@rebasepro/types 0.13.1-canary.gf57a27e → 0.14.0

package/src/types/collections.ts

@@ -211,11 +211,16 @@ export interface BaseCollectionConfig<M extends Record<string, unknown> = Record
      * Whether a write naming a field this collection does not declare is
      * rejected with a 400. Defaults to `true`.
      *
-     * Set to `false` to let unknown keys through to the database, which is what
-     * happened before this existed: a typo reached the INSERT and came back as
-     * a Postgres error about a column, or — where a column really does exist
-     * that the config never declared, populated by a trigger or a default —
-     * quietly worked. The second case is the reason for the escape hatch.
+     * Set to `false` where a column really does exist that the config never
+     * declared — populated by a trigger, or introspected rather than declared —
+     * and callers need to write it. The column still has to exist: the driver
+     * checks the key against the table's own columns whatever this is set to,
+     * because a key with no column behind it is not passed to the database and
+     * refused, it is dropped from the statement and answered 201.
+     *
+     * It does not let a typo through to Postgres for Postgres to judge. That is
+     * what this flag was documented as doing, and no such judgment ever
+     * happened.
      */
     strictWrites?: boolean;
 

package/src/types/filter-operators.ts

@@ -245,6 +245,22 @@ export const ALL_WHERE_FILTER_OPS: readonly WhereFilterOp[] = [
 /** All canonical operator strings for runtime validation. */
 const CANONICAL_OPS: ReadonlySet<string> = new Set<WhereFilterOp>(ALL_WHERE_FILTER_OPS);
 
+/**
+ * The REST table as a `Map`, because the key `toCanonicalOp` is handed comes
+ * off the wire.
+ *
+ * Indexed as a plain object, every `Object.prototype` member answered:
+ * `toCanonicalOp("valueOf")` returned the inherited *function* as though it
+ * were a `WhereFilterOp`, and every caller here treats a defined result as
+ * "known operator". Same defect the REST codec's own lookup tables were
+ * converted away from in `filter-dialect.ts`; this is the copy that survived
+ * one package over, and it now sits under the operator validation the REST
+ * parser does, which would otherwise have admitted `["constructor", x]`.
+ */
+const REST_OP_LOOKUP: ReadonlyMap<string, WhereFilterOp> = new Map<string, WhereFilterOp>(
+    Object.entries(REST_TO_CANONICAL) as [string, WhereFilterOp][]
+);
+
 /**
  * Resolve any operator string (canonical or REST short-code) to its
  * canonical `WhereFilterOp` form. Returns `undefined` for unknown operators.
@@ -257,5 +273,5 @@ const CANONICAL_OPS: ReadonlySet<string> = new Set<WhereFilterOp>(ALL_WHERE_FILT
  */
 export function toCanonicalOp(op: string): WhereFilterOp | undefined {
     if (CANONICAL_OPS.has(op)) return op as WhereFilterOp;
-    return (REST_TO_CANONICAL as Record<string, WhereFilterOp | undefined>)[op];
+    return REST_OP_LOOKUP.get(op);
 }

package/src/types/properties.ts

@@ -218,12 +218,19 @@ export interface BaseProperty<CustomProps = unknown> {
     validation?: PropertyValidationSchema;
 
     /**
-     * Never include this column in an API response.
+     * Never mention this column on the API surface, in either direction.
      *
      * For secrets the server must store and read but no client should ever
      * receive — password hashes, verification tokens. The value is still
      * written and queryable server-side; it is stripped from every row the API
-     * serves, for every caller, including admins and service keys.
+     * serves, for every caller, including admins and service keys, and it is
+     * absent from every generated description of the surface: the SDK's `Row`,
+     * `Insert` and `Update` types, and the OpenAPI schemas, filters and
+     * parameters.
+     *
+     * The generated types are a *description*, not a second enforcement point:
+     * the server still accepts such a field on a write, because that is how the
+     * value gets written in the first place. Nothing generated offers it.
      *
      * This is a server-side guarantee, unlike `admin.hideFromCollection`, which
      * only stops the admin panel from *rendering* a field and leaves it in the