@rebasepro/common 0.14.0 → 0.14.1-canary.g7e666eb

package/dist/data/query_builder.d.ts

@@ -15,8 +15,14 @@ export declare class QueryBuilder<M extends Record<string, unknown> = Record<str
     where(logicalCondition: LogicalCondition): this;
     /**
      * Order the results by a specific column.
+     *
+     * Called again, this adds a tie-breaker rather than replacing the sort:
+     * keys apply in the order they were added.
+     *
      * @example
      * client.collection('users').orderBy('createdAt', 'desc').find()
+     * @example
+     * client.collection('users').orderBy('roles').orderBy('createdAt', 'desc').find()
      */
     orderBy(column: (keyof M & string) | ComputedSortField, direction?: "asc" | "desc"): this;
     /**

package/dist/data/sort-dialect.d.ts

@@ -1,9 +1,10 @@
-import type { OrderByTuple } from "@rebasepro/types";
+import type { OrderBySpec, OrderByTuple } from "@rebasepro/types";
 /**
  * Sort-order wire codec.
  *
  * This is the ONLY module that knows about the colon-delimited wire format
- * (`"field:direction"`) used in HTTP query parameters.
+ * (`"field:direction"`) used in HTTP query parameters, and about the JSON-array
+ * form that carries a multi-column sort over the same parameter.
  * Everything else speaks {@link OrderByTuple} exclusively.
  *
  * Mirrors the filter architecture in `filter-dialect.ts`.
@@ -11,22 +12,82 @@ import type { OrderByTuple } from "@rebasepro/types";
  * @module
  */
 /**
- * Serialize an {@link OrderByTuple} to the wire format `"field:direction"`.
+ * Collapse the one-key and many-key spellings of a sort into the list form.
+ *
+ * `["a", "desc"]` and `[["a", "desc"]]` mean the same thing and normalize to
+ * the same value; the two are told apart by whether the first element is
+ * itself an array, which no field name ever is.
+ *
+ * @returns The keys in order of significance, or `undefined` for no sort. An
+ *   empty list also returns `undefined` — "sort by nothing" is no sort, and
+ *   letting `[]` through would have every layer below re-deciding what it meant.
+ */
+export declare function normalizeOrderBy(orderBy?: OrderBySpec): OrderByTuple[] | undefined;
+/**
+ * The most significant sort key, for a caller that can only express one —
+ * a column header's arrow, a URL parameter, a driver that has not been taught
+ * the list form.
+ */
+export declare function primaryOrderBy(orderBy?: OrderBySpec): OrderByTuple | undefined;
+/**
+ * Collapse the driver-level `{orderBy, order}` pair into the list form.
+ *
+ * The driver contract spells a single-column sort as a field name plus a
+ * separate direction, and a multi-column one as a list of tuples that leaves
+ * `order` meaningless. Every driver reads both through here so neither
+ * spelling has to be handled twice.
+ *
+ * An absent direction means ascending — the same thing a bare `?orderBy=name`
+ * has always meant over HTTP. The Postgres driver used to read the same pair as
+ * *descending* while Mongo read it as ascending, so one field name and no
+ * direction described two different queries depending on which database was
+ * underneath. Neither had a caller: every path in the workspace passes a
+ * direction, which is why the disagreement went unnoticed rather than being
+ * load-bearing.
+ */
+export declare function normalizeDriverOrderBy(orderBy?: string | OrderByTuple[], order?: "asc" | "desc"): OrderByTuple[] | undefined;
+/** A sort whose *shape* is unusable, as opposed to one naming a field that does not exist. */
+export declare class OrderBySpecError extends Error {
+    readonly code = "INVALID_ORDER_BY";
+    constructor(detail: string);
+}
+/**
+ * Validate an `orderBy` that arrived from outside this process — a WebSocket
+ * subscribe frame, a driver call from untyped JavaScript — and return it in the
+ * list form.
+ *
+ * Strict on purpose, in the same way the REST `parseOrderByParam` is: the
+ * failure mode for a shape nobody checks is not a crash but a *silently
+ * different query*. A malformed entry read as a field name resolves to no
+ * column, and under the lenient unknown-field mode the sort is then dropped and
+ * the rows come back in whatever order the database pleased — sorted, as far as
+ * the subscriber can tell, by whatever they asked for.
+ */
+export declare function parseOrderBySpecStrict(raw: unknown, order?: "asc" | "desc"): OrderByTuple[] | undefined;
+/**
+ * Serialize a sort to the wire.
+ *
+ * A single key keeps the `"field:direction"` shorthand it has always used —
+ * short, readable in a URL, and what every existing client and test expects.
+ * Several keys are emitted as the canonical JSON array the server already
+ * accepts, because the shorthand has no separator to spare: a comma-joined
+ * `"a:asc,b:desc"` parses as one field named `a` with the direction
+ * `"asc,b:desc"`, which the server refuses.
  *
  * **Runtime tolerance:** if the input is already a well-formed wire string
  * (from an untyped JS caller), it is returned unchanged.
  * This is undocumented tolerance, not public API — don't rely on it.
  *
- * @param orderBy - A canonical `[field, direction]` tuple, or at runtime
+ * @param orderBy - A canonical tuple or list of tuples, or at runtime
  *   possibly a pre-serialized string (undocumented tolerance).
  * @returns The wire-format string, or `undefined` if the input is falsy.
  *
  * @remarks
  * Field names containing `:` are representable in the tuple form but
- * **not** on the wire — this is an inherent limitation of the colon-delimited
- * encoding and is not resolved here.
+ * **not** in the single-key wire encoding — this is an inherent limitation of
+ * the colon-delimited shorthand and is not resolved here.
  */
-export declare function serializeOrderBy(orderBy?: OrderByTuple | string): string | undefined;
+export declare function serializeOrderBy(orderBy?: OrderBySpec | string): string | undefined;
 /**
  * Deserialize a wire-format `"field:direction"` string into an {@link OrderByTuple}.
  *
@@ -35,7 +96,23 @@ export declare function serializeOrderBy(orderBy?: OrderByTuple | string): strin
  * - Unknown direction: `"name:foo"` → `["name", "asc"]`
  * - Empty / falsy input: → `undefined`
  *
+ * Reads the single-key shorthand only. For a value that may carry several keys,
+ * use {@link deserializeOrderByList} — handed a JSON array this returns the
+ * whole array as one nonsensical field name.
+ *
  * @param raw - The wire-format string from an HTTP query parameter.
  * @returns The canonical tuple, or `undefined` if the input is empty/falsy.
  */
 export declare function deserializeOrderBy(raw?: string): OrderByTuple | undefined;
+/**
+ * Deserialize either wire spelling — the single-key shorthand or the JSON
+ * array — into the list form.
+ *
+ * Lenient in the same way {@link deserializeOrderBy} is: this is the client end
+ * of the codec, where the value was produced by {@link serializeOrderBy} a
+ * moment earlier. The *server* end parses the same shapes strictly, in
+ * `parseOrderByParam`, because there the value came from a stranger and a
+ * direction it cannot read has to be refused rather than quietly turned into
+ * `"asc"`.
+ */
+export declare function deserializeOrderByList(raw?: string): OrderByTuple[] | undefined;

package/dist/index.es.js

@@ -1471,8 +1471,147 @@ function schemaOf(collection) {
 }
 function resolveColumnName(propName, collection) {
 	const prop = collection?.properties?.[propName];
-	if (prop && "columnName" in prop && typeof prop.columnName === "string") return prop.columnName;
-	return toSnakeCase(propName);
+	if (prop && "columnName" in prop && typeof prop.columnName === "string") return quoteColumnIdentifier(prop.columnName);
+	return quoteColumnIdentifier(toSnakeCase(propName));
+}
+/**
+* Every PostgreSQL keyword that cannot stand as a bare column reference.
+* Appendix C's two reserved categories — plain "reserved", and "reserved (can
+* be function or type name)" — since neither may name a column unquoted.
+*/
+var RESERVED_SQL_WORDS = /* @__PURE__ */ new Set([
+	"all",
+	"analyse",
+	"analyze",
+	"and",
+	"any",
+	"array",
+	"as",
+	"asc",
+	"asymmetric",
+	"authorization",
+	"binary",
+	"both",
+	"case",
+	"cast",
+	"check",
+	"collate",
+	"collation",
+	"column",
+	"concurrently",
+	"constraint",
+	"create",
+	"cross",
+	"current_catalog",
+	"current_date",
+	"current_role",
+	"current_schema",
+	"current_time",
+	"current_timestamp",
+	"current_user",
+	"default",
+	"deferrable",
+	"desc",
+	"distinct",
+	"do",
+	"else",
+	"end",
+	"except",
+	"false",
+	"fetch",
+	"for",
+	"foreign",
+	"freeze",
+	"from",
+	"full",
+	"grant",
+	"group",
+	"having",
+	"ilike",
+	"in",
+	"initially",
+	"inner",
+	"intersect",
+	"into",
+	"is",
+	"isnull",
+	"join",
+	"lateral",
+	"leading",
+	"left",
+	"like",
+	"limit",
+	"localtime",
+	"localtimestamp",
+	"natural",
+	"not",
+	"notnull",
+	"null",
+	"offset",
+	"on",
+	"only",
+	"or",
+	"order",
+	"outer",
+	"overlaps",
+	"placing",
+	"primary",
+	"references",
+	"returning",
+	"right",
+	"select",
+	"session_user",
+	"similar",
+	"some",
+	"symmetric",
+	"system_user",
+	"table",
+	"tablesample",
+	"then",
+	"to",
+	"trailing",
+	"true",
+	"union",
+	"unique",
+	"user",
+	"using",
+	"variadic",
+	"verbose",
+	"when",
+	"where",
+	"window",
+	"with"
+]);
+/** An identifier Postgres reads back unchanged without quotes. */
+var BARE_IDENTIFIER = /^[a-z_][a-z0-9_$]*$/;
+/**
+* Quote a column reference when Postgres would not read the bare name as that
+* column — and only then.
+*
+* Three ways a bare name goes wrong, in ascending order of how long it takes to
+* notice:
+*
+* - **Case.** `columnName` is used verbatim, and `rebase schema introspect`
+*   populates it from a live database, so a legacy `"createdAt"` column arrives
+*   spelled exactly that way. Unquoted, Postgres folds it to `createdat` and
+*   `CREATE POLICY` fails with "column does not exist" — the collection keeps
+*   RLS enabled with no policy, which denies every row.
+* - **Syntax.** A column named `order` or `default` is a syntax error mid-clause.
+* - **Silent rebinding.** `user`, `current_user`, `session_user`, `current_date`
+*   and friends are *valid bare expressions*, so the policy compiles, applies,
+*   and is reported as a success — while comparing against the connected role
+*   or the wall clock instead of the column. Under RLS every request runs as the
+*   same `rebase_user` role, so `USING (user = rebase.uid())` is a constant: it
+*   denies everything, and its negation admits everything.
+*
+* Only the names that need it are quoted, so an ordinary snake_case policy body
+* is emitted byte-for-byte as before. That keeps generated artifacts and the
+* policies already stored in shipped databases stable — this fix reaches the
+* clauses that were broken and no others.
+*/
+function quoteColumnIdentifier(name) {
+	if (BARE_IDENTIFIER.test(name) && !RESERVED_SQL_WORDS.has(name)) return name;
+	return `"${name.replace(/"/g, "\"\"")}"`;
 }
 function quoteLiteral(value) {
 	if (value === null) return "NULL";
@@ -3144,6 +3283,180 @@ var defaultUsersCollection = defineCollection({
 	}
 });
 //#endregion
+//#region src/data/sort-dialect.ts
+/**
+* Sort-order wire codec.
+*
+* This is the ONLY module that knows about the colon-delimited wire format
+* (`"field:direction"`) used in HTTP query parameters, and about the JSON-array
+* form that carries a multi-column sort over the same parameter.
+* Everything else speaks {@link OrderByTuple} exclusively.
+*
+* Mirrors the filter architecture in `filter-dialect.ts`.
+*
+* @module
+*/
+/**
+* Collapse the one-key and many-key spellings of a sort into the list form.
+*
+* `["a", "desc"]` and `[["a", "desc"]]` mean the same thing and normalize to
+* the same value; the two are told apart by whether the first element is
+* itself an array, which no field name ever is.
+*
+* @returns The keys in order of significance, or `undefined` for no sort. An
+*   empty list also returns `undefined` — "sort by nothing" is no sort, and
+*   letting `[]` through would have every layer below re-deciding what it meant.
+*/
+function normalizeOrderBy(orderBy) {
+	if (!orderBy || orderBy.length === 0) return void 0;
+	const list = Array.isArray(orderBy[0]) ? orderBy : [orderBy];
+	return list.length > 0 ? list : void 0;
+}
+/**
+* The most significant sort key, for a caller that can only express one —
+* a column header's arrow, a URL parameter, a driver that has not been taught
+* the list form.
+*/
+function primaryOrderBy(orderBy) {
+	return normalizeOrderBy(orderBy)?.[0];
+}
+/**
+* Collapse the driver-level `{orderBy, order}` pair into the list form.
+*
+* The driver contract spells a single-column sort as a field name plus a
+* separate direction, and a multi-column one as a list of tuples that leaves
+* `order` meaningless. Every driver reads both through here so neither
+* spelling has to be handled twice.
+*
+* An absent direction means ascending — the same thing a bare `?orderBy=name`
+* has always meant over HTTP. The Postgres driver used to read the same pair as
+* *descending* while Mongo read it as ascending, so one field name and no
+* direction described two different queries depending on which database was
+* underneath. Neither had a caller: every path in the workspace passes a
+* direction, which is why the disagreement went unnoticed rather than being
+* load-bearing.
+*/
+function normalizeDriverOrderBy(orderBy, order) {
+	if (!orderBy) return void 0;
+	if (typeof orderBy === "string") return [[orderBy, order === "desc" ? "desc" : "asc"]];
+	return orderBy.length > 0 ? orderBy : void 0;
+}
+/** A sort whose *shape* is unusable, as opposed to one naming a field that does not exist. */
+var OrderBySpecError = class extends Error {
+	code = "INVALID_ORDER_BY";
+	constructor(detail) {
+		super(`Invalid \`orderBy\`: ${detail}. Expected a field name, or a list of [field, direction] pairs like [["roles","asc"],["created_at","desc"]]`);
+		this.name = "OrderBySpecError";
+	}
+};
+/**
+* Validate an `orderBy` that arrived from outside this process — a WebSocket
+* subscribe frame, a driver call from untyped JavaScript — and return it in the
+* list form.
+*
+* Strict on purpose, in the same way the REST `parseOrderByParam` is: the
+* failure mode for a shape nobody checks is not a crash but a *silently
+* different query*. A malformed entry read as a field name resolves to no
+* column, and under the lenient unknown-field mode the sort is then dropped and
+* the rows come back in whatever order the database pleased — sorted, as far as
+* the subscriber can tell, by whatever they asked for.
+*/
+function parseOrderBySpecStrict(raw, order) {
+	if (raw === void 0 || raw === null || raw === "") return void 0;
+	if (typeof raw === "string") return normalizeDriverOrderBy(raw, order);
+	if (!Array.isArray(raw) || raw.length === 0) throw new OrderBySpecError(`${typeof raw} is not a field name or a list of sort keys`);
+	if (typeof raw[0] === "string") return [toStrictTuple(raw, 0)];
+	return raw.map(toStrictTuple);
+}
+function toStrictTuple(raw, index) {
+	if (!Array.isArray(raw) || typeof raw[0] !== "string" || raw[0].trim() === "") throw new OrderBySpecError(`entry ${index} has no field name`);
+	const direction = raw[1];
+	if (direction !== void 0 && direction !== "asc" && direction !== "desc") throw new OrderBySpecError(`entry ${index} has direction '${String(direction)}'`);
+	return [raw[0], direction ?? "asc"];
+}
+/**
+* Serialize a sort to the wire.
+*
+* A single key keeps the `"field:direction"` shorthand it has always used —
+* short, readable in a URL, and what every existing client and test expects.
+* Several keys are emitted as the canonical JSON array the server already
+* accepts, because the shorthand has no separator to spare: a comma-joined
+* `"a:asc,b:desc"` parses as one field named `a` with the direction
+* `"asc,b:desc"`, which the server refuses.
+*
+* **Runtime tolerance:** if the input is already a well-formed wire string
+* (from an untyped JS caller), it is returned unchanged.
+* This is undocumented tolerance, not public API — don't rely on it.
+*
+* @param orderBy - A canonical tuple or list of tuples, or at runtime
+*   possibly a pre-serialized string (undocumented tolerance).
+* @returns The wire-format string, or `undefined` if the input is falsy.
+*
+* @remarks
+* Field names containing `:` are representable in the tuple form but
+* **not** in the single-key wire encoding — this is an inherent limitation of
+* the colon-delimited shorthand and is not resolved here.
+*/
+function serializeOrderBy(orderBy) {
+	if (!orderBy) return void 0;
+	if (typeof orderBy === "string") return orderBy;
+	const list = normalizeOrderBy(orderBy);
+	if (!list) return void 0;
+	if (list.length === 1) return `${list[0][0]}:${list[0][1]}`;
+	return JSON.stringify(list.map(([field, direction]) => ({
+		field,
+		direction
+	})));
+}
+/**
+* Deserialize a wire-format `"field:direction"` string into an {@link OrderByTuple}.
+*
+* Lenient parsing (matches existing server behaviour):
+* - Bare field name (no colon): `"name"` → `["name", "asc"]`
+* - Unknown direction: `"name:foo"` → `["name", "asc"]`
+* - Empty / falsy input: → `undefined`
+*
+* Reads the single-key shorthand only. For a value that may carry several keys,
+* use {@link deserializeOrderByList} — handed a JSON array this returns the
+* whole array as one nonsensical field name.
+*
+* @param raw - The wire-format string from an HTTP query parameter.
+* @returns The canonical tuple, or `undefined` if the input is empty/falsy.
+*/
+function deserializeOrderBy(raw) {
+	if (!raw) return void 0;
+	const idx = raw.indexOf(":");
+	if (idx === -1) return [raw, "asc"];
+	return [raw.slice(0, idx), raw.slice(idx + 1) === "desc" ? "desc" : "asc"];
+}
+/**
+* Deserialize either wire spelling — the single-key shorthand or the JSON
+* array — into the list form.
+*
+* Lenient in the same way {@link deserializeOrderBy} is: this is the client end
+* of the codec, where the value was produced by {@link serializeOrderBy} a
+* moment earlier. The *server* end parses the same shapes strictly, in
+* `parseOrderByParam`, because there the value came from a stranger and a
+* direction it cannot read has to be refused rather than quietly turned into
+* `"asc"`.
+*/
+function deserializeOrderByList(raw) {
+	if (!raw) return void 0;
+	const trimmed = raw.trim();
+	if (trimmed.startsWith("[")) try {
+		const parsed = JSON.parse(trimmed);
+		if (Array.isArray(parsed)) {
+			const list = parsed.map((entry) => {
+				if (typeof entry === "string") return deserializeOrderBy(entry);
+				if (entry && typeof entry === "object" && typeof entry.field === "string") return [entry.field, entry.direction === "desc" ? "desc" : "asc"];
+			}).filter((entry) => entry !== void 0);
+			return list.length > 0 ? list : void 0;
+		}
+	} catch {}
+	const single = deserializeOrderBy(trimmed);
+	return single ? [single] : void 0;
+}
+//#endregion
 //#region src/data/query_builder.ts
 function or(...conditions) {
 	return {
@@ -3191,11 +3504,18 @@ var QueryBuilder = class {
 	}
 	/**
 	* Order the results by a specific column.
+	*
+	* Called again, this adds a tie-breaker rather than replacing the sort:
+	* keys apply in the order they were added.
+	*
 	* @example
 	* client.collection('users').orderBy('createdAt', 'desc').find()
+	* @example
+	* client.collection('users').orderBy('roles').orderBy('createdAt', 'desc').find()
 	*/
 	orderBy(column, direction = "asc") {
-		this.params.orderBy = [column, direction];
+		const existing = normalizeOrderBy(this.params.orderBy) ?? [];
+		this.params.orderBy = [...existing, [column, direction]];
 		return this;
 	}
 	/**
@@ -3384,9 +3704,10 @@ async function* paginateFind(find, params, label = "collection") {
 	const requestedDirection = typeof cursor === "object" && cursor !== null ? cursor.direction : void 0;
 	let direction = "asc";
 	if (cursorField) {
-		const orderBy = findParams.orderBy;
-		if (orderBy && orderBy[0] !== cursorField) throw new RebasePaginationError("cursor-order-mismatch", `Cannot seek on "${cursorField}" while ordering "${label}" by "${orderBy[0]}": keyset pagination only advances along the column the query is sorted by. Order by "${cursorField}", or drop the cursor and page by offset.`);
-		direction = requestedDirection ?? orderBy?.[1] ?? "asc";
+		const orderBy = normalizeOrderBy(findParams.orderBy);
+		if (orderBy && orderBy.length > 1) throw new RebasePaginationError("cursor-order-mismatch", `Cannot seek on "${cursorField}" while ordering "${label}" by ${orderBy.map(([field]) => `"${field}"`).join(", ")}: keyset pagination advances along a single column. Order by "${cursorField}" alone, or drop the cursor and page by offset.`);
+		if (orderBy && orderBy[0][0] !== cursorField) throw new RebasePaginationError("cursor-order-mismatch", `Cannot seek on "${cursorField}" while ordering "${label}" by "${orderBy[0][0]}": keyset pagination only advances along the column the query is sorted by. Order by "${cursorField}", or drop the cursor and page by offset.`);
+		direction = requestedDirection ?? orderBy?.[0][1] ?? "asc";
 		findParams.orderBy = [cursorField, direction];
 	}
 	const seekOp = direction === "desc" ? "<" : ">";
@@ -4073,8 +4394,7 @@ function createDriverAccessor(driver, slug, getPks = () => []) {
 				logical: params?.logical,
 				limit,
 				offset: driverOffset,
-				orderBy: params?.orderBy?.[0],
-				order: params?.orderBy?.[1],
+				orderBy: normalizeOrderBy(params?.orderBy),
 				searchString: params?.searchString
 			}, params?.include) : await driver.fetchCollection({
 				path: slug,
@@ -4082,8 +4402,7 @@ function createDriverAccessor(driver, slug, getPks = () => []) {
 				offset: driverOffset,
 				filter,
 				logical: params?.logical,
-				orderBy: params?.orderBy?.[0],
-				order: params?.orderBy?.[1],
+				orderBy: normalizeOrderBy(params?.orderBy),
 				searchString: params?.searchString
 			});
 			let total = rows.length + offset;
@@ -4178,8 +4497,7 @@ function createDriverAccessor(driver, slug, getPks = () => []) {
 				offset: driverOffset,
 				filter: params?.where,
 				logical: params?.logical,
-				orderBy: params?.orderBy?.[0],
-				order: params?.orderBy?.[1],
+				orderBy: normalizeOrderBy(params?.orderBy),
 				searchString: params?.searchString,
 				searchExplain: params?.searchExplain,
 				onUpdate: (entities) => {
@@ -4299,8 +4617,10 @@ var SdkQueryBuilder = class {
 		}
 		return this;
 	}
+	/** Called again, this adds a tie-breaker rather than replacing the sort. */
 	orderBy(column, direction = "asc") {
-		this.params.orderBy = [column, direction];
+		const existing = normalizeOrderBy(this.params.orderBy) ?? [];
+		this.params.orderBy = [...existing, [column, direction]];
 		return this;
 	}
 	limit(count) {
@@ -4607,57 +4927,6 @@ function toFilterTuples(filterParam) {
 	return [filterParam];
 }
 //#endregion
-//#region src/data/sort-dialect.ts
-/**
-* Sort-order wire codec.
-*
-* This is the ONLY module that knows about the colon-delimited wire format
-* (`"field:direction"`) used in HTTP query parameters.
-* Everything else speaks {@link OrderByTuple} exclusively.
-*
-* Mirrors the filter architecture in `filter-dialect.ts`.
-*
-* @module
-*/
-/**
-* Serialize an {@link OrderByTuple} to the wire format `"field:direction"`.
-*
-* **Runtime tolerance:** if the input is already a well-formed wire string
-* (from an untyped JS caller), it is returned unchanged.
-* This is undocumented tolerance, not public API — don't rely on it.
-*
-* @param orderBy - A canonical `[field, direction]` tuple, or at runtime
-*   possibly a pre-serialized string (undocumented tolerance).
-* @returns The wire-format string, or `undefined` if the input is falsy.
-*
-* @remarks
-* Field names containing `:` are representable in the tuple form but
-* **not** on the wire — this is an inherent limitation of the colon-delimited
-* encoding and is not resolved here.
-*/
-function serializeOrderBy(orderBy) {
-	if (!orderBy) return void 0;
-	if (typeof orderBy === "string") return orderBy;
-	return `${orderBy[0]}:${orderBy[1]}`;
-}
-/**
-* Deserialize a wire-format `"field:direction"` string into an {@link OrderByTuple}.
-*
-* Lenient parsing (matches existing server behaviour):
-* - Bare field name (no colon): `"name"` → `["name", "asc"]`
-* - Unknown direction: `"name:foo"` → `["name", "asc"]`
-* - Empty / falsy input: → `undefined`
-*
-* @param raw - The wire-format string from an HTTP query parameter.
-* @returns The canonical tuple, or `undefined` if the input is empty/falsy.
-*/
-function deserializeOrderBy(raw) {
-	if (!raw) return void 0;
-	const idx = raw.indexOf(":");
-	if (idx === -1) return [raw, "asc"];
-	return [raw.slice(0, idx), raw.slice(idx + 1) === "desc" ? "desc" : "asc"];
-}
-//#endregion
 //#region src/table-classification.ts
 /** Schemas that are always considered Rebase-internal. */
 var REBASE_INTERNAL_SCHEMAS = ["rebase", "auth"];
@@ -4734,6 +5003,6 @@ async function detectJunctionTables(executeSql) {
 	return junctionTables;
 }
 //#endregion
-export { COLLECTION_PATH_SEPARATOR, COMPOSITE_ID_SEPARATOR, CollectionRegistry, DEFAULT_FIND_ALL_MAX_ROWS, DEFAULT_MAX_PAGES, DEFAULT_ONE_OF_TYPE, DEFAULT_ONE_OF_VALUE, DEFAULT_PAGE_SIZE, DEFAULT_STRING_COLUMN_LENGTH, JUNCTION_TABLES_SQL, MAX_LOGICAL_NESTING_DEPTH, QueryBuilder, REBASE_INTERNAL_PREFIXES, REBASE_INTERNAL_SCHEMAS, REBASE_INTERNAL_TABLES, REBASE_USER_ROLE, RebasePaginationError, UnknownFilterOperatorError, and, buildCollectionFromTableMetadata, buildCompositeId, buildConditionContext, buildPropertyCallbacks, buildRebaseData, buildRoutedRebaseData, buildSdkData, canCreateEntity, canDeleteEntity, canEditEntity, canReadCollection, checkOperation, classifyTable, collectAllPages, cond, createDataSourceRegistry, createPaginationHelpers, createRelationRef, createRelationRefWithData, defaultUsersCollection, defineCollection, deserializeFilter, deserializeLogicalCondition, deserializeOrderBy, detectJunctionTables, embedParentExpression, enumToObjectEntries, evaluateCondition, evaluatePolicy, fieldKeyForColumn, findAnonymousGrants, findRelation, fullPathToCollectionSegments, getArrayResolvedProperties, getChildViewDeclaringProperties, getChildViewRelationPropertyKeys, getColumnName, getDeclaredPrimaryKeys, getDefaultValueFor, getDefaultValueFortype, getDefaultValuesFor, getEffectiveSecurityRules, getEntityChildViews, getEnumVarName, getGeneratedPolicyNames, getInjectedSecurityRules, getJunctionCollectionConfig, getJunctionSecurityRules, getLabelOrConfigFrom, getPrimaryKeys, getReferenceFrom, getRelationFrom, getRelationTargetPath, getSubcollections, getTableName, getTableVarName, isAddressableId, isJunctionBackedRelation, isPropertyBuilder, isRebaseInternalTable, isRelationalCollection, normalizeEmail, normalizeToEntityRelation, or, paginateFind, parseIdValues, policyToPostgres, registerConditionOperations, relationalCollections, resolveArrayProperties, resolveCollectionRelations, resolveDataSource, resolveEnumValues, resolveFindWindow, resolveJunctionSpecs, resolvePrimaryKeys, resolveProperties, resolveProperty, resolvePropertyEnum, resolveRelation, resolveRelationProperty, resolveStorageFilenameString, resolveStoragePathString, resolveStorageSource, resolveStringColumnLength, revokeInternalTableAccess, revokeInternalTableSql, sanitizeData, securityRuleToConditions, segmentsToStrippedPath, serializeFilter, serializeLogicalCondition, serializeOrderBy, sortCollectionsBySlug, sortProperties, sqlToPolicy, stripCollectionPath, toFilterTuples, traverseValueProperty, traverseValuesProperties, updateDateAutoValues, wrapAsEntityData, wrapAsSdkData };
+export { COLLECTION_PATH_SEPARATOR, COMPOSITE_ID_SEPARATOR, CollectionRegistry, DEFAULT_FIND_ALL_MAX_ROWS, DEFAULT_MAX_PAGES, DEFAULT_ONE_OF_TYPE, DEFAULT_ONE_OF_VALUE, DEFAULT_PAGE_SIZE, DEFAULT_STRING_COLUMN_LENGTH, JUNCTION_TABLES_SQL, MAX_LOGICAL_NESTING_DEPTH, OrderBySpecError, QueryBuilder, REBASE_INTERNAL_PREFIXES, REBASE_INTERNAL_SCHEMAS, REBASE_INTERNAL_TABLES, REBASE_USER_ROLE, RebasePaginationError, UnknownFilterOperatorError, and, buildCollectionFromTableMetadata, buildCompositeId, buildConditionContext, buildPropertyCallbacks, buildRebaseData, buildRoutedRebaseData, buildSdkData, canCreateEntity, canDeleteEntity, canEditEntity, canReadCollection, checkOperation, classifyTable, collectAllPages, cond, createDataSourceRegistry, createPaginationHelpers, createRelationRef, createRelationRefWithData, defaultUsersCollection, defineCollection, deserializeFilter, deserializeLogicalCondition, deserializeOrderBy, deserializeOrderByList, detectJunctionTables, embedParentExpression, enumToObjectEntries, evaluateCondition, evaluatePolicy, fieldKeyForColumn, findAnonymousGrants, findRelation, fullPathToCollectionSegments, getArrayResolvedProperties, getChildViewDeclaringProperties, getChildViewRelationPropertyKeys, getColumnName, getDeclaredPrimaryKeys, getDefaultValueFor, getDefaultValueFortype, getDefaultValuesFor, getEffectiveSecurityRules, getEntityChildViews, getEnumVarName, getGeneratedPolicyNames, getInjectedSecurityRules, getJunctionCollectionConfig, getJunctionSecurityRules, getLabelOrConfigFrom, getPrimaryKeys, getReferenceFrom, getRelationFrom, getRelationTargetPath, getSubcollections, getTableName, getTableVarName, isAddressableId, isJunctionBackedRelation, isPropertyBuilder, isRebaseInternalTable, isRelationalCollection, normalizeDriverOrderBy, normalizeEmail, normalizeOrderBy, normalizeToEntityRelation, or, paginateFind, parseIdValues, parseOrderBySpecStrict, policyToPostgres, primaryOrderBy, registerConditionOperations, relationalCollections, resolveArrayProperties, resolveCollectionRelations, resolveDataSource, resolveEnumValues, resolveFindWindow, resolveJunctionSpecs, resolvePrimaryKeys, resolveProperties, resolveProperty, resolvePropertyEnum, resolveRelation, resolveRelationProperty, resolveStorageFilenameString, resolveStoragePathString, resolveStorageSource, resolveStringColumnLength, revokeInternalTableAccess, revokeInternalTableSql, sanitizeData, securityRuleToConditions, segmentsToStrippedPath, serializeFilter, serializeLogicalCondition, serializeOrderBy, sortCollectionsBySlug, sortProperties, sqlToPolicy, stripCollectionPath, toFilterTuples, traverseValueProperty, traverseValuesProperties, updateDateAutoValues, wrapAsEntityData, wrapAsSdkData };
 
 //# sourceMappingURL=index.es.js.map