@k9o/core 1.1.1 → 1.3.0

package/dist/index.d.ts

@@ -10,7 +10,7 @@ export { GateClient } from '@k9o/gate';
 import { KiboClient } from '@k9o/kibo';
 export { AttestationTier, CreateSecretInput, KiboClient, KmsProvider, ListSecretsInput, ListSecretsResult, MoveSecretResult, RevealChallenge, RevealSecretResult, RotateSecretResult, SecretSummary, SecretVisibility, StoreZkDekInput, UpdateSecretInput, UpdateSecretResult, ZkDekHandle, ZkDekRecord } from '@k9o/kibo';
 export { KError, KErrorWire, kerrorFromWire } from './kerror.js';
-export { orgPath, platformPath, projectPath, resolveBaseUrl, validateBaseUrl, validateSlug } from './url-grammar.js';
+export { ApiHost, DEFAULT_BASE_URL, orgPath, parseApiHost, platformPath, projectPath, resolveBaseUrl, validateBaseUrl, validateSlug } from './url-grammar.js';
 
 /**
  * Data-plane DSL: `client.from(collection).select()` etc.
@@ -164,45 +164,94 @@ declare function makeFromFactory(config: HttpClientConfig): (collection: string)
  * `discovery.ts`):
  *   - `client.projects.list()`           → GET    /projects
  *   - `client.projects.create({...})`    → POST   /projects
- *   - `client.projects.get(slug)`        → GET    /@<projectSlug>/project
- *   - `client.projects.update(slug,...)` → PATCH  /@<projectSlug>/project
+ *   - `client.projects.get(slug)`        → GET    /projects/<projectSlug>
+ *   - `client.projects.update(slug,...)` → PATCH  /projects/<projectSlug>
  *
- * The `list` + `create` operations operate org-plane and require
- * `orgSlug` to be bound on the client (or the bearer token to carry
- * an org context). The `get` + `update` operations
- * operate member-plane and use the project slug.
+ * All four operations are org-plane: the client needs an org context
+ * (an `orgSlug` or a bearer token that carries one). Input property
+ * names are the gateway's body property names.
  *
- * Per: all methods throw KError on non-2xx.
+ * All methods throw KError on non-2xx.
  */
 
 /**
- * Project shape. Fields are typed per the canonical shape;
- * the gateway may return additional fields that this type doesn't
- * narrow — those are accessible via `as unknown as` widening.
+ * Project record, as the gateway returns it. Field names are passed through unchanged.
+ * Lists and creates also carry `capabilities`; lists add `accessLevel`.
  */
 type Project = {
     /** `proj_<base62>`. */
     id: string;
     slug: string;
-    name: string;
-    custodyMode: "managed" | "byok" | "hyok";
-    createdAt: string;
-    updatedAt: string | null;
     orgId: string;
+    displayName: string;
+    description: string | null;
+    productScope: string;
+    /** Region code of the project's data. */
+    region: string;
+    custodyMode: "PLATFORM_MANAGED" | "SKR" | "BYOK" | "HYOK";
+    /** `provisioning` while the project is being set up, then `active`; other values may appear. */
+    status: string;
+    /** The caller's role on the project, or `null` when the caller is not a member. */
+    role: string | null;
+    deletedAt: string | null;
+    createdAt: string;
+    /** Soft-delete retention window in days. */
+    softDeleteRetentionDays: number;
+    /** Regions the project's data may live in; `[region]` for a single-region project. */
+    residencySet: ReadonlyArray<string>;
+    /** `"strict"`, or `{ fallbackRegion }` when a catch-all region is set. */
+    residencyPolicy: "strict" | {
+        fallbackRegion: string;
+    };
+    processingContexts: ReadonlyArray<string>;
+    /** Present on list and create responses: what the caller may write. */
+    capabilities?: {
+        authFlows: {
+            write: boolean;
+        };
+        authProviders: {
+            write: boolean;
+        };
+    } | undefined;
+    /** Present on list responses: `member` or `locked`. */
+    accessLevel?: "member" | "locked" | undefined;
 };
 /**
  * Project-creation input.
  */
 type CreateProjectInput = {
-    slug: string;
-    name: string;
-    custodyMode?: "managed" | "byok" | "hyok" | undefined;
+    /** Display name (1 to 128 characters). Required. */
+    displayName: string;
+    /** URL slug (lowercase); the gateway derives one from `displayName` when omitted. */
+    slug?: string | undefined;
+    productScope?: "core" | "kibo" | undefined;
+    /** Region code of the project's data. */
+    region?: string | undefined;
+    defaultProjectRegion?: string | undefined;
+    custodyMode?: "PLATFORM_MANAGED" | "SKR" | "BYOK" | "HYOK" | undefined;
+    processingContexts?: ReadonlyArray<string> | undefined;
+    execSeamConfined?: boolean | undefined;
+    showroomVertical?: string | undefined;
+    persona?: string | undefined;
+    showroomLocale?: {
+        code: string;
+        currency: string;
+        moneyScale: number;
+    } | undefined;
+    /** Makes a retried create return the first result instead of a second project. */
+    idempotencyKey?: string | undefined;
 };
 /**
  * Project-update patch.
  */
 type UpdateProjectInput = {
-    name?: string;
+    slug?: string | undefined;
+    displayName?: string | undefined;
+    description?: string | null | undefined;
+    region?: string | undefined;
+    productScope?: string | undefined;
+    softDeleteRetentionDays?: number | undefined;
+    processingContexts?: ReadonlyArray<string> | undefined;
 };
 /**
  * Factory — produces the `client.projects.*` namespace bound to the
@@ -234,7 +283,8 @@ declare function makeProjectsNamespace(config: HttpClientConfig): {
  * `storage-locations.ts` and is unchanged.
  *
  * Bucket names are logical: the platform resolves them to a physical store, so a developer never sees a
- * physical bucket or key. Signed URLs require an explicit `expiresIn` (no default, max 7 days).
+ * physical bucket or key. Signed URLs require an explicit `expiresIn` (no default). The gateway accepts 1 to 604800 seconds but never
+ * signs for longer than 900 seconds, and the answer's `expiresIn` is the lifetime it actually used.
  *
  * What is NOT here yet, by design: a signed PUT (a method- and content-type-bound upload URL). The gateway has
  * no route for it; uploads go through the multipart `upload` below.
@@ -243,14 +293,15 @@ declare function makeProjectsNamespace(config: HttpClientConfig): {
 /** A bucket. */
 type StorageBucket = {
     name: string;
-    /** `true` removes the authentication requirement on GET; per-object access policies still apply. */
+    /** Stored and returned, not enforced: setting it does not yet change who can read objects. */
     public: boolean;
     /** Bytes; `null` = no limit. */
     fileSizeLimit: number | null;
     /** MIME allow-list; empty = any. */
     allowedMimeTypes: string[];
+    /** Stored and returned, not enforced: the platform does not keep object versions yet. */
     versioning: boolean;
-    /** Lifecycle auto-expiry in days; `null` = never. */
+    /** Stored and returned, not enforced: nothing deletes objects after this many days yet. `null` = never. */
     deleteAfterDays: number | null;
     createdAt: string;
     updatedAt: string;
@@ -261,20 +312,26 @@ type StorageBucket = {
 };
 /** Options for `createBucket`. The bucket name is the first argument (3 to 63 chars, lowercase, digits, hyphens). */
 type CreateBucketOptions = {
+    /** Stored, not enforced yet (see `StorageBucket.public`). */
     public?: boolean;
     fileSizeLimit?: number;
     allowedMimeTypes?: string[] | null;
+    /** Stored, not enforced yet. */
     versioning?: boolean;
+    /** Stored, not enforced yet. */
     deleteAfterDays?: number;
     /** Link the bucket to one of the project's storage locations (see `client.storage.locations`). */
     byosBindingId?: string;
 };
 /** Fields you may change on a bucket. `null` clears a limit; `allowedMimeTypes: null` allows any type. */
 type UpdateBucketOptions = {
+    /** Stored, not enforced yet. */
     public?: boolean;
     fileSizeLimit?: number | null;
     allowedMimeTypes?: string[] | null;
+    /** Stored, not enforced yet. */
     versioning?: boolean;
+    /** Stored, not enforced yet. */
     deleteAfterDays?: number | null;
     /** `null` unlinks the bucket from its storage location. */
     byosBindingId?: string | null;
@@ -294,11 +351,15 @@ type UploadOptions = {
     metadata?: Record<string, string>;
 };
 type SignedUrlOptions = {
-    /** Seconds, required: 1 to 604800 (7 days). There is deliberately no default. */
+    /**
+     * Seconds, required: 1 to 604800. There is deliberately no default. The gateway clamps the lifetime to 900
+     * seconds (15 minutes); read `expiresIn` in the answer for the lifetime you got.
+     */
     expiresIn: number;
     /** `true` makes the download an attachment (`Content-Disposition: attachment`). */
     download?: boolean;
 };
+/** `expiresIn` is the lifetime the gateway used: at most 900 seconds, even when you asked for more. */
 type SignedUrl = {
     signedUrl: string;
     expiresIn: number;
@@ -429,64 +490,6 @@ declare function makeStorageNamespace(config: HttpClientConfig): {
     };
 };
 
-/**
- * `client.metadata.*` — cross-surface metadata query (`k9o.metadata.*`).
- *
- * Client-side surface for `POST /@:projectSlug/metadata/query`. The wire shape is fixed here ahead of the
- * server route: until the gateway ships that route, calling `.execute()` returns a 404 rather than a result.
- * Once it is available, only `telemetry:*` surfaces return data at first; collection and storage metadata
- * follow as their server-side schemas land.
- *
- * `textSearch`/`vectorSearch` are explicitly a later increment (Inc 5) — not implemented
- * here; adding stub methods for an unspecified future mode would be speculative, not spec-grounded.
- */
-
-/** The three cross-surface slices. */
-type MetadataSlice = "collection" | "storage" | "telemetry";
-/** operator vocabulary (= JSON-policy set), mirrored verbatim from the gateway's
- *  `metadata-query-parse.ts` so a typo can't silently pass client-side and fail only server-side. */
-declare const METADATA_OPERATORS: readonly ["eq", "neq", "gt", "gte", "lt", "lte", "contains", "startsWith", "endsWith", "in", "notIn", "and", "or", "not"];
-type MetadataOperator = (typeof METADATA_OPERATORS)[number];
-/** A surface label `<slice>:<scope>`, e.g. `collection:posts`, `storage:images`,
- *  `telemetry:auth.session.created`. */
-type MetadataSurface = `${MetadataSlice}:${string}`;
-type MetadataWhereClause = {
-    readonly field: string;
-    readonly op: MetadataOperator;
-    readonly value: unknown;
-};
-/**
- * One result row: "each record carries its surface + scope + the queried metadata
- * fields plus a back-reference id" — `recordId` (collection), `objectPath` (storage), or `eventId`
- * (telemetry), depending on which surface the row came from. Exact field names are provisional
- * pending Inc 2 landing a concrete response schema; kept loose (`metadata: Record<string, unknown>`)
- * rather than guessing a shape that isn't coined in code anywhere yet.
- */
-type MetadataQueryRecord = {
-    surface: MetadataSurface;
-    scope: string;
-    recordId?: string;
-    objectPath?: string;
-    eventId?: string;
-    metadata: Record<string, unknown>;
-};
-type MetadataQueryResult = {
-    records: readonly MetadataQueryRecord[];
-    nextCursor: string | null;
-};
-/** The `k9o.metadata.from(...).where(...).limit(...).execute()` builder. Immutable —
- *  every chained call returns a new builder, so a partially-built query can be safely reused/branched. */
-type MetadataQueryBuilder = {
-    where(field: string, op: MetadataOperator, value: unknown): MetadataQueryBuilder;
-    limit(n: number): MetadataQueryBuilder;
-    cursor(c: string | null): MetadataQueryBuilder;
-    execute(): Promise<Envelope<MetadataQueryResult>>;
-};
-declare function makeMetadataNamespace(config: HttpClientConfig): {
-    /** Start a cross-surface metadata query against one or more surfaces. */
-    from(surface: MetadataSurface | readonly MetadataSurface[]): MetadataQueryBuilder;
-};
-
 /**
  * Migration lifecycle SDK — `client.migrations.*`.
  *
@@ -660,32 +663,73 @@ type Migration = {
     policy?: MigrationPolicy;
 };
 /**
- * Applied-migration record returned by `list` + `get`.
+ * Applied-migration record returned by `list` + `get`. `get` also carries `opPayload`
+ * (the migration body as submitted, or `null` for old migrations).
  */
 type AppliedMigration = {
     version: number;
     slug: string;
     checksum: string;
     appliedAt: string;
+    noPolicy: boolean;
+    affectedCollections: ReadonlyArray<string>;
+    opPayload?: unknown;
 };
+/** A migration that `apply` or `applyPending` just applied. Carries no `appliedAt`. */
+type AppliedMigrationRow = {
+    version: number;
+    slug: string;
+    checksum: string;
+};
+/** A migration `apply` left alone, e.g. `already_applied`. */
+type SkippedMigrationRow = {
+    version: number;
+    slug: string;
+    reason: string;
+};
+/** Result of `apply`. */
+type ApplyMigrationsResult = {
+    applied: ReadonlyArray<AppliedMigrationRow>;
+    skipped: ReadonlyArray<SkippedMigrationRow>;
+};
+/** Result of `applyPending`: `pendingId` is the queued row that was applied. */
+type ApplyPendingResult = ApplyMigrationsResult & {
+    pendingId: string;
+};
+type PendingMigrationStatus = "queued" | "pending_approval" | "applied" | "rejected" | "cancelled";
 /**
  * Pending migration record returned by `listPending`.
  */
 type PendingMigration = {
-    pendingId: string;
+    id: string;
     version: number;
     slug: string;
     checksum: string;
-    submittedAt: string;
-    submittedBy: string;
+    status: PendingMigrationStatus;
+    affectedCollections: ReadonlyArray<string>;
+    /** Approval that gates a `pending_approval` row, else `null`. */
+    approvalId: string | null;
+    queuedAt: string;
+    queuedBy: string;
+    decidedAt: string | null;
+    decidedBy: string | null;
+    decisionReason: string | null;
+};
+/** One row of the `queue` answer. */
+type QueuedMigration = {
+    /** The pending id to pass to `applyPending`, `rejectPending` or `deletePending`. */
+    id: string;
+    version: number;
+    slug: string;
+    status: "queued" | "pending_approval";
+    approvalId: string | null;
+    affectedCollections: ReadonlyArray<string>;
 };
 declare function makeMigrationsNamespace(config: HttpClientConfig): {
     /** Apply migrations immediately (PROJECT_ADMIN minimum). */
     apply(input: {
         migrations: ReadonlyArray<Migration>;
-    }): Promise<Envelope<{
-        applied: ReadonlyArray<AppliedMigration>;
-    }>>;
+    }): Promise<Envelope<ApplyMigrationsResult>>;
     /** List applied migrations on the project. */
     list(): Promise<Envelope<ReadonlyArray<AppliedMigration>>>;
     /** Get a single applied migration by version. */
@@ -693,27 +737,29 @@ declare function makeMigrationsNamespace(config: HttpClientConfig): {
     /** Queue migrations for maker-checker approval. */
     queue(input: {
         migrations: ReadonlyArray<Migration>;
-    }): Promise<Envelope<{
-        pending: ReadonlyArray<PendingMigration>;
-    }>>;
-    /** List pending (queued, not yet approved) migrations. */
-    listPending(): Promise<Envelope<ReadonlyArray<PendingMigration>>>;
+    }): Promise<Envelope<ReadonlyArray<QueuedMigration>>>;
+    /** List pending migrations: `queued` ones by default, or those with the given `status`. */
+    listPending(opts?: {
+        status?: PendingMigrationStatus | undefined;
+    }): Promise<Envelope<ReadonlyArray<PendingMigration>>>;
     /**
      * Apply a queued migration by id (same-actor fast path — floors at
      * PROJECT_ADMIN; a `pending_approval` row, i.e. a protected-collection
      * migration awaiting a distinct-admin's review, is refused here and
      * needs its own approval flow, not this call).
      */
-    applyPending(pendingId: string): Promise<Envelope<AppliedMigration>>;
+    applyPending(pendingId: string): Promise<Envelope<ApplyPendingResult>>;
     /** Reject a pending migration (transitions to rejected; does not apply). */
     rejectPending(pendingId: string, input?: {
         reason?: string;
     }): Promise<Envelope<{
-        rejected: boolean;
+        pendingId: string;
+        status: "rejected";
     }>>;
     /** Delete a pending migration from the queue. */
     deletePending(pendingId: string): Promise<Envelope<{
-        deleted: boolean;
+        pendingId: string;
+        status: "cancelled";
     }>>;
 };
 
@@ -723,15 +769,14 @@ declare function makeMigrationsNamespace(config: HttpClientConfig): {
  * Backed by the gateway functions and invoke routes.
  *
  * Wire mapping:
- *   - `deploy({ name, runtime, code, ... })`  → POST   /@<slug>/functions
+ *   - `deploy({ name, runtime, tier, artifactKey, version })` → POST /@<slug>/functions
  *   - `list()`                                → GET    /@<slug>/functions
  *   - `get(name)`                             → GET    /@<slug>/functions/<name>
  *   - `delete(name)`                          → DELETE /@<slug>/functions/<name>
  *   - `invoke(name, payload)`                 → POST   /@<slug>/functions/<name>/invoke
  *
- * Per: deploy requires PROJECT_ADMIN; invoke authority is per
- * function manifest. Per: deploy returns 202 with status
- * `deploying`; the function is ready when status flips to `active`.
+ * Deploy requires PROJECT_ADMIN and returns with status `deploying`; the
+ * function is ready when status flips to `active`.
  */
 
 /**
@@ -741,50 +786,78 @@ type FunctionRecord = {
     /** `fn_<base62>`. */
     id: string;
     name: string;
-    runtime: "wasm" | "bun" | "node";
-    status: "deploying" | "active" | "retired" | "failed";
-    tier: "low" | "medium" | "high";
+    runtime: DeployFunctionInput["runtime"];
+    tier: "gateway" | "sandbox";
+    entryPoint: string;
+    version: string;
+    status: "deploying" | "active" | "error" | "retired";
+    /** Who manages the function: a developer deploy, or an extension (`extension:<id>`). */
+    source: string;
+    description: string | null;
     createdAt: string;
-    updatedAt: string | null;
+    deployedAt: string | null;
+    retiredAt: string | null;
+    errorDetail: string | null;
 };
 /**
- * Deploy input. The `code` field is the runtime bundle (base64-encoded
- * WASM or JS source).
+ * Deploy input. The function's bytes are uploaded first (the gateway's
+ * function-artifact upload returns the `artifactKey`); deploy references
+ * that artifact.
  */
 type DeployFunctionInput = {
+    /** Function name (1 to 128 characters). */
     name: string;
-    runtime: "wasm" | "bun" | "node";
-    code: string;
-    tier?: "low" | "medium" | "high";
-    config?: Record<string, unknown>;
+    runtime: "bun" | "python" | "go" | "java" | "kotlin" | "dotnet" | "swift" | "php" | "ruby" | "rust" | "tinygo" | "zig" | "assemblyscript";
+    /** `gateway` runs WebAssembly in the gateway; `sandbox` runs an OCI image archive. */
+    tier: "gateway" | "sandbox";
+    /** Content-addressed key of the uploaded artifact. */
+    artifactKey: string;
+    /** Version label for this deploy (1 to 64 characters). */
+    version: string;
+    description?: string | undefined;
+};
+/** Optional invoke controls; property names are the gateway's. */
+type InvokeFunctionOptions = {
+    /** Run asynchronously instead of waiting for the result. */
+    background?: boolean | undefined;
+    delegation?: {
+        token: string;
+        invokeSessionId?: string | undefined;
+    } | undefined;
+    onBehalfOf?: string | undefined;
+    confinedTo?: string | undefined;
 };
 declare function makeFunctionsNamespace(config: HttpClientConfig): {
-    /** Deploy or redeploy a function. Returns the function record with status. */
+    /**
+     * Upload a function artifact and get back its content-addressed `artifactKey`, to pass to `deploy`.
+     * `POST /@<projectSlug>/functions/artifacts` with the raw bytes: a WebAssembly module for the gateway tier (up to
+     * 16 MiB) or an OCI image archive for the sandbox tier (up to 256 MiB). Uploading the same bytes again returns the same key.
+     */
+    uploadArtifact(bytes: Uint8Array | ArrayBuffer | Blob, kind: "wasm" | "tar"): Promise<Envelope<{
+        artifactKey: string;
+    }>>;
+    /** Deploy or redeploy a function from an uploaded artifact. Returns the function record with status. */
     deploy(input: DeployFunctionInput): Promise<Envelope<FunctionRecord>>;
     /** List deployed functions (cursor pagination). */
     list(opts?: {
         limit?: number;
         cursor?: string;
         status?: FunctionRecord["status"];
+        tier?: FunctionRecord["tier"];
+        source?: string;
     }): Promise<Envelope<ReadonlyArray<FunctionRecord>>>;
     /** Get a function by name. */
     get(name: string): Promise<Envelope<FunctionRecord>>;
-    /** Retire a function. Returns confirmation; the function name enters a 24h cooldown. */
-    delete(name: string): Promise<Envelope<{
-        retired: boolean;
-        cooldownUntil: string;
-    }>>;
+    /** Retire a function. Returns the retired record; the function name enters a 24h cooldown. */
+    delete(name: string): Promise<Envelope<FunctionRecord>>;
     /**
-     * Invoke a function. The `payload` is passed to the function runtime
-     * verbatim; the gateway returns whatever the function returns wrapped
-     * in the standard envelope.
-     *
-     * Per: invoke authority is per-function (declared in the
-     * function manifest). Per: streaming responses use the
-     * subscription/async-iterator pattern; this method covers the
+     * Invoke a function. The `payload` is sent as the `payload` field of
+     * the request body and passed to the function runtime verbatim; the
+     * gateway returns whatever the function returns wrapped in the standard
+     * envelope. Invoke authority is per function. This method covers the
      * request-response variant only.
      */
-    invoke<TResult = unknown, TPayload = unknown>(name: string, payload: TPayload): Promise<Envelope<TResult>>;
+    invoke<TResult = unknown, TPayload = unknown>(name: string, payload?: TPayload, options?: InvokeFunctionOptions): Promise<Envelope<TResult>>;
 };
 
 /**
@@ -802,66 +875,88 @@ declare function makeFunctionsNamespace(config: HttpClientConfig): {
  *   - `delete(bundleId)`                  → DELETE /@<slug>/policies/<id>
  *   - `publish(bundleId)`                 → POST   /@<slug>/policies/<id>/publish
  *
- * Per: only Pathmaker-class roles author policy; only
- * Custodian-class roles publish. `validate` is read-only and any role
- * with policy-read can lint a candidate bundle.
+ * Only authoring roles write policy and only custodian roles publish.
+ * `validate` is read-only and any role with policy-read can lint a
+ * candidate document.
  */
 
 type PolicyBundle = {
     /** `pol_<base62>`. */
     id: string;
-    name: string;
-    version: number;
-    status: "draft" | "published" | "deactivated";
-    rules: Record<string, unknown>;
+    projectId: string;
+    status: "draft" | "published" | "superseded";
+    /** The policy document. */
+    policy: PolicyDocument;
+    /** The rules catalogue, when the bundle carries one. */
+    rules?: unknown;
+    createdBy: string;
     createdAt: string;
     publishedAt: string | null;
-    createdBy: string;
+    supersededAt: string | null;
+    supersededBy: string | null;
+    source: "rest" | "migration" | "cli";
+    editorMode: "visual" | "json" | "unspecified";
+    supersededReason: string | null;
+    /** Id of a queued publish awaiting a second approver, else `null`. */
+    pendingChangeId: string | null;
+};
+/** Answer of `publish`: the publish is queued for approval (HTTP 202). */
+type PolicyPublishResult = {
+    pendingChangeId: string;
+    bundleId: string;
+    status: "pending_approval";
 };
+/**
+ * The policy document: sections keyed by resource kind (`collections`,
+ * `storage`, `tools`, `functions`, `secrets`, `streams`, `analytics`);
+ * other keys are allowed.
+ */
+type PolicyDocument = Record<string, unknown>;
 type CreatePolicyInput = {
-    name: string;
-    rules: Record<string, unknown>;
+    policy: PolicyDocument;
+    rules?: unknown;
+    editorMode?: "visual" | "json" | "unspecified" | undefined;
 };
 type UpdatePolicyInput = {
-    name?: string;
-    rules?: Record<string, unknown>;
+    policy: PolicyDocument;
+    rules?: unknown;
+    editorMode?: "visual" | "json" | "unspecified" | undefined;
 };
+type ValidatePolicyInput = {
+    policy: PolicyDocument;
+    rules?: unknown;
+};
+/** Validation failures are errors, so a successful validate always answers `{ valid: true }`. */
 type ValidatePolicyResult = {
-    valid: boolean;
-    errors: ReadonlyArray<{
-        rule: string;
-        message: string;
-    }>;
-    warnings: ReadonlyArray<{
-        rule: string;
-        message: string;
-    }>;
+    valid: true;
+};
+/** Optional publish controls; property names are the gateway's. */
+type PublishPolicyOptions = {
+    acknowledgeSelfLockout?: boolean | undefined;
 };
 declare function makePoliciesNamespace(config: HttpClientConfig): {
     /** Return the currently-active policy for the project. */
     current(): Promise<Envelope<PolicyBundle | null>>;
-    /** List all policy bundles (draft + published + deactivated). */
+    /** List all policy bundles (draft + published + superseded). */
     list(opts?: {
         status?: PolicyBundle["status"] | undefined;
-        limit?: number | undefined;
-        cursor?: string | undefined;
     }): Promise<Envelope<ReadonlyArray<PolicyBundle>>>;
     /** Create a draft policy bundle. */
     create(input: CreatePolicyInput): Promise<Envelope<PolicyBundle>>;
-    /** Lint a candidate rule set without persisting. */
-    validate(input: {
-        rules: Record<string, unknown>;
-    }): Promise<Envelope<ValidatePolicyResult>>;
+    /** Lint a candidate policy document without persisting. */
+    validate(input: ValidatePolicyInput): Promise<Envelope<ValidatePolicyResult>>;
     /** Get a single bundle by id. */
     get(bundleId: string): Promise<Envelope<PolicyBundle>>;
-    /** Patch a draft bundle. Cannot patch published bundles (publish→republish flow). */
+    /** Replace a draft bundle's policy document. Cannot patch published bundles (publish→republish flow). */
     update(bundleId: string, patch: UpdatePolicyInput): Promise<Envelope<PolicyBundle>>;
-    /** Delete a draft bundle. Cannot delete published bundles. */
-    delete(bundleId: string): Promise<Envelope<{
-        deleted: boolean;
-    }>>;
-    /** Publish a draft bundle — transitions to `published` + becomes active for the project. */
-    publish(bundleId: string): Promise<Envelope<PolicyBundle>>;
+    /** Delete a draft bundle. Cannot delete published bundles. The gateway answers 204 with no body. */
+    delete(bundleId: string): Promise<Envelope<undefined>>;
+    /**
+     * Publish a draft bundle. The gateway answers 202 with `{ pendingChangeId, bundleId }`: the publish waits for
+     * approval, then the bundle becomes active. Pass `acknowledgeSelfLockout: true` to proceed when the bundle
+     * would remove your own read access to a collection.
+     */
+    publish(bundleId: string, options?: PublishPolicyOptions): Promise<Envelope<PolicyPublishResult>>;
 };
 
 /**
@@ -870,21 +965,17 @@ declare function makePoliciesNamespace(config: HttpClientConfig): {
  * Backed by the gateway audit-log routes.
  *
  * Wire mapping:
- *   - `query({ since, until, type, actorId, targetKind, targetId, limit, cursor })`
+ *   - `query({ eventType, actorId, after, before, limit, cursor })`
  *     → GET /@<slug>/audit-log?...
  *
- * The endpoint accepts cursor-paginated reverse-chronological queries.
- * `type` is the audit-event namespace (e.g. `data.write.access.insert`,
- * `gate.signin.success`) per the event-name taxonomy +
- * `feedback_error_code_namespace_boundary_and_prefix.md` cement.
+ * Option names are the gateway's query parameter names. The endpoint
+ * accepts cursor-paginated reverse-chronological queries. `eventType` is
+ * the audit-event name (e.g. `data.write.access.insert`).
  *
- * Returns audit events with full context payload — actorId / targetKind /
- * targetId / payload / occurredAt / requestId / traceId.
+ * Returns audit events with full context payload.
  */
 
-/**
- * Audit event record `_sys.audit_log` shape.
- */
+/** Audit event record. */
 type AuditEvent = {
     id: string;
     /** Dotted namespace (e.g. `data.write.access.insert`). */
@@ -898,18 +989,14 @@ type AuditEvent = {
     traceId: string | null;
 };
 type AuditQueryOpts = {
-    /** ISO 8601 lower bound (inclusive). */
-    since?: string | undefined;
-    /** ISO 8601 upper bound (exclusive). */
-    until?: string | undefined;
-    /** Filter by event type (exact match; future cycles may add prefix-match). */
-    type?: string | undefined;
+    /** Filter by event type. */
+    eventType?: string | undefined;
     /** Filter by actor. */
     actorId?: string | undefined;
-    /** Filter by target resource kind. */
-    targetKind?: string | undefined;
-    /** Filter by target resource id. */
-    targetId?: string | undefined;
+    /** ISO 8601 lower bound: only events after this instant. */
+    after?: string | undefined;
+    /** ISO 8601 upper bound: only events before this instant. */
+    before?: string | undefined;
     /** Page size (per-tier max bounded server-side). */
     limit?: number | undefined;
     /** Cursor from prior response. */
@@ -920,15 +1007,13 @@ declare function makeAuditNamespace(config: HttpClientConfig): {
      * Query the audit log. Returns reverse-chronological events matching
      * all supplied filters (AND composition).
      *
-     * Per RBAC: requires `AUDIT_READER` role minimum; Custodian-
-     * class roles inherit. Project-level audit is project-scoped (this
-     * endpoint); platform-level audit is admin-only (separate surface).
+     * Requires the `AUDIT_READER` role at minimum. This endpoint is
+     * project-scoped.
      */
     query(opts?: AuditQueryOpts): Promise<Envelope<ReadonlyArray<AuditEvent>>>;
     /**
      * Convenience: live-tail recent events. Currently single-shot read
-     * with `since` defaulted to "1 minute ago"; subscription-mode tail
-     * (SSE) lands when the streaming layer ships pattern.
+     * with `after` defaulted to "1 minute ago".
      */
     tail(opts?: {
         sinceMinutes?: number;
@@ -960,14 +1045,27 @@ declare function makeAuditNamespace(config: HttpClientConfig): {
  * is exposed as an API).
  */
 
+/**
+ * Org record, as the gateway returns it. `list` rows add `viaToken` and `consoleDomain`;
+ * `get`, `current` and `restore` add `customDomain` and `deletedAt`.
+ */
 type Org = {
     /** `org_<base62>`. */
     id: string;
     slug: string;
-    name: string;
-    status: "active" | "suspended" | "soft-deleted";
+    displayName: string;
+    products: ReadonlyArray<string>;
+    billingTier: string;
+    signupProduct: string;
+    /** The caller's role in the org. */
+    role: string;
     createdAt: string;
-    updatedAt: string | null;
+    customDomain?: string | null | undefined;
+    deletedAt?: string | null | undefined;
+    /** List rows only: `true` when the org is reached through the token rather than a membership. */
+    viaToken?: boolean | undefined;
+    /** List rows only: the org's Console host. */
+    consoleDomain?: string | undefined;
 };
 declare function makeOrgsNamespace(config: HttpClientConfig): {
     /** List orgs accessible to the caller. */
@@ -983,27 +1081,27 @@ declare function makeOrgsNamespace(config: HttpClientConfig): {
 /**
  * Compute LLMs SDK — `client.compute.llms.*`.
  *
- * Compute LLMs registry. Curated 9-model library
- * + 4-endpoint family + per-model tier-gating.
+ * Compute LLMs registry: a curated model library, four endpoints and
+ * per-model tier gating.
  *
- * Wire mapping (project-plane;):
+ * Wire mapping (project-plane):
  *   - list()                    → GET  /@<slug>/compute/llms
  *   - read(modelId)             → GET  /@<slug>/compute/llms/<model-id>
  *   - invoke(modelId, ...)      → POST /@<slug>/compute/llms/<model-id>/invoke
  *   - invokeStream(modelId,...) → POST /@<slug>/compute/llms/<model-id>/invoke-stream (SSE)
  *
- * Per RBAC: list/read against all cohort roles; invoke +
- * invokeStream require PROJECT_AUTHOR or PROJECT_ADMIN (LLM cost gate).
- * Per, surfaces K9O_LLM_PROVIDER_UNAVAILABLE (503) +
- * reuses K9O_MODEL_NOT_DECLARED / K9O_TIER_FEATURE_GATED /
- * K9O_AGENT_INFERENCE_TIMEOUT.
+ * RBAC: list/read against all cohort roles; invoke + invokeStream require
+ * PROJECT_AUTHOR or PROJECT_ADMIN (LLM cost gate). External-provider models
+ * answer 501 `K9O_NOT_IMPLEMENTED` until the provider client is built.
+ * Surfaces K9O_LLM_PROVIDER_UNAVAILABLE (503), K9O_MODEL_NOT_DECLARED and
+ * K9O_TIER_FEATURE_GATED.
  */
 
-/** Curated 9-model closed enum at v2 launch (extensible v2.x). */
+/** Curated model ids. */
 type LLMModelId = "mistral-7b" | "mistral-8x7b" | "llama-3-8b" | "llama-3-70b" | "claude-3-5-sonnet" | "gpt-4o" | "gpt-4o-mini" | "text-embedding-3-small" | "text-embedding-3-large";
 type LLMProviderClass = "self-hosted" | "external";
 type LLMModality = "text-completion" | "text-completion+tool-use" | "embeddings";
-/** Model metadata + (cost transparency). */
+/** Model metadata with per-model cost. */
 type LLMModel = {
     id: LLMModelId;
     providerClass: LLMProviderClass;
@@ -1012,43 +1110,68 @@ type LLMModel = {
     tierGate: string;
     contextWindow: number;
     capabilities: ReadonlyArray<string>;
-    /** Per-model token cost for cost-transparency. */
+    /** Per-model token cost. */
     costPerMillionInputTokens: number;
     costPerMillionOutputTokens: number;
 };
-/** Inference parameters (passed through to provider). */
+/** Inference parameters the route reads; sent flat in the request body. */
 type LLMInvokeParams = {
+    /** 1 to 32000. */
     maxTokens?: number;
+    /** 0 to 2. */
     temperature?: number;
-    topP?: number;
-    stop?: ReadonlyArray<string>;
-    [key: string]: unknown;
+    /** Free-form usage label recorded with the call. */
+    usageType?: string;
+};
+/** Token counts the model server reported for a call. */
+type LLMUsage = {
+    promptTokens: number;
+    completionTokens: number;
+    totalTokens: number;
 };
-/** Synchronous inference response `/invoke`. */
+/** Synchronous inference response from `/invoke`. */
 type LLMResponse = {
-    completion: string;
-    tokensUsed: number;
-    latencyMs: number;
+    modelId: string;
+    /** The generated text. */
+    content: string;
+    finishReason: string | null;
+    usage: LLMUsage;
+    usageType: string;
 };
-/** Streaming chunk `/invoke-stream` (SSE per-token). */
+/**
+ * One chunk of the `/invoke-stream` response: the model server's OpenAI-style
+ * chat-completion chunk, passed through unchanged. Read incremental text from
+ * `choices[0].delta.content`; the final chunk may carry `usage`.
+ */
 type LLMStreamChunk = {
-    /** Incremental completion delta. */
-    delta: string;
-    /** True on the terminal chunk. */
-    done?: boolean;
-    /** Populated on terminal chunk. */
-    tokensUsed?: number;
+    id?: string;
+    object?: string;
+    model?: string;
+    choices?: ReadonlyArray<{
+        index?: number;
+        delta?: {
+            role?: string;
+            content?: string | null;
+        };
+        finish_reason?: string | null;
+    }>;
+    usage?: {
+        prompt_tokens?: number;
+        completion_tokens?: number;
+        total_tokens?: number;
+    } | null;
+    [key: string]: unknown;
 };
 type LLMInvokeInput = {
     prompt: string;
     params?: LLMInvokeParams;
 };
-/** Error code coined in (others reused). */
+/** Error codes specific to LLM calls. */
 declare const LLM_ERROR_CODES: {
     readonly PROVIDER_UNAVAILABLE: "K9O_LLM_PROVIDER_UNAVAILABLE";
 };
 declare function makeComputeNamespace(config: HttpClientConfig): {
-    /** LLM registry + inference — `client.compute.llms.*`. */
+    /** LLM registry + inference — `client.compute.llms.*` . */
     llms: {
         /** GET /@<slug>/compute/llms — list models available to the project tier. */
         list(opts?: {
@@ -1064,11 +1187,10 @@ declare function makeComputeNamespace(config: HttpClientConfig): {
         invoke(modelId: LLMModelId | string, input: LLMInvokeInput): Promise<Envelope<LLMResponse>>;
         /**
          * POST /@<slug>/compute/llms/<model-id>/invoke-stream — streaming
-         * inference (SSE; per-token delta for low-latency UX).
+         * inference (SSE; the model server's OpenAI-style chunks).
          * Returns an async iterable of `LLMStreamChunk` — caller writes
          * `for await (const chunk of client.compute.llms.invokeStream(...))`.
-         * The SDK handles SSE framing internally per
-         * `feedback_sdk_abstracted_primitive_default_to_richer_interaction.md`.
+         * The SDK handles SSE framing internally.
          */
         invokeStream(modelId: LLMModelId | string, input: LLMInvokeInput): AsyncGenerator<LLMStreamChunk, void, void>;
     };
@@ -1083,33 +1205,56 @@ declare function makeComputeNamespace(config: HttpClientConfig): {
  * across accessible orgs) — `client.org` is the singular bound-org
  * namespace with member / group / smtp / audit / gate sub-namespaces.
  *
- * Org-plane URL grammar: requests route against the
- * `<orgSlug>.api.k9o.io/` org subdomain WITHOUT the `@<projectSlug>/`
- * prefix used by project-plane requests. The gateway resolves the org
- * context from the subdomain.
+ * Org-plane URL grammar: requests go to the org's API host (`<orgSlug>.api.<apex>`) WITHOUT the
+ * `@<projectSlug>/` prefix used by project-plane requests. The gateway resolves the org context from the host.
  */
 
 type OrgMember = {
-    /** `u_<base62>`. */
+    /** `usr_<base62>`. */
     userId: string;
+    orgId: string;
     email: string;
-    /** Org-level role enum. */
+    displayName: string;
+    /** Org-level role. */
     role: "ORG_OWNER" | "ORG_ADMIN" | "ORG_BILLING_ADMIN" | "ORG_MEMBER";
-    joinedAt: string;
-    status: "active" | "invited" | "suspended";
+    invitedAt: string;
+    /** `null` until the invitation is accepted. */
+    acceptedAt: string | null;
+    status: "active" | "suspended";
+    /** `invited` until accepted, then the same as `status`. */
+    state: "invited" | "active" | "suspended";
+    suspendedAt: string | null;
+};
+/**
+ * Answer of `members.invite` when the email has no account yet (HTTP 202): an invitation was created
+ * instead of a member. `delivery` says whether the invitation email went out.
+ */
+type OrgInviteResult = {
+    invitation: {
+        id: string;
+        orgId: string;
+        email: string;
+        role: OrgMember["role"];
+        expiresAt: string;
+    };
+    delivery: "sent" | "not_configured" | "failed";
 };
 type OrgGroup = {
     /** `grp_<base62>`. */
     id: string;
+    orgId: string;
     name: string;
-    memberCount: number;
+    description: string | null;
+    /** Groups come from an identity provider. */
+    source: "idp";
+    sourceGroupId: string;
     createdAt: string;
 };
 type OrgRoleGrant = {
     /** `grt_<base62>`. */
     id: string;
     userId: string;
-    role: "ORG_ADMIN" | "ORG_BILLING_ADMIN";
+    role: "ORG_OWNER" | "ORG_ADMIN" | "ORG_BILLING_ADMIN" | "ORG_AUDITOR" | "ORG_MEMBER";
     grantedBy: string;
     grantedAt: string;
     revokedAt: string | null;
@@ -1117,229 +1262,198 @@ type OrgRoleGrant = {
     viaDelegationId: string | null;
 };
 /**
- * Org-level audit event 6-event family.
- *
- * Event types (closed set at v2.1.132):
- *   - `data.write.org.member_invited`
- *   - `data.write.org.member_removed`
- *   - `data.write.org.role_granted`
- *   - `data.write.org.role_revoked`
- *   - `data.write.org.idp_config_changed`
- *   - `data.write.org.settings_updated`
- *
- * `targetKind` is `org` for all; `targetId` is the orgId.
+ * Org-level audit event: member invited or removed, role granted or revoked, identity provider
+ * or settings changed.
  */
 type OrgAuditEvent = {
     id: string;
     type: string;
     actorId: string | null;
-    targetKind: "org";
-    targetId: string;
+    targetKind: string | null;
+    targetId: string | null;
     payload: Record<string, unknown>;
-    occurredAt: string;
+    createdAt: string;
     requestId: string | null;
     traceId: string | null;
 };
 /**
- * Org SMTP configuration. Sensitive fields (passwordRef)
- * are sequestered in Kibo enclave; the SDK stores only the reference.
+ * Org SMTP configuration, as the gateway takes it in the `smtpConfig` field of PATCH /org.
+ * The password is never sent: `passwordRef` is a reference to a stored secret.
  */
 type SmtpConfig = {
     host: string;
     port: number;
     username: string;
-    /** Kibo enclave credential reference; opaque token. */
+    /** Reference to the stored SMTP password; opaque token. */
     passwordRef: string;
-    fromEmail: string;
-    fromName: string;
-    encryption: "none" | "starttls" | "tls";
-    replyToEmail?: string | undefined;
+    fromAddress: string;
+    fromName?: string | undefined;
 };
 type SmtpTestEmailInput = {
     to: string;
-    /** Optional override of the from address for the test send (defaults to fromEmail). */
-    fromOverride?: string | undefined;
+    subject?: string | undefined;
 };
 type SmtpTestEmailResult = {
-    ok: boolean;
-    /** Diagnostic message returned by the SMTP server (success or error detail). */
-    diagnostic: string;
-    /** ISO 8601 timestamp of the test attempt. */
-    attemptedAt: string;
+    accepted: boolean;
+    /** Which SMTP configuration serves the org: `org` when it has its own, else `platform`. */
+    resolvedTier: "org" | "platform";
+    to: string;
+    /** `true` while the gateway does not send the message itself. */
+    dryRun: boolean;
+};
+type OrgDefaultLlm = {
+    orgId: string;
+    defaultModelId: string;
+    updatedAt: string;
+    updatedBy: string | null;
 };
+type OrgIdpProviderKind = "google" | "github" | "microsoft" | "oidc" | "saml" | "scim" | "ldap" | "active_directory" | "apple" | "facebook" | "twitter";
 type OrgIdpProvider = {
-    /** `idp_<base62>`. */
     id: string;
-    name: string;
-    /** Protocol/vendor (e.g. "okta-saml", "azure-ad-oidc", "google-workspace"). */
-    kind: string;
+    idpProvider: OrgIdpProviderKind;
+    displayName: string;
+    clientId: string;
     enabled: boolean;
     createdAt: string;
 };
+/** Body of POST /identity-providers. `clientSecretRef` is a reference to a stored secret, never the secret itself. */
 type CreateOrgIdpInput = {
-    name: string;
-    kind: string;
-    config: Record<string, unknown>;
+    idpProvider: OrgIdpProviderKind;
+    displayName: string;
+    clientId: string;
+    clientSecretRef: string;
+    tierGating: "free_tier_ok" | "ridge_plus";
+    redirectUri?: string | undefined;
+    metadataUrl?: string | null | undefined;
+    attributeMap?: Record<string, unknown> | undefined;
+    enabled?: boolean | undefined;
+};
+/** Body of PATCH /identity-providers/<id>. */
+type UpdateOrgIdpInput = {
+    displayName?: string | undefined;
+    clientId?: string | undefined;
+    clientSecretRef?: string | undefined;
+    redirectUri?: string | undefined;
+    metadataUrl?: string | null | undefined;
+    attributeMap?: Record<string, unknown> | undefined;
+    enabled?: boolean | undefined;
 };
 declare function makeOrgNamespace(config: HttpClientConfig): {
-    /** Member lifecycle — list / invite / get / remove. */
+    /** Member lifecycle — list / invite / remove. */
     members: {
-        /** GET /members (org-plane LIST). */
+        /** GET /members (org-plane LIST). The route is not paged; it filters by userId, role, acceptanceStatus, status and state. */
         list(opts?: {
-            limit?: number | undefined;
-            cursor?: string | undefined;
-            status?: OrgMember["status"] | undefined;
+            userId?: string | undefined;
+            role?: OrgMember["role"] | undefined;
+            acceptanceStatus?: "accepted" | "pending" | undefined;
+            status?: "active" | "suspended" | undefined;
+            state?: string | undefined;
         }): Promise<Envelope<ReadonlyArray<OrgMember>>>;
-        /** POST /members — invite a new org member by email. */
+        /**
+         * POST /members — add a member by email. An existing user becomes a member at once (201, the member row);
+         * an unknown email gets an invitation (202, `{ invitation, delivery }`).
+         */
         invite(input: {
             email: string;
             role: OrgMember["role"];
-        }): Promise<Envelope<OrgMember>>;
-        /** GET /members/<userId> — single-read (existing endpoint). */
-        get(userId: string): Promise<Envelope<OrgMember>>;
-        /** DELETE /members/<userId> — remove a member from the org. */
-        remove(userId: string): Promise<Envelope<{
-            removed: boolean;
-        }>>;
+        }): Promise<Envelope<OrgMember | OrgInviteResult>>;
+        /** DELETE /members/<userId> — remove a member from the org. The gateway answers 204 with no body. */
+        remove(userId: string): Promise<Envelope<undefined>>;
     };
-    /** Group lifecycle — list / create / get / delete. */
+    /** Groups — list / get (read-only). */
     groups: {
         /** GET /groups (org-plane LIST). */
         list(opts?: {
-            limit?: number;
-            cursor?: string;
+            userId?: string | undefined;
         }): Promise<Envelope<ReadonlyArray<OrgGroup>>>;
-        /** POST /groups — create a new group. */
-        create(input: {
-            name: string;
-        }): Promise<Envelope<OrgGroup>>;
-        /** GET /groups/<groupId> — single-read (pre-cement existing endpoint). */
+        /** GET /groups/<groupId> — single-read. */
         get(groupId: string): Promise<Envelope<OrgGroup>>;
-        /** DELETE /groups/<groupId> — remove a group. */
-        delete(groupId: string): Promise<Envelope<{
-            deleted: boolean;
-        }>>;
     };
-    /** Org-plane audit log — query / tail. Distinct from project-plane `client.audit`. */
+    /** Org-plane audit log — query. Distinct from project-plane `client.audit`. */
     auditLog: {
         /**
-         * GET /audit-log (org-plane).
-         * Distinct from project-plane `client.audit.query()` which routes to
-         * `@<projectSlug>/audit-log`. Org-plane events cover the 6-event family
-         * (member_invited/removed/role_granted/revoked/
-         * idp_config_changed/settings_updated).
+         * GET /audit-log (org-plane), newest first. The route reads `type` and `limit` (1 to 500, default 100) only.
+         * Distinct from project-plane `client.audit.query()` which routes to `@<projectSlug>/audit-log`.
          */
         query(opts?: {
-            since?: string | undefined;
-            until?: string | undefined;
             type?: string | undefined;
-            actorId?: string | undefined;
-            targetKind?: string | undefined;
-            targetId?: string | undefined;
             limit?: number | undefined;
-            cursor?: string | undefined;
-        }): Promise<Envelope<ReadonlyArray<OrgAuditEvent>>>;
-        /** Convenience: recent events (defaults to 5 minute window). */
-        tail(opts?: {
-            sinceMinutes?: number;
-            limit?: number;
         }): Promise<Envelope<ReadonlyArray<OrgAuditEvent>>>;
     };
     /** Gate (IAK) org-level surfaces — role-grants + IdP-providers. */
     gate: {
         roles: {
-            /** GET /org-role-grants — list active grants ask 4. */
-            list(opts?: {
-                userId?: string | undefined;
-                role?: OrgRoleGrant["role"] | undefined;
-                includeRevoked?: boolean | undefined;
-            }): Promise<Envelope<ReadonlyArray<OrgRoleGrant>>>;
-            /** POST /org-role-grants — grant an ORG_ADMIN or ORG_BILLING_ADMIN role. */
+            /** GET /role-grants — list role grants. */
+            list(): Promise<Envelope<ReadonlyArray<OrgRoleGrant>>>;
+            /** POST /role-grants — grant an org role. */
             grant(input: {
                 userId: string;
                 role: OrgRoleGrant["role"];
+                decisionReason?: string | undefined;
             }): Promise<Envelope<OrgRoleGrant>>;
-            /** GET /org-role-grants/<grantId> — single-read. */
+            /** GET /role-grants/<grantId> — single-read. */
             get(grantId: string): Promise<Envelope<OrgRoleGrant>>;
-            /** DELETE /org-role-grants/<grantId> — revoke a grant (soft delete; sets revokedAt). */
-            revoke(grantId: string): Promise<Envelope<OrgRoleGrant>>;
+            /** DELETE /role-grants/<grantId> — revoke a grant (soft delete; sets revokedAt). */
+            revoke(grantId: string, opts?: {
+                decisionReason?: string | undefined;
+            }): Promise<Envelope<OrgRoleGrant>>;
         };
         idpProviders: {
-            /** GET /idp-providers — list configured org operator IdP providers ask 7. */
+            /** GET /identity-providers — list configured identity providers. */
             list(): Promise<Envelope<ReadonlyArray<OrgIdpProvider>>>;
-            /** POST /idp-providers — create a new IdP integration. */
+            /** POST /identity-providers — create a new IdP integration. */
             create(input: CreateOrgIdpInput): Promise<Envelope<OrgIdpProvider>>;
-            /** GET /idp-providers/<idpId>. */
+            /** GET /identity-providers/<idpId>. */
             get(idpId: string): Promise<Envelope<OrgIdpProvider>>;
-            /** PATCH /idp-providers/<idpId> — update config or enable/disable. */
-            configure(idpId: string, patch: {
-                name?: string;
-                enabled?: boolean;
-                config?: Record<string, unknown>;
-            }): Promise<Envelope<OrgIdpProvider>>;
-            /** DELETE /idp-providers/<idpId>. */
+            /** PATCH /identity-providers/<idpId> — update settings or enable/disable. */
+            configure(idpId: string, patch: UpdateOrgIdpInput): Promise<Envelope<OrgIdpProvider>>;
+            /** DELETE /identity-providers/<idpId>. */
             delete(idpId: string): Promise<Envelope<{
                 deleted: boolean;
             }>>;
         };
     };
-    /** Org-level SMTP config — get / set / test / unset. */
+    /** Org-level SMTP config — set / test / unset. */
     smtp: {
         /**
-         * GET /org/smtp — read current SMTP config.
-         * Returns null when no org-level SMTP is configured (falls back to
-         * platform SMTP 3-tier cascade).
+         * PATCH /org with `smtpConfig` body — set or update SMTP. Answers the org record.
+         * The body carries `passwordRef` (a reference to the stored password), not the password.
          */
-        get(): Promise<Envelope<SmtpConfig | null>>;
-        /**
-         * PATCH /orgs/<orgSlug> with `smtpConfig` body — set or update SMTP.
-         * PATCH on the org resource accepts smtpConfig.
-         * Passwords route through Kibo enclave — SDK accepts plaintext at
-         * the SDK boundary; gateway stores the reference.
-         */
-        set(config_: Omit<SmtpConfig, "passwordRef"> & {
-            password: string;
-        }): Promise<Envelope<SmtpConfig>>;
+        set(config_: SmtpConfig): Promise<Envelope<Org>>;
         /**
          * POST /org/smtp/test-email — send a diagnostic email to verify config.
          * 5/hour rate limit; RFC 5322 validation;
          * 3-tier resolution (platform→org→project) of effective SMTP.
          */
         test(input: SmtpTestEmailInput): Promise<Envelope<SmtpTestEmailResult>>;
-        /** PATCH /orgs/<orgSlug> with `smtpConfig: null` — clear org-level SMTP. */
-        unset(): Promise<Envelope<{
-            cleared: boolean;
-        }>>;
+        /** PATCH /org with `smtpConfig: null` — clear org-level SMTP. Answers the org record. */
+        unset(): Promise<Envelope<Org>>;
     };
     /** Org-default LLM — get / set (ORG_ADMIN). */
     defaultLLM: {
         /**
-         * GET /org/default-llm — read the org-default LLM model id
-         *. Returns `null` when no explicit default is set (gateway
-         * falls back to `mistral-7b`). ORG_ADMIN read; tier-gated.
+         * GET /default-llm — read the org-default LLM model id.
+         * Any accepted member of the org may read it.
          */
-        get(): Promise<Envelope<LLMModelId | null>>;
+        get(): Promise<Envelope<OrgDefaultLlm>>;
         /**
-         * PATCH /org/default-llm — set the org-default LLM.
-         * ORG_ADMIN only. The model must be available to the org's tier per
+         * PATCH /default-llm — set the org-default LLM.
+         * ORG_ADMIN or ORG_OWNER only. The model must be available to the org's tier
          * or the gateway returns K9O_TIER_FEATURE_GATED.
          */
         set(input: {
             modelId: LLMModelId;
-        }): Promise<Envelope<LLMModelId>>;
+        }): Promise<Envelope<{
+            orgId: string;
+            defaultModelId: string;
+        }>>;
     };
     /**
-     * GET /org — read the current org (slug + name + status + settings).
+     * GET /org — read the current org (slug, displayName, products, billing tier, your role).
      * Mirrors `client.orgs.current()` for symmetry; `client.org.get()` is
      * the singular-namespace convention for use within an org-bound client.
      */
-    get(): Promise<Envelope<{
-        id: string;
-        slug: string;
-        name: string;
-        status: string;
-        createdAt: string;
-    }>>;
+    get(): Promise<Envelope<Org>>;
 };
 
 /**
@@ -1351,145 +1465,112 @@ declare function makeOrgNamespace(config: HttpClientConfig): {
  *
  * Wire mapping (gateway uses platform-plane / cross-org `/me/...` routes):
  *   - `client.me.profile.get/update` → GET/PATCH /me
- *   - `client.me.sessions.list/revoke` → GET/DELETE /me/sessions
- *   - `client.me.apiTokens.list/create/delete` → GET/POST/DELETE /me/api-tokens (not available yet)
- *   - `client.me.notifications.list/markRead` → GET/PATCH /me/notifications (not available yet)
- *   - `client.me.auditLog.query` → GET /me/audit-log (not available yet)
- *   - `client.me.dataExport.request` → POST /me/data-export (not available yet)
- *
- * Profile, sessions and MFA setup are served by the existing gateway routes
- * `me.ts` + `mfa.ts`.
+ *   - `client.me.sessions.list` → GET /me/sessions
+ *   - `client.me.sessions.revoke` → POST /auth/sessions/<sessionId>/revoke
+ *   - `client.me.sessions.revokeAll` → POST /me/sessions/revoke-all
+ *   - `client.me.apiTokens.list/create/delete` → GET/POST/DELETE /me/api-tokens
  */
 
 type MyProfile = {
-    /** `u_<base62>`. */
+    /** `usr_<base62>`. */
     id: string;
     email: string;
-    displayName: string | null;
+    displayName: string;
+    mfaEnabled: boolean;
+    verifiedAt: string | null;
+    /** Set while the account is in its deletion grace period. */
+    deletedAt: string | null;
+    deletionRequestedAt: string | null;
+    deletionScheduledFor: string | null;
+    avatarUrl: string | null;
+    /** BCP 47 language tag, or `null` when unset. */
+    locale: string | null;
+    /** IANA time zone name, or `null` when unset. */
+    timezone: string | null;
     /** ISO 8601. */
     createdAt: string;
-    /** Last activity timestamp. */
-    lastActiveAt: string | null;
+    /** ISO 8601. */
+    updatedAt: string;
 };
 type MySession = {
     /** `sess_<base62>`. */
     id: string;
-    /** Initial sign-in time. */
-    createdAt: string;
-    /** Most recent activity time. */
-    lastSeenAt: string;
+    userId: string;
+    /** Sign-in time. */
+    issuedAt: string;
+    expiresAt: string;
+    revokedAt: string | null;
+    mfaVerifiedAt: string | null;
     userAgent: string | null;
     ipAddress: string | null;
+    /** Always `null` for now. */
+    geoCountry: string | null;
     /** Whether this session is the one issuing the current request. */
-    current: boolean;
+    isCurrentSession: boolean;
+};
+/** Fields `profile.update` may change; `null` clears `locale` and `timezone`. */
+type UpdateMyProfileInput = {
+    displayName?: string | undefined;
+    /** BCP 47 language tag, for example `de-DE`. */
+    locale?: string | null | undefined;
+    /** IANA time zone name, for example `Europe/Berlin`. */
+    timezone?: string | null | undefined;
 };
 type MyApiToken = {
-    /** `tok_<base62>`. */
+    /** `pat_<base62>`. */
     id: string;
-    name: string;
+    userId: string;
+    orgId: string;
+    label: string;
+    scopeManifest: CreateMyApiTokenInput["scopeManifest"];
+    ttlSeconds: number;
     /** ISO 8601. */
     createdAt: string;
-    /** ISO 8601 or null for non-expiring tokens. */
-    expiresAt: string | null;
-    /** Last 4 chars for display. */
-    suffix: string;
-    scope: string;
-};
-type MyNotification = {
-    id: string;
-    type: string;
-    payload: Record<string, unknown>;
-    createdAt: string;
-    readAt: string | null;
+    /** ISO 8601. */
+    expiresAt: string;
+    lastUsedAt: string | null;
+    revokedReason: string | null;
+    status: "active" | "revoked" | "expired";
+};
+/** Body of POST /me/api-tokens. Each `scopeManifest` field narrows the token; `null` or absent leaves it unrestricted. */
+type CreateMyApiTokenInput = {
+    label: string;
+    scopeManifest: {
+        operations?: ReadonlyArray<"read" | "write" | "admin"> | null | undefined;
+        projects?: ReadonlyArray<string> | null | undefined;
+        resourceClasses?: ReadonlyArray<string> | null | undefined;
+        collections?: Record<string, unknown> | null | undefined;
+        cidrs?: ReadonlyArray<string> | null | undefined;
+    };
+    /** Token lifetime in seconds (60 to 31536000). */
+    ttlSeconds?: number | undefined;
 };
 declare function makeMeNamespace(config: HttpClientConfig): {
     profile: {
         /** GET /me — operator profile (cross-org). */
         get(): Promise<Envelope<MyProfile>>;
-        /** PATCH /me — update mutable profile fields (displayName). */
-        update(patch: {
-            displayName?: string | null;
-        }): Promise<Envelope<MyProfile>>;
+        /** PATCH /me — update mutable profile fields (displayName, locale, timezone). */
+        update(patch: UpdateMyProfileInput): Promise<Envelope<MyProfile>>;
     };
     sessions: {
         /** GET /me/sessions — list active sessions for the operator. */
         list(): Promise<Envelope<ReadonlyArray<MySession>>>;
-        /** DELETE /me/sessions/<sessionId> — revoke a specific session. */
+        /** POST /auth/sessions/<sessionId>/revoke — revoke a specific session. */
         revoke(sessionId: string): Promise<Envelope<{
             revoked: boolean;
         }>>;
-        /** DELETE /me/sessions (no path) — revoke all sessions except the current one. */
+        /** POST /me/sessions/revoke-all — revoke all of the operator's sessions except the current one. */
         revokeAll(): Promise<Envelope<{
             revoked: number;
         }>>;
     };
-    /**
-     * API tokens for personal scripting. The gateway endpoints are not available yet,
-     * so these methods return K9O_NOT_FOUND until they ship.
-     */
+    /** Personal access tokens for scripting. */
     apiTokens: {
         list(): Promise<Envelope<ReadonlyArray<MyApiToken>>>;
-        create(input: {
-            name: string;
-            expiresInDays?: number | undefined;
-            scope?: string | undefined;
-        }): Promise<Envelope<MyApiToken & {
-            token: string;
-        }>>;
-        delete(tokenId: string): Promise<Envelope<{
-            deleted: boolean;
-        }>>;
-    };
-    /**
-     * Notifications — operator-targeted (account-level events). Forward-
-     * cycle substrate; methods route correctly when gateway ships.
-     */
-    notifications: {
-        list(opts?: {
-            unreadOnly?: boolean | undefined;
-            limit?: number | undefined;
-            cursor?: string | undefined;
-        }): Promise<Envelope<ReadonlyArray<MyNotification>>>;
-        markRead(notificationId: string): Promise<Envelope<MyNotification>>;
-        markAllRead(): Promise<Envelope<{
-            marked: number;
-        }>>;
-    };
-    /**
-     * Operator-self audit log — actions performed BY this operator across
-     * orgs. Distinct from `client.audit` (project-plane) and
-     * `client.org.auditLog` (org-plane).
-     */
-    auditLog: {
-        query(opts?: {
-            since?: string | undefined;
-            until?: string | undefined;
-            type?: string | undefined;
-            limit?: number | undefined;
-            cursor?: string | undefined;
-        }): Promise<Envelope<ReadonlyArray<{
-            id: string;
-            type: string;
-            occurredAt: string;
-            payload: Record<string, unknown>;
-        }>>>;
-    };
-    /**
-     * Personal data export per GDPR-style requests. Returns a job id
-     * the operator polls for completion.
-     */
-    dataExport: {
-        request(input?: {
-            format?: "json" | "csv";
-        }): Promise<Envelope<{
-            jobId: string;
-            status: "queued" | "in-progress" | "ready";
-        }>>;
-        status(jobId: string): Promise<Envelope<{
-            jobId: string;
-            status: "queued" | "in-progress" | "ready" | "failed";
-            downloadUrl: string | null;
+        create(input: CreateMyApiTokenInput): Promise<Envelope<MyApiToken & {
+            plaintext: string;
         }>>;
+        delete(tokenId: string): Promise<Envelope<MyApiToken>>;
     };
 };
 
@@ -1580,7 +1661,7 @@ declare const DASHBOARD_ERROR_CODES: {
  * Workflows substrate. Mirrors
  * `_sys.workflows` + `_sys.workflow_runs` row shapes.
  *
- * Wire mapping (project-plane;):
+ * Wire mapping (project-plane):
  *   - list()                       → GET    /@<slug>/workflows
  *   - create(workflow)             → POST   /@<slug>/workflows
  *   - read(id)                     → GET    /@<slug>/workflows/<wfl-id>
@@ -1591,9 +1672,9 @@ declare const DASHBOARD_ERROR_CODES: {
  *   - runs.read(id, runId)         → GET    /@<slug>/workflows/<wfl-id>/runs/<wfr-id>
  *   - runs.cancel(id, runId)       → POST   /@<slug>/workflows/<wfl-id>/runs/<wfr-id>/cancel
  *
- * Per RBAC: create/update/delete/trigger/cancel require
+ * RBAC: create/update/delete/trigger/cancel require
  * PROJECT_AUTHOR; list/read/runs read against all cohort roles subject
- * to RLS. Per, surfaces 6 K9O_WORKFLOW_* error codes (see
+ * to RLS. Surfaces 6 K9O_WORKFLOW_* error codes (see
  * `WORKFLOW_ERROR_CODES`); callers narrow on `error.code`.
  */
 
@@ -1616,7 +1697,7 @@ type WorkflowAction = {
     /** Sibling steps with parallel:true execute concurrently. */
     parallel?: boolean;
 };
-/** Workflow record `_sys.workflows` row. */
+/** Workflow record. */
 type Workflow = {
     /** `wfl_<base62>`. */
     id: string;
@@ -1647,7 +1728,7 @@ type WorkflowRunStep = {
     outputSummary?: unknown;
     costSubtotal?: number;
 };
-/** Workflow run record `_sys.workflow_runs` row. */
+/** Workflow run record. */
 type WorkflowRun = {
     /** `wfr_<base62>`. */
     id: string;
@@ -1772,23 +1853,20 @@ declare function makeAiNamespace(config: HttpClientConfig): {
  * yielding `RealtimeEvent`s — the caller writes idiomatic
  * `for await (const event of client.realtime.subscribe(topic)) { ... }`.
  *
- * Per `feedback_sdk_abstracted_primitive_default_to_richer_interaction.md`
- * +: the SDK chooses the transport (WebSocket primary → SSE
- * → poll), transparently. SPLIT (polling) is the SDK-internal fallback
- * when WebSocket / SSE are unavailable — NOT a consumer-side design
- * choice. The consumer sees one uniform async iterable regardless.
+ * Transport: SSE over `GET /@<slug>/realtime/subscribe`. The gateway
+ * serves no WebSocket upgrade and no durable replay, so neither is
+ * offered; after an `event: resync` frame the client re-reads current
+ * state from the data plane and resubscribes.
  *
- * Wire mapping (project-plane;):
- *   - subscribe → GET  /@<slug>/realtime/subscribe?topic=<t>&filter=<jsonb> (WS/SSE upgrade)
- *   - replay    → POST /@<slug>/realtime/replay  { topic, fromSequence, untilSequence?, limit? }
+ * Wire mapping (project-plane):
+ *   - subscribe → GET  /@<slug>/realtime/subscribe?topic=<t>&filter=<jsonb>  (SSE)
  *
- * Per, `filter` + RLS compose (filter narrows, RLS gates).
- * Per, surfaces no new codes — reuses K9O_INVALID_FILTER +
- * K9O_SUBSCRIPTION_LIMIT_EXCEEDED + K9O_TIER_FEATURE_GATED.
+ * `filter` + RLS compose (filter narrows, RLS gates). Surfaces
+ * K9O_INVALID_FILTER, K9O_SUBSCRIPTION_LIMIT_EXCEEDED and K9O_TIER_FEATURE_GATED.
  */
 
 /**
- * The 6 closed subscription topic families. Concrete
+ * The 6 closed subscription topic families . Concrete
  * topic strings carry a dynamic segment (collection name, resource id,
  * event family) — use `realtimeTopic.*` builders to construct them.
  */
@@ -1796,7 +1874,7 @@ type RealtimeTopicFamily = "collections" | "studio.workflows.runs" | "studio.que
 /** A concrete topic string, e.g. `studio.dashboards.refresh.dsh_abc`. */
 type RealtimeTopic = string;
 /**
- * Typed builders for the 6 topic families. Prefer these
+ * Typed builders for the 6 topic families . Prefer these
  * over hand-built strings for compile-time family safety.
  */
 declare const realtimeTopic: {
@@ -1813,15 +1891,13 @@ declare const realtimeTopic: {
     /** `audit.org.<event-family>` — org-plane audit events. */
     readonly auditOrg: (eventFamily: string) => RealtimeTopic;
 };
-/** Per-topic filter predicate (vocabulary). */
+/** Per-topic filter predicate . */
 type RealtimeFilter = Record<string, unknown>;
-/** A single realtime event delivered on a subscription. */
+/** A single realtime event, as the gateway frames it (wire spelling). */
 type RealtimeEvent<T = unknown> = {
     topic: RealtimeTopic;
     /** Event type within the topic family (e.g. `row_inserted`, `workflow.run.completed`). */
-    type: string;
-    /** Monotonic sequence number — use as `fromSequence` for replay catch-up. */
-    sequence: number;
+    eventType: string;
     payload: T;
     occurredAt: string;
 };
@@ -1829,57 +1905,30 @@ type SubscribeOptions = {
     filter?: RealtimeFilter;
     /** Abort the subscription (closes the underlying transport). */
     signal?: AbortSignal;
-    /**
-     * Force a transport instead of the WebSocket → SSE → poll cascade.
-     * Mainly for tests + constrained runtimes. Omit for production —
-     * the SDK picks the richest available transport.
-     */
-    transport?: RealtimeTransportKind;
-    /** Poll-transport interval in ms (default 2000). Only used when polling. */
-    pollIntervalMs?: number;
 };
-type RealtimeTransportKind = "websocket" | "sse" | "poll";
 /**
  * A live subscription. It is itself an async iterable (`for await`) and
- * exposes `close()` for explicit teardown + `transport` for diagnostics.
+ * exposes `close()` for explicit teardown.
  */
 type RealtimeSubscription<T = unknown> = AsyncIterable<RealtimeEvent<T>> & {
     /** Stop the subscription + release the underlying transport. */
     close(): void;
-    /** The transport actually selected (post-fallback). */
-    readonly transport: RealtimeTransportKind;
-};
-type ReplayInput = {
-    topic: RealtimeTopic;
-    filter?: RealtimeFilter;
-    fromSequence: number;
-    untilSequence?: number;
-    limit?: number;
 };
 declare function makeRealtimeNamespace(config: HttpClientConfig): {
     /**
      * Subscribe to a topic. Returns a `RealtimeSubscription` — an async
-     * iterable of `RealtimeEvent`s. The SDK selects the richest available
-     * transport (WebSocket → SSE → poll); the caller's
-     * `for await` loop is transport-agnostic.
+     * iterable of `RealtimeEvent`s over SSE.
      *
      * ```ts
      * const sub = client.realtime.subscribe(
      *   realtimeTopic.dashboardRefresh("dsh_abc"),
      * );
      * for await (const event of sub) {
-     *   if (event.type === "dashboard.widget.data_refreshed") rerender(event.payload);
+     *   if (event.eventType === "dashboard.widget.data_refreshed") rerender(event.payload);
      * }
      * ```
      */
     subscribe<T = unknown>(topic: RealtimeTopic, options?: SubscribeOptions): RealtimeSubscription<T>;
-    /**
-     * One-shot historical replay — catch up on missed
-     * events from `fromSequence`. Capped at 10k events server-side;
-     * paginate via the returned events' `sequence`. Use the highest
-     * `sequence` you've seen as the next `fromSequence`.
-     */
-    replay<T = unknown>(input: ReplayInput): Promise<Envelope<ReadonlyArray<RealtimeEvent<T>>>>;
 };
 
 /**
@@ -2083,9 +2132,6 @@ type K9oClient = {
      *  `client.kibo.vault.secrets` (credential pre-create): this namespace only registers a caller-supplied
      *  `credentialRef` string, never creates or resolves one. */
     storage: ReturnType<typeof makeStorageNamespace>;
-    /** Cross-surface metadata query — `client.metadata.from(...).where(...).execute()`. Client-side
-     *  only until the gateway's Inc-2 route lands; see `metadata.ts` for status. */
-    metadata: ReturnType<typeof makeMetadataNamespace>;
     /** Migration lifecycle — `client.migrations.apply()` etc. */
     migrations: ReturnType<typeof makeMigrationsNamespace>;
     /** Function deploy + invoke — `client.functions.deploy()` etc. */
@@ -2106,7 +2152,7 @@ type K9oClient = {
     compute: ReturnType<typeof makeComputeNamespace>;
     /** Platform AI primitives — `client.ai.embed({ model?, input })`. */
     ai: ReturnType<typeof makeAiNamespace>;
-    /** Realtime subscriptions — `client.realtime.subscribe()` / `.replay()`. */
+    /** Realtime subscriptions — `client.realtime.subscribe()` (SSE). */
     realtime: ReturnType<typeof makeRealtimeNamespace>;
     /** Gate (Identity-Aware Kernel) — composed from `@k9o/gate`. Available when projectSlug is bound on the client. */
     readonly gate: GateClient;
@@ -2124,4 +2170,4 @@ type K9oClient = {
  */
 declare function createClient(options: CreateClientOptions): K9oClient;
 
-export { type ActionRule, type AppliedMigration, type AuditEvent, type AuditQueryOpts, BYOS_CRED_FORMAT_VERSION, BYOS_CRED_REF_PREFIX, BYOS_CRED_VAULT_NAME_PREFIX, BYOS_PROVIDER_SCHEME, type ByosCredInput, type ByosCredProvider, type CollectionPolicy, type ColumnReferences, type ColumnSpec, type CreateBucketOptions, CreateClientOptions, type CreateDashboardInput, type CreateOrgIdpInput, type CreatePolicyInput, type CreateProjectInput, type CreateStorageLocationInput, type CreateWorkflowInput, DASHBOARD_ERROR_CODES, type Dashboard, type DashboardListFilters, type DashboardStatus, type DeletedBucket, type DeployFunctionInput, type EmbedInput, type EmbedResult, type EmbeddingModelId, Envelope, FilterOp, type FunctionRecord, type IndexSpec, type K9oClient, type LLMInvokeInput, type LLMInvokeParams, type LLMModality, type LLMModel, type LLMModelId, type LLMProviderClass, type LLMResponse, type LLMStreamChunk, LLM_ERROR_CODES, METADATA_OPERATORS, type MetadataOperator, type MetadataQueryBuilder, type MetadataQueryRecord, type MetadataQueryResult, type MetadataSlice, type MetadataSurface, type MetadataWhereClause, type Migration, type MigrationPolicy, type MyApiToken, type MyNotification, type MyProfile, type MySession, type Operation, type Org, type OrgAuditEvent, type OrgGroup, type OrgIdpProvider, type OrgMember, type OrgRoleGrant, type PendingMigration, type PolicyBundle, type Project, type ProviderRegionProvider, type RealtimeEvent, type RealtimeFilter, type RealtimeSubscription, type RealtimeTopic, type RealtimeTopicFamily, type RealtimeTransportKind, type RelationshipSpec, type RemovedObject, type ReplayInput, type RetiredStorageLocation, type SignedUrl, type SignedUrlOptions, type SmtpConfig, type SmtpTestEmailInput, type SmtpTestEmailResult, type StorageBucket, type StorageBucketPolicy, type StorageLocation, type StorageLocationCustodyMode, type StorageLocationProvider, type StorageLocationProviderParams, type StorageLocationTestResult, type StorageObject, type SubscribeOptions, type UpdateBucketOptions, type UpdateDashboardInput, type UpdatePolicyInput, type UpdateProjectInput, type UpdateStorageLocationInput, type UpdateWorkflowInput, type UploadOptions, type ValidatePolicyResult, WORKFLOW_ERROR_CODES, type Widget, type WidgetDataSourceMode, type WidgetType, type Workflow, type WorkflowAction, type WorkflowActionType, type WorkflowListFilters, type WorkflowRun, type WorkflowRunListFilters, type WorkflowRunStatus, type WorkflowRunStep, type WorkflowStatus, type WorkflowTriggerType, assertProviderRegion, byosCredVaultName, byosCredentialRef, createClient, encodeByosCredential, isProviderRegion, realtimeTopic };
+export { type ActionRule, type AppliedMigration, type AppliedMigrationRow, type ApplyMigrationsResult, type ApplyPendingResult, type AuditEvent, type AuditQueryOpts, BYOS_CRED_FORMAT_VERSION, BYOS_CRED_REF_PREFIX, BYOS_CRED_VAULT_NAME_PREFIX, BYOS_PROVIDER_SCHEME, type ByosCredInput, type ByosCredProvider, type CollectionPolicy, type ColumnReferences, type ColumnSpec, type CreateBucketOptions, CreateClientOptions, type CreateDashboardInput, type CreateMyApiTokenInput, type CreateOrgIdpInput, type CreatePolicyInput, type CreateProjectInput, type CreateStorageLocationInput, type CreateWorkflowInput, DASHBOARD_ERROR_CODES, type Dashboard, type DashboardListFilters, type DashboardStatus, type DeletedBucket, type DeployFunctionInput, type EmbedInput, type EmbedResult, type EmbeddingModelId, Envelope, FilterOp, type FunctionRecord, type IndexSpec, type K9oClient, type LLMInvokeInput, type LLMInvokeParams, type LLMModality, type LLMModel, type LLMModelId, type LLMProviderClass, type LLMResponse, type LLMStreamChunk, type LLMUsage, LLM_ERROR_CODES, type Migration, type MigrationPolicy, type MyApiToken, type MyProfile, type MySession, type Operation, type Org, type OrgAuditEvent, type OrgDefaultLlm, type OrgGroup, type OrgIdpProvider, type OrgIdpProviderKind, type OrgInviteResult, type OrgMember, type OrgRoleGrant, type PendingMigration, type PendingMigrationStatus, type PolicyBundle, type PolicyDocument, type PolicyPublishResult, type Project, type ProviderRegionProvider, type PublishPolicyOptions, type QueuedMigration, type RealtimeEvent, type RealtimeFilter, type RealtimeSubscription, type RealtimeTopic, type RealtimeTopicFamily, type RelationshipSpec, type RemovedObject, type RetiredStorageLocation, type SignedUrl, type SignedUrlOptions, type SkippedMigrationRow, type SmtpConfig, type SmtpTestEmailInput, type SmtpTestEmailResult, type StorageBucket, type StorageBucketPolicy, type StorageLocation, type StorageLocationCustodyMode, type StorageLocationProvider, type StorageLocationProviderParams, type StorageLocationTestResult, type StorageObject, type SubscribeOptions, type UpdateBucketOptions, type UpdateDashboardInput, type UpdateMyProfileInput, type UpdateOrgIdpInput, type UpdatePolicyInput, type UpdateProjectInput, type UpdateStorageLocationInput, type UpdateWorkflowInput, type UploadOptions, type ValidatePolicyResult, WORKFLOW_ERROR_CODES, type Widget, type WidgetDataSourceMode, type WidgetType, type Workflow, type WorkflowAction, type WorkflowActionType, type WorkflowListFilters, type WorkflowRun, type WorkflowRunListFilters, type WorkflowRunStatus, type WorkflowRunStep, type WorkflowStatus, type WorkflowTriggerType, assertProviderRegion, byosCredVaultName, byosCredentialRef, createClient, encodeByosCredential, isProviderRegion, realtimeTopic };