@rebasepro/types 0.8.0 → 0.9.1-canary.09aaf62

package/dist/types/policy.d.ts

@@ -17,7 +17,24 @@
  *
  * @group Models
  */
-export type PolicyExpression = TruePolicyExpression | FalsePolicyExpression | AndPolicyExpression | OrPolicyExpression | NotPolicyExpression | ComparePolicyExpression | RolesOverlapPolicyExpression | RolesContainPolicyExpression | AuthenticatedPolicyExpression | RawPolicyExpression;
+export type PolicyExpression = TruePolicyExpression | FalsePolicyExpression | AndPolicyExpression | OrPolicyExpression | NotPolicyExpression | ComparePolicyExpression | RolesOverlapPolicyExpression | RolesContainPolicyExpression | AuthenticatedPolicyExpression | ServerContextPolicyExpression | ExistsInPolicyExpression | RawPolicyExpression;
+/**
+ * The id a request without a logged-in user reports as `auth.uid()`.
+ *
+ * A user-context request always sets `app.user_id`: blank would read back as
+ * `NULL`, and `NULL` is how the trusted server context is recognised, so an
+ * anonymous visitor would be promoted to server privileges. The driver
+ * therefore substitutes this sentinel at the single chokepoint where the GUC
+ * is set.
+ *
+ * The consequence for policy authors is that **`auth.uid() IS NOT NULL` is a
+ * tautology on the user path** — it is true for anonymous visitors too. Use
+ * {@link policy.authenticated} (or `auth.uid() <> 'anonymous'`) to mean "signed
+ * in", and {@link policy.serverContext} to mean "the trusted server context".
+ *
+ * @group Models
+ */
+export declare const ANONYMOUS_USER_ID = "anonymous";
 /** Always allows. Compiles to `true`. @group Models */
 export interface TruePolicyExpression {
     kind: "true";
@@ -29,12 +46,12 @@ export interface FalsePolicyExpression {
 /** Logical AND — every operand must pass. @group Models */
 export interface AndPolicyExpression {
     kind: "and";
-    operands: PolicyExpression[];
+    operands: readonly PolicyExpression[];
 }
 /** Logical OR — at least one operand must pass. @group Models */
 export interface OrPolicyExpression {
     kind: "or";
-    operands: PolicyExpression[];
+    operands: readonly PolicyExpression[];
 }
 /** Logical negation. @group Models */
 export interface NotPolicyExpression {
@@ -60,7 +77,7 @@ export interface ComparePolicyExpression {
  */
 export interface RolesOverlapPolicyExpression {
     kind: "rolesOverlap";
-    roles: string[];
+    roles: readonly string[];
 }
 /**
  * True when the user holds *all* of the given application roles.
@@ -69,15 +86,81 @@ export interface RolesOverlapPolicyExpression {
  */
 export interface RolesContainPolicyExpression {
     kind: "rolesContain";
-    roles: string[];
+    roles: readonly string[];
 }
 /**
- * True when there is an authenticated user (`auth.uid() IS NOT NULL`).
+ * True when a signed-in user is making the request. Compiles to
+ * `auth.uid() IS NOT NULL AND auth.uid() <> 'anonymous'`.
+ *
+ * Both halves are load-bearing. `IS NOT NULL` excludes the server context;
+ * the {@link ANONYMOUS_USER_ID} comparison excludes anonymous visitors, who
+ * *do* carry a non-null `auth.uid()`. Checking only `IS NOT NULL` grants to
+ * everyone — see {@link ANONYMOUS_USER_ID}.
+ *
+ * `policy.not(policy.authenticated())` therefore means "anonymous visitor or
+ * the server context". To single out the server context, use
+ * {@link ServerContextPolicyExpression}.
  * @group Models
  */
 export interface AuthenticatedPolicyExpression {
     kind: "authenticated";
 }
+/**
+ * True only in the trusted **server context** — the built-in flows that run
+ * without a user (signup, migrations, `dataAsAdmin`) set no user GUC, so
+ * `auth.uid()` is `NULL` for them and only for them. Compiles to
+ * `auth.uid() IS NULL`.
+ *
+ * This is what lets the owner connection satisfy a policy even under FORCE RLS.
+ * It is deliberately a primitive rather than `not(authenticated())`: the two
+ * meant the same thing while `authenticated` ignored {@link ANONYMOUS_USER_ID},
+ * and conflating them is what turns a server-only grant into an anonymous one.
+ *
+ * The JavaScript evaluator always returns `false` for this node — a client is
+ * never the server context.
+ * @group Models
+ */
+export interface ServerContextPolicyExpression {
+    kind: "serverContext";
+}
+/**
+ * Membership / relational access: true when at least one row exists in another
+ * collection (a join/membership table) matching `where`. This is what lets you
+ * scope reads to "rows whose team the caller belongs to" without an N+1
+ * per-row lookup — it compiles to a single correlated `EXISTS` subquery.
+ *
+ * Inside `where`, {@link FieldPolicyOperand} (`policy.field`) references a column
+ * of the joined collection, while {@link OuterFieldPolicyOperand}
+ * (`policy.outerField`) references a column of the row being checked (the outer
+ * table under RLS). Combine with {@link AuthUidPolicyOperand} to correlate to
+ * the caller.
+ *
+ * @example
+ * ```ts
+ * // documents visible only to members of the document's team:
+ * policy.existsIn({
+ *   collection: "team_members",
+ *   where: policy.and(
+ *     policy.compare(policy.field("team_id"), "eq", policy.outerField("team_id")),
+ *     policy.compare(policy.field("user_id"), "eq", policy.authUid()),
+ *   ),
+ * })
+ * // → EXISTS (SELECT 1 FROM team_members _ex0
+ * //           WHERE _ex0.team_id = documents.team_id AND _ex0.user_id = auth.uid())
+ * ```
+ *
+ * Postgres-authoritative: like {@link RawPolicyExpression}, the JavaScript
+ * evaluator treats it as *unknown* (it cannot run a subquery client-side), so
+ * enforcement is always the database's.
+ * @group Models
+ */
+export interface ExistsInPolicyExpression {
+    kind: "existsIn";
+    /** Slug of the collection to search (the join / membership table). */
+    collection: string;
+    /** Condition evaluated against the joined collection's rows. */
+    where: PolicyExpression;
+}
 /**
  * A raw PostgreSQL boolean expression — the full-power escape hatch.
  *
@@ -94,13 +177,24 @@ export interface RawPolicyExpression {
  * An operand referenced by a {@link ComparePolicyExpression}.
  * @group Models
  */
-export type PolicyOperand = FieldPolicyOperand | LiteralPolicyOperand | AuthUidPolicyOperand | AuthRolesPolicyOperand;
+export type PolicyOperand = FieldPolicyOperand | OuterFieldPolicyOperand | LiteralPolicyOperand | AuthUidPolicyOperand | AuthRolesPolicyOperand;
 /** A column value on the row being evaluated. @group Models */
 export interface FieldPolicyOperand {
     kind: "field";
     /** The property/column name (resolved to its DB column when compiled). */
     name: string;
 }
+/**
+ * A column value on the *outer* row when used inside {@link ExistsInPolicyExpression}
+ * — i.e. the row the RLS policy is being evaluated for, referenced from within the
+ * subquery. Outside an `existsIn` it is equivalent to {@link FieldPolicyOperand}.
+ * @group Models
+ */
+export interface OuterFieldPolicyOperand {
+    kind: "outerField";
+    /** The property/column name on the outer collection. */
+    name: string;
+}
 /** A constant value. @group Models */
 export interface LiteralPolicyOperand {
     kind: "literal";
@@ -122,15 +216,21 @@ export interface AuthRolesPolicyOperand {
 export declare const policy: {
     true: () => TruePolicyExpression;
     false: () => FalsePolicyExpression;
-    and: (...operands: PolicyExpression[]) => AndPolicyExpression;
-    or: (...operands: PolicyExpression[]) => OrPolicyExpression;
+    and: (...operands: readonly PolicyExpression[]) => AndPolicyExpression;
+    or: (...operands: readonly PolicyExpression[]) => OrPolicyExpression;
     not: (operand: PolicyExpression) => NotPolicyExpression;
     compare: (left: PolicyOperand, op: PolicyCompareOperator, right: PolicyOperand) => ComparePolicyExpression;
-    rolesOverlap: (roles: string[]) => RolesOverlapPolicyExpression;
-    rolesContain: (roles: string[]) => RolesContainPolicyExpression;
+    rolesOverlap: (roles: readonly string[]) => RolesOverlapPolicyExpression;
+    rolesContain: (roles: readonly string[]) => RolesContainPolicyExpression;
     authenticated: () => AuthenticatedPolicyExpression;
+    serverContext: () => ServerContextPolicyExpression;
+    existsIn: (args: {
+        collection: string;
+        where: PolicyExpression;
+    }) => ExistsInPolicyExpression;
     raw: (sql: string) => RawPolicyExpression;
     field: (name: string) => FieldPolicyOperand;
+    outerField: (name: string) => OuterFieldPolicyOperand;
     literal: (value: string | number | boolean | null) => LiteralPolicyOperand;
     authUid: () => AuthUidPolicyOperand;
     authRoles: () => AuthRolesPolicyOperand;

package/dist/types/properties.d.ts

@@ -1,10 +1,10 @@
 import type { ComponentRef } from "./component_ref";
 import type { Entity, EntityReference, EntityRelation, EntityValues, GeoPoint, Vector } from "./entities";
 import type { JoinStep, OnAction, Relation } from "./relations";
-import type { EntityCollection, FilterValues } from "./collections";
+import type { CollectionConfig, FilterValues, WhereFilterOp } from "./collections";
 import type { ColorKey, ColorScheme } from "./chips";
 import type { AuthController } from "../controllers/auth";
-import type { EntityAfterReadProps, EntityBeforeSaveProps } from "./entity_callbacks";
+import type { AfterReadProps, BeforeSaveProps } from "./entity_callbacks";
 import type { User } from "../users";
 /**
  * Callbacks/Hooks for individual property fields
@@ -14,7 +14,7 @@ export type PropertyCallbacks<T = unknown, M extends Record<string, unknown> = R
     /**
      * Callback used after fetching data, to transform the value before rendering
      */
-    afterRead?(props: Omit<EntityAfterReadProps<M, USER>, "entity"> & {
+    afterRead?(props: Omit<AfterReadProps<M, USER>, "entity"> & {
         value: T;
         entity: Entity<M> | undefined;
     }): Promise<T> | T;
@@ -22,7 +22,7 @@ export type PropertyCallbacks<T = unknown, M extends Record<string, unknown> = R
      * Callback used before saving, after validation.
      * You can modify the value before it's saved.
      */
-    beforeSave?(props: Omit<EntityBeforeSaveProps<M, USER>, "values"> & {
+    beforeSave?(props: Omit<BeforeSaveProps<M, USER>, "values"> & {
         value: T;
         previousValue: T | undefined;
         values: Partial<M>;
@@ -116,6 +116,31 @@ export interface BaseUIConfig<CustomProps = unknown> {
     customProps?: CustomProps;
     Field?: ComponentRef<any>;
     Preview?: ComponentRef<any>;
+    /**
+     * Narrow the filter operators offered for this property in collection
+     * filter UIs (table header filters and the Filters dialog).
+     *
+     * The final offered set is the **intersection** of the engine's
+     * capabilities, the property-type defaults, and this list — you can only
+     * *restrict*, never enable an operator the underlying engine cannot run.
+     *
+     * Pass an empty array to disable filtering on this property entirely.
+     *
+     * @example
+     * // Email column: exact match, contains, and null check only
+     * ui: { filterOperators: ["==", "ilike", "is-null"] }
+     */
+    filterOperators?: readonly WhereFilterOp[];
+    /**
+     * Replace the filter field rendered for this property in collection
+     * filter UIs. The component receives `FilterFieldBindingProps`
+     * (property, resolved `operators`, `value`, `setValue`, …).
+     *
+     * Takes precedence over the collection-level
+     * `components["Collection.FilterField"]` override and the built-in
+     * per-type filter fields.
+     */
+    Filter?: ComponentRef<any>;
 }
 export interface BaseProperty<CustomProps = unknown> {
     ui?: BaseUIConfig<CustomProps>;
@@ -150,6 +175,19 @@ export interface BaseProperty<CustomProps = unknown> {
      * Rules for validating this property
      */
     validation?: PropertyValidationSchema;
+    /**
+     * Never include this column in an API response.
+     *
+     * For secrets the server must store and read but no client should ever
+     * receive — password hashes, verification tokens. The value is still
+     * written and queryable server-side; it is stripped from every row the API
+     * serves, for every caller, including admins and service keys.
+     *
+     * This is a server-side guarantee, unlike `ui.hideFromCollection`, which
+     * only stops the admin panel from *rendering* a field and leaves it in the
+     * JSON payload.
+     */
+    excludeFromApi?: boolean;
     /**
      * Use this to define dynamic properties that change based on certain conditions
      * or on the entity's values. For example, you can make a field read-only if
@@ -414,7 +452,7 @@ export interface ReferenceUIConfig extends BaseUIConfig {
     previewProperties?: string[];
 }
 /**
- * A pointer to an entity, stored **as a value** on the row (id + path, and
+ * A pointer to a entity, stored **as a value** on the row (id + path, and
  * optionally a `driver`/`databaseId` for cross-datasource pointers).
  *
  * This is the native primitive of **document databases** — it maps 1:1 to a
@@ -433,7 +471,7 @@ export interface ReferenceProperty extends BaseProperty {
     ui?: ReferenceUIConfig;
     type: "reference";
     /**
-     * Default value for new entities. Must be an EntityReference.
+     * Default value for new entities. Must be a EntityReference.
      */
     defaultValue?: EntityReference;
     /**
@@ -494,7 +532,7 @@ export interface RelationProperty extends BaseProperty {
     ui?: RelationUIConfig;
     type: "relation";
     /**
-     * Default value for new entities. Must be an EntityRelation or array of EntityRelation.
+     * Default value for new entities. Must be a EntityRelation or array of EntityRelation.
      */
     defaultValue?: EntityRelation | EntityRelation[];
     /**
@@ -509,7 +547,7 @@ export interface RelationProperty extends BaseProperty {
      * When set, the framework treats this property as a self-contained relation
      * definition and no separate `relations[]` entry is needed.
      */
-    target?: string | (() => EntityCollection | string);
+    target?: string | (() => CollectionConfig | string);
     /**
      * Whether this property references one or many records.
      * Defaults to `"one"`.
@@ -567,7 +605,7 @@ export interface RelationProperty extends BaseProperty {
     /**
      * Overrides applied to the target collection when rendered as a subcollection tab.
      */
-    overrides?: Partial<EntityCollection>;
+    overrides?: Partial<CollectionConfig>;
     /**
      * Optional name for this relation. Defaults to the property key at runtime.
      * Only needed when the relation name should differ from the property key,
@@ -879,6 +917,13 @@ export type StorageConfig = {
      * When omitted, the default storage source is used.
      */
     storageSource?: string;
+    /**
+     * Store files for this property as **public**: they are placed under the
+     * public prefix and served via stable, token-less, permanent, CDN-cacheable
+     * URLs (safe to persist and hotlink). Use for public assets like avatars or
+     * storefront images. Defaults to `false` (private, short-lived signed URLs).
+     */
+    public?: boolean;
     /**
      * File MIME types that can be uploaded to this reference. Don't specify for
      * all.

package/dist/types/relations.d.ts

@@ -1,4 +1,4 @@
-import type { EntityCollection } from "./collections";
+import type { CollectionConfig } from "./collections";
 /**
  * @group Models
  */
@@ -17,7 +17,7 @@ export interface Relation {
     /**
      * The final collection you want to retrieve records from.
      */
-    target: (() => EntityCollection) | any;
+    target: (() => CollectionConfig) | any;
     /**
      * The nature of the relationship, determining if one or many records are returned.
      */
@@ -270,7 +270,7 @@ export interface Relation {
      * Action to perform on delete.
      */
     onDelete?: OnAction;
-    overrides?: Partial<EntityCollection>;
+    overrides?: Partial<CollectionConfig>;
     validation?: {
         required?: boolean;
     };

package/dist/types/slots.d.ts

@@ -1,5 +1,5 @@
 import React from "react";
-import type { CollectionActionsProps, EntityTableController, SelectionController, EntityCollection } from "./collections";
+import type { CollectionActionsProps, EntityTableController, SelectionController, CollectionConfig } from "./collections";
 import type { Entity } from "./entities";
 import type { PluginFormActionProps, PluginGenericProps, PluginHomePageActionsProps, PluginHomePageAdditionalCardsProps } from "./plugins";
 import type { Property } from "./properties";
@@ -99,7 +99,7 @@ export interface NavigationSlotProps {
  */
 export interface CollectionToolbarProps {
     path: string;
-    collection: EntityCollection;
+    collection: CollectionConfig;
     parentCollectionSlugs: string[];
     parentEntityIds: string[];
     tableController: EntityTableController;
@@ -111,7 +111,7 @@ export interface CollectionToolbarProps {
  */
 export interface CollectionEmptyStateProps {
     path: string;
-    collection: EntityCollection;
+    collection: CollectionConfig;
     parentCollectionSlugs: string[];
     parentEntityIds: string[];
     canCreate: boolean;
@@ -128,7 +128,7 @@ export interface CollectionHeaderActionProps {
     parentCollectionSlugs: string[];
     parentEntityIds: string[];
     onHover: boolean;
-    collection: EntityCollection;
+    collection: CollectionConfig;
     tableController: EntityTableController;
 }
 /**
@@ -139,7 +139,7 @@ export interface CollectionAddColumnProps {
     path: string;
     parentCollectionSlugs: string[];
     parentEntityIds: string[];
-    collection: EntityCollection;
+    collection: CollectionConfig;
     tableController: EntityTableController;
 }
 /**
@@ -148,7 +148,7 @@ export interface CollectionAddColumnProps {
  */
 export interface CollectionErrorProps {
     path: string;
-    collection: EntityCollection;
+    collection: CollectionConfig;
     parentCollectionSlugs?: string[];
     parentEntityIds?: string[];
     error: Error;
@@ -158,7 +158,7 @@ export interface CollectionErrorProps {
  * @group Plugins
  */
 export interface KanbanSetupProps {
-    collection: EntityCollection;
+    collection: CollectionConfig;
     fullPath: string;
     parentCollectionSlugs: string[];
     parentEntityIds: string[];
@@ -168,7 +168,7 @@ export interface KanbanSetupProps {
  * @group Plugins
  */
 export interface KanbanAddColumnProps {
-    collection: EntityCollection;
+    collection: CollectionConfig;
     fullPath: string;
     parentCollectionSlugs: string[];
     parentEntityIds: string[];
@@ -176,14 +176,14 @@ export interface KanbanAddColumnProps {
 }
 /**
  * Props for `entity.row.actions` slot.
- * Rendered for each row in an entity collection table.
+ * Rendered for each row in a entity collection table.
  * @group Plugins
  */
 export interface EntityRowActionsProps {
     entity: Entity;
     entityId: string;
     path: string;
-    collection: EntityCollection;
+    collection: CollectionConfig;
     parentCollectionSlugs: string[];
     parentEntityIds: string[];
     selectionController: SelectionController;
@@ -199,7 +199,7 @@ export interface EntityFieldSlotProps {
     property: Property;
     path: string;
     entityId?: string | number;
-    collection: EntityCollection;
+    collection: CollectionConfig;
     context: RebaseContext;
 }
 /**
@@ -209,7 +209,7 @@ export interface EntityFieldSlotProps {
  */
 export interface CollectionFilterPanelProps {
     path: string;
-    collection: EntityCollection;
+    collection: CollectionConfig;
     parentCollectionSlugs: string[];
     parentEntityIds: string[];
     tableController: EntityTableController;
@@ -246,7 +246,7 @@ export interface ShellToolbarProps {
  */
 export interface CollectionInsightsSlotProps {
     path: string;
-    collection: EntityCollection;
+    collection: CollectionConfig;
     parentCollectionSlugs: string[];
     parentEntityIds: string[];
 }
@@ -257,6 +257,6 @@ export interface CollectionInsightsSlotProps {
  */
 export interface HomeCardInsightSlotProps {
     slug: string;
-    collection: EntityCollection;
+    collection: CollectionConfig;
     context: RebaseContext;
 }

package/dist/types/translations.d.ts

@@ -6,7 +6,7 @@ export type DeepPartial<T> = T extends object ? {
     [K in keyof T]?: DeepPartial<T[K]>;
 } : T;
 /**
- * All user-visible strings used internally by @rebasepro/core.
+ * All user-visible strings used internally by @rebasepro/app.
  * Pass a `DeepPartial<RebaseTranslations>` via the `translations` prop
  * on your Rebase entry-point component to override any key, or to add
  * a new locale.
@@ -487,6 +487,7 @@ export interface RebaseTranslations {
     invitation_sent_title?: string;
     temporary_password?: string;
     temporary_password_description?: string;
+    temporary_password_email_failed_description?: string;
     copy_password?: string;
     password_copied?: string;
     /** UsersView — pagination & search */
@@ -497,6 +498,9 @@ export interface RebaseTranslations {
     reset_password?: string;
     reset_password_success?: string;
     reset_password_confirmation?: string;
+    reset_password_send_email?: string;
+    reset_password_set_manually?: string;
+    reset_password_set_manually_description?: string;
     error_resetting_password?: string;
     /** Permission-denied empty states */
     no_permission_to_view_users?: string;

package/dist/types/user_management_delegate.d.ts

@@ -9,8 +9,14 @@ export interface UserCreationResult<USER extends User = User> {
     /** Whether an invitation email was sent to the user */
     invitationSent: boolean;
     /**
-     * Temporary password (only present when email service is not configured).
-     * This is returned one-time and should be shown to the admin to share manually.
+     * Temporary password, present when no invitation email could be delivered —
+     * either because no email service is configured, or because delivery failed
+     * (see `emailDeliveryFailed`). Returned one-time, to be shared manually.
      */
     temporaryPassword?: string;
+    /**
+     * Whether an email service was configured but delivery failed, causing the
+     * fallback to `temporaryPassword`. Absent when no email service is configured.
+     */
+    emailDeliveryFailed?: boolean;
 }

package/dist/types/websockets.d.ts

@@ -1,4 +1,3 @@
-import { Entity } from "./entities";
 export interface WebSocketErrorPayload {
     error?: string | {
         message: string;
@@ -12,32 +11,66 @@ export interface WebSocketMessage {
     payload?: unknown;
     subscriptionId?: string;
     requestId?: string;
-    entities?: Entity<Record<string, unknown>>[];
-    entity?: Entity<Record<string, unknown>> | null;
+    rows?: Record<string, unknown>[];
+    row?: Record<string, unknown> | null;
     error?: string;
+    /**
+     * Channel name, on broadcast and presence frames.
+     *
+     * These are addressed by channel rather than by `requestId` or
+     * `subscriptionId`, so this is the only field that routes them.
+     */
+    channel?: string;
 }
+/**
+ * The key columns a collection's rows are addressed by.
+ *
+ * A row is exactly its columns and carries no address, so a subscriber that has
+ * to recognise one — to patch it, or to keep its reference across a refetch —
+ * derives the address from these. The SDK is usable with no collections
+ * declared at all, so the server is the only side that knows them.
+ *
+ * Undefined when the server cannot resolve them: a table with no primary key
+ * and no `id` column has no address, and rows of it cannot be recognised by
+ * anyone.
+ */
+export type WirePrimaryKeys = {
+    fieldName: string;
+    type: "string" | "number";
+    isUUID?: boolean;
+}[];
 export interface CollectionUpdateMessage extends WebSocketMessage {
     type: "collection_update";
     subscriptionId: string;
-    entities: Entity<Record<string, unknown>>[];
+    rows: Record<string, unknown>[];
+    /**
+     * See {@link WirePrimaryKeys}. Sent with the rows themselves — and not only
+     * with a patch — because a CDC-originated change sends no patch at all: it
+     * invalidates and goes straight to a refetch, and the merge that preserves
+     * unchanged rows' references needs an address to match them by.
+     */
+    pks?: WirePrimaryKeys;
 }
-export interface EntityUpdateMessage extends WebSocketMessage {
-    type: "entity_update";
+export interface SingleUpdateMessage extends WebSocketMessage {
+    type: "single_update";
     subscriptionId: string;
-    entity: Entity<Record<string, unknown>> | null;
+    row: Record<string, unknown> | null;
 }
 /**
  * Lightweight patch message sent to collection subscribers when a single
- * entity is created, updated, or deleted. The client can merge this into
+ * row is created, updated, or deleted. The client can merge this into
  * its cached collection data for near-instant cross-tab updates without
  * waiting for a full collection refetch.
  */
-export interface CollectionEntityPatchMessage extends WebSocketMessage {
-    type: "collection_entity_patch";
+export interface CollectionPatchMessage extends WebSocketMessage {
+    type: "collection_patch";
     subscriptionId: string;
-    entityId: string;
-    /** The updated entity, or null if deleted */
-    entity: Entity<Record<string, unknown>> | null;
+    /** The address of the row this patch refers to — derived, never read off it. */
+    id: string;
+    /** The updated row, or null if deleted */
+    row: Record<string, unknown> | null;
+    /** See {@link WirePrimaryKeys}: how the subscriber finds {@link id} in its cache. */
+    pks?: WirePrimaryKeys;
 }
 /**
  * Column metadata returned by table introspection.

package/dist/users/user.d.ts

@@ -1,10 +1,17 @@
 /**
- * This interface represents a user.
- * It has some of the same fields as a Firebase User.
- * Note that in the default implementation, we simply take the Firebase user
- * and use it as a Rebase user, so that means that even if they are not mapped
- * in this interface, it contains all the methods of the former, such as `delete`,
- * `getIdToken`, etc.
+ * The canonical representation of an authenticated user in the Rebase ecosystem.
+ *
+ * Used by {@link AuthController}, collections, callbacks, and both the
+ * `@rebasepro/client` and `@rebasepro/app` packages. All other user types
+ * (`RebaseUser`, `UserInfo`) are deprecated aliases of this type.
+ *
+ * **Backend-managed fields** (`uid`, `email`, `roles`, `metadata`, `createdAt`)
+ * are populated by the server. **Client-visible fields** (`displayName`,
+ * `photoURL`, `providerId`, `isAnonymous`, `emailVerified`) may be set during
+ * authentication or profile updates.
+ *
+ * @see AdminUser — the admin-API DTO, which adds audit fields (`createdAt`,
+ * `updatedAt`) and required `roles`.
  *
  * @group Models
  */
@@ -26,15 +33,20 @@ export type User = {
      */
     readonly photoURL: string | null;
     /**
-     * The provider used to authenticate the user.
+     * The provider used to authenticate the user (e.g. `"password"`,
+     * `"google"`, `"github"`).
      */
     readonly providerId: string;
     /**
-     *
+     * Whether the user is anonymous (created via anonymous sign-in).
      */
     readonly isAnonymous: boolean;
     /**
-     * Role IDs assigned to this user (e.g. ["admin", "editor"]).
+     * Whether the user's email address has been verified.
+     */
+    readonly emailVerified?: boolean;
+    /**
+     * Role IDs assigned to this user (e.g. `["admin", "editor"]`).
      */
     roles?: string[];
     /**