@rebasepro/server-postgres 0.13.0 → 0.13.1-canary.g27a562a

package/dist/PostgresBackendDriver.d.ts

@@ -3,7 +3,7 @@ import { BranchService } from "./services/BranchService";
 import { RealtimeService } from "./services/realtimeService";
 import { DatabasePoolManager } from "./databasePoolManager";
 import { DrizzleClient } from "./interfaces";
-import { DatabaseAdmin, DataDriver, DeleteProps, CollectionConfig, FetchCollectionProps, FetchOneProps, ListenCollectionProps, ListenOneProps, RebaseClient, RebaseSdkData, RestFetchService, SaveManyProps, SaveProps, TableMetadata, User } from "@rebasepro/types";
+import { DatabaseAdmin, DataDriver, DeleteProps, CollectionConfig, FetchCollectionProps, FetchOneProps, ListenCollectionProps, ListenOneProps, RebaseClient, RebaseSdkData, RestFetchService, SaveManyProps, SaveProps, UpdateManyProps, DeleteManyProps, TableMetadata, User } from "@rebasepro/types";
 import { PostgresCollectionRegistry } from "./collections/PostgresCollectionRegistry";
 import { HistoryService } from "./history/HistoryService";
 export declare class PostgresBackendDriver implements DataDriver {
@@ -62,6 +62,25 @@ export declare class PostgresBackendDriver implements DataDriver {
      * REST/SDK read leaks unmasked data (see {@link applyAfterReadForRest}).
      */
     get restFetchService(): RestFetchService;
+    /**
+     * Build the context handed to every collection callback.
+     *
+     * Note `data: this.data` — `this` is whichever driver is running the
+     * operation, so the callback's data plane inherits that driver's privilege.
+     * On a user request `AuthenticatedPostgresBackendDriver.withTransaction`
+     * constructs a fresh base driver bound to the RLS-scoped transaction and
+     * runs the operation on it, so `this.data` speaks through that connection
+     * and policies apply. On server-context work `this` is the base driver on
+     * the owner connection, and they do not. Pinned by the
+     * `"scopes context.data to the caller"` case in the `rls-enforcement` e2e
+     * suite, because it is the kind of property that is easy to break from a
+     * distance and impossible to notice.
+     *
+     * Previously returned through `as unknown as RebaseCallContext`, which
+     * disabled checking for the whole object and let `driver` — documented in
+     * the callbacks guide — sit on the runtime context while absent from the
+     * contract. Both are declared now, so this is a plain typed return.
+     */
     private buildCallContext;
     private resolveCollectionCallbacks;
     /**
@@ -102,6 +121,34 @@ export declare class PostgresBackendDriver implements DataDriver {
      * with the last write winning, exactly as separate calls would.
      */
     saveMany<M extends Record<string, unknown>>({ path, rows, collection, upsert }: SaveManyProps<M>): Promise<Record<string, unknown>[]>;
+    /**
+     * Update many rows through the same pipeline as {@link save}, in one
+     * transaction.
+     *
+     * Structurally the mirror of {@link saveMany} — same tx-bound sub-driver,
+     * same deferred notifications, same per-row error labelling — but it calls
+     * `save` with an explicit `id` and `status: "existing"`, which is precisely
+     * what `saveMany` cannot do: that one passes `status: "new"` and keeps the
+     * key inside `values`, so it inserts or upserts and can never target a
+     * particular row.
+     *
+     * All-or-nothing, so an id matching no row aborts the batch. A partial
+     * update is the outcome with no good recovery: the caller cannot tell which
+     * half landed without re-reading everything.
+     */
+    updateMany<M extends Record<string, unknown>>({ path, updates, collection }: UpdateManyProps<M>): Promise<Record<string, unknown>[]>;
+    /**
+     * Delete many rows in one transaction, running the full delete pipeline —
+     * `beforeDelete`, the delete, `afterDelete` — for each.
+     *
+     * Looping the single-row {@link delete} rather than emitting one
+     * `DELETE ... WHERE id = ANY($1)` is the deliberate choice: a single
+     * statement would be faster and would skip every callback, so a collection
+     * relying on `beforeDelete` to veto or on `afterDelete` to clean up
+     * dependents would behave differently depending on how many rows the caller
+     * happened to delete at once. Same pipeline, one transaction.
+     */
+    deleteMany<M extends Record<string, unknown>>({ path, ids, collection }: DeleteManyProps<M>): Promise<void>;
     delete<M extends Record<string, unknown>>({ row, collection }: DeleteProps<M>): Promise<void>;
     deleteAll(path: string): Promise<void>;
     checkUniqueField(path: string, name: string, value: unknown, id?: string, collection?: CollectionConfig): Promise<boolean>;

package/dist/{src-DlPBctw_.js → auth-users-columns-Do9mw5Y5.js}

@@ -2,8 +2,8 @@ import { createRequire as __createRequire } from "module";
 import "process";
 __createRequire(import.meta.url);
 import { l as __require, s as __commonJSMin } from "./connection-BuZ97wsr.js";
-import { a as getDataSourceCapabilities, c as toCanonicalOp, n as isPostgresCollectionConfig, o as NULL_OPS, r as isRelationalCollectionConfig, s as REST_TO_CANONICAL, t as getDeclaredSubcollections } from "./src-DoU9yPqq.js";
-import { n as ANONYMOUS_USER_IDS, r as policy, t as ANONYMOUS_USER_ID } from "./policy-CeA1JcxP.js";
+import { a as rewriteLegacyRlsFunctions, c as isPostgresCollectionConfig, d as getDataSourceCapabilities, f as NULL_OPS, i as RLS_UID_SQL, l as isRelationalCollectionConfig, m as toCanonicalOp, p as REST_TO_CANONICAL, r as RLS_ROLES_SQL, s as getDeclaredSubcollections } from "./src-C_wvdMnl.js";
+import { n as ANONYMOUS_USER_IDS, r as policy, t as ANONYMOUS_USER_ID } from "./policy-CPkCqVTz.js";
 //#region ../types/src/types/entities.ts
 /**
 * Class used to create a reference to a entity in a different path
@@ -55,6 +55,25 @@ function hasForeignKeyOnTarget(relation) {
 function isManyToMany(relation) {
 	return relation.kind === "manyToMany";
 }
+/**
+* Resolve a client-supplied list `limit` into a safe, always-defined value.
+*
+* - A provided limit is coerced to an integer and clamped to `[1, maxLimit]`,
+*   so `0`, negatives, and absurd values can never bypass the cap.
+* - An absent / blank / non-numeric limit falls back to the mode default:
+*   `vectorDefaultLimit` for a vector search, otherwise `defaultLimit`.
+*
+* The return is never `undefined` — no ingress that routes its client limit
+* through this can produce an unbounded read.
+*/
+function resolveClientListLimit(rawLimit, opts = {}) {
+	const maxLimit = opts.maxLimit ?? 1e3;
+	if (rawLimit != null && String(rawLimit).trim() !== "") {
+		const parsed = typeof rawLimit === "number" ? rawLimit : parseInt(String(rawLimit), 10);
+		if (Number.isFinite(parsed)) return Math.min(Math.max(1, Math.floor(parsed)), maxLimit);
+	}
+	return opts.vectorSearch ? opts.vectorDefaultLimit ?? 10 : opts.defaultLimit ?? 50;
+}
 //#endregion
 //#region ../common/src/util/common.ts
 var DEFAULT_ONE_OF_TYPE = "type";
@@ -1007,6 +1026,35 @@ function camelCase(str) {
 	});
 })))();
 /**
+* Segments that reach the prototype chain rather than a property of the object.
+*
+* The twin of this function in `@rebasepro/forms` could be made to write onto
+* `Object.prototype` through a path of `__proto__.x`. This copy survives the
+* write by accident — its `clone` always spreads into a fresh object, while the
+* form engine's has a "preserve class instances" branch that hands back
+* `Object.prototype` itself — but `getIn` still *reads* through the chain, and
+* handing back `Object.prototype` is how a polluted value is read out again.
+*
+* Closed on both sides here, so the two implementations agree.
+*/
+var UNSAFE_PATH_SEGMENTS = /* @__PURE__ */ new Set([
+	"__proto__",
+	"constructor",
+	"prototype"
+]);
+/**
+* Whether writing this single key with `obj[key] = …` would reach the prototype
+* chain instead of creating a property.
+*
+* The single-key counterpart of {@link pathTraversesPrototype}, for the many
+* places that copy an object one key at a time. `JSON.parse` creates
+* `__proto__` as an *own* property, so it survives `hasOwnProperty` — and then
+* `target[key] = value` invokes the setter and replaces the target's prototype.
+*/
+function isPrototypePollutingKey(key) {
+	return UNSAFE_PATH_SEGMENTS.has(key);
+}
+/**
 * Deep clone a value, preserving function references and class instances.
 * Unlike structuredClone, this handles objects that contain functions
 * (e.g. CollectionConfig with target(), childCollections(), callbacks).
@@ -1383,10 +1431,21 @@ function updateDateAutoValues({ inputValues, properties, status, timestampNowVal
 * have `id` and `path` fields — these are relation-shaped objects from
 * edge cases in the data pipeline (REST fallback, stale cache, custom data source).
 *
+* When `targetPath` is given, also accepts a bare id. A relation column is a
+* foreign key, and the REST layer returns it as the scalar it is; only some
+* fetch paths hydrate it into an object. Which form a caller sees therefore
+* depends on how the row was loaded, and a caller that only accepted objects
+* reported half of its own data as a type error. The declared target is the
+* missing half: with it, an id is a relation that has not been fetched yet.
+*
 * Returns null if the value cannot be coerced.
 */
-function normalizeToEntityRelation(value, propertyType) {
+function normalizeToEntityRelation(value, propertyType, targetPath) {
 	if (value instanceof EntityRelation) return value;
+	if (targetPath && (typeof value === "string" || typeof value === "number")) {
+		if (value === "") return null;
+		return new EntityRelation(value, targetPath);
+	}
 	if (!value || typeof value !== "object" || Array.isArray(value)) return null;
 	const obj = value;
 	if (!(obj.__type === "relation" || obj.__type === "reference" || typeof obj.isEntityRelation === "function" && obj.isEntityRelation() || typeof obj.isEntityReference === "function" && obj.isEntityReference() || propertyType === "relation" && typeof obj.id !== "undefined" && typeof obj.path === "string")) return null;
@@ -1924,9 +1983,9 @@ function isKeywordAt(upper, i, keyword) {
 *
 * This used to be `sql.split(/ AND /i)`, which tore subqueries in half: the
 * `AND` inside
-*   `EXISTS (SELECT 1 FROM organization_members m WHERE m.org = t.org AND m.user_id = auth.uid())`
+*   `EXISTS (SELECT 1 FROM organization_members m WHERE m.org = t.org AND m.user_id = rebase.uid())`
 * split the expression, and re-emitting the halves produced
-*   `(EXISTS (...) AND m.user_id = auth.uid())`
+*   `(EXISTS (...) AND m.user_id = rebase.uid())`
 * where `m` is no longer in scope — SQL that Postgres rejects outright with
 * "missing FROM-clause entry for table". Returning null instead keeps such a
 * clause as a `raw` expression, which round-trips verbatim.
@@ -2000,15 +2059,15 @@ function stripOuterParens(sql) {
 	}
 }
 function sqlToPolicy(sql) {
-	const trimmed = stripOuterParens(sql.trim());
+	const trimmed = stripOuterParens(rewriteLegacyRlsFunctions(sql).trim());
 	if (trimmed.toLowerCase() === "true") return policy.true();
 	if (trimmed.toLowerCase() === "false") return policy.false();
-	const overlapMatch = trimmed.match(/^string_to_array\s*\(\s*auth\.roles\(\)\s*,\s*','\s*\)\s*&&\s*ARRAY\s*\[(.+)\]$/i);
+	const overlapMatch = trimmed.match(/^string_to_array\s*\(\s*rebase\.roles\(\)\s*,\s*','\s*\)\s*&&\s*ARRAY\s*\[(.+)\]$/i);
 	if (overlapMatch) {
 		const roles = overlapMatch[1].split(",").map((s) => s.trim().replace(/^'|'$/g, ""));
 		return policy.rolesOverlap(roles);
 	}
-	const containMatch = trimmed.match(/^string_to_array\s*\(\s*auth\.roles\(\)\s*,\s*','\s*\)\s*@>\s*ARRAY\s*\[(.+)\]$/i);
+	const containMatch = trimmed.match(/^string_to_array\s*\(\s*rebase\.roles\(\)\s*,\s*','\s*\)\s*@>\s*ARRAY\s*\[(.+)\]$/i);
 	if (containMatch) {
 		const roles = containMatch[1].split(",").map((s) => s.trim().replace(/^'|'$/g, ""));
 		return policy.rolesContain(roles);
@@ -2024,10 +2083,10 @@ function sqlToPolicy(sql) {
 		const right = parseOperand(rightStr.trim());
 		if (left && right) return policy.compare(left, op === "=" ? "eq" : "neq", right);
 	}
-	return policy.raw(sql);
+	return policy.raw(trimmed);
 }
 /**
-* Literals from other BaaS platforms that people compare `auth.uid()` against
+* Literals from other BaaS platforms that people compare `rebase.uid()` against
 * out of habit. Mirrors the driver's `FOREIGN_CONVENTION_ROLES` guard on
 * `pgRoles`, one surface over: the same muscle memory inside a `using:` string
 * is the more dangerous spelling, because it inverts a rule instead of
@@ -2038,18 +2097,25 @@ var FOREIGN_CONVENTION_UIDS = {
 	authenticated: "Supabase",
 	service_role: "Supabase"
 };
-/** `auth.uid() IS NOT NULL` in raw SQL, the clause that is always true. */
-var UID_NOT_NULL = /auth\.uid\(\)\s+IS\s+NOT\s+NULL/i;
+/**
+* `rebase.uid() IS NOT NULL` in raw SQL, the clause that is always true.
+*
+* Both schema spellings, because this runs over policy bodies read back from a
+* database, and one migrated by a pre-1.0 release still holds `auth.uid()`.
+* A security check that stops recognising a dangerous clause because the
+* framework renamed a function is a check that silently turns off.
+*/
+var UID_NOT_NULL = /\b(?:rebase|auth)\.uid\(\)\s+IS\s+NOT\s+NULL/i;
 /**
 * Find clauses that read as "signed-in users only" but admit anonymous callers.
 *
-* Both spellings come from the same place — Supabase, where `auth.uid()` really
-* is NULL for an anonymous request. Rebase substitutes
+* Both spellings come from the same place — Supabase, where its own `auth.uid()`
+* really is NULL for an anonymous request. Rebase substitutes
 * {@link ANONYMOUS_USER_ID} instead (a blank id would read back as NULL, which
 * is how the trusted *server* context is recognised), so:
 *
-*  - `auth.uid() IS NOT NULL` is a tautology on the user path, and
-*  - `auth.uid() != 'anon'` excludes one spelling of anonymous and admits the
+*  - `rebase.uid() IS NOT NULL` is a tautology on the user path, and
+*  - `rebase.uid() != 'anon'` excludes one spelling of anonymous and admits the
 *    other. This one is not hypothetical and was not only a foreign habit:
 *    rebase's own request path reported `'anon'` while everything that compiled
 *    or checked a policy used `'anonymous'`, so whichever literal an author
@@ -2081,7 +2147,7 @@ function findAnonymousGrants(expr) {
 				if (UID_NOT_NULL.test(e.sql)) found.push({
 					pattern: "uid-not-null",
 					detail: e.sql,
-					explanation: `\`auth.uid() IS NOT NULL\` is true for every request that came from a client, including anonymous ones — they carry '${ANONYMOUS_USER_ID}', not NULL. Use \`condition: policy.authenticated()\` to mean "signed in".`
+					explanation: `\`rebase.uid() IS NOT NULL\` is true for every request that came from a client, including anonymous ones — they carry '${ANONYMOUS_USER_ID}', not NULL. Use \`condition: policy.authenticated()\` to mean "signed in".`
 				});
 				return;
 			case "compare": {
@@ -2103,7 +2169,7 @@ function findAnonymousGrants(expr) {
 	return found;
 }
 function parseOperand(str) {
-	if (/current_setting\s*\(\s*'app\.(uid|user_id)'\s*\)/i.test(str) || /auth\.uid\(\)/i.test(str)) return policy.authUid();
+	if (/current_setting\s*\(\s*'app\.(uid|user_id)'\s*\)/i.test(str) || /rebase\.uid\(\)/i.test(str)) return policy.authUid();
 	const stringMatch = str.match(/^'(.+)'$/);
 	if (stringMatch) return policy.literal(stringMatch[1]);
 	if (/^\w+$/.test(str)) return policy.field(str);
@@ -2185,12 +2251,12 @@ function compile(expr, scope) {
 			const rightSql = castForAuthUid(expr.right, operandToSql(expr.right, scope), expr.left);
 			return `${leftSql} ${COMPARE_SQL[expr.op]} ${rightSql}`;
 		}
-		case "rolesOverlap": return `string_to_array(auth.roles(), ',') && ${rolesArraySql(expr.roles)}`;
-		case "rolesContain": return `string_to_array(auth.roles(), ',') @> ${rolesArraySql(expr.roles)}`;
-		case "authenticated": return `auth.uid() IS NOT NULL AND auth.uid() NOT IN (${ANONYMOUS_USER_IDS.map(quoteLiteral).join(", ")})`;
-		case "serverContext": return "auth.uid() IS NULL";
+		case "rolesOverlap": return `string_to_array(${RLS_ROLES_SQL}, ',') && ${rolesArraySql(expr.roles)}`;
+		case "rolesContain": return `string_to_array(${RLS_ROLES_SQL}, ',') @> ${rolesArraySql(expr.roles)}`;
+		case "authenticated": return `${RLS_UID_SQL} IS NOT NULL AND ${RLS_UID_SQL} NOT IN (${ANONYMOUS_USER_IDS.map(quoteLiteral).join(", ")})`;
+		case "serverContext": return `${RLS_UID_SQL} IS NULL`;
 		case "existsIn": return compileExistsIn(expr, scope);
-		case "raw": return expr.sql.replace(/\{(\w+)\}/g, (_, col) => `${outerQualifier(scope)}${resolveColumnName(col, scope.outerCollection)}`);
+		case "raw": return rewriteLegacyRlsFunctions(expr.sql).replace(/\{(\w+)\}/g, (_, col) => `${outerQualifier(scope)}${resolveColumnName(col, scope.outerCollection)}`);
 	}
 }
 /**
@@ -2227,8 +2293,8 @@ function operandToSql(operand, scope) {
 		case "field": return `${scope.fieldPrefix}${resolveColumnName(operand.name, scope.fieldCollection)}`;
 		case "outerField": return `${scope.outerPrefix}${resolveColumnName(operand.name, scope.outerCollection)}`;
 		case "literal": return quoteLiteral(operand.value);
-		case "authUid": return "auth.uid()";
-		case "authRoles": return "string_to_array(auth.roles(), ',')";
+		case "authUid": return RLS_UID_SQL;
+		case "authRoles": return `string_to_array(${RLS_ROLES_SQL}, ',')`;
 	}
 }
 /**
@@ -2308,7 +2374,7 @@ var DEFAULT_GUARDED_OPS = [
 	"delete"
 ];
 /** Whether a collection is flagged as an authentication collection. */
-function isAuthCollection(collection) {
+function isAuthCollection$1(collection) {
 	const auth = collection.auth;
 	return auth === true || typeof auth === "object" && auth?.enabled === true;
 }
@@ -2341,7 +2407,7 @@ function getEffectiveSecurityRules(collection) {
 		condition: SERVER_OR_ADMIN_EXPR$1,
 		check: SERVER_OR_ADMIN_EXPR$1
 	});
-	if (isAuthCollection(collection)) {
+	if (isAuthCollection$1(collection)) {
 		injected.push({
 			name: `${tableName}_default_self_read`,
 			operations: ["select"],
@@ -3308,6 +3374,46 @@ function resolveDataSource(collection, registry) {
 		capabilities: getDataSourceCapabilities(engine)
 	};
 }
+/**
+* Does a SQL toolchain own this collection's storage?
+*
+* "Owns the storage" means: something generates a table for it, pushes that
+* table to a database, plans its RLS policies, and reports it as drifted when
+* the two disagree. That is true of a Postgres collection and false of a
+* Firestore or MongoDB one, whose documents live in a store Rebase never
+* migrates — and the two were never told apart. Every stage of the SQL
+* toolchain took "the collections" to mean *all* of them, so a Firestore
+* collection declared next to the Postgres ones got a `pgTable` in the
+* generated schema, a `CREATE TABLE` at boot, RLS policies, and a place in the
+* `db push` include list — where its name shielding a same-named real table
+* from Atlas's exclude list is the one that can lose data.
+*
+* The answer is the resolved engine's {@link DataSourceCapabilities}, not a
+* name check: an engine registered through `registerDataSourceCapabilities`
+* gets the same treatment as the built-in ones.
+*
+* Deliberately answers **true** for an engine nobody has heard of. Build-time
+* tooling (the CLI, the schema generator) has no data-source registry to
+* resolve a `dataSource` key against, so an unknown key resolves to an unknown
+* engine — and the cost of the two mistakes is not symmetric. Wrongly
+* including a collection generates a table nothing writes to; wrongly excluding
+* one silently stops generating a table the app is serving from. Declare
+* `engine` on a collection that is not SQL-backed and this is exact.
+*/
+function isRelationalCollection(collection, registry) {
+	return getDataSourceCapabilities(collection?.engine ?? (collection?.dataSource ? resolveDataSource(collection, registry).engine : void 0)).supportsRelations;
+}
+/**
+* The subset of `collections` a SQL toolchain owns — see
+* {@link isRelationalCollection}.
+*
+* Every stage that generates SQL from collections starts by calling this, so
+* the rule lives in one place rather than being re-decided per generator. It
+* keeps the input order.
+*/
+function relationalCollections(collections, registry) {
+	return collections.filter((collection) => isRelationalCollection(collection, registry));
+}
 //#endregion
 //#region ../common/src/collections/CollectionRegistry.ts
 var CollectionRegistry = class {
@@ -3660,6 +3766,30 @@ var RebasePaginationError = class RebasePaginationError extends Error {
 		Object.setPrototypeOf(this, RebasePaginationError.prototype);
 	}
 };
+/**
+* Resolve `limit`/`offset`/`page` into the window a read will actually use.
+*
+* Lives here, next to the walk, for the reason at the top of this file: every
+* transport has to mean the same thing by "page two". Four of them did not —
+* the REST layer strode by {@link DEFAULT_LIST_LIMIT}, the local-first
+* evaluator by {@link DEFAULT_PAGE_SIZE}, the in-process accessor by 20, and
+* the published type documented a fourth number. Pages that overlap or skip
+* rows are the mildest of those outcomes.
+*
+* `page` wins over `offset`, as {@link FindParams} documents. `driverOffset`
+* is the value to hand a driver: it stays `undefined` when the caller named no
+* offset, because keyset pagination seeks with a `where` clause and must not
+* look like it is paging by offset.
+*/
+function resolveFindWindow(params) {
+	const limit = params?.limit ?? 50;
+	const offset = params?.page != null ? Math.max(0, (params.page - 1) * limit) : params?.offset ?? 0;
+	return {
+		limit,
+		offset,
+		driverOffset: params?.page != null ? offset : params?.offset
+	};
+}
 function normalizePageSize(raw) {
 	if (raw === void 0 || !Number.isFinite(raw)) return 200;
 	return Math.max(1, Math.floor(raw));
@@ -3955,21 +4085,22 @@ function createDriverAccessor(driver, slug, getPks = () => []) {
 	const accessor = {
 		async find(params) {
 			const filter = params?.where ? deserializeFilter(params.where) : void 0;
-			const limit = params?.limit ?? 20;
-			const offset = params?.offset ?? 0;
+			const { limit, offset, driverOffset } = resolveFindWindow(params);
 			const fetchService = driver.restFetchService;
 			const rows = fetchService ? await fetchService.fetchCollectionForRest(slug, {
 				filter,
-				limit: params?.limit,
-				offset: params?.offset,
+				logical: params?.logical,
+				limit,
+				offset: driverOffset,
 				orderBy: params?.orderBy?.[0],
 				order: params?.orderBy?.[1],
 				searchString: params?.searchString
 			}, params?.include) : await driver.fetchCollection({
 				path: slug,
-				limit: params?.limit,
-				offset: params?.offset,
+				limit,
+				offset: driverOffset,
 				filter,
+				logical: params?.logical,
 				orderBy: params?.orderBy?.[0],
 				order: params?.orderBy?.[1],
 				searchString: params?.searchString
@@ -3979,7 +4110,9 @@ function createDriverAccessor(driver, slug, getPks = () => []) {
 			if (driver.count) {
 				total = await driver.count({
 					path: slug,
-					filter
+					filter,
+					logical: params?.logical,
+					searchString: params?.searchString
 				});
 				hasMore = offset + rows.length < total;
 			}
@@ -4031,22 +4164,39 @@ function createDriverAccessor(driver, slug, getPks = () => []) {
 				values: {}
 			} });
 		},
+		updateMany: driver.updateMany ? async (updates) => {
+			return (await driver.updateMany({
+				path: slug,
+				updates: updates.map((u) => ({
+					id: u.id,
+					values: u.data
+				}))
+			})).map((row) => rowToEntity(row, slug, getPks()));
+		} : void 0,
+		deleteMany: driver.deleteMany ? async (ids) => {
+			await driver.deleteMany({
+				path: slug,
+				ids
+			});
+		} : void 0,
 		count: driver.count ? async (params) => {
 			const filter = params?.where ? deserializeFilter(params.where) : void 0;
 			return driver.count({
 				path: slug,
-				filter
+				filter,
+				logical: params?.logical,
+				searchString: params?.searchString
 			});
 		} : void 0,
 		listen: driver.listenCollection ? (params, onUpdate, onError) => {
-			const limit = params?.limit ?? 20;
-			const offset = params?.offset ?? 0;
+			const { limit, offset, driverOffset } = resolveFindWindow(params);
 			const normalize = driver.restFetchService ? inlineRelationRefs : (row) => row;
 			return driver.listenCollection({
 				path: slug,
-				limit: params?.limit,
-				offset: params?.offset,
+				limit,
+				offset: driverOffset,
 				filter: params?.where,
+				logical: params?.logical,
 				orderBy: params?.orderBy?.[0],
 				order: params?.orderBy?.[1],
 				searchString: params?.searchString,
@@ -4054,7 +4204,7 @@ function createDriverAccessor(driver, slug, getPks = () => []) {
 					onUpdate({
 						data: entities.map((row) => rowToEntity(normalize(row), slug, getPks())),
 						meta: {
-							total: entities.length,
+							total: offset + entities.length,
 							limit,
 							offset,
 							hasMore: entities.length >= limit
@@ -4231,9 +4381,24 @@ function toSdkCollectionClient(snap, slug = "collection") {
 		async update(id, data) {
 			return entityToRow(await snap.update(id, data));
 		},
+		async updateMany(updates) {
+			if (!Array.isArray(updates)) throw new TypeError("updateMany expects an array of { id, data } entries.");
+			if (updates.length === 0) return [];
+			if (!snap.updateMany) throw new Error("Bulk updates are not supported by this collection's data source. Fall back to update() per record.");
+			return (await snap.updateMany(updates.map((u) => ({
+				id: u.id,
+				data: u.data
+			})))).map(entityToRow);
+		},
 		delete(id) {
 			return snap.delete(id);
 		},
+		async deleteMany(ids) {
+			if (!Array.isArray(ids)) throw new TypeError("deleteMany expects an array of ids.");
+			if (ids.length === 0) return;
+			if (!snap.deleteMany) throw new Error("Bulk deletes are not supported by this collection's data source. Fall back to delete() per record.");
+			await snap.deleteMany(ids);
+		},
 		count: snap.count ? (params) => snap.count(params) : void 0,
 		listen: snap.listen ? (params, onUpdate, onError) => snap.listen(params, (res) => onUpdate({
 			data: res.data.map(entityToRow),
@@ -4294,6 +4459,117 @@ function buildSdkData(driver) {
 	return wrapAsSdkData(buildRebaseData(driver));
 }
 //#endregion
-export { toSnakeCase as A, normalizeToEntityRelation as C, getPolicyNamesForRule as D, legacyForeignKeyName as E, Vector as F, DEFAULT_ONE_OF_VALUE as M, hasForeignKeyOnTarget as N, mergeDeep as O, isManyToMany as P, createRelationRefWithData as S, generateForeignKeyName as T, buildCompositeId as _, getJunctionSecurityRules as a, parseIdValues as b, policyToPostgres as c, findRelation as d, getColumnName as f, resolveCollectionRelations as g, getTableVarName as h, getJunctionCollectionConfig as i, DEFAULT_ONE_OF_TYPE as j, camelCase as k, securityRuleToConditions as l, getTableName as m, CollectionRegistry as n, resolveJunctionSpecs as o, getEnumVarName as p, resolveStringColumnLength as r, getEffectiveSecurityRules as s, buildSdkData as t, findAnonymousGrants as u, getDeclaredPrimaryKeys as v, updateDateAutoValues as w, createRelationRef as x, isAddressableId as y };
+//#region src/schema/auth-users-columns.ts
+/**
+* `email` is NOT NULL on purpose, and the anonymous sign-in route depends on it
+* — it synthesizes `anon_<32 hex>@anonymous.local` rather than inserting NULL.
+* The 320-char bound (RFC 5321) is a CHECK rather than a `VARCHAR(n)`, added
+* separately by `ensureAuthTablesExist` so it can be `NOT VALID` on an adopted
+* table that already holds a longer row.
+*/
+var AUTH_USERS_COLUMNS = [
+	{
+		column: "email",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		column: "display_name",
+		type: "TEXT"
+	},
+	{
+		column: "photo_url",
+		type: "TEXT"
+	},
+	{
+		column: "roles",
+		type: "TEXT[]",
+		default: "'{}'",
+		notNull: true
+	},
+	{
+		column: "password_hash",
+		type: "TEXT"
+	},
+	{
+		column: "email_verified",
+		type: "BOOLEAN",
+		default: "FALSE",
+		notNull: true
+	},
+	{
+		column: "email_verification_token",
+		type: "TEXT"
+	},
+	{
+		column: "email_verification_sent_at",
+		type: "TIMESTAMP WITH TIME ZONE"
+	},
+	{
+		column: "is_anonymous",
+		type: "BOOLEAN",
+		default: "FALSE",
+		notNull: true
+	},
+	{
+		column: "metadata",
+		type: "JSONB",
+		default: "'{}'",
+		notNull: true
+	},
+	{
+		column: "tokens_valid_after",
+		type: "TIMESTAMP WITH TIME ZONE"
+	},
+	{
+		column: "created_at",
+		type: "TIMESTAMP WITH TIME ZONE",
+		default: "NOW()",
+		notNull: true
+	},
+	{
+		column: "updated_at",
+		type: "TIMESTAMP WITH TIME ZONE",
+		default: "NOW()",
+		notNull: true
+	}
+];
+var BY_COLUMN = new Map(AUTH_USERS_COLUMNS.map((c) => [c.column, c]));
+/** Type + inline constraints, as they appear after the column name. */
+function authUsersColumnSql(spec) {
+	return [
+		spec.type,
+		spec.default !== void 0 ? `DEFAULT ${spec.default}` : "",
+		spec.notNull ? "NOT NULL" : ""
+	].filter(Boolean).join(" ");
+}
+/**
+* The auth-owned definition for a physical column name, or `undefined` when
+* auth does not own it.
+*
+* Callers pass the RESOLVED column name (after `columnName` mapping), because
+* that is the only name the three creators agree on: the scaffold's users
+* collection spells the property `displayName` and the column `display_name`.
+*/
+function authUsersColumnDefinition(column) {
+	const spec = BY_COLUMN.get(column);
+	return spec ? authUsersColumnSql(spec) : void 0;
+}
+/**
+* Whether a collection is an auth collection, i.e. whether the definitions in
+* this module apply to its table at all.
+*
+* Duplicated in shape from `@rebasepro/common`'s policy defaults on purpose:
+* that one takes a `CollectionConfig`, this one is called from DDL code paths
+* that hold looser objects, and both spellings must accept `auth: true` as well
+* as `auth: { enabled: true }`.
+*/
+function isAuthCollection(collection) {
+	const auth = collection?.auth;
+	if (auth === true) return true;
+	return typeof auth === "object" && auth !== null && auth.enabled === true;
+}
+//#endregion
+export { generateForeignKeyName as A, hasForeignKeyOnTarget as B, getDeclaredPrimaryKeys as C, createRelationRefWithData as D, createRelationRef as E, camelCase as F, Vector as H, toSnakeCase as I, DEFAULT_ONE_OF_TYPE as L, getPolicyNamesForRule as M, isPrototypePollutingKey as N, normalizeToEntityRelation as O, mergeDeep as P, DEFAULT_ONE_OF_VALUE as R, buildCompositeId as S, parseIdValues as T, isManyToMany as V, getColumnName as _, buildSdkData as a, getTableVarName as b, resolveStringColumnLength as c, resolveJunctionSpecs as d, getEffectiveSecurityRules as f, findRelation as g, findAnonymousGrants as h, isAuthCollection as i, legacyForeignKeyName as j, updateDateAutoValues as k, getJunctionCollectionConfig as l, securityRuleToConditions as m, authUsersColumnDefinition as n, CollectionRegistry as o, policyToPostgres as p, authUsersColumnSql as r, relationalCollections as s, AUTH_USERS_COLUMNS as t, getJunctionSecurityRules as u, getEnumVarName as v, isAddressableId as w, resolveCollectionRelations as x, getTableName as y, resolveClientListLimit as z };
 
-//# sourceMappingURL=src-DlPBctw_.js.map
+//# sourceMappingURL=auth-users-columns-Do9mw5Y5.js.map