@sovaria/sdk 0.0.0-stage → 0.5.0

package/dist/index.d.ts

@@ -0,0 +1,3562 @@
+export { SovariaError, userMessageFor } from './errors.js';
+export type { SovariaErrorCode } from './errors.js';
+export { base64urlToBuffer, bufferToBase64url, credentialToJSON, creationOptionsFromJSON, passkeysSupported, requestOptionsFromJSON } from './passkeys.js';
+import { DocumentReference, Query, WriteBatch, type Transaction } from './collections.js';
+export { DocumentReference, FieldValue, LiveQuery, Query, Transaction, VectorQuery, WriteBatch, newDocumentId, splitTransforms, and, average, count, filter, or, sum, type AggregateField, type QueryFilter, type DocumentChange, type DocumentSnapshot, type QuerySnapshot, type WhereOp, type DistanceMeasure, type FindNearestOptions, } from './collections.js';
+import { type OfflineController, type OfflineOptions } from './offline.js';
+import { CrashReporter } from './crashes.js';
+export { CrashReporter, distinctId, parseStack, type Breadcrumb, type CrashEvent, type CrashOptions, type SessionPing } from './crashes.js';
+import { PerfMonitor } from './perf.js';
+export { PerfMonitor, type PerfEvent, type PerfKind, type PerfOptions } from './perf.js';
+import { WebPushClient } from './webpush.js';
+import { InAppMessages } from './inapp.js';
+export { InAppMessages, type InAppMessage } from './inapp.js';
+export { WebPushClient, serviceWorkerSource, urlBase64ToUint8Array, type WebPushRegisterOptions } from './webpush.js';
+import { Analytics } from './analytics.js';
+import { RemoteConfig } from './remote-config.js';
+export { Analytics, type AnalyticsEvent, type AnalyticsOptions, type AnalyticsProps } from './analytics.js';
+export { RemoteConfig, type ConfigValue, type RemoteConfigSettings } from './remote-config.js';
+export { evaluateQuery, indexedDbStorage, keyValueStorage, memoryStorage, type OfflineController, type OfflineOptions, type OfflineStorage, } from './offline.js';
+export { ARGON2_HASH_LEN, ARGON2_MEMORY_COST, ARGON2_PARALLELISM, ARGON2_SALT_LEN, ARGON2_TIME_COST, computePayloadHash, decryptDocument, decryptDocumentWithKek, deriveKek, DEK_SIZE_BYTES, encryptDocument, encryptDocumentWithKek, generateSalt, hexToBytes, bytesToHex, NONCE_SIZE_BYTES, zeroBytes, type EncryptedEnvelope, } from './crypto.js';
+export type JsonPrimitive = string | number | boolean | null;
+export type JsonValue = JsonPrimitive | JsonObject | JsonArray;
+export type JsonArray = JsonValue[];
+export type JsonObject = {
+    [key: string]: JsonValue;
+};
+export interface SovariaScope {
+    orgId: string;
+    projectId: string;
+    envId?: string;
+}
+/** Where a signed-in session is kept between page loads (localStorage-compatible). */
+export interface SessionStorageLike {
+    getItem(key: string): string | null;
+    setItem(key: string, value: string): void;
+    removeItem(key: string): void;
+}
+/** The signed-in app user's tokens. `null` when nobody is signed in (anon key only). */
+export interface SovariaSession {
+    access_token: string;
+    refresh_token?: string;
+    /** Epoch milliseconds when the access token expires. */
+    expires_at: number;
+}
+export type AuthChangeEvent = 'INITIAL_SESSION' | 'SIGNED_IN' | 'TOKEN_REFRESHED' | 'SIGNED_OUT';
+export type PersistSessionOption = boolean | {
+    storage?: SessionStorageLike;
+    key?: string;
+};
+export interface SovariaSDKOptions {
+    baseUrl: string;
+    /**
+     * Keep the signed-in session across reloads and tell listeners about sign-in/out.
+     * `true` uses localStorage; pass `{ storage, key }` for anything else (cookies, AsyncStorage adapter…).
+     */
+    persistSession?: PersistSessionOption;
+    accessToken?: string;
+    refreshToken?: string;
+    expiresIn?: number;
+    fetchImpl?: typeof fetch;
+    retryCount?: number;
+    retryBaseDelayMs?: number;
+    /**
+     * Called whenever tokens are set or refreshed (login, refresh, OTP verify, etc.).
+     * The default payload omits `refresh_token`. Use `onTokenRefreshSensitive` if you
+     * explicitly need the refresh token (store it securely; never log it).
+     */
+    onTokenRefresh?: (tokens: JsonObject) => void;
+    /** Opt-in callback that receives the full token JSON including refresh_token. */
+    onTokenRefreshSensitive?: (tokens: JsonObject) => void;
+    /**
+     * Mobile / desktop apps: the device this app runs on. Sessions are grouped by it
+     * (`auth.listDevices`, sign a device out) and push tokens are tied to it. Keep `id` stable
+     * (generate once, store it in the Keychain / Keystore / AsyncStorage).
+     */
+    device?: SovariaDevice;
+    /**
+     * App attestation: returns the current attestation token (from `api.attestation.exchange`)
+     * or null. Sent as `X-Sovaria-Attestation` on every request when the project enforces it.
+     */
+    attestationToken?: () => string | null | undefined | Promise<string | null | undefined>;
+}
+export interface SovariaDevice {
+    id: string;
+    name?: string;
+    platform?: 'ios' | 'android' | 'web' | 'macos' | 'windows' | 'linux' | 'other';
+    appVersion?: string;
+}
+export interface SovariaPortalConfig {
+    url?: string;
+    baseUrl?: string;
+    orgId?: string;
+    org_id?: string;
+    projectId?: string;
+    project_id?: string;
+    envId?: string;
+    env_id?: string;
+    accessToken?: string;
+    access_token?: string;
+    publishableKey?: string;
+    publishable_key?: string;
+    anonKey?: string;
+    anon_key?: string;
+    expiresIn?: number;
+    expires_in?: number;
+    /** Called with new tokens after a refresh — persist them so the user stays signed in. */
+    onTokenRefresh?: (tokens: JsonObject) => void;
+    onTokenRefreshSensitive?: (tokens: JsonObject) => void;
+    /**
+     * Keep the app user's session across reloads (default: on in browsers when a publishable/anon key
+     * is given). `false` turns it off; `{ storage, key }` stores it somewhere else.
+     */
+    persistSession?: PersistSessionOption;
+}
+export interface RequestOptions {
+    query?: Record<string, string | number | boolean | null | undefined>;
+    body?: unknown;
+    headers?: Record<string, string>;
+    requiresAuth?: boolean;
+    requiresScope?: boolean;
+    /**
+     * Idempotency-Key sent on every attempt. Writes (POST/PUT/PATCH/DELETE) get a fresh key per call
+     * when this is not set; pass your own to make a call safe to repeat yourself (same key, same body).
+     */
+    idempotencyKey?: string;
+    /** Kept for compatibility: every write now carries a stable Idempotency-Key from the first attempt. */
+    idempotent?: boolean;
+    /** 'blob' returns the raw response body (binary downloads); default parses JSON or text. */
+    responseType?: 'json' | 'blob';
+    /** Called with the response headers of a successful response (paging cursors, totals). */
+    onResponseHeaders?: (headers: Headers) => void;
+}
+/** `sovaria.data.rpc` options. */
+export interface RpcOptions {
+    /**
+     * Call with GET and the arguments in the query string, for functions that only read. The default
+     * is POST with the arguments as a JSON body.
+     */
+    get?: boolean;
+    /**
+     * PostgREST parameters for functions that return rows: `select`, `order`, `limit`, `offset` and
+     * filters such as `{ status: 'eq.open' }`.
+     */
+    query?: Record<string, string | number | boolean>;
+}
+/** `sovaria.data.dryRunMigrations`: every migration ran in order in one transaction, then rolled back. */
+/** `sovaria.data.schemaDigest`: the schema as one short line per table. */
+export interface SchemaDigest {
+    /** Changes whenever the schema does; pass it back as `since`. */
+    version: string;
+    tables: number;
+    /** Legend first, then one line per table: `orders(id uuid pk=gen_random_uuid(), status text!='pending' in(pending|paid), customer_id uuid →customers cascade) rls:owner(user_id)`. */
+    text?: string;
+    /** Only with `since`, when nothing changed (no `text`). */
+    unchanged?: boolean;
+}
+/** One table in a schema plan. Columns are short form (`"status text!='draft' in(draft|live)"`, `"customer_id →customers cascade"`) or objects. */
+export interface SchemaPlanTable {
+    name: string;
+    columns?: Array<string | {
+        name: string;
+        type?: string;
+        nullable?: boolean;
+        default?: string | number | boolean;
+        unique?: boolean;
+        references?: string;
+        on_delete?: 'cascade' | 'set null' | 'restrict';
+        values?: string[];
+        check?: string;
+        index?: boolean;
+    }>;
+    /** owner_rows: user_id + each signed-in user sees only their rows; public_read (with owner_rows); timestamps; soft_delete. */
+    patterns?: Array<'owner_rows' | 'public_read' | 'timestamps' | 'soft_delete'>;
+    owner?: string;
+    primary_key?: string[];
+    unique?: string[][];
+    indexes?: string[][];
+}
+/** `sovaria.data.applySchemaPlan`: what the plan created and changed, and whether the result matches it. */
+export interface SchemaPlanResult {
+    status: 'applied' | 'dry_run_ok' | 'unchanged';
+    migration_version?: string;
+    created?: string[];
+    /** Per extended table: what was added (`+column`, `idx(..)`, `rls:owner(..)`). */
+    altered?: Record<string, string[]>;
+    notes?: string[];
+    /** The touched tables as they now are (digest lines). */
+    digest?: string;
+    /** With dryRun: the SQL that would run, and its undo. */
+    up_sql?: string;
+    down_sql?: string;
+    verification?: {
+        ok: boolean;
+        checks: Array<{
+            check: string;
+            ok: boolean;
+            problems?: string[];
+        }>;
+    };
+}
+export interface MigrationSequenceResult {
+    status: 'dry_run_ok' | 'failed';
+    /** How many ran cleanly (before the failing one, when one fails). */
+    checked: number;
+    total: number;
+    duration_ms: number;
+    /** The first migration that fails: its position in the list, name and the database error. */
+    failed?: {
+        index: number;
+        name: string;
+        error: string;
+    };
+}
+export interface ProductUsersPage {
+    users: JsonObject[];
+    /** Pass back as `cursor` for the next page; null on the last page. */
+    nextCursor: string | null;
+    /** Users matching the filter; sent with the first page. */
+    total: number | null;
+}
+export declare class SovariaSDK {
+    private readonly baseUrl;
+    private readonly fetchImpl;
+    private readonly retryCount;
+    private readonly retryBaseDelayMs;
+    private accessToken;
+    /** Project anon/publishable key: the token used when no user is signed in. */
+    private publishableKey;
+    /** PKCE verifier for an in-flight provider sign-in (fallback when sessionStorage is unavailable). */
+    private ssoVerifier;
+    /** PKCE verifier for an email link that opens an app (magic link / password reset). */
+    private linkVerifier;
+    private readonly device?;
+    private readonly attestationToken?;
+    private refreshToken;
+    private expiresAtMs;
+    private refreshInFlight;
+    private scope?;
+    /** In-flight lookup of the project/org behind a project URL (see resolveScope). */
+    private scopeLookup?;
+    private readonly onTokenRefresh?;
+    private readonly onTokenRefreshSensitive?;
+    private sessionStore?;
+    private readonly authListeners;
+    /** Session-cached Argon2id salt (hex from login/register). */
+    private argon2Salt?;
+    /** Session-cached KEK derived at login — reused for E2EE document ops. */
+    private cachedKek?;
+    constructor(options: SovariaSDKOptions);
+    /** Device + attestation headers (mobile apps); empty for a plain web or server client. */
+    private clientHeaders;
+    /** Start a PKCE pair for an email link; the verifier is kept (session storage too) until the link is opened. */
+    private startLinkPkce;
+    private takeLinkVerifier;
+    private configureSessionStore;
+    /** Load a stored session (called once the publishable key is known, so sign-out falls back to it). */
+    private restoreSession;
+    private writeSession;
+    private currentSession;
+    private emitAuth;
+    static fromPortalConfig(config: SovariaPortalConfig): SovariaSDK;
+    static fromEnv(env?: Record<string, string | undefined>): SovariaSDK;
+    setAccessToken(token: string, options?: {
+        expiresIn?: number;
+    }): this;
+    setRefreshToken(token: string): this;
+    clearAccessToken(): this;
+    private clearKekCache;
+    private cacheArgon2SaltFromResponse;
+    private tryDeriveKekFromPassword;
+    private applyAuthResponse;
+    private tokenNeedsRefresh;
+    /** Refresh when the token is near expiry, or always with `force` (the server said 401). */
+    private ensureAccessTokenFresh;
+    setScope(scope: SovariaScope): this;
+    clearScope(): this;
+    /**
+     * The org/project this client talks to. Set explicitly with setScope(), or discovered once from
+     * the project URL (https://<ref>.sovarias.in) — so `createClient(projectUrl, anonKey)` is enough.
+     */
+    resolveScope(): Promise<SovariaScope | undefined>;
+    getScopeHeaders(): Record<string, string>;
+    getRealtimeWebSocketUrl(channel: string, ticket?: string): string;
+    issueRealtimeWebSocketTicket(channel: string): Promise<string>;
+    getRealtimeWebSocketUrlWithTicket(channel: string): Promise<string>;
+    private offlineTransport?;
+    /**
+     * Offline-first documents: reads fall back to a local cache, offline writes are applied locally at
+     * once and queued, and everything syncs in order when the connection is back. Call once, before
+     * reading or writing documents.
+     *
+     * ```ts
+     * const offline = sov.enableOffline({ storage: indexedDbStorage(), onSyncError: (e, writes) => console.warn(e, writes) })
+     * ```
+     */
+    enableOffline(options?: OfflineOptions): OfflineController;
+    private documentsTransport;
+    private onlineDocumentsTransport;
+    /**
+     * A document collection (or `users/alice/posts` subcollection): field queries, cursors,
+     * live listeners and `add`.
+     *
+     * ```ts
+     * const snap = await sov.collection('posts').where('tags', 'array-contains', 'news').orderBy('at', 'desc').limit(20).get()
+     * ```
+     */
+    collection<T = JsonObject>(path: string): Query<T>;
+    /**
+     * Every collection with this id at any depth (`comments`, `posts/p1/comments`, …), like Firestore's
+     * `collectionGroup`. Guard rules and row policies apply per matched collection; `onSnapshot` is a live listener on the whole group.
+     *
+     * ```ts
+     * const top = await sov.collectionGroup('comments').where('flagged', '==', true).orderBy('at', 'desc').get()
+     * ```
+     */
+    collectionGroup<T = JsonObject>(collectionId: string): Query<T>;
+    /** A document reference: `get`, `set` (merge), `create`, `update` with FieldValue transforms, `delete`, `onSnapshot`. */
+    doc<T = JsonObject>(path: string): DocumentReference<T>;
+    /** Writes committed together: every one or none. */
+    batch(): WriteBatch;
+    /** Read then write atomically; retried (up to `maxAttempts`) when a document it read changes meanwhile. */
+    runTransaction<R>(fn: (tx: Transaction) => Promise<R>, maxAttempts?: number): Promise<R>;
+    /**
+     * App crash reporting: `sov.crashes.install({ release })` reports uncaught errors (browser and React
+     * Native); `sov.crashes.capture(error)` reports one you caught. Issues appear in the console under
+     * Observability › Crashes.
+     */
+    readonly crashes: CrashReporter;
+    /**
+     * Client performance monitoring: `sov.perf.install({ release })` measures web vitals (LCP, INP, CLS, FCP, TTFB)
+     * and every Sovaria request (joined to the server trace by its `traceparent`); `sov.perf.trace(name, fn)` times
+     * your own steps. Results are in the console under Observability › Performance.
+     */
+    readonly perf: PerfMonitor;
+    /** Web push for browsers with the project's own VAPID keys: `await sov.push.register()` after sign-in. */
+    readonly push: WebPushClient;
+    /** In-app messages (fetch what to show, report impressions / clicks / dismissals) and push open tracking. */
+    readonly inApp: InAppMessages;
+    /**
+     * Product analytics: `sov.analytics.track(name, props)`, `screen(name)`, `identify(userProps)`,
+     * `setEnabled(false)` for an opt-out. Batched, offline-safe; reports in the console under Analytics.
+     */
+    readonly analytics: Analytics;
+    /**
+     * Remote config and feature flags: `setDefaults`, `fetchAndActivate()`, `getBool/getString/getNumber/getJson`,
+     * `onUpdate(cb)` (live after a publish). Values are evaluated on the server for this user.
+     */
+    readonly config: RemoteConfig;
+    request<T = unknown>(method: string, path: string, options?: RequestOptions): Promise<T>;
+    private requestImpl;
+    private pathRequiresScope;
+    private assertScopePresent;
+    private productAuthRequest;
+    private productAuthPath;
+    readonly auth: {
+        /**
+         * Listen for sign-in, token refresh and sign-out. Fires once right away with the current
+         * session (`INITIAL_SESSION`). Returns a function that stops listening.
+         */
+        onAuthStateChange: (callback: (event: AuthChangeEvent, session: SovariaSession | null) => void) => () => void;
+        /** The signed-in app user's session, or null. */
+        getSession: () => SovariaSession | null;
+        /** Sign the app user out (revokes the refresh token) and fall back to the anon key. */
+        signOut: () => Promise<void>;
+        /**
+         * Create an app user and sign them in. When the project requires email confirmation, the
+         * result has `email_verification_required: true` and no session until the user confirms.
+         */
+        signUp: (email: string, password: string, name?: string) => Promise<JsonObject>;
+        /** Sign an app user in with email and password (same as projectLogin). */
+        signIn: (email: string, password: string) => Promise<JsonObject>;
+        /** Create an app user (no session). Most apps want signUp(), which also signs them in. */
+        register: (email: string, password: string, name: string) => Promise<JsonObject>;
+        /**
+         * @deprecated Use {@link consoleLogin} for operators or {@link projectLogin}
+         * for product users. Unscoped calls post to `/api/v1/auth/console/login`.
+         */
+        login: (email: string, password: string) => Promise<JsonObject>;
+        /** Strict console login — rejects every project-scoped credential. */
+        consoleLogin: (email: string, password: string) => Promise<JsonObject>;
+        /** Alias for consoleLogin() matching lane terminology in docs. */
+        loginConsole: (email: string, password: string) => Promise<JsonObject>;
+        /** Strict project login — requires X-Sovaria-Org-ID + X-Sovaria-Project-ID. */
+        projectLogin: (email: string, password: string) => Promise<JsonObject>;
+        /** Alias for projectLogin() matching lane terminology in docs. */
+        loginProduct: (email: string, password: string) => Promise<JsonObject>;
+        refresh: (refreshToken: string) => Promise<JsonObject>;
+        logout: (refreshToken?: string) => Promise<JsonObject>;
+        me: () => Promise<JsonObject>;
+        verifyMfa: (code: string, method?: "totp" | "phone") => Promise<JsonObject>;
+        /** Send a one-time login link by email. Returns 200 even for unknown emails. */
+        /**
+         * Email a sign-in link (plus a 6-digit code). A link that opens a mobile app (`myapp://…` or a
+         * registered app link) is bound to this app with PKCE automatically; pass `pkce: true` to force it.
+         */
+        sendMagicLink: (email: string, opts?: {
+            orgId?: string;
+            projectId?: string;
+            redirectTo?: string;
+            pkce?: boolean;
+        }) => Promise<JsonObject>;
+        /** Email a password-reset link. Returns 200 even for unknown emails. */
+        resetPasswordForEmail: (email: string, opts?: {
+            orgId?: string;
+            projectId?: string;
+            redirectTo?: string;
+            pkce?: boolean;
+        }) => Promise<JsonObject>;
+        /** Set a new password with the token from a reset link (`type=recovery`). */
+        confirmPasswordReset: (token: string, newPassword: string, codeVerifier?: string) => Promise<JsonObject>;
+        /**
+         * Handle the link an auth email opened (`?token=…&type=…` on your Site URL).
+         * Magic links sign the user in; email confirmations are confirmed; for `recovery`
+         * the token is returned so you can show a "new password" form and call
+         * `confirmPasswordReset`. Returns null when the URL isn't an auth link.
+         */
+        handleEmailLink: (url?: string) => Promise<{
+            type: string;
+            error: string;
+            description: string | undefined;
+            session?: undefined;
+            result?: undefined;
+            token?: undefined;
+        } | {
+            type: string;
+            session: JsonObject;
+            error?: undefined;
+            description?: undefined;
+            result?: undefined;
+            token?: undefined;
+        } | {
+            type: string;
+            result: JsonObject;
+            error?: undefined;
+            description?: undefined;
+            session?: undefined;
+            token?: undefined;
+        } | {
+            type: string;
+            token: string;
+            error?: undefined;
+            description?: undefined;
+            session?: undefined;
+            result?: undefined;
+        } | null>;
+        /**
+         * "Sign in with Google / GitHub / …" (providers connected in Authentication › Sign in / Providers).
+         * Sends the browser to the provider; it comes back to `redirectTo` (or your Site URL) with
+         * `?code=…&type=sso`, which `handleEmailLink()` / `exchangeCodeForSession()` turn into a session.
+         * A PKCE verifier is kept in sessionStorage so only this browser can redeem the code.
+         */
+        signInWithProvider: (providerId: string, opts?: {
+            redirectTo?: string;
+            projectId?: string;
+        }) => Promise<{
+            url: string;
+        }>;
+        /**
+         * Enterprise SAML single sign-on for your app's users (connections in Authentication › SAML SSO, Team plan).
+         * Pass the user's work `email` (or its `domain`) to find their company's identity provider, or a
+         * `connectionId`. The browser goes to the IdP and comes back like `signInWithProvider()`:
+         * `?code=…&type=sso`, which `exchangeCodeForSession()` turns into a session.
+         */
+        signInWithSSO: (opts: {
+            email?: string;
+            domain?: string;
+            connectionId?: string;
+            redirectTo?: string;
+            projectId?: string;
+        }) => Promise<{
+            url: string;
+            connectionId: string;
+        }>;
+        /** Exchange the one-time `code` from a provider sign-in redirect for a session. */
+        exchangeCodeForSession: (code: string, codeVerifier?: string) => Promise<JsonObject>;
+        /**
+         * Link another sign-in method (Google/GitHub/SAML…) to the SIGNED-IN user (Supabase `linkIdentity`).
+         * Sends the browser to the provider; it returns to `redirectTo` (or your Site URL) with `?code=…&type=link`,
+         * which `handleEmailLink()` / `exchangeCodeForSession()` complete. The completion is bound to THIS browser by
+         * a PKCE verifier kept in sessionStorage, so a forwarded link can't attach someone else's identity to your
+         * account. An anonymous user who links a verified provider becomes permanent.
+         */
+        linkIdentity: (providerId: string, opts?: {
+            redirectTo?: string;
+        }) => Promise<{
+            url: string;
+        }>;
+        /** The sign-in methods linked to the signed-in user (email, google, saml:…, passkey). */
+        getUserIdentities: () => Promise<JsonObject>;
+        /** Remove a linked sign-in method (never the last one). Pass a recent-auth `nonce` if the project requires it. */
+        unlinkIdentity: (identityId: string, opts?: {
+            nonce?: string;
+        }) => Promise<JsonObject>;
+        /** Enabled social / enterprise providers for your sign-in screen. */
+        listProviders: (projectId?: string) => Promise<JsonValue>;
+        /** Public sign-in config for a project: enabled providers, password rules, MFA factors, passkeys. */
+        getPublicConfig: (projectId?: string) => Promise<JsonObject>;
+        /** Exchange a magic-link token for an access + refresh token pair. */
+        verifyMagicLink: (token: string, codeVerifier?: string) => Promise<JsonObject>;
+        /**
+         * Sign in with the 6-digit code from the sign-in email (the same email carries the magic link).
+         * Uses the client scope's org/project unless given.
+         */
+        verifyEmailCode: (email: string, code: string, opts?: {
+            orgId?: string;
+            projectId?: string;
+        }) => Promise<JsonObject>;
+        /** Send an SMS OTP code for phone-based login. */
+        sendOtp: (phone: string, opts?: {
+            orgId?: string;
+            projectId?: string;
+            envId?: string;
+        }) => Promise<JsonObject>;
+        /** Verify an SMS OTP code and establish a session.
+         * Passwordless by default — pass `password` when argon2_salt is present to
+         * populate the session KEK without a follow-up password login.
+         */
+        verifyOtp: (phone: string, code: string, opts?: {
+            orgId?: string;
+            projectId?: string;
+            envId?: string;
+            password?: string;
+        }) => Promise<JsonObject>;
+        /** Exchange an OAuth handoff token for a session (console OAuth callback).
+         * Passwordless: session KEK is not derived unless `password` is supplied.
+         */
+        oauthHandoff: (token: string, password?: string) => Promise<JsonObject>;
+        /** Console-operator listing of product users across accessible projects. Path: GET /api/v1/auth/product-users (console lane). */
+        listConsoleProductUsers: () => Promise<JsonValue>;
+        /** Trigger a verification email for the authenticated user. */
+        sendVerificationEmail: () => Promise<JsonObject>;
+        /** Confirm an email-verification token. */
+        confirmVerificationEmail: (token: string) => Promise<JsonObject>;
+        /**
+         * Auth event hooks (per-project HTTP webhooks). The project is the client's scope
+         * (`X-Sovaria-Project-ID`); the caller must be an owner or admin of it.
+         */
+        eventHooks: {
+            list: () => Promise<JsonValue>;
+            create: (payload: {
+                name: string;
+                url: string;
+                events: string[];
+                secret?: string;
+                enabled?: boolean;
+                projectId?: string;
+            }) => Promise<JsonObject>;
+            delete: (hookId: string) => Promise<JsonObject>;
+        };
+        /**
+         * Blocking hooks (before-create, before-sign-in): a webhook or one of the project's functions that can
+         * refuse a sign-up / sign-in or add custom claims. Project owners and admins; plan key `auth.blocking_hooks`.
+         * `set` returns the signing secret once (`secret`) when it is created or `rotateSecret` is true.
+         */
+        blockingHooks: {
+            get: () => Promise<JsonObject>;
+            set: (event: "before_create" | "before_sign_in", hook: {
+                target?: "webhook" | "function";
+                url?: string;
+                function?: string;
+                timeoutMs?: number;
+                fail?: "closed" | "open";
+                enabled?: boolean;
+                rotateSecret?: boolean;
+            }) => Promise<JsonObject>;
+            delete: (event: "before_create" | "before_sign_in") => Promise<JsonObject>;
+            /** Send a sample event and get the hook's decision (`allowed`, `claims`, `message`, `failed`, `error`, `latency_ms`). */
+            test: (event: "before_create" | "before_sign_in", sample?: {
+                email?: string;
+                provider?: string;
+            }) => Promise<JsonObject>;
+        };
+        /**
+         * SCIM 2.0 provisioning of the project's app users and groups (Okta, Entra ID …). `createToken` turns it on or
+         * rotates the token (the old one stops at once) and returns it once with the `base_url` for the identity
+         * provider. Plan key `auth.scim`.
+         */
+        scim: {
+            status: () => Promise<JsonObject>;
+            createToken: () => Promise<JsonObject>;
+            revokeToken: () => Promise<JsonObject>;
+        };
+        /**
+         * @deprecated Legacy GET `/api/v1/auth/users`. Use `productUsers.list()` for
+         * project-scoped product users or `listConsoleProductUsers()` for the console
+         * product-user admin path. Use `consoleMembers.list()` for org console members.
+         */
+        listUsers: () => Promise<JsonValue>;
+        /**
+         * @deprecated Legacy DELETE `/api/v1/auth/users/{id}`. Use `productUsers.delete()`
+         * or `consoleMembers.delete()`.
+         */
+        deleteUser: (userId: string) => Promise<JsonObject>;
+        /**
+         * @deprecated Legacy POST `/api/v1/auth/users/{id}/ban`. Use `productUsers.ban()`.
+         */
+        banUser: (userId: string) => Promise<JsonObject>;
+        /** Org console-member management. Canonical path: GET /api/v1/org/{orgId}/members. Not product users. */
+        consoleMembers: {
+            list: () => Promise<JsonValue>;
+            delete: (userId: string) => Promise<JsonObject>;
+            ban: (userId: string) => Promise<JsonObject>;
+        };
+        /** Product auth admin (project-scoped identities). Path: GET /api/v1/projects/{id}/auth/users. Requires setScope. */
+        productUsers: {
+            /** Every product user: follows all pages. Use `listPage()` for big projects. */
+            list: () => Promise<JsonObject[]>;
+            /** One page of product users, newest first. `search` matches part of an email or an exact id. */
+            listPage: (params?: {
+                limit?: number;
+                cursor?: string | null;
+                search?: string;
+                status?: "active" | "banned";
+            }) => Promise<ProductUsersPage>;
+            delete: (userId: string) => Promise<JsonObject>;
+            ban: (userId: string) => Promise<JsonObject>;
+            roles: (userId: string) => Promise<JsonObject>;
+            setRoles: (userId: string, roles: string[]) => Promise<JsonObject>;
+            create: (payload: {
+                email: string;
+                password: string;
+                name?: string;
+                roles?: string[];
+            }) => Promise<JsonObject>;
+            /**
+             * Bulk-import app users (up to 1,000 per call) with their ids and password hashes: `bcrypt`
+             * (Supabase) as is, `firebase_scrypt` (Firebase) checked with `hashConfig` and upgraded to bcrypt
+             * at first sign-in. No emails, hooks or triggers fire; existing emails are skipped. Org owners/admins.
+             */
+            import: (users: Array<{
+                email: string;
+                id?: string;
+                email_verified?: boolean;
+                phone?: string | null;
+                display_name?: string | null;
+                password_algorithm?: "bcrypt" | "firebase_scrypt" | null;
+                password_hash?: string | null;
+                password_salt?: string | null;
+            }>, hashConfig?: {
+                signer_key: string;
+                salt_separator: string;
+                rounds: number;
+                mem_cost: number;
+            }) => Promise<JsonObject>;
+        };
+        sessions: {
+            list: () => Promise<JsonValue>;
+            revoke: (sessionId: string) => Promise<JsonObject>;
+            revokeOthers: () => Promise<JsonObject>;
+            getConfig: () => Promise<JsonObject>;
+            setConfig: (body: JsonObject) => Promise<JsonObject>;
+        };
+        providersConfig: {
+            get: () => Promise<JsonObject>;
+            set: (body: JsonObject) => Promise<JsonObject>;
+        };
+        /**
+         * Passkeys (WebAuthn): add one for the signed-in user, sign in with one, list and remove them.
+         * The project must have passkeys set up (Users › Passkeys). `register()` and `signIn()` run the
+         * browser ceremony; on other platforms use the `start…` / `finish…` calls with your own WebAuthn API.
+         *
+         * ```ts
+         * await sov.auth.passkeys.register('MacBook')          // signed in: Touch ID creates a passkey
+         * const session = await sov.auth.passkeys.signIn()     // later: sign in with it, no email needed
+         * ```
+         */
+        passkeys: {
+            /** True when this browser can create and use passkeys. */
+            isSupported: () => boolean;
+            /** Registration options for the signed-in user (their existing passkeys are excluded). */
+            startRegistration: (name?: string) => Promise<JsonObject>;
+            /** Save the credential the authenticator created (`credential` is WebAuthn JSON). */
+            finishRegistration: (credential: JsonObject, name?: string) => Promise<JsonObject>;
+            /** Create a passkey for the signed-in user with the browser's WebAuthn API and save it. */
+            register: (name?: string) => Promise<JsonObject>;
+            /** Sign-in options: `{ challenge_id, options }`. Pass `userId` to offer only that user's passkeys. */
+            startSignIn: (opts?: {
+                userId?: string;
+            }) => Promise<JsonObject>;
+            /** Verify the signed challenge and sign the user in (the session is kept and refreshed like any sign-in). */
+            finishSignIn: (challengeId: string, credential: JsonObject) => Promise<JsonObject>;
+            /** Sign in with a passkey using the browser's WebAuthn API. Resolves to the session tokens (`aal` says if it was two-factor). */
+            signIn: (opts?: {
+                userId?: string;
+            }) => Promise<JsonObject>;
+            /** The signed-in user's passkeys: id, name, created_at, last_used_at. */
+            list: () => Promise<JsonValue>;
+            /** Remove one of the signed-in user's passkeys. */
+            remove: (passkeyId: string) => Promise<JsonValue>;
+        };
+        mfa: {
+            status: () => Promise<JsonObject>;
+            enroll: () => Promise<JsonObject>;
+            disable: (totpCode: string) => Promise<JsonObject>;
+        };
+        github: {
+            connectionState: () => Promise<JsonObject>;
+            disconnect: () => Promise<JsonObject>;
+        };
+    };
+    readonly graph: {
+        /**
+         * Create an org, project or environment node. For a PROJECT, `options.databasePassword` sets the
+         * project's database password (12–72 characters, letters, numbers and symbols; no spaces, quotes,
+         * backslashes or backticks). Without it the database gets a random password you can change later.
+         */
+        createNode: (nodeType: string, name: string, metadata?: JsonObject, options?: {
+            databasePassword?: string;
+        }) => Promise<JsonObject>;
+        createEdge: (sourceId: string, targetId: string, relationType: string, role?: string) => Promise<JsonObject>;
+        addMember: (orgId: string, userId: string, role?: string) => Promise<JsonObject>;
+        getContext: (userId: string, resourceId: string) => Promise<JsonObject>;
+        listNodes: (nodeType?: string) => Promise<JsonValue>;
+        getNode: (nodeId: string) => Promise<JsonObject>;
+        getChildren: (parentId: string, relation?: string) => Promise<JsonValue>;
+        updateOrg: (orgId: string, body: JsonObject) => Promise<JsonObject>;
+        deleteOrg: (orgId: string) => Promise<JsonObject>;
+        setOrgPlan: (orgId: string, body: JsonObject) => Promise<JsonObject>;
+        listMembers: (orgId: string) => Promise<JsonValue>;
+        removeMember: (orgId: string, userId: string) => Promise<JsonObject>;
+        updateMember: (orgId: string, userId: string, body: JsonObject) => Promise<JsonObject>;
+        createInvite: (orgId: string, body: JsonObject) => Promise<JsonObject>;
+        acceptInvite: (body: JsonObject) => Promise<JsonObject>;
+        getRoleMatrix: () => Promise<JsonObject>;
+        setRoleMatrix: (body: JsonObject) => Promise<JsonObject>;
+        getRoleCatalog: () => Promise<JsonValue>;
+        getProjectRef: (projectId: string) => Promise<JsonObject>;
+        getProjectSettings: () => Promise<JsonObject>;
+        setProjectSettings: (body: JsonObject) => Promise<JsonObject>;
+    };
+    readonly data: {
+        docPut: (collection: string, documentId: string, data: JsonObject) => Promise<JsonObject>;
+        docGet: (collection: string, documentId: string, atTxid?: number) => Promise<JsonObject>;
+        docDelete: (collection: string, documentId: string) => Promise<JsonObject>;
+        /** Encrypt client-side and write a Zero-Knowledge document envelope to Atlas-Doc. */
+        putDocumentE2ee: (collection: string, documentId: string, plaintext: Uint8Array | string, password?: string) => Promise<JsonObject>;
+        /** Retrieve and decrypt a Zero-Knowledge document from Atlas-Doc. */
+        getDocumentE2ee: (collection: string, documentId: string, password?: string, atTxid?: number) => Promise<{
+            plaintext: Uint8Array<ArrayBufferLike>;
+        }>;
+        /**
+         * List the documents in one collection (newest writes last): `[{ id, data, txid }]`.
+         * Subcollections are not included — list `collection/<docId>/<sub>` for those.
+         */
+        docList: (collection: string, options?: {
+            limit?: number;
+        }) => Promise<{
+            id: string;
+            data: JsonObject;
+            txid: number;
+        }[]>;
+        /** Field query (`where`, `order_by`, `limit`, cursors) — see also `sov.collection(...)`. */
+        docQuery: (collection: string, query?: JsonObject) => Promise<JsonObject>;
+        docCount: (collection: string, query?: JsonObject) => Promise<JsonObject>;
+        /** Atomic commit: `{ op, path, data, merge, transforms, precondition }` writes; `reads` make it a transaction. */
+        docCommit: (writes: JsonObject[], reads?: JsonObject[]) => Promise<JsonObject>;
+        docIndexes: (collection?: string) => Promise<JsonObject>;
+        createDocIndex: (collection: string, fields: (string | {
+            path: string;
+            order?: "asc" | "desc";
+        })[]) => Promise<JsonObject>;
+        dropDocIndex: (name: string) => Promise<JsonObject>;
+        collectionRules: (collection: string) => Promise<JsonObject>;
+        docScan: (args: {
+            prefix?: string;
+            start_key?: string;
+            end_key?: string;
+            limit?: number;
+        }) => Promise<JsonObject>;
+        /**
+         * Run one SQL statement. Pass values for `$1, $2, …` as `params` — they are bound by the
+         * database, so user input never becomes SQL: `sql('SELECT * FROM books WHERE id = $1', [id])`.
+         * A number as the second argument is still read as `txid` (older signature).
+         *
+         * `{ readOnly: true }` runs it in a read-only transaction (the server refuses writes, including
+         * through functions). The answer has `truncated: true` when it was cut at your plan's `sql.max_rows`.
+         */
+        sql: (sql: string, params?: JsonValue[] | number, txid?: number, opts?: {
+            readOnly?: boolean;
+        }) => Promise<JsonObject>;
+        /**
+         * Call one of your Postgres functions: `POST /rest/v1/rpc/{name}` with the arguments by name.
+         * A function that returns one value resolves to that value; one that returns rows resolves to
+         * an array of objects. App users need an access policy that allows `fn:<name>`. When the function
+         * raises an error, the SovariaError's `detail` holds the database's `code` and `message` (and
+         * `technicalMessage` repeats it for logs); `message` stays one you can show users.
+         *
+         *     const n = await sovaria.data.rpc<number>('post_count', { u: userId })
+         *     const top = await sovaria.data.rpc('top_posts', { days: 7 }, { get: true, query: { limit: 10 } })
+         */
+        rpc: <T = JsonValue>(name: string, args?: JsonObject, options?: RpcOptions) => Promise<T>;
+        tableCreate: (payload: JsonObject) => Promise<JsonObject>;
+        tableDrop: (tableName: string) => Promise<JsonObject>;
+        tableAddColumn: (payload: JsonObject) => Promise<JsonObject>;
+        tableDropColumn: (tableName: string, columnName: string) => Promise<JsonObject>;
+        tableAddForeignKey: (payload: JsonObject) => Promise<JsonObject>;
+        tableDropForeignKey: (payload: JsonObject) => Promise<JsonObject>;
+        tableMigrations: (query?: {
+            table_name?: string;
+            limit?: number;
+            offset?: number;
+        }) => Promise<JsonObject>;
+        /** The schema as one short line per table: types, keys, →references, allowed values, indexes, owner-only rows. */
+        schemaDigest: (options?: {
+            tables?: string[];
+            maxChars?: number;
+            since?: string;
+        }) => Promise<SchemaDigest>;
+        /**
+         * Create or extend tables from one declarative plan: checked first (a 422 lists every problem and nothing
+         * changes), then applied as one reversible migration and verified. `dryRun` returns the SQL instead.
+         */
+        applySchemaPlan: (plan: {
+            tables: SchemaPlanTable[];
+            dryRun?: boolean;
+            name?: string;
+        }) => Promise<SchemaPlanResult>;
+        /** Apply a migration atomically and record it in the project's history. `downSql` makes it reversible. */
+        applyMigration: (migration: {
+            name: string;
+            upSql: string;
+            downSql?: string;
+            version?: string;
+        }) => Promise<JsonObject>;
+        /** Run a migration inside a transaction and roll it back: reports whether it would apply. */
+        dryRunMigration: (migration: {
+            name: string;
+            upSql: string;
+            downSql?: string;
+        }) => Promise<JsonObject>;
+        /**
+         * Check several migrations the way they will be applied (what `sov db migrations push --dry-run` does):
+         * all run in order inside one transaction that is rolled back, so later ones see what earlier ones
+         * create. Up to 500 and 5 MB of SQL; `failed.index` is the first that fails. Nothing is kept.
+         */
+        dryRunMigrations: (migrations: Array<{
+            name: string;
+            upSql: string;
+        }>) => Promise<MigrationSequenceResult>;
+        /** Undo the latest migration (or `version` with `force`) using its down SQL. */
+        rollbackMigration: (opts?: {
+            version?: string;
+            force?: boolean;
+        }) => Promise<JsonObject>;
+        beginTransaction: () => Promise<JsonObject>;
+        commitTransaction: (txid: number) => Promise<JsonObject>;
+        rollbackTransaction: (txid: number) => Promise<JsonObject>;
+    };
+    readonly realtime: {
+        subscribe: (channel: string, clientId: string) => Promise<JsonObject>;
+        unsubscribe: (channel: string, clientId: string) => Promise<JsonObject>;
+        presence: (channel: string) => Promise<JsonObject>;
+        channels: () => Promise<JsonObject>;
+        replay: (channel: string, after?: number, limit?: number) => Promise<JsonObject>;
+        publish: (channel: string, payload: JsonObject, clock?: JsonObject, clockDelta?: JsonObject) => Promise<JsonObject>;
+        e2eeBootstrap: (channel: string, ttlSeconds?: number, forceNew?: boolean) => Promise<JsonObject>;
+        e2eeRotate: (channel: string, ttlSeconds?: number) => Promise<JsonObject>;
+        e2eeRevoke: (channel: string, keyId?: string, reason?: string) => Promise<JsonObject>;
+        /** Pass your RSA-OAEP (SHA-256) public key — PEM or base64 SPKI — to get the key wrapped for you. */
+        e2eeActiveKey: (channel: string, clientPublicKey?: string) => Promise<JsonObject>;
+        e2eeGetKey: (channel: string, keyId: string, clientPublicKey?: string) => Promise<JsonObject>;
+        e2eeListKeys: (channel: string) => Promise<JsonObject>;
+        wsTicket: (channel: string) => Promise<string>;
+        wsUrl: (channel: string, ticket?: string) => string;
+        wsUrlWithTicket: (channel: string) => Promise<string>;
+        /**
+         * Listen on a channel over WebSocket. Reconnects with backoff (a fresh ticket each time) and
+         * hands you each message's payload. Call `close()` when done.
+         *
+         * ```ts
+         * const ch = sov.realtime.channel('book:42', { onMessage: (m) => console.log(m), onStatus: setStatus })
+         * await ch.send({ type: 'typing' })
+         * ch.close()
+         * ```
+         */
+        channel: (name: string, handlers?: RealtimeChannelHandlers) => RealtimeChannel;
+    };
+    readonly policy: {
+        templates: () => Promise<JsonObject>;
+        list: () => Promise<JsonValue>;
+        get: (policyId: string) => Promise<JsonObject>;
+        create: (payload: JsonObject) => Promise<JsonObject>;
+        update: (policyId: string, payload: JsonObject) => Promise<JsonObject>;
+        delete: (policyId: string) => Promise<JsonObject>;
+        evaluate: (policyId: string, context: JsonObject) => Promise<JsonObject>;
+        check: (payload: {
+            orgId: string;
+            projectId: string;
+            action: string;
+            resource: string;
+            context?: JsonObject;
+        }) => Promise<JsonObject>;
+        preflight: (action: string, resource: string, context?: JsonObject) => Promise<JsonObject>;
+        history: (policyId: string) => Promise<JsonValue>;
+        rollback: (policyId: string, version: number) => Promise<JsonObject>;
+        simulate: (splSource: string, context?: JsonObject) => Promise<JsonObject>;
+    };
+    readonly audit: {
+        append: (payload: JsonObject) => Promise<JsonObject>;
+        list: (query?: {
+            actor_id?: string;
+            event_type?: string;
+            source?: string;
+            resource_id?: string;
+            limit?: number;
+            offset?: number;
+        }) => Promise<JsonValue>;
+        verify: () => Promise<JsonObject>;
+        count: () => Promise<JsonObject>;
+    };
+    readonly simulate: {
+        /**
+         * Who can do what in the live project, as visitors, the app's users and the team; nothing is
+         * written. Pass `{ manifest_id }` from `discover()` to skip discovery (manifest content is never
+         * accepted). Narrow with `{ filter: { resource, action, role } }` (role: `__guest__`,
+         * `__app_user__`, `app:<role>` or a team role): up to 25 request types is a single-request check
+         * that doesn't use the allowance; a wider filter is charged as a full run. One full run at a time
+         * per organization (409 `SIMULATION_RUN_IN_PROGRESS`).
+         */
+        run: (payload?: JsonObject) => Promise<JsonObject>;
+        /**
+         * Try a change before making it; nothing is written. `{ kind: 'policy', policy: { spl_source,
+         * name?, replaces? }, disable_policy_ids? }` lists who gains and loses access; `{ kind: 'sql',
+         * sql }` runs the script with every check, rolls it back and lists what it changed.
+         */
+        change: (payload: JsonObject) => Promise<JsonObject>;
+        plan: (payload: JsonObject) => Promise<JsonObject>;
+        discover: () => Promise<JsonObject>;
+        listRuns: (query?: {
+            limit?: number;
+            offset?: number;
+        }) => Promise<JsonValue>;
+        /** Real runs used and allowed today (UTC) and this month: `{ day: {used, limit, resets_at}, month: {…} }`. */
+        quota: () => Promise<JsonObject>;
+        /** Outcomes the team marked as intended (shown green on every run, left out of findings). */
+        listIntended: () => Promise<JsonObject>;
+        /** Mark an outcome as intended, e.g. `{ role: '__guest__', action: 'sql:select', resource: 'public.products',
+         *  outcome: 'ALLOW', note: 'The catalogue is public' }`. Needs policies.write. */
+        markIntended: (mark: {
+            role: string;
+            action: string;
+            resource: string;
+            outcome: "ALLOW" | "DENY";
+            note?: string;
+        }) => Promise<JsonObject>;
+        /** Remove a mark; matching cases show as measured again. */
+        unmarkIntended: (markId: string) => Promise<JsonObject>;
+        /** Callers, gateway checks, sign-in, resources and connectors (platform defences as "Platform protection"). */
+        topology: () => Promise<JsonObject>;
+        /** Everything the project has, read from every engine (every schema it created, collections, buckets, secret names,
+         *  functions with schedules, queues, workflows and triggers, sign-in, webhooks, channels, edge limits, backups,
+         *  environments, domains, policies, plan headroom). */
+        inventory: (params?: {
+            include?: string;
+            fresh?: boolean;
+        }) => Promise<JsonObject>;
+        /** What is wrong or at risk, worst first, each with a fix. `severity` keeps that level and worse. */
+        checks: (params?: {
+            severity?: "critical" | "warning" | "info";
+            area?: string;
+            fresh?: boolean;
+        }) => Promise<JsonObject>;
+        /** The architecture map: nodes by layer with their status, and the edges between them. */
+        graph: (params?: {
+            fresh?: boolean;
+        }) => Promise<JsonObject>;
+        /** Every limit the project lives under, with its value and how it is counted. */
+        limits: () => Promise<JsonObject>;
+        /** One integration flow under a programmed outcome. `modelled` is free and sends nothing; `sealed` runs the
+         *  real code path to the send point and returns the recording (one single-request check). */
+        integrationRun: (body: {
+            connector_id: string;
+            flow_id: string;
+            outcome?: string;
+            mode?: "modelled" | "sealed";
+        }) => Promise<JsonObject>;
+        /** The 14 security drills judged from the project's configuration, with an optional what-if draft (never saved). */
+        drillsRun: (body?: {
+            drill_ids?: string[];
+            overrides?: JsonObject;
+        }) => Promise<JsonObject>;
+        /** What a run's sealed send points would have sent. */
+        runArtifacts: (runId: string) => Promise<JsonObject>;
+        getRun: (runId: string) => Promise<JsonObject>;
+        compareRuns: (targetRunId: string, baselineRunId: string) => Promise<JsonObject>;
+    };
+    readonly chrono: {
+        /** The project's configuration (policies, schema, functions, settings, buckets, keys) at a commit or ISO time. */
+        state: (query?: {
+            at?: string;
+            prefix?: string;
+            timeline?: string;
+        }) => Promise<JsonObject>;
+        /**
+         * What going back to `at` on a branch changes, file by file, with who would gain or lose access. Writes nothing.
+         * The branch decides the environment acted on (main = production); `envId` is the one you have checked out
+         * ('' = production) and a mismatch is refused (ENV_MISMATCH).
+         */
+        restorePlan: (at: string, timeline?: string, options?: {
+            envId?: string;
+        }) => Promise<JsonObject>;
+        /**
+         * Go back to `at` on a branch: applies the plan's automated changes with the caller's own permissions, in that
+         * branch's own environment. `includeSchema` also rolls back the migrations applied since then; `includeDatabase`
+         * also restores the database as of then (production: the closest backup; an environment: point-in-time).
+         * The answer has `new_head`, or `recording: true` while the new commits are still arriving.
+         */
+        restore: (at: string, timeline?: string, options?: {
+            includeDatabase?: boolean;
+            includeSchema?: boolean;
+            envId?: string;
+        }) => Promise<JsonObject>;
+        commit: (payload: JsonObject) => Promise<JsonObject>;
+        timelineSpawn: (payload: JsonObject) => Promise<JsonObject>;
+        timelineList: () => Promise<JsonObject>;
+        timelineDelete: (name: string) => Promise<JsonObject>;
+        timelineJump: (name: string, targetHex: string) => Promise<JsonObject>;
+        timelineHistory: (name: string, limit?: number, offset?: number) => Promise<JsonObject>;
+        topology: (timeline?: string, limit?: number) => Promise<JsonObject>;
+        converge: (payload: JsonObject) => Promise<JsonObject>;
+        variance: (payload: JsonObject) => Promise<JsonObject>;
+        snapshotCreate: (payload: JsonObject) => Promise<JsonObject>;
+        snapshotList: () => Promise<JsonObject>;
+        snapshotRestore: (snapshotId: number) => Promise<JsonObject>;
+    };
+    readonly functions: {
+        list: (options: {
+            projectId: string;
+            limit?: number;
+            offset?: number;
+        }) => Promise<JsonObject>;
+        /** Validate a bundle and get a signed plan bound to its exact bytes. */
+        plan: (bundle: Blob, name: string, projectId?: string) => Promise<JsonObject>;
+        /** Plans, then applies exactly the planned bundle (Forge refuses anything else). */
+        deploy: (bundle: Blob, name: string, projectId?: string) => Promise<JsonObject>;
+        status: (deployId: string, projectId?: string) => Promise<JsonObject>;
+        invoke: (functionName: string, payload: JsonValue, options?: {
+            projectId?: string;
+            deployId?: string;
+            executionProfile?: "standard" | "heavy";
+        }) => Promise<JsonObject>;
+        /**
+         * Call a function the way an app does: POST {projectUrl}/functions/v1/{name} with the signed-in
+         * user's token (or no token for functions marked public). Returns the function's result.
+         */
+        call: <T = JsonValue>(functionName: string, payload?: JsonValue) => Promise<T>;
+        /**
+         * Call an HTTP function like `fetch`: any method, a sub-path, headers, a raw body (string, bytes, FormData…),
+         * and the function's own Response back (status, headers, binary body). Sends the signed-in user's token
+         * when there is one (none for public functions).
+         *
+         *     const res = await sovaria.functions.fetch('api', 'users/42', { method: 'PUT', body: JSON.stringify(user) })
+         *     if (res.status === 201) console.log(await res.json())
+         */
+        fetch: (functionName: string, path?: string, init?: {
+            method?: string;
+            headers?: Record<string, string>;
+            body?: BodyInit | null;
+            query?: Record<string, string>;
+        }) => Promise<Response>;
+        /** Make a function an HTTP function (Request in, Response out) or a JSON one again. */
+        setHttp: (functionName: string, http: boolean) => Promise<JsonObject>;
+        simulate: (functionName: string, payload: JsonValue, options?: {
+            projectId?: string;
+            deployId?: string;
+            executionProfile?: "standard" | "heavy";
+        }) => Promise<JsonObject>;
+        invokeAsync: (functionName: string, payload: JsonValue, options?: {
+            projectId?: string;
+            deployId?: string;
+            executionProfile?: "standard" | "heavy";
+            simulation?: boolean;
+        }) => Promise<JsonObject>;
+        invocationStatus: (invocationId: string, projectId: string) => Promise<JsonObject>;
+        jobs: (functionName: string, options: {
+            projectId: string;
+            status?: string;
+            limit?: number;
+            offset?: number;
+        }) => Promise<JsonObject>;
+        versions: (functionName: string, options: {
+            projectId: string;
+            limit?: number;
+            offset?: number;
+        }) => Promise<JsonObject>;
+        history: (functionName: string, options: {
+            projectId: string;
+            mode?: "invoke" | "simulate";
+            limit?: number;
+            offset?: number;
+        }) => Promise<JsonObject>;
+        simulationDiff: (functionName: string, options: {
+            projectId: string;
+            leftInvocationId: string;
+            rightInvocationId: string;
+        }) => Promise<JsonObject>;
+        promote: (functionName: string, options: {
+            projectId: string;
+            version?: number;
+            deployId?: string;
+            reason?: string;
+        }) => Promise<JsonObject>;
+        rollback: (functionName: string, options: {
+            projectId: string;
+            version?: number;
+            reason?: string;
+        }) => Promise<JsonObject>;
+        request: (method: string, path: string, options?: RequestOptions) => Promise<JsonValue>;
+        get: (name: string) => Promise<JsonObject>;
+        getSource: (name: string) => Promise<JsonObject>;
+        update: (name: string, body: JsonObject) => Promise<JsonObject>;
+        delete: (name: string) => Promise<JsonObject>;
+        logs: (name: string, query?: {
+            limit?: number;
+            offset?: number;
+            status?: string;
+        }) => Promise<JsonValue>;
+        getPolicy: (name: string) => Promise<JsonObject>;
+        setPolicy: (name: string, body: JsonObject) => Promise<JsonObject>;
+        getBindings: (name: string) => Promise<JsonObject>;
+        setBindings: (name: string, body: JsonObject) => Promise<JsonObject>;
+        githubRepositories: (body: JsonObject) => Promise<JsonObject>;
+        githubImport: (body: JsonObject) => Promise<JsonObject>;
+        githubCommit: (body: JsonObject) => Promise<JsonObject>;
+    };
+    /**
+     * Web hosting (Sites): static builds served on `<site>.sovaria.app` and your own domains. Deploys are
+     * immutable and content-addressed (only new files are uploaded); a release switches the whole site at once.
+     *
+     *     await sovaria.hosting.createSite('my-app')
+     *     const { release } = await sovaria.hosting.deployFiles('my-app', { '/index.html': '<h1>Hi</h1>' }, { config: { spa: true } })
+     *     console.log(release.url)   // https://my-app.sovaria.app
+     */
+    readonly hosting: {
+        config: () => Promise<JsonObject>;
+        sites: () => Promise<JsonObject>;
+        createSite: (name: string) => Promise<JsonObject>;
+        site: (site: string) => Promise<JsonObject>;
+        deleteSite: (site: string) => Promise<JsonObject>;
+        deploys: (site: string) => Promise<JsonObject>;
+        releases: (site: string, channel?: string) => Promise<JsonObject>;
+        rollback: (site: string, options?: {
+            channel?: string;
+            deployId?: string;
+        }) => Promise<JsonObject>;
+        channels: (site: string) => Promise<JsonObject>;
+        releaseToChannel: (site: string, channel: string, deployId: string, expiresDays?: number) => Promise<JsonObject>;
+        deleteChannel: (site: string, channel: string) => Promise<JsonObject>;
+        /**
+         * Deploy files (path → contents) and release them: hashes each file, uploads only the ones the project
+         * doesn't have, then switches the channel (`live` by default) to the new deploy in one step.
+         */
+        deployFiles: (site: string, files: Record<string, string | Uint8Array | ArrayBuffer | Blob>, options?: {
+            config?: JsonObject;
+            channel?: string;
+            expiresDays?: number;
+            message?: string;
+            release?: boolean;
+        }) => Promise<JsonObject>;
+    };
+    readonly storage: {
+        request: (method: string, path: string, options?: RequestOptions) => Promise<JsonValue>;
+        putJson: (path: string, payload: JsonObject) => Promise<JsonValue>;
+        get: (path: string, query?: Record<string, string | number | boolean | null | undefined>) => Promise<JsonValue>;
+        delete: (path: string) => Promise<JsonValue>;
+        /** Public URL of an object in a public bucket (no token needed; safe to put in <img src>). */
+        publicUrl: (bucket: string, objectPath: string, projectId?: string) => string;
+        listBuckets: () => Promise<JsonValue>;
+        createBucket: (body: JsonObject) => Promise<JsonObject>;
+        getBucket: (name: string) => Promise<JsonObject>;
+        updateBucket: (name: string, body: JsonObject) => Promise<JsonObject>;
+        deleteBucket: (name: string) => Promise<JsonObject>;
+        listObjects: (bucket: string, query?: {
+            prefix?: string;
+        }) => Promise<JsonValue>;
+        signDownload: (bucket: string, objectPath: string, expiresIn?: number) => Promise<JsonObject>;
+        /**
+         * Signed upload URL. Pass `sizeBytes` (the file's exact size) to get a direct-to-storage URL bound
+         * to that size; without it the URL uploads through Sovaria, which checks the size limits as the
+         * bytes arrive.
+         */
+        signUpload: (bucket: string, objectPath: string, expiresIn?: number, options?: {
+            sizeBytes?: number;
+            contentType?: string;
+        }) => Promise<JsonObject>;
+        moveObject: (body: JsonObject) => Promise<JsonObject>;
+        /**
+         * Upload a file. Bucket rules decide who may write where — e.g. with the "Own folder" rule a
+         * user writes to `${userId}/…`. Pass `upsert: true` to replace an existing object.
+         */
+        upload: (bucket: string, objectPath: string, file: Blob, options?: {
+            upsert?: boolean;
+            contentType?: string;
+        }) => Promise<JsonObject>;
+        /** Download an object the caller may read, as a Blob. */
+        download: (bucket: string, objectPath: string) => Promise<Blob>;
+        /** Delete an object. */
+        remove: (bucket: string, objectPath: string) => Promise<JsonObject>;
+    };
+    /**
+     * Compliance center (organization owners and admins): the evidence pack for your own audits. It is evidence of
+     * how Sovaria is configured for your organization, not a certification.
+     */
+    readonly compliance: {
+        /** Audit-log check, encryption and own-key status, data regions, per-project backups/PITR/Security Advisor, access. */
+        overview: (orgId?: string, options?: {
+            projectId?: string;
+        }) => Promise<JsonObject>;
+        /** The evidence pack as a ZIP Blob (MANIFEST.json holds every file's SHA-256). Counted per day; audited. */
+        downloadEvidence: (orgId?: string, options?: {
+            projectId?: string;
+        }) => Promise<Blob>;
+    };
+    private complianceOrg;
+    readonly system: {
+        enginesHealth: () => Promise<JsonValue>;
+    };
+    /**
+     * Billing + plan management (Ledger engine).
+     *
+     * The plan catalog is public; subscription and usage routes require a
+     * valid auth token. Subscription writes require the caller to be an
+     * org admin.
+     */
+    readonly billing: {
+        listPlans: () => Promise<JsonValue>;
+        getPlan: (name: string) => Promise<JsonObject>;
+        getSubscription: (orgId: string) => Promise<JsonObject>;
+        setSubscription: (orgId: string, payload: {
+            plan: string;
+            billingCycle?: "monthly" | "annual";
+            stripeCustomerId?: string;
+            metadata?: JsonObject;
+        }) => Promise<JsonObject>;
+        cancelSubscription: (orgId: string, options?: {
+            immediate?: boolean;
+        }) => Promise<JsonObject>;
+        listSubscriptions: () => Promise<JsonValue>;
+        getUsage: (orgId: string, period?: string) => Promise<JsonObject>;
+        getUsageHistory: (orgId: string, months?: number) => Promise<JsonValue>;
+        listInvoices: (orgId: string) => Promise<JsonValue>;
+        buildInvoice: (orgId: string, period?: string) => Promise<JsonObject>;
+        getCompute: (orgId: string, period?: string) => Promise<JsonObject>;
+        checkout: (body: JsonObject) => Promise<JsonObject>;
+        getProvider: () => Promise<JsonObject>;
+        getFx: () => Promise<JsonObject>;
+        getOverage: (orgId: string) => Promise<JsonObject>;
+        getOpenInvoice: () => Promise<JsonObject>;
+        payInvoice: (orgId: string, period: string, body?: JsonObject) => Promise<JsonObject>;
+        razorpayCreateOrder: (body: JsonObject) => Promise<JsonObject>;
+        razorpayVerifyPayment: (body: JsonObject) => Promise<JsonObject>;
+        getAccount: (accountId: string) => Promise<JsonObject>;
+        cancelAccount: (accountId: string) => Promise<JsonObject>;
+        resumeAccount: (accountId: string) => Promise<JsonObject>;
+        /** Add-ons on the billing account (price, paid units, what renews, paid-through) and the autopay mandate. */
+        listAddons: (accountId: string) => Promise<JsonObject>;
+        /**
+         * Start paying for `quantity` more units of an add-on (`extra_project`, `custom_domains`,
+         * `extra_environment`), prorated to the period end. Returns a Razorpay order to open in Checkout;
+         * the units count once the payment is verified (`razorpayVerifyPayment`). Uses the scoped org.
+         */
+        addonCheckout: (accountId: string, addonId: string, quantity?: number, projectId?: string) => Promise<JsonObject>;
+        /** How many units renew at the period end (0 cancels). Units already paid for keep working until then. */
+        setAddonRenewal: (accountId: string, addonId: string, renewQuantity: number) => Promise<JsonObject>;
+        /** ₹1 (refunded) authorisation that saves a card or UPI mandate; open it in Checkout with `recurring: '1'`. */
+        autopaySetup: (accountId: string, body?: {
+            customer_email?: string;
+            name?: string;
+        }) => Promise<JsonObject>;
+        /** Remove the saved mandate; renewals become invoices to pay by hand. */
+        removeAutopayMandate: (accountId: string) => Promise<JsonObject>;
+    };
+    /** The complete API, generated from spec/sovaria-api.json (same surface in every SDK language). */
+    readonly api: {
+        ai: {
+            gatewayOverview: () => Promise<JsonValue>;
+            saveGatewayRoute: (args: {
+                name: string;
+                body: JsonObject;
+            }) => Promise<JsonValue>;
+            deleteGatewayRoute: (args: {
+                name: string;
+            }) => Promise<JsonValue>;
+            gatewayComplete: (args: {
+                route: string;
+                messages: JsonValue;
+                system?: JsonValue;
+                maxTokens?: JsonValue;
+                cache?: JsonValue;
+            }) => Promise<JsonValue>;
+            gatewayUsage: (args?: {
+                days?: JsonValue;
+            }) => Promise<JsonValue>;
+            clearGatewayCache: () => Promise<JsonValue>;
+            listAgentVersions: (args: {
+                agentId: string;
+            }) => Promise<JsonValue>;
+            publishAgentVersion: (args: {
+                agentId: string;
+                note?: JsonValue;
+            }) => Promise<JsonValue>;
+            getAgentVersion: (args: {
+                agentId: string;
+                version: string;
+            }) => Promise<JsonValue>;
+            compareAgentVersions: (args: {
+                agentId: string;
+                a: JsonValue;
+                b?: JsonValue;
+            }) => Promise<JsonValue>;
+            rollbackAgentVersion: (args: {
+                agentId: string;
+                version: string;
+                note?: JsonValue;
+            }) => Promise<JsonValue>;
+        };
+        analytics: {
+            overview: (args?: {
+                days?: JsonValue;
+            }) => Promise<JsonValue>;
+            listEvents: (args?: {
+                days?: JsonValue;
+            }) => Promise<JsonValue>;
+            eventTrend: (args: {
+                name: string;
+                days?: JsonValue;
+            }) => Promise<JsonValue>;
+            funnel: (args: {
+                steps: JsonValue;
+                windowHours?: JsonValue;
+                days?: JsonValue;
+            }) => Promise<JsonValue>;
+            retention: (args?: {
+                startEvent?: JsonValue;
+                returnEvent?: JsonValue;
+                period?: JsonValue;
+                periods?: JsonValue;
+            }) => Promise<JsonValue>;
+            listUsers: (args?: {
+                q?: JsonValue;
+                limit?: JsonValue;
+            }) => Promise<JsonValue>;
+            getUser: (args: {
+                userKey: string;
+                limit?: JsonValue;
+            }) => Promise<JsonValue>;
+            eraseUser: (args: {
+                userKey: string;
+            }) => Promise<JsonValue>;
+            live: (args?: {
+                since?: JsonValue;
+                limit?: JsonValue;
+            }) => Promise<JsonValue>;
+            usage: () => Promise<JsonValue>;
+            getSettings: () => Promise<JsonValue>;
+            putSettings: (args: {
+                requireConsent: JsonValue;
+            }) => Promise<JsonValue>;
+        };
+        attestation: {
+            getConfig: (args?: {
+                projectId?: string;
+            }) => Promise<JsonValue>;
+            updateConfig: (args: {
+                projectId?: string;
+                body: JsonObject;
+            }) => Promise<JsonValue>;
+            setGoogleCredentials: (args: {
+                projectId?: string;
+                serviceAccount: JsonValue;
+            }) => Promise<JsonValue>;
+            setAppleCredentials: (args: {
+                projectId?: string;
+                p8: JsonValue;
+                keyId: JsonValue;
+                teamId: JsonValue;
+            }) => Promise<JsonValue>;
+            deleteCredentials: (args: {
+                projectId?: string;
+                which: string;
+            }) => Promise<JsonValue>;
+            createDebugToken: (args?: {
+                projectId?: string;
+                name?: JsonValue;
+            }) => Promise<JsonValue>;
+            deleteDebugToken: (args: {
+                projectId?: string;
+                tokenId: string;
+            }) => Promise<JsonValue>;
+            challenge: () => Promise<JsonValue>;
+            exchange: (args: {
+                provider: JsonValue;
+                appId?: JsonValue;
+                challenge?: JsonValue;
+                token?: JsonValue;
+                keyId?: JsonValue;
+                attestation?: JsonValue;
+                assertion?: JsonValue;
+                development?: JsonValue;
+            }) => Promise<JsonValue>;
+        };
+        auth: {
+            confirmVerificationEmail: (args: {
+                token: JsonValue;
+            }) => Promise<JsonValue>;
+            disableMfa: (args: {
+                totpCode: JsonValue;
+            }) => Promise<JsonValue>;
+            enrollMfa: () => Promise<JsonValue>;
+            getMfaStatus: () => Promise<JsonValue>;
+            getProvidersConfig: () => Promise<JsonValue>;
+            getSessionsConfig: () => Promise<JsonValue>;
+            listConsoleProductUsers: () => Promise<JsonValue>;
+            listSessions: () => Promise<JsonValue>;
+            revokeOtherSessions: () => Promise<JsonValue>;
+            revokeSession: (args: {
+                sessionId: string;
+            }) => Promise<JsonValue>;
+            sendVerificationEmail: () => Promise<JsonValue>;
+            updateProvidersConfig: (args: {
+                body: JsonObject;
+            }) => Promise<JsonValue>;
+            updateSessionsConfig: (args: {
+                body: JsonObject;
+            }) => Promise<JsonValue>;
+            listDevices: () => Promise<JsonValue>;
+            signOutDevice: (args: {
+                deviceId: string;
+            }) => Promise<JsonValue>;
+            passkeyRegisterStart: (args?: {
+                name?: JsonValue;
+            }) => Promise<JsonValue>;
+            passkeyRegisterFinish: (args: {
+                credential: JsonValue;
+                name?: JsonValue;
+            }) => Promise<JsonValue>;
+            passkeyAuthenticateStart: (args?: {
+                userId?: JsonValue;
+            }) => Promise<JsonValue>;
+            passkeyAuthenticateFinish: (args: {
+                challengeId: JsonValue;
+                credential: JsonValue;
+            }) => Promise<JsonValue>;
+            listPasskeys: () => Promise<JsonValue>;
+            deletePasskey: (args: {
+                passkeyId: string;
+            }) => Promise<JsonValue>;
+        };
+        billing: {
+            buildInvoice: (args?: {
+                orgId?: string;
+                period?: JsonValue;
+            }) => Promise<JsonValue>;
+            cancelAccount: (args: {
+                accountId: string;
+            }) => Promise<JsonValue>;
+            checkout: (args: {
+                body: JsonObject;
+            }) => Promise<JsonValue>;
+            getAccount: (args: {
+                accountId: string;
+            }) => Promise<JsonValue>;
+            getAccountOverage: (args: {
+                accountId: string;
+            }) => Promise<JsonValue>;
+            getAccountOveragePrefs: (args: {
+                accountId: string;
+            }) => Promise<JsonValue>;
+            getOrgOveragePrefs: (args?: {
+                orgId?: string;
+            }) => Promise<JsonValue>;
+            getCompute: (args?: {
+                orgId?: string;
+                period?: JsonValue;
+            }) => Promise<JsonValue>;
+            getFx: () => Promise<JsonValue>;
+            getOpenInvoice: () => Promise<JsonValue>;
+            getOverage: (args?: {
+                orgId?: string;
+            }) => Promise<JsonValue>;
+            getPlan: (args: {
+                name: string;
+            }) => Promise<JsonValue>;
+            getProvider: () => Promise<JsonValue>;
+            getSubscription: (args?: {
+                orgId?: string;
+            }) => Promise<JsonValue>;
+            getUsage: (args?: {
+                orgId?: string;
+                period?: JsonValue;
+            }) => Promise<JsonValue>;
+            getUsageHistory: (args?: {
+                orgId?: string;
+                months?: JsonValue;
+            }) => Promise<JsonValue>;
+            listInvoices: (args?: {
+                orgId?: string;
+            }) => Promise<JsonValue>;
+            listPlans: () => Promise<JsonValue>;
+            listSubscriptions: () => Promise<JsonValue>;
+            payInvoice: (args: {
+                orgId?: string;
+                period: string;
+            }) => Promise<JsonValue>;
+            razorpayCreateOrder: (args: {
+                body: JsonObject;
+            }) => Promise<JsonValue>;
+            razorpayVerifyPayment: (args: {
+                body: JsonObject;
+            }) => Promise<JsonValue>;
+            resumeAccount: (args: {
+                accountId: string;
+            }) => Promise<JsonValue>;
+            setAccountOveragePrefs: (args: {
+                accountId: string;
+                services: JsonValue;
+            }) => Promise<JsonValue>;
+            setOrgOveragePrefs: (args: {
+                orgId?: string;
+                services: JsonValue;
+            }) => Promise<JsonValue>;
+            listAccountAddons: (args: {
+                accountId: string;
+            }) => Promise<JsonValue>;
+            addonCheckout: (args: {
+                accountId: string;
+                addonId: string;
+                quantity: JsonValue;
+                projectId?: JsonValue;
+            }) => Promise<JsonValue>;
+            setAddonRenewal: (args: {
+                accountId: string;
+                addonId: string;
+                renewQuantity: JsonValue;
+            }) => Promise<JsonValue>;
+            setAccountAddon: (args: {
+                accountId: string;
+                addonId: string;
+                enabled: JsonValue;
+                quantity?: JsonValue;
+            }) => Promise<JsonValue>;
+            setAccountAutopay: (args: {
+                accountId: string;
+                enabled: JsonValue;
+            }) => Promise<JsonValue>;
+            autopaySetup: (args: {
+                accountId: string;
+                customerEmail?: JsonValue;
+                name? /** Refresh when the token is near expiry, or always with `force` (the server said 401). */: JsonValue;
+            }) => Promise<JsonValue>;
+            removeAutopayMandate: (args: {
+                accountId: string;
+            }) => Promise<JsonValue>;
+            billingListAddonPrices: () => Promise<JsonValue>;
+        };
+        builds: {
+            check: (args: {
+                build: JsonValue;
+            }) => Promise<JsonValue>;
+            list: (args?: {
+                limit?: JsonValue;
+            }) => Promise<JsonValue>;
+            get: (args: {
+                buildId: string;
+            }) => Promise<JsonValue>;
+            pullRequest: (args: {
+                buildId: string;
+                token?: JsonValue;
+            }) => Promise<JsonValue>;
+            delete: (args: {
+                buildId: string;
+            }) => Promise<JsonValue>;
+        };
+        byok: {
+            get: () => Promise<JsonValue>;
+            set: (args: {
+                provider?: JsonValue;
+                keyRef: JsonValue;
+            }) => Promise<JsonValue>;
+            rotate: () => Promise<JsonValue>;
+            check: () => Promise<JsonValue>;
+            reencryptStorage: () => Promise<JsonValue>;
+        };
+        compliance: {
+            overview: (args?: {
+                orgId?: string;
+                projectId?: JsonValue;
+            }) => Promise<JsonValue>;
+        };
+        crashes: {
+            listIssues: (args?: {
+                status?: JsonValue;
+                limit?: JsonValue;
+                release?: JsonValue;
+                environment?: JsonValue;
+                platform?: JsonValue;
+                q?: JsonValue;
+                sort?: JsonValue;
+                handled?: JsonValue;
+            }) => Promise<JsonValue>;
+            getIssue: (args: {
+                fingerprint: string;
+            }) => Promise<JsonValue>;
+            setIssueStatus: (args: {
+                fingerprint: string;
+                status: JsonValue;
+            }) => Promise<JsonValue>;
+            usage: () => Promise<JsonValue>;
+            trends: (args?: {
+                days?: JsonValue;
+                release? /** Read then write atomically; retried (up to `maxAttempts`) when a document it read changes meanwhile. */: JsonValue;
+                environment?: JsonValue;
+                platform?: JsonValue;
+            }) => Promise<JsonValue>;
+            releases: (args?: {
+                days?: JsonValue;
+                environment?: JsonValue;
+                platform?: JsonValue;
+                limit?: JsonValue;
+            }) => Promise<JsonValue>;
+            listDebugFiles: (args?: {
+                kind?: JsonValue;
+                release?: JsonValue;
+            }) => Promise<JsonValue>;
+            deleteDebugFile: (args: {
+                fileId: string;
+            }) => Promise<JsonValue>;
+        };
+        data: {
+            addColumn: (args: {
+                tableName: JsonValue;
+                columnName: JsonValue;
+                dataType: JsonValue;
+                isNullable?: JsonValue;
+                isUnique?: JsonValue;
+                defaultValue?: JsonValue;
+            }) => Promise<JsonValue>;
+            addForeignKey: (args: {
+                tableName: JsonValue;
+                columnName: JsonValue;
+                referencedTable: JsonValue;
+                referencedColumn: JsonValue;
+            }) => Promise<JsonValue>;
+            beginTransaction: () => Promise<JsonValue>;
+            commitTransaction: (args: {
+                txid: JsonValue;
+            }) => Promise<JsonValue>;
+            dropColumn: (args: {
+                tableName: JsonValue;
+                columnName: JsonValue;
+            }) => Promise<JsonValue>;
+            dropForeignKey: (args: {
+                tableName: JsonValue;
+                columnName: JsonValue;
+                referencedTable: JsonValue;
+                referencedColumn: JsonValue;
+            }) => Promise<JsonValue>;
+            dropTable: (args: {
+                tableName: JsonValue;
+            }) => Promise<JsonValue>;
+            rollbackTransaction: (args: {
+                txid: JsonValue;
+            }) => Promise<JsonValue>;
+            tableHistory: () => Promise<JsonValue>;
+            setTableHistory: (args: {
+                tableName: JsonValue;
+                enabled: JsonValue;
+                keepDays?: JsonValue;
+            }) => Promise<JsonValue>;
+            schemaDigest: (args?: {
+                tables?: JsonValue;
+                maxChars?: JsonValue;
+                since?: JsonValue;
+            }) => Promise<JsonValue>;
+            applySchemaPlan: (args: {
+                tables: JsonValue;
+                dryRun?: JsonValue;
+                name?: JsonValue;
+            }) => Promise<JsonValue>;
+            applyMigration: (args: {
+                name: JsonValue;
+                upSql: JsonValue;
+                downSql?: JsonValue;
+                version?: JsonValue;
+            }) => Promise<JsonValue>;
+            dryRunMigration: (args: {
+                name: JsonValue;
+                upSql: JsonValue;
+                downSql?: JsonValue;
+            }) => Promise<JsonValue>;
+            dryRunMigrations: (args: {
+                migrations: JsonValue;
+            }) => Promise<JsonValue>;
+            rollbackMigration: (args?: {
+                version?: JsonValue;
+                force?: JsonValue;
+            }) => Promise<JsonValue>;
+            resetMigrations: (args?: {
+                dryRun?: JsonValue;
+            }) => Promise<JsonValue>;
+            docPipeline: (args: {
+                collection: string;
+                stages: JsonValue;
+                collectionGroup?: JsonValue;
+            }) => Promise<JsonValue>;
+            schemaDiff: (args: {
+                fromEnv: JsonValue;
+                toEnv?: JsonValue;
+            }) => Promise<JsonValue>;
+            promoteEnvironment: (args: {
+                fromEnvId: JsonValue;
+                toEnvId?: JsonValue;
+                fromName?: JsonValue;
+                toName?: JsonValue;
+                dryRun?: JsonValue;
+                acceptViolations?: JsonValue;
+            }) => Promise<JsonValue>;
+        };
+        deadLetters: {
+            list: (args?: {
+                functionName?: JsonValue;
+                triggerId?: JsonValue;
+                limit?: JsonValue;
+                offset?: JsonValue;
+            }) => Promise<JsonValue>;
+            replay: (args: {
+                invocationId: string;
+            }) => Promise<JsonValue>;
+            replayMany: (args: {
+                ids: JsonValue;
+            }) => Promise<JsonValue>;
+            discard: (args: {
+                invocationId: string;
+            }) => Promise<JsonValue>;
+        };
+        distribution: {
+            overview: (args?: {
+                projectId?: string;
+            }) => Promise<JsonValue>;
+            createRelease: (args: {
+                projectId?: string;
+                filename: JsonValue;
+                sizeBytes: JsonValue;
+                notes?: JsonValue;
+                groups?: JsonValue;
+                env?: JsonValue;
+                gitRef?: JsonValue;
+                appId?: JsonValue;
+                notify?: JsonValue;
+            }) => Promise<JsonValue>;
+            finalizeRelease: (args: {
+                projectId?: string;
+                releaseId: string;
+            }) => Promise<JsonValue>;
+            updateRelease: (args: {
+                projectId?: string;
+                releaseId: string;
+                notes?: JsonValue;
+                groups?: JsonValue;
+            }) => Promise<JsonValue>;
+            deleteRelease: (args: {
+                projectId?: string;
+                releaseId: string;
+            }) => Promise<JsonValue>;
+            addTesters: (args: {
+                projectId?: string;
+                emails: JsonValue;
+                groups?: JsonValue;
+                sendInvite?: JsonValue;
+            }) => Promise<JsonValue>;
+            removeTester: (args: {
+                projectId?: string;
+                testerId: string;
+            }) => Promise<JsonValue>;
+            resendInvite: (args: {
+                projectId?: string;
+                testerId: string;
+            }) => Promise<JsonValue>;
+            deleteGroup: (args: {
+                projectId?: string;
+                name: string;
+            }) => Promise<JsonValue>;
+        };
+        e2ee: {
+            bootstrapKey: (args: {
+                channel: JsonValue;
+                ttlSeconds?: JsonValue;
+                forceNew?: JsonValue;
+            }) => Promise<JsonValue>;
+            getActiveKey: (args: {
+                channel: string;
+                clientPublicKey?: JsonValue;
+            }) => Promise<JsonValue>;
+            getKey: (args: {
+                channel: string;
+                keyId: string;
+                clientPublicKey?: JsonValue;
+            }) => Promise<JsonValue>;
+            listKeys: (args: {
+                channel: string;
+            }) => Promise<JsonValue>;
+            revokeKey: (args: {
+                channel: JsonValue;
+                keyId?: JsonValue;
+                reason?: JsonValue;
+            }) => Promise<JsonValue>;
+            rotateKey: (args: {
+                channel: JsonValue;
+                ttlSeconds?: JsonValue;
+            }) => Promise<JsonValue>;
+        };
+        embeddings: {
+            getSettings: () => Promise<JsonValue>;
+            setSettings: (args: {
+                body: JsonObject;
+            }) => Promise<JsonValue>;
+            clearSettings: () => Promise<JsonValue>;
+            usage: (args?: {
+                months?: JsonValue;
+            }) => Promise<JsonValue>;
+        };
+        experiments: {
+            listExperiments: (args?: {
+                projectId?: string;
+                env?: JsonValue;
+            }) => Promise<JsonValue>;
+            createExperiment: (args: {
+                projectId?: string;
+                name: JsonValue;
+                param: JsonValue;
+                variants: JsonValue;
+                control?: JsonValue;
+                condition?: JsonValue;
+                exposurePct?: JsonValue;
+                goal: JsonValue;
+                minSample?: JsonValue;
+                description?: JsonValue;
+                env?: JsonValue;
+            }) => Promise<JsonValue>;
+            getExperiment: (args: {
+                projectId?: string;
+                ref: string;
+                env?: JsonValue;
+            }) => Promise<JsonValue>;
+            updateExperiment: (args: {
+                projectId?: string;
+                ref: string;
+                variants?: JsonValue;
+                control?: JsonValue;
+                exposurePct?: JsonValue;
+                goal?: JsonValue;
+                minSample?: JsonValue;
+                description?: JsonValue;
+                env?: JsonValue;
+            }) => Promise<JsonValue>;
+            deleteExperiment: (args: {
+                projectId?: string;
+                ref: string;
+                env?: JsonValue;
+            }) => Promise<JsonValue>;
+            startExperiment: (args: {
+                projectId?: string;
+                ref: string;
+                env?: JsonValue;
+            }) => Promise<JsonValue>;
+            stopExperiment: (args: {
+                projectId?: string;
+                ref: string;
+                winner?: JsonValue;
+                env?: JsonValue;
+            }) => Promise<JsonValue>;
+            results: (args: {
+                projectId?: string;
+                ref: string;
+                env?: JsonValue;
+            }) => Promise<JsonValue>;
+            rollout: (args: {
+                projectId?: string;
+                ref: string;
+                variant?: JsonValue;
+                env?: JsonValue;
+            }) => Promise<JsonValue>;
+        };
+        functions: {
+            delete: (args: {
+                functionName: string;
+            }) => Promise<JsonValue>;
+            get: (args: {
+                functionName: string;
+                projectId?: JsonValue;
+            }) => Promise<JsonValue>;
+            getBindings: (args: {
+                functionName: string;
+            }) => Promise<JsonValue>;
+            getPolicy: (args: {
+                functionName: string;
+            }) => Promise<JsonValue>;
+            getSource: (args: {
+                functionName: string;
+                projectId?: JsonValue;
+            }) => Promise<JsonValue>;
+            githubCommit: (args: {
+                body: JsonObject;
+            }) => Promise<JsonValue>;
+            githubImport: (args: {
+                body: JsonObject;
+            }) => Promise<JsonValue>;
+            invocationStatus: (args: {
+                invocationId: string;
+                projectId?: JsonValue;
+            }) => Promise<JsonValue>;
+            list: (args?: {
+                projectId?: JsonValue;
+                limit?: JsonValue;
+                offset?: JsonValue;
+            }) => Promise<JsonValue>;
+            simulationDiff: (args: {
+                functionName: string;
+                projectId?: JsonValue;
+                leftInvocationId?: JsonValue;
+                rightInvocationId?: JsonValue;
+            }) => Promise<JsonValue>;
+            status: (args: {
+                deployId: string;
+                projectId?: JsonValue;
+            }) => Promise<JsonValue>;
+            update: (args: {
+                functionName: string;
+                body: JsonObject;
+                projectId?: JsonValue;
+            }) => Promise<JsonValue>;
+            updateBindings: (args: {
+                functionName: string;
+                bindings: JsonValue;
+            }) => Promise<JsonValue>;
+            updatePolicy: (args: {
+                functionName: string;
+                policy: JsonObject;
+            }) => Promise<JsonValue>;
+            versions: (args: {
+                functionName: string;
+                projectId?: JsonValue;
+                limit?: JsonValue;
+                offset?: JsonValue;
+            }) => Promise<JsonValue>;
+            listGithubPreviews: () => Promise<JsonValue>;
+            getFunctionLimits: (args: {
+                functionName: string;
+            }) => Promise<JsonValue>;
+            setFunctionLimits: (args: {
+                functionName: string;
+                timeoutSec?: JsonValue;
+                memoryMb?: JsonValue;
+                minInstances?: JsonValue;
+            }) => Promise<JsonValue>;
+        };
+        governance: {
+            adminDatabases: () => Promise<JsonValue>;
+            getTenant: (args?: {
+                orgId?: string;
+            }) => Promise<JsonValue>;
+            getTenantDatabaseConnection: (args?: {
+                orgId?: string;
+                projectId?: string;
+            }) => Promise<JsonValue>;
+            listHosts: (args?: {
+                regionId?: JsonValue;
+            }) => Promise<JsonValue>;
+            listRegions: () => Promise<JsonValue>;
+            listTenantDatabaseBackups: (args?: {
+                orgId?: string;
+                projectId?: string;
+                limit?: JsonValue;
+            }) => Promise<JsonValue>;
+            listTenantDatabases: (args?: {
+                orgId?: string;
+            }) => Promise<JsonValue>;
+            listTenants: () => Promise<JsonValue>;
+            metricsOverview: () => Promise<JsonValue>;
+            patchHost: (args: {
+                hostId: string;
+                body: JsonObject;
+            }) => Promise<JsonValue>;
+            patchRegion: (args: {
+                regionId: string;
+                body: JsonObject;
+            }) => Promise<JsonValue>;
+            pauseTenantDatabase: (args?: {
+                orgId?: string;
+                projectId?: string;
+            }) => Promise<JsonValue>;
+            resizeTenantDatabase: (args: {
+                orgId?: string;
+                projectId?: string;
+                computeSize: JsonValue;
+            }) => Promise<JsonValue>;
+            resumeTenantDatabase: (args?: {
+                orgId?: string;
+                projectId?: string;
+            }) => Promise<JsonValue>;
+            revealTenantDatabaseConnection: (args: {
+                orgId?: string;
+                projectId?: string;
+                grantId: JsonValue;
+            }) => Promise<JsonValue>;
+            setTenantStatus: (args: {
+                orgId?: string;
+                status: JsonValue;
+            }) => Promise<JsonValue>;
+            triggerTenantDatabaseBackup: (args?: {
+                orgId?: string;
+                projectId?: string;
+            }) => Promise<JsonValue>;
+            listDatabaseReplicas: (args?: {
+                orgId?: string;
+                projectId?: string;
+            }) => Promise<JsonValue>;
+            createDatabaseReplica: (args?: {
+                orgId?: string;
+                projectId?: string;
+            }) => Promise<JsonValue>;
+            deleteDatabaseReplica: (args: {
+                orgId?: string;
+                projectId?: string;
+                replicaId: string;
+            }) => Promise<JsonValue>;
+            compareDatabaseMoments: (args: {
+                orgId?: string;
+                projectId?: string;
+                fromMoment: JsonValue;
+                toMoment?: JsonValue;
+                includePlatform?: JsonValue;
+            }) => Promise<JsonValue>;
+            restoreDatabaseBackup: (args: {
+                orgId?: string;
+                projectId?: string;
+                backupId: string;
+                confirm: JsonValue;
+            }) => Promise<JsonValue>;
+            listDatabaseRestores: (args?: {
+                orgId?: string;
+                projectId?: string;
+            }) => Promise<JsonValue>;
+            undoDatabaseRestore: (args: {
+                orgId?: string;
+                projectId?: string;
+                restoreId: string;
+            }) => Promise<JsonValue>;
+            getPitrStatus: (args?: {
+                orgId?: string;
+                projectId?: string;
+            }) => Promise<JsonValue>;
+            enablePitr: (args?: {
+                orgId?: string;
+                projectId?: string;
+                restart?: JsonValue;
+            }) => Promise<JsonValue>;
+            disablePitr: (args?: {
+                orgId?: string;
+                projectId?: string;
+            }) => Promise<JsonValue>;
+            restoreDatabaseToTime: (args: {
+                orgId?: string;
+                projectId?: string;
+                targetTime: JsonValue;
+                confirm?: JsonValue;
+                verifyOnly?: JsonValue;
+            }) => Promise<JsonValue>;
+            getRestoreJob: (args: {
+                orgId?: string;
+                projectId?: string;
+                jobId: string;
+            }) => Promise<JsonValue>;
+            listEnvironments: (args?: {
+                orgId?: string;
+                projectId?: string;
+            }) => Promise<JsonValue>;
+            createEnvironment: (args: {
+                orgId?: string;
+                projectId?: string;
+                envId: JsonValue;
+                name: JsonValue;
+                kind?: JsonValue;
+                label?: JsonValue;
+                fromEnvId?: JsonValue;
+                database?: JsonValue;
+                sampleRows?: JsonValue;
+                includeTables?: JsonValue;
+                excludeTables?: JsonValue;
+                mask?: JsonValue;
+                maskAdd?: JsonValue;
+                maskSkip?: JsonValue;
+                protected?: JsonValue;
+                expiresInDays?: JsonValue;
+            }) => Promise<JsonValue>;
+            getEnvironmentCopy: (args: {
+                orgId?: string;
+                projectId?: string;
+                envId: string;
+            }) => Promise<JsonValue>;
+            deleteEnvironment: (args: {
+                orgId?: string;
+                projectId?: string;
+                envId: string;
+            }) => Promise<JsonValue>;
+            queryInsights: (args?: {
+                orgId?: string;
+                projectId?: string;
+                sort?: JsonValue;
+                limit?: JsonValue;
+            }) => Promise<JsonValue>;
+            resetQueryInsights: (args?: {
+                orgId?: string;
+                projectId?: string;
+            }) => Promise<JsonValue>;
+            indexAdvisor: (args?: {
+                orgId?: string;
+                projectId?: string;
+                queryid?: JsonValue;
+            }) => Promise<JsonValue>;
+            indexAdvisorForQuery: (args: {
+                orgId?: string;
+                projectId?: string;
+                query: JsonValue;
+            }) => Promise<JsonValue>;
+            applyIndex: (args: {
+                orgId?: string;
+                projectId?: string;
+                schema?: JsonValue;
+                table: JsonValue;
+                columns: JsonValue;
+            }) => Promise<JsonValue>;
+            indexStatus: (args: {
+                orgId?: string;
+                projectId?: string;
+                indexName: string;
+            }) => Promise<JsonValue>;
+            updateEnvironment: (args: {
+                orgId?: string;
+                projectId?: string;
+                envId: string;
+                kind?: JsonValue;
+                label?: JsonValue;
+                protected?: JsonValue;
+                expiresInDays?: JsonValue;
+            }) => Promise<JsonValue>;
+            resetEnvironment: (args: {
+                orgId?: string;
+                projectId?: string;
+                envId: string;
+                confirm: JsonValue;
+            }) => Promise<JsonValue>;
+            restoreEnvironment: (args: {
+                orgId?: string;
+                projectId?: string;
+                envId: string;
+                at: JsonValue;
+                confirm: JsonValue;
+            }) => Promise<JsonValue>;
+            getEnvironmentRestore: (args: {
+                orgId?: string;
+                projectId?: string;
+                envId: string;
+                restoreId: string;
+            }) => Promise<JsonValue>;
+            getBackupHealth: (args?: {
+                orgId?: string;
+                projectId?: string;
+            }) => Promise<JsonValue>;
+            listProjectExports: (args?: {
+                orgId?: string;
+                projectId?: string;
+                limit?: JsonValue;
+            }) => Promise<JsonValue>;
+            triggerProjectExport: (args?: {
+                orgId?: string;
+                projectId?: string;
+            }) => Promise<JsonValue>;
+            getCompare: (args: {
+                orgId?: string;
+                projectId?: string;
+                compareId: string;
+            }) => Promise<JsonValue>;
+            restoreDatabaseInto: (args?: {
+                orgId?: string;
+                projectId?: string;
+                envId?: JsonValue;
+                targetProjectId?: JsonValue;
+                backupId?: JsonValue;
+                targetTime?: JsonValue;
+                confirm?: JsonValue;
+                reason?: JsonValue;
+            }) => Promise<JsonValue>;
+            restoreDatabaseTables: (args: {
+                orgId?: string;
+                projectId?: string;
+                tables: JsonValue;
+                backupId?: JsonValue;
+                targetTime?: JsonValue;
+                reason?: JsonValue;
+            }) => Promise<JsonValue>;
+        };
+        history: {
+            commit: (args: {
+                timeline?: JsonValue;
+                message: JsonValue;
+                author?: JsonValue;
+                eventType?: JsonValue;
+            }) => Promise<JsonValue>;
+            converge: (args: {
+                target: JsonValue;
+                source: JsonValue;
+                author: JsonValue;
+                message?: JsonValue;
+            }) => Promise<JsonValue>;
+            createSnapshot: (args?: {
+                message?: JsonValue;
+                timeline?: JsonValue;
+                envId?: JsonValue;
+                includeDatabase?: JsonValue;
+            }) => Promise<JsonValue>;
+            deleteTimeline: (args: {
+                name: string;
+            }) => Promise<JsonValue>;
+            jumpTimeline: (args: {
+                name: string;
+                targetHex: JsonValue;
+            }) => Promise<JsonValue>;
+            listSnapshots: (args?: {
+                timeline?: JsonValue;
+            }) => Promise<JsonValue>;
+            listTimelines: () => Promise<JsonValue>;
+            restoreSnapshot: (args: {
+                snapshotId: string;
+                confirm?: JsonValue;
+                includeDatabase?: JsonValue;
+                includeSchema?: JsonValue;
+                envId?: JsonValue;
+            }) => Promise<JsonValue>;
+            restoreSnapshotPlan: (args: {
+                snapshotId: string;
+                envId?: JsonValue;
+            }) => Promise<JsonValue>;
+            deleteSnapshot: (args: {
+                snapshotId: string;
+            }) => Promise<JsonValue>;
+            spawnTimeline: (args: {
+                name: JsonValue;
+                sourceHexId?: JsonValue;
+            }) => Promise<JsonValue>;
+            timelineHistory: (args: {
+                name: string;
+                limit?: JsonValue;
+                offset?: JsonValue;
+            }) => Promise<JsonValue>;
+            topology: (args?: {
+                timeline?: JsonValue;
+                limit?: JsonValue;
+            }) => Promise<JsonValue>;
+            variance: (args: {
+                oldChrononHex: JsonValue;
+                newChrononHex: JsonValue;
+                domainFilter?: JsonValue;
+            }) => Promise<JsonValue>;
+            restorePlan: (args: {
+                at: JsonValue;
+                timeline?: JsonValue;
+                envId?: JsonValue;
+                only?: JsonValue;
+                includeDatabase?: JsonValue;
+                includeSchema?: JsonValue;
+            }) => Promise<JsonValue>;
+            restore: (args: {
+                at: JsonValue;
+                timeline?: JsonValue;
+                envId?: JsonValue;
+                only?: JsonValue;
+                includeDatabase?: JsonValue;
+                includeSchema?: JsonValue;
+                confirm: JsonValue;
+            }) => Promise<JsonValue>;
+            commitChanges: (args: {
+                hexId: string;
+                compareTo?: JsonValue;
+            }) => Promise<JsonValue>;
+            undoPlan: (args: {
+                hexId: string;
+                timeline?: JsonValue;
+                envId?: JsonValue;
+            }) => Promise<JsonValue>;
+            undo: (args: {
+                hexId: string;
+                confirm: JsonValue;
+                timeline?: JsonValue;
+                envId?: JsonValue;
+                includeSchema?: JsonValue;
+            }) => Promise<JsonValue>;
+            listEnvironmentBranches: () => Promise<JsonValue>;
+            bindEnvironment: (args: {
+                envId: string;
+                name: JsonValue;
+            }) => Promise<JsonValue>;
+        };
+        knowledge: {
+            list: () => Promise<JsonValue>;
+            create: (args: {
+                body: JsonObject;
+            }) => Promise<JsonValue>;
+            update: (args: {
+                name: string;
+                body: JsonObject;
+            }) => Promise<JsonValue>;
+            delete: (args: {
+                name: string;
+            }) => Promise<JsonValue>;
+            listDocuments: (args: {
+                name: string;
+                limit?: JsonValue;
+                offset?: JsonValue;
+            }) => Promise<JsonValue>;
+            addDocument: (args: {
+                name: string;
+                body: JsonObject;
+            }) => Promise<JsonValue>;
+            deleteDocument: (args: {
+                name: string;
+                documentId: string;
+            }) => Promise<JsonValue>;
+            search: (args: {
+                name: string;
+                body: JsonObject;
+            }) => Promise<JsonValue>;
+            listSources: (args: {
+                name: string;
+            }) => Promise<JsonValue>;
+        };
+        mcp: {
+            listConnections: () => Promise<JsonValue>;
+            disconnect: (args: {
+                grantId: string;
+            }) => Promise<JsonValue>;
+            orgSettings: (args?: {
+                orgId?: string;
+            }) => Promise<JsonValue>;
+            setOrgAllowed: (args: {
+                orgId?: string;
+                allowed: JsonValue;
+            }) => Promise<JsonValue>;
+            orgDisconnect: (args: {
+                orgId?: string;
+                grantId: string;
+            }) => Promise<JsonValue>;
+        };
+        messaging: {
+            listTemplates: (args?: {
+                projectId?: string;
+            }) => Promise<JsonValue>;
+            getTemplate: (args: {
+                projectId?: string;
+                name: string;
+            }) => Promise<JsonValue>;
+            putTemplate: (args: {
+                projectId?: string;
+                name: string;
+                description?: JsonValue;
+                category?: JsonValue;
+                push?: JsonValue;
+                email?: JsonValue;
+            }) => Promise<JsonValue>;
+            deleteTemplate: (args: {
+                projectId?: string;
+                name: string;
+            }) => Promise<JsonValue>;
+            listAudiences: (args?: {
+                projectId?: string;
+            }) => Promise<JsonValue>;
+            getAudience: (args: {
+                projectId?: string;
+                name: string;
+            }) => Promise<JsonValue>;
+            putAudience: (args: {
+                projectId?: string;
+                name: string;
+                sql: JsonValue;
+                description?: JsonValue;
+            }) => Promise<JsonValue>;
+            deleteAudience: (args: {
+                projectId?: string;
+                name: string;
+            }) => Promise<JsonValue>;
+            previewAudience: (args: {
+                projectId?: string;
+                name: string;
+            }) => Promise<JsonValue>;
+            previewSql: (args: {
+                projectId?: string;
+                sql: JsonValue;
+            }) => Promise<JsonValue>;
+            send: (args: {
+                projectId?: string;
+                template?: JsonValue;
+                content?: JsonValue;
+                to: JsonValue;
+                channels?: JsonValue;
+                variables?: JsonValue;
+                category?: JsonValue;
+                dryRun?: JsonValue;
+                sendAt?: JsonValue;
+                timezone?: JsonValue;
+                timezoneFallback?: JsonValue;
+                track?: JsonValue;
+            }) => Promise<JsonValue>;
+            listSends: (args?: {
+                projectId?: string;
+                limit?: JsonValue;
+            }) => Promise<JsonValue>;
+            getSend: (args: {
+                projectId?: string;
+                sendId: string;
+            }) => Promise<JsonValue>;
+            listDeliveries: (args?: {
+                projectId?: string;
+                sendId?: JsonValue;
+                userId?: JsonValue;
+                status?: JsonValue;
+                limit?: JsonValue;
+                offset?: JsonValue;
+            }) => Promise<JsonValue>;
+            usage: (args?: {
+                projectId?: string;
+            }) => Promise<JsonValue>;
+            setUserOptout: (args: {
+                projectId?: string;
+                userId: string;
+                channel: JsonValue;
+                optedOut: JsonValue;
+            }) => Promise<JsonValue>;
+            getPreferences: () => Promise<JsonValue>;
+            setPreferences: (args: {
+                marketing: JsonValue;
+            }) => Promise<JsonValue>;
+            cancelSend: (args: {
+                projectId?: string;
+                sendId: string;
+            }) => Promise<JsonValue>;
+            listInApp: (args?: {
+                projectId?: string;
+            }) => Promise<JsonValue>;
+            putInApp: (args: {
+                projectId?: string;
+                name: string;
+                content: JsonValue;
+                trigger?: JsonValue;
+                audience?: JsonValue;
+                status?: JsonValue;
+                startsAt?: JsonValue;
+                endsAt?: JsonValue;
+                maxImpressions?: JsonValue;
+                priority?: JsonValue;
+            }) => Promise<JsonValue>;
+            deleteInApp: (args: {
+                projectId?: string;
+                name: string;
+            }) => Promise<JsonValue>;
+            trackEvent: (args: {
+                sendId: JsonValue;
+                channel?: JsonValue;
+                kind?: JsonValue;
+            }) => Promise<JsonValue>;
+            myInApp: (args?: {
+                trigger?: JsonValue;
+                limit?: JsonValue;
+            }) => Promise<JsonValue>;
+            inAppEvent: (args: {
+                messageId: string;
+                kind: JsonValue;
+            }) => Promise<JsonValue>;
+        };
+        mobile: {
+            listApps: (args?: {
+                projectId?: string;
+            }) => Promise<JsonValue>;
+            createApp: (args: {
+                projectId?: string;
+                body: JsonObject;
+            }) => Promise<JsonValue>;
+            updateApp: (args: {
+                projectId?: string;
+                appId: string;
+                body: JsonObject;
+            }) => Promise<JsonValue>;
+            deleteApp: (args: {
+                projectId?: string;
+                appId: string;
+            }) => Promise<JsonValue>;
+            listUserDevices: (args: {
+                projectId?: string;
+                userId: string;
+            }) => Promise<JsonValue>;
+            revokeUserDevice: (args: {
+                projectId?: string;
+                userId: string;
+                deviceId: string;
+            }) => Promise<JsonValue>;
+        };
+        observability: {
+            metrics: (args?: {
+                hours?: JsonValue;
+                service?: JsonValue;
+                points?: JsonValue;
+                byService?: JsonValue;
+            }) => Promise<JsonValue>;
+            logs: (args?: {
+                limit?: JsonValue;
+                service?: JsonValue;
+                status?: JsonValue;
+                q?: JsonValue;
+                after?: JsonValue;
+                before?: JsonValue;
+                source?: JsonValue;
+                env?: JsonValue;
+            }) => Promise<JsonValue>;
+            routes: (args?: {
+                hours?: JsonValue;
+                env?: JsonValue;
+                route?: JsonValue;
+                limit?: JsonValue;
+            }) => Promise<JsonValue>;
+            alertsList: () => Promise<JsonValue>;
+            alertsCreate: (args: {
+                metric: JsonValue;
+                threshold: JsonValue;
+                windowMinutes?: JsonValue;
+                name?: JsonValue;
+                target?: JsonValue;
+                env?: JsonValue;
+                minRequests?: JsonValue;
+                email?: JsonValue;
+                webhookUrl?: JsonValue;
+            }) => Promise<JsonValue>;
+            alertsUpdate: (args: {
+                ruleId: string;
+                body: JsonObject;
+            }) => Promise<JsonValue>;
+            alertsDelete: (args: {
+                ruleId: string;
+            }) => Promise<JsonValue>;
+            alertsTest: (args: {
+                ruleId: string;
+            }) => Promise<JsonValue>;
+            alertsEvents: (args?: {
+                limit?: JsonValue;
+            }) => Promise<JsonValue>;
+        };
+        org: {
+            acceptOrgInvite: (args: {
+                token: JsonValue;
+            }) => Promise<JsonValue>;
+            addMember: (args: {
+                orgId?: string;
+                userId: JsonValue;
+                role: JsonValue;
+            }) => Promise<JsonValue>;
+            createEdge: (args: {
+                sourceNodeId: JsonValue;
+                targetNodeId: JsonValue;
+                relationType: JsonValue;
+                role?: JsonValue;
+            }) => Promise<JsonValue>;
+            createOrgInvite: (args: {
+                orgId?: string;
+                email: JsonValue;
+                role: JsonValue;
+            }) => Promise<JsonValue>;
+            deleteOrg: (args?: {
+                orgId?: string;
+            }) => Promise<JsonValue>;
+            ensureDefaultApiKeys: () => Promise<JsonValue>;
+            getChildren: (args: {
+                parentId: string;
+                relation?: JsonValue;
+            }) => Promise<JsonValue>;
+            getContext: (args: {
+                userId: string;
+                resourceId: string;
+            }) => Promise<JsonValue>;
+            getNode: (args: {
+                nodeId: string;
+            }) => Promise<JsonValue>;
+            getProjectRef: (args?: {
+                projectId?: string;
+            }) => Promise<JsonValue>;
+            getProjectSettings: () => Promise<JsonValue>;
+            getRoleCatalog: () => Promise<JsonValue>;
+            getRoleMatrix: () => Promise<JsonValue>;
+            getRoleMatrixStatus: () => Promise<JsonValue>;
+            listApiKeys: () => Promise<JsonValue>;
+            listNodes: (args?: {
+                nodeType?: JsonValue;
+            }) => Promise<JsonValue>;
+            listOrgMembers: (args?: {
+                orgId?: string;
+            }) => Promise<JsonValue>;
+            removeOrgMember: (args: {
+                orgId?: string;
+                userId: string;
+            }) => Promise<JsonValue>;
+            revokeApiKey: (args: {
+                keyId: string;
+            }) => Promise<JsonValue>;
+            setOrgPlan: (args: {
+                orgId?: string;
+                plan: JsonValue;
+            }) => Promise<JsonValue>;
+            updateMemberRole: (args: {
+                orgId?: string;
+                userId: string;
+                role: JsonValue;
+            }) => Promise<JsonValue>;
+            updateOrg: (args: {
+                orgId?: string;
+                body: JsonObject;
+            }) => Promise<JsonValue>;
+            updateProjectSettings: (args: {
+                settings: JsonValue;
+            }) => Promise<JsonValue>;
+            updateRoleMatrix: (args: {
+                matrix: JsonValue;
+            }) => Promise<JsonValue>;
+            transferOrgOwnership: (args: {
+                orgId?: string;
+                newOwnerId: JsonValue;
+                reason?: JsonValue;
+            }) => Promise<JsonValue>;
+        };
+        perf: {
+            summary: (args?: {
+                days?: JsonValue;
+                kind?: JsonValue;
+                release?: JsonValue;
+                platform?: JsonValue;
+                by?: JsonValue;
+                limit?: JsonValue;
+            }) => Promise<JsonValue>;
+            series: (args: {
+                kind: JsonValue;
+                name: JsonValue;
+                days?: JsonValue;
+                route?: JsonValue;
+                release? /**
+                 * Billing + plan management (Ledger engine).
+                 *
+                 * The plan catalog is public; subscription and usage routes require a
+                 * valid auth token. Subscription writes require the caller to be an
+                 * org admin.
+                 */: JsonValue;
+                platform?: JsonValue;
+                q?: JsonValue;
+            }) => Promise<JsonValue>;
+            samples: (args?: {
+                kind?: JsonValue;
+                name?: JsonValue;
+                route?: JsonValue;
+                traceId?: JsonValue;
+                slowest?: JsonValue;
+                days?: JsonValue;
+                limit?: JsonValue;
+            }) => Promise<JsonValue>;
+            network: (args?: {
+                days?: JsonValue;
+                env?: JsonValue;
+                limit?: JsonValue;
+            }) => Promise<JsonValue>;
+            trace: (args: {
+                traceId: string;
+            }) => Promise<JsonValue>;
+            usage: () => Promise<JsonValue>;
+        };
+        platform: {
+            createEventHook: (args: {
+                body: JsonObject;
+            }) => Promise<JsonValue>;
+            deleteEventHook: (args: {
+                hookId: string;
+            }) => Promise<JsonValue>;
+            disconnectGithub: (args?: {
+                projectId?: JsonValue;
+            }) => Promise<JsonValue>;
+            gatewayHealth: () => Promise<JsonValue>;
+            getEnginesHealth: () => Promise<JsonValue>;
+            getErrorTrace: (args: {
+                traceId: string;
+            }) => Promise<JsonValue>;
+            getGithubConnectionState: (args?: {
+                projectId?: JsonValue;
+            }) => Promise<JsonValue>;
+            listEventHooks: () => Promise<JsonValue>;
+            resolveErrorTrace: (args: {
+                traceId: string;
+                resolved: JsonValue;
+            }) => Promise<JsonValue>;
+        };
+        policy: {
+            auditCount: () => Promise<JsonValue>;
+            auditVerify: () => Promise<JsonValue>;
+            policyCreate: (args: {
+                policyId: JsonValue;
+                name: JsonValue;
+                splSource: JsonValue;
+                orgId: JsonValue;
+            }) => Promise<JsonValue>;
+            policyDelete: (args: {
+                policyId: string;
+            }) => Promise<JsonValue>;
+            policyEvaluate: (args: {
+                policyId: string;
+                context: JsonValue;
+            }) => Promise<JsonValue>;
+            policyGet: (args: {
+                policyId: string;
+            }) => Promise<JsonValue>;
+            policyHistory: (args: {
+                policyId: string;
+            }) => Promise<JsonValue>;
+            policyList: () => Promise<JsonValue>;
+            policyRollback: (args: {
+                policyId: string;
+                version: JsonValue;
+            }) => Promise<JsonValue>;
+            policyTemplates: () => Promise<JsonValue>;
+        };
+        push: {
+            getCredentials: (args?: {
+                projectId?: string;
+            }) => Promise<JsonValue>;
+            setFcmCredentials: (args: {
+                projectId?: string;
+                serviceAccount: JsonValue;
+            }) => Promise<JsonValue>;
+            setApnsCredentials: (args: {
+                projectId?: string;
+                p8: JsonValue;
+                keyId: JsonValue;
+                teamId: JsonValue;
+                bundleId: JsonValue;
+                environment?: JsonValue;
+            }) => Promise<JsonValue>;
+            deleteCredentials: (args: {
+                projectId?: string;
+                provider: string;
+            }) => Promise<JsonValue>;
+            listDevices: (args?: {
+                projectId?: string;
+                userId?: JsonValue;
+                limit?: JsonValue;
+                before?: JsonValue;
+            }) => Promise<JsonValue>;
+            send: (args: {
+                projectId?: string;
+                message: JsonObject;
+            }) => Promise<JsonValue>;
+            listSends: (args?: {
+                projectId?: string;
+                limit?: JsonValue;
+            }) => Promise<JsonValue>;
+            registerDevice: (args: {
+                token: JsonValue;
+                platform: JsonValue;
+                provider?: JsonValue;
+                deviceId?: JsonValue;
+                appId?: JsonValue;
+                topics?: JsonValue;
+                locale?: JsonValue;
+            }) => Promise<JsonValue>;
+            myDevices: () => Promise<JsonValue>;
+            updateTopics: (args: {
+                deviceRowId: string;
+                subscribe?: JsonValue;
+                unsubscribe?: JsonValue;
+                replace?: JsonValue;
+            }) => Promise<JsonValue>;
+            deleteDevice: (args: {
+                deviceRowId: string;
+            }) => Promise<JsonValue>;
+            unregisterToken: (args: {
+                token: JsonValue;
+            }) => Promise<JsonValue>;
+            setWebpushCredentials: (args?: {
+                projectId?: string;
+                subject?: JsonValue;
+                rotate?: JsonValue;
+            }) => Promise<JsonValue>;
+            webpushKey: () => Promise<JsonValue>;
+            cancelSend: (args: {
+                projectId?: string;
+                sendId: string;
+            }) => Promise<JsonValue>;
+        };
+        queues: {
+            list: () => Promise<JsonValue>;
+            create: (args: {
+                name: JsonValue;
+                description?: JsonValue;
+                visibilityTimeoutSec?: JsonValue;
+                maxReads?: JsonValue;
+                deadLetterQueue?: JsonValue;
+                retentionDays?: JsonValue;
+                appSend?: JsonValue;
+                consumer?: JsonValue;
+            }) => Promise<JsonValue>;
+            get: (args: {
+                queueName: string;
+            }) => Promise<JsonValue>;
+            update: (args: {
+                queueName: string;
+                settings: JsonObject;
+            }) => Promise<JsonValue>;
+            delete: (args: {
+                queueName: string;
+            }) => Promise<JsonValue>;
+            send: (args: {
+                queueName: string;
+                message: JsonValue;
+                delay?: JsonValue;
+                headers?: JsonValue;
+            }) => Promise<JsonValue>;
+            sendBatch: (args: {
+                queueName: string;
+                messages: JsonValue;
+                delay?: JsonValue;
+                headers?: JsonValue;
+            }) => Promise<JsonValue>;
+            read: (args: {
+                queueName: string;
+                qty?: JsonValue;
+                vt?: JsonValue;
+            }) => Promise<JsonValue>;
+            pop: (args: {
+                queueName: string;
+                qty?: JsonValue;
+            }) => Promise<JsonValue>;
+            archive: (args: {
+                queueName: string;
+                msgIds: JsonValue;
+            }) => Promise<JsonValue>;
+            deleteMessages: (args: {
+                queueName: string;
+                msgIds: JsonValue;
+            }) => Promise<JsonValue>;
+            setVt: (args: {
+                queueName: string;
+                msgId: JsonValue;
+                vt: JsonValue;
+            }) => Promise<JsonValue>;
+            purge: (args: {
+                queueName: string;
+                includeArchived?: JsonValue;
+            }) => Promise<JsonValue>;
+            metrics: (args: {
+                queueName: string;
+            }) => Promise<JsonValue>;
+            messages: (args: {
+                queueName: string;
+                state?: JsonValue;
+                limit?: JsonValue;
+                before?: JsonValue;
+            }) => Promise<JsonValue>;
+        };
+        realtime: {
+            channels: () => Promise<JsonValue>;
+            presence: (args: {
+                channel: string;
+            }) => Promise<JsonValue>;
+            replay: (args: {
+                channel: string;
+                after?: JsonValue;
+                limit?: JsonValue;
+            }) => Promise<JsonValue>;
+            subscribe: (args: {
+                channel: JsonValue;
+                clientId: JsonValue;
+            }) => Promise<JsonValue>;
+            unsubscribe: (args: {
+                channel: JsonValue;
+                clientId: JsonValue;
+            }) => Promise<JsonValue>;
+        };
+        remoteConfig: {
+            getDraft: (args?: {
+                projectId?: string;
+                env?: JsonValue;
+            }) => Promise<JsonValue>;
+            putParam: (args: {
+                projectId?: string;
+                key: string;
+                type?: JsonValue;
+                defaultValue?: JsonValue;
+                description?: JsonValue;
+                conditional?: JsonValue;
+                env?: JsonValue;
+            }) => Promise<JsonValue>;
+            deleteParam: (args: {
+                projectId?: string;
+                key: string;
+                env?: JsonValue;
+            }) => Promise<JsonValue>;
+            putCondition: (args: {
+                projectId?: string;
+                name: string;
+                rules: JsonValue;
+                priority?: JsonValue;
+                description?: JsonValue;
+                env?: JsonValue;
+            }) => Promise<JsonValue>;
+            deleteCondition: (args: {
+                projectId?: string;
+                name: string;
+                env?: JsonValue;
+            }) => Promise<JsonValue>;
+            getTemplate: (args?: {
+                projectId?: string;
+                env?: JsonValue;
+                source?: JsonValue;
+            }) => Promise<JsonValue>;
+            putTemplate: (args?: {
+                projectId?: string;
+                conditions?: JsonValue;
+                parameters?: JsonValue;
+                env?: JsonValue;
+                prune?: JsonValue;
+            }) => Promise<JsonValue>;
+            diff: (args?: {
+                projectId?: string;
+                template?: JsonValue;
+                env?: JsonValue;
+            }) => Promise<JsonValue>;
+            preview: (args?: {
+                projectId?: string;
+                template?: JsonValue;
+                env?: JsonValue;
+                sample?: JsonValue;
+            }) => Promise<JsonValue>;
+            publish: (args?: {
+                projectId?: string;
+                message?: JsonValue;
+                baseVersion?: JsonValue;
+                scheduledAt?: JsonValue;
+                env?: JsonValue;
+            }) => Promise<JsonValue>;
+            listVersions: (args?: {
+                projectId?: string;
+                env?: JsonValue;
+                limit?: JsonValue;
+            }) => Promise<JsonValue>;
+            getVersion: (args: {
+                projectId?: string;
+                version: string;
+                env?: JsonValue;
+            }) => Promise<JsonValue>;
+            rollback: (args: {
+                projectId?: string;
+                version: string;
+                message?: JsonValue;
+                env?: JsonValue;
+            }) => Promise<JsonValue>;
+            cancelSchedule: (args: {
+                projectId?: string;
+                scheduleId: string;
+                env?: JsonValue;
+            }) => Promise<JsonValue>;
+            evaluate: (args?: {
+                projectId?: string;
+                context?: JsonValue;
+                source?: JsonValue;
+                env?: JsonValue;
+            }) => Promise<JsonValue>;
+        };
+        schedules: {
+            list: (args?: {
+                functionName?: JsonValue;
+            }) => Promise<JsonValue>;
+            create: (args: {
+                cronExpression: JsonValue;
+                functionName?: JsonValue;
+                payload?: JsonValue;
+                enabled?: JsonValue;
+                name?: JsonValue;
+                description?: JsonValue;
+                timezone?: JsonValue;
+                overlap?: JsonValue;
+                maxAttempts?: JsonValue;
+                timeoutSec?: JsonValue;
+                targetType?: JsonValue;
+                target?: JsonValue;
+            }) => Promise<JsonValue>;
+            get: (args: {
+                scheduleId: string;
+            }) => Promise<JsonValue>;
+            update: (args: {
+                scheduleId: string;
+                changes: JsonObject;
+            }) => Promise<JsonValue>;
+            delete: (args: {
+                scheduleId: string;
+            }) => Promise<JsonValue>;
+            runs: (args: {
+                scheduleId: string;
+                limit?: JsonValue;
+                before?: JsonValue;
+            }) => Promise<JsonValue>;
+            run: (args: {
+                scheduleId: string;
+            }) => Promise<JsonValue>;
+            preview: (args: {
+                cronExpression: JsonValue;
+                timezone?: JsonValue;
+                count?: JsonValue;
+            }) => Promise<JsonValue>;
+        };
+        simulation: {
+            compareRuns: (args: {
+                targetRunId: string;
+                baselineRunId: string;
+            }) => Promise<JsonValue>;
+            discover: () => Promise<JsonValue>;
+            getRun: (args: {
+                runId: string;
+            }) => Promise<JsonValue>;
+            listRuns: (args?: {
+                limit?: JsonValue;
+                offset?: JsonValue;
+            }) => Promise<JsonValue>;
+            quota: () => Promise<JsonValue>;
+            listIntended: () => Promise<JsonValue>;
+            markIntended: (args: {
+                role: JsonValue;
+                action: JsonValue;
+                resource: JsonValue;
+                outcome: JsonValue;
+                note?: JsonValue;
+            }) => Promise<JsonValue>;
+            unmarkIntended: (args: {
+                markId: string;
+            }) => Promise<JsonValue>;
+            topology: () => Promise<JsonValue>;
+            inventory: (args?: {
+                include?: JsonValue;
+                fresh?: JsonValue;
+            }) => Promise<JsonValue>;
+            checks: (args?: {
+                severity?: JsonValue;
+                area?: JsonValue;
+                fresh?: JsonValue;
+            }) => Promise<JsonValue>;
+            graph: (args?: {
+                fresh?: JsonValue;
+            }) => Promise<JsonValue>;
+            limits: () => Promise<JsonValue>;
+            integrationRun: (args: {
+                connectorId: JsonValue;
+                flowId: JsonValue;
+                outcome?: JsonValue;
+                mode?: JsonValue;
+            }) => Promise<JsonValue>;
+            drillsRun: (args?: {
+                drillIds?: JsonValue;
+                overrides?: JsonValue;
+            }) => Promise<JsonValue>;
+            runArtifacts: (args: {
+                runId: string;
+            }) => Promise<JsonValue>;
+            snapshot: (args?: {
+                includeRows?: JsonValue;
+            }) => Promise<JsonValue>;
+        };
+        storage: {
+            createBucket: (args: {
+                body: JsonObject;
+            }) => Promise<JsonValue>;
+            deleteBucket: (args: {
+                name: string;
+            }) => Promise<JsonValue>;
+            getBucket: (args: {
+                name: string;
+            }) => Promise<JsonValue>;
+            listBuckets: () => Promise<JsonValue>;
+            moveObject: (args: {
+                fromPath: JsonValue;
+                toPath: JsonValue;
+            }) => Promise<JsonValue>;
+            updateBucket: (args: {
+                name: string;
+                body: JsonObject;
+            }) => Promise<JsonValue>;
+        };
+        templates: {
+            list: () => Promise<JsonValue>;
+            get: (args: {
+                name: string;
+            }) => Promise<JsonValue>;
+            apply: (args: {
+                orgId?: string;
+                projectId?: string;
+                name: string;
+                dryRun?: JsonValue;
+            }) => Promise<JsonValue>;
+        };
+        traces: {
+            list: (args?: {
+                kind?: JsonValue;
+                before?: JsonValue;
+                limit?: JsonValue;
+            }) => Promise<JsonValue>;
+            get: (args: {
+                traceId: string;
+            }) => Promise<JsonValue>;
+        };
+        triggers: {
+            list: (args?: {
+                functionName?: JsonValue;
+            }) => Promise<JsonValue>;
+            create: (args: {
+                functionName: JsonValue;
+                source: JsonValue;
+                eventTypes?: JsonValue;
+                resource?: JsonValue;
+                subjectPrefix?: JsonValue;
+                name?: JsonValue;
+                enabled?: JsonValue;
+                maxAttempts?: JsonValue;
+            }) => Promise<JsonValue>;
+            get: (args: {
+                triggerId: string;
+            }) => Promise<JsonValue>;
+            update: (args: {
+                triggerId: string;
+                changes: JsonObject;
+            }) => Promise<JsonValue>;
+            delete: (args: {
+                triggerId: string;
+            }) => Promise<JsonValue>;
+            test: (args: {
+                triggerId: string;
+            }) => Promise<JsonValue>;
+        };
+        vector: {
+            deleteCollection: (args: {
+                collection: string;
+            }) => Promise<JsonValue>;
+            deleteRecord: (args: {
+                collection: string;
+                recordId: string;
+            }) => Promise<JsonValue>;
+            embed: (args: {
+                texts: JsonValue;
+            }) => Promise<JsonValue>;
+            listCollections: () => Promise<JsonValue>;
+            upsert: (args: {
+                collection: JsonValue;
+                docs: JsonValue;
+            }) => Promise<JsonValue>;
+            setCollection: (args: {
+                collection: string;
+                appSearch?: JsonValue;
+            }) => Promise<JsonValue>;
+            reembedCollection: (args: {
+                collection: string;
+                force?: JsonValue;
+            }) => Promise<JsonValue>;
+            sqlSearch: (args: {
+                tableName: JsonValue;
+                columnName?: JsonValue;
+                vector?: JsonValue;
+                text?: JsonValue;
+                mode?: JsonValue;
+                textColumns?: JsonValue;
+                language?: JsonValue;
+                k?: JsonValue;
+                metric?: JsonValue;
+                select?: JsonValue;
+                filter?: JsonValue;
+                maxDistance?: JsonValue;
+                metadataFilter?: JsonValue;
+                metadataColumn?: JsonValue;
+                filterIn?: JsonValue;
+                efSearch?: JsonValue;
+                probes?: JsonValue;
+                rerank?: JsonValue;
+                rerankCandidates?: JsonValue;
+            }) => Promise<JsonValue>;
+            sqlAutoStatus: () => Promise<JsonValue>;
+            sqlAutoEnable: (args: {
+                tableName: JsonValue;
+                columnName?: JsonValue;
+                sourceColumns: JsonValue;
+                rebuild?: JsonValue;
+                language?: JsonValue;
+            }) => Promise<JsonValue>;
+            sqlAutoDisable: (args: {
+                tableName: string;
+            }) => Promise<JsonValue>;
+            sqlAutoSync: (args?: {
+                tableName?: JsonValue;
+                limit?: JsonValue;
+            }) => Promise<JsonValue>;
+            sqlStatus: () => Promise<JsonValue>;
+            sqlEnable: (args?: {
+                enabled?: JsonValue;
+            }) => Promise<JsonValue>;
+            sqlCreateTable: (args: {
+                tableName: JsonValue;
+                dimensions: JsonValue;
+                ownerRows?: JsonValue;
+            }) => Promise<JsonValue>;
+            sqlAddColumn: (args: {
+                tableName: JsonValue;
+                columnName?: JsonValue;
+                dimensions: JsonValue;
+            }) => Promise<JsonValue>;
+            sqlCreateIndex: (args: {
+                tableName: JsonValue;
+                columnName?: JsonValue;
+                metric?: JsonValue;
+                method?: JsonValue;
+                m?: JsonValue;
+                efConstruction?: JsonValue;
+                lists?: JsonValue;
+                concurrently?: JsonValue;
+            }) => Promise<JsonValue>;
+            sqlInsertRows: (args: {
+                tableName: JsonValue;
+                columnName?: JsonValue;
+                rows: JsonValue;
+                embed?: JsonValue;
+            }) => Promise<JsonValue>;
+        };
+        workflows: {
+            start: (args: {
+                functionName: JsonValue;
+                input?: JsonValue;
+                key?: JsonValue;
+                maxAttempts?: JsonValue;
+            }) => Promise<JsonValue>;
+            list: (args?: {
+                functionName?: JsonValue;
+                status?: JsonValue;
+                before?: JsonValue;
+                limit?: JsonValue;
+            }) => Promise<JsonValue>;
+            get: (args: {
+                runId: string;
+            }) => Promise<JsonValue>;
+            signal: (args: {
+                runId: string;
+                name: JsonValue;
+                data?: JsonValue;
+            }) => Promise<JsonValue>;
+            cancel: (args: {
+                runId: string;
+            }) => Promise<JsonValue>;
+            retry: (args: {
+                runId: string;
+                latest?: JsonValue;
+            }) => Promise<JsonValue>;
+        };
+    };
+    readonly keys: {
+        list: () => Promise<JsonValue>;
+        create: (payload: JsonObject) => Promise<JsonObject>;
+        ensureDefaults: () => Promise<JsonObject>;
+        revoke: (keyId: string) => Promise<JsonObject>;
+    };
+    readonly governance: {
+        listRegions: () => Promise<JsonValue>;
+        listAvailableRegions: (query?: {
+            size?: string;
+            plan?: string;
+        }) => Promise<JsonValue>;
+        patchRegion: (regionId: string, body: JsonObject) => Promise<JsonObject>;
+        listTenants: () => Promise<JsonValue>;
+        getTenant: (orgId: string) => Promise<JsonObject>;
+        setTenantStatus: (orgId: string, body: JsonObject) => Promise<JsonObject>;
+        listTenantDatabases: (orgId: string) => Promise<JsonValue>;
+        provisionDatabase: (orgId: string, body: JsonObject) => Promise<JsonObject>;
+        getDatabaseConnection: (orgId: string, projectId: string) => Promise<JsonObject>;
+        revealDatabaseConnection: (orgId: string, projectId: string, grantId: string) => Promise<JsonObject>;
+        pauseDatabase: (orgId: string, projectId: string) => Promise<JsonObject>;
+        resumeDatabase: (orgId: string, projectId: string) => Promise<JsonObject>;
+        resizeDatabase: (orgId: string, projectId: string, body: JsonObject) => Promise<JsonObject>;
+        deleteDatabase: (orgId: string, projectId: string, snapshot?: boolean) => Promise<JsonObject>;
+        listDatabaseBackups: (orgId: string, projectId: string, limit?: number) => Promise<JsonValue>;
+        triggerDatabaseBackup: (orgId: string, projectId: string) => Promise<JsonObject>;
+        downloadDatabaseBackup: (orgId: string, projectId: string, backupId: number | string) => Promise<Blob>;
+        downloadProjectExport: (orgId: string, projectId: string, exportId: string) => Promise<Blob>;
+        adminListDatabases: () => Promise<JsonValue>;
+        listHosts: (regionId?: string) => Promise<JsonValue>;
+        patchHost: (hostId: string, body: JsonObject) => Promise<JsonObject>;
+        metricsOverview: () => Promise<JsonObject>;
+        projectMetrics: (projectId: string, since?: string, limit?: number) => Promise<JsonObject>;
+    };
+    readonly admin: {
+        listErrorTraces: (query?: Record<string, string | number | boolean | null | undefined>) => Promise<JsonValue>;
+        getErrorTrace: (traceId: string) => Promise<JsonObject>;
+        resolveErrorTrace: (traceId: string, body?: JsonObject) => Promise<JsonObject>;
+        usageOverview: (period?: string, limit?: number) => Promise<JsonObject>;
+        listAccessTransparency: (query: Record<string, string | number | boolean | null | undefined>) => Promise<JsonValue>;
+        gatewayHealth: () => Promise<JsonValue>;
+    };
+    /**
+     * Vector / embeddings (Nexus engine). `embed` works anywhere (in functions too, with the service key).
+     *
+     * **Collections are the legacy vector store** (capped at `ai.collection_max_records` per collection). For
+     * large or row-secured data use SQL vectors (`sov.api.vector.sqlSearch`, `sqlCreateIndex`, automatic
+     * embeddings) or knowledge bases (`sov.knowledge`).
+     *
+     * All routes are project-scoped via the standard `X-Sovaria-Project-ID`
+     * header so call `setScope({ orgId, projectId })` first.
+     */
+    readonly vector: {
+        embed: (texts: string[]) => Promise<{
+            vectors: number[][];
+            dim: number;
+            count: number;
+        }>;
+        upsert: (collection: string, docs: Array<{
+            id?: string;
+            text: string;
+            metadata?: JsonObject;
+        }>) => Promise<JsonObject>;
+        /**
+         * Search a collection. `mode`: `vector` (meaning), `keyword` (the words, BM25) or `hybrid` (both,
+         * fused); the default is vector with a real embedding model and hybrid with the local hash model.
+         * Apps (anon key, signed-in users) may only search collections opened with `setCollection(name, { appSearch: true })`.
+         */
+        search: (collection: string, query: string, options?: {
+            topK?: number;
+            metadataFilter?: JsonObject;
+            mode?: "vector" | "keyword" | "hybrid";
+        }) => Promise<JsonObject>;
+        /** Collection settings (team / service key): `appSearch` lets the project's apps search it. */
+        setCollection: (collection: string, settings: {
+            appSearch?: boolean;
+        }) => Promise<JsonObject>;
+        listCollections: () => Promise<JsonObject>;
+        listRecords: (collection: string, options?: {
+            limit?: number;
+            offset?: number;
+        }) => Promise<JsonObject>;
+        deleteRecord: (collection: string, recordId: string) => Promise<JsonObject>;
+        deleteCollection: (collection: string) => Promise<JsonObject>;
+    };
+    /**
+     * Knowledge bases (RAG) on the project's own Postgres: add documents (text, files, web pages), then search
+     * them with citations. Searches only return passages the signed-in user may read.
+     *
+     * ```ts
+     * await sov.knowledge.addFile('support_docs', file)            // a File / Blob in the browser
+     * const { results, citations } = await sov.knowledge.search('support_docs', 'refund window')
+     * ```
+     */
+    readonly knowledge: {
+        list: () => Promise<JsonObject>;
+        create: (name: string, options?: KnowledgeBaseOptions) => Promise<JsonObject>;
+        addText: (name: string, text: string, options?: KnowledgeDocumentOptions & {
+            format?: "text" | "markdown" | "html";
+        }) => Promise<KnowledgeAddResult>;
+        /** A web page. `refreshHours` (team, paid plans) fetches it again on a schedule; only changed parts are re-embedded. */
+        addUrl: (name: string, url: string, options?: KnowledgeDocumentOptions & {
+            refreshHours?: number;
+        }) => Promise<KnowledgeAddResult>;
+        /** URL documents fetched again on a schedule (team). */
+        sources: (name: string) => Promise<JsonObject>;
+        /** A PDF, DOCX, HTML, Markdown, TXT, CSV or JSON file (up to 7 MB): a `File`/`Blob`, or bytes with `filename`. */
+        addFile: (name: string, file: Blob | Uint8Array | ArrayBuffer, options?: KnowledgeDocumentOptions & {
+            filename?: string;
+        }) => Promise<KnowledgeAddResult>;
+        documents: (name: string, options?: {
+            limit?: number;
+            offset?: number;
+        }) => Promise<JsonObject>;
+        deleteDocument: (name: string, documentId: string) => Promise<JsonObject>;
+        /**
+         * Passages for a question. `documentIds` (up to 50) scopes the search; `rerank` reorders the passages with
+         * the managed reranker (counts on `ai.rerank_month`; `reranked: false` when none is configured).
+         */
+        search: (name: string, query: string, options?: {
+            k?: number;
+            mode?: "vector" | "keyword" | "hybrid";
+            metadataFilter?: JsonObject;
+            documentIds?: string[];
+            rerank?: boolean;
+        }) => Promise<KnowledgeSearchResult>;
+    };
+    /**
+     * Your project's agents, from your app. The agent acts with the signed-in user's own permissions (and an
+     * agent with knowledge bases only retrieves passages that user may read).
+     *
+     * ```ts
+     * const reply = await sov.agents.run(agentId, { message: 'Where is my order?', onEvent: (e) => render(e) })
+     * await sov.agents.run(agentId, { message: 'And the invoice?', threadId: reply.threadId })
+     * ```
+     */
+    readonly agents: {
+        /** Send a message (a new thread, or `threadId` to continue one) and wait for the answer; `onEvent` streams it. */
+        run: (agentId: string, input: AgentRunInput) => Promise<AgentRunResult>;
+        /** The same as `run`, as an async iterator of events (`conversation`, `text_delta`, `text`, `tool_call`, …, `done`). */
+        stream: (agentId: string, input: AgentRunInput) => AsyncIterable<AgentEvent>;
+        /** The signed-in user's threads with this agent, newest first. */
+        threads: (agentId: string) => Promise<JsonObject[]>;
+        /** One thread with its events (messages, tool calls, answers). */
+        thread: (threadId: string) => Promise<JsonObject>;
+        /** Stop the agent's current run in this thread. */
+        cancel: (threadId: string) => Promise<JsonObject>;
+    };
+    /** POST a JSON body and read the server-sent events it streams back (one JSON object per `data:` line). */
+    private streamEvents;
+}
+export interface KnowledgeBaseOptions {
+    description?: string;
+    /** `team` (default): only the project team searches it; `app_users`: signed-in users read shared documents and their own. */
+    access?: 'team' | 'app_users';
+    /** With `access: 'app_users'`: users may add their own private documents. */
+    userUploads?: boolean;
+    chunkTokens?: number;
+}
+export interface KnowledgeDocumentOptions {
+    /** Re-using an id replaces that document; unchanged parts keep their embeddings. */
+    documentId?: string;
+    title?: string;
+    metadata?: JsonObject;
+}
+export interface KnowledgeAddResult {
+    document_id: string;
+    title: string;
+    chunks: number;
+    new_chunks: number;
+    reused_chunks: number;
+    removed_chunks: number;
+    tokens: number;
+    new_tokens: number;
+    /** Chunks still waiting for their embedding (searchable by keyword meanwhile). */
+    pending: number;
+    model?: string;
+    /** `managed` (Sovaria's model) or `own_key` (the project's provider key). */
+    billing?: string;
+    estimated_cost_usd: number | null;
+    private: boolean;
+    [key: string]: unknown;
+}
+export interface KnowledgeSearchResult {
+    results: Array<{
+        document_id: string;
+        title: string;
+        heading: string;
+        content: string;
+        source_uri: string | null;
+        citation: number;
+        score?: number;
+        distance?: number;
+        metadata: JsonObject;
+        [key: string]: unknown;
+    }>;
+    citations: Array<{
+        n: number;
+        document_id: string;
+        title: string;
+        source_uri: string | null;
+        sections: string[];
+    }>;
+    [key: string]: unknown;
+}
+export interface AgentRunInput {
+    message: string;
+    /** Continue this thread (from an earlier `run`); leave out to start a new one. */
+    threadId?: string;
+    onEvent?: (event: AgentEvent) => void;
+    signal?: AbortSignal;
+}
+export interface AgentEvent {
+    type: string;
+    [key: string]: unknown;
+}
+export interface AgentRunResult {
+    threadId: string;
+    /** The agent's answer (all of its text in this turn). */
+    text: string;
+    /** `idle` when it finished; `awaiting_approval` when a tool needs the user's OK; `error`, `budget`, … */
+    status: string;
+    usage?: JsonObject;
+    events: AgentEvent[];
+}
+/** Server-sent events → JSON objects. Streams when the runtime gives a readable body, else reads it whole. */
+export declare function parseEventStream(response: Response): AsyncGenerator<AgentEvent>;
+export type RealtimeStatus = 'connecting' | 'live' | 'reconnecting' | 'closed';
+export interface RealtimeChannelHandlers {
+    /** Each message's payload (the `payload` field of a published event, or the raw frame). */
+    onMessage?: (payload: JsonObject, raw: JsonObject) => void;
+    onStatus?: (status: RealtimeStatus) => void;
+    /** Called when a connection attempt fails; the channel keeps retrying. */
+    onError?: (error: unknown) => void;
+    /** Maximum delay between reconnects in ms (default 15000). */
+    maxBackoffMs?: number;
+    /**
+     * After a reconnect, fetch the messages published while the socket was down (from the channel's
+     * replay history) and deliver them, in order and once each, before new ones. Default true.
+     */
+    catchUp?: boolean;
+    /**
+     * Messages were missed and can't be recovered: older than the channel's retained history
+     * (`fromSeq`..`toSeq`, by `stream_seq`), or the history couldn't be read (`toSeq` undefined).
+     * Reload your state from the source of truth when this fires.
+     */
+    onGap?: (gap: {
+        fromSeq: number;
+        toSeq?: number;
+        reason: string;
+    }) => void;
+}
+export interface RealtimeChannel {
+    readonly name: string;
+    readonly status: RealtimeStatus;
+    /** Publish to this channel through the API (works for every subscriber). */
+    send: (payload: JsonObject) => Promise<JsonObject>;
+    close: () => void;
+}
+export interface SovariaProjectConfigFile {
+    project?: {
+        name?: string;
+        runtime?: string;
+        ref?: string;
+    };
+    gateway?: {
+        url?: string;
+    };
+    scope?: {
+        org_id?: string;
+        project_id?: string;
+        env_id?: string;
+        orgId?: string;
+        projectId?: string;
+        envId?: string;
+    };
+    features?: {
+        realtime?: boolean;
+        functions?: boolean;
+        storage?: boolean;
+    };
+}
+/** Extra client settings layered over sovaria.config.json (keys, callbacks, session storage). */
+export type ProjectConfigOptions = Omit<SovariaPortalConfig, 'url' | 'baseUrl'>;
+/** Map sovaria.config.json content (written by `sov init` / `sov link`) to SDK bootstrap config. */
+export declare function portalConfigFromProjectFile(raw: SovariaProjectConfigFile, options?: ProjectConfigOptions): SovariaPortalConfig;
+/**
+ * Create a client from sovaria.config.json. In a bundler, import the file and pass the anon key:
+ * `createClientFromProjectConfig(config, { publishableKey: import.meta.env.VITE_SOVARIA_ANON_KEY })`.
+ */
+export declare function createClientFromProjectConfig(raw: SovariaProjectConfigFile, options?: ProjectConfigOptions): SovariaSDK;
+/**
+ * Create a client. Either pass the two values from the console's **Connect** panel —
+ * `createClient('https://<ref>.sovarias.in', '<anon-key>')` — or a config object.
+ */
+export declare function createClient(urlOrConfig: string | SovariaPortalConfig, key?: string, options?: Omit<SovariaPortalConfig, 'url' | 'baseUrl'>): SovariaSDK;