@rebasepro/client 0.17.3 → 0.18.1

package/src/transport.ts

@@ -1,505 +0,0 @@
-import { FindParams as TypesFindParams, FindResponse as TypesFindResponse, RebaseApiError } from "@rebasepro/types";
-import { serializeFilter, serializeLogicalCondition, serializeOrderBy } from "@rebasepro/common";
-import { rebaseReviver } from "./reviver";
-
-// The canonical client error now lives in `@rebasepro/types` so every package
-// (client, auth, …) throws one type. Re-exported here to preserve the historical
-// `import { RebaseApiError } from ".../transport"` path used across the SDK.
-export { RebaseApiError } from "@rebasepro/types";
-export type { RebaseErrorInit } from "@rebasepro/types";
-import { RebaseClientError } from "@rebasepro/types";
-
-export interface RebaseClientConfig {
-    /**
-     * Origin of the Rebase server — scheme, host and port **only**.
-     *
-     * {@link apiPath} is appended to this, so do not include it here:
-     * `"http://localhost:3001"` is correct, while `"http://localhost:3001/api"`
-     * silently builds `/api/api/…` and every request 404s. Omit entirely for
-     * same-origin requests from the browser.
-     */
-    baseUrl?: string;
-    /**
-     * Bearer token sent as `Authorization` on every request.
-     *
-     * In the browser this is the signed-in user's access token, so row-level
-     * security applies. Server-side callers — scripts, cron jobs, ETL — pass the
-     * service key instead, which resolves to `{ uid: "service", roles: ["admin"] }`
-     * and **bypasses RLS**: there is no user to constrain those queries, so scope
-     * them explicitly.
-     */
-    token?: string;
-    /**
-     * Path the API is mounted under, appended to {@link baseUrl}.
-     * Defaults to `"/api"`; override only if the server mounts it elsewhere.
-     */
-    apiPath?: string;
-    /**
-     * Origin to use instead of {@link baseUrl} for URLs that are handed to the
-     * browser to fetch on its own — storage file downloads and previews.
-     *
-     * API *requests* always go to `baseUrl`; this only changes URLs the SDK
-     * *returns* (e.g. `storage.getSignedUrl`). It exists for proxied setups:
-     * when `baseUrl` routes through an authenticated middleman (the Rebase
-     * console's Studio proxy), a plain `<img src>` or a copied link cannot
-     * satisfy the middleman's auth — but the file route itself is reachable
-     * directly at the origin server and secured by its own scoped `?token=`.
-     * Set this to that server's public origin (no path; {@link apiPath} is
-     * appended) and returned file URLs point straight at it.
-     */
-    storageUrlOrigin?: string;
-    fetch?: typeof globalThis.fetch;
-    onUnauthorized?: () => Promise<boolean>;
-    websocketUrl?: string; // Optional real-time WebSocket connection
-    /**
-     * Open the realtime WebSocket. **Defaults to `true`.**
-     *
-     * The socket connects as soon as the client is constructed and keeps the
-     * Node event loop alive, so a one-shot script (CLI, cron job, ETL) will not
-     * exit on its own. Set this to `false` for any process that reads or writes
-     * and then terminates — `.listen()` and `.listenById()` then throw instead
-     * of silently doing nothing.
-     *
-     * Long-lived processes that do want realtime can instead call
-     * `client.close()` when shutting down.
-     */
-    realtime?: boolean;
-    /**
-     * "Yes, I meant to be anonymous."
-     *
-     * Off-browser, a client with no credential can only ever call as an
-     * anonymous user, and row-level security answers it with whatever is
-     * public — usually nothing. That is almost always a mistake in a script or
-     * cron job, so the SDK warns once on the first request (see
-     * {@link ANONYMOUS_SERVER_CLIENT_WARNING}). Anonymous is a legitimate
-     * choice for public reads, though; set this to `true` to say so and
-     * silence the warning.
-     *
-     * Has no effect in the browser, where anonymous-before-sign-in is normal
-     * and nothing is ever warned about.
-     */
-    anonymous?: boolean;
-}
-
-/**
- * Facts about the surrounding client that the transport cannot read off its own
- * config, but needs in order to decide whether a request is *meaningfully*
- * credential-less.
- */
-export interface TransportEnvironment {
-    /**
-     * The credential reaches the server without an `Authorization` header —
-     * i.e. `auth.authFlowMode: "cookie"`, where the refresh token lives in an
-     * httpOnly cookie. Such a client looks tokenless to the transport but is
-     * not anonymous, so it must never trip the guard.
-     */
-    credentialOutOfBand?: boolean;
-}
-
-/**
- * True when there is no browser to have signed a user in — a Node script, a
- * cron job, an edge worker.
- *
- * Anonymous is an ordinary, correct state in a browser: before sign-in, on a
- * marketing page, for public reads. Warning there would be noise that teaches
- * people to ignore warnings, so the guard is off entirely. This uses the same
- * `typeof window` test as {@link resolveBaseUrl}, and additionally treats a
- * defined `document` as a browser so an SSR shim or test harness that installs
- * only one of the two is still excluded.
- */
-function isServerLikeEnvironment(): boolean {
-    return typeof window === "undefined" && typeof document === "undefined";
-}
-
-/**
- * Emitted once per client. Kept as a constant so the wording is testable and
- * greppable — this is the string a user will paste into a search.
- */
-export const ANONYMOUS_SERVER_CLIENT_WARNING =
-    "[rebase] This client was created outside a browser with no credential — no `token`, no auth token getter, "
-    + "and no cookie auth flow — so every request runs as an anonymous caller. Row-level security will return only "
-    + "publicly readable rows, which is usually nothing and occasionally the wrong thing. "
-    + "Inside a cron or function handler, use the `rebase` you were handed instead of building a new one: its data "
-    + "plane is already admin-scoped. In a standalone script or job, pass the service key as `token`. "
-    + "If you really do want anonymous access, pass `anonymous: true` to silence this.";
-
-/**
- * Re-exported from `@rebasepro/types` so an SDK consumer can name the type of a
- * call it is already making without a second dependency.
- *
- * Forwards the row type: without the parameter this alias flattened
- * `FindParams<M>` back to its `Record<string, unknown>` default, and `where` /
- * `orderBy` went back to accepting any column name — the alias, not the
- * definition, was where the typing was lost.
- */
-export type FindParams<M extends Record<string, unknown> = Record<string, unknown>> = TypesFindParams<M>;
-export type FindResponse<T> = TypesFindResponse<T extends Record<string, unknown> ? T : Record<string, unknown>>;
-
-/**
- * Refuse a filter whose *value* is missing.
- *
- * `where: { status: ["==", undefined] }` used to serialize to the literal
- * string, so `status=eq.undefined` went out on the wire and the server dutifully
- * looked for rows whose status is the four-letter word "undefined". The caller
- * saw an empty page, not an error — the classic shape of a variable that was
- * never set.
- *
- * Dropping the condition instead would be worse than sending it: the query
- * would come back *unfiltered*, which for an ownership or tenant filter means
- * returning rows the caller never asked to see. So this is a hard error, and
- * both correct spellings are named in the message: omit the key to skip the
- * filter, or use `["is-null", null]` to match SQL NULL (which still
- * serializes — `null` is a value, `undefined` is the absence of one).
- */
-function assertNoUndefinedFilterValues(where: Record<string, unknown>): void {
-    const reject = (field: string, op: unknown): never => {
-        throw new RebaseClientError(
-            `Filter on "${field}" has an undefined value (["${String(op)}", undefined]). `
-            + `Omit "${field}" from \`where\` to skip the filter, or use ["is-null", null] to match SQL NULL.`
-        );
-    };
-
-    for (const [field, condition] of Object.entries(where)) {
-        // An entirely absent condition is the documented way to skip a filter.
-        if (condition === undefined) continue;
-        if (!Array.isArray(condition)) continue;
-
-        // Either one `[op, value]` tuple or an array of them.
-        const tuples = Array.isArray(condition[0]) ? condition as unknown[][] : [condition as unknown[]];
-        for (const tuple of tuples) {
-            if (!Array.isArray(tuple) || tuple.length !== 2) continue;
-            const [op, value] = tuple;
-            if (value === undefined) reject(field, op);
-            // `["in", [...]]` — a hole in the list is the same mistake.
-            if (Array.isArray(value) && value.some(v => v === undefined)) reject(field, op);
-        }
-    }
-}
-
-export function buildQueryString(params?: FindParams): string {
-    if (!params) return "";
-    const parts: string[] = [];
-
-    if (params.limit != null) parts.push(`limit=${params.limit}`);
-    if (params.offset != null) parts.push(`offset=${params.offset}`);
-    if (params.page != null) parts.push(`page=${params.page}`);
-
-    if (params.orderBy) {
-        const wire = serializeOrderBy(params.orderBy);
-        if (wire) parts.push(`orderBy=${encodeURIComponent(wire)}`);
-    }
-
-    if (params.searchString) {
-        parts.push(`searchString=${encodeURIComponent(params.searchString)}`);
-        if (params.searchExplain) parts.push("searchExplain=true");
-    }
-
-    // The server keys vector search off `vector_search` naming the property and
-    // `vector` carrying the embedding as a JSON array; both must be present or
-    // it ignores the pair entirely.
-    if (params.vectorSearch) {
-        const vs = params.vectorSearch;
-        parts.push(`vector_search=${encodeURIComponent(vs.property)}`);
-        parts.push(`vector=${encodeURIComponent(JSON.stringify(vs.vector))}`);
-        if (vs.distance) parts.push(`vector_distance=${encodeURIComponent(vs.distance)}`);
-        if (vs.threshold !== undefined) parts.push(`vector_threshold=${encodeURIComponent(String(vs.threshold))}`);
-    }
-
-    if (params.include && params.include.length > 0) {
-        parts.push(`include=${encodeURIComponent(params.include.join(","))}`);
-    }
-
-    if (params.logical) {
-        const root = params.logical;
-        const serialized = (root.conditions ?? []).map(serializeLogicalCondition).join(",");
-        parts.push(`${root.type}=${encodeURIComponent(`(${serialized})`)}`);
-    }
-
-    if (params.where) {
-        assertNoUndefinedFilterValues(params.where);
-        const serialized = serializeFilter(params.where);
-        for (const [field, value] of Object.entries(serialized)) {
-            if (Array.isArray(value)) {
-                for (const v of value) {
-                    parts.push(`${encodeURIComponent(field)}=${encodeURIComponent(v)}`);
-                }
-            } else {
-                parts.push(`${encodeURIComponent(field)}=${encodeURIComponent(value)}`);
-            }
-        }
-    }
-
-    return parts.length > 0 ? "?" + parts.join("&") : "";
-}
-
-export interface Transport {
-    request: <T = unknown>(path: string, init?: RequestInit) => Promise<T>;
-    setToken: (newToken: string | null) => void;
-    setAuthTokenGetter: (getter: () => Promise<string | null>) => void;
-    setOnUnauthorized: (handler: () => Promise<boolean>) => void;
-    readonly baseUrl: string;
-    readonly apiPath: string;
-    /** See {@link RebaseClientConfig.storageUrlOrigin}. Undefined = use `baseUrl`. */
-    readonly storageUrlOrigin?: string;
-    readonly fetchFn: typeof globalThis.fetch;
-    getHeaders: (init?: RequestInit) => Record<string, string>;
-    resolveToken: () => Promise<string | null>;
-}
-
-/**
- * The base every request and every caller-built URL resolves against.
- *
- * `baseUrl` is optional because the common production shape is a Rebase
- * backend serving its own SPA, where the API is simply the page's origin.
- * Leaving it unset is therefore the *correct* configuration there — and the
- * one that keeps working when a second hostname (a custom domain) points at
- * the same app.
- *
- * When unset in a browser this resolves to the page origin rather than "".
- * Requests behave identically either way, but the empty string is a trap for
- * anything that builds a URL from `client.baseUrl`: `new URL("" + path)`
- * throws, so apps "fixed" it by baking an absolute host into their bundle —
- * which is exactly what breaks the day a custom domain is added, and which no
- * amount of CORS configuration repairs, because a SameSite=Lax auth cookie is
- * not sent cross-site either.
- */
-function resolveBaseUrl(configured?: string): string {
-    if (configured) return configured.replace(/\/$/, "");
-    if (typeof window !== "undefined" && window.location?.origin) return window.location.origin;
-    return "";
-}
-
-export function createTransport(config: RebaseClientConfig, environment?: TransportEnvironment): Transport {
-    const fetchFn = config.fetch || globalThis.fetch;
-    const apiPath = config.apiPath || "/api";
-
-    // `apiPath` is appended to `baseUrl`, so a `baseUrl` that already ends in it
-    // builds `/api/api/…` and every request 404s. That was documented on
-    // `baseUrl` and left to be discovered at runtime — including by this
-    // package's own tests, which configured it that way a dozen times. A 404 on
-    // every call looks like a server that is down, not like a doubled path.
-    // `storageUrlOrigin` is checked alongside it because `storage.ts` composes
-    // it the same way — `${storageUrlOrigin ?? baseUrl}${apiPath}` — and its own
-    // docblock carries the same "no path" caveat.
-    for (const field of ["baseUrl", "storageUrlOrigin"] as const) {
-        const value = config[field];
-        if (!value || !apiPath) continue;
-        const trimmed = value.replace(/\/+$/, "");
-        if (!trimmed.endsWith(apiPath)) continue;
-        console.warn(
-            `[Rebase] ${field} ${JSON.stringify(value)} already ends with the API path ` +
-            `${JSON.stringify(apiPath)}, which is appended to it — requests will go to ` +
-            `${trimmed}${apiPath}/… and 404. Pass the origin only ` +
-            `(${JSON.stringify(trimmed.slice(0, trimmed.length - apiPath.length) || "/")}), or set ` +
-            "`apiPath` if the server really does mount the API one level deeper."
-        );
-    }
-    let token = config.token;
-    let tokenGetter: (() => Promise<string | null>) | undefined;
-    let onUnauthorizedHandler = config.onUnauthorized;
-    /** Once per client, never per request — log spam is its own bug. */
-    let anonymousWarningIssued = false;
-
-    /**
-     * Warn a server-side caller that it built a client that can only ever be
-     * anonymous. Deliberately checked at the *first request* rather than at
-     * construction: `setToken()` / `setAuthTokenGetter()` and a server-side
-     * `auth.signIn…()` (which calls `transport.setToken`) all land after the
-     * constructor, and warning at construction would fire on every one of them.
-     */
-    function warnIfAnonymousServerClient(activeToken: string | undefined): void {
-        if (anonymousWarningIssued) return;
-        if (activeToken) return;                          // a credential is being sent
-        if (tokenGetter) return;                          // a credential is being fetched per request
-        if (config.anonymous) return;                     // "yes, I meant this"
-        if (environment?.credentialOutOfBand) return;     // cookie auth flow — credential is not a header
-        if (!isServerLikeEnvironment()) return;           // browsers are legitimately anonymous
-        anonymousWarningIssued = true;
-        console.warn(ANONYMOUS_SERVER_CLIENT_WARNING);
-    }
-
-    function getHeaders(activeToken: string | undefined, init?: RequestInit) {
-        return {
-            "Content-Type": "application/json",
-            ...(activeToken ? { Authorization: `Bearer ${activeToken}` } : {}),
-            ...((init?.headers as Record<string, string>) || {})
-        };
-    }
-
-    /**
-     * The refusal for a success status carrying a body this client cannot read.
-     *
-     * The first 120 characters go in the message because they identify the
-     * sender at a glance: `<!doctype html>` says "you are talking to a web
-     * server, not to this API" faster than any wording here could.
-     *
-     * One function for both the first attempt and the post-refresh retry — the
-     * retry is a second copy of this whole response-reading path, and copies
-     * are how one of them ends up fixed and the other not.
-     */
-    function unreadableResponse(status: number, text: string): RebaseApiError {
-        return new RebaseApiError(
-            `The server answered ${status} with a body that is not JSON, so there is nothing to return. ` +
-            "This usually means the request reached something other than the Rebase API — a single-page-app " +
-            "fallback serving index.html, or a proxy error page — so check the API URL configuration " +
-            `(e.g. VITE_API_URL). The body began: ${JSON.stringify(text.slice(0, 120))}`,
-            { status, code: "INVALID_JSON_RESPONSE" }
-        );
-    }
-
-    async function request<T = unknown>(path: string, init?: RequestInit): Promise<T> {
-        const url = resolveBaseUrl(config.baseUrl) + apiPath + path;
-
-        let activeToken = token;
-        if (tokenGetter) {
-            try {
-                const fetched = await tokenGetter();
-                if (fetched !== null && fetched !== undefined) {
-                    activeToken = fetched;
-                }
-            } catch (e) {
-                // Ignore error, fallback to static token if any
-            }
-        }
-
-        warnIfAnonymousServerClient(activeToken);
-
-        const headers = getHeaders(activeToken, init);
-
-        // If passing FormData, we MUST let fetch set the boundary, so remove Content-Type
-        if (init?.body instanceof FormData) {
-            delete (headers as Record<string, string>)["Content-Type"];
-        }
-
-        const res = await fetchFn(url, { ...init,
-headers });
-
-        if (res.status === 204) return undefined as T; // SAFETY: HTTP 204 No Content has no body
-
-        const text = await res.text().catch(() => "");
-        let body: Record<string, unknown> = {};
-        /**
-         * Whether the body was there and could not be read as JSON.
-         *
-         * On an error status this does not matter — the status is the answer
-         * and the message falls back to `statusText`. On a *success* status it
-         * is the whole answer, and `{}` was being returned as though the server
-         * had sent it: `find()` answered `{}` instead of an array, `getOne()`
-         * an empty object, with nothing thrown.
-         *
-         * The case that produces it is not exotic. Point `VITE_API_URL` at the
-         * frontend's own host and `/api/data/posts` lands on the SPA fallback,
-         * which answers `200` with `index.html` — so the misconfiguration the
-         * 404 branch below spends four lines explaining reaches the caller, in
-         * its most common form, as an empty success.
-         */
-        let unreadableBody = false;
-        if (text) {
-            try {
-                body = JSON.parse(text, rebaseReviver) as Record<string, unknown>;
-            } catch (e) {
-                unreadableBody = true;
-            }
-        }
-
-        // The server always emits the canonical `{ error: { message, code, details? } }`
-        // envelope (formatted by the central errorHandler), so we read strictly
-        // from `body.error.*`.
-        const getErrorField = (obj: Record<string, unknown>, field: string): unknown => {
-            const err = obj?.error;
-            if (err && typeof err === "object" && err !== null) {
-                return (err as Record<string, unknown>)[field];
-            }
-            return undefined;
-        };
-
-        if (res.status === 401 && onUnauthorizedHandler) {
-            const retried = await onUnauthorizedHandler();
-            if (retried) {
-                let retryToken = token;
-                if (tokenGetter) {
-                    try {
-                        const fetched = await tokenGetter();
-                        if (fetched !== null && fetched !== undefined) {
-                            retryToken = fetched;
-                        }
-                    } catch (e) { /* ignore */ }
-                }
-                const retryHeaders = getHeaders(retryToken, init) as Record<string, string>;
-                const retryRes = await fetchFn(url, { ...init,
-headers: retryHeaders });
-                if (retryRes.status === 204) return undefined as T; // SAFETY: HTTP 204 No Content has no body
-                const retryText = await retryRes.text().catch(() => "");
-                let retryBody: Record<string, unknown> = {};
-                let retryUnreadable = false;
-                if (retryText) {
-                    try {
-                        retryBody = JSON.parse(retryText, rebaseReviver);
-                    } catch (e) {
-                        retryUnreadable = true;
-                    }
-                }
-                if (!retryRes.ok) {
-                    let fallbackMessage = retryRes.statusText;
-                    if (retryRes.status === 404 && !fallbackMessage) {
-                        const method = init?.method || "GET";
-                        fallbackMessage = `Endpoint not found (${method} ${path}). This usually means the collection is not registered on the backend, or the frontend API URL configuration (e.g. VITE_API_URL) is missing or pointing to the wrong host.`;
-                    }
-                    throw new RebaseApiError(
-                        String(getErrorField(retryBody, "message") || fallbackMessage || `Request failed with status ${retryRes.status}`),
-                        {
-                            status: retryRes.status,
-                            code: getErrorField(retryBody, "code") as string | undefined,
-                            details: getErrorField(retryBody, "details")
-                        }
-                    );
-                }
-                if (retryUnreadable) throw unreadableResponse(retryRes.status, retryText);
-                return retryBody as T;
-            }
-        }
-
-        if (!res.ok) {
-            let fallbackMessage = res.statusText;
-            if (res.status === 404 && !fallbackMessage) {
-                const method = init?.method || "GET";
-                fallbackMessage = `Endpoint not found (${method} ${path}). This usually means the collection is not registered on the backend, or the frontend API URL configuration (e.g. VITE_API_URL) is missing or pointing to the wrong host.`;
-            }
-            throw new RebaseApiError(
-                String(getErrorField(body, "message") || fallbackMessage || `Request failed with status ${res.status}`),
-                {
-                    status: res.status,
-                    code: getErrorField(body, "code") as string | undefined,
-                    details: getErrorField(body, "details")
-                }
-            );
-        }
-
-        if (unreadableBody) throw unreadableResponse(res.status, text);
-
-        return body as T;
-    }
-
-    return {
-        request,
-        setToken(newToken: string | null) { token = newToken || undefined; },
-        setAuthTokenGetter(getter: () => Promise<string | null>) { tokenGetter = getter; },
-        setOnUnauthorized(handler: () => Promise<boolean>) { onUnauthorizedHandler = handler; },
-        get baseUrl() { return resolveBaseUrl(config.baseUrl); },
-        get apiPath() { return apiPath; },
-        get storageUrlOrigin() { return config.storageUrlOrigin?.replace(/\/$/, "") || undefined; },
-        get fetchFn() { return fetchFn; },
-        getHeaders: (init?: RequestInit) => getHeaders(token, init) as Record<string, string>,
-        resolveToken: async () => {
-            if (tokenGetter) {
-                try {
-                    const fetched = await tokenGetter();
-                    if (fetched !== null && fetched !== undefined) {
-                        return fetched;
-                    }
-                } catch (e) { /* ignore */ }
-            }
-            return token || null;
-        }
-    };
-}

package/src/vector-search-listen.test.ts

@@ -1,42 +0,0 @@
-/**
- * `.vectorSearch(…).listen()` must reach the server's refusal.
- *
- * `realtimeService` rejects a subscription carrying `vectorSearch` — a
- * subscription is re-run on every matching write and nothing there computes
- * distances — and the documentation promises that refusal. Both producers of a
- * subscription request hand-list their fields, and both omitted this one, so
- * the guard could not fire: the call returned an ordinary `id DESC` listing,
- * with no `_distance` and no error. Through `observe()` it was worse, because
- * the correct initial snapshot was then overwritten by the wrong socket
- * listing.
- *
- * Asserted on the request the client BUILDS rather than on a live socket: what
- * was missing is a field, and the refusal it has to reach is tested where it
- * lives.
- */
-import { readFileSync } from "node:fs";
-import { resolve } from "node:path";
-
-const listenRequestBlock = (file: string, marker: string) => {
-    const source = readFileSync(resolve(__dirname, file), "utf-8");
-    const start = source.indexOf(marker);
-    expect(start).toBeGreaterThan(-1);
-    return source.slice(start, start + 3000);
-};
-
-describe("a subscription request carries every field the server refuses on", () => {
-    it("the client's listenCollection forwards vectorSearch", () => {
-        const block = listenRequestBlock("./collection.ts", "ws.listenCollection(");
-        expect(block).toContain("vectorSearch: params?.vectorSearch");
-    });
-
-    it("forwards it beside the fields it already forwarded", () => {
-        // Guards against the assertion above passing on a stray mention: the
-        // field has to be in the same object literal as the rest.
-        const block = listenRequestBlock("./collection.ts", "ws.listenCollection(");
-        const objectLiteral = block.slice(0, block.indexOf("},"));
-        for (const field of ["path:", "filter:", "orderBy:", "searchString:", "vectorSearch:"]) {
-            expect(objectLiteral).toContain(field);
-        }
-    });
-});

package/src/vector-search-query.test.ts

@@ -1,55 +0,0 @@
-/**
- * The SDK's route to vector search.
- *
- * The Postgres driver has served `vector_search` since vectors landed, but no
- * method on the query builder ever reached it and it appeared in no OpenAPI
- * spec — so the only way to use a shipped feature was to hand-build the URL.
- * These tests pin the wire format the server's parser actually expects.
- */
-import { buildQueryString } from "./transport";
-import type { FindParams } from "@rebasepro/types";
-
-const params = (p: FindParams): URLSearchParams =>
-    new URLSearchParams(buildQueryString(p).replace(/^\?/, ""));
-
-describe("vector search serialization", () => {
-    it("sends the property under `vector_search` and the embedding as a JSON array", () => {
-        const q = params({ vectorSearch: { property: "embedding", vector: [0.1, -0.2, 0.3] } });
-        expect(q.get("vector_search")).toBe("embedding");
-        expect(q.get("vector")).toBe("[0.1,-0.2,0.3]");
-    });
-
-    it("omits distance and threshold when not asked for, so the server's defaults stand", () => {
-        const q = params({ vectorSearch: { property: "embedding", vector: [1] } });
-        expect(q.has("vector_distance")).toBe(false);
-        expect(q.has("vector_threshold")).toBe(false);
-    });
-
-    it("sends distance and threshold when given", () => {
-        const q = params({
-            vectorSearch: { property: "embedding", vector: [1], distance: "l2", threshold: 0.35 }
-        });
-        expect(q.get("vector_distance")).toBe("l2");
-        expect(q.get("vector_threshold")).toBe("0.35");
-    });
-
-    it("sends a threshold of 0, which is a real bound and not an absent one", () => {
-        const q = params({ vectorSearch: { property: "embedding", vector: [1], threshold: 0 } });
-        expect(q.get("vector_threshold")).toBe("0");
-    });
-
-    it("adds nothing at all when there is no vector search", () => {
-        expect(buildQueryString({ limit: 10 })).not.toContain("vector");
-    });
-
-    it("stacks with filters and limit, which the server ANDs before ordering by distance", () => {
-        const q = params({
-            vectorSearch: { property: "embedding", vector: [0.5] },
-            where: { status: ["==", "published"] },
-            limit: 5
-        });
-        expect(q.get("vector_search")).toBe("embedding");
-        expect(q.get("limit")).toBe("5");
-        expect(buildQueryString({ where: { status: ["==", "published"] } })).toContain("status");
-    });
-});