@rebasepro/server 0.17.3 → 0.18.1

package/dist/{logs-routes-DB72iQSr.js → logs-routes-CbsTpozn.js}

@@ -3,7 +3,8 @@ import __rebaseProcess from "process";
 globalThis.process ??= __rebaseProcess;
 __rebaseCreateRequire(import.meta.url);
 import { n as __exportAll } from "./rolldown-runtime-dW7B1o5h.js";
-import { n as errorHandler, t as ApiError } from "./errors-DBwpj9N8.js";
+import { t as addLogSink } from "./logger-DO2PZc4i.js";
+import { n as errorHandler, t as ApiError } from "./errors-HjfaPlvY.js";
 import { Hono } from "hono";
 import { streamSSE } from "hono/streaming";
 //#region src/api/logs-routes.ts
@@ -12,7 +13,9 @@ var logs_routes_exports = /* @__PURE__ */ __exportAll({
 	createLogsRoutes: () => createLogsRoutes,
 	default: () => logs_routes_default,
 	logBuffer: () => logBuffer,
-	logMiddleware: () => logMiddleware
+	logMiddleware: () => logMiddleware,
+	sourceForMessage: () => sourceForMessage,
+	teeLoggerIntoLogBuffer: () => teeLoggerIntoLogBuffer
 });
 function normalizeFilter(options) {
 	return {
@@ -103,16 +106,80 @@ function logMiddleware(options = {}) {
 		if (ignored.has(c.req.path)) return;
 		const duration = Date.now() - start;
 		const reqId = c.get("requestId");
-		addLog("info", "api", `${c.req.method} ${c.req.path} ${c.res.status} ${duration}ms`, {
+		const status = c.res.status;
+		const level = status >= 500 ? "error" : status >= 400 ? "warn" : "info";
+		const failure = c.get("errorSummary");
+		addLog(level, "api", `${c.req.method} ${c.req.path} ${status} ${duration}ms` + (failure ? ` — ${failure.code}: ${failure.message}` : ""), {
 			method: c.req.method,
 			path: c.req.path,
-			status: c.res.status,
+			status,
 			duration,
-			...reqId && { requestId: reqId }
+			...reqId && { requestId: reqId },
+			...c.get("collection") && { collection: c.get("collection") },
+			...failure && {
+				errorCode: failure.code,
+				errorMessage: failure.message
+			}
 		});
 	};
 }
 /**
+* Prefixes the server writes at the head of a log message, and the `source`
+* each one belongs to.
+*
+* The ring's `source` is a closed set the Studio filters on, and the messages
+* carry their origin as a bracketed prefix — `[API]`, `[Auth]`, `[functions]`,
+* `[schema]`. Matching them is what makes a teed line filterable beside the
+* request entries rather than a heap under "system".
+*/
+var SOURCE_BY_PREFIX = [
+	[/^\[?(api|rest)\b/i, "api"],
+	[/^\[?auth\b/i, "auth"],
+	[/^\[?(storage|s3|gcs)\b/i, "storage"],
+	[/^\[?(realtime|ws|websocket|cdc)\b/i, "realtime"]
+];
+/**
+* The `source` for a teed line, from whatever prefix it carries.
+*
+* Exported for its test: the mapping is a string match on wording somebody else
+* writes, which is the shape of check that stops working without failing.
+*/
+function sourceForMessage(message) {
+	const candidate = message.match(/\[([^\]]{1,32})\]/)?.[1] ?? message;
+	for (const [pattern, source] of SOURCE_BY_PREFIX) if (pattern.test(candidate)) return source;
+	return "system";
+}
+/**
+* Feed the Logs Explorer everything the server says at warn and above.
+*
+* The ring used to be filled by `logMiddleware` alone, so the panel showed a
+* wall of `GET /api/data/posts 200 4ms` and not one of the errors, warnings or
+* boot diagnoses being written to stdout at the same moment. A function that
+* threw was the sharpest case: the request entry said `500` and the reason
+* existed only in a terminal the person looking at the panel does not have.
+*
+* Warn and above, deliberately. `info` is where the steady-state chatter lives,
+* and a 10,000-entry ring filled with it evicts the lines somebody opened the
+* panel to find.
+*
+* Idempotent: called from `createLogsRoutes`, which a split deployment may
+* reach more than once.
+*/
+var detachLoggerTee;
+function teeLoggerIntoLogBuffer() {
+	if (detachLoggerTee) return detachLoggerTee;
+	const detach = addLogSink((level, message, data) => {
+		if (level !== "warn" && level !== "error") return;
+		if (message === "request") return;
+		addLog(level, sourceForMessage(message), message, Object.keys(data).length > 0 ? data : void 0);
+	});
+	detachLoggerTee = () => {
+		detach();
+		detachLoggerTee = void 0;
+	};
+	return detachLoggerTee;
+}
+/**
 * How long entries accumulate before a batch goes out.
 *
 * Not zero, and that is the point. A busy server logs faster than a browser can
@@ -158,6 +225,7 @@ var STREAM_MAX_PENDING = 2e3;
 */
 var LOG_WINDOW_MAX = 1e4;
 function createLogsRoutes(timing = {}) {
+	teeLoggerIntoLogBuffer();
 	const flushMs = timing.flushMs ?? STREAM_FLUSH_MS;
 	const heartbeatMs = timing.heartbeatMs ?? STREAM_HEARTBEAT_MS;
 	const maxPending = timing.maxPending ?? STREAM_MAX_PENDING;
@@ -269,4 +337,4 @@ var logs_routes_default = createLogsRoutes();
 //#endregion
 export { logs_routes_exports as n, logMiddleware as t };
 
-//# sourceMappingURL=logs-routes-DB72iQSr.js.map
+//# sourceMappingURL=logs-routes-CbsTpozn.js.map

package/dist/logs-routes-CbsTpozn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logs-routes-CbsTpozn.js","names":[],"sources":["../src/api/logs-routes.ts"],"sourcesContent":["import { Hono } from \"hono\";\nimport type { MiddlewareHandler } from \"hono\";\nimport { streamSSE } from \"hono/streaming\";\nimport type { HonoEnv } from \"./types\";\nimport { ApiError, errorHandler } from \"./errors\";\nimport { addLogSink } from \"../utils/logger\";\n\nexport interface LogEntry {\n    id: string;\n    timestamp: string;\n    level: \"debug\" | \"info\" | \"warn\" | \"error\";\n    source: \"api\" | \"auth\" | \"storage\" | \"realtime\" | \"system\";\n    message: string;\n    metadata?: Record<string, unknown>;\n}\n\n/** What a caller can narrow the log by, in either direction (query or stream). */\nexport interface LogFilterOptions {\n    level?: string;\n    source?: string;\n    search?: string;\n    since?: string;\n}\n\n/**\n * A filter with the search term already lowercased.\n *\n * The distinction matters on the stream path: `query()` lowercases once and then\n * scans, but a subscriber tests one entry at a time and would otherwise redo the\n * same `toLowerCase()` on every request the server handles.\n */\ntype NormalizedFilter = LogFilterOptions;\n\nfunction normalizeFilter(options: LogFilterOptions): NormalizedFilter {\n    return { ...options,\n        search: options.search?.toLowerCase() };\n}\n\n/**\n * Whether one entry belongs in a filtered view.\n *\n * Shared by the query and the stream on purpose: two copies of this would drift,\n * and the failure that produces is invisible — a tail that quietly shows a\n * different set of lines than the snapshot it started from.\n */\nfunction matchesFilter(entry: LogEntry, filter: NormalizedFilter): boolean {\n    if (filter.level && entry.level !== filter.level) return false;\n    if (filter.source && entry.source !== filter.source) return false;\n    if (filter.search && !entry.message.toLowerCase().includes(filter.search)) return false;\n    if (filter.since && entry.timestamp < filter.since) return false;\n    return true;\n}\n\n/** Notified for every entry pushed, in push order. */\nexport type LogListener = (entry: LogEntry) => void;\n\nclass LogRingBuffer {\n    private buffer: LogEntry[] = [];\n    private maxSize: number;\n    private idCounter = 0;\n    private listeners = new Set<LogListener>();\n\n    constructor(maxSize = 10000) {\n        this.maxSize = maxSize;\n    }\n\n    push(entry: Omit<LogEntry, \"id\">): void {\n        const id = `log_${++this.idCounter}`;\n        const stored: LogEntry = { ...entry,\n            id };\n        this.buffer.push(stored);\n        if (this.buffer.length > this.maxSize) {\n            this.buffer.shift();\n        }\n        // This runs on the request hot path, so a listener must never be able to\n        // take the request down with it: a tail that throws loses its own tail,\n        // not the response the log line was describing.\n        for (const listener of this.listeners) {\n            try {\n                listener(stored);\n            } catch {\n                /* a broken tail is not the request's problem */\n            }\n        }\n    }\n\n    /**\n     * Follow the buffer. Returns the unsubscribe — call it, always: a listener\n     * left behind holds its whole closure, and on this class that closure is a\n     * pending-entry array.\n     *\n     * A listener must not log. It is called from inside `push`, so anything that\n     * reaches `addLog` from here recurses until the stack gives out.\n     */\n    subscribe(listener: LogListener): () => void {\n        this.listeners.add(listener);\n        return () => {\n            this.listeners.delete(listener);\n        };\n    }\n\n    query(options: LogFilterOptions & {\n        limit?: number;\n        offset?: number;\n    }): { entries: LogEntry[]; total: number } {\n        const filter = normalizeFilter(options);\n        const filtered = this.buffer.filter(e => matchesFilter(e, filter));\n\n        // Newest first\n        const sorted = [...filtered].reverse();\n        const total = sorted.length;\n        const limit = options.limit || 100;\n        const offset = options.offset || 0;\n\n        return {\n            entries: sorted.slice(offset, offset + limit),\n            total\n        };\n    }\n\n    getLatest(count = 50): LogEntry[] {\n        return this.buffer.slice(-count).reverse();\n    }\n}\n\n// Global singleton\nexport const logBuffer = new LogRingBuffer();\n\n/** Add a log entry */\nexport function addLog(\n    level: LogEntry[\"level\"],\n    source: LogEntry[\"source\"],\n    message: string,\n    metadata?: Record<string, unknown>\n): void {\n    logBuffer.push({\n        timestamp: new Date().toISOString(),\n        level,\n        source,\n        message,\n        metadata\n    });\n}\n\nexport interface LogMiddlewareOptions {\n    /**\n     * Paths this sink ignores, matched exactly against `c.req.path`.\n     *\n     * For requests whose only reason to exist is to read the log. Recording\n     * those makes the reader the loudest thing in its own output, and on a quiet\n     * server it is also the thing evicting real entries out of the ring.\n     */\n    ignorePaths?: string[];\n}\n\n/** Hono middleware to log API requests */\nexport function logMiddleware(options: LogMiddlewareOptions = {}): MiddlewareHandler<HonoEnv> {\n    const ignored = new Set(options.ignorePaths ?? []);\n    return async (c, next) => {\n        const start = Date.now();\n        await next();\n        if (ignored.has(c.req.path)) return;\n        const duration = Date.now() - start;\n        const reqId = c.get(\"requestId\");\n        // Every request used to be recorded at `info`, whatever it answered, so\n        // the Logs Explorer's level filter could not find a single failure: a\n        // 500 sat at the same level as the 200 above it, in a wall of them.\n        const status = c.res.status;\n        const level: LogEntry[\"level\"] = status >= 500 ? \"error\" : status >= 400 ? \"warn\" : \"info\";\n        // What the error handler answered, so the failure is on the entry\n        // rather than in a stdout line the panel cannot see. See\n        // `HonoEnv.Variables.errorSummary`.\n        const failure = c.get(\"errorSummary\");\n        addLog(\n            level,\n            \"api\",\n            `${c.req.method} ${c.req.path} ${status} ${duration}ms`\n                + (failure ? ` — ${failure.code}: ${failure.message}` : \"\"),\n            {\n                method: c.req.method,\n                path: c.req.path,\n                status,\n                duration,\n                ...(reqId && { requestId: reqId }),\n                ...(c.get(\"collection\") && { collection: c.get(\"collection\") }),\n                ...(failure && { errorCode: failure.code, errorMessage: failure.message })\n            }\n        );\n    };\n}\n\n/**\n * Prefixes the server writes at the head of a log message, and the `source`\n * each one belongs to.\n *\n * The ring's `source` is a closed set the Studio filters on, and the messages\n * carry their origin as a bracketed prefix — `[API]`, `[Auth]`, `[functions]`,\n * `[schema]`. Matching them is what makes a teed line filterable beside the\n * request entries rather than a heap under \"system\".\n */\nconst SOURCE_BY_PREFIX: Array<[RegExp, LogEntry[\"source\"]]> = [\n    [/^\\[?(api|rest)\\b/i, \"api\"],\n    [/^\\[?auth\\b/i, \"auth\"],\n    [/^\\[?(storage|s3|gcs)\\b/i, \"storage\"],\n    [/^\\[?(realtime|ws|websocket|cdc)\\b/i, \"realtime\"]\n];\n\n/**\n * The `source` for a teed line, from whatever prefix it carries.\n *\n * Exported for its test: the mapping is a string match on wording somebody else\n * writes, which is the shape of check that stops working without failing.\n */\nexport function sourceForMessage(message: string): LogEntry[\"source\"] {\n    // The level emoji comes first on several call sites (`⚠️ [API] …`), so the\n    // prefix is whatever is inside the first bracket, wherever that is.\n    const bracketed = message.match(/\\[([^\\]]{1,32})\\]/);\n    const candidate = bracketed?.[1] ?? message;\n    for (const [pattern, source] of SOURCE_BY_PREFIX) {\n        if (pattern.test(candidate)) return source;\n    }\n    return \"system\";\n}\n\n/**\n * Feed the Logs Explorer everything the server says at warn and above.\n *\n * The ring used to be filled by `logMiddleware` alone, so the panel showed a\n * wall of `GET /api/data/posts 200 4ms` and not one of the errors, warnings or\n * boot diagnoses being written to stdout at the same moment. A function that\n * threw was the sharpest case: the request entry said `500` and the reason\n * existed only in a terminal the person looking at the panel does not have.\n *\n * Warn and above, deliberately. `info` is where the steady-state chatter lives,\n * and a 10,000-entry ring filled with it evicts the lines somebody opened the\n * panel to find.\n *\n * Idempotent: called from `createLogsRoutes`, which a split deployment may\n * reach more than once.\n */\nlet detachLoggerTee: (() => void) | undefined;\nexport function teeLoggerIntoLogBuffer(): () => void {\n    if (detachLoggerTee) return detachLoggerTee;\n    const detach = addLogSink((level, message, data) => {\n        if (level !== \"warn\" && level !== \"error\") return;\n        // `requestLogger` writes this one to stdout for every request, and\n        // `logMiddleware` has already recorded the same request here with the\n        // fields this panel renders. Teeing it too would double every failure.\n        if (message === \"request\") return;\n        addLog(level, sourceForMessage(message), message, Object.keys(data).length > 0 ? data : undefined);\n    });\n    detachLoggerTee = () => {\n        detach();\n        detachLoggerTee = undefined;\n    };\n    return detachLoggerTee;\n}\n\n/**\n * How long entries accumulate before a batch goes out.\n *\n * Not zero, and that is the point. A busy server logs faster than a browser can\n * render, and one SSE frame per line would hand the client a re-render per\n * request served — worse than the 3s poll this replaces, precisely when the logs\n * are worth watching. Coalescing keeps the frame rate bounded by the window\n * rather than by traffic, and 250ms still reads as \"live\" to a person.\n */\nconst STREAM_FLUSH_MS = 250;\n\n/**\n * Idle gap after which the stream sends a comment line.\n *\n * A silent SSE connection is indistinguishable from a dead one to everything in\n * between — proxies, load balancers and laptop NICs all reap idle sockets, and a\n * server with nothing to say is the normal state here.\n */\nconst STREAM_HEARTBEAT_MS = 25_000;\n\n/**\n * Entries a single connection will hold between flushes.\n *\n * This is a *rate* ceiling, not just a memory bound, and that is easy to get\n * wrong: nothing drains `pending` between flushes, so the most a connection can\n * carry losslessly is `maxPending` per `flushMs` — here 2000 per 250ms, or 8000\n * entries a second. Above that the oldest pending entries go and the client is\n * told how many, whatever speed it is reading at.\n *\n * It was 500, which put that ceiling at 2000/s. A healthy reader on a loopback\n * socket lost 85% of a 20k burst to it — the cap fired on the server's own\n * coalescing window rather than on any slowness at the client, which is a drop\n * notice that says nothing true about why. 8000/s is past what one Node process\n * serves, so reaching it now means genuinely more log than a person can be shown.\n *\n * The memory this bounds is the copy a *stalled* reader causes: roughly 2000\n * entries, a few MB, per stuck connection.\n */\nconst STREAM_MAX_PENDING = 2000;\n\n/**\n * The largest window any of these routes will hand back.\n *\n * The ring buffer holds 10,000 entries, so asking for more than all of it is a\n * mistake worth naming rather than silently clamping — and a clamped answer is\n * indistinguishable from \"that is all there is\".\n */\nconst LOG_WINDOW_MAX = 10_000;\n\n/**\n * The stream's timings, injectable only so they can be tested.\n *\n * The defaults above are the contract and nothing in production passes this. A\n * heartbeat is a 25-second wait to observe, and a suite that cannot observe it is\n * a suite where the keepalive can rot — which surfaces as \"the tail dies after a\n * few minutes behind the load balancer\", months later, on someone else's cluster.\n */\nexport interface LogStreamTiming {\n    flushMs?: number;\n    heartbeatMs?: number;\n    maxPending?: number;\n}\n\nexport function createLogsRoutes(timing: LogStreamTiming = {}): Hono<HonoEnv> {\n    // Here rather than at module load: the ring exists whether or not anything\n    // reads it, but there is no reason to fill it on a process that serves no\n    // logs surface. Idempotent, so the repeated calls a split deployment makes\n    // do not stack up sinks.\n    teeLoggerIntoLogBuffer();\n\n    const flushMs = timing.flushMs ?? STREAM_FLUSH_MS;\n    const heartbeatMs = timing.heartbeatMs ?? STREAM_HEARTBEAT_MS;\n    const maxPending = timing.maxPending ?? STREAM_MAX_PENDING;\n\n    const app = new Hono<HonoEnv>();\n    // Its own, like every other router here: nothing registers one on the host\n    // app — not `boot.ts`, not the scaffolded backend, not the eject template —\n    // so a router that throws without this answers Hono's default 500 in plain\n    // text, outside the `{ error: { code, message } }` envelope the rest of the\n    // API keeps to.\n    app.onError(errorHandler);\n\n    /**\n     * A window into the ring buffer, or a 400 saying why not.\n     *\n     * `parseInt` was the whole of it before, and every malformed value failed\n     * differently and silently: `?limit=abc` fell through to the default,\n     * `?limit=-5` sliced an empty window and answered 200 with no entries, and\n     * `?count=abc` made `slice(-NaN)` return the *entire* buffer. Three ways to\n     * be wrong, none of them visible to the caller. The data plane refuses the\n     * same input with a 400 — see `resolveListLimitParam`.\n     */\n    const window = (raw: string | undefined, what: string, max: number): number | undefined => {\n        if (raw === undefined || raw.trim() === \"\") return undefined;\n        const parsed = Number(raw.trim());\n        if (!Number.isInteger(parsed) || parsed < 1 || parsed > max) {\n            throw new ApiError(\n                400,\n                \"INVALID_PARAM\",\n                `Invalid \\`${what}\\`: ${raw}. Expected a whole number between 1 and ${max}.`,\n                undefined,\n                true\n            );\n        }\n        return parsed;\n    };\n\n    // GET /api/logs — Query logs\n    app.get(\"/\", (c) => {\n        const query = c.req.query();\n        const result = logBuffer.query({\n            level: query.level,\n            source: query.source,\n            search: query.search,\n            limit: window(query.limit, \"limit\", LOG_WINDOW_MAX),\n            offset: window(query.offset, \"offset\", Number.MAX_SAFE_INTEGER),\n            since: query.since\n        });\n        return c.json(result);\n    });\n\n    // GET /api/logs/latest — Get latest logs (for real-time)\n    app.get(\"/latest\", (c) => {\n        const count = window(c.req.query(\"count\"), \"count\", LOG_WINDOW_MAX) ?? 50;\n        return c.json({ entries: logBuffer.getLatest(count) });\n    });\n\n    // GET /api/logs/stream — tail the buffer over SSE.\n    //\n    // The Logs Explorer used to poll this router every 3 seconds, which cost a\n    // request per client per 3s to say \"nothing happened\" and still showed each\n    // line up to 3s late. Here the buffer pushes instead, so an idle server is an\n    // idle socket.\n    //\n    // Events:\n    //   snapshot  {entries, total}   the filtered window, oldest-first, at open\n    //   append    {entries, dropped} entries since the last frame, oldest-first\n    //   `: ping`                     comment, keepalive only\n    //\n    // Snapshot and appends come down the same connection deliberately. A client\n    // that fetched its backlog separately would race the subscription — entries\n    // logged between the two calls belong to neither — and closing that race from\n    // the outside needs an id cursor and dedupe on every frame.\n    app.get(\"/stream\", (c) => {\n        const query = c.req.query();\n        const filter = normalizeFilter({\n            level: query.level,\n            source: query.source,\n            search: query.search\n        });\n        const limit = window(query.limit, \"limit\", LOG_WINDOW_MAX) ?? 200;\n\n        // Reverse proxies buffer text responses by default, which turns a live\n        // tail into nothing at all until the buffer fills. nginx (and the ingress\n        // in front of the managed runtime) reads this header; everything else\n        // ignores it. The rest of the SSE headers are set by `streamSSE`.\n        c.header(\"X-Accel-Buffering\", \"no\");\n\n        return streamSSE(c, async (stream) => {\n            let pending: LogEntry[] = [];\n            let dropped = 0;\n\n            // Subscribe *before* reading the backlog, with nothing awaited\n            // between the two. Both are synchronous, so the two halves meet\n            // exactly: an entry logged after the query but before the\n            // subscription would otherwise be in neither, and that gap is the one\n            // thing this route exists to close.\n            const unsubscribe = logBuffer.subscribe(entry => {\n                if (!matchesFilter(entry, filter)) return;\n                if (pending.length >= maxPending) {\n                    pending.shift();\n                    dropped++;\n                }\n                pending.push(entry);\n            });\n            const snapshot = logBuffer.query({ ...filter,\n                limit });\n\n            // A client that goes away has to end this handler, or the\n            // subscription outlives the socket. `streamSSE` only wires the\n            // request signal through on old Bun, so do it here and let\n            // `stream.aborted` be the one condition the loop tests.\n            //\n            // The `aborted` check is not belt-and-braces. A listener added to an\n            // already-aborted signal is never called, so a client that leaves\n            // during the snapshot write — a fast navigation, or a reconnect storm\n            // against a restarting server — would leave this handler with no way\n            // to learn it had gone: a subscriber and a flush loop, per attempt,\n            // for the life of the process.\n            const abortOnDisconnect = () => {\n                if (!stream.closed) stream.abort();\n            };\n            c.req.raw.signal.addEventListener(\"abort\", abortOnDisconnect, { once: true });\n            if (c.req.raw.signal.aborted) abortOnDisconnect();\n\n            try {\n                await stream.writeSSE({\n                    event: \"snapshot\",\n                    // The view tails like a terminal; both frames are oldest-first\n                    // so the client only ever appends.\n                    data: JSON.stringify({\n                        entries: snapshot.entries.slice().reverse(),\n                        total: snapshot.total\n                    })\n                });\n\n                let idleMs = 0;\n                while (!stream.aborted && !stream.closed) {\n                    await stream.sleep(flushMs);\n                    if (stream.aborted || stream.closed) break;\n\n                    if (pending.length === 0) {\n                        idleMs += flushMs;\n                        if (idleMs >= heartbeatMs) {\n                            await stream.write(\": ping\\n\\n\");\n                            idleMs = 0;\n                        }\n                        continue;\n                    }\n\n                    const entries = pending;\n                    const lost = dropped;\n                    pending = [];\n                    dropped = 0;\n                    idleMs = 0;\n                    await stream.writeSSE({\n                        event: \"append\",\n                        data: JSON.stringify(lost > 0 ? { entries,\n                            dropped: lost } : { entries })\n                    });\n                }\n            } finally {\n                unsubscribe();\n                c.req.raw.signal.removeEventListener(\"abort\", abortOnDisconnect);\n            }\n        });\n    });\n\n    return app;\n}\n\nexport default createLogsRoutes();\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAiCA,SAAS,gBAAgB,SAA6C;CAClE,OAAO;EAAE,GAAG;EACR,QAAQ,QAAQ,QAAQ,YAAY;CAAE;AAC9C;;;;;;;;AASA,SAAS,cAAc,OAAiB,QAAmC;CACvE,IAAI,OAAO,SAAS,MAAM,UAAU,OAAO,OAAO,OAAO;CACzD,IAAI,OAAO,UAAU,MAAM,WAAW,OAAO,QAAQ,OAAO;CAC5D,IAAI,OAAO,UAAU,CAAC,MAAM,QAAQ,YAAY,CAAC,CAAC,SAAS,OAAO,MAAM,GAAG,OAAO;CAClF,IAAI,OAAO,SAAS,MAAM,YAAY,OAAO,OAAO,OAAO;CAC3D,OAAO;AACX;AAKA,IAAM,gBAAN,MAAoB;CAChB,SAA6B,CAAC;CAC9B;CACA,YAAoB;CACpB,4BAAoB,IAAI,IAAiB;CAEzC,YAAY,UAAU,KAAO;EACzB,KAAK,UAAU;CACnB;CAEA,KAAK,OAAmC;EACpC,MAAM,KAAK,OAAO,EAAE,KAAK;EACzB,MAAM,SAAmB;GAAE,GAAG;GAC1B;EAAG;EACP,KAAK,OAAO,KAAK,MAAM;EACvB,IAAI,KAAK,OAAO,SAAS,KAAK,SAC1B,KAAK,OAAO,MAAM;EAKtB,KAAK,MAAM,YAAY,KAAK,WACxB,IAAI;GACA,SAAS,MAAM;EACnB,QAAQ,CAER;CAER;;;;;;;;;CAUA,UAAU,UAAmC;EACzC,KAAK,UAAU,IAAI,QAAQ;EAC3B,aAAa;GACT,KAAK,UAAU,OAAO,QAAQ;EAClC;CACJ;CAEA,MAAM,SAGqC;EACvC,MAAM,SAAS,gBAAgB,OAAO;EAItC,MAAM,SAAS,CAAC,GAHC,KAAK,OAAO,QAAO,MAAK,cAAc,GAAG,MAAM,CAG7C,CAAQ,CAAC,CAAC,QAAQ;EACrC,MAAM,QAAQ,OAAO;EACrB,MAAM,QAAQ,QAAQ,SAAS;EAC/B,MAAM,SAAS,QAAQ,UAAU;EAEjC,OAAO;GACH,SAAS,OAAO,MAAM,QAAQ,SAAS,KAAK;GAC5C;EACJ;CACJ;CAEA,UAAU,QAAQ,IAAgB;EAC9B,OAAO,KAAK,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ;CAC7C;AACJ;AAGA,IAAa,YAAY,IAAI,cAAc;;AAG3C,SAAgB,OACZ,OACA,QACA,SACA,UACI;CACJ,UAAU,KAAK;EACX,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;EAClC;EACA;EACA;EACA;CACJ,CAAC;AACL;;AAcA,SAAgB,cAAc,UAAgC,CAAC,GAA+B;CAC1F,MAAM,UAAU,IAAI,IAAI,QAAQ,eAAe,CAAC,CAAC;CACjD,OAAO,OAAO,GAAG,SAAS;EACtB,MAAM,QAAQ,KAAK,IAAI;EACvB,MAAM,KAAK;EACX,IAAI,QAAQ,IAAI,EAAE,IAAI,IAAI,GAAG;EAC7B,MAAM,WAAW,KAAK,IAAI,IAAI;EAC9B,MAAM,QAAQ,EAAE,IAAI,WAAW;EAI/B,MAAM,SAAS,EAAE,IAAI;EACrB,MAAM,QAA2B,UAAU,MAAM,UAAU,UAAU,MAAM,SAAS;EAIpF,MAAM,UAAU,EAAE,IAAI,cAAc;EACpC,OACI,OACA,OACA,GAAG,EAAE,IAAI,OAAO,GAAG,EAAE,IAAI,KAAK,GAAG,OAAO,GAAG,SAAS,OAC7C,UAAU,MAAM,QAAQ,KAAK,IAAI,QAAQ,YAAY,KAC5D;GACI,QAAQ,EAAE,IAAI;GACd,MAAM,EAAE,IAAI;GACZ;GACA;GACA,GAAI,SAAS,EAAE,WAAW,MAAM;GAChC,GAAI,EAAE,IAAI,YAAY,KAAK,EAAE,YAAY,EAAE,IAAI,YAAY,EAAE;GAC7D,GAAI,WAAW;IAAE,WAAW,QAAQ;IAAM,cAAc,QAAQ;GAAQ;EAC5E,CACJ;CACJ;AACJ;;;;;;;;;;AAWA,IAAM,mBAAwD;CAC1D,CAAC,qBAAqB,KAAK;CAC3B,CAAC,eAAe,MAAM;CACtB,CAAC,2BAA2B,SAAS;CACrC,CAAC,sCAAsC,UAAU;AACrD;;;;;;;AAQA,SAAgB,iBAAiB,SAAqC;CAIlE,MAAM,YADY,QAAQ,MAAM,mBACd,CAAA,GAAY,MAAM;CACpC,KAAK,MAAM,CAAC,SAAS,WAAW,kBAC5B,IAAI,QAAQ,KAAK,SAAS,GAAG,OAAO;CAExC,OAAO;AACX;;;;;;;;;;;;;;;;;AAkBA,IAAI;AACJ,SAAgB,yBAAqC;CACjD,IAAI,iBAAiB,OAAO;CAC5B,MAAM,SAAS,YAAY,OAAO,SAAS,SAAS;EAChD,IAAI,UAAU,UAAU,UAAU,SAAS;EAI3C,IAAI,YAAY,WAAW;EAC3B,OAAO,OAAO,iBAAiB,OAAO,GAAG,SAAS,OAAO,KAAK,IAAI,CAAC,CAAC,SAAS,IAAI,OAAO,KAAA,CAAS;CACrG,CAAC;CACD,wBAAwB;EACpB,OAAO;EACP,kBAAkB,KAAA;CACtB;CACA,OAAO;AACX;;;;;;;;;;AAWA,IAAM,kBAAkB;;;;;;;;AASxB,IAAM,sBAAsB;;;;;;;;;;;;;;;;;;;AAoB5B,IAAM,qBAAqB;;;;;;;;AAS3B,IAAM,iBAAiB;AAgBvB,SAAgB,iBAAiB,SAA0B,CAAC,GAAkB;CAK1E,uBAAuB;CAEvB,MAAM,UAAU,OAAO,WAAW;CAClC,MAAM,cAAc,OAAO,eAAe;CAC1C,MAAM,aAAa,OAAO,cAAc;CAExC,MAAM,MAAM,IAAI,KAAc;CAM9B,IAAI,QAAQ,YAAY;;;;;;;;;;;CAYxB,MAAM,UAAU,KAAyB,MAAc,QAAoC;EACvF,IAAI,QAAQ,KAAA,KAAa,IAAI,KAAK,MAAM,IAAI,OAAO,KAAA;EACnD,MAAM,SAAS,OAAO,IAAI,KAAK,CAAC;EAChC,IAAI,CAAC,OAAO,UAAU,MAAM,KAAK,SAAS,KAAK,SAAS,KACpD,MAAM,IAAI,SACN,KACA,iBACA,aAAa,KAAK,MAAM,IAAI,0CAA0C,IAAI,IAC1E,KAAA,GACA,IACJ;EAEJ,OAAO;CACX;CAGA,IAAI,IAAI,MAAM,MAAM;EAChB,MAAM,QAAQ,EAAE,IAAI,MAAM;EAC1B,MAAM,SAAS,UAAU,MAAM;GAC3B,OAAO,MAAM;GACb,QAAQ,MAAM;GACd,QAAQ,MAAM;GACd,OAAO,OAAO,MAAM,OAAO,SAAS,cAAc;GAClD,QAAQ,OAAO,MAAM,QAAQ,UAAU,OAAO,gBAAgB;GAC9D,OAAO,MAAM;EACjB,CAAC;EACD,OAAO,EAAE,KAAK,MAAM;CACxB,CAAC;CAGD,IAAI,IAAI,YAAY,MAAM;EACtB,MAAM,QAAQ,OAAO,EAAE,IAAI,MAAM,OAAO,GAAG,SAAS,cAAc,KAAK;EACvE,OAAO,EAAE,KAAK,EAAE,SAAS,UAAU,UAAU,KAAK,EAAE,CAAC;CACzD,CAAC;CAkBD,IAAI,IAAI,YAAY,MAAM;EACtB,MAAM,QAAQ,EAAE,IAAI,MAAM;EAC1B,MAAM,SAAS,gBAAgB;GAC3B,OAAO,MAAM;GACb,QAAQ,MAAM;GACd,QAAQ,MAAM;EAClB,CAAC;EACD,MAAM,QAAQ,OAAO,MAAM,OAAO,SAAS,cAAc,KAAK;EAM9D,EAAE,OAAO,qBAAqB,IAAI;EAElC,OAAO,UAAU,GAAG,OAAO,WAAW;GAClC,IAAI,UAAsB,CAAC;GAC3B,IAAI,UAAU;GAOd,MAAM,cAAc,UAAU,WAAU,UAAS;IAC7C,IAAI,CAAC,cAAc,OAAO,MAAM,GAAG;IACnC,IAAI,QAAQ,UAAU,YAAY;KAC9B,QAAQ,MAAM;KACd;IACJ;IACA,QAAQ,KAAK,KAAK;GACtB,CAAC;GACD,MAAM,WAAW,UAAU,MAAM;IAAE,GAAG;IAClC;GAAM,CAAC;GAaX,MAAM,0BAA0B;IAC5B,IAAI,CAAC,OAAO,QAAQ,OAAO,MAAM;GACrC;GACA,EAAE,IAAI,IAAI,OAAO,iBAAiB,SAAS,mBAAmB,EAAE,MAAM,KAAK,CAAC;GAC5E,IAAI,EAAE,IAAI,IAAI,OAAO,SAAS,kBAAkB;GAEhD,IAAI;IACA,MAAM,OAAO,SAAS;KAClB,OAAO;KAGP,MAAM,KAAK,UAAU;MACjB,SAAS,SAAS,QAAQ,MAAM,CAAC,CAAC,QAAQ;MAC1C,OAAO,SAAS;KACpB,CAAC;IACL,CAAC;IAED,IAAI,SAAS;IACb,OAAO,CAAC,OAAO,WAAW,CAAC,OAAO,QAAQ;KACtC,MAAM,OAAO,MAAM,OAAO;KAC1B,IAAI,OAAO,WAAW,OAAO,QAAQ;KAErC,IAAI,QAAQ,WAAW,GAAG;MACtB,UAAU;MACV,IAAI,UAAU,aAAa;OACvB,MAAM,OAAO,MAAM,YAAY;OAC/B,SAAS;MACb;MACA;KACJ;KAEA,MAAM,UAAU;KAChB,MAAM,OAAO;KACb,UAAU,CAAC;KACX,UAAU;KACV,SAAS;KACT,MAAM,OAAO,SAAS;MAClB,OAAO;MACP,MAAM,KAAK,UAAU,OAAO,IAAI;OAAE;OAC9B,SAAS;MAAK,IAAI,EAAE,QAAQ,CAAC;KACrC,CAAC;IACL;GACJ,UAAU;IACN,YAAY;IACZ,EAAE,IAAI,IAAI,OAAO,oBAAoB,SAAS,iBAAiB;GACnE;EACJ,CAAC;CACL,CAAC;CAED,OAAO;AACX;AAEA,IAAA,sBAAe,iBAAiB"}

package/dist/{openapi-generator-CpZp2Fai.js → openapi-generator-BIBbO1Tq.js}

@@ -2,8 +2,8 @@ import { createRequire as __rebaseCreateRequire } from "module";
 import __rebaseProcess from "process";
 globalThis.process ??= __rebaseProcess;
 __rebaseCreateRequire(import.meta.url);
-import { y as resolveCollectionRelations } from "./src-C9gKj23J.js";
-import "./src-CcOl05Oq.js";
+import { S as resolveCollectionRelations, v as fieldKeyForColumn, x as isRelationRequired, y as findRelation } from "./src-Dq-I3Ybx.js";
+import "./src-DHK4fHkw.js";
 //#region ../types/src/types/relations.ts
 /** @group Models */
 function isToMany(relation) {
@@ -203,6 +203,7 @@ function generateOpenApiSpec(collections, options = {}) {
 	const schemas = spec.components.schemas;
 	const tags = spec.tags;
 	const reservedParameterNames = new Set(listQueryParameters().map((p) => p.name));
+	const registeredSchemas = new Set((collections || []).map(schemaNameFor));
 	for (const collection of collections || []) {
 		const schemaName = schemaNameFor(collection);
 		const slug = collection.slug;
@@ -210,7 +211,7 @@ function generateOpenApiSpec(collections, options = {}) {
 			name: collection.name,
 			description: collection.description || `CRUD operations for ${collection.name}`
 		});
-		schemas[schemaName] = buildCollectionSchema(collection);
+		schemas[schemaName] = buildCollectionSchema(collection, registeredSchemas);
 		schemas[`${schemaName}Input`] = buildCollectionInputSchema(collection);
 		schemas[`${schemaName}Update`] = buildCollectionUpdateSchema(collection);
 		const dataPath = `/data/${slug}`;
@@ -569,46 +570,186 @@ function generateOpenApiSpec(collections, options = {}) {
 /**
 * Is this property part of the shape the document may describe?
 *
-* Two exclusions, and both are the document telling the truth about what the
-* server does:
+* One exclusion, and it is the document telling the truth about what the server
+* does: `excludeFromApi` is a server-side guarantee that the column "is
+* stripped from every row the API serves, for every caller, including admins
+* and service keys" — `stripExcluded` in the row pipeline enforces it. A schema
+* that lists such a column describes a field that is never present, and it
+* describes it to everyone: `/docs` is mounted on the app, not on the data
+* router, so it carries none of the auth middleware `{basePath}/data` does.
+* Every project scaffolded by `rebase init` published its `users` collection's
+* `passwordHash` and `emailVerificationToken` this way.
 *
-* - a `relation` property is virtual: the row carries the owning side's foreign
-*   key column, never the property itself, so it is not a field of any payload.
-*   (The FK column *is* readable, writable and filterable and is still absent
-*   from every schema here — a separate gap, not this rule.)
-* - `excludeFromApi` is a server-side guarantee that the column "is stripped
-*   from every row the API serves, for every caller, including admins and
-*   service keys" — `stripExcluded` in the row pipeline enforces it. A schema
-*   that lists such a column describes a field that is never present, and it
-*   describes it to everyone: `/docs` is mounted on the app, not on the data
-*   router, so it carries none of the auth middleware `{basePath}/data` does.
-*   Every project scaffolded by `rebase init` published its `users`
-*   collection's `passwordHash` and `emailVerificationToken` this way.
+* A `relation` property used to be excluded here too, on the reasoning that the
+* property is virtual. It is — but the row is not empty where it stands: the
+* owning side carries a foreign key under a *wire* name (`authorId`), and a
+* read that includes the relation carries the target's row under the relation's
+* own name. Excluding both left `/api/docs` describing a strictly smaller
+* collection than `generated/sdk/database.types.ts` did for the same config.
+* Relations are now emitted by {@link emitRelationProperties}, under the same
+* keys and in the same order as the SDK's `Row`; the direct-property loops skip
+* them so the two passes cannot emit one key twice.
 *
-* Written as one predicate rather than three `continue`s because it kept being
-* fixed in one loop at a time: this is the same rule the SDK generator applies
-* to its `Row` type (`packages/codegen/src/generate-types.ts`).
+* Written as one predicate rather than a `continue` per loop because it kept
+* being fixed in one loop at a time: this is the same rule the SDK generator
+* applies to its `Row` type (`packages/codegen/src/generate-types.ts`).
 */
 function isDocumentedProperty(property) {
-	return property.type !== "relation" && !property.excludeFromApi;
+	return !property.excludeFromApi;
+}
+/**
+* The keys `stripExcluded` deletes: the property name *and* its column name.
+*
+* Seeding the emitted set with both is what stops a foreign key derived from a
+* relation putting an `excludeFromApi` column back on the surface under its
+* other name. Same pair, same reason, as `excludedApiKeys` in the SDK
+* generator.
+*/
+function excludedApiKeys(collection) {
+	const excluded = /* @__PURE__ */ new Set();
+	for (const [key, property] of Object.entries(collection.properties ?? {})) {
+		if (!property?.excludeFromApi) continue;
+		excluded.add(key);
+		const columnName = property.columnName;
+		if (typeof columnName === "string") excluded.add(columnName);
+	}
+	return excluded;
+}
+/**
+* The collection's primary key, as the key it is addressed by on the wire and
+* the property that declares it.
+*
+* `id` was a literal in three places — seeded before the read loop, assigned
+* after the input loop, inherited by the update schema from the input one — and
+* the two spellings disagreed: a declared `id: { type: "number" }` overwrote
+* the read seed and was overwritten by the input assignment, so the same field
+* was `integer` in `Post` and `string` in `PostInput`. One helper now answers
+* the question for all three.
+*/
+function idPropertyEntry(collection) {
+	for (const [key, property] of Object.entries(collection?.properties ?? {})) if (property?.isId) return [key, property];
+}
+/**
+* The schema of a primary key or of a foreign key pointing at one: the declared
+* property's own type, stripped of the field-level facts (description,
+* validation bounds) that belong to the column and not to a reference to it.
+*
+* Falls back to `string` for a collection that declares no primary key, which
+* is what every schema here assumed unconditionally before.
+*/
+function idSchemaFor(collection) {
+	const declared = idPropertyEntry(collection);
+	if (!declared) return { type: "string" };
+	const converted = convertPropertyToSchema(declared[1]);
+	const schema = { type: converted.type ?? "string" };
+	if (converted.format) schema.format = converted.format;
+	return schema;
+}
+/**
+* Relations resolve or they do not; a document is still owed for a collection
+* whose target thunk throws (a circular import, usually). The SDK generator
+* warns and carries on with no relation fields, and so does this — the
+* alternative is `/api/docs` 500ing for the whole project.
+*/
+function resolveRelationsForDocument(collection) {
+	try {
+		return resolveCollectionRelations(collection);
+	} catch {
+		return {};
+	}
+}
+/** Unwrap a target handed back as a module namespace — `() => import("./authors")`. */
+function relationTarget(relation) {
+	try {
+		let target = relation.target();
+		if (target && (target.default || target.__esModule)) target = target.default ?? target;
+		return target;
+	} catch {
+		return;
+	}
+}
+/**
+* The schema an *included* relation arrives as: the target's own row.
+*
+* `$ref` when the target is one of the collections this document describes, and
+* an open object when it is not — a dangling pointer makes Swagger UI render an
+* empty model and makes a strict generator abort, which is worse than a vague
+* one.
+*/
+function includedRelationSchema(relation, registeredSchemas) {
+	const target = relationTarget(relation);
+	const targetSchema = target ? schemaNameFor(target) : void 0;
+	const item = targetSchema && registeredSchemas.has(targetSchema) ? { $ref: `#/components/schemas/${targetSchema}` } : { type: "object" };
+	return relation.cardinality === "many" ? {
+		type: "array",
+		items: item
+	} : item;
+}
+/**
+* Emit a collection's relations onto a read schema: the foreign keys first,
+* then the relations themselves.
+*
+* The order and the keys are the SDK `Row`'s, deliberately — the parity test
+* next door compares the two key sets, and the only way that stays true is for
+* both to be derived the same way rather than kept in step by hand.
+*
+* A `belongsTo` reaches the wire under the *field* name of its local column
+* (`author_id` → `authorId`), which is what `fieldKeyForColumn` answers; a
+* relation addressed by the same name as its own foreign key is served as
+* either the scalar or the nested row depending on `include`, so it is
+* documented as both.
+*/
+function emitRelationProperties(collection, properties, required, emitted, registeredSchemas) {
+	const resolved = resolveRelationsForDocument(collection);
+	for (const [relationKey, relation] of Object.entries(resolved)) {
+		if (relation.kind !== "belongsTo" || !relation.localKey) continue;
+		const fieldKey = fieldKeyForColumn(collection, relation.localKey);
+		if (emitted.has(fieldKey)) continue;
+		const foreignKey = idSchemaFor(relationTarget(relation));
+		const shadowedByInclude = relationKey === fieldKey;
+		properties[fieldKey] = shadowedByInclude ? { oneOf: [foreignKey, includedRelationSchema(relation, registeredSchemas)] } : {
+			...foreignKey,
+			description: `Foreign key into \`${relation.targetSlug}\``
+		};
+		emitted.add(fieldKey);
+		if (isRelationRequired(collection, relation) && !shadowedByInclude) required.push(fieldKey);
+	}
+	for (const [key, relation] of Object.entries(resolved)) {
+		if (emitted.has(key)) continue;
+		properties[key] = includedRelationSchema(relation, registeredSchemas);
+		emitted.add(key);
+	}
+	for (const [key, property] of Object.entries(collection.properties ?? {})) {
+		if (property?.type !== "relation") continue;
+		if (emitted.has(key)) continue;
+		properties[key] = { type: "object" };
+		emitted.add(key);
+	}
 }
 /**
 * Build the component schema for a collection (output / read shape).
 *
 * Every declared property except the ones {@link isDocumentedProperty} rules
-* out.
+* out, plus the foreign keys and relations {@link emitRelationProperties} adds.
 */
-function buildCollectionSchema(collection) {
-	const properties = { id: {
-		type: "string",
+function buildCollectionSchema(collection, registeredSchemas) {
+	const idKey = idPropertyEntry(collection)?.[0] ?? "id";
+	const properties = { [idKey]: {
+		...idSchemaFor(collection),
 		description: "Unique identifier"
 	} };
-	const required = ["id"];
+	const required = [idKey];
+	const excluded = excludedApiKeys(collection);
+	const emitted = new Set(excluded);
+	emitted.add(idKey);
 	for (const [key, property] of Object.entries(collection.properties)) {
+		if (property.type === "relation") continue;
 		if (!isDocumentedProperty(property)) continue;
 		properties[key] = convertPropertyToSchema(property);
-		if (property.validation?.required) required.push(key);
+		emitted.add(key);
+		if (property.validation?.required && key !== idKey) required.push(key);
 	}
+	emitRelationProperties(collection, properties, required, emitted, registeredSchemas);
 	return {
 		type: "object",
 		required: required.length > 0 ? required : void 0,
@@ -670,26 +811,35 @@ function buildCollectionUpdateSchema(collection) {
 /**
 * Build an input schema (for POST/PUT) — excludes auto-generated fields.
 *
-* `excludeFromApi` columns are left out too, though a write naming one is still
-* accepted: a create the document invites and whose result it then cannot show
-* is not a round trip anyone can verify, and naming the column here discloses
-* it just as loudly as the read schema does — this document is served
-* unauthenticated.
+* `excludeFromApi` columns are left out too, and the server now agrees: a write
+* naming one is refused (`write-validation.ts`), which is what the flag's name
+* and the generated SDK's own documentation always said. This comment used to
+* record that such a write was "still accepted" — the document was right and
+* the server was the thing that had not caught up.
 */
 function buildCollectionInputSchema(collection) {
 	const properties = {};
 	const required = [];
+	const excluded = excludedApiKeys(collection);
+	const emitted = new Set(excluded);
+	const idKey = idPropertyEntry(collection)?.[0] ?? "id";
 	for (const [key, property] of Object.entries(collection.properties)) {
+		if (property.type === "relation") continue;
 		if (!isDocumentedProperty(property)) continue;
 		if (property.type === "date" && property.autoValue) continue;
 		if ("isId" in property && property.isId && property.isId !== "manual" && property.isId !== true) continue;
 		properties[key] = convertPropertyToSchema(property);
+		emitted.add(key);
 		if (property.validation?.required) required.push(key);
 	}
-	properties["id"] = {
-		type: "string",
-		description: "Optional: client-assigned ID. If omitted, the server generates one."
-	};
+	if (!emitted.has(idKey)) {
+		properties[idKey] = {
+			...idSchemaFor(collection),
+			description: "Optional: client-assigned ID. If omitted, the server generates one."
+		};
+		emitted.add(idKey);
+	}
+	emitWritableRelations(collection, properties, emitted);
 	return {
 		type: "object",
 		required: required.length > 0 ? required : void 0,
@@ -697,6 +847,38 @@ function buildCollectionInputSchema(collection) {
 	};
 }
 /**
+* The writable half of a collection's relations: `belongsTo` only.
+*
+* A to-many is not writable through the body — the server links rows through
+* the nested routes — so offering `tags: [...]` on a create would describe a
+* write that does nothing. Same rule, same reason, as `emitWritableRelations`
+* in the SDK generator, whose `Insert` type this mirrors key for key.
+*
+* Neither spelling is listed in `required`, even for a relation the collection
+* declares `validation: { required: true }` on: the two keys are alternatives,
+* and a schema naming both would tell a spec-validating gateway to reject a
+* create that the server accepts. (The SDK's `Insert` marks both non-optional
+* for the same relation, which is the same fact stated less carefully; a
+* document is the half that a gateway enforces.)
+*/
+function emitWritableRelations(collection, properties, emitted) {
+	const resolved = resolveRelationsForDocument(collection);
+	const emit = (key, relation) => {
+		if (emitted.has(key)) return;
+		properties[key] = {
+			...idSchemaFor(relationTarget(relation)),
+			description: `The \`${relation.targetSlug}\` row this belongs to.`
+		};
+		emitted.add(key);
+	};
+	for (const relation of Object.values(resolved)) if (relation.kind === "belongsTo" && relation.localKey) emit(fieldKeyForColumn(collection, relation.localKey), relation);
+	for (const [key, property] of Object.entries(collection.properties ?? {})) {
+		if (property?.type !== "relation") continue;
+		const relation = findRelation(resolved, key);
+		if (relation?.kind === "belongsTo" && relation.localKey) emit(key, relation);
+	}
+}
+/**
 * Convert a Rebase Property to an OpenAPI 3.0 schema object.
 */
 function convertPropertyToSchema(property) {
@@ -726,7 +908,7 @@ function convertPropertyToSchema(property) {
 		}
 		case "number": {
 			const np = property;
-			base.type = np.validation?.integer || np.columnType === "integer" || np.columnType === "serial" || np.columnType === "bigserial" || np.columnType === "bigint" ? "integer" : "number";
+			base.type = np.validation?.integer || Boolean(np.isId) || np.columnType === "integer" || np.columnType === "serial" || np.columnType === "bigserial" || np.columnType === "bigint" ? "integer" : "number";
 			if (np.enum) {
 				const enumValues = resolveEnumValues(np.enum);
 				if (enumValues.length > 0) base.enum = enumValues;
@@ -851,6 +1033,7 @@ function buildFilterParameters(collection, reservedNames = /* @__PURE__ */ new S
 	const params = [];
 	for (const [key, property] of Object.entries(collection.properties)) {
 		if (!isDocumentedProperty(property)) continue;
+		if (property.type === "relation") continue;
 		if (property.type === "map" || property.type === "array" || property.type === "geopoint") continue;
 		if (reservedNames.has(key)) continue;
 		params.push({
@@ -923,4 +1106,4 @@ function toPascalCase(str) {
 //#endregion
 export { generateOpenApiSpec };
 
-//# sourceMappingURL=openapi-generator-CpZp2Fai.js.map
+//# sourceMappingURL=openapi-generator-BIBbO1Tq.js.map