@infaris/data 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) Infaris
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,126 @@
-# Temporary Holding Version
+# @infaris/data
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+JavaScript client for the **Data API** of Hosting by Infaris: a REST API over your managed Postgres database, with
+Row Level Security and the sign-in of Infaris Auth. Hosted in the EU, next to your database. Bundled shared error contract, works
+in the browser, Node, Bun, Deno and edge runtimes.
+
+```bash
+npm install @infaris/data
+```
+
+```ts
+import { createClient } from '@infaris/data';
+import type { Database } from './database.types'; // infaris-guard hosting db types <id> --out src/database.types.ts
+
+// Hosting puts NEXT_PUBLIC_INFARIS_DATA_URL (and INFARIS_DATA_URL for server code) on every site the database is
+// attached to while the Data API is on; the key is the one of the auth project (`hosting auth attach`).
+const db = createClient<Database>(process.env.NEXT_PUBLIC_INFARIS_DATA_URL!, process.env.NEXT_PUBLIC_INFARIS_AUTH_KEY!, {
+  // A signed-in user of Infaris Auth: their requests run as `authenticated`, and auth.uid() is their id.
+  accessToken: () => auth.getAccessToken(), // auth = createClient(...) of @infaris/auth-js
+});
+
+const { data, error } = await db
+  .from('todos')
+  .select('id, title, project:projects(name)')
+  .eq('done', false)
+  .order('created_at', { ascending: false })
+  .range(0, 19);
+
+await db.from('todos').insert({ title: 'Ship it' }).select().single();
+await db.from('todos').update({ done: true }).eq('id', 3);
+await db.from('todos').delete().eq('id', 3);
+await db.rpc('search_todos', { q: 'eu' });
+await db.schema('api').from('stats').select('*');
+```
+
+## Keys
+
+| Key | Role in the database | Where |
+| --- | --- | --- |
+| Publishable key `ifr_pk_…` | `anon` | Browser and apps; only from the allowed origins of the auth project |
+| Publishable key plus a user's access token | `authenticated` | Browser and apps, after sign-in |
+| Secret key `ifr_sk_…` | `service_role` (bypasses RLS) | Servers only; refused from a browser |
+
+Nothing is reachable until you put it in the API: `infaris-guard hosting db expose <id> --schema public --table todos --yes`
+(`--dry-run` shows the plan and what anyone could read). Keep columns such as `email` or `iban` out with
+`--exclude-columns email,iban` (or name the allowed ones with `--columns`): then `select('*')` fails for those roles,
+so name the columns, e.g. `.select('id, name')`. A table only goes in with Row Level Security on, and
+`infaris-guard hosting db lint <id>` fails your CI when something is open that should not be.
+
+## Types
+
+`infaris-guard hosting db types <id> --out src/database.types.ts` writes the `Database` type. With it, everything is
+checked at compile time:
+
+```ts
+const { data } = await db.from('posts').select('id, heading:title, author:users(name), comments(text)');
+// data: { id: number; heading: string; author: { name: string } | null; comments: { text: string }[] }[] | null
+
+db.from('posts').select().eq('price', 'ten'); // error: price is a number
+db.from('posts').insert({ author_id: id }); // error: title is required
+```
+
+The select string is parsed for columns, aliases (`heading:title`), casts (`price::text`), JSON paths (`meta->>theme`),
+embedded relations (one object for a many-to-one, an array for a one-to-many; `!inner` drops the `null`), spreads
+(`...users(name)`) and aggregates (`count()`, `price.sum()`). A misspelled column becomes a type that says so.
+`.returns<T>()` overrides the result when you know better.
+
+## Search and aggregates
+
+```ts
+// infaris-guard hosting db search add <id> --schema public --table posts --columns title,body --config dutch
+await db.from('posts').select('id, title').textSearch('fts', 'fiets bel', { type: 'websearch', config: 'dutch' });
+
+// infaris-guard hosting db api set <id> --enabled --aggregates
+await db.from('orders').select('customer_id, total:amount.sum(), count()');
+```
+
+## GraphQL
+
+The same Data API also speaks GraphQL at `<url>/graphql/v1` once the owner switches it on
+(`infaris-guard hosting db graphql enable <id>`): the same key and user token, so the same role, grants and row level
+security. Generate typed operations with graphql-codegen from the schema of your role and pass them in:
+
+```ts
+// infaris-guard hosting db graphql schema <id> --role authenticated --out schema.graphql
+// graphql-codegen with the client preset and documentMode: 'string'
+import { TodosDocument } from './gql/graphql';
+
+const { data, errors } = await db.graphql(TodosDocument, { first: 20 });
+// Persisted documents (persistedDocuments: true, registered with `hosting db graphql persist`): only the hash is sent.
+await db.graphql(TodosDocument, { first: 20 }, { persisted: true });
+```
+
+`errors[].extensions.code` names a refusal: `GRAPHQL_VALIDATION_FAILED` (also for a table or column your role does
+not have), `max_depth`, `max_complexity`, `page_too_large`, `introspection_disabled`, `rate_limited` or a Postgres code
+such as `42501`.
+
+## Queries
+
+`select`, `insert`, `upsert`, `update`, `delete`; filters `eq`, `neq`, `gt`, `gte`, `lt`, `lte`, `like`, `ilike`,
+`is`, `in`, `contains`, `containedBy`, `overlaps`, `textSearch`, `match`, `not`, `or`, `filter`; modifiers `order`,
+`limit`, `range`, `single`, `maybeSingle`, `abortSignal`; counts with `select('*', { count: 'exact' })`.
+The syntax is PostgREST's, so its documentation applies (embedding with `table(columns)`, `!inner` joins, and so on).
+
+Every call resolves to `{ data, error, count, status }` and never throws; `throwOnError()` throws instead. An error
+is a `DataApiError` with `code` (PostgREST's `PGRST…` or Postgres `42501`, or the gateway's `invalid_key`,
+`invalid_token`, `origin_not_allowed`, `rate_limited`, `secret_key_in_browser`), `message`, `details` and `hint`.
+
+## Runtime and modules
+
+Node.js 22.12 or newer, Bun, modern browsers and edge runtimes with `fetch`. ES modules and CommonJS are both supported. Server credentials must stay on the server.
+
+Licensed under MIT. See [LICENSE](./LICENSE).
+
+All API errors extend `InfarisError` (also exported here), with `code`, `status` and `message`. Existing error classes remain supported.
+
+## Client factory
+
+Every Hosting SDK exports `createClient(options)`. Existing named factories and positional Auth/Data arguments remain available.
+
+```ts
+import { createClient } from '@infaris/data';
+const client = createClient({ url: process.env.NEXT_PUBLIC_INFARIS_DATA_URL!, key: process.env.NEXT_PUBLIC_INFARIS_AUTH_KEY! });
+```
+
+The common error implementation is bundled; installing this SDK does not require a private workspace package.

package/dist/index.cjs

@@ -0,0 +1,492 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __commonJS = (cb, mod) => function __require() {
+  try {
+    return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  } catch (e) {
+    throw mod = 0, e;
+  }
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// ../hosting-sdk/dist/index.cjs
+var require_dist = __commonJS({
+  "../hosting-sdk/dist/index.cjs"(exports2, module2) {
+    "use strict";
+    var __defProp2 = Object.defineProperty;
+    var __getOwnPropDesc2 = Object.getOwnPropertyDescriptor;
+    var __getOwnPropNames2 = Object.getOwnPropertyNames;
+    var __hasOwnProp2 = Object.prototype.hasOwnProperty;
+    var __export2 = (target, all) => {
+      for (var name in all)
+        __defProp2(target, name, { get: all[name], enumerable: true });
+    };
+    var __copyProps2 = (to, from, except, desc) => {
+      if (from && typeof from === "object" || typeof from === "function") {
+        for (let key of __getOwnPropNames2(from))
+          if (!__hasOwnProp2.call(to, key) && key !== except)
+            __defProp2(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc2(from, key)) || desc.enumerable });
+      }
+      return to;
+    };
+    var __toCommonJS2 = (mod) => __copyProps2(__defProp2({}, "__esModule", { value: true }), mod);
+    var index_exports2 = {};
+    __export2(index_exports2, {
+      InfarisError: () => InfarisError3
+    });
+    module2.exports = __toCommonJS2(index_exports2);
+    var errorBrand = /* @__PURE__ */ Symbol.for("@infaris/hosting-sdk/error");
+    var InfarisError3 = class _InfarisError extends Error {
+      // SDK bundles contain separate copies; catch the shared base across bundles and module formats.
+      static [Symbol.hasInstance](value) {
+        if (this !== _InfarisError) return Function.prototype[Symbol.hasInstance].call(this, value);
+        return value instanceof Error && errorBrand in value && value[errorBrand] === true;
+      }
+      code;
+      status;
+      constructor(message, code = "sdk_error", status = null) {
+        super(message);
+        Object.defineProperty(this, errorBrand, { value: true });
+        this.name = "InfarisError";
+        this.code = code;
+        this.status = status;
+      }
+    };
+  }
+});
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  DataApiError: () => DataApiError,
+  DataClient: () => DataClient,
+  InfarisError: () => import_hosting_sdk2.InfarisError,
+  QueryBuilder: () => QueryBuilder,
+  SchemaClient: () => SchemaClient,
+  createClient: () => createClient,
+  quoteValue: () => quoteValue
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/graphql.ts
+async function runGraphql(context, baseUrl, document2, variables, options = {}) {
+  const headers = await context.headers("POST", null);
+  headers["Content-Type"] = "application/json";
+  headers.Accept = "application/json";
+  if (options.schema) headers["Accept-Profile"] = options.schema;
+  const hash = typeof document2 === "string" ? void 0 : document2.__meta__?.hash;
+  const body = {};
+  if (options.persisted) {
+    if (!hash) throw new TypeError("persisted needs a document with __meta__.hash (graphql-codegen persistedDocuments: true)");
+    body.documentId = `sha256:${hash.replace(/^sha256:/, "")}`;
+  } else body.query = String(document2);
+  if (variables && Object.keys(variables).length) body.variables = variables;
+  if (options.operationName) body.operationName = options.operationName;
+  let response;
+  try {
+    response = await context.fetch(`${baseUrl}/graphql/v1`, { method: "POST", headers, body: JSON.stringify(body) });
+  } catch (cause) {
+    return { data: null, errors: [{ message: cause instanceof Error ? cause.message : String(cause), extensions: { code: "network_error" } }], status: 0 };
+  }
+  let parsed = {};
+  try {
+    parsed = await response.json();
+  } catch {
+  }
+  if (!parsed.errors && parsed.code && parsed.message) {
+    parsed.errors = [{ message: parsed.message, extensions: { code: parsed.code } }];
+  }
+  return { data: parsed.data ?? null, errors: parsed.errors?.length ? parsed.errors : null, status: response.status };
+}
+
+// src/types.ts
+var import_hosting_sdk = __toESM(require_dist(), 1);
+var DataApiError = class extends import_hosting_sdk.InfarisError {
+  code;
+  details;
+  hint;
+  status;
+  constructor(input) {
+    super(input.message, input.code, input.status);
+    this.name = "DataApiError";
+    this.code = input.code;
+    this.details = input.details ?? null;
+    this.hint = input.hint ?? null;
+    this.status = input.status ?? null;
+  }
+};
+
+// src/query.ts
+function quoteValue(value) {
+  if (value === null) return "null";
+  const text = String(value);
+  return /[,()":\s\\{}]/.test(text) ? `"${text.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"` : text;
+}
+function containerValue(value) {
+  if (typeof value === "string") return value;
+  if (Array.isArray(value)) return `{${value.map(quoteValue).join(",")}}`;
+  return JSON.stringify(value);
+}
+var QueryBuilder = class {
+  constructor(ctx, path) {
+    this.ctx = ctx;
+    this.path = path;
+  }
+  ctx;
+  path;
+  method = "GET";
+  params = new URLSearchParams();
+  prefer = [];
+  body = void 0;
+  accept = null;
+  maybe = false;
+  signal;
+  retype() {
+    return this;
+  }
+  /** Overrides the result type when you know better (a view without types, a computed column). */
+  returns() {
+    return this.retype();
+  }
+  // --- operations -------------------------------------------------------------------------------------------------
+  /** Read rows (`GET`), or with a mutation before it, return the changed rows. `head: true` only counts. */
+  select(columns, options = {}) {
+    const cleaned = (columns ?? "*").replace(/\s+(?=([^"]*"[^"]*")*[^"]*$)/g, "");
+    this.params.set("select", cleaned);
+    if (this.method === "GET" || this.method === "HEAD") {
+      if (options.head) this.method = "HEAD";
+    } else {
+      this.prefer.push("return=representation");
+    }
+    if (options.count) this.prefer.push(`count=${options.count}`);
+    return this.retype();
+  }
+  insert(values, options = {}) {
+    this.method = "POST";
+    this.body = values;
+    if (Array.isArray(values)) this.columns(values);
+    if (options.defaultToNull === false) this.prefer.push("missing=default");
+    if (options.count) this.prefer.push(`count=${options.count}`);
+    return this.retype();
+  }
+  /** Insert or, on a conflict with `onConflict` (default the primary key), update (or skip with `ignoreDuplicates`). */
+  upsert(values, options = {}) {
+    this.method = "POST";
+    this.body = values;
+    this.prefer.push(`resolution=${options.ignoreDuplicates ? "ignore" : "merge"}-duplicates`);
+    if (options.onConflict) this.params.set("on_conflict", options.onConflict);
+    if (Array.isArray(values)) this.columns(values);
+    if (options.defaultToNull === false) this.prefer.push("missing=default");
+    if (options.count) this.prefer.push(`count=${options.count}`);
+    return this.retype();
+  }
+  update(values, options = {}) {
+    this.method = "PATCH";
+    this.body = values;
+    if (options.count) this.prefer.push(`count=${options.count}`);
+    return this.retype();
+  }
+  delete(options = {}) {
+    this.method = "DELETE";
+    if (options.count) this.prefer.push(`count=${options.count}`);
+    return this.retype();
+  }
+  /** `columns` for a bulk insert, so rows that leave a column out get its default instead of null. */
+  columns(rows) {
+    const keys = /* @__PURE__ */ new Set();
+    for (const row of rows) for (const key of Object.keys(row)) keys.add(key);
+    if (keys.size) this.params.set("columns", [...keys].map((k) => `"${k}"`).join(","));
+  }
+  // --- filters ----------------------------------------------------------------------------------------------------
+  /** Any PostgREST filter: `filter('age', 'gte', 18)`, `filter('tags', 'cs', '{a,b}')`. */
+  filter(column, operator, value) {
+    this.params.append(column, `${operator}.${value === null ? "null" : String(value)}`);
+    return this;
+  }
+  eq(column, value) {
+    return this.filter(column, "eq", value);
+  }
+  neq(column, value) {
+    return this.filter(column, "neq", value);
+  }
+  gt(column, value) {
+    return this.filter(column, "gt", value);
+  }
+  gte(column, value) {
+    return this.filter(column, "gte", value);
+  }
+  lt(column, value) {
+    return this.filter(column, "lt", value);
+  }
+  lte(column, value) {
+    return this.filter(column, "lte", value);
+  }
+  like(column, pattern) {
+    return this.filter(column, "like", pattern);
+  }
+  ilike(column, pattern) {
+    return this.filter(column, "ilike", pattern);
+  }
+  /** `IS NULL`, `IS TRUE`, `IS FALSE`. */
+  is(column, value) {
+    return this.filter(column, "is", value);
+  }
+  in(column, values) {
+    return this.filter(column, "in", `(${values.map(quoteValue).join(",")})`);
+  }
+  contains(column, value) {
+    return this.filter(column, "cs", containerValue(value));
+  }
+  containedBy(column, value) {
+    return this.filter(column, "cd", containerValue(value));
+  }
+  overlaps(column, value) {
+    return this.filter(column, "ov", containerValue(value));
+  }
+  /**
+   * Full-text search on a tsvector column (`infaris-guard hosting db search add` makes one):
+   * `textSearch('fts', 'fiets bel', { type: 'websearch', config: 'dutch' })`.
+   */
+  textSearch(column, query, options = {}) {
+    const op = options.type === "plain" ? "plfts" : options.type === "phrase" ? "phfts" : options.type === "websearch" ? "wfts" : "fts";
+    return this.filter(column, options.config ? `${op}(${options.config})` : op, query);
+  }
+  /** Several equalities at once. */
+  match(query) {
+    for (const [column, value] of Object.entries(query)) this.filter(column, "eq", value);
+    return this;
+  }
+  /** Negate a filter: `not('status', 'eq', 'done')`. */
+  not(column, operator, value) {
+    return this.filter(column, `not.${operator}`, value);
+  }
+  /** Raw PostgREST `or`: `or('status.eq.open,priority.gt.3')`; `referencedTable` filters an embedded table. */
+  or(filters, options = {}) {
+    this.params.append(options.referencedTable ? `${options.referencedTable}.or` : "or", `(${filters})`);
+    return this;
+  }
+  order(column, options = {}) {
+    const key = options.referencedTable ? `${options.referencedTable}.order` : "order";
+    const term = `${column}.${options.ascending === false ? "desc" : "asc"}${options.nullsFirst === void 0 ? "" : options.nullsFirst ? ".nullsfirst" : ".nullslast"}`;
+    const existing = this.params.get(key);
+    this.params.set(key, existing ? `${existing},${term}` : term);
+    return this;
+  }
+  limit(count, options = {}) {
+    this.params.set(options.referencedTable ? `${options.referencedTable}.limit` : "limit", String(count));
+    return this;
+  }
+  /** Rows `from` to `to`, both included, counting from 0. */
+  range(from, to, options = {}) {
+    const prefix = options.referencedTable ? `${options.referencedTable}.` : "";
+    this.params.set(`${prefix}offset`, String(from));
+    this.params.set(`${prefix}limit`, String(to - from + 1));
+    return this;
+  }
+  /** Exactly one row, else an error (PostgREST `PGRST116`). */
+  single() {
+    this.accept = "application/vnd.pgrst.object+json";
+    return this.retype();
+  }
+  /** One row or null; more than one is an error. */
+  maybeSingle() {
+    this.maybe = true;
+    return this.retype();
+  }
+  abortSignal(signal) {
+    this.signal = signal;
+    return this;
+  }
+  // --- running ----------------------------------------------------------------------------------------------------
+  /** The url this query will call (for logging and tests; holds filter values). */
+  toUrl() {
+    const query = this.params.toString();
+    return `${this.ctx.restUrl}/${this.path}${query ? `?${query}` : ""}`;
+  }
+  then(onfulfilled, onrejected) {
+    return this.execute().then(onfulfilled, onrejected);
+  }
+  /** Throws the error instead of returning it: `const rows = await db.from('todos').select().throwOnError()`. */
+  async throwOnError() {
+    const res = await this.execute();
+    if (res.error) throw res.error;
+    return res.data;
+  }
+  async execute() {
+    const headers = await this.ctx.headers(this.method, this.ctx.schema);
+    if (this.accept) headers.Accept = this.accept;
+    if (this.prefer.length) headers.Prefer = this.prefer.join(",");
+    if (this.body !== void 0) headers["Content-Type"] = "application/json";
+    let response;
+    try {
+      response = await this.ctx.fetch(this.toUrl(), {
+        method: this.method,
+        headers,
+        body: this.body === void 0 ? void 0 : JSON.stringify(this.body),
+        signal: this.signal
+      });
+    } catch (cause) {
+      const error = new DataApiError({ code: "network_error", message: cause instanceof Error ? cause.message : String(cause) });
+      return { data: null, error, count: null, status: 0, statusText: "" };
+    }
+    return parseResponse(response, this.maybe);
+  }
+};
+async function parseResponse(response, maybeSingle = false) {
+  const range = response.headers.get("content-range");
+  const total = range?.split("/")[1];
+  const count = total && total !== "*" ? Number(total) : null;
+  const text = response.status === 204 || response.status === 205 ? "" : await response.text();
+  const base = { count, status: response.status, statusText: response.statusText };
+  if (!response.ok) {
+    let body = {};
+    try {
+      body = text ? JSON.parse(text) : {};
+    } catch {
+      body = { message: text };
+    }
+    const nested = body.error ?? body;
+    const error = new DataApiError({
+      code: String(nested.code ?? response.status),
+      message: String(nested.message ?? response.statusText ?? "Request failed"),
+      details: nested.details ?? null,
+      hint: nested.hint ?? null,
+      status: response.status
+    });
+    return { data: null, error, ...base };
+  }
+  let data = null;
+  if (text) {
+    try {
+      data = JSON.parse(text);
+    } catch {
+      data = text;
+    }
+  }
+  if (maybeSingle && Array.isArray(data)) {
+    if (data.length > 1) {
+      const error = new DataApiError({ code: "PGRST116", message: `Expected at most one row, got ${data.length}`, status: 406 });
+      return { data: null, error, ...base, status: 406 };
+    }
+    data = data[0] ?? null;
+  }
+  return { data, error: null, ...base };
+}
+
+// src/client.ts
+var KEY_PATTERN = /^ifr_(pk|sk)_ap_[a-z0-9]{20}_/;
+var SchemaClient = class {
+  constructor(base, schemaName) {
+    this.base = base;
+    this.schemaName = schemaName;
+  }
+  base;
+  schemaName;
+  from(relation) {
+    if (!relation || relation.includes("/") || relation.includes("?")) throw new TypeError(`Invalid table name: ${relation}`);
+    return new QueryBuilder({ ...this.base, schema: this.schemaName }, encodeURIComponent(relation));
+  }
+  async rpc(fn, args = {}, options = {}) {
+    const method = options.head ? "HEAD" : options.get ? "GET" : "POST";
+    const headers = await this.base.headers(method, this.schemaName);
+    if (options.count) headers.Prefer = `count=${options.count}`;
+    let url = `${this.base.restUrl}/rpc/${encodeURIComponent(fn)}`;
+    let body;
+    if (method === "POST") {
+      headers["Content-Type"] = "application/json";
+      body = JSON.stringify(args);
+    } else {
+      const params = new URLSearchParams();
+      for (const [key, value] of Object.entries(args)) params.append(key, String(value));
+      const query = params.toString();
+      if (query) url += `?${query}`;
+    }
+    try {
+      return await parseResponse(await this.base.fetch(url, { method, headers, body }));
+    } catch (cause) {
+      const error = new DataApiError({ code: "network_error", message: cause instanceof Error ? cause.message : String(cause) });
+      return { data: null, error, count: null, status: 0, statusText: "" };
+    }
+  }
+};
+var DataClient = class extends SchemaClient {
+  url;
+  context;
+  constructor(url, key, options = {}) {
+    const base = url.replace(/\/+$/, "").replace(/\/rest\/v1$/, "");
+    if (!/^https?:\/\//.test(base)) throw new TypeError("The Data API url starts with https://");
+    if (!key) throw new TypeError("Pass the publishable key (or, on a server, the secret key) of the auth project");
+    if (KEY_PATTERN.test(key) && key.startsWith("ifr_sk_") && typeof window !== "undefined" && typeof document !== "undefined") {
+      throw new TypeError("A secret key (ifr_sk_) must never be used in a browser; use the publishable key");
+    }
+    const fetcher = options.fetch ?? ((input, init) => fetch(input, init));
+    const fixed = { ...options.headers ?? {} };
+    const context = {
+      restUrl: `${base}/rest/v1`,
+      fetch: fetcher,
+      headers: async (method, schema) => {
+        const token = options.accessToken ? await options.accessToken() : null;
+        const headers = { ...fixed, apikey: key, Authorization: `Bearer ${token ?? key}` };
+        if (schema) headers[method === "GET" || method === "HEAD" ? "Accept-Profile" : "Content-Profile"] = schema;
+        return headers;
+      }
+    };
+    super(context, options.schema ?? null);
+    this.url = base;
+    this.context = context;
+  }
+  /**
+   * A GraphQL query or mutation (`<url>/graphql/v1`), with the same key and token as REST. Pass a document of
+   * graphql-codegen for typed data and variables: `const { data } = await db.graphql(TodosDocument, { first: 10 })`.
+   */
+  graphql(document2, variables, options) {
+    return runGraphql(this.context, this.url, document2, variables, options);
+  }
+  /** Requests in another exposed schema. */
+  schema(name) {
+    return new SchemaClient(this.context, name);
+  }
+};
+function createClient(input, key, options = {}) {
+  if (typeof input !== "string") return new DataClient(input.url, input.key, input);
+  if (!key) throw new Error("A key is required");
+  return new DataClient(input, key, options);
+}
+
+// src/index.ts
+var import_hosting_sdk2 = __toESM(require_dist(), 1);
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  DataApiError,
+  DataClient,
+  InfarisError,
+  QueryBuilder,
+  SchemaClient,
+  createClient,
+  quoteValue
+});