@conduitplatform/grpc-sdk 0.17.0-alpha.7 → 0.17.0-alpha.9

package/dist/index.d.ts

@@ -107,9 +107,15 @@ declare enum ValidateAccessTokenResponse_Status {
 }
 declare function validateAccessTokenResponse_StatusFromJSON(object: any): ValidateAccessTokenResponse_Status;
 declare function validateAccessTokenResponse_StatusToJSON(object: ValidateAccessTokenResponse_Status): string;
+/**
+ * Issues tokens for a user without a login. This is a trusted path: it does not run a
+ * login strategy and satisfies a realm's requireTwoFa policy without a 2FA step.
+ */
 interface UserLoginRequest {
     userId: string;
     clientId: string;
+    /** realm slug the session is bound to; defaults to the user's home realm */
+    realm?: string | undefined;
 }
 declare const UserLoginRequest: MessageFns$9<UserLoginRequest>;
 interface UserCreateRequest {
@@ -118,19 +124,36 @@ interface UserCreateRequest {
     verify: boolean;
     anonymousId?: string | undefined;
     userData?: string | undefined;
+    realm?: string | undefined;
 }
 declare const UserCreateRequest: MessageFns$9<UserCreateRequest>;
 interface UserCreateByUsernameRequest {
     username: string;
     password?: string | undefined;
     anonymousId?: string | undefined;
+    realm?: string | undefined;
 }
 declare const UserCreateByUsernameRequest: MessageFns$9<UserCreateByUsernameRequest>;
 interface UserChangePass {
     email: string;
     password?: string | undefined;
+    /**
+     * Realm slug of the account to change, needed when the email is held by several accounts
+     * (isolated identity mode). 'global' names the account without a home realm. Unset: the
+     * deployment-wide lookup, which refuses an email held by several accounts.
+     */
+    realm?: string | undefined;
 }
 declare const UserChangePass: MessageFns$9<UserChangePass>;
+interface UserChangeEmail {
+    userId: string;
+    newEmail: string;
+}
+declare const UserChangeEmail: MessageFns$9<UserChangeEmail>;
+interface UserChangeEmailResponse {
+    message: string;
+}
+declare const UserChangeEmailResponse: MessageFns$9<UserChangeEmailResponse>;
 interface UserDeleteRequest {
     userId: string;
 }
@@ -167,6 +190,8 @@ interface Team {
     name: string;
     parentTeam: string;
     isDefault: boolean;
+    realmEnabled: boolean;
+    realmSlug?: string | undefined;
 }
 declare const Team: MessageFns$9<Team>;
 interface TeamDeleteResponse {
@@ -178,6 +203,15 @@ interface ModifyTeamMembersRequest {
     memberIds: string[];
 }
 declare const ModifyTeamMembersRequest: MessageFns$9<ModifyTeamMembersRequest>;
+interface GetUserRequest {
+    userId: string;
+}
+declare const GetUserRequest: MessageFns$9<GetUserRequest>;
+interface GetUserResponse {
+    /** user document as JSON, hashedPassword never included */
+    user: string;
+}
+declare const GetUserResponse: MessageFns$9<GetUserResponse>;
 interface ValidateAccessTokenRequest {
     accessToken: string;
     path?: string | undefined;
@@ -186,10 +220,14 @@ declare const ValidateAccessTokenRequest: MessageFns$9<ValidateAccessTokenReques
 interface ValidateAccessTokenResponse {
     status: ValidateAccessTokenResponse_Status;
     userId?: string | undefined;
+    /** slugs; absent for global sessions and global users */
+    realm?: string | undefined;
+    homeRealm?: string | undefined;
 }
 declare const ValidateAccessTokenResponse: MessageFns$9<ValidateAccessTokenResponse>;
 interface AnonymousUserCreateRequest {
     clientId: string;
+    realm?: string | undefined;
 }
 declare const AnonymousUserCreateRequest: MessageFns$9<AnonymousUserCreateRequest>;
 interface UserModifyStatusRequest {
@@ -229,6 +267,58 @@ interface UpdateTeamRequest {
     newParentTeamId?: string | undefined;
 }
 declare const UpdateTeamRequest: MessageFns$9<UpdateTeamRequest>;
+interface SetTeamRealmRequest {
+    teamId: string;
+    slug: string;
+    /** JSON of the realm settings (strategies, policies, registration, active); may carry secrets */
+    settingsJson?: string | undefined;
+    /** required to change the slug of an existing realm */
+    force: boolean;
+}
+declare const SetTeamRealmRequest: MessageFns$9<SetTeamRealmRequest>;
+interface GetRealmSettingsRequest {
+    teamId: string;
+}
+declare const GetRealmSettingsRequest: MessageFns$9<GetRealmSettingsRequest>;
+interface RealmResponse {
+    team: Team | undefined;
+    /** JSON of the masked realm settings, secrets never included */
+    settingsJson: string;
+    homeCount: number;
+    guestCount: number;
+}
+declare const RealmResponse: MessageFns$9<RealmResponse>;
+interface UnsetTeamRealmRequest {
+    teamId: string;
+    force: boolean;
+}
+declare const UnsetTeamRealmRequest: MessageFns$9<UnsetTeamRealmRequest>;
+interface UnsetTeamRealmResponse {
+    message: string;
+    blockedUsers: number;
+}
+declare const UnsetTeamRealmResponse: MessageFns$9<UnsetTeamRealmResponse>;
+interface RealmMembershipRequest {
+    teamId: string;
+    userId: string;
+    /** 'home' | 'guest', anything else is INVALID_ARGUMENT (ignored by RevokeRealmMembership) */
+    type: string;
+    /**
+     * GrantRealmMembership(home) only: the user already has a different home realm. Without
+     * force that is FAILED_PRECONDITION; with it the user is moved and all their tokens are
+     * revoked.
+     */
+    force: boolean;
+}
+declare const RealmMembershipRequest: MessageFns$9<RealmMembershipRequest>;
+/**
+ * Errors raised by the realm RPCs (and the other Authentication RPCs) keep their gRPC
+ * code. Module errors (REALM_NOT_FOUND, REALM_SLUG_TAKEN, GUESTS_NOT_ALLOWED...) carry
+ * the message as a JSON string, `{"conduitCode": "...", "message": "..."}`: clients
+ * should key on conduitCode. GrantRealmMembership(guest) for a user whose home realm is
+ * that realm, and GrantRealmMembership(home) over a different home realm without force,
+ * are FAILED_PRECONDITION.
+ */
 type AuthenticationDefinition = typeof AuthenticationDefinition;
 declare const AuthenticationDefinition: {
     readonly name: "Authentication";
@@ -282,6 +372,14 @@ declare const AuthenticationDefinition: {
             readonly responseStream: false;
             readonly options: {};
         };
+        readonly changeEmail: {
+            readonly name: "ChangeEmail";
+            readonly requestType: typeof UserChangeEmail;
+            readonly requestStream: false;
+            readonly responseType: typeof UserChangeEmailResponse;
+            readonly responseStream: false;
+            readonly options: {};
+        };
         readonly userDelete: {
             readonly name: "UserDelete";
             readonly requestType: typeof UserDeleteRequest;
@@ -330,6 +428,14 @@ declare const AuthenticationDefinition: {
             readonly responseStream: false;
             readonly options: {};
         };
+        readonly getUser: {
+            readonly name: "GetUser";
+            readonly requestType: typeof GetUserRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof GetUserResponse;
+            readonly responseStream: false;
+            readonly options: {};
+        };
         readonly validateAccessToken: {
             readonly name: "ValidateAccessToken";
             readonly requestType: typeof ValidateAccessTokenRequest;
@@ -362,6 +468,46 @@ declare const AuthenticationDefinition: {
             readonly responseStream: false;
             readonly options: {};
         };
+        readonly setTeamRealm: {
+            readonly name: "SetTeamRealm";
+            readonly requestType: typeof SetTeamRealmRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof RealmResponse;
+            readonly responseStream: false;
+            readonly options: {};
+        };
+        readonly getRealmSettings: {
+            readonly name: "GetRealmSettings";
+            readonly requestType: typeof GetRealmSettingsRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof RealmResponse;
+            readonly responseStream: false;
+            readonly options: {};
+        };
+        readonly unsetTeamRealm: {
+            readonly name: "UnsetTeamRealm";
+            readonly requestType: typeof UnsetTeamRealmRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof UnsetTeamRealmResponse;
+            readonly responseStream: false;
+            readonly options: {};
+        };
+        readonly grantRealmMembership: {
+            readonly name: "GrantRealmMembership";
+            readonly requestType: typeof RealmMembershipRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof Empty;
+            readonly responseStream: false;
+            readonly options: {};
+        };
+        readonly revokeRealmMembership: {
+            readonly name: "RevokeRealmMembership";
+            readonly requestType: typeof RealmMembershipRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof Empty;
+            readonly responseStream: false;
+            readonly options: {};
+        };
     };
 };
 type Builtin$9 = Date | Function | Uint8Array | string | number | boolean | undefined;
@@ -482,6 +628,34 @@ interface Decision {
     allow: boolean;
 }
 declare const Decision: MessageFns$8<Decision>;
+/**
+ * Lists actions declared on the resource definition. A direct grant for an
+ * undeclared action can still pass Can and is omitted here.
+ * actionPrefix is a literal prefix: "overview" also matches "overviewer".
+ * Prefer a separator such as "overview_" for a snake_case group.
+ * Results stay cached for about 60s. Grant, revoke, and relation changes for
+ * this subject drop the entry, as do resource create, update, and delete.
+ * Inherited access through an intermediate subject can lag until that TTL,
+ * the same as Can.
+ */
+interface SubjectPermissionsRequest {
+    subject: string;
+    resource: string;
+    actionPrefix?: string | undefined;
+}
+declare const SubjectPermissionsRequest: MessageFns$8<SubjectPermissionsRequest>;
+interface SubjectPermission {
+    action: string;
+    direct: boolean;
+    inherited: boolean;
+    implicit: boolean;
+    allowed: boolean;
+}
+declare const SubjectPermission: MessageFns$8<SubjectPermission>;
+interface SubjectPermissionsResponse {
+    permissions: SubjectPermission[];
+}
+declare const SubjectPermissionsResponse: MessageFns$8<SubjectPermissionsResponse>;
 type AuthorizationDefinition = typeof AuthorizationDefinition;
 declare const AuthorizationDefinition: {
     readonly name: "Authorization";
@@ -575,6 +749,14 @@ declare const AuthorizationDefinition: {
             readonly responseStream: false;
             readonly options: {};
         };
+        readonly getSubjectPermissions: {
+            readonly name: "GetSubjectPermissions";
+            readonly requestType: typeof SubjectPermissionsRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof SubjectPermissionsResponse;
+            readonly responseStream: false;
+            readonly options: {};
+        };
         readonly getAllowedResources: {
             readonly name: "GetAllowedResources";
             readonly requestType: typeof AllowedResourcesRequest;
@@ -626,6 +808,11 @@ interface EditMessageRequest {
     newMessage: string;
 }
 declare const EditMessageRequest: MessageFns$7<EditMessageRequest>;
+interface DeleteMessageRequest {
+    messageId: string;
+    userId: string;
+}
+declare const DeleteMessageRequest: MessageFns$7<DeleteMessageRequest>;
 interface DeleteRoomRequest {
     _id: string;
 }
@@ -677,6 +864,14 @@ declare const ChatDefinition: {
             readonly responseStream: false;
             readonly options: {};
         };
+        readonly deleteMessage: {
+            readonly name: "DeleteMessage";
+            readonly requestType: typeof DeleteMessageRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof Empty;
+            readonly responseStream: false;
+            readonly options: {};
+        };
     };
 };
 type Builtin$7 = Date | Function | Uint8Array | string | number | boolean | undefined;
@@ -1222,6 +1417,13 @@ interface MessageFns$6<T> {
     fromPartial(object: DeepPartial$6<T>): T;
 }
 
+interface SocketPushRequest {
+    event: string;
+    data?: string | undefined;
+    receivers: string[];
+    rooms: string[];
+}
+declare const SocketPushRequest: MessageFns$5<SocketPushRequest>;
 interface RegisterAdminRouteRequest {
     routes: RegisterAdminRouteRequest_PathDefinition[];
     routerUrl?: string | undefined;
@@ -1474,6 +1676,14 @@ declare const AdminDefinition: {
             readonly responseStream: false;
             readonly options: {};
         };
+        readonly socketPush: {
+            readonly name: "SocketPush";
+            readonly requestType: typeof SocketPushRequest;
+            readonly requestStream: false;
+            readonly responseType: typeof Empty;
+            readonly responseStream: false;
+            readonly options: {};
+        };
     };
 };
 type Builtin$5 = Date | Function | Uint8Array | string | number | boolean | undefined;
@@ -2809,6 +3019,16 @@ declare enum PostgresIndexType {
     GIN = "GIN",
     BRIN = "BRIN"
 }
+/**
+ * Portable ascending/descending indexes that exist on MongoDB and every SQL dialect.
+ * Map to Mongo 1/-1 and SQL BTREE ASC/DESC. Optional uniqueness lives on index options.
+ */
+declare enum CompatibleIndexType {
+    Ascending = "Ascending",
+    Descending = "Descending"
+}
+type IndexType = MongoIndexType | PostgresIndexType | CompatibleIndexType;
+type ModelOptionsIndexTypes = IndexType | readonly IndexType[];
 type Array$1 = any[];
 interface ConduitStringValidation {
     format?: 'email' | 'url' | 'uuid' | 'objectId';
@@ -2924,6 +3144,9 @@ interface ConduitSchemaOptions {
         authorization?: {
             enabled: boolean;
         };
+        realtime?: {
+            enabled: boolean;
+        };
         /** Mongoose read preference for this schema (ignored by SQL); per-query wins. */
         readPreference?: string;
     };
@@ -2932,14 +3155,16 @@ interface ConduitSchemaOptions {
     vectorIndexes?: ReadonlyArray<VectorIndexDefinition>;
 }
 interface SchemaFieldIndex {
-    type?: MongoIndexType | PostgresIndexType;
+    type?: IndexType;
     options?: MongoIndexOptions | PostgresIndexOptions;
     [field: string]: any;
 }
 interface ModelOptionsIndexes {
     fields: string[] | readonly string[];
-    types?: MongoIndexType[] | PostgresIndexType;
+    types?: ModelOptionsIndexTypes;
     options?: MongoIndexOptions | PostgresIndexOptions;
+    /** Optional. Generated deterministically when omitted. */
+    name?: string;
     [field: string]: any;
 }
 interface MongoIndexOptions {
@@ -3138,6 +3363,16 @@ interface ConduitRouteOptions {
      * by security middleware are excluded.
      */
     captureRawHeaders?: boolean;
+    /**
+     * Whether module-tools hydrates context.user from the user id of a verified access token.
+     * Defaults to true.
+     *
+     * DEPRECATION: the default-true behavior is deprecated. The default flips to false in the
+     * next major version; modules will call grpcSdk.authentication.getUser explicitly. Set
+     * this to false now on routes that do not need context.user, and call getUser yourself
+     * on those that do.
+     */
+    hydrateUser?: boolean;
 }
 interface ConduitRouteObject {
     options: ConduitRouteOptions;
@@ -3441,6 +3676,28 @@ interface IConduitMetrics {
     observe(metric: string, value: number, labels?: LabelValues<any>): void;
 }
 
+/** Claims carried by a short-lived Ed25519-signed access token ("jwt" session mode). */
+interface AccessTokenClaims {
+    sub: string;
+    sid: string;
+    cid: string;
+    rid?: string;
+    realm?: string;
+    home?: string;
+    rtype?: 'home' | 'guest';
+    authorized: boolean;
+    sudo: boolean;
+    tv: number;
+    teams?: {
+        id: string;
+        role: string;
+    }[];
+    teamsTruncated?: boolean;
+    iat: number;
+    exp: number;
+    iss: string;
+}
+
 declare class ConduitSchema {
     readonly name: string;
     readonly fields: ConduitModel;
@@ -3784,6 +4041,7 @@ declare class Admin extends ConduitModule<typeof AdminDefinition> {
     readonly moduleName: string;
     constructor(moduleName: string, url: string, grpcToken?: string);
     register(paths: RegisterAdminRouteRequest_PathDefinition[], serverUrl?: string): Promise<any>;
+    socketPush(data: SocketPushRequest): Promise<Empty>;
     patchRouteMiddlewares(path: string, action: ConduitRouteActions, middlewares: string[]): Promise<Empty>;
 }
 
@@ -3831,6 +4089,7 @@ declare class Chat extends ConduitModule<typeof ChatDefinition> {
     constructor(moduleName: string, url: string, grpcToken?: string);
     sendMessage(messageData: SendMessageInput): Promise<any>;
     editMessage(messageData: EditMessageRequest): Promise<any>;
+    deleteMessage(messageData: DeleteMessageRequest): Promise<any>;
     createRoom(name: string, participants: string[]): Promise<Room>;
     deleteRoom(id: string): Promise<Room>;
 }
@@ -3847,21 +4106,103 @@ declare class Authorization extends ConduitModule<typeof AuthorizationDefinition
     createRelations(subject: string, relation: string, resources: string[]): Promise<unknown>;
     findRelation(data: FindRelationRequest): Promise<FindRelationResponse>;
     can(data: PermissionCheck): Promise<Decision>;
+    /**
+     * Lists actions declared on the resource definition.
+     * A direct grant for an undeclared action can still pass `can()` and is omitted.
+     * `actionPrefix` is literal (`overview` also matches `overviewer`; prefer `overview_`).
+     * Subject and resource-definition changes drop the ~60s cache immediately.
+     * Inherited access through an intermediate subject can lag until the TTL, as with `can()`.
+     */
+    getSubjectPermissions(data: SubjectPermissionsRequest): Promise<SubjectPermissionsResponse>;
     grantPermission(data: PermissionRequest): Promise<unknown>;
     removePermission(data: PermissionRequest): Promise<unknown>;
     getAllowedResources(data: AllowedResourcesRequest): Promise<AllowedResourcesResponse>;
     createResourceAccessList(data: ResourceAccessListRequest): Promise<ResourceAccessListResponse>;
 }
 
+declare class RedisManager {
+    redisConnection: RedisOptions | {
+        nodes: {
+            host: string;
+            port: number;
+        }[];
+        options: ClusterOptions;
+    };
+    constructor(redisDetails?: RedisOptions | {
+        nodes: {
+            host: string;
+            port: number;
+        }[];
+        options: ClusterOptions;
+    });
+    getClient(options?: RedisOptions | {
+        nodes: {
+            host: string;
+            port: number;
+        }[];
+        options: ClusterOptions;
+    }): Redis | Cluster;
+}
+
+declare const USER_CACHE_PREFIX = "auth_user_";
+declare const USER_CACHE_TTL_MS = 5000;
+/**
+ * Short-lived Redis cache of user documents, stored under `auth_user_<id>` (the prefix is
+ * part of the key itself, so the layout is identical on standalone Redis and Cluster).
+ *
+ * Every operation is bounded by a 200 ms timeout and degrades to a passthrough (miss /
+ * no-op) when Redis fails or is unreachable.
+ *
+ * Staleness: entries live for up to 5 s (`USER_CACHE_TTL_MS`). `invalidate` is not atomic
+ * with a concurrent miss: a reader that fetched the user before the invalidation can write
+ * the stale document back afterwards, where it stays for up to the TTL.
+ */
+declare class UserCache {
+    private readonly client;
+    constructor(redisManager: Pick<RedisManager, 'getClient'>);
+    private key;
+    get(id: string): Promise<Indexable | null>;
+    set(id: string, user: Indexable): Promise<void>;
+    invalidate(id: string): Promise<void>;
+    invalidateMany(ids: string[]): Promise<void>;
+}
+
 declare class Authentication extends ConduitModule<typeof AuthenticationDefinition> {
     private readonly moduleName;
     constructor(moduleName: string, url: string, grpcToken?: string);
-    userLogin(userId: string, clientId: string): Promise<UserLoginResponse>;
+    private userCacheProvider?;
+    /**
+     * Attaches a cache (or a lazy provider of one, resolved on every `getUser` call so that
+     * no Redis connection is opened until it is needed) that `getUser` reads through.
+     */
+    attachUserCache(cache: UserCache | (() => UserCache | undefined) | undefined): void;
+    hasUserCache(): boolean;
+    /**
+     * Fetches a user document (never includes `hashedPassword`), reading through the
+     * attached user cache (5 s TTL, see UserCache) when there is one. Cache problems never
+     * fail or delay the call beyond the cache's own timeout; the cache write is fire-and-forget.
+     *
+     * The server answers gRPC NOT_FOUND for an unknown id and this method rejects with that
+     * error (an empty response is also turned into a `GrpcError` NOT_FOUND).
+     */
+    getUser(userId: string): Promise<Indexable>;
+    /**
+     * Issues tokens for a user without a login. Trusted path: it runs no login strategy
+     * and satisfies a realm's `requireTwoFa` policy without a 2FA step. `realm` (slug)
+     * defaults to the user's home realm.
+     */
+    userLogin(userId: string, clientId: string, realm?: string): Promise<UserLoginResponse>;
     userDelete(userId: string): Promise<UserDeleteResponse>;
-    userCreate(email: string, verify?: boolean, password?: string, anonymousId?: string, userData?: Indexable): Promise<UserCreateResponse>;
-    userCreateByUsername(username: string, password?: string, anonymousId?: string): Promise<UserCreateResponse>;
-    anonymousUserCreate(clientId: string): Promise<UserLoginResponse>;
-    changePass(email: string, password?: string): Promise<UserCreateResponse>;
+    userCreate(email: string, verify?: boolean, password?: string, anonymousId?: string, userData?: Indexable, realm?: string): Promise<UserCreateResponse>;
+    userCreateByUsername(username: string, password?: string, anonymousId?: string, realm?: string): Promise<UserCreateResponse>;
+    anonymousUserCreate(clientId: string, realm?: string): Promise<UserLoginResponse>;
+    /**
+     * Sets a new password. `realm` picks the account when the email is held by several accounts
+     * (isolated identity mode): a realm slug picks that realm's account, `'global'` picks the
+     * account without a home realm. Without it such an email is refused with FAILED_PRECONDITION.
+     */
+    changePass(email: string, password?: string, realm?: string): Promise<UserCreateResponse>;
+    changeEmail(userId: string, newEmail: string): Promise<UserChangeEmailResponse>;
     getTeam(teamId: string): Promise<Team>;
     createTeam(name: string, parentTeam?: string, isDefault?: boolean): Promise<Team>;
     teamDelete(teamId: string): Promise<TeamDeleteResponse>;
@@ -3872,6 +4213,31 @@ declare class Authentication extends ConduitModule<typeof AuthenticationDefiniti
     invitationDelete(teamId: string, email: string): Promise<InvitationDeleteResponse>;
     inviteUserToTeam(teamId: string, email: string, role: string, inviterUserId: string, redirectUri?: string, userData?: Indexable): Promise<InviteUserToTeamResponse>;
     updateTeam(teamId: string, name?: string, newParentTeamId?: string): Promise<Team>;
+    /**
+     * Turns a top-level team into a realm, or updates the settings of an existing realm.
+     * `settings` is the realm settings body (strategies, policies, registration, active);
+     * it may carry OAuth secrets (write-only). Changing the slug of an existing realm
+     * needs `force`.
+     * Errors keep their gRPC code; module errors (REALM_SLUG_TAKEN, REALM_NESTED,
+     * GUESTS_NOT_ALLOWED...) carry a JSON string message (`{"conduitCode", "message"}`),
+     * so key on `conduitCode`.
+     */
+    setTeamRealm(teamId: string, slug: string, settings?: Indexable, force?: boolean): Promise<RealmResponse>;
+    /** The team, its masked realm settings (`settingsJson`, no secrets) and user counts. */
+    getRealmSettings(teamId: string): Promise<RealmResponse>;
+    /** Demotes a realm. Refused while home users exist unless `force`, which blocks them. */
+    unsetTeamRealm(teamId: string, force?: boolean): Promise<UnsetTeamRealmResponse>;
+    /**
+     * `home` makes the realm the user's home realm, `guest` adds a guest membership.
+     * Fails with FAILED_PRECONDITION when `home` would replace a different home realm
+     * (unless `force`, which moves the user and revokes all their tokens) and when `guest`
+     * is requested for a user whose home realm is this realm.
+     * Errors keep their gRPC code; module errors carry a JSON string message
+     * (`{"conduitCode", "message"}`), so key on `conduitCode`.
+     */
+    grantRealmMembership(teamId: string, userId: string, type: 'home' | 'guest', force?: boolean): Promise<Empty>;
+    /** Removes a guest membership (home users are moved, not removed). */
+    revokeRealmMembership(teamId: string, userId: string): Promise<Empty>;
 }
 
 declare class Communications extends ConduitModule<typeof CommunicationsDefinition> {
@@ -4030,40 +4396,27 @@ declare class Communications extends ConduitModule<typeof CommunicationsDefiniti
 
 declare function sleep(ms: number): Promise<unknown>;
 
-declare class RedisManager {
-    redisConnection: RedisOptions | {
-        nodes: {
-            host: string;
-            port: number;
-        }[];
-        options: ClusterOptions;
-    };
-    constructor(redisDetails?: RedisOptions | {
-        nodes: {
-            host: string;
-            port: number;
-        }[];
-        options: ClusterOptions;
-    });
-    getClient(options?: RedisOptions | {
-        nodes: {
-            host: string;
-            port: number;
-        }[];
-        options: ClusterOptions;
-    }): Redis | Cluster;
-}
-
 declare class EventBus {
     private _clientSubscriber;
     private _clientPublisher;
-    private _subscribedChannels;
-    private _subscribers;
+    /** channelName -> subscriberId -> callback */
+    private _channelCallbacks;
+    /** subscriberId -> channelName */
+    private _subscriberChannels;
+    /** channels with a successful Redis SUBSCRIBE */
+    private _redisSubscribedChannels;
+    private _subscribeInFlight;
     private _signature;
+    private _anonymousSubscriberSeq;
+    private _shuttingDown;
     constructor(redisManager: RedisManager);
+    quit(): void;
     unsubscribe(subscriberId: string): void;
     subscribe(channelName: string, callback: (message: string) => void, subscriberId?: string): void;
+    subscribeAck(channelName: string, callback: (message: string) => void, subscriberId?: string): Promise<void>;
     publish(channelName: string, message: string): void;
+    private removeChannelCallbacks;
+    private dispatch;
 }
 
 declare class StateManager {
@@ -4089,6 +4442,42 @@ declare class StateManager {
     setKey(keyName: string, value: any, expiry?: number): Promise<"OK">;
     clearKey(keyName: string): Promise<number>;
     getKey(keyName: string): Promise<string | null>;
+    /**
+     * Deletes keyName and resolves true when it holds value. A mismatch is counted in
+     * attemptsKey (expiring with keyName), and the maxAttempts-th mismatch deletes keyName.
+     * Both keys must share a hash tag for Redis Cluster.
+     */
+    consumeKeyIfMatches(keyName: string, attemptsKey: string, value: string, maxAttempts: number): Promise<boolean>;
+    incr(keyName: string): Promise<number>;
+}
+
+declare const SESSION_REGISTRY_PREFIX = "auth_session_";
+interface SessionRegistryData {
+    user: string;
+    clientId: string;
+    realm?: string | null;
+}
+/**
+ * Redis registry of live sessions, one `auth_session_<sid>` key per session (the prefix is
+ * part of the key itself, so the layout is identical on standalone Redis and Cluster).
+ *
+ * Every operation is bounded by a 500 ms timeout and rejects with
+ * `Error('Session registry unavailable')` when Redis fails or is unreachable, so callers
+ * can fail closed.
+ */
+declare class SessionRegistry {
+    private readonly client;
+    constructor(redisManager: Pick<RedisManager, 'getClient'>);
+    private key;
+    private run;
+    private static ttl;
+    register(sid: string, data: SessionRegistryData, ttlMs: number): Promise<void>;
+    /** Extends the session's lifetime. Does nothing for an unknown session. */
+    touch(sid: string, ttlMs: number): Promise<void>;
+    exists(sid: string): Promise<boolean>;
+    revoke(sid: string): Promise<void>;
+    /** Attempts every sid; throws an Error listing the sids that could not be revoked. */
+    revokeMany(sids: string[]): Promise<void>;
 }
 
 declare enum PlatformTypesEnum {
@@ -4115,6 +4504,8 @@ declare class ConduitGrpcSdk {
     private _dynamicModules;
     private _eventBus?;
     private _stateManager?;
+    private _userCache?;
+    private _sessionRegistry?;
     private lastSearch;
     private readonly urlRemap?;
     private readonly _serviceHealthStatusGetter;
@@ -4140,6 +4531,10 @@ declare class ConduitGrpcSdk {
     };
     get bus(): EventBus | null;
     get state(): StateManager | null;
+    /** Redis-backed user cache. Throws when Redis is not initialized. */
+    get userCache(): UserCache;
+    /** Redis-backed session registry. Throws when Redis is not initialized. */
+    get sessionRegistry(): SessionRegistry;
     get core(): Core;
     get config(): Config;
     get admin(): Admin;
@@ -4195,4 +4590,4 @@ declare class ConduitGrpcSdk {
     private _initialize;
 }
 
-export { Admin, AdminDefinition, AdminRouterDefinition, AllowedResourcesRequest, AllowedResourcesResponse, AnonymousUserCreateRequest, type Array$1 as Array, type ArrayConduitModel, Attachment, Authentication, AuthenticationDefinition, Authorization, AuthorizationDefinition, type AuthzOptions, type AwaitPeerOptions, BackfillMutationResponse, BackfillRun, type BackfillRunRecord, type BasicConduitModelField, type BodyParams, CancelBackfillRequest, Chat, ChatDefinition, ClientRouterDefinition, ColumnExistenceRequest, ColumnExistenceResponse, Communications, CommunicationsDefinition, type ConduitArrayValidation, ConduitAuthorizedResource, ConduitError, ConduitGrpcSdk, type ConduitMiddlewareOptions, type ConduitModel, type ConduitModelField, type ConduitModelFieldEnum, type ConduitModelFieldJSON, type ConduitModelFieldRelation, type ConduitModelFieldVector, ConduitModelOptionsPermModifyType, ConduitModule, ConduitModuleDefinition, type ConduitNumberValidation, type ConduitQueryParam, type ConduitQueryParams, type ConduitReturn, type ConduitReturnField, type ConduitReturnModel, type ConduitRoute, ConduitRouteActions, type ConduitRouteObject, type ConduitRouteOptions, type ConduitRouteParameters, ConduitRouteReturnDefinition, ConduitSchema, type ConduitSchemaExtension, type ConduitSchemaOptions, type ConduitSocketOptions, type ConduitSocketParamTypes, type ConduitStringValidation, type ConduitUrlParam, type ConduitUrlParams, type ConduitValidationRules, Config, ConfigDefinition, type Context, Cookie, CookieOptions, type Cookies, Core, CoreDefinition, type CountDocumentsOptions, CreateFileByUrlRequest, CreateFileRequest, CreateRelationsRequest, CreateRoomRequest, CreateSchemaRequest, CreateTeamRequest, CreateViewRequest, CreateViewRequest_RawQuery, DatabaseProvider, DatabaseProviderDefinition, Decision, DeleteAllRelationsRequest, DeleteCommunicationTemplateRequest, DeleteCommunicationTemplateResponse, DeleteConfigRequest, DeleteEmbeddingConfigRequest, DeleteEmbeddingConfigResponse, DeleteFileResponse, DeleteResourceRequest, DeleteRoomRequest, DeleteVectorIndexRequest, DeleteViewRequest, type Document$1 as Document, DropCollectionRequest, DropCollectionResponse, EditMessageRequest, Email, EmbeddingConfig, type EmbeddingConfigInput, type EmbeddingConfigRecord, EmbeddingsProvider, EmbeddingsProviderDefinition, type EmbeddingsStatus, type EventsProtoDescription, ExportResourcesRequest, ExportResourcesResponse, FileByUrlResponse, FileResponse, type FindManyOptions, type FindOneOptions, FindOneRequest, FindRelationRequest, FindRelationResponse, FindRequest, FindRequest_SortEntry, GetBackfillRequest, GetCapabilitiesRequest, GetCapabilitiesResponse, GetCommunicationTemplateRequest, GetCommunicationTemplateResponse, GetConfigRequest, GetConfigResponse, GetConfigsRequest, GetConfigsResponse, GetDatabaseTypeResponse, GetEmailStatusRequest, GetEmailStatusResponse, GetExportableResourcesRequest, GetExportableResourcesResponse, GetFileDataResponse, GetFileRequest, GetFileUrlRequest, GetFileUrlResponse, GetMessageStatusRequest, GetMessageStatusResponse, GetNotificationTokensRequest, GetNotificationTokensResponse, GetRedisDetailsResponse, GetRoomResponse, GetSchemaRequest, GetSchemasRequest, GetSchemasResponse, GetStatusRequest, GetStatusResponse, GetTeamRequest, type GrpcCallback, GrpcError, type GrpcRequest, type GrpcResponse, type Headers$1 as Headers, HealthCheckRequest, HealthCheckResponse, HealthCheckResponse_ServingStatus, HealthCheckStatus, HealthDefinition, type IConduitLogger, type IConduitMetrics, ImportResourcesRequest, ImportResourcesResponse, type Indexable, InvitationDeleteRequest, InvitationDeleteResponse, InviteUserToTeamRequest, InviteUserToTeamResponse, ListBackfillsRequest, ListBackfillsResponse, ListCommunicationTemplatesRequest, ListCommunicationTemplatesResponse, MetricType, MigrateRequest, type ModelOptionsIndexes, ModifyTeamMembersRequest, ModuleByNameRequest, ModuleByNameResponse, type ModuleErrorDefinition, ModuleExistsRequest, ModuleExistsResponse, ModuleHealthRequest, ModuleListResponse, ModuleListResponse_ModuleResponse, type MongoIndexOptions, MongoIndexType, type Params, type ParsedRouterRequest, type ParsedSocketRequest, PatchAppRouteMiddlewaresRequest, PatchRouteMiddlewaresRequest, type PeerWatchBatchOptions, type PeerWatchEdge, type PeerWatchOptions, type PeerWatchSpec, PermissionCheck, PermissionRequest, PlatformTypesEnum, type PopulateAuthzOptions, type PostgresIndexOptions, PostgresIndexType, PushNotifications, type Query, type QueryParams, QueryRequest, QueryResponse, type QueueCounts, type RateLimitOptions, type RawMongoQuery, type RawQuery, RawQueryRequest, RawQueryRequest_RawQuery, RawQueryRequest_RawQuery_MongoQuery, RawQueryRequest_RawQuery_SQLQuery, type RawSQLQuery, RegisterAdminRouteRequest, RegisterAdminRouteRequest_ConduitRouteOptions, RegisterAdminRouteRequest_ConduitRouteReturnDefinition, RegisterAdminRouteRequest_ErrorDefinition, RegisterAdminRouteRequest_PathDefinition, RegisterCommunicationTemplateRequest, RegisterCommunicationTemplateRequest_CommunicationTemplate, RegisterCommunicationTemplateRequest_CommunicationTemplate_EmailTemplate, RegisterCommunicationTemplateRequest_CommunicationTemplate_PushTemplate, RegisterCommunicationTemplateRequest_CommunicationTemplate_SmsTemplate, RegisterCommunicationTemplateResponse, RegisterConduitRouteRequest, RegisterConduitRouteRequest_ConduitRouteOptions, RegisterConduitRouteRequest_ConduitRouteReturnDefinition, RegisterConduitRouteRequest_ErrorDefinition, RegisterConduitRouteRequest_PathDefinition, RegisterModuleRequest, RegisterModuleResponse, RegisterModulesConfigRequest, RegisterTemplateRequest, RegisterTemplateResponse, Relation, Request, ResendEmailRequest, ResendEmailResponse, Resource, ResourceAccessListRequest, ResourceAccessListResponse, ResourceModificationAcknowledgement, ResourceModificationAcknowledgement_Status, Resource_Permission, Resource_Relation, Response, ResumeBackfillRequest, Room, type Route, Router, RouterDefinition, SMS, SQLDataType, Schema, SchemaExtension, type SchemaFieldIndex, SemanticSearchHit, type SemanticSearchInput, SemanticSearchRequest, SemanticSearchResponse, SendCommunicationRequest, SendCommunicationRequest_SendCommunicationParams, SendCommunicationResponse, SendEmailRequest, SendEmailRequest_SendEmailParams, SendEmailResponse, SendManyNotificationsRequest, type SendMessageInput, SendMessageRequest, SendNotificationRequest, SendNotificationResponse, SendNotificationToManyDevicesRequest, SendSmsRequest, SendSmsResponse, SendToMultipleChannelsRequest, SendToMultipleChannelsRequest_SendCommunicationParams, SendToMultipleChannelsResponse, SendToMultipleChannelsResponse_ChannelResult, SendVerificationCodeRequest, SendVerificationCodeResponse, SendWithFallbackRequest, SendWithFallbackRequest_FallbackStep, SendWithFallbackRequest_SendCommunicationParams, SendWithFallbackResponse, SendWithFallbackResponse_ChannelResult, SetConfigRequest, SetConfigResponse, SetNotificationTokenRequest, SetNotificationTokenResponse, SocketData, type SocketProtoDescription, SocketRequest, SocketResponse, type StartBackfillInput, StartBackfillRequest, StartBackfillResponse, Storage, StorageDefinition, TYPE, Team, TeamDeleteRequest, TeamDeleteResponse, type UnparsedRouterResponse, type UnparsedSocketResponse, type UntypedArray, UpdateCommunicationTemplateRequest, UpdateConfigRequest, UpdateConfigResponse, UpdateFileByUrlRequest, UpdateFileRequest, UpdateManyRequest, UpdateRequest, UpdateTeamRequest, UpdateTemplateRequest, UpsertConfigRequest, UpsertConfigResponse, type UrlParams, UserChangePass, UserCreateByUsernameRequest, UserCreateRequest, UserCreateResponse, UserDeleteRequest, UserDeleteResponse, UserLoginRequest, UserLoginResponse, UserModifyStatusRequest, UserModifyStatusResponse, ValidateAccessTokenRequest, ValidateAccessTokenResponse, ValidateAccessTokenResponse_Status, type VectorCapabilities, VectorCapabilitiesRequest, VectorCapabilitiesResponse, VectorIndex, type VectorIndexDefinition, VectorIndexListRequest, VectorIndexListResponse, VectorIndexMethod, VectorIndexRequest, VectorIndexStatus, type VectorSearchInput, type VectorSearchProvider, VectorSearchRequest, type VectorSearchResult, VectorSimilarity, VerifyRequest, VerifyResponse, type allowedTypes, checkModuleHealth, defaultVectorIndexMethod, healthCheckResponse_ServingStatusFromJSON, healthCheckResponse_ServingStatusToJSON, resourceModificationAcknowledgement_StatusFromJSON, resourceModificationAcknowledgement_StatusToJSON, validateAccessTokenResponse_StatusFromJSON, validateAccessTokenResponse_StatusToJSON, vectorIndexMethodsEquivalent };
+export { type AccessTokenClaims, Admin, AdminDefinition, AdminRouterDefinition, AllowedResourcesRequest, AllowedResourcesResponse, AnonymousUserCreateRequest, type Array$1 as Array, type ArrayConduitModel, Attachment, Authentication, AuthenticationDefinition, Authorization, AuthorizationDefinition, type AuthzOptions, type AwaitPeerOptions, BackfillMutationResponse, BackfillRun, type BackfillRunRecord, type BasicConduitModelField, type BodyParams, CancelBackfillRequest, Chat, ChatDefinition, ClientRouterDefinition, ColumnExistenceRequest, ColumnExistenceResponse, Communications, CommunicationsDefinition, CompatibleIndexType, type ConduitArrayValidation, ConduitAuthorizedResource, ConduitError, ConduitGrpcSdk, type ConduitMiddlewareOptions, type ConduitModel, type ConduitModelField, type ConduitModelFieldEnum, type ConduitModelFieldJSON, type ConduitModelFieldRelation, type ConduitModelFieldVector, ConduitModelOptionsPermModifyType, ConduitModule, ConduitModuleDefinition, type ConduitNumberValidation, type ConduitQueryParam, type ConduitQueryParams, type ConduitReturn, type ConduitReturnField, type ConduitReturnModel, type ConduitRoute, ConduitRouteActions, type ConduitRouteObject, type ConduitRouteOptions, type ConduitRouteParameters, ConduitRouteReturnDefinition, ConduitSchema, type ConduitSchemaExtension, type ConduitSchemaOptions, type ConduitSocketOptions, type ConduitSocketParamTypes, type ConduitStringValidation, type ConduitUrlParam, type ConduitUrlParams, type ConduitValidationRules, Config, ConfigDefinition, type Context, Cookie, CookieOptions, type Cookies, Core, CoreDefinition, type CountDocumentsOptions, CreateFileByUrlRequest, CreateFileRequest, CreateRelationsRequest, CreateRoomRequest, CreateSchemaRequest, CreateTeamRequest, CreateViewRequest, CreateViewRequest_RawQuery, DatabaseProvider, DatabaseProviderDefinition, Decision, DeleteAllRelationsRequest, DeleteCommunicationTemplateRequest, DeleteCommunicationTemplateResponse, DeleteConfigRequest, DeleteEmbeddingConfigRequest, DeleteEmbeddingConfigResponse, DeleteFileResponse, DeleteMessageRequest, DeleteResourceRequest, DeleteRoomRequest, DeleteVectorIndexRequest, DeleteViewRequest, type Document$1 as Document, DropCollectionRequest, DropCollectionResponse, EditMessageRequest, Email, EmbeddingConfig, type EmbeddingConfigInput, type EmbeddingConfigRecord, EmbeddingsProvider, EmbeddingsProviderDefinition, type EmbeddingsStatus, type EventsProtoDescription, ExportResourcesRequest, ExportResourcesResponse, FileByUrlResponse, FileResponse, type FindManyOptions, type FindOneOptions, FindOneRequest, FindRelationRequest, FindRelationResponse, FindRequest, FindRequest_SortEntry, GetBackfillRequest, GetCapabilitiesRequest, GetCapabilitiesResponse, GetCommunicationTemplateRequest, GetCommunicationTemplateResponse, GetConfigRequest, GetConfigResponse, GetConfigsRequest, GetConfigsResponse, GetDatabaseTypeResponse, GetEmailStatusRequest, GetEmailStatusResponse, GetExportableResourcesRequest, GetExportableResourcesResponse, GetFileDataResponse, GetFileRequest, GetFileUrlRequest, GetFileUrlResponse, GetMessageStatusRequest, GetMessageStatusResponse, GetNotificationTokensRequest, GetNotificationTokensResponse, GetRealmSettingsRequest, GetRedisDetailsResponse, GetRoomResponse, GetSchemaRequest, GetSchemasRequest, GetSchemasResponse, GetStatusRequest, GetStatusResponse, GetTeamRequest, GetUserRequest, GetUserResponse, type GrpcCallback, GrpcError, type GrpcRequest, type GrpcResponse, type Headers$1 as Headers, HealthCheckRequest, HealthCheckResponse, HealthCheckResponse_ServingStatus, HealthCheckStatus, HealthDefinition, type IConduitLogger, type IConduitMetrics, ImportResourcesRequest, ImportResourcesResponse, type IndexType, type Indexable, InvitationDeleteRequest, InvitationDeleteResponse, InviteUserToTeamRequest, InviteUserToTeamResponse, ListBackfillsRequest, ListBackfillsResponse, ListCommunicationTemplatesRequest, ListCommunicationTemplatesResponse, MetricType, MigrateRequest, type ModelOptionsIndexTypes, type ModelOptionsIndexes, ModifyTeamMembersRequest, ModuleByNameRequest, ModuleByNameResponse, type ModuleErrorDefinition, ModuleExistsRequest, ModuleExistsResponse, ModuleHealthRequest, ModuleListResponse, ModuleListResponse_ModuleResponse, type MongoIndexOptions, MongoIndexType, type Params, type ParsedRouterRequest, type ParsedSocketRequest, PatchAppRouteMiddlewaresRequest, PatchRouteMiddlewaresRequest, type PeerWatchBatchOptions, type PeerWatchEdge, type PeerWatchOptions, type PeerWatchSpec, PermissionCheck, PermissionRequest, PlatformTypesEnum, type PopulateAuthzOptions, type PostgresIndexOptions, PostgresIndexType, PushNotifications, type Query, type QueryParams, QueryRequest, QueryResponse, type QueueCounts, type RateLimitOptions, type RawMongoQuery, type RawQuery, RawQueryRequest, RawQueryRequest_RawQuery, RawQueryRequest_RawQuery_MongoQuery, RawQueryRequest_RawQuery_SQLQuery, type RawSQLQuery, RealmMembershipRequest, RealmResponse, RegisterAdminRouteRequest, RegisterAdminRouteRequest_ConduitRouteOptions, RegisterAdminRouteRequest_ConduitRouteReturnDefinition, RegisterAdminRouteRequest_ErrorDefinition, RegisterAdminRouteRequest_PathDefinition, RegisterCommunicationTemplateRequest, RegisterCommunicationTemplateRequest_CommunicationTemplate, RegisterCommunicationTemplateRequest_CommunicationTemplate_EmailTemplate, RegisterCommunicationTemplateRequest_CommunicationTemplate_PushTemplate, RegisterCommunicationTemplateRequest_CommunicationTemplate_SmsTemplate, RegisterCommunicationTemplateResponse, RegisterConduitRouteRequest, RegisterConduitRouteRequest_ConduitRouteOptions, RegisterConduitRouteRequest_ConduitRouteReturnDefinition, RegisterConduitRouteRequest_ErrorDefinition, RegisterConduitRouteRequest_PathDefinition, RegisterModuleRequest, RegisterModuleResponse, RegisterModulesConfigRequest, RegisterTemplateRequest, RegisterTemplateResponse, Relation, Request, ResendEmailRequest, ResendEmailResponse, Resource, ResourceAccessListRequest, ResourceAccessListResponse, ResourceModificationAcknowledgement, ResourceModificationAcknowledgement_Status, Resource_Permission, Resource_Relation, Response, ResumeBackfillRequest, Room, type Route, Router, RouterDefinition, SESSION_REGISTRY_PREFIX, SMS, SQLDataType, Schema, SchemaExtension, type SchemaFieldIndex, SemanticSearchHit, type SemanticSearchInput, SemanticSearchRequest, SemanticSearchResponse, SendCommunicationRequest, SendCommunicationRequest_SendCommunicationParams, SendCommunicationResponse, SendEmailRequest, SendEmailRequest_SendEmailParams, SendEmailResponse, SendManyNotificationsRequest, type SendMessageInput, SendMessageRequest, SendNotificationRequest, SendNotificationResponse, SendNotificationToManyDevicesRequest, SendSmsRequest, SendSmsResponse, SendToMultipleChannelsRequest, SendToMultipleChannelsRequest_SendCommunicationParams, SendToMultipleChannelsResponse, SendToMultipleChannelsResponse_ChannelResult, SendVerificationCodeRequest, SendVerificationCodeResponse, SendWithFallbackRequest, SendWithFallbackRequest_FallbackStep, SendWithFallbackRequest_SendCommunicationParams, SendWithFallbackResponse, SendWithFallbackResponse_ChannelResult, SessionRegistry, type SessionRegistryData, SetConfigRequest, SetConfigResponse, SetNotificationTokenRequest, SetNotificationTokenResponse, SetTeamRealmRequest, SocketData, type SocketProtoDescription, SocketPushRequest, SocketRequest, SocketResponse, type StartBackfillInput, StartBackfillRequest, StartBackfillResponse, Storage, StorageDefinition, SubjectPermission, SubjectPermissionsRequest, SubjectPermissionsResponse, TYPE, Team, TeamDeleteRequest, TeamDeleteResponse, USER_CACHE_PREFIX, USER_CACHE_TTL_MS, type UnparsedRouterResponse, type UnparsedSocketResponse, UnsetTeamRealmRequest, UnsetTeamRealmResponse, type UntypedArray, UpdateCommunicationTemplateRequest, UpdateConfigRequest, UpdateConfigResponse, UpdateFileByUrlRequest, UpdateFileRequest, UpdateManyRequest, UpdateRequest, UpdateTeamRequest, UpdateTemplateRequest, UpsertConfigRequest, UpsertConfigResponse, type UrlParams, UserCache, UserChangeEmail, UserChangeEmailResponse, UserChangePass, UserCreateByUsernameRequest, UserCreateRequest, UserCreateResponse, UserDeleteRequest, UserDeleteResponse, UserLoginRequest, UserLoginResponse, UserModifyStatusRequest, UserModifyStatusResponse, ValidateAccessTokenRequest, ValidateAccessTokenResponse, ValidateAccessTokenResponse_Status, type VectorCapabilities, VectorCapabilitiesRequest, VectorCapabilitiesResponse, VectorIndex, type VectorIndexDefinition, VectorIndexListRequest, VectorIndexListResponse, VectorIndexMethod, VectorIndexRequest, VectorIndexStatus, type VectorSearchInput, type VectorSearchProvider, VectorSearchRequest, type VectorSearchResult, VectorSimilarity, VerifyRequest, VerifyResponse, type allowedTypes, checkModuleHealth, defaultVectorIndexMethod, healthCheckResponse_ServingStatusFromJSON, healthCheckResponse_ServingStatusToJSON, resourceModificationAcknowledgement_StatusFromJSON, resourceModificationAcknowledgement_StatusToJSON, validateAccessTokenResponse_StatusFromJSON, validateAccessTokenResponse_StatusToJSON, vectorIndexMethodsEquivalent };