@rebasepro/client 0.12.0 → 0.12.1-canary.g06f263c

package/dist/auth.d.ts

@@ -128,6 +128,7 @@ export declare function createAuth(transport: Transport, options?: CreateAuthOpt
         refreshToken: string;
     }>;
     signOut: () => Promise<void>;
+    stopAutoRefresh: () => void;
     refreshSession: () => Promise<RebaseSession>;
     handleUnauthorized: () => Promise<boolean>;
     getUser: () => Promise<User>;
@@ -180,6 +181,7 @@ export declare function createAuth(transport: Transport, options?: CreateAuthOpt
     getAuthConfig: () => Promise<AuthConfig>;
     getSession: () => RebaseSession | null;
     onAuthStateChange: (callback: (event: AuthChangeEvent, session: RebaseSession | null) => void) => () => boolean;
+    canRestoreSession: () => boolean;
     isInitialized: () => Promise<void>;
 };
 export interface CookieStorageOptions {

package/dist/index.d.ts

@@ -120,11 +120,17 @@ export type CreateRebaseClientResult<DB = Record<string, unknown>> = Omit<Rebase
         channel: (name: string, options?: ChannelOptions) => RebaseRealtimeChannel;
     };
     /**
-     * Release the realtime socket and its reconnect timer.
+     * Release everything this client holds that can keep a process alive: the
+     * realtime socket and its reconnect timer, channel presence heartbeats, the
+     * offline manager, and the scheduled token refresh.
      *
-     * An open socket keeps the Node event loop alive, so a script that does not
-     * call this will not exit on its own. Safe when realtime was never started
-     * (`realtime: false`), and safe to call twice.
+     * Each of those keeps the Node event loop alive on its own, so a script
+     * that does not call this will not exit — and, until the refresh timer was
+     * included, one that *did* call it still would not if it had signed in.
+     *
+     * Safe when realtime was never started (`realtime: false`), safe when
+     * signed out, and safe to call twice. It does not sign the user out: a
+     * persisted session survives for the next client to restore.
      */
     close: () => void;
     storage: StorageSource;

package/dist/index.es.js

@@ -418,6 +418,29 @@ function createAuth(transport, options) {
 			attemptScheduledRefresh(0);
 		}, delay);
 	}
+	/**
+	* Stop the scheduled token refresh, leaving the session itself alone.
+	*
+	* This is teardown, not sign-out. `scheduleRefresh` arms an ordinary
+	* `setTimeout` up to a token lifetime away, and it is not `unref`'d — so on
+	* Node it holds the event loop open by itself. `client.close()` promised
+	* that "a script that does not call this will not exit on its own", which
+	* was true, while the converse it plainly implies was not: a signed-in
+	* client that closed its socket still hung, because this timer outlived it.
+	* Any script, cron handler or job that signs in hit that.
+	*
+	* Deliberately does NOT clear the session, touch storage, or emit
+	* SIGNED_OUT. Closing a client is not the user signing out — `signOut()`
+	* POSTs /logout and revokes the whole sign-in, which is the wrong hammer
+	* (see `abandonSessionLocally`) — and a persisted session must still be
+	* there for the next client to restore.
+	*/
+	function stopAutoRefresh() {
+		if (refreshTimeout) {
+			clearTimeout(refreshTimeout);
+			refreshTimeout = null;
+		}
+	}
 	function handleAuthResponse(data, event) {
 		const user = mapRawUser(data.user);
 		const session = {
@@ -888,6 +911,7 @@ function createAuth(transport, options) {
 		signInWithSlack,
 		signInWithSpotify,
 		signOut,
+		stopAutoRefresh,
 		refreshSession,
 		handleUnauthorized,
 		getUser,
@@ -907,6 +931,7 @@ function createAuth(transport, options) {
 		getAuthConfig,
 		getSession,
 		onAuthStateChange,
+		canRestoreSession: () => persistSession || authFlowMode === "cookie",
 		isInitialized: () => isInitialized
 	};
 }
@@ -1418,7 +1443,8 @@ function createCollectionClient(transport, slug, ws) {
 function createFunctionsClient(transport) {
 	return { async invoke(name, payload, options) {
 		const method = options?.method ?? "POST";
-		const subPath = options?.path ? `/${options.path.replace(/^\//, "")}` : "";
+		const rawPath = options?.path;
+		const subPath = rawPath ? /^[?#]/.test(rawPath) ? rawPath : `/${rawPath.replace(/^\//, "")}` : "";
 		const routePath = `/functions/${encodeURIComponent(name)}${subPath}`;
 		const init = { method };
 		if (payload !== void 0 && method !== "GET") init.body = JSON.stringify(payload);
@@ -1632,7 +1658,7 @@ function extractMessageError(message) {
 * Fire-and-forget (the server sends no response envelope), and exempt from the
 * client-side auth gate — a public channel is usable without an account.
 */
-var CHANNEL_MESSAGE_TYPES = new Set([
+var CHANNEL_MESSAGE_TYPES = /* @__PURE__ */ new Set([
 	"join_channel",
 	"leave_channel",
 	"broadcast",
@@ -1661,6 +1687,17 @@ var RebaseWebSocketClient = class {
 	/** Set by `close()`. Blocks any later operation from silently redialling. */
 	closedByCaller = false;
 	/**
+	* Set when the backoff budget ran out, cleared by anything that earns a
+	* fresh one.
+	*
+	* Unlike {@link closedByCaller} this is not final — nobody *asked* for the
+	* socket to stay down. Five attempts with exponential backoff is about a
+	* minute, which a laptop lid, a wifi handover or a backend rollout all
+	* exceed routinely; treating that as permanent meant realtime silently
+	* stopped for the rest of the page's life, with a reload the only cure.
+	*/
+	gaveUp = false;
+	/**
 	* Whether a socket exists at all (open or still opening).
 	*
 	* Lets callers distinguish "authenticate the live socket" from "there is
@@ -1733,10 +1770,30 @@ var RebaseWebSocketClient = class {
 			}
 			return;
 		}
+		this.installOnlineListener();
 		if (this.ws || this.reconnectTimeout) return;
+		if (this.gaveUp) {
+			this.gaveUp = false;
+			this.reconnectAttempts = 0;
+		}
 		this.initWebSocket();
 	}
 	/**
+	* The browser says the network is back — the usual reason the budget ran
+	* out in the first place. Registered lazily so a Node client, or a page
+	* that never subscribes, adds no listener.
+	*/
+	installOnlineListener() {
+		if (this.onlineListener || typeof window === "undefined" || typeof window.addEventListener !== "function") return;
+		this.onlineListener = () => {
+			if (this.closedByCaller || !this.gaveUp) return;
+			console.debug("Network is back — retrying the realtime connection");
+			this.ensureConnected();
+		};
+		window.addEventListener("online", this.onlineListener);
+	}
+	onlineListener = null;
+	/**
 	* Authenticate the WebSocket connection
 	*/
 	async authenticate(token) {
@@ -1794,6 +1851,10 @@ var RebaseWebSocketClient = class {
 	*/
 	disconnect(permanent = false) {
 		if (permanent) this.closedByCaller = true;
+		if (permanent && this.onlineListener && typeof window !== "undefined") {
+			window.removeEventListener("online", this.onlineListener);
+			this.onlineListener = null;
+		}
 		this.isAuthenticated = false;
 		this.authPromise = null;
 		if (this.reconnectTimeout) {
@@ -1818,7 +1879,8 @@ var RebaseWebSocketClient = class {
 			this.ws = null;
 		}
 		try {
-			this.ws = new this.WebSocketConstructor(this.websocketUrl);
+			const socket = new this.WebSocketConstructor(this.websocketUrl);
+			this.ws = socket;
 			this.ws.onopen = async () => {
 				console.debug("Connected to PostgreSQL backend");
 				const wasReconnect = this.reconnectAttempts > 0;
@@ -1848,6 +1910,7 @@ var RebaseWebSocketClient = class {
 			};
 			this.ws.onclose = () => {
 				console.debug("Disconnected from PostgreSQL backend");
+				if (this.ws === socket) this.ws = null;
 				this.isConnected = false;
 				this.isAuthenticated = false;
 				this.authPromise = null;
@@ -1883,6 +1946,7 @@ var RebaseWebSocketClient = class {
 	attemptReconnect() {
 		if (this.reconnectAttempts >= this.maxReconnectAttempts) {
 			console.error("Max reconnection attempts reached");
+			this.gaveUp = true;
 			this.failAllPendingSubscriptions(new RebaseApiError$1("Connection lost", { code: "CONNECTION_LOST" }));
 			return;
 		}
@@ -2425,7 +2489,7 @@ var RebaseWebSocketClient = class {
 			if (this.deepEqual(normCached, normIncoming)) return cachedRow;
 			else {
 				const mismatches = {};
-				const allKeys = new Set([...Object.keys(normCached), ...Object.keys(normIncoming)]);
+				const allKeys = /* @__PURE__ */ new Set([...Object.keys(normCached), ...Object.keys(normIncoming)]);
 				for (const key of allKeys) if (!this.deepEqual(normCached[key], normIncoming[key])) mismatches[key] = {
 					cached: normCached[key],
 					incoming: normIncoming[key]
@@ -3228,7 +3292,7 @@ function isNetworkError(error) {
 * bug the same payload will hit again than a blip, and retrying it forever
 * jams every write behind it.
 */
-var RETRYABLE_STATUSES = new Set([
+var RETRYABLE_STATUSES = /* @__PURE__ */ new Set([
 	408,
 	425,
 	429,
@@ -5278,23 +5342,25 @@ channel: (name, options) => {
 			return existing;
 		} },
 		/**
-		* Release the realtime socket and its reconnect timer.
+		* Release every handle that can keep a process alive — see the
+		* `close` docblock on the client interface.
 		*
-		* Until this returns, the open socket keeps the Node event loop alive
-		* and the process will not exit on its own. Safe to call when realtime
-		* was never started, and safe to call twice.
+		* Safe to call when realtime was never started, safe when signed out,
+		* and safe to call twice.
 		*/
 		close: () => {
 			for (const channel of realtimeChannels.values()) channel.leave();
 			realtimeChannels.clear();
 			ws?.disconnect(true);
 			offlineManager?.dispose();
+			auth.stopAutoRefresh();
 		},
 		setToken: transport.setToken,
 		setAuthTokenGetter: transport.setAuthTokenGetter,
 		setOnUnauthorized: transport.setOnUnauthorized,
 		resolveToken: transport.resolveToken,
 		baseUrl: transport.baseUrl,
+		apiPath: transport.apiPath,
 		collection,
 		call: async (endpoint, payload) => {
 			const prefix = endpoint.startsWith("/") ? "" : "/";