@rebasepro/client 0.23.0 → 0.24.1-canary.g19596ef

package/README.md

@@ -34,22 +34,37 @@ of it resolves too: Node has supported `require(esm)` since 22.12.
 |---|---|
 | `createRebaseClient<DB>(options)` | Create a client instance. Generic `DB` parameter enables type-safe `client.data.*` access. |
 | `CreateRebaseClientResult<DB>` | The client type it returns (`RebaseClient<DB>` from `@rebasepro/types`, narrowed) — includes `auth`, `admin`, `cron`, `functions`, `storage`, `ws`, `data`, `call`, and token management methods. |
-| `CreateRebaseClientOptions` | Extends `RebaseClientConfig` with `auth`, `admin`, and `cron` sub-configs. |
+| `CreateRebaseClientOptions` | Extends `RebaseClientConfig` with the `auth`, `admin`, `cron`, `apiKeys` and `personalKeys` sub-configs, plus `storageSources`, `collections` and `offline`. |
 
 ### Config
 
 | Option | Type | Default | Description |
 |---|---|---|---|
 | `baseUrl` | `string` | `""` | Backend URL (e.g. `http://localhost:3001`) |
-| `token` | `string` | — | Static auth token |
+| `token` | `string` | — | Auth token, read each time one is needed (so it may be declared as a getter) until `setToken()` or a sign-in replaces it |
 | `apiPath` | `string` | `"/api"` | API path prefix |
 | `fetch` | `typeof fetch` | `globalThis.fetch` | Custom fetch implementation |
-| `onUnauthorized` | `() => Promise<boolean>` | auto-refresh | Handler for 401 responses |
+| `onUnauthorized` | `() => Promise<boolean>` | auto-refresh | Handler for a refused token, over HTTP (401) and on the realtime socket |
 | `websocketUrl` | `string` | derived from `baseUrl` | WebSocket URL for realtime |
 | `realtime` | `boolean` | `true` | Open the WebSocket — `false` lets a one-shot script exit |
 | `collections` | `Record<string, string>` | — | Maps accessor names to collection slugs |
 | `offline` | `boolean \| OfflineConfig` | `false` | Local-first sync — see [the docs](https://rebase.pro/docs/sdk/offline) |
 
+### Tokens
+
+| Method | Description |
+|---|---|
+| `setAuthTokenGetter(getter)` | Ask `getter` for the token each time one is needed: every HTTP request and every time the realtime socket authenticates. This is how a host signing users in with its own provider (Clerk, Firebase Auth, its own session) authenticates the client. It comes before the client's own session and the `token` option |
+| `setToken(token)` | Send this token from now on, over HTTP and on the socket |
+| `setOnUnauthorized(handler)` | Answer a refused token, on HTTP and the socket; resolve `true` to retry |
+| `resolveToken()` | The token the next request would carry |
+
+Installing a getter or calling `setToken()` rebuilds an open socket so it authenticates as the new credential. `client.ws.setAuthTokenGetter()` is deprecated: it still works, warns once, and reaches only the socket.
+
+```ts
+client.setAuthTokenGetter(() => clerk.session?.getToken() ?? Promise.resolve(null));
+```
+
 ### Collection Client
 
 `client.data.collection("slug")` or `client.data.myCollection` returns a `CollectionClient<M>`:
@@ -62,11 +77,11 @@ of it resolves too: Node has supported `require(esm)` since 22.12.
 | `update(id, data)` | Update a row. Returns `M` |
 | `delete(id)` | Delete a row |
 | `count(params?)` | Count matching rows |
-| `where(col, op, val)` | Start a fluent query — returns `QueryBuilder` |
-| `orderBy(col, dir?)` | Order results — returns `QueryBuilder` |
-| `limit(n)` / `offset(n)` | Pagination — returns `QueryBuilder` |
-| `search(str)` | Full-text search — returns `QueryBuilder` |
-| `include(...rels)` | Include related rows — returns `QueryBuilder` |
+| `where(col, op, val)` | Start a fluent query — returns a query builder |
+| `orderBy(col, dir?)` | Order results — returns a query builder |
+| `limit(n)` / `offset(n)` | Pagination — returns a query builder |
+| `search(str)` | Text search: a case-insensitive substring match by default, ranked full-text where the collection opts in — returns a query builder |
+| `include(...rels)` | Include related rows — returns a query builder |
 | `listen(params, onUpdate, onError?)` | Realtime subscription (requires WebSocket) |
 | `listenById(id, onUpdate, onError?)` | Realtime single-row subscription |
 | `observe(params, onResult, onError?, options?)` | Live query — local-first when `offline` is on, otherwise fetch + `listen` |
@@ -107,7 +122,7 @@ of it resolves too: Node has supported `require(esm)` since 22.12.
 
 | Method | Description |
 |---|---|
-| `listUsers()` / `listUsersPaginated(options?)` | List all users |
+| `listUsers(options?)` / `listUsersPaginated(options?)` | One page of users (25 by default; `limit`, `offset`, `search`, `orderBy`, `orderDir`) with `total` |
 | `getUser(userId)` | Get a single user |
 | `createUser(data)` | Create a user |
 | `updateUser(userId, data)` | Update a user |
@@ -130,7 +145,7 @@ of it resolves too: Node has supported `require(esm)` since 22.12.
 | `MemoryOfflineStore` | Reference `OfflineStore`; the IndexedDB one is wired automatically |
 | `createCookieStorage(options?)` | Cookie-based auth storage adapter |
 | `createMemoryStorage()` | In-memory auth storage adapter |
-| `QueryBuilder` | Fluent query builder (also re-exported from `@rebasepro/common`) |
+| `or`, `and`, `not`, `cond` | Logical-condition helpers for `.where(…)` |
 | `FindResult`, `FindParams`, `User`, … | Re-exported from `@rebasepro/types` |
 
 ## Quick Start

package/dist/admin-contract.types.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Compile-time assertions about the admin client's answers.
+ *
+ * A plain module under `src`, imported by nothing, for the reason
+ * `query-contract.types.ts` gives: a type assertion in a jest test is checked
+ * by nothing here, and `pnpm typecheck` reads `src`.
+ */
+import type { createAdmin } from "./admin.js";
+type Admin = ReturnType<typeof createAdmin>;
+/**
+ * `POST /admin/users` answers `{ user, invitationSent, temporaryPassword?,
+ * emailDeliveryFailed? }`, and the temporary password is returned exactly
+ * once. Typed `{ user }`, it was a compile error to read — while the sibling
+ * `resetPassword` typed the same three fields.
+ */
+export declare const createUserDelivery: (admin: Admin) => Promise<{
+    temporaryPassword: string | undefined;
+    invitationSent: boolean | undefined;
+    emailDeliveryFailed: boolean | undefined;
+}>;
+export {};

package/dist/admin.d.ts

@@ -1,5 +1,5 @@
 import type { Transport } from "./transport.js";
-import { AdminUser } from "@rebasepro/types";
+import type { AdminUser, RoleSummary } from "@rebasepro/types";
 export type { AdminUser };
 export interface CreateAdminOptions {
     adminPath?: string;
@@ -33,20 +33,29 @@ export declare function createAdmin(transport: Transport, options?: CreateAdminO
         displayName?: string;
         password?: string;
         roles?: string[];
+        skipPasswordPolicy?: boolean;
     }) => Promise<{
         user: AdminUser;
+        temporaryPassword?: string;
+        invitationSent?: boolean;
+        emailDeliveryFailed?: boolean;
     }>;
     updateUser: (userId: string, data: {
         email?: string;
         displayName?: string;
         password?: string;
         roles?: string[];
+        disabled?: boolean;
     }) => Promise<{
         user: AdminUser;
     }>;
     deleteUser: (userId: string) => Promise<{
         success: boolean;
     }>;
+    resetMfa: (userId: string) => Promise<{
+        success: boolean;
+        removedFactors: number;
+    }>;
     resetPassword: (userId: string, options?: {
         password?: string;
     }) => Promise<{
@@ -56,10 +65,7 @@ export declare function createAdmin(transport: Transport, options?: CreateAdminO
         emailDeliveryFailed?: boolean;
     }>;
     listRoles: () => Promise<{
-        roles: Array<{
-            id: string;
-            name: string;
-        }>;
+        roles: RoleSummary[];
     }>;
     bootstrap: () => Promise<{
         success: boolean;

package/dist/api-keys.d.ts

@@ -1,20 +1,13 @@
 import type { Transport } from "./transport.js";
-/**
- * These were re-declared here, under a comment saying they lived in the server
- * package rather than in `@rebasepro/types`. That stopped being true, and the
- * copy drifted: it never gained `admin`, the flag that grants a key the `admin`
- * role — admin routes plus the RLS `default_admin` policies — so the SDK could
- * describe every kind of key except a privileged one, and
- * `createKey({ …, admin: true })` was an excess-property error.
- */
-export type { ApiKeyPermission, ApiKeyMasked, ApiKeyWithSecret, CreateApiKeyRequest, UpdateApiKeyRequest } from "@rebasepro/types";
-import type { ApiKeyMasked, ApiKeyWithSecret, CreateApiKeyRequest, UpdateApiKeyRequest } from "@rebasepro/types";
+export type { ApiKeyKind, ApiKeyMasked, ApiKeyWithSecret, CreateApiKeyRequest, CreatePersonalKeyRequest, UpdateApiKeyRequest } from "@rebasepro/types";
+import type { ApiKeyMasked, ApiKeyWithSecret, CreateApiKeyRequest, CreatePersonalKeyRequest, ScopeSummary, UpdateApiKeyRequest } from "@rebasepro/types";
 /** Options for the `createApiKeys` factory. */
 export interface CreateApiKeysOptions {
     apiKeysPath?: string;
 }
 /**
- * Creates a client for managing API keys via the admin routes.
+ * Creates a client for the project's service keys, via the admin routes.
+ * Needs `keys:read` / `keys:write`.
  *
  * @param transport - The shared HTTP transport created by `createTransport`.
  * @param options   - Optional overrides (e.g. a custom base path).
@@ -36,3 +29,28 @@ export declare function createApiKeys(transport: Transport, options?: CreateApiK
         success: boolean;
     }>;
 };
+/** Options for the `createPersonalKeys` factory. */
+export interface CreatePersonalKeysOptions {
+    personalKeysPath?: string;
+    scopesPath?: string;
+}
+/**
+ * Creates a client for the signed-in account's own API keys — each acts as the
+ * account and holds no scope it does not. Answers `PERSONAL_KEYS_DISABLED`
+ * unless the backend sets `personalKeys: true` on the users collection.
+ */
+export declare function createPersonalKeys(transport: Transport, options?: CreatePersonalKeysOptions): {
+    listKeys: () => Promise<{
+        keys: ApiKeyMasked[];
+    }>;
+    createKey: (data: CreatePersonalKeyRequest) => Promise<{
+        key: ApiKeyWithSecret;
+    }>;
+    revokeKey: (id: string) => Promise<{
+        success: boolean;
+    }>;
+    listScopes: () => Promise<{
+        scopes: ScopeSummary[];
+        held: string[];
+    }>;
+};

package/dist/auth.d.ts

@@ -1,5 +1,5 @@
 import { Transport } from "./transport.js";
-import type { AuthAdapterCapabilities, AuthChangeEvent, RebaseSession, DeviceSession, User } from "@rebasepro/types";
+import type { AuthConfigDocument, AuthChangeEvent, RebaseSession, DeviceSession, User } from "@rebasepro/types";
 export type { RebaseSession, AuthTokens, AuthChangeEvent, DeviceSession } from "@rebasepro/types";
 /** Minimal, non-sensitive user profile returned by {@link findUserByEmail}. */
 export interface PublicUserProfile {
@@ -8,14 +8,15 @@ export interface PublicUserProfile {
     photoURL: string | null;
 }
 /**
- * What `GET /auth/config` answers: the backend's auth capability document.
+ * What `GET /auth/config` answers: the backend's auth capability document, and
+ * whether it serves storage.
  *
  * Declared once, in `@rebasepro/types`, and re-exported here under the name the
  * endpoint uses. The SDK used to carry its own near-copy of it, which listed an
  * `emailServiceEnabled` flag no backend has ever sent and omitted half of what
  * every backend does send.
  */
-export type AuthConfig = AuthAdapterCapabilities;
+export type AuthConfig = AuthConfigDocument;
 export interface AuthStorage {
     getItem: (key: string) => string | null;
     setItem: (key: string, value: string) => void;
@@ -52,6 +53,12 @@ export declare function createAuth(transport: Transport, options?: CreateAuthOpt
         refreshToken: string;
     }>;
     signUp: (email: string, password: string, displayName?: string) => Promise<{
+        confirmationRequired: true;
+        user: null;
+        accessToken: null;
+        refreshToken: null;
+    } | {
+        confirmationRequired: false;
         user: User;
         accessToken: string;
         refreshToken: string;
@@ -149,8 +156,11 @@ export declare function createAuth(transport: Transport, options?: CreateAuthOpt
          * Start enrolling a TOTP factor.
          *
          * Returns the secret and an `otpauth://` URI to render as a QR code,
-         * plus ten single-use recovery codes. **Show the recovery codes once
-         * and never again** — only their hashes are stored.
+         * plus — with the account's first factor — ten single-use recovery
+         * codes. **Show the recovery codes once and never again**: only their
+         * hashes are stored. Adding another factor keeps the codes the account
+         * has, and `recoveryCodes` is then `null`; `regenerateRecoveryCodes()`
+         * replaces them.
          *
          * The factor is not usable until `verify` confirms the user's
          * authenticator produced a correct code from it.
@@ -169,7 +179,7 @@ export declare function createAuth(transport: Transport, options?: CreateAuthOpt
                 uri: string;
                 qrUri: string;
             };
-            recoveryCodes: string[];
+            recoveryCodes: string[] | null;
         }>;
         /** Confirm an enrolment with a code from the authenticator app. */
         verify(factorId: string, code: string): Promise<{
@@ -188,8 +198,18 @@ export declare function createAuth(transport: Transport, options?: CreateAuthOpt
             createdAt: string;
         }[]>;
         /**
-         * Remove a factor. Requires an `aal2` session — one that has already
-         * answered a challenge — so a stolen `aal1` token cannot turn MFA off.
+         * Replace the account's recovery codes with ten new ones, shown once.
+         * Needs an `aal2` session. Adding a second factor keeps the codes the
+         * account already has; this is how to get new ones.
+         */
+        regenerateRecoveryCodes(): Promise<{
+            recoveryCodes: string[];
+        }>;
+        /**
+         * Remove a factor. Once the account has a verified factor this
+         * requires an `aal2` session — one that has already answered a
+         * challenge — so a stolen `aal1` token cannot turn MFA off. An
+         * unfinished first enrolment can be removed from any session.
          */
         unenroll(factorId: string): Promise<{
             success: boolean;
@@ -258,9 +278,23 @@ export declare function createAuth(transport: Transport, options?: CreateAuthOpt
         success: boolean;
         message: string;
     }>;
-    verifyEmail: (token: string) => Promise<{
+    verifyEmail: (token: string, options?: {
+        password?: string;
+        removeUnproven?: boolean;
+    }) => Promise<{
         success: boolean;
-        message: string;
+        passwordRemoved: boolean;
+        removedProviders: string[];
+        session: RebaseSession | null;
+    }>;
+    changeEmail: (newEmail: string) => Promise<{
+        pendingEmail: string;
+        expiresAt: string;
+    }>;
+    confirmEmailChange: (token: string) => Promise<{
+        uid: string;
+        email: string;
+        removedProviders: string[];
     }>;
     sendMagicLink: (email: string) => Promise<{
         success: boolean;
@@ -288,12 +322,32 @@ export declare function createAuth(transport: Transport, options?: CreateAuthOpt
     revokeAllSessions: () => Promise<{
         success: boolean;
     }>;
-    getAuthConfig: () => Promise<AuthAdapterCapabilities>;
+    getAuthConfig: () => Promise<AuthConfigDocument>;
     getSession: () => RebaseSession | null;
     onAuthStateChange: (callback: (event: AuthChangeEvent, session: RebaseSession | null) => void) => () => boolean;
     canRestoreSession: () => boolean;
     isInitialized: () => Promise<void>;
+    /**
+     * How restoring the session on load ended — see
+     * {@link SessionRestoreOutcome}. `"unreachable"` with no session is
+     * the one case where "signed out" is not known to be true: the
+     * device could not ask.
+     */
+    restoreOutcome: () => SessionRestoreOutcome;
 };
+/**
+ * How restoring the session on load ended — `auth.restoreOutcome()`.
+ *
+ * - `"pending"`: still restoring (`isInitialized()` has not settled).
+ * - `"restored"`: a session was restored, from storage or from the server.
+ * - `"none"`: there was nothing to restore.
+ * - `"refused"`: there was a session to restore, and the server refused it.
+ * - `"unreachable"`: the server could not be reached (or answered 5xx), so the
+ *   session was neither confirmed nor refused. With a stored session the
+ *   client keeps it and retries; in cookie mode, where nothing is stored on the
+ *   device, it has no session until a later refresh or sign-in succeeds.
+ */
+export type SessionRestoreOutcome = "pending" | "restored" | "none" | "refused" | "unreachable";
 export interface CookieStorageOptions {
     path?: string;
     domain?: string;

package/dist/backups.d.ts

@@ -1,13 +1,20 @@
 import { Transport } from "./transport.js";
-import { type BackupInfo, type BackupDestinationKind } from "@rebasepro/types";
+import { type BackupDownloadLink, type BackupListing } from "@rebasepro/types";
 export interface CreateBackupsOptions {
     backupsPath?: string;
 }
+/** One backup's bytes, as {@link createBackups}' `stream()` answers them. */
+export interface BackupStream {
+    /** The dump, read from the server as it is consumed. */
+    stream: ReadableStream<Uint8Array>;
+    /** Its size in bytes, when the server said. */
+    size?: number;
+    /** Its file name: the key's last segment, as the server names the download. */
+    name: string;
+}
 export declare function createBackups(transport: Transport, options?: CreateBackupsOptions): {
-    list: () => Promise<{
-        backups: BackupInfo[];
-        destinationKind: BackupDestinationKind;
-        configured: boolean;
-    }>;
-    download: (key: string) => Promise<Blob>;
+    list: () => Promise<BackupListing>;
+    download: (key: string) => Promise<void>;
+    downloadUrl: (key: string) => Promise<BackupDownloadLink>;
+    stream: (key: string) => Promise<BackupStream>;
 };

package/dist/collection.d.ts

@@ -1,22 +1,14 @@
 import { FindParams, Transport } from "./transport.js";
 import { RebaseWebSocketClient } from "./websocket.js";
-import { FindResult, SDKCollectionClient } from "@rebasepro/types";
+import { FindResult, SDKCollectionClient, type ByIdReadOptions, type IncludeSpec, type RestoreOptions, type TrashClient, RebaseClientError } from "@rebasepro/types";
+import { etagOf } from "@rebasepro/common";
 /**
- * The version of a row, when it came straight from a read that reported one.
- *
- * ```ts
- * const post = await client.data.posts.get(1);
- * await client.data.posts.update(1, { title: "New" }, { ifMatch: etagOf(post) });
- * ```
- *
- * `undefined` for a row from `find()` (a list response carries one ETag at
- * most, and it would not be this row's), from the offline cache, or from a
- * server that does not send them. Passing `undefined` as `ifMatch` sends no
- * precondition, so the call above degrades to an ordinary update rather than
- * failing — which is the right default, and the reason to read this at the call
- * site where the choice is visible.
+ * A bulk call given something other than an array. A `RebaseClientError` with
+ * the code the server uses for the same mistake in a request body, so one
+ * `case "INVALID_BULK_BODY"` covers both.
  */
-export declare function etagOf(row: unknown): string | undefined;
+export declare function invalidBulkBody(message: string): RebaseClientError;
+export { etagOf };
 /**
  * A live query result: a normal {@link FindResult} plus what an interface
  * needs to decide whether to show a "saving…" or "offline" affordance over it.
@@ -51,6 +43,25 @@ export interface ObserveOptions {
      */
     realtime?: boolean;
 }
+/**
+ * Options for `observeById`: {@link ObserveOptions}, plus the relations to load
+ * into the row. `include` reaches both of its reads — the one-shot
+ * `findById` and the `listenById` subscription — so every emission carries
+ * the same relations.
+ */
+export interface ObserveByIdOptions<Inc = IncludeSpec> extends ObserveOptions, ByIdReadOptions<Inc> {
+}
+/**
+ * {@link TrashClient} and {@link RestoreOptions} are the transport-agnostic
+ * contract in `@rebasepro/types`. On this client every call goes to the
+ * server. With `offline` enabled the trash is not cached and nothing in it is
+ * queued: the local database never holds a trashed row, so it cannot answer
+ * for one, and a restore or a purge made offline would act on a row this
+ * device cannot see. They reject with `OFFLINE` instead (see
+ * `isOfflineError`). A restored row joins the local database; a purged one
+ * leaves it.
+ */
+export type { RestoreOptions, TrashClient };
 /**
  * The concrete, HTTP-backed implementation of the public
  * {@link SDKCollectionClient} contract — flat rows (no Entity wrapper), plus
@@ -61,8 +72,13 @@ export interface ObserveOptions {
  * `count()` and the reactive `observe()` pair. Program against
  * {@link SDKCollectionClient} when you want a transport-agnostic type.
  */
-export interface CollectionClient<M extends Record<string, unknown> = Record<string, unknown>, I = Partial<M>, U = Partial<M>> extends SDKCollectionClient<M, I, U> {
-    count(params?: FindParams<M>): Promise<number>;
+export interface CollectionClient<M extends Record<string, unknown> = Record<string, unknown>, I = Partial<M>, U = Partial<M>, Inc = IncludeSpec> extends SDKCollectionClient<M, I, U, Inc> {
+    count(params?: FindParams<M, Inc>): Promise<number>;
+    /**
+     * The collection's trash: list, count, restore and purge the rows a soft
+     * delete stamped. See {@link TrashClient}.
+     */
+    trash: TrashClient<M, Inc>;
     /**
      * Subscribe to a query's results.
      *
@@ -78,8 +94,13 @@ export interface CollectionClient<M extends Record<string, unknown> = Record<str
      *
      * @returns An unsubscribe function.
      */
-    observe(params: FindParams<M> | undefined, onResult: (result: LiveResult<M>) => void, onError?: (error: Error) => void, options?: ObserveOptions): () => void;
+    observe(params: FindParams<M, Inc> | undefined, onResult: (result: LiveResult<M>) => void, onError?: (error: Error) => void, options?: ObserveOptions): () => void;
     /** {@link CollectionClient.observe} for a single row. */
-    observeById(id: string | number, onResult: (row: M | undefined, meta: RowSnapshotMeta) => void, onError?: (error: Error) => void, options?: ObserveOptions): () => void;
+    observeById(id: string | number, onResult: (row: M | undefined, meta: RowSnapshotMeta) => void, onError?: (error: Error) => void, options?: ObserveByIdOptions<Inc>): () => void;
 }
+/**
+ * The part of {@link ObserveByIdOptions} that is a read option: `include`, and
+ * nothing else, so `realtime` never travels as a query parameter.
+ */
+export declare function byIdRead<Inc>(options: ObserveByIdOptions<Inc> | undefined): ByIdReadOptions<Inc> | undefined;
 export declare function createCollectionClient<M extends Record<string, unknown> = Record<string, unknown>>(transport: Transport, slug: string, ws?: RebaseWebSocketClient): CollectionClient<M>;

package/dist/cron.d.ts

@@ -1,19 +1,24 @@
 import { Transport } from "./transport.js";
-import type { CronJobStatus, CronJobLogEntry } from "@rebasepro/types";
+import type { CronJobStatus, CronJobLogEntry, CronJobListing, CronJobStarted } from "@rebasepro/types";
 export interface CreateCronOptions {
     cronPath?: string;
 }
 export declare function createCron(transport: Transport, options?: CreateCronOptions): {
-    listJobs: () => Promise<{
-        jobs: CronJobStatus[];
-    }>;
+    listJobs: () => Promise<CronJobListing>;
     getJob: (jobId: string) => Promise<{
         job: CronJobStatus;
     }>;
-    triggerJob: (jobId: string) => Promise<{
-        log: CronJobLogEntry;
-        job: CronJobStatus;
-    }>;
+    triggerJob: {
+        (jobId: string, options?: {
+            async?: false;
+        }): Promise<{
+            log: CronJobLogEntry;
+            job: CronJobStatus;
+        }>;
+        (jobId: string, options: {
+            async: true;
+        }): Promise<CronJobStarted>;
+    };
     getJobLogs: (jobId: string, options?: {
         limit?: number;
     }) => Promise<{

package/dist/exports-contract.types.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Compile-time assertion that a consumer can name, from `@rebasepro/client`
+ * alone, the types its own calls are written in.
+ *
+ * A plain module under `src`, imported by nothing, for the reason
+ * `query-contract.types.ts` gives: `pnpm typecheck` reads `src`, and a type
+ * assertion in a jest test is checked by nothing. A browser app installs this
+ * package only, so an argument type missing from the barrel is one it has to
+ * spell out by hand or reach into a package it never installed.
+ */
+import type { AggregateMeta, AggregateParams, AggregateResult, AggregateRow, AggregateSelect, FieldPath, FilterCondition, FilterConditionFor, FilterValues, IncludeOptions, IncludeSpec, InsertOf, LogicalCondition, LogicalConditionFor, OrderBySpec, QueryComputedFields, RestoreOptions, RowOf, StorageSource, TrashClient, UpdateOf, WhereConditionFor, WhereFilterOp, WhereFor, WhereValueFor, WriteOptions } from "./index.js";
+export type ConsumerCanName = [
+    AggregateMeta,
+    AggregateParams,
+    AggregateResult,
+    AggregateRow,
+    AggregateSelect,
+    FieldPath,
+    FilterCondition,
+    FilterValues<string>,
+    IncludeOptions,
+    IncludeSpec,
+    InsertOf<Record<string, unknown>>,
+    LogicalCondition,
+    OrderBySpec,
+    FilterConditionFor<Record<string, unknown>>,
+    LogicalConditionFor<Record<string, unknown>>,
+    QueryComputedFields,
+    RowOf<Record<string, unknown>>,
+    StorageSource,
+    UpdateOf<Record<string, unknown>>,
+    WhereConditionFor<string>,
+    WhereFilterOp,
+    WhereFor<Record<string, unknown>>,
+    WhereValueFor<"==", string>,
+    WriteOptions,
+    RestoreOptions,
+    TrashClient
+];

package/dist/functions.d.ts

@@ -28,21 +28,11 @@ export interface FunctionsClient {
      *                  One path segment: a sub-path goes in `options.path`.
      * @param payload - Optional JSON-serialisable body. Dropped for `GET`.
      * @param options - Optional overrides (HTTP method, sub-path, extra headers).
-     * @returns The parsed JSON response from the function.
+     * @returns The parsed JSON response from the function, or — with
+     *          `options.responseType` — its text, a `Blob`, or the raw `Response`.
      */
     invoke<T = unknown>(name: string, payload?: unknown, options?: FunctionInvokeOptions): Promise<T>;
 }
 export type { FunctionInvokeOptions } from "@rebasepro/types";
 import type { FunctionInvokeOptions } from "@rebasepro/types";
-/**
- * Create a `FunctionsClient` backed by the given transport.
- *
- * The transport already handles:
- * - Base URL resolution
- * - JWT injection via `Authorization: Bearer`
- * - 401 retry / `onUnauthorized` flow
- * - Consistent error throwing via `RebaseApiError`
- *
- * @internal
- */
 export declare function createFunctionsClient(transport: Transport): FunctionsClient;