@rebasepro/client 0.16.0 → 0.16.1-canary.g0d7af95

package/dist/admin.d.ts

@@ -1,4 +1,4 @@
-import type { Transport } from "./transport";
+import type { Transport } from "./transport.js";
 import { AdminUser } from "@rebasepro/types";
 export type { AdminUser };
 export interface CreateAdminOptions {

package/dist/api-keys.d.ts

@@ -1,4 +1,4 @@
-import type { Transport } from "./transport";
+import type { Transport } from "./transport.js";
 /**
  * These were re-declared here, under a comment saying they lived in the server
  * package rather than in `@rebasepro/types`. That stopped being true, and the

package/dist/auth.d.ts

@@ -1,5 +1,5 @@
-import { Transport } from "./transport";
-import type { AuthChangeEvent, RebaseSession, DeviceSession, User } from "@rebasepro/types";
+import { Transport } from "./transport.js";
+import type { AuthAdapterCapabilities, AuthChangeEvent, RebaseSession, DeviceSession, User } from "@rebasepro/types";
 export type { RebaseSession, AuthTokens, AuthChangeEvent, DeviceSession } from "@rebasepro/types";
 /** Minimal, non-sensitive user profile returned by {@link findUserByEmail}. */
 export interface PublicUserProfile {
@@ -7,15 +7,15 @@ export interface PublicUserProfile {
     displayName: string | null;
     photoURL: string | null;
 }
-export interface AuthConfig {
-    needsSetup: boolean;
-    registrationEnabled: boolean;
-    emailServiceEnabled?: boolean;
-    passwordReset?: boolean;
-    emailVerification?: boolean;
-    magicLink?: boolean;
-    enabledProviders: string[];
-}
+/**
+ * What `GET /auth/config` answers: the backend's auth capability document.
+ *
+ * Declared once, in `@rebasepro/types`, and re-exported here under the name the
+ * endpoint uses. The SDK used to carry its own near-copy of it, which listed an
+ * `emailServiceEnabled` flag no backend has ever sent and omitted half of what
+ * every backend does send.
+ */
+export type AuthConfig = AuthAdapterCapabilities;
 export interface AuthStorage {
     getItem: (key: string) => string | null;
     setItem: (key: string, value: string) => void;
@@ -167,6 +167,16 @@ export declare function createAuth(transport: Transport, options?: CreateAuthOpt
         accessToken: string;
         refreshToken: string;
     }>;
+    sendEmailOtp: (email: string) => Promise<{
+        success: boolean;
+        message: string;
+        expiresInSeconds: number;
+    }>;
+    verifyEmailOtp: (email: string, code: string) => Promise<{
+        user: User;
+        accessToken: string;
+        refreshToken: string;
+    }>;
     getSessions: () => Promise<DeviceSession[]>;
     revokeSession: (sessionId: string) => Promise<{
         success: boolean;
@@ -174,7 +184,7 @@ export declare function createAuth(transport: Transport, options?: CreateAuthOpt
     revokeAllSessions: () => Promise<{
         success: boolean;
     }>;
-    getAuthConfig: () => Promise<AuthConfig>;
+    getAuthConfig: () => Promise<AuthAdapterCapabilities>;
     getSession: () => RebaseSession | null;
     onAuthStateChange: (callback: (event: AuthChangeEvent, session: RebaseSession | null) => void) => () => boolean;
     canRestoreSession: () => boolean;

package/dist/backups.d.ts

@@ -1,4 +1,4 @@
-import { Transport } from "./transport";
+import { Transport } from "./transport.js";
 import type { BackupInfo, BackupDestinationKind } from "@rebasepro/types";
 export interface CreateBackupsOptions {
     backupsPath?: string;

package/dist/collection.d.ts

@@ -1,5 +1,5 @@
-import { FindParams, Transport } from "./transport";
-import { RebaseWebSocketClient } from "./websocket";
+import { FindParams, Transport } from "./transport.js";
+import { RebaseWebSocketClient } from "./websocket.js";
 import { FindResult, SDKCollectionClient } from "@rebasepro/types";
 /**
  * A live query result: a normal {@link FindResult} plus what an interface

package/dist/cron.d.ts

@@ -1,4 +1,4 @@
-import { Transport } from "./transport";
+import { Transport } from "./transport.js";
 import type { CronJobStatus, CronJobLogEntry } from "@rebasepro/types";
 export interface CreateCronOptions {
     cronPath?: string;

package/dist/functions.d.ts

@@ -1,4 +1,4 @@
-import type { Transport } from "./transport";
+import type { Transport } from "./transport.js";
 /**
  * Client interface for invoking custom backend functions.
  *

package/dist/index.d.ts

@@ -1,43 +1,43 @@
-import { RebaseClientConfig } from "./transport";
-import { createAuth, CreateAuthOptions } from "./auth";
-import { createAdmin, CreateAdminOptions } from "./admin";
-import { createCron, CreateCronOptions } from "./cron";
-import { createBackups } from "./backups";
-import { createApiKeys, CreateApiKeysOptions } from "./api-keys";
-import { CollectionClient } from "./collection";
-import { createFunctionsClient } from "./functions";
-import { RebaseWebSocketClient } from "./websocket";
-import { RebaseRealtimeChannel, type ChannelOptions } from "./realtime-channel";
-import { type OfflineApi, type OfflineConfig } from "./offline";
+import { RebaseClientConfig } from "./transport.js";
+import { createAuth, CreateAuthOptions } from "./auth.js";
+import { createAdmin, CreateAdminOptions } from "./admin.js";
+import { createCron, CreateCronOptions } from "./cron.js";
+import { createBackups } from "./backups.js";
+import { createApiKeys, CreateApiKeysOptions } from "./api-keys.js";
+import { CollectionClient } from "./collection.js";
+import { createFunctionsClient } from "./functions.js";
+import { RebaseWebSocketClient } from "./websocket.js";
+import { RebaseRealtimeChannel, type ChannelOptions } from "./realtime-channel.js";
+import { type OfflineApi, type OfflineConfig } from "./offline.js";
 import { InsertOf, RebaseClient, RebaseSdkData, RowOf, StorageSource, StorageSourceDefinition, StorageSourceRegistry, UpdateOf } from "@rebasepro/types";
-export { RebaseApiError } from "./transport";
-export { RebaseClientError } from "./errors";
+export { RebaseApiError } from "./transport.js";
+export { RebaseClientError } from "./errors.js";
 export type { RebaseErrorCode } from "@rebasepro/types";
-export type { RebaseClientConfig, FindParams, FindResponse } from "./transport";
-export type { CollectionClient } from "./collection";
+export type { RebaseClientConfig, FindParams, FindResponse } from "./transport.js";
+export type { CollectionClient } from "./collection.js";
 export type { FindResult, SDKCollectionClient, SDKQueryBuilderInterface, PaginationMeta } from "@rebasepro/types";
 export type { IterateParams, FindAllParams, PageWalkOptions, CursorSpec } from "@rebasepro/types";
 export { RebasePaginationError } from "@rebasepro/common";
 export type { PaginationErrorCode } from "@rebasepro/common";
 export { QueryBuilder, or, and, cond } from "@rebasepro/common";
-export { createCookieStorage, createMemoryStorage } from "./auth";
-export type { AuthConfig, AuthStorage, CookieStorageOptions, CreateAuthOptions } from "./auth";
+export { createCookieStorage, createMemoryStorage } from "./auth.js";
+export type { AuthConfig, AuthStorage, CookieStorageOptions, CreateAuthOptions } from "./auth.js";
 export type { User, RebaseSession, AuthTokens, AuthChangeEvent, DeviceSession } from "@rebasepro/types";
-export type { CreateAdminOptions } from "./admin";
-export type { AdminUser } from "./admin";
-export type { CreateCronOptions } from "./cron";
-export { createBackups } from "./backups";
-export type { CreateBackupsOptions } from "./backups";
-export type { ApiKeyMasked, ApiKeyPermission, ApiKeyWithSecret, CreateApiKeyRequest, CreateApiKeysOptions, UpdateApiKeyRequest } from "./api-keys";
-export type { FunctionInvokeOptions, FunctionsClient } from "./functions";
-export { RebaseWebSocketClient } from "./websocket";
-export { RebaseRealtimeChannel } from "./realtime-channel";
-export type { PresenceState, PresenceDiff, BroadcastEvent, ChannelTransport, ChannelOptions, ChannelHistoryEntry, ChannelHistoryResult } from "./realtime-channel";
-export type { OfflineApi, OfflineConfig, OfflineStatus } from "./offline";
-export { isOfflineError } from "./offline";
-export type { LiveResult, ObserveOptions, RowSnapshotMeta } from "./collection";
-export type { OfflineStore, OfflineCacheEntry, OfflineCacheRecord, PendingMutation, MutationRollback } from "./offline-store";
-export { MemoryOfflineStore } from "./offline-store";
+export type { CreateAdminOptions } from "./admin.js";
+export type { AdminUser } from "./admin.js";
+export type { CreateCronOptions } from "./cron.js";
+export { createBackups } from "./backups.js";
+export type { CreateBackupsOptions } from "./backups.js";
+export type { ApiKeyMasked, ApiKeyPermission, ApiKeyWithSecret, CreateApiKeyRequest, CreateApiKeysOptions, UpdateApiKeyRequest } from "./api-keys.js";
+export type { FunctionInvokeOptions, FunctionsClient } from "./functions.js";
+export { RebaseWebSocketClient } from "./websocket.js";
+export { RebaseRealtimeChannel } from "./realtime-channel.js";
+export type { PresenceState, PresenceDiff, BroadcastEvent, ChannelTransport, ChannelOptions, ChannelHistoryEntry, ChannelHistoryResult } from "./realtime-channel.js";
+export type { OfflineApi, OfflineConfig, OfflineStatus } from "./offline.js";
+export { isOfflineError } from "./offline.js";
+export type { LiveResult, ObserveOptions, RowSnapshotMeta } from "./collection.js";
+export type { OfflineStore, OfflineCacheEntry, OfflineCacheRecord, PendingMutation, MutationRollback } from "./offline-store.js";
+export { MemoryOfflineStore } from "./offline-store.js";
 export interface CreateRebaseClientOptions extends RebaseClientConfig {
     auth?: CreateAuthOptions;
     admin?: CreateAdminOptions;

package/dist/index.es.js

@@ -48,7 +48,7 @@ function isServerLikeEnvironment() {
 * Emitted once per client. Kept as a constant so the wording is testable and
 * greppable — this is the string a user will paste into a search.
 */
-var ANONYMOUS_SERVER_CLIENT_WARNING = "[rebase] This client was created outside a browser with no credential — no `token`, no auth token getter, and no cookie auth flow — so every request runs as an anonymous caller. Row-level security will return only publicly readable rows, which is usually nothing and occasionally the wrong thing. Inside a cron or function handler, use the `client` you were handed instead of building a new one: its data plane is already admin-scoped. In a standalone script or job, pass the service key as `token`. If you really do want anonymous access, pass `anonymous: true` to silence this.";
+var ANONYMOUS_SERVER_CLIENT_WARNING = "[rebase] This client was created outside a browser with no credential — no `token`, no auth token getter, and no cookie auth flow — so every request runs as an anonymous caller. Row-level security will return only publicly readable rows, which is usually nothing and occasionally the wrong thing. Inside a cron or function handler, use the `rebase` you were handed instead of building a new one: its data plane is already admin-scoped. In a standalone script or job, pass the service key as `token`. If you really do want anonymous access, pass `anonymous: true` to silence this.";
 /**
 * Refuse a filter whose *value* is missing.
 *
@@ -936,6 +936,49 @@ function createAuth(transport, options) {
 			refreshToken: session.refreshToken
 		};
 	}
+	/**
+	* Ask for a six-digit sign-in code by email.
+	*
+	* Answers the same thing whether or not the address has an account — do not
+	* use the result to tell a person whether they are registered, because it
+	* does not know.
+	*/
+	async function sendEmailOtp(email) {
+		const res = await getFetch()(authUrl("/otp"), {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify({ email })
+		});
+		const body = await res.json().catch(() => ({}));
+		if (!res.ok) throwApiError(res.status, body, res.statusText);
+		return body;
+	}
+	/**
+	* Trade a code for a session.
+	*
+	* The address is sent with the code because the code is only valid for it:
+	* that is what keeps a six-digit guess a guess against one account rather
+	* than against every account at once.
+	*/
+	async function verifyEmailOtp(email, code) {
+		const res = await getFetch()(authUrl("/otp/verify"), {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify({
+				email,
+				code
+			}),
+			credentials: authFlowMode === "cookie" ? "include" : void 0
+		});
+		const body = await res.json().catch(() => ({}));
+		if (!res.ok) throwApiError(res.status, body, res.statusText);
+		const session = handleAuthResponse(body, "SIGNED_IN");
+		return {
+			user: session.user,
+			accessToken: session.accessToken,
+			refreshToken: session.refreshToken
+		};
+	}
 	async function getSessions() {
 		return (await transport.request(authPath + "/sessions", { method: "GET" })).sessions;
 	}
@@ -1026,6 +1069,8 @@ function createAuth(transport, options) {
 		verifyEmail,
 		sendMagicLink,
 		verifyMagicLink,
+		sendEmailOtp,
+		verifyEmailOtp,
 		getSessions,
 		revokeSession,
 		revokeAllSessions,
@@ -1444,23 +1489,17 @@ function createCollectionClient(transport, slug, ws) {
 			})).data || [];
 		},
 		/**
-		* Still `PUT`, deliberately, even though the server now serves `PATCH`
-		* on the same handler and `PATCH` is the honest verb for a merge.
+		* `PATCH`, the verb for a merge — `update(id, data: Partial<M>)` sends
+		* only the keys the caller named and the server merges the rest.
 		*
-		* The two are interchangeable server-side, so switching buys nothing at
-		* runtime — and it costs compatibility in the direction that fails
-		* quietly. A 0.14 client talking to a 0.13 server would send `PATCH` to
-		* a route that does not exist and get a **404**, which is
-		* indistinguishable from "that row is gone". Every write would look like
-		* a missing record.
-		*
-		* `PATCH` is what the OpenAPI spec advertises, so anyone generating a
-		* client gets the correct verb; this stays on `PUT` until the oldest
-		* supported server is one that serves both.
+		* It was `PUT` for a while, on a route that served both so older
+		* clients kept working. The alias is gone: the OpenAPI spec, the SDK
+		* and the route now name one verb, and a spec-validating gateway in
+		* front of the API sees the operation the server actually implements.
 		*/
 		async update(id, data) {
 			return await transport.request(`${basePath}/${encodeURIComponent(String(id))}`, {
-				method: "PUT",
+				method: "PATCH",
 				body: JSON.stringify(data)
 			});
 		},
@@ -1604,7 +1643,8 @@ function createCollectionClient(transport, slug, ws) {
 				offset: window.driverOffset,
 				orderBy: normalizeOrderBy(params?.orderBy),
 				searchString: params?.searchString,
-				searchExplain: params?.searchExplain
+				searchExplain: params?.searchExplain,
+				vectorSearch: params?.vectorSearch
 			}, (incomingRows) => {
 				const currentUpdateId = ++lastUpdateId;
 				const requestedLimit = window.limit;
@@ -1684,6 +1724,27 @@ function createFunctionsClient(transport) {
 *                    When set, it is forwarded to the server so the correct
 *                    `StorageController` is resolved from the registry.
 */
+/**
+* A storage key, encoded for a URL path.
+*
+* Every call below interpolated the key raw, and the server decodes what it
+* receives — so three ordinary filenames did three different wrong things:
+*
+*   `Invoice #12.pdf`  the `#` began the fragment, the server saw
+*                      `default/Invoice ` and looked up a key that is not the
+*                      file — and a scoped `?token=` after it was swallowed too
+*   `100% done.png`    `decodeURIComponent` threw URIError → 500
+*   `a%2Fb.png`        decoded to `a/b.png`, silently resolving a DIFFERENT
+*                      object
+*
+* Per SEGMENT, because `/` is the key's own separator and must survive; every
+* other character is encoded, including a literal `%`. Verified to round-trip
+* through the server's decode for all of the above, plus `+`, accented
+* characters and a trailing `%`.
+*/
+function encodeStorageKey(key) {
+	return key.split("/").map(encodeURIComponent).join("/");
+}
 function createStorage(transport, storageId) {
 	const urlsCache = /* @__PURE__ */ new Map();
 	/**
@@ -1729,15 +1790,15 @@ function createStorage(transport, storageId) {
 			fileNotFound: true
 		};
 		if (isPublicStoragePath(filePath)) {
-			const publicConfig = { url: withStorageId(`${fileUrlBase()}/storage/file/${filePath}`) };
+			const publicConfig = { url: withStorageId(`${fileUrlBase()}/storage/file/${encodeStorageKey(filePath)}`) };
 			urlsCache.set(cacheKey, { config: publicConfig });
 			return publicConfig;
 		}
 		try {
-			const result = await transport.request(withStorageId(`/storage/metadata/${filePath}`));
+			const result = await transport.request(withStorageId(`/storage/metadata/${encodeStorageKey(filePath)}`));
 			if (result.data.public) {
 				const publicConfig = {
-					url: withStorageId(`${fileUrlBase()}/storage/file/${filePath}`),
+					url: withStorageId(`${fileUrlBase()}/storage/file/${encodeStorageKey(filePath)}`),
 					metadata: result.data
 				};
 				urlsCache.set(cacheKey, { config: publicConfig });
@@ -1746,7 +1807,7 @@ function createStorage(transport, storageId) {
 			const scopedToken = result.data.token;
 			const tokenQuery = scopedToken ? `?token=${scopedToken}` : "";
 			const downloadConfig = {
-				url: withStorageId(`${fileUrlBase()}/storage/file/${filePath}${tokenQuery}`),
+				url: withStorageId(`${fileUrlBase()}/storage/file/${encodeStorageKey(filePath)}${tokenQuery}`),
 				metadata: result.data
 			};
 			const expiresAt = result.data.tokenExpiresIn ? Date.now() + (result.data.tokenExpiresIn - 10) * 1e3 : void 0;
@@ -1779,7 +1840,7 @@ function createStorage(transport, storageId) {
 		if (bucket && filePath && !filePath.startsWith(bucket)) filePath = `${bucket}/${filePath}`;
 		if (!filePath || filePath.trim() === "" || filePath === "/") return;
 		try {
-			await transport.request(withStorageId(`/storage/file/${filePath}`), { method: "DELETE" });
+			await transport.request(withStorageId(`/storage/file/${encodeStorageKey(filePath)}`), { method: "DELETE" });
 		} catch (e) {
 			if (!(e instanceof Error && "status" in e && e.status === 404)) throw e;
 		}
@@ -1904,7 +1965,6 @@ var RebaseWebSocketClient = class {
 	websocketUrl;
 	ws = null;
 	getAuthToken;
-	subscriptions = /* @__PURE__ */ new Map();
 	listeners = /* @__PURE__ */ new Map();
 	/** Channel-name → handlers, for broadcast and presence frames. */
 	channelHandlers = /* @__PURE__ */ new Map();
@@ -2399,17 +2459,6 @@ var RebaseWebSocketClient = class {
 				}
 			}
 		}
-		if (subscriptionId && this.subscriptions.has(subscriptionId)) {
-			const callback = this.subscriptions.get(subscriptionId);
-			if (!callback) throw new Error(`Subscription callback not found for subscriptionId: ${subscriptionId}`);
-			if (message.type === "ERROR" || message.error) {
-				if (callback.onError) {
-					const { errorMessage, errorCode } = extractMessageError(message);
-					callback.onError(new RebaseApiError$1(errorMessage, { code: errorCode }));
-				}
-			} else callback.onUpdate(message);
-			return;
-		}
 		if (type === "ERROR" || type === "error" || message.error) {
 			const { errorMessage, errorCode } = extractMessageError(message);
 			console.warn(`[Rebase] Realtime error from the server${errorCode ? ` (${errorCode})` : ""}: ${errorMessage}`);