@rebasepro/server 0.13.0 → 0.13.1-canary.g3660bd5

package/dist/index.es.js

@@ -1,15 +1,15 @@
 import { createRequire as __createRequire } from "module";
 import process from "process";
 __createRequire(import.meta.url);
-import { S as Vector, a as serializeFilter, b as EntityRelation, c as paginateFind, d as resolveDataSource, f as getEffectiveSecurityRules, g as toSnakeCase, h as buildCompositeId, i as deserializeLogicalCondition, l as CollectionRegistry, m as resolveCollectionRelations, n as buildSdkData, o as serializeLogicalCondition, p as findRelation, r as deserializeFilter, s as collectAllPages, t as buildRoutedRebaseData, u as createDataSourceRegistry, x as GeoPoint, y as EntityReference } from "./src-Cum9kox5.js";
+import { C as EntityReference, E as Vector, T as GeoPoint, _ as resolvePrimaryKeys, a as serializeFilter, b as resolveClientListLimit, c as paginateFind, d as createDataSourceRegistry, f as resolveDataSource, g as buildCompositeId, h as resolveCollectionRelations, i as deserializeLogicalCondition, l as resolveFindWindow, m as findRelation, n as buildSdkData, o as serializeLogicalCondition, p as getEffectiveSecurityRules, r as deserializeFilter, s as collectAllPages, t as buildRoutedRebaseData, u as CollectionRegistry, v as toSnakeCase, w as EntityRelation } from "./src-7U0xuQo3.js";
 import { a as DEFAULT_DATA_SOURCE_KEY, r as isPostgresCollectionConfig, t as getCollectionDataPath, u as toCanonicalOp } from "./src-_qQ3RNCK.js";
-import { n as ADMIN_PROPERTY_KEYS, t as ADMIN_COLLECTION_KEYS } from "./admin_block-CcSGdH7M.js";
+import { n as ADMIN_PROPERTY_KEYS, t as ADMIN_COLLECTION_KEYS } from "./admin_block-EmIHae6X.js";
 import { t as isSQLAdmin } from "./backend-CIxN4FVm.js";
 import { n as createContractRoutes } from "./contract-routes-Dj8i5AiM.js";
-import { $ as httpMethodToOperation, A as getEmailVerificationTemplate, B as optionalAuth, C as createDataRateLimiter, D as validatePasswordStrength, E as hashPassword, F as createAdapterAuthMiddleware, G as createApiKeyPreAuth, H as queryTokenAuth, I as createAuthMiddleware, J as isApiKeyToken, K as createFunctionApiKeyGuard, L as createRequireAuth, M as getPasswordResetTemplate, N as getUserInvitationTemplate, O as verifyPassword, P as getWelcomeEmailTemplate, Q as scopeDataDriver, R as extractUserFromToken, S as _coercedNumber, T as resolveAuthHooks, U as requireAdmin, V as publicObjectAuth, W as requireAuth, X as extractBearerToken, Y as validateApiKey, Z as safeCompare, _ as createBuiltinAuthAdapter, a as createSpotifyProvider, b as object, c as createGitLabProvider, d as createFacebookProvider, et as isOperationAllowed, f as createAppleProvider, g as createGoogleProvider, h as createLinkedinProvider, i as createApiKeyStore, it as resolveClientListLimit, j as getMagicLinkTemplate, k as generateSecurePassword, l as createDiscordProvider, m as createGitHubProvider, n as createCustomAuthAdapter, nt as isPublicStoragePath, o as createSlackProvider, p as createMicrosoftProvider, q as createStorageApiKeyGuard, r as createApiKeyRoutes, s as createBitbucketProvider, tt as PUBLIC_STORAGE_PREFIX, u as createTwitterProvider, v as ZodNumber, w as MemoryRateLimitStore, x as string, y as _enum, z as fileTokenAuth } from "./auth-CuC9M2x6.js";
+import { $ as httpMethodToOperation, A as getEmailVerificationTemplate, B as optionalAuth, C as createDataRateLimiter, D as validatePasswordStrength, E as hashPassword, F as createAdapterAuthMiddleware, G as createApiKeyPreAuth, H as queryTokenAuth, I as createAuthMiddleware, J as isApiKeyToken, K as createFunctionApiKeyGuard, L as createRequireAuth, M as getPasswordResetTemplate, N as getUserInvitationTemplate, O as verifyPassword, P as getWelcomeEmailTemplate, Q as scopeDataDriver, R as extractUserFromToken, S as _coercedNumber, T as resolveAuthHooks, U as requireAdmin, V as publicObjectAuth, W as requireAuth, X as extractBearerToken, Y as validateApiKey, Z as safeCompare, _ as createBuiltinAuthAdapter, a as createSpotifyProvider, b as object, c as createGitLabProvider, d as createFacebookProvider, et as isOperationAllowed, f as createAppleProvider, g as createGoogleProvider, h as createLinkedinProvider, i as createApiKeyStore, j as getMagicLinkTemplate, k as generateSecurePassword, l as createDiscordProvider, m as createGitHubProvider, n as createCustomAuthAdapter, nt as isPublicStoragePath, o as createSlackProvider, p as createMicrosoftProvider, q as createStorageApiKeyGuard, r as createApiKeyRoutes, s as createBitbucketProvider, tt as PUBLIC_STORAGE_PREFIX, u as createTwitterProvider, v as ZodNumber, w as MemoryRateLimitStore, x as string, y as _enum, z as fileTokenAuth } from "./auth-BE_FSK1l.js";
 import { t as logger } from "./logger-BYU66ENZ.js";
-import { n as errorHandler, r as isRebaseApiError, t as ApiError } from "./errors-CgkCzoj7.js";
-import { i as generateDownloadToken, n as configureJwt } from "./jwt-DD6EtpGj.js";
+import { n as errorHandler, t as ApiError } from "./errors-BpudWAVU.js";
+import { i as generateDownloadToken, n as configureJwt } from "./jwt-CzeviDcB.js";
 import { t as logMiddleware } from "./logs-routes-BYA72C_C.js";
 import { n as DOCUMENT_MIME_TYPES, r as IMAGE_MIME_TYPES, t as DEFAULT_MAX_FILE_SIZE } from "./types-DSnOC4mF.js";
 import { t as S3StorageController } from "./S3StorageController-B2EDXXMH.js";
@@ -17,10 +17,10 @@ import { t as GCSStorageController } from "./GCSStorageController-BEmDYFKc.js";
 import { n as loadFunctionsFromDirectory } from "./function-loader-B_1fYfUY.js";
 import { t as createFunctionRoutes } from "./function-routes-C0cLIy3N.js";
 import { n as loadCronJobsFromDirectory } from "./cron-loader-B1S2MCSl.js";
-import { r as validateCronExpression, t as CronScheduler } from "./cron-scheduler-B3RFt0HS.js";
-import { t as createCronRoutes } from "./cron-routes-CrQ0tK-_.js";
-import { t as createCronStore } from "./cron-store-BywZsyfZ.js";
-import { a as parseBackupTimestamp, i as parseBackupDestination, n as createBackupRoutes, o as readBackupBytes, r as listBackupObjects } from "./backup-CVggVhR2.js";
+import { r as validateCronExpression, t as CronScheduler } from "./cron-scheduler-BhFZWR0T.js";
+import { t as createCronRoutes } from "./cron-routes-D5a9v1HY.js";
+import { t as createCronStore } from "./cron-store-Cu4sOseb.js";
+import { a as parseBackupTimestamp, i as parseBackupDestination, n as createBackupRoutes, o as readBackupBytes, r as listBackupObjects } from "./backup-BJiY_mM-.js";
 import { randomBytes, randomUUID } from "node:crypto";
 import * as fs$2 from "fs";
 import fs, { existsSync } from "fs";
@@ -1055,11 +1055,18 @@ function assertKnownWriteFields(values, collection, options) {
 * This shapes the *response*, which is what the parameter says it does; it is
 * not a column pushdown, so it saves bandwidth rather than database work.
 *
-* `id` always survives. Rows are addressed by it everywhere above this layer —
-* the admin table, realtime reconciliation, the offline cache — and a row that
-* arrives without one is not a smaller row, it is an unusable one. Asking for
-* `fields=title` and being unable to open the record you clicked is a worse
-* answer than one extra key.
+* The collection's key always survives. Rows are addressed by it everywhere
+* above this layer — the admin table, realtime reconciliation, the offline
+* cache — and a row that arrives without one is not a smaller row, it is an
+* unusable one. Asking for `fields=title` and being unable to open the record
+* you clicked is a worse answer than one extra key.
+*
+* That is a statement about the key, not about the name `id`: a collection
+* keyed on `slug`, or on `user_id + role_id`, was projected down to the fields
+* asked for and nothing else, which is the very outcome the paragraph above
+* describes. `assertKnownWriteFields` one function up already has a dedicated
+* error for collections with no `id` column, so this layer had no excuse for
+* assuming one.
 */
 function projectResponseFields(rows, fields, collection, options) {
 	if (!fields || fields.length === 0) return rows;
@@ -1077,7 +1084,8 @@ function projectResponseFields(rows, fields, collection, options) {
 			collection: collection.slug
 		});
 	}
-	const keep = /* @__PURE__ */ new Set([...fields, "id"]);
+	const primaryKeys = resolvePrimaryKeys(collection).map((key) => key.fieldName);
+	const keep = /* @__PURE__ */ new Set([...fields, ...primaryKeys.length > 0 ? primaryKeys : ["id"]]);
 	return rows.map((row) => {
 		const projected = {};
 		for (const key of Object.keys(row)) if (keep.has(key)) projected[key] = row[key];
@@ -1161,26 +1169,43 @@ function createIdempotencyStore(driver) {
 		return ready;
 	};
 	return {
-		async recall(key, uid) {
-			if (!key || !await ensure()) return void 0;
+		async claim(key, uid) {
+			if (!key || !await ensure()) return { status: "claimed" };
 			try {
-				return (await exec(`SELECT response FROM ${TABLE}
-                     WHERE uid = $1 AND key = $2 AND created_at > NOW() - INTERVAL '${TTL_HOURS} hours'`, [principal(uid), key]))[0]?.response;
+				if ((await exec(`INSERT INTO ${TABLE} (key, uid, response, created_at)
+                     VALUES ($1, $2, NULL, NOW())
+                     ON CONFLICT (uid, key) DO UPDATE
+                       SET response = NULL, created_at = NOW()
+                       WHERE ${TABLE}.created_at < NOW() - INTERVAL '${TTL_HOURS} hours'
+                     RETURNING 1 AS claimed`, [key, principal(uid)])).length > 0) return { status: "claimed" };
+				const row = (await exec(`SELECT response, response IS NULL AS pending FROM ${TABLE}
+                     WHERE uid = $1 AND key = $2`, [principal(uid), key]))[0];
+				if (!row) return { status: "claimed" };
+				if (row.pending) return { status: "in-flight" };
+				return {
+					status: "replay",
+					response: row.response
+				};
 			} catch {
-				return;
+				return { status: "claimed" };
 			}
 		},
-		async remember(key, uid, response) {
+		async complete(key, uid, response) {
 			if (!key || !await ensure()) return;
 			try {
-				await exec(`INSERT INTO ${TABLE} (key, uid, response) VALUES ($1, $2, $3::jsonb)
-                     ON CONFLICT (uid, key) DO NOTHING`, [
-					key,
+				await exec(`UPDATE ${TABLE} SET response = $3::jsonb WHERE uid = $1 AND key = $2`, [
 					principal(uid),
+					key,
 					JSON.stringify(response ?? null)
 				]);
 				if (Math.random() < .01) await exec(`DELETE FROM ${TABLE} WHERE created_at < NOW() - INTERVAL '${TTL_HOURS} hours'`);
 			} catch {}
+		},
+		async release(key, uid) {
+			if (!key || !await ensure()) return;
+			try {
+				await exec(`DELETE FROM ${TABLE} WHERE uid = $1 AND key = $2 AND response IS NULL`, [principal(uid), key]);
+			} catch {}
 		}
 	};
 }
@@ -1395,92 +1420,83 @@ var RestApiGenerator = class {
 			});
 		});
 		this.router.post(basePath, async (c) => {
-			try {
-				this.enforceApiKeyPermission(c, collection.slug);
-				const driver = this.getScopedDriver(c);
-				const path = collection.slug;
-				const body = await parseJsonBody(c);
-				const isAuth = collection.auth;
-				const isAuthCollection = isAuth === true || isAuth && typeof isAuth === "object" && isAuth.enabled === true;
-				const collectionAuthConfig = typeof isAuth === "object" ? isAuth : void 0;
-				if (!isAuthCollection) assertKnownWriteFields(body, resolvedCollection);
-				else {
-					const contract = this.authAdapter?.describeUserCreationContract?.(collectionAuthConfig);
-					if (contract?.validate) assertKnownWriteFields(body, resolvedCollection, { extraKnownFields: contract.extraFields });
-				}
-				if (isAuthCollection && this.authAdapter?.prepareUserCreation) {
-					const prepared = await this.authAdapter.prepareUserCreation(body, collectionAuthConfig);
-					const entity = await driver.save({
-						path,
-						values: prepared.values,
-						collection: resolvedCollection,
-						status: "new"
-					});
-					const result = prepared.hookHandledEmail ? {
-						temporaryPassword: prepared.clearPassword,
-						invitationSent: prepared.invitationSent
-					} : this.authAdapter.finalizeUserCreation ? await this.authAdapter.finalizeUserCreation({
-						id: entity.id,
-						values: entity
-					}, prepared.clearPassword) : { invitationSent: false };
-					const response = this.formatResponse(entity);
-					return c.json({
-						...response,
-						invitationSent: result.invitationSent,
-						...result.temporaryPassword ? { temporaryPassword: result.temporaryPassword } : {},
-						..."emailDeliveryFailed" in result && result.emailDeliveryFailed ? { emailDeliveryFailed: true } : {}
-					}, 201);
-				}
-				const idempotencyKey = c.req.header(IDEMPOTENCY_HEADER);
-				const uid = c.get("user")?.uid;
-				const store = this.idempotency();
-				if (idempotencyKey && store) {
-					const already = await store.recall(idempotencyKey, uid);
-					if (already !== void 0) return c.json(already, 201);
-				}
+			this.enforceApiKeyPermission(c, collection.slug);
+			const driver = this.getScopedDriver(c);
+			const path = collection.slug;
+			const body = await parseJsonBody(c);
+			const isAuth = collection.auth;
+			const isAuthCollection = isAuth === true || isAuth && typeof isAuth === "object" && isAuth.enabled === true;
+			const collectionAuthConfig = typeof isAuth === "object" ? isAuth : void 0;
+			if (!isAuthCollection) assertKnownWriteFields(body, resolvedCollection);
+			else {
+				const contract = this.authAdapter?.describeUserCreationContract?.(collectionAuthConfig);
+				if (contract?.validate) assertKnownWriteFields(body, resolvedCollection, { extraKnownFields: contract.extraFields });
+			}
+			if (isAuthCollection && this.authAdapter?.prepareUserCreation) {
+				const prepared = await this.authAdapter.prepareUserCreation(body, collectionAuthConfig);
 				const entity = await driver.save({
 					path,
-					values: body,
+					values: prepared.values,
 					collection: resolvedCollection,
 					status: "new"
 				});
+				const result = prepared.hookHandledEmail ? {
+					temporaryPassword: prepared.clearPassword,
+					invitationSent: prepared.invitationSent
+				} : this.authAdapter.finalizeUserCreation ? await this.authAdapter.finalizeUserCreation({
+					id: entity.id,
+					values: entity
+				}, prepared.clearPassword) : { invitationSent: false };
 				const response = this.formatResponse(entity);
-				if (idempotencyKey && store) await store.remember(idempotencyKey, uid, response);
-				return c.json(response, 201);
-			} catch (error) {
-				if (isRebaseApiError(error) && !error.code) {
-					if (!(error instanceof TypeError || error instanceof RangeError || error instanceof SyntaxError || error instanceof ReferenceError)) error.code = "BAD_REQUEST";
-				}
-				throw error;
+				return c.json({
+					...response,
+					invitationSent: result.invitationSent,
+					...result.temporaryPassword ? { temporaryPassword: result.temporaryPassword } : {},
+					..."emailDeliveryFailed" in result && result.emailDeliveryFailed ? { emailDeliveryFailed: true } : {}
+				}, 201);
 			}
-		});
-		this.router.put(`${basePath}/:id`, async (c) => {
+			const idempotencyKey = c.req.header(IDEMPOTENCY_HEADER);
+			const uid = c.get("user")?.uid;
+			const store = this.idempotency();
+			const claimed = idempotencyKey && store ? await store.claim(idempotencyKey, uid) : void 0;
+			if (claimed?.status === "replay") return c.json(claimed.response, 201);
+			if (claimed?.status === "in-flight") throw ApiError.conflict(`A request with Idempotency-Key '${idempotencyKey}' is already in progress. Retry once it has answered; its result will be replayed.`, "IDEMPOTENCY_KEY_IN_PROGRESS");
+			let response;
 			try {
-				this.enforceApiKeyPermission(c, collection.slug);
-				const id = c.req.param("id");
-				const driver = this.getScopedDriver(c);
-				if (!await driver.fetchOne({
-					path: getCollectionDataPath(collection),
-					id: String(id),
-					collection: resolvedCollection
-				})) throw ApiError.notFound("Entity not found");
-				const body = await parseJsonBody(c);
-				assertKnownWriteFields(body, resolvedCollection);
 				const entity = await driver.save({
-					path: getCollectionDataPath(collection),
-					id: String(id),
+					path,
 					values: body,
 					collection: resolvedCollection,
-					status: "existing"
+					status: "new"
 				});
-				const response = this.formatResponse(entity);
-				return c.json(response);
+				response = this.formatResponse(entity);
 			} catch (error) {
-				if (isRebaseApiError(error) && !error.code) {
-					if (!(error instanceof TypeError || error instanceof RangeError || error instanceof SyntaxError || error instanceof ReferenceError)) error.code = "BAD_REQUEST";
-				}
+				if (claimed?.status === "claimed" && idempotencyKey && store) await store.release(idempotencyKey, uid);
 				throw error;
 			}
+			if (claimed?.status === "claimed" && idempotencyKey && store) await store.complete(idempotencyKey, uid, response);
+			return c.json(response, 201);
+		});
+		this.router.put(`${basePath}/:id`, async (c) => {
+			this.enforceApiKeyPermission(c, collection.slug);
+			const id = c.req.param("id");
+			const driver = this.getScopedDriver(c);
+			if (!await driver.fetchOne({
+				path: getCollectionDataPath(collection),
+				id: String(id),
+				collection: resolvedCollection
+			})) throw ApiError.notFound("Entity not found");
+			const body = await parseJsonBody(c);
+			assertKnownWriteFields(body, resolvedCollection);
+			const entity = await driver.save({
+				path: getCollectionDataPath(collection),
+				id: String(id),
+				values: body,
+				collection: resolvedCollection,
+				status: "existing"
+			});
+			const response = this.formatResponse(entity);
+			return c.json(response);
 		});
 		this.router.delete(`${basePath}/:id`, async (c) => {
 			this.enforceApiKeyPermission(c, collection.slug);
@@ -1552,6 +1568,7 @@ var RestApiGenerator = class {
 				const total = driver.count ? await driver.count({
 					path: parsed.collectionPath,
 					filter: queryOptions.where,
+					logical: queryOptions.logical,
 					searchString
 				}) : 0;
 				return c.json({ count: total });
@@ -1563,7 +1580,9 @@ var RestApiGenerator = class {
 					id: parsed.id
 				});
 				if (!entity) throw ApiError.notFound("Entity not found");
-				return c.json(entity);
+				const nestedCollection = this.resolveNestedWriteCollection(parsed.collectionPath);
+				if (!nestedCollection) return c.json(entity);
+				return c.json(projectResponseFields([entity], queryOptions.fields, nestedCollection, { include: queryOptions.include })[0]);
 			} else {
 				const queryDict = c.req.queries();
 				const queryOptions = this.parseQuery(queryDict);
@@ -1588,8 +1607,9 @@ var RestApiGenerator = class {
 					logical: queryOptions.logical,
 					searchString
 				}) : entities.length;
+				const listCollection = this.resolveNestedWriteCollection(parsed.collectionPath);
 				return c.json({
-					data: entities,
+					data: listCollection ? projectResponseFields(entities, queryOptions.fields, listCollection, { include: queryOptions.include }) : entities,
 					meta: {
 						total,
 						limit: queryOptions.limit,
@@ -3081,7 +3101,7 @@ function assertStorageAccessControlConfigured(state, isProduction) {
 //#region src/init/docs.ts
 async function mountOpenApiDocs(app, basePath, enableSwagger, activeCollections, requireAuth) {
 	if (enableSwagger === false || activeCollections.length === 0) return;
-	const { generateOpenApiSpec } = await import("./openapi-generator-BEwyiaAr.js");
+	const { generateOpenApiSpec } = await import("./openapi-generator-C-Rqz9sp.js");
 	app.get(`${basePath}/docs`, (c) => {
 		const spec = generateOpenApiSpec(activeCollections, {
 			basePath,
@@ -3418,6 +3438,13 @@ function resolveBaseUrl(configured) {
 function createTransport(config, environment) {
 	const fetchFn = config.fetch || globalThis.fetch;
 	const apiPath = config.apiPath || "/api";
+	for (const field of ["baseUrl", "storageUrlOrigin"]) {
+		const value = config[field];
+		if (!value || !apiPath) continue;
+		const trimmed = value.replace(/\/+$/, "");
+		if (!trimmed.endsWith(apiPath)) continue;
+		console.warn(`[Rebase] ${field} ${JSON.stringify(value)} already ends with the API path ${JSON.stringify(apiPath)}, which is appended to it — requests will go to ${trimmed}${apiPath}/… and 404. Pass the origin only (${JSON.stringify(trimmed.slice(0, trimmed.length - apiPath.length) || "/")}), or set \`apiPath\` if the server really does mount the API one level deeper.`);
+	}
 	let token = config.token;
 	let tokenGetter;
 	let onUnauthorizedHandler = config.onUnauthorized;
@@ -3628,7 +3655,9 @@ function createAuth(transport, options) {
 	function emit(event, session) {
 		for (const fn of listeners) try {
 			fn(event, session);
-		} catch (e) {}
+		} catch (e) {
+			console.error("Error in auth state change listener:", e);
+		}
 	}
 	function saveSession(session) {
 		if (!persistSession || authFlowMode === "cookie") return;
@@ -4573,8 +4602,15 @@ function createCollectionClient(transport, slug, ws) {
 		},
 		observe(params, onResult, onError, options) {
 			let closed = false;
-			const emit = (result) => {
+			let liveDelivered = false;
+			let signature;
+			const deliver = (result, fromLive) => {
 				if (closed) return;
+				if (fromLive) liveDelivered = true;
+				else if (liveDelivered) return;
+				const next = `${result.meta?.total ?? ""}|${JSON.stringify(result.data)}`;
+				if (signature !== void 0 && next === signature) return;
+				signature = next;
 				onResult({
 					...result,
 					fromCache: false,
@@ -4582,10 +4618,10 @@ function createCollectionClient(transport, slug, ws) {
 					partial: false
 				});
 			};
-			client.find(params).then(emit).catch((error) => {
+			client.find(params).then((result) => deliver(result, false)).catch((error) => {
 				if (!closed) onError?.(error);
 			});
-			const live = options?.realtime !== false && client.listen ? client.listen(params, emit, onError) : void 0;
+			const live = options?.realtime !== false && client.listen ? client.listen(params, (result) => deliver(result, true), onError) : void 0;
 			return () => {
 				closed = true;
 				live?.();
@@ -4593,17 +4629,24 @@ function createCollectionClient(transport, slug, ws) {
 		},
 		observeById(id, onResult, onError, options) {
 			let closed = false;
-			const emit = (row) => {
+			let liveDelivered = false;
+			let signature;
+			const deliver = (row, fromLive) => {
 				if (closed) return;
+				if (fromLive) liveDelivered = true;
+				else if (liveDelivered) return;
+				const next = row === void 0 ? "\0missing" : JSON.stringify(row);
+				if (signature !== void 0 && next === signature) return;
+				signature = next;
 				onResult(row, {
 					fromCache: false,
 					hasPendingWrites: false
 				});
 			};
-			client.findById(id).then(emit).catch((error) => {
+			client.findById(id).then((row) => deliver(row, false)).catch((error) => {
 				if (!closed) onError?.(error);
 			});
-			const live = options?.realtime !== false && client.listenById ? client.listenById(id, emit, onError) : void 0;
+			const live = options?.realtime !== false && client.listenById ? client.listenById(id, (row) => deliver(row, true), onError) : void 0;
 			return () => {
 				closed = true;
 				live?.();
@@ -4634,51 +4677,43 @@ function createCollectionClient(transport, slug, ws) {
 		client.listen = (params, onUpdate, onError) => {
 			let active = true;
 			let lastUpdateId = 0;
+			let lastKnownTotal;
+			const window = resolveFindWindow(params);
 			const unsub = ws.listenCollection({
 				path: slug,
 				filter: params?.where,
+				logical: params?.logical,
 				limit: params?.limit,
-				startAfter: params?.offset ? String(params.offset) : void 0,
+				offset: window.driverOffset,
 				orderBy: params?.orderBy?.[0],
 				order: params?.orderBy?.[1],
 				searchString: params?.searchString
 			}, (incomingRows) => {
 				const currentUpdateId = ++lastUpdateId;
-				const requestedLimit = params?.limit || 20;
-				const offset = params?.offset || 0;
+				const requestedLimit = window.limit;
+				const offset = window.offset;
 				const rows = incomingRows;
-				const heuristicTotal = rows.length;
-				const heuristicHasMore = rows.length >= requestedLimit;
-				if (client.count) client.count(params).then((total) => {
-					if (active && currentUpdateId === lastUpdateId) onUpdate({
+				const emit = (total, hasMore) => {
+					if (!active || currentUpdateId !== lastUpdateId) return;
+					onUpdate({
 						data: rows,
 						meta: {
 							total,
 							limit: requestedLimit,
 							offset,
-							hasMore: offset + rows.length < total
+							hasMore
 						}
 					});
+				};
+				const emitWithoutCount = () => emit(offset + rows.length, rows.length >= requestedLimit);
+				if (client.count) client.count(params).then((total) => {
+					lastKnownTotal = total;
+					emit(total, offset + rows.length < total);
 				}).catch(() => {
-					if (active && currentUpdateId === lastUpdateId) onUpdate({
-						data: rows,
-						meta: {
-							total: heuristicTotal,
-							limit: requestedLimit,
-							offset,
-							hasMore: heuristicHasMore
-						}
-					});
-				});
-				else onUpdate({
-					data: rows,
-					meta: {
-						total: heuristicTotal,
-						limit: requestedLimit,
-						offset,
-						hasMore: heuristicHasMore
-					}
+					if (lastKnownTotal !== void 0) emit(lastKnownTotal, offset + rows.length < lastKnownTotal);
+					else emitWithoutCount();
 				});
+				else emitWithoutCount();
 			}, onError);
 			return () => {
 				active = false;
@@ -6061,15 +6096,10 @@ var RebaseWebSocketClient = class {
 		}
 	}
 	createCollectionSubscriptionKey(props) {
+		const { collection, ...query } = props;
 		const key = {
-			path: props.path,
-			filter: props.filter,
-			limit: props.limit,
-			startAfter: props.startAfter,
-			orderBy: props.orderBy,
-			order: props.order,
-			searchString: props.searchString,
-			collection: props.collection?.name
+			...query,
+			collection: collection?.name
 		};
 		return JSON.stringify(key, (_, value) => {
 			if (value && typeof value === "object" && !Array.isArray(value)) return Object.keys(value).sort().reduce((sorted, k) => {
@@ -7121,12 +7151,20 @@ function sortRows(rows, orderBy) {
 function tiebreak(a, b) {
 	return compareValues(a.id, b.id) ?? 0;
 }
-/** Resolve `page`/`offset`/`limit` the way the server does. */
+/**
+* Resolve `page`/`offset`/`limit` the way the server does.
+*
+* It did not: this defaulted an absent limit to 20 while `/api/data` pages by
+* 50, so the same `observe()` answered with 20 rows from the local database and
+* 50 from the network — a list that changed length depending on which side
+* answered, with `page` striding differently on each. Delegated now, so the
+* sentence above is true by construction rather than by agreement.
+*/
 function resolvePagination(params) {
-	const limit = params?.limit ?? 20;
+	const { limit, offset } = resolveFindWindow(params);
 	return {
 		limit,
-		offset: params?.page != null ? Math.max(0, (params.page - 1) * limit) : params?.offset ?? 0
+		offset
 	};
 }
 /**
@@ -7748,9 +7786,8 @@ var OfflineManager = class {
 		if (!state) return {
 			data: [],
 			meta: {
+				...resolvePagination(params),
 				total: 0,
-				limit: params?.limit ?? 20,
-				offset: params?.offset ?? 0,
 				hasMore: false
 			},
 			fromCache: true,
@@ -7942,17 +7979,17 @@ var OfflineManager = class {
 		return row;
 	}
 	recordSnapshot(slug, params, result) {
+		const window = resolvePagination(params);
 		const meta = result.meta ?? {
 			total: result.data?.length ?? 0,
-			limit: 20,
-			offset: 0,
+			...window,
 			hasMore: false
 		};
 		const snapshot = {
 			ids: (result.data ?? []).map((row) => row.id).filter((id) => id !== void 0),
 			total: meta.total ?? result.data?.length ?? 0,
-			limit: meta.limit ?? params?.limit ?? 20,
-			offset: meta.offset ?? params?.offset ?? 0,
+			limit: meta.limit ?? window.limit,
+			offset: meta.offset ?? window.offset,
 			hasMore: meta.hasMore ?? false
 		};
 		const state = this.collectionState(slug);
@@ -8414,23 +8451,37 @@ var OfflineManager = class {
 /**
 * Derive a WebSocket URL from an HTTP base URL.
 * `http://` → `ws://`, `https://` → `wss://`.
+*
+* A backend mounted under a path is the reason `baseUrl` accepts one, so the
+* path is kept. It used to be kept for an absolute `baseUrl` and dropped for a
+* relative one — resolved through `.origin` — so one deployment dialled two
+* different sockets depending on whether its config said `"/backend"` or
+* `"https://app.example.com/backend"`.
+*
+* Returns `""` when there is nothing to resolve against: a relative `baseUrl`
+* outside a browser has no origin, and inventing one would dial somewhere
+* arbitrary. The caller warns rather than leaving that silent.
 */
 function deriveWebSocketUrl(baseUrl) {
+	const toWsProtocol = (url) => {
+		const secure = /^(https|wss):/i.test(url);
+		return url.replace(/^https?:\/\//i, secure ? "wss://" : "ws://").replace(/^wss?:\/\//i, secure ? "wss://" : "ws://").replace(/\/$/, "");
+	};
 	if (typeof window !== "undefined") {
-		let absoluteUrl = "";
+		let absoluteUrl;
 		if (!baseUrl) absoluteUrl = window.location.origin;
 		else if (/^https?:\/\//i.test(baseUrl) || /^wss?:\/\//i.test(baseUrl)) absoluteUrl = baseUrl;
 		else try {
-			absoluteUrl = new URL(baseUrl, window.location.href).origin;
+			const resolved = new URL(baseUrl, window.location.href);
+			absoluteUrl = resolved.origin + resolved.pathname;
 		} catch {
 			absoluteUrl = window.location.origin;
 		}
-		const protocol = absoluteUrl.startsWith("https:") || absoluteUrl.startsWith("wss:") ? "wss:" : "ws:";
-		return absoluteUrl.replace(/^https?:\/\//i, `${protocol}//`).replace(/^wss?:\/\//i, `${protocol}//`).replace(/\/$/, "");
+		return toWsProtocol(absoluteUrl);
 	}
 	if (!baseUrl) return "";
 	if (!/^https?:\/\//i.test(baseUrl) && !/^wss?:\/\//i.test(baseUrl)) return "";
-	return baseUrl.replace(/^https?:\/\//i, (match) => match.toLowerCase() === "https://" ? "wss://" : "ws://").replace(/\/$/, "");
+	return toWsProtocol(baseUrl);
 }
 function createRebaseClient(options) {
 	const transport = createTransport(options, { credentialOutOfBand: options.auth?.authFlowMode === "cookie" });
@@ -8458,7 +8509,11 @@ function createRebaseClient(options) {
 		});
 		return storageSourcesPromise;
 	};
-	const resolvedWsUrl = options.realtime !== false ? options.websocketUrl ?? deriveWebSocketUrl(options.baseUrl) : void 0;
+	const realtimeEnabled = options.realtime !== false;
+	const resolvedWsUrl = realtimeEnabled ? options.websocketUrl ?? deriveWebSocketUrl(options.baseUrl) : void 0;
+	const realtimeUnreachable = realtimeEnabled && !resolvedWsUrl;
+	const unreachableReason = `no WebSocket URL could be derived from baseUrl ${JSON.stringify(options.baseUrl ?? null)} — outside a browser there is no page origin to resolve a relative URL against. Pass an absolute \`baseUrl\`, set \`websocketUrl\` explicitly, or pass \`realtime: false\` to say this was intended.`;
+	if (realtimeUnreachable) console.warn(`[Rebase] Realtime is enabled but ${unreachableReason} Live queries will fall back to a single fetch and channels will throw.`);
 	let ws;
 	/** One channel object per name — see `realtime.channel`. */
 	const realtimeChannels = /* @__PURE__ */ new Map();
@@ -8578,7 +8633,7 @@ function createRebaseClient(options) {
 		* cut off the others.
 		*/
 channel: (name, options) => {
-			if (!ws) throw new RebaseClientError("Realtime is disabled on this client (realtime: false), so channels are unavailable.");
+			if (!ws) throw new RebaseClientError(realtimeUnreachable ? `Realtime is enabled but ${unreachableReason}` : "Realtime is disabled on this client (realtime: false), so channels are unavailable.");
 			let existing = realtimeChannels.get(name);
 			if (!existing) {
 				existing = new RebaseRealtimeChannel(name, ws, options);
@@ -9249,7 +9304,7 @@ async function _initializeRebaseBackend(config) {
 			]) {
 				const providerConfig = safeAuthConfig[key];
 				if (providerConfig && requiredFields.every((f) => Boolean(providerConfig[f]))) {
-					const createFn = (await import("./auth-CuC9M2x6.js").then((n) => n.t))[factory];
+					const createFn = (await import("./auth-BE_FSK1l.js").then((n) => n.t))[factory];
 					oauthProviders.push(createFn(providerConfig));
 				}
 			}
@@ -9343,7 +9398,7 @@ async function _initializeRebaseBackend(config) {
 	let schemaEditorOff = schemaEditorUnavailable();
 	let schemaEditorRoutes;
 	if (!schemaEditorOff && config.collectionsDir) try {
-		schemaEditorRoutes = (await import("./schema-editor-routes-CbF20Mf1.js")).createSchemaEditorRoutes(config.collectionsDir);
+		schemaEditorRoutes = (await import("./schema-editor-routes-C1DxDnDR.js")).createSchemaEditorRoutes(config.collectionsDir);
 	} catch (err) {
 		if (err?.code === "ERR_MODULE_NOT_FOUND") {
 			schemaEditorOff = {
@@ -9556,9 +9611,9 @@ async function _initializeRebaseBackend(config) {
 	let cronScheduler;
 	if (config.cronsDir) {
 		const { loadCronJobsFromDirectory } = await import("./cron-loader-B1S2MCSl.js").then((n) => n.t);
-		const { CronScheduler } = await import("./cron-scheduler-B3RFt0HS.js").then((n) => n.n);
-		const { createCronRoutes } = await import("./cron-routes-CrQ0tK-_.js").then((n) => n.n);
-		const { createCronStore } = await import("./cron-store-BywZsyfZ.js").then((n) => n.n);
+		const { CronScheduler } = await import("./cron-scheduler-BhFZWR0T.js").then((n) => n.n);
+		const { createCronRoutes } = await import("./cron-routes-D5a9v1HY.js").then((n) => n.n);
+		const { createCronStore } = await import("./cron-store-Cu4sOseb.js").then((n) => n.n);
 		const loadedCronJobs = await loadCronJobsFromDirectory(config.cronsDir);
 		cronScheduler = new CronScheduler();
 		cronScheduler.setClient(serverClient);
@@ -9583,7 +9638,7 @@ async function _initializeRebaseBackend(config) {
 		} else logger.warn(`Cron routes mounted at ${basePath}/cron, but no jobs loaded from ${config.cronsDir}. Nothing is scheduled — check the messages above for files that failed to load.`);
 	}
 	{
-		const { createBackupRoutes, parseBackupDestination } = await import("./backup-CVggVhR2.js").then((n) => n.t);
+		const { createBackupRoutes, parseBackupDestination } = await import("./backup-BJiY_mM-.js").then((n) => n.t);
 		const backupRouter = new Hono();
 		applyAdminGate(backupRouter, "Backup");
 		backupRouter.route("/", createBackupRoutes({
@@ -11785,7 +11840,8 @@ async function bootFromBundle(options = {}) {
 	});
 	await ensureCollectionPolicies(bundle, dataSources, env);
 	metrics?.setKnownCollections(backend.collectionRegistry.getCollections().map((collection) => collection.slug).filter((slug) => Boolean(slug)));
-	app.get("/health", async (c) => {
+	const healthPaths = ["/health", `${(env.REBASE_BASE_PATH || "/api").replace(/\/$/, "")}/health`];
+	for (const healthPath of [...new Set(healthPaths)]) app.get(healthPath, async (c) => {
 		const result = await backend.healthCheck();
 		const unhealthy = (await Promise.all(dataSources.filter((source) => source.key !== DEFAULT_DATA_SOURCE_KEY).map(async (source) => ({
 			key: source.key,
@@ -11891,7 +11947,7 @@ async function bootStaticApp(bundle, devRoot, options) {
 	if (metrics) app.use("/*", metrics.middleware);
 	const server = createServer(getRequestListener(app.fetch));
 	app.get("/livez", (c) => c.json({ status: "ok" }));
-	app.get("/health", (c) => c.json({
+	for (const healthPath of [.../* @__PURE__ */ new Set(["/health", `${basePath.replace(/\/$/, "")}/health`])]) app.get(healthPath, (c) => c.json({
 		status: "ok",
 		latencyMs: 0
 	}));
@@ -12109,6 +12165,6 @@ async function ensureCollectionPolicies(bundle, dataSources, env) {
 	logger.info(applied > 0 ? `Applied ${applied} RLS policy statement(s) before serving.` : "RLS policies are up to date.");
 }
 //#endregion
-export { ApiError, BundleError, CronScheduler, DEFAULT_DRIVER_ID, DEFAULT_MAX_FILE_SIZE, DEFAULT_STORAGE_ID, DOCUMENT_MIME_TYPES, DefaultDriverRegistry, DefaultStorageRegistry, GCSStorageController, IMAGE_MIME_TYPES, LocalStorageController, MetricsRegistry, S3StorageController, SMTPEmailService, TransformCache, TusHandler, WebhookDispatcher, _resetRebaseMock, _setRebaseMock, applyCollectionDefaults, assertCollectionConfigs, assertDistinctSuffixes, authJwt, authRoles, authUid, bootFromBundle, classifySurface, cleanupDevPortFile, createAppleProvider, createBackupRoutes, createBitbucketProvider, createBuiltinAuthAdapter, createContractRoutes, createCronRoutes, createCronStore, createCustomAuthAdapter, createDiscordProvider, createEmailService, createFacebookProvider, createFunctionRoutes, createGitHubProvider, createGitLabProvider, createGoogleProvider, createHistoryRoutes, createLinkedinProvider, createMetricsMiddleware, createMetricsRoutes, createMicrosoftProvider, createSlackProvider, createSourceBundle, createSpotifyProvider, createStorageController, createStorageRoutes, createTwitterProvider, defineCron, defineFunction, envSuffixForKey, errorHandler, extractUserFromToken, fileTokenAuth, findCollectionConfigProblems, generateSecurePassword, getEmailVerificationTemplate, getMagicLinkTemplate, getPasswordResetTemplate, getUserInvitationTemplate, getWelcomeEmailTemplate, hashPassword, httpMethodToOperation, initializeDataSource, initializeDataSources, initializeRebaseBackend, installShutdownHandlers, isApiKeyToken, isAuthAdapter, isDatabaseAdapter, isLocalhostOrigin, isOperationAllowed, isRebaseApiError, isTransformableImage, listBackupObjects, listenWithPortRetry, loadBootEnv, loadBundle, loadBundleConfigExports, loadBundleSchema, loadCollectionsFromDirectory, loadCronJobsFromDirectory, loadDeclaredStorageSources, loadEnv, loadFunctionsFromDirectory, loadUsersCollection, logger, optionalAuth, parseBackupDestination, parseBackupTimestamp, parseTransformOptions, queryTokenAuth, readBackupBytes, readBundleManifest, rebase, requireAdmin, requireAuth, resolveAuthHooks, resolveAuthOptions, resolveCorsOrigin, resolveDataSources, resolveEmailOptions, resolveRequireAuth, resolveStorageBackend, resolveStorageSources, runFromBundle, safeCompare, serveSPA, transformImage, unknownKeyPolicyFromEnv, validateApiKey, validateCronExpression, validatePasswordStrength, verifyPassword };
+export { ApiError, BundleError, CronScheduler, DEFAULT_DRIVER_ID, DEFAULT_MAX_FILE_SIZE, DEFAULT_STORAGE_ID, DOCUMENT_MIME_TYPES, DefaultDriverRegistry, DefaultStorageRegistry, GCSStorageController, IMAGE_MIME_TYPES, LocalStorageController, MetricsRegistry, S3StorageController, SMTPEmailService, TransformCache, TusHandler, WebhookDispatcher, _resetRebaseMock, _setRebaseMock, applyCollectionDefaults, assertCollectionConfigs, assertDistinctSuffixes, authJwt, authRoles, authUid, bootFromBundle, classifySurface, cleanupDevPortFile, createAppleProvider, createBackupRoutes, createBitbucketProvider, createBuiltinAuthAdapter, createContractRoutes, createCronRoutes, createCronStore, createCustomAuthAdapter, createDiscordProvider, createEmailService, createFacebookProvider, createFunctionRoutes, createGitHubProvider, createGitLabProvider, createGoogleProvider, createHistoryRoutes, createLinkedinProvider, createMetricsMiddleware, createMetricsRoutes, createMicrosoftProvider, createSlackProvider, createSourceBundle, createSpotifyProvider, createStorageController, createStorageRoutes, createTwitterProvider, defineCron, defineFunction, envSuffixForKey, errorHandler, extractUserFromToken, fileTokenAuth, findCollectionConfigProblems, generateSecurePassword, getEmailVerificationTemplate, getMagicLinkTemplate, getPasswordResetTemplate, getUserInvitationTemplate, getWelcomeEmailTemplate, hashPassword, httpMethodToOperation, initializeDataSource, initializeDataSources, initializeRebaseBackend, installShutdownHandlers, isApiKeyToken, isAuthAdapter, isDatabaseAdapter, isLocalhostOrigin, isOperationAllowed, isTransformableImage, listBackupObjects, listenWithPortRetry, loadBootEnv, loadBundle, loadBundleConfigExports, loadBundleSchema, loadCollectionsFromDirectory, loadCronJobsFromDirectory, loadDeclaredStorageSources, loadEnv, loadFunctionsFromDirectory, loadUsersCollection, logger, optionalAuth, parseBackupDestination, parseBackupTimestamp, parseTransformOptions, queryTokenAuth, readBackupBytes, readBundleManifest, rebase, requireAdmin, requireAuth, resolveAuthHooks, resolveAuthOptions, resolveCorsOrigin, resolveDataSources, resolveEmailOptions, resolveRequireAuth, resolveStorageBackend, resolveStorageSources, runFromBundle, safeCompare, serveSPA, transformImage, unknownKeyPolicyFromEnv, validateApiKey, validateCronExpression, validatePasswordStrength, verifyPassword };
 
 //# sourceMappingURL=index.es.js.map