@rebasepro/common 0.6.1 → 0.8.0

package/dist/index.es.js

@@ -1,4 +1,4 @@
-import { EntityReference, EntityRelation, getDataSourceCapabilities } from "@rebasepro/types";
+import { CANONICAL_TO_REST, DEFAULT_DATA_SOURCE_KEY, EntityReference, EntityRelation, REST_TO_CANONICAL, getDataSourceCapabilities, getDeclaredSubcollections, policy, toCanonicalOp } from "@rebasepro/types";
 import { deepClone, generateForeignKeyName, getIn, isDefaultFieldConfigId, mergeDeep, randomString, removeFunctions, toSnakeCase } from "@rebasepro/utils";
 import jsonLogic from "json-logic-js";
 import { deepEqual } from "fast-equals";
@@ -336,7 +336,7 @@ function sanitizeRelation(relation, sourceCollection, resolveCollection) {
 			if (!newRelation.foreignKeyOnTarget) {
 				let foundForeignKey = false;
 				try {
-					const targetRelations = getDataSourceCapabilities(targetCollection.driver).supportsRelations ? targetCollection.relations || [] : [];
+					const targetRelations = getDataSourceCapabilities(targetCollection.engine).supportsRelations ? targetCollection.relations || [] : [];
 					for (const targetRel of targetRelations) if (targetRel.direction === "owning" && targetRel.cardinality === "one" && targetRel.localKey) try {
 						if (targetRel.target().slug === sourceCollection.slug) {
 							newRelation.foreignKeyOnTarget = targetRel.localKey;
@@ -352,7 +352,7 @@ function sanitizeRelation(relation, sourceCollection, resolveCollection) {
 		} else if (newRelation.cardinality === "many" && newRelation.direction === "inverse") {
 			let isManyToManyInverse = false;
 			if (newRelation.inverseRelationName && !newRelation.foreignKeyOnTarget) try {
-				const targetRelations = getDataSourceCapabilities(targetCollection.driver).supportsRelations ? targetCollection.relations || [] : [];
+				const targetRelations = getDataSourceCapabilities(targetCollection.engine).supportsRelations ? targetCollection.relations || [] : [];
 				for (const targetRel of targetRelations) if (targetRel.cardinality === "many" && (targetRel.direction === "owning" || !targetRel.direction) && targetRel.relationName === newRelation.inverseRelationName) {
 					isManyToManyInverse = true;
 					break;
@@ -387,11 +387,10 @@ var _resolvedRelationsCache = /* @__PURE__ */ new WeakMap();
 function resolveCollectionRelations(collection) {
 	const cached = _resolvedRelationsCache.get(collection);
 	if (cached) return cached;
-	if (!getDataSourceCapabilities(collection.driver).supportsRelations) return {};
-	const relCollection = collection;
+	if (!getDataSourceCapabilities(collection.engine).supportsRelations) return {};
 	const relations = {};
 	const registeredRelationNames = /* @__PURE__ */ new Set();
-	if (relCollection.relations) relCollection.relations.forEach((relation) => {
+	if (collection.relations) collection.relations.forEach((relation) => {
 		try {
 			const normalizedRelation = sanitizeRelation(relation, collection);
 			const relationKey = normalizedRelation.relationName;
@@ -438,7 +437,7 @@ function resolvePropertyRelation({ propertyKey, property, sourceCollection }) {
 	console.warn(`Unrecognized or missing relation target for property '${propertyKey}' in collection '${sourceCollection.slug}'`);
 }
 function getTableName(collection) {
-	if (getDataSourceCapabilities(collection.driver).supportsRelations) return collection.table ?? toSnakeCase(collection.slug) ?? toSnakeCase(collection.name);
+	if (getDataSourceCapabilities(collection.engine).supportsRelations) return collection.table ?? toSnakeCase(collection.slug) ?? toSnakeCase(collection.name);
 	return toSnakeCase(collection.slug) ?? toSnakeCase(collection.name);
 }
 function getTableVarName(tableName) {
@@ -643,8 +642,9 @@ function resolveEnumValues(input) {
 }
 function getSubcollections(collection) {
 	if (collection.childCollections) return collection.childCollections() ?? [];
-	if (getDataSourceCapabilities(collection.driver).supportsSubcollections && collection.subcollections) return collection.subcollections() ?? [];
-	if (getDataSourceCapabilities(collection.driver).supportsRelations) {
+	const declaredSubcollections = getDeclaredSubcollections(collection);
+	if (getDataSourceCapabilities(collection.engine).supportsSubcollections && declaredSubcollections) return declaredSubcollections() ?? [];
+	if (getDataSourceCapabilities(collection.engine).supportsRelations) {
 		const resolvedRelations = resolveCollectionRelations(collection);
 		return Object.values(resolvedRelations).filter((r) => r.cardinality === "many").map((r) => {
 			const target = r.target();
@@ -670,113 +670,339 @@ function getSubcollections(collection) {
 	return [];
 }
 //#endregion
-//#region src/util/permissions.ts
-function evaluateAST(sqlString, auth, entity) {
-	if (!entity) return true;
-	let cleanedSQL = sqlString.trim();
-	while (cleanedSQL.startsWith("(") && cleanedSQL.endsWith(")")) {
-		let openCount = 0;
-		let isEnclosing = true;
-		for (let i = 0; i < cleanedSQL.length - 1; i++) {
-			if (cleanedSQL[i] === "(") openCount++;
-			else if (cleanedSQL[i] === ")") openCount--;
-			if (openCount === 0) {
-				isEnclosing = false;
-				break;
-			}
+//#region src/util/policy/sqlToPolicy.ts
+/**
+* A tiny, regex-based SQL "parser" for security rules.
+*
+* This is NOT a full SQL parser. It is designed to handle the subset of SQL
+* commonly used in `USING` and `WITH CHECK` clauses, enough to drive the
+* optimistic client-side UI decision.
+*
+* It handles:
+* - `field = 'literal'`
+* - `field != 'literal'`
+* - `field = current_setting('app.user_id')`
+* - `A AND B`
+* - `true`
+* - `IN (...)` (as optimistic true)
+*
+* For anything it doesn't understand, it returns a `raw` expression, which
+* the evaluator treats as "unknown" (and usually optimistic true).
+*/
+function sqlToPolicy(sql) {
+	const trimmed = sql.trim();
+	if (trimmed.toLowerCase() === "true") return policy.true();
+	if (trimmed.toLowerCase() === "false") return policy.false();
+	const overlapMatch = trimmed.match(/^string_to_array\s*\(\s*auth\.roles\(\)\s*,\s*','\s*\)\s*&&\s*ARRAY\s*\[(.+)\]$/i);
+	if (overlapMatch) {
+		const roles = overlapMatch[1].split(",").map((s) => s.trim().replace(/^'|'$/g, ""));
+		return policy.rolesOverlap(roles);
+	}
+	const containMatch = trimmed.match(/^string_to_array\s*\(\s*auth\.roles\(\)\s*,\s*','\s*\)\s*@>\s*ARRAY\s*\[(.+)\]$/i);
+	if (containMatch) {
+		const roles = containMatch[1].split(",").map((s) => s.trim().replace(/^'|'$/g, ""));
+		return policy.rolesContain(roles);
+	}
+	if (trimmed.toUpperCase().includes(" OR ")) {
+		const parts = trimmed.split(/ OR /i);
+		return policy.or(...parts.map(sqlToPolicy));
+	}
+	if (trimmed.toUpperCase().includes(" AND ")) {
+		const parts = trimmed.split(/ AND /i);
+		return policy.and(...parts.map(sqlToPolicy));
+	}
+	const match = trimmed.match(/^(.+?)\s*(!?=)\s*(.+)$/);
+	if (match) {
+		const [, leftStr, op, rightStr] = match;
+		const left = parseOperand(leftStr.trim());
+		const right = parseOperand(rightStr.trim());
+		if (left && right) return policy.compare(left, op === "=" ? "eq" : "neq", right);
+	}
+	return policy.raw(sql);
+}
+function parseOperand(str) {
+	if (/current_setting\s*\(\s*'app\.user_id'\s*\)/i.test(str) || /auth\.uid\(\)/i.test(str)) return policy.authUid();
+	const stringMatch = str.match(/^'(.+)'$/);
+	if (stringMatch) return policy.literal(stringMatch[1]);
+	if (/^\w+$/.test(str)) return policy.field(str);
+	return null;
+}
+//#endregion
+//#region src/util/policy/securityRuleToConditions.ts
+/**
+* Desugars a {@link SecurityRule} — its `access`/`ownerField`/`roles` shortcuts,
+* structured `condition`/`check`, and raw `using`/`withCheck` — into a single
+* normalized {@link PolicyExpression} pair.
+*
+* **This is the linchpin against drift:** both the Postgres DDL generators and
+* the client-side evaluator consume this one function, so there is exactly one
+* definition of what a rule means. In particular, application `roles` are folded
+* into the expression here (AND'd with the base condition, matching how Postgres
+* generates the clause) rather than being handled separately by each consumer.
+*/
+function securityRuleToConditions(rule) {
+	return {
+		usingExpr: withRoles(baseUsing(rule), rule),
+		withCheckExpr: withRoles(baseWithCheck(rule), rule)
+	};
+}
+function baseUsing(rule) {
+	if (rule.condition) return rule.condition;
+	if (rule.using != null) return sqlToPolicy(rule.using);
+	if (rule.access === "public") return policy.true();
+	if (rule.ownerField) return policy.compare(policy.field(rule.ownerField), "eq", policy.authUid());
+	return null;
+}
+function baseWithCheck(rule) {
+	if (rule.check) return rule.check;
+	if (rule.withCheck != null) return sqlToPolicy(rule.withCheck);
+	return baseUsing(rule);
+}
+/**
+* AND the base condition with an application-role check, or produce a roles-only
+* condition when there is no base. Mirrors the Postgres generator so that a
+* role-scoped restrictive rule denies exactly the same set of users on both
+* sides.
+*/
+function withRoles(base, rule) {
+	if (!rule.roles || rule.roles.length === 0) return base;
+	const rolesExpr = policy.rolesOverlap(rule.roles);
+	if (rule.mode === "restrictive") return base ? policy.or(policy.not(rolesExpr), base) : policy.not(rolesExpr);
+	return base ? policy.and(base, rolesExpr) : rolesExpr;
+}
+//#endregion
+//#region src/util/policy/policyToPostgres.ts
+/**
+* Compiles a {@link PolicyExpression} to a PostgreSQL boolean SQL string,
+* suitable for a `USING (...)` / `WITH CHECK (...)` clause.
+*
+* This is one of the two consumers of the shared policy model (the other being
+* {@link evaluatePolicy}); the Postgres schema generators call it so that DDL
+* and the admin UI derive from the exact same expression.
+*/
+function policyToPostgres(expr, collection) {
+	switch (expr.kind) {
+		case "true": return "true";
+		case "false": return "false";
+		case "and": return expr.operands.length === 0 ? "true" : expr.operands.map((o) => `(${policyToPostgres(o, collection)})`).join(" AND ");
+		case "or": return expr.operands.length === 0 ? "false" : expr.operands.map((o) => `(${policyToPostgres(o, collection)})`).join(" OR ");
+		case "not":
+			if (expr.operand.kind === "authenticated") return "auth.uid() IS NULL";
+			return `NOT (${policyToPostgres(expr.operand, collection)})`;
+		case "compare": return `${operandToSql(expr.left, collection)} ${COMPARE_SQL[expr.op]} ${operandToSql(expr.right, collection)}`;
+		case "rolesOverlap": return `string_to_array(auth.roles(), ',') && ${rolesArraySql(expr.roles)}`;
+		case "rolesContain": return `string_to_array(auth.roles(), ',') @> ${rolesArraySql(expr.roles)}`;
+		case "authenticated": return "auth.uid() IS NOT NULL";
+		case "raw": return expr.sql.replace(/\{(\w+)\}/g, (_, col) => col);
+	}
+}
+var COMPARE_SQL = {
+	eq: "=",
+	neq: "!=",
+	lt: "<",
+	lte: "<=",
+	gt: ">",
+	gte: ">="
+};
+function operandToSql(operand, collection) {
+	switch (operand.kind) {
+		case "field": return resolveColumnName(operand.name, collection);
+		case "literal": return quoteLiteral(operand.value);
+		case "authUid": return "auth.uid()";
+		case "authRoles": return "string_to_array(auth.roles(), ',')";
+	}
+}
+function resolveColumnName(propName, collection) {
+	const prop = collection?.properties?.[propName];
+	if (prop && "columnName" in prop && typeof prop.columnName === "string") return prop.columnName;
+	return toSnakeCase(propName);
+}
+function quoteLiteral(value) {
+	if (value === null) return "NULL";
+	if (typeof value === "boolean") return value ? "true" : "false";
+	if (typeof value === "number") return String(value);
+	return `'${value.replace(/'/g, "''")}'`;
+}
+/** Sorted, single-quoted `ARRAY['a','b']` — matches the generators' output. */
+function rolesArraySql(roles) {
+	return `ARRAY[${[...roles].sort().map((r) => `'${r}'`).join(",")}]`;
+}
+//#endregion
+//#region src/util/policy/evaluatePolicy.ts
+/**
+* Evaluates a {@link PolicyExpression} against a user + row, using three-valued
+* (Kleene) logic so that `"unknown"` sub-results propagate soundly.
+*
+* This is the JavaScript twin of {@link policyToPostgres}: both derive from the
+* same expression, so the admin UI matches database enforcement by construction
+* for every non-raw rule.
+*/
+function evaluatePolicy(expr, ctx) {
+	switch (expr.kind) {
+		case "true": return true;
+		case "false": return false;
+		case "and": return kleeneAnd$1(expr.operands.map((o) => evaluatePolicy(o, ctx)));
+		case "or": return kleeneOr(expr.operands.map((o) => evaluatePolicy(o, ctx)));
+		case "not": return kleeneNot(evaluatePolicy(expr.operand, ctx));
+		case "compare": return evaluateCompare(expr.op, expr.left, expr.right, ctx);
+		case "rolesOverlap": {
+			const userRoles = ctx.roles ?? [];
+			return expr.roles.some((r) => r === "public" || userRoles.includes(r));
 		}
-		if (isEnclosing) cleanedSQL = cleanedSQL.substring(1, cleanedSQL.length - 1).trim();
-		else break;
-	}
-	const splitByTopLevel = (str, delimiter) => {
-		const parts = [];
-		let current = "";
-		let openCount = 0;
-		let i = 0;
-		while (i < str.length) {
-			if (str[i] === "(") openCount++;
-			else if (str[i] === ")") openCount--;
-			if (openCount === 0 && str.substring(i).toUpperCase().startsWith(delimiter)) {
-				parts.push(current);
-				current = "";
-				i += delimiter.length;
-			} else {
-				current += str[i];
-				i++;
-			}
+		case "rolesContain": {
+			const userRoles = ctx.roles ?? [];
+			return expr.roles.every((r) => r === "public" || userRoles.includes(r));
 		}
-		parts.push(current);
-		return parts;
-	};
-	const orParts = splitByTopLevel(cleanedSQL, " OR ");
-	if (orParts.length > 1) return orParts.some((part) => evaluateAST(part, auth, entity));
-	const andParts = splitByTopLevel(cleanedSQL, " AND ");
-	if (andParts.length > 1) return andParts.every((part) => evaluateAST(part, auth, entity));
-	const upperSQL = cleanedSQL.toUpperCase();
-	if (upperSQL.includes(" IN ") || upperSQL.includes(" EXISTS ")) return true;
-	const roleIntersectMatch = cleanedSQL.match(/string_to_array\s*\(\s*auth\.roles\(\)\s*,\s*','\s*\)\s*&&\s*ARRAY\[(.*?)\]/i);
-	if (roleIntersectMatch && roleIntersectMatch[1]) {
-		const requiredRoles = roleIntersectMatch[1].split(",").map((r) => r.trim().replace(/'/g, ""));
-		const userRoles = auth.user?.roles || [];
-		return requiredRoles.some((r) => userRoles.includes(r));
-	}
-	const roleContainMatch = cleanedSQL.match(/string_to_array\s*\(\s*auth\.roles\(\)\s*,\s*','\s*\)\s*@>\s*ARRAY\[(.*?)\]/i);
-	if (roleContainMatch && roleContainMatch[1]) {
-		const requiredRoles = roleContainMatch[1].split(",").map((r) => r.trim().replace(/'/g, ""));
-		const userRoles = auth.user?.roles || [];
-		return requiredRoles.every((r) => userRoles.includes(r));
-	}
-	const pattern1 = /* @__PURE__ */ new RegExp("^\\{?([a-zA-Z0-9_]+)\\}?\\s*=\\s*(?:current_setting\\s*\\(\\s*'app\\.user_id'\\s*\\)|auth\\.uid\\(\\))");
-	const pattern2 = /* @__PURE__ */ new RegExp("^(?:current_setting\\s*\\(\\s*'app\\.user_id'\\s*\\)|auth\\.uid\\(\\))\\s*=\\s*\\{?([a-zA-Z0-9_]+)\\}?");
-	const match1 = cleanedSQL.match(pattern1);
-	if (match1 && match1[1]) return entity.values[match1[1]] === auth.user?.uid;
-	const match2 = cleanedSQL.match(pattern2);
-	if (match2 && match2[1]) return entity.values[match2[1]] === auth.user?.uid;
-	const simpleEqualityMatch = cleanedSQL.match(/^\{?([\w_]+)\}?\s*(=|!=)\s*'([^']+)'$/i);
-	if (simpleEqualityMatch) {
-		const field = simpleEqualityMatch[1];
-		const operator = simpleEqualityMatch[2];
-		const value = simpleEqualityMatch[3];
-		const entityValue = entity.values[field];
-		if (operator === "=") return entityValue === value;
-		if (operator === "!=") return entityValue !== value;
+		case "authenticated": return ctx.uid != null;
+		case "raw": return "unknown";
 	}
+}
+function kleeneAnd$1(values) {
+	if (values.some((v) => v === false)) return false;
+	if (values.some((v) => v === "unknown")) return "unknown";
 	return true;
 }
-function evaluateRule(rule, auth, entity) {
-	if (rule.access === "public") return true;
-	if (rule.ownerField) {
-		if (!entity) {} else if (entity.values[rule.ownerField] !== auth.user?.uid) return false;
+function kleeneOr(values) {
+	if (values.some((v) => v === true)) return true;
+	if (values.some((v) => v === "unknown")) return "unknown";
+	return false;
+}
+function kleeneNot(value) {
+	if (value === "unknown") return "unknown";
+	return !value;
+}
+function resolveOperand(operand, ctx) {
+	switch (operand.kind) {
+		case "literal": return {
+			known: true,
+			value: operand.value
+		};
+		case "authUid": return {
+			known: true,
+			value: ctx.uid ?? null
+		};
+		case "authRoles": return {
+			known: true,
+			value: ctx.roles ?? []
+		};
+		case "field":
+			if (!ctx.entity) return { known: false };
+			return {
+				known: true,
+				value: ctx.entity.values[operand.name]
+			};
+	}
+}
+function evaluateCompare(op, left, right, ctx) {
+	const l = resolveOperand(left, ctx);
+	const r = resolveOperand(right, ctx);
+	if (!l.known || !r.known) return "unknown";
+	const a = l.value;
+	const b = r.value;
+	if (a === null || b === null) {
+		if (op === "eq") return false;
+		if (op === "neq") return true;
+		return "unknown";
+	}
+	if (op === "eq") return a === b;
+	if (op === "neq") return a !== b;
+	if (typeof a === "string" && typeof b === "string") {
+		if (op === "lt") return a < b;
+		if (op === "lte") return a <= b;
+		if (op === "gt") return a > b;
+		if (op === "gte") return a >= b;
 	}
-	if (rule.using && !evaluateAST(rule.using, auth, entity)) return false;
-	if (rule.withCheck && !evaluateAST(rule.withCheck, auth, entity)) return false;
+	if (typeof a === "number" && typeof b === "number") {
+		if (op === "lt") return a < b;
+		if (op === "lte") return a <= b;
+		if (op === "gt") return a > b;
+		if (op === "gte") return a >= b;
+	}
+	if (typeof a === "bigint" && typeof b === "bigint") {
+		if (op === "lt") return a < b;
+		if (op === "lte") return a <= b;
+		if (op === "gt") return a > b;
+		if (op === "gte") return a >= b;
+	}
+	return "unknown";
+}
+//#endregion
+//#region src/util/permissions.ts
+/** Combine clause results with AND under three-valued (Kleene) logic. */
+function kleeneAnd(values) {
+	if (values.some((v) => v === false)) return false;
+	if (values.some((v) => v === "unknown")) return "unknown";
 	return true;
 }
-function checkOperation(collection, authContext, entity, targetOperation) {
-	const securityRules = getDataSourceCapabilities(collection.driver).supportsRLS ? collection.securityRules : void 0;
+/** The operations a rule covers, mirroring the Postgres generator's resolution. */
+function ruleOperations(rule) {
+	return rule.operations && rule.operations.length > 0 ? rule.operations : [rule.operation ?? "all"];
+}
+function ruleApplies(rule, targetOperation) {
+	const ops = ruleOperations(rule);
+	return ops.includes(targetOperation) || ops.includes("all");
+}
+/**
+* Evaluate a single rule for one operation, returning a tri-state.
+*
+* A `null` clause (the rule contributes no condition for a required clause)
+* denies — matching Postgres, which emits `USING (false)` / `WITH CHECK (false)`
+* in that case. USING applies to SELECT/UPDATE/DELETE; WITH CHECK to
+* INSERT/UPDATE; both must pass for UPDATE.
+*/
+function evaluateRuleForOperation(rule, ctx, targetOperation) {
+	const { usingExpr, withCheckExpr } = securityRuleToConditions(rule);
+	const clause = (expr) => expr === null ? false : evaluatePolicy(expr, ctx);
+	const needsUsing = targetOperation !== "insert";
+	const needsWithCheck = targetOperation === "insert" || targetOperation === "update";
+	const results = [];
+	if (needsUsing) results.push(clause(usingExpr));
+	if (needsWithCheck) results.push(clause(withCheckExpr));
+	return kleeneAnd(results);
+}
+function resolveTriState(value, onUnknown) {
+	if (value === "unknown") return onUnknown === "allow";
+	return value;
+}
+/**
+* Decide whether an operation is permitted for a user on a (possibly null) row,
+* by evaluating the collection's security rules with the shared policy model —
+* the same model compiled to Postgres RLS DDL, so the decision matches database
+* enforcement for every non-raw rule.
+*
+* @param options.onUnknown how to treat rules that cannot be decided
+*   client-side (raw SQL, or row predicates with no row). Defaults to `"allow"`
+*   for optimistic UI gating; enforcement callers should pass `"deny"`.
+*/
+function checkOperation(collection, authContext, entity, targetOperation, options) {
+	const onUnknown = options?.onUnknown ?? "allow";
+	const securityRules = getDataSourceCapabilities(collection.engine).supportsRLS ? collection.securityRules : void 0;
 	if (!securityRules || securityRules.length === 0) return true;
-	const applicableRules = securityRules.filter((r) => r.operation === targetOperation || r.operation === "all" || r.operations?.includes(targetOperation) || r.operations?.includes("all"));
+	const applicableRules = securityRules.filter((r) => ruleApplies(r, targetOperation));
 	if (applicableRules.length === 0) return false;
-	const userRoles = [...authContext.user?.roles ?? [], "public"];
-	const roleApplicableRules = applicableRules.filter((rule) => {
-		if (!rule.roles || rule.roles.length === 0) return true;
-		return rule.roles.some((r) => userRoles.includes(r));
-	});
-	if (roleApplicableRules.length === 0) return false;
+	const ctx = {
+		uid: authContext.user?.uid,
+		roles: authContext.user?.roles ?? [],
+		entity
+	};
 	let grantedByPermissive = false;
 	let deniedByRestrictive = false;
-	for (const rule of roleApplicableRules) {
+	let hasPermissive = false;
+	for (const rule of applicableRules) {
 		const mode = rule.mode || "permissive";
-		const passed = evaluateRule(rule, authContext, entity);
-		if (mode === "restrictive" && !passed) {
-			deniedByRestrictive = true;
-			break;
+		const passed = resolveTriState(evaluateRuleForOperation(rule, ctx, targetOperation), onUnknown);
+		if (mode === "restrictive") {
+			if (!passed) {
+				deniedByRestrictive = true;
+				break;
+			}
+		} else {
+			hasPermissive = true;
+			if (passed) grantedByPermissive = true;
 		}
-		if (mode === "permissive" && passed) grantedByPermissive = true;
 	}
 	if (deniedByRestrictive) return false;
-	if (roleApplicableRules.some((r) => (r.mode || "permissive") === "permissive")) return grantedByPermissive;
-	else return false;
+	return hasPermissive ? grantedByPermissive : false;
 }
 function canReadCollection(collection, authContext) {
 	return checkOperation(collection, authContext, null, "select");
@@ -807,7 +1033,7 @@ function getEntityImagePreviewPropertyKey(collection) {
 	}
 	for (const key in collection.properties) {
 		const property = collection.properties[key];
-		if (property.type === "array" && property.of && !Array.isArray(property.of) && property.of.type === "string" && property.of.url === "image") return key;
+		if (property.type === "array" && property.of && !Array.isArray(property.of) && property.of.type === "string" && property.of.ui?.url === "image") return key;
 	}
 	for (const key in collection.properties) {
 		const property = collection.properties[key];
@@ -1041,6 +1267,13 @@ function buildCollection(collection) {
 	return collection;
 }
 /**
+* Implementation — delegates to the correct overload at the type level.
+* At runtime this is a plain identity function.
+*/
+function defineCollection(collection) {
+	return collection;
+}
+/**
 * Identity function we use to defeat the type system of Typescript and preserve
 * the property keys.
 * @param property
@@ -1105,6 +1338,29 @@ function buildAdditionalFieldDelegate(additionalFieldDelegate) {
 }
 //#endregion
 //#region src/util/storage.ts
+/**
+* Resolve the {@link StorageSource} to use for a property, given the key
+* referenced by `StorageConfig.storageSource`.
+*
+* Resolution priority:
+* 1. No `sourceKey` → the default source (backward compatible).
+* 2. An explicit {@link StorageSourceRegistry} (e.g. `client.storageRegistry`).
+* 3. A `sources` lookup map (e.g. the `StorageSourcesContext`).
+* 4. Fall back to the default source.
+*
+* Shared by the upload hook, the markdown editor, and the read-only previews
+* so the resolution logic lives in one place.
+*
+* @group Storage
+*/
+function resolveStorageSource(params) {
+	const { sourceKey, sources, registry, defaultSource } = params;
+	if (!sourceKey) return defaultSource;
+	if (registry) return registry.getOrDefault(sourceKey);
+	const fromSources = sources?.[sourceKey];
+	if (fromSources) return fromSources;
+	return defaultSource;
+}
 async function resolveStorageFilenameString({ input, storage, values, entityId, path, property, file, propertyKey }) {
 	let result;
 	if (typeof input === "function") {
@@ -1411,8 +1667,76 @@ function applyEnumConditions(enumValues, conditions, context) {
 	return result;
 }
 //#endregion
+//#region src/data/resolveDataSource.ts
+/**
+* Build a keyed registry from a list of {@link DataSourceDefinition}s.
+* Later entries win on key collision.
+*/
+function createDataSourceRegistry(definitions) {
+	const registry = {};
+	for (const def of definitions ?? []) registry[def.key] = def;
+	return registry;
+}
+/**
+* Resolve the effective data source for a collection — the single source of
+* truth shared by the frontend router, the backend driver registry, and the
+* editor's capability lookups.
+*
+* Resolution order:
+* 1. The routing **key** is `collection.dataSource`, else
+*    {@link DEFAULT_DATA_SOURCE_KEY}.
+* 2. If a definition is registered for that key, it provides `engine`,
+*    `transport`, and `databaseId`.
+* 3. Otherwise values are synthesized: `engine` from `collection.engine`
+*    (or the key, or `"postgres"`), `transport` defaults to `"server"`,
+*    and `databaseId` from the collection.
+*
+* `capabilities` are always derived from the resolved `engine`, so two
+* data sources sharing an engine share capabilities.
+*
+* @param collection the collection (or any object carrying the routing fields)
+* @param registry   optional registry of declared data sources
+*/
+function resolveDataSource(collection, registry) {
+	const key = collection?.dataSource ?? DEFAULT_DATA_SOURCE_KEY;
+	const def = registry?.[key];
+	const engine = def?.engine ?? collection?.engine ?? (key !== DEFAULT_DATA_SOURCE_KEY ? key : "postgres");
+	return {
+		key,
+		engine,
+		transport: def?.transport ?? "server",
+		databaseId: collection?.databaseId ?? def?.databaseId,
+		capabilities: getDataSourceCapabilities(engine)
+	};
+}
+//#endregion
 //#region src/collections/CollectionRegistry.ts
 var CollectionRegistry = class {
+	/**
+	* Declared data sources, used during normalization to resolve each
+	* collection's engine (so `dataSource`-only collections get the right
+	* capabilities). Empty by default.
+	*/
+	dataSources = {};
+	/**
+	* Global lifecycle callbacks applied to every collection.
+	* Runs on all data paths (REST, WebSocket, `rebase.data`).
+	* Execution order: global → collection → property callbacks.
+	*/
+	_globalCallbacks;
+	/**
+	* Set global lifecycle callbacks that apply to every collection.
+	* Typically called once during backend initialization.
+	*/
+	setGlobalCallbacks(callbacks) {
+		this._globalCallbacks = callbacks;
+	}
+	/**
+	* Get the currently registered global callbacks, if any.
+	*/
+	getGlobalCallbacks() {
+		return this._globalCallbacks;
+	}
 	collectionsByTableName = /* @__PURE__ */ new Map();
 	collectionsBySlug = /* @__PURE__ */ new Map();
 	rootCollections = [];
@@ -1422,9 +1746,20 @@ var CollectionRegistry = class {
 	rawRootCollections = [];
 	cachedRawCollectionsList = null;
 	lastRawInputSnapshot = null;
-	constructor(collections) {
+	constructor(collections, dataSources) {
+		if (dataSources) this.dataSources = dataSources;
 		if (collections) this.registerMultiple(collections);
 	}
+	/**
+	* Provide the declared data sources used to resolve each collection's
+	* engine during normalization. Set this before registering collections.
+	* Returns true if the registry changed (callers may re-register).
+	*/
+	setDataSources(dataSources) {
+		if (deepEqual(this.dataSources, dataSources)) return false;
+		this.dataSources = dataSources ?? {};
+		return true;
+	}
 	reset() {
 		this.collectionsByTableName.clear();
 		this.collectionsBySlug.clear();
@@ -1493,9 +1828,14 @@ var CollectionRegistry = class {
 	}
 	normalizeCollection(collection) {
 		const result = { ...collection };
+		{
+			const resolved = resolveDataSource(result, this.dataSources);
+			if (!result.dataSource) result.dataSource = resolved.key;
+			if (!result.engine) result.engine = resolved.engine;
+		}
 		const extractedRelations = this.extractRelationsFromProperties(result.properties);
 		const relResult = result;
-		const manualRelations = getDataSourceCapabilities(result.driver).supportsRelations ? relResult.relations ?? [] : [];
+		const manualRelations = getDataSourceCapabilities(result.engine).supportsRelations ? relResult.relations ?? [] : [];
 		const mergedRelationsRaw = [...extractedRelations];
 		for (const manual of manualRelations) {
 			const name = manual.relationName;
@@ -1510,7 +1850,7 @@ var CollectionRegistry = class {
 			}
 		}
 		let mergedRelations = mergedRelationsRaw;
-		if (getDataSourceCapabilities(result.driver).supportsRelations) {
+		if (getDataSourceCapabilities(result.engine).supportsRelations) {
 			mergedRelations = mergedRelationsRaw.map((r) => {
 				try {
 					return sanitizeRelation(r, result, (slug) => this.get(slug));
@@ -1522,8 +1862,10 @@ var CollectionRegistry = class {
 		}
 		result.properties = this.normalizeProperties(result.properties, mergedRelations);
 		if (!result.childCollections) {
-			if (getDataSourceCapabilities(result.driver).supportsSubcollections && result.subcollections) result.childCollections = result.subcollections;
-			else if (getDataSourceCapabilities(result.driver).supportsRelations && relResult.relations) {
+			const capabilities = getDataSourceCapabilities(result.engine);
+			const declaredSubcollections = getDeclaredSubcollections(result);
+			if (capabilities.supportsSubcollections && declaredSubcollections) result.childCollections = declaredSubcollections;
+			else if (capabilities.supportsRelations && relResult.relations) {
 				const manyRelations = relResult.relations.filter((r) => r.cardinality === "many");
 				if (manyRelations.length > 0) result.childCollections = () => manyRelations.map((r) => {
 					const target = r.target();
@@ -1625,7 +1967,7 @@ var CollectionRegistry = class {
 		if (!currentCollection) throw new Error(`Root collection not found: ${rootCollectionPath}`);
 		for (let i = 2; i < pathSegments.length; i += 2) {
 			const relationKey = pathSegments[i];
-			if (!getDataSourceCapabilities(currentCollection.driver).supportsRelations) throw new Error(`Relation path navigation requires a collection that supports relations, but '${currentCollection.slug}' uses driver '${currentCollection.driver}'`);
+			if (!getDataSourceCapabilities(currentCollection.engine).supportsRelations) throw new Error(`Relation path navigation requires a collection that supports relations, but '${currentCollection.slug}' uses engine '${currentCollection.engine}'`);
 			const relation = findRelation(resolveCollectionRelations(currentCollection), relationKey);
 			if (!relation) throw new Error(`Relation '${relationKey}' not found in collection '${currentCollection.slug}'`);
 			const target = relation.target();
@@ -1686,7 +2028,7 @@ var CollectionRegistry = class {
 * Slug-based dedup (Map keyed by slug, last-write-wins) lets developers
 * override by defining their own collection with `slug: "users"`.
 */
-var defaultUsersCollection = {
+var defaultUsersCollection = defineCollection({
 	name: "Users",
 	singularName: "User",
 	slug: "users",
@@ -1734,7 +2076,7 @@ var defaultUsersCollection = {
 			name: "Photo URL",
 			type: "string",
 			columnName: "photo_url",
-			url: "image"
+			ui: { url: "image" }
 		},
 		roles: {
 			name: "Roles",
@@ -1829,7 +2171,7 @@ var defaultUsersCollection = {
 		"roles",
 		"createdAt"
 	]
-};
+});
 //#endregion
 //#region src/data/query_builder.ts
 function or(...conditions) {
@@ -1881,8 +2223,8 @@ var QueryBuilder = class {
 	* @example
 	* client.collection('users').orderBy('createdAt', 'desc').find()
 	*/
-	orderBy(column, ascending = "asc") {
-		this.params.orderBy = `${column}:${ascending}`;
+	orderBy(column, direction = "asc") {
+		this.params.orderBy = `${column}:${direction}`;
 		return this;
 	}
 	/**
@@ -1937,80 +2279,216 @@ var QueryBuilder = class {
 	}
 };
 //#endregion
-//#region src/data/buildRebaseData.ts
+//#region src/data/filter-dialect.ts
 /**
-* Convert where-clause filter object to the internal DataDriver FilterValues format.
+* REST wire-format adapter for the unified filter system.
 *
-* Supports multiple value formats:
-* - PostgREST string: { status: "eq.published", age: "gte.18" }
-* - Equality shorthand: { company_profile_id: null, status: "active", age: 18 }
-* - Tuple syntax: { age: [">=", 18], role: ["in", ["admin", "editor"]] }
+* This module is the ONLY code in the entire codebase that knows about
+* PostgREST-style dot-syntax strings (`eq.active`, `gt.18`, `in.(a,b)`).
+* Everything else speaks `FilterValues` exclusively.
 *
-* Internal:  { status: ["==", "published"], age: [">=", 18] }
+* @module
 */
-function convertWhereToFilter(where) {
-	if (!where) return void 0;
-	const operatorMap = {
-		"eq": "==",
-		"neq": "!=",
-		"gt": ">",
-		"gte": ">=",
-		"lt": "<",
-		"lte": "<=",
-		"in": "in",
-		"nin": "not-in",
-		"not-in": "not-in",
-		"cs": "array-contains",
-		"csa": "array-contains-any",
-		"==": "==",
-		"!=": "!=",
-		">": ">",
-		">=": ">=",
-		"<": "<",
-		"<=": "<=",
-		"array-contains": "array-contains",
-		"array-contains-any": "array-contains-any"
-	};
-	const filter = {};
-	for (const [field, rawValue] of Object.entries(where)) {
-		if (rawValue === null) {
-			filter[field] = ["==", null];
-			continue;
-		}
-		if (typeof rawValue === "boolean") {
-			filter[field] = ["==", rawValue];
-			continue;
-		}
-		if (typeof rawValue === "number") {
-			filter[field] = ["==", rawValue];
-			continue;
+/**
+* Coerce a raw querystring value to its natural JS type.
+* - `"true"` / `"false"` → boolean
+* - `"null"` → null
+* - Numeric strings → number
+* - Everything else → string (unchanged)
+*/
+function coerceValue(raw) {
+	if (raw === "true") return true;
+	if (raw === "false") return false;
+	if (raw === "null") return null;
+	if (raw !== "" && !isNaN(Number(raw))) return Number(raw);
+	return raw;
+}
+/**
+* Serialize a JS value to its querystring representation.
+*/
+function stringifyValue(value) {
+	if (value === null) return "null";
+	if (typeof value === "boolean") return String(value);
+	return String(value);
+}
+/**
+* Serialize a single condition tuple to a PostgREST dot-string.
+*
+* @example
+* serializeTuple(["==", "active"])           // "eq.active"
+* serializeTuple(["in", ["admin","editor"]]) // "in.(admin,editor)"
+* serializeTuple([">=", 18])                 // "gte.18"
+*/
+function serializeTuple(tuple) {
+	if (typeof tuple === "string") {
+		if (tuple.includes(".")) {
+			const dotIndex = tuple.indexOf(".");
+			if (REST_TO_CANONICAL[tuple.substring(0, dotIndex)]) return tuple;
 		}
-		if (Array.isArray(rawValue)) {
-			const mappedConditions = (Array.isArray(rawValue[0]) ? rawValue : [rawValue]).map(([rawOp, val]) => {
-				return [operatorMap[rawOp] ?? "==", val];
-			});
-			filter[field] = Array.isArray(rawValue[0]) ? mappedConditions : mappedConditions[0];
+		return tuple;
+	}
+	if (!Array.isArray(tuple) || tuple.length !== 2 || typeof tuple[0] !== "string" || !CANONICAL_TO_REST[tuple[0]]) return `eq.${stringifyValue(tuple)}`;
+	const [op, value] = tuple;
+	const restOp = CANONICAL_TO_REST[op];
+	if (Array.isArray(value)) return `${restOp}.(${value.map(stringifyValue).join(",")})`;
+	return `${restOp}.${stringifyValue(value)}`;
+}
+/**
+* Convert `FilterValues` to a PostgREST-style querystring record.
+*
+* - Single conditions produce a string value.
+* - Multiple conditions on the same field produce a string array (repeated params).
+*
+* @example
+* serializeFilter({ status: ["==", "active"] })
+* // → { status: "eq.active" }
+*
+* serializeFilter({ age: [[">=", 18], ["<", 65]] })
+* // → { age: ["gte.18", "lt.65"] }
+*/
+function serializeFilter(filter) {
+	const result = {};
+	for (const [field, condition] of Object.entries(filter)) {
+		if (condition === void 0) continue;
+		if (Array.isArray(condition) && condition.length > 0 && Array.isArray(condition[0])) result[field] = condition.map(serializeTuple);
+		else result[field] = serializeTuple(condition);
+	}
+	return result;
+}
+/**
+* Parse a single PostgREST dot-string into a `[WhereFilterOp, unknown]` tuple.
+*
+* If the string doesn't match a known operator prefix, falls back to
+* `["==", originalString]` (treating the whole string as an equality value).
+*/
+function deserializeSingle(raw) {
+	const dotIndex = raw.indexOf(".");
+	if (dotIndex === -1) return ["==", coerceValue(raw)];
+	const prefix = raw.substring(0, dotIndex);
+	const rest = raw.substring(dotIndex + 1);
+	const canonicalOp = REST_TO_CANONICAL[prefix];
+	if (!canonicalOp) return ["==", raw];
+	if (rest.startsWith("(") && rest.endsWith(")")) return [canonicalOp, rest.slice(1, -1).split(",").map((s) => coerceValue(s.trim()))];
+	return [canonicalOp, coerceValue(rest)];
+}
+/**
+* Convert a PostgREST-style querystring record to `FilterValues`.
+*
+* - String values are parsed as single conditions.
+* - String arrays (repeated query params) become multiple conditions on the same field.
+*
+* @example
+* deserializeFilter({ status: "eq.active" })
+* // → { status: ["==", "active"] }
+*
+* deserializeFilter({ age: ["gte.18", "lt.65"] })
+* // → { age: [[">=", 18], ["<", 65]] }
+*/
+function deserializeFilter(query) {
+	const result = {};
+	for (const [field, raw] of Object.entries(query)) {
+		if (raw === void 0) continue;
+		if (Array.isArray(raw) && raw.length === 2 && typeof raw[0] === "string" && toCanonicalOp(raw[0]) === raw[0]) {
+			result[field] = raw;
 			continue;
 		}
-		if (typeof rawValue === "string") {
-			const dotIndex = rawValue.indexOf(".");
-			if (dotIndex === -1) {
-				filter[field] = ["==", rawValue];
+		if (Array.isArray(raw)) {
+			if (raw.length === 0) continue;
+			if (Array.isArray(raw[0]) && raw[0].length === 2 && typeof raw[0][0] === "string" && toCanonicalOp(raw[0][0]) === raw[0][0]) {
+				result[field] = raw;
 				continue;
 			}
-			const op = rawValue.substring(0, dotIndex);
-			let value = rawValue.substring(dotIndex + 1);
-			if (typeof value === "string" && value.startsWith("(") && value.endsWith(")")) value = value.slice(1, -1).split(",").map((v) => v.trim());
-			if (value === "null") value = null;
-			else if (value === "true") value = true;
-			else if (value === "false") value = false;
-			else if (typeof value === "string" && !isNaN(Number(value)) && value.trim() !== "") value = Number(value);
-			const mappedOp = operatorMap[op];
-			if (mappedOp) filter[field] = [mappedOp, value];
+			if (raw.length === 1) result[field] = typeof raw[0] === "string" ? deserializeSingle(raw[0]) : ["==", raw[0]];
+			else if (typeof raw[0] === "string" && raw[0].includes(".")) result[field] = raw.map((r) => typeof r === "string" ? deserializeSingle(r) : ["==", r]);
+			else result[field] = ["in", raw];
+		} else if (typeof raw === "string") result[field] = deserializeSingle(raw);
+		else result[field] = ["==", raw];
+	}
+	return result;
+}
+/**
+* Serialize a `LogicalCondition` or `FilterCondition` to its wire-format string.
+*
+* @example
+* serializeLogicalCondition({ column: "status", operator: "==", value: "active" })
+* // → "status.eq.active"
+*
+* serializeLogicalCondition({ type: "or", conditions: [...] })
+* // → "or(status.eq.active,status.eq.pending)"
+*/
+function serializeLogicalCondition(cond) {
+	if ("type" in cond) {
+		const inner = (cond.conditions ?? []).map(serializeLogicalCondition).join(",");
+		return `${cond.type}(${inner})`;
+	}
+	const restOp = CANONICAL_TO_REST[cond.operator] || "eq";
+	if (Array.isArray(cond.value)) {
+		const items = cond.value.map(stringifyValue).join(",");
+		return `${cond.column}.${restOp}.(${items})`;
+	}
+	return `${cond.column}.${restOp}.${stringifyValue(cond.value)}`;
+}
+/**
+* Parse a logical condition wire-format string back into a
+* `LogicalCondition` or `FilterCondition`.
+*
+* @example
+* deserializeLogicalCondition("status.eq.active")
+* // → { column: "status", operator: "==", value: "active" }
+*
+* deserializeLogicalCondition("or(status.eq.active,age.gte.18)")
+* // → { type: "or", conditions: [...] }
+*/
+function deserializeLogicalCondition(str) {
+	const logicalMatch = str.match(/^(and|or)\((.+)\)$/);
+	if (logicalMatch) {
+		const type = logicalMatch[1];
+		const innerStr = logicalMatch[2];
+		const conditions = [];
+		let depth = 0;
+		let start = 0;
+		for (let i = 0; i < innerStr.length; i++) if (innerStr[i] === "(") depth++;
+		else if (innerStr[i] === ")") depth--;
+		else if (innerStr[i] === "," && depth === 0) {
+			conditions.push(deserializeLogicalCondition(innerStr.slice(start, i)));
+			start = i + 1;
 		}
+		conditions.push(deserializeLogicalCondition(innerStr.slice(start)));
+		return {
+			type,
+			conditions
+		};
 	}
-	return Object.keys(filter).length > 0 ? filter : void 0;
+	const firstDot = str.indexOf(".");
+	if (firstDot === -1) return {
+		column: str,
+		operator: "==",
+		value: true
+	};
+	const column = str.substring(0, firstDot);
+	const rest = str.substring(firstDot + 1);
+	const secondDot = rest.indexOf(".");
+	if (secondDot === -1) return {
+		column,
+		operator: "==",
+		value: coerceValue(rest)
+	};
+	const opStr = rest.substring(0, secondDot);
+	let valueStr = rest.substring(secondDot + 1);
+	const operator = toCanonicalOp(opStr) ?? "==";
+	if (valueStr.startsWith("(") && valueStr.endsWith(")")) return {
+		column,
+		operator,
+		value: valueStr.slice(1, -1).split(",").map((s) => coerceValue(s.trim()))
+	};
+	return {
+		column,
+		operator,
+		value: coerceValue(valueStr)
+	};
 }
+//#endregion
+//#region src/data/buildRebaseData.ts
 /**
 * Parse an orderBy string like "created_at:desc" into [field, direction].
 */
@@ -2023,11 +2501,12 @@ function createDriverAccessor(driver, slug) {
 	const accessor = {
 		async find(params) {
 			const orderParsed = parseOrderBy(params?.orderBy);
+			const filter = params?.where ? deserializeFilter(params.where) : void 0;
 			const entities = await driver.fetchCollection({
 				path: slug,
 				limit: params?.limit,
 				offset: params?.offset,
-				filter: convertWhereToFilter(params?.where),
+				filter,
 				orderBy: orderParsed?.[0],
 				order: orderParsed?.[1],
 				searchString: params?.searchString
@@ -2077,9 +2556,10 @@ function createDriverAccessor(driver, slug) {
 			return driver.deleteAll(slug);
 		} : void 0,
 		count: driver.countEntities ? async (params) => {
+			const filter = params?.where ? deserializeFilter(params.where) : void 0;
 			return driver.countEntities({
 				path: slug,
-				filter: convertWhereToFilter(params?.where)
+				filter
 			});
 		} : void 0,
 		listen: driver.listenCollection ? (params, onUpdate, onError) => {
@@ -2090,7 +2570,7 @@ function createDriverAccessor(driver, slug) {
 				path: slug,
 				limit: params?.limit,
 				offset: params?.offset,
-				filter: convertWhereToFilter(params?.where),
+				filter: params?.where,
 				orderBy: orderParsed?.[0],
 				order: orderParsed?.[1],
 				searchString: params?.searchString,
@@ -2169,6 +2649,125 @@ function buildRebaseData(driver) {
 	} });
 }
 //#endregion
-export { COLLECTION_PATH_SEPARATOR, CollectionRegistry, DEFAULT_ONE_OF_TYPE, DEFAULT_ONE_OF_VALUE, QueryBuilder, addInitialSlash, and, applyPropertyConditions, buildAdditionalFieldDelegate, buildCollection, buildConditionContext, buildEntityCallbacks, buildEnum, buildEnumValueConfig, buildProperties, buildPropertiesOrBuilder, buildProperty, buildPropertyCallbacks, buildRebaseData, canCreateEntity, canDeleteEntity, canEditEntity, canReadCollection, checkOperation, cond, createRelationRef, createRelationRefWithData, defaultUsersCollection, enumToObjectEntries, evaluateCondition, findRelation, fullPathToCollectionSegments, getArrayResolvedProperties, getCollectionBySlugWithin, getCollectionPathsCombinations, getColumnName, getDefaultValueFor, getDefaultValueFortype, getDefaultValuesFor, getEntityImagePreviewPropertyKey, getEnumVarName, getLabelOrConfigFrom, getLastSegment, getLocalChangesBackup, getNavigationEntriesFromPath, getParentReferencesFromPath, getPrimaryKeys, getReferenceFrom, getRelationFrom, getSubcollections, getTableName, getTableVarName, isHidden, isPropertyBuilder, isReadOnly, normalizeToEntityRelation, or, registerConditionOperations, removeInitialAndTrailingSlashes, removeInitialSlash, removeTrailingSlash, resolveArrayProperties, resolveCollectionPathIds, resolveCollectionRelations, resolveDefaultSelectedView, resolveEnumValues, resolveProperties, resolveProperty, resolvePropertyEnum, resolvePropertyRelation, resolveRelationProperty, resolveStorageFilenameString, resolveStoragePathString, sanitizeData, sanitizeRelation, segmentsToStrippedPath, sortProperties, stripCollectionPath, traverseValueProperty, traverseValuesProperties, updateDateAutoValues };
+//#region src/data/buildRoutedRebaseData.ts
+/**
+* Build a {@link RebaseData} that routes each collection to the right
+* backend based on its resolved data source.
+*
+* `.collection(path)` (and dynamic `data.products`-style access) resolves the
+* collection's data-source key via `resolveKey` and delegates to the matching
+* entry in `sources`, falling back to `defaultData` when there is no match.
+* Because routing keys off the *path being accessed*, a reference widget
+* inside a Firestore form that points at a Postgres collection is still
+* served by Postgres — routing follows the target, not the ancestor.
+*
+* When `sources` is empty this returns `defaultData` untouched, so the
+* single-driver setup keeps identical behaviour and identity (important for
+* effect dependencies that key off the data instance).
+*
+* @example
+* const data = buildRoutedRebaseData({
+*     defaultData: client.data,
+*     sources: { analytics: buildRebaseData(firestoreDriver) },
+*     resolveKey: (path) => resolveDataSource(registry.getCollection(path), defs).key
+* });
+* await data.products.find();        // → default (server / Postgres)
+* await data.events.find();          // → Firestore, if `events.dataSource === "analytics"`
+*/
+function buildRoutedRebaseData({ defaultData, sources, resolveKey }) {
+	if (!sources || Object.keys(sources).length === 0) return defaultData;
+	function resolve(slugOrPath) {
+		const key = resolveKey(slugOrPath);
+		if (key && sources[key]) return sources[key];
+		return defaultData;
+	}
+	function getAccessor(slugOrPath) {
+		return resolve(slugOrPath).collection(slugOrPath);
+	}
+	return new Proxy({ collection: getAccessor }, { get(_target, prop) {
+		if (prop === "collection") return getAccessor;
+		if (typeof prop === "symbol") return void 0;
+		if (prop === "then" || prop === "toJSON" || prop === "$$typeof") return void 0;
+		return getAccessor(toSnakeCase(prop));
+	} });
+}
+//#endregion
+//#region src/table-classification.ts
+/** Schemas that are always considered Rebase-internal. */
+var REBASE_INTERNAL_SCHEMAS = ["rebase", "auth"];
+/** Table-name prefixes that mark a table as Rebase-internal regardless of schema. */
+var REBASE_INTERNAL_PREFIXES = [
+	"_rebase_",
+	"_auth_",
+	"drizzle_"
+];
+/**
+* Synchronously classify a table based on naming conventions.
+*
+* @param tableName  - The unqualified name of the table.
+* @param schemaName - The schema the table belongs to (e.g. `"public"`, `"rebase"`).
+* @returns `"rebase-internal"` when the table belongs to a reserved schema or
+*          carries a reserved prefix; `"user"` otherwise.
+*
+* @remarks
+* Junction-table detection requires an async database query and is therefore
+* **not** handled by this function. Use {@link detectJunctionTables} to obtain
+* the set of junction tables, then reclassify as needed.
+*/
+function classifyTable(tableName, schemaName) {
+	if (REBASE_INTERNAL_SCHEMAS.includes(schemaName) || REBASE_INTERNAL_PREFIXES.some((prefix) => tableName.startsWith(prefix))) return "rebase-internal";
+	return "user";
+}
+/**
+* Convenience predicate that checks whether a table is Rebase-internal.
+*
+* @param tableName  - The unqualified name of the table.
+* @param schemaName - The schema the table belongs to.
+* @returns `true` if the table is classified as `"rebase-internal"`.
+*/
+function isRebaseInternalTable(tableName, schemaName) {
+	return classifyTable(tableName, schemaName) === "rebase-internal";
+}
+/** SQL query that detects junction tables in the `public` schema. */
+var JUNCTION_TABLES_SQL = `
+  SELECT t.table_name
+  FROM information_schema.tables t
+  WHERE t.table_schema = 'public'
+    AND t.table_type = 'BASE TABLE'
+    AND NOT EXISTS (
+      SELECT 1
+      FROM information_schema.columns c
+      WHERE c.table_schema = t.table_schema
+        AND c.table_name = t.table_name
+        AND c.column_name NOT IN (
+          SELECT kcu.column_name
+          FROM information_schema.key_column_usage kcu
+          JOIN information_schema.table_constraints tc
+            ON tc.constraint_name = kcu.constraint_name
+            AND tc.table_schema = kcu.table_schema
+          WHERE tc.constraint_type = 'FOREIGN KEY'
+            AND kcu.table_schema = t.table_schema
+            AND kcu.table_name = t.table_name
+        )
+    )
+`;
+/**
+* Asynchronously detect junction (link) tables in the `public` schema.
+*
+* A junction table is defined as a table where **every** column participates in
+* at least one foreign-key constraint.
+*
+* @param executeSql - A callback that executes a raw SQL string and returns the
+*                     resulting rows.
+* @returns A `Set` containing the names of all detected junction tables.
+*/
+async function detectJunctionTables(executeSql) {
+	const rows = await executeSql(JUNCTION_TABLES_SQL);
+	const junctionTables = /* @__PURE__ */ new Set();
+	for (const row of rows) if (typeof row.table_name === "string") junctionTables.add(row.table_name);
+	return junctionTables;
+}
+//#endregion
+export { COLLECTION_PATH_SEPARATOR, CollectionRegistry, DEFAULT_ONE_OF_TYPE, DEFAULT_ONE_OF_VALUE, JUNCTION_TABLES_SQL, QueryBuilder, REBASE_INTERNAL_PREFIXES, REBASE_INTERNAL_SCHEMAS, addInitialSlash, and, applyPropertyConditions, buildAdditionalFieldDelegate, buildCollection, buildConditionContext, buildEntityCallbacks, buildEnum, buildEnumValueConfig, buildProperties, buildPropertiesOrBuilder, buildProperty, buildPropertyCallbacks, buildRebaseData, buildRoutedRebaseData, canCreateEntity, canDeleteEntity, canEditEntity, canReadCollection, checkOperation, classifyTable, cond, createDataSourceRegistry, createRelationRef, createRelationRefWithData, defaultUsersCollection, defineCollection, deserializeFilter, deserializeLogicalCondition, detectJunctionTables, enumToObjectEntries, evaluateCondition, evaluatePolicy, findRelation, fullPathToCollectionSegments, getArrayResolvedProperties, getCollectionBySlugWithin, getCollectionPathsCombinations, getColumnName, getDefaultValueFor, getDefaultValueFortype, getDefaultValuesFor, getEntityImagePreviewPropertyKey, getEnumVarName, getLabelOrConfigFrom, getLastSegment, getLocalChangesBackup, getNavigationEntriesFromPath, getParentReferencesFromPath, getPrimaryKeys, getReferenceFrom, getRelationFrom, getSubcollections, getTableName, getTableVarName, isHidden, isPropertyBuilder, isReadOnly, isRebaseInternalTable, normalizeToEntityRelation, or, policyToPostgres, registerConditionOperations, removeInitialAndTrailingSlashes, removeInitialSlash, removeTrailingSlash, resolveArrayProperties, resolveCollectionPathIds, resolveCollectionRelations, resolveDataSource, resolveDefaultSelectedView, resolveEnumValues, resolveProperties, resolveProperty, resolvePropertyEnum, resolvePropertyRelation, resolveRelationProperty, resolveStorageFilenameString, resolveStoragePathString, resolveStorageSource, sanitizeData, sanitizeRelation, securityRuleToConditions, segmentsToStrippedPath, serializeFilter, serializeLogicalCondition, sortProperties, stripCollectionPath, traverseValueProperty, traverseValuesProperties, updateDateAutoValues };
 
 //# sourceMappingURL=index.es.js.map