@rebasepro/client 0.9.1-canary.a639738 → 0.9.1-canary.a8dbf1c

package/dist/auth.d.ts

@@ -147,6 +147,11 @@ export declare function createAuth(transport: Transport, options?: CreateAuthOpt
         success: boolean;
         message: string;
     }>;
+    linkProvider: (providerId: string, payload: Record<string, unknown>) => Promise<{
+        success: boolean;
+        provider: string;
+        alreadyLinked: boolean;
+    }>;
     sendVerificationEmail: () => Promise<{
         success: boolean;
         message: string;

package/dist/index.d.ts

@@ -7,6 +7,7 @@ import { createApiKeys, CreateApiKeysOptions } from "./api-keys";
 import { CollectionClient } from "./collection";
 import { createFunctionsClient } from "./functions";
 import { RebaseWebSocketClient } from "./websocket";
+import { RebaseRealtimeChannel, type ChannelOptions } from "./realtime-channel";
 import { InsertOf, RebaseClient, RebaseSdkData, RowOf, StorageSource, StorageSourceDefinition, StorageSourceRegistry, UpdateOf } from "@rebasepro/types";
 export { RebaseApiError } from "./transport";
 export { RebaseClientError } from "./errors";
@@ -28,7 +29,7 @@ export type { ApiKeyMasked, ApiKeyPermission, ApiKeyWithSecret, CreateApiKeyRequ
 export type { FunctionInvokeOptions, FunctionsClient } from "./functions";
 export { RebaseWebSocketClient } from "./websocket";
 export { RebaseRealtimeChannel } from "./realtime-channel";
-export type { PresenceState, PresenceDiff, BroadcastEvent, ChannelTransport } from "./realtime-channel";
+export type { PresenceState, PresenceDiff, BroadcastEvent, ChannelTransport, ChannelOptions, ChannelHistoryEntry, ChannelHistoryResult } from "./realtime-channel";
 export interface CreateRebaseClientOptions extends RebaseClientConfig {
     auth?: CreateAuthOptions;
     admin?: CreateAdminOptions;
@@ -76,6 +77,24 @@ export type CreateRebaseClientResult<DB = Record<string, unknown>> = Omit<Rebase
     apiKeys: ReturnType<typeof createApiKeys>;
     functions: ReturnType<typeof createFunctionsClient>;
     ws?: RebaseWebSocketClient;
+    /**
+     * Broadcast and presence channels.
+     *
+     * Was missing from this type while present on the returned object, which
+     * made `client.realtime.channel(...)` a type error and forced every adopter
+     * to cast around the feature before they could reach it.
+     */
+    realtime: {
+        /**
+         * Join a broadcast/presence channel. Repeated calls with the same name
+         * return the same channel object. Throws only when the client was
+         * created with `realtime: false`.
+         *
+         * Pass `{ history: true }` to have the channel replay what it missed on
+         * join and on every reconnect, for channels the server retains.
+         */
+        channel: (name: string, options?: ChannelOptions) => RebaseRealtimeChannel;
+    };
     /**
      * Release the realtime socket and its reconnect timer.
      *

package/dist/index.es.js

@@ -54,6 +54,28 @@ function buildQueryString(params) {
 	}
 	return parts.length > 0 ? "?" + parts.join("&") : "";
 }
+/**
+* The base every request and every caller-built URL resolves against.
+*
+* `baseUrl` is optional because the common production shape is a Rebase
+* backend serving its own SPA, where the API is simply the page's origin.
+* Leaving it unset is therefore the *correct* configuration there — and the
+* one that keeps working when a second hostname (a custom domain) points at
+* the same app.
+*
+* When unset in a browser this resolves to the page origin rather than "".
+* Requests behave identically either way, but the empty string is a trap for
+* anything that builds a URL from `client.baseUrl`: `new URL("" + path)`
+* throws, so apps "fixed" it by baking an absolute host into their bundle —
+* which is exactly what breaks the day a custom domain is added, and which no
+* amount of CORS configuration repairs, because a SameSite=Lax auth cookie is
+* not sent cross-site either.
+*/
+function resolveBaseUrl(configured) {
+	if (configured) return configured.replace(/\/$/, "");
+	if (typeof window !== "undefined" && window.location?.origin) return window.location.origin;
+	return "";
+}
 function createTransport(config) {
 	const fetchFn = config.fetch || globalThis.fetch;
 	const apiPath = config.apiPath || "/api";
@@ -68,7 +90,7 @@ function createTransport(config) {
 		};
 	}
 	async function request(path, init) {
-		const url = (config.baseUrl ? config.baseUrl.replace(/\/$/, "") : "") + apiPath + path;
+		const url = resolveBaseUrl(config.baseUrl) + apiPath + path;
 		let activeToken = token;
 		if (tokenGetter) try {
 			const fetched = await tokenGetter();
@@ -143,7 +165,7 @@ function createTransport(config) {
 			onUnauthorizedHandler = handler;
 		},
 		get baseUrl() {
-			return config.baseUrl ? config.baseUrl.replace(/\/$/, "") : "";
+			return resolveBaseUrl(config.baseUrl);
 		},
 		get apiPath() {
 			return apiPath;
@@ -605,6 +627,30 @@ function createAuth(transport, options) {
 			})
 		});
 	}
+	/**
+	* Link an OAuth provider to the **currently signed-in** account.
+	*
+	* Use this when `signIn*` failed with `EMAIL_NOT_VERIFIED` — an account
+	* with that email already exists under a different sign-in method — or to
+	* attach a provider whose email differs from the account's.
+	*
+	* The payload is the same one the provider's sign-in method takes, e.g.
+	* `linkProvider("google", { idToken })`.
+	*
+	* Unlike sign-in, this does not require the provider to have verified the
+	* email, and the emails need not match: the active session already proves
+	* account ownership.
+	*
+	* Throws `IDENTITY_ALREADY_LINKED` (409) if that provider identity is
+	* attached to a different user. Succeeds idempotently (`alreadyLinked:
+	* true`) if it is already attached to the current one.
+	*/
+	async function linkProvider(providerId, payload) {
+		return transport.request(authPath + "/link/" + providerId, {
+			method: "POST",
+			body: JSON.stringify(payload)
+		});
+	}
 	async function sendVerificationEmail() {
 		return transport.request(authPath + "/send-verification", { method: "POST" });
 	}
@@ -726,6 +772,7 @@ function createAuth(transport, options) {
 		resetPasswordForEmail,
 		resetPassword,
 		changePassword,
+		linkProvider,
 		sendVerificationEmail,
 		verifyEmail,
 		sendMagicLink,
@@ -1416,7 +1463,8 @@ var CHANNEL_MESSAGE_TYPES = new Set([
 	"broadcast",
 	"presence_track",
 	"presence_untrack",
-	"presence_state"
+	"presence_state",
+	"channel_history"
 ]);
 /**
 * Low-level realtime WebSocket client.
@@ -1755,7 +1803,7 @@ var RebaseWebSocketClient = class {
 			}
 			return;
 		}
-		if (typeof message.channel === "string" && (type === "broadcast" || type === "presence_state" || type === "presence_diff")) {
+		if (typeof message.channel === "string" && (type === "broadcast" || type === "presence_state" || type === "presence_diff" || type === "channel_history")) {
 			const handlers = this.channelHandlers.get(message.channel);
 			if (handlers) for (const handler of [...handlers]) try {
 				handler(message);
@@ -2051,6 +2099,9 @@ var RebaseWebSocketClient = class {
 	async fetchAvailableRoles() {
 		return (await this.sendMessage({ type: "FETCH_ROLES" })).roles || [];
 	}
+	async fetchApplicationRoles() {
+		return (await this.sendMessage({ type: "FETCH_APPLICATION_ROLES" })).roles || [];
+	}
 	async fetchCurrentDatabase() {
 		return (await this.sendMessage({ type: "FETCH_CURRENT_DATABASE" })).database;
 	}
@@ -2539,6 +2590,14 @@ var RebaseWebSocketClient = class {
 * before the entry is reaped, so a single dropped frame is not a disappearance.
 */
 var PRESENCE_HEARTBEAT_MS = 2e4;
+/**
+* How long live messages are held back waiting for a catch-up response.
+*
+* Short, because the cost of waiting is visible — on a collaborative document
+* this is a stall in everyone else's edits appearing. Long enough that a slow
+* replay of a busy channel is not abandoned needlessly.
+*/
+var CATCH_UP_TIMEOUT_MS = 1e4;
 var RebaseRealtimeChannel = class {
 	name;
 	transport;
@@ -2551,9 +2610,63 @@ var RebaseRealtimeChannel = class {
 	trackedState = null;
 	heartbeat = null;
 	joined = false;
-	constructor(name, transport) {
+	/** Whether this handle asks the server to replay missed messages. */
+	wantsHistory;
+	/**
+	* Highest sequence number delivered to handlers so far.
+	*
+	* This is the resume point sent as `sinceSeq`, and the watermark that makes
+	* replay idempotent: catch-up ranges overlap with what arrived live, and
+	* anything at or below this has already been seen.
+	*/
+	lastSeq = 0;
+	/**
+	* Live messages that arrived while a catch-up was in flight.
+	*
+	* Without this they would be delivered ahead of the older messages being
+	* fetched, and — worse — would advance {@link lastSeq} past them, so the
+	* catch-up response would then be discarded as already-seen and those
+	* messages would be lost for good. Held here and flushed, in order, once
+	* the replay lands.
+	*/
+	pendingLive = [];
+	catchUpInFlight = false;
+	/**
+	* Deadline for a catch-up response.
+	*
+	* Buffering live messages is only safe because the wait is bounded. A
+	* catch-up frame that never arrives — a server that dropped it, a socket
+	* that died between request and reply — would otherwise leave the channel
+	* silently holding every subsequent edit forever, which is a worse failure
+	* than the one replay was added to fix.
+	*/
+	catchUpTimeout = null;
+	/**
+	* Callers of {@link history} awaiting the next `channel_history` frame.
+	*
+	* These frames are addressed by channel rather than by request id, so they
+	* are matched in arrival order. Requests on one channel are serialized by
+	* the socket, so FIFO is the right correlation here.
+	*/
+	historyWaiters = [];
+	constructor(name, transport, options = {}) {
 		this.name = name;
 		this.transport = transport;
+		this.wantsHistory = options.history ?? false;
+	}
+	/**
+	* Turn on catch-up for a handle that was created without it.
+	*
+	* The client hands back the same channel object for a given name, so a
+	* later `channel(name, { history: true })` has no new object to configure —
+	* it upgrades this one instead. Idempotent, and never downgrades: one
+	* caller asking for history must not be switched off by another that did
+	* not ask.
+	*/
+	enableHistory() {
+		if (this.wantsHistory) return;
+		this.wantsHistory = true;
+		if (this.joined) this.requestHistory();
 	}
 	/**
 	* Join the channel and ask for the current roster.
@@ -2562,6 +2675,27 @@ var RebaseRealtimeChannel = class {
 	* `onBroadcast`; calling it directly is only needed to start receiving
 	* before there is anything to send.
 	*/
+	/**
+	* Send a channel message.
+	*
+	* Every channel message is read by the server out of a `payload` envelope
+	* (`payload?.channel`, `payload?.state`, `payload?.event`). Sending those
+	* fields flat does not error: `payload?.channel` simply reads as
+	* `undefined`, so the client is registered into channel `undefined` with
+	* empty state, and the echo comes back with no `channel` for
+	* `onChannelMessage` to match — presence and broadcast both go quiet with
+	* nothing logged. Funnelled through one place so a new message type cannot
+	* reintroduce that.
+	*/
+	send(type, fields = {}) {
+		return this.transport.sendMessage({
+			type,
+			payload: {
+				channel: this.name,
+				...fields
+			}
+		});
+	}
 	async join() {
 		if (this.joined) return;
 		this.joined = true;
@@ -2569,33 +2703,60 @@ var RebaseRealtimeChannel = class {
 		this.unsubscribers.push(this.transport.onReconnect(() => {
 			this.rejoin();
 		}));
-		await this.transport.sendMessage({
-			type: "join_channel",
-			channel: this.name
-		});
-		await this.transport.sendMessage({
-			type: "presence_state",
-			channel: this.name
-		});
+		await this.send("join_channel");
+		await this.send("presence_state");
+		if (this.wantsHistory) await this.requestHistory();
 	}
 	async rejoin() {
 		try {
-			await this.transport.sendMessage({
-				type: "join_channel",
-				channel: this.name
-			});
-			await this.transport.sendMessage({
-				type: "presence_state",
-				channel: this.name
-			});
-			if (this.trackedState) await this.transport.sendMessage({
-				type: "presence_track",
-				channel: this.name,
-				state: this.trackedState
-			});
+			await this.send("join_channel");
+			await this.send("presence_state");
+			if (this.trackedState) await this.send("presence_track", { state: this.trackedState });
+			if (this.wantsHistory) await this.requestHistory();
 		} catch {}
 	}
 	/**
+	* Ask the server for everything after {@link lastSeq}.
+	*
+	* Live messages are buffered from here until the answer arrives — see
+	* {@link pendingLive}.
+	*/
+	async requestHistory(limit) {
+		this.catchUpInFlight = true;
+		if (this.catchUpTimeout) clearTimeout(this.catchUpTimeout);
+		this.catchUpTimeout = setTimeout(() => this.abandonCatchUp(), CATCH_UP_TIMEOUT_MS);
+		this.catchUpTimeout.unref?.();
+		try {
+			await this.send("channel_history", {
+				sinceSeq: this.lastSeq,
+				...limit !== void 0 ? { limit } : {}
+			});
+		} catch {
+			this.abandonCatchUp();
+		}
+	}
+	/**
+	* Give up waiting for a catch-up and release what was held back.
+	*
+	* The buffered messages are still the freshest thing this client has, so
+	* they are delivered rather than dropped. Callers of {@link history} are
+	* answered with `retained: false` — accurate in the sense that matters:
+	* this client has no history to work from and has to resync.
+	*/
+	abandonCatchUp() {
+		if (this.catchUpTimeout) {
+			clearTimeout(this.catchUpTimeout);
+			this.catchUpTimeout = null;
+		}
+		if (!this.catchUpInFlight) return;
+		this.catchUpInFlight = false;
+		for (const resolve of this.historyWaiters.splice(0)) resolve({
+			messages: [],
+			retained: false
+		});
+		this.flushPendingLive();
+	}
+	/**
 	* Publish this client's presence state, and keep publishing it.
 	*
 	* Calling `track` again replaces the state (and restarts the heartbeat),
@@ -2604,19 +2765,11 @@ var RebaseRealtimeChannel = class {
 	async track(state) {
 		await this.join();
 		this.trackedState = state;
-		await this.transport.sendMessage({
-			type: "presence_track",
-			channel: this.name,
-			state
-		});
+		await this.send("presence_track", { state });
 		if (!this.heartbeat) {
 			this.heartbeat = setInterval(() => {
 				if (!this.trackedState) return;
-				this.transport.sendMessage({
-					type: "presence_track",
-					channel: this.name,
-					state: this.trackedState
-				}).catch(() => {});
+				this.send("presence_track", { state: this.trackedState }).catch(() => {});
 			}, PRESENCE_HEARTBEAT_MS);
 			this.heartbeat.unref?.();
 		}
@@ -2625,10 +2778,7 @@ var RebaseRealtimeChannel = class {
 	async untrack() {
 		this.stopHeartbeat();
 		this.trackedState = null;
-		if (this.joined) await this.transport.sendMessage({
-			type: "presence_untrack",
-			channel: this.name
-		});
+		if (this.joined) await this.send("presence_untrack");
 	}
 	/**
 	* Observe the roster. The handler fires immediately with what is already
@@ -2643,9 +2793,7 @@ var RebaseRealtimeChannel = class {
 	/** Send a broadcast. The sender does not receive its own message. */
 	async broadcast(event, payload) {
 		await this.join();
-		await this.transport.sendMessage({
-			type: "broadcast",
-			channel: this.name,
+		await this.send("broadcast", {
 			event,
 			payload
 		});
@@ -2658,6 +2806,34 @@ var RebaseRealtimeChannel = class {
 		this.join();
 		return () => this.broadcastHandlers.delete(wrapped);
 	}
+	/**
+	* The last sequence number this channel has delivered.
+	*
+	* Zero on a channel that retains nothing. Persist it if you want catch-up
+	* to survive a page reload as well as a reconnect, and pass it back via
+	* {@link history}.
+	*/
+	get sequence() {
+		return this.lastSeq;
+	}
+	/**
+	* Fetch retained messages explicitly, instead of waiting for join or
+	* reconnect to do it.
+	*
+	* Defaults to resuming from {@link sequence}. Messages are delivered to
+	* `onBroadcast` handlers as usual — the returned value is for callers that
+	* want to inspect the batch, or to learn from `retained` that the channel
+	* keeps no history at all.
+	*/
+	async history(options = {}) {
+		await this.join();
+		if (options.sinceSeq !== void 0) this.lastSeq = options.sinceSeq;
+		const result = new Promise((resolve) => {
+			this.historyWaiters.push(resolve);
+		});
+		await this.requestHistory(options.limit);
+		return result;
+	}
 	/** Leave the channel and release every listener and timer. */
 	async leave() {
 		this.stopHeartbeat();
@@ -2665,14 +2841,22 @@ var RebaseRealtimeChannel = class {
 		this.presences = {};
 		this.presenceHandlers.clear();
 		this.broadcastHandlers.clear();
+		this.lastSeq = 0;
+		this.pendingLive = [];
+		this.catchUpInFlight = false;
+		if (this.catchUpTimeout) {
+			clearTimeout(this.catchUpTimeout);
+			this.catchUpTimeout = null;
+		}
+		for (const resolve of this.historyWaiters.splice(0)) resolve({
+			messages: [],
+			retained: false
+		});
 		for (const off of this.unsubscribers) off();
 		this.unsubscribers = [];
 		if (this.joined) {
 			this.joined = false;
-			await this.transport.sendMessage({
-				type: "leave_channel",
-				channel: this.name
-			});
+			await this.send("leave_channel");
 		}
 	}
 	stopHeartbeat() {
@@ -2700,15 +2884,71 @@ var RebaseRealtimeChannel = class {
 				break;
 			}
 			case "broadcast": {
+				const seq = typeof message.seq === "number" ? message.seq : void 0;
 				const event = {
 					event: message.event,
-					payload: message.payload
+					payload: message.payload,
+					...seq !== void 0 ? { seq } : {}
 				};
-				for (const handler of this.broadcastHandlers) handler(event);
+				if (seq === void 0) {
+					this.deliver(event);
+					break;
+				}
+				if (this.catchUpInFlight) {
+					this.pendingLive.push(event);
+					break;
+				}
+				if (seq <= this.lastSeq) break;
+				this.lastSeq = seq;
+				this.deliver(event);
+				break;
+			}
+			case "channel_history": {
+				this.catchUpInFlight = false;
+				if (this.catchUpTimeout) {
+					clearTimeout(this.catchUpTimeout);
+					this.catchUpTimeout = null;
+				}
+				const entries = message.messages ?? [];
+				const retained = message.retained === true;
+				const latestSeq = typeof message.latestSeq === "number" ? message.latestSeq : void 0;
+				for (const resolve of this.historyWaiters.splice(0)) resolve({
+					messages: entries,
+					retained,
+					latestSeq
+				});
+				for (const entry of entries) {
+					if (entry.seq <= this.lastSeq) continue;
+					this.lastSeq = entry.seq;
+					this.deliver({
+						event: entry.event,
+						payload: entry.payload,
+						seq: entry.seq,
+						replayed: true
+					});
+				}
+				this.flushPendingLive();
 				break;
 			}
 		}
 	}
+	/** Deliver everything held back during a catch-up, in sequence order. */
+	flushPendingLive() {
+		if (this.pendingLive.length === 0) return;
+		const buffered = this.pendingLive.sort((a, b) => (a.seq ?? 0) - (b.seq ?? 0));
+		this.pendingLive = [];
+		for (const event of buffered) {
+			const seq = event.seq;
+			if (seq !== void 0) {
+				if (seq <= this.lastSeq) continue;
+				this.lastSeq = seq;
+			}
+			this.deliver(event);
+		}
+	}
+	deliver(event) {
+		for (const handler of [...this.broadcastHandlers]) handler(event);
+	}
 	emitPresence(diff) {
 		const snapshot = { ...this.presences };
 		for (const handler of this.presenceHandlers) handler(snapshot, diff);
@@ -2886,13 +3126,13 @@ function createRebaseClient(options) {
 		* own membership — and `leave()` from one would otherwise silently
 		* cut off the others.
 		*/
-channel: (name) => {
+channel: (name, options) => {
 			if (!ws) throw new RebaseClientError("Realtime is disabled on this client (realtime: false), so channels are unavailable.");
 			let existing = realtimeChannels.get(name);
 			if (!existing) {
-				existing = new RebaseRealtimeChannel(name, ws);
+				existing = new RebaseRealtimeChannel(name, ws, options);
 				realtimeChannels.set(name, existing);
-			}
+			} else if (options?.history) existing.enableHistory();
 			return existing;
 		} },
 		/**