@rebasepro/server 0.12.1-canary.gf5f1d39 → 0.13.0

package/dist/{src-CoOAMnBh.js → src-Cum9kox5.js}

@@ -1,8 +1,240 @@
 import { createRequire as __createRequire } from "module";
 import "process";
 __createRequire(import.meta.url);
-import { r as __require, t as __commonJSMin } from "./chunk-DSJWtz9O.js";
-import { S as toCanonicalOp, b as NULL_OPS, f as getDeclaredSubcollections, g as getDataSourceCapabilities, l as policy, m as isRelationalCollectionConfig, w as EntityRelation, x as REST_TO_CANONICAL, y as CANONICAL_TO_REST } from "./src-Ivjud8jD.js";
+import { r as __require, t as __commonJSMin } from "./rolldown-runtime-DSJWtz9O.js";
+import { c as NULL_OPS, i as isRelationalCollectionConfig, l as REST_TO_CANONICAL, n as getDeclaredSubcollections, o as getDataSourceCapabilities, r as isPostgresCollectionConfig, s as CANONICAL_TO_REST, u as toCanonicalOp } from "./src-_qQ3RNCK.js";
+//#region ../types/src/types/entities.ts
+/**
+* Class used to create a reference to a entity in a different path.
+*
+* @example
+* // Simple reference (most common case - single driver, single db)
+* new EntityReference({ id: "123", path: "users" })
+*
+* // Reference to a different driver (e.g., Firestore)
+* new EntityReference({ id: "123", path: "analytics", driver: "firestore" })
+*
+* // Reference to a specific database within a driver
+* new EntityReference({ id: "123", path: "orders", driver: "postgres", databaseId: "orders_db" })
+*/
+var EntityReference = class {
+	__type = "reference";
+	/**
+	* ID of the entity
+	*/
+	id;
+	/**
+	* A string representing the path of the referenced document (relative
+	* to the root of the database).
+	*/
+	path;
+	/**
+	* Which driver (e.g., 'postgres', 'firestore').
+	* Defaults to "(default)" if not specified.
+	*/
+	driver;
+	/**
+	* Which database within the driver.
+	* Defaults to "(default)" if not specified.
+	*/
+	databaseId;
+	/**
+	* Create a reference to a entity.
+	*
+	* @example
+	* // Simple reference (most common case)
+	* new EntityReference({ id: "123", path: "users" })
+	*
+	* // With driver
+	* new EntityReference({ id: "123", path: "analytics", driver: "firestore" })
+	*/
+	constructor(props) {
+		this.id = props.id;
+		this.path = props.path;
+		this.driver = props.driver;
+		this.databaseId = props.databaseId;
+	}
+	get pathWithId() {
+		return `${this.path}/${this.id}`;
+	}
+	/**
+	* Get the full path including driver and database prefixes if specified.
+	* For the common case (single driver, single db), this just returns pathWithId.
+	*/
+	get fullPath() {
+		const parts = [];
+		if (this.driver && this.driver !== "(default)") parts.push(this.driver);
+		if (this.databaseId && this.databaseId !== "(default)") parts.push(this.databaseId);
+		if (parts.length > 0) return `${parts.join(":")}:::${this.path}/${this.id}`;
+		return this.pathWithId;
+	}
+	isEntityReference() {
+		return true;
+	}
+};
+/**
+* Class used to create a reference to a entity in a different path
+*/
+var EntityRelation = class {
+	__type = "relation";
+	/**
+	* ID of the entity
+	*/
+	id;
+	/**
+	* A string representing the path of the referenced document (relative
+	* to the root of the database).
+	*/
+	path;
+	/**
+	* Pre-fetched data payload to eliminate N+1 queries.
+	* When present, clients can use this directly instead of fetching.
+	*/
+	data;
+	constructor(id, path, data) {
+		this.id = id;
+		this.path = path;
+		this.data = data;
+	}
+	get pathWithId() {
+		return `${this.path}/${this.id}`;
+	}
+	isEntityReference() {
+		return false;
+	}
+	isEntityRelation() {
+		return true;
+	}
+};
+var GeoPoint = class {
+	/**
+	* The latitude of this GeoPoint instance.
+	*/
+	latitude;
+	/**
+	* The longitude of this GeoPoint instance.
+	*/
+	longitude;
+	constructor(latitude, longitude) {
+		this.latitude = latitude;
+		this.longitude = longitude;
+	}
+};
+var Vector = class {
+	value;
+	constructor(value) {
+		this.value = value;
+	}
+};
+//#endregion
+//#region ../types/src/types/policy.ts
+/**
+* The id a request without a logged-in user reports as `auth.uid()`.
+*
+* A user-context request always sets `app.uid`: blank would read back as
+* `NULL`, and `NULL` is how the trusted server context is recognised, so an
+* anonymous visitor would be promoted to server privileges. The driver
+* therefore substitutes this sentinel at the single chokepoint where the GUC
+* is set.
+*
+* The consequence for policy authors is that **`auth.uid() IS NOT NULL` is a
+* tautology on the user path** — it is true for anonymous visitors too. Use
+* {@link policy.authenticated} to mean "signed in", and
+* {@link policy.serverContext} to mean "the trusted server context". Do not
+* hand-write the comparison: see {@link ANONYMOUS_USER_IDS} for why one
+* literal is not enough.
+*
+* @group Models
+*/
+var ANONYMOUS_USER_ID = "anonymous";
+/**
+* Every uid that has ever meant "nobody is signed in" — newest first.
+*
+* There are two because there were two. The types, the policy compiler, the
+* JavaScript evaluator and the linter were all built on
+* {@link ANONYMOUS_USER_ID}, while the request path scoped unauthenticated
+* callers as `'anon'` — so `policy.authenticated()`, which compiled to
+* `auth.uid() <> 'anonymous'`, was *true* for an anonymous visitor. The
+* sanctioned way to write "signed in" granted to everyone, and the linter
+* flagged the spelling that actually worked as a foreign convention.
+*
+* The request path now reports {@link ANONYMOUS_USER_ID}. `'anon'` stays here
+* because policies outlive the server that generated them: a database still
+* holding policies from before the fix, or a project whose server has not been
+* upgraded yet, must not become a grant in either direction. Compile against
+* this list, not against a single literal.
+*
+* No real user id is ever one of these, so a match is always "not signed in".
+*
+* @group Models
+*/
+var ANONYMOUS_USER_IDS = [ANONYMOUS_USER_ID, "anon"];
+/**
+* Whether a uid stands for "no one is signed in", in any spelling rebase has
+* used. `null`/`undefined` is the trusted server context, not an anonymous
+* caller, and is therefore **not** anonymous — see {@link ANONYMOUS_USER_ID}.
+*
+* @group Models
+*/
+function isAnonymousUid(uid) {
+	return typeof uid === "string" && ANONYMOUS_USER_IDS.includes(uid);
+}
+/** @group Models */
+var policy = {
+	true: () => ({ kind: "true" }),
+	false: () => ({ kind: "false" }),
+	and: (...operands) => ({
+		kind: "and",
+		operands
+	}),
+	or: (...operands) => ({
+		kind: "or",
+		operands
+	}),
+	not: (operand) => ({
+		kind: "not",
+		operand
+	}),
+	compare: (left, op, right) => ({
+		kind: "compare",
+		op,
+		left,
+		right
+	}),
+	rolesOverlap: (roles) => ({
+		kind: "rolesOverlap",
+		roles
+	}),
+	rolesContain: (roles) => ({
+		kind: "rolesContain",
+		roles
+	}),
+	authenticated: () => ({ kind: "authenticated" }),
+	serverContext: () => ({ kind: "serverContext" }),
+	existsIn: (args) => ({
+		kind: "existsIn",
+		collection: args.collection,
+		where: args.where
+	}),
+	raw: (sql) => ({
+		kind: "raw",
+		sql
+	}),
+	field: (name) => ({
+		kind: "field",
+		name
+	}),
+	outerField: (name) => ({
+		kind: "outerField",
+		name
+	}),
+	literal: (value) => ({
+		kind: "literal",
+		value
+	}),
+	authUid: () => ({ kind: "authUid" }),
+	authRoles: () => ({ kind: "authRoles" })
+};
 (/* @__PURE__ */ __commonJSMin(((exports, module) => {
 	(function(e) {
 		var t;
@@ -1004,23 +1236,107 @@ function removeFunctions(o) {
 	if (o === void 0) return void 0;
 	if (o === null) return null;
 	if (typeof o === "object") {
-		if (Array.isArray(o)) return o.map((v) => removeFunctions(v));
+		if (Array.isArray(o)) return o.filter((v) => typeof v !== "function").map((v) => removeFunctions(v));
 		if (!isPlainObject(o)) return o;
-		return Object.entries(o).filter(([_, value]) => typeof value !== "function").map(([key, value]) => {
-			if (Array.isArray(value)) return { [key]: value.map((v) => removeFunctions(v)) };
-			else if (typeof value === "object") return { [key]: removeFunctions(value) };
-			else return { [key]: value };
-		}).reduce((a, b) => ({
-			...a,
-			...b
-		}), {});
+		return Object.entries(o).filter(([_, value]) => typeof value !== "function").reduce((acc, [key, value]) => {
+			acc[key] = removeFunctions(value);
+			return acc;
+		}, {});
 	}
 	return o;
 }
 /**
+* Returns the singular of an English word.
+*
+* @param {string} word
+* @param {number} [amount]
+* @returns {string}
+*/
+function singular(word, amount) {
+	if (amount !== void 0 && amount !== 1) return word;
+	const singulars = {
+		"(quiz)zes$": "$1",
+		"(matr)ices$": "$1ix",
+		"(vert|ind)ices$": "$1ex",
+		"^(ox)en$": "$1",
+		"(alias)es$": "$1",
+		"(octop|vir)i$": "$1us",
+		"(cris|ax|test)es$": "$1is",
+		"(shoe)s$": "$1",
+		"(o)es$": "$1",
+		"(bus)es$": "$1",
+		"([m|l])ice$": "$1ouse",
+		"(x|ch|ss|sh)es$": "$1",
+		"(m)ovies$": "$1ovie",
+		"(s)eries$": "$1eries",
+		"([^aeiouy]|qu)ies$": "$1y",
+		"([lr])ves$": "$1f",
+		"(tive)s$": "$1",
+		"(hive)s$": "$1",
+		"(li|wi|kni)ves$": "$1fe",
+		"(shea|loa|lea|thie)ves$": "$1f",
+		"(^analy)ses$": "$1sis",
+		"((a)naly|(b)a|(d)iagno|(p)arenthe|(p)rogno|(s)ynop|(t)he)ses$": "$1$2sis",
+		"([ti])a$": "$1um",
+		"(n)ews$": "$1ews",
+		"(h|bl)ouses$": "$1ouse",
+		"(corpse)s$": "$1",
+		"(us)es$": "$1",
+		s$: ""
+	};
+	const irregular = {
+		move: "moves",
+		foot: "feet",
+		goose: "geese",
+		sex: "sexes",
+		child: "children",
+		man: "men",
+		tooth: "teeth",
+		person: "people"
+	};
+	if ([
+		"sheep",
+		"fish",
+		"deer",
+		"moose",
+		"series",
+		"species",
+		"money",
+		"rice",
+		"information",
+		"equipment",
+		"bison",
+		"cod",
+		"offspring",
+		"pike",
+		"salmon",
+		"shrimp",
+		"swine",
+		"trout",
+		"aircraft",
+		"hovercraft",
+		"spacecraft",
+		"sugar",
+		"tuna",
+		"you",
+		"wood"
+	].indexOf(word.toLowerCase()) >= 0) return word;
+	for (const w in irregular) {
+		const pattern = new RegExp(`${irregular[w]}$`, "i");
+		if (pattern.test(word)) return word.replace(pattern, w);
+	}
+	for (const reg in singulars) {
+		const pattern = new RegExp(reg, "i");
+		if (pattern.test(word)) return word.replace(pattern, singulars[reg]);
+	}
+	return word;
+}
+/**
 * Generates a foreign key column name from a given string, typically a collection slug or name.
-* It converts the name to snake_case, attempts to singularize it by removing a trailing 's'
-* (a common convention for collection names), and appends '_id'.
+* It singularizes the name, converts it to snake_case and appends '_id'.
+*
+* Singularization runs *before* snake-casing so that acronyms survive: `toSnakeCase`
+* splits on every capital, which turned "URLs" into "ur_ls" and then "ur_l_id".
 *
 * @param name The base name to convert to a foreign key.
 * @returns A foreign key name in the format 'singular_name_id'.
@@ -1030,8 +1346,8 @@ function removeFunctions(o) {
 * generateForeignKeyName("users")
 *
 * @example
-* // returns "post_id"
-* generateForeignKeyName("posts")
+* // returns "category_id"
+* generateForeignKeyName("categories")
 *
 * @example
 * // returns "product_id"
@@ -1039,8 +1355,21 @@ function removeFunctions(o) {
 *
 */
 function generateForeignKeyName(name) {
-	const snakeCaseName = toSnakeCase(name);
-	return `${snakeCaseName.endsWith("s") ? snakeCaseName.slice(0, -1) : snakeCaseName}_id`;
+	return `${toSnakeCase(singularizeForKey(name))}_id`;
+}
+/**
+* `singular()` handles real English plurals, but its final catch-all rule strips
+* any trailing "s", which mangles words that only look plural. Guard the two
+* cases that produce a column name nobody would recognise:
+*
+* - a double "s" ending is never a plural marker ("address", "class", "process"),
+*   so stripping it yields "addres";
+* - a name that singularizes to nothing (the literal "s") would yield "_id".
+*/
+function singularizeForKey(name) {
+	if (/ss$/i.test(name)) return name;
+	const result = singular(name);
+	return result.length > 0 ? result : name;
 }
 //#endregion
 //#region ../common/src/util/entities.ts
@@ -1169,8 +1498,7 @@ function enumToObjectEntries(enumValues) {
 function resolveRelation(relation, sourceCollection, propertyKey) {
 	const target = relation.target;
 	if (typeof target !== "function") throw new Error(`Relation${relation.relationName ? ` '${relation.relationName}'` : ""} on '${sourceCollection.slug}' has no \`target\`. Give it a thunk: \`target: () => otherCollection\`.`);
-	const targetCollection = target();
-	if (!targetCollection?.slug) throw new Error(`Relation${relation.relationName ? ` '${relation.relationName}'` : ""} on '${sourceCollection.slug}' has a \`target\` that did not resolve to a collection.`);
+	const targetCollection = callTarget(relation, sourceCollection, propertyKey, target);
 	const relationName = relation.relationName ?? propertyKey ?? toSnakeCase(targetCollection.slug);
 	const shared = {
 		relationName,
@@ -1197,7 +1525,8 @@ function resolveRelation(relation, sourceCollection, propertyKey) {
 			cardinality: "one",
 			writable: true,
 			shared: false,
-			foreignKeyOnTarget: relation.foreignKeyOnTarget ?? generateForeignKeyName(sourceName)
+			foreignKeyOnTarget: relation.foreignKeyOnTarget ?? generateForeignKeyName(sourceName),
+			sourceKey: relation.sourceKey
 		};
 		case "hasMany": return {
 			...shared,
@@ -1205,7 +1534,8 @@ function resolveRelation(relation, sourceCollection, propertyKey) {
 			cardinality: "many",
 			writable: true,
 			shared: false,
-			foreignKeyOnTarget: relation.foreignKeyOnTarget ?? generateForeignKeyName(sourceName)
+			foreignKeyOnTarget: relation.foreignKeyOnTarget ?? generateForeignKeyName(sourceName),
+			sourceKey: relation.sourceKey
 		};
 		case "manyToMany": {
 			const sourceTable = getTableName(sourceCollection);
@@ -1234,6 +1564,43 @@ function resolveRelation(relation, sourceCollection, propertyKey) {
 		default: throw new Error(`Unknown relation kind: ${JSON.stringify(relation)}`);
 	}
 }
+/** How this relation is addressed in an error message, before it has a resolved name. */
+function describe(relation, sourceCollection, propertyKey) {
+	const name = relation.relationName ?? propertyKey;
+	return `Relation${name ? ` '${name}'` : ""} on '${sourceCollection.slug}'`;
+}
+/**
+* Call the `target` thunk, and translate the two ways an import cycle breaks it
+* into an error that names the cause.
+*
+* The thunk exists to defer the reference until every module has finished
+* evaluating, and for a cycle that closes at import time it does. What it cannot
+* defer is a cycle that leaves the binding permanently unusable, and there are
+* two shapes of that:
+*
+*  - **ESM/TDZ.** `const` and `class` bindings in a not-yet-evaluated module are
+*    in the temporal dead zone, so reading one throws `ReferenceError: x is not
+*    defined`. The stack points at the thunk — a one-line arrow function that is
+*    obviously fine — and says nothing about the cycle that made it throw.
+*  - **CJS interop.** The half-initialised module object has no `default` yet,
+*    the import resolves to `undefined`, and the thunk returns it without
+*    complaint. That one used to surface here as "did not resolve to a
+*    collection", which is true and unhelpful.
+*
+* Both mean the same thing, and the fix for both is the same: break the cycle,
+* or move the relation into the collection that does not close it.
+*/
+function callTarget(relation, sourceCollection, propertyKey, target) {
+	let targetCollection;
+	try {
+		targetCollection = target();
+	} catch (error) {
+		if (error instanceof ReferenceError) throw new Error(`${describe(relation, sourceCollection, propertyKey)} targets a collection that is not initialized yet — almost always an import cycle between the two collection files. Break the cycle (move the shared piece into a third module, or import the target lazily) so the target's module finishes evaluating before the registry is built.`, { cause: error });
+		throw error;
+	}
+	if (!targetCollection?.slug) throw new Error(`${describe(relation, sourceCollection, propertyKey)} has a \`target\` that resolved to ${targetCollection === void 0 ? "`undefined`" : "something that is not a collection"}. ` + (targetCollection === void 0 ? "Under CommonJS interop an import cycle resolves the default import to `undefined`, so check whether this collection and its target import each other. Otherwise the thunk is returning the wrong value — it must return the collection itself, not a promise or a module." : "The thunk must return a collection config with a `slug`."));
+	return targetCollection;
+}
 //#endregion
 //#region ../common/src/util/relations.ts
 /**
@@ -1381,7 +1748,105 @@ function getEntityChildViews(collection) {
 function getSubcollections(collection) {
 	return getEntityChildViews(collection).map((view) => view.collection);
 }
-policy.or(policy.serverContext(), policy.rolesOverlap(["admin"]));
+//#endregion
+//#region ../common/src/util/auth-default-policies.ts
+/**
+* Default RLS policies injected by the schema generator.
+*
+* Rebase's enforcement model is unified: authenticated (user-context) requests
+* run under the restricted `rebase_user` role, so Postgres RLS binds *every*
+* statement — reads and writes. A collection's `securityRules` are the whole
+* authorization model. The server context (auth flows, migrations,
+* `dataAsAdmin`) runs as the owner and bypasses RLS.
+*
+* Because RLS default-denies, every collection is **locked by default**: with
+* no rules, only the server context and admins can touch it. The generator
+* injects that safe baseline:
+*
+* **For every collection**
+*  1. A permissive **server-or-admin SELECT** grant.
+*  2. A permissive **server-or-admin write** grant (insert/update/delete).
+*
+* Author `securityRules` are permissive and OR together, so explicit rules only
+* *broaden* access from this locked baseline (e.g. "users read/write their own
+* rows").
+*
+* **For auth collections additionally**
+*  3. A permissive **self SELECT** grant (`id = auth.uid()`), so users can read
+*     their own row (profile, session bootstrap) without every app re-declaring
+*     it.
+*  4. A **restrictive** admin write gate. Restrictive policies are AND'd with
+*     every other policy, so a write is rejected unless the caller is an admin
+*     (or the server context) — even if the author also wrote a permissive rule
+*     such as "a user may edit their own row". Without this, a permissive owner
+*     rule would let a user change their own `roles`.
+*
+* The server context is recognised as `auth.uid() IS NULL` (`policy.serverContext()`)
+* — the built-in flows that run without a user (signup, migrations) set no user
+* GUC — which also lets the owner connection satisfy these policies even under
+* FORCE RLS. A *user* request never reaches that state: an anonymous one carries
+* `ANONYMOUS_USER_ID`, precisely so it cannot pass for the server here.
+*
+* Opt out with `disableDefaultPolicies: true` to take full responsibility for
+* the collection's RLS.
+*/
+var SERVER_OR_ADMIN_EXPR$1 = policy.or(policy.serverContext(), policy.rolesOverlap(["admin"]));
+/** Write operations that must be admin-gated by default on auth collections. */
+var DEFAULT_GUARDED_OPS = [
+	"insert",
+	"update",
+	"delete"
+];
+/** Whether a collection is flagged as an authentication collection. */
+function isAuthCollection(collection) {
+	const auth = collection.auth;
+	return auth === true || typeof auth === "object" && auth?.enabled === true;
+}
+/** The property marked as the row id (falls back to `id`). */
+function getIdPropertyName(collection) {
+	for (const [name, prop] of Object.entries(collection.properties ?? {})) if (prop && typeof prop === "object" && "isId" in prop && prop.isId) return name;
+	return "id";
+}
+/**
+* Returns the security rules that should be applied to a collection: the
+* author's explicit `securityRules` plus the framework defaults described in
+* the module doc (baseline server/admin read for all collections; self-read
+* and the admin write gate for auth collections).
+*
+* Collections that opt out via `disableDefaultPolicies` are returned unchanged.
+*/
+function getEffectiveSecurityRules(collection) {
+	const explicit = [...collection.securityRules ?? []];
+	if (isPostgresCollectionConfig(collection) && collection.disableDefaultPolicies) return explicit;
+	const tableName = getTableName(collection);
+	const injected = [];
+	injected.push({
+		name: `${tableName}_default_admin_read`,
+		operations: ["select"],
+		condition: SERVER_OR_ADMIN_EXPR$1
+	});
+	injected.push({
+		name: `${tableName}_default_admin_write`,
+		operations: [...DEFAULT_GUARDED_OPS],
+		condition: SERVER_OR_ADMIN_EXPR$1,
+		check: SERVER_OR_ADMIN_EXPR$1
+	});
+	if (isAuthCollection(collection)) {
+		injected.push({
+			name: `${tableName}_default_self_read`,
+			operations: ["select"],
+			condition: policy.compare(policy.field(getIdPropertyName(collection)), "eq", policy.authUid())
+		});
+		injected.push({
+			name: `${tableName}_require_admin_write`,
+			mode: "restrictive",
+			operations: [...DEFAULT_GUARDED_OPS],
+			condition: SERVER_OR_ADMIN_EXPR$1,
+			check: SERVER_OR_ADMIN_EXPR$1
+		});
+	}
+	return [...explicit, ...injected];
+}
 policy.or(policy.serverContext(), policy.rolesOverlap(["admin"]));
 (/* @__PURE__ */ __commonJSMin(((exports, module) => {
 	(function(root, factory) {
@@ -1660,7 +2125,7 @@ policy.or(policy.serverContext(), policy.rolesOverlap(["admin"]));
 * Apply PropertyConditions to a resolved property, evaluating all JSON Logic rules.
 */
 //#endregion
-//#region ../../node_modules/.pnpm/fast-equals@6.0.0/node_modules/fast-equals/dist/es/index.mjs
+//#region ../../node_modules/.pnpm/fast-equals@6.0.2/node_modules/fast-equals/dist/es/index.mjs
 var { getOwnPropertyNames, getOwnPropertySymbols } = Object;
 var { hasOwnProperty } = Object.prototype;
 /**
@@ -1696,7 +2161,8 @@ function createIsCircular(areItemsEqual) {
 * not enumerable and symbol properties.
 */
 function getStrictProperties(object) {
-	return getOwnPropertyNames(object).concat(getOwnPropertySymbols(object));
+	const symbols = getOwnPropertySymbols(object);
+	return symbols.length ? getOwnPropertyNames(object).concat(symbols) : getOwnPropertyNames(object);
 }
 /**
 * Whether the object contains the property passed as an own property.
@@ -1769,7 +2235,7 @@ function areMapsEqual(a, b, state) {
 	const size = a.size;
 	if (size !== b.size) return false;
 	if (!size) return true;
-	const matchedIndices = new Array(size);
+	const matchedIndices = new Uint8Array(size);
 	const aIterable = a.entries();
 	let aResult;
 	let bResult;
@@ -1777,7 +2243,7 @@ function areMapsEqual(a, b, state) {
 	while (aResult = aIterable.next()) {
 		if (aResult.done) break;
 		const bIterable = b.entries();
-		let hasMatch = false;
+		let hasMatch = 0;
 		let matchIndex = 0;
 		while (bResult = bIterable.next()) {
 			if (bResult.done) break;
@@ -1788,7 +2254,7 @@ function areMapsEqual(a, b, state) {
 			const aEntry = aResult.value;
 			const bEntry = bResult.value;
 			if (state.equals(aEntry[0], bEntry[0], index, matchIndex, a, b, state) && state.equals(aEntry[1], bEntry[1], aEntry[0], bEntry[0], a, b, state)) {
-				hasMatch = matchedIndices[matchIndex] = true;
+				hasMatch = matchedIndices[matchIndex] = 1;
 				break;
 			}
 			matchIndex++;
@@ -1846,19 +2312,19 @@ function areSetsEqual(a, b, state) {
 	const size = a.size;
 	if (size !== b.size) return false;
 	if (!size) return true;
-	const matchedIndices = new Array(size);
+	const matchedIndices = new Uint8Array(size);
 	const aIterable = a.values();
 	let aResult;
 	let bResult;
 	while (aResult = aIterable.next()) {
 		if (aResult.done) break;
 		const bIterable = b.values();
-		let hasMatch = false;
+		let hasMatch = 0;
 		let matchIndex = 0;
 		while (bResult = bIterable.next()) {
 			if (bResult.done) break;
 			if (!matchedIndices[matchIndex] && state.equals(aResult.value, bResult.value, aResult.value, bResult.value, a, b, state)) {
-				hasMatch = matchedIndices[matchIndex] = true;
+				hasMatch = matchedIndices[matchIndex] = 1;
 				break;
 			}
 			matchIndex++;
@@ -1871,8 +2337,8 @@ function areSetsEqual(a, b, state) {
 * Whether the TypedArray instances are equal in value.
 */
 function areTypedArraysEqual(a, b) {
-	let index = a.byteLength;
-	if (b.byteLength !== index || a.byteOffset !== b.byteOffset) return false;
+	let index = a.length;
+	if (b.length !== index || a.byteOffset !== b.byteOffset) return false;
 	while (index-- > 0) if (a[index] !== b[index]) return false;
 	return true;
 }
@@ -2885,7 +3351,7 @@ function rowToEntity(row, slug, primaryKeys = []) {
 	};
 }
 /**
-* The relation envelope `toCmsRow` writes where a relation was:
+* The relation envelope `toFlatRow` writes where a relation was:
 * `{ id, path, __type: "relation", data: { id, path, values } }`. It is the
 * admin's view-model, and the only pipeline that produces one is postgres'.
 */
@@ -3306,57 +3772,6 @@ function buildRoutedRebaseData({ defaultData, sources, resolveKey }) {
 	} });
 }
 //#endregion
-//#region ../common/src/data/sort-dialect.ts
-/**
-* Sort-order wire codec.
-*
-* This is the ONLY module that knows about the colon-delimited wire format
-* (`"field:direction"`) used in HTTP query parameters.
-* Everything else speaks {@link OrderByTuple} exclusively.
-*
-* Mirrors the filter architecture in `filter-dialect.ts`.
-*
-* @module
-*/
-/**
-* Serialize an {@link OrderByTuple} to the wire format `"field:direction"`.
-*
-* **Runtime tolerance:** if the input is already a well-formed wire string
-* (from an untyped JS caller), it is returned unchanged.
-* This is undocumented tolerance, not public API — don't rely on it.
-*
-* @param orderBy - A canonical `[field, direction]` tuple, or at runtime
-*   possibly a pre-serialized string (undocumented tolerance).
-* @returns The wire-format string, or `undefined` if the input is falsy.
-*
-* @remarks
-* Field names containing `:` are representable in the tuple form but
-* **not** on the wire — this is an inherent limitation of the colon-delimited
-* encoding and is not resolved here.
-*/
-function serializeOrderBy(orderBy) {
-	if (!orderBy) return void 0;
-	if (typeof orderBy === "string") return orderBy;
-	return `${orderBy[0]}:${orderBy[1]}`;
-}
-/**
-* Deserialize a wire-format `"field:direction"` string into an {@link OrderByTuple}.
-*
-* Lenient parsing (matches existing server behaviour):
-* - Bare field name (no colon): `"name"` → `["name", "asc"]`
-* - Unknown direction: `"name:foo"` → `["name", "asc"]`
-* - Empty / falsy input: → `undefined`
-*
-* @param raw - The wire-format string from an HTTP query parameter.
-* @returns The canonical tuple, or `undefined` if the input is empty/falsy.
-*/
-function deserializeOrderBy(raw) {
-	if (!raw) return void 0;
-	const idx = raw.indexOf(":");
-	if (idx === -1) return [raw, "asc"];
-	return [raw.slice(0, idx), raw.slice(idx + 1) === "desc" ? "desc" : "asc"];
-}
-//#endregion
-export { toSnakeCase as _, deserializeFilter as a, serializeLogicalCondition as c, CollectionRegistry as d, createDataSourceRegistry as f, buildCompositeId as g, resolveCollectionRelations as h, buildSdkData as i, collectAllPages as l, findRelation as m, serializeOrderBy as n, deserializeLogicalCondition as o, resolveDataSource as p, buildRoutedRebaseData as r, serializeFilter as s, deserializeOrderBy as t, paginateFind as u };
+export { Vector as S, ANONYMOUS_USER_ID as _, serializeFilter as a, EntityRelation as b, paginateFind as c, resolveDataSource as d, getEffectiveSecurityRules as f, toSnakeCase as g, buildCompositeId as h, deserializeLogicalCondition as i, CollectionRegistry as l, resolveCollectionRelations as m, buildSdkData as n, serializeLogicalCondition as o, findRelation as p, deserializeFilter as r, collectAllPages as s, buildRoutedRebaseData as t, createDataSourceRegistry as u, isAnonymousUid as v, GeoPoint as x, EntityReference as y };
 
-//# sourceMappingURL=src-CoOAMnBh.js.map
+//# sourceMappingURL=src-Cum9kox5.js.map