@rebasepro/types 0.12.1-canary.gf5f1d39 → 0.13.0

package/dist/types/admin_block.d.ts

@@ -29,7 +29,7 @@
  *
  * @group Models
  */
-export declare const ADMIN_COLLECTION_KEYS: readonly ["Actions", "additionalFields", "alwaysApplyDefaultValues", "components", "defaultEntityAction", "defaultFilter", "defaultSelectedView", "defaultSize", "defaultViewMode", "disableDefaultActions", "enabledViews", "entityActions", "entityViews", "exportable", "filterPresets", "fixedFilter", "formAutoSave", "formView", "group", "hideFromNavigation", "hideIdFromCollection", "hideIdFromForm", "icon", "includeJsonView", "inlineEditing", "kanban", "listProperties", "localChangesBackup", "openEntityMode", "orderProperty", "pagination", "previewProperties", "propertiesOrder", "selectionController", "selectionEnabled", "sideDialogWidth", "sort", "titleProperty"];
+export declare const ADMIN_COLLECTION_KEYS: readonly ["Actions", "additionalFields", "alwaysApplyDefaultValues", "components", "defaultEntityAction", "defaultFilter", "defaultSelectedView", "defaultSize", "defaultViewMode", "disableDefaultActions", "enabledViews", "entityActions", "entityViews", "exportable", "filterPresets", "fixedFilter", "form", "formAutoSave", "formView", "group", "hideFromNavigation", "hideIdFromCollection", "hideIdFromForm", "icon", "includeJsonView", "inlineEditing", "kanban", "listProperties", "localChangesBackup", "openEntityMode", "orderProperty", "pagination", "previewProperties", "propertiesOrder", "selectionController", "selectionEnabled", "sideDialogWidth", "sort", "titleProperty"];
 /** A key of a collection's `admin` block. @group Models */
 export type AdminCollectionKey = typeof ADMIN_COLLECTION_KEYS[number];
 /**
@@ -49,6 +49,6 @@ export type AdminCollectionKey = typeof ADMIN_COLLECTION_KEYS[number];
  *
  * @group Models
  */
-export declare const ADMIN_PROPERTY_KEYS: readonly ["canAddElements", "clearable", "columnWidth", "customProps", "disabled", "expanded", "Field", "Filter", "filterOperators", "fixedFilter", "hideFromCollection", "includeEntityLink", "includeId", "markdown", "minimalistView", "multiline", "Preview", "previewAsTag", "previewProperties", "readOnly", "sortable", "spreadChildren", "urlPreview", "widget", "widthPercentage"];
+export declare const ADMIN_PROPERTY_KEYS: readonly ["canAddElements", "clearable", "columnWidth", "customProps", "disabled", "expanded", "Field", "Filter", "filterOperators", "fixedFilter", "hideFromCollection", "includeEntityLink", "includeId", "markdown", "minimalistView", "multiline", "Preview", "previewAsTag", "previewProperties", "readOnly", "sortable", "span", "spreadChildren", "urlPreview", "widget"];
 /** A key of a property's `admin` block. @group Models */
 export type AdminPropertyKey = typeof ADMIN_PROPERTY_KEYS[number];

package/dist/types/backend.d.ts

@@ -1,4 +1,5 @@
 import type { CollectionConfig, FilterValues, WhereFilterOp } from "./collections";
+import type { LogicalCondition } from "../controllers/data";
 import type { AuthAdapter } from "./auth_adapter";
 import type { HistoryConfig } from "../controllers/client";
 import type { ChannelBusSetting } from "./channel_bus";
@@ -58,6 +59,13 @@ export interface SearchOptions<M extends Record<string, unknown> = Record<string
  */
 export interface CountOptions<M extends Record<string, unknown> = Record<string, unknown>> {
     filter?: FilterValues<Extract<keyof M, string>>;
+    /**
+     * An `or(...)`/`and(...)` group, alongside `filter`.
+     *
+     * Counted as well as fetched, or `total` describes a different set of rows
+     * from the one that was served — the same reason `filter` is here.
+     */
+    logical?: LogicalCondition;
     searchString?: string;
     databaseId?: string;
 }
@@ -611,6 +619,25 @@ export interface BackendBootstrapper {
     ensureCollectionSchema?(collections: unknown[], driverResult: InitializedDriver, log?: (message: string) => void): Promise<{
         applied: number;
     }>;
+    /**
+     * Apply the collections' row-level-security policies, additively and
+     * idempotently — the companion to {@link ensureCollectionSchema}.
+     *
+     * That method creates the tables; a table with RLS disabled and no policies
+     * is not servable, because authenticated requests run as a restricted role:
+     * a read with no `SELECT` policy returns nothing (a public collection
+     * answers 401) and a write with no `INSERT`/`UPDATE` policy is denied. The
+     * `db push` CLI applies these from the same collections, but it cannot reach
+     * a managed tenant's in-cluster database — the runtime, already connected,
+     * is the only thing that can.
+     *
+     * MUST be idempotent (re-run on every boot) and MUST NOT be destructive.
+     * Runs after auth initialization, because the generated policies call the
+     * `auth.*` helper functions and `CREATE POLICY` validates they exist.
+     */
+    ensureCollectionPolicies?(collections: unknown[], driverResult: InitializedDriver, log?: (message: string) => void): Promise<{
+        applied: number;
+    }>;
     /**
      * Initialize WebSocket server for realtime operations.
      */

package/dist/types/chips.d.ts

@@ -2,4 +2,15 @@ export type ColorScheme = {
     color: string;
     text: string;
 };
-export type ColorKey = "blue" | "cyan" | "teal" | "green" | "yellow" | "orange" | "red" | "pink" | "purple" | "gray" | "indigo" | "violet" | "fuchsia" | "rose" | "emerald";
+/**
+ * The hues a chip can take.
+ *
+ * Kept in step with `CHIP_HUES` in `@rebasepro/ui` by hand: config types cannot
+ * depend on the component library. A hue added there needs adding here too.
+ */
+export type ColorHue = "blue" | "cyan" | "teal" | "green" | "yellow" | "orange" | "red" | "pink" | "purple" | "gray" | "indigo" | "violet" | "fuchsia" | "rose" | "emerald";
+/**
+ * How light or saturated a chip is. A hue on its own means `Lighter`.
+ */
+export type ColorTone = "Lighter" | "Light" | "Dark" | "Darker";
+export type ColorKey = ColorHue | `${ColorHue}${ColorTone}`;

package/dist/types/cron.d.ts

@@ -26,6 +26,37 @@ export interface CronJobDefinition {
      * considered timed-out. Default: 300 (5 min).
      */
     timeoutSeconds?: number;
+    /**
+     * How far back to look, on startup, for a slot that elapsed while no
+     * instance was holding a timer for it. Off by default.
+     *
+     * The scheduler drives jobs with in-process `setTimeout` and computes the
+     * next slot from *now* on every boot, so a slot only fires if some instance
+     * happened to be alive and ticking when it came round. That is not a
+     * scale-to-zero problem: a platform that recycles containers — Cloud Run
+     * rotating an instance under `--min-instances 1`, a rolling deploy, a crash
+     * loop — drops any slot that falls inside the changeover, and the
+     * replacement schedules the slot *after* it. The run is skipped in silence.
+     *
+     * Set this to a window comfortably wider than a restart (a few minutes for
+     * a frequent job; an hour or more for a daily one) and startup will run a
+     * slot it finds unclaimed inside that window.
+     *
+     * Two deliberate limits:
+     *
+     * - **Only the most recent missed slot runs.** Booting after a six-hour
+     *   outage catches an hourly job up once, not six times. Catch-up exists to
+     *   stop a run going missing, not to replay history.
+     * - **A claims-capable store is required.** Catch-up is skipped entirely
+     *   when the store has no `tryClaimRun` (or no store is attached), because
+     *   the claim is the only thing that distinguishes "this slot never ran"
+     *   from "this slot already ran on the instance I am replacing". Without
+     *   it, an instance recycled every 30 minutes would re-run the same hourly
+     *   job every time it booted.
+     *
+     * @example catchUpWindowSeconds: 3600  // daily job: tolerate an hour of downtime
+     */
+    catchUpWindowSeconds?: number;
     /**
      * The handler function executed on each tick.
      * Receives a context object with the data driver and logger.

package/dist/types/database_adapter.d.ts

@@ -65,8 +65,42 @@ export interface DatabaseAdapter {
     } | undefined>;
     /**
      * Initialize WebSocket server for realtime operations.
+     *
+     * `adapter` is the configured AuthAdapter, if any. It is what makes the
+     * socket secure by default: an implementation that receives one requires
+     * authentication regardless of whether a local `jwtSecret` exists. The
+     * parameter was missing from this signature while the caller in `init.ts`
+     * already passed it, so it was dropped at every adapter that routed through
+     * here — turning an adapter-authenticated server's socket into one that
+     * accepted every client as already authenticated.
+     */
+    initializeWebsockets?(server: unknown, realtimeService: RealtimeProvider, driver: DataDriver, config?: unknown, adapter?: import("./auth_adapter").AuthAdapter): Promise<void> | void;
+    /**
+     * Bring the database's collection tables up to date, additively — the boot
+     * companion to `db push`. See `BackendBootstrapper.ensureCollectionSchema`
+     * for the contract (create-only; never drop, narrow, or rewrite).
+     *
+     * Optional, and MUST be forwarded by any wrapper that turns this adapter
+     * into a `BackendBootstrapper`: the runtime calls it through the bootstrapper
+     * at boot, and a wrapper that silently omits it leaves a managed tenant
+     * 500ing every data route with no create step ever having run.
+     */
+    ensureCollectionSchema?(collections: unknown[], driverResult: InitializedDriver, log?: (message: string) => void): Promise<{
+        applied: number;
+    }>;
+    /**
+     * Apply the collections' RLS policies (ENABLE ROW LEVEL SECURITY + the
+     * `securityRules` compiled to `CREATE POLICY`) — the boot companion to the
+     * policy half of `db push`. Idempotent; see
+     * `BackendBootstrapper.ensureCollectionPolicies`.
+     *
+     * Same forwarding requirement as `ensureCollectionSchema`: without the
+     * policies, tables exist but every user-context read is denied (a public
+     * collection answers 401).
      */
-    initializeWebsockets?(server: unknown, realtimeService: RealtimeProvider, driver: DataDriver, config?: unknown): Promise<void> | void;
+    ensureCollectionPolicies?(collections: unknown[], driverResult: InitializedDriver, log?: (message: string) => void): Promise<{
+        applied: number;
+    }>;
     /**
      * Return admin capabilities for this database (SQL editor, schema browser, branching).
      */

package/dist/types/policy.d.ts

@@ -29,12 +29,44 @@ export type PolicyExpression = TruePolicyExpression | FalsePolicyExpression | An
  *
  * The consequence for policy authors is that **`auth.uid() IS NOT NULL` is a
  * tautology on the user path** — it is true for anonymous visitors too. Use
- * {@link policy.authenticated} (or `auth.uid() <> 'anonymous'`) to mean "signed
- * in", and {@link policy.serverContext} to mean "the trusted server context".
+ * {@link policy.authenticated} to mean "signed in", and
+ * {@link policy.serverContext} to mean "the trusted server context". Do not
+ * hand-write the comparison: see {@link ANONYMOUS_USER_IDS} for why one
+ * literal is not enough.
  *
  * @group Models
  */
 export declare const ANONYMOUS_USER_ID = "anonymous";
+/**
+ * Every uid that has ever meant "nobody is signed in" — newest first.
+ *
+ * There are two because there were two. The types, the policy compiler, the
+ * JavaScript evaluator and the linter were all built on
+ * {@link ANONYMOUS_USER_ID}, while the request path scoped unauthenticated
+ * callers as `'anon'` — so `policy.authenticated()`, which compiled to
+ * `auth.uid() <> 'anonymous'`, was *true* for an anonymous visitor. The
+ * sanctioned way to write "signed in" granted to everyone, and the linter
+ * flagged the spelling that actually worked as a foreign convention.
+ *
+ * The request path now reports {@link ANONYMOUS_USER_ID}. `'anon'` stays here
+ * because policies outlive the server that generated them: a database still
+ * holding policies from before the fix, or a project whose server has not been
+ * upgraded yet, must not become a grant in either direction. Compile against
+ * this list, not against a single literal.
+ *
+ * No real user id is ever one of these, so a match is always "not signed in".
+ *
+ * @group Models
+ */
+export declare const ANONYMOUS_USER_IDS: readonly string[];
+/**
+ * Whether a uid stands for "no one is signed in", in any spelling rebase has
+ * used. `null`/`undefined` is the trusted server context, not an anonymous
+ * caller, and is therefore **not** anonymous — see {@link ANONYMOUS_USER_ID}.
+ *
+ * @group Models
+ */
+export declare function isAnonymousUid(uid: string | null | undefined): boolean;
 /** Always allows. Compiles to `true`. @group Models */
 export interface TruePolicyExpression {
     kind: "true";

package/dist/types/project_manifest.d.ts

@@ -192,6 +192,21 @@ export interface RebaseProjectManifest {
      * common project and must not be required to say so.
      */
     storage?: Record<string, RebaseStorageSourceConfig>;
+    /**
+     * Repository-wide opt-out from anonymous CLI usage sharing.
+     *
+     * **Only `false` does anything.** It suppresses sharing for everyone who
+     * clones this repository, overriding each developer's own opt-in — an
+     * organisation setting policy for work done on its behalf, the same shape
+     * as a committed `.npmrc`.
+     *
+     * `true` is deliberately ignored, and the CLI says so rather than obeying
+     * quietly. This file is committed, so a `true` here would be one developer
+     * answering a privacy question for every colleague who later clones the
+     * repo — consent by proxy, which is the exact thing opt-in exists to
+     * prevent. Individuals opt in with `rebase telemetry enable`.
+     */
+    telemetry?: boolean;
 }
 /**
  * The per-checkout project link.

package/dist/types/relations.d.ts

@@ -73,6 +73,15 @@ export interface HasOneRelation extends RelationBase {
      * Defaults to `<thisCollection>_id`.
      */
     foreignKeyOnTarget?: string;
+    /**
+     * Column on **this** collection's table whose value `foreignKeyOnTarget`
+     * holds. Defaults to this collection's primary key.
+     *
+     * Set it when the two sides are joined on a natural key rather than on the
+     * row id — an external identity id, a SKU, a tenant slug. See
+     * {@link HasManyRelation.sourceKey}, which this mirrors.
+     */
+    sourceKey?: string;
 }
 /**
  * The target holds the foreign key, and many target rows point back. The
@@ -90,6 +99,30 @@ export interface HasManyRelation extends RelationBase {
      * Defaults to `<thisCollection>_id`.
      */
     foreignKeyOnTarget?: string;
+    /**
+     * Column on **this** collection's table whose value `foreignKeyOnTarget`
+     * holds. Defaults to this collection's primary key.
+     *
+     * The mirror of `localKey` on {@link BelongsToRelation}: that one names the
+     * column this side reads from, this one names the column the other side
+     * points at. Without it the pair can only be joined on the row id, which
+     * makes a natural-key link — `auth_user_id ↔ auth_user_id`, a SKU, a tenant
+     * slug — inexpressible as `hasMany`, and it has to drop to the read-only
+     * `via`.
+     *
+     * The column must be unique: the link addresses one source row per value,
+     * and Postgres will not accept a foreign key against a non-unique column.
+     *
+     * ```ts
+     * applications: {
+     *     kind: "hasMany",
+     *     target: () => talentApplications,
+     *     sourceKey: "auth_user_id",
+     *     foreignKeyOnTarget: "auth_user_id"
+     * }
+     * ```
+     */
+    sourceKey?: string;
 }
 /**
  * Both sides hold many, through a junction table. The target rows are shared,
@@ -223,6 +256,8 @@ export interface ResolvedHasOne extends ResolvedRelationBase {
     shared: false;
     /** Column on the target's table. */
     foreignKeyOnTarget: string;
+    /** @see ResolvedHasMany.sourceKey */
+    sourceKey?: string;
 }
 /** @group Models */
 export interface ResolvedHasMany extends ResolvedRelationBase {
@@ -232,6 +267,22 @@ export interface ResolvedHasMany extends ResolvedRelationBase {
     shared: false;
     /** Column on the target's table. */
     foreignKeyOnTarget: string;
+    /**
+     * Column on the source's table that `foreignKeyOnTarget` points at, or
+     * `undefined` for the source's primary key.
+     *
+     * The one optional field on a resolved relation, and deliberately so. Every
+     * other default is filled in here because it can be: a table name and a
+     * column name are derivable from the relation and its two endpoints alone.
+     * The primary key is not — this driver resolves it from `isId`, then the
+     * Drizzle schema, then a column named `id`, and the middle tier does not
+     * exist at resolution time.
+     *
+     * So `undefined` is a sentinel with exactly one meaning, not a field a
+     * consumer is invited to guess at. Read it through `sourceKeyField()`,
+     * which is the only place that turns it into a column name.
+     */
+    sourceKey?: string;
 }
 /** @group Models */
 export interface ResolvedManyToMany extends ResolvedRelationBase {

package/dist/users/user.d.ts

@@ -2,8 +2,8 @@
  * The canonical representation of an authenticated user in the Rebase ecosystem.
  *
  * Used by {@link AuthController}, collections, callbacks, and both the
- * `@rebasepro/client` and `@rebasepro/app` packages. All other user types
- * (`RebaseUser`, `UserInfo`) are deprecated aliases of this type.
+ * `@rebasepro/client` and `@rebasepro/app` packages. It is the only user type
+ * those packages export — the `RebaseUser` / `UserInfo` aliases are gone.
  *
  * **Backend-managed fields** (`uid`, `email`, `roles`, `metadata`, `createdAt`)
  * are populated by the server. **Client-visible fields** (`displayName`,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@rebasepro/types",
   "type": "module",
-  "version": "0.12.1-canary.gf5f1d39",
+  "version": "0.13.0",
   "description": "Rebase type definitions — shared interfaces and controller types",
   "funding": {
     "url": "https://github.com/sponsors/rebaseco"
@@ -39,14 +39,14 @@
   },
   "devDependencies": {
     "@types/jest": "^30.0.0",
-    "@types/node": "^25.9.3",
+    "@types/node": "^26.1.2",
     "@types/object-hash": "^3.0.6",
     "@types/react-measure": "^2.0.12",
     "hono": "^4.12.27",
     "jest": "^30.4.2",
-    "ts-jest": "^29.4.11",
+    "ts-jest": "^29.4.12",
     "typescript": "^6.0.3",
-    "vite": "^8.0.16"
+    "vite": "^8.1.5"
   },
   "peerDependencies": {
     "hono": "^4.12.27"

package/src/controllers/client.ts

@@ -94,6 +94,21 @@ export interface AuthClient {
      * Manually refresh the session token
      */
     refreshSession(): Promise<RebaseSession>;
+
+    /**
+     * Whether a session could exist that this client has not loaded yet.
+     *
+     * `false` means the only way this client can hold a session is an explicit
+     * sign-in during this page's lifetime: it neither persists sessions nor
+     * carries an httpOnly auth cookie, so there is nothing on disk or in the
+     * browser to restore from. A caller that would otherwise probe the server
+     * — `getUser()` on mount, say — can skip it, because the answer is already
+     * known and the request can only ever fail.
+     *
+     * Optional so that alternative {@link AuthClient} implementations need not
+     * supply it; treat a missing implementation as "unknown, go ahead and ask".
+     */
+    canRestoreSession?: () => boolean;
 }
 
 // ─── Admin API ───────────────────────────────────────────────────────────────
@@ -321,6 +336,17 @@ export interface RebaseClient<DB = unknown> {
     /** Base HTTP URL of the backend server */
     baseUrl?: string;
 
+    /**
+     * The path every API route is mounted under, appended to {@link baseUrl}.
+     *
+     * `"/api"` unless the backend was configured with a different `basePath`
+     * and the client told to match. Exposed because code that builds a URL by
+     * hand — rather than going through the client's own methods — otherwise has
+     * to guess, and guessing `/api` is wrong for exactly the projects that set
+     * the option.
+     */
+    apiPath?: string;
+
     /** WebSocket client for realtime subscriptions */
     ws?: RebaseWebSocket;
 
@@ -356,20 +382,14 @@ export interface RebaseClient<DB = unknown> {
  * the admin-scoped {@link dataAsAdmin} accessor, raw {@link sql}, and the
  * {@link email} service are all present (non-optional).
  *
- * **Trust levels.** Both {@link dataAsAdmin} and the deprecated {@link data}
- * alias point at the same admin-scoped, **RLS-bypassing** driver. Prefer
- * `dataAsAdmin` so the privilege is explicit at every call site. For user-scoped
- * queries inside a request handler use the request-scoped driver
- * (`c.var.driver`) instead — never `dataAsAdmin`/`data`.
+ * **Trust levels.** {@link dataAsAdmin} is the admin-scoped, **RLS-bypassing**
+ * driver, and it is the only name for it here — the `data` alias that used to
+ * sit beside it is deliberately `Omit`ted from {@link RebaseClient} so the
+ * privilege has to be spelled out at every call site. For user-scoped queries
+ * inside a request handler use the request-scoped driver (`c.var.driver`)
+ * instead — never `dataAsAdmin`.
  */
-export interface RebaseServerClient<DB = unknown> extends RebaseClient<DB> {
-    /**
-     * @deprecated On the server, prefer {@link dataAsAdmin} for admin scope or
-     * the request-scoped driver (`c.var.driver`) for user scope. This alias
-     * points at the same admin-scoped, RLS-bypassing accessor as `dataAsAdmin`.
-     */
-    data: RebaseSdkData<DB>;
-
+export interface RebaseServerClient<DB = unknown> extends Omit<RebaseClient<DB>, "data"> {
     /**
      * Admin-scoped, **RLS-bypassing** data accessor. Always present server-side.
      * See {@link RebaseClient.dataAsAdmin} for the full safety contract.
@@ -439,6 +459,17 @@ export interface RebaseBrowserClient<DB = unknown> {
     /** Base HTTP URL of the backend server */
     baseUrl?: string;
 
+    /**
+     * The path every API route is mounted under, appended to {@link baseUrl}.
+     *
+     * `"/api"` unless the backend was configured with a different `basePath`
+     * and the client told to match. Exposed because code that builds a URL by
+     * hand — rather than going through the client's own methods — otherwise has
+     * to guess, and guessing `/api` is wrong for exactly the projects that set
+     * the option.
+     */
+    apiPath?: string;
+
     /** WebSocket client for realtime subscriptions */
     ws?: RebaseWebSocket;
 

package/src/controllers/data_driver.ts

@@ -2,6 +2,7 @@ import type { CollectionRegistryController } from "./collection_registry";
 import type { EntityStatus, EntityValues } from "../types/entities";
 import type { CollectionConfig, FilterValues } from "../types/collections";
 import type { RebaseCallContext } from "../call_context";
+import type { LogicalCondition } from "./data";
 
 
 /**
@@ -103,6 +104,14 @@ export interface FetchCollectionProps<M extends Record<string, unknown> = Record
     path: string;
     collection?: CollectionConfig<M>;
     filter?: FilterValues<Extract<keyof M, string>>,
+    /**
+     * An `or(...)`/`and(...)` group, applied alongside `filter`.
+     *
+     * The REST layer parsed `?or=` into this and then had nowhere to put it, so
+     * the group was dropped and the read ran unfiltered — returning every row
+     * the caller's policies allowed rather than the ones they asked for.
+     */
+    logical?: LogicalCondition;
     limit?: number;
     offset?: number;
     startAfter?: unknown;
@@ -366,6 +375,8 @@ export interface RestFetchService {
         collectionPath: string,
         options?: {
             filter?: FilterValues<string>;
+            /** An `or(...)`/`and(...)` group, applied alongside `filter`. */
+            logical?: LogicalCondition;
             orderBy?: string;
             order?: "desc" | "asc";
             limit?: number;

package/src/types/admin_block.ts

@@ -47,6 +47,7 @@ export const ADMIN_COLLECTION_KEYS = [
     "exportable",
     "filterPresets",
     "fixedFilter",
+    "form",
     "formAutoSave",
     "formView",
     "group",
@@ -113,10 +114,10 @@ export const ADMIN_PROPERTY_KEYS = [
     "previewProperties",
     "readOnly",
     "sortable",
+    "span",
     "spreadChildren",
     "urlPreview",
     "widget",
-    "widthPercentage"
 ] as const;
 
 /** A key of a property's `admin` block. @group Models */

package/src/types/backend.ts

@@ -1,4 +1,5 @@
 import type { CollectionConfig, FilterValues, WhereFilterOp } from "./collections";
+import type { LogicalCondition } from "../controllers/data";
 import type { AuthAdapter } from "./auth_adapter";
 import type { HistoryConfig } from "../controllers/client";
 import type { ChannelBusSetting } from "./channel_bus";
@@ -73,6 +74,13 @@ export interface SearchOptions<M extends Record<string, unknown> = Record<string
  */
 export interface CountOptions<M extends Record<string, unknown> = Record<string, unknown>> {
     filter?: FilterValues<Extract<keyof M, string>>;
+    /**
+     * An `or(...)`/`and(...)` group, alongside `filter`.
+     *
+     * Counted as well as fetched, or `total` describes a different set of rows
+     * from the one that was served — the same reason `filter` is here.
+     */
+    logical?: LogicalCondition;
     searchString?: string;
     databaseId?: string;
 }
@@ -798,6 +806,28 @@ export interface BackendBootstrapper {
         log?: (message: string) => void
     ): Promise<{ applied: number }>;
 
+    /**
+     * Apply the collections' row-level-security policies, additively and
+     * idempotently — the companion to {@link ensureCollectionSchema}.
+     *
+     * That method creates the tables; a table with RLS disabled and no policies
+     * is not servable, because authenticated requests run as a restricted role:
+     * a read with no `SELECT` policy returns nothing (a public collection
+     * answers 401) and a write with no `INSERT`/`UPDATE` policy is denied. The
+     * `db push` CLI applies these from the same collections, but it cannot reach
+     * a managed tenant's in-cluster database — the runtime, already connected,
+     * is the only thing that can.
+     *
+     * MUST be idempotent (re-run on every boot) and MUST NOT be destructive.
+     * Runs after auth initialization, because the generated policies call the
+     * `auth.*` helper functions and `CREATE POLICY` validates they exist.
+     */
+    ensureCollectionPolicies?(
+        collections: unknown[],
+        driverResult: InitializedDriver,
+        log?: (message: string) => void
+    ): Promise<{ applied: number }>;
+
     /**
      * Initialize WebSocket server for realtime operations.
      */

package/src/types/chips.ts

@@ -3,7 +3,13 @@ export type ColorScheme = {
     text: string;
 }
 
-export type ColorKey =
+/**
+ * The hues a chip can take.
+ *
+ * Kept in step with `CHIP_HUES` in `@rebasepro/ui` by hand: config types cannot
+ * depend on the component library. A hue added there needs adding here too.
+ */
+export type ColorHue =
     | "blue"
     | "cyan"
     | "teal"
@@ -19,3 +25,10 @@ export type ColorKey =
     | "fuchsia"
     | "rose"
     | "emerald";
+
+/**
+ * How light or saturated a chip is. A hue on its own means `Lighter`.
+ */
+export type ColorTone = "Lighter" | "Light" | "Dark" | "Darker";
+
+export type ColorKey = ColorHue | `${ColorHue}${ColorTone}`;

package/src/types/cron.ts

@@ -38,6 +38,38 @@ export interface CronJobDefinition {
      */
     timeoutSeconds?: number;
 
+    /**
+     * How far back to look, on startup, for a slot that elapsed while no
+     * instance was holding a timer for it. Off by default.
+     *
+     * The scheduler drives jobs with in-process `setTimeout` and computes the
+     * next slot from *now* on every boot, so a slot only fires if some instance
+     * happened to be alive and ticking when it came round. That is not a
+     * scale-to-zero problem: a platform that recycles containers — Cloud Run
+     * rotating an instance under `--min-instances 1`, a rolling deploy, a crash
+     * loop — drops any slot that falls inside the changeover, and the
+     * replacement schedules the slot *after* it. The run is skipped in silence.
+     *
+     * Set this to a window comfortably wider than a restart (a few minutes for
+     * a frequent job; an hour or more for a daily one) and startup will run a
+     * slot it finds unclaimed inside that window.
+     *
+     * Two deliberate limits:
+     *
+     * - **Only the most recent missed slot runs.** Booting after a six-hour
+     *   outage catches an hourly job up once, not six times. Catch-up exists to
+     *   stop a run going missing, not to replay history.
+     * - **A claims-capable store is required.** Catch-up is skipped entirely
+     *   when the store has no `tryClaimRun` (or no store is attached), because
+     *   the claim is the only thing that distinguishes "this slot never ran"
+     *   from "this slot already ran on the instance I am replacing". Without
+     *   it, an instance recycled every 30 minutes would re-run the same hourly
+     *   job every time it booted.
+     *
+     * @example catchUpWindowSeconds: 3600  // daily job: tolerate an hour of downtime
+     */
+    catchUpWindowSeconds?: number;
+
     /**
      * The handler function executed on each tick.
      * Receives a context object with the data driver and logger.