@rebasepro/client 0.0.1-canary.eae7889 → 0.0.1-canary.eb08332

package/LICENSE

@@ -1,6 +1,21 @@
-Source code in this repository is variously licensed under the Business Source
-License 1.1 (BSL), Apache version 2.0 and the MIT license. A copy of each
-license can be found in each one of the packages under the folder packages
-under a file called License. Source code in a given file is licensed under the
-BSL and the copyright belongs to Rebase Authors unless otherwise noted at the
-beginning of the file.
+MIT License
+
+Copyright (c) 2026 Rebase
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,164 @@
+# @rebasepro/client
+
+HTTP SDK client for the Rebase backend — typed CRUD, auth, storage, realtime WebSockets, admin, cron, and custom functions.
+
+## Installation
+
+```bash
+pnpm add @rebasepro/client
+```
+
+## What This Package Does
+
+`@rebasepro/client` is the primary SDK for interacting with a Rebase backend from any JavaScript/TypeScript environment (browser, Node.js, edge). It creates a single client instance that provides:
+
+- **Collection CRUD** with a fluent query builder (`.where()`, `.orderBy()`, `.limit()`, etc.)
+- **Authentication** — email/password, Google, 10+ OAuth providers, session management, password reset
+- **Admin** — user CRUD for admins
+- **Storage** — file upload, download, delete, list
+- **Realtime** — WebSocket subscriptions for collection and snapshot changes
+- **Cron** — list, trigger, and manage cron jobs
+- **Custom functions** — invoke server-side Hono route functions
+- **Type-safe data proxy** — `client.data.products` auto-maps to the `products` collection
+
+## Key Exports
+
+### Client Factory
+
+| Export | Description |
+|---|---|
+| `createRebaseClient<DB>(options)` | Create a `RebaseClient` instance. Generic `DB` parameter enables type-safe `client.data.*` access. |
+| `RebaseClient<DB>` | The client type — includes `auth`, `admin`, `cron`, `functions`, `storage`, `ws`, `data`, `call`, and token management methods. |
+| `CreateRebaseClientOptions` | Extends `RebaseClientConfig` with `auth`, `admin`, and `cron` sub-configs. |
+
+### Config
+
+| Option | Type | Default | Description |
+|---|---|---|---|
+| `baseUrl` | `string` | `""` | Backend URL (e.g. `http://localhost:3001`) |
+| `token` | `string` | — | Static auth token |
+| `apiPath` | `string` | `"/api"` | API path prefix |
+| `fetch` | `typeof fetch` | `globalThis.fetch` | Custom fetch implementation |
+| `onUnauthorized` | `() => Promise<boolean>` | auto-refresh | Handler for 401 responses |
+| `websocketUrl` | `string` | derived from `baseUrl` | WebSocket URL for realtime |
+
+### Collection Client
+
+`client.data.collection("slug")` or `client.data.myCollection` returns a `CollectionClient<M>`:
+
+| Method | Description |
+|---|---|
+| `find(params?)` | Query with pagination. Returns `FindResponse<M>` (`{ data, meta }`) |
+| `findById(id)` | Fetch a single snapshot. Returns `Snapshot<M> \| undefined` |
+| `create(data, id?)` | Create snapshot. Returns `Snapshot<M>` |
+| `update(id, data)` | Update snapshot. Returns `Snapshot<M>` |
+| `delete(id)` | Delete snapshot |
+| `count(params?)` | Count matching snapshots |
+| `where(col, op, val)` | Start a fluent query — returns `QueryBuilder` |
+| `orderBy(col, dir?)` | Order results — returns `QueryBuilder` |
+| `limit(n)` / `offset(n)` | Pagination — returns `QueryBuilder` |
+| `search(str)` | Full-text search — returns `QueryBuilder` |
+| `include(...rels)` | Include related snapshots — returns `QueryBuilder` |
+| `listen(params, onUpdate, onError?)` | Realtime subscription (requires WebSocket) |
+| `listenById(id, onUpdate, onError?)` | Realtime single-snapshot subscription |
+
+### Auth Module (`client.auth`)
+
+| Method | Description |
+|---|---|
+| `signInWithEmail(email, password)` | Email/password login |
+| `signUp(email, password, displayName?)` | Register new user |
+| `signInWithGoogle(payload)` | Google OAuth (ID token, access token, or auth code) |
+| `signInWithOAuth(providerId, payload)` | Generic OAuth for any provider |
+| `signInWithGitHub/Microsoft/Apple/Facebook/Twitter/Discord/GitLab/Bitbucket/Slack/Spotify` | Provider-specific convenience methods |
+| `signOut()` | Sign out and invalidate refresh token |
+| `refreshSession()` | Refresh the access token |
+| `getUser()` / `updateUser(updates)` | Current user profile |
+| `resetPasswordForEmail(email)` | Request password reset |
+| `resetPassword(token, password)` | Complete password reset |
+| `changePassword(old, new)` | Change password (authenticated) |
+| `sendVerificationEmail()` / `verifyEmail(token)` | Email verification |
+| `getSessions()` / `revokeSession(id)` / `revokeAllSessions()` | Session management |
+| `getAuthConfig()` | Fetch backend auth configuration |
+| `getSession()` | Get current session (sync) |
+| `onAuthStateChange(callback)` | Subscribe to auth events (`SIGNED_IN`, `SIGNED_OUT`, `TOKEN_REFRESHED`, `USER_UPDATED`) |
+
+### Storage Module (`client.storage`)
+
+| Method | Description |
+|---|---|
+| `putObject({ file, key, metadata, bucket })` | Upload a file |
+| `getSignedUrl(key, bucket?)` | Get download URL + metadata |
+| `getObject(key, bucket?)` | Download file as `File` object |
+| `deleteObject(key, bucket?)` | Delete a file |
+| `listObjects(prefix, options?)` | List files with optional pagination |
+
+### Admin Module (`client.admin`)
+
+| Method | Description |
+|---|---|
+| `listUsers()` / `listUsersPaginated(options?)` | List all users |
+| `getUser(userId)` | Get a single user |
+| `createUser(data)` | Create a user |
+| `updateUser(userId, data)` | Update a user |
+| `deleteUser(userId)` | Delete a user |
+| `bootstrap()` | First-user bootstrap |
+
+### Functions Module (`client.functions`)
+
+| Method | Description |
+|---|---|
+| `invoke<T>(name, payload?, options?)` | Call a custom backend function at `/api/functions/{name}` |
+
+### Other Exports
+
+| Export | Description |
+|---|---|
+| `RebaseApiError` | Error class with `status`, `message`, `code`, `details` |
+| `RebaseWebSocketClient` | WebSocket client for realtime subscriptions |
+| `createCookieStorage(options?)` | Cookie-based auth storage adapter |
+| `createMemoryStorage()` | In-memory auth storage adapter |
+| `QueryBuilder` | Fluent query builder (also re-exported from `@rebasepro/common`) |
+| `Snapshot`, `FindResponse` | Re-exported from `@rebasepro/types` |
+
+## Quick Start
+
+```ts
+import { createRebaseClient } from "@rebasepro/client";
+
+const client = createRebaseClient({
+    baseUrl: "http://localhost:3001",
+});
+
+// Auth
+await client.auth.signInWithEmail("user@example.com", "password");
+
+// CRUD
+const { data: products } = await client.data.products.find({ limit: 10 });
+const product = await client.data.products.create({ name: "Camera", price: 299 });
+await client.data.products.update(product.id, { price: 249 });
+await client.data.products.delete(product.id);
+
+// Fluent queries
+const { data: expensive } = await client.data.products
+    .where("price", ">=", 100)
+    .orderBy("price", "desc")
+    .limit(5)
+    .find();
+
+// Custom function
+const result = await client.functions.invoke("process-order", { orderId: "123" });
+
+// Realtime
+const unsubscribe = client.data.products.listen(
+    { limit: 50 },
+    (response) => console.log("Update:", response.data)
+);
+```
+
+## Related Packages
+
+- [`@rebasepro/common`](../common) — `QueryBuilder`, `buildRebaseData`, shared utilities
+- [`@rebasepro/types`](../types) — `Snapshot`, `FindResponse`, `CollectionAccessor`, etc.
+- [`@rebasepro/utils`](../utils) — `toSnakeCase` and other helpers
+- [`@rebasepro/app`](../auth) — React hook adapter that wraps `client.auth` for CMS integration

package/dist/admin.d.ts

@@ -1,21 +1,6 @@
-import { Transport } from "./transport";
-export interface AdminUser {
-    uid: string;
-    email: string;
-    displayName: string | null;
-    photoURL: string | null;
-    provider: string;
-    roles: string[];
-    createdAt: string;
-    updatedAt: string;
-}
-export interface RebaseRole {
-    id: string;
-    name: string;
-    isAdmin: boolean;
-    defaultPermissions: Record<string, unknown> | null;
-    config: Record<string, unknown> | null;
-}
+import type { Transport } from "./transport";
+import { AdminUser } from "@rebasepro/types";
+export type { AdminUser };
 export interface CreateAdminOptions {
     adminPath?: string;
 }
@@ -57,31 +42,19 @@ export declare function createAdmin(transport: Transport, options?: CreateAdminO
     deleteUser: (userId: string) => Promise<{
         success: boolean;
     }>;
-    listRoles: () => Promise<{
-        roles: RebaseRole[];
-    }>;
-    getRole: (roleId: string) => Promise<{
-        role: RebaseRole;
-    }>;
-    createRole: (data: {
-        id: string;
-        name: string;
-        isAdmin?: boolean;
-        defaultPermissions?: Record<string, unknown>;
-        config?: Record<string, unknown>;
-    }) => Promise<{
-        role: RebaseRole;
-    }>;
-    updateRole: (roleId: string, data: {
-        name?: string;
-        isAdmin?: boolean;
-        defaultPermissions?: Record<string, unknown>;
-        config?: Record<string, unknown>;
+    resetPassword: (userId: string, options?: {
+        password?: string;
     }) => Promise<{
-        role: RebaseRole;
+        user: AdminUser;
+        temporaryPassword?: string;
+        invitationSent?: boolean;
+        emailDeliveryFailed?: boolean;
     }>;
-    deleteRole: (roleId: string) => Promise<{
-        success: boolean;
+    listRoles: () => Promise<{
+        roles: Array<{
+            id: string;
+            name: string;
+        }>;
     }>;
     bootstrap: () => Promise<{
         success: boolean;

package/dist/api-keys.d.ts

@@ -0,0 +1,66 @@
+import type { Transport } from "./transport";
+/** A single permission entry scoping an API key to a collection and its allowed operations. */
+export interface ApiKeyPermission {
+    collection: string;
+    operations: ("read" | "write" | "delete")[];
+}
+/** An API key with the secret portion masked (returned by list / get / update). */
+export interface ApiKeyMasked {
+    id: string;
+    name: string;
+    key_prefix: string;
+    permissions: ApiKeyPermission[];
+    admin: boolean;
+    rate_limit: number | null;
+    created_by: string;
+    created_at: string;
+    updated_at: string;
+    last_used_at: string | null;
+    expires_at: string | null;
+    revoked_at: string | null;
+}
+/** An API key including the full secret (returned only on creation). */
+export interface ApiKeyWithSecret extends ApiKeyMasked {
+    key: string;
+}
+/** Payload for creating a new API key. */
+export interface CreateApiKeyRequest {
+    name: string;
+    permissions: ApiKeyPermission[];
+    rate_limit?: number | null;
+    expires_at?: string | null;
+}
+/** Payload for updating an existing API key. */
+export interface UpdateApiKeyRequest {
+    name?: string;
+    permissions?: ApiKeyPermission[];
+    rate_limit?: number | null;
+    expires_at?: string | null;
+}
+/** Options for the `createApiKeys` factory. */
+export interface CreateApiKeysOptions {
+    apiKeysPath?: string;
+}
+/**
+ * Creates a client for managing API keys via the admin routes.
+ *
+ * @param transport - The shared HTTP transport created by `createTransport`.
+ * @param options   - Optional overrides (e.g. a custom base path).
+ */
+export declare function createApiKeys(transport: Transport, options?: CreateApiKeysOptions): {
+    listKeys: () => Promise<{
+        keys: ApiKeyMasked[];
+    }>;
+    getKey: (id: string) => Promise<{
+        key: ApiKeyMasked;
+    }>;
+    createKey: (data: CreateApiKeyRequest) => Promise<{
+        key: ApiKeyWithSecret;
+    }>;
+    updateKey: (id: string, data: UpdateApiKeyRequest) => Promise<{
+        key: ApiKeyMasked;
+    }>;
+    revokeKey: (id: string) => Promise<{
+        success: boolean;
+    }>;
+};

package/dist/auth.d.ts

@@ -1,31 +1,24 @@
 import { Transport } from "./transport";
-export interface RebaseUser {
+import type { AuthChangeEvent, RebaseSession, AuthTokens, DeviceSession, User } from "@rebasepro/types";
+export type { RebaseSession, AuthTokens, AuthChangeEvent, DeviceSession } from "@rebasepro/types";
+/** @deprecated Use `User` from `@rebasepro/types` instead. */
+export type RebaseUser = User;
+/** @deprecated Use `AuthTokens` from `@rebasepro/types` instead. */
+export type RebaseTokens = AuthTokens;
+/** Minimal, non-sensitive user profile returned by {@link findUserByEmail}. */
+export interface PublicUserProfile {
     uid: string;
-    email: string | null;
     displayName: string | null;
     photoURL: string | null;
-    emailVerified?: boolean;
-    roles?: string[];
-    providerId: string;
-    isAnonymous: boolean;
 }
-export interface RebaseTokens {
-    accessToken: string;
-    refreshToken: string;
-    accessTokenExpiresAt: number;
-}
-export interface RebaseSession {
-    accessToken: string;
-    refreshToken: string;
-    expiresAt: number;
-    user: RebaseUser;
-}
-export type AuthChangeEvent = "SIGNED_IN" | "SIGNED_OUT" | "TOKEN_REFRESHED" | "USER_UPDATED";
 export interface AuthConfig {
     needsSetup: boolean;
     registrationEnabled: boolean;
-    googleEnabled: boolean;
-    emailServiceEnabled: boolean;
+    emailServiceEnabled?: boolean;
+    passwordReset?: boolean;
+    emailVerification?: boolean;
+    magicLink?: boolean;
+    enabledProviders: string[];
 }
 export interface AuthStorage {
     getItem: (key: string) => string | null;
@@ -38,40 +31,53 @@ export interface CreateAuthOptions {
     authPath?: string;
     autoRefresh?: boolean;
     persistSession?: boolean;
+    /**
+     * Authentication flow mode.
+     * - 'json' (default): Tokens are sent/received in JSON bodies. Refresh token is stored in local storage.
+     * - 'cookie': Refresh token is sent/received via httpOnly cookies. Access token remains in memory.
+     */
+    authFlowMode?: "json" | "cookie";
 }
 export declare function createAuth(transport: Transport, options?: CreateAuthOptions): {
     signInWithEmail: (email: string, password: string) => Promise<{
-        user: RebaseUser;
+        user: User;
         accessToken: string;
         refreshToken: string;
     }>;
     signUp: (email: string, password: string, displayName?: string) => Promise<{
-        user: RebaseUser;
+        user: User;
         accessToken: string;
         refreshToken: string;
     }>;
-    signInWithGoogle: (idToken: string) => Promise<{
-        user: RebaseUser;
+    signInWithGoogle: (payload: {
+        idToken: string;
+    } | {
+        accessToken: string;
+    } | {
+        code: string;
+        redirectUri: string;
+    }) => Promise<{
+        user: User;
         accessToken: string;
         refreshToken: string;
     }>;
     signInWithLinkedin: (code: string, redirectUri: string) => Promise<{
-        user: RebaseUser;
+        user: User;
         accessToken: string;
         refreshToken: string;
     }>;
     signInWithOAuth: (providerId: string, payload: Record<string, unknown>) => Promise<{
-        user: RebaseUser;
+        user: User;
         accessToken: string;
         refreshToken: string;
     }>;
     signInWithGitHub: (code: string, redirectUri: string) => Promise<{
-        user: RebaseUser;
+        user: User;
         accessToken: string;
         refreshToken: string;
     }>;
     signInWithMicrosoft: (code: string, redirectUri: string) => Promise<{
-        user: RebaseUser;
+        user: User;
         accessToken: string;
         refreshToken: string;
     }>;
@@ -82,52 +88,53 @@ export declare function createAuth(transport: Transport, options?: CreateAuthOpt
         };
         email?: string;
     }) => Promise<{
-        user: RebaseUser;
+        user: User;
         accessToken: string;
         refreshToken: string;
     }>;
     signInWithFacebook: (code: string, redirectUri: string) => Promise<{
-        user: RebaseUser;
+        user: User;
         accessToken: string;
         refreshToken: string;
     }>;
     signInWithTwitter: (code: string, redirectUri: string, codeVerifier: string) => Promise<{
-        user: RebaseUser;
+        user: User;
         accessToken: string;
         refreshToken: string;
     }>;
     signInWithDiscord: (code: string, redirectUri: string) => Promise<{
-        user: RebaseUser;
+        user: User;
         accessToken: string;
         refreshToken: string;
     }>;
     signInWithGitLab: (code: string, redirectUri: string) => Promise<{
-        user: RebaseUser;
+        user: User;
         accessToken: string;
         refreshToken: string;
     }>;
     signInWithBitbucket: (code: string, redirectUri: string) => Promise<{
-        user: RebaseUser;
+        user: User;
         accessToken: string;
         refreshToken: string;
     }>;
     signInWithSlack: (code: string, redirectUri: string) => Promise<{
-        user: RebaseUser;
+        user: User;
         accessToken: string;
         refreshToken: string;
     }>;
     signInWithSpotify: (code: string, redirectUri: string) => Promise<{
-        user: RebaseUser;
+        user: User;
         accessToken: string;
         refreshToken: string;
     }>;
     signOut: () => Promise<void>;
     refreshSession: () => Promise<RebaseSession>;
-    getUser: () => Promise<RebaseUser>;
+    getUser: () => Promise<User>;
+    findUserByEmail: (email: string) => Promise<PublicUserProfile | null>;
     updateUser: (updates: {
         displayName?: string;
         photoURL?: string;
-    }) => Promise<RebaseUser>;
+    }) => Promise<User>;
     resetPasswordForEmail: (email: string) => Promise<{
         success: boolean;
         message: string;
@@ -148,7 +155,16 @@ export declare function createAuth(transport: Transport, options?: CreateAuthOpt
         success: boolean;
         message: string;
     }>;
-    getSessions: () => Promise<Record<string, unknown>[]>;
+    sendMagicLink: (email: string) => Promise<{
+        success: boolean;
+        message: string;
+    }>;
+    verifyMagicLink: (token: string) => Promise<{
+        user: User;
+        accessToken: string;
+        refreshToken: string;
+    }>;
+    getSessions: () => Promise<DeviceSession[]>;
     revokeSession: (sessionId: string) => Promise<{
         success: boolean;
     }>;
@@ -158,4 +174,13 @@ export declare function createAuth(transport: Transport, options?: CreateAuthOpt
     getAuthConfig: () => Promise<AuthConfig>;
     getSession: () => RebaseSession | null;
     onAuthStateChange: (callback: (event: AuthChangeEvent, session: RebaseSession | null) => void) => () => boolean;
+    isInitialized: () => Promise<void>;
 };
+export interface CookieStorageOptions {
+    path?: string;
+    domain?: string;
+    secure?: boolean;
+    sameSite?: "Lax" | "Strict" | "None";
+    maxAge?: number;
+}
+export declare function createCookieStorage(options?: CookieStorageOptions): AuthStorage;

package/dist/backups.d.ts

@@ -0,0 +1,13 @@
+import { Transport } from "./transport";
+import type { BackupInfo, BackupDestinationKind } from "@rebasepro/types";
+export interface CreateBackupsOptions {
+    backupsPath?: string;
+}
+export declare function createBackups(transport: Transport, options?: CreateBackupsOptions): {
+    list: () => Promise<{
+        backups: BackupInfo[];
+        destinationKind: BackupDestinationKind;
+        configured: boolean;
+    }>;
+    download: (key: string) => Promise<Blob>;
+};

package/dist/collection.d.ts

@@ -1,19 +1,17 @@
-import { Transport } from "./transport";
+import { FindParams, Transport } from "./transport";
 import { RebaseWebSocketClient } from "./websocket";
-import { CollectionAccessor } from "@rebasepro/types";
-import { FilterOperator, QueryBuilder } from "./query_builder";
+import { SDKCollectionClient } from "@rebasepro/types";
 /**
- * CollectionClient extends `CollectionAccessor` from `@rebasepro/types` so that
- * `client.data` can be passed directly to the core Rebase component.
+ * The concrete, HTTP-backed implementation of the public
+ * {@link SDKCollectionClient} contract — flat rows (no Entity wrapper), plus
+ * fluent query-builder methods (`.where()`, `.orderBy()`, …).
  *
- * Additionally it exposes fluent query builder methods like `.where()`, `.orderBy()`.
+ * This is what `createRebaseClient().data.<collection>` returns. It is not a
+ * separate API from {@link SDKCollectionClient}; it only widens it with
+ * `count()`. Program against {@link SDKCollectionClient} when you want a
+ * transport-agnostic type.
  */
-export interface CollectionClient<M extends Record<string, unknown> = Record<string, unknown>> extends CollectionAccessor<M> {
-    where(column: keyof M & string, operator: FilterOperator, value: unknown): QueryBuilder<M>;
-    orderBy(column: keyof M & string, ascending?: "asc" | "desc"): QueryBuilder<M>;
-    limit(count: number): QueryBuilder<M>;
-    offset(count: number): QueryBuilder<M>;
-    search(searchString: string): QueryBuilder<M>;
-    include(...relations: string[]): QueryBuilder<M>;
+export interface CollectionClient<M extends Record<string, unknown> = Record<string, unknown>, I = Partial<M>, U = Partial<M>> extends SDKCollectionClient<M, I, U> {
+    count(params?: FindParams): Promise<number>;
 }
 export declare function createCollectionClient<M extends Record<string, unknown> = Record<string, unknown>>(transport: Transport, slug: string, ws?: RebaseWebSocketClient): CollectionClient<M>;

package/dist/collection.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/data-proxy.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/errors.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Client-side logic error (e.g. accessing an unknown collection when a typed
+ * dictionary is available). A subclass of {@link RebaseApiError}, so a single
+ * `catch (e) { if (e instanceof RebaseApiError) ... }` covers it too.
+ *
+ * The canonical definition now lives in `@rebasepro/types`; re-exported here to
+ * preserve the historical `import { RebaseClientError } from ".../errors"` path.
+ */
+export { RebaseClientError } from "@rebasepro/types";

package/dist/functions.d.ts

@@ -0,0 +1,49 @@
+import type { Transport } from "./transport";
+/**
+ * Client interface for invoking custom backend functions.
+ *
+ * Custom functions are Hono route files auto-mounted by the Rebase backend
+ * at `/api/functions/{name}`.  The `FunctionsClient` wraps the shared
+ * transport so callers never need to manually construct URLs or inject
+ * auth tokens.
+ *
+ * @example
+ * ```ts
+ * const result = await client.functions.invoke<{ job: Job }>('extract-job', {
+ *     url: 'https://example.com/posting',
+ *     html: htmlContent,
+ * });
+ * ```
+ */
+export interface FunctionsClient {
+    /**
+     * Invoke a custom backend function by name.
+     *
+     * @typeParam T - Expected shape of the response payload.
+     * @param name    - Function name (the filename without extension, e.g. `"extract-job"`).
+     * @param payload - Optional JSON-serialisable body sent as `POST`.
+     * @param options - Optional overrides (HTTP method, sub-path, extra headers).
+     * @returns The parsed JSON response from the function.
+     */
+    invoke<T = unknown>(name: string, payload?: unknown, options?: FunctionInvokeOptions): Promise<T>;
+}
+export interface FunctionInvokeOptions {
+    /** HTTP method — defaults to `"POST"`. */
+    method?: "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
+    /** Sub-path appended after the function name, e.g. `"status/123"`. */
+    path?: string;
+    /** Extra headers merged into the request (auth is still injected automatically). */
+    headers?: Record<string, string>;
+}
+/**
+ * Create a `FunctionsClient` backed by the given transport.
+ *
+ * The transport already handles:
+ * - Base URL resolution
+ * - JWT injection via `Authorization: Bearer`
+ * - 401 retry / `onUnauthorized` flow
+ * - Consistent error throwing via `RebaseApiError`
+ *
+ * @internal
+ */
+export declare function createFunctionsClient(transport: Transport): FunctionsClient;