@rebasepro/types 0.13.0 → 0.13.1-canary.g18cfeb7

package/src/controllers/data.ts

@@ -38,13 +38,19 @@ export interface FilterCondition {
  *
  * `limit`/`offset` and `page` describe the same window two ways. If **both
  * `offset` and `page` are provided, `page` wins** — the backend computes
- * `offset = (page - 1) * (limit ?? 20)` and ignores the explicit `offset`.
- * Pick one style per query.
+ * `offset = (page - 1) * (limit ?? DEFAULT_LIST_LIMIT)` and ignores the
+ * explicit `offset`. Pick one style per query.
  *
  * @group Data
  */
 export interface FindParams<M extends Record<string, unknown> = Record<string, unknown>> {
-    /** Maximum number of items to return (default: 20). */
+    /**
+     * Maximum number of items to return.
+     *
+     * Defaults to {@link DEFAULT_LIST_LIMIT}, and is clamped to
+     * {@link MAX_LIST_LIMIT}. Both bounds are applied by the backend, so a
+     * read is never unbounded whether or not a limit was asked for.
+     */
     limit?: number;
     /**
      * Number of items to skip. Ignored when {@link FindParams.page} is also
@@ -53,7 +59,7 @@ export interface FindParams<M extends Record<string, unknown> = Record<string, u
     offset?: number;
     /**
      * Page number (1-indexed), alternative to {@link FindParams.offset}.
-     * When set, overrides `offset` as `(page - 1) * (limit ?? 20)`.
+     * When set, overrides `offset` as `(page - 1) * (limit ?? DEFAULT_LIST_LIMIT)`.
      */
     page?: number;
     /**
@@ -116,12 +122,12 @@ export interface FindResponse<M extends Record<string, unknown> = Record<string,
 
 
 /**
- * Fluent query builder for the **admin admin** — resolves to `FindResponse<M>`
+ * Fluent query builder for the **admin panel** — resolves to `FindResponse<M>`
  * (Snapshot-wrapped rows).
  *
  * @internal App developers should use {@link SDKQueryBuilderInterface}
  * (flat rows, returned by `client.data.*` / `context.data.*`). This
- * Snapshot-flavored variant backs the admin admin internals only.
+ * Snapshot-flavored variant backs the admin panel internals only.
  *
  * @group Data
  */
@@ -138,13 +144,13 @@ export interface QueryBuilderInterface<M extends Record<string, unknown> = Recor
 }
 
 /**
- * A single collection's CRUD accessor for the **admin admin** — every method
+ * A single collection's CRUD accessor for the **admin panel** — every method
  * resolves to `Snapshot`-wrapped rows (`FindResponse<M>` / `Snapshot<M>`).
  *
  * @internal App developers do **not** use this. The public, symmetric surface
  * is {@link SDKCollectionClient} (flat rows), exposed as `client.data.products`
  * in the SDK and `context.data.products` in framework callbacks. This
- * Snapshot-flavored accessor backs the admin admin view-model only.
+ * Snapshot-flavored accessor backs the admin panel view-model only.
  *
  * @group Data
  */
@@ -181,6 +187,20 @@ export interface CollectionAccessor<M extends Record<string, unknown> = Record<s
      */
     update(id: string | number, data: Partial<EntityValues<M>>): Promise<Entity<M>>;
 
+    /**
+     * Update many records in a single transaction.
+     *
+     * See {@link SDKCollectionClient.updateMany}. Optional, as `createMany` is.
+     */
+    updateMany?(updates: { id: string | number; data: Partial<EntityValues<M>> }[]): Promise<Entity<M>[]>;
+
+    /**
+     * Delete many records in a single transaction.
+     *
+     * See {@link SDKCollectionClient.deleteMany}. Optional, as `createMany` is.
+     */
+    deleteMany?(ids: (string | number)[]): Promise<void>;
+
     /**
      * Delete a record by ID.
      */
@@ -200,6 +220,12 @@ export interface CollectionAccessor<M extends Record<string, unknown> = Record<s
 
     /**
      * Count the number of records matching the given filter.
+     *
+     * Optional on this contract because a data source need not support it, and
+     * required on `CollectionClient` — the HTTP implementation always has it.
+     * So `client.data.posts.count()` compiles in the browser while the same
+     * call through a `context.data` accessor needs `count?.()`, which is the
+     * one place the two halves of this API are not interchangeable.
      */
     count?(params?: FindParams<M>): Promise<number>;
 
@@ -501,6 +527,12 @@ export interface SDKCollectionClient<
      * Batches are capped server-side (1000 rows by default) because one batch
      * holds its locks for the whole transaction — chunk larger jobs.
      *
+     * Pass {@link WriteOptions.idempotencyKey} on anything that may be retried.
+     * A client that never sees the response cannot know whether the batch
+     * committed, and without a key the server cannot tell the retry from a
+     * second genuine import — so it performs it again, duplicating every row in
+     * the batch rather than just one.
+     *
      * @returns The written rows, in the order given.
      *
      * @example
@@ -510,7 +542,7 @@ export interface SDKCollectionClient<
      * }
      * ```
      */
-    createMany(data: I[], options?: { upsert?: boolean }): Promise<M[]>;
+    createMany(data: I[], options?: { upsert?: boolean } & WriteOptions): Promise<M[]>;
 
     /**
      * Update an existing record by ID.
@@ -520,6 +552,46 @@ export interface SDKCollectionClient<
      */
     update(id: string | number, data: U): Promise<M>;
 
+    /**
+     * Update many records in a single request and a single transaction.
+     *
+     * The counterpart to {@link createMany}, and the reason it exists is the
+     * same: one call per row means one HTTP round trip and one transaction per
+     * row. Every record still runs the normal pipeline — callbacks, relations,
+     * row-level security — and the batch is all-or-nothing, so a rejected
+     * record leaves none of them written and the error names the offending
+     * index.
+     *
+     * Each entry is `{ id, data }` rather than a flat row carrying its own key.
+     * That is deliberate: on a table keyed on something other than `id` — a
+     * `sku`, a composite key — a flat row cannot say whether a column is the
+     * address or a value to write. Naming the address separately mirrors
+     * single-row `update(id, data)` exactly and leaves nothing to infer.
+     *
+     * An id that matches no row fails the batch with a 404 rather than being
+     * skipped, for the same reason `update()` does: silently updating four of
+     * five rows is worse than updating none.
+     *
+     * Batches share `createMany`'s server-side cap (1000 rows by default),
+     * because one batch holds its locks for the whole transaction.
+     *
+     * Pass {@link WriteOptions.idempotencyKey} on anything that may be retried.
+     * An update replayed in full is naturally idempotent, but one interleaved
+     * with another writer's is not — the key is what stops a lost ACK from
+     * re-applying a stale batch over newer data.
+     *
+     * @returns The updated rows, in the order given.
+     *
+     * @example
+     * ```ts
+     * await client.data.orders.updateMany([
+     *     { id: "o-1", data: { status: "shipped" } },
+     *     { id: "o-2", data: { status: "shipped" } }
+     * ]);
+     * ```
+     */
+    updateMany(updates: { id: string | number; data: U }[], options?: WriteOptions): Promise<M[]>;
+
     /**
      * Delete a record by ID.
      * @throws {RebaseApiError} with status 404 when the record does not exist.
@@ -527,13 +599,48 @@ export interface SDKCollectionClient<
     delete(id: string | number): Promise<void>;
 
     /**
-     * Subscribe to a collection for real-time updates.
+     * Delete many records in a single request and a single transaction.
+     *
+     * Takes ids, not a filter. A filter-shaped bulk delete is a different and
+     * far more dangerous operation — the failure mode is an omitted or
+     * mistyped condition emptying a table, and it cannot be reviewed at the
+     * call site the way an explicit list can. Read first, then pass the ids you
+     * meant.
+     *
+     * `beforeDelete` and `afterDelete` fire per row, exactly as they do for
+     * single deletes, and returning `false` from `beforeDelete` fails the batch
+     * rather than quietly dropping one row from it. All-or-nothing, so an id
+     * that matches no row 404s the whole call.
+     *
+     * Shares `createMany`'s row cap.
+     *
+     * @example
+     * ```ts
+     * const stale = await client.data.sessions.findAll({
+     *     where: { expires_at: ["<", cutoff] }
+     * });
+     * await client.data.sessions.deleteMany(stale.map(s => s.id as string));
+     * ```
      */
-    listen?(params: FindParams<M> | undefined, onUpdate: (response: FindResult<M>) => void, onError?: (error: Error) => void): () => void;
+    deleteMany(ids: (string | number)[], options?: WriteOptions): Promise<void>;
 
     /**
-     * Subscribe to a single record for real-time updates.
+     * The low-level realtime subscription: raw server pushes, nothing else.
+     *
+     * **Prefer `observe()`** on a client from `@rebasepro/client`, which wraps
+     * this one and is what a UI actually wants — it emits from the local
+     * database first when offline is enabled, re-emits on local writes and
+     * rollbacks, and de-duplicates emissions so a refresh that changes nothing
+     * does not call back. `listen` does none of that; it forwards what the
+     * socket sends.
+     *
+     * Optional because it is only present when realtime is enabled. `observe()`
+     * is not — it degrades to a single fetch — which is the other reason to
+     * reach for it instead.
      */
+    listen?(params: FindParams<M> | undefined, onUpdate: (response: FindResult<M>) => void, onError?: (error: Error) => void): () => void;
+
+    /** {@link listen} for a single row. Prefer `observeById()`. */
     listenById?(id: string | number, onUpdate: (row: M | undefined) => void, onError?: (error: Error) => void): () => void;
 
     /**
@@ -552,7 +659,7 @@ export interface SDKCollectionClient<
 }
 
 /**
- * The unified data access object for the **admin admin** (Entity-shaped).
+ * The unified data access object for the **admin panel** (Entity-shaped).
  *
  * Access collections as dynamic properties: `data.products.find(...)`. Each
  * accessor returns `Entity`-wrapped records (`{ id, path, values }`) — the
@@ -561,7 +668,7 @@ export interface SDKCollectionClient<
  *
  * @internal App developers do **not** use this — they use
  * {@link RebaseSdkData} (flat rows), which is what the SDK client and backend
- * `context.data` expose. This Entity-shaped map backs the admin admin only.
+ * `context.data` expose. This Entity-shaped map backs the admin panel only.
  *
  * @group Data
  */
@@ -584,10 +691,15 @@ export type RebaseData<DB = unknown> = {
              * Dynamic collection accessor.
              * Access any collection by its slug as a property.
              *
+             * The index signature is `CollectionAccessor` alone, for the reason
+             * spelled out on {@link RebaseSdkData}: unioning in the `collection`
+             * method's own signature is unnecessary across an intersection, and it
+             * costs `data.products.find()` — the access this `@example` documents.
+             *
              * @example
              * data.products.find({ where: { status: ["==", "published"] } })
              */
-            [collectionSlug: string]: CollectionAccessor | ((slug: string) => CollectionAccessor);
+            [collectionSlug: string]: CollectionAccessor;
         }
 );
 
@@ -639,6 +751,26 @@ export type InsertOf<T> = T extends { Insert: infer I extends Record<string, unk
  */
 export type UpdateOf<T> = T extends { Update: infer U extends Record<string, unknown> } ? U : Partial<RowOf<T>>;
 
+/**
+ * Note on the untyped branch below: its index signature is
+ * `SDKCollectionClient`, NOT `SDKCollectionClient | ((slug: string) => …)`.
+ *
+ * The union looks like it is needed so `collection` — a method on this same
+ * object — satisfies the index signature. It is not, because `collection` is
+ * declared in a *separate* member of the intersection, and TypeScript only
+ * requires named properties to be assignable to an index signature declared
+ * alongside them. Including the function arm cost the documented accessor:
+ *
+ *     rebase.dataAsAdmin.projects.find()
+ *     //                          ^ Property 'find' does not exist on type
+ *     //                            'SDKCollectionClient | ((slug: string) => …)'
+ *
+ * Every project without a generated `Database` type lands on this branch, so
+ * property-style access — the form used by the `@example` below, by the
+ * scaffolded function template, and by the 0.13 migration note — did not
+ * compile for any of them. Do not restore the arm; use `collection(slug)` if a
+ * caller genuinely needs the by-slug function.
+ */
 export type RebaseSdkData<DB = unknown> = {
     /**
      * Get a flat collection accessor by slug.
@@ -659,6 +791,6 @@ export type RebaseSdkData<DB = unknown> = {
              * @example
              * data.products.find({ where: { status: ["==", "published"] } })
              */
-            [collectionSlug: string]: SDKCollectionClient | ((slug: string) => SDKCollectionClient);
+            [collectionSlug: string]: SDKCollectionClient;
         }
 );

package/src/controllers/data_driver.ts

@@ -169,6 +169,23 @@ export interface SaveManyProps<M extends Record<string, unknown> = Record<string
     upsert?: boolean;
 }
 
+/**
+ * @internal
+ */
+export interface UpdateManyProps<M extends Record<string, unknown> = Record<string, unknown>> {
+    path: string;
+    /**
+     * The rows to update, each named by its address.
+     *
+     * Distinct from {@link SaveManyProps.rows}, which carries keys *inside* the
+     * values and is insert-shaped — `saveMany` passes `status: "new"` and no
+     * `id`, so it cannot express "update exactly this row". This can, and it is
+     * why bulk update is a separate driver method rather than a flag on that one.
+     */
+    updates: { id: string | number; values: Partial<EntityValues<M>> }[];
+    collection?: CollectionConfig<M>;
+}
+
 /**
  * @internal
  */
@@ -177,6 +194,15 @@ export interface DeleteProps<M extends Record<string, unknown> = Record<string,
     collection?: CollectionConfig<M>;
 }
 
+/**
+ * @internal
+ */
+export interface DeleteManyProps<M extends Record<string, unknown> = Record<string, unknown>> {
+    path: string;
+    ids: (string | number)[];
+    collection?: CollectionConfig<M>;
+}
+
 export type FilterCombinationValidProps = {
     path: string;
     databaseId?: string;
@@ -258,6 +284,17 @@ export interface DataDriver {
      */
     saveMany?<M extends Record<string, unknown> = Record<string, unknown>>(props: SaveManyProps<M>): Promise<Record<string, unknown>[]>;
 
+    /**
+     * Update many rows in one transaction, each addressed by id.
+     *
+     * Optional for the same reason `saveMany` is: a driver that cannot make the
+     * batch atomic should not pretend to. The REST layer reports
+     * `BULK_UNSUPPORTED` rather than silently falling back to a loop of single
+     * writes, which would be neither atomic nor one round trip — the two things
+     * a caller reaches for a batch to get.
+     */
+    updateMany?<M extends Record<string, unknown> = Record<string, unknown>>(props: UpdateManyProps<M>): Promise<Record<string, unknown>[]>;
+
     /**
      * Delete a entity
      * @param props
@@ -271,6 +308,14 @@ export interface DataDriver {
      */
     deleteAll?(path: string): Promise<void>;
 
+    /**
+     * Delete many rows in one transaction, addressed by id.
+     *
+     * Ids rather than a filter, deliberately — see
+     * {@link SDKCollectionClient.deleteMany}. Optional, as `saveMany` is.
+     */
+    deleteMany?<M extends Record<string, unknown> = Record<string, unknown>>(props: DeleteManyProps<M>): Promise<void>;
+
     /**
      * Check if the given property is unique in the given collection
      * @param path Collection path

package/src/errors.ts

@@ -1,3 +1,42 @@
+/**
+ * The error codes every route can produce, as `RebaseApiError.code`.
+ *
+ * These are the defaults on `ApiError`'s static constructors server-side, so
+ * any endpoint can answer with one. They are **not** the complete set: routes
+ * pass their own more specific codes too (`EMAIL_EXISTS`, `TOKEN_EXPIRED`,
+ * `INVALID_BULK_BODY`, …), and auth alone defines a couple of dozen.
+ *
+ * Hence the union is deliberately open rather than closed. It exists to give
+ * autocomplete and to catch a typo in the common cases — `code` was a bare
+ * `string`, so `e.code === "NOT_FOUND"` and `e.code === "NOTFOUND"` were
+ * equally valid and only one of them worked. Closing it would be a lie that
+ * broke the moment a route added a code.
+ *
+ * @example
+ * if (e instanceof RebaseApiError) {
+ *   switch (e.code) {
+ *     case "NOT_FOUND": return null;          // completed
+ *     case "FORBIDDEN": return redirect();
+ *     default: throw e;                       // routes' own codes land here
+ *   }
+ * }
+ *
+ * @group Errors
+ */
+export type RebaseErrorCode =
+    | "BAD_REQUEST"
+    | "UNAUTHORIZED"
+    | "FORBIDDEN"
+    | "NOT_FOUND"
+    | "CONFLICT"
+    | "INTERNAL_ERROR"
+    | "SERVICE_UNAVAILABLE"
+    | "DB_PERMISSION_DENIED"
+    | "SCHEMA_DRIFT"
+    // `string & {}` keeps the union open while preserving completion on the
+    // literals above — a bare `| string` would collapse them and offer nothing.
+    | (string & {});
+
 /**
  * Structured initializer for {@link RebaseApiError}.
  *
@@ -10,8 +49,8 @@ export interface RebaseErrorInit {
      * logic errors that have no HTTP status.
      */
     status?: number;
-    /** Stable, machine-readable error code (e.g. `"NOT_FOUND"`, `"BAD_REQUEST"`). */
-    code?: string;
+    /** Stable, machine-readable error code. See {@link RebaseErrorCode}. */
+    code?: RebaseErrorCode;
     /** Structured error payload returned by the server, when present. */
     details?: unknown;
     /** The underlying error this one wraps, if any. */
@@ -45,8 +84,8 @@ export interface RebaseErrorInit {
 export class RebaseApiError extends Error {
     /** HTTP status code, or `undefined` for non-HTTP errors. */
     readonly status?: number;
-    /** Stable machine-readable error code, when the server supplied one. */
-    readonly code?: string;
+    /** Stable machine-readable error code, when the server supplied one. See {@link RebaseErrorCode}. */
+    readonly code?: RebaseErrorCode;
     /** Structured error payload from the server, when present. */
     readonly details?: unknown;
 

package/src/types/admin_block.ts

@@ -41,6 +41,7 @@ export const ADMIN_COLLECTION_KEYS = [
     "defaultSize",
     "defaultViewMode",
     "disableDefaultActions",
+    "display",
     "enabledViews",
     "entityActions",
     "entityViews",
@@ -51,6 +52,7 @@ export const ADMIN_COLLECTION_KEYS = [
     "formAutoSave",
     "formView",
     "group",
+    "hideFromEntityViews",
     "hideFromNavigation",
     "hideIdFromCollection",
     "hideIdFromForm",

package/src/types/collections.ts

@@ -19,9 +19,27 @@ import type { WhereFilterOp, FilterValues, FilterPreset } from "./filter-operato
 export interface BaseCollectionConfig<M extends Record<string, unknown> = Record<string, unknown>, USER extends User = User> {
 
     /**
-     * You can set an alias that will be used internally instead of the collection name.
-     * The `slug` value will be used to determine the URL of the collection.
-     * Note that you can use this value in reference properties too.
+     * The collection's identity. Required, and the value nearly everything else
+     * keys on:
+     *
+     * - the REST path — `/api/data/<slug>`
+     * - the SDK accessor — `client.data.<slug>` / `client.data.collection("<slug>")`
+     * - the admin panel's URL
+     * - the target of a `reference` or `relation` property
+     *
+     * Conventionally kebab-case and plural (`blog-posts`). It is independent of
+     * {@link table}: the slug is what callers say, the table is where the rows
+     * live, and renaming one does not rename the other.
+     *
+     * Treat it as frozen once anything has shipped against it — changing a slug
+     * changes every URL and every generated accessor at once.
+     *
+     * @example
+     * defineCollection({
+     *     slug: "blog-posts",   // /api/data/blog-posts, client.data.blogPosts
+     *     table: "posts",
+     *     properties: { … }
+     * })
      */
     slug: string;
 

package/src/types/cron.ts

@@ -1,4 +1,5 @@
-import type { RebaseClient } from "../controllers/client";
+import type { RebaseServerClient } from "../controllers/client";
+import type { RebaseSdkData } from "../controllers/data";
 
 /**
  * Cron Job type definitions for Rebase.
@@ -93,16 +94,57 @@ export interface CronJobContext {
     log: (...args: unknown[]) => void;
 
     /**
-     * The server-side {@link RebaseClient}. This is the **same singleton**
-     * exposed as `rebase` (imported from `@rebasepro/server`) and as
-     * `context` in collection callbacks — it is only named `client` here.
+     * The server-side Rebase singleton — the **same object** `import { rebase }
+     * from "@rebasepro/server"` returns, and the same one `defineFunction`
+     * hands its callback. Spelled the same way here so that one thing has one
+     * name across every server-side authoring surface.
      *
-     * Its data plane (`client.data`) runs with **admin privileges and bypasses
-     * RLS** (`{ uid: "service", roles: ["admin"] }`). There is no per-request
-     * user in a cron, so treat every query as fully trusted and scope your own
-     * filters explicitly.
+     * Its data plane is {@link RebaseServerClient.dataAsAdmin}, which runs with
+     * **admin privileges and bypasses RLS** (`{ uid: "service", roles:
+     * ["admin"] }`). A cron has no per-request user, so there is no user-scoped
+     * alternative here and no policy to fall back on: scope every query's
+     * filters yourself.
+     *
+     * @example
+     * export default defineCron({
+     *     name: "Nightly cleanup",
+     *     schedule: "0 3 * * *",
+     *     async handler({ rebase, log }) {
+     *         const expired = await rebase.dataAsAdmin.sessions.findAll({
+     *             where: { expired: ["==", true] }
+     *         });
+     *         for (const session of expired) {
+     *             await rebase.dataAsAdmin.sessions.delete(session.id as string);
+     *         }
+     *         log(`Deleted ${expired.length} expired sessions`);
+     *     }
+     * });
+     */
+    rebase: RebaseServerClient;
+
+    /**
+     * The same object as {@link rebase}, under the name this context used
+     * before.
+     *
+     * @deprecated Use `rebase` instead. Two things made the old name a problem,
+     * and neither was cosmetic. It contradicted every other server surface,
+     * where the singleton is `rebase` — the previous docstring had to end with
+     * *"it is only named `client` here"*. And typing it as `RebaseClient`
+     * re-exposed `client.data`, the alias that {@link RebaseServerClient}
+     * deliberately `Omit`s so the RLS-bypassing plane has exactly one name and
+     * the privilege is visible at the call site. A reader who learned
+     * `client.data` here carried it to a collection callback, where
+     * `context.data` is the *user-scoped* plane — same spelling, opposite
+     * privilege.
+     *
+     * Still the full server client at runtime, and `data` still resolves, so
+     * existing cron files keep working and keep compiling. It will be removed
+     * in the next major.
      */
-    client: RebaseClient;
+    client: RebaseServerClient & {
+        /** @deprecated Use `rebase.dataAsAdmin` — the name states the privilege. */
+        data: RebaseSdkData;
+    };
 }
 
 // =============================================================================

package/src/types/entity_callbacks.ts

@@ -8,7 +8,8 @@ import type { RebaseCallContext } from "../call_context";
  *
  * Register per-collection on the collection's `callbacks` field, or globally
  * via `initializeRebaseBackend({ callbacks })`. Fires on **every** data path — REST API,
- * WebSocket / realtime subscriptions, and server-side `rebase.data`.
+ * WebSocket / realtime subscriptions, and server-side writes through
+ * `rebase.dataAsAdmin`.
  *
  * When both global and per-collection callbacks are registered, execution
  * order is: **global → collection → property callbacks**.

package/src/types/index.ts

@@ -7,6 +7,7 @@ export * from "./admin_block";
 export * from "./collections";
 export * from "./relations";
 export * from "./policy";
+export * from "./rls-functions";
 export * from "./security_rules";
 
 export * from "./entity_callbacks";

package/src/types/policy.ts

@@ -32,7 +32,7 @@ export type PolicyExpression =
     | RawPolicyExpression;
 
 /**
- * The id a request without a logged-in user reports as `auth.uid()`.
+ * The id a request without a logged-in user reports as `rebase.uid()`.
  *
  * A user-context request always sets `app.uid`: blank would read back as
  * `NULL`, and `NULL` is how the trusted server context is recognised, so an
@@ -40,7 +40,7 @@ export type PolicyExpression =
  * therefore substitutes this sentinel at the single chokepoint where the GUC
  * is set.
  *
- * The consequence for policy authors is that **`auth.uid() IS NOT NULL` is a
+ * The consequence for policy authors is that **`rebase.uid() IS NOT NULL` is a
  * tautology on the user path** — it is true for anonymous visitors too. Use
  * {@link policy.authenticated} to mean "signed in", and
  * {@link policy.serverContext} to mean "the trusted server context". Do not
@@ -58,7 +58,7 @@ export const ANONYMOUS_USER_ID = "anonymous";
  * JavaScript evaluator and the linter were all built on
  * {@link ANONYMOUS_USER_ID}, while the request path scoped unauthenticated
  * callers as `'anon'` — so `policy.authenticated()`, which compiled to
- * `auth.uid() <> 'anonymous'`, was *true* for an anonymous visitor. The
+ * `rebase.uid() <> 'anonymous'`, was *true* for an anonymous visitor. The
  * sanctioned way to write "signed in" granted to everyone, and the linter
  * flagged the spelling that actually worked as a foreign convention.
  *
@@ -117,7 +117,7 @@ export interface NotPolicyExpression {
 export type PolicyCompareOperator = "eq" | "neq" | "lt" | "lte" | "gt" | "gte";
 
 /**
- * Compares two operands, e.g. `owner_id = auth.uid()`.
+ * Compares two operands, e.g. `owner_id = rebase.uid()`.
  * @group Models
  */
 export interface ComparePolicyExpression {
@@ -129,7 +129,7 @@ export interface ComparePolicyExpression {
 
 /**
  * True when the user holds *at least one* of the given application roles.
- * Compiles to `string_to_array(auth.roles(), ',') && ARRAY[...]`.
+ * Compiles to `string_to_array(rebase.roles(), ',') && ARRAY[...]`.
  * @group Models
  */
 export interface RolesOverlapPolicyExpression {
@@ -139,7 +139,7 @@ export interface RolesOverlapPolicyExpression {
 
 /**
  * True when the user holds *all* of the given application roles.
- * Compiles to `string_to_array(auth.roles(), ',') @> ARRAY[...]`.
+ * Compiles to `string_to_array(rebase.roles(), ',') @> ARRAY[...]`.
  * @group Models
  */
 export interface RolesContainPolicyExpression {
@@ -149,11 +149,11 @@ export interface RolesContainPolicyExpression {
 
 /**
  * True when a signed-in user is making the request. Compiles to
- * `auth.uid() IS NOT NULL AND auth.uid() <> 'anonymous'`.
+ * `rebase.uid() IS NOT NULL AND rebase.uid() <> 'anonymous'`.
  *
  * Both halves are load-bearing. `IS NOT NULL` excludes the server context;
  * the {@link ANONYMOUS_USER_ID} comparison excludes anonymous visitors, who
- * *do* carry a non-null `auth.uid()`. Checking only `IS NOT NULL` grants to
+ * *do* carry a non-null `rebase.uid()`. Checking only `IS NOT NULL` grants to
  * everyone — see {@link ANONYMOUS_USER_ID}.
  *
  * `policy.not(policy.authenticated())` therefore means "anonymous visitor or
@@ -168,8 +168,8 @@ export interface AuthenticatedPolicyExpression {
 /**
  * True only in the trusted **server context** — the built-in flows that run
  * without a user (signup, migrations, `dataAsAdmin`) set no user GUC, so
- * `auth.uid()` is `NULL` for them and only for them. Compiles to
- * `auth.uid() IS NULL`.
+ * `rebase.uid()` is `NULL` for them and only for them. Compiles to
+ * `rebase.uid() IS NULL`.
  *
  * This is what lets the owner connection satisfy a policy even under FORCE RLS.
  * It is deliberately a primitive rather than `not(authenticated())`: the two
@@ -207,7 +207,7 @@ export interface ServerContextPolicyExpression {
  *   ),
  * })
  * // → EXISTS (SELECT 1 FROM team_members _ex0
- * //           WHERE _ex0.team_id = documents.team_id AND _ex0.user_id = auth.uid())
+ * //           WHERE _ex0.team_id = documents.team_id AND _ex0.user_id = rebase.uid())
  * ```
  *
  * Postgres-authoritative: like {@link RawPolicyExpression}, the JavaScript
@@ -272,14 +272,14 @@ export interface LiteralPolicyOperand {
     value: string | number | boolean | null;
 }
 
-/** The current user's id — compiles to `auth.uid()`. @group Models */
+/** The current user's id — compiles to `rebase.uid()`. @group Models */
 export interface AuthUidPolicyOperand {
     kind: "authUid";
 }
 
 /**
  * The current user's roles as an array — compiles to
- * `string_to_array(auth.roles(), ',')`.
+ * `string_to_array(rebase.roles(), ',')`.
  * @group Models
  */
 export interface AuthRolesPolicyOperand {