@cosmoops/connect-sdk 0.7.0 → 0.15.0

package/dist/types/client/provider.d.ts

@@ -1,10 +1,25 @@
 import type { ReactNode } from "react";
-import type { AddonUsageResponse, ConnectUser, IntegrationsListResponse, WorkspaceApp, PlansResponse, ReadinessResponse, ApplicationRole, SessionsListResponse, SessionSubscription, SubscriptionResponse } from "../types.js";
+import type { AddonUsageResponse, CompanyProfileResponse, ConnectUser, IntegrationsListResponse, WorkspaceApp, UserWorkspace, ConnectWorkspaceMember, PlansResponse, ReadinessResponse, SessionsListResponse, SessionSubscription, SessionAudience, SubscriptionResponse, WorkspaceType } from "../types.js";
 export declare const CONNECT_APP_URL = "https://connect.cosmoops.com";
 export interface ConnectSession {
     user: ConnectUser | null;
     subscription: SessionSubscription | null;
-    applicationRole: ApplicationRole | null;
+    /**
+     * The signed-in account's role on this application, or `null` - see
+     * `SessionAccess.role`. `null` when signed out too, which is why `user`
+     * rather than this is the signed-in test.
+     */
+    role: string | null;
+    /** What to gate on - see `SessionAccess.permissions`. `[]` when signed out. */
+    permissions: string[];
+    /** Whether this is one of Connect's own operators - see `SessionAccess.staff`. `false` when signed out. */
+    staff: boolean;
+    /**
+     * `null` when signed out, for the same reason `user` and `subscription`
+     * are: there is no workspace to compare an audience against yet. Never
+     * `null` on a signed-in session.
+     */
+    audience: SessionAudience | null;
 }
 export interface ConnectContextValue {
     /**
@@ -58,10 +73,26 @@ export interface ConnectContextValue {
      * page.
      */
     invalidateResource(path: string): void;
+    /**
+     * POST through the bridge and hand back the raw `Response`, unread and
+     * uncached - the seam `<ConnectAskAi>` streams server-sent events over.
+     *
+     * Separate from `mutateResource` rather than a flag on it, because the two
+     * differ in every respect that matters: this one must not `await
+     * response.json()` (that buffers the whole stream and defeats the point),
+     * must not touch the resource cache (a conversation is not a resource), and
+     * takes an `AbortSignal` so a "Stop" button can actually stop generation.
+     *
+     * Throws on a non-2xx, having read the error envelope - which is safe,
+     * because a failure never has a stream behind it.
+     */
+    streamResource(path: string, body: unknown, options?: {
+        signal?: AbortSignal;
+    }): Promise<Response>;
 }
 export interface ConnectProviderProps {
     /**
-     * This application's public `client_id`, from its Integration tab in Connect.
+     * This application's public `client_id`, from its Connect client section in Connect.
      *
      * Not needed for the default sign-in flow: `signIn()` with no `redirectUri`
      * bounces the browser to your own `/signin` route, which already knows
@@ -128,6 +159,56 @@ export declare function ConnectProvider({ clientId, basePath, redirectUri, appUr
 export declare function useConnect(): ConnectContextValue;
 /** The signed-in user, or `null`. Sugar over `useConnect().session`. */
 export declare function useConnectUser(): ConnectUser | null;
+/**
+ * Whether the signed-in workspace is a one-seat personal account or a team -
+ * `null` while the session is loading or signed out.
+ *
+ * Branch on this to stop rendering team UI at a solo account: a members
+ * table, an invite button and a seat meter are all dead controls on an
+ * `"individual"` workspace, which has exactly one seat and cannot gain
+ * another. `<ConnectWorkspaceTypeGate>` is the declarative form.
+ */
+export declare function useConnectWorkspaceType(): WorkspaceType | null;
+/**
+ * Whether this account is the kind your application is sold to - `null` while
+ * the session is loading or signed out.
+ *
+ * `audience.matches === false` is a hard block, not a hint: readiness reports
+ * `audience_mismatch` and subscribing is refused. `<ConnectAccessGate>`
+ * already blocks the shell on it, so reach for this only when you need the
+ * verdict somewhere the gate does not run - a marketing page, say, or a
+ * sign-up CTA you would rather not show to an account that cannot complete it.
+ */
+export declare function useConnectAudience(): SessionAudience | null;
+/**
+ * Whether this session is one of Connect's own operators - see
+ * `SessionAccess.staff`.
+ *
+ * `isStaff` is the branch you want; `roles` narrows further when your operator
+ * console has tiers of its own (a `developer` seeing a read-only view of what
+ * a `platform_admin` can edit, say).
+ *
+ * **A rendering decision, not an access decision.** The browser can call this
+ * whatever it likes. Everything an operator console exposes must be re-checked
+ * server-side against `staff` from
+ * `client.identity.getUser(sessionToken)` - see `<ConnectPlatformGate>`, which
+ * says the same thing at more length.
+ */
+export declare function useConnectPlatformAccess(): {
+    isStaff: boolean;
+    /**
+     * The staff role, as a one-element array.
+     *
+     * Still an array because `<ConnectPlatformGate accept={[...]}>` matches
+     * against a set, and because a session reports one role since
+     * `role`/`permissions`/`staff` replaced the old `platformAccess.roles`
+     * list - Connect's platform roles nest, so the highest one is the whole
+     * answer. Empty for a member session.
+     */
+    roles: string[];
+    /** `true` while the session read is in flight - neither staff nor not-staff yet. */
+    isLoading: boolean;
+};
 /** Readiness gates and the live subscription, fetched on first use. */
 export declare function useConnectEntitlements(): {
     data: {
@@ -179,6 +260,29 @@ export declare function useConnectPlans(): {
      */
     refetch(): void;
 };
+/**
+ * The platform's legal identity and DPDP grievance channel.
+ *
+ * The one read here that does not depend on a session, so it resolves the
+ * same for a signed-out visitor - which is deliberate, because the moment a
+ * grievance channel most needs to be readable is on a public privacy page.
+ *
+ * Read it rather than copying it into your own configuration; see
+ * `CompanyProfile`. `<ConnectGrievanceNotice>` renders it for you.
+ */
+export declare function useConnectCompanyProfile(): {
+    data: CompanyProfileResponse | null;
+    isLoading: boolean;
+    error: string | null;
+    /**
+     * Forces a fresh read - the provider's cache clears the mutated path's
+     * entry on a successful `mutateResource` call, but nothing re-triggers
+     * this hook's own effect on its own (none of its dependencies change from
+     * a cache write nobody here observes). Call this right after a
+     * `mutateResource` you made against the same `path` completes.
+     */
+    refetch(): void;
+};
 /** The apps this workspace can open. */
 export declare function useConnectApps(): {
     data: {
@@ -195,6 +299,48 @@ export declare function useConnectApps(): {
      */
     refetch(): void;
 };
+/**
+ * The workspaces this user belongs to - what `<ConnectWorkspaceSwitcher>`
+ * renders.
+ *
+ * Empty or single-entry results are normal, not errors: most accounts have one
+ * workspace, and the switcher decides for itself whether that is worth
+ * drawing.
+ */
+export declare function useConnectWorkspaces(): {
+    data: {
+        workspaces: UserWorkspace[];
+    } | null;
+    isLoading: boolean;
+    error: string | null;
+    /**
+     * Forces a fresh read - the provider's cache clears the mutated path's
+     * entry on a successful `mutateResource` call, but nothing re-triggers
+     * this hook's own effect on its own (none of its dependencies change from
+     * a cache write nobody here observes). Call this right after a
+     * `mutateResource` you made against the same `path` completes.
+     */
+    refetch(): void;
+};
+/**
+ * The team of the workspace this session is on, with each member's permissions
+ * already resolved for this application.
+ */
+export declare function useConnectWorkspaceMembers(): {
+    data: {
+        members: ConnectWorkspaceMember[];
+    } | null;
+    isLoading: boolean;
+    error: string | null;
+    /**
+     * Forces a fresh read - the provider's cache clears the mutated path's
+     * entry on a successful `mutateResource` call, but nothing re-triggers
+     * this hook's own effect on its own (none of its dependencies change from
+     * a cache write nobody here observes). Call this right after a
+     * `mutateResource` you made against the same `path` completes.
+     */
+    refetch(): void;
+};
 /** Enabled Composio-hosted toolkits and this workspace's connection status for each. */
 export declare function useConnectIntegrations(): {
     data: IntegrationsListResponse | null;

package/dist/types/client/use-checkout.d.ts

@@ -85,9 +85,13 @@ export declare function buildCancelUrl({ appUrl, subscriptionId }: {
  * The Connect URL that completes a subscribe or a plan change.
  *
  * Both land on a modal Connect renders over the relevant page (an intercepted
- * parallel route - `app/@modal/(.)applications/...` and
- * `app/@modal/(.)billing/...`), so the customer arrives already looking at the
- * confirmation for the plan they picked here, not at a catalogue they have to
- * find it in again.
+ * parallel route - `app/@modal/(.)apps/...` and `app/@modal/(.)billing/...`),
+ * so the customer arrives already looking at the confirmation for the plan
+ * they picked here, not at a catalogue they have to find it in again.
+ *
+ * The subscribe path is `/apps/...`, not `/applications/...`: the portal
+ * route customers see is `/apps`, and `/applications` is a Console-only
+ * prefix that has never served this page. Building the other one is what
+ * sent every first-time subscriber from a partner's pricing page to a 404.
  */
 export declare function buildCheckoutUrl({ appUrl, applicationId, planId, subscriptionId, coupon, }: CheckoutUrlOptions): string;

package/dist/types/errors.d.ts

@@ -52,7 +52,7 @@ export declare class ConnectError extends Error {
      * guessing keys. These two are the exception: reaching them required
      * presenting a key whose hash matched, so you already hold it, and what you
      * need to know is that no retry and no scope change will fix this - the key
-     * has to be reissued from the application's Integration tab.
+     * has to be reissued from the application's Connect client section.
      *
      * Worth alerting on. It is the one failure that will not resolve itself and
      * takes down every call your integration makes.

package/dist/types/index.d.ts

@@ -13,5 +13,7 @@
  */
 export { ConnectError, isConnectError } from "./errors.js";
 export { blockingBlockers, normalizePlanFeatures } from "./helpers.js";
+export { arrayRemove, arrayUnion, deleteField, documentExists, increment, serverTimestamp, storeIndexFor, storeIndexSignature, unchangedSince, } from "./store.js";
+export type { StoreIndexDirection, StoreIndexField } from "./store.js";
 export type { WirePlanFeature } from "./helpers.js";
 export type * from "./types.js";

package/dist/types/next/index.d.ts

@@ -125,7 +125,7 @@ export declare function getConnectSession(request?: Request, options?: {
  * A thin wrapper, not a framework of its own - reach for `getConnectSession`
  * plus your own check when "not signed in" isn't "redirect to sign-in"
  * (an API route returning 401, say). Role and entitlement checks stay
- * outside this function on purpose: `session.applicationRole.granted` and
+ * outside this function on purpose: `session.permissions` and
  * `connect.entitlements.*` are one line each on top of the session this
  * already gives you, and where that line redirects (a plans page, a
  * "forbidden" screen) is a decision only your app can make - see

package/dist/types/server/client.d.ts

@@ -2,6 +2,9 @@ import type { FetchLike } from "./http.js";
 import { AccessResource } from "./resources/access.js";
 import { AppsResource } from "./resources/apps.js";
 import { AiResource } from "./resources/ai.js";
+import { DataResource } from "./resources/data.js";
+import { WorkspacesResource } from "./resources/workspaces.js";
+import { KvResource } from "./resources/kv.js";
 import { BillingResource } from "./resources/billing.js";
 import { DriveResource } from "./resources/drive.js";
 import { EntitlementsResource } from "./resources/entitlements.js";
@@ -11,10 +14,11 @@ import { LogsResource } from "./resources/logs.js";
 import { AnalyticsResource } from "./resources/analytics.js";
 import { OtpResource } from "./resources/otp.js";
 import { SessionsResource } from "./resources/sessions.js";
+import { PlatformResource } from "./resources/platform.js";
 export declare const DEFAULT_BASE_URL = "https://connect.cosmoops.com";
 export interface ConnectClientOptions {
     /**
-     * The API key plaintext from this application's Integration tab, shown once at
+     * The API key plaintext from this application's Connect client section, shown once at
      * creation.
      *
      * One credential does three jobs: it is the `Authorization: Bearer` value
@@ -73,6 +77,10 @@ export declare class ConnectClient {
     readonly drive: DriveResource;
     /** RAG chat and structured extraction. */
     readonly ai: AiResource;
+    /** Your application's own document store - see `DataResource`. */
+    readonly data: DataResource;
+    /** Your application's key/value store - see `KvResource`. */
+    readonly kv: KvResource;
     /** WhatsApp/SMS phone verification. */
     readonly otp: OtpResource;
     /** Feature events into the Console's audit log, filterable to your application. */
@@ -83,7 +91,22 @@ export declare class ConnectClient {
     readonly sessions: SessionsResource;
     /** Composio-hosted third-party connections (Google Calendar, Slack, ...) a workspace has connected. */
     readonly integrations: IntegrationsResource;
+    /** Which workspaces the signed-in user belongs to, switching between them, and the team - see `WorkspacesResource`. */
+    readonly workspaces: WorkspacesResource;
+    /** The platform's own legal identity and DPDP grievance channel - see `PlatformResource`. */
+    readonly platform: PlatformResource;
+    /**
+     * Relays one `/data/*` or `/kv/*` request verbatim - `createConnectHandler`'s
+     * store route and nothing else. See `storePassthrough`.
+     * @internal
+     */
+    readonly storeRelay: (spec: {
+        method: "GET" | "POST" | "PUT" | "DELETE";
+        path: string;
+        json?: unknown;
+        headers?: Record<string, string>;
+    }) => Promise<Response>;
     constructor(options: ConnectClientOptions);
 }
 /** Kept in step with `package.json` by `sdk.test.ts`. */
-export declare const SDK_VERSION = "0.7.0";
+export declare const SDK_VERSION = "0.14.0";

package/dist/types/server/http.d.ts

@@ -1,6 +1,11 @@
 export type FetchLike = (input: string, init?: RequestInit) => Promise<Response>;
 export interface RequestSpec {
-    method: "GET" | "POST";
+    /**
+     * `PUT` and `DELETE` were added for the store resources. Both are idempotent
+     * by HTTP's own definition, so both are retried like `GET` - see the retry
+     * note on `request`.
+     */
+    method: "GET" | "POST" | "PUT" | "DELETE";
     /** Relative to the API base, e.g. `/plans`. */
     path: string;
     query?: Record<string, string | number | undefined>;
@@ -12,7 +17,12 @@ export interface RequestSpec {
     headers?: Record<string, string>;
     /** Bearer API key (default), or none - the `/sso/*` endpoints authenticate inside the form body instead. */
     auth?: "bearer" | "none";
-    /** Skip JSON parsing and hand back the raw `Response` - for streaming endpoints. */
+    /**
+     * Skip JSON parsing and hand back the raw `Response` - for streaming
+     * endpoints.
+     *
+     * Also stops `timeoutMs` from applying to the *body*: see `request`.
+     */
     raw?: boolean;
     signal?: AbortSignal;
 }
@@ -44,7 +54,8 @@ export declare function pathSegment(value: string, name: string): string;
  * `ConnectError`.
  *
  * **On retries.** Only idempotent requests are retried without a caller
- * opt-in: every `GET`, plus any `POST` carrying an `Idempotency-Key` (the
+ * opt-in: every `GET`, `PUT` and `DELETE`, plus any `POST` carrying an
+ * `Idempotency-Key` (the
  * resources that mutate - `billing.consumeAddon`, `otp.send` - always set
  * one). A bare `POST` is attempted exactly once, because a 429 or a 504 says
  * nothing about whether the server already did the work.

package/dist/types/server/index.d.ts

@@ -18,11 +18,15 @@ export type { AppsResource } from "./resources/apps.js";
 export type { EntitlementsResource } from "./resources/entitlements.js";
 export type { BillingResource } from "./resources/billing.js";
 export type { AiResource } from "./resources/ai.js";
+export type { DataResource } from "./resources/data.js";
+export type { KvResource } from "./resources/kv.js";
+export type { WorkspacesResource } from "./resources/workspaces.js";
 export type { OtpResource } from "./resources/otp.js";
 export type { LogsResource } from "./resources/logs.js";
 export type { AnalyticsResource } from "./resources/analytics.js";
 export type { SessionsResource } from "./resources/sessions.js";
 export type { ExecuteIntegrationActionInput, IntegrationsResource } from "./resources/integrations.js";
+export type { PlatformResource } from "./resources/platform.js";
 /**
  * Webhook verification and a ready-made POST route. Server-only for the
  * obvious reason: the signing secret must never reach a browser bundle.

package/dist/types/server/resources/acting-as.d.ts

@@ -0,0 +1,11 @@
+/**
+ * The header that turns a server-to-server store call into one made *on behalf
+ * of* a signed-in user.
+ *
+ * Connect resolves the token to a user and a workspace itself and checks the
+ * collection's declared permission against that member's live roles - so a
+ * caller supplying this is asking for a *narrower* check than an application
+ * call, never a wider one. An unresolvable token is refused rather than
+ * quietly downgraded, precisely because the downgrade would be an escalation.
+ */
+export declare function actingAs(sessionToken: string | undefined): Record<string, string>;

package/dist/types/server/resources/ai.d.ts

@@ -1,6 +1,13 @@
 import { type TransportOptions } from "../http.js";
 import type { ChatMessage } from "../../types.js";
-/** RAG chat and structured extraction against a workspace's data. */
+/**
+ * RAG chat and structured extraction against a workspace's data.
+ *
+ * `asUser` on `chat` behaves as it does on the store resources: pass a
+ * signed-in user's `sessionToken` and Connect resolves the workspace from it,
+ * ignoring `workspaceId`. Without it you are the application, naming the
+ * workspace yourself.
+ */
 export declare class AiResource {
     private readonly transport;
     constructor(transport: TransportOptions);
@@ -13,6 +20,7 @@ export declare class AiResource {
     chat(input: {
         workspaceId: string;
         messages: ChatMessage[];
+        asUser?: string;
     }, options?: {
         signal?: AbortSignal;
     }): Promise<Response>;

package/dist/types/server/resources/data.d.ts

@@ -0,0 +1,258 @@
+import { type TransportOptions } from "../http.js";
+import type { StoreAggregatePage, StoreAggregation, StoreCommitOperation, StoreCommitResult, StoreDocument, StoreQueryFilter, StoreQueryPage, StoreOrderBy, StoreScanPage } from "../../types.js";
+/**
+ * Your application's own document store - a dedicated Firestore database that
+ * only Connect can reach.
+ *
+ * You hold no Firebase credential and write no security rules. Collections are
+ * declared in the Console; an undeclared name is refused rather than created,
+ * and `workspaceId` is a path segment rather than a filter, so a query cannot
+ * cross tenants.
+ *
+ * **A query needs an index for its shape, and there are two ways to have one.**
+ * Firestore maintains a single-field index automatically, which covers one
+ * filter, or an `orderBy` on that same field. Anything wider - two filters, or
+ * a filter ordered by a different field - needs a composite index **declared
+ * on your application's Store tab**, which Connect then builds in your
+ * database. A query with no matching index is refused up front, naming the
+ * index to declare, rather than failing later with a Firestore index error
+ * pointing at a console you cannot open.
+ *
+ * **Dates are ISO-8601 strings.** The store writes what you send it, and JSON
+ * has no date type, so a `Date` must be sent as `toISOString()`. That is not a
+ * compromise: UTC ISO strings sort lexicographically in chronological order,
+ * so ordering and range filters on them behave exactly as they would on a
+ * timestamp - and Connect's own `_createdAt`/`_updatedAt` come back in the
+ * same form.
+ *
+ * **`workspaceId` is omitted for master data.** A collection declared
+ * application-scoped in the Console belongs to no workspace - one copy, owned
+ * by you, read by every tenant. Those are written with your API key only,
+ * never on behalf of a user: a write permission is something a *workspace*
+ * grants, so honouring one on shared data would give one tenant's admin reach
+ * over every other tenant's reference data.
+ *
+ * **`asUser` is how you act on behalf of a signed-in user.** Pass the opaque
+ * `sessionToken` you were given at sign-in and Connect resolves the user and
+ * their workspace from it - checking the collection's declared permission
+ * against what that member actually holds, and **ignoring `workspaceId`
+ * entirely**. Without it you are the application itself: your API key's scopes
+ * are the only gate, and the per-user permissions do not apply. The bridge
+ * (`createConnectHandler`) always passes it, which is what makes the browser
+ * path safe.
+ */
+export declare class DataResource {
+    private readonly transport;
+    constructor(transport: TransportOptions);
+    /** Reads one document. Throws `ConnectError` with status 404 when it does not exist. */
+    get(input: {
+        workspaceId?: string;
+        collection: string;
+        id: string;
+        asUser?: string;
+    }): Promise<StoreDocument>;
+    /**
+     * Lists a collection, one page at a time.
+     *
+     * `filters` are ANDed. More than one, or one combined with an `orderBy` on a
+     * different field, needs a composite index declared on the Store tab - see
+     * the class note above.
+     *
+     * `limit` defaults to 50 and caps at 200. Page by passing the previous
+     * page's `nextCursor`; a `null` `nextCursor` is the end of the collection.
+     */
+    query(input: {
+        workspaceId?: string;
+        collection: string;
+        filters?: StoreQueryFilter[];
+        orderBy?: StoreOrderBy;
+        limit?: number;
+        cursor?: string | null;
+        asUser?: string;
+    }): Promise<StoreQueryPage>;
+    /**
+     * Counts, sums and averages a filtered collection - **in Firestore**, not by
+     * reading the rows back and adding them up.
+     *
+     * That distinction is the whole point. An aggregation is billed by the index
+     * entries it scans rather than by the documents it would have returned, so a
+     * dashboard tile over ten thousand rows costs a handful of reads and stays
+     * flat as the collection grows. Paging the rows into your own process to sum
+     * them is an unbounded read, and it is what every integration does when
+     * there is no aggregate call to reach for.
+     *
+     * ```ts
+     * const { values } = await connect.data.aggregate({
+     *   workspaceId,
+     *   collection: "deals",
+     *   filters: [{ field: "outcome", op: "==", value: "won" }],
+     *   aggregations: [
+     *     { op: "count", alias: "count" },
+     *     { op: "sum", field: "value", alias: "total" },
+     *   ],
+     * });
+     * ```
+     *
+     * A `sum` or `avg` over nothing answers `null` rather than `0`, because
+     * "nothing matched" and "the total is zero" are different facts.
+     *
+     * The index it needs is the one its **filters** need plus the aggregated
+     * field - Firestore reads a sum out of the index rather than out of the
+     * documents.
+     *
+     * There is no `orderBy`, `limit` or `cursor`: the aggregate of an ordered
+     * page is the aggregate of the whole filtered set.
+     */
+    aggregate(input: {
+        workspaceId?: string;
+        collection: string;
+        aggregations: StoreAggregation[];
+        filters?: StoreQueryFilter[];
+        asUser?: string;
+    }): Promise<StoreAggregatePage>;
+    /**
+     * Reads one collection across **every workspace at once** - your own
+     * back-office view of your whole customer base. Each row carries the
+     * `workspaceId` it came from.
+     *
+     * Needs the `data:read:all` scope, and the collection must be marked
+     * cross-workspace in the Console. There is deliberately **no `asUser`**: a
+     * scan is never available on behalf of a signed-in user, because a workspace
+     * admin is an admin of their own workspace and not of your other customers.
+     *
+     * Filtering and ordering follow the same index rules as `query`, and
+     * additionally need collection-group scope. Connect creates those from the
+     * declaration - the single-field ones when you mark a field queryable, and a
+     * group-scoped copy of every composite index the collection declares. A scan
+     * issued in the minutes after that declaration may fail while the index
+     * builds.
+     */
+    scan(input: {
+        collection: string;
+        filters?: StoreQueryFilter[];
+        orderBy?: StoreOrderBy;
+        limit?: number;
+        cursor?: string | null;
+    }): Promise<StoreScanPage>;
+    /**
+     * Creates a document. Pass `id` to choose it, or omit it and one is
+     * allocated. An `id` that already exists throws with status 409 - use
+     * `replace` to overwrite deliberately.
+     */
+    create(input: {
+        workspaceId?: string;
+        collection: string;
+        data: Record<string, unknown>;
+        id?: string;
+        asUser?: string;
+    }): Promise<StoreDocument>;
+    /** Replaces every field, creating the document if it does not exist. `_createdAt`/`_createdBy` survive. */
+    replace(input: {
+        workspaceId?: string;
+        collection: string;
+        id: string;
+        data: Record<string, unknown>;
+        asUser?: string;
+    }): Promise<StoreDocument>;
+    /** Merges top-level fields into an existing document. Throws with status 404 if it does not exist. */
+    update(input: {
+        workspaceId?: string;
+        collection: string;
+        id: string;
+        data: Record<string, unknown>;
+        asUser?: string;
+    }): Promise<StoreDocument>;
+    /** Idempotent - deleting a document that is not there succeeds. */
+    delete(input: {
+        workspaceId?: string;
+        collection: string;
+        id: string;
+        asUser?: string;
+    }): Promise<void>;
+    /**
+     * Applies a set of writes atomically, across as many of your collections as
+     * they name. All of them land, or none.
+     *
+     * This is the store's answer to a database transaction, and the shape is
+     * deliberate: **you never hold one**. A transaction handle passed across an
+     * HTTP boundary is a server-side lock whose duration your network controls,
+     * with Firestore's sixty-second ceiling and lock contention as the failure
+     * mode. Instead you read, decide, and commit *conditional on nothing having
+     * moved* - Connect runs the whole set as one short transaction on its side.
+     *
+     * ```ts
+     * await connect.data.commit({
+     *   workspaceId,
+     *   operations: [
+     *     { op: "create", collection: "ledger", id, data: entry },
+     *     {
+     *       op: "merge",
+     *       collection: "funds",
+     *       id: entry.fundId,
+     *       data: { balancePaise: increment(entry.amountPaise) },
+     *     },
+     *   ],
+     * });
+     * ```
+     *
+     * A precondition that no longer holds throws `ConnectError` with status 409
+     * and **writes nothing** - see `transaction`, which re-reads and retries for
+     * you. Note that the example above needs no precondition at all: an
+     * `increment` is commutative, so concurrent commits both land correctly.
+     *
+     * Returns the id each operation wrote, in order - which is how you learn the
+     * id a `create` without one was given.
+     */
+    commit(input: {
+        workspaceId?: string;
+        operations: StoreCommitOperation[];
+        asUser?: string;
+    }): Promise<StoreCommitResult>;
+    /**
+     * Read, decide, commit - retried when the world moved underneath you.
+     *
+     * The optimistic-concurrency loop, written once. `build` reads whatever it
+     * needs and returns the operations to apply; if any precondition among them
+     * has gone stale by the time Connect looks, the commit is rejected whole and
+     * `build` runs again against fresh reads.
+     *
+     * ```ts
+     * await connect.data.transaction(async () => {
+     *   const fund = await connect.data.get({ workspaceId, collection: "funds", id });
+     *   if (!fund.data.active) throw new Error("That fund is closed.");
+     *   return [
+     *     {
+     *       op: "merge",
+     *       collection: "funds",
+     *       id,
+     *       data: { balancePaise: increment(amount) },
+     *       precondition: unchangedSince(fund),
+     *     },
+     *   ];
+     * });
+     * ```
+     *
+     * **Only a 409 is retried.** A 403 or a validation error means the operation
+     * was wrong rather than late, and retrying it would turn one clear failure
+     * into `attempts` identical ones. An error thrown by `build` itself - the
+     * closed-fund check above - is not retried either: it is a decision, not a
+     * collision.
+     *
+     * `build` must be free of side effects outside the returned operations,
+     * because it can run more than once. That is the price of not holding a
+     * lock, and it is the same contract Firestore's own `runTransaction` states
+     * for the same reason.
+     */
+    transaction(build: () => Promise<StoreCommitOperation[]>, options?: {
+        workspaceId?: string;
+        asUser?: string;
+        attempts?: number;
+    }): Promise<StoreCommitResult>;
+    private write;
+}
+export declare function storePassthrough(transport: TransportOptions, spec: {
+    method: "GET" | "POST" | "PUT" | "DELETE";
+    path: string;
+    json?: unknown;
+    headers?: Record<string, string>;
+}): Promise<Response>;