@rebasepro/agent-skills 0.7.0 → 0.9.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Rebase
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/package.json

@@ -1,9 +1,14 @@
 {
   "name": "@rebasepro/agent-skills",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "private": false,
   "description": "Bundled AI agent skills for Rebase",
   "type": "module",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/rebasepro/rebase.git",
+    "directory": "rebase-agent-skills"
+  },
   "files": [
     "skills/"
   ],
@@ -11,5 +16,6 @@
     ".": "./package.json",
     "./package.json": "./package.json",
     "./skills": "./skills/"
-  }
-}
+  },
+  "scripts": {}
+}

package/skills/rebase-admin/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: rebase-admin
-description: Guide for navigating the Rebase admin CMS, opening entities in side drawers, building URLs, embedding collection panels, using the collection registry, and programmatic navigation. Use this skill when an agent or user needs to navigate to a collection view, open an entity in the side panel/drawer, build admin URLs, embed a collection inside a custom page, use the entity selection dialog, or access CMS-specific controllers.
+description: Guide for navigating the Rebase admin CMS, opening entities in side drawers, building URLs, embedding collection panels, using the collection registry, and programmatic navigation. Use this skill when an agent or user needs to navigate to a collection view, open a entity in the side panel/drawer, build admin URLs, embed a collection inside a custom page, use the entity selection dialog, or access CMS-specific controllers.
 ---
 
 # Rebase Admin (`@rebasepro/admin`)
@@ -13,12 +13,12 @@ The `@rebasepro/admin` package provides the CMS layer for Rebase. It handles col
 
 | Task | Hook / Component | Package |
 |------|-----------------|---------|
-| Open entity in side drawer | `useSideEntityController()` | `@rebasepro/admin` |
+| Open entity in side drawer | `useSidePanel()` | `@rebasepro/admin` |
 | Navigate to a collection view | `useUrlController()` | `@rebasepro/admin` |
 | Look up a collection by slug | `useCollectionRegistryController()` | `@rebasepro/admin` |
 | Embed a collection in a custom page | `<CollectionPanel>` | `@rebasepro/admin` |
 | Add custom top-level views | `<RebaseCMS views={[...]}>` | `@rebasepro/admin` |
-| Open an entity selection dialog | `useEntitySelectionDialog()` | `@rebasepro/admin` |
+| Open a entity selection dialog | `useSelectionDialog()` | `@rebasepro/admin` |
 | Open a custom side dialog | `useSideDialogsController()` | `@rebasepro/admin` |
 | Set breadcrumbs | `useBreadcrumbsController()` | `@rebasepro/admin` |
 | Access full CMS context | `useCMSContext()` | `@rebasepro/admin` |
@@ -28,16 +28,16 @@ The `@rebasepro/admin` package provides the CMS layer for Rebase. It handles col
 
 ## 1. Opening Entities in the Side Drawer
 
-Use `useSideEntityController()` to open, replace, or close entity side panels (the sliding drawer that shows entity forms).
+Use `useSidePanel()` to open, replace, or close entity side panels (the sliding drawer that shows entity forms).
 
 ```typescript
-import { useSideEntityController } from "@rebasepro/admin";
+import { useSidePanel } from "@rebasepro/admin";
 ```
 
-### SideEntityController Interface
+### SidePanelController Interface
 
 ```typescript
-interface SideEntityController {
+interface SidePanelController {
     /** Close the last (topmost) panel */
     close: () => void;
 
@@ -69,7 +69,7 @@ interface EntitySidePanelProps<M extends Record<string, unknown> = Record<string
     width?: number | string;
 
     /** Explicit collection config (auto-resolved from navigation if omitted) */
-    collection?: EntityCollection<M>;
+    collection?: CollectionConfig<M>;
 
     /** Whether to update the browser URL when opening (default: true) */
     updateUrl?: boolean;
@@ -98,7 +98,7 @@ interface EntitySidePanelProps<M extends Record<string, unknown> = Record<string
 
 **Open an existing entity for editing:**
 ```tsx
-const sideEntityController = useSideEntityController();
+const sideEntityController = useSidePanel();
 
 // Open the product with ID "abc123" in the side drawer
 sideEntityController.open({
@@ -236,10 +236,10 @@ import { useCollectionRegistryController } from "@rebasepro/admin";
 ```typescript
 type CollectionRegistryController<
     DB = Record<string, unknown>,
-    EC extends EntityCollection = EntityCollection
+    EC extends CollectionConfig = CollectionConfig
 > = {
     /** All registered collections */
-    collections?: EntityCollection[];
+    collections?: CollectionConfig[];
 
     /** Whether the registry is ready */
     initialised: boolean;
@@ -321,7 +321,7 @@ type CollectionPanelProps = {
     className?: string;
 
     /** Additional collection-level overrides */
-    collectionOverrides?: Partial<EntityCollection>;
+    collectionOverrides?: Partial<CollectionConfig>;
 };
 ```
 
@@ -356,17 +356,17 @@ type CollectionPanelProps = {
 
 ## 5. Entity Selection Dialog
 
-Use `useEntitySelectionDialog()` to open a side dialog for selecting entities (same mechanism used by reference fields).
+Use `useSelectionDialog()` to open a side dialog for selecting entities (same mechanism used by reference fields).
 
 ```typescript
-import { useEntitySelectionDialog } from "@rebasepro/admin";
+import { useSelectionDialog } from "@rebasepro/admin";
 ```
 
 ### Usage
 
 ```tsx
 function MyComponent() {
-    const { open, close } = useEntitySelectionDialog<Product>({
+    const { open, close } = useSelectionDialog<Product>({
         path: "products",
         onSingleEntitySelected: (entity) => {
             console.log("Selected:", entity.id);
@@ -378,7 +378,7 @@ function MyComponent() {
 }
 ```
 
-The hook accepts all `EntitySelectionProps` except `path` (which you pass separately), plus an `onClose` callback.
+The hook accepts all `SelectionProps` except `path` (which you pass separately), plus an `onClose` callback.
 
 ---
 
@@ -545,7 +545,7 @@ import { useCMSContext } from "@rebasepro/admin";
 
 ```typescript
 type CMSContext = RebaseContext & {
-    sideEntityController: SideEntityController;
+    sideEntityController: SidePanelController;
     sideDialogsController: SideDialogsController;
     urlController: UrlController;
     navigationStateController: NavigationStateController;
@@ -572,14 +572,14 @@ context.data;           // DataSource from RebaseContext
 
 ## 10. Common Patterns
 
-### Navigate to a collection and open an entity
+### Navigate to a collection and open a entity
 
 ```tsx
-import { useUrlController, useSideEntityController } from "@rebasepro/admin";
+import { useUrlController, useSidePanel } from "@rebasepro/admin";
 
 function navigateAndOpen() {
     const urlController = useUrlController();
-    const sideEntityController = useSideEntityController();
+    const sideEntityController = useSidePanel();
 
     // First navigate to the collection
     urlController.navigate(urlController.buildUrlCollectionPath("products"));
@@ -595,10 +595,10 @@ function navigateAndOpen() {
 ### Open entity from a custom view without navigating
 
 ```tsx
-import { useSideEntityController } from "@rebasepro/admin";
+import { useSidePanel } from "@rebasepro/admin";
 
 function MyCustomView() {
-    const sideEntityController = useSideEntityController();
+    const sideEntityController = useSidePanel();
 
     return (
         <button onClick={() => sideEntityController.open({
@@ -615,10 +615,10 @@ function MyCustomView() {
 ### Programmatic entity creation from a custom view
 
 ```tsx
-import { useSideEntityController } from "@rebasepro/admin";
+import { useSidePanel } from "@rebasepro/admin";
 
 function CreateButton() {
-    const sideEntity = useSideEntityController();
+    const sideEntity = useSidePanel();
 
     return (
         <button onClick={() => sideEntity.open({
@@ -754,10 +754,10 @@ The admin package exports the following components (from `@rebasepro/admin`):
 | `RebaseCMS` | Declarative CMS config (collections, views, editor) — renders nothing |
 | `RebaseShell` | App shell (drawer, nav, routes, layout) — renders the actual UI |
 | `CollectionPanel` | Embed a collection view inside custom pages |
-| `EntityCollectionView` | The collection view component |
-| `EntityView` | Entity detail/edit view |
+| `DataCollectionView` | The collection view component |
+| `EntityCustomView` | Entity detail/edit view |
 | `EntityPreview` | Reference/relation preview chip |
-| `EntityCard` | Card representation of an entity |
+| `EntityCard` | Card representation of a entity |
 | `SideDialogs` | Side dialog container |
 | `SideEntityProvider` | Context provider for side entity controller |
 | `EntitySelectionTable` | Table for selecting entities |
@@ -773,16 +773,16 @@ The admin package exports the following components (from `@rebasepro/admin`):
 
 | Hook | Description |
 |------|-------------|
-| `useSideEntityController()` | Open/close entity side panels |
+| `useSidePanel()` | Open/close entity side panels |
 | `useSideDialogsController()` | Open/close generic side dialogs |
 | `useUrlController()` | Build URLs and navigate |
 | `useNavigationStateController()` | Access navigation state |
 | `useCollectionRegistryController()` | Look up collections by slug |
 | `useBreadcrumbsController()` | Read/set breadcrumbs |
 | `useCMSContext()` | Full CMS context (core + CMS controllers) |
-| `useEntitySelectionDialog()` | Open entity selection dialog |
+| `useSelectionDialog()` | Open entity selection dialog |
 | `useSelectionController()` | Multi-select controller |
-| `useEntityHistory()` | Entity version history |
+| `useHistory()` | Entity version history |
 | `useApp()` | App-level utilities |
 
 ## Exported Utilities
@@ -796,8 +796,8 @@ The admin package exports the following components (from `@rebasepro/admin`):
 | `getLastSegment(path)` | Get last path segment |
 | `getCollectionBySlugWithin(collections, slug)` | Find collection in array |
 | `mergeEntityActions(...)` | Merge entity action arrays |
-| `resolveEntityAction(...)` | Resolve an entity action |
-| `resolveEntityView(...)` | Resolve an entity view |
+| `resolveEntityAction(...)` | Resolve a entity action |
+| `resolveEntityView(...)` | Resolve a entity view |
 | `isReferenceProperty(prop)` | Check if property is a reference |
 | `isRelationProperty(prop)` | Check if property is a relation |
 | `getIconForProperty(prop)` | Get icon for a property type |

package/skills/rebase-api/SKILL.md

@@ -43,8 +43,8 @@ All data routes are mounted under `/api/data/`. Other route categories:
 | `GET` | `/api/data/{slug}/count` | Count matching entities (with optional filters) | `200` |
 | `GET` | `/api/data/{slug}/:id` | Get a single entity by ID | `200` |
 | `POST` | `/api/data/{slug}` | Create a new entity | `201` |
-| `PUT` | `/api/data/{slug}/:id` | Update an entity | `200` |
-| `DELETE` | `/api/data/{slug}/:id` | Delete an entity | `204` |
+| `PUT` | `/api/data/{slug}/:id` | Update a entity | `200` |
+| `DELETE` | `/api/data/{slug}/:id` | Delete a entity | `204` |
 
 ### Subcollection Routes
 
@@ -405,7 +405,7 @@ curl -H "Authorization: Bearer $TOKEN" \
   "https://example.com/api/data/products?status=eq.active&price=gte.50&orderBy=created_at:desc&limit=10&offset=0&include=category"
 ```
 
-### Create an entity
+### Create a entity
 
 ```bash
 curl -X POST \
@@ -415,7 +415,7 @@ curl -X POST \
   "https://example.com/api/data/products"
 ```
 
-### Update an entity
+### Update a entity
 
 ```bash
 curl -X PUT \
@@ -425,7 +425,7 @@ curl -X PUT \
   "https://example.com/api/data/products/uuid-123"
 ```
 
-### Delete an entity
+### Delete a entity
 
 ```bash
 curl -X DELETE \
@@ -655,7 +655,7 @@ GET /api/collections
 | `pagination.maxLimit` | `number` | `100` | Maximum allowed page size |
 | `cors.origin` | `string \| string[] \| boolean` | — | CORS origin configuration |
 | `cors.credentials` | `boolean` | `false` | Allow credentials in CORS |
-| `collections` | `EntityCollection[]` | `[]` | Collections to generate APIs for |
+| `collections` | `CollectionConfig[]` | `[]` | Collections to generate APIs for |
 | `collectionsDir` | `string` | — | Directory to auto-discover collections |
 
 ## References

package/skills/rebase-auth/SKILL.md

@@ -5,7 +5,7 @@ description: Guide for setting up and using Rebase Authentication, roles, Row-Le
 
 # Rebase Authentication
 
-Rebase ships a complete, built-in authentication system with JWT sessions, OAuth, MFA/TOTP, API keys, Row-Level Security, and lifecycle hooks — or you can plug in an external provider (Clerk, Auth0, Firebase Auth) via the `AuthAdapter` interface.
+Rebase ships a complete, built-in authentication system with JWT sessions, OAuth, MFA/TOTP, API keys, Row-Level Security, and lifecycle hooks — or you can plug in an external auth system (e.g., Clerk, Auth0, or custom identity providers) via the `AuthAdapter` interface.
 
 > **IMPORTANT FOR AGENTS:** Always read the `rebase-basics` skill first. The auth system is configured inside `initializeRebaseBackend()` which is covered there.
 
@@ -33,21 +33,22 @@ Rebase ships a complete, built-in authentication system with JWT sessions, OAuth
 
 Authentication is configured via the `auth` property of `initializeRebaseBackend()`. It accepts **either** a `RebaseAuthConfig` object (built-in auth) or an `AuthAdapter` (external auth).
 
-> **Auth & multiple data sources.** The built-in auth system (users, sessions, API keys) is bootstrapped on the **default** data source — the auth collection must live there (the backend warns at boot otherwise). **RLS only protects Postgres**: server collections on engines without row-level security (e.g. MongoDB) still require authentication but enforce authorization at the app layer (the backend warns for these). **Direct data sources (e.g. Firestore) bypass Rebase auth entirely** — they're governed by the external backend's own rules/token; use an `AuthAdapter` (e.g. Firebase Auth) to unify identity. See the **rebase-collections** skill for the data-source model.
+> **Auth & multiple data sources.** The built-in auth system (users, sessions, API keys) is bootstrapped on the **default** data source — the auth collection must live there (the backend warns at boot otherwise). **RLS only protects Postgres**: server collections on engines without row-level security (e.g. MongoDB) still require authentication but enforce authorization at the app layer (the backend warns for these). **Direct data sources (e.g. Firestore) bypass Rebase auth entirely** — they're governed by the external backend's own rules/token; use an `AuthAdapter` to unify identity. See the **rebase-collections** skill for the data-source model.
 
 ### RebaseAuthConfig
 
 | Property | Type | Default | Description |
 |---|---|---|---|
-| `collection` | `EntityCollection` | Built-in users collection | The collection used for auth user storage. Import `defaultUsersCollection` from `@rebasepro/common` or pass a custom collection with required auth fields. |
+| `collection` | `CollectionConfig` | Built-in users collection | The collection used for auth user storage. Import `defaultUsersCollection` from `@rebasepro/common` or pass a custom collection with required auth fields. |
 | `jwtSecret` | `string` | — | **Required.** Secret for signing JWT access tokens. |
 | `accessExpiresIn` | `string` | `"1h"` | Access token lifetime (e.g. `"15m"`, `"2h"`). |
 | `refreshExpiresIn` | `string` | `"30d"` | Refresh token lifetime. |
 | `requireAuth` | `boolean` | `true` | When `true`, data routes return 401 for unauthenticated requests. Set to `false` to rely entirely on Postgres RLS. |
 | `allowRegistration` | `boolean` | `false` | Enable self-service registration via `POST /auth/register`. |
+| `allowUserLookup` | `boolean` | `false` | Expose `POST /auth/find-user` — an authenticated email→minimal-profile lookup (`uid`/`displayName`/`photoURL` only) for invite flows. Enables user enumeration by signed-in users, so it's off by default. See [Inviting by email](#inviting-teammates-by-email). |
 | `serviceKey` | `string` | — | Static secret for server-to-server auth. Must be ≥ 32 characters. Requests with `Authorization: Bearer <serviceKey>` get admin access. |
 | `defaultRole` | `string` | — | Role ID assigned to new users (except the first user, who always gets `"admin"`). **Must NOT be `"admin"`** — throws a security error at startup. |
-| `providers` | `OAuthProvider<any>[]` | `[]` | Custom OAuth providers (use alongside the shorthand configs below). |
+| `providers` | `OAuthProvider<unknown>[]` | `[]` | **Canonical** OAuth provider array. Use `create*Provider` factories or pass custom providers. Named shorthand fields below are merged into this array at startup. |
 | `hooks` | `AuthHooks` | — | [Lifecycle hooks](#auth-lifecycle-hooks) to customize passwords, credentials, and auth events. |
 | `email` | `EmailConfig` | — | [Email configuration](#email-configuration) for password resets, verification, and welcome emails. |
 | `google` | `{ clientId, clientSecret? }` | — | Google OAuth shorthand. |
@@ -107,9 +108,9 @@ await initializeRebaseBackend({
 Instead of relying solely on the default database auth rules, you can mark any Postgres collection (such as `users.ts` or a custom `members.ts` collection) as the authentication collection. This is configured via the `auth` property on the collection itself:
 
 ```typescript
-import { PostgresCollection } from "@rebasepro/types";
+import { PostgresCollectionConfig } from "@rebasepro/types";
 
-const membersCollection: PostgresCollection = {
+const membersCollection: PostgresCollectionConfig = {
   name: "Members",
   slug: "members",
   table: "members",
@@ -154,6 +155,27 @@ When custom hooks (`onCreateUser`, `onResetPassword`) are called, they receive a
 
 > **IMPORTANT FOR AGENTS:** The very first user registered (via `POST /auth/register` or OAuth) is automatically promoted to `"admin"`. This prevents the chicken-and-egg problem. All subsequent users receive the `defaultRole`.
 
+### Inviting teammates by email
+
+Invite flows must turn an email into a user id, but the `users` collection is
+RLS-protected from the client. **Do not** hand-roll an admin server function for
+this — enable `allowUserLookup` and use the built-in primitive:
+
+```typescript
+// backend: initializeRebaseBackend({ auth: { allowUserLookup: true } })
+
+// client:
+const profile = await rebase.auth.findUserByEmail("teammate@example.com");
+// → { uid, displayName, photoURL } | null   (never email/roles/metadata)
+if (profile) {
+    await rebase.data.team_members.create({ team_id, user_id: profile.uid });
+}
+```
+
+The `find-user` endpoint is authenticated-only and returns just the minimal
+public profile. It is off by default because it enables user enumeration by any
+signed-in user.
+
 ---
 
 ## OAuth Providers
@@ -351,14 +373,14 @@ hooks: {
 }
 ```
 
-### Example: Firebase Custom Token Bridge
+### Example: External Token Bridge (e.g. custom auth system)
 
 ```typescript
 import admin from "firebase-admin";
 
 hooks: {
   transformAuthResponse: async (response, context) => {
-    // Generate a Firebase Custom Token for the authenticated user
+    // Generate a custom provider token for the authenticated user
     const firebaseToken = await admin.auth().createCustomToken(context.userId);
     return {
       ...response,
@@ -371,7 +393,7 @@ hooks: {
 }
 ```
 
-The frontend can then call `signInWithCustomToken(firebaseToken)` immediately after login.
+The frontend can then call `signInWithCustomToken(providerToken)` immediately after login.
 
 ---
 
@@ -664,7 +686,7 @@ All login/register/OAuth endpoints return:
 }
 ```
 
-> **TIP:** Use the `transformAuthResponse` hook to inject additional tokens (e.g., Firebase Custom Tokens) or metadata into this response. See [Auth Lifecycle Hooks](#auth-lifecycle-hooks).
+> **TIP:** Use the `transformAuthResponse` hook to inject additional tokens (e.g., external system tokens) or metadata into this response. See [Auth Lifecycle Hooks](#auth-lifecycle-hooks).
 
 ### Error Response Format
 
@@ -857,6 +879,21 @@ Requests with the `serviceKey` bypass RLS — they receive admin-level access wi
 
 API keys use a service identity for RLS scoping: `uid: "api-key:{id}"`, `roles: ["service"]` (or `["admin", "service"]` when `admin: true`). They do not inherit the `created_by` user's identity.
 
+### Reserved System Identities
+
+The auth middleware assigns these reserved identities automatically. They are visible in `context.user` (Collection Callbacks / DataHooks) and `c.get("user")` (custom functions):
+
+| Auth Method | `userId` | `roles` | When It Occurs |
+|---|---|---|---|
+| JWT (end-user) | Real user ID (e.g. `"abc123"`) | User's assigned roles (e.g. `["viewer"]`) | Normal authenticated requests |
+| Service Key | `"service"` | `["admin"]` | Server-side `rebase.data` calls, cron jobs, or any request with `Authorization: Bearer <serviceKey>` |
+| API Key (default) | `"api-key:{id}"` | `["service"]` | Machine-to-machine API key requests |
+| API Key (admin) | `"api-key:{id}"` | `["admin", "service"]` | Admin API key requests |
+| Anonymous | `"anon"` | `["anon"]` | Unauthenticated when `requireAuth: false` |
+| No token + `requireAuth: true` | — | — | **Rejected (401)** |
+
+> **IMPORTANT FOR AGENTS:** Server-side `rebase.data` (the singleton used in cron jobs, custom functions, and webhooks) is built with `createRebaseClient({ token: serviceKey })`. It round-trips through the REST API, so all middleware, DataHooks, and Collection Callbacks fire with `userId: "service"`, `roles: ["admin"]`. This lets developers distinguish server-internal reads from end-user reads in callbacks.
+
 ---
 
 ## Rate Limiting
@@ -917,7 +954,7 @@ const myLimiter = createRateLimiter({
 
 ## Custom Auth Adapters
 
-For external auth systems (Clerk, Auth0, Firebase Auth, or custom JWT), use the `AuthAdapter` interface or the `createCustomAuthAdapter()` helper.
+For external auth systems (Clerk, Auth0, custom providers, or custom JWT), use the `AuthAdapter` interface or the `createCustomAuthAdapter()` helper.
 
 ### AuthAdapter Interface
 
@@ -1077,7 +1114,7 @@ Admin user and role management is handled via dedicated admin routes (mounted un
 
 ## Backend Hooks
 
-Backend hooks intercept data at the **API boundary** (after DB operations, before API responses). They are separate from auth hooks and collection-level `EntityCallbacks`.
+Backend hooks intercept data at the **API boundary** (after DB operations, before API responses). They are separate from auth hooks and collection-level `CollectionCallbacks`.
 
 ### BackendHooks Interface
 
@@ -1241,6 +1278,8 @@ When a request includes `Authorization: Bearer <serviceKey>`:
 - Comparison is done with constant-time comparison to prevent timing attacks.
 - Must be ≥ 32 characters (validated at startup).
 
+> **TIP:** In Collection Callbacks and DataHooks, server-side `rebase.data` calls appear as `userId: "service"`, `roles: ["admin"]`. Use this to skip masking, bypass rate limits, or grant elevated access in your callback logic.
+
 ### Token Rotation
 
 Refresh tokens are rotated on every use:
@@ -1281,3 +1320,4 @@ All auth endpoints validate input with Zod schemas:
 - Source: `packages/types/src/types/auth_adapter.ts` — `AuthAdapter` interface
 - Source: `packages/server-core/src/auth/rls-scope.ts` — RLS scoping
 - Source: `packages/server-core/src/email/types.ts` — Email configuration
+- **Reserved Identities**: `"service"` / `"anon"` / `"api-key:{id}"` — see [Row-Level Security > Reserved System Identities](#reserved-system-identities)

package/skills/rebase-backend-postgres/SKILL.md

@@ -69,7 +69,7 @@ rebase db migrate
 |---------|---------|
 | `@rebasepro/server-core` | Hono server coordinator, API generation, auth, storage, env validation |
 | `@rebasepro/server-postgresql` | PostgreSQL bootstrapper, data driver, connection helpers, realtime (LISTEN/NOTIFY) |
-| `@rebasepro/types` | Shared TypeScript type definitions (`PostgresCollection`, etc.) |
+| `@rebasepro/types` | Shared TypeScript type definitions (`PostgresCollectionConfig`, etc.) |
 
 ## Connection Functions
 
@@ -339,7 +339,7 @@ The `initializeRebaseBackend()` coordinator calls bootstrapper methods in this o
 
 | Property | Type | Default | Description |
 |----------|------|---------|-------------|
-| `collection` | `EntityCollection` | Built-in `rebase.users` | Auth users collection |
+| `collection` | `CollectionConfig` | Built-in `rebase.users` | Auth users collection |
 | `jwtSecret` | `string` | Auto-generated in dev | JWT signing secret (≥32 chars) |
 | `accessExpiresIn` | `string` | `"1h"` | Access token TTL |
 | `refreshExpiresIn` | `string` | `"30d"` | Refresh token TTL |
@@ -514,7 +514,7 @@ const backend = await initializeRebaseBackend({
 
 When enabled:
 - The bootstrapper auto-creates a `rebase.entity_history` table
-- Every `INSERT`, `UPDATE`, `DELETE` is recorded with before/after snapshots
+- Every `INSERT`, `UPDATE`, `DELETE` is recorded with before/after entities
 - History is queryable via the `/:slug/:entityId/history` REST endpoint
 
 ## Health Check

package/skills/rebase-basics/SKILL.md

@@ -125,7 +125,7 @@ rebase/
 | `@rebasepro/server-postgresql` | PostgreSQL bootstrapper and Drizzle ORM data driver | Backend setup when using PostgreSQL |
 | `@rebasepro/server-mongodb` | MongoDB bootstrapper and data driver | Backend setup when using MongoDB |
 | `@rebasepro/core` | Core framework, types, hooks, and React components | Frontend — React integration, hooks, providers |
-| `@rebasepro/types` | Shared TypeScript type definitions (`PostgresCollection`, `EntityCollection`, `RebaseClient`, etc.) | Type imports across all packages |
+| `@rebasepro/types` | Shared TypeScript type definitions (`PostgresCollectionConfig`, `CollectionConfig`, `RebaseClient`, etc.) | Type imports across all packages |
 | `@rebasepro/ui` | Standalone component library (Tailwind CSS v4 + Radix) | Building custom views in Studio or standalone UI |
 | `@rebasepro/admin` | CMS frontend application | The Studio admin panel frontend |
 | `@rebasepro/studio` | Admin panel, collection editor, visual schema editor | Studio-specific features and customization |
@@ -388,7 +388,7 @@ When `extend` is provided, the base `rebaseEnvSchema` is merged (`.merge()`) wit
 | `DB_POOL_MAX` | `string` → `number` | `"20"` | No | Max database pool connections |
 | `DB_POOL_IDLE_TIMEOUT` | `string` → `number` | `"30000"` | No | Pool idle timeout (ms) |
 | `DB_POOL_CONNECT_TIMEOUT` | `string` → `number` | `"10000"` | No | Pool connect timeout (ms) |
-| `STORAGE_TYPE` | `"local" \| "s3"` | `"local"` | No | File storage backend type |
+| `STORAGE_TYPE` | `"local" \| "s3" \| "gcs"` | `"local"` | No | File storage backend type |
 | `STORAGE_PATH` | `string` | — | No | Local storage directory path |
 | `FORCE_LOCAL_STORAGE` | `"true" \| "false"` | — | No | Force local storage even in production |
 | `S3_BUCKET` | `string` | — | When S3 | S3 bucket name |
@@ -397,6 +397,9 @@ When `extend` is provided, the base `rebaseEnvSchema` is merged (`.merge()`) wit
 | `S3_SECRET_ACCESS_KEY` | `string` | — | When S3 | S3 secret key |
 | `S3_ENDPOINT` | `string` (URL) | — | No | Custom S3 endpoint (MinIO, R2, etc.) |
 | `S3_FORCE_PATH_STYLE` | `"true" \| "false"` | — | No | Use path-style S3 URLs |
+| `GCS_BUCKET` | `string` | — | When GCS | GCS/Firebase Storage bucket name |
+| `GCS_PROJECT_ID` | `string` | — | When GCS | GCP project ID |
+| `GOOGLE_APPLICATION_CREDENTIALS` | `string` (path) | — | When GCS | Path to GCP service account JSON |
 
 ### Production Validations
 
@@ -431,14 +434,14 @@ import { initializeRebaseBackend, RebaseBackendConfig } from "@rebasepro/server-
 |----------|------|---------|-------------|
 | `server` | `Server` (Node `http.Server`) | — | **Required.** The HTTP server instance |
 | `app` | `Hono<HonoEnv>` | — | **Required.** The Hono application instance |
-| `collections` | `EntityCollection[]` | `[]` | Inline collection definitions |
+| `collections` | `CollectionConfig[]` | `[]` | Inline collection definitions |
 | `collectionsDir` | `string` | — | Directory to auto-discover collection files (used if `collections` is empty) |
 | `basePath` | `string` | `"/api"` | Base path for all API routes |
 | `database` | `DatabaseAdapter` | — | Database adapter (takes precedence over `bootstrappers`) |
 | `bootstrappers` | `BackendBootstrapper[]` | `[]` | Database bootstrappers. Use one per engine for multiple engines in a single instance (e.g. Postgres + MongoDB); mark one `isDefault` |
 | `dataSources` | `DataSourceDefinition[]` | `[]` | Declared data sources (`key`, `engine`, `transport`). Drives capabilities and the server-vs-direct distinction. Collections on a `direct`/`custom` transport are client-only — the backend skips data routes for them. Server engines need no entry |
 | `auth` | `RebaseAuthConfig \| AuthAdapter` | — | Authentication config or pluggable adapter |
-| `storage` | `BackendStorageConfig \| StorageController \| Record<string, ...>` | — | File storage configuration |
+| `storage` | `BackendStorageConfig \| StorageController \| Record<string, ...>` | — | File storage configuration. Supports `"local"`, `"s3"`, and `"gcs"` (GCS/Firebase Storage) backends. Use `Record<string, StorageController>` for multi-backend setups with named sources |
 | `history` | `unknown` | — | Entity history/audit-log configuration |
 | `defaultSecurityRules` | `SecurityRule[]` | — | Default RLS rules for collections without their own |
 | `enableSwagger` | `boolean` | `true` | Enable OpenAPI spec at `/api/docs` and Swagger UI at `/api/swagger` (dev only) |
@@ -456,7 +459,7 @@ import { initializeRebaseBackend, RebaseBackendConfig } from "@rebasepro/server-
 
 | Property | Type | Default | Description |
 |----------|------|---------|-------------|
-| `collection` | `EntityCollection` | `defaultUsersCollection` | The collection used for auth users |
+| `collection` | `CollectionConfig` | `defaultUsersCollection` | The collection used for auth users |
 | `jwtSecret` | `string` | — | JWT signing secret (≥32 chars) |
 | `accessExpiresIn` | `string` | `"1h"` | Access token TTL |
 | `refreshExpiresIn` | `string` | `"30d"` | Refresh token TTL |
@@ -546,6 +549,8 @@ await initializeRebaseBackend({
             ? { clientId: env.GOOGLE_CLIENT_ID }
             : undefined,
     },
+    // Single backend: { type: "local" | "s3" | "gcs" }
+    // Multi-backend: Record<string, StorageController> with named sources
     storage: { type: env.STORAGE_TYPE },
     defaultSecurityRules: [
         { operation: "select", access: "public" },
@@ -649,7 +654,7 @@ The Rebase MCP server provides these tools for AI agents. Use the MCP tool calli
 | `rebase_schema_generate` | Generate Drizzle schema from collection definitions. Run after adding or modifying collection files | — |
 | `rebase_schema_introspect` | Introspect the live database and generate Rebase collection definitions from existing tables | — |
 | `rebase_db_push` | Apply the current Drizzle schema directly to the database (development shortcut, skips migration files) | — |
-| `rebase_db_generate` | Generate SQL migration files from schema changes (compares current Drizzle schema against the last snapshot) | — |
+| `rebase_db_generate` | Generate SQL migration files from schema changes (compares current Drizzle schema against the last entity) | — |
 | `rebase_db_migrate` | Run all pending SQL migrations against the database | — |
 
 ### SDK