@rebasepro/server 0.13.1-canary.gf57a27e → 0.14.0

package/dist/{admin_block-CLeUMG8G.js → admin_block-H86dCPsj.js}

@@ -120,7 +120,65 @@ var ADMIN_PROPERTY_KEYS = [
 	"urlPreview",
 	"widget"
 ];
+/**
+* Move flattened admin keys back down into the `admin` block.
+*
+* The admin panel works with a *flat* view model — the block merged onto the
+* collection — so what comes back from a form has `icon` and `defaultViewMode`
+* at the top level while `admin` still holds whatever the file was loaded with.
+* This is the way back.
+*
+* **The top-level value wins.** It is the one the form just wrote; the block is
+* the copy the collection was loaded with, and preferring it resolves every edit
+* in favour of the value the user changed away from.
+*
+* This lives here, next to the key lists, because it had two implementations —
+* `toAdminCollectionConfig` in `@rebasepro/admin-types` and `nestAdminKeys` in
+* `@rebasepro/server`'s schema editor — that agreed on everything except that
+* precedence, which is the only part that decides whether a save is visible.
+*
+* @group Models
+*/
+function nestAdminKeysOf(source, adminKeys) {
+	const keys = new Set(adminKeys);
+	const top = {};
+	const block = { ...source.admin ?? {} };
+	for (const [key, value] of Object.entries(source)) {
+		if (key === "admin") continue;
+		if (keys.has(key)) block[key] = value;
+		else top[key] = value;
+	}
+	if (Object.keys(block).length > 0) top.admin = block;
+	return top;
+}
+/**
+* {@link nestAdminKeysOf} for a collection.
+*
+* @group Models
+*/
+function nestAdminCollectionKeys(collection) {
+	return nestAdminKeysOf(collection, ADMIN_COLLECTION_KEYS);
+}
+/**
+* {@link nestAdminKeysOf} for a property, applied to its children too.
+*
+* A map property carries `properties`, an array property carries `of`, and both
+* hold properties with `admin` blocks of their own. A flat `readOnly` left on a
+* child is as dead — and as fatal at the next boot — as one left on the parent,
+* so the walk goes all the way down.
+*
+* @group Models
+*/
+function nestAdminPropertyKeys(property) {
+	const nested = nestAdminKeysOf(property, ADMIN_PROPERTY_KEYS);
+	const children = nested.properties;
+	if (children && typeof children === "object" && !Array.isArray(children)) nested.properties = Object.fromEntries(Object.entries(children).map(([key, child]) => [key, child && typeof child === "object" && !Array.isArray(child) ? nestAdminPropertyKeys(child) : child]));
+	const of = nested.of;
+	if (Array.isArray(of)) nested.of = of.map((entry) => entry && typeof entry === "object" && !Array.isArray(entry) ? nestAdminPropertyKeys(entry) : entry);
+	else if (of && typeof of === "object") nested.of = nestAdminPropertyKeys(of);
+	return nested;
+}
 //#endregion
-export { ADMIN_PROPERTY_KEYS as n, ADMIN_COLLECTION_KEYS as t };
+export { nestAdminPropertyKeys as i, ADMIN_PROPERTY_KEYS as n, nestAdminCollectionKeys as r, ADMIN_COLLECTION_KEYS as t };
 
-//# sourceMappingURL=admin_block-CLeUMG8G.js.map
+//# sourceMappingURL=admin_block-H86dCPsj.js.map

package/dist/admin_block-H86dCPsj.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin_block-H86dCPsj.js","names":[],"sources":["../../types/src/types/admin_block.ts"],"sourcesContent":["/**\n * The keys of a collection's admin block, as data.\n *\n * There is no *type* for the block in this package any more, and that is the point:\n * `admin` is not declared on `BaseCollectionConfig` or on any property here, so a\n * BaaS install cannot even write one. `@rebasepro/admin-types` adds the field back by\n * declaration merging, which is why installing it is what makes the admin surface\n * appear.\n *\n * The *list* still has to live here, because three runtime consumers need it and two\n * of them are core — see below.\n */\n\n/**\n * Every key that belongs inside a collection's `admin` block, as data.\n *\n * The type that describes these fields is `AdminCollectionOptions` in\n * `@rebasepro/admin-types`, and it is erased at build time — but three runtime\n * consumers need the list, and two of them are core:\n *\n * - `serializeCollections`, to drop the block from the contract\n * - the ts-morph schema editor in `@rebasepro/server`, which rewrites collection\n *   files on disk from the admin panel and has to know where each key goes. A key\n *   missing from this list gets written to the *top level* of the file, where the\n *   backend ignores it and the panel never finds it again.\n * - the `collections-admin-block` codemod\n *\n * `@rebasepro/admin-types` re-exports this and asserts it names only real option\n * keys; the count is pinned by a test there.\n *\n * @group Models\n */\nexport const ADMIN_COLLECTION_KEYS = [\n    \"Actions\",\n    \"additionalFields\",\n    \"alwaysApplyDefaultValues\",\n    \"components\",\n    \"defaultEntityAction\",\n    \"defaultFilter\",\n    \"defaultSelectedView\",\n    \"defaultSize\",\n    \"defaultViewMode\",\n    \"disableDefaultActions\",\n    \"display\",\n    \"enabledViews\",\n    \"entityActions\",\n    \"entityViews\",\n    \"exportable\",\n    \"filterPresets\",\n    \"fixedFilter\",\n    \"form\",\n    \"formAutoSave\",\n    \"formView\",\n    \"group\",\n    \"hideFromEntityViews\",\n    \"hideFromNavigation\",\n    \"hideIdFromCollection\",\n    \"hideIdFromForm\",\n    \"icon\",\n    \"includeJsonView\",\n    \"inlineEditing\",\n    \"kanban\",\n    \"listProperties\",\n    \"localChangesBackup\",\n    \"openEntityMode\",\n    \"orderProperty\",\n    \"pagination\",\n    \"previewProperties\",\n    \"propertiesOrder\",\n    \"selectionController\",\n    \"selectionEnabled\",\n    \"sideDialogWidth\",\n    \"sort\",\n    \"titleProperty\"\n] as const;\n\n/** A key of a collection's `admin` block. @group Models */\nexport type AdminCollectionKey = typeof ADMIN_COLLECTION_KEYS[number];\n\n/**\n * Every key that belongs inside a *property's* `admin` block, as data.\n *\n * The union of `AdminPropertyOptions` and its per-type extensions\n * (`AdminStringOptions`, `AdminArrayOptions`, …) in `@rebasepro/admin-types`.\n * It lives here for the same reason {@link ADMIN_COLLECTION_KEYS} does: the\n * runtime consumers are core packages that the BaaS guard forbids from\n * importing `@rebasepro/admin-types`. Here it is the boot-time collection\n * validator in `@rebasepro/server`, which has to tell \"you left `readOnly` at\n * the top of the property, where nothing reads it\" apart from \"you invented a\n * key we have never heard of\".\n *\n * `@rebasepro/admin-types` re-exports this and asserts it names only real\n * option keys.\n *\n * @group Models\n */\nexport const ADMIN_PROPERTY_KEYS = [\n    \"canAddElements\",\n    \"clearable\",\n    \"columnWidth\",\n    \"customProps\",\n    \"disabled\",\n    \"expanded\",\n    \"Field\",\n    \"Filter\",\n    \"filterOperators\",\n    \"fixedFilter\",\n    \"hideFromCollection\",\n    \"includeEntityLink\",\n    \"includeId\",\n    \"markdown\",\n    \"minimalistView\",\n    \"multiline\",\n    \"Preview\",\n    \"previewAsTag\",\n    \"previewProperties\",\n    \"readOnly\",\n    \"sortable\",\n    \"span\",\n    \"spreadChildren\",\n    \"urlPreview\",\n    \"widget\",\n] as const;\n\n/** A key of a property's `admin` block. @group Models */\nexport type AdminPropertyKey = typeof ADMIN_PROPERTY_KEYS[number];\n\n/**\n * Move flattened admin keys back down into the `admin` block.\n *\n * The admin panel works with a *flat* view model — the block merged onto the\n * collection — so what comes back from a form has `icon` and `defaultViewMode`\n * at the top level while `admin` still holds whatever the file was loaded with.\n * This is the way back.\n *\n * **The top-level value wins.** It is the one the form just wrote; the block is\n * the copy the collection was loaded with, and preferring it resolves every edit\n * in favour of the value the user changed away from.\n *\n * This lives here, next to the key lists, because it had two implementations —\n * `toAdminCollectionConfig` in `@rebasepro/admin-types` and `nestAdminKeys` in\n * `@rebasepro/server`'s schema editor — that agreed on everything except that\n * precedence, which is the only part that decides whether a save is visible.\n *\n * @group Models\n */\nexport function nestAdminKeysOf(\n    source: Record<string, unknown>,\n    adminKeys: readonly string[]\n): Record<string, unknown> {\n    const keys = new Set<string>(adminKeys);\n    const top: Record<string, unknown> = {};\n    const block: Record<string, unknown> = { ...((source.admin as Record<string, unknown> | undefined) ?? {}) };\n\n    for (const [key, value] of Object.entries(source)) {\n        if (key === \"admin\") continue;\n        if (keys.has(key)) block[key] = value;\n        else top[key] = value;\n    }\n\n    if (Object.keys(block).length > 0) top.admin = block;\n    return top;\n}\n\n/**\n * {@link nestAdminKeysOf} for a collection.\n *\n * @group Models\n */\nexport function nestAdminCollectionKeys(collection: Record<string, unknown>): Record<string, unknown> {\n    return nestAdminKeysOf(collection, ADMIN_COLLECTION_KEYS);\n}\n\n/**\n * {@link nestAdminKeysOf} for a property, applied to its children too.\n *\n * A map property carries `properties`, an array property carries `of`, and both\n * hold properties with `admin` blocks of their own. A flat `readOnly` left on a\n * child is as dead — and as fatal at the next boot — as one left on the parent,\n * so the walk goes all the way down.\n *\n * @group Models\n */\nexport function nestAdminPropertyKeys(property: Record<string, unknown>): Record<string, unknown> {\n    const nested = nestAdminKeysOf(property, ADMIN_PROPERTY_KEYS);\n\n    const children = nested.properties;\n    if (children && typeof children === \"object\" && !Array.isArray(children)) {\n        nested.properties = Object.fromEntries(\n            Object.entries(children as Record<string, unknown>).map(([key, child]) => [\n                key,\n                child && typeof child === \"object\" && !Array.isArray(child)\n                    ? nestAdminPropertyKeys(child as Record<string, unknown>)\n                    : child\n            ])\n        );\n    }\n\n    const of = nested.of;\n    if (Array.isArray(of)) {\n        nested.of = of.map(entry => entry && typeof entry === \"object\" && !Array.isArray(entry)\n            ? nestAdminPropertyKeys(entry as Record<string, unknown>)\n            : entry);\n    } else if (of && typeof of === \"object\") {\n        nested.of = nestAdminPropertyKeys(of as Record<string, unknown>);\n    }\n\n    return nested;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCA,IAAa,wBAAwB;CACjC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACJ;;;;;;;;;;;;;;;;;;AAsBA,IAAa,sBAAsB;CAC/B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACJ;;;;;;;;;;;;;;;;;;;;AAwBA,SAAgB,gBACZ,QACA,WACuB;CACvB,MAAM,OAAO,IAAI,IAAY,SAAS;CACtC,MAAM,MAA+B,CAAC;CACtC,MAAM,QAAiC,EAAE,GAAK,OAAO,SAAiD,CAAC,EAAG;CAE1G,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,MAAM,GAAG;EAC/C,IAAI,QAAQ,SAAS;EACrB,IAAI,KAAK,IAAI,GAAG,GAAG,MAAM,OAAO;OAC3B,IAAI,OAAO;CACpB;CAEA,IAAI,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,GAAG,IAAI,QAAQ;CAC/C,OAAO;AACX;;;;;;AAOA,SAAgB,wBAAwB,YAA8D;CAClG,OAAO,gBAAgB,YAAY,qBAAqB;AAC5D;;;;;;;;;;;AAYA,SAAgB,sBAAsB,UAA4D;CAC9F,MAAM,SAAS,gBAAgB,UAAU,mBAAmB;CAE5D,MAAM,WAAW,OAAO;CACxB,IAAI,YAAY,OAAO,aAAa,YAAY,CAAC,MAAM,QAAQ,QAAQ,GACnE,OAAO,aAAa,OAAO,YACvB,OAAO,QAAQ,QAAmC,CAAC,CAAC,KAAK,CAAC,KAAK,WAAW,CACtE,KACA,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IACpD,sBAAsB,KAAgC,IACtD,KACV,CAAC,CACL;CAGJ,MAAM,KAAK,OAAO;CAClB,IAAI,MAAM,QAAQ,EAAE,GAChB,OAAO,KAAK,GAAG,KAAI,UAAS,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAChF,sBAAsB,KAAgC,IACtD,KAAK;MACR,IAAI,MAAM,OAAO,OAAO,UAC3B,OAAO,KAAK,sBAAsB,EAA6B;CAGnE,OAAO;AACX"}

package/dist/api/ast-schema-editor.d.ts

@@ -1,11 +1,11 @@
 /**
  * Move presentation keys into the `admin` block.
  *
- * `ADMIN_COLLECTION_KEYS` comes from `@rebasepro/types` rather than being spelled
- * out here, so adding a field to `AdminCollectionOptions` cannot leave this writer
- * behind. Any such key already inside `admin` wins over a top-level copy: the
- * nested one is what the file said, and a flat duplicate is the view model's
- * flattening leaking back.
+ * The rule itself lives in `@rebasepro/types`, next to `ADMIN_COLLECTION_KEYS`,
+ * because `@rebasepro/admin-types` has to apply the identical one on the panel's
+ * side and this package cannot import that one. Two copies used to exist and
+ * they disagreed about precedence, which decided whether a presentation edit was
+ * saved or silently reverted to the value the user had just changed away from.
  */
 export declare function nestAdminKeys(collectionData: Record<string, unknown>): Record<string, unknown>;
 export declare class AstSchemaEditor {
@@ -22,10 +22,78 @@ export declare class AstSchemaEditor {
      */
     private safePath;
     private getCollectionFile;
+    /**
+     * Find the object literal a collection is declared with, through whatever
+     * wraps it.
+     *
+     * `defineCollection({ … })` is the shape `rebase init` writes and the one the
+     * docs recommend; `satisfies` / `as` / parentheses are the other ways an
+     * author can dress the same literal. Returning `null` for any of them meant
+     * the three callers below each failed differently, and the worst of them
+     * overwrote the file.
+     */
+    private unwrapCollectionObject;
     private getCollectionObject;
+    /**
+     * The collection's object literal, or a refusal that says what to do.
+     *
+     * Every caller needs this to be all-or-nothing: a missing object literal used
+     * to mean "throw", "report success and do nothing" and "recreate the file
+     * from scratch" depending on which method you called.
+     */
+    private requireCollectionObject;
+    private unreadableFileMessage;
+    /** Look a key up on an object literal, quoted or not. */
+    private findProperty;
+    private static quoteKey;
+    private static isPlainObject;
     private convertJsonToAstString;
+    /**
+     * Write only the keys the patch names, leaving every sibling alone.
+     *
+     * A patch says what changed, not what the collection is. The panel sends one
+     * — `{ propertiesOrder }` is what adding a column posts — and rewriting the
+     * `admin` block from it deleted the collection's icon, group, list columns
+     * and kanban config in the same write.
+     */
+    private mergeIntoObjectLiteral;
     saveProperty(collectionId: string, propertyKey: string, propertyConfig: Record<string, unknown>): Promise<void>;
     deleteProperty(collectionId: string, propertyKey: string): Promise<void>;
-    saveCollection(collectionId: string, collectionData: Record<string, unknown>): Promise<void>;
+    /**
+     * Write a collection back to its file.
+     *
+     * `partial` is the difference between "this is the collection" and "this is
+     * what changed about it". The panel sends both — a full save from the editor
+     * dialog, and a one-key patch whenever a property is added, deleted or
+     * reordered — and they cannot be told apart by looking at the payload. Read
+     * as a full save, a patch deletes everything it does not mention, including
+     * `securityRules`; the loader then hands the collection the directory
+     * default, which in the scaffold is `access: "public"`.
+     */
+    saveCollection(collectionId: string, collectionData: Record<string, unknown>, options?: {
+        partial?: boolean;
+    }): Promise<void>;
+    /**
+     * Write the collection-level `relations` array.
+     *
+     * Relations are the one key whose values are not all data: `target` is a
+     * thunk in the file, and the panel sends the target collection's slug (or,
+     * for a relation it did not touch, nothing at all — `JSON.stringify` drops
+     * the function). So each entry's target is resolved in that order: a slug
+     * becomes `() => xCollection` plus the import it needs, and anything else
+     * falls back to the thunk already in the file.
+     *
+     * This used to be a `continue` with a comment saying relations were handled
+     * elsewhere. Nothing handled them; every edit in the Relations tab was
+     * dropped without a word.
+     */
+    private writeRelations;
+    /**
+     * `() => targetCollection` for a target named by its slug, importing it if
+     * the file does not already.
+     */
+    private targetThunk;
+    private hasDefaultImport;
+    private getDefaultExportName;
     deleteCollection(collectionId: string): Promise<void>;
 }

package/dist/api/errors.d.ts

@@ -17,6 +17,18 @@ export declare class ApiError extends Error {
      * The motivating case is `POST /auth/refresh` with no session: clients
      * refresh on page load before they know whether one exists, so every
      * anonymous page view is a 401 — correct, and not worth a warning line.
+     *
+     * The other class is a caller-caused 4xx that never reached the database: a
+     * mistyped filter operator, sort direction or limit, a request for a
+     * collection that does not exist. Nothing on this server is wrong, and the
+     * response body has already told the caller what to fix — while one client
+     * holding a stale name would otherwise write a warning per request, forever,
+     * until the level means nothing. See `api/rest/query-parser.ts`.
+     *
+     * What stays at warn is anything that says something about the *server*:
+     * a schema that has drifted from the code, a permission the database
+     * refused, a dependency that failed. Those are 4xx too, and they are still
+     * incidents.
      */
     readonly expected: boolean;
     constructor(statusCode: number, code: string, message: string, details?: unknown, expected?: boolean);

package/dist/api/rest/api-generator.d.ts

@@ -32,6 +32,31 @@ export declare class RestApiGenerator {
      * Generate REST routes using existing DataDriver
      */
     generateRoutes(): Hono<HonoEnv>;
+    /**
+     * Answer anything left under `/api/data` in the canonical error envelope.
+     *
+     * Without this, `GET /api/data/nonexistent` fell through to Hono's default
+     * handler and came back as the plain text `404 Not Found` — the one error
+     * on the data API that is not `{"error":{"message","code","requestId"}}`.
+     * A client that does `res.json()` on the error path got a parse failure
+     * where every other 4xx hands it a code, so a mistyped collection name
+     * surfaced as "invalid JSON" rather than "no such collection".
+     *
+     * Registered after every real route, so a request reaches it only when the
+     * slug is unknown *or* the method/sub-path is: those are different
+     * mistakes, and the message says which. The collection list is deliberately
+     * not enumerated — an unauthenticated request to this same URL is answered
+     * 401 before routing, on purpose, and echoing the full set of slugs back
+     * would undo that for any signed-in caller.
+     *
+     * Every answer here is `expected`, so it logs at debug (see
+     * {@link ApiError.expected}). This path used to log *nothing at all* —
+     * Hono's default 404 never reaches `errorHandler` — so routing it through
+     * the handler at warn would have traded a missing error envelope for a
+     * `⚠️` line on every request from any frontend holding a stale slug. The
+     * envelope is the fix; the log volume is not part of it.
+     */
+    private createUnmatchedRoute;
     /**
      * Check API key permissions for a collection operation.
      * Throws 403 if the key doesn't have the required permission.
@@ -54,7 +79,7 @@ export declare class RestApiGenerator {
      * Needed so a nested write can be checked against a schema at all. Without
      * it these routes skipped `assertKnownWriteFields` entirely, which is why a
      * typo `POST /posts` rejected with a 400 while the same typo on
-     * `POST /authors/1/posts` reached the database.
+     * `POST /authors/1/posts` was dropped from the statement and answered 201.
      *
      * Returns `undefined` rather than throwing when the path cannot be walked:
      * the driver raises the authoritative error a moment later, and duplicating

package/dist/api/rest/idempotency.d.ts

@@ -1,4 +1,17 @@
 import { DataDriver } from "@rebasepro/types";
+/**
+ * What a key was claimed *for*, so presenting it on a different request is
+ * caught instead of silently replaying the first one's answer.
+ *
+ * Nothing about the request used to enter the key, so `createMany(rows, { key })`
+ * followed by `deleteMany(ids, { key })` — the reusable business id the docs
+ * recommended — answered the delete with the create's `200` body and deleted
+ * nothing. Method and path separate the routes; the body separates a re-run
+ * carrying corrected rows from the retry of an unanswered one, which is the
+ * difference between "here is your earlier answer" and silently discarding a
+ * correction.
+ */
+export declare function requestFingerprint(method: string, path: string, body: unknown): string;
 /**
  * What a caller may do with a key.
  *
@@ -20,6 +33,10 @@ export type IdempotencyClaim =
  | {
     status: "in-flight";
 }
+/** This key is live, but it was claimed for a different request. */
+ | {
+    status: "mismatch";
+}
 /** The key is ours; do the write, then `complete` or `release` it. */
  | {
     status: "claimed";
@@ -29,16 +46,20 @@ export interface IdempotencyStore {
      * Take the key if it is free, atomically. Never throws — a store that
      * cannot answer reports `claimed`, which degrades to no idempotency rather
      * than to a refused write.
+     *
+     * `fingerprint` says what the key is being claimed for (see
+     * {@link requestFingerprint}); a live key presented with a different one is
+     * a reused key, not a replay, and is reported as `mismatch`.
      */
-    claim(key: string, uid: string | undefined): Promise<IdempotencyClaim>;
+    claim(key: string, uid: string | undefined, fingerprint: string): Promise<IdempotencyClaim>;
     /** Record what this key answered. Never throws. */
     complete(key: string, uid: string | undefined, response: unknown): Promise<void>;
     /**
      * Give the key back after the write it was claimed for failed.
      *
-     * Without this a transient failure strands the key: every retry would be
-     * told `in-flight` until the row aged out, turning one failed write into a
-     * day of refusals.
+     * Without this a transient failure strands the key until its lease runs
+     * out, turning one failed write into a minute of refused retries. The lease
+     * is the floor, not the mechanism: it only covers the exits no code runs on.
      */
     release(key: string, uid: string | undefined): Promise<void>;
 }

package/dist/api/rest/query-parser.d.ts

@@ -1,3 +1,4 @@
+import type { ListLimitBounds } from "@rebasepro/types";
 import { QueryOptions } from "../types";
 export declare const mapOperator: (op: string) => import("@rebasepro/types").WhereFilterOp | null;
 export { DEFAULT_LIST_LIMIT, DEFAULT_VECTOR_LIST_LIMIT, MAX_LIST_LIMIT } from "@rebasepro/types";
@@ -13,9 +14,22 @@ export interface ListLimitOptions {
      * text-search reads — a vector search falls back to its own default (10).
      */
     defaultLimit?: number;
-    /** Upper bound clamped onto any client-supplied `?limit`. */
+    /** Largest `?limit` a client may ask for. A larger one is a 400, not a clamp. */
     maxLimit?: number;
 }
+/**
+ * {@link resolveClientListLimit} for an HTTP route: the same bounds, answered
+ * with a 400 rather than a 500.
+ *
+ * The shared resolver throws a `ListLimitError`, which carries `status` — but
+ * the Hono error handler discriminates on `statusCode`, so an unconverted one
+ * reaches the client as `INTERNAL_ERROR` with its message stripped, telling the
+ * caller nothing about the parameter it got wrong. Every REST list ingress
+ * routes its `limit` through here so all of them name the ceiling the same way.
+ */
+export declare function resolveListLimitParam(rawLimit: number | string | null | undefined, opts?: ListLimitBounds & {
+    vectorSearch?: boolean;
+}): number;
 /**
  * Parse query parameters into QueryOptions
  */

package/dist/api/rest/write-validation.d.ts

@@ -2,10 +2,18 @@ import { CollectionConfig } from "@rebasepro/types";
 /**
  * Reject a write naming a field the collection does not have.
  *
- * Unknown keys used to travel all the way into the INSERT, where Postgres
- * rejected them — so a typo came back as `column "titel" does not exist`,
- * phrased by the database, from a stack the caller cannot see, and only if the
- * column really was absent. It is a request problem and belongs in a 400.
+ * An unknown key does *not* reach the INSERT and come back as `column "titel"
+ * does not exist`, which is what this comment used to claim. Drizzle builds
+ * INSERT and UPDATE from the table's own column list, so a key the table does
+ * not carry is left out of the statement: the write answers 201 having stored
+ * nothing under that name. A typo is a request problem, it belongs in a 400,
+ * and nothing below this was ever going to raise one.
+ *
+ * This is the config-level check and it is skipped on several paths (see the
+ * `strictWrites` bail below, and the auth-adapter contract at the call site).
+ * `assertWritableColumns` in the Postgres driver is the backstop every write
+ * passes through, including in-process `rebase.data` writes that never come
+ * near this layer.
  *
  * What counts as known:
  * - a declared property (for an introspected BaaS collection these *are* the
@@ -20,6 +28,34 @@ export declare function assertKnownWriteFields(values: Record<string, unknown>,
     rowIndex?: number;
     extraKnownFields?: readonly string[];
 }): void;
+/**
+ * Reject a write whose values break the constraints the collection declares.
+ *
+ * `validation.min`, `max`, `matches`, `positive`, `integer` and the date and
+ * array bounds were read by exactly three things: the DDL generators (for
+ * `integer` and for a `varchar` width), and the admin's client-side form. No
+ * layer on the write path looked at them, no `CHECK` constraint was emitted,
+ * and the generated OpenAPI published every one of them as `minimum`,
+ * `maximum`, `minLength`, `maxLength` and `pattern`. So the docs' own example —
+ * `price: { type: "number", validation: { min: 0 } }` — accepted `-5000` with a
+ * 201 while the spec said it would not, and any client or gateway generated
+ * from that spec believed the server was checking.
+ *
+ * Only `required` is left to the database, where it is a NOT NULL: a partial
+ * update legitimately omits keys, and this function sees one request's values,
+ * not the row they land on.
+ *
+ * A value of the wrong *type* is not this function's business — that reaches
+ * Postgres, which types every column and gives a 400 through the driver's
+ * SQLSTATE mapping. Constraints are checked against values of the right type,
+ * plus the numeric-string form a JSON body may carry for a number column.
+ *
+ * Every failing field is reported at once. A form that fixes one field per
+ * round trip is the reason validation errors get ignored.
+ */
+export declare function assertWriteValuesValid(values: Record<string, unknown>, collection: CollectionConfig, options?: {
+    rowIndex?: number;
+}): void;
 /**
  * Narrow response rows to the fields the caller asked for.
  *

package/dist/auth/adapter-middleware.d.ts

@@ -9,7 +9,9 @@
  * 1. Checks for API key tokens (`rk_` prefix) first — these are Rebase-level
  * 2. Falls back to `adapter.verifyRequest(request)` to resolve the user
  * 3. Scopes the DataDriver via `withAuth()` for RLS
- * 4. Enforces auth (401) when `requireAuth` is true and no user is found
+ * 4. Rejects a presented-but-unverifiable token with 401, whatever
+ *    `requireAuth` says
+ * 5. Enforces auth (401) when `requireAuth` is true and no user is found
  *
  * The behavior is identical to `createAuthMiddleware()` — only the
  * token verification strategy is pluggable.

package/dist/auth/admin-roles.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Which role names carry administrative privilege.
+ *
+ * One definition, because there used to be several and they disagreed.
+ * `requireAdmin` accepted `admin` **or** `schema-admin`; the guard that refuses
+ * a dangerous `defaultRole` compared against `admin` alone. So
+ * `AUTH_DEFAULT_ROLE=schema-admin` passed the guard and made every public
+ * registrant an administrator — and, since a `schema-admin` may edit users, one
+ * of them could then grant themselves real `admin` and keep it.
+ *
+ * The guard and the check have to read the same list or the gap comes back, so
+ * neither of them owns it.
+ *
+ * `schema-admin` is here deliberately: it can reach the schema editor and the
+ * SQL surfaces, which is administrative by any definition that matters. If a
+ * genuinely lesser role is added later, it does not belong in this list — it
+ * belongs in a capability check of its own.
+ */
+export declare const ADMINISTRATIVE_ROLES: readonly ["admin", "schema-admin"];
+export type AdministrativeRole = (typeof ADMINISTRATIVE_ROLES)[number];
+/** Does this single role name carry administrative privilege? */
+export declare function isAdministrativeRole(role: string): role is AdministrativeRole;
+/** Does any role in this list carry administrative privilege? */
+export declare function hasAdministrativeRole(roles: readonly string[] | null | undefined): boolean;

package/dist/auth/apple-oauth.d.ts

@@ -1,4 +1,19 @@
 import type { OAuthProvider } from "./interfaces";
+import { type OAuthCodeFlowPayload } from "./oauth-code-flow";
+/** Extra field Apple's client sends that no other provider has. */
+export interface AppleCodeFlowPayload extends OAuthCodeFlowPayload {
+    /**
+     * Apple sends the user's *name* only on the first authorization, so the
+     * frontend has to forward it. It is display data and nothing else — the
+     * identity email comes from the id_token, never from the request body.
+     */
+    user?: {
+        name?: {
+            firstName?: string;
+            lastName?: string;
+        };
+    };
+}
 /**
  * Creates an Apple Sign In OAuth Provider integration.
  *
@@ -17,14 +32,4 @@ export declare function createAppleProvider(config: {
     keyId: string;
     /** The raw PEM contents of the .p8 private key file */
     privateKey: string;
-}): OAuthProvider<{
-    code: string;
-    redirectUri: string;
-    user?: {
-        name?: {
-            firstName?: string;
-            lastName?: string;
-        };
-        email?: string;
-    };
-}>;
+}): OAuthProvider<AppleCodeFlowPayload>;

package/dist/auth/bitbucket-oauth.d.ts

@@ -1,11 +1,9 @@
 import type { OAuthProvider } from "./interfaces";
+import { type OAuthCodeFlowPayload } from "./oauth-code-flow";
 /**
  * Creates a Bitbucket OAuth Provider integration (OAuth 2.0 consumer).
  */
 export declare function createBitbucketProvider(config: {
     clientId: string;
     clientSecret: string;
-}): OAuthProvider<{
-    code: string;
-    redirectUri: string;
-}>;
+}): OAuthProvider<OAuthCodeFlowPayload>;

package/dist/auth/builtin-auth-adapter.d.ts

@@ -39,12 +39,23 @@ export interface BuiltinAuthAdapterConfig {
      * wiring path a real backend uses).
      */
     disableSelfRegistration?: boolean;
+    /**
+     * Opt-in: allow `POST /auth/anonymous` to mint a user without credentials.
+     *
+     * Off by default, and overridden by `disableSelfRegistration`. Anonymous
+     * sign-in inserts a `users` row and assigns `defaultRole` exactly as
+     * registration does, so before this key existed a closed backend still
+     * handed out permanent accounts via `/auth/anonymous` + `/auth/anonymous/link`.
+     */
+    allowAnonymous?: boolean;
     /** Whether to expose the authenticated email→minimal-profile lookup route. */
     allowUserLookup?: boolean;
     /** Default role to assign to new users. */
     defaultRole?: string;
     /** OAuth providers to register. */
     oauthProviders?: OAuthProvider<unknown>[];
+    /** Redirect URIs the OAuth routes accept, for every provider. */
+    allowedRedirectUris?: string[];
     /** Static service key for server-to-server auth. */
     serviceKey?: string;
     /** Auth hooks for customizing password, credentials, lifecycle, etc. */

package/dist/auth/discord-oauth.d.ts

@@ -1,14 +1,13 @@
 import type { OAuthProvider } from "./interfaces";
+import { type OAuthCodeFlowPayload } from "./oauth-code-flow";
 /**
  * Creates a Discord OAuth2 Provider integration.
  *
- * Uses the authorization code flow. Requires the "identify" and "email"
- * scopes to retrieve the user's email and profile information.
+ * Uses the authorization code flow (with PKCE when the client supplies a
+ * verifier). Requires the "identify" and "email" scopes to retrieve the
+ * user's email and profile information.
  */
 export declare function createDiscordProvider(config: {
     clientId: string;
     clientSecret: string;
-}): OAuthProvider<{
-    code: string;
-    redirectUri: string;
-}>;
+}): OAuthProvider<OAuthCodeFlowPayload>;

package/dist/auth/facebook-oauth.d.ts

@@ -1,4 +1,5 @@
 import type { OAuthProvider } from "./interfaces";
+import { type OAuthCodeFlowPayload } from "./oauth-code-flow";
 /**
  * Creates a Facebook / Meta OAuth Provider integration.
  *
@@ -8,7 +9,4 @@ import type { OAuthProvider } from "./interfaces";
 export declare function createFacebookProvider(config: {
     clientId: string;
     clientSecret: string;
-}): OAuthProvider<{
-    code: string;
-    redirectUri: string;
-}>;
+}): OAuthProvider<OAuthCodeFlowPayload>;

package/dist/auth/github-oauth.d.ts

@@ -1,4 +1,5 @@
 import type { OAuthProvider } from "./interfaces";
+import { type OAuthCodeFlowPayload } from "./oauth-code-flow";
 /**
  * Creates a GitHub OAuth Provider integration.
  *
@@ -9,7 +10,4 @@ import type { OAuthProvider } from "./interfaces";
 export declare function createGitHubProvider(config: {
     clientId: string;
     clientSecret: string;
-}): OAuthProvider<{
-    code: string;
-    redirectUri: string;
-}>;
+}): OAuthProvider<OAuthCodeFlowPayload>;

package/dist/auth/gitlab-oauth.d.ts

@@ -1,13 +1,15 @@
 import type { OAuthProvider } from "./interfaces";
+import { type OAuthCodeFlowPayload } from "./oauth-code-flow";
 /**
  * Creates a GitLab OAuth Provider integration.
  * Works with both GitLab.com and self-hosted instances.
+ *
+ * `baseUrl` is configuration only and must stay that way: a caller-supplied
+ * instance URL would make this provider an SSRF primitive and an
+ * arbitrary-identity oracle in one step.
  */
 export declare function createGitLabProvider(config: {
     clientId: string;
     clientSecret: string;
     baseUrl?: string;
-}): OAuthProvider<{
-    code: string;
-    redirectUri: string;
-}>;
+}): OAuthProvider<OAuthCodeFlowPayload>;

package/dist/auth/google-oauth.d.ts

@@ -44,4 +44,5 @@ export declare function createGoogleProvider(config: GoogleProviderConfig | stri
     accessToken?: string;
     code?: string;
     redirectUri?: string;
+    codeVerifier?: string;
 }>;

package/dist/auth/index.d.ts

@@ -21,6 +21,13 @@ export { createGitLabProvider } from "./gitlab-oauth";
 export { createBitbucketProvider } from "./bitbucket-oauth";
 export { createSlackProvider } from "./slack-oauth";
 export { createSpotifyProvider } from "./spotify-oauth";
+export type { AppleCodeFlowPayload } from "./apple-oauth";
+export { oauthCodeFlowSchema, pkceTokenParams, providerVerifiedEmail } from "./oauth-code-flow";
+export type { OAuthCodeFlowPayload } from "./oauth-code-flow";
+export { verifyOidcIdToken, tryVerifyOidcIdToken } from "./oidc-id-token";
+export type { OidcIdTokenClaims, VerifyOidcIdTokenOptions } from "./oidc-id-token";
+export { decideOAuthAutoLink, isRedirectUriAllowed } from "./oauth-signin-policy";
+export type { AutoLinkDecision, AutoLinkRefusal } from "./oauth-signin-policy";
 export { requireAuth, requireAdmin, optionalAuth, extractUserFromToken, createAuthMiddleware, queryTokenAuth, fileTokenAuth } from "./middleware";
 export type { AuthMiddlewareOptions, AuthResult } from "./middleware";
 export { createAuthRoutes } from "./routes";