@ninedeploy/sdk 0.10.5 → 0.16.0

package/dist/index.d.ts

@@ -1,1977 +1,16 @@
-import type { ActiveSession, ActivityEntry, AlertRule, AnalyzeRepoInput, CreateAlertRuleInput, ApiToken, PasskeyCredential, Attachment, CreateServiceVolumeAttachmentInput, CreateVolumeBackupInput, ServiceVolumeAttachment, UpdateServiceVolumeAttachmentInput, Backup, BackupWithDb, ComposePreviewRequestInput, ComposePreviewResponse, CreateApiTokenInput, CreateDatabaseInput, CreateDomainInput, CreateProjectInput, CreateServiceInput, CreateSourceInput, CreateTunnelInput, CreateWebhookInput, CreatedApiToken, CreatedWebhook, ConfigItem, ConfigListResponse, SetConfigInput, DoctorFixRequestInput, DoctorFixResponse, DoctorReport, PluginListResponse, PluginInspectResponse, InstallPluginInput, MarketplaceCatalogResponse, MenuListResponse, DemoSeedResult, Deployment, QueueResponse, DeployTemplateInput, DockerResources, Domain, DomainPatch, DomainEntry, EnvVar, Label, CreateLabelInput, LabelPatchInput, Environment, EnvironmentCreateInput, AiConfigStatus, AiConfigUpdate, Login, ManagedDatabase, DatabaseDetail, DatabaseCredentials, PasswordChange, PasswordReset, MetricSeries, ProjectEntry, ProjectPatchInput, PublicUser, Refresh, Register, RepoInsights, Service, ServiceTags, SetServiceTagsInput, Session, SetLimitsInput, Source, StatsSnapshot, Template, TemplateSummary, CommunityTemplateListResult, TopologyGraph, TraefikCertificate, CertificateInventoryEntry, CertificateInventoryReport, TraefikInfo, TraefikStatus, TunnelEntry, UserCreate, VolumeFileEntry, VolumeFileWriteInput, VolumePathCreateInput, TriggerDeploy, UpdateCheckResult, SelfUpdateStatus, UpdateServiceInput, UpsertEnvVarInput, VolumeEntry, Webhook, LogDrain, LogDrainCreateInput, LogDrainUpdateInput, LogDrainTestResult, AutoPruneConfigUpdateInput, AutoPruneStatus, AutoPruneRunResult, ServerSshTest, ServerSshTestResult, ServerSshBootstrap, ServerBootstrapResult, WorkspaceEntry, WorkspaceDetail, WorkspaceCreateInput, WorkspaceUpdateInput, WorkspaceMemberEntry, WorkspaceMemberInviteEntry, WorkspaceMemberAddInput, WorkspaceMemberRoleUpdateInput, OidcPublicProvider, NinedeployManifest, WorkspaceInvitationEntry, WorkspaceInvitationPublic, WorkspaceRole, OidcProviderEntry, OidcProviderCreateInput, OidcProviderUpdateInput } from '@ninedeploy/schemas';
-import { NineDeployError } from './errors.js';
-export { NineDeployError };
+export { NineDeployError } from './errors.js';
 export type * from '@ninedeploy/schemas';
 export { detectProjectKind, formatManifestYaml, ManifestParseError, ManifestValidationError, parseManifestYaml, starterManifest, buildManifestFromTemplate, } from './manifest.js';
 export type { ProjectKind, TemplateRegistryEntry } from './manifest.js';
-/**
- * Minimal structural fetch type so the SDK is isomorphic (browser + Node)
- * without pulling in DOM lib types. Both `globalThis.fetch` implementations
- * satisfy this shape.
- */
-export type FetchLike = (input: string, init: {
-    method?: string;
-    headers?: Record<string, string>;
-    body?: string;
-    credentials?: 'omit' | 'same-origin' | 'include';
-}) => Promise<{
-    ok: boolean;
-    status: number;
-    text(): Promise<string>;
-}>;
-export interface HealthStatus {
-    status: string;
-    db?: string;
-    version?: string;
-    time?: string;
-}
-/**
- * Result of `GET /v1/auth/token`. Tells the caller what
- * the current bearer credential is and what it can do.
- * `kind` is `'session'` for JWTs and `'api'` for opaque
- * API tokens. `scopes` lists the resource-scoped
- * authorities (or the legacy `read` / `write` / `operator`
- * shorthand); an interactive session reports
- * `['session']` which is implicit full authority.
- */
-export interface TokenIntrospection {
-    kind: 'session' | 'api';
-    userId: number;
-    scopes: string[];
-    expiresAt: string | null;
-    isOperator: boolean;
-    /** API tokens only. */
-    tokenId?: number;
-    name?: string;
-}
-export interface TemplateDeployResult {
-    serviceId: number;
-    serviceName: string;
-    serviceSlug: string;
-    deploymentId: number;
-    databaseId: number | null;
-    generatedSecrets: Array<{
-        key: string;
-        value: string;
-    }>;
-    stages: Array<{
-        id: 'service' | 'environment' | 'database' | 'attachment' | 'deployment';
-        status: 'success' | 'skipped';
-        message: string;
-    }>;
-    alreadyInProgress: boolean;
-}
-export interface TemplatePrepareResult {
-    serviceId: number;
-    serviceName: string;
-    serviceSlug: string;
-    deploymentId: number;
-    generatedSecrets: Array<{
-        key: string;
-        value: string;
-    }>;
-    stages: TemplateDeployResult['stages'];
-}
-/**
- * Response from `services.manifest.apply`. The server returns the
- * subset of fields the manifest actually changed under each
- * section; untouched fields stay in the panel-managed column
- * and do not appear in `diff`.
- */
-export interface ApplyManifestResult {
-    ok: boolean;
-    serviceId: number;
-    /** Sections the server actually wrote: `service`, `build_config`. */
-    touched: string[];
-    diff: {
-        service: {
-            port?: number;
-            healthPath?: string;
-            publishedPort?: number | null;
-        };
-        build: {
-            installCmd?: string;
-            buildCmd?: string;
-            startCmd?: string;
-            baseDir?: string;
-            dockerfilePath?: string | null;
-            restartPolicy?: string;
-            stopGraceSeconds?: number;
-        };
-    };
-}
-/** Body for `services.manifest.apply`. The manifest shape itself
- *  comes from `@ninedeploy/schemas`'s `ninedeployManifest` parser. */
-export interface ApplyManifestInput {
-    manifest: NinedeployManifest;
-    /** `merge` (default) preserves fields the manifest omits;
-     *  `replace` is per-field (not per-row) and still leaves
-     *  unmentioned sections alone. */
-    strategy?: 'merge' | 'replace';
-}
-/**
- * Single row from `GET /v1/databases/:id/drills`. The drill
- * is an engine-specific smoke check (pg_restore --list,
- * redis-check-rdb, mysqldump header parse, ...) that proves
- * a backup is at least parseable without spinning up a real
- * database container. `details` is the engine-specific
- * output (object counts, banner, ...).
- */
-export interface BackupDrillResult {
-    drillId: number;
-    ok: true;
-    status: 'passed' | 'failed';
-    durationMs: number;
-    details: Record<string, unknown> | null;
-    error: string | null;
-}
-/** History row from `GET /v1/databases/:id/drills`. */
-export interface BackupDrillEntry {
-    id: number;
-    databaseId: number;
-    backupId: number;
-    status: 'pending' | 'running' | 'passed' | 'failed';
-    engine: string;
-    durationMs: number;
-    error: string | null;
-    details: Record<string, unknown> | null;
-    startedAt: number;
-    completedAt: number | null;
-}
-/**
- * Body for `POST /v1/log-drains/search` (G-16). The
- * search round-trips to the configured Loki drain.
- */
-export interface LogSearchInput {
-    /** Free-text search (case-insensitive substring). */
-    query: string;
-    /** Restrict to one service. */
-    serviceId?: number;
-    /** Window length in minutes (default 15). */
-    sinceMinutes?: number;
-    /** Hard cap on returned lines (default 200, max 1000). */
-    limit?: number;
-    /** Query a specific drain. */
-    drainId?: number;
-}
-export interface LogSearchLine {
-    ts: number;
-    line: string;
-    service: string | null;
-}
-export interface LogSearchResult {
-    drain: {
-        id: number;
-        name: string;
-        type: string;
-    };
-    serviceId: number | null;
-    window: {
-        since: string;
-        until: string;
-    };
-    lines: LogSearchLine[];
-}
-/**
- * Built-in email template names (G-30). The full set
- * lives in `apps/server/src/lib/emailTemplates.ts`; the
- * union here is the closed set the SDK can name. The
- * server validates on the wire (zod enum) — a string
- * the SDK does not know about returns 400.
- */
-export type EmailTemplateName = 'password-reset' | 'workspace-invitation' | 'domain-transfer' | 'backup-drill-failed';
-/** One row from `GET /v1/workspaces/:wid/email-templates`. */
-export interface EmailTemplateEntry {
-    name: EmailTemplateName;
-    /** True when the workspace has an override for this name. */
-    overridden: boolean;
-    /** Override subject; null when the built-in default applies. */
-    subject: string | null;
-    /** Override text body; null when the built-in default applies. */
-    text: string | null;
-}
-/** Result of `POST /v1/workspaces/:wid/email-templates/preview`. */
-export interface EmailTemplateRender {
-    subject: string;
-    text: string;
-    /** True when the rendered text came from a tenant override. */
-    overridden: boolean;
-}
-/**
- * Result of `GET /v1/databases/:id/pgbouncer` (and the
- * post-mutation body of the enable / disable routes).
- * `pooledConnectionString` is non-null only when `running`
- * is true — a `docker inspect` failure on the sidecar
- * reports `enabled: true, running: false` so the panel
- * can surface the discrepancy.
- */
-export interface PgbouncerStatus {
-    enabled: boolean;
-    containerName: string | null;
-    port: number;
-    running: boolean;
-    poolMode: string | null;
-    pooledConnectionString: string | null;
-}
-/**
- * Single image row from `GET /v1/housekeeping/images`. Both
- * the human-readable `size` ("1.2GB") and a parsed byte
- * count are returned so the panel can sort without
- * re-parsing. `inUse` is true when at least one container
- * is currently using the image id.
- */
-export interface ImageInfo {
-    repository: string;
-    tag: string;
-    id: string;
-    size: string;
-    sizeBytes: number;
-    createdAt: string;
-    ageHours: number;
-    dangling: boolean;
-    inUse: boolean;
-}
-/** Body for `POST /v1/housekeeping/images/prune`. The server
- *  refuses the empty-options combination (it would delete
- *  every image not currently in use). */
-export interface PruneImagesInput {
-    keepLast?: number;
-    olderThanHours?: number;
-    danglingOnly?: boolean;
-    dryRun?: boolean;
-}
-export interface PruneImagesResult {
-    freedBytes: number;
-    removed: string[];
-    removedLabels: string[];
-    dryRun: boolean;
-    output: string;
-}
-/**
- * Result of `POST /v1/domains/:id/transfer` (start a
- * transfer). The caller forwards `acceptUrl` to the target
- * user out-of-band; the token is the only secret embedded
- * in the URL.
- */
-export interface StartDomainTransferResult {
-    ok: boolean;
-    transferId: number;
-    acceptUrl: string;
-    expiresAt: number;
-}
-/**
- * Result of `GET /v1/domain-transfers/:token` (preview).
- * `effectivelyExpired` is true when the row is still
- * `pending` server-side but `expiresAt` is in the past;
- * the route reports it as `expired` and refuses accept.
- */
-export interface DomainTransferPreview {
-    id: number;
-    status: 'pending' | 'accepted' | 'cancelled' | 'expired';
-    hostname: string;
-    sourceEmail: string;
-    targetEmail: string;
-    expiresAt: number;
-    createdAt: number;
-    acceptedAt: number | null;
-    cancelledAt: number | null;
-    effectivelyExpired: boolean;
-}
-/** Body for `POST /v1/domain-transfers/:token/accept`. */
-export interface AcceptDomainTransferInput {
-    targetServiceId: number;
-}
-export interface AcceptDomainTransferResult {
-    ok: boolean;
-    transferId: number;
-    domainId: number;
-    serviceId: number;
-    hostname: string;
-}
-export interface NineDeployClientOptions {
-    /** Base URL of the NineDeploy API, e.g. http://localhost:3000. */
-    baseUrl: string;
-    /** Returns the current access token (or bearer credential). */
-    getToken?: () => string | undefined | null;
-    /**
-     * Per-request timeout in milliseconds. A stalled backend must not hang
-     * callers forever (worst in CI, where nothing is interactive to Ctrl-C).
-     * Defaults to 30_000; pass `0` to disable entirely.
-     */
-    timeoutMs?: number;
-    /** Custom fetch implementation (defaults to globalThis.fetch). */
-    fetch?: FetchLike;
-}
-export interface NineDeployClient {
-    auth: {
-        status: () => Promise<{
-            initialized: boolean;
-        }>;
-        /**
-         * Introspect the current bearer token. Returns the
-         * token's id (when opaque), name, scopes, expiry and
-         * the operator flag. Interactive sessions (JWT) report
-         * `scopes: ['session']`. The MCP server uses this to
-         * discover the token's authority before registering
-         * tools.
-         */
-        introspectToken: () => Promise<TokenIntrospection>;
-        setup: (input: Register) => Promise<Session>;
-        register: (input: Register) => Promise<Session>;
-        login: (input: Login) => Promise<Session>;
-        refresh: (input: Refresh) => Promise<Session>;
-        logout: () => Promise<{
-            ok: boolean;
-        }>;
-        /** Self-service password change; revokes other sessions, returns a fresh token pair. */
-        changePassword: (input: PasswordChange) => Promise<Session>;
-        /** Request a reset link (always 200 — no user enumeration). */
-        forgotPassword: (email: string) => Promise<{
-            ok: boolean;
-        }>;
-        /** Complete a reset with a single-use token; revokes all sessions. */
-        resetPasswordWithToken: (input: {
-            token: string;
-            newPassword: string;
-        }) => Promise<{
-            ok: boolean;
-        }>;
-        twoFactor: {
-            /** Generate a pending secret + otpauth URI (auth required). */
-            setup: (input?: {
-                password: string;
-            }) => Promise<{
-                secret: string;
-                otpauthUri: string;
-            }>;
-            enable: (code: string) => Promise<{
-                ok: boolean;
-                totpEnabled: boolean;
-            }>;
-            disable: (input: {
-                password: string;
-                code: string;
-            }) => Promise<{
-                ok: boolean;
-                totpEnabled: boolean;
-            }>;
-        };
-        me: () => Promise<PublicUser>;
-        tokens: {
-            create: (input?: CreateApiTokenInput) => Promise<CreatedApiToken>;
-            list: () => Promise<ApiToken[]>;
-            remove: (id: number) => Promise<void>;
-        };
-        passkeys: {
-            /** Start a registration ceremony (returns JSON options for the browser API). */
-            registerOptions: () => Promise<{
-                options: string;
-            }>;
-            /** Complete registration: verify the browser response, store the credential. */
-            registerVerify: (input: {
-                name: string;
-                response: unknown;
-            }) => Promise<PasskeyCredential>;
-            list: () => Promise<PasskeyCredential[]>;
-            remove: (id: number) => Promise<void>;
-            /** Start a passwordless login ceremony (discoverable credentials). */
-            loginOptions: () => Promise<{
-                options: string;
-            }>;
-            /** Complete passkey login — returns a full session on success. */
-            loginVerify: (response: unknown) => Promise<Session>;
-        };
-        sessions: {
-            list: () => Promise<ActiveSession[]>;
-            revoke: (id: number) => Promise<{
-                ok: boolean;
-            }>;
-        };
-        oidc: {
-            publicProviders: () => Promise<OidcPublicProvider[]>;
-            link: (slug: string) => Promise<{
-                authUrl: string;
-            }>;
-            listProviders: () => Promise<OidcProviderEntry[]>;
-            list: () => Promise<OidcProviderEntry[]>;
-            createProvider: (input: OidcProviderCreateInput) => Promise<OidcProviderEntry>;
-            create: (input: OidcProviderCreateInput) => Promise<OidcProviderEntry>;
-            updateProvider: (id: number, input: OidcProviderUpdateInput) => Promise<OidcProviderEntry>;
-            update: (id: number, input: OidcProviderUpdateInput) => Promise<OidcProviderEntry>;
-            deleteProvider: (id: number) => Promise<{
-                ok: boolean;
-            }>;
-            delete: (id: number) => Promise<{
-                ok: boolean;
-            }>;
-            callback: (slug: string, payload: {
-                code: string;
-                state: string;
-            }) => Promise<Session>;
-        };
-    };
-    workspaces: {
-        list: () => Promise<WorkspaceEntry[]>;
-        get: (id: number) => Promise<WorkspaceDetail>;
-        create: (input: WorkspaceCreateInput) => Promise<WorkspaceEntry>;
-        update: (id: number, input: WorkspaceUpdateInput) => Promise<WorkspaceEntry>;
-        delete: (id: number) => Promise<{
-            ok: boolean;
-        }>;
-        addMember: (id: number, input: WorkspaceMemberAddInput) => Promise<WorkspaceMemberEntry | WorkspaceMemberInviteEntry>;
-        /** Create a pending invitation for an email address that isn't a user yet. */
-        inviteMember: (id: number, input: WorkspaceMemberAddInput) => Promise<WorkspaceInvitationEntry & {
-            acceptUrl: string;
-        }>;
-        listInvitations: (id: number) => Promise<WorkspaceInvitationEntry[]>;
-        revokeInvitation: (id: number, inviteId: number) => Promise<{
-            ok: boolean;
-        }>;
-        /** Look up a pending invitation by its public token (no auth required). */
-        previewInvitation: (token: string) => Promise<WorkspaceInvitationPublic>;
-        /** Accept an invitation as the currently authenticated user. */
-        acceptInvitation: (token: string) => Promise<{
-            ok: boolean;
-            workspaceId: number;
-            role: WorkspaceRole;
-        }>;
-        updateMemberRole: (id: number, memberId: number, input: WorkspaceMemberRoleUpdateInput) => Promise<WorkspaceMemberEntry>;
-        removeMember: (id: number, memberId: number) => Promise<{
-            ok: boolean;
-        }>;
-    };
-    services: {
-        /**
-         * `query` is appended verbatim. Use `?tagWorkspaceIds=1,2&tagProjectIds=3`
-         * to scope the list by tag (each dimension ANDs, members within a
-         * dimension OR). The legacy `?projectId=` query is no longer accepted.
-         */
-        list: (query?: string) => Promise<Service[]>;
-        get: (id: number) => Promise<Service>;
-        create: (input: CreateServiceInput) => Promise<Service>;
-        update: (id: number, input: UpdateServiceInput) => Promise<Service>;
-        /**
-         * Dry-run a compose file before creating anything: blocking reasons,
-         * host-privilege warnings, the declared services and the variables the
-         * stack will ask for. Admin-only, and writes nothing.
-         */
-        composePreview: (input: ComposePreviewRequestInput) => Promise<ComposePreviewResponse>;
-        remove: (id: number) => Promise<void>;
-        stop: (id: number) => Promise<{
-            ok: boolean;
-            status: string;
-        }>;
-        start: (id: number) => Promise<{
-            ok: boolean;
-            status: string;
-        }>;
-        restart: (id: number) => Promise<{
-            ok: boolean;
-            status: string;
-        }>;
-        logs: (id: number) => Promise<{
-            lines: string;
-        }>;
-        clone: (id: number, input?: {
-            name?: string;
-            slug?: string;
-        }) => Promise<Service>;
-        exportUrl: (id: number) => string;
-        importBundle: (bundle: unknown) => Promise<{
-            ok: boolean;
-            serviceId: number;
-            slug: string;
-            message: string;
-        }>;
-        /**
-         * `.ninedeploy` manifest endpoints. The server applies
-         * build / run / network sections to the service + build
-         * config rows (operator > manifest > DB merge semantics);
-         * routes / alerts / database reconcile happens at deploy
-         * time via the deploy pipeline and is intentionally
-         * outside this endpoint's scope.
-         */
-        manifest: {
-            /**
-             * Push a parsed manifest to the panel and reconcile it
-             * into the service. Requires the `admin` role on the
-             * service. The response echoes the diff so the CLI can
-             * render a one-shot summary without a follow-up GET.
-             */
-            apply: (serviceId: number, input: ApplyManifestInput) => Promise<ApplyManifestResult>;
-        };
-    };
-    labels: {
-        /** `query` is appended verbatim, e.g. `?workspaceId=1`. */
-        list: (query?: string) => Promise<Label[]>;
-        create: (input: CreateLabelInput) => Promise<Label>;
-        update: (id: number, input: LabelPatchInput) => Promise<Label>;
-        remove: (id: number) => Promise<{
-            ok: boolean;
-        }>;
-    };
-    /** Deployment lanes (production / staging / development) per workspace. */
-    environments: {
-        list: () => Promise<Environment[]>;
-        create: (input: EnvironmentCreateInput) => Promise<Environment>;
-        rename: (id: number, name: string) => Promise<Environment>;
-        remove: (id: number) => Promise<{
-            ok: boolean;
-        }>;
-    };
-    /** AI failure diagnosis (BYO-key): operator-configured, OpenAI-compatible. */
-    ai: {
-        /** Never carries key material — only endpoint/model + hasApiKey. */
-        getConfig: () => Promise<AiConfigStatus>;
-        updateConfig: (input: AiConfigUpdate) => Promise<{
-            ok: boolean;
-        }>;
-        /** Ask the configured provider to diagnose a failed build log. */
-        diagnose: (serviceId: number, deploymentId: number) => Promise<{
-            diagnosis: string;
-            model: string;
-        }>;
-        /** Describe the app in plain language, get a schema-valid .ninedeploy manifest. */
-        suggestManifest: (description: string) => Promise<{
-            manifest: Record<string, unknown>;
-            model: string;
-        }>;
-    };
-    serviceTags: {
-        /** Read the project's / workspace's / label memberships of a service. */
-        get: (serviceId: number) => Promise<ServiceTags>;
-        /** Replace the membership in a single round-trip. Empty arrays clear. */
-        set: (serviceId: number, input: SetServiceTagsInput) => Promise<ServiceTags>;
-    };
-    deploys: {
-        trigger: (serviceId: number, input?: TriggerDeploy) => Promise<{
-            deploymentId: number;
-        }>;
-        list: (serviceId: number) => Promise<Deployment[]>;
-        /**
-         * Global deploy queue view: every in-flight (queued / building /
-         * deploying) deployment the caller can see, with service + project
-         * metadata. The optional `status` filter is a comma-separated token
-         * list (e.g. `?status=queued,building`).
-         */
-        queue: (query?: string) => Promise<QueueResponse>;
-        rollback: (serviceId: number, deploymentId: number) => Promise<{
-            deploymentId: number;
-        }>;
-        /** Cancel a queued/in-flight deployment (checkpoints abort at step boundaries). */
-        cancel: (serviceId: number, deploymentId: number) => Promise<{
-            ok: boolean;
-            status: string;
-        }>;
-        /**
-         * Remove a finished deployment from history, with its build log.
-         * Refused for an in-flight deployment (cancel it first) and for the one
-         * currently serving traffic. Requires the `admin` role on the service.
-         */
-        remove: (serviceId: number, deploymentId: number) => Promise<{
-            ok: boolean;
-            id: number;
-        }>;
-        /** Build-config + env-key diff against the previous deployment. */
-        configDiff: (serviceId: number, deploymentId: number) => Promise<{
-            deploymentId: number;
-            previousDeploymentId: number | null;
-            changed: boolean;
-            diff: string;
-        }>;
-        /** Build log download URL (serves the raw log file as an attachment). */
-        logDownloadUrl: (serviceId: number, deploymentId: number) => string;
-        /**
-         * Promote: deploy ANOTHER service at this service's exact running
-         * commit — the staging → production lane hop. Both services must
-         * track the same repository and the caller needs `member` on both.
-         */
-        promote: (serviceId: number, targetServiceId: number) => Promise<{
-            ok: boolean;
-            deploymentId: number;
-            commitSha: string;
-            promotedFrom: string;
-        }>;
-    };
-    domains: {
-        list: (serviceId: number) => Promise<Domain[]>;
-        create: (serviceId: number, input: CreateDomainInput) => Promise<Domain>;
-        remove: (serviceId: number, domainId: number) => Promise<void>;
-        /**
-         * DNS status for a domain: does the hostname resolve to the addresses
-         * this panel expects? Advisory — routing is governed by ownership.
-         */
-        dnsCheck: (serviceId: number, domainId: number) => Promise<{
-            hostname: string;
-            status: 'ok' | 'mismatch' | 'unresolved';
-            addresses: {
-                a: string[];
-                aaaa: string[];
-            };
-            expected: string[];
-        }>;
-        /** Update routing extras: ssl toggle, www→apex redirect, custom headers, basicAuth, ipAllowlist, rateLimit. */
-        update: (serviceId: number, domainId: number, input: DomainPatch) => Promise<Domain>;
-        all: () => Promise<DomainEntry[]>;
-        setSsl: (domainId: number, ssl: boolean) => Promise<{
-            id: number;
-            ssl: boolean;
-        }>;
-        /** Toggle sticky-session routing for the service (G-28). */
-        setStickySession: (serviceId: number, enabled: boolean) => Promise<{
-            id: number;
-            enabled: boolean;
-            active: boolean;
-        }>;
-        /**
-         * Start a domain transfer (G-29). The source user (admin
-         * on the source service) names the target email; the
-         * server returns a one-time `acceptUrl` to forward. The
-         * target user accepts via `acceptDomainTransfer(token,
-         * { targetServiceId })`. The transfer expires after 7
-         * days; cancelling is one call.
-         */
-        transfer: (domainId: number, input: {
-            targetEmail: string;
-        }) => Promise<StartDomainTransferResult>;
-        /**
-         * Preview a transfer by token. Does NOT require auth
-         * (the token is the secret) — the panel uses this to
-         * render the accept page to a logged-out visitor.
-         */
-        previewTransfer: (token: string) => Promise<DomainTransferPreview>;
-        /**
-         * Accept a transfer. The caller must be authenticated
-         * and the caller's email must equal the transfer's
-         * target email; the panel / CLI surfaces the preview
-         * first so the user knows what they're signing in to.
-         */
-        acceptTransfer: (token: string, input: AcceptDomainTransferInput) => Promise<AcceptDomainTransferResult>;
-        /**
-         * Cancel a pending transfer. Only the source user
-         * (or an instance operator) can cancel.
-         */
-        cancelTransfer: (token: string) => Promise<{
-            transferId: number;
-            status: 'cancelled';
-        }>;
-    };
-    domainPresets: {
-        /** Every `IDomainProvider` the running kernel has registered. */
-        list: () => Promise<{
-            providers: string[];
-        }>;
-        /**
-         * Manually create the DNS record for `hostname` via the operator's
-         * active provider. `content` is optional: when omitted the route
-         * falls back to the panel's `dns_records_content` setting, then to
-         * `detectPublicIp()`. Returns the upstream recordId so the caller
-         * can correlate.
-         */
-        apply: (input: {
-            hostname: string;
-            content?: string;
-        }) => Promise<{
-            hostname: string;
-            provider: string;
-            zone: string;
-            recordId: string;
-            type: 'A' | 'CNAME';
-            content: string;
-        }>;
-    };
-    configPresets: {
-        /** Every preset the kernel has registered. */
-        list: () => Promise<{
-            presets: string[];
-        }>;
-        /** Fetch a single preset's values + description. */
-        get: (id: string) => Promise<{
-            id: string;
-            description: string | null;
-            values: Record<string, unknown>;
-            createdAt: string;
-        }>;
-        /** Register a new preset. Throws if `id` already exists. */
-        register: (input: {
-            id: string;
-            description?: string;
-            values: Record<string, unknown>;
-        }) => Promise<{
-            ok: boolean;
-            id: string;
-            keyCount: number;
-        }>;
-        /** Write every value in the preset to the live configCenter. */
-        apply: (id: string, opts?: {
-            override?: Record<string, unknown>;
-        }) => Promise<{
-            ok: boolean;
-            id: string;
-            keyCount: number;
-            failureCount?: number;
-            failures?: Array<{
-                key: string;
-                status: 'failed';
-                reason?: string;
-            }>;
-        }>;
-        /** Unregister a preset. Does NOT undo the apply. */
-        remove: (id: string) => Promise<{
-            ok: boolean;
-            id: string;
-        }>;
-    };
-    metricHistory: {
-        /** Current configuration snapshot (backend choice, enabled flag, retention, last-flush). */
-        get: () => Promise<{
-            enabled: boolean;
-            backend: 'builtin' | 'prometheus' | 'influxdb';
-            events: string[];
-            retentionDays: number;
-            lastFlush: {
-                ts: number;
-                backend: string;
-                count: number;
-            };
-        }>;
-        /** Run the built-in backend's retention sweep. Returns the row count trimmed. */
-        flush: () => Promise<{
-            ok: boolean;
-            backend: 'builtin';
-            deleted: number;
-        }>;
-    };
-    buildCache: {
-        /** Per-backend counters + merged totals. G-01 PR-A. */
-        stats: () => Promise<{
-            backends: Array<{
-                name: string;
-                entries: number;
-                totalBytes: number;
-                hits: number;
-                misses: number;
-                stores: number;
-                evictions: number;
-            }>;
-            totals: {
-                entries: number;
-                totalBytes: number;
-                hits: number;
-                misses: number;
-                stores: number;
-                evictions: number;
-            };
-        }>;
-    };
-    orchestrators: {
-        /** Every `IOrchestrator` the running kernel has registered. G-10 PR-A. */
-        list: () => Promise<{
-            orchestrators: Array<{
-                name: string;
-                stacks: Array<{
-                    name: string;
-                    serviceCount: number;
-                }>;
-            }>;
-        }>;
-        /** The stacks one orchestrator knows about. */
-        stacks: (orchestrator: string) => Promise<{
-            stacks: Array<{
-                name: string;
-                serviceCount: number;
-            }>;
-        }>;
-        /**
-         * Stable snapshot of ONE stack. Returns `null` when the orchestrator has
-         * no record of it.
-         *
-         * r036: this used to take only the orchestrator name and hit
-         * `/:name/stacks`, which passed that name through as the STACK name — so
-         * it answered `null` for every stack not coincidentally named after its
-         * orchestrator. The stack now has its own argument and path segment.
-         */
-        stackStatus: (orchestrator: string, stack: string) => Promise<{
-            name: string;
-            services: Array<{
-                name: string;
-                state: 'running' | 'stopped' | 'partial' | 'unknown';
-                replicas: number;
-            }>;
-            appliedAt: string;
-        } | null>;
-    };
-    branding: {
-        /** Read the four operator-overridable branding fields. G-30. */
-        get: () => Promise<{
-            logoUrl: string | null;
-            primaryColor: string | null;
-            supportEmail: string | null;
-            footerHtml: string | null;
-        }>;
-        /** Set one or more branding fields. Empty strings are stored as `null`. */
-        set: (input: {
-            logoUrl?: string | null;
-            primaryColor?: string | null;
-            supportEmail?: string | null;
-            footerHtml?: string | null;
-        }) => Promise<{
-            ok: boolean;
-        }>;
-    };
-    egress: {
-        /** Every egress IP rule across every registered driver. G-15. */
-        list: () => Promise<{
-            drivers: Array<{
-                name: string;
-                rules: Array<{
-                    selector: {
-                        projectId: number;
-                        sourceCidr?: string;
-                    };
-                    ip: string;
-                    createdAt: string;
-                }>;
-            }>;
-        }>;
-        /** Attach an egress IP to a project on the named (or first) driver. */
-        set: (input: {
-            projectId: number;
-            ip: string;
-            driver?: string;
-        }) => Promise<{
-            ok: boolean;
-            driver: string;
-            rule: {
-                selector: {
-                    projectId: number;
-                    sourceCidr?: string;
-                };
-                ip: string;
-                createdAt: string;
-            };
-            /** Present (with `ok: false`) when the route refused the request. */
-            error?: string;
-        }>;
-        /** Detach the rule for a project (on the named or first driver). */
-        clear: (projectId: number, driver?: string) => Promise<{
-            ok: boolean;
-            driver: string;
-            error?: string;
-        }>;
-    };
-    fanout: {
-        /** The extra nodes an image/Dockerfile release is pushed to. */
-        get: (serviceId: number) => Promise<Array<{
-            serverId: number;
-            runtimeId: string | null;
-            status: string;
-        }>>;
-        /** Replace the target-node set (operator-only). */
-        set: (serviceId: number, serverIds: number[]) => Promise<{
-            targets: Array<{
-                serverId: number;
-                runtimeId: string | null;
-                status: string;
-            }>;
-        }>;
-    };
-    scim: {
-        /** SCIM 2.0 provisioning tokens (operator-managed). */
-        listTokens: () => Promise<Array<{
-            id: number;
-            name: string;
-            workspaceId: number;
-            createdAt: string | null;
-            lastUsedAt: string | null;
-            revoked: boolean;
-        }>>;
-        /** The plaintext token is returned exactly once — only its sha256 persists. */
-        createToken: (input: {
-            name: string;
-            workspaceId: number;
-        }) => Promise<{
-            id: number;
-            token: string;
-        }>;
-        revokeToken: (id: number) => Promise<{
-            ok: boolean;
-        }>;
-    };
-    sso: {
-        /** Every configured OIDC / SAML provider. G-22. */
-        listProviders: () => Promise<{
-            providers: Array<{
-                id: number;
-                type: 'oidc' | 'saml';
-                name: string;
-                createdAt: string;
-            }>;
-        }>;
-        /** Add a provider (OIDC issuer URL or SAML metadata URL lives in `config`). */
-        addProvider: (input: {
-            type: 'oidc' | 'saml';
-            name: string;
-            config: Record<string, unknown>;
-        }) => Promise<{
-            ok: boolean;
-            id?: number;
-            name?: string;
-            type?: 'oidc' | 'saml';
-            error?: string;
-        }>;
-        /** Remove a provider by id. */
-        removeProvider: (id: number) => Promise<{
-            ok: boolean;
-        }>;
-    };
-    volumes: {
-        list: () => Promise<VolumeEntry[]>;
-        remove: (name: string) => Promise<void>;
-        prune: () => Promise<{
-            ok: boolean;
-            deleted: number;
-            freedBytes: number;
-        }>;
-        /** File manager: list a directory inside the volume. */
-        listFiles: (name: string, path?: string) => Promise<{
-            path: string;
-            entries: VolumeFileEntry[];
-        }>;
-        /** File manager: read a file (base64 content). */
-        readFile: (name: string, path: string) => Promise<{
-            content: string;
-            encoding: 'utf8' | 'base64';
-        }>;
-        /** File manager: write/overwrite a file (base64 content). */
-        writeFile: (name: string, input: VolumeFileWriteInput) => Promise<{
-            ok: boolean;
-        }>;
-        /** File manager: create a directory. */
-        mkdir: (name: string, input: VolumePathCreateInput) => Promise<{
-            ok: boolean;
-        }>;
-        /** File manager: delete a file or directory (recursive). */
-        deleteFile: (name: string, path: string) => Promise<void>;
-    };
-    containers: {
-        inspect: (container: string) => Promise<ContainerInspectData>;
-        compose: (container: string) => Promise<ContainerComposeData>;
-        /** File manager: list a directory inside the container. */
-        listFiles: (container: string, path?: string) => Promise<{
-            path: string;
-            entries: VolumeFileEntry[];
-        }>;
-        /** File manager: read a file (base64 content). */
-        readFile: (container: string, path: string) => Promise<{
-            content: string;
-            encoding: 'utf8' | 'base64';
-        }>;
-        /** File manager: write/overwrite a file (base64 content). */
-        writeFile: (container: string, input: VolumeFileWriteInput) => Promise<{
-            ok: boolean;
-        }>;
-        /** File manager: create a directory. */
-        mkdir: (container: string, input: VolumePathCreateInput) => Promise<{
-            ok: boolean;
-        }>;
-        makeDir: (container: string, input: VolumePathCreateInput) => Promise<{
-            ok: boolean;
-        }>;
-        /** File manager: delete a file or directory (recursive). */
-        deleteFile: (container: string, path: string) => Promise<void>;
-        deletePath: (container: string, path: string) => Promise<void>;
-    };
-    system: {
-        resources: () => Promise<DockerResources>;
-        pruneImages: () => Promise<{
-            ok: boolean;
-        }>;
-        exportUrl: () => string;
-        /** Latest-release check (admin). updateAvailable is null when offline/disabled. */
-        updateCheck: (force?: boolean) => Promise<UpdateCheckResult>;
-        /** State of a panel-initiated upgrade (idle/running/success/failed/unsupported). */
-        updateStatus: () => Promise<SelfUpdateStatus>;
-        /** Start upgrading the panel itself to an exact release tag; the updater survives the restart it performs. */
-        updateStart: (version: string) => Promise<{
-            ok: boolean;
-        }>;
-        /** Recent docker daemon events (single-shot, for the Docker dashboard feed). */
-        dockerEvents: (minutes?: number) => Promise<{
-            events: Array<{
-                time: string;
-                type: string;
-                action: string;
-                name: string;
-            }>;
-        }>;
-    };
-    networks: {
-        list: () => Promise<{
-            networks: Array<{
-                name: string;
-                driver: string;
-                members: string[];
-                /** True when the network is reserved by NineDeploy (cannot be removed). */
-                isManaged?: boolean;
-            }>;
-            remote: number | null;
-        }>;
-        create: (input: {
-            name: string;
-            driver?: 'bridge' | 'overlay';
-            serverId?: number | null;
-        }) => Promise<{
-            ok: boolean;
-            name: string;
-        }>;
-        remove: (name: string, serverId?: number) => Promise<{
-            ok: boolean;
-        }>;
-        attach: (input: {
-            network: string;
-            container: string;
-            serverId?: number | null;
-        }) => Promise<{
-            ok: boolean;
-        }>;
-        detach: (input: {
-            network: string;
-            container: string;
-            serverId?: number | null;
-        }) => Promise<{
-            ok: boolean;
-        }>;
-    };
-    tunnels: {
-        list: () => Promise<TunnelEntry[]>;
-        create: (input: CreateTunnelInput) => Promise<TunnelEntry>;
-        remove: (id: number) => Promise<void>;
-    };
-    activity: {
-        /** Filter + paginate the audit trail. Omitted filters return the newest page. */
-        list: (query?: {
-            entity?: string;
-            action?: string;
-            userId?: number;
-            before?: number;
-        }) => Promise<{
-            entries: ActivityEntry[];
-            nextCursor: number | null;
-        }>;
-    };
-    alerts: {
-        list: () => Promise<AlertRule[]>;
-        create: (input: CreateAlertRuleInput) => Promise<AlertRule>;
-        update: (id: number, input: Partial<CreateAlertRuleInput>) => Promise<AlertRule>;
-        remove: (id: number) => Promise<void>;
-    };
-    settings: {
-        get: () => Promise<{
-            allowRegistration: boolean;
-            acmeEmail: string | null;
-            templatesSource: string | null;
-            dnsProvider: string | null;
-            hasDnsToken: boolean;
-            wildcardApex: string | null;
-            panelDomain: string | null;
-        }>;
-        setPanelDomain: (domain: string) => Promise<{
-            ok: boolean;
-            panelDomain: string | null;
-        }>;
-        setAllowRegistration: (enabled: boolean) => Promise<{
-            ok: boolean;
-            allowRegistration: boolean;
-        }>;
-        setAcmeEmail: (email: string) => Promise<{
-            ok: boolean;
-            acmeEmail: string | null;
-            applied: string;
-        }>;
-        setTemplatesSource: (source: string) => Promise<{
-            ok: boolean;
-            templatesSource: string | null;
-        }>;
-        /** Configure the ACME DNS-01 challenge (wildcard certificates). */
-        setDns: (input: {
-            provider: string;
-            token?: string;
-            wildcardApex: string;
-        }) => Promise<{
-            ok: boolean;
-            dnsProvider: string | null;
-            wildcardApex: string | null;
-            applied: string;
-        }>;
-        /** Vault provider (deploy-time secret resolution). */
-        vault: {
-            get: () => Promise<{
-                provider: string | null;
-                hasToken: boolean;
-                projectId: string | null;
-                environment: string | null;
-            }>;
-            set: (input: {
-                provider: '' | 'infisical' | 'doppler';
-                token?: string;
-                projectId?: string;
-                environment?: string;
-            }) => Promise<{
-                ok: boolean;
-                provider: string | null;
-            }>;
-            test: () => Promise<{
-                ok: boolean;
-                secrets: number;
-            }>;
-        };
-        /** Cloudflare DNS-record auto-provisioning for added domains. */
-        dnsRecords: {
-            get: () => Promise<{
-                enabled: boolean;
-                hasToken: boolean;
-                content: string | null;
-            }>;
-            set: (input: {
-                enabled: boolean;
-                token?: string;
-                content?: string;
-            }) => Promise<{
-                ok: boolean;
-                enabled: boolean;
-            }>;
-            test: () => Promise<{
-                ok: boolean;
-                status?: string;
-                error?: string;
-            }>;
-        };
-        /** Namecheap DNS-record auto-provisioning for added domains (G-07 PR-A). */
-        namecheap: {
-            get: () => Promise<{
-                configured: boolean;
-                apiUser: string | null;
-                clientIp: string | null;
-                hasKey: boolean;
-            }>;
-            set: (input: {
-                apiUser: string;
-                apiKey: string;
-                clientIp: string;
-            }) => Promise<{
-                ok: boolean;
-                apiUser: string;
-            }>;
-        };
-        /**
-         * Master-key rotation. `rotate` re-encrypts every stored secret onto the
-         * highest key version in `NINEDEPLOY_MASTER_KEYS`; it does NOT rewrite
-         * backup envelopes, which is what `warning` reports.
-         */
-        masterKey: {
-            get: () => Promise<{
-                activeVersion: number;
-                knownVersions: number[];
-                rotatable: boolean;
-            }>;
-            rotate: () => Promise<{
-                rotated: number;
-                activeVersion: number;
-                backupsNotRotated: number;
-                warning: string | null;
-            }>;
-        };
-    };
-    firewall: {
-        status: () => Promise<{
-            installed: boolean;
-            active: boolean;
-            supported: boolean;
-            rules: Array<{
-                id: number;
-                to: string;
-                action: string;
-                from: string;
-                comment?: string;
-            }>;
-            defaultIncoming: string;
-            defaultOutgoing: string;
-        }>;
-        toggle: (enabled: boolean) => Promise<{
-            ok: boolean;
-            status: any;
-        }>;
-        addRule: (input: {
-            port: number | string;
-            proto?: 'tcp' | 'udp' | 'any';
-            action?: 'allow' | 'deny' | 'limit';
-            from?: string;
-            comment?: string;
-        }) => Promise<{
-            ok: boolean;
-            status: any;
-        }>;
-        deleteRule: (id: number | string) => Promise<{
-            ok: boolean;
-            status: any;
-        }>;
-        applyRecommended: () => Promise<{
-            ok: boolean;
-            status: any;
-        }>;
-    };
-    users: {
-        list: () => Promise<PublicUser[]>;
-        /**
-         * Operator-only: create a user directly (no registration flow needed).
-         * The new account has no workspace memberships — an existing owner/admin
-         * must invite it into at least one workspace before it can act.
-         */
-        create: (input: UserCreate) => Promise<PublicUser>;
-        /**
-         * Operator-only: delete a user. The `users.role` column was removed when
-         * authorization became workspace-only; the legacy `setRole` is gone with
-         * it. Role changes go through `workspaces.updateMemberRole`.
-         */
-        remove: (id: number) => Promise<void>;
-        /** Operator reset of another user's password (revokes their sessions). */
-        resetPassword: (id: number, input: PasswordReset) => Promise<{
-            ok: boolean;
-        }>;
-        /** Mint a one-time reset link for a user (returned exactly once). */
-        resetLink: (id: number) => Promise<{
-            url: string;
-            expiresAt: string;
-        }>;
-        /**
-         * Operator-only: grant or revoke the INSTANCE-operator flag.
-         *
-         * Not a workspace role — this is the flag that gates operator-only routes
-         * and the host-privilege boundary (PM2/compose deploys, lifecycle hooks,
-         * docker-socket templates). Creating a workspace does NOT confer it. The
-         * last remaining operator cannot be demoted.
-         */
-        setOperator: (id: number, isOperator: boolean) => Promise<{
-            ok: boolean;
-            id: number;
-            isOperator: boolean;
-        }>;
-    };
-    projects: {
-        /** `query` is appended verbatim, e.g. `?workspaceId=2` (workspace scoping). */
-        list: (query?: string) => Promise<ProjectEntry[]>;
-        create: (input: CreateProjectInput) => Promise<ProjectEntry>;
-        update: (id: number, input: ProjectPatchInput) => Promise<ProjectEntry>;
-        remove: (id: number) => Promise<{
-            ok: boolean;
-        }>;
-    };
-    about: {
-        get: () => Promise<{
-            name: string;
-            version: string;
-            description: string;
-            license: string;
-            repo: string;
-            docs: string;
-            techStack: Array<{
-                category: string;
-                items: string[];
-            }>;
-            changelog: Array<{
-                version: string;
-                date: string;
-                title: string;
-                changes: string[];
-            }>;
-            /** Instance counts are only returned for authenticated requests. */
-            stats?: {
-                services: number;
-                databases: number;
-                deployments: number;
-                users: number;
-            };
-        }>;
-    };
-    notifications: {
-        listChannels: () => Promise<Array<{
-            id: number;
-            name: string;
-            type: string;
-            eventFilter: string;
-            active: boolean;
-            configJson: string | null;
-            createdAt: string;
-        }>>;
-        createChannel: (input: {
-            name: string;
-            type: string;
-            target: string;
-            eventFilter?: string;
-            configJson?: string | null;
-        }) => Promise<{
-            id: number;
-            name: string;
-            type: string;
-        }>;
-        updateChannel: (id: number, input: {
-            name?: string;
-            target?: string;
-            eventFilter?: string;
-            active?: boolean;
-            configJson?: string | null;
-        }) => Promise<{
-            id: number;
-            active: boolean;
-        }>;
-        removeChannel: (id: number) => Promise<void>;
-        testChannel: (id: number) => Promise<{
-            ok: boolean;
-        }>;
-        log: () => Promise<Array<{
-            id: number;
-            channelId: number | null;
-            event: string;
-            entity: string | null;
-            status: string;
-            error: string | null;
-            ts: string;
-        }>>;
-    };
-    sources: {
-        list: () => Promise<Source[]>;
-        create: (input: CreateSourceInput) => Promise<Source>;
-        update: (id: number, input: Partial<CreateSourceInput>) => Promise<Source>;
-        remove: (id: number) => Promise<void>;
-        repos: (id: number) => Promise<Array<{
-            name: string;
-            fullName: string;
-            url: string;
-            defaultBranch: string;
-            isPrivate: boolean;
-        }>>;
-        branches: (id: number, repo: string) => Promise<string[]>;
-        /** Live credential check — proves a stored token still authenticates. */
-        test: (id: number) => Promise<{
-            ok: boolean;
-            provider?: string;
-            login?: string;
-            name?: string | null;
-            status?: number;
-            error?: string;
-        }>;
-        /**
-         * Server-side generation of an ed25519 deploy key pair. The private key
-         * is encrypted into the source row and never leaves the server; only the
-         * public key and fingerprint are returned (the operator pastes the public
-         * key into the Git provider's "Deploy keys" UI).
-         */
-        generateDeployKey: (id: number) => Promise<{
-            publicKey: string;
-            fingerprint: string;
-        }>;
-    };
-    insights: {
-        /** Pre-deploy repository inspection (DeployWizard): clone + framework detection. */
-        analyze: (input: AnalyzeRepoInput) => Promise<RepoInsights>;
-        /** Latest stored analysis for a service (null before the first deploy/refresh). */
-        get: (serviceId: number) => Promise<RepoInsights | null>;
-        /** Re-analyze the service's repository now and store the result. */
-        refresh: (serviceId: number) => Promise<RepoInsights>;
-    };
-    webhooks: {
-        list: (serviceId: number) => Promise<Webhook[]>;
-        create: (serviceId: number, input?: CreateWebhookInput) => Promise<CreatedWebhook>;
-        remove: (serviceId: number, hookId: number) => Promise<void>;
-    };
-    databases: {
-        /** `query` is appended verbatim, e.g. `?projectId=3` (project scoping). */
-        list: (query?: string) => Promise<ManagedDatabase[]>;
-        create: (input: CreateDatabaseInput) => Promise<ManagedDatabase>;
-        get: (id: number) => Promise<DatabaseDetail>;
-        remove: (id: number, options?: {
-            force?: boolean;
-        }) => Promise<void>;
-        restart: (id: number) => Promise<void>;
-        stop: (id: number) => Promise<void>;
-        start: (id: number) => Promise<void>;
-        logs: (id: number, lines?: number) => Promise<{
-            logs: string[];
-        }>;
-        credentials: (id: number) => Promise<DatabaseCredentials>;
-        setLimits: (id: number, input: SetLimitsInput) => Promise<{
-            cpuShares: number | null;
-            memLimitMb: number | null;
-        }>;
-        startStudio: (id: number, port?: number) => Promise<{
-            ok: boolean;
-            port: number;
-            url: string;
-        }>;
-        stopStudio: (id: number) => Promise<{
-            ok: boolean;
-        }>;
-        /**
-         * PgBouncer sidecar (G-32). Returns the current sidecar
-         * state — `enabled` + `running` + the URL the services
-         * should connect to. Use the same call after
-         * `enablePgbouncer` / `disablePgbouncer` for a fresh
-         * read (the route returns the post-mutation status).
-         */
-        pgbouncerStatus: (id: number) => Promise<PgbouncerStatus>;
-        /**
-         * Spin up the sidecar. `port` is optional — the row's
-         * existing `pgbouncerPort` (default 6432) is used
-         * when omitted. Only `engine='postgres'` is supported;
-         * the server returns 422 for any other engine.
-         */
-        enablePgbouncer: (id: number, input?: {
-            port?: number;
-        }) => Promise<PgbouncerStatus>;
-        /** Stop + remove the sidecar and clear the row's flags. */
-        disablePgbouncer: (id: number) => Promise<PgbouncerStatus>;
-        /**
-         * Run an engine-specific smoke check against a backup
-         * file (pg_restore --list, redis-check-rdb, mysqldump
-         * header parse, ...). Returns the drill row with `status`
-         * of `passed` or `failed`; a failed drill is a real
-         * signal that the backup cannot be restored cleanly, not
-         * a warning. Requires the `member` role on the database.
-         */
-        drillBackup: (id: number, input: {
-            backupId: number;
-        }) => Promise<BackupDrillResult>;
-        /** List the most recent drills for a database, newest first. */
-        drills: (id: number) => Promise<BackupDrillEntry[]>;
-    };
-    attachments: {
-        list: (serviceId: number) => Promise<Attachment[]>;
-        create: (serviceId: number, input: {
-            databaseId: number;
-            envAlias?: string;
-            reuseExisting?: boolean;
-        }) => Promise<Attachment>;
-        remove: (serviceId: number, attachmentId: number) => Promise<void>;
-    };
-    /** Per-volume backup history. The base URL is `/v1/volumes/:name/backups`;
-     *  restore + download go through the same path. The global `/v1/backups`
-     *  list/delete are exposed as `backups` below. */
-    volumeBackups: {
-        list: (volumeName: string) => Promise<Backup[]>;
-        create: (volumeName: string, input: CreateVolumeBackupInput) => Promise<Backup>;
-        restore: (volumeName: string, backupId: number) => Promise<{
-            ok: boolean;
-        }>;
-        downloadUrl: (volumeName: string, backupId: number) => string;
-    };
-    /** Per-service additional volume attachments. Distinct from the instance-wide
-     * `volumes` namespace (which lists every Docker volume on the host). The
-     * list endpoint returns runtime-computed metadata (size, in-use, sharing);
-     * the create/update endpoints return the database row only. */
-    serviceVolumes: {
-        list: (serviceId: number) => Promise<Array<ServiceVolumeAttachment & {
-            sizeBytes: number;
-            inUse: boolean;
-            sharedWith: number;
-        }>>;
-        /** Attach an existing managed volume or create a new one and attach it. */
-        create: (serviceId: number, input: CreateServiceVolumeAttachmentInput) => Promise<{
-            attachment: ServiceVolumeAttachment;
-            deploymentId: number;
-        }>;
-        update: (serviceId: number, attachmentId: number, input: UpdateServiceVolumeAttachmentInput) => Promise<{
-            attachment: ServiceVolumeAttachment;
-            deploymentId: number;
-        }>;
-        /** Detach. The underlying Docker volume is NOT deleted (data persists). */
-        remove: (serviceId: number, attachmentId: number) => Promise<void>;
-        /** Delete a first-boot-baked config file from the volume and queue a
-         *  redeploy so the app regenerates it from the current environment
-         *  (WordPress wp-config.php et al.). Exactly one of `attachmentId` /
-         *  `volumeName` must be set; `filePath` is a single path segment. */
-        repairConfig: (serviceId: number, input: {
-            filePath: string;
-            attachmentId?: number;
-            volumeName?: string;
-        }) => Promise<{
-            ok: boolean;
-            deploymentId: number;
-        }>;
-    };
-    env: {
-        list: (serviceId: number) => Promise<EnvVar[]>;
-        create: (serviceId: number, input: UpsertEnvVarInput) => Promise<EnvVar>;
-        update: (serviceId: number, varId: number, input: UpsertEnvVarInput) => Promise<EnvVar>;
-        remove: (serviceId: number, varId: number) => Promise<void>;
-        /** Bulk import from a .env-formatted string. Returns imported/skipped counts. */
-        import: (serviceId: number, content: string) => Promise<{
-            imported: number;
-            skipped: number;
-            errors: Array<{
-                line: number;
-                message: string;
-            }>;
-        }>;
-        /** Export non-secret env vars as a .env-formatted string (admin floor). */
-        export: (serviceId: number) => Promise<{
-            content: string;
-            count: number;
-        }>;
-        /** Cross-scope key search: where a given env key is defined. */
-        search: (q: string) => Promise<{
-            results: Array<{
-                key: string;
-                isSecret: boolean;
-                scope: string;
-                serviceId: number | null;
-                serviceName: string | null;
-            }>;
-        }>;
-    };
-    projectEnv: {
-        /** Shared env vars applied to every service in a project (service env wins). */
-        list: (projectId: number) => Promise<EnvVar[]>;
-        create: (projectId: number, input: UpsertEnvVarInput) => Promise<EnvVar>;
-        update: (projectId: number, varId: number, input: UpsertEnvVarInput) => Promise<EnvVar>;
-        remove: (projectId: number, varId: number) => Promise<void>;
-    };
-    stats: {
-        snapshot: () => Promise<StatsSnapshot>;
-        metrics: (serviceId: number, opts?: {
-            kind?: 'cpu' | 'memory';
-            minutes?: number;
-        }) => Promise<MetricSeries>;
-    };
-    dashboard: {
-        get: () => Promise<{
-            stats: {
-                services: number;
-                databases: number;
-                deployments: number;
-                domains: number;
-                webhooks: number;
-                running: number;
-                stopped: number;
-                errored: number;
-                dbRunning: number;
-                containers: number;
-            };
-            health: Array<{
-                serviceId: number;
-                name: string;
-                slug: string;
-                type: string;
-                status: string;
-                healthy: boolean;
-                responseMs: number | null;
-                port: number | null;
-                runtimeId: string | null;
-                commitSha: string | null;
-                lastDeploy: string | null;
-            }>;
-            recentDeploys: Array<{
-                id: number;
-                serviceId: number;
-                serviceName: string;
-                status: string;
-                commitSha: string | null;
-                message: string | null;
-                trigger: string;
-                finishedAt: string | null;
-                createdAt: string;
-            }>;
-        }>;
-    };
-    topology: {
-        get: () => Promise<TopologyGraph>;
-    };
-    backups: {
-        storage: (databaseId: number) => Promise<{
-            sizeBytes: number;
-        }>;
-        backupNow: (databaseId: number) => Promise<Backup>;
-        listForDb: (databaseId: number) => Promise<Backup[]>;
-        restore: (databaseId: number, backupId: number) => Promise<{
-            ok: boolean;
-        }>;
-        list: () => Promise<BackupWithDb[]>;
-        remove: (backupId: number) => Promise<void>;
-        downloadUrl: (backupId: number) => string;
-    };
-    backupDestinations: {
-        list: () => Promise<Array<{
-            id: number;
-            name: string;
-            endpoint: string;
-            region: string;
-            bucket: string;
-            prefix: string;
-            active: boolean;
-            createdAt: string;
-        }>>;
-        create: (input: {
-            name: string;
-            endpoint: string;
-            region?: string;
-            bucket: string;
-            prefix?: string;
-            accessKeyId: string;
-            secretAccessKey: string;
-        }) => Promise<{
-            id: number;
-        }>;
-        update: (id: number, input: Partial<{
-            name: string;
-            endpoint: string;
-            region: string;
-            bucket: string;
-            prefix: string;
-            active: boolean;
-            accessKeyId: string;
-            secretAccessKey: string;
-        }>) => Promise<{
-            ok: boolean;
-        }>;
-        remove: (id: number) => Promise<{
-            ok: boolean;
-        }>;
-        test: (id: number) => Promise<{
-            ok: boolean;
-        }>;
-    };
-    jobs: {
-        list: (serviceId: number) => Promise<Array<{
-            id: number;
-            name: string;
-            cron: string;
-            kind: 'deploy' | 'exec';
-            command: string;
-            enabled: boolean;
-            lastRunAt: string | null;
-        }>>;
-        create: (serviceId: number, input: {
-            name: string;
-            cron: string;
-            kind: 'deploy' | 'exec';
-            command?: string;
-            enabled?: boolean;
-        }) => Promise<{
-            id: number;
-        }>;
-        update: (serviceId: number, jobId: number, input: Partial<{
-            name: string;
-            cron: string;
-            kind: 'deploy' | 'exec';
-            command: string;
-            enabled: boolean;
-        }>) => Promise<{
-            ok: boolean;
-        }>;
-        remove: (serviceId: number, jobId: number) => Promise<{
-            ok: boolean;
-        }>;
-        run: (serviceId: number, jobId: number) => Promise<{
-            ok: boolean;
-        }>;
-        runs: (serviceId: number, jobId: number) => Promise<Array<{
-            id: number;
-            status: string;
-            output: string;
-            exitCode: number | null;
-            createdAt: string;
-        }>>;
-    };
-    servers: {
-        list: () => Promise<Array<{
-            id: number;
-            name: string;
-            host: string;
-            port: number;
-            status: string;
-            lastSeenAt: string | null;
-        }>>;
-        /** Register a server — the agent token + its sha256 are returned exactly once. */
-        create: (input: {
-            name: string;
-            host: string;
-            port?: number;
-        }) => Promise<{
-            id: number;
-            token: string;
-            tokenSha256: string;
-            agentCommand: string;
-        }>;
-        remove: (id: number, options?: {
-            force?: boolean;
-        }) => Promise<{
-            ok: boolean;
-        }>;
-        test: (id: number) => Promise<{
-            ok: boolean;
-            status: string;
-        }>;
-        approve: (id: number) => Promise<{
-            ok: boolean;
-            status: string;
-        }>;
-        reject: (id: number) => Promise<{
-            ok: boolean;
-        }>;
-        sshTest: (input: ServerSshTest) => Promise<ServerSshTestResult>;
-        sshBootstrap: (input: ServerSshBootstrap) => Promise<ServerBootstrapResult>;
-        bootstrapLogs: (id: number) => Promise<{
-            logs: string[];
-        }>;
-    };
-    templates: {
-        list: () => Promise<TemplateSummary[]>;
-        get: (id: string) => Promise<Template>;
-        prepare: (id: string, input?: DeployTemplateInput) => Promise<TemplatePrepareResult>;
-        deploy: (id: string, input?: DeployTemplateInput) => Promise<TemplateDeployResult>;
-        /**
-         * Community contributions (G-13). The `list` call
-         * already merges community entries with the curated
-         * catalog; the dedicated `community` namespace lets
-         * the panel surface errors and the operator import
-         * a new template from a PR comment or a file.
-         */
-        community: {
-            list: () => Promise<CommunityTemplateListResult>;
-            import: (content: string, opts?: {
-                replace?: boolean;
-            }) => Promise<{
-                ok: boolean;
-                id: string;
-                file: string;
-                bytes: number;
-            }>;
-            remove: (id: string) => Promise<{
-                ok: boolean;
-                id: string;
-                removed: boolean;
-            }>;
-        };
-    };
-    limits: {
-        setService: (serviceId: number, input: SetLimitsInput) => Promise<{
-            cpuShares: number;
-            cpuLimitMilli: number;
-            memLimitMb: number;
-            liveApplied: boolean;
-        }>;
-        setDatabase: (databaseId: number, input: SetLimitsInput) => Promise<{
-            cpuShares: number;
-            cpuLimitMilli: number;
-            memLimitMb: number;
-        }>;
-    };
-    traefik: {
-        get: () => Promise<TraefikInfo>;
-        status: () => Promise<TraefikStatus>;
-        certificates: () => Promise<TraefikCertificate[]>;
-        /**
-         * Richer certificate inventory (G-15). Same
-         * underlying data as `certificates()` but adds a
-         * `status` classification (valid / expiring-soon /
-         * expired), a `summary` block, and the full set of
-         * fields the Certificates page renders.
-         * `threshold` is the days-out cutoff for the
-         * `expiring-soon` bucket; default 30.
-         */
-        certificateInventory: (opts?: {
-            threshold?: number;
-        }) => Promise<CertificateInventoryReport>;
-        /**
-         * Focused "expiring within N days" filter. Default
-         * 30. Used by the alert engine and by the panel's
-         * "About to expire" widget.
-         */
-        expiringCertificates: (opts?: {
-            days?: number;
-        }) => Promise<{
-            threshold: number;
-            count: number;
-            certificates: CertificateInventoryEntry[];
-        }>;
-        logs: (lines?: number) => Promise<{
-            logs: string[];
-        }>;
-        restart: () => Promise<{
-            ok: boolean;
-            message?: string;
-        }>;
-        backupCerts: () => Promise<{
-            ok: boolean;
-            message?: string;
-            filename?: string;
-        }>;
-    };
-    config: {
-        list: (query?: {
-            category?: string;
-            pluginId?: string;
-            reveal?: boolean;
-        }) => Promise<ConfigListResponse>;
-        get: (key: string) => Promise<ConfigItem>;
-        set: (key: string, input: SetConfigInput) => Promise<{
-            ok: boolean;
-            key: string;
-        }>;
-        delete: (key: string) => Promise<{
-            ok: boolean;
-            key: string;
-        }>;
-    };
-    plugins: {
-        list: () => Promise<PluginListResponse>;
-        marketplace: (opts?: {
-            refresh?: boolean;
-        }) => Promise<MarketplaceCatalogResponse>;
-        install: (input: InstallPluginInput) => Promise<{
-            ok: boolean;
-            id: string;
-            status: string;
-        }>;
-        enable: (id: string) => Promise<{
-            ok: boolean;
-            id: string;
-            status: string;
-        }>;
-        disable: (id: string) => Promise<{
-            ok: boolean;
-            id: string;
-            status: string;
-        }>;
-        reload: (id: string) => Promise<{
-            ok: boolean;
-            id: string;
-            status: string;
-        }>;
-        inspect: (id: string) => Promise<PluginInspectResponse>;
-        uninstall: (id: string) => Promise<{
-            ok: boolean;
-            id: string;
-        }>;
-    };
-    menus: {
-        list: (query?: {
-            slot?: string;
-        }) => Promise<MenuListResponse>;
-    };
-    demo: {
-        seed: () => Promise<DemoSeedResult>;
-    };
-    logDrains: {
-        list: (query?: {
-            serviceId?: number;
-        }) => Promise<LogDrain[]>;
-        get: (id: number) => Promise<LogDrain>;
-        create: (input: LogDrainCreateInput) => Promise<LogDrain>;
-        update: (id: number, input: LogDrainUpdateInput) => Promise<LogDrain>;
-        remove: (id: number) => Promise<{
-            ok: boolean;
-        }>;
-        test: (id: number) => Promise<LogDrainTestResult>;
-        /**
-         * Search the configured Loki drain for `query` over
-         * the last `sinceMinutes` (default 15). The route
-         * round-trips to the drain's `url` so the upstream
-         * does the heavy lifting; this is the same shape
-         * the operator sees in the Loki Grafana panel.
-         */
-        search: (input: LogSearchInput) => Promise<LogSearchResult>;
-    };
-    /**
-     * Per-workspace email template overrides (G-30).
-     * Read-side is open to members; write-side requires the
-     * workspace's admin role. The list / preview are safe
-     * to call from a CI script; `set` / `reset` mutate the
-     * panel's outbound email and should be operator-only.
-     */
-    emailTemplates: {
-        list: (workspaceId: number) => Promise<{
-            workspaceId: number;
-            templates: EmailTemplateEntry[];
-        }>;
-        preview: (workspaceId: number, name: EmailTemplateName, vars?: Record<string, string | number | null>) => Promise<EmailTemplateRender>;
-        set: (workspaceId: number, name: EmailTemplateName, subject: string, text: string) => Promise<{
-            ok: boolean;
-        }>;
-        reset: (workspaceId: number, name: EmailTemplateName) => Promise<{
-            ok: boolean;
-        }>;
-    };
-    housekeeping: {
-        getAutoPrune: () => Promise<AutoPruneStatus>;
-        updateAutoPrune: (input: AutoPruneConfigUpdateInput) => Promise<AutoPruneStatus>;
-        runPrune: () => Promise<AutoPruneRunResult>;
-        /**
-         * List every image on the host with repo / tag / size /
-         * created / dangling / inUse metadata. The companion to
-         * the auto-prune cron: this is what the operator
-         * inspects before `pruneImages({ keepLast: 5 })`.
-         */
-        listImages: () => Promise<{
-            images: ImageInfo[];
-            totalCount: number;
-            totalBytes: number;
-        }>;
-        /**
-         * Prune images with operator-supplied filters. `dryRun`
-         * returns the candidate set without deleting. Refused
-         * when no filter is supplied (a naked prune would
-         * delete every unused image).
-         */
-        pruneImages: (input: PruneImagesInput) => Promise<PruneImagesResult>;
-    };
-    /** Host-wide analysis + guarded cleanup. */
-    doctor: {
-        scan: () => Promise<DoctorReport>;
-        fix: (input: DoctorFixRequestInput) => Promise<DoctorFixResponse>;
-    };
-    health: () => Promise<HealthStatus>;
-}
-export interface ContainerInspectData {
-    id: string;
-    name: string;
-    image: string;
-    state: {
-        status: string;
-        running: boolean;
-        startedAt: string;
-        finishedAt: string;
-        exitCode: number;
-        error: string;
-    };
-    labels: Record<string, string>;
-    traefikTags: Record<string, string>;
-    env: string[];
-    ports: Record<string, unknown>;
-    mounts: Array<{
-        source: string;
-        destination: string;
-        mode: string;
-        rw: boolean;
-    }>;
-    networks: string[];
-    resources: {
-        memoryLimitBytes: number;
-        cpuShares: number;
-        restartPolicy: string;
-    };
-    raw: unknown;
-}
-export interface ContainerComposeData {
-    yaml: string;
-    inspect: ContainerInspectData;
-}
-/**
- * Create a typed NineDeploy API client. Used by both the web dashboard and the CLI.
- *
- * @example
- * const client = createClient({ baseUrl: 'http://localhost:3000', getToken: () => token });
- * const services = await client.services.list();
- */
-export declare function createClient(opts: NineDeployClientOptions): NineDeployClient;
+export type { FetchLike, NineDeployClientOptions, } from './transport.js';
+export type { JobKind, ScheduledJob, JobRun, TraefikVersionInfo, TraefikRoutingConfig, HealthStatus, VaultAllowlistView, VaultSettings, TokenIntrospection, TemplateDeployResult, TemplatePrepareResult, ApplyManifestResult, ApplyManifestInput, BackupDrillResult, BackupDrillEntry, LogSearchInput, LogSearchLine, LogSearchResult, EmailTemplateName, EmailTemplateEntry, EmailTemplateRender, PgbouncerStatus, ImageInfo, PruneImagesInput, PruneImagesResult, DomainVerificationChallenge, CreatedDomain, DomainVerifyResult, StartDomainTransferResult, DomainTransferPreview, AcceptDomainTransferInput, AcceptDomainTransferResult, DatabaseCredentialsWithPublic, GithubAppInstallationSync, SourceRepo, SourceUpdateInput, ServerListEntry, ServerRolesResult, SwarmJoinResult, SwarmLeaveResult, VolumeListEntry, VolumeCreateResult, ServiceDetail, NodeTerminalCapability, TerminalListQuery, TrafficQuery, ContainerInspectData, ContainerComposeData, } from './types.js';
+export { DATABASE_IMPORT_FINISHED_STATUSES, } from './databaseImport.js';
+export type { ImportWaitOptions, ImportFileData, ImportFileOptions, } from './databaseImport.js';
+export type { ApiQuery, } from './apiPath.js';
+export { apiGetUrl, } from './apiPath.js';
+export { AGENT_SWARM_MANAGER_VAR, } from './types.js';
+export { TERMINAL_SUBPROTOCOL, TERMINAL_TICKET_PREFIX, TERMINAL_INPUT_CHUNK_BYTES, TERMINAL_PENDING_INPUT_MAX, terminalAttachInfo, terminalCloseMessage, connectTerminal, } from './terminal.js';
+export type { TerminalAttachSource, WebSocketLocation, TerminalAttachInfo, TerminalSocketLike, TerminalSocketFactory, TerminalReady, TerminalHandlers, TerminalConnectOptions, TerminalConnection, } from './terminal.js';
+export { createClient } from './client.js';
+export type { NineDeployClient } from './client.js';
 //# sourceMappingURL=index.d.ts.map