@rebasepro/server-postgres 0.13.1-canary.gcd6689e → 0.13.1-canary.gef9608c

package/dist/schema/ensure-collection-tables.d.ts

@@ -107,7 +107,7 @@ export interface EnsureOutcome extends EnsurePlan {
  * that reference them, tables before the columns added to other tables (a new
  * table may be the target of a relation), and nothing is emitted twice.
  */
-export declare function planCollectionSchemaEnsure(collections: CollectionConfig[], existing: ExistingSchema): EnsurePlan;
+export declare function planCollectionSchemaEnsure(allCollections: CollectionConfig[], existing: ExistingSchema): EnsurePlan;
 /** Read what the database has, for the schemas the collections live in. */
 export declare function readExistingSchema(client: Queryable, schemas: string[]): Promise<ExistingSchema>;
 /**

package/dist/schema/generate-drizzle-schema-logic.d.ts

@@ -1,2 +1,2 @@
 import { CollectionConfig } from "@rebasepro/types";
-export declare const generateSchema: (collections: CollectionConfig[], stripPolicies?: boolean) => Promise<string>;
+export declare const generateSchema: (allCollections: CollectionConfig[], stripPolicies?: boolean) => Promise<string>;

package/dist/schema/generate-postgres-ddl-logic.d.ts

@@ -29,7 +29,7 @@ export declare const generatePolicyStatements: (collection: CollectionConfig, ru
  */
 export declare const quoteSqlLiteral: (value: string) => string;
 export declare const getSqlColumnType: (propName: string, prop: Property, collection: CollectionConfig, collections: CollectionConfig[]) => string;
-export declare const generatePostgresDdl: (collections: CollectionConfig[], options?: {
+export declare const generatePostgresDdl: (allCollections: CollectionConfig[], options?: {
     includePolicies?: boolean;
 }) => Promise<string>;
 /** The RLS statements one declared collection's table needs, ready to run. */
@@ -100,7 +100,7 @@ export interface JunctionTablePlan {
  * is unknown yields the column without a constraint. Both mirror the generator
  * exactly — a divergence here is a schema fork between boot and `db push`.
  */
-export declare const planRelationalColumns: (collections: CollectionConfig[]) => RelationalColumnPlan[];
+export declare const planRelationalColumns: (allCollections: CollectionConfig[]) => RelationalColumnPlan[];
 /**
  * The junction tables a bundle's many-to-many relations imply.
  *
@@ -109,7 +109,7 @@ export declare const planRelationalColumns: (collections: CollectionConfig[]) =>
  * junction with row-level security left off is readable and writable by every
  * signed-in user, which is why the two must ship together.
  */
-export declare const planJunctionTables: (collections: CollectionConfig[]) => JunctionTablePlan[];
+export declare const planJunctionTables: (allCollections: CollectionConfig[]) => JunctionTablePlan[];
 export interface CollectionPolicyPlan {
     /** The table's schema (e.g. `public`, `rebase`). */
     schema: string;
@@ -137,6 +137,6 @@ export interface CollectionPolicyPlan {
  * writable by every signed-in user. A junction whose table is still absent is
  * skipped by the applier, not planned away here.
  */
-export declare const planCollectionPolicies: (collections: CollectionConfig[]) => CollectionPolicyPlan[];
-export declare const generatePostgresPoliciesDdl: (collections: CollectionConfig[]) => string;
+export declare const planCollectionPolicies: (allCollections: CollectionConfig[]) => CollectionPolicyPlan[];
+export declare const generatePostgresPoliciesDdl: (allCollections: CollectionConfig[]) => string;
 export {};

package/dist/services/FetchService.d.ts

@@ -153,6 +153,16 @@ export declare class FetchService {
      */
     fetchCollection<M extends Record<string, unknown>>(collectionPath: string, options?: {
         filter?: FilterValues<Extract<keyof M, string>>;
+        /**
+         * An `or(...)`/`and(...)` group, applied alongside `filter`.
+         *
+         * `fetchRowsWithConditions` below has always applied this; it was
+         * simply absent from this signature, so the only callers that could
+         * pass one were the ones that went around this method. Realtime
+         * came through here, which is why a subscription filtered by a
+         * logical group was pushed every row in the table.
+         */
+        logical?: LogicalCondition;
         orderBy?: string;
         order?: "desc" | "asc";
         limit?: number;

package/dist/services/dataService.d.ts

@@ -36,6 +36,8 @@ export declare class DataService implements DataRepository {
      */
     fetchCollection<M extends Record<string, unknown>>(collectionPath: string, options?: {
         filter?: FilterValues<Extract<keyof M, string>>;
+        /** An `or(...)`/`and(...)` group, applied alongside `filter`. */
+        logical?: LogicalCondition;
         orderBy?: string;
         order?: "desc" | "asc";
         limit?: number;

package/dist/services/realtimeService.d.ts

@@ -1,6 +1,6 @@
 import { WebSocket } from "ws";
 import { EventEmitter } from "events";
-import { DataDriver, WebSocketMessage } from "@rebasepro/types";
+import { DataDriver, WebSocketMessage, LogicalCondition } from "@rebasepro/types";
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
 import { RealtimeProvider, CollectionSubscriptionConfig, SingleSubscriptionConfig } from "../interfaces";
 import { PostgresCollectionRegistry } from "../collections/PostgresCollectionRegistry";
@@ -14,6 +14,27 @@ export interface SubscriptionAuthContext {
     uid: string;
     roles: string[];
 }
+/**
+ * The narrowing a collection subscription was created with, kept so that every
+ * refetch answers the same query the initial fetch did.
+ *
+ * Named once because it used to be written out inline in five places, and a
+ * field missing from one of them is accepted over the wire and then silently
+ * ignored: `offset` was declared on the incoming props and never stored, so a
+ * live list on page three served page one, and `logical` was never stored
+ * either, so an `or(...)` subscription was pushed every row in the table.
+ */
+type StoredCollectionRequest = {
+    filter?: Record<string, unknown>;
+    logical?: LogicalCondition;
+    orderBy?: string;
+    order?: "desc" | "asc";
+    limit?: number;
+    offset?: number;
+    startAfter?: Record<string, unknown>;
+    databaseId?: string;
+    searchString?: string;
+};
 /**
  * PostgreSQL-specific realtime service.
  * Handles WebSocket connections and subscriptions for real-time row updates.
@@ -128,16 +149,7 @@ export declare class RealtimeService extends EventEmitter implements RealtimePro
         type: "collection" | "single";
         path: string;
         id?: string | number;
-        collectionRequest?: {
-            filter?: Record<string, unknown>;
-            orderBy?: string;
-            order?: "desc" | "asc";
-            limit?: number;
-            offset?: number;
-            startAfter?: Record<string, unknown>;
-            databaseId?: string;
-            searchString?: string;
-        };
+        collectionRequest?: StoredCollectionRequest;
         authContext?: SubscriptionAuthContext;
     }>;
     registerDataDriverSubscription(subscriptionId: string, subscription: {
@@ -145,16 +157,7 @@ export declare class RealtimeService extends EventEmitter implements RealtimePro
         type: "collection" | "single";
         path: string;
         id?: string | number;
-        collectionRequest?: {
-            filter?: Record<string, unknown>;
-            orderBy?: string;
-            order?: "desc" | "asc";
-            limit?: number;
-            offset?: number;
-            startAfter?: Record<string, unknown>;
-            databaseId?: string;
-            searchString?: string;
-        };
+        collectionRequest?: StoredCollectionRequest;
         authContext?: SubscriptionAuthContext;
     }): void;
     addSubscriptionCallback(subscriptionId: string, callback: (data: Record<string, unknown>[] | Record<string, unknown> | null) => void): void;
@@ -497,3 +500,4 @@ export declare class RealtimeService extends EventEmitter implements RealtimePro
  * This allows code to use PostgresRealtimeProvider alongside future MongoRealtimeProvider, etc.
  */
 export declare const PostgresRealtimeProvider: typeof RealtimeService;
+export {};

package/dist/{src-DlPBctw_.js → src-CU6WZGYV.js}

@@ -55,6 +55,25 @@ function hasForeignKeyOnTarget(relation) {
 function isManyToMany(relation) {
 	return relation.kind === "manyToMany";
 }
+/**
+* Resolve a client-supplied list `limit` into a safe, always-defined value.
+*
+* - A provided limit is coerced to an integer and clamped to `[1, maxLimit]`,
+*   so `0`, negatives, and absurd values can never bypass the cap.
+* - An absent / blank / non-numeric limit falls back to the mode default:
+*   `vectorDefaultLimit` for a vector search, otherwise `defaultLimit`.
+*
+* The return is never `undefined` — no ingress that routes its client limit
+* through this can produce an unbounded read.
+*/
+function resolveClientListLimit(rawLimit, opts = {}) {
+	const maxLimit = opts.maxLimit ?? 1e3;
+	if (rawLimit != null && String(rawLimit).trim() !== "") {
+		const parsed = typeof rawLimit === "number" ? rawLimit : parseInt(String(rawLimit), 10);
+		if (Number.isFinite(parsed)) return Math.min(Math.max(1, Math.floor(parsed)), maxLimit);
+	}
+	return opts.vectorSearch ? opts.vectorDefaultLimit ?? 10 : opts.defaultLimit ?? 50;
+}
 //#endregion
 //#region ../common/src/util/common.ts
 var DEFAULT_ONE_OF_TYPE = "type";
@@ -1007,6 +1026,35 @@ function camelCase(str) {
 	});
 })))();
 /**
+* Segments that reach the prototype chain rather than a property of the object.
+*
+* The twin of this function in `@rebasepro/forms` could be made to write onto
+* `Object.prototype` through a path of `__proto__.x`. This copy survives the
+* write by accident — its `clone` always spreads into a fresh object, while the
+* form engine's has a "preserve class instances" branch that hands back
+* `Object.prototype` itself — but `getIn` still *reads* through the chain, and
+* handing back `Object.prototype` is how a polluted value is read out again.
+*
+* Closed on both sides here, so the two implementations agree.
+*/
+var UNSAFE_PATH_SEGMENTS = /* @__PURE__ */ new Set([
+	"__proto__",
+	"constructor",
+	"prototype"
+]);
+/**
+* Whether writing this single key with `obj[key] = …` would reach the prototype
+* chain instead of creating a property.
+*
+* The single-key counterpart of {@link pathTraversesPrototype}, for the many
+* places that copy an object one key at a time. `JSON.parse` creates
+* `__proto__` as an *own* property, so it survives `hasOwnProperty` — and then
+* `target[key] = value` invokes the setter and replaces the target's prototype.
+*/
+function isPrototypePollutingKey(key) {
+	return UNSAFE_PATH_SEGMENTS.has(key);
+}
+/**
 * Deep clone a value, preserving function references and class instances.
 * Unlike structuredClone, this handles objects that contain functions
 * (e.g. CollectionConfig with target(), childCollections(), callbacks).
@@ -3308,6 +3356,46 @@ function resolveDataSource(collection, registry) {
 		capabilities: getDataSourceCapabilities(engine)
 	};
 }
+/**
+* Does a SQL toolchain own this collection's storage?
+*
+* "Owns the storage" means: something generates a table for it, pushes that
+* table to a database, plans its RLS policies, and reports it as drifted when
+* the two disagree. That is true of a Postgres collection and false of a
+* Firestore or MongoDB one, whose documents live in a store Rebase never
+* migrates — and the two were never told apart. Every stage of the SQL
+* toolchain took "the collections" to mean *all* of them, so a Firestore
+* collection declared next to the Postgres ones got a `pgTable` in the
+* generated schema, a `CREATE TABLE` at boot, RLS policies, and a place in the
+* `db push` include list — where its name shielding a same-named real table
+* from Atlas's exclude list is the one that can lose data.
+*
+* The answer is the resolved engine's {@link DataSourceCapabilities}, not a
+* name check: an engine registered through `registerDataSourceCapabilities`
+* gets the same treatment as the built-in ones.
+*
+* Deliberately answers **true** for an engine nobody has heard of. Build-time
+* tooling (the CLI, the schema generator) has no data-source registry to
+* resolve a `dataSource` key against, so an unknown key resolves to an unknown
+* engine — and the cost of the two mistakes is not symmetric. Wrongly
+* including a collection generates a table nothing writes to; wrongly excluding
+* one silently stops generating a table the app is serving from. Declare
+* `engine` on a collection that is not SQL-backed and this is exact.
+*/
+function isRelationalCollection(collection, registry) {
+	return getDataSourceCapabilities(collection?.engine ?? (collection?.dataSource ? resolveDataSource(collection, registry).engine : void 0)).supportsRelations;
+}
+/**
+* The subset of `collections` a SQL toolchain owns — see
+* {@link isRelationalCollection}.
+*
+* Every stage that generates SQL from collections starts by calling this, so
+* the rule lives in one place rather than being re-decided per generator. It
+* keeps the input order.
+*/
+function relationalCollections(collections, registry) {
+	return collections.filter((collection) => isRelationalCollection(collection, registry));
+}
 //#endregion
 //#region ../common/src/collections/CollectionRegistry.ts
 var CollectionRegistry = class {
@@ -3660,6 +3748,30 @@ var RebasePaginationError = class RebasePaginationError extends Error {
 		Object.setPrototypeOf(this, RebasePaginationError.prototype);
 	}
 };
+/**
+* Resolve `limit`/`offset`/`page` into the window a read will actually use.
+*
+* Lives here, next to the walk, for the reason at the top of this file: every
+* transport has to mean the same thing by "page two". Four of them did not —
+* the REST layer strode by {@link DEFAULT_LIST_LIMIT}, the local-first
+* evaluator by {@link DEFAULT_PAGE_SIZE}, the in-process accessor by 20, and
+* the published type documented a fourth number. Pages that overlap or skip
+* rows are the mildest of those outcomes.
+*
+* `page` wins over `offset`, as {@link FindParams} documents. `driverOffset`
+* is the value to hand a driver: it stays `undefined` when the caller named no
+* offset, because keyset pagination seeks with a `where` clause and must not
+* look like it is paging by offset.
+*/
+function resolveFindWindow(params) {
+	const limit = params?.limit ?? 50;
+	const offset = params?.page != null ? Math.max(0, (params.page - 1) * limit) : params?.offset ?? 0;
+	return {
+		limit,
+		offset,
+		driverOffset: params?.page != null ? offset : params?.offset
+	};
+}
 function normalizePageSize(raw) {
 	if (raw === void 0 || !Number.isFinite(raw)) return 200;
 	return Math.max(1, Math.floor(raw));
@@ -3955,21 +4067,22 @@ function createDriverAccessor(driver, slug, getPks = () => []) {
 	const accessor = {
 		async find(params) {
 			const filter = params?.where ? deserializeFilter(params.where) : void 0;
-			const limit = params?.limit ?? 20;
-			const offset = params?.offset ?? 0;
+			const { limit, offset, driverOffset } = resolveFindWindow(params);
 			const fetchService = driver.restFetchService;
 			const rows = fetchService ? await fetchService.fetchCollectionForRest(slug, {
 				filter,
-				limit: params?.limit,
-				offset: params?.offset,
+				logical: params?.logical,
+				limit,
+				offset: driverOffset,
 				orderBy: params?.orderBy?.[0],
 				order: params?.orderBy?.[1],
 				searchString: params?.searchString
 			}, params?.include) : await driver.fetchCollection({
 				path: slug,
-				limit: params?.limit,
-				offset: params?.offset,
+				limit,
+				offset: driverOffset,
 				filter,
+				logical: params?.logical,
 				orderBy: params?.orderBy?.[0],
 				order: params?.orderBy?.[1],
 				searchString: params?.searchString
@@ -3979,7 +4092,9 @@ function createDriverAccessor(driver, slug, getPks = () => []) {
 			if (driver.count) {
 				total = await driver.count({
 					path: slug,
-					filter
+					filter,
+					logical: params?.logical,
+					searchString: params?.searchString
 				});
 				hasMore = offset + rows.length < total;
 			}
@@ -4035,18 +4150,20 @@ function createDriverAccessor(driver, slug, getPks = () => []) {
 			const filter = params?.where ? deserializeFilter(params.where) : void 0;
 			return driver.count({
 				path: slug,
-				filter
+				filter,
+				logical: params?.logical,
+				searchString: params?.searchString
 			});
 		} : void 0,
 		listen: driver.listenCollection ? (params, onUpdate, onError) => {
-			const limit = params?.limit ?? 20;
-			const offset = params?.offset ?? 0;
+			const { limit, offset, driverOffset } = resolveFindWindow(params);
 			const normalize = driver.restFetchService ? inlineRelationRefs : (row) => row;
 			return driver.listenCollection({
 				path: slug,
-				limit: params?.limit,
-				offset: params?.offset,
+				limit,
+				offset: driverOffset,
 				filter: params?.where,
+				logical: params?.logical,
 				orderBy: params?.orderBy?.[0],
 				order: params?.orderBy?.[1],
 				searchString: params?.searchString,
@@ -4054,7 +4171,7 @@ function createDriverAccessor(driver, slug, getPks = () => []) {
 					onUpdate({
 						data: entities.map((row) => rowToEntity(normalize(row), slug, getPks())),
 						meta: {
-							total: entities.length,
+							total: offset + entities.length,
 							limit,
 							offset,
 							hasMore: entities.length >= limit
@@ -4294,6 +4411,6 @@ function buildSdkData(driver) {
 	return wrapAsSdkData(buildRebaseData(driver));
 }
 //#endregion
-export { toSnakeCase as A, normalizeToEntityRelation as C, getPolicyNamesForRule as D, legacyForeignKeyName as E, Vector as F, DEFAULT_ONE_OF_VALUE as M, hasForeignKeyOnTarget as N, mergeDeep as O, isManyToMany as P, createRelationRefWithData as S, generateForeignKeyName as T, buildCompositeId as _, getJunctionSecurityRules as a, parseIdValues as b, policyToPostgres as c, findRelation as d, getColumnName as f, resolveCollectionRelations as g, getTableVarName as h, getJunctionCollectionConfig as i, DEFAULT_ONE_OF_TYPE as j, camelCase as k, securityRuleToConditions as l, getTableName as m, CollectionRegistry as n, resolveJunctionSpecs as o, getEnumVarName as p, resolveStringColumnLength as r, getEffectiveSecurityRules as s, buildSdkData as t, findAnonymousGrants as u, getDeclaredPrimaryKeys as v, updateDateAutoValues as w, createRelationRef as x, isAddressableId as y };
+export { mergeDeep as A, createRelationRefWithData as C, legacyForeignKeyName as D, generateForeignKeyName as E, resolveClientListLimit as F, hasForeignKeyOnTarget as I, isManyToMany as L, toSnakeCase as M, DEFAULT_ONE_OF_TYPE as N, getPolicyNamesForRule as O, DEFAULT_ONE_OF_VALUE as P, Vector as R, createRelationRef as S, updateDateAutoValues as T, resolveCollectionRelations as _, getJunctionCollectionConfig as a, isAddressableId as b, getEffectiveSecurityRules as c, findAnonymousGrants as d, findRelation as f, getTableVarName as g, getTableName as h, resolveStringColumnLength as i, camelCase as j, isPrototypePollutingKey as k, policyToPostgres as l, getEnumVarName as m, CollectionRegistry as n, getJunctionSecurityRules as o, getColumnName as p, relationalCollections as r, resolveJunctionSpecs as s, buildSdkData as t, securityRuleToConditions as u, buildCompositeId as v, normalizeToEntityRelation as w, parseIdValues as x, getDeclaredPrimaryKeys as y };
 
-//# sourceMappingURL=src-DlPBctw_.js.map
+//# sourceMappingURL=src-CU6WZGYV.js.map