@rebasepro/client 0.13.0 → 0.13.1-canary.g1822133

package/dist/index.es.js

@@ -1,5 +1,5 @@
 import { DEFAULT_STORAGE_SOURCE_KEY, EntityReference, EntityRelation, GeoPoint, PUBLIC_STORAGE_PREFIX, RebaseApiError, RebaseApiError as RebaseApiError$1, RebaseClientError, RebaseClientError as RebaseClientError$1, Vector, isPublicStoragePath, toCanonicalOp } from "@rebasepro/types";
-import { COMPOSITE_ID_SEPARATOR, QueryBuilder, RebasePaginationError, and, buildCompositeId, collectAllPages, cond, or, paginateFind, serializeFilter, serializeLogicalCondition, serializeOrderBy } from "@rebasepro/common";
+import { COMPOSITE_ID_SEPARATOR, QueryBuilder, RebasePaginationError, and, buildCompositeId, collectAllPages, cond, or, paginateFind, resolveFindWindow, serializeFilter, serializeLogicalCondition, serializeOrderBy } from "@rebasepro/common";
 import { toSnakeCase } from "@rebasepro/utils";
 //#region src/reviver.ts
 function rebaseReviver(_key, value) {
@@ -91,7 +91,17 @@ function buildQueryString(params) {
 		const wire = serializeOrderBy(params.orderBy);
 		if (wire) parts.push(`orderBy=${encodeURIComponent(wire)}`);
 	}
-	if (params.searchString) parts.push(`searchString=${encodeURIComponent(params.searchString)}`);
+	if (params.searchString) {
+		parts.push(`searchString=${encodeURIComponent(params.searchString)}`);
+		if (params.searchExplain) parts.push("searchExplain=true");
+	}
+	if (params.vectorSearch) {
+		const vs = params.vectorSearch;
+		parts.push(`vector_search=${encodeURIComponent(vs.property)}`);
+		parts.push(`vector=${encodeURIComponent(JSON.stringify(vs.vector))}`);
+		if (vs.distance) parts.push(`vector_distance=${encodeURIComponent(vs.distance)}`);
+		if (vs.threshold !== void 0) parts.push(`vector_threshold=${encodeURIComponent(String(vs.threshold))}`);
+	}
 	if (params.include && params.include.length > 0) parts.push(`include=${encodeURIComponent(params.include.join(","))}`);
 	if (params.logical) {
 		const root = params.logical;
@@ -131,6 +141,13 @@ function resolveBaseUrl(configured) {
 function createTransport(config, environment) {
 	const fetchFn = config.fetch || globalThis.fetch;
 	const apiPath = config.apiPath || "/api";
+	for (const field of ["baseUrl", "storageUrlOrigin"]) {
+		const value = config[field];
+		if (!value || !apiPath) continue;
+		const trimmed = value.replace(/\/+$/, "");
+		if (!trimmed.endsWith(apiPath)) continue;
+		console.warn(`[Rebase] ${field} ${JSON.stringify(value)} already ends with the API path ${JSON.stringify(apiPath)}, which is appended to it — requests will go to ${trimmed}${apiPath}/… and 404. Pass the origin only (${JSON.stringify(trimmed.slice(0, trimmed.length - apiPath.length) || "/")}), or set \`apiPath\` if the server really does mount the API one level deeper.`);
+	}
 	let token = config.token;
 	let tokenGetter;
 	let onUnauthorizedHandler = config.onUnauthorized;
@@ -160,6 +177,23 @@ function createTransport(config, environment) {
 			...init?.headers || {}
 		};
 	}
+	/**
+	* The refusal for a success status carrying a body this client cannot read.
+	*
+	* The first 120 characters go in the message because they identify the
+	* sender at a glance: `<!doctype html>` says "you are talking to a web
+	* server, not to this API" faster than any wording here could.
+	*
+	* One function for both the first attempt and the post-refresh retry — the
+	* retry is a second copy of this whole response-reading path, and copies
+	* are how one of them ends up fixed and the other not.
+	*/
+	function unreadableResponse(status, text) {
+		return new RebaseApiError$1(`The server answered ${status} with a body that is not JSON, so there is nothing to return. This usually means the request reached something other than the Rebase API — a single-page-app fallback serving index.html, or a proxy error page — so check the API URL configuration (e.g. VITE_API_URL). The body began: ${JSON.stringify(text.slice(0, 120))}`, {
+			status,
+			code: "INVALID_JSON_RESPONSE"
+		});
+	}
 	async function request(path, init) {
 		const url = resolveBaseUrl(config.baseUrl) + apiPath + path;
 		let activeToken = token;
@@ -177,9 +211,27 @@ function createTransport(config, environment) {
 		if (res.status === 204) return void 0;
 		const text = await res.text().catch(() => "");
 		let body = {};
+		/**
+		* Whether the body was there and could not be read as JSON.
+		*
+		* On an error status this does not matter — the status is the answer
+		* and the message falls back to `statusText`. On a *success* status it
+		* is the whole answer, and `{}` was being returned as though the server
+		* had sent it: `find()` answered `{}` instead of an array, `getOne()`
+		* an empty object, with nothing thrown.
+		*
+		* The case that produces it is not exotic. Point `VITE_API_URL` at the
+		* frontend's own host and `/api/data/posts` lands on the SPA fallback,
+		* which answers `200` with `index.html` — so the misconfiguration the
+		* 404 branch below spends four lines explaining reaches the caller, in
+		* its most common form, as an empty success.
+		*/
+		let unreadableBody = false;
 		if (text) try {
 			body = JSON.parse(text, rebaseReviver);
-		} catch (e) {}
+		} catch (e) {
+			unreadableBody = true;
+		}
 		const getErrorField = (obj, field) => {
 			const err = obj?.error;
 			if (err && typeof err === "object" && err !== null) return err[field];
@@ -199,9 +251,12 @@ function createTransport(config, environment) {
 				if (retryRes.status === 204) return void 0;
 				const retryText = await retryRes.text().catch(() => "");
 				let retryBody = {};
+				let retryUnreadable = false;
 				if (retryText) try {
 					retryBody = JSON.parse(retryText, rebaseReviver);
-				} catch (e) {}
+				} catch (e) {
+					retryUnreadable = true;
+				}
 				if (!retryRes.ok) {
 					let fallbackMessage = retryRes.statusText;
 					if (retryRes.status === 404 && !fallbackMessage) fallbackMessage = `Endpoint not found (${init?.method || "GET"} ${path}). This usually means the collection is not registered on the backend, or the frontend API URL configuration (e.g. VITE_API_URL) is missing or pointing to the wrong host.`;
@@ -211,6 +266,7 @@ function createTransport(config, environment) {
 						details: getErrorField(retryBody, "details")
 					});
 				}
+				if (retryUnreadable) throw unreadableResponse(retryRes.status, retryText);
 				return retryBody;
 			}
 		}
@@ -223,6 +279,7 @@ function createTransport(config, environment) {
 				details: getErrorField(body, "details")
 			});
 		}
+		if (unreadableBody) throw unreadableResponse(res.status, text);
 		return body;
 	}
 	return {
@@ -316,6 +373,11 @@ function createAuth(transport, options) {
 	const authFlowMode = opts.authFlowMode || "json";
 	const STORAGE_KEY = "rebase_auth";
 	const REFRESH_BUFFER_MS = 12e4;
+	/**
+	* The largest delay `setTimeout` can hold — 2^31 - 1 ms, about 24.8 days.
+	* Anything larger is silently clamped to 1ms by Node and every browser.
+	*/
+	const MAX_TIMER_DELAY_MS = 2147483647;
 	const MAX_REFRESH_RETRIES = 5;
 	const REFRESH_RETRY_BASE_MS = 1e3;
 	const REFRESH_RETRY_MAX_MS = 3e4;
@@ -343,7 +405,9 @@ function createAuth(transport, options) {
 	function emit(event, session) {
 		for (const fn of listeners) try {
 			fn(event, session);
-		} catch (e) {}
+		} catch (e) {
+			console.error("Error in auth state change listener:", e);
+		}
 	}
 	function saveSession(session) {
 		if (!persistSession || authFlowMode === "cookie") return;
@@ -447,6 +511,10 @@ function createAuth(transport, options) {
 			attemptScheduledRefresh(0);
 			return;
 		}
+		if (delay > MAX_TIMER_DELAY_MS) {
+			refreshTimeout = setTimeout(() => scheduleRefresh(expiresAt), MAX_TIMER_DELAY_MS);
+			return;
+		}
 		refreshTimeout = setTimeout(() => {
 			attemptScheduledRefresh(0);
 		}, delay);
@@ -1230,9 +1298,55 @@ var SDKQueryBuilder = class {
 	}
 	/**
 	* Set a free-text search string if supported by the backend.
+	*
+	* By default this is a substring match across the collection's top-level
+	* string properties. A Postgres collection that declares a `search` block
+	* gets ranked full-text matching over the fields it named instead, and each
+	* row comes back with a `_score` you can sort on:
+	*
+	* ```ts
+	* client.data.talents.search("auditor iso 14001").orderBy("_score", "desc").find()
+	* ```
+	*
+	* Pass `{ explain: true }` to have each row report which of the declared
+	* fields matched, with a highlighted snippet, on `_matches`:
+	*
+	* ```ts
+	* const { data } = await client.data.talents.search("iso 14001", { explain: true }).find();
+	* data[0]._matches
+	* // [{ field: "questionnaire.certifications", snippet: "<mark>ISO</mark> <mark>14001</mark> Lead Auditor" }]
+	* ```
 	*/
-	search(searchString) {
+	search(searchString, options) {
 		this.params.searchString = searchString;
+		if (options?.explain !== void 0) this.params.searchExplain = options.explain;
+		return this;
+	}
+	/**
+	* Order rows by nearest-neighbour distance to `vector`.
+	*
+	* The server has supported this from the REST layer since vectors landed;
+	* this is the SDK reaching it. Results come back closest-first with a
+	* `_distance` on each row, and any `where` / `orderBy` on the same query is
+	* a filter applied before the ordering — distance decides the order.
+	*
+	* You supply the query vector. Rebase stores and searches embeddings; it
+	* does not produce them, so this is where whatever model you already use
+	* for the stored vectors gets called.
+	*
+	* @param property - Name of the `vector` property to compare against.
+	* @param vector - The query embedding. Its length must match the property's
+	*                 declared `dimensions`, or the server answers 400.
+	* @example
+	* client.data.docs.vectorSearch("embedding", queryVector, { threshold: 0.35 }).limit(10).find()
+	*/
+	vectorSearch(property, vector, options) {
+		this.params.vectorSearch = {
+			property,
+			vector,
+			...options?.distance !== void 0 && { distance: options.distance },
+			...options?.threshold !== void 0 && { threshold: options.threshold }
+		};
 		return this;
 	}
 	/**
@@ -1270,6 +1384,11 @@ var SDKQueryBuilder = class {
 };
 //#endregion
 //#region src/collection.ts
+/**
+* Counts currently in flight, keyed by the exact request they issue. Entries
+* live only for the duration of the request — see `count()` for why.
+*/
+var inflightCounts = /* @__PURE__ */ new Map();
 function createCollectionClient(transport, slug, ws) {
 	const basePath = `/data/${slug}`;
 	const client = {
@@ -1314,18 +1433,63 @@ function createCollectionClient(transport, slug, ws) {
 				body: JSON.stringify({
 					rows: data,
 					...options?.upsert ? { upsert: true } : {}
-				})
+				}),
+				...options?.idempotencyKey ? { headers: { "Idempotency-Key": options.idempotencyKey } } : {}
 			})).data || [];
 		},
+		/**
+		* Still `PUT`, deliberately, even though the server now serves `PATCH`
+		* on the same handler and `PATCH` is the honest verb for a merge.
+		*
+		* The two are interchangeable server-side, so switching buys nothing at
+		* runtime — and it costs compatibility in the direction that fails
+		* quietly. A 0.14 client talking to a 0.13 server would send `PATCH` to
+		* a route that does not exist and get a **404**, which is
+		* indistinguishable from "that row is gone". Every write would look like
+		* a missing record.
+		*
+		* `PATCH` is what the OpenAPI spec advertises, so anyone generating a
+		* client gets the correct verb; this stays on `PUT` until the oldest
+		* supported server is one that serves both.
+		*/
 		async update(id, data) {
 			return await transport.request(`${basePath}/${encodeURIComponent(String(id))}`, {
 				method: "PUT",
 				body: JSON.stringify(data)
 			});
 		},
+		async updateMany(updates, options) {
+			if (!Array.isArray(updates)) throw new TypeError("updateMany expects an array of { id, data } entries.");
+			if (updates.length === 0) return [];
+			return (await transport.request(`${basePath}/bulk`, {
+				method: "PATCH",
+				body: JSON.stringify({ updates }),
+				...options?.idempotencyKey ? { headers: { "Idempotency-Key": options.idempotencyKey } } : {}
+			})).data || [];
+		},
 		async delete(id) {
 			await transport.request(`${basePath}/${encodeURIComponent(String(id))}`, { method: "DELETE" });
 		},
+		/**
+		* `POST .../bulk/delete`, not `DELETE .../bulk`.
+		*
+		* The honest verb would take the ids in a DELETE body, and that is the
+		* one request shape the HTTP ecosystem handles unreliably: bodies on
+		* DELETE are permitted but widely dropped by proxies and CDNs, and
+		* several OpenAPI generators ignore `requestBody` on a DELETE
+		* operation, so a generated client would send the request without its
+		* ids. A backend deployed behind arbitrary ingress cannot take that
+		* bet. Same reason `:batchDelete` exists in Google's API guidelines.
+		*/
+		async deleteMany(ids, options) {
+			if (!Array.isArray(ids)) throw new TypeError("deleteMany expects an array of ids.");
+			if (ids.length === 0) return;
+			await transport.request(`${basePath}/bulk/delete`, {
+				method: "POST",
+				body: JSON.stringify({ ids }),
+				...options?.idempotencyKey ? { headers: { "Idempotency-Key": options.idempotencyKey } } : {}
+			});
+		},
 		async count(params) {
 			const qs = buildQueryString({
 				...params,
@@ -1333,12 +1497,28 @@ function createCollectionClient(transport, slug, ws) {
 				offset: void 0,
 				include: void 0
 			});
-			return (await transport.request(basePath + "/count" + qs, { method: "GET" })).count ?? 0;
+			const key = basePath + "/count" + qs;
+			const inflight = inflightCounts.get(key);
+			if (inflight) return inflight;
+			const request = transport.request(key, { method: "GET" }).then((raw) => raw.count ?? 0);
+			inflightCounts.set(key, request);
+			try {
+				return await request;
+			} finally {
+				inflightCounts.delete(key);
+			}
 		},
 		observe(params, onResult, onError, options) {
 			let closed = false;
-			const emit = (result) => {
+			let liveDelivered = false;
+			let signature;
+			const deliver = (result, fromLive) => {
 				if (closed) return;
+				if (fromLive) liveDelivered = true;
+				else if (liveDelivered) return;
+				const next = `${result.meta?.total ?? ""}|${JSON.stringify(result.data)}`;
+				if (signature !== void 0 && next === signature) return;
+				signature = next;
 				onResult({
 					...result,
 					fromCache: false,
@@ -1346,10 +1526,10 @@ function createCollectionClient(transport, slug, ws) {
 					partial: false
 				});
 			};
-			client.find(params).then(emit).catch((error) => {
+			client.find(params).then((result) => deliver(result, false)).catch((error) => {
 				if (!closed) onError?.(error);
 			});
-			const live = options?.realtime !== false && client.listen ? client.listen(params, emit, onError) : void 0;
+			const live = options?.realtime !== false && client.listen ? client.listen(params, (result) => deliver(result, true), onError) : void 0;
 			return () => {
 				closed = true;
 				live?.();
@@ -1357,17 +1537,24 @@ function createCollectionClient(transport, slug, ws) {
 		},
 		observeById(id, onResult, onError, options) {
 			let closed = false;
-			const emit = (row) => {
+			let liveDelivered = false;
+			let signature;
+			const deliver = (row, fromLive) => {
 				if (closed) return;
+				if (fromLive) liveDelivered = true;
+				else if (liveDelivered) return;
+				const next = row === void 0 ? "\0missing" : JSON.stringify(row);
+				if (signature !== void 0 && next === signature) return;
+				signature = next;
 				onResult(row, {
 					fromCache: false,
 					hasPendingWrites: false
 				});
 			};
-			client.findById(id).then(emit).catch((error) => {
+			client.findById(id).then((row) => deliver(row, false)).catch((error) => {
 				if (!closed) onError?.(error);
 			});
-			const live = options?.realtime !== false && client.listenById ? client.listenById(id, emit, onError) : void 0;
+			const live = options?.realtime !== false && client.listenById ? client.listenById(id, (row) => deliver(row, true), onError) : void 0;
 			return () => {
 				closed = true;
 				live?.();
@@ -1387,8 +1574,11 @@ function createCollectionClient(transport, slug, ws) {
 		offset(count) {
 			return new SDKQueryBuilder(client).offset(count);
 		},
-		search(searchString) {
-			return new SDKQueryBuilder(client).search(searchString);
+		search(searchString, options) {
+			return new SDKQueryBuilder(client).search(searchString, options);
+		},
+		vectorSearch(property, vector, options) {
+			return new SDKQueryBuilder(client).vectorSearch(property, vector, options);
 		},
 		include(...relations) {
 			return new SDKQueryBuilder(client).include(...relations);
@@ -1398,51 +1588,44 @@ function createCollectionClient(transport, slug, ws) {
 		client.listen = (params, onUpdate, onError) => {
 			let active = true;
 			let lastUpdateId = 0;
+			let lastKnownTotal;
+			const window = resolveFindWindow(params);
 			const unsub = ws.listenCollection({
 				path: slug,
 				filter: params?.where,
+				logical: params?.logical,
 				limit: params?.limit,
-				startAfter: params?.offset ? String(params.offset) : void 0,
+				offset: window.driverOffset,
 				orderBy: params?.orderBy?.[0],
 				order: params?.orderBy?.[1],
-				searchString: params?.searchString
+				searchString: params?.searchString,
+				searchExplain: params?.searchExplain
 			}, (incomingRows) => {
 				const currentUpdateId = ++lastUpdateId;
-				const requestedLimit = params?.limit || 20;
-				const offset = params?.offset || 0;
+				const requestedLimit = window.limit;
+				const offset = window.offset;
 				const rows = incomingRows;
-				const heuristicTotal = rows.length;
-				const heuristicHasMore = rows.length >= requestedLimit;
-				if (client.count) client.count(params).then((total) => {
-					if (active && currentUpdateId === lastUpdateId) onUpdate({
+				const emit = (total, hasMore) => {
+					if (!active || currentUpdateId !== lastUpdateId) return;
+					onUpdate({
 						data: rows,
 						meta: {
 							total,
 							limit: requestedLimit,
 							offset,
-							hasMore: offset + rows.length < total
+							hasMore
 						}
 					});
+				};
+				const emitWithoutCount = () => emit(offset + rows.length, rows.length >= requestedLimit);
+				if (client.count) client.count(params).then((total) => {
+					lastKnownTotal = total;
+					emit(total, offset + rows.length < total);
 				}).catch(() => {
-					if (active && currentUpdateId === lastUpdateId) onUpdate({
-						data: rows,
-						meta: {
-							total: heuristicTotal,
-							limit: requestedLimit,
-							offset,
-							hasMore: heuristicHasMore
-						}
-					});
-				});
-				else onUpdate({
-					data: rows,
-					meta: {
-						total: heuristicTotal,
-						limit: requestedLimit,
-						offset,
-						hasMore: heuristicHasMore
-					}
+					if (lastKnownTotal !== void 0) emit(lastKnownTotal, offset + rows.length < lastKnownTotal);
+					else emitWithoutCount();
 				});
+				else emitWithoutCount();
 			}, onError);
 			return () => {
 				active = false;
@@ -1706,9 +1889,11 @@ var CHANNEL_MESSAGE_TYPES = /* @__PURE__ */ new Set([
 *
 * @internal Not a stable app-facing API. `createRebaseClient()` constructs and
 * manages this internally (exposed as `client.ws`, typed by the minimal
-* `RebaseWebSocket` contract in `@rebasepro/types`). It is re-exported from the
-* package root only because the `@rebasepro/client-postgres` driver
-* instantiates it directly; its surface may change without a major bump.
+* `RebaseWebSocket` contract in `@rebasepro/types`). It stays exported from the
+* package root for the same reason it always was — a data-source driver may
+* instantiate it directly — but nothing in this repo does since
+* `@rebasepro/client-postgres` was removed; its surface may change without a
+* major bump.
 */
 var RebaseWebSocketClient = class {
 	websocketUrl;
@@ -2218,6 +2403,11 @@ var RebaseWebSocketClient = class {
 					callback.onError(new RebaseApiError$1(errorMessage, { code: errorCode }));
 				}
 			} else callback.onUpdate(message);
+			return;
+		}
+		if (type === "ERROR" || type === "error" || message.error) {
+			const { errorMessage, errorCode } = extractMessageError(message);
+			console.warn(`[Rebase] Realtime error from the server${errorCode ? ` (${errorCode})` : ""}: ${errorMessage}`);
 		}
 	}
 	async ensureAuthenticated(retryCount = 3) {
@@ -2833,15 +3023,10 @@ var RebaseWebSocketClient = class {
 		}
 	}
 	createCollectionSubscriptionKey(props) {
+		const { collection, ...query } = props;
 		const key = {
-			path: props.path,
-			filter: props.filter,
-			limit: props.limit,
-			startAfter: props.startAfter,
-			orderBy: props.orderBy,
-			order: props.order,
-			searchString: props.searchString,
-			collection: props.collection?.name
+			...query,
+			collection: collection?.name
 		};
 		return JSON.stringify(key, (_, value) => {
 			if (value && typeof value === "object" && !Array.isArray(value)) return Object.keys(value).sort().reduce((sorted, k) => {
@@ -3335,11 +3520,29 @@ var RETRYABLE_STATUSES = /* @__PURE__ */ new Set([
 	503,
 	504
 ]);
+/**
+* The server holds this key for a request it has not answered yet.
+*
+* It is a 409 like a duplicate row is a 409, and nothing but the code separates
+* them — one means "your write is already there", the other means "your write
+* may not have happened at all, ask again".
+*/
+var IDEMPOTENCY_IN_PROGRESS = "IDEMPOTENCY_KEY_IN_PROGRESS";
+/**
+* Is the server still answering an earlier attempt of this same write?
+*
+* The only correct response is to ask again — which is exactly what the
+* server's own message says, and exactly what this SDK used not to do.
+*/
+function isIdempotencyInProgressError(error) {
+	return error instanceof RebaseApiError && error.status === 409 && error.code === IDEMPOTENCY_IN_PROGRESS;
+}
 /** Is this failure worth another attempt later? */
 function isRetryableError(error) {
 	if (isNetworkError(error)) return true;
-	if (error instanceof RebaseApiError) return error.status !== void 0 && RETRYABLE_STATUSES.has(error.status);
-	return false;
+	if (!(error instanceof RebaseApiError)) return false;
+	if (isIdempotencyInProgressError(error)) return true;
+	return error.status !== void 0 && RETRYABLE_STATUSES.has(error.status);
 }
 /**
 * Did this write fail because the row is already there?
@@ -3351,10 +3554,16 @@ function isRetryableError(error) {
 * The queue uses this to recognise its own earlier attempt. A create whose
 * response was lost is replayed, and for a row carrying an id the SDK generated
 * the server can only be rejecting it because the first attempt actually landed.
+*
+* Which is why the status alone cannot decide it: `IDEMPOTENCY_KEY_IN_PROGRESS`
+* is a 409 that means the opposite — the row may not exist at all. Read as a
+* duplicate, the queue looked for a row that was never written, found nothing,
+* concluded there was nothing left to do and deleted the write from the queue.
 */
 function isDuplicateKeyError(error) {
 	if (!(error instanceof RebaseApiError)) return false;
-	return error.code === "23505" || error.status === 409;
+	if (error.code === "23505") return true;
+	return error.status === 409 && !isIdempotencyInProgressError(error);
 }
 var ConnectivityMonitor = class {
 	state = "online";
@@ -3764,14 +3973,23 @@ function looseEquals(a, b) {
 */
 function likeToRegExp(pattern, caseInsensitive) {
 	let source = "^";
+	let lastWasWildcard = false;
 	for (let i = 0; i < pattern.length; i++) {
 		const char = pattern[i];
 		if (char === "\\" && i + 1 < pattern.length) {
 			source += pattern[i + 1].replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 			i++;
-		} else if (char === "%") source += "[\\s\\S]*";
-		else if (char === "_") source += "[\\s\\S]";
-		else source += char.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+			lastWasWildcard = false;
+		} else if (char === "%") {
+			if (!lastWasWildcard) source += "[\\s\\S]*";
+			lastWasWildcard = true;
+		} else if (char === "_") {
+			source += "[\\s\\S]";
+			lastWasWildcard = false;
+		} else {
+			source += char.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+			lastWasWildcard = false;
+		}
 	}
 	return new RegExp(source + "$", caseInsensitive ? "i" : "");
 }
@@ -3903,14 +4121,41 @@ function sortRows(rows, orderBy) {
 function tiebreak(a, b) {
 	return compareValues(a.id, b.id) ?? 0;
 }
-/** Resolve `page`/`offset`/`limit` the way the server does. */
+/**
+* Resolve `page`/`offset`/`limit` the way the server does.
+*
+* It did not: this defaulted an absent limit to 20 while `/api/data` pages by
+* 50, so the same `observe()` answered with 20 rows from the local database and
+* 50 from the network — a list that changed length depending on which side
+* answered, with `page` striding differently on each. Delegated now, so the
+* sentence above is true by construction rather than by agreement.
+*/
 function resolvePagination(params) {
-	const limit = params?.limit ?? 20;
+	const { limit, offset } = resolveFindWindow(params);
 	return {
 		limit,
-		offset: params?.page != null ? Math.max(0, (params.page - 1) * limit) : params?.offset ?? 0
+		offset
 	};
 }
+/** `<`, `<=`, `>`, `>=` — the operators whose answer depends on a collation. */
+var ORDERING_OPS = /* @__PURE__ */ new Set([
+	"<",
+	"<=",
+	">",
+	">="
+]);
+/** Does any condition in this `where` clause order its operands? */
+function whereOrders(where) {
+	if (!where) return false;
+	for (const condition of Object.values(where)) if ((isTuple(condition) ? [condition] : condition.filter(isTuple)).some(([op]) => ORDERING_OPS.has(op))) return true;
+	return false;
+}
+/** The same question, through an `and(...)`/`or(...)` tree. */
+function logicalOrders(condition, depth = 0) {
+	if (!condition || depth > 32) return false;
+	if ("type" in condition) return (condition.conditions ?? []).some((c) => logicalOrders(c, depth + 1));
+	return ORDERING_OPS.has(condition.operator);
+}
 /**
 * Can a locally evaluated answer to `params` be trusted to match the server's,
 * assuming the cache holds every row of the collection?
@@ -3918,11 +4163,67 @@ function resolvePagination(params) {
 * `include` pulls in rows from other collections that this evaluator never
 * sees, and `searchString` is only approximated — both make the local answer a
 * best effort rather than an equivalent one.
+*
+* **Ordering comparisons are refused, and that is the interesting one.**
+* `compareValues` falls back to an `Intl.Collator` for operands it cannot read
+* as numbers or instants. PostgreSQL orders text by the *database's* collation,
+* which is a property of the server this process has never been told: under the
+* C collation `'apple' < 'Banana'` is false, under `en_US.UTF-8` it is true,
+* and the collator says true. So `["<", "Banana"]` selects a different set here
+* than it does there — silently, and in whichever direction the deployment
+* happens to have been created.
+*
+* The refusal covers *every* ordering comparison rather than only the ones with
+* a string operand, because the operand type does not settle it: a numeric
+* bound against a text column (`["<", 10]` on a `varchar`) also reaches the
+* collator, and nothing in `params` says what the column holds. Conservative on
+* purpose — the cost is that a query combining an ordering filter with
+* *unsynced local writes* stops placing those writes optimistically, which is a
+* degraded answer rather than a wrong one. Claiming exactness we do not have is
+* the other way round.
+*
+* This says nothing about ordering *results*; that is a separate claim with a
+* separate answer, because a sort changes which rows come first and not which
+* rows match. See {@link isLocallySortable}.
 */
 function isExactlyEvaluable(params) {
 	if (!params) return true;
 	if (params.include && params.include.length > 0) return false;
 	if (params.searchString) return false;
+	if (params.vectorSearch) return false;
+	if (whereOrders(params.where)) return false;
+	if (logicalOrders(params.logical)) return false;
+	return true;
+}
+/**
+* Would sorting `rows` locally reproduce the order the server would have sent?
+*
+* Asked of the rows rather than of the query, because unlike a filter this one
+* *is* decidable from the data in hand: {@link compareValues} reaches the
+* collator only when it cannot read both operands as numbers, and `toComparable`
+* has already turned dates and relations into numbers and ids by then. If every
+* value on the sort column normalises to a number, the collator is unreachable
+* and the local order is the server's order.
+*
+* A text column is therefore refused — see {@link isExactlyEvaluable} for why
+* the two cannot be made to agree — and so is a column this page happens to see
+* only as strings, which is the same thing from here.
+*
+* Nulls are fine either way: they are ordered by an explicit rule (last
+* ascending, first descending) that matches Postgres and never reaches the
+* comparator.
+*/
+function isLocallySortable(rows, orderBy) {
+	if (!orderBy) return true;
+	const [field] = orderBy;
+	for (const row of rows) {
+		const value = toComparable(row[field]);
+		if (isNullish(value)) continue;
+		if (typeof value === "number" || typeof value === "boolean") continue;
+		if (typeof value === "bigint") continue;
+		if (typeof value === "string" && value.trim() !== "" && !Number.isNaN(Number(value))) continue;
+		return false;
+	}
 	return true;
 }
 /** Run a full query — filter, sort, paginate — over a set of rows. */
@@ -3958,6 +4259,17 @@ function generateOfflineId() {
 	return `off-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
 }
 var MISSING = "\0missing";
+/**
+* Replays to spend on a mutation whose idempotency key the server is still
+* holding, when the app has not asked for more.
+*
+* Retries double from a second and cap at the sync interval, so the default
+* budget of five covers about half a minute — less than the lease a server
+* gives a claim nobody came back for. This many outlast it with room for a slow
+* batch, and the count is what stops a server that never releases the key from
+* blocking the queue behind it indefinitely.
+*/
+var IN_PROGRESS_MIN_RETRIES = 12;
 var OfflineManager = class {
 	store;
 	maxCachedQueries;
@@ -4238,6 +4550,72 @@ var OfflineManager = class {
 				this.notifyCollection(slug);
 				return rows;
 			},
+			updateMany: async (updates, options) => {
+				await this.ensureCollection(slug);
+				if (!Array.isArray(updates)) throw new TypeError("updateMany expects an array of { id, data } entries.");
+				if (updates.length === 0) return [];
+				const anyPending = updates.some((u) => this.hasPending(slug, u.id));
+				if (this.connectivity.shouldAttempt() && !anyPending) try {
+					const rows = await inner.updateMany(updates, options);
+					this.connectivity.markSuccess();
+					await this.ingest(slug, rows);
+					this.notifyCollection(slug);
+					return rows;
+				} catch (error) {
+					if (!isNetworkError(error)) throw error;
+					this.connectivity.markFailure();
+				}
+				const rollback = {};
+				const optimistic = [];
+				for (const { id, data } of updates) {
+					const base = this.rawLocalRow(slug, id);
+					rollback[String(id)] = base ?? null;
+					optimistic.push({
+						...base ?? {},
+						...data,
+						id
+					});
+				}
+				await this.enqueue({
+					collection: slug,
+					type: "updateMany",
+					updates: updates.map((u) => ({
+						id: u.id,
+						data: u.data
+					})),
+					rollback: { rows: rollback }
+				});
+				for (const row of optimistic) this.setLocalRow(slug, row.id, row);
+				this.notifyCollection(slug);
+				return optimistic;
+			},
+			deleteMany: async (ids, options) => {
+				await this.ensureCollection(slug);
+				if (!Array.isArray(ids)) throw new TypeError("deleteMany expects an array of ids.");
+				if (ids.length === 0) return;
+				const anyPending = ids.some((id) => this.hasPending(slug, id));
+				if (this.connectivity.shouldAttempt() && !anyPending) try {
+					await inner.deleteMany(ids, options);
+					this.connectivity.markSuccess();
+					for (const id of ids) this.removeLocalRow(slug, id, true);
+					this.notifyCollection(slug);
+					this.scheduleRefresh(slug);
+					return;
+				} catch (error) {
+					if (!isNetworkError(error)) throw error;
+					this.connectivity.markFailure();
+				}
+				const rollback = {};
+				for (const id of ids) rollback[String(id)] = this.rawLocalRow(slug, id) ?? null;
+				await this.enqueue({
+					collection: slug,
+					type: "deleteMany",
+					ids,
+					rollback: { rows: rollback }
+				});
+				for (const id of ids) this.removeLocalRow(slug, id, false);
+				this.notifyCollection(slug);
+			},
 			update: async (id, data) => {
 				await this.ensureCollection(slug);
 				if (this.connectivity.shouldAttempt() && !this.hasPending(slug, id)) try {
@@ -4316,7 +4694,8 @@ var OfflineManager = class {
 			orderBy: (column, direction) => new SDKQueryBuilder(wrapped).orderBy(column, direction),
 			limit: (count) => new SDKQueryBuilder(wrapped).limit(count),
 			offset: (count) => new SDKQueryBuilder(wrapped).offset(count),
-			search: (searchString) => new SDKQueryBuilder(wrapped).search(searchString),
+			search: (searchString, options) => new SDKQueryBuilder(wrapped).search(searchString, options),
+			vectorSearch: (property, vector, options) => new SDKQueryBuilder(wrapped).vectorSearch(property, vector, options),
 			include: (...relations) => new SDKQueryBuilder(wrapped).include(...relations)
 		};
 		if (inner.listen) wrapped.listen = (params, onUpdate, onError) => inner.listen(params, (response) => {
@@ -4536,9 +4915,8 @@ var OfflineManager = class {
 		if (!state) return {
 			data: [],
 			meta: {
+				...resolvePagination(params),
 				total: 0,
-				limit: params?.limit ?? 20,
-				offset: params?.offset ?? 0,
 				hasMore: false
 			},
 			fromCache: true,
@@ -4574,16 +4952,15 @@ var OfflineManager = class {
 		}
 		let added = 0;
 		const offset = snapshot.offset ?? 0;
-		if (exact && offset === 0) {
-			for (const [key, entry] of state.rows) {
-				if (seen.has(key) || !this.hasPending(slug, key)) continue;
-				if (!this.isLocallyCreated(slug, key)) continue;
-				if (!matchesParams(entry.row, params)) continue;
-				rows.push(entry.row);
-				added++;
-			}
-			if (added > 0 && params?.orderBy) sortRows(rows, params.orderBy);
+		if (exact && offset === 0) for (const [key, entry] of state.rows) {
+			if (seen.has(key) || !this.hasPending(slug, key)) continue;
+			if (!this.isLocallyCreated(slug, key)) continue;
+			if (!matchesParams(entry.row, params)) continue;
+			rows.push(entry.row);
+			added++;
 		}
+		const orderIsLocal = isLocallySortable(rows, params?.orderBy);
+		if (params?.orderBy && orderIsLocal) sortRows(rows, params.orderBy);
 		return {
 			data: rows,
 			meta: {
@@ -4594,7 +4971,7 @@ var OfflineManager = class {
 			},
 			fromCache,
 			hasPendingWrites: rows.some((row) => this.hasPending(slug, row.id)),
-			partial: !exact
+			partial: !exact || !orderIsLocal
 		};
 	}
 	localFind(slug, params) {
@@ -4730,17 +5107,17 @@ var OfflineManager = class {
 		return row;
 	}
 	recordSnapshot(slug, params, result) {
+		const window = resolvePagination(params);
 		const meta = result.meta ?? {
 			total: result.data?.length ?? 0,
-			limit: 20,
-			offset: 0,
+			...window,
 			hasMore: false
 		};
 		const snapshot = {
 			ids: (result.data ?? []).map((row) => row.id).filter((id) => id !== void 0),
 			total: meta.total ?? result.data?.length ?? 0,
-			limit: meta.limit ?? params?.limit ?? 20,
-			offset: meta.offset ?? params?.offset ?? 0,
+			limit: meta.limit ?? window.limit,
+			offset: meta.offset ?? window.offset,
 			hasMore: meta.hasMore ?? false
 		};
 		const state = this.collectionState(slug);
@@ -4909,7 +5286,8 @@ var OfflineManager = class {
 						}
 						op.attempts = (op.attempts ?? 0) + 1;
 						op.lastError = error?.message ?? String(error);
-						if (isRetryableError(error) && op.attempts < this.maxRetries) {
+						const limit = isIdempotencyInProgressError(error) ? Math.max(this.maxRetries, IN_PROGRESS_MIN_RETRIES) : this.maxRetries;
+						if (isRetryableError(error) && op.attempts < limit) {
 							await this.store.enqueue(this.queueKey(op), op).catch(() => void 0);
 							this.connectivity.deferRetry();
 							this.patchStatus({ lastError: op.lastError });
@@ -4955,11 +5333,25 @@ var OfflineManager = class {
 			await this.adoptServerRow(op, op.id, row);
 		} else if (op.type === "createMany") {
 			const queued = op.data ?? [];
-			const rows = await inner.createMany(queued, op.upsert ? { upsert: true } : void 0);
+			const rows = await inner.createMany(queued, {
+				...op.upsert ? { upsert: true } : {},
+				idempotencyKey: op.mutationId
+			});
 			for (let i = 0; i < rows.length; i++) await this.adoptServerRow(op, queued[i]?.id, rows[i]);
+		} else if (op.type === "updateMany") {
+			const queued = op.updates ?? [];
+			const rows = await inner.updateMany(queued.map((u) => ({
+				id: u.id,
+				data: u.data
+			})), { idempotencyKey: op.mutationId });
+			for (let i = 0; i < rows.length; i++) await this.ingestReplaced(op, queued[i].id, rows[i]);
 		} else if (op.type === "update") {
 			const row = await inner.update(op.id, op.data);
 			await this.ingestReplaced(op, op.id, row);
+		} else if (op.type === "deleteMany") {
+			const ids = op.ids ?? [];
+			await inner.deleteMany(ids, { idempotencyKey: op.mutationId });
+			for (const id of ids) this.removeLocalRow(op.collection, id, true);
 		} else if (op.type === "delete") {
 			await inner.delete(op.id);
 			this.removeLocalRow(op.collection, op.id, true);
@@ -5204,23 +5596,37 @@ var OfflineManager = class {
 /**
 * Derive a WebSocket URL from an HTTP base URL.
 * `http://` → `ws://`, `https://` → `wss://`.
+*
+* A backend mounted under a path is the reason `baseUrl` accepts one, so the
+* path is kept. It used to be kept for an absolute `baseUrl` and dropped for a
+* relative one — resolved through `.origin` — so one deployment dialled two
+* different sockets depending on whether its config said `"/backend"` or
+* `"https://app.example.com/backend"`.
+*
+* Returns `""` when there is nothing to resolve against: a relative `baseUrl`
+* outside a browser has no origin, and inventing one would dial somewhere
+* arbitrary. The caller warns rather than leaving that silent.
 */
 function deriveWebSocketUrl(baseUrl) {
+	const toWsProtocol = (url) => {
+		const secure = /^(https|wss):/i.test(url);
+		return url.replace(/^https?:\/\//i, secure ? "wss://" : "ws://").replace(/^wss?:\/\//i, secure ? "wss://" : "ws://").replace(/\/$/, "");
+	};
 	if (typeof window !== "undefined") {
-		let absoluteUrl = "";
+		let absoluteUrl;
 		if (!baseUrl) absoluteUrl = window.location.origin;
 		else if (/^https?:\/\//i.test(baseUrl) || /^wss?:\/\//i.test(baseUrl)) absoluteUrl = baseUrl;
 		else try {
-			absoluteUrl = new URL(baseUrl, window.location.href).origin;
+			const resolved = new URL(baseUrl, window.location.href);
+			absoluteUrl = resolved.origin + resolved.pathname;
 		} catch {
 			absoluteUrl = window.location.origin;
 		}
-		const protocol = absoluteUrl.startsWith("https:") || absoluteUrl.startsWith("wss:") ? "wss:" : "ws:";
-		return absoluteUrl.replace(/^https?:\/\//i, `${protocol}//`).replace(/^wss?:\/\//i, `${protocol}//`).replace(/\/$/, "");
+		return toWsProtocol(absoluteUrl);
 	}
 	if (!baseUrl) return "";
 	if (!/^https?:\/\//i.test(baseUrl) && !/^wss?:\/\//i.test(baseUrl)) return "";
-	return baseUrl.replace(/^https?:\/\//i, (match) => match.toLowerCase() === "https://" ? "wss://" : "ws://").replace(/\/$/, "");
+	return toWsProtocol(baseUrl);
 }
 function createRebaseClient(options) {
 	const transport = createTransport(options, { credentialOutOfBand: options.auth?.authFlowMode === "cookie" });
@@ -5248,7 +5654,11 @@ function createRebaseClient(options) {
 		});
 		return storageSourcesPromise;
 	};
-	const resolvedWsUrl = options.realtime !== false ? options.websocketUrl ?? deriveWebSocketUrl(options.baseUrl) : void 0;
+	const realtimeEnabled = options.realtime !== false;
+	const resolvedWsUrl = realtimeEnabled ? options.websocketUrl ?? deriveWebSocketUrl(options.baseUrl) : void 0;
+	const realtimeUnreachable = realtimeEnabled && !resolvedWsUrl;
+	const unreachableReason = `no WebSocket URL could be derived from baseUrl ${JSON.stringify(options.baseUrl ?? null)} — outside a browser there is no page origin to resolve a relative URL against. Pass an absolute \`baseUrl\`, set \`websocketUrl\` explicitly, or pass \`realtime: false\` to say this was intended.`;
+	if (realtimeUnreachable) console.warn(`[Rebase] Realtime is enabled but ${unreachableReason} Live queries will fall back to a single fetch and channels will throw.`);
 	let ws;
 	/** One channel object per name — see `realtime.channel`. */
 	const realtimeChannels = /* @__PURE__ */ new Map();
@@ -5368,7 +5778,7 @@ function createRebaseClient(options) {
 		* cut off the others.
 		*/
 channel: (name, options) => {
-			if (!ws) throw new RebaseClientError("Realtime is disabled on this client (realtime: false), so channels are unavailable.");
+			if (!ws) throw new RebaseClientError(realtimeUnreachable ? `Realtime is enabled but ${unreachableReason}` : "Realtime is disabled on this client (realtime: false), so channels are unavailable.");
 			let existing = realtimeChannels.get(name);
 			if (!existing) {
 				existing = new RebaseRealtimeChannel(name, ws, options);