@miosa/sdk 1.2.5 → 1.2.6

package/dist/index.d.ts

@@ -155,6 +155,81 @@ declare class Admin {
     optimalStatus(): Promise<Json>;
     listOptimalModels(): Promise<Json>;
     switchOptimalModel(modelId: string): Promise<Json>;
+    /** POST /api/v1/admin/impersonate — returns {token, expires_at}. */
+    impersonate(externalUserId: string, options?: {
+        ttlSec?: number;
+    }): Promise<{
+        token: string;
+        expires_at: string;
+    }>;
+}
+
+type AgentRunId = string & {
+    readonly __brand: "AgentRunId";
+};
+type AgentRunTargetKind = "sandbox" | "computer";
+type AgentRunStatus = "running" | "succeeded" | "failed" | "canceled";
+type AgentRunProvider = "claude" | "claude-code" | "codex" | "custom" | "hermes" | "osa" | "pi" | (string & {});
+interface AgentRunData {
+    id: AgentRunId;
+    tenant_id?: string | null;
+    user_id?: string | null;
+    target_kind: AgentRunTargetKind | string;
+    target_id: string;
+    target_name?: string | null;
+    provider: AgentRunProvider;
+    model?: string | null;
+    prompt: string;
+    status: AgentRunStatus | string;
+    output?: string | null;
+    stderr?: string | null;
+    exit_code?: number | null;
+    error_code?: string | null;
+    error_message?: string | null;
+    metadata?: Record<string, unknown>;
+    started_at?: string | null;
+    finished_at?: string | null;
+    created_at?: string | null;
+    updated_at?: string | null;
+}
+interface AgentRunCreateParams {
+    target_id?: string;
+    targetId?: string;
+    sandbox_id?: string;
+    sandboxId?: string;
+    computer_id?: string;
+    computerId?: string;
+    target_kind?: AgentRunTargetKind;
+    targetKind?: AgentRunTargetKind;
+    provider?: AgentRunProvider;
+    prompt: string;
+    instruction?: string;
+    command?: string;
+    model?: string;
+    cwd?: string;
+    timeout?: number;
+    metadata?: Record<string, unknown>;
+}
+interface AgentRunListParams {
+    target_id?: string;
+    targetId?: string;
+    sandbox_id?: string;
+    sandboxId?: string;
+    computer_id?: string;
+    computerId?: string;
+    limit?: number;
+}
+declare class AgentRuns {
+    private readonly http;
+    constructor(http: HttpClient);
+    /** Dispatch a prompt to a sandbox/computer and persist the run record. */
+    create(params: AgentRunCreateParams): Promise<AgentRunData>;
+    /** Alias for create(), matching the product language. */
+    run(params: AgentRunCreateParams): Promise<AgentRunData>;
+    /** List recent agent runs for the authenticated tenant. */
+    list(params?: AgentRunListParams): Promise<AgentRunData[]>;
+    /** Fetch one persisted agent run. */
+    get(runId: string): Promise<AgentRunData>;
 }
 
 /**
@@ -221,6 +296,12 @@ declare class ApiKeys {
     constructor(http: HttpClient);
     list(params?: ApiKeyListParams): Promise<ApiKeyData[]>;
     create(params: ApiKeyCreateParams): Promise<ApiKeyCreateResult>;
+    /** POST /api/v1/api-keys/scoped — L2 delegation token bound to one external user. */
+    createScoped(params: {
+        externalUserId: string;
+        scopes: string[];
+        expiresAt?: string;
+    }): Promise<ApiKeyCreateResult>;
     delete(keyId: string): Promise<void>;
 }
 
@@ -639,7 +720,7 @@ interface CustomDomainData$1 {
  * // 1. Register the domain
  * const domain = await computer.domains.register("app.example.com");
  * console.log(domain.instructions);
- * // => "Add a CNAME record: app.example.com → <slug>.sandbox.<tenant-domain>"
+ * // => "Add a CNAME record: app.example.com → <slug>.sandbox.miosa.ai"
  *
  * // 2. Add the CNAME in your DNS registrar, then...
  *
@@ -755,9 +836,9 @@ interface ComputerData {
     id: ComputerId;
     name: string;
     /**
-     * URL-safe identifier used in preview URLs:
-     * `https://{port}-{slug}.sandbox.{preview_domain}`.
-     * Falls back to the computer id when no slug is assigned.
+     * URL-safe identifier used in preview URLs: `https://{port}-{slug}.sandbox.{preview_domain}`.
+     * Falls back to the computer id when no slug is assigned. The domain is the
+     * tenant's white-label `preview_domain` (server-provided) — never hardcode it.
      */
     slug: string;
     status: ComputerStatus;
@@ -768,9 +849,9 @@ interface ComputerData {
     metadata: Record<string, string>;
     /** Controls who can access the HTTP preview URL. Defaults to `"public"`. */
     visibility: ComputerVisibility;
-    /** Public ingress root, e.g. `https://<slug>.sandbox.<preview_domain>`. */
+    /** Public ingress root, e.g. `https://<slug>.sandbox.<preview_domain>` (server-provided). */
     sandbox_url?: string;
-    /** Tenant's white-label preview/base domain, e.g. `cliniciq.com`. */
+    /** Tenant's white-label preview/base domain (e.g. `cliniciq.com`). Use to build preview URLs. */
     preview_domain?: string;
     /** KasmVNC URL for desktop templates. */
     desktop_url?: string;
@@ -2760,107 +2841,11 @@ interface DeploymentCreateParams extends ExternalAttribution {
     auto_deploy?: boolean;
     autoDeploy?: boolean;
     database?: DeploymentDatabaseRequest;
-    docker_deploy_template_id?: string;
-    dockerDeployTemplateId?: string;
     metadata?: Record<string, unknown>;
     idempotencyKey?: string;
 }
 interface DockerDeployCreateParams extends DeploymentCreateParams {
 }
-interface DockerDeployHostData {
-    id: string;
-    tenant_id?: string;
-    workspace_id?: string | null;
-    computer_id?: string | null;
-    fleet_node_id?: string | null;
-    runtime_base_url?: string | null;
-    status?: string;
-    appliance_status?: string | null;
-    appliance_version?: string | null;
-    appliance_image?: string | null;
-    agent_configured?: boolean;
-    last_health_check_at?: string | null;
-    created_at?: string;
-    updated_at?: string;
-    metadata?: Record<string, unknown>;
-}
-interface DockerDeployHostListParams {
-    workspace_id?: string;
-    workspaceId?: string;
-}
-interface DockerDeployHostEnsureParams {
-    workspace_id: string;
-    workspaceId?: string;
-    region?: string;
-    size?: string;
-    appliance_image?: string;
-    applianceImage?: string;
-    metadata?: Record<string, unknown>;
-    idempotencyKey?: string;
-}
-interface DockerDeployTemplateData {
-    id: string;
-    name: string;
-    summary?: string;
-    description?: string;
-    category?: string;
-    runtime?: string;
-    framework?: string;
-    build_command?: string | null;
-    run_command?: string | null;
-    ports?: number[];
-    env?: Record<string, string>;
-    files?: Record<string, string>;
-    design_md?: string | null;
-    design_source_url?: string | null;
-    design_sources?: string[];
-    design_reference_presets?: DockerDeployDesignReferencePreset[];
-    metadata?: Record<string, unknown>;
-}
-interface DockerDeployDesignReferencePreset {
-    id: string;
-    name: string;
-    summary: string;
-    best_for?: string[];
-}
-interface DockerDeployTemplateListParams {
-    category?: string;
-    runtime?: string;
-    framework?: string;
-    includePreview?: boolean;
-    include_preview?: boolean;
-}
-interface DockerDeployDoctorParams {
-    /** Probe the deployment public URL after checking control-plane metadata. Default: true. */
-    probe?: boolean;
-    /** Path to request on the public URL. Default: "/". */
-    probePath?: string;
-    /** Public URL probe timeout in milliseconds. Default: 20_000. */
-    timeoutMs?: number;
-    /** Test hook or custom runtime fetch implementation. */
-    fetchImpl?: typeof fetch;
-}
-interface DockerDeployDoctorCheck {
-    name: string;
-    ok: boolean;
-    message: string;
-    data?: Record<string, unknown>;
-}
-interface DockerDeployDoctorProbe {
-    url: string;
-    status: number | null;
-    ok: boolean;
-    responseSnippet: string;
-    gatewayJson?: boolean;
-}
-interface DockerDeployDoctorResult {
-    ok: boolean;
-    deployment: DeploymentData;
-    host?: DockerDeployHostData;
-    publicUrl?: string | null;
-    checks: DockerDeployDoctorCheck[];
-    probe?: DockerDeployDoctorProbe;
-}
 interface DeploymentUpdateParams {
     name?: string;
     branch?: string;
@@ -2906,10 +2891,6 @@ interface PublishParams extends ExternalAttribution {
     healthCheckPath?: string;
     /** @deprecated Reserved for dynamic runtime publish. */
     health_check_path?: string;
-    deploymentType?: DeploymentProduct | string;
-    deployment_type?: DeploymentProduct | string;
-    dockerDeployTemplateId?: string;
-    docker_deploy_template_id?: string;
     /** @deprecated Reserved for managed data-service binding. */
     dataServices?: string[];
     /** @deprecated Reserved for managed data-service binding. */
@@ -2995,20 +2976,6 @@ declare class Deployments {
      * deployment so the control plane attaches it to the workspace Docker host.
      */
     createDockerDeploy(params: DockerDeployCreateParams): Promise<DeploymentData>;
-    listDockerDeployHosts(params?: DockerDeployHostListParams): Promise<DockerDeployHostData[]>;
-    ensureDockerDeployHost(params: DockerDeployHostEnsureParams): Promise<DockerDeployHostData>;
-    getDockerDeployHost(hostId: string): Promise<DockerDeployHostData>;
-    /**
-     * Verify a Docker Deploy deployment end-to-end.
-     *
-     * This checks the deployment product marker, Docker Deploy host linkage,
-     * appliance health, route runtime metadata, and optionally the public URL.
-     * It is intentionally agent-friendly: use this after sandbox.deployDocker()
-     * or createDockerDeploy() before telling a user the app is live.
-     */
-    doctorDockerDeploy(deploymentId: string, params?: DockerDeployDoctorParams): Promise<DockerDeployDoctorResult>;
-    listDockerDeployTemplates(params?: DockerDeployTemplateListParams): Promise<DockerDeployTemplateData[]>;
-    getDockerDeployTemplate(templateId: string): Promise<DockerDeployTemplateData>;
     update(deploymentId: string, params: DeploymentUpdateParams): Promise<DeploymentData>;
     delete(deploymentId: string): Promise<void>;
     publish(deploymentId: string, params: PublishParams): Promise<PublishResult>;
@@ -3032,58 +2999,88 @@ declare class Deployments {
     domains(deploymentId: string): DeploymentDomains;
 }
 
-type DeviceKind = "sandbox_worker" | "computer" | "local_device" | "docker_deploy_host";
-type DeviceSource = "sandboxes" | "computers";
-interface DeviceCatalogEntry {
-    kind: DeviceKind;
-    label: string;
-    purpose: string;
-    lifecycle: string;
-    persistence: string;
-    primaryCommands: string[];
-    useWhen: string[];
-    avoidWhen: string[];
+type DockerDeployHostId = string & {
+    readonly __brand: "DockerDeployHostId";
+};
+type DockerDeployHostStatus = "pending" | "provisioning" | "bootstrapping" | "active" | "degraded" | "suspended" | "retired" | "error";
+type DockerDeployApplianceStatus = "not_installed" | "installing" | "starting" | "healthy" | "unhealthy" | "unknown";
+interface DockerDeployHostData {
+    id: DockerDeployHostId;
+    tenant_id: string;
+    workspace_id: string;
+    external_workspace_id?: string | null;
+    computer_id?: string | null;
+    fleet_node_id?: string | null;
+    status: DockerDeployHostStatus;
+    size: string;
+    region: string;
+    portal_domain?: string | null;
+    runtime_base_url?: string | null;
+    agent_base_url?: string | null;
+    appliance_image?: string | null;
+    appliance_version?: string | null;
+    appliance_status: DockerDeployApplianceStatus;
+    agent_last_seen_at?: string | null;
+    metadata?: Record<string, unknown>;
+    created_at?: string;
+    updated_at?: string;
 }
-interface DeviceRecord {
-    id: string;
-    kind: DeviceKind;
-    source: DeviceSource;
-    name?: string;
-    state?: string;
-    ready?: boolean;
-    persistent?: boolean;
-    alwaysOn?: boolean;
-    region?: string;
-    template?: string;
-    previewUrl?: string;
-    timeoutRemainingMs?: number;
+interface DockerDeployHostListParams {
+    workspace_id?: string;
+    workspaceId?: string;
 }
-interface DeviceListError {
-    source: DeviceSource;
-    message: string;
-    retryable: boolean;
+interface DockerDeployHostEnsureParams {
+    workspace_id?: string;
+    workspaceId?: string;
+    external_workspace_id?: string;
+    externalWorkspaceId?: string;
+}
+interface DockerDeployHostListResponse {
+    data?: DockerDeployHostData[];
+    hosts?: DockerDeployHostData[];
 }
-interface DeviceListParams {
-    kind?: "all" | "sandbox_worker" | "sandbox" | "computer";
+interface DockerDeployHostResponse {
+    data?: DockerDeployHostData;
+    host?: DockerDeployHostData;
+    queued?: boolean;
 }
-interface DeviceListResponse {
-    devices: DeviceRecord[];
-    errors: DeviceListError[];
+interface DockerDeployTemplate {
+    id: string;
+    name: string;
+    description?: string;
+    category?: string;
+    runtime?: string;
+    tags?: string[];
+    metadata?: Record<string, unknown>;
+    [key: string]: unknown;
 }
-declare class Devices {
+declare class DockerDeploy {
     private readonly http;
     constructor(http: HttpClient);
     /**
-     * Return the static device catalog used by orchestration apps to choose the
-     * right MIOSA execution surface before creating resources.
+     * List Docker Deploy appliance hosts scoped to the current tenant.
+     *
+     * Pass a workspace ID to inspect the dedicated always-on appliance machine
+     * for one white-label workspace.
      */
-    catalog(): DeviceCatalogEntry[];
+    listHosts(params?: DockerDeployHostListParams): Promise<DockerDeployHostData[]>;
     /**
-     * List hosted devices by normalizing existing sandboxes and computers.
-     * Partial backend failures are returned in `errors` so orchestration UIs can
-     * still show usable inventory instead of failing the whole page.
+     * Ensure a workspace has its dedicated Docker Deploy appliance host.
+     *
+     * The host may still be `pending`, `provisioning`, or `bootstrapping` after
+     * this call. Treat `status === "active"` and `appliance_status === "healthy"`
+     * as the ready condition before sending app/container traffic to it.
      */
-    list(params?: DeviceListParams): Promise<DeviceListResponse>;
+    ensureHost(params?: DockerDeployHostEnsureParams): Promise<{
+        host: DockerDeployHostData;
+        queued: boolean;
+    }>;
+    /** Fetch one Docker Deploy host by ID. */
+    getHost(hostId: string): Promise<DockerDeployHostData>;
+    /** List Docker Deploy starter templates. */
+    listTemplates(): Promise<DockerDeployTemplate[]>;
+    /** Fetch one Docker Deploy starter template by ID. */
+    getTemplate(templateId: string): Promise<DockerDeployTemplate>;
 }
 
 /**
@@ -4483,6 +4480,28 @@ interface SandboxCreateParams {
     timeout_sec?: number;
     idleTimeoutSec?: number;
     idle_timeout_sec?: number;
+    /**
+     * Persistence policy for builder/agent sandboxes.
+     *
+     * MIOSA persistence means the sandbox should snapshot/pause when idle and
+     * resume from that checkpoint later. It does not mean "keep CPU running".
+     * Use alwaysOn for a sandbox that must keep executing without idle pause.
+     */
+    persistent?: boolean;
+    snapshotExpirationSec?: number;
+    snapshot_expiration_sec?: number;
+    snapshotExpirationDays?: number;
+    snapshot_expiration_days?: number;
+    keepLastSnapshots?: number | {
+        count: number;
+        expirationSec?: number;
+        deleteEvicted?: boolean;
+    };
+    keep_last_snapshots?: number | {
+        count: number;
+        expiration_sec?: number;
+        delete_evicted?: boolean;
+    };
     alwaysOn?: boolean;
     always_on?: boolean;
     env?: Record<string, string>;
@@ -4511,6 +4530,15 @@ interface SandboxCreateParams {
     externalProjectId?: string;
     external_project_id?: string;
 }
+interface SandboxGetOrCreateParams extends SandboxCreateParams {
+    name: string;
+    /** Resume an existing paused sandbox before returning it. Defaults to true. */
+    resume?: boolean;
+    /** Wait for readiness before returning a created/resumed sandbox. Defaults to false. */
+    waitUntilReady?: boolean;
+    /** Readiness wait timeout in seconds. Defaults to 60 when waitUntilReady is true. */
+    waitTimeoutSec?: number;
+}
 interface SandboxListParams {
     state?: SandboxState | string;
     tags?: string[];
@@ -4742,8 +4770,6 @@ interface SandboxDeployParams {
     health_check_path?: string;
     deploymentType?: "miosa_deploy" | "docker_deploy" | "docker-deploy" | string;
     deployment_type?: "miosa_deploy" | "docker_deploy" | "docker-deploy" | string;
-    dockerDeployTemplateId?: string;
-    docker_deploy_template_id?: string;
     type?: "static" | "dynamic" | "server" | string;
     mode?: "static" | "dynamic" | "server" | string;
     database?: boolean | Record<string, unknown>;
@@ -4923,9 +4949,28 @@ declare class Sandbox {
         tags?: string[];
         metadata?: Record<string, unknown>;
         always_on?: boolean;
+        alwaysOn?: boolean;
         timeout_sec?: number;
+        timeoutSec?: number;
         idle_timeout_sec?: number;
+        idleTimeoutSec?: number;
+        persistent?: boolean;
+        snapshotExpirationSec?: number;
+        snapshot_expiration_sec?: number;
+        snapshotExpirationDays?: number;
+        snapshot_expiration_days?: number;
+        keepLastSnapshots?: number | {
+            count: number;
+            expirationSec?: number;
+            deleteEvicted?: boolean;
+        };
+        keep_last_snapshots?: number | {
+            count: number;
+            expiration_sec?: number;
+            delete_evicted?: boolean;
+        };
     }): Promise<Sandbox>;
+    extend(timeoutSec: number): Promise<Sandbox>;
     /**
      * POST /api/v1/sandboxes/{id}/preview-token → {token, url, expires_at, scope}
      */
@@ -4975,10 +5020,30 @@ declare class Sandbox {
 declare class Sandboxes {
     private readonly http;
     constructor(http: HttpClient);
+    /**
+     * Create a persistent agent workspace.
+     *
+     * This is the preferred entry point for AI builders, coding agents, and
+     * product workspaces. It gives the sandbox a stable name, a longer interactive
+     * timeout, and metadata that makes the workspace easy to identify later. The
+     * agent should create/edit files in `/workspace`, run installs/tests/builds
+     * inside the sandbox, expose previews from the sandbox, and publish from the
+     * sandbox when ready.
+     */
+    createAgentWorkspace(params: SandboxGetOrCreateParams): Promise<Sandbox>;
     create(params?: SandboxCreateParams): Promise<Sandbox>;
     list(params?: SandboxListParams): Promise<Sandbox[]>;
     get(id: SandboxId | string): Promise<Sandbox>;
     connect(id: SandboxId | string): Promise<Sandbox>;
+    getByName(name: string): Promise<Sandbox>;
+    /**
+     * Idempotently obtain a persistent sandbox by stable name.
+     *
+     * If the sandbox exists, it is returned. If it is paused and `resume !== false`,
+     * it is resumed first. If it does not exist, it is created with the supplied
+     * params. Destroyed sandboxes are permanent and are not resumed by this helper.
+     */
+    getOrCreate(params: SandboxGetOrCreateParams): Promise<Sandbox>;
     delete(id: SandboxId | string): Promise<void>;
     listTemplates(options?: {
         includeAliases?: boolean;
@@ -5328,34 +5393,10 @@ declare class OrgInvites {
 interface TenantPlan {
     id?: string;
     name?: string;
-    preview_domain?: string | null;
-    deployment_domain?: string | null;
-    fallback_miosa_domain?: string | null;
     limits?: Record<string, unknown>;
     usage?: Record<string, unknown>;
     [key: string]: unknown;
 }
-interface BrandingData {
-    logo_url?: string | null;
-    primary_color?: string | null;
-    wordmark?: string | null;
-    favicon_url?: string | null;
-    [key: string]: unknown;
-}
-interface PreviewDomainData {
-    preview_domain?: string | null;
-    deployment_domain?: string | null;
-    fallback_miosa_domain?: string | null;
-    status?: string;
-    [key: string]: unknown;
-}
-interface TenantBrandingUpdateParams {
-    logo_url?: string | null;
-    primary_color?: string | null;
-    wordmark?: string | null;
-    favicon_url?: string | null;
-    [key: string]: unknown;
-}
 declare class Tenant {
     private readonly http;
     constructor(http: HttpClient);
@@ -5498,20 +5539,8 @@ interface WebhookUpdateParams {
     enabled?: boolean;
     [key: string]: unknown;
 }
-interface WebhookSignatureVerifyOptions {
-    /** Maximum age for the webhook timestamp in seconds. Defaults to 300. */
-    toleranceSeconds?: number;
-}
-/**
- * Verify a MIOSA webhook signature header.
- *
- * Header format: `t=<unix_seconds>,v1=<hex_hmac_sha256>`.
- */
-declare function verifySignature(body: string | Buffer | Uint8Array, header: string, secret: string, options?: WebhookSignatureVerifyOptions): boolean;
 declare class Webhooks {
     private readonly http;
-    static verifySignature: typeof verifySignature;
-    static verify_signature: typeof verifySignature;
     constructor(http: HttpClient);
     list(params?: WebhookListParams): Promise<WebhookData[]>;
     get(webhookId: string): Promise<WebhookData>;
@@ -5754,6 +5783,8 @@ declare class WorkspaceInvites {
 declare class Miosa {
     /** Per-workspace user roster — list, add, update role, remove. */
     readonly workspaceMembers: WorkspaceMembers;
+    /** Target-agnostic prompt dispatch to sandboxes/computers with durable records. */
+    readonly agentRuns: AgentRuns;
     /**
      * Workspace invite flow — create invite, list, revoke, preview, accept.
      * Sending to an email already in the org adds the user directly.
@@ -5794,13 +5825,13 @@ declare class Miosa {
     readonly computers: Computers;
     /** Sandboxes — native code-execution environments under `/sandboxes`. */
     readonly sandboxes: Sandboxes;
-    /** Agent device facade — route work across Sandboxes, Computers, and deploy hosts. */
-    readonly devices: Devices;
     /**
      * Deployments — publish from a sandbox to a stable production URL.
      * Versions, releases, rollback, custom domains.
      */
     readonly deployments: Deployments;
+    /** Docker Deploy appliance hosts — one always-on workspace host, many apps. */
+    readonly dockerDeploy: DockerDeploy;
     /** Credit balance and usage. */
     readonly credits: Credits;
     /** Admin surface (`/api/v1/admin/*`) — requires an admin credential. */
@@ -5860,6 +5891,104 @@ declare class Miosa {
     constructor(config: MiosaClientConfig);
 }
 
+/**
+ * AppAuth — end-user authentication client for apps deployed on MIOSA.
+ *
+ * Reads AUTH_URL and AUTH_JWT_SECRET from the process environment at
+ * construction time. Both are injected automatically when a sandbox or
+ * deployment boots.
+ *
+ * @example
+ * ```ts
+ * import { AppAuth } from '@miosa/sdk';
+ *
+ * const auth = new AppAuth({ resourceType: 'deployment', resourceId: 'dep_abc' });
+ *
+ * const session = await auth.signup('alice@example.com', 'hunter2');
+ * console.log(session.userId, session.token);
+ *
+ * const verified = await auth.verifyToken(session.token);
+ * console.log(verified.sub);
+ * ```
+ */
+/** Branded string types for domain safety. */
+type UserId = string & {
+    readonly __brand: "UserId";
+};
+type AuthToken = string & {
+    readonly __brand: "AuthToken";
+};
+/** Response returned by signup, login, verify, and me. */
+interface AppAuthSession {
+    userId: UserId;
+    token: AuthToken;
+    expiresAt: string;
+}
+/** Decoded JWT payload returned by verifyToken. */
+interface AppAuthTokenPayload {
+    sub: string;
+    exp: number;
+    iat: number;
+    [key: string]: unknown;
+}
+type AppAuthResourceType = "sandbox" | "deployment";
+interface AppAuthConfig {
+    /** Resource type — "sandbox" or "deployment". */
+    resourceType: AppAuthResourceType;
+    /** Resource ID (sandbox ID or deployment ID). */
+    resourceId: string;
+    /**
+     * Base URL of the app-auth service. Defaults to the AUTH_URL environment
+     * variable, which is injected at boot inside every MIOSA sandbox/deployment.
+     */
+    authUrl?: string;
+    /**
+     * HS256 secret for verifyToken(). Defaults to AUTH_JWT_SECRET from env.
+     * Only needed if you call verifyToken() server-side.
+     */
+    jwtSecret?: string;
+}
+declare class AppAuth {
+    private readonly baseUrl;
+    private readonly resourceType;
+    private readonly resourceId;
+    private readonly jwtSecret;
+    constructor(config: AppAuthConfig);
+    /** POST /app-auth/:resourceType/:resourceId/signup */
+    signup(email: string, password: string): Promise<AppAuthSession>;
+    /** POST /app-auth/:resourceType/:resourceId/login */
+    login(email: string, password: string): Promise<AppAuthSession>;
+    /**
+     * POST /app-auth/:resourceType/:resourceId/verify
+     * Verifies an email confirmation or magic-link token issued by the backend.
+     */
+    verify(token: string): Promise<AppAuthSession>;
+    /** POST /app-auth/:resourceType/:resourceId/password-reset */
+    passwordReset(email: string): Promise<{
+        ok: boolean;
+    }>;
+    /**
+     * POST /app-auth/:resourceType/:resourceId/logout
+     * Invalidates the given bearer token server-side.
+     */
+    logout(token: AuthToken): Promise<{
+        ok: boolean;
+    }>;
+    /**
+     * GET /app-auth/:resourceType/:resourceId/me
+     * Returns the session for the bearer token.
+     */
+    me(token: AuthToken): Promise<AppAuthSession>;
+    /**
+     * Verifies a JWT token locally using HS256 + AUTH_JWT_SECRET.
+     *
+     * Does NOT make a network call. Throws if the signature is invalid or the
+     * token is expired. Returns the decoded payload on success.
+     */
+    verifyToken(token: string): Promise<AppAuthTokenPayload>;
+    private _post;
+}
+
 interface MiosaErrorBody {
     error?: {
         code?: string;
@@ -5901,4 +6030,4 @@ declare class NetworkError extends MiosaError {
     constructor(message: string, cause: Error);
 }
 
-export { type AcceptOrgInviteResponse, type AcceptWorkspaceInviteResponse, type AddDomainParams, type AddWorkspaceMemberParams, Admin, type AgentDispatchParams, type AgentEvent$1 as AgentEvent, type AgentEventType, type AgentSessionCreateParams, type AgentSessionData, type AgentSessionListResponse$1 as AgentSessionListResponse, type AgentSessionStatus$1 as AgentSessionStatus, type AllowParams, Analytics, type AnalyticsFilters, type ApiKeyCreateParams, type ApiKeyCreateResult, type ApiKeyData, type ApiKeyId, type ApiKeyListParams, ApiKeys, type AppCatalogEntry, type AppInstallData, type AppInstallEvent, type AuditListParams, AuditLog, type AuditLogEvent, type AuditLogListParams, type AuditTailParams, AuthError, type BenchmarkCompareParams, type BenchmarkCreateParams, Benchmarks, type BindingCreateParams, type BindingListParams, type BrandingData, type BrandingUpdateParams, type BucketCreateParams, type BucketData, type BucketId, type BuilderSessionListParams, BuilderSessions, type BulkUserActionParams, type ChannelCreateParams, type ChannelData, type ChannelListParams, type ChannelUpdateParams, Channels, type ChatCompletionCreateParams, type ChatCompletionCreateStreamParams, Checkpoints, type ClickParams, type ClusterCreateParams, type ClusterData, type ClusterEvent, type ClusterId, type ClusterListResponse, type ClusterStatus, CommandCenter, Community, type CompletionCreateParams, type CompletionCreateStreamParams, Completions, Computer, ComputerAudit, ComputerAutoStop, type ComputerCreateParams, type ComputerData, ComputerEnv, type ComputerId, ComputerInbox, type ComputerListParams, type ComputerListResponse, ComputerLogs, type ComputerLogsGetParams, ComputerNetwork, ComputerOsa, ComputerPorts, ComputerSecrets, type ComputerSize, type ComputerStatus, type ComputerTemplateType, ComputerTerminal, type ComputerUpdateParams, type ComputerVisibility, ComputerVolumes, Computers, type CopyParams, type CreateAdminApiKeyParams, type CreateOrgInviteParams, type CreateWorkspaceInviteParams, type CreateWorkspaceInviteResponse, type CreditBalance, type CreditTransaction, type CreditTransactionListResponse, type CreditUsage, Credits, type CronJobCreateParams, type CronJobData, type CronJobExecutionData, type CronJobExecutionId, type CronJobId, type CronJobListParams, type CronJobUpdateParams, CronJobs, type CursorInfo, type CustomDomainCreateParams, type CustomDomainData, type CustomDomainId, type CustomDomainListParams, Dashboard, type DashboardSummary, type DatabaseCreateParams, type DatabaseCredentials, type DatabaseData, type DatabaseId, type DatabaseListParams, type DatabaseLogsParams, type DatabaseLogsResult, Databases, type DeploymentBuildData, type DeploymentCreateParams, type DeploymentData, DeploymentDomains, type DeploymentId, type DeploymentListParams, type DeploymentProduct, type DeploymentReleaseData, type DeploymentReleaseId, DeploymentReleases, DeploymentRuntimeInstances, type DeploymentServiceData, type DeploymentServiceId, type DeploymentServiceType, type DeploymentSourceType, type DeploymentState, type DeploymentUpdateParams, type DeploymentVersionData, type DeploymentVersionId, type DeploymentVersionKind, type DeploymentVersionState, DeploymentVersions, Deployments, Desktop$1 as Desktop, type DesktopActionResult, type DeviceCatalogEntry, type DeviceKind, type DeviceListError, type DeviceListParams, type DeviceListResponse, type DeviceRecord, type DeviceSource, Devices, type DirEntry, type DirListResult, type DiscordSendTestParams, type DockerDeployCreateParams, type DockerDeployDesignReferencePreset, type DockerDeployDoctorCheck, type DockerDeployDoctorParams, type DockerDeployDoctorProbe, type DockerDeployDoctorResult, type DockerDeployHostData, type DockerDeployHostEnsureParams, type DockerDeployHostListParams, type DockerDeployTemplateData, type DockerDeployTemplateListParams, type DoubleClickParams, type DragParams, type EgressAllowlistRule, EgressAudit, type EgressAuditEvent, type EgressBindingData, EgressNetwork, type EgressPolicyData, type EgressPolicyMode, type EgressRuleEffect, type EgressSecretData, type EgressSecretScope, type EgressSecretType, EgressSecrets, type EgressSuggestion, Email, EmailCampaigns, EmailInbox, EmailTemplates, type EmbeddingCreateParams, Embeddings, Exec, type ExecParams, type ExecPythonParams, type ExecResult, type ExternalAttribution, type ExternalKeyCreateParams, type ExternalKeyData, ExternalKeys, type FileDeleteParams, type FileDownloadParams, type FileEntry, type FileExportParams, type FileExportResult, type FileListParams, type FileListResult, type FileStat, Files, FlatCustomDomains, type FsEntry, type FsListResponse, type FsStat, type FunctionCreateParams, type FunctionData, type FunctionId, type FunctionInvokeParams, type FunctionListParams, type FunctionUpdateParams, Functions, type GithubRepo, type GithubSshKey, type HealthCheckCreateParams, type HealthCheckData, type HealthCheckId, type HealthCheckListParams, type HealthCheckUpdateParams, HealthChecks, type HostCreateParams, type HostData, type HostEvent, type HostId, type HostListResponse, type HostStatus, type HostUpdateParams, InsufficientCreditsError, type IntegrationCatalogEntry, type IntegrationData, Integrations, type JobData, type JobEvent, type JobEventType, type JobId, type JobListResponse, type JobRunParams, type JobStatus, type KeyParams, type LaunchParams, type LinearCreateIssueParams, type ListAdminApiKeysParams, type ListAdminComputersParams, type ListAdminTenantsParams, type ListAdminUsersParams, Mcp, type McpDispatchParams, Miosa, type MiosaClientConfig, MiosaError, type MkdirParams, type ModeParams, Models, type MouseButton, NetworkError, NetworkPolicy, type NetworkPolicyData, type NetworkPolicyEffect, type NetworkPolicyProtocol, type NetworkPolicyRule, type NetworkPolicySetParams, NotFoundError, type NotificationPrefsUpdateParams, OAuthFlow, type OauthConnectParams, type OauthProvider, type OauthStartResult, type OauthStatusResult, type ObjectListParams, type AgentEvent as OcAgentEvent, type OcAgentSessionData, type AgentSessionListResponse as OcAgentSessionListResponse, type OcWorkspaceCreateParams, type OcWorkspaceData, type OcWorkspaceEvent, type OcWorkspaceListResponse, type OcWorkspaceStatus, type OcWorkspaceUpdateParams, OpenComputers, type OrgInvite, type OrgInviteCreated, type OrgInviteCreatedResponse, type OrgInviteListResponse, type OrgInvitePreview, type OrgInviteRevokeResponse, OrgInvites, type OrgRole, type OverviewData, type PolicyCreateParams, type PolicyListParams, type PolicyUpdateParams, type PresignParams, type PresignResult, type PreviewDomainData, ProjectAuth, type ProjectAuthEnableParams, type ProjectAuthStatus, type ProjectAuthUpdateParams, type ProjectIntegrationCatalogEntry, type ProjectIntegrationCreateParams, type ProjectIntegrationData, type ProjectIntegrationListParams, type ProjectIntegrationUpdateParams, ProjectIntegrations, ProviderDefaults, type ProviderKeyUpsertParams, type PublishFromSandboxParams, type PublishParams, type PublishResult, RateLimitError, type RegionData, Regions, type RollbackParams, type RulesListParams, type RuntimeInstanceData, type RuntimeInstanceId, type RuntimeInstanceState, type RuntimeLogsResult, SANDBOX_TEMPLATE, Sandbox, SandboxArtifacts, SandboxAudit, type SandboxBuildSpec, type SandboxBuildSpecError, type SandboxBuildSpecValidation, SandboxCommands, type SandboxCreateParams, type SandboxData, SandboxEnv, SandboxEvents, type SandboxExecOptions, type SandboxExecResult, SandboxFiles, type SandboxId, type SandboxListParams, SandboxNetwork, SandboxPreview, SandboxPreviews, SandboxSecrets, type SandboxState, SandboxTags, type SandboxTemplate, type SandboxTemplateBuild, type SandboxTemplateBuildCreateParams, type SandboxTemplateBuildResourceData, type SandboxTemplateBuildResourceId, type SandboxTemplateCreateParams, type SandboxTemplateList, type SandboxTemplateListParams, type SandboxTemplateResourceData, type SandboxTemplateResourceId, SandboxTemplates, SandboxTerminal, Sandboxes, ScopedFs, type ScrollDirection, type ScrollParams, type SecretCreateParams, type SecretData, type SecretId, type SecretListParams, type SecretRotateParams, type SecretSetParams, type SecretUpdateParams, type SessionId, Settings, type SettingsUpdateParams, type SizeData, type SlackSendTestParams, type SnapshotCreateParams, type SnapshotData, type SnapshotListResponse, type SnapshotProgressEvent, type SnapshotRestoreResult, type SnapshotStatus, SnapshotsStandalone, Storage, type StorageObjectData, type SuggestionsParams, type TemplateBuildCreateParams, type TemplateCreateParams, type TemplateData, Tenant, type TenantBrandingUpdateParams, type TenantId, type TenantPlan, type TenantSummary, type TerminalCreateParams, TimeoutError, type TimeseriesParams, type TunnelAuthMode, type TunnelCreateParams, type TunnelData, type TunnelId, type TunnelListResponse, type TunnelUpdateParams, type TypeParams, type UpdateWorkspaceMemberRoleParams, Usage, type UsageReportParams, type UsageSession, type UsageSessionsParams, type UsageSummary, ValidationError, type VersionListParams, type VolumeCreateParams, type VolumeData, type VolumeId, type VolumeListParams, Volumes, type WaitParams, type WebhookCreateParams, type WebhookData, type WebhookDeliveryData, type WebhookDeliveryId, type WebhookId, type WebhookListParams, type WebhookUpdateParams, Webhooks, type WindowFocusParams, type WindowInfo, type WorkspaceId, type WorkspaceInvite, type WorkspaceInviteCreatedResponse, type WorkspaceInviteListResponse, type WorkspaceInvitePreview, type WorkspaceInviteRevokeResponse, WorkspaceInvites, type WorkspaceMember, type WorkspaceMemberAddedResponse, type WorkspaceMemberDeleteResponse, type WorkspaceMemberListResponse, type WorkspaceMemberRecord, type WorkspaceMemberRecordResponse, WorkspaceMembers, type WorkspaceRole, type WsTicket, verifySignature };
+export { type AcceptOrgInviteResponse, type AcceptWorkspaceInviteResponse, type AddDomainParams, type AddWorkspaceMemberParams, Admin, type AgentDispatchParams, type AgentEvent$1 as AgentEvent, type AgentEventType, type AgentRunCreateParams, type AgentRunData, type AgentRunId, type AgentRunListParams, type AgentRunProvider, type AgentRunStatus, type AgentRunTargetKind, AgentRuns, type AgentSessionCreateParams, type AgentSessionData, type AgentSessionListResponse$1 as AgentSessionListResponse, type AgentSessionStatus$1 as AgentSessionStatus, type AllowParams, Analytics, type AnalyticsFilters, type ApiKeyCreateParams, type ApiKeyCreateResult, type ApiKeyData, type ApiKeyId, type ApiKeyListParams, ApiKeys, AppAuth, type AppAuthConfig, type AppAuthResourceType, type AppAuthSession, type AppAuthTokenPayload, type AppCatalogEntry, type AppInstallData, type AppInstallEvent, type AuditListParams, AuditLog, type AuditLogEvent, type AuditLogListParams, type AuditTailParams, AuthError, type AuthToken, type BenchmarkCompareParams, type BenchmarkCreateParams, Benchmarks, type BindingCreateParams, type BindingListParams, type BrandingUpdateParams, type BucketCreateParams, type BucketData, type BucketId, type BuilderSessionListParams, BuilderSessions, type BulkUserActionParams, type ChannelCreateParams, type ChannelData, type ChannelListParams, type ChannelUpdateParams, Channels, type ChatCompletionCreateParams, type ChatCompletionCreateStreamParams, Checkpoints, type ClickParams, type ClusterCreateParams, type ClusterData, type ClusterEvent, type ClusterId, type ClusterListResponse, type ClusterStatus, CommandCenter, Community, type CompletionCreateParams, type CompletionCreateStreamParams, Completions, Computer, ComputerAudit, ComputerAutoStop, type ComputerCreateParams, type ComputerData, ComputerEnv, type ComputerId, ComputerInbox, type ComputerListParams, type ComputerListResponse, ComputerLogs, type ComputerLogsGetParams, ComputerNetwork, ComputerOsa, ComputerPorts, ComputerSecrets, type ComputerSize, type ComputerStatus, type ComputerTemplateType, ComputerTerminal, type ComputerUpdateParams, type ComputerVisibility, ComputerVolumes, Computers, type CopyParams, type CreateAdminApiKeyParams, type CreateOrgInviteParams, type CreateWorkspaceInviteParams, type CreateWorkspaceInviteResponse, type CreditBalance, type CreditTransaction, type CreditTransactionListResponse, type CreditUsage, Credits, type CronJobCreateParams, type CronJobData, type CronJobExecutionData, type CronJobExecutionId, type CronJobId, type CronJobListParams, type CronJobUpdateParams, CronJobs, type CursorInfo, type CustomDomainCreateParams, type CustomDomainData, type CustomDomainId, type CustomDomainListParams, Dashboard, type DashboardSummary, type DatabaseCreateParams, type DatabaseCredentials, type DatabaseData, type DatabaseId, type DatabaseListParams, type DatabaseLogsParams, type DatabaseLogsResult, Databases, type DeploymentBuildData, type DeploymentCreateParams, type DeploymentData, DeploymentDomains, type DeploymentId, type DeploymentListParams, type DeploymentProduct, type DeploymentReleaseData, type DeploymentReleaseId, DeploymentReleases, DeploymentRuntimeInstances, type DeploymentServiceData, type DeploymentServiceId, type DeploymentServiceType, type DeploymentSourceType, type DeploymentState, type DeploymentUpdateParams, type DeploymentVersionData, type DeploymentVersionId, type DeploymentVersionKind, type DeploymentVersionState, DeploymentVersions, Deployments, Desktop$1 as Desktop, type DesktopActionResult, type DirEntry, type DirListResult, type DiscordSendTestParams, DockerDeploy, type DockerDeployApplianceStatus, type DockerDeployCreateParams, type DockerDeployHostData, type DockerDeployHostEnsureParams, type DockerDeployHostId, type DockerDeployHostListParams, type DockerDeployHostListResponse, type DockerDeployHostResponse, type DockerDeployHostStatus, type DoubleClickParams, type DragParams, type EgressAllowlistRule, EgressAudit, type EgressAuditEvent, type EgressBindingData, EgressNetwork, type EgressPolicyData, type EgressPolicyMode, type EgressRuleEffect, type EgressSecretData, type EgressSecretScope, type EgressSecretType, EgressSecrets, type EgressSuggestion, Email, EmailCampaigns, EmailInbox, EmailTemplates, type EmbeddingCreateParams, Embeddings, Exec, type ExecParams, type ExecPythonParams, type ExecResult, type ExternalAttribution, type ExternalKeyCreateParams, type ExternalKeyData, ExternalKeys, type FileDeleteParams, type FileDownloadParams, type FileEntry, type FileExportParams, type FileExportResult, type FileListParams, type FileListResult, type FileStat, Files, FlatCustomDomains, type FsEntry, type FsListResponse, type FsStat, type FunctionCreateParams, type FunctionData, type FunctionId, type FunctionInvokeParams, type FunctionListParams, type FunctionUpdateParams, Functions, type GithubRepo, type GithubSshKey, type HealthCheckCreateParams, type HealthCheckData, type HealthCheckId, type HealthCheckListParams, type HealthCheckUpdateParams, HealthChecks, type HostCreateParams, type HostData, type HostEvent, type HostId, type HostListResponse, type HostStatus, type HostUpdateParams, InsufficientCreditsError, type IntegrationCatalogEntry, type IntegrationData, Integrations, type JobData, type JobEvent, type JobEventType, type JobId, type JobListResponse, type JobRunParams, type JobStatus, type KeyParams, type LaunchParams, type LinearCreateIssueParams, type ListAdminApiKeysParams, type ListAdminComputersParams, type ListAdminTenantsParams, type ListAdminUsersParams, Mcp, type McpDispatchParams, Miosa, type MiosaClientConfig, MiosaError, type MkdirParams, type ModeParams, Models, type MouseButton, NetworkError, NetworkPolicy, type NetworkPolicyData, type NetworkPolicyEffect, type NetworkPolicyProtocol, type NetworkPolicyRule, type NetworkPolicySetParams, NotFoundError, type NotificationPrefsUpdateParams, OAuthFlow, type OauthConnectParams, type OauthProvider, type OauthStartResult, type OauthStatusResult, type ObjectListParams, type AgentEvent as OcAgentEvent, type OcAgentSessionData, type AgentSessionListResponse as OcAgentSessionListResponse, type OcWorkspaceCreateParams, type OcWorkspaceData, type OcWorkspaceEvent, type OcWorkspaceListResponse, type OcWorkspaceStatus, type OcWorkspaceUpdateParams, OpenComputers, type OrgInvite, type OrgInviteCreated, type OrgInviteCreatedResponse, type OrgInviteListResponse, type OrgInvitePreview, type OrgInviteRevokeResponse, OrgInvites, type OrgRole, type OverviewData, type PolicyCreateParams, type PolicyListParams, type PolicyUpdateParams, type PresignParams, type PresignResult, ProjectAuth, type ProjectAuthEnableParams, type ProjectAuthStatus, type ProjectAuthUpdateParams, type ProjectIntegrationCatalogEntry, type ProjectIntegrationCreateParams, type ProjectIntegrationData, type ProjectIntegrationListParams, type ProjectIntegrationUpdateParams, ProjectIntegrations, ProviderDefaults, type ProviderKeyUpsertParams, type PublishFromSandboxParams, type PublishParams, type PublishResult, RateLimitError, type RegionData, Regions, type RollbackParams, type RulesListParams, type RuntimeInstanceData, type RuntimeInstanceId, type RuntimeInstanceState, type RuntimeLogsResult, SANDBOX_TEMPLATE, Sandbox, SandboxArtifacts, SandboxAudit, type SandboxBuildSpec, type SandboxBuildSpecError, type SandboxBuildSpecValidation, SandboxCommands, type SandboxCreateParams, type SandboxData, SandboxEnv, SandboxEvents, type SandboxExecOptions, type SandboxExecResult, SandboxFiles, type SandboxGetOrCreateParams, type SandboxId, type SandboxListParams, SandboxNetwork, SandboxPreview, SandboxPreviews, SandboxSecrets, type SandboxState, SandboxTags, type SandboxTemplate, type SandboxTemplateBuild, type SandboxTemplateBuildCreateParams, type SandboxTemplateBuildResourceData, type SandboxTemplateBuildResourceId, type SandboxTemplateCreateParams, type SandboxTemplateList, type SandboxTemplateListParams, type SandboxTemplateResourceData, type SandboxTemplateResourceId, SandboxTemplates, SandboxTerminal, Sandboxes, ScopedFs, type ScrollDirection, type ScrollParams, type SecretCreateParams, type SecretData, type SecretId, type SecretListParams, type SecretRotateParams, type SecretSetParams, type SecretUpdateParams, type SessionId, Settings, type SettingsUpdateParams, type SizeData, type SlackSendTestParams, type SnapshotCreateParams, type SnapshotData, type SnapshotListResponse, type SnapshotProgressEvent, type SnapshotRestoreResult, type SnapshotStatus, SnapshotsStandalone, Storage, type StorageObjectData, type SuggestionsParams, type TemplateBuildCreateParams, type TemplateCreateParams, type TemplateData, Tenant, type TenantId, type TenantPlan, type TenantSummary, type TerminalCreateParams, TimeoutError, type TimeseriesParams, type TunnelAuthMode, type TunnelCreateParams, type TunnelData, type TunnelId, type TunnelListResponse, type TunnelUpdateParams, type TypeParams, type UpdateWorkspaceMemberRoleParams, Usage, type UsageReportParams, type UsageSession, type UsageSessionsParams, type UsageSummary, type UserId, ValidationError, type VersionListParams, type VolumeCreateParams, type VolumeData, type VolumeId, type VolumeListParams, Volumes, type WaitParams, type WebhookCreateParams, type WebhookData, type WebhookDeliveryData, type WebhookDeliveryId, type WebhookId, type WebhookListParams, type WebhookUpdateParams, Webhooks, type WindowFocusParams, type WindowInfo, type WorkspaceId, type WorkspaceInvite, type WorkspaceInviteCreatedResponse, type WorkspaceInviteListResponse, type WorkspaceInvitePreview, type WorkspaceInviteRevokeResponse, WorkspaceInvites, type WorkspaceMember, type WorkspaceMemberAddedResponse, type WorkspaceMemberDeleteResponse, type WorkspaceMemberListResponse, type WorkspaceMemberRecord, type WorkspaceMemberRecordResponse, WorkspaceMembers, type WorkspaceRole, type WsTicket };