@rebasepro/common 0.8.0 → 0.9.1-canary.09aaf62

package/dist/util/auth-default-policies.d.ts

@@ -0,0 +1,22 @@
+import { CollectionConfig, SecurityRule } from "@rebasepro/types";
+/**
+ * Returns the security rules that should be applied to a collection: the
+ * author's explicit `securityRules` plus the framework defaults described in
+ * the module doc (baseline server/admin read for all collections; self-read
+ * and the admin write gate for auth collections).
+ *
+ * Collections that opt out via `disableDefaultPolicies` are returned unchanged.
+ */
+export declare function getEffectiveSecurityRules(collection: CollectionConfig): SecurityRule[];
+/**
+ * The framework defaults that {@link getEffectiveSecurityRules} would add to a
+ * collection, without the author's own rules.
+ *
+ * These policies appear in the database under names the author never wrote, and
+ * a permissive policy ORs with every other permissive policy — so someone
+ * reading their `securityRules` and then the real ACL sees more access than they
+ * declared. Dropping them by hand does nothing either: `db push` is declarative,
+ * so the next push asserts them again. Callers use this to say, in the generated
+ * DDL, which policies are injected and how to take them off.
+ */
+export declare function getInjectedSecurityRules(collection: CollectionConfig): SecurityRule[];

package/dist/util/builders.d.ts

@@ -1,11 +1,14 @@
-import { AdditionalFieldDelegate, ArrayProperty, BooleanProperty, DateProperty, EntityCallbacks, EntityCollection, EnumValueConfig, EnumValues, FirebaseCollection, FirebaseProperties, GeopointProperty, InferEntityType, MapProperty, MongoDBCollection, MongoProperties, NumberProperty, PostgresCollection, PostgresProperties, Properties, Property, ReferenceProperty, StringProperty, User } from "@rebasepro/types";
+import { ArrayProperty, BooleanProperty, DateProperty, CollectionConfig, FirebaseCollectionConfig, FirebaseProperties, GeopointProperty, InferEntityType, MapProperty, MongoDBCollectionConfig, MongoProperties, NumberProperty, PostgresCollectionConfig, PostgresProperties, Property, ReferenceProperty, StringProperty, User } from "@rebasepro/types";
 /**
- * Identity function we use to defeat the type system of Typescript and build
- * collection views with all its properties
- * @param collection
+ * @deprecated Use {@link defineCollection} instead — it infers property
+ * types automatically (autocomplete on `titleProperty`, `sort`,
+ * `propertiesOrder`, callbacks) without manual generics.
+ * `buildCollection` is kept for FireCMS migration compatibility and will
+ * be removed before 1.0.
+ *
  * @group Builder
  */
-export declare function buildCollection<M extends Record<string, unknown> = Record<string, unknown>, USER extends User = User>(collection: EntityCollection<M, USER>): EntityCollection<M, USER>;
+export declare function buildCollection<M extends Record<string, unknown> = Record<string, unknown>, USER extends User = User>(collection: CollectionConfig<M, USER>): CollectionConfig<M, USER>;
 /**
  * Define a PostgreSQL-backed collection with full type inference.
  *
@@ -30,75 +33,35 @@ export declare function buildCollection<M extends Record<string, unknown> = Reco
  *
  * @group Builder
  */
-export declare function defineCollection<const P extends PostgresProperties, USER extends User = User>(collection: Omit<PostgresCollection<InferEntityType<P>, USER>, "properties"> & {
+export declare function defineCollection<const P extends PostgresProperties, USER extends User = User>(collection: Omit<PostgresCollectionConfig<InferEntityType<P>, USER>, "properties"> & {
     properties: P;
-}): PostgresCollection<InferEntityType<P>, USER> & {
+}): PostgresCollectionConfig<InferEntityType<P>, USER> & {
     properties: P;
 };
 /**
  * Define a Firestore-backed collection with full type inference.
  * @group Builder
  */
-export declare function defineCollection<const P extends FirebaseProperties, USER extends User = User>(collection: Omit<FirebaseCollection<InferEntityType<P>, USER>, "properties"> & {
+export declare function defineCollection<const P extends FirebaseProperties, USER extends User = User>(collection: Omit<FirebaseCollectionConfig<InferEntityType<P>, USER>, "properties"> & {
     properties: P;
-}): FirebaseCollection<InferEntityType<P>, USER> & {
+}): FirebaseCollectionConfig<InferEntityType<P>, USER> & {
     properties: P;
 };
 /**
  * Define a MongoDB-backed collection with full type inference.
  * @group Builder
  */
-export declare function defineCollection<const P extends MongoProperties, USER extends User = User>(collection: Omit<MongoDBCollection<InferEntityType<P>, USER>, "properties"> & {
+export declare function defineCollection<const P extends MongoProperties, USER extends User = User>(collection: Omit<MongoDBCollectionConfig<InferEntityType<P>, USER>, "properties"> & {
     properties: P;
-}): MongoDBCollection<InferEntityType<P>, USER> & {
+}): MongoDBCollectionConfig<InferEntityType<P>, USER> & {
     properties: P;
 };
 /**
- * Identity function we use to defeat the type system of Typescript and preserve
- * the property keys.
- * @param property
+ * @deprecated Use plain typed property objects with {@link defineCollection}
+ * instead — `defineCollection` infers property types automatically, making
+ * this wrapper unnecessary. `buildProperty` is kept for FireCMS migration
+ * compatibility and will be removed before 1.0.
+ *
  * @group Builder
  */
 export declare function buildProperty<T, P extends Property = Property>(property: P): P extends StringProperty ? StringProperty : P extends NumberProperty ? NumberProperty : P extends BooleanProperty ? BooleanProperty : P extends DateProperty ? DateProperty : P extends GeopointProperty ? GeopointProperty : P extends ReferenceProperty ? ReferenceProperty : P extends ArrayProperty ? ArrayProperty : P extends MapProperty ? MapProperty : never;
-/**
- * Identity function we use to defeat the type system of Typescript and preserve
- * the properties keys.
- * @param properties
- * @group Builder
- */
-export declare function buildProperties<M extends Record<string, unknown>>(properties: Properties): Properties;
-/**
- * Identity function we use to defeat the type system of Typescript and preserve
- * the properties keys.
- * @param propertiesOrBuilder
- * @group Builder
- */
-export declare function buildPropertiesOrBuilder<M extends Record<string, unknown>>(propertiesOrBuilder: Properties): Properties;
-/**
- * Identity function we use to defeat the type system of Typescript and preserve
- * the properties keys.
- * @param enumValues
- * @group Builder
- */
-export declare function buildEnum(enumValues: EnumValues): EnumValues;
-/**
- * Identity function we use to defeat the type system of Typescript and preserve
- * the properties keys.
- * @param enumValueConfig
- * @group Builder
- */
-export declare function buildEnumValueConfig(enumValueConfig: EnumValueConfig): EnumValueConfig;
-/**
- * Identity function we use to defeat the type system of Typescript and preserve
- * the properties keys.
- * @param callbacks
- * @group Builder
- */
-export declare function buildEntityCallbacks<M extends Record<string, unknown> = Record<string, unknown>>(callbacks: EntityCallbacks<M>): EntityCallbacks<M>;
-/**
- * Identity function we use to defeat the type system of Typescript and build
- * additional field delegates views with all its properties
- * @param additionalFieldDelegate
- * @group Builder
- */
-export declare function buildAdditionalFieldDelegate<M extends Record<string, unknown>, USER extends User = User>(additionalFieldDelegate: AdditionalFieldDelegate<M, USER>): AdditionalFieldDelegate<M, USER>;

package/dist/util/callbacks.d.ts

@@ -1,4 +1,4 @@
-import { EntityCallbacks, Properties, RebaseCallContext } from "@rebasepro/types";
+import { CollectionCallbacks, Properties, RebaseCallContext } from "@rebasepro/types";
 /**
  * Context passed to entity lifecycle callbacks.
  * @group Models
@@ -6,6 +6,6 @@ import { EntityCallbacks, Properties, RebaseCallContext } from "@rebasepro/types
 export type EntityCallbackContext = RebaseCallContext;
 /**
  * Helper function to extract field-level PropertyCallbacks from a properties schema
- * and wrap them into an EntityCallbacks object recursively.
+ * and wrap them into an CollectionCallbacks object recursively.
  */
-export declare const buildPropertyCallbacks: (properties: Properties) => EntityCallbacks | undefined;
+export declare const buildPropertyCallbacks: (properties: Properties) => CollectionCallbacks | undefined;

package/dist/util/collections.d.ts

@@ -1,11 +1,11 @@
-import { DefaultSelectedViewBuilder, DefaultSelectedViewParams, EntityCollection, Properties } from "@rebasepro/types";
+import { DefaultSelectedViewBuilder, DefaultSelectedViewParams, CollectionConfig, Properties } from "@rebasepro/types";
 export declare function sortProperties<M extends Record<string, unknown>>(properties: Properties, propertiesOrder?: string[]): Properties;
 export declare function resolveDefaultSelectedView(defaultSelectedView: string | DefaultSelectedViewBuilder | undefined, params: DefaultSelectedViewParams): string | undefined;
-export declare function getLocalChangesBackup(collection: EntityCollection): "manual_apply" | "auto_apply";
+export declare function getLocalChangesBackup(collection: CollectionConfig): "manual_apply" | "auto_apply";
 /**
- * Returns the primary keys for an entity collection by inspecting the properties
+ * Returns the primary keys for a entity collection by inspecting the properties
  * and finding any properties with `isId`.
  * Fallbacks to `["id"]` if no properties are marked as `isId: true`.
  * @param collection
  */
-export declare function getPrimaryKeys<M extends Record<string, unknown>>(collection: EntityCollection<M>): Extract<keyof M, string>[];
+export declare function getPrimaryKeys<M extends Record<string, unknown>>(collection: CollectionConfig<M>): Extract<keyof M, string>[];

package/dist/util/entities.d.ts

@@ -6,7 +6,7 @@ export declare function getDefaultValuesFor<M extends Record<string, unknown>>(p
 export declare function getDefaultValueFor(property?: Property): unknown;
 export declare function getDefaultValueFortype(type: DataType): unknown;
 /**
- * Update the automatic values in an entity before save
+ * Update the automatic values in a entity before save
  * @group Driver
  */
 export declare function updateDateAutoValues<M extends Record<string, unknown>>({ inputValues, properties, status, timestampNowValue }: {
@@ -16,7 +16,7 @@ export declare function updateDateAutoValues<M extends Record<string, unknown>>(
     timestampNowValue: unknown;
 }): EntityValues<M>;
 /**
- * Add missing required fields, expected in the collection, to the values of an entity
+ * Add missing required fields, expected in the collection, to the values of a entity
  * @param values
  * @param properties
  * @group Driver

package/dist/util/filter-operator-resolution.d.ts

@@ -0,0 +1,32 @@
+import { Property, WhereFilterOp } from "@rebasepro/types";
+export interface ResolveFilterOperatorsParams {
+    /**
+     * The property to filter on. For array properties, pass the **item**
+     * property (`property.of`) together with `isArray: true` — the same
+     * convention the filter field dispatchers use.
+     */
+    property: Property;
+    /** True when filtering an array of `property`. */
+    isArray?: boolean;
+    /**
+     * The engine backing the collection (`collection.engine`, e.g.
+     * `"postgres"`, `"firestore"`). Falls back to the default engine's
+     * capabilities when omitted.
+     */
+    engine?: string;
+}
+/**
+ * Resolve which filter operators the UI should offer for a property.
+ *
+ * The result is the **intersection** of three sets:
+ * 1. what the engine can execute — {@link DataSourceCapabilities.filterOperators}
+ *    (e.g. Firestore cannot run the LIKE family);
+ * 2. what makes sense for the property type (e.g. no `>` on booleans);
+ * 3. the developer's optional narrowing — `property.ui.filterOperators`.
+ *
+ * Returns an empty array when the property is not filterable (either by
+ * type, or because the developer disabled it with `filterOperators: []`).
+ *
+ * @group Models
+ */
+export declare function resolveFilterOperators({ property, isArray, engine }: ResolveFilterOperatorsParams): WhereFilterOp[];

package/dist/util/identity.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Row identity: the address of a row, and how to derive it.
+ *
+ * Postgres has no `id`. A row is identified by its primary key — one or more
+ * columns, with any names and any types. `id` is something we synthesize on top
+ * of that: a single string token, because the admin needs *one* value it can put
+ * in a URL (`/products/1:::2`), use as a cache key, and hang a relation ref off.
+ *
+ * That token is an address, not data. It is derived from the row's columns and
+ * never stored in them — a row is exactly its columns, with their real types.
+ * Writing the address back into the row is what used to rename primary keys
+ * (`sku` → `id`) and restringify them (`42` → `"42"`) on the way out.
+ *
+ * These live in `common` because both sides need them and must agree exactly:
+ * the driver parses an incoming address back into key columns, and the admin
+ * derives the address from a row it was served.
+ */
+/**
+ * A primary-key column: its name, the type it round-trips as, and whether it is
+ * a UUID (which is a string despite sometimes being described as an id "number").
+ */
+export interface PrimaryKeyInfo {
+    fieldName: string;
+    type: "string" | "number";
+    isUUID?: boolean;
+}
+/** Separator between the parts of a composite address. */
+export declare const COMPOSITE_ID_SEPARATOR = ":::";
+/**
+ * Derive a row's address from its key columns.
+ *
+ * Single key → the value as a string. Composite → each part joined by
+ * {@link COMPOSITE_ID_SEPARATOR}, in primary-key order, which is what
+ * {@link parseIdValues} expects to invert.
+ */
+export declare function buildCompositeId(values: Record<string, unknown>, primaryKeys: PrimaryKeyInfo[]): string;
+/**
+ * Invert {@link buildCompositeId}: turn an address back into key columns, each
+ * coerced to the type its column actually round-trips as.
+ *
+ * This is the boundary where a URL segment becomes a query parameter, so a
+ * malformed address must throw rather than silently produce a query that
+ * matches the wrong row (or none).
+ */
+export declare function parseIdValues(idValue: string | number, primaryKeys: PrimaryKeyInfo[]): Record<string, string | number>;
+/**
+ * The primary keys of a collection, as declared by its properties.
+ *
+ * This is the only tier both sides can read, because it is the only one written
+ * in the config: the postgres driver can also infer keys from the Drizzle
+ * schema, which the browser never sees and is never sent — the admin compiles
+ * the collection files into its own bundle rather than being served them. A key
+ * that lives only in the Drizzle schema is therefore invisible here, and the
+ * server says so at boot (`warnOnKeysTheAdminCannotResolve`) naming the `isId`
+ * to add.
+ *
+ * Returns an empty array when a collection declares none, which callers must
+ * treat as "not addressable" rather than defaulting to `id`: guessing a key
+ * that is not the real one produces confidently wrong addresses.
+ */
+export declare function getDeclaredPrimaryKeys(collection: {
+    properties?: Record<string, unknown>;
+}): PrimaryKeyInfo[];
+/**
+ * The keys to address a collection's rows with, resolved the way the driver
+ * resolves them — minus the tier the browser cannot reach.
+ *
+ * The postgres driver tries, in order: properties marked `isId`; the primary
+ * keys of the Drizzle schema; and finally a column literally named `id`. Only
+ * the first and last are visible in a `CollectionConfig`, which is what both
+ * sides share.
+ *
+ * So the two agree except on a collection that declares no `isId` and whose key
+ * is known only to Drizzle. There, the driver reads the real key, and this
+ * either resolves nothing (reported to the console by the caller) or — if the
+ * table happens to have an unrelated `id` property — resolves `id`, which is
+ * the wrong key and cannot be detected from here: the addresses look right and
+ * route wrong. Only the config can settle it, so the server names both cases
+ * at boot (`warnOnKeysTheAdminCannotResolve`) with the `isId` to add.
+ */
+export declare function resolvePrimaryKeys(collection: {
+    properties?: Record<string, unknown>;
+}): PrimaryKeyInfo[];

package/dist/util/index.d.ts

@@ -1,6 +1,7 @@
 export * from "./collections";
 export * from "./common";
 export * from "./entities";
+export * from "./identity";
 export * from "./enums";
 export * from "./paths";
 export * from "./resolutions";
@@ -13,5 +14,8 @@ export * from "./builders";
 export * from "./storage";
 export * from "./callbacks";
 export * from "./relations";
+export * from "./auth-default-policies";
+export * from "./junction-policies";
 export * from "./conditions";
 export * from "./navigation_utils";
+export * from "./filter-operator-resolution";

package/dist/util/junction-policies.d.ts

@@ -0,0 +1,108 @@
+import { CollectionConfig, PolicyExpression, Relation, SecurityRule } from "@rebasepro/types";
+/**
+ * RLS derivation for many-to-many junction tables.
+ *
+ * A `through` relation makes the generator create a table nobody declared as a
+ * collection — `posts_tags`, `user_roles`. Those tables used to be the one kind
+ * of generated table with **no** RLS at all: `rebase_user` holds full DML grants,
+ * so with the endpoints locked down, any signed-up user could still read or wipe
+ * every edge between them. There is also nowhere in the config to write rules
+ * for a junction, so the author could not even fix it by hand.
+ *
+ * The architecture here is that a junction's security is *derived*, never
+ * hand-written:
+ *
+ *  1. **Locked baseline.** The same server-or-admin `default_admin` grants every
+ *     collection gets, so the invariant holds again: every table the generator
+ *     creates is default-deny, and rules only broaden.
+ *
+ *  2. **Reads follow the endpoints.** An edge is visible iff *both* endpoint
+ *     rows are visible — two correlated `EXISTS` subqueries. The subqueries run
+ *     under the caller's role, so each endpoint's own RLS filters them: junction
+ *     visibility delegates to the endpoints' policies, whatever they become,
+ *     with nothing duplicated. A public blog keeps rendering its tags; a private
+ *     CRM's edges are exactly as hidden as its rows.
+ *
+ *  3. **Writes follow the owning side's update rules.** Linking or unlinking an
+ *     edge *is* an edit of the owning row — tagging a post is editing the post —
+ *     so edge writes inherit the declaring collection's explicit permissive
+ *     `update` rules, each wrapped in an `EXISTS` against the owning row. Where
+ *     a rule cannot be embedded faithfully (see below) it is dropped, so the
+ *     failure mode is always *too locked*, never open. Explicit **restrictive**
+ *     update rules are inherited as restrictive junction rules; if one of them
+ *     cannot be embedded, the whole derived write grant for that side is
+ *     suppressed — granting without the author's gate would be looser than the
+ *     parent itself.
+ *
+ * **Embeddability.** A parent rule is embedded by moving its condition inside
+ * `EXISTS (SELECT 1 FROM parent WHERE parent.pk = junction.fk AND <condition>)`.
+ * In that scope, `field` operands bind to the parent — which is what the author
+ * meant. But `outerField` operands and `{column}` placeholders in `raw` SQL bind
+ * to the RLS row, which is now the junction, not the parent the author wrote
+ * them against. So: `raw` anywhere disqualifies a rule; a top-level `outerField`
+ * (equivalent to `field` outside a subquery) is rewritten to `field`; an
+ * `outerField` inside a nested `existsIn` cannot be re-scoped and disqualifies
+ * the rule.
+ *
+ * Injected parent defaults are never inherited — the junction's own baseline
+ * already covers the server/admin plane, and an auth collection's restrictive
+ * `require_admin_write` gate exists to protect privileged parent *columns*,
+ * which an edge write cannot touch. Inheriting it would stop users managing
+ * e.g. their own interests through a `users_interests` junction for no gain.
+ *
+ * Everything flows through the shared naming machinery, so the Studio
+ * recognises these policies as generated instead of offering to "import" them.
+ */
+/** One side of a junction: the collection and the FK column pointing at it. */
+export interface JunctionEndpoint {
+    collection: CollectionConfig;
+    /** Junction column holding this endpoint's key. */
+    junctionColumn: string;
+}
+/** A collection that declares the `through` relation (owns the edge semantics). */
+export interface JunctionDeclaringSide extends JunctionEndpoint {
+    relation: Relation;
+}
+export interface JunctionSpec {
+    /** Bare table name (schema stripped). */
+    table: string;
+    /** Schema the junction is created in — mirrors the CREATE TABLE path. */
+    schema: string;
+    /** The two endpoints, in [source, target] order of the first declaring relation. */
+    endpoints: [JunctionEndpoint, JunctionEndpoint];
+    /** Every collection that declares a relation through this table. */
+    declaringSides: JunctionDeclaringSide[];
+}
+/**
+ * Walk every collection's resolved relations and aggregate the junction tables
+ * they declare. Two collections may declare the same junction from opposite
+ * sides (posts→tags and tags→posts through `posts_tags`); both become
+ * `declaringSides` of one spec, so derived write grants consider both.
+ */
+export declare function resolveJunctionSpecs(collections: CollectionConfig[]): Map<string, JunctionSpec>;
+/**
+ * A synthetic CollectionConfig standing in for the junction during policy
+ * compilation and naming. Its two FK columns carry explicit `columnName`s so
+ * `outerField` operands resolve to the exact columns the CREATE TABLE emitted,
+ * whatever their casing.
+ */
+export declare function getJunctionCollectionConfig(spec: JunctionSpec): CollectionConfig;
+/**
+ * Whether a parent-rule expression keeps its meaning when moved inside the
+ * junction's `EXISTS` subquery — and the re-scoped copy if it does.
+ *
+ * Returns `null` when the rule cannot be embedded faithfully: `raw` SQL
+ * anywhere (its `{column}` placeholders would bind to the junction), or an
+ * `outerField` inside a nested `existsIn` (it would bind to the junction while
+ * the author meant the parent, and no operand can express "the middle scope").
+ * Top-level `outerField`s are rewritten to `field`, which is what they meant.
+ */
+export declare function embedParentExpression(expr: PolicyExpression, depth?: number): PolicyExpression | null;
+/**
+ * The full derived policy set for a junction table: the locked server/admin
+ * baseline, the endpoint-visibility read grant, inherited write grants, and
+ * inherited restrictive gates. Returns `[]` when every declaring collection set
+ * `disableDefaultPolicies` — the junction is then the author's to police, and
+ * stays locked (RLS is still enabled) until they write policies for it.
+ */
+export declare function getJunctionSecurityRules(spec: JunctionSpec): SecurityRule[];

package/dist/util/navigation_from_path.d.ts

@@ -1,4 +1,4 @@
-import { EntityCollection } from "@rebasepro/types";
+import { CollectionConfig } from "@rebasepro/types";
 type EntityCustomView<M extends Record<string, unknown> = Record<string, unknown>> = {
     key: string;
     [key: string]: unknown;
@@ -9,14 +9,14 @@ export interface NavigationViewEntityInternal<M extends Record<string, unknown>>
     entityId: string | number;
     slug: string;
     path: string;
-    parentCollection: EntityCollection<M>;
+    parentCollection: CollectionConfig<M>;
 }
 export interface NavigationViewCollectionInternal<M extends Record<string, unknown>> {
     type: "collection";
     id: string;
     slug: string;
     path: string;
-    collection: EntityCollection<M>;
+    collection: CollectionConfig<M>;
 }
 export interface NavigationViewEntityCustomInternal<M extends Record<string, unknown>> {
     type: "custom_view";
@@ -27,7 +27,7 @@ export interface NavigationViewEntityCustomInternal<M extends Record<string, unk
 }
 export declare function getNavigationEntriesFromPath(props: {
     path: string;
-    collections: EntityCollection[] | undefined;
+    collections: CollectionConfig[] | undefined;
     currentFullPath?: string;
     contextEntityViews?: EntityCustomView[];
 }): NavigationViewInternal[];

package/dist/util/navigation_utils.d.ts

@@ -1,17 +1,17 @@
-import { EntityCollection } from "@rebasepro/types";
+import { CollectionConfig } from "@rebasepro/types";
 export declare function removeInitialAndTrailingSlashes(s: string): string;
 export declare function removeInitialSlash(s: string): string;
 export declare function removeTrailingSlash(s: string): string;
 export declare function addInitialSlash(s: string): string;
 export declare function getLastSegment(path: string): string;
-export declare function resolveCollectionPathIds(path: string, allCollections: EntityCollection[]): string;
+export declare function resolveCollectionPathIds(path: string, allCollections: CollectionConfig[]): string;
 /**
  * Find the corresponding view at any depth for a given path.
  * Note that path or segments of the paths can be collection aliases.
  * @param slugOrPath
  * @param collections
  */
-export declare function getCollectionBySlugWithin(slugOrPath: string, collections: EntityCollection[]): EntityCollection | undefined;
+export declare function getCollectionBySlugWithin(slugOrPath: string, collections: CollectionConfig[]): CollectionConfig | undefined;
 /**
  * Get the subcollection combinations from a path:
  * "sites/es/locales" => ["sites/es/locales", "sites"]

package/dist/util/parent_references_from_path.d.ts

@@ -1,6 +1,6 @@
-import { EntityCollection, EntityReference } from "@rebasepro/types";
+import { CollectionConfig, EntityReference } from "@rebasepro/types";
 export declare function getParentReferencesFromPath(props: {
     path: string;
-    collections: EntityCollection[] | undefined;
+    collections: CollectionConfig[] | undefined;
     currentFullPath?: string;
 }): EntityReference[];

package/dist/util/permissions.d.ts

@@ -1,4 +1,4 @@
-import { Entity, EntityCollection, SecurityOperation, User } from "@rebasepro/types";
+import { Entity, CollectionConfig, SecurityOperation, User } from "@rebasepro/types";
 /**
  * Minimal auth context for permission checking.
  * Only requires the user object — avoids forcing callers to construct
@@ -31,8 +31,8 @@ export interface CheckOperationOptions {
  *   client-side (raw SQL, or row predicates with no row). Defaults to `"allow"`
  *   for optimistic UI gating; enforcement callers should pass `"deny"`.
  */
-export declare function checkOperation<M extends Record<string, unknown>, USER extends User>(collection: EntityCollection<M>, authContext: AuthContext<USER>, entity: Entity<M> | null, targetOperation: SecurityOperation, options?: CheckOperationOptions): boolean;
-export declare function canReadCollection<M extends Record<string, unknown>, USER extends User>(collection: EntityCollection<M>, authContext: AuthContext<USER>): boolean;
-export declare function canEditEntity<M extends Record<string, unknown>, USER extends User>(collection: EntityCollection<M>, authContext: AuthContext<USER>, path: string, entity: Entity<M> | null): boolean;
-export declare function canCreateEntity<M extends Record<string, unknown>, USER extends User>(collection: EntityCollection<M>, authContext: AuthContext<USER>, path: string, entity: Entity<M> | null): boolean;
-export declare function canDeleteEntity<M extends Record<string, unknown>, USER extends User>(collection: EntityCollection<M>, authContext: AuthContext<USER>, path: string, entity: Entity<M> | null): boolean;
+export declare function checkOperation<M extends Record<string, unknown>, USER extends User>(collection: CollectionConfig<M>, authContext: AuthContext<USER>, entity: Entity<M> | null, targetOperation: SecurityOperation, options?: CheckOperationOptions): boolean;
+export declare function canReadCollection<M extends Record<string, unknown>, USER extends User>(collection: CollectionConfig<M>, authContext: AuthContext<USER>): boolean;
+export declare function canEditEntity<M extends Record<string, unknown>, USER extends User>(collection: CollectionConfig<M>, authContext: AuthContext<USER>, path: string, entity: Entity<M> | null): boolean;
+export declare function canCreateEntity<M extends Record<string, unknown>, USER extends User>(collection: CollectionConfig<M>, authContext: AuthContext<USER>, path: string, entity: Entity<M> | null): boolean;
+export declare function canDeleteEntity<M extends Record<string, unknown>, USER extends User>(collection: CollectionConfig<M>, authContext: AuthContext<USER>, path: string, entity: Entity<M> | null): boolean;

package/dist/util/policy/evaluatePolicy.d.ts

@@ -13,7 +13,14 @@ export type TriState = boolean | "unknown";
  * being evaluated (or none, for collection-level gating).
  */
 export interface PolicyEvalContext {
-    /** The current user's id, or null/undefined when unauthenticated. */
+    /**
+     * The current user's id, or null/undefined when no user is signed in.
+     *
+     * Null here means *anonymous visitor*, not "server context" — a client is
+     * never the server context. `authUid` operands therefore resolve to
+     * {@link ANONYMOUS_USER_ID} rather than `null`, matching the `auth.uid()`
+     * the database would see for the same request.
+     */
     uid?: string | null;
     /** The current user's application roles. */
     roles?: string[];

package/dist/util/policy/index.d.ts

@@ -1,3 +1,4 @@
 export * from "./securityRuleToConditions";
+export * from "./sqlToPolicy";
 export * from "./policyToPostgres";
 export * from "./evaluatePolicy";

package/dist/util/policy/policyToPostgres.d.ts

@@ -1,4 +1,16 @@
-import { EntityCollection, PolicyExpression } from "@rebasepro/types";
+import { CollectionConfig, PolicyExpression } from "@rebasepro/types";
+/**
+ * Options for {@link policyToPostgres}.
+ */
+export interface PolicyCompileOptions {
+    /**
+     * Resolve a collection by slug. Required to compile
+     * {@link ExistsInPolicyExpression} (`policy.existsIn`) — the compiler needs
+     * the joined collection to derive its table name / schema. When omitted, the
+     * join table falls back to a snake_cased slug.
+     */
+    resolveCollection?: (slug: string) => CollectionConfig | undefined;
+}
 /**
  * Compiles a {@link PolicyExpression} to a PostgreSQL boolean SQL string,
  * suitable for a `USING (...)` / `WITH CHECK (...)` clause.
@@ -7,4 +19,4 @@ import { EntityCollection, PolicyExpression } from "@rebasepro/types";
  * {@link evaluatePolicy}); the Postgres schema generators call it so that DDL
  * and the admin UI derive from the exact same expression.
  */
-export declare function policyToPostgres(expr: PolicyExpression, collection?: EntityCollection): string;
+export declare function policyToPostgres(expr: PolicyExpression, collection?: CollectionConfig, options?: PolicyCompileOptions): string;

package/dist/util/policy/sqlToPolicy.d.ts

@@ -1,20 +1,30 @@
 import { PolicyExpression } from "@rebasepro/types";
+export declare function sqlToPolicy(sql: string): PolicyExpression;
+/** A clause that reads as a lockdown but admits anonymous callers. */
+export interface AnonymousGrantRisk {
+    /** Which spelling was found. */
+    pattern: "foreign-uid-literal" | "uid-not-null";
+    /** The offending fragment — the literal, or the SQL that is a tautology. */
+    detail: string;
+    /** Why it admits anonymous callers, and what to write instead. */
+    explanation: string;
+}
 /**
- * A tiny, regex-based SQL "parser" for security rules.
+ * Find clauses that read as "signed-in users only" but admit anonymous callers.
+ *
+ * Both spellings come from the same place — Supabase, where `auth.uid()` really
+ * is NULL for an anonymous request. Rebase substitutes
+ * {@link ANONYMOUS_USER_ID} instead (a blank id would read back as NULL, which
+ * is how the trusted *server* context is recognised), so:
  *
- * This is NOT a full SQL parser. It is designed to handle the subset of SQL
- * commonly used in `USING` and `WITH CHECK` clauses, enough to drive the
- * optimistic client-side UI decision.
+ *  - `auth.uid() IS NOT NULL` is a tautology on the user path, and
+ *  - `auth.uid() != 'anon'` compares against a string no caller ever has.
  *
- * It handles:
- * - `field = 'literal'`
- * - `field != 'literal'`
- * - `field = current_setting('app.user_id')`
- * - `A AND B`
- * - `true`
- * - `IN (...)` (as optimistic true)
+ * Either one turns a lockdown into a full grant, and neither looks wrong. No
+ * real user id is ever one of these literals, and a user-context request is
+ * never NULL, so a match is always a mistake rather than a deliberate check.
  *
- * For anything it doesn't understand, it returns a `raw` expression, which
- * the evaluator treats as "unknown" (and usually optimistic true).
+ * Structured expressions are checked too, not just parsed SQL: `policy.compare`
+ * can spell the same mistake.
  */
-export declare function sqlToPolicy(sql: string): PolicyExpression;
+export declare function findAnonymousGrants(expr: PolicyExpression): AnonymousGrantRisk[];

package/dist/util/references.d.ts

@@ -1,2 +1,2 @@
-import { EntityCollection } from "@rebasepro/types";
-export declare function getEntityImagePreviewPropertyKey<M extends Record<string, unknown>>(collection: EntityCollection<M>): string | undefined;
+import { CollectionConfig } from "@rebasepro/types";
+export declare function getEntityImagePreviewPropertyKey<M extends Record<string, unknown>>(collection: CollectionConfig<M>): string | undefined;

package/dist/util/relations.d.ts

@@ -1,12 +1,12 @@
-import { EntityCollection, Property, Relation } from "@rebasepro/types";
-export declare function sanitizeRelation(relation: Partial<Relation>, sourceCollection: EntityCollection, resolveCollection?: (slugOrTable: string) => EntityCollection | undefined): Relation;
-export declare function resolveCollectionRelations(collection: EntityCollection): Record<string, Relation>;
+import { CollectionConfig, Property, Relation } from "@rebasepro/types";
+export declare function sanitizeRelation(relation: Partial<Relation>, sourceCollection: CollectionConfig, resolveCollection?: (slugOrTable: string) => CollectionConfig | undefined): Relation;
+export declare function resolveCollectionRelations(collection: CollectionConfig): Record<string, Relation>;
 export declare function resolvePropertyRelation({ propertyKey, property, sourceCollection }: {
     propertyKey: string;
     property: Property;
-    sourceCollection: EntityCollection;
+    sourceCollection: CollectionConfig;
 }): Relation | undefined;
-export declare function getTableName(collection: EntityCollection): string;
+export declare function getTableName(collection: CollectionConfig): string;
 export declare function getTableVarName(tableName: string): string;
 export declare function getEnumVarName(tableName: string, propName: string): string;
 export declare function getColumnName(fullColumn: string): string;