@rebasepro/client 0.17.3 → 0.18.1

package/README.md

@@ -8,6 +8,10 @@ HTTP SDK client for the Rebase backend — typed CRUD, auth, storage, realtime W
 pnpm add @rebasepro/client
 ```
 
+ESM-only: `"type": "module"` with no CommonJS build, so it is loaded with
+`import`. `require()` of it resolves only on Node 22.12+, which supports
+`require(esm)`.
+
 ## What This Package Does
 
 `@rebasepro/client` is the primary SDK for interacting with a Rebase backend from any JavaScript/TypeScript environment (browser, Node.js, edge). It creates a single client instance that provides:

package/dist/auth.d.ts

@@ -123,6 +123,86 @@ export declare function createAuth(transport: Transport, options?: CreateAuthOpt
         accessToken: string;
         refreshToken: string;
     }>;
+    signInAnonymously: () => Promise<{
+        user: User;
+        accessToken: string;
+        refreshToken: string;
+    }>;
+    linkAnonymous: (email: string, password: string) => Promise<{
+        user: User;
+        accessToken: string;
+        refreshToken: string;
+    }>;
+    mfa: {
+        /**
+         * Start enrolling a TOTP factor.
+         *
+         * Returns the secret and an `otpauth://` URI to render as a QR code,
+         * plus ten single-use recovery codes. **Show the recovery codes once
+         * and never again** — only their hashes are stored.
+         *
+         * The factor is not usable until `verify` confirms the user's
+         * authenticator produced a correct code from it.
+         */
+        enroll(options?: {
+            friendlyName?: string;
+            issuer?: string;
+        }): Promise<{
+            factor: {
+                id: string;
+                factorType: string;
+                friendlyName?: string;
+            };
+            totp: {
+                secret: string;
+                uri: string;
+                qrUri: string;
+            };
+            recoveryCodes: string[];
+        }>;
+        /** Confirm an enrolment with a code from the authenticator app. */
+        verify(factorId: string, code: string): Promise<{
+            success: boolean;
+            factor: {
+                id: string;
+                verified: boolean;
+            };
+        }>;
+        /** The factors on this account, verified or not. */
+        listFactors(): Promise<{
+            id: string;
+            factorType: string;
+            friendlyName?: string;
+            verified: boolean;
+            createdAt: string;
+        }[]>;
+        /**
+         * Remove a factor. Requires an `aal2` session — one that has already
+         * answered a challenge — so a stolen `aal1` token cannot turn MFA off.
+         */
+        unenroll(factorId: string): Promise<{
+            success: boolean;
+            message: string;
+        }>;
+        /** Open a challenge against a verified factor. Expires in five minutes. */
+        challenge(factorId: string): Promise<{
+            challengeId: string;
+            factorId: string;
+            expiresAt: string;
+        }>;
+        /**
+         * Answer a challenge with a TOTP code or a recovery code.
+         *
+         * This is where an MFA-enrolled account's real session is minted, at
+         * `aal2` — so the returned tokens replace the ones the sign-in handed
+         * back, and this client adopts them.
+         */
+        verifyChallenge(challengeId: string, code: string): Promise<{
+            user: User;
+            accessToken: string;
+            refreshToken: string;
+        }>;
+    };
     signOut: () => Promise<void>;
     stopAutoRefresh: () => void;
     refreshSession: () => Promise<RebaseSession>;

package/dist/functions.d.ts

@@ -19,9 +19,14 @@ export interface FunctionsClient {
     /**
      * Invoke a custom backend function by name.
      *
+     * **The method is `POST` unless you say otherwise.** A function whose only
+     * route is `app.get("/")` therefore answers 404 to a bare `invoke(name)` —
+     * pass `{ method: "GET" }`, or write the route as `app.post`.
+     *
      * @typeParam T - Expected shape of the response payload.
      * @param name    - Function name (the filename without extension, e.g. `"extract-job"`).
-     * @param payload - Optional JSON-serialisable body sent as `POST`.
+     *                  One path segment: a sub-path goes in `options.path`.
+     * @param payload - Optional JSON-serialisable body. Dropped for `GET`.
      * @param options - Optional overrides (HTTP method, sub-path, extra headers).
      * @returns The parsed JSON response from the function.
      */

package/dist/index.d.ts

@@ -136,6 +136,14 @@ export type CreateRebaseClientResult<DB = Record<string, unknown>> = Omit<Rebase
     storageRegistry: StorageSourceRegistry;
     createStorageSource: (storageId: string) => StorageSource;
     fetchStorageSources: () => Promise<StorageSourceDefinition[]>;
+    /**
+     * POST to an arbitrary endpoint on this backend, returning its body
+     * verbatim.
+     *
+     * The shorthand for {@link FunctionsClient.invoke} — `call("functions/x",
+     * p)` is `functions.invoke("x", p)` — and it unwraps exactly as little.
+     * Neither reaches into the response for a `data` key.
+     */
     call: <T = unknown>(endpoint: string, payload?: unknown) => Promise<T>;
     collection: <M extends Record<string, unknown> = Record<string, unknown>>(slug: string) => CollectionClient<M>;
     data: TypedDataLayer<DB>;