@substrio/sdk 0.1.0 → 0.1.1

package/substrio_operations.d.mts

@@ -1,5 +1,5 @@
 // Generated by packages/substrio-sdk/scripts/gen_operations.mjs from the server's operation catalog
-// (GET /v1/_openapi, registry version 1, 511 operations with routes);
+// (GET /v1/_openapi, registry version 1, 548 operations with routes);
 // never edit by hand. Regenerate: npm run gen:operations (packages/substrio-sdk).
 
 /** Filter: a field name maps to a value (equality) or an operator object; $and, $or and $nor combine filters of this same form */
@@ -20,6 +20,7 @@ export type SubstrioErrorBody = {
     fix?: {
         operation: string;
         tool?: string;
+        why?: string;
         cli?: string;
         method?: string;
         path?: string;
@@ -28,13 +29,13 @@ export type SubstrioErrorBody = {
     };
     /** The offending request field */
     field?: string;
-    code: "UNKNOWN" | "NOT_IMPLEMENTED" | "SYSTEM_CLOSED" | "SYSTEM_ALREADY_OPEN" | "INVALID_ARGUMENT" | "INVALID_HANDLE" | "THREAD_INIT_FAILED" | "SHUTDOWN_IN_PROGRESS" | "INTERNAL" | "NULL_TREE" | "NULL_SYSTEM" | "BARRIER_UNSUPPORTED" | "STORAGE_IO" | "DISK_FULL" | "FILE_NOT_FOUND" | "PERMISSION_DENIED" | "FILE_CORRUPT" | "MMAP_FAILED" | "FSYNC_FAILED" | "LOCK_FAILED" | "NOT_A_DATABASE" | "OLD_FORMAT" | "NEWER_FORMAT" | "OUT_OF_MEMORY" | "BUFFER_TOO_SMALL" | "ALLOCATOR_FAULT" | "TRANSACTION_CONFLICT" | "RETRY" | "TRANSACTION_READ_ONLY" | "TRANSACTION_NOT_FOUND" | "DEADLOCK_DETECTED" | "TIMEOUT" | "NO_ACTIVE_TRANSACTION" | "CANCELLED" | "LWW_STALE" | "KEY_NOT_FOUND" | "KEY_TOO_LARGE" | "VALUE_TOO_LARGE" | "KEY_EMPTY" | "KEY_EXISTS" | "MISSING_INDEX" | "OWNERSHIP_REQUIRED" | "KEY_PREFIX_COLLISION" | "KEY_DELETED" | "UNIQUE" | "ID_RESERVED" | "INVALID_ID" | "ID_MISMATCH" | "INDEX_DUPLICATES" | "FIELD_IDS_EXHAUSTED" | "ID_PAST_ROWS" | "ID_NOT_ISSUED" | "ENGINE_GATE_HELD" | "ROW_STALE" | "CURSOR_EXHAUSTED" | "CURSOR_INVALIDATED" | "INVALID_RANGE" | "BATCH_OP_FAILED" | "NODE_NOT_FOUND" | "EDGE_NOT_FOUND" | "PROPERTY_NOT_FOUND" | "INVALID_EDGE" | "PATH_NOT_FOUND" | "GRAPH_CYCLE_DETECTED" | "DIMENSION_MISMATCH" | "POINT_NOT_FOUND" | "INVALID_BOUNDS" | "INVALID_RADIUS" | "SCHEMA_VIOLATION" | "TYPE_MISMATCH" | "CONSTRAINT_VIOLATION" | "TOO_MANY_FIELDS" | "SCHEMA_REFUSED" | "SCHEMA_VIOLATORS" | "SECRET_FIELD" | "TYPE_TAG_NOT_FIRST" | "STORAGE_QUOTA_EXCEEDED" | "DOCUMENT_QUOTA_EXCEEDED" | "BANDWIDTH_QUOTA_EXCEEDED" | "RATE_LIMIT_EXCEEDED" | "REQUEST_TOO_LARGE" | "CONCURRENT_LIMIT" | "COLLECTION_LIMIT" | "INDEX_LIMIT" | "FUNCTION_LIMIT" | "CF_CPU_TIMEOUT" | "CF_MEMORY_EXCEEDED" | "CF_EXECUTION_FAILED" | "SERVER_BUSY" | "CF_TENANT_MEMORY" | "CF_WALL_TIMEOUT" | "CF_SERVER_MEMORY" | "KEY_RATE_LIMIT_EXCEEDED" | "REALTIME_LIMIT" | "CRON_LIMIT" | "SPACE_FULL" | "TOKEN_EXPIRED" | "TOKEN_INVALID" | "TOKEN_REVOKED" | "SESSION_EXPIRED" | "ACCOUNT_SUSPENDED" | "TENANT_SUSPENDED" | "TENANT_READ_ONLY" | "IP_BLOCKED" | "INSUFFICIENT_PERMISSIONS" | "APPROVAL_REQUIRED" | "APPROVAL_INVALID" | "APPROVAL_DENIED" | "AGENT_BUDGET_EXHAUSTED" | "KEY_BUDGET_EXHAUSTED" | "QUERY_TOO_COMPLEX" | "QUERY_TIMEOUT" | "RESULT_SET_TOO_LARGE" | "SORT_LIMIT_EXCEEDED" | "SCAN_LIMIT_EXCEEDED" | "INVALID_QUERY_SYNTAX" | "SQL_FAILED" | "TENANT_NOT_FOUND" | "TENANT_ALREADY_EXISTS" | "TENANT_INVALID" | "TENANT_CANNOT_DROP_DEFAULT" | "COLLECTION_NOT_FOUND" | "COLLECTION_ALREADY_EXISTS" | "FUNCTION_NOT_FOUND" | "THREAD_NOT_FOUND" | "MESSAGE_NOT_FOUND" | "DATABASE_ERROR" | "ACCOUNT_NOT_FOUND" | "ACCOUNT_MEMBER_NOT_FOUND" | "ACCOUNT_LAST_OWNER" | "ACCOUNT_HAS_APPS" | "ACCOUNT_LIMIT" | "ACCOUNT_KEY_NOT_FOUND" | "ACCOUNT_INVITE_NOT_FOUND" | "ACCOUNT_INVITE_EXPIRED" | "ACCOUNT_INVITE_EMAIL" | "UNDO_TOKEN_NOT_FOUND" | "UNDO_TOKEN_EXPIRED" | "UNDO_RESOURCE_CHANGED" | "APP_OWNED_BY_ANOTHER_ACCOUNT" | "KEY_EXPIRED" | "TENANT_KEY_NOT_FOUND" | "TENANT_SLUG_RESERVED" | "TENANT_NOTE_TOO_LONG" | "TENANT_JOBS_DISABLED" | "TOOL_BAD_NAME" | "TOOL_HASH_MISMATCH" | "TOOL_BAD_SIZE" | "TOOL_BAD_FORMAT" | "TOOL_TOO_MANY" | "TOOL_STORAGE_IO" | "TOOL_NOT_INSTALLED" | "TOOL_TOO_MANY_BYTES" | "TOOL_LIMIT_OUT_OF_RANGE" | "TOOL_BAD_ARGS" | "TOOL_CONFINEMENT_UNAVAILABLE" | "TOOL_SPAWN_FAILED" | "DIRECT_CHANGES" | "HOST_NOT_FOUND" | "HOST_HAS_NODES" | "NODE_LABEL_NOT_FOUND" | "NODE_LABEL_IN_USE" | "NODE_LABEL_LIMIT" | "HOST_CAPABILITY_MISSING" | "HOST_AT_CAPACITY" | "HOST_HAS_APPS" | "SETTING_IS_PLATFORM" | "NO_CALL_CONTEXT" | "LEDGER_UNAVAILABLE" | "APP_QUERY_NOT_INDEXED" | "APP_QUERY_FIELD_NOT_EXPOSED" | "APP_USE_UNKNOWN_APP" | "SECRET_NOT_FOUND" | "EDIT_NO_MATCH" | "EDIT_AMBIGUOUS" | "HOST_TAKEN" | "HOST_INVALID" | "HOST_RESERVED" | "ENV_HOST_NOT_FOUND" | "ENVIRONMENT_NOT_FOUND" | "ROOT_DOMAIN_UNKNOWN" | "ROOT_DOMAIN_DISABLED" | "ROOT_DOMAIN_IN_USE" | "FEATURED_APP_NOT_FOUND" | "FEATURED_NOT_ENABLED" | "FEATURED_NEEDS_PLANS" | "BILLING_KEY_NOT_TEST" | "CART_EMPTY" | "CART_PLAN_NOT_FOUND" | "CART_PLAN_NOT_FOR_SALE" | "CART_APP_REPEATED" | "CART_COVERED" | "CART_MIXED" | "FUNDS_OUT_OF_RANGE" | "CART_NOT_FOUND" | "CART_CLOSED" | "CHECKOUT_PERSON_ONLY" | "PAYMENT_NOT_DONE" | "PAYMENT_PROCESSING" | "SUBSCRIPTION_NONE" | "PROVIDER_ANSWER_INVALID" | "MODULE_NOT_FOUND" | "IMPORT_OUTSIDE_PROJECT" | "IMPORT_NEEDS_VERSION" | "PACKAGE_NOT_FOUND" | "PACKAGE_NOT_EXPORTED" | "PACKAGE_NOT_ESM" | "PACKAGE_MANIFEST_INVALID" | "PACKAGE_REGISTRY_UNSET" | "PACKAGE_UNKNOWN" | "PACKAGE_NAME_INVALID" | "PACKAGE_RANGE_INVALID" | "PACKAGE_VERSION_NOT_FOUND" | "PACKAGE_VERSION_CONFLICT" | "PACKAGE_REGISTRY_FAILED" | "PACKAGE_TARBALL_OUTSIDE_REGISTRY" | "PACKAGE_INTEGRITY_MISMATCH" | "PACKAGE_TARBALL_INVALID" | "PACKAGE_TOO_LARGE" | "KEY_AUTOMATION_NEEDS_PERSON" | "MCP_TOOL_NOT_FOUND" | "MCP_TEST_USER_NOT_FOUND" | "MCP_TOOL_FROM_ROUTE" | "MCP_TOOL_INVALID" | "TEST_TENANT_REQUIRED" | "SERIALIZATION" | "DESERIALIZATION" | "PIPELINE_TOO_LARGE" | "INVALID_JSON" | "EMPTY_PAYLOAD" | "BODY_REQUIRED" | "METHOD_NOT_ALLOWED" | "ENDPOINT_NOT_FOUND" | "MISSING_FIELD" | "UNSUPPORTED_OPERATION" | "NO_WAIT_IN_QUERY" | "NO_WAIT_IN_TRANSACTION" | "NO_WAIT_IN_UPSERT" | "NO_WAIT_IN_ENGINE_GATE" | "FETCH_FAILED" | "CREDENTIAL_REQUIRED" | "EMAIL_VERIFICATION_REQUIRED" | "OAUTH_INVALID" | "PROVIDER_NOT_CONFIGURED" | "PROVIDER_DISABLED" | "LIVE_BY_PROMOTE" | "TENANT_MOVED" | "GRANT_REQUIRED" | "KEY_ORIGIN_REFUSED" | "APPROVAL_PENDING" | "APPROVAL_SPENT" | "APPROVAL_EXPIRED" | "APPROVAL_MISMATCH" | "WEBHOOK_SIGNATURE_INVALID" | "BILLING_NOT_SET_UP" | "CRITICAL_SEGFAULT";
-    next_action: "retry" | "reauthenticate" | "request_permission" | "reduce_request_or_increase_limit" | "refresh_resource" | "choose_supported_operation" | "correct_request" | "inspect_detail" | "version.live.set" | "follow_location";
+    code: "UNKNOWN" | "NOT_IMPLEMENTED" | "SYSTEM_CLOSED" | "SYSTEM_ALREADY_OPEN" | "INVALID_ARGUMENT" | "INVALID_HANDLE" | "THREAD_INIT_FAILED" | "SHUTDOWN_IN_PROGRESS" | "INTERNAL" | "NULL_TREE" | "NULL_SYSTEM" | "BARRIER_UNSUPPORTED" | "STORAGE_IO" | "DISK_FULL" | "FILE_NOT_FOUND" | "PERMISSION_DENIED" | "FILE_CORRUPT" | "MMAP_FAILED" | "FSYNC_FAILED" | "LOCK_FAILED" | "NOT_A_DATABASE" | "OLD_FORMAT" | "NEWER_FORMAT" | "OUT_OF_MEMORY" | "BUFFER_TOO_SMALL" | "ALLOCATOR_FAULT" | "TRANSACTION_CONFLICT" | "RETRY" | "TRANSACTION_READ_ONLY" | "TRANSACTION_NOT_FOUND" | "DEADLOCK_DETECTED" | "TIMEOUT" | "NO_ACTIVE_TRANSACTION" | "CANCELLED" | "LWW_STALE" | "KEY_NOT_FOUND" | "KEY_TOO_LARGE" | "VALUE_TOO_LARGE" | "KEY_EMPTY" | "KEY_EXISTS" | "MISSING_INDEX" | "OWNERSHIP_REQUIRED" | "KEY_PREFIX_COLLISION" | "KEY_DELETED" | "UNIQUE" | "ID_RESERVED" | "INVALID_ID" | "ID_MISMATCH" | "INDEX_DUPLICATES" | "FIELD_IDS_EXHAUSTED" | "ID_PAST_ROWS" | "ID_NOT_ISSUED" | "ENGINE_GATE_HELD" | "ROW_STALE" | "CURSOR_EXHAUSTED" | "CURSOR_INVALIDATED" | "INVALID_RANGE" | "BATCH_OP_FAILED" | "NODE_NOT_FOUND" | "EDGE_NOT_FOUND" | "PROPERTY_NOT_FOUND" | "INVALID_EDGE" | "PATH_NOT_FOUND" | "GRAPH_CYCLE_DETECTED" | "DIMENSION_MISMATCH" | "POINT_NOT_FOUND" | "INVALID_BOUNDS" | "INVALID_RADIUS" | "SCHEMA_VIOLATION" | "TYPE_MISMATCH" | "CONSTRAINT_VIOLATION" | "TOO_MANY_FIELDS" | "SCHEMA_REFUSED" | "SCHEMA_VIOLATORS" | "SECRET_FIELD" | "TYPE_TAG_NOT_FIRST" | "STORAGE_QUOTA_EXCEEDED" | "DOCUMENT_QUOTA_EXCEEDED" | "BANDWIDTH_QUOTA_EXCEEDED" | "RATE_LIMIT_EXCEEDED" | "REQUEST_TOO_LARGE" | "CONCURRENT_LIMIT" | "COLLECTION_LIMIT" | "INDEX_LIMIT" | "FUNCTION_LIMIT" | "CF_CPU_TIMEOUT" | "CF_MEMORY_EXCEEDED" | "CF_EXECUTION_FAILED" | "SERVER_BUSY" | "CF_TENANT_MEMORY" | "CF_WALL_TIMEOUT" | "CF_SERVER_MEMORY" | "KEY_RATE_LIMIT_EXCEEDED" | "REALTIME_LIMIT" | "CRON_LIMIT" | "SPACE_FULL" | "TOKEN_EXPIRED" | "TOKEN_INVALID" | "TOKEN_REVOKED" | "SESSION_EXPIRED" | "ACCOUNT_SUSPENDED" | "TENANT_SUSPENDED" | "TENANT_READ_ONLY" | "IP_BLOCKED" | "INSUFFICIENT_PERMISSIONS" | "APPROVAL_REQUIRED" | "APPROVAL_INVALID" | "APPROVAL_DENIED" | "AGENT_BUDGET_EXHAUSTED" | "KEY_BUDGET_EXHAUSTED" | "QUERY_TOO_COMPLEX" | "QUERY_TIMEOUT" | "RESULT_SET_TOO_LARGE" | "SORT_LIMIT_EXCEEDED" | "SCAN_LIMIT_EXCEEDED" | "INVALID_QUERY_SYNTAX" | "SQL_FAILED" | "TENANT_NOT_FOUND" | "TENANT_ALREADY_EXISTS" | "TENANT_INVALID" | "TENANT_CANNOT_DROP_DEFAULT" | "COLLECTION_NOT_FOUND" | "COLLECTION_ALREADY_EXISTS" | "FUNCTION_NOT_FOUND" | "THREAD_NOT_FOUND" | "MESSAGE_NOT_FOUND" | "DATABASE_ERROR" | "ACCOUNT_NOT_FOUND" | "ACCOUNT_MEMBER_NOT_FOUND" | "ACCOUNT_LAST_OWNER" | "ACCOUNT_HAS_APPS" | "ACCOUNT_LIMIT" | "ACCOUNT_KEY_NOT_FOUND" | "ACCOUNT_INVITE_NOT_FOUND" | "ACCOUNT_INVITE_EXPIRED" | "ACCOUNT_INVITE_EMAIL" | "UNDO_TOKEN_NOT_FOUND" | "UNDO_TOKEN_EXPIRED" | "UNDO_RESOURCE_CHANGED" | "APP_OWNED_BY_ANOTHER_ACCOUNT" | "KEY_EXPIRED" | "TENANT_KEY_NOT_FOUND" | "TENANT_SLUG_RESERVED" | "TENANT_NOTE_TOO_LONG" | "TENANT_JOBS_DISABLED" | "TOOL_BAD_NAME" | "TOOL_HASH_MISMATCH" | "TOOL_BAD_SIZE" | "TOOL_BAD_FORMAT" | "TOOL_TOO_MANY" | "TOOL_STORAGE_IO" | "TOOL_NOT_INSTALLED" | "TOOL_TOO_MANY_BYTES" | "TOOL_LIMIT_OUT_OF_RANGE" | "TOOL_BAD_ARGS" | "TOOL_CONFINEMENT_UNAVAILABLE" | "TOOL_SPAWN_FAILED" | "DIRECT_CHANGES" | "HOST_NOT_FOUND" | "HOST_HAS_NODES" | "NODE_LABEL_NOT_FOUND" | "NODE_LABEL_IN_USE" | "NODE_LABEL_LIMIT" | "HOST_CAPABILITY_MISSING" | "HOST_AT_CAPACITY" | "HOST_HAS_APPS" | "SETTING_IS_PLATFORM" | "NO_CALL_CONTEXT" | "LEDGER_UNAVAILABLE" | "APP_QUERY_NOT_INDEXED" | "APP_QUERY_FIELD_NOT_EXPOSED" | "APP_USE_UNKNOWN_APP" | "SECRET_NOT_FOUND" | "EDIT_NO_MATCH" | "EDIT_AMBIGUOUS" | "SHELL_SYNTAX" | "SHELL_UNKNOWN_COMMAND" | "SHELL_UNKNOWN_VARIABLE" | "SHELL_PATH_OUTSIDE" | "SHELL_READ_ONLY" | "SHELL_WRITE_NOT_GRANTED" | "SHELL_FILES_DELETE" | "SHELL_OFFSET_WRITES" | "SHELL_CPU_BUDGET" | "SHELL_PIPE_BUDGET" | "HOST_TAKEN" | "HOST_INVALID" | "HOST_RESERVED" | "ENV_HOST_NOT_FOUND" | "ENVIRONMENT_NOT_FOUND" | "ROOT_DOMAIN_UNKNOWN" | "ROOT_DOMAIN_DISABLED" | "ROOT_DOMAIN_IN_USE" | "FEATURED_APP_NOT_FOUND" | "JET_KEY_NEEDS_APP" | "FEATURED_ALWAYS_ON" | "FEATURED_NEEDS_PLANS" | "BILLING_KEY_NOT_TEST" | "CART_EMPTY" | "CART_PLAN_NOT_FOUND" | "CART_PLAN_NOT_FOR_SALE" | "CART_APP_REPEATED" | "CART_COVERED" | "CART_MIXED" | "FUNDS_OUT_OF_RANGE" | "CART_NOT_FOUND" | "CART_CLOSED" | "CHECKOUT_PERSON_ONLY" | "PAYMENT_NOT_DONE" | "PAYMENT_PROCESSING" | "SUBSCRIPTION_NONE" | "PROVIDER_ANSWER_INVALID" | "PLAN_LIMIT" | "SPACE_ADDON_NOT_ON_PLAN" | "SPACE_ADDON_HELD" | "SPACE_ADDON_IN_USE" | "PLAN_NOT_ON_SALE" | "MODULE_NOT_FOUND" | "IMPORT_OUTSIDE_PROJECT" | "IMPORT_NEEDS_VERSION" | "PACKAGE_NOT_FOUND" | "PACKAGE_NOT_EXPORTED" | "PACKAGE_NOT_ESM" | "PACKAGE_MANIFEST_INVALID" | "PACKAGE_REGISTRY_UNSET" | "PACKAGE_UNKNOWN" | "PACKAGE_NAME_INVALID" | "PACKAGE_RANGE_INVALID" | "PACKAGE_VERSION_NOT_FOUND" | "PACKAGE_VERSION_CONFLICT" | "PACKAGE_REGISTRY_FAILED" | "PACKAGE_TARBALL_OUTSIDE_REGISTRY" | "PACKAGE_INTEGRITY_MISMATCH" | "PACKAGE_TARBALL_INVALID" | "PACKAGE_TOO_LARGE" | "KEY_AUTOMATION_NEEDS_PERSON" | "ADOPT_DISABLED" | "ADOPT_SOURCE_NOT_FOUND" | "ADOPT_SOURCE_OUTSIDE" | "ADOPT_SOURCE_SYMLINK" | "ADOPT_SOURCE_NOT_REGULAR" | "ADOPT_SOURCE_LINKED" | "ADOPT_CROSS_DEVICE" | "ADOPT_SOURCE_CHANGED" | "FILE_EXISTS" | "CONSOLE_LINK_NEEDS_PERSON" | "CONSOLE_LINK_UNKNOWN" | "CONSOLE_LINK_USED" | "CONSOLE_LINK_EXPIRED" | "CONSOLE_LINK_STEP_UP" | "AGENT_CODE_INVALID" | "AGENT_ALREADY_CONNECTED" | "AGENT_TOOL_UNKNOWN" | "APP_NOT_NAMED" | "SYSTEM_PROTECTED" | "CPU_HISTORY_OFF" | "SUBSCRIPTION_NOT_FOUND" | "PLAN_FEATURE_REQUIRED" | "SUBSCRIBERS_NOT_VISIBLE" | "SUBSCRIPTION_PERSON_REQUIRED" | "PLAN_FEATURE_UNKNOWN" | "DASHBOARD_INVALID" | "REGION_NOT_FOUND" | "REGION_IN_USE" | "REGION_LIMIT" | "REGION_UNAVAILABLE" | "REGION_FULL" | "HOST_NOT_PROBED" | "HOST_NO_SYSTEMD" | "HOST_NGINX_PRESENT" | "RELEASE_NOT_FOUND" | "RELEASE_NOT_PACKED" | "RELEASE_ISA_UNKNOWN" | "HOST_CPU_MISSING" | "HOST_NODE_LIMIT" | "NODE_BUSY" | "MCP_TOOL_NOT_FOUND" | "MCP_TEST_USER_NOT_FOUND" | "MCP_TOOL_FROM_ROUTE" | "MCP_RESULT_INVALID" | "MCP_OPERATIONS_IDENTITY_ONLY" | "MCP_LINK_NOT_LINKED" | "MCP_LINK_NOT_OFFERED" | "CALLER_USERS_REFUSED" | "NO_CALLER_APP" | "SELF_FIELD_REFUSED" | "MCP_IDENTITY_FUNCTION_NOT_DEPLOYED" | "MCP_TOOL_INVALID" | "TEST_TENANT_REQUIRED" | "ARCHIVE_INVALID" | "WASM_MODULE_INVALID" | "WASM_COMPILE_FAILED" | "WASM_CELLS_UNSUPPORTED" | "RUST_COMPILE_FAILED" | "RUST_TOOLCHAIN_UNAVAILABLE" | "ARCHIVE_PASSPHRASE_WRONG" | "SERIALIZATION" | "DESERIALIZATION" | "PIPELINE_TOO_LARGE" | "INVALID_JSON" | "EMPTY_PAYLOAD" | "BODY_REQUIRED" | "METHOD_NOT_ALLOWED" | "ENDPOINT_NOT_FOUND" | "MISSING_FIELD" | "UNSUPPORTED_OPERATION" | "NO_WAIT_IN_QUERY" | "NO_WAIT_IN_TRANSACTION" | "NO_WAIT_IN_UPSERT" | "NO_WAIT_IN_ENGINE_GATE" | "FETCH_FAILED" | "CREDENTIAL_REQUIRED" | "EMAIL_VERIFICATION_REQUIRED" | "OAUTH_INVALID" | "PROVIDER_NOT_CONFIGURED" | "PROVIDER_DISABLED" | "LIVE_BY_PROMOTE" | "TENANT_MOVED" | "GRANT_REQUIRED" | "KEY_ORIGIN_REFUSED" | "SECRET_KEY_IN_URL" | "APPROVAL_PENDING" | "APPROVAL_SPENT" | "APPROVAL_EXPIRED" | "APPROVAL_MISMATCH" | "WEBHOOK_SIGNATURE_INVALID" | "BILLING_NOT_SET_UP" | "EMAIL_TAKEN" | "CREDENTIALS_MISMATCH" | "PASSWORD_LENGTH" | "EMAIL_INVALID" | "USER_NOT_FOUND" | "ACCOUNT_LOCKED" | "RECIPIENT_UNSUBSCRIBED" | "APP_OVER_PLAN" | "CRITICAL_SEGFAULT";
+    next_action: "retry" | "reauthenticate" | "request_permission" | "reduce_request_or_increase_limit" | "refresh_resource" | "choose_supported_operation" | "correct_request" | "inspect_detail" | "version.live.set" | "follow_location" | "sign_in";
     [field: string]: unknown;
 };
 
 /** Every error code the server sends (SubstrioError.code). */
-export type SubstrioErrorCode = "UNKNOWN" | "NOT_IMPLEMENTED" | "SYSTEM_CLOSED" | "SYSTEM_ALREADY_OPEN" | "INVALID_ARGUMENT" | "INVALID_HANDLE" | "THREAD_INIT_FAILED" | "SHUTDOWN_IN_PROGRESS" | "INTERNAL" | "NULL_TREE" | "NULL_SYSTEM" | "BARRIER_UNSUPPORTED" | "STORAGE_IO" | "DISK_FULL" | "FILE_NOT_FOUND" | "PERMISSION_DENIED" | "FILE_CORRUPT" | "MMAP_FAILED" | "FSYNC_FAILED" | "LOCK_FAILED" | "NOT_A_DATABASE" | "OLD_FORMAT" | "NEWER_FORMAT" | "OUT_OF_MEMORY" | "BUFFER_TOO_SMALL" | "ALLOCATOR_FAULT" | "TRANSACTION_CONFLICT" | "RETRY" | "TRANSACTION_READ_ONLY" | "TRANSACTION_NOT_FOUND" | "DEADLOCK_DETECTED" | "TIMEOUT" | "NO_ACTIVE_TRANSACTION" | "CANCELLED" | "LWW_STALE" | "KEY_NOT_FOUND" | "KEY_TOO_LARGE" | "VALUE_TOO_LARGE" | "KEY_EMPTY" | "KEY_EXISTS" | "MISSING_INDEX" | "OWNERSHIP_REQUIRED" | "KEY_PREFIX_COLLISION" | "KEY_DELETED" | "UNIQUE" | "ID_RESERVED" | "INVALID_ID" | "ID_MISMATCH" | "INDEX_DUPLICATES" | "FIELD_IDS_EXHAUSTED" | "ID_PAST_ROWS" | "ID_NOT_ISSUED" | "ENGINE_GATE_HELD" | "ROW_STALE" | "CURSOR_EXHAUSTED" | "CURSOR_INVALIDATED" | "INVALID_RANGE" | "BATCH_OP_FAILED" | "NODE_NOT_FOUND" | "EDGE_NOT_FOUND" | "PROPERTY_NOT_FOUND" | "INVALID_EDGE" | "PATH_NOT_FOUND" | "GRAPH_CYCLE_DETECTED" | "DIMENSION_MISMATCH" | "POINT_NOT_FOUND" | "INVALID_BOUNDS" | "INVALID_RADIUS" | "SCHEMA_VIOLATION" | "TYPE_MISMATCH" | "CONSTRAINT_VIOLATION" | "TOO_MANY_FIELDS" | "SCHEMA_REFUSED" | "SCHEMA_VIOLATORS" | "SECRET_FIELD" | "TYPE_TAG_NOT_FIRST" | "STORAGE_QUOTA_EXCEEDED" | "DOCUMENT_QUOTA_EXCEEDED" | "BANDWIDTH_QUOTA_EXCEEDED" | "RATE_LIMIT_EXCEEDED" | "REQUEST_TOO_LARGE" | "CONCURRENT_LIMIT" | "COLLECTION_LIMIT" | "INDEX_LIMIT" | "FUNCTION_LIMIT" | "CF_CPU_TIMEOUT" | "CF_MEMORY_EXCEEDED" | "CF_EXECUTION_FAILED" | "SERVER_BUSY" | "CF_TENANT_MEMORY" | "CF_WALL_TIMEOUT" | "CF_SERVER_MEMORY" | "KEY_RATE_LIMIT_EXCEEDED" | "REALTIME_LIMIT" | "CRON_LIMIT" | "SPACE_FULL" | "TOKEN_EXPIRED" | "TOKEN_INVALID" | "TOKEN_REVOKED" | "SESSION_EXPIRED" | "ACCOUNT_SUSPENDED" | "TENANT_SUSPENDED" | "TENANT_READ_ONLY" | "IP_BLOCKED" | "INSUFFICIENT_PERMISSIONS" | "APPROVAL_REQUIRED" | "APPROVAL_INVALID" | "APPROVAL_DENIED" | "AGENT_BUDGET_EXHAUSTED" | "KEY_BUDGET_EXHAUSTED" | "QUERY_TOO_COMPLEX" | "QUERY_TIMEOUT" | "RESULT_SET_TOO_LARGE" | "SORT_LIMIT_EXCEEDED" | "SCAN_LIMIT_EXCEEDED" | "INVALID_QUERY_SYNTAX" | "SQL_FAILED" | "TENANT_NOT_FOUND" | "TENANT_ALREADY_EXISTS" | "TENANT_INVALID" | "TENANT_CANNOT_DROP_DEFAULT" | "COLLECTION_NOT_FOUND" | "COLLECTION_ALREADY_EXISTS" | "FUNCTION_NOT_FOUND" | "THREAD_NOT_FOUND" | "MESSAGE_NOT_FOUND" | "DATABASE_ERROR" | "ACCOUNT_NOT_FOUND" | "ACCOUNT_MEMBER_NOT_FOUND" | "ACCOUNT_LAST_OWNER" | "ACCOUNT_HAS_APPS" | "ACCOUNT_LIMIT" | "ACCOUNT_KEY_NOT_FOUND" | "ACCOUNT_INVITE_NOT_FOUND" | "ACCOUNT_INVITE_EXPIRED" | "ACCOUNT_INVITE_EMAIL" | "UNDO_TOKEN_NOT_FOUND" | "UNDO_TOKEN_EXPIRED" | "UNDO_RESOURCE_CHANGED" | "APP_OWNED_BY_ANOTHER_ACCOUNT" | "KEY_EXPIRED" | "TENANT_KEY_NOT_FOUND" | "TENANT_SLUG_RESERVED" | "TENANT_NOTE_TOO_LONG" | "TENANT_JOBS_DISABLED" | "TOOL_BAD_NAME" | "TOOL_HASH_MISMATCH" | "TOOL_BAD_SIZE" | "TOOL_BAD_FORMAT" | "TOOL_TOO_MANY" | "TOOL_STORAGE_IO" | "TOOL_NOT_INSTALLED" | "TOOL_TOO_MANY_BYTES" | "TOOL_LIMIT_OUT_OF_RANGE" | "TOOL_BAD_ARGS" | "TOOL_CONFINEMENT_UNAVAILABLE" | "TOOL_SPAWN_FAILED" | "DIRECT_CHANGES" | "HOST_NOT_FOUND" | "HOST_HAS_NODES" | "NODE_LABEL_NOT_FOUND" | "NODE_LABEL_IN_USE" | "NODE_LABEL_LIMIT" | "HOST_CAPABILITY_MISSING" | "HOST_AT_CAPACITY" | "HOST_HAS_APPS" | "SETTING_IS_PLATFORM" | "NO_CALL_CONTEXT" | "LEDGER_UNAVAILABLE" | "APP_QUERY_NOT_INDEXED" | "APP_QUERY_FIELD_NOT_EXPOSED" | "APP_USE_UNKNOWN_APP" | "SECRET_NOT_FOUND" | "EDIT_NO_MATCH" | "EDIT_AMBIGUOUS" | "HOST_TAKEN" | "HOST_INVALID" | "HOST_RESERVED" | "ENV_HOST_NOT_FOUND" | "ENVIRONMENT_NOT_FOUND" | "ROOT_DOMAIN_UNKNOWN" | "ROOT_DOMAIN_DISABLED" | "ROOT_DOMAIN_IN_USE" | "FEATURED_APP_NOT_FOUND" | "FEATURED_NOT_ENABLED" | "FEATURED_NEEDS_PLANS" | "BILLING_KEY_NOT_TEST" | "CART_EMPTY" | "CART_PLAN_NOT_FOUND" | "CART_PLAN_NOT_FOR_SALE" | "CART_APP_REPEATED" | "CART_COVERED" | "CART_MIXED" | "FUNDS_OUT_OF_RANGE" | "CART_NOT_FOUND" | "CART_CLOSED" | "CHECKOUT_PERSON_ONLY" | "PAYMENT_NOT_DONE" | "PAYMENT_PROCESSING" | "SUBSCRIPTION_NONE" | "PROVIDER_ANSWER_INVALID" | "MODULE_NOT_FOUND" | "IMPORT_OUTSIDE_PROJECT" | "IMPORT_NEEDS_VERSION" | "PACKAGE_NOT_FOUND" | "PACKAGE_NOT_EXPORTED" | "PACKAGE_NOT_ESM" | "PACKAGE_MANIFEST_INVALID" | "PACKAGE_REGISTRY_UNSET" | "PACKAGE_UNKNOWN" | "PACKAGE_NAME_INVALID" | "PACKAGE_RANGE_INVALID" | "PACKAGE_VERSION_NOT_FOUND" | "PACKAGE_VERSION_CONFLICT" | "PACKAGE_REGISTRY_FAILED" | "PACKAGE_TARBALL_OUTSIDE_REGISTRY" | "PACKAGE_INTEGRITY_MISMATCH" | "PACKAGE_TARBALL_INVALID" | "PACKAGE_TOO_LARGE" | "KEY_AUTOMATION_NEEDS_PERSON" | "MCP_TOOL_NOT_FOUND" | "MCP_TEST_USER_NOT_FOUND" | "MCP_TOOL_FROM_ROUTE" | "MCP_TOOL_INVALID" | "TEST_TENANT_REQUIRED" | "SERIALIZATION" | "DESERIALIZATION" | "PIPELINE_TOO_LARGE" | "INVALID_JSON" | "EMPTY_PAYLOAD" | "BODY_REQUIRED" | "METHOD_NOT_ALLOWED" | "ENDPOINT_NOT_FOUND" | "MISSING_FIELD" | "UNSUPPORTED_OPERATION" | "NO_WAIT_IN_QUERY" | "NO_WAIT_IN_TRANSACTION" | "NO_WAIT_IN_UPSERT" | "NO_WAIT_IN_ENGINE_GATE" | "FETCH_FAILED" | "CREDENTIAL_REQUIRED" | "EMAIL_VERIFICATION_REQUIRED" | "OAUTH_INVALID" | "PROVIDER_NOT_CONFIGURED" | "PROVIDER_DISABLED" | "LIVE_BY_PROMOTE" | "TENANT_MOVED" | "GRANT_REQUIRED" | "KEY_ORIGIN_REFUSED" | "APPROVAL_PENDING" | "APPROVAL_SPENT" | "APPROVAL_EXPIRED" | "APPROVAL_MISMATCH" | "WEBHOOK_SIGNATURE_INVALID" | "BILLING_NOT_SET_UP" | "CRITICAL_SEGFAULT";
+export type SubstrioErrorCode = "UNKNOWN" | "NOT_IMPLEMENTED" | "SYSTEM_CLOSED" | "SYSTEM_ALREADY_OPEN" | "INVALID_ARGUMENT" | "INVALID_HANDLE" | "THREAD_INIT_FAILED" | "SHUTDOWN_IN_PROGRESS" | "INTERNAL" | "NULL_TREE" | "NULL_SYSTEM" | "BARRIER_UNSUPPORTED" | "STORAGE_IO" | "DISK_FULL" | "FILE_NOT_FOUND" | "PERMISSION_DENIED" | "FILE_CORRUPT" | "MMAP_FAILED" | "FSYNC_FAILED" | "LOCK_FAILED" | "NOT_A_DATABASE" | "OLD_FORMAT" | "NEWER_FORMAT" | "OUT_OF_MEMORY" | "BUFFER_TOO_SMALL" | "ALLOCATOR_FAULT" | "TRANSACTION_CONFLICT" | "RETRY" | "TRANSACTION_READ_ONLY" | "TRANSACTION_NOT_FOUND" | "DEADLOCK_DETECTED" | "TIMEOUT" | "NO_ACTIVE_TRANSACTION" | "CANCELLED" | "LWW_STALE" | "KEY_NOT_FOUND" | "KEY_TOO_LARGE" | "VALUE_TOO_LARGE" | "KEY_EMPTY" | "KEY_EXISTS" | "MISSING_INDEX" | "OWNERSHIP_REQUIRED" | "KEY_PREFIX_COLLISION" | "KEY_DELETED" | "UNIQUE" | "ID_RESERVED" | "INVALID_ID" | "ID_MISMATCH" | "INDEX_DUPLICATES" | "FIELD_IDS_EXHAUSTED" | "ID_PAST_ROWS" | "ID_NOT_ISSUED" | "ENGINE_GATE_HELD" | "ROW_STALE" | "CURSOR_EXHAUSTED" | "CURSOR_INVALIDATED" | "INVALID_RANGE" | "BATCH_OP_FAILED" | "NODE_NOT_FOUND" | "EDGE_NOT_FOUND" | "PROPERTY_NOT_FOUND" | "INVALID_EDGE" | "PATH_NOT_FOUND" | "GRAPH_CYCLE_DETECTED" | "DIMENSION_MISMATCH" | "POINT_NOT_FOUND" | "INVALID_BOUNDS" | "INVALID_RADIUS" | "SCHEMA_VIOLATION" | "TYPE_MISMATCH" | "CONSTRAINT_VIOLATION" | "TOO_MANY_FIELDS" | "SCHEMA_REFUSED" | "SCHEMA_VIOLATORS" | "SECRET_FIELD" | "TYPE_TAG_NOT_FIRST" | "STORAGE_QUOTA_EXCEEDED" | "DOCUMENT_QUOTA_EXCEEDED" | "BANDWIDTH_QUOTA_EXCEEDED" | "RATE_LIMIT_EXCEEDED" | "REQUEST_TOO_LARGE" | "CONCURRENT_LIMIT" | "COLLECTION_LIMIT" | "INDEX_LIMIT" | "FUNCTION_LIMIT" | "CF_CPU_TIMEOUT" | "CF_MEMORY_EXCEEDED" | "CF_EXECUTION_FAILED" | "SERVER_BUSY" | "CF_TENANT_MEMORY" | "CF_WALL_TIMEOUT" | "CF_SERVER_MEMORY" | "KEY_RATE_LIMIT_EXCEEDED" | "REALTIME_LIMIT" | "CRON_LIMIT" | "SPACE_FULL" | "TOKEN_EXPIRED" | "TOKEN_INVALID" | "TOKEN_REVOKED" | "SESSION_EXPIRED" | "ACCOUNT_SUSPENDED" | "TENANT_SUSPENDED" | "TENANT_READ_ONLY" | "IP_BLOCKED" | "INSUFFICIENT_PERMISSIONS" | "APPROVAL_REQUIRED" | "APPROVAL_INVALID" | "APPROVAL_DENIED" | "AGENT_BUDGET_EXHAUSTED" | "KEY_BUDGET_EXHAUSTED" | "QUERY_TOO_COMPLEX" | "QUERY_TIMEOUT" | "RESULT_SET_TOO_LARGE" | "SORT_LIMIT_EXCEEDED" | "SCAN_LIMIT_EXCEEDED" | "INVALID_QUERY_SYNTAX" | "SQL_FAILED" | "TENANT_NOT_FOUND" | "TENANT_ALREADY_EXISTS" | "TENANT_INVALID" | "TENANT_CANNOT_DROP_DEFAULT" | "COLLECTION_NOT_FOUND" | "COLLECTION_ALREADY_EXISTS" | "FUNCTION_NOT_FOUND" | "THREAD_NOT_FOUND" | "MESSAGE_NOT_FOUND" | "DATABASE_ERROR" | "ACCOUNT_NOT_FOUND" | "ACCOUNT_MEMBER_NOT_FOUND" | "ACCOUNT_LAST_OWNER" | "ACCOUNT_HAS_APPS" | "ACCOUNT_LIMIT" | "ACCOUNT_KEY_NOT_FOUND" | "ACCOUNT_INVITE_NOT_FOUND" | "ACCOUNT_INVITE_EXPIRED" | "ACCOUNT_INVITE_EMAIL" | "UNDO_TOKEN_NOT_FOUND" | "UNDO_TOKEN_EXPIRED" | "UNDO_RESOURCE_CHANGED" | "APP_OWNED_BY_ANOTHER_ACCOUNT" | "KEY_EXPIRED" | "TENANT_KEY_NOT_FOUND" | "TENANT_SLUG_RESERVED" | "TENANT_NOTE_TOO_LONG" | "TENANT_JOBS_DISABLED" | "TOOL_BAD_NAME" | "TOOL_HASH_MISMATCH" | "TOOL_BAD_SIZE" | "TOOL_BAD_FORMAT" | "TOOL_TOO_MANY" | "TOOL_STORAGE_IO" | "TOOL_NOT_INSTALLED" | "TOOL_TOO_MANY_BYTES" | "TOOL_LIMIT_OUT_OF_RANGE" | "TOOL_BAD_ARGS" | "TOOL_CONFINEMENT_UNAVAILABLE" | "TOOL_SPAWN_FAILED" | "DIRECT_CHANGES" | "HOST_NOT_FOUND" | "HOST_HAS_NODES" | "NODE_LABEL_NOT_FOUND" | "NODE_LABEL_IN_USE" | "NODE_LABEL_LIMIT" | "HOST_CAPABILITY_MISSING" | "HOST_AT_CAPACITY" | "HOST_HAS_APPS" | "SETTING_IS_PLATFORM" | "NO_CALL_CONTEXT" | "LEDGER_UNAVAILABLE" | "APP_QUERY_NOT_INDEXED" | "APP_QUERY_FIELD_NOT_EXPOSED" | "APP_USE_UNKNOWN_APP" | "SECRET_NOT_FOUND" | "EDIT_NO_MATCH" | "EDIT_AMBIGUOUS" | "SHELL_SYNTAX" | "SHELL_UNKNOWN_COMMAND" | "SHELL_UNKNOWN_VARIABLE" | "SHELL_PATH_OUTSIDE" | "SHELL_READ_ONLY" | "SHELL_WRITE_NOT_GRANTED" | "SHELL_FILES_DELETE" | "SHELL_OFFSET_WRITES" | "SHELL_CPU_BUDGET" | "SHELL_PIPE_BUDGET" | "HOST_TAKEN" | "HOST_INVALID" | "HOST_RESERVED" | "ENV_HOST_NOT_FOUND" | "ENVIRONMENT_NOT_FOUND" | "ROOT_DOMAIN_UNKNOWN" | "ROOT_DOMAIN_DISABLED" | "ROOT_DOMAIN_IN_USE" | "FEATURED_APP_NOT_FOUND" | "JET_KEY_NEEDS_APP" | "FEATURED_ALWAYS_ON" | "FEATURED_NEEDS_PLANS" | "BILLING_KEY_NOT_TEST" | "CART_EMPTY" | "CART_PLAN_NOT_FOUND" | "CART_PLAN_NOT_FOR_SALE" | "CART_APP_REPEATED" | "CART_COVERED" | "CART_MIXED" | "FUNDS_OUT_OF_RANGE" | "CART_NOT_FOUND" | "CART_CLOSED" | "CHECKOUT_PERSON_ONLY" | "PAYMENT_NOT_DONE" | "PAYMENT_PROCESSING" | "SUBSCRIPTION_NONE" | "PROVIDER_ANSWER_INVALID" | "PLAN_LIMIT" | "SPACE_ADDON_NOT_ON_PLAN" | "SPACE_ADDON_HELD" | "SPACE_ADDON_IN_USE" | "PLAN_NOT_ON_SALE" | "MODULE_NOT_FOUND" | "IMPORT_OUTSIDE_PROJECT" | "IMPORT_NEEDS_VERSION" | "PACKAGE_NOT_FOUND" | "PACKAGE_NOT_EXPORTED" | "PACKAGE_NOT_ESM" | "PACKAGE_MANIFEST_INVALID" | "PACKAGE_REGISTRY_UNSET" | "PACKAGE_UNKNOWN" | "PACKAGE_NAME_INVALID" | "PACKAGE_RANGE_INVALID" | "PACKAGE_VERSION_NOT_FOUND" | "PACKAGE_VERSION_CONFLICT" | "PACKAGE_REGISTRY_FAILED" | "PACKAGE_TARBALL_OUTSIDE_REGISTRY" | "PACKAGE_INTEGRITY_MISMATCH" | "PACKAGE_TARBALL_INVALID" | "PACKAGE_TOO_LARGE" | "KEY_AUTOMATION_NEEDS_PERSON" | "ADOPT_DISABLED" | "ADOPT_SOURCE_NOT_FOUND" | "ADOPT_SOURCE_OUTSIDE" | "ADOPT_SOURCE_SYMLINK" | "ADOPT_SOURCE_NOT_REGULAR" | "ADOPT_SOURCE_LINKED" | "ADOPT_CROSS_DEVICE" | "ADOPT_SOURCE_CHANGED" | "FILE_EXISTS" | "CONSOLE_LINK_NEEDS_PERSON" | "CONSOLE_LINK_UNKNOWN" | "CONSOLE_LINK_USED" | "CONSOLE_LINK_EXPIRED" | "CONSOLE_LINK_STEP_UP" | "AGENT_CODE_INVALID" | "AGENT_ALREADY_CONNECTED" | "AGENT_TOOL_UNKNOWN" | "APP_NOT_NAMED" | "SYSTEM_PROTECTED" | "CPU_HISTORY_OFF" | "SUBSCRIPTION_NOT_FOUND" | "PLAN_FEATURE_REQUIRED" | "SUBSCRIBERS_NOT_VISIBLE" | "SUBSCRIPTION_PERSON_REQUIRED" | "PLAN_FEATURE_UNKNOWN" | "DASHBOARD_INVALID" | "REGION_NOT_FOUND" | "REGION_IN_USE" | "REGION_LIMIT" | "REGION_UNAVAILABLE" | "REGION_FULL" | "HOST_NOT_PROBED" | "HOST_NO_SYSTEMD" | "HOST_NGINX_PRESENT" | "RELEASE_NOT_FOUND" | "RELEASE_NOT_PACKED" | "RELEASE_ISA_UNKNOWN" | "HOST_CPU_MISSING" | "HOST_NODE_LIMIT" | "NODE_BUSY" | "MCP_TOOL_NOT_FOUND" | "MCP_TEST_USER_NOT_FOUND" | "MCP_TOOL_FROM_ROUTE" | "MCP_RESULT_INVALID" | "MCP_OPERATIONS_IDENTITY_ONLY" | "MCP_LINK_NOT_LINKED" | "MCP_LINK_NOT_OFFERED" | "CALLER_USERS_REFUSED" | "NO_CALLER_APP" | "SELF_FIELD_REFUSED" | "MCP_IDENTITY_FUNCTION_NOT_DEPLOYED" | "MCP_TOOL_INVALID" | "TEST_TENANT_REQUIRED" | "ARCHIVE_INVALID" | "WASM_MODULE_INVALID" | "WASM_COMPILE_FAILED" | "WASM_CELLS_UNSUPPORTED" | "RUST_COMPILE_FAILED" | "RUST_TOOLCHAIN_UNAVAILABLE" | "ARCHIVE_PASSPHRASE_WRONG" | "SERIALIZATION" | "DESERIALIZATION" | "PIPELINE_TOO_LARGE" | "INVALID_JSON" | "EMPTY_PAYLOAD" | "BODY_REQUIRED" | "METHOD_NOT_ALLOWED" | "ENDPOINT_NOT_FOUND" | "MISSING_FIELD" | "UNSUPPORTED_OPERATION" | "NO_WAIT_IN_QUERY" | "NO_WAIT_IN_TRANSACTION" | "NO_WAIT_IN_UPSERT" | "NO_WAIT_IN_ENGINE_GATE" | "FETCH_FAILED" | "CREDENTIAL_REQUIRED" | "EMAIL_VERIFICATION_REQUIRED" | "OAUTH_INVALID" | "PROVIDER_NOT_CONFIGURED" | "PROVIDER_DISABLED" | "LIVE_BY_PROMOTE" | "TENANT_MOVED" | "GRANT_REQUIRED" | "KEY_ORIGIN_REFUSED" | "SECRET_KEY_IN_URL" | "APPROVAL_PENDING" | "APPROVAL_SPENT" | "APPROVAL_EXPIRED" | "APPROVAL_MISMATCH" | "WEBHOOK_SIGNATURE_INVALID" | "BILLING_NOT_SET_UP" | "EMAIL_TAKEN" | "CREDENTIALS_MISMATCH" | "PASSWORD_LENGTH" | "EMAIL_INVALID" | "USER_NOT_FOUND" | "ACCOUNT_LOCKED" | "RECIPIENT_UNSUBSCRIBED" | "APP_OVER_PLAN" | "CRITICAL_SEGFAULT";
 
 export type SubstrioMethod = 'GET' | 'HEAD' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
 
@@ -77,10 +78,12 @@ export type AccountAppAttachResult = {
     [field: string]: unknown;
 };
 
-/** Input of account.app.create: Create an app owned by the account */
+/** Input of account.app.create: Create an app owned by the account. A region (a slug region.choices lists) places it there; one that is not listed is refused with REGION_UNAVAILABLE */
 export type AccountAppCreateInput = {
     id: number;
     slug: string;
+    /** A slug region.choices lists: the region to create the app in. Refused with REGION_UNAVAILABLE when it is not listed */
+    region?: string;
     [field: string]: unknown;
 };
 /** Result of account.app.create. */
@@ -143,6 +146,25 @@ export type AccountAppOpenSetResult = {
     [field: string]: unknown;
 };
 
+/** Input of account.apps.order: Set the order the account's apps run in: apps lists every app id of the account once (any other list is refused, INVALID_ARGUMENT naming apps). The first max_apps run; the rest are paused, keeping every byte, and their requests answer APP_OVER_PLAN until they move up, an app is deleted or the plan allows more. Answers each app in order with active, and max_apps (0: no limit) */
+export type AccountAppsOrderInput = {
+    id: number;
+    /** Every app id of the account (account.app.list's id), each once, in the order they run: the first max_apps run, the rest are paused (APP_OVER_PLAN) */
+    apps: number[];
+    [field: string]: unknown;
+};
+/** Result of account.apps.order. */
+export type AccountAppsOrderResult = {
+    apps: Array<{
+        id: number;
+        slug: string;
+        /** true: inside the first max_apps, it runs; false: paused, its requests answer APP_OVER_PLAN */
+        active: boolean;
+    }>;
+    /** the apps the account may run; 0: no limit */
+    max_apps: number;
+};
+
 /** Input of account.audit.list: Read an account's audit trail (its keys, members, invites, apps and clients), newest first; the filters, limit and cursor of audit.list */
 export type AccountAuditListInput = {
     id: number;
@@ -178,6 +200,17 @@ export type AccountAuditListResult = {
     [field: string]: unknown;
 };
 
+/** Input of account.console.link: Mint the person you act for a one-time console sign-in, then open its url in their browser: it lands them signed in on their dashboard. Only a person mints one (an agent session for its own person, or the person signed in to the console); a key, the master key or an agent token is refused CONSOLE_LINK_NEEDS_PERSON. The link lives 5 minutes (the server's --console-link-seconds), signs in once, and a new one replaces the last; its token rides in the url's fragment, so no server receives or logs it. Answers {url, expires_at} */
+export type AccountConsoleLinkInput = Record<string, never>;
+/** Result of account.console.link. */
+export type AccountConsoleLinkResult = {
+    /** The console address with the one-time link in its fragment (#link=...): open it in the person's browser */
+    url: string;
+    /** Unix seconds */
+    expires_at: number;
+    [field: string]: unknown;
+};
+
 /** Input of account.create: Create an account owned by the signed-in person */
 export type AccountCreateInput = {
     name: string;
@@ -195,6 +228,8 @@ export type AccountCreateResult = {
 /** Input of account.delete: Delete an account that owns no apps, with its members and keys */
 export type AccountDeleteInput = {
     id: number;
+    /** true deletes every app the account owns first (each app with its data, one at a time), then the account; without it an account that owns apps is refused */
+    with_apps?: boolean;
 };
 /** Result of account.delete. */
 export type AccountDeleteResult = {
@@ -407,10 +442,10 @@ export type AccountMemberSetResult = {
     [field: string]: unknown;
 };
 
-/** Input of account.mfa.set: Require every member of an account to sign in with a second factor, or stop requiring it */
+/** Input of account.mfa.set: Require every member of an account to sign in with 2FA, or stop requiring it */
 export type AccountMfaSetInput = {
     id: number;
-    /** Every member signs in with a second factor; one without it enrols at sign-in */
+    /** Every member signs in with 2FA; one without it enrols at sign-in */
     required: boolean;
     [field: string]: unknown;
 };
@@ -441,12 +476,22 @@ export type AccountOverviewResult = {
         stored_bytes?: number;
         /** present only when open is true */
         documents?: number;
+        /** present only when open is true: the app's API requests since its database opened (total, status, the latency percentiles, cpu_ns), the counters and the writer of tenant.usage's and app.overview's requests */
+        requests?: Record<string, unknown>;
+        /** the app's function calls, API requests and their 5xx this month (UTC, the plan's metering month), open or not: durable totals kept in the app's record, reset when the month turns */
+        this_month: {
+            calls: number;
+            requests: number;
+            requests_5xx: number;
+            [field: string]: unknown;
+        };
         [field: string]: unknown;
     }>;
     totals: {
         apps: number;
         suspended: number;
         open: number;
+        /** every app's this_month calls */
         calls: number;
         stored_bytes: number;
         documents: number;
@@ -494,6 +539,27 @@ export type AccountPlanSummaryResult = {
     [field: string]: unknown;
 };
 
+/** Input of account.storage: Read what each app of the account holds on disk (disk_bytes: its database, files, logs, backups, code and the rest, as of its last fold, open or not), the account's total (its apps and their sandboxes, the figure its space is held against) and the space in force (null while none). Supersedes account.overview's stored_bytes, which counts only open apps' document bytes */
+export type AccountStorageInput = {
+    id: number;
+};
+/** Result of account.storage. */
+export type AccountStorageResult = {
+    apps: Array<{
+        slug: string;
+        /** the app's tenant id */
+        id: number;
+        /** what the app's folder holds on disk (its database, files, logs, backups, code and the rest) as of its last fold, open or not: an app that is not open answers the figure it had when it closed */
+        disk_bytes: number;
+        [field: string]: unknown;
+    }>;
+    /** what the account's apps hold on disk, their sandboxes included: the figure its space is held against */
+    total_bytes: number;
+    /** the account's space in force; null while it has none */
+    space_bytes: number | null;
+    [field: string]: unknown;
+};
+
 /** Input of account.update: Rename an account; the system key also sets its services, space and max_apps, and suspends it */
 export type AccountUpdateInput = {
     id: number;
@@ -502,11 +568,11 @@ export type AccountUpdateInput = {
     services?: number;
     /** System key only */
     suspended?: boolean;
-    /** System key only: its owners and admins who sign in to the identity app with a second factor operate the platform */
+    /** System key only: its owners and admins who sign in to the identity app with 2FA operate the platform */
     platform_operator?: boolean;
-    /** System key only: the bytes the account's apps may hold together, records and files; 0 is unlimited, null gives the account back to the platform's account_space_bytes (1 GiB by default). The account makes apps while they fit */
+    /** System key only: the bytes the account's apps may hold together, records and files; 0 is unlimited, null returns the account to the server-wide account_space_bytes (1 GiB by default). The account makes apps while they fit */
     space_bytes?: number | null;
-    /** System key only: the apps the account may own, beside its space; 0 is unlimited, null gives the account back to the platform's account_max_apps (unlimited by default) */
+    /** System key only: the apps the account may own, beside its space; 0 is unlimited, null returns the account to the server-wide account_max_apps (unlimited by default) */
     max_apps?: number | null;
     [field: string]: unknown;
 };
@@ -528,6 +594,59 @@ export type AccountUsageResult = {
     [field: string]: unknown;
 };
 
+/** Input of account.usage.cpu: Read the CPU the account's apps used in each of the last 60 finished minutes, the hour's mean, the last 15 minutes' mean, the peak minute, the plan's CPU slices and the hour against them (used, of_share), the requests and calls held back while the server was saturated (holds) and each app's minutes and holds, each in CPU slices (1 is the Free plan's CPU under load; Standard holds 4). Explains how close the account runs to its plan's share and who waited for it */
+export type AccountUsageCpuInput = {
+    id: number;
+};
+/** Result of account.usage.cpu. */
+export type AccountUsageCpuResult = {
+    account: number;
+    /** the last 60 finished minutes, oldest first; a minute with no CPU is 0 */
+    minutes: Array<{
+        /** Unix seconds, the start of the minute */
+        at: number;
+        /** the CPU the account's apps used in it: their function calls' thread CPU and their API requests' CPU sampled every 10 ms, in nanoseconds */
+        cpu_ns: number;
+        /** cpu_ns in CPU slices (1: one CPU busy the whole minute, 60e9 ns, the Free plan's CPU under load) */
+        used: number;
+        [field: string]: unknown;
+    }>;
+    /** the hour's mean, in CPU slices */
+    mean_used: number;
+    /** the mean of its last 15 minutes, the trend against the hour */
+    recent_used: number;
+    /** the busiest minute (the latest of equal ones); null in an hour with no CPU */
+    peak: {
+        /** Unix seconds, the start of the minute */
+        at: number;
+        used: number;
+        [field: string]: unknown;
+    } | null;
+    /** the CPU slices of the account's plan, the Free plan's 1 (the identity app's plans file, cpu_share); null when the plan sets none or no plans are set */
+    share: number | null;
+    /** the account's plan id; null when no plans are set */
+    plan: string | null;
+    /** the hour's mean in CPU slices (mean_used) */
+    used: number;
+    /** used over share: 1 is the plan's whole slices on average; null when share is */
+    of_share: number | null;
+    /** the hour's requests and function calls queued behind other accounts' work while the server's CPU was saturated (CPU slices are a priority, never a cap); 0 on a server never saturated */
+    holds: number;
+    /** each of the account's apps with CPU or holds this hour */
+    apps: Array<{
+        /** the app's tenant id */
+        app: number;
+        /** empty for an app since removed */
+        slug: string;
+        /** its CPU in nanoseconds in each of the 60 minutes, oldest first */
+        minutes: number[];
+        /** its holds in each of the 60 minutes, oldest first */
+        holds: number[];
+        [field: string]: unknown;
+    }>;
+    [field: string]: unknown;
+};
+
 /** Input of agent.alert.list: List the account's agent alerts (a spent key used again revokes its session and leaves one), newest first */
 export type AgentAlertListInput = {
     id: number;
@@ -607,7 +726,7 @@ export type AgentEnrollCreateResult = {
     [field: string]: unknown;
 };
 
-/** Input of agent.enroll.exchange: Exchange a one-time enrollment code for an agent session: a key-bound one when a public key is sent, else a ratcheted one. The code is spent */
+/** Input of agent.enroll.exchange: Exchange a one-time enrollment code (substrio_ae_...) for an agent session acting as the member who made it: a bearer one unless a kind is named or a public key is sent (key-bound). Answers the credential once and next, what to do with it; the code is spent. Over MCP it is the tool substrio_connect on any /mcp, with no credential */
 export type AgentEnrollExchangeInput = {
     /** bearer: one static secret (substrio_ab_...), short-lived (agent_bearer_max_seconds), for an agent that can hold only one string; absent: key_bound with a public_key, else bearer. ratcheted: a key that changes on every request */
     kind?: "key_bound" | "ratcheted" | "bearer";
@@ -665,7 +784,7 @@ export type AgentSessionDelegateResult = {
     [field: string]: unknown;
 };
 
-/** Input of agent.session.list: List the account's agent sessions, oldest first, a page at a time (limit, cursor; next_cursor), or only those reaching one app (app); never a key */
+/** Input of agent.session.list: List the account's live agent sessions (an ended one leaves the list; its log is still read by id), oldest first, a page at a time (limit, cursor; next_cursor), or only those reaching one app (app); never a key */
 export type AgentSessionListInput = {
     id: number;
     /** only this app's rows: its slug, as account.app.list names it; a session whose grant names no app reaches every app */
@@ -998,6 +1117,125 @@ export type AiToolsResult = {
     [field: string]: unknown;
 };
 
+/** Input of app.archive: Download the app as one .substrio.zip, its backup and its portable export: every collection as NDJSON (data/<collection>.ndjson), its users (users.ndjson), versions, config and site files, and manifest.json with each entry's SHA-256. Optional body passphrase seals secret values, password hashes, TOTP enrolments and passkeys into sealed.bin; without it they are left out. Optional backup_id archives that backup instead. app.restore or app.import reads it back on any server version */
+export type AppArchiveInput = {
+    /** Seals secret values, users' password hashes, TOTP enrolments and passkeys into sealed.bin (Argon2id, AES-256-GCM), so a restore with the same passphrase keeps sign-ins and secrets; without it they are left out */
+    passphrase?: string;
+    /** Archive this backup (an id from backup.list) instead of the app as it is now */
+    backup_id?: string;
+    [field: string]: unknown;
+};
+/** Result of app.archive. */
+export type AppArchiveResult = {
+    data?: unknown;
+    error?: unknown;
+    [field: string]: unknown;
+};
+
+/** Input of app.deploy: Ship files in one call: commit the units and removals (as version.commit takes them), check the version's functions (unless check is false), make it live where to names (live, or a sandbox), test it there with app.test (unless test is false), and, with promote and a sandbox in to, make it live on the app once the test is green. Stops at the first step that fails: a refused commit, check or live answers that step's own error with stage; a failed test answers ok false, stage test and the test's failures with their fixes, and promotes nothing. Answers ok, stage, deployed {commit, live}, test and promote, each the answer of that step's own tool. Over HTTP it runs the commit, the check and live; test and promote run in the MCP tool */
+export type AppDeployInput = {
+    /** What this commit did */
+    message: string;
+    /** The units this commit writes, as version.commit takes them */
+    units?: Array<{
+        /** The unit's path inside the version: site/index.html, functions/hello.js, functions/hello.json */
+        path: string;
+        /** The unit's bytes as text */
+        text?: string;
+        /** The unit's bytes as base64, for a unit that is not text */
+        base64?: string;
+        /** An object this app already holds (64 hex), instead of sending the bytes again */
+        id?: string;
+        [field: string]: unknown;
+    }>;
+    /** The paths this commit removes */
+    removals?: string[];
+    /** The branch to commit on (default: main) */
+    branch?: string;
+    /** changes applies units and removals to the parent version (default); snapshot makes the units the whole content */
+    mode?: "changes" | "snapshot";
+    /** The version the branch must still point at (64 hex, or an empty string for a branch with no version yet). 409 when it moved: nothing is written */
+    expected?: string;
+    /** true says the branch's required checks are green, which a protected branch needs */
+    checks_green?: boolean;
+    /** Where the version goes live: live for the app, or a sandbox name from sandbox.list */
+    to: string;
+    /** false skips function.check over the version's functions before it goes live */
+    check?: boolean;
+    /** true runs app.test on where the version went live, with its defaults; a failure stops the deploy there */
+    test?: boolean;
+    /** With a sandbox in to: once the test is green, make what the sandbox runs live on the app (live.set from the sandbox) */
+    promote?: boolean;
+    /** false skips the data backup a version going live on the app takes first */
+    backup?: boolean;
+    /** As live.set: what to do with a function deployed outside a version that this would overwrite */
+    direct?: "refuse" | "replace" | "keep";
+    [field: string]: unknown;
+};
+/** Result of app.deploy. */
+export type AppDeployResult = {
+    /** true when every step asked for passed */
+    ok: boolean;
+    /** done, or the step that stopped the deploy (a refused commit, check or live answers its own error, stage commit, check or live) */
+    stage: "done" | "test" | "promote";
+    deployed: {
+        /** version.commit's answer */
+        commit: Record<string, unknown>;
+        /** live.set's answer for to; its url is the https address to open in a browser */
+        live: Record<string, unknown>;
+        [field: string]: unknown;
+    };
+    /** app.test's answer; null when test was false */
+    test: Record<string, unknown> | null;
+    /** live.set's answer on the app (its url the app's address); null when promote was not asked or the test failed */
+    promote: Record<string, unknown> | null;
+    [field: string]: unknown;
+};
+
+/** Input of app.diagnose: What is wrong with the app (or a sandbox) and how to fix it, in one call: which version each environment runs against main's head, function.check over the version that runs where the call looks (its diagnostics), its newest function errors, and app.test of its website and GET routes, each finding with its fix. Answers ok, sandbox, live {main, environments}, check, errors {recent, fix}, test and fixes, every fix in order. Read only; the MCP server runs it */
+export type AppDiagnoseInput = {
+    /** A sandbox name from sandbox.list: look at what it runs instead of the app */
+    sandbox?: string;
+    [field: string]: unknown;
+};
+/** Result of app.diagnose. */
+export type AppDiagnoseResult = {
+    /** something is live where the call looks, its functions pass function.check and app.test passed */
+    ok: boolean;
+    sandbox: string | null;
+    live: {
+        /** main's head, by number */
+        main: number | null;
+        environments: Array<{
+            /** null: the app */
+            sandbox: string | null;
+            live: number | null;
+            /** when it does not run main's head */
+            fix?: string;
+            [field: string]: unknown;
+        }>;
+        [field: string]: unknown;
+    };
+    check: {
+        version: number | null;
+        ok: boolean;
+        diagnostics: Array<Record<string, unknown>>;
+        fix?: string;
+        [field: string]: unknown;
+    };
+    errors: {
+        /** the newest function errors, as function.errors pages them */
+        recent: Record<string, unknown>;
+        fix: string;
+        [field: string]: unknown;
+    };
+    /** app.test's answer; null when nothing runs there */
+    test: Record<string, unknown> | null;
+    /** every finding's fix, in order; empty when ok */
+    fixes: string[];
+    [field: string]: unknown;
+};
+
 /** Input of app.export: Stream the app as one bundle (versions, blobs, live stack, views, AI config, database, secrets), sealed whole to seal_to, for that server's POST /v1/_import */
 export type AppExportInput = {
     /** the importing server's seal key (GET /v1/_seal-key); required */
@@ -1010,11 +1248,48 @@ export type AppExportResult = {
     [field: string]: unknown;
 };
 
+/** Input of app.get: Read this app's own record: slug, hosts, domains, suspended, readonly, live_by_promote, account_id, created_at and its limits. The app is the one the request names (X-Substrio-Tenant or its host) */
+export type AppGetInput = Record<string, never>;
+/** Result of app.get. */
+export type AppGetResult = {
+    suspended: boolean;
+    /** present only while suspended is true */
+    suspend_reason?: "billing" | "abuse" | "owner_request" | "maintenance";
+    /** present only while suspended is true */
+    suspend_note?: string;
+    readonly: boolean;
+    /** the live version changes only by promote (version.live.set): a function is changed in a version, never deployed straight to live */
+    live_by_promote: boolean;
+    hosts: string[];
+    _id: number;
+    /** the account that owns the app (account.get); 0: the platform */
+    account_id: number;
+    slug: string;
+    subdomain: string;
+    createdAt: number;
+    customDomain: string;
+    domains: string[];
+    flags: number;
+    active: boolean;
+    storageBytesLimit: number;
+    storageBytesUsed: number;
+    documentsLimit: number;
+    documentsCount: number;
+    requestsPerMinute: number;
+    maxDocumentSize: number;
+    cfCpuLimitMs: number;
+    cfMemoryLimitMb: number;
+    cfTenantMemoryLimitMb: number;
+    cfConcurrentLimit: number;
+    cfTimeoutS: number;
+    [field: string]: unknown;
+};
+
 /** Input of app.import: Make an app from a bundle GET /v1/_export streamed (the request body): its data, versions, live version, secrets sealed to this server, views and sandboxes */
 export type AppImportInput = {
     /** the app slug to import as (default: the bundle's app) */
     slug?: string;
-    /** true replaces an existing app of that slug */
+    /** true replaces an existing app of that slug (app.restore: the caller's own app) that holds data */
     replace?: boolean;
     [field: string]: unknown;
 };
@@ -1065,7 +1340,7 @@ export type AppMeshResult = {
     [field: string]: unknown;
 };
 
-/** Input of app.overview: Read everything a dashboard's first paint needs for this app in one call: app (slug, tenant_id, created_at, hosts, domains, suspended, live_by_promote, is_sandbox), usage (the same body as tenant.usage), storage (database_bytes on disk and backups: count, bytes, latest_at), versions (live, rollback_to, count, sandboxes), functions (count, names), collections (count), cron (count), queues (count), alerts (log alerts fired in their last window), audit (the last 5 entries, newest first) and mesh (this app's mesh position, in short) */
+/** Input of app.overview: Read everything a dashboard's first paint needs for this app in one call: app (slug, tenant_id, created_at, hosts, domains, suspended, live_by_promote, is_sandbox), usage (the same body as tenant.usage.self), storage (database_bytes on disk and backups: count, bytes, latest_at), versions (live, rollback_to, count, sandboxes), functions (count, names), collections (count), cron (count), queues (count), alerts (log alerts fired in their last window), audit (the last 5 entries, newest first) and mesh (this app's mesh position, in short) */
 export type AppOverviewInput = Record<string, never>;
 /** Result of app.overview. */
 export type AppOverviewResult = {
@@ -1082,16 +1357,18 @@ export type AppOverviewResult = {
         is_sandbox: boolean;
         [field: string]: unknown;
     };
-    /** the same body as tenant.usage */
+    /** the same body as tenant.usage.self */
     usage: Record<string, unknown>;
     storage: {
-        /** allocated bytes (st_blocks) of the records: substrio.db and its -wal/-shm */
+        /** the database file: its used end, page-rounded (tenant.storage's kinds.database) */
         database_bytes: number;
-        /** allocated bytes of the app's log: logs.db and its siblings */
+        /** the logs and the sync log, each at its used end (tenant.storage's kinds.logs) */
         logs_bytes?: number;
-        /** allocated bytes of every other file directly in the data folder (substrio.conf, key.gen, ...) */
+        /** the backups and set-aside copies, their allocated bytes: a part of folder_bytes, held against the storage limit like the rest */
+        backups_bytes?: number;
+        /** the rest of folder_bytes: the stored files, code and every other file */
         other_bytes?: number;
-        /** the three above together: every file directly in the app's data folder, no recursion */
+        /** the three above together: what the app's folder holds on disk, tenant.storage's disk_bytes, the figure its storage limit is held against */
         folder_bytes?: number;
         backups: {
             count: number;
@@ -1134,11 +1411,24 @@ export type AppOverviewResult = {
     alerts: unknown[];
     /** the last 5 entries, newest first */
     audit: unknown[];
-    /** as app.mesh answers */
+    /** the servers this app runs on, for the operator */
     mesh: Record<string, unknown>;
     [field: string]: unknown;
 };
 
+/** Input of app.restore: Restore a .substrio.zip (the request body, as app.archive made it) into this app through the normal write paths: users, data, versions, site files, config, and with the X-Substrio-Passphrase header the sealed secrets and sign-ins. Every entry is checked against manifest.json before anything is written. An app that holds data is refused unless replace=true. Answers the counts restored and what was left out */
+export type AppRestoreInput = {
+    /** true replaces an existing app of that slug (app.restore: the caller's own app) that holds data */
+    replace?: boolean;
+    [field: string]: unknown;
+};
+/** Result of app.restore. */
+export type AppRestoreResult = {
+    data?: unknown;
+    error?: unknown;
+    [field: string]: unknown;
+};
+
 /** Input of app.runtime_level.set: Set one app's runtime compatibility level: which behaviour of the function runtime it gets. Never above the level this release carries (a higher level refuses the call), and the app's isolates pick the new level up as they are made */
 export type AppRuntimeLevelSetInput = {
     slug: string;
@@ -1153,6 +1443,29 @@ export type AppRuntimeLevelSetResult = {
     [field: string]: unknown;
 };
 
+/** Input of app.scaffold: Start an app from a template compiled into the release: commits the app's first version on main, one snapshot of the template's units, each of which passes app.test. site is a page with its stylesheet and script; site-api adds a function route (GET /api/hello) the page calls; site-data-auth is a notes page anyone reads and a signed-in person adds to (GET /api/notes, POST /api/notes auth, GET /api/me auth). Refused with 409 when main already holds a version: change an app that has one with version.commit or app.deploy. Answers version.commit's answer and template; make it live with live.set (with sandbox to try it first) */
+export type AppScaffoldInput = {
+    /** site: a page, its stylesheet and script; site-api: that and a function route, GET /api/hello, the page calls; site-data-auth: a notes page anyone reads, a signed-in person adds to (GET /api/notes, POST /api/notes auth, GET /api/me auth) */
+    template: "site" | "site-api" | "site-data-auth";
+    /** The commit's message (default: app.scaffold: and the template) */
+    message?: string;
+    [field: string]: unknown;
+};
+/** Result of app.scaffold. */
+export type AppScaffoldResult = {
+    branch: string;
+    /** the version's id (64 hex) */
+    version: string;
+    root?: string;
+    /** the version number, promotable at once with live.set (with sandbox to run it there first) */
+    number: number;
+    generation?: number;
+    blobs_written?: number;
+    trees_written?: number;
+    template: "site" | "site-api" | "site-data-auth";
+    [field: string]: unknown;
+};
+
 /** Input of app.seal_key.get: Read the X25519 public key bundles this server imports are sealed to (seal_to of an export) */
 export type AppSealKeyGetInput = Record<string, never>;
 /** Result of app.seal_key.get. */
@@ -1162,6 +1475,63 @@ export type AppSealKeyGetResult = {
     [field: string]: unknown;
 };
 
+/** Input of app.test: Test the app's website (or a sandbox's) as a browser loads it, in one call: each page of paths (default /) and every same-site page it links, every stylesheet, script, image, icon and CSS url() or @import they name, and every GET function route with no parameter, each fetched in process as route.call does, as a visitor with no credentials. Each is checked for its status, its content type (a stylesheet must be text/css, a script JavaScript, an image image/*, never the site's page in their place) and its size. Answers ok, the table of every resource (path, kind, from, status, type, bytes, ok) and each failure with its problem and its fix. References to another origin are counted, never fetched */
+export type AppTestInput = {
+    /** A sandbox name from sandbox.list: test what it runs instead of the app */
+    sandbox?: string;
+    /** The pages to start from (default ["/"]); every same-site <a href> page they link is tested too, up to max_pages */
+    paths?: string[];
+    /** true also calls every GET function route that has no parameter, as a visitor with no credentials, and fails one answering 500 or above */
+    routes?: boolean;
+    /** Pages fetched at most, paths and links together */
+    max_pages?: number;
+    /** Requests made at most; a run that stops there answers truncated: true */
+    max_fetches?: number;
+    [field: string]: unknown;
+};
+/** Result of app.test. */
+export type AppTestResult = {
+    /** true when no resource failed */
+    ok: boolean;
+    sandbox: string | null;
+    pages: number;
+    /** requests made */
+    checked: number;
+    failed: number;
+    /** references to another origin, not fetched */
+    external: number;
+    /** function routes with a parameter, a * or a method other than GET, not called */
+    skipped_routes: number;
+    /** max_pages or max_fetches stopped the run */
+    truncated: boolean;
+    resources: Array<{
+        path: string;
+        kind: "page" | "stylesheet" | "script" | "image" | "css_url" | "link" | "route";
+        /** the page or stylesheet that names it; null for one this call named */
+        from: string | null;
+        status: number;
+        /** the media type answered */
+        type: string;
+        bytes: number;
+        ok: boolean;
+        [field: string]: unknown;
+    }>;
+    failures: Array<{
+        path: string;
+        kind: string;
+        from: string | null;
+        status: number;
+        type: string;
+        problem: "not_found" | "status" | "wrong_type" | "empty" | "server_error";
+        /** what to do, naming the unit to commit, the reference or header to change, or the log to read */
+        fix: string;
+        /** a failing route's body, its first 300 bytes */
+        detail?: string;
+        [field: string]: unknown;
+    }>;
+    [field: string]: unknown;
+};
+
 /** Input of apps.calls.get: Read the app's word on calls between apps: the functions it offers other apps (each to the apps named, or @account: every app of its own account) and the functions of other apps it calls as substrio.apps.<app>.<entry>(...) */
 export type AppsCallsGetInput = Record<string, never>;
 /** Result of apps.calls.get. */
@@ -1439,7 +1809,20 @@ export type AuthClientRedirectUrisSetResult = {
     [field: string]: unknown;
 };
 
-/** Input of auth.email.code_request: Mail a short code and a link that prove an address; nobody need be signed in. One live pair an address, a new request replaces it, paced by the app's request interval. Answers {accepted, expires_at} whether or not anyone holds the address */
+/** Input of auth.devices: Count the signed-in person's remembered devices: each signs in with the authenticator code and no email until it ends (30 days, or every session of the person ending) */
+export type AuthDevicesInput = Record<string, never>;
+/** Result of auth.devices. */
+export type AuthDevicesResult = {
+    count: number;
+    [field: string]: unknown;
+};
+
+/** Input of auth.devices.forget: Forget every remembered device of the signed-in person: each signs in by the email code again. No session ends */
+export type AuthDevicesForgetInput = Record<string, never>;
+/** Result of auth.devices.forget. */
+export type AuthDevicesForgetResult = void;
+
+/** Input of auth.email.code_request: Mail a short code and a link that prove an address; nobody need be signed in. One pair an address: asked again while it lives, the same code and link are mailed again (every mail sent works) and its life starts over; a spent, expired or locked pair gives way to a new one. Paced by the app's request interval. Answers {accepted, expires_at} whether or not anyone holds the address. On a device remembered for the person the address names (the substrio_device cookie auth.mfa set), their 2FA on, no mail is sent: {accepted, expires_at, mfa_required, challenge}, finished by auth.mfa with the authenticator code */
 export type AuthEmailCodeRequestInput = {
     email: string;
     [field: string]: unknown;
@@ -1447,8 +1830,12 @@ export type AuthEmailCodeRequestInput = {
 /** Result of auth.email.code_request. */
 export type AuthEmailCodeRequestResult = {
     accepted: true;
-    /** Unix seconds */
+    /** Unix seconds: the code's end, or the challenge's */
     expires_at: number;
+    /** A remembered device: no email was sent; answer the challenge with auth.mfa */
+    mfa_required?: true;
+    /** With mfa_required: the challenge auth.mfa takes with the authenticator code */
+    challenge?: string;
     [field: string]: unknown;
 };
 
@@ -1467,10 +1854,10 @@ export type AuthEmailCodeVerifyResult = {
     created: boolean;
     /** A one-time password reset token; absent for a suspended or deleted person */
     password_grant?: string;
-    /** A session: the code proves the mailbox, so the person is signed in; absent when a second factor is due */
+    /** A session: the code proves the mailbox, so the person is signed in; absent when 2FA is due */
     token?: string;
     keyring?: string;
-    /** The second factor due instead of a session: the challenge to answer with auth.mfa */
+    /** The 2FA step due instead of a session: the challenge to answer with auth.mfa */
     mfa?: Record<string, unknown>;
     [field: string]: unknown;
 };
@@ -1531,6 +1918,24 @@ export type AuthGoogleResult = {
     [field: string]: unknown;
 };
 
+/** Input of auth.link.redeem: For the console: spend a one-time console link (token, from the url's #link fragment) and sign its person in at the identity app, marked: an irreversible call waits for an approval and it decides none (CONSOLE_LINK_STEP_UP) until the person signs in again by the email code or 2FA. Answers {user_id, account_id, token, keyring} as auth.email.code_verify signs in, or the 2FA step due under mfa; a link that signs nobody in is refused CONSOLE_LINK_UNKNOWN (made up, or replaced by a newer link), CONSOLE_LINK_USED or CONSOLE_LINK_EXPIRED */
+export type AuthLinkRedeemInput = {
+    token: string;
+    [field: string]: unknown;
+};
+/** Result of auth.link.redeem. */
+export type AuthLinkRedeemResult = {
+    user_id: number;
+    /** The account the agent acts in; 0 when the link names none */
+    account_id: number;
+    /** The person's session; absent when 2FA is due */
+    token?: string;
+    keyring?: string;
+    /** The 2FA step due instead of a session: the challenge to answer with auth.mfa */
+    mfa?: Record<string, unknown>;
+    [field: string]: unknown;
+};
+
 /** Input of auth.login: Authenticate a user */
 export type AuthLoginInput = {
     email: string;
@@ -1564,7 +1969,7 @@ export type AuthLoginSetResult = {
     [field: string]: unknown;
 };
 
-/** Input of auth.logout: End this session; its token stops working at once */
+/** Input of auth.logout: End this session; its token stops working at once, and this browser's substrio_session cookie ends and is cleared (a remembered device stays) */
 export type AuthLogoutInput = Record<string, never>;
 /** Result of auth.logout. */
 export type AuthLogoutResult = void;
@@ -1595,7 +2000,22 @@ export type AuthMeDeleteResult = {
     [field: string]: unknown;
 };
 
-/** Input of auth.mfa: Finish a sign-in that answered mfa_required: trade its challenge and a code, or a recovery code, for the session */
+/** Input of auth.me.update: Edit the signed-in person's own profile: name always, and each member of fields only when the app's _users schema marks that field "self": true (a member not marked refuses the whole edit with 403 SELF_FIELD_REFUSED naming it; a value the schema refuses is 400 SCHEMA_REFUSED; a key is refused 403, a key is not a user). Email and password change through their own verified flows. Answers the profile as auth.me does */
+export type AuthMeUpdateInput = {
+    /** The person's display name */
+    name?: string;
+    /** Members of the person object, each one the app's _users schema marks self */
+    fields?: Record<string, unknown>;
+    [field: string]: unknown;
+};
+/** Result of auth.me.update. */
+export type AuthMeUpdateResult = {
+    data?: unknown;
+    error?: unknown;
+    [field: string]: unknown;
+};
+
+/** Input of auth.mfa: Finish a sign-in that answered mfa_required: trade its challenge and a code, or a recovery code, for the session. After the email code, remember true also remembers the device (the substrio_device cookie, 30 days) */
 export type AuthMfaInput = {
     /** From the sign-in that answered mfa_required */
     challenge: string;
@@ -1603,6 +2023,8 @@ export type AuthMfaInput = {
     code?: string;
     /** One of the recovery codes, instead of code; each works once */
     recovery_code?: string;
+    /** Remember this device (a sign-in that began with the email code only): its next sign-in asks for the authenticator code with no email. The answer sets the substrio_device cookie; false when absent */
+    remember?: boolean;
     [field: string]: unknown;
 };
 /** Result of auth.mfa. */
@@ -1766,7 +2188,7 @@ export type AuthPasskeyRenameResult = {
     [field: string]: unknown;
 };
 
-/** Input of auth.passkey.sign_in: Sign in with a passkey and no password: verifies the assertion and returns a session; a passkey that verified the person needs no second factor */
+/** Input of auth.passkey.sign_in: Sign in with a passkey and no password: verifies the assertion and returns a session; a passkey that verified the person needs no 2FA */
 export type AuthPasskeySignInInput = {
     /** The credential id, base64url */
     id: string;
@@ -1891,8 +2313,12 @@ export type AuthProviderUpdateResult = {
     [field: string]: unknown;
 };
 
-/** Input of auth.refresh: Refresh a session */
-export type AuthRefreshInput = Record<string, never>;
+/** Input of auth.refresh: Refresh a session: the Bearer token for a new one (the old one stops working). stay true also sets the substrio_session cookie (30 days, renewed by each refresh); with no Bearer, that cookie alone signs its person in again as their sign-in did */
+export type AuthRefreshInput = {
+    /** Stay signed in on this browser: the answer sets the substrio_session cookie (HttpOnly), which auth.refresh with no Bearer trades for a session for 30 days, each refresh renewing it; false when absent */
+    stay?: boolean;
+    [field: string]: unknown;
+};
 /** Result of auth.refresh. */
 export type AuthRefreshResult = {
     success: true;
@@ -2020,7 +2446,7 @@ export type BackupCloneIntoResult = {
     [field: string]: unknown;
 };
 
-/** Input of backup.create: Start a backup of the app's database as a background job: optional body description. Answers 202 {job_id, status:'running'} at once; backup.get with that job id shows the progress and, when it completes, the backup id that backup.restore takes */
+/** Input of backup.create: Start a backup of the app's database as a background job: optional body description. Answers 202 {job_id, backup_id, status:'running'} at once, the backup already listed by backup.list as running; backup.get with the job id shows the progress, and with the backup id the backup that backup.restore takes once it completes */
 export type BackupCreateInput = {
     /** A note kept with the backup */
     description?: string;
@@ -2152,6 +2578,8 @@ export type BillingCartCreateInput = {
     }>;
     /** credit to add, in the minor unit (cents), 500 to 1000000 */
     funds?: number;
+    /** the space add-on blocks the account holds once the cart is paid (a plan with space_addon, Scale); 0 releases them */
+    space_blocks?: number;
     [field: string]: unknown;
 };
 /** Result of billing.cart.create. */
@@ -2184,6 +2612,7 @@ export type BillingCartUpdateInput = {
         [field: string]: unknown;
     }>;
     funds?: number;
+    space_blocks?: number;
     [field: string]: unknown;
 };
 /** Result of billing.cart.update. */
@@ -2241,6 +2670,27 @@ export type BillingCreditGetResult = {
     [field: string]: unknown;
 };
 
+/** Input of billing.person_cart.create: Make a cart of plans that are the person's own, paid by the account: they hold them at every app wherever they sign in, apart from the account's (subscriptions.mine lists them). The plans, the offer and checkout_url as billing.cart.create gives them; the subject is the person whose own session starts the checkout. No space_blocks: the add-on is the account's */
+export type BillingPersonCartCreateInput = {
+    /** the account that pays */
+    id: number;
+    items?: Array<{
+        /** the app whose plan it is: any app with a priced plan (a featured app, a customer's app), or the identity app for a Substrio plan */
+        jet: string;
+        plan: string;
+        [field: string]: unknown;
+    }>;
+    /** credit to add to the account, in the minor unit (cents), 500 to 1000000 */
+    funds?: number;
+    [field: string]: unknown;
+};
+/** Result of billing.person_cart.create. */
+export type BillingPersonCartCreateResult = {
+    data?: unknown;
+    error?: unknown;
+    [field: string]: unknown;
+};
+
 /** Input of billing.revenue: What every account has paid the platform (paid: the identity ledger's maintained balance of the platform party, in USD, with how many payments) and how many accounts' newest invoice is unpaid (past_due). Platform operator only */
 export type BillingRevenueInput = Record<string, never>;
 /** Result of billing.revenue. */
@@ -2326,7 +2776,7 @@ export type ClusterReadyResult = {
     [field: string]: unknown;
 };
 
-/** Input of cluster.version: Read the platform's own versions: the wire range this release speaks, the version chosen for the mesh (the lowest max over the members), the version the mesh has FINALIZED, the storage format, the runtime level this release carries, and every member with its range and whether its link is live */
+/** Input of cluster.version: Read the versions in use: the wire range this release speaks, the version chosen for the mesh (the lowest max over the members), the version the mesh has FINALIZED, the storage format, the runtime level this release carries, and every member with its range and whether its link is live */
 export type ClusterVersionInput = Record<string, never>;
 /** Result of cluster.version. */
 export type ClusterVersionResult = {
@@ -2421,6 +2871,20 @@ export type CollectionStatsResult = {
     [field: string]: unknown;
 };
 
+/** Input of dashboard.get: Read the dashboard an app declares, the file its live version shipped (nav items and their panels, canonical), for the console to draw. The app is one of the account's own or a featured app the account has enabled; any other answers TENANT_NOT_FOUND. An app that declares none answers an empty nav. With version (a number or id), that version's dashboard instead, checked against its own routes as a push's is: what the console will draw once it goes live (an app of the account's own) */
+export type DashboardGetInput = {
+    id: number;
+    slug: string;
+    /** the dashboard of this version instead of the live one, by number or id (64 hex digits), checked against that version's own routes as version.check checks a push's; an app of the caller's own account only */
+    version?: string;
+};
+/** Result of dashboard.get. */
+export type DashboardGetResult = {
+    /** the console's nav items in order, each {id, title, icon, panels, role?, params?}; empty when the app declares no dashboard */
+    nav: Array<Record<string, unknown>>;
+    [field: string]: unknown;
+};
+
 /** Input of data.delete: Delete one record by its _id; 404 when it does not exist, 403 when the key may not delete it */
 export type DataDeleteInput = {
     /** The collection's name, as collection.list names it */
@@ -2655,6 +3119,33 @@ export type DocumentationAgentGuideResult = {
     [field: string]: unknown;
 };
 
+/** Input of documentation.brief: Start here, in at most 3 KB. Answers the app, what this key is, the live version number, the goals an app is built for (website, api, database, auth, events: each with its summary, its skill and the tools it needs), the build loop's tools in order, and how to reach every other tool. Takes no input; substrio_tools {area: <goal>} answers a goal's full definitions, substrio_start every area's tools */
+export type DocumentationBriefInput = Record<string, never>;
+/** Result of documentation.brief. */
+export type DocumentationBriefResult = {
+    /** the app's slug */
+    tenant: string;
+    /** what the calling key is: system (the master key), tenant (this app's administrator key) or user */
+    key_scope: "system" | "tenant" | "user";
+    /** the version number live on this app (a sandbox: on this sandbox); null when none was made live */
+    live_version: number | null;
+    /** what an app is built for; substrio_tools {area: <goal name>} answers a goal's full tool definitions */
+    goals: Array<{
+        name: string;
+        summary: string;
+        /** the skill that teaches it: substrio_skill {name} */
+        skill: string;
+        /** the MCP tools it needs beyond the loop's */
+        tools: string[];
+        [field: string]: unknown;
+    }>;
+    /** the build loop in order, by MCP tool name */
+    next_steps: string[];
+    /** how to reach every other tool and the full guide */
+    more: string;
+    [field: string]: unknown;
+};
+
 /** Input of documentation.capabilities: Describe typed capabilities */
 export type DocumentationCapabilitiesInput = Record<string, never>;
 /** Result of documentation.capabilities. */
@@ -2754,7 +3245,7 @@ export type DocumentationStartInput = Record<string, never>;
 export type DocumentationStartResult = {
     /** the app's slug */
     tenant: string;
-    /** what the calling key is: system (the platform's), tenant (this app's administrator) or user */
+    /** what the calling key is: system (the master key), tenant (this app's administrator key) or user */
     key_scope: "system" | "tenant" | "user";
     /** the version number live on this app (a sandbox: on this sandbox); null when none was made live */
     live_version: number | null;
@@ -2858,7 +3349,7 @@ export type EnvHostRemoveInput = {
 /** Result of env.host.remove. */
 export type EnvHostRemoveResult = void;
 
-/** Input of env.host.set: Bind a host of the app's choosing, <label>.<root> under an enabled root domain (my-app-v2.substrio.com), to one of its environments: live, or a sandbox (with version, a new sandbox running that version). The host answers exactly what that environment runs, with its data. A label has one owner across the platform: HOST_TAKEN when another app holds it, HOST_RESERVED for the platform's names and app hosts, HOST_INVALID (with suggestion) for a label that is not a hostname label, ROOT_DOMAIN_UNKNOWN or ROOT_DOMAIN_DISABLED for the root. Binding a host the app holds again moves it. version.live.set with from: <host> pushes what it runs live */
+/** Input of env.host.set: Bind a host of the app's choosing, <label>.<root> under an enabled root domain (my-app-v2.substrio.com), to one of its environments: live, or a sandbox (with version, a new sandbox running that version). The host answers exactly what that environment runs, with its data. A label has one owner across the platform: HOST_TAKEN when another app holds it, HOST_RESERVED for a reserved name or an app host, HOST_INVALID (with suggestion) for a label that is not a hostname label, ROOT_DOMAIN_UNKNOWN or ROOT_DOMAIN_DISABLED for the root. Binding a host the app holds again moves it. version.live.set with from: <host> pushes what it runs live */
 export type EnvHostSetInput = {
     /** <label>.<root>: one DNS label (lowercase letters, digits, inner hyphens, 1 to 63) under a root domain env.host.list names, such as my-app-v2.substrio.com */
     host: string;
@@ -2881,7 +3372,7 @@ export type EnvHostSetResult = {
     [field: string]: unknown;
 };
 
-/** Input of featured.disable: Disable a featured app for the account: its plan there is removed, every account key scoped to that app alone is revoked (a key scoped to several apps loses this one), so each stops at its next request. The answer counts the keys revoked. The use already counted stays */
+/** Input of featured.disable: Deprecated: every account has every jet, always on, so it is refused FEATURED_ALWAYS_ON. A key stops with account.key.revoke; an app's keys go with the app */
 export type FeaturedDisableInput = {
     id: number;
     /** the featured app's slug (featured.list names it app) */
@@ -2894,7 +3385,7 @@ export type FeaturedDisableResult = {
     [field: string]: unknown;
 };
 
-/** Input of featured.enable: Enable a featured app for the account: the account is put on the app's default plan there (an account already enabled keeps its plan) and may then make keys scoped to it (featured.key.create). Every call to the app is metered against that plan */
+/** Input of featured.enable: Deprecated: every account has every jet, always on. Answers the jet's entry as featured.list writes it and changes nothing */
 export type FeaturedEnableInput = {
     id: number;
     /** the featured app's slug (featured.list names it app) */
@@ -2907,7 +3398,7 @@ export type FeaturedEnableResult = {
     [field: string]: unknown;
 };
 
-/** Input of featured.key.create: Make an account key scoped to one featured app the account has enabled; the secret is returned once. An unscoped account key may make one (it is narrower than the key that makes it); a scoped key may not */
+/** Input of featured.key.create: Deprecated: a jet key belongs to one of the account's apps, so it is refused JET_KEY_NEEDS_APP; jet.key.create makes it */
 export type FeaturedKeyCreateInput = {
     id: number;
     /** the featured app the key is scoped to; the account must have it enabled */
@@ -2927,7 +3418,7 @@ export type FeaturedKeyCreateResult = {
     [field: string]: unknown;
 };
 
-/** Input of featured.list: List the featured apps (the jets: MapJet, SendJet, AuthJet and every later one) with what each does, its admin in the console, whether the account has it enabled, the plan it is metered against and its use this day and month against that plan's limits */
+/** Input of featured.list: List the featured apps (the jets: MapJet, SendJet, AuthJet and every later one) for the account: what each does, the plan it is metered against and the account's use this day and month (every app of the account summed) against that plan's limits. Every account has every jet: there is nothing to enable */
 export type FeaturedListInput = {
     id: number;
 };
@@ -2938,7 +3429,7 @@ export type FeaturedListResult = {
     [field: string]: unknown;
 };
 
-/** Input of featured.set: Feature an app for every account, or stop featuring it (platform admin). It must be open to other accounts' keys and its plans file must have a featured block (title, summary, admin). Accounts that enabled it keep their plan when it stops being featured */
+/** Input of featured.set: Feature an app for every account, or stop featuring it (platform admin). It must be open to other accounts' keys and its plans file must have a featured block (title, summary, admin). An account on a plan there keeps it when it stops being featured */
 export type FeaturedSetInput = {
     jet: string;
     /** true lists the app for every account; it must be open to other accounts' keys and its plans file must have a featured block */
@@ -2952,6 +3443,27 @@ export type FeaturedSetResult = {
     [field: string]: unknown;
 };
 
+/** Input of file.adopt: Platform operator only: store a file that is already on this server's own disk (under the server's --adopt-dir) at a path of the app the request names, with 0 bytes written: hashed in one read, then renamed in. Answers what file.upload answers */
+export type FileAdoptInput = {
+    /** Where to store the file, as file.upload takes it */
+    path: string;
+    /** The file on the server's disk, named relative to the directory the server was started with as --adopt-dir (for example tiles/planet.pmtiles); no symlink, no .. past it. It is renamed into the store: its name is gone afterwards */
+    source: string;
+    /** Its MIME type; the one its path's extension gives when absent */
+    content_type?: string;
+    /** Its Cache-Control response header when served */
+    cache_control?: string;
+    /** true serves it without authentication */
+    public?: boolean;
+    [field: string]: unknown;
+};
+/** Result of file.adopt. */
+export type FileAdoptResult = {
+    data?: unknown;
+    error?: unknown;
+    [field: string]: unknown;
+};
+
 /** Input of file.delete: Delete one stored file by its path (the route's tail, as file.list shows it) */
 export type FileDeleteInput = {
     /** The file's path, as file.list or file.upload returned it */
@@ -2991,6 +3503,34 @@ export type FileListResult = {
     [field: string]: unknown;
 };
 
+/** Input of file.move: Rename a stored file's path from one path to another, its content never copied. Refused with FILE_EXISTS when a file is at to, unless replace is true; FILE_NOT_FOUND when none is at from. Answers the file at its new path, as file.upload answers */
+export type FileMoveInput = {
+    /** The file's path now */
+    from: string;
+    /** Its new path, as file.upload takes one */
+    to: string;
+    /** true replaces a file already at to; false refuses it with FILE_EXISTS */
+    replace?: boolean;
+    [field: string]: unknown;
+};
+/** Result of file.move. */
+export type FileMoveResult = {
+    data?: unknown;
+    error?: unknown;
+    [field: string]: unknown;
+};
+
+/** Input of file.public.get: Read a stored file marked public, with no key, on the app's own hosts; a private or missing path is the same 404 */
+export type FilePublicGetInput = {
+    path: string;
+};
+/** Result of file.public.get. */
+export type FilePublicGetResult = {
+    data?: unknown;
+    error?: unknown;
+    [field: string]: unknown;
+};
+
 /** Input of file.site_root.get: Read the tenant site's index page (the app named by Host or X-Substrio-Tenant) */
 export type FileSiteRootGetInput = Record<string, never>;
 /** Result of file.site_root.get. */
@@ -3011,6 +3551,25 @@ export type FileStaticAssetGetResult = {
     [field: string]: unknown;
 };
 
+/** Input of file.update: Change a stored file's settings (public, content_type, cache_control) by its path, with no byte of it sent again: its bytes and hash are untouched and an absent setting keeps its value. Answers what file.upload answers; FILE_NOT_FOUND when no file is at the path */
+export type FileUpdateInput = {
+    /** The file's path, as file.list or file.upload returned it */
+    path: string;
+    /** true serves it with no key at /_files/<path> on the app's own hosts; false takes that away */
+    public?: boolean;
+    /** Its MIME type; empty or application/octet-stream is the type its path's extension gives */
+    content_type?: string;
+    /** Its Cache-Control response header when served; empty clears it (no-cache is sent) */
+    cache_control?: string;
+    [field: string]: unknown;
+};
+/** Result of file.update. */
+export type FileUpdateResult = {
+    data?: unknown;
+    error?: unknown;
+    [field: string]: unknown;
+};
+
 /** Input of file.upload: Upload a file into the app's file storage at its path; see the schema for the body. Answers its path, which file.download and file.delete take */
 export type FileUploadInput = {
     /** Where to store the file, for example docs/report.pdf; no leading or trailing /, no empty, . or .. segment */
@@ -3051,8 +3610,10 @@ export type FunctionCatalogResult = {
 export type FunctionCheckInput = {
     /** The function's name: letters, digits, - _ and . (required by function.deploy; function.update takes it from the path; function.check names it in its diagnostics) */
     name?: string;
-    /** The whole source: a script, CommonJS or ES module. It must compile to a handler (module.exports = async function (event) {...} or export default { fetch }) */
-    script: string;
+    /** A JavaScript function's whole source (this or rust, one of the two): a script, CommonJS or ES module. It must compile to a handler (module.exports = async function (event) {...} or export default { fetch }) */
+    script?: string;
+    /** A Rust function's whole source (this or script, one of the two): one file using the substrio_wasm crate, ending in substrio_wasm::export!(fetch) (docs/runtime/wasm-functions.md). The server compiles it; nothing is built by the caller. Source that does not compile is refused with rustc's own diagnostics (RUST_COMPILE_FAILED) */
+    rust?: string;
     /** The entry file name (default index.js) */
     main?: string;
     /** HTTP routes the function answers: [METHOD ]/path, METHOD one of GET POST PUT PATCH DELETE ANY, :name for a parameter segment, a last * segment for any remainder */
@@ -3118,12 +3679,14 @@ export type FunctionDeleteResult = {
     [field: string]: unknown;
 };
 
-/** Input of function.deploy: Deploy one function now, outside a version: body name and script (required), optional main, routes (like 'GET /orders/:id' or 'ANY /hooks/*'), vars, bindings and deploy_nodes. The source is compiled to a handler first; a source that does not compile, or that calls require(), is refused and nothing changes. On success it is live at once and the answer is the function's metadata (id, content_hash, routes, env_vars, bindings). To ship several functions together, or to try them first, use version.create, sandbox.create and version.live.set; function.check shows the problems without writing */
+/** Input of function.deploy: Deploy one function now, outside a version: body name and its source (required): script for JavaScript, or rust for a Rust function's source, which the server compiles; optional main, routes (like 'GET /orders/:id' or 'ANY /hooks/*'), vars, bindings and deploy_nodes. The source is compiled to a handler first; a source that does not compile, or that calls require(), is refused and nothing changes. On success it is live at once and the answer is the function's metadata (id, content_hash, routes, env_vars, bindings). To ship several functions together, or to try them first, use version.create, sandbox.create and version.live.set; function.check shows the problems without writing */
 export type FunctionDeployInput = {
     /** The function's name: letters, digits, - _ and . (required by function.deploy; function.update takes it from the path; function.check names it in its diagnostics) */
     name?: string;
-    /** The whole source: a script, CommonJS or ES module. It must compile to a handler (module.exports = async function (event) {...} or export default { fetch }) */
-    script: string;
+    /** A JavaScript function's whole source (this or rust, one of the two): a script, CommonJS or ES module. It must compile to a handler (module.exports = async function (event) {...} or export default { fetch }) */
+    script?: string;
+    /** A Rust function's whole source (this or script, one of the two): one file using the substrio_wasm crate, ending in substrio_wasm::export!(fetch) (docs/runtime/wasm-functions.md). The server compiles it; nothing is built by the caller. Source that does not compile is refused with rustc's own diagnostics (RUST_COMPILE_FAILED) */
+    rust?: string;
     /** The entry file name (default index.js) */
     main?: string;
     /** HTTP routes the function answers: [METHOD ]/path, METHOD one of GET POST PUT PATCH DELETE ANY, :name for a parameter segment, a last * segment for any remainder */
@@ -3244,7 +3807,7 @@ export type FunctionErrorsResult = {
     [field: string]: unknown;
 };
 
-/** Input of function.eval: Run a Lua script against the tenant's default key-value store, Redis style: body script (or sha of a script loaded earlier with load:true, which answers {sha}), keys and args as arrays of strings. Answers {result}. This is Lua over key-value data, not JavaScript: to run JavaScript use function.invoke, route.call or function.execute_inline */
+/** Input of function.eval: Run a Lua script against the tenant's default key-value store, Redis style, in a build with the Redis frontend (not in this release, where the Redis frontend is a build switch, off, and the call answers NOT_IMPLEMENTED). Body script (or sha of a script loaded earlier with load:true, which answers {sha}), keys and args as arrays of strings. Answers {result}. This is Lua over key-value data, not JavaScript: to run JavaScript use function.invoke, route.call or function.execute_inline */
 export type FunctionEvalInput = {
     /** The Lua source to run */
     script?: string;
@@ -3421,7 +3984,7 @@ export type FunctionPatchApprovalRevokeResult = {
     [field: string]: unknown;
 };
 
-/** Input of function.source.edit: Replace one byte range or one exclusive line range of a function's source: body replacement, an approval_token from function.source.preview (required: preview the patch first), the range, and expected_hash (defaults to the current content_hash; a source that changed since is refused with 409). The edited source is compiled before it is stored */
+/** Input of function.source.edit: Replace one byte range or one exclusive line range of a function's source: body replacement, an approval_token from function.source.preview (required: preview the patch first), the range, and expected_hash (defaults to the current content_hash; a source that changed since is refused with 409). The edited source is compiled before it is stored, JavaScript or Rust (a Rust edit that does not compile is RUST_COMPILE_FAILED with rustc's diagnostics, and the function keeps serving its last source) */
 export type FunctionSourceEditInput = {
     /** The function's name, as function.list names it */
     name: string;
@@ -3482,11 +4045,14 @@ export type FunctionSourceReadResult = {
     [field: string]: unknown;
 };
 
-/** Input of function.source.replace: Replace one function's whole source with a compare-and-swap: body script (required, compiled before it is stored), optional expected_hash (the content_hash you last read; it defaults to the current one, and a source that changed since is refused with a conflict), main, routes, vars, bindings and deploy_nodes. Fields left out keep their values; an empty array clears. The function must exist (404). Answers the function's metadata */
+/** Input of function.source.replace: Replace one function's whole source with a compare-and-swap: body script for a JavaScript function or rust for a Rust one (required, compiled before it is stored; a replace keeps the function's language), optional expected_hash (the content_hash you last read; it defaults to the current one, and a source that changed since is refused with a conflict), main, routes, vars, bindings and deploy_nodes. Fields left out keep their values; an empty array clears. The function must exist (404). Answers the function's metadata */
 export type FunctionSourceReplaceInput = {
     /** The function's name, as function.list names it */
     name: string;
-    script: string;
+    /** A JavaScript function's whole new source */
+    script?: string;
+    /** A Rust function's whole new source, compiled by the server */
+    rust?: string;
     expected_hash?: string;
     main?: string;
     routes?: string[];
@@ -3569,12 +4135,14 @@ export type FunctionToggleResult = {
     [field: string]: unknown;
 };
 
-/** Input of function.update: Replace one function's source: PATCH with the body function.deploy takes (script is required); the name comes from the path and a name in the body is ignored. A source that does not compile to a handler is refused with 400 and nothing changes. On success it is live at once and the answer is the function's metadata. For a change to part of the source use function.source.edit */
+/** Input of function.update: Replace one function's source: PATCH with the body function.deploy takes (script or rust is required); the name comes from the path and a name in the body is ignored. A source that does not compile to a handler is refused with 400 and nothing changes. On success it is live at once and the answer is the function's metadata. For a change to part of the source use function.source.edit */
 export type FunctionUpdateInput = {
     /** The function's name: letters, digits, - _ and . (required by function.deploy; function.update takes it from the path; function.check names it in its diagnostics) */
     name: string;
-    /** The whole source: a script, CommonJS or ES module. It must compile to a handler (module.exports = async function (event) {...} or export default { fetch }) */
-    script: string;
+    /** A JavaScript function's whole source (this or rust, one of the two): a script, CommonJS or ES module. It must compile to a handler (module.exports = async function (event) {...} or export default { fetch }) */
+    script?: string;
+    /** A Rust function's whole source (this or script, one of the two): one file using the substrio_wasm crate, ending in substrio_wasm::export!(fetch) (docs/runtime/wasm-functions.md). The server compiles it; nothing is built by the caller. Source that does not compile is refused with rustc's own diagnostics (RUST_COMPILE_FAILED) */
+    rust?: string;
     /** The entry file name (default index.js) */
     main?: string;
     /** HTTP routes the function answers: [METHOD ]/path, METHOD one of GET POST PUT PATCH DELETE ANY, :name for a parameter segment, a last * segment for any remainder */
@@ -3812,6 +4380,12 @@ export type HostAddResult = {
     cores: number;
     capabilities: Array<"own_kernel" | "systemd" | "zram_module" | "zram_active">;
     labels: string[];
+    /** the region the host serves, an id from region.list; 0: none */
+    region?: number;
+    /** the instruction-set features host.probe found, comma separated; empty: never probed */
+    cpu_features?: string;
+    /** the nodes installed on the host */
+    nodes?: number;
     [field: string]: unknown;
 };
 
@@ -3852,6 +4426,12 @@ export type HostBootstrapResult = {
     cores: number;
     capabilities: Array<"own_kernel" | "systemd" | "zram_module" | "zram_active">;
     labels: string[];
+    /** the region the host serves, an id from region.list; 0: none */
+    region?: number;
+    /** the instruction-set features host.probe found, comma separated; empty: never probed */
+    cpu_features?: string;
+    /** the nodes installed on the host */
+    nodes?: number;
     [field: string]: unknown;
 };
 
@@ -3892,6 +4472,12 @@ export type HostGetResult = {
     cores: number;
     capabilities: Array<"own_kernel" | "systemd" | "zram_module" | "zram_active">;
     labels: string[];
+    /** the region the host serves, an id from region.list; 0: none */
+    region?: number;
+    /** the instruction-set features host.probe found, comma separated; empty: never probed */
+    cpu_features?: string;
+    /** the nodes installed on the host */
+    nodes?: number;
     [field: string]: unknown;
 };
 
@@ -3931,11 +4517,68 @@ export type HostListResult = {
         cores: number;
         capabilities: Array<"own_kernel" | "systemd" | "zram_module" | "zram_active">;
         labels: string[];
+        /** the region the host serves, an id from region.list; 0: none */
+        region?: number;
+        /** the instruction-set features host.probe found, comma separated; empty: never probed */
+        cpu_features?: string;
+        /** the nodes installed on the host */
+        nodes?: number;
         [field: string]: unknown;
     }>;
     [field: string]: unknown;
 };
 
+/** Input of host.node.deploy: Install a packed release on a host as a node (a new slot) or onto an existing node (its slot): the release streams over the host's SSH into the release's own installer, which preflights, installs the unit, health checks and rolls back. Refused before anything is copied with HOST_NOT_PROBED, HOST_NO_SYSTEMD, HOST_NGINX_PRESENT, RELEASE_NOT_FOUND, RELEASE_NOT_PACKED, RELEASE_ISA_UNKNOWN, HOST_CPU_MISSING (the detail names the features), HOST_NODE_LIMIT or NODE_BUSY. Answers 202 with the node as it stands; host.node.list then answers running, failed or rolled_back */
+export type HostNodeDeployInput = {
+    id: number;
+    /** A release release.list names that the master holds packed (its .tar.zst and .sha256 beside the folder) */
+    release: string;
+    /** 0 (the default) installs a new node on the lowest free slot; another number deploys a new release onto that node */
+    slot?: number;
+    [field: string]: unknown;
+};
+/** Result of host.node.deploy. */
+export type HostNodeDeployResult = {
+    slot: number;
+    port: number;
+    state: "deploying" | "running" | "failed" | "rolled_back" | "undeploying";
+    /** the release last asked of the node */
+    release: string;
+    deployed_at: number;
+};
+
+/** Input of host.node.list: List the nodes installed on a host in slot order, each with its slot, port, state (deploying, running, failed, rolled_back, undeploying), the release last asked of it and when. A run that stays deploying for 30 minutes reads failed */
+export type HostNodeListInput = {
+    id: number;
+};
+/** Result of host.node.list. */
+export type HostNodeListResult = {
+    nodes: Array<{
+        slot: number;
+        port: number;
+        state: "deploying" | "running" | "failed" | "rolled_back" | "undeploying";
+        /** the release last asked of the node */
+        release: string;
+        deployed_at: number;
+    }>;
+    [field: string]: unknown;
+};
+
+/** Input of host.node.undeploy: Stop and remove a node's service and unit on a host; its data folder stays. Refused with HOST_HAS_APPS for the last node of a host while apps are placed on it and NODE_BUSY while its run is under way. Answers 202 with the node as it stands */
+export type HostNodeUndeployInput = {
+    id: number;
+    slot: number;
+};
+/** Result of host.node.undeploy. */
+export type HostNodeUndeployResult = {
+    slot: number;
+    port: number;
+    state: "deploying" | "running" | "failed" | "rolled_back" | "undeploying";
+    /** the release last asked of the node */
+    release: string;
+    deployed_at: number;
+};
+
 /** Input of host.probe: Probe a host over its orchestrator's SSH, read only: whether it runs its own kernel (bare metal, kvm, another VM) or shares one (openvz, lxc, another container), systemd, the zram module, and zram swap active with zstd. Answers 202 with the host as it stands; the run lands on the host record in one transaction, and host.get answers virt, capabilities, probe (ok, unreachable, failed) and probed_at */
 export type HostProbeInput = {
     id: number;
@@ -3973,6 +4616,12 @@ export type HostProbeResult = {
     cores: number;
     capabilities: Array<"own_kernel" | "systemd" | "zram_module" | "zram_active">;
     labels: string[];
+    /** the region the host serves, an id from region.list; 0: none */
+    region?: number;
+    /** the instruction-set features host.probe found, comma separated; empty: never probed */
+    cpu_features?: string;
+    /** the nodes installed on the host */
+    nodes?: number;
     [field: string]: unknown;
 };
 
@@ -4010,6 +4659,8 @@ export type HostTenantsResult = {
 /** Input of host.update: Change a host: its state (available, draining, offline), address, SSH port and user, location, group settings or labels; a field left out keeps its value. An ssh_key rotates the key: the new one is sealed and the old one gone */
 export type HostUpdateInput = {
     id: number;
+    /** The region the host serves, by id (region.list); 0 serves none. A region still named by a host cannot be removed */
+    region?: number;
     /** The host's DNS name or IP address, as its orchestrator reaches it */
     address?: string;
     /** Default 22 */
@@ -4073,6 +4724,12 @@ export type HostUpdateResult = {
     cores: number;
     capabilities: Array<"own_kernel" | "systemd" | "zram_module" | "zram_active">;
     labels: string[];
+    /** the region the host serves, an id from region.list; 0: none */
+    region?: number;
+    /** the instruction-set features host.probe found, comma separated; empty: never probed */
+    cpu_features?: string;
+    /** the nodes installed on the host */
+    nodes?: number;
     [field: string]: unknown;
 };
 
@@ -4287,6 +4944,43 @@ export type IndexListResult = {
     [field: string]: unknown;
 };
 
+/** Input of jet.key.create: Make a key of one of the account's apps scoped to one jet; the secret is returned once. The jet sees each call as that app (request.auth.app) and meters it to the account's plan, the app's own use counted beside; removing the app revokes the key. With origins the key is publishable (safe in a page's source, answering only those origins). An unscoped account key may make one; a scoped key may not */
+export type JetKeyCreateInput = {
+    id: number;
+    /** the account's app the key belongs to: the jet sees it as request.auth.app, and removing the app revokes the key */
+    slug: string;
+    /** the featured app (jet) the key is scoped to (jet.list and featured.list name each as app) */
+    jet: string;
+    name: string;
+    mode?: "live" | "test";
+    /** makes the key publishable: it answers only a request from one of these origins (https://host[:port]), so it is safe in a page's source */
+    origins?: string[];
+    /** the key's own request limit; 0 or absent: no limit of its own */
+    requests_per_minute?: number;
+    /** the key's own lifetime request budget; 0 or absent: none */
+    request_budget?: number;
+    [field: string]: unknown;
+};
+/** Result of jet.key.create. */
+export type JetKeyCreateResult = {
+    data?: unknown;
+    error?: unknown;
+    [field: string]: unknown;
+};
+
+/** Input of jet.list: List the jets of one of the account's apps: each jet's menu in the app's dashboard (app_nav: its pages, each a list, form or detail over the jet's own routes), the account's plan and use there (every app summed: the limit is the account's) and this app's own use this day and month */
+export type JetListInput = {
+    id: number;
+    /** one of the account's apps: the jets it has, each with its menu, the account's plan and use and this app's own use */
+    slug: string;
+};
+/** Result of jet.list. */
+export type JetListResult = {
+    data?: unknown;
+    error?: unknown;
+    [field: string]: unknown;
+};
+
 /** Input of job.cancel: Cancel one running background job by id: answers the job; 404 when no such job, and refused when it already ended */
 export type JobCancelInput = {
     id: string;
@@ -4941,6 +5635,18 @@ export type McpToolSetInput = {
     outputSchema?: Record<string, unknown>;
     /** MCP tool annotations (readOnlyHint, destructiveHint, ...) */
     annotations?: Record<string, unknown>;
+    /** The tools that come after a success, each a Next line and an entry of _meta substrio/next */
+    next?: Array<{
+        tool: string;
+        why: string;
+        /** A member of this tool's result to hand on */
+        pass?: string;
+        /** The next tool's argument pass fills */
+        as?: string;
+        [field: string]: unknown;
+    }>;
+    /** The tool's place in the app's flow: _meta substrio/stage */
+    stage?: string;
     [field: string]: unknown;
 };
 /** Result of mcp.tool.set. */
@@ -5004,6 +5710,14 @@ export type McpToolsGetResult = {
 /** Input of mcp.tools.set: Replace the app's MCP tool manifest (its own tools and instructions) with the body; see the schema. A version can carry the manifest too (version.create) */
 export type McpToolsSetInput = {
     instructions?: string;
+    /** The text the first result of a person's connection opens with */
+    welcome?: string;
+    /** The app's function run for that welcome instead: its _mcp content and _meta lead the result */
+    welcome_function?: string;
+    /** The app's function whose answer ends every result of a person's call */
+    line_function?: string;
+    /** How long a person's line is kept before line_function runs again (60) */
+    line_ttl_seconds?: number;
     tools: Array<{
         name: string;
         title?: string;
@@ -5013,6 +5727,8 @@ export type McpToolsSetInput = {
         inputSchema?: Record<string, unknown>;
         outputSchema?: Record<string, unknown>;
         annotations?: Record<string, unknown>;
+        next?: Array<Record<string, unknown>>;
+        stage?: string;
         [field: string]: unknown;
     }>;
     [field: string]: unknown;
@@ -5578,6 +6294,17 @@ export type PlansAccountSetResult = {
     [field: string]: unknown;
 };
 
+/** Input of plans.catalog: Read every plan sold, with no account and no person data: the Substrio plans (each with the jet plan it bundles per jet) and every featured app's (jet's) own plans, each with its limits and standalone price, each plans file as plans.get answers it. The sites build their prices from this. No key needed */
+export type PlansCatalogInput = Record<string, never>;
+/** Result of plans.catalog. */
+export type PlansCatalogResult = {
+    /** the identity app's plans file as plans.get answers it: every Substrio plan, each with the jet plan it bundles per jet (apps); null when none is set */
+    substrio: Record<string, unknown> | null;
+    /** each featured app (jet) by slug: its plans file as plans.get answers it, every plan with its limits and standalone price */
+    apps: Record<string, Record<string, unknown>>;
+    [field: string]: unknown;
+};
+
 /** Input of plans.delete: Delete the app's plans file: every plan definition is gone and cannot be restored by this call (keep the plans.get answer to put it back with plans.set). Answers 204 with no body; accounts keep no plan and fall back to the default */
 export type PlansDeleteInput = Record<string, never>;
 /** Result of plans.delete. */
@@ -5619,7 +6346,7 @@ export type PlansSetResult = {
     [field: string]: unknown;
 };
 
-/** Input of platform.audit.list: Read the platform's audit trail (tenant create, update and delete, platform settings, shared providers, key rotations), newest first; the filters, limit and cursor of audit.list */
+/** Input of platform.audit.list: Read the server-wide audit trail (tenant create, update and delete, platform settings, shared providers, key rotations), newest first; the filters, limit and cursor of audit.list */
 export type PlatformAuditListInput = {
     /** asc lists oldest first; desc (the default) newest first */
     order?: "asc" | "desc";
@@ -5653,7 +6380,7 @@ export type PlatformAuditListResult = {
     [field: string]: unknown;
 };
 
-/** Input of platform.counts: Read the platform's account and host counts for the operator, each kept with the accounts and hosts it counts */
+/** Input of platform.counts: Read the account and host counts for the operator, each kept with the accounts and hosts it counts */
 export type PlatformCountsInput = Record<string, never>;
 /** Result of platform.counts. */
 export type PlatformCountsResult = {
@@ -5688,7 +6415,7 @@ export type PlatformSettingsGetResult = {
     [field: string]: unknown;
 };
 
-/** Input of platform.usage.history: Read the platform's KPI history for the operator, oldest first: one point per finished minute (step=minute, the default) or hour (step=hour), each with what every app's API requests (total, status classes 2xx to 5xx, latency buckets and percentiles) and function calls added in it, summed as each app's minute is written. since and until are Unix seconds (default: the last hour of minutes, or the last two days of hours); limit caps the points. Counted on the node that answers; platform calls (no app) are not counted */
+/** Input of platform.usage.history: Read the KPI history of every app on this server for the operator, oldest first: one point per finished minute (step=minute, the default) or hour (step=hour), each with what every app's API requests (total, status classes 2xx to 5xx, latency buckets and percentiles) and function calls added in it, summed as each app's minute is written. since and until are Unix seconds (default: the last hour of minutes, or the last two days of hours); limit caps the points. Counted on the node that answers; platform calls (no app) are not counted */
 export type PlatformUsageHistoryInput = {
     /** the most items to return */
     limit?: number;
@@ -6241,6 +6968,69 @@ export type RefRestoreResult = {
     [field: string]: unknown;
 };
 
+/** Input of region.choices: List the regions an app can be created in: those that are available and serving, each with its slug, public name and country. Empty until a region serves. Pass a slug as region to account.app.create to place the app there */
+export type RegionChoicesInput = {
+    id: number;
+};
+/** Result of region.choices. */
+export type RegionChoicesResult = {
+    regions: Array<{
+        slug: string;
+        name: string;
+        country: string;
+    }>;
+};
+
+/** Input of region.list: List the regions in id order, each with its slug, public name, country, state (available or hidden) and whether it is serving (answers app traffic; the operator cannot set that) */
+export type RegionListInput = Record<string, never>;
+/** Result of region.list. */
+export type RegionListResult = {
+    regions: Array<{
+        id: number;
+        slug: string;
+        name: string;
+        /** two upper case letters, empty when none is named */
+        country: string;
+        state: "available" | "hidden";
+        /** true once the region answers app traffic; the operator cannot set it */
+        serving: boolean;
+        created_at: number;
+    }>;
+    [field: string]: unknown;
+};
+
+/** Input of region.remove: Remove a region by slug; refused with REGION_IN_USE while a host names it. Answers 204 with no body */
+export type RegionRemoveInput = {
+    slug: string;
+};
+/** Result of region.remove. */
+export type RegionRemoveResult = void;
+
+/** Input of region.set: Create the region of this slug (the name is required) or change its name, country or state; a field left out keeps its value. A host joins a region through host.update */
+export type RegionSetInput = {
+    /** The region's name on the wire (eu-central); it is the key and never changes */
+    slug: string;
+    /** The public name; required when the region is new */
+    name?: string;
+    /** ISO 3166-1 alpha-2 code */
+    country?: string;
+    /** hidden: not offered to anyone; a region starts available. Whether it is serving is not settable */
+    state?: "available" | "hidden";
+    [field: string]: unknown;
+};
+/** Result of region.set. */
+export type RegionSetResult = {
+    id: number;
+    slug: string;
+    name: string;
+    /** two upper case letters, empty when none is named */
+    country: string;
+    state: "available" | "hidden";
+    /** true once the region answers app traffic; the operator cannot set it */
+    serving: boolean;
+    created_at: number;
+};
+
 /** Input of release.list: List this host's platform releases, newest first: every folder of <root>/releases holding the server binary (the folder's name is the commit it was built from, with the binary's size and time), which one this process runs, which one the current link names (the next restart's) and which one the previous link names (a rollback's), and restart_pending when current is not the running one. A release is switched on the host by deploy-stax.sh, which health-checks it and rolls back */
 export type ReleaseListInput = Record<string, never>;
 /** Result of release.list. */
@@ -6342,7 +7132,7 @@ export type RoleUpdateResult = {
     [field: string]: unknown;
 };
 
-/** Input of root_domain.add: Add a root domain (onstax.com) the platform's apps answer under as <slug>.<root> and their test hosts as <label>.<root>: stored in the platform's data before it answers, published to the front as *.<root> and, when the platform has a DNS-01 token, its wildcard certificate asked of the platform's ACME. Answers 201 with domain, enabled, source, hosts and added_at; KEY_EXISTS (field domain) when the platform has it, INVALID_ARGUMENT (field domain) when it is not a domain */
+/** Input of root_domain.add: Add a root domain (onstax.com) that apps answer under as <slug>.<root> and their test hosts as <label>.<root>: stored before the call answers, published to the front as *.<root> and, when the platform has a DNS-01 token, its wildcard certificate requested from the configured ACME provider. Answers 201 with domain, enabled, source, hosts and added_at; KEY_EXISTS (field domain) when the platform has it, INVALID_ARGUMENT (field domain) when it is not a domain */
 export type RootDomainAddInput = {
     /** A root domain, two or more lowercase DNS labels joined by dots (onstax.com) */
     domain: string;
@@ -6359,7 +7149,7 @@ export type RootDomainAddResult = {
     [field: string]: unknown;
 };
 
-/** Input of root_domain.list: List the platform's root domains: those of substrio.conf (source config) then the ones added (source admin), each with enabled and its count of test hosts */
+/** Input of root_domain.list: List the root domains: those of substrio.conf (source config) then the ones added (source admin), each with enabled and its count of test hosts */
 export type RootDomainListInput = Record<string, never>;
 /** Result of root_domain.list. */
 export type RootDomainListResult = {
@@ -6580,7 +7370,7 @@ export type SandboxStubListResult = {
     [field: string]: unknown;
 };
 
-/** Input of sandbox.stub.set: Stub one outbound request of a test tenant: its functions' fetch() of the given method, origin and path resolves with the stub's status, headers and body instead of going out. Only a test tenant (made with tenant.create test=true) takes stubs, any other is refused with TEST_TENANT_REQUIRED. The newest matching stub that is not spent answers; a fetch no stub matches is rejected. Answers {id} */
+/** Input of sandbox.stub.set: Stub one outbound request of a test tenant: its functions' fetch() of the given method, origin and path resolves with the stub's status, headers and body instead of going out. Only a test tenant takes stubs, any other is refused with TEST_TENANT_REQUIRED. The newest matching stub that is not spent answers; a fetch no stub matches is rejected. Answers {id} */
 export type SandboxStubSetInput = {
     /** The request method this stub answers; absent: any method */
     method?: "GET" | "POST" | "PUT" | "DELETE" | "PATCH" | "OPTIONS" | "HEAD";
@@ -6918,7 +7708,7 @@ export type SecurityAuditResult = {
     [field: string]: unknown;
 };
 
-/** Input of security.rate_limit: Manage the platform's per-address rate limit (the server's --rate-limit): GET shows it, POST sets max_tokens and tokens_per_second, DELETE with clear turns it off */
+/** Input of security.rate_limit: Manage the per-address rate limit (the --rate-limit server option): GET shows it, POST sets max_tokens and tokens_per_second, DELETE with clear turns it off */
 export type SecurityRateLimitInput = {
     /** the burst each client address may make at once */
     max_tokens?: number;
@@ -6993,7 +7783,7 @@ export type SettingsGetResult = {
     [field: string]: unknown;
 };
 
-/** Input of settings.set: Set one app setting: body key and value (a string, or true or false). Any key is stored; substrio reads changes.history (keep change history so change streams can resume) and webhooks.brand (the webhook signature and delivery id header names, <brand>-Signature and <brand>-Delivery-Id) and the delivery settings webhooks.max_attempts, webhooks.backoff_ms, triggers.max_attempts, triggers.backoff_ms, cron.max_attempts, cron.backoff_ms, delivery.backoff_cap_ms (milliseconds) and delivery.retain_days (days a delivered record stays replayable, 0 keeps none), each a whole number (the attempt counts at least 1), and refuses a value that does not suit them. A server-wide runtime limit (jsc.*, queue.*, objects.*) is a platform setting and is refused here with SETTING_IS_PLATFORM: platform.setting.set sets it */
+/** Input of settings.set: Set one app setting: body key and value (a string, or true or false). Any key is stored; substrio reads changes.history (keep change history so change streams can resume) and webhooks.brand (the webhook signature and delivery id header names, <brand>-Signature and <brand>-Delivery-Id) and the delivery settings webhooks.max_attempts, webhooks.backoff_ms, triggers.max_attempts, triggers.backoff_ms, cron.max_attempts, cron.backoff_ms, delivery.backoff_cap_ms (milliseconds) and delivery.retain_days (days a delivered record stays replayable, 0 keeps none), each a whole number (the attempt counts at least 1), and refuses a value that does not suit them. A server-wide runtime limit (jsc.*, queue.*, objects.*) is a platform setting and is refused here with SETTING_IS_PLATFORM */
 export type SettingsSetInput = {
     /** The setting's name; substrio reads changes.history and webhooks.brand, any other key is only stored */
     key: string;
@@ -7133,6 +7923,27 @@ export type SourceSearchResult = {
     [field: string]: unknown;
 };
 
+/** Input of source.shell: Run one shell command over the app, the way you work on a checkout: no process, a POSIX shell subset interpreted in the server. Mounts: /src is the branch's tree (writable, default main, the starting directory), /site the live release's site/ (read only), /files the app's stored files (writable; rm there is refused, file.delete does it). Any other path is refused. Builtins: grep (-r -n -l -L -c -i -v -w -o -q -E -F -A -B -C -m --include --exclude), sed (-n -E -i -e, addresses N $ /re/ ranges !, s///g with \1 groups, p d q a i c y { }), find (-name -iname -path -type -maxdepth -mindepth -empty -exec {} + -delete), cat, head, tail, wc, sort, uniq, cut, tr, diff (unified), ls, cd, pwd, mv, cp, rm, mkdir, touch, echo, printf, tee, test and [ ], xargs, basename, dirname, true, false, commit -m, and js (a script in the app's own runtime with fs.readFile, writeFile, readdir, stat, exists, rm, rename, mkdir on the same mounts; input is stdin). Variables: $PWD $HOME $SRC $SITE $FILES $BRANCH $?. Every /src change of one call lands as ONE commit (message: the command, or commit -m) when the command ends with status 0; any other status, or any refusal, lands nothing. No state is kept between calls. Answers {stdout, stderr, exit_code, offset, truncated, next_offset, commit: {version, number, changed}}; output past the budget is cut with truncated:true and continued with offset. Examples: grep -rn 'TODO' /src; sed -n 10,40p src/app.js; find /src/functions -name '*.js' | xargs sed -i 's/oldName/newName/g'; cat > /src/site/about.html <<'EOF' (lines) EOF; js 'fs.writeFile("notes.txt", input.toUpperCase())' < notes.txt */
+export type SourceShellInput = {
+    /** One shell command line: pipes, ; && ||, redirections, quotes, globs and heredocs, over the builtins (grep, sed, find, cat, head, tail, wc, sort, uniq, cut, tr, diff, ls, mv, cp, rm, mkdir, touch, echo, printf, tee, test, xargs, js and more) */
+    command: string;
+    /** The branch /src is (default main) */
+    branch?: string;
+    /** The directory the command starts in (default /src) */
+    cwd?: string;
+    /** Continue a truncated output from this byte: the next_offset of the last answer. Refused for a command that writes */
+    offset?: number;
+    /** The commit's message (default: the command itself, or what commit -m set) */
+    message?: string;
+    [field: string]: unknown;
+};
+/** Result of source.shell. */
+export type SourceShellResult = {
+    data?: unknown;
+    error?: unknown;
+    [field: string]: unknown;
+};
+
 /** Input of source.tree: List the paths a version holds (the route's {version}: an id, a number, a branch, live or a sandbox name), ordered by path, each with its kind (file or dir). prefix walks only that directory; glob keeps the files whose path matches (* and ? also match /); sizes:true adds each file's size. Answers {version, entries, count} */
 export type SourceTreeInput = {
     /** The version: its id (64 hex), its number on the branch, a branch name whose head it is, live for the version the app runs, or a sandbox name for the version that sandbox runs */
@@ -7244,6 +8055,121 @@ export type SqlSchemaResult = {
     [field: string]: unknown;
 };
 
+/** Input of subscriptions.cancel: End one of the signed-in person's own subscriptions now: a paid one leaves the account's provider subscription that pays it (that line, or the whole subscription when it was the last) and the person falls back to what else they hold there (a bundle's plan, else the app's default). A bundle child ends only with its Substrio plan (SUBSCRIPTION_NOT_FOUND). The person's own session only, never a key or an agent (SUBSCRIPTION_PERSON_REQUIRED). Answers the subscription, ended */
+export type SubscriptionsCancelInput = {
+    /** The subscription's id, from subscriptions.mine */
+    id: string;
+};
+/** Result of subscriptions.cancel. */
+export type SubscriptionsCancelResult = {
+    /** 0: the plan the app granted */
+    id?: number;
+    subject?: {
+        kind?: "account" | "person" | "app_user";
+        id?: number;
+        app?: string;
+        [field: string]: unknown;
+    };
+    /** the seller: the app whose plans file the plan is in */
+    app?: string;
+    plan?: string;
+    source?: "grant" | "purchase" | "bundle";
+    status?: "active" | "canceling" | "ended";
+    /** a bundle: the Substrio plan's subscription it came with */
+    parent?: number;
+    since?: number;
+    period_end?: number | null;
+    ended_at?: number;
+    [field: string]: unknown;
+};
+
+/** Input of subscriptions.list: List an app's subscribers a page at a time: every subscription to its plans (a purchase, a bundle child of a Substrio plan, or a grant), by subject (an account, a person, or an app's own user) and id. The caller's own app, or (app) another app of the same owning account; any other app's is refused SUBSCRIBERS_NOT_VISIBLE */
+export type SubscriptionsListInput = {
+    /** The seller app's slug: the caller's own app (the default) or another app of the same owning account */
+    app?: string;
+    /** The cursor a page answered */
+    cursor?: string;
+    /** Subscriptions a page (default 100) */
+    limit?: number;
+};
+/** Result of subscriptions.list. */
+export type SubscriptionsListResult = {
+    subscriptions: Array<{
+        /** 0: the plan the app granted */
+        id?: number;
+        subject?: {
+            kind?: "account" | "person" | "app_user";
+            id?: number;
+            app?: string;
+            [field: string]: unknown;
+        };
+        /** the seller: the app whose plans file the plan is in */
+        app?: string;
+        plan?: string;
+        source?: "grant" | "purchase" | "bundle";
+        status?: "active" | "canceling" | "ended";
+        /** a bundle: the Substrio plan's subscription it came with */
+        parent?: number;
+        since?: number;
+        period_end?: number | null;
+        ended_at?: number;
+        [field: string]: unknown;
+    }>;
+    /** subscriptions.mine: the plan in force at each app where one is active (the highest of the stack per counter and period) */
+    entitlements?: Array<{
+        app?: string;
+        plan?: string;
+        default?: boolean;
+        since?: number;
+        limits?: Record<string, unknown>;
+        features?: Record<string, unknown>;
+        [field: string]: unknown;
+    }>;
+    /** the next page's cursor; null at the end */
+    cursor?: string | null;
+    [field: string]: unknown;
+};
+
+/** Input of subscriptions.mine: List the signed-in person's own subscriptions at every app, active and ended: what they bought for themselves (a cart for the person), each Substrio plan's bundle children, and the plans apps granted them. A person's session only (at the console or at any app); a key is refused SUBSCRIPTION_PERSON_REQUIRED */
+export type SubscriptionsMineInput = Record<string, never>;
+/** Result of subscriptions.mine. */
+export type SubscriptionsMineResult = {
+    subscriptions: Array<{
+        /** 0: the plan the app granted */
+        id?: number;
+        subject?: {
+            kind?: "account" | "person" | "app_user";
+            id?: number;
+            app?: string;
+            [field: string]: unknown;
+        };
+        /** the seller: the app whose plans file the plan is in */
+        app?: string;
+        plan?: string;
+        source?: "grant" | "purchase" | "bundle";
+        status?: "active" | "canceling" | "ended";
+        /** a bundle: the Substrio plan's subscription it came with */
+        parent?: number;
+        since?: number;
+        period_end?: number | null;
+        ended_at?: number;
+        [field: string]: unknown;
+    }>;
+    /** subscriptions.mine: the plan in force at each app where one is active (the highest of the stack per counter and period) */
+    entitlements?: Array<{
+        app?: string;
+        plan?: string;
+        default?: boolean;
+        since?: number;
+        limits?: Record<string, unknown>;
+        features?: Record<string, unknown>;
+        [field: string]: unknown;
+    }>;
+    /** the next page's cursor; null at the end */
+    cursor?: string | null;
+    [field: string]: unknown;
+};
+
 /** Input of sync.push: Push replication operations */
 export type SyncPushInput = Record<string, unknown>;
 /** Result of sync.push. */
@@ -7532,6 +8458,8 @@ export type TenantGetResult = {
     /** present only while suspended is true */
     suspend_note?: string;
     readonly: boolean;
+    /** the live version changes only by promote (version.live.set): a function is changed in a version, never deployed straight to live */
+    live_by_promote: boolean;
     hosts: string[];
     _id: number;
     /** the account that owns the app (account.get); 0: the platform */
@@ -7661,7 +8589,7 @@ export type TenantKeyUpdateResult = {
 
 /** Input of tenant.limits: Read a tenant's quota, document and request limits and their live usage */
 export type TenantLimitsInput = {
-    /** The app's slug, as tenant.list names it */
+    /** The app's slug, as account.app.list names it */
     slug?: string;
 };
 /** Result of tenant.limits. */
@@ -7792,6 +8720,8 @@ export type TenantRenameResult = {
     /** present only while suspended is true */
     suspend_note?: string;
     readonly: boolean;
+    /** the live version changes only by promote (version.live.set): a function is changed in a version, never deployed straight to live */
+    live_by_promote: boolean;
     hosts: string[];
     _id: number;
     /** the account that owns the app (account.get); 0: the platform */
@@ -7829,6 +8759,8 @@ export type TenantResumeResult = {
     /** present only while suspended is true */
     suspend_note?: string;
     readonly: boolean;
+    /** the live version changes only by promote (version.live.set): a function is changed in a version, never deployed straight to live */
+    live_by_promote: boolean;
     hosts: string[];
     _id: number;
     /** the account that owns the app (account.get); 0: the platform */
@@ -7854,6 +8786,37 @@ export type TenantResumeResult = {
     [field: string]: unknown;
 };
 
+/** Input of tenant.storage: Read what this app's folder holds on disk (disk_bytes, as of the last fold, each second) by kind (database, files, logs, backups, code, other), its storage limit and the room left (null while no limit is set). The storage limit is held against disk_bytes; tenant.usage's used_bytes and blob_bytes count only document and file bytes */
+export type TenantStorageInput = Record<string, never>;
+/** Result of tenant.storage. */
+export type TenantStorageResult = {
+    tenant_id: number;
+    slug: string;
+    /** what the app's folder holds on disk as of the last fold (each second): the figure the storage limit is held against */
+    disk_bytes: number;
+    /** disk_bytes by kind */
+    kinds: {
+        /** the database file: its used end, page-rounded (it never shrinks; freed room inside it is reused) */
+        database: number;
+        /** the stored files, each the blocks it takes on disk (its length rounded up to the filesystem's block), once whatever uploads it */
+        files: number;
+        /** the function and delivery logs (logs.db) and the sync log (oplog.db), each its used end */
+        logs: number;
+        /** the backups and a restore's set-aside copy */
+        backups: number;
+        /** functions, their bytecode cache, the site releases and tools */
+        code: number;
+        /** every other file: the app's config, keys and the rest */
+        other: number;
+        [field: string]: unknown;
+    };
+    /** the app's storage limit; null while none is set */
+    limit_bytes: number | null;
+    /** limit_bytes less disk_bytes, at least 0; null while no limit is set */
+    available_bytes: number | null;
+    [field: string]: unknown;
+};
+
 /** Input of tenant.suspend: Suspend a tenant with a typed reason and an optional note */
 export type TenantSuspendInput = {
     slug: string;
@@ -7871,6 +8834,8 @@ export type TenantSuspendResult = {
     /** present only while suspended is true */
     suspend_note?: string;
     readonly: boolean;
+    /** the live version changes only by promote (version.live.set): a function is changed in a version, never deployed straight to live */
+    live_by_promote: boolean;
     hosts: string[];
     _id: number;
     /** the account that owns the app (account.get); 0: the platform */
@@ -7940,6 +8905,8 @@ export type TenantUpdateResult = {
     /** present only while suspended is true */
     suspend_note?: string;
     readonly: boolean;
+    /** the live version changes only by promote (version.live.set): a function is changed in a version, never deployed straight to live */
+    live_by_promote: boolean;
     hosts: string[];
     _id: number;
     /** the account that owns the app (account.get); 0: the platform */
@@ -7976,10 +8943,11 @@ export type TenantUsageResult = {
     storage: {
         /** the bytes of the stored documents, exact */
         used_bytes: number;
-        /** the bytes of the stored files (a file counts once, whatever uploads it); the storage limit covers them and the documents together. Key-value bytes are not metered */
+        /** the bytes of the stored files, each its length (a file counts once, whatever uploads it). The storage limit is held against everything the app's folder holds on disk: tenant.storage */
         blob_bytes: number;
         /** null while no limit is set */
         limit_bytes: number | null;
+        /** the room the storage limit leaves: limit_bytes less tenant.storage's disk_bytes, at least 0; null while no limit is set */
         available_bytes: number | null;
         [field: string]: unknown;
     };
@@ -8116,6 +9084,13 @@ export type TenantUsageResult = {
     active: boolean;
     /** tools/call runs of each of the app's own MCP tools on its /mcp, by tool name, kept in the app's database (APP-MCP) */
     mcp_tools?: Record<string, number>;
+    /** the app's function calls, API requests and their 5xx this month (UTC, the plan's metering month): durable totals kept in the app's record, reset when the month turns */
+    this_month: {
+        calls: number;
+        requests: number;
+        requests_5xx: number;
+        [field: string]: unknown;
+    };
     [field: string]: unknown;
 };
 
@@ -8145,16 +9120,16 @@ export type TenantUsageHistoryResult = {
         documents?: number;
         stored_bytes?: number;
         blob_bytes?: number;
-        /** what the app's function calls added in it: the counters of tenant.usage calls (invocations, direct_calls, cpu_us, wall_us, wall_ns, refused, ended, status, latency, p50_under_ms, p95_under_ms, p99_under_ms) */
+        /** what the app's function calls added in it: the counters of tenant.usage.self calls (invocations, direct_calls, cpu_us, wall_us, wall_ns, refused, ended, status, latency, p50_under_ms, p95_under_ms, p99_under_ms) */
         calls?: Record<string, unknown>;
-        /** what the app's API requests over HTTP added in it: total, status, latency, p50_under_ms, p95_under_ms, p99_under_ms, as tenant.usage requests */
+        /** what the app's API requests over HTTP added in it: total, status, latency, p50_under_ms, p95_under_ms, p99_under_ms, as tenant.usage.self requests */
         requests?: Record<string, unknown>;
         [field: string]: unknown;
     }>;
     [field: string]: unknown;
 };
 
-/** Input of tenant.usage.self: Read this tenant's own exact usage and limits: storage bytes, documents, requests per minute (a limit is null until one is set) and the function limits (cpu, memory, concurrency, timeout, body and value sizes); the same body as tenant.usage, for the tenant the key belongs to */
+/** Input of tenant.usage.self: Read this tenant's own exact usage and limits: storage bytes, documents, requests per minute (a limit is null until one is set) and the function limits (cpu, memory, concurrency, timeout, body and value sizes), for the tenant the key belongs to */
 export type TenantUsageSelfInput = Record<string, never>;
 /** Result of tenant.usage.self. */
 export type TenantUsageSelfResult = {
@@ -8163,10 +9138,11 @@ export type TenantUsageSelfResult = {
     storage: {
         /** the bytes of the stored documents, exact */
         used_bytes: number;
-        /** the bytes of the stored files (a file counts once, whatever uploads it); the storage limit covers them and the documents together. Key-value bytes are not metered */
+        /** the bytes of the stored files, each its length (a file counts once, whatever uploads it). The storage limit is held against everything the app's folder holds on disk: tenant.storage */
         blob_bytes: number;
         /** null while no limit is set */
         limit_bytes: number | null;
+        /** the room the storage limit leaves: limit_bytes less tenant.storage's disk_bytes, at least 0; null while no limit is set */
         available_bytes: number | null;
         [field: string]: unknown;
     };
@@ -8303,6 +9279,13 @@ export type TenantUsageSelfResult = {
     active: boolean;
     /** tools/call runs of each of the app's own MCP tools on its /mcp, by tool name, kept in the app's database (APP-MCP) */
     mcp_tools?: Record<string, number>;
+    /** the app's function calls, API requests and their 5xx this month (UTC, the plan's metering month): durable totals kept in the app's record, reset when the month turns */
+    this_month: {
+        calls: number;
+        requests: number;
+        requests_5xx: number;
+        [field: string]: unknown;
+    };
     [field: string]: unknown;
 };
 
@@ -8728,7 +9711,7 @@ export type UserCreateInput = {
     metadata?: Record<string, unknown>;
     /** The person's display name, a member of the person object (collection _users) */
     name?: string;
-    /** The person's own fields, written as members of the person object (_users, keyed by the user id) in the same insert: the platform's (given_name, family_name, phone, picture, locale, timezone, birthday, consent, tags) and the ones the app declares in the _users schema. email, created_at, email_verified and a name starting with an underscore are reserved (400). A member the schema does not declare answers 400 SCHEMA_REFUSED with each violation and nothing is created */
+    /** The person's own fields, written as members of the person object (_users, keyed by the user id) in the same insert: the standard ones (given_name, family_name, phone, picture, locale, timezone, birthday, consent, tags) and the ones the app declares in the _users schema. email, created_at, email_verified and a name starting with an underscore are reserved (400). A member the schema does not declare answers 400 SCHEMA_REFUSED with each violation and nothing is created */
     fields?: Record<string, unknown>;
     [field: string]: unknown;
 };
@@ -8930,10 +9913,10 @@ export type VersionChangesResult = {
     [field: string]: unknown;
 };
 
-/** Input of version.check: Check an app version before it is pushed or made live: the body is the version.create body. Runs function.check over every function whose source is uploaded (parsed as script, CommonJS or ES module, with deploy's require() refusal) and answers ok, diagnostics (function, severity, message, line, column) and the blobs still missing. Nothing is stored or run. version.create and version.live.set run this same check unless they are sent check:false */
+/** Input of version.check: Check an app version before it is pushed or made live: the body is the version.create body, or {version} naming one already committed (a number, an id, a branch, live or a sandbox's name; no manifest). Runs function.check over every function whose source is uploaded (parsed as script, CommonJS or ES module, with deploy's require() refusal) and answers ok, diagnostics (function, severity, message, line, column) and the blobs still missing. Nothing is stored or run. version.create and version.live.set run this same check unless they are sent check:false */
 export type VersionCheckInput = {
     /** Every function of the app. A function not listed here is not part of the version */
-    functions: Array<{
+    functions?: Array<{
         /** Letters, digits, - _ and . only; also the file named in check diagnostics */
         name: string;
         /** SHA-256 of the body, lowercase hex */
@@ -9031,6 +10014,8 @@ export type VersionCheckInput = {
         body: Record<string, unknown>;
         [field: string]: unknown;
     }> | null;
+    /** Instead of a manifest: the committed version to check, a number from version.list, an id (64 hex digits), a branch, live or a sandbox's name. The answer then names its number in version */
+    version?: number | string;
     /** Ignored; kept so a version.create body can be sent as it is */
     message?: string;
     [field: string]: unknown;
@@ -9052,6 +10037,8 @@ export type VersionCheckResult = {
     }>;
     /** hashes of blobs (any part of the version) not uploaded yet */
     missing: string[];
+    /** the number of the committed version checked, when the call named one */
+    version?: number;
     [field: string]: unknown;
 };
 
@@ -9552,7 +10539,7 @@ export interface SubstrioOperations {
         app: {
             /** Make an existing app one of an account's apps (platform admin) (account.app.attach; PUT /v1/_tenants/{slug}/account) */
             attach(input: AccountAppAttachInput, options?: SubstrioCallOptions<'PUT'>): Promise<AccountAppAttachResult>;
-            /** Create an app owned by the account (account.app.create; POST /v1/_accounts/{id}/apps) */
+            /** Create an app owned by the account. A region (a slug region.choices lists) places it there; one that is not listed is refused with REGION_UNAVAILABLE (account.app.create; POST /v1/_accounts/{id}/apps) */
             create(input: AccountAppCreateInput, options?: SubstrioCallOptions<'POST'>): Promise<AccountAppCreateResult>;
             /** Delete one of the account's apps and its data (account.app.delete; DELETE /v1/_accounts/{id}/apps/{slug}) */
             delete(input: AccountAppDeleteInput, options?: SubstrioCallOptions<'DELETE'>): Promise<AccountAppDeleteResult>;
@@ -9565,10 +10552,18 @@ export interface SubstrioOperations {
                 set(input: AccountAppOpenSetInput, options?: SubstrioCallOptions<'PUT'>): Promise<AccountAppOpenSetResult>;
             };
         };
+        apps: {
+            /** Set the order the account's apps run in: apps lists every app id of the account once (any other list is refused, INVALID_ARGUMENT naming apps). The first max_apps run; the rest are paused, keeping every byte, and their requests answer APP_OVER_PLAN until they move up, an app is deleted or the plan allows more. Answers each app in order with active, and max_apps (0: no limit) (account.apps.order; PUT /v1/_accounts/{id}/apps/order) */
+            order(input: AccountAppsOrderInput, options?: SubstrioCallOptions<'PUT'>): Promise<AccountAppsOrderResult>;
+        };
         audit: {
             /** Read an account's audit trail (its keys, members, invites, apps and clients), newest first; the filters, limit and cursor of audit.list (account.audit.list; GET /v1/_accounts/{id}/audit) */
             list(input: AccountAuditListInput, options?: SubstrioCallOptions<'GET'>): Promise<AccountAuditListResult>;
         };
+        console: {
+            /** Mint the person you act for a one-time console sign-in, then open its url in their browser: it lands them signed in on their dashboard. Only a person mints one (an agent session for its own person, or the person signed in to the console); a key, the master key or an agent token is refused CONSOLE_LINK_NEEDS_PERSON. The link lives 5 minutes (the server's --console-link-seconds), signs in once, and a new one replaces the last; its token rides in the url's fragment, so no server receives or logs it. Answers {url, expires_at} (account.console.link; POST /v1/_accounts/console/link) */
+            link(input?: AccountConsoleLinkInput, options?: SubstrioCallOptions<'POST'>): Promise<AccountConsoleLinkResult>;
+        };
         /** Create an account owned by the signed-in person (account.create; POST /v1/_accounts) */
         create(input: AccountCreateInput, options?: SubstrioCallOptions<'POST'>): Promise<AccountCreateResult>;
         /** Delete an account that owns no apps, with its members and keys (account.delete; DELETE /v1/_accounts/{id}) */
@@ -9610,7 +10605,7 @@ export interface SubstrioOperations {
             set(input: AccountMemberSetInput, options?: SubstrioCallOptions<'PUT'>): Promise<AccountMemberSetResult>;
         };
         mfa: {
-            /** Require every member of an account to sign in with a second factor, or stop requiring it (account.mfa.set; PUT /v1/_accounts/{id}/mfa) */
+            /** Require every member of an account to sign in with 2FA, or stop requiring it (account.mfa.set; PUT /v1/_accounts/{id}/mfa) */
             set(input: AccountMfaSetInput, options?: SubstrioCallOptions<'PUT'>): Promise<AccountMfaSetResult>;
         };
         /** Read every app of the account with slug, tenant_id, suspended, live version and calls (invocations, status classes, p95_under_ms, from memory); stored_bytes and documents are present only when open is true (the app's database was already open: never opened here to total it), then the account's totals (apps, suspended, open, calls, stored_bytes, documents) across every app (account.overview; GET /v1/_accounts/{id}/overview) */
@@ -9623,10 +10618,16 @@ export interface SubstrioOperations {
             /** Read what the account's plan allows beside what it uses, and every plan with what it adds and its price. An agent explains the plans and the upgrade from this alone (account.plan.summary; GET /v1/_accounts/{id}/plan) */
             summary(input: AccountPlanSummaryInput, options?: SubstrioCallOptions<'GET'>): Promise<AccountPlanSummaryResult>;
         };
+        /** Read what each app of the account holds on disk (disk_bytes: its database, files, logs, backups, code and the rest, as of its last fold, open or not), the account's total (its apps and their sandboxes, the figure its space is held against) and the space in force (null while none). Supersedes account.overview's stored_bytes, which counts only open apps' document bytes (account.storage; GET /v1/_accounts/{id}/storage) */
+        storage(input: AccountStorageInput, options?: SubstrioCallOptions<'GET'>): Promise<AccountStorageResult>;
         /** Rename an account; the system key also sets its services, space and max_apps, and suspends it (account.update; PATCH /v1/_accounts/{id}) */
         update(input: AccountUpdateInput, options?: SubstrioCallOptions<'PATCH'>): Promise<AccountUpdateResult>;
-        /** Read the account's plan and usage counters at each app it has a plan or usage at (account.usage; GET /v1/_accounts/{id}/usage) */
-        usage(input: AccountUsageInput, options?: SubstrioCallOptions<'GET'>): Promise<AccountUsageResult>;
+        usage: {
+            /** Read the account's plan and usage counters at each app it has a plan or usage at (account.usage) */
+            (input: AccountUsageInput, options?: SubstrioCallOptions<'GET'>): Promise<AccountUsageResult>;
+            /** Read the CPU the account's apps used in each of the last 60 finished minutes, the hour's mean, the last 15 minutes' mean, the peak minute, the plan's CPU slices and the hour against them (used, of_share), the requests and calls held back while the server was saturated (holds) and each app's minutes and holds, each in CPU slices (1 is the Free plan's CPU under load; Standard holds 4). Explains how close the account runs to its plan's share and who waited for it (account.usage.cpu; GET /v1/_accounts/{id}/usage/cpu) */
+            cpu(input: AccountUsageCpuInput, options?: SubstrioCallOptions<'GET'>): Promise<AccountUsageCpuResult>;
+        };
     };
     agent: {
         alert: {
@@ -9644,13 +10645,13 @@ export interface SubstrioOperations {
         enroll: {
             /** Make a one-time code that an AI agent exchanges for a session acting as you in the account; the code is returned once (agent.enroll.create; POST /v1/_accounts/{id}/agent/enrollments) */
             create(input: AgentEnrollCreateInput, options?: SubstrioCallOptions<'POST'>): Promise<AgentEnrollCreateResult>;
-            /** Exchange a one-time enrollment code for an agent session: a key-bound one when a public key is sent, else a ratcheted one. The code is spent (agent.enroll.exchange; POST /v1/_agent/exchange) */
+            /** Exchange a one-time enrollment code (substrio_ae_...) for an agent session acting as the member who made it: a bearer one unless a kind is named or a public key is sent (key-bound). Answers the credential once and next, what to do with it; the code is spent. Over MCP it is the tool substrio_connect on any /mcp, with no credential (agent.enroll.exchange; POST /v1/_agent/exchange) */
             exchange(input: AgentEnrollExchangeInput, options?: SubstrioCallOptions<'POST'>): Promise<AgentEnrollExchangeResult>;
         };
         session: {
             /** An agent session makes a narrower child session for a sub-agent: the child's capabilities and apps are within the caller's, it ends no later than the caller, and it dies with the caller. Returns the child's credentials once (agent.session.delegate; POST /v1/_accounts/{id}/agent/delegations) */
             delegate(input: AgentSessionDelegateInput, options?: SubstrioCallOptions<'POST'>): Promise<AgentSessionDelegateResult>;
-            /** List the account's agent sessions, oldest first, a page at a time (limit, cursor; next_cursor), or only those reaching one app (app); never a key (agent.session.list; GET /v1/_accounts/{id}/agent/sessions) */
+            /** List the account's live agent sessions (an ended one leaves the list; its log is still read by id), oldest first, a page at a time (limit, cursor; next_cursor), or only those reaching one app (app); never a key (agent.session.list; GET /v1/_accounts/{id}/agent/sessions) */
             list(input: AgentSessionListInput, options?: SubstrioCallOptions<'GET'>): Promise<AgentSessionListResult>;
             /** List the requests an agent session made, oldest first, each with its operation, outcome (ran, refused, approval asked, approved, denied, spent), status, app and time; pages by limit and cursor (a member sees their own agents, an admin or owner the account's). Kept for agent_log_retention_seconds (agent.session.log; GET /v1/_accounts/{id}/agent/sessions/{session_id}/log) */
             log(input: AgentSessionLogInput, options?: SubstrioCallOptions<'GET'>): Promise<AgentSessionLogResult>;
@@ -9707,22 +10708,36 @@ export interface SubstrioOperations {
         tools(input?: AiToolsInput, options?: SubstrioCallOptions<'GET'>): Promise<AiToolsResult>;
     };
     app: {
+        /** Download the app as one .substrio.zip, its backup and its portable export: every collection as NDJSON (data/<collection>.ndjson), its users (users.ndjson), versions, config and site files, and manifest.json with each entry's SHA-256. Optional body passphrase seals secret values, password hashes, TOTP enrolments and passkeys into sealed.bin; without it they are left out. Optional backup_id archives that backup instead. app.restore or app.import reads it back on any server version (app.archive; POST /v1/_archive/download) */
+        archive(input?: AppArchiveInput, options?: SubstrioCallOptions<'POST'>): Promise<AppArchiveResult>;
+        /** Ship files in one call: commit the units and removals (as version.commit takes them), check the version's functions (unless check is false), make it live where to names (live, or a sandbox), test it there with app.test (unless test is false), and, with promote and a sandbox in to, make it live on the app once the test is green. Stops at the first step that fails: a refused commit, check or live answers that step's own error with stage; a failed test answers ok false, stage test and the test's failures with their fixes, and promotes nothing. Answers ok, stage, deployed {commit, live}, test and promote, each the answer of that step's own tool. Over HTTP it runs the commit, the check and live; test and promote run in the MCP tool (app.deploy; POST /v1/_app/deploy) */
+        deploy(input: AppDeployInput, options?: SubstrioCallOptions<'POST'>): Promise<AppDeployResult>;
+        /** What is wrong with the app (or a sandbox) and how to fix it, in one call: which version each environment runs against main's head, function.check over the version that runs where the call looks (its diagnostics), its newest function errors, and app.test of its website and GET routes, each finding with its fix. Answers ok, sandbox, live {main, environments}, check, errors {recent, fix}, test and fixes, every fix in order. Read only; the MCP server runs it (app.diagnose; POST /v1/_app/diagnose) */
+        diagnose(input?: AppDiagnoseInput, options?: SubstrioCallOptions<'POST'>): Promise<AppDiagnoseResult>;
         /** Stream the app as one bundle (versions, blobs, live stack, views, AI config, database, secrets), sealed whole to seal_to, for that server's POST /v1/_import (app.export; GET /v1/_export) */
         export(input?: AppExportInput, options?: SubstrioCallOptions<'GET'>): Promise<AppExportResult>;
+        /** Read this app's own record: slug, hosts, domains, suspended, readonly, live_by_promote, account_id, created_at and its limits. The app is the one the request names (X-Substrio-Tenant or its host) (app.get; GET /v1/_app) */
+        get(input?: AppGetInput, options?: SubstrioCallOptions<'GET'>): Promise<AppGetResult>;
         /** Make an app from a bundle GET /v1/_export streamed (the request body): its data, versions, live version, secrets sealed to this server, views and sandboxes (app.import; POST /v1/_import) */
         import(input?: AppImportInput, options?: SubstrioCallOptions<'POST'>): Promise<AppImportResult>;
         /** Read the mesh as this app sees it: enabled, node_id (hex), origin_seq (this node's own last origin sequence), max_applied_hlc (the highest HLC applied), entries (applied, streamed, deduped, pending), peer_count and peers (peer_id, node_id, address, connected, last_sent_seq, latency_us, state, acked_seq and behind, from gossip, null until the peer has gossiped since this process started). An app with no sync answers {"enabled": false} (app.mesh; GET /v1/_mesh/app) */
         mesh(input?: AppMeshInput, options?: SubstrioCallOptions<'GET'>): Promise<AppMeshResult>;
-        /** Read everything a dashboard's first paint needs for this app in one call: app (slug, tenant_id, created_at, hosts, domains, suspended, live_by_promote, is_sandbox), usage (the same body as tenant.usage), storage (database_bytes on disk and backups: count, bytes, latest_at), versions (live, rollback_to, count, sandboxes), functions (count, names), collections (count), cron (count), queues (count), alerts (log alerts fired in their last window), audit (the last 5 entries, newest first) and mesh (this app's mesh position, in short) (app.overview; GET /v1/_overview) */
+        /** Read everything a dashboard's first paint needs for this app in one call: app (slug, tenant_id, created_at, hosts, domains, suspended, live_by_promote, is_sandbox), usage (the same body as tenant.usage.self), storage (database_bytes on disk and backups: count, bytes, latest_at), versions (live, rollback_to, count, sandboxes), functions (count, names), collections (count), cron (count), queues (count), alerts (log alerts fired in their last window), audit (the last 5 entries, newest first) and mesh (this app's mesh position, in short) (app.overview; GET /v1/_overview) */
         overview(input?: AppOverviewInput, options?: SubstrioCallOptions<'GET'>): Promise<AppOverviewResult>;
+        /** Restore a .substrio.zip (the request body, as app.archive made it) into this app through the normal write paths: users, data, versions, site files, config, and with the X-Substrio-Passphrase header the sealed secrets and sign-ins. Every entry is checked against manifest.json before anything is written. An app that holds data is refused unless replace=true. Answers the counts restored and what was left out (app.restore; POST /v1/_archive) */
+        restore(input?: AppRestoreInput, options?: SubstrioCallOptions<'POST'>): Promise<AppRestoreResult>;
         runtime_level: {
             /** Set one app's runtime compatibility level: which behaviour of the function runtime it gets. Never above the level this release carries (a higher level refuses the call), and the app's isolates pick the new level up as they are made (app.runtime_level.set; PATCH /v1/_tenants/{slug}/runtime_level) */
             set(input: AppRuntimeLevelSetInput, options?: SubstrioCallOptions<'PATCH'>): Promise<AppRuntimeLevelSetResult>;
         };
+        /** Start an app from a template compiled into the release: commits the app's first version on main, one snapshot of the template's units, each of which passes app.test. site is a page with its stylesheet and script; site-api adds a function route (GET /api/hello) the page calls; site-data-auth is a notes page anyone reads and a signed-in person adds to (GET /api/notes, POST /api/notes auth, GET /api/me auth). Refused with 409 when main already holds a version: change an app that has one with version.commit or app.deploy. Answers version.commit's answer and template; make it live with live.set (with sandbox to try it first) (app.scaffold; POST /v1/_app/scaffold) */
+        scaffold(input: AppScaffoldInput, options?: SubstrioCallOptions<'POST'>): Promise<AppScaffoldResult>;
         seal_key: {
             /** Read the X25519 public key bundles this server imports are sealed to (seal_to of an export) (app.seal_key.get; GET /v1/_seal-key) */
             get(input?: AppSealKeyGetInput, options?: SubstrioCallOptions<'GET'>): Promise<AppSealKeyGetResult>;
         };
+        /** Test the app's website (or a sandbox's) as a browser loads it, in one call: each page of paths (default /) and every same-site page it links, every stylesheet, script, image, icon and CSS url() or @import they name, and every GET function route with no parameter, each fetched in process as route.call does, as a visitor with no credentials. Each is checked for its status, its content type (a stylesheet must be text/css, a script JavaScript, an image image/*, never the site's page in their place) and its size. Answers ok, the table of every resource (path, kind, from, status, type, bytes, ok) and each failure with its problem and its fix. References to another origin are counted, never fetched (app.test; POST /v1/_app/test) */
+        test(input?: AppTestInput, options?: SubstrioCallOptions<'POST'>): Promise<AppTestResult>;
     };
     apps: {
         calls: {
@@ -9763,8 +10778,14 @@ export interface SubstrioOperations {
                 set(input: AuthClientRedirectUrisSetInput, options?: SubstrioCallOptions<'PUT'>): Promise<AuthClientRedirectUrisSetResult>;
             };
         };
+        devices: {
+            /** Count the signed-in person's remembered devices: each signs in with the authenticator code and no email until it ends (30 days, or every session of the person ending) (auth.devices) */
+            (input?: AuthDevicesInput, options?: SubstrioCallOptions<'GET'>): Promise<AuthDevicesResult>;
+            /** Forget every remembered device of the signed-in person: each signs in by the email code again. No session ends (auth.devices.forget; POST /v1/_auth/devices/forget) */
+            forget(input?: AuthDevicesForgetInput, options?: SubstrioCallOptions<'POST'>): Promise<AuthDevicesForgetResult>;
+        };
         email: {
-            /** Mail a short code and a link that prove an address; nobody need be signed in. One live pair an address, a new request replaces it, paced by the app's request interval. Answers {accepted, expires_at} whether or not anyone holds the address (auth.email.code_request; POST /v1/_auth/email/code_request) */
+            /** Mail a short code and a link that prove an address; nobody need be signed in. One pair an address: asked again while it lives, the same code and link are mailed again (every mail sent works) and its life starts over; a spent, expired or locked pair gives way to a new one. Paced by the app's request interval. Answers {accepted, expires_at} whether or not anyone holds the address. On a device remembered for the person the address names (the substrio_device cookie auth.mfa set), their 2FA on, no mail is sent: {accepted, expires_at, mfa_required, challenge}, finished by auth.mfa with the authenticator code (auth.email.code_request; POST /v1/_auth/email/code_request) */
             code_request(input: AuthEmailCodeRequestInput, options?: SubstrioCallOptions<'POST'>): Promise<AuthEmailCodeRequestResult>;
             /** Prove an address with its mailed code (email and code) or its link (token): the person holding it, made when nobody does, is verified. Answers {verified, email, user_id, created, password_grant?}; a code or link that proves nothing is 400 with its reason (MISSING, USED, EXPIRED, TOO_MANY_ATTEMPTS, WRONG and attempts_remaining) (auth.email.code_verify; POST /v1/_auth/email/code_verify) */
             code_verify(input?: AuthEmailCodeVerifyInput, options?: SubstrioCallOptions<'POST'>): Promise<AuthEmailCodeVerifyResult>;
@@ -9777,13 +10798,17 @@ export interface SubstrioOperations {
         github(input?: AuthGithubInput, options?: SubstrioCallOptions<'POST'>): Promise<AuthGithubResult>;
         /** Authenticate with Google OAuth (auth.google; POST /v1/_auth/google) */
         google(input: AuthGoogleInput, options?: SubstrioCallOptions<'POST'>): Promise<AuthGoogleResult>;
+        link: {
+            /** For the console: spend a one-time console link (token, from the url's #link fragment) and sign its person in at the identity app, marked: an irreversible call waits for an approval and it decides none (CONSOLE_LINK_STEP_UP) until the person signs in again by the email code or 2FA. Answers {user_id, account_id, token, keyring} as auth.email.code_verify signs in, or the 2FA step due under mfa; a link that signs nobody in is refused CONSOLE_LINK_UNKNOWN (made up, or replaced by a newer link), CONSOLE_LINK_USED or CONSOLE_LINK_EXPIRED (auth.link.redeem; POST /v1/_auth/link/redeem) */
+            redeem(input: AuthLinkRedeemInput, options?: SubstrioCallOptions<'POST'>): Promise<AuthLinkRedeemResult>;
+        };
         login: {
             /** Authenticate a user (auth.login) */
             (input: AuthLoginInput, options?: SubstrioCallOptions<'POST'>): Promise<AuthLoginResult>;
             /** Join the shared login ([login]): make the app a client of the identity app with a callback on each of its hosts (auth.login.set; PUT /v1/_auth/login) */
             set(input?: AuthLoginSetInput, options?: SubstrioCallOptions<'PUT'>): Promise<AuthLoginSetResult>;
         };
-        /** End this session; its token stops working at once (auth.logout; POST /v1/_auth/logout) */
+        /** End this session; its token stops working at once, and this browser's substrio_session cookie ends and is cleared (a remembered device stays) (auth.logout; POST /v1/_auth/logout) */
         logout(input?: AuthLogoutInput, options?: SubstrioCallOptions<'POST'>): Promise<AuthLogoutResult>;
         /** End every session of the signed-in user, this one included (auth.logout_all; POST /v1/_auth/logout_all) */
         logout_all(input?: AuthLogoutAllInput, options?: SubstrioCallOptions<'POST'>): Promise<AuthLogoutAllResult>;
@@ -9792,9 +10817,11 @@ export interface SubstrioOperations {
             (input?: AuthMeInput, options?: SubstrioCallOptions<'GET'>): Promise<AuthMeResult>;
             /** Erase the signed-in user and their auth records; dry_run checks only (auth.me.delete; DELETE /v1/_auth/me) */
             delete(input?: AuthMeDeleteInput, options?: SubstrioCallOptions<'DELETE'>): Promise<AuthMeDeleteResult>;
+            /** Edit the signed-in person's own profile: name always, and each member of fields only when the app's _users schema marks that field "self": true (a member not marked refuses the whole edit with 403 SELF_FIELD_REFUSED naming it; a value the schema refuses is 400 SCHEMA_REFUSED; a key is refused 403, a key is not a user). Email and password change through their own verified flows. Answers the profile as auth.me does (auth.me.update; PATCH /v1/_auth/me) */
+            update(input?: AuthMeUpdateInput, options?: SubstrioCallOptions<'PATCH'>): Promise<AuthMeUpdateResult>;
         };
         mfa: {
-            /** Finish a sign-in that answered mfa_required: trade its challenge and a code, or a recovery code, for the session (auth.mfa) */
+            /** Finish a sign-in that answered mfa_required: trade its challenge and a code, or a recovery code, for the session. After the email code, remember true also remembers the device (the substrio_device cookie, 30 days) (auth.mfa) */
             (input: AuthMfaInput, options?: SubstrioCallOptions<'POST'>): Promise<AuthMfaResult>;
             /** Turn MFA off with a code or a recovery code; every older session ends at its refresh (auth.mfa.disable; POST /v1/_auth/mfa/disable) */
             disable(input?: AuthMfaDisableInput, options?: SubstrioCallOptions<'POST'>): Promise<AuthMfaDisableResult>;
@@ -9831,7 +10858,7 @@ export interface SubstrioOperations {
             /** Rename one of the signed-in person's passkeys (auth.passkey.rename; PATCH /v1/_auth/passkeys/{id}) */
             rename(input: AuthPasskeyRenameInput, options?: SubstrioCallOptions<'PATCH'>): Promise<AuthPasskeyRenameResult>;
             sign_in: {
-                /** Sign in with a passkey and no password: verifies the assertion and returns a session; a passkey that verified the person needs no second factor (auth.passkey.sign_in) */
+                /** Sign in with a passkey and no password: verifies the assertion and returns a session; a passkey that verified the person needs no 2FA (auth.passkey.sign_in) */
                 (input: AuthPasskeySignInInput, options?: SubstrioCallOptions<'POST'>): Promise<AuthPasskeySignInResult>;
                 /** Start a passkey sign-in: returns the WebAuthn request options for navigator.credentials.get, for a discoverable passkey or a person's by email (auth.passkey.sign_in.options; POST /v1/_auth/passkeys/sign-in/options) */
                 options(input?: AuthPasskeySignInOptionsInput, options?: SubstrioCallOptions<'POST'>): Promise<AuthPasskeySignInOptionsResult>;
@@ -9855,7 +10882,7 @@ export interface SubstrioOperations {
             /** Configure one identity provider of the app for social sign-in; see the schema for its body (auth.provider.update; POST /v1/_auth/providers) */
             update(input: AuthProviderUpdateInput, options?: SubstrioCallOptions<'POST'>): Promise<AuthProviderUpdateResult>;
         };
-        /** Refresh a session (auth.refresh; POST /v1/_auth/refresh) */
+        /** Refresh a session: the Bearer token for a new one (the old one stops working). stay true also sets the substrio_session cookie (30 days, renewed by each refresh); with no Bearer, that cookie alone signs its person in again as their sign-in did (auth.refresh; POST /v1/_auth/refresh) */
         refresh(input?: AuthRefreshInput, options?: SubstrioCallOptions<'POST'>): Promise<AuthRefreshResult>;
         /** Create a user session (auth.register; POST /v1/_auth/register) */
         register(input: AuthRegisterInput, options?: SubstrioCallOptions<'POST'>): Promise<AuthRegisterResult>;
@@ -9881,7 +10908,7 @@ export interface SubstrioOperations {
     backup: {
         /** Replace another tenant's database (body target_slug) with a backup of this app (the route's {id} from backup.list), then catch it up with this app's history from the backup's point to now, so it ends up current, not frozen at the backup. Everything target_slug held is lost; it must be a different tenant. Answers {status:'cloned', backup_id, target_slug, history_position, history_through, history_applied} (backup.clone_into; POST /v1/_backups/{id}/clone_into) */
         clone_into(input: BackupCloneIntoInput, options?: SubstrioCallOptions<'POST'>): Promise<BackupCloneIntoResult>;
-        /** Start a backup of the app's database as a background job: optional body description. Answers 202 {job_id, status:'running'} at once; backup.get with that job id shows the progress and, when it completes, the backup id that backup.restore takes (backup.create; POST /v1/_backups) */
+        /** Start a backup of the app's database as a background job: optional body description. Answers 202 {job_id, backup_id, status:'running'} at once, the backup already listed by backup.list as running; backup.get with the job id shows the progress, and with the backup id the backup that backup.restore takes once it completes (backup.create; POST /v1/_backups) */
         create(input?: BackupCreateInput, options?: SubstrioCallOptions<'POST'>): Promise<BackupCreateResult>;
         /** Delete one backup by its id (the route's {id}, as backup.list shows it) (backup.delete; DELETE /v1/_backups/{id}) */
         delete(input: BackupDeleteInput, options?: SubstrioCallOptions<'DELETE'>): Promise<BackupDeleteResult>;
@@ -9919,6 +10946,10 @@ export interface SubstrioOperations {
             /** Read the account's credit: the funds it added, in the minor unit, and how many payments made it (billing.credit.get; GET /v1/_accounts/{id}/billing/credit) */
             get(input: BillingCreditGetInput, options?: SubstrioCallOptions<'GET'>): Promise<BillingCreditGetResult>;
         };
+        person_cart: {
+            /** Make a cart of plans that are the person's own, paid by the account: they hold them at every app wherever they sign in, apart from the account's (subscriptions.mine lists them). The plans, the offer and checkout_url as billing.cart.create gives them; the subject is the person whose own session starts the checkout. No space_blocks: the add-on is the account's (billing.person_cart.create; POST /v1/_accounts/{id}/billing/person-carts) */
+            create(input: BillingPersonCartCreateInput, options?: SubstrioCallOptions<'POST'>): Promise<BillingPersonCartCreateResult>;
+        };
         /** What every account has paid the platform (paid: the identity ledger's maintained balance of the platform party, in USD, with how many payments) and how many accounts' newest invoice is unpaid (past_due). Platform operator only (billing.revenue; GET /v1/_billing/revenue) */
         revenue(input?: BillingRevenueInput, options?: SubstrioCallOptions<'GET'>): Promise<BillingRevenueResult>;
         subscription: {
@@ -9940,7 +10971,7 @@ export interface SubstrioOperations {
         /** Whether this node has caught up with the mesh: 200 when every app's replication has nothing outstanding (its links up, no catch-up in flight, and every position its peers have gossiped already held here) and 503 while one has, naming the app it waits on and what it waits for. A rolling upgrade asks this between nodes, with curl alone, before it installs on the next one (cluster.ready; GET /v1/_cluster/ready) */
         ready(input?: ClusterReadyInput, options?: SubstrioCallOptions<'GET'>): Promise<ClusterReadyResult>;
         version: {
-            /** Read the platform's own versions: the wire range this release speaks, the version chosen for the mesh (the lowest max over the members), the version the mesh has FINALIZED, the storage format, the runtime level this release carries, and every member with its range and whether its link is live (cluster.version) */
+            /** Read the versions in use: the wire range this release speaks, the version chosen for the mesh (the lowest max over the members), the version the mesh has FINALIZED, the storage format, the runtime level this release carries, and every member with its range and whether its link is live (cluster.version) */
             (input?: ClusterVersionInput, options?: SubstrioCallOptions<'GET'>): Promise<ClusterVersionResult>;
             /** Finalize the mesh at wire version {version}: allowed only when this node and every member already speak it (a member whose link is down or whose max is lower refuses the call and is named). It is written durably before the call answers and never goes back: from then on a node that does not speak it is refused at the handshake, so finalize only once every node runs the new release (cluster.version.finalize; POST /v1/_cluster/version/finalize) */
             finalize(input: ClusterVersionFinalizeInput, options?: SubstrioCallOptions<'POST'>): Promise<ClusterVersionFinalizeResult>;
@@ -9956,6 +10987,10 @@ export interface SubstrioOperations {
         /** Read one collection's statistics: doc_count, indexes (each named: {kind: field, field, unique} for a declared field, {kind: vector|text|sparse} for a search index) with index_count, their number, and has_rag; 404 when it does not exist (collection.stats; GET /v1/{collection}/_stats) */
         stats(input: CollectionStatsInput, options?: SubstrioCallOptions<'GET'>): Promise<CollectionStatsResult>;
     };
+    dashboard: {
+        /** Read the dashboard an app declares, the file its live version shipped (nav items and their panels, canonical), for the console to draw. The app is one of the account's own or a featured app the account has enabled; any other answers TENANT_NOT_FOUND. An app that declares none answers an empty nav. With version (a number or id), that version's dashboard instead, checked against its own routes as a push's is: what the console will draw once it goes live (an app of the account's own) (dashboard.get; GET /v1/_accounts/{id}/apps/{slug}/dashboard) */
+        get(input: DashboardGetInput, options?: SubstrioCallOptions<'GET'>): Promise<DashboardGetResult>;
+    };
     data: {
         /** Delete one record by its _id; 404 when it does not exist, 403 when the key may not delete it (data.delete; DELETE /v1/{collection}/{id}) */
         delete(input: DataDeleteInput, options?: SubstrioCallOptions<'DELETE'>): Promise<DataDeleteResult>;
@@ -9979,6 +11014,8 @@ export interface SubstrioOperations {
     documentation: {
         /** Read the guide for AI agents building on substrio (text/plain); a tenant's own /llms.txt function route or site file is served instead (documentation.agent_guide; GET /llms.txt) */
         agent_guide(input?: DocumentationAgentGuideInput, options?: SubstrioCallOptions<'GET'>): Promise<DocumentationAgentGuideResult>;
+        /** Start here, in at most 3 KB. Answers the app, what this key is, the live version number, the goals an app is built for (website, api, database, auth, events: each with its summary, its skill and the tools it needs), the build loop's tools in order, and how to reach every other tool. Takes no input; substrio_tools {area: <goal>} answers a goal's full definitions, substrio_start every area's tools (documentation.brief; GET /v1/_brief) */
+        brief(input?: DocumentationBriefInput, options?: SubstrioCallOptions<'GET'>): Promise<DocumentationBriefResult>;
         /** Describe typed capabilities (documentation.capabilities; GET /v1/_capabilities) */
         capabilities(input?: DocumentationCapabilitiesInput, options?: SubstrioCallOptions<'GET'>): Promise<DocumentationCapabilitiesResult>;
         /** Read generated OpenAPI (documentation.openapi; GET /v1/_openapi) */
@@ -10018,31 +11055,39 @@ export interface SubstrioOperations {
             list(input?: EnvHostListInput, options?: SubstrioCallOptions<'GET'>): Promise<EnvHostListResult>;
             /** Remove one of the app's hosts: it answers nothing from then on and its label is free. ENV_HOST_NOT_FOUND when the app holds no such host. Answers 204 (env.host.remove; DELETE /v1/_env_hosts/{host}) */
             remove(input: EnvHostRemoveInput, options?: SubstrioCallOptions<'DELETE'>): Promise<EnvHostRemoveResult>;
-            /** Bind a host of the app's choosing, <label>.<root> under an enabled root domain (my-app-v2.substrio.com), to one of its environments: live, or a sandbox (with version, a new sandbox running that version). The host answers exactly what that environment runs, with its data. A label has one owner across the platform: HOST_TAKEN when another app holds it, HOST_RESERVED for the platform's names and app hosts, HOST_INVALID (with suggestion) for a label that is not a hostname label, ROOT_DOMAIN_UNKNOWN or ROOT_DOMAIN_DISABLED for the root. Binding a host the app holds again moves it. version.live.set with from: <host> pushes what it runs live (env.host.set; POST /v1/_env_hosts) */
+            /** Bind a host of the app's choosing, <label>.<root> under an enabled root domain (my-app-v2.substrio.com), to one of its environments: live, or a sandbox (with version, a new sandbox running that version). The host answers exactly what that environment runs, with its data. A label has one owner across the platform: HOST_TAKEN when another app holds it, HOST_RESERVED for a reserved name or an app host, HOST_INVALID (with suggestion) for a label that is not a hostname label, ROOT_DOMAIN_UNKNOWN or ROOT_DOMAIN_DISABLED for the root. Binding a host the app holds again moves it. version.live.set with from: <host> pushes what it runs live (env.host.set; POST /v1/_env_hosts) */
             set(input: EnvHostSetInput, options?: SubstrioCallOptions<'POST'>): Promise<EnvHostSetResult>;
         };
     };
     featured: {
-        /** Disable a featured app for the account: its plan there is removed, every account key scoped to that app alone is revoked (a key scoped to several apps loses this one), so each stops at its next request. The answer counts the keys revoked. The use already counted stays (featured.disable; DELETE /v1/_accounts/{id}/featured/{jet}) */
+        /** Deprecated: every account has every jet, always on, so it is refused FEATURED_ALWAYS_ON. A key stops with account.key.revoke; an app's keys go with the app (featured.disable; DELETE /v1/_accounts/{id}/featured/{jet}) */
         disable(input: FeaturedDisableInput, options?: SubstrioCallOptions<'DELETE'>): Promise<FeaturedDisableResult>;
-        /** Enable a featured app for the account: the account is put on the app's default plan there (an account already enabled keeps its plan) and may then make keys scoped to it (featured.key.create). Every call to the app is metered against that plan (featured.enable; PUT /v1/_accounts/{id}/featured/{jet}) */
+        /** Deprecated: every account has every jet, always on. Answers the jet's entry as featured.list writes it and changes nothing (featured.enable; PUT /v1/_accounts/{id}/featured/{jet}) */
         enable(input: FeaturedEnableInput, options?: SubstrioCallOptions<'PUT'>): Promise<FeaturedEnableResult>;
         key: {
-            /** Make an account key scoped to one featured app the account has enabled; the secret is returned once. An unscoped account key may make one (it is narrower than the key that makes it); a scoped key may not (featured.key.create; POST /v1/_accounts/{id}/featured/{jet}/keys) */
+            /** Deprecated: a jet key belongs to one of the account's apps, so it is refused JET_KEY_NEEDS_APP; jet.key.create makes it (featured.key.create; POST /v1/_accounts/{id}/featured/{jet}/keys) */
             create(input: FeaturedKeyCreateInput, options?: SubstrioCallOptions<'POST'>): Promise<FeaturedKeyCreateResult>;
         };
-        /** List the featured apps (the jets: MapJet, SendJet, AuthJet and every later one) with what each does, its admin in the console, whether the account has it enabled, the plan it is metered against and its use this day and month against that plan's limits (featured.list; GET /v1/_accounts/{id}/featured) */
+        /** List the featured apps (the jets: MapJet, SendJet, AuthJet and every later one) for the account: what each does, the plan it is metered against and the account's use this day and month (every app of the account summed) against that plan's limits. Every account has every jet: there is nothing to enable (featured.list; GET /v1/_accounts/{id}/featured) */
         list(input: FeaturedListInput, options?: SubstrioCallOptions<'GET'>): Promise<FeaturedListResult>;
-        /** Feature an app for every account, or stop featuring it (platform admin). It must be open to other accounts' keys and its plans file must have a featured block (title, summary, admin). Accounts that enabled it keep their plan when it stops being featured (featured.set; PUT /v1/_featured/{jet}) */
+        /** Feature an app for every account, or stop featuring it (platform admin). It must be open to other accounts' keys and its plans file must have a featured block (title, summary, admin). An account on a plan there keeps it when it stops being featured (featured.set; PUT /v1/_featured/{jet}) */
         set(input: FeaturedSetInput, options?: SubstrioCallOptions<'PUT'>): Promise<FeaturedSetResult>;
     };
     file: {
+        /** Platform operator only: store a file that is already on this server's own disk (under the server's --adopt-dir) at a path of the app the request names, with 0 bytes written: hashed in one read, then renamed in. Answers what file.upload answers (file.adopt; POST /v1/_files/adopt) */
+        adopt(input: FileAdoptInput, options?: SubstrioCallOptions<'POST'>): Promise<FileAdoptResult>;
         /** Delete one stored file by its path (the route's tail, as file.list shows it) (file.delete; DELETE /v1/_files/{path}) */
         delete(input: FileDeleteInput, options?: SubstrioCallOptions<'DELETE'>): Promise<FileDeleteResult>;
         /** Download one stored file by path (from file.list) (file.download; GET /v1/_files/{path}) */
         download(input: FileDownloadInput, options?: SubstrioCallOptions<'GET'>): Promise<FileDownloadResult>;
         /** List the app's stored files by path (optionally under a prefix): the path is what file.download and file.delete take (file.list; GET /v1/_files) */
         list(input?: FileListInput, options?: SubstrioCallOptions<'GET'>): Promise<FileListResult>;
+        /** Rename a stored file's path from one path to another, its content never copied. Refused with FILE_EXISTS when a file is at to, unless replace is true; FILE_NOT_FOUND when none is at from. Answers the file at its new path, as file.upload answers (file.move; POST /v1/_files/move) */
+        move(input: FileMoveInput, options?: SubstrioCallOptions<'POST'>): Promise<FileMoveResult>;
+        public: {
+            /** Read a stored file marked public, with no key, on the app's own hosts; a private or missing path is the same 404 (file.public.get; GET /_files/{path}) */
+            get(input: FilePublicGetInput, options?: SubstrioCallOptions<'GET'>): Promise<FilePublicGetResult>;
+        };
         site_root: {
             /** Read the tenant site's index page (the app named by Host or X-Substrio-Tenant) (file.site_root.get; GET /) */
             get(input?: FileSiteRootGetInput, options?: SubstrioCallOptions<'GET'>): Promise<FileSiteRootGetResult>;
@@ -10051,6 +11096,8 @@ export interface SubstrioOperations {
             /** Read a tenant static asset (file.static_asset.get; GET /_/{path}) */
             get(input: FileStaticAssetGetInput, options?: SubstrioCallOptions<'GET'>): Promise<FileStaticAssetGetResult>;
         };
+        /** Change a stored file's settings (public, content_type, cache_control) by its path, with no byte of it sent again: its bytes and hash are untouched and an absent setting keeps its value. Answers what file.upload answers; FILE_NOT_FOUND when no file is at the path (file.update; PATCH /v1/_files/{path}) */
+        update(input: FileUpdateInput, options?: SubstrioCallOptions<'PATCH'>): Promise<FileUpdateResult>;
         /** Upload a file into the app's file storage at its path; see the schema for the body. Answers its path, which file.download and file.delete take (file.upload; POST /v1/_files) */
         upload(input: FileUploadInput, options?: SubstrioCallOptions<'POST'>): Promise<FileUploadResult>;
     };
@@ -10058,13 +11105,13 @@ export interface SubstrioOperations {
         /** Summarize tenant databases and deployed functions (function.catalog; GET /v1/_functions/_catalog) */
         catalog(input?: FunctionCatalogInput, options?: SubstrioCallOptions<'GET'>): Promise<FunctionCatalogResult>;
         /** Check a function before deploying it: the same body as function.deploy (script, name, routes, vars, bindings); parses the source as a script, CommonJS or ES module without running it and applies deploy's manifest and require() refusals; answers ok and diagnostics (severity, message, file, line, column); nothing is written or executed (function.check; POST /v1/_functions/_check) */
-        check(input: FunctionCheckInput, options?: SubstrioCallOptions<'POST'>): Promise<FunctionCheckResult>;
+        check(input?: FunctionCheckInput, options?: SubstrioCallOptions<'POST'>): Promise<FunctionCheckResult>;
         /** Invoke a function through the compatibility endpoint (function.compat; GET /fn/{function}) */
         compat(input?: FunctionCompatInput, options?: SubstrioCallOptions<'GET' | 'POST' | 'PUT' | 'DELETE'>): Promise<FunctionCompatResult>;
         /** Delete one function by name; answers {success, deleted}, 404 when no such function (function.delete; DELETE /v1/functions/{name}) */
         delete(input: FunctionDeleteInput, options?: SubstrioCallOptions<'DELETE'>): Promise<FunctionDeleteResult>;
-        /** Deploy one function now, outside a version: body name and script (required), optional main, routes (like 'GET /orders/:id' or 'ANY /hooks/*'), vars, bindings and deploy_nodes. The source is compiled to a handler first; a source that does not compile, or that calls require(), is refused and nothing changes. On success it is live at once and the answer is the function's metadata (id, content_hash, routes, env_vars, bindings). To ship several functions together, or to try them first, use version.create, sandbox.create and version.live.set; function.check shows the problems without writing (function.deploy; POST /v1/functions) */
-        deploy(input: FunctionDeployInput, options?: SubstrioCallOptions<'POST'>): Promise<FunctionDeployResult>;
+        /** Deploy one function now, outside a version: body name and its source (required): script for JavaScript, or rust for a Rust function's source, which the server compiles; optional main, routes (like 'GET /orders/:id' or 'ANY /hooks/*'), vars, bindings and deploy_nodes. The source is compiled to a handler first; a source that does not compile, or that calls require(), is refused and nothing changes. On success it is live at once and the answer is the function's metadata (id, content_hash, routes, env_vars, bindings). To ship several functions together, or to try them first, use version.create, sandbox.create and version.live.set; function.check shows the problems without writing (function.deploy; POST /v1/functions) */
+        deploy(input?: FunctionDeployInput, options?: SubstrioCallOptions<'POST'>): Promise<FunctionDeployResult>;
         environment: {
             /** Delete one environment variable of a function: the route's {name} and {key}, optional body expected_hash (the content_hash you last read; a function that changed since is refused). Takes effect on the next call; answers the function's metadata (function.environment.delete; DELETE /v1/functions/{name}/env/{key}) */
             delete(input: FunctionEnvironmentDeleteInput, options?: SubstrioCallOptions<'DELETE'>): Promise<FunctionEnvironmentDeleteResult>;
@@ -10075,7 +11122,7 @@ export interface SubstrioOperations {
         };
         /** Read the errors the app's functions threw, newest first: each has an id (also a cursor), function, revision (the function's newest revision when it threw), request_id, timestamp, error name, message and the stack as frames (function, file, line, column). Options: function, request_id, revision (only errors of one deploy), since and until (Unix seconds), limit and cursor. Answers errors, count and next_cursor. Check the revision against version.log with the function path: a deploy that fixed a bug stops adding errors under the new revision (function.errors; GET /v1/_function_errors) */
         errors(input?: FunctionErrorsInput, options?: SubstrioCallOptions<'GET'>): Promise<FunctionErrorsResult>;
-        /** Run a Lua script against the tenant's default key-value store, Redis style: body script (or sha of a script loaded earlier with load:true, which answers {sha}), keys and args as arrays of strings. Answers {result}. This is Lua over key-value data, not JavaScript: to run JavaScript use function.invoke, route.call or function.execute_inline (function.eval; POST /v1/eval) */
+        /** Run a Lua script against the tenant's default key-value store, Redis style, in a build with the Redis frontend (not in this release, where the Redis frontend is a build switch, off, and the call answers NOT_IMPLEMENTED). Body script (or sha of a script loaded earlier with load:true, which answers {sha}), keys and args as arrays of strings. Answers {result}. This is Lua over key-value data, not JavaScript: to run JavaScript use function.invoke, route.call or function.execute_inline (function.eval; POST /v1/eval) */
         eval(input?: FunctionEvalInput, options?: SubstrioCallOptions<'POST'>): Promise<FunctionEvalResult>;
         /** Run inline JavaScript in the app's runtime: body code (required, not empty). It runs with the caller's own permissions through the same data API a function uses, and nothing is deployed or stored. For a deployed function use function.invoke; to check source without running it use function.check (function.execute_inline; POST /v1/_exec) */
         execute_inline(input: FunctionExecuteInlineInput, options?: SubstrioCallOptions<'POST'>): Promise<FunctionExecuteInlineResult>;
@@ -10104,13 +11151,13 @@ export interface SubstrioOperations {
             };
         };
         source: {
-            /** Replace one byte range or one exclusive line range of a function's source: body replacement, an approval_token from function.source.preview (required: preview the patch first), the range, and expected_hash (defaults to the current content_hash; a source that changed since is refused with 409). The edited source is compiled before it is stored (function.source.edit; PATCH /v1/functions/{name}/source) */
+            /** Replace one byte range or one exclusive line range of a function's source: body replacement, an approval_token from function.source.preview (required: preview the patch first), the range, and expected_hash (defaults to the current content_hash; a source that changed since is refused with 409). The edited source is compiled before it is stored, JavaScript or Rust (a Rust edit that does not compile is RUST_COMPILE_FAILED with rustc's diagnostics, and the function keeps serving its last source) (function.source.edit; PATCH /v1/functions/{name}/source) */
             edit(input: FunctionSourceEditInput, options?: SubstrioCallOptions<'PATCH'>): Promise<FunctionSourceEditResult>;
             /** Preview and approve one bounded function source edit (function.source.preview; POST /v1/functions/{name}/source/preview) */
             preview(input: FunctionSourcePreviewInput, options?: SubstrioCallOptions<'POST'>): Promise<FunctionSourcePreviewResult>;
             /** Read a bounded line range from the current function source (function.source.read; GET /v1/functions/{name}/source) */
             read(input: FunctionSourceReadInput, options?: SubstrioCallOptions<'GET'>): Promise<FunctionSourceReadResult>;
-            /** Replace one function's whole source with a compare-and-swap: body script (required, compiled before it is stored), optional expected_hash (the content_hash you last read; it defaults to the current one, and a source that changed since is refused with a conflict), main, routes, vars, bindings and deploy_nodes. Fields left out keep their values; an empty array clears. The function must exist (404). Answers the function's metadata (function.source.replace; PUT /v1/functions/{name}/source) */
+            /** Replace one function's whole source with a compare-and-swap: body script for a JavaScript function or rust for a Rust one (required, compiled before it is stored; a replace keeps the function's language), optional expected_hash (the content_hash you last read; it defaults to the current one, and a source that changed since is refused with a conflict), main, routes, vars, bindings and deploy_nodes. Fields left out keep their values; an empty array clears. The function must exist (404). Answers the function's metadata (function.source.replace; PUT /v1/functions/{name}/source) */
             replace(input: FunctionSourceReplaceInput, options?: SubstrioCallOptions<'PUT'>): Promise<FunctionSourceReplaceResult>;
             /** Search bounded source snippets in the current function (function.source.search; GET /v1/functions/{name}/search) */
             search(input: FunctionSourceSearchInput, options?: SubstrioCallOptions<'GET'>): Promise<FunctionSourceSearchResult>;
@@ -10123,7 +11170,7 @@ export interface SubstrioOperations {
         };
         /** Enable or disable one function without deleting it: body enabled (required boolean). Answers {success, enabled}, 404 when no such function. A disabled function is left out of route.list (function.toggle; POST /v1/functions/{name}/toggle) */
         toggle(input: FunctionToggleInput, options?: SubstrioCallOptions<'POST'>): Promise<FunctionToggleResult>;
-        /** Replace one function's source: PATCH with the body function.deploy takes (script is required); the name comes from the path and a name in the body is ignored. A source that does not compile to a handler is refused with 400 and nothing changes. On success it is live at once and the answer is the function's metadata. For a change to part of the source use function.source.edit (function.update; PATCH /v1/functions/{name}) */
+        /** Replace one function's source: PATCH with the body function.deploy takes (script or rust is required); the name comes from the path and a name in the body is ignored. A source that does not compile to a handler is refused with 400 and nothing changes. On success it is live at once and the answer is the function's metadata. For a change to part of the source use function.source.edit (function.update; PATCH /v1/functions/{name}) */
         update(input: FunctionUpdateInput, options?: SubstrioCallOptions<'PATCH'>): Promise<FunctionUpdateResult>;
     };
     graph: {
@@ -10157,6 +11204,14 @@ export interface SubstrioOperations {
         get(input: HostGetInput, options?: SubstrioCallOptions<'GET'>): Promise<HostGetResult>;
         /** List the hosts of the manifest in id order, each with its state, location, group settings, labels and key fingerprint (never the key) (host.list; GET /v1/_hosts) */
         list(input?: HostListInput, options?: SubstrioCallOptions<'GET'>): Promise<HostListResult>;
+        node: {
+            /** Install a packed release on a host as a node (a new slot) or onto an existing node (its slot): the release streams over the host's SSH into the release's own installer, which preflights, installs the unit, health checks and rolls back. Refused before anything is copied with HOST_NOT_PROBED, HOST_NO_SYSTEMD, HOST_NGINX_PRESENT, RELEASE_NOT_FOUND, RELEASE_NOT_PACKED, RELEASE_ISA_UNKNOWN, HOST_CPU_MISSING (the detail names the features), HOST_NODE_LIMIT or NODE_BUSY. Answers 202 with the node as it stands; host.node.list then answers running, failed or rolled_back (host.node.deploy; POST /v1/_hosts/{id}/nodes) */
+            deploy(input: HostNodeDeployInput, options?: SubstrioCallOptions<'POST'>): Promise<HostNodeDeployResult>;
+            /** List the nodes installed on a host in slot order, each with its slot, port, state (deploying, running, failed, rolled_back, undeploying), the release last asked of it and when. A run that stays deploying for 30 minutes reads failed (host.node.list; GET /v1/_hosts/{id}/nodes) */
+            list(input: HostNodeListInput, options?: SubstrioCallOptions<'GET'>): Promise<HostNodeListResult>;
+            /** Stop and remove a node's service and unit on a host; its data folder stays. Refused with HOST_HAS_APPS for the last node of a host while apps are placed on it and NODE_BUSY while its run is under way. Answers 202 with the node as it stands (host.node.undeploy; DELETE /v1/_hosts/{id}/nodes/{slot}) */
+            undeploy(input: HostNodeUndeployInput, options?: SubstrioCallOptions<'DELETE'>): Promise<HostNodeUndeployResult>;
+        };
         /** Probe a host over its orchestrator's SSH, read only: whether it runs its own kernel (bare metal, kvm, another VM) or shares one (openvz, lxc, another container), systemd, the zram module, and zram swap active with zstd. Answers 202 with the host as it stands; the run lands on the host record in one transaction, and host.get answers virt, capabilities, probe (ok, unreachable, failed) and probed_at (host.probe; POST /v1/_hosts/{id}/probe) */
         probe(input: HostProbeInput, options?: SubstrioCallOptions<'POST'>): Promise<HostProbeResult>;
         /** Remove a host and its sealed key from the manifest; refused with HOST_HAS_NODES while it carries nodes and HOST_HAS_APPS while apps are placed on it (tenant.place moves them). Answers 204 with no body (host.remove; DELETE /v1/_hosts/{id}) */
@@ -10174,6 +11229,14 @@ export interface SubstrioOperations {
         /** List the indexes of the SQL tables with each one's value-key state: state ready (every row has its key and every write keeps it), building (a first query is posting the keys now) or none (no key kept; reason says why; a failed build reports none and the engine retries it). Pass table for one table. A collection's field is keyed by its first query, or declared with index.create kind collection: pass kind collection with collection and field to read whether the field is declared (unique, or indexed: a unique field is indexed too) and its key state and the reason it has no key; without field it lists every field the collection declares. Pass kind conflicts with collection and field (or fields, a JSON array, for a compound, with nulls skip or count) to list what stops the field from being declared unique (a declaration over duplicates answers INDEX_DUPLICATES with the first and the count): {conflicts: [{_id, value}], count, next_cursor}, the documents that hold a value another document holds, in id order, paged with limit and cursor; it builds the field's keys when they are not kept yet. Pass kind space to list the unique spaces: {spaces: [{space, members: [{collection, field}]}], count}. Pass kind expiry with collection to read the collection's expiry declaration {field, after_ms, armed_ms}. A collection's keyword and element declarations are listed beside its fields, each its own entry: keyword true with keyword_term_bytes, or elements (the tuple's members), with state and reason. Pass kind aggregate with collection to list the collection's declared live aggregates (index.create kind aggregate): {name, group, metrics, where, state} (index.list; GET /v1/_indexes) */
         list(input?: IndexListInput, options?: SubstrioCallOptions<'GET'>): Promise<IndexListResult>;
     };
+    jet: {
+        key: {
+            /** Make a key of one of the account's apps scoped to one jet; the secret is returned once. The jet sees each call as that app (request.auth.app) and meters it to the account's plan, the app's own use counted beside; removing the app revokes the key. With origins the key is publishable (safe in a page's source, answering only those origins). An unscoped account key may make one; a scoped key may not (jet.key.create; POST /v1/_accounts/{id}/apps/{slug}/jets/{jet}/keys) */
+            create(input: JetKeyCreateInput, options?: SubstrioCallOptions<'POST'>): Promise<JetKeyCreateResult>;
+        };
+        /** List the jets of one of the account's apps: each jet's menu in the app's dashboard (app_nav: its pages, each a list, form or detail over the jet's own routes), the account's plan and use there (every app summed: the limit is the account's) and this app's own use this day and month (jet.list; GET /v1/_accounts/{id}/apps/{slug}/jets) */
+        list(input: JetListInput, options?: SubstrioCallOptions<'GET'>): Promise<JetListResult>;
+    };
     job: {
         /** Cancel one running background job by id: answers the job; 404 when no such job, and refused when it already ended (job.cancel; POST /v1/_jobs/{id}/cancel) */
         cancel(input: JobCancelInput, options?: SubstrioCallOptions<'POST'>): Promise<JobCancelResult>;
@@ -10421,6 +11484,8 @@ export interface SubstrioOperations {
             /** Put an account on one of the tenant's plans (plans.account.set; PUT /v1/_plans/accounts/{account}) */
             set(input: PlansAccountSetInput, options?: SubstrioCallOptions<'PUT'>): Promise<PlansAccountSetResult>;
         };
+        /** Read every plan sold, with no account and no person data: the Substrio plans (each with the jet plan it bundles per jet) and every featured app's (jet's) own plans, each with its limits and standalone price, each plans file as plans.get answers it. The sites build their prices from this. No key needed (plans.catalog; GET /v1/_billing/catalog) */
+        catalog(input?: PlansCatalogInput, options?: SubstrioCallOptions<'GET'>): Promise<PlansCatalogResult>;
         /** Delete the app's plans file: every plan definition is gone and cannot be restored by this call (keep the plans.get answer to put it back with plans.set). Answers 204 with no body; accounts keep no plan and fall back to the default (plans.delete; DELETE /v1/_plans) */
         delete(input?: PlansDeleteInput, options?: SubstrioCallOptions<'DELETE'>): Promise<PlansDeleteResult>;
         /** Read the app's plans file: the plans an account can be put on, each with its limits and features. Answers 404 when no plans are set, so a first plans.set is a create, not an update (plans.get; GET /v1/_plans) */
@@ -10430,10 +11495,10 @@ export interface SubstrioOperations {
     };
     platform: {
         audit: {
-            /** Read the platform's audit trail (tenant create, update and delete, platform settings, shared providers, key rotations), newest first; the filters, limit and cursor of audit.list (platform.audit.list; GET /v1/_platform/audit) */
+            /** Read the server-wide audit trail (tenant create, update and delete, platform settings, shared providers, key rotations), newest first; the filters, limit and cursor of audit.list (platform.audit.list; GET /v1/_platform/audit) */
             list(input?: PlatformAuditListInput, options?: SubstrioCallOptions<'GET'>): Promise<PlatformAuditListResult>;
         };
-        /** Read the platform's account and host counts for the operator, each kept with the accounts and hosts it counts (platform.counts; GET /v1/_platform/counts) */
+        /** Read the account and host counts for the operator, each kept with the accounts and hosts it counts (platform.counts; GET /v1/_platform/counts) */
         counts(input?: PlatformCountsInput, options?: SubstrioCallOptions<'GET'>): Promise<PlatformCountsResult>;
         setting: {
             /** Set one platform setting on the running server; it takes effect at once, is kept in the system database and wins over substrio.conf. The server-wide runtime limits (jsc.*, queue.*, objects.*) are set here; an empty value unsets one, restoring its default (platform.setting.set; PUT /v1/_platform/settings/{key}) */
@@ -10444,7 +11509,7 @@ export interface SubstrioOperations {
             get(input?: PlatformSettingsGetInput, options?: SubstrioCallOptions<'GET'>): Promise<PlatformSettingsGetResult>;
         };
         usage: {
-            /** Read the platform's KPI history for the operator, oldest first: one point per finished minute (step=minute, the default) or hour (step=hour), each with what every app's API requests (total, status classes 2xx to 5xx, latency buckets and percentiles) and function calls added in it, summed as each app's minute is written. since and until are Unix seconds (default: the last hour of minutes, or the last two days of hours); limit caps the points. Counted on the node that answers; platform calls (no app) are not counted (platform.usage.history; GET /v1/_platform/usage/history) */
+            /** Read the KPI history of every app on this server for the operator, oldest first: one point per finished minute (step=minute, the default) or hour (step=hour), each with what every app's API requests (total, status classes 2xx to 5xx, latency buckets and percentiles) and function calls added in it, summed as each app's minute is written. since and until are Unix seconds (default: the last hour of minutes, or the last two days of hours); limit caps the points. Counted on the node that answers; platform calls (no app) are not counted (platform.usage.history; GET /v1/_platform/usage/history) */
             history(input?: PlatformUsageHistoryInput, options?: SubstrioCallOptions<'GET'>): Promise<PlatformUsageHistoryResult>;
         };
     };
@@ -10514,6 +11579,16 @@ export interface SubstrioOperations {
         /** Put a name back to a version its own log holds (the route's {kind} and {name}): name the version, or the log entry by sequence. A name that was deleted is made again, and one that still lives is moved, which is itself one more log entry. A tag is never moved, only made again at the version it marked. Answers {name, version, previous} (ref.restore; POST /v1/_refs/{kind}/{name}/restore) */
         restore(input: RefRestoreInput, options?: SubstrioCallOptions<'POST'>): Promise<RefRestoreResult>;
     };
+    region: {
+        /** List the regions an app can be created in: those that are available and serving, each with its slug, public name and country. Empty until a region serves. Pass a slug as region to account.app.create to place the app there (region.choices; GET /v1/_accounts/{id}/regions) */
+        choices(input: RegionChoicesInput, options?: SubstrioCallOptions<'GET'>): Promise<RegionChoicesResult>;
+        /** List the regions in id order, each with its slug, public name, country, state (available or hidden) and whether it is serving (answers app traffic; the operator cannot set that) (region.list; GET /v1/_regions) */
+        list(input?: RegionListInput, options?: SubstrioCallOptions<'GET'>): Promise<RegionListResult>;
+        /** Remove a region by slug; refused with REGION_IN_USE while a host names it. Answers 204 with no body (region.remove; DELETE /v1/_regions/{slug}) */
+        remove(input: RegionRemoveInput, options?: SubstrioCallOptions<'DELETE'>): Promise<RegionRemoveResult>;
+        /** Create the region of this slug (the name is required) or change its name, country or state; a field left out keeps its value. A host joins a region through host.update (region.set; PUT /v1/_regions/{slug}) */
+        set(input: RegionSetInput, options?: SubstrioCallOptions<'PUT'>): Promise<RegionSetResult>;
+    };
     release: {
         /** List this host's platform releases, newest first: every folder of <root>/releases holding the server binary (the folder's name is the commit it was built from, with the binary's size and time), which one this process runs, which one the current link names (the next restart's) and which one the previous link names (a rollback's), and restart_pending when current is not the running one. A release is switched on the host by deploy-stax.sh, which health-checks it and rolls back (release.list; GET /v1/_releases) */
         list(input?: ReleaseListInput, options?: SubstrioCallOptions<'GET'>): Promise<ReleaseListResult>;
@@ -10531,9 +11606,9 @@ export interface SubstrioOperations {
         update(input: RoleUpdateInput, options?: SubstrioCallOptions<'PATCH' | 'PUT'>): Promise<RoleUpdateResult>;
     };
     root_domain: {
-        /** Add a root domain (onstax.com) the platform's apps answer under as <slug>.<root> and their test hosts as <label>.<root>: stored in the platform's data before it answers, published to the front as *.<root> and, when the platform has a DNS-01 token, its wildcard certificate asked of the platform's ACME. Answers 201 with domain, enabled, source, hosts and added_at; KEY_EXISTS (field domain) when the platform has it, INVALID_ARGUMENT (field domain) when it is not a domain (root_domain.add; POST /v1/_root_domains) */
+        /** Add a root domain (onstax.com) that apps answer under as <slug>.<root> and their test hosts as <label>.<root>: stored before the call answers, published to the front as *.<root> and, when the platform has a DNS-01 token, its wildcard certificate requested from the configured ACME provider. Answers 201 with domain, enabled, source, hosts and added_at; KEY_EXISTS (field domain) when the platform has it, INVALID_ARGUMENT (field domain) when it is not a domain (root_domain.add; POST /v1/_root_domains) */
         add(input: RootDomainAddInput, options?: SubstrioCallOptions<'POST'>): Promise<RootDomainAddResult>;
-        /** List the platform's root domains: those of substrio.conf (source config) then the ones added (source admin), each with enabled and its count of test hosts (root_domain.list; GET /v1/_root_domains) */
+        /** List the root domains: those of substrio.conf (source config) then the ones added (source admin), each with enabled and its count of test hosts (root_domain.list; GET /v1/_root_domains) */
         list(input?: RootDomainListInput, options?: SubstrioCallOptions<'GET'>): Promise<RootDomainListResult>;
         /** Remove an added root domain; refused ROOT_DOMAIN_IN_USE (hosts: the count) while a test host is bound under it, UNSUPPORTED_OPERATION (field domain) for one of substrio.conf. Answers 204 (root_domain.remove; DELETE /v1/_root_domains/{domain}) */
         remove(input: RootDomainRemoveInput, options?: SubstrioCallOptions<'DELETE'>): Promise<RootDomainRemoveResult>;
@@ -10570,7 +11645,7 @@ export interface SubstrioOperations {
             clear(input?: SandboxStubClearInput, options?: SubstrioCallOptions<'DELETE'>): Promise<SandboxStubClearResult>;
             /** Read a test tenant's stubs, with how often each answered, and every fetch its functions made since the last clear (method, URL, headers, body, the tenant's clock, stubbed or unmatched) (sandbox.stub.list; GET /v1/_stubs) */
             list(input?: SandboxStubListInput, options?: SubstrioCallOptions<'GET'>): Promise<SandboxStubListResult>;
-            /** Stub one outbound request of a test tenant: its functions' fetch() of the given method, origin and path resolves with the stub's status, headers and body instead of going out. Only a test tenant (made with tenant.create test=true) takes stubs, any other is refused with TEST_TENANT_REQUIRED. The newest matching stub that is not spent answers; a fetch no stub matches is rejected. Answers {id} (sandbox.stub.set; POST /v1/_stubs) */
+            /** Stub one outbound request of a test tenant: its functions' fetch() of the given method, origin and path resolves with the stub's status, headers and body instead of going out. Only a test tenant takes stubs, any other is refused with TEST_TENANT_REQUIRED. The newest matching stub that is not spent answers; a fetch no stub matches is rejected. Answers {id} (sandbox.stub.set; POST /v1/_stubs) */
             set(input: SandboxStubSetInput, options?: SubstrioCallOptions<'POST'>): Promise<SandboxStubSetResult>;
         };
     };
@@ -10615,7 +11690,7 @@ export interface SubstrioOperations {
         allowlist(input?: SecurityAllowlistInput, options?: SubstrioCallOptions<'GET' | 'POST' | 'DELETE'>): Promise<SecurityAllowlistResult>;
         /** Read the failed sign-ins of the audit trail (action auth.failure in audit.list), newest first: the key id of the key that proved nothing, or the caller's address when no key was presented; since, until, order, limit, cursor, actor_kind and actor filter it (security.audit; GET /v1/_security/audit) */
         audit(input?: SecurityAuditInput, options?: SubstrioCallOptions<'GET'>): Promise<SecurityAuditResult>;
-        /** Manage the platform's per-address rate limit (the server's --rate-limit): GET shows it, POST sets max_tokens and tokens_per_second, DELETE with clear turns it off (security.rate_limit; GET /v1/_security/rate_limit) */
+        /** Manage the per-address rate limit (the --rate-limit server option): GET shows it, POST sets max_tokens and tokens_per_second, DELETE with clear turns it off (security.rate_limit; GET /v1/_security/rate_limit) */
         rate_limit(input?: SecurityRateLimitInput, options?: SubstrioCallOptions<'GET' | 'POST' | 'DELETE'>): Promise<SecurityRateLimitResult>;
         rules: {
             /** Delete the app's collection security rules; answers {ok} (security.rules.delete; DELETE /v1/_rules) */
@@ -10631,7 +11706,7 @@ export interface SubstrioOperations {
         delete(input: SettingsDeleteInput, options?: SubstrioCallOptions<'DELETE'>): Promise<SettingsDeleteResult>;
         /** List the app's settings: answers settings (each {key, value}) and count (settings.get; GET /v1/_settings) */
         get(input?: SettingsGetInput, options?: SubstrioCallOptions<'GET'>): Promise<SettingsGetResult>;
-        /** Set one app setting: body key and value (a string, or true or false). Any key is stored; substrio reads changes.history (keep change history so change streams can resume) and webhooks.brand (the webhook signature and delivery id header names, <brand>-Signature and <brand>-Delivery-Id) and the delivery settings webhooks.max_attempts, webhooks.backoff_ms, triggers.max_attempts, triggers.backoff_ms, cron.max_attempts, cron.backoff_ms, delivery.backoff_cap_ms (milliseconds) and delivery.retain_days (days a delivered record stays replayable, 0 keeps none), each a whole number (the attempt counts at least 1), and refuses a value that does not suit them. A server-wide runtime limit (jsc.*, queue.*, objects.*) is a platform setting and is refused here with SETTING_IS_PLATFORM: platform.setting.set sets it (settings.set; PUT /v1/_settings) */
+        /** Set one app setting: body key and value (a string, or true or false). Any key is stored; substrio reads changes.history (keep change history so change streams can resume) and webhooks.brand (the webhook signature and delivery id header names, <brand>-Signature and <brand>-Delivery-Id) and the delivery settings webhooks.max_attempts, webhooks.backoff_ms, triggers.max_attempts, triggers.backoff_ms, cron.max_attempts, cron.backoff_ms, delivery.backoff_cap_ms (milliseconds) and delivery.retain_days (days a delivered record stays replayable, 0 keeps none), each a whole number (the attempt counts at least 1), and refuses a value that does not suit them. A server-wide runtime limit (jsc.*, queue.*, objects.*) is a platform setting and is refused here with SETTING_IS_PLATFORM (settings.set; PUT /v1/_settings) */
         set(input: SettingsSetInput, options?: SubstrioCallOptions<'PUT' | 'POST'>): Promise<SettingsSetResult>;
     };
     site: {
@@ -10655,6 +11730,8 @@ export interface SubstrioOperations {
         move(input: SourceMoveInput, options?: SubstrioCallOptions<'POST'>): Promise<SourceMoveResult>;
         /** Search the text units of a version (the route's {version}) for pattern: exact bytes, or a regular expression with regex:true (linear time, line by line). glob narrows the files; context adds lines before and after. Answers {version, matches: [{path, line, text, before, after}], count, truncated}, bounded by max_matches and max_bytes (source.search; GET /v1/_commits/{version}/search) */
         search(input: SourceSearchInput, options?: SubstrioCallOptions<'GET'>): Promise<SourceSearchResult>;
+        /** Run one shell command over the app, the way you work on a checkout: no process, a POSIX shell subset interpreted in the server. Mounts: /src is the branch's tree (writable, default main, the starting directory), /site the live release's site/ (read only), /files the app's stored files (writable; rm there is refused, file.delete does it). Any other path is refused. Builtins: grep (-r -n -l -L -c -i -v -w -o -q -E -F -A -B -C -m --include --exclude), sed (-n -E -i -e, addresses N $ /re/ ranges !, s///g with \1 groups, p d q a i c y { }), find (-name -iname -path -type -maxdepth -mindepth -empty -exec {} + -delete), cat, head, tail, wc, sort, uniq, cut, tr, diff (unified), ls, cd, pwd, mv, cp, rm, mkdir, touch, echo, printf, tee, test and [ ], xargs, basename, dirname, true, false, commit -m, and js (a script in the app's own runtime with fs.readFile, writeFile, readdir, stat, exists, rm, rename, mkdir on the same mounts; input is stdin). Variables: $PWD $HOME $SRC $SITE $FILES $BRANCH $?. Every /src change of one call lands as ONE commit (message: the command, or commit -m) when the command ends with status 0; any other status, or any refusal, lands nothing. No state is kept between calls. Answers {stdout, stderr, exit_code, offset, truncated, next_offset, commit: {version, number, changed}}; output past the budget is cut with truncated:true and continued with offset. Examples: grep -rn 'TODO' /src; sed -n 10,40p src/app.js; find /src/functions -name '*.js' | xargs sed -i 's/oldName/newName/g'; cat > /src/site/about.html <<'EOF' (lines) EOF; js 'fs.writeFile("notes.txt", input.toUpperCase())' < notes.txt (source.shell; POST /v1/_source/shell) */
+        shell(input: SourceShellInput, options?: SubstrioCallOptions<'POST'>): Promise<SourceShellResult>;
         /** List the paths a version holds (the route's {version}: an id, a number, a branch, live or a sandbox name), ordered by path, each with its kind (file or dir). prefix walks only that directory; glob keeps the files whose path matches (* and ? also match /); sizes:true adds each file's size. Answers {version, entries, count} (source.tree; GET /v1/_commits/{version}/tree) */
         tree(input: SourceTreeInput, options?: SubstrioCallOptions<'GET'>): Promise<SourceTreeResult>;
     };
@@ -10664,6 +11741,14 @@ export interface SubstrioOperations {
         /** Describe the SQL catalog from the engine's typed descriptors: tables and views with columns (name, declared type, nullable, default, key, generated), indexes (columns with order, unique), foreign keys, and routines; pass table for one table (sql.schema; GET /v1/_sql/schema) */
         schema(input?: SqlSchemaInput, options?: SubstrioCallOptions<'GET'>): Promise<SqlSchemaResult>;
     };
+    subscriptions: {
+        /** End one of the signed-in person's own subscriptions now: a paid one leaves the account's provider subscription that pays it (that line, or the whole subscription when it was the last) and the person falls back to what else they hold there (a bundle's plan, else the app's default). A bundle child ends only with its Substrio plan (SUBSCRIPTION_NOT_FOUND). The person's own session only, never a key or an agent (SUBSCRIPTION_PERSON_REQUIRED). Answers the subscription, ended (subscriptions.cancel; POST /v1/_subscriptions/{id}/cancel) */
+        cancel(input: SubscriptionsCancelInput, options?: SubstrioCallOptions<'POST'>): Promise<SubscriptionsCancelResult>;
+        /** List an app's subscribers a page at a time: every subscription to its plans (a purchase, a bundle child of a Substrio plan, or a grant), by subject (an account, a person, or an app's own user) and id. The caller's own app, or (app) another app of the same owning account; any other app's is refused SUBSCRIBERS_NOT_VISIBLE (subscriptions.list; GET /v1/_subscriptions) */
+        list(input?: SubscriptionsListInput, options?: SubstrioCallOptions<'GET'>): Promise<SubscriptionsListResult>;
+        /** List the signed-in person's own subscriptions at every app, active and ended: what they bought for themselves (a cart for the person), each Substrio plan's bundle children, and the plans apps granted them. A person's session only (at the console or at any app); a key is refused SUBSCRIPTION_PERSON_REQUIRED (subscriptions.mine; GET /v1/_subscriptions/mine) */
+        mine(input?: SubscriptionsMineInput, options?: SubstrioCallOptions<'GET'>): Promise<SubscriptionsMineResult>;
+    };
     sync: {
         /** Push replication operations (sync.push; POST /v1/_sync) */
         push(input?: SyncPushInput, options?: SubstrioCallOptions<'POST'>): Promise<SyncPushResult>;
@@ -10741,6 +11826,8 @@ export interface SubstrioOperations {
         rename(input: TenantRenameInput, options?: SubstrioCallOptions<'POST'>): Promise<TenantRenameResult>;
         /** Resume a suspended tenant, restoring the state before it was suspended (tenant.resume; POST /v1/_tenants/{slug}/resume) */
         resume(input: TenantResumeInput, options?: SubstrioCallOptions<'POST'>): Promise<TenantResumeResult>;
+        /** Read what this app's folder holds on disk (disk_bytes, as of the last fold, each second) by kind (database, files, logs, backups, code, other), its storage limit and the room left (null while no limit is set). The storage limit is held against disk_bytes; tenant.usage's used_bytes and blob_bytes count only document and file bytes (tenant.storage; GET /v1/_storage) */
+        storage(input?: TenantStorageInput, options?: SubstrioCallOptions<'GET'>): Promise<TenantStorageResult>;
         /** Suspend a tenant with a typed reason and an optional note (tenant.suspend; POST /v1/_tenants/{slug}/suspend) */
         suspend(input: TenantSuspendInput, options?: SubstrioCallOptions<'POST'>): Promise<TenantSuspendResult>;
         /** Update tenant configuration (tenant.update; PATCH /v1/_tenants/{slug}) */
@@ -10750,7 +11837,7 @@ export interface SubstrioOperations {
             (input: TenantUsageInput, options?: SubstrioCallOptions<'GET'>): Promise<TenantUsageResult>;
             /** Read this app's KPI history, oldest first: one point per finished minute (step=minute, the default; kept two days) or hour (step=hour; kept 90 days), each with what the app's function calls added in it (calls, status classes, latency buckets and percentiles, refusals, CPU and wall time) and its stored documents and bytes at its end. since and until are Unix seconds (default: the last hour of minutes, or the last two days of hours); limit caps the points. Counted on the node that answers (tenant.usage.history; GET /v1/_usage/history) */
             history(input?: TenantUsageHistoryInput, options?: SubstrioCallOptions<'GET'>): Promise<TenantUsageHistoryResult>;
-            /** Read this tenant's own exact usage and limits: storage bytes, documents, requests per minute (a limit is null until one is set) and the function limits (cpu, memory, concurrency, timeout, body and value sizes); the same body as tenant.usage, for the tenant the key belongs to (tenant.usage.self; GET /v1/_usage) */
+            /** Read this tenant's own exact usage and limits: storage bytes, documents, requests per minute (a limit is null until one is set) and the function limits (cpu, memory, concurrency, timeout, body and value sizes), for the tenant the key belongs to (tenant.usage.self; GET /v1/_usage) */
             self(input?: TenantUsageSelfInput, options?: SubstrioCallOptions<'GET'>): Promise<TenantUsageSelfResult>;
         };
     };
@@ -10847,8 +11934,8 @@ export interface SubstrioOperations {
     version: {
         /** What one commit changed (the route's {version}): every path that differs from the version it is compared against, added, removed or changed, with the object ids on both sides. against names another version (default: the commit's first parent, so the answer is the commit's own change) (version.changes; GET /v1/_commits/{version}/changes) */
         changes(input: VersionChangesInput, options?: SubstrioCallOptions<'GET'>): Promise<VersionChangesResult>;
-        /** Check an app version before it is pushed or made live: the body is the version.create body. Runs function.check over every function whose source is uploaded (parsed as script, CommonJS or ES module, with deploy's require() refusal) and answers ok, diagnostics (function, severity, message, line, column) and the blobs still missing. Nothing is stored or run. version.create and version.live.set run this same check unless they are sent check:false (version.check; POST /v1/_versions/_check) */
-        check(input: VersionCheckInput, options?: SubstrioCallOptions<'POST'>): Promise<VersionCheckResult>;
+        /** Check an app version before it is pushed or made live: the body is the version.create body, or {version} naming one already committed (a number, an id, a branch, live or a sandbox's name; no manifest). Runs function.check over every function whose source is uploaded (parsed as script, CommonJS or ES module, with deploy's require() refusal) and answers ok, diagnostics (function, severity, message, line, column) and the blobs still missing. Nothing is stored or run. version.create and version.live.set run this same check unless they are sent check:false (version.check; POST /v1/_versions/_check) */
+        check(input?: VersionCheckInput, options?: SubstrioCallOptions<'POST'>): Promise<VersionCheckResult>;
         /** Write one commit on a branch of the app's history: the units it changes (bytes as text, as base64, or the id of an object the app already holds, such as the hash site.blob.upload answered), the paths it removes, and what it did. This is how a file is written or deleted: one file is {message, units: [{path: "site/index.html", text: "<h1>Hi</h1>"}]}, one removal is {message, removals: ["site/old.css"]}; no hash is computed by the caller. A function is functions/<name>.js with its routes in functions/<name>.json ({"routes": ["GET /hello"]}), a site file site/<path>. The answered number is promotable at once: version.live.set {version: number}, with sandbox to run it there first. mode changes applies them to the parent version, mode snapshot makes the units the whole content. expected is the version the branch must still point at, so a racing commit is refused rather than overwritten. Answers {version, root, number, generation, branch, blobs_written, trees_written} (version.commit; POST /v1/_commits) */
         commit(input: VersionCommitInput, options?: SubstrioCallOptions<'POST'>): Promise<VersionCommitResult>;
         /** Push an app version: the functions (each by the SHA-256 of its source), rules, MCP manifest, site files, cron, triggers, plans, auth and login settings, and the permission and ledger catalogs (declared first when it goes live, append only). Answers 201 {version, missing, existed}: missing lists the blobs you still have to upload with site.blob.upload, and existed is true when the same content was pushed before. Pushing does not change what is live: make it live with version.live.set. The version is committed on the branch named by branch (main when none is), which is created at this version when it has no version yet. Sources already uploaded are checked like function.check unless check is false; a failing one refuses the push with 400 and its diagnostics (version.create; POST /v1/_versions) */