@rebasepro/common 0.23.0 → 0.24.1-canary.g56af4a4

package/dist/collections/CollectionRegistry.d.ts

@@ -24,6 +24,13 @@ export declare class CollectionRegistry {
     getGlobalCallbacks(): CollectionCallbacks | undefined;
     private collectionsByTableName;
     private collectionsBySlug;
+    /**
+     * Root collections whose driver stores them under a `path` other than
+     * their slug, by that path. A list, because the path is only unique within
+     * a data source: two collections in different databases may both be stored
+     * at `customer`.
+     */
+    private collectionsByDataPath;
     private rootCollections;
     private cachedCollectionsList;
     private rawCollectionsByTableName;
@@ -49,11 +56,61 @@ export declare class CollectionRegistry {
      */
     registerMultiple(collections: CollectionConfig[]): boolean;
     register(collection: CollectionConfig, rawCollection?: CollectionConfig): void;
+    /**
+     * Index a root collection by the path its driver stores it under, when
+     * that is not its slug. Only roots: a subcollection's `path` is relative to
+     * the record it hangs off, so it names nothing on its own.
+     */
+    private indexDataPath;
     private _registerRecursively;
     normalizeCollection(collection: CollectionConfig): CollectionConfig;
     private normalizeProperties;
     private normalizeProperty;
-    get(path: string): CollectionConfig | undefined;
+    /**
+     * The collection registered under `path`: by slug, by slug with hyphens
+     * for underscores, by table name, and last by the `path` a root Firestore
+     * or MongoDB collection declares for its driver.
+     *
+     * One string can name two collections. Declaring `slug: "fs_diagnosis",
+     * path: "diagnosis"` is how a Firestore collection sits beside a Postgres
+     * collection whose slug is `diagnosis` — and a reference read back from
+     * Firestore carries `diagnosis`. The order above settles it in favour of the
+     * slug unless `preferredDriver` is given: then the first collection whose
+     * data source or engine is `preferredDriver` wins. Pass a reference's
+     * `driver`, or the data source of the record the path was read from.
+     */
+    get(path: string, preferredDriver?: string): CollectionConfig | undefined;
+    /** Every collection {@link get} could answer `path` with, in its order. */
+    private candidatesFor;
+    /**
+     * The path a collection's rows are stored under, for the path the admin
+     * addresses it by.
+     *
+     * The admin addresses a collection by its slug — in routes, in
+     * `data.collection(...)`, in the `path` of every entity it lists — because
+     * the slug is what is unique. A Firestore or MongoDB collection may declare
+     * a `path` of its own ({@link getCollectionDataPath}), and its driver has to
+     * be handed that one, under every record and subcollection too:
+     * `fs_diagnosis/abc/locales` is stored at `diagnosis/abc/locales`.
+     *
+     * A path that names no registered collection, or runs only through
+     * collections stored under their slugs, comes back unchanged.
+     */
+    resolveDataPath(path: string): string;
+    /**
+     * The path the admin addresses a collection by, for a path its rows are
+     * stored under: the inverse of {@link resolveDataPath}, for a reference
+     * read back from its driver.
+     *
+     * The root is the longest leading run of segments naming a collection, and
+     * becomes its slug when the run is where that collection is stored. Each
+     * subcollection after a record id is matched by where it is stored too. A
+     * path that already names its collections by slug comes back unchanged.
+     *
+     * `preferredDriver` decides between a collection stored at the path and one
+     * whose slug it is, as in {@link get}.
+     */
+    resolveCollectionPath(path: string, preferredDriver?: string): string;
     /**
      * Gets the pristine, un-normalized collection exactly as it was provided.
      * Useful for the AST editor so it doesn't accidentally serialize injected metadata back to disk.
@@ -68,9 +125,21 @@ export declare class CollectionRegistry {
     getRawCollections(): CollectionConfig[];
     /**
      * Resolves a multi-segment path like "products/123/locales" and returns
-     * information about the collections and entity IDs along the path
+     * information about the collections and entity IDs along the path.
+     *
+     * A slug may contain slashes (`content/de-DE/podcasts`), so the root is
+     * the longest leading run of segments naming a registered collection, and
+     * each subcollection is matched the same way among its parent's.
+     *
+     * @param options.allowRecordPath accept a path that ends at a record
+     * (`…/{id}`) and resolve it to the collection holding that record, with the
+     * id last in `entityIds`. Without it such a path is an error. Only the
+     * registry can tell the two shapes apart, because only it knows where each
+     * slug ends.
      */
-    resolvePathToCollections(path: string): {
+    resolvePathToCollections(path: string, options?: {
+        allowRecordPath?: boolean;
+    }): {
         collections: CollectionConfig[];
         entityIds: (string | number)[];
         finalCollection: CollectionConfig;

package/dist/collections/CollectionRegistry.es.js

@@ -0,0 +1,404 @@
+import { enumToObjectEntries } from "../util/enums.es.js";
+import { resolveRelation } from "../util/resolve-relation.es.js";
+import { findRelation, getTableName, resolveCollectionRelations } from "../util/relations.es.js";
+import { getSubcollections } from "../util/resolutions.es.js";
+import { authSecretsMissingExclusion } from "./auth-secrets.es.js";
+import { resolveDataSource } from "../data/resolveDataSource.es.js";
+import { getCollectionDataPath, getDataSourceCapabilities } from "@rebasepro/types";
+import { deepClone, removeFunctions } from "@rebasepro/utils";
+import { deepEqual } from "fast-equals";
+//#region src/collections/CollectionRegistry.ts
+var CollectionRegistry = class {
+	/**
+	* Declared data sources, used during normalization to resolve each
+	* collection's engine (so `dataSource`-only collections get the right
+	* capabilities). Empty by default.
+	*/
+	dataSources = {};
+	/**
+	* Global lifecycle callbacks applied to every collection.
+	* Runs on all data paths (REST, WebSocket, `rebase.dataAsAdmin`).
+	* Execution order: global → collection → property callbacks.
+	*/
+	_globalCallbacks;
+	/**
+	* Set global lifecycle callbacks that apply to every collection.
+	* Typically called once during backend initialization.
+	*/
+	setGlobalCallbacks(callbacks) {
+		this._globalCallbacks = callbacks;
+	}
+	/**
+	* Get the currently registered global callbacks, if any.
+	*/
+	getGlobalCallbacks() {
+		return this._globalCallbacks;
+	}
+	collectionsByTableName = /* @__PURE__ */ new Map();
+	collectionsBySlug = /* @__PURE__ */ new Map();
+	/**
+	* Root collections whose driver stores them under a `path` other than
+	* their slug, by that path. A list, because the path is only unique within
+	* a data source: two collections in different databases may both be stored
+	* at `customer`.
+	*/
+	collectionsByDataPath = /* @__PURE__ */ new Map();
+	rootCollections = [];
+	cachedCollectionsList = null;
+	rawCollectionsByTableName = /* @__PURE__ */ new Map();
+	rawCollectionsBySlug = /* @__PURE__ */ new Map();
+	rawRootCollections = [];
+	cachedRawCollectionsList = null;
+	lastRawInputEntity = null;
+	constructor(collections, dataSources) {
+		if (dataSources) this.dataSources = dataSources;
+		if (collections) this.registerMultiple(collections);
+	}
+	/**
+	* Provide the declared data sources used to resolve each collection's
+	* engine during normalization. Set this before registering collections.
+	* Returns true if the registry changed (callers may re-register).
+	*/
+	setDataSources(dataSources) {
+		if (deepEqual(this.dataSources, dataSources)) return false;
+		this.dataSources = dataSources ?? {};
+		return true;
+	}
+	reset() {
+		this.collectionsByTableName.clear();
+		this.collectionsBySlug.clear();
+		this.collectionsByDataPath.clear();
+		this.rootCollections = [];
+		this.cachedCollectionsList = null;
+		this.rawCollectionsByTableName.clear();
+		this.rawCollectionsBySlug.clear();
+		this.rawRootCollections = [];
+		this.cachedRawCollectionsList = null;
+	}
+	/**
+	* Registers a collection and its subcollections recursively.
+	* Returns true if the collections have changed, false otherwise.
+	*
+	* Idempotent: compares the raw input (before normalization) against a stored
+	* entity. Only re-normalizes and re-registers when the raw input actually changed.
+	* @param collections
+	*/
+	registerMultiple(collections) {
+		const rawEntity = collections.map((c) => removeFunctions(c));
+		if (this.lastRawInputEntity && deepEqual(this.lastRawInputEntity, rawEntity)) return false;
+		this.reset();
+		collections.forEach((c) => {
+			if (c.slug) this.collectionsBySlug.set(c.slug, c);
+			this.collectionsByTableName.set(getTableName(c), c);
+		});
+		const normalizedCollections = collections.map((c) => this.normalizeCollection({ ...c }));
+		normalizedCollections.forEach((c, index) => {
+			const raw = deepClone(collections[index]);
+			this.rootCollections.push(c);
+			this.rawRootCollections.push(raw);
+			const normalized = this.normalizeCollection(c);
+			this.collectionsByTableName.set(getTableName(normalized), normalized);
+			this.rawCollectionsByTableName.set(getTableName(raw), raw);
+			if (normalized.slug) this.collectionsBySlug.set(normalized.slug, normalized);
+			this.indexDataPath(normalized);
+			if (raw.slug) this.rawCollectionsBySlug.set(raw.slug, raw);
+		});
+		normalizedCollections.forEach((c) => {
+			const subcollections = getSubcollections(c);
+			if (subcollections && subcollections.length > 0) subcollections.forEach((subCollection) => {
+				if (!subCollection) return;
+				this._registerRecursively(this.normalizeCollection({ ...subCollection }), deepClone(subCollection));
+			});
+		});
+		this.lastRawInputEntity = rawEntity;
+		return true;
+	}
+	register(collection, rawCollection) {
+		const raw = rawCollection ? deepClone(rawCollection) : deepClone(collection);
+		this.rootCollections.push(collection);
+		this.rawRootCollections.push(raw);
+		this._registerRecursively(collection, raw);
+		const registered = this.collectionsByTableName.get(getTableName(collection));
+		if (registered) this.indexDataPath(registered);
+	}
+	/**
+	* Index a root collection by the path its driver stores it under, when
+	* that is not its slug. Only roots: a subcollection's `path` is relative to
+	* the record it hangs off, so it names nothing on its own.
+	*/
+	indexDataPath(collection) {
+		const dataPath = getCollectionDataPath(collection);
+		if (!dataPath || dataPath === collection.slug) return;
+		const indexed = this.collectionsByDataPath.get(dataPath) ?? [];
+		if (!indexed.includes(collection)) this.collectionsByDataPath.set(dataPath, [...indexed, collection]);
+	}
+	_registerRecursively(collection, rawCollection) {
+		if (this.collectionsByTableName.has(getTableName(collection))) return;
+		const normalizedCollection = this.normalizeCollection(collection);
+		this.collectionsByTableName.set(getTableName(normalizedCollection), normalizedCollection);
+		this.rawCollectionsByTableName.set(getTableName(rawCollection), rawCollection);
+		if (normalizedCollection.slug) this.collectionsBySlug.set(normalizedCollection.slug, normalizedCollection);
+		if (rawCollection.slug) this.rawCollectionsBySlug.set(rawCollection.slug, rawCollection);
+		const subcollections = getSubcollections(normalizedCollection);
+		if (subcollections && subcollections.length > 0) subcollections.forEach((subCollection) => {
+			if (!subCollection) return;
+			this._registerRecursively(this.normalizeCollection({ ...subCollection }), deepClone(subCollection));
+		});
+	}
+	normalizeCollection(collection) {
+		const result = { ...collection };
+		{
+			const resolved = resolveDataSource(result, this.dataSources);
+			if (!result.dataSource) result.dataSource = resolved.key;
+			if (!result.engine) result.engine = resolved.engine;
+		}
+		const properties = this.normalizeProperties(result.properties, result);
+		result.properties = properties;
+		for (const key of authSecretsMissingExclusion(result)) properties[key].excludeFromApi = true;
+		return result;
+	}
+	normalizeProperties(properties, collection) {
+		const newProperties = {};
+		for (const key in properties) newProperties[key] = this.normalizeProperty(key, properties[key], collection);
+		return newProperties;
+	}
+	normalizeProperty(key, property, collection) {
+		const newProperty = { ...property };
+		if (newProperty.type === "map" && newProperty.properties) newProperty.properties = this.normalizeProperties(newProperty.properties, collection);
+		else if (newProperty.type === "array") {
+			const arrayProp = newProperty;
+			if (arrayProp.of) if (Array.isArray(arrayProp.of)) arrayProp.of = arrayProp.of.map((p, i) => this.normalizeProperty(`${key}[${i}]`, p, collection));
+			else arrayProp.of = this.normalizeProperty(`${key}.of`, arrayProp.of, collection);
+			else if (arrayProp.oneOf && arrayProp.oneOf.properties) arrayProp.oneOf.properties = this.normalizeProperties(arrayProp.oneOf.properties, collection);
+		} else if ((newProperty.type === "string" || newProperty.type === "number") && newProperty.enum) {
+			const stringOrNumberProperty = newProperty;
+			if (Array.isArray(stringOrNumberProperty.enum)) stringOrNumberProperty.enum = enumToObjectEntries(stringOrNumberProperty.enum);
+			else if (typeof stringOrNumberProperty.enum === "object") stringOrNumberProperty.enum = enumToObjectEntries(stringOrNumberProperty.enum)?.filter((value) => value && (value.id || value.id === 0) && value.label) ?? [];
+		} else if (newProperty.type === "relation") {
+			const relationProperty = newProperty;
+			if (relationProperty.relation) relationProperty.resolvedRelation = resolveRelation(relationProperty.relation, collection, key);
+			else {
+				const declared = resolveCollectionRelations(collection)[key];
+				if (declared) relationProperty.resolvedRelation = declared;
+				else console.warn(`Relation property '${key}' on '${collection.slug}' names no relation: it has no \`relation\` block, and the collection's \`relations\` array has no entry called '${key}'. The field will render no picker, generate no foreign key, and return nothing from \`include()\`.`);
+			}
+		}
+		return newProperty;
+	}
+	/**
+	* The collection registered under `path`: by slug, by slug with hyphens
+	* for underscores, by table name, and last by the `path` a root Firestore
+	* or MongoDB collection declares for its driver.
+	*
+	* One string can name two collections. Declaring `slug: "fs_diagnosis",
+	* path: "diagnosis"` is how a Firestore collection sits beside a Postgres
+	* collection whose slug is `diagnosis` — and a reference read back from
+	* Firestore carries `diagnosis`. The order above settles it in favour of the
+	* slug unless `preferredDriver` is given: then the first collection whose
+	* data source or engine is `preferredDriver` wins. Pass a reference's
+	* `driver`, or the data source of the record the path was read from.
+	*/
+	get(path, preferredDriver) {
+		if (preferredDriver) {
+			const preferred = this.candidatesFor(path).find((collection) => collection.dataSource === preferredDriver || collection.engine === preferredDriver);
+			if (preferred) return preferred;
+		}
+		const bySlug = this.collectionsBySlug.get(path);
+		if (bySlug) return bySlug;
+		if (path.includes("-")) {
+			const normalized = path.replace(/-/g, "_");
+			const byNormalized = this.collectionsBySlug.get(normalized);
+			if (byNormalized) return byNormalized;
+		}
+		const byTableName = this.collectionsByTableName.get(path);
+		if (byTableName) return byTableName;
+		return this.collectionsByDataPath.get(path)?.[0];
+	}
+	/** Every collection {@link get} could answer `path` with, in its order. */
+	candidatesFor(path) {
+		const candidates = [
+			this.collectionsBySlug.get(path),
+			path.includes("-") ? this.collectionsBySlug.get(path.replace(/-/g, "_")) : void 0,
+			this.collectionsByTableName.get(path),
+			...this.collectionsByDataPath.get(path) ?? []
+		];
+		return candidates.filter((collection, index) => collection !== void 0 && candidates.indexOf(collection) === index);
+	}
+	/**
+	* The path a collection's rows are stored under, for the path the admin
+	* addresses it by.
+	*
+	* The admin addresses a collection by its slug — in routes, in
+	* `data.collection(...)`, in the `path` of every entity it lists — because
+	* the slug is what is unique. A Firestore or MongoDB collection may declare
+	* a `path` of its own ({@link getCollectionDataPath}), and its driver has to
+	* be handed that one, under every record and subcollection too:
+	* `fs_diagnosis/abc/locales` is stored at `diagnosis/abc/locales`.
+	*
+	* A path that names no registered collection, or runs only through
+	* collections stored under their slugs, comes back unchanged.
+	*/
+	resolveDataPath(path) {
+		let resolved;
+		const exact = this.get(path);
+		if (exact) resolved = {
+			collections: [exact],
+			entityIds: []
+		};
+		else try {
+			resolved = this.resolvePathToCollections(path);
+		} catch {
+			return path;
+		}
+		const { collections, entityIds } = resolved;
+		if (collections.every((collection) => getCollectionDataPath(collection) === collection.slug)) return path;
+		return collections.map((collection, index) => index < entityIds.length ? `${getCollectionDataPath(collection)}/${entityIds[index]}` : getCollectionDataPath(collection)).join("/");
+	}
+	/**
+	* The path the admin addresses a collection by, for a path its rows are
+	* stored under: the inverse of {@link resolveDataPath}, for a reference
+	* read back from its driver.
+	*
+	* The root is the longest leading run of segments naming a collection, and
+	* becomes its slug when the run is where that collection is stored. Each
+	* subcollection after a record id is matched by where it is stored too. A
+	* path that already names its collections by slug comes back unchanged.
+	*
+	* `preferredDriver` decides between a collection stored at the path and one
+	* whose slug it is, as in {@link get}.
+	*/
+	resolveCollectionPath(path, preferredDriver) {
+		const segments = path.split("/").filter(Boolean);
+		for (let length = segments.length; length > 0; length--) {
+			const prefix = segments.slice(0, length).join("/");
+			const root = this.get(prefix, preferredDriver);
+			if (!root) continue;
+			const translated = [getCollectionDataPath(root) === prefix ? root.slug : prefix];
+			let current = root;
+			let rest = segments.slice(length);
+			while (rest.length >= 2) {
+				const [entityId, storedAt, ...after] = rest;
+				const child = getSubcollections(current).find((subcollection) => getCollectionDataPath(subcollection) === storedAt);
+				if (!child) break;
+				translated.push(entityId, child.slug);
+				current = child;
+				rest = after;
+			}
+			const collectionPath = [...translated, ...rest].join("/");
+			return collectionPath === segments.join("/") ? path : collectionPath;
+		}
+		return path;
+	}
+	/**
+	* Gets the pristine, un-normalized collection exactly as it was provided.
+	* Useful for the AST editor so it doesn't accidentally serialize injected metadata back to disk.
+	*/
+	getRaw(path) {
+		const bySlug = this.rawCollectionsBySlug.get(path);
+		if (bySlug) return bySlug;
+		if (path.includes("-")) {
+			const normalized = path.replace(/-/g, "_");
+			const byNormalized = this.rawCollectionsBySlug.get(normalized);
+			if (byNormalized) return byNormalized;
+		}
+		return this.rawCollectionsByTableName.get(path);
+	}
+	/**
+	* Get collection by resolving multi-segment paths through relations
+	* e.g., "authors/70/posts" resolves to the posts collection
+	*/
+	getCollectionByPath(collectionPath) {
+		if (!collectionPath.includes("/")) return this.get(collectionPath);
+		const pathSegments = collectionPath.split("/").filter((p) => p);
+		if (pathSegments.length < 3 || pathSegments.length % 2 === 0) throw new Error(`Invalid relation path: ${collectionPath}. Expected format: collection/id/relation or collection/id/relation/id/relation`);
+		const rootCollectionPath = pathSegments[0];
+		let currentCollection = this.get(rootCollectionPath);
+		if (!currentCollection) throw new Error(`Root collection not found: ${rootCollectionPath}`);
+		for (let i = 2; i < pathSegments.length; i += 2) {
+			const relationKey = pathSegments[i];
+			if (!getDataSourceCapabilities(currentCollection.engine).supportsRelations) throw new Error(`Relation path navigation requires a collection that supports relations, but '${currentCollection.slug}' uses engine '${currentCollection.engine}'`);
+			const relation = findRelation(resolveCollectionRelations(currentCollection), relationKey);
+			if (!relation) throw new Error(`Relation '${relationKey}' not found in collection '${currentCollection.slug}'`);
+			const target = relation.target();
+			currentCollection = this.collectionsByTableName.get(getTableName(target)) ?? this.normalizeCollection(target);
+			if (i + 1 < pathSegments.length) {}
+		}
+		return currentCollection;
+	}
+	getCollections() {
+		if (!this.cachedCollectionsList) this.cachedCollectionsList = Array.from(this.collectionsByTableName.values());
+		return this.cachedCollectionsList;
+	}
+	getRawCollections() {
+		if (!this.cachedRawCollectionsList) this.cachedRawCollectionsList = Array.from(this.rawCollectionsByTableName.values());
+		return this.cachedRawCollectionsList;
+	}
+	/**
+	* Resolves a multi-segment path like "products/123/locales" and returns
+	* information about the collections and entity IDs along the path.
+	*
+	* A slug may contain slashes (`content/de-DE/podcasts`), so the root is
+	* the longest leading run of segments naming a registered collection, and
+	* each subcollection is matched the same way among its parent's.
+	*
+	* @param options.allowRecordPath accept a path that ends at a record
+	* (`…/{id}`) and resolve it to the collection holding that record, with the
+	* id last in `entityIds`. Without it such a path is an error. Only the
+	* registry can tell the two shapes apart, because only it knows where each
+	* slug ends.
+	*/
+	resolvePathToCollections(path, options) {
+		const pathSegments = path.split("/").filter((p) => p);
+		if (pathSegments.length === 0) throw new Error(`Invalid path: ${path}`);
+		const root = splitAtLeadingCollection(pathSegments, (candidate) => this.get(candidate));
+		if (!root) throw new Error(`Unknown collection path or slug: ${path}`);
+		let currentCollection = root.collection;
+		const collections = [currentCollection];
+		const entityIds = [];
+		let rest = root.rest;
+		while (rest.length > 0) {
+			const [entityId, ...afterEntity] = rest;
+			entityIds.push(entityId);
+			if (afterEntity.length === 0) {
+				if (options?.allowRecordPath) break;
+				throw new Error(`Invalid collection path: ${path}. It ends at the record '${entityId}' of '${currentCollection.slug}', not at a collection.`);
+			}
+			const subcollections = getSubcollections(currentCollection);
+			if (!subcollections || subcollections.length === 0) throw new Error(`No subcollections found for ${currentCollection.slug} in path: ${path}`);
+			const child = splitAtLeadingCollection(afterEntity, (candidate) => subcollections.find((c) => c.slug === candidate));
+			if (!child) throw new Error(`Subcollection '${afterEntity[0]}' not found in ${currentCollection.slug}`);
+			currentCollection = this.normalizeCollection(child.collection);
+			collections.push(currentCollection);
+			rest = child.rest;
+		}
+		return {
+			collections,
+			entityIds,
+			finalCollection: currentCollection
+		};
+	}
+};
+/**
+* Split path segments at the collection they start with.
+*
+* A slug may contain slashes, and several drivers need it to: a Firestore
+* collection partitioned by locale is declared as `content/de-DE/podcasts`,
+* and that string is its *name*. So the collection a path starts with is not
+* its first segment but the longest run of whole leading segments that names
+* one, and what follows it is `entityId/subcollection/…`.
+*
+* Whole segments only, so `content` never matches the start of `contents/1`.
+*/
+function splitAtLeadingCollection(segments, find) {
+	for (let length = segments.length; length > 0; length--) {
+		const collection = find(segments.slice(0, length).join("/"));
+		if (collection) return {
+			collection,
+			rest: segments.slice(length)
+		};
+	}
+}
+//#endregion
+export { CollectionRegistry };
+
+//# sourceMappingURL=CollectionRegistry.es.js.map

package/dist/collections/CollectionRegistry.es.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CollectionRegistry.es.js","names":[],"sources":["../../src/collections/CollectionRegistry.ts"],"sourcesContent":["import {\n    ArrayProperty,\n    CollectionCallbacks,\n    EngineProperties,\n    CollectionConfig,\n    getCollectionDataPath,\n    getDataSourceCapabilities,\n    getDeclaredSubcollections,\n    NumberProperty,\n    Properties,\n    Property,\n    Relation,\n    RelationProperty,\n    StringProperty\n} from \"@rebasepro/types\";\nimport { deepEqual } from \"fast-equals\";\n\nimport {\n    enumToObjectEntries,\n    findRelation,\n    getSubcollections,\n    getTableName,\n    resolveCollectionRelations,\n    resolveRelation\n} from \"../util\";\nimport { deepClone, mergeDeep, removeFunctions } from \"@rebasepro/utils\";\nimport { DataSourceRegistry, resolveDataSource } from \"../data/resolveDataSource\";\nimport { authSecretsMissingExclusion } from \"./auth-secrets\";\n\nexport class CollectionRegistry {\n\n    /**\n     * Declared data sources, used during normalization to resolve each\n     * collection's engine (so `dataSource`-only collections get the right\n     * capabilities). Empty by default.\n     */\n    private dataSources: DataSourceRegistry = {};\n\n    /**\n     * Global lifecycle callbacks applied to every collection.\n     * Runs on all data paths (REST, WebSocket, `rebase.dataAsAdmin`).\n     * Execution order: global → collection → property callbacks.\n     */\n    private _globalCallbacks?: CollectionCallbacks;\n\n    /**\n     * Set global lifecycle callbacks that apply to every collection.\n     * Typically called once during backend initialization.\n     */\n    setGlobalCallbacks(callbacks: CollectionCallbacks): void {\n        this._globalCallbacks = callbacks;\n    }\n\n    /**\n     * Get the currently registered global callbacks, if any.\n     */\n    getGlobalCallbacks(): CollectionCallbacks | undefined {\n        return this._globalCallbacks;\n    }\n\n    // Normalized runtime layer (used by Data Grid / UI)\n    private collectionsByTableName = new Map<string, CollectionConfig>();\n    private collectionsBySlug = new Map<string, CollectionConfig>();\n    /**\n     * Root collections whose driver stores them under a `path` other than\n     * their slug, by that path. A list, because the path is only unique within\n     * a data source: two collections in different databases may both be stored\n     * at `customer`.\n     */\n    private collectionsByDataPath = new Map<string, CollectionConfig[]>();\n    private rootCollections: CollectionConfig[] = [];\n    private cachedCollectionsList: CollectionConfig[] | null = null;\n\n    // Raw configuration layer (used by Collection Editor AST generator)\n    private rawCollectionsByTableName = new Map<string, CollectionConfig>();\n    private rawCollectionsBySlug = new Map<string, CollectionConfig>();\n    private rawRootCollections: CollectionConfig[] = [];\n    private cachedRawCollectionsList: CollectionConfig[] | null = null;\n\n    // Entity of raw input for idempotency check — compared BEFORE normalization\n    // to avoid the issue where normalization creates new objects that always fail equality.\n    private lastRawInputEntity: ReturnType<typeof removeFunctions>[] | null = null;\n\n    constructor(collections?: CollectionConfig[], dataSources?: DataSourceRegistry) {\n        if (dataSources) this.dataSources = dataSources;\n        if (collections) {\n            this.registerMultiple(collections);\n        }\n    }\n\n    /**\n     * Provide the declared data sources used to resolve each collection's\n     * engine during normalization. Set this before registering collections.\n     * Returns true if the registry changed (callers may re-register).\n     */\n    setDataSources(dataSources: DataSourceRegistry): boolean {\n        if (deepEqual(this.dataSources, dataSources)) return false;\n        this.dataSources = dataSources ?? {};\n        return true;\n    }\n\n    reset() {\n        this.collectionsByTableName.clear();\n        this.collectionsBySlug.clear();\n        this.collectionsByDataPath.clear();\n        this.rootCollections = [];\n        this.cachedCollectionsList = null;\n\n        this.rawCollectionsByTableName.clear();\n        this.rawCollectionsBySlug.clear();\n        this.rawRootCollections = [];\n        this.cachedRawCollectionsList = null;\n    }\n\n    /**\n     * Registers a collection and its subcollections recursively.\n     * Returns true if the collections have changed, false otherwise.\n     *\n     * Idempotent: compares the raw input (before normalization) against a stored\n     * entity. Only re-normalizes and re-registers when the raw input actually changed.\n     * @param collections\n     */\n    registerMultiple(collections: CollectionConfig[]): boolean {\n        // Compare raw input BEFORE normalization to detect actual changes.\n        // This avoids the old issue where normalization creates new objects\n        // that always fail deep-equal even when the source data is identical.\n        const rawEntity = collections.map(c => removeFunctions(c));\n        if (this.lastRawInputEntity && deepEqual(this.lastRawInputEntity, rawEntity)) {\n            return false;\n        }\n\n        this.reset();\n        // Phase 0: Populate maps with raw collections first for string target resolution\n        collections.forEach((c) => {\n            if (c.slug) {\n                this.collectionsBySlug.set(c.slug, c);\n            }\n            this.collectionsByTableName.set(getTableName(c), c);\n        });\n\n        const normalizedCollections = collections.map(c => this.normalizeCollection({ ...c }));\n\n        // Phase 1: Register all top-level collections first (without recursion).\n        // This ensures that injected entityViews (e.g. History tab) are preserved.\n        // Without this, _registerRecursively could register a relation-target collection\n        // (e.g. Tags from Posts.relations) using the raw module object (without injected views)\n        // before the top-level Tags collection (with injected views) gets its turn.\n        normalizedCollections.forEach((c, index) => {\n            const raw = deepClone(collections[index]);\n            this.rootCollections.push(c);\n            this.rawRootCollections.push(raw);\n\n            const normalized = this.normalizeCollection(c);\n            this.collectionsByTableName.set(getTableName(normalized), normalized);\n            this.rawCollectionsByTableName.set(getTableName(raw), raw);\n            if (normalized.slug) {\n                this.collectionsBySlug.set(normalized.slug, normalized);\n            }\n            this.indexDataPath(normalized);\n            if (raw.slug) {\n                this.rawCollectionsBySlug.set(raw.slug, raw);\n            }\n        });\n\n        // Phase 2: Now recurse into subcollections (relations, etc.)\n        normalizedCollections.forEach((c) => {\n            const subcollections = getSubcollections(c);\n            if (subcollections && subcollections.length > 0) {\n                subcollections.forEach((subCollection) => {\n                    if (!subCollection) return;\n                    // Spread to avoid mutating the original target() return value\n                    this._registerRecursively(this.normalizeCollection({ ...subCollection }), deepClone(subCollection));\n                });\n            }\n        });\n\n        // Store the entity for future comparisons\n        this.lastRawInputEntity = rawEntity;\n\n        return true;\n    }\n\n    register(collection: CollectionConfig, rawCollection?: CollectionConfig) {\n        const raw = rawCollection ? deepClone(rawCollection) : deepClone(collection);\n\n        this.rootCollections.push(collection);\n        this.rawRootCollections.push(raw);\n\n        this._registerRecursively(collection, raw);\n\n        const registered = this.collectionsByTableName.get(getTableName(collection));\n        if (registered) this.indexDataPath(registered);\n    }\n\n    /**\n     * Index a root collection by the path its driver stores it under, when\n     * that is not its slug. Only roots: a subcollection's `path` is relative to\n     * the record it hangs off, so it names nothing on its own.\n     */\n    private indexDataPath(collection: CollectionConfig) {\n        const dataPath = getCollectionDataPath(collection);\n        if (!dataPath || dataPath === collection.slug) return;\n        const indexed = this.collectionsByDataPath.get(dataPath) ?? [];\n        if (!indexed.includes(collection)) {\n            this.collectionsByDataPath.set(dataPath, [...indexed, collection]);\n        }\n    }\n\n    private _registerRecursively(collection: CollectionConfig, rawCollection: CollectionConfig) {\n        if (this.collectionsByTableName.has(getTableName(collection))) {\n            return;\n        }\n\n        const normalizedCollection = this.normalizeCollection(collection);\n        this.collectionsByTableName.set(getTableName(normalizedCollection), normalizedCollection);\n        this.rawCollectionsByTableName.set(getTableName(rawCollection), rawCollection);\n\n        if (normalizedCollection.slug) {\n            this.collectionsBySlug.set(normalizedCollection.slug, normalizedCollection);\n        }\n        if (rawCollection.slug) {\n            this.rawCollectionsBySlug.set(rawCollection.slug, rawCollection);\n        }\n\n        // Use the normalized collection for subcollection discovery so that\n        // both inline-extracted and explicit relations are considered.\n        const subcollections = getSubcollections(normalizedCollection);\n\n        if (subcollections && subcollections.length > 0) {\n            subcollections.forEach((subCollection) => {\n                if (!subCollection) return;\n                // Spread to avoid mutating the original target() return value\n                this._registerRecursively(this.normalizeCollection({ ...subCollection }), deepClone(subCollection));\n            });\n        }\n    }\n\n    public normalizeCollection(collection: CollectionConfig): CollectionConfig {\n        // Work on a shallow copy to avoid mutating the caller's reference.\n        // This is critical for idempotency (the raw input must not be changed)\n        // and for preventing mutation of module-level collection singletons.\n        const result = { ...collection } as CollectionConfig;\n\n        // 0. Resolve and stamp `dataSource` and `engine` on the normalized copy.\n        //    After this block every normalized collection has both fields set,\n        //    so downstream code can read them directly without calling\n        //    `resolveDataSource()`.  Only the normalized layer is affected —\n        //    the raw layer used by the collection editor keeps the author's\n        //    original fields.\n        {\n            const resolved = resolveDataSource(result, this.dataSources);\n            if (!result.dataSource) (result as { dataSource?: string }).dataSource = resolved.key;\n            if (!result.engine) (result as { engine?: string }).engine = resolved.engine;\n        }\n\n        // Relations are left exactly as authored.\n        //\n        // This used to hoist every inline relation property into\n        // `collection.relations`, merge it with the declared ones, and run each\n        // through `sanitizeRelation` — a pass that guessed at missing fields and\n        // fell back to the raw relation when it threw. `resolveCollectionRelations`\n        // now reads both sources itself and defaults deterministically, so there\n        // is nothing to hoist, nothing to merge and nothing to guess.\n        //\n        // The hoisting also had a defect worth not reinstating: it flattened\n        // relations declared inside a `map` up to the collection's top level,\n        // where they became child-view tabs keyed by the inner property key.\n\n        // Stamp each relation property with its resolved relation.\n        const properties: Properties = this.normalizeProperties(result.properties, result);\n        result.properties = properties as EngineProperties;\n\n        // The user store's secret columns are excluded in every registry, not\n        // only in the config the server loaded. A redeclared `users` collection\n        // that omits `excludeFromApi` reaches the panel as written, and a form\n        // built from it submits `passwordHash: null` with every new user — a\n        // write the server refuses. The properties are this call's own copies,\n        // so setting the flag here leaves the caller's collection untouched.\n        for (const key of authSecretsMissingExclusion(result)) {\n            properties[key].excludeFromApi = true;\n        }\n\n        // `childCollections` is deliberately NOT populated here.\n        //\n        // It used to be, from the same many-relations `getEntityChildViews`\n        // reads — but stamped with the *target's* slug rather than the relation\n        // key, and then cached onto the collection, so the registry's version\n        // shadowed the correct one for every consumer downstream. Deriving on\n        // read leaves one implementation and keeps `childCollections` meaning\n        // what it documents: a custom driver's explicit override.\n        return result;\n    }\n\n    private normalizeProperties(properties: Properties, collection: CollectionConfig): Properties {\n        const newProperties: Properties = {};\n        for (const key in properties) {\n            newProperties[key] = this.normalizeProperty(key, properties[key], collection);\n        }\n        return newProperties;\n    }\n\n    private normalizeProperty(key: string, property: Property, collection: CollectionConfig): Property {\n        const newProperty = { ...property };\n\n        if (newProperty.type === \"map\" && newProperty.properties) {\n            newProperty.properties = this.normalizeProperties(newProperty.properties, collection);\n        } else if (newProperty.type === \"array\") {\n            // Cast to get a properly typed mutable reference\n            const arrayProp = newProperty as ArrayProperty;\n            if (arrayProp.of) {\n                if (Array.isArray(arrayProp.of)) {\n                    (arrayProp as { of: Property | Property[] }).of = arrayProp.of.map((p, i) => this.normalizeProperty(`${key}[${i}]`, p, collection));\n                } else {\n                    arrayProp.of = this.normalizeProperty(`${key}.of`, arrayProp.of, collection);\n                }\n            } else if (arrayProp.oneOf && arrayProp.oneOf.properties) {\n                arrayProp.oneOf.properties = this.normalizeProperties(arrayProp.oneOf.properties, collection);\n            }\n        } else if ((newProperty.type === \"string\" || newProperty.type === \"number\") && newProperty.enum) {\n            const stringOrNumberProperty = newProperty as StringProperty | NumberProperty;\n            if (Array.isArray(stringOrNumberProperty.enum)) {\n                // A plain list of values (`[\"draft\", \"published\"]`, from a JS\n                // config) becomes `{ id, label }` entries here, once, so no\n                // reader downstream meets a bare string.\n                stringOrNumberProperty.enum = enumToObjectEntries(stringOrNumberProperty.enum);\n            } else if (typeof stringOrNumberProperty.enum === \"object\") {\n                stringOrNumberProperty.enum = enumToObjectEntries(stringOrNumberProperty.enum)?.filter((value) => value && (value.id || value.id === 0) && value.label) ?? [];\n            }\n        } else if (newProperty.type === \"relation\") {\n            const relationProperty = newProperty as RelationProperty;\n\n            // A property either declares its link inline, or names one the\n            // collection declares. Resolve the first directly; look the second\n            // up by name. Either way the property carries the fully-defaulted\n            // relation, so no consumer has to re-derive it.\n            if (relationProperty.relation) {\n                relationProperty.resolvedRelation = resolveRelation(relationProperty.relation, collection, key);\n            } else {\n                const declared = resolveCollectionRelations(collection)[key];\n                if (declared) {\n                    relationProperty.resolvedRelation = declared;\n                } else {\n                    // The boot validator refuses this shape outright, naming the\n                    // property and both ways to fix it — see\n                    // `checkRelationPropertiesResolve` in @rebasepro/server. This\n                    // stays as the second line, for the registries built outside\n                    // a validated boot: the panel's, and the collection editor's\n                    // preview of a config being written.\n                    //\n                    // Still `console.warn`. There is no logger below\n                    // @rebasepro/server, and this package runs in the browser as\n                    // well as on the server, so acquiring one is a design\n                    // decision rather than a substitution.\n                    console.warn(\n                        `Relation property '${key}' on '${collection.slug}' names no relation: it has no ` +\n                        \"`relation` block, and the collection's `relations` array has no entry called \" +\n                        `'${key}'. The field will render no picker, generate no foreign key, and return ` +\n                        \"nothing from `include()`.\"\n                    );\n                }\n            }\n        }\n\n        return newProperty;\n    }\n\n    /**\n     * The collection registered under `path`: by slug, by slug with hyphens\n     * for underscores, by table name, and last by the `path` a root Firestore\n     * or MongoDB collection declares for its driver.\n     *\n     * One string can name two collections. Declaring `slug: \"fs_diagnosis\",\n     * path: \"diagnosis\"` is how a Firestore collection sits beside a Postgres\n     * collection whose slug is `diagnosis` — and a reference read back from\n     * Firestore carries `diagnosis`. The order above settles it in favour of the\n     * slug unless `preferredDriver` is given: then the first collection whose\n     * data source or engine is `preferredDriver` wins. Pass a reference's\n     * `driver`, or the data source of the record the path was read from.\n     */\n    get(path: string, preferredDriver?: string): CollectionConfig | undefined {\n        if (preferredDriver) {\n            const preferred = this.candidatesFor(path)\n                .find(collection => collection.dataSource === preferredDriver || collection.engine === preferredDriver);\n            if (preferred) return preferred;\n        }\n\n        // First try slug lookup\n        const bySlug = this.collectionsBySlug.get(path);\n        if (bySlug) return bySlug;\n\n        // Fallback: normalize hyphens → underscores (URLs use kebab-case, slugs use snake_case)\n        if (path.includes(\"-\")) {\n            const normalized = path.replace(/-/g, \"_\");\n            const byNormalized = this.collectionsBySlug.get(normalized);\n            if (byNormalized) return byNormalized;\n        }\n\n        // Fallback to table name lookup\n        const byTableName = this.collectionsByTableName.get(path);\n        if (byTableName) return byTableName;\n\n        // Last, the path a driver stores a root collection under\n        return this.collectionsByDataPath.get(path)?.[0];\n    }\n\n    /** Every collection {@link get} could answer `path` with, in its order. */\n    private candidatesFor(path: string): CollectionConfig[] {\n        const candidates = [\n            this.collectionsBySlug.get(path),\n            path.includes(\"-\") ? this.collectionsBySlug.get(path.replace(/-/g, \"_\")) : undefined,\n            this.collectionsByTableName.get(path),\n            ...(this.collectionsByDataPath.get(path) ?? [])\n        ];\n        return candidates.filter((collection, index): collection is CollectionConfig =>\n            collection !== undefined && candidates.indexOf(collection) === index);\n    }\n\n    /**\n     * The path a collection's rows are stored under, for the path the admin\n     * addresses it by.\n     *\n     * The admin addresses a collection by its slug — in routes, in\n     * `data.collection(...)`, in the `path` of every entity it lists — because\n     * the slug is what is unique. A Firestore or MongoDB collection may declare\n     * a `path` of its own ({@link getCollectionDataPath}), and its driver has to\n     * be handed that one, under every record and subcollection too:\n     * `fs_diagnosis/abc/locales` is stored at `diagnosis/abc/locales`.\n     *\n     * A path that names no registered collection, or runs only through\n     * collections stored under their slugs, comes back unchanged.\n     */\n    resolveDataPath(path: string): string {\n        let resolved: { collections: CollectionConfig[], entityIds: (string | number)[] };\n        // The whole path first: a slug may contain slashes.\n        const exact = this.get(path);\n        if (exact) {\n            resolved = { collections: [exact], entityIds: [] };\n        } else {\n            try {\n                resolved = this.resolvePathToCollections(path);\n            } catch {\n                return path;\n            }\n        }\n\n        const { collections, entityIds } = resolved;\n        if (collections.every(collection => getCollectionDataPath(collection) === collection.slug)) {\n            return path;\n        }\n        return collections\n            .map((collection, index) => index < entityIds.length\n                ? `${getCollectionDataPath(collection)}/${entityIds[index]}`\n                : getCollectionDataPath(collection))\n            .join(\"/\");\n    }\n\n    /**\n     * The path the admin addresses a collection by, for a path its rows are\n     * stored under: the inverse of {@link resolveDataPath}, for a reference\n     * read back from its driver.\n     *\n     * The root is the longest leading run of segments naming a collection, and\n     * becomes its slug when the run is where that collection is stored. Each\n     * subcollection after a record id is matched by where it is stored too. A\n     * path that already names its collections by slug comes back unchanged.\n     *\n     * `preferredDriver` decides between a collection stored at the path and one\n     * whose slug it is, as in {@link get}.\n     */\n    resolveCollectionPath(path: string, preferredDriver?: string): string {\n        const segments = path.split(\"/\").filter(Boolean);\n        for (let length = segments.length; length > 0; length--) {\n            const prefix = segments.slice(0, length).join(\"/\");\n            const root = this.get(prefix, preferredDriver);\n            if (!root) continue;\n\n            // Reached by its slug, its table name or an alias, a root keeps\n            // what it was called.\n            const translated = [getCollectionDataPath(root) === prefix ? root.slug : prefix];\n            let current: CollectionConfig = root;\n            let rest = segments.slice(length);\n            while (rest.length >= 2) {\n                const [entityId, storedAt, ...after] = rest;\n                const child = getSubcollections(current).find(subcollection => getCollectionDataPath(subcollection) === storedAt);\n                if (!child) break;\n                translated.push(entityId, child.slug);\n                current = child;\n                rest = after;\n            }\n\n            const collectionPath = [...translated, ...rest].join(\"/\");\n            return collectionPath === segments.join(\"/\") ? path : collectionPath;\n        }\n        return path;\n    }\n\n    /**\n     * Gets the pristine, un-normalized collection exactly as it was provided.\n     * Useful for the AST editor so it doesn't accidentally serialize injected metadata back to disk.\n     */\n    getRaw(path: string): CollectionConfig | undefined {\n        const bySlug = this.rawCollectionsBySlug.get(path);\n        if (bySlug) return bySlug;\n\n        // Fallback: normalize hyphens → underscores (URLs use kebab-case, slugs use snake_case)\n        if (path.includes(\"-\")) {\n            const normalized = path.replace(/-/g, \"_\");\n            const byNormalized = this.rawCollectionsBySlug.get(normalized);\n            if (byNormalized) return byNormalized;\n        }\n\n        return this.rawCollectionsByTableName.get(path);\n    }\n\n    /**\n     * Get collection by resolving multi-segment paths through relations\n     * e.g., \"authors/70/posts\" resolves to the posts collection\n     */\n    getCollectionByPath(collectionPath: string): CollectionConfig | undefined {\n        // Handle simple single collection path\n        if (!collectionPath.includes(\"/\")) {\n            return this.get(collectionPath);\n        }\n\n        // Handle multi-segment paths by resolving through relations\n        const pathSegments = collectionPath.split(\"/\").filter(p => p);\n\n        if (pathSegments.length < 3 || pathSegments.length % 2 === 0) {\n            throw new Error(`Invalid relation path: ${collectionPath}. Expected format: collection/id/relation or collection/id/relation/id/relation`);\n        }\n\n        // Start with the root collection\n        const rootCollectionPath = pathSegments[0];\n        let currentCollection = this.get(rootCollectionPath);\n\n        if (!currentCollection) {\n            throw new Error(`Root collection not found: ${rootCollectionPath}`);\n        }\n\n        // Navigate through the path using relations\n        for (let i = 2; i < pathSegments.length; i += 2) {\n            const relationKey = pathSegments[i];\n\n            // Get relations for current collection\n            if (!getDataSourceCapabilities(currentCollection.engine).supportsRelations) {\n                throw new Error(`Relation path navigation requires a collection that supports relations, but '${currentCollection.slug}' uses engine '${currentCollection.engine}'`);\n            }\n            const resolvedRelations = resolveCollectionRelations(currentCollection);\n            const relation = findRelation(resolvedRelations, relationKey);\n\n            if (!relation) {\n                throw new Error(`Relation '${relationKey}' not found in collection '${currentCollection.slug}'`);\n            }\n\n            // Move to the target collection.\n            //\n            // By the relation's own target, never by a slug lookup on its\n            // *name*: `this.get(relation.relationName)` searches the global slug\n            // map, so a relation named `people` that targets `notes` resolved to\n            // an unrelated root collection called `people` — and a nested write\n            // then ran that collection's callbacks against its properties.\n            // The registered instance is preferred, matched by table, to pick up\n            // whatever normalization and injection it received.\n            const target = relation.target();\n            currentCollection = this.collectionsByTableName.get(getTableName(target))\n                ?? this.normalizeCollection(target);\n\n            // If there are more segments, continue navigation\n            if (i + 1 < pathSegments.length) {\n                // Skip entity ID segment\n            }\n        }\n\n        return currentCollection;\n    }\n\n    getCollections(): CollectionConfig[] {\n        if (!this.cachedCollectionsList) {\n            this.cachedCollectionsList = Array.from(this.collectionsByTableName.values());\n        }\n        return this.cachedCollectionsList;\n    }\n\n    getRawCollections(): CollectionConfig[] {\n        if (!this.cachedRawCollectionsList) {\n            this.cachedRawCollectionsList = Array.from(this.rawCollectionsByTableName.values());\n        }\n        return this.cachedRawCollectionsList;\n    }\n\n    /**\n     * Resolves a multi-segment path like \"products/123/locales\" and returns\n     * information about the collections and entity IDs along the path.\n     *\n     * A slug may contain slashes (`content/de-DE/podcasts`), so the root is\n     * the longest leading run of segments naming a registered collection, and\n     * each subcollection is matched the same way among its parent's.\n     *\n     * @param options.allowRecordPath accept a path that ends at a record\n     * (`…/{id}`) and resolve it to the collection holding that record, with the\n     * id last in `entityIds`. Without it such a path is an error. Only the\n     * registry can tell the two shapes apart, because only it knows where each\n     * slug ends.\n     */\n    resolvePathToCollections(path: string, options?: { allowRecordPath?: boolean }): {\n        collections: CollectionConfig[],\n        entityIds: (string | number)[],\n        finalCollection: CollectionConfig\n    } {\n        const pathSegments = path.split(\"/\").filter(p => p);\n\n        if (pathSegments.length === 0) {\n            throw new Error(`Invalid path: ${path}`);\n        }\n\n        // Not `pathSegments[0]`: for `medico/v2.0.0/joints/j1/movements` that\n        // looked for a root collection called `medico`, threw, and left every\n        // subcollection under a slashed slug unreachable.\n        const root = splitAtLeadingCollection(pathSegments, (candidate) => this.get(candidate));\n        if (!root) {\n            throw new Error(`Unknown collection path or slug: ${path}`);\n        }\n\n        let currentCollection = root.collection;\n        const collections: CollectionConfig[] = [currentCollection];\n        const entityIds: (string | number)[] = [];\n\n        // What follows a collection is (entityId, subcollection) pairs, so a\n        // collection path is one whose *remainder* pairs up. Counting the whole\n        // path's segments instead is off by one for every slug with an odd\n        // number of slashes: `content/podcasts` and everything under it read\n        // as a record path.\n        let rest = root.rest;\n        while (rest.length > 0) {\n            const [entityId, ...afterEntity] = rest;\n            entityIds.push(entityId);\n\n            if (afterEntity.length === 0) {\n                if (options?.allowRecordPath) break;\n                throw new Error(`Invalid collection path: ${path}. It ends at the record '${entityId}' of '${currentCollection.slug}', not at a collection.`);\n            }\n\n            const subcollections: CollectionConfig[] | undefined = getSubcollections(currentCollection);\n            if (!subcollections || subcollections.length === 0) {\n                throw new Error(`No subcollections found for ${currentCollection.slug} in path: ${path}`);\n            }\n\n            const child = splitAtLeadingCollection(afterEntity, (candidate) => subcollections.find(c => c.slug === candidate));\n            if (!child) {\n                throw new Error(`Subcollection '${afterEntity[0]}' not found in ${currentCollection.slug}`);\n            }\n            // The child as resolved, not whatever root collection happens to\n            // share its slug. Re-looking it up globally both risked the wrong\n            // collection and discarded the relation's `overrides`, which are\n            // applied when the child view is built.\n            currentCollection = this.normalizeCollection(child.collection);\n            collections.push(currentCollection);\n            rest = child.rest;\n        }\n\n        return {\n            collections,\n            entityIds,\n            finalCollection: currentCollection\n        };\n    }\n\n}\n\n/**\n * Split path segments at the collection they start with.\n *\n * A slug may contain slashes, and several drivers need it to: a Firestore\n * collection partitioned by locale is declared as `content/de-DE/podcasts`,\n * and that string is its *name*. So the collection a path starts with is not\n * its first segment but the longest run of whole leading segments that names\n * one, and what follows it is `entityId/subcollection/…`.\n *\n * Whole segments only, so `content` never matches the start of `contents/1`.\n */\nfunction splitAtLeadingCollection(\n    segments: string[],\n    find: (candidate: string) => CollectionConfig | undefined\n): { collection: CollectionConfig; rest: string[] } | undefined {\n    for (let length = segments.length; length > 0; length--) {\n        const collection = find(segments.slice(0, length).join(\"/\"));\n        if (collection) {\n            return {\n                collection,\n                rest: segments.slice(length)\n            };\n        }\n    }\n    return undefined;\n}\n"],"mappings":";;;;;;;;;;AA6BA,IAAa,qBAAb,MAAgC;;;;;;CAO5B,cAA0C,CAAC;;;;;;CAO3C;;;;;CAMA,mBAAmB,WAAsC;EACrD,KAAK,mBAAmB;CAC5B;;;;CAKA,qBAAsD;EAClD,OAAO,KAAK;CAChB;CAGA,yCAAiC,IAAI,IAA8B;CACnE,oCAA4B,IAAI,IAA8B;;;;;;;CAO9D,wCAAgC,IAAI,IAAgC;CACpE,kBAA8C,CAAC;CAC/C,wBAA2D;CAG3D,4CAAoC,IAAI,IAA8B;CACtE,uCAA+B,IAAI,IAA8B;CACjE,qBAAiD,CAAC;CAClD,2BAA8D;CAI9D,qBAA0E;CAE1E,YAAY,aAAkC,aAAkC;EAC5E,IAAI,aAAa,KAAK,cAAc;EACpC,IAAI,aACA,KAAK,iBAAiB,WAAW;CAEzC;;;;;;CAOA,eAAe,aAA0C;EACrD,IAAI,UAAU,KAAK,aAAa,WAAW,GAAG,OAAO;EACrD,KAAK,cAAc,eAAe,CAAC;EACnC,OAAO;CACX;CAEA,QAAQ;EACJ,KAAK,uBAAuB,MAAM;EAClC,KAAK,kBAAkB,MAAM;EAC7B,KAAK,sBAAsB,MAAM;EACjC,KAAK,kBAAkB,CAAC;EACxB,KAAK,wBAAwB;EAE7B,KAAK,0BAA0B,MAAM;EACrC,KAAK,qBAAqB,MAAM;EAChC,KAAK,qBAAqB,CAAC;EAC3B,KAAK,2BAA2B;CACpC;;;;;;;;;CAUA,iBAAiB,aAA0C;EAIvD,MAAM,YAAY,YAAY,KAAI,MAAK,gBAAgB,CAAC,CAAC;EACzD,IAAI,KAAK,sBAAsB,UAAU,KAAK,oBAAoB,SAAS,GACvE,OAAO;EAGX,KAAK,MAAM;EAEX,YAAY,SAAS,MAAM;GACvB,IAAI,EAAE,MACF,KAAK,kBAAkB,IAAI,EAAE,MAAM,CAAC;GAExC,KAAK,uBAAuB,IAAI,aAAa,CAAC,GAAG,CAAC;EACtD,CAAC;EAED,MAAM,wBAAwB,YAAY,KAAI,MAAK,KAAK,oBAAoB,EAAE,GAAG,EAAE,CAAC,CAAC;EAOrF,sBAAsB,SAAS,GAAG,UAAU;GACxC,MAAM,MAAM,UAAU,YAAY,MAAM;GACxC,KAAK,gBAAgB,KAAK,CAAC;GAC3B,KAAK,mBAAmB,KAAK,GAAG;GAEhC,MAAM,aAAa,KAAK,oBAAoB,CAAC;GAC7C,KAAK,uBAAuB,IAAI,aAAa,UAAU,GAAG,UAAU;GACpE,KAAK,0BAA0B,IAAI,aAAa,GAAG,GAAG,GAAG;GACzD,IAAI,WAAW,MACX,KAAK,kBAAkB,IAAI,WAAW,MAAM,UAAU;GAE1D,KAAK,cAAc,UAAU;GAC7B,IAAI,IAAI,MACJ,KAAK,qBAAqB,IAAI,IAAI,MAAM,GAAG;EAEnD,CAAC;EAGD,sBAAsB,SAAS,MAAM;GACjC,MAAM,iBAAiB,kBAAkB,CAAC;GAC1C,IAAI,kBAAkB,eAAe,SAAS,GAC1C,eAAe,SAAS,kBAAkB;IACtC,IAAI,CAAC,eAAe;IAEpB,KAAK,qBAAqB,KAAK,oBAAoB,EAAE,GAAG,cAAc,CAAC,GAAG,UAAU,aAAa,CAAC;GACtG,CAAC;EAET,CAAC;EAGD,KAAK,qBAAqB;EAE1B,OAAO;CACX;CAEA,SAAS,YAA8B,eAAkC;EACrE,MAAM,MAAM,gBAAgB,UAAU,aAAa,IAAI,UAAU,UAAU;EAE3E,KAAK,gBAAgB,KAAK,UAAU;EACpC,KAAK,mBAAmB,KAAK,GAAG;EAEhC,KAAK,qBAAqB,YAAY,GAAG;EAEzC,MAAM,aAAa,KAAK,uBAAuB,IAAI,aAAa,UAAU,CAAC;EAC3E,IAAI,YAAY,KAAK,cAAc,UAAU;CACjD;;;;;;CAOA,cAAsB,YAA8B;EAChD,MAAM,WAAW,sBAAsB,UAAU;EACjD,IAAI,CAAC,YAAY,aAAa,WAAW,MAAM;EAC/C,MAAM,UAAU,KAAK,sBAAsB,IAAI,QAAQ,KAAK,CAAC;EAC7D,IAAI,CAAC,QAAQ,SAAS,UAAU,GAC5B,KAAK,sBAAsB,IAAI,UAAU,CAAC,GAAG,SAAS,UAAU,CAAC;CAEzE;CAEA,qBAA6B,YAA8B,eAAiC;EACxF,IAAI,KAAK,uBAAuB,IAAI,aAAa,UAAU,CAAC,GACxD;EAGJ,MAAM,uBAAuB,KAAK,oBAAoB,UAAU;EAChE,KAAK,uBAAuB,IAAI,aAAa,oBAAoB,GAAG,oBAAoB;EACxF,KAAK,0BAA0B,IAAI,aAAa,aAAa,GAAG,aAAa;EAE7E,IAAI,qBAAqB,MACrB,KAAK,kBAAkB,IAAI,qBAAqB,MAAM,oBAAoB;EAE9E,IAAI,cAAc,MACd,KAAK,qBAAqB,IAAI,cAAc,MAAM,aAAa;EAKnE,MAAM,iBAAiB,kBAAkB,oBAAoB;EAE7D,IAAI,kBAAkB,eAAe,SAAS,GAC1C,eAAe,SAAS,kBAAkB;GACtC,IAAI,CAAC,eAAe;GAEpB,KAAK,qBAAqB,KAAK,oBAAoB,EAAE,GAAG,cAAc,CAAC,GAAG,UAAU,aAAa,CAAC;EACtG,CAAC;CAET;CAEA,oBAA2B,YAAgD;EAIvE,MAAM,SAAS,EAAE,GAAG,WAAW;EAQ/B;GACI,MAAM,WAAW,kBAAkB,QAAQ,KAAK,WAAW;GAC3D,IAAI,CAAC,OAAO,YAAY,OAAoC,aAAa,SAAS;GAClF,IAAI,CAAC,OAAO,QAAQ,OAAgC,SAAS,SAAS;EAC1E;EAgBA,MAAM,aAAyB,KAAK,oBAAoB,OAAO,YAAY,MAAM;EACjF,OAAO,aAAa;EAQpB,KAAK,MAAM,OAAO,4BAA4B,MAAM,GAChD,WAAW,IAAI,CAAC,iBAAiB;EAWrC,OAAO;CACX;CAEA,oBAA4B,YAAwB,YAA0C;EAC1F,MAAM,gBAA4B,CAAC;EACnC,KAAK,MAAM,OAAO,YACd,cAAc,OAAO,KAAK,kBAAkB,KAAK,WAAW,MAAM,UAAU;EAEhF,OAAO;CACX;CAEA,kBAA0B,KAAa,UAAoB,YAAwC;EAC/F,MAAM,cAAc,EAAE,GAAG,SAAS;EAElC,IAAI,YAAY,SAAS,SAAS,YAAY,YAC1C,YAAY,aAAa,KAAK,oBAAoB,YAAY,YAAY,UAAU;OACjF,IAAI,YAAY,SAAS,SAAS;GAErC,MAAM,YAAY;GAClB,IAAI,UAAU,IACV,IAAI,MAAM,QAAQ,UAAU,EAAE,GAC1B,UAA6C,KAAK,UAAU,GAAG,KAAK,GAAG,MAAM,KAAK,kBAAkB,GAAG,IAAI,GAAG,EAAE,IAAI,GAAG,UAAU,CAAC;QAElI,UAAU,KAAK,KAAK,kBAAkB,GAAG,IAAI,MAAM,UAAU,IAAI,UAAU;QAE5E,IAAI,UAAU,SAAS,UAAU,MAAM,YAC1C,UAAU,MAAM,aAAa,KAAK,oBAAoB,UAAU,MAAM,YAAY,UAAU;EAEpG,OAAO,KAAK,YAAY,SAAS,YAAY,YAAY,SAAS,aAAa,YAAY,MAAM;GAC7F,MAAM,yBAAyB;GAC/B,IAAI,MAAM,QAAQ,uBAAuB,IAAI,GAIzC,uBAAuB,OAAO,oBAAoB,uBAAuB,IAAI;QAC1E,IAAI,OAAO,uBAAuB,SAAS,UAC9C,uBAAuB,OAAO,oBAAoB,uBAAuB,IAAI,CAAC,EAAE,QAAQ,UAAU,UAAU,MAAM,MAAM,MAAM,OAAO,MAAM,MAAM,KAAK,KAAK,CAAC;EAEpK,OAAO,IAAI,YAAY,SAAS,YAAY;GACxC,MAAM,mBAAmB;GAMzB,IAAI,iBAAiB,UACjB,iBAAiB,mBAAmB,gBAAgB,iBAAiB,UAAU,YAAY,GAAG;QAC3F;IACH,MAAM,WAAW,2BAA2B,UAAU,CAAC,CAAC;IACxD,IAAI,UACA,iBAAiB,mBAAmB;SAapC,QAAQ,KACJ,sBAAsB,IAAI,QAAQ,WAAW,KAAK,mHAE9C,IAAI,oGAEZ;GAER;EACJ;EAEA,OAAO;CACX;;;;;;;;;;;;;;CAeA,IAAI,MAAc,iBAAwD;EACtE,IAAI,iBAAiB;GACjB,MAAM,YAAY,KAAK,cAAc,IAAI,CAAC,CACrC,MAAK,eAAc,WAAW,eAAe,mBAAmB,WAAW,WAAW,eAAe;GAC1G,IAAI,WAAW,OAAO;EAC1B;EAGA,MAAM,SAAS,KAAK,kBAAkB,IAAI,IAAI;EAC9C,IAAI,QAAQ,OAAO;EAGnB,IAAI,KAAK,SAAS,GAAG,GAAG;GACpB,MAAM,aAAa,KAAK,QAAQ,MAAM,GAAG;GACzC,MAAM,eAAe,KAAK,kBAAkB,IAAI,UAAU;GAC1D,IAAI,cAAc,OAAO;EAC7B;EAGA,MAAM,cAAc,KAAK,uBAAuB,IAAI,IAAI;EACxD,IAAI,aAAa,OAAO;EAGxB,OAAO,KAAK,sBAAsB,IAAI,IAAI,CAAC,GAAG;CAClD;;CAGA,cAAsB,MAAkC;EACpD,MAAM,aAAa;GACf,KAAK,kBAAkB,IAAI,IAAI;GAC/B,KAAK,SAAS,GAAG,IAAI,KAAK,kBAAkB,IAAI,KAAK,QAAQ,MAAM,GAAG,CAAC,IAAI,KAAA;GAC3E,KAAK,uBAAuB,IAAI,IAAI;GACpC,GAAI,KAAK,sBAAsB,IAAI,IAAI,KAAK,CAAC;EACjD;EACA,OAAO,WAAW,QAAQ,YAAY,UAClC,eAAe,KAAA,KAAa,WAAW,QAAQ,UAAU,MAAM,KAAK;CAC5E;;;;;;;;;;;;;;;CAgBA,gBAAgB,MAAsB;EAClC,IAAI;EAEJ,MAAM,QAAQ,KAAK,IAAI,IAAI;EAC3B,IAAI,OACA,WAAW;GAAE,aAAa,CAAC,KAAK;GAAG,WAAW,CAAC;EAAE;OAEjD,IAAI;GACA,WAAW,KAAK,yBAAyB,IAAI;EACjD,QAAQ;GACJ,OAAO;EACX;EAGJ,MAAM,EAAE,aAAa,cAAc;EACnC,IAAI,YAAY,OAAM,eAAc,sBAAsB,UAAU,MAAM,WAAW,IAAI,GACrF,OAAO;EAEX,OAAO,YACF,KAAK,YAAY,UAAU,QAAQ,UAAU,SACxC,GAAG,sBAAsB,UAAU,EAAE,GAAG,UAAU,WAClD,sBAAsB,UAAU,CAAC,CAAC,CACvC,KAAK,GAAG;CACjB;;;;;;;;;;;;;;CAeA,sBAAsB,MAAc,iBAAkC;EAClE,MAAM,WAAW,KAAK,MAAM,GAAG,CAAC,CAAC,OAAO,OAAO;EAC/C,KAAK,IAAI,SAAS,SAAS,QAAQ,SAAS,GAAG,UAAU;GACrD,MAAM,SAAS,SAAS,MAAM,GAAG,MAAM,CAAC,CAAC,KAAK,GAAG;GACjD,MAAM,OAAO,KAAK,IAAI,QAAQ,eAAe;GAC7C,IAAI,CAAC,MAAM;GAIX,MAAM,aAAa,CAAC,sBAAsB,IAAI,MAAM,SAAS,KAAK,OAAO,MAAM;GAC/E,IAAI,UAA4B;GAChC,IAAI,OAAO,SAAS,MAAM,MAAM;GAChC,OAAO,KAAK,UAAU,GAAG;IACrB,MAAM,CAAC,UAAU,UAAU,GAAG,SAAS;IACvC,MAAM,QAAQ,kBAAkB,OAAO,CAAC,CAAC,MAAK,kBAAiB,sBAAsB,aAAa,MAAM,QAAQ;IAChH,IAAI,CAAC,OAAO;IACZ,WAAW,KAAK,UAAU,MAAM,IAAI;IACpC,UAAU;IACV,OAAO;GACX;GAEA,MAAM,iBAAiB,CAAC,GAAG,YAAY,GAAG,IAAI,CAAC,CAAC,KAAK,GAAG;GACxD,OAAO,mBAAmB,SAAS,KAAK,GAAG,IAAI,OAAO;EAC1D;EACA,OAAO;CACX;;;;;CAMA,OAAO,MAA4C;EAC/C,MAAM,SAAS,KAAK,qBAAqB,IAAI,IAAI;EACjD,IAAI,QAAQ,OAAO;EAGnB,IAAI,KAAK,SAAS,GAAG,GAAG;GACpB,MAAM,aAAa,KAAK,QAAQ,MAAM,GAAG;GACzC,MAAM,eAAe,KAAK,qBAAqB,IAAI,UAAU;GAC7D,IAAI,cAAc,OAAO;EAC7B;EAEA,OAAO,KAAK,0BAA0B,IAAI,IAAI;CAClD;;;;;CAMA,oBAAoB,gBAAsD;EAEtE,IAAI,CAAC,eAAe,SAAS,GAAG,GAC5B,OAAO,KAAK,IAAI,cAAc;EAIlC,MAAM,eAAe,eAAe,MAAM,GAAG,CAAC,CAAC,QAAO,MAAK,CAAC;EAE5D,IAAI,aAAa,SAAS,KAAK,aAAa,SAAS,MAAM,GACvD,MAAM,IAAI,MAAM,0BAA0B,eAAe,gFAAgF;EAI7I,MAAM,qBAAqB,aAAa;EACxC,IAAI,oBAAoB,KAAK,IAAI,kBAAkB;EAEnD,IAAI,CAAC,mBACD,MAAM,IAAI,MAAM,8BAA8B,oBAAoB;EAItE,KAAK,IAAI,IAAI,GAAG,IAAI,aAAa,QAAQ,KAAK,GAAG;GAC7C,MAAM,cAAc,aAAa;GAGjC,IAAI,CAAC,0BAA0B,kBAAkB,MAAM,CAAC,CAAC,mBACrD,MAAM,IAAI,MAAM,gFAAgF,kBAAkB,KAAK,iBAAiB,kBAAkB,OAAO,EAAE;GAGvK,MAAM,WAAW,aADS,2BAA2B,iBACvB,GAAmB,WAAW;GAE5D,IAAI,CAAC,UACD,MAAM,IAAI,MAAM,aAAa,YAAY,6BAA6B,kBAAkB,KAAK,EAAE;GAYnG,MAAM,SAAS,SAAS,OAAO;GAC/B,oBAAoB,KAAK,uBAAuB,IAAI,aAAa,MAAM,CAAC,KACjE,KAAK,oBAAoB,MAAM;GAGtC,IAAI,IAAI,IAAI,aAAa,QAAQ,CAEjC;EACJ;EAEA,OAAO;CACX;CAEA,iBAAqC;EACjC,IAAI,CAAC,KAAK,uBACN,KAAK,wBAAwB,MAAM,KAAK,KAAK,uBAAuB,OAAO,CAAC;EAEhF,OAAO,KAAK;CAChB;CAEA,oBAAwC;EACpC,IAAI,CAAC,KAAK,0BACN,KAAK,2BAA2B,MAAM,KAAK,KAAK,0BAA0B,OAAO,CAAC;EAEtF,OAAO,KAAK;CAChB;;;;;;;;;;;;;;;CAgBA,yBAAyB,MAAc,SAIrC;EACE,MAAM,eAAe,KAAK,MAAM,GAAG,CAAC,CAAC,QAAO,MAAK,CAAC;EAElD,IAAI,aAAa,WAAW,GACxB,MAAM,IAAI,MAAM,iBAAiB,MAAM;EAM3C,MAAM,OAAO,yBAAyB,eAAe,cAAc,KAAK,IAAI,SAAS,CAAC;EACtF,IAAI,CAAC,MACD,MAAM,IAAI,MAAM,oCAAoC,MAAM;EAG9D,IAAI,oBAAoB,KAAK;EAC7B,MAAM,cAAkC,CAAC,iBAAiB;EAC1D,MAAM,YAAiC,CAAC;EAOxC,IAAI,OAAO,KAAK;EAChB,OAAO,KAAK,SAAS,GAAG;GACpB,MAAM,CAAC,UAAU,GAAG,eAAe;GACnC,UAAU,KAAK,QAAQ;GAEvB,IAAI,YAAY,WAAW,GAAG;IAC1B,IAAI,SAAS,iBAAiB;IAC9B,MAAM,IAAI,MAAM,4BAA4B,KAAK,2BAA2B,SAAS,QAAQ,kBAAkB,KAAK,wBAAwB;GAChJ;GAEA,MAAM,iBAAiD,kBAAkB,iBAAiB;GAC1F,IAAI,CAAC,kBAAkB,eAAe,WAAW,GAC7C,MAAM,IAAI,MAAM,+BAA+B,kBAAkB,KAAK,YAAY,MAAM;GAG5F,MAAM,QAAQ,yBAAyB,cAAc,cAAc,eAAe,MAAK,MAAK,EAAE,SAAS,SAAS,CAAC;GACjH,IAAI,CAAC,OACD,MAAM,IAAI,MAAM,kBAAkB,YAAY,GAAG,iBAAiB,kBAAkB,MAAM;GAM9F,oBAAoB,KAAK,oBAAoB,MAAM,UAAU;GAC7D,YAAY,KAAK,iBAAiB;GAClC,OAAO,MAAM;EACjB;EAEA,OAAO;GACH;GACA;GACA,iBAAiB;EACrB;CACJ;AAEJ;;;;;;;;;;;;AAaA,SAAS,yBACL,UACA,MAC4D;CAC5D,KAAK,IAAI,SAAS,SAAS,QAAQ,SAAS,GAAG,UAAU;EACrD,MAAM,aAAa,KAAK,SAAS,MAAM,GAAG,MAAM,CAAC,CAAC,KAAK,GAAG,CAAC;EAC3D,IAAI,YACA,OAAO;GACH;GACA,MAAM,SAAS,MAAM,MAAM;EAC/B;CAER;AAEJ"}

package/dist/collections/auth-secrets.es.js

@@ -0,0 +1,47 @@
+import { defaultUsersCollection } from "./default-collections.es.js";
+//#region src/collections/auth-secrets.ts
+/** Is this collection the one the auth subsystem stores users in? */
+function isAuthCollection(collection) {
+	const auth = collection.auth;
+	if (auth === true) return true;
+	return typeof auth === "object" && auth !== null && "enabled" in auth && auth.enabled === true;
+}
+/**
+* The column names, and property keys, the default users collection marks
+* `excludeFromApi`.
+*
+* Both spellings, because a redeclaration is free to rename the property: one
+* project's copy says `password_hash` where the default says `passwordHash`, and
+* the column is the same either way. Read off {@link defaultUsersCollection}, so
+* a secret added there is covered on the same commit.
+*/
+function defaultSecretNames() {
+	const properties = defaultUsersCollection.properties;
+	const names = /* @__PURE__ */ new Set();
+	for (const [key, property] of Object.entries(properties)) {
+		if (!property?.excludeFromApi) continue;
+		names.add(key);
+		if (property.columnName) names.add(property.columnName);
+	}
+	return names;
+}
+/**
+* The keys of the properties on `collection` that hold an auth secret and do not
+* carry `excludeFromApi`. Empty for any collection that is not the user store: a
+* `password_hash` column elsewhere — a CRM importing hashes, say — is that
+* project's data, not this rule's business.
+*/
+function authSecretsMissingExclusion(collection) {
+	if (!collection.properties || !isAuthCollection(collection)) return [];
+	const secrets = defaultSecretNames();
+	const missing = [];
+	for (const [key, property] of Object.entries(collection.properties)) {
+		if (!property || property.excludeFromApi) continue;
+		if (secrets.has(key) || secrets.has(property.columnName ?? key)) missing.push(key);
+	}
+	return missing;
+}
+//#endregion
+export { authSecretsMissingExclusion };
+
+//# sourceMappingURL=auth-secrets.es.js.map