@rebasepro/server-mongo 0.13.0 → 0.13.1-canary.g06dbe5b

package/dist/MongoBootstrapper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MongoBootstrapper.d.ts","sourceRoot":"","sources":["../src/MongoBootstrapper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,KAAK,EACR,mBAAmB,EAQtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AAIpD,MAAM,WAAW,iBAAiB;IAC9B,UAAU,EAAE,EAAE,CAAC;IACf,MAAM,EAAE,WAAW,CAAC;CACvB;AAED,MAAM,WAAW,oBAAoB;IACjC,EAAE,EAAE,EAAE,CAAC;IACP,MAAM,EAAE,WAAW,CAAC;IACpB,QAAQ,EAAE,uBAAuB,CAAC;IAClC,eAAe,EAAE,oBAAoB,CAAC;IACtC,MAAM,EAAE,WAAW,CAAC;CACvB;AAcD,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,iBAAiB,GAAG,mBAAmB,CAyJ3F"}
+{"version":3,"file":"MongoBootstrapper.d.ts","sourceRoot":"","sources":["../src/MongoBootstrapper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,KAAK,EAER,mBAAmB,EAQtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AAIpD,MAAM,WAAW,iBAAiB;IAC9B,UAAU,EAAE,EAAE,CAAC;IACf,MAAM,EAAE,WAAW,CAAC;CACvB;AAED,MAAM,WAAW,oBAAoB;IACjC,EAAE,EAAE,EAAE,CAAC;IACP,MAAM,EAAE,WAAW,CAAC;IACpB,QAAQ,EAAE,uBAAuB,CAAC;IAClC,eAAe,EAAE,oBAAoB,CAAC;IACtC,MAAM,EAAE,WAAW,CAAC;CACvB;AAcD,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,iBAAiB,GAAG,mBAAmB,CAgK3F"}

package/dist/auth/ensure-collections.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ensure-collections.d.ts","sourceRoot":"","sources":["../../src/auth/ensure-collections.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,SAAS,CAAC;AA0C7B,wBAAsB,0BAA0B,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAwCtE"}
+{"version":3,"file":"ensure-collections.d.ts","sourceRoot":"","sources":["../../src/auth/ensure-collections.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,SAAS,CAAC;AAiE7B,wBAAsB,0BAA0B,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAkDtE"}

package/dist/db/MongoConditionBuilder.d.ts

@@ -3,7 +3,7 @@
  *
  * Translates Rebase filter conditions to MongoDB query operators.
  */
-import { CollectionConfig, FilterValues } from "@rebasepro/types";
+import { CollectionConfig, FilterValues, LogicalCondition } from "@rebasepro/types";
 import { Filter, Document } from "mongodb";
 /**
  * MongoDB Condition Builder
@@ -19,6 +19,26 @@ export declare class MongoConditionBuilder {
      * @returns Array of MongoDB filter objects
      */
     static buildFilterConditions<M extends Record<string, any>>(filter: FilterValues<Extract<keyof M, string>>): Filter<Document>[];
+    /**
+     * One field, one operator, one value.
+     *
+     * Extracted so that `logical` groups translate through exactly this code.
+     * A group written as a second dialect is a group where `array-contains` or
+     * `ilike` quietly means something else than it does in `filter`, which is
+     * the kind of difference nobody finds until a query returns the wrong rows.
+     *
+     * Always returns a condition or throws: there is no operator this can be
+     * given that legitimately means "no condition".
+     */
+    private static buildCondition;
+    /**
+     * Translate an `or(...)` / `and(...)` group, nesting included.
+     *
+     * Returns `undefined` for a group with nothing in it. `$or: []` is an error
+     * in Mongo and `$and: []` matches every document, so neither is a
+     * defensible reading of "no conditions".
+     */
+    static buildLogicalConditions(logical: LogicalCondition | undefined): Filter<Document> | undefined;
     /**
      * Build search conditions for text search
      *
@@ -49,6 +69,13 @@ export declare class MongoConditionBuilder {
      */
     static buildQuery<M extends Record<string, any>>(options: {
         filter?: FilterValues<Extract<keyof M, string>>;
+        /**
+         * An `or(...)`/`and(...)` group, AND-ed with `filter` and
+         * `searchString` — the three are independent, as `FindParams`
+         * documents. Absent here until now, so a group that reached this
+         * driver was dropped and the read ran unfiltered.
+         */
+        logical?: LogicalCondition;
         searchString?: string;
         properties?: CollectionConfig["properties"];
     }): Filter<Document>;

package/dist/db/MongoConditionBuilder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MongoConditionBuilder.d.ts","sourceRoot":"","sources":["../../src/db/MongoConditionBuilder.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAiB,MAAM,kBAAkB,CAAC;AACjF,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAsC3C;;;;;GAKG;AACH,qBAAa,qBAAqB;IAC9B;;;;;OAKG;IACH,MAAM,CAAC,qBAAqB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACtD,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,GAC/C,MAAM,CAAC,QAAQ,CAAC,EAAE;IAqDrB;;;;;;OAMG;IACH,MAAM,CAAC,qBAAqB,CACxB,YAAY,EAAE,MAAM,EAKpB,UAAU,EAAE,gBAAgB,CAAC,YAAY,CAAC,GAC3C,MAAM,CAAC,QAAQ,CAAC,EAAE;IAkCrB;;;;;OAKG;IACH,MAAM,CAAC,wBAAwB,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAS;IAM7F;;;;;OAKG;IACH,MAAM,CAAC,uBAAuB,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAS;IAM5F;;;;;OAKG;IACH,MAAM,CAAC,UAAU,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE;QACtD,MAAM,CAAC,EAAE,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAChD,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,UAAU,CAAC,EAAE,gBAAgB,CAAC,YAAY,CAAC,CAAC;KAC/C,GAAG,MAAM,CAAC,QAAQ,CAAC;IA2BpB;;;;;;OAMG;IACH,MAAM,CAAC,SAAS,CACZ,OAAO,CAAC,EAAE,MAAM,EAChB,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,GACvB,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,SAAS;CAIxC"}
+{"version":3,"file":"MongoConditionBuilder.d.ts","sourceRoot":"","sources":["../../src/db/MongoConditionBuilder.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,gBAAgB,EAAmB,YAAY,EAAE,gBAAgB,EAAiB,MAAM,kBAAkB,CAAC;AAEpH,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAkD3C;;;;;GAKG;AACH,qBAAa,qBAAqB;IAC9B;;;;;OAKG;IACH,MAAM,CAAC,qBAAqB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACtD,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,GAC/C,MAAM,CAAC,QAAQ,CAAC,EAAE;IAqBrB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,MAAM,CAAC,cAAc;IAwC7B;;;;;;OAMG;IACH,MAAM,CAAC,sBAAsB,CAAC,OAAO,EAAE,gBAAgB,GAAG,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAS;IAuBlG;;;;;;OAMG;IACH,MAAM,CAAC,qBAAqB,CACxB,YAAY,EAAE,MAAM,EAKpB,UAAU,EAAE,gBAAgB,CAAC,YAAY,CAAC,GAC3C,MAAM,CAAC,QAAQ,CAAC,EAAE;IAkCrB;;;;;OAKG;IACH,MAAM,CAAC,wBAAwB,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAS;IAM7F;;;;;OAKG;IACH,MAAM,CAAC,uBAAuB,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAS;IAM5F;;;;;OAKG;IACH,MAAM,CAAC,UAAU,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE;QACtD,MAAM,CAAC,EAAE,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAChD;;;;;WAKG;QACH,OAAO,CAAC,EAAE,gBAAgB,CAAC;QAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,UAAU,CAAC,EAAE,gBAAgB,CAAC,YAAY,CAAC,CAAC;KAC/C,GAAG,MAAM,CAAC,QAAQ,CAAC;IA8BpB;;;;;;OAMG;IACH,MAAM,CAAC,SAAS,CACZ,OAAO,CAAC,EAAE,MAAM,EAChB,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,GACvB,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,SAAS;CAIxC"}

package/dist/db/MongoDataService.d.ts

@@ -5,7 +5,7 @@
  * Provides all CRUD operations for rows.
  */
 import { Db, Document, Filter } from "mongodb";
-import { FilterValues, DataRepository, CollectionConfig } from "@rebasepro/types";
+import { FilterValues, DataRepository, CollectionConfig, LogicalCondition } from "@rebasepro/types";
 /**
  * MongoDB Row Service
  *
@@ -52,9 +52,12 @@ export declare class MongoDataService implements DataRepository {
      */
     fetchCollection<M extends Record<string, any>>(collectionPath: string, options?: {
         filter?: FilterValues<Extract<keyof M, string>>;
+        /** An `or(...)`/`and(...)` group, AND-ed with `filter`. */
+        logical?: LogicalCondition;
         orderBy?: string;
         order?: "desc" | "asc";
         limit?: number;
+        offset?: number;
         startAfter?: any;
         searchString?: string;
         databaseId?: string;
@@ -78,13 +81,28 @@ export declare class MongoDataService implements DataRepository {
      */
     count<M extends Record<string, any>>(collectionPath: string, options?: {
         filter?: FilterValues<Extract<keyof M, string>>;
+        /** An `or(...)`/`and(...)` group, AND-ed with `filter`. */
+        logical?: LogicalCondition;
+        searchString?: string;
+        collection?: CollectionConfig;
         databaseId?: string;
         rawQuery?: Filter<Document>;
     }): Promise<number>;
     /**
      * Save an row (create or update)
+     *
+     * Returns the **stored** document, not the values that were sent. A partial
+     * update sends only the fields that changed, and returning those was a
+     * partial row everywhere it went: the REST response, `afterSave`, the
+     * history entry a revert restores from, and the row pushed to realtime
+     * subscribers. Postgres returns the whole row here (`RETURNING *`).
      */
     save<M extends Record<string, any>>(collectionPath: string, values: Partial<M>, id?: string | number, _databaseId?: string): Promise<Record<string, unknown>>;
+    /**
+     * Read the document back after a write, falling back to the caller's own
+     * values if it has already been removed by a concurrent delete.
+     */
+    private readBack;
     /**
      * Delete an row by ID
      */

package/dist/db/MongoDataService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MongoDataService.d.ts","sourceRoot":"","sources":["../../src/db/MongoDataService.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,EAAE,EAAwB,QAAQ,EAAe,MAAM,EAAE,MAAM,SAAS,CAAC;AAClF,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAmB,MAAM,kBAAkB,CAAC;AAInG;;;;;GAKG;AACH,qBAAa,gBAAiB,YAAW,cAAc;IACvC,OAAO,CAAC,EAAE;gBAAF,EAAE,EAAE,EAAE;IAE1B;;OAEG;IACH,OAAO,CAAC,aAAa;IAMrB;;OAEG;IACH,OAAO,CAAC,UAAU;IAOlB;;OAEG;IACH,OAAO,CAAC,aAAa;IASrB;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAU9B;;OAEG;IACH,OAAO,CAAC,qBAAqB;IA+C7B;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAU5B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAuC3B;;OAEG;IACG,QAAQ,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACxC,cAAc,EAAE,MAAM,EACtB,EAAE,EAAE,MAAM,GAAG,MAAM,EACnB,WAAW,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;IAW/C;;OAEG;IACG,eAAe,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC/C,cAAc,EAAE,MAAM,EACtB,OAAO,GAAE;QACL,MAAM,CAAC,EAAE,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAChD,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,KAAK,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;QACvB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,UAAU,CAAC,EAAE,GAAG,CAAC;QACjB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,UAAU,CAAC,EAAE,gBAAgB,CAAC;QAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;KAC1B,GACP,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IAkCrC;;OAEG;IACG,UAAU,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1C,cAAc,EAAE,MAAM,EACtB,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE;QACL,MAAM,CAAC,EAAE,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAChD,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,KAAK,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;QACvB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,UAAU,CAAC,EAAE,gBAAgB,CAAC;QAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;KAC1B,GACP,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IAOrC;;OAEG;IACG,KAAK,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACrC,cAAc,EAAE,MAAM,EACtB,OAAO,GAAE;QACL,MAAM,CAAC,EAAE,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAChD,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;KAC1B,GACP,OAAO,CAAC,MAAM,CAAC;IAUlB;;OAEG;IACG,IAAI,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACpC,cAAc,EAAE,MAAM,EACtB,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAClB,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,EACpB,WAAW,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAgCnC;;OAEG;IACG,MAAM,CACR,cAAc,EAAE,MAAM,EACtB,EAAE,EAAE,MAAM,GAAG,MAAM,EACnB,WAAW,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,IAAI,CAAC;IAWhB;;OAEG;IACG,gBAAgB,CAClB,cAAc,EAAE,MAAM,EACtB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,GAAG,EACV,eAAe,CAAC,EAAE,MAAM,EACxB,WAAW,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,OAAO,CAAC;IAcnB;;OAEG;IACH,UAAU,IAAI,MAAM;CAGvB"}
+{"version":3,"file":"MongoDataService.d.ts","sourceRoot":"","sources":["../../src/db/MongoDataService.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,EAAE,EAAwB,QAAQ,EAAe,MAAM,EAAE,MAAM,SAAS,CAAC;AAClF,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAmB,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAIrH;;;;;GAKG;AACH,qBAAa,gBAAiB,YAAW,cAAc;IACvC,OAAO,CAAC,EAAE;gBAAF,EAAE,EAAE,EAAE;IAE1B;;OAEG;IACH,OAAO,CAAC,aAAa;IAMrB;;OAEG;IACH,OAAO,CAAC,UAAU;IAOlB;;OAEG;IACH,OAAO,CAAC,aAAa;IASrB;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAU9B;;OAEG;IACH,OAAO,CAAC,qBAAqB;IA+C7B;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAU5B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAuC3B;;OAEG;IACG,QAAQ,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACxC,cAAc,EAAE,MAAM,EACtB,EAAE,EAAE,MAAM,GAAG,MAAM,EACnB,WAAW,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;IAW/C;;OAEG;IACG,eAAe,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC/C,cAAc,EAAE,MAAM,EACtB,OAAO,GAAE;QACL,MAAM,CAAC,EAAE,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAChD,2DAA2D;QAC3D,OAAO,CAAC,EAAE,gBAAgB,CAAC;QAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,KAAK,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;QACvB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,UAAU,CAAC,EAAE,GAAG,CAAC;QACjB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,UAAU,CAAC,EAAE,gBAAgB,CAAC;QAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;KAC1B,GACP,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IAwCrC;;OAEG;IACG,UAAU,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1C,cAAc,EAAE,MAAM,EACtB,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE;QACL,MAAM,CAAC,EAAE,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAChD,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,KAAK,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;QACvB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,UAAU,CAAC,EAAE,gBAAgB,CAAC;QAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;KAC1B,GACP,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IAOrC;;OAEG;IACG,KAAK,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACrC,cAAc,EAAE,MAAM,EACtB,OAAO,GAAE;QACL,MAAM,CAAC,EAAE,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAChD,2DAA2D;QAC3D,OAAO,CAAC,EAAE,gBAAgB,CAAC;QAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,UAAU,CAAC,EAAE,gBAAgB,CAAC;QAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;KAC1B,GACP,OAAO,CAAC,MAAM,CAAC;IAgBlB;;;;;;;;OAQG;IACG,IAAI,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACpC,cAAc,EAAE,MAAM,EACtB,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAClB,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,EACpB,WAAW,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IA+BnC;;;OAGG;YACW,QAAQ;IAStB;;OAEG;IACG,MAAM,CACR,cAAc,EAAE,MAAM,EACtB,EAAE,EAAE,MAAM,GAAG,MAAM,EACnB,WAAW,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,IAAI,CAAC;IAWhB;;OAEG;IACG,gBAAgB,CAClB,cAAc,EAAE,MAAM,EACtB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,GAAG,EACV,eAAe,CAAC,EAAE,MAAM,EACxB,WAAW,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,OAAO,CAAC;IAcnB;;OAEG;IACH,UAAU,IAAI,MAAM;CAGvB"}

package/dist/db/securityRuleFilter.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Row security for MongoDB.
+ *
+ * MongoDB has no RLS, so this driver enforces `securityRules` in-process. That
+ * makes the translation from a rule to a query the enforcement boundary, and it
+ * has exactly one safe failure mode: refuse.
+ *
+ * Two properties this file exists to hold:
+ *
+ * 1. **One predicate, one implementation.** The rules are compiled through the
+ *    same {@link securityRuleToConditions} the Postgres DDL generator and the
+ *    admin UI's `checkOperation` use, so "what does this rule mean" is answered
+ *    in one place. The previous translator re-parsed the raw SQL itself and
+ *    recognised four shapes — a second, smaller parser that disagreed with the
+ *    first about the same rule.
+ * 2. **Fail closed, out loud.** An expression with no MongoDB equivalent (raw
+ *    SQL, a membership subquery, a negated row predicate) used to become `{}` —
+ *    "match every document". It now raises {@link SECURITY_RULE_UNSUPPORTED},
+ *    the same shape the REST layer uses to refuse bulk writes this driver
+ *    cannot perform: a request that cannot be authorized is not served.
+ */
+import { Document, Filter } from "mongodb";
+import { CollectionConfig, PolicyExpression, SecurityOperation, User } from "@rebasepro/types";
+import { ApiError } from "@rebasepro/server";
+/** The expression has no MongoDB equivalent — the caller must refuse. */
+declare const UNTRANSLATABLE: "untranslatable";
+type TranslationResult = Filter<Document> | typeof UNTRANSLATABLE;
+/** The error code a caller sees when a rule cannot be honoured. */
+export declare const SECURITY_RULE_UNSUPPORTED = "SECURITY_RULE_UNSUPPORTED";
+/**
+ * The refusal. Names the collection, the clause and the expression, because the
+ * only useful thing an operator can do with this is rewrite that rule — or move
+ * the collection to an engine that can enforce it.
+ */
+export declare function securityRuleUnsupported(collectionSlug: string, clause: "using" | "withCheck", detail: string): ApiError;
+/**
+ * Translate one {@link PolicyExpression} into a MongoDB filter, or
+ * {@link UNTRANSLATABLE}.
+ *
+ * The JavaScript twin of `evaluatePolicy`, one level up: where that decides a
+ * single row, this narrows a query. `"unknown"` there and `UNTRANSLATABLE` here
+ * are the same condition, and both are resolved fail-closed by their callers.
+ */
+export declare function policyToMongoFilter(expr: PolicyExpression, user: User | undefined): TranslationResult;
+/**
+ * Refuse up front when this collection's rules cannot be enforced for
+ * `targetOperation`.
+ *
+ * The row-in-hand paths (`fetchOne`, `save`, `delete`) resolve an undecidable
+ * rule through `checkOperation`'s `onUnknown: "deny"`, which is safe but
+ * indistinguishable from a plain "you may not do that". Calling this first
+ * turns the same condition into the refusal an operator can act on.
+ */
+export declare function assertSecurityRulesEnforceable(collection: CollectionConfig | undefined, targetOperation: SecurityOperation): void;
+/**
+ * Build the MongoDB filter that narrows a query to the rows `user` may see
+ * under `collection`'s security rules.
+ *
+ * Returns `null` when no row can qualify (the caller answers with an empty
+ * result), `{}` when the rules impose no narrowing, and throws
+ * {@link SECURITY_RULE_UNSUPPORTED} when a rule cannot be translated.
+ */
+export declare function buildMongoFilterFromSecurityRules<M extends Record<string, any>>(collection: CollectionConfig<M> | undefined, user: User | undefined, targetOperation: SecurityOperation): Filter<Document> | null;
+export {};
+//# sourceMappingURL=securityRuleFilter.d.ts.map

package/dist/db/securityRuleFilter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"securityRuleFilter.d.ts","sourceRoot":"","sources":["../../src/db/securityRuleFilter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,EAEH,gBAAgB,EAChB,gBAAgB,EAEhB,iBAAiB,EAEjB,IAAI,EAEP,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAY7C,yEAAyE;AACzE,QAAA,MAAM,cAAc,EAAG,gBAAyB,CAAC;AAEjD,KAAK,iBAAiB,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,OAAO,cAAc,CAAC;AAUlE,mEAAmE;AACnE,eAAO,MAAM,yBAAyB,8BAA8B,CAAC;AAErE;;;;GAIG;AACH,wBAAgB,uBAAuB,CACnC,cAAc,EAAE,MAAM,EACtB,MAAM,EAAE,OAAO,GAAG,WAAW,EAC7B,MAAM,EAAE,MAAM,GACf,QAAQ,CAQV;AAoHD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,IAAI,GAAG,SAAS,GAAG,iBAAiB,CAuErG;AA2BD;;;;;;;;GAQG;AACH,wBAAgB,8BAA8B,CAC1C,UAAU,EAAE,gBAAgB,GAAG,SAAS,EACxC,eAAe,EAAE,iBAAiB,GACnC,IAAI,CAiBN;AAED;;;;;;;GAOG;AACH,wBAAgB,iCAAiC,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3E,UAAU,EAAE,gBAAgB,CAAC,CAAC,CAAC,GAAG,SAAS,EAC3C,IAAI,EAAE,IAAI,GAAG,SAAS,EACtB,eAAe,EAAE,iBAAiB,GACnC,MAAM,CAAC,QAAQ,CAAC,GAAG,IAAI,CAqDzB"}

package/dist/ensure-collections-Bl12bSwO.js

@@ -0,0 +1,130 @@
+import { logger } from "@rebasepro/server";
+//#region src/auth/ensure-collections.ts
+/**
+* Default roles to seed on first run
+*/
+var DEFAULT_ROLES = [
+	{
+		_id: "admin",
+		id: "admin",
+		name: "Admin",
+		isAdmin: true,
+		defaultPermissions: {
+			read: true,
+			create: true,
+			edit: true,
+			delete: true
+		},
+		createdAt: /* @__PURE__ */ new Date()
+	},
+	{
+		_id: "editor",
+		id: "editor",
+		name: "Editor",
+		isAdmin: false,
+		defaultPermissions: {
+			read: true,
+			create: true,
+			edit: true,
+			delete: true
+		},
+		createdAt: /* @__PURE__ */ new Date()
+	},
+	{
+		_id: "viewer",
+		id: "viewer",
+		name: "Viewer",
+		isAdmin: false,
+		defaultPermissions: {
+			read: true,
+			create: false,
+			edit: false,
+			delete: false
+		},
+		createdAt: /* @__PURE__ */ new Date()
+	}
+];
+/**
+* Indexes created by releases up to 0.13.0, on snake_case field names the auth
+* services never wrote.
+*
+* MongoDB indexes an absent field as `null`, so a unique index whose every key
+* component is always missing admits exactly **one** document per collection:
+* the second login on the whole deployment failed with `E11000`, as did the
+* second role assignment and the second outstanding password-reset token.
+* Dropping them is therefore part of the fix, not tidying — creating the
+* correct index alongside a broken one leaves the deployment just as broken.
+*
+* `{user_id, user_agent, ip_address}` has a second reason to go: it is the
+* reverted Postgres constraint. `MongoRefreshTokenService.createToken` explains
+* why evicting by that triple signs a second browser out; the unique index
+* expressing the same rule was left behind here.
+*/
+var LEGACY_INDEX_NAMES = {
+	rebase_user_identities: ["provider_1_provider_id_1", "user_id_1"],
+	rebase_user_roles: ["user_id_1_role_id_1", "user_id_1"],
+	rebase_refresh_tokens: [
+		"token_hash_1",
+		"user_id_1_user_agent_1_ip_address_1",
+		"user_id_1"
+	],
+	rebase_password_reset_tokens: ["token_hash_1", "user_id_1"]
+};
+async function ensureAuthCollectionsExist(db) {
+	logger.info("🔍 Checking MongoDB auth collections and indexes...");
+	try {
+		await dropLegacyIndexes(db);
+		const users = db.collection("rebase_users");
+		await users.createIndex({ email: 1 }, { unique: true });
+		await users.createIndex({ id: 1 });
+		const identities = db.collection("rebase_user_identities");
+		await identities.createIndex({
+			provider: 1,
+			providerId: 1
+		}, { unique: true });
+		await identities.createIndex({ uid: 1 });
+		const userRoles = db.collection("rebase_user_roles");
+		await userRoles.createIndex({
+			uid: 1,
+			roleId: 1
+		}, { unique: true });
+		await userRoles.createIndex({ roleId: 1 });
+		const refreshTokens = db.collection("rebase_refresh_tokens");
+		await refreshTokens.createIndex({ tokenHash: 1 }, { unique: true });
+		await refreshTokens.createIndex({ uid: 1 });
+		await refreshTokens.createIndex({ sessionId: 1 });
+		const resetTokens = db.collection("rebase_password_reset_tokens");
+		await resetTokens.createIndex({ tokenHash: 1 }, { unique: true });
+		await resetTokens.createIndex({ uid: 1 });
+		await seedDefaultRoles(db);
+		logger.info("✅ MongoDB Auth collections ready");
+	} catch (error) {
+		logger.error("❌ Failed to set up MongoDB auth collections", { error });
+		throw error;
+	}
+}
+/** Drop the indexes of {@link LEGACY_INDEX_NAMES} that this database still has. */
+async function dropLegacyIndexes(db) {
+	for (const [collectionName, indexNames] of Object.entries(LEGACY_INDEX_NAMES)) {
+		const collection = db.collection(collectionName);
+		for (const indexName of indexNames) try {
+			await collection.dropIndex(indexName);
+			logger.info(`🧹 Dropped stale auth index ${collectionName}.${indexName}`);
+		} catch {}
+	}
+}
+async function seedDefaultRoles(db) {
+	const roles = db.collection("rebase_roles");
+	const count = await roles.countDocuments();
+	if (count > 0) {
+		logger.info(`📋 Found ${count} existing roles`);
+		return;
+	}
+	logger.info("🌱 Seeding default roles...");
+	for (const role of DEFAULT_ROLES) await roles.updateOne({ id: role.id }, { $setOnInsert: role }, { upsert: true });
+	logger.info("✅ Default roles created: admin, editor, viewer");
+}
+//#endregion
+export { ensureAuthCollectionsExist };
+
+//# sourceMappingURL=ensure-collections-Bl12bSwO.js.map

package/dist/ensure-collections-Bl12bSwO.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ensure-collections-Bl12bSwO.js","names":[],"sources":["../src/auth/ensure-collections.ts"],"sourcesContent":["import { Db } from \"mongodb\";\nimport { logger } from \"@rebasepro/server\";\n\n/**\n * Default roles to seed on first run\n */\nconst DEFAULT_ROLES = [\n    {\n        _id: \"admin\",\n        id: \"admin\",\n        name: \"Admin\",\n        isAdmin: true,\n        defaultPermissions: { read: true,\ncreate: true,\nedit: true,\ndelete: true },\n        createdAt: new Date()\n    },\n    {\n        _id: \"editor\",\n        id: \"editor\",\n        name: \"Editor\",\n        isAdmin: false,\n        defaultPermissions: { read: true,\ncreate: true,\nedit: true,\ndelete: true },\n        createdAt: new Date()\n    },\n    {\n        _id: \"viewer\",\n        id: \"viewer\",\n        name: \"Viewer\",\n        isAdmin: false,\n        defaultPermissions: { read: true,\ncreate: false,\nedit: false,\ndelete: false },\n        createdAt: new Date()\n    }\n];\n\n/**\n * Indexes created by releases up to 0.13.0, on snake_case field names the auth\n * services never wrote.\n *\n * MongoDB indexes an absent field as `null`, so a unique index whose every key\n * component is always missing admits exactly **one** document per collection:\n * the second login on the whole deployment failed with `E11000`, as did the\n * second role assignment and the second outstanding password-reset token.\n * Dropping them is therefore part of the fix, not tidying — creating the\n * correct index alongside a broken one leaves the deployment just as broken.\n *\n * `{user_id, user_agent, ip_address}` has a second reason to go: it is the\n * reverted Postgres constraint. `MongoRefreshTokenService.createToken` explains\n * why evicting by that triple signs a second browser out; the unique index\n * expressing the same rule was left behind here.\n */\nconst LEGACY_INDEX_NAMES: Record<string, string[]> = {\n    rebase_user_identities: [\"provider_1_provider_id_1\", \"user_id_1\"],\n    rebase_user_roles: [\"user_id_1_role_id_1\", \"user_id_1\"],\n    rebase_refresh_tokens: [\"token_hash_1\", \"user_id_1_user_agent_1_ip_address_1\", \"user_id_1\"],\n    rebase_password_reset_tokens: [\"token_hash_1\", \"user_id_1\"]\n};\n\nexport async function ensureAuthCollectionsExist(db: Db): Promise<void> {\n    logger.info(\"🔍 Checking MongoDB auth collections and indexes...\");\n\n    try {\n        await dropLegacyIndexes(db);\n\n        // Every key below is a field `auth/services.ts` actually writes —\n        // camelCase, matching the documents. Verified by\n        // `test/MongoAuthServices.test.ts`, which now runs this function.\n\n        // Users\n        const users = db.collection(\"rebase_users\");\n        await users.createIndex({ email: 1 }, { unique: true });\n        await users.createIndex({ id: 1 });\n\n        // User Identities\n        const identities = db.collection(\"rebase_user_identities\");\n        await identities.createIndex({ provider: 1,\nproviderId: 1 }, { unique: true });\n        await identities.createIndex({ uid: 1 });\n\n        // User Roles (junction collection)\n        const userRoles = db.collection(\"rebase_user_roles\");\n        await userRoles.createIndex({ uid: 1,\nroleId: 1 }, { unique: true });\n        await userRoles.createIndex({ roleId: 1 });\n\n        // Refresh Tokens. No unique index on (uid, userAgent, ipAddress):\n        // tokens of one sign-in accumulate under a shared sessionId.\n        const refreshTokens = db.collection(\"rebase_refresh_tokens\");\n        await refreshTokens.createIndex({ tokenHash: 1 }, { unique: true });\n        await refreshTokens.createIndex({ uid: 1 });\n        await refreshTokens.createIndex({ sessionId: 1 });\n\n        // Password Reset Tokens\n        const resetTokens = db.collection(\"rebase_password_reset_tokens\");\n        await resetTokens.createIndex({ tokenHash: 1 }, { unique: true });\n        await resetTokens.createIndex({ uid: 1 });\n\n        // Seed roles\n        await seedDefaultRoles(db);\n\n        logger.info(\"✅ MongoDB Auth collections ready\");\n    } catch (error) {\n        // Not swallowed. Every index here is load-bearing for auth — a boot\n        // that logs this and carries on is a deployment whose second login\n        // fails, with a green boot log to say nothing is wrong.\n        logger.error(\"❌ Failed to set up MongoDB auth collections\", { error: error });\n        throw error;\n    }\n}\n\n/** Drop the indexes of {@link LEGACY_INDEX_NAMES} that this database still has. */\nasync function dropLegacyIndexes(db: Db): Promise<void> {\n    for (const [collectionName, indexNames] of Object.entries(LEGACY_INDEX_NAMES)) {\n        const collection = db.collection(collectionName);\n        for (const indexName of indexNames) {\n            try {\n                await collection.dropIndex(indexName);\n                logger.info(`🧹 Dropped stale auth index ${collectionName}.${indexName}`);\n            } catch {\n                // NamespaceNotFound / IndexNotFound — nothing to drop here.\n            }\n        }\n    }\n}\n\nasync function seedDefaultRoles(db: Db): Promise<void> {\n    const roles = db.collection(\"rebase_roles\");\n    const count = await roles.countDocuments();\n\n    if (count > 0) {\n        logger.info(`📋 Found ${count} existing roles`);\n        return;\n    }\n\n    logger.info(\"🌱 Seeding default roles...\");\n\n    for (const role of DEFAULT_ROLES) {\n        await roles.updateOne(\n            { id: role.id },\n            { $setOnInsert: role },\n            { upsert: true }\n        );\n    }\n\n    logger.info(\"✅ Default roles created: admin, editor, viewer\");\n}\n"],"mappings":";;;;;AAMA,IAAM,gBAAgB;CAClB;EACI,KAAK;EACL,IAAI;EACJ,MAAM;EACN,SAAS;EACT,oBAAoB;GAAE,MAAM;GACpC,QAAQ;GACR,MAAM;GACN,QAAQ;EAAK;EACL,2BAAW,IAAI,KAAK;CACxB;CACA;EACI,KAAK;EACL,IAAI;EACJ,MAAM;EACN,SAAS;EACT,oBAAoB;GAAE,MAAM;GACpC,QAAQ;GACR,MAAM;GACN,QAAQ;EAAK;EACL,2BAAW,IAAI,KAAK;CACxB;CACA;EACI,KAAK;EACL,IAAI;EACJ,MAAM;EACN,SAAS;EACT,oBAAoB;GAAE,MAAM;GACpC,QAAQ;GACR,MAAM;GACN,QAAQ;EAAM;EACN,2BAAW,IAAI,KAAK;CACxB;AACJ;;;;;;;;;;;;;;;;;AAkBA,IAAM,qBAA+C;CACjD,wBAAwB,CAAC,4BAA4B,WAAW;CAChE,mBAAmB,CAAC,uBAAuB,WAAW;CACtD,uBAAuB;EAAC;EAAgB;EAAuC;CAAW;CAC1F,8BAA8B,CAAC,gBAAgB,WAAW;AAC9D;AAEA,eAAsB,2BAA2B,IAAuB;CACpE,OAAO,KAAK,qDAAqD;CAEjE,IAAI;EACA,MAAM,kBAAkB,EAAE;EAO1B,MAAM,QAAQ,GAAG,WAAW,cAAc;EAC1C,MAAM,MAAM,YAAY,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,KAAK,CAAC;EACtD,MAAM,MAAM,YAAY,EAAE,IAAI,EAAE,CAAC;EAGjC,MAAM,aAAa,GAAG,WAAW,wBAAwB;EACzD,MAAM,WAAW,YAAY;GAAE,UAAU;GACjD,YAAY;EAAE,GAAG,EAAE,QAAQ,KAAK,CAAC;EACzB,MAAM,WAAW,YAAY,EAAE,KAAK,EAAE,CAAC;EAGvC,MAAM,YAAY,GAAG,WAAW,mBAAmB;EACnD,MAAM,UAAU,YAAY;GAAE,KAAK;GAC3C,QAAQ;EAAE,GAAG,EAAE,QAAQ,KAAK,CAAC;EACrB,MAAM,UAAU,YAAY,EAAE,QAAQ,EAAE,CAAC;EAIzC,MAAM,gBAAgB,GAAG,WAAW,uBAAuB;EAC3D,MAAM,cAAc,YAAY,EAAE,WAAW,EAAE,GAAG,EAAE,QAAQ,KAAK,CAAC;EAClE,MAAM,cAAc,YAAY,EAAE,KAAK,EAAE,CAAC;EAC1C,MAAM,cAAc,YAAY,EAAE,WAAW,EAAE,CAAC;EAGhD,MAAM,cAAc,GAAG,WAAW,8BAA8B;EAChE,MAAM,YAAY,YAAY,EAAE,WAAW,EAAE,GAAG,EAAE,QAAQ,KAAK,CAAC;EAChE,MAAM,YAAY,YAAY,EAAE,KAAK,EAAE,CAAC;EAGxC,MAAM,iBAAiB,EAAE;EAEzB,OAAO,KAAK,kCAAkC;CAClD,SAAS,OAAO;EAIZ,OAAO,MAAM,+CAA+C,EAAS,MAAM,CAAC;EAC5E,MAAM;CACV;AACJ;;AAGA,eAAe,kBAAkB,IAAuB;CACpD,KAAK,MAAM,CAAC,gBAAgB,eAAe,OAAO,QAAQ,kBAAkB,GAAG;EAC3E,MAAM,aAAa,GAAG,WAAW,cAAc;EAC/C,KAAK,MAAM,aAAa,YACpB,IAAI;GACA,MAAM,WAAW,UAAU,SAAS;GACpC,OAAO,KAAK,+BAA+B,eAAe,GAAG,WAAW;EAC5E,QAAQ,CAER;CAER;AACJ;AAEA,eAAe,iBAAiB,IAAuB;CACnD,MAAM,QAAQ,GAAG,WAAW,cAAc;CAC1C,MAAM,QAAQ,MAAM,MAAM,eAAe;CAEzC,IAAI,QAAQ,GAAG;EACX,OAAO,KAAK,YAAY,MAAM,gBAAgB;EAC9C;CACJ;CAEA,OAAO,KAAK,6BAA6B;CAEzC,KAAK,MAAM,QAAQ,eACf,MAAM,MAAM,UACR,EAAE,IAAI,KAAK,GAAG,GACd,EAAE,cAAc,KAAK,GACrB,EAAE,QAAQ,KAAK,CACnB;CAGJ,OAAO,KAAK,gDAAgD;AAChE"}

package/dist/factory.d.ts

@@ -46,10 +46,20 @@ export interface MongoBackendInstance extends BackendInstance {
  * Simple in-memory collection registry for MongoDB.
  */
 export declare class MongoCollectionRegistry implements CollectionRegistryInterface {
+    /** Every addressable key → collection. See {@link register}. */
     private collections;
+    /** Registration order, so `getCollections()` returns each collection once. */
+    private registered;
     private _globalCallbacks?;
     /**
-     * Register a collection
+     * Register a collection under every name it can be addressed by.
+     *
+     * A Mongo collection has up to three: `slug` (the routing key), `path` (the
+     * MongoDB collection-name override, which is what `getCollectionDataPath`
+     * hands the driver) and `name` (the human label). Registering only `name`
+     * meant every `getCollectionByPath` lookup missed — and the realtime path,
+     * whose only source of the collection is this registry, ran with no
+     * `securityRules`, no `properties` and no callbacks.
      */
     register(collection: CollectionConfig): void;
     /**

package/dist/factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"factory.d.ts","sourceRoot":"","sources":["../src/factory.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEhE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAE7F,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,2BAA2B,EAAE,cAAc,EAAwC,aAAa,EAAiD,MAAM,kBAAkB,CAAC;AAEnN;;GAEG;AACH,MAAM,WAAW,kBAAmB,SAAQ,aAAa;IACrD,IAAI,EAAE,SAAS,CAAC;IAChB,gCAAgC;IAChC,UAAU,EAAE,EAAE,CAAC;IACf,iDAAiD;IACjD,MAAM,EAAE,WAAW,CAAC;IACpB,kEAAkE;IAClE,WAAW,CAAC,EAAE,gBAAgB,EAAE,CAAC;IACjC,sCAAsC;IACtC,gBAAgB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;CACtD;AAED;;GAEG;AACH,MAAM,WAAW,oBAAqB,SAAQ,eAAe;IACzD,oCAAoC;IACpC,EAAE,EAAE,EAAE,CAAC;IACP,yBAAyB;IACzB,MAAM,EAAE,WAAW,CAAC;IACpB,6CAA6C;IAC7C,MAAM,EAAE,UAAU,CAAC;IACnB,oDAAoD;IACpD,WAAW,EAAE,gBAAgB,CAAC;IAC9B,yCAAyC;IACzC,eAAe,EAAE,oBAAoB,CAAC;IACtC,uDAAuD;IACvD,KAAK,EAAE,aAAa,CAAC;CACxB;AAMD;;GAEG;AACH,qBAAa,uBAAwB,YAAW,2BAA2B;IACvE,OAAO,CAAC,WAAW,CAAuC;IAC1D,OAAO,CAAC,gBAAgB,CAAC,CAAM;IAE/B;;OAEG;IACH,QAAQ,CAAC,UAAU,EAAE,gBAAgB,GAAG,IAAI;IAI5C;;OAEG;IACH,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS;IAI/D;;OAEG;IACH,cAAc,IAAI,gBAAgB,EAAE;IAIpC;;OAEG;IACH,kBAAkB,IAAI,GAAG,GAAG,SAAS;IAIrC;;OAEG;IACH,kBAAkB,CAAC,SAAS,EAAE,GAAG,GAAG,IAAI;CAG3C;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,kBAAkB,GAAG,oBAAoB,CAgGnF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAC/B,EAAE,EAAE,EAAE,EACN,eAAe,CAAC,EAAE,oBAAoB,EACtC,cAAc,CAAC,EAAE,mBAAmB,EACpC,QAAQ,CAAC,EAAE,2BAA2B,GACvC,WAAW,CAIb;AAED;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CAAC,EAAE,EAAE,EAAE,GAAG,oBAAoB,CAEvE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CAAC,EAAE,EAAE,EAAE,GAAG,cAAc,CAElE;AAMD;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,IAAI,kBAAkB,CAIxF;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,UAAU,EAAE,EAAE,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,CAOjH"}
+{"version":3,"file":"factory.d.ts","sourceRoot":"","sources":["../src/factory.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAyB,MAAM,kBAAkB,CAAC;AAEvF,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAE7F,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,2BAA2B,EAAE,cAAc,EAAwC,aAAa,EAAiD,MAAM,kBAAkB,CAAC;AAEnN;;GAEG;AACH,MAAM,WAAW,kBAAmB,SAAQ,aAAa;IACrD,IAAI,EAAE,SAAS,CAAC;IAChB,gCAAgC;IAChC,UAAU,EAAE,EAAE,CAAC;IACf,iDAAiD;IACjD,MAAM,EAAE,WAAW,CAAC;IACpB,kEAAkE;IAClE,WAAW,CAAC,EAAE,gBAAgB,EAAE,CAAC;IACjC,sCAAsC;IACtC,gBAAgB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;CACtD;AAED;;GAEG;AACH,MAAM,WAAW,oBAAqB,SAAQ,eAAe;IACzD,oCAAoC;IACpC,EAAE,EAAE,EAAE,CAAC;IACP,yBAAyB;IACzB,MAAM,EAAE,WAAW,CAAC;IACpB,6CAA6C;IAC7C,MAAM,EAAE,UAAU,CAAC;IACnB,oDAAoD;IACpD,WAAW,EAAE,gBAAgB,CAAC;IAC9B,yCAAyC;IACzC,eAAe,EAAE,oBAAoB,CAAC;IACtC,uDAAuD;IACvD,KAAK,EAAE,aAAa,CAAC;CACxB;AAMD;;GAEG;AACH,qBAAa,uBAAwB,YAAW,2BAA2B;IACvE,gEAAgE;IAChE,OAAO,CAAC,WAAW,CAAuC;IAC1D,8EAA8E;IAC9E,OAAO,CAAC,UAAU,CAA0B;IAC5C,OAAO,CAAC,gBAAgB,CAAC,CAAM;IAE/B;;;;;;;;;OASG;IACH,QAAQ,CAAC,UAAU,EAAE,gBAAgB,GAAG,IAAI;IAO5C;;OAEG;IACH,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS;IAI/D;;OAEG;IACH,cAAc,IAAI,gBAAgB,EAAE;IAIpC;;OAEG;IACH,kBAAkB,IAAI,GAAG,GAAG,SAAS;IAIrC;;OAEG;IACH,kBAAkB,CAAC,SAAS,EAAE,GAAG,GAAG,IAAI;CAG3C;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,kBAAkB,GAAG,oBAAoB,CAgGnF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAC/B,EAAE,EAAE,EAAE,EACN,eAAe,CAAC,EAAE,oBAAoB,EACtC,cAAc,CAAC,EAAE,mBAAmB,EACpC,QAAQ,CAAC,EAAE,2BAA2B,GACvC,WAAW,CAIb;AAED;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CAAC,EAAE,EAAE,EAAE,GAAG,oBAAoB,CAEvE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CAAC,EAAE,EAAE,EAAE,GAAG,cAAc,CAElE;AAMD;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,IAAI,kBAAkB,CAIxF;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,UAAU,EAAE,EAAE,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,CAOjH"}