@rebasepro/server 0.22.0 → 0.24.0

package/dist/mcp/mcp-tools.d.ts

@@ -16,36 +16,48 @@
  *  - A write can fail with a permission error the tool cannot explain in
  *    detail, because the policy that refused it is not visible from here.
  *
- * `mcp:write` gates whether the mutating tools are *offered* at all. It is a
- * second lock, not the main one — a `mcp:write` token still cannot write a row
- * the user could not write themselves.
+ * The scopes gate which tools are *offered* and which collections each
+ * reaches — `data:write:posts` offers the write tools for `posts` alone. That
+ * is a second lock, not the main one: a `data:write` token still cannot write
+ * a row the user could not write themselves.
  */
-import type { CollectionConfig, DataDriver } from "@rebasepro/types";
+import type { AuthAdapter, CollectionConfig, DataDriver } from "@rebasepro/types";
+import type { McpScope } from "./oauth-metadata.js";
 /** The identity a tool call runs as. Comes from the verified access token. */
 export interface McpCaller {
     uid: string;
     roles: string[];
-    scope: string;
+    /** The scopes granted to this connection — `data:read`, `data:write:posts`, … */
+    scopes: string[];
     clientId: string;
 }
 export interface McpToolContext {
     driver: DataDriver;
     collections: CollectionConfig[];
     caller: McpCaller;
+    /**
+     * The deployment's auth adapter. The auth collection's rows are the users,
+     * so the write tools hand a write to one to it, as REST and `/admin/users`
+     * do. See `api/rest/auth-collection-writes.ts`.
+     */
+    authAdapter?: AuthAdapter;
 }
 export interface McpToolDefinition {
     name: string;
     description: string;
     inputSchema: Record<string, unknown>;
-    /** The scope a caller must hold for this tool to be listed or callable. */
-    requiredScope: "mcp:read" | "mcp:write";
+    /**
+     * The scope a caller must hold — on at least one collection for the tool
+     * to be listed, and on the collection a call names for it to run.
+     */
+    requiredScope: McpScope;
     run(args: Record<string, unknown>, ctx: McpToolContext): Promise<unknown>;
 }
 /** An error whose message is safe to hand back to the model. */
 export declare class McpToolError extends Error {
 }
 export declare const MCP_TOOLS: McpToolDefinition[];
-/** The tools a caller holding `scope` may see and call. */
-export declare function toolsForScope(scope: string): McpToolDefinition[];
+/** The tools a caller holding `scopes` may see and call: each needs its scope on at least one collection. */
+export declare function toolsForScopes(scopes: readonly string[]): McpToolDefinition[];
 /** Look up a tool by name, honouring scope — an unlisted tool is not callable. */
-export declare function findTool(name: string, scope: string): McpToolDefinition | undefined;
+export declare function findTool(name: string, scopes: readonly string[]): McpToolDefinition | undefined;

package/dist/mcp/oauth-metadata.d.ts

@@ -1,20 +1,24 @@
 /**
- * What a token may do at `/mcp`.
+ * What a token may do at `/mcp`: the data-plane scopes its tools need, in the
+ * vocabulary every other credential uses — `data:read`, `data:write`,
+ * `data:delete` — each narrowable to one collection (`data:read:posts`).
  *
- * Two, and no more. RFC 9728 asks `scopes_supported` to be the minimal set that
- * makes the resource usable, and the MCP specification's scope-minimization
- * guidance points the same way: a client that only needs to read should be able
- * to ask for exactly that, and a consent screen listing eleven fine-grained
- * permissions is one nobody reads.
- *
- * They are not a substitute for RLS. A `mcp:read` token still reads through the
- * user's own policies — the scope decides whether the tool exists for this
- * session, the database decides which rows come back.
+ * They are not a substitute for RLS. A `data:read` token still reads through
+ * the user's own policies — the scope decides whether a tool exists for this
+ * session and which collections it reaches; the database decides which rows
+ * come back.
  */
-export declare const MCP_SCOPES: readonly ["mcp:read", "mcp:write"];
+export declare const MCP_SCOPES: readonly ["data:read", "data:write", "data:delete"];
 export type McpScope = (typeof MCP_SCOPES)[number];
 /** The scope a client gets when it asks for nothing in particular. */
-export declare const DEFAULT_MCP_SCOPE = "mcp:read";
+export declare const DEFAULT_MCP_SCOPE = "data:read";
+/**
+ * A scope string as granted before `/mcp` spoke the shared vocabulary, read as
+ * what it granted: `mcp:read` was every read, `mcp:write` every create, change
+ * and delete. Applied to stored refresh grants and to access tokens still in
+ * flight, so a connection made before the change keeps exactly its reach.
+ */
+export declare function upgradeStoredMcpScope(scope: string): string;
 /**
  * The canonical resource identifier for this server's MCP endpoint.
  *
@@ -93,12 +97,13 @@ export declare function redirectUriAllowed(candidate: string, registered: string
  *
  * An unknown scope is dropped rather than refused. RFC 6749 §3.3 allows either,
  * and dropping is what keeps a client that asks for `openid profile email` out
- * of habit from failing to connect at all — it gets the MCP scopes it is
- * entitled to and none of the ones it invented.
+ * of habit from failing to connect at all — it gets the data scopes it is
+ * entitled to and none of the ones it invented. A collection target is kept:
+ * `data:read:posts` is a narrower grant, never a wider one.
  */
 export declare function narrowScope(requested: string | undefined | null): string;
-/** Does a granted scope string carry this permission? */
-export declare function scopeAllows(scope: string, needed: McpScope): boolean;
+/** A granted scope string as the list of scopes it holds. */
+export declare function scopeList(scope: string): string[];
 /**
  * The `WWW-Authenticate` value for an unauthenticated request.
  *

package/dist/mcp/oauth-routes.d.ts

@@ -25,6 +25,7 @@
  */
 import { Hono } from "hono";
 import type { HonoEnv } from "../api/types.js";
+import type { AuthRepository } from "../auth/interfaces.js";
 import type { OAuthStore } from "./oauth-store.js";
 export interface OAuthRoutesConfig {
     store: OAuthStore;
@@ -36,7 +37,33 @@ export interface OAuthRoutesConfig {
     authBasePath: string;
     /** Whether open registration is permitted. */
     allowDynamicRegistration: boolean;
+    /**
+     * Who a grant's user is now. Absent when the auth adapter exposes no user
+     * repository, and then a grant carries the roles it was consented with.
+     */
+    identity?: McpGrantIdentity;
 }
+/**
+ * The account a grant acts for, read where a grant is issued or renewed.
+ *
+ * A refresh has no session to re-read anything from, so without this a grant
+ * is a snapshot of the moment of consent: the roles it was given, for an
+ * account that may since have been demoted, signed out everywhere, or deleted.
+ */
+export interface McpGrantIdentity {
+    /** The account's roles as they are now, or null when it no longer exists. */
+    currentRoles(uid: string): Promise<string[] | null>;
+    /** Where "sign out everywhere" and every password change leave their mark. */
+    revocation?: Pick<AuthRepository, "getTokensValidAfter">;
+}
+/**
+ * The grant identity the auth repository can answer, or undefined when the
+ * adapter exposes no repository that can say whether an account exists.
+ *
+ * The same repository the admin gate re-reads roles and the revocation
+ * watermark from, so a grant is held to what a session is held to.
+ */
+export declare function grantIdentityFromRepository(repo: Partial<Pick<AuthRepository, "getUserById" | "getUserRoleIds" | "getTokensValidAfter">> | undefined): McpGrantIdentity | undefined;
 export declare function createOAuthRoutes(config: OAuthRoutesConfig): Hono<HonoEnv>;
 /**
  * Why a redirect URI cannot be registered, or null if it can.
@@ -45,7 +72,13 @@ export declare function createOAuthRoutes(config: OAuthRoutesConfig): Hono<HonoE
  * means a stored row is never itself the hazard.
  */
 export declare function redirectUriProblem(uri: string): string | null;
-/** Human-readable consent lines, one per granted scope. */
+/**
+ * Human-readable consent lines, one per granted scope.
+ *
+ * Worded for the person consenting, not taken from the scope catalogue: what
+ * they need to read here is that the client gets *their own* access and no
+ * more, and which collections it reaches when the grant names some.
+ */
 export declare function describeScopes(scope: string): {
     scope: string;
     description: string;

package/dist/mcp/oauth-store.d.ts

@@ -53,26 +53,29 @@ export interface RefreshTokenRecord {
     clientId: string;
     uid: string;
     /**
-     * The roles the grant was made with.
+     * The roles the token was minted with.
      *
-     * Carried here because a refresh has no session to re-read them from, and
-     * an access token minted with an empty `roles` is not a smaller grant — it
-     * is a DIFFERENT identity to the database. Any policy written as "a row this
-     * user's role may see" evaluates against an empty list and returns nothing,
-     * so dropping them turns the first token refresh into an integration that
-     * silently stops seeing data.
-     *
-     * The consequence of storing them is that a role change does not reach an
-     * existing grant until the refresh token expires or the user revokes the
-     * client. That is stated in the docs, and it is the trade this design makes
-     * knowingly: the alternative is a user lookup on every refresh, which puts
-     * the auth adapter on a path that currently has no dependency on it.
+     * A refresh re-reads the account's roles when the routes are given an
+     * identity to ask (`McpGrantIdentity`), so these are what a grant falls
+     * back on when there is none — an auth adapter that exposes no user
+     * repository. The fallback is these rather than an empty list because an
+     * access token minted with no `roles` is not a smaller grant — it is a
+     * DIFFERENT identity to the database: any policy written as "a row this
+     * user's role may see" evaluates against an empty list and returns nothing.
      */
     roles: string[];
     scope: string;
     resource: string;
     family: string;
 }
+/** A refresh token that could be spent right now, and when it was minted. */
+export interface LiveRefreshToken extends RefreshTokenRecord {
+    /**
+     * When this token — not its family — was issued. Compared with the user's
+     * revocation watermark: a token minted before "sign out everywhere" is void.
+     */
+    issuedAt: Date;
+}
 export interface OAuthStore {
     ensureTables(): Promise<void>;
     registerClient(client: OAuthClient): Promise<void>;
@@ -91,6 +94,19 @@ export interface OAuthStore {
      * the same family before returning null.
      */
     consumeRefreshToken(token: string): Promise<RefreshTokenRecord | null>;
+    /**
+     * A live refresh token's grant, WITHOUT spending it.
+     *
+     * What the token endpoint checks before it rotates: whose client it is,
+     * the scope asked for, and whether the account behind it still stands.
+     * Spending first and checking after means a refusal — or a database blip
+     * in the account lookup — leaves the holder with a spent token, and their
+     * retry reads as a replay that kills the family.
+     *
+     * Returns null for anything {@link consumeRefreshToken} would refuse, and
+     * writes nothing: a replayed token is detected when it is spent.
+     */
+    peekRefreshToken(token: string): Promise<LiveRefreshToken | null>;
     revokeFamily(family: string): Promise<void>;
     /**
      * Revoke the family a token belongs to, for RFC 7009 — without spending it.

package/dist/metrics/history-recorder.d.ts

@@ -1,4 +1,4 @@
-import type { DataDriver } from "@rebasepro/types";
+import { type DataDriver } from "@rebasepro/types";
 import { type MetricSeries, type SeriesPoint } from "./history-store.js";
 export interface MetricsHistory {
     /** Create the table and sweep what has aged out. */

package/dist/{openapi-generator-D8uFz-LW.js → openapi-generator-DAq_XVDu.js}

@@ -2,9 +2,44 @@ import { createRequire as __rebaseCreateRequire } from "module";
 import __rebaseProcess from "process";
 globalThis.process ??= __rebaseProcess;
 __rebaseCreateRequire(import.meta.url);
-import { B as fieldKeyForColumn, E as effectiveAccess, R as getTenantConfig, U as isRelationRequired, V as findRelation, W as resolveCollectionRelations, ut as isToMany } from "./src-1vL-I1Po.js";
-import "./src-Br6ARbs6.js";
+import { n as __exportAll } from "./rolldown-runtime-dW7B1o5h.js";
+import { B as findRelation, H as isRelationRequired, L as getTenantConfig, T as effectiveAccess, W as resolveCollectionRelations, ft as isToMany, z as fieldKeyForColumn } from "./src-I3aG1PcY.js";
+import "./src-CatHFUym.js";
+import { n as HARD_DELETE_QUERY_PARAM, t as DELETED_QUERY_PARAM } from "./soft-delete-params-BWPilMPF.js";
+/**
+* The property a `softDelete` collection records a deletion in — its wire
+* name, what a delete stamps and what a restore (an update to `null`) clears —
+* or `undefined` for a collection without soft delete.
+*
+* One reading of the declaration for every layer that needs it: the driver
+* that stamps and filters on it, and the REST route that has to recognise a
+* restore before it looks the row up.
+*/
+function softDeleteFieldOf(collection) {
+	const declared = collection && "softDelete" in collection ? collection.softDelete : void 0;
+	if (!declared) return void 0;
+	return typeof declared === "object" && declared.field || "deletedAt";
+}
+/**
+* Whether an update's values restore a soft-deleted row: they set the
+* soft-delete field back to `null`, the documented restore.
+*
+* A restore is an ordinary update of a row every default read hides, so a door
+* that looks the row up before updating it has to include the trashed rows for
+* this update — and only for this one: any other edit of a trashed row is a
+* 404.
+*/
+function restoresSoftDeletedRow(collection, values) {
+	const field = softDeleteFieldOf(collection);
+	return field !== void 0 && values?.[field] === null;
+}
+//#endregion
 //#region src/api/openapi-generator.ts
+var openapi_generator_exports = /* @__PURE__ */ __exportAll({
+	buildCollectionInputSchema: () => buildCollectionInputSchema,
+	buildCollectionSchema: () => buildCollectionSchema,
+	generateOpenApiSpec: () => generateOpenApiSpec
+});
 function generateOpenApiSpec(collections, options = {}) {
 	const basePath = options.basePath ?? "/api";
 	const requireAuth = options.requireAuth ?? true;
@@ -108,7 +143,7 @@ function generateOpenApiSpec(collections, options = {}) {
 			name: "distinct",
 			in: "query",
 			schema: { type: "boolean" },
-			description: "`SELECT DISTINCT` over the returned columns. Only meaningful alongside `fields`: the primary key is always in the projection, so without narrowing it every row is already distinct. `meta.total` counts distinct rows too. Refused (400) alongside `searchString` or a vector search, which attach a per-row score that makes every row distinct by construction, and (400 DISTINCT_ORDER_BY_NOT_SELECTED) when `orderBy` names a column `fields` does not return.",
+			description: "`SELECT DISTINCT` over the returned columns. Only meaningful alongside `fields`: the primary key is always in the projection, so without narrowing it every row is already distinct. The response has no `meta.total` — the rows before deduplication are a different set, so their count would not describe the page — and `meta.hasMore` is true when the page came back full. Refused (400) alongside `searchString` or a vector search, which attach a per-row score that makes every row distinct by construction, and (400 DISTINCT_ORDER_BY_NOT_SELECTED) when `orderBy` names a column `fields` does not return.",
 			example: "true"
 		},
 		{
@@ -183,7 +218,7 @@ function generateOpenApiSpec(collections, options = {}) {
 					properties: {
 						total: {
 							type: "integer",
-							description: "Total number of matching records"
+							description: "Total number of matching records. Absent on a `distinct` read, which has no count of the rows it returns."
 						},
 						limit: {
 							type: "integer",
@@ -220,7 +255,50 @@ function generateOpenApiSpec(collections, options = {}) {
 	const paths = spec.paths;
 	const schemas = spec.components.schemas;
 	const tags = spec.tags;
-	const reservedParameterNames = new Set(listQueryParameters().map((p) => p.name));
+	const reservedParameterNames = /* @__PURE__ */ new Set([...listQueryParameters().map((p) => p.name), DELETED_QUERY_PARAM]);
+	/**
+	* `?deleted=` on the reads of a `softDelete` collection. A delete there
+	* moves the row to the trash, and every read hides trashed rows unless it
+	* asks for them; the list, the single row, the count and the aggregate all
+	* honour this. Empty for any other collection.
+	*/
+	const deletedParameters = (collection) => {
+		const field = softDeleteFieldOf(collection);
+		if (!field) return [];
+		return [{
+			name: DELETED_QUERY_PARAM,
+			in: "query",
+			required: false,
+			schema: {
+				type: "string",
+				enum: ["include", "only"]
+			},
+			description: `Rows a delete moved to the trash (\`${field}\` set) are left out unless this asks for them: \`include\` reads them with the live rows, \`only\` reads them alone. Any other value is a 400 INVALID_DELETED_PARAM.`
+		}];
+	};
+	/**
+	* `?hard=` on the deletes of a `softDelete` collection: delete for good
+	* rather than move to the trash. Empty for any other collection.
+	*/
+	const hardDeleteParameters = (collection) => {
+		if (!softDeleteFieldOf(collection)) return [];
+		return [{
+			name: HARD_DELETE_QUERY_PARAM,
+			in: "query",
+			required: false,
+			schema: {
+				type: "boolean",
+				default: false
+			},
+			description: "`true` deletes for good instead of moving to the trash — a row already in the trash included, which is how the trash is emptied. Only `true`/`1` and `false`/`0` are accepted; anything else is a 400 INVALID_HARD_PARAM."
+		}];
+	};
+	/** What a delete does to a `softDelete` collection's row, for the delete operations' descriptions. */
+	const softDeleteBehaviour = (collection) => {
+		const field = softDeleteFieldOf(collection);
+		if (!field) return void 0;
+		return `This collection soft-deletes: a delete moves the row to the trash by stamping \`${field}\`, and every read leaves it out unless it passes \`?deleted=include\` or \`?deleted=only\`. A PATCH setting \`${field}\` back to \`null\` restores it. Pass \`?hard=true\` to delete for good.`;
+	};
 	const registeredSchemas = new Set((collections || []).map(schemaNameFor));
 	/**
 	* `Prefer: return=minimal`, on every route that would otherwise send a row
@@ -387,12 +465,17 @@ function generateOpenApiSpec(collections, options = {}) {
 		schemas[`${schemaName}Input`] = buildCollectionInputSchema(collection);
 		schemas[`${schemaName}Update`] = buildCollectionUpdateSchema(collection);
 		const dataPath = `/data/${slug}`;
+		const softDeleteNote = softDeleteBehaviour(collection);
 		paths[`${dataPath}/count`] = { get: {
 			tags: [collection.name],
 			summary: `Count ${collection.name}`,
 			description: "The number of rows the same filters would return, without returning them. Takes the filter and search parameters of the list endpoint; `limit`, `offset` and `orderBy` are not part of the question and are ignored.",
 			operationId: `count${schemaName}`,
-			parameters: [...listQueryParameters().filter((p) => p.name === "searchString"), ...buildFilterParameters(collection, reservedParameterNames)],
+			parameters: [
+				...listQueryParameters().filter((p) => p.name === "searchString"),
+				...deletedParameters(collection),
+				...buildFilterParameters(collection, reservedParameterNames)
+			],
 			responses: {
 				200: {
 					description: "The number of matching rows",
@@ -430,7 +513,16 @@ function generateOpenApiSpec(collections, options = {}) {
 					schema: { type: "string" },
 					example: "status"
 				},
-				...listQueryParameters().filter((p) => p.name === "searchString" || p.name === "limit"),
+				...listQueryParameters().filter((p) => p.name === "searchString" || p.name === "limit" || p.name === "offset" || p.name === "page"),
+				{
+					name: "orderBy",
+					in: "query",
+					required: false,
+					description: "Sort for the groups, by a `groupBy` field or an aggregate's result key (`count`, `sum_total`): `key:asc`, `key:desc` or `key:desc:last`. Groups it leaves tied are ordered by the `groupBy` fields, so every page boundary falls in the same place. `offset`, `page` and `orderBy` need `groupBy` — without it the result is one row — and are otherwise a 400 INVALID_AGGREGATE_WINDOW.",
+					schema: { type: "string" },
+					example: "count:desc"
+				},
+				...deletedParameters(collection),
 				...buildFilterParameters(collection, reservedParameterNames)
 			],
 			responses: {
@@ -439,13 +531,27 @@ function generateOpenApiSpec(collections, options = {}) {
 					content: { "application/json": { schema: {
 						type: "object",
 						required: ["data"],
-						properties: { data: {
-							type: "array",
-							items: {
+						properties: {
+							data: {
+								type: "array",
+								items: {
+									type: "object",
+									additionalProperties: true
+								}
+							},
+							meta: {
 								type: "object",
-								additionalProperties: true
+								description: "The page of groups. Present when `groupBy` is.",
+								properties: {
+									limit: { type: "integer" },
+									offset: { type: "integer" },
+									hasMore: {
+										type: "boolean",
+										description: "Whether a group follows this page."
+									}
+								}
 							}
-						} }
+						}
 					} } }
 				},
 				501: { description: "This backend's data driver does not implement aggregates" },
@@ -457,7 +563,11 @@ function generateOpenApiSpec(collections, options = {}) {
 				tags: [collection.name],
 				summary: `List ${collection.name}`,
 				operationId: `list${schemaName}`,
-				parameters: [...listQueryParameters(), ...buildFilterParameters(collection, reservedParameterNames)],
+				parameters: [
+					...listQueryParameters(),
+					...deletedParameters(collection),
+					...buildFilterParameters(collection, reservedParameterNames)
+				],
 				responses: {
 					200: {
 						description: "Paginated list of entities",
@@ -627,9 +737,9 @@ function generateOpenApiSpec(collections, options = {}) {
 		paths[`/data/${slug}/bulk/delete`] = { post: {
 			tags: [collection.name],
 			summary: `Delete many ${collection.name} in one transaction`,
-			description: "A POST, not `DELETE /bulk` with a body. Bodies on DELETE are permitted but widely dropped by proxies and CDNs, and several generators ignore `requestBody` on a DELETE operation — a generated client would send the request with no ids at all. Takes ids rather than a filter: a mistyped condition that empties a table cannot be reviewed at the call site the way an explicit list can. `beforeDelete`/`afterDelete` fire per row.",
+			description: "A POST, not `DELETE /bulk` with a body. Bodies on DELETE are permitted but widely dropped by proxies and CDNs, and several generators ignore `requestBody` on a DELETE operation — a generated client would send the request with no ids at all. Takes ids rather than a filter: a mistyped condition that empties a table cannot be reviewed at the call site the way an explicit list can. `beforeDelete`/`afterDelete` fire per row." + (softDeleteNote ? `\n\n${softDeleteNote}` : ""),
 			operationId: `deleteMany${schemaName}`,
-			parameters: [idempotencyHeader],
+			parameters: [idempotencyHeader, ...hardDeleteParameters(collection)],
 			requestBody: {
 				required: true,
 				content: { "application/json": { schema: {
@@ -643,7 +753,7 @@ function generateOpenApiSpec(collections, options = {}) {
 			},
 			responses: {
 				200: {
-					description: "How many rows were deleted",
+					description: softDeleteNote ? "How many rows were moved to the trash, or deleted for good with `?hard=true`" : "How many rows were deleted",
 					content: { "application/json": { schema: {
 						type: "object",
 						properties: { meta: {
@@ -686,7 +796,8 @@ function generateOpenApiSpec(collections, options = {}) {
 						schema: { type: "string" },
 						description: "Comma-separated columns to return, as a SELECT projection. The primary key always survives and `excludeFromApi` columns stay hidden.",
 						example: "id,title"
-					}
+					},
+					...deletedParameters(collection)
 				],
 				responses: {
 					200: {
@@ -713,6 +824,7 @@ function generateOpenApiSpec(collections, options = {}) {
 			delete: {
 				tags: [collection.name],
 				summary: `Delete ${collection.singularName || collection.name}`,
+				...softDeleteNote ? { description: softDeleteNote } : {},
 				operationId: `delete${schemaName}`,
 				parameters: [
 					{
@@ -729,10 +841,11 @@ function generateOpenApiSpec(collections, options = {}) {
 						required: false,
 						schema: { type: "string" },
 						description: "Names this delete so a retry replays its answer. A delete replayed after the first attempt committed would otherwise answer 404 — which an offline queue reads as a permanent failure for a delete that in fact succeeded."
-					}
+					},
+					...hardDeleteParameters(collection)
 				],
 				responses: {
-					204: { description: "Deleted successfully" },
+					204: { description: softDeleteNote ? "Moved to the trash: the row still exists and can be restored. With `?hard=true`, deleted for good" : "Deleted successfully" },
 					404: {
 						description: "Entity not found",
 						content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } }
@@ -1055,7 +1168,7 @@ function updateOperation(collection, schemaName, requireAuth, shared) {
 	return {
 		tags: [collection.name],
 		summary: `Update ${collection.singularName || collection.name}`,
-		description: "Partial update: only the properties present in the body are written; the rest are left unchanged.\n\nA property's value may instead be a field operation — `{ \"views\": { \"$inc\": 1 } }`, `{ \"tags\": { \"$push\": \"new\" } }`, `{ \"tags\": { \"$pull\": \"old\" } }`, `{ \"meta\": { \"$merge\": { \"seen\": true } } }` — which is applied inside the statement holding the row lock. That is the difference between a counter that is correct under concurrency and one that silently loses increments, because expressing the same change as a value means reading it first. `$inc` needs a `number` property, `$push`/`$pull` an `array`, `$merge` a `map`; anything else is a 400. See the `FieldOperation` schema.",
+		description: "Partial update: only the properties present in the body are written; the rest are left unchanged.\n\nA property's value may instead be a field operation — `{ \"views\": { \"$inc\": 1 } }`, `{ \"tags\": { \"$push\": \"new\" } }`, `{ \"tags\": { \"$pull\": \"old\" } }`, `{ \"meta\": { \"$merge\": { \"seen\": true } } }` — which is applied inside the statement holding the row lock. That is the difference between a counter that is correct under concurrency and one that silently loses increments, because expressing the same change as a value means reading it first. `$inc` needs a `number` property, `$push`/`$pull` an `array`, `$merge` a `map`; anything else is a 400. Pushed elements and merged keys answer to the property's own rules, as a value would. See the `FieldOperation` schema.",
 		operationId: `update${schemaName}`,
 		parameters: [
 			{
@@ -1424,6 +1537,6 @@ function toPascalCase(str) {
 	return str.replace(/[^a-zA-Z0-9]+/g, " ").split(" ").filter(Boolean).map((word) => word.charAt(0).toUpperCase() + word.slice(1).toLowerCase()).join("");
 }
 //#endregion
-export { generateOpenApiSpec };
+export { softDeleteFieldOf as a, restoresSoftDeletedRow as i, buildCollectionSchema as n, openapi_generator_exports as r, buildCollectionInputSchema as t };
 
-//# sourceMappingURL=openapi-generator-D8uFz-LW.js.map
+//# sourceMappingURL=openapi-generator-DAq_XVDu.js.map