@everystack/api 0.2.2 → 0.2.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/api",
-  "version": "0.2.2",
+  "version": "0.2.4",
   "description": "PostgREST-compatible HTTP handler + typed fetch client for Drizzle ORM",
   "license": "AGPL-3.0-only",
   "publishConfig": {

package/src/client/index.ts

@@ -76,6 +76,8 @@ export interface QueryBuilder {
 
 export interface Client {
   from(table: string): QueryBuilder;
+  /** Call a named RPC on the handler: POST {baseUrl}/rpc/{fn}. */
+  rpc<T = unknown>(fn: string, body?: unknown): Promise<ClientResponse<T>>;
 }
 
 /**
@@ -89,6 +91,27 @@ export function createClient(options: ClientOptions): Client {
     from(table: string): QueryBuilder {
       return createQueryBuilder(options, table);
     },
+
+    async rpc<T = unknown>(fn: string, body?: unknown): Promise<ClientResponse<T>> {
+      const url = `${options.baseUrl}/rpc/${encodeURIComponent(fn)}`;
+      const headers = await buildHeaders(options);
+      headers['Content-Type'] = 'application/json';
+
+      const { response, retried } = await fetchWithRetry(
+        url,
+        { method: 'POST', headers, body: JSON.stringify(body ?? {}) },
+        options,
+      );
+
+      if (retried) return retried as ClientResponse<T>;
+
+      if (!response.ok) {
+        return { data: null, error: await parseError(response) };
+      }
+
+      const data = (await response.json()) as T;
+      return { data, error: null };
+    },
   };
 }
 

package/src/handler/index.ts

@@ -431,14 +431,12 @@ export function createHandler(db: DrizzleDb, schema: Schema, options?: HandlerOp
     //   1. Header-based (native/server): X-Client-Id + X-Client-Secret
     //   2. Referer-based (web): Referer or Origin header (no secrets in browser source)
     // The verifyClient callback receives all three and decides which path to validate.
-    // Skipped for publicRoutes methods (e.g. GET) and publicRpc functions — no credentials needed.
+    // Skipped for publicRoutes methods (e.g. GET) — no credentials needed.
+    // publicRpc skips JWT verification only, NOT client auth.
     let user: Record<string, unknown> | null = null;
     let client: Record<string, unknown> | null = null;
     const isPublicRoute = options?.auth?.publicRoutes?.includes(method) ?? false;
-    const isPublicRpc = pathSegments[0] === 'rpc'
-      && !!pathSegments[1]
-      && (options?.auth?.publicRpc?.includes(pathSegments[1]) ?? false);
-    if (options?.auth?.verifyClient && !isPublicRoute && !isPublicRpc) {
+    if (options?.auth?.verifyClient && !isPublicRoute) {
       const idHeader = options.auth.clientHeaders?.id ?? 'X-Client-Id';
       const secretHeader = options.auth.clientHeaders?.secret ?? 'X-Client-Secret';
       const clientId = request.headers.get(idHeader);