@rebasepro/server 0.23.0 → 0.24.1-canary.g56af4a4

package/dist/{query-parser-DGRVFNM3.js → query-parser-DK9eMkb9.js}

@@ -2,58 +2,260 @@ import { createRequire as __rebaseCreateRequire } from "module";
 import __rebaseProcess from "process";
 globalThis.process ??= __rebaseProcess;
 __rebaseCreateRequire(import.meta.url);
-import { D as restrictedFieldNames, G as resolveCollectionRelations, S as CursorMismatchError, T as reconcileCursorOrder, a as deserializeFilter, f as IncludeSpecError, h as normalizeInclude, i as UnknownFilterOperatorError, o as deserializeLogicalCondition, p as deserializeInclude, r as RESERVED_QUERY_KEYS, rt as resolveClientListLimit, tt as ListLimitError, v as OrderBySpecError, w as decodeCursor, x as CursorError } from "./src-pmvW7BFx.js";
-import "./src-vkcwKXbT.js";
-import { t as ApiError } from "./errors-DWsX4yTd.js";
-//#region src/api/rest/soft-delete-params.ts
+import { i as ListLimitError, o as resolveClientListLimit } from "./strings.es-BeZWAodn.js";
+import { d as IncludeSpecError, f as deserializeInclude, g as OrderBySpecError, i as deserializeLogicalCondition, m as normalizeInclude, n as UnknownFilterOperatorError, r as deserializeFilter, s as PAGE_WITH_OFFSET_MESSAGE, t as RESERVED_QUERY_KEYS } from "./filter-dialect-REl-TjZr.js";
+import { $ as parseRelationAggregateSort } from "./src-CatHFUym.js";
+import { a as apiHiddenFieldNames, c as fieldKeyForColumn, i as parseWithDeleted, l as findRelation, m as resolveCollectionRelations, s as restrictedFieldNames, t as DELETED_QUERY_PARAM } from "./soft-delete-params-47yBGs3_.js";
+import { t as ApiError } from "./errors-D6_y86c5.js";
+//#region ../common/src/collections/unknown-field.ts
 /**
-* The two query parameters soft delete adds to the REST surface.
+* The fields an unknown-field answer offers as valid, sorted: what a query on
+* this collection can name as a column. A relation contributes its foreign key
+* (`authorId`) when the key is on this table, and nothing otherwise. An
+* `excludeFromApi` field is never offered.
 *
-* Kept in their own module so the call sites in `query-parser.ts` and the
-* delete routes are a single line each: the parsing rules belong to soft
-* delete, not to the parser, and a rule spread across the two files that read
-* it is a rule that drifts.
+* Read off the collection rather than the table, so the REST check — which
+* holds no table — lists exactly what the driver lists.
 */
-/** `?deleted=` — what to do about rows a soft delete has stamped. */
-var DELETED_QUERY_PARAM = "deleted";
-/** `?hard=` — ask for a real `DELETE` on a soft-delete collection. */
-var HARD_DELETE_QUERY_PARAM = "hard";
+function queryableFieldNames(collection) {
+	const hidden = apiHiddenFieldNames(collection);
+	const names = /* @__PURE__ */ new Set();
+	let relations;
+	for (const [key, property] of Object.entries(collection.properties ?? {})) {
+		if (property?.type === "relation") {
+			relations ??= resolveCollectionRelations(collection);
+			const relation = findRelation(relations, key);
+			if (relation?.kind === "belongsTo") names.add(fieldKeyForColumn(collection, relation.localKey));
+			continue;
+		}
+		names.add(key);
+	}
+	return [...names].filter((name) => !hidden.has(name)).sort();
+}
+var validList = (validFields) => validFields.length > 0 ? `. Valid fields: ${validFields.join(", ")}` : "";
+/** A filter key that resolves to nothing on `collectionPath`. */
+function unknownFilterField(field, collectionPath, validFields) {
+	return {
+		message: `Unknown filter field '${field}' on collection '${collectionPath}'${validList(validFields)}`,
+		code: "UNKNOWN_FILTER_FIELD",
+		details: {
+			field,
+			collection: collectionPath,
+			...validFields.length > 0 && { validFields }
+		}
+	};
+}
+/** `author.emial` — a relation path whose last segment names nothing on the relation's target. */
+function unknownRelationTargetField(path, target, collectionPath) {
+	return {
+		message: `Unknown field '${path.fieldKey}' on '${target.slug}', the target of relation '${path.relationKey}' on collection '${collectionPath}'${validList(target.validFields)}`,
+		code: "UNKNOWN_FILTER_FIELD",
+		details: {
+			field: path.field,
+			collection: collectionPath,
+			relation: path.relationKey,
+			targetCollection: target.slug,
+			...target.validFields.length > 0 && { validFields: target.validFields }
+		}
+	};
+}
+/** An `orderBy` key that resolves to nothing. `collectionName` is absent when the read carries no collection. */
+function unknownOrderByField(orderBy, collectionName, validFields) {
+	return {
+		message: `Unknown orderBy field '${orderBy}'${collectionName ? ` on collection '${collectionName}'` : ""}${validList(validFields)}`,
+		code: "UNKNOWN_ORDER_BY_FIELD",
+		details: {
+			field: orderBy,
+			...collectionName && { collection: collectionName },
+			...validFields.length > 0 && { validFields }
+		}
+	};
+}
+/** A `fields` entry that names nothing. */
+function unknownProjectionField(name, collectionName, validFields) {
+	return {
+		message: `Unknown field '${name}' in \`fields\` on collection '${collectionName}'. Valid fields: ${validFields.join(", ")}`,
+		code: "UNKNOWN_FIELD",
+		details: {
+			field: name,
+			collection: collectionName
+		}
+	};
+}
+/**
+* An `include` naming no relation of the collection. `validRelations` is what
+* the collection declares, never an `excludeFromApi` relation.
+*/
+function unknownIncludeRelation(key, collectionName, validRelations) {
+	return {
+		message: `Unknown relation '${key}' on collection '${collectionName}'` + (validRelations.length > 0 ? `. Its relations are: ${validRelations.join(", ")}` : ". It declares no relations."),
+		code: "UNKNOWN_RELATION",
+		details: {
+			relation: key,
+			collection: collectionName,
+			...validRelations.length > 0 && { validRelations }
+		}
+	};
+}
+/** The relations an unknown-relation answer offers, sorted — never an `excludeFromApi` one. */
+function includableRelationNames(collection) {
+	const hidden = apiHiddenFieldNames(collection);
+	return Object.keys(resolveCollectionRelations(collection)).filter((key) => !hidden.has(key)).sort();
+}
 /**
-* `?deleted=include|only` → the driver's `withDeleted`.
+* An aggregate's `select` field or `groupBy` key that names no column.
+* `forWhat` is where it was named: `sum()`, `count()`, `groupBy`.
+* `validFields` is {@link queryableFieldNames}, never an `excludeFromApi` field.
+*/
+function unknownAggregateField(field, forWhat, validFields) {
+	return {
+		message: `Unknown field '${field}' in ${forWhat}${validList(validFields)}`,
+		code: "UNKNOWN_AGGREGATE_FIELD",
+		details: {
+			field,
+			...validFields.length > 0 && { validFields }
+		}
+	};
+}
+/**
+* The properties a `vector_search` can name, sorted: those declared
+* `{ type: "vector" }`, never an `excludeFromApi` one.
+*/
+function vectorPropertyNames(collection) {
+	const hidden = apiHiddenFieldNames(collection);
+	return Object.entries(collection.properties ?? {}).filter(([key, property]) => property?.type === "vector" && !hidden.has(key)).map(([key]) => key).sort();
+}
+/** A `vector_search` naming no vector property. `vectorProperties` is {@link vectorPropertyNames}. */
+function unknownVectorProperty(property, vectorProperties) {
+	return {
+		message: `Unknown vector property "${property}". ` + (vectorProperties.length > 0 ? `This collection's vector properties are: ${vectorProperties.join(", ")}.` : "This collection declares no `vector` property to search."),
+		code: "UNKNOWN_VECTOR_PROPERTY",
+		details: {
+			property,
+			...vectorProperties.length > 0 && { vectorProperties }
+		}
+	};
+}
+//#endregion
+//#region ../common/src/data/cursor.ts
+/** A cursor that cannot be read at all — truncated, re-encoded, or invented. */
+var CursorError = class CursorError extends Error {
+	code = "INVALID_CURSOR";
+	constructor(detail) {
+		super(`Invalid \`after\` cursor: ${detail}. Pass back the \`meta.nextCursor\` from the previous page unchanged — it is opaque and must not be built by hand.`);
+		this.name = "CursorError";
+		Object.setPrototypeOf(this, CursorError.prototype);
+	}
+};
+/**
+* A cursor that reads fine but describes a different query.
 *
-* Spelled `deleted` on the wire and `withDeleted` in the driver, deliberately:
-* the URL reads as a question about the rows (`?deleted=only` — "only the
-* deleted ones"), and the driver option reads as an instruction about the query.
+* Separate from {@link CursorError} because the fix is different: this one is
+* not a corrupt string, it is a correct cursor used against a sort it was not
+* produced under. Seeking anyway would return rows in an order nobody asked
+* for, and — worse — would look like it worked.
+*/
+var CursorMismatchError = class CursorMismatchError extends Error {
+	code = "CURSOR_ORDER_MISMATCH";
+	constructor(cursorKeys, queryKeys) {
+		super(`The \`after\` cursor was produced by a query ordered by ${cursorKeys.map((k) => `"${k}"`).join(", ") || "(nothing)"}, but this query orders by ${queryKeys.map((k) => `"${k}"`).join(", ") || "(nothing)"}. A cursor only continues the listing it came from — keep \`orderBy\` identical across pages, or drop \`after\` to start over.`);
+		this.name = "CursorMismatchError";
+		Object.setPrototypeOf(this, CursorMismatchError.prototype);
+	}
+};
+/**
+* Tag for a value whose JSON round-trip would otherwise lose its type.
 *
-* A value neither word is a 400 rather than a silent fallback to the default.
-* `?deleted=true` quietly hiding every deleted row is the worst of both: it
-* looks like it worked and answers the opposite question. Absent is the
-* default, which is "hide them".
+* A `timestamp` column comes back from the driver as a `Date`; JSON turns it
+* into a string, and the string would then be compared against the column by
+* whatever cast Postgres chose. Round-tripping it as a `Date` keeps the
+* comparison the one the ORDER BY made.
 */
-function parseWithDeleted(raw) {
-	if (raw === void 0 || raw === null || raw === "") return void 0;
-	const value = String(raw).trim().toLowerCase();
-	if (value === "include") return true;
-	if (value === "only") return "only";
-	throw ApiError.badRequest(`Invalid \`?${DELETED_QUERY_PARAM}=${String(raw)}\`. It takes 'include' (live rows and deleted ones) or 'only' (deleted rows alone). Omit it to see only the live rows.`, "INVALID_DELETED_PARAM");
+var DATE_TAG = "$date";
+function decodeValue(value) {
+	if (value && typeof value === "object" && !Array.isArray(value)) {
+		const tagged = value[DATE_TAG];
+		if (typeof tagged === "string") {
+			const date = new Date(tagged);
+			return Number.isNaN(date.getTime()) ? tagged : date;
+		}
+	}
+	return value;
+}
+function fromBase64Url(encoded) {
+	const padded = encoded.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - encoded.length % 4) % 4);
+	const binary = atob(padded);
+	const bytes = new Uint8Array(binary.length);
+	for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+	return new TextDecoder().decode(bytes);
+}
+/**
+* Read a cursor produced by {@link encodeCursor}.
+*
+* @throws {CursorError} when the string is not a cursor this codec wrote.
+*/
+function decodeCursor(raw) {
+	let parsed;
+	try {
+		parsed = JSON.parse(fromBase64Url(raw.trim()));
+	} catch {
+		throw new CursorError("it is not a cursor this API issued");
+	}
+	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw new CursorError("it does not decode to a cursor");
+	const body = parsed;
+	if (!Array.isArray(body.k)) throw new CursorError("it carries no sort keys");
+	if (body.i === void 0) throw new CursorError("it carries no row id");
+	const orderBy = [];
+	for (const entry of body.k) {
+		if (!Array.isArray(entry) || typeof entry[0] !== "string") throw new CursorError("one of its sort keys is malformed");
+		const direction = entry[1] === "desc" ? "desc" : "asc";
+		orderBy.push(entry[2] === "first" || entry[2] === "last" ? [
+			entry[0],
+			direction,
+			entry[2]
+		] : [entry[0], direction]);
+	}
+	const rawValues = body.v && typeof body.v === "object" && !Array.isArray(body.v) ? body.v : {};
+	const values = {};
+	for (const [field, value] of Object.entries(rawValues)) values[field] = decodeValue(value);
+	return {
+		orderBy,
+		values,
+		id: decodeValue(body.i)
+	};
 }
 /**
-* `?hard=true` → a real `DELETE` on a collection that soft-deletes.
+* The `orderBy` a request should run under, given a cursor and whatever sort
+* the request itself named.
 *
-* Needs no permission beyond the delete it replaces: it is the same verb, and a
-* second access-control surface for one operation is a second thing to get
-* wrong. What it changes is whether the row can be restored.
+* A request that names no sort **adopts the cursor's** — that is what makes
+* `find({ after })` work without restating the `orderBy` from the previous
+* call, and it cannot be wrong, since the cursor is the only sort in play.
+* A request that names one must name the *same* one, key for key, direction for
+* direction, nulls for nulls; anything else is {@link CursorMismatchError}.
 *
-* Only the exact words `true` and `1` mean yes. Anything else is a 400, not a
-* "no" — a typo that silently soft-deletes when the caller asked to purge is a
-* caller who believes the data is gone.
+* @throws {CursorMismatchError}
 */
-function parseHardDelete(raw) {
-	if (raw === void 0 || raw === null || raw === "") return false;
-	const value = String(raw).trim().toLowerCase();
-	if (value === "true" || value === "1") return true;
-	if (value === "false" || value === "0") return false;
-	throw ApiError.badRequest(`Invalid \`?${HARD_DELETE_QUERY_PARAM}=${String(raw)}\`. It takes 'true' or 'false'.`, "INVALID_HARD_PARAM");
+function reconcileCursorOrder(cursor, requested) {
+	if (!requested || requested.length === 0) return cursor.orderBy;
+	const spell = (keys) => keys.map(([field, direction, nulls]) => `${field}:${direction}${nulls ? `:${nulls}` : ""}`);
+	const cursorKeys = spell(cursor.orderBy);
+	const queryKeys = spell(requested);
+	if (cursorKeys.length !== queryKeys.length || cursorKeys.some((key, i) => key !== queryKeys[i])) throw new CursorMismatchError(cursorKeys, queryKeys);
+	return requested;
+}
+/**
+* The `startAfter` shape the driver contract takes, built from a cursor.
+*
+* The driver has always accepted `{ id, values }`; this is the one place that
+* shape is produced, so the REST route and the WebSocket ingress cannot drift
+* into two spellings of the same seek.
+*/
+function cursorToStartAfter(cursor) {
+	return {
+		id: cursor.id,
+		values: cursor.values
+	};
 }
 //#endregion
 //#region src/api/rest/field-access-query.ts
@@ -66,13 +268,22 @@ function parseHardDelete(raw) {
 * `?orderBy=salary` returns them in order of it. A column no response can carry
 * has to be a column no query can interrogate, or the read rule is decoration.
 *
-* The refusal names the field. That is deliberate and it is not a leak: the
-* published OpenAPI lists every property of every collection, including the ones
-* a given caller cannot read, because the document is one document and is served
-* off the app rather than off the authenticated data router. Hiding the name
-* here would protect nothing and would answer a caller's genuine typo with
-* "unknown field", sending them to look for a spelling mistake that is not
-* there. Field *names* are public; field *values* are not.
+* The refusal names a field restricted by role. That is deliberate and it is
+* not a leak: the published OpenAPI lists every property of every collection,
+* including the ones a given caller cannot read, because the document is one
+* document and is served off the app rather than off the authenticated data
+* router. Hiding the name here would protect nothing and would answer a
+* caller's genuine typo with "unknown field", sending them to look for a
+* spelling mistake that is not there. Those field *names* are public; their
+* *values* are not.
+*
+* An `excludeFromApi` field is the exception, because its name is *not*
+* public: OpenAPI, `list_collections` and the generated SDK all leave it out.
+* "`email` is not readable on `authors`" would confirm the one thing those hide,
+* so a filter, sort, projection, include, aggregate or vector search naming one
+* is answered as one naming a field that does not exist — built by the functions the driver answers a
+* typo with (`@rebasepro/common`'s `unknown-field`), so the two answers are the
+* same bytes. See {@link assertNoHiddenNames}.
 *
 * @module
 */
@@ -136,7 +347,8 @@ function assertReadableFields(names, collection, viewer, where) {
 	if (names.length === 0) return;
 	const { refused } = restrictedFieldNames(collection, viewer, "read");
 	if (refused.size === 0) return;
-	const named = [...new Set(names.filter((n) => n !== void 0 && refused.has(n)))];
+	const hidden = apiHiddenFieldNames(collection);
+	const named = [...new Set(names.filter((n) => n !== void 0 && refused.has(n) && !hidden.has(n)))];
 	if (named.length === 0) return;
 	throw ApiError.badRequest(`${named.map((f) => `'${f}'`).join(", ")} ${named.length > 1 ? "are" : "is"} not readable on '${collection.slug}' with your roles, so ${named.length > 1 ? "they" : "it"} cannot be used in ${WHERE_LABEL[where]}.`, "FIELD_NOT_READABLE", {
 		collection: collection.slug,
@@ -156,15 +368,240 @@ function assertReadableFields(names, collection, viewer, where) {
 * parsed and then dropped by the list route.
 */
 function assertQueryFieldsReadable(options, collection, viewer) {
+	const filtered = assertRestrictedFieldsUnused(options, collection, viewer);
+	const include = options.include !== void 0 ? normalizeInclude(options.include) : void 0;
+	assertNoHiddenNames({
+		...options,
+		filtered,
+		include: include?.tree
+	}, collection);
+}
+/**
+* The aggregate route's `select` and `groupBy`, which it parses itself: an
+* `excludeFromApi` name there is answered exactly as the driver answers a
+* column that does not exist. Walked in the driver's order — each aggregate's
+* field, then each group key — and the first hidden *or* unknown name gets the
+* answer, so a typo before a hidden name is still the one named.
+*/
+function assertNoHiddenAggregateNames(aggregates, groupBy, collection) {
+	const hidden = apiHiddenFieldNames(collection);
+	if (hidden.size === 0) return;
+	const asked = [...aggregates.flatMap(({ fn, field }) => field === void 0 ? [] : [{
+		name: field,
+		forWhat: `${fn}()`
+	}]), ...groupBy.map((name) => ({
+		name,
+		forWhat: "groupBy"
+	}))];
+	if (!asked.some(({ name }) => hidden.has(name))) return;
+	const valid = queryableFieldNames(collection);
+	const known = (name) => !hidden.has(name) && (valid.includes(name) || name in (collection.properties ?? {}));
+	for (const { name, forWhat } of asked) {
+		if (known(name)) continue;
+		const answer = unknownAggregateField(name, forWhat, valid);
+		throw ApiError.badRequest(answer.message, answer.code, answer.details);
+	}
+}
+/**
+* Refuse every field restricted by role that the read names, at every level of
+* its include tree. Returns the filter's column names, for the hidden pass.
+*/
+function assertRestrictedFieldsUnused(options, collection, viewer) {
 	const filtered = [];
 	if (options.where) filtered.push(...Object.keys(options.where));
 	logicalColumns(options.logical, filtered);
-	assertReadableFields(filtered, collection, viewer, "filter");
+	assertReadableFields(filtered.map(filterHead), collection, viewer, "filter");
+	assertRelationPathsReadable(filtered, collection, viewer);
 	assertReadableFields((options.orderBy ?? []).map((entry) => orderByColumn(entry.field)), collection, viewer, "orderBy");
+	assertAggregateSortsReadable(options.orderBy ?? [], collection, viewer);
 	assertReadableFields(options.fields ?? [], collection, viewer, "fields");
 	assertReadableFields(options.vectorSearch ? [options.vectorSearch.property] : [], collection, viewer, "vector_search");
 	const include = options.include !== void 0 ? normalizeInclude(options.include) : void 0;
 	if (include) assertIncludeFieldsReadable(include.tree, collection, viewer);
+	return filtered;
+}
+/**
+* The field a filter key reads on *this* collection: the column before a JSON
+* path's first arrow (`metadata->theme` reads `metadata`), the relation before
+* a relation path's dot (`author.email` reads `author`), the key itself
+* otherwise. A key that is a property outright wins, as the driver resolves it.
+*/
+function filterHead(name) {
+	const arrow = name.indexOf("->");
+	if (arrow > 0) return name.slice(0, arrow);
+	const dot = name.indexOf(".");
+	if (dot > 0) return name.slice(0, dot);
+	return name;
+}
+/**
+* `orderBy=max(staff.salary)` ranks the parents by the target's `salary` — the
+* same reading `orderBy=salary` on `staff` is — so the aggregated field is
+* judged by the target's rule. Whether the relation itself may be read is the
+* driver's check (`assertRelationReadable`), which runs on every door.
+*/
+function assertAggregateSortsReadable(orderBy, collection, viewer) {
+	let relations;
+	for (const { field } of orderBy) {
+		const spec = parseRelationAggregateSort(field);
+		if (!spec?.field) continue;
+		relations ??= resolveCollectionRelations(collection);
+		const relation = findRelation(relations, spec.relation);
+		if (!relation) continue;
+		assertReadableFields([spec.field], relation.target(), viewer, "orderBy");
+	}
+}
+/**
+* `?author.salary=gt.100000` reads the target's `salary`, a row at a time, as
+* `?salary=gt.100000` on `authors` would — so it is judged by the target's
+* rule. Only a path whose first segment is a relation here; anything else is
+* the driver's to refuse.
+*/
+function assertRelationPathsReadable(filtered, collection, viewer) {
+	let relations;
+	for (const name of filtered) {
+		const dot = name.indexOf(".");
+		if (dot <= 0 || name.indexOf("->") >= 0) continue;
+		relations ??= resolveCollectionRelations(collection);
+		const relation = findRelation(relations, name.slice(0, dot));
+		if (!relation) continue;
+		assertReadableFields([name.slice(dot + 1)], relation.target(), viewer, "filter");
+	}
+}
+/**
+* Answer a read naming an `excludeFromApi` field — or relation — exactly as the
+* driver answers a read naming a field that does not exist.
+*
+* The names are walked in the order the driver resolves them — the `fields`
+* projection, then the filter, then the sort, then each include, parent before
+* child — and the first that is hidden *or* unknown gets the answer. Answering
+* only the hidden one would still tell the two apart: with `?aaa=x&email=x` the
+* driver names `aaa` when `email` does not exist, so this has to as well.
+*
+* A request naming nothing hidden is left alone entirely, so the driver stays
+* the only one answering ordinary typos.
+*/
+function assertNoHiddenNames(options, collection) {
+	const hidden = apiHiddenFieldNames(collection);
+	if (hidden.size > 0) {
+		const shapes = [
+			...(options.fields ?? []).map((name) => ({
+				kind: "fields",
+				name
+			})),
+			...options.filtered.map((name) => ({
+				kind: "filter",
+				name
+			})),
+			...(options.orderBy ?? []).flatMap((entry) => {
+				const name = orderByColumn(entry.field);
+				return name === void 0 ? [] : [{
+					kind: "orderBy",
+					name
+				}];
+			})
+		].map(({ kind, name }) => ({
+			kind,
+			name,
+			shape: nameShape(name, collection, hidden)
+		}));
+		const vectorHidden = options.vectorSearch !== void 0 && hidden.has(options.vectorSearch.property);
+		if (vectorHidden || shapes.some((entry) => entry.shape.hidden)) for (const { kind, name, shape } of shapes) {
+			if (shape.known && !shape.hidden) continue;
+			const answer = unknownAnswer(kind, name, shape, collection);
+			throw ApiError.badRequest(answer.message, answer.code, answer.details);
+		}
+		if (vectorHidden && options.vectorSearch) {
+			const answer = unknownVectorProperty(options.vectorSearch.property, vectorPropertyNames(collection));
+			throw ApiError.badRequest(answer.message, answer.code, answer.details);
+		}
+	}
+	const relations = resolveCollectionRelations(collection);
+	for (const [key, node] of Object.entries(options.include ?? {})) {
+		if (hidden.has(key)) {
+			const answer = unknownIncludeRelation(key, collection.slug ?? collection.name, includableRelationNames(collection));
+			throw ApiError.badRequest(answer.message, answer.code, answer.details);
+		}
+		const relation = relations[key];
+		if (!relation) continue;
+		const filtered = [];
+		if (node.where) filtered.push(...Object.keys(node.where));
+		logicalColumns(node.logical, filtered);
+		assertNoHiddenNames({
+			filtered,
+			orderBy: node.orderBy?.map(([field]) => ({ field })),
+			fields: node.fields,
+			include: node.children
+		}, relation.target());
+	}
+}
+function nameShape(name, collection, hidden) {
+	if (hidden.has(name)) return {
+		hidden: true,
+		known: false
+	};
+	const columns = new Set(queryableFieldNames(collection));
+	const relations = resolveCollectionRelations(collection);
+	if (columns.has(name) || name in (collection.properties ?? {})) return {
+		hidden: false,
+		known: true
+	};
+	const arrow = name.indexOf("->");
+	if (arrow > 0) {
+		const head = name.slice(0, arrow);
+		return {
+			hidden: hidden.has(head),
+			known: columns.has(head)
+		};
+	}
+	const dot = name.indexOf(".");
+	if (dot > 0) {
+		const relationKey = name.slice(0, dot);
+		const fieldKey = name.slice(dot + 1);
+		if (hidden.has(relationKey)) return {
+			hidden: true,
+			known: false
+		};
+		const relation = findRelation(relations, relationKey);
+		if (!relation) return {
+			hidden: false,
+			known: false
+		};
+		const target = relation.target();
+		const targetHidden = apiHiddenFieldNames(target);
+		const path = {
+			relationKey,
+			fieldKey,
+			target
+		};
+		if (targetHidden.has(fieldKey)) return {
+			hidden: true,
+			known: false,
+			path
+		};
+		return {
+			hidden: false,
+			known: queryableFieldNames(target).includes(fieldKey) || fieldKey in (target.properties ?? {}),
+			path
+		};
+	}
+	return {
+		hidden: false,
+		known: false
+	};
+}
+function unknownAnswer(kind, name, shape, collection) {
+	const slug = collection.slug ?? collection.name;
+	if (kind === "fields") return unknownProjectionField(name, slug, queryableFieldNames(collection));
+	if (kind === "orderBy") return unknownOrderByField(name, slug, queryableFieldNames(collection));
+	if (shape.path) return unknownRelationTargetField({
+		field: name,
+		relationKey: shape.path.relationKey,
+		fieldKey: shape.path.fieldKey
+	}, {
+		slug: shape.path.target.slug,
+		validFields: queryableFieldNames(shape.path.target)
+	}, slug);
+	return unknownFilterField(name, slug, queryableFieldNames(collection));
 }
 /**
 * Every relation an `include` loads, judged like the read it is part of.
@@ -186,7 +623,7 @@ function assertIncludeFieldsReadable(tree, collection, viewer) {
 		const relation = relations[key];
 		if (!relation) continue;
 		const target = relation.target();
-		assertQueryFieldsReadable({
+		assertRestrictedFieldsUnused({
 			where: node.where,
 			logical: node.logical,
 			orderBy: node.orderBy?.map(([field]) => ({ field })),
@@ -263,6 +700,7 @@ function parseLogicalGroup(type, raw) {
 	try {
 		parsed = deserializeLogicalCondition(`${type}(${inner})`);
 	} catch (e) {
+		if (e instanceof UnknownFilterOperatorError) throw invalidParam(e.message, e.code, e.details);
 		throw invalidParam(`Invalid \`${type}\` parameter: ${e instanceof Error ? e.message : String(e)}`, "INVALID_LOGICAL_GROUP");
 	}
 	return "type" in parsed ? parsed : void 0;
@@ -514,6 +952,7 @@ function parseQueryOptions(query, limits = {}, access) {
 	const offsetVal = getLastValue(query.offset);
 	if (offsetVal) options.offset = parseWindowParam(offsetVal, "offset", 0, "INVALID_OFFSET");
 	const pageVal = getLastValue(query.page);
+	if (pageVal && offsetVal) throw invalidParam(PAGE_WITH_OFFSET_MESSAGE, "PAGE_WITH_OFFSET");
 	if (pageVal) {
 		const page = parseWindowParam(pageVal, "page", 1, "INVALID_PAGE");
 		const limit = resolveListLimitParam(rawLimit, {
@@ -566,6 +1005,12 @@ function parseQueryOptions(query, limits = {}, access) {
 		if (text !== "true" && text !== "1" && text !== "false" && text !== "0") throw invalidParam(`Invalid \`distinct\` parameter: expected \`true\` or \`false\`, got ${JSON.stringify(String(distinctVal))}.`, "INVALID_DISTINCT");
 		options.distinct = text === "true" || text === "1";
 	}
+	const countVal = getLastValue(query.count);
+	if (countVal !== void 0 && countVal !== null && String(countVal) !== "") {
+		const text = String(countVal).trim().toLowerCase();
+		if (text !== "exact" && text !== "none") throw invalidParam(`Invalid \`count\` parameter: expected \`exact\` or \`none\`, got ${JSON.stringify(String(countVal))}.`, "INVALID_COUNT");
+		options.count = text;
+	}
 	const afterVal = getLastValue(query.after);
 	if (afterVal !== void 0 && afterVal !== null && String(afterVal).trim() !== "") {
 		let cursor;
@@ -628,6 +1073,6 @@ function parseQueryOptions(query, limits = {}, access) {
 	return options;
 }
 //#endregion
-export { resolveListLimitParam as a, requestViewer as c, parseQueryOptions as i, HARD_DELETE_QUERY_PARAM as l, parseAggregateSelect as n, assertQueryFieldsReadable as o, parseGroupBy as r, assertReadableFields as s, orderByEntriesToTuples as t, parseHardDelete as u };
+export { resolveListLimitParam as a, assertReadableFields as c, decodeCursor as d, reconcileCursorOrder as f, parseQueryOptions as i, requestViewer as l, parseAggregateSelect as n, assertNoHiddenAggregateNames as o, parseGroupBy as r, assertQueryFieldsReadable as s, orderByEntriesToTuples as t, cursorToStartAfter as u };
 
-//# sourceMappingURL=query-parser-DGRVFNM3.js.map
+//# sourceMappingURL=query-parser-DK9eMkb9.js.map