@rebasepro/types 0.10.0 → 0.10.1-canary.0a881d4

package/src/types/collections.ts

@@ -1,19 +1,11 @@
-import React, { Dispatch, SetStateAction } from "react";
-import type { Entity, EntityStatus, EntityValues } from "./entities";
 import type { CollectionCallbacks } from "./entity_callbacks";
 
 import type { EnumValues, Properties, PostgresProperties, FirebaseProperties, MongoProperties } from "./properties";
-import type { ExportConfig } from "./export_import";
 
 import type { User } from "../users";
-import type { RebaseContext } from "../rebase_context";
 import type { Relation } from "./relations";
-import type { EntityCustomView, FormViewConfig } from "./entity_views";
-import type { EntityAction } from "./entity_actions";
-import type { PolicyExpression } from "./policy";
-import type { ComponentRef } from "./component_ref";
-import type { CollectionComponentOverrideMap } from "./component_overrides";
-import type { WhereFilterOp, FilterValues, FilterPreset, OrderByTuple } from "./filter-operators";
+import type { SecurityRule } from "./security_rules";
+import type { WhereFilterOp, FilterValues, FilterPreset } from "./filter-operators";
 
 /**
  * Base interface containing all driver-agnostic collection properties.
@@ -107,70 +99,16 @@ export interface BaseCollectionConfig<M extends Record<string, unknown> = Record
      */
     properties: Properties;
 
-    /**
-     * Icon for the navigation sidebar or cards.
-     */
-    icon?: string | React.ReactNode;
 
-    /**
-     * Navigation group for this collection.
-     * Collections sharing the same group name will be visually grouped
-     * together in the drawer and home page. If not set, the collection
-     * falls into the default "Views" group.
-     */
-    group?: string;
 
-    /**
-     * Array of entity views that this collection has.
-     * Can be an array of `EntityCustomView` or a string representing the key of a global `EntityCustomView`.
-     */
-    entityViews?: (string | EntityCustomView<Record<string, unknown>>)[];
 
-    /**
-     * Default preview properties displayed when this collection is referenced to.
-     */
-    previewProperties?: string[];
 
-    /**
-     * Properties to display as columns in the list view.
-     * If not specified, the list view uses a smart default (Title, Status, Date).
-     */
-    listProperties?: string[];
 
-    /**
-     * Title property of the entity. This is the property that will be used
-     * as the title in entity related views and references.
-     * If not specified, the first property simple text property will be used.
-     */
-    readonly titleProperty?: Extract<keyof M, string> | (string & {});
 
-    /**
-     * When editing a entity, you can choose to open the entity in a side dialog
-     * or in a full screen dialog. Defaults to `full_screen`.
-     */
-    openEntityMode?: "side_panel" | "full_screen" | "split" | "dialog";
 
-    /**
-     * Controls what happens when a user clicks on a entity in the collection view.
-     * - `"edit"` (default): Opens the entity in the edit form.
-     * - `"view"`: Opens a read-only detail view with an "Edit" button.
-     */
-    defaultEntityAction?: "view" | "edit";
 
-    /**
-     * Replace the default entity form with a custom component.
-     * The Builder receives the same props as entity view tabs
-     * (entity, formContext, collection, etc.) and has full control over the UI.
-     *
-     * Works in both edit mode and read-only mode (when `defaultEntityAction`
-     * is `"view"`). In read-only mode, `formContext.readOnly` will be `true`.
-     */
-    formView?: FormViewConfig;
 
-    /**
-     * Prevent default actions from being displayed or executed on this collection.
-     */
-    disableDefaultActions?: ("edit" | "copy" | "delete")[];
+
 
     /**
      * Mark this collection as an authentication collection.
@@ -198,37 +136,9 @@ export interface BaseCollectionConfig<M extends Record<string, unknown> = Record
     disableDefaultPolicies?: boolean;
 
 
-    /**
-     * Order in which the properties are displayed.
-     * If you are specifying your collection as code, the order is the same as the
-     * one you define in `properties`. Additional columns are added at the
-     * end of the list, if the order is not specified.
-     *
-     * You can use this prop to hide some properties from the table view.
-     * Note that if you set this prop, other ways to hide fields, like
-     * `hidden` in the property definition, will be ignored.
-     * `propertiesOrder` has precedence over `hidden`.
-     *
-     * Supported entry formats:
-     *     - For properties, use the property key.
-     *     - For additional fields, use the field key.
-     *     - Child collections (Firestore subcollections, or Postgres relations
-     *       with `many` cardinality) each get a column with id
-     *       `subcollection:<slug>`, e.g. `subcollection:orders`.
-     */
-    propertiesOrder?: (Extract<keyof M, string> | (string & {}) | string | `subcollection:${string}`)[];
 
-    /**
-     * If enabled, content is loaded in batches. If `false` all entities in the
-     * collection are loaded. This means that when reaching the end of the
-     * collection, the CMS will load more entities.
-     * You can specify a number to specify the pagination size (50 by default)
-     * Defaults to `true`
-     */
-    pagination?: boolean | number;
 
 
-    selectionEnabled?: boolean;
 
     /**
      * This interface defines all the callbacks that can be used when a entity
@@ -237,114 +147,19 @@ export interface BaseCollectionConfig<M extends Record<string, unknown> = Record
      */
     readonly callbacks?: CollectionCallbacks<M, USER>;
 
-    /**
-     * Pass your own selection controller if you want to control selected
-     * entities externally.
-     * @see useSelectionController
-     */
-    selectionController?: SelectionController<M>;
 
-    /**
-     * Force a filter in this view. If applied, the rest of the filters will
-     * be disabled. Filters applied with this prop cannot be changed.
-     * e.g. `fixedFilter: { age: [">", 18] }`
-     * e.g. `fixedFilter: { related_user: ["==", new EntityReference("sdc43dsw2", "users")] }`
-     */
-    readonly fixedFilter?: FilterValues<Extract<keyof M, string> | (string & {})>;
 
-    /**
-     * Initial filters applied to the collection this collection is related to.
-     * Defaults to none. Filters applied with this prop can be changed.
-     * e.g. `defaultFilter: { age: [">", 18] }`
-     * e.g. `defaultFilter: { related_user: ["==", new EntityReference("sdc43dsw2", "users")] }`
-     */
-    readonly defaultFilter?: FilterValues<Extract<keyof M, string> | (string & {})>; // setting FilterValues<M> can break defining collections by code
 
-    /**
-     * Pre-defined filter presets that appear as quick-access options in the
-     * collection toolbar. Each preset applies a set of filters (and
-     * optionally a sort order) with a single click.
-     *
-     * ```ts
-     * filterPresets: [
-     *   {
-     *     label: "Shipped this month",
-     *     filterValues: {
-     *       status: ["==", "shipped"],
-     *       order_date: [">=", new Date(Date.now() - 30 * 86400000)]
-     *     }
-     *   }
-     * ]
-     * ```
-     */
-    readonly filterPresets?: FilterPreset<Extract<keyof M, string> | (string & {})>[];
 
-    /**
-     * Default sort applied to this collection.
-     * When setting this prop, entities will have a default order
-     * applied in the collection.
-     * e.g. `sort: ["order", "asc"]`
-     */
-    readonly sort?: OrderByTuple<Extract<keyof M, string> | (string & {})>;
 
-    /**
-     * You can add additional fields to the collection view by implementing
-     * an additional field delegate.
-     */
-    readonly additionalFields?: AdditionalFieldDelegate<M, USER>[];
 
-    /**
-     * Default size of the rendered collection
-     */
-    defaultSize?: CollectionSize;
 
-    /**
-     * Can the elements in this collection be edited inline in the collection
-     * view. Even when inline editing is disabled, entities can still be
-     * edited in the side panel (subject to `securityRules`).
-     */
-    inlineEditing?: boolean;
 
-    /**
-     * Should this collection be hidden from the main navigation panel, if
-     * it is at the root level, or in the entity side panel if it's a
-     * subcollection.
-     * It will still be accessible if you reach the specified path.
-     * You can also use this collection as a reference target.
-     */
-    hideFromNavigation?: boolean;
 
-    /**
-     * If you want to open custom views or subcollections by default when opening the edit
-     * view of a entity, you can specify the path to the view here.
-     * The path is relative to the current collection. For example if you have a collection
-     * that has a custom view as well as a subcollection that refers to another entity, you can
-     * either specify the path to the custom view or the path to the subcollection.
-     */
-    defaultSelectedView?: string | DefaultSelectedViewBuilder;
 
-    /**
-     * Should the ID of this collection be hidden from the form view.
-     */
-    hideIdFromForm?: boolean;
 
-    /**
-     * Should the ID of this collection be hidden from the grid view.
-     */
-    hideIdFromCollection?: boolean;
 
-    /**
-     * If set to true, the form will be auto-saved when the user changes
-     * the value of a field.
-     * Defaults to false.
-     * When a new entity is created, this property can be updated to generated a new ID
-     */
-    formAutoSave?: boolean;
 
-    /**
-     *
-     */
-    exportable?: boolean | ExportConfig<USER>;
 
     /**
      * User id of the owner of this collection. This is used only by plugins, or if you
@@ -359,22 +174,8 @@ export interface BaseCollectionConfig<M extends Record<string, unknown> = Record
      */
     metadata?: Record<string, unknown>;
 
-    /**
-     * Width of the side dialog (in pixels) when opening a entity in this collection.
-     */
-    sideDialogWidth?: number | string;
 
-    /**
-     * If set to true, the default values of the properties will be applied
-     * to the entity every time the entity is updated (not only when created).
-     * Defaults to false.
-     */
-    alwaysApplyDefaultValues?: boolean;
 
-    /**
-     * If set to true, a tab including the JSON representation of the entity will be included.
-     */
-    includeJsonView?: boolean;
 
     /**
      * If set to true, changes to the entity will be saved in a subcollection.
@@ -394,61 +195,12 @@ export interface BaseCollectionConfig<M extends Record<string, unknown> = Record
      */
     strictWrites?: boolean;
 
-    /**
-     * Should local changes be backed up in local storage, to prevent data loss on
-     * accidental navigations.
-     * - `manual_apply`: When the user navigates back to a entity with local changes,
-     *   they will be prompted to restore the changes.
-     * - `auto_apply`: When the user navigates back to a entity with local changes,
-     *   the changes will be automatically applied.
-     * - `false`: Local changes will not be backed up.
-     * Defaults to `manual_apply`.
-     */
-    localChangesBackup?: "manual_apply" | "auto_apply" | false;
 
-    /**
-     * Default view mode for displaying this collection.
-     * - "table": Display entities in a table with inline editing (default)
-     * - "cards": Display entities as a grid of cards with thumbnails
-     * - "kanban": Display entities in a Kanban board grouped by a property
-     * Defaults to "table".
-     */
-    defaultViewMode?: ViewMode;
 
-    /**
-     * Which view modes are available for this collection.
-     * Possible values: "table", "cards", "kanban".
-     * Defaults to all three: ["table", "cards", "kanban"].
-     * Note: "kanban" will only be available if the collection has at least
-     * one string property with `enum` defined, regardless of this setting.
-     */
-    enabledViews?: ViewMode[];
 
-    /**
-     * Configuration for Kanban board view mode.
-     * When set, the Kanban view mode becomes available.
-     */
-    kanban?: KanbanConfig<M>;
 
-    /**
-     * Property key to use for ordering items.
-     * Must reference a string/text property. When items are reordered,
-     * this property will be updated with lexicographic sort keys
-     * (e.g. "a0", "a1", "a0V") using string-based fractional indexing.
-     * Used by Kanban view for ordering within columns
-     * and can be used for general ordering purposes.
-     */
-    readonly orderProperty?: Extract<keyof M, string> | (string & {});
 
-    /**
-     * Actions that can be performed on the entities in this collection.
-     */
-    entityActions?: EntityAction<M, USER>[];
 
-    /**
-     * Builder for the collection actions rendered in the toolbar
-     */
-    Actions?: ComponentRef<CollectionActionsProps>[];
 
     /**
      * The database table name for this collection.
@@ -470,30 +222,6 @@ export interface BaseCollectionConfig<M extends Record<string, unknown> = Record
      */
     securityRules?: readonly SecurityRule[];
 
-    /**
-     * Collection-scoped component overrides. These take precedence over
-     * global overrides set on `<Rebase>`, but only within this collection's
-     * views (entity form, detail view, table, empty state, etc.).
-     *
-     * Only collection-scoped components (like `Entity.Form`, `Collection.EmptyState`,
-     * `Collection.Card`, etc.) can be overridden here. App-level components
-     * (like `Shell.AppBar`, `HomePage`) can only be overridden at the `<Rebase>` level.
-     *
-     * @example
-     * ```tsx
-     * const productsCollection: PostgresCollectionConfig = {
-     *     name: "Products",
-     *     slug: "products",
-     *     table: "products",
-     *     components: {
-     *         "Entity.Form": { Component: ProductCustomForm },
-     *         "Collection.Card": { Component: ProductCard },
-     *     },
-     *     properties: { ... }
-     * };
-     * ```
-     */
-    components?: CollectionComponentOverrideMap;
 }
 
 // ── Driver-specific collection types ──────────────────────────────────
@@ -658,11 +386,18 @@ export type CollectionConfig<M extends Record<string, unknown> = Record<string,
 /**
  * Type guard for PostgreSQL collections.
  * Returns true if the collection uses the Postgres engine (or the default engine).
+ *
+ * Generic over the *input* type, and narrows by intersection rather than
+ * replacement. Narrowing to a bare `PostgresCollectionConfig` discarded whatever
+ * the caller actually had — most visibly the admin panel's view model, whose
+ * flattened presentation fields vanished the moment a collection passed through
+ * one of these guards.
+ *
  * @group Models
  */
-export function isPostgresCollectionConfig<M extends Record<string, unknown> = Record<string, unknown>, USER extends User = User>(
-    collection: CollectionConfig<M, USER>
-): collection is PostgresCollectionConfig<M, USER> {
+export function isPostgresCollectionConfig<C extends CollectionConfig<any, any>>(
+    collection: C
+): collection is C & PostgresCollectionConfig<any, any> {
     return !collection.engine || collection.engine === "postgres";
 }
 
@@ -670,9 +405,9 @@ export function isPostgresCollectionConfig<M extends Record<string, unknown> = R
  * Type guard for Firebase / Firestore collections.
  * @group Models
  */
-export function isFirebaseCollectionConfig<M extends Record<string, unknown> = Record<string, unknown>, USER extends User = User>(
-    collection: CollectionConfig<M, USER>
-): collection is FirebaseCollectionConfig<M, USER> {
+export function isFirebaseCollectionConfig<C extends CollectionConfig<any, any>>(
+    collection: C
+): collection is C & FirebaseCollectionConfig<any, any> {
     return collection.engine === "firestore";
 }
 
@@ -680,9 +415,9 @@ export function isFirebaseCollectionConfig<M extends Record<string, unknown> = R
  * Type guard for MongoDB collections.
  * @group Models
  */
-export function isMongoDBCollectionConfig<M extends Record<string, unknown> = Record<string, unknown>, USER extends User = User>(
-    collection: CollectionConfig<M, USER>
-): collection is MongoDBCollectionConfig<M, USER> {
+export function isMongoDBCollectionConfig<C extends CollectionConfig<any, any>>(
+    collection: C
+): collection is C & MongoDBCollectionConfig<any, any> {
     return collection.engine === "mongodb";
 }
 
@@ -720,574 +455,11 @@ export function getDeclaredSubcollections<M extends Record<string, unknown> = Re
 }
 
 
-/**
- * Configuration for Kanban board view mode.
- * @group Collections
- */
-export interface KanbanConfig<M extends Record<string, unknown> = Record<string, unknown>> {
-    /**
-     * Property key to use for Kanban board columns.
-     * Must reference a string property with `enum` values defined.
-     * Entities will be grouped into columns based on this property's value.
-     * The column order is determined by the order of `enum` values in the property.
-     */
-    columnProperty: Extract<keyof M, string> | (string & {});
-}
-
-/**
- * View mode for displaying a collection.
- * - "list": Simple, clean list view — the classic CMS default
- * - "table": Table with inline editing
- * - "cards": Grid of visual cards with thumbnails
- * - "kanban": Board view grouped by a property
- * @group Collections
- */
-export type ViewMode = "list" | "table" | "cards" | "kanban";
-
-/**
- * Parameter passed to the `Actions` prop in the collection configuration.
- * The component will receive this prop when it is rendered in the collection
- * toolbar.
- *
- * @group Models
- */
-export interface CollectionActionsProps<M extends Record<string, unknown> = Record<string, unknown>, USER extends User = User, EC extends CollectionConfig<M> = CollectionConfig<M>> {
-    /**
-     * Full collection path of this entity. This is the full path, like
-     * `users/1234/addresses`
-     */
-    path: string;
-
-    /**
-     * Path of the last collection, like `addresses`
-     */
-    relativePath: string;
-
-    /**
-     * Array of the parent path segments like `['users']`
-     */
-    parentCollectionSlugs: string[];
-    parentEntityIds: string[];
-
-    /**
-     * The collection configuration
-     */
-    collection: EC;
-
-    /**
-     * Use this controller to get the selected entities and to update the
-     * selected entities state.
-     */
-    selectionController: SelectionController<M>;
-
-    /**
-     * Use this controller to get the table controller and to update the
-     * table controller state.
-     */
-    tableController: EntityTableController<M>;
-
-    /**
-     * Context of the app status
-     */
-    context: RebaseContext<USER>;
-
-    /**
-     * Count of the entities in this collection.
-     * undefined means the count is still loading.
-     */
-    collectionEntitiesCount?: number;
-
-    /**
-     * Programmatically open the new-document form for this collection,
-     * optionally pre-populating it with initial field values.
-     * The form opens in the same mode configured for the collection
-     * (side panel, full screen, or split).
-     *
-     * This is the primary hook for workflows that need to create a document
-     * from external data — e.g. fetching content from a URL, importing from
-     * a third-party API, or duplicating from another system.
-     *
-     * @example
-     * // Inside a custom CollectionAction component:
-     * openNewDocument({ title: "Fetched title", body: "..." });
-     */
-    openNewDocument: (defaultValues?: Record<string, unknown>) => void;
-
-}
-
-/**
- * Use this controller to retrieve the selected entities or modify them in
- * an {@link CollectionConfig}
- * @group Models
- */
-export interface SelectionController<M extends Record<string, unknown> = Record<string, unknown>> {
-    selectedEntities: Entity<M>[];
-    setSelectedEntities(entities: Entity<M>[]): void;
-    setSelectedEntities(action: (prev: Entity<M>[]) => Entity<M>[]): void;
-    isEntitySelected(entity: Entity<M>): boolean;
-    toggleEntitySelection(entity: Entity<M>, newSelectedState?: boolean): void;
-}
-
-// Canonical filter types — re-exported from the single source-of-truth.
 export type { WhereFilterOp, FilterValues, WireFilterValues, FilterPreset } from "./filter-operators";
 
 
-/**
- * Used to indicate valid filter combinations (e.g. created in Firestore)
- * If the user selects a specific filter/sort combination, the CMS checks if it's
- * valid, otherwise it reverts to the simpler valid case
- * @group Models
- */
-export type FilterCombination<Key extends string> = Partial<Record<Key, "asc" | "desc">>;
-
-/**
- * Sizes in which a collection can be rendered
- * @group Models
- */
-export type CollectionSize = "xs" | "s" | "m" | "l" | "xl";
-
-export type AdditionalFieldDelegateProps<M extends Record<string, unknown> = Record<string, unknown>, USER extends User = User> = {
-    entity: Entity<M>,
-    context: RebaseContext<USER>
-};
-
-/**
- * Use this interface for adding additional fields to entity collection views and forms.
- * @group Models
- */
-export interface AdditionalFieldDelegate<M extends Record<string, unknown> = Record<string, unknown>,
-    USER extends User = User> {
-
-    /**
-     * ID of this column. You can use this id in the `properties` field of the
-     * collection in any order you want
-     */
-    key: string;
-
-    /**
-     * Header of this column
-     */
-    name: string;
-
-    /**
-     * Width of the generated column in pixels
-     */
-    width?: number;
-
-    /**
-     * Builder for the custom field
-     */
-    Builder?(props: { entity: Entity<M>, context: RebaseContext<USER> }): React.ReactNode;
-
-
-    /**
-     * If this column needs to update dynamically based on other properties,
-     * you can define an array of keys as strings with the
-     * `dependencies` prop.
-     * e.g. ["name", "surname"]
-     * This is a performance optimization, if you don't define dependencies
-     * it will be updated in every render.
-     */
-    dependencies?: NoInfer<Extract<keyof M, string>> | NoInfer<Extract<keyof M, string>>[] | (string & {}) | (string & {})[];
-
-    /**
-     * Use this prop to define the value of the column as a string or number.
-     * This is the value that will be used for exporting the collection.
-     * If `Builder` is defined, this prop will be ignored in the collection
-     * view.
-     * @param entity
-     */
-    value?(props: {
-        entity: Entity<M>,
-        context: RebaseContext
-    }): string | number | Promise<string | number> | undefined;
-}
-
-
 export type InferCollectionConfigType<S extends CollectionConfig> = S extends CollectionConfig<infer M> ? M : never;
 
-/**
- * Used in the {@link CollectionConfig#defaultSelectedView} to define the default
- * @group Models
- */
-export type DefaultSelectedViewBuilder = (params: DefaultSelectedViewParams) => string | undefined;
-
-/**
- * Used in the {@link CollectionConfig#defaultSelectedView} to define the default
- * @group Models
- */
-export type DefaultSelectedViewParams = {
-    status?: EntityStatus;
-    entityId?: string | number;
-};
-/**
- * You can use this controller to control the table view of a collection.
- */
-export type EntityTableController<M extends Record<string, unknown> = Record<string, unknown>> = {
-    data: Entity<M>[];
-    dataLoading: boolean;
-    noMoreToLoad: boolean;
-    dataLoadingError?: Error;
-    filterValues?: FilterValues<Extract<keyof M, string> | (string & {})>;
-    setFilterValues?: (filterValues: FilterValues<Extract<keyof M, string> | (string & {})>) => void;
-    sortBy?: [Extract<keyof M, string> | (string & {}), "asc" | "desc"];
-    setSortBy?: (sortBy?: [Extract<keyof M, string> | (string & {}), "asc" | "desc"]) => void;
-    searchString?: string;
-    setSearchString?: (searchString?: string) => void;
-    clearFilter?: () => void;
-    itemCount?: number;
-    setItemCount?: (itemCount: number) => void;
-    initialScroll?: number;
-    onScroll?: (props: {
-        scrollDirection: "forward" | "backward",
-        scrollOffset: number,
-        scrollUpdateWasRequested: boolean
-    }) => void;
-    paginationEnabled?: boolean;
-    pageSize?: number;
-    checkFilterCombination?: (filterValues: FilterValues<string>,
-        sortBy?: [string, "asc" | "desc"]) => boolean;
-    popupCell?: SelectedCellProps<M>;
-    setPopupCell?: (popupCell?: SelectedCellProps<M>) => void;
-
-    onAddColumn?: (column: string) => void;
-}
-
-export type SelectedCellProps<M extends Record<string, unknown> = Record<string, unknown>> = {
-    propertyKey: Extract<keyof M, string> | (string & {});
-    cellRect: DOMRect;
-    width: number;
-    height: number;
-    entityPath: string;
-    entityId: string | number;
-};
-
-/**
- * SQL operation that a policy applies to.
- * @group Models
- */
-export type SecurityOperation = "select" | "insert" | "update" | "delete" | "all";
-
-/**
- * Flexible Row Level Security rule for a collection.
- *
- * Built on PostgreSQL Row Level Security. Rules can range from
- * simple convenience shortcuts to fully custom SQL expressions, giving you the
- * full power of PostgreSQL Row Level Security.
- *
- * The authenticated user's identity is available in raw SQL via:
- * - `auth.uid()`   — the user's ID
- * - `auth.roles()` — comma-separated app role IDs
- * - `auth.jwt()`   — full JWT claims as JSONB
- *
- * These are set automatically per-transaction by the backend.
- *
- * **How rules combine:** PostgreSQL evaluates all matching policies for an
- * operation. Permissive rules are OR'd together (any one passing is enough).
- * Restrictive rules are AND'd (all must pass). This is standard PostgreSQL RLS behavior.
- *
- * **Mutual exclusivity:** `ownerField`, `access`, structured `condition`, and
- * raw SQL (`using`/`withCheck`) cannot be combined. The type system enforces
- * this — attempting to set conflicting fields will produce a compile-time
- * error.
- *
- * **Which form to reach for:** prefer the structured {@link StructuredSecurityRule}
- * (`condition`/`check`) or the shortcuts (`ownerField`, `access`, `roles`). These
- * are engine-agnostic and evaluated identically by the database and the admin UI,
- * so the UI never shows an action the database will reject. Raw SQL
- * ({@link RawSQLSecurityRule}) keeps full PostgreSQL power but is Postgres-only
- * and server-authoritative (the UI cannot evaluate arbitrary SQL locally).
- *
- * @group Models
- */
-export type SecurityRule =
-    | OwnerSecurityRule
-    | PublicSecurityRule
-    | StructuredSecurityRule
-    | RawSQLSecurityRule
-    | RolesOnlySecurityRule;
-
-/**
- * Shared fields for all SecurityRule variants.
- * @group Models
- */
-export interface SecurityRuleBase {
-    /**
-     * Optional human-readable name for the policy.
-     * If not provided, one will be auto-generated from the table name and operation.
-     * Must be unique per table.
-     *
-     * When using `operations` (array), each generated policy will have the
-     * operation name appended, e.g. `"owner_access_select"`, `"owner_access_update"`.
-     */
-    name?: string;
-
-    /**
-     * Which SQL operation this policy applies to.
-     * Use this when the policy targets a single operation or all operations.
-     *
-     * For multiple specific operations, use `operations` (array) instead.
-     * If neither is specified, defaults to `"all"`.
-     *
-     * @default "all"
-     */
-    operation?: SecurityOperation;
-
-    /**
-     * Array of SQL operations this policy applies to.
-     * The compiler will generate one PostgreSQL policy per operation, sharing
-     * the same configuration.
-     *
-     * This reduces boilerplate when the same rule applies to multiple (but not all)
-     * operations.
-     *
-     * Takes precedence over `operation` (singular) if both are specified.
-     *
-     * @example
-     * // Same rule for select and update
-     * { operations: ["select", "update"], ownerField: "user_id" }
-     *
-     * @example
-     * // Equivalent to operation: "all"
-     * { operations: ["all"], ownerField: "user_id" }
-     */
-    operations?: readonly SecurityOperation[];
-
-    /**
-     * Whether this policy is `"permissive"` (default) or `"restrictive"`.
-     *
-     * - **permissive**: Multiple permissive policies for the same operation are
-     *   OR'd together — if *any* passes, access is granted.
-     * - **restrictive**: Restrictive policies are AND'd with all permissive
-     *   policies — they act as additional gates that *must* also pass.
-     *
-     * This is the standard PostgreSQL RLS model.
-     *
-     * @default "permissive"
-     */
-    mode?: "permissive" | "restrictive";
-
-    /**
-     * **Shortcut.** Restrict this rule to users that have one of these
-     * application-level roles.
-     *
-     * **Important:** These are NOT native PostgreSQL database roles — names
-     * like `public`, `anon` or `authenticated` belong to {@link pgRoles} and
-     * produce a condition no user can satisfy if used here. These are
-     * application roles managed by Rebase, stored as an inline `roles TEXT[]`
-     * column on the users table, and injected into each transaction as
-     * `app.user_roles` — which `auth.roles()` reads.
-     *
-     * There is no roles registry: a role exists once it is assigned to a user.
-     *
-     * Generates a safe array-overlap condition — the user passes if they hold
-     * *any* of the listed roles:
-     *   `string_to_array(auth.roles(), ',') && ARRAY['<role1>', '<role2>']`
-     *
-     * (Note: this is a true set intersection, NOT a regex/substring match, so
-     * a role named `admin` never matches `nonadmin` or `superadmin`.)
-     *
-     * Can be combined with `ownerField`, `access`, `condition`, or raw
-     * `using`/`withCheck`. When combined, the role check is AND'd with the
-     * other condition.
-     *
-     * @example
-     * // Only admins can delete
-     * { operation: "delete", roles: ["admin"] }
-     *
-     * @example
-     * // Admins have unfiltered read access to all rows
-     * { operation: "select", roles: ["admin"], using: "true" }
-     */
-    roles?: readonly string[];
-
-    // ── Advanced: native PostgreSQL role targeting ───────────────────────
-
-    /**
-     * **Advanced.** Native PostgreSQL database roles the policy applies to.
-     *
-     * By default, all generated policies target the `public` role (i.e.
-     * every database connection). This is correct for most setups where
-     * a single database role is used for all connections.
-     *
-     * **Important:** These are NOT the same as the application-level
-     * {@link roles} (admin, editor, viewer, etc.) — those are enforced in the
-     * USING/WITH CHECK clauses via `auth.roles()`. This field controls the
-     * PostgreSQL `TO` clause in `CREATE POLICY ... TO role_name`.
-     *
-     * Use this if you have dedicated PostgreSQL roles (e.g. `app_read`,
-     * `app_write`) and want policies to target specific ones.
-     *
-     * @default ["public"]
-     *
-     * @example
-     * // Only apply this policy when connected as `app_role`
-     * { operation: "select", access: "public", pgRoles: ["app_role"] }
-     */
-    pgRoles?: readonly string[];
-}
-
-/**
- * Security rule that grants access based on row ownership.
- * Generates a USING/WITH CHECK clause like: `<column> = auth.uid()`
- *
- * Cannot be combined with `using`, `withCheck`, or `access`.
- *
- * @example
- * { operation: "all", ownerField: "user_id" }
- *
- * @group Models
- */
-export interface OwnerSecurityRule extends SecurityRuleBase {
-    /** The property (column) that stores the owner's user ID. */
-    ownerField: string;
-    access?: never;
-    using?: never;
-    withCheck?: never;
-    condition?: never;
-    check?: never;
-}
-
-/**
- * Security rule that grants unrestricted row access (no row filtering).
- * Generates `USING (true)`.
- *
- * This means "no row-level filter", NOT "anonymous/unauthenticated access".
- * Authentication is still enforced at the API layer — this only controls which
- * *rows* authenticated users can see.
- *
- * Cannot be combined with `using`, `withCheck`, or `ownerField`.
- *
- * @example
- * // Public read (any authenticated user sees all rows)
- * { operation: "select", access: "public" }
- *
- * @group Models
- */
-export interface PublicSecurityRule extends SecurityRuleBase {
-    /** Grant unrestricted row access for this operation. */
-    access: "public";
-    ownerField?: never;
-    using?: never;
-    withCheck?: never;
-    condition?: never;
-    check?: never;
-}
-
-/**
- * Security rule expressed as a structured, engine-agnostic
- * {@link PolicyExpression}. This is the **recommended** way to write a
- * non-trivial condition: it compiles to PostgreSQL `USING`/`WITH CHECK` SQL
- * *and* is evaluated identically by the admin UI, so the UI can never show an
- * action the database will reject.
- *
- * Cannot be combined with `ownerField`, `access`, or raw `using`/`withCheck`.
- *
- * @example
- * // Owner, or any user holding the `moderator` role
- * {
- *   operation: "update",
- *   condition: policy.or(
- *       policy.compare(policy.field("user_id"), "eq", policy.authUid()),
- *       policy.rolesOverlap(["moderator"])
- *   )
- * }
- *
- * @group Models
- */
-export interface StructuredSecurityRule extends SecurityRuleBase {
-    /**
-     * Structured condition for the `USING` clause — which *existing* rows are
-     * visible / can be modified / deleted (SELECT, UPDATE, DELETE).
-     */
-    condition: PolicyExpression;
-
-    /**
-     * Structured condition for the `WITH CHECK` clause — which *new/updated*
-     * row values are allowed (INSERT, UPDATE). Defaults to `condition` when
-     * omitted, mirroring PostgreSQL's own behavior.
-     */
-    check?: PolicyExpression;
-
-    ownerField?: never;
-    access?: never;
-    using?: never;
-    withCheck?: never;
-}
-
-/**
- * Security rule using raw SQL expressions for full PostgreSQL RLS power.
- *
- * **Postgres-only and server-authoritative.** Arbitrary SQL cannot be
- * evaluated by the admin UI, so a rule using this form is treated as *unknown*
- * client-side (never silently allowed) and its effect on visible actions is
- * reflected from the server. For conditions that should also drive the UI
- * precisely, prefer the structured {@link StructuredSecurityRule}.
- *
- * Cannot be combined with `ownerField`, `access`, or structured `condition`.
- *
- * You can reference columns via `{column_name}` which will be resolved to
- * `table.column_name` in the generated Drizzle code.
- *
- * @example
- * // Rows published in the last 30 days are visible
- * { operation: "select", using: "{published_at} > now() - interval '30 days'" }
- *
- * @example
- * // Only the owner, or users with 'moderator' role
- * {
- *   operation: "select",
- *   using: "{user_id} = auth.uid() OR auth.roles() ~ 'moderator'"
- * }
- *
- * @group Models
- */
-export interface RawSQLSecurityRule extends SecurityRuleBase {
-    /**
-     * Raw SQL expression for the `USING` clause.
-     * This controls which *existing* rows are visible / can be modified / deleted.
-     * Applied to SELECT, UPDATE, and DELETE.
-     */
-    using: string;
-
-    /**
-     * Raw SQL expression for the `WITH CHECK` clause.
-     * This controls which *new/updated* row values are allowed.
-     * Applied to INSERT and UPDATE.
-     *
-     * If not provided on INSERT/UPDATE policies, falls back to `using`
-     * (which matches PostgreSQL's own default behavior).
-     */
-    withCheck?: string;
-
-    ownerField?: never;
-    access?: never;
-    condition?: never;
-    check?: never;
-}
-
-/**
- * Security rule that only filters by application roles, without any
- * row-level condition (USING/WITH CHECK).
- *
- * Useful for simple "only admins can access this table" rules where
- * no per-row filtering is needed.
- *
- * @example
- * // Only admins can delete
- * { operation: "delete", roles: ["admin"] }
- *
- * @group Models
- */
-export interface RolesOnlySecurityRule extends SecurityRuleBase {
-    ownerField?: never;
-    access?: never;
-    using?: never;
-    withCheck?: never;
-    condition?: never;
-    check?: never;
-}
-
 /**
  * Configuration for authentication collections.
  *
@@ -1355,9 +527,14 @@ export interface AuthCollectionConfig {
      * the built-in `resetPasswordAction` into the collection's entity actions.
      *
      * Set to `false` to disable, or pass a custom `EntityAction` to replace the UI.
+     *
+     * The object form is an `EntityAction` from `@rebasepro/admin-types`, typed
+     * here as `object` because it is a React component with admin controllers in
+     * its props and nothing on the server reads it — only whether the built-in
+     * action is injected, which is the boolean.
      */
     actions?: {
-        resetPassword?: boolean | EntityAction;
+        resetPassword?: boolean | object;
     };
 }