@rebasepro/common 0.6.1 → 0.8.0

package/dist/index.umd.js

@@ -365,7 +365,7 @@
 				if (!newRelation.foreignKeyOnTarget) {
 					let foundForeignKey = false;
 					try {
-						const targetRelations = (0, _rebasepro_types.getDataSourceCapabilities)(targetCollection.driver).supportsRelations ? targetCollection.relations || [] : [];
+						const targetRelations = (0, _rebasepro_types.getDataSourceCapabilities)(targetCollection.engine).supportsRelations ? targetCollection.relations || [] : [];
 						for (const targetRel of targetRelations) if (targetRel.direction === "owning" && targetRel.cardinality === "one" && targetRel.localKey) try {
 							if (targetRel.target().slug === sourceCollection.slug) {
 								newRelation.foreignKeyOnTarget = targetRel.localKey;
@@ -381,7 +381,7 @@
 			} else if (newRelation.cardinality === "many" && newRelation.direction === "inverse") {
 				let isManyToManyInverse = false;
 				if (newRelation.inverseRelationName && !newRelation.foreignKeyOnTarget) try {
-					const targetRelations = (0, _rebasepro_types.getDataSourceCapabilities)(targetCollection.driver).supportsRelations ? targetCollection.relations || [] : [];
+					const targetRelations = (0, _rebasepro_types.getDataSourceCapabilities)(targetCollection.engine).supportsRelations ? targetCollection.relations || [] : [];
 					for (const targetRel of targetRelations) if (targetRel.cardinality === "many" && (targetRel.direction === "owning" || !targetRel.direction) && targetRel.relationName === newRelation.inverseRelationName) {
 						isManyToManyInverse = true;
 						break;
@@ -416,11 +416,10 @@
 	function resolveCollectionRelations(collection) {
 		const cached = _resolvedRelationsCache.get(collection);
 		if (cached) return cached;
-		if (!(0, _rebasepro_types.getDataSourceCapabilities)(collection.driver).supportsRelations) return {};
-		const relCollection = collection;
+		if (!(0, _rebasepro_types.getDataSourceCapabilities)(collection.engine).supportsRelations) return {};
 		const relations = {};
 		const registeredRelationNames = /* @__PURE__ */ new Set();
-		if (relCollection.relations) relCollection.relations.forEach((relation) => {
+		if (collection.relations) collection.relations.forEach((relation) => {
 			try {
 				const normalizedRelation = sanitizeRelation(relation, collection);
 				const relationKey = normalizedRelation.relationName;
@@ -467,7 +466,7 @@
 		console.warn(`Unrecognized or missing relation target for property '${propertyKey}' in collection '${sourceCollection.slug}'`);
 	}
 	function getTableName(collection) {
-		if ((0, _rebasepro_types.getDataSourceCapabilities)(collection.driver).supportsRelations) return collection.table ?? (0, _rebasepro_utils.toSnakeCase)(collection.slug) ?? (0, _rebasepro_utils.toSnakeCase)(collection.name);
+		if ((0, _rebasepro_types.getDataSourceCapabilities)(collection.engine).supportsRelations) return collection.table ?? (0, _rebasepro_utils.toSnakeCase)(collection.slug) ?? (0, _rebasepro_utils.toSnakeCase)(collection.name);
 		return (0, _rebasepro_utils.toSnakeCase)(collection.slug) ?? (0, _rebasepro_utils.toSnakeCase)(collection.name);
 	}
 	function getTableVarName(tableName) {
@@ -672,8 +671,9 @@
 	}
 	function getSubcollections(collection) {
 		if (collection.childCollections) return collection.childCollections() ?? [];
-		if ((0, _rebasepro_types.getDataSourceCapabilities)(collection.driver).supportsSubcollections && collection.subcollections) return collection.subcollections() ?? [];
-		if ((0, _rebasepro_types.getDataSourceCapabilities)(collection.driver).supportsRelations) {
+		const declaredSubcollections = (0, _rebasepro_types.getDeclaredSubcollections)(collection);
+		if ((0, _rebasepro_types.getDataSourceCapabilities)(collection.engine).supportsSubcollections && declaredSubcollections) return declaredSubcollections() ?? [];
+		if ((0, _rebasepro_types.getDataSourceCapabilities)(collection.engine).supportsRelations) {
 			const resolvedRelations = resolveCollectionRelations(collection);
 			return Object.values(resolvedRelations).filter((r) => r.cardinality === "many").map((r) => {
 				const target = r.target();
@@ -699,113 +699,339 @@
 		return [];
 	}
 	//#endregion
-	//#region src/util/permissions.ts
-	function evaluateAST(sqlString, auth, entity) {
-		if (!entity) return true;
-		let cleanedSQL = sqlString.trim();
-		while (cleanedSQL.startsWith("(") && cleanedSQL.endsWith(")")) {
-			let openCount = 0;
-			let isEnclosing = true;
-			for (let i = 0; i < cleanedSQL.length - 1; i++) {
-				if (cleanedSQL[i] === "(") openCount++;
-				else if (cleanedSQL[i] === ")") openCount--;
-				if (openCount === 0) {
-					isEnclosing = false;
-					break;
-				}
+	//#region src/util/policy/sqlToPolicy.ts
+	/**
+	* A tiny, regex-based SQL "parser" for security rules.
+	*
+	* This is NOT a full SQL parser. It is designed to handle the subset of SQL
+	* commonly used in `USING` and `WITH CHECK` clauses, enough to drive the
+	* optimistic client-side UI decision.
+	*
+	* It handles:
+	* - `field = 'literal'`
+	* - `field != 'literal'`
+	* - `field = current_setting('app.user_id')`
+	* - `A AND B`
+	* - `true`
+	* - `IN (...)` (as optimistic true)
+	*
+	* For anything it doesn't understand, it returns a `raw` expression, which
+	* the evaluator treats as "unknown" (and usually optimistic true).
+	*/
+	function sqlToPolicy(sql) {
+		const trimmed = sql.trim();
+		if (trimmed.toLowerCase() === "true") return _rebasepro_types.policy.true();
+		if (trimmed.toLowerCase() === "false") return _rebasepro_types.policy.false();
+		const overlapMatch = trimmed.match(/^string_to_array\s*\(\s*auth\.roles\(\)\s*,\s*','\s*\)\s*&&\s*ARRAY\s*\[(.+)\]$/i);
+		if (overlapMatch) {
+			const roles = overlapMatch[1].split(",").map((s) => s.trim().replace(/^'|'$/g, ""));
+			return _rebasepro_types.policy.rolesOverlap(roles);
+		}
+		const containMatch = trimmed.match(/^string_to_array\s*\(\s*auth\.roles\(\)\s*,\s*','\s*\)\s*@>\s*ARRAY\s*\[(.+)\]$/i);
+		if (containMatch) {
+			const roles = containMatch[1].split(",").map((s) => s.trim().replace(/^'|'$/g, ""));
+			return _rebasepro_types.policy.rolesContain(roles);
+		}
+		if (trimmed.toUpperCase().includes(" OR ")) {
+			const parts = trimmed.split(/ OR /i);
+			return _rebasepro_types.policy.or(...parts.map(sqlToPolicy));
+		}
+		if (trimmed.toUpperCase().includes(" AND ")) {
+			const parts = trimmed.split(/ AND /i);
+			return _rebasepro_types.policy.and(...parts.map(sqlToPolicy));
+		}
+		const match = trimmed.match(/^(.+?)\s*(!?=)\s*(.+)$/);
+		if (match) {
+			const [, leftStr, op, rightStr] = match;
+			const left = parseOperand(leftStr.trim());
+			const right = parseOperand(rightStr.trim());
+			if (left && right) return _rebasepro_types.policy.compare(left, op === "=" ? "eq" : "neq", right);
+		}
+		return _rebasepro_types.policy.raw(sql);
+	}
+	function parseOperand(str) {
+		if (/current_setting\s*\(\s*'app\.user_id'\s*\)/i.test(str) || /auth\.uid\(\)/i.test(str)) return _rebasepro_types.policy.authUid();
+		const stringMatch = str.match(/^'(.+)'$/);
+		if (stringMatch) return _rebasepro_types.policy.literal(stringMatch[1]);
+		if (/^\w+$/.test(str)) return _rebasepro_types.policy.field(str);
+		return null;
+	}
+	//#endregion
+	//#region src/util/policy/securityRuleToConditions.ts
+	/**
+	* Desugars a {@link SecurityRule} — its `access`/`ownerField`/`roles` shortcuts,
+	* structured `condition`/`check`, and raw `using`/`withCheck` — into a single
+	* normalized {@link PolicyExpression} pair.
+	*
+	* **This is the linchpin against drift:** both the Postgres DDL generators and
+	* the client-side evaluator consume this one function, so there is exactly one
+	* definition of what a rule means. In particular, application `roles` are folded
+	* into the expression here (AND'd with the base condition, matching how Postgres
+	* generates the clause) rather than being handled separately by each consumer.
+	*/
+	function securityRuleToConditions(rule) {
+		return {
+			usingExpr: withRoles(baseUsing(rule), rule),
+			withCheckExpr: withRoles(baseWithCheck(rule), rule)
+		};
+	}
+	function baseUsing(rule) {
+		if (rule.condition) return rule.condition;
+		if (rule.using != null) return sqlToPolicy(rule.using);
+		if (rule.access === "public") return _rebasepro_types.policy.true();
+		if (rule.ownerField) return _rebasepro_types.policy.compare(_rebasepro_types.policy.field(rule.ownerField), "eq", _rebasepro_types.policy.authUid());
+		return null;
+	}
+	function baseWithCheck(rule) {
+		if (rule.check) return rule.check;
+		if (rule.withCheck != null) return sqlToPolicy(rule.withCheck);
+		return baseUsing(rule);
+	}
+	/**
+	* AND the base condition with an application-role check, or produce a roles-only
+	* condition when there is no base. Mirrors the Postgres generator so that a
+	* role-scoped restrictive rule denies exactly the same set of users on both
+	* sides.
+	*/
+	function withRoles(base, rule) {
+		if (!rule.roles || rule.roles.length === 0) return base;
+		const rolesExpr = _rebasepro_types.policy.rolesOverlap(rule.roles);
+		if (rule.mode === "restrictive") return base ? _rebasepro_types.policy.or(_rebasepro_types.policy.not(rolesExpr), base) : _rebasepro_types.policy.not(rolesExpr);
+		return base ? _rebasepro_types.policy.and(base, rolesExpr) : rolesExpr;
+	}
+	//#endregion
+	//#region src/util/policy/policyToPostgres.ts
+	/**
+	* Compiles a {@link PolicyExpression} to a PostgreSQL boolean SQL string,
+	* suitable for a `USING (...)` / `WITH CHECK (...)` clause.
+	*
+	* This is one of the two consumers of the shared policy model (the other being
+	* {@link evaluatePolicy}); the Postgres schema generators call it so that DDL
+	* and the admin UI derive from the exact same expression.
+	*/
+	function policyToPostgres(expr, collection) {
+		switch (expr.kind) {
+			case "true": return "true";
+			case "false": return "false";
+			case "and": return expr.operands.length === 0 ? "true" : expr.operands.map((o) => `(${policyToPostgres(o, collection)})`).join(" AND ");
+			case "or": return expr.operands.length === 0 ? "false" : expr.operands.map((o) => `(${policyToPostgres(o, collection)})`).join(" OR ");
+			case "not":
+				if (expr.operand.kind === "authenticated") return "auth.uid() IS NULL";
+				return `NOT (${policyToPostgres(expr.operand, collection)})`;
+			case "compare": return `${operandToSql(expr.left, collection)} ${COMPARE_SQL[expr.op]} ${operandToSql(expr.right, collection)}`;
+			case "rolesOverlap": return `string_to_array(auth.roles(), ',') && ${rolesArraySql(expr.roles)}`;
+			case "rolesContain": return `string_to_array(auth.roles(), ',') @> ${rolesArraySql(expr.roles)}`;
+			case "authenticated": return "auth.uid() IS NOT NULL";
+			case "raw": return expr.sql.replace(/\{(\w+)\}/g, (_, col) => col);
+		}
+	}
+	var COMPARE_SQL = {
+		eq: "=",
+		neq: "!=",
+		lt: "<",
+		lte: "<=",
+		gt: ">",
+		gte: ">="
+	};
+	function operandToSql(operand, collection) {
+		switch (operand.kind) {
+			case "field": return resolveColumnName(operand.name, collection);
+			case "literal": return quoteLiteral(operand.value);
+			case "authUid": return "auth.uid()";
+			case "authRoles": return "string_to_array(auth.roles(), ',')";
+		}
+	}
+	function resolveColumnName(propName, collection) {
+		const prop = collection?.properties?.[propName];
+		if (prop && "columnName" in prop && typeof prop.columnName === "string") return prop.columnName;
+		return (0, _rebasepro_utils.toSnakeCase)(propName);
+	}
+	function quoteLiteral(value) {
+		if (value === null) return "NULL";
+		if (typeof value === "boolean") return value ? "true" : "false";
+		if (typeof value === "number") return String(value);
+		return `'${value.replace(/'/g, "''")}'`;
+	}
+	/** Sorted, single-quoted `ARRAY['a','b']` — matches the generators' output. */
+	function rolesArraySql(roles) {
+		return `ARRAY[${[...roles].sort().map((r) => `'${r}'`).join(",")}]`;
+	}
+	//#endregion
+	//#region src/util/policy/evaluatePolicy.ts
+	/**
+	* Evaluates a {@link PolicyExpression} against a user + row, using three-valued
+	* (Kleene) logic so that `"unknown"` sub-results propagate soundly.
+	*
+	* This is the JavaScript twin of {@link policyToPostgres}: both derive from the
+	* same expression, so the admin UI matches database enforcement by construction
+	* for every non-raw rule.
+	*/
+	function evaluatePolicy(expr, ctx) {
+		switch (expr.kind) {
+			case "true": return true;
+			case "false": return false;
+			case "and": return kleeneAnd$1(expr.operands.map((o) => evaluatePolicy(o, ctx)));
+			case "or": return kleeneOr(expr.operands.map((o) => evaluatePolicy(o, ctx)));
+			case "not": return kleeneNot(evaluatePolicy(expr.operand, ctx));
+			case "compare": return evaluateCompare(expr.op, expr.left, expr.right, ctx);
+			case "rolesOverlap": {
+				const userRoles = ctx.roles ?? [];
+				return expr.roles.some((r) => r === "public" || userRoles.includes(r));
 			}
-			if (isEnclosing) cleanedSQL = cleanedSQL.substring(1, cleanedSQL.length - 1).trim();
-			else break;
-		}
-		const splitByTopLevel = (str, delimiter) => {
-			const parts = [];
-			let current = "";
-			let openCount = 0;
-			let i = 0;
-			while (i < str.length) {
-				if (str[i] === "(") openCount++;
-				else if (str[i] === ")") openCount--;
-				if (openCount === 0 && str.substring(i).toUpperCase().startsWith(delimiter)) {
-					parts.push(current);
-					current = "";
-					i += delimiter.length;
-				} else {
-					current += str[i];
-					i++;
-				}
+			case "rolesContain": {
+				const userRoles = ctx.roles ?? [];
+				return expr.roles.every((r) => r === "public" || userRoles.includes(r));
 			}
-			parts.push(current);
-			return parts;
-		};
-		const orParts = splitByTopLevel(cleanedSQL, " OR ");
-		if (orParts.length > 1) return orParts.some((part) => evaluateAST(part, auth, entity));
-		const andParts = splitByTopLevel(cleanedSQL, " AND ");
-		if (andParts.length > 1) return andParts.every((part) => evaluateAST(part, auth, entity));
-		const upperSQL = cleanedSQL.toUpperCase();
-		if (upperSQL.includes(" IN ") || upperSQL.includes(" EXISTS ")) return true;
-		const roleIntersectMatch = cleanedSQL.match(/string_to_array\s*\(\s*auth\.roles\(\)\s*,\s*','\s*\)\s*&&\s*ARRAY\[(.*?)\]/i);
-		if (roleIntersectMatch && roleIntersectMatch[1]) {
-			const requiredRoles = roleIntersectMatch[1].split(",").map((r) => r.trim().replace(/'/g, ""));
-			const userRoles = auth.user?.roles || [];
-			return requiredRoles.some((r) => userRoles.includes(r));
-		}
-		const roleContainMatch = cleanedSQL.match(/string_to_array\s*\(\s*auth\.roles\(\)\s*,\s*','\s*\)\s*@>\s*ARRAY\[(.*?)\]/i);
-		if (roleContainMatch && roleContainMatch[1]) {
-			const requiredRoles = roleContainMatch[1].split(",").map((r) => r.trim().replace(/'/g, ""));
-			const userRoles = auth.user?.roles || [];
-			return requiredRoles.every((r) => userRoles.includes(r));
-		}
-		const pattern1 = /* @__PURE__ */ new RegExp("^\\{?([a-zA-Z0-9_]+)\\}?\\s*=\\s*(?:current_setting\\s*\\(\\s*'app\\.user_id'\\s*\\)|auth\\.uid\\(\\))");
-		const pattern2 = /* @__PURE__ */ new RegExp("^(?:current_setting\\s*\\(\\s*'app\\.user_id'\\s*\\)|auth\\.uid\\(\\))\\s*=\\s*\\{?([a-zA-Z0-9_]+)\\}?");
-		const match1 = cleanedSQL.match(pattern1);
-		if (match1 && match1[1]) return entity.values[match1[1]] === auth.user?.uid;
-		const match2 = cleanedSQL.match(pattern2);
-		if (match2 && match2[1]) return entity.values[match2[1]] === auth.user?.uid;
-		const simpleEqualityMatch = cleanedSQL.match(/^\{?([\w_]+)\}?\s*(=|!=)\s*'([^']+)'$/i);
-		if (simpleEqualityMatch) {
-			const field = simpleEqualityMatch[1];
-			const operator = simpleEqualityMatch[2];
-			const value = simpleEqualityMatch[3];
-			const entityValue = entity.values[field];
-			if (operator === "=") return entityValue === value;
-			if (operator === "!=") return entityValue !== value;
+			case "authenticated": return ctx.uid != null;
+			case "raw": return "unknown";
 		}
+	}
+	function kleeneAnd$1(values) {
+		if (values.some((v) => v === false)) return false;
+		if (values.some((v) => v === "unknown")) return "unknown";
 		return true;
 	}
-	function evaluateRule(rule, auth, entity) {
-		if (rule.access === "public") return true;
-		if (rule.ownerField) {
-			if (!entity) {} else if (entity.values[rule.ownerField] !== auth.user?.uid) return false;
+	function kleeneOr(values) {
+		if (values.some((v) => v === true)) return true;
+		if (values.some((v) => v === "unknown")) return "unknown";
+		return false;
+	}
+	function kleeneNot(value) {
+		if (value === "unknown") return "unknown";
+		return !value;
+	}
+	function resolveOperand(operand, ctx) {
+		switch (operand.kind) {
+			case "literal": return {
+				known: true,
+				value: operand.value
+			};
+			case "authUid": return {
+				known: true,
+				value: ctx.uid ?? null
+			};
+			case "authRoles": return {
+				known: true,
+				value: ctx.roles ?? []
+			};
+			case "field":
+				if (!ctx.entity) return { known: false };
+				return {
+					known: true,
+					value: ctx.entity.values[operand.name]
+				};
 		}
-		if (rule.using && !evaluateAST(rule.using, auth, entity)) return false;
-		if (rule.withCheck && !evaluateAST(rule.withCheck, auth, entity)) return false;
+	}
+	function evaluateCompare(op, left, right, ctx) {
+		const l = resolveOperand(left, ctx);
+		const r = resolveOperand(right, ctx);
+		if (!l.known || !r.known) return "unknown";
+		const a = l.value;
+		const b = r.value;
+		if (a === null || b === null) {
+			if (op === "eq") return false;
+			if (op === "neq") return true;
+			return "unknown";
+		}
+		if (op === "eq") return a === b;
+		if (op === "neq") return a !== b;
+		if (typeof a === "string" && typeof b === "string") {
+			if (op === "lt") return a < b;
+			if (op === "lte") return a <= b;
+			if (op === "gt") return a > b;
+			if (op === "gte") return a >= b;
+		}
+		if (typeof a === "number" && typeof b === "number") {
+			if (op === "lt") return a < b;
+			if (op === "lte") return a <= b;
+			if (op === "gt") return a > b;
+			if (op === "gte") return a >= b;
+		}
+		if (typeof a === "bigint" && typeof b === "bigint") {
+			if (op === "lt") return a < b;
+			if (op === "lte") return a <= b;
+			if (op === "gt") return a > b;
+			if (op === "gte") return a >= b;
+		}
+		return "unknown";
+	}
+	//#endregion
+	//#region src/util/permissions.ts
+	/** Combine clause results with AND under three-valued (Kleene) logic. */
+	function kleeneAnd(values) {
+		if (values.some((v) => v === false)) return false;
+		if (values.some((v) => v === "unknown")) return "unknown";
 		return true;
 	}
-	function checkOperation(collection, authContext, entity, targetOperation) {
-		const securityRules = (0, _rebasepro_types.getDataSourceCapabilities)(collection.driver).supportsRLS ? collection.securityRules : void 0;
+	/** The operations a rule covers, mirroring the Postgres generator's resolution. */
+	function ruleOperations(rule) {
+		return rule.operations && rule.operations.length > 0 ? rule.operations : [rule.operation ?? "all"];
+	}
+	function ruleApplies(rule, targetOperation) {
+		const ops = ruleOperations(rule);
+		return ops.includes(targetOperation) || ops.includes("all");
+	}
+	/**
+	* Evaluate a single rule for one operation, returning a tri-state.
+	*
+	* A `null` clause (the rule contributes no condition for a required clause)
+	* denies — matching Postgres, which emits `USING (false)` / `WITH CHECK (false)`
+	* in that case. USING applies to SELECT/UPDATE/DELETE; WITH CHECK to
+	* INSERT/UPDATE; both must pass for UPDATE.
+	*/
+	function evaluateRuleForOperation(rule, ctx, targetOperation) {
+		const { usingExpr, withCheckExpr } = securityRuleToConditions(rule);
+		const clause = (expr) => expr === null ? false : evaluatePolicy(expr, ctx);
+		const needsUsing = targetOperation !== "insert";
+		const needsWithCheck = targetOperation === "insert" || targetOperation === "update";
+		const results = [];
+		if (needsUsing) results.push(clause(usingExpr));
+		if (needsWithCheck) results.push(clause(withCheckExpr));
+		return kleeneAnd(results);
+	}
+	function resolveTriState(value, onUnknown) {
+		if (value === "unknown") return onUnknown === "allow";
+		return value;
+	}
+	/**
+	* Decide whether an operation is permitted for a user on a (possibly null) row,
+	* by evaluating the collection's security rules with the shared policy model —
+	* the same model compiled to Postgres RLS DDL, so the decision matches database
+	* enforcement for every non-raw rule.
+	*
+	* @param options.onUnknown how to treat rules that cannot be decided
+	*   client-side (raw SQL, or row predicates with no row). Defaults to `"allow"`
+	*   for optimistic UI gating; enforcement callers should pass `"deny"`.
+	*/
+	function checkOperation(collection, authContext, entity, targetOperation, options) {
+		const onUnknown = options?.onUnknown ?? "allow";
+		const securityRules = (0, _rebasepro_types.getDataSourceCapabilities)(collection.engine).supportsRLS ? collection.securityRules : void 0;
 		if (!securityRules || securityRules.length === 0) return true;
-		const applicableRules = securityRules.filter((r) => r.operation === targetOperation || r.operation === "all" || r.operations?.includes(targetOperation) || r.operations?.includes("all"));
+		const applicableRules = securityRules.filter((r) => ruleApplies(r, targetOperation));
 		if (applicableRules.length === 0) return false;
-		const userRoles = [...authContext.user?.roles ?? [], "public"];
-		const roleApplicableRules = applicableRules.filter((rule) => {
-			if (!rule.roles || rule.roles.length === 0) return true;
-			return rule.roles.some((r) => userRoles.includes(r));
-		});
-		if (roleApplicableRules.length === 0) return false;
+		const ctx = {
+			uid: authContext.user?.uid,
+			roles: authContext.user?.roles ?? [],
+			entity
+		};
 		let grantedByPermissive = false;
 		let deniedByRestrictive = false;
-		for (const rule of roleApplicableRules) {
+		let hasPermissive = false;
+		for (const rule of applicableRules) {
 			const mode = rule.mode || "permissive";
-			const passed = evaluateRule(rule, authContext, entity);
-			if (mode === "restrictive" && !passed) {
-				deniedByRestrictive = true;
-				break;
+			const passed = resolveTriState(evaluateRuleForOperation(rule, ctx, targetOperation), onUnknown);
+			if (mode === "restrictive") {
+				if (!passed) {
+					deniedByRestrictive = true;
+					break;
+				}
+			} else {
+				hasPermissive = true;
+				if (passed) grantedByPermissive = true;
 			}
-			if (mode === "permissive" && passed) grantedByPermissive = true;
 		}
 		if (deniedByRestrictive) return false;
-		if (roleApplicableRules.some((r) => (r.mode || "permissive") === "permissive")) return grantedByPermissive;
-		else return false;
+		return hasPermissive ? grantedByPermissive : false;
 	}
 	function canReadCollection(collection, authContext) {
 		return checkOperation(collection, authContext, null, "select");
@@ -836,7 +1062,7 @@
 		}
 		for (const key in collection.properties) {
 			const property = collection.properties[key];
-			if (property.type === "array" && property.of && !Array.isArray(property.of) && property.of.type === "string" && property.of.url === "image") return key;
+			if (property.type === "array" && property.of && !Array.isArray(property.of) && property.of.type === "string" && property.of.ui?.url === "image") return key;
 		}
 		for (const key in collection.properties) {
 			const property = collection.properties[key];
@@ -1070,6 +1296,13 @@
 		return collection;
 	}
 	/**
+	* Implementation — delegates to the correct overload at the type level.
+	* At runtime this is a plain identity function.
+	*/
+	function defineCollection(collection) {
+		return collection;
+	}
+	/**
 	* Identity function we use to defeat the type system of Typescript and preserve
 	* the property keys.
 	* @param property
@@ -1134,6 +1367,29 @@
 	}
 	//#endregion
 	//#region src/util/storage.ts
+	/**
+	* Resolve the {@link StorageSource} to use for a property, given the key
+	* referenced by `StorageConfig.storageSource`.
+	*
+	* Resolution priority:
+	* 1. No `sourceKey` → the default source (backward compatible).
+	* 2. An explicit {@link StorageSourceRegistry} (e.g. `client.storageRegistry`).
+	* 3. A `sources` lookup map (e.g. the `StorageSourcesContext`).
+	* 4. Fall back to the default source.
+	*
+	* Shared by the upload hook, the markdown editor, and the read-only previews
+	* so the resolution logic lives in one place.
+	*
+	* @group Storage
+	*/
+	function resolveStorageSource(params) {
+		const { sourceKey, sources, registry, defaultSource } = params;
+		if (!sourceKey) return defaultSource;
+		if (registry) return registry.getOrDefault(sourceKey);
+		const fromSources = sources?.[sourceKey];
+		if (fromSources) return fromSources;
+		return defaultSource;
+	}
 	async function resolveStorageFilenameString({ input, storage, values, entityId, path, property, file, propertyKey }) {
 		let result;
 		if (typeof input === "function") {
@@ -1440,8 +1696,76 @@
 		return result;
 	}
 	//#endregion
+	//#region src/data/resolveDataSource.ts
+	/**
+	* Build a keyed registry from a list of {@link DataSourceDefinition}s.
+	* Later entries win on key collision.
+	*/
+	function createDataSourceRegistry(definitions) {
+		const registry = {};
+		for (const def of definitions ?? []) registry[def.key] = def;
+		return registry;
+	}
+	/**
+	* Resolve the effective data source for a collection — the single source of
+	* truth shared by the frontend router, the backend driver registry, and the
+	* editor's capability lookups.
+	*
+	* Resolution order:
+	* 1. The routing **key** is `collection.dataSource`, else
+	*    {@link DEFAULT_DATA_SOURCE_KEY}.
+	* 2. If a definition is registered for that key, it provides `engine`,
+	*    `transport`, and `databaseId`.
+	* 3. Otherwise values are synthesized: `engine` from `collection.engine`
+	*    (or the key, or `"postgres"`), `transport` defaults to `"server"`,
+	*    and `databaseId` from the collection.
+	*
+	* `capabilities` are always derived from the resolved `engine`, so two
+	* data sources sharing an engine share capabilities.
+	*
+	* @param collection the collection (or any object carrying the routing fields)
+	* @param registry   optional registry of declared data sources
+	*/
+	function resolveDataSource(collection, registry) {
+		const key = collection?.dataSource ?? _rebasepro_types.DEFAULT_DATA_SOURCE_KEY;
+		const def = registry?.[key];
+		const engine = def?.engine ?? collection?.engine ?? (key !== _rebasepro_types.DEFAULT_DATA_SOURCE_KEY ? key : "postgres");
+		return {
+			key,
+			engine,
+			transport: def?.transport ?? "server",
+			databaseId: collection?.databaseId ?? def?.databaseId,
+			capabilities: (0, _rebasepro_types.getDataSourceCapabilities)(engine)
+		};
+	}
+	//#endregion
 	//#region src/collections/CollectionRegistry.ts
 	var CollectionRegistry = class {
+		/**
+		* Declared data sources, used during normalization to resolve each
+		* collection's engine (so `dataSource`-only collections get the right
+		* capabilities). Empty by default.
+		*/
+		dataSources = {};
+		/**
+		* Global lifecycle callbacks applied to every collection.
+		* Runs on all data paths (REST, WebSocket, `rebase.data`).
+		* Execution order: global → collection → property callbacks.
+		*/
+		_globalCallbacks;
+		/**
+		* Set global lifecycle callbacks that apply to every collection.
+		* Typically called once during backend initialization.
+		*/
+		setGlobalCallbacks(callbacks) {
+			this._globalCallbacks = callbacks;
+		}
+		/**
+		* Get the currently registered global callbacks, if any.
+		*/
+		getGlobalCallbacks() {
+			return this._globalCallbacks;
+		}
 		collectionsByTableName = /* @__PURE__ */ new Map();
 		collectionsBySlug = /* @__PURE__ */ new Map();
 		rootCollections = [];
@@ -1451,9 +1775,20 @@
 		rawRootCollections = [];
 		cachedRawCollectionsList = null;
 		lastRawInputSnapshot = null;
-		constructor(collections) {
+		constructor(collections, dataSources) {
+			if (dataSources) this.dataSources = dataSources;
 			if (collections) this.registerMultiple(collections);
 		}
+		/**
+		* Provide the declared data sources used to resolve each collection's
+		* engine during normalization. Set this before registering collections.
+		* Returns true if the registry changed (callers may re-register).
+		*/
+		setDataSources(dataSources) {
+			if ((0, fast_equals.deepEqual)(this.dataSources, dataSources)) return false;
+			this.dataSources = dataSources ?? {};
+			return true;
+		}
 		reset() {
 			this.collectionsByTableName.clear();
 			this.collectionsBySlug.clear();
@@ -1522,9 +1857,14 @@
 		}
 		normalizeCollection(collection) {
 			const result = { ...collection };
+			{
+				const resolved = resolveDataSource(result, this.dataSources);
+				if (!result.dataSource) result.dataSource = resolved.key;
+				if (!result.engine) result.engine = resolved.engine;
+			}
 			const extractedRelations = this.extractRelationsFromProperties(result.properties);
 			const relResult = result;
-			const manualRelations = (0, _rebasepro_types.getDataSourceCapabilities)(result.driver).supportsRelations ? relResult.relations ?? [] : [];
+			const manualRelations = (0, _rebasepro_types.getDataSourceCapabilities)(result.engine).supportsRelations ? relResult.relations ?? [] : [];
 			const mergedRelationsRaw = [...extractedRelations];
 			for (const manual of manualRelations) {
 				const name = manual.relationName;
@@ -1539,7 +1879,7 @@
 				}
 			}
 			let mergedRelations = mergedRelationsRaw;
-			if ((0, _rebasepro_types.getDataSourceCapabilities)(result.driver).supportsRelations) {
+			if ((0, _rebasepro_types.getDataSourceCapabilities)(result.engine).supportsRelations) {
 				mergedRelations = mergedRelationsRaw.map((r) => {
 					try {
 						return sanitizeRelation(r, result, (slug) => this.get(slug));
@@ -1551,8 +1891,10 @@
 			}
 			result.properties = this.normalizeProperties(result.properties, mergedRelations);
 			if (!result.childCollections) {
-				if ((0, _rebasepro_types.getDataSourceCapabilities)(result.driver).supportsSubcollections && result.subcollections) result.childCollections = result.subcollections;
-				else if ((0, _rebasepro_types.getDataSourceCapabilities)(result.driver).supportsRelations && relResult.relations) {
+				const capabilities = (0, _rebasepro_types.getDataSourceCapabilities)(result.engine);
+				const declaredSubcollections = (0, _rebasepro_types.getDeclaredSubcollections)(result);
+				if (capabilities.supportsSubcollections && declaredSubcollections) result.childCollections = declaredSubcollections;
+				else if (capabilities.supportsRelations && relResult.relations) {
 					const manyRelations = relResult.relations.filter((r) => r.cardinality === "many");
 					if (manyRelations.length > 0) result.childCollections = () => manyRelations.map((r) => {
 						const target = r.target();
@@ -1654,7 +1996,7 @@
 			if (!currentCollection) throw new Error(`Root collection not found: ${rootCollectionPath}`);
 			for (let i = 2; i < pathSegments.length; i += 2) {
 				const relationKey = pathSegments[i];
-				if (!(0, _rebasepro_types.getDataSourceCapabilities)(currentCollection.driver).supportsRelations) throw new Error(`Relation path navigation requires a collection that supports relations, but '${currentCollection.slug}' uses driver '${currentCollection.driver}'`);
+				if (!(0, _rebasepro_types.getDataSourceCapabilities)(currentCollection.engine).supportsRelations) throw new Error(`Relation path navigation requires a collection that supports relations, but '${currentCollection.slug}' uses engine '${currentCollection.engine}'`);
 				const relation = findRelation(resolveCollectionRelations(currentCollection), relationKey);
 				if (!relation) throw new Error(`Relation '${relationKey}' not found in collection '${currentCollection.slug}'`);
 				const target = relation.target();
@@ -1715,7 +2057,7 @@
 	* Slug-based dedup (Map keyed by slug, last-write-wins) lets developers
 	* override by defining their own collection with `slug: "users"`.
 	*/
-	var defaultUsersCollection = {
+	var defaultUsersCollection = defineCollection({
 		name: "Users",
 		singularName: "User",
 		slug: "users",
@@ -1763,7 +2105,7 @@
 				name: "Photo URL",
 				type: "string",
 				columnName: "photo_url",
-				url: "image"
+				ui: { url: "image" }
 			},
 			roles: {
 				name: "Roles",
@@ -1858,7 +2200,7 @@
 			"roles",
 			"createdAt"
 		]
-	};
+	});
 	//#endregion
 	//#region src/data/query_builder.ts
 	function or(...conditions) {
@@ -1910,8 +2252,8 @@
 		* @example
 		* client.collection('users').orderBy('createdAt', 'desc').find()
 		*/
-		orderBy(column, ascending = "asc") {
-			this.params.orderBy = `${column}:${ascending}`;
+		orderBy(column, direction = "asc") {
+			this.params.orderBy = `${column}:${direction}`;
 			return this;
 		}
 		/**
@@ -1966,80 +2308,216 @@
 		}
 	};
 	//#endregion
-	//#region src/data/buildRebaseData.ts
+	//#region src/data/filter-dialect.ts
 	/**
-	* Convert where-clause filter object to the internal DataDriver FilterValues format.
+	* REST wire-format adapter for the unified filter system.
 	*
-	* Supports multiple value formats:
-	* - PostgREST string: { status: "eq.published", age: "gte.18" }
-	* - Equality shorthand: { company_profile_id: null, status: "active", age: 18 }
-	* - Tuple syntax: { age: [">=", 18], role: ["in", ["admin", "editor"]] }
+	* This module is the ONLY code in the entire codebase that knows about
+	* PostgREST-style dot-syntax strings (`eq.active`, `gt.18`, `in.(a,b)`).
+	* Everything else speaks `FilterValues` exclusively.
 	*
-	* Internal:  { status: ["==", "published"], age: [">=", 18] }
+	* @module
 	*/
-	function convertWhereToFilter(where) {
-		if (!where) return void 0;
-		const operatorMap = {
-			"eq": "==",
-			"neq": "!=",
-			"gt": ">",
-			"gte": ">=",
-			"lt": "<",
-			"lte": "<=",
-			"in": "in",
-			"nin": "not-in",
-			"not-in": "not-in",
-			"cs": "array-contains",
-			"csa": "array-contains-any",
-			"==": "==",
-			"!=": "!=",
-			">": ">",
-			">=": ">=",
-			"<": "<",
-			"<=": "<=",
-			"array-contains": "array-contains",
-			"array-contains-any": "array-contains-any"
-		};
-		const filter = {};
-		for (const [field, rawValue] of Object.entries(where)) {
-			if (rawValue === null) {
-				filter[field] = ["==", null];
-				continue;
-			}
-			if (typeof rawValue === "boolean") {
-				filter[field] = ["==", rawValue];
-				continue;
-			}
-			if (typeof rawValue === "number") {
-				filter[field] = ["==", rawValue];
-				continue;
+	/**
+	* Coerce a raw querystring value to its natural JS type.
+	* - `"true"` / `"false"` → boolean
+	* - `"null"` → null
+	* - Numeric strings → number
+	* - Everything else → string (unchanged)
+	*/
+	function coerceValue(raw) {
+		if (raw === "true") return true;
+		if (raw === "false") return false;
+		if (raw === "null") return null;
+		if (raw !== "" && !isNaN(Number(raw))) return Number(raw);
+		return raw;
+	}
+	/**
+	* Serialize a JS value to its querystring representation.
+	*/
+	function stringifyValue(value) {
+		if (value === null) return "null";
+		if (typeof value === "boolean") return String(value);
+		return String(value);
+	}
+	/**
+	* Serialize a single condition tuple to a PostgREST dot-string.
+	*
+	* @example
+	* serializeTuple(["==", "active"])           // "eq.active"
+	* serializeTuple(["in", ["admin","editor"]]) // "in.(admin,editor)"
+	* serializeTuple([">=", 18])                 // "gte.18"
+	*/
+	function serializeTuple(tuple) {
+		if (typeof tuple === "string") {
+			if (tuple.includes(".")) {
+				const dotIndex = tuple.indexOf(".");
+				if (_rebasepro_types.REST_TO_CANONICAL[tuple.substring(0, dotIndex)]) return tuple;
 			}
-			if (Array.isArray(rawValue)) {
-				const mappedConditions = (Array.isArray(rawValue[0]) ? rawValue : [rawValue]).map(([rawOp, val]) => {
-					return [operatorMap[rawOp] ?? "==", val];
-				});
-				filter[field] = Array.isArray(rawValue[0]) ? mappedConditions : mappedConditions[0];
+			return tuple;
+		}
+		if (!Array.isArray(tuple) || tuple.length !== 2 || typeof tuple[0] !== "string" || !_rebasepro_types.CANONICAL_TO_REST[tuple[0]]) return `eq.${stringifyValue(tuple)}`;
+		const [op, value] = tuple;
+		const restOp = _rebasepro_types.CANONICAL_TO_REST[op];
+		if (Array.isArray(value)) return `${restOp}.(${value.map(stringifyValue).join(",")})`;
+		return `${restOp}.${stringifyValue(value)}`;
+	}
+	/**
+	* Convert `FilterValues` to a PostgREST-style querystring record.
+	*
+	* - Single conditions produce a string value.
+	* - Multiple conditions on the same field produce a string array (repeated params).
+	*
+	* @example
+	* serializeFilter({ status: ["==", "active"] })
+	* // → { status: "eq.active" }
+	*
+	* serializeFilter({ age: [[">=", 18], ["<", 65]] })
+	* // → { age: ["gte.18", "lt.65"] }
+	*/
+	function serializeFilter(filter) {
+		const result = {};
+		for (const [field, condition] of Object.entries(filter)) {
+			if (condition === void 0) continue;
+			if (Array.isArray(condition) && condition.length > 0 && Array.isArray(condition[0])) result[field] = condition.map(serializeTuple);
+			else result[field] = serializeTuple(condition);
+		}
+		return result;
+	}
+	/**
+	* Parse a single PostgREST dot-string into a `[WhereFilterOp, unknown]` tuple.
+	*
+	* If the string doesn't match a known operator prefix, falls back to
+	* `["==", originalString]` (treating the whole string as an equality value).
+	*/
+	function deserializeSingle(raw) {
+		const dotIndex = raw.indexOf(".");
+		if (dotIndex === -1) return ["==", coerceValue(raw)];
+		const prefix = raw.substring(0, dotIndex);
+		const rest = raw.substring(dotIndex + 1);
+		const canonicalOp = _rebasepro_types.REST_TO_CANONICAL[prefix];
+		if (!canonicalOp) return ["==", raw];
+		if (rest.startsWith("(") && rest.endsWith(")")) return [canonicalOp, rest.slice(1, -1).split(",").map((s) => coerceValue(s.trim()))];
+		return [canonicalOp, coerceValue(rest)];
+	}
+	/**
+	* Convert a PostgREST-style querystring record to `FilterValues`.
+	*
+	* - String values are parsed as single conditions.
+	* - String arrays (repeated query params) become multiple conditions on the same field.
+	*
+	* @example
+	* deserializeFilter({ status: "eq.active" })
+	* // → { status: ["==", "active"] }
+	*
+	* deserializeFilter({ age: ["gte.18", "lt.65"] })
+	* // → { age: [[">=", 18], ["<", 65]] }
+	*/
+	function deserializeFilter(query) {
+		const result = {};
+		for (const [field, raw] of Object.entries(query)) {
+			if (raw === void 0) continue;
+			if (Array.isArray(raw) && raw.length === 2 && typeof raw[0] === "string" && (0, _rebasepro_types.toCanonicalOp)(raw[0]) === raw[0]) {
+				result[field] = raw;
 				continue;
 			}
-			if (typeof rawValue === "string") {
-				const dotIndex = rawValue.indexOf(".");
-				if (dotIndex === -1) {
-					filter[field] = ["==", rawValue];
+			if (Array.isArray(raw)) {
+				if (raw.length === 0) continue;
+				if (Array.isArray(raw[0]) && raw[0].length === 2 && typeof raw[0][0] === "string" && (0, _rebasepro_types.toCanonicalOp)(raw[0][0]) === raw[0][0]) {
+					result[field] = raw;
 					continue;
 				}
-				const op = rawValue.substring(0, dotIndex);
-				let value = rawValue.substring(dotIndex + 1);
-				if (typeof value === "string" && value.startsWith("(") && value.endsWith(")")) value = value.slice(1, -1).split(",").map((v) => v.trim());
-				if (value === "null") value = null;
-				else if (value === "true") value = true;
-				else if (value === "false") value = false;
-				else if (typeof value === "string" && !isNaN(Number(value)) && value.trim() !== "") value = Number(value);
-				const mappedOp = operatorMap[op];
-				if (mappedOp) filter[field] = [mappedOp, value];
+				if (raw.length === 1) result[field] = typeof raw[0] === "string" ? deserializeSingle(raw[0]) : ["==", raw[0]];
+				else if (typeof raw[0] === "string" && raw[0].includes(".")) result[field] = raw.map((r) => typeof r === "string" ? deserializeSingle(r) : ["==", r]);
+				else result[field] = ["in", raw];
+			} else if (typeof raw === "string") result[field] = deserializeSingle(raw);
+			else result[field] = ["==", raw];
+		}
+		return result;
+	}
+	/**
+	* Serialize a `LogicalCondition` or `FilterCondition` to its wire-format string.
+	*
+	* @example
+	* serializeLogicalCondition({ column: "status", operator: "==", value: "active" })
+	* // → "status.eq.active"
+	*
+	* serializeLogicalCondition({ type: "or", conditions: [...] })
+	* // → "or(status.eq.active,status.eq.pending)"
+	*/
+	function serializeLogicalCondition(cond) {
+		if ("type" in cond) {
+			const inner = (cond.conditions ?? []).map(serializeLogicalCondition).join(",");
+			return `${cond.type}(${inner})`;
+		}
+		const restOp = _rebasepro_types.CANONICAL_TO_REST[cond.operator] || "eq";
+		if (Array.isArray(cond.value)) {
+			const items = cond.value.map(stringifyValue).join(",");
+			return `${cond.column}.${restOp}.(${items})`;
+		}
+		return `${cond.column}.${restOp}.${stringifyValue(cond.value)}`;
+	}
+	/**
+	* Parse a logical condition wire-format string back into a
+	* `LogicalCondition` or `FilterCondition`.
+	*
+	* @example
+	* deserializeLogicalCondition("status.eq.active")
+	* // → { column: "status", operator: "==", value: "active" }
+	*
+	* deserializeLogicalCondition("or(status.eq.active,age.gte.18)")
+	* // → { type: "or", conditions: [...] }
+	*/
+	function deserializeLogicalCondition(str) {
+		const logicalMatch = str.match(/^(and|or)\((.+)\)$/);
+		if (logicalMatch) {
+			const type = logicalMatch[1];
+			const innerStr = logicalMatch[2];
+			const conditions = [];
+			let depth = 0;
+			let start = 0;
+			for (let i = 0; i < innerStr.length; i++) if (innerStr[i] === "(") depth++;
+			else if (innerStr[i] === ")") depth--;
+			else if (innerStr[i] === "," && depth === 0) {
+				conditions.push(deserializeLogicalCondition(innerStr.slice(start, i)));
+				start = i + 1;
 			}
+			conditions.push(deserializeLogicalCondition(innerStr.slice(start)));
+			return {
+				type,
+				conditions
+			};
 		}
-		return Object.keys(filter).length > 0 ? filter : void 0;
+		const firstDot = str.indexOf(".");
+		if (firstDot === -1) return {
+			column: str,
+			operator: "==",
+			value: true
+		};
+		const column = str.substring(0, firstDot);
+		const rest = str.substring(firstDot + 1);
+		const secondDot = rest.indexOf(".");
+		if (secondDot === -1) return {
+			column,
+			operator: "==",
+			value: coerceValue(rest)
+		};
+		const opStr = rest.substring(0, secondDot);
+		let valueStr = rest.substring(secondDot + 1);
+		const operator = (0, _rebasepro_types.toCanonicalOp)(opStr) ?? "==";
+		if (valueStr.startsWith("(") && valueStr.endsWith(")")) return {
+			column,
+			operator,
+			value: valueStr.slice(1, -1).split(",").map((s) => coerceValue(s.trim()))
+		};
+		return {
+			column,
+			operator,
+			value: coerceValue(valueStr)
+		};
 	}
+	//#endregion
+	//#region src/data/buildRebaseData.ts
 	/**
 	* Parse an orderBy string like "created_at:desc" into [field, direction].
 	*/
@@ -2052,11 +2530,12 @@
 		const accessor = {
 			async find(params) {
 				const orderParsed = parseOrderBy(params?.orderBy);
+				const filter = params?.where ? deserializeFilter(params.where) : void 0;
 				const entities = await driver.fetchCollection({
 					path: slug,
 					limit: params?.limit,
 					offset: params?.offset,
-					filter: convertWhereToFilter(params?.where),
+					filter,
 					orderBy: orderParsed?.[0],
 					order: orderParsed?.[1],
 					searchString: params?.searchString
@@ -2106,9 +2585,10 @@
 				return driver.deleteAll(slug);
 			} : void 0,
 			count: driver.countEntities ? async (params) => {
+				const filter = params?.where ? deserializeFilter(params.where) : void 0;
 				return driver.countEntities({
 					path: slug,
-					filter: convertWhereToFilter(params?.where)
+					filter
 				});
 			} : void 0,
 			listen: driver.listenCollection ? (params, onUpdate, onError) => {
@@ -2119,7 +2599,7 @@
 					path: slug,
 					limit: params?.limit,
 					offset: params?.offset,
-					filter: convertWhereToFilter(params?.where),
+					filter: params?.where,
 					orderBy: orderParsed?.[0],
 					order: orderParsed?.[1],
 					searchString: params?.searchString,
@@ -2198,11 +2678,133 @@
 		} });
 	}
 	//#endregion
+	//#region src/data/buildRoutedRebaseData.ts
+	/**
+	* Build a {@link RebaseData} that routes each collection to the right
+	* backend based on its resolved data source.
+	*
+	* `.collection(path)` (and dynamic `data.products`-style access) resolves the
+	* collection's data-source key via `resolveKey` and delegates to the matching
+	* entry in `sources`, falling back to `defaultData` when there is no match.
+	* Because routing keys off the *path being accessed*, a reference widget
+	* inside a Firestore form that points at a Postgres collection is still
+	* served by Postgres — routing follows the target, not the ancestor.
+	*
+	* When `sources` is empty this returns `defaultData` untouched, so the
+	* single-driver setup keeps identical behaviour and identity (important for
+	* effect dependencies that key off the data instance).
+	*
+	* @example
+	* const data = buildRoutedRebaseData({
+	*     defaultData: client.data,
+	*     sources: { analytics: buildRebaseData(firestoreDriver) },
+	*     resolveKey: (path) => resolveDataSource(registry.getCollection(path), defs).key
+	* });
+	* await data.products.find();        // → default (server / Postgres)
+	* await data.events.find();          // → Firestore, if `events.dataSource === "analytics"`
+	*/
+	function buildRoutedRebaseData({ defaultData, sources, resolveKey }) {
+		if (!sources || Object.keys(sources).length === 0) return defaultData;
+		function resolve(slugOrPath) {
+			const key = resolveKey(slugOrPath);
+			if (key && sources[key]) return sources[key];
+			return defaultData;
+		}
+		function getAccessor(slugOrPath) {
+			return resolve(slugOrPath).collection(slugOrPath);
+		}
+		return new Proxy({ collection: getAccessor }, { get(_target, prop) {
+			if (prop === "collection") return getAccessor;
+			if (typeof prop === "symbol") return void 0;
+			if (prop === "then" || prop === "toJSON" || prop === "$$typeof") return void 0;
+			return getAccessor((0, _rebasepro_utils.toSnakeCase)(prop));
+		} });
+	}
+	//#endregion
+	//#region src/table-classification.ts
+	/** Schemas that are always considered Rebase-internal. */
+	var REBASE_INTERNAL_SCHEMAS = ["rebase", "auth"];
+	/** Table-name prefixes that mark a table as Rebase-internal regardless of schema. */
+	var REBASE_INTERNAL_PREFIXES = [
+		"_rebase_",
+		"_auth_",
+		"drizzle_"
+	];
+	/**
+	* Synchronously classify a table based on naming conventions.
+	*
+	* @param tableName  - The unqualified name of the table.
+	* @param schemaName - The schema the table belongs to (e.g. `"public"`, `"rebase"`).
+	* @returns `"rebase-internal"` when the table belongs to a reserved schema or
+	*          carries a reserved prefix; `"user"` otherwise.
+	*
+	* @remarks
+	* Junction-table detection requires an async database query and is therefore
+	* **not** handled by this function. Use {@link detectJunctionTables} to obtain
+	* the set of junction tables, then reclassify as needed.
+	*/
+	function classifyTable(tableName, schemaName) {
+		if (REBASE_INTERNAL_SCHEMAS.includes(schemaName) || REBASE_INTERNAL_PREFIXES.some((prefix) => tableName.startsWith(prefix))) return "rebase-internal";
+		return "user";
+	}
+	/**
+	* Convenience predicate that checks whether a table is Rebase-internal.
+	*
+	* @param tableName  - The unqualified name of the table.
+	* @param schemaName - The schema the table belongs to.
+	* @returns `true` if the table is classified as `"rebase-internal"`.
+	*/
+	function isRebaseInternalTable(tableName, schemaName) {
+		return classifyTable(tableName, schemaName) === "rebase-internal";
+	}
+	/** SQL query that detects junction tables in the `public` schema. */
+	var JUNCTION_TABLES_SQL = `
+  SELECT t.table_name
+  FROM information_schema.tables t
+  WHERE t.table_schema = 'public'
+    AND t.table_type = 'BASE TABLE'
+    AND NOT EXISTS (
+      SELECT 1
+      FROM information_schema.columns c
+      WHERE c.table_schema = t.table_schema
+        AND c.table_name = t.table_name
+        AND c.column_name NOT IN (
+          SELECT kcu.column_name
+          FROM information_schema.key_column_usage kcu
+          JOIN information_schema.table_constraints tc
+            ON tc.constraint_name = kcu.constraint_name
+            AND tc.table_schema = kcu.table_schema
+          WHERE tc.constraint_type = 'FOREIGN KEY'
+            AND kcu.table_schema = t.table_schema
+            AND kcu.table_name = t.table_name
+        )
+    )
+`;
+	/**
+	* Asynchronously detect junction (link) tables in the `public` schema.
+	*
+	* A junction table is defined as a table where **every** column participates in
+	* at least one foreign-key constraint.
+	*
+	* @param executeSql - A callback that executes a raw SQL string and returns the
+	*                     resulting rows.
+	* @returns A `Set` containing the names of all detected junction tables.
+	*/
+	async function detectJunctionTables(executeSql) {
+		const rows = await executeSql(JUNCTION_TABLES_SQL);
+		const junctionTables = /* @__PURE__ */ new Set();
+		for (const row of rows) if (typeof row.table_name === "string") junctionTables.add(row.table_name);
+		return junctionTables;
+	}
+	//#endregion
 	exports.COLLECTION_PATH_SEPARATOR = COLLECTION_PATH_SEPARATOR;
 	exports.CollectionRegistry = CollectionRegistry;
 	exports.DEFAULT_ONE_OF_TYPE = DEFAULT_ONE_OF_TYPE;
 	exports.DEFAULT_ONE_OF_VALUE = DEFAULT_ONE_OF_VALUE;
+	exports.JUNCTION_TABLES_SQL = JUNCTION_TABLES_SQL;
 	exports.QueryBuilder = QueryBuilder;
+	exports.REBASE_INTERNAL_PREFIXES = REBASE_INTERNAL_PREFIXES;
+	exports.REBASE_INTERNAL_SCHEMAS = REBASE_INTERNAL_SCHEMAS;
 	exports.addInitialSlash = addInitialSlash;
 	exports.and = and;
 	exports.applyPropertyConditions = applyPropertyConditions;
@@ -2217,17 +2819,25 @@
 	exports.buildProperty = buildProperty;
 	exports.buildPropertyCallbacks = buildPropertyCallbacks;
 	exports.buildRebaseData = buildRebaseData;
+	exports.buildRoutedRebaseData = buildRoutedRebaseData;
 	exports.canCreateEntity = canCreateEntity;
 	exports.canDeleteEntity = canDeleteEntity;
 	exports.canEditEntity = canEditEntity;
 	exports.canReadCollection = canReadCollection;
 	exports.checkOperation = checkOperation;
+	exports.classifyTable = classifyTable;
 	exports.cond = cond;
+	exports.createDataSourceRegistry = createDataSourceRegistry;
 	exports.createRelationRef = createRelationRef;
 	exports.createRelationRefWithData = createRelationRefWithData;
 	exports.defaultUsersCollection = defaultUsersCollection;
+	exports.defineCollection = defineCollection;
+	exports.deserializeFilter = deserializeFilter;
+	exports.deserializeLogicalCondition = deserializeLogicalCondition;
+	exports.detectJunctionTables = detectJunctionTables;
 	exports.enumToObjectEntries = enumToObjectEntries;
 	exports.evaluateCondition = evaluateCondition;
+	exports.evaluatePolicy = evaluatePolicy;
 	exports.findRelation = findRelation;
 	exports.fullPathToCollectionSegments = fullPathToCollectionSegments;
 	exports.getArrayResolvedProperties = getArrayResolvedProperties;
@@ -2253,8 +2863,10 @@
 	exports.isHidden = isHidden;
 	exports.isPropertyBuilder = isPropertyBuilder;
 	exports.isReadOnly = isReadOnly;
+	exports.isRebaseInternalTable = isRebaseInternalTable;
 	exports.normalizeToEntityRelation = normalizeToEntityRelation;
 	exports.or = or;
+	exports.policyToPostgres = policyToPostgres;
 	exports.registerConditionOperations = registerConditionOperations;
 	exports.removeInitialAndTrailingSlashes = removeInitialAndTrailingSlashes;
 	exports.removeInitialSlash = removeInitialSlash;
@@ -2262,6 +2874,7 @@
 	exports.resolveArrayProperties = resolveArrayProperties;
 	exports.resolveCollectionPathIds = resolveCollectionPathIds;
 	exports.resolveCollectionRelations = resolveCollectionRelations;
+	exports.resolveDataSource = resolveDataSource;
 	exports.resolveDefaultSelectedView = resolveDefaultSelectedView;
 	exports.resolveEnumValues = resolveEnumValues;
 	exports.resolveProperties = resolveProperties;
@@ -2271,9 +2884,13 @@
 	exports.resolveRelationProperty = resolveRelationProperty;
 	exports.resolveStorageFilenameString = resolveStorageFilenameString;
 	exports.resolveStoragePathString = resolveStoragePathString;
+	exports.resolveStorageSource = resolveStorageSource;
 	exports.sanitizeData = sanitizeData;
 	exports.sanitizeRelation = sanitizeRelation;
+	exports.securityRuleToConditions = securityRuleToConditions;
 	exports.segmentsToStrippedPath = segmentsToStrippedPath;
+	exports.serializeFilter = serializeFilter;
+	exports.serializeLogicalCondition = serializeLogicalCondition;
 	exports.sortProperties = sortProperties;
 	exports.stripCollectionPath = stripCollectionPath;
 	exports.traverseValueProperty = traverseValueProperty;