@rebasepro/server 0.24.0 → 0.24.1-canary.gcb918fc

package/dist/soft-delete-params-DfV3vVN5.js

@@ -0,0 +1,668 @@
+import { createRequire as __rebaseCreateRequire } from "module";
+import __rebaseProcess from "process";
+globalThis.process ??= __rebaseProcess;
+__rebaseCreateRequire(import.meta.url);
+import { r as toSnakeCase } from "./strings.es-BeZWAodn.js";
+import { W as isRelationalCollectionConfig } from "./src-D5Y3N-S4.js";
+import { t as ApiError } from "./errors-D6_y86c5.js";
+//#region ../utils/dist/plurals.es.js
+/**
+* Returns the singular of an English word.
+*
+* @param {string} word
+* @param {number} [amount]
+* @returns {string}
+*/
+function singular(word, amount) {
+	if (amount !== void 0 && amount !== 1) return word;
+	const singulars = {
+		"(quiz)zes$": "$1",
+		"(matr)ices$": "$1ix",
+		"(vert|ind)ices$": "$1ex",
+		"^(ox)en$": "$1",
+		"(alias)es$": "$1",
+		"(octop|vir)i$": "$1us",
+		"(cris|ax|test)es$": "$1is",
+		"(shoe)s$": "$1",
+		"(o)es$": "$1",
+		"(bus)es$": "$1",
+		"([m|l])ice$": "$1ouse",
+		"(x|ch|ss|sh)es$": "$1",
+		"(m)ovies$": "$1ovie",
+		"(s)eries$": "$1eries",
+		"([^aeiouy]|qu)ies$": "$1y",
+		"([lr])ves$": "$1f",
+		"(tive)s$": "$1",
+		"(hive)s$": "$1",
+		"(li|wi|kni)ves$": "$1fe",
+		"(shea|loa|lea|thie)ves$": "$1f",
+		"(^analy)ses$": "$1sis",
+		"((a)naly|(b)a|(d)iagno|(p)arenthe|(p)rogno|(s)ynop|(t)he)ses$": "$1$2sis",
+		"([ti])a$": "$1um",
+		"(n)ews$": "$1ews",
+		"(h|bl)ouses$": "$1ouse",
+		"(corpse)s$": "$1",
+		"(us)es$": "$1",
+		s$: ""
+	};
+	const irregular = {
+		move: "moves",
+		foot: "feet",
+		goose: "geese",
+		sex: "sexes",
+		child: "children",
+		man: "men",
+		tooth: "teeth",
+		person: "people"
+	};
+	if ([
+		"sheep",
+		"fish",
+		"deer",
+		"moose",
+		"series",
+		"species",
+		"money",
+		"rice",
+		"information",
+		"equipment",
+		"bison",
+		"cod",
+		"offspring",
+		"pike",
+		"salmon",
+		"shrimp",
+		"swine",
+		"trout",
+		"aircraft",
+		"hovercraft",
+		"spacecraft",
+		"sugar",
+		"tuna",
+		"you",
+		"wood"
+	].indexOf(word.toLowerCase()) >= 0) return word;
+	for (const w in irregular) {
+		const pattern = new RegExp(`${irregular[w]}$`, "i");
+		if (pattern.test(word)) return word.replace(pattern, w);
+	}
+	for (const reg in singulars) {
+		const pattern = new RegExp(reg, "i");
+		if (pattern.test(word)) return word.replace(pattern, singulars[reg]);
+	}
+	return word;
+}
+//#endregion
+//#region ../utils/dist/names.es.js
+/**
+* Generates a foreign key column name from a given string, typically a collection slug or name.
+* It singularizes the name, converts it to snake_case and appends '_id'.
+*
+* Singularization runs *before* snake-casing so that acronyms survive: `toSnakeCase`
+* splits on every capital, which turned "URLs" into "ur_ls" and then "ur_l_id".
+*
+* @param name The base name to convert to a foreign key.
+* @returns A foreign key name in the format 'singular_name_id'.
+*
+* @example
+* // returns "user_id"
+* generateForeignKeyName("users")
+*
+* @example
+* // returns "category_id"
+* generateForeignKeyName("categories")
+*
+* @example
+* // returns "product_id"
+* generateForeignKeyName("Product")
+*
+*/
+function generateForeignKeyName(name) {
+	return `${toSnakeCase(singularizeForKey(name))}_id`;
+}
+/**
+* `singular()` handles real English plurals, but its final catch-all rule strips
+* any trailing "s", which mangles words that only look plural. Guard the two
+* cases that produce a column name nobody would recognise:
+*
+* - a double "s" ending is never a plural marker ("address", "class", "process"),
+*   so stripping it yields "addres";
+* - a name that singularizes to nothing (the literal "s") would yield "_id".
+*/
+function singularizeForKey(name) {
+	if (/ss$/i.test(name)) return name;
+	const result = singular(name);
+	return result.length > 0 ? result : name;
+}
+/**
+* The API name a database column is served under.
+*
+* The wire name of a field is its property key, and Rebase's property keys are
+* camelCase — `displayName`, `createdAt`, `photoURL`. Columns are snake_case,
+* because an unquoted Postgres identifier folds to lower case and a camelCase
+* column is therefore reachable only as `"authorId"` forever: in hand-written
+* SQL, in psql, in an RLS policy body, in a dump, and in every third-party tool
+* that ever touches the database. So the two conventions are both right, and
+* this is the function that crosses between them.
+*
+* It exists because two sources of field names never crossed: a foreign key
+* derived from a relation (`author_id`) and a column read back by introspection
+* (`user_id`) both landed on the wire under their column name, while every
+* hand-authored collection next to them used camelCase. One API, two
+* conventions, and no rule a caller could infer from outside — those names are
+* also the `where` and `orderBy` keys, so it was not a matter of taste.
+*
+* Rules, in the order they matter:
+*
+*  - **A name with no separator is returned unchanged.** `photoURL` stays
+*    `photoURL` and `id` stays `id`. Lower-casing a single token is what makes
+*    a "camelCase" helper destructive — `camelCase("photoURL")` is `photourl` —
+*    and this function is applied to names that are *already* keys.
+*  - **Each following segment keeps its own casing** apart from an upper-cased
+*    first letter, so `photo_URL` → `photoURL` rather than `photoUrl`.
+*  - **The result may still not be a JavaScript identifier.** `2fa_enabled`
+*    becomes `2faEnabled`, which is a perfectly good object key and still needs
+*    quoting where one is written into generated source.
+*
+* Not the inverse of {@link toSnakeCase}: `toSnakeCase` tokenises on case
+* boundaries and would turn `photoURL` into `photo_url`. Round-tripping is not
+* a property either function promises, which is why a column name that a
+* property maps explicitly is always read off `columnName` rather than derived.
+*/
+function toWireKey(columnName) {
+	if (!columnName) return columnName;
+	const segments = columnName.split(/[-_ ]+/).filter(Boolean);
+	if (segments.length <= 1) return columnName;
+	return segments.map((segment, index) => index === 0 ? segment.charAt(0).toLowerCase() + segment.slice(1) : segment.charAt(0).toUpperCase() + segment.slice(1)).join("");
+}
+//#endregion
+//#region ../common/src/util/resolve-relation.ts
+/**
+* Fill in a relation's defaults.
+*
+* This replaces `sanitizeRelation`, which had to work out *which kind of link
+* you meant* from whichever optional fields happened to be set — 194 lines of
+* it, including a pass that inspected the target collection's own relations to
+* decide whether a `many`/`inverse` pair was a one-to-many or the far side of a
+* many-to-many, wrapped in a `try/catch` that fell through to the wrong answer
+* when it could not tell. Two consumers running that logic at different moments
+* could reach different conclusions about the same relation.
+*
+* With the kind declared there is nothing to work out. What remains is
+* defaulting — a table name, a column name — which is deterministic, depends
+* only on the relation and its two endpoints, and cannot fail. That is why this
+* function returns rather than throws, and why it needs no cache to be
+* consistent.
+*/
+function resolveRelation(relation, sourceCollection, propertyKey) {
+	const target = relation.target;
+	if (typeof target !== "function") throw new Error(`Relation${relation.relationName ? ` '${relation.relationName}'` : ""} on '${sourceCollection.slug}' has no \`target\`. Give it a thunk: \`target: () => otherCollection\`.`);
+	const targetCollection = callTarget(relation, sourceCollection, propertyKey, target);
+	const relationName = relation.relationName ?? propertyKey ?? toSnakeCase(targetCollection.slug);
+	const shared = {
+		relationName,
+		target: () => unwrapModuleNamespace(target()),
+		targetSlug: targetCollection.slug,
+		onUpdate: relation.onUpdate,
+		onDelete: relation.onDelete,
+		overrides: relation.overrides
+	};
+	const sourceName = toSnakeCase(sourceCollection.slug ?? sourceCollection.name);
+	switch (relation.kind) {
+		case "belongsTo": return {
+			...shared,
+			kind: "belongsTo",
+			cardinality: "one",
+			writable: true,
+			shared: false,
+			localKey: relation.localKey ?? generateForeignKeyName(relationName),
+			index: relation.index !== false
+		};
+		case "hasOne": return {
+			...shared,
+			kind: "hasOne",
+			cardinality: "one",
+			writable: true,
+			shared: false,
+			foreignKeyOnTarget: relation.foreignKeyOnTarget ?? generateForeignKeyName(sourceName),
+			sourceKey: relation.sourceKey
+		};
+		case "hasMany": return {
+			...shared,
+			kind: "hasMany",
+			cardinality: "many",
+			writable: true,
+			shared: false,
+			foreignKeyOnTarget: relation.foreignKeyOnTarget ?? generateForeignKeyName(sourceName),
+			sourceKey: relation.sourceKey
+		};
+		case "manyToMany": {
+			const sourceTable = getTableName(sourceCollection);
+			const targetTable = getTableName(targetCollection);
+			return {
+				...shared,
+				kind: "manyToMany",
+				cardinality: "many",
+				writable: true,
+				shared: true,
+				through: {
+					table: relation.through?.table ?? [sourceTable, targetTable].sort().join("_"),
+					sourceColumn: relation.through?.sourceColumn ?? generateForeignKeyName(sourceName),
+					targetColumn: relation.through?.targetColumn ?? generateForeignKeyName(relationName),
+					properties: relation.through?.properties ?? {}
+				}
+			};
+		}
+		case "via": return {
+			...shared,
+			kind: "via",
+			cardinality: relation.cardinality,
+			writable: false,
+			shared: true,
+			joinPath: relation.joinPath
+		};
+		default: throw new Error(`Unknown relation kind: ${JSON.stringify(relation)}`);
+	}
+}
+/** How this relation is addressed in an error message, before it has a resolved name. */
+function describe(relation, sourceCollection, propertyKey) {
+	const name = relation.relationName ?? propertyKey;
+	return `Relation${name ? ` '${name}'` : ""} on '${sourceCollection.slug}'`;
+}
+/**
+* A module namespace, unwrapped to the collection it exports.
+*
+* A cycle transpiled to CommonJS does not hand the importing module the
+* *default export* — it hands it the module object, `{ __esModule: true,
+* default: … }`, captured before the exporting module finished evaluating. The
+* `default` slot fills in later, so by the time a lazy `target` thunk runs the
+* collection is sitting right there, one level down. Returning the namespace is
+* never a thing a thunk means to do, and there is exactly one reading of it.
+*
+* Only unwrapped when the inner value is itself a collection: a `default` that
+* is not one is a genuinely wrong thunk, and it should reach the error below
+* rather than be quietly swapped in.
+*/
+function unwrapModuleNamespace(value) {
+	if (!value || typeof value !== "object") return value;
+	if (value.slug) return value;
+	const inner = value.default;
+	return inner && typeof inner === "object" && inner.slug ? inner : value;
+}
+/**
+* Call the `target` thunk, and translate the ways an import cycle breaks it into
+* an error that names the cause — or, where the value is recoverable, into the
+* collection the thunk meant.
+*
+* The thunk exists to defer the reference until every module has finished
+* evaluating, and for a cycle that closes at import time it does. Two cycles
+* leave the binding permanently unusable:
+*
+*  - **ESM/TDZ.** `const` and `class` bindings in a not-yet-evaluated module are
+*    in the temporal dead zone, so reading one throws `ReferenceError: x is not
+*    defined`. The stack points at the thunk — a one-line arrow function that is
+*    obviously fine — and says nothing about the cycle that made it throw.
+*  - **CJS interop, unresolved.** The half-initialised module object has no
+*    `default` yet, the import resolves to `undefined`, and the thunk returns it
+*    without complaint. That one used to surface here as "did not resolve to a
+*    collection", which is true and unhelpful.
+*
+* Both mean the same thing, and the fix for both is the same: break the cycle,
+* or move the relation into the collection that does not close it.
+*
+* A third shape is *not* an error, and used to be reported as one. A loader that
+* transpiles ESM to CJS — jiti, which is what `rebase generate-sdk` and
+* `rebase build` load collections with — gives the module entered second in a
+* cycle a namespace object rather than the default export, and never replaces it
+* with a live binding. The thunk then returns `{ __esModule: true, default: … }`
+* holding the fully-initialised collection. Native ESM resolves the same thunk
+* to the collection directly, so this was a loader artefact reported as an
+* authoring mistake, and the advice it gave — make the target a lazy thunk — was
+* already satisfied by the code it was rejecting. Bidirectional relations make
+* these cycles unavoidable, and the lazy thunk is this framework's own answer to
+* them, so {@link unwrapModuleNamespace} takes the collection and moves on.
+*/
+function callTarget(relation, sourceCollection, propertyKey, target) {
+	let targetCollection;
+	try {
+		targetCollection = unwrapModuleNamespace(target());
+	} catch (error) {
+		if (error instanceof ReferenceError) throw new Error(`${describe(relation, sourceCollection, propertyKey)} targets a collection that is not initialized yet — almost always an import cycle between the two collection files. Break the cycle (move the shared piece into a third module, or import the target lazily) so the target's module finishes evaluating before the registry is built.`, { cause: error });
+		throw error;
+	}
+	if (!targetCollection?.slug) throw new Error(`${describe(relation, sourceCollection, propertyKey)} has a \`target\` that resolved to ${targetCollection === void 0 ? "`undefined`" : "something that is not a collection"}. ` + (targetCollection === void 0 ? "Under CommonJS interop an import cycle resolves the default import to `undefined`, so check whether this collection and its target import each other. Otherwise the thunk is returning the wrong value — it must return the collection itself, not a promise or a module." : typeof targetCollection.then === "function" ? "The thunk returned a promise — `target: () => import(\"./other\")` is asynchronous. Import the collection at the top of the file and return the binding: `target: () => otherCollection`." : "The thunk must return a collection config with a `slug`."));
+	return targetCollection;
+}
+//#endregion
+//#region ../common/src/util/relations.ts
+/**
+* Whether the target rows are shared with other parents — a many-to-many, or a
+* multi-hop `via` chain.
+*
+* Decides what a write "through" the relation may touch: a shared target
+* belongs to every parent that links it, so the parent owns the *link* and not
+* the row. The backend enforces that (an unlink rather than a delete) and the
+* admin renders it (remove-from-parent rather than delete).
+*
+* Now a field on the resolved relation rather than a re-derivation, so both
+* sides read the same answer instead of each computing one.
+*/
+function isJunctionBackedRelation(relation) {
+	return relation.shared;
+}
+/** WeakMap cache — same collection instance always yields the same relation map. */
+var _resolvedRelationsCache = /* @__PURE__ */ new WeakMap();
+/**
+* Every relation a collection declares, keyed by the name it is addressed by.
+*
+* A relation reaches the map from either of two places — the collection's
+* `relations` array, or a `relation` property that declares one inline — and is
+* keyed by its resolved `relationName`, which is what a nested path segment,
+* an `include` key and an admin tab all match against.
+*
+* Resolution no longer swallows failures. It used to wrap each relation in a
+* `try/catch` that dropped anything it could not work out, so a
+* mis-declared relation silently vanished instead of being reported; with the
+* kind declared, the only remaining failure is a `target` that does not resolve,
+* which is worth hearing about.
+*/
+function resolveCollectionRelations(collection) {
+	const cached = _resolvedRelationsCache.get(collection);
+	if (cached) return cached;
+	if (!isRelationalCollectionConfig(collection)) return {};
+	const relations = {};
+	for (const relation of collection.relations ?? []) {
+		const resolved = resolveRelation(relation, collection);
+		relations[resolved.relationName] = resolved;
+	}
+	for (const [propertyKey, property] of Object.entries(collection.properties ?? {})) {
+		if (property?.type !== "relation") continue;
+		const declared = property.relation;
+		if (!declared || relations[propertyKey]) continue;
+		relations[propertyKey] = resolveRelation(declared, collection, propertyKey);
+	}
+	_resolvedRelationsCache.set(collection, relations);
+	return relations;
+}
+/**
+* The `type: "relation"` property that declares a link, or `undefined` for one
+* that only exists in the collection's `relations` array.
+*
+* Both declaration sites end up in {@link resolveCollectionRelations}, and only
+* one of them has a property to carry field-level facts — `name`, `admin`, and
+* the one this exists for, `validation.required`.
+*/
+function relationDeclaringProperty(collection, relation) {
+	const resolved = resolveCollectionRelations(collection);
+	for (const [key, raw] of Object.entries(collection.properties ?? {})) {
+		const prop = raw;
+		if (prop?.type !== "relation") continue;
+		if (resolved[key] === relation) return prop;
+		const addressed = prop.relation?.relationName;
+		if (addressed && findRelation(resolved, addressed) === relation) return prop;
+	}
+}
+/**
+* Must every row of this collection point at a target through this link?
+*
+* Read from the declaring property's `validation.required` — the same key every
+* other field uses, and the only place it lives.
+*
+* `RelationBase` carried its own `validation.required` until 0.18, which made
+* this two questions rather than one. They were answered by different readers:
+* the Postgres DDL generator asked the property (so the foreign-key column was
+* `NOT NULL`) and the SDK type generator asked the relation (so the generated
+* `Insert` type made the field optional). A `create()` that left the relation
+* out therefore typechecked and then failed at the database with a not-null
+* violation, and the two `required`s had to be written twice, identically, for
+* the pair to agree.
+*
+* A relation with no declaring property — an entry in `relations` nothing
+* points at — is not required. There is no field to fill in.
+*/
+function isRelationRequired(collection, relation) {
+	return Boolean(relationDeclaringProperty(collection, relation)?.validation?.required);
+}
+/**
+* The table a collection reads and writes.
+*
+* `table` when it is set, otherwise `toSnakeCase(slug)` — which is what made it
+* safe to drop `table` from the required fields on the config type: the runtime
+* had always derived it, and the type was demanding a value it did not need.
+*
+* The `||` chain is load-bearing. `toSnakeCase(undefined)` returns `""`, not
+* `undefined`, so the previous `??` chain short-circuited on the empty string
+* and the name fallback could never run — a safety net that read like one and
+* caught nothing. It was unreachable while `slug` was required; it stops being
+* unreachable the moment anything constructs a config without one.
+*/
+function getTableName(collection) {
+	return (isRelationalCollectionConfig(collection) ? collection.table : void 0) || toSnakeCase(collection.slug) || toSnakeCase(collection.name);
+}
+/**
+* The field key a database column is served and addressed under.
+*
+* A column has two names and they are not the same name. `author_id` is what
+* Postgres stores; `authorId` is the key on the JSON row, the key in the
+* generated Drizzle table, and the key a caller writes in `where` and
+* `orderBy`. Every place that starts from a column and has to reach a row, a
+* Drizzle table or a payload goes through here, so there is one answer rather
+* than one per call site — the two that disagreed put `displayName` and
+* `author_id` on the same API.
+*
+* A declared property is the authority when there is one, because its key *is*
+* the wire name and `columnName` is the only thing that ever renamed the
+* column:
+*
+*  1. an explicit `columnName` equal to this column;
+*  2. a property whose key is literally the column (an author who wrote
+*     `author_id:` meant `author_id` on the wire, and gets it);
+*  3. a property whose key snake-cases to the column, which is the default
+*     mapping — `authorId` → `author_id`.
+*
+* With no property in the way — a foreign key derived from a relation, which
+* usually has none — the name is derived: {@link toWireKey}.
+*
+* Note the fallback is *not* the column verbatim. That was the old behaviour
+* and it is precisely the defect: a derived foreign key reached the wire under
+* its column name while every hand-authored field beside it was camelCase.
+*/
+function fieldKeyForColumn(collection, column) {
+	const properties = collection?.properties;
+	if (properties) {
+		for (const [key, prop] of Object.entries(properties)) {
+			const columnName = prop?.columnName;
+			if (typeof columnName === "string" && columnName === column) return key;
+		}
+		for (const key of Object.keys(properties)) {
+			if (key === column) return key;
+			if (toSnakeCase(key) === column) return key;
+		}
+	}
+	return toWireKey(column);
+}
+/**
+* Look up a relation by key with forgiving normalization.
+*
+* `resolveCollectionRelations` stores each relation under a single canonical
+* key (no aliases). This helper tries the given key as-is, then falls back to
+* slug form (underscores → hyphens) and snake_case form (hyphens → underscores)
+* so that callers that receive a key from external input (URL path segments,
+* user-provided config, etc.) can still find the right entry.
+*/
+function findRelation(resolvedRelations, key) {
+	if (resolvedRelations[key]) return resolvedRelations[key];
+	const slugKey = key.replace(/_/g, "-");
+	if (slugKey !== key && resolvedRelations[slugKey]) return resolvedRelations[slugKey];
+	const snakeKey = key.replace(/-/g, "_");
+	if (snakeKey !== key && resolvedRelations[snakeKey]) return resolvedRelations[snakeKey];
+}
+/**
+* What a property's access rules actually are, with `excludeFromApi` expanded.
+*
+* Returns `undefined` when the property constrains nothing, so callers can skip
+* the whole check for the overwhelmingly common case.
+*/
+function effectiveAccess(property) {
+	if (!property) return void 0;
+	if (property.excludeFromApi) return EXCLUDED_ACCESS;
+	const access = property.access;
+	if (!access) return void 0;
+	if (access.read === void 0 && access.write === void 0) return void 0;
+	return access;
+}
+/** The rule `excludeFromApi: true` expands to. Frozen: it is shared by every caller. */
+var EXCLUDED_ACCESS = Object.freeze({
+	read: Object.freeze([]),
+	write: Object.freeze([])
+});
+/**
+* Does a caller holding `roles` satisfy `allowed`?
+*
+* Three cases, and the middle one is the one worth stating out loud:
+*
+* - `allowed` omitted — the field carries no rule of its own, so the row's
+*   policies have already answered. True.
+* - `allowed` empty — nobody, at any privilege, through any API. Not the admin,
+*   not the service key, not the trusted plane reading on a caller's behalf.
+*   This is what `excludeFromApi` has always meant on the read side, and
+*   collapsing the two spellings means the empty list has to keep meaning it.
+* - `allowed` non-empty — one of the named roles, or `admin`, or no viewer at
+*   all (the trusted server plane, which is not an API caller).
+*/
+function satisfies(allowed, viewer) {
+	if (allowed === void 0) return true;
+	if (allowed.length === 0) return false;
+	if (!viewer) return true;
+	const roles = viewer.roles;
+	if (!roles || roles.length === 0) return false;
+	return roles.includes("admin") || allowed.some((role) => roles.includes(role));
+}
+/** May this caller receive this field's value? */
+function canReadField(property, viewer) {
+	const access = effectiveAccess(property);
+	return access ? satisfies(access.read, viewer) : true;
+}
+/** May this caller set this field's value? */
+function canWriteField(property, viewer) {
+	const access = effectiveAccess(property);
+	return access ? satisfies(access.write, viewer) : true;
+}
+/**
+* The names on this collection a caller may not touch, in the two spellings a
+* caller can write them in.
+*
+* `declared` is the property keys, which is what has to leave a *known-fields*
+* set. `refused` is those plus the physical column names behind them: a caller
+* who knows the table can send `password_hash` as readily as `passwordHash`, and
+* a rule that only knew the wire name would be one rename away from useless.
+*
+* A restricted to-one relation takes its foreign key with it. `bandId: 7` names
+* the band exactly as `band: { id: 7 }` does, and the row carries the column
+* beside the relation — so a rule on the relation that left the key alone
+* withheld the value from the row and still let `?bandId=7` ask for it.
+*
+* `kind` picks which half of the rule is read; nothing else differs.
+*/
+function restrictedFieldNames(collection, viewer, kind) {
+	const allowed = kind === "read" ? canReadField : canWriteField;
+	return namesWhere(collection, (property) => !allowed(property, viewer));
+}
+/**
+* The names on this collection that the API does not have, in every spelling
+* a caller could write them in — the `excludeFromApi` properties, their column
+* names, and the foreign key of an excluded to-one relation.
+*
+* Not the same set as {@link restrictedFieldNames}. A field restricted by role
+* is public by name: OpenAPI and `list_collections` describe it, and refusing a
+* query on it with "not readable" tells the caller nothing they could not read
+* there. An `excludeFromApi` field is described nowhere, so a query naming one
+* has to be answered as a query naming a column that does not exist — anything
+* else confirms that it does.
+*/
+function apiHiddenFieldNames(collection) {
+	return namesWhere(collection, (property) => Boolean(property?.excludeFromApi)).refused;
+}
+function namesWhere(collection, restricted) {
+	const declared = [];
+	const refused = /* @__PURE__ */ new Set();
+	const properties = collection.properties ?? {};
+	let relations;
+	const restrict = (name) => {
+		if (name in properties && !declared.includes(name)) declared.push(name);
+		refused.add(name);
+	};
+	for (const [name, property] of Object.entries(properties)) {
+		if (!restricted(property)) continue;
+		restrict(name);
+		const columnName = property.columnName;
+		if (columnName) refused.add(columnName);
+		if (property.type === "relation") {
+			relations ??= resolveCollectionRelations(collection);
+			const relation = findRelation(relations, name);
+			if (relation?.kind === "belongsTo") {
+				restrict(fieldKeyForColumn(collection, relation.localKey));
+				refused.add(relation.localKey);
+			}
+		}
+	}
+	return {
+		declared,
+		refused
+	};
+}
+//#endregion
+//#region src/api/rest/soft-delete-params.ts
+/**
+* The two query parameters soft delete adds to the REST surface.
+*
+* Kept in their own module so the call sites in `query-parser.ts` and the
+* delete routes are a single line each: the parsing rules belong to soft
+* delete, not to the parser, and a rule spread across the two files that read
+* it is a rule that drifts.
+*/
+/** `?deleted=` — what to do about rows a soft delete has stamped. */
+var DELETED_QUERY_PARAM = "deleted";
+/** `?hard=` — ask for a real `DELETE` on a soft-delete collection. */
+var HARD_DELETE_QUERY_PARAM = "hard";
+/**
+* `?deleted=include|only` → the driver's `withDeleted`.
+*
+* Spelled `deleted` on the wire and `withDeleted` in the driver, deliberately:
+* the URL reads as a question about the rows (`?deleted=only` — "only the
+* deleted ones"), and the driver option reads as an instruction about the query.
+*
+* A value neither word is a 400 rather than a silent fallback to the default.
+* `?deleted=true` quietly hiding every deleted row is the worst of both: it
+* looks like it worked and answers the opposite question. Absent is the
+* default, which is "hide them".
+*/
+function parseWithDeleted(raw) {
+	if (raw === void 0 || raw === null || raw === "") return void 0;
+	const value = String(raw).trim().toLowerCase();
+	if (value === "include") return true;
+	if (value === "only") return "only";
+	throw ApiError.badRequest(`Invalid \`?${DELETED_QUERY_PARAM}=${String(raw)}\`. It takes 'include' (live rows and deleted ones) or 'only' (deleted rows alone). Omit it to see only the live rows.`, "INVALID_DELETED_PARAM");
+}
+/**
+* `?hard=true` → a real `DELETE` on a collection that soft-deletes.
+*
+* Needs no permission beyond the delete it replaces: it is the same verb, and a
+* second access-control surface for one operation is a second thing to get
+* wrong. What it changes is whether the row can be restored.
+*
+* Only the exact words `true` and `1` mean yes. Anything else is a 400, not a
+* "no" — a typo that silently soft-deletes when the caller asked to purge is a
+* caller who believes the data is gone.
+*/
+function parseHardDelete(raw) {
+	if (raw === void 0 || raw === null || raw === "") return false;
+	const value = String(raw).trim().toLowerCase();
+	if (value === "true" || value === "1") return true;
+	if (value === "false" || value === "0") return false;
+	throw ApiError.badRequest(`Invalid \`?${HARD_DELETE_QUERY_PARAM}=${String(raw)}\`. It takes 'true' or 'false'.`, "INVALID_HARD_PARAM");
+}
+//#endregion
+export { apiHiddenFieldNames as a, fieldKeyForColumn as c, isJunctionBackedRelation as d, isRelationRequired as f, toWireKey as g, resolveRelation as h, parseWithDeleted as i, findRelation as l, resolveCollectionRelations as m, HARD_DELETE_QUERY_PARAM as n, effectiveAccess as o, relationDeclaringProperty as p, parseHardDelete as r, restrictedFieldNames as s, DELETED_QUERY_PARAM as t, getTableName as u };
+
+//# sourceMappingURL=soft-delete-params-DfV3vVN5.js.map