@giaeulate/baas-sdk 1.2.0 → 1.4.0

package/dist/index.cjs

@@ -30,14 +30,31 @@ module.exports = __toCommonJS(index_exports);
 var HttpClient = class {
   url;
   apiKey = "";
+  keyType;
   token = null;
+  refreshToken = null;
   environment = "prod";
   _onForceLogout = null;
-  constructor(url, apiKey) {
+  _refreshing = null;
+  constructor(url, apiKey, options) {
     let baseUrl = url || (typeof window !== "undefined" ? window.location.origin : "http://localhost:8080");
     this.url = baseUrl.endsWith("/") ? baseUrl.slice(0, -1) : baseUrl;
     if (apiKey) this.apiKey = apiKey;
-    this.token = this.cleanValue(localStorage.getItem("baas_token"));
+    this.keyType = options?.keyType ?? "service_role";
+    this.warnIfUnsafeKey();
+    this.token = typeof localStorage !== "undefined" ? this.cleanValue(localStorage.getItem("baas_token")) : null;
+    this.refreshToken = typeof localStorage !== "undefined" ? this.cleanValue(localStorage.getItem("baas_refresh_token")) : null;
+  }
+  /** SECURITY: a service_role key bypasses RLS and grants admin over every
+   *  tenant. If it ends up in a browser bundle, anyone can extract it. Warn
+   *  loudly when a non-anon key is constructed in a browser context. */
+  warnIfUnsafeKey() {
+    const inBrowser = typeof window !== "undefined" && typeof document !== "undefined";
+    if (inBrowser && this.apiKey && this.keyType !== "anon") {
+      console.warn(
+        '[baas-sdk] SECURITY WARNING: a non-anon (service_role) key is running in a browser. It bypasses Row-Level Security and grants admin over ALL tenants, and is extractable from the bundle. Mint an anon key in the dashboard and construct the client with { keyType: "anon" }.'
+      );
+    }
   }
   /**
    * Set the auth token manually (e.g. restoring from SecureStore in React Native).
@@ -45,12 +62,59 @@ var HttpClient = class {
    */
   setToken(token) {
     this.token = token;
+    if (typeof localStorage === "undefined") return;
     if (token) {
       localStorage.setItem("baas_token", token);
     } else {
       localStorage.removeItem("baas_token");
     }
   }
+  /** Persist the rotating refresh token (used by auto-refresh on 401). In the
+   *  browser the server also sets an HttpOnly `baas_refresh` cookie, so storing
+   *  it here is mainly for non-cookie clients (React Native). */
+  setRefreshToken(token) {
+    this.refreshToken = token;
+    if (typeof localStorage === "undefined") return;
+    if (token) {
+      localStorage.setItem("baas_refresh_token", token);
+    } else {
+      localStorage.removeItem("baas_refresh_token");
+    }
+  }
+  getRefreshToken() {
+    const ls = typeof localStorage !== "undefined" ? localStorage.getItem("baas_refresh_token") : null;
+    return this.cleanValue(this.refreshToken || ls);
+  }
+  /** Attempts a single token refresh, deduped across concurrent 401s. Sends the
+   *  stored refresh token (falls back to the HttpOnly cookie in browsers). */
+  tryRefresh() {
+    if (!this._refreshing) {
+      this._refreshing = this.doRefresh().finally(() => {
+        this._refreshing = null;
+      });
+    }
+    return this._refreshing;
+  }
+  async doRefresh() {
+    try {
+      const body = {};
+      const rt = this.getRefreshToken();
+      if (rt) body.refresh_token = rt;
+      const res = await fetch(`${this.url}/api/auth/refresh`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", apikey: this.apiKey },
+        credentials: "include",
+        body: JSON.stringify(body)
+      });
+      if (!res.ok) return false;
+      const data = await res.json().catch(() => null);
+      if (data?.token) this.setToken(data.token);
+      if (data?.refresh_token) this.setRefreshToken(data.refresh_token);
+      return Boolean(data?.token);
+    } catch {
+      return false;
+    }
+  }
   /**
    * Register a callback invoked on forced logout (401).
    * Use this in React Native instead of the default window.location redirect.
@@ -91,7 +155,7 @@ var HttpClient = class {
   /**
    * Core HTTP request method - DRY principle
    */
-  async request(endpoint, options = {}) {
+  async request(endpoint, options = {}, _isRetry = false) {
     const { method = "GET", body, headers: customHeaders, skipAuth = false } = options;
     const headers = { ...this.getHeaders(), ...customHeaders };
     const fetchOptions = {
@@ -109,12 +173,22 @@ var HttpClient = class {
     const data = await res.json().catch(() => null);
     if (!res.ok) {
       if (res.status === 401 && !skipAuth) {
+        if (!_isRetry && await this.tryRefresh()) {
+          return this.request(endpoint, options, true);
+        }
         this.forceLogout();
       }
       if (res.status === 403 && data?.error === "ip_not_allowed") {
         this.handleIPBlocked(data.ip);
       }
-      return { error: data?.error || `Request failed: ${res.status}`, ...data };
+      const rateLimited = res.status === 429;
+      const retryHint = res.headers.get("retry-after") || res.headers.get("x-ratelimit-reset");
+      return {
+        error: data?.error || `Request failed: ${res.status}`,
+        status: res.status,
+        ...rateLimited ? { rateLimited: true, retryAfter: retryHint ? parseInt(retryHint, 10) : void 0 } : {},
+        ...data
+      };
     }
     return data;
   }
@@ -146,7 +220,11 @@ var HttpClient = class {
   }
   logout() {
     this.token = null;
-    localStorage.removeItem("baas_token");
+    this.refreshToken = null;
+    if (typeof localStorage !== "undefined") {
+      localStorage.removeItem("baas_token");
+      localStorage.removeItem("baas_refresh_token");
+    }
   }
   forceLogout() {
     this.logout();
@@ -231,10 +309,49 @@ var QueryBuilder = class {
     this.queryParams.set(column, `not.${operator}.${value}`);
     return this;
   }
+  /** Array/jsonb/range contains (@>). Arrays become a `{a,b}` literal. */
+  contains(column, values) {
+    this.queryParams.set(column, `cs.${this.arrayLiteral(values)}`);
+    return this;
+  }
+  /** Array/jsonb/range contained-by (<@). */
+  containedBy(column, values) {
+    this.queryParams.set(column, `cd.${this.arrayLiteral(values)}`);
+    return this;
+  }
+  /** Array/range overlap (&&). */
+  overlaps(column, values) {
+    this.queryParams.set(column, `ov.${this.arrayLiteral(values)}`);
+    return this;
+  }
+  /** Full-text search (@@). type: fts|plfts|phfts|wfts (tsquery flavour). */
+  textSearch(column, query, type = "fts") {
+    this.queryParams.set(column, `${type}.${query}`);
+    return this;
+  }
+  arrayLiteral(values) {
+    return Array.isArray(values) ? `{${values.join(",")}}` : `${values}`;
+  }
+  /** OR group: `or=(c1,c2)`. Members are dotted `col.op.value` strings. */
   or(filters) {
     this.queryParams.set("or", `(${filters})`);
     return this;
   }
+  /** AND group: `and=(c1,c2)` — e.g. a range `qty.gt.5,qty.lt.20`. */
+  and(filters) {
+    this.queryParams.set("and", `(${filters})`);
+    return this;
+  }
+  /** Negated AND group: `not.and=(...)`. */
+  notAnd(filters) {
+    this.queryParams.set("not.and", `(${filters})`);
+    return this;
+  }
+  /** Negated OR group: `not.or=(...)`. */
+  notOr(filters) {
+    this.queryParams.set("not.or", `(${filters})`);
+    return this;
+  }
   order(column, { ascending = true } = {}) {
     this.queryParams.set("order", `${column}.${ascending ? "asc" : "desc"}`);
     return this;
@@ -278,6 +395,34 @@ var QueryBuilder = class {
     if (res.status === 204) return { success: true };
     return await this.handleResponse(res);
   }
+  /** Insert-or-update on conflict. [onConflict] is the conflict-target column(s). */
+  async upsert(data, onConflict) {
+    const res = await fetch(`${this.url}/api/v1/data/${this.table}/upsert`, {
+      method: "POST",
+      headers: this.getHeaders(),
+      body: JSON.stringify({ ...data, on_conflict: onConflict })
+    });
+    return await this.handleResponse(res);
+  }
+  /**
+   * Count rows matching the current filters (PostgREST parity). Sends
+   * `Prefer: count=exact` and parses the total from the `Content-Range`
+   * response header. Returns `{ count, error, status }`.
+   */
+  async count() {
+    const res = await fetch(`${this.url}/api/v1/data/${this.table}?${this.queryParams.toString()}`, {
+      headers: { ...this.getHeaders(), Prefer: "count=exact", "Cache-Control": "no-cache" },
+      cache: "no-store"
+    });
+    if (!res.ok) {
+      if (res.status === 401) this.client.forceLogout();
+      const body = await res.json().catch(() => null);
+      return { count: 0, error: body?.error || "Request failed", status: res.status };
+    }
+    const cr = res.headers.get("content-range");
+    const total = cr && cr.includes("/") ? parseInt(cr.split("/").pop() || "", 10) : NaN;
+    return { count: Number.isNaN(total) ? 0 : total, error: null, status: res.status };
+  }
   getHeaders() {
     return this.client.getHeaders();
   }
@@ -320,18 +465,65 @@ function createAuthModule(client) {
         throw new Error(data?.error || `Login failed: ${res.status}`);
       }
       if (data.token) {
-        client.token = data.token;
-        localStorage.setItem("baas_token", data.token);
+        client.setToken(data.token);
+      }
+      if (data.refresh_token) {
+        client.setRefreshToken(data.refresh_token);
       }
       return data;
     },
+    /** Manually refresh the access token via the rotating refresh token. The
+     *  HttpClient also does this automatically on a 401. */
+    async refresh() {
+      const rt = client.refreshToken;
+      const data = await post("/api/auth/refresh", rt ? { refresh_token: rt } : {});
+      if (data?.token) client.setToken(data.token);
+      if (data?.refresh_token) client.setRefreshToken(data.refresh_token);
+      return data;
+    },
     async logout() {
       try {
         await post("/api/logout");
       } finally {
-        client.token = null;
-        localStorage.removeItem("baas_token");
+        client.logout();
+      }
+    },
+    // Anonymous sign-in (Supabase parity). Response carries access_token (+ a
+    // back-compat `token`); store whichever is present.
+    async signInAnonymous() {
+      const data = await post("/api/auth/anonymous");
+      const tok = data?.access_token || data?.token;
+      if (tok) {
+        client.token = tok;
+        localStorage.setItem("baas_token", tok);
+      }
+      return data;
+    },
+    // Passwordless: request a magic link + 6-digit email OTP. Always resolves on
+    // a well-formed request (no account enumeration).
+    async requestOtp(email, createUser = true) {
+      return post("/api/auth/otp", { email, create_user: createUser });
+    },
+    // Verify a passwordless OTP/magic-link and complete sign-in.
+    async verifyOtp(type, email, token) {
+      const data = await post("/api/auth/verify", { type, email, token });
+      const tok = data?.access_token || data?.token;
+      if (tok) {
+        client.token = tok;
+        localStorage.setItem("baas_token", tok);
+      }
+      return data;
+    },
+    // Upgrade the current anonymous guest to a real account (preserves user id).
+    // Requires the anonymous Bearer to be set (call after signInAnonymous).
+    async upgradeAnonymous(email, password) {
+      const data = await post("/api/auth/upgrade", { email, password });
+      const tok = data?.access_token || data?.token;
+      if (tok) {
+        client.token = tok;
+        localStorage.setItem("baas_token", tok);
       }
+      return data;
     },
     async verifyMFA(mfaToken, code) {
       const data = await post("/api/mfa/finalize", { mfa_token: mfaToken, code });
@@ -530,6 +722,7 @@ function createDatabaseModule(client) {
 function createStorageModule(client) {
   const get = (endpoint) => client.get(endpoint);
   const post = (endpoint, body) => client.post(endpoint, body);
+  const put = (endpoint, body) => client.put(endpoint, body);
   const del = (endpoint) => client.delete(endpoint);
   async function uploadFile(fileOrTable, fileOrBucketId) {
     let file;
@@ -564,14 +757,24 @@ function createStorageModule(client) {
     async listFiles() {
       return get("/api/storage/files");
     },
-    async getFile(fileId) {
-      return get(`/api/storage/files/${fileId}`);
+    async getFile(fileId, expiresIn) {
+      const q = expiresIn && expiresIn > 0 ? `?expiresIn=${expiresIn}` : "";
+      return get(`/api/storage/files/${fileId}${q}`);
+    },
+    async createSignedUrl(fileId, expiresIn) {
+      const res = await get(
+        `/api/storage/files/${fileId}${expiresIn && expiresIn > 0 ? `?expiresIn=${expiresIn}` : ""}`
+      );
+      return { signedUrl: res?.url };
     },
     async deleteFile(fileId) {
       return del(`/api/storage/files/${fileId}`);
     },
-    async createBucket(name, isPublic = false) {
-      return post("/api/storage/buckets", { name, is_public: isPublic });
+    async createBucket(name, isPublic = false, maxBytes) {
+      return post("/api/storage/buckets", { name, is_public: isPublic, max_bytes: maxBytes });
+    },
+    async updateBucket(bucketId, opts) {
+      return put(`/api/storage/buckets/${bucketId}`, { is_public: opts.isPublic, max_bytes: opts.maxBytes });
     },
     async listBuckets() {
       return get("/api/storage/buckets");
@@ -584,6 +787,17 @@ function createStorageModule(client) {
     },
     async listBucketFiles(bucketId) {
       return get(`/api/storage/buckets/${bucketId}/files`);
+    },
+    async download(fileId) {
+      const res = await fetch(`${client.url}/api/storage/files/${fileId}/download`, {
+        headers: client.getHeaders("")
+      });
+      if (!res.ok) {
+        if (res.status === 401) client.forceLogout();
+        const err = await res.json().catch(() => ({ error: `Download failed: ${res.status}` }));
+        throw new Error(err.error ?? `Download failed: ${res.status}`);
+      }
+      return res.blob();
     }
   };
 }
@@ -684,7 +898,9 @@ function createFunctionsModule(client) {
       return del(`/api/functions/${id}`);
     },
     async update(id, code, options) {
-      return put(`/api/functions/${id}`, { code, ...options });
+      const current = await get(`/api/functions/${id}`);
+      const name = current?.name ?? current?.data?.name;
+      return post("/api/functions", { name, code, ...options });
     },
     async executeCode(code, options) {
       return post("/api/functions/execute", { code, ...options });
@@ -775,9 +991,18 @@ function createEmailModule(client) {
     async getConfig() {
       return get("/api/email/config");
     },
+    async listConfigs() {
+      return get("/api/email/configs");
+    },
     async saveConfig(config) {
       return post("/api/email/config", config);
     },
+    async setDefaultConfig(id) {
+      return post(`/api/email/configs/${id}/default`);
+    },
+    async deleteConfig(id) {
+      return del(`/api/email/configs/${id}`);
+    },
     async createTemplate(template) {
       return post("/api/email/templates", template);
     },
@@ -830,7 +1055,9 @@ function createGraphQLModule(client) {
       return post("/api/graphql", { query, variables });
     },
     async getSchema() {
-      return get("/api/graphql/schema");
+      return post("/api/graphql", {
+        query: "{ __schema { queryType { name } mutationType { name } types { name kind } } }"
+      });
     },
     getPlaygroundUrl() {
       return `${client.url}/api/graphql/playground`;
@@ -876,6 +1103,7 @@ function createMetricsModule(client) {
 // src/modules/audit.ts
 function createAuditModule(client) {
   const get = (endpoint) => client.get(endpoint);
+  const del = (endpoint) => client.delete(endpoint);
   return {
     async list(options) {
       const params = new URLSearchParams();
@@ -892,6 +1120,43 @@ function createAuditModule(client) {
     },
     async getActions() {
       return get("/api/audit/actions");
+    },
+    async exportLogs(format, options) {
+      const params = new URLSearchParams();
+      params.set("format", format);
+      if (options?.action) params.set("action", options.action);
+      if (options?.method) params.set("method", options.method);
+      if (options?.path) params.set("path", options.path);
+      if (options?.status_code) params.set("status_code", options.status_code.toString());
+      if (options?.start_date) params.set("start_date", options.start_date);
+      if (options?.end_date) params.set("end_date", options.end_date);
+      const res = await fetch(`${client.url}/api/audit/export?${params.toString()}`, {
+        headers: client.getHeaders(),
+        credentials: "include"
+      });
+      if (!res.ok) {
+        const data = await res.json();
+        return { error: data.error || `Export failed: ${res.status}` };
+      }
+      const blob = await res.blob();
+      const url = window.URL.createObjectURL(blob);
+      const a = document.createElement("a");
+      a.href = url;
+      a.download = `audit_logs_${(/* @__PURE__ */ new Date()).toISOString().split("T")[0]}.${format}`;
+      document.body.appendChild(a);
+      a.click();
+      window.URL.revokeObjectURL(url);
+      document.body.removeChild(a);
+      return { success: true };
+    },
+    async purgePreview(olderThanDays) {
+      return get(`/api/audit/purge/preview?older_than_days=${olderThanDays}`);
+    },
+    async purge(olderThanDays) {
+      return del(`/api/audit/purge?older_than_days=${olderThanDays}`);
+    },
+    async clearAll() {
+      return del(`/api/audit/clear`);
     }
   };
 }
@@ -992,6 +1257,16 @@ var RealtimeService = class {
   }
   socket = null;
   subscribers = /* @__PURE__ */ new Map();
+  // The server-side value filter currently REGISTERED per table (e.g.
+  // { status: 'eq.pending' }). The server keeps one filter per (connection,table),
+  // so this is only set when every subscriber on the table shares the same filter;
+  // otherwise the table runs unfiltered server-side and each subscriber's filter is
+  // applied client-side in handleEvent (see computeServerFilter).
+  filters = /* @__PURE__ */ new Map();
+  // Ephemeral Broadcast / Presence channel handlers.
+  broadcastHandlers = /* @__PURE__ */ new Map();
+  presenceHandlers = /* @__PURE__ */ new Map();
+  presenceStates = /* @__PURE__ */ new Map();
   reconnectAttempts = 0;
   maxReconnectAttempts = 5;
   reconnectInterval = 3e3;
@@ -1017,6 +1292,15 @@ var RealtimeService = class {
       socket.onopen = () => {
         console.log("BaaS Realtime: Connected");
         this.reconnectAttempts = 0;
+        for (const table of this.subscribers.keys()) {
+          this.sendSub("subscribe", table);
+        }
+        for (const channel of this.broadcastHandlers.keys()) {
+          this.send({ event: "broadcast_subscribe", channel });
+        }
+        for (const channel of this.presenceHandlers.keys()) {
+          this.send({ event: "presence_subscribe", channel, state: this.presenceStates.get(channel) ?? {} });
+        }
         resolve();
       };
       socket.onmessage = (event) => {
@@ -1052,13 +1336,15 @@ var RealtimeService = class {
   /**
    * Subscribe to changes on a specific table
    */
-  async subscribe(table, action, callback) {
+  async subscribe(table, action, callback, filter) {
     await this.connect();
-    if (!this.subscribers.has(table)) {
+    const isNewTable = !this.subscribers.has(table);
+    if (isNewTable) {
       this.subscribers.set(table, /* @__PURE__ */ new Set());
     }
-    const sub = { action, callback };
+    const sub = { action, callback, filter: filter && Object.keys(filter).length > 0 ? filter : void 0 };
     this.subscribers.get(table).add(sub);
+    if (table !== "*") this.syncServerFilter(table, isNewTable);
     return {
       unsubscribe: () => {
         const tableSubs = this.subscribers.get(table);
@@ -1066,32 +1352,194 @@ var RealtimeService = class {
           tableSubs.delete(sub);
           if (tableSubs.size === 0) {
             this.subscribers.delete(table);
+            this.filters.delete(table);
+            if (table !== "*") this.sendSub("unsubscribe", table);
+          } else if (table !== "*") {
+            this.syncServerFilter(table, false);
           }
         }
       }
     };
   }
+  /**
+   * Recompute the effective server-side filter for a table and (re)register it
+   * when it changed (or when force is set, e.g. a brand-new table). The server
+   * stores exactly one filter per (connection, table): a plain `subscribe`
+   * clears it, a filtered `subscribe` replaces it.
+   */
+  syncServerFilter(table, force) {
+    const desired = this.computeServerFilter(table);
+    const current = this.filters.get(table);
+    const changed = JSON.stringify(desired ?? null) !== JSON.stringify(current ?? null);
+    if (!force && !changed) return;
+    if (desired) this.filters.set(table, desired);
+    else this.filters.delete(table);
+    this.sendSub("subscribe", table);
+  }
+  /**
+   * The server-side filter safe to apply for a table: the shared filter iff
+   * EVERY subscriber requested the identical (non-empty) filter. If any
+   * subscriber is unfiltered or filters conflict, returns undefined so the
+   * server delivers all rows and each subscriber filters client-side.
+   */
+  computeServerFilter(table) {
+    const subs = this.subscribers.get(table);
+    if (!subs || subs.size === 0) return void 0;
+    let chosen;
+    for (const sub of subs) {
+      const key = sub.filter && Object.keys(sub.filter).length > 0 ? JSON.stringify(sub.filter) : "";
+      if (key === "") return void 0;
+      if (chosen === void 0) chosen = key;
+      else if (chosen !== key) return void 0;
+    }
+    return chosen ? JSON.parse(chosen) : void 0;
+  }
+  /** Send a subscribe/unsubscribe control frame to the server (with any filter). */
+  sendSub(event, table) {
+    const frame = { event, table };
+    if (event === "subscribe") {
+      const filter = this.filters.get(table);
+      if (filter) frame.filter = filter;
+    }
+    this.send(frame);
+  }
+  /** Send an arbitrary control frame if the socket is open. */
+  send(frame) {
+    if (this.socket?.readyState === WebSocket.OPEN) {
+      this.socket.send(JSON.stringify(frame));
+    }
+  }
+  /**
+   * Subscribe to an ephemeral Broadcast channel (no DB, no RLS — UI sync/chat).
+   */
+  async subscribeBroadcast(channel, callback) {
+    await this.connect();
+    const isNew = !this.broadcastHandlers.has(channel);
+    if (isNew) this.broadcastHandlers.set(channel, /* @__PURE__ */ new Set());
+    const handlers = this.broadcastHandlers.get(channel);
+    handlers.add(callback);
+    if (isNew) this.send({ event: "broadcast_subscribe", channel });
+    return {
+      unsubscribe: () => {
+        handlers.delete(callback);
+        if (handlers.size === 0) {
+          this.broadcastHandlers.delete(channel);
+          this.send({ event: "broadcast_unsubscribe", channel });
+        }
+      }
+    };
+  }
+  /** Publish a message to a Broadcast channel. */
+  broadcast(channel, payload) {
+    this.send({ event: "broadcast", channel, payload });
+  }
+  /**
+   * Join a Presence channel. The callback receives sync/join/leave events with
+   * the current member list. Returns a leave() handle.
+   */
+  async subscribePresence(channel, state, callback) {
+    await this.connect();
+    const isNew = !this.presenceHandlers.has(channel);
+    if (isNew) this.presenceHandlers.set(channel, /* @__PURE__ */ new Set());
+    this.presenceStates.set(channel, state ?? {});
+    const handlers = this.presenceHandlers.get(channel);
+    handlers.add(callback);
+    if (isNew) this.send({ event: "presence_subscribe", channel, state: state ?? {} });
+    return {
+      leave: () => {
+        handlers.delete(callback);
+        if (handlers.size === 0) {
+          this.presenceHandlers.delete(channel);
+          this.presenceStates.delete(channel);
+          this.send({ event: "presence_unsubscribe", channel });
+        }
+      }
+    };
+  }
   /**
    * Handle incoming CDC events from the server
    */
   handleEvent(payload) {
-    const tableSubs = this.subscribers.get(payload.table);
-    if (tableSubs) {
-      for (const sub of tableSubs) {
-        if (sub.action === "*" || sub.action.toLowerCase() === payload.action.toLowerCase()) {
-          sub.callback(payload);
+    const kind = payload.type;
+    if (kind === "broadcast") {
+      const handlers = this.broadcastHandlers.get(payload.channel);
+      if (handlers) for (const cb of handlers) cb(payload.payload);
+      return;
+    }
+    if (kind === "presence") {
+      const handlers = this.presenceHandlers.get(payload.channel);
+      if (handlers) for (const cb of handlers) cb(payload);
+      return;
+    }
+    this.dispatchToSubs(this.subscribers.get(payload.table), payload);
+    this.dispatchToSubs(this.subscribers.get("*"), payload);
+  }
+  /**
+   * Fire matching subscribers. Each subscriber's own filter is re-checked
+   * client-side: when subscribers on a table disagree, the server delivers all
+   * rows unfiltered, so client-side filtering is what keeps each callback scoped.
+   */
+  dispatchToSubs(subs, payload) {
+    if (!subs) return;
+    for (const sub of subs) {
+      if (sub.action !== "*" && sub.action.toLowerCase() !== payload.action.toLowerCase()) continue;
+      if (sub.filter && !this.matchFilter(payload.record, sub.filter)) continue;
+      sub.callback(payload);
+    }
+  }
+  /** Evaluate a PostgREST-style filter against a record (mirrors hub_filter.go). */
+  matchFilter(record, filter) {
+    if (record == null) return false;
+    for (const col of Object.keys(filter)) {
+      const spec = filter[col];
+      let op = "eq";
+      let val = spec;
+      const i = spec.indexOf(".");
+      if (i > 0) {
+        const cand = spec.slice(0, i);
+        if (["eq", "neq", "gt", "gte", "lt", "lte", "in", "like"].includes(cand)) {
+          op = cand;
+          val = spec.slice(i + 1);
         }
       }
+      const actualRaw = record[col];
+      if (actualRaw === void 0) return false;
+      const actual = actualRaw === null ? "" : String(actualRaw);
+      if (!this.evalPred(op, actual, val)) return false;
     }
-    const wildcardSubs = this.subscribers.get("*");
-    if (wildcardSubs) {
-      for (const sub of wildcardSubs) {
-        if (sub.action === "*" || sub.action.toLowerCase() === payload.action.toLowerCase()) {
-          sub.callback(payload);
-        }
+    return true;
+  }
+  evalPred(op, actual, val) {
+    switch (op) {
+      case "eq":
+        return actual === val;
+      case "neq":
+        return actual !== val;
+      case "in":
+        return val.split(",").includes(actual);
+      case "like":
+        return this.likeMatch(actual, val);
+      case "gt":
+      case "gte":
+      case "lt":
+      case "lte": {
+        const a = parseFloat(actual);
+        const b = parseFloat(val);
+        if (Number.isNaN(a) || Number.isNaN(b)) return false;
+        if (op === "gt") return a > b;
+        if (op === "gte") return a >= b;
+        if (op === "lt") return a < b;
+        return a <= b;
       }
+      default:
+        return false;
     }
   }
+  /** SQL LIKE with '%' (any run) and '_' (any single char), anchored, case-sensitive. */
+  likeMatch(s, pattern) {
+    const re = "^" + pattern.replace(/[.*+?^${}()|[\]\\]/g, "\\$&").replace(/%/g, ".*").replace(/_/g, ".") + "$";
+    return new RegExp(re).test(s);
+  }
   /**
    * Attempt to reconnect on connection loss
    */
@@ -1129,8 +1577,17 @@ function createRealtimeModule(client) {
     typeof WebSocket !== "undefined" ? WebSocket : void 0
   );
   return {
-    async subscribe(table, action, callback) {
-      return service.subscribe(table, action, callback);
+    async subscribe(table, action, callback, filter) {
+      return service.subscribe(table, action, callback, filter);
+    },
+    async subscribeBroadcast(channel, callback) {
+      return service.subscribeBroadcast(channel, callback);
+    },
+    broadcast(channel, payload) {
+      service.broadcast(channel, payload);
+    },
+    async subscribePresence(channel, state, callback) {
+      return service.subscribePresence(channel, state, callback);
     }
   };
 }
@@ -1153,6 +1610,9 @@ function createApiKeysModule(client) {
     async delete(keyId) {
       return del(`/api/api-keys/${keyId}`);
     },
+    async setBrand(keyId, emailConfigId) {
+      return post(`/api/api-keys/${keyId}/brand`, { email_config_id: emailConfigId });
+    },
     async getInstanceToken() {
       return get("/api/api-keys/instance");
     },
@@ -1242,6 +1702,44 @@ function createIPWhitelistModule(client) {
   };
 }
 
+// src/modules/cache.ts
+function createCacheModule(client) {
+  const get = (endpoint) => client.get(endpoint);
+  const post = (endpoint, body) => client.post(endpoint, body);
+  const patch = (endpoint, body) => client.patch(endpoint, body);
+  const del = (endpoint) => client.delete(endpoint);
+  return {
+    async getStatus() {
+      return get("/api/cache/status");
+    },
+    async getStats() {
+      return get("/api/cache/stats");
+    },
+    async listPolicies() {
+      return get("/api/cache/policies");
+    },
+    async updatePolicy(namespace, body) {
+      return patch(`/api/cache/policies/${encodeURIComponent(namespace)}`, body);
+    },
+    async removePolicy(namespace) {
+      return del(`/api/cache/policies/${encodeURIComponent(namespace)}`);
+    },
+    async invalidateNamespace(namespace) {
+      return post(`/api/cache/invalidate/${encodeURIComponent(namespace)}`);
+    },
+    async invalidateAll() {
+      return post("/api/cache/invalidate-all");
+    },
+    async listKeys(prefix, cursor = 0, count = 100) {
+      const params = new URLSearchParams({ prefix, cursor: String(cursor), count: String(count) });
+      return get(`/api/cache/keys?${params}`);
+    },
+    async inspectKey(key) {
+      return get(`/api/cache/keys/inspect?key=${encodeURIComponent(key)}`);
+    }
+  };
+}
+
 // src/client.ts
 var BaasClient = class extends HttpClient {
   // Feature modules
@@ -1268,8 +1766,9 @@ var BaasClient = class extends HttpClient {
   corsOrigins;
   policies;
   ipWhitelist;
-  constructor(url, apiKey) {
-    super(url, apiKey);
+  cache;
+  constructor(url, apiKey, options) {
+    super(url, apiKey, options);
     this.auth = createAuthModule(this);
     this.users = createUsersModule(this);
     this.database = createDatabaseModule(this);
@@ -1293,6 +1792,7 @@ var BaasClient = class extends HttpClient {
     this.corsOrigins = createCorsOriginsModule(this);
     this.policies = createPoliciesModule(this);
     this.ipWhitelist = createIPWhitelistModule(this);
+    this.cache = createCacheModule(this);
   }
   /**
    * Create a query builder for fluent data queries
@@ -1300,6 +1800,18 @@ var BaasClient = class extends HttpClient {
   from(table) {
     return new QueryBuilder(table, this.url, this);
   }
+  /**
+   * Invoke a PL/pgSQL function (PostgREST `.rpc()` parity). Runs under the
+   * caller's RLS context; args bind by name and are $N-safe. Pass [params] for
+   * POST (named args in the body) or set `opts.get = true` for the GET variant.
+   */
+  async rpc(fn, params, opts) {
+    if (opts?.get) {
+      const qs = params ? "?" + new URLSearchParams(Object.entries(params).map(([k, v]) => [k, String(v)])).toString() : "";
+      return this.get(`/api/v1/rpc/${fn}${qs}`);
+    }
+    return this.post(`/api/v1/rpc/${fn}`, params ?? {});
+  }
   // ============================================
   // BACKWARD COMPATIBILITY METHODS
   // These delegate to the appropriate modules
@@ -1419,8 +1931,8 @@ var BaasClient = class extends HttpClient {
   async deleteStorageFile(fileId) {
     return this.storage.deleteFile(fileId);
   }
-  async createStorageBucket(name, isPublic) {
-    return this.storage.createBucket(name, isPublic);
+  async createStorageBucket(name, isPublic, maxBytes) {
+    return this.storage.createBucket(name, isPublic, maxBytes);
   }
   async listStorageBuckets() {
     return this.storage.listBuckets();
@@ -1451,6 +1963,9 @@ var BaasClient = class extends HttpClient {
   async deleteApiKey(keyId) {
     return this.apiKeys.delete(keyId);
   }
+  async setApiKeyBrand(keyId, emailConfigId) {
+    return this.apiKeys.setBrand(keyId, emailConfigId);
+  }
   async getInstanceToken() {
     return this.apiKeys.getInstanceToken();
   }
@@ -1525,9 +2040,18 @@ var BaasClient = class extends HttpClient {
   async getEmailConfig() {
     return this.email.getConfig();
   }
+  async listEmailConfigs() {
+    return this.email.listConfigs();
+  }
   async saveEmailConfig(config) {
     return this.email.saveConfig(config);
   }
+  async setDefaultEmailConfig(id) {
+    return this.email.setDefaultConfig(id);
+  }
+  async deleteEmailConfig(id) {
+    return this.email.deleteConfig(id);
+  }
   async createEmailTemplate(template) {
     return this.email.createTemplate(template);
   }
@@ -1667,9 +2191,21 @@ var BaasClient = class extends HttpClient {
   async getAuditActions() {
     return this.audit.getActions();
   }
+  async exportAuditLogs(format, options) {
+    return this.audit.exportLogs(format, options);
+  }
+  async previewPurgeAuditLogs(olderThanDays) {
+    return this.audit.purgePreview(olderThanDays);
+  }
+  async purgeAuditLogs(olderThanDays) {
+    return this.audit.purge(olderThanDays);
+  }
+  async clearAllAuditLogs() {
+    return this.audit.clearAll();
+  }
   // Realtime shortcuts
-  subscribe(table, action, callback) {
-    return this.realtime.subscribe(table, action, callback);
+  subscribe(table, action, callback, filter) {
+    return this.realtime.subscribe(table, action, callback, filter);
   }
   // Environment shortcuts
   async getEnvironmentStatus() {
@@ -1721,3 +2257,4 @@ var BaasClient = class extends HttpClient {
   HttpClient,
   QueryBuilder
 });
+//# sourceMappingURL=index.cjs.map