@rebasepro/types 0.15.0 → 0.16.0

package/dist/types/backend.d.ts

@@ -345,7 +345,7 @@ export interface SQLAdmin {
      * Fetch the *application-level* roles in use in this project.
      *
      * These are the strings stored on the users table's `roles` column and
-     * exposed to policies as `auth.roles()` — what `SecurityRule.roles`
+     * exposed to policies as `rebase.roles()` — what `SecurityRule.roles`
      * matches against. Distinct from {@link fetchAvailableRoles}; the two are
      * not interchangeable.
      */
@@ -667,6 +667,33 @@ export interface BackendBootstrapper {
     ensureCollectionPolicies?(collections: unknown[], driverResult?: InitializedDriver, log?: (message: string) => void): Promise<{
         applied: number;
     }>;
+    /**
+     * Read the collections schema version this database was last provisioned
+     * from, or `null` when nothing has ever stamped it.
+     *
+     * The companion to {@link stampCollectionsSchemaVersion}: one process writes
+     * what it applied, every other process compares itself to it. This is what
+     * lets a split deployment — several processes over one database, only one of
+     * which provisions — notice that a unit is serving against a schema it was
+     * not built for. That failure is otherwise silent in both directions: a
+     * column that does not exist is a SQL error on one route, and a policy that
+     * was never applied is a 200 with no rows.
+     *
+     * `null` is not an error and MUST NOT be treated as one — every database
+     * provisioned before the stamp existed reads this way, and so does every
+     * fresh one until its first provisioning boot finishes.
+     */
+    readCollectionsSchemaVersion?(driverResult?: InitializedDriver): Promise<string | null>;
+    /**
+     * Record the collections schema version this process just applied.
+     *
+     * Called only by the process that provisions, and only after both
+     * {@link ensureCollectionSchema} and {@link ensureCollectionPolicies} have
+     * run — a stamp written before the policies would claim a schema that is
+     * only half in place, and the half that is missing is the one that fails
+     * without an error.
+     */
+    stampCollectionsSchemaVersion?(version: string, driverResult?: InitializedDriver): Promise<void>;
     /**
      * Initialize WebSocket server for realtime operations.
      */

package/dist/types/collections.d.ts

@@ -210,9 +210,9 @@ export interface PostgresCollectionConfig<M extends Record<string, unknown> = Re
      * 3. **Combined** — mix shortcuts with `roles` for common patterns
      *
      * The authenticated user context is available in raw SQL via:
-     * - `auth.uid()`   — the current user's ID
-     * - `auth.roles()` — comma-separated app role IDs
-     * - `auth.jwt()`   — full JWT claims as JSONB
+     * - `rebase.uid()`   — the current user's ID
+     * - `rebase.roles()` — comma-separated app role IDs
+     * - `rebase.jwt()`   — full JWT claims as JSONB
      */
     securityRules?: readonly SecurityRule[];
     /**
@@ -222,7 +222,7 @@ export interface PostgresCollectionConfig<M extends Record<string, unknown> = Re
      * baseline SELECT policy granting the trusted server context and the
      * `admin` role read access (reads run under a restricted role, so RLS
      * default-denies without it). For auth collections it additionally injects
-     * a self-read policy (`id = auth.uid()`) and an admin-only write gate
+     * a self-read policy (`id = rebase.uid()`) and an admin-only write gate
      * (INSERT/UPDATE/DELETE require the `admin` role or the trusted server
      * context), making privileged columns such as `roles` safe by default.
      *

package/dist/types/cron.d.ts

@@ -81,10 +81,14 @@ export interface CronJobContext {
      * hands its callback. Spelled the same way here so that one thing has one
      * name across every server-side authoring surface.
      *
-     * Its data plane is {@link RebaseServerClient.dataAsAdmin}, which runs with
-     * **admin privileges and bypasses RLS** (`{ uid: "service", roles:
-     * ["admin"] }`). A cron has no per-request user, so there is no user-scoped
-     * alternative here and no policy to fall back on: scope every query's
+     * Its data plane is {@link RebaseServerClient.dataAsAdmin}, scoped as
+     * `{ uid: "service", roles: ["admin"] }` — **admin-scoped, not
+     * RLS-bypassing**. Statements still run as `rebase_user` with the policies
+     * evaluated against that identity; the admin role merely clears the default
+     * policies through their `rolesOverlap(['admin'])` arm, and
+     * `policy.serverContext()` (`rebase.uid() IS NULL`) is *false* for it.
+     * `rebase.sql()` is the unconditional bypass. A cron has no per-request
+     * user, so there is no user-scoped alternative here: scope every query's
      * filters yourself.
      *
      * @example

package/dist/types/database_adapter.d.ts

@@ -109,6 +109,27 @@ export interface DatabaseAdapter {
     ensureCollectionPolicies?(collections: unknown[], driverResult?: InitializedDriver, log?: (message: string) => void): Promise<{
         applied: number;
     }>;
+    /**
+     * Read the collections schema version this database was last provisioned
+     * from, or `null` when nothing has ever stamped it.
+     *
+     * `null` is not an error and MUST NOT be treated as one — every database
+     * provisioned before the stamp existed reads this way, and so does every
+     * fresh one until its first provisioning boot finishes.
+     *
+     * Same forwarding requirement as the two hooks above: a wrapper that omits
+     * it turns the check off, and a check that is off looks exactly like a check
+     * that passed.
+     */
+    readCollectionsSchemaVersion?(driverResult?: InitializedDriver): Promise<string | null>;
+    /**
+     * Record the collections schema version this process just applied.
+     *
+     * Called only by the process that provisions, and only after the tables AND
+     * the policies are in place — a stamp written earlier would claim a schema
+     * that a half-finished boot never finished creating.
+     */
+    stampCollectionsSchemaVersion?(version: string, driverResult?: InitializedDriver): Promise<void>;
     /**
      * Return admin capabilities for this database (SQL editor, schema browser, branching).
      */
@@ -176,4 +197,33 @@ export interface DatabaseAdapterInitConfig {
         /** Why it did not, when it did not — safe to print verbatim. */
         reason?: string;
     };
+    /**
+     * What this process wants from the realtime subsystem.
+     *
+     * Both halves used to be assumed true, and both were wrong for a split
+     * deployment. A `functions` or `worker` process has no websocket clients, so
+     * consuming change events buys it a dedicated `LISTEN` connection to deliver
+     * to nobody; and it is explicitly not the process that owns schema DDL, so
+     * installing capture triggers from it contradicts the one-owner rule the
+     * runtime otherwise refuses to boot without.
+     *
+     * Absent means both — every caller that predates this field is a
+     * single-process deployment, where both are true.
+     */
+    realtime?: {
+        /**
+         * Consume change events: open the `LISTEN` connection, start CDC or the
+         * app-level fallback. False for a process that serves no websockets.
+         *
+         * Writes made by a non-consuming process are still published: capture is
+         * database triggers, so the publisher is the database.
+         */
+        subscribe: boolean;
+        /**
+         * Install what capture needs — the trigger function, the per-table
+         * triggers, any channel-history tables. This is DDL, and it follows the
+         * same single-owner rule as every other boot-time schema change.
+         */
+        provision: boolean;
+    };
 }

package/dist/types/project_manifest.d.ts

@@ -395,6 +395,45 @@ export interface RebaseBundleManifest {
     deps: {
         /** Runtime dependencies of user code, as declared. */
         declared: Record<string, string>;
+        /**
+         * The dependency tree ships *inside* the bundle, already installed.
+         *
+         * Absent or false means the tree is declared but not present, and
+         * whoever boots the bundle has to install it. On the managed runtime that
+         * install runs in an init container on **every** pod start — the bundle
+         * lives on a volume that is wiped each time — and it is the single
+         * largest cost in a managed pod's life: 35–55 seconds of a 40–60 second
+         * cold start. Since a pod restarts on every eviction, node failure, OOM
+         * and runtime rollout, that number is not a startup detail. It is what an
+         * outage costs.
+         *
+         * Vendoring moves the install to build time, where it happens once. It is
+         * skipped when the closure contains native code, because a prebuilt
+         * binary is only valid for the platform it was built for — see
+         * {@link vendorTarget} for what "the platform" means here.
+         */
+        vendored?: boolean;
+        /**
+         * What {@link vendored} was resolved for, recorded so a mismatch can be
+         * refused rather than discovered at import time.
+         *
+         * Cross-platform vendoring is safe for pure JavaScript and unsafe for
+         * anything compiled, and the boundary between them is not always visible
+         * in a dependency list: `esbuild` is pure-JS with a *platform-specific
+         * optional dependency* holding the actual binary, so an install run on a
+         * developer's Mac silently produces a tree that cannot run on the Linux
+         * image. The install therefore resolves optional dependencies for the
+         * target explicitly rather than for the machine it runs on, and records
+         * the answer here.
+         */
+        vendorTarget?: {
+            /** npm `--os`, e.g. `linux`. */
+            os: string;
+            /** npm `--cpu`, e.g. `x64`. */
+            cpu: string;
+            /** Node major the tree was resolved for. */
+            node: string;
+        };
     };
     build: {
         /** `@rebasepro/cli` version that produced this bundle. */

package/dist/types/security_rules.d.ts

@@ -29,9 +29,9 @@ export type SecurityOperation = "select" | "insert" | "update" | "delete" | "all
  * full power of PostgreSQL Row Level Security.
  *
  * The authenticated user's identity is available in raw SQL via:
- * - `auth.uid()`   — the user's ID
- * - `auth.roles()` — comma-separated app role IDs
- * - `auth.jwt()`   — full JWT claims as JSONB
+ * - `rebase.uid()`   — the user's ID
+ * - `rebase.roles()` — comma-separated app role IDs
+ * - `rebase.jwt()`   — full JWT claims as JSONB
  *
  * These are set automatically per-transaction by the backend.
  *
@@ -119,13 +119,13 @@ export interface SecurityRuleBase {
      * produce a condition no user can satisfy if used here. These are
      * application roles managed by Rebase, stored as an inline `roles TEXT[]`
      * column on the users table, and injected into each transaction as
-     * `app.user_roles` — which `auth.roles()` reads.
+     * `app.user_roles` — which `rebase.roles()` reads.
      *
      * There is no roles registry: a role exists once it is assigned to a user.
      *
      * Generates a safe array-overlap condition — the user passes if they hold
      * *any* of the listed roles:
-     *   `string_to_array(auth.roles(), ',') && ARRAY['<role1>', '<role2>']`
+     *   `string_to_array(rebase.roles(), ',') && ARRAY['<role1>', '<role2>']`
      *
      * (Note: this is a true set intersection, NOT a regex/substring match, so
      * a role named `admin` never matches `nonadmin` or `superadmin`.)
@@ -152,7 +152,7 @@ export interface SecurityRuleBase {
      *
      * **Important:** These are NOT the same as the application-level
      * {@link roles} (admin, editor, viewer, etc.) — those are enforced in the
-     * USING/WITH CHECK clauses via `auth.roles()`. This field controls the
+     * USING/WITH CHECK clauses via `rebase.roles()`. This field controls the
      * PostgreSQL `TO` clause in `CREATE POLICY ... TO role_name`.
      *
      * Use this if you have dedicated PostgreSQL roles (e.g. `app_read`,
@@ -168,7 +168,7 @@ export interface SecurityRuleBase {
 }
 /**
  * Security rule that grants access based on row ownership.
- * Generates a USING/WITH CHECK clause like: `<column> = auth.uid()`
+ * Generates a USING/WITH CHECK clause like: `<column> = rebase.uid()`
  *
  * Cannot be combined with `using`, `withCheck`, or `access`.
  *
@@ -271,7 +271,7 @@ export interface StructuredSecurityRule extends SecurityRuleBase {
  * // Only the owner, or users with 'moderator' role
  * {
  *   operation: "select",
- *   using: "{user_id} = auth.uid() OR auth.roles() ~ 'moderator'"
+ *   using: "{user_id} = rebase.uid() OR rebase.roles() ~ 'moderator'"
  * }
  *
  * @group Models

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@rebasepro/types",
   "type": "module",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "description": "Rebase type definitions — shared interfaces and controller types",
   "funding": {
     "url": "https://github.com/sponsors/rebaseco"

package/src/call_context.ts

@@ -67,7 +67,7 @@ export type RebaseCallContext<USER extends User = User> = {
      * because RLS filters rather than raises. Write callbacks that tolerate
      * that, or reach for {@link client}`.dataAsAdmin` deliberately when the
      * callback genuinely has to see what an admin may see. Note what that does
-     * *not* buy you: `policy.serverContext()` (`auth.uid() IS NULL`) is false
+     * *not* buy you: `policy.serverContext()` (`rebase.uid() IS NULL`) is false
      * for the service identity, so a collection whose only rule is
      * `serverContext()` stays closed to it.
      *

package/src/controllers/client.ts

@@ -279,7 +279,7 @@ export interface RebaseClient<DB = unknown> {
      *
      * Two consequences the name does not suggest:
      *
-     * - `policy.serverContext()` compiles to `auth.uid() IS NULL` and is
+     * - `policy.serverContext()` compiles to `rebase.uid() IS NULL` and is
      *   therefore **false** here. A collection with `disableDefaultPolicies:
      *   true` whose only rule is `serverContext()` refuses these writes
      *   (`42501`) and returns zero rows — HTTP 200, empty — for these reads.

package/src/types/backend.ts

@@ -470,7 +470,7 @@ export interface SQLAdmin {
      * Fetch the *application-level* roles in use in this project.
      *
      * These are the strings stored on the users table's `roles` column and
-     * exposed to policies as `auth.roles()` — what `SecurityRule.roles`
+     * exposed to policies as `rebase.roles()` — what `SecurityRule.roles`
      * matches against. Distinct from {@link fetchAvailableRoles}; the two are
      * not interchangeable.
      */
@@ -857,6 +857,40 @@ export interface BackendBootstrapper {
         log?: (message: string) => void
     ): Promise<{ applied: number }>;
 
+    /**
+     * Read the collections schema version this database was last provisioned
+     * from, or `null` when nothing has ever stamped it.
+     *
+     * The companion to {@link stampCollectionsSchemaVersion}: one process writes
+     * what it applied, every other process compares itself to it. This is what
+     * lets a split deployment — several processes over one database, only one of
+     * which provisions — notice that a unit is serving against a schema it was
+     * not built for. That failure is otherwise silent in both directions: a
+     * column that does not exist is a SQL error on one route, and a policy that
+     * was never applied is a 200 with no rows.
+     *
+     * `null` is not an error and MUST NOT be treated as one — every database
+     * provisioned before the stamp existed reads this way, and so does every
+     * fresh one until its first provisioning boot finishes.
+     */
+    readCollectionsSchemaVersion?(
+        driverResult?: InitializedDriver
+    ): Promise<string | null>;
+
+    /**
+     * Record the collections schema version this process just applied.
+     *
+     * Called only by the process that provisions, and only after both
+     * {@link ensureCollectionSchema} and {@link ensureCollectionPolicies} have
+     * run — a stamp written before the policies would claim a schema that is
+     * only half in place, and the half that is missing is the one that fails
+     * without an error.
+     */
+    stampCollectionsSchemaVersion?(
+        version: string,
+        driverResult?: InitializedDriver
+    ): Promise<void>;
+
     /**
      * Initialize WebSocket server for realtime operations.
      */

package/src/types/collections.ts

@@ -283,9 +283,9 @@ export interface PostgresCollectionConfig<M extends Record<string, unknown> = Re
      * 3. **Combined** — mix shortcuts with `roles` for common patterns
      *
      * The authenticated user context is available in raw SQL via:
-     * - `auth.uid()`   — the current user's ID
-     * - `auth.roles()` — comma-separated app role IDs
-     * - `auth.jwt()`   — full JWT claims as JSONB
+     * - `rebase.uid()`   — the current user's ID
+     * - `rebase.roles()` — comma-separated app role IDs
+     * - `rebase.jwt()`   — full JWT claims as JSONB
      */
     securityRules?: readonly SecurityRule[];
 
@@ -296,7 +296,7 @@ export interface PostgresCollectionConfig<M extends Record<string, unknown> = Re
      * baseline SELECT policy granting the trusted server context and the
      * `admin` role read access (reads run under a restricted role, so RLS
      * default-denies without it). For auth collections it additionally injects
-     * a self-read policy (`id = auth.uid()`) and an admin-only write gate
+     * a self-read policy (`id = rebase.uid()`) and an admin-only write gate
      * (INSERT/UPDATE/DELETE require the `admin` role or the trusted server
      * context), making privileged columns such as `roles` safe by default.
      *

package/src/types/cron.ts

@@ -99,10 +99,14 @@ export interface CronJobContext {
      * hands its callback. Spelled the same way here so that one thing has one
      * name across every server-side authoring surface.
      *
-     * Its data plane is {@link RebaseServerClient.dataAsAdmin}, which runs with
-     * **admin privileges and bypasses RLS** (`{ uid: "service", roles:
-     * ["admin"] }`). A cron has no per-request user, so there is no user-scoped
-     * alternative here and no policy to fall back on: scope every query's
+     * Its data plane is {@link RebaseServerClient.dataAsAdmin}, scoped as
+     * `{ uid: "service", roles: ["admin"] }` — **admin-scoped, not
+     * RLS-bypassing**. Statements still run as `rebase_user` with the policies
+     * evaluated against that identity; the admin role merely clears the default
+     * policies through their `rolesOverlap(['admin'])` arm, and
+     * `policy.serverContext()` (`rebase.uid() IS NULL`) is *false* for it.
+     * `rebase.sql()` is the unconditional bypass. A cron has no per-request
+     * user, so there is no user-scoped alternative here: scope every query's
      * filters yourself.
      *
      * @example

package/src/types/database_adapter.ts

@@ -139,6 +139,34 @@ export interface DatabaseAdapter {
         log?: (message: string) => void,
     ): Promise<{ applied: number }>;
 
+    /**
+     * Read the collections schema version this database was last provisioned
+     * from, or `null` when nothing has ever stamped it.
+     *
+     * `null` is not an error and MUST NOT be treated as one — every database
+     * provisioned before the stamp existed reads this way, and so does every
+     * fresh one until its first provisioning boot finishes.
+     *
+     * Same forwarding requirement as the two hooks above: a wrapper that omits
+     * it turns the check off, and a check that is off looks exactly like a check
+     * that passed.
+     */
+    readCollectionsSchemaVersion?(
+        driverResult?: InitializedDriver,
+    ): Promise<string | null>;
+
+    /**
+     * Record the collections schema version this process just applied.
+     *
+     * Called only by the process that provisions, and only after the tables AND
+     * the policies are in place — a stamp written earlier would claim a schema
+     * that a half-finished boot never finished creating.
+     */
+    stampCollectionsSchemaVersion?(
+        version: string,
+        driverResult?: InitializedDriver,
+    ): Promise<void>;
+
     /**
      * Return admin capabilities for this database (SQL editor, schema browser, branching).
      */
@@ -207,4 +235,33 @@ export interface DatabaseAdapterInitConfig {
         /** Why it did not, when it did not — safe to print verbatim. */
         reason?: string;
     };
+    /**
+     * What this process wants from the realtime subsystem.
+     *
+     * Both halves used to be assumed true, and both were wrong for a split
+     * deployment. A `functions` or `worker` process has no websocket clients, so
+     * consuming change events buys it a dedicated `LISTEN` connection to deliver
+     * to nobody; and it is explicitly not the process that owns schema DDL, so
+     * installing capture triggers from it contradicts the one-owner rule the
+     * runtime otherwise refuses to boot without.
+     *
+     * Absent means both — every caller that predates this field is a
+     * single-process deployment, where both are true.
+     */
+    realtime?: {
+        /**
+         * Consume change events: open the `LISTEN` connection, start CDC or the
+         * app-level fallback. False for a process that serves no websockets.
+         *
+         * Writes made by a non-consuming process are still published: capture is
+         * database triggers, so the publisher is the database.
+         */
+        subscribe: boolean;
+        /**
+         * Install what capture needs — the trigger function, the per-table
+         * triggers, any channel-history tables. This is DDL, and it follows the
+         * same single-owner rule as every other boot-time schema change.
+         */
+        provision: boolean;
+    };
 }

package/src/types/project_manifest.ts

@@ -415,6 +415,45 @@ export interface RebaseBundleManifest {
     deps: {
         /** Runtime dependencies of user code, as declared. */
         declared: Record<string, string>;
+        /**
+         * The dependency tree ships *inside* the bundle, already installed.
+         *
+         * Absent or false means the tree is declared but not present, and
+         * whoever boots the bundle has to install it. On the managed runtime that
+         * install runs in an init container on **every** pod start — the bundle
+         * lives on a volume that is wiped each time — and it is the single
+         * largest cost in a managed pod's life: 35–55 seconds of a 40–60 second
+         * cold start. Since a pod restarts on every eviction, node failure, OOM
+         * and runtime rollout, that number is not a startup detail. It is what an
+         * outage costs.
+         *
+         * Vendoring moves the install to build time, where it happens once. It is
+         * skipped when the closure contains native code, because a prebuilt
+         * binary is only valid for the platform it was built for — see
+         * {@link vendorTarget} for what "the platform" means here.
+         */
+        vendored?: boolean;
+        /**
+         * What {@link vendored} was resolved for, recorded so a mismatch can be
+         * refused rather than discovered at import time.
+         *
+         * Cross-platform vendoring is safe for pure JavaScript and unsafe for
+         * anything compiled, and the boundary between them is not always visible
+         * in a dependency list: `esbuild` is pure-JS with a *platform-specific
+         * optional dependency* holding the actual binary, so an install run on a
+         * developer's Mac silently produces a tree that cannot run on the Linux
+         * image. The install therefore resolves optional dependencies for the
+         * target explicitly rather than for the machine it runs on, and records
+         * the answer here.
+         */
+        vendorTarget?: {
+            /** npm `--os`, e.g. `linux`. */
+            os: string;
+            /** npm `--cpu`, e.g. `x64`. */
+            cpu: string;
+            /** Node major the tree was resolved for. */
+            node: string;
+        };
     };
     build: {
         /** `@rebasepro/cli` version that produced this bundle. */

package/src/types/security_rules.ts

@@ -31,9 +31,9 @@ export type SecurityOperation = "select" | "insert" | "update" | "delete" | "all
  * full power of PostgreSQL Row Level Security.
  *
  * The authenticated user's identity is available in raw SQL via:
- * - `auth.uid()`   — the user's ID
- * - `auth.roles()` — comma-separated app role IDs
- * - `auth.jwt()`   — full JWT claims as JSONB
+ * - `rebase.uid()`   — the user's ID
+ * - `rebase.roles()` — comma-separated app role IDs
+ * - `rebase.jwt()`   — full JWT claims as JSONB
  *
  * These are set automatically per-transaction by the backend.
  *
@@ -131,13 +131,13 @@ export interface SecurityRuleBase {
      * produce a condition no user can satisfy if used here. These are
      * application roles managed by Rebase, stored as an inline `roles TEXT[]`
      * column on the users table, and injected into each transaction as
-     * `app.user_roles` — which `auth.roles()` reads.
+     * `app.user_roles` — which `rebase.roles()` reads.
      *
      * There is no roles registry: a role exists once it is assigned to a user.
      *
      * Generates a safe array-overlap condition — the user passes if they hold
      * *any* of the listed roles:
-     *   `string_to_array(auth.roles(), ',') && ARRAY['<role1>', '<role2>']`
+     *   `string_to_array(rebase.roles(), ',') && ARRAY['<role1>', '<role2>']`
      *
      * (Note: this is a true set intersection, NOT a regex/substring match, so
      * a role named `admin` never matches `nonadmin` or `superadmin`.)
@@ -167,7 +167,7 @@ export interface SecurityRuleBase {
      *
      * **Important:** These are NOT the same as the application-level
      * {@link roles} (admin, editor, viewer, etc.) — those are enforced in the
-     * USING/WITH CHECK clauses via `auth.roles()`. This field controls the
+     * USING/WITH CHECK clauses via `rebase.roles()`. This field controls the
      * PostgreSQL `TO` clause in `CREATE POLICY ... TO role_name`.
      *
      * Use this if you have dedicated PostgreSQL roles (e.g. `app_read`,
@@ -184,7 +184,7 @@ export interface SecurityRuleBase {
 
 /**
  * Security rule that grants access based on row ownership.
- * Generates a USING/WITH CHECK clause like: `<column> = auth.uid()`
+ * Generates a USING/WITH CHECK clause like: `<column> = rebase.uid()`
  *
  * Cannot be combined with `using`, `withCheck`, or `access`.
  *
@@ -292,7 +292,7 @@ export interface StructuredSecurityRule extends SecurityRuleBase {
  * // Only the owner, or users with 'moderator' role
  * {
  *   operation: "select",
- *   using: "{user_id} = auth.uid() OR auth.roles() ~ 'moderator'"
+ *   using: "{user_id} = rebase.uid() OR rebase.roles() ~ 'moderator'"
  * }
  *
  * @group Models