@zveltio/sdk 3.0.0-beta.5 → 3.0.0-beta.70

package/dist/client/Auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Auth.d.ts","sourceRoot":"","sources":["../../src/client/Auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEvD,qBAAa,IAAI;IACf,OAAO,CAAC,MAAM,CAAgB;gBAElB,MAAM,EAAE,aAAa;IAI3B,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,GAAG,CAAC;QAAC,OAAO,EAAE,GAAG,CAAA;KAAE,CAAC;IAW7E,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,GAAG,CAAA;KAAE,CAAC;IAW7E,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAOxB,UAAU,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,GAAG,CAAC;QAAC,OAAO,EAAE,GAAG,CAAA;KAAE,GAAG,IAAI,CAAC;IAQ/D,eAAe,CAAC,QAAQ,EAAE,QAAQ,GAAG,QAAQ,GAAG,WAAW,GAAG,IAAI;CAGnE"}
+{"version":3,"file":"Auth.d.ts","sourceRoot":"","sources":["../../src/client/Auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEvD,qBAAa,IAAI;IACf,OAAO,CAAC,MAAM,CAAgB;gBAElB,MAAM,EAAE,aAAa;IAK3B,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,GAAG,CAAC;QAAC,OAAO,EAAE,GAAG,CAAA;KAAE,CAAC;IAY7E,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,GAAG,CAAA;KAAE,CAAC;IAW7E,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAQxB,UAAU,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,GAAG,CAAC;QAAC,OAAO,EAAE,GAAG,CAAA;KAAE,GAAG,IAAI,CAAC;IAQ/D,eAAe,CAAC,QAAQ,EAAE,QAAQ,GAAG,QAAQ,GAAG,WAAW,GAAG,IAAI;CAGnE"}

package/dist/client/Auth.js

@@ -3,6 +3,7 @@ export class Auth {
     constructor(config) {
         this.config = config;
     }
+    // biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
     async signIn(email, password) {
         const res = await fetch(`${this.config.baseUrl}/api/auth/sign-in/email`, {
             method: 'POST',
@@ -14,6 +15,7 @@ export class Auth {
             throw new Error((await res.json()).message || 'Sign in failed');
         return res.json();
     }
+    // biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
     async signUp(name, email, password) {
         const res = await fetch(`${this.config.baseUrl}/api/auth/sign-up/email`, {
             method: 'POST',
@@ -31,6 +33,7 @@ export class Auth {
             credentials: 'include',
         });
     }
+    // biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
     async getSession() {
         const res = await fetch(`${this.config.baseUrl}/api/me`, { credentials: 'include' });
         if (!res.ok)

package/dist/client/QueryBuilder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"QueryBuilder.d.ts","sourceRoot":"","sources":["../../src/client/QueryBuilder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEpF,qBAAa,YAAY;IACvB,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,OAAO,CAAgB;IAC/B,OAAO,CAAC,QAAQ,CAA2B;IAC3C,OAAO,CAAC,QAAQ,CAAoB;gBAExB,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa;IAMrD,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,IAAI;IACtC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,IAAI;IAWlD,IAAI,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI;IAIrB,KAAK,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI;IAMtB,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,GAAE,KAAK,GAAG,MAAc,GAAG,IAAI;IAO1D,MAAM,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI;IAMjB,KAAK,CAAC,CAAC,GAAG,GAAG,EAAE,eAAe,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IAiCxE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,cAAc,CAAC,CAAC,EAAE,CAAC;CAY9D"}
+{"version":3,"file":"QueryBuilder.d.ts","sourceRoot":"","sources":["../../src/client/QueryBuilder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEpF,qBAAa,YAAY;IACvB,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,OAAO,CAAgB;IAE/B,OAAO,CAAC,QAAQ,CAA2B;IAC3C,OAAO,CAAC,QAAQ,CAAoB;gBAExB,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa;IAOrD,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,IAAI;IAEtC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,IAAI;IAYlD,IAAI,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI;IAIrB,KAAK,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI;IAMtB,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,GAAE,KAAK,GAAG,MAAc,GAAG,IAAI;IAO1D,MAAM,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI;IAOjB,KAAK,CAAC,CAAC,GAAG,GAAG,EAAE,eAAe,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IAkCxE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,cAAc,CAAC,CAAC,EAAE,CAAC;CAY9D"}

package/dist/client/QueryBuilder.js

@@ -1,12 +1,14 @@
 export class QueryBuilder {
     _collection;
     _config;
+    // biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
     _filters = {};
     _options = {};
     constructor(collection, config) {
         this._collection = collection;
         this._config = config;
     }
+    // biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
     where(field, opOrValue, value) {
         if (value === undefined) {
             this._filters[field] = opOrValue;
@@ -37,6 +39,7 @@ export class QueryBuilder {
         return this;
     }
     // Execute
+    // biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
     async query(overrideOptions) {
         const opts = { ...this._options, ...overrideOptions };
         const params = new URLSearchParams();
@@ -69,6 +72,7 @@ export class QueryBuilder {
         return res.json();
     }
     // Async iterable — allows `for await (const page of query)`
+    // biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
     async *[Symbol.asyncIterator]() {
         let currentPage = this._options.page || 1;
         const pageSize = this._options.limit || 20;

package/dist/client/RealtimeClient.d.ts

@@ -4,16 +4,34 @@ type StatusCallback = (status: 'connecting' | 'connected' | 'disconnected') => v
 export declare class RealtimeClient {
     private ws;
     private baseUrl;
+    private headers;
     private subscriptions;
     private statusCallbacks;
+    private unauthorizedCallbacks;
     private reconnectDelay;
     private maxReconnectDelay;
+    private reconnectAttempts;
+    private maxReconnectAttempts;
+    private reconnectTimer;
     private shouldReconnect;
-    constructor(baseUrl: string);
+    /** Set by a 4001 close; only an explicit `connect()` clears it. */
+    private unauthorized;
+    /**
+     * @param options.headers Sent with the upgrade — e.g. `{ 'X-API-Key': key }`
+     *   for a server-side client (Bun, Node). A browser cannot set headers on a
+     *   WebSocket and authenticates by session cookie.
+     */
+    constructor(baseUrl: string, options?: {
+        headers?: Record<string, string>;
+    });
+    /** Open the socket — also after a 4001, once the app has re-authenticated. */
     connect(): void;
+    private open;
     disconnect(): void;
     subscribe(collection: string, event: string | '*', callback: EventCallback): () => void;
     onStatusChange(callback: StatusCallback): () => void;
+    /** Called when the engine ends the socket because its credentials were revoked. */
+    onUnauthorized(callback: () => void): () => void;
     private sendSubscribe;
     private sendUnsubscribe;
     private notifyStatus;

package/dist/client/RealtimeClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"RealtimeClient.d.ts","sourceRoot":"","sources":["../../src/client/RealtimeClient.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEzD,KAAK,aAAa,GAAG,CAAC,OAAO,EAAE,eAAe,KAAK,IAAI,CAAC;AACxD,KAAK,cAAc,GAAG,CAAC,MAAM,EAAE,YAAY,GAAG,WAAW,GAAG,cAAc,KAAK,IAAI,CAAC;AAEpF,qBAAa,cAAc;IACzB,OAAO,CAAC,EAAE,CAA0B;IACpC,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,aAAa,CAAyC;IAC9D,OAAO,CAAC,eAAe,CAA6B;IACpD,OAAO,CAAC,cAAc,CAAQ;IAC9B,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,eAAe,CAAQ;gBAEnB,OAAO,EAAE,MAAM;IAI3B,OAAO,IAAI,IAAI;IA8Cf,UAAU,IAAI,IAAI;IAQlB,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,GAAG,EAAE,QAAQ,EAAE,aAAa,GAAG,MAAM,IAAI;IAwBvF,cAAc,CAAC,QAAQ,EAAE,cAAc,GAAG,MAAM,IAAI;IAKpD,OAAO,CAAC,aAAa;IAMrB,OAAO,CAAC,eAAe;IAMvB,OAAO,CAAC,YAAY;CAGrB"}
+{"version":3,"file":"RealtimeClient.d.ts","sourceRoot":"","sources":["../../src/client/RealtimeClient.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEzD,KAAK,aAAa,GAAG,CAAC,OAAO,EAAE,eAAe,KAAK,IAAI,CAAC;AACxD,KAAK,cAAc,GAAG,CAAC,MAAM,EAAE,YAAY,GAAG,WAAW,GAAG,cAAc,KAAK,IAAI,CAAC;AAEpF,qBAAa,cAAc;IACzB,OAAO,CAAC,EAAE,CAA0B;IACpC,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,OAAO,CAAqC;IACpD,OAAO,CAAC,aAAa,CAAyC;IAC9D,OAAO,CAAC,eAAe,CAA6B;IACpD,OAAO,CAAC,qBAAqB,CAAyB;IACtD,OAAO,CAAC,cAAc,CAAQ;IAC9B,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,iBAAiB,CAAK;IAC9B,OAAO,CAAC,oBAAoB,CAAM;IAClC,OAAO,CAAC,cAAc,CAA8C;IACpE,OAAO,CAAC,eAAe,CAAQ;IAC/B,mEAAmE;IACnE,OAAO,CAAC,YAAY,CAAS;IAE7B;;;;OAIG;gBACS,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAO;IAK/E,8EAA8E;IAC9E,OAAO,IAAI,IAAI;IAQf,OAAO,CAAC,IAAI;IAkEZ,UAAU,IAAI,IAAI;IAUlB,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,GAAG,EAAE,QAAQ,EAAE,aAAa,GAAG,MAAM,IAAI;IA0BvF,cAAc,CAAC,QAAQ,EAAE,cAAc,GAAG,MAAM,IAAI;IAKpD,mFAAmF;IACnF,cAAc,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI;IAKhD,OAAO,CAAC,aAAa;IAMrB,OAAO,CAAC,eAAe;IAMvB,OAAO,CAAC,YAAY;CAGrB"}

package/dist/client/RealtimeClient.js

@@ -1,29 +1,57 @@
+import { WS_UNAUTHORIZED } from '../realtime.js';
 export class RealtimeClient {
     ws = null;
     baseUrl;
+    headers;
     subscriptions = new Map();
     statusCallbacks = new Set();
+    unauthorizedCallbacks = new Set();
     reconnectDelay = 1000;
     maxReconnectDelay = 30000;
+    reconnectAttempts = 0;
+    maxReconnectAttempts = 10;
+    reconnectTimer = null;
     shouldReconnect = true;
-    constructor(baseUrl) {
+    /** Set by a 4001 close; only an explicit `connect()` clears it. */
+    unauthorized = false;
+    /**
+     * @param options.headers Sent with the upgrade — e.g. `{ 'X-API-Key': key }`
+     *   for a server-side client (Bun, Node). A browser cannot set headers on a
+     *   WebSocket and authenticates by session cookie.
+     */
+    constructor(baseUrl, options = {}) {
         this.baseUrl = baseUrl;
+        this.headers = options.headers;
     }
+    /** Open the socket — also after a 4001, once the app has re-authenticated. */
     connect() {
-        if (this.ws?.readyState === WebSocket.OPEN)
+        this.unauthorized = false;
+        this.shouldReconnect = true;
+        this.reconnectAttempts = 0;
+        this.reconnectDelay = 1000;
+        this.open();
+    }
+    open() {
+        if (this.ws?.readyState === WebSocket.OPEN || this.ws?.readyState === WebSocket.CONNECTING) {
             return;
+        }
         const wsUrl = this.baseUrl.replace(/^http/, 'ws') + '/api/ws';
-        this.ws = new WebSocket(wsUrl);
+        // The two-argument form with `{ headers }` is the Bun/undici extension.
+        const ws = this.headers
+            ? new WebSocket(wsUrl, { headers: this.headers })
+            : new WebSocket(wsUrl);
+        this.ws = ws;
         this.notifyStatus('connecting');
-        this.ws.onopen = () => {
+        ws.onopen = () => {
             this.reconnectDelay = 1000;
+            this.reconnectAttempts = 0;
             this.notifyStatus('connected');
             // Re-subscribe all active subscriptions
             for (const channel of this.subscriptions.keys()) {
                 this.sendSubscribe(channel);
             }
         };
-        this.ws.onmessage = (event) => {
+        ws.onmessage = (event) => {
             try {
                 const message = JSON.parse(event.data);
                 const key = `${message.collection}:${message.event}`;
@@ -39,19 +67,37 @@ export class RealtimeClient {
                 /* ignore invalid messages */
             }
         };
-        this.ws.onclose = () => {
+        ws.onclose = (event) => {
+            // A socket `disconnect()` dropped still reports; one already replaced does not.
+            if (this.ws !== ws) {
+                if (this.ws === null)
+                    this.notifyStatus('disconnected');
+                return;
+            }
             this.notifyStatus('disconnected');
-            if (this.shouldReconnect) {
-                setTimeout(() => this.connect(), this.reconnectDelay);
-                this.reconnectDelay = Math.min(this.reconnectDelay * 2, this.maxReconnectDelay);
+            if (event?.code === WS_UNAUTHORIZED) {
+                // Credentials revoked: every retry would be refused with 401.
+                this.unauthorized = true;
+                this.unauthorizedCallbacks.forEach((cb) => cb());
+                return;
             }
+            // Bounded: a refused handshake (401) is not visible to a WebSocket in any
+            // runtime — it closes as 1002/1006 — so it must not be retried forever.
+            if (!this.shouldReconnect || this.reconnectAttempts >= this.maxReconnectAttempts)
+                return;
+            this.reconnectAttempts++;
+            this.reconnectTimer = setTimeout(() => this.open(), this.reconnectDelay);
+            this.reconnectDelay = Math.min(this.reconnectDelay * 2, this.maxReconnectDelay);
         };
-        this.ws.onerror = () => {
-            this.ws?.close();
+        ws.onerror = () => {
+            ws.close();
         };
     }
     disconnect() {
         this.shouldReconnect = false;
+        if (this.reconnectTimer)
+            clearTimeout(this.reconnectTimer);
+        this.reconnectTimer = null;
         this.ws?.close();
         this.ws = null;
     }
@@ -66,9 +112,11 @@ export class RealtimeClient {
         if (this.ws?.readyState === WebSocket.OPEN) {
             this.sendSubscribe(key);
         }
-        else {
+        else if (!this.unauthorized) {
             this.connect();
         }
+        // After a 4001 the subscription is only recorded: the next explicit
+        // `connect()` sends it. Dialling again would only be refused.
         // Return unsubscribe function
         return () => {
             this.subscriptions.get(key)?.delete(callback);
@@ -82,6 +130,11 @@ export class RealtimeClient {
         this.statusCallbacks.add(callback);
         return () => this.statusCallbacks.delete(callback);
     }
+    /** Called when the engine ends the socket because its credentials were revoked. */
+    onUnauthorized(callback) {
+        this.unauthorizedCallbacks.add(callback);
+        return () => this.unauthorizedCallbacks.delete(callback);
+    }
     sendSubscribe(channel) {
         if (this.ws?.readyState === WebSocket.OPEN) {
             this.ws.send(JSON.stringify({ type: 'subscribe', channel }));

package/dist/client/ZveltioClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ZveltioClient.d.ts","sourceRoot":"","sources":["../../src/client/ZveltioClient.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,aAAa,EACb,YAAY,EACZ,aAAa,EAGb,cAAc,EACf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,qBAAa,aAAa;IACxB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,OAAO,CAAC,MAAM,CAAgB;gBAElB,MAAM,EAAE,aAAa;IAOjC,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,YAAY;IAKhC,IAAI,CAAC,CAAC,GAAG,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IAIpF,GAAG,CAAC,CAAC,GAAG,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAKxD,MAAM,CAAC,CAAC,GAAG,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAQjE,MAAM,CAAC,CAAC,GAAG,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAQ7E,OAAO,CAAC,CAAC,GAAG,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAQrE,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAO/D,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC;CA4B/D;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,aAAa,GAAG,aAAa,CAEjE"}
+{"version":3,"file":"ZveltioClient.d.ts","sourceRoot":"","sources":["../../src/client/ZveltioClient.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,aAAa,EACb,YAAY,EACZ,aAAa,EAGb,cAAc,EACf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,qBAAa,aAAa;IACxB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,OAAO,CAAC,MAAM,CAAgB;gBAElB,MAAM,EAAE,aAAa;IAajC,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,YAAY;IAMhC,IAAI,CAAC,CAAC,GAAG,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IAKpF,GAAG,CAAC,CAAC,GAAG,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAMxD,MAAM,CAAC,CAAC,GAAG,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IASjE,MAAM,CAAC,CAAC,GAAG,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAS7E,OAAO,CAAC,CAAC,GAAG,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAQrE,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAO/D,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC;CA4B/D;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,aAAa,GAAG,aAAa,CAEjE"}

package/dist/client/ZveltioClient.js

@@ -8,20 +8,29 @@ export class ZveltioClient {
     constructor(config) {
         this.config = config;
         this.auth = new Auth(config);
-        this.realtime = new RealtimeClient(config.baseUrl);
+        // The key the HTTP calls send, sent with the upgrade too (server-side
+        // clients; a browser authenticates the socket by its session cookie).
+        this.realtime = new RealtimeClient(config.baseUrl, {
+            headers: config.apiKey ? { 'X-API-Key': config.apiKey } : undefined,
+        });
+        // A socket closed for revoked credentials is the same event as a 401.
+        this.realtime.onUnauthorized(() => config.onUnauthorized?.());
     }
     // Fluent query builder
     from(collection) {
         return new QueryBuilder(collection, this.config);
     }
     // Direct CRUD methods
+    // biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
     async list(collection, options) {
         return this.from(collection).query(options);
     }
+    // biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
     async get(collection, id) {
         const res = await this.request(`/api/data/${collection}/${id}`);
         return res.record;
     }
+    // biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
     async create(collection, data) {
         const res = await this.request(`/api/data/${collection}`, {
             method: 'POST',
@@ -29,6 +38,7 @@ export class ZveltioClient {
         });
         return res.record;
     }
+    // biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
     async update(collection, id, data) {
         const res = await this.request(`/api/data/${collection}/${id}`, {
             method: 'PATCH',
@@ -36,6 +46,7 @@ export class ZveltioClient {
         });
         return res.record;
     }
+    // biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
     async replace(collection, id, data) {
         const res = await this.request(`/api/data/${collection}/${id}`, {
             method: 'PUT',

package/dist/client.d.ts

@@ -3,6 +3,19 @@ export interface ZveltioClientConfig {
     apiKey?: string;
     headers?: Record<string, string>;
 }
+/** `GET /api/api-keys/self` — the key a client authenticates with, as the engine holds it. */
+export interface ApiKeySelf {
+    id: string;
+    name: string;
+    key_prefix: string;
+    scopes: Array<{
+        collection: string;
+        actions: string[];
+    }>;
+    tenant_id: string | null;
+    expires_at: string | null;
+    rls_bypass: boolean;
+}
 export interface ListParams {
     page?: number;
     limit?: number;
@@ -20,8 +33,11 @@ export interface ListResult<T> {
     next_cursor?: string;
 }
 declare class CollectionRef<T extends Record<string, any>> {
-    private readonly name;
     private readonly client;
+    /** URL-encoded once, here: a record id is caller data (a slug, an email, a
+     * composite key), and an unencoded `/`, `?` or `#` in one silently routes
+     * the request somewhere else. */
+    private readonly path;
     constructor(name: string, client: ZveltioClient<any>);
     list(params?: ListParams): Promise<ListResult<T>>;
     getMany(params?: ListParams): Promise<ListResult<T>>;
@@ -69,8 +85,18 @@ export declare class ZveltioClient<Schema extends Record<string, any> = Record<s
         readonly signup: (email: string, password: string, name: string) => Promise<any>;
         readonly logout: () => Promise<any>;
         readonly session: () => Promise<any>;
+        /**
+         * The API key this client was made with: its scopes, tenant, expiry and RLS
+         * exemption — never the hash. 403 for a session, 401 for a key that no
+         * longer authenticates.
+         */
+        readonly apiKey: () => Promise<ApiKeySelf>;
     };
-    /** Storage helpers */
+    /**
+     * Storage helpers. A client made with `apiKey` needs a key holding the `$storage`
+     * scope — `{ collection: '$storage', actions: ['read', 'create', 'delete'] }`; a
+     * `*` collection does not include it, and the engine answers 403 without it.
+     */
     readonly storage: {
         readonly upload: (file: File, folder?: string) => Promise<any>;
         readonly list: (folder?: string) => Promise<any>;

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,UAAU,CAAC,CAAC;IAC3B,IAAI,EAAE,CAAC,EAAE,CAAC;IACV,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,cAAM,aAAa,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;IAE7C,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC;IAG7C,IAAI,CAAC,MAAM,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAajD,OAAO,CAAC,MAAM,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAIpD,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAI3B,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAI9B,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,GAAG,YAAY,GAAG,YAAY,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAIrE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,GAAG,YAAY,GAAG,YAAY,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAI1F,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;CAGlD;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,aAAa,CAAC,MAAM,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;IACjF,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,OAAO,CAAyB;gBAE5B,MAAM,EAAE,mBAAmB;YASzB,OAAO;IAcrB,GAAG,CAAC,CAAC,GAAG,GAAG,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAGtC,IAAI,CAAC,CAAC,GAAG,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAGvD,KAAK,CAAC,CAAC,GAAG,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAGxD,MAAM,CAAC,CAAC,GAAG,GAAG,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAInC,MAAM,CAAC,CAAC,GAAG,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC;IAanE;;;;OAIG;IACH,UAAU,CAAC,CAAC,SAAS,MAAM,MAAM,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC9E,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAK5D,mBAAmB;IACnB,QAAQ,CAAC,IAAI;gCACI,MAAM,YAAY,MAAM;iCAEvB,MAAM,YAAY,MAAM,QAAQ,MAAM;;;MAI7C;IAEX,sBAAsB;IACtB,QAAQ,CAAC,OAAO;gCACC,IAAI,WAAW,MAAM;iCAMpB,MAAM;+BACR,MAAM;MACX;CACZ;AAED,wBAAgB,mBAAmB,CAAC,MAAM,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1F,MAAM,EAAE,mBAAmB,GAC1B,aAAa,CAAC,MAAM,CAAC,CAEvB"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED,8FAA8F;AAC9F,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,KAAK,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACzD,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,UAAU,CAAC,CAAC;IAC3B,IAAI,EAAE,CAAC,EAAE,CAAC;IACV,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAGD,cAAM,aAAa,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;IAS7C,OAAO,CAAC,QAAQ,CAAC,MAAM;IARzB;;qCAEiC;IACjC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;gBAG5B,IAAI,EAAE,MAAM,EAEK,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC;IAK7C,IAAI,CAAC,MAAM,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAajD,OAAO,CAAC,MAAM,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAIpD,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAI3B,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAI9B,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,GAAG,YAAY,GAAG,YAAY,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAIrE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,GAAG,YAAY,GAAG,YAAY,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAI1F,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;CAGlD;AAED;;;;;;;;;;;;GAYG;AAGH,qBAAa,aAAa,CAAC,MAAM,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;IACjF,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,OAAO,CAAyB;gBAE5B,MAAM,EAAE,mBAAmB;YAUzB,OAAO;IAcrB,GAAG,CAAC,CAAC,GAAG,GAAG,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAItC,IAAI,CAAC,CAAC,GAAG,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAIvD,KAAK,CAAC,CAAC,GAAG,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAIxD,MAAM,CAAC,CAAC,GAAG,GAAG,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAKnC,MAAM,CAAC,CAAC,GAAG,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC;IAanE;;;;OAIG;IACH,UAAU,CAAC,CAAC,SAAS,MAAM,MAAM,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAE9E,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAM5D,mBAAmB;IACnB,QAAQ,CAAC,IAAI;gCACI,MAAM,YAAY,MAAM;iCAEvB,MAAM,YAAY,MAAM,QAAQ,MAAM;;;QAItD;;;;WAIG;;MAEM;IAEX;;;;OAIG;IACH,QAAQ,CAAC,OAAO;gCACC,IAAI,WAAW,MAAM;iCAQpB,MAAM;+BAER,MAAM;MACX;CACZ;AAGD,wBAAgB,mBAAmB,CAAC,MAAM,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1F,MAAM,EAAE,mBAAmB,GAC1B,aAAa,CAAC,MAAM,CAAC,CAEvB"}

package/dist/client.js

@@ -1,9 +1,16 @@
+import { ZveltioApiError } from './errors.js';
+// biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
 class CollectionRef {
-    name;
     client;
-    constructor(name, client) {
-        this.name = name;
+    /** URL-encoded once, here: a record id is caller data (a slug, an email, a
+     * composite key), and an unencoded `/`, `?` or `#` in one silently routes
+     * the request somewhere else. */
+    path;
+    constructor(name, 
+    // biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
+    client) {
         this.client = client;
+        this.path = `/api/data/${encodeURIComponent(name)}`;
     }
     list(params) {
         const qs = new URLSearchParams();
@@ -22,25 +29,25 @@ class CollectionRef {
         if (params?.cursor)
             qs.set('cursor', params.cursor);
         const q = qs.toString();
-        return this.client['request']('GET', `/api/data/${this.name}${q ? `?${q}` : ''}`);
+        return this.client['request']('GET', `${this.path}${q ? `?${q}` : ''}`);
     }
     getMany(params) {
         return this.list(params);
     }
     get(id) {
-        return this.client['request']('GET', `/api/data/${this.name}/${id}`);
+        return this.client['request']('GET', `${this.path}/${encodeURIComponent(id)}`);
     }
     getOne(id) {
         return this.get(id);
     }
     create(data) {
-        return this.client['request']('POST', `/api/data/${this.name}`, data);
+        return this.client['request']('POST', this.path, data);
     }
     update(id, data) {
-        return this.client['request']('PATCH', `/api/data/${this.name}/${id}`, data);
+        return this.client['request']('PATCH', `${this.path}/${encodeURIComponent(id)}`, data);
     }
     delete(id) {
-        return this.client['request']('DELETE', `/api/data/${this.name}/${id}`);
+        return this.client['request']('DELETE', `${this.path}/${encodeURIComponent(id)}`);
     }
 }
 /**
@@ -56,6 +63,7 @@ class CollectionRef {
  * Usage without types (untyped, same as before):
  *   const client = createZveltioClient({ baseUrl: '...' });
  */
+// biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
 export class ZveltioClient {
     baseUrl;
     headers;
@@ -67,6 +75,7 @@ export class ZveltioClient {
             ...config.headers,
         };
     }
+    // biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
     async request(method, path, body) {
         const res = await fetch(`${this.baseUrl}${path}`, {
             method,
@@ -75,23 +84,27 @@ export class ZveltioClient {
             body: body ? JSON.stringify(body) : undefined,
         });
         if (!res.ok) {
-            const text = await res.text().catch(() => '');
-            throw new Error(`${method} ${path} failed: ${res.status} ${text}`);
+            throw await ZveltioApiError.fromResponse(res);
         }
         return res.json();
     }
+    // biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
     get(path) {
         return this.request('GET', path);
     }
+    // biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
     post(path, body) {
         return this.request('POST', path, body);
     }
+    // biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
     patch(path, body) {
         return this.request('PATCH', path, body);
     }
+    // biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
     delete(path) {
         return this.request('DELETE', path);
     }
+    // biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
     async upload(path, formData) {
         const headers = { ...this.headers };
         delete headers['Content-Type'];
@@ -102,9 +115,10 @@ export class ZveltioClient {
             body: formData,
         });
         if (!res.ok)
-            throw new Error(`Upload ${path} failed: ${res.status}`);
+            throw await ZveltioApiError.fromResponse(res);
         return res.json();
     }
+    // biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
     collection(name) {
         return new CollectionRef(name, this);
     }
@@ -114,20 +128,33 @@ export class ZveltioClient {
         signup: (email, password, name) => this.request('POST', '/api/auth/sign-up/email', { email, password, name }),
         logout: () => this.request('POST', '/api/auth/sign-out'),
         session: () => this.request('GET', '/api/auth/get-session'),
+        /**
+         * The API key this client was made with: its scopes, tenant, expiry and RLS
+         * exemption — never the hash. 403 for a session, 401 for a key that no
+         * longer authenticates.
+         */
+        apiKey: () => this.request('GET', '/api/api-keys/self'),
     };
-    /** Storage helpers */
+    /**
+     * Storage helpers. A client made with `apiKey` needs a key holding the `$storage`
+     * scope — `{ collection: '$storage', actions: ['read', 'create', 'delete'] }`; a
+     * `*` collection does not include it, and the engine answers 403 without it.
+     */
     storage = {
         upload: (file, folder) => {
             const fd = new FormData();
             fd.append('file', file);
+            // The engine reads `folder_id`; a `folder` field is ignored and the file
+            // lands in the root.
             if (folder)
-                fd.append('folder', folder);
+                fd.append('folder_id', folder);
             return this.upload('/api/storage/upload', fd);
         },
-        list: (folder) => this.get(`/api/storage${folder ? `?folder=${folder}` : ''}`),
+        list: (folder) => this.get(`/api/storage${folder ? `?folder_id=${encodeURIComponent(folder)}` : ''}`),
         delete: (key) => this.delete(`/api/storage/${encodeURIComponent(key)}`),
     };
 }
+// biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
 export function createZveltioClient(config) {
     return new ZveltioClient(config);
 }

package/dist/core.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"core.d.ts","sourceRoot":"","sources":["../src/core.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAIrD,MAAM,WAAW,iBAAiB;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB,CAAC,CAAC;IACjC,OAAO,EAAE,CAAC,EAAE,CAAC;IACb,UAAU,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3E;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,GAAG,GAAG,IAAI,CAAC;IACjB,OAAO,EAAE,GAAG,GAAG,IAAI,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAID,wBAAsB,eAAe,CAAC,CAAC,GAAG,GAAG,EAC3C,MAAM,EAAE,aAAa,EACrB,cAAc,EAAE,MAAM,EACtB,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,CAAC,EAAE,CAAC,CAGd;AAED,wBAAsB,WAAW,CAAC,CAAC,GAAG,GAAG,EACvC,MAAM,EAAE,aAAa,EACrB,cAAc,EAAE,MAAM,EACtB,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAGnB;AAED,wBAAsB,YAAY,CAAC,CAAC,GAAG,GAAG,EACxC,MAAM,EAAE,aAAa,EACrB,cAAc,EAAE,MAAM,EACtB,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,GACf,OAAO,CAAC,CAAC,CAAC,CAGZ;AAED,wBAAsB,YAAY,CAAC,CAAC,GAAG,GAAG,EACxC,MAAM,EAAE,aAAa,EACrB,cAAc,EAAE,MAAM,EACtB,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,GACf,OAAO,CAAC,CAAC,CAAC,CAGZ;AAED,wBAAsB,YAAY,CAChC,MAAM,EAAE,aAAa,EACrB,cAAc,EAAE,MAAM,EACtB,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,IAAI,CAAC,CAEf;AAID,wBAAsB,YAAY,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,SAAS,CAAC,CAO5E;AAED,wBAAsB,SAAS,CAC7B,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,SAAS,CAAC,CAGpB;AAED,wBAAsB,UAAU,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,SAAS,CAAC,CAG1E;AAED,wBAAsB,UAAU,CAC9B,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,SAAS,CAAC,CAGpB;AAID,wBAAsB,UAAU,CAC9B,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,IAAI,EACV,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,WAAW,CAAC,CAGtB;AAED,wBAAsB,SAAS,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAG9F;AAED,wBAAsB,UAAU,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAErF;AAID,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,eAAe,EACzB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,CAAC,KAAK,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,GAAG,CAAA;CAAE,KAAK,IAAI,GACrD,MAAM,IAAI,CAEZ"}
+{"version":3,"file":"core.d.ts","sourceRoot":"","sources":["../src/core.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAIrD,MAAM,WAAW,iBAAiB;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IAEvB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB,CAAC,CAAC;IACjC,OAAO,EAAE,CAAC,EAAE,CAAC;IACb,UAAU,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3E;AAED,MAAM,WAAW,SAAS;IAExB,IAAI,EAAE,GAAG,GAAG,IAAI,CAAC;IAEjB,OAAO,EAAE,GAAG,GAAG,IAAI,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAElB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAKD,wBAAsB,eAAe,CAAC,CAAC,GAAG,GAAG,EAC3C,MAAM,EAAE,aAAa,EACrB,cAAc,EAAE,MAAM,EACtB,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,CAAC,EAAE,CAAC,CAKd;AAGD,wBAAsB,WAAW,CAAC,CAAC,GAAG,GAAG,EACvC,MAAM,EAAE,aAAa,EACrB,cAAc,EAAE,MAAM,EACtB,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAInB;AAGD,wBAAsB,YAAY,CAAC,CAAC,GAAG,GAAG,EACxC,MAAM,EAAE,aAAa,EACrB,cAAc,EAAE,MAAM,EACtB,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,GACf,OAAO,CAAC,CAAC,CAAC,CAKZ;AAGD,wBAAsB,YAAY,CAAC,CAAC,GAAG,GAAG,EACxC,MAAM,EAAE,aAAa,EACrB,cAAc,EAAE,MAAM,EACtB,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,GACf,OAAO,CAAC,CAAC,CAAC,CAKZ;AAED,wBAAsB,YAAY,CAChC,MAAM,EAAE,aAAa,EACrB,cAAc,EAAE,MAAM,EACtB,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,IAAI,CAAC,CAEf;AAID,wBAAsB,YAAY,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,SAAS,CAAC,CAS5E;AAED,wBAAsB,SAAS,CAC7B,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,SAAS,CAAC,CAGpB;AAED,wBAAsB,UAAU,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,SAAS,CAAC,CAG1E;AAED,wBAAsB,UAAU,CAC9B,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,SAAS,CAAC,CAGpB;AAID,wBAAsB,UAAU,CAC9B,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,IAAI,EACV,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,WAAW,CAAC,CAItB;AAED,wBAAsB,SAAS,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAI9F;AAED,wBAAsB,UAAU,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAErF;AAID,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,eAAe,EACzB,UAAU,EAAE,MAAM,EAElB,QAAQ,EAAE,CAAC,KAAK,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,GAAG,CAAA;CAAE,KAAK,IAAI,GACrD,MAAM,IAAI,CAGZ"}

package/dist/core.js

@@ -6,20 +6,31 @@
  * state primitives (useState/ref) and lifecycle hooks (useEffect/onMounted).
  */
 // ── Collection ────────────────────────────────────────────────────────────────
+// biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
 export async function fetchCollection(client, collectionName, options) {
+    // biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
     const result = await client.collection(collectionName).list(options);
+    // biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
     return result?.data ?? result?.records ?? result ?? [];
 }
+// biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
 export async function fetchRecord(client, collectionName, id) {
     const result = await client.collection(collectionName).get(id);
+    // biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
     return result?.data ?? result?.record ?? result ?? null;
 }
+// biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
 export async function createRecord(client, collectionName, data) {
+    // biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
     const result = await client.collection(collectionName).create(data);
+    // biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
     return result?.data ?? result?.record ?? result;
 }
+// biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
 export async function updateRecord(client, collectionName, id, data) {
+    // biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
     const result = await client.collection(collectionName).update(id, data);
+    // biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
     return result?.data ?? result?.record ?? result;
 }
 export async function deleteRecord(client, collectionName, id) {
@@ -28,8 +39,10 @@ export async function deleteRecord(client, collectionName, id) {
 // ── Auth ──────────────────────────────────────────────────────────────────────
 export async function fetchSession(client) {
     try {
-        const session = await client.auth.session();
-        return { user: session?.user ?? null, session };
+        // `/api/auth/get-session` answers `{ session, user }` (or null): `session`
+        // is the envelope's own member, not the envelope.
+        const res = await client.auth.session();
+        return { user: res?.user ?? null, session: res?.session ?? null };
     }
     catch {
         return { user: null, session: null };
@@ -50,16 +63,21 @@ export async function signupUser(client, email, password, name) {
 // ── Storage ───────────────────────────────────────────────────────────────────
 export async function uploadFile(client, file, folder) {
     const result = await client.storage.upload(file, folder);
+    // biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
     return result?.data ?? result?.file ?? result;
 }
 export async function listFiles(client, folder) {
     const result = await client.storage.list(folder);
+    // biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
     return result?.data ?? result?.files ?? result ?? [];
 }
 export async function removeFile(client, fileId) {
     await client.storage.delete(fileId);
 }
 // ── Realtime ──────────────────────────────────────────────────────────────────
-export function subscribeToCollection(realtime, collection, callback) {
+export function subscribeToCollection(realtime, collection, 
+// biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
+callback) {
+    // biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
     return realtime.subscribe(collection, callback);
 }

package/dist/crdt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"crdt.d.ts","sourceRoot":"","sources":["../src/crdt.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,QAAQ,CAAC,CAAC,GAAG,GAAG;IAC/B,KAAK,EAAE,CAAC,CAAC;IACT,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AAEnD;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,GAAG,WAAW,CAkB7E;AAED,gDAAgD;AAChD,wBAAgB,UAAU,CACxB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,WAAW,CAMb;AAED,8CAA8C;AAC9C,wBAAgB,YAAY,CAAC,GAAG,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAMlE;AAID,MAAM,WAAW,YAAY,CAAC,CAAC,GAAG,GAAG;IACnC,KAAK,EAAE,CAAC,CAAC;IACT,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,MAAM,KAAK,CAAC,CAAC,GAAG,GAAG,IAAI,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;AAE/C,wBAAgB,QAAQ,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAE7D;AAED,wBAAgB,WAAW,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAEnE;AAED,wBAAgB,UAAU,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAUzE;AAED,wBAAgB,WAAW,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAEjD;AAID,qBAAa,YAAY;IACvB,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;gBAEtB,QAAQ,EAAE,MAAM,EAAE,OAAO,SAAI;IAKzC,yCAAyC;IACzC,IAAI,IAAI,MAAM;IAId,uDAAuD;IACvD,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;IAKhC,IAAI,OAAO,IAAI,MAAM,CAEpB;IAED,IAAI,EAAE,IAAI,MAAM,CAEf;CACF"}
+{"version":3,"file":"crdt.d.ts","sourceRoot":"","sources":["../src/crdt.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,QAAQ,CAAC,CAAC,GAAG,GAAG;IAC/B,KAAK,EAAE,CAAC,CAAC;IACT,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AAEnD;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,GAAG,WAAW,CAkB7E;AAED,gDAAgD;AAChD,wBAAgB,UAAU,CAExB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,WAAW,CAMb;AAED,8CAA8C;AAE9C,wBAAgB,YAAY,CAAC,GAAG,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAOlE;AAKD,MAAM,WAAW,YAAY,CAAC,CAAC,GAAG,GAAG;IACnC,KAAK,EAAE,CAAC,CAAC;IACT,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,OAAO,CAAC;CAClB;AAGD,MAAM,MAAM,KAAK,CAAC,CAAC,GAAG,GAAG,IAAI,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;AAE/C,wBAAgB,QAAQ,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAE7D;AAED,wBAAgB,WAAW,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAEnE;AAED,wBAAgB,UAAU,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAezE;AAED,wBAAgB,WAAW,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAEjD;AAID,qBAAa,YAAY;IACvB,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;gBAEtB,QAAQ,EAAE,MAAM,EAAE,OAAO,SAAI;IAKzC,yCAAyC;IACzC,IAAI,IAAI,MAAM;IAId,uDAAuD;IACvD,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;IAKhC,IAAI,OAAO,IAAI,MAAM,CAEpB;IAED,IAAI,EAAE,IAAI,MAAM,CAEf;CACF"}