@rebasepro/common 0.7.0 → 0.9.0

package/dist/index.umd.js

@@ -83,7 +83,7 @@
 		else return null;
 	}
 	/**
-	* Update the automatic values in an entity before save
+	* Update the automatic values in a entity before save
 	* @group Driver
 	*/
 	function updateDateAutoValues({ inputValues, properties, status, timestampNowValue }) {
@@ -95,7 +95,7 @@
 		}) ?? {};
 	}
 	/**
-	* Add missing required fields, expected in the collection, to the values of an entity
+	* Add missing required fields, expected in the collection, to the values of a entity
 	* @param values
 	* @param properties
 	* @group Driver
@@ -265,7 +265,7 @@
 		return collection.localChangesBackup;
 	}
 	/**
-	* Returns the primary keys for an entity collection by inspecting the properties
+	* Returns the primary keys for a entity collection by inspecting the properties
 	* and finding any properties with `isId`.
 	* Fallbacks to `["id"]` if no properties are marked as `isId: true`.
 	* @param collection
@@ -365,7 +365,7 @@
 				if (!newRelation.foreignKeyOnTarget) {
 					let foundForeignKey = false;
 					try {
-						const targetRelations = (0, _rebasepro_types.getDataSourceCapabilities)(targetCollection.driver).supportsRelations ? targetCollection.relations || [] : [];
+						const targetRelations = (0, _rebasepro_types.getDataSourceCapabilities)(targetCollection.engine).supportsRelations ? targetCollection.relations || [] : [];
 						for (const targetRel of targetRelations) if (targetRel.direction === "owning" && targetRel.cardinality === "one" && targetRel.localKey) try {
 							if (targetRel.target().slug === sourceCollection.slug) {
 								newRelation.foreignKeyOnTarget = targetRel.localKey;
@@ -381,7 +381,7 @@
 			} else if (newRelation.cardinality === "many" && newRelation.direction === "inverse") {
 				let isManyToManyInverse = false;
 				if (newRelation.inverseRelationName && !newRelation.foreignKeyOnTarget) try {
-					const targetRelations = (0, _rebasepro_types.getDataSourceCapabilities)(targetCollection.driver).supportsRelations ? targetCollection.relations || [] : [];
+					const targetRelations = (0, _rebasepro_types.getDataSourceCapabilities)(targetCollection.engine).supportsRelations ? targetCollection.relations || [] : [];
 					for (const targetRel of targetRelations) if (targetRel.cardinality === "many" && (targetRel.direction === "owning" || !targetRel.direction) && targetRel.relationName === newRelation.inverseRelationName) {
 						isManyToManyInverse = true;
 						break;
@@ -416,11 +416,10 @@
 	function resolveCollectionRelations(collection) {
 		const cached = _resolvedRelationsCache.get(collection);
 		if (cached) return cached;
-		if (!(0, _rebasepro_types.getDataSourceCapabilities)(collection.driver).supportsRelations) return {};
-		const relCollection = collection;
+		if (!(0, _rebasepro_types.getDataSourceCapabilities)(collection.engine).supportsRelations) return {};
 		const relations = {};
 		const registeredRelationNames = /* @__PURE__ */ new Set();
-		if (relCollection.relations) relCollection.relations.forEach((relation) => {
+		if (collection.relations) collection.relations.forEach((relation) => {
 			try {
 				const normalizedRelation = sanitizeRelation(relation, collection);
 				const relationKey = normalizedRelation.relationName;
@@ -467,7 +466,7 @@
 		console.warn(`Unrecognized or missing relation target for property '${propertyKey}' in collection '${sourceCollection.slug}'`);
 	}
 	function getTableName(collection) {
-		if ((0, _rebasepro_types.getDataSourceCapabilities)(collection.driver).supportsRelations) return collection.table ?? (0, _rebasepro_utils.toSnakeCase)(collection.slug) ?? (0, _rebasepro_utils.toSnakeCase)(collection.name);
+		if ((0, _rebasepro_types.getDataSourceCapabilities)(collection.engine).supportsRelations) return collection.table ?? (0, _rebasepro_utils.toSnakeCase)(collection.slug) ?? (0, _rebasepro_utils.toSnakeCase)(collection.name);
 		return (0, _rebasepro_utils.toSnakeCase)(collection.slug) ?? (0, _rebasepro_utils.toSnakeCase)(collection.name);
 	}
 	function getTableVarName(tableName) {
@@ -672,8 +671,9 @@
 	}
 	function getSubcollections(collection) {
 		if (collection.childCollections) return collection.childCollections() ?? [];
-		if ((0, _rebasepro_types.getDataSourceCapabilities)(collection.driver).supportsSubcollections && collection.subcollections) return collection.subcollections() ?? [];
-		if ((0, _rebasepro_types.getDataSourceCapabilities)(collection.driver).supportsRelations) {
+		const declaredSubcollections = (0, _rebasepro_types.getDeclaredSubcollections)(collection);
+		if ((0, _rebasepro_types.getDataSourceCapabilities)(collection.engine).supportsSubcollections && declaredSubcollections) return declaredSubcollections() ?? [];
+		if ((0, _rebasepro_types.getDataSourceCapabilities)(collection.engine).supportsRelations) {
 			const resolvedRelations = resolveCollectionRelations(collection);
 			return Object.values(resolvedRelations).filter((r) => r.cardinality === "many").map((r) => {
 				const target = r.target();
@@ -699,113 +699,379 @@
 		return [];
 	}
 	//#endregion
-	//#region src/util/permissions.ts
-	function evaluateAST(sqlString, auth, entity) {
-		if (!entity) return true;
-		let cleanedSQL = sqlString.trim();
-		while (cleanedSQL.startsWith("(") && cleanedSQL.endsWith(")")) {
-			let openCount = 0;
-			let isEnclosing = true;
-			for (let i = 0; i < cleanedSQL.length - 1; i++) {
-				if (cleanedSQL[i] === "(") openCount++;
-				else if (cleanedSQL[i] === ")") openCount--;
-				if (openCount === 0) {
-					isEnclosing = false;
-					break;
-				}
+	//#region src/util/policy/sqlToPolicy.ts
+	/**
+	* A tiny, regex-based SQL "parser" for security rules.
+	*
+	* This is NOT a full SQL parser. It is designed to handle the subset of SQL
+	* commonly used in `USING` and `WITH CHECK` clauses, enough to drive the
+	* optimistic client-side UI decision.
+	*
+	* It handles:
+	* - `field = 'literal'`
+	* - `field != 'literal'`
+	* - `field = current_setting('app.user_id')`
+	* - `A AND B`
+	* - `true`
+	* - `IN (...)` (as optimistic true)
+	*
+	* For anything it doesn't understand, it returns a `raw` expression, which
+	* the evaluator treats as "unknown" (and usually optimistic true).
+	*/
+	function sqlToPolicy(sql) {
+		const trimmed = sql.trim();
+		if (trimmed.toLowerCase() === "true") return _rebasepro_types.policy.true();
+		if (trimmed.toLowerCase() === "false") return _rebasepro_types.policy.false();
+		const overlapMatch = trimmed.match(/^string_to_array\s*\(\s*auth\.roles\(\)\s*,\s*','\s*\)\s*&&\s*ARRAY\s*\[(.+)\]$/i);
+		if (overlapMatch) {
+			const roles = overlapMatch[1].split(",").map((s) => s.trim().replace(/^'|'$/g, ""));
+			return _rebasepro_types.policy.rolesOverlap(roles);
+		}
+		const containMatch = trimmed.match(/^string_to_array\s*\(\s*auth\.roles\(\)\s*,\s*','\s*\)\s*@>\s*ARRAY\s*\[(.+)\]$/i);
+		if (containMatch) {
+			const roles = containMatch[1].split(",").map((s) => s.trim().replace(/^'|'$/g, ""));
+			return _rebasepro_types.policy.rolesContain(roles);
+		}
+		if (trimmed.toUpperCase().includes(" OR ")) {
+			const parts = trimmed.split(/ OR /i);
+			return _rebasepro_types.policy.or(...parts.map(sqlToPolicy));
+		}
+		if (trimmed.toUpperCase().includes(" AND ")) {
+			const parts = trimmed.split(/ AND /i);
+			return _rebasepro_types.policy.and(...parts.map(sqlToPolicy));
+		}
+		const match = trimmed.match(/^(.+?)\s*(!?=)\s*(.+)$/);
+		if (match) {
+			const [, leftStr, op, rightStr] = match;
+			const left = parseOperand(leftStr.trim());
+			const right = parseOperand(rightStr.trim());
+			if (left && right) return _rebasepro_types.policy.compare(left, op === "=" ? "eq" : "neq", right);
+		}
+		return _rebasepro_types.policy.raw(sql);
+	}
+	function parseOperand(str) {
+		if (/current_setting\s*\(\s*'app\.user_id'\s*\)/i.test(str) || /auth\.uid\(\)/i.test(str)) return _rebasepro_types.policy.authUid();
+		const stringMatch = str.match(/^'(.+)'$/);
+		if (stringMatch) return _rebasepro_types.policy.literal(stringMatch[1]);
+		if (/^\w+$/.test(str)) return _rebasepro_types.policy.field(str);
+		return null;
+	}
+	//#endregion
+	//#region src/util/policy/securityRuleToConditions.ts
+	/**
+	* Desugars a {@link SecurityRule} — its `access`/`ownerField`/`roles` shortcuts,
+	* structured `condition`/`check`, and raw `using`/`withCheck` — into a single
+	* normalized {@link PolicyExpression} pair.
+	*
+	* **This is the linchpin against drift:** both the Postgres DDL generators and
+	* the client-side evaluator consume this one function, so there is exactly one
+	* definition of what a rule means. In particular, application `roles` are folded
+	* into the expression here (AND'd with the base condition, matching how Postgres
+	* generates the clause) rather than being handled separately by each consumer.
+	*/
+	function securityRuleToConditions(rule) {
+		return {
+			usingExpr: withRoles(baseUsing(rule), rule),
+			withCheckExpr: withRoles(baseWithCheck(rule), rule)
+		};
+	}
+	function baseUsing(rule) {
+		if (rule.condition) return rule.condition;
+		if (rule.using != null) return sqlToPolicy(rule.using);
+		if (rule.access === "public") return _rebasepro_types.policy.true();
+		if (rule.ownerField) return _rebasepro_types.policy.compare(_rebasepro_types.policy.field(rule.ownerField), "eq", _rebasepro_types.policy.authUid());
+		return null;
+	}
+	function baseWithCheck(rule) {
+		if (rule.check) return rule.check;
+		if (rule.withCheck != null) return sqlToPolicy(rule.withCheck);
+		return baseUsing(rule);
+	}
+	/**
+	* AND the base condition with an application-role check, or produce a roles-only
+	* condition when there is no base. Mirrors the Postgres generator so that a
+	* role-scoped restrictive rule denies exactly the same set of users on both
+	* sides.
+	*/
+	function withRoles(base, rule) {
+		if (!rule.roles || rule.roles.length === 0) return base;
+		const rolesExpr = _rebasepro_types.policy.rolesOverlap(rule.roles);
+		if (rule.mode === "restrictive") return base ? _rebasepro_types.policy.or(_rebasepro_types.policy.not(rolesExpr), base) : _rebasepro_types.policy.not(rolesExpr);
+		return base ? _rebasepro_types.policy.and(base, rolesExpr) : rolesExpr;
+	}
+	//#endregion
+	//#region src/util/policy/policyToPostgres.ts
+	/**
+	* Compiles a {@link PolicyExpression} to a PostgreSQL boolean SQL string,
+	* suitable for a `USING (...)` / `WITH CHECK (...)` clause.
+	*
+	* This is one of the two consumers of the shared policy model (the other being
+	* {@link evaluatePolicy}); the Postgres schema generators call it so that DDL
+	* and the admin UI derive from the exact same expression.
+	*/
+	function policyToPostgres(expr, collection, options) {
+		return compile(expr, {
+			fieldCollection: collection,
+			fieldPrefix: "",
+			outerCollection: collection,
+			outerPrefix: "",
+			resolveCollection: options?.resolveCollection,
+			alias: { n: 0 }
+		});
+	}
+	function compile(expr, scope) {
+		switch (expr.kind) {
+			case "true": return "true";
+			case "false": return "false";
+			case "and": return expr.operands.length === 0 ? "true" : expr.operands.map((o) => `(${compile(o, scope)})`).join(" AND ");
+			case "or": return expr.operands.length === 0 ? "false" : expr.operands.map((o) => `(${compile(o, scope)})`).join(" OR ");
+			case "not":
+				if (expr.operand.kind === "authenticated") return "auth.uid() IS NULL";
+				return `NOT (${compile(expr.operand, scope)})`;
+			case "compare": return `${operandToSql(expr.left, scope)} ${COMPARE_SQL[expr.op]} ${operandToSql(expr.right, scope)}`;
+			case "rolesOverlap": return `string_to_array(auth.roles(), ',') && ${rolesArraySql(expr.roles)}`;
+			case "rolesContain": return `string_to_array(auth.roles(), ',') @> ${rolesArraySql(expr.roles)}`;
+			case "authenticated": return "auth.uid() IS NOT NULL";
+			case "existsIn": return compileExistsIn(expr, scope);
+			case "raw": return expr.sql.replace(/\{(\w+)\}/g, (_, col) => col);
+		}
+	}
+	/**
+	* Compiles `existsIn` to a correlated `EXISTS (SELECT 1 FROM <join> WHERE ...)`.
+	* Inside the subquery, `field` operands bind to the aliased join table and
+	* `outerField` operands bind to the (table-qualified) outer RLS row.
+	*/
+	function compileExistsIn(expr, scope) {
+		const join = scope.resolveCollection?.(expr.collection);
+		const joinTable = join ? getTableName(join) : (0, _rebasepro_utils.toSnakeCase)(expr.collection);
+		const joinSchema = schemaOf(join) ?? schemaOf(scope.outerCollection) ?? "public";
+		const alias = `_ex${scope.alias.n++}`;
+		const outerTable = scope.outerCollection ? getTableName(scope.outerCollection) : void 0;
+		const outerSchema = schemaOf(scope.outerCollection) ?? "public";
+		const outerPrefix = outerTable ? `"${outerSchema}"."${outerTable}".` : "";
+		const innerScope = {
+			fieldCollection: join,
+			fieldPrefix: `"${alias}".`,
+			outerCollection: scope.outerCollection,
+			outerPrefix,
+			resolveCollection: scope.resolveCollection,
+			alias: scope.alias
+		};
+		return `EXISTS (SELECT 1 FROM "${joinSchema}"."${joinTable}" "${alias}" WHERE ${compile(expr.where, innerScope)})`;
+	}
+	var COMPARE_SQL = {
+		eq: "=",
+		neq: "!=",
+		lt: "<",
+		lte: "<=",
+		gt: ">",
+		gte: ">="
+	};
+	function operandToSql(operand, scope) {
+		switch (operand.kind) {
+			case "field": return `${scope.fieldPrefix}${resolveColumnName(operand.name, scope.fieldCollection)}`;
+			case "outerField": return `${scope.outerPrefix}${resolveColumnName(operand.name, scope.outerCollection)}`;
+			case "literal": return quoteLiteral(operand.value);
+			case "authUid": return "auth.uid()";
+			case "authRoles": return "string_to_array(auth.roles(), ',')";
+		}
+	}
+	function schemaOf(collection) {
+		return collection?.schema || void 0;
+	}
+	function resolveColumnName(propName, collection) {
+		const prop = collection?.properties?.[propName];
+		if (prop && "columnName" in prop && typeof prop.columnName === "string") return prop.columnName;
+		return (0, _rebasepro_utils.toSnakeCase)(propName);
+	}
+	function quoteLiteral(value) {
+		if (value === null) return "NULL";
+		if (typeof value === "boolean") return value ? "true" : "false";
+		if (typeof value === "number") return String(value);
+		return `'${value.replace(/'/g, "''")}'`;
+	}
+	/** Sorted, single-quoted `ARRAY['a','b']` — matches the generators' output. */
+	function rolesArraySql(roles) {
+		return `ARRAY[${[...roles].sort().map((r) => `'${r}'`).join(",")}]`;
+	}
+	//#endregion
+	//#region src/util/policy/evaluatePolicy.ts
+	/**
+	* Evaluates a {@link PolicyExpression} against a user + row, using three-valued
+	* (Kleene) logic so that `"unknown"` sub-results propagate soundly.
+	*
+	* This is the JavaScript twin of {@link policyToPostgres}: both derive from the
+	* same expression, so the admin UI matches database enforcement by construction
+	* for every non-raw rule.
+	*/
+	function evaluatePolicy(expr, ctx) {
+		switch (expr.kind) {
+			case "true": return true;
+			case "false": return false;
+			case "and": return kleeneAnd$1(expr.operands.map((o) => evaluatePolicy(o, ctx)));
+			case "or": return kleeneOr(expr.operands.map((o) => evaluatePolicy(o, ctx)));
+			case "not": return kleeneNot(evaluatePolicy(expr.operand, ctx));
+			case "compare": return evaluateCompare(expr.op, expr.left, expr.right, ctx);
+			case "rolesOverlap": {
+				const userRoles = ctx.roles ?? [];
+				return expr.roles.some((r) => r === "public" || userRoles.includes(r));
 			}
-			if (isEnclosing) cleanedSQL = cleanedSQL.substring(1, cleanedSQL.length - 1).trim();
-			else break;
-		}
-		const splitByTopLevel = (str, delimiter) => {
-			const parts = [];
-			let current = "";
-			let openCount = 0;
-			let i = 0;
-			while (i < str.length) {
-				if (str[i] === "(") openCount++;
-				else if (str[i] === ")") openCount--;
-				if (openCount === 0 && str.substring(i).toUpperCase().startsWith(delimiter)) {
-					parts.push(current);
-					current = "";
-					i += delimiter.length;
-				} else {
-					current += str[i];
-					i++;
-				}
+			case "rolesContain": {
+				const userRoles = ctx.roles ?? [];
+				return expr.roles.every((r) => r === "public" || userRoles.includes(r));
 			}
-			parts.push(current);
-			return parts;
-		};
-		const orParts = splitByTopLevel(cleanedSQL, " OR ");
-		if (orParts.length > 1) return orParts.some((part) => evaluateAST(part, auth, entity));
-		const andParts = splitByTopLevel(cleanedSQL, " AND ");
-		if (andParts.length > 1) return andParts.every((part) => evaluateAST(part, auth, entity));
-		const upperSQL = cleanedSQL.toUpperCase();
-		if (upperSQL.includes(" IN ") || upperSQL.includes(" EXISTS ")) return true;
-		const roleIntersectMatch = cleanedSQL.match(/string_to_array\s*\(\s*auth\.roles\(\)\s*,\s*','\s*\)\s*&&\s*ARRAY\[(.*?)\]/i);
-		if (roleIntersectMatch && roleIntersectMatch[1]) {
-			const requiredRoles = roleIntersectMatch[1].split(",").map((r) => r.trim().replace(/'/g, ""));
-			const userRoles = auth.user?.roles || [];
-			return requiredRoles.some((r) => userRoles.includes(r));
-		}
-		const roleContainMatch = cleanedSQL.match(/string_to_array\s*\(\s*auth\.roles\(\)\s*,\s*','\s*\)\s*@>\s*ARRAY\[(.*?)\]/i);
-		if (roleContainMatch && roleContainMatch[1]) {
-			const requiredRoles = roleContainMatch[1].split(",").map((r) => r.trim().replace(/'/g, ""));
-			const userRoles = auth.user?.roles || [];
-			return requiredRoles.every((r) => userRoles.includes(r));
-		}
-		const pattern1 = /* @__PURE__ */ new RegExp("^\\{?([a-zA-Z0-9_]+)\\}?\\s*=\\s*(?:current_setting\\s*\\(\\s*'app\\.user_id'\\s*\\)|auth\\.uid\\(\\))");
-		const pattern2 = /* @__PURE__ */ new RegExp("^(?:current_setting\\s*\\(\\s*'app\\.user_id'\\s*\\)|auth\\.uid\\(\\))\\s*=\\s*\\{?([a-zA-Z0-9_]+)\\}?");
-		const match1 = cleanedSQL.match(pattern1);
-		if (match1 && match1[1]) return entity.values[match1[1]] === auth.user?.uid;
-		const match2 = cleanedSQL.match(pattern2);
-		if (match2 && match2[1]) return entity.values[match2[1]] === auth.user?.uid;
-		const simpleEqualityMatch = cleanedSQL.match(/^\{?([\w_]+)\}?\s*(=|!=)\s*'([^']+)'$/i);
-		if (simpleEqualityMatch) {
-			const field = simpleEqualityMatch[1];
-			const operator = simpleEqualityMatch[2];
-			const value = simpleEqualityMatch[3];
-			const entityValue = entity.values[field];
-			if (operator === "=") return entityValue === value;
-			if (operator === "!=") return entityValue !== value;
+			case "authenticated": return ctx.uid != null;
+			case "existsIn": return "unknown";
+			case "raw": return "unknown";
 		}
+	}
+	function kleeneAnd$1(values) {
+		if (values.some((v) => v === false)) return false;
+		if (values.some((v) => v === "unknown")) return "unknown";
 		return true;
 	}
-	function evaluateRule(rule, auth, entity) {
-		if (rule.access === "public") return true;
-		if (rule.ownerField) {
-			if (!entity) {} else if (entity.values[rule.ownerField] !== auth.user?.uid) return false;
-		}
-		if (rule.using && !evaluateAST(rule.using, auth, entity)) return false;
-		if (rule.withCheck && !evaluateAST(rule.withCheck, auth, entity)) return false;
+	function kleeneOr(values) {
+		if (values.some((v) => v === true)) return true;
+		if (values.some((v) => v === "unknown")) return "unknown";
+		return false;
+	}
+	function kleeneNot(value) {
+		if (value === "unknown") return "unknown";
+		return !value;
+	}
+	function resolveOperand(operand, ctx) {
+		switch (operand.kind) {
+			case "literal": return {
+				known: true,
+				value: operand.value
+			};
+			case "authUid": return {
+				known: true,
+				value: ctx.uid ?? null
+			};
+			case "authRoles": return {
+				known: true,
+				value: ctx.roles ?? []
+			};
+			case "field":
+				if (!ctx.entity) return { known: false };
+				return {
+					known: true,
+					value: ctx.entity.values[operand.name]
+				};
+			case "outerField": return { known: false };
+		}
+	}
+	function evaluateCompare(op, left, right, ctx) {
+		const l = resolveOperand(left, ctx);
+		const r = resolveOperand(right, ctx);
+		if (!l.known || !r.known) return "unknown";
+		const a = l.value;
+		const b = r.value;
+		if (a === null || b === null) {
+			if (op === "eq") return false;
+			if (op === "neq") return true;
+			return "unknown";
+		}
+		if (op === "eq") return a === b;
+		if (op === "neq") return a !== b;
+		if (typeof a === "string" && typeof b === "string") {
+			if (op === "lt") return a < b;
+			if (op === "lte") return a <= b;
+			if (op === "gt") return a > b;
+			if (op === "gte") return a >= b;
+		}
+		if (typeof a === "number" && typeof b === "number") {
+			if (op === "lt") return a < b;
+			if (op === "lte") return a <= b;
+			if (op === "gt") return a > b;
+			if (op === "gte") return a >= b;
+		}
+		if (typeof a === "bigint" && typeof b === "bigint") {
+			if (op === "lt") return a < b;
+			if (op === "lte") return a <= b;
+			if (op === "gt") return a > b;
+			if (op === "gte") return a >= b;
+		}
+		return "unknown";
+	}
+	//#endregion
+	//#region src/util/permissions.ts
+	/** Combine clause results with AND under three-valued (Kleene) logic. */
+	function kleeneAnd(values) {
+		if (values.some((v) => v === false)) return false;
+		if (values.some((v) => v === "unknown")) return "unknown";
 		return true;
 	}
-	function checkOperation(collection, authContext, entity, targetOperation) {
-		const securityRules = (0, _rebasepro_types.getDataSourceCapabilities)(collection.driver).supportsRLS ? collection.securityRules : void 0;
+	/** The operations a rule covers, mirroring the Postgres generator's resolution. */
+	function ruleOperations(rule) {
+		return rule.operations && rule.operations.length > 0 ? rule.operations : [rule.operation ?? "all"];
+	}
+	function ruleApplies(rule, targetOperation) {
+		const ops = ruleOperations(rule);
+		return ops.includes(targetOperation) || ops.includes("all");
+	}
+	/**
+	* Evaluate a single rule for one operation, returning a tri-state.
+	*
+	* A `null` clause (the rule contributes no condition for a required clause)
+	* denies — matching Postgres, which emits `USING (false)` / `WITH CHECK (false)`
+	* in that case. USING applies to SELECT/UPDATE/DELETE; WITH CHECK to
+	* INSERT/UPDATE; both must pass for UPDATE.
+	*/
+	function evaluateRuleForOperation(rule, ctx, targetOperation) {
+		const { usingExpr, withCheckExpr } = securityRuleToConditions(rule);
+		const clause = (expr) => expr === null ? false : evaluatePolicy(expr, ctx);
+		const needsUsing = targetOperation !== "insert";
+		const needsWithCheck = targetOperation === "insert" || targetOperation === "update";
+		const results = [];
+		if (needsUsing) results.push(clause(usingExpr));
+		if (needsWithCheck) results.push(clause(withCheckExpr));
+		return kleeneAnd(results);
+	}
+	function resolveTriState(value, onUnknown) {
+		if (value === "unknown") return onUnknown === "allow";
+		return value;
+	}
+	/**
+	* Decide whether an operation is permitted for a user on a (possibly null) row,
+	* by evaluating the collection's security rules with the shared policy model —
+	* the same model compiled to Postgres RLS DDL, so the decision matches database
+	* enforcement for every non-raw rule.
+	*
+	* @param options.onUnknown how to treat rules that cannot be decided
+	*   client-side (raw SQL, or row predicates with no row). Defaults to `"allow"`
+	*   for optimistic UI gating; enforcement callers should pass `"deny"`.
+	*/
+	function checkOperation(collection, authContext, entity, targetOperation, options) {
+		const onUnknown = options?.onUnknown ?? "allow";
+		const securityRules = (0, _rebasepro_types.getDataSourceCapabilities)(collection.engine).supportsRLS ? collection.securityRules : void 0;
 		if (!securityRules || securityRules.length === 0) return true;
-		const applicableRules = securityRules.filter((r) => r.operation === targetOperation || r.operation === "all" || r.operations?.includes(targetOperation) || r.operations?.includes("all"));
+		const applicableRules = securityRules.filter((r) => ruleApplies(r, targetOperation));
 		if (applicableRules.length === 0) return false;
-		const userRoles = [...authContext.user?.roles ?? [], "public"];
-		const roleApplicableRules = applicableRules.filter((rule) => {
-			if (!rule.roles || rule.roles.length === 0) return true;
-			return rule.roles.some((r) => userRoles.includes(r));
-		});
-		if (roleApplicableRules.length === 0) return false;
+		const ctx = {
+			uid: authContext.user?.uid,
+			roles: authContext.user?.roles ?? [],
+			entity
+		};
 		let grantedByPermissive = false;
 		let deniedByRestrictive = false;
-		for (const rule of roleApplicableRules) {
+		let hasPermissive = false;
+		for (const rule of applicableRules) {
 			const mode = rule.mode || "permissive";
-			const passed = evaluateRule(rule, authContext, entity);
-			if (mode === "restrictive" && !passed) {
-				deniedByRestrictive = true;
-				break;
+			const passed = resolveTriState(evaluateRuleForOperation(rule, ctx, targetOperation), onUnknown);
+			if (mode === "restrictive") {
+				if (!passed) {
+					deniedByRestrictive = true;
+					break;
+				}
+			} else {
+				hasPermissive = true;
+				if (passed) grantedByPermissive = true;
 			}
-			if (mode === "permissive" && passed) grantedByPermissive = true;
 		}
 		if (deniedByRestrictive) return false;
-		if (roleApplicableRules.some((r) => (r.mode || "permissive") === "permissive")) return grantedByPermissive;
-		else return false;
+		return hasPermissive ? grantedByPermissive : false;
 	}
 	function canReadCollection(collection, authContext) {
 		return checkOperation(collection, authContext, null, "select");
@@ -836,7 +1102,7 @@
 		}
 		for (const key in collection.properties) {
 			const property = collection.properties[key];
-			if (property.type === "array" && property.of && !Array.isArray(property.of) && property.of.type === "string" && property.of.url === "image") return key;
+			if (property.type === "array" && property.of && !Array.isArray(property.of) && property.of.type === "string" && property.of.ui?.url === "image") return key;
 		}
 		for (const key in collection.properties) {
 			const property = collection.properties[key];
@@ -905,7 +1171,7 @@
 				} else {
 					entityId = remainingPath;
 					remainingPath = "";
-					console.warn(`resolveCollectionPathIds: Path seems to end with an entity ID "${entityId}" instead of a collection segment in original path "${path}". This might indicate an invalid input path.`);
+					console.warn(`resolveCollectionPathIds: Path seems to end with a entity ID "${entityId}" instead of a collection segment in original path "${path}". This might indicate an invalid input path.`);
 				}
 				resolvedPathParts.push(entityId);
 				currentCollections = getSubcollections(foundCollection);
@@ -1061,79 +1327,60 @@
 	//#endregion
 	//#region src/util/builders.ts
 	/**
-	* Identity function we use to defeat the type system of Typescript and build
-	* collection views with all its properties
-	* @param collection
+	* @deprecated Use {@link defineCollection} instead — it infers property
+	* types automatically (autocomplete on `titleProperty`, `sort`,
+	* `propertiesOrder`, callbacks) without manual generics.
+	* `buildCollection` is kept for FireCMS migration compatibility and will
+	* be removed before 1.0.
+	*
 	* @group Builder
 	*/
 	function buildCollection(collection) {
 		return collection;
 	}
 	/**
-	* Identity function we use to defeat the type system of Typescript and preserve
-	* the property keys.
-	* @param property
-	* @group Builder
-	*/
-	function buildProperty(property) {
-		return property;
-	}
-	/**
-	* Identity function we use to defeat the type system of Typescript and preserve
-	* the properties keys.
-	* @param properties
-	* @group Builder
-	*/
-	function buildProperties(properties) {
-		return properties;
-	}
-	/**
-	* Identity function we use to defeat the type system of Typescript and preserve
-	* the properties keys.
-	* @param propertiesOrBuilder
-	* @group Builder
-	*/
-	function buildPropertiesOrBuilder(propertiesOrBuilder) {
-		return propertiesOrBuilder;
-	}
-	/**
-	* Identity function we use to defeat the type system of Typescript and preserve
-	* the properties keys.
-	* @param enumValues
-	* @group Builder
-	*/
-	function buildEnum(enumValues) {
-		return enumValues;
-	}
-	/**
-	* Identity function we use to defeat the type system of Typescript and preserve
-	* the properties keys.
-	* @param enumValueConfig
-	* @group Builder
+	* Implementation — delegates to the correct overload at the type level.
+	* At runtime this is a plain identity function.
 	*/
-	function buildEnumValueConfig(enumValueConfig) {
-		return enumValueConfig;
+	function defineCollection(collection) {
+		return collection;
 	}
 	/**
-	* Identity function we use to defeat the type system of Typescript and preserve
-	* the properties keys.
-	* @param callbacks
+	* @deprecated Use plain typed property objects with {@link defineCollection}
+	* instead — `defineCollection` infers property types automatically, making
+	* this wrapper unnecessary. `buildProperty` is kept for FireCMS migration
+	* compatibility and will be removed before 1.0.
+	*
 	* @group Builder
 	*/
-	function buildEntityCallbacks(callbacks) {
-		return callbacks;
+	function buildProperty(property) {
+		return property;
 	}
+	//#endregion
+	//#region src/util/storage.ts
 	/**
-	* Identity function we use to defeat the type system of Typescript and build
-	* additional field delegates views with all its properties
-	* @param additionalFieldDelegate
-	* @group Builder
+	* Resolve the {@link StorageSource} to use for a property, given the key
+	* referenced by `StorageConfig.storageSource`.
+	*
+	* Resolution priority:
+	* 1. No `sourceKey` → the default source (backward compatible).
+	* 2. An explicit {@link StorageSourceRegistry} (e.g. `client.storageRegistry`).
+	* 3. A `sources` lookup map (e.g. the `StorageSourcesContext`).
+	* 4. Fall back to the default source.
+	*
+	* Shared by the upload hook, the markdown editor, and the read-only previews
+	* so the resolution logic lives in one place.
+	*
+	* @group Storage
 	*/
-	function buildAdditionalFieldDelegate(additionalFieldDelegate) {
-		return additionalFieldDelegate;
+	function resolveStorageSource(params) {
+		const { sourceKey, sources, registry, defaultSource } = params;
+		if (!sourceKey) return defaultSource;
+		if (registry) return registry.getOrDefault(sourceKey);
+		const fromSources = sources?.[sourceKey];
+		if (fromSources) return fromSources;
+		return defaultSource;
 	}
-	//#endregion
-	//#region src/util/storage.ts
 	async function resolveStorageFilenameString({ input, storage, values, entityId, path, property, file, propertyKey }) {
 		let result;
 		if (typeof input === "function") {
@@ -1244,16 +1491,17 @@
 	}
 	/**
 	* Helper function to extract field-level PropertyCallbacks from a properties schema
-	* and wrap them into an EntityCallbacks object recursively.
+	* and wrap them into an CollectionCallbacks object recursively.
 	*/
 	var buildPropertyCallbacks = (properties) => {
 		if (!properties) return void 0;
 		const propertyCallbacks = {};
 		if (hasPropertyCallbacks(properties, "afterRead")) propertyCallbacks.afterRead = async (props) => {
-			const processedValues = await processProperties(properties, props.entity.values, props.entity.values, props, "afterRead");
+			const row = props.row;
+			const processedValues = await processProperties(properties, row, row, props, "afterRead");
 			return {
-				...props.entity,
-				values: processedValues
+				...props.row,
+				...processedValues
 			};
 		};
 		if (hasPropertyCallbacks(properties, "beforeSave")) propertyCallbacks.beforeSave = async (props) => {
@@ -1440,6 +1688,84 @@
 		return result;
 	}
 	//#endregion
+	//#region src/util/filter-operator-resolution.ts
+	/**
+	* Default operators offered per property type, before engine capabilities and
+	* per-property narrowing are applied. These mirror what the built-in filter
+	* fields can render.
+	*/
+	var COMPARISON_OPS = [
+		"==",
+		"!=",
+		">",
+		">=",
+		"<",
+		"<="
+	];
+	var NULL_CHECK_OPS = ["is-null", "is-not-null"];
+	var MEMBERSHIP_OPS = ["in", "not-in"];
+	var PATTERN_OPS = [
+		"like",
+		"ilike",
+		"not-like",
+		"not-ilike"
+	];
+	var DEFAULT_OPS_BY_TYPE = {
+		string: [
+			...COMPARISON_OPS,
+			...MEMBERSHIP_OPS,
+			...PATTERN_OPS,
+			...NULL_CHECK_OPS
+		],
+		number: [
+			...COMPARISON_OPS,
+			...MEMBERSHIP_OPS,
+			...NULL_CHECK_OPS
+		],
+		date: [...COMPARISON_OPS, ...NULL_CHECK_OPS],
+		boolean: [
+			"==",
+			"!=",
+			...NULL_CHECK_OPS
+		],
+		reference: [
+			"==",
+			"!=",
+			...MEMBERSHIP_OPS,
+			...NULL_CHECK_OPS
+		],
+		relation: [
+			"==",
+			"!=",
+			...MEMBERSHIP_OPS,
+			...NULL_CHECK_OPS
+		]
+	};
+	/** Operators offered when the property is an *array of* a filterable type. */
+	var ARRAY_OPS = ["array-contains", "array-contains-any"];
+	/**
+	* Resolve which filter operators the UI should offer for a property.
+	*
+	* The result is the **intersection** of three sets:
+	* 1. what the engine can execute — {@link DataSourceCapabilities.filterOperators}
+	*    (e.g. Firestore cannot run the LIKE family);
+	* 2. what makes sense for the property type (e.g. no `>` on booleans);
+	* 3. the developer's optional narrowing — `property.ui.filterOperators`.
+	*
+	* Returns an empty array when the property is not filterable (either by
+	* type, or because the developer disabled it with `filterOperators: []`).
+	*
+	* @group Models
+	*/
+	function resolveFilterOperators({ property, isArray, engine }) {
+		const typeDefaults = isArray ? ARRAY_OPS : DEFAULT_OPS_BY_TYPE[property.type] ?? [];
+		if (typeDefaults.length === 0) return [];
+		const engineOps = new Set((0, _rebasepro_types.getDataSourceCapabilities)(engine).filterOperators ?? _rebasepro_types.ALL_WHERE_FILTER_OPS);
+		const narrowing = property.ui?.filterOperators;
+		const narrowingSet = narrowing !== void 0 ? new Set(narrowing) : void 0;
+		return typeDefaults.filter((op) => engineOps.has(op) && (narrowingSet === void 0 || narrowingSet.has(op)));
+	}
+	//#endregion
 	//#region src/data/resolveDataSource.ts
 	/**
 	* Build a keyed registry from a list of {@link DataSourceDefinition}s.
@@ -1456,13 +1782,13 @@
 	* editor's capability lookups.
 	*
 	* Resolution order:
-	* 1. The routing **key** is `collection.dataSource`, else the legacy
-	*    `collection.driver`, else {@link DEFAULT_DATA_SOURCE_KEY}.
+	* 1. The routing **key** is `collection.dataSource`, else
+	*    {@link DEFAULT_DATA_SOURCE_KEY}.
 	* 2. If a definition is registered for that key, it provides `engine`,
 	*    `transport`, and `databaseId`.
-	* 3. Otherwise values are synthesized for backward compatibility: `engine`
-	*    from the legacy `driver` (or the key, or `"postgres"`), `transport`
-	*    defaults to `"server"`, and `databaseId` from the collection.
+	* 3. Otherwise values are synthesized: `engine` from `collection.engine`
+	*    (or the key, or `"postgres"`), `transport` defaults to `"server"`,
+	*    and `databaseId` from the collection.
 	*
 	* `capabilities` are always derived from the resolved `engine`, so two
 	* data sources sharing an engine share capabilities.
@@ -1471,9 +1797,9 @@
 	* @param registry   optional registry of declared data sources
 	*/
 	function resolveDataSource(collection, registry) {
-		const key = collection?.dataSource ?? collection?.driver ?? _rebasepro_types.DEFAULT_DATA_SOURCE_KEY;
+		const key = collection?.dataSource ?? _rebasepro_types.DEFAULT_DATA_SOURCE_KEY;
 		const def = registry?.[key];
-		const engine = def?.engine ?? collection?.driver ?? (key !== _rebasepro_types.DEFAULT_DATA_SOURCE_KEY ? key : "postgres");
+		const engine = def?.engine ?? collection?.engine ?? (key !== _rebasepro_types.DEFAULT_DATA_SOURCE_KEY ? key : "postgres");
 		return {
 			key,
 			engine,
@@ -1488,9 +1814,28 @@
 		/**
 		* Declared data sources, used during normalization to resolve each
 		* collection's engine (so `dataSource`-only collections get the right
-		* capabilities). Empty by default → behaviour keys off `driver` as before.
+		* capabilities). Empty by default.
 		*/
 		dataSources = {};
+		/**
+		* Global lifecycle callbacks applied to every collection.
+		* Runs on all data paths (REST, WebSocket, `rebase.data`).
+		* Execution order: global → collection → property callbacks.
+		*/
+		_globalCallbacks;
+		/**
+		* Set global lifecycle callbacks that apply to every collection.
+		* Typically called once during backend initialization.
+		*/
+		setGlobalCallbacks(callbacks) {
+			this._globalCallbacks = callbacks;
+		}
+		/**
+		* Get the currently registered global callbacks, if any.
+		*/
+		getGlobalCallbacks() {
+			return this._globalCallbacks;
+		}
 		collectionsByTableName = /* @__PURE__ */ new Map();
 		collectionsBySlug = /* @__PURE__ */ new Map();
 		rootCollections = [];
@@ -1499,7 +1844,7 @@
 		rawCollectionsBySlug = /* @__PURE__ */ new Map();
 		rawRootCollections = [];
 		cachedRawCollectionsList = null;
-		lastRawInputSnapshot = null;
+		lastRawInputEntity = null;
 		constructor(collections, dataSources) {
 			if (dataSources) this.dataSources = dataSources;
 			if (collections) this.registerMultiple(collections);
@@ -1529,12 +1874,12 @@
 		* Returns true if the collections have changed, false otherwise.
 		*
 		* Idempotent: compares the raw input (before normalization) against a stored
-		* snapshot. Only re-normalizes and re-registers when the raw input actually changed.
+		* entity. Only re-normalizes and re-registers when the raw input actually changed.
 		* @param collections
 		*/
 		registerMultiple(collections) {
-			const rawSnapshot = collections.map((c) => (0, _rebasepro_utils.removeFunctions)(c));
-			if (this.lastRawInputSnapshot && (0, fast_equals.deepEqual)(this.lastRawInputSnapshot, rawSnapshot)) return false;
+			const rawEntity = collections.map((c) => (0, _rebasepro_utils.removeFunctions)(c));
+			if (this.lastRawInputEntity && (0, fast_equals.deepEqual)(this.lastRawInputEntity, rawEntity)) return false;
 			this.reset();
 			collections.forEach((c) => {
 				if (c.slug) this.collectionsBySlug.set(c.slug, c);
@@ -1558,7 +1903,7 @@
 					this._registerRecursively(this.normalizeCollection({ ...subCollection }), (0, _rebasepro_utils.deepClone)(subCollection));
 				});
 			});
-			this.lastRawInputSnapshot = rawSnapshot;
+			this.lastRawInputEntity = rawEntity;
 			return true;
 		}
 		register(collection, rawCollection) {
@@ -1582,13 +1927,14 @@
 		}
 		normalizeCollection(collection) {
 			const result = { ...collection };
-			if (result.dataSource && !result.driver) {
-				const engine = resolveDataSource(result, this.dataSources).engine;
-				if (engine) result.driver = engine;
+			{
+				const resolved = resolveDataSource(result, this.dataSources);
+				if (!result.dataSource) result.dataSource = resolved.key;
+				if (!result.engine) result.engine = resolved.engine;
 			}
 			const extractedRelations = this.extractRelationsFromProperties(result.properties);
 			const relResult = result;
-			const manualRelations = (0, _rebasepro_types.getDataSourceCapabilities)(result.driver).supportsRelations ? relResult.relations ?? [] : [];
+			const manualRelations = (0, _rebasepro_types.getDataSourceCapabilities)(result.engine).supportsRelations ? relResult.relations ?? [] : [];
 			const mergedRelationsRaw = [...extractedRelations];
 			for (const manual of manualRelations) {
 				const name = manual.relationName;
@@ -1603,7 +1949,7 @@
 				}
 			}
 			let mergedRelations = mergedRelationsRaw;
-			if ((0, _rebasepro_types.getDataSourceCapabilities)(result.driver).supportsRelations) {
+			if ((0, _rebasepro_types.getDataSourceCapabilities)(result.engine).supportsRelations) {
 				mergedRelations = mergedRelationsRaw.map((r) => {
 					try {
 						return sanitizeRelation(r, result, (slug) => this.get(slug));
@@ -1615,8 +1961,10 @@
 			}
 			result.properties = this.normalizeProperties(result.properties, mergedRelations);
 			if (!result.childCollections) {
-				if ((0, _rebasepro_types.getDataSourceCapabilities)(result.driver).supportsSubcollections && result.subcollections) result.childCollections = result.subcollections;
-				else if ((0, _rebasepro_types.getDataSourceCapabilities)(result.driver).supportsRelations && relResult.relations) {
+				const capabilities = (0, _rebasepro_types.getDataSourceCapabilities)(result.engine);
+				const declaredSubcollections = (0, _rebasepro_types.getDeclaredSubcollections)(result);
+				if (capabilities.supportsSubcollections && declaredSubcollections) result.childCollections = declaredSubcollections;
+				else if (capabilities.supportsRelations && relResult.relations) {
 					const manyRelations = relResult.relations.filter((r) => r.cardinality === "many");
 					if (manyRelations.length > 0) result.childCollections = () => manyRelations.map((r) => {
 						const target = r.target();
@@ -1718,7 +2066,7 @@
 			if (!currentCollection) throw new Error(`Root collection not found: ${rootCollectionPath}`);
 			for (let i = 2; i < pathSegments.length; i += 2) {
 				const relationKey = pathSegments[i];
-				if (!(0, _rebasepro_types.getDataSourceCapabilities)(currentCollection.driver).supportsRelations) throw new Error(`Relation path navigation requires a collection that supports relations, but '${currentCollection.slug}' uses driver '${currentCollection.driver}'`);
+				if (!(0, _rebasepro_types.getDataSourceCapabilities)(currentCollection.engine).supportsRelations) throw new Error(`Relation path navigation requires a collection that supports relations, but '${currentCollection.slug}' uses engine '${currentCollection.engine}'`);
 				const relation = findRelation(resolveCollectionRelations(currentCollection), relationKey);
 				if (!relation) throw new Error(`Relation '${relationKey}' not found in collection '${currentCollection.slug}'`);
 				const target = relation.target();
@@ -1779,7 +2127,7 @@
 	* Slug-based dedup (Map keyed by slug, last-write-wins) lets developers
 	* override by defining their own collection with `slug: "users"`.
 	*/
-	var defaultUsersCollection = {
+	var defaultUsersCollection = defineCollection({
 		name: "Users",
 		singularName: "User",
 		slug: "users",
@@ -1827,7 +2175,7 @@
 				name: "Photo URL",
 				type: "string",
 				columnName: "photo_url",
-				url: "image"
+				ui: { url: "image" }
 			},
 			roles: {
 				name: "Roles",
@@ -1922,7 +2270,7 @@
 			"roles",
 			"createdAt"
 		]
-	};
+	});
 	//#endregion
 	//#region src/data/query_builder.ts
 	function or(...conditions) {
@@ -1974,8 +2322,8 @@
 		* @example
 		* client.collection('users').orderBy('createdAt', 'desc').find()
 		*/
-		orderBy(column, ascending = "asc") {
-			this.params.orderBy = `${column}:${ascending}`;
+		orderBy(column, direction = "asc") {
+			this.params.orderBy = [column, direction];
 			return this;
 		}
 		/**
@@ -2030,166 +2378,369 @@
 		}
 	};
 	//#endregion
-	//#region src/data/buildRebaseData.ts
+	//#region src/data/filter-dialect.ts
 	/**
-	* Convert where-clause filter object to the internal DataDriver FilterValues format.
-	*
-	* Supports multiple value formats:
-	* - PostgREST string: { status: "eq.published", age: "gte.18" }
-	* - Equality shorthand: { company_profile_id: null, status: "active", age: 18 }
-	* - Tuple syntax: { age: [">=", 18], role: ["in", ["admin", "editor"]] }
-	*
-	* Internal:  { status: ["==", "published"], age: [">=", 18] }
-	*/
-	function convertWhereToFilter(where) {
-		if (!where) return void 0;
-		const operatorMap = {
-			"eq": "==",
-			"neq": "!=",
-			"gt": ">",
-			"gte": ">=",
-			"lt": "<",
-			"lte": "<=",
-			"in": "in",
-			"nin": "not-in",
-			"not-in": "not-in",
-			"cs": "array-contains",
-			"csa": "array-contains-any",
-			"==": "==",
-			"!=": "!=",
-			">": ">",
-			">=": ">=",
-			"<": "<",
-			"<=": "<=",
-			"array-contains": "array-contains",
-			"array-contains-any": "array-contains-any"
-		};
-		const filter = {};
-		for (const [field, rawValue] of Object.entries(where)) {
-			if (rawValue === null) {
-				filter[field] = ["==", null];
-				continue;
-			}
-			if (typeof rawValue === "boolean") {
-				filter[field] = ["==", rawValue];
-				continue;
-			}
-			if (typeof rawValue === "number") {
-				filter[field] = ["==", rawValue];
+	* REST wire-format adapter for the unified filter system.
+	*
+	* This module is the ONLY code in the entire codebase that knows about
+	* PostgREST-style dot-syntax strings (`eq.active`, `gt.18`, `in.(a,b)`).
+	* Everything else speaks `FilterValues` exclusively.
+	*
+	* Wire-format values are always strings — the wire format carries no type
+	* metadata, so type coercion is the responsibility of the server-side data
+	* driver which has access to the collection schema.
+	*
+	* Commas inside list values are backslash-escaped (`\,`), and literal
+	* backslashes are escaped as `\\`.
+	*
+	* @module
+	*/
+	/**
+	* Serialize a JS value to its querystring representation.
+	* `null` is serialized as the literal string `"null"`.
+	*/
+	function stringifyValue(value) {
+		if (value === null) return "null";
+		return String(value);
+	}
+	/**
+	* Escape a single list item for the wire format.
+	* `\` → `\\`, `,` → `\,`
+	*/
+	function escapeListItem(value) {
+		return value.replace(/\\/g, "\\\\").replace(/,/g, "\\,");
+	}
+	/**
+	* Unescape a single list item from the wire format.
+	* `\\` → `\`, `\,` → `,`
+	*/
+	function unescapeListItem(value) {
+		let result = "";
+		for (let i = 0; i < value.length; i++) if (value[i] === "\\" && i + 1 < value.length) {
+			result += value[i + 1];
+			i++;
+		} else result += value[i];
+		return result;
+	}
+	/**
+	* Split a parenthesized list string on unescaped commas.
+	* Input is the content between `(` and `)`.
+	*
+	* @example
+	* splitListItems("admin,editor")          // ["admin", "editor"]
+	* splitListItems("hello\\, world,foo")    // ["hello, world", "foo"]
+	*/
+	function splitListItems(inner) {
+		const items = [];
+		let current = "";
+		for (let i = 0; i < inner.length; i++) if (inner[i] === "\\" && i + 1 < inner.length) {
+			current += inner[i] + inner[i + 1];
+			i++;
+		} else if (inner[i] === ",") {
+			items.push(unescapeListItem(current));
+			current = "";
+		} else current += inner[i];
+		items.push(unescapeListItem(current));
+		return items;
+	}
+	var REST_OP_LOOKUP = _rebasepro_types.REST_TO_CANONICAL;
+	var CANONICAL_OP_LOOKUP = _rebasepro_types.CANONICAL_TO_REST;
+	/**
+	* Serialize a single canonical condition tuple to a PostgREST dot-string.
+	*
+	* Throws `TypeError` if the input is not a valid `[WhereFilterOp, unknown]` tuple.
+	*
+	* @example
+	* serializeTuple(["==", "active"])           // "eq.active"
+	* serializeTuple(["in", ["admin","editor"]]) // "in.(admin,editor)"
+	* serializeTuple([">=", 18])                 // "gte.18"
+	*/
+	function serializeTuple(tuple) {
+		if (!Array.isArray(tuple) || tuple.length !== 2) throw new TypeError(`serializeTuple: expected a [WhereFilterOp, value] tuple, got ${JSON.stringify(tuple)}`);
+		const [op, value] = tuple;
+		if (typeof op !== "string") throw new TypeError(`serializeTuple: operator must be a string, got ${typeof op}`);
+		const restOp = CANONICAL_OP_LOOKUP[op];
+		if (!restOp) throw new TypeError(`serializeTuple: unknown operator "${op}". Valid operators: ${Object.keys(_rebasepro_types.CANONICAL_TO_REST).join(", ")}`);
+		if (Array.isArray(value)) return `${restOp}.(${value.map((v) => escapeListItem(stringifyValue(v))).join(",")})`;
+		return `${restOp}.${stringifyValue(value)}`;
+	}
+	/**
+	* Convert `FilterValues` (or `WireFilterValues`) to a PostgREST-style
+	* querystring record.
+	*
+	* - Canonical `[WhereFilterOp, value]` tuples are serialized strictly.
+	* - Pre-serialized PostgREST strings (e.g. `"eq.published"`) are passed through.
+	* - Single conditions produce a string value.
+	* - Multiple conditions on the same field produce a string array (repeated params).
+	*
+	* @example
+	* serializeFilter({ status: ["==", "active"] })
+	* // → { status: "eq.active" }
+	*
+	* serializeFilter({ age: [[">=", 18], ["<", 65]] })
+	* // → { age: ["gte.18", "lt.65"] }
+	*
+	* // Pre-serialized strings pass through unchanged:
+	* serializeFilter({ status: "eq.published" })
+	* // → { status: "eq.published" }
+	*/
+	function serializeFilter(filter) {
+		const result = {};
+		for (const [field, condition] of Object.entries(filter)) {
+			if (condition === void 0) continue;
+			if (typeof condition === "string") {
+				result[field] = condition;
 				continue;
 			}
-			if (Array.isArray(rawValue)) {
-				const mappedConditions = (Array.isArray(rawValue[0]) ? rawValue : [rawValue]).map(([rawOp, val]) => {
-					return [operatorMap[rawOp] ?? "==", val];
-				});
-				filter[field] = Array.isArray(rawValue[0]) ? mappedConditions : mappedConditions[0];
+			if (Array.isArray(condition) && condition.length > 0 && Array.isArray(condition[0])) result[field] = condition.map(serializeTuple);
+			else result[field] = serializeTuple(condition);
+		}
+		return result;
+	}
+	/**
+	* Parse a single PostgREST dot-string into a `[WhereFilterOp, unknown]` tuple.
+	*
+	* All values are returned as strings — the wire format carries no type
+	* metadata, so coercion is the data driver's responsibility.
+	*
+	* If the string doesn't match a known operator prefix, it falls back to
+	* `["==", originalString]` (treating the whole string as an equality value).
+	* This intentional defense handles values like `"user@host.com"` or
+	* `"1.2.3"` that happen to contain dots.
+	*/
+	function deserializeSingle(raw) {
+		const dotIndex = raw.indexOf(".");
+		if (dotIndex === -1) return ["==", raw];
+		const prefix = raw.substring(0, dotIndex);
+		const rest = raw.substring(dotIndex + 1);
+		const canonicalOp = REST_OP_LOOKUP[prefix];
+		if (!canonicalOp) return ["==", raw];
+		if (_rebasepro_types.NULL_OPS.has(canonicalOp)) return [canonicalOp, null];
+		if (rest.startsWith("(") && rest.endsWith(")")) return [canonicalOp, splitListItems(rest.slice(1, -1))];
+		return [canonicalOp, rest];
+	}
+	/**
+	* Convert a PostgREST-style querystring record to `FilterValues`.
+	*
+	* - String values are parsed as single conditions.
+	* - String arrays (repeated query params) become multiple conditions on the same field.
+	*
+	* @example
+	* deserializeFilter({ status: "eq.active" })
+	* // → { status: ["==", "active"] }
+	*
+	* deserializeFilter({ age: ["gte.18", "lt.65"] })
+	* // → { age: [[">=", "18"], ["<", "65"]] }
+	*/
+	function deserializeFilter(query) {
+		const result = {};
+		for (const [field, raw] of Object.entries(query)) {
+			if (raw === void 0) continue;
+			if (Array.isArray(raw) && raw.length === 2 && typeof raw[0] === "string" && (0, _rebasepro_types.toCanonicalOp)(raw[0]) === raw[0]) {
+				result[field] = raw;
 				continue;
 			}
-			if (typeof rawValue === "string") {
-				const dotIndex = rawValue.indexOf(".");
-				if (dotIndex === -1) {
-					filter[field] = ["==", rawValue];
+			if (Array.isArray(raw)) {
+				if (raw.length === 0) continue;
+				if (Array.isArray(raw[0]) && raw[0].length === 2 && typeof raw[0][0] === "string" && (0, _rebasepro_types.toCanonicalOp)(raw[0][0]) === raw[0][0]) {
+					result[field] = raw;
 					continue;
 				}
-				const op = rawValue.substring(0, dotIndex);
-				let value = rawValue.substring(dotIndex + 1);
-				if (typeof value === "string" && value.startsWith("(") && value.endsWith(")")) value = value.slice(1, -1).split(",").map((v) => v.trim());
-				if (value === "null") value = null;
-				else if (value === "true") value = true;
-				else if (value === "false") value = false;
-				else if (typeof value === "string" && !isNaN(Number(value)) && value.trim() !== "") value = Number(value);
-				const mappedOp = operatorMap[op];
-				if (mappedOp) filter[field] = [mappedOp, value];
+				if (raw.length === 1) result[field] = typeof raw[0] === "string" ? deserializeSingle(raw[0]) : ["==", raw[0]];
+				else if (typeof raw[0] === "string" && raw[0].includes(".")) result[field] = raw.map((r) => typeof r === "string" ? deserializeSingle(r) : ["==", r]);
+				else result[field] = ["in", raw];
+			} else if (typeof raw === "string") result[field] = deserializeSingle(raw);
+			else result[field] = ["==", raw];
+		}
+		return result;
+	}
+	/**
+	* Serialize a `LogicalCondition` or `FilterCondition` to its wire-format string.
+	*
+	* @example
+	* serializeLogicalCondition({ column: "status", operator: "==", value: "active" })
+	* // → "status.eq.active"
+	*
+	* serializeLogicalCondition({ type: "or", conditions: [...] })
+	* // → "or(status.eq.active,status.eq.pending)"
+	*/
+	function serializeLogicalCondition(cond) {
+		if ("type" in cond) {
+			const inner = (cond.conditions ?? []).map(serializeLogicalCondition).join(",");
+			return `${cond.type}(${inner})`;
+		}
+		const restOp = CANONICAL_OP_LOOKUP[cond.operator] ?? "eq";
+		if (Array.isArray(cond.value)) {
+			const items = cond.value.map((v) => escapeListItem(stringifyValue(v))).join(",");
+			return `${cond.column}.${restOp}.(${items})`;
+		}
+		return `${cond.column}.${restOp}.${stringifyValue(cond.value)}`;
+	}
+	/**
+	* Parse a logical condition wire-format string back into a
+	* `LogicalCondition` or `FilterCondition`.
+	*
+	* @example
+	* deserializeLogicalCondition("status.eq.active")
+	* // → { column: "status", operator: "==", value: "active" }
+	*
+	* deserializeLogicalCondition("or(status.eq.active,age.gte.18)")
+	* // → { type: "or", conditions: [...] }
+	*/
+	function deserializeLogicalCondition(str) {
+		const logicalMatch = str.match(/^(and|or)\((.+)\)$/);
+		if (logicalMatch) {
+			const type = logicalMatch[1];
+			const innerStr = logicalMatch[2];
+			const conditions = [];
+			let depth = 0;
+			let start = 0;
+			for (let i = 0; i < innerStr.length; i++) if (innerStr[i] === "(") depth++;
+			else if (innerStr[i] === ")") depth--;
+			else if (innerStr[i] === "," && depth === 0) {
+				conditions.push(deserializeLogicalCondition(innerStr.slice(start, i)));
+				start = i + 1;
 			}
+			conditions.push(deserializeLogicalCondition(innerStr.slice(start)));
+			return {
+				type,
+				conditions
+			};
 		}
-		return Object.keys(filter).length > 0 ? filter : void 0;
+		const firstDot = str.indexOf(".");
+		if (firstDot === -1) return {
+			column: str,
+			operator: "==",
+			value: true
+		};
+		const column = str.substring(0, firstDot);
+		const rest = str.substring(firstDot + 1);
+		const secondDot = rest.indexOf(".");
+		if (secondDot === -1) return {
+			column,
+			operator: "==",
+			value: rest
+		};
+		const opStr = rest.substring(0, secondDot);
+		const valueStr = rest.substring(secondDot + 1);
+		const operator = (0, _rebasepro_types.toCanonicalOp)(opStr) ?? "==";
+		if (valueStr.startsWith("(") && valueStr.endsWith(")")) return {
+			column,
+			operator,
+			value: splitListItems(valueStr.slice(1, -1))
+		};
+		return {
+			column,
+			operator,
+			value: valueStr
+		};
 	}
+	//#endregion
+	//#region src/data/buildRebaseData.ts
 	/**
-	* Parse an orderBy string like "created_at:desc" into [field, direction].
+	* Convert a flat REST record (e.g. from RestFetchService) to Entity<M> format.
+	* Mirrors the client SDK's rowToEntity conversion.
 	*/
-	function parseOrderBy(orderBy) {
-		if (!orderBy) return void 0;
-		const parts = orderBy.split(":");
-		return [parts[0], parts[1] || "asc"];
+	function rowToEntity(row, slug) {
+		return {
+			id: row.id,
+			path: slug,
+			values: row
+		};
 	}
 	function createDriverAccessor(driver, slug) {
 		const accessor = {
 			async find(params) {
-				const orderParsed = parseOrderBy(params?.orderBy);
-				const entities = await driver.fetchCollection({
+				const filter = params?.where ? deserializeFilter(params.where) : void 0;
+				const limit = params?.limit ?? 20;
+				const offset = params?.offset ?? 0;
+				const fetchService = driver.restFetchService;
+				const rows = fetchService && params?.include && params.include.length > 0 ? await fetchService.fetchCollectionForRest(slug, {
+					filter,
+					limit: params?.limit,
+					offset: params?.offset,
+					orderBy: params?.orderBy?.[0],
+					order: params?.orderBy?.[1],
+					searchString: params?.searchString
+				}, params.include) : await driver.fetchCollection({
 					path: slug,
 					limit: params?.limit,
 					offset: params?.offset,
-					filter: convertWhereToFilter(params?.where),
-					orderBy: orderParsed?.[0],
-					order: orderParsed?.[1],
+					filter,
+					orderBy: params?.orderBy?.[0],
+					order: params?.orderBy?.[1],
 					searchString: params?.searchString
 				});
-				const limit = params?.limit ?? 20;
-				const offset = params?.offset ?? 0;
+				let total = rows.length + offset;
+				let hasMore = rows.length >= limit;
+				if (driver.count) {
+					total = await driver.count({
+						path: slug,
+						filter
+					});
+					hasMore = offset + rows.length < total;
+				}
 				return {
-					data: entities,
+					data: rows.map((row) => rowToEntity(row, slug)),
 					meta: {
-						total: entities.length,
+						total,
 						limit,
 						offset,
-						hasMore: entities.length >= limit
+						hasMore
 					}
 				};
 			},
 			async findById(id) {
-				return driver.fetchEntity({
+				const row = await driver.fetchOne({
 					path: slug,
-					entityId: id
+					id
 				});
+				return row ? rowToEntity(row, slug) : void 0;
 			},
 			async create(data, id) {
-				return driver.saveEntity({
+				return rowToEntity(await driver.save({
 					path: slug,
 					values: data,
-					entityId: id,
+					id,
 					status: "new"
-				});
+				}), slug);
 			},
 			async update(id, data) {
-				return driver.saveEntity({
+				return rowToEntity(await driver.save({
 					path: slug,
 					values: data,
-					entityId: id,
+					id,
 					status: "existing"
-				});
+				}), slug);
 			},
 			async delete(id) {
-				return driver.deleteEntity({ entity: {
+				return driver.delete({ row: {
 					id,
 					path: slug,
 					values: {}
 				} });
 			},
-			deleteAll: driver.deleteAll ? async () => {
-				return driver.deleteAll(slug);
-			} : void 0,
-			count: driver.countEntities ? async (params) => {
-				return driver.countEntities({
+			count: driver.count ? async (params) => {
+				const filter = params?.where ? deserializeFilter(params.where) : void 0;
+				return driver.count({
 					path: slug,
-					filter: convertWhereToFilter(params?.where)
+					filter
 				});
 			} : void 0,
 			listen: driver.listenCollection ? (params, onUpdate, onError) => {
-				const orderParsed = parseOrderBy(params?.orderBy);
 				const limit = params?.limit ?? 20;
 				const offset = params?.offset ?? 0;
 				return driver.listenCollection({
 					path: slug,
 					limit: params?.limit,
 					offset: params?.offset,
-					filter: convertWhereToFilter(params?.where),
-					orderBy: orderParsed?.[0],
-					order: orderParsed?.[1],
+					filter: params?.where,
+					orderBy: params?.orderBy?.[0],
+					order: params?.orderBy?.[1],
 					searchString: params?.searchString,
 					onUpdate: (entities) => {
 						onUpdate({
-							data: entities,
+							data: entities.map((row) => rowToEntity(row, slug)),
 							meta: {
 								total: entities.length,
 								limit,
@@ -2201,11 +2752,11 @@
 					onError
 				});
 			} : void 0,
-			listenById: driver.listenEntity ? (id, onUpdate, onError) => {
-				return driver.listenEntity({
+			listenById: driver.listenOne ? (id, onUpdate, onError) => {
+				return driver.listenOne({
 					path: slug,
-					entityId: id,
-					onUpdate: (entity) => onUpdate(entity ?? void 0),
+					id,
+					onUpdate: (entity) => onUpdate(entity ? rowToEntity(entity, slug) : void 0),
 					onError
 				});
 			} : void 0,
@@ -2242,7 +2793,7 @@
 	* @example
 	* const data = buildRebaseData(driver);
 	* await data.products.create({ name: "Camera", price: 299 });
-	* const { data: items } = await data.products.find({ where: { status: "eq.published" } });
+	* const { data: items } = await data.products.find({ where: { status: ["==", "published"] } });
 	*/
 	function buildRebaseData(driver) {
 		const cache = /* @__PURE__ */ new Map();
@@ -2261,6 +2812,230 @@
 			return getAccessor((0, _rebasepro_utils.toSnakeCase)(prop));
 		} });
 	}
+	/**
+	* Unwrap a Entity into a flat row. `rowToEntity` stores the whole flat row
+	* (id included) under `.values`, so this is just that payload.
+	*/
+	function entityToRow(entity) {
+		return entity.values;
+	}
+	/**
+	* Fluent query builder for the flat SDK data layer. Mirrors {@link QueryBuilder}
+	* but resolves to `FindResult<M>` (flat rows) instead of Entity-wrapped
+	* `FindResponse<M>`.
+	*/
+	var SdkQueryBuilder = class {
+		client;
+		params = { where: {} };
+		constructor(client) {
+			this.client = client;
+		}
+		where(columnOrCondition, operator, value) {
+			if (typeof columnOrCondition === "object" && columnOrCondition !== null && "type" in columnOrCondition) {
+				this.params.logical = columnOrCondition;
+				return this;
+			}
+			if (!this.params.where) this.params.where = {};
+			const column = columnOrCondition;
+			const condition = [operator, value];
+			const existing = this.params.where[column];
+			if (existing === void 0) this.params.where[column] = condition;
+			else if (Array.isArray(existing) && existing.length > 0 && Array.isArray(existing[0])) this.params.where[column].push(condition);
+			else {
+				let firstCondition;
+				if (Array.isArray(existing) && existing.length === 2 && typeof existing[0] === "string") firstCondition = existing;
+				else firstCondition = ["==", existing];
+				this.params.where[column] = [firstCondition, condition];
+			}
+			return this;
+		}
+		orderBy(column, direction = "asc") {
+			this.params.orderBy = [column, direction];
+			return this;
+		}
+		limit(count) {
+			this.params.limit = count;
+			return this;
+		}
+		offset(count) {
+			this.params.offset = count;
+			return this;
+		}
+		search(searchString) {
+			this.params.searchString = searchString;
+			return this;
+		}
+		include(...relations) {
+			this.params.include = relations;
+			return this;
+		}
+		async find() {
+			return this.client.find(this.params);
+		}
+		async count() {
+			return this.client.count ? this.client.count(this.params) : 0;
+		}
+		listen(onUpdate, onError) {
+			if (!this.client.listen) throw new Error("Listen is only available when the driver supports realtime.");
+			return this.client.listen(this.params, onUpdate, onError);
+		}
+	};
+	/**
+	* Wrap a Entity-shaped {@link CollectionAccessor} into a flat
+	* {@link SDKCollectionClient}. Every returned record is unwrapped to a flat row
+	* so the backend SDK is byte-for-byte the same shape as the frontend client.
+	*/
+	function toSdkCollectionClient(snap) {
+		const client = {
+			async find(params) {
+				const res = await snap.find(params);
+				return {
+					data: res.data.map(entityToRow),
+					meta: res.meta
+				};
+			},
+			async findById(id) {
+				const s = await snap.findById(id);
+				return s ? entityToRow(s) : void 0;
+			},
+			async create(data, id) {
+				return entityToRow(await snap.create(data, id));
+			},
+			async update(id, data) {
+				return entityToRow(await snap.update(id, data));
+			},
+			delete(id) {
+				return snap.delete(id);
+			},
+			count: snap.count ? (params) => snap.count(params) : void 0,
+			listen: snap.listen ? (params, onUpdate, onError) => snap.listen(params, (res) => onUpdate({
+				data: res.data.map(entityToRow),
+				meta: res.meta
+			}), onError) : void 0,
+			listenById: snap.listenById ? (id, onUpdate, onError) => snap.listenById(id, (s) => onUpdate(s ? entityToRow(s) : void 0), onError) : void 0,
+			where(columnOrCondition, operator, value) {
+				const builder = new SdkQueryBuilder(client);
+				if (typeof columnOrCondition === "object") return builder.where(columnOrCondition);
+				return builder.where(columnOrCondition, operator, value);
+			},
+			orderBy: (column, direction) => new SdkQueryBuilder(client).orderBy(column, direction),
+			limit: (count) => new SdkQueryBuilder(client).limit(count),
+			offset: (count) => new SdkQueryBuilder(client).offset(count),
+			search: (searchString) => new SdkQueryBuilder(client).search(searchString),
+			include: (...relations) => new SdkQueryBuilder(client).include(...relations)
+		};
+		return client;
+	}
+	/**
+	* Wrap a flat {@link SDKCollectionClient} into a Entity-shaped
+	* {@link CollectionAccessor}. Every returned row is re-wrapped into the
+	* `{ id, path, values }` view-model the admin CMS renders.
+	*/
+	function toEntityAccessor(sdk, slug) {
+		const accessor = {
+			async find(params) {
+				const res = await sdk.find(params);
+				return {
+					data: res.data.map((row) => rowToEntity(row, slug)),
+					meta: res.meta
+				};
+			},
+			async findById(id) {
+				const row = await sdk.findById(id);
+				return row ? rowToEntity(row, slug) : void 0;
+			},
+			async create(data, id) {
+				return rowToEntity(await sdk.create(data, id), slug);
+			},
+			async update(id, data) {
+				const row = await sdk.update(id, data);
+				if (!row) throw new Error(`Update returned no data for id ${id}`);
+				return rowToEntity(row, slug);
+			},
+			delete(id) {
+				return sdk.delete(id);
+			},
+			count: sdk.count ? (params) => sdk.count(params) : void 0,
+			listen: sdk.listen ? (params, onUpdate, onError) => sdk.listen(params, (res) => onUpdate({
+				data: res.data.map((row) => rowToEntity(row, slug)),
+				meta: res.meta
+			}), onError) : void 0,
+			listenById: sdk.listenById ? (id, onUpdate, onError) => sdk.listenById(id, (row) => onUpdate(row ? rowToEntity(row, slug) : void 0), onError) : void 0,
+			where(columnOrCondition, operator, value) {
+				const builder = new QueryBuilder(accessor);
+				if (typeof columnOrCondition === "object") return builder.where(columnOrCondition);
+				return builder.where(columnOrCondition, operator, value);
+			},
+			orderBy: (column, direction) => new QueryBuilder(accessor).orderBy(column, direction),
+			limit: (count) => new QueryBuilder(accessor).limit(count),
+			offset: (count) => new QueryBuilder(accessor).offset(count),
+			search: (searchString) => new QueryBuilder(accessor).search(searchString),
+			include: (...relations) => new QueryBuilder(accessor).include(...relations)
+		};
+		return accessor;
+	}
+	/**
+	* Wrap a flat {@link RebaseSdkData} into a Entity-shaped {@link RebaseData}.
+	*
+	* This is the **CMS boundary**: the SDK client (`client.data`) returns flat
+	* rows, but the admin renders the `Entity` view-model (`entity.values.*`).
+	* `core/Rebase.tsx` wraps `client.data` through this before handing it to the
+	* CMS `RebaseDataContext` — without it the admin renders rows with only their
+	* `id`.
+	*/
+	function wrapAsEntityData(sdkData) {
+		const cache = /* @__PURE__ */ new Map();
+		function getAccessor(slug) {
+			let accessor = cache.get(slug);
+			if (!accessor) {
+				accessor = toEntityAccessor(sdkData.collection(slug), slug);
+				cache.set(slug, accessor);
+			}
+			return accessor;
+		}
+		return new Proxy({ collection: getAccessor }, { get(_target, prop) {
+			if (prop === "collection") return getAccessor;
+			if (typeof prop === "symbol") return void 0;
+			if (prop === "then" || prop === "toJSON" || prop === "$$typeof") return void 0;
+			return getAccessor((0, _rebasepro_utils.toSnakeCase)(prop));
+		} });
+	}
+	/**
+	* Wrap a Entity-shaped {@link RebaseData} into a flat {@link RebaseSdkData}.
+	*
+	* Every collection accessor is adapted to return flat rows. Use this to derive
+	* the flat SDK data layer (`context.data`) from an existing Entity data layer
+	* — e.g. the admin routes its Entity data via `useData()` and exposes the
+	* same routing as flat `context.data` for callbacks by wrapping it here.
+	*/
+	function wrapAsSdkData(entityData) {
+		const cache = /* @__PURE__ */ new Map();
+		function getAccessor(slug) {
+			let accessor = cache.get(slug);
+			if (!accessor) {
+				accessor = toSdkCollectionClient(entityData.collection(slug));
+				cache.set(slug, accessor);
+			}
+			return accessor;
+		}
+		return new Proxy({ collection: getAccessor }, { get(_target, prop) {
+			if (prop === "collection") return getAccessor;
+			if (typeof prop === "symbol") return void 0;
+			if (prop === "then" || prop === "toJSON" || prop === "$$typeof") return void 0;
+			return getAccessor((0, _rebasepro_utils.toSnakeCase)(prop));
+		} });
+	}
+	/**
+	* Build a flat {@link RebaseSdkData} from a `DataDriver`.
+	*
+	* This is the developer-facing SDK data layer used by backend framework
+	* callbacks & scripts (`context.data` / `rebase.data`). It returns flat rows —
+	* identical in shape to the frontend SDK client — so the API is symmetric
+	* across front and back. The admin CMS uses {@link buildRebaseData} (Entity).
+	*/
+	function buildSdkData(driver) {
+		return wrapAsSdkData(buildRebaseData(driver));
+	}
 	//#endregion
 	//#region src/data/buildRoutedRebaseData.ts
 	/**
@@ -2305,6 +3080,57 @@
 		} });
 	}
 	//#endregion
+	//#region src/data/sort-dialect.ts
+	/**
+	* Sort-order wire codec.
+	*
+	* This is the ONLY module that knows about the colon-delimited wire format
+	* (`"field:direction"`) used in HTTP query parameters.
+	* Everything else speaks {@link OrderByTuple} exclusively.
+	*
+	* Mirrors the filter architecture in `filter-dialect.ts`.
+	*
+	* @module
+	*/
+	/**
+	* Serialize an {@link OrderByTuple} to the wire format `"field:direction"`.
+	*
+	* **Runtime tolerance:** if the input is already a well-formed wire string
+	* (from an untyped JS caller), it is returned unchanged.
+	* This is undocumented tolerance, not public API — don't rely on it.
+	*
+	* @param orderBy - A canonical `[field, direction]` tuple, or at runtime
+	*   possibly a pre-serialized string (undocumented tolerance).
+	* @returns The wire-format string, or `undefined` if the input is falsy.
+	*
+	* @remarks
+	* Field names containing `:` are representable in the tuple form but
+	* **not** on the wire — this is an inherent limitation of the colon-delimited
+	* encoding and is not resolved here.
+	*/
+	function serializeOrderBy(orderBy) {
+		if (!orderBy) return void 0;
+		if (typeof orderBy === "string") return orderBy;
+		return `${orderBy[0]}:${orderBy[1]}`;
+	}
+	/**
+	* Deserialize a wire-format `"field:direction"` string into an {@link OrderByTuple}.
+	*
+	* Lenient parsing (matches existing server behaviour):
+	* - Bare field name (no colon): `"name"` → `["name", "asc"]`
+	* - Unknown direction: `"name:foo"` → `["name", "asc"]`
+	* - Empty / falsy input: → `undefined`
+	*
+	* @param raw - The wire-format string from an HTTP query parameter.
+	* @returns The canonical tuple, or `undefined` if the input is empty/falsy.
+	*/
+	function deserializeOrderBy(raw) {
+		if (!raw) return void 0;
+		const idx = raw.indexOf(":");
+		if (idx === -1) return [raw, "asc"];
+		return [raw.slice(0, idx), raw.slice(idx + 1) === "desc" ? "desc" : "asc"];
+	}
+	//#endregion
 	//#region src/table-classification.ts
 	/** Schemas that are always considered Rebase-internal. */
 	var REBASE_INTERNAL_SCHEMAS = ["rebase", "auth"];
@@ -2392,18 +3218,13 @@
 	exports.addInitialSlash = addInitialSlash;
 	exports.and = and;
 	exports.applyPropertyConditions = applyPropertyConditions;
-	exports.buildAdditionalFieldDelegate = buildAdditionalFieldDelegate;
 	exports.buildCollection = buildCollection;
 	exports.buildConditionContext = buildConditionContext;
-	exports.buildEntityCallbacks = buildEntityCallbacks;
-	exports.buildEnum = buildEnum;
-	exports.buildEnumValueConfig = buildEnumValueConfig;
-	exports.buildProperties = buildProperties;
-	exports.buildPropertiesOrBuilder = buildPropertiesOrBuilder;
 	exports.buildProperty = buildProperty;
 	exports.buildPropertyCallbacks = buildPropertyCallbacks;
 	exports.buildRebaseData = buildRebaseData;
 	exports.buildRoutedRebaseData = buildRoutedRebaseData;
+	exports.buildSdkData = buildSdkData;
 	exports.canCreateEntity = canCreateEntity;
 	exports.canDeleteEntity = canDeleteEntity;
 	exports.canEditEntity = canEditEntity;
@@ -2415,9 +3236,14 @@
 	exports.createRelationRef = createRelationRef;
 	exports.createRelationRefWithData = createRelationRefWithData;
 	exports.defaultUsersCollection = defaultUsersCollection;
+	exports.defineCollection = defineCollection;
+	exports.deserializeFilter = deserializeFilter;
+	exports.deserializeLogicalCondition = deserializeLogicalCondition;
+	exports.deserializeOrderBy = deserializeOrderBy;
 	exports.detectJunctionTables = detectJunctionTables;
 	exports.enumToObjectEntries = enumToObjectEntries;
 	exports.evaluateCondition = evaluateCondition;
+	exports.evaluatePolicy = evaluatePolicy;
 	exports.findRelation = findRelation;
 	exports.fullPathToCollectionSegments = fullPathToCollectionSegments;
 	exports.getArrayResolvedProperties = getArrayResolvedProperties;
@@ -2446,6 +3272,7 @@
 	exports.isRebaseInternalTable = isRebaseInternalTable;
 	exports.normalizeToEntityRelation = normalizeToEntityRelation;
 	exports.or = or;
+	exports.policyToPostgres = policyToPostgres;
 	exports.registerConditionOperations = registerConditionOperations;
 	exports.removeInitialAndTrailingSlashes = removeInitialAndTrailingSlashes;
 	exports.removeInitialSlash = removeInitialSlash;
@@ -2456,6 +3283,7 @@
 	exports.resolveDataSource = resolveDataSource;
 	exports.resolveDefaultSelectedView = resolveDefaultSelectedView;
 	exports.resolveEnumValues = resolveEnumValues;
+	exports.resolveFilterOperators = resolveFilterOperators;
 	exports.resolveProperties = resolveProperties;
 	exports.resolveProperty = resolveProperty;
 	exports.resolvePropertyEnum = resolvePropertyEnum;
@@ -2463,14 +3291,21 @@
 	exports.resolveRelationProperty = resolveRelationProperty;
 	exports.resolveStorageFilenameString = resolveStorageFilenameString;
 	exports.resolveStoragePathString = resolveStoragePathString;
+	exports.resolveStorageSource = resolveStorageSource;
 	exports.sanitizeData = sanitizeData;
 	exports.sanitizeRelation = sanitizeRelation;
+	exports.securityRuleToConditions = securityRuleToConditions;
 	exports.segmentsToStrippedPath = segmentsToStrippedPath;
+	exports.serializeFilter = serializeFilter;
+	exports.serializeLogicalCondition = serializeLogicalCondition;
+	exports.serializeOrderBy = serializeOrderBy;
 	exports.sortProperties = sortProperties;
 	exports.stripCollectionPath = stripCollectionPath;
 	exports.traverseValueProperty = traverseValueProperty;
 	exports.traverseValuesProperties = traverseValuesProperties;
 	exports.updateDateAutoValues = updateDateAutoValues;
+	exports.wrapAsEntityData = wrapAsEntityData;
+	exports.wrapAsSdkData = wrapAsSdkData;
 });
 
 //# sourceMappingURL=index.umd.js.map