@rebasepro/server 0.13.0 → 0.13.1-canary.g06dbe5b

package/dist/{admin_block-CcSGdH7M.js → admin_block-H86dCPsj.js}

@@ -44,6 +44,7 @@ var ADMIN_COLLECTION_KEYS = [
 	"defaultSize",
 	"defaultViewMode",
 	"disableDefaultActions",
+	"display",
 	"enabledViews",
 	"entityActions",
 	"entityViews",
@@ -54,6 +55,7 @@ var ADMIN_COLLECTION_KEYS = [
 	"formAutoSave",
 	"formView",
 	"group",
+	"hideFromEntityViews",
 	"hideFromNavigation",
 	"hideIdFromCollection",
 	"hideIdFromForm",
@@ -118,7 +120,65 @@ var ADMIN_PROPERTY_KEYS = [
 	"urlPreview",
 	"widget"
 ];
+/**
+* Move flattened admin keys back down into the `admin` block.
+*
+* The admin panel works with a *flat* view model — the block merged onto the
+* collection — so what comes back from a form has `icon` and `defaultViewMode`
+* at the top level while `admin` still holds whatever the file was loaded with.
+* This is the way back.
+*
+* **The top-level value wins.** It is the one the form just wrote; the block is
+* the copy the collection was loaded with, and preferring it resolves every edit
+* in favour of the value the user changed away from.
+*
+* This lives here, next to the key lists, because it had two implementations —
+* `toAdminCollectionConfig` in `@rebasepro/admin-types` and `nestAdminKeys` in
+* `@rebasepro/server`'s schema editor — that agreed on everything except that
+* precedence, which is the only part that decides whether a save is visible.
+*
+* @group Models
+*/
+function nestAdminKeysOf(source, adminKeys) {
+	const keys = new Set(adminKeys);
+	const top = {};
+	const block = { ...source.admin ?? {} };
+	for (const [key, value] of Object.entries(source)) {
+		if (key === "admin") continue;
+		if (keys.has(key)) block[key] = value;
+		else top[key] = value;
+	}
+	if (Object.keys(block).length > 0) top.admin = block;
+	return top;
+}
+/**
+* {@link nestAdminKeysOf} for a collection.
+*
+* @group Models
+*/
+function nestAdminCollectionKeys(collection) {
+	return nestAdminKeysOf(collection, ADMIN_COLLECTION_KEYS);
+}
+/**
+* {@link nestAdminKeysOf} for a property, applied to its children too.
+*
+* A map property carries `properties`, an array property carries `of`, and both
+* hold properties with `admin` blocks of their own. A flat `readOnly` left on a
+* child is as dead — and as fatal at the next boot — as one left on the parent,
+* so the walk goes all the way down.
+*
+* @group Models
+*/
+function nestAdminPropertyKeys(property) {
+	const nested = nestAdminKeysOf(property, ADMIN_PROPERTY_KEYS);
+	const children = nested.properties;
+	if (children && typeof children === "object" && !Array.isArray(children)) nested.properties = Object.fromEntries(Object.entries(children).map(([key, child]) => [key, child && typeof child === "object" && !Array.isArray(child) ? nestAdminPropertyKeys(child) : child]));
+	const of = nested.of;
+	if (Array.isArray(of)) nested.of = of.map((entry) => entry && typeof entry === "object" && !Array.isArray(entry) ? nestAdminPropertyKeys(entry) : entry);
+	else if (of && typeof of === "object") nested.of = nestAdminPropertyKeys(of);
+	return nested;
+}
 //#endregion
-export { ADMIN_PROPERTY_KEYS as n, ADMIN_COLLECTION_KEYS as t };
+export { nestAdminPropertyKeys as i, ADMIN_PROPERTY_KEYS as n, nestAdminCollectionKeys as r, ADMIN_COLLECTION_KEYS as t };
 
-//# sourceMappingURL=admin_block-CcSGdH7M.js.map
+//# sourceMappingURL=admin_block-H86dCPsj.js.map

package/dist/admin_block-H86dCPsj.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin_block-H86dCPsj.js","names":[],"sources":["../../types/src/types/admin_block.ts"],"sourcesContent":["/**\n * The keys of a collection's admin block, as data.\n *\n * There is no *type* for the block in this package any more, and that is the point:\n * `admin` is not declared on `BaseCollectionConfig` or on any property here, so a\n * BaaS install cannot even write one. `@rebasepro/admin-types` adds the field back by\n * declaration merging, which is why installing it is what makes the admin surface\n * appear.\n *\n * The *list* still has to live here, because three runtime consumers need it and two\n * of them are core — see below.\n */\n\n/**\n * Every key that belongs inside a collection's `admin` block, as data.\n *\n * The type that describes these fields is `AdminCollectionOptions` in\n * `@rebasepro/admin-types`, and it is erased at build time — but three runtime\n * consumers need the list, and two of them are core:\n *\n * - `serializeCollections`, to drop the block from the contract\n * - the ts-morph schema editor in `@rebasepro/server`, which rewrites collection\n *   files on disk from the admin panel and has to know where each key goes. A key\n *   missing from this list gets written to the *top level* of the file, where the\n *   backend ignores it and the panel never finds it again.\n * - the `collections-admin-block` codemod\n *\n * `@rebasepro/admin-types` re-exports this and asserts it names only real option\n * keys; the count is pinned by a test there.\n *\n * @group Models\n */\nexport const ADMIN_COLLECTION_KEYS = [\n    \"Actions\",\n    \"additionalFields\",\n    \"alwaysApplyDefaultValues\",\n    \"components\",\n    \"defaultEntityAction\",\n    \"defaultFilter\",\n    \"defaultSelectedView\",\n    \"defaultSize\",\n    \"defaultViewMode\",\n    \"disableDefaultActions\",\n    \"display\",\n    \"enabledViews\",\n    \"entityActions\",\n    \"entityViews\",\n    \"exportable\",\n    \"filterPresets\",\n    \"fixedFilter\",\n    \"form\",\n    \"formAutoSave\",\n    \"formView\",\n    \"group\",\n    \"hideFromEntityViews\",\n    \"hideFromNavigation\",\n    \"hideIdFromCollection\",\n    \"hideIdFromForm\",\n    \"icon\",\n    \"includeJsonView\",\n    \"inlineEditing\",\n    \"kanban\",\n    \"listProperties\",\n    \"localChangesBackup\",\n    \"openEntityMode\",\n    \"orderProperty\",\n    \"pagination\",\n    \"previewProperties\",\n    \"propertiesOrder\",\n    \"selectionController\",\n    \"selectionEnabled\",\n    \"sideDialogWidth\",\n    \"sort\",\n    \"titleProperty\"\n] as const;\n\n/** A key of a collection's `admin` block. @group Models */\nexport type AdminCollectionKey = typeof ADMIN_COLLECTION_KEYS[number];\n\n/**\n * Every key that belongs inside a *property's* `admin` block, as data.\n *\n * The union of `AdminPropertyOptions` and its per-type extensions\n * (`AdminStringOptions`, `AdminArrayOptions`, …) in `@rebasepro/admin-types`.\n * It lives here for the same reason {@link ADMIN_COLLECTION_KEYS} does: the\n * runtime consumers are core packages that the BaaS guard forbids from\n * importing `@rebasepro/admin-types`. Here it is the boot-time collection\n * validator in `@rebasepro/server`, which has to tell \"you left `readOnly` at\n * the top of the property, where nothing reads it\" apart from \"you invented a\n * key we have never heard of\".\n *\n * `@rebasepro/admin-types` re-exports this and asserts it names only real\n * option keys.\n *\n * @group Models\n */\nexport const ADMIN_PROPERTY_KEYS = [\n    \"canAddElements\",\n    \"clearable\",\n    \"columnWidth\",\n    \"customProps\",\n    \"disabled\",\n    \"expanded\",\n    \"Field\",\n    \"Filter\",\n    \"filterOperators\",\n    \"fixedFilter\",\n    \"hideFromCollection\",\n    \"includeEntityLink\",\n    \"includeId\",\n    \"markdown\",\n    \"minimalistView\",\n    \"multiline\",\n    \"Preview\",\n    \"previewAsTag\",\n    \"previewProperties\",\n    \"readOnly\",\n    \"sortable\",\n    \"span\",\n    \"spreadChildren\",\n    \"urlPreview\",\n    \"widget\",\n] as const;\n\n/** A key of a property's `admin` block. @group Models */\nexport type AdminPropertyKey = typeof ADMIN_PROPERTY_KEYS[number];\n\n/**\n * Move flattened admin keys back down into the `admin` block.\n *\n * The admin panel works with a *flat* view model — the block merged onto the\n * collection — so what comes back from a form has `icon` and `defaultViewMode`\n * at the top level while `admin` still holds whatever the file was loaded with.\n * This is the way back.\n *\n * **The top-level value wins.** It is the one the form just wrote; the block is\n * the copy the collection was loaded with, and preferring it resolves every edit\n * in favour of the value the user changed away from.\n *\n * This lives here, next to the key lists, because it had two implementations —\n * `toAdminCollectionConfig` in `@rebasepro/admin-types` and `nestAdminKeys` in\n * `@rebasepro/server`'s schema editor — that agreed on everything except that\n * precedence, which is the only part that decides whether a save is visible.\n *\n * @group Models\n */\nexport function nestAdminKeysOf(\n    source: Record<string, unknown>,\n    adminKeys: readonly string[]\n): Record<string, unknown> {\n    const keys = new Set<string>(adminKeys);\n    const top: Record<string, unknown> = {};\n    const block: Record<string, unknown> = { ...((source.admin as Record<string, unknown> | undefined) ?? {}) };\n\n    for (const [key, value] of Object.entries(source)) {\n        if (key === \"admin\") continue;\n        if (keys.has(key)) block[key] = value;\n        else top[key] = value;\n    }\n\n    if (Object.keys(block).length > 0) top.admin = block;\n    return top;\n}\n\n/**\n * {@link nestAdminKeysOf} for a collection.\n *\n * @group Models\n */\nexport function nestAdminCollectionKeys(collection: Record<string, unknown>): Record<string, unknown> {\n    return nestAdminKeysOf(collection, ADMIN_COLLECTION_KEYS);\n}\n\n/**\n * {@link nestAdminKeysOf} for a property, applied to its children too.\n *\n * A map property carries `properties`, an array property carries `of`, and both\n * hold properties with `admin` blocks of their own. A flat `readOnly` left on a\n * child is as dead — and as fatal at the next boot — as one left on the parent,\n * so the walk goes all the way down.\n *\n * @group Models\n */\nexport function nestAdminPropertyKeys(property: Record<string, unknown>): Record<string, unknown> {\n    const nested = nestAdminKeysOf(property, ADMIN_PROPERTY_KEYS);\n\n    const children = nested.properties;\n    if (children && typeof children === \"object\" && !Array.isArray(children)) {\n        nested.properties = Object.fromEntries(\n            Object.entries(children as Record<string, unknown>).map(([key, child]) => [\n                key,\n                child && typeof child === \"object\" && !Array.isArray(child)\n                    ? nestAdminPropertyKeys(child as Record<string, unknown>)\n                    : child\n            ])\n        );\n    }\n\n    const of = nested.of;\n    if (Array.isArray(of)) {\n        nested.of = of.map(entry => entry && typeof entry === \"object\" && !Array.isArray(entry)\n            ? nestAdminPropertyKeys(entry as Record<string, unknown>)\n            : entry);\n    } else if (of && typeof of === \"object\") {\n        nested.of = nestAdminPropertyKeys(of as Record<string, unknown>);\n    }\n\n    return nested;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCA,IAAa,wBAAwB;CACjC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACJ;;;;;;;;;;;;;;;;;;AAsBA,IAAa,sBAAsB;CAC/B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACJ;;;;;;;;;;;;;;;;;;;;AAwBA,SAAgB,gBACZ,QACA,WACuB;CACvB,MAAM,OAAO,IAAI,IAAY,SAAS;CACtC,MAAM,MAA+B,CAAC;CACtC,MAAM,QAAiC,EAAE,GAAK,OAAO,SAAiD,CAAC,EAAG;CAE1G,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,MAAM,GAAG;EAC/C,IAAI,QAAQ,SAAS;EACrB,IAAI,KAAK,IAAI,GAAG,GAAG,MAAM,OAAO;OAC3B,IAAI,OAAO;CACpB;CAEA,IAAI,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,GAAG,IAAI,QAAQ;CAC/C,OAAO;AACX;;;;;;AAOA,SAAgB,wBAAwB,YAA8D;CAClG,OAAO,gBAAgB,YAAY,qBAAqB;AAC5D;;;;;;;;;;;AAYA,SAAgB,sBAAsB,UAA4D;CAC9F,MAAM,SAAS,gBAAgB,UAAU,mBAAmB;CAE5D,MAAM,WAAW,OAAO;CACxB,IAAI,YAAY,OAAO,aAAa,YAAY,CAAC,MAAM,QAAQ,QAAQ,GACnE,OAAO,aAAa,OAAO,YACvB,OAAO,QAAQ,QAAmC,CAAC,CAAC,KAAK,CAAC,KAAK,WAAW,CACtE,KACA,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IACpD,sBAAsB,KAAgC,IACtD,KACV,CAAC,CACL;CAGJ,MAAM,KAAK,OAAO;CAClB,IAAI,MAAM,QAAQ,EAAE,GAChB,OAAO,KAAK,GAAG,KAAI,UAAS,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAChF,sBAAsB,KAAgC,IACtD,KAAK;MACR,IAAI,MAAM,OAAO,OAAO,UAC3B,OAAO,KAAK,sBAAsB,EAA6B;CAGnE,OAAO;AACX"}

package/dist/api/ast-schema-editor.d.ts

@@ -1,11 +1,11 @@
 /**
  * Move presentation keys into the `admin` block.
  *
- * `ADMIN_COLLECTION_KEYS` comes from `@rebasepro/types` rather than being spelled
- * out here, so adding a field to `AdminCollectionOptions` cannot leave this writer
- * behind. Any such key already inside `admin` wins over a top-level copy: the
- * nested one is what the file said, and a flat duplicate is the view model's
- * flattening leaking back.
+ * The rule itself lives in `@rebasepro/types`, next to `ADMIN_COLLECTION_KEYS`,
+ * because `@rebasepro/admin-types` has to apply the identical one on the panel's
+ * side and this package cannot import that one. Two copies used to exist and
+ * they disagreed about precedence, which decided whether a presentation edit was
+ * saved or silently reverted to the value the user had just changed away from.
  */
 export declare function nestAdminKeys(collectionData: Record<string, unknown>): Record<string, unknown>;
 export declare class AstSchemaEditor {
@@ -22,10 +22,78 @@ export declare class AstSchemaEditor {
      */
     private safePath;
     private getCollectionFile;
+    /**
+     * Find the object literal a collection is declared with, through whatever
+     * wraps it.
+     *
+     * `defineCollection({ … })` is the shape `rebase init` writes and the one the
+     * docs recommend; `satisfies` / `as` / parentheses are the other ways an
+     * author can dress the same literal. Returning `null` for any of them meant
+     * the three callers below each failed differently, and the worst of them
+     * overwrote the file.
+     */
+    private unwrapCollectionObject;
     private getCollectionObject;
+    /**
+     * The collection's object literal, or a refusal that says what to do.
+     *
+     * Every caller needs this to be all-or-nothing: a missing object literal used
+     * to mean "throw", "report success and do nothing" and "recreate the file
+     * from scratch" depending on which method you called.
+     */
+    private requireCollectionObject;
+    private unreadableFileMessage;
+    /** Look a key up on an object literal, quoted or not. */
+    private findProperty;
+    private static quoteKey;
+    private static isPlainObject;
     private convertJsonToAstString;
+    /**
+     * Write only the keys the patch names, leaving every sibling alone.
+     *
+     * A patch says what changed, not what the collection is. The panel sends one
+     * — `{ propertiesOrder }` is what adding a column posts — and rewriting the
+     * `admin` block from it deleted the collection's icon, group, list columns
+     * and kanban config in the same write.
+     */
+    private mergeIntoObjectLiteral;
     saveProperty(collectionId: string, propertyKey: string, propertyConfig: Record<string, unknown>): Promise<void>;
     deleteProperty(collectionId: string, propertyKey: string): Promise<void>;
-    saveCollection(collectionId: string, collectionData: Record<string, unknown>): Promise<void>;
+    /**
+     * Write a collection back to its file.
+     *
+     * `partial` is the difference between "this is the collection" and "this is
+     * what changed about it". The panel sends both — a full save from the editor
+     * dialog, and a one-key patch whenever a property is added, deleted or
+     * reordered — and they cannot be told apart by looking at the payload. Read
+     * as a full save, a patch deletes everything it does not mention, including
+     * `securityRules`; the loader then hands the collection the directory
+     * default, which in the scaffold is `access: "public"`.
+     */
+    saveCollection(collectionId: string, collectionData: Record<string, unknown>, options?: {
+        partial?: boolean;
+    }): Promise<void>;
+    /**
+     * Write the collection-level `relations` array.
+     *
+     * Relations are the one key whose values are not all data: `target` is a
+     * thunk in the file, and the panel sends the target collection's slug (or,
+     * for a relation it did not touch, nothing at all — `JSON.stringify` drops
+     * the function). So each entry's target is resolved in that order: a slug
+     * becomes `() => xCollection` plus the import it needs, and anything else
+     * falls back to the thunk already in the file.
+     *
+     * This used to be a `continue` with a comment saying relations were handled
+     * elsewhere. Nothing handled them; every edit in the Relations tab was
+     * dropped without a word.
+     */
+    private writeRelations;
+    /**
+     * `() => targetCollection` for a target named by its slug, importing it if
+     * the file does not already.
+     */
+    private targetThunk;
+    private hasDefaultImport;
+    private getDefaultExportName;
     deleteCollection(collectionId: string): Promise<void>;
 }

package/dist/api/errors.d.ts

@@ -55,12 +55,6 @@ export interface RebaseApiError extends Error {
     code?: string;
     details?: unknown;
 }
-/**
- * Type guard for errors that carry optional API metadata (statusCode, code, details).
- * Returns true for any Error instance — the optional properties are then
- * checked via normal property access.
- */
-export declare function isRebaseApiError(error: unknown): error is RebaseApiError;
 /**
  * Hono error-handling middleware (`app.onError`).
  * Converts any error into the canonical `{ error: { message, code } }` shape.

package/dist/api/openapi-generator.d.ts

@@ -12,5 +12,19 @@ export interface OpenApiGeneratorOptions {
     basePath?: string;
     /** Whether auth is enabled on data routes. Defaults to true. */
     requireAuth?: boolean;
+    /**
+     * The list-pagination bounds the REST layer applies, so the spec states the
+     * ones a request will actually meet.
+     *
+     * These were hardcoded as `default: 20, maximum: 100` — neither of which
+     * the server has ever used. The spec drives the API Explorer and is what a
+     * generated client is built from, so an understated ceiling is a request
+     * the client refuses to make, and an overstated one is a 400 nobody
+     * predicted.
+     */
+    listLimits?: {
+        defaultLimit?: number;
+        maxLimit?: number;
+    };
 }
 export declare function generateOpenApiSpec(collections: CollectionConfig[], options?: OpenApiGeneratorOptions): Record<string, unknown>;

package/dist/api/rest/api-generator.d.ts

@@ -54,7 +54,7 @@ export declare class RestApiGenerator {
      * Needed so a nested write can be checked against a schema at all. Without
      * it these routes skipped `assertKnownWriteFields` entirely, which is why a
      * typo `POST /posts` rejected with a 400 while the same typo on
-     * `POST /authors/1/posts` reached the database.
+     * `POST /authors/1/posts` was dropped from the statement and answered 201.
      *
      * Returns `undefined` rather than throwing when the path cannot be walked:
      * the driver raises the authoritative error a moment later, and duplicating

package/dist/api/rest/idempotency.d.ts

@@ -1,9 +1,67 @@
 import { DataDriver } from "@rebasepro/types";
+/**
+ * What a key was claimed *for*, so presenting it on a different request is
+ * caught instead of silently replaying the first one's answer.
+ *
+ * Nothing about the request used to enter the key, so `createMany(rows, { key })`
+ * followed by `deleteMany(ids, { key })` — the reusable business id the docs
+ * recommended — answered the delete with the create's `200` body and deleted
+ * nothing. Method and path separate the routes; the body separates a re-run
+ * carrying corrected rows from the retry of an unanswered one, which is the
+ * difference between "here is your earlier answer" and silently discarding a
+ * correction.
+ */
+export declare function requestFingerprint(method: string, path: string, body: unknown): string;
+/**
+ * What a caller may do with a key.
+ *
+ * `claimed` is the only outcome that permits the write. Recalling and then
+ * writing was not atomic: two requests carrying one key both missed the recall,
+ * both wrote, and `ON CONFLICT DO NOTHING` protected only the second row in
+ * *this* table — the duplicate row in the caller's collection, which is the
+ * thing the mechanism exists to prevent, was inserted anyway. The offline queue
+ * is shared across tabs, so two tabs reconnecting together is the ordinary case
+ * rather than an exotic one.
+ */
+export type IdempotencyClaim = 
+/** This key has already been answered; serve that answer again. */
+{
+    status: "replay";
+    response: unknown;
+}
+/** Another request holds this key and has not answered yet. */
+ | {
+    status: "in-flight";
+}
+/** This key is live, but it was claimed for a different request. */
+ | {
+    status: "mismatch";
+}
+/** The key is ours; do the write, then `complete` or `release` it. */
+ | {
+    status: "claimed";
+};
 export interface IdempotencyStore {
-    /** What this key answered before, or `undefined` if it is new. */
-    recall(key: string, uid: string | undefined): Promise<unknown | undefined>;
-    /** Record what this key answered. Never throws — see {@link createIdempotencyStore}. */
-    remember(key: string, uid: string | undefined, response: unknown): Promise<void>;
+    /**
+     * Take the key if it is free, atomically. Never throws — a store that
+     * cannot answer reports `claimed`, which degrades to no idempotency rather
+     * than to a refused write.
+     *
+     * `fingerprint` says what the key is being claimed for (see
+     * {@link requestFingerprint}); a live key presented with a different one is
+     * a reused key, not a replay, and is reported as `mismatch`.
+     */
+    claim(key: string, uid: string | undefined, fingerprint: string): Promise<IdempotencyClaim>;
+    /** Record what this key answered. Never throws. */
+    complete(key: string, uid: string | undefined, response: unknown): Promise<void>;
+    /**
+     * Give the key back after the write it was claimed for failed.
+     *
+     * Without this a transient failure strands the key until its lease runs
+     * out, turning one failed write into a minute of refused retries. The lease
+     * is the floor, not the mechanism: it only covers the exits no code runs on.
+     */
+    release(key: string, uid: string | undefined): Promise<void>;
 }
 /**
  * Returns `undefined` when the driver cannot run SQL, which disables the whole

package/dist/api/rest/query-parser.d.ts

@@ -1,3 +1,4 @@
+import type { ListLimitBounds } from "@rebasepro/types";
 import { QueryOptions } from "../types";
 export declare const mapOperator: (op: string) => import("@rebasepro/types").WhereFilterOp | null;
 export { DEFAULT_LIST_LIMIT, DEFAULT_VECTOR_LIST_LIMIT, MAX_LIST_LIMIT } from "@rebasepro/types";
@@ -13,9 +14,22 @@ export interface ListLimitOptions {
      * text-search reads — a vector search falls back to its own default (10).
      */
     defaultLimit?: number;
-    /** Upper bound clamped onto any client-supplied `?limit`. */
+    /** Largest `?limit` a client may ask for. A larger one is a 400, not a clamp. */
     maxLimit?: number;
 }
+/**
+ * {@link resolveClientListLimit} for an HTTP route: the same bounds, answered
+ * with a 400 rather than a 500.
+ *
+ * The shared resolver throws a `ListLimitError`, which carries `status` — but
+ * the Hono error handler discriminates on `statusCode`, so an unconverted one
+ * reaches the client as `INTERNAL_ERROR` with its message stripped, telling the
+ * caller nothing about the parameter it got wrong. Every REST list ingress
+ * routes its `limit` through here so all of them name the ceiling the same way.
+ */
+export declare function resolveListLimitParam(rawLimit: number | string | null | undefined, opts?: ListLimitBounds & {
+    vectorSearch?: boolean;
+}): number;
 /**
  * Parse query parameters into QueryOptions
  */

package/dist/api/rest/write-validation.d.ts

@@ -2,10 +2,18 @@ import { CollectionConfig } from "@rebasepro/types";
 /**
  * Reject a write naming a field the collection does not have.
  *
- * Unknown keys used to travel all the way into the INSERT, where Postgres
- * rejected them — so a typo came back as `column "titel" does not exist`,
- * phrased by the database, from a stack the caller cannot see, and only if the
- * column really was absent. It is a request problem and belongs in a 400.
+ * An unknown key does *not* reach the INSERT and come back as `column "titel"
+ * does not exist`, which is what this comment used to claim. Drizzle builds
+ * INSERT and UPDATE from the table's own column list, so a key the table does
+ * not carry is left out of the statement: the write answers 201 having stored
+ * nothing under that name. A typo is a request problem, it belongs in a 400,
+ * and nothing below this was ever going to raise one.
+ *
+ * This is the config-level check and it is skipped on several paths (see the
+ * `strictWrites` bail below, and the auth-adapter contract at the call site).
+ * `assertWritableColumns` in the Postgres driver is the backstop every write
+ * passes through, including in-process `rebase.data` writes that never come
+ * near this layer.
  *
  * What counts as known:
  * - a declared property (for an introspected BaaS collection these *are* the
@@ -20,6 +28,34 @@ export declare function assertKnownWriteFields(values: Record<string, unknown>,
     rowIndex?: number;
     extraKnownFields?: readonly string[];
 }): void;
+/**
+ * Reject a write whose values break the constraints the collection declares.
+ *
+ * `validation.min`, `max`, `matches`, `positive`, `integer` and the date and
+ * array bounds were read by exactly three things: the DDL generators (for
+ * `integer` and for a `varchar` width), and the admin's client-side form. No
+ * layer on the write path looked at them, no `CHECK` constraint was emitted,
+ * and the generated OpenAPI published every one of them as `minimum`,
+ * `maximum`, `minLength`, `maxLength` and `pattern`. So the docs' own example —
+ * `price: { type: "number", validation: { min: 0 } }` — accepted `-5000` with a
+ * 201 while the spec said it would not, and any client or gateway generated
+ * from that spec believed the server was checking.
+ *
+ * Only `required` is left to the database, where it is a NOT NULL: a partial
+ * update legitimately omits keys, and this function sees one request's values,
+ * not the row they land on.
+ *
+ * A value of the wrong *type* is not this function's business — that reaches
+ * Postgres, which types every column and gives a 400 through the driver's
+ * SQLSTATE mapping. Constraints are checked against values of the right type,
+ * plus the numeric-string form a JSON body may carry for a number column.
+ *
+ * Every failing field is reported at once. A form that fixes one field per
+ * round trip is the reason validation errors get ignored.
+ */
+export declare function assertWriteValuesValid(values: Record<string, unknown>, collection: CollectionConfig, options?: {
+    rowIndex?: number;
+}): void;
 /**
  * Narrow response rows to the fields the caller asked for.
  *
@@ -33,11 +69,18 @@ export declare function assertKnownWriteFields(values: Record<string, unknown>,
  * This shapes the *response*, which is what the parameter says it does; it is
  * not a column pushdown, so it saves bandwidth rather than database work.
  *
- * `id` always survives. Rows are addressed by it everywhere above this layer —
- * the admin table, realtime reconciliation, the offline cache — and a row that
- * arrives without one is not a smaller row, it is an unusable one. Asking for
- * `fields=title` and being unable to open the record you clicked is a worse
- * answer than one extra key.
+ * The collection's key always survives. Rows are addressed by it everywhere
+ * above this layer — the admin table, realtime reconciliation, the offline
+ * cache — and a row that arrives without one is not a smaller row, it is an
+ * unusable one. Asking for `fields=title` and being unable to open the record
+ * you clicked is a worse answer than one extra key.
+ *
+ * That is a statement about the key, not about the name `id`: a collection
+ * keyed on `slug`, or on `user_id + role_id`, was projected down to the fields
+ * asked for and nothing else, which is the very outcome the paragraph above
+ * describes. `assertKnownWriteFields` one function up already has a dedicated
+ * error for collections with no `id` column, so this layer had no excuse for
+ * assuming one.
  */
 export declare function projectResponseFields<T extends Record<string, unknown>>(rows: T[], fields: readonly string[] | undefined, collection: CollectionConfig, options?: {
     include?: readonly string[];

package/dist/auth/adapter-middleware.d.ts

@@ -9,7 +9,9 @@
  * 1. Checks for API key tokens (`rk_` prefix) first — these are Rebase-level
  * 2. Falls back to `adapter.verifyRequest(request)` to resolve the user
  * 3. Scopes the DataDriver via `withAuth()` for RLS
- * 4. Enforces auth (401) when `requireAuth` is true and no user is found
+ * 4. Rejects a presented-but-unverifiable token with 401, whatever
+ *    `requireAuth` says
+ * 5. Enforces auth (401) when `requireAuth` is true and no user is found
  *
  * The behavior is identical to `createAuthMiddleware()` — only the
  * token verification strategy is pluggable.

package/dist/auth/apple-oauth.d.ts

@@ -1,4 +1,19 @@
 import type { OAuthProvider } from "./interfaces";
+import { type OAuthCodeFlowPayload } from "./oauth-code-flow";
+/** Extra field Apple's client sends that no other provider has. */
+export interface AppleCodeFlowPayload extends OAuthCodeFlowPayload {
+    /**
+     * Apple sends the user's *name* only on the first authorization, so the
+     * frontend has to forward it. It is display data and nothing else — the
+     * identity email comes from the id_token, never from the request body.
+     */
+    user?: {
+        name?: {
+            firstName?: string;
+            lastName?: string;
+        };
+    };
+}
 /**
  * Creates an Apple Sign In OAuth Provider integration.
  *
@@ -17,14 +32,4 @@ export declare function createAppleProvider(config: {
     keyId: string;
     /** The raw PEM contents of the .p8 private key file */
     privateKey: string;
-}): OAuthProvider<{
-    code: string;
-    redirectUri: string;
-    user?: {
-        name?: {
-            firstName?: string;
-            lastName?: string;
-        };
-        email?: string;
-    };
-}>;
+}): OAuthProvider<AppleCodeFlowPayload>;

package/dist/auth/bitbucket-oauth.d.ts

@@ -1,11 +1,9 @@
 import type { OAuthProvider } from "./interfaces";
+import { type OAuthCodeFlowPayload } from "./oauth-code-flow";
 /**
  * Creates a Bitbucket OAuth Provider integration (OAuth 2.0 consumer).
  */
 export declare function createBitbucketProvider(config: {
     clientId: string;
     clientSecret: string;
-}): OAuthProvider<{
-    code: string;
-    redirectUri: string;
-}>;
+}): OAuthProvider<OAuthCodeFlowPayload>;

package/dist/auth/builtin-auth-adapter.d.ts

@@ -45,6 +45,8 @@ export interface BuiltinAuthAdapterConfig {
     defaultRole?: string;
     /** OAuth providers to register. */
     oauthProviders?: OAuthProvider<unknown>[];
+    /** Redirect URIs the OAuth routes accept, for every provider. */
+    allowedRedirectUris?: string[];
     /** Static service key for server-to-server auth. */
     serviceKey?: string;
     /** Auth hooks for customizing password, credentials, lifecycle, etc. */

package/dist/auth/discord-oauth.d.ts

@@ -1,14 +1,13 @@
 import type { OAuthProvider } from "./interfaces";
+import { type OAuthCodeFlowPayload } from "./oauth-code-flow";
 /**
  * Creates a Discord OAuth2 Provider integration.
  *
- * Uses the authorization code flow. Requires the "identify" and "email"
- * scopes to retrieve the user's email and profile information.
+ * Uses the authorization code flow (with PKCE when the client supplies a
+ * verifier). Requires the "identify" and "email" scopes to retrieve the
+ * user's email and profile information.
  */
 export declare function createDiscordProvider(config: {
     clientId: string;
     clientSecret: string;
-}): OAuthProvider<{
-    code: string;
-    redirectUri: string;
-}>;
+}): OAuthProvider<OAuthCodeFlowPayload>;

package/dist/auth/facebook-oauth.d.ts

@@ -1,4 +1,5 @@
 import type { OAuthProvider } from "./interfaces";
+import { type OAuthCodeFlowPayload } from "./oauth-code-flow";
 /**
  * Creates a Facebook / Meta OAuth Provider integration.
  *
@@ -8,7 +9,4 @@ import type { OAuthProvider } from "./interfaces";
 export declare function createFacebookProvider(config: {
     clientId: string;
     clientSecret: string;
-}): OAuthProvider<{
-    code: string;
-    redirectUri: string;
-}>;
+}): OAuthProvider<OAuthCodeFlowPayload>;

package/dist/auth/github-oauth.d.ts

@@ -1,4 +1,5 @@
 import type { OAuthProvider } from "./interfaces";
+import { type OAuthCodeFlowPayload } from "./oauth-code-flow";
 /**
  * Creates a GitHub OAuth Provider integration.
  *
@@ -9,7 +10,4 @@ import type { OAuthProvider } from "./interfaces";
 export declare function createGitHubProvider(config: {
     clientId: string;
     clientSecret: string;
-}): OAuthProvider<{
-    code: string;
-    redirectUri: string;
-}>;
+}): OAuthProvider<OAuthCodeFlowPayload>;

package/dist/auth/gitlab-oauth.d.ts

@@ -1,13 +1,15 @@
 import type { OAuthProvider } from "./interfaces";
+import { type OAuthCodeFlowPayload } from "./oauth-code-flow";
 /**
  * Creates a GitLab OAuth Provider integration.
  * Works with both GitLab.com and self-hosted instances.
+ *
+ * `baseUrl` is configuration only and must stay that way: a caller-supplied
+ * instance URL would make this provider an SSRF primitive and an
+ * arbitrary-identity oracle in one step.
  */
 export declare function createGitLabProvider(config: {
     clientId: string;
     clientSecret: string;
     baseUrl?: string;
-}): OAuthProvider<{
-    code: string;
-    redirectUri: string;
-}>;
+}): OAuthProvider<OAuthCodeFlowPayload>;

package/dist/auth/google-oauth.d.ts

@@ -44,4 +44,5 @@ export declare function createGoogleProvider(config: GoogleProviderConfig | stri
     accessToken?: string;
     code?: string;
     redirectUri?: string;
+    codeVerifier?: string;
 }>;

package/dist/auth/index.d.ts

@@ -1,5 +1,5 @@
 export * from "./interfaces";
-export { configureJwt, generateAccessToken, verifyAccessToken, generateRefreshToken, hashRefreshToken, getRefreshTokenExpiry, getAccessTokenExpiry, generateDownloadToken, verifyDownloadToken } from "./jwt";
+export { configureJwt, isJwtConfigured, generateAccessToken, verifyAccessToken, generateRefreshToken, hashRefreshToken, getRefreshTokenExpiry, getAccessTokenExpiry, generateDownloadToken, verifyDownloadToken } from "./jwt";
 export type { JwtConfig, AccessTokenPayload, DownloadTokenPayload } from "./jwt";
 export { hashPassword, verifyPassword, validatePasswordStrength } from "./password";
 export { safeCompare } from "./crypto-utils";
@@ -21,6 +21,13 @@ export { createGitLabProvider } from "./gitlab-oauth";
 export { createBitbucketProvider } from "./bitbucket-oauth";
 export { createSlackProvider } from "./slack-oauth";
 export { createSpotifyProvider } from "./spotify-oauth";
+export type { AppleCodeFlowPayload } from "./apple-oauth";
+export { oauthCodeFlowSchema, pkceTokenParams, providerVerifiedEmail } from "./oauth-code-flow";
+export type { OAuthCodeFlowPayload } from "./oauth-code-flow";
+export { verifyOidcIdToken, tryVerifyOidcIdToken } from "./oidc-id-token";
+export type { OidcIdTokenClaims, VerifyOidcIdTokenOptions } from "./oidc-id-token";
+export { decideOAuthAutoLink, isRedirectUriAllowed } from "./oauth-signin-policy";
+export type { AutoLinkDecision, AutoLinkRefusal } from "./oauth-signin-policy";
 export { requireAuth, requireAdmin, optionalAuth, extractUserFromToken, createAuthMiddleware, queryTokenAuth, fileTokenAuth } from "./middleware";
 export type { AuthMiddlewareOptions, AuthResult } from "./middleware";
 export { createAuthRoutes } from "./routes";