@rebasepro/common 0.21.2-canary.g1ea48be → 0.23.0

package/dist/collections/default-collections.d.ts

@@ -17,8 +17,8 @@ export declare const defaultUsersCollection: import("@rebasepro/types").Postgres
 } & {
     id?: string | undefined;
     metadata?: import("@rebasepro/types").InferEntityType<{}> | undefined;
-    photoURL?: string | undefined;
     roles?: string[] | undefined;
+    photoURL?: string | undefined;
     passwordHash?: string | undefined;
     emailVerified?: boolean | undefined;
     emailVerificationToken?: string | undefined;

package/dist/collections/engine-support.d.ts

@@ -0,0 +1,23 @@
+import type { CollectionConfig } from "@rebasepro/types";
+/**
+ * Refuse a `beforeQuery` hook on a collection Postgres does not serve.
+ *
+ * `beforeQuery` narrows a read *before it is compiled*, which means compiling
+ * a declarative filter into the query the engine is about to run. Only
+ * `@rebasepro/server-postgres` does that today. On any other engine the hook
+ * would look configured and do nothing — and for a hook whose whole purpose is
+ * to restrict which rows come back, "nothing" means every row served to
+ * everybody.
+ *
+ * So it is a boot failure, named. The alternative — declaring the hook only on
+ * `PostgresCollectionConfig`, the way `search` is — is not available:
+ * `callbacks` is one engine-agnostic type shared by every collection, and
+ * splitting it would fork `afterRead` and the five write hooks along with it.
+ *
+ * Lives here rather than in either driver because both have to run it: the
+ * Postgres schema planner sees every collection in a mixed app, and a
+ * Mongo-only app never boots a Postgres planner at all.
+ *
+ * Called with *every* collection, before an engine filters any out.
+ */
+export declare const assertBeforeQueryIsPostgresOnly: (collections: CollectionConfig[]) => void;

package/dist/collections/field-access.d.ts

@@ -60,6 +60,11 @@ export declare function canWriteField(property: Property | undefined, viewer: Fi
  * who knows the table can send `password_hash` as readily as `passwordHash`, and
  * a rule that only knew the wire name would be one rename away from useless.
  *
+ * A restricted to-one relation takes its foreign key with it. `bandId: 7` names
+ * the band exactly as `band: { id: 7 }` does, and the row carries the column
+ * beside the relation — so a rule on the relation that left the key alone
+ * withheld the value from the row and still let `?bandId=7` ask for it.
+ *
  * `kind` picks which half of the rule is read; nothing else differs.
  */
 export declare function restrictedFieldNames(collection: CollectionConfig, viewer: FieldViewer | undefined, kind: "read" | "write"): {

package/dist/collections/index.d.ts

@@ -1,4 +1,6 @@
 export * from "./auth-secrets.js";
 export * from "./CollectionRegistry.js";
 export * from "./default-collections.js";
+export * from "./engine-support.js";
 export * from "./field-access.js";
+export * from "./soft-delete.js";

package/dist/collections/soft-delete.d.ts

@@ -0,0 +1,23 @@
+import type { CollectionConfig } from "@rebasepro/types";
+/** The field `softDelete: true` means, when the object form names none. */
+export declare const DEFAULT_SOFT_DELETE_FIELD = "deletedAt";
+/**
+ * The property a `softDelete` collection records a deletion in — its wire
+ * name, what a delete stamps and what a restore (an update to `null`) clears —
+ * or `undefined` for a collection without soft delete.
+ *
+ * One reading of the declaration for every layer that needs it: the driver
+ * that stamps and filters on it, and the REST route that has to recognise a
+ * restore before it looks the row up.
+ */
+export declare function softDeleteFieldOf(collection: CollectionConfig | undefined): string | undefined;
+/**
+ * Whether an update's values restore a soft-deleted row: they set the
+ * soft-delete field back to `null`, the documented restore.
+ *
+ * A restore is an ordinary update of a row every default read hides, so a door
+ * that looks the row up before updating it has to include the trashed rows for
+ * this update — and only for this one: any other edit of a trashed row is a
+ * 404.
+ */
+export declare function restoresSoftDeletedRow(collection: CollectionConfig | undefined, values: Record<string, unknown> | undefined): boolean;

package/dist/data/filter-dialect.d.ts

@@ -64,6 +64,19 @@ export declare class UnknownFilterOperatorError extends Error {
     };
     constructor(field: string, operator: string);
 }
+/**
+ * The query-parameter names a REST listing reads as something other than a
+ * field filter: pagination, sorting, includes, projection, search, the logical
+ * groups, the JSON `where` dialect, an aggregate's `select`/`groupBy`, and the
+ * soft-delete switches.
+ *
+ * One list for both ends. The server skips these names when it collects
+ * `?<field>=<op>.<value>` filters, and the SDK sends a filter on a column with
+ * one of these names inside `?where=` instead — a collection is free to have a
+ * `page`, `select` or `hard` column, and a filter on it sent as its own
+ * parameter was read as the parameter and never applied.
+ */
+export declare const RESERVED_QUERY_KEYS: ReadonlySet<string>;
 /**
  * Convert `FilterValues` (or `WireFilterValues`) to a PostgREST-style
  * querystring record.

package/dist/index.es.js

@@ -2130,6 +2130,81 @@ function evaluateCompare(op, left, right, ctx) {
 	return "unknown";
 }
 //#endregion
+//#region src/util/policy/policyToSecurityRule.ts
+/**
+* The rule a Postgres policy compiles back from — a `pg_policies` row, or what
+* a policy editor produced in that shape.
+*
+* One definition for every place that turns a policy into a rule: Studio's RLS
+* editor ("Save" and "Import to codebase"), the collection editor's RLS tab
+* ("Import to codebase") and "Import from table"
+* (`buildCollectionFromTableMetadata`). The rule is what `db push` compiles back
+* into the database, so anything this gets wrong is a policy that changes on
+* the way back:
+*
+* - The `TO` list names *database* roles, which is `pgRoles`. `roles` holds
+*   *application* roles and compiles to a `rebase.roles()` check: filed there,
+*   `TO public` is a check no user passes, and on a restrictive policy — which
+*   compiles to `NOT (roles) OR condition` — a gate every user passes.
+*   `pgRoles` is omitted at the `public` default, so a rule that targets every
+*   connection, nearly all of them, carries no advanced field it does not need.
+* - The WITH CHECK is kept whether or not there is a USING beside it. Every
+*   INSERT policy has only a check, and a rule with neither clause compiles to
+*   `WITH CHECK (false)`, which stops every insert.
+* - `mode` is written when the policy states one: a restrictive policy read
+*   back as permissive is OR'd with every grant beside it.
+* - Retired RLS helpers (`auth.uid()`) are respelled, as `sqlToPolicy` does
+*   for what it reads, because this rule is written into the project's config.
+*/
+function policyToSecurityRule(policy) {
+	const operation = toSecurityOperation(policy.cmd);
+	const mode = toSecurityMode(policy.permissive);
+	const pgRoles = toPgRoles(policy.roles);
+	const base = {
+		...policy.policyname ? { name: policy.policyname } : {},
+		...operation ? { operation } : {},
+		...mode ? { mode } : {},
+		...pgRoles ? { pgRoles } : {}
+	};
+	const using = policy.qual ? rewriteLegacyRlsFunctions(policy.qual) : void 0;
+	const withCheck = policy.with_check ? rewriteLegacyRlsFunctions(policy.with_check) : void 0;
+	if (using) return withCheck ? {
+		...base,
+		using,
+		withCheck
+	} : {
+		...base,
+		using
+	};
+	if (withCheck) return {
+		...base,
+		withCheck
+	};
+	return base;
+}
+function toPgRoles(roles) {
+	if (!roles || roles.length === 0) return void 0;
+	if (roles.length === 1 && roles[0] === "public") return void 0;
+	return [...roles];
+}
+function toSecurityOperation(cmd) {
+	switch (cmd) {
+		case "SELECT": return "select";
+		case "INSERT": return "insert";
+		case "UPDATE": return "update";
+		case "DELETE": return "delete";
+		case "ALL": return "all";
+		default: return;
+	}
+}
+function toSecurityMode(permissive) {
+	switch (permissive) {
+		case "PERMISSIVE": return "permissive";
+		case "RESTRICTIVE": return "restrictive";
+		default: return;
+	}
+}
+//#endregion
 //#region src/util/permissions.ts
 /** Combine clause results with AND under three-valued (Kleene) logic. */
 function kleeneAnd(values) {
@@ -3293,6 +3368,26 @@ function buildConditionContext(params) {
 */
 //#endregion
 //#region src/util/pg-column-to-property.ts
+var POLICY_COMMANDS = [
+	"SELECT",
+	"INSERT",
+	"UPDATE",
+	"DELETE",
+	"ALL"
+];
+/**
+* A policy's command, as `pg_policies.cmd` names it.
+*
+* Anything else is refused rather than guessed at. A rule with no operation
+* compiles to FOR ALL, where the USING doubles as the WITH CHECK — so a
+* `SELECT ... USING (true)` whose command went unrecognised (`pg_policy.polcmd`
+* spells it `r`) would come back a write grant.
+*/
+function policyCommand(policy, tableName) {
+	const cmd = POLICY_COMMANDS.find((c) => c === policy.cmd);
+	if (!cmd) throw new Error(`Policy "${policy.policy_name}" on "${tableName}" has the command "${policy.cmd}", not one of ${POLICY_COMMANDS.join(", ")}, so it cannot be imported as a security rule.`);
+	return cmd;
+}
 /**
 * Maps a PostgreSQL column data type to a Rebase property type.
 */
@@ -3490,40 +3585,14 @@ function buildCollectionFromTableMetadata(tableName, metadata) {
 			}
 		});
 	}
-	if (metadata.policies) for (const policy of metadata.policies) {
-		let operations = [];
-		switch (policy.cmd) {
-			case "ALL":
-				operations = ["all"];
-				break;
-			case "SELECT":
-				operations = ["select"];
-				break;
-			case "INSERT":
-				operations = ["insert"];
-				break;
-			case "UPDATE":
-				operations = ["update"];
-				break;
-			case "DELETE":
-				operations = ["delete"];
-				break;
-		}
-		const qual = policy.qual ? rewriteLegacyRlsFunctions(policy.qual) : void 0;
-		const withCheck = policy.with_check ? rewriteLegacyRlsFunctions(policy.with_check) : void 0;
-		if (qual) securityRules.push({
-			name: policy.policy_name,
-			operations,
-			roles: policy.roles ?? [],
-			using: qual,
-			...withCheck ? { withCheck } : {}
-		});
-		else securityRules.push({
-			name: policy.policy_name,
-			operations,
-			roles: policy.roles ?? []
-		});
-	}
+	if (metadata.policies) for (const policy of metadata.policies) securityRules.push(policyToSecurityRule({
+		policyname: policy.policy_name,
+		cmd: policyCommand(policy, tableName),
+		permissive: policy.permissive,
+		roles: policy.roles,
+		qual: policy.qual ?? null,
+		with_check: policy.with_check ?? null
+	}));
 	return {
 		name: prettifyIdentifier(tableName),
 		slug: tableName,
@@ -3662,6 +3731,7 @@ var REBASE_INTERNAL_TABLES = [
 	"api_keys",
 	"cron_logs",
 	"cron_claims",
+	"cron_job_state",
 	"jobs",
 	"rate_limit_hits",
 	"idempotency_keys",
@@ -4265,6 +4335,37 @@ var CollectionRegistry = class {
 	}
 };
 //#endregion
+//#region src/collections/engine-support.ts
+/**
+* Refuse a `beforeQuery` hook on a collection Postgres does not serve.
+*
+* `beforeQuery` narrows a read *before it is compiled*, which means compiling
+* a declarative filter into the query the engine is about to run. Only
+* `@rebasepro/server-postgres` does that today. On any other engine the hook
+* would look configured and do nothing — and for a hook whose whole purpose is
+* to restrict which rows come back, "nothing" means every row served to
+* everybody.
+*
+* So it is a boot failure, named. The alternative — declaring the hook only on
+* `PostgresCollectionConfig`, the way `search` is — is not available:
+* `callbacks` is one engine-agnostic type shared by every collection, and
+* splitting it would fork `afterRead` and the five write hooks along with it.
+*
+* Lives here rather than in either driver because both have to run it: the
+* Postgres schema planner sees every collection in a mixed app, and a
+* Mongo-only app never boots a Postgres planner at all.
+*
+* Called with *every* collection, before an engine filters any out.
+*/
+var assertBeforeQueryIsPostgresOnly = (collections) => {
+	for (const collection of collections) {
+		if (isPostgresCollectionConfig(collection)) continue;
+		if (!collection.callbacks?.beforeQuery) continue;
+		const engine = collection.engine ?? "non-postgres";
+		throw new Error(`${collection.slug}.callbacks.beforeQuery: narrowing a read before it is compiled is a Postgres feature, and this collection is served by \`${engine}\`. Remove the hook — it would otherwise look configured while every read kept returning every row the engine allows. Redaction that works on every engine is \`afterRead\`.`);
+	}
+};
+//#endregion
 //#region src/collections/field-access.ts
 /**
 * The role that satisfies any non-empty list.
@@ -4337,18 +4438,36 @@ function canWriteField(property, viewer) {
 * who knows the table can send `password_hash` as readily as `passwordHash`, and
 * a rule that only knew the wire name would be one rename away from useless.
 *
+* A restricted to-one relation takes its foreign key with it. `bandId: 7` names
+* the band exactly as `band: { id: 7 }` does, and the row carries the column
+* beside the relation — so a rule on the relation that left the key alone
+* withheld the value from the row and still let `?bandId=7` ask for it.
+*
 * `kind` picks which half of the rule is read; nothing else differs.
 */
 function restrictedFieldNames(collection, viewer, kind) {
 	const declared = [];
 	const refused = /* @__PURE__ */ new Set();
 	const allowed = kind === "read" ? canReadField : canWriteField;
-	for (const [name, property] of Object.entries(collection.properties ?? {})) {
-		if (allowed(property, viewer)) continue;
-		declared.push(name);
+	const properties = collection.properties ?? {};
+	let relations;
+	const restrict = (name) => {
+		if (name in properties && !declared.includes(name)) declared.push(name);
 		refused.add(name);
+	};
+	for (const [name, property] of Object.entries(properties)) {
+		if (allowed(property, viewer)) continue;
+		restrict(name);
 		const columnName = property.columnName;
 		if (columnName) refused.add(columnName);
+		if (property.type === "relation") {
+			relations ??= resolveCollectionRelations(collection);
+			const relation = findRelation(relations, name);
+			if (relation?.kind === "belongsTo") {
+				restrict(fieldKeyForColumn(collection, relation.localKey));
+				refused.add(relation.localKey);
+			}
+		}
 	}
 	return {
 		declared,
@@ -4367,6 +4486,37 @@ function hasFieldAccessRules(collection) {
 	return false;
 }
 //#endregion
+//#region src/collections/soft-delete.ts
+/** The field `softDelete: true` means, when the object form names none. */
+var DEFAULT_SOFT_DELETE_FIELD = "deletedAt";
+/**
+* The property a `softDelete` collection records a deletion in — its wire
+* name, what a delete stamps and what a restore (an update to `null`) clears —
+* or `undefined` for a collection without soft delete.
+*
+* One reading of the declaration for every layer that needs it: the driver
+* that stamps and filters on it, and the REST route that has to recognise a
+* restore before it looks the row up.
+*/
+function softDeleteFieldOf(collection) {
+	const declared = collection && "softDelete" in collection ? collection.softDelete : void 0;
+	if (!declared) return void 0;
+	return typeof declared === "object" && declared.field || "deletedAt";
+}
+/**
+* Whether an update's values restore a soft-deleted row: they set the
+* soft-delete field back to `null`, the documented restore.
+*
+* A restore is an ordinary update of a row every default read hides, so a door
+* that looks the row up before updating it has to include the trashed rows for
+* this update — and only for this one: any other edit of a trashed row is a
+* 404.
+*/
+function restoresSoftDeletedRow(collection, values) {
+	const field = softDeleteFieldOf(collection);
+	return field !== void 0 && values?.[field] === null;
+}
+//#endregion
 //#region src/data/cursor.ts
 /** A cursor that cannot be read at all — truncated, re-encoded, or invented. */
 var CursorError = class CursorError extends Error {
@@ -5264,19 +5414,23 @@ function normalizeMaxRows(raw) {
 * @param label  the collection name, so an error says which walk failed
 */
 async function* paginateFind(find, params, label = "collection") {
-	const { pageSize, cursor, maxPages, ...rest } = params ?? {};
+	const { pageSize, cursor, maxPages, after: startAfter, offset: startOffset, page: startPage, ...rest } = params ?? {};
 	const findParams = { ...rest };
 	const size = normalizePageSize(pageSize);
 	const pageCap = normalizeMaxPages(maxPages);
-	const seekRequested = cursor !== void 0 && cursor !== null;
-	if (seekRequested) {
+	const seekRequested = cursor !== void 0 && cursor !== null || !!startAfter;
+	if (cursor !== void 0 && cursor !== null) {
 		const field = typeof cursor === "string" ? cursor : cursor.field;
 		const requested = typeof cursor === "object" && cursor !== null ? cursor.direction : void 0;
 		if (!normalizeOrderBy(findParams.orderBy)) findParams.orderBy = [field, requested ?? "asc"];
 	}
-	let offset = 0;
+	let offset = resolveFindWindow({
+		limit: size,
+		offset: startOffset,
+		page: startPage
+	}).offset;
 	let pages = 0;
-	let after;
+	let after = startAfter || void 0;
 	for (;;) {
 		if (pages >= pageCap) throw new RebasePaginationError("max-pages", `Iterating "${label}" made ${pages} requests without the server reporting the end of the collection. Stopping rather than looping forever — raise \`maxPages\` if the walk is genuinely this long, or check that the backend sets \`meta.hasMore\`.`);
 		const pageParams = {
@@ -5353,9 +5507,16 @@ function createPaginationHelpers(find, label) {
 * Relation values (`EntityRelation` instances or `{ __type: "relation", id, path }`
 * objects) are serialized as their raw id — the wire format only carries the
 * value to compare against the FK column.
+*
+* A `Date` is its ISO 8601 instant — what JSON makes of it on the socket and
+* in-process, so one filter names one instant through every door. `String()`
+* gave the viewer's local zone, no milliseconds and a parenthesised zone name
+* Postgres cannot parse. An invalid date keeps its "Invalid Date" spelling for
+* the server to refuse, rather than throwing a `RangeError` from here.
 */
 function stringifyValue(value) {
 	if (value === null) return "null";
+	if (value instanceof Date && !Number.isNaN(value.getTime())) return value.toISOString();
 	const relation = normalizeToEntityRelation(value);
 	if (relation) return String(relation.id);
 	return String(value);
@@ -5413,6 +5574,41 @@ function unescapeWireValue(value) {
 	return result;
 }
 /**
+* Whether a scalar, sent raw as a query parameter's operand, would be read
+* back as something other than itself.
+*
+* A query parameter owns its whole value, so its scalar goes out unescaped —
+* `eq.a,b`, `eq.C:\x` — and the decoder returns it verbatim. Two shapes break
+* that. A parenthesised operand is a list for every operator (so that
+* `["==", ["a","b"]]` on an array column stays a list), so raw, the scalar
+* `"(deleted)"` would arrive as `["deleted"]`: an `==` matching nothing, a
+* `!=` returning the very rows it excludes. Such a scalar is sent escaped,
+* `eq.\(deleted\)`. And that spelling has to be told apart from a raw value
+* that looks the same, so a scalar of *that* shape is escaped in turn.
+*
+* Everything else stays raw, so a value an older client sends decodes as it
+* always has — unless it is exactly the escaped spelling of such a scalar,
+* which decodes to the scalar it spells.
+*/
+function scalarNeedsEscape(value) {
+	if (value.startsWith("(") && value.endsWith(")")) return true;
+	return decodeEscapedScalar(value) !== void 0;
+}
+/**
+* The scalar an operand is the escaped spelling of, when it is one.
+*
+* Exact on purpose: only an operand that {@link escapeWireValue} produces from
+* a scalar that {@link scalarNeedsEscape} is decoded. Any other operand —
+* including a raw backslash an older client sent, like `\\server\share` — is
+* left verbatim. Terminates because an operand that matches contains an
+* escape pair, so the value is strictly shorter than it.
+*/
+function decodeEscapedScalar(operand) {
+	if (!operand.startsWith("\\")) return void 0;
+	const value = unescapeWireValue(operand);
+	return escapeWireValue(value) === operand && scalarNeedsEscape(value) ? value : void 0;
+}
+/**
 * Split a parenthesized list string on unescaped commas.
 * Input is the content between `(` and `)`.
 *
@@ -5657,6 +5853,42 @@ function readTuple(field, raw) {
 	if (isOperatorShaped(op)) throw new UnknownFilterOperatorError(field, op);
 }
 /**
+* The query-parameter names a REST listing reads as something other than a
+* field filter: pagination, sorting, includes, projection, search, the logical
+* groups, the JSON `where` dialect, an aggregate's `select`/`groupBy`, and the
+* soft-delete switches.
+*
+* One list for both ends. The server skips these names when it collects
+* `?<field>=<op>.<value>` filters, and the SDK sends a filter on a column with
+* one of these names inside `?where=` instead — a collection is free to have a
+* `page`, `select` or `hard` column, and a filter on it sent as its own
+* parameter was read as the parameter and never applied.
+*/
+var RESERVED_QUERY_KEYS = /* @__PURE__ */ new Set([
+	"limit",
+	"offset",
+	"page",
+	"after",
+	"orderBy",
+	"include",
+	"fields",
+	"distinct",
+	"searchString",
+	"searchExplain",
+	"vector_search",
+	"vector",
+	"vector_distance",
+	"vector_threshold",
+	"or",
+	"and",
+	"not",
+	"where",
+	"select",
+	"groupBy",
+	"deleted",
+	"hard"
+]);
+/**
 * Encode the `<op>.<value>` half of a wire condition.
 *
 * This is the single leaf encoder. Both wire positions that carry a condition
@@ -5684,7 +5916,7 @@ function serializeOperatorAndValue(op, value, { escapeScalar, where }) {
 		return `${restOp}.(${value.map((v) => escapeWireValue(stringifyValue(v))).join(",")})`;
 	}
 	const scalar = stringifyValue(value);
-	return `${restOp}.${escapeScalar ? escapeWireValue(scalar) : scalar}`;
+	return `${restOp}.${escapeScalar || !LIST_OPS.has(op) && scalarNeedsEscape(scalar) ? escapeWireValue(scalar) : scalar}`;
 }
 /**
 * Serialize a single canonical condition tuple to a PostgREST dot-string.
@@ -5780,7 +6012,10 @@ var NULL_OPERANDS = /* @__PURE__ */ new Set([
 *   operand: only {@link NULL_OPERANDS}. `notnull.reason` is the value
 *   `"notnull.reason"`, not "reason is not null".
 * - **Everything else** takes one scalar, and any remainder is one — including
-*   the empty string, so `eq.` really is "equals the empty string".
+*   the empty string, so `eq.` really is "equals the empty string". A
+*   parenthesised remainder is a list for these too (`eq.(a,b)` is array
+*   equality); a scalar that is itself parenthesised arrives escaped,
+*   `eq.\(none\)`, and is decoded here — see {@link scalarNeedsEscape}.
 *
 * ### The one ambiguity that remains, and how to write past it
 *
@@ -5815,7 +6050,7 @@ function deserializeSingle(raw) {
 		return [canonicalOp, inner === EMPTY_LIST_TOKEN ? [] : splitListItems(inner)];
 	}
 	if (LIST_OPS.has(canonicalOp)) return ["==", raw];
-	return [canonicalOp, rest];
+	return [canonicalOp, decodeEscapedScalar(rest) ?? rest];
 }
 /**
 * Convert a PostgREST-style querystring record to `FilterValues`.
@@ -6995,6 +7230,6 @@ async function detectJunctionTables(executeSql) {
 	return junctionTables;
 }
 //#endregion
-export { ADMIN_ROLE, CALLBACK_REJECTED, COLLECTION_PATH_SEPARATOR, COMPOSITE_ID_SEPARATOR, CollectionRegistry, CursorError, CursorMismatchError, DEFAULT_FIND_ALL_MAX_ROWS, DEFAULT_MAX_PAGES, DEFAULT_ONE_OF_TYPE, DEFAULT_ONE_OF_VALUE, DEFAULT_PAGE_SIZE, DEFAULT_STRING_COLUMN_LENGTH, IncludeSpecError, JUNCTION_TABLES_SQL, MAX_LOGICAL_NESTING_DEPTH, OrderBySpecError, QueryBuilder, REBASE_INTERNAL_PREFIXES, REBASE_INTERNAL_SCHEMAS, REBASE_INTERNAL_TABLES, REBASE_USER_ROLE, RebasePaginationError, TENANT_INDEX_REASON, UnknownFilterOperatorError, aggregateAlias, and, applyDefaultValuesOnCreate, authSecretsMissingExclusion, buildCollectionFromTableMetadata, buildCompositeId, buildConditionContext, buildPropertyCallbacks, buildRebaseData, buildRoutedRebaseData, buildSdkData, buildTenantSecurityRule, callbackRefusal, canCreateEntity, canDeleteEntity, canEditEntity, canReadCollection, canReadField, canWriteField, checkOperation, classifyTable, collectAllPages, cond, createDataSourceRegistry, createPaginationHelpers, createRelationRef, createRelationRefWithData, cursorToStartAfter, decodeCursor, defaultUsersCollection, defineCollection, denormalizeInclude, deserializeFilter, deserializeInclude, deserializeLogicalCondition, deserializeOrderBy, deserializeOrderByList, detectJunctionTables, effectiveAccess, embedParentExpression, encodeCursor, enumToObjectEntries, evaluateCondition, evaluatePolicy, fieldKeyForColumn, findAnonymousGrants, findRelation, firstSqlRow, fullPathToCollectionSegments, getArrayResolvedProperties, getChildViewDeclaringProperties, getChildViewRelationPropertyKeys, getColumnName, getDeclaredPrimaryKeys, getDefaultValueFor, getDefaultValueFortype, getDefaultValuesFor, getEffectiveSecurityRules, getEntityChildViews, getEnumVarName, getGeneratedPolicyNames, getInjectedSecurityRules, getJunctionCollectionConfig, getJunctionConfigForRelation, getJunctionSecurityRules, getLabelOrConfigFrom, getPrimaryKeys, getReferenceFrom, getRelationFrom, getRelationTargetPath, getSubcollections, getTableName, getTableVarName, getTenantConfig, hasFieldAccessRules, includePaths, isAddressableId, isJunctionBackedRelation, isPropertyBuilder, isRebaseInternalTable, isRelationRequired, isRelationalCollection, mergeIncludeSpecs, normalizeDriverOrderBy, normalizeEmail, normalizeInclude, normalizeOrderBy, normalizeToEntityRelation, not, or, paginateFind, parseIdValues, parseOrderBySpecStrict, policyToPostgres, primaryOrderBy, reconcileCursorOrder, registerConditionOperations, relationDeclaringProperty, relationalCollections, requireCallbackClient, requireCallbackCollection, resolveArrayProperties, resolveCollectionRelations, resolveDataSource, resolveEnumValues, resolveFindWindow, resolveJunctionSpecs, resolvePrimaryKeys, resolveProperties, resolveProperty, resolvePropertyEnum, resolveRelation, resolveRelationProperty, resolveStorageFilenameString, resolveStoragePathString, resolveStorageSource, resolveStringColumnLength, resolveTenantWrite, restrictedFieldNames, revokeInternalTableAccess, revokeInternalTableSql, sanitizeData, securityRuleToConditions, segmentsToStrippedPath, serializeFilter, serializeInclude, serializeLogicalCondition, serializeOrderBy, sortCollectionsBySlug, sortProperties, sqlRows, sqlToPolicy, stripCollectionPath, tenantBypassRoles, tenantPolicyName, tenantScopeExpression, toCallbackError, toFilterTuples, topLevelIncludeNames, traverseValueProperty, traverseValuesProperties, updateDateAutoValues, updateUserAutoValues, wrapAsEntityData, wrapAsSdkData };
+export { ADMIN_ROLE, CALLBACK_REJECTED, COLLECTION_PATH_SEPARATOR, COMPOSITE_ID_SEPARATOR, CollectionRegistry, CursorError, CursorMismatchError, DEFAULT_FIND_ALL_MAX_ROWS, DEFAULT_MAX_PAGES, DEFAULT_ONE_OF_TYPE, DEFAULT_ONE_OF_VALUE, DEFAULT_PAGE_SIZE, DEFAULT_SOFT_DELETE_FIELD, DEFAULT_STRING_COLUMN_LENGTH, IncludeSpecError, JUNCTION_TABLES_SQL, MAX_LOGICAL_NESTING_DEPTH, OrderBySpecError, QueryBuilder, REBASE_INTERNAL_PREFIXES, REBASE_INTERNAL_SCHEMAS, REBASE_INTERNAL_TABLES, REBASE_USER_ROLE, RESERVED_QUERY_KEYS, RebasePaginationError, TENANT_INDEX_REASON, UnknownFilterOperatorError, aggregateAlias, and, applyDefaultValuesOnCreate, assertBeforeQueryIsPostgresOnly, authSecretsMissingExclusion, buildCollectionFromTableMetadata, buildCompositeId, buildConditionContext, buildPropertyCallbacks, buildRebaseData, buildRoutedRebaseData, buildSdkData, buildTenantSecurityRule, callbackRefusal, canCreateEntity, canDeleteEntity, canEditEntity, canReadCollection, canReadField, canWriteField, checkOperation, classifyTable, collectAllPages, cond, createDataSourceRegistry, createPaginationHelpers, createRelationRef, createRelationRefWithData, cursorToStartAfter, decodeCursor, defaultUsersCollection, defineCollection, denormalizeInclude, deserializeFilter, deserializeInclude, deserializeLogicalCondition, deserializeOrderBy, deserializeOrderByList, detectJunctionTables, effectiveAccess, embedParentExpression, encodeCursor, enumToObjectEntries, evaluateCondition, evaluatePolicy, fieldKeyForColumn, findAnonymousGrants, findRelation, firstSqlRow, fullPathToCollectionSegments, getArrayResolvedProperties, getChildViewDeclaringProperties, getChildViewRelationPropertyKeys, getColumnName, getDeclaredPrimaryKeys, getDefaultValueFor, getDefaultValueFortype, getDefaultValuesFor, getEffectiveSecurityRules, getEntityChildViews, getEnumVarName, getGeneratedPolicyNames, getInjectedSecurityRules, getJunctionCollectionConfig, getJunctionConfigForRelation, getJunctionSecurityRules, getLabelOrConfigFrom, getPrimaryKeys, getReferenceFrom, getRelationFrom, getRelationTargetPath, getSubcollections, getTableName, getTableVarName, getTenantConfig, hasFieldAccessRules, includePaths, isAddressableId, isJunctionBackedRelation, isPropertyBuilder, isRebaseInternalTable, isRelationRequired, isRelationalCollection, mergeIncludeSpecs, normalizeDriverOrderBy, normalizeEmail, normalizeInclude, normalizeOrderBy, normalizeToEntityRelation, not, or, paginateFind, parseIdValues, parseOrderBySpecStrict, policyToPostgres, policyToSecurityRule, primaryOrderBy, reconcileCursorOrder, registerConditionOperations, relationDeclaringProperty, relationalCollections, requireCallbackClient, requireCallbackCollection, resolveArrayProperties, resolveCollectionRelations, resolveDataSource, resolveEnumValues, resolveFindWindow, resolveJunctionSpecs, resolvePrimaryKeys, resolveProperties, resolveProperty, resolvePropertyEnum, resolveRelation, resolveRelationProperty, resolveStorageFilenameString, resolveStoragePathString, resolveStorageSource, resolveStringColumnLength, resolveTenantWrite, restoresSoftDeletedRow, restrictedFieldNames, revokeInternalTableAccess, revokeInternalTableSql, sanitizeData, securityRuleToConditions, segmentsToStrippedPath, serializeFilter, serializeInclude, serializeLogicalCondition, serializeOrderBy, softDeleteFieldOf, sortCollectionsBySlug, sortProperties, sqlRows, sqlToPolicy, stripCollectionPath, tenantBypassRoles, tenantPolicyName, tenantScopeExpression, toCallbackError, toFilterTuples, topLevelIncludeNames, traverseValueProperty, traverseValuesProperties, updateDateAutoValues, updateUserAutoValues, wrapAsEntityData, wrapAsSdkData };
 
 //# sourceMappingURL=index.es.js.map