nodestack-client 1.3.0 → 2.1.0

package/dist/Client.d.ts

@@ -5,7 +5,9 @@ import { RealtimeService } from './services/RealtimeService';
 import { AdminService } from './services/AdminService';
 import { CollectionService } from './services/CollectionService';
 import { DemoService } from './services/DemoService';
+import { SnapshotService } from './services/SnapshotService';
 import { WebhookService } from './services/WebhookService';
+import { AppService } from './services/AppService';
 import type { ClientOptions, SendOptions, RecordModel, ChaosOptions } from './types';
 /**
  * Main NodeStack Client SDK entry point.
@@ -13,12 +15,16 @@ import type { ClientOptions, SendOptions, RecordModel, ChaosOptions } from './ty
 export declare class NodeStackClient<TCollections extends Record<string, any> = Record<string, RecordModel>> {
     readonly baseUrl: string;
     readonly authStore: BaseAuthStore;
+    apiKey?: string;
     readonly files: FileService;
     readonly realtime: RealtimeService;
     readonly admins: AdminService;
     readonly collections: CollectionService;
+    readonly snapshots: SnapshotService;
     readonly demo: DemoService;
     readonly webhooks: WebhookService;
+    readonly apps: AppService;
+    readonly appSlug?: string;
     private customFetch?;
     private defaultHeaders;
     private defaultTimeout;
@@ -65,5 +71,10 @@ export declare class NodeStackClient<TCollections extends Record<string, any> =
      * Fetches system metrics & analytics (Admin only).
      */
     metrics(): Promise<any>;
+    /**
+     * Returns a new NodeStackClient instance scoped to a specific application/MVP.
+     * Inherits baseUrl, authStore, customFetch, defaultHeaders, and defaultTimeout.
+     */
+    app<TAppCollections extends Record<string, any> = Record<string, RecordModel>>(slug: string, options?: Partial<ClientOptions>): NodeStackClient<TAppCollections>;
 }
 //# sourceMappingURL=Client.d.ts.map

package/dist/Client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Client.d.ts","sourceRoot":"","sources":["../src/Client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAGrD,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,KAAK,EACV,aAAa,EACb,WAAW,EACX,WAAW,EACX,YAAY,EACb,MAAM,SAAS,CAAC;AAEjB;;GAEG;AACH,qBAAa,eAAe,CAAC,YAAY,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC;IACjG,SAAgB,OAAO,EAAE,MAAM,CAAC;IAChC,SAAgB,SAAS,EAAE,aAAa,CAAC;IACzC,SAAgB,KAAK,EAAE,WAAW,CAAC;IACnC,SAAgB,QAAQ,EAAE,eAAe,CAAC;IAC1C,SAAgB,MAAM,EAAE,YAAY,CAAC;IACrC,SAAgB,WAAW,EAAE,iBAAiB,CAAC;IAC/C,SAAgB,IAAI,EAAE,WAAW,CAAC;IAClC,SAAgB,QAAQ,EAAE,cAAc,CAAC;IAEzC,OAAO,CAAC,WAAW,CAAC,CAAe;IACnC,OAAO,CAAC,cAAc,CAAyB;IAC/C,OAAO,CAAC,cAAc,CAAS;IAC/B,OAAO,CAAC,YAAY,CAA6B;IACjD,OAAO,CAAC,cAAc,CAA8C;gBAExD,OAAO,GAAE,MAAY,EAAE,OAAO,GAAE,aAAkB;IAgB9D;;;OAGG;IACI,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI,GAAG,IAAI;IAInD;;OAEG;IACI,QAAQ,IAAI,YAAY,GAAG,IAAI;IAItC;;;;OAIG;IACI,UAAU,CAAC,CAAC,SAAS,MAAM,YAAY,EAAE,IAAI,EAAE,CAAC,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACjF,UAAU,CAAC,CAAC,GAAG,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC;IAWlE;;;OAGG;IACU,IAAI,CAAC,CAAC,GAAG,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,CAAC,CAAC;IAsJ/E;;OAEG;IACU,MAAM,IAAI,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;KAAE,CAAC;IAItE;;OAEG;IACU,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC;IAIrC;;OAEG;IACU,IAAI,CAAC,IAAI,SAAI,EAAE,OAAO,SAAK,GAAG,OAAO,CAAC,GAAG,CAAC;IAOvD;;OAEG;IACU,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC;CAGrC"}
+{"version":3,"file":"Client.d.ts","sourceRoot":"","sources":["../src/Client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAGrD,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,KAAK,EACV,aAAa,EACb,WAAW,EACX,WAAW,EACX,YAAY,EACb,MAAM,SAAS,CAAC;AAEjB;;GAEG;AACH,qBAAa,eAAe,CAAC,YAAY,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC;IACjG,SAAgB,OAAO,EAAE,MAAM,CAAC;IAChC,SAAgB,SAAS,EAAE,aAAa,CAAC;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;IACvB,SAAgB,KAAK,EAAE,WAAW,CAAC;IACnC,SAAgB,QAAQ,EAAE,eAAe,CAAC;IAC1C,SAAgB,MAAM,EAAE,YAAY,CAAC;IACrC,SAAgB,WAAW,EAAE,iBAAiB,CAAC;IAC/C,SAAgB,SAAS,EAAE,eAAe,CAAC;IAC3C,SAAgB,IAAI,EAAE,WAAW,CAAC;IAClC,SAAgB,QAAQ,EAAE,cAAc,CAAC;IACzC,SAAgB,IAAI,EAAE,UAAU,CAAC;IACjC,SAAgB,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjC,OAAO,CAAC,WAAW,CAAC,CAAe;IACnC,OAAO,CAAC,cAAc,CAAyB;IAC/C,OAAO,CAAC,cAAc,CAAS;IAC/B,OAAO,CAAC,YAAY,CAA6B;IACjD,OAAO,CAAC,cAAc,CAA8C;IAEpE,YAAY,OAAO,GAAE,MAAY,EAAE,OAAO,GAAE,aAAkB,EAkB7D;IAED;;;OAGG;IACI,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI,GAAG,IAAI,CAElD;IAED;;OAEG;IACI,QAAQ,IAAI,YAAY,GAAG,IAAI,CAErC;IAED;;;;OAIG;IACI,UAAU,CAAC,CAAC,SAAS,MAAM,YAAY,EAAE,IAAI,EAAE,CAAC,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IAClF,UAAU,CAAC,CAAC,GAAG,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;IAWnE;;;OAGG;IACU,IAAI,CAAC,CAAC,GAAG,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,CAAC,CAAC,CA0J9E;IAED;;OAEG;IACU,MAAM,IAAI,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;KAAE,CAAC,CAErE;IAED;;OAEG;IACU,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,CAEpC;IAED;;OAEG;IACU,IAAI,CAAC,IAAI,SAAI,EAAE,OAAO,SAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAKtD;IAED;;OAEG;IACU,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,CAEnC;IAED;;;OAGG;IACI,GAAG,CAAC,eAAe,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EAClF,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,OAAO,CAAC,aAAa,CAAM,GACnC,eAAe,CAAC,eAAe,CAAC,CAUlC;CACF"}

package/dist/auth/BaseAuthStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"BaseAuthStore.d.ts","sourceRoot":"","sources":["../../src/auth/BaseAuthStore.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAExD,MAAM,MAAM,kBAAkB,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,GAAG,UAAU,GAAG,IAAI,KAAK,IAAI,CAAC;AAEjG;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAqC1E;AAED;;GAEG;AACH,8BAAsB,aAAa;IACjC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAM;IAC9B,SAAS,CAAC,MAAM,EAAE,WAAW,GAAG,UAAU,GAAG,IAAI,CAAQ;IACzD,OAAO,CAAC,UAAU,CAAsC;IAExD,IAAW,KAAK,IAAI,MAAM,CAEzB;IAED,IAAW,KAAK,IAAI,WAAW,GAAG,UAAU,GAAG,IAAI,CAElD;IAED;;OAEG;IACH,IAAW,OAAO,IAAI,OAAO,CAgB5B;IAED;;OAEG;IACI,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,WAAW,GAAG,UAAU,GAAG,IAAI,GAAG,IAAI;IAMzE;;OAEG;IACI,KAAK,IAAI,IAAI;IAMpB;;;OAGG;IACI,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,EAAE,eAAe,UAAQ,GAAG,MAAM,IAAI;IAelF;;OAEG;IACH,SAAS,CAAC,MAAM,IAAI,IAAI;CASzB"}
+{"version":3,"file":"BaseAuthStore.d.ts","sourceRoot":"","sources":["../../src/auth/BaseAuthStore.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAExD,MAAM,MAAM,kBAAkB,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,GAAG,UAAU,GAAG,IAAI,KAAK,IAAI,CAAC;AAEjG;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAqC1E;AAED;;GAEG;AACH,8BAAsB,aAAa;IACjC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAM;IAC9B,SAAS,CAAC,MAAM,EAAE,WAAW,GAAG,UAAU,GAAG,IAAI,CAAQ;IACzD,OAAO,CAAC,UAAU,CAAsC;IAExD,IAAW,KAAK,IAAI,MAAM,CAEzB;IAED,IAAW,KAAK,IAAI,WAAW,GAAG,UAAU,GAAG,IAAI,CAElD;IAED;;OAEG;IACH,IAAW,OAAO,IAAI,OAAO,CAgB5B;IAED;;OAEG;IACI,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,WAAW,GAAG,UAAU,GAAG,IAAI,GAAG,IAAI,CAIxE;IAED;;OAEG;IACI,KAAK,IAAI,IAAI,CAInB;IAED;;;OAGG;IACI,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,EAAE,eAAe,UAAQ,GAAG,MAAM,IAAI,CAajF;IAED;;OAEG;IACH,SAAS,CAAC,MAAM,IAAI,IAAI,CAQvB;CACF"}

package/dist/auth/LocalAuthStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"LocalAuthStore.d.ts","sourceRoot":"","sources":["../../src/auth/LocalAuthStore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAExD,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACpC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAID;;;;GAIG;AACH,qBAAa,cAAe,SAAQ,aAAa;IAC/C,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,OAAO,CAAC,CAAc;gBAElB,UAAU,GAAE,MAA4B,EAAE,aAAa,CAAC,EAAE,WAAW;IAajF,OAAO,CAAC,WAAW;IAiBH,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,WAAW,GAAG,UAAU,GAAG,IAAI,GAAG,IAAI;IAkBlE,KAAK,IAAI,IAAI;CAW9B"}
+{"version":3,"file":"LocalAuthStore.d.ts","sourceRoot":"","sources":["../../src/auth/LocalAuthStore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAExD,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACpC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAID;;;;GAIG;AACH,qBAAa,cAAe,SAAQ,aAAa;IAC/C,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,OAAO,CAAC,CAAc;IAE9B,YAAY,UAAU,GAAE,MAA4B,EAAE,aAAa,CAAC,EAAE,WAAW,EAWhF;IAED,OAAO,CAAC,WAAW;IAiBH,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,WAAW,GAAG,UAAU,GAAG,IAAI,GAAG,IAAI,CAgBjF;IAEe,KAAK,IAAI,IAAI,CAU5B;CACF"}

package/dist/auth/PkceUtil.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Lightweight, zero-dependency PKCE helper for browsers and Node.js environments.
+ */
+export declare class PkceUtil {
+    static generateVerifier(length?: number): string;
+    static generateChallenge(verifier: string): Promise<string>;
+    static base64UrlEncode(bytes: Uint8Array): string;
+}
+//# sourceMappingURL=PkceUtil.d.ts.map

package/dist/auth/PkceUtil.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PkceUtil.d.ts","sourceRoot":"","sources":["../../src/auth/PkceUtil.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,qBAAa,QAAQ;IACnB,OAAc,gBAAgB,CAAC,MAAM,SAAK,GAAG,MAAM,CAgClD;IAED,OAAoB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAsBvE;IAED,OAAc,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAiCvD;CACF"}

package/dist/errors/ClientResponseError.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ClientResponseError.d.ts","sourceRoot":"","sources":["../../src/errors/ClientResponseError.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,0BAA0B;IACzC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,GAAG,CAAC;IACX,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,GAAG,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,SAAgB,GAAG,EAAE,MAAM,CAAC;IAC5B,SAAgB,MAAM,EAAE,MAAM,CAAC;IAC/B,SAAgB,IAAI,EAAE,GAAG,CAAC;IAC1B,SAAgB,OAAO,EAAE,OAAO,CAAC;IACjC,SAAgB,aAAa,CAAC,EAAE,GAAG,CAAC;gBAExB,OAAO,GAAE,0BAA+B;IAmB7C,MAAM;;;;;;;;CAUd"}
+{"version":3,"file":"ClientResponseError.d.ts","sourceRoot":"","sources":["../../src/errors/ClientResponseError.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,0BAA0B;IACzC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,GAAG,CAAC;IACX,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,GAAG,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,SAAgB,GAAG,EAAE,MAAM,CAAC;IAC5B,SAAgB,MAAM,EAAE,MAAM,CAAC;IAC/B,SAAgB,IAAI,EAAE,GAAG,CAAC;IAC1B,SAAgB,OAAO,EAAE,OAAO,CAAC;IACjC,SAAgB,aAAa,CAAC,EAAE,GAAG,CAAC;IAEpC,YAAY,OAAO,GAAE,0BAA+B,EAiBnD;IAEM,MAAM;QAET,IAAI;QACJ,OAAO;QACP,GAAG;QACH,MAAM;QACN,IAAI;QACJ,OAAO;MAEV;CACF"}

package/dist/index.cjs

@@ -21,6 +21,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var index_exports = {};
 __export(index_exports, {
   AdminService: () => AdminService,
+  AppService: () => AppService,
   BaseAuthStore: () => BaseAuthStore,
   BaseService: () => BaseService,
   ClientResponseError: () => ClientResponseError,
@@ -30,8 +31,10 @@ __export(index_exports, {
   LocalAuthStore: () => LocalAuthStore,
   MemoryAuthStore: () => MemoryAuthStore,
   NodeStackClient: () => NodeStackClient,
+  PkceUtil: () => PkceUtil,
   RealtimeService: () => RealtimeService,
   RecordService: () => RecordService,
+  SnapshotService: () => SnapshotService,
   WebhookService: () => WebhookService,
   computeWebhookSignature: () => computeWebhookSignature,
   decodeJwtPayload: () => decodeJwtPayload,
@@ -375,6 +378,175 @@ var RecordService = class extends BaseService {
     }
     return result;
   }
+  /**
+   * Returns a list of configured and enabled OAuth2 authentication providers.
+   */
+  async listAuthMethods(redirectUri) {
+    return this.send(
+      `/api/collections/${encodeURIComponent(this.collectionName)}/auth-methods`,
+      {
+        method: "GET",
+        query: redirectUri ? { redirectUri } : void 0
+      }
+    );
+  }
+  /**
+   * Authenticates against an auth collection using OAuth2 with PKCE code exchange.
+   * On success, automatically persists the token and record to authStore.
+   */
+  async authWithOAuth2(options) {
+    let code = options.code;
+    let codeVerifier = options.codeVerifier;
+    if ((options.urlCallback || options.popup || typeof window !== "undefined" && !code && !codeVerifier) && (!code || !codeVerifier)) {
+      const authMethods = await this.listAuthMethods(options.redirectUrl);
+      const provider = authMethods.authProviders.find(
+        (p) => p.name.toLowerCase() === options.provider.toLowerCase()
+      );
+      if (!provider) {
+        throw new Error(`OAuth provider '${options.provider}' is not enabled or configured.`);
+      }
+      codeVerifier = provider.codeVerifier;
+      const expectedState = provider.state;
+      let expectedOrigin = null;
+      if (typeof window !== "undefined" && window.location) {
+        if (options.redirectUrl) {
+          try {
+            expectedOrigin = new URL(options.redirectUrl, window.location.href).origin;
+          } catch {
+            expectedOrigin = window.location.origin;
+          }
+        } else {
+          expectedOrigin = window.location.origin;
+        }
+      }
+      let popup = options.popup || null;
+      if (options.urlCallback) {
+        const cbResult = options.urlCallback(provider.authUrl);
+        if (!popup && cbResult && typeof cbResult.postMessage === "function") {
+          popup = cbResult;
+        }
+      } else if (typeof window !== "undefined" && typeof window.open === "function") {
+        popup = window.open(provider.authUrl, "_blank", "width=600,height=700");
+        if (!popup) {
+          throw new Error("Failed to open OAuth popup window. It may have been blocked by the browser.");
+        }
+      }
+      return new Promise((resolve, reject) => {
+        if (typeof window !== "undefined" && window.addEventListener) {
+          let pollTimer = null;
+          const cleanup = () => {
+            if (pollTimer) {
+              clearInterval(pollTimer);
+              pollTimer = null;
+            }
+            if (typeof window !== "undefined" && window.removeEventListener) {
+              window.removeEventListener("message", handler);
+            }
+          };
+          const handler = async (event) => {
+            if (!event.data || typeof event.data !== "object" || event.data.type !== "nodestack_oauth_callback") {
+              return;
+            }
+            if (expectedOrigin && event.origin !== expectedOrigin) {
+              return;
+            }
+            if (popup) {
+              if (event.source !== popup) {
+                return;
+              }
+            } else if (event.source === window) {
+              return;
+            }
+            if (expectedState && event.data.state !== expectedState) {
+              return;
+            }
+            cleanup();
+            if (popup && typeof popup.close === "function") {
+              try {
+                popup.close();
+              } catch {
+              }
+            }
+            if (event.data.error) {
+              const errMsg = typeof event.data.error === "string" ? event.data.error : event.data.error.message || event.data.error_description || JSON.stringify(event.data.error);
+              return reject(new Error(errMsg));
+            }
+            if (!event.data.code) {
+              return reject(new Error("OAuth callback message is missing authorization code."));
+            }
+            try {
+              const res = await this.authWithOAuth2({
+                provider: options.provider,
+                code: event.data.code,
+                codeVerifier,
+                redirectUrl: options.redirectUrl,
+                createData: options.createData,
+                state: expectedState
+              });
+              resolve(res);
+            } catch (err) {
+              reject(err);
+            }
+          };
+          window.addEventListener("message", handler);
+          if (popup) {
+            pollTimer = setInterval(() => {
+              if (popup && popup.closed) {
+                cleanup();
+                reject(new Error("The OAuth popup window was closed before completing authentication."));
+              }
+            }, 500);
+          }
+        } else {
+          reject(new Error("urlCallback requires code and codeVerifier in non-browser environments."));
+        }
+      });
+    }
+    if (!code || !codeVerifier) {
+      throw new Error("Both code and codeVerifier are required for OAuth2 authentication");
+    }
+    const result = await this.send(
+      `/api/collections/${encodeURIComponent(this.collectionName)}/auth-with-oauth2`,
+      {
+        method: "POST",
+        body: {
+          provider: options.provider,
+          code,
+          codeVerifier,
+          state: options.state,
+          redirectUrl: options.redirectUrl,
+          createData: options.createData
+        }
+      }
+    );
+    if (result && result.token) {
+      this.client.authStore.save(result.token, result.record);
+    }
+    return result;
+  }
+  /**
+   * Lists external social identities linked to a specific record.
+   */
+  async listExternalAuths(recordId) {
+    return this.send(
+      `/api/collections/${encodeURIComponent(this.collectionName)}/records/${encodeURIComponent(recordId)}/external-auths`,
+      {
+        method: "GET"
+      }
+    );
+  }
+  /**
+   * Unlinks an external social identity from a record.
+   */
+  async unlinkExternalAuth(recordId, provider) {
+    await this.send(
+      `/api/collections/${encodeURIComponent(this.collectionName)}/records/${encodeURIComponent(recordId)}/external-auths/${encodeURIComponent(provider)}`,
+      {
+        method: "DELETE"
+      }
+    );
+    return true;
+  }
   /**
    * Exports records from the collection as CSV or JSON.
    */
@@ -466,7 +638,8 @@ var FileService = class extends BaseService {
     const cleanCol = encodeURIComponent(collectionName);
     const cleanId = encodeURIComponent(recordId);
     const cleanFile = encodeURIComponent(filename);
-    let url = `${cleanBase}/api/files/${cleanCol}/${cleanId}/${cleanFile}`;
+    const appSlug = options.app || this.client.appSlug;
+    let url = appSlug && appSlug !== "default" ? `${cleanBase}/api/apps/${encodeURIComponent(appSlug)}/files/${cleanCol}/${cleanId}/${cleanFile}` : `${cleanBase}/api/files/${cleanCol}/${cleanId}/${cleanFile}`;
     const queryParts = [];
     if (options.download) {
       queryParts.push("download=1");
@@ -539,8 +712,16 @@ var RealtimeService = class extends BaseService {
         const EventSourceClass = this.getEventSourceConstructor();
         const base = (this.client.baseUrl || "").replace(/\/+$/, "");
         let url = `${base}/api/realtime`;
+        const queryParams = new URLSearchParams();
         if (this.client.authStore.token) {
-          url += `?token=${encodeURIComponent(this.client.authStore.token)}`;
+          queryParams.append("token", this.client.authStore.token);
+        }
+        if (this.client.appSlug) {
+          queryParams.append("app", this.client.appSlug);
+        }
+        const qs = queryParams.toString();
+        if (qs) {
+          url += `?${qs}`;
         }
         this.eventSource = new EventSourceClass(url);
         const handleConnect = async (event) => {
@@ -772,6 +953,8 @@ var AdminService = class extends BaseService {
 
 // src/services/CollectionService.ts
 var CollectionService = class extends BaseService {
+  list = this.getList.bind(this);
+  get = this.getOne.bind(this);
   /**
    * Retrieves all collection schema models.
    */
@@ -878,11 +1061,72 @@ var DemoService = class extends BaseService {
   }
 };
 
+// src/services/SnapshotService.ts
+var SnapshotService = class extends BaseService {
+  /**
+   * Retrieves all snapshots, active baseline, and live drift information.
+   */
+  async list() {
+    return this.send("/api/snapshots", {
+      method: "GET"
+    });
+  }
+  /**
+   * Alias for list() to retrieve status.
+   */
+  async getStatus() {
+    return this.list();
+  }
+  /**
+   * Creates a new application state snapshot.
+   * If snapshot limit (10) is reached, evictOldest: true can be passed to confirm eviction of the oldest.
+   */
+  async create(options) {
+    return this.send("/api/snapshots", {
+      method: "POST",
+      body: options || {}
+    });
+  }
+  /**
+   * Retrieves a specific snapshot by ID.
+   */
+  async get(id) {
+    return this.send(`/api/snapshots/${encodeURIComponent(id)}`, {
+      method: "GET"
+    });
+  }
+  /**
+   * Restores application state to a specific snapshot.
+   * Note: Future snapshots are NOT deleted; history remains intact.
+   */
+  async restore(id) {
+    return this.send(`/api/snapshots/${encodeURIComponent(id)}/restore`, {
+      method: "POST"
+    });
+  }
+  /**
+   * Deletes a specific snapshot by ID.
+   */
+  async delete(id) {
+    return this.send(`/api/snapshots/${encodeURIComponent(id)}`, {
+      method: "DELETE"
+    });
+  }
+  /**
+   * Clears all saved snapshots.
+   */
+  async clear() {
+    return this.send("/api/snapshots", {
+      method: "DELETE"
+    });
+  }
+};
+
 // src/services/WebhookService.ts
 function computeWebhookSignature(payload, secret) {
   const str = typeof payload === "string" ? payload : JSON.stringify(payload);
   try {
-    const nodeCrypto = typeof require !== "undefined" ? require("crypto") : globalThis?.crypto;
+    const nodeCrypto = typeof require !== "undefined" ? require("crypto") : typeof globalThis !== "undefined" ? globalThis.require?.("crypto") || globalThis.crypto : null;
     if (nodeCrypto && typeof nodeCrypto.createHmac === "function") {
       return nodeCrypto.createHmac("sha256", secret).update(str, "utf8").digest("hex");
     }
@@ -906,9 +1150,10 @@ function verifyWebhookSignature(payload, signatureHeader, secret) {
   }
   if (cleanHeader.length !== expected.length) return false;
   try {
-    const nodeCrypto = typeof require !== "undefined" ? require("crypto") : null;
-    if (nodeCrypto && typeof nodeCrypto.timingSafeEqual === "function" && typeof Buffer !== "undefined") {
-      return nodeCrypto.timingSafeEqual(Buffer.from(cleanHeader, "hex"), Buffer.from(expected, "hex"));
+    const nodeCrypto = typeof require !== "undefined" ? require("crypto") : typeof globalThis !== "undefined" ? globalThis.require?.("crypto") : null;
+    const buf = typeof Buffer !== "undefined" ? Buffer : typeof globalThis !== "undefined" ? globalThis.Buffer : null;
+    if (nodeCrypto && typeof nodeCrypto.timingSafeEqual === "function" && buf) {
+      return nodeCrypto.timingSafeEqual(buf.from(cleanHeader, "hex"), buf.from(expected, "hex"));
     }
   } catch {
   }
@@ -1035,16 +1280,70 @@ var WebhookService = class extends BaseService {
   static computeSignature = computeWebhookSignature;
 };
 
+// src/services/AppService.ts
+var AppService = class extends BaseService {
+  list = this.getList.bind(this);
+  get = this.getOne.bind(this);
+  /**
+   * Retrieves all configured applications.
+   */
+  async getList() {
+    const res = await this.send("/api/apps", {
+      method: "GET"
+    });
+    return Array.isArray(res) ? res : res?.items || [];
+  }
+  /**
+   * Retrieves a single application by ID or slug.
+   */
+  async getOne(appId) {
+    return this.send(`/api/apps/${encodeURIComponent(appId)}`, {
+      method: "GET"
+    });
+  }
+  /**
+   * Creates a new application.
+   */
+  async create(data) {
+    return this.send("/api/apps", {
+      method: "POST",
+      body: data
+    });
+  }
+  /**
+   * Updates an existing application.
+   */
+  async update(appId, data) {
+    return this.send(`/api/apps/${encodeURIComponent(appId)}`, {
+      method: "PATCH",
+      body: data
+    });
+  }
+  /**
+   * Deletes an application by ID or slug.
+   */
+  async delete(appId) {
+    await this.send(`/api/apps/${encodeURIComponent(appId)}`, {
+      method: "DELETE"
+    });
+    return true;
+  }
+};
+
 // src/Client.ts
-var NodeStackClient = class {
+var NodeStackClient = class _NodeStackClient {
   baseUrl;
   authStore;
+  apiKey;
   files;
   realtime;
   admins;
   collections;
+  snapshots;
   demo;
   webhooks;
+  apps;
+  appSlug;
   customFetch;
   defaultHeaders;
   defaultTimeout;
@@ -1053,16 +1352,20 @@ var NodeStackClient = class {
   constructor(baseUrl = "/", options = {}) {
     this.baseUrl = (baseUrl || "/").replace(/\/+$/, "");
     this.authStore = options.authStore || new LocalAuthStore();
+    this.apiKey = options.apiKey;
     this.customFetch = options.fetch;
     this.defaultHeaders = options.headers || {};
     this.defaultTimeout = options.timeout || 12e4;
     this.chaosOptions = options.chaos ? { ...options.chaos } : null;
+    this.appSlug = options.app;
     this.files = new FileService(this);
     this.realtime = new RealtimeService(this, options.EventSource);
     this.admins = new AdminService(this);
     this.collections = new CollectionService(this);
+    this.snapshots = new SnapshotService(this);
     this.demo = new DemoService(this);
     this.webhooks = new WebhookService(this);
+    this.apps = new AppService(this);
   }
   /**
    * Dynamically configure latency & chaos simulation options for all future requests.
@@ -1113,9 +1416,14 @@ var NodeStackClient = class {
       ...this.defaultHeaders,
       ...options.headers || {}
     };
-    if (this.authStore.token && !headers["Authorization"] && !headers["authorization"]) {
+    if (this.apiKey && !headers["Authorization"] && !headers["authorization"] && !headers["x-api-key"] && !headers["X-API-Key"]) {
+      headers["Authorization"] = `Bearer ${this.apiKey}`;
+    } else if (this.authStore.token && !headers["Authorization"] && !headers["authorization"]) {
       headers["Authorization"] = `Bearer ${this.authStore.token}`;
     }
+    if (this.appSlug && !headers["x-nodestack-app"] && !headers["X-NodeStack-App"]) {
+      headers["x-nodestack-app"] = this.appSlug;
+    }
     const effectiveChaos = {
       ...this.chaosOptions || {},
       ...options.chaos || {},
@@ -1232,10 +1540,111 @@ var NodeStackClient = class {
   async metrics() {
     return this.send("/api/metrics", { method: "GET" });
   }
+  /**
+   * Returns a new NodeStackClient instance scoped to a specific application/MVP.
+   * Inherits baseUrl, authStore, customFetch, defaultHeaders, and defaultTimeout.
+   */
+  app(slug, options = {}) {
+    return new _NodeStackClient(this.baseUrl, {
+      authStore: options.authStore || this.authStore,
+      fetch: options.fetch || this.customFetch,
+      headers: { ...this.defaultHeaders, ...options.headers || {} },
+      timeout: options.timeout !== void 0 ? options.timeout : this.defaultTimeout,
+      chaos: options.chaos !== void 0 ? options.chaos ? { ...options.chaos } : void 0 : this.chaosOptions ? { ...this.chaosOptions } : void 0,
+      app: slug,
+      EventSource: options.EventSource || this.realtime.customEventSource
+    });
+  }
 };
 
 // src/auth/MemoryAuthStore.ts
 var MemoryAuthStore = class extends BaseAuthStore {
   // Inherits default in-memory behavior of BaseAuthStore
 };
+
+// src/auth/PkceUtil.ts
+var PkceUtil = class _PkceUtil {
+  static generateVerifier(length = 64) {
+    const charset = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~";
+    const clampedLength = Math.max(43, Math.min(128, length));
+    const randomBytes = new Uint8Array(clampedLength);
+    const g = typeof globalThis !== "undefined" ? globalThis : {};
+    if (typeof crypto !== "undefined" && crypto.getRandomValues) {
+      crypto.getRandomValues(randomBytes);
+    } else if (g.crypto && g.crypto.getRandomValues) {
+      g.crypto.getRandomValues(randomBytes);
+    } else {
+      let filled = false;
+      try {
+        const req = g.require;
+        if (typeof req === "function") {
+          req("crypto").randomFillSync(randomBytes);
+          filled = true;
+        }
+      } catch {
+      }
+      if (!filled) {
+        throw new Error(
+          "A cryptographically secure random number generator (crypto.getRandomValues or node:crypto) is required to generate a PKCE code_verifier."
+        );
+      }
+    }
+    let result = "";
+    for (let i = 0; i < clampedLength; i++) {
+      result += charset[randomBytes[i] % charset.length];
+    }
+    return result;
+  }
+  static async generateChallenge(verifier) {
+    const encoder = new TextEncoder();
+    const data = encoder.encode(verifier);
+    const g = typeof globalThis !== "undefined" ? globalThis : {};
+    if (typeof crypto !== "undefined" && crypto.subtle) {
+      const hash = await crypto.subtle.digest("SHA-256", data);
+      return _PkceUtil.base64UrlEncode(new Uint8Array(hash));
+    } else if (g.crypto && g.crypto.subtle) {
+      const hash = await g.crypto.subtle.digest("SHA-256", data);
+      return _PkceUtil.base64UrlEncode(new Uint8Array(hash));
+    }
+    try {
+      const req = g.require;
+      if (typeof req === "function") {
+        const hash = req("crypto").createHash("sha256").update(data).digest();
+        return _PkceUtil.base64UrlEncode(new Uint8Array(hash));
+      }
+    } catch {
+    }
+    throw new Error("Web Crypto API (crypto.subtle) is not available to compute SHA-256 code challenge.");
+  }
+  static base64UrlEncode(bytes) {
+    const chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+    let base64 = "";
+    const byteLength = bytes.byteLength;
+    const byteRemainder = byteLength % 3;
+    const mainLength = byteLength - byteRemainder;
+    let a, b, c, d;
+    let chunk;
+    for (let i = 0; i < mainLength; i += 3) {
+      chunk = bytes[i] << 16 | bytes[i + 1] << 8 | bytes[i + 2];
+      a = (chunk & 16515072) >> 18;
+      b = (chunk & 258048) >> 12;
+      c = (chunk & 4032) >> 6;
+      d = chunk & 63;
+      base64 += chars[a] + chars[b] + chars[c] + chars[d];
+    }
+    if (byteRemainder === 1) {
+      chunk = bytes[mainLength];
+      a = (chunk & 252) >> 2;
+      b = (chunk & 3) << 4;
+      base64 += chars[a] + chars[b] + "==";
+    } else if (byteRemainder === 2) {
+      chunk = bytes[mainLength] << 8 | bytes[mainLength + 1];
+      a = (chunk & 64512) >> 10;
+      b = (chunk & 1008) >> 4;
+      c = (chunk & 15) << 2;
+      base64 += chars[a] + chars[b] + chars[c] + "=";
+    }
+    return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+  }
+};
 //# sourceMappingURL=index.cjs.map