@protobase/client 0.12.2 → 0.12.3

package/dist/client.d.ts

@@ -36,6 +36,10 @@ export type UploadOptions = {
   onProgress?: UploadProgress;
   signal?: AbortSignal;
 };
+/**
+ * The client of one API. With an absolute `baseUrl`, the URL of each file in a record it answers is absolute too, on
+ * that API's origin; with a path, it stays the path the API answers.
+ */
 export declare const createClient: (options?: ClientOptions) => {
   list: <R extends ResourceRef>(resource: R, params?: ListParams) => Promise<ListPage<RecordOf<R>>>;
   search: <R extends ResourceRef>(resource: R, params?: ListParams) => Promise<ListPage<RecordOf<R>>>;
@@ -64,7 +68,9 @@ export declare const createClient: (options?: ClientOptions) => {
   seek: <R extends ResourceRef>(resource: R, params: ListParams & {
     position: number;
   }) => Promise<ListPage<RecordOf<R>>>;
-  meta: (etag?: string) => Promise<MetaResult>;
+  meta: (etag?: string, { signal }?: {
+    signal?: AbortSignal;
+  }) => Promise<MetaResult>;
   invoke: <T = unknown>(name: string, { method, body, path, query, headers }?: InvokeOptions) => Promise<T>;
   upload: (resource: ResourceRef, field: string, file: Blob, { onProgress, signal }?: UploadOptions) => Promise<UploadResult>;
 };

package/dist/client.js

@@ -1,12 +1,13 @@
 import { filterText, listWire, queryString } from "./query-string.js";
+import { originOf, withFileOrigin } from "./file-urls.js";
 import { createTransport } from "./transport.js";
 import { fetchWithProgress } from "./upload-request.js";
 import { encodeKey } from "@protobase/schema";
 //#region src/client.ts
 const nameOf = (resource) => typeof resource === "string" ? resource : resource.toModel().name;
 const keyPath = (resource, key) => `/${nameOf(resource)}/${encodeKey(key)}`;
-const toPage = (body, response) => ({
-	items: body.items,
+const toPage = (body, response, origin) => ({
+	items: body.items.map((item) => withFileOrigin(item, origin)),
 	nextPageToken: body.next_page_token,
 	totalSizeEstimate: body.total_size_estimate,
 	...body.prev_page_token !== void 0 && { prevPageToken: body.prev_page_token },
@@ -15,23 +16,42 @@ const toPage = (body, response) => ({
 });
 const etagOf = (response) => response.headers.get("etag") ?? "";
 /** A single-record response: the record without its `permissions` member, which travels beside it. */
-const storedOf = async (response) => {
+const storedOf = async (response, origin) => {
 	const { permissions, ...record } = await response.json();
 	return {
-		record,
+		record: withFileOrigin(record, origin),
 		etag: etagOf(response),
 		...permissions && { permissions }
 	};
 };
+const batchResultOf = (body, origin) => ({ results: (body.results ?? []).map((result) => {
+	if (result.op === "create" || result.op === "update") return {
+		...result,
+		record: withFileOrigin(result.record, origin)
+	};
+	if (result.op === "reorder") return {
+		...result,
+		records: result.records.map((entry) => ({
+			...entry,
+			record: withFileOrigin(entry.record, origin)
+		}))
+	};
+	return result;
+}) });
+/**
+* The client of one API. With an absolute `baseUrl`, the URL of each file in a record it answers is absolute too, on
+* that API's origin; with a path, it stays the path the API answers.
+*/
 const createClient = (options = {}) => {
 	const send = createTransport(options);
+	const origin = originOf(options.baseUrl);
 	const list = async (resource, params) => {
 		const response = await send({
 			method: "GET",
 			path: `/${nameOf(resource)}`,
 			query: queryString(listWire(params))
 		});
-		return toPage(await response.json(), response);
+		return toPage(await response.json(), response, origin);
 	};
 	/** Same as `list`, with the parameters in a JSON body, for long filters. */
 	const search = async (resource, params) => {
@@ -44,13 +64,13 @@ const createClient = (options = {}) => {
 				fields: params?.fields
 			}
 		});
-		return toPage(await response.json(), response);
+		return toPage(await response.json(), response, origin);
 	};
 	const get = async (resource, key) => {
 		return storedOf(await send({
 			method: "GET",
 			path: keyPath(resource, key)
-		}));
+		}), origin);
 	};
 	const create = async (resource, body) => {
 		const response = await send({
@@ -59,7 +79,7 @@ const createClient = (options = {}) => {
 			body
 		});
 		return {
-			record: await response.json(),
+			record: withFileOrigin(await response.json(), origin),
 			etag: etagOf(response),
 			location: response.headers.get("location") ?? ""
 		};
@@ -71,7 +91,7 @@ const createClient = (options = {}) => {
 			path: keyPath(resource, key),
 			body: patch,
 			headers: { "if-match": etag }
-		}));
+		}), origin);
 	};
 	/** `etag` is the version the user saw (`*` for any); a stale one rejects with `PreconditionFailedError`. */
 	const remove = async (resource, key, { etag } = {}) => {
@@ -88,7 +108,7 @@ const createClient = (options = {}) => {
 			path: `${keyPath(resource, key)}:undelete`
 		});
 		return {
-			record: await response.json(),
+			record: withFileOrigin(await response.json(), origin),
 			etag: etagOf(response)
 		};
 	};
@@ -109,11 +129,12 @@ const createClient = (options = {}) => {
 			..."key" in operation && { key: keyText(operation.key) },
 			...operation.op === "reorder" && { keys: operation.keys.map(keyText) }
 		}));
-		return { results: (await (await send({
+		const response = await send({
 			method: "POST",
 			path: ":batchWrite",
 			body: { ops: wireOps }
-		})).json()).results ?? [] };
+		});
+		return batchResultOf(await response.json(), origin);
 	};
 	const facets = async (resource, field, o = {}) => {
 		return (await (await send({
@@ -168,16 +189,17 @@ const createClient = (options = {}) => {
 				position: params.position
 			})
 		});
-		return toPage(await response.json(), response);
+		return toPage(await response.json(), response, origin);
 	};
-	/** Pass the `etag` of the last result to get `{ status: 'unchanged' }` on a `304`. */
-	const meta = async (etag) => {
+	/** Pass the `etag` of the last result to get `{ status: 'unchanged' }` on a `304`; `signal` gives up waiting. */
+	const meta = async (etag, { signal } = {}) => {
 		const response = await send({
 			method: "GET",
 			path: "/meta",
 			system: true,
 			headers: etag ? { "if-none-match": etag } : void 0,
-			accept: [304]
+			accept: [304],
+			...signal && { signal }
 		});
 		if (response.status === 304) return { status: "unchanged" };
 		return {

package/dist/file-urls.js

@@ -0,0 +1,21 @@
+//#region src/file-urls.ts
+const isFileAtPath = (value) => {
+	if (typeof value !== "object" || value === null) return false;
+	const { uri, url } = value;
+	return typeof uri === "string" && typeof url === "string" && url.startsWith("/") && !url.startsWith("//");
+};
+/** The origin of an absolute `baseUrl`; `undefined` for a path on the page's own origin. */
+const originOf = (baseUrl) => baseUrl !== void 0 && URL.canParse(baseUrl) ? new URL(baseUrl).origin : void 0;
+/**
+* Makes each file of a record download from `origin`: the API answers a file's URL as a path on its own origin, which a
+* page on another origin, or code outside a page, cannot follow. Without an origin the record is returned as it is.
+*/
+const withFileOrigin = (record, origin) => {
+	if (origin === void 0 || typeof record !== "object" || record === null) return record;
+	return Object.fromEntries(Object.entries(record).map(([name, value]) => [name, isFileAtPath(value) ? {
+		...value,
+		url: `${origin}${value.url}`
+	} : value]));
+};
+//#endregion
+export { originOf, withFileOrigin };

package/dist/index.d.ts

@@ -1,9 +1,11 @@
 import { FilterInput, ListParams, filterText, listWire } from "./query-string.js";
 import { ClientOptions } from "./transport.js";
 import { UploadProgress } from "./upload-request.js";
-import { BatchOp, BatchRef, BatchResult, Facet, Histogram, HistogramBucket, ListPage, Meta, MetaResult, PluginRef, RecordOf, RecordPermissions, ResourcePermissions, ResourceRef, Series, SeriesParams, SeriesPoint, Stored, StoredFile } from "./types.js";
+import { BatchOp, BatchRef, BatchResult, Facet, Histogram, HistogramBucket, ListPage, Meta, MetaResult, PluginRef, RecordOf, RecordPermissions, ResourcePermissions, ResourceRef, Series, SeriesParams, SeriesPoint, SourceRef, Stored, StoredFile } from "./types.js";
 import { Client, InvokeOptions, UploadOptions, UploadResult, createClient } from "./client.js";
 import { ApiError, PreconditionFailedError, ProblemDetails, ProblemError, isApiError } from "./problem.js";
+import { routedClient } from "./routed-client.js";
+import { SourceMeta, sourceMeta } from "./source-meta.js";
 import { SignInPolicy, SignInPolicyClient, SignInPolicyState, SignInRule, StaffAccessRule } from "./sign-in-policy.js";
 import { AccountSecurity, AccountSignIn, AuthenticatorSetup, Passkey, RequiredSetup } from "./account-security.js";
 import { CurrentOrganization, InvitationPreview, InvitationSent, Organization, OrganizationInvitation, OrganizationMember, OrganizationRole, OrganizationsClient } from "./organizations.js";
@@ -15,4 +17,4 @@ import { AuthSession, AuthSessionOptions, createAuthSession, tokenExpiry } from
 import { createStaticSession } from "./static-session.js";
 import { AssistantClient, AssistantClientOptions, AssistantConnection, createAssistantClient } from "./assistant.js";
 import { RuntimeClient, RuntimeClientOptions, RuntimePolicy, RuntimeStatus, createRuntimeClient } from "./runtime.js";
-export { type AccountSecurity, type AccountSignIn, type ActiveRole, ApiError, type AssistantClient, type AssistantClientOptions, type AssistantConnection, AuthError, type AuthSession, type AuthSessionOptions, type AuthUser, type AuthenticatorSetup, type BatchOp, type BatchRef, type BatchResult, type Client, type ClientOptions, type CurrentOrganization, type Facet, type FilterInput, type Histogram, type HistogramBucket, type InvitationPreview, type InvitationSent, type InvokeOptions, type ListPage, type ListParams, type Meta, type MetaResult, type Organization, type OrganizationInvitation, type OrganizationMember, type OrganizationRole, type OrganizationsClient, type Passkey, type PlatformSignIn, type PluginRef, PreconditionFailedError, type ProblemDetails, type ProblemError, type RecordOf, type RecordPermissions, type RequiredSetup, type ResourcePermissions, type ResourceRef, type RoleLabel, type RoleOption, type RolesClient, type RuntimeClient, type RuntimeClientOptions, type RuntimePolicy, type RuntimeStatus, type Series, type SeriesParams, type SeriesPoint, type SetupStatus, type SignInMethod, type SignInPolicy, type SignInPolicyClient, type SignInPolicyState, type SignInResult, type SignInRule, type StaffAccessRule, type StaffSignIn, type StaffSignInClient, type Stored, type StoredFile, type TwoFactorMethod, type UploadOptions, type UploadProgress, type UploadResult, createAssistantClient, createAuthSession, createClient, createRuntimeClient, createStaticSession, filterText, isApiError, listWire, tokenExpiry };
+export { type AccountSecurity, type AccountSignIn, type ActiveRole, ApiError, type AssistantClient, type AssistantClientOptions, type AssistantConnection, AuthError, type AuthSession, type AuthSessionOptions, type AuthUser, type AuthenticatorSetup, type BatchOp, type BatchRef, type BatchResult, type Client, type ClientOptions, type CurrentOrganization, type Facet, type FilterInput, type Histogram, type HistogramBucket, type InvitationPreview, type InvitationSent, type InvokeOptions, type ListPage, type ListParams, type Meta, type MetaResult, type Organization, type OrganizationInvitation, type OrganizationMember, type OrganizationRole, type OrganizationsClient, type Passkey, type PlatformSignIn, type PluginRef, PreconditionFailedError, type ProblemDetails, type ProblemError, type RecordOf, type RecordPermissions, type RequiredSetup, type ResourcePermissions, type ResourceRef, type RoleLabel, type RoleOption, type RolesClient, type RuntimeClient, type RuntimeClientOptions, type RuntimePolicy, type RuntimeStatus, type Series, type SeriesParams, type SeriesPoint, type SetupStatus, type SignInMethod, type SignInPolicy, type SignInPolicyClient, type SignInPolicyState, type SignInResult, type SignInRule, type SourceMeta, type SourceRef, type StaffAccessRule, type StaffSignIn, type StaffSignInClient, type Stored, type StoredFile, type TwoFactorMethod, type UploadOptions, type UploadProgress, type UploadResult, createAssistantClient, createAuthSession, createClient, createRuntimeClient, createStaticSession, filterText, isApiError, listWire, routedClient, sourceMeta, tokenExpiry };

package/dist/index.js

@@ -1,9 +1,11 @@
 import { filterText, listWire } from "./query-string.js";
 import { ApiError, PreconditionFailedError, isApiError } from "./problem.js";
 import { createClient } from "./client.js";
+import { routedClient } from "./routed-client.js";
+import { sourceMeta } from "./source-meta.js";
 import { AuthError } from "./auth-error.js";
 import { createAuthSession, tokenExpiry } from "./auth.js";
 import { createStaticSession } from "./static-session.js";
 import { createAssistantClient } from "./assistant.js";
 import { createRuntimeClient } from "./runtime.js";
-export { ApiError, AuthError, PreconditionFailedError, createAssistantClient, createAuthSession, createClient, createRuntimeClient, createStaticSession, filterText, isApiError, listWire, tokenExpiry };
+export { ApiError, AuthError, PreconditionFailedError, createAssistantClient, createAuthSession, createClient, createRuntimeClient, createStaticSession, filterText, isApiError, listWire, routedClient, sourceMeta, tokenExpiry };

package/dist/routed-client.d.ts

@@ -0,0 +1,10 @@
+import { Client } from "./client.js";
+//#region src/routed-client.d.ts
+/**
+ * One client over the app's own API and the sources it draws resources from: a call about a resource goes to the API
+ * that serves it (`sourceOf` gives a source's client, or `undefined` for the app's own), and `meta` and `invoke` go to
+ * the app's own. A batch goes to the one API all its writes are for; one that writes to two cannot be atomic, so it is
+ * refused before anything is sent.
+ */
+export declare const routedClient: (own: Client, sourceOf: (resource: string) => Client | undefined) => Client;
+//#endregion

package/dist/routed-client.js

@@ -0,0 +1,35 @@
+//#region src/routed-client.ts
+const nameOf = (resource) => typeof resource === "string" ? resource : resource.toModel().name;
+/**
+* One client over the app's own API and the sources it draws resources from: a call about a resource goes to the API
+* that serves it (`sourceOf` gives a source's client, or `undefined` for the app's own), and `meta` and `invoke` go to
+* the app's own. A batch goes to the one API all its writes are for; one that writes to two cannot be atomic, so it is
+* refused before anything is sent.
+*/
+const routedClient = (own, sourceOf) => {
+	const to = (resource) => sourceOf(nameOf(resource)) ?? own;
+	return {
+		list: (resource, params) => to(resource).list(resource, params),
+		search: (resource, params) => to(resource).search(resource, params),
+		get: (resource, key) => to(resource).get(resource, key),
+		create: (resource, body) => to(resource).create(resource, body),
+		update: (resource, key, patch, etag) => to(resource).update(resource, key, patch, etag),
+		remove: (resource, key, options) => to(resource).remove(resource, key, options),
+		undelete: (resource, key) => to(resource).undelete(resource, key),
+		reveal: (resource, key, field) => to(resource).reveal(resource, key, field),
+		batchWrite: (ops) => {
+			const apis = [...new Set(ops.map((op) => to(op.resource)))];
+			if (apis.length > 1) return Promise.reject(/* @__PURE__ */ new Error(`A batch writes to one API, but these writes are for ${[...new Set(ops.map((op) => nameOf(op.resource)))].join(", ")}, which different APIs serve`));
+			return (apis[0] ?? own).batchWrite(ops);
+		},
+		facets: (resource, field, options) => to(resource).facets(resource, field, options),
+		series: (resource, params) => to(resource).series(resource, params),
+		histogram: (resource, field, options) => to(resource).histogram(resource, field, options),
+		seek: (resource, params) => to(resource).seek(resource, params),
+		meta: (etag, options) => own.meta(etag, options),
+		invoke: (name, options) => own.invoke(name, options),
+		upload: (resource, field, file, options) => to(resource).upload(resource, field, file, options)
+	};
+};
+//#endregion
+export { routedClient };

package/dist/source-meta.d.ts

@@ -0,0 +1,16 @@
+import { Meta, ResourcePermissions, SourceRef } from "./types.js";
+import { ResourceModel, ViewModel } from "@protobase/schema";
+//#region src/source-meta.d.ts
+/** What the app draws of a source: the resources it lists that the user may see there, their views and what the user may do. */
+export type SourceMeta = {
+  resources: ResourceModel[];
+  views: ViewModel[];
+  permissions: Record<string, ResourcePermissions>;
+};
+/**
+ * The part of a source's `/meta` the app draws: the resources `source` lists, of those the source names to the user,
+ * with their views and permissions. Nothing in them leads out of the source: a relation to a resource the app does not
+ * draw from it shows its key, and related records of one, columns through one and links to one or to a page go.
+ */
+export declare const sourceMeta: (meta: Meta, source: SourceRef) => SourceMeta;
+//#endregion

package/dist/source-meta.js

@@ -0,0 +1,49 @@
+import { addressErrors } from "@protobase/schema";
+import { resolveFieldPath } from "@protobase/layout";
+//#region src/source-meta.ts
+const withinSource = (model, drawn) => ({
+	...model,
+	fields: Object.fromEntries(Object.entries(model.fields).map(([name, field]) => {
+		if (!field.relation || Object.hasOwn(drawn, field.relation.resource)) return [name, field];
+		const { relation: _outside, ...plain } = field;
+		return [name, plain];
+	}))
+});
+const keptLayoutItem = (item, models) => {
+	if (item.kind !== "related") return [item];
+	if (!Object.hasOwn(models, item.resource) || item.through && !Object.hasOwn(models, item.through.resource)) return [];
+	const { columns, ...rest } = item;
+	const kept = columns?.filter((column) => resolveFieldPath(models, item.resource, column).ok);
+	return [kept && kept.length > 0 ? {
+		...rest,
+		columns: kept
+	} : rest];
+};
+const keptAction = (action, model, models) => action.run?.kind !== "link" || !("to" in action.run) || addressErrors(action.run.to, {
+	models,
+	pages: /* @__PURE__ */ new Set(),
+	source: model
+}).length === 0;
+const withinSourceView = (view, models) => ({
+	...view,
+	layout: view.layout.flatMap((item) => keptLayoutItem(item, models)),
+	actions: view.actions.filter((action) => keptAction(action, models[view.resource], models))
+});
+/**
+* The part of a source's `/meta` the app draws: the resources `source` lists, of those the source names to the user,
+* with their views and permissions. Nothing in them leads out of the source: a relation to a resource the app does not
+* draw from it shows its key, and related records of one, columns through one and links to one or to a page go.
+*/
+const sourceMeta = (meta, source) => {
+	const listed = meta.resources.filter((model) => source.resources.includes(model.name));
+	const models = Object.fromEntries(listed.map((model) => [model.name, model]));
+	const resources = listed.map((model) => withinSource(model, models));
+	const scoped = Object.fromEntries(resources.map((model) => [model.name, model]));
+	return {
+		resources,
+		views: meta.views.filter((view) => Object.hasOwn(scoped, view.resource)).map((view) => withinSourceView(view, scoped)),
+		permissions: Object.fromEntries(listed.flatMap((model) => meta.permissions?.[model.name] ? [[model.name, meta.permissions[model.name]]] : []))
+	};
+};
+//#endregion
+export { sourceMeta };

package/dist/types.d.ts

@@ -67,6 +67,7 @@ export type ResourcePermissions = {
  * `runtime`: the runtime updates endpoint, for a caller with the `admin` role when the app has one.
  * `bottomBar`: the tabs on phones, of the bottom bar that names the caller's active role.
  * `plugins`: the plugins the admin app loads for the caller, each by its plugin.json.
+ * `sources`: the other APIs whose resources the admin app draws for the caller.
  */
 export type Meta = {
   resources: ResourceModel[];
@@ -82,12 +83,22 @@ export type Meta = {
     url: string;
   };
   plugins?: PluginRef[];
+  sources?: SourceRef[];
 };
 /** A plugin as `/meta` names it: the URL of its plugin.json, and the settings it reads with `usePlugin()`. */
 export type PluginRef = {
   url: string;
   settings?: Record<string, unknown>;
 };
+/**
+ * Another Protobase API as `/meta` names it: `url` is its resources API (`.../api/v1`), `label` its name as people read
+ * it, and `resources` the ones the app draws from it, with its own `/meta` and data, at their own addresses.
+ */
+export type SourceRef = {
+  url: string;
+  label: string;
+  resources: string[];
+};
 export type MetaResult = {
   status: 'modified';
   meta: Meta;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/client",
-  "version": "0.12.2",
+  "version": "0.12.3",
   "description": "Typed fetch client for the Protobase REST API.",
   "license": "Apache-2.0",
   "repository": {
@@ -30,8 +30,8 @@
   },
   "dependencies": {
     "@better-auth/passkey": "^1.7.7",
-    "@protobase/layout": "0.12.2",
-    "@protobase/schema": "0.12.2",
+    "@protobase/layout": "0.12.3",
+    "@protobase/schema": "0.12.3",
     "@simplewebauthn/browser": "^13.3.0",
     "better-auth": "^1.7.7"
   }