@miosa/sdk 0.3.0

package/dist/index.d.ts

@@ -0,0 +1,4689 @@
+import * as ws from 'ws';
+import EventEmitter from 'node:events';
+
+interface RequestOptions {
+    method?: string;
+    headers?: Record<string, string>;
+    body?: unknown;
+    timeout?: number;
+    /** Return raw Response instead of parsing JSON */
+    rawResponse?: boolean;
+    /** Send body as multipart/form-data */
+    formData?: FormData;
+    /** Expected response is binary */
+    binary?: boolean;
+}
+interface HttpClientConfig {
+    baseUrl: string;
+    apiKey: string;
+    timeout: number;
+    maxRetries: number;
+}
+declare class HttpClient {
+    /** Public for WebSocket clients that need to derive their own URL. */
+    readonly baseUrl: string;
+    /** Public for WebSocket clients that need to send the same auth. */
+    readonly apiKey: string;
+    private readonly timeout;
+    private readonly maxRetries;
+    constructor(config: HttpClientConfig);
+    private buildUrl;
+    private baseHeaders;
+    request<T>(path: string, options?: RequestOptions): Promise<T>;
+    get<T>(path: string, query?: Record<string, string | number | boolean | undefined>): Promise<T>;
+    post<T>(path: string, body?: unknown): Promise<T>;
+    patch<T>(path: string, body?: unknown): Promise<T>;
+    put<T>(path: string, body?: unknown): Promise<T>;
+    delete<T>(path: string, body?: unknown): Promise<T>;
+    getBinary(path: string): Promise<Uint8Array>;
+    postFormData<T>(path: string, formData: FormData): Promise<T>;
+    /**
+     * Open a Server-Sent Events stream. Returns an AsyncIterableIterator of
+     * parsed event data objects. The caller is responsible for breaking the loop.
+     */
+    stream<T>(path: string, options?: RequestOptions): AsyncIterableIterator<T>;
+}
+
+type Json = Record<string, unknown>;
+type Query = Record<string, string | number | boolean | undefined>;
+interface ListAdminUsersParams {
+    limit?: number;
+    cursor?: string;
+    q?: string;
+    status?: "active" | "suspended" | "deleted";
+}
+interface ListAdminTenantsParams {
+    limit?: number;
+    cursor?: string;
+    q?: string;
+}
+interface ListAdminComputersParams {
+    limit?: number;
+    cursor?: string;
+    status?: "creating" | "provisioning" | "running" | "stopped" | "paused" | "error";
+    tenantId?: string;
+}
+interface ListAdminApiKeysParams {
+    limit?: number;
+    cursor?: string;
+    tenantId?: string;
+    status?: "active" | "revoked" | "expired";
+}
+interface CreateAdminApiKeyParams {
+    name: string;
+    tenantId: string;
+    userId: string;
+    keyType?: "user" | "admin" | "platform";
+    purpose?: "api" | "optimal";
+    rateLimitRpm?: number;
+    expiresAt?: string;
+    allowedIps?: string[];
+}
+interface BulkUserActionParams {
+    userIds: string[];
+    action: "suspend" | "unsuspend" | "delete" | "tag" | "notify";
+    params?: Json;
+}
+/**
+ * Admin surface — `/api/v1/admin/*` endpoints.
+ *
+ * Requires a `msk_a_*` or `msk_p_*` API key, or an admin JWT. Calls from
+ * a user-role credential return 403 Forbidden.
+ */
+declare class Admin {
+    private readonly http;
+    constructor(http: HttpClient);
+    /** Escape hatch — call any admin endpoint by method + path. */
+    request<T = Json>(method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE", path: string, body?: unknown, query?: Query): Promise<T>;
+    dashboard(): Promise<Json>;
+    stats(): Promise<Json>;
+    auditLog(params?: {
+        limit?: number;
+        cursor?: string;
+    }): Promise<Json>;
+    detailedHealth(): Promise<Json>;
+    grantCredits(params: {
+        tenantId: string;
+        amount: number;
+        description: string;
+        expiresAt?: string;
+    }): Promise<Json>;
+    deductCredits(params: {
+        tenantId: string;
+        amount: number;
+        description: string;
+    }): Promise<Json>;
+    refundCredits(params: {
+        tenantId: string;
+        amount: number;
+        description: string;
+        transactionId?: string;
+    }): Promise<Json>;
+    tenantBalance(tenantId: string): Promise<Json>;
+    tenantCreditHistory(tenantId: string, params?: {
+        limit?: number;
+        cursor?: string;
+    }): Promise<Json>;
+    listUsers(params?: ListAdminUsersParams): Promise<Json>;
+    getUser(userId: string): Promise<Json>;
+    updateUser(userId: string, attrs: Json): Promise<Json>;
+    deleteUser(userId: string): Promise<Json>;
+    changeUserRole(userId: string, role: "user" | "admin" | "owner" | "super_admin"): Promise<Json>;
+    forceLogout(userId: string): Promise<Json>;
+    suspendUser(userId: string, reason?: string): Promise<Json>;
+    unsuspendUser(userId: string): Promise<Json>;
+    banUser(userId: string, reason: string, expiresAt?: string): Promise<Json>;
+    unbanUser(userId: string): Promise<Json>;
+    bulkUserAction(params: BulkUserActionParams): Promise<Json>;
+    listTenants(params?: ListAdminTenantsParams): Promise<Json>;
+    tenantDetail(tenantId: string): Promise<Json>;
+    suspendTenant(tenantId: string, reason?: string): Promise<Json>;
+    unsuspendTenant(tenantId: string): Promise<Json>;
+    changeTenantPlan(tenantId: string, plan: "free" | "starter" | "pro" | "scale", prorate?: boolean): Promise<Json>;
+    deleteTenant(tenantId: string): Promise<Json>;
+    listComputers(params?: ListAdminComputersParams): Promise<Json>;
+    deleteComputer(computerId: string): Promise<Json>;
+    suspendComputer(computerId: string): Promise<Json>;
+    resumeComputer(computerId: string): Promise<Json>;
+    restartComputer(computerId: string): Promise<Json>;
+    purgeStaleComputers(): Promise<Json>;
+    listApiKeys(params?: ListAdminApiKeysParams): Promise<Json>;
+    createApiKey(params: CreateAdminApiKeyParams): Promise<Json>;
+    apiKeyStats(): Promise<Json>;
+    bulkRevokeApiKeys(keyIds: string[]): Promise<Json>;
+    revokeApiKey(keyId: string): Promise<Json>;
+    optimalStatus(): Promise<Json>;
+    listOptimalModels(): Promise<Json>;
+    switchOptimalModel(modelId: string): Promise<Json>;
+}
+
+/**
+ * Analytics — overview + timeseries (admin scope).
+ */
+
+interface AnalyticsFilters {
+    [key: string]: string | number | boolean | undefined;
+}
+interface TimeseriesParams extends AnalyticsFilters {
+    metric?: string;
+    period?: string;
+}
+declare class Analytics {
+    private readonly http;
+    constructor(http: HttpClient);
+    /** Get the platform analytics overview. */
+    overview(filters?: AnalyticsFilters): Promise<Record<string, unknown>>;
+    /** Get a timeseries for a metric over a period. */
+    timeseries(params?: TimeseriesParams): Promise<Record<string, unknown>>;
+}
+
+/**
+ * ApiKeys resource — programmatic API key management.
+ *
+ * The plaintext key is returned ONLY at create time. Store it immediately;
+ * the server only keeps a hash.
+ */
+
+type ApiKeyId = string & {
+    readonly __brand: "ApiKeyId";
+};
+interface ApiKeyData {
+    id: ApiKeyId;
+    tenant_id: string;
+    name: string;
+    prefix?: string;
+    scopes?: string[];
+    expires_at?: string | null;
+    last_used_at?: string | null;
+    created_at?: string;
+    [key: string]: unknown;
+}
+interface ApiKeyCreateResult extends ApiKeyData {
+    /** One-time plaintext key. Store immediately. */
+    token?: string;
+    key?: string;
+}
+interface ApiKeyListParams {
+    limit?: number;
+    cursor?: string;
+    [key: string]: string | number | boolean | undefined;
+}
+interface ApiKeyCreateParams {
+    name: string;
+    scopes?: string[];
+    expires_at?: string;
+    expiresAt?: string;
+    idempotencyKey?: string;
+    [key: string]: unknown;
+}
+declare class ApiKeys {
+    private readonly http;
+    constructor(http: HttpClient);
+    list(params?: ApiKeyListParams): Promise<ApiKeyData[]>;
+    create(params: ApiKeyCreateParams): Promise<ApiKeyCreateResult>;
+    delete(keyId: string): Promise<void>;
+}
+
+/**
+ * Audit log — admin-scoped event history.
+ */
+
+interface AuditLogEvent {
+    id?: string;
+    action?: string;
+    actor_id?: string;
+    resource_type?: string;
+    resource_id?: string;
+    metadata?: Record<string, unknown>;
+    inserted_at?: string;
+    [key: string]: unknown;
+}
+interface AuditLogListParams {
+    action?: string;
+    actor_id?: string;
+    resource_type?: string;
+    limit?: number;
+    cursor?: string;
+    [key: string]: string | number | boolean | undefined;
+}
+declare class AuditLog {
+    private readonly http;
+    constructor(http: HttpClient);
+    /** List audit-log events with optional filters. */
+    list(params?: AuditLogListParams): Promise<AuditLogEvent[]>;
+}
+
+/**
+ * Benchmarks — admin-triggered platform benchmark runs.
+ *
+ * Routes: /admin/benchmarks/*
+ * Requires admin credential (msk_a_* / msk_p_* or admin JWT).
+ * Available kinds: cold_boot, fleet_routing, concurrent_create, full_e2e.
+ */
+
+interface BenchmarkCreateParams {
+    kind: string;
+    [key: string]: unknown;
+}
+interface BenchmarkCompareParams {
+    left_id: string;
+    right_id: string;
+    [key: string]: unknown;
+}
+declare class Benchmarks {
+    private readonly http;
+    constructor(http: HttpClient);
+    list(filters?: Record<string, string | number | boolean | undefined>): Promise<Record<string, unknown>[]>;
+    get(benchmarkId: string): Promise<Record<string, unknown>>;
+    /** Start a new benchmark run — pass kind and run-specific options. */
+    create(params: BenchmarkCreateParams): Promise<Record<string, unknown>>;
+    cancel(benchmarkId: string): Promise<Record<string, unknown>>;
+    /** Return per-iteration timing samples for a benchmark run. */
+    samples(benchmarkId: string, filters?: Record<string, string | number | boolean | undefined>): Promise<Record<string, unknown>[]>;
+    /** Compare two benchmark runs. */
+    compare(params: BenchmarkCompareParams): Promise<Record<string, unknown>>;
+}
+
+/**
+ * BuilderSessions — durable, cross-device Builder UI state.
+ *
+ * Routes: /builder/sessions/*
+ * Accepts msk_* API keys or JWT.
+ * Sessions are optimal_sessions with resource_type="sandbox".
+ */
+
+interface BuilderSessionListParams {
+    limit?: number;
+    [key: string]: string | number | boolean | undefined;
+}
+declare class BuilderSessions {
+    private readonly http;
+    constructor(http: HttpClient);
+    list(params?: BuilderSessionListParams): Promise<Record<string, unknown>[]>;
+    /**
+     * Get a single session. The platform router only exposes index +
+     * title-update + delete, so this filters list() client-side.
+     */
+    get(sessionId: string): Promise<Record<string, unknown>>;
+    updateTitle(sessionId: string, title: string): Promise<Record<string, unknown>>;
+    delete(sessionId: string): Promise<void>;
+}
+
+/**
+ * Channels — notification preferences + per-channel enable/disable.
+ */
+
+interface ChannelData {
+    id?: string;
+    type?: string;
+    name?: string;
+    enabled?: boolean;
+    config?: Record<string, unknown>;
+    [key: string]: unknown;
+}
+interface ChannelListParams {
+    type?: string;
+    enabled?: boolean;
+    [key: string]: string | number | boolean | undefined;
+}
+interface ChannelCreateParams {
+    type: string;
+    name?: string;
+    config?: Record<string, unknown>;
+    [key: string]: unknown;
+}
+interface ChannelUpdateParams {
+    name?: string;
+    config?: Record<string, unknown>;
+    [key: string]: unknown;
+}
+interface NotificationPrefsUpdateParams {
+    [key: string]: unknown;
+}
+declare class Channels {
+    private readonly http;
+    constructor(http: HttpClient);
+    /** List all channels for the tenant. */
+    list(params?: ChannelListParams): Promise<ChannelData[]>;
+    /** Get a single channel. */
+    get(channelId: string): Promise<ChannelData>;
+    /** Create a new channel. */
+    create(params: ChannelCreateParams): Promise<ChannelData>;
+    /** Update a channel. */
+    update(channelId: string, params: ChannelUpdateParams): Promise<ChannelData>;
+    /** Delete a channel. */
+    delete(channelId: string): Promise<void>;
+    /** Get notification preferences across all channels. */
+    listNotifications(): Promise<Record<string, unknown>>;
+    /** Update notification preferences. */
+    updateNotifications(params: NotificationPrefsUpdateParams): Promise<Record<string, unknown>>;
+    /** Enable a channel. */
+    enable(channelId: string): Promise<ChannelData>;
+    /** Disable a channel. */
+    disable(channelId: string): Promise<ChannelData>;
+}
+
+/**
+ * CommandCenter — agent fleet, orchestrations, metrics.
+ *
+ * Routes: /command-center/*
+ * Requires JWT or msk_u_* API key.
+ */
+
+declare class CommandCenter {
+    private readonly http;
+    constructor(http: HttpClient);
+    /** Top-level snapshot (GET /command-center). */
+    overview(): Promise<Record<string, unknown>>;
+    agents(): Promise<Record<string, unknown>[]>;
+    runningAgents(): Promise<Record<string, unknown>[]>;
+    metrics(): Promise<Record<string, unknown>>;
+    presets(): Promise<Record<string, unknown>[]>;
+    tiers(): Promise<Record<string, unknown>>;
+    /** Stream live command-center events via SSE. */
+    events(): AsyncIterableIterator<Record<string, unknown>>;
+}
+
+/**
+ * Community — public template + agent catalog with install + rate.
+ *
+ * Routes: /community/*
+ * Requires JWT.
+ */
+
+declare class Community {
+    private readonly http;
+    constructor(http: HttpClient);
+    listAgents(filters?: Record<string, string | number | boolean | undefined>): Promise<Record<string, unknown>[]>;
+    getAgent(agentId: string): Promise<Record<string, unknown>>;
+    listTemplates(filters?: Record<string, string | number | boolean | undefined>): Promise<Record<string, unknown>[]>;
+    getTemplate(templateId: string): Promise<Record<string, unknown>>;
+    /** Install a community template into the caller's tenant. */
+    installTemplate(templateId: string, opts?: Record<string, unknown>): Promise<Record<string, unknown>>;
+    /** Rate a community template (1–5). */
+    rateTemplate(templateId: string, rating: number, opts?: Record<string, unknown>): Promise<Record<string, unknown>>;
+}
+
+/**
+ * Completions — OpenAI-compatible chat / text completion endpoints.
+ *
+ * Routes: POST /intelligence/completions, POST /intelligence/chat/completions
+ * Requires an mki_* intelligence key. Supports stream=true via SSE.
+ */
+
+interface CompletionBase {
+    model: string;
+    prompt?: string | string[];
+    [key: string]: unknown;
+}
+interface CompletionCreateParams extends CompletionBase {
+    stream?: false;
+}
+interface CompletionCreateStreamParams extends CompletionBase {
+    stream: true;
+}
+interface ChatBase {
+    model: string;
+    messages: Record<string, unknown>[];
+    [key: string]: unknown;
+}
+interface ChatCompletionCreateParams extends ChatBase {
+    stream?: false;
+}
+interface ChatCompletionCreateStreamParams extends ChatBase {
+    stream: true;
+}
+declare class Completions {
+    private readonly http;
+    constructor(http: HttpClient);
+    /** Create a text completion (POST /intelligence/completions). */
+    create(params: CompletionCreateParams): Promise<Record<string, unknown>>;
+    create(params: CompletionCreateStreamParams): AsyncIterableIterator<Record<string, unknown>>;
+    /** Create a chat completion (POST /intelligence/chat/completions). */
+    chat(params: ChatCompletionCreateParams): Promise<Record<string, unknown>>;
+    chat(params: ChatCompletionCreateStreamParams): AsyncIterableIterator<Record<string, unknown>>;
+}
+
+/** Producer names that can be subscribed to. */
+type EventProducer = "window" | "clipboard" | "file" | "process" | "idle";
+/** Options for `Events.subscribe()`. */
+interface EventSubscribeOptions {
+    /** At least one producer is required. */
+    subscribe: EventProducer[];
+    /** Paths to watch for the `file` producer. Defaults to `["/home/user"]`. */
+    paths?: string[];
+    /** Idle threshold in seconds for the `idle` producer. Defaults to 30. */
+    idleThresholdSec?: number;
+}
+interface WindowFocusChangedPayload {
+    window_id: string;
+    pid: string;
+    title: string;
+}
+interface WindowOpenedPayload {
+    window_id: string;
+    pid: string;
+    title: string;
+}
+interface WindowClosedPayload {
+    window_id: string;
+    pid: string;
+    title: string;
+}
+interface ClipboardChangedPayload {
+    size_bytes: number;
+}
+interface FileCreatedPayload {
+    path: string;
+}
+interface FileModifiedPayload {
+    path: string;
+}
+interface FileDeletedPayload {
+    path: string;
+}
+interface ProcessStartedPayload {
+    pid: number;
+    cmd: string;
+    ppid: string;
+}
+interface ProcessStoppedPayload {
+    pid: number;
+    cmd: string;
+}
+interface IdleInactivePayload {
+    idle_ms: number;
+}
+interface IdleActivePayload {
+    idle_ms: number;
+}
+interface ProducerUnavailablePayload {
+    producer: EventProducer;
+    reason: string;
+}
+/** Union of all typed event envelopes. */
+type ComputerEvent = {
+    type: "window.focus_changed";
+    timestamp: string;
+    payload: WindowFocusChangedPayload;
+} | {
+    type: "window.opened";
+    timestamp: string;
+    payload: WindowOpenedPayload;
+} | {
+    type: "window.closed";
+    timestamp: string;
+    payload: WindowClosedPayload;
+} | {
+    type: "clipboard.changed";
+    timestamp: string;
+    payload: ClipboardChangedPayload;
+} | {
+    type: "file.created";
+    timestamp: string;
+    payload: FileCreatedPayload;
+} | {
+    type: "file.modified";
+    timestamp: string;
+    payload: FileModifiedPayload;
+} | {
+    type: "file.deleted";
+    timestamp: string;
+    payload: FileDeletedPayload;
+} | {
+    type: "process.started";
+    timestamp: string;
+    payload: ProcessStartedPayload;
+} | {
+    type: "process.stopped";
+    timestamp: string;
+    payload: ProcessStoppedPayload;
+} | {
+    type: "idle.inactive";
+    timestamp: string;
+    payload: IdleInactivePayload;
+} | {
+    type: "idle.active";
+    timestamp: string;
+    payload: IdleActivePayload;
+} | {
+    type: "producer.unavailable";
+    timestamp: string;
+    payload: ProducerUnavailablePayload;
+};
+type EventMap = {
+    [K in ComputerEvent["type"]]: [
+        Extract<ComputerEvent, {
+            type: K;
+        }>["payload"]
+    ];
+} & {
+    error: [Error];
+    close: [{
+        code: number;
+        reason: string;
+    }];
+};
+/**
+ * Typed event stream returned by `computer.events.subscribe()`.
+ *
+ * ```ts
+ * const stream = computer.events.subscribe({ subscribe: ["file", "process"] });
+ * stream.on("file.created", e => console.log("created:", e.path));
+ * stream.on("process.started", e => console.log("pid:", e.pid));
+ * stream.on("error", err => console.error(err));
+ * await stream.close();
+ * ```
+ */
+declare class EventStream extends EventEmitter<EventMap> {
+    private ws;
+    private closed;
+    /** @internal — use `Events.subscribe()` instead. */
+    constructor(ws: WebSocket | ws.WebSocket);
+    private attachHandlers;
+    /** Close the event stream. Idempotent. */
+    close(): Promise<void>;
+    /** Whether the stream has been closed (by client or server). */
+    get isClosed(): boolean;
+}
+/**
+ * Events resource attached to every `Computer` instance.
+ * Exposes `subscribe()` for real-time in-VM event streaming.
+ */
+declare class Events {
+    private readonly baseUrl;
+    private readonly apiKey;
+    private readonly computerId;
+    constructor(baseUrl: string, apiKey: string, computerId: string);
+    /**
+     * Open a WebSocket subscription for the specified producers.
+     *
+     * ```ts
+     * const stream = computer.events.subscribe({
+     *   subscribe: ["window", "clipboard", "file"],
+     *   paths: ["/home/user", "/workspace"],
+     * });
+     * stream.on("window.focus_changed", e => ...);
+     * stream.on("file.created", e => ...);
+     * stream.on("error", err => ...);
+     * await stream.close();
+     * ```
+     */
+    subscribe(options: EventSubscribeOptions): EventStream;
+    private buildWsUrl;
+}
+
+type CustomDomainStatus = "pending" | "verified" | "active" | "failed" | "removed";
+interface CustomDomainData$1 {
+    id: string;
+    computer_id: string;
+    tenant_id: string;
+    fqdn: string;
+    status: CustomDomainStatus;
+    /** The CNAME target the user must point their DNS record at. */
+    verification_target: string;
+    /** Human-readable DNS setup instructions. */
+    instructions: string;
+    verified_at: string | null;
+    tls_issued_at: string | null;
+    created_at: string;
+    updated_at: string;
+}
+/**
+ * Custom domain management for a Computer.
+ *
+ * Accessed via `computer.domains`.
+ *
+ * ## Workflow
+ * ```ts
+ * // 1. Register the domain
+ * const domain = await computer.domains.register("app.example.com");
+ * console.log(domain.instructions);
+ * // => "Add a CNAME record: app.example.com → <slug>.sandbox.miosa.ai"
+ *
+ * // 2. Add the CNAME in your DNS registrar, then...
+ *
+ * // 3. Verify ownership
+ * const verified = await computer.domains.verify(domain.id);
+ * // Caddy auto-issues a TLS certificate after this point.
+ * ```
+ */
+declare class CustomDomains {
+    private readonly http;
+    private readonly computerId;
+    constructor(http: HttpClient, computerId: string);
+    private base;
+    /**
+     * Register a custom FQDN for this computer.
+     *
+     * Returns the domain record with `verification_target` and `instructions`
+     * showing which CNAME record to add. The domain starts in `pending` status.
+     *
+     * @param fqdn - The fully-qualified domain name to register
+     *   (e.g. `"app.example.com"`). Must be lowercase RFC 1123, ≤ 253 chars,
+     *   and must NOT end with `miosa.ai`.
+     */
+    register(fqdn: string): Promise<CustomDomainData$1>;
+    /**
+     * List all custom domains registered for this computer.
+     */
+    list(): Promise<CustomDomainData$1[]>;
+    /**
+     * Verify DNS ownership of a registered domain.
+     *
+     * The control plane resolves the domain's CNAME and confirms it points to
+     * the expected `verification_target`. On success the domain transitions to
+     * `verified` status and Caddy will auto-issue a TLS certificate on the next
+     * inbound request.
+     *
+     * @param id - The custom domain record id (from `register()` or `list()`).
+     * @throws `ApiError` with code `CNAME_MISMATCH` if the CNAME doesn't match.
+     * @throws `ApiError` with code `DNS_LOOKUP_FAILED` if DNS is unreachable.
+     */
+    verify(id: string): Promise<CustomDomainData$1>;
+    /**
+     * Delete a custom domain mapping.
+     *
+     * The domain is immediately removed from the routing cache and Caddy will
+     * stop serving it on the next cert renewal cycle.
+     *
+     * @param id - The custom domain record id.
+     */
+    delete(id: string): Promise<void>;
+}
+
+type ComputerId = string & {
+    readonly __brand: "ComputerId";
+};
+type SessionId = string & {
+    readonly __brand: "SessionId";
+};
+type TenantId = string & {
+    readonly __brand: "TenantId";
+};
+type ComputerSize = "small" | "medium" | "large";
+/**
+ * Lifecycle states emitted by the control plane.
+ *
+ * Canonical states (what the server actually emits):
+ *   provisioning  — VM is being created + booted (~30-50s on small tier)
+ *   active        — running and reachable (same as legacy "running")
+ *   paused        — RAM snapshot on disk, cold start available
+ *   stopped       — explicitly halted
+ *   error         — terminal failure; destroy and retry
+ *   destroyed     — terminal; gone
+ *
+ * Legacy aliases (`running`, `starting`, `creating`, `stopping`) are kept
+ * in the union so older callers still typecheck, but the server will emit
+ * the canonical names. Treat `active` and `running` as synonymous.
+ */
+type ComputerStatus = "provisioning" | "active" | "paused" | "stopped" | "error" | "destroyed" | "creating" | "starting" | "running" | "stopping";
+/**
+ * Template slug for the rootfs a computer boots into.
+ *
+ * - `miosa-desktop` — full KasmVNC + Xfce GUI (default)
+ * - `miosa-sandbox` — lightweight code-exec rootfs, no desktop
+ *
+ * Additional templates can be added at the platform level; the type is kept
+ * open so future templates don't require an SDK release.
+ */
+type ComputerTemplateType = "miosa-desktop" | "miosa-sandbox" | (string & {});
+/**
+ * Controls who can access the computer's HTTP preview URL.
+ *
+ * - `public`  — unauthenticated access to preview paths (default)
+ * - `tenant`  — requires a valid JWT with matching tenant_id
+ * - `key`     — requires a Bearer `msk_u_*` key matching the owner tenant
+ *
+ * Sensitive paths (`/api/*`, `/vnc/*`, `/term/*`) are always auth-gated
+ * regardless of visibility mode.
+ */
+type ComputerVisibility = "public" | "tenant" | "key";
+interface ComputerCreateParams {
+    name: string;
+    template_type?: ComputerTemplateType;
+    size?: ComputerSize;
+    visibility?: ComputerVisibility;
+    metadata?: Record<string, string>;
+}
+interface ComputerUpdateParams {
+    name?: string;
+    visibility?: ComputerVisibility;
+    metadata?: Record<string, string>;
+}
+interface ComputerData {
+    id: ComputerId;
+    name: string;
+    /**
+     * URL-safe identifier used in preview URLs: `https://{port}-{slug}.sandbox.miosa.ai`.
+     * Falls back to the computer id when no slug is assigned.
+     */
+    slug: string;
+    status: ComputerStatus;
+    template_type: ComputerTemplateType;
+    size: ComputerSize;
+    tenant_id: TenantId;
+    ip_address: string | null;
+    metadata: Record<string, string>;
+    /** Controls who can access the HTTP preview URL. Defaults to `"public"`. */
+    visibility: ComputerVisibility;
+    /** Public ingress root, e.g. `https://<slug>.sandbox.miosa.ai`. */
+    sandbox_url?: string;
+    /** KasmVNC URL for desktop templates. */
+    desktop_url?: string;
+    created_at: string;
+    updated_at: string;
+}
+type NetworkPolicyEffect = "allow" | "deny";
+type NetworkPolicyProtocol = "tcp" | "udp" | "any";
+/**
+ * A single egress rule.
+ *
+ * - `effect`      — `"allow"` or `"deny"`
+ * - `destination` — CIDR (`"10.0.0.0/8"`), IP, domain (`"example.com"`),
+ *                   wildcard (`"*.example.com"`), or `"any"`
+ * - `ports`       — optional: `"80"`, `"80,443"`, `"8000-9000"` (omit = all ports)
+ * - `protocol`    — `"tcp"` | `"udp"` | `"any"` (default `"any"`)
+ */
+interface NetworkPolicyRule {
+    effect: NetworkPolicyEffect;
+    destination: string;
+    ports?: string;
+    protocol?: NetworkPolicyProtocol;
+}
+interface NetworkPolicySetParams {
+    /** Rules evaluated top-to-bottom. */
+    rules: NetworkPolicyRule[];
+    /**
+     * Verdict when no rule matches.
+     * `"allow"` = allowlist entries, deny everything else.
+     * `"deny"`  = blocklist entries, allow everything else (default).
+     */
+    default_effect?: NetworkPolicyEffect;
+}
+interface NetworkPolicyData {
+    computer_id: ComputerId;
+    tenant_id: TenantId;
+    rules: NetworkPolicyRule[];
+    default_effect: NetworkPolicyEffect;
+    inserted_at?: string;
+    updated_at?: string;
+}
+interface ComputerListResponse {
+    data: ComputerData[];
+    meta: {
+        total: number;
+        page: number;
+        per_page: number;
+    };
+}
+interface ComputerListParams {
+    page?: number;
+    per_page?: number;
+    status?: ComputerStatus;
+}
+type MouseButton = "left" | "right" | "middle";
+type ScrollDirection = "up" | "down" | "left" | "right";
+interface ClickParams {
+    x: number;
+    y: number;
+    button?: MouseButton;
+}
+interface DoubleClickParams {
+    x: number;
+    y: number;
+}
+interface TypeParams {
+    text: string;
+    delay?: number;
+}
+interface KeyParams {
+    key: string;
+}
+interface ScrollParams {
+    x?: number;
+    y?: number;
+    direction: ScrollDirection;
+    clicks?: number;
+}
+interface DragParams {
+    from_x: number;
+    from_y: number;
+    to_x: number;
+    to_y: number;
+}
+interface WaitParams {
+    seconds: number;
+}
+interface WindowInfo {
+    id: string;
+    title: string;
+    x: number;
+    y: number;
+    width: number;
+    height: number;
+    is_focused: boolean;
+}
+interface CursorInfo {
+    x: number;
+    y: number;
+}
+interface WindowFocusParams {
+    window_id: string;
+}
+interface LaunchParams {
+    app_name: string;
+}
+interface DesktopActionResult {
+    success: boolean;
+}
+interface ExecParams {
+    command: string;
+    timeout?: number;
+}
+interface ExecPythonParams {
+    code: string;
+    timeout?: number;
+}
+/**
+ * Result of `exec.bash()` / `exec.python()`.
+ *
+ * The server returns stdout and stderr separately (what every other
+ * runtime does too) — the older `{output, success}` shape was never
+ * actually emitted. `output` is kept as a read-only alias of `stdout`
+ * for backwards compatibility; new code should use `stdout` + `stderr`.
+ */
+interface ExecResult {
+    /** Standard output from the command. */
+    stdout: string;
+    /** Standard error from the command. Empty string when no error output. */
+    stderr: string;
+    /** Process exit code. 0 = success. */
+    exit_code: number;
+    /** @deprecated alias for `stdout`; prefer `stdout` in new code. */
+    output?: string;
+    /** @deprecated derive from `exit_code === 0` in new code. */
+    success?: boolean;
+}
+interface FileEntry {
+    name: string;
+    path: string;
+    size: number;
+    is_dir: boolean;
+    modified_at: string;
+}
+interface FileListParams {
+    path: string;
+}
+interface FileDownloadParams {
+    path: string;
+}
+interface FileDeleteParams {
+    path: string;
+}
+interface FileExportParams {
+    path: string;
+}
+interface FileExportResult {
+    url: string;
+    expires_at: string;
+}
+interface FileListResult {
+    entries: FileEntry[];
+    path: string;
+}
+interface FileStat {
+    path: string;
+    /** File size in bytes. */
+    size: number;
+    /** Unix mode bits (e.g. 0o100644 for a regular file with rw-r--r--). */
+    mode: number;
+    is_dir: boolean;
+    is_symlink: boolean;
+    /** Populated when is_symlink is true. */
+    symlink_target?: string;
+    modified_at: string;
+}
+interface DirEntry {
+    name: string;
+    is_dir: boolean;
+    is_symlink: boolean;
+    size: number;
+    modified_at: string;
+}
+interface MkdirParams {
+    /** Create parent directories as needed. Defaults to true. */
+    recursive?: boolean;
+    /** Octal mode bits (e.g. 0o755). Defaults to 0o755. */
+    mode?: number;
+}
+interface CopyParams {
+    /** Copy directory trees recursively. Defaults to false. */
+    recursive?: boolean;
+}
+interface DirListResult {
+    data: {
+        entries: DirEntry[];
+        path: string;
+    };
+}
+type AgentSessionStatus$1 = "pending" | "running" | "completed" | "failed" | "cancelled";
+interface AgentSessionCreateParams {
+    goal: string;
+    model_id?: string;
+    max_turns?: number;
+}
+interface AgentSessionData {
+    id: SessionId;
+    computer_id: ComputerId;
+    goal: string;
+    model_id: string;
+    status: AgentSessionStatus$1;
+    max_turns: number;
+    turns_used: number;
+    created_at: string;
+    updated_at: string;
+    completed_at: string | null;
+    error: string | null;
+}
+interface AgentSessionListResponse$1 {
+    data: AgentSessionData[];
+}
+type AgentEventType = "session_started" | "turn_started" | "thinking" | "tool_call" | "tool_result" | "streaming_token" | "agent_response" | "turn_completed" | "session_completed" | "session_failed" | "done" | "error";
+interface AgentEvent$1 {
+    type: AgentEventType;
+    session_id: SessionId;
+    data: unknown;
+    timestamp: string;
+}
+interface CreditBalance {
+    balance: number;
+    expires_at: string | null;
+}
+interface CreditTransaction {
+    id: string;
+    amount: number;
+    type: "credit" | "debit";
+    description: string;
+    created_at: string;
+}
+interface CreditTransactionListResponse {
+    data: CreditTransaction[];
+    meta: {
+        total: number;
+        page: number;
+        per_page: number;
+    };
+}
+interface CreditUsage {
+    period_start: string;
+    period_end: string;
+    compute_credits: number;
+    ai_credits: number;
+    total_credits: number;
+}
+
+interface MiosaClientConfig {
+    apiKey: string;
+    baseUrl?: string;
+    timeout?: number;
+    maxRetries?: number;
+}
+
+type SnapshotStatus = "creating" | "uploading" | "ready" | "restoring" | "failed" | "deleted";
+interface SnapshotData {
+    id: string;
+    computer_id: string;
+    tenant_id: string;
+    comment: string | null;
+    status: SnapshotStatus;
+    state_size_bytes: number | null;
+    memory_size_bytes: number | null;
+    rootfs_size_bytes: number | null;
+    compressed_size_bytes: number | null;
+    s3_bucket: string | null;
+    s3_prefix: string | null;
+    parent_snapshot_id: string | null;
+    error: string | null;
+    created_at: string;
+    updated_at: string;
+}
+interface SnapshotCreateParams {
+    /** Optional human-readable label for this checkpoint. */
+    comment?: string;
+}
+interface SnapshotRestoreResult {
+    /** The newly provisioned Computer booted from this snapshot. */
+    data: ComputerData;
+    /** The source snapshot used for the restore. */
+    snapshot: SnapshotData;
+}
+interface SnapshotListResponse {
+    data: SnapshotData[];
+}
+type SnapshotProgressEvent = {
+    type: "snapshot_progress";
+    snapshot_id: string;
+    status: SnapshotStatus | string;
+    step?: string;
+    progress?: number;
+    error?: string;
+};
+/**
+ * Firecracker microVM checkpoint management for a Computer.
+ *
+ * Accessed via `computer.checkpoints`.
+ *
+ * @example
+ * ```ts
+ * const snap = await computer.checkpoints.create({ comment: "before upgrade" });
+ * // ... do risky work ...
+ * const fresh = await computer.checkpoints.restore(snap.id);
+ * ```
+ */
+declare class Checkpoints {
+    private readonly http;
+    private readonly computerId;
+    constructor(http: HttpClient, computerId: string);
+    private base;
+    /**
+     * Create a checkpoint of the running computer.
+     *
+     * The returned snapshot starts in `creating` status and progresses
+     * through `uploading` → `ready` asynchronously. Poll `get()` or subscribe
+     * to progress events via `onProgress` to know when it's ready.
+     *
+     * @param params - Optional `comment` label.
+     * @param onProgress - Optional callback fired for each SSE progress event.
+     *   Only called if a SSE ticket is available (the `events` endpoint requires
+     *   a prior `POST /api/v1/auth/sse-ticket` call).
+     */
+    create(params?: SnapshotCreateParams, onProgress?: (event: SnapshotProgressEvent) => void): Promise<SnapshotData>;
+    /**
+     * List all non-deleted checkpoints for this computer.
+     */
+    list(): Promise<SnapshotData[]>;
+    /**
+     * Fetch a single checkpoint by id.
+     */
+    get(id: string): Promise<SnapshotData>;
+    /**
+     * Delete a checkpoint.
+     *
+     * Transitions the snapshot to `deleted` and schedules S3 cleanup on the
+     * server. After deletion the snapshot object is returned with
+     * `status: "deleted"`.
+     */
+    delete(id: string): Promise<SnapshotData>;
+    /**
+     * Restore a checkpoint onto a fresh Computer.
+     *
+     * The returned Computer starts in `provisioning` status. Use
+     * `computer.checkpoints.restore(id, onProgress)` to subscribe to restore
+     * progress events.
+     *
+     * @param id - Snapshot id to restore (must be in `ready` status).
+     * @param onProgress - Optional callback for SSE progress events during restore.
+     * @returns A `SnapshotRestoreResult` containing the new Computer and the
+     *   source snapshot.
+     */
+    restore(id: string, onProgress?: (event: SnapshotProgressEvent) => void): Promise<SnapshotRestoreResult>;
+    /**
+     * Subscribe to Server-Sent Events for a snapshot's progress.
+     *
+     * Yields `SnapshotProgressEvent` objects until the stream closes or
+     * `status` reaches a terminal state (`ready`, `failed`, `deleted`).
+     *
+     * Requires a valid SSE ticket obtained via
+     * `POST /api/v1/auth/sse-ticket` and passed as `?ticket=<token>`.
+     *
+     * @param id - Snapshot id to watch.
+     * @param ticket - Short-lived SSE ticket from the auth endpoint.
+     */
+    events(id: string, ticket: string): AsyncIterableIterator<SnapshotProgressEvent>;
+    /**
+     * Internal: subscribe to SSE progress events and call `cb` for each.
+     *
+     * Resolves when the stream closes. Any auth/network errors are silently
+     * swallowed so the caller isn't blocked on progress-tracking failures.
+     */
+    private subscribeProgress;
+}
+
+/**
+ * ComputerAutoStop — read/update idle-timeout config.
+ *
+ * Routes:
+ *   GET   /computers/:id/auto-stop
+ *   PATCH /computers/:id/auto-stop
+ */
+
+declare class ComputerAutoStop {
+    private readonly http;
+    private readonly computerId;
+    constructor(http: HttpClient, computerId: string);
+    /** Return the current auto-stop configuration. */
+    get(): Promise<Record<string, unknown>>;
+    /** Set the idle timeout in seconds (0 disables auto-stop). */
+    update(seconds: number): Promise<Record<string, unknown>>;
+}
+
+/**
+ * ComputerEnv — encrypted env var CRUD scoped to one Computer.
+ *
+ * Routes:
+ *   GET    /computers/:id/env           → list
+ *   POST   /computers/:id/env           → create (single)
+ *   PATCH  /computers/:id/env/:name     → update value
+ *   DELETE /computers/:id/env/:name     → remove
+ *
+ * bulkSet falls back to N individual POSTs (no bulk endpoint yet).
+ */
+
+declare class ComputerEnv {
+    private readonly http;
+    private readonly computerId;
+    constructor(http: HttpClient, computerId: string);
+    private base;
+    /** List all env vars (values may be masked depending on server policy). */
+    list(): Promise<Record<string, unknown>[]>;
+    /** Create a new env var. Use update() to change an existing one. */
+    set(name: string, value: string): Promise<Record<string, unknown>>;
+    /** Patch the value of an existing env var by name. */
+    update(name: string, value: string): Promise<Record<string, unknown>>;
+    /** Remove an env var by name. */
+    delete(name: string): Promise<void>;
+    /** Convenience: create one env var per entry. */
+    bulkSet(env: Record<string, string>): Promise<Record<string, unknown>[]>;
+}
+
+/**
+ * ComputerLogs — read + stream VM logs.
+ *
+ * Routes:
+ *   GET /computers/:id/logs         — JSON snapshot (last N lines)
+ *   GET /computers/:id/logs/stream  — text/event-stream of new lines (SSE)
+ */
+
+interface ComputerLogsGetParams {
+    lines?: number;
+    since?: string;
+}
+declare class ComputerLogs {
+    private readonly http;
+    private readonly computerId;
+    constructor(http: HttpClient, computerId: string);
+    /** Fetch the most recent log snapshot. */
+    get(params?: ComputerLogsGetParams): Promise<Record<string, unknown>>;
+    /** Stream live log events as SSE dicts `{type, data, id}`. */
+    stream(): AsyncIterableIterator<Record<string, unknown>>;
+}
+
+/**
+ * ComputerOsa — task dispatch to the in-VM OSA agent.
+ *
+ * Routes:
+ *   POST   /computers/:id/osa/task
+ *   DELETE /computers/:id/osa/task
+ *   GET    /computers/:id/osa/status
+ *   POST   /computers/:id/osa/configure
+ */
+
+declare class ComputerOsa {
+    private readonly http;
+    private readonly computerId;
+    constructor(http: HttpClient, computerId: string);
+    /** Submit a free-form task to the in-VM OSA agent. */
+    submitTask(task: string, params?: Record<string, unknown>): Promise<Record<string, unknown>>;
+    /** Cancel the currently-running OSA task, if any. */
+    cancelTask(): Promise<Record<string, unknown>>;
+    /** Return OSA's current task / configuration / health snapshot. */
+    status(): Promise<Record<string, unknown>>;
+    /** Update OSA runtime configuration (model, tools, secrets, etc.). */
+    configure(config: Record<string, unknown>): Promise<Record<string, unknown>>;
+}
+
+/**
+ * ComputerPorts — per-port visibility control.
+ *
+ * Routes:
+ *   GET    /computers/:id/ports        — list
+ *   POST   /computers/:id/ports        — create
+ *   PATCH  /computers/:id/ports/:port  — update
+ *   DELETE /computers/:id/ports/:port  — delete
+ *
+ * The backend does not expose a single-port GET; get() filters the list
+ * response client-side for ergonomics.
+ */
+
+declare class ComputerPorts {
+    private readonly http;
+    private readonly computerId;
+    constructor(http: HttpClient, computerId: string);
+    private base;
+    list(): Promise<Record<string, unknown>[]>;
+    /** Return the port record for port, or null if not exposed. */
+    get(port: number): Promise<Record<string, unknown> | null>;
+    /** Expose port with the given visibility options. */
+    create(port: number, opts?: Record<string, unknown>): Promise<Record<string, unknown>>;
+    /** Patch visibility / auth options for port. */
+    update(port: number, opts: Record<string, unknown>): Promise<Record<string, unknown>>;
+    /** Stop exposing port. */
+    delete(port: number): Promise<void>;
+}
+
+/**
+ * ComputerTerminal — PTY session management for a Computer.
+ *
+ * Routes:
+ *   POST /computers/:id/terminal
+ *   POST /computers/:id/pty/:sessionId/resize
+ */
+
+interface TerminalCreateParams {
+    cols?: number;
+    rows?: number;
+    shell?: string;
+    cwd?: string;
+    env?: Record<string, string>;
+}
+declare class ComputerTerminal {
+    private readonly http;
+    private readonly computerId;
+    constructor(http: HttpClient, computerId: string);
+    /** Open a new PTY session. Returns the server payload (session id, etc.). */
+    create(params?: TerminalCreateParams): Promise<Record<string, unknown>>;
+    /** Resize an existing PTY session. */
+    resize(sessionId: string, cols: number, rows: number): Promise<Record<string, unknown>>;
+}
+
+/**
+ * ComputerVolumes — per-computer volume attachment.
+ *
+ * Routes:
+ *   GET    /computers/:id/volumes          — list attachments
+ *   POST   /computers/:id/volumes          — attach a volume
+ *   DELETE /computers/:id/volumes/:aid     — detach an attachment
+ */
+
+declare class ComputerVolumes {
+    private readonly http;
+    private readonly computerId;
+    constructor(http: HttpClient, computerId: string);
+    private base;
+    list(): Promise<Record<string, unknown>[]>;
+    /** Attach volumeId at mountPath inside the VM. */
+    attach(volumeId: string, mountPath: string): Promise<Record<string, unknown>>;
+    /** Detach an existing attachment by attachment id. */
+    detach(attachmentId: string): Promise<void>;
+}
+
+declare class Desktop$1 {
+    private readonly http;
+    private readonly computerId;
+    constructor(http: HttpClient, computerId: string);
+    private base;
+    /** Capture a screenshot of the desktop. Returns raw PNG bytes. */
+    screenshot(): Promise<Uint8Array>;
+    /** Click at the given coordinates. */
+    click(x: number, y: number, button?: ClickParams["button"]): Promise<DesktopActionResult>;
+    /** Double-click at the given coordinates. */
+    doubleClick(x: number, y: number): Promise<DesktopActionResult>;
+    /** Type text into the currently focused element. */
+    type(text: string, delay?: number): Promise<DesktopActionResult>;
+    /** Send a key or key combination (e.g. "Enter", "ctrl+c"). */
+    key(key: string): Promise<DesktopActionResult>;
+    /** Scroll in a direction at an optional position. */
+    scroll(direction: ScrollParams["direction"], clicks?: number, x?: number, y?: number): Promise<DesktopActionResult>;
+    /** Click and drag from one coordinate to another. */
+    drag(fromX: number, fromY: number, toX: number, toY: number): Promise<DesktopActionResult>;
+    /** Wait for the given number of seconds. */
+    wait(seconds: number): Promise<DesktopActionResult>;
+    /** List all open windows on the desktop. */
+    windows(): Promise<WindowInfo[]>;
+    /** Get the current cursor position. */
+    cursor(): Promise<CursorInfo>;
+    /** Bring the given window into focus. */
+    focusWindow(windowId: string): Promise<DesktopActionResult>;
+    /** Launch an application by name. */
+    launch(appName: string): Promise<DesktopActionResult>;
+}
+
+/** Options for `Exec.stream()`. */
+interface ExecStreamOptions {
+    /** Command to execute. */
+    command: string;
+    /** Optional arguments. */
+    args?: string[];
+    /** Optional environment variables as KEY=VALUE strings. */
+    env?: string[];
+    /** Working directory inside the VM. */
+    cwd?: string;
+    /** Allocate a PTY. Defaults to false. */
+    tty?: boolean;
+    /** Terminal rows (when tty=true). */
+    rows?: number;
+    /** Terminal columns (when tty=true). */
+    cols?: number;
+}
+type ExecStreamEventMap = {
+    stdout: [data: Uint8Array];
+    stderr: [data: Uint8Array];
+    exit: [code: number];
+    error: [err: Error];
+    close: [code: number, reason: string];
+};
+/**
+ * Live bidirectional exec stream backed by a `miosa-exec-v1` WebSocket.
+ *
+ * The binary wire protocol (1-byte frame ID) is handled by the server-side
+ * proxy and envd. The SDK exposes typed events on the received frames:
+ *
+ * - `stdout` — chunk of stdout bytes
+ * - `stderr` — chunk of stderr bytes
+ * - `exit`   — process exit code (stream ends after this)
+ * - `error`  — WebSocket error
+ * - `close`  — WebSocket closed
+ *
+ * Obtain via `computer.exec.stream({ command: "bash", tty: true })`.
+ *
+ * ```ts
+ * const s = computer.exec.stream({ command: "python3", args: ["script.py"] });
+ * s.on("stdout", chunk => process.stdout.write(chunk));
+ * s.on("exit",   code  => console.log("exit:", code));
+ * s.sendStdin(new TextEncoder().encode("hello\n"));
+ * await s.close();
+ * ```
+ */
+declare class ExecStreamHandle {
+    private ws;
+    private closed;
+    private readonly listeners;
+    private static readonly FRAME_STDIN;
+    private static readonly FRAME_STDOUT;
+    private static readonly FRAME_STDERR;
+    private static readonly FRAME_EXIT;
+    /** @internal — use `Exec.stream()` instead. */
+    constructor(ws: WebSocket | ws.WebSocket);
+    on<K extends keyof ExecStreamEventMap>(event: K, handler: (...args: ExecStreamEventMap[K]) => void): this;
+    off<K extends keyof ExecStreamEventMap>(event: K, handler: (...args: ExecStreamEventMap[K]) => void): this;
+    private emit;
+    /**
+     * Send stdin bytes to the running process.
+     * Prepends the 0x00 frame ID byte automatically.
+     */
+    sendStdin(data: Uint8Array): void;
+    /**
+     * Send a terminal resize event.
+     * Encodes as 0x05 + rows (u16 BE) + cols (u16 BE).
+     */
+    sendResize(rows: number, cols: number): void;
+    /** Close the stream. Idempotent. */
+    close(): Promise<void>;
+    /** Whether the stream has ended (by client or server). */
+    get isClosed(): boolean;
+    private attachHandlers;
+}
+/**
+ * Exec resource attached to every `Computer` instance.
+ * Exposes `bash()`, `python()`, and `stream()` for command execution.
+ */
+declare class Exec {
+    private readonly http;
+    private readonly computerId;
+    constructor(http: HttpClient, computerId: string);
+    private base;
+    /**
+     * Run a shell command inside the computer.
+     * @param command - Shell command string to execute.
+     * @param timeout - Optional timeout in seconds.
+     */
+    bash(command: string, timeout?: number): Promise<ExecResult>;
+    /**
+     * Execute Python code inside the computer.
+     * @param code - Python source code string.
+     * @param timeout - Optional timeout in seconds.
+     */
+    python(code: string, timeout?: number): Promise<ExecResult>;
+    /**
+     * Open a live binary exec stream using the `miosa-exec-v1` subprotocol.
+     *
+     * The WebSocket negotiates `Sec-WebSocket-Protocol: miosa-exec-v1` to
+     * ensure version compatibility. Future protocol versions can be added
+     * server-side without breaking v1 clients.
+     *
+     * ```ts
+     * const stream = computer.exec.stream({ command: "bash", tty: true, rows: 24, cols: 80 });
+     * stream.on("stdout", data => process.stdout.write(data));
+     * stream.on("exit",   code => console.log("done:", code));
+     * stream.sendStdin(new TextEncoder().encode("echo hello\n"));
+     * ```
+     */
+    stream(options: ExecStreamOptions): ExecStreamHandle;
+    private buildWsUrl;
+}
+
+declare class Files {
+    private readonly http;
+    private readonly computerId;
+    constructor(http: HttpClient, computerId: string);
+    private base;
+    /**
+     * Upload a local file to the computer.
+     *
+     * In a Node.js environment pass a Buffer or Blob; in a browser pass a File
+     * or Blob.  The remote path is where the file will be written inside the VM.
+     *
+     * @param content  - File content as Blob, Buffer, Uint8Array, or string.
+     * @param remotePath - Absolute path inside the VM (e.g. /home/user/file.txt).
+     * @param filename - Optional filename hint (defaults to basename of remotePath).
+     */
+    upload(content: Blob | Uint8Array | string, remotePath: string, _filename?: string): Promise<FileEntry>;
+    /**
+     * List files and directories at the given path inside the VM.
+     */
+    list(path: string): Promise<FileListResult>;
+    /**
+     * Download a file from the computer. Returns raw bytes.
+     */
+    download(path: string): Promise<Uint8Array>;
+    /**
+     * Export a file from the computer and receive a temporary signed URL.
+     */
+    export(path: string): Promise<FileExportResult>;
+    /**
+     * Delete a file or directory inside the computer.
+     */
+    delete(path: string): Promise<void>;
+    /**
+     * Stat a path inside the computer. Does not follow symlinks (lstat semantics).
+     *
+     * Returns `{path, size, mode, is_dir, is_symlink, symlink_target?, modified_at}`.
+     */
+    stat(path: string): Promise<FileStat>;
+    /**
+     * Create a directory inside the computer.
+     *
+     * @param path    - Absolute path to create (e.g. `/home/user/project`).
+     * @param options - `{ recursive?: boolean, mode?: number }`. Defaults: recursive=true, mode=0o755.
+     */
+    mkdir(path: string, options?: MkdirParams): Promise<void>;
+    /**
+     * Rename (move) a path inside the computer.
+     *
+     * Creates the destination parent directory if it does not exist.
+     */
+    rename(from: string, to: string): Promise<void>;
+    /**
+     * Copy a file or directory inside the computer.
+     *
+     * @param from    - Source absolute path.
+     * @param to      - Destination absolute path.
+     * @param options - `{ recursive?: boolean }`. Required when source is a directory.
+     */
+    copy(from: string, to: string, options?: CopyParams): Promise<void>;
+    /**
+     * Change permissions on a path inside the computer.
+     *
+     * @param path - Absolute path inside the VM.
+     * @param mode - Unix mode bits as an octal integer (e.g. `0o755`) or string (`"0755"`).
+     */
+    chmod(path: string, mode: number | string): Promise<void>;
+    /**
+     * Return a rich directory listing for the given path.
+     *
+     * Each entry includes `{name, is_dir, is_symlink, size, modified_at}`.
+     * Richer than `list()` which uses `find` under the hood.
+     *
+     * @param path        - Absolute path to list.
+     * @param _withTypes  - Kept for API symmetry; types are always returned.
+     */
+    readdir(path: string, _withTypes?: boolean): Promise<DirEntry[]>;
+    /**
+     * Write a UTF-8 string to a file inside the computer.
+     * Convenience wrapper around `upload()`.
+     */
+    writeFile(path: string, content: string): Promise<void>;
+    /**
+     * Read a file from the computer and return its contents as a UTF-8 string.
+     */
+    readFile(path: string): Promise<string>;
+}
+
+/**
+ * Manage egress network policy for a computer.
+ *
+ * A policy is a list of rules evaluated top-to-bottom, with a `default_effect`
+ * applied when no rule matches.
+ *
+ * Example — block IMDS and allow everything else:
+ * ```ts
+ * await computer.networkPolicy.set({
+ *   default_effect: "allow",
+ *   rules: [
+ *     { effect: "deny", destination: "169.254.169.254/32" },
+ *     { effect: "deny", destination: "metadata.google.internal" },
+ *   ],
+ * });
+ * ```
+ *
+ * Example — allowlist mode (deny all by default, allow only example.com):
+ * ```ts
+ * await computer.networkPolicy.set({
+ *   default_effect: "deny",
+ *   rules: [
+ *     { effect: "allow", destination: "example.com", ports: "443", protocol: "tcp" },
+ *   ],
+ * });
+ * ```
+ */
+declare class NetworkPolicy {
+    private readonly http;
+    private readonly computerId;
+    constructor(http: HttpClient, computerId: string);
+    /**
+     * Get the current network policy.
+     * Returns an empty allow-all policy if none is set.
+     */
+    get(): Promise<NetworkPolicyData>;
+    /**
+     * Set (create or replace) the network policy.
+     * Triggers immediate nftables update on the host — running VMs pick up
+     * the new rules without a restart.
+     */
+    set(params: NetworkPolicySetParams): Promise<NetworkPolicyData>;
+    /**
+     * Reset to the default policy (allow all egress).
+     * Idempotent — safe to call even if no policy was set.
+     */
+    reset(): Promise<void>;
+}
+
+/**
+ * Per-computer inbox config (GET/PATCH /computers/:id/inbox).
+ * Defined inline because it has no separate file (small surface).
+ */
+declare class ComputerInbox {
+    private readonly http;
+    private readonly computerId;
+    constructor(http: HttpClient, computerId: string);
+    get(): Promise<Record<string, unknown>>;
+    update(fields: Record<string, unknown>): Promise<Record<string, unknown>>;
+}
+/**
+ * A Computer instance bound to a specific computer ID.
+ *
+ * Returned by `miosa.computers.create()`, `miosa.computers.get()`, and
+ * `miosa.computers.list()`. Exposes all per-computer actions as methods and
+ * sub-resources as properties.
+ */
+declare class Computer {
+    /** Raw data from the API. Refresh with `await computer.reload()`. */
+    data: ComputerData;
+    /** Desktop control — screenshot, click, type, drag, etc. */
+    readonly desktop: Desktop$1;
+    /** Execute shell and Python commands. */
+    readonly exec: Exec;
+    /** File operations — upload, download, list, delete. */
+    readonly files: Files;
+    /** Firecracker checkpoint (snapshot) management. */
+    readonly checkpoints: Checkpoints;
+    /** Egress network policy — allow/deny rules applied at the host TAP level. */
+    readonly networkPolicy: NetworkPolicy;
+    /** Real-time event subscription (window, clipboard, file, process, idle). */
+    readonly events: Events;
+    /** Custom domain management — map your own FQDNs to this sandbox. */
+    readonly domains: CustomDomains;
+    /** PTY session management — create/resize. */
+    readonly terminal: ComputerTerminal;
+    /** In-VM OSA agent dispatch — submitTask, cancelTask, status, configure. */
+    readonly osa: ComputerOsa;
+    /** Idle auto-stop config — get/update. */
+    readonly autoStop: ComputerAutoStop;
+    /** Per-computer inbox config — get/update. */
+    readonly inbox: ComputerInbox;
+    /** Encrypted env var CRUD — list, set, update, delete, bulkSet. */
+    readonly env: ComputerEnv;
+    /** VM log read + SSE stream. */
+    readonly logs: ComputerLogs;
+    /** Per-port visibility control — list, get, create, update, delete. */
+    readonly ports: ComputerPorts;
+    /** Volume attachment — list, attach, detach. */
+    readonly volumes: ComputerVolumes;
+    private readonly http;
+    constructor(http: HttpClient, data: ComputerData);
+    get id(): ComputerId;
+    get name(): string;
+    get status(): ComputerData["status"];
+    /** URL-safe slug; falls back to the raw id when unset. */
+    get slug(): string;
+    /**
+     * Public HTTPS URL that forwards to a given port inside the VM.
+     *
+     * Example — expose a dev server running on port 3000:
+     * ```ts
+     * await computer.exec.bash("npm run dev &");
+     * const url = computer.previewUrl(3000);
+     * // => https://3000-<slug>.sandbox.miosa.ai
+     * ```
+     *
+     * Works for any TCP HTTP listener. Public (no auth required); anyone with
+     * the URL can see it. Served over the ingress proxy so it inherits the
+     * wildcard TLS cert — no per-sandbox certs to manage.
+     */
+    previewUrl(port: number, path?: string): string;
+    /** Root preview URL — serves whatever is on the default app port. */
+    get publicUrl(): string;
+    /** Start the computer. */
+    start(): Promise<Computer>;
+    /** Stop the computer. */
+    stop(): Promise<Computer>;
+    /** Restart the computer. */
+    restart(): Promise<Computer>;
+    /** Permanently destroy the computer. After this call the instance is invalid. */
+    destroy(): Promise<void>;
+    /** Reload metadata from the API and update `this.data`. */
+    reload(): Promise<Computer>;
+    /**
+     * Capture a desktop screenshot as PNG bytes.
+     * Shortcut for `computer.desktop.screenshot()`.
+     */
+    screenshot(): Promise<Uint8Array>;
+    /**
+     * Capture a desktop screenshot encoded as a base64 string.
+     * Convenience for AI agents that pass screenshots to LLMs.
+     */
+    screenshotBase64(): Promise<string>;
+    /**
+     * Click at the given coordinates (default left button).
+     * Shortcut for `computer.desktop.click(x, y)`.
+     */
+    click(x: number, y: number): Promise<void>;
+    /** Explicit left-button click. Alias for `click(x, y)`. */
+    leftClick(x: number, y: number): Promise<void>;
+    /** Right-button click. */
+    rightClick(x: number, y: number): Promise<void>;
+    /** Double-click at the given coordinates. */
+    doubleClick(x: number, y: number): Promise<void>;
+    /**
+     * Type text into the focused element.
+     * Shortcut for `computer.desktop.type(text)`.
+     */
+    type(text: string): Promise<void>;
+    /**
+     * Send a key or key combo.
+     * Shortcut for `computer.desktop.key(key)`.
+     */
+    key(key: string): Promise<void>;
+    /**
+     * Scroll in a direction.
+     * Shortcut for `computer.desktop.scroll(direction, clicks)`.
+     */
+    scroll(direction: Parameters<Desktop$1["scroll"]>[0], clicks?: number): Promise<void>;
+    /**
+     * Click and drag between two points.
+     * Shortcut for `computer.desktop.drag(fromX, fromY, toX, toY)`.
+     */
+    drag(fromX: number, fromY: number, toX: number, toY: number): Promise<void>;
+    /**
+     * Wait for N seconds inside the desktop environment.
+     * Shortcut for `computer.desktop.wait(seconds)`.
+     */
+    wait(seconds: number): Promise<void>;
+    /**
+     * Run a shell command.
+     * Shortcut for `computer.exec.bash(command)`.
+     */
+    bash(command: string, timeout?: number): Promise<ExecResult>;
+    /**
+     * Run Python code.
+     * Shortcut for `computer.exec.python(code)`.
+     */
+    python(code: string, timeout?: number): Promise<ExecResult>;
+    /** List open windows on the desktop. */
+    windows(): Promise<Awaited<ReturnType<Desktop$1["windows"]>>>;
+    /** Get the current cursor position. */
+    cursor(): Promise<Awaited<ReturnType<Desktop$1["cursor"]>>>;
+    /** Focus a specific window by ID. */
+    focusWindow(windowId: string): Promise<void>;
+    /** Launch an installed app inside the VM. */
+    launch(appName: string): Promise<void>;
+    /**
+     * Return a `ScopedFs` bound to `workingDir`.  All path arguments to
+     * `readFile`, `writeFile`, and `readdir` are resolved relative to that
+     * directory — no need to repeat the prefix on every call.
+     *
+     * ```ts
+     * const fs = computer.fs("/workspace");
+     * await fs.writeFile("main.py", "print(1)");
+     * const src = await fs.readFile("main.py");
+     * const entries = await fs.readdir(".");
+     * ```
+     */
+    fs(workingDir: string): ScopedFs;
+    /** Get VNC credentials for this computer. */
+    vncCredentials(): Promise<Record<string, unknown>>;
+    /** List installed apps inside the VM. */
+    apps(): Promise<Record<string, unknown>>;
+    /** Get URL map for this computer (VNC, preview, etc.). */
+    urls(): Promise<Record<string, unknown>>;
+    /** Mint a short-lived stream token for this computer. */
+    streamToken(): Promise<Record<string, unknown>>;
+    /** Clone this computer into a new one. */
+    clone(opts?: Record<string, unknown>): Promise<Computer>;
+    /** Resize the computer (change CPU/memory/disk). */
+    resize(size: string): Promise<Computer>;
+    /** Move the computer to a different region or host. */
+    move(opts: Record<string, unknown>): Promise<Computer>;
+    /** Capture a region of the desktop as PNG bytes. */
+    screenshotRegion(x: number, y: number, width: number, height: number): Promise<Uint8Array>;
+    /** Get time-series metrics (window: "1h" | "24h" | "7d"). */
+    metrics(window?: string): Promise<Record<string, unknown>>;
+    toJSON(): ComputerData;
+    toString(): string;
+}
+/**
+ * A thin filesystem wrapper that prepends a fixed working directory to all
+ * path arguments, mirroring the Node.js `fs/promises` surface.
+ *
+ * Obtain via `computer.fs("/workspace")`.
+ */
+declare class ScopedFs {
+    private readonly files;
+    private readonly workingDir;
+    constructor(files: Files, workingDir: string);
+    /** Resolve a relative or absolute path against `workingDir`. */
+    private resolve;
+    /** Write a UTF-8 string to a file (relative or absolute path). */
+    writeFile(path: string, content: string): Promise<void>;
+    /** Read a file and return its UTF-8 contents (relative or absolute path). */
+    readFile(path: string): Promise<string>;
+    /** List a directory (relative or absolute path). */
+    readdir(path: string): Promise<DirEntry[]>;
+    /** Stat a path (relative or absolute). */
+    stat(path: string): Promise<FileStat>;
+    /** Create a directory (relative or absolute). */
+    mkdir(path: string, options?: MkdirParams): Promise<void>;
+}
+
+declare class Computers {
+    private readonly http;
+    constructor(http: HttpClient);
+    /**
+     * Create a new computer. The computer starts in `creating` state — call
+     * `computer.start()` once it reaches `stopped` to boot it.
+     */
+    create(params: ComputerCreateParams): Promise<Computer>;
+    /**
+     * List all computers for the authenticated tenant.
+     */
+    list(params?: ComputerListParams): Promise<Computer[]>;
+    /**
+     * Fetch a single computer by ID.
+     */
+    get(id: ComputerId | string): Promise<Computer>;
+    /**
+     * Update computer metadata or name.
+     */
+    update(id: ComputerId | string, params: ComputerUpdateParams): Promise<Computer>;
+    /**
+     * Permanently delete a computer.
+     */
+    delete(id: ComputerId | string): Promise<void>;
+}
+
+interface CreditTransactionListParams {
+    page?: number;
+    per_page?: number;
+}
+declare class Credits {
+    private readonly http;
+    constructor(http: HttpClient);
+    /** Get the current credit balance for the authenticated tenant. */
+    balance(): Promise<CreditBalance>;
+    /** List credit transactions (purchases, deductions). */
+    transactions(params?: CreditTransactionListParams): Promise<CreditTransactionListResponse>;
+    /** Get aggregated credit usage for the current billing period. */
+    usage(): Promise<CreditUsage>;
+}
+
+/**
+ * CronJobs resource — scheduled work.
+ */
+
+type CronJobId = string & {
+    readonly __brand: "CronJobId";
+};
+type CronJobExecutionId = string & {
+    readonly __brand: "CronJobExecutionId";
+};
+interface CronJobData {
+    id: CronJobId;
+    tenant_id: string;
+    name: string;
+    schedule: string;
+    state?: string;
+    paused?: boolean;
+    last_run_at?: string | null;
+    next_run_at?: string | null;
+    created_at?: string;
+    updated_at?: string;
+    [key: string]: unknown;
+}
+interface CronJobExecutionData {
+    id: CronJobExecutionId;
+    cron_job_id: CronJobId;
+    state?: string;
+    started_at?: string | null;
+    finished_at?: string | null;
+    duration_ms?: number | null;
+    exit_code?: number | null;
+    error?: string | null;
+    created_at?: string;
+    [key: string]: unknown;
+}
+interface CronJobListParams {
+    limit?: number;
+    cursor?: string;
+    state?: string;
+    [key: string]: string | number | boolean | undefined;
+}
+interface CronJobCreateParams {
+    name: string;
+    schedule: string;
+    idempotencyKey?: string;
+    [key: string]: unknown;
+}
+interface CronJobUpdateParams {
+    name?: string;
+    schedule?: string;
+    [key: string]: unknown;
+}
+declare class CronJobs {
+    private readonly http;
+    constructor(http: HttpClient);
+    list(params?: CronJobListParams): Promise<CronJobData[]>;
+    get(jobId: string): Promise<CronJobData>;
+    create(params: CronJobCreateParams): Promise<CronJobData>;
+    update(jobId: string, params: CronJobUpdateParams): Promise<CronJobData>;
+    delete(jobId: string): Promise<void>;
+    pause(jobId: string): Promise<CronJobData>;
+    resume(jobId: string): Promise<CronJobData>;
+    runNow(jobId: string, opts?: {
+        idempotencyKey?: string;
+    }): Promise<CronJobData>;
+    listExecutions(jobId: string): Promise<CronJobExecutionData[]>;
+    getExecution(jobId: string, executionId: string): Promise<CronJobExecutionData>;
+}
+
+/**
+ * Dashboard — aggregated platform overview.
+ */
+
+interface DashboardSummary {
+    computers?: unknown;
+    sandboxes?: unknown;
+    credits?: unknown;
+    [key: string]: unknown;
+}
+interface OverviewData {
+    status?: string;
+    [key: string]: unknown;
+}
+declare class Dashboard {
+    private readonly http;
+    constructor(http: HttpClient);
+    /** Aggregated user dashboard payload. */
+    summary(): Promise<DashboardSummary>;
+    /** Status / health overview (public endpoint). */
+    overview(): Promise<OverviewData>;
+}
+
+/**
+ * Databases resource — managed Postgres / databases.
+ */
+
+type DatabaseId = string & {
+    readonly __brand: "DatabaseId";
+};
+interface DatabaseData {
+    id: DatabaseId;
+    tenant_id: string;
+    name: string;
+    state?: string;
+    engine?: string;
+    engine_version?: string;
+    version?: string;
+    cpu_count?: number;
+    memory_mb?: number;
+    storage_mb?: number;
+    host?: string | null;
+    port?: number | null;
+    created_at?: string;
+    updated_at?: string;
+    [key: string]: unknown;
+}
+interface DatabaseCredentials {
+    url?: string;
+    host?: string;
+    port?: number;
+    user?: string;
+    username?: string;
+    password?: string;
+    database?: string;
+    [key: string]: unknown;
+}
+interface DatabaseLogsResult {
+    lines?: string[];
+    logs?: string[];
+    [key: string]: unknown;
+}
+interface DatabaseListParams {
+    limit?: number;
+    cursor?: string;
+    state?: string;
+    [key: string]: string | number | boolean | undefined;
+}
+interface DatabaseCreateParams {
+    name: string;
+    engine?: string;
+    engine_version?: string;
+    cpu_count?: number;
+    memory_mb?: number;
+    storage_mb?: number;
+    external_workspace_id?: string;
+    external_user_id?: string;
+    external_project_id?: string;
+    metadata?: Record<string, unknown>;
+    /** @deprecated use engine_version. */
+    version?: string;
+    /** @deprecated use cpu_count/memory_mb/storage_mb. */
+    size?: string;
+    region?: string;
+    idempotencyKey?: string;
+    idempotency_key?: string;
+    [key: string]: unknown;
+}
+interface DatabaseLogsParams {
+    lines?: number;
+    since?: string;
+}
+declare class Databases {
+    private readonly http;
+    constructor(http: HttpClient);
+    list(params?: DatabaseListParams): Promise<DatabaseData[]>;
+    get(databaseId: string): Promise<DatabaseData>;
+    create(params: DatabaseCreateParams): Promise<DatabaseData>;
+    delete(databaseId: string): Promise<void>;
+    start(databaseId: string): Promise<DatabaseData>;
+    stop(databaseId: string): Promise<DatabaseData>;
+    restart(databaseId: string): Promise<DatabaseData>;
+    credentials(databaseId: string): Promise<DatabaseCredentials>;
+    logs(databaseId: string, params?: DatabaseLogsParams): Promise<DatabaseLogsResult>;
+    streamLogs(databaseId: string): AsyncIterableIterator<unknown>;
+}
+
+/**
+ * Deployments resource — sandbox→production publishing surface.
+ *
+ * Backend phase status:
+ *   - list / get / create / update / delete / env: repo deployment surface.
+ *   - publish / versions.* / releases.* / rollback / domains.*: live release surface.
+ *   - runtimeInstances.*: dynamic runtime status/log inspection.
+ *   - publishFromSandbox: direct sandbox -> deployment bridge.
+ *
+ * See docs/deploy/* for the conceptual model.
+ */
+
+type DeploymentId = string & {
+    readonly __brand: "DeploymentId";
+};
+type DeploymentVersionId = string & {
+    readonly __brand: "DeploymentVersionId";
+};
+type DeploymentReleaseId = string & {
+    readonly __brand: "DeploymentReleaseId";
+};
+type DeploymentServiceId = string & {
+    readonly __brand: "DeploymentServiceId";
+};
+type RuntimeInstanceId = string & {
+    readonly __brand: "RuntimeInstanceId";
+};
+type DeploymentState = "pending" | "building" | "running" | "stopped" | "failed";
+type DeploymentVersionKind = "static" | "dynamic" | "sandbox_backed";
+type DeploymentVersionState = "created" | "building" | "ready" | "failed" | "archived";
+type DeploymentSourceType = "repo" | "sandbox" | "upload";
+type DeploymentServiceType = "static_web" | "web" | "api" | "function" | "worker" | "cron" | "postgres" | "redis" | "bucket" | "volume";
+type RuntimeInstanceState = "provisioning" | "starting" | "healthy" | "unhealthy" | "error" | "stopped" | "destroyed";
+interface ExternalAttribution {
+    externalWorkspaceId?: string;
+    external_workspace_id?: string;
+    externalUserId?: string;
+    external_user_id?: string;
+    externalProjectId?: string;
+    external_project_id?: string;
+}
+interface DeploymentData {
+    id: DeploymentId;
+    tenant_id: string;
+    owner_id?: string;
+    name: string;
+    slug: string;
+    /**
+     * @deprecated — repo-based model. New deployments use source_type: "sandbox"
+     * with `source_sandbox_id` on the version row. Will become nullable.
+     */
+    repo_url?: string;
+    repo_provider?: "github";
+    branch?: string;
+    build_command?: string | null;
+    run_command?: string | null;
+    runtime_image?: string | null;
+    current_build_id?: string | null;
+    active_version_id?: string | null;
+    source_type?: DeploymentSourceType;
+    state: DeploymentState;
+    auto_deploy?: boolean;
+    custom_domain_id?: string | null;
+    linked_database_id?: string | null;
+    metadata?: Record<string, unknown>;
+    external_workspace_id?: string | null;
+    external_user_id?: string | null;
+    external_project_id?: string | null;
+    public_url?: string | null;
+    created_at?: string;
+    updated_at?: string;
+}
+type DeploymentDatabaseRequest = boolean | {
+    engine?: "postgresql" | "mysql" | "redis";
+    size?: "xs" | "small" | "medium" | "large";
+    storage_mb?: number;
+    region?: string;
+};
+interface DeploymentVersionData {
+    id: DeploymentVersionId;
+    deployment_id: DeploymentId;
+    tenant_id: string;
+    created_by?: string | null;
+    source_sandbox_id?: string | null;
+    build_id?: string | null;
+    version_number: number;
+    kind: DeploymentVersionKind;
+    state: DeploymentVersionState;
+    artifact_uri?: string | null;
+    artifact_manifest?: Record<string, unknown>;
+    artifact_sha256?: string | null;
+    runtime_image?: string | null;
+    runtime_command?: string | null;
+    runtime_port?: number | null;
+    health_check_path?: string | null;
+    build_log_uri?: string | null;
+    metadata?: Record<string, unknown>;
+    promoted_at?: string | null;
+    archived_at?: string | null;
+    external_workspace_id?: string | null;
+    external_user_id?: string | null;
+    external_project_id?: string | null;
+    created_at?: string;
+    updated_at?: string;
+}
+interface DeploymentReleaseData {
+    id: DeploymentReleaseId;
+    deployment_id?: DeploymentId;
+    environment_id?: string | null;
+    deployment_version_id: DeploymentVersionId;
+    service_id?: DeploymentServiceId | null;
+    tenant_id: string;
+    external_workspace_id?: string | null;
+    external_user_id?: string | null;
+    external_project_id?: string | null;
+    source_sandbox_id?: string | null;
+    build_id?: string | null;
+    kind: "static" | "oci" | "rootfs" | string;
+    state?: string;
+    artifact_uri?: string | null;
+    artifact_sha256?: string | null;
+    artifact_manifest?: Record<string, unknown>;
+    storage_backend?: string | null;
+    storage_uri?: string;
+    sha256?: string;
+    size_bytes?: number;
+    start_command?: string | null;
+    port?: number | null;
+    health_check_path?: string | null;
+    build_log_uri?: string | null;
+    metadata?: Record<string, unknown>;
+    ready_at?: string | null;
+    archived_at?: string | null;
+    created_at?: string;
+    updated_at?: string;
+}
+interface DeploymentServiceData {
+    id: DeploymentServiceId;
+    deployment_id: DeploymentId;
+    environment_id?: string | null;
+    tenant_id: string;
+    type: DeploymentServiceType;
+    name?: string | null;
+    desired_replicas?: number;
+    state: string;
+    metadata?: Record<string, unknown>;
+}
+interface RuntimeInstanceData {
+    id: RuntimeInstanceId;
+    deployment_id?: DeploymentId;
+    environment_id?: string | null;
+    service_id?: DeploymentServiceId | null;
+    release_id?: DeploymentReleaseId;
+    tenant_id: string;
+    external_workspace_id?: string | null;
+    external_user_id?: string | null;
+    external_project_id?: string | null;
+    host_id?: string | null;
+    node_id?: string | null;
+    vm_id?: string | null;
+    desired_state?: string | null;
+    state: RuntimeInstanceState;
+    ip_address?: string | null;
+    port?: number | null;
+    health_check_path?: string | null;
+    last_health_check_at?: string | null;
+    last_heartbeat_at?: string | null;
+    started_at?: string | null;
+    stopped_at?: string | null;
+    error_message?: string | null;
+    restart_count?: number;
+    cpu_limit_millicores?: number | null;
+    memory_limit_mb?: number | null;
+    runtime_log_path?: string | null;
+    metadata?: Record<string, unknown>;
+    created_at?: string;
+    updated_at?: string;
+}
+interface DeploymentBuildData {
+    id: string;
+    deployment_id: DeploymentId;
+    commit_sha?: string | null;
+    commit_message?: string | null;
+    triggered_by?: string;
+    state: string;
+    started_at?: string | null;
+    finished_at?: string | null;
+    duration_ms?: number | null;
+    log_url?: string | null;
+    image_digest?: string | null;
+    error_message?: string | null;
+    external_workspace_id?: string | null;
+    external_user_id?: string | null;
+    external_project_id?: string | null;
+    created_at?: string;
+}
+interface DeploymentListParams extends ExternalAttribution {
+    project_id?: string;
+    projectId?: string;
+    state?: DeploymentState | string;
+    limit?: number;
+    cursor?: string;
+}
+interface DeploymentCreateParams extends ExternalAttribution {
+    name: string;
+    /** Current backend create route is repo-backed; project IDs are attribution, not route ownership. */
+    project_id?: string;
+    projectId?: string;
+    /** @deprecated Ignored by the backend create route. Use sandbox.deploy() for sandbox-backed deployments. */
+    source_type?: DeploymentSourceType;
+    /** @deprecated Ignored by the backend create route. Use sandbox.deploy() for sandbox-backed deployments. */
+    sourceType?: DeploymentSourceType;
+    repo_url?: string;
+    repoUrl?: string;
+    branch?: string;
+    build_command?: string;
+    buildCommand?: string;
+    run_command?: string;
+    runCommand?: string;
+    auto_deploy?: boolean;
+    autoDeploy?: boolean;
+    database?: DeploymentDatabaseRequest;
+    metadata?: Record<string, unknown>;
+    idempotencyKey?: string;
+}
+interface DeploymentUpdateParams {
+    name?: string;
+    branch?: string;
+    build_command?: string;
+    buildCommand?: string;
+    run_command?: string;
+    runCommand?: string;
+    auto_deploy?: boolean;
+    autoDeploy?: boolean;
+}
+interface PublishParams extends ExternalAttribution {
+    sourceSandboxId: string;
+    source_sandbox_id?: string;
+    name?: string;
+    deploymentId?: string;
+    deployment_id?: string;
+    /** @deprecated Reserved for dynamic runtime publish; ignored by current static publish route. */
+    kind?: "auto" | "static" | "dynamic";
+    /** @deprecated Reserved for deployment environments; ignored by current static publish route. */
+    environment?: "production" | "staging" | string;
+    outputPath?: string;
+    output_path?: string;
+    /** @deprecated Current /deployments/:id/publish snapshots /workspace internally. */
+    sourceSnapshotPath?: string;
+    /** @deprecated Current /deployments/:id/publish snapshots /workspace internally. */
+    source_snapshot_path?: string;
+    entrypoint?: string;
+    promote?: boolean;
+    domain?: string;
+    customDomain?: string;
+    custom_domain?: string;
+    /** @deprecated Reserved for dynamic runtime publish. */
+    buildCommand?: string;
+    /** @deprecated Reserved for dynamic runtime publish. */
+    build_command?: string;
+    /** @deprecated Reserved for dynamic runtime publish. */
+    runCommand?: string;
+    /** @deprecated Reserved for dynamic runtime publish. */
+    run_command?: string;
+    /** @deprecated Reserved for dynamic runtime publish. */
+    port?: number;
+    /** @deprecated Reserved for dynamic runtime publish. */
+    healthCheckPath?: string;
+    /** @deprecated Reserved for dynamic runtime publish. */
+    health_check_path?: string;
+    /** @deprecated Reserved for managed data-service binding. */
+    dataServices?: string[];
+    /** @deprecated Reserved for managed data-service binding. */
+    data_services?: string[];
+    idempotencyKey?: string;
+}
+interface PublishResult {
+    deployment: DeploymentData;
+    version: DeploymentVersionData;
+    release?: DeploymentReleaseData;
+    services?: DeploymentServiceData[];
+    promoted: boolean;
+}
+type PublishFromSandboxParams = Omit<PublishParams, "sourceSandboxId" | "source_sandbox_id"> & {
+    sourceSandboxId?: string;
+    source_sandbox_id?: string;
+};
+interface RollbackParams {
+    versionId?: string;
+    version_id?: string;
+    idempotencyKey?: string;
+}
+interface VersionListParams extends ExternalAttribution {
+    state?: DeploymentVersionState | string;
+    limit?: number;
+    cursor?: string;
+}
+interface RuntimeLogsResult {
+    runtime_instance_id?: string;
+    deployment_id?: string;
+    log_path?: string;
+    logs: string;
+}
+interface AddDomainParams extends ExternalAttribution {
+    redirectPolicy?: "none" | "www_to_apex" | "apex_to_www";
+    redirect_policy?: "none" | "www_to_apex" | "apex_to_www";
+    idempotencyKey?: string;
+}
+declare class DeploymentVersions {
+    private readonly http;
+    private readonly deploymentId;
+    constructor(http: HttpClient, deploymentId: string);
+    list(params?: VersionListParams): Promise<DeploymentVersionData[]>;
+    get(versionId: string): Promise<DeploymentVersionData>;
+    promote(versionId: string, opts?: {
+        environment?: string;
+        idempotencyKey?: string;
+    }): Promise<DeploymentData>;
+}
+declare class DeploymentReleases {
+    private readonly http;
+    private readonly deploymentId;
+    constructor(http: HttpClient, deploymentId: string);
+    list(): Promise<DeploymentReleaseData[]>;
+    get(releaseId: string): Promise<DeploymentReleaseData>;
+}
+declare class DeploymentRuntimeInstances {
+    private readonly http;
+    private readonly deploymentId;
+    constructor(http: HttpClient, deploymentId: string);
+    list(): Promise<RuntimeInstanceData[]>;
+    get(instanceId: string): Promise<RuntimeInstanceData>;
+    logs(instanceId: string, lines?: number): Promise<RuntimeLogsResult>;
+}
+declare class DeploymentDomains {
+    private readonly http;
+    private readonly deploymentId;
+    constructor(http: HttpClient, deploymentId: string);
+    add(domain: string, params?: AddDomainParams): Promise<Record<string, unknown>>;
+    list(filters?: ExternalAttribution): Promise<Record<string, unknown>[]>;
+    verify(domainId: string): Promise<Record<string, unknown>>;
+    delete(domainId: string): Promise<void>;
+}
+declare class Deployments {
+    private readonly http;
+    constructor(http: HttpClient);
+    list(params?: DeploymentListParams): Promise<DeploymentData[]>;
+    get(deploymentId: string): Promise<DeploymentData>;
+    create(params: DeploymentCreateParams): Promise<DeploymentData>;
+    update(deploymentId: string, params: DeploymentUpdateParams): Promise<DeploymentData>;
+    delete(deploymentId: string): Promise<void>;
+    publish(deploymentId: string, params: PublishParams): Promise<PublishResult>;
+    /**
+     * Backward-compatible bridge: POST /sandboxes/:id/deploy. Works today;
+     * returns either release-backed or sandbox-backed depending on backend
+     * phase. Prefer `publish()` once Phase 2B/3 lands.
+     */
+    publishFromSandbox(sandboxId: string, params?: PublishFromSandboxParams): Promise<Record<string, unknown>>;
+    rollback(deploymentId: string, params?: RollbackParams): Promise<DeploymentData>;
+    listBuilds(deploymentId: string): Promise<DeploymentBuildData[]>;
+    getBuild(deploymentId: string, buildId: string): Promise<DeploymentBuildData>;
+    listEnv(deploymentId: string): Promise<Record<string, unknown>[]>;
+    setEnv(deploymentId: string, vars: Record<string, string>, opts?: {
+        environment?: string;
+    }): Promise<Record<string, unknown>[]>;
+    versions(deploymentId: string): DeploymentVersions;
+    releases(deploymentId: string): DeploymentReleases;
+    runtimeInstances(deploymentId: string): DeploymentRuntimeInstances;
+    runtime_instances(deploymentId: string): DeploymentRuntimeInstances;
+    domains(deploymentId: string): DeploymentDomains;
+}
+
+/**
+ * Email — admin email campaigns, templates, and inbox surfaces.
+ *
+ * Sub-namespaces:
+ *   client.email.campaigns  — bulk email send-out lifecycle
+ *   client.email.templates  — reusable templates (keyed by name)
+ *   client.email.inbox      — inbound + outbound direct messages
+ *
+ * Routes: /admin/email-{campaigns,templates,inbox}/*
+ * Requires admin credential (msk_a_* / msk_p_* or admin JWT).
+ */
+
+declare class EmailCampaigns {
+    private readonly http;
+    constructor(http: HttpClient);
+    list(filters?: Record<string, string | number | boolean | undefined>): Promise<Record<string, unknown>[]>;
+    create(attrs: Record<string, unknown>): Promise<Record<string, unknown>>;
+    recipientCount(filters?: Record<string, string | number | boolean | undefined>): Promise<Record<string, unknown>>;
+    send(campaignId: string, opts?: Record<string, unknown>): Promise<Record<string, unknown>>;
+    cancel(campaignId: string): Promise<Record<string, unknown>>;
+    deliveries(campaignId: string, filters?: Record<string, string | number | boolean | undefined>): Promise<Record<string, unknown>[]>;
+}
+declare class EmailTemplates {
+    private readonly http;
+    constructor(http: HttpClient);
+    list(filters?: Record<string, string | number | boolean | undefined>): Promise<Record<string, unknown>[]>;
+    create(key: string, attrs?: Record<string, unknown>): Promise<Record<string, unknown>>;
+    update(key: string, attrs: Record<string, unknown>): Promise<Record<string, unknown>>;
+    reset(key: string): Promise<Record<string, unknown>>;
+}
+declare class EmailInbox {
+    private readonly http;
+    constructor(http: HttpClient);
+    list(filters?: Record<string, string | number | boolean | undefined>): Promise<Record<string, unknown>[]>;
+    send(attrs: Record<string, unknown>): Promise<Record<string, unknown>>;
+    markRead(messageId: string): Promise<Record<string, unknown>>;
+    archive(messageId: string): Promise<Record<string, unknown>>;
+}
+declare class Email {
+    readonly campaigns: EmailCampaigns;
+    readonly templates: EmailTemplates;
+    readonly inbox: EmailInbox;
+    constructor(http: HttpClient);
+}
+
+/**
+ * Embeddings — OpenAI-compatible embedding vectors.
+ *
+ * Route: POST /intelligence/embeddings
+ * Requires an mki_* intelligence key.
+ */
+
+interface EmbeddingCreateParams {
+    input: string | string[];
+    model: string;
+    [key: string]: unknown;
+}
+declare class Embeddings {
+    private readonly http;
+    constructor(http: HttpClient);
+    /**
+     * Create one or more embedding vectors.
+     *
+     * Returns the full OpenAI-compatible envelope
+     * `{ object: "list", data: [...], model, usage }`.
+     */
+    create(params: EmbeddingCreateParams): Promise<Record<string, unknown>>;
+}
+
+/**
+ * External keys — BYOK encrypted per-user provider keys.
+ */
+
+interface ExternalKeyData {
+    provider?: string;
+    masked_key?: string;
+    created_at?: string;
+    [key: string]: unknown;
+}
+interface ExternalKeyCreateParams {
+    provider: string;
+    key: string;
+    [key: string]: unknown;
+}
+declare class ExternalKeys {
+    private readonly http;
+    constructor(http: HttpClient);
+    /** List configured external keys. */
+    list(): Promise<ExternalKeyData[]>;
+    /** Create / register an external provider key. */
+    create(params: ExternalKeyCreateParams): Promise<ExternalKeyData>;
+    /** Resolve (preview) the stored key for a provider. */
+    resolve(provider: string): Promise<ExternalKeyData>;
+    /**
+     * Delete the stored key for a provider.
+     * Keys are addressed by provider name, not by id.
+     */
+    delete(provider: string): Promise<void>;
+}
+
+/**
+ * FlatCustomDomains resource — tenant-scoped custom domains at /custom-domains.
+ *
+ * The per-computer and per-deployment domain APIs live on those resources;
+ * this is the flat tenant-level list view for white-label platforms managing
+ * many domains across all resources.
+ */
+
+type CustomDomainId = string & {
+    readonly __brand: "CustomDomainId";
+};
+interface CustomDomainData {
+    id: CustomDomainId;
+    tenant_id: string;
+    domain: string;
+    state?: string;
+    resource_type?: string | null;
+    resource_id?: string | null;
+    verified?: boolean;
+    verification_token?: string | null;
+    created_at?: string;
+    updated_at?: string;
+    [key: string]: unknown;
+}
+interface CustomDomainListParams {
+    limit?: number;
+    cursor?: string;
+    [key: string]: string | number | boolean | undefined;
+}
+interface CustomDomainCreateParams {
+    domain: string;
+    resource_type?: string;
+    resourceType?: string;
+    resource_id?: string;
+    resourceId?: string;
+    redirect_policy?: "none" | "www_to_apex" | "apex_to_www";
+    redirectPolicy?: "none" | "www_to_apex" | "apex_to_www";
+    idempotencyKey?: string;
+    [key: string]: unknown;
+}
+declare class FlatCustomDomains {
+    private readonly http;
+    constructor(http: HttpClient);
+    list(params?: CustomDomainListParams): Promise<CustomDomainData[]>;
+    create(params: CustomDomainCreateParams): Promise<CustomDomainData>;
+    delete(domainId: string): Promise<void>;
+}
+
+/**
+ * Functions resource — serverless edge functions.
+ */
+
+type FunctionId = string & {
+    readonly __brand: "FunctionId";
+};
+interface FunctionData {
+    id: FunctionId;
+    tenant_id: string;
+    name: string;
+    state?: string;
+    runtime?: string | null;
+    handler?: string | null;
+    memory_mb?: number | null;
+    timeout_sec?: number | null;
+    env?: Record<string, string>;
+    created_at?: string;
+    updated_at?: string;
+    [key: string]: unknown;
+}
+interface FunctionListParams {
+    limit?: number;
+    cursor?: string;
+    state?: string;
+    [key: string]: string | number | boolean | undefined;
+}
+interface FunctionCreateParams {
+    name: string;
+    runtime?: string;
+    handler?: string;
+    memory_mb?: number;
+    memoryMb?: number;
+    timeout_sec?: number;
+    timeoutSec?: number;
+    env?: Record<string, string>;
+    idempotencyKey?: string;
+    [key: string]: unknown;
+}
+interface FunctionUpdateParams {
+    name?: string;
+    runtime?: string;
+    handler?: string;
+    memory_mb?: number;
+    memoryMb?: number;
+    timeout_sec?: number;
+    timeoutSec?: number;
+    env?: Record<string, string>;
+    [key: string]: unknown;
+}
+interface FunctionInvokeParams {
+    payload?: Record<string, unknown>;
+    headers?: Record<string, string>;
+    idempotencyKey?: string;
+}
+declare class Functions {
+    private readonly http;
+    constructor(http: HttpClient);
+    list(params?: FunctionListParams): Promise<FunctionData[]>;
+    get(functionId: string): Promise<FunctionData>;
+    create(params: FunctionCreateParams): Promise<FunctionData>;
+    update(functionId: string, params: FunctionUpdateParams): Promise<FunctionData>;
+    delete(functionId: string): Promise<void>;
+    invoke(functionId: string, params?: FunctionInvokeParams): Promise<Record<string, unknown>>;
+}
+
+/**
+ * HealthChecks resource — uptime monitoring.
+ */
+
+type HealthCheckId = string & {
+    readonly __brand: "HealthCheckId";
+};
+interface HealthCheckData {
+    id: HealthCheckId;
+    tenant_id: string;
+    name: string;
+    url: string;
+    state?: string;
+    interval_sec?: number;
+    timeout_sec?: number;
+    method?: string;
+    expected_status?: number | null;
+    last_checked_at?: string | null;
+    last_status?: "up" | "down" | null;
+    created_at?: string;
+    updated_at?: string;
+    [key: string]: unknown;
+}
+interface HealthCheckListParams {
+    limit?: number;
+    cursor?: string;
+    state?: string;
+    [key: string]: string | number | boolean | undefined;
+}
+interface HealthCheckCreateParams {
+    name: string;
+    url: string;
+    interval_sec?: number;
+    intervalSec?: number;
+    timeout_sec?: number;
+    timeoutSec?: number;
+    method?: string;
+    expected_status?: number;
+    expectedStatus?: number;
+    idempotencyKey?: string;
+    [key: string]: unknown;
+}
+interface HealthCheckUpdateParams {
+    name?: string;
+    url?: string;
+    interval_sec?: number;
+    intervalSec?: number;
+    timeout_sec?: number;
+    timeoutSec?: number;
+    method?: string;
+    expected_status?: number;
+    expectedStatus?: number;
+    [key: string]: unknown;
+}
+declare class HealthChecks {
+    private readonly http;
+    constructor(http: HttpClient);
+    list(params?: HealthCheckListParams): Promise<HealthCheckData[]>;
+    get(checkId: string): Promise<HealthCheckData>;
+    create(params: HealthCheckCreateParams): Promise<HealthCheckData>;
+    update(checkId: string, params: HealthCheckUpdateParams): Promise<HealthCheckData>;
+    delete(checkId: string): Promise<void>;
+}
+
+/**
+ * Integrations — OAuth account-level connections (GitHub, Slack, Linear, Discord).
+ */
+
+interface IntegrationData {
+    id?: string;
+    provider?: string;
+    status?: string;
+    connected_at?: string;
+    [key: string]: unknown;
+}
+interface IntegrationCatalogEntry {
+    provider?: string;
+    name?: string;
+    description?: string;
+    [key: string]: unknown;
+}
+interface GithubRepo {
+    id?: number;
+    name?: string;
+    full_name?: string;
+    private?: boolean;
+    [key: string]: unknown;
+}
+interface GithubSshKey {
+    id?: number;
+    title?: string;
+    key?: string;
+    [key: string]: unknown;
+}
+interface SlackSendTestParams {
+    message?: string;
+    channel?: string;
+    [key: string]: unknown;
+}
+interface DiscordSendTestParams {
+    message?: string;
+    channel_id?: string;
+    [key: string]: unknown;
+}
+interface LinearCreateIssueParams {
+    title?: string;
+    description?: string;
+    team_id?: string;
+    [key: string]: unknown;
+}
+declare class Integrations {
+    private readonly http;
+    constructor(http: HttpClient);
+    /** List active OAuth integrations for the tenant. */
+    list(): Promise<IntegrationData[]>;
+    /** List available providers in the integration catalog. */
+    catalog(): Promise<IntegrationCatalogEntry[]>;
+    /** Begin the OAuth flow for a provider — returns an authorize URL. */
+    start(provider: string): Promise<Record<string, unknown>>;
+    /** Force-refresh the access token for a provider. */
+    refresh(provider: string): Promise<Record<string, unknown>>;
+    /** Disconnect (revoke) an integration. */
+    disconnect(provider: string): Promise<void>;
+    /** List GitHub repositories accessible to this integration. */
+    githubRepos(): Promise<GithubRepo[]>;
+    /** List configured GitHub deploy keys. */
+    githubSshKeys(): Promise<GithubSshKey[]>;
+    /** Send a test message to the connected Slack channel. */
+    slackSendTest(params?: SlackSendTestParams): Promise<Record<string, unknown>>;
+    /** Send a test message to the connected Discord channel. */
+    discordSendTest(params?: DiscordSendTestParams): Promise<Record<string, unknown>>;
+    /** Begin Linear OAuth — Linear has provider-specific error shapes. */
+    linearStart(): Promise<Record<string, unknown>>;
+    /** Create a Linear issue via the connected workspace. */
+    linearCreateIssue(params?: LinearCreateIssueParams): Promise<Record<string, unknown>>;
+}
+
+/**
+ * Mcp — Model Context Protocol streamable-HTTP transport.
+ *
+ * Clients (Claude Code, Cursor, Gemini CLI, Copilot) point at /api/v1/mcp
+ * with a msk_* Bearer token and discover the MIOSA tool-belt.
+ */
+
+interface McpDispatchParams {
+    method?: string;
+    params?: Record<string, unknown>;
+    [key: string]: unknown;
+}
+declare class Mcp {
+    private readonly http;
+    constructor(http: HttpClient);
+    /** Send a JSON-RPC request to the MCP endpoint. */
+    dispatch(params?: McpDispatchParams): Promise<Record<string, unknown>>;
+    /**
+     * Open the MCP listen channel (GET).
+     *
+     * Returns whatever the server returns. For true SSE streaming, use
+     * `http.stream("/mcp")` directly.
+     */
+    listen(): Promise<unknown>;
+    /** Close (terminate) the MCP session. */
+    close(): Promise<void>;
+}
+
+/**
+ * Models — list available LLMs across providers.
+ *
+ * Routes: GET /intelligence/models
+ * Requires an mki_* intelligence key or JWT.
+ */
+
+declare class Models {
+    private readonly http;
+    constructor(http: HttpClient);
+    /** List all models available to the calling tenant (OpenAI-compatible shape). */
+    list(filters?: Record<string, string | number | boolean | undefined>): Promise<Record<string, unknown>[]>;
+    /**
+     * Get a single model by id.
+     *
+     * The platform router does not expose a per-model GET; this filters
+     * the list payload client-side.
+     */
+    get(modelId: string): Promise<Record<string, unknown>>;
+}
+
+type HostId = string & {
+    readonly __brand: "HostId";
+};
+type JobId = string & {
+    readonly __brand: "JobId";
+};
+type TunnelId = string & {
+    readonly __brand: "TunnelId";
+};
+type ClusterId = string & {
+    readonly __brand: "ClusterId";
+};
+type WorkspaceId = string & {
+    readonly __brand: "WorkspaceId";
+};
+type SecretId = string & {
+    readonly __brand: "SecretId";
+};
+type HostStatus = "pending" | "online" | "offline" | "error" | "revoked";
+interface HostData {
+    id: HostId;
+    name: string;
+    region: string | null;
+    status: HostStatus;
+    tenant_id: string;
+    labels: Record<string, string>;
+    /** Present only on create response — treat as write-once. */
+    host_key?: string;
+    created_at: string;
+    updated_at: string;
+}
+interface HostCreateParams {
+    name: string;
+    region?: string;
+    labels?: Record<string, string>;
+}
+interface HostUpdateParams {
+    name?: string;
+    labels?: Record<string, string>;
+}
+interface HostListResponse {
+    data: HostData[];
+    meta: {
+        total: number;
+        page: number;
+        per_page: number;
+    };
+}
+interface HostEvent {
+    type: "host_connected" | "host_disconnected" | "host_error" | string;
+    host_id: HostId;
+    data: unknown;
+    timestamp: string;
+}
+type JobStatus = "queued" | "running" | "completed" | "failed" | "cancelled";
+interface JobData {
+    id: JobId;
+    host_id: HostId;
+    status: JobStatus;
+    command: string;
+    args: string[];
+    env: string[];
+    cwd: string | null;
+    exit_code: number | null;
+    stdout: string | null;
+    stderr: string | null;
+    created_at: string;
+    updated_at: string;
+    completed_at: string | null;
+}
+interface JobRunParams {
+    command: string;
+    args?: string[];
+    env?: string[];
+    cwd?: string;
+    timeout?: number;
+}
+interface JobListResponse {
+    data: JobData[];
+    meta: {
+        total: number;
+        page: number;
+        per_page: number;
+    };
+}
+type JobEventType = "stdout" | "stderr" | "exit" | "error" | "started" | "done";
+interface JobEvent {
+    type: JobEventType;
+    job_id: JobId;
+    data: string | number | null;
+    timestamp: string;
+}
+interface FsEntry {
+    name: string;
+    path: string;
+    size: number;
+    is_dir: boolean;
+    modified_at: string;
+}
+interface FsStat {
+    path: string;
+    size: number;
+    mode: number;
+    is_dir: boolean;
+    is_symlink: boolean;
+    symlink_target?: string;
+    modified_at: string;
+}
+interface FsListResponse {
+    entries: FsEntry[];
+    path: string;
+}
+interface WsTicket {
+    /** Short-lived JWT for WS authentication. */
+    ticket: string;
+    /** Fully-qualified WS URL to connect to. */
+    ws_url: string;
+    expires_at: string;
+}
+type TunnelAuthMode = "public" | "tenant_only" | "password";
+interface TunnelData {
+    id: TunnelId;
+    host_id: HostId;
+    slug: string;
+    target_port: number;
+    auth_mode: TunnelAuthMode;
+    public_url: string;
+    enabled: boolean;
+    created_at: string;
+    updated_at: string;
+}
+interface TunnelCreateParams {
+    target_port: number;
+    auth_mode?: TunnelAuthMode;
+    slug?: string;
+}
+interface TunnelUpdateParams {
+    target_port?: number;
+    auth_mode?: TunnelAuthMode;
+    enabled?: boolean;
+}
+interface TunnelListResponse {
+    data: TunnelData[];
+}
+type AgentSessionStatus = "pending" | "running" | "completed" | "failed" | "cancelled";
+interface OcAgentSessionData {
+    id: string;
+    host_id: HostId;
+    task: string;
+    model_id: string | null;
+    status: AgentSessionStatus;
+    max_turns: number;
+    turns_used: number;
+    created_at: string;
+    updated_at: string;
+    completed_at: string | null;
+    error: string | null;
+}
+interface AgentDispatchParams {
+    task: string;
+    model_id?: string;
+    max_turns?: number;
+    context?: Record<string, unknown>;
+}
+interface AgentSessionListResponse {
+    data: OcAgentSessionData[];
+}
+interface AgentEvent {
+    type: string;
+    session_id: string;
+    data: unknown;
+    timestamp: string;
+}
+type ClusterStatus = "provisioning" | "active" | "stopped" | "error" | "destroyed";
+interface ClusterData {
+    id: ClusterId;
+    name: string;
+    model: string;
+    slug: string;
+    status: ClusterStatus;
+    host_ids: HostId[];
+    /** OpenAI-compatible endpoint: POST /inference/{slug}/v1/chat/completions */
+    inference_url: string;
+    created_at: string;
+    updated_at: string;
+}
+interface ClusterCreateParams {
+    name: string;
+    model: string;
+    host_ids: string[];
+}
+interface ClusterListResponse {
+    data: ClusterData[];
+}
+interface ClusterEvent {
+    type: string;
+    cluster_id: ClusterId;
+    data: unknown;
+    timestamp: string;
+}
+interface AppCatalogEntry {
+    id: string;
+    name: string;
+    description: string;
+    category: string;
+    version: string;
+    icon_url: string | null;
+}
+interface AppInstallData {
+    id: string;
+    host_id: HostId;
+    app_id: string;
+    status: "pending" | "installing" | "installed" | "failed" | "uninstalled";
+    error: string | null;
+    created_at: string;
+    updated_at: string;
+}
+interface AppInstallEvent {
+    type: string;
+    install_id: string;
+    data: unknown;
+    timestamp: string;
+}
+type OcWorkspaceStatus = "creating" | "ready" | "running" | "stopped" | "error";
+interface OcWorkspaceData {
+    id: WorkspaceId;
+    host_id: HostId;
+    name: string;
+    repo_url: string | null;
+    branch: string | null;
+    status: OcWorkspaceStatus;
+    directory: string;
+    created_at: string;
+    updated_at: string;
+}
+interface OcWorkspaceCreateParams {
+    name: string;
+    repo_url?: string;
+    branch?: string;
+    directory?: string;
+}
+interface OcWorkspaceUpdateParams {
+    name?: string;
+    branch?: string;
+}
+interface OcWorkspaceListResponse {
+    data: OcWorkspaceData[];
+}
+interface OcWorkspaceEvent {
+    type: string;
+    workspace_id: WorkspaceId;
+    data: unknown;
+    timestamp: string;
+}
+interface SecretData {
+    id: SecretId;
+    name: string;
+    description: string | null;
+    host_id: HostId | null;
+    tenant_id: string;
+    created_at: string;
+    updated_at: string;
+}
+interface SecretCreateParams {
+    name: string;
+    value: string;
+    description?: string;
+}
+interface SecretUpdateParams {
+    value?: string;
+    description?: string;
+}
+
+/**
+ * Agents resource — dispatch Optimal AI agent sessions that execute on a
+ * remote OpenComputers host via the OSA/WS tunnel.
+ *
+ * ```ts
+ * const session = await client.openComputers.agents.dispatch(hostId, {
+ *   task: "Run the test suite and report failures",
+ * });
+ *
+ * for await (const event of client.openComputers.agents.events(hostId, session.id)) {
+ *   console.log(event.type, event.data);
+ *   if (event.type === "session_completed" || event.type === "done") break;
+ * }
+ * ```
+ */
+declare class Agents {
+    private readonly http;
+    constructor(http: HttpClient);
+    private base;
+    /**
+     * Dispatch a new agent session on the host.
+     */
+    dispatch(hostId: HostId | string, params: AgentDispatchParams): Promise<OcAgentSessionData>;
+    /**
+     * List all agent sessions for a host.
+     */
+    list(hostId: HostId | string): Promise<AgentSessionListResponse>;
+    /**
+     * Fetch the current state of a specific agent session.
+     */
+    get(hostId: HostId | string, sessionId: string): Promise<OcAgentSessionData>;
+    /**
+     * Stream live events from an agent session.
+     *
+     * Yields `AgentEvent` objects. Break on `type === "done"` or
+     * `type === "session_completed"`.
+     */
+    events(hostId: HostId | string, sessionId: string): AsyncIterableIterator<AgentEvent>;
+    /**
+     * Cancel a running or pending agent session.
+     */
+    cancel(hostId: HostId | string, sessionId: string): Promise<void>;
+}
+
+/**
+ * Apps resource — one-click install of common dev services on a remote host.
+ *
+ * ```ts
+ * const catalog = await client.openComputers.apps.catalog();
+ * const install = await client.openComputers.apps.install(hostId, "postgres");
+ *
+ * for await (const evt of client.openComputers.apps.installEvents(hostId, install.id)) {
+ *   console.log(evt.type, evt.data);
+ *   if (evt.type === "installed" || evt.type === "failed") break;
+ * }
+ * ```
+ */
+declare class Apps {
+    private readonly http;
+    constructor(http: HttpClient);
+    /**
+     * List all available apps in the MIOSA app library.
+     */
+    catalog(): Promise<AppCatalogEntry[]>;
+    /**
+     * List apps installed on a specific host.
+     */
+    listInstalled(hostId: HostId | string): Promise<AppInstallData[]>;
+    /**
+     * Install an app on a host by app catalog ID.
+     */
+    install(hostId: HostId | string, appId: string): Promise<AppInstallData>;
+    /**
+     * Get the current state of an install operation.
+     */
+    getInstall(hostId: HostId | string, installId: string): Promise<AppInstallData>;
+    /**
+     * Stream install progress events.
+     */
+    installEvents(hostId: HostId | string, installId: string): AsyncIterableIterator<AppInstallEvent>;
+    /**
+     * Uninstall an app from a host.
+     */
+    uninstall(hostId: HostId | string, appId: string): Promise<void>;
+    /**
+     * Start a previously installed app (e.g. start the postgres service).
+     */
+    startApp(hostId: HostId | string, appId: string): Promise<void>;
+}
+
+/**
+ * Clusters resource — manage multi-host LLM inference clusters (exo / MLX
+ * Distributed). Hosts must be Apple Silicon.
+ *
+ * Once a cluster is active it exposes an OpenAI-compatible endpoint at:
+ *   `POST /inference/{slug}/v1/chat/completions`
+ *
+ * Point any OpenAI client at `https://api.miosa.ai/inference/{slug}/v1` with
+ * your `msk_*` Bearer token.
+ *
+ * ```ts
+ * const cluster = await client.openComputers.clusters.create({
+ *   name: "llama-cluster",
+ *   model: "llama3:70b",
+ *   host_ids: [hostA.id, hostB.id],
+ * });
+ * console.log(cluster.inference_url); // OpenAI-compatible base URL
+ * ```
+ */
+declare class Clusters {
+    private readonly http;
+    constructor(http: HttpClient);
+    private base;
+    /**
+     * List all inference clusters for the tenant.
+     */
+    list(): Promise<ClusterListResponse>;
+    /**
+     * Create and provision a new inference cluster.
+     */
+    create(params: ClusterCreateParams): Promise<ClusterData>;
+    /**
+     * Fetch a single cluster.
+     */
+    get(id: ClusterId | string): Promise<ClusterData>;
+    /**
+     * Start a stopped cluster.
+     */
+    start(id: ClusterId | string): Promise<ClusterData>;
+    /**
+     * Stop a running cluster (preserves configuration).
+     */
+    stop(id: ClusterId | string): Promise<ClusterData>;
+    /**
+     * Permanently delete a cluster.
+     */
+    delete(id: ClusterId | string): Promise<void>;
+    /**
+     * Stream cluster provisioning / health events.
+     */
+    events(id: ClusterId | string): AsyncIterableIterator<ClusterEvent>;
+}
+
+/**
+ * Desktop resource — issue WebSocket tickets for KasmVNC desktop streaming on
+ * a remote OpenComputers host.
+ *
+ * The ticket is consumed by a WebSocket upgrade at the URL in `ws_url`. Connect
+ * a KasmVNC-compatible client (or an iframe pointing at the VNC web client) to
+ * drive the desktop.
+ *
+ * ```ts
+ * const { ws_url } = await client.openComputers.desktop.ticket(hostId);
+ * // Open ws_url in an iframe or VNC client
+ * ```
+ */
+declare class Desktop {
+    private readonly http;
+    constructor(http: HttpClient);
+    /**
+     * Issue a short-lived WebSocket ticket for a desktop streaming session.
+     *
+     * The ticket expires quickly — open the WebSocket immediately after receiving it.
+     */
+    ticket(hostId: HostId | string): Promise<WsTicket>;
+}
+
+/**
+ * Files resource — direct file-system access on a remote OpenComputers host.
+ *
+ * Operations are proxied through the OSA daemon running on the host.
+ *
+ * ```ts
+ * const entries = await client.openComputers.files.list(hostId, "/home/user");
+ * const bytes = await client.openComputers.files.download(hostId, "/home/user/report.pdf");
+ * await client.openComputers.files.upload(hostId, "/tmp/data.json", new TextEncoder().encode("{}"));
+ * ```
+ */
+declare class OcFiles {
+    private readonly http;
+    constructor(http: HttpClient);
+    private base;
+    /**
+     * List directory entries at `path`.
+     */
+    list(hostId: HostId | string, path: string): Promise<FsListResponse>;
+    /**
+     * Stat a path (does not follow symlinks).
+     */
+    stat(hostId: HostId | string, path: string): Promise<FsStat>;
+    /**
+     * Download a file from the host. Returns raw bytes.
+     */
+    download(hostId: HostId | string, path: string): Promise<Uint8Array>;
+    /**
+     * Upload content to `remotePath` on the host.
+     *
+     * @param content    - `Blob`, `Uint8Array`, or UTF-8 string.
+     * @param remotePath - Absolute destination path on the host.
+     * @param filename   - Optional filename hint; defaults to `remotePath` basename.
+     */
+    upload(hostId: HostId | string, remotePath: string, content: Blob | Uint8Array | string, filename?: string): Promise<FsEntry>;
+    /**
+     * Delete a file or directory.
+     *
+     * @param recursive - When `true`, delete non-empty directories recursively.
+     */
+    delete(hostId: HostId | string, path: string, recursive?: boolean): Promise<void>;
+    /**
+     * Create a directory (and any missing parents).
+     */
+    mkdir(hostId: HostId | string, path: string): Promise<void>;
+}
+
+/**
+ * Hosts resource — manage BYOC (Bring Your Own Computer) hosts registered
+ * under your tenant.
+ *
+ * ```ts
+ * const host = await client.openComputers.hosts.create({ name: "my-mac" });
+ * console.log(host.host_key); // store this — shown only once
+ * ```
+ */
+declare class Hosts {
+    private readonly http;
+    constructor(http: HttpClient);
+    private base;
+    /**
+     * List all hosts registered for the tenant.
+     */
+    list(): Promise<HostListResponse>;
+    /**
+     * Register a new host. The returned `host_key` is shown **once** — store it
+     * immediately and install it on the target machine.
+     */
+    create(params: HostCreateParams): Promise<HostData>;
+    /**
+     * Fetch a single host by ID.
+     */
+    get(id: HostId | string): Promise<HostData>;
+    /**
+     * Update host metadata (name / labels).
+     */
+    update(id: HostId | string, params: HostUpdateParams): Promise<HostData>;
+    /**
+     * Revoke a host. Permanently removes the registration; the host key is
+     * invalidated and the host will disconnect on next heartbeat.
+     */
+    revoke(id: HostId | string): Promise<void>;
+    /**
+     * Stream host state-change events (connect / disconnect / error) as an
+     * `AsyncIterable`.
+     *
+     * ```ts
+     * for await (const event of client.openComputers.hosts.events()) {
+     *   console.log(event.type, event.host_id);
+     *   if (shouldStop) break;
+     * }
+     * ```
+     */
+    events(): AsyncIterableIterator<HostEvent>;
+}
+
+/**
+ * Jobs resource — run commands on a remote OpenComputers host and stream output.
+ *
+ * ```ts
+ * const job = await client.openComputers.jobs.run(hostId, { command: "npm test" });
+ * for await (const event of client.openComputers.jobs.stream(hostId, job.id)) {
+ *   process.stdout.write(String(event.data ?? ""));
+ *   if (event.type === "done") break;
+ * }
+ * ```
+ */
+declare class Jobs {
+    private readonly http;
+    constructor(http: HttpClient);
+    private base;
+    /**
+     * Dispatch a command to run on the remote host.
+     */
+    run(hostId: HostId | string, params: JobRunParams): Promise<JobData>;
+    /**
+     * List all jobs for a host.
+     */
+    list(hostId: HostId | string): Promise<JobListResponse>;
+    /**
+     * Fetch the current state of a job.
+     */
+    get(hostId: HostId | string, jobId: JobId | string): Promise<JobData>;
+    /**
+     * Stream live output from a running job.
+     *
+     * Yields `JobEvent` objects with `type` of `stdout`, `stderr`, `exit`, or
+     * `done`. Break the loop when you receive `done` or `exit`.
+     */
+    stream(hostId: HostId | string, jobId: JobId | string): AsyncIterableIterator<JobEvent>;
+    /**
+     * Cancel a running or queued job.
+     */
+    cancel(hostId: HostId | string, jobId: JobId | string): Promise<void>;
+}
+
+/**
+ * Secrets resource — manage encrypted per-host (and per-tenant) env vars.
+ *
+ * Secrets are injected into exec sessions and PTY sessions on the host.
+ * The value is encrypted at rest; `reveal()` decrypts it for one-time display.
+ *
+ * ```ts
+ * // Tenant-wide secret (shared across all hosts)
+ * await client.openComputers.secrets.createForTenant({ name: "OPENAI_KEY", value: "sk-..." });
+ *
+ * // Host-specific secret
+ * const secret = await client.openComputers.secrets.createForHost(hostId, {
+ *   name: "DB_PASSWORD", value: "hunter2",
+ * });
+ * ```
+ */
+declare class Secrets {
+    private readonly http;
+    constructor(http: HttpClient);
+    /**
+     * List all tenant-scoped secrets.
+     */
+    listForTenant(): Promise<SecretData[]>;
+    /**
+     * Create a tenant-scoped secret (available to all hosts).
+     */
+    createForTenant(params: SecretCreateParams): Promise<SecretData>;
+    /**
+     * List secrets scoped to a specific host.
+     */
+    listForHost(hostId: HostId | string): Promise<SecretData[]>;
+    /**
+     * Create a secret scoped to a specific host.
+     */
+    createForHost(hostId: HostId | string, params: SecretCreateParams): Promise<SecretData>;
+    /**
+     * Update a host-scoped secret (rotate value or update description).
+     */
+    updateForHost(hostId: HostId | string, secretId: SecretId | string, params: SecretUpdateParams): Promise<SecretData>;
+    /**
+     * Delete a host-scoped secret.
+     */
+    deleteForHost(hostId: HostId | string, secretId: SecretId | string): Promise<void>;
+    /**
+     * Reveal (decrypt and return) the plaintext value of a secret.
+     * Use sparingly — each call is audit-logged.
+     */
+    reveal(hostId: HostId | string, secretId: SecretId | string): Promise<{
+        value: string;
+    }>;
+}
+
+/**
+ * Terminal resource — issue WebSocket tickets for interactive PTY sessions on
+ * a remote OpenComputers host.
+ *
+ * The ticket is consumed by a WebSocket upgrade at the URL in `ws_url`. Use
+ * xterm.js or any raw WebSocket client to drive the terminal.
+ *
+ * ```ts
+ * const { ws_url } = await client.openComputers.terminal.ticket(hostId);
+ * const ws = new WebSocket(ws_url);
+ * ```
+ */
+declare class Terminal {
+    private readonly http;
+    constructor(http: HttpClient);
+    /**
+     * Issue a short-lived WebSocket ticket for a terminal session.
+     *
+     * The ticket expires quickly — open the WebSocket immediately after receiving it.
+     */
+    ticket(hostId: HostId | string): Promise<WsTicket>;
+}
+
+/**
+ * Tunnels resource — expose ports on a remote host as publicly reachable URLs.
+ *
+ * The public proxy is served at `/t/:slug/*path`. The `auth_mode` field on each
+ * tunnel controls whether the URL is open to the internet or requires
+ * tenant credentials / a password.
+ *
+ * ```ts
+ * const tunnel = await client.openComputers.tunnels.create(hostId, {
+ *   target_port: 8080,
+ *   auth_mode: "public",
+ * });
+ * console.log(tunnel.public_url); // https://api.miosa.ai/t/<slug>
+ * ```
+ */
+declare class Tunnels {
+    private readonly http;
+    constructor(http: HttpClient);
+    private base;
+    /**
+     * List all tunnels for a host.
+     */
+    list(hostId: HostId | string): Promise<TunnelListResponse>;
+    /**
+     * Create a new tunnel that forwards traffic to `target_port` on the host.
+     */
+    create(hostId: HostId | string, params: TunnelCreateParams): Promise<TunnelData>;
+    /**
+     * Fetch a single tunnel.
+     */
+    get(hostId: HostId | string, tunnelId: TunnelId | string): Promise<TunnelData>;
+    /**
+     * Update a tunnel (target port, auth mode, or enabled state).
+     */
+    update(hostId: HostId | string, tunnelId: TunnelId | string, params: TunnelUpdateParams): Promise<TunnelData>;
+    /**
+     * Delete a tunnel. The public URL immediately becomes unreachable.
+     */
+    delete(hostId: HostId | string, tunnelId: TunnelId | string): Promise<void>;
+}
+
+/**
+ * Workspaces resource — git-backed development environments on a remote host.
+ *
+ * A workspace clones a repository, installs dependencies, and gives you a
+ * ready-to-use terminal scoped to the project root.
+ *
+ * ```ts
+ * const ws = await client.openComputers.workspaces.create(hostId, {
+ *   name: "my-project",
+ *   repo_url: "https://github.com/acme/backend",
+ *   branch: "main",
+ * });
+ * const { ws_url } = await client.openComputers.workspaces.openTerminal(hostId, ws.id);
+ * ```
+ */
+declare class OcWorkspaces {
+    private readonly http;
+    constructor(http: HttpClient);
+    private base;
+    /**
+     * List all workspaces across all hosts for the tenant.
+     */
+    listAll(): Promise<OcWorkspaceListResponse>;
+    /**
+     * List workspaces on a specific host.
+     */
+    list(hostId: HostId | string): Promise<OcWorkspaceListResponse>;
+    /**
+     * Create a new workspace on a host.
+     */
+    create(hostId: HostId | string, params: OcWorkspaceCreateParams): Promise<OcWorkspaceData>;
+    /**
+     * Fetch a single workspace.
+     */
+    get(hostId: HostId | string, workspaceId: WorkspaceId | string): Promise<OcWorkspaceData>;
+    /**
+     * Update workspace metadata (name, branch).
+     */
+    update(hostId: HostId | string, workspaceId: WorkspaceId | string, params: OcWorkspaceUpdateParams): Promise<OcWorkspaceData>;
+    /**
+     * Delete a workspace.
+     */
+    delete(hostId: HostId | string, workspaceId: WorkspaceId | string): Promise<void>;
+    /**
+     * Pull the latest changes from the remote repository.
+     */
+    pull(hostId: HostId | string, workspaceId: WorkspaceId | string): Promise<OcWorkspaceData>;
+    /**
+     * Open a terminal session scoped to the workspace root directory.
+     * Returns a short-lived WebSocket ticket.
+     */
+    openTerminal(hostId: HostId | string, workspaceId: WorkspaceId | string): Promise<WsTicket>;
+    /**
+     * Stream workspace setup / clone / install events.
+     */
+    events(hostId: HostId | string, workspaceId: WorkspaceId | string): AsyncIterableIterator<OcWorkspaceEvent>;
+}
+
+/**
+ * OpenComputers namespace — BYOC (Bring Your Own Computer) host management.
+ *
+ * Register your own machines (Mac, Linux, Windows) with MIOSA and use them
+ * just like cloud computers: run jobs, manage files, open terminals, expose
+ * ports, dispatch AI agents, and run LLM inference clusters.
+ *
+ * Access via `client.openComputers`:
+ *
+ * ```ts
+ * const miosa = new Miosa({ apiKey: "msk_u_..." });
+ *
+ * // Register a host — save host_key immediately, shown only once
+ * const host = await miosa.openComputers.hosts.create({ name: "my-mac" });
+ *
+ * // Run a command
+ * const job = await miosa.openComputers.jobs.run(host.id, { command: "npm test" });
+ *
+ * // Stream output
+ * for await (const event of miosa.openComputers.jobs.stream(host.id, job.id)) {
+ *   process.stdout.write(String(event.data ?? ""));
+ *   if (event.type === "done") break;
+ * }
+ *
+ * // Expose a port
+ * const tunnel = await miosa.openComputers.tunnels.create(host.id, { target_port: 3000 });
+ * console.log(tunnel.public_url);
+ *
+ * // Dispatch an AI agent
+ * const session = await miosa.openComputers.agents.dispatch(host.id, {
+ *   task: "Run tests and fix failing ones",
+ * });
+ * ```
+ */
+declare class OpenComputers {
+    /** Host registration and lifecycle. */
+    readonly hosts: Hosts;
+    /** Command execution on remote hosts. */
+    readonly jobs: Jobs;
+    /** File system access on remote hosts. */
+    readonly files: OcFiles;
+    /** Interactive terminal session tickets. */
+    readonly terminal: Terminal;
+    /** Desktop streaming session tickets. */
+    readonly desktop: Desktop;
+    /** HTTP tunnel management (expose host ports publicly). */
+    readonly tunnels: Tunnels;
+    /** AI agent dispatch and session management. */
+    readonly agents: Agents;
+    /** Multi-host LLM inference clusters. */
+    readonly clusters: Clusters;
+    /** App library — one-click installs on hosts. */
+    readonly apps: Apps;
+    /** Git-backed workspace environments. */
+    readonly workspaces: OcWorkspaces;
+    /** Encrypted per-host / per-tenant secrets. */
+    readonly secrets: Secrets;
+    constructor(http: HttpClient);
+}
+
+/**
+ * Project auth — built-in auth for sandboxes and deployments.
+ */
+
+interface ProjectAuthStatus {
+    enabled?: boolean;
+    state?: string;
+    database_id?: string | null;
+    config?: Record<string, unknown>;
+    [key: string]: unknown;
+}
+type ProjectAuthResourceType = "sandbox" | "deployment";
+interface ProjectAuthResourceParams {
+    resourceType?: ProjectAuthResourceType;
+    resource_type?: ProjectAuthResourceType;
+    resourceId?: string;
+    resource_id?: string;
+}
+interface ProjectAuthEnableParams extends ProjectAuthResourceParams {
+    signupEnabled?: boolean;
+    signup_enabled?: boolean;
+    emailConfirmRequired?: boolean;
+    email_confirm_required?: boolean;
+    tokenExpirySec?: number;
+    token_expiry_sec?: number;
+    config?: Record<string, unknown>;
+    [key: string]: unknown;
+}
+interface ProjectAuthUpdateParams extends ProjectAuthEnableParams {
+}
+interface ProjectAuthDisableParams extends ProjectAuthResourceParams {
+    [key: string]: unknown;
+}
+interface ProjectAuthStatusParams extends ProjectAuthResourceParams {
+    [key: string]: unknown;
+}
+declare class ProjectAuth {
+    private readonly http;
+    constructor(http: HttpClient);
+    /** Get the current project-auth status and config. */
+    status(params: ProjectAuthStatusParams): Promise<ProjectAuthStatus>;
+    /** Enable project auth. */
+    enable(params: ProjectAuthEnableParams): Promise<ProjectAuthStatus>;
+    /** Disable project auth. */
+    disable(params: ProjectAuthDisableParams): Promise<ProjectAuthStatus>;
+    /** Update project-auth configuration. */
+    update(params: ProjectAuthUpdateParams): Promise<ProjectAuthStatus>;
+}
+
+/**
+ * Project integrations — third-party API key connections injected into VMs.
+ */
+
+interface ProjectIntegrationData {
+    id?: string;
+    project_id?: string;
+    provider?: string;
+    status?: string;
+    [key: string]: unknown;
+}
+interface ProjectIntegrationCatalogEntry {
+    provider?: string;
+    name?: string;
+    description?: string;
+    schema?: Record<string, unknown>;
+    [key: string]: unknown;
+}
+interface ProjectIntegrationListParams {
+    project_id?: string;
+    provider?: string;
+    [key: string]: string | number | boolean | undefined;
+}
+interface ProjectIntegrationCreateParams {
+    project_id?: string;
+    provider?: string;
+    credentials?: Record<string, unknown>;
+    [key: string]: unknown;
+}
+interface ProjectIntegrationUpdateParams {
+    credentials?: Record<string, unknown>;
+    [key: string]: unknown;
+}
+declare class ProjectIntegrations {
+    private readonly http;
+    constructor(http: HttpClient);
+    /** List project integrations. */
+    list(params?: ProjectIntegrationListParams): Promise<ProjectIntegrationData[]>;
+    /** List supported providers and their schemas. */
+    catalog(): Promise<ProjectIntegrationCatalogEntry[]>;
+    /** Get a project integration by id. */
+    get(integrationId: string): Promise<ProjectIntegrationData>;
+    /** Create a project integration. */
+    create(params: ProjectIntegrationCreateParams): Promise<ProjectIntegrationData>;
+    /** Update a project integration. */
+    update(integrationId: string, params: ProjectIntegrationUpdateParams): Promise<ProjectIntegrationData>;
+    /** Delete a project integration. */
+    delete(integrationId: string): Promise<void>;
+}
+
+/**
+ * ProviderDefaults — admin LLM provider routing config.
+ *
+ * Routes:
+ *   GET  /admin/provider-defaults
+ *   PUT  /admin/provider-defaults
+ *   GET  /admin/tenants/:id/provider-config
+ *   PUT  /admin/tenants/:id/provider-config
+ *   DELETE /admin/tenants/:id/provider-config
+ *
+ * Requires admin credential (msk_a_* / msk_p_* or admin JWT).
+ */
+
+declare class ProviderDefaults {
+    private readonly http;
+    constructor(http: HttpClient);
+    /** Get the current fleet-wide provider defaults. */
+    list(): Promise<Record<string, unknown>>;
+    /** Return the defaults entry for a single provider, or {} if missing. */
+    get(provider: string): Promise<Record<string, unknown>>;
+    /** Replace the fleet-wide defaults (PUT /admin/provider-defaults). */
+    update(opts: Record<string, unknown>): Promise<Record<string, unknown>>;
+    getTenant(tenantId: string): Promise<Record<string, unknown>>;
+    setTenant(tenantId: string, opts: Record<string, unknown>): Promise<Record<string, unknown>>;
+    resetTenant(tenantId: string): Promise<void>;
+}
+
+/**
+ * Regions — datacenter availability, sizes, pricing, templates.
+ */
+
+interface RegionData {
+    id?: string;
+    name?: string;
+    slug?: string;
+    available?: boolean;
+    [key: string]: unknown;
+}
+interface SizeData {
+    id?: string;
+    name?: string;
+    slug?: string;
+    cpu?: number;
+    memory_mb?: number;
+    [key: string]: unknown;
+}
+interface TemplateData {
+    id?: string;
+    name?: string;
+    slug?: string;
+    [key: string]: unknown;
+}
+declare class Regions {
+    private readonly http;
+    constructor(http: HttpClient);
+    /** List datacenter regions. */
+    listRegions(): Promise<RegionData[]>;
+    /** List available compute sizes. */
+    listSizes(): Promise<SizeData[]>;
+    /** Get static compute pricing data. */
+    pricing(): Promise<unknown>;
+    /** List community computer templates. */
+    listTemplates(): Promise<TemplateData[]>;
+    /** Get a single community template by id. */
+    getTemplate(templateId: string): Promise<TemplateData>;
+}
+
+declare const SANDBOX_TEMPLATE = "miosa-sandbox";
+type SandboxId = string & {
+    readonly __brand: "SandboxId";
+};
+type SandboxState = "provisioning" | "running" | "paused" | "destroyed" | "error";
+interface SandboxCreateParams {
+    templateId?: string;
+    template_id?: string;
+    image?: string;
+    cpuCount?: number;
+    cpu_count?: number;
+    memoryMb?: number;
+    memory_mb?: number;
+    diskMb?: number;
+    disk_mb?: number;
+    diskSizeMb?: number;
+    disk_size_mb?: number;
+    timeoutSec?: number;
+    timeout_sec?: number;
+    idleTimeoutSec?: number;
+    idle_timeout_sec?: number;
+    alwaysOn?: boolean;
+    always_on?: boolean;
+    env?: Record<string, string>;
+    metadata?: Record<string, unknown>;
+    services?: Array<Record<string, unknown>>;
+    readinessProbe?: Record<string, unknown>;
+    readiness_probe?: Record<string, unknown>;
+    database?: Record<string, unknown> | boolean;
+    githubRepoUrl?: string;
+    github_repo_url?: string;
+    githubBranch?: string;
+    github_branch?: string;
+    githubClonePath?: string;
+    github_clone_path?: string;
+    name?: string;
+    region?: string;
+    entrypoint?: string;
+    tags?: string[];
+    idempotencyKey?: string;
+    idempotency_key?: string;
+    externalWorkspaceId?: string;
+    external_workspace_id?: string;
+    externalUserId?: string;
+    external_user_id?: string;
+    externalProjectId?: string;
+    external_project_id?: string;
+}
+interface SandboxListParams {
+    state?: SandboxState | string;
+    tags?: string[];
+    externalWorkspaceId?: string;
+    external_workspace_id?: string;
+    externalUserId?: string;
+    external_user_id?: string;
+    externalProjectId?: string;
+    external_project_id?: string;
+}
+interface SandboxExecOptions {
+    cwd?: string;
+    workingDir?: string;
+    working_dir?: string;
+    env?: Record<string, string>;
+    timeout?: number;
+    timeoutSec?: number;
+    timeout_sec?: number;
+}
+interface SandboxExecResult {
+    stdout: string;
+    stderr: string;
+    exitCode: number;
+    exit_code: number;
+    durationMs?: number;
+    duration_ms?: number;
+}
+type SandboxExecEvent = {
+    type?: "stdout";
+    line: string;
+} | {
+    type?: "stderr";
+    line: string;
+} | {
+    type?: "exit";
+    exit_code: number;
+    exitCode?: number;
+} | Record<string, unknown>;
+interface SandboxExecRunner {
+    (command: string, options?: SandboxExecOptions): Promise<SandboxExecResult>;
+    run(command: string, options?: SandboxExecOptions): Promise<SandboxExecResult>;
+    stream(command: string, options?: SandboxExecOptions): AsyncIterableIterator<SandboxExecEvent>;
+}
+interface SandboxData {
+    id: SandboxId;
+    state: SandboxState;
+    ready?: boolean;
+    template_id?: string;
+    image_id?: string | null;
+    cpu_count?: number | null;
+    memory_mb?: number | null;
+    disk_mb?: number | null;
+    disk_size_mb?: number | null;
+    timeout_sec?: number | null;
+    boot_path?: string | null;
+    boot_ms?: number | null;
+    ready_at?: string | null;
+    preview_url?: string | null;
+    metadata?: Record<string, unknown>;
+    inserted_at?: string;
+    created_at?: string;
+    started_at?: string | null;
+    destroyed_at?: string | null;
+    total_runtime_sec?: number | null;
+}
+interface SandboxTemplate {
+    id: string;
+    name?: string;
+    slug?: string;
+    description?: string;
+    image_id?: string;
+    built_in?: boolean;
+    status?: string;
+    preview_port?: number | null;
+    workdir?: string;
+    install_command?: string | null;
+    start_command?: string | null;
+    readiness_probe?: Record<string, unknown> | null;
+    artifact_paths?: string[];
+    runtimes?: string[];
+    tags?: string[];
+    build_spec?: Record<string, unknown>;
+    current_build_id?: string | null;
+}
+interface SandboxTemplateList {
+    data: SandboxTemplate[];
+    default_template_id?: string;
+}
+interface SandboxBuildSpec {
+    from: string;
+    vcpu?: number;
+    memoryMib?: number;
+    diskMib?: number;
+    steps?: Array<Record<string, unknown>>;
+    env?: Record<string, string>;
+    workdir?: string;
+    user?: string;
+    startCmd?: string;
+    readyCmd?: string;
+    previewPort?: number;
+    artifactPaths?: string[];
+}
+interface SandboxBuildSpecError {
+    code: string;
+    field: string;
+    message: string;
+}
+interface SandboxBuildSpecValidation {
+    valid: boolean;
+    build_spec?: Record<string, unknown>;
+    errors?: SandboxBuildSpecError[];
+}
+interface SandboxTemplateCreateParams {
+    name: string;
+    buildSpec?: SandboxBuildSpec;
+    build_spec?: SandboxBuildSpec;
+    slug?: string;
+    description?: string;
+    metadata?: Record<string, unknown>;
+}
+interface SandboxTemplateBuildCreateParams {
+    buildSpec?: SandboxBuildSpec;
+    build_spec?: SandboxBuildSpec;
+    metadata?: Record<string, unknown>;
+}
+interface SandboxTemplateBuild {
+    id: string;
+    sandbox_template_id: string;
+    source_type: "build_spec" | string;
+    state: "queued" | "building" | "certifying" | "snapshotting" | "ready" | "failed" | "cancelled";
+    image_id?: string | null;
+    rootfs_path?: string | null;
+    snapshot_manifest?: Record<string, unknown>;
+    log_url?: string | null;
+    error_code?: string | null;
+    error_message?: string | null;
+    started_at?: string | null;
+    finished_at?: string | null;
+    duration_ms?: number | null;
+    build_spec?: Record<string, unknown>;
+    inserted_at?: string;
+    updated_at?: string;
+}
+interface SandboxFileEntry {
+    name: string;
+    path: string;
+    size?: number;
+    is_dir?: boolean;
+    isDir?: boolean;
+    modified_at?: string;
+    modifiedAt?: string;
+    [key: string]: unknown;
+}
+interface SandboxFileList {
+    path?: string;
+    entries: SandboxFileEntry[];
+}
+interface SandboxFileStat {
+    path: string;
+    size?: number;
+    is_dir?: boolean;
+    isDir?: boolean;
+    mode?: string;
+    modified_at?: string;
+    modifiedAt?: string;
+    [key: string]: unknown;
+}
+interface SandboxSnapshot {
+    id: string;
+    sandbox_id?: string;
+    status?: string;
+    comment?: string;
+    created_at?: string;
+    updated_at?: string;
+    [key: string]: unknown;
+}
+interface SandboxDeployParams {
+    name?: string;
+    deploymentId?: string;
+    deployment_id?: string;
+    path?: string;
+    sourcePath?: string;
+    source_path?: string;
+    outputPath?: string;
+    output_path?: string;
+    sourceSnapshotPath?: string;
+    source_snapshot_path?: string;
+    entrypoint?: string;
+    domain?: string;
+    customDomain?: string;
+    custom_domain?: string;
+    idempotencyKey?: string;
+    idempotency_key?: string;
+}
+declare class SandboxCommands {
+    private readonly sandbox;
+    constructor(sandbox: Sandbox);
+    run(command: string, options?: SandboxExecOptions): Promise<SandboxExecResult>;
+    stream(command: string, options?: SandboxExecOptions): AsyncIterableIterator<SandboxExecEvent>;
+}
+declare class SandboxFiles {
+    private readonly sandbox;
+    constructor(sandbox: Sandbox);
+    write(path: string, content: string | Uint8Array): Promise<void>;
+    read(path: string): Promise<Uint8Array>;
+    readText(path: string): Promise<string>;
+    list(path?: string): Promise<SandboxFileList>;
+    stat(path: string): Promise<SandboxFileStat>;
+    upload(path: string, content: string | Uint8Array): Promise<void>;
+    download(path: string): Promise<Uint8Array>;
+}
+declare class SandboxPreview {
+    private readonly sandbox;
+    constructor(sandbox: Sandbox);
+    expose(port?: number): Promise<string>;
+}
+declare class SandboxArtifacts {
+    private readonly sandbox;
+    constructor(sandbox: Sandbox);
+    list(): Promise<Record<string, unknown>>;
+}
+declare class SandboxLogs {
+    private readonly sandbox;
+    constructor(sandbox: Sandbox);
+    get(lines?: number): Promise<string | Record<string, unknown>>;
+    stream(): AsyncIterableIterator<Record<string, unknown>>;
+}
+declare class SandboxSnapshots {
+    private readonly sandbox;
+    constructor(sandbox: Sandbox);
+    create(comment?: string): Promise<SandboxSnapshot>;
+    list(): Promise<SandboxSnapshot[]>;
+    restore(snapshotId: string): Promise<Sandbox>;
+    delete(snapshotId: string): Promise<void>;
+}
+declare class SandboxTerminal {
+    private readonly sandbox;
+    constructor(sandbox: Sandbox);
+    create(params?: {
+        cols?: number;
+        rows?: number;
+        shell?: string;
+        cwd?: string;
+        env?: Record<string, string>;
+    }): Promise<Record<string, unknown>>;
+    delete(sessionId: string): Promise<void>;
+}
+declare class SandboxEvents {
+    private readonly sandbox;
+    constructor(sandbox: Sandbox);
+    /** Stream live sandbox events via SSE. */
+    stream(): AsyncIterableIterator<Record<string, unknown>>;
+}
+declare class SandboxPreviews {
+    private readonly sandbox;
+    constructor(sandbox: Sandbox);
+    private get http();
+    list(): Promise<Record<string, unknown>[]>;
+    create(port: number, opts?: Record<string, unknown>): Promise<Record<string, unknown>>;
+    get(previewId: string): Promise<Record<string, unknown>>;
+    delete(previewId: string): Promise<void>;
+    /** Mint a share token for previewId. */
+    share(previewId: string, opts?: {
+        ttl_seconds?: number;
+        expires_in_sec?: number;
+    }): Promise<Record<string, unknown>>;
+    /** Invalidate every share token associated with previewId. */
+    revokeShare(previewId: string): Promise<void>;
+}
+declare class SandboxEnv {
+    private readonly sandbox;
+    constructor(sandbox: Sandbox);
+    /**
+     * Read-only listing of sandbox env vars.
+     * The backend has no per-name CRUD route; use Sandbox.create(env=...) to set values.
+     */
+    list(): Promise<Record<string, unknown>>;
+}
+declare class SandboxTags {
+    private readonly sandbox;
+    constructor(sandbox: Sandbox);
+    /** Replace the full tag list with tags. */
+    set(tags: string[]): Promise<Record<string, unknown>>;
+}
+declare class Sandbox {
+    private readonly http;
+    data: SandboxData;
+    readonly commands: SandboxCommands;
+    readonly exec: SandboxExecRunner;
+    readonly files: SandboxFiles;
+    readonly preview: SandboxPreview;
+    readonly artifacts: SandboxArtifacts;
+    readonly logs: SandboxLogs;
+    readonly snapshots: SandboxSnapshots;
+    /** PTY session control — create/delete. */
+    readonly terminal: SandboxTerminal;
+    /** SSE event stream. */
+    readonly events: SandboxEvents;
+    /** Preview CRUD + share/revokeShare. */
+    readonly previews: SandboxPreviews;
+    /** Read-only env var listing. */
+    readonly env: SandboxEnv;
+    /** Tag replacement. */
+    readonly tags: SandboxTags;
+    constructor(http: HttpClient, data: SandboxData);
+    get id(): SandboxId;
+    get state(): SandboxState;
+    get ready(): boolean;
+    get templateId(): string;
+    refresh(): Promise<Sandbox>;
+    private runExec;
+    private execStream;
+    writeFile(path: string, content: string | Uint8Array): Promise<void>;
+    download(path: string): Promise<Uint8Array>;
+    readFile(path: string): Promise<string>;
+    listFiles(path?: string): Promise<SandboxFileList>;
+    statFile(path: string): Promise<SandboxFileStat>;
+    expose(port?: number): Promise<string>;
+    startTemplate(options?: Record<string, unknown>): Promise<Record<string, unknown>>;
+    getArtifacts(): Promise<Record<string, unknown>>;
+    getLogs(lines?: number): Promise<string | Record<string, unknown>>;
+    streamLogs(): AsyncIterableIterator<Record<string, unknown>>;
+    createSnapshot(comment?: string): Promise<SandboxSnapshot>;
+    listSnapshots(): Promise<SandboxSnapshot[]>;
+    restoreSnapshot(snapshotId: string): Promise<Sandbox>;
+    deleteSnapshot(snapshotId: string): Promise<void>;
+    pause(): Promise<Sandbox>;
+    resume(): Promise<Sandbox>;
+    deploy(params?: SandboxDeployParams): Promise<Record<string, unknown>>;
+    /** Check readiness of the sandbox (GET /sandboxes/:id/readiness). */
+    readiness(): Promise<Record<string, unknown>>;
+    destroy(): Promise<void>;
+    delete(): Promise<void>;
+    private assertRunning;
+}
+declare class Sandboxes {
+    private readonly http;
+    constructor(http: HttpClient);
+    create(params?: SandboxCreateParams): Promise<Sandbox>;
+    list(params?: SandboxListParams): Promise<Sandbox[]>;
+    get(id: SandboxId | string): Promise<Sandbox>;
+    connect(id: SandboxId | string): Promise<Sandbox>;
+    delete(id: SandboxId | string): Promise<void>;
+    listTemplates(options?: {
+        includeAliases?: boolean;
+    }): Promise<SandboxTemplateList>;
+    getTemplate(id: string): Promise<SandboxTemplate>;
+    getBuildSpecSchema(): Promise<Record<string, unknown>>;
+    validateBuildSpec(buildSpec: SandboxBuildSpec): Promise<SandboxBuildSpecValidation>;
+    createTemplate(params: SandboxTemplateCreateParams): Promise<SandboxTemplate>;
+    createTemplateBuild(templateId: string, params?: SandboxTemplateBuildCreateParams): Promise<SandboxTemplateBuild>;
+    listTemplateBuilds(templateId: string): Promise<SandboxTemplateBuild[]>;
+    getTemplateBuild(buildId: string): Promise<SandboxTemplateBuild>;
+}
+
+/**
+ * SandboxTemplates resource — tenant sandbox template management.
+ */
+
+type SandboxTemplateResourceId = string & {
+    readonly __brand: "SandboxTemplateResourceId";
+};
+type SandboxTemplateBuildResourceId = string & {
+    readonly __brand: "SandboxTemplateBuildResourceId";
+};
+interface SandboxTemplateResourceData {
+    id: SandboxTemplateResourceId;
+    tenant_id: string;
+    name: string;
+    state?: string;
+    build_spec?: Record<string, unknown>;
+    aliases?: string[];
+    created_at?: string;
+    updated_at?: string;
+    [key: string]: unknown;
+}
+interface SandboxTemplateBuildResourceData {
+    id: SandboxTemplateBuildResourceId;
+    template_id: SandboxTemplateResourceId;
+    state?: string;
+    started_at?: string | null;
+    finished_at?: string | null;
+    error?: string | null;
+    created_at?: string;
+    [key: string]: unknown;
+}
+interface SandboxTemplateListParams {
+    include_aliases?: boolean;
+    includeAliases?: boolean;
+}
+interface TemplateCreateParams {
+    name: string;
+    build_spec: Record<string, unknown>;
+    buildSpec?: Record<string, unknown>;
+    idempotencyKey?: string;
+    [key: string]: unknown;
+}
+interface TemplateBuildCreateParams {
+    idempotencyKey?: string;
+    [key: string]: unknown;
+}
+declare class SandboxTemplates {
+    private readonly http;
+    constructor(http: HttpClient);
+    list(params?: SandboxTemplateListParams): Promise<SandboxTemplateResourceData[]>;
+    get(templateId: string): Promise<SandboxTemplateResourceData>;
+    create(params: TemplateCreateParams): Promise<SandboxTemplateResourceData>;
+    buildSpecSchema(): Promise<Record<string, unknown>>;
+    validate(buildSpec: Record<string, unknown>): Promise<Record<string, unknown>>;
+    listBuilds(templateId: string): Promise<SandboxTemplateBuildResourceData[]>;
+    createBuild(templateId: string, params?: TemplateBuildCreateParams): Promise<SandboxTemplateBuildResourceData>;
+}
+
+/**
+ * Settings — tenant config, branding, BYOK provider keys.
+ */
+
+interface SettingsUpdateParams {
+    [key: string]: unknown;
+}
+interface BrandingUpdateParams {
+    logo_url?: string;
+    primary_color?: string;
+    wordmark?: string;
+    [key: string]: unknown;
+}
+interface ProviderKeyUpsertParams {
+    key: string;
+    [key: string]: unknown;
+}
+declare class Settings {
+    private readonly http;
+    constructor(http: HttpClient);
+    /** Get the current tenant settings. */
+    get(): Promise<Record<string, unknown>>;
+    /** Update tenant settings. */
+    update(params: SettingsUpdateParams): Promise<Record<string, unknown>>;
+    /** Get tenant branding (logo, colors, custom wordmark). */
+    getBranding(): Promise<Record<string, unknown>>;
+    /** Update tenant branding. */
+    updateBranding(params: BrandingUpdateParams): Promise<Record<string, unknown>>;
+    /** Get tenant-scoped compute pricing. */
+    computePricing(): Promise<unknown>;
+    /** Get tenant-scoped GPU pricing. */
+    gpuPricing(): Promise<unknown>;
+    /** List models available to this tenant. */
+    availableModels(): Promise<unknown>;
+    /** List regions enabled for this tenant. */
+    regions(): Promise<unknown>;
+    /** List tenant-level BYOK provider keys (Anthropic, OpenAI, etc.). */
+    listProviderKeys(): Promise<Record<string, unknown>[]>;
+    /** Create or update a BYOK provider key. */
+    upsertProviderKey(provider: string, params: ProviderKeyUpsertParams): Promise<Record<string, unknown>>;
+    /** Delete a BYOK provider key. */
+    deleteProviderKey(provider: string): Promise<void>;
+}
+
+/**
+ * SnapshotsStandalone — fleet-wide snapshot index for admin callers.
+ *
+ * Routes: /admin/snapshots/*
+ * Requires admin credential.
+ *
+ * Per-computer snapshots remain nested under client.computers.get(id).checkpoints.
+ * This resource exposes the fleet-wide read-only index used by the admin dashboard.
+ */
+
+declare class SnapshotsStandalone {
+    private readonly http;
+    constructor(http: HttpClient);
+    list(filters?: Record<string, string | number | boolean | undefined>): Promise<Record<string, unknown>[]>;
+    get(snapshotId: string): Promise<Record<string, unknown>>;
+}
+
+/**
+ * Storage resource — managed S3-compatible buckets, objects, and presigned URLs.
+ */
+
+type BucketId = string & {
+    readonly __brand: "BucketId";
+};
+interface BucketData {
+    id: BucketId;
+    tenant_id: string;
+    name: string;
+    region?: string | null;
+    visibility?: "private" | "public" | string;
+    quota_bytes?: number | null;
+    used_bytes?: number | null;
+    public?: boolean;
+    object_count?: number | null;
+    size_bytes?: number | null;
+    created_at?: string;
+    updated_at?: string;
+    [key: string]: unknown;
+}
+interface StorageObjectData {
+    key: string;
+    size_bytes?: number;
+    content_type?: string;
+    etag?: string | null;
+    last_modified?: string | null;
+    [key: string]: unknown;
+}
+interface PresignResult {
+    url: string;
+    expires_at?: string;
+    [key: string]: unknown;
+}
+interface BucketCreateParams {
+    name: string;
+    region?: string;
+    visibility?: "private" | "public";
+    quota_bytes?: number;
+    public?: boolean;
+    [key: string]: unknown;
+}
+interface ObjectListParams {
+    prefix?: string;
+    maxKeys?: number;
+    max_keys?: number;
+    marker?: string;
+    /** @deprecated use maxKeys/max_keys; kept as a convenience alias. */
+    limit?: number;
+    /** @deprecated use marker; kept as a convenience alias. */
+    cursor?: string;
+}
+interface PresignParams {
+    key: string;
+    method?: "GET" | "PUT";
+    expiresIn?: number;
+    expires_in?: number;
+    /** @deprecated use method; kept as a convenience alias. */
+    operation?: "get" | "put";
+    /** @deprecated use expiresIn/expires_in; kept as a convenience alias. */
+    expiresInSec?: number;
+    /** @deprecated use expiresIn/expires_in; kept as a convenience alias. */
+    expires_in_sec?: number;
+    contentType?: string;
+    content_type?: string;
+}
+declare class Storage {
+    private readonly http;
+    constructor(http: HttpClient);
+    listBuckets(): Promise<BucketData[]>;
+    createBucket(params: BucketCreateParams): Promise<BucketData>;
+    getBucket(bucketId: string): Promise<BucketData>;
+    deleteBucket(bucketId: string): Promise<void>;
+    listObjects(bucketId: string, params?: ObjectListParams): Promise<StorageObjectData[]>;
+    putObject(bucketId: string, key: string, content: Uint8Array | ArrayBuffer, opts?: {
+        contentType?: string;
+    }): Promise<Record<string, unknown>>;
+    getObject(bucketId: string, key: string): Promise<Uint8Array>;
+    deleteObject(bucketId: string, key: string): Promise<void>;
+    presign(bucketId: string, params: PresignParams): Promise<PresignResult>;
+}
+
+/**
+ * Tenant — current tenant info and plan/usage.
+ */
+
+interface TenantPlan {
+    id?: string;
+    name?: string;
+    limits?: Record<string, unknown>;
+    usage?: Record<string, unknown>;
+    [key: string]: unknown;
+}
+declare class Tenant {
+    private readonly http;
+    constructor(http: HttpClient);
+    /** Get the current tenant's plan, limits, and live usage counters. */
+    current(): Promise<TenantPlan>;
+}
+
+/**
+ * Usage — per-session metering, summary, and reports.
+ */
+
+interface UsageSummary {
+    period_start?: string;
+    period_end?: string;
+    total_credits?: number;
+    [key: string]: unknown;
+}
+interface UsageSession {
+    id?: string;
+    computer_id?: string;
+    started_at?: string;
+    ended_at?: string;
+    credits_used?: number;
+    [key: string]: unknown;
+}
+interface UsageSessionsParams {
+    computer_id?: string;
+    limit?: number;
+    cursor?: string;
+    [key: string]: string | number | boolean | undefined;
+}
+interface UsageReportParams extends UsageSessionsParams {
+    period_start?: string;
+    period_end?: string;
+}
+declare class Usage {
+    private readonly http;
+    constructor(http: HttpClient);
+    /** Get the current period usage summary. */
+    current(): Promise<UsageSummary>;
+    /** List per-session metering events. */
+    sessions(params?: UsageSessionsParams): Promise<UsageSession[]>;
+    /** Get a usage report for a period. */
+    report(params?: UsageReportParams): Promise<UsageSummary>;
+}
+
+/**
+ * Volumes resource — persistent block storage.
+ */
+
+type VolumeId = string & {
+    readonly __brand: "VolumeId";
+};
+interface VolumeData {
+    id: VolumeId;
+    tenant_id: string;
+    name: string;
+    size_gb: number;
+    state?: string;
+    region?: string | null;
+    attached_to?: string | null;
+    created_at?: string;
+    updated_at?: string;
+    [key: string]: unknown;
+}
+interface VolumeListParams {
+    limit?: number;
+    cursor?: string;
+    state?: string;
+    [key: string]: string | number | boolean | undefined;
+}
+interface VolumeCreateParams {
+    name: string;
+    size_gb: number;
+    sizeGb?: number;
+    region?: string;
+    idempotencyKey?: string;
+    [key: string]: unknown;
+}
+declare class Volumes {
+    private readonly http;
+    constructor(http: HttpClient);
+    list(params?: VolumeListParams): Promise<VolumeData[]>;
+    get(volumeId: string): Promise<VolumeData>;
+    create(params: VolumeCreateParams): Promise<VolumeData>;
+    delete(volumeId: string): Promise<void>;
+}
+
+/**
+ * Webhooks resource — tenant outgoing event delivery.
+ */
+
+type WebhookId = string & {
+    readonly __brand: "WebhookId";
+};
+type WebhookDeliveryId = string & {
+    readonly __brand: "WebhookDeliveryId";
+};
+interface WebhookData {
+    id: WebhookId;
+    tenant_id: string;
+    url: string;
+    events: string[];
+    state?: string;
+    secret?: string | null;
+    enabled?: boolean;
+    created_at?: string;
+    updated_at?: string;
+    [key: string]: unknown;
+}
+interface WebhookDeliveryData {
+    id: WebhookDeliveryId;
+    webhook_id: WebhookId;
+    event?: string;
+    state?: string;
+    response_status?: number | null;
+    attempt_count?: number;
+    next_retry_at?: string | null;
+    delivered_at?: string | null;
+    created_at?: string;
+    [key: string]: unknown;
+}
+interface WebhookListParams {
+    limit?: number;
+    cursor?: string;
+    [key: string]: string | number | boolean | undefined;
+}
+interface WebhookCreateParams {
+    url: string;
+    events: string[];
+    secret?: string;
+    enabled?: boolean;
+    idempotencyKey?: string;
+    [key: string]: unknown;
+}
+interface WebhookUpdateParams {
+    url?: string;
+    events?: string[];
+    secret?: string;
+    enabled?: boolean;
+    [key: string]: unknown;
+}
+declare class Webhooks {
+    private readonly http;
+    constructor(http: HttpClient);
+    list(params?: WebhookListParams): Promise<WebhookData[]>;
+    get(webhookId: string): Promise<WebhookData>;
+    create(params: WebhookCreateParams): Promise<WebhookData>;
+    update(webhookId: string, params: WebhookUpdateParams): Promise<WebhookData>;
+    delete(webhookId: string): Promise<void>;
+    test(webhookId: string, opts?: {
+        idempotencyKey?: string;
+    }): Promise<Record<string, unknown>>;
+    deliveries(webhookId: string): Promise<WebhookDeliveryData[]>;
+}
+
+/**
+ * The top-level MIOSA client.
+ *
+ * @example
+ * ```ts
+ * import { Miosa } from '@miosa/sdk';
+ *
+ * const miosa = new Miosa({ apiKey: 'msk_u_...' });
+ *
+ * const computer = await miosa.computers.create({ name: 'my-agent' });
+ * await computer.start();
+ * ```
+ */
+declare class Miosa {
+    /** Current tenant plan, limits, and live usage counters. */
+    readonly tenant: Tenant;
+    /** Datacenter regions, compute sizes, pricing, community templates. */
+    readonly regions: Regions;
+    /** Tenant settings — workspace config, branding, BYOK provider keys. */
+    readonly settings: Settings;
+    /** Aggregated platform dashboard and health overview. */
+    readonly dashboard: Dashboard;
+    /** Admin-scoped analytics overview and timeseries metrics. */
+    readonly analytics: Analytics;
+    /** Admin-scoped audit log event stream. */
+    readonly auditLog: AuditLog;
+    /** Current-period usage summary, sessions, and report queries. */
+    readonly usage: Usage;
+    /** Notification channels — Slack, Discord, email, etc. */
+    readonly channels: Channels;
+    /** OAuth integrations — GitHub, Slack, Linear, Discord. */
+    readonly integrations: Integrations;
+    /** Per-project integrations (Stripe, Resend, Twilio, etc.). */
+    readonly projectIntegrations: ProjectIntegrations;
+    /** Built-in auth for generated apps inside sandboxes/deployments. */
+    readonly projectAuth: ProjectAuth;
+    /** BYOK encrypted per-user provider keys. */
+    readonly externalKeys: ExternalKeys;
+    /** Model Context Protocol — JSON-RPC dispatch + streaming channel. */
+    readonly mcp: Mcp;
+    /** Computer management — create, list, get, delete. */
+    readonly computers: Computers;
+    /** Sandboxes — native code-execution environments under `/sandboxes`. */
+    readonly sandboxes: Sandboxes;
+    /**
+     * Deployments — publish from a sandbox to a stable production URL.
+     * Versions, releases, rollback, custom domains.
+     */
+    readonly deployments: Deployments;
+    /** Credit balance and usage. */
+    readonly credits: Credits;
+    /** Admin surface (`/api/v1/admin/*`) — requires an admin credential. */
+    readonly admin: Admin;
+    /**
+     * OpenComputers — BYOC host management: register your own machines and use
+     * them like cloud computers (jobs, files, tunnels, AI agents, clusters).
+     */
+    readonly openComputers: OpenComputers;
+    /** Managed Postgres databases — lifecycle, credentials, logs. */
+    readonly databases: Databases;
+    /** Managed object storage — buckets, objects, presigned URLs. */
+    readonly storage: Storage;
+    /** Persistent block storage volumes. */
+    readonly volumes: Volumes;
+    /** Tenant-scoped custom domains across all resources. */
+    readonly customDomains: FlatCustomDomains;
+    /** Serverless edge functions — CRUD and invoke. */
+    readonly functions: Functions;
+    /** Scheduled cron jobs — CRUD, pause/resume, execution history. */
+    readonly cronJobs: CronJobs;
+    /** Uptime health checks. */
+    readonly healthChecks: HealthChecks;
+    /** Outgoing tenant webhooks — CRUD, test, delivery history. */
+    readonly webhooks: Webhooks;
+    /** Sandbox templates — CRUD, build-spec schema, builds. */
+    readonly sandboxTemplates: SandboxTemplates;
+    /** API key management — list, create, delete. */
+    readonly apiKeys: ApiKeys;
+    /** Available LLM models via the intelligence gateway. */
+    readonly models: Models;
+    /** OpenAI-compatible text + chat completions (supports SSE streaming). */
+    readonly completions: Completions;
+    /** OpenAI-compatible embedding vectors. */
+    readonly embeddings: Embeddings;
+    /** Admin: fleet-wide + per-tenant LLM provider routing defaults. */
+    readonly providerDefaults: ProviderDefaults;
+    /** Admin: trigger + inspect platform benchmark runs. */
+    readonly benchmarks: Benchmarks;
+    /** Read-only views of the Optimal AI agent fleet. */
+    readonly commandCenter: CommandCenter;
+    /** Community template + agent catalog. */
+    readonly community: Community;
+    /** Admin email campaigns, templates, and inbox. */
+    readonly email: Email;
+    /** Builder UI session metadata. */
+    readonly builderSessions: BuilderSessions;
+    /** Admin: fleet-wide snapshot index. */
+    readonly snapshotsStandalone: SnapshotsStandalone;
+    private readonly http;
+    constructor(config: MiosaClientConfig);
+}
+
+interface MiosaErrorBody {
+    error?: {
+        code?: string;
+        message?: string;
+        details?: unknown;
+    };
+    message?: string;
+    code?: string;
+}
+declare class MiosaError extends Error {
+    readonly status: number;
+    readonly code: string;
+    readonly details: unknown;
+    readonly requestId: string | undefined;
+    constructor(message: string, status: number, code: string, details?: unknown, requestId?: string);
+    static fromResponse(status: number, body: MiosaErrorBody, requestId?: string): MiosaError;
+}
+declare class AuthError extends MiosaError {
+    constructor(message: string, status?: number, code?: string, details?: unknown, requestId?: string);
+}
+declare class NotFoundError extends MiosaError {
+    constructor(message: string, code?: string, details?: unknown, requestId?: string);
+}
+declare class RateLimitError extends MiosaError {
+    readonly retryAfter: number | undefined;
+    constructor(message: string, details?: unknown, requestId?: string, retryAfter?: number);
+}
+declare class InsufficientCreditsError extends MiosaError {
+    constructor(message: string, details?: unknown, requestId?: string);
+}
+declare class ValidationError extends MiosaError {
+    constructor(message: string, status: number, code?: string, details?: unknown, requestId?: string);
+}
+declare class TimeoutError extends MiosaError {
+    constructor(message?: string);
+}
+declare class NetworkError extends MiosaError {
+    readonly cause: Error;
+    constructor(message: string, cause: Error);
+}
+
+export { type AddDomainParams, Admin, type AgentDispatchParams, type AgentEvent$1 as AgentEvent, type AgentEventType, type AgentSessionCreateParams, type AgentSessionData, type AgentSessionListResponse$1 as AgentSessionListResponse, type AgentSessionStatus$1 as AgentSessionStatus, Analytics, type AnalyticsFilters, type ApiKeyCreateParams, type ApiKeyCreateResult, type ApiKeyData, type ApiKeyId, type ApiKeyListParams, ApiKeys, type AppCatalogEntry, type AppInstallData, type AppInstallEvent, AuditLog, type AuditLogEvent, type AuditLogListParams, AuthError, type BenchmarkCompareParams, type BenchmarkCreateParams, Benchmarks, type BrandingUpdateParams, type BucketCreateParams, type BucketData, type BucketId, type BuilderSessionListParams, BuilderSessions, type BulkUserActionParams, type ChannelCreateParams, type ChannelData, type ChannelListParams, type ChannelUpdateParams, Channels, type ChatCompletionCreateParams, type ChatCompletionCreateStreamParams, Checkpoints, type ClickParams, type ClusterCreateParams, type ClusterData, type ClusterEvent, type ClusterId, type ClusterListResponse, type ClusterStatus, CommandCenter, Community, type CompletionCreateParams, type CompletionCreateStreamParams, Completions, Computer, ComputerAutoStop, type ComputerCreateParams, type ComputerData, ComputerEnv, type ComputerId, ComputerInbox, type ComputerListParams, type ComputerListResponse, ComputerLogs, type ComputerLogsGetParams, ComputerOsa, ComputerPorts, type ComputerSize, type ComputerStatus, type ComputerTemplateType, ComputerTerminal, type ComputerUpdateParams, type ComputerVisibility, ComputerVolumes, Computers, type CopyParams, type CreateAdminApiKeyParams, type CreditBalance, type CreditTransaction, type CreditTransactionListResponse, type CreditUsage, Credits, type CronJobCreateParams, type CronJobData, type CronJobExecutionData, type CronJobExecutionId, type CronJobId, type CronJobListParams, type CronJobUpdateParams, CronJobs, type CursorInfo, type CustomDomainCreateParams, type CustomDomainData, type CustomDomainId, type CustomDomainListParams, Dashboard, type DashboardSummary, type DatabaseCreateParams, type DatabaseCredentials, type DatabaseData, type DatabaseId, type DatabaseListParams, type DatabaseLogsParams, type DatabaseLogsResult, Databases, type DeploymentBuildData, type DeploymentCreateParams, type DeploymentData, DeploymentDomains, type DeploymentId, type DeploymentListParams, type DeploymentReleaseData, type DeploymentReleaseId, DeploymentReleases, DeploymentRuntimeInstances, type DeploymentServiceData, type DeploymentServiceId, type DeploymentServiceType, type DeploymentSourceType, type DeploymentState, type DeploymentUpdateParams, type DeploymentVersionData, type DeploymentVersionId, type DeploymentVersionKind, type DeploymentVersionState, DeploymentVersions, Deployments, Desktop$1 as Desktop, type DesktopActionResult, type DirEntry, type DirListResult, type DiscordSendTestParams, type DoubleClickParams, type DragParams, Email, EmailCampaigns, EmailInbox, EmailTemplates, type EmbeddingCreateParams, Embeddings, Exec, type ExecParams, type ExecPythonParams, type ExecResult, type ExternalAttribution, type ExternalKeyCreateParams, type ExternalKeyData, ExternalKeys, type FileDeleteParams, type FileDownloadParams, type FileEntry, type FileExportParams, type FileExportResult, type FileListParams, type FileListResult, type FileStat, Files, FlatCustomDomains, type FsEntry, type FsListResponse, type FsStat, type FunctionCreateParams, type FunctionData, type FunctionId, type FunctionInvokeParams, type FunctionListParams, type FunctionUpdateParams, Functions, type GithubRepo, type GithubSshKey, type HealthCheckCreateParams, type HealthCheckData, type HealthCheckId, type HealthCheckListParams, type HealthCheckUpdateParams, HealthChecks, type HostCreateParams, type HostData, type HostEvent, type HostId, type HostListResponse, type HostStatus, type HostUpdateParams, InsufficientCreditsError, type IntegrationCatalogEntry, type IntegrationData, Integrations, type JobData, type JobEvent, type JobEventType, type JobId, type JobListResponse, type JobRunParams, type JobStatus, type KeyParams, type LaunchParams, type LinearCreateIssueParams, type ListAdminApiKeysParams, type ListAdminComputersParams, type ListAdminTenantsParams, type ListAdminUsersParams, Mcp, type McpDispatchParams, Miosa, type MiosaClientConfig, MiosaError, type MkdirParams, Models, type MouseButton, NetworkError, NetworkPolicy, type NetworkPolicyData, type NetworkPolicyEffect, type NetworkPolicyProtocol, type NetworkPolicyRule, type NetworkPolicySetParams, NotFoundError, type NotificationPrefsUpdateParams, type ObjectListParams, type AgentEvent as OcAgentEvent, type OcAgentSessionData, type AgentSessionListResponse as OcAgentSessionListResponse, type OcWorkspaceCreateParams, type OcWorkspaceData, type OcWorkspaceEvent, type OcWorkspaceListResponse, type OcWorkspaceStatus, type OcWorkspaceUpdateParams, OpenComputers, type OverviewData, type PresignParams, type PresignResult, ProjectAuth, type ProjectAuthEnableParams, type ProjectAuthStatus, type ProjectAuthUpdateParams, type ProjectIntegrationCatalogEntry, type ProjectIntegrationCreateParams, type ProjectIntegrationData, type ProjectIntegrationListParams, type ProjectIntegrationUpdateParams, ProjectIntegrations, ProviderDefaults, type ProviderKeyUpsertParams, type PublishFromSandboxParams, type PublishParams, type PublishResult, RateLimitError, type RegionData, Regions, type RollbackParams, type RuntimeInstanceData, type RuntimeInstanceId, type RuntimeInstanceState, type RuntimeLogsResult, SANDBOX_TEMPLATE, Sandbox, SandboxArtifacts, type SandboxBuildSpec, type SandboxBuildSpecError, type SandboxBuildSpecValidation, SandboxCommands, type SandboxCreateParams, type SandboxData, SandboxEnv, SandboxEvents, type SandboxExecOptions, type SandboxExecResult, SandboxFiles, type SandboxId, type SandboxListParams, SandboxPreview, SandboxPreviews, type SandboxState, SandboxTags, type SandboxTemplate, type SandboxTemplateBuild, type SandboxTemplateBuildCreateParams, type SandboxTemplateBuildResourceData, type SandboxTemplateBuildResourceId, type SandboxTemplateCreateParams, type SandboxTemplateList, type SandboxTemplateListParams, type SandboxTemplateResourceData, type SandboxTemplateResourceId, SandboxTemplates, SandboxTerminal, Sandboxes, ScopedFs, type ScrollDirection, type ScrollParams, type SecretCreateParams, type SecretData, type SecretId, type SecretUpdateParams, type SessionId, Settings, type SettingsUpdateParams, type SizeData, type SlackSendTestParams, type SnapshotCreateParams, type SnapshotData, type SnapshotListResponse, type SnapshotProgressEvent, type SnapshotRestoreResult, type SnapshotStatus, SnapshotsStandalone, Storage, type StorageObjectData, type TemplateBuildCreateParams, type TemplateCreateParams, type TemplateData, Tenant, type TenantId, type TenantPlan, type TerminalCreateParams, TimeoutError, type TimeseriesParams, type TunnelAuthMode, type TunnelCreateParams, type TunnelData, type TunnelId, type TunnelListResponse, type TunnelUpdateParams, type TypeParams, Usage, type UsageReportParams, type UsageSession, type UsageSessionsParams, type UsageSummary, ValidationError, type VersionListParams, type VolumeCreateParams, type VolumeData, type VolumeId, type VolumeListParams, Volumes, type WaitParams, type WebhookCreateParams, type WebhookData, type WebhookDeliveryData, type WebhookDeliveryId, type WebhookId, type WebhookListParams, type WebhookUpdateParams, Webhooks, type WindowFocusParams, type WindowInfo, type WorkspaceId, type WsTicket };