@rebasepro/server 0.14.0 → 0.14.1-canary.g7e666eb

package/dist/index.es.js

@@ -1,15 +1,15 @@
 import { createRequire as __createRequire } from "module";
 import process from "process";
 __createRequire(import.meta.url);
-import { A as RebaseApiError, D as EntityRelation, E as EntityReference, O as GeoPoint, _ as resolveCollectionRelations, b as toSnakeCase, c as collectAllPages, d as CollectionRegistry, f as createDataSourceRegistry, g as findRelation, h as fieldKeyForColumn, j as RebaseClientError, k as Vector, l as paginateFind, m as getEffectiveSecurityRules, n as buildSdkData, o as serializeFilter, p as resolveDataSource, s as serializeLogicalCondition, t as buildRoutedRebaseData, u as resolveFindWindow, v as buildCompositeId, y as resolvePrimaryKeys } from "./src-C7rkDGxA.js";
+import { A as GeoPoint, M as RebaseApiError, N as RebaseClientError, O as EntityReference, S as toSnakeCase, _ as fieldKeyForColumn, b as buildCompositeId, c as collectAllPages, d as normalizeOrderBy, f as serializeOrderBy, g as getEffectiveSecurityRules, h as resolveDataSource, j as Vector, k as EntityRelation, l as paginateFind, m as createDataSourceRegistry, n as buildSdkData, o as serializeFilter, p as CollectionRegistry, s as serializeLogicalCondition, t as buildRoutedRebaseData, u as resolveFindWindow, v as findRelation, x as resolvePrimaryKeys, y as resolveCollectionRelations } from "./src-8XDWyDfR.js";
 import { c as DEFAULT_DATA_SOURCE_KEY, i as getCollectionDataPath, m as toCanonicalOp, n as RLS_ROLES_SQL, o as isPostgresCollectionConfig, r as RLS_UID_SQL, t as RLS_JWT_SQL } from "./src-Cz9nMgUR.js";
 import { n as ADMIN_PROPERTY_KEYS, t as ADMIN_COLLECTION_KEYS } from "./admin_block-H86dCPsj.js";
 import { i as isSQLAdmin, r as revokeInternalTableSql } from "./ddl-bootstrap-BhXbTnBl.js";
+import { C as DEFAULT_STORAGE_SOURCE_KEY, E as storageEnvSuffix, T as normalizeStorageSources, _ as InvalidStorageKeyError, b as canonicalStorageKey, g as InvalidStorageBucketError, i as generateDownloadToken, n as configureJwt, v as canonicalStorageBucket, w as findStorageSuffixCollision, y as canonicalStorageId } from "./jwt-CYGFT0ih.js";
 import { n as createContractRoutes } from "./contract-routes-Bet-eCNJ.js";
-import { $ as fileTokenAuth, A as MemoryRateLimitStore, B as getEmailVerificationTemplate, C as ZodNumber, Ct as isPublicStoragePath, D as _coercedNumber, E as string, F as resolveAuthHooks, G as RawHtml, H as getPasswordResetTemplate, I as hashPassword, J as raw, K as escapeHtml, L as validatePasswordStrength, M as createEmailService, N as assertEmailLinkBases, O as DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT, P as resolveEmailLinkBase, Q as extractUserFromToken, R as verifyPassword, S as createBuiltinAuthAdapter, St as PUBLIC_STORAGE_PREFIX, T as object, U as getUserInvitationTemplate, V as getMagicLinkTemplate, W as getWelcomeEmailTemplate, X as createAuthMiddleware, Y as createAdapterAuthMiddleware, Z as createRequireAuth, _ as createLinkedinProvider, _t as scopeDataDriver, a as createSpotifyProvider, at as InvalidStorageBucketError, b as pkceTokenParams, bt as parseQueryOptions, c as createGitLabProvider, ct as canonicalStorageKey, d as createFacebookProvider, dt as createStorageApiKeyGuard, et as optionalAuth, f as createAppleProvider, ft as isApiKeyToken, g as createGitHubProvider, gt as SERVICE_IDENTITY, h as verifyOidcIdToken, ht as safeCompare, i as createApiKeyStore, it as requireAuth, j as SMTPEmailService, k as createDataRateLimiter, l as createDiscordProvider, lt as createApiKeyPreAuth, m as tryVerifyOidcIdToken, mt as extractBearerToken, n as createCustomAuthAdapter, nt as queryTokenAuth, o as createSlackProvider, ot as InvalidStorageKeyError, p as createMicrosoftProvider, pt as validateApiKey, q as html, r as createApiKeyRoutes, rt as requireAdmin, s as createBitbucketProvider, st as canonicalStorageBucket, tt as publicObjectAuth, u as createTwitterProvider, ut as createFunctionApiKeyGuard, v as createGoogleProvider, vt as httpMethodToOperation, w as _enum, x as providerVerifiedEmail, xt as resolveListLimitParam, y as oauthCodeFlowSchema, yt as isOperationAllowed, z as generateSecurePassword } from "./auth-CYoPVf-E.js";
+import { $ as fileTokenAuth, A as MemoryRateLimitStore, B as getEmailVerificationTemplate, C as ZodNumber, D as _coercedNumber, E as string, F as resolveAuthHooks, G as RawHtml, H as getPasswordResetTemplate, I as hashPassword, J as raw, K as escapeHtml, L as validatePasswordStrength, M as createEmailService, N as assertEmailLinkBases, O as DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT, P as resolveEmailLinkBase, Q as extractUserFromToken, R as verifyPassword, S as createBuiltinAuthAdapter, T as object, U as getUserInvitationTemplate, V as getMagicLinkTemplate, W as getWelcomeEmailTemplate, X as createAuthMiddleware, Y as createAdapterAuthMiddleware, Z as createRequireAuth, _ as createLinkedinProvider, _t as parseQueryOptions, a as createSpotifyProvider, at as createApiKeyPreAuth, b as pkceTokenParams, bt as isPublicStoragePath, c as createGitLabProvider, ct as isApiKeyToken, d as createFacebookProvider, dt as safeCompare, et as optionalAuth, f as createAppleProvider, ft as SERVICE_IDENTITY, g as createGitHubProvider, gt as orderByEntriesToTuples, h as verifyOidcIdToken, ht as isOperationAllowed, i as createApiKeyStore, it as requireAuth, j as SMTPEmailService, k as createDataRateLimiter, l as createDiscordProvider, lt as validateApiKey, m as tryVerifyOidcIdToken, mt as httpMethodToOperation, n as createCustomAuthAdapter, nt as queryTokenAuth, o as createSlackProvider, ot as createFunctionApiKeyGuard, p as createMicrosoftProvider, pt as scopeDataDriver, q as html, r as createApiKeyRoutes, rt as requireAdmin, s as createBitbucketProvider, st as createStorageApiKeyGuard, tt as publicObjectAuth, u as createTwitterProvider, ut as extractBearerToken, v as createGoogleProvider, vt as resolveListLimitParam, w as _enum, x as providerVerifiedEmail, y as oauthCodeFlowSchema, yt as PUBLIC_STORAGE_PREFIX, z as generateSecurePassword } from "./auth-BQcdhMBL.js";
 import { t as logger } from "./logger-DfvF_8r-.js";
 import { n as errorHandler, t as ApiError } from "./errors-EBYiaJ2E.js";
-import { i as generateDownloadToken, n as configureJwt } from "./jwt-_IFqfTOg.js";
 import { t as logMiddleware } from "./logs-routes-BYA72C_C.js";
 import { n as DOCUMENT_MIME_TYPES, r as IMAGE_MIME_TYPES, t as DEFAULT_MAX_FILE_SIZE } from "./types-DSnOC4mF.js";
 import { t as S3StorageController } from "./S3StorageController-B2EDXXMH.js";
@@ -19,7 +19,7 @@ import { t as createFunctionRoutes } from "./function-routes-Btcez1T-.js";
 import { n as loadCronJobsFromDirectory, r as loadCronJobsWithDiagnostics } from "./cron-loader-YhhQeVBM.js";
 import { r as validateCronExpression, t as CronScheduler } from "./cron-scheduler-DIpYBmZP.js";
 import { t as createCronRoutes } from "./cron-routes-maM_RlUu.js";
-import { t as createCronStore } from "./cron-store-Dvr4Y1sZ.js";
+import { t as createCronStore } from "./cron-store-D5dUNviq.js";
 import { a as parseBackupTimestamp, i as parseBackupDestination, n as createBackupRoutes, o as readBackupBytes, r as listBackupObjects } from "./backup-C6ljYVTp.js";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import * as fs$2 from "fs";
@@ -49,153 +49,6 @@ import { secureHeaders } from "hono/secure-headers";
 import { getRequestListener } from "@hono/node-server";
 import { execFile } from "node:child_process";
 import { promisify as promisify$1 } from "node:util";
-//#region ../types/src/types/storage_source.ts
-/**
-* Describes a named storage backend — a place files live.
-*
-* Declared once and shared front + back: the frontend uses it to decide
-* transport (HTTP proxy vs direct SDK), the backend uses the same `key`
-* to resolve a StorageController, and collection properties reference
-* a definition by its `key` via `StorageConfig.storageSource`.
-*
-* This mirrors the {@link DataSourceDefinition} pattern used for databases.
-*
-* @group Models
-*/
-/**
-* The default storage source key, used when a property does not specify
-* a `storageSource`. Shared by the frontend and backend registries so
-* both agree on "the default storage backend".
-* @group Models
-*/
-var DEFAULT_STORAGE_SOURCE_KEY = "(default)";
-/**
-* The environment-variable suffix for a storage or data source key.
-*
-* `""` for the default source — so a single-bucket project keeps configuring
-* plain `S3_BUCKET` — and `__<KEY>` for every named one, uppercased with
-* non-alphanumerics collapsed to underscores: `media-cdn` → `S3_BUCKET__MEDIA_CDN`.
-*
-* The rule derives the variable name from the declared key rather than
-* discovering keys by scanning the environment. Scanning would have to guess how
-* `S3_BUCKET__MEDIA_CDN` splits into a key; deriving cannot be ambiguous, and a
-* typo surfaces as a missing source at boot instead of a silently ignored
-* variable.
-*
-* It lives in this package, with no dependencies, because four things must agree
-* on it exactly: the CLI (validating a build), the runtime (reading its own
-* environment), the control plane (writing a tenant's Secret), and the docs. A
-* second implementation of a naming convention is a second chance to disagree.
-*
-* @group Models
-*/
-function storageEnvSuffix(key, defaultKey = DEFAULT_STORAGE_SOURCE_KEY) {
-	if (!key || key === defaultKey) return "";
-	const normalized = key.replace(/[^A-Za-z0-9]+/g, "_").replace(/^_+|_+$/g, "").toUpperCase();
-	if (!normalized) throw new Error(`Source key "${key}" cannot be turned into an environment variable name. Use a key containing at least one letter or digit.`);
-	return `__${normalized}`;
-}
-/**
-* Two distinct keys that collapse onto the same variable name, or `null`.
-*
-* `media-cdn` and `media_cdn` are different source keys but the same suffix, so
-* without this one of them silently reads the other's configuration. Returns the
-* offending pair rather than throwing, so each caller can raise it in its own
-* idiom — a `BundleError` at boot, a build failure in the CLI, a rejected deploy
-* in a control plane.
-*
-* @group Models
-*/
-function findStorageSuffixCollision(keys, defaultKey = DEFAULT_STORAGE_SOURCE_KEY) {
-	const seen = /* @__PURE__ */ new Map();
-	for (const key of keys) {
-		const suffix = storageEnvSuffix(key, defaultKey);
-		const existing = seen.get(suffix);
-		if (existing !== void 0 && existing !== key) return {
-			a: existing,
-			b: key,
-			suffix
-		};
-		seen.set(suffix, key);
-	}
-	return null;
-}
-/**
-* Merge the two places a project may declare storage sources into one list.
-*
-* `rebase.json` is authoritative for every field it states. Config code may add
-* sources it does not mention and fill in fields it left out, but may not
-* contradict it: the manifest is what a host reads to decide which buckets need
-* configuring, and a runtime that quietly disagreed with it would put the
-* console back to describing a topology the tenant does not have — the exact
-* failure this whole mechanism exists to end.
-*
-* Note what is *not* here: no default source is invented when both inputs are
-* empty. That decision belongs to the resolver, which knows whether declaring
-* nothing means "one plain bucket" (it does) or "no storage at all".
-*
-* @group Models
-*/
-function normalizeStorageSources(declared, exported) {
-	const merged = /* @__PURE__ */ new Map();
-	const declaredEntries = Array.isArray(declared) ? declared.filter((d) => d?.key).map((d) => [d.key, d]) : Object.entries(declared ?? {});
-	for (const [key, config] of declaredEntries) merged.set(key, {
-		key,
-		engine: config.engine,
-		transport: config.transport ?? "server",
-		...config.label !== void 0 ? { label: config.label } : {}
-	});
-	for (const definition of exported ?? []) {
-		if (!definition?.key) continue;
-		const existing = merged.get(definition.key);
-		if (!existing) {
-			merged.set(definition.key, {
-				key: definition.key,
-				engine: definition.engine,
-				transport: definition.transport ?? "server",
-				...definition.label !== void 0 ? { label: definition.label } : {}
-			});
-			continue;
-		}
-		if (existing.label === void 0 && definition.label !== void 0) existing.label = definition.label;
-	}
-	return Array.from(merged.values());
-}
-//#endregion
-//#region ../common/src/data/sort-dialect.ts
-/**
-* Sort-order wire codec.
-*
-* This is the ONLY module that knows about the colon-delimited wire format
-* (`"field:direction"`) used in HTTP query parameters.
-* Everything else speaks {@link OrderByTuple} exclusively.
-*
-* Mirrors the filter architecture in `filter-dialect.ts`.
-*
-* @module
-*/
-/**
-* Serialize an {@link OrderByTuple} to the wire format `"field:direction"`.
-*
-* **Runtime tolerance:** if the input is already a well-formed wire string
-* (from an untyped JS caller), it is returned unchanged.
-* This is undocumented tolerance, not public API — don't rely on it.
-*
-* @param orderBy - A canonical `[field, direction]` tuple, or at runtime
-*   possibly a pre-serialized string (undocumented tolerance).
-* @returns The wire-format string, or `undefined` if the input is falsy.
-*
-* @remarks
-* Field names containing `:` are representable in the tuple form but
-* **not** on the wire — this is an inherent limitation of the colon-delimited
-* encoding and is not resolved here.
-*/
-function serializeOrderBy(orderBy) {
-	if (!orderBy) return void 0;
-	if (typeof orderBy === "string") return orderBy;
-	return `${orderBy[0]}:${orderBy[1]}`;
-}
-//#endregion
 //#region src/collections/BackendCollectionRegistry.ts
 /**
 * Backend-agnostic collection registry.
@@ -1083,6 +936,35 @@ function projectResponseFields(rows, fields, collection, options) {
 		return projected;
 	});
 }
+/**
+* Both write checks, as one call, for a transport that is not the REST router.
+*
+* The REST routes run `assertKnownWriteFields` and `assertWriteValuesValid`
+* back to back on the caller's body, seven times over — and they were the only
+* place either ran. The WebSocket `SAVE` handler took a client payload straight
+* to `driver.save`, so the same write arrived validated through one door and
+* unvalidated through the other: `PATCH /api/data/users/1 { age: 999 }` was a
+* 400, and the socket wrote it.
+*
+* Exported for the sockets in `@rebasepro/server-postgres` and
+* `@rebasepro/server-mongo`, which are the other request boundaries. Not the
+* route builder — `index.ts` keeps that internal, and this is a rule rather
+* than wiring.
+*
+* It stays at the boundary rather than moving into the driver deliberately: it
+* validates what a *caller sent*, before `beforeSave` gets a chance to fill in
+* or rewrite anything. In-process writes through `rebase.data` are trusted
+* server code and are not run through it, which is the placement the REST layer
+* already chose.
+*
+* @param values     the caller's payload, exactly as it arrived
+* @param collection resolved from the registry by path — never the copy the
+*                   client sent, or the rules would be the caller's to pick
+*/
+function assertWriteRequestValid(values, collection) {
+	assertKnownWriteFields(values, collection);
+	assertWriteValuesValid(values, collection);
+}
 //#endregion
 //#region src/api/rest/idempotency.ts
 /**
@@ -1495,12 +1377,11 @@ var RestApiGenerator = class {
 				logical: queryOptions.logical,
 				limit: queryOptions.limit,
 				offset: queryOptions.offset,
-				orderBy: queryOptions.orderBy?.[0]?.field,
-				order: queryOptions.orderBy?.[0]?.direction === "desc" ? "desc" : "asc",
+				orderBy: orderByEntriesToTuples(queryOptions.orderBy),
 				searchString,
 				searchExplain,
 				vectorSearch: queryOptions.vectorSearch
-			}, queryOptions.include) : await this.fetchRawCollection(driver, resolvedCollection, queryOptions, searchString);
+			}, queryOptions.include) : await this.fetchRawCollection(driver, resolvedCollection, queryOptions, searchString, searchExplain);
 			const total = await this.countRawEntities(driver, resolvedCollection, queryOptions, searchString);
 			return c.json({
 				data: projectResponseFields(entities, queryOptions.fields, resolvedCollection, { include: queryOptions.include }),
@@ -1829,7 +1710,8 @@ var RestApiGenerator = class {
 					path: parsed.collectionPath,
 					filter: queryOptions.where,
 					logical: queryOptions.logical,
-					searchString
+					searchString,
+					vectorSearch: queryOptions.vectorSearch
 				}) : 0;
 				return c.json({ count: total });
 			} else if (parsed.id) {
@@ -1853,9 +1735,9 @@ var RestApiGenerator = class {
 					logical: queryOptions.logical,
 					limit: queryOptions.limit,
 					offset: queryOptions.offset,
-					orderBy: queryOptions.orderBy?.[0]?.field,
-					order: queryOptions.orderBy?.[0]?.direction === "desc" ? "desc" : "asc",
-					searchString
+					orderBy: orderByEntriesToTuples(queryOptions.orderBy),
+					searchString,
+					vectorSearch: queryOptions.vectorSearch
 				};
 				const entities = fetchService ? await fetchService.fetchCollectionForRest(parsed.collectionPath, listOptions, queryOptions.include) : await driver.fetchCollection({
 					path: parsed.collectionPath,
@@ -1865,7 +1747,8 @@ var RestApiGenerator = class {
 					path: parsed.collectionPath,
 					filter: queryOptions.where,
 					logical: queryOptions.logical,
-					searchString
+					searchString,
+					vectorSearch: queryOptions.vectorSearch
 				}) : entities.length;
 				const listCollection = this.resolveNestedWriteCollection(parsed.collectionPath);
 				return c.json({
@@ -1960,17 +1843,17 @@ var RestApiGenerator = class {
 	/**
 	* Fetch raw collection data without Entity wrapper (fallback for non-Postgres)
 	*/
-	async fetchRawCollection(driver, collection, queryOptions, searchString) {
+	async fetchRawCollection(driver, collection, queryOptions, searchString, searchExplain) {
 		return await driver.fetchCollection({
 			path: getCollectionDataPath(collection),
 			collection,
 			filter: queryOptions.where,
 			logical: queryOptions.logical,
 			limit: queryOptions.limit,
-			orderBy: queryOptions.orderBy?.[0]?.field,
-			order: queryOptions.orderBy?.[0]?.direction === "desc" ? "desc" : "asc",
-			startAfter: queryOptions.offset ? String(queryOptions.offset) : void 0,
+			orderBy: orderByEntriesToTuples(queryOptions.orderBy),
+			offset: queryOptions.offset,
 			searchString,
+			searchExplain,
 			vectorSearch: queryOptions.vectorSearch
 		});
 	}
@@ -1983,7 +1866,8 @@ var RestApiGenerator = class {
 			collection,
 			filter: queryOptions.where,
 			logical: queryOptions.logical,
-			searchString
+			searchString,
+			vectorSearch: queryOptions.vectorSearch
 		}) : 0;
 	}
 	/**
@@ -2439,6 +2323,129 @@ var LocalStorageController = class {
 	}
 };
 //#endregion
+//#region src/storage/storage-registry.ts
+/**
+* Storage Registry
+*
+* Manages multiple storage controllers for Rebase backend.
+* Allows different storage backends for different use cases.
+*
+* Usage:
+* - Single storage: Pass a single StorageController → maps to "(default)"
+* - Multiple storages: Pass a map of { storageId: StorageController }
+* - String properties use `storageId` in their config to specify which storage to use
+* - Properties without `storageId` fallback to "(default)"
+*/
+/**
+* The default storage identifier used when:
+* - A single storage controller is provided (not a map)
+* - A property doesn't specify a storageId
+*
+* An alias rather than a second `"(default)"` literal: the same string is the
+* registry key here, the source key a project declares in `rebase.json`, and
+* the scope baked into a download token. Two literals that must stay equal are
+* a divergence waiting to happen — and this one would silently unscope tokens.
+*/
+var DEFAULT_STORAGE_ID = DEFAULT_STORAGE_SOURCE_KEY;
+/**
+* A request named a storage source that is not registered.
+*
+* This used to be a `logger.warn` and a fallback to the default source, which
+* is the wrong answer in a way that is hard to notice: the caller asks for
+* `media`, the `storageAuthorize` hook is asked about `media`, and the bytes
+* are read from — or written to — `(default)`. A hook that widens access for
+* one named source therefore widens it for the default one, and the object the
+* hook approved is not the object the request touched. That is the same shape
+* as the non-canonical-key bypass: the check and the read disagree about which
+* object is in play.
+*
+* The failure is silent by construction. Both sources hold the *same key*,
+* because that is what makes a caller reach for a second source in the first
+* place, so the fallback returns plausible bytes rather than an error.
+*
+* It is also reachable without an attacker: a source declared in `rebase.json`
+* but not configured by the environment is skipped at boot and never
+* registered, while `GET /sources` still advertises it. The client asks for a
+* source it was told exists and silently gets a different bucket's contents.
+*
+* Carries `knownKeys` so the route layer can tell a typo from a source that was
+* declared but never configured — two different answers to the caller. The
+* registry itself does not know what was *declared*, only what was registered,
+* so it does not make that decision.
+*/
+var UnknownStorageSourceError = class extends Error {
+	storageId;
+	knownKeys;
+	constructor(storageId, knownKeys) {
+		super(`[StorageRegistry] Storage source "${storageId}" is not registered. Registered sources: ${knownKeys.length > 0 ? knownKeys.map((k) => `"${k}"`).join(", ") : "(none)"}.`);
+		this.storageId = storageId;
+		this.knownKeys = knownKeys;
+		this.name = "UnknownStorageSourceError";
+	}
+};
+/**
+* Default implementation of StorageRegistry
+*/
+var DefaultStorageRegistry = class DefaultStorageRegistry {
+	controllers = /* @__PURE__ */ new Map();
+	/**
+	* Create a StorageRegistry from either a single controller or a map
+	* @param input - Single StorageController (maps to "(default)") or Record<string, StorageController>
+	*/
+	static create(input) {
+		const registry = new DefaultStorageRegistry();
+		if (isStorageController(input)) registry.register(DEFAULT_STORAGE_ID, input);
+		else {
+			for (const [id, controller] of Object.entries(input)) if (isStorageController(controller)) registry.register(id, controller);
+			if (!registry.has(DEFAULT_STORAGE_ID) && registry.size() > 0) {
+				const firstId = Object.keys(input).find((k) => isStorageController(input[k]));
+				if (firstId) {
+					logger.warn(`[StorageRegistry] No "${DEFAULT_STORAGE_ID}" storage provided. Using "${firstId}" as the default.`);
+					registry.register(DEFAULT_STORAGE_ID, input[firstId]);
+				}
+			}
+		}
+		return registry;
+	}
+	register(id, controller) {
+		if (this.controllers.has(id)) logger.warn(`[StorageRegistry] Overwriting storage with id "${id}"`);
+		this.controllers.set(id, controller);
+	}
+	getDefault() {
+		const controller = this.controllers.get(DEFAULT_STORAGE_ID);
+		if (!controller) throw new Error(`[StorageRegistry] No default storage registered. Register one with id "${DEFAULT_STORAGE_ID}" or pass a single StorageController.`);
+		return controller;
+	}
+	get(id) {
+		return this.controllers.get(canonicalStorageId(id));
+	}
+	getOrDefault(id) {
+		const key = canonicalStorageId(id);
+		if (key === DEFAULT_STORAGE_ID) return this.getDefault();
+		const controller = this.controllers.get(key);
+		if (controller) return controller;
+		throw new UnknownStorageSourceError(key, this.list());
+	}
+	has(id) {
+		return this.controllers.has(canonicalStorageId(id));
+	}
+	list() {
+		return Array.from(this.controllers.keys());
+	}
+	size() {
+		return this.controllers.size;
+	}
+};
+/**
+* Type guard to check if an object is a StorageController
+* vs a Record<string, StorageController> (multiple storages)
+*/
+function isStorageController(obj) {
+	if (typeof obj !== "object" || obj === null) return false;
+	const controller = obj;
+	return typeof controller.putObject === "function" && typeof controller.getSignedUrl === "function" && typeof controller.deleteObject === "function" && typeof controller.listObjects === "function" && typeof controller.getType === "function";
+}
+//#endregion
 //#region src/storage/image-transform.ts
 /**
 * Image Transformation Service
@@ -2810,6 +2817,7 @@ var TusHandler = class {
 			throw new ApiError(400, "INVALID_STORAGE_BUCKET", err instanceof InvalidStorageBucketError ? err.message : "Invalid storage bucket");
 		}
 		const storageId = metadata.storageId || c.req.query("storageId") || void 0;
+		if (storageId !== void 0 && this.storageRegistry && !this.storageRegistry.has(canonicalStorageId(storageId))) throw new ApiError(400, "UNKNOWN_STORAGE_SOURCE", `Unknown storage source "${storageId}". Available: ${this.storageRegistry.list().map((k) => `"${k}"`).join(", ") || "(none)"}.`, void 0, true);
 		if (this.authorizeUpload) await this.authorizeUpload(c, key, bucket || "default", storageId);
 		const filePath = join(this.tusDir, id);
 		await writeFile(filePath, Buffer.alloc(0));
@@ -2912,7 +2920,12 @@ var TusHandler = class {
 	async finalize(upload) {
 		const storageId = upload.storageId;
 		let targetController = this.storageController;
-		if (this.storageRegistry) targetController = storageId ? this.storageRegistry.getOrDefault(storageId) : this.storageRegistry.getDefault();
+		if (this.storageRegistry) try {
+			targetController = storageId ? this.storageRegistry.getOrDefault(storageId) : this.storageRegistry.getDefault();
+		} catch (err) {
+			if (!(err instanceof UnknownStorageSourceError)) throw err;
+			targetController = void 0;
+		}
 		if (!targetController) {
 			logger.error("[TUS] Upload received but no StorageController is configured — nothing can be written", {
 				uploadId: upload.id,
@@ -3074,8 +3087,8 @@ function canonicalKeyOrBadRequest(key) {
 * The bucket's counterpart to {@link canonicalKeyOrBadRequest}, and it exists
 * for the same reason: the value routes a write, so it has to be checked where
 * it enters rather than where it is used. Applied at every entry point a bucket
-* has — this route's multipart body, the `?bucket=` query, and the TUS
-* `Upload-Metadata` header.
+* has — this route's multipart body, the folder route's JSON body, the
+* `?bucket=` query, and the TUS `Upload-Metadata` header.
 */
 function canonicalBucketOrBadRequest(bucket) {
 	try {
@@ -3175,13 +3188,46 @@ function createStorageRoutes(config) {
 		if (!allowed) throw ApiError.forbidden("Not authorized for this object");
 	};
 	/**
-	* Resolve the storage controller for a request.
-	* Looks up by `storageId` in the registry, falls back to the single
-	* controller, and finally to the registry default.
+	* Resolve the storage controller for a request, or refuse the request.
+	*
+	* A `storageId` that names no registered source used to fall back to the
+	* default one. That is silently wrong: the `storageAuthorize` hook is asked
+	* about the source the caller named while the bytes come from `(default)`,
+	* so the object the hook approved is not the object the request touched —
+	* and because the two sources hold the same key, the fallback returns
+	* plausible bytes instead of an error.
+	*
+	* The caller gets one of two answers, because they are two different
+	* problems with two different fixes:
+	*
+	* - **501** if the source *is* declared in `rebase.json` but has no
+	*   credentials in this environment. It was skipped at boot rather than
+	*   crash-looping the backend, but `GET /sources` still advertises it, so a
+	*   client asking for it is not confused — the deployment is incomplete.
+	*   501 (not 503) for the same reason the whole-storage stub uses it: this
+	*   is permanent until someone configures it, and the client's offline
+	*   queue retries 503 forever.
+	* - **400** otherwise. The id names nothing this deployment has ever heard
+	*   of, which is a caller mistake. `expected`, so one client holding a
+	*   stale source name does not write a warning per request forever.
 	*/
+	const declaredKeys = new Set((declaredSources ?? []).map((s) => s.key));
+	const refuseUnknownSource = (storageId, knownKeys) => {
+		if (declaredKeys.has(storageId)) throw new ApiError(501, "STORAGE_SOURCE_NOT_CONFIGURED", `Storage source "${storageId}" is declared but not configured on this deployment, so it cannot be read from or written to. Set its credentials (the ${storageId} suffixed environment variables) and redeploy.`);
+		throw new ApiError(400, "UNKNOWN_STORAGE_SOURCE", `Unknown storage source "${storageId}". Available: ${knownKeys.length > 0 ? knownKeys.map((k) => `"${k}"`).join(", ") : "(none)"}.`, void 0, true);
+	};
 	const resolveController = (storageId) => {
-		if (registry) return registry.getOrDefault(storageId);
-		if (controller) return controller;
+		if (registry) try {
+			return registry.getOrDefault(storageId);
+		} catch (err) {
+			if (err instanceof UnknownStorageSourceError) return refuseUnknownSource(err.storageId, err.knownKeys);
+			throw err;
+		}
+		if (controller) {
+			const requested = canonicalStorageId(storageId);
+			if (requested !== "(default)") return refuseUnknownSource(requested, [DEFAULT_STORAGE_SOURCE_KEY]);
+			return controller;
+		}
 		throw new Error("No storage controller or registry available");
 	};
 	/** Get the default controller (used for TUS and base-path derivation). */
@@ -3263,7 +3309,7 @@ function createStorageRoutes(config) {
 		const transformKeyPrefix = `${storageId || "(default)"}/${bucket}/${resolvedPath}`;
 		const transformOpts = transformOptionsOrBadRequest(c.req.query());
 		if (resolved.getType() === "local") {
-			const absolutePath = resolved.getAbsolutePath(resolvedPath, bucket);
+			const absolutePath = resolved.getAbsolutePath(resolvedPath, bucket ?? "default");
 			try {
 				await fsp.access(absolutePath);
 			} catch {
@@ -3324,7 +3370,7 @@ function createStorageRoutes(config) {
 			const scopedPath = `${bucket}/${resolvedPath}`;
 			if (isPublicStoragePath(scopedPath)) downloadConfig.metadata.public = true;
 			else {
-				downloadConfig.metadata.token = generateDownloadToken(scopedPath, 300);
+				downloadConfig.metadata.token = generateDownloadToken(scopedPath, 300, storageId);
 				downloadConfig.metadata.tokenExpiresIn = 300;
 			}
 		}
@@ -3384,9 +3430,10 @@ function createStorageRoutes(config) {
 		const storageId = typeof body.storageId === "string" ? body.storageId : c.req.query("storageId");
 		if (!folderPath || typeof folderPath !== "string") throw ApiError.badRequest("Folder path is required");
 		const resolved = resolveController(storageId);
-		const { bucket, resolvedPath } = parseBucketAndPath(folderPath);
+		const { resolvedPath } = parseBucketAndPath(folderPath);
+		const bucket = canonicalBucketOrBadRequest(typeof body.bucket === "string" ? body.bucket : void 0);
 		if (!resolvedPath || resolvedPath.trim() === "") throw ApiError.badRequest("Invalid folder path");
-		await checkAuthorized(c, "write", resolvedPath, bucket, storageId);
+		await checkAuthorized(c, "write", resolvedPath, bucket ?? "default", storageId);
 		if (resolved.getType() === "local") {
 			const absolutePath = resolved.getAbsolutePath(resolvedPath, bucket);
 			fs$1.mkdirSync(absolutePath, { recursive: true });
@@ -3395,7 +3442,8 @@ function createStorageRoutes(config) {
 			const emptyFile = new File([], key, { type: "application/x-directory" });
 			await resolved.putObject({
 				file: emptyFile,
-				key
+				key,
+				bucket
 			});
 		}
 		return c.json({
@@ -3446,77 +3494,6 @@ function createStorageRoutes(config) {
 	return router;
 }
 //#endregion
-//#region src/storage/storage-registry.ts
-/**
-* The default storage identifier used when:
-* - A single storage controller is provided (not a map)
-* - A property doesn't specify a storageId
-*/
-var DEFAULT_STORAGE_ID = "(default)";
-/**
-* Default implementation of StorageRegistry
-*/
-var DefaultStorageRegistry = class DefaultStorageRegistry {
-	controllers = /* @__PURE__ */ new Map();
-	/**
-	* Create a StorageRegistry from either a single controller or a map
-	* @param input - Single StorageController (maps to "(default)") or Record<string, StorageController>
-	*/
-	static create(input) {
-		const registry = new DefaultStorageRegistry();
-		if (isStorageController(input)) registry.register(DEFAULT_STORAGE_ID, input);
-		else {
-			for (const [id, controller] of Object.entries(input)) if (isStorageController(controller)) registry.register(id, controller);
-			if (!registry.has("(default)") && registry.size() > 0) {
-				const firstId = Object.keys(input).find((k) => isStorageController(input[k]));
-				if (firstId) {
-					logger.warn(`[StorageRegistry] No "${DEFAULT_STORAGE_ID}" storage provided. Using "${firstId}" as the default.`);
-					registry.register(DEFAULT_STORAGE_ID, input[firstId]);
-				}
-			}
-		}
-		return registry;
-	}
-	register(id, controller) {
-		if (this.controllers.has(id)) logger.warn(`[StorageRegistry] Overwriting storage with id "${id}"`);
-		this.controllers.set(id, controller);
-	}
-	getDefault() {
-		const controller = this.controllers.get(DEFAULT_STORAGE_ID);
-		if (!controller) throw new Error(`[StorageRegistry] No default storage registered. Register one with id "${DEFAULT_STORAGE_ID}" or pass a single StorageController.`);
-		return controller;
-	}
-	get(id) {
-		if (id === void 0 || id === null) return this.controllers.get(DEFAULT_STORAGE_ID);
-		return this.controllers.get(id);
-	}
-	getOrDefault(id) {
-		if (id === void 0 || id === null) return this.getDefault();
-		const controller = this.controllers.get(id);
-		if (controller) return controller;
-		logger.warn(`[StorageRegistry] Storage "${id}" not found, falling back to "${DEFAULT_STORAGE_ID}"`);
-		return this.getDefault();
-	}
-	has(id) {
-		return this.controllers.has(id);
-	}
-	list() {
-		return Array.from(this.controllers.keys());
-	}
-	size() {
-		return this.controllers.size;
-	}
-};
-/**
-* Type guard to check if an object is a StorageController
-* vs a Record<string, StorageController> (multiple storages)
-*/
-function isStorageController(obj) {
-	if (typeof obj !== "object" || obj === null) return false;
-	const controller = obj;
-	return typeof controller.putObject === "function" && typeof controller.getSignedUrl === "function" && typeof controller.deleteObject === "function" && typeof controller.listObjects === "function" && typeof controller.getType === "function";
-}
-//#endregion
 //#region src/storage/index.ts
 /**
 * Create a storage controller from a config object.
@@ -3610,7 +3587,7 @@ function assertStorageAccessControlConfigured(state, isProduction) {
 */
 async function mountOpenApiDocs(app, basePath, enableSwagger, serverCollections, requireAuth) {
 	if (enableSwagger === false || serverCollections.length === 0) return;
-	const { generateOpenApiSpec } = await import("./openapi-generator-DPKtUC9X.js");
+	const { generateOpenApiSpec } = await import("./openapi-generator-BWL8F2La.js");
 	app.get(`${basePath}/docs`, (c) => {
 		const spec = generateOpenApiSpec(serverCollections, {
 			basePath,
@@ -5092,9 +5069,15 @@ var SDKQueryBuilder = class {
 	}
 	/**
 	* Order the results by a specific column.
+	*
+	* Call it again to add a tie-breaker rather than replace the sort: keys
+	* apply in the order they were added, so
+	* `.orderBy("roles").orderBy("created_at", "desc")` sorts by role and
+	* shows the newest first within each one.
 	*/
 	orderBy(column, direction = "asc") {
-		this.params.orderBy = [column, direction];
+		const existing = normalizeOrderBy(this.params.orderBy) ?? [];
+		this.params.orderBy = [...existing, [column, direction]];
 		return this;
 	}
 	/**
@@ -5409,8 +5392,7 @@ function createCollectionClient(transport, slug, ws) {
 				logical: params?.logical,
 				limit: params?.limit,
 				offset: window.driverOffset,
-				orderBy: params?.orderBy?.[0],
-				order: params?.orderBy?.[1],
+				orderBy: normalizeOrderBy(params?.orderBy),
 				searchString: params?.searchString,
 				searchExplain: params?.searchExplain
 			}, (incomingRows) => {
@@ -7896,23 +7878,30 @@ function matchesParams(row, params) {
 * not shuffle rows between pages.
 */
 function sortRows(rows, orderBy) {
-	if (!orderBy) return rows;
-	const [field, direction = "asc"] = orderBy;
-	const sign = direction === "desc" ? -1 : 1;
+	const keys = normalizeOrderBy(orderBy);
+	if (!keys) return rows;
 	return rows.sort((a, b) => {
-		const av = a[field];
-		const bv = b[field];
-		const aNull = isNullish(toComparable(av));
-		const bNull = isNullish(toComparable(bv));
-		if (aNull || bNull) {
-			if (aNull && bNull) return tiebreak(a, b);
-			return (aNull ? 1 : -1) * (direction === "desc" ? -1 : 1);
-		}
-		const cmp = compareValues(av, bv);
-		if (cmp === void 0 || cmp === 0) return tiebreak(a, b);
-		return cmp * sign;
+		for (const [field, direction = "asc"] of keys) {
+			const cmp = compareOnKey(a, b, field, direction);
+			if (cmp !== 0) return cmp;
+		}
+		return tiebreak(a, b);
 	});
 }
+/** One key's verdict: negative, positive, or 0 for "these two are equal here". */
+function compareOnKey(a, b, field, direction) {
+	const av = a[field];
+	const bv = b[field];
+	const aNull = isNullish(toComparable(av));
+	const bNull = isNullish(toComparable(bv));
+	if (aNull || bNull) {
+		if (aNull && bNull) return 0;
+		return (aNull ? 1 : -1) * (direction === "desc" ? -1 : 1);
+	}
+	const cmp = compareValues(av, bv);
+	if (cmp === void 0 || cmp === 0) return 0;
+	return cmp * (direction === "desc" ? -1 : 1);
+}
 function tiebreak(a, b) {
 	return compareValues(a.id, b.id) ?? 0;
 }
@@ -8009,17 +7998,16 @@ function isExactlyEvaluable(params) {
 * comparator.
 */
 function isLocallySortable(rows, orderBy) {
-	if (!orderBy) return true;
-	const [field] = orderBy;
-	for (const row of rows) {
+	const keys = normalizeOrderBy(orderBy);
+	if (!keys) return true;
+	return keys.every(([field]) => rows.every((row) => {
 		const value = toComparable(row[field]);
-		if (isNullish(value)) continue;
-		if (typeof value === "number" || typeof value === "boolean") continue;
-		if (typeof value === "bigint") continue;
-		if (typeof value === "string" && value.trim() !== "" && !Number.isNaN(Number(value))) continue;
+		if (isNullish(value)) return true;
+		if (typeof value === "number" || typeof value === "boolean") return true;
+		if (typeof value === "bigint") return true;
+		if (typeof value === "string" && value.trim() !== "" && !Number.isNaN(Number(value))) return true;
 		return false;
-	}
-	return true;
+	}));
 }
 /** Run a full query — filter, sort, paginate — over a set of rows. */
 function runLocalQuery(rows, params) {
@@ -10185,7 +10173,7 @@ async function _initializeRebaseBackend(config) {
 			]) {
 				const providerConfig = safeAuthConfig[key];
 				if (providerConfig && requiredFields.every((f) => Boolean(providerConfig[f]))) {
-					const createFn = (await import("./auth-CYoPVf-E.js").then((n) => n.t))[factory];
+					const createFn = (await import("./auth-BQcdhMBL.js").then((n) => n.t))[factory];
 					oauthProviders.push(createFn(providerConfig));
 				}
 			}
@@ -10463,7 +10451,7 @@ async function _initializeRebaseBackend(config) {
 	if (config.functionsDir) {
 		const { loadFunctionsWithDiagnostics } = await import("./function-loader-DDS1v7YX.js").then((n) => n.t);
 		const { createFunctionRoutes } = await import("./function-routes-Btcez1T-.js").then((n) => n.n);
-		const { createFunctionsRequestTimeout, resolveFunctionsTimeoutMs } = await import("./request-timeout-RivJsME0.js");
+		const { createFunctionsRequestTimeout, resolveFunctionsTimeoutMs } = await import("./request-timeout-BuFoEKwT.js");
 		const { functions: loadedFunctions, problems } = await loadFunctionsWithDiagnostics(config.functionsDir);
 		const functionsRouter = new Hono();
 		functionsRouter.onError(errorHandler);
@@ -10502,7 +10490,7 @@ async function _initializeRebaseBackend(config) {
 		const { loadCronJobsWithDiagnostics } = await import("./cron-loader-YhhQeVBM.js").then((n) => n.t);
 		const { CronScheduler } = await import("./cron-scheduler-DIpYBmZP.js").then((n) => n.n);
 		const { createCronRoutes } = await import("./cron-routes-maM_RlUu.js").then((n) => n.n);
-		const { createCronStore } = await import("./cron-store-Dvr4Y1sZ.js").then((n) => n.n);
+		const { createCronStore } = await import("./cron-store-D5dUNviq.js").then((n) => n.n);
 		const { jobs: loadedCronJobs, problems: cronProblems } = await loadCronJobsWithDiagnostics(config.cronsDir);
 		cronScheduler = new CronScheduler();
 		cronScheduler.setClient(serverSingleton);
@@ -13411,6 +13399,6 @@ async function ensureCollectionPolicies(bundle, dataSources, env) {
 	else logger.debug("RLS policies are up to date.");
 }
 //#endregion
-export { ApiError, BlockedUrlError, BundleError, CronScheduler, DEFAULT_DRIVER_ID, DEFAULT_MAX_FILE_SIZE, DEFAULT_STORAGE_ID, DOCUMENT_MIME_TYPES, DefaultDriverRegistry, DefaultStorageRegistry, GCSStorageController, IMAGE_MIME_TYPES, LocalStorageController, MetricsRegistry, RawHtml, S3StorageController, SMTPEmailService, TransformCache, TusHandler, WebhookDispatcher, _resetRebaseMock, _setRebaseMock, applyCollectionDefaults, assertAllowedOutboundUrl, assertCollectionConfigs, assertDistinctSuffixes, assertEmailLinkBases, authJwt, authRoles, authUid, blockedAddressReason, bootFromBundle, classifySurface, cleanupDevPortFile, createAppleProvider, createBackupRoutes, createBitbucketProvider, createBuiltinAuthAdapter, createContractRoutes, createCronRoutes, createCronStore, createCustomAuthAdapter, createDiscordProvider, createEmailService, createFacebookProvider, createFunctionRoutes, createGitHubProvider, createGitLabProvider, createGoogleProvider, createHistoryRoutes, createLinkedinProvider, createMetricsMiddleware, createMetricsRoutes, createMicrosoftProvider, createSlackProvider, createSourceBundle, createSpotifyProvider, createStorageController, createStorageRoutes, createTwitterProvider, defineCron, defineFunction, envSuffixForKey, errorHandler, escapeHtml, extractUserFromToken, fileTokenAuth, findCollectionConfigProblems, generateSecurePassword, getEmailVerificationTemplate, getMagicLinkTemplate, getPasswordResetTemplate, getUserInvitationTemplate, getWelcomeEmailTemplate, hashPassword, html, httpMethodToOperation, initializeDataSource, initializeDataSources, initializeRebaseBackend, installShutdownHandlers, isApiKeyToken, isAuthAdapter, isDatabaseAdapter, isLocalhostOrigin, isOperationAllowed, isTransformableImage, listBackupObjects, listenWithPortRetry, loadBootEnv, loadBundle, loadBundleConfigExports, loadBundleSchema, loadCollectionsFromDirectory, loadCronJobsFromDirectory, loadCronJobsWithDiagnostics, loadDeclaredStorageSources, loadEnv, loadFunctionsFromDirectory, loadUsersCollection, logger, oauthCodeFlowSchema, optionalAuth, parseBackupDestination, parseBackupTimestamp, parseTransformOptions, pkceTokenParams, providerVerifiedEmail, queryTokenAuth, raw, readBackupBytes, readBundleManifest, rebase, requireAdmin, requireAuth, resolveAuthHooks, resolveAuthOptions, resolveCorsOrigin, resolveDataSources, resolveEmailLinkBase, resolveEmailOptions, resolveRequireAuth, resolveStorageBackend, resolveStorageSources, runFromBundle, safeCompare, serveSPA, transformImage, tryVerifyOidcIdToken, unknownKeyPolicyFromEnv, validateApiKey, validateCronExpression, validatePasswordStrength, verifyOidcIdToken, verifyPassword };
+export { ApiError, BlockedUrlError, BundleError, CronScheduler, DEFAULT_DRIVER_ID, DEFAULT_MAX_FILE_SIZE, DEFAULT_STORAGE_ID, DOCUMENT_MIME_TYPES, DefaultDriverRegistry, DefaultStorageRegistry, GCSStorageController, IMAGE_MIME_TYPES, LocalStorageController, MetricsRegistry, RawHtml, S3StorageController, SMTPEmailService, TransformCache, TusHandler, UnknownStorageSourceError, WebhookDispatcher, _resetRebaseMock, _setRebaseMock, applyCollectionDefaults, assertAllowedOutboundUrl, assertCollectionConfigs, assertDistinctSuffixes, assertEmailLinkBases, assertWriteRequestValid, authJwt, authRoles, authUid, blockedAddressReason, bootFromBundle, classifySurface, cleanupDevPortFile, createAppleProvider, createBackupRoutes, createBitbucketProvider, createBuiltinAuthAdapter, createContractRoutes, createCronRoutes, createCronStore, createCustomAuthAdapter, createDiscordProvider, createEmailService, createFacebookProvider, createFunctionRoutes, createGitHubProvider, createGitLabProvider, createGoogleProvider, createHistoryRoutes, createLinkedinProvider, createMetricsMiddleware, createMetricsRoutes, createMicrosoftProvider, createSlackProvider, createSourceBundle, createSpotifyProvider, createStorageController, createStorageRoutes, createTwitterProvider, defineCron, defineFunction, envSuffixForKey, errorHandler, escapeHtml, extractUserFromToken, fileTokenAuth, findCollectionConfigProblems, generateSecurePassword, getEmailVerificationTemplate, getMagicLinkTemplate, getPasswordResetTemplate, getUserInvitationTemplate, getWelcomeEmailTemplate, hashPassword, html, httpMethodToOperation, initializeDataSource, initializeDataSources, initializeRebaseBackend, installShutdownHandlers, isApiKeyToken, isAuthAdapter, isDatabaseAdapter, isLocalhostOrigin, isOperationAllowed, isTransformableImage, listBackupObjects, listenWithPortRetry, loadBootEnv, loadBundle, loadBundleConfigExports, loadBundleSchema, loadCollectionsFromDirectory, loadCronJobsFromDirectory, loadCronJobsWithDiagnostics, loadDeclaredStorageSources, loadEnv, loadFunctionsFromDirectory, loadUsersCollection, logger, oauthCodeFlowSchema, optionalAuth, parseBackupDestination, parseBackupTimestamp, parseTransformOptions, pkceTokenParams, providerVerifiedEmail, queryTokenAuth, raw, readBackupBytes, readBundleManifest, rebase, requireAdmin, requireAuth, resolveAuthHooks, resolveAuthOptions, resolveCorsOrigin, resolveDataSources, resolveEmailLinkBase, resolveEmailOptions, resolveRequireAuth, resolveStorageBackend, resolveStorageSources, runFromBundle, safeCompare, serveSPA, transformImage, tryVerifyOidcIdToken, unknownKeyPolicyFromEnv, validateApiKey, validateCronExpression, validatePasswordStrength, verifyOidcIdToken, verifyPassword };
 
 //# sourceMappingURL=index.es.js.map