@rebasepro/server 0.17.3 → 0.18.0

package/dist/{src-C9gKj23J.js → src-Dq-I3Ybx.js}

@@ -3,7 +3,7 @@ import __rebaseProcess from "process";
 globalThis.process ??= __rebaseProcess;
 __rebaseCreateRequire(import.meta.url);
 import { r as __require, t as __commonJSMin } from "./rolldown-runtime-dW7B1o5h.js";
-import { _ as REST_TO_CANONICAL, b as toCanonicalOp, d as isRelationalCollectionConfig, g as NULL_OPS, h as CANONICAL_TO_REST, l as getDeclaredSubcollections, m as ALL_WHERE_FILTER_OPS, p as getDataSourceCapabilities, u as isPostgresCollectionConfig, y as sortKeyToString } from "./src-CcOl05Oq.js";
+import { A as REST_TO_CANONICAL, C as isPostgresCollectionConfig, D as ALL_WHERE_FILTER_OPS, E as getDataSourceCapabilities, N as sortKeyToString, O as CANONICAL_TO_REST, P as toCanonicalOp, S as getDeclaredSubcollections, j as isRelationAggregateSort, k as NULL_OPS, p as resolveResourceRefs, w as isRelationalCollectionConfig } from "./src-DHK4fHkw.js";
 //#region ../types/src/errors.ts
 /**
 * The single error type thrown across the entire Rebase client surface —
@@ -36,12 +36,18 @@ var RebaseApiError = class extends Error {
 	code;
 	/** Structured error payload from the server, when present. */
 	details;
+	/** See {@link RebaseErrorInit.requestId}. Quote it in a bug report. */
+	requestId;
+	/** See {@link RebaseErrorInit.retryAfterSeconds}. */
+	retryAfterSeconds;
 	constructor(message, init = {}) {
 		super(message);
 		this.name = "RebaseApiError";
 		this.status = init.status;
 		this.code = init.code;
 		this.details = init.details;
+		this.requestId = init.requestId;
+		this.retryAfterSeconds = init.retryAfterSeconds;
 		if (init.cause !== void 0) this.cause = init.cause;
 	}
 };
@@ -55,11 +61,76 @@ var RebaseApiError = class extends Error {
 * @group Errors
 */
 var RebaseClientError = class extends RebaseApiError {
-	constructor(message) {
-		super(message);
+	/**
+	* `init` is the same one {@link RebaseApiError} takes, and it is what makes
+	* `code` reachable at all.
+	*
+	* The constructor used to accept a message and nothing else, so every
+	* client-side failure — an undefined filter value, an unknown accessor,
+	* `listen()` on a client built with `realtime: false`, a function name with
+	* a `/` in it, `refreshSession()` while signed out — arrived with `code ===
+	* undefined`. The documented `switch (e.code)` in this file's own example
+	* fell to `default: throw e` for all of them, and the only client-side error
+	* that *did* carry a code was `OFFLINE`, because that one path minted a
+	* `RebaseApiError` instead.
+	*/
+	constructor(message, init = {}) {
+		super(message, init);
 		this.name = "RebaseClientError";
 	}
 };
+/**
+* Brand for a contract method a particular client cannot serve.
+*
+* `Symbol.for` rather than a fresh symbol: two copies of `@rebasepro/types` in
+* one tree — which happens, see `docs/dependency-duplication-traps.md` — must
+* agree about it, and a module-local symbol would not.
+*/
+var UNSUPPORTED_METHOD = Symbol.for("rebase.unsupportedMethod");
+/**
+* Build the stub a client installs for a contract method it cannot serve.
+*
+* `listen`, `listenById` and `count` are part of `SDKCollectionClient`, not
+* optional extras — a caller should be able to write
+* `client.data.posts.count()` without asking first, and a transport that cannot
+* serve it should answer with a sentence naming the configuration that would,
+* rather than with `undefined is not a function` at the call site. Where the
+* transport genuinely cannot (a client built with `realtime: false`, a driver
+* with no `listenCollection`), it installs one of these instead of omitting the
+* method.
+*
+* @param message What to tell the caller, naming the fix.
+* @group Errors
+*/
+function unsupportedMethod(message) {
+	const stub = () => {
+		throw new RebaseClientError(message, { code: "REALTIME_DISABLED" });
+	};
+	stub[UNSUPPORTED_METHOD] = true;
+	return stub;
+}
+/**
+* Can this method actually do anything?
+*
+* `true` for a stub from {@link unsupportedMethod} **and** for a method that is
+* simply not there — a partial client, a hand-built test double, an
+* implementation written against an older shape of the interface. Both mean the
+* same thing to a caller, so both answer the same way, and an adapter that
+* checks this cannot be caught out by either.
+*
+* Ordinary code does not need it: calling the method and letting it throw is
+* the normal path. Adapters do — the admin panel chooses between subscribing
+* and a one-shot `find()` by asking whether the client can listen, and a UI
+* that subscribes into a throw is worse than one that polls. This is the
+* question `if (accessor.listen)` used to be asking, made explicit now that the
+* method is always there to call.
+*
+* @group Errors
+*/
+function isUnsupported(method) {
+	if (typeof method !== "function") return true;
+	return method[UNSUPPORTED_METHOD] === true;
+}
 //#endregion
 //#region ../types/src/types/entities.ts
 /**
@@ -268,6 +339,7 @@ var policy = {
 		roles
 	}),
 	authenticated: () => ({ kind: "authenticated" }),
+	registered: () => ({ kind: "registered" }),
 	serverContext: () => ({ kind: "serverContext" }),
 	existsIn: (args) => ({
 		kind: "existsIn",
@@ -1282,6 +1354,51 @@ var toSnakeCase = (str) => {
 	return regExpMatchArray.map((x) => x.toLowerCase()).join("_");
 };
 /**
+* Are these two identifiers one edit apart, ignoring case?
+*
+* Tight on purpose. A suggester that fires on two edits offers `columnWidth`
+* for `colWith` and `readOnly` for `required`, and a "did you mean" that is
+* usually wrong teaches people to stop reading them. One edit covers what
+* actually happens — a dropped letter (`multilne`), a doubled one, a transposed
+* pair (`validaton`), a wrong case — and nothing else.
+*
+* Lives here rather than beside either caller because both the CLI's manifest
+* reader and the server's collection validator answer the same question about
+* an unknown key, and two copies of a similarity rule is two rules the moment
+* one of them is tuned.
+*/
+function isNearMiss(a, b) {
+	const x = a.toLowerCase();
+	const y = b.toLowerCase();
+	if (x === y) return true;
+	if (Math.abs(x.length - y.length) > 1) return false;
+	const [shorter, longer] = x.length <= y.length ? [x, y] : [y, x];
+	let i = 0;
+	let j = 0;
+	let edits = 0;
+	while (i < shorter.length && j < longer.length) {
+		if (shorter[i] === longer[j]) {
+			i++;
+			j++;
+			continue;
+		}
+		if (++edits > 1) return false;
+		if (shorter.length === longer.length) i++;
+		j++;
+	}
+	return edits + (longer.length - j) + (shorter.length - i) <= 1;
+}
+/**
+* The key in `known` that `key` was probably meant to be, if any.
+*
+* `undefined` when nothing is close — which is the common case for a key that
+* is simply from a newer version, and the reason the caller must be able to say
+* "unknown" without saying "wrong".
+*/
+function suggestNearMiss(known, key) {
+	return known.find((candidate) => isNearMiss(candidate, key));
+}
+/**
 * Deep clone a value, preserving function references and class instances.
 * Unlike structuredClone, this handles objects that contain functions
 * (e.g. CollectionConfig with target(), childCollections(), callbacks).
@@ -1664,8 +1781,7 @@ function resolveRelation(relation, sourceCollection, propertyKey) {
 		targetSlug: targetCollection.slug,
 		onUpdate: relation.onUpdate,
 		onDelete: relation.onDelete,
-		overrides: relation.overrides,
-		validation: relation.validation
+		overrides: relation.overrides
 	};
 	const sourceName = toSnakeCase(sourceCollection.slug ?? sourceCollection.name);
 	switch (relation.kind) {
@@ -1842,9 +1958,60 @@ function resolveCollectionRelations(collection) {
 	_resolvedRelationsCache.set(collection, relations);
 	return relations;
 }
+/**
+* The `type: "relation"` property that declares a link, or `undefined` for one
+* that only exists in the collection's `relations` array.
+*
+* Both declaration sites end up in {@link resolveCollectionRelations}, and only
+* one of them has a property to carry field-level facts — `name`, `admin`, and
+* the one this exists for, `validation.required`.
+*/
+function relationDeclaringProperty(collection, relation) {
+	const resolved = resolveCollectionRelations(collection);
+	for (const [key, raw] of Object.entries(collection.properties ?? {})) {
+		const prop = raw;
+		if (prop?.type !== "relation") continue;
+		if (resolved[key] === relation) return prop;
+		const addressed = prop.relation?.relationName;
+		if (addressed && findRelation(resolved, addressed) === relation) return prop;
+	}
+}
+/**
+* Must every row of this collection point at a target through this link?
+*
+* Read from the declaring property's `validation.required` — the same key every
+* other field uses, and the only place it lives.
+*
+* `RelationBase` carried its own `validation.required` until 0.18, which made
+* this two questions rather than one. They were answered by different readers:
+* the Postgres DDL generator asked the property (so the foreign-key column was
+* `NOT NULL`) and the SDK type generator asked the relation (so the generated
+* `Insert` type made the field optional). A `create()` that left the relation
+* out therefore typechecked and then failed at the database with a not-null
+* violation, and the two `required`s had to be written twice, identically, for
+* the pair to agree.
+*
+* A relation with no declaring property — an entry in `relations` nothing
+* points at — is not required. There is no field to fill in.
+*/
+function isRelationRequired(collection, relation) {
+	return Boolean(relationDeclaringProperty(collection, relation)?.validation?.required);
+}
+/**
+* The table a collection reads and writes.
+*
+* `table` when it is set, otherwise `toSnakeCase(slug)` — which is what made it
+* safe to drop `table` from the required fields on the config type: the runtime
+* had always derived it, and the type was demanding a value it did not need.
+*
+* The `||` chain is load-bearing. `toSnakeCase(undefined)` returns `""`, not
+* `undefined`, so the previous `??` chain short-circuited on the empty string
+* and the name fallback could never run — a safety net that read like one and
+* caught nothing. It was unreachable while `slug` was required; it stops being
+* unreachable the moment anything constructs a config without one.
+*/
 function getTableName(collection) {
-	if (isRelationalCollectionConfig(collection)) return collection.table ?? toSnakeCase(collection.slug) ?? toSnakeCase(collection.name);
-	return toSnakeCase(collection.slug) ?? toSnakeCase(collection.name);
+	return (isRelationalCollectionConfig(collection) ? collection.table : void 0) || toSnakeCase(collection.slug) || toSnakeCase(collection.name);
 }
 /**
 * The field key a database column is served and addressed under.
@@ -2012,6 +2179,17 @@ var FOREIGN_CONVENTION_UIDS = /* @__PURE__ */ new Map([
 ]);
 new RegExp(String.raw`rebase\.uid\(\)\s*=\s*'(${[...FOREIGN_CONVENTION_UIDS.keys()].join("|")})'`, "i");
 //#endregion
+//#region ../common/src/util/builders.ts
+/**
+* At runtime this is a plain identity function: a resource handle written where
+* a key belongs — `dataSource: analytics` — becomes its key, so past this point
+* a collection is plain data. The signature above is the rest of the point.
+* @group Builder
+*/
+function defineCollection(collection) {
+	return resolveResourceRefs(collection);
+}
+//#endregion
 //#region ../common/src/util/auth-default-policies.ts
 /**
 * Default RLS policies injected by the schema generator.
@@ -2880,7 +3058,7 @@ var CollectionRegistry = class {
 	dataSources = {};
 	/**
 	* Global lifecycle callbacks applied to every collection.
-	* Runs on all data paths (REST, WebSocket, `rebase.data`).
+	* Runs on all data paths (REST, WebSocket, `rebase.dataAsAdmin`).
 	* Execution order: global → collection → property callbacks.
 	*/
 	_globalCallbacks;
@@ -3018,7 +3196,7 @@ var CollectionRegistry = class {
 			else {
 				const declared = resolveCollectionRelations(collection)[key];
 				if (declared) relationProperty.resolvedRelation = declared;
-				else console.warn(`Relation property '${key}' on '${collection.slug}' declares no \`relation\`, and the collection has no relation of that name.`);
+				else console.warn(`Relation property '${key}' on '${collection.slug}' names no relation: it has no \`relation\` block, and the collection's \`relations\` array has no entry called '${key}'. The field will render no picker, generate no foreign key, and return nothing from \`include()\`.`);
 			}
 		}
 		return newProperty;
@@ -3111,6 +3289,122 @@ var CollectionRegistry = class {
 	}
 };
 //#endregion
+//#region ../common/src/collections/default-collections.ts
+/**
+* Default users collection.
+*
+* Prepended to the developer's collections array by the admin and server.
+* Slug-based dedup (Map keyed by slug, last-write-wins) lets developers
+* override by defining their own collection with `slug: "users"`.
+*
+* Schema only — no `admin` block. This package is on the backend's dependency path,
+* where that field does not exist: `@rebasepro/cms-types` adds it by declaration
+* merging, and a BaaS install never installs that. The scaffolded
+* `config/collections/users.ts` carries the presentation for projects that want this
+* collection in their panel, which is also where it is editable.
+*/
+var defaultUsersCollection = defineCollection({
+	name: "Users",
+	singularName: "User",
+	slug: "users",
+	auth: true,
+	table: "users",
+	schema: "rebase",
+	securityRules: [{
+		operation: "select",
+		roles: ["admin"]
+	}, {
+		operations: [
+			"insert",
+			"update",
+			"delete"
+		],
+		roles: ["admin"]
+	}],
+	properties: {
+		id: {
+			name: "ID",
+			type: "string",
+			isId: "uuid"
+		},
+		email: {
+			name: "Email",
+			type: "string",
+			validation: {
+				required: true,
+				unique: true
+			}
+		},
+		displayName: {
+			name: "Name",
+			type: "string",
+			columnName: "display_name",
+			validation: { required: true }
+		},
+		photoURL: {
+			name: "Photo URL",
+			type: "string",
+			columnName: "photo_url"
+		},
+		roles: {
+			name: "Roles",
+			type: "array",
+			columnType: "text[]",
+			of: {
+				name: "Role",
+				type: "string",
+				enum: {
+					admin: "Admin",
+					editor: "Editor",
+					viewer: "Viewer"
+				}
+			}
+		},
+		passwordHash: {
+			name: "Password Hash",
+			type: "string",
+			columnName: "password_hash",
+			excludeFromApi: true
+		},
+		emailVerified: {
+			name: "Email Verified",
+			type: "boolean",
+			columnName: "email_verified",
+			defaultValue: false
+		},
+		emailVerificationToken: {
+			name: "Email Verification Token",
+			type: "string",
+			columnName: "email_verification_token",
+			excludeFromApi: true
+		},
+		emailVerificationSentAt: {
+			name: "Email Verification Sent At",
+			type: "date",
+			columnName: "email_verification_sent_at"
+		},
+		metadata: {
+			name: "Metadata",
+			type: "map",
+			keyValue: true,
+			properties: {},
+			defaultValue: {}
+		},
+		createdAt: {
+			name: "Created At",
+			type: "date",
+			columnName: "created_at",
+			autoValue: "on_create"
+		},
+		updatedAt: {
+			name: "Updated At",
+			type: "date",
+			columnName: "updated_at",
+			autoValue: "on_update"
+		}
+	}
+});
+//#endregion
 //#region ../common/src/data/sort-dialect.ts
 /**
 * Sort-order wire codec.
@@ -3146,7 +3440,23 @@ function normalizeOrderBy(orderBy) {
 	if (!orderBy || orderBy.length === 0) return void 0;
 	const list = Array.isArray(orderBy[0]) ? orderBy : [orderBy];
 	if (list.length === 0) return void 0;
-	return list.map(([key, direction]) => [sortKeyToString(key), direction]);
+	return list.map((entry, index) => toStrictTuple(entry, index));
+}
+/** A sort whose *shape* is unusable, as opposed to one naming a field that does not exist. */
+var OrderBySpecError = class extends Error {
+	code = "INVALID_ORDER_BY";
+	constructor(detail) {
+		super(`Invalid \`orderBy\`: ${detail}. Expected a field name, or a list of [field, direction] pairs like [["roles","asc"],["created_at","desc"]]`);
+		this.name = "OrderBySpecError";
+	}
+};
+function toStrictTuple(raw, index) {
+	if (!Array.isArray(raw)) throw new OrderBySpecError(`entry ${index} has no field name`);
+	const key = isRelationAggregateSort(raw[0]) ? sortKeyToString(raw[0]) : raw[0];
+	if (typeof key !== "string" || key.trim() === "") throw new OrderBySpecError(`entry ${index} has no field name`);
+	const direction = raw[1];
+	if (direction !== void 0 && direction !== "asc" && direction !== "desc") throw new OrderBySpecError(`entry ${index} has direction '${String(direction)}'`);
+	return [key, direction ?? "asc"];
 }
 /**
 * Serialize a sort to the wire.
@@ -3192,7 +3502,11 @@ var QueryBuilder = class {
 	}
 	where(columnOrCondition, operator, value) {
 		if (typeof columnOrCondition === "object" && columnOrCondition !== null && "type" in columnOrCondition) {
-			this.params.logical = columnOrCondition;
+			const next = columnOrCondition;
+			this.params.logical = this.params.logical ? {
+				type: "and",
+				conditions: [this.params.logical, next]
+			} : next;
 			return this;
 		}
 		if (!this.params.where) this.params.where = {};
@@ -3777,6 +4091,36 @@ function readTuple(field, raw) {
 	if (isOperatorShaped(op)) throw new UnknownFilterOperatorError(field, op);
 }
 /**
+* Encode the `<op>.<value>` half of a wire condition.
+*
+* This is the single leaf encoder. Both wire positions that carry a condition
+* — a top-level query parameter (`?status=eq.active`) and a leaf inside an
+* `and(...)`/`or(...)` group (`or(status.eq.active,…)`) — go through it, so a
+* rule expressed here holds in both. The group serializer used to carry its
+* own copy, and the copy had drifted on every rule that matters: `null` went
+* out as the four-character string, the empty list as `()`, and an operator
+* this dialect does not have was silently rewritten to `eq` — a filter that
+* ran, returned rows, and answered a different question than the one asked.
+*
+* `escapeScalar` is the one thing the two positions legitimately disagree
+* about. A scalar in a query parameter owns the whole value and needs no
+* escaping; a scalar inside a group sits between the same commas a list item
+* does, so a comma in it would end the condition early.
+*/
+function serializeOperatorAndValue(op, value, { escapeScalar, where }) {
+	if (typeof op !== "string") throw new TypeError(`${where}: operator must be a string, got ${typeof op}`);
+	const restOp = CANONICAL_OP_LOOKUP.get(op);
+	if (!restOp) throw new TypeError(`${where}: unknown operator "${op}". Valid operators: ${Object.keys(CANONICAL_TO_REST).join(", ")}`);
+	if (value === null && (op === "==" || op === "!=")) return op === "==" ? "isnull.null" : "notnull.null";
+	if (NULL_OPS.has(op)) return `${restOp}.null`;
+	if (Array.isArray(value)) {
+		if (value.length === 0) return `${restOp}.(${EMPTY_LIST_TOKEN})`;
+		return `${restOp}.(${value.map((v) => escapeWireValue(stringifyValue(v))).join(",")})`;
+	}
+	const scalar = stringifyValue(value);
+	return `${restOp}.${escapeScalar ? escapeWireValue(scalar) : scalar}`;
+}
+/**
 * Serialize a single canonical condition tuple to a PostgREST dot-string.
 *
 * Throws `TypeError` if the input is not a valid `[WhereFilterOp, unknown]` tuple.
@@ -3789,15 +4133,10 @@ function readTuple(field, raw) {
 function serializeTuple(tuple) {
 	if (!Array.isArray(tuple) || tuple.length !== 2) throw new TypeError(`serializeTuple: expected a [WhereFilterOp, value] tuple, got ${JSON.stringify(tuple)}`);
 	const [op, value] = tuple;
-	if (typeof op !== "string") throw new TypeError(`serializeTuple: operator must be a string, got ${typeof op}`);
-	const restOp = CANONICAL_OP_LOOKUP.get(op);
-	if (!restOp) throw new TypeError(`serializeTuple: unknown operator "${op}". Valid operators: ${Object.keys(CANONICAL_TO_REST).join(", ")}`);
-	if (value === null && (op === "==" || op === "!=")) return op === "==" ? "isnull.null" : "notnull.null";
-	if (Array.isArray(value)) {
-		if (value.length === 0) return `${restOp}.(${EMPTY_LIST_TOKEN})`;
-		return `${restOp}.(${value.map((v) => escapeWireValue(stringifyValue(v))).join(",")})`;
-	}
-	return `${restOp}.${stringifyValue(value)}`;
+	return serializeOperatorAndValue(op, value, {
+		escapeScalar: false,
+		where: "serializeTuple"
+	});
 }
 /**
 * Convert `FilterValues` (or `WireFilterValues`) to a PostgREST-style
@@ -3902,10 +4241,21 @@ function deserializeFilter(query) {
 /**
 * Serialize a `LogicalCondition` or `FilterCondition` to its wire-format string.
 *
+* Leaf encoding is {@link serializeOperatorAndValue}, the same function
+* `serializeTuple` uses, so `null`, the empty list and an unknown operator
+* behave identically inside a group and in a query parameter.
+*
+* @throws {TypeError} when a leaf names an operator this dialect does not have.
+* It used to fall back to `eq`, which turned `age >= 18` into `age = 18` with
+* no diagnostic anywhere.
+*
 * @example
 * serializeLogicalCondition({ column: "status", operator: "==", value: "active" })
 * // → "status.eq.active"
 *
+* serializeLogicalCondition({ column: "deleted_at", operator: "==", value: null })
+* // → "deleted_at.isnull.null"
+*
 * serializeLogicalCondition({ type: "or", conditions: [...] })
 * // → "or(status.eq.active,status.eq.pending)"
 */
@@ -3914,12 +4264,60 @@ function serializeLogicalCondition(cond) {
 		const inner = (cond.conditions ?? []).map(serializeLogicalCondition).join(",");
 		return `${cond.type}(${inner})`;
 	}
-	const restOp = CANONICAL_OP_LOOKUP.get(cond.operator) ?? "eq";
-	if (Array.isArray(cond.value)) {
-		const items = cond.value.map((v) => escapeWireValue(stringifyValue(v))).join(",");
-		return `${cond.column}.${restOp}.(${items})`;
+	return `${escapeWireValue(cond.column)}.${serializeOperatorAndValue(cond.operator, cond.value, {
+		escapeScalar: true,
+		where: "serializeLogicalCondition"
+	})}`;
+}
+/**
+* Split a leaf condition into `column`, operator token and value.
+*
+* The naive reading — column is everything before the first dot, operator is
+* everything up to the second — cannot express a relation path. A filter on
+* `author.name` serializes to `author.name.eq.bob` and came back as the column
+* `author` with the operator `name`, which resolves to nothing, so the
+* fallback made it `author == "eq.bob"`: a condition that runs and matches
+* nothing, on a column the caller never named.
+*
+* So the operator is found rather than assumed: it is the first dot-separated
+* segment after the column that resolves to a real operator. Everything before
+* it is the column, everything after is the value. `version.eq.1.2.3` reads as
+* `version == "1.2.3"` because the scan stops at the first match — the `eq` at
+* offset 1, not a later segment — and `metadata->>x.eq.5` never had dots in the
+* column to begin with.
+*
+* Returns `undefined` when no segment resolves — `status.active`, an equality
+* written without an operator, which the caller handles.
+*/
+function splitLeafCondition(str) {
+	let limit = str.length;
+	for (let i = 0; i < str.length; i++) {
+		if (str[i] === "\\") {
+			i++;
+			continue;
+		}
+		if (str[i] === "(") {
+			limit = i;
+			break;
+		}
+	}
+	const dots = [];
+	for (let i = 0; i < limit; i++) {
+		if (str[i] === "\\") {
+			i++;
+			continue;
+		}
+		if (str[i] === ".") dots.push(i);
+	}
+	for (let i = 1; i < dots.length; i++) {
+		const operator = toCanonicalOp(str.substring(dots[i - 1] + 1, dots[i]));
+		if (!operator) continue;
+		return {
+			column: unescapeWireValue(str.substring(0, dots[i - 1])),
+			operator,
+			value: str.substring(dots[i] + 1)
+		};
 	}
-	return `${cond.column}.${restOp}.${escapeWireValue(stringifyValue(cond.value))}`;
 }
 function deserializeLogicalCondition(str, nesting = 0) {
 	if (nesting > 32) throw new Error(`Filter groups nest more than 32 levels deep. Flatten the condition — \`or(a,or(b,c))\` is \`or(a,b,c)\`.`);
@@ -3932,28 +4330,34 @@ function deserializeLogicalCondition(str, nesting = 0) {
 			conditions: splitGroupItems(innerStr).map((part) => deserializeLogicalCondition(part, nesting + 1))
 		};
 	}
-	const firstDot = str.indexOf(".");
-	if (firstDot === -1) return {
-		column: str,
-		operator: "==",
-		value: true
-	};
-	const column = str.substring(0, firstDot);
-	const rest = str.substring(firstDot + 1);
-	const secondDot = rest.indexOf(".");
-	if (secondDot === -1) return {
-		column,
-		operator: "==",
-		value: unescapeWireValue(rest)
-	};
-	const opStr = rest.substring(0, secondDot);
-	const valueStr = rest.substring(secondDot + 1);
-	const operator = toCanonicalOp(opStr) ?? "==";
-	if (valueStr.startsWith("(") && valueStr.endsWith(")")) return {
+	const leaf = splitLeafCondition(str);
+	if (!leaf) {
+		const firstDot = str.indexOf(".");
+		if (firstDot === -1) return {
+			column: unescapeWireValue(str),
+			operator: "==",
+			value: true
+		};
+		return {
+			column: unescapeWireValue(str.substring(0, firstDot)),
+			operator: "==",
+			value: unescapeWireValue(str.substring(firstDot + 1))
+		};
+	}
+	const { column, operator, value: valueStr } = leaf;
+	if (NULL_OPS.has(operator)) return {
 		column,
 		operator,
-		value: splitListItems(valueStr.slice(1, -1))
+		value: null
 	};
+	if (valueStr.startsWith("(") && valueStr.endsWith(")")) {
+		const inner = valueStr.slice(1, -1);
+		return {
+			column,
+			operator,
+			value: inner === EMPTY_LIST_TOKEN ? [] : splitListItems(inner)
+		};
+	}
 	return {
 		column,
 		operator,
@@ -3962,6 +4366,15 @@ function deserializeLogicalCondition(str, nesting = 0) {
 }
 //#endregion
 //#region ../common/src/data/buildRebaseData.ts
+/**
+* What a client says when its data source cannot subscribe.
+*
+* Named rather than inlined so the sentence a caller sees does not depend on
+* which of the two adapters below happened to build the client.
+*/
+var noRealtime = (slug) => `Realtime is not available for "${slug}": its data source does not support subscriptions.`;
+/** What a client says when its data source cannot count. */
+var noCount = (slug) => `Counting is not available for "${slug}": its data source does not support it.`;
 function createPrimaryKeyResolver(options) {
 	const cache = /* @__PURE__ */ new Map();
 	const warned = /* @__PURE__ */ new Set();
@@ -4256,7 +4669,11 @@ var SdkQueryBuilder = class {
 	}
 	where(columnOrCondition, operator, value) {
 		if (typeof columnOrCondition === "object" && columnOrCondition !== null && "type" in columnOrCondition) {
-			this.params.logical = columnOrCondition;
+			const next = columnOrCondition;
+			this.params.logical = this.params.logical ? {
+				type: "and",
+				conditions: [this.params.logical, next]
+			} : next;
 			return this;
 		}
 		if (!this.params.where) this.params.where = {};
@@ -4276,7 +4693,7 @@ var SdkQueryBuilder = class {
 	/** Called again, this adds a tie-breaker rather than replacing the sort. */
 	orderBy(column, direction = "asc") {
 		const existing = normalizeOrderBy(this.params.orderBy) ?? [];
-		this.params.orderBy = [...existing, [column, direction]];
+		this.params.orderBy = [...existing, [sortKeyToString(column), direction]];
 		return this;
 	}
 	limit(count) {
@@ -4308,11 +4725,39 @@ var SdkQueryBuilder = class {
 	async find() {
 		return this.client.find(this.params);
 	}
+	/**
+	* Page through everything this query matches, one row at a time.
+	*
+	* `.limit()` on the builder becomes the page size, so the ceiling on a
+	* single `find()` is not a ceiling on what the query can read.
+	*/
+	iterate(options) {
+		return this.client.iterate({
+			...this.params,
+			...this.params.limit !== void 0 && { pageSize: this.params.limit },
+			...options
+		});
+	}
+	/** Collect everything this query matches into one array. */
+	findAll(options) {
+		return this.client.findAll({
+			...this.params,
+			...this.params.limit !== void 0 && { pageSize: this.params.limit },
+			...options
+		});
+	}
+	/**
+	* Count the records matching this query.
+	*
+	* This used to answer `0` when the client had no `count` — a number, from a
+	* source that had not counted anything, indistinguishable from an empty
+	* collection. It now does what the client does, which on a source that
+	* cannot count is throw and say so.
+	*/
 	async count() {
-		return this.client.count ? this.client.count(this.params) : 0;
+		return this.client.count(this.params);
 	}
 	listen(onUpdate, onError) {
-		if (!this.client.listen) throw new Error("Listen is only available when the driver supports realtime.");
 		return this.client.listen(this.params, onUpdate, onError);
 	}
 };
@@ -4340,6 +4785,14 @@ function toSdkCollectionClient(snap, slug = "collection") {
 			const s = await snap.findById(id);
 			return s ? entityToRow(s) : void 0;
 		},
+		async get(id) {
+			const s = await snap.findById(id);
+			if (!s) throw new RebaseApiError(`No record with id ${JSON.stringify(String(id))} in "${slug}".`, {
+				status: 404,
+				code: "NOT_FOUND"
+			});
+			return entityToRow(s);
+		},
 		async create(data, id) {
 			return entityToRow(await snap.create(data, id));
 		},
@@ -4370,12 +4823,12 @@ function toSdkCollectionClient(snap, slug = "collection") {
 			if (!snap.deleteMany) throw new Error("Bulk deletes are not supported by this collection's data source. Fall back to delete() per record.");
 			await snap.deleteMany(ids);
 		},
-		count: snap.count ? (params) => snap.count(params) : void 0,
+		count: snap.count ? (params) => snap.count(params) : unsupportedMethod(noCount(slug)),
 		listen: snap.listen ? (params, onUpdate, onError) => snap.listen(params, (res) => onUpdate({
 			data: res.data.map(entityToRow),
 			meta: res.meta
-		}), onError) : void 0,
-		listenById: snap.listenById ? (id, onUpdate, onError) => snap.listenById(id, (s) => onUpdate(s ? entityToRow(s) : void 0), onError) : void 0,
+		}), onError) : unsupportedMethod(noRealtime(slug)),
+		listenById: snap.listenById ? (id, onUpdate, onError) => snap.listenById(id, (s) => onUpdate(s ? entityToRow(s) : void 0), onError) : unsupportedMethod(noRealtime(slug)),
 		where(columnOrCondition, operator, value) {
 			const builder = new SdkQueryBuilder(client);
 			if (typeof columnOrCondition === "object") return builder.where(columnOrCondition);
@@ -4419,7 +4872,7 @@ function wrapAsSdkData(entityData) {
 * Build a flat {@link RebaseSdkData} from a `DataDriver`.
 *
 * This is the developer-facing SDK data layer used by backend framework
-* callbacks & scripts (`context.data` / `rebase.data`). It returns flat rows —
+* callbacks & scripts (`context.data` / `rebase.dataAsAdmin`). It returns flat rows —
 * identical in shape to the frontend SDK client, down to how a relation is
 * served: a foreign key stays a foreign key, and a relation named in `include`
 * arrives as the target's own columns. The `{ __type: "relation" }` envelope is
@@ -4474,6 +4927,6 @@ function buildRoutedRebaseData({ defaultData, sources, resolveKey }) {
 	} });
 }
 //#endregion
-export { GeoPoint as A, ListLimitError as C, isAnonymousUid as D, ANONYMOUS_USER_ID as E, RebaseApiError as M, RebaseClientError as N, EntityReference as O, toSnakeCase as S, resolveClientListLimit as T, fieldKeyForColumn as _, deserializeLogicalCondition as a, buildCompositeId as b, collectAllPages as c, normalizeOrderBy as d, serializeOrderBy as f, getEffectiveSecurityRules as g, resolveDataSource as h, deserializeFilter as i, Vector as j, EntityRelation as k, paginateFind as l, createDataSourceRegistry as m, buildSdkData as n, serializeFilter as o, CollectionRegistry as p, UnknownFilterOperatorError as r, serializeLogicalCondition as s, buildRoutedRebaseData as t, resolveFindWindow as u, findRelation as v, MAX_LIST_LIMIT as w, resolvePrimaryKeys as x, resolveCollectionRelations as y };
+export { ANONYMOUS_USER_ID as A, buildCompositeId as C, ListLimitError as D, toSnakeCase as E, Vector as F, RebaseApiError as I, RebaseClientError as L, EntityReference as M, EntityRelation as N, MAX_LIST_LIMIT as O, GeoPoint as P, isUnsupported as R, resolveCollectionRelations as S, suggestNearMiss as T, getEffectiveSecurityRules as _, deserializeLogicalCondition as a, getTableName as b, collectAllPages as c, normalizeOrderBy as d, serializeOrderBy as f, resolveDataSource as g, createDataSourceRegistry as h, deserializeFilter as i, isAnonymousUid as j, resolveClientListLimit as k, paginateFind as l, CollectionRegistry as m, buildSdkData as n, serializeFilter as o, defaultUsersCollection as p, UnknownFilterOperatorError as r, serializeLogicalCondition as s, buildRoutedRebaseData as t, resolveFindWindow as u, fieldKeyForColumn as v, resolvePrimaryKeys as w, isRelationRequired as x, findRelation as y, unsupportedMethod as z };
 
-//# sourceMappingURL=src-C9gKj23J.js.map
+//# sourceMappingURL=src-Dq-I3Ybx.js.map