@makemind/sdk 0.1.0

package/dist/index.d.ts

@@ -0,0 +1,3080 @@
+import { FirebaseApp } from 'firebase/app';
+
+interface ApiClientConfig {
+    baseUrl: string;
+    apiKey: string;
+    applicationId: string;
+    /** Gateway API version segment. Defaults to 'v1'. */
+    apiVersion?: string;
+    getAuthToken: () => string | null;
+    getTenantId: () => string | null;
+    /**
+     * Optional App Check token provider. When set, its resolved value is attached
+     * as the `X-Firebase-AppCheck` header on every request so first-party apps can
+     * pass App Check enforcement on the pre-login gateway endpoints. Async because
+     * the Firebase App Check SDK returns the token as a promise; returns null when
+     * App Check is not configured (the header is then simply omitted).
+     */
+    getAppCheckToken?: () => Promise<string | null>;
+}
+interface ApiRequestOptions {
+    method?: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
+    body?: unknown;
+    headers?: Record<string, string>;
+    skipAuth?: boolean;
+}
+declare class ApiClient {
+    private baseUrl;
+    private apiVersion;
+    private apiKey;
+    private applicationId;
+    private getAuthToken;
+    private getTenantId;
+    private getAppCheckToken?;
+    constructor(config: ApiClientConfig);
+    request<T>(endpoint: string, options?: ApiRequestOptions): Promise<T>;
+    private handleErrorResponse;
+    private mapStatusToCode;
+    get<T>(endpoint: string, options?: Omit<ApiRequestOptions, 'method' | 'body'>): Promise<T>;
+    post<T>(endpoint: string, body?: unknown, options?: Omit<ApiRequestOptions, 'method' | 'body'>): Promise<T>;
+    put<T>(endpoint: string, body?: unknown, options?: Omit<ApiRequestOptions, 'method' | 'body'>): Promise<T>;
+    patch<T>(endpoint: string, body?: unknown, options?: Omit<ApiRequestOptions, 'method' | 'body'>): Promise<T>;
+    delete<T>(endpoint: string, options?: Omit<ApiRequestOptions, 'method' | 'body'>): Promise<T>;
+    /**
+     * Execute a tenant-defined logic function by name via the logic service.
+     * This is NOT the gateway RPC dispatch — use `dispatch()` for Callable operations.
+     */
+    call<T>(functionName: string, data?: unknown): Promise<T>;
+    /**
+     * Invoke a platform Callable operation through the gateway RPC dispatch route
+     * (`POST /api/v<version>/call/:operation`). The operation key is the deployed
+     * Callable name (`<domain>-<name>` for namespaced groups, bare name for flat
+     * exports). The gateway expects the payload under a `data` envelope.
+     */
+    dispatch<T>(operation: string, payload?: unknown): Promise<T>;
+    /**
+     * Get the version-qualified base URL for direct API calls (e.g. streaming),
+     * including the `/api/<version>` segment.
+     */
+    getBaseUrl(): string;
+    /**
+     * Get auth headers for direct API calls (e.g., streaming)
+     */
+    getAuthHeaders(): Record<string, string>;
+}
+
+interface MAKEMINDSettlementConfig extends MAKEMINDConfig {
+    apiClient: ApiClient;
+    tenantId: () => string | null;
+}
+type SubscriptionStatus = 'active' | 'trialing' | 'past_due' | 'paused' | 'cancelled' | 'expired';
+type BillingCycle = 'daily' | 'weekly' | 'monthly' | 'yearly' | 'oneTime';
+interface Subscription {
+    id: string;
+    tenantId: string;
+    planId: string;
+    planName: string;
+    status: SubscriptionStatus;
+    billingCycle: BillingCycle;
+    currentPeriodStart: Date;
+    currentPeriodEnd: Date;
+    cancelAtPeriodEnd: boolean;
+    canceledAt?: Date;
+    pausedAt?: Date;
+    pauseUntil?: Date;
+    trialEnd?: Date;
+    discount?: {
+        couponCode: string;
+        percentOff?: number;
+        amountOff?: number;
+        expiresAt?: Date;
+    };
+    createdAt: Date;
+    updatedAt: Date;
+}
+interface SubscribeOptions {
+    planId: string;
+    billingCycle?: BillingCycle;
+    paymentMethodId?: string;
+    couponCode?: string;
+    startImmediately?: boolean;
+    trialDays?: number;
+}
+interface UpdateSubscriptionOptions {
+    planId?: string;
+    billingCycle?: BillingCycle;
+    prorate?: boolean;
+}
+interface CancelSubscriptionOptions {
+    reason?: string;
+    /** When false, cancels immediately. When true (default), cancels at period end. */
+    cancelAtPeriodEnd?: boolean;
+}
+interface PauseSubscriptionOptions {
+    reason?: string;
+}
+interface SubscriptionHistoryEntry {
+    id: string;
+    action: 'created' | 'updated' | 'canceled' | 'paused' | 'resumed' | 'reactivated';
+    previousPlanId?: string;
+    newPlanId?: string;
+    previousStatus?: SubscriptionStatus;
+    newStatus?: SubscriptionStatus;
+    reason?: string;
+    metadata?: Record<string, unknown>;
+    createdAt: Date;
+}
+interface SubscriptionChangePreview {
+    currentPlan: {
+        id: string;
+        name: string;
+        price: number;
+    };
+    newPlan: {
+        id: string;
+        name: string;
+        price: number;
+    };
+    proratedCredit: number;
+    proratedCharge: number;
+    immediateCharge: number;
+    nextBillingAmount: number;
+    nextBillingDate: Date;
+}
+type PaymentProvider = 'stripe' | 'paypal' | 'toss' | 'kakaoPay' | 'lemonSqueezy' | 'paddle' | 'apple' | 'google' | 'manual';
+interface AddPaymentMethodData {
+    provider: PaymentProvider;
+    stripe?: {
+        customerId: string;
+        accountId: string;
+    };
+    manual?: {
+        externalRef: string;
+        label?: string;
+        metadata?: Record<string, unknown>;
+    };
+    toss?: {
+        customerKey: string;
+        authKey: string;
+    };
+    kakaoPay?: {
+        pgToken: string;
+        tid: string;
+        partnerUserId: string;
+    };
+}
+type AddPaymentMethodResponse = {
+    kind: 'stripeSetupIntent';
+    clientSecret: string;
+    setupIntentId: string;
+    customerId: string;
+} | {
+    kind: 'redirect';
+    url: string;
+    provider: PaymentProvider;
+} | {
+    kind: 'billingKey';
+    paymentAccountId: string;
+    provider: PaymentProvider;
+} | {
+    kind: 'manualCreated';
+    paymentAccountId: string;
+} | {
+    kind: 'inAppPurchase';
+    provider: 'apple' | 'google';
+    message: string;
+};
+declare class MAKEMINDSettlement {
+    private apiClient;
+    private getTenantId;
+    constructor(config: MAKEMINDSettlementConfig);
+    private get tenantId();
+    recordUsage(options: UsageEventOptions): Promise<void>;
+    /**
+     * Record a sale and distribute it to n recipients in one atomic posting.
+     *
+     * The revenue leg and every share leg commit together or not at all. Do not
+     * emulate this by recording the sale and then each share separately — that
+     * makes every partial-failure combination yours to recover, and a
+     * half-distributed sale cannot be repaired from outside the ledger.
+     *
+     * The split rule is the caller's: send the recipients and amounts you
+     * computed. Each cut is either a percentage or a fixed amount, and the two
+     * may be mixed; the combined claim may not exceed the sale. Recipients are settlement accounts, so the same call serves an
+     * End User seller, another party in the tenant, or a platform cut.
+     *
+     * Shares are floored to the currency's minor unit; the remainder stays with
+     * the receiving party. A share too small to express posts no leg and comes
+     * back as `0` / `null`.
+     */
+    recordSaleWithShares(options: {
+        provider: string;
+        providerTransactionId: string;
+        amount: number;
+        currency: string;
+        referenceType?: string;
+        referenceId?: string;
+        idempotencyKey?: string;
+        shares?: Array<{
+            toAccountId: string;
+            /** A proportional cut, `(0, 100]`. Exactly one of this or shareAmount. */
+            sharePercent?: number;
+            /** A fixed amount in the sale's currency. Does not scale with the sale. */
+            shareAmount?: number;
+            description?: string;
+            metadata?: Record<string, unknown>;
+        }>;
+    }): Promise<{
+        transactionId: string;
+        shareTransactionIds: (string | null)[];
+        shareAmounts: number[];
+        residue: number;
+        idempotent: boolean;
+    }>;
+    /**
+     * Reverse a split sale, clawing back each recipient's share in the same
+     * posting. Partial refunds claw back proportionally (floored, so a claw-back
+     * never exceeds what the recipient received; the difference is yours).
+     *
+     * Use this rather than a plain refund for anything recorded with
+     * `recordSaleWithShares` — otherwise the buyer is refunded while the shares
+     * stay paid out, and the ledger is short by exactly the shares.
+     */
+    reverseSaleWithShares(options: {
+        transactionId: string;
+        amount?: number;
+        reason?: string;
+        idempotencyKey: string;
+    }): Promise<{
+        refundTransactionId: string;
+        shareReversalIds: string[];
+        shareReversalAmounts: number[];
+        tenantBorne: number;
+        idempotent: boolean;
+    }>;
+    getUsageStats(options?: {
+        startDate?: string;
+        endDate?: string;
+        metric?: string;
+    }): Promise<UsageStats>;
+    getBillingSummary(): Promise<BillingSummary>;
+    getQuotaStatus(_resourceType?: string): Promise<{
+        quotas: Array<{
+            resource: string;
+            limit: number;
+            used: number;
+            remaining: number;
+            usagePercent: number;
+        }>;
+    }>;
+    listInvoices(options?: {
+        status?: 'draft' | 'pending' | 'paid' | 'overdue' | 'cancelled' | 'refunded';
+        limit?: number;
+    }): Promise<Invoice[]>;
+    getInvoice(invoiceId: string): Promise<Invoice>;
+    downloadInvoice(_invoiceId: string): Promise<{
+        url: string;
+        expiresIn: number;
+    }>;
+    getCurrentPlan(): Promise<{
+        id: string;
+        name: string;
+        features: string[];
+        limits: Record<string, number>;
+    }>;
+    listPlans(): Promise<Array<{
+        id: string;
+        name: string;
+        description: string;
+        price: number;
+        currency: string;
+        features: string[];
+        limits: Record<string, number>;
+    }>>;
+    changePlan(planId: string): Promise<void>;
+    /**
+     * Get current subscription details
+     */
+    getCurrentSubscription(): Promise<Subscription | null>;
+    /**
+     * Subscribe to a plan
+     */
+    subscribe(options: SubscribeOptions): Promise<Subscription>;
+    /**
+     * Update current subscription (e.g., change plan, billing cycle).
+     * The backend has no in-place PATCH; a plan update is implemented by creating
+     * a new subscription (which cancels the current one server-side). billingCycle
+     * and prorate are forwarded as metadata but only planId is acted upon today.
+     */
+    updateSubscription(options: UpdateSubscriptionOptions): Promise<Subscription>;
+    /**
+     * Cancel current subscription.
+     * Resolves the active subscriptionId first, then dispatches to
+     * settlement-cancelSubscription. Backend field is cancelImmediately (not
+     * cancelAtPeriodEnd); meaning is inverted — SDK default cancelAtPeriodEnd=true
+     * maps to cancelImmediately=false.
+     */
+    cancelSubscription(options?: CancelSubscriptionOptions): Promise<void>;
+    /**
+     * Pause subscription (if supported by plan).
+     * Backend accepts only { subscriptionId }; pauseUntil is not supported yet.
+     */
+    pauseSubscription(_options?: PauseSubscriptionOptions): Promise<void>;
+    /**
+     * Resume a paused subscription.
+     */
+    resumeSubscription(): Promise<Subscription>;
+    /**
+     * Reactivate a canceled subscription (before period end).
+     * Routes to settlement-resumeSubscription: fetches the most-recently-canceled
+     * subscription and resumes it. This is semantically equivalent for the
+     * cancel-at-period-end case where the subscription is still within its period.
+     */
+    reactivateSubscription(): Promise<Subscription>;
+    /**
+     * Get subscription history.
+     * TODO(gateway): no dedicated subscription history table/function exists in the
+     * backend. Requires a new settlement_subscription_events table or equivalent
+     * audit trail (scope: schema + backfill trigger + query function).
+     */
+    getSubscriptionHistory(_options?: {
+        limit?: number;
+        offset?: number;
+    }): Promise<SubscriptionHistoryEntry[]>;
+    /**
+     * Preview subscription change (get prorated amounts).
+     * TODO(gateway): proration calculation requires billing period overlap logic
+     * that is not yet implemented in the backend (scope: period credits, immediate
+     * charge delta, next-billing projection — needs a new onCall or REST endpoint).
+     */
+    previewSubscriptionChange(_newPlanId: string): Promise<SubscriptionChangePreview>;
+    /**
+     * Apply a coupon to current subscription.
+     * TODO(gateway): coupon engine (validation, redemption ledger, discount
+     * application) is not yet implemented (scope: coupon collection + validation
+     * function + subscription discount field update).
+     */
+    applyCoupon(_couponCode: string): Promise<{
+        success: boolean;
+        discount: number;
+        message: string;
+    }>;
+    getPaymentMethods(): Promise<Array<{
+        id: string;
+        type: 'card' | 'bankAccount';
+        last4: string;
+        isDefault: boolean;
+    }>>;
+    addPaymentMethod(data: AddPaymentMethodData): Promise<AddPaymentMethodResponse>;
+    removePaymentMethod(paymentAccountId: string): Promise<void>;
+    setDefaultPaymentMethod(paymentAccountId: string): Promise<void>;
+    recordProductCreation(productId: string): Promise<void>;
+    recordDocumentUpload(documentId: string, fileSizeMb: number): Promise<void>;
+    recordEcoSubmission(ecoId: string): Promise<void>;
+    recordMarketplaceBid(bidId: string, requestId: string): Promise<void>;
+    recordParticipantAdded(productId: string, participantTenantId: string): Promise<void>;
+}
+
+interface MAKEMINDConfig {
+    applicationId: string;
+    environment?: 'development' | 'staging' | 'production';
+}
+interface AuthUser {
+    uid: string;
+    email: string | null;
+    displayName: string | null;
+    photoURL: string | null;
+    tenantId: string;
+    roles: string[];
+    scopes: string[];
+}
+interface TenantClaims {
+    id: string;
+    roles: string[];
+    scopes: string[];
+}
+interface AuthStateCallback {
+    (user: AuthUser | null): void;
+}
+interface Tenant {
+    id: string;
+    name: string;
+    plan: string;
+    status: 'active' | 'suspended' | 'deleted';
+    settings?: Record<string, unknown>;
+    createdAt?: Date;
+    updatedAt?: Date;
+}
+interface TenantMember {
+    id: string;
+    userId: string;
+    tenantId: string;
+    role: string;
+    scopes: string[];
+    status: 'active' | 'invited' | 'suspended';
+    joinedAt?: Date;
+}
+interface Workspace {
+    id: string;
+    name: string;
+    description?: string;
+    parentId?: string;
+    createdAt?: Date;
+}
+interface QueryCondition {
+    field: string;
+    op: '==' | '!=' | '<' | '<=' | '>' | '>=' | 'in' | 'not-in' | 'array-contains' | 'array-contains-any';
+    value: unknown;
+}
+interface OrderBy {
+    field: string;
+    direction: 'asc' | 'desc';
+}
+interface QueryOptions {
+    collection: string;
+    where?: QueryCondition[];
+    orderBy?: OrderBy[];
+    limit?: number;
+    startAfter?: string;
+}
+interface QueryResult<T> {
+    data: T[];
+    metadata?: {
+        hasMore: boolean;
+        lastDocId?: string;
+        totalCount?: number;
+    };
+}
+interface DocumentResult<T> {
+    data: T;
+    id: string;
+}
+interface CreateOptions {
+    collection: string;
+    data: Record<string, unknown>;
+    documentId?: string;
+}
+interface UpdateOptions {
+    collection: string;
+    documentId: string;
+    data: Record<string, unknown>;
+}
+interface DeleteOptions {
+    collection: string;
+    documentId: string;
+}
+interface GetOptions {
+    collection: string;
+    documentId: string;
+}
+type SnapshotCallback<T> = (data: T | null) => void;
+type CollectionSnapshotCallback<T> = (data: T[]) => void;
+type Unsubscribe = () => void;
+interface LogicCallResult {
+    executionId: string;
+    status: 'completed' | 'running' | 'failed';
+    output?: unknown;
+    error?: {
+        code: string;
+        message: string;
+    };
+}
+interface WorkflowTransitionOptions {
+    workflowName: string;
+    documentId: string;
+    action: string;
+    data?: Record<string, unknown>;
+}
+interface SendMessageOptions {
+    template: string;
+    recipients: string[];
+    data: Record<string, unknown>;
+    channels?: ('push' | 'email' | 'sms')[];
+}
+interface Notification {
+    id: string;
+    title: string;
+    body: string;
+    data?: Record<string, unknown>;
+    read: boolean;
+    createdAt: Date;
+}
+interface UsageEventOptions {
+    eventType: string;
+    resourceId: string;
+    quantity?: number;
+    metadata?: Record<string, unknown>;
+}
+interface UsageStats {
+    period: string;
+    events: Record<string, number>;
+    totalUsage: number;
+}
+interface BillingSummary {
+    currentBalance: number;
+    pendingCharges: number;
+    currency: string;
+    plan: string;
+}
+interface Invoice {
+    id: string;
+    amount: number;
+    currency: string;
+    status: 'draft' | 'pending' | 'paid' | 'overdue' | 'cancelled' | 'refunded';
+    periodStart: Date;
+    periodEnd: Date;
+    createdAt: Date;
+}
+interface PlatformErrorDetails {
+    code: string;
+    message: string;
+    details?: Record<string, unknown>;
+}
+
+interface MAKEMINDAuthConfig extends MAKEMINDConfig {
+    apiClient: ApiClient;
+    onAuthStateChange: (user: AuthUser | null) => void;
+    setAuthToken: (token: string | null) => void;
+}
+interface TenantMembership {
+    tenantId: string;
+    tenantName: string;
+    tenantDisplayName: string;
+    roles: string[];
+    status: string;
+}
+declare class MAKEMINDAuth {
+    private apiClient;
+    private applicationId;
+    private onAuthStateChange;
+    private setAuthToken;
+    private _currentUser;
+    private _memberships;
+    private refreshToken;
+    private authStateCallbacks;
+    constructor(config: MAKEMINDAuthConfig);
+    private restoreSession;
+    private persistSession;
+    private clearStoredSession;
+    get currentUser(): AuthUser | null;
+    get memberships(): TenantMembership[];
+    /**
+     * Set the session directly from an externally-obtained token — e.g. a Firebase
+     * ID token from Google sign-in, which the gateway accepts as a Bearer. Mirrors
+     * the post-authentication state update of signInWithEmail (set token, persist
+     * to localStorage, notify auth-state listeners) without a /auth/signin
+     * round-trip. Also used by the console's token-refresh bridge to swap in a
+     * freshly-refreshed Firebase token. Existing memberships are preserved when
+     * `memberships` is omitted.
+     */
+    setSession(user: AuthUser, token: string, refreshToken: string, memberships?: TenantMembership[]): void;
+    /**
+     * Load the caller's tenant memberships into the session.
+     *
+     * `signInWithEmail` gets them in its response, but a session established from
+     * an external credential (a Firebase ID token from a Google popup) has no
+     * such response — it arrives with claims only. Claims carry the *current*
+     * tenant, not the list, and a platform admin's claims carry no tenant roles
+     * at all, so a console that gates its navigation on `admin`/`owner` shows an
+     * almost empty menu until this runs.
+     *
+     * @return {Promise<TenantMembership[]>} The loaded memberships.
+     */
+    loadMemberships(): Promise<TenantMembership[]>;
+    signInWithEmail(email: string, password: string): Promise<AuthUser>;
+    signInWithEmailAndPassword(email: string, password: string): Promise<AuthUser>;
+    signUp(email: string, password: string, options?: {
+        displayName?: string;
+        phoneNumber?: string;
+    }): Promise<AuthUser>;
+    signOut(): Promise<void>;
+    sendPasswordResetEmail(email: string): Promise<void>;
+    onAuthStateChanged(callback: AuthStateCallback): () => void;
+    private notifyAuthStateCallbacks;
+    refreshAuthToken(): Promise<void>;
+    switchTenant(tenantId: string): Promise<AuthUser>;
+    getUserMemberships(): Promise<{
+        tenantId: string;
+        tenantName: string;
+        roles: string[];
+        status: string;
+    }[]>;
+    hasScope(scope: string): boolean;
+    hasRole(role: string): boolean;
+    hasAnyRole(roles: string[]): boolean;
+    hasAllScopes(scopes: string[]): boolean;
+    /**
+     * Get the current ID token for use with external services
+     */
+    getIdToken(forceRefresh?: boolean): Promise<string | null>;
+    /**
+     * Update the current user's password.
+     * Backend dispatch 'updatePassword' → data { currentPassword, newPassword }.
+     */
+    updatePassword(currentPassword: string, newPassword: string): Promise<void>;
+    /**
+     * Send email verification.
+     * Backend dispatch 'resendVerificationEmail' — uid resolved from auth context, no payload needed.
+     */
+    sendEmailVerification(): Promise<void>;
+    /**
+     * Verify email with code
+     */
+    verifyEmail(code: string): Promise<void>;
+    /**
+     * Confirm password reset with code
+     */
+    confirmPasswordReset(code: string, newPassword: string): Promise<void>;
+    /**
+     * OAuth redirect-based sign-in is NOT supported by this backend.
+     * The backend has no /oauth/initiate or /oauth/callback routes.
+     * Use signInWithOAuthToken() with a provider-issued ID token instead,
+     * or use the Firebase Client SDK directly for OAuth redirect flows.
+     */
+    signInWithOAuth(_provider: 'google' | 'apple' | 'github' | 'microsoft'): Promise<{
+        redirectUrl: string;
+    }>;
+    /**
+     * OAuth redirect callback handling is NOT supported by this backend.
+     * Use signInWithOAuthToken() with a provider-issued ID token instead,
+     * or use the Firebase Client SDK directly for OAuth redirect flows.
+     */
+    handleOAuthCallback(_code: string, _state: string): Promise<AuthUser>;
+    /**
+     * Sign in with OAuth ID token directly (for native apps)
+     * Use this when you have already obtained the ID token from the OAuth provider
+     */
+    signInWithOAuthToken(provider: 'google' | 'apple' | 'github' | 'microsoft', idToken: string): Promise<AuthUser>;
+    /**
+     * OAuth redirect-based account linking is NOT supported by this backend.
+     * The backend has no /oauth/link/initiate route.
+     * Use the Firebase Client SDK linkWithRedirect() or linkWithPopup() instead.
+     */
+    linkWithOAuth(_provider: 'google' | 'apple' | 'github' | 'microsoft'): Promise<{
+        redirectUrl: string;
+    }>;
+    /**
+     * OAuth redirect link callback is NOT supported by this backend.
+     * The backend has no /oauth/link/callback route.
+     * Use the Firebase Client SDK for OAuth redirect link flows.
+     */
+    handleOAuthLinkCallback(_code: string, _state: string): Promise<void>;
+    /**
+     * Unlink OAuth provider from current account
+     */
+    unlinkOAuth(provider: 'google' | 'apple' | 'github' | 'microsoft'): Promise<void>;
+    /**
+     * Get linked OAuth providers for current user
+     */
+    getLinkedProviders(): Promise<string[]>;
+    updateCurrentUser(userData: {
+        uid: string;
+        email: string;
+        displayName?: string | null;
+        tenantId: string;
+        roles: string[];
+        scopes: string[];
+    }, membership?: TenantMembership): void;
+}
+
+interface MAKEMINDDataConfig extends MAKEMINDConfig {
+    apiClient: ApiClient;
+    tenantId: () => string | null;
+}
+declare class MAKEMINDData {
+    private apiClient;
+    private applicationId;
+    private getTenantId;
+    private subscriptions;
+    constructor(config: MAKEMINDDataConfig);
+    private get tenantId();
+    query<T = Record<string, unknown>>(options: QueryOptions): Promise<QueryResult<T>>;
+    get<T = Record<string, unknown>>(options: GetOptions): Promise<DocumentResult<T> | null>;
+    create<T = Record<string, unknown>>(options: CreateOptions): Promise<DocumentResult<T>>;
+    update(options: UpdateOptions): Promise<void>;
+    delete(options: DeleteOptions): Promise<void>;
+    onSnapshot<T = Record<string, unknown>>(options: GetOptions, callback: SnapshotCallback<T>): Unsubscribe;
+    onCollectionSnapshot<T = Record<string, unknown>>(options: QueryOptions, callback: CollectionSnapshotCallback<T>): Unsubscribe;
+    private createSubscription;
+    private createCollectionSubscription;
+    private pollForUpdates;
+    private closeSubscription;
+    collectionGroupQuery<T = Record<string, unknown>>(_options: Omit<QueryOptions, 'collection'> & {
+        collection: string;
+    }): Promise<QueryResult<T>>;
+    queryTenant<T = Record<string, unknown>>(collectionName: string, additionalConditions?: QueryCondition[], orderByOptions?: OrderBy[], limitCount?: number): Promise<QueryResult<T>>;
+    batchCreate<T = Record<string, unknown>>(collection: string, documents: Array<{
+        data: Record<string, unknown>;
+        documentId?: string;
+    }>): Promise<Array<DocumentResult<T>>>;
+    batchUpdate(collection: string, updates: Array<{
+        documentId: string;
+        data: Record<string, unknown>;
+    }>): Promise<void>;
+    batchDelete(collection: string, documentIds: string[]): Promise<void>;
+    exportCollection(options: {
+        collection: string;
+        format?: 'json' | 'csv';
+        filter?: Record<string, unknown>;
+    }): Promise<{
+        jobId: string;
+        status: string;
+    }>;
+    importCollection(options: {
+        collection: string;
+        sourcePath: string;
+        format?: 'json' | 'csv';
+        upsert?: boolean;
+    }): Promise<{
+        jobId: string;
+        status: string;
+    }>;
+    getExportStatus(jobId: string): Promise<{
+        jobId: string;
+        status: 'pending' | 'running' | 'completed' | 'failed';
+        documentCount?: number;
+        downloadUrl?: string;
+        error?: string;
+        completedAt?: unknown;
+    }>;
+    getImportStatus(jobId: string): Promise<{
+        jobId: string;
+        status: 'pending' | 'validating' | 'running' | 'completed' | 'failed';
+        totalRecords?: number;
+        processedRecords?: number;
+        skippedRecords?: number;
+        failedRecords?: number;
+        error?: string;
+        completedAt?: unknown;
+    }>;
+    aggregate(options: {
+        collection: string;
+        filters?: QueryCondition[];
+        aggregations: Array<{
+            type: 'count' | 'sum' | 'avg' | 'min' | 'max';
+            field?: string;
+            alias: string;
+        }>;
+    }): Promise<{
+        results: Record<string, unknown>;
+        documentCount: number;
+    }>;
+    search<T = Record<string, unknown>>(options: {
+        collection: string;
+        query: string;
+        fields: string[];
+        limit?: number;
+    }): Promise<{
+        results: Array<T & {
+            _score: number;
+        }>;
+        total: number;
+    }>;
+}
+
+interface MAKEMINDLogicConfig extends MAKEMINDConfig {
+    apiClient: ApiClient;
+    tenantId: () => string | null;
+}
+interface FlowDefinition {
+    id?: string;
+    name: string;
+    description: string;
+    mode: 'form' | 'code';
+    trigger: {
+        type: 'event' | 'schedule' | 'manual' | 'webhook' | 'data';
+        [key: string]: unknown;
+    };
+    definition: unknown;
+    variables?: Record<string, unknown>;
+}
+/**
+ * A row of `GET /logic/flows`, as the gateway actually answers it.
+ *
+ * This declared six fields while the route returns eighteen, so every consumer
+ * that needed `publicExecution` or `mode` cast the row to read them — the
+ * portal does exactly that. A type that under-describes a payload does not
+ * protect the caller; it just moves the reading of it out of the type system.
+ *
+ * `status` said `'active'`, which the route never sends: a published flow is
+ * stored and returned as `'published'` (logic/service/flows.ts). Consumers
+ * translating `'active' -> 'published'` were translating a value that never
+ * arrives.
+ */
+interface ListFlowsParams {
+    status?: 'draft' | 'published' | 'disabled' | 'archived';
+    mode?: 'form' | 'code' | 'hybrid';
+    /** Rows per page. The gateway caps this at 100 and defaults to it. */
+    limit?: number;
+    /** `nextCursor` from a previous page. */
+    cursor?: string;
+}
+interface ListFlowsResult {
+    flows: FlowListItem[];
+    /** True when the server had more rows than this page carries. */
+    hasMore: boolean;
+    nextCursor?: string;
+}
+interface FlowListItem {
+    id: string;
+    name: string;
+    description: string;
+    status: 'draft' | 'published' | 'archived';
+    mode?: 'form' | 'code' | 'hybrid';
+    trigger?: unknown;
+    definition?: unknown;
+    variables?: unknown;
+    isSubflow?: boolean;
+    inputSchema?: unknown;
+    outputSchema?: unknown;
+    /** Whether the flow may be executed from a published app without a session. */
+    publicExecution?: boolean;
+    partyInput?: unknown;
+    durable?: boolean;
+    currentVersion?: number;
+    publishedVersion?: number;
+    createdAt: Date;
+    updatedAt: Date;
+}
+declare class MAKEMINDLogic {
+    private apiClient;
+    private getTenantId;
+    constructor(config: MAKEMINDLogicConfig);
+    transition(options: WorkflowTransitionOptions): Promise<LogicCallResult>;
+    call(functionName: string, input?: unknown): Promise<LogicCallResult>;
+    executeFlow(flowId: string, input?: unknown, options?: {
+        idempotencyKey?: string;
+    }): Promise<LogicCallResult>;
+    getExecution(executionId: string): Promise<{
+        id: string;
+        flowId: string;
+        status: string;
+        startedAt: Date;
+        completedAt?: Date;
+        output?: unknown;
+        error?: {
+            code: string;
+            message: string;
+        };
+    }>;
+    listExecutions(options?: {
+        flowId?: string;
+        status?: string;
+        limit?: number;
+        startAfter?: string;
+    }): Promise<{
+        executions: Array<{
+            id: string;
+            flowId: string;
+            status: string;
+            startedAt: Date;
+            completedAt?: Date;
+        }>;
+        nextCursor?: string;
+        hasMore: boolean;
+    }>;
+    sendSignal(executionId: string, signalName: string, payload?: unknown): Promise<{
+        success: boolean;
+    }>;
+    /**
+     * Cancel a running workflow execution
+     */
+    cancelWorkflow(executionId: string, reason?: string): Promise<{
+        success: boolean;
+    }>;
+    /**
+     * Retry a failed workflow execution
+     */
+    retryWorkflow(executionId: string): Promise<{
+        success: boolean;
+        newExecutionId: string;
+    }>;
+    /**
+     * Pause a running workflow execution
+     */
+    pauseWorkflow(executionId: string): Promise<{
+        success: boolean;
+    }>;
+    /**
+     * Resume a paused workflow execution
+     */
+    resumeWorkflow(executionId: string): Promise<{
+        success: boolean;
+    }>;
+    ecoTransition(ecoId: string, action: 'submit' | 'approve' | 'reject' | 'implement' | 'recall', data?: Record<string, unknown>): Promise<LogicCallResult>;
+    ncrTransition(issueId: string, action: 'assignContainment' | 'analyze' | 'defineCorrective' | 'implement' | 'verifyEffective' | 'close', data?: Record<string, unknown>): Promise<LogicCallResult>;
+    bidTransition(requestId: string, bidId: string, action: 'submit' | 'approve' | 'reject' | 'withdraw', data?: Record<string, unknown>): Promise<LogicCallResult>;
+    gateApproval(productId: string, gate: 'production' | 'sales' | 'custom', action: 'approve' | 'reject', comment?: string): Promise<LogicCallResult>;
+    accessDocument(documentId: string, action: 'view' | 'download' | 'print'): Promise<{
+        url: string;
+        expiresIn: number;
+    }>;
+    createFlow(flow: Omit<FlowDefinition, 'id'>): Promise<{
+        id: string;
+    }>;
+    updateFlow(flowId: string, updates: Partial<FlowDefinition>): Promise<void>;
+    publishFlow(flowId: string): Promise<void>;
+    archiveFlow(flowId: string): Promise<void>;
+    /**
+     * A page of the tenant's flows.
+     *
+     * Took no arguments and returned a bare array, so a caller wanting one
+     * state — published flows, to offer as event handlers — pulled every state
+     * and filtered locally. The server has always been able to filter; asking
+     * it to means the page is spent on rows the caller wants.
+     *
+     * `hasMore` is returned rather than implied. A full page and a truncated
+     * one are the same array, and a caller that cannot tell them apart quietly
+     * drops whatever did not fit.
+     */
+    listFlows(params?: ListFlowsParams): Promise<ListFlowsResult>;
+    getFlow(flowId: string): Promise<FlowDefinition>;
+    testFlow(flowId: string, testInput: unknown): Promise<LogicCallResult>;
+    cloneFlow(flowId: string, newName: string): Promise<{
+        id: string;
+    }>;
+    listVariables(): Promise<Array<{
+        id: string;
+        name: string;
+        type: 'string' | 'number' | 'boolean' | 'json' | 'secret';
+        value?: unknown;
+        isSecret: boolean;
+        createdAt: Date;
+        updatedAt: Date;
+    }>>;
+    getVariable(variableId: string): Promise<{
+        id: string;
+        name: string;
+        type: 'string' | 'number' | 'boolean' | 'json' | 'secret';
+        value?: unknown;
+        isSecret: boolean;
+    }>;
+    createVariable(data: {
+        name: string;
+        type: 'string' | 'number' | 'boolean' | 'json' | 'secret';
+        value: unknown;
+        description?: string;
+    }): Promise<{
+        id: string;
+    }>;
+    updateVariable(variableId: string, data: {
+        value?: unknown;
+        description?: string;
+    }): Promise<void>;
+    deleteVariable(variableId: string): Promise<void>;
+    listTemplates(): Promise<Array<{
+        id: string;
+        name: string;
+        description: string;
+        category: string;
+        isPublic: boolean;
+        createdAt: Date;
+    }>>;
+    getTemplate(templateId: string): Promise<{
+        id: string;
+        name: string;
+        description: string;
+        definition: unknown;
+        variables: Array<{
+            name: string;
+            type: string;
+            defaultValue?: unknown;
+        }>;
+    }>;
+    createFlowFromTemplate(templateId: string, data: {
+        name: string;
+        description?: string;
+        variables?: Record<string, unknown>;
+    }): Promise<{
+        flowId: string;
+    }>;
+    listWebhooks(): Promise<Array<{
+        id: string;
+        name: string;
+        url: string;
+        flowId: string;
+        isActive: boolean;
+        createdAt: Date;
+    }>>;
+    createWebhook(data: {
+        name: string;
+        flowId: string;
+        description?: string;
+    }): Promise<{
+        id: string;
+        url: string;
+        secret: string;
+    }>;
+    deleteWebhook(webhookId: string): Promise<void>;
+    rotateWebhookSecret(webhookId: string): Promise<{
+        secret: string;
+    }>;
+    listPendingApprovals(): Promise<Array<{
+        id: string;
+        executionId: string;
+        flowName: string;
+        requestedBy: string;
+        requestedAt: Date;
+        expiresAt?: Date;
+    }>>;
+    approveRequest(approvalId: string, comment?: string): Promise<void>;
+    rejectRequest(approvalId: string, reason: string): Promise<void>;
+    listDataTriggers(): Promise<Array<{
+        id: string;
+        name: string;
+        collection: string;
+        operation: 'create' | 'update' | 'delete';
+        flowId: string;
+        isActive: boolean;
+    }>>;
+    createDataTrigger(data: {
+        name: string;
+        collection: string;
+        operation: 'create' | 'update' | 'delete';
+        flowId: string;
+        conditions?: Array<{
+            field: string;
+            operator: string;
+            value: unknown;
+        }>;
+    }): Promise<{
+        id: string;
+    }>;
+    deleteDataTrigger(triggerId: string): Promise<void>;
+    toggleDataTrigger(triggerId: string, isActive: boolean): Promise<void>;
+    generateFlowFromPrompt(prompt: string): Promise<{
+        suggestedFlow: FlowDefinition;
+        explanation: string;
+    }>;
+    explainFlow(flowId: string): Promise<{
+        summary: string;
+        steps: Array<{
+            step: number;
+            description: string;
+        }>;
+        suggestedImprovements?: string[];
+    }>;
+}
+
+interface MAKEMINDTenantConfig extends MAKEMINDConfig {
+    apiClient: ApiClient;
+    tenantId: () => string | null;
+    /**
+     * Called after a tenant is created so the client can activate the new tenant
+     * context (set the active tenant id and refresh the session token so the new
+     * tenant's claims take effect immediately).
+     */
+    onTenantCreated?: (tenantId: string, customToken?: string) => Promise<void>;
+}
+declare class MAKEMINDTenant {
+    private apiClient;
+    private getTenantId;
+    private onTenantCreated?;
+    constructor(config: MAKEMINDTenantConfig);
+    private get tenantId();
+    createTenant(data: {
+        name: string;
+        plan?: string;
+        industryType?: string;
+        /**
+         * 'test' creates a sandbox tenant: usage is recorded non-billable and rate
+         * limits are capped at the sandbox tier — use it to run conformance/
+         * integration checks without incurring cost. Defaults to 'live'.
+         */
+        mode?: 'test' | 'live';
+        settings?: {
+            displayName?: string;
+            type?: string;
+            [key: string]: unknown;
+        };
+    }): Promise<{
+        id: string;
+        name: string;
+        workspaceId: string;
+        status: string;
+        user?: {
+            uid: string;
+            email: string;
+            displayName: string | null;
+            tenantId: string;
+            roles: string[];
+            scopes: string[];
+        };
+        customToken?: string;
+    }>;
+    getCurrent(): Promise<Tenant | null>;
+    getTenant(tenantId: string): Promise<Tenant | null>;
+    onTenantSnapshot(callback: (tenant: Tenant | null) => void): Unsubscribe;
+    updateTenant(updates: {
+        displayName?: string;
+        settings?: Record<string, unknown>;
+    }): Promise<void>;
+    listMembers(): Promise<TenantMember[]>;
+    inviteMember(data: {
+        email: string;
+        roles: string[];
+        scopes?: string[];
+    }): Promise<void>;
+    updateMember(userId: string, updates: {
+        roles?: string[];
+        scopes?: string[];
+    }): Promise<void>;
+    removeMember(userId: string): Promise<void>;
+    listWorkspaces(): Promise<Workspace[]>;
+    createWorkspace(data: {
+        name: string;
+        displayName: string;
+        settings?: Record<string, unknown>;
+        type?: 'default' | 'development' | 'staging' | 'production';
+    }): Promise<{
+        workspaceId: string;
+    }>;
+    updateWorkspace(workspaceId: string, updates: {
+        displayName?: string;
+        settings?: Record<string, unknown>;
+    }): Promise<{
+        success: boolean;
+    }>;
+    deleteWorkspace(workspaceId: string): Promise<{
+        success: boolean;
+    }>;
+}
+
+interface RegisterDeviceOptions {
+    platform: 'ios' | 'android' | 'web';
+    deviceId?: string;
+}
+interface PushMessage {
+    messageId: string;
+    title?: string;
+    body: string;
+    data?: Record<string, string>;
+}
+interface MAKEMINDMessagingConfig extends MAKEMINDConfig {
+    apiClient: ApiClient;
+    tenantId: () => string | null;
+    userId: () => string | null;
+    firebaseApp?: FirebaseApp;
+    vapidKey?: string;
+}
+declare class MAKEMINDMessaging {
+    private apiClient;
+    private applicationId;
+    private getTenantId;
+    private getUserId;
+    private firebaseApp?;
+    private vapidKey?;
+    private messaging?;
+    private currentDeviceId?;
+    constructor(config: MAKEMINDMessagingConfig);
+    private get tenantId();
+    private get userId();
+    private getMessaging;
+    private generateDeviceId;
+    /**
+     * Send a message using a template via the sendBatchMessages onCall.
+     * Maps SDK SendMessageOptions to the batch service: one call per channel.
+     */
+    send(options: SendMessageOptions): Promise<{
+        messageId: string;
+    }>;
+    /**
+     * Send notification to specific users across channels.
+     * Uses sendBatchMessages onCall (one dispatch per channel).
+     */
+    notify(userIds: string[], notification: {
+        title: string;
+        body: string;
+        data?: Record<string, unknown>;
+        channels?: ('push' | 'email' | 'sms')[];
+    }): Promise<{
+        messageId: string;
+    }>;
+    /**
+     * Register device for push notifications.
+     * SDK internally handles token acquisition (Firebase FCM).
+     * Uses the REST /messaging/devices route (already correct).
+     */
+    registerDevice(options: RegisterDeviceOptions): Promise<{
+        deviceId: string;
+    }>;
+    /**
+     * Internal: Acquire push token from the platform's push service.
+     * Currently uses Firebase FCM, abstracted for future cloud-agnostic support.
+     */
+    private acquirePushToken;
+    /**
+     * Unregister device from push notifications.
+     * Uses the REST DELETE /messaging/devices/:token route.
+     * The route key is the raw FCM token (server base64-encodes it to deviceId).
+     */
+    unregisterDevice(deviceId: string): Promise<void>;
+    /**
+     * Listen for foreground push messages.
+     */
+    onPushMessage(callback: (message: PushMessage) => void): Unsubscribe;
+    /**
+     * Get in-app notifications for the current user.
+     * Dispatch op: messaging-getInAppNotifications
+     * Service contract: { userId?, unreadOnly?, limit?, cursor? }
+     * Response: { notifications, hasMore, nextCursor }
+     */
+    getNotifications(options?: {
+        unreadOnly?: boolean;
+        limit?: number;
+        cursor?: string;
+    }): Promise<{
+        notifications: Notification[];
+        nextCursor?: string;
+    }>;
+    /**
+     * Get in-app notifications stream (polling-based).
+     */
+    onNotifications(callback: (notifications: Notification[]) => void, options?: {
+        unreadOnly?: boolean;
+        limitCount?: number;
+    }): Unsubscribe;
+    /**
+     * Get unread notification count.
+     * Dispatch op: messaging-getUnreadNotificationCount (the verified onCall service).
+     * Response: { userId, unreadCount }
+     */
+    getUnreadCount(): Promise<number>;
+    /**
+     * Get unread notification count stream (polling-based).
+     */
+    onUnreadCount(callback: (count: number) => void): Unsubscribe;
+    /**
+     * Mark a notification as read.
+     * Dispatch op: messaging-markNotificationRead
+     * Service contract: { notificationId } or { notificationIds }
+     */
+    markAsRead(notificationId: string): Promise<void>;
+    /**
+     * Mark all notifications as read for the current user.
+     * Dispatch op: messaging-markAllNotificationsRead (new onCall — no existing match).
+     * Implemented in backend send.ts + service/send.ts below.
+     */
+    markAllAsRead(): Promise<void>;
+    /**
+     * Notify ECO reviewers.
+     */
+    notifyEcoReviewers(eco: {
+        requestNumber: string;
+        title: string;
+        priority: string;
+        productCode?: string;
+    }, reviewerIds: string[]): Promise<{
+        messageId: string;
+    }>;
+    /**
+     * Notify quality issue critical.
+     */
+    notifyQualityCritical(issue: {
+        issueNumber: string;
+        title: string;
+        severity: string;
+    }, recipientIds: string[]): Promise<{
+        messageId: string;
+    }>;
+    /**
+     * Notify bid received.
+     */
+    notifyBidReceived(request: {
+        requestNumber: string;
+        title: string;
+    }, bidder: {
+        name: string;
+    }, ownerId: string): Promise<{
+        messageId: string;
+    }>;
+    /**
+     * List available message templates.
+     * Dispatch op: messaging-msgGetTemplates (the verified onCall service).
+     * Service contract: { channelType? }
+     * Response: { templates }
+     */
+    listTemplates(options?: {
+        channel?: 'push' | 'email' | 'sms';
+        status?: 'active' | 'draft';
+    }): Promise<MessageTemplate[]>;
+    /**
+     * Get a specific template by ID.
+     * Dispatch op: messaging-msgGetTemplate
+     * Service contract: { templateId }
+     * Response: template document (FirebaseFirestore.DocumentData)
+     */
+    getTemplate(templateId: string): Promise<MessageTemplate>;
+    /**
+     * Create a new message template.
+     * Dispatch op: messaging-msgCreateTemplate
+     * Service contract: { name, channelType, subject?, body, bodyHtml?, language?, variables?, description? }
+     * Response: { templateId }
+     * Note: backend returns { templateId }; SDK surface returns full MessageTemplate.
+     * We re-fetch the created template to satisfy the return type.
+     */
+    createTemplate(template: CreateTemplateOptions): Promise<MessageTemplate>;
+    /**
+     * Update an existing template.
+     * Dispatch op: messaging-msgUpdateTemplate
+     * Service contract: { templateId, subject?, body?, bodyHtml?, language?, variables?, description? }
+     * Response: { success }
+     * We re-fetch the updated template to satisfy the return type.
+     */
+    updateTemplate(templateId: string, updates: Partial<CreateTemplateOptions>): Promise<MessageTemplate>;
+    /**
+     * Delete a template.
+     * Dispatch op: messaging-msgDeleteTemplate
+     * Service contract: { templateId }
+     * Response: { success }
+     */
+    deleteTemplate(templateId: string): Promise<void>;
+    /**
+     * Subscribe to a topic for push notifications.
+     * Dispatch op: messaging-subscribeToTopic
+     * Service contract: { token, topic, tenantId }
+     * Token is acquired from the current device registration.
+     * If no token is available, the subscription request is sent with userId context only.
+     */
+    subscribeToTopic(topic: string): Promise<void>;
+    /**
+     * Unsubscribe from a topic.
+     * Dispatch op: messaging-unsubscribeFromTopic
+     * Service contract: { token, topic, tenantId }
+     */
+    unsubscribeFromTopic(topic: string): Promise<void>;
+    /**
+     * List subscribed topics for the current user.
+     * Dispatch op: messaging-getMyTopics
+     * Service contract: { tenantId? }
+     * Response: { topics: Array<{ topic, fullTopic, tenantId, subscribedAt }> }
+     */
+    listSubscribedTopics(): Promise<string[]>;
+    /**
+     * Send message to a topic.
+     * Dispatch op: messaging-sendTopicMessage
+     * Service contract: { topic, subject?, body, imageUrl?, data? }
+     * Response: { messageId, fcmMessageId }
+     */
+    sendToTopic(topic: string, message: {
+        title: string;
+        body: string;
+        data?: Record<string, string>;
+    }): Promise<{
+        messageId: string;
+    }>;
+    /**
+     * Get message history for this tenant.
+     * Dispatch op: messaging-getMessages
+     * Service contract: { channelType?, status?, limit? }
+     * Response: { messages }
+     */
+    getMessageHistory(options?: {
+        channel?: 'push' | 'email' | 'sms';
+        status?: 'sent' | 'delivered' | 'failed';
+        limit?: number;
+        cursor?: string;
+    }): Promise<{
+        messages: MessageHistoryItem[];
+        nextCursor?: string;
+    }>;
+    /**
+     * Get full details of a single message.
+     * Dispatch op: messaging-getMessage
+     * Service contract: { messageId }
+     * Response: full message document (FirebaseFirestore.DocumentData)
+     */
+    getMessageDetails(messageId: string): Promise<MessageDetails>;
+    /**
+     * Retry a failed message.
+     * No backend messaging onCall exists for retry (confirmed: two searches — grep
+     * across messaging/service/* and messaging/*.ts both returned no match).
+     * Dispatch op: messaging-retryFailedMessage (new onCall implemented below).
+     */
+    retryMessage(messageId: string): Promise<{
+        messageId: string;
+    }>;
+}
+interface MessageTemplate {
+    id: string;
+    name: string;
+    channel: 'push' | 'email' | 'sms';
+    subject?: string;
+    body: string;
+    variables: string[];
+    status: 'active' | 'draft';
+    language?: string;
+    createdAt: Date;
+    updatedAt: Date;
+}
+interface CreateTemplateOptions {
+    name: string;
+    channel: 'push' | 'email' | 'sms';
+    subject?: string;
+    body: string;
+    variables?: string[];
+    status?: 'active' | 'draft';
+    language?: string;
+}
+interface MessageHistoryItem {
+    id: string;
+    channel: 'push' | 'email' | 'sms';
+    template?: string;
+    recipientCount: number;
+    status: 'sent' | 'delivered' | 'failed' | 'partial';
+    sentAt: Date;
+}
+interface MessageDetails {
+    id: string;
+    channel: 'push' | 'email' | 'sms';
+    template?: string;
+    recipients: Array<{
+        userId: string;
+        status: 'sent' | 'delivered' | 'failed';
+        deliveredAt?: Date;
+        error?: string;
+    }>;
+    subject?: string;
+    body: string;
+    data?: Record<string, unknown>;
+    sentAt: Date;
+}
+
+interface MAKEMINDPartnersConfig extends MAKEMINDConfig {
+    apiClient: ApiClient;
+    tenantId: () => string | null;
+}
+type CommissionRate = {
+    kind: 'flatPercent';
+    percent: number;
+} | {
+    kind: 'fixedPerTransaction';
+    amount: number;
+    currency: string;
+} | {
+    kind: 'excluded';
+};
+/** One row of a partner's rate card. revenueType '*' is the default. */
+interface CommissionTerm {
+    revenueType: string;
+    rate: CommissionRate;
+}
+interface PartnerAttribution {
+    scope: 'tenantMargin' | 'layer1';
+    base: 'margin' | 'gmv';
+    /** Rate card: per-product rates, with an optional '*' default and exclusions. */
+    terms: CommissionTerm[];
+    validFrom: string | Date;
+    validUntil: string | Date | null;
+    status: 'active' | 'paused' | 'ended';
+}
+interface CommissionStatementLine {
+    sourceId: string;
+    sourceName: string | null;
+    currency: string;
+    accrued: number;
+    paid: number;
+    owed: number;
+}
+interface PartnerCommissionStatement {
+    partnerId: string;
+    lines: CommissionStatementLine[];
+    totalsByCurrency: Array<{
+        currency: string;
+        accrued: number;
+        paid: number;
+        owed: number;
+    }>;
+}
+/**
+ * Partner commission overlay client. The same API backs both the central portal
+ * and a tenant's own admin (a tenant embeds partner management in its SaaS via
+ * these tenant-admin methods); Guild consumes the platform-admin methods to
+ * manage the partners of our own SaaSes.
+ */
+declare class MAKEMINDPartners {
+    private apiClient;
+    constructor(config: MAKEMINDPartnersConfig);
+    /** Register the signed-in individual as a partner (requires a verified email). */
+    registerSelf(displayName?: string): Promise<{
+        partnerId: string;
+    }>;
+    /** Browse the open partner-program directory. */
+    listPrograms(): Promise<{
+        programs: unknown[];
+    }>;
+    /** Apply to a tenant's program (creates a pending registration). */
+    apply(tenantId: string): Promise<{
+        registration: unknown;
+    }>;
+    /** Auto-attribute a subject to a partner via a referral code (at checkout/entry). */
+    registerReferral(input: {
+        code: string;
+        subjectType: 'endCustomer' | 'tenant' | 'sale';
+        subjectId: string;
+        expiresAt?: string | null;
+    }): Promise<{
+        referral: unknown;
+    }>;
+    /** Derive commission for a settled sale for any partner that referred the subject. */
+    deriveCommission(input: {
+        subjectId: string;
+        revenueType: string;
+        baseAmount: number;
+        currency: string;
+        saleId: string;
+        tenantId?: string;
+    }): Promise<{
+        entries: unknown[];
+    }>;
+    /**
+     * Canonical settlement intake: report a revenue event; the engine derives the
+     * full line set (tax + commission + net waterfall) and records partner
+     * commissions when a saleId is given.
+     */
+    deriveSettlementForEvent(input: {
+        revenue: {
+            category: string;
+            amount: number;
+            currency: string;
+            priceTaxMode: 'inclusive' | 'exclusive';
+            supplyType?: string;
+            recognition?: 'pointInTime' | 'overTime';
+        };
+        seller: {
+            role: 'seller';
+            country?: string;
+        };
+        buyer: {
+            role: 'buyer';
+            country?: string;
+            isBusiness?: boolean;
+            taxId?: string;
+            taxIdValidated?: boolean;
+        };
+        fees?: Array<{
+            category: string;
+            amount: number;
+            treatment: 'deductFromProceeds' | 'addToCost';
+        }>;
+        platformFee?: number;
+        saleId?: string;
+        subjectId?: string;
+        at?: string;
+        tenantId?: string;
+    }): Promise<{
+        lines: unknown[];
+        waterfall: unknown;
+        taxRate: number;
+        reverseCharge: boolean;
+    }>;
+    /** Publish/update the tenant's partner program (directory listing). */
+    publishProgram(input: {
+        description: string;
+        offeredTerms: CommissionTerm[];
+        status?: 'open' | 'closed';
+        scope?: 'tenantMargin' | 'layer1';
+        tenantId?: string;
+    }): Promise<{
+        program: unknown;
+    }>;
+    /** Approve a pending/invited registration (optionally overriding the rate). */
+    approve(input: {
+        partnerId: string;
+        attribution?: PartnerAttribution;
+        tenantId?: string;
+    }): Promise<{
+        ok: true;
+    }>;
+    /** Add an already-registered partner directly by id (arranged relationship). */
+    addById(input: {
+        partnerId: string;
+        attribution: PartnerAttribution;
+        tenantId?: string;
+    }): Promise<{
+        ok: true;
+    }>;
+    /** Invite a partner by email (fallback for someone not yet self-registered). */
+    invite(input: {
+        email: string;
+        attribution: PartnerAttribution;
+        tenantId?: string;
+    }): Promise<{
+        partnerId: string;
+    }>;
+    /** List the partners registered in the current tenant. */
+    list(tenantId?: string): Promise<{
+        registrations: unknown[];
+    }>;
+    /** Update a registration's rate and/or status. */
+    update(input: {
+        partnerId: string;
+        attribution?: PartnerAttribution;
+        status?: 'active' | 'paused' | 'ended';
+        tenantId?: string;
+    }): Promise<{
+        ok: true;
+    }>;
+    /** Record a commission accrual for the current tenant (idempotent on idempotencyKey). */
+    recordCommission(input: {
+        partnerId: string;
+        amount: number;
+        currency: string;
+        idempotencyKey: string;
+        scope?: 'tenantMargin' | 'layer1';
+        sourceRef?: string | null;
+        tenantId?: string;
+    }): Promise<{
+        entry: unknown;
+    }>;
+    /** Claw back a commission entry. */
+    reverseCommission(entryId: string): Promise<{
+        reversal: unknown;
+    }>;
+    /** Record a manual payout against a partner's owed commission. */
+    recordPayout(input: {
+        partnerId: string;
+        tenantId: string | null;
+        amount: number;
+        currency: string;
+        ref?: string | null;
+    }): Promise<{
+        payout: unknown;
+    }>;
+    /** Accept an invitation, claiming the partner identity (requires a verified email). */
+    acceptInvitation(partnerId: string, tenantId: string): Promise<{
+        partnerId: string;
+        tenantId: string;
+    }>;
+    /** The signed-in partner's own cross-tenant commission statement (union). */
+    myCommissions(): Promise<{
+        statement: PartnerCommissionStatement;
+    }>;
+    /** Any partner's statement (platform admin only). */
+    commissionsOf(partnerId: string): Promise<{
+        statement: PartnerCommissionStatement;
+    }>;
+}
+
+interface MAKEMINDStorageConfig extends MAKEMINDConfig {
+    apiClient: ApiClient;
+    tenantId: () => string | null;
+}
+interface UploadOptions {
+    path: string;
+    file: File | Blob;
+    metadata?: Record<string, string>;
+    onProgress?: (progress: number) => void;
+}
+interface UploadResult {
+    path: string;
+    url: string;
+    size: number;
+    contentType: string;
+    metadata?: Record<string, string>;
+}
+interface FileMetadata {
+    name: string;
+    path: string;
+    size: number;
+    contentType: string;
+    createdAt: Date;
+    updatedAt: Date;
+    metadata?: Record<string, string>;
+}
+interface ListFilesOptions {
+    prefix?: string;
+    maxResults?: number;
+    pageToken?: string;
+}
+interface ListFilesResult {
+    files: FileMetadata[];
+    nextPageToken?: string;
+}
+declare class MAKEMINDStorage {
+    private apiClient;
+    private getTenantId;
+    constructor(config: MAKEMINDStorageConfig);
+    private get tenantId();
+    /**
+     * Encode a storage object path for use as a path parameter, preserving the
+     * `/` separators (the gateway captures the full sub-path via a wildcard).
+     */
+    private encodePath;
+    /**
+     * Upload a file
+     */
+    upload(options: UploadOptions): Promise<UploadResult>;
+    private uploadToSignedUrl;
+    /**
+     * Get download URL for a file
+     */
+    getDownloadUrl(path: string): Promise<string>;
+    /**
+     * Download a file directly
+     * Returns the file as a Blob
+     */
+    download(path: string): Promise<Blob>;
+    /**
+     * Download a file and trigger browser download
+     */
+    downloadToFile(path: string, filename?: string): Promise<void>;
+    /**
+     * Get file metadata
+     */
+    getMetadata(path: string): Promise<FileMetadata>;
+    /**
+     * Update file metadata
+     */
+    updateMetadata(path: string, metadata: Record<string, string>): Promise<void>;
+    /**
+     * List files in a directory
+     */
+    listFiles(options?: ListFilesOptions): Promise<ListFilesResult>;
+    /**
+     * Delete a file
+     */
+    delete(path: string): Promise<void>;
+    /**
+     * Delete multiple files
+     */
+    deleteMany(paths: string[]): Promise<void>;
+    /**
+     * Copy a file
+     */
+    copy(sourcePath: string, destinationPath: string): Promise<UploadResult>;
+    /**
+     * Move a file
+     */
+    move(sourcePath: string, destinationPath: string): Promise<UploadResult>;
+    /**
+     * Upload a document for a product
+     */
+    uploadProductDocument(productId: string, file: File, options?: {
+        documentType?: string;
+        version?: string;
+        onProgress?: (progress: number) => void;
+    }): Promise<UploadResult>;
+    /**
+     * Upload an ECO attachment
+     */
+    uploadEcoAttachment(ecoId: string, file: File, onProgress?: (progress: number) => void): Promise<UploadResult>;
+    /**
+     * Upload a quality issue attachment
+     */
+    uploadQualityAttachment(issueId: string, file: File, onProgress?: (progress: number) => void): Promise<UploadResult>;
+    /**
+     * Get all documents for a product
+     */
+    getProductDocuments(productId: string): Promise<FileMetadata[]>;
+    /**
+     * List all buckets for the tenant
+     */
+    listBuckets(): Promise<BucketInfo[]>;
+    /**
+     * Create a new bucket.
+     *
+     * The REST route expects { name, settings } where settings carries the
+     * bucket policy fields. publicAccess, corsConfig, and lifecycleRules from
+     * CreateBucketOptions are folded into the settings envelope so the backend
+     * handler can read them from req.body.settings.
+     */
+    createBucket(options: CreateBucketOptions): Promise<BucketInfo>;
+    /**
+     * Get bucket info
+     */
+    getBucket(bucketId: string): Promise<BucketInfo>;
+    /**
+     * Update bucket settings.
+     *
+     * The REST route reads { settings } from req.body. Flatten the
+     * CreateBucketOptions partial into a settings envelope so the backend
+     * merges the diff correctly.
+     */
+    updateBucket(bucketId: string, updates: Partial<CreateBucketOptions>): Promise<BucketInfo>;
+    /**
+     * Delete a bucket (must be empty)
+     */
+    deleteBucket(bucketId: string): Promise<void>;
+    /**
+     * Get a pre-signed URL for direct upload (bypassing SDK)
+     */
+    getUploadUrl(path: string, options?: {
+        contentType?: string;
+        expiresIn?: number;
+    }): Promise<{
+        uploadUrl: string;
+        fileId: string;
+    }>;
+    /**
+     * Check if a file exists
+     */
+    exists(path: string): Promise<boolean>;
+    /**
+     * Get storage usage statistics
+     */
+    getUsageStats(): Promise<StorageUsageStats>;
+}
+interface BucketInfo {
+    id: string;
+    name: string;
+    tenantId: string;
+    publicAccess: boolean;
+    createdAt: Date;
+    updatedAt: Date;
+    storageUsed: number;
+    fileCount: number;
+}
+interface CreateBucketOptions {
+    name: string;
+    publicAccess?: boolean;
+    corsConfig?: CorsConfig;
+    lifecycleRules?: LifecycleRule[];
+}
+interface CorsConfig {
+    allowedOrigins: string[];
+    allowedMethods: string[];
+    allowedHeaders?: string[];
+    maxAgeSeconds?: number;
+}
+interface LifecycleRule {
+    action: 'delete' | 'archive';
+    conditions: {
+        ageInDays?: number;
+        prefix?: string;
+    };
+}
+interface StorageUsageStats {
+    totalBytes: number;
+    fileCount: number;
+    bucketCount: number;
+    lastUpdated: Date;
+}
+
+interface MAKEMINDAIConfig extends MAKEMINDConfig {
+    apiClient: ApiClient;
+    tenantId: () => string | null;
+}
+interface ChatMessage {
+    role: 'user' | 'assistant' | 'system';
+    content: string;
+}
+interface ChatOptions {
+    model?: string;
+    temperature?: number;
+    maxTokens?: number;
+    systemPrompt?: string;
+}
+interface ChatResponse {
+    message: ChatMessage;
+    usage: {
+        promptTokens: number;
+        completionTokens: number;
+        totalTokens: number;
+    };
+}
+interface EmbeddingOptions {
+    model?: string;
+}
+interface VisionOptions {
+    model?: string;
+    maxTokens?: number;
+}
+interface ToolCall {
+    name: string;
+    arguments: Record<string, unknown>;
+}
+interface ToolDefinition {
+    name: string;
+    description: string;
+    parameters: Record<string, unknown>;
+}
+declare class MAKEMINDAI {
+    private apiClient;
+    private getTenantId;
+    constructor(config: MAKEMINDAIConfig);
+    chat(messages: ChatMessage[], options?: ChatOptions): Promise<ChatResponse>;
+    /**
+     * Stream chat completion via the aiStreamChat onCall backend.
+     *
+     * The backend writes chunks progressively to Firestore
+     * (aiStreamChunks/{streamId}/chunks). This method polls the stream
+     * document until the status reaches 'completed' or 'failed', invoking
+     * onChunk for each content chunk in order. Callers that need real-time
+     * granularity should subscribe to the Firestore collection directly using
+     * the returned streamId from aiStreamChat.
+     *
+     * @param messages - Chat messages
+     * @param onChunk - Callback for each streamed content chunk
+     * @param options - Chat options and optional onDone callback
+     * @returns Promise that resolves when streaming is complete
+     */
+    chatStream(messages: ChatMessage[], onChunk: (chunk: string) => void, options?: ChatOptions & {
+        onDone?: (response: ChatResponse) => void;
+    }): Promise<ChatResponse>;
+    /**
+     * Stream chat using async generator for easier consumption.
+     * Yields content deltas via polling on aiGetStreamResult.
+     */
+    streamChat(messages: ChatMessage[], options?: ChatOptions): AsyncGenerator<string, ChatResponse, unknown>;
+    createEmbedding(text: string | string[], options?: EmbeddingOptions): Promise<{
+        embeddings: number[][];
+        usage: {
+            totalTokens: number;
+        };
+    }>;
+    /**
+     * Vector search over a tenant knowledge collection.
+     * Routes to the knowledge domain dispatch (knowledge-knowledgeSearch),
+     * which performs semantic search with embeddings over indexed documents.
+     */
+    vectorSearch(collection: string, query: string, options?: {
+        limit?: number;
+        filter?: Record<string, unknown>;
+    }): Promise<Array<{
+        id: string;
+        score: number;
+        data: Record<string, unknown>;
+    }>>;
+    /**
+     * Vision analysis for a publicly accessible image URL.
+     * Routes to ai-aiVision (aiVision onCall). The image is passed as a
+     * ChatCompletionRequest message using the imageUrl ContentPart type.
+     */
+    analyzeImage(imageUrl: string, prompt: string, options?: VisionOptions): Promise<{
+        content: string;
+        usage: {
+            totalTokens: number;
+        };
+    }>;
+    /**
+     * Vision analysis for a base64-encoded image.
+     * The image is embedded as a data URI in the imageUrl ContentPart.
+     */
+    analyzeImageBase64(base64Image: string, mimeType: string, prompt: string, options?: VisionOptions): Promise<{
+        content: string;
+        usage: {
+            totalTokens: number;
+        };
+    }>;
+    /**
+     * Chat completion with tool definitions (function calling).
+     * Routes to ai-aiChat — the aiChat onCall natively supports the tools field
+     * in ChatCompletionRequest, no separate endpoint required.
+     */
+    chatWithTools(messages: ChatMessage[], tools: ToolDefinition[], options?: ChatOptions): Promise<{
+        message: ChatMessage;
+        toolCalls?: ToolCall[];
+        usage: {
+            promptTokens: number;
+            completionTokens: number;
+            totalTokens: number;
+        };
+    }>;
+    /**
+     * Document analysis (summary, field extraction, or QA).
+     * No dedicated onCall exists in the ai domain; implemented via ai-aiChat
+     * with a structured system prompt that targets the requested analysis type.
+     * The document content must be fetched by the caller and passed as text —
+     * the backend has no URL-fetch / OCR pipeline for onCall yet.
+     */
+    analyzeDocument(documentUrl: string, analysisType: 'summary' | 'extract' | 'qa', options?: {
+        question?: string;
+        extractFields?: string[];
+    }): Promise<{
+        result: string | Record<string, unknown>;
+        usage: {
+            totalTokens: number;
+        };
+    }>;
+    generate(prompt: string, options?: ChatOptions): Promise<{
+        text: string;
+        usage: {
+            totalTokens: number;
+        };
+    }>;
+    /**
+     * Text summarization via ai-aiChat.
+     * No dedicated onCall exists; implemented as a structured chat request
+     * with a summarization system prompt.
+     */
+    summarize(text: string, options?: {
+        maxLength?: number;
+        style?: 'bullet' | 'paragraph';
+    }): Promise<{
+        summary: string;
+        usage: {
+            totalTokens: number;
+        };
+    }>;
+    /**
+     * Text translation via ai-aiChat.
+     * No dedicated onCall exists; implemented as a structured chat request
+     * with a translation system prompt.
+     */
+    translate(text: string, targetLanguage: string, sourceLanguage?: string): Promise<{
+        translation: string;
+        detectedLanguage?: string;
+        usage: {
+            totalTokens: number;
+        };
+    }>;
+}
+
+interface MAKEMINDSearchConfig extends MAKEMINDConfig {
+    apiClient: ApiClient;
+    tenantId: () => string | null;
+}
+interface SearchResult {
+    hits: Array<{
+        document: Record<string, unknown>;
+        highlights?: Array<{
+            field: string;
+            snippet: string;
+        }>;
+        score: number;
+    }>;
+    found: number;
+    page: number;
+    totalPages: number;
+}
+interface SearchQueryOptions {
+    q: string;
+    collections?: string[];
+    page?: number;
+    perPage?: number;
+}
+interface AdvancedSearchOptions {
+    query: string;
+    collection: string;
+    facets?: string[];
+    filters?: Record<string, unknown>;
+    sortBy?: string;
+    page?: number;
+    perPage?: number;
+    highlightFields?: string[];
+    groupBy?: string;
+}
+interface SearchSuggestionOptions {
+    prefix: string;
+    collection: string;
+    limit?: number;
+}
+interface BulkReindexOptions {
+    collection?: string;
+    recreateCollections?: boolean;
+}
+interface ReindexStatus {
+    jobId: string;
+    status: 'queued' | 'processing' | 'completed' | 'failed';
+    progress?: number;
+    error?: string;
+}
+declare class MAKEMINDSearch {
+    private apiClient;
+    private getTenantId;
+    constructor(config: MAKEMINDSearchConfig);
+    query(options: SearchQueryOptions): Promise<SearchResult>;
+    advanced(options: AdvancedSearchOptions): Promise<SearchResult>;
+    suggestions(options: SearchSuggestionOptions): Promise<string[]>;
+    getAnalytics(options?: {
+        startDate?: string;
+        endDate?: string;
+    }): Promise<Record<string, unknown>>;
+    bulkReindex(options?: BulkReindexOptions): Promise<{
+        jobId: string;
+    }>;
+    getBulkReindexStatus(options: {
+        jobId: string;
+    }): Promise<ReindexStatus>;
+}
+
+/**
+ * MAKEMINDApps - App Builder SDK Service
+ *
+ * SDK service for the App Builder feature.
+ * Provides methods for managing apps, pages, publishing, and domains.
+ *
+ * @see docs/03_DDD/ui-tenant-portal/08-app-builder.md
+ */
+
+type AppStatus = 'draft' | 'published' | 'archived';
+type LayoutType = 'blank' | 'sidebar' | 'topnav' | 'dashboard' | 'centered';
+type SSLStatus = 'pending' | 'provisioning' | 'active' | 'expired' | 'failed';
+type CustomDomainStatus = 'pending' | 'verifying' | 'active' | 'failed';
+/** Where a hostname's traffic is routed once it reaches the domain-serving edge. */
+type DomainTargetKind = 'marketplace-server' | 'tenant-home' | 'external-url' | 'relay';
+/**
+ * Optional generic reverse-proxy routing target for a hostname: a
+ * marketplace server, a tenant's own home app, an external URL, or a relay.
+ * Passed to `addSubdomain`, `addCustomDomain`, and
+ * `registerDomainForSubTenant`; a registered domain with no `target` is
+ * still a valid entry, just unresolvable for proxying until one is set.
+ *
+ * Requires domain-service activation. The control-plane call is live, but a
+ * registered domain/target does not serve traffic until the domain-serving
+ * edge is provisioned (Phase 2). Custom and nested (sub-tenant) domains
+ * additionally require an active domain entitlement (paid SKU); pricing is
+ * not yet set. Subdomains are free.
+ */
+/** An address that opens an MCP origin, as returned by the entry operations. */
+interface WebEntrySummary {
+    /** The hostname the platform minted and reserved. */
+    host: string;
+    /** The address a visitor opens. */
+    url: string;
+    /** What the renderer connects to once it boots. */
+    origin: {
+        kind: 'app' | 'server' | 'bundle';
+        ref: string;
+    };
+    /** Who owns the entry. A parameter, not a fixed scope. */
+    party: {
+        kind: 'tenant' | 'euid' | 'ref';
+        id: string;
+    };
+    /** Feeds both the share metadata and the boot declaration. */
+    display?: {
+        name?: string;
+        description?: string;
+        iconUrl?: string;
+    };
+    status: string;
+}
+interface DomainTarget {
+    kind: DomainTargetKind;
+    ref: string;
+}
+interface ThemeConfig {
+    mode: 'light' | 'dark' | 'system';
+    primaryColor: string;
+    secondaryColor: string;
+    fontFamily: string;
+    borderRadius: 'none' | 'sm' | 'md' | 'lg' | 'full';
+    density: 'compact' | 'normal' | 'comfortable';
+    logoUrl?: string;
+    faviconUrl?: string;
+    customCss?: string;
+}
+interface AuthConfig {
+    enabled: boolean;
+    providers: ('email' | 'google' | 'apple' | 'microsoft' | 'saml')[];
+    signupEnabled: boolean;
+    requireEmailVerification: boolean;
+    mfaEnabled: boolean;
+    sessionTimeout: number;
+}
+interface PWAConfig {
+    enabled: boolean;
+    name: string;
+    shortName: string;
+    description: string;
+    themeColor: string;
+    backgroundColor: string;
+    display: 'standalone' | 'fullscreen' | 'minimal-ui' | 'browser';
+    orientation: 'portrait' | 'landscape' | 'any';
+    offlineEnabled: boolean;
+    pushEnabled: boolean;
+}
+interface AppSettings {
+    theme?: Partial<ThemeConfig>;
+    auth?: Partial<AuthConfig>;
+    pwa?: Partial<PWAConfig>;
+    seo?: {
+        title?: string;
+        description?: string;
+        ogImage?: string;
+    };
+    localization?: {
+        defaultLocale?: string;
+        supportedLocales?: string[];
+    };
+}
+interface DomainConfig {
+    subdomain: string;
+    customDomain: string | null;
+    customDomainStatus: CustomDomainStatus;
+    sslStatus: SSLStatus;
+}
+interface App {
+    id: string;
+    tenantId: string;
+    name: string;
+    displayName: string;
+    description: string;
+    icon: string;
+    status: AppStatus;
+    version: number;
+    publishedVersion: number | null;
+    domain: DomainConfig;
+    settings: AppSettings;
+    createdAt: string;
+    createdBy: string;
+    updatedAt: string;
+    updatedBy: string;
+}
+interface LayoutConfig {
+    sidebarWidth?: number;
+    sidebarCollapsible?: boolean;
+    headerHeight?: number;
+    footerHeight?: number;
+    contentMaxWidth?: number;
+}
+interface PageSEO {
+    title: string;
+    description: string;
+    ogImage?: string;
+    noIndex?: boolean;
+}
+/**
+ * A node of a builder page, as stored and as the API returns it.
+ *
+ * This described nine of the tree's fields while the editor writes fifteen:
+ * `dataBinding`, `validation`, `a11y` and `conditions.className` were absent
+ * entirely. TypeScript does not delete what it cannot see, so a round trip
+ * through `getPage`/`updatePage` kept them — but a consumer BUILDING a node
+ * from this type had no way to express a binding or a validation rule, and
+ * one rebuilding a node field-by-field dropped them silently.
+ *
+ * `type` stays `string` rather than the editor's 108-member union: this
+ * describes a REST payload, and the palette must be able to grow without
+ * every SDK consumer needing a new release to accept the new type.
+ *
+ * Kept in step with `@makemind/app-builder-ui`'s `ComponentNode` by
+ * `src/__tests__/component-node-parity.test.ts`.
+ */
+interface ComponentNode {
+    id: string;
+    type: string;
+    name: string;
+    props: Record<string, unknown>;
+    styles: Record<string, unknown>;
+    children?: ComponentNode[];
+    conditions?: {
+        visible?: string;
+        enabled?: string;
+        className?: string;
+    };
+    events?: Record<string, unknown[]>;
+    dataBinding?: {
+        source: string;
+        field: string;
+        transform?: string;
+    };
+    validation?: Array<{
+        type: string;
+        value?: unknown;
+        message: string;
+    }>;
+    a11y?: {
+        label?: string;
+        description?: string;
+        role?: string;
+    };
+}
+interface DataSource {
+    id: string;
+    name: string;
+    type: 'query' | 'document' | 'api' | 'flow' | 'variable' | 'realtime';
+    config: Record<string, unknown>;
+}
+interface PageVariable {
+    name: string;
+    type: 'string' | 'number' | 'boolean' | 'object' | 'array';
+    defaultValue: unknown;
+}
+interface Page {
+    id: string;
+    appId: string;
+    name: string;
+    path: string;
+    title: string;
+    description: string;
+    isHomePage: boolean;
+    isPublic: boolean;
+    accessRoles: string[];
+    layout: {
+        type: LayoutType;
+        config: LayoutConfig;
+    };
+    components: ComponentNode[];
+    dataSources: DataSource[];
+    variables: PageVariable[];
+    seo: PageSEO;
+    order: number;
+    createdAt: string;
+    updatedAt: string;
+}
+interface AppVersion {
+    id: string;
+    appId: string;
+    version: number;
+    changelog: string;
+    createdAt: string;
+    createdBy: string;
+}
+interface DNSRecord {
+    type: 'CNAME' | 'TXT' | 'A' | 'AAAA';
+    name: string;
+    value: string;
+    ttl: number;
+}
+interface DomainStatus {
+    domain: string;
+    type: 'subdomain' | 'custom';
+    status: string;
+    sslStatus: SSLStatus;
+}
+/** Registry status of a delegated (sub-tenant) domain entry. */
+type SubTenantDomainStatus = 'pending' | 'verifying' | 'active' | 'suspended' | 'deleted';
+/**
+ * A Firestore Timestamp as it crosses the wire — JSON has no native
+ * timestamp type, so the Admin SDK's `Timestamp` class serializes to this
+ * `{ _seconds, _nanoseconds }` shape.
+ */
+interface SerializedTimestamp {
+    _seconds: number;
+    _nanoseconds: number;
+}
+/** One entry returned by `listSubTenantDomains`. */
+interface SubTenantDomainSummary {
+    domain: string;
+    type: 'subdomain' | 'custom';
+    appId: string;
+    subTenantId?: string;
+    status: SubTenantDomainStatus;
+    sslStatus: SSLStatus;
+    createdAt: SerializedTimestamp;
+}
+interface AppAnalytics {
+    appId: string;
+    period: string;
+    pageViews: number;
+    uniqueVisitors: number;
+    apiCalls: number;
+    errors: number;
+    avgLoadTime: number;
+    topPages: Array<{
+        path: string;
+        views: number;
+    }>;
+}
+interface CreateAppParams {
+    name: string;
+    displayName?: string;
+    description?: string;
+    icon?: string;
+    type?: 'web' | 'mobile' | 'backend' | 'agent';
+}
+interface UpdateAppParams {
+    name?: string;
+    displayName?: string;
+    description?: string;
+    icon?: string;
+    status?: AppStatus;
+    settings?: AppSettings;
+}
+interface ListAppsParams {
+    status?: AppStatus;
+    limit?: number;
+    startAfter?: string;
+}
+interface CreatePageParams {
+    name: string;
+    path: string;
+    title?: string;
+    description?: string;
+    isHomePage?: boolean;
+    isPublic?: boolean;
+    layout?: {
+        type: LayoutType;
+        config?: LayoutConfig;
+    };
+}
+interface UpdatePageParams {
+    name?: string;
+    path?: string;
+    title?: string;
+    description?: string;
+    isHomePage?: boolean;
+    isPublic?: boolean;
+    accessRoles?: string[];
+    layout?: {
+        type: LayoutType;
+        config?: LayoutConfig;
+    };
+    components?: ComponentNode[];
+    dataSources?: DataSource[];
+    variables?: PageVariable[];
+    seo?: PageSEO;
+}
+interface MAKEMINDAppsConfig extends MAKEMINDConfig {
+    apiClient: ApiClient;
+    tenantId: () => string | null;
+}
+declare class MAKEMINDApps {
+    private apiClient;
+    private getTenantId;
+    constructor(config: MAKEMINDAppsConfig);
+    private get tenantId();
+    createApp(params: CreateAppParams): Promise<{
+        appId: string;
+    }>;
+    getApp(appId: string): Promise<App | null>;
+    listApps(params?: ListAppsParams): Promise<{
+        apps: App[];
+        hasMore: boolean;
+        nextCursor?: string;
+    }>;
+    updateApp(appId: string, params: UpdateAppParams): Promise<void>;
+    deleteApp(appId: string, hardDelete?: boolean): Promise<void>;
+    duplicateApp(appId: string, newName: string): Promise<{
+        appId: string;
+    }>;
+    onAppSnapshot(appId: string, callback: (app: App | null) => void): Unsubscribe;
+    createPage(appId: string, params: CreatePageParams): Promise<{
+        pageId: string;
+    }>;
+    getPage(appId: string, pageId: string): Promise<Page | null>;
+    listPages(appId: string): Promise<Page[]>;
+    updatePage(appId: string, pageId: string, params: UpdatePageParams): Promise<void>;
+    deletePage(appId: string, pageId: string): Promise<void>;
+    reorderPages(appId: string, order: string[]): Promise<void>;
+    duplicatePage(appId: string, pageId: string, newName?: string, newPath?: string): Promise<{
+        pageId: string;
+    }>;
+    publish(appId: string, changelog?: string): Promise<{
+        success: boolean;
+        version: number;
+        publishedAt: string;
+    }>;
+    unpublish(appId: string): Promise<void>;
+    rollback(appId: string, targetVersion: number): Promise<{
+        success: boolean;
+        currentVersion: number;
+    }>;
+    getVersions(appId: string, limit?: number): Promise<AppVersion[]>;
+    getVersionDetail(appId: string, versionId: string): Promise<AppVersion & {
+        snapshot: Record<string, unknown>;
+    }>;
+    compareVersions(appId: string, version1: number, version2: number): Promise<{
+        version1: {
+            version: number;
+            changelog: string;
+            createdAt: string;
+        };
+        version2: {
+            version: number;
+            changelog: string;
+            createdAt: string;
+        };
+        changes: {
+            pagesAdded: number;
+            pagesRemoved: number;
+            pagesModified: number;
+            addedPageNames: string[];
+            removedPageNames: string[];
+        };
+    }>;
+    /**
+     * Add a platform subdomain (`<subdomain>.<platform-host>`) for an app.
+     * `target` is an optional generic reverse-proxy routing target.
+     *
+     * Requires domain-service activation. The control-plane call is live, but
+     * a registered domain/target does not serve traffic until the
+     * domain-serving edge is provisioned (Phase 2). Custom and nested
+     * (sub-tenant) domains additionally require an active domain entitlement
+     * (paid SKU); pricing is not yet set. Subdomains are free.
+     */
+    addSubdomain(appId: string, subdomain: string, target?: DomainTarget): Promise<{
+        success: boolean;
+        domain: string;
+    }>;
+    /**
+     * Add a custom (BYO) domain for an app. Returns a verification token and
+     * DNS records the caller must publish before `verifyDomain` will pass.
+     * `target` is an optional generic reverse-proxy routing target.
+     *
+     * Requires domain-service activation. The control-plane call is live, but
+     * a registered domain/target does not serve traffic until the
+     * domain-serving edge is provisioned (Phase 2). Custom and nested
+     * (sub-tenant) domains additionally require an active domain entitlement
+     * (paid SKU); pricing is not yet set. Subdomains are free.
+     */
+    addCustomDomain(appId: string, domain: string, target?: DomainTarget): Promise<{
+        success: boolean;
+        verificationToken: string;
+        dnsRecords: DNSRecord[];
+    }>;
+    verifyDomain(appId: string, domain: string): Promise<{
+        verified: boolean;
+        sslStatus: SSLStatus;
+        error?: string;
+    }>;
+    removeDomain(appId: string, domain: string): Promise<void>;
+    getDomainStatus(appId: string): Promise<DomainStatus[]>;
+    /**
+     * Mint an address for an app.
+     *
+     * The caller proposes a **label**, not a hostname: the platform derives and
+     * reserves the host under its own uniqueness and reserved-name rules. A
+     * caller cannot claim a hostname it does not own, and the origin is derived
+     * from the app being bound rather than supplied — the whole capability rests
+     * on the issuer deciding the origin, and a free-text URL field is exactly how
+     * that property gets lost.
+     *
+     * `display` feeds both the share metadata (`og:*`) and the boot declaration,
+     * so a link preview and the running app cannot disagree.
+     */
+    mintWebEntry(params: {
+        label: string;
+        /**
+         * `app` is the resident case: `ref` is an appId and the platform derives
+         * its own MCP endpoint from it, so there is no address for a caller to
+         * supply — and therefore none to point elsewhere. `server` binds an
+         * external endpoint the party has proven it controls.
+         */
+        origin: {
+            kind: 'app' | 'server' | 'bundle';
+            ref: string;
+        };
+        /**
+         * Who the address is for. **Required, and not defaulted anywhere.**
+         *
+         * An address states its party, and a payment served from it pays that
+         * party. The platform used to fill this in from the calling tenant, which
+         * meant an address selling on a seller's behalf collected for the tenant
+         * because nobody said otherwise. Sending nothing is refused; a shop
+         * selling its own goods says `{ kind: 'tenant', id: '<its id>' }`.
+         */
+        party: {
+            kind: 'tenant' | 'euid' | 'ref';
+            id: string;
+        };
+        display?: {
+            name?: string;
+            description?: string;
+            iconUrl?: string;
+        };
+    }): Promise<WebEntrySummary>;
+    /** Read one entry the caller owns. Requires `domains:read`. */
+    getWebEntry(host: string): Promise<WebEntrySummary>;
+    /** List the caller's entries, optionally narrowed to one party. Requires `domains:read`. */
+    listWebEntries(params?: {
+        party?: {
+            kind: 'tenant' | 'euid' | 'ref';
+            id: string;
+        };
+    }): Promise<{
+        entries: WebEntrySummary[];
+    }>;
+    /**
+     * Repoint an entry at a different (still proven) origin, or change how it
+     * appears when shared. The address itself is immutable — a different address
+     * is a different entry.
+     */
+    updateWebEntry(params: {
+        host: string;
+        origin?: {
+            kind: 'app' | 'server' | 'bundle';
+            ref: string;
+        };
+        display?: {
+            name?: string;
+            description?: string;
+            iconUrl?: string;
+        };
+    }): Promise<WebEntrySummary>;
+    /** Retire an entry — the address stops serving immediately. Requires `domains:write`. */
+    retireWebEntry(host: string): Promise<{
+        success: true;
+        host: string;
+    }>;
+    /**
+     * Register a custom domain on behalf of one of the caller tenant's
+     * sub-tenants ("custom domains for your customers"). `parentTenantId`,
+     * when provided, must equal the caller's own tenantId — the server never
+     * trusts a client-supplied parent tenant for cross-tenant registration.
+     * Requires API key scope `domains:write`.
+     *
+     * Requires domain-service activation. The control-plane call is live, but
+     * a registered domain/target does not serve traffic until the
+     * domain-serving edge is provisioned (Phase 2). Custom and nested
+     * (sub-tenant) domains additionally require an active domain entitlement
+     * (paid SKU); pricing is not yet set. Subdomains are free.
+     */
+    registerDomainForSubTenant(params: {
+        appId: string;
+        domain: string;
+        subTenantId: string;
+        parentTenantId?: string;
+        target?: DomainTarget;
+    }): Promise<{
+        success: boolean;
+        domain: string;
+        subTenantId: string;
+        verificationToken: string;
+        dnsRecords: DNSRecord[];
+    }>;
+    /**
+     * Verify a delegated sub-tenant domain's DNS configuration.
+     * Requires API key scope `domains:write`.
+     *
+     * Requires domain-service activation. The control-plane call is live, but
+     * a registered domain/target does not serve traffic until the
+     * domain-serving edge is provisioned (Phase 2). Custom and nested
+     * (sub-tenant) domains additionally require an active domain entitlement
+     * (paid SKU); pricing is not yet set. Subdomains are free.
+     */
+    verifyDomainForSubTenant(domain: string): Promise<{
+        verified: boolean;
+        sslStatus: SSLStatus;
+        error?: string;
+    }>;
+    /**
+     * List the caller tenant's delegated sub-tenant domains, optionally
+     * filtered to one `subTenantId`. Requires API key scope `domains:read`.
+     *
+     * Requires domain-service activation. The control-plane call is live, but
+     * a registered domain/target does not serve traffic until the
+     * domain-serving edge is provisioned (Phase 2). Custom and nested
+     * (sub-tenant) domains additionally require an active domain entitlement
+     * (paid SKU); pricing is not yet set. Subdomains are free.
+     */
+    listSubTenantDomains(subTenantId?: string): Promise<{
+        domains: SubTenantDomainSummary[];
+    }>;
+    /**
+     * Remove a delegated sub-tenant domain. Requires API key scope
+     * `domains:write`.
+     *
+     * Requires domain-service activation. The control-plane call is live, but
+     * a registered domain/target does not serve traffic until the
+     * domain-serving edge is provisioned (Phase 2). Custom and nested
+     * (sub-tenant) domains additionally require an active domain entitlement
+     * (paid SKU); pricing is not yet set. Subdomains are free.
+     */
+    removeSubTenantDomain(domain: string): Promise<{
+        success: boolean;
+    }>;
+    getAnalytics(appId: string, params?: {
+        startDate?: string;
+        endDate?: string;
+    }): Promise<AppAnalytics>;
+    generateUI(prompt: string, context?: Record<string, unknown>, appId?: string): Promise<{
+        components: ComponentNode[];
+    }>;
+    suggestActions(appId: string, componentType?: string, context?: Record<string, unknown>): Promise<{
+        actions: unknown[];
+    }>;
+    startSession(appId: string, pageId: string): Promise<{
+        sessionToken: string;
+        wsEndpoint: string;
+    }>;
+    addComment(appId: string, pageId: string, componentId: string, content: string, threadId?: string): Promise<{
+        commentId: string;
+    }>;
+    resolveComment(appId: string, pageId: string, commentId: string): Promise<void>;
+}
+
+/**
+ * MAKEMIND SDK - Marketplace Service
+ *
+ * Client-side SDK for the SaaS Marketplace feature.
+ * Provides methods for browsing, installing, and publishing marketplace apps.
+ *
+ * @see docs/03_DDD/infra-sdk.md
+ */
+
+interface MAKEMINDMarketplaceConfig extends MAKEMINDConfig {
+    apiClient: ApiClient;
+    tenantId: () => string | null;
+}
+interface SearchOptions {
+    query?: string;
+    category?: string;
+    tags?: string[];
+    pricingModel?: string[];
+    sortBy?: 'relevance' | 'rating' | 'installs' | 'newest' | 'price_asc' | 'price_desc';
+    page?: number;
+    limit?: number;
+}
+interface InstallResult {
+    bindingId: string;
+    status: string;
+    trialExpiresAt?: string;
+}
+interface ReviewInput {
+    listingId: string;
+    rating: number;
+    title?: string;
+    body?: string;
+}
+interface PublisherProfileInput {
+    displayName: string;
+    description: string;
+    logoUrl: string;
+    websiteUrl?: string;
+    supportEmail: string;
+}
+declare class MAKEMINDMarketplace {
+    private apiClient;
+    private getTenantId;
+    constructor(config: MAKEMINDMarketplaceConfig);
+    search(options?: SearchOptions): Promise<unknown>;
+    getDetail(listingId: string): Promise<unknown>;
+    browseCategory(categorySlug: string, options?: Omit<SearchOptions, 'category'>): Promise<unknown>;
+    getFeatured(): Promise<unknown>;
+    getTrending(): Promise<unknown>;
+    getRecommendations(): Promise<unknown>;
+    listCategories(): Promise<unknown>;
+    install(listingId: string): Promise<InstallResult>;
+    uninstall(listingId: string, cleanupData?: boolean): Promise<unknown>;
+    listInstalled(options?: {
+        status?: string;
+        page?: number;
+        limit?: number;
+    }): Promise<unknown>;
+    updateApp(listingId: string): Promise<unknown>;
+    proxy(bindingId: string, options: {
+        method: string;
+        path: string;
+        body?: unknown;
+        query?: Record<string, string>;
+    }): Promise<unknown>;
+    getApiSpec(bindingId: string): Promise<unknown>;
+    getConfig(bindingId: string): Promise<unknown>;
+    updateConfig(bindingId: string, updates: Record<string, unknown>): Promise<unknown>;
+    issueCredentials(bindingId: string): Promise<unknown>;
+    revokeCredentials(bindingId: string): Promise<unknown>;
+    createReview(input: ReviewInput): Promise<unknown>;
+    updateReview(reviewId: string, listingId: string, updates: {
+        rating?: number;
+        title?: string;
+        body?: string;
+    }): Promise<unknown>;
+    deleteReview(reviewId: string, listingId: string): Promise<unknown>;
+    listReviews(listingId: string, options?: {
+        sortBy?: string;
+        page?: number;
+        limit?: number;
+    }): Promise<unknown>;
+    replyToReview(reviewId: string, listingId: string, body: string): Promise<unknown>;
+    reportReview(reviewId: string, listingId: string, reason: string): Promise<unknown>;
+    voteHelpful(reviewId: string, listingId: string): Promise<unknown>;
+    createPublisherProfile(input: PublisherProfileInput): Promise<unknown>;
+    updatePublisherProfile(updates: Partial<PublisherProfileInput>): Promise<unknown>;
+    getDashboard(): Promise<unknown>;
+    createListing(input: Record<string, unknown>): Promise<unknown>;
+    updateListing(listingId: string, updates: Record<string, unknown>): Promise<unknown>;
+    submitForReview(listingId: string): Promise<unknown>;
+    publishListing(listingId: string): Promise<unknown>;
+    archiveListing(listingId: string): Promise<unknown>;
+    reactivateListing(listingId: string): Promise<unknown>;
+    createVersion(listingId: string, version: string, changelog: string, appVersionId: string, breakingChanges?: boolean): Promise<unknown>;
+    approveListing(listingId: string): Promise<unknown>;
+    rejectListing(listingId: string, reason: string): Promise<unknown>;
+    suspendListing(listingId: string, reason: string): Promise<unknown>;
+    approveVersion(listingId: string, versionId: string): Promise<unknown>;
+    verifyPublisher(tenantId: string): Promise<unknown>;
+    suspendPublisher(tenantId: string, reason: string): Promise<unknown>;
+    reactivatePublisher(tenantId: string): Promise<unknown>;
+    adminCreateCategory(data: {
+        name: string;
+        slug: string;
+        parentId?: string;
+        sortOrder?: number;
+    }): Promise<unknown>;
+    adminUpdateCategory(categoryId: string, data: Record<string, unknown>): Promise<unknown>;
+    adminDeleteCategory(categoryId: string): Promise<unknown>;
+    getAnalytics(params?: {
+        startDate?: string;
+        endDate?: string;
+        granularity?: string;
+    }): Promise<unknown>;
+    getPendingListings(params?: {
+        status?: string;
+        page?: number;
+        limit?: number;
+    }): Promise<unknown>;
+    listPublishers(params?: {
+        status?: string;
+        page?: number;
+        limit?: number;
+    }): Promise<unknown>;
+}
+
+interface MAKEMINDClientConfig {
+    apiKey: string;
+    applicationId: string;
+    environment?: 'development' | 'staging' | 'production';
+    baseUrl?: string;
+    /** Gateway API version segment. Defaults to 'v1'. */
+    apiVersion?: string;
+    /**
+     * Optional App Check token provider (first-party apps only). When set, its
+     * token is attached as `X-Firebase-AppCheck` on every gateway call so the app
+     * passes App Check enforcement on pre-login endpoints. Omit for M2M/API-key
+     * integrations — those are exempt from App Check server-side.
+     */
+    getAppCheckToken?: () => Promise<string | null>;
+}
+declare class MAKEMINDClient {
+    private apiClient;
+    private applicationId;
+    private environment;
+    private _auth;
+    private _data;
+    private _logic;
+    private _tenant;
+    private _messaging;
+    private _settlement;
+    private _partners;
+    private _storage;
+    private _ai;
+    private _search;
+    private _apps;
+    private _marketplace;
+    private currentTenantId;
+    private currentUserId;
+    private authToken;
+    constructor(config: MAKEMINDClientConfig);
+    setAuthToken(token: string): void;
+    setUserContext(userId: string, tenantId: string | null): void;
+    get tenantId(): string | null;
+    get userId(): string | null;
+    setTenantContext(tenantId: string): void;
+    getApiClient(): ApiClient;
+    /**
+     * Invoke a platform Callable operation through the gateway RPC dispatch
+     * (`POST /api/v1/call/:operation`). The operation name matches the deployed
+     * Callable key (namespaced groups use `<prefix>-<name>`, e.g.
+     * `settlement-getMRR`; flat exports use the bare name, e.g. `createTenant`).
+     *
+     * This is the platform-operation channel, distinct from `logic.call()` which
+     * runs a tenant-defined logic function. Each operation enforces its own
+     * authorization server-side (platform roles / tenant scopes), so exposing
+     * this method does not bypass access control. Returns the operation's result
+     * value directly (the `{ data }` envelope is already unwrapped).
+     */
+    call<T = unknown>(operation: string, input?: unknown): Promise<T>;
+    get auth(): MAKEMINDAuth;
+    get data(): MAKEMINDData;
+    get logic(): MAKEMINDLogic;
+    get tenant(): MAKEMINDTenant;
+    get messaging(): MAKEMINDMessaging;
+    get settlement(): MAKEMINDSettlement;
+    get partners(): MAKEMINDPartners;
+    get storage(): MAKEMINDStorage;
+    get ai(): MAKEMINDAI;
+    get search(): MAKEMINDSearch;
+    get apps(): MAKEMINDApps;
+    get marketplace(): MAKEMINDMarketplace;
+}
+declare function initializeMAKEMIND(config: MAKEMINDClientConfig): MAKEMINDClient;
+declare function getMAKEMIND(): MAKEMINDClient;
+
+/**
+ * The expert guest door — the one SDK surface that carries no credential.
+ *
+ * Deliberately not built on `ApiClient`. That client attaches `X-API-Key` to
+ * every request by construction, and a key in a browser carries
+ * `expert:execute` over the tenant's whole budget. A page embedding an expert
+ * must not be able to ship one by accident, so this talks to the public routes
+ * with its own fetch that has no credential to attach.
+ *
+ * The only attestation is App Check, which the tenant's own web app produces.
+ *
+ * What a guest holds instead of an account is a capability: a token minted on
+ * the first turn and returned once. Whoever holds it holds the thread; losing
+ * it loses the thread, and nothing recovers it — there is no account to recover
+ * into. Say that on any page that opens one.
+ *
+ * @see docs/03_DDD/feat-expert/20-public-consumption-surfaces.md
+ */
+interface MAKEMINDExpertsConfig {
+    /** Gateway origin, e.g. `https://api.makemind.app`. */
+    baseUrl: string;
+    /** The tenant whose expert is being consulted. */
+    tenantId: string;
+    /** Supplies an App Check token. Omit only where the tenant has none configured. */
+    appCheck?: () => string | null | Promise<string | null>;
+    /** Injected in tests; defaults to the global. */
+    fetchImpl?: typeof fetch;
+}
+interface ExpertAccess {
+    token: string;
+    expiresAt?: unknown;
+}
+interface ConsultationConclusion {
+    value: string;
+    origin: 'rule' | 'model';
+}
+interface ExpertConsultation {
+    id: string;
+    status: string;
+    /** Present when the expert declined; it is an answer, not a failure. */
+    refusal?: string;
+    synthesis?: {
+        answer?: string;
+        confidence?: number;
+        conclusions?: Record<string, ConsultationConclusion>;
+    };
+    budget?: {
+        tokensUsed: number;
+        tokensMax: number;
+    };
+    [key: string]: unknown;
+}
+interface ConsultResult extends ExpertConsultation {
+    access?: ExpertAccess;
+}
+interface ExpertTurn {
+    question: string;
+    answer?: string;
+    consultationId: string;
+}
+interface ExpertSession {
+    id: string;
+    turns: ExpertTurn[];
+    [key: string]: unknown;
+}
+/** The platform's refusal, surfaced with its own name rather than a generic failure. */
+declare class ExpertDoorError extends Error {
+    readonly code: string;
+    readonly status: number;
+    constructor(code: string, message: string, status: number);
+}
+declare class MAKEMINDExperts {
+    private readonly baseUrl;
+    private readonly tenantId;
+    private readonly appCheck?;
+    private readonly fetchImpl;
+    constructor(config: MAKEMINDExpertsConfig);
+    private post;
+    /** One question, one answer, and the capability to read it back. */
+    consult(options: {
+        expertId: string;
+        question: string;
+        facts?: Record<string, unknown>;
+    }): Promise<ConsultResult>;
+    /**
+     * Open a conversation, or resume one whose capability the caller kept.
+     * @param {Object} options The expert to open, or a thread to resume.
+     * @return {ExpertChat} A thread that carries its own capability.
+     */
+    chat(options: {
+        expertId: string;
+        sessionId?: string;
+        accessToken?: string;
+    }): ExpertChat;
+    /** @internal */
+    converse(body: Record<string, unknown>): Promise<{
+        sessionId: string;
+        consultation: ExpertConsultation;
+        access?: ExpertAccess;
+    }>;
+    getConsultation(options: {
+        consultationId: string;
+        accessToken: string;
+    }): Promise<ExpertConsultation>;
+    getSession(options: {
+        sessionId: string;
+        accessToken: string;
+    }): Promise<ExpertSession>;
+}
+/**
+ * A thread and the capability that names it.
+ *
+ * The first `ask` opens the thread and takes the token from the answer; every
+ * later one presents it. Callers that want a visitor's thread to survive a
+ * reload persist `sessionId` and `accessToken` themselves and hand them back to
+ * `chat()` — the SDK does not reach into storage on its own.
+ */
+declare class ExpertChat {
+    private readonly api;
+    private readonly expertId;
+    private session?;
+    private token?;
+    private readonly turns;
+    constructor(api: MAKEMINDExperts, options: {
+        expertId: string;
+        sessionId?: string;
+        accessToken?: string;
+    });
+    get sessionId(): string | undefined;
+    get accessToken(): string | undefined;
+    get history(): ExpertTurn[];
+    /**
+     * Ask, and keep whatever the thread needs to be continued.
+     * @param {string} question What the visitor asked.
+     * @param {Object} [facts] Structured facts the rules read.
+     * @return {Promise<ExpertConsultation>} The turn's record. A refusal comes
+     *   back as an answer with `refusal` set; only a closed door throws.
+     */
+    ask(question: string, facts?: Record<string, unknown>): Promise<ExpertConsultation>;
+}
+
+interface ExpertChatWidgetOptions extends MAKEMINDExpertsConfig {
+    expertId: string;
+    /** Shown above the thread. */
+    title?: string;
+    placeholder?: string;
+    /**
+     * Where the thread is remembered across reloads. Defaults to `localStorage`
+     * when the page has one. Pass `null` to remember nothing — a visitor on a
+     * shared machine leaves nothing behind, at the cost of the thread.
+     */
+    storage?: Pick<Storage, 'getItem' | 'setItem' | 'removeItem'> | null;
+    /**
+     * The line that tells a visitor the link is the only way back. Overridable
+     * for wording and translation; removing it is the embedder's decision to
+     * make, and their visitor's to regret.
+     */
+    bearerNotice?: string;
+}
+interface ExpertChatWidget {
+    /** Ask programmatically — the same path the input takes. */
+    ask(question: string): Promise<void>;
+    /** Remove the UI and stop. The remembered thread is left alone. */
+    destroy(): void;
+    /** What the page would need to re-open this thread elsewhere. */
+    readonly thread: {
+        sessionId?: string;
+        accessToken?: string;
+    };
+}
+/**
+ * Mount a chat into an element.
+ * @param {HTMLElement} el Where it goes. Its contents are replaced.
+ * @param {ExpertChatWidgetOptions} options Tenant, expert and presentation.
+ * @return {ExpertChatWidget} A handle to ask, read the thread, or remove it.
+ */
+declare function mountExpertChat(el: HTMLElement, options: ExpertChatWidgetOptions): ExpertChatWidget;
+
+declare class MAKEMINDError extends Error {
+    code: string;
+    details?: Record<string, unknown>;
+    constructor(code: string, message: string, details?: Record<string, unknown>);
+    static fromApiError(error: unknown): MAKEMINDError;
+    static fromHttpStatus(status: number, body?: unknown): MAKEMINDError;
+    toJSON(): PlatformErrorDetails;
+}
+declare const ErrorCodes: {
+    readonly UNAUTHENTICATED: "UNAUTHENTICATED";
+    readonly PERMISSION_DENIED: "PERMISSION_DENIED";
+    readonly INVALID_TOKEN: "INVALID_TOKEN";
+    readonly NOT_FOUND: "NOT_FOUND";
+    readonly ALREADY_EXISTS: "ALREADY_EXISTS";
+    readonly VALIDATION_ERROR: "VALIDATION_ERROR";
+    readonly TENANT_NOT_FOUND: "TENANT_NOT_FOUND";
+    readonly TENANT_SUSPENDED: "TENANT_SUSPENDED";
+    readonly NOT_A_MEMBER: "NOT_A_MEMBER";
+    readonly QUOTA_EXCEEDED: "QUOTA_EXCEEDED";
+    readonly STORAGE_ERROR: "STORAGE_ERROR";
+    readonly INTERNAL_ERROR: "INTERNAL_ERROR";
+    readonly SERVICE_UNAVAILABLE: "SERVICE_UNAVAILABLE";
+    readonly UNKNOWN_ERROR: "UNKNOWN_ERROR";
+};
+
+export { ApiClient, type ApiClientConfig, type ApiRequestOptions, type AuthStateCallback, type AuthUser, type BillingSummary, type CollectionSnapshotCallback, type ConsultResult, type ConsultationConclusion, type CreateOptions, type DeleteOptions, type DocumentResult, ErrorCodes, type ExpertAccess, ExpertChat, type ExpertChatWidget, type ExpertChatWidgetOptions, type ExpertConsultation, ExpertDoorError, type ExpertSession, type ExpertTurn, type FileMetadata, type FlowListItem, type GetOptions, type Invoice, type ListFilesOptions, type ListFilesResult, type ListFlowsParams, type ListFlowsResult, type LogicCallResult, MAKEMINDAI, type MAKEMINDAIConfig, MAKEMINDApps, type MAKEMINDAppsConfig, MAKEMINDAuth, type MAKEMINDAuthConfig, MAKEMINDClient, type MAKEMINDClientConfig, type MAKEMINDConfig, MAKEMINDData, type MAKEMINDDataConfig, MAKEMINDError, MAKEMINDExperts, type MAKEMINDExpertsConfig, MAKEMINDLogic, type MAKEMINDLogicConfig, MAKEMINDMarketplace, type MAKEMINDMarketplaceConfig, MAKEMINDMessaging, type MAKEMINDMessagingConfig, MAKEMINDSearch, type MAKEMINDSearchConfig, MAKEMINDSettlement, type MAKEMINDSettlementConfig, MAKEMINDStorage, type MAKEMINDStorageConfig, MAKEMINDTenant, type MAKEMINDTenantConfig, type Notification, type OrderBy, type PlatformErrorDetails, type QueryCondition, type QueryOptions, type QueryResult, type SendMessageOptions, type SnapshotCallback, type Tenant, type TenantClaims, type TenantMember, type Unsubscribe, type UpdateOptions, type UploadOptions, type UploadResult, type UsageEventOptions, type UsageStats, type WorkflowTransitionOptions, type Workspace, getMAKEMIND, initializeMAKEMIND, mountExpertChat };