@bunbase-ae/js 2.13.3-next.300.4a69028 → 2.13.3-next.310.9b923b7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bunbase-ae/js",
-  "version": "2.13.3-next.300.4a69028",
+  "version": "2.13.3-next.310.9b923b7",
   "type": "module",
   "description": "TypeScript/JavaScript SDK for BunBase",
   "license": "UNLICENSED",

package/src/admin.ts

@@ -650,23 +650,25 @@ class AdminCollectionsClient {
     if (opts.includeDeleted) params.include_deleted = "true";
     if (opts.search) params.search = opts.search;
     if (opts.filter) {
+      // Encode filters as a single ?filter=[{field,op,value}, …] JSON array.
+      // See buildQueryString in collection.ts for the rationale (issue #533):
+      // the bracket form silently corrupts values containing commas.
+      const fieldFilters: { field: string; op: string; value: unknown }[] = [];
       for (const [key, value] of Object.entries(opts.filter)) {
         if (value === undefined || value === null) continue;
-        if (typeof value === "object" && !Array.isArray(value)) {
-          // Operator filter: { age: { gte: 18 } } → filter[age][gte]=18
+        if (Array.isArray(value)) {
+          fieldFilters.push({ field: key, op: "in", value });
+        } else if (typeof value === "object") {
           for (const [op, opVal] of Object.entries(value as Record<string, unknown>)) {
             if (opVal !== undefined && opVal !== null) {
-              params[`filter[${key}][${op}]`] = String(opVal);
+              fieldFilters.push({ field: key, op, value: opVal });
             }
           }
-        } else if (Array.isArray(value)) {
-          // Array shorthand: { stage: ["a", "b"] } → filter[stage][in]=a,b
-          params[`filter[${key}][in]`] = value.join(",");
         } else {
-          // Equality filter: { status: "active" } → filter[status]=active
-          params[`filter[${key}]`] = String(value);
+          fieldFilters.push({ field: key, op: "eq", value });
         }
       }
+      if (fieldFilters.length) params.filter = JSON.stringify(fieldFilters);
     }
     return this.http.request<AdminListResult<T & AdminRecord>>(
       "GET",
@@ -1097,11 +1099,27 @@ export interface NamedQueryParamDef {
   required?: boolean;
 }
 
+/**
+ * Access rules valid for a named query.
+ *
+ * Named queries don't carry a record-level owner — `"owner"` (which is valid
+ * on collections) has no per-row meaning here and is rejected at create/update
+ * time. Use `"authenticated"` for logged-in-only access, or `{ role: "..." }`
+ * for role-gated access.
+ */
+export type NamedQueryAccessRule = Exclude<AccessRule, "owner">;
+
 export interface NamedQuery {
   name: string;
   description: string | null;
   sql: string;
   params: Record<string, NamedQueryParamDef>;
+  /**
+   * The persisted access rule. New queries are restricted to
+   * {@link NamedQueryAccessRule}; this remains the broader {@link AccessRule}
+   * union so legacy rows persisted before the validator was tightened can
+   * still be read.
+   */
   access: AccessRule;
   row_limit: number;
   timeout_ms: number;
@@ -1122,7 +1140,7 @@ export interface CreateNamedQueryInput {
   description?: string | null;
   sql: string;
   params?: Record<string, NamedQueryParamDef>;
-  access?: AccessRule;
+  access?: NamedQueryAccessRule;
   row_limit?: number;
   timeout_ms?: number;
   result_cache_ttl_s?: number;

package/src/collection.ts

@@ -161,24 +161,28 @@ export function buildQueryString<T extends Record<string, unknown> = Record<stri
   const params: Record<string, string> = {};
 
   if (query.filter) {
+    // Encode filters as a single ?filter=[{field,op,value}, …] JSON array.
+    // The bracket form (?filter[field][op]=value) joins array values on ",", which
+    // silently corrupts any value containing a comma — see issue #533. The JSON
+    // form preserves array values verbatim and is parsed by the server's
+    // parseFilterJson (apps/server/src/routes/_filterParams.ts).
+    const fieldFilters: { field: string; op: string; value: unknown }[] = [];
     for (const [field, value] of Object.entries(query.filter)) {
       if (value === undefined || value === null) continue;
 
-      if (typeof value === "object" && !Array.isArray(value)) {
-        // Operator filter: { age: { gte: 18 } } → filter[age][gte]=18
+      if (Array.isArray(value)) {
+        fieldFilters.push({ field, op: "in", value });
+      } else if (typeof value === "object") {
         for (const [op, opVal] of Object.entries(value as Record<string, unknown>)) {
           if (opVal !== undefined && opVal !== null) {
-            params[`filter[${field}][${op}]`] = String(opVal);
+            fieldFilters.push({ field, op, value: opVal });
           }
         }
-      } else if (Array.isArray(value)) {
-        // Array shorthand: { stage: ["a", "b"] } → filter[stage][in]=a,b
-        params[`filter[${field}][in]`] = value.join(",");
       } else {
-        // Equality filter: { status: "published" } → filter[status]=published
-        params[`filter[${field}]`] = String(value);
+        fieldFilters.push({ field, op: "eq", value });
       }
     }
+    if (fieldFilters.length) params.filter = JSON.stringify(fieldFilters);
   }
 
   if (query.sort) params.sort = query.sort;

package/src/types.ts

@@ -166,8 +166,10 @@ export type FilterFieldValue<V> = V | FilterArrayShorthandValue<V> | FilterOpera
  * filter: { rfid_tag: { in: ["a", "b"] } }
  * filter: { score: { gte: 0, lte: 100 } }
  */
-// Simple: { status: "published" }  → filter[status]=published
-// Operator: { age: { gte: 18 } }  → filter[age][gte]=18
+// Wire format: a single ?filter=[{field,op,value}, …] JSON entry.
+// Simple   { status: "published" }   → [{ field: "status", op: "eq", value: "published" }]
+// Operator { age: { gte: 18 } }      → [{ field: "age", op: "gte", value: 18 }]
+// Array    { id: ["a", "b"] }        → [{ field: "id", op: "in", value: ["a", "b"] }]
 export type Filter<T = Record<string, unknown>> = {
   [K in Exclude<keyof T, keyof BunBaseRecord>]?: FilterFieldValue<T[K]>;
 } & {