@rebasepro/common 0.19.1 → 0.19.2-canary.g08eed46

package/dist/index.es.js

@@ -1,4 +1,4 @@
-import { ALL_WHERE_FILTER_OPS, ANONYMOUS_USER_ID, ANONYMOUS_USER_IDS, CANONICAL_TO_REST, DEFAULT_DATA_SOURCE_KEY, DEFAULT_LIST_LIMIT, EntityReference, EntityRelation, NULL_OPS, REST_TO_CANONICAL, RLS_IS_ANONYMOUS_SQL, RLS_ROLES_SQL, RLS_UID_SQL, RebaseApiError, getDataSourceCapabilities, getDeclaredSubcollections, isAnonymousUid, isManyToMany, isPostgresCollectionConfig, isRelationAggregateSort, isRelationalCollectionConfig, isUnsupported, policy, resolveResourceRefs, rewriteLegacyRlsFunctions, sortKeyToString, toCanonicalOp, unsupportedMethod } from "@rebasepro/types";
+import { ALL_WHERE_FILTER_OPS, ANONYMOUS_USER_ID, ANONYMOUS_USER_IDS, CANONICAL_TO_REST, DEFAULT_DATA_SOURCE_KEY, DEFAULT_LIST_LIMIT, DEFAULT_TENANT_BYPASS_ROLES, EntityReference, EntityRelation, JUNCTION_PIVOT_KEY, LIST_OPS, MAX_INCLUDE_DEPTH, NULL_OPS, REST_TO_CANONICAL, RLS_IS_ANONYMOUS_SQL, RLS_JWT_SQL, RLS_ROLES_SQL, RLS_UID_SQL, RebaseApiError, getDataSourceCapabilities, getDeclaredSubcollections, isAnonymousUid, isManyToMany, isPostgresCollectionConfig, isRelationAggregateSort, isRelationalCollectionConfig, isTenantClaimSource, isUnsupported, policy, resolveResourceRefs, rewriteLegacyRlsFunctions, sortKeyToString, toCanonicalOp, unsupportedMethod } from "@rebasepro/types";
 import { deepClone, firstFreeKey, generateForeignKeyName, getIn, getPolicyNamesForRules, getPolicyOperations, isDefaultFieldConfigId, mergeDeep, prettifyIdentifier, randomString, removeFunctions, toSnakeCase, toWireKey } from "@rebasepro/utils";
 import jsonLogic from "json-logic-js";
 import { deepEqual } from "fast-equals";
@@ -10,10 +10,28 @@ var DEFAULT_ONE_OF_VALUE = "value";
 function isPropertyBuilder(property) {
 	return typeof property?.dynamicProps === "function";
 }
+/**
+* What a form opens with: a value for every property it can write.
+*
+* `excludeFromApi` columns are left out, and that is the whole of the rule —
+* they are not part of the API surface in either direction, so there is nothing
+* for a form to open showing and nothing it may send back. Including them was
+* not cosmetic: the baseline is what gets submitted, so a new record carried
+* `passwordHash: null` and `emailVerificationToken: null` into the create, and
+* the server refused the whole write with "these columns are the server's to
+* set" — the users collection could not be added to from the panel at all. The
+* fields were invisible on screen (`admin.disabled.hidden`), which is what made
+* the error read as being about the roles the operator *had* just edited.
+*
+* Server-side defaulting does not come through here: `applyDefaultValuesOnCreate`
+* asks each property for its own default, so an excluded column with a declared
+* `defaultValue` is still filled in on an in-process write.
+*/
 function getDefaultValuesFor(properties) {
 	if (!properties) return {};
 	return Object.entries(properties).map(([key, property]) => {
 		if (!property) return {};
+		if (property.excludeFromApi) return {};
 		const value = getDefaultValueFor(property);
 		return value === void 0 ? {} : { [key]: value };
 	}).reduce((a, b) => ({
@@ -24,7 +42,7 @@ function getDefaultValuesFor(properties) {
 function getDefaultValueFor(property) {
 	if (!property) return void 0;
 	if (isPropertyBuilder(property)) return void 0;
-	if (property.defaultValue || property.defaultValue === null) return property.defaultValue;
+	if (property.defaultValue !== void 0) return property.defaultValue;
 	else if (property.type === "map" && property.properties) {
 		const defaultValuesFor = getDefaultValuesFor(property.properties);
 		if (Object.keys(defaultValuesFor).length === 0) return void 0;
@@ -55,6 +73,101 @@ function updateDateAutoValues({ inputValues, properties, status, timestampNowVal
 	}) ?? {};
 }
 /**
+* Stamp the acting user's uid into the `user_on_create` / `user_on_update`
+* columns a collection declares.
+*
+* A deliberate sibling of {@link updateDateAutoValues} rather than another
+* branch inside it. The two share a shape and nothing else: one takes an
+* instant the server generates and the other takes an identity the request
+* carries, so overloading the timestamp function would have meant threading a
+* second, unrelated argument through every one of its callers and letting a
+* `date` property and a `string` property compete for the same `autoValue`
+* union. Called side by side in the driver.
+*
+* The stamped value overwrites whatever arrived in the body. A caller who can
+* set `createdBy` is a caller who can attribute their write to somebody else,
+* which is the one thing an audit column must not allow.
+*
+* `uid` is `undefined` for an anonymous request, a service token or an
+* in-process write; the column is set to an explicit `null` there. Explicit
+* matters on an update: leaving the key absent would keep whatever uid the
+* column already held, so an anonymous edit would be recorded as the previous
+* editor's. Refusing that write outright is `required`'s job, not this
+* function's — see `assertWriteValuesValid`.
+*
+* Top-level properties only, deliberately, unlike {@link updateDateAutoValues}.
+* `traverseValuesProperties` cannot express "set this key to null" — a `null`
+* from its operation means "leave the key out" — and an audit column nested
+* inside a `map` is not a column at all, so there is nothing down there to
+* stamp.
+*
+* @group Driver
+*/
+function updateUserAutoValues({ inputValues, properties, status, uid }) {
+	const result = { ...inputValues ?? {} };
+	for (const [key, property] of Object.entries(properties ?? {})) {
+		const prop = property;
+		if (!prop || prop.type !== "string") continue;
+		const autoValue = prop.autoValue;
+		if (autoValue !== "user_on_create" && autoValue !== "user_on_update") continue;
+		if (status === "existing" && autoValue === "user_on_create") continue;
+		result[key] = uid ?? null;
+	}
+	return result;
+}
+/**
+* Fill in the `defaultValue`s a create left unset.
+*
+* `defaultValue` was read by exactly one thing: the Studio's form, which uses it
+* to prefill inputs. Every other way into the same collection — the REST create,
+* the SDK, the socket, an import — stored whatever arrived and nothing where the
+* key was absent. So `active: { type: "boolean", defaultValue: true }` produced
+* rows with `active` unset through the API and `true` through the panel, from
+* one declaration that reads like a promise about the data.
+*
+* Only genuinely absent keys are filled. An explicit `null` is a caller saying
+* "no value", which is a different statement from not mentioning the field, and
+* overwriting it would make the default impossible to opt out of.
+*
+* `getDefaultValuesFor` also invents a per-type default for properties with no
+* `defaultValue` at all (`false` for a boolean, `[]` for an array, `null` for
+* the rest) — right for a form, which must render *something* in every input,
+* and wrong here, where an absent key must stay absent so the column's own
+* DEFAULT applies. Only declared defaults are taken.
+*
+* @param values the caller's payload
+* @param properties the collection's declared properties
+* @group Driver
+*/
+function applyDefaultValuesOnCreate(values, properties) {
+	if (!properties) return values ?? {};
+	const result = { ...values ?? {} };
+	for (const [key, property] of Object.entries(properties)) {
+		if (!property) continue;
+		if (!declaresDefault(property)) continue;
+		const defaultValue = getDefaultValueFor(property);
+		if (result[key] !== void 0) {
+			if (property.type === "map" && property.defaultValue === void 0 && isPlainObject(result[key])) result[key] = {
+				...defaultValue ?? {},
+				...result[key]
+			};
+			continue;
+		}
+		if (defaultValue !== void 0) result[key] = defaultValue;
+	}
+	return result;
+}
+/** Does this property, or something nested under it, state a `defaultValue`? */
+function declaresDefault(property) {
+	if (isPropertyBuilder(property)) return false;
+	if (property.defaultValue !== void 0) return true;
+	if (property.type === "map" && property.properties) return Object.values(property.properties).some((child) => child && declaresDefault(child));
+	return false;
+}
+function isPlainObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
 * Add missing required fields, expected in the collection, to the values of a entity
 * @param values
 * @param properties
@@ -532,7 +645,8 @@ function resolveRelation(relation, sourceCollection, propertyKey) {
 				through: {
 					table: relation.through?.table ?? [sourceTable, targetTable].sort().join("_"),
 					sourceColumn: relation.through?.sourceColumn ?? generateForeignKeyName(sourceName),
-					targetColumn: relation.through?.targetColumn ?? generateForeignKeyName(relationName)
+					targetColumn: relation.through?.targetColumn ?? generateForeignKeyName(relationName),
+					properties: relation.through?.properties ?? {}
 				}
 			};
 		}
@@ -1526,8 +1640,9 @@ function compile(expr, scope) {
 		case "not": return `NOT (${compile(expr.operand, scope)})`;
 		case "compare": {
 			const castForAuthUid = (operand, sqlText, other) => other.kind === "authUid" && (operand.kind === "field" || operand.kind === "outerField") ? `(${sqlText})::text` : sqlText;
-			const leftSql = castForAuthUid(expr.left, operandToSql(expr.left, scope), expr.right);
-			const rightSql = castForAuthUid(expr.right, operandToSql(expr.right, scope), expr.left);
+			const claimSql = (operand, other) => operand.kind === "authClaim" ? authClaimSql(operand.name, claimCastType(other, scope)) : void 0;
+			const leftSql = claimSql(expr.left, expr.right) ?? castForAuthUid(expr.left, operandToSql(expr.left, scope), expr.right);
+			const rightSql = claimSql(expr.right, expr.left) ?? castForAuthUid(expr.right, operandToSql(expr.right, scope), expr.left);
 			return `${leftSql} ${COMPARE_SQL[expr.op]} ${rightSql}`;
 		}
 		case "rolesOverlap": return `string_to_array(${RLS_ROLES_SQL}, ',') && ${rolesArraySql(expr.roles)}`;
@@ -1575,9 +1690,124 @@ function operandToSql(operand, scope) {
 		case "literal": return quoteLiteral(operand.value);
 		case "authUid": return RLS_UID_SQL;
 		case "authRoles": return `string_to_array(${RLS_ROLES_SQL}, ',')`;
+		case "authClaim": return authClaimSql(operand.name, "text");
 	}
 }
 /**
+* The Postgres type a claim has to be cast to, to be compared with `operand`.
+*
+* `"text"` means "no cast": a claim already is text, and a `text` / `varchar`
+* column compares with it directly and keeps using its index.
+*
+* Resolved from the *property*, and through a relation's target when the column
+* is a foreign key — a `belongsTo` tenant field is the ordinary shape, and its
+* column's type is the target collection's primary key type rather than
+* anything visible on the property itself. Unknown resolves to `"text"`, which
+* is the safe direction: a redundant `text` comparison costs nothing, while a
+* missing `uuid` cast is a `CREATE POLICY` that fails and leaves a table with
+* RLS enabled and no policy — which denies every row.
+*/
+function claimCastType(operand, scope) {
+	if (operand.kind !== "field" && operand.kind !== "outerField") return "text";
+	const collection = operand.kind === "field" ? scope.fieldCollection : scope.outerCollection;
+	return propertyClaimCastType(operand.name, collection, scope.resolveCollection);
+}
+/**
+* What `name` on `collection` compares against a text claim as.
+*
+* `depth` stops a `reference` cycle — two collections whose keys point at each
+* other — from recursing forever. Two hops is more than any real declaration
+* needs.
+*/
+function propertyClaimCastType(name, collection, resolveCollection, depth = 0) {
+	const prop = collection?.properties?.[name];
+	if (!prop || depth > 2) return "text";
+	switch (prop.type) {
+		case "string": {
+			const sp = prop;
+			if (sp.enum) return "text";
+			return sp.isId === "uuid" || sp.columnType === "uuid" ? "uuid" : "text";
+		}
+		case "number": {
+			const np = prop;
+			if (np.columnType === "numeric") return "numeric";
+			if (np.columnType || np.validation?.integer || np.isId) return "bigint";
+			return "numeric";
+		}
+		case "reference": return primaryKeyClaimCastType(resolveTargetCollection(prop.path, resolveCollection), resolveCollection, depth);
+		case "relation": return primaryKeyClaimCastType(resolveTargetCollection(relationTargetSlug(prop.relation), resolveCollection), resolveCollection, depth);
+		default: return "text";
+	}
+}
+/** The cast a column pointing at `target`'s primary key needs. */
+function primaryKeyClaimCastType(target, resolveCollection, depth) {
+	if (!target) return "text";
+	for (const [key, property] of Object.entries(target.properties ?? {})) {
+		if (!property?.isId) continue;
+		return propertyClaimCastType(key, target, resolveCollection, depth + 1);
+	}
+	return "text";
+}
+/**
+* A relation's target slug, whatever form the declaration took.
+*
+* `target` is a slug on a plain object and a thunk on a builder — the two
+* shapes `resolveRelation` normalises — and this runs on the raw property,
+* before that resolution.
+*/
+function relationTargetSlug(relation) {
+	const target = relation?.target;
+	if (typeof target === "string") return target;
+	if (typeof target !== "function") return void 0;
+	try {
+		const slug = target()?.slug;
+		return typeof slug === "string" ? slug : void 0;
+	} catch {
+		return;
+	}
+}
+function resolveTargetCollection(slug, resolveCollection) {
+	if (!slug || !resolveCollection) return void 0;
+	return resolveCollection(slug) ?? resolveCollection(slug.split("/").pop());
+}
+/**
+* `NULLIF(rebase.jwt() ->> 'name', '')`, cast to the column's type.
+*
+* Two things here are load-bearing beyond the cast:
+*
+* - **`NULLIF(…, '')`.** An absent claim already reads as NULL, but one set to
+*   the empty string does not, and `''::uuid` raises rather than denying. Both
+*   spellings of "this caller has no tenant" have to reach the comparison as
+*   NULL, which is never true and therefore never a grant.
+* - **The guard.** The cast sits inside a `CASE` that first checks the text is
+*   well-formed, because `'nonsense'::uuid` raises `invalid input syntax` — and
+*   a policy that raises does not deny a row, it fails the whole statement. A
+*   caller holding a malformed claim would get a 500 on every read of the table
+*   instead of an empty list. `CASE` rather than an `AND` guard because only
+*   `CASE` is guaranteed not to evaluate its arms out of order.
+*
+* The whole expression is STABLE (`rebase.jwt()` is), so Postgres evaluates it
+* once per query and can still use a btree index on the column it is compared
+* against — which is the entire reason the cast is on this side.
+*/
+function authClaimSql(name, cast) {
+	const claim = `NULLIF(${RLS_JWT_SQL} ->> ${quoteLiteral(name)}, '')`;
+	if (cast === "text") return claim;
+	return `CASE WHEN ${claim} ~ '${CLAIM_CAST_GUARDS[cast]}' THEN (${claim})::${cast} END`;
+}
+/**
+* The text a claim must match before it is cast, per target type.
+*
+* The `bigint` guard caps the digit run at 18 rather than matching any run of
+* digits: `'99999999999999999999'::bigint` is a range error, which fails the
+* statement exactly as the syntax error would have.
+*/
+var CLAIM_CAST_GUARDS = {
+	uuid: "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$",
+	bigint: "^-?[0-9]{1,18}$",
+	numeric: "^-?[0-9]+(\\.[0-9]+)?$"
+};
+/**
 * SQL prefix that qualifies a column of the outer RLS row (`"schema"."table".`),
 * or `""` when the collection is unknown.
 */
@@ -1811,6 +2041,7 @@ function resolveOperand(operand, ctx) {
 				value: ctx.entity.values[operand.name]
 			};
 		case "outerField": return { known: false };
+		case "authClaim": return { known: false };
 	}
 }
 function evaluateCompare(op, left, right, ctx) {
@@ -2210,6 +2441,202 @@ function callbackRefusal(stage, path) {
 	});
 }
 //#endregion
+//#region src/util/tenant.ts
+/**
+* The one reading of `collection.tenant`.
+*
+* Four things have to agree for a tenant-scoped collection to work — the
+* column, the RLS policy, the value stamped on insert and the index — and
+* before this they were four hand-written declarations that nothing compared.
+* The three that are schema become a {@link SecurityRule} and a column effect
+* derived here and in `planSchema`; the fourth, the write path, is
+* {@link resolveTenantWrite}.
+*
+* Everything in this module is pure. The policy it builds is a `SecurityRule`
+* like any other, which is what makes `db push`, the doctor, boot-ensure, the
+* drift detector and the Studio treat the tenancy policy as what it is —
+* generated, named, and recognisable — rather than as somebody's hand-written
+* SQL that a push should offer to drop.
+*/
+/**
+* The collection's tenancy declaration, or nothing.
+*
+* Read through this rather than off the object, so the one shape check —
+* `tenant` is an object carrying a `field` and a `from` — is in one place. A
+* config that is *wrong* is refused by `validateCollectionConfig` with a
+* message; this is only asking whether there is one.
+*/
+function getTenantConfig(collection) {
+	const tenant = collection?.tenant;
+	if (!tenant || typeof tenant !== "object") return void 0;
+	if (typeof tenant.field !== "string" || !tenant.field) return void 0;
+	if (!tenant.from || typeof tenant.from !== "object") return void 0;
+	return tenant;
+}
+/** The roles tenancy does not apply to, defaulted. */
+function tenantBypassRoles(tenant) {
+	return tenant.bypassRoles ?? DEFAULT_TENANT_BYPASS_ROLES;
+}
+/**
+* The name of the policy a tenant declaration compiles to.
+*
+* Explicit — not a `getPolicyNameHash` of the rule — precisely because the
+* rule's *body* is compiled with more information in some callers than in
+* others (`planSchema` can resolve a relation's target collection and so knows
+* the column's type; the Studio, asking only for names, cannot). A hashed name
+* would then differ between the two, and the same policy would read as drift.
+* A frozen identifier: see `contracts/derived-names.txt`.
+*/
+function tenantPolicyName(tableName) {
+	return `${tableName}_tenant_scope`;
+}
+/** The `reason` on the index a tenant column gets. Rendered into `schema.sql`. */
+var TENANT_INDEX_REASON = "tenant scope";
+/**
+* The condition a tenant declaration means, as a policy expression.
+*
+* `serverContext()` first, for the same reason every injected baseline rule
+* carries it: the trusted plane runs migrations, the auth flows and the boot,
+* and a restrictive policy that excluded it would not protect a tenant, it
+* would stop the server from starting.
+*
+* Then the bypass roles, then the tenancy test itself — a claim comparison or a
+* correlated `EXISTS` over the membership table, which are the two ways a
+* deployment answers "which tenant is this caller in".
+*/
+function tenantScopeExpression(tenant) {
+	const match = isTenantClaimSource(tenant.from) ? policy.compare(policy.field(tenant.field), "eq", policy.authClaim(tenant.from.claim)) : policy.existsIn({
+		collection: tenant.from.membership.collection,
+		where: policy.and(policy.compare(policy.field(tenant.from.membership.tenantField), "eq", policy.outerField(tenant.field)), policy.compare(policy.field(tenant.from.membership.userField), "eq", policy.authUid()))
+	});
+	const bypass = tenantBypassRoles(tenant);
+	return bypass.length > 0 ? policy.or(policy.serverContext(), policy.rolesOverlap(bypass), match) : policy.or(policy.serverContext(), match);
+}
+/**
+* The rule a tenant declaration compiles to, or nothing when there is none.
+*
+* **Restrictive**, and that is the whole design. A restrictive policy is ANDed
+* with every other policy on the table, so tenancy narrows what the
+* collection's own `securityRules` allow and can never widen it. A permissive
+* one would OR with them, and a single `access: "public"` rule elsewhere in the
+* file would take the entire tenancy boundary off without contradicting
+* anything a reader could see.
+*
+* One rule with `operation: "all"` rather than four with `operations: [...]`:
+* `FOR ALL` gives Postgres the USING clause for SELECT/UPDATE/DELETE and the
+* WITH CHECK clause for INSERT/UPDATE, which is exactly the coverage wanted,
+* as one policy with one name instead of four.
+*/
+function buildTenantSecurityRule(collection) {
+	const tenant = getTenantConfig(collection);
+	if (!tenant) return void 0;
+	const expression = tenantScopeExpression(tenant);
+	return {
+		name: tenantPolicyName(getTableName(collection)),
+		mode: "restrictive",
+		operation: "all",
+		condition: expression,
+		check: expression
+	};
+}
+/**
+* An id, however it arrived.
+*
+* A tenant field may be a `belongsTo` relation or a `reference`, and those
+* arrive over the wire as `{ id }` envelopes as often as bare ids. Comparing
+* the envelope to a bare id would refuse every correct write with
+* `TENANT_MISMATCH`, which is the most confusing possible failure — the caller
+* sent exactly the tenant they belong to.
+*/
+function tenantIdOf(value) {
+	if (value === null || value === void 0) return value;
+	if (typeof value === "object") {
+		const id = value.id;
+		return id === void 0 ? value : id;
+	}
+	return value;
+}
+/**
+* Compare two tenant ids as the database will.
+*
+* Stringified, because JSON has one number type and Postgres has several: a
+* caller sending `"42"` for a `bigint` tenant column is writing the same row as
+* one sending `42`, and Postgres agrees after the cast. Refusing one of them
+* would be an API rule the database does not have.
+*/
+function sameTenant(a, b) {
+	if (a === null || a === void 0 || b === null || b === void 0) return false;
+	return String(tenantIdOf(a)) === String(tenantIdOf(b));
+}
+/**
+* Stamp, or refuse, the tenant on a write.
+*
+* Three refusals, and each exists because the alternative lands somewhere
+* worse:
+*
+* - **`TENANT_REQUIRED`** — the caller has no tenant, or belongs to several and
+*   named none. Stamping a guess would put the row in the wrong tenant; letting
+*   it through would write a NULL into a `NOT NULL` column and surface as a
+*   23502 naming a column the caller never wrote.
+* - **`TENANT_MISMATCH`** — the caller named a tenant that is not theirs. The
+*   database refuses this too, through the policy's `WITH CHECK`, but as a
+*   42501 "new row violates row-level security policy" with no mention of which
+*   field or why. Refused here so the answer names the field.
+* - **`TENANT_IMMUTABLE`** — an update that moves a row to another tenant. RLS
+*   would allow it whenever the caller belongs to both, and it is almost never
+*   what anybody meant: it takes the row out of one tenant's history and drops
+*   it into another's, with no trace on either side. A deliberate move is a
+*   `bypassRoles` operation.
+*
+* A bypass caller is exempt from all three: they are trusted across tenants by
+* declaration, and stamping their write would silently confine a support
+* operator's row to whichever tenant they happen to carry.
+*/
+function resolveTenantWrite(input) {
+	const { tenant, values, status, callerTenants, bypass, previousValues, slug } = input;
+	const field = tenant.field;
+	const complete = input.callerTenantsComplete !== false;
+	/** Is `value` one the caller may write? Unknown counts as yes — see `callerTenantsComplete`. */
+	const callerHas = (value) => callerTenants.some((t) => sameTenant(t, value)) || !complete;
+	if (bypass) return { values };
+	const provided = values[field];
+	if (!(status !== "existing")) {
+		if (provided === void 0) return { values };
+		const previous = previousValues?.[field];
+		if (previous !== void 0 && !sameTenant(provided, previous)) return { refusal: {
+			code: "TENANT_IMMUTABLE",
+			field,
+			message: `'${field}' is the tenant '${slug}' rows belong to, and a row cannot change tenant. This update would move it from '${String(tenantIdOf(previous))}' to '${String(tenantIdOf(provided))}'. Create the row in the other tenant and delete this one, or perform the move with a role listed in \`tenant.bypassRoles\`.`
+		} };
+		if (previous === void 0 && !callerHas(provided)) return { refusal: mismatch(field, slug, provided, callerTenants) };
+		return { values };
+	}
+	if (provided === void 0 || provided === null || provided === "") {
+		if (callerTenants.length === 1) return { values: {
+			...values,
+			[field]: tenantIdOf(callerTenants[0])
+		} };
+		return { refusal: {
+			code: "TENANT_REQUIRED",
+			field,
+			message: callerTenants.length === 0 ? `'${slug}' is scoped to a tenant and this request carries none, so there is nothing to write into '${field}'. ` + sourceHint(tenant) : `'${slug}' is scoped to a tenant and this caller belongs to ${callerTenants.length} of them, so '${field}' cannot be inferred. Send it on the write — it must be one the caller belongs to.`
+		} };
+	}
+	if (!callerHas(provided)) return { refusal: mismatch(field, slug, provided, callerTenants) };
+	return { values };
+}
+function mismatch(field, slug, provided, callerTenants) {
+	return {
+		code: "TENANT_MISMATCH",
+		field,
+		message: `'${field}' names tenant '${String(tenantIdOf(provided))}', which this caller does not belong to, so the write to '${slug}' would be refused by the database as well. ` + (callerTenants.length === 0 ? "This request carries no tenant at all." : `The caller's ${callerTenants.length === 1 ? "tenant is" : "tenants are"} ` + callerTenants.map((t) => `'${String(tenantIdOf(t))}'`).join(", ") + ".")
+	};
+}
+/** Where a caller's tenant was supposed to come from, for the 400. */
+function sourceHint(tenant) {
+	return isTenantClaimSource(tenant.from) ? `The tenant comes from the '${tenant.from.claim}' claim on the caller's token; this one has no such claim. Sign in, or add the claim in the custom-claims hook.` : `The tenant comes from rows of '${tenant.from.membership.collection}' whose '${tenant.from.membership.userField}' is the caller; this caller has none.`;
+}
+//#endregion
 //#region src/util/auth-default-policies.ts
 /**
 * Default RLS policies injected by the schema generator.
@@ -2254,8 +2681,16 @@ function callbackRefusal(stage, path) {
 * FORCE RLS. A *user* request never reaches that state: an anonymous one carries
 * `ANONYMOUS_USER_ID`, precisely so it cannot pass for the server here.
 *
+* **For a collection declaring `tenant`, additionally**
+*  5. A **restrictive** tenancy gate for every operation. Same kind of thing as
+*     the admin write gate and injected for the same reason: it is ANDed with
+*     every other policy, so it narrows what the author's permissive rules
+*     grant and can never widen them. See `./tenant.ts`.
+*
 * Opt out with `disableDefaultPolicies: true` to take full responsibility for
-* the collection's RLS.
+* the collection's RLS. The *restrictive* rules are not part of that opt-out:
+* dropping a rule that can only remove access could express nothing but "let
+* more people in", which is what the flag already does by removing the grants.
 */
 var SERVER_OR_ADMIN_EXPR$1 = policy.or(policy.serverContext(), policy.rolesOverlap(["admin"]));
 /** Write operations that must be admin-gated by default on auth collections. */
@@ -2299,11 +2734,27 @@ function adminWriteGate(tableName) {
 		check: SERVER_OR_ADMIN_EXPR$1
 	};
 }
+/**
+* The restrictive tenancy policy, as a list of zero or one.
+*
+* A list so the two call sites can splice it in without a conditional, and a
+* separate function so it is obvious that it is injected on *both* paths —
+* including the `disableDefaultPolicies` one, where it is the only permissive-
+* looking thing that stays. See `./tenant.ts`.
+*/
+function tenantRule(collection) {
+	const rule = buildTenantSecurityRule(collection);
+	return rule ? [rule] : [];
+}
 function getEffectiveSecurityRules(collection) {
 	const explicit = [...collection.securityRules ?? []];
 	const tableName = getTableName(collection);
 	const injected = [];
-	if (isPostgresCollectionConfig(collection) && collection.disableDefaultPolicies) return isAuthCollection(collection) ? [...explicit, adminWriteGate(tableName)] : explicit;
+	if (isPostgresCollectionConfig(collection) && collection.disableDefaultPolicies) return [
+		...explicit,
+		...tenantRule(collection),
+		...isAuthCollection(collection) ? [adminWriteGate(tableName)] : []
+	];
 	injected.push({
 		name: `${tableName}_default_admin_read`,
 		operations: ["select"],
@@ -2323,6 +2774,7 @@ function getEffectiveSecurityRules(collection) {
 		});
 		injected.push(adminWriteGate(tableName));
 	}
+	injected.push(...tenantRule(collection));
 	return [...explicit, ...injected];
 }
 /**
@@ -2337,7 +2789,7 @@ function getEffectiveSecurityRules(collection) {
 * DDL, which policies are injected and how to take them off.
 */
 function getInjectedSecurityRules(collection) {
-	if (isPostgresCollectionConfig(collection) && collection.disableDefaultPolicies) return isAuthCollection(collection) ? [adminWriteGate(getTableName(collection))] : [];
+	if (isPostgresCollectionConfig(collection) && collection.disableDefaultPolicies) return [...tenantRule(collection), ...isAuthCollection(collection) ? [adminWriteGate(getTableName(collection))] : []];
 	const explicitCount = (collection.securityRules ?? []).length;
 	return getEffectiveSecurityRules(collection).slice(explicitCount);
 }
@@ -2395,18 +2847,51 @@ function resolveJunctionSpecs(collections) {
 				table,
 				schema,
 				endpoints: [source, target],
-				declaringSides: [source]
+				declaringSides: [source],
+				properties: mergeJunctionPayload({}, relation.through.properties, table, collection)
 			});
-			else if (!existing.declaringSides.some((s) => s.collection === collection)) existing.declaringSides.push(source);
+			else {
+				existing.properties = mergeJunctionPayload(existing.properties, relation.through.properties, table, collection);
+				if (!existing.declaringSides.some((s) => s.collection === collection)) existing.declaringSides.push(source);
+			}
 		}
 	}
 	return specs;
 }
 /**
+* Fold one side's `through.properties` into the junction's, refusing a
+* disagreement rather than picking a winner.
+*
+* Both ends of a link may declare it — `posts.tags` and `tags.posts` are one
+* junction — and each end may name the payload. Only one table gets created, so
+* two descriptions of `role` that are not the same description are a question
+* with no correct answer: whichever won, one of the two collections would be
+* writing through a column it does not think it has. Compared structurally, so
+* two sides that spell the same property twice (the normal case, and the one
+* the docs recommend) are fine.
+*/
+function mergeJunctionPayload(into, incoming, table, collection) {
+	if (!incoming || Object.keys(incoming).length === 0) return into;
+	const merged = { ...into };
+	for (const [key, property] of Object.entries(incoming)) {
+		const already = merged[key];
+		if (already && JSON.stringify(already) !== JSON.stringify(property)) throw new Error(`The junction table "${table}" is declared from more than one side, and they disagree about the payload column "${key}": "${collection.slug ?? collection.name}" describes it differently than another declaring collection does. One table is created, so both \`through.properties\` blocks have to describe the same column — or only one side should declare it.`);
+		merged[key] = property;
+	}
+	return merged;
+}
+/**
 * A synthetic CollectionConfig standing in for the junction during policy
 * compilation and naming. Its two FK columns carry explicit `columnName`s so
 * `outerField` operands resolve to the exact columns the CREATE TABLE emitted,
 * whatever their casing.
+*
+* The payload columns are here too, exactly as authored. That is what lets one
+* reading of a `Property` serve the junction as well as a collection: the
+* schema planner plans these columns with the same function it plans a
+* collection's with, and the write path validates a `_pivot` against them with
+* the same validator a row's values go through. A second description of a
+* payload column anywhere is a second description that can disagree.
 */
 function getJunctionCollectionConfig(spec) {
 	const properties = {};
@@ -2414,6 +2899,10 @@ function getJunctionCollectionConfig(spec) {
 		type: "string",
 		columnName: endpoint.junctionColumn
 	};
+	for (const [key, property] of Object.entries(spec.properties)) {
+		if (key === JUNCTION_PIVOT_KEY || key in properties) continue;
+		properties[key] = property;
+	}
 	return {
 		slug: spec.table,
 		name: spec.table,
@@ -3550,6 +4039,266 @@ var defaultUsersCollection = defineCollection({
 	}
 });
 //#endregion
+//#region src/collections/field-access.ts
+/**
+* The role that satisfies any non-empty list.
+*
+* The same arm every baseline policy carries: `security_rules` injects
+* `rolesOverlap(['admin'])` into the default read and write policies, and
+* `rebase.dataAsAdmin` is scoped with `{ uid: "service", roles: ["admin"] }`.
+* Without this an author could declare `access: { read: ["hr"] }` and lock the
+* administrator out of a column of their own database — and lock the Studio out
+* of rendering it.
+*/
+var ADMIN_ROLE = "admin";
+/**
+* What a property's access rules actually are, with `excludeFromApi` expanded.
+*
+* Returns `undefined` when the property constrains nothing, so callers can skip
+* the whole check for the overwhelmingly common case.
+*/
+function effectiveAccess(property) {
+	if (!property) return void 0;
+	if (property.excludeFromApi) return EXCLUDED_ACCESS;
+	const access = property.access;
+	if (!access) return void 0;
+	if (access.read === void 0 && access.write === void 0) return void 0;
+	return access;
+}
+/** The rule `excludeFromApi: true` expands to. Frozen: it is shared by every caller. */
+var EXCLUDED_ACCESS = Object.freeze({
+	read: Object.freeze([]),
+	write: Object.freeze([])
+});
+/**
+* Does a caller holding `roles` satisfy `allowed`?
+*
+* Three cases, and the middle one is the one worth stating out loud:
+*
+* - `allowed` omitted — the field carries no rule of its own, so the row's
+*   policies have already answered. True.
+* - `allowed` empty — nobody, at any privilege, through any API. Not the admin,
+*   not the service key, not the trusted plane reading on a caller's behalf.
+*   This is what `excludeFromApi` has always meant on the read side, and
+*   collapsing the two spellings means the empty list has to keep meaning it.
+* - `allowed` non-empty — one of the named roles, or `admin`, or no viewer at
+*   all (the trusted server plane, which is not an API caller).
+*/
+function satisfies(allowed, viewer) {
+	if (allowed === void 0) return true;
+	if (allowed.length === 0) return false;
+	if (!viewer) return true;
+	const roles = viewer.roles;
+	if (!roles || roles.length === 0) return false;
+	return roles.includes("admin") || allowed.some((role) => roles.includes(role));
+}
+/** May this caller receive this field's value? */
+function canReadField(property, viewer) {
+	const access = effectiveAccess(property);
+	return access ? satisfies(access.read, viewer) : true;
+}
+/** May this caller set this field's value? */
+function canWriteField(property, viewer) {
+	const access = effectiveAccess(property);
+	return access ? satisfies(access.write, viewer) : true;
+}
+/**
+* The names on this collection a caller may not touch, in the two spellings a
+* caller can write them in.
+*
+* `declared` is the property keys, which is what has to leave a *known-fields*
+* set. `refused` is those plus the physical column names behind them: a caller
+* who knows the table can send `password_hash` as readily as `passwordHash`, and
+* a rule that only knew the wire name would be one rename away from useless.
+*
+* `kind` picks which half of the rule is read; nothing else differs.
+*/
+function restrictedFieldNames(collection, viewer, kind) {
+	const declared = [];
+	const refused = /* @__PURE__ */ new Set();
+	const allowed = kind === "read" ? canReadField : canWriteField;
+	for (const [name, property] of Object.entries(collection.properties ?? {})) {
+		if (allowed(property, viewer)) continue;
+		declared.push(name);
+		refused.add(name);
+		const columnName = property.columnName;
+		if (columnName) refused.add(columnName);
+	}
+	return {
+		declared,
+		refused
+	};
+}
+/**
+* True when nothing on this collection restricts a field, for either direction.
+*
+* Every read of every row runs through the strip, so the collection that has no
+* rules — which is almost all of them — has to cost one property walk and no
+* allocation.
+*/
+function hasFieldAccessRules(collection) {
+	for (const property of Object.values(collection.properties ?? {})) if (effectiveAccess(property)) return true;
+	return false;
+}
+//#endregion
+//#region src/data/cursor.ts
+/** A cursor that cannot be read at all — truncated, re-encoded, or invented. */
+var CursorError = class CursorError extends Error {
+	code = "INVALID_CURSOR";
+	constructor(detail) {
+		super(`Invalid \`after\` cursor: ${detail}. Pass back the \`meta.nextCursor\` from the previous page unchanged — it is opaque and must not be built by hand.`);
+		this.name = "CursorError";
+		Object.setPrototypeOf(this, CursorError.prototype);
+	}
+};
+/**
+* A cursor that reads fine but describes a different query.
+*
+* Separate from {@link CursorError} because the fix is different: this one is
+* not a corrupt string, it is a correct cursor used against a sort it was not
+* produced under. Seeking anyway would return rows in an order nobody asked
+* for, and — worse — would look like it worked.
+*/
+var CursorMismatchError = class CursorMismatchError extends Error {
+	code = "CURSOR_ORDER_MISMATCH";
+	constructor(cursorKeys, queryKeys) {
+		super(`The \`after\` cursor was produced by a query ordered by ${cursorKeys.map((k) => `"${k}"`).join(", ") || "(nothing)"}, but this query orders by ${queryKeys.map((k) => `"${k}"`).join(", ") || "(nothing)"}. A cursor only continues the listing it came from — keep \`orderBy\` identical across pages, or drop \`after\` to start over.`);
+		this.name = "CursorMismatchError";
+		Object.setPrototypeOf(this, CursorMismatchError.prototype);
+	}
+};
+/**
+* Tag for a value whose JSON round-trip would otherwise lose its type.
+*
+* A `timestamp` column comes back from the driver as a `Date`; JSON turns it
+* into a string, and the string would then be compared against the column by
+* whatever cast Postgres chose. Round-tripping it as a `Date` keeps the
+* comparison the one the ORDER BY made.
+*/
+var DATE_TAG = "$date";
+function encodeValue(value) {
+	if (value instanceof Date) return { [DATE_TAG]: value.toISOString() };
+	return value;
+}
+function decodeValue(value) {
+	if (value && typeof value === "object" && !Array.isArray(value)) {
+		const tagged = value[DATE_TAG];
+		if (typeof tagged === "string") {
+			const date = new Date(tagged);
+			return Number.isNaN(date.getTime()) ? tagged : date;
+		}
+	}
+	return value;
+}
+/** base64url, without depending on Node's Buffer (this package runs in browsers). */
+function toBase64Url(text) {
+	const bytes = new TextEncoder().encode(text);
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function fromBase64Url(encoded) {
+	const padded = encoded.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - encoded.length % 4) % 4);
+	const binary = atob(padded);
+	const bytes = new Uint8Array(binary.length);
+	for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+	return new TextDecoder().decode(bytes);
+}
+/**
+* Encode "everything strictly after this row, in this order".
+*
+* @param orderBy the sort keys the listing ran under, in order of significance
+* @param row     the last row served, which the next page picks up after
+* @param id      that row's id — the tiebreaker every keyset comparison ends on
+* @returns the opaque cursor, or `undefined` when no cursor can describe the
+*   page. That is not a failure: a listing sorted by relevance has no stored
+*   value to compare a later page against (scores are computed per query and
+*   are not on the same scale between two of them), so it pages by offset and
+*   `meta.nextCursor` is simply absent.
+*/
+function encodeCursor(orderBy, row, id) {
+	if (id === void 0 || id === null) return void 0;
+	const keys = orderBy ?? [];
+	const values = {};
+	for (const [field] of keys) {
+		if (!(field in row)) return void 0;
+		values[field] = encodeValue(row[field]);
+	}
+	return toBase64Url(JSON.stringify({
+		k: keys,
+		v: values,
+		i: encodeValue(id)
+	}));
+}
+/**
+* Read a cursor produced by {@link encodeCursor}.
+*
+* @throws {CursorError} when the string is not a cursor this codec wrote.
+*/
+function decodeCursor(raw) {
+	let parsed;
+	try {
+		parsed = JSON.parse(fromBase64Url(raw.trim()));
+	} catch {
+		throw new CursorError("it is not a cursor this API issued");
+	}
+	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw new CursorError("it does not decode to a cursor");
+	const body = parsed;
+	if (!Array.isArray(body.k)) throw new CursorError("it carries no sort keys");
+	if (body.i === void 0) throw new CursorError("it carries no row id");
+	const orderBy = [];
+	for (const entry of body.k) {
+		if (!Array.isArray(entry) || typeof entry[0] !== "string") throw new CursorError("one of its sort keys is malformed");
+		const direction = entry[1] === "desc" ? "desc" : "asc";
+		orderBy.push(entry[2] === "first" || entry[2] === "last" ? [
+			entry[0],
+			direction,
+			entry[2]
+		] : [entry[0], direction]);
+	}
+	const rawValues = body.v && typeof body.v === "object" && !Array.isArray(body.v) ? body.v : {};
+	const values = {};
+	for (const [field, value] of Object.entries(rawValues)) values[field] = decodeValue(value);
+	return {
+		orderBy,
+		values,
+		id: decodeValue(body.i)
+	};
+}
+/**
+* The `orderBy` a request should run under, given a cursor and whatever sort
+* the request itself named.
+*
+* A request that names no sort **adopts the cursor's** — that is what makes
+* `find({ after })` work without restating the `orderBy` from the previous
+* call, and it cannot be wrong, since the cursor is the only sort in play.
+* A request that names one must name the *same* one, key for key, direction for
+* direction, nulls for nulls; anything else is {@link CursorMismatchError}.
+*
+* @throws {CursorMismatchError}
+*/
+function reconcileCursorOrder(cursor, requested) {
+	if (!requested || requested.length === 0) return cursor.orderBy;
+	const spell = (keys) => keys.map(([field, direction, nulls]) => `${field}:${direction}${nulls ? `:${nulls}` : ""}`);
+	const cursorKeys = spell(cursor.orderBy);
+	const queryKeys = spell(requested);
+	if (cursorKeys.length !== queryKeys.length || cursorKeys.some((key, i) => key !== queryKeys[i])) throw new CursorMismatchError(cursorKeys, queryKeys);
+	return requested;
+}
+/**
+* The `startAfter` shape the driver contract takes, built from a cursor.
+*
+* The driver has always accepted `{ id, values }`; this is the one place that
+* shape is produced, so the REST route and the WebSocket ingress cannot drift
+* into two spellings of the same seek.
+*/
+function cursorToStartAfter(cursor) {
+	return {
+		id: cursor.id,
+		values: cursor.values
+	};
+}
+//#endregion
 //#region src/data/sort-dialect.ts
 /**
 * Sort-order wire codec.
@@ -3643,13 +4392,24 @@ function parseOrderBySpecStrict(raw, order) {
 	if (typeof raw[0] === "string" || isRelationAggregateSort(raw[0])) return [toStrictTuple(raw, 0)];
 	return raw.map(toStrictTuple);
 }
+/** `first`/`last`, or a refusal naming the entry — see {@link NullsPlacement}. */
+function toStrictNulls(raw, index) {
+	if (raw === void 0 || raw === null) return void 0;
+	if (raw !== "first" && raw !== "last") throw new OrderBySpecError(`entry ${index} has nulls '${String(raw)}' — expected "first" or "last"`);
+	return raw;
+}
 function toStrictTuple(raw, index) {
 	if (!Array.isArray(raw)) throw new OrderBySpecError(`entry ${index} has no field name`);
 	const key = isRelationAggregateSort(raw[0]) ? sortKeyToString(raw[0]) : raw[0];
 	if (typeof key !== "string" || key.trim() === "") throw new OrderBySpecError(`entry ${index} has no field name`);
 	const direction = raw[1];
 	if (direction !== void 0 && direction !== "asc" && direction !== "desc") throw new OrderBySpecError(`entry ${index} has direction '${String(direction)}'`);
-	return [key, direction ?? "asc"];
+	const nulls = toStrictNulls(raw[2], index);
+	return nulls ? [
+		key,
+		direction ?? "asc",
+		nulls
+	] : [key, direction ?? "asc"];
 }
 /**
 * Serialize a sort to the wire.
@@ -3679,11 +4439,18 @@ function serializeOrderBy(orderBy) {
 	if (typeof orderBy === "string") return orderBy;
 	const list = normalizeOrderBy(orderBy);
 	if (!list) return void 0;
-	if (list.length === 1) return `${list[0][0]}:${list[0][1]}`;
-	return JSON.stringify(list.map(([field, direction]) => ({
+	if (list.length === 1) {
+		const [field, direction, nulls] = list[0];
+		return nulls ? `${field}:${direction}:${nulls}` : `${field}:${direction}`;
+	}
+	return JSON.stringify(list.map(([field, direction, nulls]) => nulls ? {
+		field,
+		direction,
+		nulls
+	} : {
 		field,
 		direction
-	})));
+	}));
 }
 /**
 * Deserialize a wire-format `"field:direction"` string into an {@link OrderByTuple}.
@@ -3718,7 +4485,16 @@ function deserializeOrderBy(raw) {
 	if (idx === -1) return raw.trim() === "" ? void 0 : [raw, "asc"];
 	const field = raw.slice(0, idx);
 	if (field.trim() === "") return void 0;
-	return [field, raw.slice(idx + 1) === "desc" ? "desc" : "asc"];
+	const rest = raw.slice(idx + 1);
+	const nullsIdx = rest.indexOf(":");
+	const dir = nullsIdx === -1 ? rest : rest.slice(0, nullsIdx);
+	const nulls = nullsIdx === -1 ? void 0 : rest.slice(nullsIdx + 1);
+	const direction = dir === "desc" ? "desc" : "asc";
+	return nulls === "first" || nulls === "last" ? [
+		field,
+		direction,
+		nulls
+	] : [field, direction];
 }
 /**
 * Deserialize either wire spelling — the single-key shorthand or the JSON
@@ -3739,7 +4515,14 @@ function deserializeOrderByList(raw) {
 		if (Array.isArray(parsed)) {
 			const list = parsed.map((entry) => {
 				if (typeof entry === "string") return deserializeOrderBy(entry);
-				if (entry && typeof entry === "object" && typeof entry.field === "string") return [entry.field, entry.direction === "desc" ? "desc" : "asc"];
+				if (entry && typeof entry === "object" && typeof entry.field === "string") {
+					const direction = entry.direction === "desc" ? "desc" : "asc";
+					return entry.nulls === "first" || entry.nulls === "last" ? [
+						entry.field,
+						direction,
+						entry.nulls
+					] : [entry.field, direction];
+				}
 			}).filter((entry) => entry !== void 0);
 			return list.length > 0 ? list : void 0;
 		}
@@ -3748,6 +4531,270 @@ function deserializeOrderByList(raw) {
 	return single ? [single] : void 0;
 }
 //#endregion
+//#region src/data/include-spec.ts
+/** An `include` that cannot be read, as opposed to one naming a relation that does not exist. */
+var IncludeSpecError = class IncludeSpecError extends Error {
+	code;
+	constructor(detail, code = "INVALID_INCLUDE") {
+		super(`Invalid \`include\`: ${detail}`);
+		this.name = "IncludeSpecError";
+		this.code = code;
+		Object.setPrototypeOf(this, IncludeSpecError.prototype);
+	}
+};
+var emptyNode = () => ({ children: {} });
+function ensureNode(tree, key) {
+	return tree[key] ??= emptyNode();
+}
+/**
+* Merge one dotted path (`"comments.author"`) into a tree.
+*
+* Merging rather than assigning is what makes `include=comments,comments.author`
+* mean the same thing as `include=comments.author`: the second path deepens the
+* node the first created instead of replacing it and losing its options.
+*/
+function addPath(tree, path) {
+	const segments = path.split(".").map((s) => s.trim()).filter(Boolean);
+	if (segments.length === 0) return;
+	if (segments.length > MAX_INCLUDE_DEPTH) throw new IncludeSpecError(`"${path}" nests ${segments.length} relations deep; the limit is ${MAX_INCLUDE_DEPTH}. Each hop is another query, and an unbounded one walks a self-referencing relation forever.`, "INCLUDE_TOO_DEEP");
+	let level = tree;
+	for (const segment of segments) level = ensureNode(level, segment).children;
+}
+function normalizeOptions(key, options, depth) {
+	if (depth > MAX_INCLUDE_DEPTH) throw new IncludeSpecError(`"${key}" nests more than ${MAX_INCLUDE_DEPTH} relations deep.`, "INCLUDE_TOO_DEEP");
+	if (options.limit !== void 0 && (!Number.isInteger(options.limit) || options.limit < 1)) throw new IncludeSpecError(`"${key}" has limit ${JSON.stringify(options.limit)} — expected a whole number of 1 or more.`);
+	const node = { children: {} };
+	if (options.limit !== void 0) node.limit = options.limit;
+	if (options.where) node.where = options.where;
+	if (options.logical) node.logical = options.logical;
+	if (options.fields && options.fields.length > 0) node.fields = [...options.fields];
+	const orderBy = typeof options.orderBy === "string" ? deserializeOrderByList(options.orderBy) : normalizeOrderBy(options.orderBy);
+	if (orderBy) node.orderBy = orderBy;
+	if (options.include) {
+		const nested = normalizeIncludeAt(options.include, depth + 1);
+		if (nested.wildcard) throw new IncludeSpecError(`"${key}" asks for \`*\` inside a nested include. Name the relations you need.`);
+		node.children = nested.tree;
+	}
+	return node;
+}
+function normalizeIncludeAt(spec, depth) {
+	if (Array.isArray(spec)) {
+		const tree = {};
+		let wildcard = false;
+		for (const raw of spec) {
+			if (typeof raw !== "string") throw new IncludeSpecError(`${typeof raw} is not a relation name`);
+			const name = raw.trim();
+			if (!name) continue;
+			if (name === "*") {
+				wildcard = true;
+				continue;
+			}
+			addPath(tree, name);
+		}
+		return {
+			wildcard,
+			tree
+		};
+	}
+	if (typeof spec !== "object" || spec === null) throw new IncludeSpecError(`${typeof spec} is not a list of relations or an include tree`);
+	const tree = {};
+	let wildcard = false;
+	for (const [key, value] of Object.entries(spec)) {
+		if (key === "*") {
+			if (value) wildcard = true;
+			continue;
+		}
+		if (value === true) {
+			ensureNode(tree, key);
+			continue;
+		}
+		if (value === false || value === void 0 || value === null) continue;
+		if (typeof value !== "object" || Array.isArray(value)) throw new IncludeSpecError(`"${key}" must be \`true\` or an options object`);
+		tree[key] = normalizeOptions(key, value, depth);
+	}
+	return {
+		wildcard,
+		tree
+	};
+}
+/**
+* Collapse any {@link IncludeSpec} spelling into one tree.
+*
+* `["author", "comments.author"]` and
+* `{ author: true, comments: { include: { author: true } } }` normalize to the
+* same value — which is the whole point: the REST parameter can only carry the
+* flat spelling, the SDK prefers the tree, and the driver should never learn
+* about either.
+*
+* @throws {IncludeSpecError} for a shape that is not an include at all, or one
+*   that nests past {@link MAX_INCLUDE_DEPTH}.
+*/
+function normalizeInclude(spec) {
+	if (spec === void 0 || spec === null) return void 0;
+	const normalized = normalizeIncludeAt(spec, 1);
+	if (!normalized.wildcard && Object.keys(normalized.tree).length === 0) return void 0;
+	return normalized;
+}
+/**
+* Every relation name a tree names, as dotted paths — `["comments",
+* "comments.author"]`.
+*
+* Used to report which names an `include` asked for when one of them is not a
+* relation, and to serialize a tree that carries no per-relation options back
+* to the flat wire spelling.
+*/
+function includePaths(tree, prefix = "") {
+	const out = [];
+	for (const [key, node] of Object.entries(tree)) {
+		const path = prefix ? `${prefix}.${key}` : key;
+		out.push(path);
+		out.push(...includePaths(node.children, path));
+	}
+	return out;
+}
+/**
+* The relation names an `include` asks for at the top level.
+*
+* `["author", "comments.author"]` and `{author: true, comments: {...}}` both
+* answer `["author", "comments"]` — a *hop*, not a path, because the only
+* consumer is `?fields=`, which names keys on the row being returned and a
+* nested relation is not one of those.
+*
+* Derived rather than passed: `include` has four spellings and three of them
+* are not a `string[]`, so every consumer that wants the plain names either
+* calls this or reimplements the flattening.
+*/
+function topLevelIncludeNames(spec) {
+	const normalized = normalizeInclude(spec);
+	if (!normalized) return [];
+	return Object.keys(normalized.tree);
+}
+/** Whether any node in the tree carries per-relation options. */
+function hasOptions(tree) {
+	return Object.values(tree).some((node) => node.limit !== void 0 || node.where !== void 0 || node.logical !== void 0 || node.orderBy !== void 0 || node.fields !== void 0 || hasOptions(node.children));
+}
+/**
+* Serialize an {@link IncludeSpec} for the REST `?include=` parameter.
+*
+* Two spellings, and which one is used is decided by the request rather than
+* chosen:
+*
+* - **Comma-separated dotted paths** — `include=author,comments.author`. What a
+*   plain include is, what a human types, and what every existing client sends.
+* - **JSON**, when any relation carries options — `include={"comments":{"limit":5,
+*   "include":{"author":true}}}`. The flat spelling has nowhere to put a
+*   `limit`, and inventing a punctuation for it (`comments(limit:5)`) would be a
+*   third grammar to learn beside the two this API already has.
+*
+* The server accepts both on every list and get route, and tells them apart the
+* same way this does: a value starting with `{` is JSON.
+*/
+function serializeInclude(spec) {
+	const normalized = normalizeInclude(spec);
+	if (!normalized) return void 0;
+	if (normalized.wildcard && Object.keys(normalized.tree).length === 0) return "*";
+	if (!hasOptions(normalized.tree)) {
+		const paths = includePaths(normalized.tree);
+		const leaves = paths.filter((path) => !paths.some((other) => other.startsWith(`${path}.`)));
+		const all = normalized.wildcard ? ["*", ...leaves] : leaves;
+		return all.length > 0 ? all.join(",") : void 0;
+	}
+	return JSON.stringify(toWireTree(normalized));
+}
+/**
+* A normalized tree, back in the {@link IncludeSpec} spelling a caller writes.
+*
+* The round trip is what lets a builder accumulate `include` calls: normalize
+* each, merge, and hand the result back as a spec the next layer can normalize
+* again. Idempotent, so doing it twice changes nothing.
+*/
+function denormalizeInclude(normalized) {
+	return toWireTree(normalized);
+}
+function mergeTrees(into, from) {
+	for (const [key, node] of Object.entries(from)) {
+		const existing = into[key];
+		if (!existing) {
+			into[key] = node;
+			continue;
+		}
+		if (node.limit !== void 0) existing.limit = node.limit;
+		if (node.where !== void 0) existing.where = node.where;
+		if (node.logical !== void 0) existing.logical = node.logical;
+		if (node.orderBy !== void 0) existing.orderBy = node.orderBy;
+		if (node.fields !== void 0) existing.fields = node.fields;
+		existing.children = mergeTrees(existing.children, node.children);
+	}
+	return into;
+}
+/**
+* Combine several `include` requests into one.
+*
+* Repeated `.include(...)` calls on a query builder are additive: each names
+* more of the graph to load, and a later one must not discard what an earlier
+* one asked for. Assigning instead of merging is why `.include("author")
+* .include("tags")` used to load only tags.
+*/
+function mergeIncludeSpecs(existing, additions) {
+	const merged = {
+		wildcard: false,
+		tree: {}
+	};
+	const absorb = (spec) => {
+		const normalized = normalizeInclude(spec);
+		if (!normalized) return;
+		merged.wildcard ||= normalized.wildcard;
+		mergeTrees(merged.tree, normalized.tree);
+	};
+	absorb(existing);
+	const names = additions.filter((a) => typeof a === "string");
+	if (names.length > 0) absorb(names);
+	for (const addition of additions) if (typeof addition !== "string") absorb(addition);
+	if (!merged.wildcard && Object.keys(merged.tree).length === 0) return void 0;
+	return denormalizeInclude(merged);
+}
+function toWireTree(normalized) {
+	const emit = (tree) => {
+		const out = {};
+		for (const [key, node] of Object.entries(tree)) {
+			const options = {};
+			if (node.limit !== void 0) options.limit = node.limit;
+			if (node.where) options.where = node.where;
+			if (node.logical) options.logical = node.logical;
+			if (node.orderBy) options.orderBy = node.orderBy;
+			if (node.fields) options.fields = node.fields;
+			const children = emit(node.children);
+			if (Object.keys(children).length > 0) options.include = children;
+			out[key] = Object.keys(options).length > 0 ? options : true;
+		}
+		return out;
+	};
+	const tree = emit(normalized.tree);
+	if (normalized.wildcard) tree["*"] = true;
+	return tree;
+}
+/**
+* Read the REST `?include=` parameter, in either spelling.
+*
+* @throws {IncludeSpecError} for malformed JSON or a tree that nests too deep.
+*/
+function deserializeInclude(raw) {
+	if (raw === void 0 || raw === null) return void 0;
+	const text = raw.trim();
+	if (!text) return void 0;
+	if (text.startsWith("{")) {
+		let parsed;
+		try {
+			parsed = JSON.parse(text);
+		} catch {
+			throw new IncludeSpecError("the parametrised form must be a JSON object, e.g. {\"comments\":{\"limit\":5,\"include\":{\"author\":true}}}");
+		}
+		if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw new IncludeSpecError("the parametrised form must be a JSON object");
+		return parsed;
+	}
+	return text.split(",").map((s) => s.trim()).filter(Boolean);
+}
+//#endregion
 //#region src/data/query_builder.ts
 function or(...conditions) {
 	return {
@@ -3761,6 +4808,26 @@ function and(...conditions) {
 		conditions
 	};
 }
+/**
+* Negate a group: `not(a)` is `NOT a`, and `not(a, b)` is `NOT (a AND b)`.
+*
+* The conjunction, not the disjunction — one rule, stated on
+* {@link LogicalCondition} and applied identically by the wire codec, the REST
+* `?not=` parameter and every driver compiler. Groups nest, so De Morgan's
+* other half is `not(or(a, b))`.
+*
+* It compiles to a real SQL `NOT (...)` rather than to inverted operators,
+* which matters more than it looks: SQL is three-valued, so `NOT (a AND b)` and
+* `(NOT a) OR (NOT b)` stop agreeing the moment a NULL is involved, and only
+* one of them is the query the caller wrote. It also means a negation includes
+* rows whose column is NULL — which is what `NOT` means.
+*/
+function not(...conditions) {
+	return {
+		type: "not",
+		conditions
+	};
+}
 function cond(column, operator, value) {
 	return {
 		column,
@@ -3960,26 +5027,6 @@ function normalizeMaxRows(raw) {
 	return Math.max(0, Math.floor(raw));
 }
 /**
-* Add one condition to a `where` map without disturbing what is already there.
-*
-* The caller's own filter on the cursor column has to survive — dropping it
-* would widen the query, which is the silent-filter-loss failure mode — so a
-* second condition on the same column becomes the array-of-tuples form that
-* `FindParams.where` already accepts, and both are AND-ed.
-*/
-function appendCondition(where, column, condition) {
-	const next = { ...where ?? {} };
-	const existing = next[column];
-	if (existing === void 0) next[column] = condition;
-	else if (Array.isArray(existing) && existing.length > 0 && Array.isArray(existing[0])) next[column] = [...existing, condition];
-	else next[column] = [existing, condition];
-	return next;
-}
-function cursorEquals(a, b) {
-	if (a instanceof Date && b instanceof Date) return a.getTime() === b.getTime();
-	return Object.is(a, b);
-}
-/**
 * Walk every row a query matches, yielding one row at a time and fetching the
 * next page only when the consumer asks for it.
 *
@@ -3995,30 +5042,23 @@ async function* paginateFind(find, params, label = "collection") {
 	const findParams = { ...rest };
 	const size = normalizePageSize(pageSize);
 	const pageCap = normalizeMaxPages(maxPages);
-	const cursorField = typeof cursor === "string" ? cursor : cursor?.field;
-	const requestedDirection = typeof cursor === "object" && cursor !== null ? cursor.direction : void 0;
-	let direction = "asc";
-	if (cursorField) {
-		const orderBy = normalizeOrderBy(findParams.orderBy);
-		if (orderBy && orderBy.length > 1) throw new RebasePaginationError("cursor-order-mismatch", `Cannot seek on "${cursorField}" while ordering "${label}" by ${orderBy.map(([field]) => `"${field}"`).join(", ")}: keyset pagination advances along a single column. Order by "${cursorField}" alone, or drop the cursor and page by offset.`);
-		if (orderBy && orderBy[0][0] !== cursorField) throw new RebasePaginationError("cursor-order-mismatch", `Cannot seek on "${cursorField}" while ordering "${label}" by "${orderBy[0][0]}": keyset pagination only advances along the column the query is sorted by. Order by "${cursorField}", or drop the cursor and page by offset.`);
-		direction = requestedDirection ?? orderBy?.[0][1] ?? "asc";
-		findParams.orderBy = [cursorField, direction];
-	}
-	const seekOp = direction === "desc" ? "<" : ">";
-	const baseWhere = findParams.where;
+	const seekRequested = cursor !== void 0 && cursor !== null;
+	if (seekRequested) {
+		const field = typeof cursor === "string" ? cursor : cursor.field;
+		const requested = typeof cursor === "object" && cursor !== null ? cursor.direction : void 0;
+		if (!normalizeOrderBy(findParams.orderBy)) findParams.orderBy = [field, requested ?? "asc"];
+	}
 	let offset = 0;
 	let pages = 0;
-	let cursorValue;
-	let seeking = false;
+	let after;
 	for (;;) {
 		if (pages >= pageCap) throw new RebasePaginationError("max-pages", `Iterating "${label}" made ${pages} requests without the server reporting the end of the collection. Stopping rather than looping forever — raise \`maxPages\` if the walk is genuinely this long, or check that the backend sets \`meta.hasMore\`.`);
 		const pageParams = {
 			...findParams,
 			limit: size
 		};
-		if (cursorField) {
-			if (seeking) pageParams.where = appendCondition(baseWhere, cursorField, [seekOp, cursorValue]);
+		if (seekRequested) {
+			if (after) pageParams.after = after;
 		} else pageParams.offset = offset;
 		const page = await find(pageParams);
 		pages += 1;
@@ -4026,12 +5066,11 @@ async function* paginateFind(find, params, label = "collection") {
 		if (rows.length === 0) return;
 		for (const row of rows) yield row;
 		if (page?.meta?.hasMore !== true) return;
-		if (cursorField) {
-			const nextValue = rows[rows.length - 1]?.[cursorField];
-			if (nextValue === void 0 || nextValue === null) throw new RebasePaginationError("cursor-missing", `Cannot seek past the last row of "${label}": it has no value for the cursor column "${cursorField}". Pick a column that is present and non-null on every row.`);
-			if (seeking && cursorEquals(nextValue, cursorValue)) throw new RebasePaginationError("cursor-stalled", `Iterating "${label}" is stuck: two pages in a row ended at ${cursorField}=${String(nextValue)}. The cursor column has to be unique — a repeated value cannot be seeked past, and continuing would either loop forever or skip the duplicates. Use the primary key, or page by offset.`);
-			cursorValue = nextValue;
-			seeking = true;
+		if (seekRequested) {
+			const next = page.meta.nextCursor;
+			if (!next) throw new RebasePaginationError("cursor-missing", `Cannot seek past the last row of "${label}": the server reported another page but issued no cursor for it. An ordering with no stored value to compare against — relevance (\`_score\`) — cannot key a cursor. Drop \`cursor\` to page by offset.`);
+			if (next === after) throw new RebasePaginationError("cursor-stalled", `Iterating "${label}" is stuck: two pages in a row ended on the same cursor, so the walk cannot advance. Continuing would loop forever. Page by offset instead, or report this — a cursor that does not move is a server-side bug.`);
+			after = next;
 		} else offset += rows.length;
 	}
 }
@@ -4473,15 +5512,66 @@ function serializeFilter(filter) {
 	return result;
 }
 /**
+* The spellings a null-testing operator's operand may take.
+*
+* The serializer writes `isnull.null`; a hand-written `isnull.true` means the
+* same thing and has always been accepted. Anything else after the operator is
+* not an operand it has — `notnull.reason` is a *value* — see
+* {@link deserializeSingle}.
+*/
+var NULL_OPERANDS = /* @__PURE__ */ new Set([
+	"null",
+	"true",
+	"false",
+	""
+]);
+/**
 * Parse a single PostgREST dot-string into a `[WhereFilterOp, unknown]` tuple.
 *
 * All values are returned as strings — the wire format carries no type
 * metadata, so coercion is the data driver's responsibility.
 *
-* If the string doesn't match a known operator prefix, it falls back to
-* `["==", originalString]` (treating the whole string as an equality value).
-* This intentional defense handles values like `"user@host.com"` or
-* `"1.2.3"` that happen to contain dots.
+* ## When a leading segment is an operator, and when it is part of the value
+*
+* `?status=in.progress` and `?status=in.(a,b)` differ by one character and mean
+* entirely different things, and the reading here decides which. The rule, in
+* full:
+*
+* > A dot-string is read as `operator.operand` **only** when its first segment
+* > names a known REST operator **and** what follows is a well-formed operand
+* > *for that operator's arity*. Otherwise the whole string is the value.
+*
+* Arity, per operator family:
+*
+* - **List** operators (`in`, `nin`, `csa` — `LIST_OPS`) take a parenthesised
+*   list and nothing else. `in.(draft,review)` is the operator; `in.progress`
+*   is the *value* `"in.progress"`, because there is no list there and so no
+*   `in` filter that could have been written. That case used to compile to
+*   `status IN ('progress')` — a filter the caller never wrote, quietly
+*   matching the wrong rows and, on a status field, hiding every row they were
+*   looking for.
+* - **Null** operators (`isnull`, `notnull` — {@link NULL_OPS}) take no
+*   operand: only {@link NULL_OPERANDS}. `notnull.reason` is the value
+*   `"notnull.reason"`, not "reason is not null".
+* - **Everything else** takes one scalar, and any remainder is one — including
+*   the empty string, so `eq.` really is "equals the empty string".
+*
+* ### The one ambiguity that remains, and how to write past it
+*
+* A scalar operator's operand is unconstrained, so `?status=like.that` is a
+* `LIKE 'that'` and no rule at this layer can tell it from the literal value
+* `"like.that"` — both are well-formed encodings, and picking either by guess
+* would break the other. Two spellings say "value" unambiguously, and both
+* round-trip:
+*
+* - `?status=eq.like.that` — name the operator. The *first* segment is consumed
+*   as the operator and everything after it is the value, dots and all. This is
+*   what `serializeFilter` emits, which is why the SDK never meets the
+*   ambiguity at all.
+* - `?where={"status":["==","like.that"]}` — the JSON dialect's tuple form.
+*
+* Values that merely *contain* dots (`user@host.com`, `1.2.3`) were never
+* ambiguous: their first segment names no operator to begin with.
 */
 function deserializeSingle(raw) {
 	const dotIndex = raw.indexOf(".");
@@ -4490,11 +5580,15 @@ function deserializeSingle(raw) {
 	const rest = raw.substring(dotIndex + 1);
 	const canonicalOp = REST_OP_LOOKUP.get(prefix);
 	if (!canonicalOp) return ["==", raw];
-	if (NULL_OPS.has(canonicalOp)) return [canonicalOp, null];
+	if (NULL_OPS.has(canonicalOp)) {
+		if (!NULL_OPERANDS.has(rest)) return ["==", raw];
+		return [canonicalOp, null];
+	}
 	if (rest.startsWith("(") && rest.endsWith(")")) {
 		const inner = rest.slice(1, -1);
 		return [canonicalOp, inner === EMPTY_LIST_TOKEN ? [] : splitListItems(inner)];
 	}
+	if (LIST_OPS.has(canonicalOp)) return ["==", raw];
 	return [canonicalOp, rest];
 }
 /**
@@ -4647,7 +5741,7 @@ function splitLeafCondition(str) {
 var MAX_LOGICAL_NESTING_DEPTH = 32;
 function deserializeLogicalCondition(str, nesting = 0) {
 	if (nesting > 32) throw new Error(`Filter groups nest more than 32 levels deep. Flatten the condition — \`or(a,or(b,c))\` is \`or(a,b,c)\`.`);
-	const logicalMatch = str.match(/^(and|or)\((.+)\)$/);
+	const logicalMatch = str.match(/^(and|or|not)\((.+)\)$/);
 	if (logicalMatch) {
 		const type = logicalMatch[1];
 		const innerStr = logicalMatch[2];
@@ -4701,6 +5795,33 @@ function deserializeLogicalCondition(str, nesting = 0) {
 var noRealtime = (slug) => `Realtime is not available for "${slug}": its data source does not support subscriptions.`;
 /** What a client says when its data source cannot count. */
 var noCount = (slug) => `Counting is not available for "${slug}": its data source does not support it.`;
+/**
+* Derive the response key an aggregate comes back under.
+*
+* `sum(total)` → `sum_total`, `count()` → `count`. Written once, here, because
+* the REST parser derives the same alias from `?select=sum(total)` and the two
+* have to agree — a caller reading `row.sum_total` off an SDK result and off an
+* HTTP response is reading the same key or the SDK is broken.
+*/
+function aggregateAlias(fn, field) {
+	return field ? `${fn}_${field}` : fn;
+}
+function toDriverAggregate(select) {
+	const field = select.field;
+	return {
+		fn: select.fn,
+		field,
+		alias: aggregateAlias(select.fn, field)
+	};
+}
+/**
+* What a client says when its data source cannot aggregate.
+*
+* A stub rather than a fallback that fetches and reduces in JavaScript: that
+* would be wrong under a `limit` and unaffordable without one, and it would look
+* like it had worked.
+*/
+var noAggregate = (slug) => `Aggregates are not available for "${slug}": its data source does not implement them.`;
 function createPrimaryKeyResolver(options) {
 	const cache = /* @__PURE__ */ new Map();
 	const warned = /* @__PURE__ */ new Set();
@@ -4722,6 +5843,89 @@ function createPrimaryKeyResolver(options) {
 	};
 }
 /**
+* Build the admin's view model out of the row the wire serves.
+*
+* The wire has ONE shape, for every consumer: flat columns, typed the way the
+* database typed them, and a relation rendered as the target's own columns (or
+* only its foreign key, when nothing asked for it). That is the REST contract,
+* what `find()` returns, what `listen()` pushes, and what the generated types
+* describe.
+*
+* The admin renders neither of those directly. Its date field requires a real
+* `Date` and rejects a string outright; its relation cells read `.data.values`
+* off a relation ref. Those requirements are the *admin's*, so they are met
+* here — in the browser, from the collection config the panel already has —
+* rather than by asking the server for a second wire shape.
+*
+* That second shape is what this replaces. Until 2026-09-09 the realtime wire
+* carried the view model and every other read carried flat rows, so `find()`
+* and `listen()` answered one query two ways; unifying the wire without doing
+* this conversion is what left every date cell reading "Invalid date value"
+* and every relation cell "Unexpected value".
+*
+* Values already in view-model form pass through untouched: a driver that
+* still sends `{ __type: "date" }` or a relation ref (the client revives both)
+* is served by the same walk.
+*/
+function toViewModelValues(values, properties, collection, resolveCollection) {
+	if (!properties) return values;
+	const relations = collection ? resolveCollectionRelations(collection) : {};
+	let out;
+	const write = (key, value) => {
+		out = out ?? { ...values };
+		out[key] = value;
+	};
+	for (const [key, rawProperty] of Object.entries(properties)) {
+		const property = rawProperty;
+		if (!property) continue;
+		if (!(key in values)) {
+			const fkRelation = relations[key];
+			const column = fkRelation && "localKey" in fkRelation ? fkRelation.localKey : void 0;
+			const fk = column !== void 0 ? values[column] ?? values[toWireKey(column)] : void 0;
+			const fkTarget = fkRelation?.targetSlug;
+			if (fkTarget && (typeof fk === "string" || typeof fk === "number")) write(key, new EntityRelation(fk, fkTarget));
+			continue;
+		}
+		const value = values[key];
+		if (value === null || value === void 0) continue;
+		const relation = relations[key];
+		if (relation && (property.type === "relation" || property.of?.type === "relation" || property.type === "array")) {
+			const target = relation.targetSlug;
+			if (!target) continue;
+			const targetProperties = resolveCollection?.(target)?.properties;
+			const targetCollection = resolveCollection?.(target);
+			const toRef = (item) => {
+				if (item instanceof EntityRelation) return item;
+				if (typeof item === "object" && item !== null && "__type" in item) return item;
+				if (typeof item === "object" && item !== null) {
+					const row = item;
+					const keys = targetCollection ? resolvePrimaryKeys(targetCollection) : [];
+					const id = keys.length > 0 ? buildCompositeId(row, keys) : row.id;
+					if (id === void 0 || id === null || id === "") return item;
+					return new EntityRelation(id, target, {
+						id,
+						path: target,
+						values: toViewModelValues(row, targetProperties, targetCollection, resolveCollection)
+					});
+				}
+				if (typeof item === "string" || typeof item === "number") return new EntityRelation(item, target);
+				return item;
+			};
+			write(key, Array.isArray(value) ? value.map(toRef) : toRef(value));
+			continue;
+		}
+		if (property.type === "date" && !(value instanceof Date)) {
+			if (typeof value === "string" || typeof value === "number") {
+				const date = new Date(value);
+				write(key, isNaN(date.getTime()) ? null : date);
+			}
+			continue;
+		}
+		if (property.type === "map" && property.properties && typeof value === "object" && !Array.isArray(value)) write(key, toViewModelValues(value, property.properties, void 0, resolveCollection));
+	}
+	return out ?? values;
+}
+/**
 * Give a flat row the Entity view-model the admin renders.
 *
 * The address is *derived here* — it is not a column, and the row it came from
@@ -4732,12 +5936,12 @@ function createPrimaryKeyResolver(options) {
 * `primaryKeys` empty falls back to a literal `id` on the row: drivers other
 * than postgres still serve rows with one, and this keeps them working.
 */
-function rowToEntity(row, slug, primaryKeys = []) {
+function rowToEntity(row, slug, primaryKeys = [], toViewModel) {
 	const { _matches, ...values } = row;
 	return {
 		id: primaryKeys.length > 0 ? buildCompositeId(row, primaryKeys) : row.id,
 		path: slug,
-		values,
+		values: toViewModel ? toViewModel(values) : values,
 		..._matches ? { searchMatches: _matches } : {}
 	};
 }
@@ -4757,14 +5961,16 @@ function inlineEnvelope(envelope) {
 * Replace every relation envelope on a row with the target's flat columns.
 *
 * The SDK serves one relation shape — the inlined one (see
-* {@link RestFetchService}) — and reads that come back through a *driver*
-* method rather than the REST pipeline still carry envelopes. Realtime is the
-* one such read left: there is no `listenForRest`, so the rows arrive shaped
-* for the admin and are flattened here instead.
+* {@link RestFetchService}) — and Postgres now serves it on every read, so
+* against that driver this walk finds nothing to do. It stays for the drivers
+* whose own `fetchCollection` still answers with refs: a developer reading
+* through this accessor gets one shape whichever driver is underneath.
 *
 * Only applied where the REST pipeline is the contract (see `find`); a driver
-* without a `restFetchService` keeps whatever it returns, so the admin's own
-* path through {@link buildRebaseData} is untouched.
+* without a `restFetchService` keeps whatever it returns.
+*
+* Note this is NOT how the admin gets its view model — that is built in the
+* browser by {@link toViewModelValues}, from the same flat row.
 */
 function inlineRelationRefs(row) {
 	let out;
@@ -4777,30 +5983,43 @@ function inlineRelationRefs(row) {
 	}
 	return out ?? row;
 }
-function createDriverAccessor(driver, slug, getPks = () => []) {
+function createDriverAccessor(driver, slug, getPks = () => [], toViewModel) {
 	const accessor = {
 		async find(params) {
 			const filter = params?.where ? deserializeFilter(params.where) : void 0;
 			const { limit, offset, driverOffset } = resolveFindWindow(params);
+			const cursor = params?.after ? decodeCursor(params.after) : void 0;
+			const orderBy = cursor ? reconcileCursorOrder(cursor, normalizeOrderBy(params?.orderBy)) : normalizeOrderBy(params?.orderBy);
+			const startAfter = cursor ? cursorToStartAfter(cursor) : void 0;
+			const probeLimit = startAfter ? limit + 1 : limit;
 			const fetchService = driver.restFetchService;
-			const rows = fetchService ? await fetchService.fetchCollectionForRest(slug, {
+			const fetched = fetchService ? await fetchService.fetchCollectionForRest(slug, {
 				filter,
 				logical: params?.logical,
-				limit,
-				offset: driverOffset,
-				orderBy: normalizeOrderBy(params?.orderBy),
-				searchString: params?.searchString
+				limit: probeLimit,
+				offset: startAfter ? void 0 : driverOffset,
+				startAfter,
+				orderBy,
+				searchString: params?.searchString,
+				fields: params?.fields,
+				distinct: params?.distinct
 			}, params?.include) : await driver.fetchCollection({
 				path: slug,
-				limit,
-				offset: driverOffset,
+				limit: probeLimit,
+				offset: startAfter ? void 0 : driverOffset,
+				startAfter,
 				filter,
 				logical: params?.logical,
-				orderBy: normalizeOrderBy(params?.orderBy),
-				searchString: params?.searchString
+				orderBy,
+				searchString: params?.searchString,
+				include: params?.include,
+				fields: params?.fields,
+				distinct: params?.distinct
 			});
+			const seeking = startAfter !== void 0;
+			const rows = seeking ? fetched.slice(0, limit) : fetched;
 			let total = rows.length + offset;
-			let hasMore = rows.length >= limit;
+			let hasMore = seeking ? fetched.length > limit : rows.length >= limit;
 			if (driver.count) {
 				total = await driver.count({
 					path: slug,
@@ -4808,15 +6027,18 @@ function createDriverAccessor(driver, slug, getPks = () => []) {
 					logical: params?.logical,
 					searchString: params?.searchString
 				});
-				hasMore = offset + rows.length < total;
+				if (!seeking) hasMore = offset + rows.length < total;
 			}
+			const last = rows[rows.length - 1];
+			const nextCursor = hasMore && last && driver.restFetchService?.cursorFor ? driver.restFetchService.cursorFor(slug, last, orderBy) : void 0;
 			return {
-				data: rows.map((row) => rowToEntity(row, slug, getPks())),
+				data: rows.map((row) => rowToEntity(row, slug, getPks(), toViewModel)),
 				meta: {
 					total,
 					limit,
 					offset,
-					hasMore
+					hasMore,
+					...nextCursor && { nextCursor }
 				}
 			};
 		},
@@ -4826,22 +6048,31 @@ function createDriverAccessor(driver, slug, getPks = () => []) {
 				path: slug,
 				id
 			});
-			return row ? rowToEntity(row, slug, getPks()) : void 0;
+			return row ? rowToEntity(row, slug, getPks(), toViewModel) : void 0;
 		},
+		aggregate: driver.restFetchService?.aggregate ? async (params) => driver.restFetchService.aggregate(slug, {
+			aggregates: params.select.map(toDriverAggregate),
+			groupBy: params.groupBy,
+			filter: params.where ? deserializeFilter(params.where) : void 0,
+			logical: params.logical,
+			searchString: params.searchString,
+			limit: params.limit
+		}) : void 0,
 		async create(data, id) {
 			return rowToEntity(await driver.save({
 				path: slug,
 				values: data,
 				id,
 				status: "new"
-			}), slug, getPks());
+			}), slug, getPks(), toViewModel);
 		},
 		createMany: driver.saveMany ? async (data, options) => {
 			return (await driver.saveMany({
 				path: slug,
 				rows: data,
-				upsert: options?.upsert
-			})).map((row) => rowToEntity(row, slug, getPks()));
+				upsert: options?.upsert,
+				onConflict: options?.onConflict
+			})).map((row) => rowToEntity(row, slug, getPks(), toViewModel));
 		} : void 0,
 		async update(id, data) {
 			return rowToEntity(await driver.save({
@@ -4849,7 +6080,7 @@ function createDriverAccessor(driver, slug, getPks = () => []) {
 				values: data,
 				id,
 				status: "existing"
-			}), slug, getPks());
+			}), slug, getPks(), toViewModel);
 		},
 		async delete(id) {
 			return driver.delete({ row: {
@@ -4865,7 +6096,7 @@ function createDriverAccessor(driver, slug, getPks = () => []) {
 					id: u.id,
 					values: u.data
 				}))
-			})).map((row) => rowToEntity(row, slug, getPks()));
+			})).map((row) => rowToEntity(row, slug, getPks(), toViewModel));
 		} : void 0,
 		deleteMany: driver.deleteMany ? async (ids) => {
 			await driver.deleteMany({
@@ -4897,7 +6128,7 @@ function createDriverAccessor(driver, slug, getPks = () => []) {
 				vectorSearch: params?.vectorSearch,
 				onUpdate: (entities) => {
 					onUpdate({
-						data: entities.map((row) => rowToEntity(normalize(row), slug, getPks())),
+						data: entities.map((row) => rowToEntity(normalize(row), slug, getPks(), toViewModel)),
 						meta: {
 							total: offset + entities.length,
 							limit,
@@ -4914,7 +6145,7 @@ function createDriverAccessor(driver, slug, getPks = () => []) {
 			return driver.listenOne({
 				path: slug,
 				id,
-				onUpdate: (entity) => onUpdate(entity ? rowToEntity(normalize(entity), slug, getPks()) : void 0),
+				onUpdate: (entity) => onUpdate(entity ? rowToEntity(normalize(entity), slug, getPks(), toViewModel) : void 0),
 				onError
 			});
 		} : void 0,
@@ -4956,13 +6187,32 @@ function createDriverAccessor(driver, slug, getPks = () => []) {
 * await data.products.create({ name: "Camera", price: 299 });
 * const { data: items } = await data.products.find({ where: { status: ["==", "published"] } });
 */
+/**
+* The view-model converter for one collection, or `undefined` when there is no
+* collection config to build it from.
+*
+* Absent is the honest answer for every consumer that is not the admin: the
+* flat SDK derives itself from this same layer (`buildSdkData`) and must keep
+* the wire's own types, and it registers no collection resolver.
+*/
+function createViewModelConverter(options) {
+	if (!options?.resolveCollection) return () => void 0;
+	return function converterFor(slug) {
+		return (values) => {
+			const collection = options.resolveCollection?.(slug);
+			if (!collection) return values;
+			return toViewModelValues(values, collection.properties, collection, options.resolveCollection);
+		};
+	};
+}
 function buildRebaseData(driver, options) {
 	const cache = /* @__PURE__ */ new Map();
 	const primaryKeysFor = createPrimaryKeyResolver(options);
+	const viewModelFor = createViewModelConverter(options);
 	function getAccessor(slug) {
 		let accessor = cache.get(slug);
 		if (!accessor) {
-			accessor = createDriverAccessor(driver, slug, () => primaryKeysFor(slug));
+			accessor = createDriverAccessor(driver, slug, () => primaryKeysFor(slug), viewModelFor(slug));
 			cache.set(slug, accessor);
 		}
 		return accessor;
@@ -5017,9 +6267,14 @@ var SdkQueryBuilder = class {
 		return this;
 	}
 	/** Called again, this adds a tie-breaker rather than replacing the sort. */
-	orderBy(column, direction = "asc") {
+	orderBy(column, direction = "asc", nulls) {
 		const existing = normalizeOrderBy(this.params.orderBy) ?? [];
-		this.params.orderBy = [...existing, [sortKeyToString(column), direction]];
+		const key = sortKeyToString(column);
+		this.params.orderBy = [...existing, nulls ? [
+			key,
+			direction,
+			nulls
+		] : [key, direction]];
 		return this;
 	}
 	limit(count) {
@@ -5044,13 +6299,39 @@ var SdkQueryBuilder = class {
 		};
 		return this;
 	}
+	/**
+	* Load relations. Merges rather than replaces, so `.include("author")` then
+	* `.include({ comments: { limit: 5 } })` asks for both — a builder call that
+	* silently discarded an earlier one is the same defect `where` had.
+	*/
 	include(...relations) {
-		this.params.include = relations;
+		this.params.include = mergeIncludeSpecs(this.params.include, relations);
+		return this;
+	}
+	fields(...columns) {
+		this.params.fields = [...this.params.fields ?? [], ...columns];
+		return this;
+	}
+	distinct(enabled = true) {
+		this.params.distinct = enabled;
+		return this;
+	}
+	after(cursor) {
+		this.params.after = cursor;
 		return this;
 	}
 	async find() {
 		return this.client.find(this.params);
 	}
+	/** Aggregate the matching rows. See {@link SDKCollectionClient.aggregate}. */
+	async aggregate(params) {
+		return this.client.aggregate({
+			...params,
+			where: this.params.where,
+			logical: this.params.logical,
+			searchString: this.params.searchString
+		});
+	}
 	/**
 	* Page through everything this query matches, one row at a time.
 	*
@@ -5128,6 +6409,24 @@ function toSdkCollectionClient(snap, slug = "collection") {
 			if (!snap.createMany) throw new Error("Bulk writes are not supported by this collection's data source. Fall back to create() per record.");
 			return (await snap.createMany(data, options)).map(entityToRow);
 		},
+		/**
+		* One row through the bulk path, because the bulk path is where the
+		* conflict target lives.
+		*
+		* `CollectionAccessor` has no single-row upsert and adding one would
+		* mean a second way to say the same thing to the same driver method —
+		* `saveMany` already takes `upsert` and `onConflict`, and a batch of
+		* one is exactly an upsert of one.
+		*/
+		async upsert(data, options) {
+			if (!snap.createMany) throw new Error("Upsert is not supported by this collection's data source: it needs a bulk write, which this driver does not implement. Fall back to create() or update().");
+			const row = (await snap.createMany([data], {
+				upsert: true,
+				onConflict: options?.onConflict
+			}))[0];
+			if (!row) throw new Error(`Upsert into "${slug}" returned no row.`);
+			return entityToRow(row);
+		},
 		async update(id, data) {
 			return entityToRow(await snap.update(id, data));
 		},
@@ -5160,12 +6459,16 @@ function toSdkCollectionClient(snap, slug = "collection") {
 			if (typeof columnOrCondition === "object") return builder.where(columnOrCondition);
 			return builder.where(columnOrCondition, operator, value);
 		},
-		orderBy: (column, direction) => new SdkQueryBuilder(client).orderBy(column, direction),
+		orderBy: (column, direction, nulls) => new SdkQueryBuilder(client).orderBy(column, direction, nulls),
 		limit: (count) => new SdkQueryBuilder(client).limit(count),
 		offset: (count) => new SdkQueryBuilder(client).offset(count),
 		search: (searchString) => new SdkQueryBuilder(client).search(searchString),
 		vectorSearch: (property, vector, options) => new SdkQueryBuilder(client).vectorSearch(property, vector, options),
-		include: (...relations) => new SdkQueryBuilder(client).include(...relations)
+		include: (...relations) => new SdkQueryBuilder(client).include(...relations),
+		fields: (...columns) => new SdkQueryBuilder(client).fields(...columns),
+		distinct: (enabled) => new SdkQueryBuilder(client).distinct(enabled),
+		after: (cursor) => new SdkQueryBuilder(client).after(cursor),
+		aggregate: snap.aggregate ? (params) => snap.aggregate(params) : unsupportedMethod(noAggregate(slug))
 	};
 	return client;
 }
@@ -5174,39 +6477,40 @@ function toSdkCollectionClient(snap, slug = "collection") {
 * {@link CollectionAccessor}. Every returned row is re-wrapped into the
 * `{ id, path, values }` view-model the admin panel renders.
 */
-function toEntityAccessor(sdk, slug, getPks = () => []) {
+function toEntityAccessor(sdk, slug, getPks = () => [], toViewModel) {
 	const accessor = {
 		async find(params) {
 			const res = await sdk.find(params);
 			return {
-				data: res.data.map((row) => rowToEntity(row, slug, getPks())),
+				data: res.data.map((row) => rowToEntity(row, slug, getPks(), toViewModel)),
 				meta: res.meta
 			};
 		},
 		async findById(id) {
 			const row = await sdk.findById(id);
-			return row ? rowToEntity(row, slug, getPks()) : void 0;
+			return row ? rowToEntity(row, slug, getPks(), toViewModel) : void 0;
 		},
 		async create(data, id) {
-			return rowToEntity(await sdk.create(data, id), slug, getPks());
+			return rowToEntity(await sdk.create(data, id), slug, getPks(), toViewModel);
 		},
 		createMany: sdk.createMany ? async (data, options) => {
-			return (await sdk.createMany(data, options)).map((row) => rowToEntity(row, slug, getPks()));
+			return (await sdk.createMany(data, options)).map((row) => rowToEntity(row, slug, getPks(), toViewModel));
 		} : void 0,
 		async update(id, data) {
 			const row = await sdk.update(id, data);
 			if (!row) throw new Error(`Update returned no data for id ${id}`);
-			return rowToEntity(row, slug, getPks());
+			return rowToEntity(row, slug, getPks(), toViewModel);
 		},
 		delete(id) {
 			return sdk.delete(id);
 		},
 		count: isUnsupported(sdk.count) ? void 0 : (params) => sdk.count(params),
+		aggregate: isUnsupported(sdk.aggregate) ? void 0 : (params) => sdk.aggregate(params),
 		listen: isUnsupported(sdk.listen) ? void 0 : (params, onUpdate, onError) => sdk.listen(params, (res) => onUpdate({
-			data: res.data.map((row) => rowToEntity(row, slug, getPks())),
+			data: res.data.map((row) => rowToEntity(row, slug, getPks(), toViewModel)),
 			meta: res.meta
 		}), onError),
-		listenById: isUnsupported(sdk.listenById) ? void 0 : (id, onUpdate, onError) => sdk.listenById(id, (row) => onUpdate(row ? rowToEntity(row, slug, getPks()) : void 0), onError),
+		listenById: isUnsupported(sdk.listenById) ? void 0 : (id, onUpdate, onError) => sdk.listenById(id, (row) => onUpdate(row ? rowToEntity(row, slug, getPks(), toViewModel) : void 0), onError),
 		where(columnOrCondition, operator, value) {
 			const builder = new QueryBuilder(accessor);
 			if (typeof columnOrCondition === "object") return builder.where(columnOrCondition);
@@ -5242,10 +6546,11 @@ function toEntityAccessor(sdk, slug, getPks = () => []) {
 function wrapAsEntityData(sdkData, options) {
 	const cache = /* @__PURE__ */ new Map();
 	const primaryKeysFor = createPrimaryKeyResolver(options);
+	const viewModelFor = createViewModelConverter(options);
 	function getAccessor(slug) {
 		let accessor = cache.get(slug);
 		if (!accessor) {
-			accessor = toEntityAccessor(sdkData.collection(slug), slug, () => primaryKeysFor(slug));
+			accessor = toEntityAccessor(sdkData.collection(slug), slug, () => primaryKeysFor(slug), viewModelFor(slug));
 			cache.set(slug, accessor);
 		}
 		return accessor;
@@ -5438,6 +6743,6 @@ async function detectJunctionTables(executeSql) {
 	return junctionTables;
 }
 //#endregion
-export { CALLBACK_REJECTED, COLLECTION_PATH_SEPARATOR, COMPOSITE_ID_SEPARATOR, CollectionRegistry, DEFAULT_FIND_ALL_MAX_ROWS, DEFAULT_MAX_PAGES, DEFAULT_ONE_OF_TYPE, DEFAULT_ONE_OF_VALUE, DEFAULT_PAGE_SIZE, DEFAULT_STRING_COLUMN_LENGTH, JUNCTION_TABLES_SQL, MAX_LOGICAL_NESTING_DEPTH, OrderBySpecError, QueryBuilder, REBASE_INTERNAL_PREFIXES, REBASE_INTERNAL_SCHEMAS, REBASE_INTERNAL_TABLES, REBASE_USER_ROLE, RebasePaginationError, UnknownFilterOperatorError, and, buildCollectionFromTableMetadata, buildCompositeId, buildConditionContext, buildPropertyCallbacks, buildRebaseData, buildRoutedRebaseData, buildSdkData, callbackRefusal, canCreateEntity, canDeleteEntity, canEditEntity, canReadCollection, checkOperation, classifyTable, collectAllPages, cond, createDataSourceRegistry, createPaginationHelpers, createRelationRef, createRelationRefWithData, defaultUsersCollection, defineCollection, deserializeFilter, deserializeLogicalCondition, deserializeOrderBy, deserializeOrderByList, detectJunctionTables, embedParentExpression, enumToObjectEntries, evaluateCondition, evaluatePolicy, fieldKeyForColumn, findAnonymousGrants, findRelation, fullPathToCollectionSegments, getArrayResolvedProperties, getChildViewDeclaringProperties, getChildViewRelationPropertyKeys, getColumnName, getDeclaredPrimaryKeys, getDefaultValueFor, getDefaultValueFortype, getDefaultValuesFor, getEffectiveSecurityRules, getEntityChildViews, getEnumVarName, getGeneratedPolicyNames, getInjectedSecurityRules, getJunctionCollectionConfig, getJunctionSecurityRules, getLabelOrConfigFrom, getPrimaryKeys, getReferenceFrom, getRelationFrom, getRelationTargetPath, getSubcollections, getTableName, getTableVarName, isAddressableId, isJunctionBackedRelation, isPropertyBuilder, isRebaseInternalTable, isRelationRequired, isRelationalCollection, normalizeDriverOrderBy, normalizeEmail, normalizeOrderBy, normalizeToEntityRelation, or, paginateFind, parseIdValues, parseOrderBySpecStrict, policyToPostgres, primaryOrderBy, registerConditionOperations, relationDeclaringProperty, relationalCollections, resolveArrayProperties, resolveCollectionRelations, resolveDataSource, resolveEnumValues, resolveFindWindow, resolveJunctionSpecs, resolvePrimaryKeys, resolveProperties, resolveProperty, resolvePropertyEnum, resolveRelation, resolveRelationProperty, resolveStorageFilenameString, resolveStoragePathString, resolveStorageSource, resolveStringColumnLength, revokeInternalTableAccess, revokeInternalTableSql, sanitizeData, securityRuleToConditions, segmentsToStrippedPath, serializeFilter, serializeLogicalCondition, serializeOrderBy, sortCollectionsBySlug, sortProperties, sqlToPolicy, stripCollectionPath, toCallbackError, toFilterTuples, traverseValueProperty, traverseValuesProperties, updateDateAutoValues, wrapAsEntityData, wrapAsSdkData };
+export { ADMIN_ROLE, CALLBACK_REJECTED, COLLECTION_PATH_SEPARATOR, COMPOSITE_ID_SEPARATOR, CollectionRegistry, CursorError, CursorMismatchError, DEFAULT_FIND_ALL_MAX_ROWS, DEFAULT_MAX_PAGES, DEFAULT_ONE_OF_TYPE, DEFAULT_ONE_OF_VALUE, DEFAULT_PAGE_SIZE, DEFAULT_STRING_COLUMN_LENGTH, IncludeSpecError, JUNCTION_TABLES_SQL, MAX_LOGICAL_NESTING_DEPTH, OrderBySpecError, QueryBuilder, REBASE_INTERNAL_PREFIXES, REBASE_INTERNAL_SCHEMAS, REBASE_INTERNAL_TABLES, REBASE_USER_ROLE, RebasePaginationError, TENANT_INDEX_REASON, UnknownFilterOperatorError, aggregateAlias, and, applyDefaultValuesOnCreate, buildCollectionFromTableMetadata, buildCompositeId, buildConditionContext, buildPropertyCallbacks, buildRebaseData, buildRoutedRebaseData, buildSdkData, buildTenantSecurityRule, callbackRefusal, canCreateEntity, canDeleteEntity, canEditEntity, canReadCollection, canReadField, canWriteField, checkOperation, classifyTable, collectAllPages, cond, createDataSourceRegistry, createPaginationHelpers, createRelationRef, createRelationRefWithData, cursorToStartAfter, decodeCursor, defaultUsersCollection, defineCollection, denormalizeInclude, deserializeFilter, deserializeInclude, deserializeLogicalCondition, deserializeOrderBy, deserializeOrderByList, detectJunctionTables, effectiveAccess, embedParentExpression, encodeCursor, enumToObjectEntries, evaluateCondition, evaluatePolicy, fieldKeyForColumn, findAnonymousGrants, findRelation, fullPathToCollectionSegments, getArrayResolvedProperties, getChildViewDeclaringProperties, getChildViewRelationPropertyKeys, getColumnName, getDeclaredPrimaryKeys, getDefaultValueFor, getDefaultValueFortype, getDefaultValuesFor, getEffectiveSecurityRules, getEntityChildViews, getEnumVarName, getGeneratedPolicyNames, getInjectedSecurityRules, getJunctionCollectionConfig, getJunctionSecurityRules, getLabelOrConfigFrom, getPrimaryKeys, getReferenceFrom, getRelationFrom, getRelationTargetPath, getSubcollections, getTableName, getTableVarName, getTenantConfig, hasFieldAccessRules, includePaths, isAddressableId, isJunctionBackedRelation, isPropertyBuilder, isRebaseInternalTable, isRelationRequired, isRelationalCollection, mergeIncludeSpecs, normalizeDriverOrderBy, normalizeEmail, normalizeInclude, normalizeOrderBy, normalizeToEntityRelation, not, or, paginateFind, parseIdValues, parseOrderBySpecStrict, policyToPostgres, primaryOrderBy, reconcileCursorOrder, registerConditionOperations, relationDeclaringProperty, relationalCollections, resolveArrayProperties, resolveCollectionRelations, resolveDataSource, resolveEnumValues, resolveFindWindow, resolveJunctionSpecs, resolvePrimaryKeys, resolveProperties, resolveProperty, resolvePropertyEnum, resolveRelation, resolveRelationProperty, resolveStorageFilenameString, resolveStoragePathString, resolveStorageSource, resolveStringColumnLength, resolveTenantWrite, restrictedFieldNames, revokeInternalTableAccess, revokeInternalTableSql, sanitizeData, securityRuleToConditions, segmentsToStrippedPath, serializeFilter, serializeInclude, serializeLogicalCondition, serializeOrderBy, sortCollectionsBySlug, sortProperties, sqlToPolicy, stripCollectionPath, tenantBypassRoles, tenantPolicyName, tenantScopeExpression, toCallbackError, toFilterTuples, topLevelIncludeNames, traverseValueProperty, traverseValuesProperties, updateDateAutoValues, updateUserAutoValues, wrapAsEntityData, wrapAsSdkData };
 
 //# sourceMappingURL=index.es.js.map