@rebasepro/server 0.10.1-canary.ff9ccd6 → 0.10.1-canary.g4db1bb1

package/dist/api/rest/api-generator.d.ts

@@ -16,6 +16,12 @@ export declare class RestApiGenerator {
     private listLimits;
     private authAdapter?;
     constructor(collections: CollectionConfig[], driver: DataDriver, authAdapter?: AuthAdapter, maxBulkRows?: number, listLimits?: ListLimitOptions);
+    /**
+     * Built on first use rather than in the constructor: it probes the driver
+     * for SQL support and creates a table, and most requests never send a key.
+     */
+    private idempotencyStore?;
+    private idempotency;
     /**
      * Parse request query params into QueryOptions, applying this generator's
      * list-pagination bounds (default page size + hard max limit) so no read
@@ -41,6 +47,20 @@ export declare class RestApiGenerator {
      * slug, never an id.
      */
     private enforceSubcollectionApiKeyPermission;
+    /**
+     * The collection a nested path writes into — the target of the relation its
+     * last segment names.
+     *
+     * Needed so a nested write can be checked against a schema at all. Without
+     * it these routes skipped `assertKnownWriteFields` entirely, which is why a
+     * typo `POST /posts` rejected with a 400 while the same typo on
+     * `POST /authors/1/posts` reached the database.
+     *
+     * Returns `undefined` rather than throwing when the path cannot be walked:
+     * the driver raises the authoritative error a moment later, and duplicating
+     * it here would report a resolution failure as a validation failure.
+     */
+    private resolveNestedWriteCollection;
     /**
      * Get the request-scoped driver. Throws if none is set — never falls
      * back to the unscoped `this.driver` to avoid bypassing RLS/auth.

package/dist/api/rest/idempotency.d.ts

@@ -0,0 +1,20 @@
+import { DataDriver } from "@rebasepro/types";
+export interface IdempotencyStore {
+    /** What this key answered before, or `undefined` if it is new. */
+    recall(key: string, uid: string | undefined): Promise<unknown | undefined>;
+    /** Record what this key answered. Never throws — see {@link createIdempotencyStore}. */
+    remember(key: string, uid: string | undefined, response: unknown): Promise<void>;
+}
+/**
+ * Returns `undefined` when the driver cannot run SQL, which disables the whole
+ * mechanism rather than failing writes: a document backend has no table to put
+ * this in, and refusing to serve is far worse than the duplicate this prevents.
+ *
+ * Every method swallows its own errors for the same reason. A write must not
+ * fail because the bookkeeping around it did — the worst case of a failed
+ * `remember` is the duplicate we already have today, while a thrown error would
+ * reject a write the database has already accepted.
+ */
+export declare function createIdempotencyStore(driver: DataDriver): IdempotencyStore | undefined;
+/** The header the client sends. Matches the widely used Stripe/IETF spelling. */
+export declare const IDEMPOTENCY_HEADER = "Idempotency-Key";

package/dist/auth/rate-limit-store.d.ts

@@ -42,7 +42,14 @@ export interface RateLimitStore {
 export declare class MemoryRateLimitStore implements RateLimitStore {
     private store;
     private cleanupInterval?;
-    constructor(sweepMs?: number);
+    private now;
+    /**
+     * `now` exists so the window can be driven directly instead of by sleeping:
+     * a test that waits half a real window is a test that fails on a loaded
+     * machine, where the sleep overruns and the hits it expects to still be in
+     * the window have left it.
+     */
+    constructor(sweepMs?: number, now?: () => number);
     hit(key: string, windowMs: number, limit: number): Promise<RateLimitDecision>;
     private sweep;
     dispose(): void;

package/dist/chunk-DSJWtz9O.js

@@ -0,0 +1,40 @@
+import { createRequire as __createRequire } from "module";
+import "process";
+const require = __createRequire(import.meta.url);
+//#region \0rolldown/runtime.js
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+var __copyProps = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+		key = keys[i];
+		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
+			get: ((k) => from[k]).bind(null, key),
+			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+		});
+	}
+	return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+	value: mod,
+	enumerable: true
+}) : target, mod));
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, { get: (a, b) => (typeof require !== "undefined" ? require : a)[b] }) : x)(function(x) {
+	if (typeof require !== "undefined") return require.apply(this, arguments);
+	throw Error("Calling `require` for \"" + x + "\" in an environment that doesn't expose the `require` function. See https://rolldown.rs/in-depth/bundling-cjs#require-external-modules for more details.");
+});
+//#endregion
+export { __toESM as i, __exportAll as n, __require as r, __commonJSMin as t };