@rebasepro/types 0.7.0 → 0.8.0

package/src/controllers/data.ts

@@ -1,29 +1,5 @@
 import { Entity, EntityValues } from "../types/entities";
-
-/**
- * Parameters for querying a collection.
- * Uses PostgREST-style filter syntax for consistency between
- * the SDK (HTTP) and framework (in-process) contexts.
- *
- * @group Data
- */
-/**
- * A where-clause value for a single field.
- *
- * Supports three syntaxes:
- *  1. **Equality shorthand**: raw JS values — `null`, `"active"`, `42`, `true`
- *  2. **Tuple syntax**: `[operator, value]` — `[">", 18]`, `["in", ["a","b"]]`
- *  3. **PostgREST string**: `"eq.published"`, `"gte.18"`, `"in.(a,b)"`
- *
- * @group Data
- */
-export type WhereFieldValue =
-    | string
-    | number
-    | boolean
-    | null
-    | [WhereFilterOpShort, any]
-    | [WhereFilterOpShort, any][];
+import { WhereFilterOp, FilterValues } from "../types/filter-operators";
 
 export type WhereValue<T> = T | T[] | null;
 
@@ -34,17 +10,15 @@ export interface LogicalCondition {
 
 export interface FilterCondition {
     column: string;
-    operator: FilterOperator;
+    operator: WhereFilterOp;
     value: unknown;
 }
 
-/** Short operator strings accepted in the tuple syntax. */
-export type WhereFilterOpShort =
-    | "==" | "!=" | ">" | ">=" | "<" | "<="
-    | "eq" | "neq" | "gt" | "gte" | "lt" | "lte"
-    | "in" | "nin" | "not-in"
-    | "array-contains" | "array-contains-any" | "cs" | "csa";
-
+/**
+ * Parameters for querying a collection.
+ *
+ * @group Data
+ */
 export interface FindParams {
     /** Maximum number of items to return (default: 20) */
     limit?: number;
@@ -53,30 +27,17 @@ export interface FindParams {
     /** Page number (1-indexed), alternative to offset */
     page?: number;
     /**
-     * Filter object. Supports multiple syntaxes per field:
-     *
-     * **Equality shorthand** — raw JS values (null, string, number, boolean):
-     * ```ts
-     * { company_profile_id: null }
-     * { status: "active" }
-     * { age: 18 }
-     * ```
+     * Filter conditions keyed by field name.
+     * Each value is a `[WhereFilterOp, value]` tuple or an array of tuples
+     * for multiple conditions on the same field.
      *
-     * **Tuple syntax** — `[operator, value]`:
-     * ```ts
+     * @example
+     * { status: ["==", "active"] }
      * { age: [">=", 18] }
      * { role: ["in", ["admin", "editor"]] }
-     * { deleted_at: ["!=", null] }
-     * ```
-     *
-     * **PostgREST string syntax** (original format):
-     * ```ts
-     * { status: "eq.published" }
-     * { age: "gte.18" }
-     * { role: "in.(admin,editor)" }
-     * ```
+     * { age: [[">=", 18], ["<", 65]] }
      */
-    where?: Record<string, WhereFieldValue>;
+    where?: FilterValues<string>;
     /** Logical grouping conditions (AND/OR) */
     logical?: LogicalCondition;
     /**
@@ -106,16 +67,16 @@ export interface FindResponse<M extends Record<string, unknown> = Record<string,
     };
 }
 
-export type FilterOperator = WhereFilterOpShort;
+
 
 /**
  * Fluent Query Builder Interface supported on both client and server accessors.
  * @group Data
  */
 export interface QueryBuilderInterface<M extends Record<string, unknown> = Record<string, unknown>> {
-    where<K extends keyof M & string>(column: K, operator: FilterOperator, value: WhereValue<M[K]>): this;
+    where<K extends keyof M & string>(column: K, operator: WhereFilterOp, value: WhereValue<M[K]>): this;
     where(logicalCondition: LogicalCondition): this;
-    orderBy(column: keyof M & string, ascending?: "asc" | "desc"): this;
+    orderBy(column: keyof M & string, direction?: "asc" | "desc"): this;
     limit(count: number): this;
     offset(count: number): this;
     search(searchString: string): this;
@@ -186,9 +147,9 @@ export interface CollectionAccessor<M extends Record<string, unknown> = Record<s
     count?(params?: FindParams): Promise<number>;
 
     // Fluent Query Builder
-    where<K extends keyof M & string>(column: K, operator: FilterOperator, value: WhereValue<M[K]>): QueryBuilderInterface<M>;
+    where<K extends keyof M & string>(column: K, operator: WhereFilterOp, value: WhereValue<M[K]>): QueryBuilderInterface<M>;
     where(logicalCondition: LogicalCondition): QueryBuilderInterface<M>;
-    orderBy(column: keyof M & string, ascending?: "asc" | "desc"): QueryBuilderInterface<M>;
+    orderBy(column: keyof M & string, direction?: "asc" | "desc"): QueryBuilderInterface<M>;
     limit(count: number): QueryBuilderInterface<M>;
     offset(count: number): QueryBuilderInterface<M>;
     search(searchString: string): QueryBuilderInterface<M>;
@@ -226,7 +187,7 @@ export interface RebaseData {
      * const accessor = data.collection("products");
      * await accessor.find({ limit: 10 });
      */
-    collection(slug: string): CollectionAccessor;
+    collection<M extends Record<string, unknown> = Record<string, unknown>>(slug: string): CollectionAccessor<M>;
 
     /**
      * Dynamic collection accessor.

package/src/controllers/registry.ts

@@ -4,7 +4,6 @@ import type { EntityCollectionsBuilder, AppViewsBuilder } from "../types/builder
 import type { EntityCustomView } from "../types/entity_views";
 import type { EntityAction } from "../types/entity_actions";
 import type { AppView, NavigationGroupMapping } from "./navigation";
-import type { RebasePlugin } from "../types/plugins";
 
 /**
  * Options to enable the built-in collection editor.
@@ -35,7 +34,6 @@ export interface RebaseCMSConfig<EC extends EntityCollection = EntityCollection>
     homePage?: ReactNode;
     entityViews?: EntityCustomView[];
     entityActions?: EntityAction[];
-    plugins?: RebasePlugin[];
 
     /**
      * Centralized configuration for how collections and views are grouped

package/src/types/auth_adapter.ts

@@ -4,8 +4,8 @@
  * Pluggable authentication abstraction for Rebase.
  *
  * An `AuthAdapter` decouples authentication from the database layer,
- * allowing users to bring their own auth system (Clerk, Auth0, Firebase Auth,
- * custom JWT, etc.) while keeping the Rebase admin frontend fully functional.
+ * allowing users to bring their own auth system (Clerk, Auth0, or other
+ * external providers) while keeping the Rebase admin frontend fully functional.
  *
  * @example Built-in auth (default — zero config change)
  * ```ts
@@ -277,7 +277,7 @@ export interface TransformAuthResponseContext {
  * 4. Advertise its capabilities so the frontend can adapt
  *
  * The built-in Rebase auth implements this interface internally.
- * External providers (Clerk, Auth0, Firebase Auth) provide their own adapters.
+ * External providers (Clerk, Auth0, or others) provide their own adapters.
  * Users with custom auth can use `createCustomAuthAdapter()` for a minimal setup.
  *
  * @group Auth
@@ -286,7 +286,7 @@ export interface AuthAdapter {
     /**
      * Unique identifier for this auth adapter.
      *
-     * @example "rebase-builtin", "clerk", "auth0", "firebase", "custom"
+     * @example "rebase-builtin", "clerk", "auth0", "external-provider", "custom"
      */
     readonly id: string;
 
@@ -435,7 +435,7 @@ export interface AuthAdapter {
      * response and returns a (potentially enriched) response.
      *
      * Use cases:
-     * - Inject tokens from external auth systems (Firebase Custom Tokens, etc.)
+     * - Inject tokens from external auth systems (custom provider tokens, etc.)
      * - Add project-specific metadata to the response
      * - Enrich the user object with data from external sources
      *

package/src/types/backend.ts

@@ -325,6 +325,11 @@ export interface CollectionRegistryInterface {
      * Get all registered collections
      */
     getCollections(): EntityCollection[];
+
+    /**
+     * Get the currently registered global callbacks, if any.
+     */
+    getGlobalCallbacks(): any | undefined;
 }
 
 // =============================================================================

package/src/types/collections.ts

@@ -2,16 +2,18 @@ import React, { Dispatch, SetStateAction } from "react";
 import type { Entity, EntityStatus, EntityValues } from "./entities";
 import type { EntityCallbacks } from "./entity_callbacks";
 
-import type { EnumValues, Properties } from "./properties";
+import type { EnumValues, Properties, PostgresProperties, FirebaseProperties, MongoProperties } from "./properties";
 import type { ExportConfig } from "./export_import";
-import type { EntityOverrides } from "./entity_overrides";
+
 import type { User } from "../users";
 import type { RebaseContext } from "../rebase_context";
 import type { Relation } from "./relations";
 import type { EntityCustomView, FormViewConfig } from "./entity_views";
 import type { EntityAction } from "./entity_actions";
+import type { PolicyExpression } from "./policy";
 import type { ComponentRef } from "./component_ref";
 import type { CollectionComponentOverrideMap } from "./component_overrides";
+import type { WhereFilterOp, FilterValues, FilterPreset } from "./filter-operators";
 
 /**
  * Base interface containing all driver-agnostic collection properties.
@@ -76,17 +78,18 @@ export interface BaseEntityCollection<M extends Record<string, unknown> = Record
     dataSource?: string;
 
     /**
-     * The engine backing this collection (`"postgres"`, `"firestore"`,
-     * `"mongodb"`, or a custom id). Drives editor capabilities (relations vs
-     * subcollections, RLS, column types).
+     * The database engine backing this collection (`"postgres"`, `"firestore"`,
+     * `"mongodb"`, or a custom id).
      *
-     * @deprecated Prefer {@link dataSource} for routing. `driver` is retained
-     * as an engine hint and for backward compatibility: when `dataSource` is
-     * omitted it also acts as the data-source key.
+     * On concrete collection types ({@link PostgresCollection},
+     * {@link FirebaseCollection}, {@link MongoDBCollection}) this is a literal
+     * discriminant. On the base type it is optional and gets stamped
+     * automatically during collection normalization from the registered
+     * {@link DataSourceDefinition}.
      *
-     * If not specified, `"postgres"` is assumed.
+     * Prefer setting {@link dataSource} and letting the engine be resolved.
      */
-    driver?: string;
+    engine?: string;
 
     /**
      * Which database within the engine.
@@ -299,8 +302,8 @@ export interface BaseEntityCollection<M extends Record<string, unknown> = Record
 
     /**
      * Can the elements in this collection be edited inline in the collection
-     * view. If this flag is set to false but `permissions.edit` is `true`, entities
-     * can still be edited in the side panel
+     * view. Even when inline editing is disabled, entities can still be
+     * edited in the side panel (subject to `securityRules`).
      */
     inlineEditing?: boolean;
 
@@ -358,11 +361,6 @@ export interface BaseEntityCollection<M extends Record<string, unknown> = Record
      */
     metadata?: Record<string, unknown>;
 
-    /**
-     * Overrides for the entity view, like the data source or the storage source.
-     */
-    overrides?: EntityOverrides;
-
     /**
      * Width of the side dialog (in pixels) when opening an entity in this collection.
      */
@@ -501,13 +499,13 @@ export interface BaseEntityCollection<M extends Record<string, unknown> = Record
  */
 export interface PostgresCollection<M extends Record<string, unknown> = Record<string, unknown>, USER extends User = User>
     extends BaseEntityCollection<M, USER> {
-    properties: Properties;
+    properties: PostgresProperties;
 
     /**
-     * The driver for this collection. For Postgres collections this
+     * The database engine for this collection. For Postgres collections this
      * can be omitted (Postgres is the default) or set to `"postgres"`.
      */
-    driver?: "postgres" | undefined;
+    engine?: "postgres" | undefined;
 
     /**
      * The PostgreSQL table name for this collection.
@@ -557,9 +555,33 @@ export interface PostgresCollection<M extends Record<string, unknown> = Record<s
 export interface FirebaseCollection<M extends Record<string, unknown> = Record<string, unknown>, USER extends User = User>
     extends BaseEntityCollection<M, USER> {
     /**
-     * The driver for this collection. Must be set to `"firestore"`.
+     * The database engine for this collection. Must be set to `"firestore"`.
+     */
+    engine: "firestore";
+
+    /**
+     * Set of properties that compose an entity.
+     * Firestore collections support `reference` properties but not `relation`.
+     */
+    properties: FirebaseProperties;
+
+    /**
+     * The Firestore collection path to query. Defaults to `slug` if not set.
+     * Use this when the Firestore path differs from the slug
+     * (e.g., when a PostgreSQL collection already uses the same slug).
+     *
+     * @example
+     * ```typescript
+     * const fsCustomer: FirebaseCollection = {
+     *     slug: "fs_customer",        // URL: /c/fs_customer
+     *     path: "customer",           // Firestore path: customer
+     *     name: "Customers (Firestore)",
+     *     engine: "firestore",
+     *     properties: { ... }
+     * };
+     * ```
      */
-    driver: "firestore";
+    path?: string;
 
     /**
      * You can add subcollections to your entity in the same way you define the root
@@ -581,9 +603,33 @@ export interface MongoDBCollection<M extends Record<string, unknown> = Record<st
     extends BaseEntityCollection<M, USER> {
 
     /**
-     * The driver for this collection. Must be set to `"mongodb"`.
+     * The database engine for this collection. Must be set to `"mongodb"`.
+     */
+    engine: "mongodb";
+
+    /**
+     * Set of properties that compose an entity.
+     * MongoDB collections support `reference` properties but not `relation`.
      */
-    driver: "mongodb";
+    properties: MongoProperties;
+
+    /**
+     * The MongoDB collection name to use. Defaults to `slug` if not set.
+     * Use this when the MongoDB collection name differs from the slug
+     * (e.g., when a PostgreSQL collection already uses the same slug).
+     *
+     * @example
+     * ```typescript
+     * const mongoCustomer: MongoDBCollection = {
+     *     slug: "mongo_customer",      // URL: /c/mongo_customer
+     *     path: "customer",            // MongoDB collection: customer
+     *     name: "Customers (MongoDB)",
+     *     engine: "mongodb",
+     *     properties: { ... }
+     * };
+     * ```
+     */
+    path?: string;
 }
 
 /**
@@ -599,33 +645,15 @@ export type EntityCollection<M extends Record<string, unknown> = Record<string,
     | FirebaseCollection<M, USER>
     | MongoDBCollection<M, USER>;
 
-// ── Capability intersection types ─────────────────────────────────────
-// Use these after a `getDataSourceCapabilities()` guard to safely access
-// driver-specific fields without coupling to a concrete driver type.
-
-/**
- * An EntityCollection that supports SQL-style relations (e.g. Postgres).
- * @deprecated Use `EntityCollection` directly — `table`, `relations`, and `securityRules` are now on `BaseEntityCollection`.
- */
-export type CollectionWithRelations<M extends Record<string, unknown> = Record<string, unknown>> =
-    EntityCollection<M> & { table?: string; relations?: Relation[]; securityRules?: SecurityRule[] };
-
-/** An EntityCollection that supports subcollections (e.g. Firestore). */
-export type CollectionWithSubcollections<M extends Record<string, unknown> = Record<string, unknown>> =
-    EntityCollection<M> & { subcollections?: () => EntityCollection<Record<string, unknown>>[] };
-
-
-// ── Type guards ───────────────────────────────────────────────────────
-
 /**
  * Type guard for PostgreSQL collections.
- * Returns true if the collection uses the Postgres driver (or the default driver).
+ * Returns true if the collection uses the Postgres engine (or the default engine).
  * @group Models
  */
 export function isPostgresCollection<M extends Record<string, unknown> = Record<string, unknown>, USER extends User = User>(
     collection: EntityCollection<M, USER>
 ): collection is PostgresCollection<M, USER> {
-    return !collection.driver || collection.driver === "postgres";
+    return !collection.engine || collection.engine === "postgres";
 }
 
 /**
@@ -635,7 +663,7 @@ export function isPostgresCollection<M extends Record<string, unknown> = Record<
 export function isFirebaseCollection<M extends Record<string, unknown> = Record<string, unknown>, USER extends User = User>(
     collection: EntityCollection<M, USER>
 ): collection is FirebaseCollection<M, USER> {
-    return collection.driver === "firestore";
+    return collection.engine === "firestore";
 }
 
 /**
@@ -645,7 +673,40 @@ export function isFirebaseCollection<M extends Record<string, unknown> = Record<
 export function isMongoDBCollection<M extends Record<string, unknown> = Record<string, unknown>, USER extends User = User>(
     collection: EntityCollection<M, USER>
 ): collection is MongoDBCollection<M, USER> {
-    return collection.driver === "mongodb";
+    return collection.engine === "mongodb";
+}
+
+/**
+ * Returns the data path for a collection.
+ * For Firestore or MongoDB collections with a `path`, returns that value;
+ * otherwise falls back to `slug`.
+ */
+export function getCollectionDataPath<M extends Record<string, unknown> = Record<string, unknown>, USER extends User = User>(
+    collection: EntityCollection<M, USER>
+): string {
+    if (isFirebaseCollection(collection) && collection.path) {
+        return collection.path;
+    }
+    if (isMongoDBCollection(collection) && collection.path) {
+        return collection.path;
+    }
+    return collection.slug;
+}
+
+/**
+ * Reads a collection's driver-declared subcollections thunk (the `subcollections`
+ * field) independent of engine identity, so engine-agnostic code doesn't have to
+ * type-guard against a specific driver. Returns `undefined` when the collection
+ * declares none.
+ *
+ * Pair with `getDataSourceCapabilities(engine).supportsSubcollections` to decide
+ * whether the engine honours subcollections at all before reading them.
+ * @group Models
+ */
+export function getDeclaredSubcollections<M extends Record<string, unknown> = Record<string, unknown>, USER extends User = User>(
+    collection: EntityCollection<M, USER>
+): (() => EntityCollection<Record<string, unknown>>[]) | undefined {
+    return (collection as FirebaseCollection<M, USER>).subcollections;
 }
 
 
@@ -757,57 +818,8 @@ export interface SelectionController<M extends Record<string, unknown> = Record<
     toggleEntitySelection(entity: Entity<M>, newSelectedState?: boolean): void;
 }
 
-/**
- * Filter conditions in a `Query.where()` clause are specified using the
- * strings `<`, `<=`, `==`, `>=`, `>`, `array-contains`, `in`, and `array-contains-any`.
- * @group Models
- */
-export type WhereFilterOp =
-    | "<"
-    | "<="
-    | "=="
-    | "!="
-    | ">="
-    | ">"
-    | "array-contains"
-    | "in"
-    | "not-in"
-    | "array-contains-any";
-
-/**
- * Used to define filters applied in collections
- *
- * e.g. `{ age: [">=", 18] }`
- *
- * @group Models
- */
-export type FilterValues<Key extends string> =
-    Partial<Record<Key, [WhereFilterOp, unknown] | [WhereFilterOp, unknown][]>>;
-
-/**
- * A pre-defined filter preset for quick access in the collection toolbar.
- * Users can select a preset to instantly apply a set of filters and
- * optionally a sort order.
- *
- * @group Models
- */
-export interface FilterPreset<Key extends string = string> {
-    /**
-     * Display label shown in the preset menu.
-     * If omitted, a summary is auto-generated from the filter keys.
-     */
-    label?: string;
-
-    /**
-     * The filter values to apply when this preset is selected.
-     */
-    filterValues: FilterValues<Key>;
-
-    /**
-     * Optional sort override to apply alongside the filter values.
-     */
-    sort?: [Key, "asc" | "desc"];
-}
+// Canonical filter types — re-exported from the single source-of-truth.
+export type { WhereFilterOp, FilterValues, WireFilterValues, FilterPreset } from "./filter-operators";
 
 
 /**
@@ -964,13 +976,26 @@ export type SecurityOperation = "select" | "insert" | "update" | "delete" | "all
  * operation. Permissive rules are OR'd together (any one passing is enough).
  * Restrictive rules are AND'd (all must pass). This mirrors Supabase behavior.
  *
- * **Mutual exclusivity:** `ownerField`, `access`, and raw SQL (`using`/`withCheck`)
- * cannot be combined. The type system enforces this — attempting to set
- * conflicting fields will produce a compile-time error.
+ * **Mutual exclusivity:** `ownerField`, `access`, structured `condition`, and
+ * raw SQL (`using`/`withCheck`) cannot be combined. The type system enforces
+ * this — attempting to set conflicting fields will produce a compile-time
+ * error.
+ *
+ * **Which form to reach for:** prefer the structured {@link StructuredSecurityRule}
+ * (`condition`/`check`) or the shortcuts (`ownerField`, `access`, `roles`). These
+ * are engine-agnostic and evaluated identically by the database and the admin UI,
+ * so the UI never shows an action the database will reject. Raw SQL
+ * ({@link RawSQLSecurityRule}) keeps full PostgreSQL power but is Postgres-only
+ * and server-authoritative (the UI cannot evaluate arbitrary SQL locally).
  *
  * @group Models
  */
-export type SecurityRule = OwnerSecurityRule | PublicSecurityRule | RawSQLSecurityRule | RolesOnlySecurityRule;
+export type SecurityRule =
+    | OwnerSecurityRule
+    | PublicSecurityRule
+    | StructuredSecurityRule
+    | RawSQLSecurityRule
+    | RolesOnlySecurityRule;
 
 /**
  * Shared fields for all SecurityRule variants.
@@ -1040,11 +1065,16 @@ export interface SecurityRuleBase {
      * application roles managed by Rebase, stored in the `rebase.user_roles`
      * table, and injected into each transaction via `auth.roles()`.
      *
-     * Generates a condition like:
-     *   `auth.roles() ~ '<role1>|<role2>'`
+     * Generates a safe array-overlap condition — the user passes if they hold
+     * *any* of the listed roles:
+     *   `string_to_array(auth.roles(), ',') && ARRAY['<role1>', '<role2>']`
      *
-     * Can be combined with `ownerField`, `access`, or raw `using`/`withCheck`.
-     * When combined, the role check is AND'd with the other condition.
+     * (Note: this is a true set intersection, NOT a regex/substring match, so
+     * a role named `admin` never matches `nonadmin` or `superadmin`.)
+     *
+     * Can be combined with `ownerField`, `access`, `condition`, or raw
+     * `using`/`withCheck`. When combined, the role check is AND'd with the
+     * other condition.
      *
      * @example
      * // Only admins can delete
@@ -1099,6 +1129,8 @@ export interface OwnerSecurityRule extends SecurityRuleBase {
     access?: never;
     using?: never;
     withCheck?: never;
+    condition?: never;
+    check?: never;
 }
 
 /**
@@ -1123,12 +1155,61 @@ export interface PublicSecurityRule extends SecurityRuleBase {
     ownerField?: never;
     using?: never;
     withCheck?: never;
+    condition?: never;
+    check?: never;
+}
+
+/**
+ * Security rule expressed as a structured, engine-agnostic
+ * {@link PolicyExpression}. This is the **recommended** way to write a
+ * non-trivial condition: it compiles to PostgreSQL `USING`/`WITH CHECK` SQL
+ * *and* is evaluated identically by the admin UI, so the UI can never show an
+ * action the database will reject.
+ *
+ * Cannot be combined with `ownerField`, `access`, or raw `using`/`withCheck`.
+ *
+ * @example
+ * // Owner, or any user holding the `moderator` role
+ * {
+ *   operation: "update",
+ *   condition: policy.or(
+ *       policy.compare(policy.field("user_id"), "eq", policy.authUid()),
+ *       policy.rolesOverlap(["moderator"])
+ *   )
+ * }
+ *
+ * @group Models
+ */
+export interface StructuredSecurityRule extends SecurityRuleBase {
+    /**
+     * Structured condition for the `USING` clause — which *existing* rows are
+     * visible / can be modified / deleted (SELECT, UPDATE, DELETE).
+     */
+    condition: PolicyExpression;
+
+    /**
+     * Structured condition for the `WITH CHECK` clause — which *new/updated*
+     * row values are allowed (INSERT, UPDATE). Defaults to `condition` when
+     * omitted, mirroring PostgreSQL's own behavior.
+     */
+    check?: PolicyExpression;
+
+    ownerField?: never;
+    access?: never;
+    using?: never;
+    withCheck?: never;
 }
 
 /**
  * Security rule using raw SQL expressions for full PostgreSQL RLS power.
  *
- * Cannot be combined with `ownerField` or `access`.
+ * **Postgres-only and server-authoritative.** Arbitrary SQL cannot be
+ * evaluated by the admin UI, so a rule using this form is treated as *unknown*
+ * client-side (never silently allowed) and its effect on visible actions is
+ * reflected from the server. For conditions that should also drive the UI
+ * precisely, prefer the structured {@link StructuredSecurityRule}.
+ *
+ * Cannot be combined with `ownerField`, `access`, or structured `condition`.
  *
  * You can reference columns via `{column_name}` which will be resolved to
  * `table.column_name` in the generated Drizzle code.
@@ -1166,6 +1247,8 @@ export interface RawSQLSecurityRule extends SecurityRuleBase {
 
     ownerField?: never;
     access?: never;
+    condition?: never;
+    check?: never;
 }
 
 /**
@@ -1186,6 +1269,8 @@ export interface RolesOnlySecurityRule extends SecurityRuleBase {
     access?: never;
     using?: never;
     withCheck?: never;
+    condition?: never;
+    check?: never;
 }
 
 /**

package/src/types/data_source.ts

@@ -211,13 +211,13 @@ const CAPABILITIES_REGISTRY: Record<string, DataSourceCapabilities> = {
 };
 
 /**
- * Look up capabilities for a given driver key.
- * If `driver` is undefined or not found, returns `DEFAULT_CAPABILITIES`.
+ * Look up capabilities for a given engine key.
+ * If `engine` is undefined or not found, returns `DEFAULT_CAPABILITIES`.
  * @group Models
  */
-export function getDataSourceCapabilities(driver?: string): DataSourceCapabilities {
-    if (!driver) return POSTGRES_CAPABILITIES; // postgres is the default driver
-    return CAPABILITIES_REGISTRY[driver] ?? DEFAULT_CAPABILITIES;
+export function getDataSourceCapabilities(engine?: string): DataSourceCapabilities {
+    if (!engine) return POSTGRES_CAPABILITIES; // postgres is the default engine
+    return CAPABILITIES_REGISTRY[engine] ?? DEFAULT_CAPABILITIES;
 }
 
 /**