@sovereignfs/sdk 1.25.0

package/dist/index.d.ts

@@ -0,0 +1,543 @@
+import { C as ChangePasswordInput, S as Session, A as ActiveSession, D as DrizzleClient, M as MailOptions, P as PlatformConfig, a as SearchUsersInput, b as DirectoryUser, R as ResolveUsersInput, c as ActivityLogEntry, d as SendNotificationInput, e as StoragePutInput, f as StorageContext, g as StorageObject, E as E2eeContext, h as E2eeProfile, i as CreateE2eeProfileInput, j as E2eeRecoveryWrapper, k as SetE2eeRecoveryWrapperInput, l as EnrollE2eeDeviceInput, m as E2eeDeviceEnrollment, n as CreateSecretInput, o as SecretContext, p as SecretRef, q as SecretScope, r as CreateConnectionInput, s as ConnectionContext, t as ConnectionRef, u as ConnectionListFilter, U as UpdateConnectionInput, v as MarkConnectionErrorInput, O as OAuthStateInput, w as ConnectionOAuthState, x as ProviderConfig } from './e2ee-state-U-GEJ7oL.js';
+export { y as ConnectionScope, z as ConnectionStatus, B as E2eeLocalState, F as E2eeProfileStatus, G as E2eeState, H as ProviderConfigSource, I as SanitizedConnectionError, J as ScheduleContext, K as ScheduleHandler, L as SessionUser, N as UpdateSecretInput } from './e2ee-state-U-GEJ7oL.js';
+export { RecoveryWrappedCmk, WrappedCmk, WrappedDek } from './e2ee-crypto.js';
+export { EncryptedBlob, EncryptedJson } from './e2ee-object.js';
+
+/**
+ * A reference to a versioned data contract exposed by a *provider* plugin, used
+ * by a *consumer* plugin to request it.
+ */
+interface DataContractRef {
+    /** The provider plugin's manifest `id`. */
+    providerId: string;
+    /** The named, read-only contract the provider exposes (e.g. `"expenses"`). */
+    contract: string;
+    /** Contract major version the consumer was built against. */
+    version: number;
+}
+/**
+ * A resolver a provider registers to answer read requests for one of its
+ * contracts. The runtime invokes it only for consumers that hold an active
+ * user consent grant, already scoped to the requesting user and tenant.
+ */
+type DataContractResolver<TParams = unknown, TRow = unknown> = (params: TParams) => Promise<TRow[]>;
+
+/** A data contract a plugin declares in its manifest `data.provides`. */
+interface PluginContractSummary {
+    contract: string;
+    version: number;
+}
+/**
+ * Discovery status of an installed plugin, scoped to the requesting user
+ * (RFC 0051). Never exposes private provider data — only install/enable
+ * status, launch availability, and declared (not consented) contracts.
+ */
+interface PluginAvailability {
+    id: string;
+    name: string;
+    routePrefix: string;
+    icon?: string;
+    /** Always `true` — `get()`/`list()` only ever return installed plugins. */
+    installed: true;
+    /** Whether the plugin is enabled instance-wide (Console toggle / example default). */
+    enabled: boolean;
+    /**
+     * Whether the *current* user could launch this plugin right now: enabled,
+     * not blocked by an `adminOnly` gate the user lacks `console:access` for,
+     * and not paywalled by an unmet entitlement (RFC 0003). `false` when called
+     * without an authenticated user in context.
+     */
+    availableToUser: boolean;
+    /** Data contracts this plugin exposes (`data.provides`), if any. */
+    providesContracts: PluginContractSummary[];
+}
+interface PluginListFilter {
+    /** Only return plugins that declare this contract name in `data.provides`. */
+    providesContract?: string;
+}
+/**
+ * Whether the current user has an active consent grant for a (consumer,
+ * provider, contract, version) tuple. `'not_granted'` covers both "never
+ * granted" and "revoked" — the platform does not distinguish the two once a
+ * grant is inactive; a consumer that needs to tell them apart should compare
+ * against its own last-known cached state.
+ */
+type ConsentStatus = 'granted' | 'not_granted';
+/**
+ * A standard, opaque reference to another plugin's record (RFC 0051). Store
+ * this shape (or split it into columns) in your own tables to point at a
+ * sibling plugin's data without a direct foreign key or copying private data.
+ * `resourceId` is opaque to the consumer — the provider decides its shape.
+ *
+ * References are never authorization: every dereference still goes through
+ * `sdk.data.query()` (or a tool contract) and the current user's live
+ * consent. Treat a stored reference as a nullable link — the provider may be
+ * uninstalled, disabled, have revoked consent, or have deleted the resource.
+ */
+interface PluginReference {
+    /** The provider plugin's manifest `id`. */
+    providerId: string;
+    /** Provider-local resource kind (e.g. `"contact"`, `"invoice"`). */
+    resourceType: string;
+    /** Opaque to the consumer — a UUID, slug, or compound key the provider defines. */
+    resourceId: string;
+    /** The data contract this reference was resolved through, if any. */
+    contract?: string;
+    /** Contract major version at the time this reference was captured. */
+    version?: number;
+    /** A cached, possibly-stale display label — show it when the provider is unavailable. */
+    labelSnapshot?: string;
+    /** Consumer-defined extra metadata. */
+    metadata?: unknown;
+    /** ISO-8601 timestamp of when this reference was created. */
+    linkedAt: string;
+}
+
+/** Supplied by the runtime to an export resolver — scoped to the current user. */
+interface ExportContext {
+    userId: string;
+    tenantId: string;
+    /** User-selected export scope (RFC 0052). */
+    options: ExportOptions;
+}
+/** User-selectable export scope, gathered by the Account Data tab. */
+interface ExportOptions {
+    /** Whether to include plugin-contributed file blobs. Defaults to `true`. */
+    includeFiles: boolean;
+}
+/** Supplied by the runtime to an import handler — scoped to the importing user. */
+interface ImportContext {
+    userId: string;
+    tenantId: string;
+    /**
+     * Maps an id from the source bundle to the id minted on this instance.
+     * Stable within one import: the same `originalId` always yields the same new
+     * id, so a plugin can preserve internal references (FKs) without breakage.
+     */
+    remapId(originalId: string): string;
+}
+/** Metadata about one of the plugin's own secrets, without its plaintext value. */
+interface ExportSecretMetadata {
+    /** The secret's user-facing label (e.g. "Personal API key"). */
+    label: string;
+    /** The secret's provider/purpose (e.g. "openai", "smtp"). */
+    provider: string;
+    /** Whether a value is currently stored — never the value itself. */
+    exists: boolean;
+}
+/** One plugin's slice of a user's export. */
+interface PluginExportSection {
+    /** The contributing plugin's manifest `id`. */
+    pluginId: string;
+    /**
+     * The installed manifest `version` of the contributing plugin, for provenance.
+     * A resolver may omit this — the runtime always overwrites it with the
+     * installed manifest's actual `version` before writing the bundle, so a
+     * plugin cannot misreport its own version.
+     */
+    pluginVersion?: string;
+    /** The plugin's own data-format version (for forward/backward compatibility). */
+    schemaVersion: number;
+    /** Plugin-defined JSON payload (rows, references). */
+    data: unknown;
+    /** Optional binary attachments, keyed by relative path within the section. */
+    blobs?: Record<string, Uint8Array>;
+    /**
+     * Metadata for secrets this plugin owns, scoped to the current user.
+     * Plaintext secret values must never appear here or anywhere in the export.
+     */
+    secretMetadata?: ExportSecretMetadata[];
+    /** Non-fatal notices about this section (e.g. a file that was skipped). */
+    warnings?: string[];
+    /**
+     * Opaque links this plugin holds to other plugins' records (RFC 0051).
+     * Exported and imported as **inert metadata only** — the platform never
+     * dereferences them, whether or not the referenced provider plugin is also
+     * part of the same export. Importing a reference never grants access to
+     * the provider plugin; a live dereference still goes through
+     * `sdk.data.query()` and the current user's consent.
+     */
+    references?: PluginReference[];
+}
+/** Produces one plugin's export section for the current user. */
+type ExportResolver = (ctx: ExportContext) => Promise<PluginExportSection>;
+/** Restores one plugin's export section into the importing user's account. */
+type ImportHandler = (section: PluginExportSection, ctx: ImportContext) => Promise<void>;
+/** Supplied to a deletion handler — scoped to the user being deleted. */
+interface DeletionContext {
+    userId: string;
+    tenantId: string;
+    /** The plugin's own Drizzle client (same as `sdk.db.getClient()`). */
+    db: unknown;
+}
+/** What a deletion handler must return. */
+interface DeletionResult {
+    /** Number of rows (or objects) deleted. */
+    deleted: number;
+    /** Non-fatal errors encountered during cleanup. */
+    errors?: string[];
+}
+/** Cleans up one plugin's user data when a user account is deleted. */
+type DeletionHandler = (ctx: DeletionContext) => Promise<DeletionResult>;
+
+/** Returns the current user session from runtime-injected headers, or null if unauthenticated. */
+declare function getSession(): Promise<Session | null>;
+/**
+ * Return true if the given session has the named capability (RFC 0021).
+ * Plugins should call this instead of comparing `session.user.role` directly
+ * to avoid coupling to the role-preset details.
+ */
+declare function hasCapability(session: Session | null, capability: string): boolean;
+/** Returns the current user session, throwing `NotAuthenticatedError` if unauthenticated. */
+declare function requireSession(): Promise<Session>;
+/**
+ * Change the current user's password (SRS ACC-04). Requires the current
+ * password; the current session is preserved (other sessions are kept too).
+ * Throws with better-auth's message on failure (e.g. wrong current password).
+ */
+declare function changePassword(input: ChangePasswordInput): Promise<void>;
+/** List the current user's active sessions, current one first (SRS ACC-05). */
+declare function listSessions(): Promise<ActiveSession[]>;
+/** Revoke a session by its token (SRS ACC-06). */
+declare function revokeSession(token: string): Promise<void>;
+/**
+ * Sign the current user out (SRS AUTH-02): ends the active session on the auth
+ * server. The caller is responsible for clearing the runtime's `session_data`
+ * cache cookies and redirecting — the platform's logout route does both.
+ */
+declare function signOut(): Promise<void>;
+
+declare const auth_changePassword: typeof changePassword;
+declare const auth_getSession: typeof getSession;
+declare const auth_hasCapability: typeof hasCapability;
+declare const auth_listSessions: typeof listSessions;
+declare const auth_requireSession: typeof requireSession;
+declare const auth_revokeSession: typeof revokeSession;
+declare const auth_signOut: typeof signOut;
+declare namespace auth {
+  export { auth_changePassword as changePassword, auth_getSession as getSession, auth_hasCapability as hasCapability, auth_listSessions as listSessions, auth_requireSession as requireSession, auth_revokeSession as revokeSession, auth_signOut as signOut };
+}
+
+/**
+ * Returns the Drizzle client for this plugin's database.
+ *
+ * **Shared plugins** (the default, `database` omitted or `"shared"`) receive
+ * the platform DB. Tables must be slug-prefixed (e.g. `tasks_lists`) and carry
+ * a `tenant_id` column. `sdk.db.getClient()` is unchanged for these plugins —
+ * isolation is transparent to the caller.
+ *
+ * **Isolated plugins** (`database: "isolated"` in the manifest) receive a
+ * dedicated Drizzle instance backed by their own SQLite file or Postgres
+ * schema. No slug prefix is required inside an isolated store. Tables should
+ * still carry `tenant_id` for multi-tenancy readiness.
+ *
+ * The plugin ID is read from the `x-sovereign-plugin-id` request header
+ * injected by the runtime middleware. Outside a plugin route context (e.g.
+ * instrumentation startup code) the platform DB is returned.
+ *
+ * Async by contract: the platform DB is dialect-agnostic and Postgres has no
+ * synchronous query (SRS §3.6).
+ */
+declare function getClient(): Promise<DrizzleClient>;
+
+declare const db_getClient: typeof getClient;
+declare namespace db {
+  export { db_getClient as getClient };
+}
+
+/** Sends an email via the platform mailer. No-ops when SMTP is not configured. */
+declare function send(options: MailOptions): Promise<void>;
+
+declare const mailer_send: typeof send;
+declare namespace mailer {
+  export { mailer_send as send };
+}
+
+/**
+ * Returns the platform runtime configuration (SRS PLT-06). Async by contract:
+ * the platform DB is dialect-agnostic and Postgres has no synchronous query.
+ */
+declare function getConfig(): Promise<PlatformConfig>;
+
+declare const platform_getConfig: typeof getConfig;
+declare namespace platform {
+  export { platform_getConfig as getConfig };
+}
+
+/**
+ * The host interface that the Sovereign runtime provides to the SDK.
+ * Every method that touches platform infrastructure (DB, mailer, config) is
+ * routed through this interface — the SDK itself has no runtime dependencies.
+ */
+interface SdkHost {
+    db: {
+        /**
+         * `pluginId` is the calling plugin's manifest id, read from the
+         * `x-sovereign-plugin-id` request header by the SDK. `null` means the call
+         * happened outside a plugin route context; the platform DB is returned.
+         */
+        getClient(pluginId: string | null): Promise<DrizzleClient>;
+    };
+    mailer: {
+        send(options: MailOptions): Promise<void>;
+    };
+    platform: {
+        getConfig(): Promise<PlatformConfig>;
+    };
+    directory: {
+        /**
+         * Search active users in the current tenant. `requestingUserId` and
+         * `tenantId` come from runtime-injected request context, not plugin input.
+         */
+        searchUsers(input: SearchUsersInput, requestingUserId: string, tenantId: string): Promise<DirectoryUser[]>;
+        /**
+         * Resolve explicit user IDs to display-safe profile fields for active users
+         * in the current tenant.
+         */
+        resolveUsers(input: ResolveUsersInput, requestingUserId: string, tenantId: string): Promise<DirectoryUser[]>;
+    };
+    data: {
+        /** Register a resolver for a contract this plugin provides. */
+        provide(contract: string, resolver: DataContractResolver): void;
+        /**
+         * Query a provider plugin's contract for the current user.
+         * `consumerId` and `userId` are read from request headers by the SDK caller.
+         */
+        query(ref: DataContractRef, consumerId: string | null, userId: string | null, tenantId: string, params: unknown): Promise<unknown[]>;
+    };
+    activity: {
+        /**
+         * Record one activity event.
+         * `actorId`, `pluginId`, and `tenantId` are injected by the runtime host
+         * from request headers so plugins cannot forge actor identity.
+         */
+        log(entry: ActivityLogEntry, actorId: string | null, pluginId: string | null): Promise<void>;
+    };
+    portability: {
+        /**
+         * Register a plugin's export resolver, keyed by `pluginId` (resolved by the
+         * SDK from the request context). The runtime invokes it at export time.
+         */
+        provideExport(pluginId: string, resolver: ExportResolver): void;
+        /** Register a plugin's import handler, keyed by `pluginId`. */
+        provideImport(pluginId: string, handler: ImportHandler): void;
+        /** Register a plugin's deletion handler (RFC 0033), keyed by `pluginId`. */
+        provideDelete(pluginId: string, handler: DeletionHandler): void;
+    };
+    plugins: {
+        /** Discover one installed plugin's status (RFC 0051), scoped to the given user. */
+        get(id: string, userId: string | null, capabilities: readonly string[]): Promise<PluginAvailability | null>;
+        /** Discover installed plugins, optionally filtered, scoped to the given user. */
+        list(filter: PluginListFilter | undefined, userId: string | null, capabilities: readonly string[]): Promise<PluginAvailability[]>;
+        /** Whether `userId` has an active consent grant for `ref`, requested by `consumerId`. */
+        getConsentStatus(ref: DataContractRef, consumerId: string, userId: string): Promise<ConsentStatus>;
+    };
+    notifications: {
+        /**
+         * Deliver one notification to a user. The runtime injects `source`,
+         * `sourceType`, and `tenantId` from the request context so the plugin only
+         * supplies the payload fields.
+         */
+        send(input: SendNotificationInput, pluginId: string): Promise<void>;
+    };
+    storage: {
+        put(input: StoragePutInput, context: StorageContext): Promise<StorageObject>;
+        get(key: string, context: StorageContext): Promise<(StorageObject & {
+            body: ReadableStream;
+        }) | null>;
+        delete(key: string, context: StorageContext): Promise<void>;
+        list(prefix: string | undefined, context: StorageContext): Promise<StorageObject[]>;
+        getSignedUrl(key: string, options: {
+            expiresInSeconds?: number;
+        } | undefined, context: StorageContext): Promise<string>;
+    };
+    /**
+     * Client-side encryption profile persistence (RFC 0060). Pure metadata
+     * plumbing — no encryption happens here; the CMK is generated and
+     * wrapped/unwrapped entirely in the browser (`@sovereignfs/sdk`'s
+     * `e2ee-crypto`/`e2ee-device` modules) before these methods are ever
+     * called with the resulting ciphertext.
+     */
+    e2ee: {
+        getProfile(context: E2eeContext): Promise<E2eeProfile | null>;
+        createProfile(input: CreateE2eeProfileInput, context: E2eeContext): Promise<E2eeProfile>;
+        getRecoveryWrapper(context: E2eeContext): Promise<E2eeRecoveryWrapper | null>;
+        setRecoveryWrapper(input: SetE2eeRecoveryWrapperInput, context: E2eeContext): Promise<E2eeRecoveryWrapper>;
+        enrollDevice(input: EnrollE2eeDeviceInput, context: E2eeContext): Promise<E2eeDeviceEnrollment>;
+        listDevices(context: E2eeContext): Promise<E2eeDeviceEnrollment[]>;
+        revokeDevice(id: string, context: E2eeContext): Promise<void>;
+    };
+    secrets: {
+        create(input: CreateSecretInput, context: SecretContext): Promise<SecretRef>;
+        get(id: string, context: SecretContext): Promise<string | null>;
+        list(scope: SecretScope | undefined, context: SecretContext): Promise<SecretRef[]>;
+        update(id: string, value: string, context: SecretContext): Promise<SecretRef>;
+        delete(id: string, context: SecretContext): Promise<void>;
+    };
+    connections: {
+        create(input: CreateConnectionInput, context: ConnectionContext): Promise<ConnectionRef>;
+        list(filter: ConnectionListFilter | undefined, context: ConnectionContext): Promise<ConnectionRef[]>;
+        get(id: string, context: ConnectionContext): Promise<ConnectionRef | null>;
+        update(id: string, input: UpdateConnectionInput, context: ConnectionContext): Promise<ConnectionRef>;
+        disconnect(id: string, context: ConnectionContext): Promise<void>;
+        markUsed(id: string, context: ConnectionContext): Promise<void>;
+        markError(id: string, input: MarkConnectionErrorInput, context: ConnectionContext): Promise<ConnectionRef>;
+        createOAuthState(input: OAuthStateInput, context: ConnectionContext): Promise<string>;
+        verifyOAuthState(state: string, context: ConnectionContext): Promise<ConnectionOAuthState>;
+        getProviderConfig(provider: string, context: ConnectionContext): Promise<ProviderConfig>;
+    };
+}
+/**
+ * Register the platform host implementation. Called once at runtime startup
+ * (via `runtime/instrumentation.ts`) before any request is served.
+ *
+ * Exported from `@sovereignfs/sdk` so the runtime can call it; plugin code
+ * should never need to call this.
+ */
+declare function provideHost(host: SdkHost): void;
+
+/**
+ * Thrown by SDK surfaces that have no standalone implementation: the v1 methods
+ * that the Sovereign runtime supplies at runtime, and the post-v1 surfaces
+ * (storage, notifications, events) that are declared but not yet implemented.
+ */
+declare class NotImplementedError extends Error {
+    constructor(message: string);
+}
+/** Thrown by `sdk.auth.requireSession()` when no authenticated session is present. */
+declare class NotAuthenticatedError extends Error {
+    constructor();
+}
+/**
+ * Thrown by `sdk.data.query()` when the current user has not granted the calling
+ * (consumer) plugin consent to read the requested provider contract — the
+ * consent-gated cross-plugin data-sharing mechanism (RFC 0002). Reserved
+ * alongside that surface; not raised until the mechanism is implemented.
+ */
+declare class ConsentRequiredError extends Error {
+    constructor(message?: string);
+}
+/**
+ * Thrown by `sdk.billing.requireEntitlement()` when the current user has no
+ * valid (active, unexpired) entitlement for the calling plugin (RFC 0003).
+ * The runtime middleware also enforces this at the route level, so most plugins
+ * never need to call `requireEntitlement()` directly — it is for in-plugin
+ * feature gating by tier.
+ */
+declare class EntitlementRequiredError extends Error {
+    constructor(message?: string);
+}
+
+/**
+ * The Sovereign SDK — the only contract between a plugin and the platform.
+ *
+ * **Stable surface (covered by the v1.0.0 semver guarantee** — see
+ * `docs/sdk-stability.md`): `auth`, `db`, `mailer`, `platform`. These are
+ * implemented and will not change in breaking ways without a major bump +
+ * migration note (NFR-04).
+ *
+ * **Experimental / reserved (NOT covered by the stability guarantee):** `data`
+ * (cross-plugin data sharing, RFC 0002), `activity` (activity log, RFC 0005),
+ * `portability` (user data export/import, RFC 0007), `env` (plugin-scoped env
+ * vars, RFC 0018), `notifications` (notification center, RFC 0015),
+ * `directory` (member selection, RFC 0041), `secrets` (plugin secret vault,
+ * RFC 0043), `storage` (plugin file storage, RFC 0044), `connections`
+ * (external provider connections, RFC 0049), `e2ee` (client-side encryption
+ * profile persistence, RFC 0060 — profile/device plumbing only; see
+ * `e2ee-crypto`/`e2ee-device`/`e2ee-object`/`e2ee-state` for the browser-only
+ * crypto and state helpers that produce the ciphertext these methods store),
+ * `plugins` (dependency discovery and cross-plugin references, RFC 0051),
+ * `billing` (plugin monetization / entitlement gating, RFC 0003), `events`.
+ * `data`, `activity`, `portability`, `env`, `notifications`, `directory`,
+ * `secrets`, `storage`, `connections`, `e2ee`, and `plugins` are implemented;
+ * `billing` and `events` throw `NotImplementedError` until their backing
+ * mechanisms ship. Their shape may change before they stabilise.
+ */
+declare const sdk: {
+    auth: typeof auth;
+    db: typeof db;
+    mailer: typeof mailer;
+    platform: typeof platform;
+    data: {
+        provide<TParams = unknown, TRow = unknown>(contract: string, resolver: DataContractResolver<TParams, TRow>): void;
+        query<TParams = unknown, TRow = unknown>(ref: DataContractRef, params?: TParams): Promise<TRow[]>;
+    };
+    storage: {
+        put(input: StoragePutInput): Promise<StorageObject>;
+        get(key: string): Promise<(StorageObject & {
+            body: ReadableStream;
+        }) | null>;
+        delete(key: string): Promise<void>;
+        list(prefix?: string): Promise<StorageObject[]>;
+        getSignedUrl(key: string, options?: {
+            expiresInSeconds?: number;
+        }): Promise<string>;
+    };
+    directory: {
+        searchUsers(input: SearchUsersInput): Promise<DirectoryUser[]>;
+        resolveUsers(input: ResolveUsersInput): Promise<DirectoryUser[]>;
+    };
+    notifications: {
+        send(input: SendNotificationInput, requestHeaders?: Headers): Promise<void>;
+    };
+    secrets: {
+        create(input: CreateSecretInput): Promise<SecretRef>;
+        get(id: string): Promise<string | null>;
+        list(scope?: SecretScope): Promise<SecretRef[]>;
+        update(id: string, value: string): Promise<SecretRef>;
+        delete(id: string): Promise<void>;
+    };
+    connections: {
+        create(input: CreateConnectionInput): Promise<ConnectionRef>;
+        list(filter?: ConnectionListFilter): Promise<ConnectionRef[]>;
+        get(id: string): Promise<ConnectionRef | null>;
+        update(id: string, input: UpdateConnectionInput): Promise<ConnectionRef>;
+        disconnect(id: string): Promise<void>;
+        markUsed(id: string): Promise<void>;
+        markError(id: string, input: MarkConnectionErrorInput): Promise<ConnectionRef>;
+        createOAuthState(input: OAuthStateInput): Promise<string>;
+        verifyOAuthState(state: string): Promise<ConnectionOAuthState>;
+        getProviderConfig(provider: string): Promise<ProviderConfig>;
+    };
+    e2ee: {
+        getProfile(): Promise<E2eeProfile | null>;
+        createProfile(input: CreateE2eeProfileInput): Promise<E2eeProfile>;
+        getRecoveryWrapper(): Promise<E2eeRecoveryWrapper | null>;
+        setRecoveryWrapper(input: SetE2eeRecoveryWrapperInput): Promise<E2eeRecoveryWrapper>;
+        enrollDevice(input: EnrollE2eeDeviceInput): Promise<E2eeDeviceEnrollment>;
+        listDevices(): Promise<E2eeDeviceEnrollment[]>;
+        revokeDevice(id: string): Promise<void>;
+    };
+    events: {
+        publish(_event: string, _payload: unknown): Promise<void>;
+        subscribe(_event: string, _handler: (payload: unknown) => void): void;
+    };
+    activity: {
+        log(entry: ActivityLogEntry): Promise<void>;
+    };
+    portability: {
+        provideExport(resolver: ExportResolver): Promise<void>;
+        provideImport(handler: ImportHandler): Promise<void>;
+        provideDelete(handler: DeletionHandler): Promise<void>;
+    };
+    plugins: {
+        get(id: string): Promise<PluginAvailability | null>;
+        list(filter?: PluginListFilter): Promise<PluginAvailability[]>;
+        getConsentStatus(ref: DataContractRef): Promise<ConsentStatus>;
+    };
+    env: {
+        get(key: string): Promise<string | null>;
+    };
+    billing: {
+        getEntitlement(_headers: Headers): Promise<{
+            tier: string | null;
+            expiresAt: number | null;
+        } | null>;
+        requireEntitlement(_headers: Headers): Promise<{
+            tier: string | null;
+            expiresAt: number | null;
+        }>;
+    };
+};
+
+export { ActiveSession, ActivityLogEntry, ChangePasswordInput, ConnectionContext, ConnectionListFilter, ConnectionOAuthState, ConnectionRef, ConsentRequiredError, type ConsentStatus, CreateConnectionInput, CreateE2eeProfileInput, CreateSecretInput, type DataContractRef, type DataContractResolver, type DeletionContext, type DeletionHandler, type DeletionResult, DirectoryUser, DrizzleClient, E2eeContext, E2eeDeviceEnrollment, E2eeProfile, E2eeRecoveryWrapper, EnrollE2eeDeviceInput, EntitlementRequiredError, type ExportContext, type ExportOptions, type ExportResolver, type ExportSecretMetadata, type ImportContext, type ImportHandler, MailOptions, MarkConnectionErrorInput, NotAuthenticatedError, NotImplementedError, OAuthStateInput, PlatformConfig, type PluginAvailability, type PluginContractSummary, type PluginExportSection, type PluginListFilter, type PluginReference, ProviderConfig, ResolveUsersInput, type SdkHost, SearchUsersInput, SecretContext, SecretRef, SecretScope, SendNotificationInput, Session, SetE2eeRecoveryWrapperInput, StorageContext, StorageObject, StoragePutInput, UpdateConnectionInput, provideHost, sdk };