@krovacloud/sdk 0.4.0 → 0.4.2

package/dist/index.d.cts

@@ -1,2040 +1,2041 @@
-import { Client } from 'openapi-fetch';
-
+import { Client } from "openapi-fetch";
+//#region src/generated/types.d.ts
 /**
  * This file was auto-generated by openapi-typescript.
  * Do not make direct changes to the file.
  */
 interface paths {
-    "/regions": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        /** List regions with available capacity */
-        get: {
-            parameters: {
-                query?: never;
-                header?: never;
-                path?: never;
-                cookie?: never;
-            };
-            requestBody?: never;
-            responses: {
-                /** @description Region list */
-                200: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": {
-                            regions: components["schemas"]["Region"][];
-                        };
-                    };
-                };
-            };
-        };
-        put?: never;
-        post?: never;
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/images": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        /** List available OS images */
-        get: {
-            parameters: {
-                query?: never;
-                header?: never;
-                path?: never;
-                cookie?: never;
-            };
-            requestBody?: never;
-            responses: {
-                /** @description Image list */
-                200: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": {
-                            images: components["schemas"]["Image"][];
-                        };
-                    };
-                };
-            };
-        };
-        put?: never;
-        post?: never;
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/pricing": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        /** Per-resource hourly rates and volume pricing tiers */
-        get: {
-            parameters: {
-                query?: never;
-                header?: never;
-                path?: never;
-                cookie?: never;
-            };
-            requestBody?: never;
-            responses: {
-                /** @description Pricing data */
-                200: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": {
-                            currency: string;
-                            rates: {
-                                vcpuPerHour: number;
-                                ramGbPerHour: number;
-                                diskGbPerHour: number;
-                            };
-                            tiers: components["schemas"]["PricingTier"][];
-                            note: string;
-                        };
-                    };
-                };
-            };
-        };
-        put?: never;
-        post?: never;
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/auth/cli/start": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        get?: never;
-        put?: never;
-        /**
-         * Begin a CLI device-authorization login (RFC 8628)
-         * @description Public, unauthenticated. Mints a device code (returned once) and a short human user code, and returns the verification URIs the user opens in a browser to approve. The CLI then polls /auth/cli/poll. Rate-limited per client IP.
-         */
-        post: {
-            parameters: {
-                query?: never;
-                header?: never;
-                path?: never;
-                cookie?: never;
-            };
-            requestBody?: never;
-            responses: {
-                /** @description Device-authorization request created */
-                200: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": {
-                            /** @description High-entropy code the CLI keeps secret and presents on each poll. Only its hash is stored server-side. */
-                            deviceCode: string;
-                            /** @description Short human-readable code (KROVA-XXXX-XXXX) the user confirms in the browser. */
-                            userCode: string;
-                            /**
-                             * Format: uri
-                             * @description Browser URL where the user approves.
-                             */
-                            verificationUri: string;
-                            /**
-                             * Format: uri
-                             * @description verificationUri with the user code pre-filled.
-                             */
-                            verificationUriComplete: string;
-                            /** @description Seconds to wait between polls. */
-                            interval: number;
-                            /** @description Seconds until the device code expires (~600). */
-                            expiresIn: number;
-                        };
-                    };
-                };
-                429: components["responses"]["RateLimited"];
-                /** @description Could not allocate a login code; retry */
-                503: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content?: never;
-                };
-            };
-        };
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/auth/cli/poll": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        get?: never;
-        put?: never;
-        /**
-         * Poll for CLI device-authorization approval (RFC 8628)
-         * @description Public, unauthenticated. The CLI submits its deviceCode until the user approves or denies. On approval a real API key is minted ONCE, scoped to the approved Space and the approving user's membership, and returned a single time. Rate-limited per client IP.
-         */
-        post: {
-            parameters: {
-                query?: never;
-                header?: never;
-                path?: never;
-                cookie?: never;
-            };
-            requestBody: {
-                content: {
-                    "application/json": {
-                        /** @description The device code from /auth/cli/start. */
-                        deviceCode: string;
-                    };
-                };
-            };
-            responses: {
-                /** @description Approved — API key minted (returned once) */
-                200: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": {
-                            /** @description The full API key. Shown once and never returned again — store it securely. */
-                            apiKey: string;
-                            /** @description The Space the key is scoped to. */
-                            spaceId: string;
-                        };
-                    };
-                };
-                400: components["responses"]["BadRequest"];
-                /** @description The user denied the login request */
-                403: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content?: never;
-                };
-                /** @description The device code expired, was already consumed, or is unknown */
-                410: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content?: never;
-                };
-                /** @description Authorization still pending — keep polling at the given interval */
-                428: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content?: never;
-                };
-                429: components["responses"]["RateLimited"];
-            };
-        };
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/space": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        /**
-         * Resolve the space this API key is scoped to
-         * @description Returns the single space the API key belongs to. Lets a client auto-resolve the space id from the key alone (no spaceId in the URL).
-         */
-        get: {
-            parameters: {
-                query?: never;
-                header?: never;
-                path?: never;
-                cookie?: never;
-            };
-            requestBody?: never;
-            responses: {
-                /** @description The key's space */
-                200: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": components["schemas"]["Space"];
-                    };
-                };
-                401: components["responses"]["Unauthorized"];
-                404: components["responses"]["NotFound"];
-            };
-        };
-        put?: never;
-        post?: never;
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/spaces/{spaceId}/cubes": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        /** List Cubes in a Space */
-        get: {
-            parameters: {
-                query?: never;
-                header?: never;
-                path: {
-                    spaceId: string;
-                };
-                cookie?: never;
-            };
-            requestBody?: never;
-            responses: {
-                /** @description Paginated Cube list */
-                200: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": {
-                            cubes: components["schemas"]["Cube"][];
-                            pagination: components["schemas"]["Pagination"];
-                        };
-                    };
-                };
-                401: components["responses"]["Unauthorized"];
-                403: components["responses"]["Forbidden"];
-            };
-        };
-        put?: never;
-        /** Create a Cube */
-        post: {
-            parameters: {
-                query?: never;
-                header?: {
-                    /** @description Optional unique key (max 255 chars). Replays return the original response and add header Idempotency-Replayed: true. Scoped per space; expires after 24h. */
-                    "Idempotency-Key"?: string;
-                };
-                path: {
-                    spaceId: string;
-                };
-                cookie?: never;
-            };
-            requestBody: {
-                content: {
-                    "application/json": {
-                        name: string;
-                        image: string;
-                        resources: {
-                            vcpu: number;
-                            ramGb: number;
-                            diskGb: number;
-                        };
-                        /** @description SSH public key written to the Cube login user's authorized_keys at boot (~/.ssh/authorized_keys for the ubuntu or debian user; /root/.ssh/authorized_keys on Cubes created before the default-user change). GET /cubes/{cubeId}/ssh reports the login user for a given Cube. Must start with ssh-ed25519, ssh-rsa, ecdsa-sha2-*, ssh-dss, or sk-*@openssh.com. */
-                        sshPublicKey: string;
-                        /** @description Region slug from /v1/regions (optional). */
-                        region?: string;
-                        /** @description cloud-init script (max 16 KB, optional). */
-                        userData?: string;
-                    };
-                };
-            };
-            responses: {
-                /** @description Cube created */
-                201: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": {
-                            cube?: components["schemas"]["Cube"];
-                        };
-                    };
-                };
-                400: components["responses"]["BadRequest"];
-                401: components["responses"]["Unauthorized"];
-                403: components["responses"]["Forbidden"];
-                429: components["responses"]["RateLimited"];
-            };
-        };
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/spaces/{spaceId}/cubes/{cubeId}": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        /** Get a Cube */
-        get: {
-            parameters: {
-                query?: never;
-                header?: never;
-                path: {
-                    spaceId: string;
-                    cubeId: string;
-                };
-                cookie?: never;
-            };
-            requestBody?: never;
-            responses: {
-                /** @description Cube */
-                200: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": {
-                            cube: components["schemas"]["Cube"];
-                        };
-                    };
-                };
-                404: components["responses"]["NotFound"];
-            };
-        };
-        put?: never;
-        post?: never;
-        /** Delete a Cube (asynchronous) */
-        delete: {
-            parameters: {
-                query?: never;
-                header?: never;
-                path: {
-                    spaceId: string;
-                    cubeId: string;
-                };
-                cookie?: never;
-            };
-            requestBody?: never;
-            responses: {
-                /** @description Deletion enqueued */
-                200: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": {
-                            success: boolean;
-                        };
-                    };
-                };
-                404: components["responses"]["NotFound"];
-                429: components["responses"]["RateLimited"];
-            };
-        };
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/spaces/{spaceId}/cubes/{cubeId}/power-off": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        get?: never;
-        put?: never;
-        /** Power off a running Cube */
-        post: {
-            parameters: {
-                query?: never;
-                header?: never;
-                path: {
-                    spaceId: string;
-                    cubeId: string;
-                };
-                cookie?: never;
-            };
-            requestBody?: never;
-            responses: {
-                /** @description Power off enqueued */
-                200: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content?: never;
-                };
-                404: components["responses"]["NotFound"];
-                429: components["responses"]["RateLimited"];
-            };
-        };
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/spaces/{spaceId}/cubes/{cubeId}/wake": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        get?: never;
-        put?: never;
-        /** Start a stopped Cube */
-        post: {
-            parameters: {
-                query?: never;
-                header?: never;
-                path: {
-                    spaceId: string;
-                    cubeId: string;
-                };
-                cookie?: never;
-            };
-            requestBody?: never;
-            responses: {
-                /** @description Start enqueued */
-                200: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content?: never;
-                };
-                404: components["responses"]["NotFound"];
-                429: components["responses"]["RateLimited"];
-            };
-        };
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/spaces/{spaceId}/cubes/{cubeId}/restart": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        get?: never;
-        put?: never;
-        /**
-         * Restart a running Cube
-         * @description Cold-restarts the Cube: the hypervisor process is stopped and relaunched, so the Cube boots against the host's current kernel. This is how a Cube picks up a refreshed guest kernel after a platform image update — a `reboot` issued inside the Cube cannot do it, because the kernel is supplied externally by the host. Disk state is preserved; only the kernel changes. Cube must be `running` (a stopped Cube already picks up the latest kernel when started). Concurrent restarts of the same Cube are rejected with 409 rather than queued twice.
-         */
-        post: {
-            parameters: {
-                query?: never;
-                header?: never;
-                path: {
-                    spaceId: string;
-                    cubeId: string;
-                };
-                cookie?: never;
-            };
-            requestBody?: never;
-            responses: {
-                /** @description Restart enqueued */
-                200: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content?: never;
-                };
-                404: components["responses"]["NotFound"];
-                /** @description Cube is not running, or a restart is already in progress */
-                409: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content?: never;
-                };
-                429: components["responses"]["RateLimited"];
-            };
-        };
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/spaces/{spaceId}/cubes/{cubeId}/ssh-port": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        get?: never;
-        /**
-         * Change a Cube's SSH port
-         * @description Sets the port INSIDE the Cube that SSH is forwarded to — NOT the host port you connect to. The host port is allocated by Krova and is unchanged by this call. Pointing this at a port nothing is listening on inside the Cube will make SSH unreachable; the default is 22. The change is applied atomically (the old port mapping is replaced).
-         */
-        put: {
-            parameters: {
-                query?: never;
-                header?: never;
-                path: {
-                    spaceId: string;
-                    cubeId: string;
-                };
-                cookie?: never;
-            };
-            requestBody: {
-                content: {
-                    "application/json": {
-                        /** @description The port inside the Cube that sshd listens on (default 22). This is the Cube side of the mapping, not the host port. */
-                        cubePort: number;
-                    };
-                };
-            };
-            responses: {
-                /** @description SSH port updated */
-                200: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content?: never;
-                };
-                400: components["responses"]["BadRequest"];
-                404: components["responses"]["NotFound"];
-                429: components["responses"]["RateLimited"];
-            };
-        };
-        post?: never;
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/spaces/{spaceId}/cubes/{cubeId}/ssh": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        /**
-         * Get a Cube's SSH connection info
-         * @description Host (server public IPv4), host SSH port, login user, and the Cube's captured SSH host public keys. **Use `user` rather than assuming a username** — it is `ubuntu` or `debian` on Cubes created from images that ship a default user, and `root` on Cubes created before that change or imported from a rootfs without one. `hostKeys` is empty only until the reachability cron makes its first capture; clients fall back to trust-on-first-use until then, and pin strictly afterwards.
-         */
-        get: {
-            parameters: {
-                query?: never;
-                header?: never;
-                path: {
-                    spaceId: string;
-                    cubeId: string;
-                };
-                cookie?: never;
-            };
-            requestBody?: never;
-            responses: {
-                /** @description SSH connection info */
-                200: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": components["schemas"]["CubeSshInfo"];
-                    };
-                };
-                404: components["responses"]["NotFound"];
-            };
-        };
-        put?: never;
-        post?: never;
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/spaces/{spaceId}/cubes/{cubeId}/domains": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        /** List custom domains attached to a Cube */
-        get: {
-            parameters: {
-                query?: never;
-                header?: never;
-                path: {
-                    spaceId: string;
-                    cubeId: string;
-                };
-                cookie?: never;
-            };
-            requestBody?: never;
-            responses: {
-                /** @description Domain list */
-                200: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": {
-                            domains: components["schemas"]["Domain"][];
-                        };
-                    };
-                };
-            };
-        };
-        put?: never;
-        /**
-         * Attach a custom domain to a Cube
-         * @description Attaches a domain and optionally configures any per-domain proxy settings at the same time. Settings can also be changed later via PATCH.
-         */
-        post: {
-            parameters: {
-                query?: never;
-                header?: {
-                    /** @description Optional unique key (max 255 chars). Replays return the original response and add header Idempotency-Replayed: true. Scoped per space; expires after 24h. */
-                    "Idempotency-Key"?: string;
-                };
-                path: {
-                    spaceId: string;
-                    cubeId: string;
-                };
-                cookie?: never;
-            };
-            requestBody: {
-                content: {
-                    "application/json": {
-                        /** @description The hostname to attach, e.g. app.example.com */
-                        domain: string;
-                        /** @description Cube port the domain proxies to. */
-                        port: number;
-                        /**
-                         * @description enforced = proxy sets platform security headers (HSTS, X-Frame-Options, …); app_managed = the app's own headers pass through. Default enforced.
-                         * @enum {string}
-                         */
-                        securityHeadersMode?: "enforced" | "app_managed";
-                        /** @description Seconds the app may take to send response headers (streaming unaffected). Default 60. */
-                        responseHeaderTimeoutSecs?: number;
-                        /** @description Header rewrites: `set` adds/overwrites, `remove` deletes. Null clears all. */
-                        responseHeaderOverrides?: {
-                            set?: {
-                                [key: string]: string;
-                            };
-                            remove?: string[];
-                        } | null;
-                        /** @description Header rewrites: `set` adds/overwrites, `remove` deletes. Null clears all. */
-                        requestHeaderOverrides?: {
-                            set?: {
-                                [key: string]: string;
-                            };
-                            remove?: string[];
-                        } | null;
-                        /** @description Max request body size (MB). Null = unlimited (default). */
-                        maxRequestBodyMb?: number | null;
-                        /** @description Per-domain CORS policy, applied at the edge. Null (default) = CORS disabled and no Access-Control-* header is emitted anywhere. When set, the proxy answers OPTIONS preflight itself (204, the cube is never involved) and adds the headers to normal AND error responses, so a cross-origin request to a failing or sleeping cube is never CORS-masked. */
-                        corsConfig?: {
-                            /** @description Exact scheme://host[:port] origins (no path, query or trailing slash), or the single-element wildcard ["*"]. "*" and allowCredentials are mutually exclusive. */
-                            allowedOrigins: string[];
-                            /** @description Allowed methods. Omitted = GET, POST, PUT, PATCH, DELETE, OPTIONS. */
-                            allowedMethods?: string[];
-                            /** @description Allowed request headers. Omitted/empty = echo the preflight's Access-Control-Request-Headers. */
-                            allowedHeaders?: string[];
-                            /** @description Response headers exposed to JS. Omitted/empty = none. */
-                            exposedHeaders?: string[];
-                            /** @description Send Access-Control-Allow-Credentials: true. Rejected together with the "*" origin. */
-                            allowCredentials?: boolean;
-                            /** @description Preflight cache TTL. Default 600; 86400 is Chromium's hard cap. */
-                            maxAgeSeconds?: number;
-                        } | null;
-                        /**
-                         * @description Scheme the edge speaks to the CUBE on the backend hop. http (default) = cleartext. https = the cube terminates TLS itself (a control panel holding its own certificate, or an app listening on HTTPS) and answers plain HTTP with a redirect, so it cannot be reached over cleartext at all. Visitors are on HTTPS either way. The dial port is derived: https on the default port 80 connects on 443; a deliberate custom port is honoured exactly. Verified against the cube before it is applied — if the domain does not serve, the route is left on http.
-                         * @enum {string}
-                         */
-                        originScheme?: "http" | "https";
-                        /** @description Edge gzip/zstd compression. Default false (domains behind a CDN are already compressed there). */
-                        responseCompression?: boolean;
-                        /** @description Visitor IP/CIDR allow-list (v4+v6). Non-empty ⇒ only these reach the app. Null/empty = open. */
-                        ipAllowList?: string[] | null;
-                        /** @description Visitor IP/CIDR deny-list (v4+v6) → 403. Null/empty = none. */
-                        ipDenyList?: string[] | null;
-                        /** @description HTTP Basic Auth username. Null/empty clears Basic Auth. Setting it requires basicAuthPassword. */
-                        basicAuthUser?: string | null;
-                        /** @description Plaintext Basic Auth password — bcrypt-hashed server-side, never stored or returned. Required when setting basicAuthUser. */
-                        basicAuthPassword?: string;
-                    };
-                };
-            };
-            responses: {
-                /** @description Domain attached */
-                201: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": {
-                            domain: components["schemas"]["Domain"];
-                            records: components["schemas"]["DnsRecord"][];
-                        };
-                    };
-                };
-                400: components["responses"]["BadRequest"];
-                429: components["responses"]["RateLimited"];
-            };
-        };
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/spaces/{spaceId}/cubes/{cubeId}/domains/{mappingId}/records": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        /**
-         * DNS records this domain needs, with their live status
-         * @description Every record required for the domain to work, each checked against live DNS. Poll this after publishing them.
-         *
-         *     `state` is per record: `found`, `missing` (not published yet — the expected state before you add it, never an error), `mismatch` (something else is there), or `unknown` (we could not check — never a statement about your DNS). `summary.complete` is true only when every record is `found`.
-         *
-         *     A wildcard needs three records; an exact host needs one. Each call performs live DNS lookups and is rate limited.
-         */
-        get: {
-            parameters: {
-                query?: never;
-                header?: never;
-                path: {
-                    spaceId: string;
-                    cubeId: string;
-                    mappingId: string;
-                };
-                cookie?: never;
-            };
-            requestBody?: never;
-            responses: {
-                /** @description Required records with live status */
-                200: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": {
-                            domain: string;
-                            isWildcard: boolean;
-                            records: components["schemas"]["DnsRecordStatus"][];
-                            summary: {
-                                found: number;
-                                total: number;
-                                complete: boolean;
-                            };
-                            /** Format: date-time */
-                            checkedAt: string;
-                        };
-                    };
-                };
-                404: components["responses"]["NotFound"];
-                429: components["responses"]["RateLimited"];
-            };
-        };
-        put?: never;
-        post?: never;
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/spaces/{spaceId}/cubes/{cubeId}/domains/{mappingId}": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        get?: never;
-        put?: never;
-        post?: never;
-        /** Detach a custom domain */
-        delete: {
-            parameters: {
-                query?: never;
-                header?: never;
-                path: {
-                    spaceId: string;
-                    cubeId: string;
-                    mappingId: string;
-                };
-                cookie?: never;
-            };
-            requestBody?: never;
-            responses: {
-                /** @description Detached */
-                200: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": {
-                            success: boolean;
-                        };
-                    };
-                };
-                404: components["responses"]["NotFound"];
-            };
-        };
-        options?: never;
-        head?: never;
-        /**
-         * Update a custom domain's proxy settings
-         * @description Partial update — only the fields you send change; omitted fields are left as-is. The Basic Auth password is write-only and bcrypt-hashed server-side.
-         */
-        patch: {
-            parameters: {
-                query?: never;
-                header?: never;
-                path: {
-                    spaceId: string;
-                    cubeId: string;
-                    mappingId: string;
-                };
-                cookie?: never;
-            };
-            requestBody: {
-                content: {
-                    "application/json": {
-                        /**
-                         * @description enforced = proxy sets platform security headers (HSTS, X-Frame-Options, …); app_managed = the app's own headers pass through. Default enforced.
-                         * @enum {string}
-                         */
-                        securityHeadersMode?: "enforced" | "app_managed";
-                        /** @description Seconds the app may take to send response headers (streaming unaffected). Default 60. */
-                        responseHeaderTimeoutSecs?: number;
-                        /** @description Header rewrites: `set` adds/overwrites, `remove` deletes. Null clears all. */
-                        responseHeaderOverrides?: {
-                            set?: {
-                                [key: string]: string;
-                            };
-                            remove?: string[];
-                        } | null;
-                        /** @description Header rewrites: `set` adds/overwrites, `remove` deletes. Null clears all. */
-                        requestHeaderOverrides?: {
-                            set?: {
-                                [key: string]: string;
-                            };
-                            remove?: string[];
-                        } | null;
-                        /** @description Max request body size (MB). Null = unlimited (default). */
-                        maxRequestBodyMb?: number | null;
-                        /** @description Per-domain CORS policy, applied at the edge. Null (default) = CORS disabled and no Access-Control-* header is emitted anywhere. When set, the proxy answers OPTIONS preflight itself (204, the cube is never involved) and adds the headers to normal AND error responses, so a cross-origin request to a failing or sleeping cube is never CORS-masked. */
-                        corsConfig?: {
-                            /** @description Exact scheme://host[:port] origins (no path, query or trailing slash), or the single-element wildcard ["*"]. "*" and allowCredentials are mutually exclusive. */
-                            allowedOrigins: string[];
-                            /** @description Allowed methods. Omitted = GET, POST, PUT, PATCH, DELETE, OPTIONS. */
-                            allowedMethods?: string[];
-                            /** @description Allowed request headers. Omitted/empty = echo the preflight's Access-Control-Request-Headers. */
-                            allowedHeaders?: string[];
-                            /** @description Response headers exposed to JS. Omitted/empty = none. */
-                            exposedHeaders?: string[];
-                            /** @description Send Access-Control-Allow-Credentials: true. Rejected together with the "*" origin. */
-                            allowCredentials?: boolean;
-                            /** @description Preflight cache TTL. Default 600; 86400 is Chromium's hard cap. */
-                            maxAgeSeconds?: number;
-                        } | null;
-                        /**
-                         * @description Scheme the edge speaks to the CUBE on the backend hop. http (default) = cleartext. https = the cube terminates TLS itself (a control panel holding its own certificate, or an app listening on HTTPS) and answers plain HTTP with a redirect, so it cannot be reached over cleartext at all. Visitors are on HTTPS either way. The dial port is derived: https on the default port 80 connects on 443; a deliberate custom port is honoured exactly. Verified against the cube before it is applied — if the domain does not serve, the route is left on http.
-                         * @enum {string}
-                         */
-                        originScheme?: "http" | "https";
-                        /** @description Edge gzip/zstd compression. Default false (domains behind a CDN are already compressed there). */
-                        responseCompression?: boolean;
-                        /** @description Visitor IP/CIDR allow-list (v4+v6). Non-empty ⇒ only these reach the app. Null/empty = open. */
-                        ipAllowList?: string[] | null;
-                        /** @description Visitor IP/CIDR deny-list (v4+v6) → 403. Null/empty = none. */
-                        ipDenyList?: string[] | null;
-                        /** @description HTTP Basic Auth username. Null/empty clears Basic Auth. Setting it requires basicAuthPassword. */
-                        basicAuthUser?: string | null;
-                        /** @description Plaintext Basic Auth password — bcrypt-hashed server-side, never stored or returned. Required when setting basicAuthUser. */
-                        basicAuthPassword?: string;
-                    };
-                };
-            };
-            responses: {
-                /** @description Settings updated */
-                200: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": {
-                            domain: components["schemas"]["Domain"];
-                        };
-                    };
-                };
-                400: components["responses"]["BadRequest"];
-                404: components["responses"]["NotFound"];
-                429: components["responses"]["RateLimited"];
-            };
-        };
-        trace?: never;
-    };
-    "/spaces/{spaceId}/cubes/{cubeId}/tcp-mappings": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        /** List TCP port forwards for a Cube */
-        get: {
-            parameters: {
-                query?: never;
-                header?: never;
-                path: {
-                    spaceId: string;
-                    cubeId: string;
-                };
-                cookie?: never;
-            };
-            requestBody?: never;
-            responses: {
-                /** @description TCP mapping list */
-                200: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": {
-                            tcpMappings: components["schemas"]["TcpMapping"][];
-                        };
-                    };
-                };
-            };
-        };
-        put?: never;
-        /** Create a TCP port forward */
-        post: {
-            parameters: {
-                query?: never;
-                header?: {
-                    /** @description Optional unique key (max 255 chars). Replays return the original response and add header Idempotency-Replayed: true. Scoped per space; expires after 24h. */
-                    "Idempotency-Key"?: string;
-                };
-                path: {
-                    spaceId: string;
-                    cubeId: string;
-                };
-                cookie?: never;
-            };
-            requestBody: {
-                content: {
-                    "application/json": {
-                        cubePort: number;
-                        whitelistIps?: string[];
-                    };
-                };
-            };
-            responses: {
-                /** @description Mapping created */
-                201: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": {
-                            tcpMapping: components["schemas"]["TcpMapping"];
-                        };
-                    };
-                };
-                400: components["responses"]["BadRequest"];
-                429: components["responses"]["RateLimited"];
-            };
-        };
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/spaces/{spaceId}/cubes/{cubeId}/tcp-mappings/{mappingId}": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        get?: never;
-        put?: never;
-        post?: never;
-        /** Delete a TCP port forward */
-        delete: {
-            parameters: {
-                query?: never;
-                header?: never;
-                path: {
-                    spaceId: string;
-                    cubeId: string;
-                    mappingId: string;
-                };
-                cookie?: never;
-            };
-            requestBody?: never;
-            responses: {
-                /** @description Deleted */
-                200: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": {
-                            success: boolean;
-                        };
-                    };
-                };
-                404: components["responses"]["NotFound"];
-            };
-        };
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/spaces/{spaceId}/cubes/{cubeId}/snapshots": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        /** List snapshots for a Cube */
-        get: {
-            parameters: {
-                query?: never;
-                header?: never;
-                path: {
-                    spaceId: string;
-                    cubeId: string;
-                };
-                cookie?: never;
-            };
-            requestBody?: never;
-            responses: {
-                /** @description Snapshot list */
-                200: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": {
-                            snapshots: components["schemas"]["Snapshot"][];
-                        };
-                    };
-                };
-            };
-        };
-        put?: never;
-        /** Create a snapshot */
-        post: {
-            parameters: {
-                query?: never;
-                header?: {
-                    /** @description Optional unique key (max 255 chars). Replays return the original response and add header Idempotency-Replayed: true. Scoped per space; expires after 24h. */
-                    "Idempotency-Key"?: string;
-                };
-                path: {
-                    spaceId: string;
-                    cubeId: string;
-                };
-                cookie?: never;
-            };
-            requestBody?: {
-                content: {
-                    "application/json": {
-                        name?: string;
-                    };
-                };
-            };
-            responses: {
-                /** @description Snapshot enqueued */
-                201: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": {
-                            snapshot: components["schemas"]["Snapshot"];
-                        };
-                    };
-                };
-                429: components["responses"]["RateLimited"];
-            };
-        };
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/spaces/{spaceId}/cubes/{cubeId}/snapshots/{snapshotId}": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        get?: never;
-        put?: never;
-        post?: never;
-        /** Delete a snapshot */
-        delete: {
-            parameters: {
-                query?: never;
-                header?: never;
-                path: {
-                    spaceId: string;
-                    cubeId: string;
-                    snapshotId: string;
-                };
-                cookie?: never;
-            };
-            requestBody?: never;
-            responses: {
-                /** @description Deleted */
-                200: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": {
-                            success: boolean;
-                        };
-                    };
-                };
-                404: components["responses"]["NotFound"];
-            };
-        };
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/spaces/{spaceId}/cubes/{cubeId}/restore": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        get?: never;
-        put?: never;
-        /** Restore a Cube from a snapshot */
-        post: {
-            parameters: {
-                query?: never;
-                header?: never;
-                path: {
-                    spaceId: string;
-                    cubeId: string;
-                };
-                cookie?: never;
-            };
-            requestBody: {
-                content: {
-                    "application/json": {
-                        snapshotId: string;
-                    };
-                };
-            };
-            responses: {
-                /** @description Restore enqueued */
-                200: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": {
-                            success: boolean;
-                        };
-                    };
-                };
-                404: components["responses"]["NotFound"];
-            };
-        };
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/spaces/{spaceId}/backups/{backupId}/download": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        /** Generate a presigned download URL for a backup .cube archive */
-        get: {
-            parameters: {
-                query?: never;
-                header?: never;
-                path: {
-                    spaceId: string;
-                    backupId: string;
-                };
-                cookie?: never;
-            };
-            requestBody?: never;
-            responses: {
-                /** @description Presigned URL valid for 15 minutes */
-                200: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": {
-                            url?: string;
-                            filename?: string;
-                            sizeBytes?: number | null;
-                            /** Format: date-time */
-                            expiresAt?: string;
-                        };
-                    };
-                };
-                404: components["responses"]["NotFound"];
-                /** @description Backup is not in 'complete' status */
-                409: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content?: never;
-                };
-            };
-        };
-        put?: never;
-        post?: never;
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/spaces/{spaceId}/cubes/imports": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        get?: never;
-        put?: never;
-        /** Initiate a .cube archive import (browser-side multipart upload) */
-        post: {
-            parameters: {
-                query?: never;
-                header?: never;
-                path: {
-                    spaceId: string;
-                };
-                cookie?: never;
-            };
-            requestBody: {
-                content: {
-                    "application/json": {
-                        name: string;
-                        fileSizeBytes: number;
-                        /**
-                         * @description What to do with SSH access on the imported rootfs. `replace` (default) writes `sshPublicKey` to the login user's authorized_keys and requires `sshPublicKey` to be set. `keep` leaves the image's own authorized_keys and sshd configuration completely untouched — nothing is written — so you must already hold a private key that the image accepts, or you will not be able to log in.
-                         * @default replace
-                         * @enum {string}
-                         */
-                        sshKeyMode?: "replace" | "keep";
-                        /** @description Public key to install when `sshKeyMode` is `replace`. Written to the login user's `~/.ssh/authorized_keys` — which user that is comes from the imported rootfs itself, so an image without a Krova default user keeps logging in as root. Ignored when `sshKeyMode` is `keep`. */
-                        sshPublicKey?: string | null;
-                        region?: string | null;
-                        vcpusOverride?: number | null;
-                        ramMbOverride?: number | null;
-                        diskGbOverride?: number | null;
-                        userData?: string | null;
-                        expectedConfig?: {
-                            vcpus?: number;
-                            ramMb?: number;
-                            diskLimitGb?: number;
-                        } | null;
-                    };
-                };
-            };
-            responses: {
-                /** @description Import initiated; returns presigned part URLs */
-                201: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": {
-                            importId?: string;
-                            uploadId?: string;
-                            key?: string;
-                            chunkSizeBytes?: number;
-                            parts?: {
-                                partNumber?: number;
-                                url?: string;
-                            }[];
-                            /** Format: date-time */
-                            expiresAt?: string;
-                        };
-                    };
-                };
-                /** @description Invalid input */
-                400: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content?: never;
-                };
-                /** @description Plan limit exceeded */
-                403: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content?: never;
-                };
-                /** @description No active storage backend */
-                503: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content?: never;
-                };
-            };
-        };
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/spaces/{spaceId}/cubes/imports/{importId}": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        /** Get the current state of an import */
-        get: {
-            parameters: {
-                query?: never;
-                header?: never;
-                path: {
-                    spaceId: string;
-                    importId: string;
-                };
-                cookie?: never;
-            };
-            requestBody?: never;
-            responses: {
-                /** @description Current import state */
-                200: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": {
-                            import?: {
-                                id?: string;
-                                name?: string;
-                                /** @enum {string} */
-                                status?: "uploading" | "finalizing" | "provisioning" | "complete" | "failed" | "expired";
-                                cubeId?: string | null;
-                                error?: string | null;
-                                createdAt?: string;
-                                updatedAt?: string;
-                                completedAt?: string | null;
-                            };
-                        };
-                    };
-                };
-                404: components["responses"]["NotFound"];
-            };
-        };
-        put?: never;
-        post?: never;
-        /** Cancel an in-flight upload (only allowed in 'uploading' state) */
-        delete: {
-            parameters: {
-                query?: never;
-                header?: never;
-                path: {
-                    spaceId: string;
-                    importId: string;
-                };
-                cookie?: never;
-            };
-            requestBody?: never;
-            responses: {
-                /** @description Cancelled */
-                200: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": {
-                            success: boolean;
-                        };
-                    };
-                };
-                404: components["responses"]["NotFound"];
-                /** @description Cannot cancel an import past the 'uploading' state */
-                409: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content?: never;
-                };
-            };
-        };
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/spaces/{spaceId}/cubes/imports/{importId}/complete": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        get?: never;
-        put?: never;
-        /** Finalize a .cube import: complete multipart upload + create cube row + enqueue provisioning */
-        post: {
-            parameters: {
-                query?: never;
-                header?: never;
-                path: {
-                    spaceId: string;
-                    importId: string;
-                };
-                cookie?: never;
-            };
-            requestBody: {
-                content: {
-                    "application/json": {
-                        parts: {
-                            partNumber: number;
-                            etag: string;
-                        }[];
-                        config: {
-                            vcpus: number;
-                            ramMb: number;
-                            diskLimitGb: number;
-                            imageId: string;
-                            userData?: string | null;
-                        };
-                    };
-                };
-            };
-            responses: {
-                /** @description Provisioning enqueued */
-                200: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": {
-                            importId?: string;
-                            cubeId?: string;
-                            /** @enum {string} */
-                            status?: "provisioning";
-                        };
-                    };
-                };
-                /** @description Invalid input */
-                400: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content?: never;
-                };
-                /** @description Plan limit exceeded */
-                403: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content?: never;
-                };
-                /** @description Import not in 'uploading' state */
-                409: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content?: never;
-                };
-                /** @description S3 finalization failed */
-                502: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content?: never;
-                };
-                /** @description Storage backend unavailable */
-                503: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content?: never;
-                };
-            };
-        };
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/spaces/{spaceId}/webhooks": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        /** List webhook endpoints */
-        get: {
-            parameters: {
-                query?: never;
-                header?: never;
-                path: {
-                    spaceId: string;
-                };
-                cookie?: never;
-            };
-            requestBody?: never;
-            responses: {
-                /** @description Webhook list */
-                200: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content?: never;
-                };
-            };
-        };
-        put?: never;
-        /** Create a webhook endpoint (signing secret returned once) */
-        post: {
-            parameters: {
-                query?: never;
-                header?: never;
-                path: {
-                    spaceId: string;
-                };
-                cookie?: never;
-            };
-            requestBody: {
-                content: {
-                    "application/json": {
-                        /** Format: uri */
-                        url: string;
-                        events: ("cube.created" | "cube.running" | "cube.stopped" | "cube.error" | "cube.deleted" | "cube.cold_restarted" | "cube.transfer.started" | "cube.transfer.completed" | "cube.transfer.failed" | "cube.resize.started" | "cube.resize.completed" | "cube.resize.failed" | "resource.alert.memory" | "resource.alert.cpu" | "resource.alert.disk" | "domain.alert.error_4xx" | "domain.alert.error_5xx" | "snapshot.created" | "snapshot.restored" | "snapshot.deleted" | "snapshot.pinned" | "snapshot.promoted_to_backup" | "snapshot.exported" | "backup.created" | "backup.deleted" | "backup.redeployed" | "domain.added" | "domain.active" | "domain.removed" | "tcp_mapping.added" | "tcp_mapping.removed" | "tcp_mapping.updated" | "hosting.provisioned" | "hosting.suspended" | "hosting.unsuspended" | "hosting.deleted" | "hosting.plan_changed" | "hosting.renewed" | "hosting.cancellation_scheduled" | "hosting.suspended_for_non_payment" | "hosting.deleted_after_recovery" | "member.invited" | "member.joined" | "member.removed" | "member.role_changed")[];
-                    };
-                };
-            };
-            responses: {
-                /** @description Webhook created (response includes secret) */
-                201: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content?: never;
-                };
-                400: components["responses"]["BadRequest"];
-                429: components["responses"]["RateLimited"];
-            };
-        };
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/spaces/{spaceId}/webhooks/{endpointId}": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        /** Get a webhook (no secret) */
-        get: {
-            parameters: {
-                query?: never;
-                header?: never;
-                path: {
-                    spaceId: string;
-                    endpointId: string;
-                };
-                cookie?: never;
-            };
-            requestBody?: never;
-            responses: {
-                /** @description Webhook */
-                200: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content?: never;
-                };
-            };
-        };
-        put?: never;
-        post?: never;
-        /** Delete a webhook (cascades deliveries) */
-        delete: {
-            parameters: {
-                query?: never;
-                header?: never;
-                path: {
-                    spaceId: string;
-                    endpointId: string;
-                };
-                cookie?: never;
-            };
-            requestBody?: never;
-            responses: {
-                /** @description Deleted */
-                200: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content?: never;
-                };
-                429: components["responses"]["RateLimited"];
-            };
-        };
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/spaces/{spaceId}/webhooks/{endpointId}/deliveries": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        /** Last 30 days of webhook delivery history (max 100) */
-        get: {
-            parameters: {
-                query?: {
-                    limit?: number;
-                };
-                header?: never;
-                path: {
-                    spaceId: string;
-                    endpointId: string;
-                };
-                cookie?: never;
-            };
-            requestBody?: never;
-            responses: {
-                /** @description Delivery list */
-                200: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content?: never;
-                };
+  "/regions": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /** List regions with available capacity */
+    get: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path?: never;
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /** @description Region list */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": {
+              regions: components["schemas"]["Region"][];
+            };
+          };
+        };
+      };
+    };
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  "/images": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /** List available OS images */
+    get: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path?: never;
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /** @description Image list */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": {
+              images: components["schemas"]["Image"][];
+            };
+          };
+        };
+      };
+    };
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  "/pricing": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /** Per-resource hourly rates and volume pricing tiers */
+    get: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path?: never;
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /** @description Pricing data */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": {
+              currency: string;
+              rates: {
+                vcpuPerHour: number;
+                ramGbPerHour: number;
+                diskGbPerHour: number;
+              };
+              tiers: components["schemas"]["PricingTier"][];
+              note: string;
             };
+          };
         };
-        put?: never;
-        post?: never;
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
+      };
     };
-}
-interface components {
-    schemas: {
-        Space: {
-            id: string;
-            name: string;
-            tier: string;
-            /** Format: date-time */
-            createdAt: string;
-        };
-        CubeSshInfo: {
-            host: string | null;
-            port: number;
-            user: string;
-            hostKeys: {
-                type: string;
-                key: string;
-            }[];
-        };
-        Cube: {
-            id: string;
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  "/auth/cli/start": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Begin a CLI device-authorization login (RFC 8628)
+     * @description Public, unauthenticated. Mints a device code (returned once) and a short human user code, and returns the verification URIs the user opens in a browser to approve. The CLI then polls /auth/cli/poll. Rate-limited per client IP.
+     */
+    post: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path?: never;
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /** @description Device-authorization request created */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": {
+              /** @description High-entropy code the CLI keeps secret and presents on each poll. Only its hash is stored server-side. */
+              deviceCode: string;
+              /** @description Short human-readable code (KROVA-XXXX-XXXX) the user confirms in the browser. */
+              userCode: string;
+              /**
+               * Format: uri
+               * @description Browser URL where the user approves.
+               */
+              verificationUri: string;
+              /**
+               * Format: uri
+               * @description verificationUri with the user code pre-filled.
+               */
+              verificationUriComplete: string;
+              /** @description Seconds to wait between polls. */
+              interval: number;
+              /** @description Seconds until the device code expires (~600). */
+              expiresIn: number;
+            };
+          };
+        };
+        429: components["responses"]["RateLimited"];
+        /** @description Could not allocate a login code; retry */
+        503: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content?: never;
+        };
+      };
+    };
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  "/auth/cli/poll": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Poll for CLI device-authorization approval (RFC 8628)
+     * @description Public, unauthenticated. The CLI submits its deviceCode until the user approves or denies. On approval a real API key is minted ONCE, scoped to the approved Space and the approving user's membership, and returned a single time. Rate-limited per client IP.
+     */
+    post: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path?: never;
+        cookie?: never;
+      };
+      requestBody: {
+        content: {
+          "application/json": {
+            /** @description The device code from /auth/cli/start. */
+            deviceCode: string;
+          };
+        };
+      };
+      responses: {
+        /** @description Approved — API key minted (returned once) */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": {
+              /** @description The full API key. Shown once and never returned again — store it securely. */
+              apiKey: string;
+              /** @description The Space the key is scoped to. */
+              spaceId: string;
+            };
+          };
+        };
+        400: components["responses"]["BadRequest"];
+        /** @description The user denied the login request */
+        403: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content?: never;
+        };
+        /** @description The device code expired, was already consumed, or is unknown */
+        410: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content?: never;
+        };
+        /** @description Authorization still pending — keep polling at the given interval */
+        428: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content?: never;
+        };
+        429: components["responses"]["RateLimited"];
+      };
+    };
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  "/space": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Resolve the space this API key is scoped to
+     * @description Returns the single space the API key belongs to. Lets a client auto-resolve the space id from the key alone (no spaceId in the URL).
+     */
+    get: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path?: never;
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /** @description The key's space */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["Space"];
+          };
+        };
+        401: components["responses"]["Unauthorized"];
+        404: components["responses"]["NotFound"];
+      };
+    };
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  "/spaces/{spaceId}/cubes": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /** List Cubes in a Space */
+    get: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path: {
+          spaceId: string;
+        };
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /** @description Paginated Cube list */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": {
+              cubes: components["schemas"]["Cube"][];
+              pagination: components["schemas"]["Pagination"];
+            };
+          };
+        };
+        401: components["responses"]["Unauthorized"];
+        403: components["responses"]["Forbidden"];
+      };
+    };
+    put?: never;
+    /** Create a Cube */
+    post: {
+      parameters: {
+        query?: never;
+        header?: {
+          /** @description Optional unique key (max 255 chars). Replays return the original response and add header Idempotency-Replayed: true. Scoped per space; expires after 24h. */
+          "Idempotency-Key"?: string;
+        };
+        path: {
+          spaceId: string;
+        };
+        cookie?: never;
+      };
+      requestBody: {
+        content: {
+          "application/json": {
             name: string;
-            /** @enum {string} */
-            state: "pending" | "booting" | "running" | "stopped" | "stopping" | "error" | "deleted";
-            publicIpv4: string | null;
+            image: string;
             resources: {
-                vcpu: number;
-                ramGb: number;
-                diskGb: number;
+              vcpu: number;
+              ramGb: number;
+              diskGb: number;
+            };
+            /** @description SSH public key written to the Cube login user's authorized_keys at boot (~/.ssh/authorized_keys for the ubuntu or debian user; /root/.ssh/authorized_keys on Cubes created before the default-user change). GET /cubes/{cubeId}/ssh reports the login user for a given Cube. Must start with ssh-ed25519, ssh-rsa, ecdsa-sha2-*, ssh-dss, or sk-*@openssh.com. */
+            sshPublicKey: string;
+            /** @description Region slug from /v1/regions (optional). */
+            region?: string;
+            /** @description cloud-init script (max 16 KB, optional). */
+            userData?: string;
+          };
+        };
+      };
+      responses: {
+        /** @description Cube created */
+        201: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": {
+              cube?: components["schemas"]["Cube"];
+            };
+          };
+        };
+        400: components["responses"]["BadRequest"];
+        401: components["responses"]["Unauthorized"];
+        403: components["responses"]["Forbidden"];
+        429: components["responses"]["RateLimited"];
+      };
+    };
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  "/spaces/{spaceId}/cubes/{cubeId}": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /** Get a Cube */
+    get: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path: {
+          spaceId: string;
+          cubeId: string;
+        };
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /** @description Cube */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": {
+              cube: components["schemas"]["Cube"];
+            };
+          };
+        };
+        404: components["responses"]["NotFound"];
+      };
+    };
+    put?: never;
+    post?: never;
+    /** Delete a Cube (asynchronous) */
+    delete: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path: {
+          spaceId: string;
+          cubeId: string;
+        };
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /** @description Deletion enqueued */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": {
+              success: boolean;
+            };
+          };
+        };
+        404: components["responses"]["NotFound"];
+        429: components["responses"]["RateLimited"];
+      };
+    };
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  "/spaces/{spaceId}/cubes/{cubeId}/power-off": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /** Power off a running Cube */
+    post: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path: {
+          spaceId: string;
+          cubeId: string;
+        };
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /** @description Power off enqueued */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content?: never;
+        };
+        404: components["responses"]["NotFound"];
+        429: components["responses"]["RateLimited"];
+      };
+    };
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  "/spaces/{spaceId}/cubes/{cubeId}/wake": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /** Start a stopped Cube */
+    post: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path: {
+          spaceId: string;
+          cubeId: string;
+        };
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /** @description Start enqueued */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content?: never;
+        };
+        404: components["responses"]["NotFound"];
+        429: components["responses"]["RateLimited"];
+      };
+    };
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  "/spaces/{spaceId}/cubes/{cubeId}/restart": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Restart a running Cube
+     * @description Cold-restarts the Cube: the hypervisor process is stopped and relaunched, so the Cube boots against the host's current kernel. This is how a Cube picks up a refreshed guest kernel after a platform image update — a `reboot` issued inside the Cube cannot do it, because the kernel is supplied externally by the host. Disk state is preserved; only the kernel changes. Cube must be `running` (a stopped Cube already picks up the latest kernel when started). Concurrent restarts of the same Cube are rejected with 409 rather than queued twice.
+     */
+    post: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path: {
+          spaceId: string;
+          cubeId: string;
+        };
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /** @description Restart enqueued */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content?: never;
+        };
+        404: components["responses"]["NotFound"];
+        /** @description Cube is not running, or a restart is already in progress */
+        409: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content?: never;
+        };
+        429: components["responses"]["RateLimited"];
+      };
+    };
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  "/spaces/{spaceId}/cubes/{cubeId}/ssh-port": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    /**
+     * Change a Cube's SSH port
+     * @description Sets the port INSIDE the Cube that SSH is forwarded to — NOT the host port you connect to. The host port is allocated by Krova and is unchanged by this call. Pointing this at a port nothing is listening on inside the Cube will make SSH unreachable; the default is 22. The change is applied atomically (the old port mapping is replaced).
+     */
+    put: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path: {
+          spaceId: string;
+          cubeId: string;
+        };
+        cookie?: never;
+      };
+      requestBody: {
+        content: {
+          "application/json": {
+            /** @description The port inside the Cube that sshd listens on (default 22). This is the Cube side of the mapping, not the host port. */
+            cubePort: number;
+          };
+        };
+      };
+      responses: {
+        /** @description SSH port updated */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content?: never;
+        };
+        400: components["responses"]["BadRequest"];
+        404: components["responses"]["NotFound"];
+        429: components["responses"]["RateLimited"];
+      };
+    };
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  "/spaces/{spaceId}/cubes/{cubeId}/ssh": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Get a Cube's SSH connection info
+     * @description Host (server public IPv4), host SSH port, login user, and the Cube's captured SSH host public keys. **Use `user` rather than assuming a username** — it is `ubuntu` or `debian` on Cubes created from images that ship a default user, and `root` on Cubes created before that change or imported from a rootfs without one. `hostKeys` is empty only until the reachability cron makes its first capture; clients fall back to trust-on-first-use until then, and pin strictly afterwards.
+     */
+    get: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path: {
+          spaceId: string;
+          cubeId: string;
+        };
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /** @description SSH connection info */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["CubeSshInfo"];
+          };
+        };
+        404: components["responses"]["NotFound"];
+      };
+    };
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  "/spaces/{spaceId}/cubes/{cubeId}/domains": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /** List custom domains attached to a Cube */
+    get: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path: {
+          spaceId: string;
+          cubeId: string;
+        };
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /** @description Domain list */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": {
+              domains: components["schemas"]["Domain"][];
+            };
+          };
+        };
+      };
+    };
+    put?: never;
+    /**
+     * Attach a custom domain to a Cube
+     * @description Attaches a domain and optionally configures any per-domain proxy settings at the same time. Settings can also be changed later via PATCH.
+     */
+    post: {
+      parameters: {
+        query?: never;
+        header?: {
+          /** @description Optional unique key (max 255 chars). Replays return the original response and add header Idempotency-Replayed: true. Scoped per space; expires after 24h. */
+          "Idempotency-Key"?: string;
+        };
+        path: {
+          spaceId: string;
+          cubeId: string;
+        };
+        cookie?: never;
+      };
+      requestBody: {
+        content: {
+          "application/json": {
+            /** @description The hostname to attach, e.g. app.example.com */
+            domain: string;
+            /** @description Cube port the domain proxies to. */
+            port: number;
+            /**
+             * @description enforced = proxy sets platform security headers (HSTS, X-Frame-Options, …); app_managed = the app's own headers pass through. Default enforced.
+             * @enum {string}
+             */
+            securityHeadersMode?: "enforced" | "app_managed";
+            /** @description Seconds the app may take to send response headers (streaming unaffected). Default 60. */
+            responseHeaderTimeoutSecs?: number;
+            /** @description Header rewrites: `set` adds/overwrites, `remove` deletes. Null clears all. */
+            responseHeaderOverrides?: {
+              set?: {
+                [key: string]: string;
+              };
+              remove?: string[];
+            } | null;
+            /** @description Header rewrites: `set` adds/overwrites, `remove` deletes. Null clears all. */
+            requestHeaderOverrides?: {
+              set?: {
+                [key: string]: string;
+              };
+              remove?: string[];
+            } | null;
+            /** @description Max request body size (MB). Null = unlimited (default). */
+            maxRequestBodyMb?: number | null;
+            /** @description Per-domain CORS policy, applied at the edge. Null (default) = CORS disabled and no Access-Control-* header is emitted anywhere. When set, the proxy answers OPTIONS preflight itself (204, the cube is never involved) and adds the headers to normal AND error responses, so a cross-origin request to a failing or sleeping cube is never CORS-masked. */
+            corsConfig?: {
+              /** @description Exact scheme://host[:port] origins (no path, query or trailing slash), or the single-element wildcard ["*"]. "*" and allowCredentials are mutually exclusive. */
+              allowedOrigins: string[];
+              /** @description Allowed methods. Omitted = GET, POST, PUT, PATCH, DELETE, OPTIONS. */
+              allowedMethods?: string[];
+              /** @description Allowed request headers. Omitted/empty = echo the preflight's Access-Control-Request-Headers. */
+              allowedHeaders?: string[];
+              /** @description Response headers exposed to JS. Omitted/empty = none. */
+              exposedHeaders?: string[];
+              /** @description Send Access-Control-Allow-Credentials: true. Rejected together with the "*" origin. */
+              allowCredentials?: boolean;
+              /** @description Preflight cache TTL. Default 600; 86400 is Chromium's hard cap. */
+              maxAgeSeconds?: number;
+            } | null;
+            /**
+             * @description Scheme the edge speaks to the CUBE on the backend hop. http (default) = cleartext. https = the cube terminates TLS itself (a control panel holding its own certificate, or an app listening on HTTPS) and answers plain HTTP with a redirect, so it cannot be reached over cleartext at all. Visitors are on HTTPS either way. The dial port is derived: https on the default port 80 connects on 443; a deliberate custom port is honoured exactly. Verified against the cube before it is applied — if the domain does not serve, the route is left on http.
+             * @enum {string}
+             */
+            originScheme?: "http" | "https";
+            /** @description Edge gzip/zstd compression. Default false (domains behind a CDN are already compressed there). */
+            responseCompression?: boolean;
+            /** @description Visitor IP/CIDR allow-list (v4+v6). Non-empty ⇒ only these reach the app. Null/empty = open. */
+            ipAllowList?: string[] | null;
+            /** @description Visitor IP/CIDR deny-list (v4+v6) → 403. Null/empty = none. */
+            ipDenyList?: string[] | null;
+            /** @description HTTP Basic Auth username. Null/empty clears Basic Auth. Setting it requires basicAuthPassword. */
+            basicAuthUser?: string | null;
+            /** @description Plaintext Basic Auth password — bcrypt-hashed server-side, never stored or returned. Required when setting basicAuthUser. */
+            basicAuthPassword?: string;
+          };
+        };
+      };
+      responses: {
+        /** @description Domain attached */
+        201: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": {
+              domain: components["schemas"]["Domain"];
+              records: components["schemas"]["DnsRecord"][];
+            };
+          };
+        };
+        400: components["responses"]["BadRequest"];
+        429: components["responses"]["RateLimited"];
+      };
+    };
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  "/spaces/{spaceId}/cubes/{cubeId}/domains/{mappingId}/records": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * DNS records this domain needs, with their live status
+     * @description Every record required for the domain to work, each checked against live DNS. Poll this after publishing them.
+     *
+     *     `state` is per record: `found`, `missing` (not published yet — the expected state before you add it, never an error), `mismatch` (something else is there), or `unknown` (we could not check — never a statement about your DNS). `summary.complete` is true only when every record is `found`.
+     *
+     *     A wildcard needs three records; an exact host needs one. Each call performs live DNS lookups and is rate limited.
+     */
+    get: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path: {
+          spaceId: string;
+          cubeId: string;
+          mappingId: string;
+        };
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /** @description Required records with live status */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": {
+              domain: string;
+              isWildcard: boolean;
+              records: components["schemas"]["DnsRecordStatus"][];
+              summary: {
+                found: number;
+                total: number;
+                complete: boolean;
+              };
+              /** Format: date-time */
+              checkedAt: string;
             };
-            image: string;
-            sshUser: string;
-            costPerHour: number;
-            /** Format: date-time */
-            createdAt: string;
-            /** Format: date-time */
-            updatedAt: string;
-        };
-        Pagination: {
-            page: number;
-            limit: number;
-            total: number;
-            totalPages: number;
-        };
-        Region: {
-            id: string;
-            name: string;
-            slug: string;
+          };
         };
-        Image: {
-            id: string;
-            name: string;
-            version: string;
-            description: string;
-            defaultUser: string;
-        };
-        PricingTier: {
-            minVcpus: number;
-            maxVcpus: number | null;
-            multiplier: number;
-            label: string;
-        };
-        DnsRecord: {
-            /** @enum {string} */
-            id: "ownership" | "routing" | "certificate";
-            /** @enum {string} */
-            type: "CNAME" | "TXT" | "A";
-            host: string;
-            value: string;
-            /** @enum {string} */
-            purpose: "ownership" | "routing" | "certificate";
-            note?: string | null;
-            mustBeGrey: boolean;
-            proxyOk: boolean;
-        };
-        DnsRecordStatus: {
-            id: string;
-            /** @enum {string} */
-            type: "CNAME" | "TXT" | "A";
-            host: string;
-            value: string;
-            purpose: string;
-            note?: string | null;
-            mustBeGrey?: boolean;
-            proxyOk?: boolean;
-            /** @enum {string} */
-            state: "found" | "missing" | "mismatch" | "unknown";
-            detail: string;
-            observed?: string[] | null;
-        };
-        Domain: {
-            id: string;
-            cubeId: string;
-            domain: string;
-            port: number | null;
-            status: string;
-            ingressStatus: string | null;
-            /** @enum {string} */
-            securityHeadersMode: "enforced" | "app_managed";
-            responseHeaderTimeoutSecs: number;
+        404: components["responses"]["NotFound"];
+        429: components["responses"]["RateLimited"];
+      };
+    };
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  "/spaces/{spaceId}/cubes/{cubeId}/domains/{mappingId}": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    post?: never;
+    /** Detach a custom domain */
+    delete: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path: {
+          spaceId: string;
+          cubeId: string;
+          mappingId: string;
+        };
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /** @description Detached */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": {
+              success: boolean;
+            };
+          };
+        };
+        404: components["responses"]["NotFound"];
+      };
+    };
+    options?: never;
+    head?: never;
+    /**
+     * Update a custom domain's proxy settings
+     * @description Partial update — only the fields you send change; omitted fields are left as-is. The Basic Auth password is write-only and bcrypt-hashed server-side.
+     */
+    patch: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path: {
+          spaceId: string;
+          cubeId: string;
+          mappingId: string;
+        };
+        cookie?: never;
+      };
+      requestBody: {
+        content: {
+          "application/json": {
+            /**
+             * @description enforced = proxy sets platform security headers (HSTS, X-Frame-Options, …); app_managed = the app's own headers pass through. Default enforced.
+             * @enum {string}
+             */
+            securityHeadersMode?: "enforced" | "app_managed";
+            /** @description Seconds the app may take to send response headers (streaming unaffected). Default 60. */
+            responseHeaderTimeoutSecs?: number;
             /** @description Header rewrites: `set` adds/overwrites, `remove` deletes. Null clears all. */
-            responseHeaderOverrides: {
-                set?: {
-                    [key: string]: string;
-                };
-                remove?: string[];
+            responseHeaderOverrides?: {
+              set?: {
+                [key: string]: string;
+              };
+              remove?: string[];
             } | null;
             /** @description Header rewrites: `set` adds/overwrites, `remove` deletes. Null clears all. */
-            requestHeaderOverrides: {
-                set?: {
-                    [key: string]: string;
-                };
-                remove?: string[];
+            requestHeaderOverrides?: {
+              set?: {
+                [key: string]: string;
+              };
+              remove?: string[];
+            } | null;
+            /** @description Max request body size (MB). Null = unlimited (default). */
+            maxRequestBodyMb?: number | null;
+            /** @description Per-domain CORS policy, applied at the edge. Null (default) = CORS disabled and no Access-Control-* header is emitted anywhere. When set, the proxy answers OPTIONS preflight itself (204, the cube is never involved) and adds the headers to normal AND error responses, so a cross-origin request to a failing or sleeping cube is never CORS-masked. */
+            corsConfig?: {
+              /** @description Exact scheme://host[:port] origins (no path, query or trailing slash), or the single-element wildcard ["*"]. "*" and allowCredentials are mutually exclusive. */
+              allowedOrigins: string[];
+              /** @description Allowed methods. Omitted = GET, POST, PUT, PATCH, DELETE, OPTIONS. */
+              allowedMethods?: string[];
+              /** @description Allowed request headers. Omitted/empty = echo the preflight's Access-Control-Request-Headers. */
+              allowedHeaders?: string[];
+              /** @description Response headers exposed to JS. Omitted/empty = none. */
+              exposedHeaders?: string[];
+              /** @description Send Access-Control-Allow-Credentials: true. Rejected together with the "*" origin. */
+              allowCredentials?: boolean;
+              /** @description Preflight cache TTL. Default 600; 86400 is Chromium's hard cap. */
+              maxAgeSeconds?: number;
             } | null;
-            maxRequestBodyMb: number | null;
-            responseCompression: boolean;
-            ipAllowList: string[] | null;
-            ipDenyList: string[] | null;
-            basicAuthUser: string | null;
-            basicAuthEnabled: boolean;
-            corsConfig: Record<string, never> | null;
-            isWildcard: boolean;
-            /** @enum {string|null} */
-            wildcardCertState: "pending_delegation" | "issuing" | "ready" | "failed" | null;
-            acmeDelegationTarget: string | null;
-            /** Format: date-time */
-            createdAt: string;
-            /** Format: date-time */
-            updatedAt: string;
-        };
-        TcpMapping: {
-            id: string;
-            cubeId: string;
+            /**
+             * @description Scheme the edge speaks to the CUBE on the backend hop. http (default) = cleartext. https = the cube terminates TLS itself (a control panel holding its own certificate, or an app listening on HTTPS) and answers plain HTTP with a redirect, so it cannot be reached over cleartext at all. Visitors are on HTTPS either way. The dial port is derived: https on the default port 80 connects on 443; a deliberate custom port is honoured exactly. Verified against the cube before it is applied — if the domain does not serve, the route is left on http.
+             * @enum {string}
+             */
+            originScheme?: "http" | "https";
+            /** @description Edge gzip/zstd compression. Default false (domains behind a CDN are already compressed there). */
+            responseCompression?: boolean;
+            /** @description Visitor IP/CIDR allow-list (v4+v6). Non-empty ⇒ only these reach the app. Null/empty = open. */
+            ipAllowList?: string[] | null;
+            /** @description Visitor IP/CIDR deny-list (v4+v6) → 403. Null/empty = none. */
+            ipDenyList?: string[] | null;
+            /** @description HTTP Basic Auth username. Null/empty clears Basic Auth. Setting it requires basicAuthPassword. */
+            basicAuthUser?: string | null;
+            /** @description Plaintext Basic Auth password — bcrypt-hashed server-side, never stored or returned. Required when setting basicAuthUser. */
+            basicAuthPassword?: string;
+          };
+        };
+      };
+      responses: {
+        /** @description Settings updated */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": {
+              domain: components["schemas"]["Domain"];
+            };
+          };
+        };
+        400: components["responses"]["BadRequest"];
+        404: components["responses"]["NotFound"];
+        429: components["responses"]["RateLimited"];
+      };
+    };
+    trace?: never;
+  };
+  "/spaces/{spaceId}/cubes/{cubeId}/tcp-mappings": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /** List TCP port forwards for a Cube */
+    get: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path: {
+          spaceId: string;
+          cubeId: string;
+        };
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /** @description TCP mapping list */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": {
+              tcpMappings: components["schemas"]["TcpMapping"][];
+            };
+          };
+        };
+      };
+    };
+    put?: never;
+    /** Create a TCP port forward */
+    post: {
+      parameters: {
+        query?: never;
+        header?: {
+          /** @description Optional unique key (max 255 chars). Replays return the original response and add header Idempotency-Replayed: true. Scoped per space; expires after 24h. */
+          "Idempotency-Key"?: string;
+        };
+        path: {
+          spaceId: string;
+          cubeId: string;
+        };
+        cookie?: never;
+      };
+      requestBody: {
+        content: {
+          "application/json": {
             cubePort: number;
-            hostPort: number;
-            label: string | null;
-            status: string;
-            isSsh: boolean;
-            /** Format: date-time */
-            createdAt: string;
-            /** Format: date-time */
-            updatedAt: string;
-            whitelistedIps: {
-                id: string;
-                cidr: string;
-            }[];
-        };
-        Snapshot: {
-            id: string;
-            cubeId: string;
+            whitelistIps?: string[];
+          };
+        };
+      };
+      responses: {
+        /** @description Mapping created */
+        201: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": {
+              tcpMapping: components["schemas"]["TcpMapping"];
+            };
+          };
+        };
+        400: components["responses"]["BadRequest"];
+        429: components["responses"]["RateLimited"];
+      };
+    };
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  "/spaces/{spaceId}/cubes/{cubeId}/tcp-mappings/{mappingId}": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    post?: never;
+    /** Delete a TCP port forward */
+    delete: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path: {
+          spaceId: string;
+          cubeId: string;
+          mappingId: string;
+        };
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /** @description Deleted */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": {
+              success: boolean;
+            };
+          };
+        };
+        404: components["responses"]["NotFound"];
+      };
+    };
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  "/spaces/{spaceId}/cubes/{cubeId}/snapshots": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /** List snapshots for a Cube */
+    get: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path: {
+          spaceId: string;
+          cubeId: string;
+        };
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /** @description Snapshot list */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": {
+              snapshots: components["schemas"]["Snapshot"][];
+            };
+          };
+        };
+      };
+    };
+    put?: never;
+    /** Create a snapshot */
+    post: {
+      parameters: {
+        query?: never;
+        header?: {
+          /** @description Optional unique key (max 255 chars). Replays return the original response and add header Idempotency-Replayed: true. Scoped per space; expires after 24h. */
+          "Idempotency-Key"?: string;
+        };
+        path: {
+          spaceId: string;
+          cubeId: string;
+        };
+        cookie?: never;
+      };
+      requestBody?: {
+        content: {
+          "application/json": {
+            name?: string;
+          };
+        };
+      };
+      responses: {
+        /** @description Snapshot enqueued */
+        201: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": {
+              snapshot: components["schemas"]["Snapshot"];
+            };
+          };
+        };
+        429: components["responses"]["RateLimited"];
+      };
+    };
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  "/spaces/{spaceId}/cubes/{cubeId}/snapshots/{snapshotId}": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    post?: never;
+    /** Delete a snapshot */
+    delete: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path: {
+          spaceId: string;
+          cubeId: string;
+          snapshotId: string;
+        };
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /** @description Deleted */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": {
+              success: boolean;
+            };
+          };
+        };
+        404: components["responses"]["NotFound"];
+      };
+    };
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  "/spaces/{spaceId}/cubes/{cubeId}/restore": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /** Restore a Cube from a snapshot */
+    post: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path: {
+          spaceId: string;
+          cubeId: string;
+        };
+        cookie?: never;
+      };
+      requestBody: {
+        content: {
+          "application/json": {
+            snapshotId: string;
+          };
+        };
+      };
+      responses: {
+        /** @description Restore enqueued */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": {
+              success: boolean;
+            };
+          };
+        };
+        404: components["responses"]["NotFound"];
+      };
+    };
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  "/spaces/{spaceId}/backups/{backupId}/download": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /** Generate a presigned download URL for a backup .cube archive */
+    get: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path: {
+          spaceId: string;
+          backupId: string;
+        };
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /** @description Presigned URL valid for 15 minutes */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": {
+              url?: string;
+              filename?: string;
+              sizeBytes?: number | null;
+              /** Format: date-time */
+              expiresAt?: string;
+            };
+          };
+        };
+        404: components["responses"]["NotFound"];
+        /** @description Backup is not in 'complete' status */
+        409: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content?: never;
+        };
+      };
+    };
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  "/spaces/{spaceId}/cubes/imports": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /** Initiate a .cube archive import (browser-side multipart upload) */
+    post: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path: {
+          spaceId: string;
+        };
+        cookie?: never;
+      };
+      requestBody: {
+        content: {
+          "application/json": {
             name: string;
-            sizeBytes: number | null;
-            status: string;
-            kind: string;
-            /** Format: date-time */
-            createdAt: string;
-        };
-        Webhook: {
-            id: string;
+            fileSizeBytes: number;
+            /**
+             * @description What to do with SSH access on the imported rootfs. `replace` (default) writes `sshPublicKey` to the login user's authorized_keys and requires `sshPublicKey` to be set. `keep` leaves the image's own authorized_keys and sshd configuration completely untouched — nothing is written — so you must already hold a private key that the image accepts, or you will not be able to log in.
+             * @default replace
+             * @enum {string}
+             */
+            sshKeyMode?: "replace" | "keep";
+            /** @description Public key to install when `sshKeyMode` is `replace`. Written to the login user's `~/.ssh/authorized_keys` — which user that is comes from the imported rootfs itself, so an image without a Krova default user keeps logging in as root. Ignored when `sshKeyMode` is `keep`. */
+            sshPublicKey?: string | null;
+            region?: string | null;
+            vcpusOverride?: number | null;
+            ramMbOverride?: number | null;
+            diskGbOverride?: number | null;
+            userData?: string | null;
+            expectedConfig?: {
+              vcpus?: number;
+              ramMb?: number;
+              diskLimitGb?: number;
+            } | null;
+          };
+        };
+      };
+      responses: {
+        /** @description Import initiated; returns presigned part URLs */
+        201: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": {
+              importId?: string;
+              uploadId?: string;
+              key?: string;
+              chunkSizeBytes?: number;
+              parts?: {
+                partNumber?: number;
+                url?: string;
+              }[];
+              /** Format: date-time */
+              expiresAt?: string;
+            };
+          };
+        };
+        /** @description Invalid input */
+        400: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content?: never;
+        };
+        /** @description Plan limit exceeded */
+        403: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content?: never;
+        };
+        /** @description No active storage backend */
+        503: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content?: never;
+        };
+      };
+    };
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  "/spaces/{spaceId}/cubes/imports/{importId}": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /** Get the current state of an import */
+    get: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path: {
+          spaceId: string;
+          importId: string;
+        };
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /** @description Current import state */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": {
+              import?: {
+                id?: string;
+                name?: string;
+                /** @enum {string} */
+                status?: "uploading" | "finalizing" | "provisioning" | "complete" | "failed" | "expired";
+                cubeId?: string | null;
+                error?: string | null;
+                createdAt?: string;
+                updatedAt?: string;
+                completedAt?: string | null;
+              };
+            };
+          };
+        };
+        404: components["responses"]["NotFound"];
+      };
+    };
+    put?: never;
+    post?: never;
+    /** Cancel an in-flight upload (only allowed in 'uploading' state) */
+    delete: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path: {
+          spaceId: string;
+          importId: string;
+        };
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /** @description Cancelled */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": {
+              success: boolean;
+            };
+          };
+        };
+        404: components["responses"]["NotFound"];
+        /** @description Cannot cancel an import past the 'uploading' state */
+        409: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content?: never;
+        };
+      };
+    };
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  "/spaces/{spaceId}/cubes/imports/{importId}/complete": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /** Finalize a .cube import: complete multipart upload + create cube row + enqueue provisioning */
+    post: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path: {
+          spaceId: string;
+          importId: string;
+        };
+        cookie?: never;
+      };
+      requestBody: {
+        content: {
+          "application/json": {
+            parts: {
+              partNumber: number;
+              etag: string;
+            }[];
+            config: {
+              vcpus: number;
+              ramMb: number;
+              diskLimitGb: number;
+              imageId: string;
+              userData?: string | null;
+            };
+          };
+        };
+      };
+      responses: {
+        /** @description Provisioning enqueued */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": {
+              importId?: string;
+              cubeId?: string;
+              /** @enum {string} */
+              status?: "provisioning";
+            };
+          };
+        };
+        /** @description Invalid input */
+        400: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content?: never;
+        };
+        /** @description Plan limit exceeded */
+        403: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content?: never;
+        };
+        /** @description Import not in 'uploading' state */
+        409: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content?: never;
+        };
+        /** @description S3 finalization failed */
+        502: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content?: never;
+        };
+        /** @description Storage backend unavailable */
+        503: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content?: never;
+        };
+      };
+    };
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  "/spaces/{spaceId}/webhooks": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /** List webhook endpoints */
+    get: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path: {
+          spaceId: string;
+        };
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /** @description Webhook list */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content?: never;
+        };
+      };
+    };
+    put?: never;
+    /** Create a webhook endpoint (signing secret returned once) */
+    post: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path: {
+          spaceId: string;
+        };
+        cookie?: never;
+      };
+      requestBody: {
+        content: {
+          "application/json": {
             /** Format: uri */
             url: string;
-            events: string[];
-            enabled: boolean;
-            /** Format: date-time */
-            createdAt: string;
-            /** Format: date-time */
-            updatedAt: string;
-        };
-        WebhookDelivery: {
-            id: string;
-            event: string;
-            /** @enum {string} */
-            status: "pending" | "delivered" | "failed";
-            attempts: number;
-            /** Format: date-time */
-            lastAttemptAt: string | null;
-            responseStatus: number | null;
-            /** Format: date-time */
-            createdAt: string;
-        };
-        Error: {
-            error: string;
-        };
-    };
-    responses: {
-        /** @description Bad request */
-        BadRequest: {
-            headers: {
-                [name: string]: unknown;
-            };
-            content: {
-                "application/json": components["schemas"]["Error"];
-            };
-        };
-        /** @description Missing or invalid API key */
-        Unauthorized: {
-            headers: {
-                [name: string]: unknown;
-            };
-            content: {
-                "application/json": components["schemas"]["Error"];
-            };
-        };
-        /** @description Authenticated but lacks the required permission */
-        Forbidden: {
-            headers: {
-                [name: string]: unknown;
-            };
-            content: {
-                "application/json": components["schemas"]["Error"];
-            };
-        };
-        /** @description Resource not found */
-        NotFound: {
-            headers: {
-                [name: string]: unknown;
-            };
-            content: {
-                "application/json": components["schemas"]["Error"];
-            };
-        };
-        /** @description Rate limit exceeded (10 mutations / 60s) */
-        RateLimited: {
-            headers: {
-                [name: string]: unknown;
-            };
-            content: {
-                "application/json": components["schemas"]["Error"];
-            };
-        };
+            events: ("cube.created" | "cube.running" | "cube.stopped" | "cube.error" | "cube.deleted" | "cube.cold_restarted" | "cube.transfer.started" | "cube.transfer.completed" | "cube.transfer.failed" | "cube.resize.started" | "cube.resize.completed" | "cube.resize.failed" | "resource.alert.memory" | "resource.alert.cpu" | "resource.alert.disk" | "domain.alert.error_4xx" | "domain.alert.error_5xx" | "snapshot.created" | "snapshot.restored" | "snapshot.deleted" | "snapshot.pinned" | "snapshot.promoted_to_backup" | "snapshot.exported" | "backup.created" | "backup.deleted" | "backup.redeployed" | "domain.added" | "domain.active" | "domain.removed" | "tcp_mapping.added" | "tcp_mapping.removed" | "tcp_mapping.updated" | "hosting.provisioned" | "hosting.suspended" | "hosting.unsuspended" | "hosting.deleted" | "hosting.plan_changed" | "hosting.renewed" | "hosting.cancellation_scheduled" | "hosting.suspended_for_non_payment" | "hosting.deleted_after_recovery" | "member.invited" | "member.joined" | "member.removed" | "member.role_changed")[];
+          };
+        };
+      };
+      responses: {
+        /** @description Webhook created (response includes secret) */
+        201: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content?: never;
+        };
+        400: components["responses"]["BadRequest"];
+        429: components["responses"]["RateLimited"];
+      };
+    };
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  "/spaces/{spaceId}/webhooks/{endpointId}": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /** Get a webhook (no secret) */
+    get: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path: {
+          spaceId: string;
+          endpointId: string;
+        };
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /** @description Webhook */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content?: never;
+        };
+      };
+    };
+    put?: never;
+    post?: never;
+    /** Delete a webhook (cascades deliveries) */
+    delete: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path: {
+          spaceId: string;
+          endpointId: string;
+        };
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /** @description Deleted */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content?: never;
+        };
+        429: components["responses"]["RateLimited"];
+      };
+    };
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  "/spaces/{spaceId}/webhooks/{endpointId}/deliveries": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
     };
-    parameters: never;
-    requestBodies: never;
-    headers: never;
-    pathItems: never;
+    /** Last 30 days of webhook delivery history (max 100) */
+    get: {
+      parameters: {
+        query?: {
+          limit?: number;
+        };
+        header?: never;
+        path: {
+          spaceId: string;
+          endpointId: string;
+        };
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /** @description Delivery list */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content?: never;
+        };
+      };
+    };
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
 }
-
+interface components {
+  schemas: {
+    Space: {
+      id: string;
+      name: string;
+      tier: string;
+      /** Format: date-time */
+      createdAt: string;
+    };
+    CubeSshInfo: {
+      host: string | null;
+      port: number;
+      user: string;
+      hostKeys: {
+        type: string;
+        key: string;
+      }[];
+    };
+    Cube: {
+      id: string;
+      name: string;
+      /** @enum {string} */
+      state: "pending" | "booting" | "running" | "stopped" | "stopping" | "error" | "deleted";
+      publicIpv4: string | null;
+      resources: {
+        vcpu: number;
+        ramGb: number;
+        diskGb: number;
+      };
+      image: string;
+      sshUser: string;
+      costPerHour: number;
+      /** Format: date-time */
+      createdAt: string;
+      /** Format: date-time */
+      updatedAt: string;
+    };
+    Pagination: {
+      page: number;
+      limit: number;
+      total: number;
+      totalPages: number;
+    };
+    Region: {
+      id: string;
+      name: string;
+      slug: string;
+    };
+    Image: {
+      id: string;
+      name: string;
+      version: string;
+      description: string;
+      defaultUser: string;
+    };
+    PricingTier: {
+      minVcpus: number;
+      maxVcpus: number | null;
+      multiplier: number;
+      label: string;
+    };
+    DnsRecord: {
+      /** @enum {string} */
+      id: "ownership" | "routing" | "certificate";
+      /** @enum {string} */
+      type: "CNAME" | "TXT" | "A";
+      host: string;
+      value: string;
+      /** @enum {string} */
+      purpose: "ownership" | "routing" | "certificate";
+      note?: string | null;
+      mustBeGrey: boolean;
+      proxyOk: boolean;
+    };
+    DnsRecordStatus: {
+      id: string;
+      /** @enum {string} */
+      type: "CNAME" | "TXT" | "A";
+      host: string;
+      value: string;
+      purpose: string;
+      note?: string | null;
+      mustBeGrey?: boolean;
+      proxyOk?: boolean;
+      /** @enum {string} */
+      state: "found" | "missing" | "mismatch" | "unknown";
+      detail: string;
+      observed?: string[] | null;
+    };
+    Domain: {
+      id: string;
+      cubeId: string;
+      domain: string;
+      port: number | null;
+      status: string;
+      ingressStatus: string | null;
+      /** @enum {string} */
+      securityHeadersMode: "enforced" | "app_managed";
+      responseHeaderTimeoutSecs: number;
+      /** @description Header rewrites: `set` adds/overwrites, `remove` deletes. Null clears all. */
+      responseHeaderOverrides: {
+        set?: {
+          [key: string]: string;
+        };
+        remove?: string[];
+      } | null;
+      /** @description Header rewrites: `set` adds/overwrites, `remove` deletes. Null clears all. */
+      requestHeaderOverrides: {
+        set?: {
+          [key: string]: string;
+        };
+        remove?: string[];
+      } | null;
+      maxRequestBodyMb: number | null;
+      responseCompression: boolean;
+      ipAllowList: string[] | null;
+      ipDenyList: string[] | null;
+      basicAuthUser: string | null;
+      basicAuthEnabled: boolean;
+      corsConfig: Record<string, never> | null;
+      isWildcard: boolean;
+      /** @enum {string|null} */
+      wildcardCertState: "pending_delegation" | "issuing" | "ready" | "failed" | null;
+      acmeDelegationTarget: string | null;
+      /** Format: date-time */
+      createdAt: string;
+      /** Format: date-time */
+      updatedAt: string;
+    };
+    TcpMapping: {
+      id: string;
+      cubeId: string;
+      cubePort: number;
+      hostPort: number;
+      label: string | null;
+      status: string;
+      isSsh: boolean;
+      /** Format: date-time */
+      createdAt: string;
+      /** Format: date-time */
+      updatedAt: string;
+      whitelistedIps: {
+        id: string;
+        cidr: string;
+      }[];
+    };
+    Snapshot: {
+      id: string;
+      cubeId: string;
+      name: string;
+      sizeBytes: number | null;
+      status: string;
+      kind: string;
+      /** Format: date-time */
+      createdAt: string;
+    };
+    Webhook: {
+      id: string;
+      /** Format: uri */
+      url: string;
+      events: string[];
+      enabled: boolean;
+      /** Format: date-time */
+      createdAt: string;
+      /** Format: date-time */
+      updatedAt: string;
+    };
+    WebhookDelivery: {
+      id: string;
+      event: string;
+      /** @enum {string} */
+      status: "pending" | "delivered" | "failed";
+      attempts: number;
+      /** Format: date-time */
+      lastAttemptAt: string | null;
+      responseStatus: number | null;
+      /** Format: date-time */
+      createdAt: string;
+    };
+    Error: {
+      error: string;
+    };
+  };
+  responses: {
+    /** @description Bad request */
+    BadRequest: {
+      headers: {
+        [name: string]: unknown;
+      };
+      content: {
+        "application/json": components["schemas"]["Error"];
+      };
+    };
+    /** @description Missing or invalid API key */
+    Unauthorized: {
+      headers: {
+        [name: string]: unknown;
+      };
+      content: {
+        "application/json": components["schemas"]["Error"];
+      };
+    };
+    /** @description Authenticated but lacks the required permission */
+    Forbidden: {
+      headers: {
+        [name: string]: unknown;
+      };
+      content: {
+        "application/json": components["schemas"]["Error"];
+      };
+    };
+    /** @description Resource not found */
+    NotFound: {
+      headers: {
+        [name: string]: unknown;
+      };
+      content: {
+        "application/json": components["schemas"]["Error"];
+      };
+    };
+    /** @description Rate limit exceeded (10 mutations / 60s) */
+    RateLimited: {
+      headers: {
+        [name: string]: unknown;
+      };
+      content: {
+        "application/json": components["schemas"]["Error"];
+      };
+    };
+  };
+  parameters: never;
+  requestBodies: never;
+  headers: never;
+  pathItems: never;
+}
+//#endregion
+//#region src/client.d.ts
 /** The Cube resource, as defined in the Krova Cloud OpenAPI spec. */
 type Cube = components["schemas"]["Cube"];
 /** A region with available capacity (from the catalog). */
@@ -2095,27 +2096,27 @@ declare const DEFAULT_BASE_URL = "https://krova.cloud/api/v1";
  */
 type AuthScheme = "x-api-key" | "bearer";
 interface KrovaClientOptions {
-    /**
-     * Your Krova Cloud API key (a `kro_...` token). Keys are scoped per Space
-     * and inherit the permissions of the membership that created them.
-     */
-    apiKey: string;
-    /** Override the API base URL. Defaults to {@link DEFAULT_BASE_URL}. */
-    baseUrl?: string;
-    /**
-     * Auth header scheme. Defaults to `"x-api-key"` (the spec's scheme).
-     */
-    authScheme?: AuthScheme;
-    /**
-     * Max automatic retries on retryable statuses (429, 503).
-     * Defaults to 2. Set to 0 to disable retries.
-     */
-    maxRetries?: number;
-    /**
-     * A custom `fetch` implementation (e.g. for tests or a proxy). Defaults to
-     * the global `fetch`.
-     */
-    fetch?: typeof fetch;
+  /**
+   * Your Krova Cloud API key (a `kro_...` token). Keys are scoped per Space
+   * and inherit the permissions of the membership that created them.
+   */
+  apiKey: string;
+  /** Override the API base URL. Defaults to {@link DEFAULT_BASE_URL}. */
+  baseUrl?: string;
+  /**
+   * Auth header scheme. Defaults to `"x-api-key"` (the spec's scheme).
+   */
+  authScheme?: AuthScheme;
+  /**
+   * Max automatic retries on retryable statuses (429, 503).
+   * Defaults to 2. Set to 0 to disable retries.
+   */
+  maxRetries?: number;
+  /**
+   * A custom `fetch` implementation (e.g. for tests or a proxy). Defaults to
+   * the global `fetch`.
+   */
+  fetch?: typeof fetch;
 }
 /**
  * A typed client for the Krova Cloud API.
@@ -2127,283 +2128,284 @@ interface KrovaClientOptions {
  * ```
  */
 declare class KrovaClient {
+  /**
+   * The underlying openapi-fetch client — a fully typed escape hatch to every
+   * path in the spec. Returns `{ data, error, response }` and never throws.
+   *
+   * @example
+   * ```ts
+   * const { data, error } = await krova.raw.GET(
+   *   "/spaces/{spaceId}/cubes/{cubeId}",
+   *   { params: { path: { spaceId, cubeId } } },
+   * );
+   * ```
+   */
+  readonly raw: Client<paths>;
+  /** The resolved base URL in use. */
+  readonly baseUrl: string;
+  constructor(options: KrovaClientOptions);
+  readonly cubes: {
+    /** List Cubes in a Space, with pagination metadata. */
+    list: (spaceId: string) => Promise<{
+      cubes: {
+        id: string;
+        name: string;
+        state: "pending" | "booting" | "running" | "stopped" | "stopping" | "error" | "deleted";
+        publicIpv4: string | null;
+        resources: {
+          vcpu: number;
+          ramGb: number;
+          diskGb: number;
+        };
+        image: string;
+        sshUser: string;
+        costPerHour: number;
+        createdAt: string;
+        updatedAt: string;
+      }[];
+      pagination: {
+        page: number;
+        limit: number;
+        total: number;
+        totalPages: number;
+      };
+    }>;
     /**
-     * The underlying openapi-fetch client — a fully typed escape hatch to every
-     * path in the spec. Returns `{ data, error, response }` and never throws.
+     * Create a Cube. Returns the created {@link Cube}.
      *
-     * @example
-     * ```ts
-     * const { data, error } = await krova.raw.GET(
-     *   "/spaces/{spaceId}/cubes/{cubeId}",
-     *   { params: { path: { spaceId, cubeId } } },
-     * );
-     * ```
+     * @param spaceId Target Space id.
+     * @param body Cube spec — `{ name, image, resources, sshPublicKey, ... }`.
+     * @param opts Optional `idempotencyKey` (max 255 chars, scoped per space).
      */
-    readonly raw: Client<paths>;
-    /** The resolved base URL in use. */
-    readonly baseUrl: string;
-    constructor(options: KrovaClientOptions);
-    readonly cubes: {
-        /** List Cubes in a Space, with pagination metadata. */
-        list: (spaceId: string) => Promise<{
-            cubes: {
-                id: string;
-                name: string;
-                state: "pending" | "booting" | "running" | "stopped" | "stopping" | "error" | "deleted";
-                publicIpv4: string | null;
-                resources: {
-                    vcpu: number;
-                    ramGb: number;
-                    diskGb: number;
-                };
-                image: string;
-                sshUser: string;
-                costPerHour: number;
-                createdAt: string;
-                updatedAt: string;
-            }[];
-            pagination: {
-                page: number;
-                limit: number;
-                total: number;
-                totalPages: number;
-            };
-        }>;
-        /**
-         * Create a Cube. Returns the created {@link Cube}.
-         *
-         * @param spaceId Target Space id.
-         * @param body Cube spec — `{ name, image, resources, sshPublicKey, ... }`.
-         * @param opts Optional `idempotencyKey` (max 255 chars, scoped per space).
-         */
-        create: (spaceId: string, body: NonNullable<paths["/spaces/{spaceId}/cubes"]["post"]["requestBody"]>["content"]["application/json"], opts?: {
-            idempotencyKey?: string;
-        }) => Promise<Cube>;
-        /** Get a single Cube. Returns the {@link Cube}. */
-        get: (spaceId: string, cubeId: string) => Promise<Cube>;
-        /**
-         * Update the IN-CUBE port that SSH is forwarded to.
-         *
-         * `cubePort` is the port **inside** the Cube that sshd listens on — NOT the
-         * host port you connect to. The host port is allocated by Krova and is not
-         * changed by this call. Pointing this at a port nothing is listening on
-         * inside the Cube will silently make SSH unreachable; the default is 22.
-         *
-         * The Krova Cloud API exposes no general Cube-mutation endpoint; the only
-         * mutable Cube field over the API is this port, via
-         * `PUT /spaces/{spaceId}/cubes/{cubeId}/ssh-port`. This helper maps to that
-         * endpoint. (Compute resize / rename are not part of the public API.)
-         */
-        update: (spaceId: string, cubeId: string, body: NonNullable<paths["/spaces/{spaceId}/cubes/{cubeId}/ssh-port"]["put"]["requestBody"]>["content"]["application/json"]) => Promise<unknown>;
-        /** Delete a Cube (asynchronous — deletion is enqueued). */
-        delete: (spaceId: string, cubeId: string) => Promise<{
-            success: boolean;
-        }>;
-        /** Power off a running Cube (asynchronous — power-off is enqueued). The Cube
-         *  becomes `stopped` (its host RAM is freed); start it again with `wake`. */
-        powerOff: (spaceId: string, cubeId: string) => Promise<unknown>;
-        /** Start a stopped Cube (asynchronous — start is enqueued). */
-        /**
-         * Restart a Cube (COLD restart).
-         *
-         * The hypervisor process is stopped and relaunched, so the Cube boots
-         * against the host's current kernel. This is the only way a Cube picks up a
-         * refreshed guest kernel after a platform image update — a `reboot` issued
-         * INSIDE the Cube cannot do it, because Firecracker treats a guest reboot as
-         * a shutdown and the kernel is supplied externally by the host.
-         *
-         * Disk state is preserved; only the kernel changes. The Cube must be
-         * `running`. Concurrent restarts of the same Cube are rejected (409) rather
-         * than queued twice.
-         */
-        restart: (spaceId: string, cubeId: string) => Promise<unknown>;
-        wake: (spaceId: string, cubeId: string) => Promise<unknown>;
-        /**
-         * Get a Cube's SSH connection info — host, port, login user, and (when
-         * available) the pinned host public keys for strict host-key verification.
-         */
-        ssh: (spaceId: string, cubeId: string) => Promise<CubeSshInfo>;
-        /**
-         * Restore a Cube's disk from one of its {@link Snapshot}s (asynchronous —
-         * the restore is enqueued). The Cube's current disk is replaced.
-         */
-        restore: (spaceId: string, cubeId: string, snapshotId: string) => Promise<{
-            success: boolean;
-        }>;
-    };
+    create: (spaceId: string, body: NonNullable<paths["/spaces/{spaceId}/cubes"]["post"]["requestBody"]>["content"]["application/json"], opts?: {
+      idempotencyKey?: string;
+    }) => Promise<Cube>;
+    /** Get a single Cube. Returns the {@link Cube}. */
+    get: (spaceId: string, cubeId: string) => Promise<Cube>;
     /**
-     * Resolve the {@link Space} this API key is scoped to — so you don't have to
-     * hardcode a `spaceId`. Handy right after constructing the client:
+     * Update the IN-CUBE port that SSH is forwarded to.
      *
-     * @example
-     * ```ts
-     * const space = await krova.getSpace();
-     * const cubes = await krova.cubes.list(space.id);
-     * ```
+     * `cubePort` is the port **inside** the Cube that sshd listens on — NOT the
+     * host port you connect to. The host port is allocated by Krova and is not
+     * changed by this call. Pointing this at a port nothing is listening on
+     * inside the Cube will silently make SSH unreachable; the default is 22.
+     *
+     * The Krova Cloud API exposes no general Cube-mutation endpoint; the only
+     * mutable Cube field over the API is this port, via
+     * `PUT /spaces/{spaceId}/cubes/{cubeId}/ssh-port`. This helper maps to that
+     * endpoint. (Compute resize / rename are not part of the public API.)
      */
-    getSpace(): Promise<Space>;
-    readonly domains: {
-        /** List the custom domains attached to a Cube. */
-        list: (spaceId: string, cubeId: string) => Promise<Domain[]>;
-        /**
-         * Attach a custom domain to a Cube. `domain` + `port` are required.
-         *
-         * Returns the domain AND the DNS records you must publish for it to work —
-         * so you can create them in the same run, without a second call and without
-         * hard-coding record shapes. A wildcard needs three; an exact host needs one.
-         *
-         * ⛔ BREAKING in 0.4.0: this used to resolve to `Domain`. It now resolves to
-         * `{ domain, records }`, because for a wildcard two of the three records
-         * (the ownership TXT and the `_acme-challenge` delegation) were not
-         * derivable from anything the SDK returned — an integration had to read
-         * them out of the docs and hope they still matched the server.
-         */
-        create: (spaceId: string, cubeId: string, body: CreateDomainInput) => Promise<{
-            domain: Domain;
-            records: DnsRecord[];
-        }>;
-        /**
-         * The DNS records a domain needs, each checked against live DNS.
-         *
-         * Poll this after publishing them: `summary.complete` turns true only once
-         * every record is `found`. Each call performs real DNS lookups and is rate
-         * limited, so poll on an interval rather than in a tight loop.
-         */
-        records: (spaceId: string, cubeId: string, mappingId: string) => Promise<{
-            domain: string;
-            isWildcard: boolean;
-            records: DnsRecordStatus[];
-            summary: {
-                found: number;
-                total: number;
-                complete: boolean;
-            };
-            checkedAt: string;
-        }>;
-        /** Update a domain's per-domain proxy settings. */
-        update: (spaceId: string, cubeId: string, mappingId: string, body: UpdateDomainInput) => Promise<Domain>;
-        /** Detach a custom domain from a Cube. */
-        delete: (spaceId: string, cubeId: string, mappingId: string) => Promise<{
-            success: boolean;
-        }>;
-    };
-    readonly snapshots: {
-        /** List a Cube's snapshots. */
-        list: (spaceId: string, cubeId: string) => Promise<Snapshot[]>;
-        /** Create a snapshot of a Cube's disk (asynchronous — enqueued). */
-        create: (spaceId: string, cubeId: string, body?: {
-            name?: string;
-        }) => Promise<Snapshot>;
-        /** Delete a snapshot. */
-        delete: (spaceId: string, cubeId: string, snapshotId: string) => Promise<{
-            success: boolean;
-        }>;
-    };
-    readonly tcpMappings: {
-        /** List a Cube's TCP port mappings. */
-        list: (spaceId: string, cubeId: string) => Promise<TcpMapping[]>;
-        /**
-         * Create a TCP port mapping exposing a Cube port on the host. `cubePort` is
-         * required; `whitelistIps` optionally restricts who can reach it.
-         */
-        create: (spaceId: string, cubeId: string, body: CreateTcpMappingInput) => Promise<TcpMapping>;
-        /** Delete a TCP port mapping. */
-        delete: (spaceId: string, cubeId: string, mappingId: string) => Promise<{
-            success: boolean;
-        }>;
-    };
-    readonly imports: {
-        /**
-         * Start importing a `.cube` archive into a new Cube. Returns the multipart
-         * upload target (`importId`, `uploadId`, presigned `parts`, …). Upload the
-         * archive to those URLs, then call {@link imports.complete}.
-         */
-        create: (spaceId: string, body: NonNullable<paths["/spaces/{spaceId}/cubes/imports"]["post"]["requestBody"]>["content"]["application/json"]) => Promise<{
-            importId?: string | undefined;
-            uploadId?: string | undefined;
-            key?: string | undefined;
-            chunkSizeBytes?: number | undefined;
-            parts?: {
-                partNumber?: number | undefined;
-                url?: string | undefined;
-            }[] | undefined;
-            expiresAt?: string | undefined;
-        } | undefined>;
-        /** Get an in-progress or completed import by id. */
-        get: (spaceId: string, importId: string) => Promise<{
-            import?: {
-                id?: string | undefined;
-                name?: string | undefined;
-                status?: "uploading" | "finalizing" | "provisioning" | "complete" | "failed" | "expired" | undefined;
-                cubeId?: string | null | undefined;
-                error?: string | null | undefined;
-                createdAt?: string | undefined;
-                updatedAt?: string | undefined;
-                completedAt?: string | null | undefined;
-            } | undefined;
-        }>;
-        /**
-         * Finish an import after the archive has been uploaded — provisions the
-         * Cube. Pass the uploaded `parts` (partNumber + etag) and the resolved
-         * `config`.
-         */
-        complete: (spaceId: string, importId: string, body: NonNullable<paths["/spaces/{spaceId}/cubes/imports/{importId}/complete"]["post"]["requestBody"]>["content"]["application/json"]) => Promise<{
-            importId?: string | undefined;
-            cubeId?: string | undefined;
-            status?: "provisioning" | undefined;
-        } | undefined>;
-        /** Cancel an in-progress import. */
-        cancel: (spaceId: string, importId: string) => Promise<{
-            success: boolean;
-        } | undefined>;
-    };
-    readonly backups: {
-        /** Get a time-limited download URL for a backup `.cube` archive. */
-        download: (spaceId: string, backupId: string) => Promise<{
-            url?: string | undefined;
-            filename?: string | undefined;
-            sizeBytes?: number | null | undefined;
-            expiresAt?: string | undefined;
-        } | undefined>;
-    };
-    readonly catalog: {
-        /** List regions with available capacity. */
-        regions: () => Promise<{
-            regions: {
-                id: string;
-                name: string;
-                slug: string;
-            }[];
-        }>;
-        /** List available OS images. */
-        images: () => Promise<{
-            images: {
-                id: string;
-                name: string;
-                version: string;
-                description: string;
-                defaultUser: string;
-            }[];
-        }>;
-        /** Per-resource hourly rates and volume pricing tiers. */
-        pricing: () => Promise<{
-            currency: string;
-            rates: {
-                vcpuPerHour: number;
-                ramGbPerHour: number;
-                diskGbPerHour: number;
-            };
-            tiers: {
-                minVcpus: number;
-                maxVcpus: number | null;
-                multiplier: number;
-                label: string;
-            }[];
-            note: string;
-        }>;
-    };
+    update: (spaceId: string, cubeId: string, body: NonNullable<paths["/spaces/{spaceId}/cubes/{cubeId}/ssh-port"]["put"]["requestBody"]>["content"]["application/json"]) => Promise<unknown>;
+    /** Delete a Cube (asynchronous — deletion is enqueued). */
+    delete: (spaceId: string, cubeId: string) => Promise<{
+      success: boolean;
+    }>;
+    /** Power off a running Cube (asynchronous — power-off is enqueued). The Cube
+     *  becomes `stopped` (its host RAM is freed); start it again with `wake`. */
+    powerOff: (spaceId: string, cubeId: string) => Promise<unknown>;
+    /** Start a stopped Cube (asynchronous — start is enqueued). */
+    /**
+     * Restart a Cube (COLD restart).
+     *
+     * The hypervisor process is stopped and relaunched, so the Cube boots
+     * against the host's current kernel. This is the only way a Cube picks up a
+     * refreshed guest kernel after a platform image update — a `reboot` issued
+     * INSIDE the Cube cannot do it, because Firecracker treats a guest reboot as
+     * a shutdown and the kernel is supplied externally by the host.
+     *
+     * Disk state is preserved; only the kernel changes. The Cube must be
+     * `running`. Concurrent restarts of the same Cube are rejected (409) rather
+     * than queued twice.
+     */
+    restart: (spaceId: string, cubeId: string) => Promise<unknown>;
+    wake: (spaceId: string, cubeId: string) => Promise<unknown>;
+    /**
+     * Get a Cube's SSH connection info — host, port, login user, and (when
+     * available) the pinned host public keys for strict host-key verification.
+     */
+    ssh: (spaceId: string, cubeId: string) => Promise<CubeSshInfo>;
+    /**
+     * Restore a Cube's disk from one of its {@link Snapshot}s (asynchronous —
+     * the restore is enqueued). The Cube's current disk is replaced.
+     */
+    restore: (spaceId: string, cubeId: string, snapshotId: string) => Promise<{
+      success: boolean;
+    }>;
+  };
+  /**
+   * Resolve the {@link Space} this API key is scoped to — so you don't have to
+   * hardcode a `spaceId`. Handy right after constructing the client:
+   *
+   * @example
+   * ```ts
+   * const space = await krova.getSpace();
+   * const cubes = await krova.cubes.list(space.id);
+   * ```
+   */
+  getSpace(): Promise<Space>;
+  readonly domains: {
+    /** List the custom domains attached to a Cube. */
+    list: (spaceId: string, cubeId: string) => Promise<Domain[]>;
+    /**
+     * Attach a custom domain to a Cube. `domain` + `port` are required.
+     *
+     * Returns the domain AND the DNS records you must publish for it to work —
+     * so you can create them in the same run, without a second call and without
+     * hard-coding record shapes. A wildcard needs three; an exact host needs one.
+     *
+     * ⛔ BREAKING in 0.4.0: this used to resolve to `Domain`. It now resolves to
+     * `{ domain, records }`, because for a wildcard two of the three records
+     * (the ownership TXT and the `_acme-challenge` delegation) were not
+     * derivable from anything the SDK returned — an integration had to read
+     * them out of the docs and hope they still matched the server.
+     */
+    create: (spaceId: string, cubeId: string, body: CreateDomainInput) => Promise<{
+      domain: Domain;
+      records: DnsRecord[];
+    }>;
+    /**
+     * The DNS records a domain needs, each checked against live DNS.
+     *
+     * Poll this after publishing them: `summary.complete` turns true only once
+     * every record is `found`. Each call performs real DNS lookups and is rate
+     * limited, so poll on an interval rather than in a tight loop.
+     */
+    records: (spaceId: string, cubeId: string, mappingId: string) => Promise<{
+      domain: string;
+      isWildcard: boolean;
+      records: DnsRecordStatus[];
+      summary: {
+        found: number;
+        total: number;
+        complete: boolean;
+      };
+      checkedAt: string;
+    }>;
+    /** Update a domain's per-domain proxy settings. */
+    update: (spaceId: string, cubeId: string, mappingId: string, body: UpdateDomainInput) => Promise<Domain>;
+    /** Detach a custom domain from a Cube. */
+    delete: (spaceId: string, cubeId: string, mappingId: string) => Promise<{
+      success: boolean;
+    }>;
+  };
+  readonly snapshots: {
+    /** List a Cube's snapshots. */
+    list: (spaceId: string, cubeId: string) => Promise<Snapshot[]>;
+    /** Create a snapshot of a Cube's disk (asynchronous — enqueued). */
+    create: (spaceId: string, cubeId: string, body?: {
+      name?: string;
+    }) => Promise<Snapshot>;
+    /** Delete a snapshot. */
+    delete: (spaceId: string, cubeId: string, snapshotId: string) => Promise<{
+      success: boolean;
+    }>;
+  };
+  readonly tcpMappings: {
+    /** List a Cube's TCP port mappings. */
+    list: (spaceId: string, cubeId: string) => Promise<TcpMapping[]>;
+    /**
+     * Create a TCP port mapping exposing a Cube port on the host. `cubePort` is
+     * required; `whitelistIps` optionally restricts who can reach it.
+     */
+    create: (spaceId: string, cubeId: string, body: CreateTcpMappingInput) => Promise<TcpMapping>;
+    /** Delete a TCP port mapping. */
+    delete: (spaceId: string, cubeId: string, mappingId: string) => Promise<{
+      success: boolean;
+    }>;
+  };
+  readonly imports: {
+    /**
+     * Start importing a `.cube` archive into a new Cube. Returns the multipart
+     * upload target (`importId`, `uploadId`, presigned `parts`, …). Upload the
+     * archive to those URLs, then call {@link imports.complete}.
+     */
+    create: (spaceId: string, body: NonNullable<paths["/spaces/{spaceId}/cubes/imports"]["post"]["requestBody"]>["content"]["application/json"]) => Promise<{
+      importId?: string;
+      uploadId?: string;
+      key?: string;
+      chunkSizeBytes?: number;
+      parts?: {
+        partNumber?: number;
+        url?: string;
+      }[] | undefined;
+      expiresAt?: string;
+    } | undefined>;
+    /** Get an in-progress or completed import by id. */
+    get: (spaceId: string, importId: string) => Promise<{
+      import?: {
+        id?: string;
+        name?: string;
+        status?: "uploading" | "finalizing" | "provisioning" | "complete" | "failed" | "expired";
+        cubeId?: string | null;
+        error?: string | null;
+        createdAt?: string;
+        updatedAt?: string;
+        completedAt?: string | null;
+      } | undefined;
+    }>;
+    /**
+     * Finish an import after the archive has been uploaded — provisions the
+     * Cube. Pass the uploaded `parts` (partNumber + etag) and the resolved
+     * `config`.
+     */
+    complete: (spaceId: string, importId: string, body: NonNullable<paths["/spaces/{spaceId}/cubes/imports/{importId}/complete"]["post"]["requestBody"]>["content"]["application/json"]) => Promise<{
+      importId?: string;
+      cubeId?: string;
+      status?: "provisioning";
+    } | undefined>;
+    /** Cancel an in-progress import. */
+    cancel: (spaceId: string, importId: string) => Promise<{
+      success: boolean;
+    } | undefined>;
+  };
+  readonly backups: {
+    /** Get a time-limited download URL for a backup `.cube` archive. */
+    download: (spaceId: string, backupId: string) => Promise<{
+      url?: string;
+      filename?: string;
+      sizeBytes?: number | null;
+      expiresAt?: string;
+    } | undefined>;
+  };
+  readonly catalog: {
+    /** List regions with available capacity. */
+    regions: () => Promise<{
+      regions: {
+        id: string;
+        name: string;
+        slug: string;
+      }[];
+    }>;
+    /** List available OS images. */
+    images: () => Promise<{
+      images: {
+        id: string;
+        name: string;
+        version: string;
+        description: string;
+        defaultUser: string;
+      }[];
+    }>;
+    /** Per-resource hourly rates and volume pricing tiers. */
+    pricing: () => Promise<{
+      currency: string;
+      rates: {
+        vcpuPerHour: number;
+        ramGbPerHour: number;
+        diskGbPerHour: number;
+      };
+      tiers: {
+        minVcpus: number;
+        maxVcpus: number | null;
+        multiplier: number;
+        label: string;
+      }[];
+      note: string;
+    }>;
+  };
 }
-
+//#endregion
+//#region src/error.d.ts
 /**
  * The error body shape returned by the Krova Cloud API.
  *
@@ -2412,8 +2414,8 @@ declare class KrovaClient {
  * we keep the type open.
  */
 interface KrovaErrorBody {
-    error?: string;
-    [key: string]: unknown;
+  error?: string;
+  [key: string]: unknown;
 }
 /**
  * Error thrown by the ergonomic {@link KrovaClient} helpers when the API
@@ -2424,34 +2426,35 @@ interface KrovaErrorBody {
  * so callers can `try/catch`.
  */
 declare class KrovaError extends Error {
-    /** HTTP status code of the failing response. */
-    readonly status: number;
-    /**
-     * A machine-readable error code, when the API surfaces one via the
-     * `X-Error-Code` response header. The documented error body only carries a
-     * human-readable `error` string, so this is best-effort.
-     */
-    readonly code?: string;
-    /**
-     * The request id from the `X-Request-Id` response header, when present.
-     * Useful when contacting Krova Cloud support about a specific failure.
-     */
-    readonly requestId?: string;
-    /** The parsed JSON error body, when the response had one. */
-    readonly body?: KrovaErrorBody;
-    /** The raw `Response` object, for callers that need headers/url/etc. */
-    readonly response?: Response;
-    constructor(message: string, init: {
-        status: number;
-        code?: string;
-        requestId?: string;
-        body?: KrovaErrorBody;
-        response?: Response;
-    });
+  /** HTTP status code of the failing response. */
+  readonly status: number;
+  /**
+   * A machine-readable error code, when the API surfaces one via the
+   * `X-Error-Code` response header. The documented error body only carries a
+   * human-readable `error` string, so this is best-effort.
+   */
+  readonly code?: string;
+  /**
+   * The request id from the `X-Request-Id` response header, when present.
+   * Useful when contacting Krova Cloud support about a specific failure.
+   */
+  readonly requestId?: string;
+  /** The parsed JSON error body, when the response had one. */
+  readonly body?: KrovaErrorBody;
+  /** The raw `Response` object, for callers that need headers/url/etc. */
+  readonly response?: Response;
+  constructor(message: string, init: {
+    status: number;
+    code?: string;
+    requestId?: string;
+    body?: KrovaErrorBody;
+    response?: Response;
+  });
 }
 /**
  * Build a {@link KrovaError} from a failing response + parsed error body.
  */
 declare function krovaErrorFrom(response: Response, body: KrovaErrorBody | undefined): KrovaError;
-
+//#endregion
 export { type AuthScheme, type CreateDomainInput, type CreateTcpMappingInput, type Cube, type CubeSshInfo, DEFAULT_BASE_URL, type Domain, type Image, KrovaClient, type KrovaClientOptions, KrovaError, type KrovaErrorBody, type Pagination, type PricingTier, type Region, type Snapshot, type Space, type TcpMapping, type UpdateDomainInput, type components, krovaErrorFrom, type paths };
+//# sourceMappingURL=index.d.cts.map