@rebasepro/server 0.13.0 → 0.13.1-canary.g394d868

package/dist/index.es.js

@@ -1,15 +1,15 @@
 import { createRequire as __createRequire } from "module";
 import process from "process";
 __createRequire(import.meta.url);
-import { S as Vector, a as serializeFilter, b as EntityRelation, c as paginateFind, d as resolveDataSource, f as getEffectiveSecurityRules, g as toSnakeCase, h as buildCompositeId, i as deserializeLogicalCondition, l as CollectionRegistry, m as resolveCollectionRelations, n as buildSdkData, o as serializeLogicalCondition, p as findRelation, r as deserializeFilter, s as collectAllPages, t as buildRoutedRebaseData, u as createDataSourceRegistry, x as GeoPoint, y as EntityReference } from "./src-Cum9kox5.js";
+import { C as EntityReference, E as Vector, T as GeoPoint, _ as resolvePrimaryKeys, a as serializeFilter, b as resolveClientListLimit, c as paginateFind, d as createDataSourceRegistry, f as resolveDataSource, g as buildCompositeId, h as resolveCollectionRelations, i as deserializeLogicalCondition, l as resolveFindWindow, m as findRelation, n as buildSdkData, o as serializeLogicalCondition, p as getEffectiveSecurityRules, r as deserializeFilter, s as collectAllPages, t as buildRoutedRebaseData, u as CollectionRegistry, v as toSnakeCase, w as EntityRelation } from "./src-CY0jBL-x.js";
 import { a as DEFAULT_DATA_SOURCE_KEY, r as isPostgresCollectionConfig, t as getCollectionDataPath, u as toCanonicalOp } from "./src-_qQ3RNCK.js";
-import { n as ADMIN_PROPERTY_KEYS, t as ADMIN_COLLECTION_KEYS } from "./admin_block-CcSGdH7M.js";
+import { n as ADMIN_PROPERTY_KEYS, t as ADMIN_COLLECTION_KEYS } from "./admin_block-EmIHae6X.js";
 import { t as isSQLAdmin } from "./backend-CIxN4FVm.js";
 import { n as createContractRoutes } from "./contract-routes-Dj8i5AiM.js";
-import { $ as httpMethodToOperation, A as getEmailVerificationTemplate, B as optionalAuth, C as createDataRateLimiter, D as validatePasswordStrength, E as hashPassword, F as createAdapterAuthMiddleware, G as createApiKeyPreAuth, H as queryTokenAuth, I as createAuthMiddleware, J as isApiKeyToken, K as createFunctionApiKeyGuard, L as createRequireAuth, M as getPasswordResetTemplate, N as getUserInvitationTemplate, O as verifyPassword, P as getWelcomeEmailTemplate, Q as scopeDataDriver, R as extractUserFromToken, S as _coercedNumber, T as resolveAuthHooks, U as requireAdmin, V as publicObjectAuth, W as requireAuth, X as extractBearerToken, Y as validateApiKey, Z as safeCompare, _ as createBuiltinAuthAdapter, a as createSpotifyProvider, b as object, c as createGitLabProvider, d as createFacebookProvider, et as isOperationAllowed, f as createAppleProvider, g as createGoogleProvider, h as createLinkedinProvider, i as createApiKeyStore, it as resolveClientListLimit, j as getMagicLinkTemplate, k as generateSecurePassword, l as createDiscordProvider, m as createGitHubProvider, n as createCustomAuthAdapter, nt as isPublicStoragePath, o as createSlackProvider, p as createMicrosoftProvider, q as createStorageApiKeyGuard, r as createApiKeyRoutes, s as createBitbucketProvider, tt as PUBLIC_STORAGE_PREFIX, u as createTwitterProvider, v as ZodNumber, w as MemoryRateLimitStore, x as string, y as _enum, z as fileTokenAuth } from "./auth-CuC9M2x6.js";
+import { $ as httpMethodToOperation, A as getEmailVerificationTemplate, B as optionalAuth, C as createDataRateLimiter, D as validatePasswordStrength, E as hashPassword, F as createAdapterAuthMiddleware, G as createApiKeyPreAuth, H as queryTokenAuth, I as createAuthMiddleware, J as isApiKeyToken, K as createFunctionApiKeyGuard, L as createRequireAuth, M as getPasswordResetTemplate, N as getUserInvitationTemplate, O as verifyPassword, P as getWelcomeEmailTemplate, Q as scopeDataDriver, R as extractUserFromToken, S as _coercedNumber, T as resolveAuthHooks, U as requireAdmin, V as publicObjectAuth, W as requireAuth, X as extractBearerToken, Y as validateApiKey, Z as safeCompare, _ as createBuiltinAuthAdapter, a as createSpotifyProvider, b as object, c as createGitLabProvider, d as createFacebookProvider, et as isOperationAllowed, f as createAppleProvider, g as createGoogleProvider, h as createLinkedinProvider, i as createApiKeyStore, j as getMagicLinkTemplate, k as generateSecurePassword, l as createDiscordProvider, m as createGitHubProvider, n as createCustomAuthAdapter, nt as isPublicStoragePath, o as createSlackProvider, p as createMicrosoftProvider, q as createStorageApiKeyGuard, r as createApiKeyRoutes, s as createBitbucketProvider, tt as PUBLIC_STORAGE_PREFIX, u as createTwitterProvider, v as ZodNumber, w as MemoryRateLimitStore, x as string, y as _enum, z as fileTokenAuth } from "./auth-Bm5kOV2E.js";
 import { t as logger } from "./logger-BYU66ENZ.js";
-import { n as errorHandler, r as isRebaseApiError, t as ApiError } from "./errors-CgkCzoj7.js";
-import { i as generateDownloadToken, n as configureJwt } from "./jwt-DD6EtpGj.js";
+import { n as errorHandler, t as ApiError } from "./errors-BpudWAVU.js";
+import { i as generateDownloadToken, n as configureJwt } from "./jwt-CzeviDcB.js";
 import { t as logMiddleware } from "./logs-routes-BYA72C_C.js";
 import { n as DOCUMENT_MIME_TYPES, r as IMAGE_MIME_TYPES, t as DEFAULT_MAX_FILE_SIZE } from "./types-DSnOC4mF.js";
 import { t as S3StorageController } from "./S3StorageController-B2EDXXMH.js";
@@ -17,10 +17,10 @@ import { t as GCSStorageController } from "./GCSStorageController-BEmDYFKc.js";
 import { n as loadFunctionsFromDirectory } from "./function-loader-B_1fYfUY.js";
 import { t as createFunctionRoutes } from "./function-routes-C0cLIy3N.js";
 import { n as loadCronJobsFromDirectory } from "./cron-loader-B1S2MCSl.js";
-import { r as validateCronExpression, t as CronScheduler } from "./cron-scheduler-B3RFt0HS.js";
-import { t as createCronRoutes } from "./cron-routes-CrQ0tK-_.js";
-import { t as createCronStore } from "./cron-store-BywZsyfZ.js";
-import { a as parseBackupTimestamp, i as parseBackupDestination, n as createBackupRoutes, o as readBackupBytes, r as listBackupObjects } from "./backup-CVggVhR2.js";
+import { r as validateCronExpression, t as CronScheduler } from "./cron-scheduler-CsQtYLMq.js";
+import { t as createCronRoutes } from "./cron-routes-D5a9v1HY.js";
+import { t as createCronStore } from "./cron-store-Cu4sOseb.js";
+import { a as parseBackupTimestamp, i as parseBackupDestination, n as createBackupRoutes, o as readBackupBytes, r as listBackupObjects } from "./backup-BJiY_mM-.js";
 import { randomBytes, randomUUID } from "node:crypto";
 import * as fs$2 from "fs";
 import fs, { existsSync } from "fs";
@@ -75,7 +75,7 @@ import { promisify as promisify$1 } from "node:util";
 var RebaseApiError = class extends Error {
 	/** HTTP status code, or `undefined` for non-HTTP errors. */
 	status;
-	/** Stable machine-readable error code, when the server supplied one. */
+	/** Stable machine-readable error code, when the server supplied one. See {@link RebaseErrorCode}. */
 	code;
 	/** Structured error payload from the server, when present. */
 	details;
@@ -869,7 +869,12 @@ function parseLogicalGroup(type, raw) {
 	if (inner.startsWith("(") && inner.endsWith(")")) inner = inner.slice(1, -1);
 	inner = inner.trim();
 	if (!inner) return void 0;
-	const parsed = deserializeLogicalCondition(`${type}(${inner})`);
+	let parsed;
+	try {
+		parsed = deserializeLogicalCondition(`${type}(${inner})`);
+	} catch (e) {
+		throw ApiError.badRequest(`Invalid \`${type}\` parameter: ${e instanceof Error ? e.message : String(e)}`, "INVALID_LOGICAL_GROUP");
+	}
 	return "type" in parsed ? parsed : void 0;
 }
 /**
@@ -1055,11 +1060,18 @@ function assertKnownWriteFields(values, collection, options) {
 * This shapes the *response*, which is what the parameter says it does; it is
 * not a column pushdown, so it saves bandwidth rather than database work.
 *
-* `id` always survives. Rows are addressed by it everywhere above this layer —
-* the admin table, realtime reconciliation, the offline cache — and a row that
-* arrives without one is not a smaller row, it is an unusable one. Asking for
-* `fields=title` and being unable to open the record you clicked is a worse
-* answer than one extra key.
+* The collection's key always survives. Rows are addressed by it everywhere
+* above this layer — the admin table, realtime reconciliation, the offline
+* cache — and a row that arrives without one is not a smaller row, it is an
+* unusable one. Asking for `fields=title` and being unable to open the record
+* you clicked is a worse answer than one extra key.
+*
+* That is a statement about the key, not about the name `id`: a collection
+* keyed on `slug`, or on `user_id + role_id`, was projected down to the fields
+* asked for and nothing else, which is the very outcome the paragraph above
+* describes. `assertKnownWriteFields` one function up already has a dedicated
+* error for collections with no `id` column, so this layer had no excuse for
+* assuming one.
 */
 function projectResponseFields(rows, fields, collection, options) {
 	if (!fields || fields.length === 0) return rows;
@@ -1077,7 +1089,8 @@ function projectResponseFields(rows, fields, collection, options) {
 			collection: collection.slug
 		});
 	}
-	const keep = /* @__PURE__ */ new Set([...fields, "id"]);
+	const primaryKeys = resolvePrimaryKeys(collection).map((key) => key.fieldName);
+	const keep = /* @__PURE__ */ new Set([...fields, ...primaryKeys.length > 0 ? primaryKeys : ["id"]]);
 	return rows.map((row) => {
 		const projected = {};
 		for (const key of Object.keys(row)) if (keep.has(key)) projected[key] = row[key];
@@ -1161,26 +1174,43 @@ function createIdempotencyStore(driver) {
 		return ready;
 	};
 	return {
-		async recall(key, uid) {
-			if (!key || !await ensure()) return void 0;
+		async claim(key, uid) {
+			if (!key || !await ensure()) return { status: "claimed" };
 			try {
-				return (await exec(`SELECT response FROM ${TABLE}
-                     WHERE uid = $1 AND key = $2 AND created_at > NOW() - INTERVAL '${TTL_HOURS} hours'`, [principal(uid), key]))[0]?.response;
+				if ((await exec(`INSERT INTO ${TABLE} (key, uid, response, created_at)
+                     VALUES ($1, $2, NULL, NOW())
+                     ON CONFLICT (uid, key) DO UPDATE
+                       SET response = NULL, created_at = NOW()
+                       WHERE ${TABLE}.created_at < NOW() - INTERVAL '${TTL_HOURS} hours'
+                     RETURNING 1 AS claimed`, [key, principal(uid)])).length > 0) return { status: "claimed" };
+				const row = (await exec(`SELECT response, response IS NULL AS pending FROM ${TABLE}
+                     WHERE uid = $1 AND key = $2`, [principal(uid), key]))[0];
+				if (!row) return { status: "claimed" };
+				if (row.pending) return { status: "in-flight" };
+				return {
+					status: "replay",
+					response: row.response
+				};
 			} catch {
-				return;
+				return { status: "claimed" };
 			}
 		},
-		async remember(key, uid, response) {
+		async complete(key, uid, response) {
 			if (!key || !await ensure()) return;
 			try {
-				await exec(`INSERT INTO ${TABLE} (key, uid, response) VALUES ($1, $2, $3::jsonb)
-                     ON CONFLICT (uid, key) DO NOTHING`, [
-					key,
+				await exec(`UPDATE ${TABLE} SET response = $3::jsonb WHERE uid = $1 AND key = $2`, [
 					principal(uid),
+					key,
 					JSON.stringify(response ?? null)
 				]);
 				if (Math.random() < .01) await exec(`DELETE FROM ${TABLE} WHERE created_at < NOW() - INTERVAL '${TTL_HOURS} hours'`);
 			} catch {}
+		},
+		async release(key, uid) {
+			if (!key || !await ensure()) return;
+			try {
+				await exec(`DELETE FROM ${TABLE} WHERE uid = $1 AND key = $2 AND response IS NULL`, [principal(uid), key]);
+			} catch {}
 		}
 	};
 }
@@ -1367,121 +1397,225 @@ var RestApiGenerator = class {
 			if (!entity) throw ApiError.notFound("Entity not found");
 			return c.json(projectResponseFields([entity], queryOptions.fields, resolvedCollection, { include: queryOptions.include })[0]);
 		});
+		/**
+		* Run a bulk handler under an idempotency key.
+		*
+		* All three bulk routes need the identical claim-before-write dance —
+		* claim, replay on a repeat, 409 while one is in flight, release on
+		* failure, complete on success — and getting one of those steps wrong
+		* is exactly the bug the key exists to prevent. Written once so the
+		* three cannot drift into three different notions of "already done".
+		*/
+		const withIdempotency = async (c, run, respond) => {
+			const idempotencyKey = c.req.header(IDEMPOTENCY_HEADER);
+			const uid = c.get("user")?.uid;
+			const store = this.idempotency();
+			const claimed = idempotencyKey && store ? await store.claim(idempotencyKey, uid) : void 0;
+			if (claimed?.status === "replay") return respond(claimed.response);
+			if (claimed?.status === "in-flight") throw ApiError.conflict(`A request with Idempotency-Key '${idempotencyKey}' is already in progress. Retry once it has answered; its result will be replayed.`, "IDEMPOTENCY_KEY_IN_PROGRESS");
+			let response;
+			try {
+				response = await run();
+			} catch (error) {
+				if (claimed?.status === "claimed" && idempotencyKey && store) await store.release(idempotencyKey, uid);
+				throw error;
+			}
+			if (claimed?.status === "claimed" && idempotencyKey && store) await store.complete(idempotencyKey, uid, response);
+			return respond(response);
+		};
+		/**
+		* Validate the envelope every bulk route shares: an array, non-empty,
+		* of objects, within the row cap.
+		*
+		* The cap is the load-bearing one. A batch is a single transaction that
+		* holds its locks for its whole duration, so an unbounded one is a
+		* self-inflicted outage — and the message names both the limit and the
+		* actual count so the caller can chunk to it rather than guess.
+		*/
+		const assertBulkShape = (items, field, requireObjects) => {
+			if (!Array.isArray(items)) throw ApiError.badRequest(`Expected a JSON body of { ${field}: [...] }.`, "INVALID_BULK_BODY");
+			if (requireObjects && items.some((it) => typeof it !== "object" || it === null || Array.isArray(it))) throw ApiError.badRequest(`Every entry in \`${field}\` must be an object.`, "INVALID_BULK_BODY");
+			if (items.length > this.maxBulkRows) throw ApiError.badRequest(`Too many rows: ${items.length} exceeds the ${this.maxBulkRows}-row limit for a single bulk write. Send it in chunks of ${this.maxBulkRows} or fewer.`, "BULK_TOO_LARGE");
+		};
 		this.router.post(`${basePath}/bulk`, async (c) => {
 			this.enforceApiKeyPermission(c, collection.slug);
 			const driver = this.getScopedDriver(c);
 			const path = collection.slug;
 			const body = await parseJsonBody(c);
-			if (!Array.isArray(body?.rows)) throw ApiError.badRequest("Expected a JSON body of { rows: [...] }.", "INVALID_BULK_BODY");
-			if (body.rows.length === 0) return c.json({
+			assertBulkShape(body?.rows, "rows", true);
+			const rows = body.rows;
+			if (rows.length === 0) return c.json({
 				data: [],
 				meta: { written: 0 }
 			});
-			if (body.rows.some((row) => typeof row !== "object" || row === null || Array.isArray(row))) throw ApiError.badRequest("Every entry in `rows` must be an object.", "INVALID_BULK_BODY");
 			if (body.upsert !== void 0 && typeof body.upsert !== "boolean") throw ApiError.badRequest("`upsert` must be a boolean.", "INVALID_BULK_BODY");
-			const maxRows = this.maxBulkRows;
-			if (body.rows.length > maxRows) throw ApiError.badRequest(`Too many rows: ${body.rows.length} exceeds the ${maxRows}-row limit for a single bulk write. Send it in chunks of ${maxRows} or fewer.`, "BULK_TOO_LARGE");
 			if (!driver.saveMany) throw ApiError.badRequest("This collection's data source does not support bulk writes.", "BULK_UNSUPPORTED");
-			body.rows.forEach((row, rowIndex) => assertKnownWriteFields(row, resolvedCollection, { rowIndex }));
-			const rows = await driver.saveMany({
-				path,
-				rows: body.rows,
-				collection: resolvedCollection,
-				upsert: body.upsert === true
+			rows.forEach((row, rowIndex) => assertKnownWriteFields(row, resolvedCollection, { rowIndex }));
+			return withIdempotency(c, async () => {
+				const written = await driver.saveMany({
+					path,
+					rows,
+					collection: resolvedCollection,
+					upsert: body.upsert === true
+				});
+				return {
+					data: written.map((row) => this.formatResponse(row)),
+					meta: { written: written.length }
+				};
+			}, (result) => c.json(result));
+		});
+		this.router.patch(`${basePath}/bulk`, async (c) => {
+			this.enforceApiKeyPermission(c, collection.slug);
+			const driver = this.getScopedDriver(c);
+			const path = collection.slug;
+			const body = await parseJsonBody(c);
+			assertBulkShape(body?.updates, "updates", true);
+			const updates = body.updates;
+			if (updates.length === 0) return c.json({
+				data: [],
+				meta: { written: 0 }
 			});
-			return c.json({
-				data: rows.map((row) => this.formatResponse(row)),
-				meta: { written: rows.length }
+			if (!driver.updateMany) throw ApiError.badRequest("This collection's data source does not support bulk updates.", "BULK_UNSUPPORTED");
+			updates.forEach((entry, rowIndex) => {
+				if (entry.id === void 0 || entry.id === null || entry.id === "") throw ApiError.badRequest(`Entry ${rowIndex} of \`updates\` is missing \`id\`. Each entry must be { id, data }.`, "INVALID_BULK_BODY");
+				if (typeof entry.data !== "object" || entry.data === null || Array.isArray(entry.data)) throw ApiError.badRequest(`Entry ${rowIndex} of \`updates\` is missing \`data\`, or it is not an object.`, "INVALID_BULK_BODY");
+				assertKnownWriteFields(entry.data, resolvedCollection, { rowIndex });
 			});
+			return withIdempotency(c, async () => {
+				const written = await driver.updateMany({
+					path,
+					updates: updates.map((entry) => ({
+						id: entry.id,
+						values: entry.data
+					})),
+					collection: resolvedCollection
+				});
+				return {
+					data: written.map((row) => this.formatResponse(row)),
+					meta: { written: written.length }
+				};
+			}, (result) => c.json(result));
+		});
+		this.router.post(`${basePath}/bulk/delete`, async (c) => {
+			this.enforceApiKeyPermission(c, collection.slug);
+			const driver = this.getScopedDriver(c);
+			const path = collection.slug;
+			const body = await parseJsonBody(c);
+			assertBulkShape(body?.ids, "ids", false);
+			const ids = body.ids;
+			if (ids.length === 0) return c.json({ meta: { deleted: 0 } });
+			if (ids.some((id) => typeof id !== "string" && typeof id !== "number")) throw ApiError.badRequest("Every entry in `ids` must be a string or a number.", "INVALID_BULK_BODY");
+			if (!driver.deleteMany) throw ApiError.badRequest("This collection's data source does not support bulk deletes.", "BULK_UNSUPPORTED");
+			return withIdempotency(c, async () => {
+				await driver.deleteMany({
+					path,
+					ids,
+					collection: resolvedCollection
+				});
+				return { meta: { deleted: ids.length } };
+			}, (result) => c.json(result));
 		});
 		this.router.post(basePath, async (c) => {
-			try {
-				this.enforceApiKeyPermission(c, collection.slug);
-				const driver = this.getScopedDriver(c);
-				const path = collection.slug;
-				const body = await parseJsonBody(c);
-				const isAuth = collection.auth;
-				const isAuthCollection = isAuth === true || isAuth && typeof isAuth === "object" && isAuth.enabled === true;
-				const collectionAuthConfig = typeof isAuth === "object" ? isAuth : void 0;
-				if (!isAuthCollection) assertKnownWriteFields(body, resolvedCollection);
-				else {
-					const contract = this.authAdapter?.describeUserCreationContract?.(collectionAuthConfig);
-					if (contract?.validate) assertKnownWriteFields(body, resolvedCollection, { extraKnownFields: contract.extraFields });
-				}
-				if (isAuthCollection && this.authAdapter?.prepareUserCreation) {
-					const prepared = await this.authAdapter.prepareUserCreation(body, collectionAuthConfig);
-					const entity = await driver.save({
-						path,
-						values: prepared.values,
-						collection: resolvedCollection,
-						status: "new"
-					});
-					const result = prepared.hookHandledEmail ? {
-						temporaryPassword: prepared.clearPassword,
-						invitationSent: prepared.invitationSent
-					} : this.authAdapter.finalizeUserCreation ? await this.authAdapter.finalizeUserCreation({
-						id: entity.id,
-						values: entity
-					}, prepared.clearPassword) : { invitationSent: false };
-					const response = this.formatResponse(entity);
-					return c.json({
-						...response,
-						invitationSent: result.invitationSent,
-						...result.temporaryPassword ? { temporaryPassword: result.temporaryPassword } : {},
-						..."emailDeliveryFailed" in result && result.emailDeliveryFailed ? { emailDeliveryFailed: true } : {}
-					}, 201);
-				}
-				const idempotencyKey = c.req.header(IDEMPOTENCY_HEADER);
-				const uid = c.get("user")?.uid;
-				const store = this.idempotency();
-				if (idempotencyKey && store) {
-					const already = await store.recall(idempotencyKey, uid);
-					if (already !== void 0) return c.json(already, 201);
-				}
+			this.enforceApiKeyPermission(c, collection.slug);
+			const driver = this.getScopedDriver(c);
+			const path = collection.slug;
+			const body = await parseJsonBody(c);
+			const isAuth = collection.auth;
+			const isAuthCollection = isAuth === true || isAuth && typeof isAuth === "object" && isAuth.enabled === true;
+			const collectionAuthConfig = typeof isAuth === "object" ? isAuth : void 0;
+			if (!isAuthCollection) assertKnownWriteFields(body, resolvedCollection);
+			else {
+				const contract = this.authAdapter?.describeUserCreationContract?.(collectionAuthConfig);
+				if (contract?.validate) assertKnownWriteFields(body, resolvedCollection, { extraKnownFields: contract.extraFields });
+			}
+			if (isAuthCollection && this.authAdapter?.prepareUserCreation) {
+				const prepared = await this.authAdapter.prepareUserCreation(body, collectionAuthConfig);
 				const entity = await driver.save({
 					path,
-					values: body,
+					values: prepared.values,
 					collection: resolvedCollection,
 					status: "new"
 				});
+				const result = prepared.hookHandledEmail ? {
+					temporaryPassword: prepared.clearPassword,
+					invitationSent: prepared.invitationSent
+				} : this.authAdapter.finalizeUserCreation ? await this.authAdapter.finalizeUserCreation({
+					id: entity.id,
+					values: entity
+				}, prepared.clearPassword) : { invitationSent: false };
 				const response = this.formatResponse(entity);
-				if (idempotencyKey && store) await store.remember(idempotencyKey, uid, response);
-				return c.json(response, 201);
-			} catch (error) {
-				if (isRebaseApiError(error) && !error.code) {
-					if (!(error instanceof TypeError || error instanceof RangeError || error instanceof SyntaxError || error instanceof ReferenceError)) error.code = "BAD_REQUEST";
-				}
-				throw error;
+				return c.json({
+					...response,
+					invitationSent: result.invitationSent,
+					...result.temporaryPassword ? { temporaryPassword: result.temporaryPassword } : {},
+					..."emailDeliveryFailed" in result && result.emailDeliveryFailed ? { emailDeliveryFailed: true } : {}
+				}, 201);
 			}
-		});
-		this.router.put(`${basePath}/:id`, async (c) => {
+			const idempotencyKey = c.req.header(IDEMPOTENCY_HEADER);
+			const uid = c.get("user")?.uid;
+			const store = this.idempotency();
+			const claimed = idempotencyKey && store ? await store.claim(idempotencyKey, uid) : void 0;
+			if (claimed?.status === "replay") return c.json(claimed.response, 201);
+			if (claimed?.status === "in-flight") throw ApiError.conflict(`A request with Idempotency-Key '${idempotencyKey}' is already in progress. Retry once it has answered; its result will be replayed.`, "IDEMPOTENCY_KEY_IN_PROGRESS");
+			let response;
 			try {
-				this.enforceApiKeyPermission(c, collection.slug);
-				const id = c.req.param("id");
-				const driver = this.getScopedDriver(c);
-				if (!await driver.fetchOne({
-					path: getCollectionDataPath(collection),
-					id: String(id),
-					collection: resolvedCollection
-				})) throw ApiError.notFound("Entity not found");
-				const body = await parseJsonBody(c);
-				assertKnownWriteFields(body, resolvedCollection);
 				const entity = await driver.save({
-					path: getCollectionDataPath(collection),
-					id: String(id),
+					path,
 					values: body,
 					collection: resolvedCollection,
-					status: "existing"
+					status: "new"
 				});
-				const response = this.formatResponse(entity);
-				return c.json(response);
+				response = this.formatResponse(entity);
 			} catch (error) {
-				if (isRebaseApiError(error) && !error.code) {
-					if (!(error instanceof TypeError || error instanceof RangeError || error instanceof SyntaxError || error instanceof ReferenceError)) error.code = "BAD_REQUEST";
-				}
+				if (claimed?.status === "claimed" && idempotencyKey && store) await store.release(idempotencyKey, uid);
 				throw error;
 			}
+			if (claimed?.status === "claimed" && idempotencyKey && store) await store.complete(idempotencyKey, uid, response);
+			return c.json(response, 201);
 		});
+		const updateEntity = async (c) => {
+			this.enforceApiKeyPermission(c, collection.slug);
+			const id = c.req.param("id");
+			const driver = this.getScopedDriver(c);
+			if (!await driver.fetchOne({
+				path: getCollectionDataPath(collection),
+				id: String(id),
+				collection: resolvedCollection
+			})) throw ApiError.notFound("Entity not found");
+			const body = await parseJsonBody(c);
+			assertKnownWriteFields(body, resolvedCollection);
+			const entity = await driver.save({
+				path: getCollectionDataPath(collection),
+				id: String(id),
+				values: body,
+				collection: resolvedCollection,
+				status: "existing"
+			});
+			const response = this.formatResponse(entity);
+			return c.json(response);
+		};
+		/**
+		* The verb that matches what this actually does.
+		*
+		* The handler merges: it writes the columns in the body and leaves the
+		* rest alone, which is what the SDK's `update(id, data: Partial<M>)`
+		* sends. PUT was the only route, and PUT means replace — so the
+		* generated OpenAPI spec described a full replacement while the server
+		* performed a merge, and it reused the *create* input schema for it,
+		* `required` fields and all. A client generated from that spec was
+		* given a contract the server does not implement, and a spec-validating
+		* gateway in front of this API would reject partial updates the server
+		* would have accepted.
+		*
+		* PUT stays mounted on the same handler rather than being changed or
+		* removed: every published SDK sends it, and altering its semantics to
+		* be a true replace would silently start nulling columns that callers
+		* had simply omitted for years — a data-loss change disguised as a
+		* standards fix. So PATCH is the honest name, PUT is the compatible one,
+		* and both do the documented thing.
+		*/
+		this.router.patch(`${basePath}/:id`, updateEntity);
+		this.router.put(`${basePath}/:id`, updateEntity);
 		this.router.delete(`${basePath}/:id`, async (c) => {
 			this.enforceApiKeyPermission(c, collection.slug);
 			const id = c.req.param("id");
@@ -1552,6 +1686,7 @@ var RestApiGenerator = class {
 				const total = driver.count ? await driver.count({
 					path: parsed.collectionPath,
 					filter: queryOptions.where,
+					logical: queryOptions.logical,
 					searchString
 				}) : 0;
 				return c.json({ count: total });
@@ -1563,7 +1698,9 @@ var RestApiGenerator = class {
 					id: parsed.id
 				});
 				if (!entity) throw ApiError.notFound("Entity not found");
-				return c.json(entity);
+				const nestedCollection = this.resolveNestedWriteCollection(parsed.collectionPath);
+				if (!nestedCollection) return c.json(entity);
+				return c.json(projectResponseFields([entity], queryOptions.fields, nestedCollection, { include: queryOptions.include })[0]);
 			} else {
 				const queryDict = c.req.queries();
 				const queryOptions = this.parseQuery(queryDict);
@@ -1588,8 +1725,9 @@ var RestApiGenerator = class {
 					logical: queryOptions.logical,
 					searchString
 				}) : entities.length;
+				const listCollection = this.resolveNestedWriteCollection(parsed.collectionPath);
 				return c.json({
-					data: entities,
+					data: listCollection ? projectResponseFields(entities, queryOptions.fields, listCollection, { include: queryOptions.include }) : entities,
 					meta: {
 						total,
 						limit: queryOptions.limit,
@@ -1618,7 +1756,7 @@ var RestApiGenerator = class {
 			const response = this.formatResponse(entity);
 			return c.json(response, 201);
 		});
-		this.router.put("/:parent/:parentId/:rest{.+}", async (c, next) => {
+		const updateNested = async (c, next) => {
 			const rest = c.req.param("rest");
 			if (!rest || rest === "undefined") return next();
 			const rawPath = `${c.req.param("parent")}/${c.req.param("parentId")}/${rest}`;
@@ -1637,7 +1775,9 @@ var RestApiGenerator = class {
 			});
 			const response = this.formatResponse(entity);
 			return c.json(response);
-		});
+		};
+		this.router.patch("/:parent/:parentId/:rest{.+}", updateNested);
+		this.router.put("/:parent/:parentId/:rest{.+}", updateNested);
 		this.router.delete("/:parent/:parentId/:rest{.+}", async (c, next) => {
 			const rest = c.req.param("rest");
 			if (!rest || rest === "undefined") return next();
@@ -3081,7 +3221,7 @@ function assertStorageAccessControlConfigured(state, isProduction) {
 //#region src/init/docs.ts
 async function mountOpenApiDocs(app, basePath, enableSwagger, activeCollections, requireAuth) {
 	if (enableSwagger === false || activeCollections.length === 0) return;
-	const { generateOpenApiSpec } = await import("./openapi-generator-BEwyiaAr.js");
+	const { generateOpenApiSpec } = await import("./openapi-generator-DieRvJdS.js");
 	app.get(`${basePath}/docs`, (c) => {
 		const spec = generateOpenApiSpec(activeCollections, {
 			basePath,
@@ -3418,6 +3558,13 @@ function resolveBaseUrl(configured) {
 function createTransport(config, environment) {
 	const fetchFn = config.fetch || globalThis.fetch;
 	const apiPath = config.apiPath || "/api";
+	for (const field of ["baseUrl", "storageUrlOrigin"]) {
+		const value = config[field];
+		if (!value || !apiPath) continue;
+		const trimmed = value.replace(/\/+$/, "");
+		if (!trimmed.endsWith(apiPath)) continue;
+		console.warn(`[Rebase] ${field} ${JSON.stringify(value)} already ends with the API path ${JSON.stringify(apiPath)}, which is appended to it — requests will go to ${trimmed}${apiPath}/… and 404. Pass the origin only (${JSON.stringify(trimmed.slice(0, trimmed.length - apiPath.length) || "/")}), or set \`apiPath\` if the server really does mount the API one level deeper.`);
+	}
 	let token = config.token;
 	let tokenGetter;
 	let onUnauthorizedHandler = config.onUnauthorized;
@@ -3601,6 +3748,11 @@ function createAuth(transport, options) {
 	const authFlowMode = opts.authFlowMode || "json";
 	const STORAGE_KEY = "rebase_auth";
 	const REFRESH_BUFFER_MS = 12e4;
+	/**
+	* The largest delay `setTimeout` can hold — 2^31 - 1 ms, about 24.8 days.
+	* Anything larger is silently clamped to 1ms by Node and every browser.
+	*/
+	const MAX_TIMER_DELAY_MS = 2147483647;
 	const MAX_REFRESH_RETRIES = 5;
 	const REFRESH_RETRY_BASE_MS = 1e3;
 	const REFRESH_RETRY_MAX_MS = 3e4;
@@ -3628,7 +3780,9 @@ function createAuth(transport, options) {
 	function emit(event, session) {
 		for (const fn of listeners) try {
 			fn(event, session);
-		} catch (e) {}
+		} catch (e) {
+			console.error("Error in auth state change listener:", e);
+		}
 	}
 	function saveSession(session) {
 		if (!persistSession || authFlowMode === "cookie") return;
@@ -3732,6 +3886,10 @@ function createAuth(transport, options) {
 			attemptScheduledRefresh(0);
 			return;
 		}
+		if (delay > MAX_TIMER_DELAY_MS) {
+			refreshTimeout = setTimeout(() => scheduleRefresh(expiresAt), MAX_TIMER_DELAY_MS);
+			return;
+		}
 		refreshTimeout = setTimeout(() => {
 			attemptScheduledRefresh(0);
 		}, delay);
@@ -4506,6 +4664,11 @@ var SDKQueryBuilder = class {
 		return this.collection.listen(this.params, onUpdate, onError);
 	}
 };
+/**
+* Counts currently in flight, keyed by the exact request they issue. Entries
+* live only for the duration of the request — see `count()` for why.
+*/
+var inflightCounts = /* @__PURE__ */ new Map();
 function createCollectionClient(transport, slug, ws) {
 	const basePath = `/data/${slug}`;
 	const client = {
@@ -4550,18 +4713,63 @@ function createCollectionClient(transport, slug, ws) {
 				body: JSON.stringify({
 					rows: data,
 					...options?.upsert ? { upsert: true } : {}
-				})
+				}),
+				...options?.idempotencyKey ? { headers: { "Idempotency-Key": options.idempotencyKey } } : {}
 			})).data || [];
 		},
+		/**
+		* Still `PUT`, deliberately, even though the server now serves `PATCH`
+		* on the same handler and `PATCH` is the honest verb for a merge.
+		*
+		* The two are interchangeable server-side, so switching buys nothing at
+		* runtime — and it costs compatibility in the direction that fails
+		* quietly. A 0.14 client talking to a 0.13 server would send `PATCH` to
+		* a route that does not exist and get a **404**, which is
+		* indistinguishable from "that row is gone". Every write would look like
+		* a missing record.
+		*
+		* `PATCH` is what the OpenAPI spec advertises, so anyone generating a
+		* client gets the correct verb; this stays on `PUT` until the oldest
+		* supported server is one that serves both.
+		*/
 		async update(id, data) {
 			return await transport.request(`${basePath}/${encodeURIComponent(String(id))}`, {
 				method: "PUT",
 				body: JSON.stringify(data)
 			});
 		},
+		async updateMany(updates, options) {
+			if (!Array.isArray(updates)) throw new TypeError("updateMany expects an array of { id, data } entries.");
+			if (updates.length === 0) return [];
+			return (await transport.request(`${basePath}/bulk`, {
+				method: "PATCH",
+				body: JSON.stringify({ updates }),
+				...options?.idempotencyKey ? { headers: { "Idempotency-Key": options.idempotencyKey } } : {}
+			})).data || [];
+		},
 		async delete(id) {
 			await transport.request(`${basePath}/${encodeURIComponent(String(id))}`, { method: "DELETE" });
 		},
+		/**
+		* `POST .../bulk/delete`, not `DELETE .../bulk`.
+		*
+		* The honest verb would take the ids in a DELETE body, and that is the
+		* one request shape the HTTP ecosystem handles unreliably: bodies on
+		* DELETE are permitted but widely dropped by proxies and CDNs, and
+		* several OpenAPI generators ignore `requestBody` on a DELETE
+		* operation, so a generated client would send the request without its
+		* ids. A backend deployed behind arbitrary ingress cannot take that
+		* bet. Same reason `:batchDelete` exists in Google's API guidelines.
+		*/
+		async deleteMany(ids, options) {
+			if (!Array.isArray(ids)) throw new TypeError("deleteMany expects an array of ids.");
+			if (ids.length === 0) return;
+			await transport.request(`${basePath}/bulk/delete`, {
+				method: "POST",
+				body: JSON.stringify({ ids }),
+				...options?.idempotencyKey ? { headers: { "Idempotency-Key": options.idempotencyKey } } : {}
+			});
+		},
 		async count(params) {
 			const qs = buildQueryString({
 				...params,
@@ -4569,12 +4777,28 @@ function createCollectionClient(transport, slug, ws) {
 				offset: void 0,
 				include: void 0
 			});
-			return (await transport.request(basePath + "/count" + qs, { method: "GET" })).count ?? 0;
+			const key = basePath + "/count" + qs;
+			const inflight = inflightCounts.get(key);
+			if (inflight) return inflight;
+			const request = transport.request(key, { method: "GET" }).then((raw) => raw.count ?? 0);
+			inflightCounts.set(key, request);
+			try {
+				return await request;
+			} finally {
+				inflightCounts.delete(key);
+			}
 		},
 		observe(params, onResult, onError, options) {
 			let closed = false;
-			const emit = (result) => {
+			let liveDelivered = false;
+			let signature;
+			const deliver = (result, fromLive) => {
 				if (closed) return;
+				if (fromLive) liveDelivered = true;
+				else if (liveDelivered) return;
+				const next = `${result.meta?.total ?? ""}|${JSON.stringify(result.data)}`;
+				if (signature !== void 0 && next === signature) return;
+				signature = next;
 				onResult({
 					...result,
 					fromCache: false,
@@ -4582,10 +4806,10 @@ function createCollectionClient(transport, slug, ws) {
 					partial: false
 				});
 			};
-			client.find(params).then(emit).catch((error) => {
+			client.find(params).then((result) => deliver(result, false)).catch((error) => {
 				if (!closed) onError?.(error);
 			});
-			const live = options?.realtime !== false && client.listen ? client.listen(params, emit, onError) : void 0;
+			const live = options?.realtime !== false && client.listen ? client.listen(params, (result) => deliver(result, true), onError) : void 0;
 			return () => {
 				closed = true;
 				live?.();
@@ -4593,17 +4817,24 @@ function createCollectionClient(transport, slug, ws) {
 		},
 		observeById(id, onResult, onError, options) {
 			let closed = false;
-			const emit = (row) => {
+			let liveDelivered = false;
+			let signature;
+			const deliver = (row, fromLive) => {
 				if (closed) return;
+				if (fromLive) liveDelivered = true;
+				else if (liveDelivered) return;
+				const next = row === void 0 ? "\0missing" : JSON.stringify(row);
+				if (signature !== void 0 && next === signature) return;
+				signature = next;
 				onResult(row, {
 					fromCache: false,
 					hasPendingWrites: false
 				});
 			};
-			client.findById(id).then(emit).catch((error) => {
+			client.findById(id).then((row) => deliver(row, false)).catch((error) => {
 				if (!closed) onError?.(error);
 			});
-			const live = options?.realtime !== false && client.listenById ? client.listenById(id, emit, onError) : void 0;
+			const live = options?.realtime !== false && client.listenById ? client.listenById(id, (row) => deliver(row, true), onError) : void 0;
 			return () => {
 				closed = true;
 				live?.();
@@ -4634,51 +4865,43 @@ function createCollectionClient(transport, slug, ws) {
 		client.listen = (params, onUpdate, onError) => {
 			let active = true;
 			let lastUpdateId = 0;
+			let lastKnownTotal;
+			const window = resolveFindWindow(params);
 			const unsub = ws.listenCollection({
 				path: slug,
 				filter: params?.where,
+				logical: params?.logical,
 				limit: params?.limit,
-				startAfter: params?.offset ? String(params.offset) : void 0,
+				offset: window.driverOffset,
 				orderBy: params?.orderBy?.[0],
 				order: params?.orderBy?.[1],
 				searchString: params?.searchString
 			}, (incomingRows) => {
 				const currentUpdateId = ++lastUpdateId;
-				const requestedLimit = params?.limit || 20;
-				const offset = params?.offset || 0;
+				const requestedLimit = window.limit;
+				const offset = window.offset;
 				const rows = incomingRows;
-				const heuristicTotal = rows.length;
-				const heuristicHasMore = rows.length >= requestedLimit;
-				if (client.count) client.count(params).then((total) => {
-					if (active && currentUpdateId === lastUpdateId) onUpdate({
+				const emit = (total, hasMore) => {
+					if (!active || currentUpdateId !== lastUpdateId) return;
+					onUpdate({
 						data: rows,
 						meta: {
 							total,
 							limit: requestedLimit,
 							offset,
-							hasMore: offset + rows.length < total
+							hasMore
 						}
 					});
+				};
+				const emitWithoutCount = () => emit(offset + rows.length, rows.length >= requestedLimit);
+				if (client.count) client.count(params).then((total) => {
+					lastKnownTotal = total;
+					emit(total, offset + rows.length < total);
 				}).catch(() => {
-					if (active && currentUpdateId === lastUpdateId) onUpdate({
-						data: rows,
-						meta: {
-							total: heuristicTotal,
-							limit: requestedLimit,
-							offset,
-							hasMore: heuristicHasMore
-						}
-					});
-				});
-				else onUpdate({
-					data: rows,
-					meta: {
-						total: heuristicTotal,
-						limit: requestedLimit,
-						offset,
-						hasMore: heuristicHasMore
-					}
+					if (lastKnownTotal !== void 0) emit(lastKnownTotal, offset + rows.length < lastKnownTotal);
+					else emitWithoutCount();
 				});
+				else emitWithoutCount();
 			}, onError);
 			return () => {
 				active = false;
@@ -6061,15 +6284,10 @@ var RebaseWebSocketClient = class {
 		}
 	}
 	createCollectionSubscriptionKey(props) {
+		const { collection, ...query } = props;
 		const key = {
-			path: props.path,
-			filter: props.filter,
-			limit: props.limit,
-			startAfter: props.startAfter,
-			orderBy: props.orderBy,
-			order: props.order,
-			searchString: props.searchString,
-			collection: props.collection?.name
+			...query,
+			collection: collection?.name
 		};
 		return JSON.stringify(key, (_, value) => {
 			if (value && typeof value === "object" && !Array.isArray(value)) return Object.keys(value).sort().reduce((sorted, k) => {
@@ -6982,14 +7200,23 @@ function looseEquals(a, b) {
 */
 function likeToRegExp(pattern, caseInsensitive) {
 	let source = "^";
+	let lastWasWildcard = false;
 	for (let i = 0; i < pattern.length; i++) {
 		const char = pattern[i];
 		if (char === "\\" && i + 1 < pattern.length) {
 			source += pattern[i + 1].replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 			i++;
-		} else if (char === "%") source += "[\\s\\S]*";
-		else if (char === "_") source += "[\\s\\S]";
-		else source += char.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+			lastWasWildcard = false;
+		} else if (char === "%") {
+			if (!lastWasWildcard) source += "[\\s\\S]*";
+			lastWasWildcard = true;
+		} else if (char === "_") {
+			source += "[\\s\\S]";
+			lastWasWildcard = false;
+		} else {
+			source += char.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+			lastWasWildcard = false;
+		}
 	}
 	return new RegExp(source + "$", caseInsensitive ? "i" : "");
 }
@@ -7121,12 +7348,20 @@ function sortRows(rows, orderBy) {
 function tiebreak(a, b) {
 	return compareValues(a.id, b.id) ?? 0;
 }
-/** Resolve `page`/`offset`/`limit` the way the server does. */
+/**
+* Resolve `page`/`offset`/`limit` the way the server does.
+*
+* It did not: this defaulted an absent limit to 20 while `/api/data` pages by
+* 50, so the same `observe()` answered with 20 rows from the local database and
+* 50 from the network — a list that changed length depending on which side
+* answered, with `page` striding differently on each. Delegated now, so the
+* sentence above is true by construction rather than by agreement.
+*/
 function resolvePagination(params) {
-	const limit = params?.limit ?? 20;
+	const { limit, offset } = resolveFindWindow(params);
 	return {
 		limit,
-		offset: params?.page != null ? Math.max(0, (params.page - 1) * limit) : params?.offset ?? 0
+		offset
 	};
 }
 /**
@@ -7450,6 +7685,72 @@ var OfflineManager = class {
 				this.notifyCollection(slug);
 				return rows;
 			},
+			updateMany: async (updates, options) => {
+				await this.ensureCollection(slug);
+				if (!Array.isArray(updates)) throw new TypeError("updateMany expects an array of { id, data } entries.");
+				if (updates.length === 0) return [];
+				const anyPending = updates.some((u) => this.hasPending(slug, u.id));
+				if (this.connectivity.shouldAttempt() && !anyPending) try {
+					const rows = await inner.updateMany(updates, options);
+					this.connectivity.markSuccess();
+					await this.ingest(slug, rows);
+					this.notifyCollection(slug);
+					return rows;
+				} catch (error) {
+					if (!isNetworkError(error)) throw error;
+					this.connectivity.markFailure();
+				}
+				const rollback = {};
+				const optimistic = [];
+				for (const { id, data } of updates) {
+					const base = this.rawLocalRow(slug, id);
+					rollback[String(id)] = base ?? null;
+					optimistic.push({
+						...base ?? {},
+						...data,
+						id
+					});
+				}
+				await this.enqueue({
+					collection: slug,
+					type: "updateMany",
+					updates: updates.map((u) => ({
+						id: u.id,
+						data: u.data
+					})),
+					rollback: { rows: rollback }
+				});
+				for (const row of optimistic) this.setLocalRow(slug, row.id, row);
+				this.notifyCollection(slug);
+				return optimistic;
+			},
+			deleteMany: async (ids, options) => {
+				await this.ensureCollection(slug);
+				if (!Array.isArray(ids)) throw new TypeError("deleteMany expects an array of ids.");
+				if (ids.length === 0) return;
+				const anyPending = ids.some((id) => this.hasPending(slug, id));
+				if (this.connectivity.shouldAttempt() && !anyPending) try {
+					await inner.deleteMany(ids, options);
+					this.connectivity.markSuccess();
+					for (const id of ids) this.removeLocalRow(slug, id, true);
+					this.notifyCollection(slug);
+					this.scheduleRefresh(slug);
+					return;
+				} catch (error) {
+					if (!isNetworkError(error)) throw error;
+					this.connectivity.markFailure();
+				}
+				const rollback = {};
+				for (const id of ids) rollback[String(id)] = this.rawLocalRow(slug, id) ?? null;
+				await this.enqueue({
+					collection: slug,
+					type: "deleteMany",
+					ids,
+					rollback: { rows: rollback }
+				});
+				for (const id of ids) this.removeLocalRow(slug, id, false);
+				this.notifyCollection(slug);
+			},
 			update: async (id, data) => {
 				await this.ensureCollection(slug);
 				if (this.connectivity.shouldAttempt() && !this.hasPending(slug, id)) try {
@@ -7748,9 +8049,8 @@ var OfflineManager = class {
 		if (!state) return {
 			data: [],
 			meta: {
+				...resolvePagination(params),
 				total: 0,
-				limit: params?.limit ?? 20,
-				offset: params?.offset ?? 0,
 				hasMore: false
 			},
 			fromCache: true,
@@ -7786,16 +8086,14 @@ var OfflineManager = class {
 		}
 		let added = 0;
 		const offset = snapshot.offset ?? 0;
-		if (exact && offset === 0) {
-			for (const [key, entry] of state.rows) {
-				if (seen.has(key) || !this.hasPending(slug, key)) continue;
-				if (!this.isLocallyCreated(slug, key)) continue;
-				if (!matchesParams(entry.row, params)) continue;
-				rows.push(entry.row);
-				added++;
-			}
-			if (added > 0 && params?.orderBy) sortRows(rows, params.orderBy);
+		if (exact && offset === 0) for (const [key, entry] of state.rows) {
+			if (seen.has(key) || !this.hasPending(slug, key)) continue;
+			if (!this.isLocallyCreated(slug, key)) continue;
+			if (!matchesParams(entry.row, params)) continue;
+			rows.push(entry.row);
+			added++;
 		}
+		if (params?.orderBy) sortRows(rows, params.orderBy);
 		return {
 			data: rows,
 			meta: {
@@ -7942,17 +8240,17 @@ var OfflineManager = class {
 		return row;
 	}
 	recordSnapshot(slug, params, result) {
+		const window = resolvePagination(params);
 		const meta = result.meta ?? {
 			total: result.data?.length ?? 0,
-			limit: 20,
-			offset: 0,
+			...window,
 			hasMore: false
 		};
 		const snapshot = {
 			ids: (result.data ?? []).map((row) => row.id).filter((id) => id !== void 0),
 			total: meta.total ?? result.data?.length ?? 0,
-			limit: meta.limit ?? params?.limit ?? 20,
-			offset: meta.offset ?? params?.offset ?? 0,
+			limit: meta.limit ?? window.limit,
+			offset: meta.offset ?? window.offset,
 			hasMore: meta.hasMore ?? false
 		};
 		const state = this.collectionState(slug);
@@ -8167,11 +8465,25 @@ var OfflineManager = class {
 			await this.adoptServerRow(op, op.id, row);
 		} else if (op.type === "createMany") {
 			const queued = op.data ?? [];
-			const rows = await inner.createMany(queued, op.upsert ? { upsert: true } : void 0);
+			const rows = await inner.createMany(queued, {
+				...op.upsert ? { upsert: true } : {},
+				idempotencyKey: op.mutationId
+			});
 			for (let i = 0; i < rows.length; i++) await this.adoptServerRow(op, queued[i]?.id, rows[i]);
+		} else if (op.type === "updateMany") {
+			const queued = op.updates ?? [];
+			const rows = await inner.updateMany(queued.map((u) => ({
+				id: u.id,
+				data: u.data
+			})), { idempotencyKey: op.mutationId });
+			for (let i = 0; i < rows.length; i++) await this.ingestReplaced(op, queued[i].id, rows[i]);
 		} else if (op.type === "update") {
 			const row = await inner.update(op.id, op.data);
 			await this.ingestReplaced(op, op.id, row);
+		} else if (op.type === "deleteMany") {
+			const ids = op.ids ?? [];
+			await inner.deleteMany(ids, { idempotencyKey: op.mutationId });
+			for (const id of ids) this.removeLocalRow(op.collection, id, true);
 		} else if (op.type === "delete") {
 			await inner.delete(op.id);
 			this.removeLocalRow(op.collection, op.id, true);
@@ -8414,23 +8726,37 @@ var OfflineManager = class {
 /**
 * Derive a WebSocket URL from an HTTP base URL.
 * `http://` → `ws://`, `https://` → `wss://`.
+*
+* A backend mounted under a path is the reason `baseUrl` accepts one, so the
+* path is kept. It used to be kept for an absolute `baseUrl` and dropped for a
+* relative one — resolved through `.origin` — so one deployment dialled two
+* different sockets depending on whether its config said `"/backend"` or
+* `"https://app.example.com/backend"`.
+*
+* Returns `""` when there is nothing to resolve against: a relative `baseUrl`
+* outside a browser has no origin, and inventing one would dial somewhere
+* arbitrary. The caller warns rather than leaving that silent.
 */
 function deriveWebSocketUrl(baseUrl) {
+	const toWsProtocol = (url) => {
+		const secure = /^(https|wss):/i.test(url);
+		return url.replace(/^https?:\/\//i, secure ? "wss://" : "ws://").replace(/^wss?:\/\//i, secure ? "wss://" : "ws://").replace(/\/$/, "");
+	};
 	if (typeof window !== "undefined") {
-		let absoluteUrl = "";
+		let absoluteUrl;
 		if (!baseUrl) absoluteUrl = window.location.origin;
 		else if (/^https?:\/\//i.test(baseUrl) || /^wss?:\/\//i.test(baseUrl)) absoluteUrl = baseUrl;
 		else try {
-			absoluteUrl = new URL(baseUrl, window.location.href).origin;
+			const resolved = new URL(baseUrl, window.location.href);
+			absoluteUrl = resolved.origin + resolved.pathname;
 		} catch {
 			absoluteUrl = window.location.origin;
 		}
-		const protocol = absoluteUrl.startsWith("https:") || absoluteUrl.startsWith("wss:") ? "wss:" : "ws:";
-		return absoluteUrl.replace(/^https?:\/\//i, `${protocol}//`).replace(/^wss?:\/\//i, `${protocol}//`).replace(/\/$/, "");
+		return toWsProtocol(absoluteUrl);
 	}
 	if (!baseUrl) return "";
 	if (!/^https?:\/\//i.test(baseUrl) && !/^wss?:\/\//i.test(baseUrl)) return "";
-	return baseUrl.replace(/^https?:\/\//i, (match) => match.toLowerCase() === "https://" ? "wss://" : "ws://").replace(/\/$/, "");
+	return toWsProtocol(baseUrl);
 }
 function createRebaseClient(options) {
 	const transport = createTransport(options, { credentialOutOfBand: options.auth?.authFlowMode === "cookie" });
@@ -8458,7 +8784,11 @@ function createRebaseClient(options) {
 		});
 		return storageSourcesPromise;
 	};
-	const resolvedWsUrl = options.realtime !== false ? options.websocketUrl ?? deriveWebSocketUrl(options.baseUrl) : void 0;
+	const realtimeEnabled = options.realtime !== false;
+	const resolvedWsUrl = realtimeEnabled ? options.websocketUrl ?? deriveWebSocketUrl(options.baseUrl) : void 0;
+	const realtimeUnreachable = realtimeEnabled && !resolvedWsUrl;
+	const unreachableReason = `no WebSocket URL could be derived from baseUrl ${JSON.stringify(options.baseUrl ?? null)} — outside a browser there is no page origin to resolve a relative URL against. Pass an absolute \`baseUrl\`, set \`websocketUrl\` explicitly, or pass \`realtime: false\` to say this was intended.`;
+	if (realtimeUnreachable) console.warn(`[Rebase] Realtime is enabled but ${unreachableReason} Live queries will fall back to a single fetch and channels will throw.`);
 	let ws;
 	/** One channel object per name — see `realtime.channel`. */
 	const realtimeChannels = /* @__PURE__ */ new Map();
@@ -8578,7 +8908,7 @@ function createRebaseClient(options) {
 		* cut off the others.
 		*/
 channel: (name, options) => {
-			if (!ws) throw new RebaseClientError("Realtime is disabled on this client (realtime: false), so channels are unavailable.");
+			if (!ws) throw new RebaseClientError(realtimeUnreachable ? `Realtime is enabled but ${unreachableReason}` : "Realtime is disabled on this client (realtime: false), so channels are unavailable.");
 			let existing = realtimeChannels.get(name);
 			if (!existing) {
 				existing = new RebaseRealtimeChannel(name, ws, options);
@@ -9249,7 +9579,7 @@ async function _initializeRebaseBackend(config) {
 			]) {
 				const providerConfig = safeAuthConfig[key];
 				if (providerConfig && requiredFields.every((f) => Boolean(providerConfig[f]))) {
-					const createFn = (await import("./auth-CuC9M2x6.js").then((n) => n.t))[factory];
+					const createFn = (await import("./auth-Bm5kOV2E.js").then((n) => n.t))[factory];
 					oauthProviders.push(createFn(providerConfig));
 				}
 			}
@@ -9343,7 +9673,7 @@ async function _initializeRebaseBackend(config) {
 	let schemaEditorOff = schemaEditorUnavailable();
 	let schemaEditorRoutes;
 	if (!schemaEditorOff && config.collectionsDir) try {
-		schemaEditorRoutes = (await import("./schema-editor-routes-CbF20Mf1.js")).createSchemaEditorRoutes(config.collectionsDir);
+		schemaEditorRoutes = (await import("./schema-editor-routes-C1DxDnDR.js")).createSchemaEditorRoutes(config.collectionsDir);
 	} catch (err) {
 		if (err?.code === "ERR_MODULE_NOT_FOUND") {
 			schemaEditorOff = {
@@ -9513,7 +9843,8 @@ async function _initializeRebaseBackend(config) {
 		Object.assign(serverClient, { sql: (query, options) => driverAdmin.executeSql(query, options) });
 		logger.info("SQL capability attached to singleton");
 	}
-	_initRebase(serverClient);
+	const serverSingleton = serverClient;
+	_initRebase(serverSingleton);
 	logger.info("Rebase singleton initialized");
 	if (defaultDriverResult.internals) {
 		const driver = defaultDriverResult.internals.driver;
@@ -9556,12 +9887,12 @@ async function _initializeRebaseBackend(config) {
 	let cronScheduler;
 	if (config.cronsDir) {
 		const { loadCronJobsFromDirectory } = await import("./cron-loader-B1S2MCSl.js").then((n) => n.t);
-		const { CronScheduler } = await import("./cron-scheduler-B3RFt0HS.js").then((n) => n.n);
-		const { createCronRoutes } = await import("./cron-routes-CrQ0tK-_.js").then((n) => n.n);
-		const { createCronStore } = await import("./cron-store-BywZsyfZ.js").then((n) => n.n);
+		const { CronScheduler } = await import("./cron-scheduler-CsQtYLMq.js").then((n) => n.n);
+		const { createCronRoutes } = await import("./cron-routes-D5a9v1HY.js").then((n) => n.n);
+		const { createCronStore } = await import("./cron-store-Cu4sOseb.js").then((n) => n.n);
 		const loadedCronJobs = await loadCronJobsFromDirectory(config.cronsDir);
 		cronScheduler = new CronScheduler();
-		cronScheduler.setClient(serverClient);
+		cronScheduler.setClient(serverSingleton);
 		if (loadedCronJobs.length > 0) {
 			cronScheduler.registerJobs(loadedCronJobs);
 			const store = defaultBootstrapper.getAdmin?.(defaultDriverResult) && config.cronPersistence !== false ? createCronStore(defaultDriver) : void 0;
@@ -9583,7 +9914,7 @@ async function _initializeRebaseBackend(config) {
 		} else logger.warn(`Cron routes mounted at ${basePath}/cron, but no jobs loaded from ${config.cronsDir}. Nothing is scheduled — check the messages above for files that failed to load.`);
 	}
 	{
-		const { createBackupRoutes, parseBackupDestination } = await import("./backup-CVggVhR2.js").then((n) => n.t);
+		const { createBackupRoutes, parseBackupDestination } = await import("./backup-BJiY_mM-.js").then((n) => n.t);
 		const backupRouter = new Hono();
 		applyAdminGate(backupRouter, "Backup");
 		backupRouter.route("/", createBackupRoutes({
@@ -9699,7 +10030,7 @@ async function _initializeRebaseBackend(config) {
 * export default defineFunction((app, { rebase }) => {
 *     app.use("/*", requireAuth);
 *     app.get("/home", async (c) => {
-*         const [stats] = await rebase.sql!(`SELECT count(*) AS n FROM orders`);
+*         const [stats] = await rebase.sql(`SELECT count(*) AS n FROM orders`);
 *         return c.json({ orders: Number(stats.n) });
 *     });
 * });
@@ -9731,12 +10062,14 @@ function defineFunction(definition) {
 * export default defineCron({
 *     name: "Nightly cleanup",
 *     schedule: "0 3 * * *",
-*     async handler({ client, log }) {
-*         const { data: expired } = await client.data.sessions.find({
+*     async handler({ rebase, log }) {
+*         // `dataAsAdmin` bypasses RLS. A cron has no per-request user, so
+*         // there is no policy to fall back on — scope the filters yourself.
+*         const { data: expired } = await rebase.dataAsAdmin.sessions.find({
 *             where: { expired: ["==", true] },
 *         });
 *         for (const session of expired) {
-*             await client.data.sessions.delete(session.id);
+*             await rebase.dataAsAdmin.sessions.delete(session.id as string);
 *         }
 *         log(`Deleted ${expired.length} expired sessions`);
 *     },
@@ -9951,8 +10284,10 @@ var WebhookDispatcher = class {
 		for (let attempt = 1; attempt <= this.maxRetries; attempt++) {
 			const result = await this.deliver(webhook, event, payload, attempt);
 			if (result.success) return result;
-			if (attempt < this.maxRetries) await new Promise((r) => setTimeout(r, this.retryDelays[attempt - 1]));
-			else return result;
+			if (attempt < this.maxRetries) {
+				const backoff = this.retryDelays[attempt - 1] ?? this.retryDelays[this.retryDelays.length - 1];
+				await new Promise((r) => setTimeout(r, backoff));
+			} else return result;
 		}
 		return {
 			webhookId: webhook.id,
@@ -11785,7 +12120,8 @@ async function bootFromBundle(options = {}) {
 	});
 	await ensureCollectionPolicies(bundle, dataSources, env);
 	metrics?.setKnownCollections(backend.collectionRegistry.getCollections().map((collection) => collection.slug).filter((slug) => Boolean(slug)));
-	app.get("/health", async (c) => {
+	const healthPaths = ["/health", `${(env.REBASE_BASE_PATH || "/api").replace(/\/$/, "")}/health`];
+	for (const healthPath of [...new Set(healthPaths)]) app.get(healthPath, async (c) => {
 		const result = await backend.healthCheck();
 		const unhealthy = (await Promise.all(dataSources.filter((source) => source.key !== DEFAULT_DATA_SOURCE_KEY).map(async (source) => ({
 			key: source.key,
@@ -11891,7 +12227,7 @@ async function bootStaticApp(bundle, devRoot, options) {
 	if (metrics) app.use("/*", metrics.middleware);
 	const server = createServer(getRequestListener(app.fetch));
 	app.get("/livez", (c) => c.json({ status: "ok" }));
-	app.get("/health", (c) => c.json({
+	for (const healthPath of [.../* @__PURE__ */ new Set(["/health", `${basePath.replace(/\/$/, "")}/health`])]) app.get(healthPath, (c) => c.json({
 		status: "ok",
 		latencyMs: 0
 	}));
@@ -12001,6 +12337,40 @@ function warnOnDriverSkew(dataSources, runtimeVersion) {
 	}
 }
 /**
+* The collections a data source's engine is the store for.
+*
+* A bundle's collections directory holds *every* collection the project
+* declares, whatever engine serves it — that is the point of `dataSource`
+* routing. What it is not is a list of tables to create: handing the whole
+* directory to the primary source's bootstrapper made a Firestore collection
+* declared alongside the Postgres ones arrive as an empty Postgres table, with
+* RLS policies, while the app went on reading its documents from Firestore.
+*
+* Excluding is deliberately conservative. A collection that names neither an
+* `engine` nor a `dataSource` belongs to whichever source is primary — the
+* "postgres" that `resolveDataSource` falls back to there is a default, not a
+* declaration, and must not exclude anything on its own. Only a collection that
+* explicitly routes to a *different* engine is dropped, so a project running two
+* sources on the same engine is unaffected.
+*/
+function collectionsStoredBy(collections, primary, dataSources) {
+	const registry = createDataSourceRegistry(dataSources.map((source) => ({
+		key: source.key,
+		engine: source.engine
+	})));
+	return collections.filter((collection) => {
+		const declared = collection.engine ?? (collection.dataSource ? resolveDataSource(collection, registry).engine : void 0);
+		if (!declared) return true;
+		return declared === primary.engine;
+	});
+}
+/** Say what was routed elsewhere, so a missing table is never a silent one. */
+function logForeignCollections(all, stored, primary) {
+	if (stored.length === all.length) return;
+	const foreign = all.filter((c) => !stored.includes(c)).map((c) => c.slug);
+	logger.info(`Skipping ${foreign.length} collection(s) served by another engine, not "${primary.engine}": ${foreign.join(", ")}. Their storage is not managed by this data source.`);
+}
+/**
 * Bring the database's collection tables up to date before serving.
 *
 * Delegates to whichever driver bootstrapped the default data source; a driver
@@ -12049,11 +12419,17 @@ async function ensureCollectionSchema(bundle, dataSources, env) {
 		skip(`the adapter from "${primary.driverPackage}" (engine "${primary.engine}") does not expose collection-table creation. ` + (skew.detail ? `${skew.detail} ` : "") + "The driver package may well implement it on a class the adapter does not forward, so check the adapter's shape before blaming its version. Collection tables will NOT be created, so every /api/data route will fail on a missing relation.\n" + schemaRecoveryGuidance({ staleDriver: skew.stale }), "warn");
 		return;
 	}
-	const collections = await loadCollectionsFromDirectory(bundle.collectionsDir);
-	if (collections.length === 0) {
+	const loaded = await loadCollectionsFromDirectory(bundle.collectionsDir);
+	if (loaded.length === 0) {
 		skip(`no collections were loaded from "${bundle.collectionsDir}".`, "warn");
 		return;
 	}
+	const collections = collectionsStoredBy(loaded, primary, dataSources);
+	logForeignCollections(loaded, collections, primary);
+	if (collections.length === 0) {
+		skip(`none of the ${loaded.length} declared collection(s) are stored by the "${primary.engine}" data source.`);
+		return;
+	}
 	const { applied } = await primary.bootstrapper.ensureCollectionSchema(collections, preInitDriverResult(primary), (message) => logger.info(`schema: ${message}`));
 	logger.info(applied > 0 ? `Applied ${applied} additive schema change(s) before boot.` : "Collection schema is up to date.");
 }
@@ -12103,12 +12479,14 @@ async function ensureCollectionPolicies(bundle, dataSources, env) {
 		logger.warn(`Collection policies: skipped — the "${primary.driverPackage}" driver (engine "${primary.engine}") does not apply RLS policies at boot. ` + (skew.detail ? `${skew.detail} ` : "") + "Collections will deny reads until policies are applied.\n" + schemaRecoveryGuidance({ staleDriver: skew.stale }));
 		return;
 	}
-	const collections = await loadCollectionsFromDirectory(bundle.collectionsDir);
+	const loaded = await loadCollectionsFromDirectory(bundle.collectionsDir);
+	if (loaded.length === 0) return;
+	const collections = collectionsStoredBy(loaded, primary, dataSources);
 	if (collections.length === 0) return;
 	const { applied } = await primary.bootstrapper.ensureCollectionPolicies(collections, preInitDriverResult(primary), (message) => logger.info(`policies: ${message}`));
 	logger.info(applied > 0 ? `Applied ${applied} RLS policy statement(s) before serving.` : "RLS policies are up to date.");
 }
 //#endregion
-export { ApiError, BundleError, CronScheduler, DEFAULT_DRIVER_ID, DEFAULT_MAX_FILE_SIZE, DEFAULT_STORAGE_ID, DOCUMENT_MIME_TYPES, DefaultDriverRegistry, DefaultStorageRegistry, GCSStorageController, IMAGE_MIME_TYPES, LocalStorageController, MetricsRegistry, S3StorageController, SMTPEmailService, TransformCache, TusHandler, WebhookDispatcher, _resetRebaseMock, _setRebaseMock, applyCollectionDefaults, assertCollectionConfigs, assertDistinctSuffixes, authJwt, authRoles, authUid, bootFromBundle, classifySurface, cleanupDevPortFile, createAppleProvider, createBackupRoutes, createBitbucketProvider, createBuiltinAuthAdapter, createContractRoutes, createCronRoutes, createCronStore, createCustomAuthAdapter, createDiscordProvider, createEmailService, createFacebookProvider, createFunctionRoutes, createGitHubProvider, createGitLabProvider, createGoogleProvider, createHistoryRoutes, createLinkedinProvider, createMetricsMiddleware, createMetricsRoutes, createMicrosoftProvider, createSlackProvider, createSourceBundle, createSpotifyProvider, createStorageController, createStorageRoutes, createTwitterProvider, defineCron, defineFunction, envSuffixForKey, errorHandler, extractUserFromToken, fileTokenAuth, findCollectionConfigProblems, generateSecurePassword, getEmailVerificationTemplate, getMagicLinkTemplate, getPasswordResetTemplate, getUserInvitationTemplate, getWelcomeEmailTemplate, hashPassword, httpMethodToOperation, initializeDataSource, initializeDataSources, initializeRebaseBackend, installShutdownHandlers, isApiKeyToken, isAuthAdapter, isDatabaseAdapter, isLocalhostOrigin, isOperationAllowed, isRebaseApiError, isTransformableImage, listBackupObjects, listenWithPortRetry, loadBootEnv, loadBundle, loadBundleConfigExports, loadBundleSchema, loadCollectionsFromDirectory, loadCronJobsFromDirectory, loadDeclaredStorageSources, loadEnv, loadFunctionsFromDirectory, loadUsersCollection, logger, optionalAuth, parseBackupDestination, parseBackupTimestamp, parseTransformOptions, queryTokenAuth, readBackupBytes, readBundleManifest, rebase, requireAdmin, requireAuth, resolveAuthHooks, resolveAuthOptions, resolveCorsOrigin, resolveDataSources, resolveEmailOptions, resolveRequireAuth, resolveStorageBackend, resolveStorageSources, runFromBundle, safeCompare, serveSPA, transformImage, unknownKeyPolicyFromEnv, validateApiKey, validateCronExpression, validatePasswordStrength, verifyPassword };
+export { ApiError, BundleError, CronScheduler, DEFAULT_DRIVER_ID, DEFAULT_MAX_FILE_SIZE, DEFAULT_STORAGE_ID, DOCUMENT_MIME_TYPES, DefaultDriverRegistry, DefaultStorageRegistry, GCSStorageController, IMAGE_MIME_TYPES, LocalStorageController, MetricsRegistry, S3StorageController, SMTPEmailService, TransformCache, TusHandler, WebhookDispatcher, _resetRebaseMock, _setRebaseMock, applyCollectionDefaults, assertCollectionConfigs, assertDistinctSuffixes, authJwt, authRoles, authUid, bootFromBundle, classifySurface, cleanupDevPortFile, createAppleProvider, createBackupRoutes, createBitbucketProvider, createBuiltinAuthAdapter, createContractRoutes, createCronRoutes, createCronStore, createCustomAuthAdapter, createDiscordProvider, createEmailService, createFacebookProvider, createFunctionRoutes, createGitHubProvider, createGitLabProvider, createGoogleProvider, createHistoryRoutes, createLinkedinProvider, createMetricsMiddleware, createMetricsRoutes, createMicrosoftProvider, createSlackProvider, createSourceBundle, createSpotifyProvider, createStorageController, createStorageRoutes, createTwitterProvider, defineCron, defineFunction, envSuffixForKey, errorHandler, extractUserFromToken, fileTokenAuth, findCollectionConfigProblems, generateSecurePassword, getEmailVerificationTemplate, getMagicLinkTemplate, getPasswordResetTemplate, getUserInvitationTemplate, getWelcomeEmailTemplate, hashPassword, httpMethodToOperation, initializeDataSource, initializeDataSources, initializeRebaseBackend, installShutdownHandlers, isApiKeyToken, isAuthAdapter, isDatabaseAdapter, isLocalhostOrigin, isOperationAllowed, isTransformableImage, listBackupObjects, listenWithPortRetry, loadBootEnv, loadBundle, loadBundleConfigExports, loadBundleSchema, loadCollectionsFromDirectory, loadCronJobsFromDirectory, loadDeclaredStorageSources, loadEnv, loadFunctionsFromDirectory, loadUsersCollection, logger, optionalAuth, parseBackupDestination, parseBackupTimestamp, parseTransformOptions, queryTokenAuth, readBackupBytes, readBundleManifest, rebase, requireAdmin, requireAuth, resolveAuthHooks, resolveAuthOptions, resolveCorsOrigin, resolveDataSources, resolveEmailOptions, resolveRequireAuth, resolveStorageBackend, resolveStorageSources, runFromBundle, safeCompare, serveSPA, transformImage, unknownKeyPolicyFromEnv, validateApiKey, validateCronExpression, validatePasswordStrength, verifyPassword };
 
 //# sourceMappingURL=index.es.js.map