@fenaura/sdk 0.2.2 → 0.2.3

package/bin/init.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// npx @fenaura/auth-init — run from your frontend folder.
+// npx @fenaura/auth-init - run from your frontend folder.
 // Writes the /fenaura/* proxy files your host needs. Idempotent.
 const fs = require('fs');
 const path = require('path');
@@ -17,7 +17,7 @@ async function confirmRoot() {
   const answer = await new Promise((resolve) => rl.question(`No package.json here. Is this your frontend root? (${cwd}) [Y/n] `, resolve));
   rl.close();
   if (!/^(y|yes)?\s*$/i.test(answer || '')) {
-    console.error('Aborted — cd into your frontend folder first, then re-run.');
+    console.error('Aborted - cd into your frontend folder first, then re-run.');
     process.exit(1);
   }
 }
@@ -87,7 +87,7 @@ async function main() {
     const vp = path.join(cwd, viteCfg);
     let src = fs.readFileSync(vp, 'utf8');
     if (src.includes('/fenaura')) {
-      // already has proxy — correct it if API mismatched (tampered)
+      // already has proxy - correct it if API mismatched (tampered)
       if (src.includes(API)) {
         report.push(`kept  ${viteCfg} (proxy already present)`);
       } else {
@@ -98,26 +98,26 @@ async function main() {
         report.push(`fixed ${viteCfg} (corrected tampered API target → ${API})`);
       }
     } else if (/server\s*:\s*\{[^}]*proxy\s*:/.test(src)) {
-      // server.proxy exists — append our entry inside it
+      // server.proxy exists - append our entry inside it
       src = src.replace(/(proxy\s*:\s*\{)/, `$1\n      ${PROXY_BLOCK},`);
       fs.writeFileSync(vp, src);
       report.push(`wrote ${viteCfg} (appended to server.proxy)`);
     } else if (/defineConfig\(\s*\{/.test(src)) {
-      // no server key — add one
+      // no server key - add one
       src = src.replace(/(defineConfig\(\s*\{)/, `$1\n  server: {\n    proxy: {\n      ${PROXY_BLOCK},\n    },\n  },`);
       fs.writeFileSync(vp, src);
       report.push(`wrote ${viteCfg} (added server.proxy)`);
     } else {
-      report.push(`${viteCfg} has no defineConfig({...) — add manually:`);
+      report.push(`${viteCfg} has no defineConfig({...) - add manually:`);
       report.push(`  ${PROXY_BLOCK}`);
     }
   } else if (nextCfg) {
-    report.push('next detected — rewrites() needs an async function; add manually:');
+    report.push('next detected - rewrites() needs an async function; add manually:');
     report.push(`  { source: '/fenaura/:path*', destination: '${API}/:path*' }`);
   } else if (fallbackVite) {
     // SvelteKit / Astro / Nuxt: they all proxy via vite underneath, but config shape varies
     // For these, ensure public/_redirects covers prod and print the vite snippet for dev
-    report.push(`${fallbackVite} detected (vite-based) — add to vite server.proxy for dev:`);
+    report.push(`${fallbackVite} detected (vite-based) - add to vite server.proxy for dev:`);
     report.push(`  ${PROXY_BLOCK}`);
     report.push('  (public/_redirects already covers prod)');
   } else {
@@ -142,7 +142,7 @@ async function main() {
     } else {
       proxy.enable = true;
       proxy.baseUri = '/fenaura';
-      // Via local nginx (:3000), which strips /fenaura — Live Server can't rewrite paths itself.
+      // Via local nginx (:3000), which strips /fenaura - Live Server can't rewrite paths itself.
       proxy.proxyUri = 'http://localhost:3000/fenaura';
       fs.mkdirSync(vsDir, { recursive: true });
       fs.writeFileSync(vsPath, JSON.stringify(settings, null, 2) + '\n');
@@ -151,9 +151,9 @@ async function main() {
   }
 
   const wroteAny = report.some(r => r.startsWith('wrote') || r.startsWith('fixed'));
-  console.log('\n' + (wroteAny ? '✓ Fenaura auth proxy setup — done' : '✓ Fenaura auth proxy setup — already configured') + '\n' + report.map((r) => '  ' + r).join('\n'));
-  if (wroteAny) console.log('\n  → You should see "wrote public/_redirects" and "wrote vercel.json" above (or "fixed …" if a tampered file was corrected). If you see "kept … (already present)" it was already configured — you are good to go.');
-  else console.log('\n  → Nothing to write — proxy files were already present. You are good to go.');
+  console.log('\n' + (wroteAny ? '✓ Fenaura auth proxy setup - done' : '✓ Fenaura auth proxy setup - already configured') + '\n' + report.map((r) => '  ' + r).join('\n'));
+  if (wroteAny) console.log('\n  → You should see "wrote public/_redirects" and "wrote vercel.json" above (or "fixed …" if a tampered file was corrected). If you see "kept … (already present)" it was already configured - you are good to go.');
+  else console.log('\n  → Nothing to write - proxy files were already present. You are good to go.');
   console.log('\nFrontend calls (copy-paste, project ID from dashboard):');
   console.log("  fetch('/fenaura/auth/dp/login', { method: 'POST', headers: { 'Content-Type': 'application/json' }, credentials: 'include', body: JSON.stringify({ email, password, project_id: '<PROJECT_ID>' }) })");
 
@@ -185,13 +185,13 @@ async function main() {
     const deps = { ...(pkg.dependencies || {}), ...(pkg.devDependencies || {}) };
     const hasSdk = deps['@fenaura/client'] || deps['@fenaura/sdk'] || deps['fenaura'];
     if (!hasSdk) {
-      console.log('\n  → SDK not in package.json — installing @fenaura/sdk ...');
+      console.log('\n  → SDK not in package.json - installing @fenaura/sdk ...');
       const { spawnSync } = require('child_process');
       const res = spawnSync('npm', ['install', '@fenaura/sdk', '--save'], { stdio: 'inherit', cwd });
-      if (res.status !== 0) console.log('  (auto-install failed — run: npm install @fenaura/sdk)');
+      if (res.status !== 0) console.log('  (auto-install failed - run: npm install @fenaura/sdk)');
       else console.log('  ✓ @fenaura/client installed');
     }
-  } catch { /* no package.json or parse fail — skip auto-install */ }
+  } catch { /* no package.json or parse fail - skip auto-install */ }
 
   // 6. Detect how the dev server is running + print next steps.
   const net = require('net');
@@ -213,10 +213,10 @@ async function main() {
     }
     console.log('\nNext steps:');
     console.log(`  1. Start dev: ${startCmd}   (detected stack: ${stack})`);
-    console.log(`  2. Open the page (local ports answering now: ${open.length ? open.join(', ') : 'none yet — start the server first'})`);
-    console.log('  3. Click login — expect session_minted + a fenaura_eusid_* cookie on YOUR domain (devtools → Application → Cookies).');
+    console.log(`  2. Open the page (local ports answering now: ${open.length ? open.join(', ') : 'none yet - start the server first'})`);
+    console.log('  3. Click login - expect session_minted + a fenaura_eusid_* cookie on YOUR domain (devtools → Application → Cookies).');
     console.log('  4. Public URL test: forward the dev port in VS Code (Ports → Public, protocol http) and open the tunnel link.');
-    console.log('  5. Deploy: the _redirects/vercel.json files proxy /fenaura/* in prod — no code changes.\n');
+    console.log('  5. Deploy: the _redirects/vercel.json files proxy /fenaura/* in prod - no code changes.\n');
   })();
 
 }

package/js/fenaura-client.d.ts

@@ -157,7 +157,7 @@ interface CompressResult {
   mode: string;
   originalSize: number;
   compressedSize: number;
-  /** Real MIME of `file` — never assumed, always the produced bytes' type */
+  /** Real MIME of `file` - never assumed, always the produced bytes' type */
   contentType: string;
 }
 
@@ -223,7 +223,7 @@ interface QueryBuilder<T = Record<string, any>> {
   select(columns?: string): QueryBuilder<T>;
   insert(data: T | T[]): Promise<QueryResult & { data: T[] }>;
   update(data: Partial<T>): QueryBuilder<T>;
-  /** Single object only — arrays are rejected 400 server-side. */
+  /** Single object only - arrays are rejected 400 server-side. */
   upsert(data: T): Promise<QueryResult & { data: T[] }>;
   delete(): QueryBuilder<T>;
 
@@ -311,7 +311,7 @@ interface StorageBucket {
   download(path: string): Promise<QueryResult & { data: Blob }>;
   list(path?: string, options?: ListOptions): Promise<QueryResult & { data: FileObject[] }>;
   remove(paths: string[]): Promise<QueryResult>;
-  /** Same-origin SESSION url (not public — GET needs the caller's cookie). Segments encoded. Outsiders: createSignedUrl. */
+  /** Same-origin SESSION url (not public - GET needs the caller's cookie). Segments encoded. Outsiders: createSignedUrl. */
   getPublicUrl(path: string): string;
   /** Real HMAC-signed expiring link (server-enforced, ≤7d). Anonymous fetches OK until exp. */
   createSignedUrl(path: string, expiresIn?: number): Promise<QueryResult & { data: { signedUrl: string } }>;

package/js/fenaura-client.js

@@ -19,7 +19,7 @@
  *   // Storage
  *   await db.storage.from('avatars').upload('user1.jpg', file)
  *
- *   // Storage with client-side compression (images shrink, text gzips —
+ *   // Storage with client-side compression (images shrink, text gzips -
  *   *   fewer bytes leave the device over the same chunked upload)
  *   await db.storage.from('avatars').upload('user1.jpg', file, {
  *     compress: { mode: 'auto', maxWidth: 1920, quality: 0.8, format: 'webp' },
@@ -337,7 +337,7 @@ class QueryBuilder {
   }
 
   /**
-   * Upsert data (insert or update) — single object only (D18: arrays are
+   * Upsert data (insert or update) - single object only (D18: arrays are
    * rejected 400 server-side; bulk upsert is insert-then-update instead).
    * @param {Object} data - Data to upsert
    * @returns {Promise<QueryResult>}
@@ -727,10 +727,10 @@ class AuthClient {
    * @param {Object} params
    * @param {string} params.email - Email address
    * @param {string} params.password - Password
-   * @param {Object} [options] - { browser=true } — browser:false returns the raw
+   * @param {Object} [options] - { browser=true } - browser:false returns the raw
    *   token in `data.token` (no cookie set) for non-web clients / backends.
    *   Store or forward it yourself. WARNING: a raw token in JS memory or
-   *   localStorage is readable by any script on the page — prefer the cookie
+   *   localStorage is readable by any script on the page - prefer the cookie
    *   flow in browsers, and never use browser:false on shared machines.
    * @returns {Promise<QueryResult>}
    */
@@ -749,7 +749,7 @@ class AuthClient {
    * @param {Object} params
    * @param {string} params.email - Email address
    * @param {string} params.password - Password
-   * @param {Object} [options] - { browser=true } — browser:false returns the raw
+   * @param {Object} [options] - { browser=true } - browser:false returns the raw
    *   token in `data.token` (no cookie set) for non-web clients / backends.
    * @returns {Promise<QueryResult>}
    */
@@ -785,7 +785,7 @@ class AuthClient {
    * Sign in with OAuth provider (Supabase-shaped, Fenaura transport).
    * Web (default): redirects the browser to the provider; session returns as
    * HttpOnly fenaura_eusid_* cookie (+ one-time ?code= for exchange).
-   * Non-web ({ browser:false }): no navigation — returns { data:{url} };
+   * Non-web ({ browser:false }): no navigation - returns { data:{url} };
    * open the URL in a system browser, then call exchangeCodeForSession(code)
    * with the ?code= your redirect_to (deep link) receives.
    * @param {string} provider - google|github|microsoft|apple|facebook|twitter|discord|linkedin|spotify|slack|gitlab|twitch
@@ -803,7 +803,7 @@ class AuthClient {
     if (redirectTo) q.set('redirect_to', redirectTo);
     if (scopes) q.set('scopes', scopes);
     if (queryParams && Object.keys(queryParams).length > 0) {
-      // Global AJV removeAdditional strips unknown query keys (server.ts) —
+      // Global AJV removeAdditional strips unknown query keys (server.ts) -
       // send extras as one JSON blob `qp`, server filters reserved keys.
       q.set('qp', JSON.stringify(queryParams));
     }
@@ -818,7 +818,7 @@ class AuthClient {
   /**
    * Exchange a one-time OAuth ?code= for the session (plan §12).
    * Web via /fenaura proxy: ALSO sets the first-party HttpOnly cookie.
-   * Non-web / backend: use `data.token` — store or forward it yourself
+   * Non-web / backend: use `data.token` - store or forward it yourself
    * (e.g. your backend sets it as a cookie for YOUR end users).
    * Codes are single-use, 60s TTL; replay → INVALID_CODE.
    * @param {string} code - one-time code from the callback redirect (?code=)
@@ -856,7 +856,7 @@ class AuthClient {
 
   /**
    * Send a password-reset code (account must exist; unknown addresses get a
-   * generic success without email — anti-enumeration).
+   * generic success without email - anti-enumeration).
    * @param {Object} params - { email }
    * @returns {Promise<QueryResult>} { data: { code_sent, email }, error }
    */
@@ -876,7 +876,7 @@ class AuthClient {
   }
 
   /**
-   * Send a magic-link (OTP) code — passwordless sign-in for existing accounts.
+   * Send a magic-link (OTP) code - passwordless sign-in for existing accounts.
    * @param {Object} params - { email }
    * @returns {Promise<QueryResult>} { data: { code_sent, email }, error }
    */
@@ -1025,7 +1025,7 @@ class StorageClient {
        * Upload a file in 1 MiB chunks, with live backend progress.
        * Flow: init → PUT each chunk (server answers received/total per
        * chunk) → complete (server assembles + sniffs content). A failed
-       * chunk is retried alone — never the whole file.
+       * chunk is retried alone - never the whole file.
        * @param {string} path - File path
        * @param {File|Blob} file - File to upload
        * @param {Object} [options] - Upload options
@@ -1045,7 +1045,7 @@ class StorageClient {
         if (!isPathSafe(path)) {
           throw new Error('Invalid path: directory traversal not allowed');
         }
-        // 0. compress — on-device; only the smaller bytes leave the device
+        // 0. compress - on-device; only the smaller bytes leave the device
         let source = file;
         let compression = null;
         if (options.compress !== undefined && options.compress !== false && options.compress !== null) {
@@ -1067,7 +1067,7 @@ class StorageClient {
         const creds = isProxy ? { credentials: 'include' } : {};
         const fail = (code, message, request_id = '') => ({ status: 'error', data: null, error: { code, message }, request_id });
 
-        // 1. init — server validates name/type/size and hands back an upload id
+        // 1. init - server validates name/type/size and hands back an upload id
         const initRes = await fetch(`${this._url}/api/v1/blob/${this._apiKey}/init`, {
           method: 'POST',
           headers: { 'Content-Type': 'application/json', ...authHeaders },
@@ -1093,7 +1093,7 @@ class StorageClient {
           }
         };
 
-        // 2. chunks — sequential 1 MiB PUTs; each response is the progress event
+        // 2. chunks - sequential 1 MiB PUTs; each response is the progress event
         for (let i = 0; i < chunks_total; i++) {
           const start = i * chunk_size;
           const end = Math.min(start + chunk_size, source.size);
@@ -1117,7 +1117,7 @@ class StorageClient {
           }
         }
 
-        // 3. complete — server assembles, verifies size + content, stores
+        // 3. complete - server assembles, verifies size + content, stores
         const doneRes = await fetch(`${this._url}/api/v1/blob/${this._apiKey}/complete/${upload_id}`, {
           method: 'POST',
           headers: { 'Content-Type': 'application/json', ...authHeaders },
@@ -1195,7 +1195,7 @@ class StorageClient {
       },
 
       /**
-       * Same-origin session URL (B15: NOT public despite the name — the GET
+       * Same-origin session URL (B15: NOT public despite the name - the GET
        * still requires the caller's session cookie; outsiders get 401. For
        * sharing with outsiders use createSignedUrl, which mints a real
        * HMAC-signed expiring link server-side).
@@ -1265,10 +1265,10 @@ class StorageClient {
 // Confirmed platform facts (researched 2026-09):
 // - CompressionStream gzip/deflate: Baseline, all browsers since May 2023.
 // - canvas.toBlob: PNG guaranteed; jpeg/webp widely supported BUT Safari may
-//   silently fall back to PNG when webp encode is missing — so we NEVER trust
+//   silently fall back to PNG when webp encode is missing - so we NEVER trust
 //   the requested mime; the reported contentType is always out.type.
 // - Video transcode (360p) needs WebCodecs + a muxer lib (WebCodecs emits raw
-//   packets, not a playable file) — intentionally NOT in core; see Phase 2.
+//   packets, not a playable file) - intentionally NOT in core; see Phase 2.
 
 const COMPRESS_MODES = new Set(['auto', 'image', 'gzip', 'deflate', 'deflate-raw', 'none']);
 const COMPRESS_IMAGE_FORMATS = new Set(['original', 'webp', 'jpeg', 'jpg', 'png']);
@@ -1356,7 +1356,7 @@ function requireBlob(file) {
 // Image path: decode → scale-to-fit (aspect preserved, never upscale) →
 // re-encode. Lossless (`lossless:true`) forces PNG. JPEG gets a white
 // backdrop (no alpha channel). Anti-corruption: decode/encode failures throw
-// and the caller keeps the original — we never return partial bytes.
+// and the caller keeps the original - we never return partial bytes.
 async function compressImageBlob(blob, o) {
   if (!canCompressImage()) {
     throw new Error('Image compression needs a browser (canvas/createImageBitmap unavailable)');
@@ -1366,7 +1366,7 @@ async function compressImageBlob(blob, o) {
   try {
     bitmap = await createImageBitmap(blob);
   } catch {
-    throw new Error('Could not decode image (unsupported or corrupt file — original kept)');
+    throw new Error('Could not decode image (unsupported or corrupt file - original kept)');
   }
   try {
     throwIfAborted(o.signal);
@@ -1377,7 +1377,7 @@ async function compressImageBlob(blob, o) {
     canvas.width = w;
     canvas.height = h;
     const ctx = canvas.getContext('2d');
-    if (!ctx) throw new Error('Canvas 2D unavailable — original kept');
+    if (!ctx) throw new Error('Canvas 2D unavailable - original kept');
     let mime;
     if (o.lossless) mime = 'image/png';
     else if (o.format === 'original') mime = (blob.type && blob.type.startsWith('image/')) ? blob.type : 'image/jpeg';
@@ -1391,7 +1391,7 @@ async function compressImageBlob(blob, o) {
     const q = (o.lossless || mime === 'image/png') ? undefined : o.quality;
     const out = await new Promise((resolve, reject) => {
       try {
-        canvas.toBlob(b => (b ? resolve(b) : reject(new Error('Image encode failed — original kept'))), mime, q);
+        canvas.toBlob(b => (b ? resolve(b) : reject(new Error('Image encode failed - original kept'))), mime, q);
       } catch (err) {
         reject(err);
       }
@@ -1425,7 +1425,7 @@ async function compressGzipBlob(blob, format, signal) {
     total += value.byteLength;
     if (total > COMPRESS_MAX_BYTES) {
       try { await reader.cancel(); } catch { /* noop */ }
-      throw new Error('Compressed output exceeds 500 MB cap — original kept');
+      throw new Error('Compressed output exceeds 500 MB cap - original kept');
     }
     chunks.push(value);
   }
@@ -1436,7 +1436,7 @@ async function compressGzipBlob(blob, format, signal) {
     off += c.byteLength;
   }
   const out = new Blob([merged], { type: 'application/gzip' });
-  if (!out.size) throw new Error('Compression produced empty output — original kept');
+  if (!out.size) throw new Error('Compression produced empty output - original kept');
   return out;
 }
 
@@ -1450,7 +1450,7 @@ async function compressGzipBlob(blob, format, signal) {
  *   preserved, never upscales), quality (0,1] default 0.8 (jpeg/webp only),
  *   format original|webp|jpeg|png, lossless:true forces PNG.
  * - 'gzip'|'deflate'|'deflate-raw': lossless, any file type. Output is
- *   `application/gzip` — decompress after download.
+ *   `application/gzip` - decompress after download.
  * - 'none': passthrough (no-op, still validates).
  *
  * Never corrupts: any decode/encode/stream failure throws and the original

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@fenaura/sdk",
-  "version": "0.2.2",
-  "description": "Fenaura Client SDK — direct database access, auth, and storage from the browser",
+  "version": "0.2.3",
+  "description": "Fenaura Client SDK - direct database access, auth, and storage from the browser",
   "main": "js/fenaura-client.js",
   "types": "js/fenaura-client.d.ts",
   "files": [