@rebasepro/types 0.6.1 → 0.8.0

package/dist/types/auth_adapter.d.ts

@@ -4,8 +4,8 @@
  * Pluggable authentication abstraction for Rebase.
  *
  * An `AuthAdapter` decouples authentication from the database layer,
- * allowing users to bring their own auth system (Clerk, Auth0, Firebase Auth,
- * custom JWT, etc.) while keeping the Rebase admin frontend fully functional.
+ * allowing users to bring their own auth system (Clerk, Auth0, or other
+ * external providers) while keeping the Rebase admin frontend fully functional.
  *
  * @example Built-in auth (default — zero config change)
  * ```ts
@@ -85,6 +85,8 @@ export interface AuthAdapterCapabilities {
     profileUpdate: boolean;
     /** Supports email verification. */
     emailVerification: boolean;
+    /** Supports passwordless magic link login. */
+    magicLink: boolean;
     /** List of enabled OAuth provider IDs (e.g. `["google", "github"]`). */
     enabledProviders: string[];
     /**
@@ -195,6 +197,45 @@ export interface UserCreationFinalizeResult {
     /** Whether an invitation email was sent. */
     invitationSent: boolean;
 }
+/**
+ * The auth response payload shape that flows through `transformAuthResponse`.
+ *
+ * For login, register, OAuth, anonymous, and magic-link flows the payload
+ * contains both `user` and `tokens`. For refresh and MFA flows the payload
+ * contains only `tokens` (no `user`).
+ *
+ * @group Auth
+ */
+export interface AuthResponsePayload {
+    user?: {
+        uid: string;
+        email: string;
+        displayName: string | null;
+        photoURL: string | null;
+        roles: string[];
+        metadata: Record<string, unknown>;
+    };
+    tokens: {
+        accessToken: string;
+        refreshToken: string;
+        accessTokenExpiresAt: number;
+        /** Additional tokens injected by `transformAuthResponse`. */
+        [key: string]: unknown;
+    };
+}
+/**
+ * Context passed to the `transformAuthResponse` hook.
+ *
+ * @group Auth
+ */
+export interface TransformAuthResponseContext {
+    /** The authenticated user's ID. */
+    userId: string;
+    /** The auth method that triggered this response. */
+    method: "login" | "register" | "oauth" | "refresh" | "anonymous" | "magic-link" | "mfa";
+    /** The raw HTTP request (for reading headers, IP, etc.). */
+    request: Request;
+}
 /**
  * Pluggable authentication adapter for Rebase.
  *
@@ -207,7 +248,7 @@ export interface UserCreationFinalizeResult {
  * 4. Advertise its capabilities so the frontend can adapt
  *
  * The built-in Rebase auth implements this interface internally.
- * External providers (Clerk, Auth0, Firebase Auth) provide their own adapters.
+ * External providers (Clerk, Auth0, or others) provide their own adapters.
  * Users with custom auth can use `createCustomAuthAdapter()` for a minimal setup.
  *
  * @group Auth
@@ -216,7 +257,7 @@ export interface AuthAdapter {
     /**
      * Unique identifier for this auth adapter.
      *
-     * @example "rebase-builtin", "clerk", "auth0", "firebase", "custom"
+     * @example "rebase-builtin", "clerk", "auth0", "external-provider", "custom"
      */
     readonly id: string;
     /**
@@ -326,6 +367,22 @@ export interface AuthAdapter {
      * normal token verification and are granted admin-level access.
      */
     serviceKey?: string;
+    /**
+     * Transform the auth response before sending it to the client.
+     *
+     * Called after successful login, register, refresh, OAuth, anonymous,
+     * magic-link, and MFA flows. The hook receives the fully-formed
+     * response and returns a (potentially enriched) response.
+     *
+     * Use cases:
+     * - Inject tokens from external auth systems (custom provider tokens, etc.)
+     * - Add project-specific metadata to the response
+     * - Enrich the user object with data from external sources
+     *
+     * The hook runs in the request path — keep it fast.
+     * Heavy work should be offloaded to `onAuthenticated` (fire-and-forget).
+     */
+    transformAuthResponse?(response: AuthResponsePayload, context: TransformAuthResponseContext): Promise<AuthResponsePayload>;
 }
 /**
  * Options for creating a minimal custom auth adapter via `createCustomAuthAdapter()`.
@@ -353,4 +410,9 @@ export interface CustomAuthAdapterOptions {
     serviceKey?: string;
     /** Override default capabilities. */
     capabilities?: Partial<AuthAdapterCapabilities>;
+    /**
+     * Transform the auth response before sending it to the client.
+     * Same semantics as `AuthAdapter.transformAuthResponse`.
+     */
+    transformAuthResponse?: (response: AuthResponsePayload, context: TransformAuthResponseContext) => Promise<AuthResponsePayload>;
 }

package/dist/types/backend.d.ts

@@ -219,6 +219,10 @@ export interface CollectionRegistryInterface {
      * Get all registered collections
      */
     getCollections(): EntityCollection[];
+    /**
+     * Get the currently registered global callbacks, if any.
+     */
+    getGlobalCallbacks(): any | undefined;
 }
 /**
  * Abstract data transformer interface.
@@ -247,6 +251,7 @@ export interface SQLAdmin {
     executeSql(sql: string, options?: {
         database?: string;
         role?: string;
+        params?: unknown[];
     }): Promise<Record<string, unknown>[]>;
     /**
      * Fetch the available databases on the server.

package/dist/types/collections.d.ts

@@ -1,16 +1,17 @@
 import React from "react";
 import type { Entity, EntityStatus } from "./entities";
 import type { EntityCallbacks } from "./entity_callbacks";
-import type { Properties } from "./properties";
+import type { Properties, PostgresProperties, FirebaseProperties, MongoProperties } from "./properties";
 import type { ExportConfig } from "./export_import";
-import type { EntityOverrides } from "./entity_overrides";
 import type { User } from "../users";
 import type { RebaseContext } from "../rebase_context";
 import type { Relation } from "./relations";
 import type { EntityCustomView, FormViewConfig } from "./entity_views";
 import type { EntityAction } from "./entity_actions";
+import type { PolicyExpression } from "./policy";
 import type { ComponentRef } from "./component_ref";
 import type { CollectionComponentOverrideMap } from "./component_overrides";
+import type { FilterValues, FilterPreset } from "./filter-operators";
 /**
  * Base interface containing all driver-agnostic collection properties.
  * Use {@link PostgresCollection} or {@link FirebaseCollection} for
@@ -49,33 +50,43 @@ export interface BaseEntityCollection<M extends Record<string, unknown> = Record
      */
     childCollections?: () => EntityCollection<Record<string, unknown>>[];
     /**
-     * Which driver handles this collection.
-     * Use this to route collections to different backends:
-     * - `"postgres"` - Route to PostgreSQL backend
-     * - `"firestore"` - Route to Firestore (client-side)
-     * - `"mongodb"` - Route to MongoDB backend
-     * - Custom IDs for your own driver implementations
+     * The data source this collection belongs to — the routing key shared by
+     * the frontend router and the backend driver registry. It points at a
+     * {@link DataSourceDefinition} registered on `<Rebase dataSources>` (front)
+     * and `initRebase({ dataSources })` (back).
      *
-     * If not specified, the default driver `"(default)"` is used.
+     * If not specified, the default data source `"(default)"` is used, which
+     * for a standard Rebase app is the server-mediated Postgres backend.
      *
      * @example
-     * // Simple - no driver needed for default
+     * // Default data source (server-mediated Postgres)
      * { slug: "products" }
      *
-     * // Firestore collection (client-side real-time)
-     * { slug: "analytics", driver: "firestore" }
+     * // A direct-transport Firestore data source registered as "analytics"
+     * { slug: "events", dataSource: "analytics" }
+     */
+    dataSource?: string;
+    /**
+     * The database engine backing this collection (`"postgres"`, `"firestore"`,
+     * `"mongodb"`, or a custom id).
+     *
+     * On concrete collection types ({@link PostgresCollection},
+     * {@link FirebaseCollection}, {@link MongoDBCollection}) this is a literal
+     * discriminant. On the base type it is optional and gets stamped
+     * automatically during collection normalization from the registered
+     * {@link DataSourceDefinition}.
      *
-     * // Multiple databases within a driver
-     * { slug: "orders", driver: "postgres", databaseId: "orders_db" }
+     * Prefer setting {@link dataSource} and letting the engine be resolved.
      */
-    driver?: string;
+    engine?: string;
     /**
-     * Which database within the driver.
+     * Which database within the engine.
      * - For Firestore: The Firestore database ID (e.g., for multi-database projects)
      * - For PostgreSQL: Schema or database name
      * - For MongoDB: Database name
      *
-     * If not specified, the default database of the driver is used.
+     * If not specified, the default database of the engine is used. Resolved
+     * from the collection's {@link DataSourceDefinition} when omitted here.
      */
     databaseId?: string;
     /**
@@ -142,6 +153,25 @@ export interface BaseEntityCollection<M extends Record<string, unknown> = Record
      * When true, this collection is used for user management, login, password hashing, and invitation flows.
      */
     auth?: boolean | AuthCollectionConfig;
+    /**
+     * Opt out of the framework's default Row Level Security policies for
+     * authentication collections.
+     *
+     * When a collection has `auth` enabled, the schema generator automatically
+     * injects an admin-only write policy (INSERT/UPDATE/DELETE require the
+     * `admin` role, or the trusted server context) for any write operation that
+     * the collection does not already cover with an explicit `securityRules`
+     * entry. This makes privileged columns such as `roles` safe by default — a
+     * non-admin cannot modify the user row through the data API regardless of
+     * which code path issues the write.
+     *
+     * Defining your own write rule for an operation overrides the default for
+     * that operation. Set this flag to `true` to remove the default policies
+     * entirely and take full responsibility for the collection's RLS.
+     *
+     * @default false
+     */
+    disableDefaultAuthPolicies?: boolean;
     /**
      * Order in which the properties are displayed.
      * If you are specifying your collection as code, the order is the same as the
@@ -233,8 +263,8 @@ export interface BaseEntityCollection<M extends Record<string, unknown> = Record
     defaultSize?: CollectionSize;
     /**
      * Can the elements in this collection be edited inline in the collection
-     * view. If this flag is set to false but `permissions.edit` is `true`, entities
-     * can still be edited in the side panel
+     * view. Even when inline editing is disabled, entities can still be
+     * edited in the side panel (subject to `securityRules`).
      */
     inlineEditing?: boolean;
     /**
@@ -278,9 +308,11 @@ export interface BaseEntityCollection<M extends Record<string, unknown> = Record
      */
     ownerId?: string;
     /**
-     * Overrides for the entity view, like the data source or the storage source.
+     * Arbitrary key-value metadata for external consumers.
+     * Not interpreted by Rebase — passed through serialization unchanged.
+     * Used by domain apps to store custom per-collection config.
      */
-    overrides?: EntityOverrides;
+    metadata?: Record<string, unknown>;
     /**
      * Width of the side dialog (in pixels) when opening an entity in this collection.
      */
@@ -324,7 +356,7 @@ export interface BaseEntityCollection<M extends Record<string, unknown> = Record
      * Possible values: "table", "cards", "kanban".
      * Defaults to all three: ["table", "cards", "kanban"].
      * Note: "kanban" will only be available if the collection has at least
-     * one string property with enumValues defined, regardless of this setting.
+     * one string property with `enum` defined, regardless of this setting.
      */
     enabledViews?: ViewMode[];
     /**
@@ -401,12 +433,12 @@ export interface BaseEntityCollection<M extends Record<string, unknown> = Record
  * @group Models
  */
 export interface PostgresCollection<M extends Record<string, unknown> = Record<string, unknown>, USER extends User = User> extends BaseEntityCollection<M, USER> {
-    properties: Properties;
+    properties: PostgresProperties;
     /**
-     * The driver for this collection. For Postgres collections this
+     * The database engine for this collection. For Postgres collections this
      * can be omitted (Postgres is the default) or set to `"postgres"`.
      */
-    driver?: "postgres" | undefined;
+    engine?: "postgres" | undefined;
     /**
      * The PostgreSQL table name for this collection.
      */
@@ -450,9 +482,31 @@ export interface PostgresCollection<M extends Record<string, unknown> = Record<s
  */
 export interface FirebaseCollection<M extends Record<string, unknown> = Record<string, unknown>, USER extends User = User> extends BaseEntityCollection<M, USER> {
     /**
-     * The driver for this collection. Must be set to `"firestore"`.
+     * The database engine for this collection. Must be set to `"firestore"`.
+     */
+    engine: "firestore";
+    /**
+     * Set of properties that compose an entity.
+     * Firestore collections support `reference` properties but not `relation`.
      */
-    driver: "firestore";
+    properties: FirebaseProperties;
+    /**
+     * The Firestore collection path to query. Defaults to `slug` if not set.
+     * Use this when the Firestore path differs from the slug
+     * (e.g., when a PostgreSQL collection already uses the same slug).
+     *
+     * @example
+     * ```typescript
+     * const fsCustomer: FirebaseCollection = {
+     *     slug: "fs_customer",        // URL: /c/fs_customer
+     *     path: "customer",           // Firestore path: customer
+     *     name: "Customers (Firestore)",
+     *     engine: "firestore",
+     *     properties: { ... }
+     * };
+     * ```
+     */
+    path?: string;
     /**
      * You can add subcollections to your entity in the same way you define the root
      * collections. The collections added here will be displayed when opening
@@ -470,9 +524,31 @@ export interface FirebaseCollection<M extends Record<string, unknown> = Record<s
  */
 export interface MongoDBCollection<M extends Record<string, unknown> = Record<string, unknown>, USER extends User = User> extends BaseEntityCollection<M, USER> {
     /**
-     * The driver for this collection. Must be set to `"mongodb"`.
+     * The database engine for this collection. Must be set to `"mongodb"`.
      */
-    driver: "mongodb";
+    engine: "mongodb";
+    /**
+     * Set of properties that compose an entity.
+     * MongoDB collections support `reference` properties but not `relation`.
+     */
+    properties: MongoProperties;
+    /**
+     * The MongoDB collection name to use. Defaults to `slug` if not set.
+     * Use this when the MongoDB collection name differs from the slug
+     * (e.g., when a PostgreSQL collection already uses the same slug).
+     *
+     * @example
+     * ```typescript
+     * const mongoCustomer: MongoDBCollection = {
+     *     slug: "mongo_customer",      // URL: /c/mongo_customer
+     *     path: "customer",            // MongoDB collection: customer
+     *     name: "Customers (MongoDB)",
+     *     engine: "mongodb",
+     *     properties: { ... }
+     * };
+     * ```
+     */
+    path?: string;
 }
 /**
  * A collection backed by any data source.
@@ -483,22 +559,9 @@ export interface MongoDBCollection<M extends Record<string, unknown> = Record<st
  * @group Models
  */
 export type EntityCollection<M extends Record<string, unknown> = Record<string, unknown>, USER extends User = User> = PostgresCollection<M, USER> | FirebaseCollection<M, USER> | MongoDBCollection<M, USER>;
-/**
- * An EntityCollection that supports SQL-style relations (e.g. Postgres).
- * @deprecated Use `EntityCollection` directly — `table`, `relations`, and `securityRules` are now on `BaseEntityCollection`.
- */
-export type CollectionWithRelations<M extends Record<string, unknown> = Record<string, unknown>> = EntityCollection<M> & {
-    table?: string;
-    relations?: Relation[];
-    securityRules?: SecurityRule[];
-};
-/** An EntityCollection that supports subcollections (e.g. Firestore). */
-export type CollectionWithSubcollections<M extends Record<string, unknown> = Record<string, unknown>> = EntityCollection<M> & {
-    subcollections?: () => EntityCollection<Record<string, unknown>>[];
-};
 /**
  * Type guard for PostgreSQL collections.
- * Returns true if the collection uses the Postgres driver (or the default driver).
+ * Returns true if the collection uses the Postgres engine (or the default engine).
  * @group Models
  */
 export declare function isPostgresCollection<M extends Record<string, unknown> = Record<string, unknown>, USER extends User = User>(collection: EntityCollection<M, USER>): collection is PostgresCollection<M, USER>;
@@ -512,6 +575,23 @@ export declare function isFirebaseCollection<M extends Record<string, unknown> =
  * @group Models
  */
 export declare function isMongoDBCollection<M extends Record<string, unknown> = Record<string, unknown>, USER extends User = User>(collection: EntityCollection<M, USER>): collection is MongoDBCollection<M, USER>;
+/**
+ * Returns the data path for a collection.
+ * For Firestore or MongoDB collections with a `path`, returns that value;
+ * otherwise falls back to `slug`.
+ */
+export declare function getCollectionDataPath<M extends Record<string, unknown> = Record<string, unknown>, USER extends User = User>(collection: EntityCollection<M, USER>): string;
+/**
+ * Reads a collection's driver-declared subcollections thunk (the `subcollections`
+ * field) independent of engine identity, so engine-agnostic code doesn't have to
+ * type-guard against a specific driver. Returns `undefined` when the collection
+ * declares none.
+ *
+ * Pair with `getDataSourceCapabilities(engine).supportsSubcollections` to decide
+ * whether the engine honours subcollections at all before reading them.
+ * @group Models
+ */
+export declare function getDeclaredSubcollections<M extends Record<string, unknown> = Record<string, unknown>, USER extends User = User>(collection: EntityCollection<M, USER>): (() => EntityCollection<Record<string, unknown>>[]) | undefined;
 /**
  * Configuration for Kanban board view mode.
  * @group Collections
@@ -519,9 +599,9 @@ export declare function isMongoDBCollection<M extends Record<string, unknown> =
 export interface KanbanConfig<M extends Record<string, unknown> = Record<string, unknown>> {
     /**
      * Property key to use for Kanban board columns.
-     * Must reference a string property with enumValues defined.
+     * Must reference a string property with `enum` values defined.
      * Entities will be grouped into columns based on this property's value.
-     * The column order is determined by the order of enumValues in the property.
+     * The column order is determined by the order of `enum` values in the property.
      */
     columnProperty: Extract<keyof M, string> | (string & {});
 }
@@ -607,42 +687,7 @@ export interface SelectionController<M extends Record<string, unknown> = Record<
     isEntitySelected(entity: Entity<M>): boolean;
     toggleEntitySelection(entity: Entity<M>, newSelectedState?: boolean): void;
 }
-/**
- * Filter conditions in a `Query.where()` clause are specified using the
- * strings `<`, `<=`, `==`, `>=`, `>`, `array-contains`, `in`, and `array-contains-any`.
- * @group Models
- */
-export type WhereFilterOp = "<" | "<=" | "==" | "!=" | ">=" | ">" | "array-contains" | "in" | "not-in" | "array-contains-any";
-/**
- * Used to define filters applied in collections
- *
- * e.g. `{ age: [">=", 18] }`
- *
- * @group Models
- */
-export type FilterValues<Key extends string> = Partial<Record<Key, [WhereFilterOp, unknown] | [WhereFilterOp, unknown][]>>;
-/**
- * A pre-defined filter preset for quick access in the collection toolbar.
- * Users can select a preset to instantly apply a set of filters and
- * optionally a sort order.
- *
- * @group Models
- */
-export interface FilterPreset<Key extends string = string> {
-    /**
-     * Display label shown in the preset menu.
-     * If omitted, a summary is auto-generated from the filter keys.
-     */
-    label?: string;
-    /**
-     * The filter values to apply when this preset is selected.
-     */
-    filterValues: FilterValues<Key>;
-    /**
-     * Optional sort override to apply alongside the filter values.
-     */
-    sort?: [Key, "asc" | "desc"];
-}
+export type { WhereFilterOp, FilterValues, WireFilterValues, FilterPreset } from "./filter-operators";
 /**
  * Used to indicate valid filter combinations (e.g. created in Firestore)
  * If the user selects a specific filter/sort combination, the CMS checks if it's
@@ -780,13 +825,21 @@ export type SecurityOperation = "select" | "insert" | "update" | "delete" | "all
  * operation. Permissive rules are OR'd together (any one passing is enough).
  * Restrictive rules are AND'd (all must pass). This mirrors Supabase behavior.
  *
- * **Mutual exclusivity:** `ownerField`, `access`, and raw SQL (`using`/`withCheck`)
- * cannot be combined. The type system enforces this — attempting to set
- * conflicting fields will produce a compile-time error.
+ * **Mutual exclusivity:** `ownerField`, `access`, structured `condition`, and
+ * raw SQL (`using`/`withCheck`) cannot be combined. The type system enforces
+ * this — attempting to set conflicting fields will produce a compile-time
+ * error.
+ *
+ * **Which form to reach for:** prefer the structured {@link StructuredSecurityRule}
+ * (`condition`/`check`) or the shortcuts (`ownerField`, `access`, `roles`). These
+ * are engine-agnostic and evaluated identically by the database and the admin UI,
+ * so the UI never shows an action the database will reject. Raw SQL
+ * ({@link RawSQLSecurityRule}) keeps full PostgreSQL power but is Postgres-only
+ * and server-authoritative (the UI cannot evaluate arbitrary SQL locally).
  *
  * @group Models
  */
-export type SecurityRule = OwnerSecurityRule | PublicSecurityRule | RawSQLSecurityRule | RolesOnlySecurityRule;
+export type SecurityRule = OwnerSecurityRule | PublicSecurityRule | StructuredSecurityRule | RawSQLSecurityRule | RolesOnlySecurityRule;
 /**
  * Shared fields for all SecurityRule variants.
  * @group Models
@@ -851,11 +904,16 @@ export interface SecurityRuleBase {
      * application roles managed by Rebase, stored in the `rebase.user_roles`
      * table, and injected into each transaction via `auth.roles()`.
      *
-     * Generates a condition like:
-     *   `auth.roles() ~ '<role1>|<role2>'`
+     * Generates a safe array-overlap condition — the user passes if they hold
+     * *any* of the listed roles:
+     *   `string_to_array(auth.roles(), ',') && ARRAY['<role1>', '<role2>']`
      *
-     * Can be combined with `ownerField`, `access`, or raw `using`/`withCheck`.
-     * When combined, the role check is AND'd with the other condition.
+     * (Note: this is a true set intersection, NOT a regex/substring match, so
+     * a role named `admin` never matches `nonadmin` or `superadmin`.)
+     *
+     * Can be combined with `ownerField`, `access`, `condition`, or raw
+     * `using`/`withCheck`. When combined, the role check is AND'd with the
+     * other condition.
      *
      * @example
      * // Only admins can delete
@@ -906,6 +964,8 @@ export interface OwnerSecurityRule extends SecurityRuleBase {
     access?: never;
     using?: never;
     withCheck?: never;
+    condition?: never;
+    check?: never;
 }
 /**
  * Security rule that grants unrestricted row access (no row filtering).
@@ -929,11 +989,57 @@ export interface PublicSecurityRule extends SecurityRuleBase {
     ownerField?: never;
     using?: never;
     withCheck?: never;
+    condition?: never;
+    check?: never;
+}
+/**
+ * Security rule expressed as a structured, engine-agnostic
+ * {@link PolicyExpression}. This is the **recommended** way to write a
+ * non-trivial condition: it compiles to PostgreSQL `USING`/`WITH CHECK` SQL
+ * *and* is evaluated identically by the admin UI, so the UI can never show an
+ * action the database will reject.
+ *
+ * Cannot be combined with `ownerField`, `access`, or raw `using`/`withCheck`.
+ *
+ * @example
+ * // Owner, or any user holding the `moderator` role
+ * {
+ *   operation: "update",
+ *   condition: policy.or(
+ *       policy.compare(policy.field("user_id"), "eq", policy.authUid()),
+ *       policy.rolesOverlap(["moderator"])
+ *   )
+ * }
+ *
+ * @group Models
+ */
+export interface StructuredSecurityRule extends SecurityRuleBase {
+    /**
+     * Structured condition for the `USING` clause — which *existing* rows are
+     * visible / can be modified / deleted (SELECT, UPDATE, DELETE).
+     */
+    condition: PolicyExpression;
+    /**
+     * Structured condition for the `WITH CHECK` clause — which *new/updated*
+     * row values are allowed (INSERT, UPDATE). Defaults to `condition` when
+     * omitted, mirroring PostgreSQL's own behavior.
+     */
+    check?: PolicyExpression;
+    ownerField?: never;
+    access?: never;
+    using?: never;
+    withCheck?: never;
 }
 /**
  * Security rule using raw SQL expressions for full PostgreSQL RLS power.
  *
- * Cannot be combined with `ownerField` or `access`.
+ * **Postgres-only and server-authoritative.** Arbitrary SQL cannot be
+ * evaluated by the admin UI, so a rule using this form is treated as *unknown*
+ * client-side (never silently allowed) and its effect on visible actions is
+ * reflected from the server. For conditions that should also drive the UI
+ * precisely, prefer the structured {@link StructuredSecurityRule}.
+ *
+ * Cannot be combined with `ownerField`, `access`, or structured `condition`.
  *
  * You can reference columns via `{column_name}` which will be resolved to
  * `table.column_name` in the generated Drizzle code.
@@ -969,6 +1075,8 @@ export interface RawSQLSecurityRule extends SecurityRuleBase {
     withCheck?: string;
     ownerField?: never;
     access?: never;
+    condition?: never;
+    check?: never;
 }
 /**
  * Security rule that only filters by application roles, without any
@@ -988,6 +1096,8 @@ export interface RolesOnlySecurityRule extends SecurityRuleBase {
     access?: never;
     using?: never;
     withCheck?: never;
+    condition?: never;
+    check?: never;
 }
 /**
  * Configuration for authentication collections.