@rebasepro/client 0.11.1-canary.gfd39654 → 0.12.1-canary.g06f263c

package/dist/api-keys.d.ts

@@ -1,42 +1,14 @@
 import type { Transport } from "./transport";
-/** A single permission entry scoping an API key to a collection and its allowed operations. */
-export interface ApiKeyPermission {
-    collection: string;
-    operations: ("read" | "write" | "delete")[];
-}
-/** An API key with the secret portion masked (returned by list / get / update). */
-export interface ApiKeyMasked {
-    id: string;
-    name: string;
-    key_prefix: string;
-    permissions: ApiKeyPermission[];
-    admin: boolean;
-    rate_limit: number | null;
-    created_by: string;
-    created_at: string;
-    updated_at: string;
-    last_used_at: string | null;
-    expires_at: string | null;
-    revoked_at: string | null;
-}
-/** An API key including the full secret (returned only on creation). */
-export interface ApiKeyWithSecret extends ApiKeyMasked {
-    key: string;
-}
-/** Payload for creating a new API key. */
-export interface CreateApiKeyRequest {
-    name: string;
-    permissions: ApiKeyPermission[];
-    rate_limit?: number | null;
-    expires_at?: string | null;
-}
-/** Payload for updating an existing API key. */
-export interface UpdateApiKeyRequest {
-    name?: string;
-    permissions?: ApiKeyPermission[];
-    rate_limit?: number | null;
-    expires_at?: string | null;
-}
+/**
+ * These were re-declared here, under a comment saying they lived in the server
+ * package rather than in `@rebasepro/types`. That stopped being true, and the
+ * copy drifted: it never gained `admin`, the flag that grants a key the `admin`
+ * role — admin routes plus the RLS `default_admin` policies — so the SDK could
+ * describe every kind of key except a privileged one, and
+ * `createKey({ …, admin: true })` was an excess-property error.
+ */
+export type { ApiKeyPermission, ApiKeyMasked, ApiKeyWithSecret, CreateApiKeyRequest, UpdateApiKeyRequest } from "@rebasepro/types";
+import type { ApiKeyMasked, ApiKeyWithSecret, CreateApiKeyRequest, UpdateApiKeyRequest } from "@rebasepro/types";
 /** Options for the `createApiKeys` factory. */
 export interface CreateApiKeysOptions {
     apiKeysPath?: string;

package/dist/auth.d.ts

@@ -128,6 +128,7 @@ export declare function createAuth(transport: Transport, options?: CreateAuthOpt
         refreshToken: string;
     }>;
     signOut: () => Promise<void>;
+    stopAutoRefresh: () => void;
     refreshSession: () => Promise<RebaseSession>;
     handleUnauthorized: () => Promise<boolean>;
     getUser: () => Promise<User>;
@@ -180,6 +181,7 @@ export declare function createAuth(transport: Transport, options?: CreateAuthOpt
     getAuthConfig: () => Promise<AuthConfig>;
     getSession: () => RebaseSession | null;
     onAuthStateChange: (callback: (event: AuthChangeEvent, session: RebaseSession | null) => void) => () => boolean;
+    canRestoreSession: () => boolean;
     isInitialized: () => Promise<void>;
 };
 export interface CookieStorageOptions {

package/dist/functions.d.ts

@@ -27,14 +27,8 @@ export interface FunctionsClient {
      */
     invoke<T = unknown>(name: string, payload?: unknown, options?: FunctionInvokeOptions): Promise<T>;
 }
-export interface FunctionInvokeOptions {
-    /** HTTP method — defaults to `"POST"`. */
-    method?: "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
-    /** Sub-path appended after the function name, e.g. `"status/123"`. */
-    path?: string;
-    /** Extra headers merged into the request (auth is still injected automatically). */
-    headers?: Record<string, string>;
-}
+export type { FunctionInvokeOptions } from "@rebasepro/types";
+import type { FunctionInvokeOptions } from "@rebasepro/types";
 /**
  * Create a `FunctionsClient` backed by the given transport.
  *

package/dist/index.d.ts

@@ -15,6 +15,9 @@ export { RebaseClientError } from "./errors";
 export type { RebaseClientConfig, FindParams, FindResponse } from "./transport";
 export type { CollectionClient } from "./collection";
 export type { FindResult, SDKCollectionClient, SDKQueryBuilderInterface, PaginationMeta } from "@rebasepro/types";
+export type { IterateParams, FindAllParams, PageWalkOptions, CursorSpec } from "@rebasepro/types";
+export { RebasePaginationError } from "@rebasepro/common";
+export type { PaginationErrorCode } from "@rebasepro/common";
 export { QueryBuilder, or, and, cond } from "@rebasepro/common";
 export { createCookieStorage, createMemoryStorage } from "./auth";
 export type { AuthConfig, AuthStorage, CookieStorageOptions, CreateAuthOptions } from "./auth";
@@ -117,11 +120,17 @@ export type CreateRebaseClientResult<DB = Record<string, unknown>> = Omit<Rebase
         channel: (name: string, options?: ChannelOptions) => RebaseRealtimeChannel;
     };
     /**
-     * Release the realtime socket and its reconnect timer.
+     * Release everything this client holds that can keep a process alive: the
+     * realtime socket and its reconnect timer, channel presence heartbeats, the
+     * offline manager, and the scheduled token refresh.
      *
-     * An open socket keeps the Node event loop alive, so a script that does not
-     * call this will not exit on its own. Safe when realtime was never started
-     * (`realtime: false`), and safe to call twice.
+     * Each of those keeps the Node event loop alive on its own, so a script
+     * that does not call this will not exit — and, until the refresh timer was
+     * included, one that *did* call it still would not if it had signed in.
+     *
+     * Safe when realtime was never started (`realtime: false`), safe when
+     * signed out, and safe to call twice. It does not sign the user out: a
+     * persisted session survives for the next client to restore.
      */
     close: () => void;
     storage: StorageSource;

package/dist/index.es.js

@@ -1,5 +1,5 @@
 import { DEFAULT_STORAGE_SOURCE_KEY, EntityReference, EntityRelation, GeoPoint, PUBLIC_STORAGE_PREFIX, RebaseApiError, RebaseApiError as RebaseApiError$1, RebaseClientError, Vector, isPublicStoragePath, toCanonicalOp } from "@rebasepro/types";
-import { COMPOSITE_ID_SEPARATOR, QueryBuilder, and, buildCompositeId, cond, or, serializeFilter, serializeLogicalCondition, serializeOrderBy } from "@rebasepro/common";
+import { COMPOSITE_ID_SEPARATOR, QueryBuilder, RebasePaginationError, and, buildCompositeId, collectAllPages, cond, or, paginateFind, serializeFilter, serializeLogicalCondition, serializeOrderBy } from "@rebasepro/common";
 import { toSnakeCase } from "@rebasepro/utils";
 //#region src/reviver.ts
 function rebaseReviver(_key, value) {
@@ -30,6 +30,25 @@ function rebaseReviver(_key, value) {
 }
 //#endregion
 //#region src/transport.ts
+/**
+* True when there is no browser to have signed a user in — a Node script, a
+* cron job, an edge worker.
+*
+* Anonymous is an ordinary, correct state in a browser: before sign-in, on a
+* marketing page, for public reads. Warning there would be noise that teaches
+* people to ignore warnings, so the guard is off entirely. This uses the same
+* `typeof window` test as {@link resolveBaseUrl}, and additionally treats a
+* defined `document` as a browser so an SSR shim or test harness that installs
+* only one of the two is still excluded.
+*/
+function isServerLikeEnvironment() {
+	return typeof window === "undefined" && typeof document === "undefined";
+}
+/**
+* Emitted once per client. Kept as a constant so the wording is testable and
+* greppable — this is the string a user will paste into a search.
+*/
+var ANONYMOUS_SERVER_CLIENT_WARNING = "[rebase] This client was created outside a browser with no credential — no `token`, no auth token getter, and no cookie auth flow — so every request runs as an anonymous caller. Row-level security will return only publicly readable rows, which is usually nothing and occasionally the wrong thing. Inside a cron or function handler, use the `client` you were handed instead of building a new one: its data plane is already admin-scoped. In a standalone script or job, pass the service key as `token`. If you really do want anonymous access, pass `anonymous: true` to silence this.";
 function buildQueryString(params) {
 	if (!params) return "";
 	const parts = [];
@@ -76,12 +95,31 @@ function resolveBaseUrl(configured) {
 	if (typeof window !== "undefined" && window.location?.origin) return window.location.origin;
 	return "";
 }
-function createTransport(config) {
+function createTransport(config, environment) {
 	const fetchFn = config.fetch || globalThis.fetch;
 	const apiPath = config.apiPath || "/api";
 	let token = config.token;
 	let tokenGetter;
 	let onUnauthorizedHandler = config.onUnauthorized;
+	/** Once per client, never per request — log spam is its own bug. */
+	let anonymousWarningIssued = false;
+	/**
+	* Warn a server-side caller that it built a client that can only ever be
+	* anonymous. Deliberately checked at the *first request* rather than at
+	* construction: `setToken()` / `setAuthTokenGetter()` and a server-side
+	* `auth.signIn…()` (which calls `transport.setToken`) all land after the
+	* constructor, and warning at construction would fire on every one of them.
+	*/
+	function warnIfAnonymousServerClient(activeToken) {
+		if (anonymousWarningIssued) return;
+		if (activeToken) return;
+		if (tokenGetter) return;
+		if (config.anonymous) return;
+		if (environment?.credentialOutOfBand) return;
+		if (!isServerLikeEnvironment()) return;
+		anonymousWarningIssued = true;
+		console.warn(ANONYMOUS_SERVER_CLIENT_WARNING);
+	}
 	function getHeaders(activeToken, init) {
 		return {
 			"Content-Type": "application/json",
@@ -96,6 +134,7 @@ function createTransport(config) {
 			const fetched = await tokenGetter();
 			if (fetched !== null && fetched !== void 0) activeToken = fetched;
 		} catch (e) {}
+		warnIfAnonymousServerClient(activeToken);
 		const headers = getHeaders(activeToken, init);
 		if (init?.body instanceof FormData) delete headers["Content-Type"];
 		const res = await fetchFn(url, {
@@ -379,6 +418,29 @@ function createAuth(transport, options) {
 			attemptScheduledRefresh(0);
 		}, delay);
 	}
+	/**
+	* Stop the scheduled token refresh, leaving the session itself alone.
+	*
+	* This is teardown, not sign-out. `scheduleRefresh` arms an ordinary
+	* `setTimeout` up to a token lifetime away, and it is not `unref`'d — so on
+	* Node it holds the event loop open by itself. `client.close()` promised
+	* that "a script that does not call this will not exit on its own", which
+	* was true, while the converse it plainly implies was not: a signed-in
+	* client that closed its socket still hung, because this timer outlived it.
+	* Any script, cron handler or job that signs in hit that.
+	*
+	* Deliberately does NOT clear the session, touch storage, or emit
+	* SIGNED_OUT. Closing a client is not the user signing out — `signOut()`
+	* POSTs /logout and revokes the whole sign-in, which is the wrong hammer
+	* (see `abandonSessionLocally`) — and a persisted session must still be
+	* there for the next client to restore.
+	*/
+	function stopAutoRefresh() {
+		if (refreshTimeout) {
+			clearTimeout(refreshTimeout);
+			refreshTimeout = null;
+		}
+	}
 	function handleAuthResponse(data, event) {
 		const user = mapRawUser(data.user);
 		const session = {
@@ -849,6 +911,7 @@ function createAuth(transport, options) {
 		signInWithSlack,
 		signInWithSpotify,
 		signOut,
+		stopAutoRefresh,
 		refreshSession,
 		handleUnauthorized,
 		getUser,
@@ -868,6 +931,7 @@ function createAuth(transport, options) {
 		getAuthConfig,
 		getSession,
 		onAuthStateChange,
+		canRestoreSession: () => persistSession || authFlowMode === "cookie",
 		isInitialized: () => isInitialized
 	};
 }
@@ -1184,6 +1248,12 @@ function createCollectionClient(transport, slug, ws) {
 				meta: raw.meta
 			};
 		},
+		iterate(params) {
+			return paginateFind((p) => client.find(p), params, slug);
+		},
+		findAll(params) {
+			return collectAllPages((p) => client.find(p), params, slug);
+		},
 		async findById(id) {
 			try {
 				const raw = await transport.request(`${basePath}/${encodeURIComponent(String(id))}`, { method: "GET" });
@@ -1373,7 +1443,8 @@ function createCollectionClient(transport, slug, ws) {
 function createFunctionsClient(transport) {
 	return { async invoke(name, payload, options) {
 		const method = options?.method ?? "POST";
-		const subPath = options?.path ? `/${options.path.replace(/^\//, "")}` : "";
+		const rawPath = options?.path;
+		const subPath = rawPath ? /^[?#]/.test(rawPath) ? rawPath : `/${rawPath.replace(/^\//, "")}` : "";
 		const routePath = `/functions/${encodeURIComponent(name)}${subPath}`;
 		const init = { method };
 		if (payload !== void 0 && method !== "GET") init.body = JSON.stringify(payload);
@@ -1587,7 +1658,7 @@ function extractMessageError(message) {
 * Fire-and-forget (the server sends no response envelope), and exempt from the
 * client-side auth gate — a public channel is usable without an account.
 */
-var CHANNEL_MESSAGE_TYPES = new Set([
+var CHANNEL_MESSAGE_TYPES = /* @__PURE__ */ new Set([
 	"join_channel",
 	"leave_channel",
 	"broadcast",
@@ -1616,6 +1687,17 @@ var RebaseWebSocketClient = class {
 	/** Set by `close()`. Blocks any later operation from silently redialling. */
 	closedByCaller = false;
 	/**
+	* Set when the backoff budget ran out, cleared by anything that earns a
+	* fresh one.
+	*
+	* Unlike {@link closedByCaller} this is not final — nobody *asked* for the
+	* socket to stay down. Five attempts with exponential backoff is about a
+	* minute, which a laptop lid, a wifi handover or a backend rollout all
+	* exceed routinely; treating that as permanent meant realtime silently
+	* stopped for the rest of the page's life, with a reload the only cure.
+	*/
+	gaveUp = false;
+	/**
 	* Whether a socket exists at all (open or still opening).
 	*
 	* Lets callers distinguish "authenticate the live socket" from "there is
@@ -1688,10 +1770,30 @@ var RebaseWebSocketClient = class {
 			}
 			return;
 		}
+		this.installOnlineListener();
 		if (this.ws || this.reconnectTimeout) return;
+		if (this.gaveUp) {
+			this.gaveUp = false;
+			this.reconnectAttempts = 0;
+		}
 		this.initWebSocket();
 	}
 	/**
+	* The browser says the network is back — the usual reason the budget ran
+	* out in the first place. Registered lazily so a Node client, or a page
+	* that never subscribes, adds no listener.
+	*/
+	installOnlineListener() {
+		if (this.onlineListener || typeof window === "undefined" || typeof window.addEventListener !== "function") return;
+		this.onlineListener = () => {
+			if (this.closedByCaller || !this.gaveUp) return;
+			console.debug("Network is back — retrying the realtime connection");
+			this.ensureConnected();
+		};
+		window.addEventListener("online", this.onlineListener);
+	}
+	onlineListener = null;
+	/**
 	* Authenticate the WebSocket connection
 	*/
 	async authenticate(token) {
@@ -1749,6 +1851,10 @@ var RebaseWebSocketClient = class {
 	*/
 	disconnect(permanent = false) {
 		if (permanent) this.closedByCaller = true;
+		if (permanent && this.onlineListener && typeof window !== "undefined") {
+			window.removeEventListener("online", this.onlineListener);
+			this.onlineListener = null;
+		}
 		this.isAuthenticated = false;
 		this.authPromise = null;
 		if (this.reconnectTimeout) {
@@ -1773,7 +1879,8 @@ var RebaseWebSocketClient = class {
 			this.ws = null;
 		}
 		try {
-			this.ws = new this.WebSocketConstructor(this.websocketUrl);
+			const socket = new this.WebSocketConstructor(this.websocketUrl);
+			this.ws = socket;
 			this.ws.onopen = async () => {
 				console.debug("Connected to PostgreSQL backend");
 				const wasReconnect = this.reconnectAttempts > 0;
@@ -1803,6 +1910,7 @@ var RebaseWebSocketClient = class {
 			};
 			this.ws.onclose = () => {
 				console.debug("Disconnected from PostgreSQL backend");
+				if (this.ws === socket) this.ws = null;
 				this.isConnected = false;
 				this.isAuthenticated = false;
 				this.authPromise = null;
@@ -1838,6 +1946,7 @@ var RebaseWebSocketClient = class {
 	attemptReconnect() {
 		if (this.reconnectAttempts >= this.maxReconnectAttempts) {
 			console.error("Max reconnection attempts reached");
+			this.gaveUp = true;
 			this.failAllPendingSubscriptions(new RebaseApiError$1("Connection lost", { code: "CONNECTION_LOST" }));
 			return;
 		}
@@ -2380,7 +2489,7 @@ var RebaseWebSocketClient = class {
 			if (this.deepEqual(normCached, normIncoming)) return cachedRow;
 			else {
 				const mismatches = {};
-				const allKeys = new Set([...Object.keys(normCached), ...Object.keys(normIncoming)]);
+				const allKeys = /* @__PURE__ */ new Set([...Object.keys(normCached), ...Object.keys(normIncoming)]);
 				for (const key of allKeys) if (!this.deepEqual(normCached[key], normIncoming[key])) mismatches[key] = {
 					cached: normCached[key],
 					incoming: normIncoming[key]
@@ -3183,7 +3292,7 @@ function isNetworkError(error) {
 * bug the same payload will hit again than a blip, and retrying it forever
 * jams every write behind it.
 */
-var RETRYABLE_STATUSES = new Set([
+var RETRYABLE_STATUSES = /* @__PURE__ */ new Set([
 	408,
 	425,
 	429,
@@ -4008,6 +4117,8 @@ var OfflineManager = class {
 					meta: answer.meta
 				};
 			},
+			iterate: (params) => paginateFind((p) => wrapped.find(p), params, slug),
+			findAll: (params) => collectAllPages((p) => wrapped.find(p), params, slug),
 			findById: async (id) => {
 				await this.ensureCollection(slug);
 				if (this.connectivity.shouldAttempt()) try {
@@ -5077,7 +5188,7 @@ function deriveWebSocketUrl(baseUrl) {
 	return baseUrl.replace(/^https?:\/\//i, (match) => match.toLowerCase() === "https://" ? "wss://" : "ws://").replace(/\/$/, "");
 }
 function createRebaseClient(options) {
-	const transport = createTransport(options);
+	const transport = createTransport(options, { credentialOutOfBand: options.auth?.authFlowMode === "cookie" });
 	const auth = createAuth(transport, options.auth);
 	const admin = createAdmin(transport, options.admin);
 	const cron = createCron(transport, options.cron);
@@ -5231,23 +5342,25 @@ channel: (name, options) => {
 			return existing;
 		} },
 		/**
-		* Release the realtime socket and its reconnect timer.
+		* Release every handle that can keep a process alive — see the
+		* `close` docblock on the client interface.
 		*
-		* Until this returns, the open socket keeps the Node event loop alive
-		* and the process will not exit on its own. Safe to call when realtime
-		* was never started, and safe to call twice.
+		* Safe to call when realtime was never started, safe when signed out,
+		* and safe to call twice.
 		*/
 		close: () => {
 			for (const channel of realtimeChannels.values()) channel.leave();
 			realtimeChannels.clear();
 			ws?.disconnect(true);
 			offlineManager?.dispose();
+			auth.stopAutoRefresh();
 		},
 		setToken: transport.setToken,
 		setAuthTokenGetter: transport.setAuthTokenGetter,
 		setOnUnauthorized: transport.setOnUnauthorized,
 		resolveToken: transport.resolveToken,
 		baseUrl: transport.baseUrl,
+		apiPath: transport.apiPath,
 		collection,
 		call: async (endpoint, payload) => {
 			const prefix = endpoint.startsWith("/") ? "" : "/";
@@ -5262,6 +5375,6 @@ channel: (name, options) => {
 	};
 }
 //#endregion
-export { MemoryOfflineStore, QueryBuilder, RebaseApiError, RebaseClientError, RebaseRealtimeChannel, RebaseWebSocketClient, and, cond, createBackups, createCookieStorage, createMemoryStorage, createRebaseClient, isOfflineError, or };
+export { MemoryOfflineStore, QueryBuilder, RebaseApiError, RebaseClientError, RebasePaginationError, RebaseRealtimeChannel, RebaseWebSocketClient, and, cond, createBackups, createCookieStorage, createMemoryStorage, createRebaseClient, isOfflineError, or };
 
 //# sourceMappingURL=index.es.js.map