@fusebase/fusebase-gate-sdk 2.3.34-sdk.9 → 2.5.0

package/dist/apis/FusebaseAuthApi.d.ts

@@ -5,7 +5,7 @@
  * Domain: fusebase-auth
  */
 import type { Client } from "../runtime/transport";
-import type { FusebaseAuthChallengeRequestContract, FusebaseAuthChallengeResponseContract, FusebaseAuthLoginRequestContract, FusebaseAuthLoginResponseContract, FusebaseAuthLogoutResponseContract, FusebaseAuthPasswordResetRequestContract, FusebaseAuthPasswordResetResponseContract, FusebaseAuthPasswordRestoreKeyResponseContract, FusebaseAuthPasswordRestoreRequestContract, FusebaseAuthPasswordRestoreResponseContract, FusebaseAuthRegisterMemberRequestContract, FusebaseAuthRegisterMemberResponseContract, FusebaseAuthRegisterRequestContract, FusebaseAuthRegisterResponseContract, FusebaseAuthRestoreKeyRequestContract, FusebaseAuthRestoreKeyResponseContract, orgIdInPathRequired } from "../types";
+import type { FusebaseAuthChallengeRequestContract, FusebaseAuthChallengeResponseContract, FusebaseAuthLoginRequestContract, FusebaseAuthLoginResponseContract, FusebaseAuthLogoutResponseContract, FusebaseAuthPasswordResetRequestContract, FusebaseAuthPasswordResetResponseContract, FusebaseAuthPasswordRestoreKeyResponseContract, FusebaseAuthPasswordRestoreRequestContract, FusebaseAuthPasswordRestoreResponseContract, FusebaseAuthRegisterMemberRequestContract, FusebaseAuthRegisterMemberResponseContract, FusebaseAuthRegisterRequestContract, FusebaseAuthRegisterResponseContract, FusebaseAuthRestoreKeyRequestContract, FusebaseAuthRestoreKeyResponseContract, FusebaseAuthSetInitialPasswordRequestContract, FusebaseAuthSetInitialPasswordResponseContract, orgIdInPathRequired } from "../types";
 export declare class FusebaseAuthApi {
     private client;
     constructor(client: Client);
@@ -63,7 +63,7 @@ export declare class FusebaseAuthApi {
     }): Promise<FusebaseAuthRegisterResponseContract>;
     /**
      * Request Fusebase password restore
-     * Visitor-safe password restore request. Forwards to auth-form `/auth/api/remind` and always returns a generic success shape so the route does not enumerate accounts. The email link is `${customAuthUrl}/resetpass?key=<key>` (platform appends `/resetpass` and puts the key in query param `key`). When both `portalId` and `workspaceId` are set, user-service applies portal white-label branding (overrides `customAuthUrl` to the portal domain and uses the `restore_portal_password` template).
+     * Visitor-safe password restore request. Forwards to auth-form `/auth/api/remind` and always returns a generic success shape so the route does not enumerate accounts. The email and its reset link are rendered by the platform mail template; the link is not part of this contract. Set BOTH `portalId` and `workspaceId` for portal white-label branding. To control the reset URL yourself, use `requestFusebaseRestoreKey` and send your own email.
      */
     requestFusebasePasswordRestore(params: {
         headers?: Record<string, string>;
@@ -71,7 +71,7 @@ export declare class FusebaseAuthApi {
     }): Promise<FusebaseAuthPasswordRestoreResponseContract>;
     /**
      * Mint a Fusebase password-restore key (no email)
-     * Protected white-label flow. Creates a password-restore session for the email through user-service WITHOUT sending the platform email, and returns the raw key so a trusted AI App backend can send its own branded reset mail. The key passes `checkFusebasePasswordRestoreKey` / `resetFusebasePassword` with the same TTL and one-time-use as the email flow. `resetUrl` is `${customAuthUrl}/resetpass?key=<key>` when `customAuthUrl` is provided. Requires `auth.restore_key.write` and org access (same trust level as `registerFusebaseOrgMember`/`addOrgUser`); visitor/anonymous callers get 403. A key resets the target's GLOBAL FuseBase password, so it is only minted when the path `orgId` is the user's ONLY organization — a user with any footprint elsewhere (another org, or a private org from self-registration) is an independent account the app must not hijack, even if it was just added to this org. Otherwise 404 (also for unknown emails, so it does not leak global account existence). Unlike `requestFusebasePasswordRestore` this is NOT visitor-safe — it exposes the key.
+     * Mints a password-restore key without sending the platform email, so an app backend can send its own branded reset mail. The key works with `checkFusebasePasswordRestoreKey` / `resetFusebasePassword` at the same TTL and one-time-use as the email flow, and is not bound to any URL — build whatever reset link you want around it, or use the returned `platformResetUrl` if the app has no reset page of its own. Requires `auth.restore_key.write` and an app service token scoped to the path `orgId`; user, visitor and anonymous callers get 403, as does a token scoped to another org. Backend only — the app-wrapper `fbsfeaturetoken` cookie also resolves as a token subject, so the calling credential must never be reachable from frontend code. A key resets the target's GLOBAL FuseBase password, so it is minted only when the path `orgId` is the user's ONLY org; any footprint elsewhere is an independent account and 404s, as do unknown emails. NOT visitor-safe — it exposes the key.
      */
     requestFusebaseRestoreKey(params: {
         path: {
@@ -91,4 +91,12 @@ export declare class FusebaseAuthApi {
         headers?: Record<string, string>;
         body: FusebaseAuthPasswordResetRequestContract;
     }): Promise<FusebaseAuthPasswordResetResponseContract>;
+    /**
+     * Set the initial password of the calling invited account
+     * Sets the password of the authenticated caller, once, without any platform email. Needed for an invitee whose account was pre-provisioned by an invite (`addOrgUser` with autoConfirmClientInvite, or an app magic link) and therefore holds a random password its user never learns. Limits: the subject is always the caller — there is no email in the body and a service/app-token caller gets 403; `409` once a password has been set, so an existing user's password can never be overwritten (use password restore for that); no session is minted and every existing session of the account is dropped, so the user must sign in with the new password afterwards.
+     */
+    setFusebaseInitialPassword(params: {
+        headers?: Record<string, string>;
+        body: FusebaseAuthSetInitialPasswordRequestContract;
+    }): Promise<FusebaseAuthSetInitialPasswordResponseContract>;
 }

package/dist/apis/FusebaseAuthApi.js

@@ -97,7 +97,7 @@ class FusebaseAuthApi {
     }
     /**
      * Request Fusebase password restore
-     * Visitor-safe password restore request. Forwards to auth-form `/auth/api/remind` and always returns a generic success shape so the route does not enumerate accounts. The email link is `${customAuthUrl}/resetpass?key=<key>` (platform appends `/resetpass` and puts the key in query param `key`). When both `portalId` and `workspaceId` are set, user-service applies portal white-label branding (overrides `customAuthUrl` to the portal domain and uses the `restore_portal_password` template).
+     * Visitor-safe password restore request. Forwards to auth-form `/auth/api/remind` and always returns a generic success shape so the route does not enumerate accounts. The email and its reset link are rendered by the platform mail template; the link is not part of this contract. Set BOTH `portalId` and `workspaceId` for portal white-label branding. To control the reset URL yourself, use `requestFusebaseRestoreKey` and send your own email.
      */
     async requestFusebasePasswordRestore(params) {
         return this.client.request({
@@ -111,7 +111,7 @@ class FusebaseAuthApi {
     }
     /**
      * Mint a Fusebase password-restore key (no email)
-     * Protected white-label flow. Creates a password-restore session for the email through user-service WITHOUT sending the platform email, and returns the raw key so a trusted AI App backend can send its own branded reset mail. The key passes `checkFusebasePasswordRestoreKey` / `resetFusebasePassword` with the same TTL and one-time-use as the email flow. `resetUrl` is `${customAuthUrl}/resetpass?key=<key>` when `customAuthUrl` is provided. Requires `auth.restore_key.write` and org access (same trust level as `registerFusebaseOrgMember`/`addOrgUser`); visitor/anonymous callers get 403. A key resets the target's GLOBAL FuseBase password, so it is only minted when the path `orgId` is the user's ONLY organization — a user with any footprint elsewhere (another org, or a private org from self-registration) is an independent account the app must not hijack, even if it was just added to this org. Otherwise 404 (also for unknown emails, so it does not leak global account existence). Unlike `requestFusebasePasswordRestore` this is NOT visitor-safe — it exposes the key.
+     * Mints a password-restore key without sending the platform email, so an app backend can send its own branded reset mail. The key works with `checkFusebasePasswordRestoreKey` / `resetFusebasePassword` at the same TTL and one-time-use as the email flow, and is not bound to any URL — build whatever reset link you want around it, or use the returned `platformResetUrl` if the app has no reset page of its own. Requires `auth.restore_key.write` and an app service token scoped to the path `orgId`; user, visitor and anonymous callers get 403, as does a token scoped to another org. Backend only — the app-wrapper `fbsfeaturetoken` cookie also resolves as a token subject, so the calling credential must never be reachable from frontend code. A key resets the target's GLOBAL FuseBase password, so it is minted only when the path `orgId` is the user's ONLY org; any footprint elsewhere is an independent account and 404s, as do unknown emails. NOT visitor-safe — it exposes the key.
      */
     async requestFusebaseRestoreKey(params) {
         return this.client.request({
@@ -139,5 +139,19 @@ class FusebaseAuthApi {
             expectedContentType: "application/json",
         });
     }
+    /**
+     * Set the initial password of the calling invited account
+     * Sets the password of the authenticated caller, once, without any platform email. Needed for an invitee whose account was pre-provisioned by an invite (`addOrgUser` with autoConfirmClientInvite, or an app magic link) and therefore holds a random password its user never learns. Limits: the subject is always the caller — there is no email in the body and a service/app-token caller gets 403; `409` once a password has been set, so an existing user's password can never be overwritten (use password restore for that); no session is minted and every existing session of the account is dropped, so the user must sign in with the new password afterwards.
+     */
+    async setFusebaseInitialPassword(params) {
+        return this.client.request({
+            method: "POST",
+            path: "/auth/fusebase/set-initial-password",
+            headers: params.headers,
+            body: params.body,
+            opId: "setFusebaseInitialPassword",
+            expectedContentType: "application/json",
+        });
+    }
 }
 exports.FusebaseAuthApi = FusebaseAuthApi;

package/dist/apis/OrgUsersApi.d.ts

@@ -32,7 +32,7 @@ export declare class OrgUsersApi {
     }): Promise<OrgUserListResponseContract>;
     /**
      * List portal members
-     * Returns the members of a portal by its underlying workspaceId. Portal membership is currently represented by workspace membership (same semantics as removePortalMember), so Gate validates the workspace belongs to `orgId` and returns its members, each including the workspaceMember `id` (globalId). Requires org.members.read and org access.
+     * Returns the members of a portal by its underlying workspaceId. Portal membership is currently represented by workspace membership (same semantics as removePortalMember), so Gate validates the workspace belongs to `orgId` and returns its members, each including the workspaceMember `id` (globalId). Each member is enriched from org membership (joined by `userId`) with `orgRole` (guest|client|member|manager|owner), `email`, `firstname`, `lastname`, and `isPortalManager`. `isPortalManager` is the official flag for a portal manager (org role `manager`, what invitePortalManager grants, or `owner`); use it — plus `orgRole === 'client'` for clients — to answer 'client vs portal manager' and to build a 'Chat with <name | email>' channel name in one call, without a separate listOrgUsers roundtrip. Requires org.members.read and org access.
      */
     listPortalMembers(params: {
         path: {
@@ -43,7 +43,7 @@ export declare class OrgUsersApi {
     }): Promise<OrgWorkspaceMemberListResponseContract>;
     /**
      * List workspace members
-     * Returns the members of a single workspace scoped to the organization. Gate validates that the workspace belongs to `orgId`, then calls org-service. Each member includes the workspaceMember `id` (globalId) needed by removeWorkspaceMember. Requires org.members.read and org access.
+     * Returns the members of a single workspace scoped to the organization. Gate validates that the workspace belongs to `orgId`, then calls org-service. Each member includes the workspaceMember `id` (globalId) needed by removeWorkspaceMember. Each member is enriched from org membership (joined by `userId`) with `orgRole` (guest|client|member|manager|owner), `email`, `firstname`, `lastname`, and `isPortalManager` — the official flag for a portal manager (org role `manager`, what invitePortalManager grants, or `owner`); prefer it over re-deriving the formula. Requires org.members.read and org access.
      */
     listWorkspaceMembers(params: {
         path: {

package/dist/apis/OrgUsersApi.js

@@ -42,7 +42,7 @@ class OrgUsersApi {
     }
     /**
      * List portal members
-     * Returns the members of a portal by its underlying workspaceId. Portal membership is currently represented by workspace membership (same semantics as removePortalMember), so Gate validates the workspace belongs to `orgId` and returns its members, each including the workspaceMember `id` (globalId). Requires org.members.read and org access.
+     * Returns the members of a portal by its underlying workspaceId. Portal membership is currently represented by workspace membership (same semantics as removePortalMember), so Gate validates the workspace belongs to `orgId` and returns its members, each including the workspaceMember `id` (globalId). Each member is enriched from org membership (joined by `userId`) with `orgRole` (guest|client|member|manager|owner), `email`, `firstname`, `lastname`, and `isPortalManager`. `isPortalManager` is the official flag for a portal manager (org role `manager`, what invitePortalManager grants, or `owner`); use it — plus `orgRole === 'client'` for clients — to answer 'client vs portal manager' and to build a 'Chat with <name | email>' channel name in one call, without a separate listOrgUsers roundtrip. Requires org.members.read and org access.
      */
     async listPortalMembers(params) {
         return this.client.request({
@@ -56,7 +56,7 @@ class OrgUsersApi {
     }
     /**
      * List workspace members
-     * Returns the members of a single workspace scoped to the organization. Gate validates that the workspace belongs to `orgId`, then calls org-service. Each member includes the workspaceMember `id` (globalId) needed by removeWorkspaceMember. Requires org.members.read and org access.
+     * Returns the members of a single workspace scoped to the organization. Gate validates that the workspace belongs to `orgId`, then calls org-service. Each member includes the workspaceMember `id` (globalId) needed by removeWorkspaceMember. Each member is enriched from org membership (joined by `userId`) with `orgRole` (guest|client|member|manager|owner), `email`, `firstname`, `lastname`, and `isPortalManager` — the official flag for a portal manager (org role `manager`, what invitePortalManager grants, or `owner`); prefer it over re-deriving the formula. Requires org.members.read and org access.
      */
     async listWorkspaceMembers(params) {
         return this.client.request({

package/dist/apis/PortalFeatureContextApi.d.ts

@@ -11,7 +11,7 @@ export declare class PortalFeatureContextApi {
     constructor(client: Client);
     /**
      * Verify portal embed context token
-     * Validates a platform-signed `portalFeatureContextToken` (iframe query param) and returns trusted portalId/workspaceId for backend RLS context. The token must match the path appId when bound to a specific app feature.
+     * Validates a platform-signed `portalFeatureContextToken` (iframe query param) and returns trusted portalId/workspaceId for backend RLS context. The token must match the path appId when bound to a specific app feature. Additionally returns the caller's `userId`/`orgRole` if and only if the request is authenticated with an app session whose own portal binding equals the verified token's portalId AND the caller is a real user, not an anonymous visitor — i.e. they opened this app through THIS portal's embed. Identity is never read from the token itself: it is static, shared by all viewers of the brick and user-agnostic. Presence of `userId` proves the platform bound this user to this portal and app; it does NOT prove portal membership (enforce that via the app's `--access` principals).
      */
     verifyPortalFeatureContextToken(params: {
         path: {

package/dist/apis/PortalFeatureContextApi.js

@@ -13,7 +13,7 @@ class PortalFeatureContextApi {
     }
     /**
      * Verify portal embed context token
-     * Validates a platform-signed `portalFeatureContextToken` (iframe query param) and returns trusted portalId/workspaceId for backend RLS context. The token must match the path appId when bound to a specific app feature.
+     * Validates a platform-signed `portalFeatureContextToken` (iframe query param) and returns trusted portalId/workspaceId for backend RLS context. The token must match the path appId when bound to a specific app feature. Additionally returns the caller's `userId`/`orgRole` if and only if the request is authenticated with an app session whose own portal binding equals the verified token's portalId AND the caller is a real user, not an anonymous visitor — i.e. they opened this app through THIS portal's embed. Identity is never read from the token itself: it is static, shared by all viewers of the brick and user-agnostic. Presence of `userId` proves the platform bound this user to this portal and app; it does NOT prove portal membership (enforce that via the app's `--access` principals).
      */
     async verifyPortalFeatureContextToken(params) {
         return this.client.request({

package/dist/apis/PortalsApi.d.ts

@@ -5,13 +5,39 @@
  * Domain: portals
  */
 import type { Client } from "../runtime/transport";
-import type { AddPortalAppPageRequestContract, AddPortalAppPageResponseContract, AddPortalBlockRequestContract, AddPortalBlockResponseContract, AddPortalNoteBlockRequestContract, AddPortalNoteBlockResponseContract, BulkInviteToPortalRequestContract, BulkInviteToPortalResponseContract, CreatePortalFolderRequestContract, CreatePortalFolderResponseContract, CreatePortalPageWithNoteRequestContract, CreatePortalPageWithNoteResponseContract, CreatePortalRequestContract, CreatePortalResponseContract, DuplicatePortalItemRequestContract, DuplicatePortalItemResponseContract, DuplicatePortalRequestContract, globalIdInPathRequired, InvitePortalManagerRequestContract, InvitePortalManagerResponseContract, InviteToPortalRequestContract, InviteToPortalResponseContract, ListPortalContentResponseContract, orgIdInPathRequired, OrgPortalListResponseContract, PortalDetailContract, PublishPortalDraftResponseContract, UpdatePortalAccessRequestContract, UpdatePortalAccessResponseContract, UpdatePortalCustomCodeRequestContract, UpdatePortalCustomCodeResponseContract } from "../types";
+import type { AddPortalAiAgentBlockRequestContract, AddPortalAiAgentBlockResponseContract, AddPortalAppBlockRequestContract, AddPortalAppBlockResponseContract, AddPortalAppPageRequestContract, AddPortalAppPageResponseContract, AddPortalBlankNoteBlockRequestContract, AddPortalBlankNoteBlockResponseContract, AddPortalBlockRequestContract, AddPortalBlockResponseContract, AddPortalCardBlockRequestContract, AddPortalCardBlockResponseContract, AddPortalCarouselBlockRequestContract, AddPortalCarouselBlockResponseContract, AddPortalChatBlockRequestContract, AddPortalChatBlockResponseContract, AddPortalCountdownBlockRequestContract, AddPortalCountdownBlockResponseContract, AddPortalDatabaseBlockRequestContract, AddPortalDatabaseBlockResponseContract, AddPortalEmbedBlockRequestContract, AddPortalEmbedBlockResponseContract, AddPortalHeadingBlockRequestContract, AddPortalImageBlockRequestContract, AddPortalNoteBlockRequestContract, AddPortalNoteBlockResponseContract, AddPortalTextBlockRequestContract, BulkInviteToPortalRequestContract, BulkInviteToPortalResponseContract, CreatePortalFolderRequestContract, CreatePortalFolderResponseContract, CreatePortalPageRequestContract, CreatePortalPageResponseContract, CreatePortalPageWithNoteRequestContract, CreatePortalPageWithNoteResponseContract, CreatePortalRequestContract, CreatePortalResponseContract, DuplicatePortalItemRequestContract, DuplicatePortalItemResponseContract, DuplicatePortalRequestContract, GetPortalPageBlockCountResponseContract, globalIdInPathRequired, InvitePortalManagerRequestContract, InvitePortalManagerResponseContract, InviteToPortalRequestContract, InviteToPortalResponseContract, ListPortalAiAgentsResponseContract, ListPortalChatChannelsResponseContract, ListPortalChatUsersResponseContract, ListPortalContentResponseContract, ListPortalDatabaseBlockSourcesResponseContract, orgIdInPathRequired, OrgPortalListResponseContract, PortalDetailContract, PortalTextAndMediaBlockResponseContract, PublishPortalDraftResponseContract, SetDashboardViewReadonlyRequestContract, SetDashboardViewReadonlyResponseContract, UpdatePortalAccessRequestContract, UpdatePortalAccessResponseContract, UpdatePortalCustomCodeRequestContract, UpdatePortalCustomCodeResponseContract } from "../types";
 export declare class PortalsApi {
     private client;
     constructor(client: Client);
+    /**
+     * Add an AI Agent block to a portal page
+     * Stages one Customizer-compatible AI Agent block on an EXISTING portal page — the programmatic equivalent of the customizer's "AI Agent" tile (a flexible block with one ai-agent brick). No new page and no sidebar menu item is created. Pass only agentId, the exact id from listPortalAiAgents; the block title is the agent's current title and every layout/brick detail is fixed by the service. Immediately before calling this, check getPortalPageBlockCount with type='flexible' and templateType='ai-agent': only ONE AI Agent block is allowed per page and a second returns 400. For a published page resolve pageId from listPortalContent; for a page created earlier in the active draft use the pageId that operation returned. The block is staged in the portal's customizer draft (not published immediately). Returns the block id and the draft branch/seqs. Requires portals.write access.
+     */
+    addPortalAiAgentBlock(params: {
+        path: {
+            orgId: orgIdInPathRequired;
+            portalId: globalIdInPathRequired;
+            pageId: globalIdInPathRequired;
+        };
+        headers?: Record<string, string>;
+        body: AddPortalAiAgentBlockRequestContract;
+    }): Promise<AddPortalAiAgentBlockResponseContract>;
+    /**
+     * Add a published app as a block on an existing portal page
+     * Stages one published Fusebase app as a flexible app-feature block on an EXISTING portal page. No new page and no sidebar menu item is created — use addPortalAppPage when the app should get its own sidebar page. Pass productId (the product that owns the app) and appId (the app to embed); resolve both, plus productType and productOrgId, with findPublishedApps. For a managed product (Customizer "Managed Products") also pass productType='managed' and productOrgId. For a published page resolve pageId from listPortalContent; for a page created earlier in the active draft use the pageId that operation returned. The block is staged in the portal's customizer draft (not published immediately). Returns the block id, the page the block was staged on, and the draft branch/seqs. Requires portals.write access.
+     */
+    addPortalAppBlock(params: {
+        path: {
+            orgId: orgIdInPathRequired;
+            portalId: globalIdInPathRequired;
+            pageId: globalIdInPathRequired;
+        };
+        headers?: Record<string, string>;
+        body: AddPortalAppBlockRequestContract;
+    }): Promise<AddPortalAppBlockResponseContract>;
     /**
      * Add a published app as a portal page (embed)
-     * Creates a new sidebar page in the portal that embeds a published Fusebase app (a flexible block with an app-feature brick). Pass productId (the product that owns the app) and appId (the app to embed) — typically the app you just built and published via the CLI. The app's URL is resolved by the portal at render time from these ids; nothing is hard-coded. Pass parentId to nest the page under an existing folder. The page is staged in the portal's customizer draft (not published immediately): the portal owner opens the customizer, reviews the pending page, and publishes it. Returns the page/menu-item/block ids, the page url, and the draft branch/seqs. Requires portals.write access.
+     * Creates a new sidebar page in the portal that embeds a published Fusebase app (a flexible block with an app-feature brick). Pass productId (the product that owns the app) and appId (the app to embed) — typically the app you just built and published via the CLI. For a managed product (Customizer "Managed Products") also pass productType='managed' and productOrgId from findPublishedApps. The app's URL is resolved by the portal at render time from these ids; nothing is hard-coded. Pass parentId to nest the page under an existing folder. The page is staged in the portal's customizer draft (not published immediately): the portal owner opens the customizer, reviews the pending page, and publishes it. Returns the page/menu-item/block ids, the page url, and the draft branch/seqs. Requires portals.write access.
      */
     addPortalAppPage(params: {
         path: {
@@ -21,9 +47,22 @@ export declare class PortalsApi {
         headers?: Record<string, string>;
         body: AddPortalAppPageRequestContract;
     }): Promise<AddPortalAppPageResponseContract>;
+    /**
+     * Add an empty Fusebase note as a block to a portal page
+     * Creates a new EMPTY Fusebase note, shares it into the portal and adds it as a note block to an existing portal page — the programmatic equivalent of the customizer's "Blank Block" action. No new page and no sidebar menu item is created. For a published page resolve pageId from listPortalContent; for a page created earlier in the active draft use the pageId that operation returned. The block is appended after the last block of the page body and is staged in the portal's customizer draft (not published immediately). Use addPortalNoteBlock when the note already exists and is already shared into the portal, and createPortalPageWithNote when a new sidebar page backed by a note is wanted. Returns the note/block ids and the draft branch/seqs. Requires portals.write access.
+     */
+    addPortalBlankNoteBlock(params: {
+        path: {
+            orgId: orgIdInPathRequired;
+            portalId: globalIdInPathRequired;
+            pageId: globalIdInPathRequired;
+        };
+        headers?: Record<string, string>;
+        body?: AddPortalBlankNoteBlockRequestContract;
+    }): Promise<AddPortalBlankNoteBlockResponseContract>;
     /**
      * Add a block of any palette type to a portal page
-     * Stages a single block of any supported type onto an existing portal page — the universal building block behind the customizer's 'Add new block' palette (no new page or sidebar item is created). Pass pageId (the target page node id from listPortalContent) and type. Supported types: note, content, embed, chat, info, docs, help, request, meetings, links, task-list, projection, files-dashboard, tasks-dashboard, chats-dashboard, files-recent, files-bucket, flexible. Type-specific fields: note/content require noteId; flexible requires template (e.g. {type:'text'|'image'|'title'|'code'|'form'|'dashboard'|'ai-agent'|'app-feature'|...}) and may carry bricks; embed/info/projection/task-list and others take their fields via the free-form `properties` object (e.g. embedType/content/contentUrl, image/link, sourcePortalId/sourcePageId/sourceBlockId, taskListIds). Use addPortalNoteBlock for the common note case or addPortalAppPage for an app on its own page. Note: a `content` block renames the page to its title, so leave title empty for content blocks. The block is staged in the portal's customizer draft (not published immediately); the owner reviews and publishes it. Returns the block id and the draft branch/seqs. Requires portals.write access.
+     * Stages a single block of any supported type onto an existing portal page — the universal building block behind the customizer's 'Add new block' palette (no new page or sidebar item is created). Pass pageId (the target page node id from listPortalContent) and type. Supported types: note, content, info, docs, help, request, meetings, links, task-list, projection, files-dashboard, tasks-dashboard, chats-dashboard, files-recent, files-bucket, flexible. Type-specific fields: note/content require noteId; flexible requires template (e.g. {type:'text'|'image'|'title'|'code'|'form'|'dashboard'|'app-feature'|...}) and may carry bricks; info/projection/task-list and others take their fields via the free-form `properties` object (e.g. image/link, sourcePortalId/sourcePageId/sourceBlockId, taskListIds). This op does NOT accept type='embed', a flexible block with template.type='dashboard' or a dashboard brick (use addPortalDatabaseBlock) or type='chat' — use addPortalEmbedBlock for Embed blocks and addPortalChatBlock for Chat blocks — and it does NOT accept a flexible ai-agent template or an ai-agent brick: use addPortalAiAgentBlock, which binds the agent to the caller. Use addPortalNoteBlock for the common note case or addPortalAppPage for an app on its own page. Note: a `content` block renames the page to its title, so leave title empty for content blocks. The block is staged in the portal's customizer draft (not published immediately); the owner reviews and publishes it. Returns the block id and the draft branch/seqs. Requires portals.write access.
      */
     addPortalBlock(params: {
         path: {
@@ -33,6 +72,110 @@ export declare class PortalsApi {
         headers?: Record<string, string>;
         body: AddPortalBlockRequestContract;
     }): Promise<AddPortalBlockResponseContract>;
+    /**
+     * Add a Card block to a portal page
+     * Stages one Customizer-compatible Card on an EXISTING portal page — the programmatic equivalent of the customizer's Content display "Card" tile. It creates exactly one flexible block with the five canonical bricks (Image, Heading, Description, Button, Destination URL); no page, sidebar item or media asset is created. `view` is the Card Type: `top-image`, `left-image`, `right-image` or `fill-image` (default `top-image`; `fill-image` defaults the text to white). `content` configures the bricks: `image.visible` only — the Card always uses the built-in template image and an `src`/URL/asset id/upload is rejected —, `heading` and `description` (plain text plus one palette colour token such as `cyan-700`, size `s`/`m`/`l`/`xl`, a unique set of `bold`/`italic`/`underline`/`lineThrough` styles and alignment), `button` (plain label sent as `button.text` — there is no `label` field and sending one is rejected — with no dynamic variables) and `destination`. `visible` defaults to `true`, so a visible item does NOT need `visible: true`: send `content.button: {text: "Open"}` to set an enabled Button label. Any of Image, Heading, Description and Button can be hidden with `visible: false`, which then must be the item's only field. `destination` is shared by the whole Card and its Button: an exact `pageId` of a page in THIS portal, an absolute https URL, an email address, or `null` for no link — a raw DynamicLink, `javascript:`/`data:` URL or caller-supplied internal title/targetId is rejected, and the link target (new tab) is not configurable. `appearance` is optional; omitting it keeps the Card's canonical bare wrapper, and a `custom` backdrop takes a colour, gradient or one of the five preset background images (`azure`, `mira`, `solis`, `serenity`, `glow`). `layout` sets Customizer Width (2-6, default 3) and Height (Auto by default, a manual value is at least 50px). HTML, Markdown, CSS, Tailwind classes, a wrapper title and raw bricks are not accepted. The block is staged in the portal's customizer draft (not published immediately). Requires portals.write access.
+     */
+    addPortalCardBlock(params: {
+        path: {
+            orgId: orgIdInPathRequired;
+            portalId: globalIdInPathRequired;
+            pageId: globalIdInPathRequired;
+        };
+        headers?: Record<string, string>;
+        body: AddPortalCardBlockRequestContract;
+    }): Promise<AddPortalCardBlockResponseContract>;
+    /**
+     * Add a Carousel block to a portal page
+     * Stages one Customizer-compatible Carousel on an EXISTING portal page — the programmatic equivalent of the customizer's Content display "Carousel" tile. It creates exactly one flexible block with a single Carousel brick; no page, sidebar item or media asset is created. Omit `content` to get the Customizer default of three slides (Deliberation, Elaboration, Presentation) with their built-in images, descriptions, More buttons and links. `content.items` replaces that list entirely and must hold 1 to 6 slides in visual order; the slide index is taken from the array position and is not accepted from the caller. Each slide takes `caption` and `description` (plain text; only `description` supports the `{{ClientName}}` and `{{ClientLastName}}` variables), `button: {text}` or `null` for no Button, and `destination` or `null` for no link — an exact `pageId` of a page in THIS portal, an absolute https URL or an email address. The slide surface and its Button share that one destination. Every slide image is a built-in one: an image/video URL, asset id, file name, base64, local path or upload is rejected, as are a raw DynamicLink, raw item index, brick, CSS class, autoplay, duration, controls and indicators. Carousel has no public Appearance settings. `layout` sets Customizer Width (2-6, default 6) and Height (Auto by default, a manual value is at least 50px). The block is staged in the portal's customizer draft (not published immediately). Requires portals.write access.
+     */
+    addPortalCarouselBlock(params: {
+        path: {
+            orgId: orgIdInPathRequired;
+            portalId: globalIdInPathRequired;
+            pageId: globalIdInPathRequired;
+        };
+        headers?: Record<string, string>;
+        body: AddPortalCarouselBlockRequestContract;
+    }): Promise<AddPortalCarouselBlockResponseContract>;
+    /**
+     * Add a Chat block to a portal page
+     * Stages one Customizer-compatible Chat block on an EXISTING portal page — the programmatic equivalent of the customizer's "Chat" action. Pass exactly one target: { type: 'channel', channelId } (id from listPortalChatChannels) or { type: 'dm', userId } (an active org member's userId). membersOnly is channel-only (default true; a private channel requires true; forbidden for dm). One active Chat block is allowed per page — a second returns 409. Creates one chat widget configuration and stages the block in the customizer draft (not published immediately). This is a Chat WIDGET on a page, distinct from the portal's system chat menu item and the chats-dashboard block. For a published page resolve pageId from listPortalContent; for a page created earlier in the active draft use the pageId that operation returned. Returns the block id and the draft branch/seqs. Requires portals.write access.
+     */
+    addPortalChatBlock(params: {
+        path: {
+            orgId: orgIdInPathRequired;
+            portalId: globalIdInPathRequired;
+            pageId: globalIdInPathRequired;
+        };
+        headers?: Record<string, string>;
+        body: AddPortalChatBlockRequestContract;
+    }): Promise<AddPortalChatBlockResponseContract>;
+    /**
+     * Add a Countdown block to a portal page
+     * Stages one Customizer-compatible Countdown on an EXISTING portal page — the programmatic equivalent of the customizer's Content display "Countdown" tile. It creates exactly one flexible block with a single Countdown item that ticks down days, hours, minutes and seconds to a future moment; no page, sidebar item or external entity is created. The body may be empty, which reproduces the Customizer default: the title "Countdown" and a target 30 days after creation. `content.targetAt` is an absolute RFC 3339 date-time with `Z` or an explicit UTC offset — epoch seconds/milliseconds, a timezone-less local date and a duration are rejected, as are a raw timestamp, brick, renderer style, the item's internal title and its fixed days/hours/min/sec labels. The target must not be in the past or more than 99 days after creation. `title` is the block title (plain text, only the `{{ClientName}}` and `{{ClientLastName}}` variables). `appearance` sets Customizer Backdrop `none`, `blank` or `custom`; omitting it keeps the canonical blank backdrop with the title shown, and a custom backdrop takes a background, padding (default `s`) and `showTitle` (default true). `layout` sets Width (2-6, default 6) and Height (Auto by default, a manual value is at least 50px). The block is staged in the portal's customizer draft (not published immediately). Requires portals.write access.
+     */
+    addPortalCountdownBlock(params: {
+        path: {
+            orgId: orgIdInPathRequired;
+            portalId: globalIdInPathRequired;
+            pageId: globalIdInPathRequired;
+        };
+        headers?: Record<string, string>;
+        body: AddPortalCountdownBlockRequestContract;
+    }): Promise<AddPortalCountdownBlockResponseContract>;
+    /**
+     * Add a Database block to a portal page
+     * Stages one Customizer-compatible Database block on an EXISTING portal page — the programmatic equivalent of the customizer's "Database" tile. It creates exactly one flexible block with a single dashboard brick; no page, sidebar item, database, dashboard or view is created and the selected view's own settings are untouched. Both Customizer types are supported: `database` (Database -> Table -> View) and `dashboard` (a shared source such as All forms -> View). Pass exact ids from listPortalDatabaseBlockSources; names, aliases and URLs are rejected, and the dashboard must belong to `databaseId` in database mode. Optional `title` (default "Database"), `itemsPerPage` (10/20/50/100/200/500, default 100), `appearance` and `layout`. To change whether the view is editable call setDashboardViewReadonly separately — that is a global view setting. The block is staged in the portal's customizer draft (not published immediately). Requires portals.write access.
+     */
+    addPortalDatabaseBlock(params: {
+        path: {
+            orgId: orgIdInPathRequired;
+            portalId: globalIdInPathRequired;
+            pageId: globalIdInPathRequired;
+        };
+        headers?: Record<string, string>;
+        body: AddPortalDatabaseBlockRequestContract;
+    }): Promise<AddPortalDatabaseBlockResponseContract>;
+    /**
+     * Add an Embeds & Integrations block to a portal page
+     * Stages one Customizer-compatible Embed block on an EXISTING portal page — the programmatic equivalent of the customizer's "Embeds & Integrations" action. No new page and no sidebar menu item is created. embedType is one of the 11 chooser variants (custom, youtube, google-drive, ms-doc, calendly, hubspot, airtable, loom, data-studio, figma, miro). For `custom` pass `content` (URL or embed code) and NOT `url`; for every named variant pass `url` and NOT `content` — the service builds the canonical iframe. hubspot here is an iframe Embed block, not a Flexible Block integration brick. For a published page resolve pageId from listPortalContent; for a page created earlier in the active draft use the pageId that operation returned. The block is staged in the portal's customizer draft (not published immediately). Returns the block id and the draft branch/seqs. Requires portals.write access.
+     */
+    addPortalEmbedBlock(params: {
+        path: {
+            orgId: orgIdInPathRequired;
+            portalId: globalIdInPathRequired;
+            pageId: globalIdInPathRequired;
+        };
+        headers?: Record<string, string>;
+        body: AddPortalEmbedBlockRequestContract;
+    }): Promise<AddPortalEmbedBlockResponseContract>;
+    /**
+     * Add a Text & Media Heading block to a portal page
+     * Stages one Customizer-compatible Heading block on an existing portal page — the programmatic equivalent of the customizer's Text & Media "Heading" tile. `content` carries the text settings (plain text, one palette colour token such as `cyan-700` — never HEX or CSS —, size `s`/`m`/`l`/`xl`, a unique set of `bold`, `italic`, `underline`, `lineThrough` styles and alignment). `appearance` is the Customizer Appearance section; a `custom` backdrop takes a colour, gradient or one of the five preset background images (`azure`, `mira`, `solis`, `serenity`, `glow`) — an image URL, asset id or upload is rejected. HTML, Markdown, CSS, Tailwind classes, a wrapper title and raw bricks are not accepted. Defaults: text "Your Title Goes Here", size `l`, no styles, left alignment and a blank backdrop. It creates exactly one flexible block on an EXISTING page; no page, sidebar item or media asset is created. `layout` sets Customizer Width (2-6, default 6) and Height (Auto by default, a manual value is at least 50px); `rowspan`, row placement and responsive values are not part of this contract. The block is staged in the portal's customizer draft (not published immediately). Requires portals.write access.
+     */
+    addPortalHeadingBlock(params: {
+        path: {
+            orgId: orgIdInPathRequired;
+            portalId: globalIdInPathRequired;
+            pageId: globalIdInPathRequired;
+        };
+        headers?: Record<string, string>;
+        body: AddPortalHeadingBlockRequestContract;
+    }): Promise<PortalTextAndMediaBlockResponseContract>;
+    /**
+     * Add a Text & Media Image block to a portal page
+     * Stages one Customizer-compatible Image block on an existing portal page — the programmatic equivalent of the customizer's Text & Media "Image" tile. It always creates the customizer's default stock image: `assetId`, `src`, a URL, base64, a file path or name, HTML and any other image input are rejected, and so are Appearance and text settings. Only `layout` applies. It creates exactly one flexible block on an EXISTING page; no page, sidebar item or media asset is created. `layout` sets Customizer Width (2-6, default 6) and Height (Auto by default, a manual value is at least 50px); `rowspan`, row placement and responsive values are not part of this contract. The block is staged in the portal's customizer draft (not published immediately). Requires portals.write access.
+     */
+    addPortalImageBlock(params: {
+        path: {
+            orgId: orgIdInPathRequired;
+            portalId: globalIdInPathRequired;
+            pageId: globalIdInPathRequired;
+        };
+        headers?: Record<string, string>;
+        body: AddPortalImageBlockRequestContract;
+    }): Promise<PortalTextAndMediaBlockResponseContract>;
     /**
      * Add an existing Fusebase note as a block to a portal page
      * Embeds an existing Fusebase note as a content block on an existing portal page (no new page or sidebar item is created). The note must already exist in the portal's workspace and be shared into the portal (e.g. created via createPortalPageWithNote). Pass pageId (the target page node id, obtained from listPortalContent) and noteId. The block is staged in the portal's customizer draft (not published immediately): the portal owner opens the customizer, reviews the pending block, and publishes it. Returns the created block id and the draft branch/seqs. Requires portals.write access.
@@ -45,6 +188,19 @@ export declare class PortalsApi {
         headers?: Record<string, string>;
         body: AddPortalNoteBlockRequestContract;
     }): Promise<AddPortalNoteBlockResponseContract>;
+    /**
+     * Add a Text & Media Simple text block to a portal page
+     * Stages one Customizer-compatible Simple text block on an existing portal page — the programmatic equivalent of the customizer's Text & Media "Simple text" tile. `content` carries the text settings (plain text, one palette colour token such as `cyan-700` — never HEX or CSS —, size `s`/`m`/`l`/`xl`, a unique set of `bold`, `italic`, `underline`, `lineThrough` styles and alignment). `appearance` is the Customizer Appearance section; a `custom` backdrop takes a colour, gradient or one of the five preset background images (`azure`, `mira`, `solis`, `serenity`, `glow`) — an image URL, asset id or upload is rejected. HTML, Markdown, CSS, Tailwind classes, a wrapper title and raw bricks are not accepted. Defaults: text "Your journey starts here! Add your unique message to engage your audience.", size `m`, no styles, left alignment and a blank backdrop. It creates exactly one flexible block on an EXISTING page; no page, sidebar item or media asset is created. `layout` sets Customizer Width (2-6, default 6) and Height (Auto by default, a manual value is at least 50px); `rowspan`, row placement and responsive values are not part of this contract. The block is staged in the portal's customizer draft (not published immediately). Requires portals.write access.
+     */
+    addPortalTextBlock(params: {
+        path: {
+            orgId: orgIdInPathRequired;
+            portalId: globalIdInPathRequired;
+            pageId: globalIdInPathRequired;
+        };
+        headers?: Record<string, string>;
+        body: AddPortalTextBlockRequestContract;
+    }): Promise<PortalTextAndMediaBlockResponseContract>;
     /**
      * Invite multiple users to a portal in one call
      * Invites a batch of users to a single portal in one request, replacing N sequential inviteToPortal calls. Portal discovery (listPortals/getPortal) runs once for the whole batch. Invites are processed with bounded concurrency (default 5, max 5); the rest are queued. With background=false (default) the response waits for all invites and returns aggregated per-invitation results (status='completed'). With background=true the response returns immediately (status='processing') and invites run in the background without blocking the caller. Per-invitation orgRole/isFullAccess semantics match inviteToPortal. Invarian — before calling for client invites (orgRole='client' or unspecified): ALWAYS ask the user 'Full access (all pages) or Shared only (public pages)?' and wait for their answer.
@@ -80,6 +236,18 @@ export declare class PortalsApi {
         headers?: Record<string, string>;
         body: CreatePortalFolderRequestContract;
     }): Promise<CreatePortalFolderResponseContract>;
+    /**
+     * Create an empty portal page
+     * Creates a new EMPTY sidebar page in the portal — a page node plus its sidebar menu item, with no Fusebase note and no block. The page is staged in the portal's customizer draft (not published immediately): the portal owner opens the customizer, reviews the pending page, and publishes it. Pass parentId to nest the page under an existing published or active-draft folder. The returned pageId can immediately be passed to semantic block operations to add content before publishing. Use createPortalPageWithNote instead when a page backed by a new Fusebase note is wanted. Returns the page/menu-item ids, the page url, and the draft branch/seqs. Requires portals.write access.
+     */
+    createPortalPage(params: {
+        path: {
+            orgId: orgIdInPathRequired;
+            portalId: globalIdInPathRequired;
+        };
+        headers?: Record<string, string>;
+        body: CreatePortalPageRequestContract;
+    }): Promise<CreatePortalPageResponseContract>;
     /**
      * Create a portal page backed by a Fusebase note
      * Creates a new sidebar page in the portal backed by a freshly created Fusebase note. The note is created in the portal's workspace and shared into the portal; optional initial text or html can be appended to it. The page (page node + note menu item + note content block) is staged in the portal's customizer draft (not published immediately): the portal owner opens the customizer, reviews the pending page, and publishes it. Pass parentId to nest the page under an existing folder. Returns the note/page/menu-item ids, the page url, and the draft branch/seqs. Requires portals.write access.
@@ -128,6 +296,22 @@ export declare class PortalsApi {
         };
         headers?: Record<string, string>;
     }): Promise<PortalDetailContract>;
+    /**
+     * Count matching blocks on a portal page (published + draft)
+     * Universal preflight: how many active blocks of a given type a page already carries, counted over the published portal AND its active customizer draft — so a block staged earlier in this session is included. `type` is a canonical portal block type; `templateType` is allowed only with type='flexible' and narrows by the flexible template (e.g. type='flexible' + templateType='ai-agent' for AI Agent blocks). Returns only the count — never blocks, bricks, ids or draft events. Requires portals.write access.
+     */
+    getPortalPageBlockCount(params: {
+        path: {
+            orgId: orgIdInPathRequired;
+            portalId: globalIdInPathRequired;
+            pageId: globalIdInPathRequired;
+        };
+        query?: {
+            type?: string;
+            templateType?: string;
+        };
+        headers?: Record<string, string>;
+    }): Promise<GetPortalPageBlockCountResponseContract>;
     /**
      * Invite a portal manager (customizer access)
      * Invites a user as a PORTAL MANAGER via a magic link. A manager has access to the portal customizer and can build, edit, and publish the portal (layout, settings, widgets, custom code); they always get full access to all portal pages. This is a dedicated shortcut for inviteToPortal with orgRole='manager' — no access question is needed (managers are always full access). Returns a magic link for direct portal/customizer access without email confirmation. Requires portals.manage access.
@@ -152,6 +336,48 @@ export declare class PortalsApi {
         headers?: Record<string, string>;
         body: InviteToPortalRequestContract;
     }): Promise<InviteToPortalResponseContract>;
+    /**
+     * Search or browse the AI agents available to the caller
+     * Searches the organization's AI agents (the caller's own org agents plus the available default agents) by title so an AI Agent block can target one by exact id. ALWAYS call this before addPortalAiAgentBlock — never guess or invent an agent id. `query` is optional: omit it to browse the first bounded page. Returns a single page of { id, title, description?, iconName?, iconColor? } and an opaque nextCursor when more pages exist. Show one page at a time and ask before fetching the next; never aggregate the full agent list. Requires portals.write access.
+     */
+    listPortalAiAgents(params: {
+        path: {
+            orgId: orgIdInPathRequired;
+        };
+        query?: {
+            query?: string;
+            limit?: number;
+            cursor?: string;
+        };
+        headers?: Record<string, string>;
+    }): Promise<ListPortalAiAgentsResponseContract>;
+    /**
+     * List a portal's chat channels for the Chat block picker
+     * Lists the real, listable chat channels of a portal so a Chat block can target one by exact id. DMs, group DMs and hidden channels are excluded; the default channel is returned first. ALWAYS call this before addPortalChatBlock with a channel target — never guess a channel id and never assume `general` exists. This is the Chat widget's channel list, distinct from the portal's system chat menu item and the chats-dashboard block. Requires portals.write access.
+     */
+    listPortalChatChannels(params: {
+        path: {
+            orgId: orgIdInPathRequired;
+            portalId: globalIdInPathRequired;
+        };
+        headers?: Record<string, string>;
+    }): Promise<ListPortalChatChannelsResponseContract>;
+    /**
+     * Search or browse a portal's DM target users for the Chat block picker
+     * Searches a portal org's active members + owner by name, username or email so a Chat block can target a DM by exact user id. Call this before addPortalChatBlock with a `dm` target — never guess a user id. `query` is optional: omit it to browse the first bounded page. Returns a single page of { id, displayName, username?, email? }, the matching `total`, and an opaque nextCursor when more pages exist. Show one page at a time and ask before fetching the next; never request or aggregate the full org user list. Requires portals.write access.
+     */
+    listPortalChatUsers(params: {
+        path: {
+            orgId: orgIdInPathRequired;
+            portalId: globalIdInPathRequired;
+        };
+        query?: {
+            query?: string;
+            limit?: number;
+            cursor?: string;
+        };
+        headers?: Record<string, string>;
+    }): Promise<ListPortalChatUsersResponseContract>;
     /**
      * List portal content (folders and pages)
      * Returns the menu tree of a portal: folders, note pages, portal pages, and system items. Use this operation to discover existing content before creating new folders or pages. Item types match portal-service values: notesFolder, note, portalPage, home, link, etc. For items of type 'note', the noteId field contains the Fusebase note id. Requires portals.read access.
@@ -163,6 +389,23 @@ export declare class PortalsApi {
         };
         headers?: Record<string, string>;
     }): Promise<ListPortalContentResponseContract>;
+    /**
+     * Discover Database block sources
+     * Read-only discovery of the exact Database/Dashboard/View ids that addPortalDatabaseBlock requires. `type=database` without `databaseId` returns ONE page of databases (`databases`, `page`, `limit` 20, `total`, optional `nextPage`); `query` searches Database title and alias case-insensitively. `type=database` with `databaseId` returns that database and every Table with its Views. `type=dashboard` returns all shared Dashboard sources with their Views, unpaged. The response is a compact projection: ids, titles, aliases and isDefault only — never schema, filters, representations, metadata, scopes or row data. Requires portals.write access.
+     */
+    listPortalDatabaseBlockSources(params: {
+        path: {
+            orgId: orgIdInPathRequired;
+        };
+        query?: {
+            type?: string;
+            query?: string;
+            page?: number;
+            limit?: number;
+            databaseId?: string;
+        };
+        headers?: Record<string, string>;
+    }): Promise<ListPortalDatabaseBlockSourcesResponseContract>;
     /**
      * List organization portals
      * Returns portals visible for the caller in the organization. Requires portals.read and org access.
@@ -184,6 +427,19 @@ export declare class PortalsApi {
         };
         headers?: Record<string, string>;
     }): Promise<PublishPortalDraftResponseContract>;
+    /**
+     * Restrict or allow editing of a dashboard view
+     * The customizer's "Restrict editing" switch. This is a GLOBAL view setting, not a portal-block setting: it applies everywhere the view is used, including other portal blocks and the dashboard itself. Call it only when the user explicitly asks to restrict or allow editing; it is never part of addPortalDatabaseBlock. Requires dashboard.write access.
+     */
+    setDashboardViewReadonly(params: {
+        path: {
+            orgId: orgIdInPathRequired;
+            dashboardId: string;
+            viewId: string;
+        };
+        headers?: Record<string, string>;
+        body: SetDashboardViewReadonlyRequestContract;
+    }): Promise<SetDashboardViewReadonlyResponseContract>;
     /**
      * Update portal access mode
      * Sets the portal access mode: 'open' (anyone), 'invite-only' (invited users only), 'email' (visitor enters an email, no verification), or 'email-verified' (email with confirmation). The change is staged in the portal's customizer draft (not published immediately): the portal owner opens the customizer, reviews the pending change, and publishes it. Returns the staged access mode and the draft branch/seq. Requires portals.write access.