@rebasepro/common 0.7.0 → 0.9.0

package/dist/index.es.js

@@ -1,4 +1,4 @@
-import { DEFAULT_DATA_SOURCE_KEY, EntityReference, EntityRelation, getDataSourceCapabilities } from "@rebasepro/types";
+import { ALL_WHERE_FILTER_OPS, CANONICAL_TO_REST, DEFAULT_DATA_SOURCE_KEY, EntityReference, EntityRelation, NULL_OPS, REST_TO_CANONICAL, getDataSourceCapabilities, getDeclaredSubcollections, policy, toCanonicalOp } from "@rebasepro/types";
 import { deepClone, generateForeignKeyName, getIn, isDefaultFieldConfigId, mergeDeep, randomString, removeFunctions, toSnakeCase } from "@rebasepro/utils";
 import jsonLogic from "json-logic-js";
 import { deepEqual } from "fast-equals";
@@ -54,7 +54,7 @@ function getDefaultValueFortype(type) {
 	else return null;
 }
 /**
-* Update the automatic values in an entity before save
+* Update the automatic values in a entity before save
 * @group Driver
 */
 function updateDateAutoValues({ inputValues, properties, status, timestampNowValue }) {
@@ -66,7 +66,7 @@ function updateDateAutoValues({ inputValues, properties, status, timestampNowVal
 	}) ?? {};
 }
 /**
-* Add missing required fields, expected in the collection, to the values of an entity
+* Add missing required fields, expected in the collection, to the values of a entity
 * @param values
 * @param properties
 * @group Driver
@@ -236,7 +236,7 @@ function getLocalChangesBackup(collection) {
 	return collection.localChangesBackup;
 }
 /**
-* Returns the primary keys for an entity collection by inspecting the properties
+* Returns the primary keys for a entity collection by inspecting the properties
 * and finding any properties with `isId`.
 * Fallbacks to `["id"]` if no properties are marked as `isId: true`.
 * @param collection
@@ -336,7 +336,7 @@ function sanitizeRelation(relation, sourceCollection, resolveCollection) {
 			if (!newRelation.foreignKeyOnTarget) {
 				let foundForeignKey = false;
 				try {
-					const targetRelations = getDataSourceCapabilities(targetCollection.driver).supportsRelations ? targetCollection.relations || [] : [];
+					const targetRelations = getDataSourceCapabilities(targetCollection.engine).supportsRelations ? targetCollection.relations || [] : [];
 					for (const targetRel of targetRelations) if (targetRel.direction === "owning" && targetRel.cardinality === "one" && targetRel.localKey) try {
 						if (targetRel.target().slug === sourceCollection.slug) {
 							newRelation.foreignKeyOnTarget = targetRel.localKey;
@@ -352,7 +352,7 @@ function sanitizeRelation(relation, sourceCollection, resolveCollection) {
 		} else if (newRelation.cardinality === "many" && newRelation.direction === "inverse") {
 			let isManyToManyInverse = false;
 			if (newRelation.inverseRelationName && !newRelation.foreignKeyOnTarget) try {
-				const targetRelations = getDataSourceCapabilities(targetCollection.driver).supportsRelations ? targetCollection.relations || [] : [];
+				const targetRelations = getDataSourceCapabilities(targetCollection.engine).supportsRelations ? targetCollection.relations || [] : [];
 				for (const targetRel of targetRelations) if (targetRel.cardinality === "many" && (targetRel.direction === "owning" || !targetRel.direction) && targetRel.relationName === newRelation.inverseRelationName) {
 					isManyToManyInverse = true;
 					break;
@@ -387,11 +387,10 @@ var _resolvedRelationsCache = /* @__PURE__ */ new WeakMap();
 function resolveCollectionRelations(collection) {
 	const cached = _resolvedRelationsCache.get(collection);
 	if (cached) return cached;
-	if (!getDataSourceCapabilities(collection.driver).supportsRelations) return {};
-	const relCollection = collection;
+	if (!getDataSourceCapabilities(collection.engine).supportsRelations) return {};
 	const relations = {};
 	const registeredRelationNames = /* @__PURE__ */ new Set();
-	if (relCollection.relations) relCollection.relations.forEach((relation) => {
+	if (collection.relations) collection.relations.forEach((relation) => {
 		try {
 			const normalizedRelation = sanitizeRelation(relation, collection);
 			const relationKey = normalizedRelation.relationName;
@@ -438,7 +437,7 @@ function resolvePropertyRelation({ propertyKey, property, sourceCollection }) {
 	console.warn(`Unrecognized or missing relation target for property '${propertyKey}' in collection '${sourceCollection.slug}'`);
 }
 function getTableName(collection) {
-	if (getDataSourceCapabilities(collection.driver).supportsRelations) return collection.table ?? toSnakeCase(collection.slug) ?? toSnakeCase(collection.name);
+	if (getDataSourceCapabilities(collection.engine).supportsRelations) return collection.table ?? toSnakeCase(collection.slug) ?? toSnakeCase(collection.name);
 	return toSnakeCase(collection.slug) ?? toSnakeCase(collection.name);
 }
 function getTableVarName(tableName) {
@@ -643,8 +642,9 @@ function resolveEnumValues(input) {
 }
 function getSubcollections(collection) {
 	if (collection.childCollections) return collection.childCollections() ?? [];
-	if (getDataSourceCapabilities(collection.driver).supportsSubcollections && collection.subcollections) return collection.subcollections() ?? [];
-	if (getDataSourceCapabilities(collection.driver).supportsRelations) {
+	const declaredSubcollections = getDeclaredSubcollections(collection);
+	if (getDataSourceCapabilities(collection.engine).supportsSubcollections && declaredSubcollections) return declaredSubcollections() ?? [];
+	if (getDataSourceCapabilities(collection.engine).supportsRelations) {
 		const resolvedRelations = resolveCollectionRelations(collection);
 		return Object.values(resolvedRelations).filter((r) => r.cardinality === "many").map((r) => {
 			const target = r.target();
@@ -670,113 +670,379 @@ function getSubcollections(collection) {
 	return [];
 }
 //#endregion
-//#region src/util/permissions.ts
-function evaluateAST(sqlString, auth, entity) {
-	if (!entity) return true;
-	let cleanedSQL = sqlString.trim();
-	while (cleanedSQL.startsWith("(") && cleanedSQL.endsWith(")")) {
-		let openCount = 0;
-		let isEnclosing = true;
-		for (let i = 0; i < cleanedSQL.length - 1; i++) {
-			if (cleanedSQL[i] === "(") openCount++;
-			else if (cleanedSQL[i] === ")") openCount--;
-			if (openCount === 0) {
-				isEnclosing = false;
-				break;
-			}
+//#region src/util/policy/sqlToPolicy.ts
+/**
+* A tiny, regex-based SQL "parser" for security rules.
+*
+* This is NOT a full SQL parser. It is designed to handle the subset of SQL
+* commonly used in `USING` and `WITH CHECK` clauses, enough to drive the
+* optimistic client-side UI decision.
+*
+* It handles:
+* - `field = 'literal'`
+* - `field != 'literal'`
+* - `field = current_setting('app.user_id')`
+* - `A AND B`
+* - `true`
+* - `IN (...)` (as optimistic true)
+*
+* For anything it doesn't understand, it returns a `raw` expression, which
+* the evaluator treats as "unknown" (and usually optimistic true).
+*/
+function sqlToPolicy(sql) {
+	const trimmed = sql.trim();
+	if (trimmed.toLowerCase() === "true") return policy.true();
+	if (trimmed.toLowerCase() === "false") return policy.false();
+	const overlapMatch = trimmed.match(/^string_to_array\s*\(\s*auth\.roles\(\)\s*,\s*','\s*\)\s*&&\s*ARRAY\s*\[(.+)\]$/i);
+	if (overlapMatch) {
+		const roles = overlapMatch[1].split(",").map((s) => s.trim().replace(/^'|'$/g, ""));
+		return policy.rolesOverlap(roles);
+	}
+	const containMatch = trimmed.match(/^string_to_array\s*\(\s*auth\.roles\(\)\s*,\s*','\s*\)\s*@>\s*ARRAY\s*\[(.+)\]$/i);
+	if (containMatch) {
+		const roles = containMatch[1].split(",").map((s) => s.trim().replace(/^'|'$/g, ""));
+		return policy.rolesContain(roles);
+	}
+	if (trimmed.toUpperCase().includes(" OR ")) {
+		const parts = trimmed.split(/ OR /i);
+		return policy.or(...parts.map(sqlToPolicy));
+	}
+	if (trimmed.toUpperCase().includes(" AND ")) {
+		const parts = trimmed.split(/ AND /i);
+		return policy.and(...parts.map(sqlToPolicy));
+	}
+	const match = trimmed.match(/^(.+?)\s*(!?=)\s*(.+)$/);
+	if (match) {
+		const [, leftStr, op, rightStr] = match;
+		const left = parseOperand(leftStr.trim());
+		const right = parseOperand(rightStr.trim());
+		if (left && right) return policy.compare(left, op === "=" ? "eq" : "neq", right);
+	}
+	return policy.raw(sql);
+}
+function parseOperand(str) {
+	if (/current_setting\s*\(\s*'app\.user_id'\s*\)/i.test(str) || /auth\.uid\(\)/i.test(str)) return policy.authUid();
+	const stringMatch = str.match(/^'(.+)'$/);
+	if (stringMatch) return policy.literal(stringMatch[1]);
+	if (/^\w+$/.test(str)) return policy.field(str);
+	return null;
+}
+//#endregion
+//#region src/util/policy/securityRuleToConditions.ts
+/**
+* Desugars a {@link SecurityRule} — its `access`/`ownerField`/`roles` shortcuts,
+* structured `condition`/`check`, and raw `using`/`withCheck` — into a single
+* normalized {@link PolicyExpression} pair.
+*
+* **This is the linchpin against drift:** both the Postgres DDL generators and
+* the client-side evaluator consume this one function, so there is exactly one
+* definition of what a rule means. In particular, application `roles` are folded
+* into the expression here (AND'd with the base condition, matching how Postgres
+* generates the clause) rather than being handled separately by each consumer.
+*/
+function securityRuleToConditions(rule) {
+	return {
+		usingExpr: withRoles(baseUsing(rule), rule),
+		withCheckExpr: withRoles(baseWithCheck(rule), rule)
+	};
+}
+function baseUsing(rule) {
+	if (rule.condition) return rule.condition;
+	if (rule.using != null) return sqlToPolicy(rule.using);
+	if (rule.access === "public") return policy.true();
+	if (rule.ownerField) return policy.compare(policy.field(rule.ownerField), "eq", policy.authUid());
+	return null;
+}
+function baseWithCheck(rule) {
+	if (rule.check) return rule.check;
+	if (rule.withCheck != null) return sqlToPolicy(rule.withCheck);
+	return baseUsing(rule);
+}
+/**
+* AND the base condition with an application-role check, or produce a roles-only
+* condition when there is no base. Mirrors the Postgres generator so that a
+* role-scoped restrictive rule denies exactly the same set of users on both
+* sides.
+*/
+function withRoles(base, rule) {
+	if (!rule.roles || rule.roles.length === 0) return base;
+	const rolesExpr = policy.rolesOverlap(rule.roles);
+	if (rule.mode === "restrictive") return base ? policy.or(policy.not(rolesExpr), base) : policy.not(rolesExpr);
+	return base ? policy.and(base, rolesExpr) : rolesExpr;
+}
+//#endregion
+//#region src/util/policy/policyToPostgres.ts
+/**
+* Compiles a {@link PolicyExpression} to a PostgreSQL boolean SQL string,
+* suitable for a `USING (...)` / `WITH CHECK (...)` clause.
+*
+* This is one of the two consumers of the shared policy model (the other being
+* {@link evaluatePolicy}); the Postgres schema generators call it so that DDL
+* and the admin UI derive from the exact same expression.
+*/
+function policyToPostgres(expr, collection, options) {
+	return compile(expr, {
+		fieldCollection: collection,
+		fieldPrefix: "",
+		outerCollection: collection,
+		outerPrefix: "",
+		resolveCollection: options?.resolveCollection,
+		alias: { n: 0 }
+	});
+}
+function compile(expr, scope) {
+	switch (expr.kind) {
+		case "true": return "true";
+		case "false": return "false";
+		case "and": return expr.operands.length === 0 ? "true" : expr.operands.map((o) => `(${compile(o, scope)})`).join(" AND ");
+		case "or": return expr.operands.length === 0 ? "false" : expr.operands.map((o) => `(${compile(o, scope)})`).join(" OR ");
+		case "not":
+			if (expr.operand.kind === "authenticated") return "auth.uid() IS NULL";
+			return `NOT (${compile(expr.operand, scope)})`;
+		case "compare": return `${operandToSql(expr.left, scope)} ${COMPARE_SQL[expr.op]} ${operandToSql(expr.right, scope)}`;
+		case "rolesOverlap": return `string_to_array(auth.roles(), ',') && ${rolesArraySql(expr.roles)}`;
+		case "rolesContain": return `string_to_array(auth.roles(), ',') @> ${rolesArraySql(expr.roles)}`;
+		case "authenticated": return "auth.uid() IS NOT NULL";
+		case "existsIn": return compileExistsIn(expr, scope);
+		case "raw": return expr.sql.replace(/\{(\w+)\}/g, (_, col) => col);
+	}
+}
+/**
+* Compiles `existsIn` to a correlated `EXISTS (SELECT 1 FROM <join> WHERE ...)`.
+* Inside the subquery, `field` operands bind to the aliased join table and
+* `outerField` operands bind to the (table-qualified) outer RLS row.
+*/
+function compileExistsIn(expr, scope) {
+	const join = scope.resolveCollection?.(expr.collection);
+	const joinTable = join ? getTableName(join) : toSnakeCase(expr.collection);
+	const joinSchema = schemaOf(join) ?? schemaOf(scope.outerCollection) ?? "public";
+	const alias = `_ex${scope.alias.n++}`;
+	const outerTable = scope.outerCollection ? getTableName(scope.outerCollection) : void 0;
+	const outerSchema = schemaOf(scope.outerCollection) ?? "public";
+	const outerPrefix = outerTable ? `"${outerSchema}"."${outerTable}".` : "";
+	const innerScope = {
+		fieldCollection: join,
+		fieldPrefix: `"${alias}".`,
+		outerCollection: scope.outerCollection,
+		outerPrefix,
+		resolveCollection: scope.resolveCollection,
+		alias: scope.alias
+	};
+	return `EXISTS (SELECT 1 FROM "${joinSchema}"."${joinTable}" "${alias}" WHERE ${compile(expr.where, innerScope)})`;
+}
+var COMPARE_SQL = {
+	eq: "=",
+	neq: "!=",
+	lt: "<",
+	lte: "<=",
+	gt: ">",
+	gte: ">="
+};
+function operandToSql(operand, scope) {
+	switch (operand.kind) {
+		case "field": return `${scope.fieldPrefix}${resolveColumnName(operand.name, scope.fieldCollection)}`;
+		case "outerField": return `${scope.outerPrefix}${resolveColumnName(operand.name, scope.outerCollection)}`;
+		case "literal": return quoteLiteral(operand.value);
+		case "authUid": return "auth.uid()";
+		case "authRoles": return "string_to_array(auth.roles(), ',')";
+	}
+}
+function schemaOf(collection) {
+	return collection?.schema || void 0;
+}
+function resolveColumnName(propName, collection) {
+	const prop = collection?.properties?.[propName];
+	if (prop && "columnName" in prop && typeof prop.columnName === "string") return prop.columnName;
+	return toSnakeCase(propName);
+}
+function quoteLiteral(value) {
+	if (value === null) return "NULL";
+	if (typeof value === "boolean") return value ? "true" : "false";
+	if (typeof value === "number") return String(value);
+	return `'${value.replace(/'/g, "''")}'`;
+}
+/** Sorted, single-quoted `ARRAY['a','b']` — matches the generators' output. */
+function rolesArraySql(roles) {
+	return `ARRAY[${[...roles].sort().map((r) => `'${r}'`).join(",")}]`;
+}
+//#endregion
+//#region src/util/policy/evaluatePolicy.ts
+/**
+* Evaluates a {@link PolicyExpression} against a user + row, using three-valued
+* (Kleene) logic so that `"unknown"` sub-results propagate soundly.
+*
+* This is the JavaScript twin of {@link policyToPostgres}: both derive from the
+* same expression, so the admin UI matches database enforcement by construction
+* for every non-raw rule.
+*/
+function evaluatePolicy(expr, ctx) {
+	switch (expr.kind) {
+		case "true": return true;
+		case "false": return false;
+		case "and": return kleeneAnd$1(expr.operands.map((o) => evaluatePolicy(o, ctx)));
+		case "or": return kleeneOr(expr.operands.map((o) => evaluatePolicy(o, ctx)));
+		case "not": return kleeneNot(evaluatePolicy(expr.operand, ctx));
+		case "compare": return evaluateCompare(expr.op, expr.left, expr.right, ctx);
+		case "rolesOverlap": {
+			const userRoles = ctx.roles ?? [];
+			return expr.roles.some((r) => r === "public" || userRoles.includes(r));
 		}
-		if (isEnclosing) cleanedSQL = cleanedSQL.substring(1, cleanedSQL.length - 1).trim();
-		else break;
-	}
-	const splitByTopLevel = (str, delimiter) => {
-		const parts = [];
-		let current = "";
-		let openCount = 0;
-		let i = 0;
-		while (i < str.length) {
-			if (str[i] === "(") openCount++;
-			else if (str[i] === ")") openCount--;
-			if (openCount === 0 && str.substring(i).toUpperCase().startsWith(delimiter)) {
-				parts.push(current);
-				current = "";
-				i += delimiter.length;
-			} else {
-				current += str[i];
-				i++;
-			}
+		case "rolesContain": {
+			const userRoles = ctx.roles ?? [];
+			return expr.roles.every((r) => r === "public" || userRoles.includes(r));
 		}
-		parts.push(current);
-		return parts;
-	};
-	const orParts = splitByTopLevel(cleanedSQL, " OR ");
-	if (orParts.length > 1) return orParts.some((part) => evaluateAST(part, auth, entity));
-	const andParts = splitByTopLevel(cleanedSQL, " AND ");
-	if (andParts.length > 1) return andParts.every((part) => evaluateAST(part, auth, entity));
-	const upperSQL = cleanedSQL.toUpperCase();
-	if (upperSQL.includes(" IN ") || upperSQL.includes(" EXISTS ")) return true;
-	const roleIntersectMatch = cleanedSQL.match(/string_to_array\s*\(\s*auth\.roles\(\)\s*,\s*','\s*\)\s*&&\s*ARRAY\[(.*?)\]/i);
-	if (roleIntersectMatch && roleIntersectMatch[1]) {
-		const requiredRoles = roleIntersectMatch[1].split(",").map((r) => r.trim().replace(/'/g, ""));
-		const userRoles = auth.user?.roles || [];
-		return requiredRoles.some((r) => userRoles.includes(r));
-	}
-	const roleContainMatch = cleanedSQL.match(/string_to_array\s*\(\s*auth\.roles\(\)\s*,\s*','\s*\)\s*@>\s*ARRAY\[(.*?)\]/i);
-	if (roleContainMatch && roleContainMatch[1]) {
-		const requiredRoles = roleContainMatch[1].split(",").map((r) => r.trim().replace(/'/g, ""));
-		const userRoles = auth.user?.roles || [];
-		return requiredRoles.every((r) => userRoles.includes(r));
-	}
-	const pattern1 = /* @__PURE__ */ new RegExp("^\\{?([a-zA-Z0-9_]+)\\}?\\s*=\\s*(?:current_setting\\s*\\(\\s*'app\\.user_id'\\s*\\)|auth\\.uid\\(\\))");
-	const pattern2 = /* @__PURE__ */ new RegExp("^(?:current_setting\\s*\\(\\s*'app\\.user_id'\\s*\\)|auth\\.uid\\(\\))\\s*=\\s*\\{?([a-zA-Z0-9_]+)\\}?");
-	const match1 = cleanedSQL.match(pattern1);
-	if (match1 && match1[1]) return entity.values[match1[1]] === auth.user?.uid;
-	const match2 = cleanedSQL.match(pattern2);
-	if (match2 && match2[1]) return entity.values[match2[1]] === auth.user?.uid;
-	const simpleEqualityMatch = cleanedSQL.match(/^\{?([\w_]+)\}?\s*(=|!=)\s*'([^']+)'$/i);
-	if (simpleEqualityMatch) {
-		const field = simpleEqualityMatch[1];
-		const operator = simpleEqualityMatch[2];
-		const value = simpleEqualityMatch[3];
-		const entityValue = entity.values[field];
-		if (operator === "=") return entityValue === value;
-		if (operator === "!=") return entityValue !== value;
+		case "authenticated": return ctx.uid != null;
+		case "existsIn": return "unknown";
+		case "raw": return "unknown";
 	}
+}
+function kleeneAnd$1(values) {
+	if (values.some((v) => v === false)) return false;
+	if (values.some((v) => v === "unknown")) return "unknown";
 	return true;
 }
-function evaluateRule(rule, auth, entity) {
-	if (rule.access === "public") return true;
-	if (rule.ownerField) {
-		if (!entity) {} else if (entity.values[rule.ownerField] !== auth.user?.uid) return false;
-	}
-	if (rule.using && !evaluateAST(rule.using, auth, entity)) return false;
-	if (rule.withCheck && !evaluateAST(rule.withCheck, auth, entity)) return false;
+function kleeneOr(values) {
+	if (values.some((v) => v === true)) return true;
+	if (values.some((v) => v === "unknown")) return "unknown";
+	return false;
+}
+function kleeneNot(value) {
+	if (value === "unknown") return "unknown";
+	return !value;
+}
+function resolveOperand(operand, ctx) {
+	switch (operand.kind) {
+		case "literal": return {
+			known: true,
+			value: operand.value
+		};
+		case "authUid": return {
+			known: true,
+			value: ctx.uid ?? null
+		};
+		case "authRoles": return {
+			known: true,
+			value: ctx.roles ?? []
+		};
+		case "field":
+			if (!ctx.entity) return { known: false };
+			return {
+				known: true,
+				value: ctx.entity.values[operand.name]
+			};
+		case "outerField": return { known: false };
+	}
+}
+function evaluateCompare(op, left, right, ctx) {
+	const l = resolveOperand(left, ctx);
+	const r = resolveOperand(right, ctx);
+	if (!l.known || !r.known) return "unknown";
+	const a = l.value;
+	const b = r.value;
+	if (a === null || b === null) {
+		if (op === "eq") return false;
+		if (op === "neq") return true;
+		return "unknown";
+	}
+	if (op === "eq") return a === b;
+	if (op === "neq") return a !== b;
+	if (typeof a === "string" && typeof b === "string") {
+		if (op === "lt") return a < b;
+		if (op === "lte") return a <= b;
+		if (op === "gt") return a > b;
+		if (op === "gte") return a >= b;
+	}
+	if (typeof a === "number" && typeof b === "number") {
+		if (op === "lt") return a < b;
+		if (op === "lte") return a <= b;
+		if (op === "gt") return a > b;
+		if (op === "gte") return a >= b;
+	}
+	if (typeof a === "bigint" && typeof b === "bigint") {
+		if (op === "lt") return a < b;
+		if (op === "lte") return a <= b;
+		if (op === "gt") return a > b;
+		if (op === "gte") return a >= b;
+	}
+	return "unknown";
+}
+//#endregion
+//#region src/util/permissions.ts
+/** Combine clause results with AND under three-valued (Kleene) logic. */
+function kleeneAnd(values) {
+	if (values.some((v) => v === false)) return false;
+	if (values.some((v) => v === "unknown")) return "unknown";
 	return true;
 }
-function checkOperation(collection, authContext, entity, targetOperation) {
-	const securityRules = getDataSourceCapabilities(collection.driver).supportsRLS ? collection.securityRules : void 0;
+/** The operations a rule covers, mirroring the Postgres generator's resolution. */
+function ruleOperations(rule) {
+	return rule.operations && rule.operations.length > 0 ? rule.operations : [rule.operation ?? "all"];
+}
+function ruleApplies(rule, targetOperation) {
+	const ops = ruleOperations(rule);
+	return ops.includes(targetOperation) || ops.includes("all");
+}
+/**
+* Evaluate a single rule for one operation, returning a tri-state.
+*
+* A `null` clause (the rule contributes no condition for a required clause)
+* denies — matching Postgres, which emits `USING (false)` / `WITH CHECK (false)`
+* in that case. USING applies to SELECT/UPDATE/DELETE; WITH CHECK to
+* INSERT/UPDATE; both must pass for UPDATE.
+*/
+function evaluateRuleForOperation(rule, ctx, targetOperation) {
+	const { usingExpr, withCheckExpr } = securityRuleToConditions(rule);
+	const clause = (expr) => expr === null ? false : evaluatePolicy(expr, ctx);
+	const needsUsing = targetOperation !== "insert";
+	const needsWithCheck = targetOperation === "insert" || targetOperation === "update";
+	const results = [];
+	if (needsUsing) results.push(clause(usingExpr));
+	if (needsWithCheck) results.push(clause(withCheckExpr));
+	return kleeneAnd(results);
+}
+function resolveTriState(value, onUnknown) {
+	if (value === "unknown") return onUnknown === "allow";
+	return value;
+}
+/**
+* Decide whether an operation is permitted for a user on a (possibly null) row,
+* by evaluating the collection's security rules with the shared policy model —
+* the same model compiled to Postgres RLS DDL, so the decision matches database
+* enforcement for every non-raw rule.
+*
+* @param options.onUnknown how to treat rules that cannot be decided
+*   client-side (raw SQL, or row predicates with no row). Defaults to `"allow"`
+*   for optimistic UI gating; enforcement callers should pass `"deny"`.
+*/
+function checkOperation(collection, authContext, entity, targetOperation, options) {
+	const onUnknown = options?.onUnknown ?? "allow";
+	const securityRules = getDataSourceCapabilities(collection.engine).supportsRLS ? collection.securityRules : void 0;
 	if (!securityRules || securityRules.length === 0) return true;
-	const applicableRules = securityRules.filter((r) => r.operation === targetOperation || r.operation === "all" || r.operations?.includes(targetOperation) || r.operations?.includes("all"));
+	const applicableRules = securityRules.filter((r) => ruleApplies(r, targetOperation));
 	if (applicableRules.length === 0) return false;
-	const userRoles = [...authContext.user?.roles ?? [], "public"];
-	const roleApplicableRules = applicableRules.filter((rule) => {
-		if (!rule.roles || rule.roles.length === 0) return true;
-		return rule.roles.some((r) => userRoles.includes(r));
-	});
-	if (roleApplicableRules.length === 0) return false;
+	const ctx = {
+		uid: authContext.user?.uid,
+		roles: authContext.user?.roles ?? [],
+		entity
+	};
 	let grantedByPermissive = false;
 	let deniedByRestrictive = false;
-	for (const rule of roleApplicableRules) {
+	let hasPermissive = false;
+	for (const rule of applicableRules) {
 		const mode = rule.mode || "permissive";
-		const passed = evaluateRule(rule, authContext, entity);
-		if (mode === "restrictive" && !passed) {
-			deniedByRestrictive = true;
-			break;
+		const passed = resolveTriState(evaluateRuleForOperation(rule, ctx, targetOperation), onUnknown);
+		if (mode === "restrictive") {
+			if (!passed) {
+				deniedByRestrictive = true;
+				break;
+			}
+		} else {
+			hasPermissive = true;
+			if (passed) grantedByPermissive = true;
 		}
-		if (mode === "permissive" && passed) grantedByPermissive = true;
 	}
 	if (deniedByRestrictive) return false;
-	if (roleApplicableRules.some((r) => (r.mode || "permissive") === "permissive")) return grantedByPermissive;
-	else return false;
+	return hasPermissive ? grantedByPermissive : false;
 }
 function canReadCollection(collection, authContext) {
 	return checkOperation(collection, authContext, null, "select");
@@ -807,7 +1073,7 @@ function getEntityImagePreviewPropertyKey(collection) {
 	}
 	for (const key in collection.properties) {
 		const property = collection.properties[key];
-		if (property.type === "array" && property.of && !Array.isArray(property.of) && property.of.type === "string" && property.of.url === "image") return key;
+		if (property.type === "array" && property.of && !Array.isArray(property.of) && property.of.type === "string" && property.of.ui?.url === "image") return key;
 	}
 	for (const key in collection.properties) {
 		const property = collection.properties[key];
@@ -876,7 +1142,7 @@ function resolveCollectionPathIds(path, allCollections) {
 			} else {
 				entityId = remainingPath;
 				remainingPath = "";
-				console.warn(`resolveCollectionPathIds: Path seems to end with an entity ID "${entityId}" instead of a collection segment in original path "${path}". This might indicate an invalid input path.`);
+				console.warn(`resolveCollectionPathIds: Path seems to end with a entity ID "${entityId}" instead of a collection segment in original path "${path}". This might indicate an invalid input path.`);
 			}
 			resolvedPathParts.push(entityId);
 			currentCollections = getSubcollections(foundCollection);
@@ -1032,79 +1298,60 @@ function getParentReferencesFromPath(props) {
 //#endregion
 //#region src/util/builders.ts
 /**
-* Identity function we use to defeat the type system of Typescript and build
-* collection views with all its properties
-* @param collection
+* @deprecated Use {@link defineCollection} instead — it infers property
+* types automatically (autocomplete on `titleProperty`, `sort`,
+* `propertiesOrder`, callbacks) without manual generics.
+* `buildCollection` is kept for FireCMS migration compatibility and will
+* be removed before 1.0.
+*
 * @group Builder
 */
 function buildCollection(collection) {
 	return collection;
 }
 /**
-* Identity function we use to defeat the type system of Typescript and preserve
-* the property keys.
-* @param property
-* @group Builder
-*/
-function buildProperty(property) {
-	return property;
-}
-/**
-* Identity function we use to defeat the type system of Typescript and preserve
-* the properties keys.
-* @param properties
-* @group Builder
-*/
-function buildProperties(properties) {
-	return properties;
-}
-/**
-* Identity function we use to defeat the type system of Typescript and preserve
-* the properties keys.
-* @param propertiesOrBuilder
-* @group Builder
-*/
-function buildPropertiesOrBuilder(propertiesOrBuilder) {
-	return propertiesOrBuilder;
-}
-/**
-* Identity function we use to defeat the type system of Typescript and preserve
-* the properties keys.
-* @param enumValues
-* @group Builder
-*/
-function buildEnum(enumValues) {
-	return enumValues;
-}
-/**
-* Identity function we use to defeat the type system of Typescript and preserve
-* the properties keys.
-* @param enumValueConfig
-* @group Builder
+* Implementation — delegates to the correct overload at the type level.
+* At runtime this is a plain identity function.
 */
-function buildEnumValueConfig(enumValueConfig) {
-	return enumValueConfig;
+function defineCollection(collection) {
+	return collection;
 }
 /**
-* Identity function we use to defeat the type system of Typescript and preserve
-* the properties keys.
-* @param callbacks
+* @deprecated Use plain typed property objects with {@link defineCollection}
+* instead — `defineCollection` infers property types automatically, making
+* this wrapper unnecessary. `buildProperty` is kept for FireCMS migration
+* compatibility and will be removed before 1.0.
+*
 * @group Builder
 */
-function buildEntityCallbacks(callbacks) {
-	return callbacks;
+function buildProperty(property) {
+	return property;
 }
+//#endregion
+//#region src/util/storage.ts
 /**
-* Identity function we use to defeat the type system of Typescript and build
-* additional field delegates views with all its properties
-* @param additionalFieldDelegate
-* @group Builder
+* Resolve the {@link StorageSource} to use for a property, given the key
+* referenced by `StorageConfig.storageSource`.
+*
+* Resolution priority:
+* 1. No `sourceKey` → the default source (backward compatible).
+* 2. An explicit {@link StorageSourceRegistry} (e.g. `client.storageRegistry`).
+* 3. A `sources` lookup map (e.g. the `StorageSourcesContext`).
+* 4. Fall back to the default source.
+*
+* Shared by the upload hook, the markdown editor, and the read-only previews
+* so the resolution logic lives in one place.
+*
+* @group Storage
 */
-function buildAdditionalFieldDelegate(additionalFieldDelegate) {
-	return additionalFieldDelegate;
+function resolveStorageSource(params) {
+	const { sourceKey, sources, registry, defaultSource } = params;
+	if (!sourceKey) return defaultSource;
+	if (registry) return registry.getOrDefault(sourceKey);
+	const fromSources = sources?.[sourceKey];
+	if (fromSources) return fromSources;
+	return defaultSource;
 }
-//#endregion
-//#region src/util/storage.ts
 async function resolveStorageFilenameString({ input, storage, values, entityId, path, property, file, propertyKey }) {
 	let result;
 	if (typeof input === "function") {
@@ -1215,16 +1462,17 @@ async function processProperties(properties, values, previousValues, propsContex
 }
 /**
 * Helper function to extract field-level PropertyCallbacks from a properties schema
-* and wrap them into an EntityCallbacks object recursively.
+* and wrap them into an CollectionCallbacks object recursively.
 */
 var buildPropertyCallbacks = (properties) => {
 	if (!properties) return void 0;
 	const propertyCallbacks = {};
 	if (hasPropertyCallbacks(properties, "afterRead")) propertyCallbacks.afterRead = async (props) => {
-		const processedValues = await processProperties(properties, props.entity.values, props.entity.values, props, "afterRead");
+		const row = props.row;
+		const processedValues = await processProperties(properties, row, row, props, "afterRead");
 		return {
-			...props.entity,
-			values: processedValues
+			...props.row,
+			...processedValues
 		};
 	};
 	if (hasPropertyCallbacks(properties, "beforeSave")) propertyCallbacks.beforeSave = async (props) => {
@@ -1411,6 +1659,84 @@ function applyEnumConditions(enumValues, conditions, context) {
 	return result;
 }
 //#endregion
+//#region src/util/filter-operator-resolution.ts
+/**
+* Default operators offered per property type, before engine capabilities and
+* per-property narrowing are applied. These mirror what the built-in filter
+* fields can render.
+*/
+var COMPARISON_OPS = [
+	"==",
+	"!=",
+	">",
+	">=",
+	"<",
+	"<="
+];
+var NULL_CHECK_OPS = ["is-null", "is-not-null"];
+var MEMBERSHIP_OPS = ["in", "not-in"];
+var PATTERN_OPS = [
+	"like",
+	"ilike",
+	"not-like",
+	"not-ilike"
+];
+var DEFAULT_OPS_BY_TYPE = {
+	string: [
+		...COMPARISON_OPS,
+		...MEMBERSHIP_OPS,
+		...PATTERN_OPS,
+		...NULL_CHECK_OPS
+	],
+	number: [
+		...COMPARISON_OPS,
+		...MEMBERSHIP_OPS,
+		...NULL_CHECK_OPS
+	],
+	date: [...COMPARISON_OPS, ...NULL_CHECK_OPS],
+	boolean: [
+		"==",
+		"!=",
+		...NULL_CHECK_OPS
+	],
+	reference: [
+		"==",
+		"!=",
+		...MEMBERSHIP_OPS,
+		...NULL_CHECK_OPS
+	],
+	relation: [
+		"==",
+		"!=",
+		...MEMBERSHIP_OPS,
+		...NULL_CHECK_OPS
+	]
+};
+/** Operators offered when the property is an *array of* a filterable type. */
+var ARRAY_OPS = ["array-contains", "array-contains-any"];
+/**
+* Resolve which filter operators the UI should offer for a property.
+*
+* The result is the **intersection** of three sets:
+* 1. what the engine can execute — {@link DataSourceCapabilities.filterOperators}
+*    (e.g. Firestore cannot run the LIKE family);
+* 2. what makes sense for the property type (e.g. no `>` on booleans);
+* 3. the developer's optional narrowing — `property.ui.filterOperators`.
+*
+* Returns an empty array when the property is not filterable (either by
+* type, or because the developer disabled it with `filterOperators: []`).
+*
+* @group Models
+*/
+function resolveFilterOperators({ property, isArray, engine }) {
+	const typeDefaults = isArray ? ARRAY_OPS : DEFAULT_OPS_BY_TYPE[property.type] ?? [];
+	if (typeDefaults.length === 0) return [];
+	const engineOps = new Set(getDataSourceCapabilities(engine).filterOperators ?? ALL_WHERE_FILTER_OPS);
+	const narrowing = property.ui?.filterOperators;
+	const narrowingSet = narrowing !== void 0 ? new Set(narrowing) : void 0;
+	return typeDefaults.filter((op) => engineOps.has(op) && (narrowingSet === void 0 || narrowingSet.has(op)));
+}
+//#endregion
 //#region src/data/resolveDataSource.ts
 /**
 * Build a keyed registry from a list of {@link DataSourceDefinition}s.
@@ -1427,13 +1753,13 @@ function createDataSourceRegistry(definitions) {
 * editor's capability lookups.
 *
 * Resolution order:
-* 1. The routing **key** is `collection.dataSource`, else the legacy
-*    `collection.driver`, else {@link DEFAULT_DATA_SOURCE_KEY}.
+* 1. The routing **key** is `collection.dataSource`, else
+*    {@link DEFAULT_DATA_SOURCE_KEY}.
 * 2. If a definition is registered for that key, it provides `engine`,
 *    `transport`, and `databaseId`.
-* 3. Otherwise values are synthesized for backward compatibility: `engine`
-*    from the legacy `driver` (or the key, or `"postgres"`), `transport`
-*    defaults to `"server"`, and `databaseId` from the collection.
+* 3. Otherwise values are synthesized: `engine` from `collection.engine`
+*    (or the key, or `"postgres"`), `transport` defaults to `"server"`,
+*    and `databaseId` from the collection.
 *
 * `capabilities` are always derived from the resolved `engine`, so two
 * data sources sharing an engine share capabilities.
@@ -1442,9 +1768,9 @@ function createDataSourceRegistry(definitions) {
 * @param registry   optional registry of declared data sources
 */
 function resolveDataSource(collection, registry) {
-	const key = collection?.dataSource ?? collection?.driver ?? DEFAULT_DATA_SOURCE_KEY;
+	const key = collection?.dataSource ?? DEFAULT_DATA_SOURCE_KEY;
 	const def = registry?.[key];
-	const engine = def?.engine ?? collection?.driver ?? (key !== DEFAULT_DATA_SOURCE_KEY ? key : "postgres");
+	const engine = def?.engine ?? collection?.engine ?? (key !== DEFAULT_DATA_SOURCE_KEY ? key : "postgres");
 	return {
 		key,
 		engine,
@@ -1459,9 +1785,28 @@ var CollectionRegistry = class {
 	/**
 	* Declared data sources, used during normalization to resolve each
 	* collection's engine (so `dataSource`-only collections get the right
-	* capabilities). Empty by default → behaviour keys off `driver` as before.
+	* capabilities). Empty by default.
 	*/
 	dataSources = {};
+	/**
+	* Global lifecycle callbacks applied to every collection.
+	* Runs on all data paths (REST, WebSocket, `rebase.data`).
+	* Execution order: global → collection → property callbacks.
+	*/
+	_globalCallbacks;
+	/**
+	* Set global lifecycle callbacks that apply to every collection.
+	* Typically called once during backend initialization.
+	*/
+	setGlobalCallbacks(callbacks) {
+		this._globalCallbacks = callbacks;
+	}
+	/**
+	* Get the currently registered global callbacks, if any.
+	*/
+	getGlobalCallbacks() {
+		return this._globalCallbacks;
+	}
 	collectionsByTableName = /* @__PURE__ */ new Map();
 	collectionsBySlug = /* @__PURE__ */ new Map();
 	rootCollections = [];
@@ -1470,7 +1815,7 @@ var CollectionRegistry = class {
 	rawCollectionsBySlug = /* @__PURE__ */ new Map();
 	rawRootCollections = [];
 	cachedRawCollectionsList = null;
-	lastRawInputSnapshot = null;
+	lastRawInputEntity = null;
 	constructor(collections, dataSources) {
 		if (dataSources) this.dataSources = dataSources;
 		if (collections) this.registerMultiple(collections);
@@ -1500,12 +1845,12 @@ var CollectionRegistry = class {
 	* Returns true if the collections have changed, false otherwise.
 	*
 	* Idempotent: compares the raw input (before normalization) against a stored
-	* snapshot. Only re-normalizes and re-registers when the raw input actually changed.
+	* entity. Only re-normalizes and re-registers when the raw input actually changed.
 	* @param collections
 	*/
 	registerMultiple(collections) {
-		const rawSnapshot = collections.map((c) => removeFunctions(c));
-		if (this.lastRawInputSnapshot && deepEqual(this.lastRawInputSnapshot, rawSnapshot)) return false;
+		const rawEntity = collections.map((c) => removeFunctions(c));
+		if (this.lastRawInputEntity && deepEqual(this.lastRawInputEntity, rawEntity)) return false;
 		this.reset();
 		collections.forEach((c) => {
 			if (c.slug) this.collectionsBySlug.set(c.slug, c);
@@ -1529,7 +1874,7 @@ var CollectionRegistry = class {
 				this._registerRecursively(this.normalizeCollection({ ...subCollection }), deepClone(subCollection));
 			});
 		});
-		this.lastRawInputSnapshot = rawSnapshot;
+		this.lastRawInputEntity = rawEntity;
 		return true;
 	}
 	register(collection, rawCollection) {
@@ -1553,13 +1898,14 @@ var CollectionRegistry = class {
 	}
 	normalizeCollection(collection) {
 		const result = { ...collection };
-		if (result.dataSource && !result.driver) {
-			const engine = resolveDataSource(result, this.dataSources).engine;
-			if (engine) result.driver = engine;
+		{
+			const resolved = resolveDataSource(result, this.dataSources);
+			if (!result.dataSource) result.dataSource = resolved.key;
+			if (!result.engine) result.engine = resolved.engine;
 		}
 		const extractedRelations = this.extractRelationsFromProperties(result.properties);
 		const relResult = result;
-		const manualRelations = getDataSourceCapabilities(result.driver).supportsRelations ? relResult.relations ?? [] : [];
+		const manualRelations = getDataSourceCapabilities(result.engine).supportsRelations ? relResult.relations ?? [] : [];
 		const mergedRelationsRaw = [...extractedRelations];
 		for (const manual of manualRelations) {
 			const name = manual.relationName;
@@ -1574,7 +1920,7 @@ var CollectionRegistry = class {
 			}
 		}
 		let mergedRelations = mergedRelationsRaw;
-		if (getDataSourceCapabilities(result.driver).supportsRelations) {
+		if (getDataSourceCapabilities(result.engine).supportsRelations) {
 			mergedRelations = mergedRelationsRaw.map((r) => {
 				try {
 					return sanitizeRelation(r, result, (slug) => this.get(slug));
@@ -1586,8 +1932,10 @@ var CollectionRegistry = class {
 		}
 		result.properties = this.normalizeProperties(result.properties, mergedRelations);
 		if (!result.childCollections) {
-			if (getDataSourceCapabilities(result.driver).supportsSubcollections && result.subcollections) result.childCollections = result.subcollections;
-			else if (getDataSourceCapabilities(result.driver).supportsRelations && relResult.relations) {
+			const capabilities = getDataSourceCapabilities(result.engine);
+			const declaredSubcollections = getDeclaredSubcollections(result);
+			if (capabilities.supportsSubcollections && declaredSubcollections) result.childCollections = declaredSubcollections;
+			else if (capabilities.supportsRelations && relResult.relations) {
 				const manyRelations = relResult.relations.filter((r) => r.cardinality === "many");
 				if (manyRelations.length > 0) result.childCollections = () => manyRelations.map((r) => {
 					const target = r.target();
@@ -1689,7 +2037,7 @@ var CollectionRegistry = class {
 		if (!currentCollection) throw new Error(`Root collection not found: ${rootCollectionPath}`);
 		for (let i = 2; i < pathSegments.length; i += 2) {
 			const relationKey = pathSegments[i];
-			if (!getDataSourceCapabilities(currentCollection.driver).supportsRelations) throw new Error(`Relation path navigation requires a collection that supports relations, but '${currentCollection.slug}' uses driver '${currentCollection.driver}'`);
+			if (!getDataSourceCapabilities(currentCollection.engine).supportsRelations) throw new Error(`Relation path navigation requires a collection that supports relations, but '${currentCollection.slug}' uses engine '${currentCollection.engine}'`);
 			const relation = findRelation(resolveCollectionRelations(currentCollection), relationKey);
 			if (!relation) throw new Error(`Relation '${relationKey}' not found in collection '${currentCollection.slug}'`);
 			const target = relation.target();
@@ -1750,7 +2098,7 @@ var CollectionRegistry = class {
 * Slug-based dedup (Map keyed by slug, last-write-wins) lets developers
 * override by defining their own collection with `slug: "users"`.
 */
-var defaultUsersCollection = {
+var defaultUsersCollection = defineCollection({
 	name: "Users",
 	singularName: "User",
 	slug: "users",
@@ -1798,7 +2146,7 @@ var defaultUsersCollection = {
 			name: "Photo URL",
 			type: "string",
 			columnName: "photo_url",
-			url: "image"
+			ui: { url: "image" }
 		},
 		roles: {
 			name: "Roles",
@@ -1893,7 +2241,7 @@ var defaultUsersCollection = {
 		"roles",
 		"createdAt"
 	]
-};
+});
 //#endregion
 //#region src/data/query_builder.ts
 function or(...conditions) {
@@ -1945,8 +2293,8 @@ var QueryBuilder = class {
 	* @example
 	* client.collection('users').orderBy('createdAt', 'desc').find()
 	*/
-	orderBy(column, ascending = "asc") {
-		this.params.orderBy = `${column}:${ascending}`;
+	orderBy(column, direction = "asc") {
+		this.params.orderBy = [column, direction];
 		return this;
 	}
 	/**
@@ -2001,166 +2349,369 @@ var QueryBuilder = class {
 	}
 };
 //#endregion
-//#region src/data/buildRebaseData.ts
+//#region src/data/filter-dialect.ts
 /**
-* Convert where-clause filter object to the internal DataDriver FilterValues format.
-*
-* Supports multiple value formats:
-* - PostgREST string: { status: "eq.published", age: "gte.18" }
-* - Equality shorthand: { company_profile_id: null, status: "active", age: 18 }
-* - Tuple syntax: { age: [">=", 18], role: ["in", ["admin", "editor"]] }
-*
-* Internal:  { status: ["==", "published"], age: [">=", 18] }
-*/
-function convertWhereToFilter(where) {
-	if (!where) return void 0;
-	const operatorMap = {
-		"eq": "==",
-		"neq": "!=",
-		"gt": ">",
-		"gte": ">=",
-		"lt": "<",
-		"lte": "<=",
-		"in": "in",
-		"nin": "not-in",
-		"not-in": "not-in",
-		"cs": "array-contains",
-		"csa": "array-contains-any",
-		"==": "==",
-		"!=": "!=",
-		">": ">",
-		">=": ">=",
-		"<": "<",
-		"<=": "<=",
-		"array-contains": "array-contains",
-		"array-contains-any": "array-contains-any"
-	};
-	const filter = {};
-	for (const [field, rawValue] of Object.entries(where)) {
-		if (rawValue === null) {
-			filter[field] = ["==", null];
-			continue;
-		}
-		if (typeof rawValue === "boolean") {
-			filter[field] = ["==", rawValue];
-			continue;
-		}
-		if (typeof rawValue === "number") {
-			filter[field] = ["==", rawValue];
+* REST wire-format adapter for the unified filter system.
+*
+* This module is the ONLY code in the entire codebase that knows about
+* PostgREST-style dot-syntax strings (`eq.active`, `gt.18`, `in.(a,b)`).
+* Everything else speaks `FilterValues` exclusively.
+*
+* Wire-format values are always strings — the wire format carries no type
+* metadata, so type coercion is the responsibility of the server-side data
+* driver which has access to the collection schema.
+*
+* Commas inside list values are backslash-escaped (`\,`), and literal
+* backslashes are escaped as `\\`.
+*
+* @module
+*/
+/**
+* Serialize a JS value to its querystring representation.
+* `null` is serialized as the literal string `"null"`.
+*/
+function stringifyValue(value) {
+	if (value === null) return "null";
+	return String(value);
+}
+/**
+* Escape a single list item for the wire format.
+* `\` → `\\`, `,` → `\,`
+*/
+function escapeListItem(value) {
+	return value.replace(/\\/g, "\\\\").replace(/,/g, "\\,");
+}
+/**
+* Unescape a single list item from the wire format.
+* `\\` → `\`, `\,` → `,`
+*/
+function unescapeListItem(value) {
+	let result = "";
+	for (let i = 0; i < value.length; i++) if (value[i] === "\\" && i + 1 < value.length) {
+		result += value[i + 1];
+		i++;
+	} else result += value[i];
+	return result;
+}
+/**
+* Split a parenthesized list string on unescaped commas.
+* Input is the content between `(` and `)`.
+*
+* @example
+* splitListItems("admin,editor")          // ["admin", "editor"]
+* splitListItems("hello\\, world,foo")    // ["hello, world", "foo"]
+*/
+function splitListItems(inner) {
+	const items = [];
+	let current = "";
+	for (let i = 0; i < inner.length; i++) if (inner[i] === "\\" && i + 1 < inner.length) {
+		current += inner[i] + inner[i + 1];
+		i++;
+	} else if (inner[i] === ",") {
+		items.push(unescapeListItem(current));
+		current = "";
+	} else current += inner[i];
+	items.push(unescapeListItem(current));
+	return items;
+}
+var REST_OP_LOOKUP = REST_TO_CANONICAL;
+var CANONICAL_OP_LOOKUP = CANONICAL_TO_REST;
+/**
+* Serialize a single canonical condition tuple to a PostgREST dot-string.
+*
+* Throws `TypeError` if the input is not a valid `[WhereFilterOp, unknown]` tuple.
+*
+* @example
+* serializeTuple(["==", "active"])           // "eq.active"
+* serializeTuple(["in", ["admin","editor"]]) // "in.(admin,editor)"
+* serializeTuple([">=", 18])                 // "gte.18"
+*/
+function serializeTuple(tuple) {
+	if (!Array.isArray(tuple) || tuple.length !== 2) throw new TypeError(`serializeTuple: expected a [WhereFilterOp, value] tuple, got ${JSON.stringify(tuple)}`);
+	const [op, value] = tuple;
+	if (typeof op !== "string") throw new TypeError(`serializeTuple: operator must be a string, got ${typeof op}`);
+	const restOp = CANONICAL_OP_LOOKUP[op];
+	if (!restOp) throw new TypeError(`serializeTuple: unknown operator "${op}". Valid operators: ${Object.keys(CANONICAL_TO_REST).join(", ")}`);
+	if (Array.isArray(value)) return `${restOp}.(${value.map((v) => escapeListItem(stringifyValue(v))).join(",")})`;
+	return `${restOp}.${stringifyValue(value)}`;
+}
+/**
+* Convert `FilterValues` (or `WireFilterValues`) to a PostgREST-style
+* querystring record.
+*
+* - Canonical `[WhereFilterOp, value]` tuples are serialized strictly.
+* - Pre-serialized PostgREST strings (e.g. `"eq.published"`) are passed through.
+* - Single conditions produce a string value.
+* - Multiple conditions on the same field produce a string array (repeated params).
+*
+* @example
+* serializeFilter({ status: ["==", "active"] })
+* // → { status: "eq.active" }
+*
+* serializeFilter({ age: [[">=", 18], ["<", 65]] })
+* // → { age: ["gte.18", "lt.65"] }
+*
+* // Pre-serialized strings pass through unchanged:
+* serializeFilter({ status: "eq.published" })
+* // → { status: "eq.published" }
+*/
+function serializeFilter(filter) {
+	const result = {};
+	for (const [field, condition] of Object.entries(filter)) {
+		if (condition === void 0) continue;
+		if (typeof condition === "string") {
+			result[field] = condition;
 			continue;
 		}
-		if (Array.isArray(rawValue)) {
-			const mappedConditions = (Array.isArray(rawValue[0]) ? rawValue : [rawValue]).map(([rawOp, val]) => {
-				return [operatorMap[rawOp] ?? "==", val];
-			});
-			filter[field] = Array.isArray(rawValue[0]) ? mappedConditions : mappedConditions[0];
+		if (Array.isArray(condition) && condition.length > 0 && Array.isArray(condition[0])) result[field] = condition.map(serializeTuple);
+		else result[field] = serializeTuple(condition);
+	}
+	return result;
+}
+/**
+* Parse a single PostgREST dot-string into a `[WhereFilterOp, unknown]` tuple.
+*
+* All values are returned as strings — the wire format carries no type
+* metadata, so coercion is the data driver's responsibility.
+*
+* If the string doesn't match a known operator prefix, it falls back to
+* `["==", originalString]` (treating the whole string as an equality value).
+* This intentional defense handles values like `"user@host.com"` or
+* `"1.2.3"` that happen to contain dots.
+*/
+function deserializeSingle(raw) {
+	const dotIndex = raw.indexOf(".");
+	if (dotIndex === -1) return ["==", raw];
+	const prefix = raw.substring(0, dotIndex);
+	const rest = raw.substring(dotIndex + 1);
+	const canonicalOp = REST_OP_LOOKUP[prefix];
+	if (!canonicalOp) return ["==", raw];
+	if (NULL_OPS.has(canonicalOp)) return [canonicalOp, null];
+	if (rest.startsWith("(") && rest.endsWith(")")) return [canonicalOp, splitListItems(rest.slice(1, -1))];
+	return [canonicalOp, rest];
+}
+/**
+* Convert a PostgREST-style querystring record to `FilterValues`.
+*
+* - String values are parsed as single conditions.
+* - String arrays (repeated query params) become multiple conditions on the same field.
+*
+* @example
+* deserializeFilter({ status: "eq.active" })
+* // → { status: ["==", "active"] }
+*
+* deserializeFilter({ age: ["gte.18", "lt.65"] })
+* // → { age: [[">=", "18"], ["<", "65"]] }
+*/
+function deserializeFilter(query) {
+	const result = {};
+	for (const [field, raw] of Object.entries(query)) {
+		if (raw === void 0) continue;
+		if (Array.isArray(raw) && raw.length === 2 && typeof raw[0] === "string" && toCanonicalOp(raw[0]) === raw[0]) {
+			result[field] = raw;
 			continue;
 		}
-		if (typeof rawValue === "string") {
-			const dotIndex = rawValue.indexOf(".");
-			if (dotIndex === -1) {
-				filter[field] = ["==", rawValue];
+		if (Array.isArray(raw)) {
+			if (raw.length === 0) continue;
+			if (Array.isArray(raw[0]) && raw[0].length === 2 && typeof raw[0][0] === "string" && toCanonicalOp(raw[0][0]) === raw[0][0]) {
+				result[field] = raw;
 				continue;
 			}
-			const op = rawValue.substring(0, dotIndex);
-			let value = rawValue.substring(dotIndex + 1);
-			if (typeof value === "string" && value.startsWith("(") && value.endsWith(")")) value = value.slice(1, -1).split(",").map((v) => v.trim());
-			if (value === "null") value = null;
-			else if (value === "true") value = true;
-			else if (value === "false") value = false;
-			else if (typeof value === "string" && !isNaN(Number(value)) && value.trim() !== "") value = Number(value);
-			const mappedOp = operatorMap[op];
-			if (mappedOp) filter[field] = [mappedOp, value];
+			if (raw.length === 1) result[field] = typeof raw[0] === "string" ? deserializeSingle(raw[0]) : ["==", raw[0]];
+			else if (typeof raw[0] === "string" && raw[0].includes(".")) result[field] = raw.map((r) => typeof r === "string" ? deserializeSingle(r) : ["==", r]);
+			else result[field] = ["in", raw];
+		} else if (typeof raw === "string") result[field] = deserializeSingle(raw);
+		else result[field] = ["==", raw];
+	}
+	return result;
+}
+/**
+* Serialize a `LogicalCondition` or `FilterCondition` to its wire-format string.
+*
+* @example
+* serializeLogicalCondition({ column: "status", operator: "==", value: "active" })
+* // → "status.eq.active"
+*
+* serializeLogicalCondition({ type: "or", conditions: [...] })
+* // → "or(status.eq.active,status.eq.pending)"
+*/
+function serializeLogicalCondition(cond) {
+	if ("type" in cond) {
+		const inner = (cond.conditions ?? []).map(serializeLogicalCondition).join(",");
+		return `${cond.type}(${inner})`;
+	}
+	const restOp = CANONICAL_OP_LOOKUP[cond.operator] ?? "eq";
+	if (Array.isArray(cond.value)) {
+		const items = cond.value.map((v) => escapeListItem(stringifyValue(v))).join(",");
+		return `${cond.column}.${restOp}.(${items})`;
+	}
+	return `${cond.column}.${restOp}.${stringifyValue(cond.value)}`;
+}
+/**
+* Parse a logical condition wire-format string back into a
+* `LogicalCondition` or `FilterCondition`.
+*
+* @example
+* deserializeLogicalCondition("status.eq.active")
+* // → { column: "status", operator: "==", value: "active" }
+*
+* deserializeLogicalCondition("or(status.eq.active,age.gte.18)")
+* // → { type: "or", conditions: [...] }
+*/
+function deserializeLogicalCondition(str) {
+	const logicalMatch = str.match(/^(and|or)\((.+)\)$/);
+	if (logicalMatch) {
+		const type = logicalMatch[1];
+		const innerStr = logicalMatch[2];
+		const conditions = [];
+		let depth = 0;
+		let start = 0;
+		for (let i = 0; i < innerStr.length; i++) if (innerStr[i] === "(") depth++;
+		else if (innerStr[i] === ")") depth--;
+		else if (innerStr[i] === "," && depth === 0) {
+			conditions.push(deserializeLogicalCondition(innerStr.slice(start, i)));
+			start = i + 1;
 		}
+		conditions.push(deserializeLogicalCondition(innerStr.slice(start)));
+		return {
+			type,
+			conditions
+		};
 	}
-	return Object.keys(filter).length > 0 ? filter : void 0;
+	const firstDot = str.indexOf(".");
+	if (firstDot === -1) return {
+		column: str,
+		operator: "==",
+		value: true
+	};
+	const column = str.substring(0, firstDot);
+	const rest = str.substring(firstDot + 1);
+	const secondDot = rest.indexOf(".");
+	if (secondDot === -1) return {
+		column,
+		operator: "==",
+		value: rest
+	};
+	const opStr = rest.substring(0, secondDot);
+	const valueStr = rest.substring(secondDot + 1);
+	const operator = toCanonicalOp(opStr) ?? "==";
+	if (valueStr.startsWith("(") && valueStr.endsWith(")")) return {
+		column,
+		operator,
+		value: splitListItems(valueStr.slice(1, -1))
+	};
+	return {
+		column,
+		operator,
+		value: valueStr
+	};
 }
+//#endregion
+//#region src/data/buildRebaseData.ts
 /**
-* Parse an orderBy string like "created_at:desc" into [field, direction].
+* Convert a flat REST record (e.g. from RestFetchService) to Entity<M> format.
+* Mirrors the client SDK's rowToEntity conversion.
 */
-function parseOrderBy(orderBy) {
-	if (!orderBy) return void 0;
-	const parts = orderBy.split(":");
-	return [parts[0], parts[1] || "asc"];
+function rowToEntity(row, slug) {
+	return {
+		id: row.id,
+		path: slug,
+		values: row
+	};
 }
 function createDriverAccessor(driver, slug) {
 	const accessor = {
 		async find(params) {
-			const orderParsed = parseOrderBy(params?.orderBy);
-			const entities = await driver.fetchCollection({
+			const filter = params?.where ? deserializeFilter(params.where) : void 0;
+			const limit = params?.limit ?? 20;
+			const offset = params?.offset ?? 0;
+			const fetchService = driver.restFetchService;
+			const rows = fetchService && params?.include && params.include.length > 0 ? await fetchService.fetchCollectionForRest(slug, {
+				filter,
+				limit: params?.limit,
+				offset: params?.offset,
+				orderBy: params?.orderBy?.[0],
+				order: params?.orderBy?.[1],
+				searchString: params?.searchString
+			}, params.include) : await driver.fetchCollection({
 				path: slug,
 				limit: params?.limit,
 				offset: params?.offset,
-				filter: convertWhereToFilter(params?.where),
-				orderBy: orderParsed?.[0],
-				order: orderParsed?.[1],
+				filter,
+				orderBy: params?.orderBy?.[0],
+				order: params?.orderBy?.[1],
 				searchString: params?.searchString
 			});
-			const limit = params?.limit ?? 20;
-			const offset = params?.offset ?? 0;
+			let total = rows.length + offset;
+			let hasMore = rows.length >= limit;
+			if (driver.count) {
+				total = await driver.count({
+					path: slug,
+					filter
+				});
+				hasMore = offset + rows.length < total;
+			}
 			return {
-				data: entities,
+				data: rows.map((row) => rowToEntity(row, slug)),
 				meta: {
-					total: entities.length,
+					total,
 					limit,
 					offset,
-					hasMore: entities.length >= limit
+					hasMore
 				}
 			};
 		},
 		async findById(id) {
-			return driver.fetchEntity({
+			const row = await driver.fetchOne({
 				path: slug,
-				entityId: id
+				id
 			});
+			return row ? rowToEntity(row, slug) : void 0;
 		},
 		async create(data, id) {
-			return driver.saveEntity({
+			return rowToEntity(await driver.save({
 				path: slug,
 				values: data,
-				entityId: id,
+				id,
 				status: "new"
-			});
+			}), slug);
 		},
 		async update(id, data) {
-			return driver.saveEntity({
+			return rowToEntity(await driver.save({
 				path: slug,
 				values: data,
-				entityId: id,
+				id,
 				status: "existing"
-			});
+			}), slug);
 		},
 		async delete(id) {
-			return driver.deleteEntity({ entity: {
+			return driver.delete({ row: {
 				id,
 				path: slug,
 				values: {}
 			} });
 		},
-		deleteAll: driver.deleteAll ? async () => {
-			return driver.deleteAll(slug);
-		} : void 0,
-		count: driver.countEntities ? async (params) => {
-			return driver.countEntities({
+		count: driver.count ? async (params) => {
+			const filter = params?.where ? deserializeFilter(params.where) : void 0;
+			return driver.count({
 				path: slug,
-				filter: convertWhereToFilter(params?.where)
+				filter
 			});
 		} : void 0,
 		listen: driver.listenCollection ? (params, onUpdate, onError) => {
-			const orderParsed = parseOrderBy(params?.orderBy);
 			const limit = params?.limit ?? 20;
 			const offset = params?.offset ?? 0;
 			return driver.listenCollection({
 				path: slug,
 				limit: params?.limit,
 				offset: params?.offset,
-				filter: convertWhereToFilter(params?.where),
-				orderBy: orderParsed?.[0],
-				order: orderParsed?.[1],
+				filter: params?.where,
+				orderBy: params?.orderBy?.[0],
+				order: params?.orderBy?.[1],
 				searchString: params?.searchString,
 				onUpdate: (entities) => {
 					onUpdate({
-						data: entities,
+						data: entities.map((row) => rowToEntity(row, slug)),
 						meta: {
 							total: entities.length,
 							limit,
@@ -2172,11 +2723,11 @@ function createDriverAccessor(driver, slug) {
 				onError
 			});
 		} : void 0,
-		listenById: driver.listenEntity ? (id, onUpdate, onError) => {
-			return driver.listenEntity({
+		listenById: driver.listenOne ? (id, onUpdate, onError) => {
+			return driver.listenOne({
 				path: slug,
-				entityId: id,
-				onUpdate: (entity) => onUpdate(entity ?? void 0),
+				id,
+				onUpdate: (entity) => onUpdate(entity ? rowToEntity(entity, slug) : void 0),
 				onError
 			});
 		} : void 0,
@@ -2213,7 +2764,7 @@ function createDriverAccessor(driver, slug) {
 * @example
 * const data = buildRebaseData(driver);
 * await data.products.create({ name: "Camera", price: 299 });
-* const { data: items } = await data.products.find({ where: { status: "eq.published" } });
+* const { data: items } = await data.products.find({ where: { status: ["==", "published"] } });
 */
 function buildRebaseData(driver) {
 	const cache = /* @__PURE__ */ new Map();
@@ -2232,6 +2783,230 @@ function buildRebaseData(driver) {
 		return getAccessor(toSnakeCase(prop));
 	} });
 }
+/**
+* Unwrap a Entity into a flat row. `rowToEntity` stores the whole flat row
+* (id included) under `.values`, so this is just that payload.
+*/
+function entityToRow(entity) {
+	return entity.values;
+}
+/**
+* Fluent query builder for the flat SDK data layer. Mirrors {@link QueryBuilder}
+* but resolves to `FindResult<M>` (flat rows) instead of Entity-wrapped
+* `FindResponse<M>`.
+*/
+var SdkQueryBuilder = class {
+	client;
+	params = { where: {} };
+	constructor(client) {
+		this.client = client;
+	}
+	where(columnOrCondition, operator, value) {
+		if (typeof columnOrCondition === "object" && columnOrCondition !== null && "type" in columnOrCondition) {
+			this.params.logical = columnOrCondition;
+			return this;
+		}
+		if (!this.params.where) this.params.where = {};
+		const column = columnOrCondition;
+		const condition = [operator, value];
+		const existing = this.params.where[column];
+		if (existing === void 0) this.params.where[column] = condition;
+		else if (Array.isArray(existing) && existing.length > 0 && Array.isArray(existing[0])) this.params.where[column].push(condition);
+		else {
+			let firstCondition;
+			if (Array.isArray(existing) && existing.length === 2 && typeof existing[0] === "string") firstCondition = existing;
+			else firstCondition = ["==", existing];
+			this.params.where[column] = [firstCondition, condition];
+		}
+		return this;
+	}
+	orderBy(column, direction = "asc") {
+		this.params.orderBy = [column, direction];
+		return this;
+	}
+	limit(count) {
+		this.params.limit = count;
+		return this;
+	}
+	offset(count) {
+		this.params.offset = count;
+		return this;
+	}
+	search(searchString) {
+		this.params.searchString = searchString;
+		return this;
+	}
+	include(...relations) {
+		this.params.include = relations;
+		return this;
+	}
+	async find() {
+		return this.client.find(this.params);
+	}
+	async count() {
+		return this.client.count ? this.client.count(this.params) : 0;
+	}
+	listen(onUpdate, onError) {
+		if (!this.client.listen) throw new Error("Listen is only available when the driver supports realtime.");
+		return this.client.listen(this.params, onUpdate, onError);
+	}
+};
+/**
+* Wrap a Entity-shaped {@link CollectionAccessor} into a flat
+* {@link SDKCollectionClient}. Every returned record is unwrapped to a flat row
+* so the backend SDK is byte-for-byte the same shape as the frontend client.
+*/
+function toSdkCollectionClient(snap) {
+	const client = {
+		async find(params) {
+			const res = await snap.find(params);
+			return {
+				data: res.data.map(entityToRow),
+				meta: res.meta
+			};
+		},
+		async findById(id) {
+			const s = await snap.findById(id);
+			return s ? entityToRow(s) : void 0;
+		},
+		async create(data, id) {
+			return entityToRow(await snap.create(data, id));
+		},
+		async update(id, data) {
+			return entityToRow(await snap.update(id, data));
+		},
+		delete(id) {
+			return snap.delete(id);
+		},
+		count: snap.count ? (params) => snap.count(params) : void 0,
+		listen: snap.listen ? (params, onUpdate, onError) => snap.listen(params, (res) => onUpdate({
+			data: res.data.map(entityToRow),
+			meta: res.meta
+		}), onError) : void 0,
+		listenById: snap.listenById ? (id, onUpdate, onError) => snap.listenById(id, (s) => onUpdate(s ? entityToRow(s) : void 0), onError) : void 0,
+		where(columnOrCondition, operator, value) {
+			const builder = new SdkQueryBuilder(client);
+			if (typeof columnOrCondition === "object") return builder.where(columnOrCondition);
+			return builder.where(columnOrCondition, operator, value);
+		},
+		orderBy: (column, direction) => new SdkQueryBuilder(client).orderBy(column, direction),
+		limit: (count) => new SdkQueryBuilder(client).limit(count),
+		offset: (count) => new SdkQueryBuilder(client).offset(count),
+		search: (searchString) => new SdkQueryBuilder(client).search(searchString),
+		include: (...relations) => new SdkQueryBuilder(client).include(...relations)
+	};
+	return client;
+}
+/**
+* Wrap a flat {@link SDKCollectionClient} into a Entity-shaped
+* {@link CollectionAccessor}. Every returned row is re-wrapped into the
+* `{ id, path, values }` view-model the admin CMS renders.
+*/
+function toEntityAccessor(sdk, slug) {
+	const accessor = {
+		async find(params) {
+			const res = await sdk.find(params);
+			return {
+				data: res.data.map((row) => rowToEntity(row, slug)),
+				meta: res.meta
+			};
+		},
+		async findById(id) {
+			const row = await sdk.findById(id);
+			return row ? rowToEntity(row, slug) : void 0;
+		},
+		async create(data, id) {
+			return rowToEntity(await sdk.create(data, id), slug);
+		},
+		async update(id, data) {
+			const row = await sdk.update(id, data);
+			if (!row) throw new Error(`Update returned no data for id ${id}`);
+			return rowToEntity(row, slug);
+		},
+		delete(id) {
+			return sdk.delete(id);
+		},
+		count: sdk.count ? (params) => sdk.count(params) : void 0,
+		listen: sdk.listen ? (params, onUpdate, onError) => sdk.listen(params, (res) => onUpdate({
+			data: res.data.map((row) => rowToEntity(row, slug)),
+			meta: res.meta
+		}), onError) : void 0,
+		listenById: sdk.listenById ? (id, onUpdate, onError) => sdk.listenById(id, (row) => onUpdate(row ? rowToEntity(row, slug) : void 0), onError) : void 0,
+		where(columnOrCondition, operator, value) {
+			const builder = new QueryBuilder(accessor);
+			if (typeof columnOrCondition === "object") return builder.where(columnOrCondition);
+			return builder.where(columnOrCondition, operator, value);
+		},
+		orderBy: (column, direction) => new QueryBuilder(accessor).orderBy(column, direction),
+		limit: (count) => new QueryBuilder(accessor).limit(count),
+		offset: (count) => new QueryBuilder(accessor).offset(count),
+		search: (searchString) => new QueryBuilder(accessor).search(searchString),
+		include: (...relations) => new QueryBuilder(accessor).include(...relations)
+	};
+	return accessor;
+}
+/**
+* Wrap a flat {@link RebaseSdkData} into a Entity-shaped {@link RebaseData}.
+*
+* This is the **CMS boundary**: the SDK client (`client.data`) returns flat
+* rows, but the admin renders the `Entity` view-model (`entity.values.*`).
+* `core/Rebase.tsx` wraps `client.data` through this before handing it to the
+* CMS `RebaseDataContext` — without it the admin renders rows with only their
+* `id`.
+*/
+function wrapAsEntityData(sdkData) {
+	const cache = /* @__PURE__ */ new Map();
+	function getAccessor(slug) {
+		let accessor = cache.get(slug);
+		if (!accessor) {
+			accessor = toEntityAccessor(sdkData.collection(slug), slug);
+			cache.set(slug, accessor);
+		}
+		return accessor;
+	}
+	return new Proxy({ collection: getAccessor }, { get(_target, prop) {
+		if (prop === "collection") return getAccessor;
+		if (typeof prop === "symbol") return void 0;
+		if (prop === "then" || prop === "toJSON" || prop === "$$typeof") return void 0;
+		return getAccessor(toSnakeCase(prop));
+	} });
+}
+/**
+* Wrap a Entity-shaped {@link RebaseData} into a flat {@link RebaseSdkData}.
+*
+* Every collection accessor is adapted to return flat rows. Use this to derive
+* the flat SDK data layer (`context.data`) from an existing Entity data layer
+* — e.g. the admin routes its Entity data via `useData()` and exposes the
+* same routing as flat `context.data` for callbacks by wrapping it here.
+*/
+function wrapAsSdkData(entityData) {
+	const cache = /* @__PURE__ */ new Map();
+	function getAccessor(slug) {
+		let accessor = cache.get(slug);
+		if (!accessor) {
+			accessor = toSdkCollectionClient(entityData.collection(slug));
+			cache.set(slug, accessor);
+		}
+		return accessor;
+	}
+	return new Proxy({ collection: getAccessor }, { get(_target, prop) {
+		if (prop === "collection") return getAccessor;
+		if (typeof prop === "symbol") return void 0;
+		if (prop === "then" || prop === "toJSON" || prop === "$$typeof") return void 0;
+		return getAccessor(toSnakeCase(prop));
+	} });
+}
+/**
+* Build a flat {@link RebaseSdkData} from a `DataDriver`.
+*
+* This is the developer-facing SDK data layer used by backend framework
+* callbacks & scripts (`context.data` / `rebase.data`). It returns flat rows —
+* identical in shape to the frontend SDK client — so the API is symmetric
+* across front and back. The admin CMS uses {@link buildRebaseData} (Entity).
+*/
+function buildSdkData(driver) {
+	return wrapAsSdkData(buildRebaseData(driver));
+}
 //#endregion
 //#region src/data/buildRoutedRebaseData.ts
 /**
@@ -2276,6 +3051,57 @@ function buildRoutedRebaseData({ defaultData, sources, resolveKey }) {
 	} });
 }
 //#endregion
+//#region src/data/sort-dialect.ts
+/**
+* Sort-order wire codec.
+*
+* This is the ONLY module that knows about the colon-delimited wire format
+* (`"field:direction"`) used in HTTP query parameters.
+* Everything else speaks {@link OrderByTuple} exclusively.
+*
+* Mirrors the filter architecture in `filter-dialect.ts`.
+*
+* @module
+*/
+/**
+* Serialize an {@link OrderByTuple} to the wire format `"field:direction"`.
+*
+* **Runtime tolerance:** if the input is already a well-formed wire string
+* (from an untyped JS caller), it is returned unchanged.
+* This is undocumented tolerance, not public API — don't rely on it.
+*
+* @param orderBy - A canonical `[field, direction]` tuple, or at runtime
+*   possibly a pre-serialized string (undocumented tolerance).
+* @returns The wire-format string, or `undefined` if the input is falsy.
+*
+* @remarks
+* Field names containing `:` are representable in the tuple form but
+* **not** on the wire — this is an inherent limitation of the colon-delimited
+* encoding and is not resolved here.
+*/
+function serializeOrderBy(orderBy) {
+	if (!orderBy) return void 0;
+	if (typeof orderBy === "string") return orderBy;
+	return `${orderBy[0]}:${orderBy[1]}`;
+}
+/**
+* Deserialize a wire-format `"field:direction"` string into an {@link OrderByTuple}.
+*
+* Lenient parsing (matches existing server behaviour):
+* - Bare field name (no colon): `"name"` → `["name", "asc"]`
+* - Unknown direction: `"name:foo"` → `["name", "asc"]`
+* - Empty / falsy input: → `undefined`
+*
+* @param raw - The wire-format string from an HTTP query parameter.
+* @returns The canonical tuple, or `undefined` if the input is empty/falsy.
+*/
+function deserializeOrderBy(raw) {
+	if (!raw) return void 0;
+	const idx = raw.indexOf(":");
+	if (idx === -1) return [raw, "asc"];
+	return [raw.slice(0, idx), raw.slice(idx + 1) === "desc" ? "desc" : "asc"];
+}
+//#endregion
 //#region src/table-classification.ts
 /** Schemas that are always considered Rebase-internal. */
 var REBASE_INTERNAL_SCHEMAS = ["rebase", "auth"];
@@ -2352,6 +3178,6 @@ async function detectJunctionTables(executeSql) {
 	return junctionTables;
 }
 //#endregion
-export { COLLECTION_PATH_SEPARATOR, CollectionRegistry, DEFAULT_ONE_OF_TYPE, DEFAULT_ONE_OF_VALUE, JUNCTION_TABLES_SQL, QueryBuilder, REBASE_INTERNAL_PREFIXES, REBASE_INTERNAL_SCHEMAS, addInitialSlash, and, applyPropertyConditions, buildAdditionalFieldDelegate, buildCollection, buildConditionContext, buildEntityCallbacks, buildEnum, buildEnumValueConfig, buildProperties, buildPropertiesOrBuilder, buildProperty, buildPropertyCallbacks, buildRebaseData, buildRoutedRebaseData, canCreateEntity, canDeleteEntity, canEditEntity, canReadCollection, checkOperation, classifyTable, cond, createDataSourceRegistry, createRelationRef, createRelationRefWithData, defaultUsersCollection, detectJunctionTables, enumToObjectEntries, evaluateCondition, findRelation, fullPathToCollectionSegments, getArrayResolvedProperties, getCollectionBySlugWithin, getCollectionPathsCombinations, getColumnName, getDefaultValueFor, getDefaultValueFortype, getDefaultValuesFor, getEntityImagePreviewPropertyKey, getEnumVarName, getLabelOrConfigFrom, getLastSegment, getLocalChangesBackup, getNavigationEntriesFromPath, getParentReferencesFromPath, getPrimaryKeys, getReferenceFrom, getRelationFrom, getSubcollections, getTableName, getTableVarName, isHidden, isPropertyBuilder, isReadOnly, isRebaseInternalTable, normalizeToEntityRelation, or, registerConditionOperations, removeInitialAndTrailingSlashes, removeInitialSlash, removeTrailingSlash, resolveArrayProperties, resolveCollectionPathIds, resolveCollectionRelations, resolveDataSource, resolveDefaultSelectedView, resolveEnumValues, resolveProperties, resolveProperty, resolvePropertyEnum, resolvePropertyRelation, resolveRelationProperty, resolveStorageFilenameString, resolveStoragePathString, sanitizeData, sanitizeRelation, segmentsToStrippedPath, sortProperties, stripCollectionPath, traverseValueProperty, traverseValuesProperties, updateDateAutoValues };
+export { COLLECTION_PATH_SEPARATOR, CollectionRegistry, DEFAULT_ONE_OF_TYPE, DEFAULT_ONE_OF_VALUE, JUNCTION_TABLES_SQL, QueryBuilder, REBASE_INTERNAL_PREFIXES, REBASE_INTERNAL_SCHEMAS, addInitialSlash, and, applyPropertyConditions, buildCollection, buildConditionContext, buildProperty, buildPropertyCallbacks, buildRebaseData, buildRoutedRebaseData, buildSdkData, canCreateEntity, canDeleteEntity, canEditEntity, canReadCollection, checkOperation, classifyTable, cond, createDataSourceRegistry, createRelationRef, createRelationRefWithData, defaultUsersCollection, defineCollection, deserializeFilter, deserializeLogicalCondition, deserializeOrderBy, detectJunctionTables, enumToObjectEntries, evaluateCondition, evaluatePolicy, findRelation, fullPathToCollectionSegments, getArrayResolvedProperties, getCollectionBySlugWithin, getCollectionPathsCombinations, getColumnName, getDefaultValueFor, getDefaultValueFortype, getDefaultValuesFor, getEntityImagePreviewPropertyKey, getEnumVarName, getLabelOrConfigFrom, getLastSegment, getLocalChangesBackup, getNavigationEntriesFromPath, getParentReferencesFromPath, getPrimaryKeys, getReferenceFrom, getRelationFrom, getSubcollections, getTableName, getTableVarName, isHidden, isPropertyBuilder, isReadOnly, isRebaseInternalTable, normalizeToEntityRelation, or, policyToPostgres, registerConditionOperations, removeInitialAndTrailingSlashes, removeInitialSlash, removeTrailingSlash, resolveArrayProperties, resolveCollectionPathIds, resolveCollectionRelations, resolveDataSource, resolveDefaultSelectedView, resolveEnumValues, resolveFilterOperators, resolveProperties, resolveProperty, resolvePropertyEnum, resolvePropertyRelation, resolveRelationProperty, resolveStorageFilenameString, resolveStoragePathString, resolveStorageSource, sanitizeData, sanitizeRelation, securityRuleToConditions, segmentsToStrippedPath, serializeFilter, serializeLogicalCondition, serializeOrderBy, sortProperties, stripCollectionPath, traverseValueProperty, traverseValuesProperties, updateDateAutoValues, wrapAsEntityData, wrapAsSdkData };
 
 //# sourceMappingURL=index.es.js.map