@rebasepro/server 0.13.0 → 0.13.1-canary.g06dbe5b

package/dist/{src-Cum9kox5.js → src-By48Ffg0.js}

@@ -2,7 +2,64 @@ import { createRequire as __createRequire } from "module";
 import "process";
 __createRequire(import.meta.url);
 import { r as __require, t as __commonJSMin } from "./rolldown-runtime-DSJWtz9O.js";
-import { c as NULL_OPS, i as isRelationalCollectionConfig, l as REST_TO_CANONICAL, n as getDeclaredSubcollections, o as getDataSourceCapabilities, r as isPostgresCollectionConfig, s as CANONICAL_TO_REST, u as toCanonicalOp } from "./src-_qQ3RNCK.js";
+import { a as getDeclaredSubcollections, d as NULL_OPS, f as REST_TO_CANONICAL, l as getDataSourceCapabilities, o as isPostgresCollectionConfig, p as toCanonicalOp, s as isRelationalCollectionConfig, u as CANONICAL_TO_REST } from "./src-Ca6NhxKs.js";
+//#region ../types/src/errors.ts
+/**
+* The single error type thrown across the entire Rebase client surface —
+* HTTP data/control-plane calls, realtime/WebSocket operations, and
+* client-side logic errors (e.g. an unknown collection accessor). A `catch`
+* block only ever needs to check for this one class:
+*
+* ```ts
+* import { RebaseApiError } from "@rebasepro/client"; // re-exported
+*
+* try {
+*   await client.data.products.update(id, { price: 9 });
+* } catch (e) {
+*   if (e instanceof RebaseApiError) {
+*     if (e.status === 404) { ... }   // HTTP failures carry a status
+*     console.error(e.code, e.details);
+*   }
+* }
+* ```
+*
+* `status` is present for HTTP failures and `undefined` otherwise, so its
+* presence distinguishes transport-level errors from realtime/logic errors.
+*
+* @group Errors
+*/
+var RebaseApiError = class extends Error {
+	/** HTTP status code, or `undefined` for non-HTTP errors. */
+	status;
+	/** Stable machine-readable error code, when the server supplied one. See {@link RebaseErrorCode}. */
+	code;
+	/** Structured error payload from the server, when present. */
+	details;
+	constructor(message, init = {}) {
+		super(message);
+		this.name = "RebaseApiError";
+		this.status = init.status;
+		this.code = init.code;
+		this.details = init.details;
+		if (init.cause !== void 0) this.cause = init.cause;
+	}
+};
+/**
+* Client-side logic error — raised before any request is made (e.g. accessing
+* an unknown collection accessor when a typed dictionary is configured).
+*
+* A subclass of {@link RebaseApiError} (with no `status`), so a single
+* `catch (e) { if (e instanceof RebaseApiError) ... }` handles it too.
+*
+* @group Errors
+*/
+var RebaseClientError = class extends RebaseApiError {
+	constructor(message) {
+		super(message);
+		this.name = "RebaseClientError";
+	}
+};
+//#endregion
 //#region ../types/src/types/entities.ts
 /**
 * Class used to create a reference to a entity in a different path.
@@ -129,7 +186,7 @@ var Vector = class {
 //#endregion
 //#region ../types/src/types/policy.ts
 /**
-* The id a request without a logged-in user reports as `auth.uid()`.
+* The id a request without a logged-in user reports as `rebase.uid()`.
 *
 * A user-context request always sets `app.uid`: blank would read back as
 * `NULL`, and `NULL` is how the trusted server context is recognised, so an
@@ -137,7 +194,7 @@ var Vector = class {
 * therefore substitutes this sentinel at the single chokepoint where the GUC
 * is set.
 *
-* The consequence for policy authors is that **`auth.uid() IS NOT NULL` is a
+* The consequence for policy authors is that **`rebase.uid() IS NOT NULL` is a
 * tautology on the user path** — it is true for anonymous visitors too. Use
 * {@link policy.authenticated} to mean "signed in", and
 * {@link policy.serverContext} to mean "the trusted server context". Do not
@@ -154,7 +211,7 @@ var ANONYMOUS_USER_ID = "anonymous";
 * JavaScript evaluator and the linter were all built on
 * {@link ANONYMOUS_USER_ID}, while the request path scoped unauthenticated
 * callers as `'anon'` — so `policy.authenticated()`, which compiled to
-* `auth.uid() <> 'anonymous'`, was *true* for an anonymous visitor. The
+* `rebase.uid() <> 'anonymous'`, was *true* for an anonymous visitor. The
 * sanctioned way to write "signed in" granted to everyone, and the linter
 * flagged the spelling that actually worked as a foreign convention.
 *
@@ -235,6 +292,54 @@ var policy = {
 	authUid: () => ({ kind: "authUid" }),
 	authRoles: () => ({ kind: "authRoles" })
 };
+/** Largest `limit` a client may ask for on any surface. Above it, the read is refused. */
+var MAX_LIST_LIMIT = 1e3;
+/**
+* Thrown by {@link resolveClientListLimit} for a `limit` the platform will not
+* serve. Carries an HTTP status so an ingress that speaks HTTP can forward it
+* verbatim, and `maxLimit` so one can be built without re-deriving the ceiling.
+*
+* @group Errors
+*/
+var ListLimitError = class ListLimitError extends RebaseApiError {
+	/** The ceiling that was exceeded — what the caller should page by instead. */
+	maxLimit;
+	constructor(message, maxLimit) {
+		super(message, {
+			status: 400,
+			code: "INVALID_LIMIT"
+		});
+		this.name = "ListLimitError";
+		this.maxLimit = maxLimit;
+		Object.setPrototypeOf(this, ListLimitError.prototype);
+	}
+};
+/**
+* Resolve a client-supplied list `limit` into a safe, always-defined value.
+*
+* - An absent / blank limit falls back to the mode default:
+*   `vectorDefaultLimit` for a vector search, otherwise `defaultLimit`.
+* - A limit that is present must be an integer in `[1, maxLimit]`. Anything
+*   else — `0`, a negative, `1.5`, `abc`, `100000000` — throws
+*   {@link ListLimitError} rather than being coerced into range, because every
+*   coercion answers a question the caller did not ask with a page it cannot
+*   tell apart from the whole collection.
+*
+* The return is never `undefined` — no ingress that routes its client limit
+* through this can produce an unbounded read.
+*
+* @throws {ListLimitError} when a present `limit` is not an integer in range.
+*/
+function resolveClientListLimit(rawLimit, opts = {}) {
+	const maxLimit = opts.maxLimit ?? 1e3;
+	if (rawLimit != null && String(rawLimit).trim() !== "") {
+		const parsed = typeof rawLimit === "number" ? rawLimit : Number(String(rawLimit).trim());
+		if (!Number.isInteger(parsed) || parsed < 1) throw new ListLimitError(`Invalid \`limit\`: ${String(rawLimit)}. Expected a whole number between 1 and ${maxLimit}.`, maxLimit);
+		if (parsed > maxLimit) throw new ListLimitError(`\`limit\` ${parsed} is above the maximum of ${maxLimit}. Ask for at most ${maxLimit} rows per read and page through the rest with \`offset\` — answering with a smaller page would be indistinguishable from there being no more rows.`, maxLimit);
+		return parsed;
+	}
+	return opts.vectorSearch ? opts.vectorDefaultLimit ?? 10 : opts.defaultLimit ?? 50;
+}
 (/* @__PURE__ */ __commonJSMin(((exports, module) => {
 	(function(e) {
 		var t;
@@ -1382,10 +1487,21 @@ function singularizeForKey(name) {
 * have `id` and `path` fields — these are relation-shaped objects from
 * edge cases in the data pipeline (REST fallback, stale cache, custom data source).
 *
+* When `targetPath` is given, also accepts a bare id. A relation column is a
+* foreign key, and the REST layer returns it as the scalar it is; only some
+* fetch paths hydrate it into an object. Which form a caller sees therefore
+* depends on how the row was loaded, and a caller that only accepted objects
+* reported half of its own data as a type error. The declared target is the
+* missing half: with it, an id is a relation that has not been fetched yet.
+*
 * Returns null if the value cannot be coerced.
 */
-function normalizeToEntityRelation(value, propertyType) {
+function normalizeToEntityRelation(value, propertyType, targetPath) {
 	if (value instanceof EntityRelation) return value;
+	if (targetPath && (typeof value === "string" || typeof value === "number")) {
+		if (value === "") return null;
+		return new EntityRelation(value, targetPath);
+	}
 	if (!value || typeof value !== "object" || Array.isArray(value)) return null;
 	const obj = value;
 	if (!(obj.__type === "relation" || obj.__type === "reference" || typeof obj.isEntityRelation === "function" && obj.isEntityRelation() || typeof obj.isEntityReference === "function" && obj.isEntityReference() || propertyType === "relation" && typeof obj.id !== "undefined" && typeof obj.path === "string")) return null;
@@ -1756,8 +1872,14 @@ function getSubcollections(collection) {
 * Rebase's enforcement model is unified: authenticated (user-context) requests
 * run under the restricted `rebase_user` role, so Postgres RLS binds *every*
 * statement — reads and writes. A collection's `securityRules` are the whole
-* authorization model. The server context (auth flows, migrations,
-* `dataAsAdmin`) runs as the owner and bypasses RLS.
+* authorization model. The server context (auth flows, migrations, raw
+* `rebase.sql`) runs as the owner and bypasses RLS.
+*
+* `rebase.dataAsAdmin` is **not** in that set, despite the name: it is scoped as
+* `{ uid: "service", roles: ["admin"] }`, so it runs as `rebase_user` like any
+* other caller and clears the baseline below through the *admin* arm, not the
+* server arm. Which is why `disableDefaultPolicies` plus a lone
+* `policy.serverContext()` rule locks it out too.
 *
 * Because RLS default-denies, every collection is **locked by default**: with
 * no rules, only the server context and admins can touch it. The generator
@@ -2883,8 +3005,24 @@ var QueryBuilder = class {
 	/**
 	* Set a free-text search string if supported by the backend.
 	*/
-	search(searchString) {
+	search(searchString, options) {
 		this.params.searchString = searchString;
+		if (options?.explain !== void 0) this.params.searchExplain = options.explain;
+		return this;
+	}
+	/**
+	* Order rows by nearest-neighbour distance to `vector`, closest first.
+	*
+	* Postgres only, over a property declared as `type: "vector"`. Rows come
+	* back with a `_distance`; `where` filters before the ordering.
+	*/
+	vectorSearch(property, vector, options) {
+		this.params.vectorSearch = {
+			property,
+			vector,
+			...options?.distance !== void 0 && { distance: options.distance },
+			...options?.threshold !== void 0 && { threshold: options.threshold }
+		};
 		return this;
 	}
 	/**
@@ -2941,6 +3079,30 @@ var RebasePaginationError = class RebasePaginationError extends Error {
 		Object.setPrototypeOf(this, RebasePaginationError.prototype);
 	}
 };
+/**
+* Resolve `limit`/`offset`/`page` into the window a read will actually use.
+*
+* Lives here, next to the walk, for the reason at the top of this file: every
+* transport has to mean the same thing by "page two". Four of them did not —
+* the REST layer strode by {@link DEFAULT_LIST_LIMIT}, the local-first
+* evaluator by {@link DEFAULT_PAGE_SIZE}, the in-process accessor by 20, and
+* the published type documented a fourth number. Pages that overlap or skip
+* rows are the mildest of those outcomes.
+*
+* `page` wins over `offset`, as {@link FindParams} documents. `driverOffset`
+* is the value to hand a driver: it stays `undefined` when the caller named no
+* offset, because keyset pagination seeks with a `where` clause and must not
+* look like it is paging by offset.
+*/
+function resolveFindWindow(params) {
+	const limit = params?.limit ?? 50;
+	const offset = params?.page != null ? Math.max(0, (params.page - 1) * limit) : params?.offset ?? 0;
+	return {
+		limit,
+		offset,
+		driverOffset: params?.page != null ? offset : params?.offset
+	};
+}
 function normalizePageSize(raw) {
 	if (raw === void 0 || !Number.isFinite(raw)) return 200;
 	return Math.max(1, Math.floor(raw));
@@ -3060,8 +3222,10 @@ async function collectAllPages(find, params, label = "collection") {
 * metadata, so type coercion is the responsibility of the server-side data
 * driver which has access to the collection schema.
 *
-* Commas inside list values are backslash-escaped (`\,`), and literal
-* backslashes are escaped as `\\`.
+* Structural characters inside a value are backslash-escaped: `,` → `\,`,
+* `(` → `\(`, `)` → `\)`, and a literal backslash as `\\`. Decoding is
+* deliberately conservative — only those four sequences are decoded, so a
+* backslash that arrives unescaped from an older client survives intact.
 *
 * @module
 */
@@ -3079,22 +3243,48 @@ function stringifyValue(value) {
 	return String(value);
 }
 /**
-* Escape a single list item for the wire format.
-* `\` → `\\`, `,` → `\,`
+* Characters that carry structure in the wire format and must therefore be
+* escaped inside a value: the separator, the group delimiters, and the escape
+* character itself.
+*
+* Parentheses are here because `and(...)`/`or(...)` groups are parsed by
+* tracking paren depth. A value containing one is not merely ambiguous, it
+* moves where the parser thinks the group ends.
 */
-function escapeListItem(value) {
-	return value.replace(/\\/g, "\\\\").replace(/,/g, "\\,");
+var WIRE_SPECIALS = /[\\,()]/g;
+/**
+* Escape a value for the wire format: `\` → `\\`, `,` → `\,`, `(` → `\(`,
+* `)` → `\)`.
+*/
+function escapeWireValue(value) {
+	return value.replace(WIRE_SPECIALS, (ch) => `\\${ch}`);
 }
 /**
-* Unescape a single list item from the wire format.
-* `\\` → `\`, `\,` → `,`
+* Unescape a wire-format value.
+*
+* **Conservative**, and deliberately so: only the four sequences
+* {@link escapeWireValue} actually produces are decoded. A backslash followed
+* by anything else is left exactly as it is.
+*
+* This used to consume the backslash before *any* character, which is
+* indistinguishable for anything this codec emitted — it only ever emits those
+* four — but not for input arriving from elsewhere. A client on an older
+* release sends a Windows path or a LIKE pattern with a literal `C:\x`
+* unescaped, and greedy unescaping silently turned it into `C:x`, changing
+* which rows matched. Decoding only what the encoder can produce makes the two
+* directions agree across versions.
 */
-function unescapeListItem(value) {
+function unescapeWireValue(value) {
 	let result = "";
-	for (let i = 0; i < value.length; i++) if (value[i] === "\\" && i + 1 < value.length) {
-		result += value[i + 1];
-		i++;
-	} else result += value[i];
+	for (let i = 0; i < value.length; i++) {
+		const next = value[i + 1];
+		if (value[i] === "\\" && (next === "\\" || next === "," || next === "(" || next === ")")) {
+			result += next;
+			i++;
+			continue;
+		}
+		result += value[i];
+	}
 	return result;
 }
 /**
@@ -3112,12 +3302,42 @@ function splitListItems(inner) {
 		current += inner[i] + inner[i + 1];
 		i++;
 	} else if (inner[i] === ",") {
-		items.push(unescapeListItem(current));
+		items.push(unescapeWireValue(current));
 		current = "";
 	} else current += inner[i];
-	items.push(unescapeListItem(current));
+	items.push(unescapeWireValue(current));
 	return items;
 }
+/**
+* Split a group body on commas at paren depth 0, honouring escapes.
+*
+* The escape-awareness is the point. The splitter used to track only paren
+* depth, so a comma inside a scalar value ended a condition:
+* `or(name.eq.Doe, John,age.gte.18)` parsed as *three* conditions, the middle
+* one a fabricated `" John" == true`. On an `or` that widens the result set,
+* and nothing anywhere reports an error — the query simply stops meaning what
+* the caller wrote.
+*/
+function splitGroupItems(inner) {
+	const parts = [];
+	let depth = 0;
+	let start = 0;
+	for (let i = 0; i < inner.length; i++) {
+		const ch = inner[i];
+		if (ch === "\\" && i + 1 < inner.length) {
+			i++;
+			continue;
+		}
+		if (ch === "(") depth++;
+		else if (ch === ")") depth--;
+		else if (ch === "," && depth === 0) {
+			parts.push(inner.slice(start, i));
+			start = i + 1;
+		}
+	}
+	parts.push(inner.slice(start));
+	return parts;
+}
 var REST_OP_LOOKUP = REST_TO_CANONICAL;
 var CANONICAL_OP_LOOKUP = CANONICAL_TO_REST;
 /**
@@ -3136,7 +3356,7 @@ function serializeTuple(tuple) {
 	if (typeof op !== "string") throw new TypeError(`serializeTuple: operator must be a string, got ${typeof op}`);
 	const restOp = CANONICAL_OP_LOOKUP[op];
 	if (!restOp) throw new TypeError(`serializeTuple: unknown operator "${op}". Valid operators: ${Object.keys(CANONICAL_TO_REST).join(", ")}`);
-	if (Array.isArray(value)) return `${restOp}.(${value.map((v) => escapeListItem(stringifyValue(v))).join(",")})`;
+	if (Array.isArray(value)) return `${restOp}.(${value.map((v) => escapeWireValue(stringifyValue(v))).join(",")})`;
 	return `${restOp}.${stringifyValue(value)}`;
 }
 /**
@@ -3246,40 +3466,20 @@ function serializeLogicalCondition(cond) {
 	}
 	const restOp = CANONICAL_OP_LOOKUP[cond.operator] ?? "eq";
 	if (Array.isArray(cond.value)) {
-		const items = cond.value.map((v) => escapeListItem(stringifyValue(v))).join(",");
+		const items = cond.value.map((v) => escapeWireValue(stringifyValue(v))).join(",");
 		return `${cond.column}.${restOp}.(${items})`;
 	}
-	return `${cond.column}.${restOp}.${stringifyValue(cond.value)}`;
+	return `${cond.column}.${restOp}.${escapeWireValue(stringifyValue(cond.value))}`;
 }
-/**
-* Parse a logical condition wire-format string back into a
-* `LogicalCondition` or `FilterCondition`.
-*
-* @example
-* deserializeLogicalCondition("status.eq.active")
-* // → { column: "status", operator: "==", value: "active" }
-*
-* deserializeLogicalCondition("or(status.eq.active,age.gte.18)")
-* // → { type: "or", conditions: [...] }
-*/
-function deserializeLogicalCondition(str) {
+function deserializeLogicalCondition(str, nesting = 0) {
+	if (nesting > 32) throw new Error(`Filter groups nest more than 32 levels deep. Flatten the condition — \`or(a,or(b,c))\` is \`or(a,b,c)\`.`);
 	const logicalMatch = str.match(/^(and|or)\((.+)\)$/);
 	if (logicalMatch) {
 		const type = logicalMatch[1];
 		const innerStr = logicalMatch[2];
-		const conditions = [];
-		let depth = 0;
-		let start = 0;
-		for (let i = 0; i < innerStr.length; i++) if (innerStr[i] === "(") depth++;
-		else if (innerStr[i] === ")") depth--;
-		else if (innerStr[i] === "," && depth === 0) {
-			conditions.push(deserializeLogicalCondition(innerStr.slice(start, i)));
-			start = i + 1;
-		}
-		conditions.push(deserializeLogicalCondition(innerStr.slice(start)));
 		return {
 			type,
-			conditions
+			conditions: splitGroupItems(innerStr).map((part) => deserializeLogicalCondition(part, nesting + 1))
 		};
 	}
 	const firstDot = str.indexOf(".");
@@ -3294,7 +3494,7 @@ function deserializeLogicalCondition(str) {
 	if (secondDot === -1) return {
 		column,
 		operator: "==",
-		value: rest
+		value: unescapeWireValue(rest)
 	};
 	const opStr = rest.substring(0, secondDot);
 	const valueStr = rest.substring(secondDot + 1);
@@ -3307,7 +3507,7 @@ function deserializeLogicalCondition(str) {
 	return {
 		column,
 		operator,
-		value: valueStr
+		value: unescapeWireValue(valueStr)
 	};
 }
 //#endregion
@@ -3344,10 +3544,12 @@ function createPrimaryKeyResolver(options) {
 * than postgres still serve rows with one, and this keeps them working.
 */
 function rowToEntity(row, slug, primaryKeys = []) {
+	const { _matches, ...values } = row;
 	return {
 		id: primaryKeys.length > 0 ? buildCompositeId(row, primaryKeys) : row.id,
 		path: slug,
-		values: row
+		values,
+		..._matches ? { searchMatches: _matches } : {}
 	};
 }
 /**
@@ -3390,21 +3592,22 @@ function createDriverAccessor(driver, slug, getPks = () => []) {
 	const accessor = {
 		async find(params) {
 			const filter = params?.where ? deserializeFilter(params.where) : void 0;
-			const limit = params?.limit ?? 20;
-			const offset = params?.offset ?? 0;
+			const { limit, offset, driverOffset } = resolveFindWindow(params);
 			const fetchService = driver.restFetchService;
 			const rows = fetchService ? await fetchService.fetchCollectionForRest(slug, {
 				filter,
-				limit: params?.limit,
-				offset: params?.offset,
+				logical: params?.logical,
+				limit,
+				offset: driverOffset,
 				orderBy: params?.orderBy?.[0],
 				order: params?.orderBy?.[1],
 				searchString: params?.searchString
 			}, params?.include) : await driver.fetchCollection({
 				path: slug,
-				limit: params?.limit,
-				offset: params?.offset,
+				limit,
+				offset: driverOffset,
 				filter,
+				logical: params?.logical,
 				orderBy: params?.orderBy?.[0],
 				order: params?.orderBy?.[1],
 				searchString: params?.searchString
@@ -3414,7 +3617,9 @@ function createDriverAccessor(driver, slug, getPks = () => []) {
 			if (driver.count) {
 				total = await driver.count({
 					path: slug,
-					filter
+					filter,
+					logical: params?.logical,
+					searchString: params?.searchString
 				});
 				hasMore = offset + rows.length < total;
 			}
@@ -3466,30 +3671,48 @@ function createDriverAccessor(driver, slug, getPks = () => []) {
 				values: {}
 			} });
 		},
+		updateMany: driver.updateMany ? async (updates) => {
+			return (await driver.updateMany({
+				path: slug,
+				updates: updates.map((u) => ({
+					id: u.id,
+					values: u.data
+				}))
+			})).map((row) => rowToEntity(row, slug, getPks()));
+		} : void 0,
+		deleteMany: driver.deleteMany ? async (ids) => {
+			await driver.deleteMany({
+				path: slug,
+				ids
+			});
+		} : void 0,
 		count: driver.count ? async (params) => {
 			const filter = params?.where ? deserializeFilter(params.where) : void 0;
 			return driver.count({
 				path: slug,
-				filter
+				filter,
+				logical: params?.logical,
+				searchString: params?.searchString
 			});
 		} : void 0,
 		listen: driver.listenCollection ? (params, onUpdate, onError) => {
-			const limit = params?.limit ?? 20;
-			const offset = params?.offset ?? 0;
+			const { limit, offset, driverOffset } = resolveFindWindow(params);
 			const normalize = driver.restFetchService ? inlineRelationRefs : (row) => row;
 			return driver.listenCollection({
 				path: slug,
-				limit: params?.limit,
-				offset: params?.offset,
+				limit,
+				offset: driverOffset,
 				filter: params?.where,
+				logical: params?.logical,
 				orderBy: params?.orderBy?.[0],
 				order: params?.orderBy?.[1],
 				searchString: params?.searchString,
+				searchExplain: params?.searchExplain,
 				onUpdate: (entities) => {
 					onUpdate({
 						data: entities.map((row) => rowToEntity(normalize(row), slug, getPks())),
 						meta: {
-							total: entities.length,
+							total: offset + entities.length,
 							limit,
 							offset,
 							hasMore: entities.length >= limit
@@ -3522,8 +3745,11 @@ function createDriverAccessor(driver, slug, getPks = () => []) {
 		offset(count) {
 			return new QueryBuilder(accessor).offset(count);
 		},
-		search(searchString) {
-			return new QueryBuilder(accessor).search(searchString);
+		search(searchString, options) {
+			return new QueryBuilder(accessor).search(searchString, options);
+		},
+		vectorSearch(property, vector, options) {
+			return new QueryBuilder(accessor).vectorSearch(property, vector, options);
 		},
 		include(...relations) {
 			return new QueryBuilder(accessor).include(...relations);
@@ -3611,8 +3837,18 @@ var SdkQueryBuilder = class {
 		this.params.offset = count;
 		return this;
 	}
-	search(searchString) {
+	search(searchString, options) {
 		this.params.searchString = searchString;
+		if (options?.explain !== void 0) this.params.searchExplain = options.explain;
+		return this;
+	}
+	vectorSearch(property, vector, options) {
+		this.params.vectorSearch = {
+			property,
+			vector,
+			...options?.distance !== void 0 && { distance: options.distance },
+			...options?.threshold !== void 0 && { threshold: options.threshold }
+		};
 		return this;
 	}
 	include(...relations) {
@@ -3666,9 +3902,24 @@ function toSdkCollectionClient(snap, slug = "collection") {
 		async update(id, data) {
 			return entityToRow(await snap.update(id, data));
 		},
+		async updateMany(updates) {
+			if (!Array.isArray(updates)) throw new TypeError("updateMany expects an array of { id, data } entries.");
+			if (updates.length === 0) return [];
+			if (!snap.updateMany) throw new Error("Bulk updates are not supported by this collection's data source. Fall back to update() per record.");
+			return (await snap.updateMany(updates.map((u) => ({
+				id: u.id,
+				data: u.data
+			})))).map(entityToRow);
+		},
 		delete(id) {
 			return snap.delete(id);
 		},
+		async deleteMany(ids) {
+			if (!Array.isArray(ids)) throw new TypeError("deleteMany expects an array of ids.");
+			if (ids.length === 0) return;
+			if (!snap.deleteMany) throw new Error("Bulk deletes are not supported by this collection's data source. Fall back to delete() per record.");
+			await snap.deleteMany(ids);
+		},
 		count: snap.count ? (params) => snap.count(params) : void 0,
 		listen: snap.listen ? (params, onUpdate, onError) => snap.listen(params, (res) => onUpdate({
 			data: res.data.map(entityToRow),
@@ -3684,6 +3935,7 @@ function toSdkCollectionClient(snap, slug = "collection") {
 		limit: (count) => new SdkQueryBuilder(client).limit(count),
 		offset: (count) => new SdkQueryBuilder(client).offset(count),
 		search: (searchString) => new SdkQueryBuilder(client).search(searchString),
+		vectorSearch: (property, vector, options) => new SdkQueryBuilder(client).vectorSearch(property, vector, options),
 		include: (...relations) => new SdkQueryBuilder(client).include(...relations)
 	};
 	return client;
@@ -3772,6 +4024,6 @@ function buildRoutedRebaseData({ defaultData, sources, resolveKey }) {
 	} });
 }
 //#endregion
-export { Vector as S, ANONYMOUS_USER_ID as _, serializeFilter as a, EntityRelation as b, paginateFind as c, resolveDataSource as d, getEffectiveSecurityRules as f, toSnakeCase as g, buildCompositeId as h, deserializeLogicalCondition as i, CollectionRegistry as l, resolveCollectionRelations as m, buildSdkData as n, serializeLogicalCondition as o, findRelation as p, deserializeFilter as r, collectAllPages as s, buildRoutedRebaseData as t, createDataSourceRegistry as u, isAnonymousUid as v, GeoPoint as x, EntityReference as y };
+export { isAnonymousUid as C, Vector as D, GeoPoint as E, RebaseApiError as O, ANONYMOUS_USER_ID as S, EntityRelation as T, resolvePrimaryKeys as _, serializeFilter as a, MAX_LIST_LIMIT as b, paginateFind as c, createDataSourceRegistry as d, resolveDataSource as f, buildCompositeId as g, resolveCollectionRelations as h, deserializeLogicalCondition as i, RebaseClientError as k, resolveFindWindow as l, findRelation as m, buildSdkData as n, serializeLogicalCondition as o, getEffectiveSecurityRules as p, deserializeFilter as r, collectAllPages as s, buildRoutedRebaseData as t, CollectionRegistry as u, toSnakeCase as v, EntityReference as w, resolveClientListLimit as x, ListLimitError as y };
 
-//# sourceMappingURL=src-Cum9kox5.js.map
+//# sourceMappingURL=src-By48Ffg0.js.map