@sovaria/sdk 0.0.0-stage → 0.4.0

package/dist/index.d.ts

@@ -0,0 +1,2046 @@
+export { SovariaError, userMessageFor } from './errors.js';
+export type { SovariaErrorCode } from './errors.js';
+import { DocumentReference, Query, WriteBatch, type Transaction } from './collections.js';
+export { DocumentReference, FieldValue, LiveQuery, Query, Transaction, WriteBatch, newDocumentId, splitTransforms, type DocumentChange, type DocumentSnapshot, type QuerySnapshot, type WhereOp, } from './collections.js';
+import { type OfflineController, type OfflineOptions } from './offline.js';
+import { CrashReporter } from './crashes.js';
+export { CrashReporter, parseStack, type Breadcrumb, type CrashEvent, type CrashOptions } from './crashes.js';
+export { evaluateQuery, indexedDbStorage, keyValueStorage, memoryStorage, type OfflineController, type OfflineOptions, type OfflineStorage, } from './offline.js';
+export { ARGON2_HASH_LEN, ARGON2_MEMORY_COST, ARGON2_PARALLELISM, ARGON2_SALT_LEN, ARGON2_TIME_COST, computePayloadHash, decryptDocument, decryptDocumentWithKek, deriveKek, DEK_SIZE_BYTES, encryptDocument, encryptDocumentWithKek, generateSalt, hexToBytes, bytesToHex, NONCE_SIZE_BYTES, zeroBytes, type EncryptedEnvelope, } from './crypto.js';
+export type JsonPrimitive = string | number | boolean | null;
+export type JsonValue = JsonPrimitive | JsonObject | JsonArray;
+export type JsonArray = JsonValue[];
+export type JsonObject = {
+    [key: string]: JsonValue;
+};
+export interface SovariaScope {
+    orgId: string;
+    projectId: string;
+    envId?: string;
+}
+/** Where a signed-in session is kept between page loads (localStorage-compatible). */
+export interface SessionStorageLike {
+    getItem(key: string): string | null;
+    setItem(key: string, value: string): void;
+    removeItem(key: string): void;
+}
+/** The signed-in app user's tokens. `null` when nobody is signed in (anon key only). */
+export interface SovariaSession {
+    access_token: string;
+    refresh_token?: string;
+    /** Epoch milliseconds when the access token expires. */
+    expires_at: number;
+}
+export type AuthChangeEvent = 'INITIAL_SESSION' | 'SIGNED_IN' | 'TOKEN_REFRESHED' | 'SIGNED_OUT';
+export type PersistSessionOption = boolean | {
+    storage?: SessionStorageLike;
+    key?: string;
+};
+export interface SovariaSDKOptions {
+    baseUrl: string;
+    /**
+     * Keep the signed-in session across reloads and tell listeners about sign-in/out.
+     * `true` uses localStorage; pass `{ storage, key }` for anything else (cookies, AsyncStorage adapter…).
+     */
+    persistSession?: PersistSessionOption;
+    accessToken?: string;
+    refreshToken?: string;
+    expiresIn?: number;
+    fetchImpl?: typeof fetch;
+    retryCount?: number;
+    retryBaseDelayMs?: number;
+    /**
+     * Called whenever tokens are set or refreshed (login, refresh, OTP verify, etc.).
+     * The default payload omits `refresh_token`. Use `onTokenRefreshSensitive` if you
+     * explicitly need the refresh token (store it securely; never log it).
+     */
+    onTokenRefresh?: (tokens: JsonObject) => void;
+    /** Opt-in callback that receives the full token JSON including refresh_token. */
+    onTokenRefreshSensitive?: (tokens: JsonObject) => void;
+    /**
+     * Mobile / desktop apps: the device this app runs on. Sessions are grouped by it
+     * (`auth.listDevices`, sign a device out) and push tokens are tied to it. Keep `id` stable
+     * (generate once, store it in the Keychain / Keystore / AsyncStorage).
+     */
+    device?: SovariaDevice;
+    /**
+     * App attestation: returns the current attestation token (from `api.attestation.exchange`)
+     * or null. Sent as `X-Sovaria-Attestation` on every request when the project enforces it.
+     */
+    attestationToken?: () => string | null | undefined | Promise<string | null | undefined>;
+}
+export interface SovariaDevice {
+    id: string;
+    name?: string;
+    platform?: 'ios' | 'android' | 'web' | 'macos' | 'windows' | 'linux' | 'other';
+    appVersion?: string;
+}
+export interface SovariaPortalConfig {
+    url?: string;
+    baseUrl?: string;
+    orgId?: string;
+    org_id?: string;
+    projectId?: string;
+    project_id?: string;
+    envId?: string;
+    env_id?: string;
+    accessToken?: string;
+    access_token?: string;
+    publishableKey?: string;
+    publishable_key?: string;
+    anonKey?: string;
+    anon_key?: string;
+    expiresIn?: number;
+    expires_in?: number;
+    /** Called with new tokens after a refresh — persist them so the user stays signed in. */
+    onTokenRefresh?: (tokens: JsonObject) => void;
+    onTokenRefreshSensitive?: (tokens: JsonObject) => void;
+    /**
+     * Keep the app user's session across reloads (default: on in browsers when a publishable/anon key
+     * is given). `false` turns it off; `{ storage, key }` stores it somewhere else.
+     */
+    persistSession?: PersistSessionOption;
+}
+export interface RequestOptions {
+    query?: Record<string, string | number | boolean | null | undefined>;
+    body?: unknown;
+    headers?: Record<string, string>;
+    requiresAuth?: boolean;
+    requiresScope?: boolean;
+    /**
+     * Idempotency-Key sent on every attempt. Writes (POST/PUT/PATCH/DELETE) get a fresh key per call
+     * when this is not set; pass your own to make a call safe to repeat yourself (same key, same body).
+     */
+    idempotencyKey?: string;
+    /** Kept for compatibility: every write now carries a stable Idempotency-Key from the first attempt. */
+    idempotent?: boolean;
+    /** 'blob' returns the raw response body (binary downloads); default parses JSON or text. */
+    responseType?: 'json' | 'blob';
+    /** Called with the response headers of a successful response (paging cursors, totals). */
+    onResponseHeaders?: (headers: Headers) => void;
+}
+/** `sovaria.data.dryRunMigrations`: every migration ran in order in one transaction, then rolled back. */
+/** `sovaria.data.schemaDigest`: the schema as one short line per table. */
+export interface SchemaDigest {
+    /** Changes whenever the schema does; pass it back as `since`. */
+    version: string;
+    tables: number;
+    /** Legend first, then one line per table: `orders(id uuid pk=gen_random_uuid(), status text!='pending' in(pending|paid), customer_id uuid →customers cascade) rls:owner(user_id)`. */
+    text?: string;
+    /** Only with `since`, when nothing changed (no `text`). */
+    unchanged?: boolean;
+}
+/** One table in a schema plan. Columns are short form (`"status text!='draft' in(draft|live)"`, `"customer_id →customers cascade"`) or objects. */
+export interface SchemaPlanTable {
+    name: string;
+    columns?: Array<string | {
+        name: string;
+        type?: string;
+        nullable?: boolean;
+        default?: string | number | boolean;
+        unique?: boolean;
+        references?: string;
+        on_delete?: 'cascade' | 'set null' | 'restrict';
+        values?: string[];
+        check?: string;
+        index?: boolean;
+    }>;
+    /** owner_rows: user_id + each signed-in user sees only their rows; public_read (with owner_rows); timestamps; soft_delete. */
+    patterns?: Array<'owner_rows' | 'public_read' | 'timestamps' | 'soft_delete'>;
+    owner?: string;
+    primary_key?: string[];
+    unique?: string[][];
+    indexes?: string[][];
+}
+/** `sovaria.data.applySchemaPlan`: what the plan created and changed, and whether the result matches it. */
+export interface SchemaPlanResult {
+    status: 'applied' | 'dry_run_ok' | 'unchanged';
+    migration_version?: string;
+    created?: string[];
+    /** Per extended table: what was added (`+column`, `idx(..)`, `rls:owner(..)`). */
+    altered?: Record<string, string[]>;
+    notes?: string[];
+    /** The touched tables as they now are (digest lines). */
+    digest?: string;
+    /** With dryRun: the SQL that would run, and its undo. */
+    up_sql?: string;
+    down_sql?: string;
+    verification?: {
+        ok: boolean;
+        checks: Array<{
+            check: string;
+            ok: boolean;
+            problems?: string[];
+        }>;
+    };
+}
+export interface MigrationSequenceResult {
+    status: 'dry_run_ok' | 'failed';
+    /** How many ran cleanly (before the failing one, when one fails). */
+    checked: number;
+    total: number;
+    duration_ms: number;
+    /** The first migration that fails: its position in the list, name and the database error. */
+    failed?: {
+        index: number;
+        name: string;
+        error: string;
+    };
+}
+export interface ProductUsersPage {
+    users: JsonObject[];
+    /** Pass back as `cursor` for the next page; null on the last page. */
+    nextCursor: string | null;
+    /** Users matching the filter; sent with the first page. */
+    total: number | null;
+}
+export declare class SovariaSDK {
+    private readonly baseUrl;
+    private readonly fetchImpl;
+    private readonly retryCount;
+    private readonly retryBaseDelayMs;
+    private accessToken;
+    /** Project anon/publishable key: the token used when no user is signed in. */
+    private publishableKey;
+    /** PKCE verifier for an in-flight provider sign-in (fallback when sessionStorage is unavailable). */
+    private ssoVerifier;
+    /** PKCE verifier for an email link that opens an app (magic link / password reset). */
+    private linkVerifier;
+    private readonly device?;
+    private readonly attestationToken?;
+    private refreshToken;
+    private expiresAtMs;
+    private refreshInFlight;
+    private scope?;
+    /** In-flight lookup of the project/org behind a project URL (see resolveScope). */
+    private scopeLookup?;
+    private readonly onTokenRefresh?;
+    private readonly onTokenRefreshSensitive?;
+    private sessionStore?;
+    private readonly authListeners;
+    /** Session-cached Argon2id salt (hex from login/register). */
+    private argon2Salt?;
+    /** Session-cached KEK derived at login — reused for E2EE document ops. */
+    private cachedKek?;
+    constructor(options: SovariaSDKOptions);
+    /** Device + attestation headers (mobile apps); empty for a plain web or server client. */
+    private clientHeaders;
+    /** Start a PKCE pair for an email link; the verifier is kept (session storage too) until the link is opened. */
+    private startLinkPkce;
+    private takeLinkVerifier;
+    private configureSessionStore;
+    /** Load a stored session (called once the publishable key is known, so sign-out falls back to it). */
+    private restoreSession;
+    private writeSession;
+    private currentSession;
+    private emitAuth;
+    static fromPortalConfig(config: SovariaPortalConfig): SovariaSDK;
+    static fromEnv(env?: Record<string, string | undefined>): SovariaSDK;
+    setAccessToken(token: string, options?: {
+        expiresIn?: number;
+    }): this;
+    setRefreshToken(token: string): this;
+    clearAccessToken(): this;
+    private clearKekCache;
+    private cacheArgon2SaltFromResponse;
+    private tryDeriveKekFromPassword;
+    private applyAuthResponse;
+    private tokenNeedsRefresh;
+    /** Refresh when the token is near expiry, or always with `force` (the server said 401). */
+    private ensureAccessTokenFresh;
+    setScope(scope: SovariaScope): this;
+    clearScope(): this;
+    /**
+     * The org/project this client talks to. Set explicitly with setScope(), or discovered once from
+     * the project URL (https://<ref>.sovarias.in) — so `createClient(projectUrl, anonKey)` is enough.
+     */
+    resolveScope(): Promise<SovariaScope | undefined>;
+    getScopeHeaders(): Record<string, string>;
+    getRealtimeWebSocketUrl(channel: string, ticket?: string): string;
+    issueRealtimeWebSocketTicket(channel: string): Promise<string>;
+    getRealtimeWebSocketUrlWithTicket(channel: string): Promise<string>;
+    private offlineTransport?;
+    /**
+     * Offline-first documents: reads fall back to a local cache, offline writes are applied locally at
+     * once and queued, and everything syncs in order when the connection is back. Call once, before
+     * reading or writing documents.
+     *
+     * ```ts
+     * const offline = sov.enableOffline({ storage: indexedDbStorage(), onSyncError: (e, writes) => console.warn(e, writes) })
+     * ```
+     */
+    enableOffline(options?: OfflineOptions): OfflineController;
+    private documentsTransport;
+    private onlineDocumentsTransport;
+    /**
+     * A document collection (or `users/alice/posts` subcollection): field queries, cursors,
+     * live listeners and `add`.
+     *
+     * ```ts
+     * const snap = await sov.collection('posts').where('tags', 'array-contains', 'news').orderBy('at', 'desc').limit(20).get()
+     * ```
+     */
+    collection<T = JsonObject>(path: string): Query<T>;
+    /** A document reference: `get`, `set` (merge), `create`, `update` with FieldValue transforms, `delete`, `onSnapshot`. */
+    doc<T = JsonObject>(path: string): DocumentReference<T>;
+    /** Writes committed together: every one or none. */
+    batch(): WriteBatch;
+    /** Read then write atomically; retried (up to `maxAttempts`) when a document it read changes meanwhile. */
+    runTransaction<R>(fn: (tx: Transaction) => Promise<R>, maxAttempts?: number): Promise<R>;
+    /**
+     * App crash reporting: `sov.crashes.install({ release })` reports uncaught errors (browser and React
+     * Native); `sov.crashes.capture(error)` reports one you caught. Issues appear in the console under
+     * Observability › Crashes.
+     */
+    readonly crashes: CrashReporter;
+    request<T = unknown>(method: string, path: string, options?: RequestOptions): Promise<T>;
+    private requestImpl;
+    private pathRequiresScope;
+    private assertScopePresent;
+    private productAuthRequest;
+    private productAuthPath;
+    readonly auth: {
+        /**
+         * Listen for sign-in, token refresh and sign-out. Fires once right away with the current
+         * session (`INITIAL_SESSION`). Returns a function that stops listening.
+         */
+        onAuthStateChange: (callback: (event: AuthChangeEvent, session: SovariaSession | null) => void) => () => void;
+        /** The signed-in app user's session, or null. */
+        getSession: () => SovariaSession | null;
+        /** Sign the app user out (revokes the refresh token) and fall back to the anon key. */
+        signOut: () => Promise<void>;
+        /**
+         * Create an app user and sign them in. When the project requires email confirmation, the
+         * result has `email_verification_required: true` and no session until the user confirms.
+         */
+        signUp: (email: string, password: string, name?: string) => Promise<JsonObject>;
+        /** Sign an app user in with email and password (same as projectLogin). */
+        signIn: (email: string, password: string) => Promise<JsonObject>;
+        /** Create an app user (no session). Most apps want signUp(), which also signs them in. */
+        register: (email: string, password: string, name: string) => Promise<JsonObject>;
+        /**
+         * @deprecated Use {@link consoleLogin} for operators or {@link projectLogin}
+         * for product users. Unscoped calls post to `/api/v1/auth/console/login`.
+         */
+        login: (email: string, password: string) => Promise<JsonObject>;
+        /** Strict console login — rejects every project-scoped credential. */
+        consoleLogin: (email: string, password: string) => Promise<JsonObject>;
+        /** Alias for consoleLogin() matching lane terminology in docs. */
+        loginConsole: (email: string, password: string) => Promise<JsonObject>;
+        /** Strict project login — requires X-Sovaria-Org-ID + X-Sovaria-Project-ID. */
+        projectLogin: (email: string, password: string) => Promise<JsonObject>;
+        /** Alias for projectLogin() matching lane terminology in docs. */
+        loginProduct: (email: string, password: string) => Promise<JsonObject>;
+        refresh: (refreshToken: string) => Promise<JsonObject>;
+        logout: (refreshToken?: string) => Promise<JsonObject>;
+        me: () => Promise<JsonObject>;
+        verifyMfa: (code: string, method?: "totp" | "phone") => Promise<JsonObject>;
+        /** Send a one-time login link by email. Returns 200 even for unknown emails. */
+        /**
+         * Email a sign-in link (plus a 6-digit code). A link that opens a mobile app (`myapp://…` or a
+         * registered app link) is bound to this app with PKCE automatically; pass `pkce: true` to force it.
+         */
+        sendMagicLink: (email: string, opts?: {
+            orgId?: string;
+            projectId?: string;
+            redirectTo?: string;
+            pkce?: boolean;
+        }) => Promise<JsonObject>;
+        /** Email a password-reset link. Returns 200 even for unknown emails. */
+        resetPasswordForEmail: (email: string, opts?: {
+            orgId?: string;
+            projectId?: string;
+            redirectTo?: string;
+            pkce?: boolean;
+        }) => Promise<JsonObject>;
+        /** Set a new password with the token from a reset link (`type=recovery`). */
+        confirmPasswordReset: (token: string, newPassword: string, codeVerifier?: string) => Promise<JsonObject>;
+        /**
+         * Handle the link an auth email opened (`?token=…&type=…` on your Site URL).
+         * Magic links sign the user in; email confirmations are confirmed; for `recovery`
+         * the token is returned so you can show a "new password" form and call
+         * `confirmPasswordReset`. Returns null when the URL isn't an auth link.
+         */
+        handleEmailLink: (url?: string) => Promise<{
+            type: string;
+            error: string;
+            description: string | undefined;
+            session?: undefined;
+            result?: undefined;
+            token?: undefined;
+        } | {
+            type: string;
+            session: JsonObject;
+            error?: undefined;
+            description?: undefined;
+            result?: undefined;
+            token?: undefined;
+        } | {
+            type: string;
+            result: JsonObject;
+            error?: undefined;
+            description?: undefined;
+            session?: undefined;
+            token?: undefined;
+        } | {
+            type: string;
+            token: string;
+            error?: undefined;
+            description?: undefined;
+            session?: undefined;
+            result?: undefined;
+        } | null>;
+        /**
+         * "Sign in with Google / GitHub / …" (providers connected in Authentication › Sign in / Providers).
+         * Sends the browser to the provider; it comes back to `redirectTo` (or your Site URL) with
+         * `?code=…&type=sso`, which `handleEmailLink()` / `exchangeCodeForSession()` turn into a session.
+         * A PKCE verifier is kept in sessionStorage so only this browser can redeem the code.
+         */
+        signInWithProvider: (providerId: string, opts?: {
+            redirectTo?: string;
+            projectId?: string;
+        }) => Promise<{
+            url: string;
+        }>;
+        /** Exchange the one-time `code` from a provider sign-in redirect for a session. */
+        exchangeCodeForSession: (code: string, codeVerifier?: string) => Promise<JsonObject>;
+        /** Enabled social / enterprise providers for your sign-in screen. */
+        listProviders: (projectId?: string) => Promise<JsonValue>;
+        /** Public sign-in config for a project: enabled providers, password rules, MFA factors, passkeys. */
+        getPublicConfig: (projectId?: string) => Promise<JsonObject>;
+        /** Exchange a magic-link token for an access + refresh token pair. */
+        verifyMagicLink: (token: string, codeVerifier?: string) => Promise<JsonObject>;
+        /**
+         * Sign in with the 6-digit code from the sign-in email (the same email carries the magic link).
+         * Uses the client scope's org/project unless given.
+         */
+        verifyEmailCode: (email: string, code: string, opts?: {
+            orgId?: string;
+            projectId?: string;
+        }) => Promise<JsonObject>;
+        /** Send an SMS OTP code for phone-based login. */
+        sendOtp: (phone: string, opts?: {
+            orgId?: string;
+            projectId?: string;
+            envId?: string;
+        }) => Promise<JsonObject>;
+        /** Verify an SMS OTP code and establish a session.
+         * Passwordless by default — pass `password` when argon2_salt is present to
+         * populate the session KEK without a follow-up password login.
+         */
+        verifyOtp: (phone: string, code: string, opts?: {
+            orgId?: string;
+            projectId?: string;
+            envId?: string;
+            password?: string;
+        }) => Promise<JsonObject>;
+        /** Exchange an OAuth handoff token for a session (console OAuth callback).
+         * Passwordless: session KEK is not derived unless `password` is supplied.
+         */
+        oauthHandoff: (token: string, password?: string) => Promise<JsonObject>;
+        /** Console-operator listing of product users across accessible projects. Path: GET /api/v1/auth/product-users (console lane). */
+        listConsoleProductUsers: () => Promise<JsonValue>;
+        /** Trigger a verification email for the authenticated user. */
+        sendVerificationEmail: () => Promise<JsonObject>;
+        /** Confirm an email-verification token. */
+        confirmVerificationEmail: (token: string) => Promise<JsonObject>;
+        /**
+         * Auth event hooks (per-project HTTP webhooks). The project is the client's scope
+         * (`X-Sovaria-Project-ID`); the caller must be an owner or admin of it.
+         */
+        eventHooks: {
+            list: () => Promise<JsonValue>;
+            create: (payload: {
+                name: string;
+                url: string;
+                events: string[];
+                secret?: string;
+                enabled?: boolean;
+                projectId?: string;
+            }) => Promise<JsonObject>;
+            delete: (hookId: string) => Promise<JsonObject>;
+        };
+        /**
+         * @deprecated Legacy GET `/api/v1/auth/users`. Use `productUsers.list()` for
+         * project-scoped product users or `listConsoleProductUsers()` for the console
+         * product-user admin path. Use `consoleMembers.list()` for org console members.
+         */
+        listUsers: () => Promise<JsonValue>;
+        /**
+         * @deprecated Legacy DELETE `/api/v1/auth/users/{id}`. Use `productUsers.delete()`
+         * or `consoleMembers.delete()`.
+         */
+        deleteUser: (userId: string) => Promise<JsonObject>;
+        /**
+         * @deprecated Legacy POST `/api/v1/auth/users/{id}/ban`. Use `productUsers.ban()`.
+         */
+        banUser: (userId: string) => Promise<JsonObject>;
+        /** Org console-member management. Canonical path: GET /api/v1/org/{orgId}/members. Not product users. */
+        consoleMembers: {
+            list: () => Promise<JsonValue>;
+            delete: (userId: string) => Promise<JsonObject>;
+            ban: (userId: string) => Promise<JsonObject>;
+        };
+        /** Product auth admin (project-scoped identities). Path: GET /api/v1/projects/{id}/auth/users. Requires setScope. */
+        productUsers: {
+            /** Every product user: follows all pages. Use `listPage()` for big projects. */
+            list: () => Promise<JsonObject[]>;
+            /** One page of product users, newest first. `search` matches part of an email or an exact id. */
+            listPage: (params?: {
+                limit?: number;
+                cursor?: string | null;
+                search?: string;
+                status?: "active" | "banned";
+            }) => Promise<ProductUsersPage>;
+            delete: (userId: string) => Promise<JsonObject>;
+            ban: (userId: string) => Promise<JsonObject>;
+            roles: (userId: string) => Promise<JsonObject>;
+            setRoles: (userId: string, roles: string[]) => Promise<JsonObject>;
+            create: (payload: {
+                email: string;
+                password: string;
+                name?: string;
+                roles?: string[];
+            }) => Promise<JsonObject>;
+            /**
+             * Bulk-import app users (up to 1,000 per call) with their ids and password hashes: `bcrypt`
+             * (Supabase) as is, `firebase_scrypt` (Firebase) checked with `hashConfig` and upgraded to bcrypt
+             * at first sign-in. No emails, hooks or triggers fire; existing emails are skipped. Org owners/admins.
+             */
+            import: (users: Array<{
+                email: string;
+                id?: string;
+                email_verified?: boolean;
+                phone?: string | null;
+                display_name?: string | null;
+                password_algorithm?: "bcrypt" | "firebase_scrypt" | null;
+                password_hash?: string | null;
+                password_salt?: string | null;
+            }>, hashConfig?: {
+                signer_key: string;
+                salt_separator: string;
+                rounds: number;
+                mem_cost: number;
+            }) => Promise<JsonObject>;
+        };
+        sessions: {
+            list: () => Promise<JsonValue>;
+            revoke: (sessionId: string) => Promise<JsonObject>;
+            revokeOthers: () => Promise<JsonObject>;
+            getConfig: () => Promise<JsonObject>;
+            setConfig: (body: JsonObject) => Promise<JsonObject>;
+        };
+        providersConfig: {
+            get: () => Promise<JsonObject>;
+            set: (body: JsonObject) => Promise<JsonObject>;
+        };
+        mfa: {
+            status: () => Promise<JsonObject>;
+            enroll: () => Promise<JsonObject>;
+            disable: (totpCode: string) => Promise<JsonObject>;
+        };
+        github: {
+            connectionState: () => Promise<JsonObject>;
+            disconnect: () => Promise<JsonObject>;
+        };
+    };
+    readonly graph: {
+        createNode: (nodeType: string, name: string, metadata?: JsonObject) => Promise<JsonObject>;
+        createEdge: (sourceId: string, targetId: string, relationType: string, role?: string) => Promise<JsonObject>;
+        addMember: (orgId: string, userId: string, role?: string) => Promise<JsonObject>;
+        getContext: (userId: string, resourceId: string) => Promise<JsonObject>;
+        listNodes: (nodeType?: string) => Promise<JsonValue>;
+        getNode: (nodeId: string) => Promise<JsonObject>;
+        getChildren: (parentId: string, relation?: string) => Promise<JsonValue>;
+        updateOrg: (orgId: string, body: JsonObject) => Promise<JsonObject>;
+        deleteOrg: (orgId: string) => Promise<JsonObject>;
+        setOrgPlan: (orgId: string, body: JsonObject) => Promise<JsonObject>;
+        listMembers: (orgId: string) => Promise<JsonValue>;
+        removeMember: (orgId: string, userId: string) => Promise<JsonObject>;
+        updateMember: (orgId: string, userId: string, body: JsonObject) => Promise<JsonObject>;
+        createInvite: (orgId: string, body: JsonObject) => Promise<JsonObject>;
+        acceptInvite: (body: JsonObject) => Promise<JsonObject>;
+        getRoleMatrix: () => Promise<JsonObject>;
+        setRoleMatrix: (body: JsonObject) => Promise<JsonObject>;
+        getRoleCatalog: () => Promise<JsonValue>;
+        getProjectRef: (projectId: string) => Promise<JsonObject>;
+        getProjectSettings: () => Promise<JsonObject>;
+        setProjectSettings: (body: JsonObject) => Promise<JsonObject>;
+    };
+    readonly data: {
+        docPut: (collection: string, documentId: string, data: JsonObject) => Promise<JsonObject>;
+        docGet: (collection: string, documentId: string, atTxid?: number) => Promise<JsonObject>;
+        docDelete: (collection: string, documentId: string) => Promise<JsonObject>;
+        /** Encrypt client-side and write a Zero-Knowledge document envelope to Atlas-Doc. */
+        putDocumentE2ee: (collection: string, documentId: string, plaintext: Uint8Array | string, password?: string) => Promise<JsonObject>;
+        /** Retrieve and decrypt a Zero-Knowledge document from Atlas-Doc. */
+        getDocumentE2ee: (collection: string, documentId: string, password?: string, atTxid?: number) => Promise<{
+            plaintext: Uint8Array<ArrayBufferLike>;
+        }>;
+        /**
+         * List the documents in one collection (newest writes last): `[{ id, data, txid }]`.
+         * Subcollections are not included — list `collection/<docId>/<sub>` for those.
+         */
+        docList: (collection: string, options?: {
+            limit?: number;
+        }) => Promise<{
+            id: string;
+            data: JsonObject;
+            txid: number;
+        }[]>;
+        /** Field query (`where`, `order_by`, `limit`, cursors) — see also `sov.collection(...)`. */
+        docQuery: (collection: string, query?: JsonObject) => Promise<JsonObject>;
+        docCount: (collection: string, query?: JsonObject) => Promise<JsonObject>;
+        /** Atomic commit: `{ op, path, data, merge, transforms, precondition }` writes; `reads` make it a transaction. */
+        docCommit: (writes: JsonObject[], reads?: JsonObject[]) => Promise<JsonObject>;
+        docIndexes: (collection?: string) => Promise<JsonObject>;
+        createDocIndex: (collection: string, fields: (string | {
+            path: string;
+            order?: "asc" | "desc";
+        })[]) => Promise<JsonObject>;
+        dropDocIndex: (name: string) => Promise<JsonObject>;
+        collectionRules: (collection: string) => Promise<JsonObject>;
+        docScan: (args: {
+            prefix?: string;
+            start_key?: string;
+            end_key?: string;
+            limit?: number;
+        }) => Promise<JsonObject>;
+        /**
+         * Run one SQL statement. Pass values for `$1, $2, …` as `params` — they are bound by the
+         * database, so user input never becomes SQL: `sql('SELECT * FROM books WHERE id = $1', [id])`.
+         * A number as the second argument is still read as `txid` (older signature).
+         */
+        sql: (sql: string, params?: JsonValue[] | number, txid?: number) => Promise<JsonObject>;
+        tableCreate: (payload: JsonObject) => Promise<JsonObject>;
+        tableDrop: (tableName: string) => Promise<JsonObject>;
+        tableAddColumn: (payload: JsonObject) => Promise<JsonObject>;
+        tableDropColumn: (tableName: string, columnName: string) => Promise<JsonObject>;
+        tableAddForeignKey: (payload: JsonObject) => Promise<JsonObject>;
+        tableDropForeignKey: (payload: JsonObject) => Promise<JsonObject>;
+        tableMigrations: (query?: {
+            table_name?: string;
+            limit?: number;
+            offset?: number;
+        }) => Promise<JsonObject>;
+        /** The schema as one short line per table: types, keys, →references, allowed values, indexes, owner-only rows. */
+        schemaDigest: (options?: {
+            tables?: string[];
+            maxChars?: number;
+            since?: string;
+        }) => Promise<SchemaDigest>;
+        /**
+         * Create or extend tables from one declarative plan: checked first (a 422 lists every problem and nothing
+         * changes), then applied as one reversible migration and verified. `dryRun` returns the SQL instead.
+         */
+        applySchemaPlan: (plan: {
+            tables: SchemaPlanTable[];
+            dryRun?: boolean;
+            name?: string;
+        }) => Promise<SchemaPlanResult>;
+        /** Apply a migration atomically and record it in the project's history. `downSql` makes it reversible. */
+        applyMigration: (migration: {
+            name: string;
+            upSql: string;
+            downSql?: string;
+            version?: string;
+        }) => Promise<JsonObject>;
+        /** Run a migration inside a transaction and roll it back: reports whether it would apply. */
+        dryRunMigration: (migration: {
+            name: string;
+            upSql: string;
+            downSql?: string;
+        }) => Promise<JsonObject>;
+        /**
+         * Check several migrations the way they will be applied (what `sov db migrations push --dry-run` does):
+         * all run in order inside one transaction that is rolled back, so later ones see what earlier ones
+         * create. Up to 500 and 5 MB of SQL; `failed.index` is the first that fails. Nothing is kept.
+         */
+        dryRunMigrations: (migrations: Array<{
+            name: string;
+            upSql: string;
+        }>) => Promise<MigrationSequenceResult>;
+        /** Undo the latest migration (or `version` with `force`) using its down SQL. */
+        rollbackMigration: (opts?: {
+            version?: string;
+            force?: boolean;
+        }) => Promise<JsonObject>;
+        beginTransaction: () => Promise<JsonObject>;
+        commitTransaction: (txid: number) => Promise<JsonObject>;
+        rollbackTransaction: (txid: number) => Promise<JsonObject>;
+    };
+    readonly realtime: {
+        subscribe: (channel: string, clientId: string) => Promise<JsonObject>;
+        unsubscribe: (channel: string, clientId: string) => Promise<JsonObject>;
+        presence: (channel: string) => Promise<JsonObject>;
+        channels: () => Promise<JsonObject>;
+        replay: (channel: string, after?: number, limit?: number) => Promise<JsonObject>;
+        publish: (channel: string, payload: JsonObject, clock?: JsonObject, clockDelta?: JsonObject) => Promise<JsonObject>;
+        e2eeBootstrap: (channel: string, ttlSeconds?: number, forceNew?: boolean) => Promise<JsonObject>;
+        e2eeRotate: (channel: string, ttlSeconds?: number) => Promise<JsonObject>;
+        e2eeRevoke: (channel: string, keyId?: string, reason?: string) => Promise<JsonObject>;
+        /** Pass your RSA-OAEP (SHA-256) public key — PEM or base64 SPKI — to get the key wrapped for you. */
+        e2eeActiveKey: (channel: string, clientPublicKey?: string) => Promise<JsonObject>;
+        e2eeGetKey: (channel: string, keyId: string, clientPublicKey?: string) => Promise<JsonObject>;
+        e2eeListKeys: (channel: string) => Promise<JsonObject>;
+        wsTicket: (channel: string) => Promise<string>;
+        wsUrl: (channel: string, ticket?: string) => string;
+        wsUrlWithTicket: (channel: string) => Promise<string>;
+        /**
+         * Listen on a channel over WebSocket. Reconnects with backoff (a fresh ticket each time) and
+         * hands you each message's payload. Call `close()` when done.
+         *
+         * ```ts
+         * const ch = sov.realtime.channel('book:42', { onMessage: (m) => console.log(m), onStatus: setStatus })
+         * await ch.send({ type: 'typing' })
+         * ch.close()
+         * ```
+         */
+        channel: (name: string, handlers?: RealtimeChannelHandlers) => RealtimeChannel;
+    };
+    readonly policy: {
+        templates: () => Promise<JsonObject>;
+        list: () => Promise<JsonValue>;
+        get: (policyId: string) => Promise<JsonObject>;
+        create: (payload: JsonObject) => Promise<JsonObject>;
+        update: (policyId: string, payload: JsonObject) => Promise<JsonObject>;
+        delete: (policyId: string) => Promise<JsonObject>;
+        evaluate: (policyId: string, context: JsonObject) => Promise<JsonObject>;
+        check: (payload: {
+            orgId: string;
+            projectId: string;
+            action: string;
+            resource: string;
+            context?: JsonObject;
+        }) => Promise<JsonObject>;
+        preflight: (action: string, resource: string, context?: JsonObject) => Promise<JsonObject>;
+        history: (policyId: string) => Promise<JsonValue>;
+        rollback: (policyId: string, version: number) => Promise<JsonObject>;
+        simulate: (splSource: string, context?: JsonObject) => Promise<JsonObject>;
+    };
+    readonly audit: {
+        append: (payload: JsonObject) => Promise<JsonObject>;
+        list: (query?: {
+            actor_id?: string;
+            event_type?: string;
+            source?: string;
+            resource_id?: string;
+            limit?: number;
+            offset?: number;
+        }) => Promise<JsonValue>;
+        verify: () => Promise<JsonObject>;
+        count: () => Promise<JsonObject>;
+    };
+    readonly simulate: {
+        /**
+         * Who can do what in the live project, as visitors, the app's users and the team; nothing is
+         * written. Narrow with `{ filter: { resource, action, role } }` (role: `__guest__`,
+         * `__app_user__`, `app:<role>` or a team role).
+         */
+        run: (payload?: JsonObject) => Promise<JsonObject>;
+        /**
+         * Try a change before making it; nothing is written. `{ kind: 'policy', policy: { spl_source,
+         * name?, replaces? }, disable_policy_ids? }` lists who gains and loses access; `{ kind: 'sql',
+         * sql }` runs the script with every check, rolls it back and lists what it changed.
+         */
+        change: (payload: JsonObject) => Promise<JsonObject>;
+        plan: (payload: JsonObject) => Promise<JsonObject>;
+        discover: () => Promise<JsonObject>;
+        listRuns: (query?: {
+            limit?: number;
+            offset?: number;
+        }) => Promise<JsonValue>;
+        getRun: (runId: string) => Promise<JsonObject>;
+        compareRuns: (targetRunId: string, baselineRunId: string) => Promise<JsonObject>;
+    };
+    readonly chrono: {
+        /** The project's configuration (policies, schema, functions, settings, buckets, keys) at a commit or ISO time. */
+        state: (query?: {
+            at?: string;
+            prefix?: string;
+            timeline?: string;
+        }) => Promise<JsonObject>;
+        /** What going back to `at` changes, file by file, with who would gain or lose access. Writes nothing. */
+        restorePlan: (at: string, timeline?: string) => Promise<JsonObject>;
+        /**
+         * Go back to `at`: applies the plan's automated changes with the caller's own permissions.
+         * `includeDatabase` also restores the database from the closest backup before `at` (replaces all
+         * data after a safety backup; undo within 7 days).
+         */
+        restore: (at: string, timeline?: string, options?: {
+            includeDatabase?: boolean;
+        }) => Promise<JsonObject>;
+        commit: (payload: JsonObject) => Promise<JsonObject>;
+        timelineSpawn: (payload: JsonObject) => Promise<JsonObject>;
+        timelineList: () => Promise<JsonObject>;
+        timelineDelete: (name: string) => Promise<JsonObject>;
+        timelineJump: (name: string, targetHex: string) => Promise<JsonObject>;
+        timelineHistory: (name: string, limit?: number, offset?: number) => Promise<JsonObject>;
+        topology: (timeline?: string, limit?: number) => Promise<JsonObject>;
+        converge: (payload: JsonObject) => Promise<JsonObject>;
+        variance: (payload: JsonObject) => Promise<JsonObject>;
+        snapshotCreate: (payload: JsonObject) => Promise<JsonObject>;
+        snapshotList: () => Promise<JsonObject>;
+        snapshotRestore: (snapshotId: number) => Promise<JsonObject>;
+    };
+    readonly functions: {
+        list: (options: {
+            projectId: string;
+            limit?: number;
+            offset?: number;
+        }) => Promise<JsonObject>;
+        /** Validate a bundle and get a signed plan bound to its exact bytes. */
+        plan: (bundle: Blob, name: string, projectId?: string) => Promise<JsonObject>;
+        /** Plans, then applies exactly the planned bundle (Forge refuses anything else). */
+        deploy: (bundle: Blob, name: string, projectId?: string) => Promise<JsonObject>;
+        status: (deployId: string, projectId?: string) => Promise<JsonObject>;
+        invoke: (functionName: string, payload: JsonValue, options?: {
+            projectId?: string;
+            deployId?: string;
+            executionProfile?: "standard" | "heavy";
+        }) => Promise<JsonObject>;
+        /**
+         * Call a function the way an app does: POST {projectUrl}/functions/v1/{name} with the signed-in
+         * user's token (or no token for functions marked public). Returns the function's result.
+         */
+        call: <T = JsonValue>(functionName: string, payload?: JsonValue) => Promise<T>;
+        simulate: (functionName: string, payload: JsonValue, options?: {
+            projectId?: string;
+            deployId?: string;
+            executionProfile?: "standard" | "heavy";
+        }) => Promise<JsonObject>;
+        invokeAsync: (functionName: string, payload: JsonValue, options?: {
+            projectId?: string;
+            deployId?: string;
+            executionProfile?: "standard" | "heavy";
+            simulation?: boolean;
+        }) => Promise<JsonObject>;
+        invocationStatus: (invocationId: string, projectId: string) => Promise<JsonObject>;
+        jobs: (functionName: string, options: {
+            projectId: string;
+            status?: string;
+            limit?: number;
+            offset?: number;
+        }) => Promise<JsonObject>;
+        versions: (functionName: string, options: {
+            projectId: string;
+            limit?: number;
+            offset?: number;
+        }) => Promise<JsonObject>;
+        history: (functionName: string, options: {
+            projectId: string;
+            mode?: "invoke" | "simulate";
+            limit?: number;
+            offset?: number;
+        }) => Promise<JsonObject>;
+        simulationDiff: (functionName: string, options: {
+            projectId: string;
+            leftInvocationId: string;
+            rightInvocationId: string;
+        }) => Promise<JsonObject>;
+        promote: (functionName: string, options: {
+            projectId: string;
+            version?: number;
+            deployId?: string;
+            reason?: string;
+        }) => Promise<JsonObject>;
+        rollback: (functionName: string, options: {
+            projectId: string;
+            version?: number;
+            reason?: string;
+        }) => Promise<JsonObject>;
+        request: (method: string, path: string, options?: RequestOptions) => Promise<JsonValue>;
+        get: (name: string) => Promise<JsonObject>;
+        getSource: (name: string) => Promise<JsonObject>;
+        update: (name: string, body: JsonObject) => Promise<JsonObject>;
+        delete: (name: string) => Promise<JsonObject>;
+        logs: (name: string, query?: {
+            limit?: number;
+            offset?: number;
+            status?: string;
+        }) => Promise<JsonValue>;
+        getPolicy: (name: string) => Promise<JsonObject>;
+        setPolicy: (name: string, body: JsonObject) => Promise<JsonObject>;
+        getBindings: (name: string) => Promise<JsonObject>;
+        setBindings: (name: string, body: JsonObject) => Promise<JsonObject>;
+        githubRepositories: (body: JsonObject) => Promise<JsonObject>;
+        githubImport: (body: JsonObject) => Promise<JsonObject>;
+        githubCommit: (body: JsonObject) => Promise<JsonObject>;
+    };
+    readonly storage: {
+        request: (method: string, path: string, options?: RequestOptions) => Promise<JsonValue>;
+        putJson: (path: string, payload: JsonObject) => Promise<JsonValue>;
+        get: (path: string, query?: Record<string, string | number | boolean | null | undefined>) => Promise<JsonValue>;
+        delete: (path: string) => Promise<JsonValue>;
+        /** Public URL of an object in a public bucket (no token needed; safe to put in <img src>). */
+        publicUrl: (bucket: string, objectPath: string, projectId?: string) => string;
+        listBuckets: () => Promise<JsonValue>;
+        createBucket: (body: JsonObject) => Promise<JsonObject>;
+        getBucket: (name: string) => Promise<JsonObject>;
+        updateBucket: (name: string, body: JsonObject) => Promise<JsonObject>;
+        deleteBucket: (name: string) => Promise<JsonObject>;
+        listObjects: (bucket: string, query?: {
+            prefix?: string;
+        }) => Promise<JsonValue>;
+        signDownload: (bucket: string, objectPath: string, expiresIn?: number) => Promise<JsonObject>;
+        /**
+         * Signed upload URL. Pass `sizeBytes` (the file's exact size) to get a direct-to-storage URL bound
+         * to that size; without it the URL uploads through Sovaria, which checks the size limits as the
+         * bytes arrive.
+         */
+        signUpload: (bucket: string, objectPath: string, expiresIn?: number, options?: {
+            sizeBytes?: number;
+            contentType?: string;
+        }) => Promise<JsonObject>;
+        moveObject: (body: JsonObject) => Promise<JsonObject>;
+        /**
+         * Upload a file. Bucket rules decide who may write where — e.g. with the "Own folder" rule a
+         * user writes to `${userId}/…`. Pass `upsert: true` to replace an existing object.
+         */
+        upload: (bucket: string, objectPath: string, file: Blob, options?: {
+            upsert?: boolean;
+            contentType?: string;
+        }) => Promise<JsonObject>;
+        /** Download an object the caller may read, as a Blob. */
+        download: (bucket: string, objectPath: string) => Promise<Blob>;
+        /** Delete an object. */
+        remove: (bucket: string, objectPath: string) => Promise<JsonObject>;
+    };
+    readonly system: {
+        enginesHealth: () => Promise<JsonValue>;
+    };
+    /**
+     * Billing + plan management (Ledger engine).
+     *
+     * The plan catalog is public; subscription and usage routes require a
+     * valid auth token. Subscription writes require the caller to be an
+     * org admin.
+     */
+    readonly billing: {
+        listPlans: () => Promise<JsonValue>;
+        getPlan: (name: string) => Promise<JsonObject>;
+        getSubscription: (orgId: string) => Promise<JsonObject>;
+        setSubscription: (orgId: string, payload: {
+            plan: string;
+            billingCycle?: "monthly" | "annual";
+            stripeCustomerId?: string;
+            metadata?: JsonObject;
+        }) => Promise<JsonObject>;
+        cancelSubscription: (orgId: string, options?: {
+            immediate?: boolean;
+        }) => Promise<JsonObject>;
+        listSubscriptions: () => Promise<JsonValue>;
+        getUsage: (orgId: string, period?: string) => Promise<JsonObject>;
+        getUsageHistory: (orgId: string, months?: number) => Promise<JsonValue>;
+        listInvoices: (orgId: string) => Promise<JsonValue>;
+        buildInvoice: (orgId: string, period?: string) => Promise<JsonObject>;
+        getCompute: (orgId: string, period?: string) => Promise<JsonObject>;
+        checkout: (body: JsonObject) => Promise<JsonObject>;
+        getProvider: () => Promise<JsonObject>;
+        getFx: () => Promise<JsonObject>;
+        getOverage: (orgId: string) => Promise<JsonObject>;
+        getOpenInvoice: () => Promise<JsonObject>;
+        payInvoice: (orgId: string, period: string, body?: JsonObject) => Promise<JsonObject>;
+        razorpayCreateOrder: (body: JsonObject) => Promise<JsonObject>;
+        razorpayVerifyPayment: (body: JsonObject) => Promise<JsonObject>;
+        getAccount: (accountId: string) => Promise<JsonObject>;
+        cancelAccount: (accountId: string) => Promise<JsonObject>;
+        resumeAccount: (accountId: string) => Promise<JsonObject>;
+    };
+    /** The complete API, generated from spec/sovaria-api.json (same surface in every SDK language). */
+    readonly api: {
+        attestation: {
+            getConfig: (args?: {
+                projectId?: string;
+            }) => Promise<JsonValue>;
+            updateConfig: (args: {
+                projectId?: string;
+                body: JsonObject;
+            }) => Promise<JsonValue>;
+            setGoogleCredentials: (args: {
+                projectId?: string;
+                serviceAccount: JsonValue;
+            }) => Promise<JsonValue>;
+            setAppleCredentials: (args: {
+                projectId?: string;
+                p8: JsonValue;
+                keyId: JsonValue;
+                teamId: JsonValue;
+            }) => Promise<JsonValue>;
+            deleteCredentials: (args: {
+                projectId?: string;
+                which: string;
+            }) => Promise<JsonValue>;
+            createDebugToken: (args?: {
+                projectId?: string;
+                name?: JsonValue;
+            }) => Promise<JsonValue>;
+            deleteDebugToken: (args: {
+                projectId?: string;
+                tokenId: string;
+            }) => Promise<JsonValue>;
+            challenge: () => Promise<JsonValue>;
+            exchange: (args: {
+                provider: JsonValue;
+                appId?: JsonValue;
+                challenge?: JsonValue;
+                token?: JsonValue;
+                keyId?: JsonValue;
+                attestation?: JsonValue;
+                assertion?: JsonValue;
+                development?: JsonValue;
+            }) => Promise<JsonValue>;
+        };
+        auth: {
+            confirmVerificationEmail: (args: {
+                token: JsonValue;
+            }) => Promise<JsonValue>;
+            disableMfa: (args: {
+                totpCode: JsonValue;
+            }) => Promise<JsonValue>;
+            enrollMfa: () => Promise<JsonValue>;
+            getMfaStatus: () => Promise<JsonValue>;
+            getProvidersConfig: () => Promise<JsonValue>;
+            getSessionsConfig: () => Promise<JsonValue>;
+            listConsoleProductUsers: () => Promise<JsonValue>;
+            listSessions: () => Promise<JsonValue>;
+            revokeOtherSessions: () => Promise<JsonValue>;
+            revokeSession: (args: {
+                sessionId: string;
+            }) => Promise<JsonValue>;
+            sendVerificationEmail: () => Promise<JsonValue>;
+            updateProvidersConfig: (args: {
+                body: JsonObject;
+            }) => Promise<JsonValue>;
+            updateSessionsConfig: (args: {
+                body: JsonObject;
+            }) => Promise<JsonValue>;
+            listDevices: () => Promise<JsonValue>;
+            signOutDevice: (args: {
+                deviceId: string;
+            }) => Promise<JsonValue>;
+        };
+        billing: {
+            buildInvoice: (args?: {
+                orgId?: string;
+                period?: JsonValue;
+            }) => Promise<JsonValue>;
+            cancelAccount: (args: {
+                accountId: string;
+            }) => Promise<JsonValue>;
+            checkout: (args: {
+                body: JsonObject;
+            }) => Promise<JsonValue>;
+            getAccount: (args: {
+                accountId: string;
+            }) => Promise<JsonValue>;
+            getAccountOverage: (args: {
+                accountId: string;
+            }) => Promise<JsonValue>;
+            getAccountOveragePrefs: (args: {
+                accountId: string;
+            }) => Promise<JsonValue>;
+            getOrgOveragePrefs: (args?: {
+                orgId?: string;
+            }) => Promise<JsonValue>;
+            getCompute: (args?: {
+                orgId?: string;
+                period?: JsonValue;
+            }) => Promise<JsonValue>;
+            getFx: () => Promise<JsonValue>;
+            getOpenInvoice: () => Promise<JsonValue>;
+            getOverage: (args?: {
+                orgId?: string;
+            }) => Promise<JsonValue>;
+            getPlan: (args: {
+                name: string;
+            }) => Promise<JsonValue>;
+            getProvider: () => Promise<JsonValue>;
+            getSubscription: (args?: {
+                orgId?: string;
+            }) => Promise<JsonValue>;
+            getUsage: (args?: {
+                orgId?: string;
+                period?: JsonValue;
+            }) => Promise<JsonValue>;
+            getUsageHistory: (args?: {
+                orgId?: string;
+                months?: JsonValue;
+            }) => Promise<JsonValue>;
+            listInvoices: (args?: {
+                orgId?: string;
+            }) => Promise<JsonValue>;
+            listPlans: () => Promise<JsonValue>;
+            listSubscriptions: () => Promise<JsonValue>;
+            payInvoice: (args: {
+                orgId?: string;
+                period: string;
+            }) => Promise<JsonValue>;
+            razorpayCreateOrder: (args: {
+                body: JsonObject;
+            }) => Promise<JsonValue>;
+            razorpayVerifyPayment: (args: {
+                body: JsonObject;
+            }) => Promise<JsonValue>;
+            resumeAccount: (args: {
+                accountId: string;
+            }) => Promise<JsonValue>;
+            setAccountOveragePrefs: (args: {
+                accountId: string;
+                services: JsonValue;
+            }) => Promise<JsonValue>;
+            setOrgOveragePrefs: (args: {
+                orgId?: string;
+                services: JsonValue;
+            }) => Promise<JsonValue>;
+        };
+        builds: {
+            check: (args: {
+                build: JsonValue;
+            }) => Promise<JsonValue>;
+            list: (args?: {
+                limit?: JsonValue;
+            }) => Promise<JsonValue>;
+            get: (args: {
+                buildId: string;
+            }) => Promise<JsonValue>;
+            pullRequest: (args: {
+                buildId: string;
+                token?: JsonValue;
+            }) => Promise<JsonValue>;
+            delete: (args: {
+                buildId: string;
+            }) => Promise<JsonValue>;
+        };
+        byok: {
+            get: () => Promise<JsonValue>;
+            set: (args: {
+                provider?: JsonValue;
+                keyRef: JsonValue;
+            }) => Promise<JsonValue>;
+            rotate: () => Promise<JsonValue>;
+            check: () => Promise<JsonValue>;
+            reencryptStorage: () => Promise<JsonValue>;
+        };
+        crashes: {
+            listIssues: (args?: {
+                status
+                /** Load a stored session (called once the publishable key is known, so sign-out falls back to it). */
+                ? /** Load a stored session (called once the publishable key is known, so sign-out falls back to it). */: JsonValue;
+                limit?: JsonValue;
+            }) => Promise<JsonValue>;
+            getIssue: (args: {
+                fingerprint: string;
+            }) => Promise<JsonValue>;
+            setIssueStatus: (args: {
+                fingerprint: string;
+                status: JsonValue;
+            }) => Promise<JsonValue>;
+            usage: () => Promise<JsonValue>;
+        };
+        data: {
+            addColumn: (args: {
+                tableName: JsonValue;
+                columnName: JsonValue;
+                dataType: JsonValue;
+                isNullable?: JsonValue;
+                isUnique?: JsonValue;
+                defaultValue?: JsonValue;
+            }) => Promise<JsonValue>;
+            addForeignKey: (args: {
+                tableName: JsonValue;
+                columnName: JsonValue;
+                referencedTable: JsonValue;
+                referencedColumn: JsonValue;
+            }) => Promise<JsonValue>;
+            beginTransaction: () => Promise<JsonValue>;
+            commitTransaction: (args: {
+                txid: JsonValue;
+            }) => Promise<JsonValue>;
+            dropColumn: (args: {
+                tableName: JsonValue;
+                columnName: JsonValue;
+            }) => Promise<JsonValue>;
+            dropForeignKey: (args: {
+                tableName: JsonValue;
+                columnName: JsonValue;
+                referencedTable: JsonValue;
+                referencedColumn: JsonValue;
+            }) => Promise<JsonValue>;
+            dropTable: (args: {
+                tableName: JsonValue;
+            }) => Promise<JsonValue>;
+            rollbackTransaction: (args: {
+                txid: JsonValue;
+            }) => Promise<JsonValue>;
+            tableHistory: () => Promise<JsonValue>;
+            setTableHistory: (args: {
+                tableName: JsonValue;
+                enabled: JsonValue;
+                keepDays?: JsonValue;
+            }) => Promise<JsonValue>;
+            schemaDigest: (args?: {
+                tables?: JsonValue;
+                maxChars?: JsonValue;
+                since?: JsonValue;
+            }) => Promise<JsonValue>;
+            applySchemaPlan: (args: {
+                tables: JsonValue;
+                dryRun?: JsonValue;
+                name?: JsonValue;
+            }) => Promise<JsonValue>;
+            applyMigration: (args: {
+                name: JsonValue;
+                upSql: JsonValue;
+                downSql?: JsonValue;
+                version?: JsonValue;
+            }) => Promise<JsonValue>;
+            dryRunMigration: (args: {
+                name: JsonValue;
+                upSql: JsonValue;
+                downSql?: JsonValue;
+            }) => Promise<JsonValue>;
+            dryRunMigrations: (args: {
+                migrations: JsonValue;
+            }) => Promise<JsonValue>;
+            rollbackMigration: (args?: {
+                version?: JsonValue;
+                force?: JsonValue;
+            }) => Promise<JsonValue>;
+        };
+        e2ee: {
+            bootstrapKey: (args: {
+                channel: JsonValue;
+                ttlSeconds?: JsonValue;
+                forceNew?: JsonValue;
+            }) => Promise<JsonValue>;
+            getActiveKey: (args: {
+                channel: string;
+                clientPublicKey?: JsonValue;
+            }) => Promise<JsonValue>;
+            getKey: (args: {
+                channel: string;
+                keyId: string;
+                clientPublicKey?: JsonValue;
+            }) => Promise<JsonValue>;
+            listKeys: (args: {
+                channel: string;
+            }) => Promise<JsonValue>;
+            revokeKey: (args: {
+                channel: JsonValue;
+                keyId?: JsonValue;
+                reason?: JsonValue;
+            }) => Promise<JsonValue>;
+            rotateKey: (args: {
+                channel: JsonValue;
+                ttlSeconds?: JsonValue;
+            }) => Promise<JsonValue>;
+        };
+        functions: {
+            delete: (args: {
+                functionName: string;
+            }) => Promise<JsonValue>;
+            get: (args: {
+                functionName: string;
+                projectId?: JsonValue;
+            }) => Promise<JsonValue>;
+            getBindings: (args: {
+                functionName: string;
+            }) => Promise<JsonValue>;
+            getPolicy: (args: {
+                functionName: string;
+            }) => Promise<JsonValue>;
+            getSource: (args: {
+                functionName: string;
+                projectId?: JsonValue;
+            }) => Promise<JsonValue>;
+            githubCommit: (args: {
+                body: JsonObject;
+            }) => Promise<JsonValue>;
+            githubImport: (args: {
+                body: JsonObject;
+            }) => Promise<JsonValue>;
+            invocationStatus: (args: {
+                invocationId: string;
+                projectId?: JsonValue;
+            }) => Promise<JsonValue>;
+            list: (args?: {
+                projectId?: JsonValue;
+                limit?: JsonValue;
+                offset?: JsonValue;
+            }) => Promise<JsonValue>;
+            simulationDiff: (args: {
+                functionName: string;
+                projectId?: JsonValue;
+                leftInvocationId?: JsonValue;
+                rightInvocationId?: JsonValue;
+            }) => Promise<JsonValue>;
+            status: (args: {
+                deployId: string;
+                projectId?: JsonValue;
+            }) => Promise<JsonValue>;
+            update: (args: {
+                functionName: string;
+                body: JsonObject;
+                projectId?: JsonValue;
+            }) => Promise<JsonValue>;
+            updateBindings: (args: {
+                functionName: string;
+                bindings: JsonValue;
+            }) => Promise<JsonValue>;
+            updatePolicy: (args: {
+                functionName: string;
+                policy: JsonObject;
+            }) => Promise<JsonValue>;
+            versions: (args: {
+                functionName: string;
+                projectId?: JsonValue;
+                limit?: JsonValue;
+                offset?: JsonValue;
+            }) => Promise<JsonValue>;
+        };
+        governance: {
+            adminDatabases: () => Promise<JsonValue>;
+            getTenant: (args?: {
+                orgId?: string;
+            }) => Promise<JsonValue>;
+            getTenantDatabaseConnection: (args?: {
+                orgId?: string;
+                projectId?: string;
+            }) => Promise<JsonValue>;
+            listHosts: (args?: {
+                regionId?: JsonValue;
+            }) => Promise<JsonValue>;
+            listRegions: () => Promise<JsonValue>;
+            listTenantDatabaseBackups: (args?: {
+                orgId?: string;
+                projectId?: string;
+                limit?: JsonValue;
+            }) => Promise<JsonValue>;
+            listTenantDatabases: (args?: {
+                orgId?: string;
+            }) => Promise<JsonValue>;
+            listTenants: () => Promise<JsonValue>;
+            metricsOverview: () => Promise<JsonValue>;
+            patchHost: (args: {
+                hostId: string;
+                body: JsonObject;
+            }) => Promise<JsonValue>;
+            patchRegion: (args: {
+                regionId: string;
+                body: JsonObject;
+            }) => Promise<JsonValue>;
+            pauseTenantDatabase: (args?: {
+                orgId?: string;
+                projectId?: string;
+            }) => Promise<JsonValue>;
+            resizeTenantDatabase: (args: {
+                orgId?: string;
+                projectId?: string;
+                computeSize: JsonValue;
+            }) => Promise<JsonValue>;
+            resumeTenantDatabase: (args?: {
+                orgId?: string;
+                projectId?: string;
+            }) => Promise<JsonValue>;
+            revealTenantDatabaseConnection: (args: {
+                orgId?: string;
+                projectId?: string;
+                grantId: JsonValue;
+            }) => Promise<JsonValue>;
+            setTenantStatus: (args: {
+                orgId?: string;
+                status: JsonValue;
+            }) => Promise<JsonValue>;
+            triggerTenantDatabaseBackup: (args?: {
+                orgId?: string;
+                projectId?: string;
+            }) => Promise<JsonValue>;
+            listDatabaseReplicas: (args?: {
+                orgId?: string;
+                projectId?: string;
+            }) => Promise<JsonValue>;
+            createDatabaseReplica: (args?: {
+                orgId?: string;
+                projectId?: string;
+            }) => Promise<JsonValue>;
+            deleteDatabaseReplica: (args: {
+                orgId?: string;
+                projectId?: string;
+                replicaId: string;
+            }) => Promise<JsonValue>;
+            compareDatabaseMoments: (args: {
+                orgId?: string;
+                projectId?: string;
+                fromMoment: JsonValue;
+                toMoment?: JsonValue;
+                includePlatform?: JsonValue;
+            }) => Promise<JsonValue>;
+            restoreDatabaseBackup: (args: {
+                orgId? /** Strict console login — rejects every project-scoped credential. */: string;
+                projectId?: string;
+                backupId: string;
+                confirm: JsonValue;
+            }) => Promise<JsonValue>;
+            listDatabaseRestores: (args?: {
+                orgId?: string;
+                projectId?: string;
+            }) => Promise<JsonValue>;
+            undoDatabaseRestore: (args: {
+                orgId?: string;
+                projectId?: string;
+                restoreId: string;
+            }) => Promise<JsonValue>;
+        };
+        history: {
+            commit: (args: {
+                timeline?: JsonValue;
+                message: JsonValue;
+                author?: JsonValue;
+                eventType?: JsonValue;
+            }) => Promise<JsonValue>;
+            converge: (args: {
+                target: JsonValue;
+                source: JsonValue;
+                author: JsonValue;
+                message?: JsonValue;
+            }) => Promise<JsonValue>;
+            createSnapshot: (args: {
+                message: JsonValue;
+            }) => Promise<JsonValue>;
+            deleteTimeline: (args: {
+                name: string;
+            }) => Promise<JsonValue>;
+            jumpTimeline: (args: {
+                name: string;
+                targetHex: JsonValue;
+            }) => Promise<JsonValue>;
+            listSnapshots: () => Promise<JsonValue>;
+            listTimelines: () => Promise<JsonValue>;
+            restoreSnapshot: (args: {
+                snapshotId: string;
+            }) => Promise<JsonValue>;
+            spawnTimeline: (args: {
+                name: JsonValue;
+                sourceHexId?: JsonValue;
+            }) => Promise<JsonValue>;
+            timelineHistory: (args: {
+                name: string;
+                limit?: JsonValue;
+                offset?: JsonValue;
+            }) => Promise<JsonValue>;
+            topology: (args?: {
+                timeline?: JsonValue;
+                limit?: JsonValue;
+            }) => Promise<JsonValue>;
+            variance: (args: {
+                oldChrononHex: JsonValue;
+                newChrononHex: JsonValue;
+                domainFilter?: JsonValue;
+            }) => Promise<JsonValue>;
+        };
+        mcp: {
+            listConnections: () => Promise<JsonValue>;
+            disconnect: (args: {
+                grantId: string;
+            }) => Promise<JsonValue>;
+            orgSettings: (args?: {
+                orgId?: string;
+            }) => Promise<JsonValue>;
+            setOrgAllowed: (args: {
+                orgId?: string;
+                allowed: JsonValue;
+            }) => Promise<JsonValue>;
+            orgDisconnect: (args: {
+                orgId?: string;
+                grantId: string;
+            }) => Promise<JsonValue>;
+        };
+        messaging: {
+            listTemplates: (args?: {
+                projectId?: string;
+            }) => Promise<JsonValue>;
+            getTemplate: (args: {
+                projectId?: string;
+                name: string;
+            }) => Promise<JsonValue>;
+            putTemplate: (args: {
+                projectId?: string;
+                name: string;
+                description?: JsonValue;
+                category?: JsonValue;
+                push?: JsonValue;
+                email?: JsonValue;
+            }) => Promise<JsonValue>;
+            deleteTemplate: (args: {
+                projectId?: string;
+                name: string;
+            }) => Promise<JsonValue>;
+            listAudiences: (args?: {
+                projectId?: string;
+            }) => Promise<JsonValue>;
+            getAudience: (args: {
+                projectId?: string;
+                name: string;
+            }) => Promise<JsonValue>;
+            putAudience: (args: {
+                projectId?: string;
+                name: string;
+                sql: JsonValue;
+                description?: JsonValue;
+            }) => Promise<JsonValue>;
+            deleteAudience: (args: {
+                projectId?: string;
+                name: string;
+            }) => Promise<JsonValue>;
+            previewAudience: (args: {
+                projectId?: string;
+                name: string;
+            }) => Promise<JsonValue>;
+            previewSql: (args: {
+                projectId?: string;
+                sql: JsonValue;
+            }) => Promise<JsonValue>;
+            send: (args: {
+                projectId?: string;
+                template?: JsonValue;
+                content?: JsonValue;
+                to: JsonValue;
+                channels?: JsonValue;
+                variables?: JsonValue;
+                category?: JsonValue;
+                dryRun?: JsonValue;
+            }) => Promise<JsonValue>;
+            listSends: (args?: {
+                projectId?: string;
+                limit?: JsonValue;
+            }) => Promise<JsonValue>;
+            getSend: (args: {
+                projectId?: string;
+                sendId: string;
+            }) => Promise<JsonValue>;
+            listDeliveries: (args?: {
+                projectId?: string;
+                sendId?: JsonValue;
+                userId?: JsonValue;
+                status?: JsonValue;
+                limit?: JsonValue;
+                offset?: JsonValue;
+            }) => Promise<JsonValue>;
+            usage: (args?: {
+                projectId?: string;
+            }) => Promise<JsonValue>;
+            setUserOptout: (args: {
+                projectId?: string;
+                userId: string;
+                channel: JsonValue;
+                optedOut: JsonValue;
+            }) => Promise<JsonValue>;
+            getPreferences: () => Promise<JsonValue>;
+            setPreferences: (args: {
+                marketing: JsonValue;
+            }) => Promise<JsonValue>;
+        };
+        mobile: {
+            listApps: (args?: {
+                projectId?: string;
+            }) => Promise<JsonValue>;
+            createApp: (args: {
+                projectId?: string;
+                body: JsonObject;
+            }) => Promise<JsonValue>;
+            updateApp: (args: {
+                projectId?: string;
+                appId: string;
+                body: JsonObject;
+            }) => Promise<JsonValue>;
+            deleteApp: (args: {
+                projectId?: string;
+                appId: string;
+            }) => Promise<JsonValue>;
+            listUserDevices: (args: {
+                projectId?: string;
+                userId: string;
+            }) => Promise<JsonValue>;
+            revokeUserDevice: (args: {
+                projectId?: string;
+                userId: string;
+                deviceId: string;
+            }) => Promise<JsonValue>;
+        };
+        org: {
+            acceptOrgInvite: (args: {
+                token: JsonValue;
+            }) => Promise<JsonValue>;
+            addMember: (args: {
+                orgId?: string;
+                userId: JsonValue;
+                role: JsonValue;
+            }) => Promise<JsonValue>;
+            createEdge: (args: {
+                sourceNodeId: JsonValue;
+                targetNodeId: JsonValue;
+                relationType: JsonValue;
+                role?: JsonValue;
+            }) => Promise<JsonValue>;
+            createOrgInvite: (args: {
+                orgId?: string;
+                email: JsonValue;
+                role: JsonValue;
+            }) => Promise<JsonValue>;
+            deleteOrg: (args?: {
+                orgId?: string;
+            }) => Promise<JsonValue>;
+            ensureDefaultApiKeys: () => Promise<JsonValue>;
+            getChildren: (args: {
+                parentId: string;
+                relation?: JsonValue;
+            }) => Promise<JsonValue>;
+            getContext: (args: {
+                userId: string;
+                resourceId: string;
+            }) => Promise<JsonValue>;
+            getNode: (args: {
+                nodeId: string;
+            }) => Promise<JsonValue>;
+            getProjectRef: (args?: {
+                projectId?: string;
+            }) => Promise<JsonValue>;
+            getProjectSettings: () => Promise<JsonValue>;
+            getRoleCatalog: () => Promise<JsonValue>;
+            getRoleMatrix: () => Promise<JsonValue>;
+            listApiKeys: () => Promise<JsonValue>;
+            listNodes: (args?: {
+                nodeType?: JsonValue;
+            }) => Promise<JsonValue>;
+            listOrgMembers: (args?: {
+                orgId?: string;
+            }) => Promise<JsonValue>;
+            removeOrgMember: (args: {
+                orgId?: string;
+                userId: string;
+            }) => Promise<JsonValue>;
+            revokeApiKey: (args: {
+                keyId: string;
+            }) => Promise<JsonValue>;
+            setOrgPlan: (args: {
+                orgId?: string;
+                plan: JsonValue;
+            }) => Promise<JsonValue>;
+            updateMemberRole: (args: {
+                orgId?: string;
+                userId: string;
+                role: JsonValue;
+            }) => Promise<JsonValue>;
+            updateOrg: (args: {
+                orgId?: string;
+                body: JsonObject;
+            }) => Promise<JsonValue>;
+            updateProjectSettings: (args: {
+                settings: JsonValue;
+            }) => Promise<JsonValue>;
+            updateRoleMatrix: (args: {
+                matrix: JsonValue;
+            }) => Promise<JsonValue>;
+        };
+        platform: {
+            createEventHook: (args: {
+                body: JsonObject;
+            }) => Promise<JsonValue>;
+            deleteEventHook: (args: {
+                hookId: string;
+            }) => Promise<JsonValue>;
+            disconnectGithub: (args?: {
+                projectId?: JsonValue;
+            }) => Promise<JsonValue>;
+            gatewayHealth: () => Promise<JsonValue>;
+            getEnginesHealth: () => Promise<JsonValue>;
+            getErrorTrace: (args: {
+                traceId: string;
+            }) => Promise<JsonValue>;
+            getGithubConnectionState: (args?: {
+                projectId?: JsonValue;
+            }) => Promise<JsonValue>;
+            listEventHooks: () => Promise<JsonValue>;
+            resolveErrorTrace: (args: {
+                traceId: string;
+                resolved: JsonValue;
+            }) => Promise<JsonValue>;
+        };
+        policy: {
+            auditCount: () => Promise<JsonValue>;
+            auditVerify: () => Promise<JsonValue>;
+            policyCreate: (args: {
+                policyId: JsonValue;
+                name: JsonValue;
+                splSource: JsonValue;
+                orgId: JsonValue;
+            }) => Promise<JsonValue>;
+            policyDelete: (args: {
+                policyId: string;
+            }) => Promise<JsonValue>;
+            policyEvaluate: (args: {
+                policyId: string;
+                context: JsonValue;
+            }) => Promise<JsonValue>;
+            policyGet: (args: {
+                policyId: string;
+            }) => Promise<JsonValue>;
+            policyHistory: (args: {
+                policyId: string;
+            }) => Promise<JsonValue>;
+            policyList: () => Promise<JsonValue>;
+            policyRollback: (args: {
+                policyId: string;
+                version: JsonValue;
+            }) => Promise<JsonValue>;
+            policyTemplates: () => Promise<JsonValue>;
+        };
+        push: {
+            getCredentials: (args?: {
+                projectId?: string;
+            }) => Promise<JsonValue>;
+            setFcmCredentials: (args: {
+                projectId?: string;
+                serviceAccount: JsonValue;
+            }) => Promise<JsonValue>;
+            setApnsCredentials: (args: {
+                projectId?: string;
+                p8: JsonValue;
+                keyId: JsonValue;
+                teamId: JsonValue;
+                bundleId: JsonValue;
+                environment?: JsonValue;
+            }) => Promise<JsonValue>;
+            deleteCredentials: (args: {
+                projectId?: string;
+                provider: string;
+            }) => Promise<JsonValue>;
+            listDevices: (args?: {
+                projectId?: string;
+                userId?: JsonValue;
+                limit?: JsonValue;
+                before?: JsonValue;
+            }) => Promise<JsonValue>;
+            send: (args: {
+                projectId?: string;
+                message: JsonObject;
+            }) => Promise<JsonValue>;
+            listSends: (args?: {
+                projectId?: string;
+                limit?: JsonValue;
+            }) => Promise<JsonValue>;
+            registerDevice: (args: {
+                token: JsonValue;
+                platform: JsonValue;
+                provider?: JsonValue;
+                deviceId?: JsonValue;
+                appId?: JsonValue;
+                topics?: JsonValue;
+                locale?: JsonValue;
+            }) => Promise<JsonValue>;
+            myDevices: () => Promise<JsonValue>;
+            updateTopics: (args: {
+                deviceRowId: string;
+                subscribe?: JsonValue;
+                unsubscribe?: JsonValue;
+                replace?: JsonValue;
+            }) => Promise<JsonValue>;
+            deleteDevice: (args: {
+                deviceRowId: string;
+            }) => Promise<JsonValue>;
+            unregisterToken: (args: {
+                token: JsonValue;
+            }) => Promise<JsonValue>;
+        };
+        realtime: {
+            channels: () => Promise<JsonValue>;
+            presence: (args: {
+                channel: string;
+            }) => Promise<JsonValue>;
+            replay: (args: {
+                channel: string;
+                after?: JsonValue;
+                limit?: JsonValue;
+            }) => Promise<JsonValue>;
+            subscribe: (args: {
+                channel: JsonValue;
+                clientId: JsonValue;
+            }) => Promise<JsonValue>;
+            unsubscribe: (args: {
+                channel: JsonValue;
+                clientId: JsonValue;
+            }) => Promise<JsonValue>;
+        };
+        simulation: {
+            compareRuns: (args: {
+                targetRunId: string;
+                baselineRunId: string;
+            }) => Promise<JsonValue>;
+            discover: () => Promise<JsonValue>;
+            getRun: (args: {
+                runId: string;
+            }) => Promise<JsonValue>;
+            listRuns: (args?: {
+                limit?: JsonValue;
+                offset?: JsonValue;
+            }) => Promise<JsonValue>;
+        };
+        storage: {
+            createBucket: (args: {
+                body: JsonObject;
+            }) => Promise<JsonValue>;
+            deleteBucket: (args: {
+                name: string;
+            }) => Promise<JsonValue>;
+            getBucket: (args: {
+                name: string;
+            }) => Promise<JsonValue>;
+            listBuckets: () => Promise<JsonValue>;
+            moveObject: (args: {
+                fromPath: JsonValue;
+                toPath: JsonValue;
+            }) => Promise<JsonValue>;
+            updateBucket: (args: {
+                name: string;
+                body: JsonObject;
+            }) => Promise<JsonValue>;
+        };
+        templates: {
+            list: () => Promise<JsonValue>;
+            get: (args: {
+                name: string;
+            }) => Promise<JsonValue>;
+            apply: (args: {
+                orgId?: string;
+                projectId?: string;
+                name: string;
+                dryRun?: JsonValue;
+            }) => Promise<JsonValue>;
+        };
+        traces: {
+            list: (args?: {
+                kind?: JsonValue;
+                before?: JsonValue;
+                limit?: JsonValue;
+            }) => Promise<JsonValue>;
+            get: (args: {
+                traceId: string;
+            }) => Promise<JsonValue>;
+        };
+        vector: {
+            deleteCollection: (args: {
+                collection: string;
+            }) => Promise<JsonValue>;
+            deleteRecord: (args: {
+                collection: string;
+                recordId: string;
+            }) => Promise<JsonValue>;
+            embed: (args: {
+                texts: JsonValue;
+            }) => Promise<JsonValue>;
+            listCollections: () => Promise<JsonValue>;
+            upsert: (args: {
+                collection: JsonValue;
+                docs: JsonValue;
+            }) => Promise<JsonValue>;
+            setCollection: (args: {
+                collection: string;
+                appSearch?: JsonValue;
+            }) => Promise<JsonValue>;
+            reembedCollection: (args: {
+                collection: string;
+                force?: JsonValue;
+            }) => Promise<JsonValue>;
+            sqlSearch: (args: {
+                tableName: JsonValue;
+                columnName?: JsonValue;
+                vector?: JsonValue;
+                text?: JsonValue;
+                mode?: JsonValue;
+                textColumns?: JsonValue;
+                language?: JsonValue;
+                k?: JsonValue;
+                metric?: JsonValue;
+                select?: JsonValue;
+                filter?: JsonValue;
+                maxDistance?: JsonValue;
+            }) => Promise<JsonValue>;
+            sqlAutoStatus: () => Promise<JsonValue>;
+            sqlAutoEnable: (args: {
+                tableName: JsonValue;
+                columnName?: JsonValue;
+                sourceColumns: JsonValue;
+                rebuild?: JsonValue;
+            }) => Promise<JsonValue>;
+            sqlAutoDisable: (args: {
+                tableName: string;
+            }) => Promise<JsonValue>;
+            sqlAutoSync: (args?: {
+                tableName?: JsonValue;
+                limit?: JsonValue;
+            }) => Promise<JsonValue>;
+        };
+        workflows: {
+            start: (args: {
+                functionName: JsonValue;
+                input?: JsonValue;
+                key?: JsonValue;
+            }) => Promise<JsonValue>;
+            list: (args?: {
+                functionName?: JsonValue;
+                status?: JsonValue;
+                before?: JsonValue;
+                limit?: JsonValue;
+            }) => Promise<JsonValue>;
+            get: (args: {
+                runId: string;
+            }) => Promise<JsonValue>;
+            signal: (args: {
+                runId: string;
+                name: JsonValue;
+                data?: JsonValue;
+            }) => Promise<JsonValue>;
+            cancel: (args: {
+                runId: string;
+            }) => Promise<JsonValue>;
+            retry: (args: {
+                runId: string;
+                latest?: JsonValue;
+            }) => Promise<JsonValue>;
+        };
+    };
+    readonly keys: {
+        list: () => Promise<JsonValue>;
+        create: (payload: JsonObject) => Promise<JsonObject>;
+        ensureDefaults: () => Promise<JsonObject>;
+        revoke: (keyId: string) => Promise<JsonObject>;
+    };
+    readonly governance: {
+        listRegions: () => Promise<JsonValue>;
+        listAvailableRegions: (query?: {
+            size?: string;
+            plan?: string;
+        }) => Promise<JsonValue>;
+        patchRegion: (regionId: string, body: JsonObject) => Promise<JsonObject>;
+        listTenants: () => Promise<JsonValue>;
+        getTenant: (orgId: string) => Promise<JsonObject>;
+        setTenantStatus: (orgId: string, body: JsonObject) => Promise<JsonObject>;
+        listTenantDatabases: (orgId: string) => Promise<JsonValue>;
+        provisionDatabase: (orgId: string, body: JsonObject) => Promise<JsonObject>;
+        getDatabaseConnection: (orgId: string, projectId: string) => Promise<JsonObject>;
+        revealDatabaseConnection: (orgId: string, projectId: string, grantId: string) => Promise<JsonObject>;
+        pauseDatabase: (orgId: string, projectId: string) => Promise<JsonObject>;
+        resumeDatabase: (orgId: string, projectId: string) => Promise<JsonObject>;
+        resizeDatabase: (orgId: string, projectId: string, body: JsonObject) => Promise<JsonObject>;
+        deleteDatabase: (orgId: string, projectId: string, snapshot?: boolean) => Promise<JsonObject>;
+        listDatabaseBackups: (orgId: string, projectId: string, limit?: number) => Promise<JsonValue>;
+        triggerDatabaseBackup: (orgId: string, projectId: string) => Promise<JsonObject>;
+        adminListDatabases: () => Promise<JsonValue>;
+        listHosts: (regionId?: string) => Promise<JsonValue>;
+        patchHost: (hostId: string, body: JsonObject) => Promise<JsonObject>;
+        metricsOverview: () => Promise<JsonObject>;
+        projectMetrics: (projectId: string, since?: string, limit?: number) => Promise<JsonObject>;
+    };
+    readonly admin: {
+        listErrorTraces: (query?: Record<string, string | number | boolean | null | undefined>) => Promise<JsonValue>;
+        getErrorTrace: (traceId: string) => Promise<JsonObject>;
+        resolveErrorTrace: (traceId: string, body?: JsonObject) => Promise<JsonObject>;
+        usageOverview: (period?: string, limit?: number) => Promise<JsonObject>;
+        listAccessTransparency: (query: Record<string, string | number | boolean | null | undefined>) => Promise<JsonValue>;
+        gatewayHealth: () => Promise<JsonValue>;
+    };
+    /**
+     * Vector / embeddings (Nexus engine).
+     *
+     * All routes are project-scoped via the standard `X-Sovaria-Project-ID`
+     * header so call `setScope({ orgId, projectId })` first.
+     */
+    readonly vector: {
+        embed: (texts: string[]) => Promise<{
+            vectors: number[][];
+            dim: number;
+            count: number;
+        }>;
+        upsert: (collection: string, docs: Array<{
+            id?: string;
+            text: string;
+            metadata?: JsonObject;
+        }>) => Promise<JsonObject>;
+        /**
+         * Search a collection. `mode`: `vector` (meaning), `keyword` (the words, BM25) or `hybrid` (both,
+         * fused); the default is vector with a real embedding model and hybrid with the local hash model.
+         * Apps (anon key, signed-in users) may only search collections opened with `setCollection(name, { appSearch: true })`.
+         */
+        search: (collection: string, query: string, options?: {
+            topK?: number;
+            metadataFilter?: JsonObject;
+            mode?: "vector" | "keyword" | "hybrid";
+        }) => Promise<JsonObject>;
+        /** Collection settings (team / service key): `appSearch` lets the project's apps search it. */
+        setCollection: (collection: string, settings: {
+            appSearch?: boolean;
+        }) => Promise<JsonObject>;
+        listCollections: () => Promise<JsonObject>;
+        listRecords: (collection: string, options?: {
+            limit?: number;
+            offset?: number;
+        }) => Promise<JsonObject>;
+        deleteRecord: (collection: string, recordId: string) => Promise<JsonObject>;
+        deleteCollection: (collection: string) => Promise<JsonObject>;
+    };
+}
+export type RealtimeStatus = 'connecting' | 'live' | 'reconnecting' | 'closed';
+export interface RealtimeChannelHandlers {
+    /** Each message's payload (the `payload` field of a published event, or the raw frame). */
+    onMessage?: (payload: JsonObject, raw: JsonObject) => void;
+    onStatus?: (status: RealtimeStatus) => void;
+    /** Called when a connection attempt fails; the channel keeps retrying. */
+    onError?: (error: unknown) => void;
+    /** Maximum delay between reconnects in ms (default 15000). */
+    maxBackoffMs?: number;
+}
+export interface RealtimeChannel {
+    readonly name: string;
+    readonly status: RealtimeStatus;
+    /** Publish to this channel through the API (works for every subscriber). */
+    send: (payload: JsonObject) => Promise<JsonObject>;
+    close: () => void;
+}
+export interface SovariaProjectConfigFile {
+    project?: {
+        name?: string;
+        runtime?: string;
+        ref?: string;
+    };
+    gateway?: {
+        url?: string;
+    };
+    scope?: {
+        org_id?: string;
+        project_id?: string;
+        env_id?: string;
+        orgId?: string;
+        projectId?: string;
+        envId?: string;
+    };
+    features?: {
+        realtime?: boolean;
+        functions?: boolean;
+        storage?: boolean;
+    };
+}
+/** Extra client settings layered over sovaria.config.json (keys, callbacks, session storage). */
+export type ProjectConfigOptions = Omit<SovariaPortalConfig, 'url' | 'baseUrl'>;
+/** Map sovaria.config.json content (written by `sov init` / `sov link`) to SDK bootstrap config. */
+export declare function portalConfigFromProjectFile(raw: SovariaProjectConfigFile, options?: ProjectConfigOptions): SovariaPortalConfig;
+/**
+ * Create a client from sovaria.config.json. In a bundler, import the file and pass the anon key:
+ * `createClientFromProjectConfig(config, { publishableKey: import.meta.env.VITE_SOVARIA_ANON_KEY })`.
+ */
+export declare function createClientFromProjectConfig(raw: SovariaProjectConfigFile, options?: ProjectConfigOptions): SovariaSDK;
+/**
+ * Create a client. Either pass the two values from the console's **Connect** panel —
+ * `createClient('https://<ref>.sovarias.in', '<anon-key>')` — or a config object.
+ */
+export declare function createClient(urlOrConfig: string | SovariaPortalConfig, key?: string, options?: Omit<SovariaPortalConfig, 'url' | 'baseUrl'>): SovariaSDK;