@rebasepro/common 0.8.0 → 0.9.1-canary.09aaf62

package/dist/index.es.js

@@ -1,5 +1,5 @@
-import { CANONICAL_TO_REST, DEFAULT_DATA_SOURCE_KEY, EntityReference, EntityRelation, REST_TO_CANONICAL, getDataSourceCapabilities, getDeclaredSubcollections, policy, toCanonicalOp } from "@rebasepro/types";
-import { deepClone, generateForeignKeyName, getIn, isDefaultFieldConfigId, mergeDeep, randomString, removeFunctions, toSnakeCase } from "@rebasepro/utils";
+import { ALL_WHERE_FILTER_OPS, ANONYMOUS_USER_ID, CANONICAL_TO_REST, DEFAULT_DATA_SOURCE_KEY, EntityReference, EntityRelation, NULL_OPS, REST_TO_CANONICAL, getDataSourceCapabilities, getDeclaredSubcollections, isPostgresCollectionConfig, policy, toCanonicalOp } from "@rebasepro/types";
+import { deepClone, generateForeignKeyName, getIn, getPolicyOperations, isDefaultFieldConfigId, mergeDeep, randomString, removeFunctions, toSnakeCase } from "@rebasepro/utils";
 import jsonLogic from "json-logic-js";
 import { deepEqual } from "fast-equals";
 //#region src/util/common.ts
@@ -54,7 +54,7 @@ function getDefaultValueFortype(type) {
 	else return null;
 }
 /**
-* Update the automatic values in an entity before save
+* Update the automatic values in a entity before save
 * @group Driver
 */
 function updateDateAutoValues({ inputValues, properties, status, timestampNowValue }) {
@@ -66,7 +66,7 @@ function updateDateAutoValues({ inputValues, properties, status, timestampNowVal
 	}) ?? {};
 }
 /**
-* Add missing required fields, expected in the collection, to the values of an entity
+* Add missing required fields, expected in the collection, to the values of a entity
 * @param values
 * @param properties
 * @group Driver
@@ -236,7 +236,7 @@ function getLocalChangesBackup(collection) {
 	return collection.localChangesBackup;
 }
 /**
-* Returns the primary keys for an entity collection by inspecting the properties
+* Returns the primary keys for a entity collection by inspecting the properties
 * and finding any properties with `isId`.
 * Fallbacks to `["id"]` if no properties are marked as `isId: true`.
 * @param collection
@@ -249,6 +249,113 @@ function getPrimaryKeys(collection) {
 	return ["id"];
 }
 //#endregion
+//#region src/util/identity.ts
+/** Separator between the parts of a composite address. */
+var COMPOSITE_ID_SEPARATOR = ":::";
+/**
+* Derive a row's address from its key columns.
+*
+* Single key → the value as a string. Composite → each part joined by
+* {@link COMPOSITE_ID_SEPARATOR}, in primary-key order, which is what
+* {@link parseIdValues} expects to invert.
+*/
+function buildCompositeId(values, primaryKeys) {
+	if (primaryKeys.length === 0) return "";
+	if (primaryKeys.length === 1) return String(values[primaryKeys[0].fieldName] ?? "");
+	return primaryKeys.map((pk) => String(values[pk.fieldName] ?? "")).join(":::");
+}
+/**
+* Invert {@link buildCompositeId}: turn an address back into key columns, each
+* coerced to the type its column actually round-trips as.
+*
+* This is the boundary where a URL segment becomes a query parameter, so a
+* malformed address must throw rather than silently produce a query that
+* matches the wrong row (or none).
+*/
+function parseIdValues(idValue, primaryKeys) {
+	const result = {};
+	if (primaryKeys.length === 0) return result;
+	if (primaryKeys.length === 1) {
+		const pk = primaryKeys[0];
+		if (pk.type === "number" && !pk.isUUID) {
+			const parsed = typeof idValue === "number" ? idValue : parseInt(String(idValue), 10);
+			if (isNaN(parsed)) throw new Error(`Invalid numeric ID: ${idValue}`);
+			result[pk.fieldName] = parsed;
+		} else result[pk.fieldName] = String(idValue);
+		return result;
+	}
+	const parts = String(idValue).split(":::");
+	if (parts.length !== primaryKeys.length) throw new Error(`Composite ID parts mismatch. Expected ${primaryKeys.length}, got ${parts.length} for ID: ${idValue}`);
+	for (let i = 0; i < primaryKeys.length; i++) {
+		const pk = primaryKeys[i];
+		const val = parts[i];
+		if (pk.type === "number" && !pk.isUUID) {
+			const parsed = parseInt(val, 10);
+			if (isNaN(parsed)) throw new Error(`Invalid numeric ID component: ${val}`);
+			result[pk.fieldName] = parsed;
+		} else result[pk.fieldName] = val;
+	}
+	return result;
+}
+/**
+* The primary keys of a collection, as declared by its properties.
+*
+* This is the only tier both sides can read, because it is the only one written
+* in the config: the postgres driver can also infer keys from the Drizzle
+* schema, which the browser never sees and is never sent — the admin compiles
+* the collection files into its own bundle rather than being served them. A key
+* that lives only in the Drizzle schema is therefore invisible here, and the
+* server says so at boot (`warnOnKeysTheAdminCannotResolve`) naming the `isId`
+* to add.
+*
+* Returns an empty array when a collection declares none, which callers must
+* treat as "not addressable" rather than defaulting to `id`: guessing a key
+* that is not the real one produces confidently wrong addresses.
+*/
+function getDeclaredPrimaryKeys(collection) {
+	const properties = collection.properties;
+	if (!properties) return [];
+	const keys = [];
+	for (const [fieldName, propRaw] of Object.entries(properties)) {
+		const prop = propRaw;
+		if (!prop || typeof prop !== "object") continue;
+		if (!("isId" in prop) || !prop.isId) continue;
+		keys.push({
+			fieldName,
+			type: prop.type === "number" ? "number" : "string",
+			isUUID: prop.isId === "uuid"
+		});
+	}
+	return keys;
+}
+/**
+* The keys to address a collection's rows with, resolved the way the driver
+* resolves them — minus the tier the browser cannot reach.
+*
+* The postgres driver tries, in order: properties marked `isId`; the primary
+* keys of the Drizzle schema; and finally a column literally named `id`. Only
+* the first and last are visible in a `CollectionConfig`, which is what both
+* sides share.
+*
+* So the two agree except on a collection that declares no `isId` and whose key
+* is known only to Drizzle. There, the driver reads the real key, and this
+* either resolves nothing (reported to the console by the caller) or — if the
+* table happens to have an unrelated `id` property — resolves `id`, which is
+* the wrong key and cannot be detected from here: the addresses look right and
+* route wrong. Only the config can settle it, so the server names both cases
+* at boot (`warnOnKeysTheAdminCannotResolve`) with the `isId` to add.
+*/
+function resolvePrimaryKeys(collection) {
+	const declared = getDeclaredPrimaryKeys(collection);
+	if (declared.length > 0) return declared;
+	const idProp = collection.properties?.id;
+	if (idProp && typeof idProp === "object") return [{
+		fieldName: "id",
+		type: idProp.type === "number" ? "number" : "string"
+	}];
+	return [];
+}
+//#endregion
 //#region src/util/enums.ts
 function enumToObjectEntries(enumValues) {
 	if (Array.isArray(enumValues)) return enumValues;
@@ -682,15 +789,109 @@ function getSubcollections(collection) {
 * - `field = 'literal'`
 * - `field != 'literal'`
 * - `field = current_setting('app.user_id')`
-* - `A AND B`
+* - `A AND B`, `A OR B` — only where the keyword is at the top level
 * - `true`
 * - `IN (...)` (as optimistic true)
 *
 * For anything it doesn't understand, it returns a `raw` expression, which
 * the evaluator treats as "unknown" (and usually optimistic true).
+*
+* **This output also round-trips back into DDL** via `policyToPostgres` (the
+* schema/policy generators), so decomposing a clause the parser only partly
+* understands is not a cosmetic mistake — it emits invalid SQL. When in doubt,
+* prefer `raw`: it is reproduced verbatim.
+*/
+/** True when `keyword` starts at `i` as a standalone word. */
+function isKeywordAt(upper, i, keyword) {
+	if (!upper.startsWith(keyword, i)) return false;
+	const before = i === 0 ? " " : upper[i - 1];
+	const after = upper[i + keyword.length] ?? " ";
+	return /[\s()]/.test(before) && /[\s()]/.test(after);
+}
+/**
+* Split `sql` on a boolean keyword, but only where it sits at paren depth 0 and
+* outside a string literal. Returns null when it never does, so the caller
+* leaves the clause alone.
+*
+* This used to be `sql.split(/ AND /i)`, which tore subqueries in half: the
+* `AND` inside
+*   `EXISTS (SELECT 1 FROM organization_members m WHERE m.org = t.org AND m.user_id = auth.uid())`
+* split the expression, and re-emitting the halves produced
+*   `(EXISTS (...) AND m.user_id = auth.uid())`
+* where `m` is no longer in scope — SQL that Postgres rejects outright with
+* "missing FROM-clause entry for table". Returning null instead keeps such a
+* clause as a `raw` expression, which round-trips verbatim.
 */
+function splitTopLevel(sql, keyword) {
+	const upper = sql.toUpperCase();
+	const parts = [];
+	let depth = 0;
+	let inString = false;
+	let start = 0;
+	for (let i = 0; i < sql.length; i++) {
+		const ch = sql[i];
+		if (inString) {
+			if (ch === "'") if (sql[i + 1] === "'") i++;
+			else inString = false;
+			continue;
+		}
+		if (ch === "'") {
+			inString = true;
+			continue;
+		}
+		if (ch === "(") {
+			depth++;
+			continue;
+		}
+		if (ch === ")") {
+			depth--;
+			continue;
+		}
+		if (depth === 0 && isKeywordAt(upper, i, keyword)) {
+			parts.push(sql.slice(start, i));
+			i += keyword.length - 1;
+			start = i + 1;
+		}
+	}
+	if (parts.length === 0) return null;
+	parts.push(sql.slice(start));
+	const trimmedParts = parts.map((p) => p.trim()).filter((p) => p.length > 0);
+	return trimmedParts.length > 1 ? trimmedParts : null;
+}
+/** Drop redundant wrapping parens (`(a AND b)` → `a AND b`), never `(a) AND (b)`. */
+function stripOuterParens(sql) {
+	let s = sql.trim();
+	for (;;) {
+		if (!s.startsWith("(") || !s.endsWith(")")) return s;
+		let depth = 0;
+		let inString = false;
+		let wraps = true;
+		for (let i = 0; i < s.length; i++) {
+			const ch = s[i];
+			if (inString) {
+				if (ch === "'") if (s[i + 1] === "'") i++;
+				else inString = false;
+				continue;
+			}
+			if (ch === "'") {
+				inString = true;
+				continue;
+			}
+			if (ch === "(") depth++;
+			else if (ch === ")") {
+				depth--;
+				if (depth === 0 && i < s.length - 1) {
+					wraps = false;
+					break;
+				}
+			}
+		}
+		if (!wraps) return s;
+		s = s.slice(1, -1).trim();
+	}
+}
 function sqlToPolicy(sql) {
-	const trimmed = sql.trim();
+	const trimmed = stripOuterParens(sql.trim());
 	if (trimmed.toLowerCase() === "true") return policy.true();
 	if (trimmed.toLowerCase() === "false") return policy.false();
 	const overlapMatch = trimmed.match(/^string_to_array\s*\(\s*auth\.roles\(\)\s*,\s*','\s*\)\s*&&\s*ARRAY\s*\[(.+)\]$/i);
@@ -703,14 +904,10 @@ function sqlToPolicy(sql) {
 		const roles = containMatch[1].split(",").map((s) => s.trim().replace(/^'|'$/g, ""));
 		return policy.rolesContain(roles);
 	}
-	if (trimmed.toUpperCase().includes(" OR ")) {
-		const parts = trimmed.split(/ OR /i);
-		return policy.or(...parts.map(sqlToPolicy));
-	}
-	if (trimmed.toUpperCase().includes(" AND ")) {
-		const parts = trimmed.split(/ AND /i);
-		return policy.and(...parts.map(sqlToPolicy));
-	}
+	const orParts = splitTopLevel(trimmed, "OR");
+	if (orParts) return policy.or(...orParts.map(sqlToPolicy));
+	const andParts = splitTopLevel(trimmed, "AND");
+	if (andParts) return policy.and(...andParts.map(sqlToPolicy));
 	const match = trimmed.match(/^(.+?)\s*(!?=)\s*(.+)$/);
 	if (match) {
 		const [, leftStr, op, rightStr] = match;
@@ -720,6 +917,77 @@ function sqlToPolicy(sql) {
 	}
 	return policy.raw(sql);
 }
+/**
+* Literals from other BaaS platforms that people compare `auth.uid()` against
+* out of habit. Mirrors the driver's `FOREIGN_CONVENTION_ROLES` guard on
+* `pgRoles`, one surface over: the same muscle memory inside a `using:` string
+* is the more dangerous spelling, because it inverts a rule instead of
+* emptying a table.
+*/
+var FOREIGN_CONVENTION_UIDS = {
+	anon: "Supabase",
+	authenticated: "Supabase",
+	service_role: "Supabase"
+};
+/** `auth.uid() IS NOT NULL` in raw SQL, the clause that is always true. */
+var UID_NOT_NULL = /auth\.uid\(\)\s+IS\s+NOT\s+NULL/i;
+/**
+* Find clauses that read as "signed-in users only" but admit anonymous callers.
+*
+* Both spellings come from the same place — Supabase, where `auth.uid()` really
+* is NULL for an anonymous request. Rebase substitutes
+* {@link ANONYMOUS_USER_ID} instead (a blank id would read back as NULL, which
+* is how the trusted *server* context is recognised), so:
+*
+*  - `auth.uid() IS NOT NULL` is a tautology on the user path, and
+*  - `auth.uid() != 'anon'` compares against a string no caller ever has.
+*
+* Either one turns a lockdown into a full grant, and neither looks wrong. No
+* real user id is ever one of these literals, and a user-context request is
+* never NULL, so a match is always a mistake rather than a deliberate check.
+*
+* Structured expressions are checked too, not just parsed SQL: `policy.compare`
+* can spell the same mistake.
+*/
+function findAnonymousGrants(expr) {
+	const found = [];
+	const visit = (e) => {
+		switch (e.kind) {
+			case "and":
+			case "or":
+				e.operands.forEach(visit);
+				return;
+			case "not":
+				visit(e.operand);
+				return;
+			case "existsIn":
+				visit(e.where);
+				return;
+			case "raw":
+				if (UID_NOT_NULL.test(e.sql)) found.push({
+					pattern: "uid-not-null",
+					detail: e.sql,
+					explanation: `\`auth.uid() IS NOT NULL\` is true for every request that came from a client, including anonymous ones — they carry '${ANONYMOUS_USER_ID}', not NULL. Use \`condition: policy.authenticated()\` to mean "signed in".`
+				});
+				return;
+			case "compare": {
+				const literal = [e.left, e.right].find((o) => o.kind === "literal");
+				if (!(e.left.kind === "authUid" || e.right.kind === "authUid") || typeof literal?.value !== "string") return;
+				const platform = FOREIGN_CONVENTION_UIDS[literal.value];
+				if (!platform) return;
+				found.push({
+					pattern: "foreign-uid-literal",
+					detail: literal.value,
+					explanation: `'${literal.value}' is a ${platform} convention. Rebase reports an anonymous request as '${ANONYMOUS_USER_ID}', so comparing against '${literal.value}' passes for every caller. Use \`condition: policy.authenticated()\` to mean "signed in".`
+				});
+				return;
+			}
+			default: return;
+		}
+	};
+	visit(expr);
+	return found;
+}
 function parseOperand(str) {
 	if (/current_setting\s*\(\s*'app\.user_id'\s*\)/i.test(str) || /auth\.uid\(\)/i.test(str)) return policy.authUid();
 	const stringMatch = str.match(/^'(.+)'$/);
@@ -780,22 +1048,58 @@ function withRoles(base, rule) {
 * {@link evaluatePolicy}); the Postgres schema generators call it so that DDL
 * and the admin UI derive from the exact same expression.
 */
-function policyToPostgres(expr, collection) {
+function policyToPostgres(expr, collection, options) {
+	return compile(expr, {
+		fieldCollection: collection,
+		fieldPrefix: "",
+		outerCollection: collection,
+		outerPrefix: "",
+		resolveCollection: options?.resolveCollection,
+		alias: { n: 0 }
+	});
+}
+function compile(expr, scope) {
 	switch (expr.kind) {
 		case "true": return "true";
 		case "false": return "false";
-		case "and": return expr.operands.length === 0 ? "true" : expr.operands.map((o) => `(${policyToPostgres(o, collection)})`).join(" AND ");
-		case "or": return expr.operands.length === 0 ? "false" : expr.operands.map((o) => `(${policyToPostgres(o, collection)})`).join(" OR ");
-		case "not":
-			if (expr.operand.kind === "authenticated") return "auth.uid() IS NULL";
-			return `NOT (${policyToPostgres(expr.operand, collection)})`;
-		case "compare": return `${operandToSql(expr.left, collection)} ${COMPARE_SQL[expr.op]} ${operandToSql(expr.right, collection)}`;
+		case "and": return expr.operands.length === 0 ? "true" : expr.operands.map((o) => `(${compile(o, scope)})`).join(" AND ");
+		case "or": return expr.operands.length === 0 ? "false" : expr.operands.map((o) => `(${compile(o, scope)})`).join(" OR ");
+		case "not": return `NOT (${compile(expr.operand, scope)})`;
+		case "compare": {
+			const castForAuthUid = (operand, sqlText, other) => other.kind === "authUid" && (operand.kind === "field" || operand.kind === "outerField") ? `(${sqlText})::text` : sqlText;
+			const leftSql = castForAuthUid(expr.left, operandToSql(expr.left, scope), expr.right);
+			const rightSql = castForAuthUid(expr.right, operandToSql(expr.right, scope), expr.left);
+			return `${leftSql} ${COMPARE_SQL[expr.op]} ${rightSql}`;
+		}
 		case "rolesOverlap": return `string_to_array(auth.roles(), ',') && ${rolesArraySql(expr.roles)}`;
 		case "rolesContain": return `string_to_array(auth.roles(), ',') @> ${rolesArraySql(expr.roles)}`;
-		case "authenticated": return "auth.uid() IS NOT NULL";
-		case "raw": return expr.sql.replace(/\{(\w+)\}/g, (_, col) => col);
+		case "authenticated": return `auth.uid() IS NOT NULL AND auth.uid() <> ${quoteLiteral(ANONYMOUS_USER_ID)}`;
+		case "serverContext": return "auth.uid() IS NULL";
+		case "existsIn": return compileExistsIn(expr, scope);
+		case "raw": return expr.sql.replace(/\{(\w+)\}/g, (_, col) => `${outerQualifier(scope)}${resolveColumnName(col, scope.outerCollection)}`);
 	}
 }
+/**
+* Compiles `existsIn` to a correlated `EXISTS (SELECT 1 FROM <join> WHERE ...)`.
+* Inside the subquery, `field` operands bind to the aliased join table and
+* `outerField` operands bind to the (table-qualified) outer RLS row.
+*/
+function compileExistsIn(expr, scope) {
+	const join = scope.resolveCollection?.(expr.collection);
+	const joinTable = join ? getTableName(join) : toSnakeCase(expr.collection);
+	const joinSchema = schemaOf(join) ?? schemaOf(scope.outerCollection) ?? "public";
+	const alias = `_ex${scope.alias.n++}`;
+	const outerPrefix = outerQualifier(scope);
+	const innerScope = {
+		fieldCollection: join,
+		fieldPrefix: `"${alias}".`,
+		outerCollection: scope.outerCollection,
+		outerPrefix,
+		resolveCollection: scope.resolveCollection,
+		alias: scope.alias
+	};
+	return `EXISTS (SELECT 1 FROM "${joinSchema}"."${joinTable}" "${alias}" WHERE ${compile(expr.where, innerScope)})`;
+}
 var COMPARE_SQL = {
 	eq: "=",
 	neq: "!=",
@@ -804,14 +1108,27 @@ var COMPARE_SQL = {
 	gt: ">",
 	gte: ">="
 };
-function operandToSql(operand, collection) {
+function operandToSql(operand, scope) {
 	switch (operand.kind) {
-		case "field": return resolveColumnName(operand.name, collection);
+		case "field": return `${scope.fieldPrefix}${resolveColumnName(operand.name, scope.fieldCollection)}`;
+		case "outerField": return `${scope.outerPrefix}${resolveColumnName(operand.name, scope.outerCollection)}`;
 		case "literal": return quoteLiteral(operand.value);
 		case "authUid": return "auth.uid()";
 		case "authRoles": return "string_to_array(auth.roles(), ',')";
 	}
 }
+/**
+* SQL prefix that qualifies a column of the outer RLS row (`"schema"."table".`),
+* or `""` when the collection is unknown.
+*/
+function outerQualifier(scope) {
+	const table = scope.outerCollection ? getTableName(scope.outerCollection) : void 0;
+	if (!table) return "";
+	return `"${schemaOf(scope.outerCollection) ?? "public"}"."${table}".`;
+}
+function schemaOf(collection) {
+	return collection?.schema || void 0;
+}
 function resolveColumnName(propName, collection) {
 	const prop = collection?.properties?.[propName];
 	if (prop && "columnName" in prop && typeof prop.columnName === "string") return prop.columnName;
@@ -853,7 +1170,9 @@ function evaluatePolicy(expr, ctx) {
 			const userRoles = ctx.roles ?? [];
 			return expr.roles.every((r) => r === "public" || userRoles.includes(r));
 		}
-		case "authenticated": return ctx.uid != null;
+		case "authenticated": return ctx.uid != null && ctx.uid !== ANONYMOUS_USER_ID;
+		case "serverContext": return false;
+		case "existsIn": return "unknown";
 		case "raw": return "unknown";
 	}
 }
@@ -879,7 +1198,7 @@ function resolveOperand(operand, ctx) {
 		};
 		case "authUid": return {
 			known: true,
-			value: ctx.uid ?? null
+			value: ctx.uid ?? ANONYMOUS_USER_ID
 		};
 		case "authRoles": return {
 			known: true,
@@ -891,6 +1210,7 @@ function resolveOperand(operand, ctx) {
 				known: true,
 				value: ctx.entity.values[operand.name]
 			};
+		case "outerField": return { known: false };
 	}
 }
 function evaluateCompare(op, left, right, ctx) {
@@ -1102,7 +1422,7 @@ function resolveCollectionPathIds(path, allCollections) {
 			} else {
 				entityId = remainingPath;
 				remainingPath = "";
-				console.warn(`resolveCollectionPathIds: Path seems to end with an entity ID "${entityId}" instead of a collection segment in original path "${path}". This might indicate an invalid input path.`);
+				console.warn(`resolveCollectionPathIds: Path seems to end with a entity ID "${entityId}" instead of a collection segment in original path "${path}". This might indicate an invalid input path.`);
 			}
 			resolvedPathParts.push(entityId);
 			currentCollections = getSubcollections(foundCollection);
@@ -1258,9 +1578,12 @@ function getParentReferencesFromPath(props) {
 //#endregion
 //#region src/util/builders.ts
 /**
-* Identity function we use to defeat the type system of Typescript and build
-* collection views with all its properties
-* @param collection
+* @deprecated Use {@link defineCollection} instead — it infers property
+* types automatically (autocomplete on `titleProperty`, `sort`,
+* `propertiesOrder`, callbacks) without manual generics.
+* `buildCollection` is kept for FireCMS migration compatibility and will
+* be removed before 1.0.
+*
 * @group Builder
 */
 function buildCollection(collection) {
@@ -1274,68 +1597,16 @@ function defineCollection(collection) {
 	return collection;
 }
 /**
-* Identity function we use to defeat the type system of Typescript and preserve
-* the property keys.
-* @param property
+* @deprecated Use plain typed property objects with {@link defineCollection}
+* instead — `defineCollection` infers property types automatically, making
+* this wrapper unnecessary. `buildProperty` is kept for FireCMS migration
+* compatibility and will be removed before 1.0.
+*
 * @group Builder
 */
 function buildProperty(property) {
 	return property;
 }
-/**
-* Identity function we use to defeat the type system of Typescript and preserve
-* the properties keys.
-* @param properties
-* @group Builder
-*/
-function buildProperties(properties) {
-	return properties;
-}
-/**
-* Identity function we use to defeat the type system of Typescript and preserve
-* the properties keys.
-* @param propertiesOrBuilder
-* @group Builder
-*/
-function buildPropertiesOrBuilder(propertiesOrBuilder) {
-	return propertiesOrBuilder;
-}
-/**
-* Identity function we use to defeat the type system of Typescript and preserve
-* the properties keys.
-* @param enumValues
-* @group Builder
-*/
-function buildEnum(enumValues) {
-	return enumValues;
-}
-/**
-* Identity function we use to defeat the type system of Typescript and preserve
-* the properties keys.
-* @param enumValueConfig
-* @group Builder
-*/
-function buildEnumValueConfig(enumValueConfig) {
-	return enumValueConfig;
-}
-/**
-* Identity function we use to defeat the type system of Typescript and preserve
-* the properties keys.
-* @param callbacks
-* @group Builder
-*/
-function buildEntityCallbacks(callbacks) {
-	return callbacks;
-}
-/**
-* Identity function we use to defeat the type system of Typescript and build
-* additional field delegates views with all its properties
-* @param additionalFieldDelegate
-* @group Builder
-*/
-function buildAdditionalFieldDelegate(additionalFieldDelegate) {
-	return additionalFieldDelegate;
-}
 //#endregion
 //#region src/util/storage.ts
 /**
@@ -1471,16 +1742,17 @@ async function processProperties(properties, values, previousValues, propsContex
 }
 /**
 * Helper function to extract field-level PropertyCallbacks from a properties schema
-* and wrap them into an EntityCallbacks object recursively.
+* and wrap them into an CollectionCallbacks object recursively.
 */
 var buildPropertyCallbacks = (properties) => {
 	if (!properties) return void 0;
 	const propertyCallbacks = {};
 	if (hasPropertyCallbacks(properties, "afterRead")) propertyCallbacks.afterRead = async (props) => {
-		const processedValues = await processProperties(properties, props.entity.values, props.entity.values, props, "afterRead");
+		const row = props.row;
+		const processedValues = await processProperties(properties, row, row, props, "afterRead");
 		return {
-			...props.entity,
-			values: processedValues
+			...props.row,
+			...processedValues
 		};
 	};
 	if (hasPropertyCallbacks(properties, "beforeSave")) propertyCallbacks.beforeSave = async (props) => {
@@ -1489,6 +1761,323 @@ var buildPropertyCallbacks = (properties) => {
 	return Object.keys(propertyCallbacks).length > 0 ? propertyCallbacks : void 0;
 };
 //#endregion
+//#region src/util/auth-default-policies.ts
+/**
+* Default RLS policies injected by the schema generator.
+*
+* Rebase's enforcement model is unified: authenticated (user-context) requests
+* run under the restricted `rebase_user` role, so Postgres RLS binds *every*
+* statement — reads and writes. A collection's `securityRules` are the whole
+* authorization model. The server context (auth flows, migrations,
+* `dataAsAdmin`) runs as the owner and bypasses RLS.
+*
+* Because RLS default-denies, every collection is **locked by default**: with
+* no rules, only the server context and admins can touch it. The generator
+* injects that safe baseline:
+*
+* **For every collection**
+*  1. A permissive **server-or-admin SELECT** grant.
+*  2. A permissive **server-or-admin write** grant (insert/update/delete).
+*
+* Author `securityRules` are permissive and OR together, so explicit rules only
+* *broaden* access from this locked baseline (e.g. "users read/write their own
+* rows").
+*
+* **For auth collections additionally**
+*  3. A permissive **self SELECT** grant (`id = auth.uid()`), so users can read
+*     their own row (profile, session bootstrap) without every app re-declaring
+*     it.
+*  4. A **restrictive** admin write gate. Restrictive policies are AND'd with
+*     every other policy, so a write is rejected unless the caller is an admin
+*     (or the server context) — even if the author also wrote a permissive rule
+*     such as "a user may edit their own row". Without this, a permissive owner
+*     rule would let a user change their own `roles`.
+*
+* The server context is recognised as `auth.uid() IS NULL` (`policy.serverContext()`)
+* — the built-in flows that run without a user (signup, migrations) set no user
+* GUC — which also lets the owner connection satisfy these policies even under
+* FORCE RLS. A *user* request never reaches that state: an anonymous one carries
+* `ANONYMOUS_USER_ID`, precisely so it cannot pass for the server here.
+*
+* Opt out with `disableDefaultPolicies: true` to take full responsibility for
+* the collection's RLS.
+*/
+var SERVER_OR_ADMIN_EXPR$1 = policy.or(policy.serverContext(), policy.rolesOverlap(["admin"]));
+/** Write operations that must be admin-gated by default on auth collections. */
+var DEFAULT_GUARDED_OPS = [
+	"insert",
+	"update",
+	"delete"
+];
+/** Whether a collection is flagged as an authentication collection. */
+function isAuthCollection(collection) {
+	const auth = collection.auth;
+	return auth === true || typeof auth === "object" && auth?.enabled === true;
+}
+/** The property marked as the row id (falls back to `id`). */
+function getIdPropertyName$1(collection) {
+	for (const [name, prop] of Object.entries(collection.properties ?? {})) if (prop && typeof prop === "object" && "isId" in prop && prop.isId) return name;
+	return "id";
+}
+/**
+* Returns the security rules that should be applied to a collection: the
+* author's explicit `securityRules` plus the framework defaults described in
+* the module doc (baseline server/admin read for all collections; self-read
+* and the admin write gate for auth collections).
+*
+* Collections that opt out via `disableDefaultPolicies` are returned unchanged.
+*/
+function getEffectiveSecurityRules(collection) {
+	const explicit = [...(isPostgresCollectionConfig(collection) ? collection.securityRules : void 0) ?? []];
+	if (collection.disableDefaultPolicies) return explicit;
+	const tableName = getTableName(collection);
+	const injected = [];
+	injected.push({
+		name: `${tableName}_default_admin_read`,
+		operations: ["select"],
+		condition: SERVER_OR_ADMIN_EXPR$1
+	});
+	injected.push({
+		name: `${tableName}_default_admin_write`,
+		operations: [...DEFAULT_GUARDED_OPS],
+		condition: SERVER_OR_ADMIN_EXPR$1,
+		check: SERVER_OR_ADMIN_EXPR$1
+	});
+	if (isAuthCollection(collection)) {
+		injected.push({
+			name: `${tableName}_default_self_read`,
+			operations: ["select"],
+			condition: policy.compare(policy.field(getIdPropertyName$1(collection)), "eq", policy.authUid())
+		});
+		injected.push({
+			name: `${tableName}_require_admin_write`,
+			mode: "restrictive",
+			operations: [...DEFAULT_GUARDED_OPS],
+			condition: SERVER_OR_ADMIN_EXPR$1,
+			check: SERVER_OR_ADMIN_EXPR$1
+		});
+	}
+	return [...explicit, ...injected];
+}
+/**
+* The framework defaults that {@link getEffectiveSecurityRules} would add to a
+* collection, without the author's own rules.
+*
+* These policies appear in the database under names the author never wrote, and
+* a permissive policy ORs with every other permissive policy — so someone
+* reading their `securityRules` and then the real ACL sees more access than they
+* declared. Dropping them by hand does nothing either: `db push` is declarative,
+* so the next push asserts them again. Callers use this to say, in the generated
+* DDL, which policies are injected and how to take them off.
+*/
+function getInjectedSecurityRules(collection) {
+	if (collection.disableDefaultPolicies) return [];
+	const explicitCount = ((isPostgresCollectionConfig(collection) ? collection.securityRules : void 0) ?? []).length;
+	return getEffectiveSecurityRules(collection).slice(explicitCount);
+}
+//#endregion
+//#region src/util/junction-policies.ts
+var SERVER_OR_ADMIN_EXPR = policy.or(policy.serverContext(), policy.rolesOverlap(["admin"]));
+/**
+* Walk every collection's resolved relations and aggregate the junction tables
+* they declare. Two collections may declare the same junction from opposite
+* sides (posts→tags and tags→posts through `posts_tags`); both become
+* `declaringSides` of one spec, so derived write grants consider both.
+*/
+function resolveJunctionSpecs(collections) {
+	const specs = /* @__PURE__ */ new Map();
+	for (const collection of collections) {
+		const resolved = resolveCollectionRelations(collection);
+		for (const relation of Object.values(resolved)) {
+			if (!relation.through) continue;
+			const targetCollection = typeof relation.target === "function" ? relation.target() : void 0;
+			if (!targetCollection) continue;
+			const rawName = relation.through.table;
+			const table = rawName.includes(".") ? rawName.split(".").pop() : rawName;
+			const schema = "public";
+			const source = {
+				collection,
+				junctionColumn: relation.through.sourceColumn,
+				relation
+			};
+			const target = {
+				collection: targetCollection,
+				junctionColumn: relation.through.targetColumn
+			};
+			const existing = specs.get(table);
+			if (!existing) specs.set(table, {
+				table,
+				schema,
+				endpoints: [source, target],
+				declaringSides: [source]
+			});
+			else if (!existing.declaringSides.some((s) => s.collection === collection)) existing.declaringSides.push(source);
+		}
+	}
+	return specs;
+}
+/**
+* A synthetic CollectionConfig standing in for the junction during policy
+* compilation and naming. Its two FK columns carry explicit `columnName`s so
+* `outerField` operands resolve to the exact columns the CREATE TABLE emitted,
+* whatever their casing.
+*/
+function getJunctionCollectionConfig(spec) {
+	const properties = {};
+	for (const endpoint of spec.endpoints) properties[endpoint.junctionColumn] = {
+		type: "string",
+		columnName: endpoint.junctionColumn
+	};
+	return {
+		slug: spec.table,
+		name: spec.table,
+		table: spec.table,
+		schema: spec.schema,
+		properties
+	};
+}
+/** The property marked as the row id (falls back to `id`). */
+function getIdPropertyName(collection) {
+	for (const [name, prop] of Object.entries(collection.properties ?? {})) if (prop && typeof prop === "object" && "isId" in prop && prop.isId) return name;
+	return "id";
+}
+/** `EXISTS (SELECT 1 FROM endpoint WHERE endpoint.pk = junction.fk [AND extra])`. */
+function existsEndpoint(endpoint, extra) {
+	const correlation = policy.compare(policy.field(getIdPropertyName(endpoint.collection)), "eq", policy.outerField(endpoint.junctionColumn));
+	return policy.existsIn({
+		collection: endpoint.collection.slug,
+		where: extra ? policy.and(correlation, extra) : correlation
+	});
+}
+/**
+* Whether a parent-rule expression keeps its meaning when moved inside the
+* junction's `EXISTS` subquery — and the re-scoped copy if it does.
+*
+* Returns `null` when the rule cannot be embedded faithfully: `raw` SQL
+* anywhere (its `{column}` placeholders would bind to the junction), or an
+* `outerField` inside a nested `existsIn` (it would bind to the junction while
+* the author meant the parent, and no operand can express "the middle scope").
+* Top-level `outerField`s are rewritten to `field`, which is what they meant.
+*/
+function embedParentExpression(expr, depth = 0) {
+	switch (expr.kind) {
+		case "raw": return null;
+		case "and":
+		case "or": {
+			const parts = [];
+			for (const child of expr.operands) {
+				const embedded = embedParentExpression(child, depth);
+				if (!embedded) return null;
+				parts.push(embedded);
+			}
+			return expr.kind === "and" ? policy.and(...parts) : policy.or(...parts);
+		}
+		case "not": {
+			const embedded = embedParentExpression(expr.operand, depth);
+			return embedded ? policy.not(embedded) : null;
+		}
+		case "existsIn": {
+			const where = embedParentExpression(expr.where, depth + 1);
+			return where ? policy.existsIn({
+				collection: expr.collection,
+				where
+			}) : null;
+		}
+		case "compare": {
+			const left = embedOperand(expr.left, depth);
+			const right = embedOperand(expr.right, depth);
+			if (!left || !right) return null;
+			return {
+				...expr,
+				left,
+				right
+			};
+		}
+		default: return expr;
+	}
+}
+/** Re-scope an operand, or return `null` if its binding cannot be preserved. */
+function embedOperand(operand, depth) {
+	if (operand.kind === "outerField") {
+		if (depth === 0) return policy.field(operand.name);
+		return null;
+	}
+	return operand;
+}
+/** Does the rule cover the `update` operation? */
+function coversUpdate(rule) {
+	return getPolicyOperations(rule).some((op) => op === "update" || op === "all");
+}
+/**
+* The full derived policy set for a junction table: the locked server/admin
+* baseline, the endpoint-visibility read grant, inherited write grants, and
+* inherited restrictive gates. Returns `[]` when every declaring collection set
+* `disableDefaultPolicies` — the junction is then the author's to police, and
+* stays locked (RLS is still enabled) until they write policies for it.
+*/
+function getJunctionSecurityRules(spec) {
+	if (spec.declaringSides.every((side) => side.collection.disableDefaultPolicies)) return [];
+	const rules = [];
+	rules.push({
+		name: `${spec.table}_default_admin_read`,
+		operations: ["select"],
+		condition: SERVER_OR_ADMIN_EXPR
+	});
+	rules.push({
+		name: `${spec.table}_default_admin_write`,
+		operations: [
+			"insert",
+			"update",
+			"delete"
+		],
+		condition: SERVER_OR_ADMIN_EXPR,
+		check: SERVER_OR_ADMIN_EXPR
+	});
+	rules.push({
+		name: `${spec.table}_default_edge_read`,
+		operations: ["select"],
+		condition: policy.and(existsEndpoint(spec.endpoints[0]), existsEndpoint(spec.endpoints[1]))
+	});
+	const writeGrants = [];
+	for (const side of spec.declaringSides) {
+		const updateRules = ((isPostgresCollectionConfig(side.collection) ? side.collection.securityRules : void 0) ?? []).filter(coversUpdate);
+		const permissive = updateRules.filter((r) => r.mode !== "restrictive");
+		const restrictive = updateRules.filter((r) => r.mode === "restrictive");
+		const embeddedGates = [];
+		let gatesEmbeddable = true;
+		for (const gate of restrictive) {
+			const using = securityRuleToConditions(gate).usingExpr;
+			const embedded = using ? embedParentExpression(using) : null;
+			if (!embedded) {
+				gatesEmbeddable = false;
+				break;
+			}
+			embeddedGates.push(embedded);
+		}
+		if (!gatesEmbeddable) continue;
+		const grants = [];
+		for (const rule of permissive) {
+			const using = securityRuleToConditions(rule).usingExpr;
+			const embedded = using ? embedParentExpression(using) : null;
+			if (embedded) grants.push(embedded);
+		}
+		if (grants.length === 0) continue;
+		const condition = embeddedGates.length > 0 ? policy.and(policy.or(...grants), ...embeddedGates) : policy.or(...grants);
+		writeGrants.push(existsEndpoint(side, condition));
+	}
+	if (writeGrants.length > 0) rules.push({
+		name: `${spec.table}_default_edge_write`,
+		operations: [
+			"insert",
+			"update",
+			"delete"
+		],
+		condition: writeGrants.length === 1 ? writeGrants[0] : policy.or(...writeGrants),
+		check: writeGrants.length === 1 ? writeGrants[0] : policy.or(...writeGrants)
+	});
+	return rules;
+}
+//#endregion
 //#region src/util/conditions.ts
 /**
 * Access a nested property from an object via dot notation.
@@ -1667,6 +2256,84 @@ function applyEnumConditions(enumValues, conditions, context) {
 	return result;
 }
 //#endregion
+//#region src/util/filter-operator-resolution.ts
+/**
+* Default operators offered per property type, before engine capabilities and
+* per-property narrowing are applied. These mirror what the built-in filter
+* fields can render.
+*/
+var COMPARISON_OPS = [
+	"==",
+	"!=",
+	">",
+	">=",
+	"<",
+	"<="
+];
+var NULL_CHECK_OPS = ["is-null", "is-not-null"];
+var MEMBERSHIP_OPS = ["in", "not-in"];
+var PATTERN_OPS = [
+	"like",
+	"ilike",
+	"not-like",
+	"not-ilike"
+];
+var DEFAULT_OPS_BY_TYPE = {
+	string: [
+		...COMPARISON_OPS,
+		...MEMBERSHIP_OPS,
+		...PATTERN_OPS,
+		...NULL_CHECK_OPS
+	],
+	number: [
+		...COMPARISON_OPS,
+		...MEMBERSHIP_OPS,
+		...NULL_CHECK_OPS
+	],
+	date: [...COMPARISON_OPS, ...NULL_CHECK_OPS],
+	boolean: [
+		"==",
+		"!=",
+		...NULL_CHECK_OPS
+	],
+	reference: [
+		"==",
+		"!=",
+		...MEMBERSHIP_OPS,
+		...NULL_CHECK_OPS
+	],
+	relation: [
+		"==",
+		"!=",
+		...MEMBERSHIP_OPS,
+		...NULL_CHECK_OPS
+	]
+};
+/** Operators offered when the property is an *array of* a filterable type. */
+var ARRAY_OPS = ["array-contains", "array-contains-any"];
+/**
+* Resolve which filter operators the UI should offer for a property.
+*
+* The result is the **intersection** of three sets:
+* 1. what the engine can execute — {@link DataSourceCapabilities.filterOperators}
+*    (e.g. Firestore cannot run the LIKE family);
+* 2. what makes sense for the property type (e.g. no `>` on booleans);
+* 3. the developer's optional narrowing — `property.ui.filterOperators`.
+*
+* Returns an empty array when the property is not filterable (either by
+* type, or because the developer disabled it with `filterOperators: []`).
+*
+* @group Models
+*/
+function resolveFilterOperators({ property, isArray, engine }) {
+	const typeDefaults = isArray ? ARRAY_OPS : DEFAULT_OPS_BY_TYPE[property.type] ?? [];
+	if (typeDefaults.length === 0) return [];
+	const engineOps = new Set(getDataSourceCapabilities(engine).filterOperators ?? ALL_WHERE_FILTER_OPS);
+	const narrowing = property.ui?.filterOperators;
+	const narrowingSet = narrowing !== void 0 ? new Set(narrowing) : void 0;
+	return typeDefaults.filter((op) => engineOps.has(op) && (narrowingSet === void 0 || narrowingSet.has(op)));
+}
+//#endregion
 //#region src/data/resolveDataSource.ts
 /**
 * Build a keyed registry from a list of {@link DataSourceDefinition}s.
@@ -1745,7 +2412,7 @@ var CollectionRegistry = class {
 	rawCollectionsBySlug = /* @__PURE__ */ new Map();
 	rawRootCollections = [];
 	cachedRawCollectionsList = null;
-	lastRawInputSnapshot = null;
+	lastRawInputEntity = null;
 	constructor(collections, dataSources) {
 		if (dataSources) this.dataSources = dataSources;
 		if (collections) this.registerMultiple(collections);
@@ -1775,12 +2442,12 @@ var CollectionRegistry = class {
 	* Returns true if the collections have changed, false otherwise.
 	*
 	* Idempotent: compares the raw input (before normalization) against a stored
-	* snapshot. Only re-normalizes and re-registers when the raw input actually changed.
+	* entity. Only re-normalizes and re-registers when the raw input actually changed.
 	* @param collections
 	*/
 	registerMultiple(collections) {
-		const rawSnapshot = collections.map((c) => removeFunctions(c));
-		if (this.lastRawInputSnapshot && deepEqual(this.lastRawInputSnapshot, rawSnapshot)) return false;
+		const rawEntity = collections.map((c) => removeFunctions(c));
+		if (this.lastRawInputEntity && deepEqual(this.lastRawInputEntity, rawEntity)) return false;
 		this.reset();
 		collections.forEach((c) => {
 			if (c.slug) this.collectionsBySlug.set(c.slug, c);
@@ -1804,7 +2471,7 @@ var CollectionRegistry = class {
 				this._registerRecursively(this.normalizeCollection({ ...subCollection }), deepClone(subCollection));
 			});
 		});
-		this.lastRawInputSnapshot = rawSnapshot;
+		this.lastRawInputEntity = rawEntity;
 		return true;
 	}
 	register(collection, rawCollection) {
@@ -2096,6 +2763,7 @@ var defaultUsersCollection = defineCollection({
 			name: "Password Hash",
 			type: "string",
 			columnName: "password_hash",
+			excludeFromApi: true,
 			ui: {
 				hideFromCollection: true,
 				disabled: { hidden: true }
@@ -2115,6 +2783,7 @@ var defaultUsersCollection = defineCollection({
 			name: "Email Verification Token",
 			type: "string",
 			columnName: "email_verification_token",
+			excludeFromApi: true,
 			ui: {
 				hideFromCollection: true,
 				disabled: { hidden: true }
@@ -2224,7 +2893,7 @@ var QueryBuilder = class {
 	* client.collection('users').orderBy('createdAt', 'desc').find()
 	*/
 	orderBy(column, direction = "asc") {
-		this.params.orderBy = `${column}:${direction}`;
+		this.params.orderBy = [column, direction];
 		return this;
 	}
 	/**
@@ -2287,32 +2956,74 @@ var QueryBuilder = class {
 * PostgREST-style dot-syntax strings (`eq.active`, `gt.18`, `in.(a,b)`).
 * Everything else speaks `FilterValues` exclusively.
 *
+* Wire-format values are always strings — the wire format carries no type
+* metadata, so type coercion is the responsibility of the server-side data
+* driver which has access to the collection schema.
+*
+* Commas inside list values are backslash-escaped (`\,`), and literal
+* backslashes are escaped as `\\`.
+*
 * @module
 */
 /**
-* Coerce a raw querystring value to its natural JS type.
-* - `"true"` / `"false"` → boolean
-* - `"null"` → null
-* - Numeric strings → number
-* - Everything else → string (unchanged)
-*/
-function coerceValue(raw) {
-	if (raw === "true") return true;
-	if (raw === "false") return false;
-	if (raw === "null") return null;
-	if (raw !== "" && !isNaN(Number(raw))) return Number(raw);
-	return raw;
-}
-/**
 * Serialize a JS value to its querystring representation.
+* `null` is serialized as the literal string `"null"`.
+* Relation values (`EntityRelation` instances or `{ __type: "relation", id, path }`
+* objects) are serialized as their raw id — the wire format only carries the
+* value to compare against the FK column.
 */
 function stringifyValue(value) {
 	if (value === null) return "null";
-	if (typeof value === "boolean") return String(value);
+	const relation = normalizeToEntityRelation(value);
+	if (relation) return String(relation.id);
 	return String(value);
 }
 /**
-* Serialize a single condition tuple to a PostgREST dot-string.
+* Escape a single list item for the wire format.
+* `\` → `\\`, `,` → `\,`
+*/
+function escapeListItem(value) {
+	return value.replace(/\\/g, "\\\\").replace(/,/g, "\\,");
+}
+/**
+* Unescape a single list item from the wire format.
+* `\\` → `\`, `\,` → `,`
+*/
+function unescapeListItem(value) {
+	let result = "";
+	for (let i = 0; i < value.length; i++) if (value[i] === "\\" && i + 1 < value.length) {
+		result += value[i + 1];
+		i++;
+	} else result += value[i];
+	return result;
+}
+/**
+* Split a parenthesized list string on unescaped commas.
+* Input is the content between `(` and `)`.
+*
+* @example
+* splitListItems("admin,editor")          // ["admin", "editor"]
+* splitListItems("hello\\, world,foo")    // ["hello, world", "foo"]
+*/
+function splitListItems(inner) {
+	const items = [];
+	let current = "";
+	for (let i = 0; i < inner.length; i++) if (inner[i] === "\\" && i + 1 < inner.length) {
+		current += inner[i] + inner[i + 1];
+		i++;
+	} else if (inner[i] === ",") {
+		items.push(unescapeListItem(current));
+		current = "";
+	} else current += inner[i];
+	items.push(unescapeListItem(current));
+	return items;
+}
+var REST_OP_LOOKUP = REST_TO_CANONICAL;
+var CANONICAL_OP_LOOKUP = CANONICAL_TO_REST;
+/**
+* Serialize a single canonical condition tuple to a PostgREST dot-string.
+*
+* Throws `TypeError` if the input is not a valid `[WhereFilterOp, unknown]` tuple.
 *
 * @example
 * serializeTuple(["==", "active"])           // "eq.active"
@@ -2320,22 +3031,20 @@ function stringifyValue(value) {
 * serializeTuple([">=", 18])                 // "gte.18"
 */
 function serializeTuple(tuple) {
-	if (typeof tuple === "string") {
-		if (tuple.includes(".")) {
-			const dotIndex = tuple.indexOf(".");
-			if (REST_TO_CANONICAL[tuple.substring(0, dotIndex)]) return tuple;
-		}
-		return tuple;
-	}
-	if (!Array.isArray(tuple) || tuple.length !== 2 || typeof tuple[0] !== "string" || !CANONICAL_TO_REST[tuple[0]]) return `eq.${stringifyValue(tuple)}`;
+	if (!Array.isArray(tuple) || tuple.length !== 2) throw new TypeError(`serializeTuple: expected a [WhereFilterOp, value] tuple, got ${JSON.stringify(tuple)}`);
 	const [op, value] = tuple;
-	const restOp = CANONICAL_TO_REST[op];
-	if (Array.isArray(value)) return `${restOp}.(${value.map(stringifyValue).join(",")})`;
+	if (typeof op !== "string") throw new TypeError(`serializeTuple: operator must be a string, got ${typeof op}`);
+	const restOp = CANONICAL_OP_LOOKUP[op];
+	if (!restOp) throw new TypeError(`serializeTuple: unknown operator "${op}". Valid operators: ${Object.keys(CANONICAL_TO_REST).join(", ")}`);
+	if (Array.isArray(value)) return `${restOp}.(${value.map((v) => escapeListItem(stringifyValue(v))).join(",")})`;
 	return `${restOp}.${stringifyValue(value)}`;
 }
 /**
-* Convert `FilterValues` to a PostgREST-style querystring record.
+* Convert `FilterValues` (or `WireFilterValues`) to a PostgREST-style
+* querystring record.
 *
+* - Canonical `[WhereFilterOp, value]` tuples are serialized strictly.
+* - Pre-serialized PostgREST strings (e.g. `"eq.published"`) are passed through.
 * - Single conditions produce a string value.
 * - Multiple conditions on the same field produce a string array (repeated params).
 *
@@ -2345,11 +3054,19 @@ function serializeTuple(tuple) {
 *
 * serializeFilter({ age: [[">=", 18], ["<", 65]] })
 * // → { age: ["gte.18", "lt.65"] }
+*
+* // Pre-serialized strings pass through unchanged:
+* serializeFilter({ status: "eq.published" })
+* // → { status: "eq.published" }
 */
 function serializeFilter(filter) {
 	const result = {};
 	for (const [field, condition] of Object.entries(filter)) {
 		if (condition === void 0) continue;
+		if (typeof condition === "string") {
+			result[field] = condition;
+			continue;
+		}
 		if (Array.isArray(condition) && condition.length > 0 && Array.isArray(condition[0])) result[field] = condition.map(serializeTuple);
 		else result[field] = serializeTuple(condition);
 	}
@@ -2358,18 +3075,24 @@ function serializeFilter(filter) {
 /**
 * Parse a single PostgREST dot-string into a `[WhereFilterOp, unknown]` tuple.
 *
-* If the string doesn't match a known operator prefix, falls back to
+* All values are returned as strings — the wire format carries no type
+* metadata, so coercion is the data driver's responsibility.
+*
+* If the string doesn't match a known operator prefix, it falls back to
 * `["==", originalString]` (treating the whole string as an equality value).
+* This intentional defense handles values like `"user@host.com"` or
+* `"1.2.3"` that happen to contain dots.
 */
 function deserializeSingle(raw) {
 	const dotIndex = raw.indexOf(".");
-	if (dotIndex === -1) return ["==", coerceValue(raw)];
+	if (dotIndex === -1) return ["==", raw];
 	const prefix = raw.substring(0, dotIndex);
 	const rest = raw.substring(dotIndex + 1);
-	const canonicalOp = REST_TO_CANONICAL[prefix];
+	const canonicalOp = REST_OP_LOOKUP[prefix];
 	if (!canonicalOp) return ["==", raw];
-	if (rest.startsWith("(") && rest.endsWith(")")) return [canonicalOp, rest.slice(1, -1).split(",").map((s) => coerceValue(s.trim()))];
-	return [canonicalOp, coerceValue(rest)];
+	if (NULL_OPS.has(canonicalOp)) return [canonicalOp, null];
+	if (rest.startsWith("(") && rest.endsWith(")")) return [canonicalOp, splitListItems(rest.slice(1, -1))];
+	return [canonicalOp, rest];
 }
 /**
 * Convert a PostgREST-style querystring record to `FilterValues`.
@@ -2382,7 +3105,7 @@ function deserializeSingle(raw) {
 * // → { status: ["==", "active"] }
 *
 * deserializeFilter({ age: ["gte.18", "lt.65"] })
-* // → { age: [[">=", 18], ["<", 65]] }
+* // → { age: [[">=", "18"], ["<", "65"]] }
 */
 function deserializeFilter(query) {
 	const result = {};
@@ -2421,9 +3144,9 @@ function serializeLogicalCondition(cond) {
 		const inner = (cond.conditions ?? []).map(serializeLogicalCondition).join(",");
 		return `${cond.type}(${inner})`;
 	}
-	const restOp = CANONICAL_TO_REST[cond.operator] || "eq";
+	const restOp = CANONICAL_OP_LOOKUP[cond.operator] ?? "eq";
 	if (Array.isArray(cond.value)) {
-		const items = cond.value.map(stringifyValue).join(",");
+		const items = cond.value.map((v) => escapeListItem(stringifyValue(v))).join(",");
 		return `${cond.column}.${restOp}.(${items})`;
 	}
 	return `${cond.column}.${restOp}.${stringifyValue(cond.value)}`;
@@ -2471,99 +3194,149 @@ function deserializeLogicalCondition(str) {
 	if (secondDot === -1) return {
 		column,
 		operator: "==",
-		value: coerceValue(rest)
+		value: rest
 	};
 	const opStr = rest.substring(0, secondDot);
-	let valueStr = rest.substring(secondDot + 1);
+	const valueStr = rest.substring(secondDot + 1);
 	const operator = toCanonicalOp(opStr) ?? "==";
 	if (valueStr.startsWith("(") && valueStr.endsWith(")")) return {
 		column,
 		operator,
-		value: valueStr.slice(1, -1).split(",").map((s) => coerceValue(s.trim()))
+		value: splitListItems(valueStr.slice(1, -1))
 	};
 	return {
 		column,
 		operator,
-		value: coerceValue(valueStr)
+		value: valueStr
 	};
 }
 //#endregion
 //#region src/data/buildRebaseData.ts
+function createPrimaryKeyResolver(options) {
+	const cache = /* @__PURE__ */ new Map();
+	const warned = /* @__PURE__ */ new Set();
+	return function primaryKeysFor(slug) {
+		const cached = cache.get(slug);
+		if (cached) return cached;
+		const collection = options?.resolveCollection?.(slug);
+		if (!collection) return [];
+		const keys = resolvePrimaryKeys(collection);
+		if (keys.length > 0) {
+			cache.set(slug, keys);
+			return keys;
+		}
+		if (!warned.has(slug)) {
+			warned.add(slug);
+			console.warn(`[rebase] Collection '${slug}' declares no primary key, so its rows have no address: detail links, caching and relations will not work for it. Mark the key property with \`isId\` in its collection config — the server logs which column to mark at boot, if its schema knows the key.`);
+		}
+		return keys;
+	};
+}
 /**
-* Parse an orderBy string like "created_at:desc" into [field, direction].
+* Give a flat row the Entity view-model the admin renders.
+*
+* The address is *derived here* — it is not a column, and the row it came from
+* does not contain one. Rows carry exactly what the table has, with the types
+* Postgres returned; the id is this layer's invention, and this is the only
+* place it is minted.
+*
+* `primaryKeys` empty falls back to a literal `id` on the row: drivers other
+* than postgres still serve rows with one, and this keeps them working.
 */
-function parseOrderBy(orderBy) {
-	if (!orderBy) return void 0;
-	const parts = orderBy.split(":");
-	return [parts[0], parts[1] || "asc"];
+function rowToEntity(row, slug, primaryKeys = []) {
+	return {
+		id: primaryKeys.length > 0 ? buildCompositeId(row, primaryKeys) : row.id,
+		path: slug,
+		values: row
+	};
 }
-function createDriverAccessor(driver, slug) {
+function createDriverAccessor(driver, slug, getPks = () => []) {
 	const accessor = {
 		async find(params) {
-			const orderParsed = parseOrderBy(params?.orderBy);
 			const filter = params?.where ? deserializeFilter(params.where) : void 0;
-			const entities = await driver.fetchCollection({
+			const limit = params?.limit ?? 20;
+			const offset = params?.offset ?? 0;
+			const fetchService = driver.restFetchService;
+			const rows = fetchService && params?.include && params.include.length > 0 ? await fetchService.fetchCollectionForRest(slug, {
+				filter,
+				limit: params?.limit,
+				offset: params?.offset,
+				orderBy: params?.orderBy?.[0],
+				order: params?.orderBy?.[1],
+				searchString: params?.searchString
+			}, params.include) : await driver.fetchCollection({
 				path: slug,
 				limit: params?.limit,
 				offset: params?.offset,
 				filter,
-				orderBy: orderParsed?.[0],
-				order: orderParsed?.[1],
+				orderBy: params?.orderBy?.[0],
+				order: params?.orderBy?.[1],
 				searchString: params?.searchString
 			});
-			const limit = params?.limit ?? 20;
-			const offset = params?.offset ?? 0;
+			let total = rows.length + offset;
+			let hasMore = rows.length >= limit;
+			if (driver.count) {
+				total = await driver.count({
+					path: slug,
+					filter
+				});
+				hasMore = offset + rows.length < total;
+			}
 			return {
-				data: entities,
+				data: rows.map((row) => rowToEntity(row, slug, getPks())),
 				meta: {
-					total: entities.length,
+					total,
 					limit,
 					offset,
-					hasMore: entities.length >= limit
+					hasMore
 				}
 			};
 		},
 		async findById(id) {
-			return driver.fetchEntity({
+			const row = await driver.fetchOne({
 				path: slug,
-				entityId: id
+				id
 			});
+			return row ? rowToEntity(row, slug, getPks()) : void 0;
 		},
 		async create(data, id) {
-			return driver.saveEntity({
+			return rowToEntity(await driver.save({
 				path: slug,
 				values: data,
-				entityId: id,
+				id,
 				status: "new"
-			});
+			}), slug, getPks());
 		},
+		createMany: driver.saveMany ? async (data, options) => {
+			return (await driver.saveMany({
+				path: slug,
+				rows: data,
+				upsert: options?.upsert
+			})).map((row) => rowToEntity(row, slug, getPks()));
+		} : void 0,
 		async update(id, data) {
-			return driver.saveEntity({
+			return rowToEntity(await driver.save({
 				path: slug,
 				values: data,
-				entityId: id,
+				id,
 				status: "existing"
-			});
+			}), slug, getPks());
 		},
 		async delete(id) {
-			return driver.deleteEntity({ entity: {
+			return driver.delete({ row: {
 				id,
 				path: slug,
 				values: {}
 			} });
 		},
-		deleteAll: driver.deleteAll ? async () => {
-			return driver.deleteAll(slug);
-		} : void 0,
-		count: driver.countEntities ? async (params) => {
+		count: driver.count ? async (params) => {
 			const filter = params?.where ? deserializeFilter(params.where) : void 0;
-			return driver.countEntities({
+			return driver.count({
 				path: slug,
 				filter
 			});
 		} : void 0,
 		listen: driver.listenCollection ? (params, onUpdate, onError) => {
-			const orderParsed = parseOrderBy(params?.orderBy);
 			const limit = params?.limit ?? 20;
 			const offset = params?.offset ?? 0;
 			return driver.listenCollection({
@@ -2571,12 +3344,12 @@ function createDriverAccessor(driver, slug) {
 				limit: params?.limit,
 				offset: params?.offset,
 				filter: params?.where,
-				orderBy: orderParsed?.[0],
-				order: orderParsed?.[1],
+				orderBy: params?.orderBy?.[0],
+				order: params?.orderBy?.[1],
 				searchString: params?.searchString,
 				onUpdate: (entities) => {
 					onUpdate({
-						data: entities,
+						data: entities.map((row) => rowToEntity(row, slug, getPks())),
 						meta: {
 							total: entities.length,
 							limit,
@@ -2588,11 +3361,11 @@ function createDriverAccessor(driver, slug) {
 				onError
 			});
 		} : void 0,
-		listenById: driver.listenEntity ? (id, onUpdate, onError) => {
-			return driver.listenEntity({
+		listenById: driver.listenOne ? (id, onUpdate, onError) => {
+			return driver.listenOne({
 				path: slug,
-				entityId: id,
-				onUpdate: (entity) => onUpdate(entity ?? void 0),
+				id,
+				onUpdate: (entity) => onUpdate(entity ? rowToEntity(entity, slug, getPks()) : void 0),
 				onError
 			});
 		} : void 0,
@@ -2629,14 +3402,15 @@ function createDriverAccessor(driver, slug) {
 * @example
 * const data = buildRebaseData(driver);
 * await data.products.create({ name: "Camera", price: 299 });
-* const { data: items } = await data.products.find({ where: { status: "eq.published" } });
+* const { data: items } = await data.products.find({ where: { status: ["==", "published"] } });
 */
-function buildRebaseData(driver) {
+function buildRebaseData(driver, options) {
 	const cache = /* @__PURE__ */ new Map();
+	const primaryKeysFor = createPrimaryKeyResolver(options);
 	function getAccessor(slug) {
 		let accessor = cache.get(slug);
 		if (!accessor) {
-			accessor = createDriverAccessor(driver, slug);
+			accessor = createDriverAccessor(driver, slug, () => primaryKeysFor(slug));
 			cache.set(slug, accessor);
 		}
 		return accessor;
@@ -2648,6 +3422,238 @@ function buildRebaseData(driver) {
 		return getAccessor(toSnakeCase(prop));
 	} });
 }
+/**
+* Unwrap a Entity back into the flat row it was built from. `rowToEntity` keeps
+* the row untouched under `.values` and derives `.id` alongside it, so dropping
+* the wrapper is the whole operation — the address was never part of the row.
+*/
+function entityToRow(entity) {
+	return entity.values;
+}
+/**
+* Fluent query builder for the flat SDK data layer. Mirrors {@link QueryBuilder}
+* but resolves to `FindResult<M>` (flat rows) instead of Entity-wrapped
+* `FindResponse<M>`.
+*/
+var SdkQueryBuilder = class {
+	client;
+	params = { where: {} };
+	constructor(client) {
+		this.client = client;
+	}
+	where(columnOrCondition, operator, value) {
+		if (typeof columnOrCondition === "object" && columnOrCondition !== null && "type" in columnOrCondition) {
+			this.params.logical = columnOrCondition;
+			return this;
+		}
+		if (!this.params.where) this.params.where = {};
+		const column = columnOrCondition;
+		const condition = [operator, value];
+		const existing = this.params.where[column];
+		if (existing === void 0) this.params.where[column] = condition;
+		else if (Array.isArray(existing) && existing.length > 0 && Array.isArray(existing[0])) this.params.where[column].push(condition);
+		else {
+			let firstCondition;
+			if (Array.isArray(existing) && existing.length === 2 && typeof existing[0] === "string") firstCondition = existing;
+			else firstCondition = ["==", existing];
+			this.params.where[column] = [firstCondition, condition];
+		}
+		return this;
+	}
+	orderBy(column, direction = "asc") {
+		this.params.orderBy = [column, direction];
+		return this;
+	}
+	limit(count) {
+		this.params.limit = count;
+		return this;
+	}
+	offset(count) {
+		this.params.offset = count;
+		return this;
+	}
+	search(searchString) {
+		this.params.searchString = searchString;
+		return this;
+	}
+	include(...relations) {
+		this.params.include = relations;
+		return this;
+	}
+	async find() {
+		return this.client.find(this.params);
+	}
+	async count() {
+		return this.client.count ? this.client.count(this.params) : 0;
+	}
+	listen(onUpdate, onError) {
+		if (!this.client.listen) throw new Error("Listen is only available when the driver supports realtime.");
+		return this.client.listen(this.params, onUpdate, onError);
+	}
+};
+/**
+* Wrap a Entity-shaped {@link CollectionAccessor} into a flat
+* {@link SDKCollectionClient}. Every returned record is unwrapped to a flat row
+* so the backend SDK is byte-for-byte the same shape as the frontend client.
+*/
+function toSdkCollectionClient(snap) {
+	const client = {
+		async find(params) {
+			const res = await snap.find(params);
+			return {
+				data: res.data.map(entityToRow),
+				meta: res.meta
+			};
+		},
+		async findById(id) {
+			const s = await snap.findById(id);
+			return s ? entityToRow(s) : void 0;
+		},
+		async create(data, id) {
+			return entityToRow(await snap.create(data, id));
+		},
+		async createMany(data, options) {
+			if (!Array.isArray(data)) throw new TypeError("createMany expects an array of records.");
+			if (data.length === 0) return [];
+			if (!snap.createMany) throw new Error("Bulk writes are not supported by this collection's data source. Fall back to create() per record.");
+			return (await snap.createMany(data, options)).map(entityToRow);
+		},
+		async update(id, data) {
+			return entityToRow(await snap.update(id, data));
+		},
+		delete(id) {
+			return snap.delete(id);
+		},
+		count: snap.count ? (params) => snap.count(params) : void 0,
+		listen: snap.listen ? (params, onUpdate, onError) => snap.listen(params, (res) => onUpdate({
+			data: res.data.map(entityToRow),
+			meta: res.meta
+		}), onError) : void 0,
+		listenById: snap.listenById ? (id, onUpdate, onError) => snap.listenById(id, (s) => onUpdate(s ? entityToRow(s) : void 0), onError) : void 0,
+		where(columnOrCondition, operator, value) {
+			const builder = new SdkQueryBuilder(client);
+			if (typeof columnOrCondition === "object") return builder.where(columnOrCondition);
+			return builder.where(columnOrCondition, operator, value);
+		},
+		orderBy: (column, direction) => new SdkQueryBuilder(client).orderBy(column, direction),
+		limit: (count) => new SdkQueryBuilder(client).limit(count),
+		offset: (count) => new SdkQueryBuilder(client).offset(count),
+		search: (searchString) => new SdkQueryBuilder(client).search(searchString),
+		include: (...relations) => new SdkQueryBuilder(client).include(...relations)
+	};
+	return client;
+}
+/**
+* Wrap a flat {@link SDKCollectionClient} into a Entity-shaped
+* {@link CollectionAccessor}. Every returned row is re-wrapped into the
+* `{ id, path, values }` view-model the admin CMS renders.
+*/
+function toEntityAccessor(sdk, slug, getPks = () => []) {
+	const accessor = {
+		async find(params) {
+			const res = await sdk.find(params);
+			return {
+				data: res.data.map((row) => rowToEntity(row, slug, getPks())),
+				meta: res.meta
+			};
+		},
+		async findById(id) {
+			const row = await sdk.findById(id);
+			return row ? rowToEntity(row, slug, getPks()) : void 0;
+		},
+		async create(data, id) {
+			return rowToEntity(await sdk.create(data, id), slug, getPks());
+		},
+		async update(id, data) {
+			const row = await sdk.update(id, data);
+			if (!row) throw new Error(`Update returned no data for id ${id}`);
+			return rowToEntity(row, slug, getPks());
+		},
+		delete(id) {
+			return sdk.delete(id);
+		},
+		count: sdk.count ? (params) => sdk.count(params) : void 0,
+		listen: sdk.listen ? (params, onUpdate, onError) => sdk.listen(params, (res) => onUpdate({
+			data: res.data.map((row) => rowToEntity(row, slug, getPks())),
+			meta: res.meta
+		}), onError) : void 0,
+		listenById: sdk.listenById ? (id, onUpdate, onError) => sdk.listenById(id, (row) => onUpdate(row ? rowToEntity(row, slug, getPks()) : void 0), onError) : void 0,
+		where(columnOrCondition, operator, value) {
+			const builder = new QueryBuilder(accessor);
+			if (typeof columnOrCondition === "object") return builder.where(columnOrCondition);
+			return builder.where(columnOrCondition, operator, value);
+		},
+		orderBy: (column, direction) => new QueryBuilder(accessor).orderBy(column, direction),
+		limit: (count) => new QueryBuilder(accessor).limit(count),
+		offset: (count) => new QueryBuilder(accessor).offset(count),
+		search: (searchString) => new QueryBuilder(accessor).search(searchString),
+		include: (...relations) => new QueryBuilder(accessor).include(...relations)
+	};
+	return accessor;
+}
+/**
+* Wrap a flat {@link RebaseSdkData} into a Entity-shaped {@link RebaseData}.
+*
+* This is the **CMS boundary**: the SDK client (`client.data`) returns flat
+* rows, but the admin renders the `Entity` view-model (`entity.values.*`).
+* `core/Rebase.tsx` wraps `client.data` through this before handing it to the
+* CMS `RebaseDataContext` — without it the admin renders rows with only their
+* `id`.
+*/
+function wrapAsEntityData(sdkData, options) {
+	const cache = /* @__PURE__ */ new Map();
+	const primaryKeysFor = createPrimaryKeyResolver(options);
+	function getAccessor(slug) {
+		let accessor = cache.get(slug);
+		if (!accessor) {
+			accessor = toEntityAccessor(sdkData.collection(slug), slug, () => primaryKeysFor(slug));
+			cache.set(slug, accessor);
+		}
+		return accessor;
+	}
+	return new Proxy({ collection: getAccessor }, { get(_target, prop) {
+		if (prop === "collection") return getAccessor;
+		if (typeof prop === "symbol") return void 0;
+		if (prop === "then" || prop === "toJSON" || prop === "$$typeof") return void 0;
+		return getAccessor(toSnakeCase(prop));
+	} });
+}
+/**
+* Wrap a Entity-shaped {@link RebaseData} into a flat {@link RebaseSdkData}.
+*
+* Every collection accessor is adapted to return flat rows. Use this to derive
+* the flat SDK data layer (`context.data`) from an existing Entity data layer
+* — e.g. the admin routes its Entity data via `useData()` and exposes the
+* same routing as flat `context.data` for callbacks by wrapping it here.
+*/
+function wrapAsSdkData(entityData) {
+	const cache = /* @__PURE__ */ new Map();
+	function getAccessor(slug) {
+		let accessor = cache.get(slug);
+		if (!accessor) {
+			accessor = toSdkCollectionClient(entityData.collection(slug));
+			cache.set(slug, accessor);
+		}
+		return accessor;
+	}
+	return new Proxy({ collection: getAccessor }, { get(_target, prop) {
+		if (prop === "collection") return getAccessor;
+		if (typeof prop === "symbol") return void 0;
+		if (prop === "then" || prop === "toJSON" || prop === "$$typeof") return void 0;
+		return getAccessor(toSnakeCase(prop));
+	} });
+}
+/**
+* Build a flat {@link RebaseSdkData} from a `DataDriver`.
+*
+* This is the developer-facing SDK data layer used by backend framework
+* callbacks & scripts (`context.data` / `rebase.data`). It returns flat rows —
+* identical in shape to the frontend SDK client — so the API is symmetric
+* across front and back. The admin CMS uses {@link buildRebaseData} (Entity).
+*/
+function buildSdkData(driver) {
+	return wrapAsSdkData(buildRebaseData(driver));
+}
 //#endregion
 //#region src/data/buildRoutedRebaseData.ts
 /**
@@ -2692,6 +3698,57 @@ function buildRoutedRebaseData({ defaultData, sources, resolveKey }) {
 	} });
 }
 //#endregion
+//#region src/data/sort-dialect.ts
+/**
+* Sort-order wire codec.
+*
+* This is the ONLY module that knows about the colon-delimited wire format
+* (`"field:direction"`) used in HTTP query parameters.
+* Everything else speaks {@link OrderByTuple} exclusively.
+*
+* Mirrors the filter architecture in `filter-dialect.ts`.
+*
+* @module
+*/
+/**
+* Serialize an {@link OrderByTuple} to the wire format `"field:direction"`.
+*
+* **Runtime tolerance:** if the input is already a well-formed wire string
+* (from an untyped JS caller), it is returned unchanged.
+* This is undocumented tolerance, not public API — don't rely on it.
+*
+* @param orderBy - A canonical `[field, direction]` tuple, or at runtime
+*   possibly a pre-serialized string (undocumented tolerance).
+* @returns The wire-format string, or `undefined` if the input is falsy.
+*
+* @remarks
+* Field names containing `:` are representable in the tuple form but
+* **not** on the wire — this is an inherent limitation of the colon-delimited
+* encoding and is not resolved here.
+*/
+function serializeOrderBy(orderBy) {
+	if (!orderBy) return void 0;
+	if (typeof orderBy === "string") return orderBy;
+	return `${orderBy[0]}:${orderBy[1]}`;
+}
+/**
+* Deserialize a wire-format `"field:direction"` string into an {@link OrderByTuple}.
+*
+* Lenient parsing (matches existing server behaviour):
+* - Bare field name (no colon): `"name"` → `["name", "asc"]`
+* - Unknown direction: `"name:foo"` → `["name", "asc"]`
+* - Empty / falsy input: → `undefined`
+*
+* @param raw - The wire-format string from an HTTP query parameter.
+* @returns The canonical tuple, or `undefined` if the input is empty/falsy.
+*/
+function deserializeOrderBy(raw) {
+	if (!raw) return void 0;
+	const idx = raw.indexOf(":");
+	if (idx === -1) return [raw, "asc"];
+	return [raw.slice(0, idx), raw.slice(idx + 1) === "desc" ? "desc" : "asc"];
+}
+//#endregion
 //#region src/table-classification.ts
 /** Schemas that are always considered Rebase-internal. */
 var REBASE_INTERNAL_SCHEMAS = ["rebase", "auth"];
@@ -2768,6 +3825,6 @@ async function detectJunctionTables(executeSql) {
 	return junctionTables;
 }
 //#endregion
-export { COLLECTION_PATH_SEPARATOR, CollectionRegistry, DEFAULT_ONE_OF_TYPE, DEFAULT_ONE_OF_VALUE, JUNCTION_TABLES_SQL, QueryBuilder, REBASE_INTERNAL_PREFIXES, REBASE_INTERNAL_SCHEMAS, addInitialSlash, and, applyPropertyConditions, buildAdditionalFieldDelegate, buildCollection, buildConditionContext, buildEntityCallbacks, buildEnum, buildEnumValueConfig, buildProperties, buildPropertiesOrBuilder, buildProperty, buildPropertyCallbacks, buildRebaseData, buildRoutedRebaseData, canCreateEntity, canDeleteEntity, canEditEntity, canReadCollection, checkOperation, classifyTable, cond, createDataSourceRegistry, createRelationRef, createRelationRefWithData, defaultUsersCollection, defineCollection, deserializeFilter, deserializeLogicalCondition, detectJunctionTables, enumToObjectEntries, evaluateCondition, evaluatePolicy, findRelation, fullPathToCollectionSegments, getArrayResolvedProperties, getCollectionBySlugWithin, getCollectionPathsCombinations, getColumnName, getDefaultValueFor, getDefaultValueFortype, getDefaultValuesFor, getEntityImagePreviewPropertyKey, getEnumVarName, getLabelOrConfigFrom, getLastSegment, getLocalChangesBackup, getNavigationEntriesFromPath, getParentReferencesFromPath, getPrimaryKeys, getReferenceFrom, getRelationFrom, getSubcollections, getTableName, getTableVarName, isHidden, isPropertyBuilder, isReadOnly, isRebaseInternalTable, normalizeToEntityRelation, or, policyToPostgres, registerConditionOperations, removeInitialAndTrailingSlashes, removeInitialSlash, removeTrailingSlash, resolveArrayProperties, resolveCollectionPathIds, resolveCollectionRelations, resolveDataSource, resolveDefaultSelectedView, resolveEnumValues, resolveProperties, resolveProperty, resolvePropertyEnum, resolvePropertyRelation, resolveRelationProperty, resolveStorageFilenameString, resolveStoragePathString, resolveStorageSource, sanitizeData, sanitizeRelation, securityRuleToConditions, segmentsToStrippedPath, serializeFilter, serializeLogicalCondition, sortProperties, stripCollectionPath, traverseValueProperty, traverseValuesProperties, updateDateAutoValues };
+export { COLLECTION_PATH_SEPARATOR, COMPOSITE_ID_SEPARATOR, CollectionRegistry, DEFAULT_ONE_OF_TYPE, DEFAULT_ONE_OF_VALUE, JUNCTION_TABLES_SQL, QueryBuilder, REBASE_INTERNAL_PREFIXES, REBASE_INTERNAL_SCHEMAS, addInitialSlash, and, applyPropertyConditions, buildCollection, buildCompositeId, buildConditionContext, buildProperty, buildPropertyCallbacks, buildRebaseData, buildRoutedRebaseData, buildSdkData, canCreateEntity, canDeleteEntity, canEditEntity, canReadCollection, checkOperation, classifyTable, cond, createDataSourceRegistry, createRelationRef, createRelationRefWithData, defaultUsersCollection, defineCollection, deserializeFilter, deserializeLogicalCondition, deserializeOrderBy, detectJunctionTables, embedParentExpression, enumToObjectEntries, evaluateCondition, evaluatePolicy, findAnonymousGrants, findRelation, fullPathToCollectionSegments, getArrayResolvedProperties, getCollectionBySlugWithin, getCollectionPathsCombinations, getColumnName, getDeclaredPrimaryKeys, getDefaultValueFor, getDefaultValueFortype, getDefaultValuesFor, getEffectiveSecurityRules, getEntityImagePreviewPropertyKey, getEnumVarName, getInjectedSecurityRules, getJunctionCollectionConfig, getJunctionSecurityRules, getLabelOrConfigFrom, getLastSegment, getLocalChangesBackup, getNavigationEntriesFromPath, getParentReferencesFromPath, getPrimaryKeys, getReferenceFrom, getRelationFrom, getSubcollections, getTableName, getTableVarName, isHidden, isPropertyBuilder, isReadOnly, isRebaseInternalTable, normalizeToEntityRelation, or, parseIdValues, policyToPostgres, registerConditionOperations, removeInitialAndTrailingSlashes, removeInitialSlash, removeTrailingSlash, resolveArrayProperties, resolveCollectionPathIds, resolveCollectionRelations, resolveDataSource, resolveDefaultSelectedView, resolveEnumValues, resolveFilterOperators, resolveJunctionSpecs, resolvePrimaryKeys, resolveProperties, resolveProperty, resolvePropertyEnum, resolvePropertyRelation, resolveRelationProperty, resolveStorageFilenameString, resolveStoragePathString, resolveStorageSource, sanitizeData, sanitizeRelation, securityRuleToConditions, segmentsToStrippedPath, serializeFilter, serializeLogicalCondition, serializeOrderBy, sortProperties, sqlToPolicy, stripCollectionPath, traverseValueProperty, traverseValuesProperties, updateDateAutoValues, wrapAsEntityData, wrapAsSdkData };
 
 //# sourceMappingURL=index.es.js.map