@dontcode2/backend 0.2.1 → 0.2.2

package/README.md

@@ -1,8 +1,9 @@
 # @dontcode2/backend
 
 The public SDK for the [DontCode](https://www.dontcode.co) backend: a thin, typed
-proxy over the v1 HTTP gateway. Auth, database, and file storage for an app you host
-yourself ("bring your own code"), behind a single project API key.
+proxy over the v1 HTTP gateway. Auth, database, file storage, a key-value cache, and
+realtime pub/sub for an app you host yourself ("bring your own code"), behind a single
+project API key.
 
 It speaks the exact wire protocol of the gateway, so you can move between the SDK and
 raw HTTP at any time without platform-side changes.
@@ -228,6 +229,61 @@ await priv.move('a.pdf', 'archive/a.pdf')
 const { url: putUrl } = await priv.presignUpload('big.zip', 'application/zip')
 ```
 
+## Cache
+
+A key-value cache for ephemeral, high-churn, or session-scoped state, with optional TTL
+expiry. Keys are scoped to your project automatically. This is a cache, not a database:
+values may be evicted and are not durable, so keep your system of record in `db`.
+
+```ts
+const c = client.cache
+
+await c.set('session:42', { step: 2 }, { ttl: 3600 }) // ttl in seconds
+const session = await c.get<{ step: number }>('session:42') // null on miss or expiry
+await c.set('lock:job', '1', { nx: true }) // false if it already existed
+await c.expire('session:42', 600) // or null to clear the TTL
+await c.del('session:42')
+
+// hashes
+await c.hset('profile:9', { name: 'Zed', level: 7 })
+const profile = await c.hgetAll<{ name: string; level: number }>('profile:9') // null on miss
+
+// sets (string members)
+await c.sAdd('online', 'u1', 'u2')
+const online = await c.sMembers('online') // string[] ([] on miss)
+await c.sRem('online', 'u1')
+```
+
+A miss (or expiry) reads back as `null` for `get`/`hgetAll` and `[]` for `sMembers`,
+not an error.
+
+## Realtime
+
+Realtime pub/sub over WebSockets for live features (chat, presence, live updates). The
+SDK is the **server side**: mint a connection token for a browser, publish messages, and
+read presence. The browser opens the socket itself with the scoped token, so it never
+holds your API key. Delivery is fire-and-forget (no history/replay), so persist anything
+that needs durability to `db`.
+
+```ts
+const rt = client.realtime
+
+// In your token endpoint, after you've authenticated the user:
+const conn = await rt.mintToken({ channels: [`room:${id}`], identity: userId })
+// → send `conn` to the browser; it connects to `${conn.url}?token=${conn.token}`
+//   (use @dontcode/realtime's client `connect()` to handle the socket + reconnect)
+
+// From anywhere on your backend:
+const delivered = await rt.publish(`room:${id}`, { text: 'hello' })
+const members = await rt.presence(`room:${id}`) // [{ id, identity? }]
+```
+
+A browser connection may only use the channels named when its token was minted.
+
+> The local mock gateway (`dontcode-mock`) and the MCP server currently cover auth,
+> database, and storage. Cache and realtime are available on the hosted gateway; point
+> `DONTCODE_API_URL` at it to use them.
+
 ## Errors
 
 Every non-2xx response throws a `DontCodeError`:

package/dist/cache.d.ts

@@ -0,0 +1,36 @@
+import { Transport } from './http';
+import type { CacheSetOptions } from './types';
+/**
+ * Key-value cache: a typed proxy over `/api/v1/cache`. Keys are namespaced to
+ * your project by the gateway; values are JSON. This is ephemeral storage —
+ * use `db` for anything that must be durable.
+ *
+ * ```ts
+ * await client.cache.set('session:42', { step: 2 }, { ttl: 3600 })
+ * const s = await client.cache.get<{ step: number }>('session:42') // null if expired
+ * ```
+ */
+export declare class CacheClient {
+    private readonly transport;
+    constructor(transport: Transport);
+    /** Read a value. Returns `null` on a miss or expiry. */
+    get<T = unknown>(key: string): Promise<T | null>;
+    /** Set a value, optionally with a TTL (seconds) or set-if-absent (`nx`).
+     *  Returns `false` when `nx` is set and the key already existed. */
+    set(key: string, value: unknown, options?: CacheSetOptions): Promise<boolean>;
+    /** Delete a key. Returns whether it existed. */
+    del(key: string): Promise<boolean>;
+    /** Set or clear (`null`) the TTL on an existing key. Returns `false` if absent. */
+    expire(key: string, ttl: number | null): Promise<boolean>;
+    /** Set fields on a hash. Returns the number of fields written. */
+    hset(key: string, fields: Record<string, unknown>): Promise<number>;
+    /** Read a whole hash. Returns `null` on a miss. */
+    hgetAll<T = Record<string, unknown>>(key: string): Promise<T | null>;
+    /** Add members to a set. Returns the number newly added. */
+    sAdd(key: string, ...members: string[]): Promise<number>;
+    /** List set members. Returns `[]` on a miss. */
+    sMembers(key: string): Promise<string[]>;
+    /** Remove members from a set. Returns the number removed. */
+    sRem(key: string, ...members: string[]): Promise<number>;
+}
+export declare function createCache(transport: Transport): CacheClient;

package/dist/{chunk-HSPHQ6OU.js → chunk-6DFTM26Y.js}

@@ -3,7 +3,7 @@ import {
   Transport,
   dontcode,
   isDontCodeError
-} from "./chunk-CAYYXFFZ.js";
+} from "./chunk-LBN4R3GH.js";
 
 // src/credentials.ts
 import { mkdirSync, readFileSync, writeFileSync } from "fs";
@@ -445,4 +445,4 @@ export {
   createMcpServer,
   startMcpServer
 };
-//# sourceMappingURL=chunk-HSPHQ6OU.js.map
+//# sourceMappingURL=chunk-6DFTM26Y.js.map

package/dist/{chunk-CAYYXFFZ.js → chunk-LBN4R3GH.js}

@@ -294,6 +294,96 @@ var AuthApi = class {
   }
 };
 
+// src/cache.ts
+var CACHE_PATH = "/api/v1/cache";
+var enc = (key) => encodeURIComponent(key);
+function asMiss(err, fallback) {
+  if (isDontCodeError(err) && err.status === 404) return fallback;
+  throw err;
+}
+var CacheClient = class {
+  constructor(transport) {
+    this.transport = transport;
+  }
+  /** Read a value. Returns `null` on a miss or expiry. */
+  async get(key) {
+    try {
+      const r = await this.transport.get(`${CACHE_PATH}/kv/${enc(key)}`);
+      return r.value;
+    } catch (err) {
+      return asMiss(err, null);
+    }
+  }
+  /** Set a value, optionally with a TTL (seconds) or set-if-absent (`nx`).
+   *  Returns `false` when `nx` is set and the key already existed. */
+  async set(key, value, options = {}) {
+    const params = new URLSearchParams();
+    if (options.ttl != null) params.set("ttl", String(options.ttl));
+    if (options.nx) params.set("nx", "true");
+    const qs = params.toString() ? `?${params}` : "";
+    const r = await this.transport.put(`${CACHE_PATH}/kv/${enc(key)}${qs}`, value);
+    return r.set;
+  }
+  /** Delete a key. Returns whether it existed. */
+  async del(key) {
+    const r = await this.transport.del(`${CACHE_PATH}/kv/${enc(key)}`);
+    return r.deleted;
+  }
+  /** Set or clear (`null`) the TTL on an existing key. Returns `false` if absent. */
+  async expire(key, ttl) {
+    const r = await this.transport.json(`${CACHE_PATH}/expire/${enc(key)}`, {
+      ttl
+    });
+    return r.applied;
+  }
+  // --- hashes -------------------------------------------------------------
+  /** Set fields on a hash. Returns the number of fields written. */
+  async hset(key, fields) {
+    const r = await this.transport.json(`${CACHE_PATH}/hset/${enc(key)}`, {
+      fields
+    });
+    return r.written;
+  }
+  /** Read a whole hash. Returns `null` on a miss. */
+  async hgetAll(key) {
+    try {
+      const r = await this.transport.get(`${CACHE_PATH}/hgetall/${enc(key)}`);
+      return r.value;
+    } catch (err) {
+      return asMiss(err, null);
+    }
+  }
+  // --- sets ---------------------------------------------------------------
+  /** Add members to a set. Returns the number newly added. */
+  async sAdd(key, ...members) {
+    const r = await this.transport.json(`${CACHE_PATH}/sadd/${enc(key)}`, {
+      members
+    });
+    return r.added;
+  }
+  /** List set members. Returns `[]` on a miss. */
+  async sMembers(key) {
+    try {
+      const r = await this.transport.get(
+        `${CACHE_PATH}/smembers/${enc(key)}`
+      );
+      return r.value ?? [];
+    } catch (err) {
+      return asMiss(err, []);
+    }
+  }
+  /** Remove members from a set. Returns the number removed. */
+  async sRem(key, ...members) {
+    const r = await this.transport.json(`${CACHE_PATH}/srem/${enc(key)}`, {
+      members
+    });
+    return r.removed;
+  }
+};
+function createCache(transport) {
+  return new CacheClient(transport);
+}
+
 // src/db.ts
 var DB_PATH = "/api/v1/db";
 var MIGRATE_PATH = "/api/v1/db/migrate";
@@ -361,6 +451,40 @@ function createDb(transport) {
   });
 }
 
+// src/realtime.ts
+var REALTIME_PATH = "/api/v1/realtime";
+var RealtimeApi = class {
+  constructor(transport) {
+    this.transport = transport;
+  }
+  /** Mint a short-lived, channel-scoped connection token for a browser. */
+  mintToken(input) {
+    return this.transport.json(`${REALTIME_PATH}/token`, {
+      channels: input.channels,
+      identity: input.identity,
+      ttl: input.ttl
+    });
+  }
+  /** Publish a message to a channel. Returns how many subscribers it reached. */
+  async publish(channel, payload) {
+    const r = await this.transport.json(`${REALTIME_PATH}/publish`, {
+      channel,
+      payload
+    });
+    return r.delivered;
+  }
+  /** Who is currently connected to a channel. */
+  async presence(channel) {
+    const r = await this.transport.get(
+      `${REALTIME_PATH}/channels/${encodeURIComponent(channel)}/presence`
+    );
+    return r.presence ?? [];
+  }
+};
+function createRealtime(transport) {
+  return new RealtimeApi(transport);
+}
+
 // src/storage.ts
 var STORAGE_PATH = "/api/v1/storage";
 var DEFAULT_CONTENT_TYPE = "application/octet-stream";
@@ -503,6 +627,24 @@ var Transport = class {
     );
     return this.parse(res);
   }
+  /** PUT a JSON body and parse the JSON response. */
+  async put(path, body, opts) {
+    const res = await this.send(
+      path,
+      {
+        method: "PUT",
+        headers: { ...this.headers(opts), "Content-Type": "application/json" },
+        body: JSON.stringify(body ?? null)
+      },
+      opts
+    );
+    return this.parse(res);
+  }
+  /** DELETE and parse the JSON response. */
+  async del(path, opts) {
+    const res = await this.send(path, { method: "DELETE", headers: this.headers(opts) }, opts);
+    return this.parse(res);
+  }
   /** PUT a multipart form (file uploads). The runtime sets the boundary. */
   async multipart(path, form, opts) {
     const res = await this.send(path, { method: "PUT", headers: this.headers(opts), body: form }, opts);
@@ -542,7 +684,9 @@ function dontcode(options = {}) {
   return {
     auth: new AuthApi(transport, options.session),
     db: createDb(transport),
-    storage: createStorage(transport)
+    storage: createStorage(transport),
+    cache: createCache(transport),
+    realtime: createRealtime(transport)
   };
 }
 
@@ -558,11 +702,15 @@ export {
   isSessionExpired,
   MfaApi,
   AuthApi,
+  CacheClient,
+  createCache,
   TableQuery,
   Transport,
+  RealtimeApi,
+  createRealtime,
   BucketClient,
   PublicBucketClient,
   createStorage,
   dontcode
 };
-//# sourceMappingURL=chunk-CAYYXFFZ.js.map
+//# sourceMappingURL=chunk-LBN4R3GH.js.map

package/dist/chunk-LBN4R3GH.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cookies.ts","../src/errors.ts","../src/session.ts","../src/auth.ts","../src/cache.ts","../src/db.ts","../src/realtime.ts","../src/storage.ts","../src/http.ts","../src/client.ts"],"sourcesContent":["/**\n * Cookie helpers, framework-agnostic by design. They return strings: a\n * `Set-Cookie` header value to write, or a parsed token to read. Your framework\n * applies them (`headers.append('Set-Cookie', …)`, SvelteKit `cookies.set`, a\n * Next `Response` cookie, etc.). The SDK never owns a request or response.\n *\n * Defaults match how DontCode's own apps store the session: an httpOnly cookie\n * so JavaScript can't read the token, `Secure`, `SameSite=Lax`, path `/`, and a\n * 7-day max age. Cross-site setups (your app and the gateway on different sites)\n * need `sameSite: 'none'`, which forces `Secure` on.\n */\n\n/** Default cookie name for the end-user access token. */\nexport const DEFAULT_SESSION_COOKIE_NAME = 'dc_access_token'\n\n/** One week, in seconds. Matches the default session lifetime DontCode issues. */\nconst DEFAULT_MAX_AGE_SECONDS = 60 * 60 * 24 * 7\n\nexport interface SessionCookieOptions {\n    /** Cookie name. Default `dc_access_token`. */\n    name?: string\n    /** Lifetime in seconds. Default one week. Pass the token's `ExpiresIn` to\n     *  keep the cookie and the token in lockstep. */\n    maxAge?: number\n    /** Default `/`. */\n    path?: string\n    domain?: string\n    /** Default `true`. */\n    secure?: boolean\n    /** Default `true`. Keep the token unreadable from client JavaScript. */\n    httpOnly?: boolean\n    /** Default `'lax'`. Use `'none'` for cross-site (it forces `Secure`). */\n    sameSite?: 'lax' | 'strict' | 'none'\n}\n\nfunction serialize(name: string, value: string, options: SessionCookieOptions, maxAge: number): string {\n    const sameSite = options.sameSite ?? 'lax'\n    // SameSite=None is meaningless without Secure (browsers drop it), so force\n    // Secure on there; otherwise it defaults on and the caller can opt out.\n    const secure = sameSite === 'none' ? true : (options.secure ?? true)\n    const httpOnly = options.httpOnly ?? true\n    const path = options.path ?? '/'\n\n    const parts = [`${name}=${encodeURIComponent(value)}`, `Path=${path}`, `Max-Age=${maxAge}`]\n    if (options.domain) parts.push(`Domain=${options.domain}`)\n    parts.push(`SameSite=${sameSite.charAt(0).toUpperCase()}${sameSite.slice(1)}`)\n    if (httpOnly) parts.push('HttpOnly')\n    if (secure) parts.push('Secure')\n    return parts.join('; ')\n}\n\n/** Build a `Set-Cookie` value that stores the access token. */\nexport function serializeSessionCookie(token: string, options: SessionCookieOptions = {}): string {\n    const name = options.name ?? DEFAULT_SESSION_COOKIE_NAME\n    const maxAge = options.maxAge ?? DEFAULT_MAX_AGE_SECONDS\n    return serialize(name, token, options, maxAge)\n}\n\n/** Build a `Set-Cookie` value that clears the access token (logout). */\nexport function clearSessionCookie(options: SessionCookieOptions = {}): string {\n    const name = options.name ?? DEFAULT_SESSION_COOKIE_NAME\n    return serialize(name, '', options, 0)\n}\n\n/** Read the access token out of a `Cookie` request header, or `null`. Pass the\n *  raw header string (`name=value; name2=value2`). */\nexport function readSessionToken(\n    cookieHeader: string | null | undefined,\n    name: string = DEFAULT_SESSION_COOKIE_NAME\n): string | null {\n    if (!cookieHeader) return null\n    for (const pair of cookieHeader.split(';')) {\n        const eq = pair.indexOf('=')\n        if (eq === -1) continue\n        if (pair.slice(0, eq).trim() !== name) continue\n        const raw = pair.slice(eq + 1).trim()\n        if (!raw) return null\n        try {\n            return decodeURIComponent(raw)\n        } catch {\n            return raw\n        }\n    }\n    return null\n}\n","/**\n * Every non-2xx response from the gateway surfaces as a DontCodeError. The\n * platform's error envelope is `{ error, ... }`, sometimes with a machine\n * `code` (e.g. `EmailNotVerified`, `ChallengeExpired`, `MfaNotOffered`) or\n * rate-limit fields. We preserve the whole body so callers can branch on it.\n *\n * Note: many \"one more step\" auth states (signup needing email verification,\n * login returning `mfa_required`) are 2xx successes, NOT errors; inspect the\n * resolved value for those. Errors are reserved for actual failures.\n *\n * Transport failures (no HTTP response at all) also surface as a DontCodeError\n * so callers have one error type: a timeout is status 408 / code `Timeout`, and\n * any other network failure is status 0 / code `NetworkError`. Neither is a\n * `401`, so a guard can distinguish \"backend unavailable\" from \"signed out\".\n */\nexport interface DontCodeErrorBody {\n    error?: string\n    /** Stable machine code, when the platform sends one. */\n    code?: string\n    /** Present on 429 responses. */\n    rate_limit?: boolean\n    /** Seconds until the rate limit resets, on 429 responses. */\n    timeleft?: number\n    [key: string]: unknown\n}\n\nexport class DontCodeError extends Error {\n    /** HTTP status code of the failing response. */\n    readonly status: number\n    /** Stable machine code, when present (e.g. `EmailNotVerified`). */\n    readonly code?: string\n    /** The raw parsed response body. */\n    readonly body: DontCodeErrorBody\n\n    constructor(status: number, body: DontCodeErrorBody) {\n        const message =\n            typeof body?.error === 'string' && body.error.length > 0\n                ? body.error\n                : `DontCode request failed with status ${status}`\n        super(message)\n        this.name = 'DontCodeError'\n        this.status = status\n        this.code = typeof body?.code === 'string' ? body.code : undefined\n        this.body = body ?? {}\n    }\n\n    /** True when the request was rejected by the per-key rate limiter. */\n    get rateLimited(): boolean {\n        return this.status === 429\n    }\n}\n\n/** Cross-bundle-safe check; works even if two copies of the SDK are loaded. */\nexport function isDontCodeError(err: unknown): err is DontCodeError {\n    if (err instanceof DontCodeError) return true\n    return (\n        typeof err === 'object' &&\n        err !== null &&\n        (err as { name?: unknown }).name === 'DontCodeError'\n    )\n}\n","import { isDontCodeError } from './errors'\nimport type { AuthApi } from './auth'\nimport type { CurrentUser } from './types'\n\n/**\n * Session helpers, framework-agnostic by design. They never touch a request or\n * response object; they take a token (or a cookie header) and return plain\n * data, so they slot into any framework's guard (Next middleware, SvelteKit\n * hooks, Express, a worker) without an adapter.\n *\n * The point of the module: an auth guard must not make a network round-trip on\n * every navigation, or a slow gateway stalls the page and a swallowed timeout\n * reads as \"signed out\". So there are two modes:\n *\n *   - optimistic — decode the token locally (no signature check, no network)\n *     and trust its claims for routing. Instant. Used for the common gate.\n *   - verified   — call the gateway's `me` once, cache the result for a short\n *     TTL, and hard-timeout the request. Used for sensitive actions.\n *\n * The trade-offs (no signature verification, revocation lag) are documented on\n * `getSession` and in the public BYOC docs; read them before choosing a mode.\n */\n\n/** A JWT payload decoded WITHOUT verifying its signature. Trust accordingly. */\nexport interface DecodedSession {\n    /** Subject — the user id. */\n    sub: string\n    email?: string\n    role?: string\n    claims?: Record<string, unknown>\n    /** Expiry, seconds since the epoch (standard JWT `exp`). */\n    exp?: number\n    /** Issued-at, seconds since the epoch (standard JWT `iat`). */\n    iat?: number\n    [key: string]: unknown\n}\n\nexport type SessionStatus =\n    /** A usable session: a present, unexpired token (verified or optimistic). */\n    | 'active'\n    /** The token is present but past its `exp`. */\n    | 'expired'\n    /** No token, or an unparseable one. */\n    | 'anonymous'\n    /** Verified mode could not reach the gateway (timeout/network/5xx). The\n     *  optimistically-decoded `user` is still returned so the caller can choose\n     *  to fail open during an outage instead of logging everyone out. */\n    | 'unavailable'\n\nexport interface SessionResult {\n    status: SessionStatus\n    /** The signed-in user, or `null` when anonymous/expired. In `verified` mode\n     *  this came from the gateway; in `optimistic` (or `unavailable`) it was\n     *  decoded from the token's own claims. */\n    user: CurrentUser | null\n    /** True only when `user` was confirmed by a gateway `me` call this request\n     *  (or from a fresh cache entry of one). False for optimistic decodes. */\n    verified: boolean\n    /** The token's `exp` (seconds since epoch), when present. */\n    expiresAt?: number\n}\n\nexport interface GetSessionInput {\n    accessToken: string\n    /** `optimistic` (default): decode locally, zero network. `verified`: confirm\n     *  against the gateway with caching + a hard timeout. */\n    mode?: 'optimistic' | 'verified'\n}\n\n/** A place to cache verified sessions. Swap the default in-memory store for a\n *  shared one (Redis, KV) when running multiple instances. */\nexport interface SessionCache {\n    get(token: string): SessionResult | undefined\n    set(token: string, value: SessionResult, ttlMs: number): void\n    delete?(token: string): void\n}\n\nexport interface SessionOptions {\n    /** Cache for verified sessions. Defaults to a per-process `InMemorySessionCache`. */\n    cache?: SessionCache\n    /** How long a verified session stays cached. Default 60_000 (60s). Keep it\n     *  short: a cached session can outlive a server-side revocation by up to\n     *  this long. */\n    ttlMs?: number\n    /** Timeout for the `me` call made by `verified` mode (ms). Default 5_000. */\n    verifyTimeoutMs?: number\n}\n\nconst DEFAULT_TTL_MS = 60_000\nconst DEFAULT_VERIFY_TIMEOUT_MS = 5_000\n\n/** Default cache: a `Map` with per-entry TTL. Lives for the life of the process\n *  (and is shared across requests on a reused serverless instance). */\nexport class InMemorySessionCache implements SessionCache {\n    private readonly store = new Map<string, { value: SessionResult; expiresAtMs: number }>()\n\n    get(token: string): SessionResult | undefined {\n        const hit = this.store.get(token)\n        if (!hit) return undefined\n        if (Date.now() >= hit.expiresAtMs) {\n            this.store.delete(token)\n            return undefined\n        }\n        return hit.value\n    }\n\n    set(token: string, value: SessionResult, ttlMs: number): void {\n        this.store.set(token, { value, expiresAtMs: Date.now() + ttlMs })\n    }\n\n    delete(token: string): void {\n        this.store.delete(token)\n    }\n}\n\nfunction base64UrlDecode(segment: string): string {\n    const base64 = segment.replace(/-/g, '+').replace(/_/g, '/')\n    const padded = base64.length % 4 === 0 ? base64 : base64 + '='.repeat(4 - (base64.length % 4))\n    if (typeof atob === 'function') {\n        const binary = atob(padded)\n        const bytes = Uint8Array.from(binary, (c) => c.charCodeAt(0))\n        return new TextDecoder().decode(bytes)\n    }\n    // Node without a global atob (older runtimes); Buffer is always present there.\n    return Buffer.from(padded, 'base64').toString('utf8')\n}\n\n/**\n * Decode a JWT access token's payload WITHOUT verifying its signature, or\n * return `null` if it is not a parseable JWT. This is deliberately cheap and\n * offline; it is not proof the token is genuine. DontCode tokens are signed\n * with a secret the gateway never shares, so the only authority on a token is\n * the gateway's `me` endpoint — use `getSession({ mode: 'verified' })` when you\n * need that authority.\n */\nexport function decodeAccessToken(token: string): DecodedSession | null {\n    if (!token || typeof token !== 'string') return null\n    const parts = token.split('.')\n    if (parts.length < 2) return null\n    try {\n        const payload = JSON.parse(base64UrlDecode(parts[1])) as Record<string, unknown>\n        if (!payload || typeof payload.sub !== 'string') return null\n        return payload as DecodedSession\n    } catch {\n        return null\n    }\n}\n\n/** True when a token (or already-decoded payload) is past its `exp`. A token\n *  with no `exp` is treated as not expired (the caller cannot prove otherwise\n *  offline). `skewSeconds` widens the window to absorb clock drift. */\nexport function isSessionExpired(\n    input: string | DecodedSession | null,\n    opts: { skewSeconds?: number } = {}\n): boolean {\n    const decoded = typeof input === 'string' ? decodeAccessToken(input) : input\n    if (!decoded || typeof decoded.exp !== 'number') return false\n    const nowSeconds = Date.now() / 1000\n    return nowSeconds >= decoded.exp - (opts.skewSeconds ?? 0)\n}\n\nfunction userFromClaims(decoded: DecodedSession): CurrentUser {\n    return {\n        id: decoded.sub,\n        email: typeof decoded.email === 'string' ? decoded.email : '',\n        role: decoded.role,\n        claims: decoded.claims,\n    }\n}\n\n/**\n * Resolves access tokens into sessions for `AuthApi`. Holds the verified-session\n * cache and timeout policy. Not exported directly; reach it via\n * `client.auth.getSession` / `client.auth.sessionFromCookies`.\n */\nexport class SessionVerifier {\n    private readonly cache: SessionCache\n    private readonly ttlMs: number\n    private readonly verifyTimeoutMs: number\n\n    constructor(\n        private readonly auth: AuthApi,\n        options: SessionOptions = {}\n    ) {\n        this.cache = options.cache ?? new InMemorySessionCache()\n        this.ttlMs = options.ttlMs ?? DEFAULT_TTL_MS\n        this.verifyTimeoutMs = options.verifyTimeoutMs ?? DEFAULT_VERIFY_TIMEOUT_MS\n    }\n\n    async getSession({ accessToken, mode = 'optimistic' }: GetSessionInput): Promise<SessionResult> {\n        const decoded = decodeAccessToken(accessToken)\n        if (!decoded) return { status: 'anonymous', user: null, verified: false }\n        if (isSessionExpired(decoded)) {\n            return { status: 'expired', user: null, verified: false, expiresAt: decoded.exp }\n        }\n\n        const optimistic: SessionResult = {\n            status: 'active',\n            user: userFromClaims(decoded),\n            verified: false,\n            expiresAt: decoded.exp,\n        }\n        if (mode === 'optimistic') return optimistic\n\n        const cached = this.cache.get(accessToken)\n        if (cached) return cached\n\n        try {\n            const { user } = await this.auth.me({\n                accessToken,\n                timeoutMs: this.verifyTimeoutMs,\n            })\n            const result: SessionResult = user\n                ? { status: 'active', user, verified: true, expiresAt: decoded.exp }\n                : { status: 'anonymous', user: null, verified: true }\n            this.cache.set(accessToken, result, this.ttlMs)\n            return result\n        } catch (err) {\n            // A real 401 means the gateway rejected the token: the user is out.\n            if (isDontCodeError(err) && err.status === 401) {\n                return { status: 'anonymous', user: null, verified: true }\n            }\n            // Timeout / network / 5xx: the backend is unreachable, not a verdict\n            // on the user. Hand back the optimistic session marked unavailable so\n            // the caller decides whether to fail open. Not cached.\n            return { ...optimistic, status: 'unavailable' }\n        }\n    }\n}\n","import { Transport } from './http'\nimport { readSessionToken } from './cookies'\nimport {\n    SessionVerifier,\n    decodeAccessToken,\n    type DecodedSession,\n    type GetSessionInput,\n    type SessionOptions,\n    type SessionResult,\n} from './session'\nimport type {\n    ForgotPasswordInput,\n    LoginInput,\n    LoginResult,\n    MeResult,\n    MfaChallengeInput,\n    MfaDisableInput,\n    MfaEnrollConfirmInput,\n    MfaEnrollResult,\n    ResetPasswordInput,\n    SignupInput,\n    SignupResult,\n    SimpleResult,\n    VerifyEmailInput,\n} from './types'\n\nconst AUTH_BASE = '/api/v1/auth'\n\n/** Shape of `GET /api/v1/info`: validates the credential and reports what it\n *  can do. For device tokens, capabilities follow the signed-in user's role. */\nexport interface InfoResult {\n    project: { id: string; name: string | null }\n    credential: {\n        type: 'api_key' | 'device'\n        role: string | null\n        user_id: string | null\n    }\n    capabilities: Record<string, boolean>\n}\n\n/**\n * MFA is per-user and opt-in. `enroll`/`enrollConfirm`/`disable` act as the\n * signed-in user, so they need the end-user access token. `challenge` does\n * not; it completes a login that returned `mfa_required`, exchanging the\n * short-lived challenge token for real session tokens.\n */\nexport class MfaApi {\n    constructor(private readonly transport: Transport) {}\n\n    /** Complete an MFA login. Pass the `challenge_token` from `login`, plus\n     *  either the authenticator `code` or a `recoveryCode`. */\n    challenge(input: MfaChallengeInput): Promise<LoginResult> {\n        return this.transport.json<LoginResult>(`${AUTH_BASE}/mfa/challenge`, {\n            challenge_token: input.challengeToken,\n            code: input.code,\n            recovery_code: input.recoveryCode,\n        })\n    }\n\n    /** Begin enrollment. Render the returned `otpauth_url` as a QR code.\n     *  Enrollment stays pending until `enrollConfirm`. */\n    enroll(input: { accessToken: string }): Promise<MfaEnrollResult> {\n        return this.transport.json<MfaEnrollResult>(\n            `${AUTH_BASE}/mfa/enroll`,\n            {},\n            { accessToken: input.accessToken }\n        )\n    }\n\n    /** Confirm enrollment with the first authenticator code. The returned\n     *  `recovery_codes` are shown once and never again. */\n    enrollConfirm(input: MfaEnrollConfirmInput): Promise<SimpleResult> {\n        return this.transport.json<SimpleResult>(\n            `${AUTH_BASE}/mfa/enroll/confirm`,\n            { code: input.code },\n            { accessToken: input.accessToken }\n        )\n    }\n\n    /** Turn MFA off. Proves possession of the second factor via `code` or\n     *  `recoveryCode`. */\n    disable(input: MfaDisableInput): Promise<SimpleResult> {\n        return this.transport.json<SimpleResult>(\n            `${AUTH_BASE}/mfa/disable`,\n            { code: input.code, recovery_code: input.recoveryCode },\n            { accessToken: input.accessToken }\n        )\n    }\n}\n\n/**\n * Fronts DontCode Auth with the same shapes as the gateway. Two behaviours are\n * project settings (not API flags) and your code must handle both states:\n * email verification (signup may not return tokens) and MFA (login may be two\n * steps). Branch on the resolved value; never assume one round-trip.\n */\nexport class AuthApi {\n    readonly mfa: MfaApi\n    private readonly sessions: SessionVerifier\n\n    constructor(\n        private readonly transport: Transport,\n        sessionOptions?: SessionOptions\n    ) {\n        this.mfa = new MfaApi(transport)\n        this.sessions = new SessionVerifier(this, sessionOptions)\n    }\n\n    /** Create an account. If the project requires email verification the\n     *  response has `verification_required: true` and NO tokens; collect a\n     *  code and call `verifyEmail`, then `login`. */\n    signup(input: SignupInput): Promise<SignupResult> {\n        return this.transport.json<SignupResult>(`${AUTH_BASE}/signup`, {\n            email: input.email,\n            password: input.password,\n            name: input.name,\n            role: input.role,\n        })\n    }\n\n    /** Authenticate. Branch on `mfa_required`: when true you hold only a\n     *  challenge (finish via `mfa.challenge`); otherwise `tokens` is your\n     *  session. A 403 `EmailNotVerified` means the email step isn't done. */\n    login(input: LoginInput): Promise<LoginResult> {\n        return this.transport.json<LoginResult>(`${AUTH_BASE}/login`, {\n            email: input.email,\n            password: input.password,\n        })\n    }\n\n    /** Validate the current credential (API key or device token) and report the\n     *  project, the caller's role, and which capabilities that role grants.\n     *  Backs the MCP \"is my session still good\" check. */\n    info(): Promise<InfoResult> {\n        return this.transport.get<InfoResult>('/api/v1/info')\n    }\n\n    /** Resolve the signed-in user from their access token, or `{ user: null }`.\n     *  This is a network round-trip; for a per-navigation guard prefer\n     *  `getSession`, which can answer offline and caches verified results. */\n    me(input: { accessToken: string; timeoutMs?: number }): Promise<MeResult> {\n        return this.transport.json<MeResult>(\n            `${AUTH_BASE}/me`,\n            {},\n            { accessToken: input.accessToken, timeoutMs: input.timeoutMs }\n        )\n    }\n\n    /**\n     * Resolve an access token into a session for a route guard, the one call\n     * that replaces \"hit `me` on every navigation\". Two modes:\n     *\n     *   - `'optimistic'` (default): decode the token locally and trust its\n     *     claims. Zero network, zero stall. The right default for gating page\n     *     loads. It does NOT verify the signature and will not notice a\n     *     server-side revocation until the token's own `exp`.\n     *   - `'verified'`: confirm against the gateway's `me`, cached for a short\n     *     TTL with a hard timeout. Use it before sensitive actions. On a\n     *     timeout/outage it returns `status: 'unavailable'` with the optimistic\n     *     user, so you choose whether to fail open rather than the SDK guessing.\n     *\n     * See the BYOC docs (\"Sessions\") for the full reasoning and best practices.\n     */\n    getSession(input: GetSessionInput): Promise<SessionResult> {\n        return this.sessions.getSession(input)\n    }\n\n    /** Read the access token from a `Cookie` request header and resolve it, in\n     *  one call. `name` defaults to `dc_access_token`. Returns the anonymous\n     *  session when no cookie is present. */\n    sessionFromCookies(\n        cookieHeader: string | null | undefined,\n        options: { mode?: GetSessionInput['mode']; cookieName?: string } = {}\n    ): Promise<SessionResult> {\n        const token = readSessionToken(cookieHeader, options.cookieName)\n        if (!token) return Promise.resolve({ status: 'anonymous', user: null, verified: false })\n        return this.sessions.getSession({ accessToken: token, mode: options.mode })\n    }\n\n    /** Decode an access token's claims locally without a network call or any\n     *  signature check. Convenience re-export of `decodeAccessToken`. */\n    decodeToken(token: string): DecodedSession | null {\n        return decodeAccessToken(token)\n    }\n\n    /** Confirm the 6-digit code emailed at signup. */\n    verifyEmail(input: VerifyEmailInput): Promise<SimpleResult> {\n        return this.transport.json<SimpleResult>(`${AUTH_BASE}/verify-email`, {\n            code: input.code,\n            email: input.email,\n        })\n    }\n\n    forgotPassword(input: ForgotPasswordInput): Promise<SimpleResult> {\n        return this.transport.json<SimpleResult>(`${AUTH_BASE}/forgot-password`, {\n            email: input.email,\n        })\n    }\n\n    resetPassword(input: ResetPasswordInput): Promise<SimpleResult> {\n        return this.transport.json<SimpleResult>(`${AUTH_BASE}/reset-password`, {\n            code: input.code,\n            password: input.password,\n            email: input.email,\n        })\n    }\n}\n","import { isDontCodeError } from './errors'\nimport { Transport } from './http'\nimport type { CacheSetOptions } from './types'\n\nconst CACHE_PATH = '/api/v1/cache'\n\nconst enc = (key: string) => encodeURIComponent(key)\n\n/** Treat a 404 from the gateway as a cache miss rather than an error. */\nfunction asMiss<T>(err: unknown, fallback: T): T {\n    if (isDontCodeError(err) && err.status === 404) return fallback\n    throw err\n}\n\n/**\n * Key-value cache: a typed proxy over `/api/v1/cache`. Keys are namespaced to\n * your project by the gateway; values are JSON. This is ephemeral storage —\n * use `db` for anything that must be durable.\n *\n * ```ts\n * await client.cache.set('session:42', { step: 2 }, { ttl: 3600 })\n * const s = await client.cache.get<{ step: number }>('session:42') // null if expired\n * ```\n */\nexport class CacheClient {\n    constructor(private readonly transport: Transport) {}\n\n    /** Read a value. Returns `null` on a miss or expiry. */\n    async get<T = unknown>(key: string): Promise<T | null> {\n        try {\n            const r = await this.transport.get<{ value: T }>(`${CACHE_PATH}/kv/${enc(key)}`)\n            return r.value\n        } catch (err) {\n            return asMiss<T | null>(err, null)\n        }\n    }\n\n    /** Set a value, optionally with a TTL (seconds) or set-if-absent (`nx`).\n     *  Returns `false` when `nx` is set and the key already existed. */\n    async set(key: string, value: unknown, options: CacheSetOptions = {}): Promise<boolean> {\n        const params = new URLSearchParams()\n        if (options.ttl != null) params.set('ttl', String(options.ttl))\n        if (options.nx) params.set('nx', 'true')\n        const qs = params.toString() ? `?${params}` : ''\n        const r = await this.transport.put<{ set: boolean }>(`${CACHE_PATH}/kv/${enc(key)}${qs}`, value)\n        return r.set\n    }\n\n    /** Delete a key. Returns whether it existed. */\n    async del(key: string): Promise<boolean> {\n        const r = await this.transport.del<{ deleted: boolean }>(`${CACHE_PATH}/kv/${enc(key)}`)\n        return r.deleted\n    }\n\n    /** Set or clear (`null`) the TTL on an existing key. Returns `false` if absent. */\n    async expire(key: string, ttl: number | null): Promise<boolean> {\n        const r = await this.transport.json<{ applied: boolean }>(`${CACHE_PATH}/expire/${enc(key)}`, {\n            ttl,\n        })\n        return r.applied\n    }\n\n    // --- hashes -------------------------------------------------------------\n\n    /** Set fields on a hash. Returns the number of fields written. */\n    async hset(key: string, fields: Record<string, unknown>): Promise<number> {\n        const r = await this.transport.json<{ written: number }>(`${CACHE_PATH}/hset/${enc(key)}`, {\n            fields,\n        })\n        return r.written\n    }\n\n    /** Read a whole hash. Returns `null` on a miss. */\n    async hgetAll<T = Record<string, unknown>>(key: string): Promise<T | null> {\n        try {\n            const r = await this.transport.get<{ value: T }>(`${CACHE_PATH}/hgetall/${enc(key)}`)\n            return r.value\n        } catch (err) {\n            return asMiss<T | null>(err, null)\n        }\n    }\n\n    // --- sets ---------------------------------------------------------------\n\n    /** Add members to a set. Returns the number newly added. */\n    async sAdd(key: string, ...members: string[]): Promise<number> {\n        const r = await this.transport.json<{ added: number }>(`${CACHE_PATH}/sadd/${enc(key)}`, {\n            members,\n        })\n        return r.added\n    }\n\n    /** List set members. Returns `[]` on a miss. */\n    async sMembers(key: string): Promise<string[]> {\n        try {\n            const r = await this.transport.get<{ value: string[] }>(\n                `${CACHE_PATH}/smembers/${enc(key)}`\n            )\n            return r.value ?? []\n        } catch (err) {\n            return asMiss<string[]>(err, [])\n        }\n    }\n\n    /** Remove members from a set. Returns the number removed. */\n    async sRem(key: string, ...members: string[]): Promise<number> {\n        const r = await this.transport.json<{ removed: number }>(`${CACHE_PATH}/srem/${enc(key)}`, {\n            members,\n        })\n        return r.removed\n    }\n}\n\nexport function createCache(transport: Transport): CacheClient {\n    return new CacheClient(transport)\n}\n","import { Transport } from './http'\nimport type {\n    DeleteInput,\n    MigrateInput,\n    MigrateResult,\n    QueryOptions,\n    UpdateInput,\n} from './types'\n\nconst DB_PATH = '/api/v1/db'\nconst MIGRATE_PATH = '/api/v1/db/migrate'\n\n/** The gateway wraps every DB result in `{ data }`; we unwrap it. */\ninterface DbEnvelope<T> {\n    data: T\n}\n\n/**\n * A handle to one table. Structured queries only; there is no raw-SQL escape\n * hatch (schema changes go through `db.migrate`). `update` and `delete`\n * require a `where` clause server-side, so the types make it mandatory.\n */\nexport class TableQuery {\n    constructor(\n        private readonly transport: Transport,\n        private readonly tableName: string\n    ) {}\n\n    private async run<T>(operation: string, options: unknown): Promise<T> {\n        const res = await this.transport.json<DbEnvelope<T>>(DB_PATH, {\n            operation,\n            tableName: this.tableName,\n            options,\n        })\n        return res.data\n    }\n\n    /** Rows matching the query (max 1000 per call). */\n    find<T = Record<string, unknown>>(options: QueryOptions = {}): Promise<T[]> {\n        return this.run<T[]>('find', options)\n    }\n\n    /** Alias of `find`. */\n    findMany<T = Record<string, unknown>>(options: QueryOptions = {}): Promise<T[]> {\n        return this.run<T[]>('findMany', options)\n    }\n\n    /** The first matching row, or `null`. */\n    findFirst<T = Record<string, unknown>>(options: QueryOptions = {}): Promise<T | null> {\n        return this.run<T | null>('findFirst', options)\n    }\n\n    /** Alias of `findFirst`. */\n    findOne<T = Record<string, unknown>>(options: QueryOptions = {}): Promise<T | null> {\n        return this.run<T | null>('findOne', options)\n    }\n\n    /** Insert one row. Returns `{ id }`. Unique/FK conflicts throw a 409\n     *  DontCodeError, the supported idempotency signal. */\n    insert(data: Record<string, unknown>): Promise<{ id: unknown }> {\n        return this.run<{ id: unknown }>('insert', { data })\n    }\n\n    /** Update rows matching `where`. Returns `{ count }`. */\n    update(input: UpdateInput): Promise<{ count: number }> {\n        return this.run<{ count: number }>('update', { where: input.where, data: input.data })\n    }\n\n    /** Delete rows matching `where`. Returns `{ count }`. */\n    delete(input: DeleteInput): Promise<{ count: number }> {\n        return this.run<{ count: number }>('delete', { where: input.where })\n    }\n\n    /** Count matching rows. */\n    count(options: Pick<QueryOptions, 'where'> = {}): Promise<number> {\n        return this.run<number>('count', options)\n    }\n}\n\n/**\n * `db.users.find()` and `db('users').find()` both work; the bracket/callable\n * form is there for table names that aren't valid identifiers. `db.migrate()`\n * applies schema DDL (the one place migrations enter from outside).\n */\nexport type DbClient = {\n    readonly [tableName: string]: TableQuery\n} & {\n    (tableName: string): TableQuery\n    migrate(input: MigrateInput): Promise<MigrateResult>\n}\n\nexport function createDb(transport: Transport): DbClient {\n    const table = (tableName: string): TableQuery => new TableQuery(transport, tableName)\n    const migrate = (input: MigrateInput): Promise<MigrateResult> =>\n        transport.json<MigrateResult>(MIGRATE_PATH, { sql: input.sql })\n\n    return new Proxy(table, {\n        get(target, prop, receiver) {\n            if (prop === 'migrate') return migrate\n            // Don't manufacture a TableQuery for symbols or promise-unwrapping\n            // probes (`then`) or the function's own members.\n            if (typeof prop !== 'string' || prop === 'then' || prop in target) {\n                return Reflect.get(target, prop, receiver)\n            }\n            return new TableQuery(transport, prop)\n        },\n        apply(_target, _thisArg, args: [string]) {\n            return table(args[0])\n        },\n    }) as unknown as DbClient\n}\n","import { Transport } from './http'\nimport type { ConnectionToken, MintConnectionTokenInput, RealtimePresenceMember } from './types'\n\nconst REALTIME_PATH = '/api/v1/realtime'\n\n/**\n * Realtime control plane: a typed proxy over `/api/v1/realtime`. This is the\n * server side — mint connection tokens for browsers, publish messages, and read\n * presence. The WebSocket itself terminates at the realtime service: hand the\n * `{ token, url }` from `mintToken` to a browser and connect to\n * `${url}?token=${token}`. Channels are namespaced to your project by the gateway.\n *\n * ```ts\n * // In your token endpoint, after authenticating the user:\n * const conn = await client.realtime.mintToken({ channels: [`room:${id}`], identity: userId })\n * // → return conn to the browser, which connects to `${conn.url}?token=${conn.token}`\n *\n * // From anywhere on your backend:\n * await client.realtime.publish(`room:${id}`, { text: 'hello' })\n * ```\n */\nexport class RealtimeApi {\n    constructor(private readonly transport: Transport) {}\n\n    /** Mint a short-lived, channel-scoped connection token for a browser. */\n    mintToken(input: MintConnectionTokenInput): Promise<ConnectionToken> {\n        return this.transport.json<ConnectionToken>(`${REALTIME_PATH}/token`, {\n            channels: input.channels,\n            identity: input.identity,\n            ttl: input.ttl,\n        })\n    }\n\n    /** Publish a message to a channel. Returns how many subscribers it reached. */\n    async publish(channel: string, payload: unknown): Promise<number> {\n        const r = await this.transport.json<{ delivered: number }>(`${REALTIME_PATH}/publish`, {\n            channel,\n            payload,\n        })\n        return r.delivered\n    }\n\n    /** Who is currently connected to a channel. */\n    async presence(channel: string): Promise<RealtimePresenceMember[]> {\n        const r = await this.transport.get<{ presence: RealtimePresenceMember[] }>(\n            `${REALTIME_PATH}/channels/${encodeURIComponent(channel)}/presence`\n        )\n        return r.presence ?? []\n    }\n}\n\nexport function createRealtime(transport: Transport): RealtimeApi {\n    return new RealtimeApi(transport)\n}\n","import { Transport } from './http'\nimport type {\n    DownloadResult,\n    ListResult,\n    PresignResult,\n    StorageBucket,\n    StorageObject,\n    TemporaryUrlResult,\n    UploadBody,\n} from './types'\n\nconst STORAGE_PATH = '/api/v1/storage'\n\nconst DEFAULT_CONTENT_TYPE = 'application/octet-stream'\n\n/** Normalize whatever the caller hands us into a Blob for multipart upload. */\nfunction toBlob(body: UploadBody, contentType: string): Blob {\n    if (body instanceof Blob) return body\n    if (typeof body === 'string') return new Blob([body], { type: contentType })\n    if (body instanceof ArrayBuffer) return new Blob([body], { type: contentType })\n    if (ArrayBuffer.isView(body)) {\n        return new Blob([body as unknown as BlobPart], { type: contentType })\n    }\n    throw new TypeError('upload expects a Blob, ArrayBuffer, typed array, or string')\n}\n\nfunction fileName(path: string): string {\n    return path.split('/').filter(Boolean).pop() ?? path\n}\n\n/** Operations available on both buckets. */\nexport class BucketClient {\n    constructor(\n        protected readonly transport: Transport,\n        protected readonly bucket: StorageBucket\n    ) {}\n\n    protected op<T>(operation: string, params: Record<string, unknown> = {}): Promise<T> {\n        return this.transport.json<T>(STORAGE_PATH, { operation, bucket: this.bucket, ...params })\n    }\n\n    /** List objects under `prefix`. */\n    list(prefix?: string): Promise<ListResult> {\n        return this.op<ListResult>('list', { prefix })\n    }\n\n    /** Delete one or more objects. Returns `{ deleted }`. */\n    remove(paths: string[]): Promise<{ deleted: number }> {\n        return this.op<{ deleted: number }>('remove', { paths })\n    }\n\n    /** Move/rename an object within the bucket. */\n    move(from: string, to: string): Promise<{ object: StorageObject }> {\n        return this.op<{ object: StorageObject }>('move', { from, to })\n    }\n\n    createFolder(path: string): Promise<{ created: string }> {\n        return this.op<{ created: string }>('createFolder', { path })\n    }\n\n    /** Download an object inline (≤ 8 MB). Use `getTemporaryUrl` for larger files. */\n    download(path: string): Promise<DownloadResult> {\n        return this.op<DownloadResult>('download', { path })\n    }\n\n    /** A short-lived signed URL (default 300s, max 7 days). */\n    getTemporaryUrl(path: string, expiresIn?: number): Promise<TemporaryUrlResult> {\n        return this.op<TemporaryUrlResult>('getTemporaryUrl', { path, expiresIn })\n    }\n\n    /** A presigned PUT URL for direct, large uploads (≤ no inline limit). */\n    presignUpload(path: string, contentType?: string): Promise<PresignResult> {\n        return this.op<PresignResult>('presignUpload', { path, contentType })\n    }\n\n    /** Upload bytes directly (≤ 100 MB). For larger files, `presignUpload`\n     *  then PUT to the returned URL yourself. */\n    upload(\n        path: string,\n        body: UploadBody,\n        contentType: string = DEFAULT_CONTENT_TYPE\n    ): Promise<{ object: StorageObject }> {\n        const form = new FormData()\n        form.append('file', toBlob(body, contentType), fileName(path))\n        form.append('bucket', this.bucket)\n        form.append('path', path)\n        form.append('contentType', contentType)\n        return this.transport.multipart<{ object: StorageObject }>(STORAGE_PATH, form)\n    }\n}\n\n/** The public bucket additionally exposes stable public URLs. */\nexport class PublicBucketClient extends BucketClient {\n    constructor(transport: Transport) {\n        super(transport, 'public')\n    }\n\n    /** The permanent public URL for an object. */\n    getUrl(path: string): Promise<{ url: string }> {\n        return this.op<{ url: string }>('getUrl', { path })\n    }\n}\n\nexport interface StorageClient {\n    public: PublicBucketClient\n    private: BucketClient\n}\n\nexport function createStorage(transport: Transport): StorageClient {\n    return {\n        public: new PublicBucketClient(transport),\n        private: new BucketClient(transport, 'private'),\n    }\n}\n","import { DontCodeError, type DontCodeErrorBody } from './errors'\n\n/** Default per-request timeout. Without one, a slow or unreachable gateway can\n *  hang a request for the platform's full socket timeout (tens of seconds),\n *  which is the single worst failure mode for an auth guard on the hot path. */\nexport const DEFAULT_TIMEOUT_MS = 10_000\n\nexport interface TransportConfig {\n    /** Project API key. When absent, no Authorization header is sent and the\n     *  gateway responds with its own \"Missing API key\" 401. */\n    apiKey?: string\n    /** Gateway origin, already normalized (no trailing slash). */\n    baseUrl: string\n    /** Per-request timeout in ms. Defaults to `DEFAULT_TIMEOUT_MS`; `0` (or any\n     *  non-positive value) disables it. */\n    timeoutMs?: number\n}\n\nexport interface RequestOptions {\n    /** End-user access token, sent as `X-Access-Token` (separate from the\n     *  project API key). Required by signed-in auth calls. */\n    accessToken?: string\n    /** Override the client's timeout for this one call (ms). `0` disables it. */\n    timeoutMs?: number\n}\n\n/**\n * The single place network requests are made. Everything else in the SDK is a\n * typed shape around `json()` / `multipart()`. No retries, no caching, just a\n * faithful proxy of the v1 gateway.\n */\nexport class Transport {\n    constructor(private readonly config: TransportConfig) {}\n\n    private headers(opts?: RequestOptions): Record<string, string> {\n        const headers: Record<string, string> = {}\n        if (this.config.apiKey) headers['Authorization'] = `Bearer ${this.config.apiKey}`\n        if (opts?.accessToken) headers['X-Access-Token'] = opts.accessToken\n        return headers\n    }\n\n    private url(path: string): string {\n        return `${this.config.baseUrl}${path}`\n    }\n\n    private timeout(opts?: RequestOptions): number {\n        const value = opts?.timeoutMs ?? this.config.timeoutMs ?? DEFAULT_TIMEOUT_MS\n        return value > 0 ? value : 0\n    }\n\n    /**\n     * One fetch, with a timeout that turns \"hung socket\" into a fast, typed\n     * failure. A timeout surfaces as `DontCodeError` with status 408 / code\n     * `Timeout`; any other transport failure (DNS, refused, offline) as status\n     * 0 / code `NetworkError`. Both are distinct from a real `401`, so an auth\n     * guard can tell \"backend is down\" apart from \"user is signed out\".\n     */\n    private async send(path: string, init: RequestInit, opts?: RequestOptions): Promise<Response> {\n        const timeoutMs = this.timeout(opts)\n        const controller = timeoutMs > 0 ? new AbortController() : undefined\n        const timer = controller ? setTimeout(() => controller.abort(), timeoutMs) : undefined\n        try {\n            return await fetch(this.url(path), { ...init, signal: controller?.signal })\n        } catch (err) {\n            if (controller?.signal.aborted) {\n                throw new DontCodeError(408, {\n                    error: `Request to ${path} timed out after ${timeoutMs}ms`,\n                    code: 'Timeout',\n                })\n            }\n            throw new DontCodeError(0, {\n                error: err instanceof Error ? err.message : 'Network request failed',\n                code: 'NetworkError',\n            })\n        } finally {\n            if (timer) clearTimeout(timer)\n        }\n    }\n\n    /** GET and parse the JSON response. */\n    async get<T>(path: string, opts?: RequestOptions): Promise<T> {\n        const res = await this.send(path, { method: 'GET', headers: this.headers(opts) }, opts)\n        return this.parse<T>(res)\n    }\n\n    /** POST a JSON body and parse the JSON response. */\n    async json<T>(path: string, body?: unknown, opts?: RequestOptions): Promise<T> {\n        const res = await this.send(\n            path,\n            {\n                method: 'POST',\n                headers: { ...this.headers(opts), 'Content-Type': 'application/json' },\n                body: JSON.stringify(body ?? {}),\n            },\n            opts\n        )\n        return this.parse<T>(res)\n    }\n\n    /** PUT a JSON body and parse the JSON response. */\n    async put<T>(path: string, body?: unknown, opts?: RequestOptions): Promise<T> {\n        const res = await this.send(\n            path,\n            {\n                method: 'PUT',\n                headers: { ...this.headers(opts), 'Content-Type': 'application/json' },\n                body: JSON.stringify(body ?? null),\n            },\n            opts\n        )\n        return this.parse<T>(res)\n    }\n\n    /** DELETE and parse the JSON response. */\n    async del<T>(path: string, opts?: RequestOptions): Promise<T> {\n        const res = await this.send(path, { method: 'DELETE', headers: this.headers(opts) }, opts)\n        return this.parse<T>(res)\n    }\n\n    /** PUT a multipart form (file uploads). The runtime sets the boundary. */\n    async multipart<T>(path: string, form: FormData, opts?: RequestOptions): Promise<T> {\n        const res = await this.send(path, { method: 'PUT', headers: this.headers(opts), body: form }, opts)\n        return this.parse<T>(res)\n    }\n\n    private async parse<T>(res: Response): Promise<T> {\n        const raw = await res.text()\n        let data: unknown = null\n        if (raw) {\n            try {\n                data = JSON.parse(raw)\n            } catch {\n                data = { error: raw }\n            }\n        }\n        if (!res.ok) {\n            const body: DontCodeErrorBody =\n                data && typeof data === 'object'\n                    ? (data as DontCodeErrorBody)\n                    : { error: res.statusText || 'Request failed' }\n            throw new DontCodeError(res.status, body)\n        }\n        return data as T\n    }\n}\n","import { AuthApi } from './auth'\nimport { CacheClient, createCache } from './cache'\nimport { createDb, type DbClient } from './db'\nimport { Transport } from './http'\nimport { createRealtime, RealtimeApi } from './realtime'\nimport type { SessionOptions } from './session'\nimport { createStorage, type StorageClient } from './storage'\n\nconst DEFAULT_BASE_URL = 'https://backend.dontcode.co'\n\nexport interface DontCodeClientOptions {\n    /** Project API key (`dc_…`). Defaults to `process.env.DONTCODE_API_KEY`.\n     *  If neither is set, requests fail naturally with the gateway's\n     *  \"Missing API key\" 401. */\n    apiKey?: string\n    /** Gateway origin. Defaults to `process.env.DONTCODE_API_URL`, then to\n     *  `https://backend.dontcode.co`. */\n    baseUrl?: string\n    /** Per-request network timeout in ms. Defaults to 10_000; `0` disables it.\n     *  Without one, a slow gateway can hang a request for the full socket\n     *  timeout, the worst case for an auth guard. */\n    timeoutMs?: number\n    /** Caching + timeout policy for `auth.getSession` / `auth.sessionFromCookies`. */\n    session?: SessionOptions\n}\n\nexport interface DontCodeClient {\n    auth: AuthApi\n    db: DbClient\n    storage: StorageClient\n    cache: CacheClient\n    realtime: RealtimeApi\n}\n\n/** Read an env var without assuming `process` exists (e.g. in the browser). */\nfunction fromEnv(name: string): string | undefined {\n    if (typeof process === 'undefined' || !process.env) return undefined\n    return process.env[name]\n}\n\n/**\n * Create a DontCode backend client. A thin, typed proxy over the v1 HTTP\n * gateway: auth, database, storage, cache, and realtime. The API key scopes\n * every request to a single project; there is nothing else to configure.\n *\n * ```ts\n * import { dontcode } from '@dontcode2/backend'\n * const client = dontcode() // reads DONTCODE_API_KEY\n * await client.auth.signup({ email, password, role: 'editor' })\n * ```\n */\nexport function dontcode(options: DontCodeClientOptions = {}): DontCodeClient {\n    const apiKey = options.apiKey ?? fromEnv('DONTCODE_API_KEY')\n    const baseUrl = (options.baseUrl ?? fromEnv('DONTCODE_API_URL') ?? DEFAULT_BASE_URL).replace(\n        /\\/+$/,\n        ''\n    )\n\n    const transport = new Transport({ apiKey, baseUrl, timeoutMs: options.timeoutMs })\n\n    return {\n        auth: new AuthApi(transport, options.session),\n        db: createDb(transport),\n        storage: createStorage(transport),\n        cache: createCache(transport),\n        realtime: createRealtime(transport),\n    }\n}\n"],"mappings":";AAaO,IAAM,8BAA8B;AAG3C,IAAM,0BAA0B,KAAK,KAAK,KAAK;AAmB/C,SAAS,UAAU,MAAc,OAAe,SAA+B,QAAwB;AACnG,QAAM,WAAW,QAAQ,YAAY;AAGrC,QAAM,SAAS,aAAa,SAAS,OAAQ,QAAQ,UAAU;AAC/D,QAAM,WAAW,QAAQ,YAAY;AACrC,QAAM,OAAO,QAAQ,QAAQ;AAE7B,QAAM,QAAQ,CAAC,GAAG,IAAI,IAAI,mBAAmB,KAAK,CAAC,IAAI,QAAQ,IAAI,IAAI,WAAW,MAAM,EAAE;AAC1F,MAAI,QAAQ,OAAQ,OAAM,KAAK,UAAU,QAAQ,MAAM,EAAE;AACzD,QAAM,KAAK,YAAY,SAAS,OAAO,CAAC,EAAE,YAAY,CAAC,GAAG,SAAS,MAAM,CAAC,CAAC,EAAE;AAC7E,MAAI,SAAU,OAAM,KAAK,UAAU;AACnC,MAAI,OAAQ,OAAM,KAAK,QAAQ;AAC/B,SAAO,MAAM,KAAK,IAAI;AAC1B;AAGO,SAAS,uBAAuB,OAAe,UAAgC,CAAC,GAAW;AAC9F,QAAM,OAAO,QAAQ,QAAQ;AAC7B,QAAM,SAAS,QAAQ,UAAU;AACjC,SAAO,UAAU,MAAM,OAAO,SAAS,MAAM;AACjD;AAGO,SAAS,mBAAmB,UAAgC,CAAC,GAAW;AAC3E,QAAM,OAAO,QAAQ,QAAQ;AAC7B,SAAO,UAAU,MAAM,IAAI,SAAS,CAAC;AACzC;AAIO,SAAS,iBACZ,cACA,OAAe,6BACF;AACb,MAAI,CAAC,aAAc,QAAO;AAC1B,aAAW,QAAQ,aAAa,MAAM,GAAG,GAAG;AACxC,UAAM,KAAK,KAAK,QAAQ,GAAG;AAC3B,QAAI,OAAO,GAAI;AACf,QAAI,KAAK,MAAM,GAAG,EAAE,EAAE,KAAK,MAAM,KAAM;AACvC,UAAM,MAAM,KAAK,MAAM,KAAK,CAAC,EAAE,KAAK;AACpC,QAAI,CAAC,IAAK,QAAO;AACjB,QAAI;AACA,aAAO,mBAAmB,GAAG;AAAA,IACjC,QAAQ;AACJ,aAAO;AAAA,IACX;AAAA,EACJ;AACA,SAAO;AACX;;;AC1DO,IAAM,gBAAN,cAA4B,MAAM;AAAA,EAQrC,YAAY,QAAgB,MAAyB;AACjD,UAAM,UACF,OAAO,MAAM,UAAU,YAAY,KAAK,MAAM,SAAS,IACjD,KAAK,QACL,uCAAuC,MAAM;AACvD,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,OAAO,OAAO,MAAM,SAAS,WAAW,KAAK,OAAO;AACzD,SAAK,OAAO,QAAQ,CAAC;AAAA,EACzB;AAAA;AAAA,EAGA,IAAI,cAAuB;AACvB,WAAO,KAAK,WAAW;AAAA,EAC3B;AACJ;AAGO,SAAS,gBAAgB,KAAoC;AAChE,MAAI,eAAe,cAAe,QAAO;AACzC,SACI,OAAO,QAAQ,YACf,QAAQ,QACP,IAA2B,SAAS;AAE7C;;;AC4BA,IAAM,iBAAiB;AACvB,IAAM,4BAA4B;AAI3B,IAAM,uBAAN,MAAmD;AAAA,EAAnD;AACH,SAAiB,QAAQ,oBAAI,IAA2D;AAAA;AAAA,EAExF,IAAI,OAA0C;AAC1C,UAAM,MAAM,KAAK,MAAM,IAAI,KAAK;AAChC,QAAI,CAAC,IAAK,QAAO;AACjB,QAAI,KAAK,IAAI,KAAK,IAAI,aAAa;AAC/B,WAAK,MAAM,OAAO,KAAK;AACvB,aAAO;AAAA,IACX;AACA,WAAO,IAAI;AAAA,EACf;AAAA,EAEA,IAAI,OAAe,OAAsB,OAAqB;AAC1D,SAAK,MAAM,IAAI,OAAO,EAAE,OAAO,aAAa,KAAK,IAAI,IAAI,MAAM,CAAC;AAAA,EACpE;AAAA,EAEA,OAAO,OAAqB;AACxB,SAAK,MAAM,OAAO,KAAK;AAAA,EAC3B;AACJ;AAEA,SAAS,gBAAgB,SAAyB;AAC9C,QAAM,SAAS,QAAQ,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AAC3D,QAAM,SAAS,OAAO,SAAS,MAAM,IAAI,SAAS,SAAS,IAAI,OAAO,IAAK,OAAO,SAAS,CAAE;AAC7F,MAAI,OAAO,SAAS,YAAY;AAC5B,UAAM,SAAS,KAAK,MAAM;AAC1B,UAAM,QAAQ,WAAW,KAAK,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;AAC5D,WAAO,IAAI,YAAY,EAAE,OAAO,KAAK;AAAA,EACzC;AAEA,SAAO,OAAO,KAAK,QAAQ,QAAQ,EAAE,SAAS,MAAM;AACxD;AAUO,SAAS,kBAAkB,OAAsC;AACpE,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,MAAI,MAAM,SAAS,EAAG,QAAO;AAC7B,MAAI;AACA,UAAM,UAAU,KAAK,MAAM,gBAAgB,MAAM,CAAC,CAAC,CAAC;AACpD,QAAI,CAAC,WAAW,OAAO,QAAQ,QAAQ,SAAU,QAAO;AACxD,WAAO;AAAA,EACX,QAAQ;AACJ,WAAO;AAAA,EACX;AACJ;AAKO,SAAS,iBACZ,OACA,OAAiC,CAAC,GAC3B;AACP,QAAM,UAAU,OAAO,UAAU,WAAW,kBAAkB,KAAK,IAAI;AACvE,MAAI,CAAC,WAAW,OAAO,QAAQ,QAAQ,SAAU,QAAO;AACxD,QAAM,aAAa,KAAK,IAAI,IAAI;AAChC,SAAO,cAAc,QAAQ,OAAO,KAAK,eAAe;AAC5D;AAEA,SAAS,eAAe,SAAsC;AAC1D,SAAO;AAAA,IACH,IAAI,QAAQ;AAAA,IACZ,OAAO,OAAO,QAAQ,UAAU,WAAW,QAAQ,QAAQ;AAAA,IAC3D,MAAM,QAAQ;AAAA,IACd,QAAQ,QAAQ;AAAA,EACpB;AACJ;AAOO,IAAM,kBAAN,MAAsB;AAAA,EAKzB,YACqB,MACjB,UAA0B,CAAC,GAC7B;AAFmB;AAGjB,SAAK,QAAQ,QAAQ,SAAS,IAAI,qBAAqB;AACvD,SAAK,QAAQ,QAAQ,SAAS;AAC9B,SAAK,kBAAkB,QAAQ,mBAAmB;AAAA,EACtD;AAAA,EAEA,MAAM,WAAW,EAAE,aAAa,OAAO,aAAa,GAA4C;AAC5F,UAAM,UAAU,kBAAkB,WAAW;AAC7C,QAAI,CAAC,QAAS,QAAO,EAAE,QAAQ,aAAa,MAAM,MAAM,UAAU,MAAM;AACxE,QAAI,iBAAiB,OAAO,GAAG;AAC3B,aAAO,EAAE,QAAQ,WAAW,MAAM,MAAM,UAAU,OAAO,WAAW,QAAQ,IAAI;AAAA,IACpF;AAEA,UAAM,aAA4B;AAAA,MAC9B,QAAQ;AAAA,MACR,MAAM,eAAe,OAAO;AAAA,MAC5B,UAAU;AAAA,MACV,WAAW,QAAQ;AAAA,IACvB;AACA,QAAI,SAAS,aAAc,QAAO;AAElC,UAAM,SAAS,KAAK,MAAM,IAAI,WAAW;AACzC,QAAI,OAAQ,QAAO;AAEnB,QAAI;AACA,YAAM,EAAE,KAAK,IAAI,MAAM,KAAK,KAAK,GAAG;AAAA,QAChC;AAAA,QACA,WAAW,KAAK;AAAA,MACpB,CAAC;AACD,YAAM,SAAwB,OACxB,EAAE,QAAQ,UAAU,MAAM,UAAU,MAAM,WAAW,QAAQ,IAAI,IACjE,EAAE,QAAQ,aAAa,MAAM,MAAM,UAAU,KAAK;AACxD,WAAK,MAAM,IAAI,aAAa,QAAQ,KAAK,KAAK;AAC9C,aAAO;AAAA,IACX,SAAS,KAAK;AAEV,UAAI,gBAAgB,GAAG,KAAK,IAAI,WAAW,KAAK;AAC5C,eAAO,EAAE,QAAQ,aAAa,MAAM,MAAM,UAAU,KAAK;AAAA,MAC7D;AAIA,aAAO,EAAE,GAAG,YAAY,QAAQ,cAAc;AAAA,IAClD;AAAA,EACJ;AACJ;;;AC1MA,IAAM,YAAY;AAoBX,IAAM,SAAN,MAAa;AAAA,EAChB,YAA6B,WAAsB;AAAtB;AAAA,EAAuB;AAAA;AAAA;AAAA,EAIpD,UAAU,OAAgD;AACtD,WAAO,KAAK,UAAU,KAAkB,GAAG,SAAS,kBAAkB;AAAA,MAClE,iBAAiB,MAAM;AAAA,MACvB,MAAM,MAAM;AAAA,MACZ,eAAe,MAAM;AAAA,IACzB,CAAC;AAAA,EACL;AAAA;AAAA;AAAA,EAIA,OAAO,OAA0D;AAC7D,WAAO,KAAK,UAAU;AAAA,MAClB,GAAG,SAAS;AAAA,MACZ,CAAC;AAAA,MACD,EAAE,aAAa,MAAM,YAAY;AAAA,IACrC;AAAA,EACJ;AAAA;AAAA;AAAA,EAIA,cAAc,OAAqD;AAC/D,WAAO,KAAK,UAAU;AAAA,MAClB,GAAG,SAAS;AAAA,MACZ,EAAE,MAAM,MAAM,KAAK;AAAA,MACnB,EAAE,aAAa,MAAM,YAAY;AAAA,IACrC;AAAA,EACJ;AAAA;AAAA;AAAA,EAIA,QAAQ,OAA+C;AACnD,WAAO,KAAK,UAAU;AAAA,MAClB,GAAG,SAAS;AAAA,MACZ,EAAE,MAAM,MAAM,MAAM,eAAe,MAAM,aAAa;AAAA,MACtD,EAAE,aAAa,MAAM,YAAY;AAAA,IACrC;AAAA,EACJ;AACJ;AAQO,IAAM,UAAN,MAAc;AAAA,EAIjB,YACqB,WACjB,gBACF;AAFmB;AAGjB,SAAK,MAAM,IAAI,OAAO,SAAS;AAC/B,SAAK,WAAW,IAAI,gBAAgB,MAAM,cAAc;AAAA,EAC5D;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,OAA2C;AAC9C,WAAO,KAAK,UAAU,KAAmB,GAAG,SAAS,WAAW;AAAA,MAC5D,OAAO,MAAM;AAAA,MACb,UAAU,MAAM;AAAA,MAChB,MAAM,MAAM;AAAA,MACZ,MAAM,MAAM;AAAA,IAChB,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,OAAyC;AAC3C,WAAO,KAAK,UAAU,KAAkB,GAAG,SAAS,UAAU;AAAA,MAC1D,OAAO,MAAM;AAAA,MACb,UAAU,MAAM;AAAA,IACpB,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA,EAKA,OAA4B;AACxB,WAAO,KAAK,UAAU,IAAgB,cAAc;AAAA,EACxD;AAAA;AAAA;AAAA;AAAA,EAKA,GAAG,OAAuE;AACtE,WAAO,KAAK,UAAU;AAAA,MAClB,GAAG,SAAS;AAAA,MACZ,CAAC;AAAA,MACD,EAAE,aAAa,MAAM,aAAa,WAAW,MAAM,UAAU;AAAA,IACjE;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,WAAW,OAAgD;AACvD,WAAO,KAAK,SAAS,WAAW,KAAK;AAAA,EACzC;AAAA;AAAA;AAAA;AAAA,EAKA,mBACI,cACA,UAAmE,CAAC,GAC9C;AACtB,UAAM,QAAQ,iBAAiB,cAAc,QAAQ,UAAU;AAC/D,QAAI,CAAC,MAAO,QAAO,QAAQ,QAAQ,EAAE,QAAQ,aAAa,MAAM,MAAM,UAAU,MAAM,CAAC;AACvF,WAAO,KAAK,SAAS,WAAW,EAAE,aAAa,OAAO,MAAM,QAAQ,KAAK,CAAC;AAAA,EAC9E;AAAA;AAAA;AAAA,EAIA,YAAY,OAAsC;AAC9C,WAAO,kBAAkB,KAAK;AAAA,EAClC;AAAA;AAAA,EAGA,YAAY,OAAgD;AACxD,WAAO,KAAK,UAAU,KAAmB,GAAG,SAAS,iBAAiB;AAAA,MAClE,MAAM,MAAM;AAAA,MACZ,OAAO,MAAM;AAAA,IACjB,CAAC;AAAA,EACL;AAAA,EAEA,eAAe,OAAmD;AAC9D,WAAO,KAAK,UAAU,KAAmB,GAAG,SAAS,oBAAoB;AAAA,MACrE,OAAO,MAAM;AAAA,IACjB,CAAC;AAAA,EACL;AAAA,EAEA,cAAc,OAAkD;AAC5D,WAAO,KAAK,UAAU,KAAmB,GAAG,SAAS,mBAAmB;AAAA,MACpE,MAAM,MAAM;AAAA,MACZ,UAAU,MAAM;AAAA,MAChB,OAAO,MAAM;AAAA,IACjB,CAAC;AAAA,EACL;AACJ;;;AC1MA,IAAM,aAAa;AAEnB,IAAM,MAAM,CAAC,QAAgB,mBAAmB,GAAG;AAGnD,SAAS,OAAU,KAAc,UAAgB;AAC7C,MAAI,gBAAgB,GAAG,KAAK,IAAI,WAAW,IAAK,QAAO;AACvD,QAAM;AACV;AAYO,IAAM,cAAN,MAAkB;AAAA,EACrB,YAA6B,WAAsB;AAAtB;AAAA,EAAuB;AAAA;AAAA,EAGpD,MAAM,IAAiB,KAAgC;AACnD,QAAI;AACA,YAAM,IAAI,MAAM,KAAK,UAAU,IAAkB,GAAG,UAAU,OAAO,IAAI,GAAG,CAAC,EAAE;AAC/E,aAAO,EAAE;AAAA,IACb,SAAS,KAAK;AACV,aAAO,OAAiB,KAAK,IAAI;AAAA,IACrC;AAAA,EACJ;AAAA;AAAA;AAAA,EAIA,MAAM,IAAI,KAAa,OAAgB,UAA2B,CAAC,GAAqB;AACpF,UAAM,SAAS,IAAI,gBAAgB;AACnC,QAAI,QAAQ,OAAO,KAAM,QAAO,IAAI,OAAO,OAAO,QAAQ,GAAG,CAAC;AAC9D,QAAI,QAAQ,GAAI,QAAO,IAAI,MAAM,MAAM;AACvC,UAAM,KAAK,OAAO,SAAS,IAAI,IAAI,MAAM,KAAK;AAC9C,UAAM,IAAI,MAAM,KAAK,UAAU,IAAsB,GAAG,UAAU,OAAO,IAAI,GAAG,CAAC,GAAG,EAAE,IAAI,KAAK;AAC/F,WAAO,EAAE;AAAA,EACb;AAAA;AAAA,EAGA,MAAM,IAAI,KAA+B;AACrC,UAAM,IAAI,MAAM,KAAK,UAAU,IAA0B,GAAG,UAAU,OAAO,IAAI,GAAG,CAAC,EAAE;AACvF,WAAO,EAAE;AAAA,EACb;AAAA;AAAA,EAGA,MAAM,OAAO,KAAa,KAAsC;AAC5D,UAAM,IAAI,MAAM,KAAK,UAAU,KAA2B,GAAG,UAAU,WAAW,IAAI,GAAG,CAAC,IAAI;AAAA,MAC1F;AAAA,IACJ,CAAC;AACD,WAAO,EAAE;AAAA,EACb;AAAA;AAAA;AAAA,EAKA,MAAM,KAAK,KAAa,QAAkD;AACtE,UAAM,IAAI,MAAM,KAAK,UAAU,KAA0B,GAAG,UAAU,SAAS,IAAI,GAAG,CAAC,IAAI;AAAA,MACvF;AAAA,IACJ,CAAC;AACD,WAAO,EAAE;AAAA,EACb;AAAA;AAAA,EAGA,MAAM,QAAqC,KAAgC;AACvE,QAAI;AACA,YAAM,IAAI,MAAM,KAAK,UAAU,IAAkB,GAAG,UAAU,YAAY,IAAI,GAAG,CAAC,EAAE;AACpF,aAAO,EAAE;AAAA,IACb,SAAS,KAAK;AACV,aAAO,OAAiB,KAAK,IAAI;AAAA,IACrC;AAAA,EACJ;AAAA;AAAA;AAAA,EAKA,MAAM,KAAK,QAAgB,SAAoC;AAC3D,UAAM,IAAI,MAAM,KAAK,UAAU,KAAwB,GAAG,UAAU,SAAS,IAAI,GAAG,CAAC,IAAI;AAAA,MACrF;AAAA,IACJ,CAAC;AACD,WAAO,EAAE;AAAA,EACb;AAAA;AAAA,EAGA,MAAM,SAAS,KAAgC;AAC3C,QAAI;AACA,YAAM,IAAI,MAAM,KAAK,UAAU;AAAA,QAC3B,GAAG,UAAU,aAAa,IAAI,GAAG,CAAC;AAAA,MACtC;AACA,aAAO,EAAE,SAAS,CAAC;AAAA,IACvB,SAAS,KAAK;AACV,aAAO,OAAiB,KAAK,CAAC,CAAC;AAAA,IACnC;AAAA,EACJ;AAAA;AAAA,EAGA,MAAM,KAAK,QAAgB,SAAoC;AAC3D,UAAM,IAAI,MAAM,KAAK,UAAU,KAA0B,GAAG,UAAU,SAAS,IAAI,GAAG,CAAC,IAAI;AAAA,MACvF;AAAA,IACJ,CAAC;AACD,WAAO,EAAE;AAAA,EACb;AACJ;AAEO,SAAS,YAAY,WAAmC;AAC3D,SAAO,IAAI,YAAY,SAAS;AACpC;;;AC1GA,IAAM,UAAU;AAChB,IAAM,eAAe;AAYd,IAAM,aAAN,MAAiB;AAAA,EACpB,YACqB,WACA,WACnB;AAFmB;AACA;AAAA,EAClB;AAAA,EAEH,MAAc,IAAO,WAAmB,SAA8B;AAClE,UAAM,MAAM,MAAM,KAAK,UAAU,KAAoB,SAAS;AAAA,MAC1D;AAAA,MACA,WAAW,KAAK;AAAA,MAChB;AAAA,IACJ,CAAC;AACD,WAAO,IAAI;AAAA,EACf;AAAA;AAAA,EAGA,KAAkC,UAAwB,CAAC,GAAiB;AACxE,WAAO,KAAK,IAAS,QAAQ,OAAO;AAAA,EACxC;AAAA;AAAA,EAGA,SAAsC,UAAwB,CAAC,GAAiB;AAC5E,WAAO,KAAK,IAAS,YAAY,OAAO;AAAA,EAC5C;AAAA;AAAA,EAGA,UAAuC,UAAwB,CAAC,GAAsB;AAClF,WAAO,KAAK,IAAc,aAAa,OAAO;AAAA,EAClD;AAAA;AAAA,EAGA,QAAqC,UAAwB,CAAC,GAAsB;AAChF,WAAO,KAAK,IAAc,WAAW,OAAO;AAAA,EAChD;AAAA;AAAA;AAAA,EAIA,OAAO,MAAyD;AAC5D,WAAO,KAAK,IAAqB,UAAU,EAAE,KAAK,CAAC;AAAA,EACvD;AAAA;AAAA,EAGA,OAAO,OAAgD;AACnD,WAAO,KAAK,IAAuB,UAAU,EAAE,OAAO,MAAM,OAAO,MAAM,MAAM,KAAK,CAAC;AAAA,EACzF;AAAA;AAAA,EAGA,OAAO,OAAgD;AACnD,WAAO,KAAK,IAAuB,UAAU,EAAE,OAAO,MAAM,MAAM,CAAC;AAAA,EACvE;AAAA;AAAA,EAGA,MAAM,UAAuC,CAAC,GAAoB;AAC9D,WAAO,KAAK,IAAY,SAAS,OAAO;AAAA,EAC5C;AACJ;AAcO,SAAS,SAAS,WAAgC;AACrD,QAAM,QAAQ,CAAC,cAAkC,IAAI,WAAW,WAAW,SAAS;AACpF,QAAM,UAAU,CAAC,UACb,UAAU,KAAoB,cAAc,EAAE,KAAK,MAAM,IAAI,CAAC;AAElE,SAAO,IAAI,MAAM,OAAO;AAAA,IACpB,IAAI,QAAQ,MAAM,UAAU;AACxB,UAAI,SAAS,UAAW,QAAO;AAG/B,UAAI,OAAO,SAAS,YAAY,SAAS,UAAU,QAAQ,QAAQ;AAC/D,eAAO,QAAQ,IAAI,QAAQ,MAAM,QAAQ;AAAA,MAC7C;AACA,aAAO,IAAI,WAAW,WAAW,IAAI;AAAA,IACzC;AAAA,IACA,MAAM,SAAS,UAAU,MAAgB;AACrC,aAAO,MAAM,KAAK,CAAC,CAAC;AAAA,IACxB;AAAA,EACJ,CAAC;AACL;;;AC3GA,IAAM,gBAAgB;AAkBf,IAAM,cAAN,MAAkB;AAAA,EACrB,YAA6B,WAAsB;AAAtB;AAAA,EAAuB;AAAA;AAAA,EAGpD,UAAU,OAA2D;AACjE,WAAO,KAAK,UAAU,KAAsB,GAAG,aAAa,UAAU;AAAA,MAClE,UAAU,MAAM;AAAA,MAChB,UAAU,MAAM;AAAA,MAChB,KAAK,MAAM;AAAA,IACf,CAAC;AAAA,EACL;AAAA;AAAA,EAGA,MAAM,QAAQ,SAAiB,SAAmC;AAC9D,UAAM,IAAI,MAAM,KAAK,UAAU,KAA4B,GAAG,aAAa,YAAY;AAAA,MACnF;AAAA,MACA;AAAA,IACJ,CAAC;AACD,WAAO,EAAE;AAAA,EACb;AAAA;AAAA,EAGA,MAAM,SAAS,SAAoD;AAC/D,UAAM,IAAI,MAAM,KAAK,UAAU;AAAA,MAC3B,GAAG,aAAa,aAAa,mBAAmB,OAAO,CAAC;AAAA,IAC5D;AACA,WAAO,EAAE,YAAY,CAAC;AAAA,EAC1B;AACJ;AAEO,SAAS,eAAe,WAAmC;AAC9D,SAAO,IAAI,YAAY,SAAS;AACpC;;;AC1CA,IAAM,eAAe;AAErB,IAAM,uBAAuB;AAG7B,SAAS,OAAO,MAAkB,aAA2B;AACzD,MAAI,gBAAgB,KAAM,QAAO;AACjC,MAAI,OAAO,SAAS,SAAU,QAAO,IAAI,KAAK,CAAC,IAAI,GAAG,EAAE,MAAM,YAAY,CAAC;AAC3E,MAAI,gBAAgB,YAAa,QAAO,IAAI,KAAK,CAAC,IAAI,GAAG,EAAE,MAAM,YAAY,CAAC;AAC9E,MAAI,YAAY,OAAO,IAAI,GAAG;AAC1B,WAAO,IAAI,KAAK,CAAC,IAA2B,GAAG,EAAE,MAAM,YAAY,CAAC;AAAA,EACxE;AACA,QAAM,IAAI,UAAU,4DAA4D;AACpF;AAEA,SAAS,SAAS,MAAsB;AACpC,SAAO,KAAK,MAAM,GAAG,EAAE,OAAO,OAAO,EAAE,IAAI,KAAK;AACpD;AAGO,IAAM,eAAN,MAAmB;AAAA,EACtB,YACuB,WACA,QACrB;AAFqB;AACA;AAAA,EACpB;AAAA,EAEO,GAAM,WAAmB,SAAkC,CAAC,GAAe;AACjF,WAAO,KAAK,UAAU,KAAQ,cAAc,EAAE,WAAW,QAAQ,KAAK,QAAQ,GAAG,OAAO,CAAC;AAAA,EAC7F;AAAA;AAAA,EAGA,KAAK,QAAsC;AACvC,WAAO,KAAK,GAAe,QAAQ,EAAE,OAAO,CAAC;AAAA,EACjD;AAAA;AAAA,EAGA,OAAO,OAA+C;AAClD,WAAO,KAAK,GAAwB,UAAU,EAAE,MAAM,CAAC;AAAA,EAC3D;AAAA;AAAA,EAGA,KAAK,MAAc,IAAgD;AAC/D,WAAO,KAAK,GAA8B,QAAQ,EAAE,MAAM,GAAG,CAAC;AAAA,EAClE;AAAA,EAEA,aAAa,MAA4C;AACrD,WAAO,KAAK,GAAwB,gBAAgB,EAAE,KAAK,CAAC;AAAA,EAChE;AAAA;AAAA,EAGA,SAAS,MAAuC;AAC5C,WAAO,KAAK,GAAmB,YAAY,EAAE,KAAK,CAAC;AAAA,EACvD;AAAA;AAAA,EAGA,gBAAgB,MAAc,WAAiD;AAC3E,WAAO,KAAK,GAAuB,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAAA,EAC7E;AAAA;AAAA,EAGA,cAAc,MAAc,aAA8C;AACtE,WAAO,KAAK,GAAkB,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAAA,EACxE;AAAA;AAAA;AAAA,EAIA,OACI,MACA,MACA,cAAsB,sBACY;AAClC,UAAM,OAAO,IAAI,SAAS;AAC1B,SAAK,OAAO,QAAQ,OAAO,MAAM,WAAW,GAAG,SAAS,IAAI,CAAC;AAC7D,SAAK,OAAO,UAAU,KAAK,MAAM;AACjC,SAAK,OAAO,QAAQ,IAAI;AACxB,SAAK,OAAO,eAAe,WAAW;AACtC,WAAO,KAAK,UAAU,UAAqC,cAAc,IAAI;AAAA,EACjF;AACJ;AAGO,IAAM,qBAAN,cAAiC,aAAa;AAAA,EACjD,YAAY,WAAsB;AAC9B,UAAM,WAAW,QAAQ;AAAA,EAC7B;AAAA;AAAA,EAGA,OAAO,MAAwC;AAC3C,WAAO,KAAK,GAAoB,UAAU,EAAE,KAAK,CAAC;AAAA,EACtD;AACJ;AAOO,SAAS,cAAc,WAAqC;AAC/D,SAAO;AAAA,IACH,QAAQ,IAAI,mBAAmB,SAAS;AAAA,IACxC,SAAS,IAAI,aAAa,WAAW,SAAS;AAAA,EAClD;AACJ;;;AC5GO,IAAM,qBAAqB;AA0B3B,IAAM,YAAN,MAAgB;AAAA,EACnB,YAA6B,QAAyB;AAAzB;AAAA,EAA0B;AAAA,EAE/C,QAAQ,MAA+C;AAC3D,UAAM,UAAkC,CAAC;AACzC,QAAI,KAAK,OAAO,OAAQ,SAAQ,eAAe,IAAI,UAAU,KAAK,OAAO,MAAM;AAC/E,QAAI,MAAM,YAAa,SAAQ,gBAAgB,IAAI,KAAK;AACxD,WAAO;AAAA,EACX;AAAA,EAEQ,IAAI,MAAsB;AAC9B,WAAO,GAAG,KAAK,OAAO,OAAO,GAAG,IAAI;AAAA,EACxC;AAAA,EAEQ,QAAQ,MAA+B;AAC3C,UAAM,QAAQ,MAAM,aAAa,KAAK,OAAO,aAAa;AAC1D,WAAO,QAAQ,IAAI,QAAQ;AAAA,EAC/B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAc,KAAK,MAAc,MAAmB,MAA0C;AAC1F,UAAM,YAAY,KAAK,QAAQ,IAAI;AACnC,UAAM,aAAa,YAAY,IAAI,IAAI,gBAAgB,IAAI;AAC3D,UAAM,QAAQ,aAAa,WAAW,MAAM,WAAW,MAAM,GAAG,SAAS,IAAI;AAC7E,QAAI;AACA,aAAO,MAAM,MAAM,KAAK,IAAI,IAAI,GAAG,EAAE,GAAG,MAAM,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC9E,SAAS,KAAK;AACV,UAAI,YAAY,OAAO,SAAS;AAC5B,cAAM,IAAI,cAAc,KAAK;AAAA,UACzB,OAAO,cAAc,IAAI,oBAAoB,SAAS;AAAA,UACtD,MAAM;AAAA,QACV,CAAC;AAAA,MACL;AACA,YAAM,IAAI,cAAc,GAAG;AAAA,QACvB,OAAO,eAAe,QAAQ,IAAI,UAAU;AAAA,QAC5C,MAAM;AAAA,MACV,CAAC;AAAA,IACL,UAAE;AACE,UAAI,MAAO,cAAa,KAAK;AAAA,IACjC;AAAA,EACJ;AAAA;AAAA,EAGA,MAAM,IAAO,MAAc,MAAmC;AAC1D,UAAM,MAAM,MAAM,KAAK,KAAK,MAAM,EAAE,QAAQ,OAAO,SAAS,KAAK,QAAQ,IAAI,EAAE,GAAG,IAAI;AACtF,WAAO,KAAK,MAAS,GAAG;AAAA,EAC5B;AAAA;AAAA,EAGA,MAAM,KAAQ,MAAc,MAAgB,MAAmC;AAC3E,UAAM,MAAM,MAAM,KAAK;AAAA,MACnB;AAAA,MACA;AAAA,QACI,QAAQ;AAAA,QACR,SAAS,EAAE,GAAG,KAAK,QAAQ,IAAI,GAAG,gBAAgB,mBAAmB;AAAA,QACrE,MAAM,KAAK,UAAU,QAAQ,CAAC,CAAC;AAAA,MACnC;AAAA,MACA;AAAA,IACJ;AACA,WAAO,KAAK,MAAS,GAAG;AAAA,EAC5B;AAAA;AAAA,EAGA,MAAM,IAAO,MAAc,MAAgB,MAAmC;AAC1E,UAAM,MAAM,MAAM,KAAK;AAAA,MACnB;AAAA,MACA;AAAA,QACI,QAAQ;AAAA,QACR,SAAS,EAAE,GAAG,KAAK,QAAQ,IAAI,GAAG,gBAAgB,mBAAmB;AAAA,QACrE,MAAM,KAAK,UAAU,QAAQ,IAAI;AAAA,MACrC;AAAA,MACA;AAAA,IACJ;AACA,WAAO,KAAK,MAAS,GAAG;AAAA,EAC5B;AAAA;AAAA,EAGA,MAAM,IAAO,MAAc,MAAmC;AAC1D,UAAM,MAAM,MAAM,KAAK,KAAK,MAAM,EAAE,QAAQ,UAAU,SAAS,KAAK,QAAQ,IAAI,EAAE,GAAG,IAAI;AACzF,WAAO,KAAK,MAAS,GAAG;AAAA,EAC5B;AAAA;AAAA,EAGA,MAAM,UAAa,MAAc,MAAgB,MAAmC;AAChF,UAAM,MAAM,MAAM,KAAK,KAAK,MAAM,EAAE,QAAQ,OAAO,SAAS,KAAK,QAAQ,IAAI,GAAG,MAAM,KAAK,GAAG,IAAI;AAClG,WAAO,KAAK,MAAS,GAAG;AAAA,EAC5B;AAAA,EAEA,MAAc,MAAS,KAA2B;AAC9C,UAAM,MAAM,MAAM,IAAI,KAAK;AAC3B,QAAI,OAAgB;AACpB,QAAI,KAAK;AACL,UAAI;AACA,eAAO,KAAK,MAAM,GAAG;AAAA,MACzB,QAAQ;AACJ,eAAO,EAAE,OAAO,IAAI;AAAA,MACxB;AAAA,IACJ;AACA,QAAI,CAAC,IAAI,IAAI;AACT,YAAM,OACF,QAAQ,OAAO,SAAS,WACjB,OACD,EAAE,OAAO,IAAI,cAAc,iBAAiB;AACtD,YAAM,IAAI,cAAc,IAAI,QAAQ,IAAI;AAAA,IAC5C;AACA,WAAO;AAAA,EACX;AACJ;;;ACxIA,IAAM,mBAAmB;AA2BzB,SAAS,QAAQ,MAAkC;AAC/C,MAAI,OAAO,YAAY,eAAe,CAAC,QAAQ,IAAK,QAAO;AAC3D,SAAO,QAAQ,IAAI,IAAI;AAC3B;AAaO,SAAS,SAAS,UAAiC,CAAC,GAAmB;AAC1E,QAAM,SAAS,QAAQ,UAAU,QAAQ,kBAAkB;AAC3D,QAAM,WAAW,QAAQ,WAAW,QAAQ,kBAAkB,KAAK,kBAAkB;AAAA,IACjF;AAAA,IACA;AAAA,EACJ;AAEA,QAAM,YAAY,IAAI,UAAU,EAAE,QAAQ,SAAS,WAAW,QAAQ,UAAU,CAAC;AAEjF,SAAO;AAAA,IACH,MAAM,IAAI,QAAQ,WAAW,QAAQ,OAAO;AAAA,IAC5C,IAAI,SAAS,SAAS;AAAA,IACtB,SAAS,cAAc,SAAS;AAAA,IAChC,OAAO,YAAY,SAAS;AAAA,IAC5B,UAAU,eAAe,SAAS;AAAA,EACtC;AACJ;","names":[]}

package/dist/cli.cjs

@@ -161,6 +161,24 @@ var Transport = class {
     );
     return this.parse(res);
   }
+  /** PUT a JSON body and parse the JSON response. */
+  async put(path, body, opts) {
+    const res = await this.send(
+      path,
+      {
+        method: "PUT",
+        headers: { ...this.headers(opts), "Content-Type": "application/json" },
+        body: JSON.stringify(body ?? null)
+      },
+      opts
+    );
+    return this.parse(res);
+  }
+  /** DELETE and parse the JSON response. */
+  async del(path, opts) {
+    const res = await this.send(path, { method: "DELETE", headers: this.headers(opts) }, opts);
+    return this.parse(res);
+  }
   /** PUT a multipart form (file uploads). The runtime sets the boundary. */
   async multipart(path, form, opts) {
     const res = await this.send(path, { method: "PUT", headers: this.headers(opts), body: form }, opts);
@@ -516,6 +534,96 @@ var AuthApi = class {
   }
 };
 
+// src/cache.ts
+var CACHE_PATH = "/api/v1/cache";
+var enc = (key) => encodeURIComponent(key);
+function asMiss(err, fallback) {
+  if (isDontCodeError(err) && err.status === 404) return fallback;
+  throw err;
+}
+var CacheClient = class {
+  constructor(transport) {
+    this.transport = transport;
+  }
+  /** Read a value. Returns `null` on a miss or expiry. */
+  async get(key) {
+    try {
+      const r = await this.transport.get(`${CACHE_PATH}/kv/${enc(key)}`);
+      return r.value;
+    } catch (err) {
+      return asMiss(err, null);
+    }
+  }
+  /** Set a value, optionally with a TTL (seconds) or set-if-absent (`nx`).
+   *  Returns `false` when `nx` is set and the key already existed. */
+  async set(key, value, options = {}) {
+    const params = new URLSearchParams();
+    if (options.ttl != null) params.set("ttl", String(options.ttl));
+    if (options.nx) params.set("nx", "true");
+    const qs = params.toString() ? `?${params}` : "";
+    const r = await this.transport.put(`${CACHE_PATH}/kv/${enc(key)}${qs}`, value);
+    return r.set;
+  }
+  /** Delete a key. Returns whether it existed. */
+  async del(key) {
+    const r = await this.transport.del(`${CACHE_PATH}/kv/${enc(key)}`);
+    return r.deleted;
+  }
+  /** Set or clear (`null`) the TTL on an existing key. Returns `false` if absent. */
+  async expire(key, ttl) {
+    const r = await this.transport.json(`${CACHE_PATH}/expire/${enc(key)}`, {
+      ttl
+    });
+    return r.applied;
+  }
+  // --- hashes -------------------------------------------------------------
+  /** Set fields on a hash. Returns the number of fields written. */
+  async hset(key, fields) {
+    const r = await this.transport.json(`${CACHE_PATH}/hset/${enc(key)}`, {
+      fields
+    });
+    return r.written;
+  }
+  /** Read a whole hash. Returns `null` on a miss. */
+  async hgetAll(key) {
+    try {
+      const r = await this.transport.get(`${CACHE_PATH}/hgetall/${enc(key)}`);
+      return r.value;
+    } catch (err) {
+      return asMiss(err, null);
+    }
+  }
+  // --- sets ---------------------------------------------------------------
+  /** Add members to a set. Returns the number newly added. */
+  async sAdd(key, ...members) {
+    const r = await this.transport.json(`${CACHE_PATH}/sadd/${enc(key)}`, {
+      members
+    });
+    return r.added;
+  }
+  /** List set members. Returns `[]` on a miss. */
+  async sMembers(key) {
+    try {
+      const r = await this.transport.get(
+        `${CACHE_PATH}/smembers/${enc(key)}`
+      );
+      return r.value ?? [];
+    } catch (err) {
+      return asMiss(err, []);
+    }
+  }
+  /** Remove members from a set. Returns the number removed. */
+  async sRem(key, ...members) {
+    const r = await this.transport.json(`${CACHE_PATH}/srem/${enc(key)}`, {
+      members
+    });
+    return r.removed;
+  }
+};
+function createCache(transport) {
+  return new CacheClient(transport);
+}
+
 // src/db.ts
 var DB_PATH = "/api/v1/db";
 var MIGRATE_PATH = "/api/v1/db/migrate";
@@ -583,6 +691,40 @@ function createDb(transport) {
   });
 }
 
+// src/realtime.ts
+var REALTIME_PATH = "/api/v1/realtime";
+var RealtimeApi = class {
+  constructor(transport) {
+    this.transport = transport;
+  }
+  /** Mint a short-lived, channel-scoped connection token for a browser. */
+  mintToken(input) {
+    return this.transport.json(`${REALTIME_PATH}/token`, {
+      channels: input.channels,
+      identity: input.identity,
+      ttl: input.ttl
+    });
+  }
+  /** Publish a message to a channel. Returns how many subscribers it reached. */
+  async publish(channel, payload) {
+    const r = await this.transport.json(`${REALTIME_PATH}/publish`, {
+      channel,
+      payload
+    });
+    return r.delivered;
+  }
+  /** Who is currently connected to a channel. */
+  async presence(channel) {
+    const r = await this.transport.get(
+      `${REALTIME_PATH}/channels/${encodeURIComponent(channel)}/presence`
+    );
+    return r.presence ?? [];
+  }
+};
+function createRealtime(transport) {
+  return new RealtimeApi(transport);
+}
+
 // src/storage.ts
 var STORAGE_PATH = "/api/v1/storage";
 var DEFAULT_CONTENT_TYPE = "application/octet-stream";
@@ -676,7 +818,9 @@ function dontcode(options = {}) {
   return {
     auth: new AuthApi(transport, options.session),
     db: createDb(transport),
-    storage: createStorage(transport)
+    storage: createStorage(transport),
+    cache: createCache(transport),
+    realtime: createRealtime(transport)
   };
 }