@rebasepro/client 0.16.0 → 0.16.1-canary.g0d7af95

package/dist/offline-query.d.ts

@@ -1,5 +1,5 @@
 import { FilterValues, FindResult, LogicalCondition, FilterCondition, OrderBySpec, WhereFilterOp } from "@rebasepro/types";
-import { FindParams } from "./transport";
+import { FindParams } from "./transport.js";
 /**
  * The server's page size when the caller does not ask for one.
  *

package/dist/offline.d.ts

@@ -1,6 +1,6 @@
 import { SDKCollectionClient } from "@rebasepro/types";
-import { CollectionClient } from "./collection";
-import { OfflineStore, PendingMutation } from "./offline-store";
+import { CollectionClient } from "./collection.js";
+import { OfflineStore, PendingMutation } from "./offline-store.js";
 /**
  * The SDK's local-first sync engine.
  *
@@ -95,7 +95,7 @@ export interface OfflineStatus {
     /** The last replay rejection, if any. */
     lastError?: string;
 }
-export type { LiveResult, ObserveOptions, RowSnapshotMeta } from "./collection";
+export type { LiveResult, ObserveOptions, RowSnapshotMeta } from "./collection.js";
 /** What `client.offline` exposes to the app. */
 export interface OfflineApi {
     /** Replay the queue now. Resolves with what was flushed and what remains. */

package/dist/storage-registry.d.ts

@@ -11,7 +11,7 @@
  * 3. Register "direct" sources manually (e.g. Firebase Storage hook)
  */
 import type { StorageSource, StorageSourceRegistry, StorageSourceDefinition } from "@rebasepro/types";
-import type { Transport } from "./transport";
+import type { Transport } from "./transport.js";
 /**
  * Default implementation of the client-side `StorageSourceRegistry`.
  */

package/dist/storage.d.ts

@@ -1,5 +1,5 @@
 import { StorageSource } from "@rebasepro/types";
-import { Transport } from "./transport";
+import { Transport } from "./transport.js";
 /**
  * Create a StorageSource that talks to the Rebase backend REST API.
  *
@@ -8,4 +8,23 @@ import { Transport } from "./transport";
  *                    When set, it is forwarded to the server so the correct
  *                    `StorageController` is resolved from the registry.
  */
+/**
+ * A storage key, encoded for a URL path.
+ *
+ * Every call below interpolated the key raw, and the server decodes what it
+ * receives — so three ordinary filenames did three different wrong things:
+ *
+ *   `Invoice #12.pdf`  the `#` began the fragment, the server saw
+ *                      `default/Invoice ` and looked up a key that is not the
+ *                      file — and a scoped `?token=` after it was swallowed too
+ *   `100% done.png`    `decodeURIComponent` threw URIError → 500
+ *   `a%2Fb.png`        decoded to `a/b.png`, silently resolving a DIFFERENT
+ *                      object
+ *
+ * Per SEGMENT, because `/` is the key's own separator and must survive; every
+ * other character is encoded, including a literal `%`. Verified to round-trip
+ * through the server's decode for all of the above, plus `+`, accented
+ * characters and a trailing `%`.
+ */
+export declare function encodeStorageKey(key: string): string;
 export declare function createStorage(transport: Transport, storageId?: string): StorageSource;

package/dist/transport.d.ts

@@ -92,7 +92,8 @@ export interface TransportEnvironment {
  */
 export declare const ANONYMOUS_SERVER_CLIENT_WARNING: string;
 /**
- * Re-export from `@rebasepro/types` for backward compatibility.
+ * Re-exported from `@rebasepro/types` so an SDK consumer can name the type of a
+ * call it is already making without a second dependency.
  *
  * Forwards the row type: without the parameter this alias flattened
  * `FindParams<M>` back to its `Record<string, unknown>` default, and `where` /

package/dist/websocket.d.ts

@@ -23,7 +23,6 @@ export declare class RebaseWebSocketClient {
     private websocketUrl;
     private ws;
     getAuthToken?: () => Promise<string | null>;
-    private subscriptions;
     private listeners;
     /** Channel-name → handlers, for broadcast and presence frames. */
     private channelHandlers;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@rebasepro/client",
   "type": "module",
-  "version": "0.16.0",
+  "version": "0.16.1-canary.g0d7af95",
   "description": "HTTP SDK client for the Rebase custom backend",
   "funding": {
     "url": "https://github.com/sponsors/rebaseco"
@@ -29,9 +29,9 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@rebasepro/common": "0.16.0",
-    "@rebasepro/types": "0.16.0",
-    "@rebasepro/utils": "0.16.0"
+    "@rebasepro/common": "0.16.1-canary.g0d7af95",
+    "@rebasepro/types": "0.16.1-canary.g0d7af95",
+    "@rebasepro/utils": "0.16.1-canary.g0d7af95"
   },
   "devDependencies": {
     "@jest/globals": "^30.4.1",
@@ -78,7 +78,7 @@
   },
   "scripts": {
     "watch": "vite build --watch",
-    "build": "vite build && tsc --emitDeclarationOnly -p tsconfig.prod.json && node ../../scripts/assert-build-output.mjs",
+    "build": "vite build && tsc --emitDeclarationOnly -p tsconfig.prod.json && node ../../tooling/scripts/add-dts-extensions.mjs dist && node ../../tooling/scripts/assert-build-output.mjs",
     "test:lint": "eslint \"src/**\" --quiet",
     "test": "jest --passWithNoTests --forceExit",
     "clean": "rm -rf dist && find ./src -name '*.js' -type f | xargs rm -f"

package/src/auth.ts

@@ -1,5 +1,5 @@
 import { RebaseApiError, Transport } from "./transport";
-import type { AuthChangeEvent, RebaseSession, AuthTokens, DeviceSession, User } from "@rebasepro/types";
+import type { AuthAdapterCapabilities, AuthChangeEvent, RebaseSession, AuthTokens, DeviceSession, User } from "@rebasepro/types";
 
 // Re-export canonical types so `import { RebaseSession } from "@rebasepro/client"` keeps working
 export type { RebaseSession, AuthTokens, AuthChangeEvent, DeviceSession } from "@rebasepro/types";
@@ -30,15 +30,15 @@ function mapRawUser(raw: Record<string, unknown>): User {
 const EMPTY_USER: User = { uid: "", email: null, displayName: null, photoURL: null, providerId: "password", isAnonymous: false };
 
 
-export interface AuthConfig {
-    needsSetup: boolean;
-    registrationEnabled: boolean;
-    emailServiceEnabled?: boolean;
-    passwordReset?: boolean;
-    emailVerification?: boolean;
-    magicLink?: boolean;
-    enabledProviders: string[];
-}
+/**
+ * What `GET /auth/config` answers: the backend's auth capability document.
+ *
+ * Declared once, in `@rebasepro/types`, and re-exported here under the name the
+ * endpoint uses. The SDK used to carry its own near-copy of it, which listed an
+ * `emailServiceEnabled` flag no backend has ever sent and omitted half of what
+ * every backend does send.
+ */
+export type AuthConfig = AuthAdapterCapabilities;
 
 export interface AuthStorage {
     getItem: (key: string) => string | null;
@@ -746,6 +746,48 @@ accessToken: session.accessToken,
 refreshToken: session.refreshToken };
     }
 
+    /**
+     * Ask for a six-digit sign-in code by email.
+     *
+     * Answers the same thing whether or not the address has an account — do not
+     * use the result to tell a person whether they are registered, because it
+     * does not know.
+     */
+    async function sendEmailOtp(email: string) {
+        const fetchFn = getFetch();
+        const res = await fetchFn(authUrl("/otp"), {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ email })
+        });
+        const body = await res.json().catch(() => ({}));
+        if (!res.ok) throwApiError(res.status, body, res.statusText);
+        return body as { success: boolean; message: string; expiresInSeconds: number };
+    }
+
+    /**
+     * Trade a code for a session.
+     *
+     * The address is sent with the code because the code is only valid for it:
+     * that is what keeps a six-digit guess a guess against one account rather
+     * than against every account at once.
+     */
+    async function verifyEmailOtp(email: string, code: string) {
+        const fetchFn = getFetch();
+        const res = await fetchFn(authUrl("/otp/verify"), {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ email, code }),
+            credentials: authFlowMode === "cookie" ? "include" : undefined
+        } as RequestInit);
+        const body = await res.json().catch(() => ({}));
+        if (!res.ok) throwApiError(res.status, body, res.statusText);
+        const session = handleAuthResponse(body, "SIGNED_IN");
+        return { user: session.user,
+accessToken: session.accessToken,
+refreshToken: session.refreshToken };
+    }
+
     async function getSessions(): Promise<DeviceSession[]> {
         const data = await transport.request<{ sessions: DeviceSession[] }>(authPath + "/sessions", { method: "GET" });
         return data.sessions;
@@ -858,6 +900,8 @@ refreshToken: session.refreshToken };
         verifyEmail,
         sendMagicLink,
         verifyMagicLink,
+        sendEmailOtp,
+        verifyEmailOtp,
         getSessions,
         revokeSession,
         revokeAllSessions,

package/src/client-close.test.ts

@@ -12,7 +12,7 @@ import { createRebaseClient } from "./index";
  * an SSR request — released its socket, called `close()` exactly as documented,
  * and still hung until the token would have expired.
  *
- * Found by `e2e/tests/client-sdk-e2e.ts`, which reported every check green and
+ * Found by `tests/e2e/tests/client-sdk-e2e.ts`, which reported every check green and
  * then never exited. Pinned here rather than only there because that suite needs
  * Docker and a real Postgres, and this costs nothing.
  *

package/src/collection.ts

@@ -182,23 +182,17 @@ export function createCollectionClient<M extends Record<string, unknown> = Recor
         },
 
         /**
-         * Still `PUT`, deliberately, even though the server now serves `PATCH`
-         * on the same handler and `PATCH` is the honest verb for a merge.
+         * `PATCH`, the verb for a merge — `update(id, data: Partial<M>)` sends
+         * only the keys the caller named and the server merges the rest.
          *
-         * The two are interchangeable server-side, so switching buys nothing at
-         * runtime — and it costs compatibility in the direction that fails
-         * quietly. A 0.14 client talking to a 0.13 server would send `PATCH` to
-         * a route that does not exist and get a **404**, which is
-         * indistinguishable from "that row is gone". Every write would look like
-         * a missing record.
-         *
-         * `PATCH` is what the OpenAPI spec advertises, so anyone generating a
-         * client gets the correct verb; this stays on `PUT` until the oldest
-         * supported server is one that serves both.
+         * It was `PUT` for a while, on a route that served both so older
+         * clients kept working. The alias is gone: the OpenAPI spec, the SDK
+         * and the route now name one verb, and a spec-validating gateway in
+         * front of the API sees the operation the server actually implements.
          */
         async update(id: string | number, data: Partial<M>) {
             const raw = await transport.request<Record<string, unknown>>(`${basePath}/${encodeURIComponent(String(id))}`, {
-                method: "PUT",
+                method: "PATCH",
                 body: JSON.stringify(data)
             });
             return raw as M;
@@ -435,7 +429,16 @@ export function createCollectionClient<M extends Record<string, unknown> = Recor
                     // back in a different order from the same query fetched.
                     orderBy: normalizeOrderBy(params?.orderBy),
                     searchString: params?.searchString,
-                    searchExplain: params?.searchExplain
+                    searchExplain: params?.searchExplain,
+                    // Forwarded so the SERVER can refuse it. `realtimeService`
+                    // rejects a subscription carrying `vectorSearch` — a
+                    // subscription is re-run on every matching write and
+                    // nothing there computes distances — and the docs promise
+                    // that refusal. Both producers hand-list their fields and
+                    // both omitted this one, so the guard could not fire and
+                    // `.vectorSearch(…).listen()` returned an ordinary
+                    // `id DESC` listing with no `_distance` and no error.
+                    vectorSearch: params?.vectorSearch
                 },
                 (incomingRows: Record<string, unknown>[]) => {
                     const currentUpdateId = ++lastUpdateId;

package/src/storage-key-encoding.test.ts

@@ -0,0 +1,65 @@
+/**
+ * Storage keys in a URL path.
+ *
+ * Every call in `storage.ts` interpolated the key raw, and the server decodes
+ * what it receives. Three ordinary filenames did three different wrong things,
+ * all measured against a real Hono route before this was written:
+ *
+ *   `Invoice #12.pdf`  the `#` began the fragment, so the server saw
+ *                      `default/Invoice ` — a key that is not the file — and a
+ *                      scoped `?token=` after it was swallowed with it
+ *   `100% done.png`    `decodeURIComponent` threw URIError, answered 500
+ *   `a%2Fb.png`        decoded to `a/b.png`, silently resolving a DIFFERENT
+ *                      object
+ *
+ * The last is the one worth the test: no error, no log, the wrong bytes.
+ */
+import { encodeStorageKey } from "./storage";
+
+describe("encodeStorageKey", () => {
+    it("leaves an ordinary key untouched", () => {
+        // The no-op property: every key that already worked still produces the
+        // same URL, so nothing cached or CDN-fronted moves.
+        expect(encodeStorageKey("default/photo.png")).toBe("default/photo.png");
+        expect(encodeStorageKey("public/a/b/c.jpg")).toBe("public/a/b/c.jpg");
+    });
+
+    it("keeps the key's own separator", () => {
+        // `/` separates bucket from path and folder from file. Encoding it
+        // would make every existing key unresolvable.
+        expect(encodeStorageKey("a/b/c")).toBe("a/b/c");
+    });
+
+    it.each([
+        ["default/Invoice #12.pdf", "default/Invoice%20%2312.pdf"],
+        ["default/100% done.png", "default/100%25%20done.png"],
+        ["default/a%2Fb.png", "default/a%252Fb.png"],
+        ["default/a+b.png", "default/a%2Bb.png"],
+        ["default/naïve café.png", "default/na%C3%AFve%20caf%C3%A9.png"]
+    ])("encodes %s", (input, expected) => {
+        expect(encodeStorageKey(input)).toBe(expected);
+    });
+
+    it("keeps a key containing an encoded slash distinct from a real one", () => {
+        // The silent one. `a%2Fb.png` is a legal object name and it is not
+        // `a/b.png`; before this they resolved to the same object.
+        expect(encodeStorageKey("default/a%2Fb.png"))
+            .not.toBe(encodeStorageKey("default/a/b.png"));
+    });
+
+    it("survives a round trip through the server's decode", () => {
+        // The server runs `decodeURIComponent` over the whole path. Anything
+        // that does not come back unchanged is a key that resolves to the
+        // wrong object, or a 500.
+        for (const key of [
+            "default/photo.png",
+            "default/Invoice #12.pdf",
+            "default/100% done.png",
+            "default/a%2Fb.png",
+            "default/50%.png",
+            "default/naïve café.png"
+        ]) {
+            expect(decodeURIComponent(encodeStorageKey(key))).toBe(key);
+        }
+    });
+});

package/src/storage.ts

@@ -9,6 +9,28 @@ import { Transport } from "./transport";
  *                    When set, it is forwarded to the server so the correct
  *                    `StorageController` is resolved from the registry.
  */
+/**
+ * A storage key, encoded for a URL path.
+ *
+ * Every call below interpolated the key raw, and the server decodes what it
+ * receives — so three ordinary filenames did three different wrong things:
+ *
+ *   `Invoice #12.pdf`  the `#` began the fragment, the server saw
+ *                      `default/Invoice ` and looked up a key that is not the
+ *                      file — and a scoped `?token=` after it was swallowed too
+ *   `100% done.png`    `decodeURIComponent` threw URIError → 500
+ *   `a%2Fb.png`        decoded to `a/b.png`, silently resolving a DIFFERENT
+ *                      object
+ *
+ * Per SEGMENT, because `/` is the key's own separator and must survive; every
+ * other character is encoded, including a literal `%`. Verified to round-trip
+ * through the server's decode for all of the above, plus `+`, accented
+ * characters and a trailing `%`.
+ */
+export function encodeStorageKey(key: string): string {
+    return key.split("/").map(encodeURIComponent).join("/");
+}
+
 export function createStorage(transport: Transport, storageId?: string): StorageSource {
     const urlsCache = new Map<string, { config: DownloadConfig; expiresAt?: number }>();
 
@@ -103,19 +125,19 @@ export function createStorage(transport: Transport, storageId?: string): Storage
         // token are needed — build the URL directly and cache it forever.
         if (isPublicStoragePath(filePath)) {
             const publicConfig: DownloadConfig = {
-                url: withStorageId(`${fileUrlBase()}/storage/file/${filePath}`)
+                url: withStorageId(`${fileUrlBase()}/storage/file/${encodeStorageKey(filePath)}`)
             };
             urlsCache.set(cacheKey, { config: publicConfig }); // no expiry
             return publicConfig;
         }
 
         try {
-            const result = await transport.request<{ data: DownloadMetadata }>(withStorageId(`/storage/metadata/${filePath}`));
+            const result = await transport.request<{ data: DownloadMetadata }>(withStorageId(`/storage/metadata/${encodeStorageKey(filePath)}`));
 
             // Public object (server-confirmed): token-less permanent URL.
             if (result.data.public) {
                 const publicConfig: DownloadConfig = {
-                    url: withStorageId(`${fileUrlBase()}/storage/file/${filePath}`),
+                    url: withStorageId(`${fileUrlBase()}/storage/file/${encodeStorageKey(filePath)}`),
                     metadata: result.data
                 };
                 urlsCache.set(cacheKey, { config: publicConfig }); // no expiry
@@ -133,7 +155,7 @@ export function createStorage(transport: Transport, storageId?: string): Storage
                 // `withStorageId` picks `?` or `&` based on whether the token
                 // query is already present, so the URL stays valid even when
                 // there is no token.
-                url: withStorageId(`${fileUrlBase()}/storage/file/${filePath}${tokenQuery}`),
+                url: withStorageId(`${fileUrlBase()}/storage/file/${encodeStorageKey(filePath)}${tokenQuery}`),
                 metadata: result.data
             };
 
@@ -193,7 +215,7 @@ export function createStorage(transport: Transport, storageId?: string): Storage
         }
 
         try {
-            await transport.request(withStorageId(`/storage/file/${filePath}`), { method: "DELETE" });
+            await transport.request(withStorageId(`/storage/file/${encodeStorageKey(filePath)}`), { method: "DELETE" });
         } catch (e: unknown) {
             if (!(e instanceof Error && "status" in e && (e as { status: number }).status === 404)) throw e;
         }

package/src/transport.ts

@@ -119,12 +119,13 @@ export const ANONYMOUS_SERVER_CLIENT_WARNING =
     "[rebase] This client was created outside a browser with no credential — no `token`, no auth token getter, "
     + "and no cookie auth flow — so every request runs as an anonymous caller. Row-level security will return only "
     + "publicly readable rows, which is usually nothing and occasionally the wrong thing. "
-    + "Inside a cron or function handler, use the `client` you were handed instead of building a new one: its data "
+    + "Inside a cron or function handler, use the `rebase` you were handed instead of building a new one: its data "
     + "plane is already admin-scoped. In a standalone script or job, pass the service key as `token`. "
     + "If you really do want anonymous access, pass `anonymous: true` to silence this.";
 
 /**
- * Re-export from `@rebasepro/types` for backward compatibility.
+ * Re-exported from `@rebasepro/types` so an SDK consumer can name the type of a
+ * call it is already making without a second dependency.
  *
  * Forwards the row type: without the parameter this alias flattened
  * `FindParams<M>` back to its `Record<string, unknown>` default, and `where` /

package/src/vector-search-listen.test.ts

@@ -0,0 +1,42 @@
+/**
+ * `.vectorSearch(…).listen()` must reach the server's refusal.
+ *
+ * `realtimeService` rejects a subscription carrying `vectorSearch` — a
+ * subscription is re-run on every matching write and nothing there computes
+ * distances — and the documentation promises that refusal. Both producers of a
+ * subscription request hand-list their fields, and both omitted this one, so
+ * the guard could not fire: the call returned an ordinary `id DESC` listing,
+ * with no `_distance` and no error. Through `observe()` it was worse, because
+ * the correct initial snapshot was then overwritten by the wrong socket
+ * listing.
+ *
+ * Asserted on the request the client BUILDS rather than on a live socket: what
+ * was missing is a field, and the refusal it has to reach is tested where it
+ * lives.
+ */
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+
+const listenRequestBlock = (file: string, marker: string) => {
+    const source = readFileSync(resolve(__dirname, file), "utf-8");
+    const start = source.indexOf(marker);
+    expect(start).toBeGreaterThan(-1);
+    return source.slice(start, start + 3000);
+};
+
+describe("a subscription request carries every field the server refuses on", () => {
+    it("the client's listenCollection forwards vectorSearch", () => {
+        const block = listenRequestBlock("./collection.ts", "ws.listenCollection(");
+        expect(block).toContain("vectorSearch: params?.vectorSearch");
+    });
+
+    it("forwards it beside the fields it already forwarded", () => {
+        // Guards against the assertion above passing on a stray mention: the
+        // field has to be in the same object literal as the rest.
+        const block = listenRequestBlock("./collection.ts", "ws.listenCollection(");
+        const objectLiteral = block.slice(0, block.indexOf("},"));
+        for (const field of ["path:", "filter:", "orderBy:", "searchString:", "vectorSearch:"]) {
+            expect(objectLiteral).toContain(field);
+        }
+    });
+});

package/src/websocket.ts

@@ -86,11 +86,6 @@ export class RebaseWebSocketClient {
     private websocketUrl: string;
     private ws: WebSocket | null = null;
     public getAuthToken?: () => Promise<string | null>;
-    private subscriptions = new Map<string, {
-        onUpdate: (data: WebSocketMessage) => void,
-        onError?: (error: Error) => void
-    }>();
-
     private listeners = new Map<string, Set<(...args: unknown[]) => void>>();
 
     /** Channel-name → handlers, for broadcast and presence frames. */
@@ -883,23 +878,6 @@ export class RebaseWebSocketClient {
             }
         }
 
-        // Legacy subscription handling (for backward compatibility)
-        if (subscriptionId && this.subscriptions.has(subscriptionId)) {
-            const callback = this.subscriptions.get(subscriptionId);
-            if (!callback) {
-                throw new Error(`Subscription callback not found for subscriptionId: ${subscriptionId}`);
-            }
-            if (message.type === "ERROR" || message.error) {
-                if (callback.onError) {
-                    const { errorMessage, errorCode } = extractMessageError(message);
-                    callback.onError(new RebaseApiError(errorMessage, { code: errorCode }));
-                }
-            } else {
-                callback.onUpdate(message);
-            }
-            return;
-        }
-
         // An error that matched no waiter used to fall off the end of this
         // method and disappear. Channel frames are the ones that always do:
         // they are fire-and-forget by design, so no `pendingRequests` entry