@rebasepro/types 0.24.0 → 0.24.1-canary.gcb918fc

package/dist/controllers/data_driver.d.ts

@@ -21,10 +21,25 @@ export interface FetchOneProps<M extends Record<string, unknown> = Record<string
      */
     withDeleted?: boolean | "only";
 }
+/**
+ * What a row listener subscribes to: the row, and the relations each frame
+ * loads into it.
+ *
+ * @internal
+ */
+export type ListenOneTarget<M extends Record<string, unknown> = Record<string, unknown>> = FetchOneProps<M> & {
+    /**
+     * Relations to load into every frame, as {@link FetchCollectionProps.include}
+     * loads them into each row of a list. Without it a to-many relation
+     * is absent from each frame, and the admin's record form, opened by
+     * URL, showed it empty — so a save from it unlinked every related row.
+     */
+    include?: IncludeSpec;
+};
 /**
  * @internal
  */
-export type ListenOneProps<M extends Record<string, unknown> = Record<string, unknown>> = FetchOneProps<M> & {
+export type ListenOneProps<M extends Record<string, unknown> = Record<string, unknown>> = ListenOneTarget<M> & {
     onUpdate: (row: Record<string, unknown> | null) => void;
     onError?: (error: Error) => void;
 };
@@ -172,6 +187,13 @@ export type ListenCollectionProps<M extends Record<string, unknown> = Record<str
      * the two spellings then disagreed about what a page was.
      */
     page?: number;
+    /**
+     * Subscribe to the count alone: the server reads no rows, and each
+     * frame carries `rows: []` and `meta.total`. A server that predates it
+     * ignores the key and answers with the rows asked for (so ask for
+     * `limit: 1`) and the same `meta`. See `listenCount`.
+     */
+    countOnly?: boolean;
     onUpdate: (rows: Record<string, unknown>[], meta?: CollectionUpdateMeta) => void;
     onError?: (error: Error) => void;
 };
@@ -211,6 +233,39 @@ export interface SaveProps<M extends Record<string, unknown> = Record<string, un
      * targets rather than a 500 naming a constraint the caller never wrote.
      */
     onConflict?: readonly string[];
+    /**
+     * A check on the stored row an update addresses, run by the driver inside
+     * the write's own transaction, before any hook runs and before anything is
+     * written. See {@link RowPrecondition}. Honoured only by a driver that
+     * declares {@link DataDriver.checksRowPreconditions}; ignored on a create.
+     */
+    precondition?: RowPrecondition;
+}
+/**
+ * A check a caller makes on the row a write addresses, inside that write.
+ *
+ * The REST routes used to read the row in a transaction of their own before
+ * writing it, to answer a missing row with their 404 and to compare
+ * `If-Match`. Two transactions: the read loaded every declared relation of the
+ * row, and two writes carrying the same tag could both pass the comparison,
+ * because neither saw the other's write before making its own.
+ *
+ * @internal
+ */
+export interface RowPrecondition {
+    /**
+     * Lock the row before it is read, so no other write to it can land between
+     * this check and this write. A conditional write (`If-Match`) sets it; a
+     * plain existence check does not need it and does not pay for it.
+     */
+    lock?: boolean;
+    /**
+     * Judge the row as this caller reads it at the address written (their
+     * policies, their `beforeQuery`, the trash hidden unless the write is a
+     * restore or a purge) — `undefined` when there is none. Throw to refuse the
+     * write; nothing has been written when this runs.
+     */
+    check(stored: Record<string, unknown> | undefined): void | Promise<void>;
 }
 /**
  * @internal
@@ -277,6 +332,12 @@ export interface DeleteProps<M extends Record<string, unknown> = Record<string,
      * already this one.
      */
     hard?: boolean;
+    /**
+     * A check on the stored row, inside the delete's own transaction, before
+     * any hook runs. See {@link RowPrecondition}. Honoured only by a driver
+     * that declares {@link DataDriver.checksRowPreconditions}.
+     */
+    precondition?: RowPrecondition;
 }
 /**
  * @internal
@@ -517,6 +578,21 @@ export interface DataDriver {
      * Count the number of entities in a collection
      */
     count?<M extends Record<string, unknown> = Record<string, unknown>>(props: FetchCollectionProps<M>): Promise<number>;
+    /**
+     * Run several reads as one: `work` is handed a driver whose reads all go
+     * through a single read-only transaction that reads one snapshot, under
+     * this driver's identity and row-level security, and its result is
+     * returned.
+     *
+     * A list page is a read and a count, and each was a transaction of its
+     * own — the second checkout, `BEGIN`, identity setup and `COMMIT` cost as
+     * many round trips as the count itself. On one snapshot the two also
+     * agree: `meta.total` describes the rows the page was taken from, and an
+     * `ETag` the row the body was rendered from.
+     *
+     * Optional: a driver without it is called directly, read by read.
+     */
+    readTogether?<T>(work: (driver: DataDriver) => Promise<T>): Promise<T>;
     /**
      * Check if the given filter combination is valid
      * @param props
@@ -548,6 +624,14 @@ export interface DataDriver {
      * `fetchCollection` pipeline, enabling include-aware eager-loading.
      */
     restFetchService?: RestFetchService;
+    /**
+     * This driver reads the row an update or a delete addresses inside that
+     * write's own transaction, and runs {@link SaveProps.precondition} /
+     * {@link DeleteProps.precondition} on it there. A caller may then leave its
+     * own read of the row out. A driver without it ignores the precondition,
+     * so a caller must read the row itself.
+     */
+    readonly checksRowPreconditions?: boolean;
     /**
      * Return the admin capabilities of this driver.
      * @see SQLAdmin

package/dist/controllers/index.d.ts

@@ -4,5 +4,6 @@ export * from "./data.js";
 export * from "./data_driver.js";
 export * from "./effective_role.js";
 export * from "./storage.js";
+export * from "./storage-references.js";
 export * from "./email.js";
 export * from "./client.js";

package/dist/controllers/storage-references.d.ts

@@ -0,0 +1,114 @@
+import type { StorageSource } from "./storage.js";
+/**
+ * The scheme of a **storage reference**: a stored object named inside text.
+ *
+ * Text that embeds a file — a markdown body above all — cannot hold a private
+ * object's URL: that URL carries a download token which expires in minutes,
+ * after which every reader of the text gets a 401 for an image that is still in
+ * the bucket. It holds a reference instead,
+ * `rebase-storage:posts/cover.png` (`?storageId=media` for a named source),
+ * and whoever renders the text exchanges each reference for a fresh URL with
+ * {@link resolveStorageReferences} — `resolveStorageReferences(text, client)`
+ * from `@rebasepro/client` on a site.
+ *
+ * @group Models
+ */
+export declare const STORAGE_REFERENCE_SCHEME = "rebase-storage:";
+/**
+ * The object a storage reference names.
+ *
+ * @group Models
+ */
+export interface StorageReferenceTarget {
+    /** The object's key in its storage source. */
+    key: string;
+    /** The named storage source holding it. Absent for the default source. */
+    storageId?: string;
+}
+/**
+ * The reference for an object — what text stores in place of its URL.
+ *
+ * Every part is percent-encoded, so the reference contains no space,
+ * parenthesis or quote and survives as one markdown link destination whatever
+ * the file was called.
+ *
+ * @group Models
+ */
+export declare function storageReference(key: string, storageId?: string | null): string;
+/**
+ * Whether a string — an image's `src`, a link's `href` — is a storage reference.
+ *
+ * @group Models
+ */
+export declare function isStorageReference(value: string | null | undefined): value is string;
+/**
+ * The object a storage reference names, or `null` for anything else — a URL, a
+ * bare key, or a reference whose key would climb out of its prefix.
+ *
+ * @group Models
+ */
+export declare function parseStorageReference(value: string | null | undefined): StorageReferenceTarget | null;
+/**
+ * The object a private file's download URL was minted for, or `null` for any
+ * other URL.
+ *
+ * Text written before storage references stored such URLs —
+ * `…/storage/file/posts/cover.png?token=…` — and their tokens expired minutes
+ * later. The token still names the object it was minted for, so the URL can be
+ * traded for a fresh one, or for a reference. Read without verifying the
+ * token: it grants nothing here, it only says which object is meant, and the
+ * key in the URL must agree with it. Host-agnostic, since a URL written
+ * through one origin may be read through another.
+ *
+ * @group Models
+ */
+export declare function storageTargetOfDownloadUrl(url: string): StorageReferenceTarget | null;
+/**
+ * Every object `text` names: its storage references, and the private files'
+ * download URLs saved in it before references existed. An object named more
+ * than once may be listed more than once.
+ *
+ * @group Models
+ */
+export declare function storageTargetsInText(text: string): StorageReferenceTarget[];
+/**
+ * `text` with every private file's download URL replaced by the storage
+ * reference for its object — for rewriting text saved before references, so
+ * it stores what new text stores. Any other URL is left as it is.
+ *
+ * @group Models
+ */
+export declare function storageReferencesForDownloadUrls(text: string): string;
+/**
+ * Where {@link resolveStorageReferences} gets URLs from: a function that
+ * answers one, or anything shaped like a Rebase client — its `storage` for the
+ * default source and `createStorageSource(id)` for a named one.
+ *
+ * @group Models
+ */
+export type StorageReferenceResolver = ((target: StorageReferenceTarget) => Promise<string | null | undefined>) | {
+    storage?: StorageSource;
+    createStorageSource?(storageId: string): StorageSource;
+};
+/**
+ * Exchange every storage reference in `text` for a URL, at the moment the text
+ * is rendered.
+ *
+ * ```ts
+ * const html = markdown.render(await resolveStorageReferences(post.body, client));
+ * ```
+ *
+ * Each distinct object is asked for once — `getSignedUrl(key)` on its source —
+ * so a private object gets a freshly minted download URL every time the text is
+ * rendered. A reference that cannot be resolved (no such object, an unknown
+ * source) is left as it was, so a missing object reads as a missing image
+ * rather than as a failed render.
+ *
+ * A private file's download URL saved in the text before references existed
+ * is renewed the same way: its expired token still names the object (see
+ * {@link storageTargetOfDownloadUrl}). One that cannot be resolved is left as
+ * it was.
+ *
+ * @group Models
+ */
+export declare function resolveStorageReferences(text: string, from: StorageReferenceResolver): Promise<string>;

package/dist/controllers/storage.d.ts

@@ -54,89 +54,12 @@ export declare function isPublicStoragePath(path: string | null | undefined): bo
  * so the key `default/photo.png` sent as it is names the root `photo.png`:
  * {@link defaultBucketPath} is the spelling that names the key itself.
  *
- * Shared by every storage source that talks to those routes — the SDK's and
- * the admin panel's `useBackendStorageSource` — so they address an object alike.
+ * Shared by every storage source that talks to those routes, so they address
+ * an object alike.
  *
  * @group Models
  */
 export declare function storageObjectPath(keyOrUrl: string, bucket?: string): string;
-/**
- * The scheme of a **storage reference**: a stored object named inside text.
- *
- * Text that embeds a file — a markdown body above all — cannot hold a private
- * object's URL: that URL carries a download token which expires in minutes,
- * after which every reader of the text gets a 401 for an image that is still in
- * the bucket. It holds a reference instead,
- * `rebase-storage:posts/cover.png` (`?storageId=media` for a named source),
- * and whoever renders the text exchanges each reference for a fresh URL with
- * {@link resolveStorageReferences} — `resolveStorageReferences(text, client)`
- * from `@rebasepro/client` on a site.
- *
- * @group Models
- */
-export declare const STORAGE_REFERENCE_SCHEME = "rebase-storage:";
-/**
- * The object a storage reference names.
- *
- * @group Models
- */
-export interface StorageReferenceTarget {
-    /** The object's key in its storage source. */
-    key: string;
-    /** The named storage source holding it. Absent for the default source. */
-    storageId?: string;
-}
-/**
- * The reference for an object — what text stores in place of its URL.
- *
- * Every part is percent-encoded, so the reference contains no space,
- * parenthesis or quote and survives as one markdown link destination whatever
- * the file was called.
- *
- * @group Models
- */
-export declare function storageReference(key: string, storageId?: string | null): string;
-/**
- * Whether a string — an image's `src`, a link's `href` — is a storage reference.
- *
- * @group Models
- */
-export declare function isStorageReference(value: string | null | undefined): value is string;
-/**
- * The object a storage reference names, or `null` for anything else — a URL, a
- * bare key, or a reference whose key would climb out of its prefix.
- *
- * @group Models
- */
-export declare function parseStorageReference(value: string | null | undefined): StorageReferenceTarget | null;
-/**
- * Where {@link resolveStorageReferences} gets URLs from: a function that
- * answers one, or anything shaped like a Rebase client — its `storage` for the
- * default source and `createStorageSource(id)` for a named one.
- *
- * @group Models
- */
-export type StorageReferenceResolver = ((target: StorageReferenceTarget) => Promise<string | null | undefined>) | {
-    storage?: StorageSource;
-    createStorageSource?(storageId: string): StorageSource;
-};
-/**
- * Exchange every storage reference in `text` for a URL, at the moment the text
- * is rendered.
- *
- * ```ts
- * const html = markdown.render(await resolveStorageReferences(post.body, client));
- * ```
- *
- * Each distinct object is asked for once — `getSignedUrl(key)` on its source —
- * so a private object gets a freshly minted download URL every time the text is
- * rendered. A reference that cannot be resolved (no such object, an unknown
- * source) is left as it was, so a missing object reads as a missing image
- * rather than as a failed render.
- *
- * @group Models
- */
-export declare function resolveStorageReferences(text: string, from: StorageReferenceResolver): Promise<string>;
 /**
  * @group Models
  */
@@ -356,4 +279,22 @@ export declare interface StorageReference {
      * this reference is the root.
      */
     parent: StorageReference | null;
+    /**
+     * The object's size in bytes, as the listing read it. Set on the objects
+     * of a listing from the built-in local, S3 and GCS sources; absent on
+     * folders and from a source that cannot list it without a request per
+     * object. Since 0.24.
+     */
+    size?: number;
+    /**
+     * When the object was last written, as an ISO 8601 timestamp — set where
+     * {@link size} is.
+     */
+    updated?: string;
+    /**
+     * The object's stored content type, as the listing read it: set by local
+     * storage and GCS. An S3 listing does not carry it, so on S3 it is absent
+     * and `getSignedUrl()` (or the metadata route) still says.
+     */
+    contentType?: string;
 }

package/dist/index.es.js

@@ -855,6 +855,23 @@ var RELEVANCE_SORT_FIELD = "_score";
 * @group Models
 */
 var JUNCTION_PIVOT_KEY = "_pivot";
+/**
+* The key a row carries the totals of its counted relations under.
+*
+* An include that asks for a count — `include: { tags: { limit: 4, count: true } }`
+* — serves, beside the (capped) `tags`, how many related rows there are in all:
+* `{ id: 1, tags: [ …4 rows ], _count: { tags: 37 } }`. One object per row,
+* keyed by relation name, so counting a second relation adds a key rather than
+* a second top-level name.
+*
+* Leading underscore, like {@link JUNCTION_PIVOT_KEY} and `_matches`: it
+* describes the read, not the record, and no column or form writes it. A
+* collection with a property of this name cannot ask for a count — the read
+* answers 400 rather than writing over the column.
+*
+* @group Models
+*/
+var INCLUDE_COUNT_KEY = "_count";
 /** @group Models */
 function hasForeignKeyOnTarget(relation) {
 	return relation.kind === "hasOne" || relation.kind === "hasMany";
@@ -1865,6 +1882,7 @@ registerResourceKind({
 amendResourceKind("database", { envBases: [
 	"DATABASE_URL",
 	"DATABASE_READ_URL",
+	"DATABASE_DIRECT_URL",
 	"ADMIN_CONNECTION_STRING",
 	"REBASE_DRIVER",
 	"DB_POOL_MAX",
@@ -3221,10 +3239,13 @@ var BATCH_REF_KEY = "$ref";
 * one, which is the case worth catching.
 *
 * Any `$`-prefixed key counts, because `{ $increment: 1 }` written to a number
-* column as a JSON document is the failure this exists to prevent. No collection
-* can declare a column whose value legitimately has a key beginning with `$`: a
-* `map` property's sub-keys are declared, and `$` is not valid in the
-* identifiers the DDL generators emit.
+* column as a JSON document is the failure this exists to prevent.
+*
+* Except on a `map` (pass `propertyType`): a map's value is a JSON document,
+* and one may legitimately carry `$` keys — a JSON Schema's `$schema`, a
+* MongoDB-style export. There, only a single-key object whose key is one of
+* {@link FIELD_OPERATORS} is an operation, and anything else is data. A caller
+* that does not know the property type gets the strict reading.
 *
 * The one exception is `{ $ref: … }`, the batch's backward reference. It stands
 * where a *value* goes and is resolved to one before the row is written, so it
@@ -3233,15 +3254,16 @@ var BATCH_REF_KEY = "$ref";
 *
 * @group Data
 */
-function isFieldOperation(value) {
+function isFieldOperation(value, propertyType) {
 	if (typeof value !== "object" || value === null || Array.isArray(value) || value instanceof Date) return false;
 	const keys = Object.keys(value);
 	if (keys.length === 1 && keys[0] === "$ref") return false;
+	if (propertyType === "map") return keys.length === 1 && FIELD_OPERATORS.includes(keys[0]);
 	return keys.some((key) => key.startsWith("$"));
 }
 /** True when any value in a write payload is (or is attempting to be) one. @group Data */
 function hasFieldOperation(values) {
-	return !!values && Object.values(values).some(isFieldOperation);
+	return !!values && Object.values(values).some((value) => isFieldOperation(value));
 }
 //#endregion
 //#region src/controllers/data_driver.ts
@@ -3366,8 +3388,8 @@ function isPublicStoragePath(path) {
 * so the key `default/photo.png` sent as it is names the root `photo.png`:
 * {@link defaultBucketPath} is the spelling that names the key itself.
 *
-* Shared by every storage source that talks to those routes — the SDK's and
-* the admin panel's `useBackendStorageSource` — so they address an object alike.
+* Shared by every storage source that talks to those routes, so they address
+* an object alike.
 *
 * @group Models
 */
@@ -3399,6 +3421,8 @@ function defaultBucketPath(key) {
 	const segments = key.split("/");
 	return segments.length > 1 && segments[0].toLowerCase() === "default" ? `default/${key}` : key;
 }
+//#endregion
+//#region src/controllers/storage-references.ts
 /**
 * The scheme of a **storage reference**: a stored object named inside text.
 *
@@ -3474,6 +3498,99 @@ function parseStorageReference(value) {
 		storageId
 	} : { key };
 }
+/** The JSON in a JWT's payload segment, or `undefined` for anything else. */
+function jwtPayload(token) {
+	const segments = token.split(".");
+	if (segments.length !== 3) return void 0;
+	try {
+		const base64 = segments[1].replace(/-/g, "+").replace(/_/g, "/");
+		const binary = atob(base64.padEnd(Math.ceil(base64.length / 4) * 4, "="));
+		const json = new TextDecoder().decode(Uint8Array.from(binary, (c) => c.charCodeAt(0)));
+		const payload = JSON.parse(json);
+		return payload && typeof payload === "object" && !Array.isArray(payload) ? payload : void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* The object a private file's download URL was minted for, or `null` for any
+* other URL.
+*
+* Text written before storage references stored such URLs —
+* `…/storage/file/posts/cover.png?token=…` — and their tokens expired minutes
+* later. The token still names the object it was minted for, so the URL can be
+* traded for a fresh one, or for a reference. Read without verifying the
+* token: it grants nothing here, it only says which object is meant, and the
+* key in the URL must agree with it. Host-agnostic, since a URL written
+* through one origin may be read through another.
+*
+* @group Models
+*/
+function storageTargetOfDownloadUrl(url) {
+	let parsed;
+	try {
+		parsed = new URL(url, "http://relative.invalid");
+	} catch {
+		return null;
+	}
+	const at = parsed.pathname.indexOf("/storage/file/");
+	const token = parsed.searchParams.get("token");
+	if (at === -1 || !token) return null;
+	let key;
+	try {
+		key = parsed.pathname.slice(at + 14).split("/").map(decodeURIComponent).join("/");
+	} catch {
+		return null;
+	}
+	if (!key || key.split("/").some((segment) => segment === "..")) return null;
+	const payload = jwtPayload(token);
+	if (payload?.purpose !== "file-read" || typeof payload.path !== "string") return null;
+	const slash = payload.path.indexOf("/");
+	if (payload.path !== key && payload.path.slice(slash + 1) !== key) return null;
+	const named = parsed.searchParams.get("storageId") ?? (typeof payload.storageId === "string" ? payload.storageId : void 0);
+	return named && named !== "(default)" ? {
+		key,
+		storageId: named
+	} : { key };
+}
+/**
+* A private file's download URL as it may appear in text. Parentheses are
+* allowed in the path, where an unencoded file name puts them; the query, a
+* token, has none, so the match ends where a markdown destination does.
+*/
+var DOWNLOAD_URL_PATTERN = /(?:https?:\/\/[^\s()<>"'\]]+)?\/storage\/file\/[^\s<>"'?#\]]+\?[^\s()<>"'#\]]*/g;
+/** Each download URL in `text` that names an object, with its reference. */
+function downloadUrlsIn(text) {
+	const found = /* @__PURE__ */ new Map();
+	if (!text.includes("/storage/file/")) return found;
+	for (const url of text.match(DOWNLOAD_URL_PATTERN) ?? []) {
+		const target = storageTargetOfDownloadUrl(url);
+		if (target) found.set(url, storageReference(target.key, target.storageId));
+	}
+	return found;
+}
+/**
+* Every object `text` names: its storage references, and the private files'
+* download URLs saved in it before references existed. An object named more
+* than once may be listed more than once.
+*
+* @group Models
+*/
+function storageTargetsInText(text) {
+	return [...text.includes("rebase-storage:") ? text.match(STORAGE_REFERENCE_PATTERN) ?? [] : [], ...downloadUrlsIn(text).values()].map((reference) => parseStorageReference(reference)).filter((target) => target !== null);
+}
+/**
+* `text` with every private file's download URL replaced by the storage
+* reference for its object — for rewriting text saved before references, so
+* it stores what new text stores. Any other URL is left as it is.
+*
+* @group Models
+*/
+function storageReferencesForDownloadUrls(text) {
+	const urls = downloadUrlsIn(text);
+	if (urls.size === 0) return text;
+	return text.replace(DOWNLOAD_URL_PATTERN, (url) => urls.get(url) ?? url);
+}
 /**
 * Exchange every storage reference in `text` for a URL, at the moment the text
 * is rendered.
@@ -3488,12 +3605,19 @@ function parseStorageReference(value) {
 * source) is left as it was, so a missing object reads as a missing image
 * rather than as a failed render.
 *
+* A private file's download URL saved in the text before references existed
+* is renewed the same way: its expired token still names the object (see
+* {@link storageTargetOfDownloadUrl}). One that cannot be resolved is left as
+* it was.
+*
 * @group Models
 */
 async function resolveStorageReferences(text, from) {
-	if (!text || !text.includes("rebase-storage:")) return text;
+	if (!text) return text;
+	const downloadUrls = downloadUrlsIn(text);
+	if (!text.includes("rebase-storage:") && downloadUrls.size === 0) return text;
 	const resolve = typeof from === "function" ? from : resolverFromSources(from);
-	const references = new Set(text.match(STORAGE_REFERENCE_PATTERN) ?? []);
+	const references = /* @__PURE__ */ new Set([...text.match(STORAGE_REFERENCE_PATTERN) ?? [], ...downloadUrls.values()]);
 	const urls = /* @__PURE__ */ new Map();
 	await Promise.all([...references].map(async (reference) => {
 		const target = parseStorageReference(reference);
@@ -3504,7 +3628,11 @@ async function resolveStorageReferences(text, from) {
 		} catch {}
 	}));
 	if (urls.size === 0) return text;
-	return text.replace(STORAGE_REFERENCE_PATTERN, (reference) => {
+	return (downloadUrls.size === 0 ? text : text.replace(DOWNLOAD_URL_PATTERN, (saved) => {
+		const reference = downloadUrls.get(saved);
+		const url = reference === void 0 ? void 0 : urls.get(reference);
+		return url === void 0 ? saved : asLinkDestination(url);
+	})).replace(STORAGE_REFERENCE_PATTERN, (reference) => {
 		const url = urls.get(reference);
 		return url === void 0 ? reference : asLinkDestination(url);
 	});
@@ -3531,6 +3659,6 @@ function resolverFromSources(client) {
 	};
 }
 //#endregion
-export { ADMIN_COLLECTION_KEYS, ADMIN_PROPERTY_KEYS, ADMIN_ROLE, ADMIN_SCOPES, ALL_WHERE_FILTER_OPS, ANONYMOUS_USER_ID, ANONYMOUS_USER_IDS, BATCH_REF_KEY, BUILT_IN_SCOPES, BUILT_IN_SCOPE_DESCRIPTIONS, BUNDLE_FORMAT_VERSION, CANONICAL_TO_REST, DATA_PLANE_SCOPES, DEFAULT_CAPABILITIES, DEFAULT_COMMIT_PATHS, DEFAULT_DATA_SOURCE_KEY, DEFAULT_FILTERABLE_RELATION_KINDS, DEFAULT_FUZZY_THRESHOLD, DEFAULT_LIST_LIMIT, DEFAULT_RESOURCE_KEY, DEFAULT_SEARCH_COLUMN, DEFAULT_SEARCH_LANGUAGE, DEFAULT_SEARCH_MODE, DEFAULT_SEARCH_WEIGHT, DEFAULT_STORAGE_SOURCE_KEY, DEFAULT_TENANT_BYPASS_ROLES, DEFAULT_VECTOR_LIST_LIMIT, EMPTY_ACCESS_MODEL, EntityReference, EntityRelation, FIELD_OPERATORS, FIREBASE_CAPABILITIES, GeoPoint, IMPERSONATE_HEADER, JUNCTION_PIVOT_KEY, KEY_MANAGEMENT_SCOPES, LEGACY_RLS_JWT_SQL, LEGACY_RLS_ROLES_SQL, LEGACY_RLS_SCHEMA, LEGACY_RLS_UID_SQL, LIST_OPS, ListLimitError, MAX_INCLUDE_DEPTH, MAX_LIST_LIMIT, MONGODB_CAPABILITIES, NULL_OPS, POSTGRES_CAPABILITIES, PUBLIC_STORAGE_PREFIX, REBASE_SCHEMA, RELEVANCE_SORT_FIELD, RESERVED_BACKEND_PREFIXES, RESOURCE_GRAPH_VERSION, REST_TO_CANONICAL, RLS_IS_ANONYMOUS_SQL, RLS_JWT_SQL, RLS_ROLES_SQL, RLS_UID_SQL, RUNTIME_CONTRACT_VERSION, RUNTIME_ONLY_COLLECTION_KEYS, RebaseApiError, RebaseClientError, SCHEMA_VERSION_HEADER, SCOPE_TARGETS, STORAGE_REFERENCE_SCHEME, Vector, amendResourceKind, applyCollectionPatch, bucket, buildResourceGraph, canonicalSchemaPayload, collectionPatchProblems, computeSchemaVersion, database, declareCron, declareFunction, declareResource, declaredDataSources, declaredDatabaseExtensions, declaredQueueConsumers, declaredResources, declaredStorageSources, declaredSubscriptions, describeScope, deserializeCollections, diffCollections, diffJsonValues, encodeRelationAggregateSort, envBasesForResource, findEnvSuffixCollision, findStorageSuffixCollision, getCollectionDataPath, getDataSourceCapabilities, getDeclaredSubcollections, hasAdminRole, hasFieldOperation, hasForeignKeyOnTarget, intersectScopes, isAdminScope, isAnonymousUid, isBranchAdmin, isBuiltInScope, isChannelBusInstance, isCollectionPatch, isDataPlaneScope, isDocumentAdmin, isFieldOperation, isFirebaseCollectionConfig, isLazyComponentRef, isManyToMany, isMongoDBCollectionConfig, isPostgresCollectionConfig, isPublicStorageKey, isPublicStoragePath, isRelationAggregateSort, isRelationalCollectionConfig, isResourceHandle, isSQLAdmin, isSchemaAdmin, isSchemaEditingAdmin, isSerializedCollectionRef, isStorageReference, isTenantClaimSource, isTenantMembershipSource, isToMany, isUnsupported, isValidAppHost, isValidEngine, knownScopes, nestAdminCollectionKeys, nestAdminKeysOf, nestAdminPropertyKeys, nestCollectionPatchPaths, parseAppAddress, parseEnvBoolean, parseRelationAggregateSort, parseScope, parseStorageReference, policy, queue, registerDataSourceCapabilities, registerResourceKind, reservedPrefixFor, resetDeclaredQueueConsumers, resetDeclaredResources, resetDeclaredSubscriptions, resolveClientListLimit, resolveResourceRefs, resolveStorageReferences, resourceEnvSuffix, resourceId, resourceKeyOf, resourceKind, resourceKinds, resourceToDataSource, resourceToStorageSource, rewriteLegacyRlsFunctions, runtimeOnlyKeyIn, scopeAcceptsTarget, scopeGrants, scopeGrantsAny, scopeTargets, scopesBeyond, scopesForRoles, serializeCollections, setQueueRuntime, setTopicRuntime, sortKeyToString, storageEnvSuffix, storageObjectPath, storageReference, summarizeRoles, summarizeScopes, toCanonicalOp, toCollectionJson, topic, unsupportedMethod, usesLegacyRlsFunctions, validateScopes };
+export { ADMIN_COLLECTION_KEYS, ADMIN_PROPERTY_KEYS, ADMIN_ROLE, ADMIN_SCOPES, ALL_WHERE_FILTER_OPS, ANONYMOUS_USER_ID, ANONYMOUS_USER_IDS, BATCH_REF_KEY, BUILT_IN_SCOPES, BUILT_IN_SCOPE_DESCRIPTIONS, BUNDLE_FORMAT_VERSION, CANONICAL_TO_REST, DATA_PLANE_SCOPES, DEFAULT_CAPABILITIES, DEFAULT_COMMIT_PATHS, DEFAULT_DATA_SOURCE_KEY, DEFAULT_FILTERABLE_RELATION_KINDS, DEFAULT_FUZZY_THRESHOLD, DEFAULT_LIST_LIMIT, DEFAULT_RESOURCE_KEY, DEFAULT_SEARCH_COLUMN, DEFAULT_SEARCH_LANGUAGE, DEFAULT_SEARCH_MODE, DEFAULT_SEARCH_WEIGHT, DEFAULT_STORAGE_SOURCE_KEY, DEFAULT_TENANT_BYPASS_ROLES, DEFAULT_VECTOR_LIST_LIMIT, EMPTY_ACCESS_MODEL, EntityReference, EntityRelation, FIELD_OPERATORS, FIREBASE_CAPABILITIES, GeoPoint, IMPERSONATE_HEADER, INCLUDE_COUNT_KEY, JUNCTION_PIVOT_KEY, KEY_MANAGEMENT_SCOPES, LEGACY_RLS_JWT_SQL, LEGACY_RLS_ROLES_SQL, LEGACY_RLS_SCHEMA, LEGACY_RLS_UID_SQL, LIST_OPS, ListLimitError, MAX_INCLUDE_DEPTH, MAX_LIST_LIMIT, MONGODB_CAPABILITIES, NULL_OPS, POSTGRES_CAPABILITIES, PUBLIC_STORAGE_PREFIX, REBASE_SCHEMA, RELEVANCE_SORT_FIELD, RESERVED_BACKEND_PREFIXES, RESOURCE_GRAPH_VERSION, REST_TO_CANONICAL, RLS_IS_ANONYMOUS_SQL, RLS_JWT_SQL, RLS_ROLES_SQL, RLS_UID_SQL, RUNTIME_CONTRACT_VERSION, RUNTIME_ONLY_COLLECTION_KEYS, RebaseApiError, RebaseClientError, SCHEMA_VERSION_HEADER, SCOPE_TARGETS, STORAGE_REFERENCE_SCHEME, Vector, amendResourceKind, applyCollectionPatch, bucket, buildResourceGraph, canonicalSchemaPayload, collectionPatchProblems, computeSchemaVersion, database, declareCron, declareFunction, declareResource, declaredDataSources, declaredDatabaseExtensions, declaredQueueConsumers, declaredResources, declaredStorageSources, declaredSubscriptions, describeScope, deserializeCollections, diffCollections, diffJsonValues, encodeRelationAggregateSort, envBasesForResource, findEnvSuffixCollision, findStorageSuffixCollision, getCollectionDataPath, getDataSourceCapabilities, getDeclaredSubcollections, hasAdminRole, hasFieldOperation, hasForeignKeyOnTarget, intersectScopes, isAdminScope, isAnonymousUid, isBranchAdmin, isBuiltInScope, isChannelBusInstance, isCollectionPatch, isDataPlaneScope, isDocumentAdmin, isFieldOperation, isFirebaseCollectionConfig, isLazyComponentRef, isManyToMany, isMongoDBCollectionConfig, isPostgresCollectionConfig, isPublicStorageKey, isPublicStoragePath, isRelationAggregateSort, isRelationalCollectionConfig, isResourceHandle, isSQLAdmin, isSchemaAdmin, isSchemaEditingAdmin, isSerializedCollectionRef, isStorageReference, isTenantClaimSource, isTenantMembershipSource, isToMany, isUnsupported, isValidAppHost, isValidEngine, knownScopes, nestAdminCollectionKeys, nestAdminKeysOf, nestAdminPropertyKeys, nestCollectionPatchPaths, parseAppAddress, parseEnvBoolean, parseRelationAggregateSort, parseScope, parseStorageReference, policy, queue, registerDataSourceCapabilities, registerResourceKind, reservedPrefixFor, resetDeclaredQueueConsumers, resetDeclaredResources, resetDeclaredSubscriptions, resolveClientListLimit, resolveResourceRefs, resolveStorageReferences, resourceEnvSuffix, resourceId, resourceKeyOf, resourceKind, resourceKinds, resourceToDataSource, resourceToStorageSource, rewriteLegacyRlsFunctions, runtimeOnlyKeyIn, scopeAcceptsTarget, scopeGrants, scopeGrantsAny, scopeTargets, scopesBeyond, scopesForRoles, serializeCollections, setQueueRuntime, setTopicRuntime, sortKeyToString, storageEnvSuffix, storageObjectPath, storageReference, storageReferencesForDownloadUrls, storageTargetOfDownloadUrl, storageTargetsInText, summarizeRoles, summarizeScopes, toCanonicalOp, toCollectionJson, topic, unsupportedMethod, usesLegacyRlsFunctions, validateScopes };
 
 //# sourceMappingURL=index.es.js.map