@rebasepro/server 0.17.3 → 0.18.0

package/dist/src-DHK4fHkw.js

@@ -0,0 +1,1002 @@
+import { createRequire as __rebaseCreateRequire } from "module";
+import __rebaseProcess from "process";
+globalThis.process ??= __rebaseProcess;
+__rebaseCreateRequire(import.meta.url);
+//#region ../types/src/types/filter-operators.ts
+/** The wire spelling of a {@link RelationAggregateSort}: `min(applications.created_at)`. */
+var RELATION_AGGREGATE_SORT_PATTERN = /^(min|max|count|sum|avg)\(([^().]+)(?:\.([^()]+))?\)$/;
+/**
+* A {@link RelationAggregateSort} as a single string — `min(applications.created_at)`,
+* `count(applications)`.
+*
+* The wire form is a string because every layer below the call site already is
+* one: `OrderByTuple` is `[string, direction]`, the REST parameter is
+* `?orderBy=key:direction`, the driver contract takes `orderBy?: string |
+* OrderByTuple[]`, and a cursor names its keys by string. `_score` established
+* the same pattern — a sort key that is not a column, spelled as one — and this
+* reuses it rather than widening five signatures to carry an object that would
+* be flattened at the end anyway.
+*
+* SQL's own spelling, so the key reads as what it compiles to. Neither `:` nor
+* `,` appears in it, which is what keeps it safe in the colon-delimited wire
+* shorthand.
+*
+* @group Models
+*/
+function encodeRelationAggregateSort(sort) {
+	return `${sort.agg}(${sort.relation}${sort.field ? `.${sort.field}` : ""})`;
+}
+/**
+* Read the string spelling back, or `undefined` if it is not one.
+*
+* `undefined` rather than a throw: this is asked of *every* sort key to find
+* out which kind it is, and an ordinary column name is not an error.
+*
+* @group Models
+*/
+function parseRelationAggregateSort(key) {
+	const match = RELATION_AGGREGATE_SORT_PATTERN.exec(key);
+	if (!match) return void 0;
+	const [, agg, relation, field] = match;
+	if (!field && agg !== "count") return void 0;
+	return {
+		agg,
+		relation,
+		...field && { field }
+	};
+}
+/** Is this sort key the object form rather than a field name? */
+function isRelationAggregateSort(key) {
+	return typeof key === "object" && key !== null && typeof key.relation === "string" && typeof key.agg === "string";
+}
+/** A sort key in the single-string form every layer below the call site speaks. */
+function sortKeyToString(key) {
+	return isRelationAggregateSort(key) ? encodeRelationAggregateSort(key) : key;
+}
+/** Maps canonical operators to their REST short-code equivalents. */
+var CANONICAL_TO_REST = {
+	"==": "eq",
+	"!=": "neq",
+	">": "gt",
+	">=": "gte",
+	"<": "lt",
+	"<=": "lte",
+	"in": "in",
+	"not-in": "nin",
+	"array-contains": "cs",
+	"array-contains-any": "csa",
+	"like": "like",
+	"ilike": "ilike",
+	"not-like": "nlike",
+	"not-ilike": "nilike",
+	"is-null": "isnull",
+	"is-not-null": "notnull"
+};
+/** Maps REST short-code operators to their canonical equivalents. */
+var REST_TO_CANONICAL = {
+	"eq": "==",
+	"neq": "!=",
+	"gt": ">",
+	"gte": ">=",
+	"lt": "<",
+	"lte": "<=",
+	"in": "in",
+	"nin": "not-in",
+	"cs": "array-contains",
+	"csa": "array-contains-any",
+	"like": "like",
+	"ilike": "ilike",
+	"nlike": "not-like",
+	"nilike": "not-ilike",
+	"isnull": "is-null",
+	"notnull": "is-not-null"
+};
+/**
+* Operators that test for null/not-null and therefore ignore their value.
+* Codecs normalize the value of these conditions to `null`.
+*/
+var NULL_OPS = /* @__PURE__ */ new Set(["is-null", "is-not-null"]);
+/**
+* Every canonical operator, in a stable order. Useful for engine capability
+* declarations ({@link DataSourceCapabilities.filterOperators}) and for
+* building operator subsets.
+* @group Models
+*/
+var ALL_WHERE_FILTER_OPS = [
+	"<",
+	"<=",
+	"==",
+	"!=",
+	">=",
+	">",
+	"in",
+	"not-in",
+	"array-contains",
+	"array-contains-any",
+	"like",
+	"ilike",
+	"not-like",
+	"not-ilike",
+	"is-null",
+	"is-not-null"
+];
+/** All canonical operator strings for runtime validation. */
+var CANONICAL_OPS = new Set(ALL_WHERE_FILTER_OPS);
+/**
+* The REST table as a `Map`, because the key `toCanonicalOp` is handed comes
+* off the wire.
+*
+* Indexed as a plain object, every `Object.prototype` member answered:
+* `toCanonicalOp("valueOf")` returned the inherited *function* as though it
+* were a `WhereFilterOp`, and every caller here treats a defined result as
+* "known operator". Same defect the REST codec's own lookup tables were
+* converted away from in `filter-dialect.ts`; this is the copy that survived
+* one package over, and it now sits under the operator validation the REST
+* parser does, which would otherwise have admitted `["constructor", x]`.
+*/
+var REST_OP_LOOKUP = new Map(Object.entries(REST_TO_CANONICAL));
+/**
+* Resolve any operator string (canonical or REST short-code) to its
+* canonical `WhereFilterOp` form. Returns `undefined` for unknown operators.
+*
+* @example
+* toCanonicalOp("==")   // "=="
+* toCanonicalOp("eq")   // "=="
+* toCanonicalOp("cs")   // "array-contains"
+* toCanonicalOp("xyz")  // undefined
+*/
+function toCanonicalOp(op) {
+	if (CANONICAL_OPS.has(op)) return op;
+	return REST_OP_LOOKUP.get(op);
+}
+//#endregion
+//#region ../types/src/types/data_source.ts
+/**
+* The default data-source key, used when a collection does not name a
+* `dataSource`. Shared by the frontend router and the backend driver
+* registry so both agree on "the default database".
+* @group Models
+*/
+var DEFAULT_DATA_SOURCE_KEY = "(default)";
+/**
+* Relation kinds assumed filterable when a driver does not say.
+*
+* `belongsTo` alone: its filter is a comparison on a column of the row being
+* filtered, the one shape that needs no query construction a driver might not
+* have. Everything else is a correlated subquery over another table.
+*
+* @group Models
+*/
+var DEFAULT_FILTERABLE_RELATION_KINDS = ["belongsTo"];
+/** @group Models */
+var POSTGRES_CAPABILITIES = {
+	key: "postgres",
+	label: "PostgreSQL",
+	supportsRelations: true,
+	supportsSubcollections: false,
+	supportsRLS: true,
+	supportsReferences: false,
+	supportsColumnTypes: true,
+	supportsRealtime: true,
+	supportsVectors: true,
+	filterOperators: ALL_WHERE_FILTER_OPS,
+	filterableRelationKinds: [
+		"belongsTo",
+		"manyToMany",
+		"hasMany",
+		"hasOne"
+	],
+	supportsRelationFieldFilters: true,
+	relationAggregateSorts: true,
+	supportsSQLAdmin: true,
+	supportsDocumentAdmin: false,
+	supportsSchemaAdmin: true
+};
+/** @group Models */
+var FIREBASE_CAPABILITIES = {
+	key: "firestore",
+	label: "Firebase / Firestore",
+	supportsRelations: false,
+	supportsSubcollections: true,
+	supportsRLS: false,
+	supportsReferences: true,
+	supportsColumnTypes: false,
+	supportsRealtime: true,
+	supportsVectors: false,
+	filterOperators: ALL_WHERE_FILTER_OPS.filter((op) => op !== "like" && op !== "ilike" && op !== "not-like" && op !== "not-ilike"),
+	filterableRelationKinds: [],
+	supportsRelationFieldFilters: false,
+	relationAggregateSorts: false,
+	supportsSQLAdmin: false,
+	supportsDocumentAdmin: false,
+	supportsSchemaAdmin: false
+};
+/** @group Models */
+var MONGODB_CAPABILITIES = {
+	key: "mongodb",
+	label: "MongoDB",
+	supportsRelations: false,
+	supportsSubcollections: true,
+	supportsRLS: false,
+	supportsReferences: true,
+	supportsColumnTypes: false,
+	supportsRealtime: false,
+	supportsVectors: false,
+	filterOperators: ALL_WHERE_FILTER_OPS,
+	filterableRelationKinds: [],
+	supportsRelationFieldFilters: false,
+	relationAggregateSorts: false,
+	supportsSQLAdmin: false,
+	supportsDocumentAdmin: true,
+	supportsSchemaAdmin: true
+};
+/**
+* Fallback capabilities when the driver is unknown.
+* Enables everything so nothing is hidden unexpectedly.
+* @group Models
+*/
+var DEFAULT_CAPABILITIES = {
+	key: "(default)",
+	label: "Default",
+	supportsRelations: true,
+	supportsSubcollections: true,
+	supportsRLS: true,
+	supportsReferences: true,
+	supportsColumnTypes: true,
+	supportsRealtime: true,
+	supportsVectors: true,
+	filterOperators: ALL_WHERE_FILTER_OPS,
+	filterableRelationKinds: DEFAULT_FILTERABLE_RELATION_KINDS,
+	supportsRelationFieldFilters: false,
+	relationAggregateSorts: false,
+	supportsSQLAdmin: true,
+	supportsDocumentAdmin: true,
+	supportsSchemaAdmin: true
+};
+var CAPABILITIES_REGISTRY = {
+	postgres: POSTGRES_CAPABILITIES,
+	firestore: FIREBASE_CAPABILITIES,
+	mongodb: MONGODB_CAPABILITIES,
+	"(default)": DEFAULT_CAPABILITIES
+};
+/**
+* Look up capabilities for a given engine key.
+* If `engine` is undefined or not found, returns `DEFAULT_CAPABILITIES`.
+* @group Models
+*/
+function getDataSourceCapabilities(engine) {
+	if (!engine) return POSTGRES_CAPABILITIES;
+	return CAPABILITIES_REGISTRY[engine] ?? DEFAULT_CAPABILITIES;
+}
+//#endregion
+//#region ../types/src/types/collections.ts
+/**
+* Type guard for PostgreSQL collections.
+* Returns true if the collection uses the Postgres engine (or the default engine).
+*
+* Generic over the *input* type, and narrows by intersection rather than
+* replacement. Narrowing to a bare `PostgresCollectionConfig` discarded whatever
+* the caller actually had — most visibly the admin panel's view model, whose
+* flattened presentation fields vanished the moment a collection passed through
+* one of these guards.
+*
+* @group Models
+*/
+function isPostgresCollectionConfig(collection) {
+	return !collection.engine || collection.engine === "postgres";
+}
+/**
+* Narrows to the SQL collection fields — `table`, `relations`,
+* `disableDefaultPolicies` — by asking the engine's declared capabilities
+* rather than by naming Postgres.
+*
+* The two halves of this already existed and were never joined. The engine
+* split (`PostgresCollectionConfig` / `FirebaseCollectionConfig` /
+* `MongoDBCollectionConfig`) said which fields belong to which engine at the
+* type level; {@link DataSourceCapabilities} said the same thing at runtime,
+* down to a `supportsRelations` flag. So call sites guarded on the capability
+* and then read a field the base type had to declare for them — which is why
+* those fields were on the base, and why a MongoDB collection could be written
+* with a `table`.
+*
+* Prefer this over {@link isPostgresCollectionConfig} wherever the question is
+* "does this collection live in a SQL table", so a custom SQL engine
+* registered through `registerDataSourceCapabilities` is included.
+*
+* @group Models
+*/
+function isRelationalCollectionConfig(collection) {
+	return getDataSourceCapabilities(collection.engine).supportsRelations;
+}
+/**
+* Type guard for Firebase / Firestore collections.
+* @group Models
+*/
+function isFirebaseCollectionConfig(collection) {
+	return collection.engine === "firestore";
+}
+/**
+* Type guard for MongoDB collections.
+* @group Models
+*/
+function isMongoDBCollectionConfig(collection) {
+	return collection.engine === "mongodb";
+}
+/**
+* Returns the data path for a collection.
+* For Firestore or MongoDB collections with a `path`, returns that value;
+* otherwise falls back to `slug`.
+*/
+function getCollectionDataPath(collection) {
+	if (isFirebaseCollectionConfig(collection) && collection.path) return collection.path;
+	if (isMongoDBCollectionConfig(collection) && collection.path) return collection.path;
+	return collection.slug;
+}
+/**
+* Reads a collection's driver-declared subcollections thunk (the `subcollections`
+* field) independent of engine identity, so engine-agnostic code doesn't have to
+* type-guard against a specific driver. Returns `undefined` when the collection
+* declares none.
+*
+* Pair with `getDataSourceCapabilities(engine).supportsSubcollections` to decide
+* whether the engine honours subcollections at all before reading them.
+* @group Models
+*/
+function getDeclaredSubcollections(collection) {
+	return collection.subcollections;
+}
+//#endregion
+//#region ../types/src/types/rls-functions.ts
+/**
+* The SQL helper functions RLS policies call, and the schema they live in.
+*
+* ## One schema, and it is ours
+*
+* Rebase creates exactly one schema in a project's database: `rebase`. These
+* three functions live in it alongside the framework's own tables, and that is
+* the whole contract — a reader can look at a database and know precisely which
+* namespace belongs to the framework and that nothing else was touched.
+*
+* It used to be two. `uid()`, `jwt()` and `roles()` sat in a schema called
+* `auth`, which is Supabase's name, chosen so that a developer who had written
+* Supabase RLS would recognise `auth.uid()`. The familiarity was real but the
+* name was not Rebase's to take, and taking it had a concrete cost: pointing
+* Rebase at a database that already had a Supabase `auth` schema meant
+* `CREATE OR REPLACE FUNCTION auth.uid() RETURNS text` against Supabase's
+* `RETURNS uuid`, which Postgres rejects outright —
+*
+*     ERROR:  cannot change return type of existing function
+*     HINT:   Use DROP FUNCTION auth.uid() first.
+*
+* — and the failure landed inside a catch-all that logged a warning and carried
+* on, leaving a database with auth tables, no helper functions, and policies
+* calling functions that did not exist. Under `rebase db migrate` the same
+* statements aborted the migration instead.
+*
+* `rebase.uid()` collides with nobody. A Supabase database keeps its `auth`
+* schema untouched and gains a `rebase` one, which is what a gradual migration
+* needs.
+*
+* ## Why functions at all, rather than inlining `current_setting`
+*
+* Because the indirection has already been spent once. `uid()` resolves
+* `app.uid` and falls back to the pre-rename `app.user_id`, so that during a
+* rolling deploy — old and new pods serving one database — both eras resolve
+* the principal. That was a single `CREATE OR REPLACE`. Inlined into policy
+* bodies it would have been a rewrite of every policy on every table.
+*
+* ## Why the name is not configurable
+*
+* A policy body is stored SQL: Postgres parses `USING (…)` once and keeps it, so
+* these strings are written into every policy in every database Rebase has
+* provisioned. Everything that reads policies back — the SQL-to-policy parser
+* behind the admin UI, the drift checker, `rls-check` — would have to know the
+* configured value to recognise its own output. One frozen name is the feature.
+*/
+/** The schema Rebase owns. The only schema Rebase creates. */
+var REBASE_SCHEMA = "rebase";
+/**
+* The principal of the current request, as text, or NULL in the server context.
+*
+* Never NULL for a user request — an anonymous one carries
+* {@link ANONYMOUS_USER_ID} — which is what makes `IS NULL` a reliable test for
+* the trusted server plane and `IS NOT NULL` a tautology.
+*/
+var RLS_UID_SQL = `${REBASE_SCHEMA}.uid()`;
+/** The request's roles as a comma-separated string, for `string_to_array`. */
+var RLS_ROLES_SQL = `${REBASE_SCHEMA}.roles()`;
+`${REBASE_SCHEMA}`;
+/** The request's JWT claims as `jsonb`, or `{}`. */
+var RLS_JWT_SQL = `${REBASE_SCHEMA}.jwt()`;
+/**
+* The pre-1.0 spellings, for recognising policies and hand-written SQL that
+* predate the move.
+*
+* Kept because policies outlive the server that wrote them: a database migrated
+* by an older release still holds `auth.uid()` in its policy bodies until the
+* next push or boot recompiles them, and anything that reads policies back has
+* to recognise both eras or report the framework's own output as foreign drift.
+* Also used to give a project whose `securityRules` contain raw `auth.uid()` a
+* message naming the replacement, instead of a parse failure.
+*/
+var LEGACY_RLS_SCHEMA = "auth";
+`${LEGACY_RLS_SCHEMA}`;
+`${LEGACY_RLS_SCHEMA}`;
+`${LEGACY_RLS_SCHEMA}`;
+//#endregion
+//#region ../types/src/types/resources.ts
+/** The key a resource takes when a project declares only one of its kind. */
+var DEFAULT_RESOURCE_KEY = "(default)";
+var BRAND = Symbol.for("@rebasepro/types.resource");
+/** Whether a value is a resource handle rather than a plain string key. */
+function isResourceHandle(value) {
+	return typeof value === "object" && value !== null && BRAND in value;
+}
+/** The key a resource reference names, whether it is a handle or already a key. */
+function resourceKeyOf(ref) {
+	return isResourceHandle(ref) ? ref.key : ref;
+}
+/**
+* Replace every resource handle inside a value with its key, deeply.
+*
+* Applied where authored config becomes data: `defineCollection`, the
+* collection loaders, the derive step. Past that point a collection is plain
+* data that serialises, compares with `===` and reaches the admin UI over the
+* wire, so a handle must not survive into it. Plain objects and arrays are
+* walked; anything else — a function, a Date, a class instance — is a leaf and
+* is returned as it is, which is what keeps callbacks and validators intact.
+*/
+function resolveResourceRefs(value) {
+	if (isResourceHandle(value)) return value.key;
+	if (Array.isArray(value)) {
+		let changed = false;
+		const out = value.map((item) => {
+			const next = resolveResourceRefs(item);
+			if (next !== item) changed = true;
+			return next;
+		});
+		return changed ? out : value;
+	}
+	if (value !== null && typeof value === "object") {
+		const proto = Object.getPrototypeOf(value);
+		if (proto === Object.prototype || proto === null) {
+			let changed = false;
+			const out = {};
+			for (const [k, v] of Object.entries(value)) {
+				const next = resolveResourceRefs(v);
+				if (next !== v) changed = true;
+				out[k] = next;
+			}
+			return changed ? out : value;
+		}
+	}
+	return value;
+}
+var GLOBAL_KEY = Symbol.for("@rebasepro/types.resourceRegistry");
+/**
+* Where kinds live, versioned — and why the version is in the symbol.
+*
+* Sharing one kinds map across copies means the copy that registers SECOND is
+* the one that runs the comparison. That copy is whatever the bundle happens to
+* carry, which for a driver is a build of this package frozen at its release —
+* so the rule enforced is the rule that shipped THEN, not the one written here.
+*
+* `revision` (390bb03cd, applied to `database` in 346df48e2) was supposed to
+* settle a disagreement between two copies, and it settles it only when the
+* copy doing the arithmetic knows what `revision` is. 0.17.0–0.17.3 do not:
+* they deep-equal the spec and throw. The runtime registers at import and a
+* driver is imported after it, so the old copy is always second, always the
+* judge, and always throws — verified by the bundle corpus on 2026-09-07,
+* which reported v0.17.3's message verbatim ("Two packages cannot define the
+* same kind.", no revision clause) while the runtime it ran on was 0.18.
+*
+* So copies that understand `revision` keep their kinds here, under a symbol
+* no released copy looks at, and the legacy map is left to whoever still wants
+* it. An old copy then registers into a map nobody contests, finds no existing
+* entry, and cannot throw — in any load order, which is what the previous fix
+* only claimed. Bumping this suffix again is how a future change to the
+* REGISTRATION PROTOCOL is made; a change to a kind's own definition is still
+* `revision`, among peers that share this map.
+*/
+var KINDS_KEY = Symbol.for("@rebasepro/types.resourceKinds.v2");
+function registry() {
+	const g = globalThis;
+	let shared = g[GLOBAL_KEY];
+	if (!shared) {
+		shared = {
+			kinds: /* @__PURE__ */ new Map(),
+			declarations: /* @__PURE__ */ new Map()
+		};
+		g[GLOBAL_KEY] = shared;
+	}
+	let kinds = g[KINDS_KEY];
+	if (!kinds) {
+		kinds = /* @__PURE__ */ new Map();
+		g[KINDS_KEY] = kinds;
+	}
+	return {
+		kinds,
+		legacyKinds: shared.kinds,
+		declarations: shared.declarations
+	};
+}
+/**
+* Every kind visible to this copy: the versioned map, plus anything only a
+* legacy copy registered.
+*
+* The fallback is not for Rebase's own kinds — this copy defines all of those —
+* but for a third-party driver built against an older `@rebasepro/types` that
+* registers a kind of its own. Dropping it would make that kind invisible and
+* turn `declareResource` into "unknown resource kind" for something genuinely
+* registered.
+*/
+function visibleKinds() {
+	const { kinds, legacyKinds } = registry();
+	if (legacyKinds.size === 0) return kinds;
+	const merged = new Map(legacyKinds);
+	for (const [k, v] of kinds) merged.set(k, v);
+	return merged;
+}
+var amendments = /* @__PURE__ */ new Map();
+/**
+* Correct a registered kind without touching its registered literal.
+*
+* Use this, never an edit to the literal, for a kind that has shipped in a
+* published package. The amendment applies to reads through this copy only.
+*/
+function amendResourceKind(kind, amendment) {
+	amendments.set(kind, {
+		...amendments.get(kind),
+		...amendment
+	});
+}
+/** A registered kind as this copy sees it: the shared literal plus this copy's amendments. */
+function effectiveKind(spec) {
+	const amendment = amendments.get(spec.kind);
+	return amendment ? {
+		...spec,
+		...amendment
+	} : spec;
+}
+/** `kind:key`, the graph's primary key. */
+function declarationId(kind, key) {
+	return `${kind}:${key}`;
+}
+/**
+* Register a resource kind.
+*
+* Idempotent for an identical spec. When a spec for the same kind is already
+* registered and differs, the `revision` decides: the higher one is kept and
+* the other copy is warned about, in either load order. Two different specs at
+* the SAME revision are a genuine conflict — two packages defining one kind, or
+* a change that forgot to bump — and still throw.
+*
+* Both copies in that comparison are peers on `KINDS_KEY`, which is what makes
+* the rule enforceable: a copy old enough not to know `revision` writes to the
+* legacy map instead and never reaches this function's arithmetic. Registering
+* a kind an older copy already put in the legacy map is therefore not a
+* conflict — it is the ordinary case, and `visibleKinds` prefers this one.
+*/
+function registerResourceKind(spec) {
+	const kinds = registry().kinds;
+	const existing = kinds.get(spec.kind);
+	if (!existing) {
+		kinds.set(spec.kind, spec);
+		return;
+	}
+	if (JSON.stringify(existing) === JSON.stringify(spec)) return;
+	const have = existing.revision ?? 0;
+	const incoming = spec.revision ?? 0;
+	if (have === incoming) throw new Error(`Resource kind "${spec.kind}" is already registered with a different definition at revision ${have}. Two packages cannot define the same kind; a newer definition of the same kind must carry a higher \`revision\`.`);
+	const [kept, dropped] = incoming > have ? [spec, existing] : [existing, spec];
+	if (kept === spec) kinds.set(spec.kind, spec);
+	console.warn(`[resources] Resource kind "${spec.kind}" is registered twice, at revisions ${dropped.revision ?? 0} and ${kept.revision ?? 0}; keeping revision ${kept.revision ?? 0}. The older copy is usually @rebasepro/types inlined in a driver built before the kind changed — rebuild the project with a current driver to remove it.`);
+}
+/** Every registered kind, for validators and for `rebase doctor`. */
+function resourceKinds() {
+	return [...visibleKinds().values()].map(effectiveKind);
+}
+/** One registered kind, or undefined. */
+function resourceKind(kind) {
+	const spec = visibleKinds().get(kind);
+	return spec && effectiveKind(spec);
+}
+var COMMON_OPTION_KEYS = [
+	"engine",
+	"transport",
+	"label"
+];
+/** Whether an engine is one the kind knows, or an explicit `custom:` opt-out. */
+function isValidEngine(spec, engine) {
+	return engine.startsWith("custom:") || spec.engines.includes(engine);
+}
+/**
+* Declare a resource. The primitive every kind's constructor is built from.
+*
+* Redeclaring the same `kind:key` with a *different* shape throws rather than
+* merging. Merging is what the old storage path did, and it silently discarded
+* one of the two engines — a declaration accepted and then ignored, which is
+* the failure this whole model exists to remove. Redeclaring it identically is
+* fine: a config module evaluated twice must not be an error.
+*/
+function declareResource(kind, key = DEFAULT_RESOURCE_KEY, options = {}) {
+	const spec = resourceKind(kind);
+	if (!spec) {
+		const known = [...visibleKinds().keys()].sort().join(", ") || "none";
+		throw new Error(`Unknown resource kind "${kind}". Registered kinds: ${known}. Call registerResourceKind() before declaring one.`);
+	}
+	if (!key || typeof key !== "string" || key.trim() === "") throw new Error(`A ${kind} needs a non-empty key.`);
+	const engine = options.engine ?? spec.defaultEngine;
+	if (!isValidEngine(spec, engine)) throw new Error(`Unknown ${kind} engine "${engine}" for "${key}". Known engines: ${spec.engines.join(", ")}. An engine this build does not ship is spelled "custom:${engine}", which says so at the call site rather than failing later.`);
+	const allowed = /* @__PURE__ */ new Set([...COMMON_OPTION_KEYS, ...spec.optionKeys ?? []]);
+	const unknown = Object.keys(options).filter((k) => !allowed.has(k));
+	if (unknown.length > 0) throw new Error(`Unknown option(s) on ${kind} "${key}": ${unknown.join(", ")}. A ${kind} accepts: ${[...allowed].sort().join(", ")}.`);
+	const extra = {};
+	for (const k of spec.optionKeys ?? []) if (options[k] !== void 0) extra[k] = options[k];
+	const declaration = {
+		kind,
+		key,
+		engine,
+		transport: options.transport ?? "server",
+		...options.label !== void 0 ? { label: options.label } : {},
+		options: Object.freeze(extra)
+	};
+	const id = declarationId(kind, key);
+	const previous = registry().declarations.get(id);
+	if (previous) {
+		if (JSON.stringify(previous) !== JSON.stringify(declaration)) throw new Error(`${kind} "${key}" is declared twice with different configuration. Declare it once and export it — two declarations of one resource is the ambiguity this model exists to remove, so it is refused rather than merged.`);
+	} else registry().declarations.set(id, declaration);
+	return {
+		...declaration,
+		toString() {
+			return key;
+		},
+		[BRAND]: true
+	};
+}
+/** Every declared resource, in declaration order, optionally filtered by kind. */
+function declaredResources(kind) {
+	const all = [...registry().declarations.values()];
+	return kind ? all.filter((r) => r.kind === kind) : all;
+}
+/**
+* The env-var suffix a resource's bindings use: `__ANALYTICS` for `analytics`,
+* and nothing at all for the default-keyed one.
+*
+* The default takes no suffix so that a project with one database configured
+* through plain `DATABASE_URL` keeps working having declared nothing — the
+* overwhelmingly common project must not have to say so.
+*/
+function resourceEnvSuffix(key) {
+	if (key === "(default)") return "";
+	return `__${key.toUpperCase().replace(/[^A-Z0-9]+/g, "_").replace(/^_+|_+$/g, "")}`;
+}
+/**
+* Build a graph from the current declarations, sorted for a stable diff.
+*
+* `usedBy` maps a `kind:key` id to the things that reach it. The derive step
+* supplies it after evaluating collections; a runtime building the graph at
+* boot passes nothing and gets declarations alone, which is all it binds from.
+*/
+function buildResourceGraph(usedBy) {
+	return {
+		version: 1,
+		resources: declaredResources().slice().sort((a, b) => a.kind.localeCompare(b.kind) || a.key.localeCompare(b.key)).map((r) => {
+			const users = usedBy?.get(declarationId(r.kind, r.key));
+			return users && users.length > 0 ? {
+				...r,
+				usedBy: [...users].sort()
+			} : r;
+		})
+	};
+}
+//#endregion
+//#region ../types/src/types/storage_source.ts
+/**
+* Describes a named storage backend — a place files live.
+*
+* Declared once and shared front + back: the frontend uses it to decide
+* transport (HTTP proxy vs direct SDK), the backend uses the same `key`
+* to resolve a StorageController, and collection properties reference
+* a definition by its `key` via `StorageConfig.storageSource`.
+*
+* This mirrors the {@link DataSourceDefinition} pattern used for databases.
+*
+* @group Models
+*/
+/**
+* The default storage source key, used when a property does not specify
+* a `storageSource`. Shared by the frontend and backend registries so
+* both agree on "the default storage backend".
+* @group Models
+*/
+var DEFAULT_STORAGE_SOURCE_KEY = "(default)";
+/**
+* The environment-variable suffix for a storage or data source key.
+*
+* `""` for the default source — so a single-bucket project keeps configuring
+* plain `S3_BUCKET` — and `__<KEY>` for every named one, uppercased with
+* non-alphanumerics collapsed to underscores: `media-cdn` → `S3_BUCKET__MEDIA_CDN`.
+*
+* The rule derives the variable name from the declared key rather than
+* discovering keys by scanning the environment. Scanning would have to guess how
+* `S3_BUCKET__MEDIA_CDN` splits into a key; deriving cannot be ambiguous, and a
+* typo surfaces as a missing source at boot instead of a silently ignored
+* variable.
+*
+* It lives in this package, with no dependencies, because four things must agree
+* on it exactly: the CLI (validating a build), the runtime (reading its own
+* environment), the control plane (writing a tenant's Secret), and the docs. A
+* second implementation of a naming convention is a second chance to disagree.
+*
+* @group Models
+*/
+function storageEnvSuffix(key, defaultKey = DEFAULT_STORAGE_SOURCE_KEY) {
+	if (!key || key === defaultKey) return "";
+	const normalized = key.replace(/[^A-Za-z0-9]+/g, "_").replace(/^_+|_+$/g, "").toUpperCase();
+	if (!normalized) throw new Error(`Source key "${key}" cannot be turned into an environment variable name. Use a key containing at least one letter or digit.`);
+	return `__${normalized}`;
+}
+/**
+* Two distinct keys that collapse onto the same variable name, or `null`.
+*
+* `media-cdn` and `media_cdn` are different source keys but the same suffix, so
+* without this one of them silently reads the other's configuration. Returns the
+* offending pair rather than throwing, so each caller can raise it in its own
+* idiom — a `BundleError` at boot, a build failure in the CLI, a rejected deploy
+* in a control plane.
+*
+* @group Models
+*/
+function findStorageSuffixCollision(keys, defaultKey = DEFAULT_STORAGE_SOURCE_KEY) {
+	const seen = /* @__PURE__ */ new Map();
+	for (const key of keys) {
+		const suffix = storageEnvSuffix(key, defaultKey);
+		const existing = seen.get(suffix);
+		if (existing !== void 0 && existing !== key) return {
+			a: existing,
+			b: key,
+			suffix
+		};
+		seen.set(suffix, key);
+	}
+	return null;
+}
+//#endregion
+//#region ../types/src/types/resource_kinds.ts
+/**
+* The kinds Rebase ships, and the constructors a project declares them with.
+*
+* Each kind is registered rather than hardcoded, so a fourth one arrives
+* without editing a manifest schema, a validator and a switch statement. That
+* cost is precisely why databases and buckets ended up declared in different
+* files with different rules — the cheapest thing to do was always to bolt the
+* new kind onto whichever home was nearest.
+*
+* A kind owns its engine list. `custom:<id>` is always accepted, so a build
+* that ships an engine this package has never heard of says so at the call site
+* instead of looking like a typo of one that exists.
+*/
+registerResourceKind({
+	revision: 1,
+	kind: "database",
+	engines: [
+		"postgres",
+		"mongodb",
+		"firestore",
+		"sqlite"
+	],
+	defaultEngine: "postgres",
+	envBases: [
+		"DATABASE_URL",
+		"REBASE_DRIVER",
+		"REBASE_DB_POOL_MAX"
+	],
+	optionKeys: [
+		"databaseId",
+		"migrations",
+		"extensions"
+	],
+	implicitDefault: true
+});
+amendResourceKind("database", { envBases: [
+	"DATABASE_URL",
+	"DATABASE_READ_URL",
+	"ADMIN_CONNECTION_STRING",
+	"REBASE_DRIVER",
+	"DB_POOL_MAX",
+	"DB_POOL_IDLE_TIMEOUT",
+	"DB_POOL_CONNECT_TIMEOUT"
+] });
+registerResourceKind({
+	kind: "bucket",
+	engines: [
+		"local",
+		"s3",
+		"gcs",
+		"azure",
+		"firebase"
+	],
+	defaultEngine: "local",
+	envBases: [
+		"S3_BUCKET",
+		"GCS_BUCKET",
+		"STORAGE_BUCKET",
+		"STORAGE_PUBLIC_URL"
+	],
+	envBasesByEngine: {
+		local: ["STORAGE_BUCKET"],
+		s3: [
+			"S3_BUCKET",
+			"STORAGE_ENDPOINT",
+			"STORAGE_REGION",
+			"STORAGE_PUBLIC_URL"
+		],
+		gcs: ["GCS_BUCKET", "STORAGE_PUBLIC_URL"],
+		azure: ["STORAGE_BUCKET", "STORAGE_PUBLIC_URL"],
+		firebase: ["STORAGE_BUCKET", "STORAGE_PUBLIC_URL"]
+	},
+	optionKeys: [
+		"publicRead",
+		"prefix",
+		"account"
+	],
+	implicitDefault: false
+});
+amendResourceKind("bucket", {
+	optionKeys: [
+		"publicRead",
+		"prefix",
+		"account",
+		"default"
+	],
+	envBases: [
+		"STORAGE_TYPE",
+		"STORAGE_PATH",
+		"S3_BUCKET",
+		"S3_REGION",
+		"S3_ACCESS_KEY_ID",
+		"S3_SECRET_ACCESS_KEY",
+		"S3_ENDPOINT",
+		"S3_FORCE_PATH_STYLE",
+		"GCS_BUCKET",
+		"GCS_PROJECT_ID",
+		"GCS_KEY_FILENAME"
+	],
+	envBasesByEngine: {
+		local: ["STORAGE_TYPE", "STORAGE_PATH"],
+		s3: [
+			"STORAGE_TYPE",
+			"S3_BUCKET",
+			"S3_REGION",
+			"S3_ACCESS_KEY_ID",
+			"S3_SECRET_ACCESS_KEY",
+			"S3_ENDPOINT",
+			"S3_FORCE_PATH_STYLE"
+		],
+		gcs: [
+			"STORAGE_TYPE",
+			"GCS_BUCKET",
+			"GCS_PROJECT_ID",
+			"GCS_KEY_FILENAME"
+		],
+		azure: [],
+		firebase: []
+	}
+});
+registerResourceKind({
+	kind: "topic",
+	engines: ["jobs"],
+	defaultEngine: "jobs",
+	envBases: ["REBASE_TOPIC_URL"],
+	optionKeys: ["delivery", "maxAttempts"],
+	implicitDefault: false
+});
+amendResourceKind("topic", { envBases: [] });
+var runtimeHolder = { current: null };
+/** Install the transport topics publish through. Called by the server at boot. */
+function setTopicRuntime(runtime) {
+	runtimeHolder.current = runtime;
+}
+var subscriptions = [];
+/** Every declared subscription, for the worker to wire and the graph to record. */
+function declaredSubscriptions(topic) {
+	return topic ? subscriptions.filter((s) => s.topic === topic) : subscriptions.slice();
+}
+registerResourceKind({
+	kind: "cron",
+	engines: ["scheduler"],
+	defaultEngine: "scheduler",
+	envBases: [],
+	optionKeys: [
+		"schedule",
+		"timezone",
+		"description",
+		"enabled",
+		"timeoutSeconds",
+		"catchUpWindowSeconds"
+	],
+	implicitDefault: false
+});
+/**
+* Declare a cron, as the scheduler's `defineCron` does on its way through.
+*
+* Projects do not call this: `defineCron` in `@rebasepro/server` does, so a
+* cron file is both the handler and the declaration — one file, one name, and
+* the graph derived from it says what a host needs to know without evaluating
+* the handler. Exported so the derive step and the scheduler spell the
+* declaration identically.
+*/
+function declareCron(name, options) {
+	if (typeof options.schedule !== "string" || options.schedule.trim() === "") throw new Error(`Cron "${name}" needs a schedule — a five-field cron expression such as "0 3 * * *".`);
+	return declareResource("cron", name, options);
+}
+registerResourceKind({
+	kind: "function",
+	engines: ["http"],
+	defaultEngine: "http",
+	envBases: [],
+	optionKeys: [
+		"portable",
+		"requires",
+		"file"
+	],
+	implicitDefault: false
+});
+registerResourceKind({
+	kind: "queue",
+	engines: ["jobs"],
+	defaultEngine: "jobs",
+	envBases: [],
+	optionKeys: ["maxAttempts"],
+	implicitDefault: false
+});
+var queueRuntimeHolder = { current: null };
+/** Install the transport queues enqueue through. Called by the server at boot. */
+function setQueueRuntime(runtime) {
+	queueRuntimeHolder.current = runtime;
+}
+var queueConsumers = /* @__PURE__ */ new Map();
+/** Every declared queue handler, for the worker to wire. */
+function declaredQueueConsumers() {
+	return [...queueConsumers.values()];
+}
+/**
+* One declaration, as the data layer's definition.
+*
+* There is exactly one of these per kind, and everything that needs a
+* definition goes through it — the frontend, the managed runtime's boot path,
+* and an ejected project's own entrypoint. That is not tidiness: the mapping
+* used to exist twice, once here and once in `@rebasepro/server`'s
+* `graphToStorageSources`, and the two disagreed. The server's copy carried a
+* bucket's `account`; this one dropped it, so a bucket declared with shared
+* credentials resolved them on the managed runtime and resolved *nothing* in an
+* ejected backend — the source was skipped and every upload to it answered 501.
+*
+* A field-by-field map is one line away from that failure at all times, so
+* there is now one line to keep right instead of two to keep equal.
+*/
+function resourceToDataSource(declaration) {
+	return {
+		key: declaration.key === "(default)" ? DEFAULT_DATA_SOURCE_KEY : declaration.key,
+		engine: declaration.engine,
+		transport: declaration.transport,
+		...typeof declaration.options.databaseId === "string" ? { databaseId: declaration.options.databaseId } : {},
+		...declaration.label !== void 0 ? { label: declaration.label } : {}
+	};
+}
+/** One declaration, as the storage layer's definition. See {@link resourceToDataSource}. */
+function resourceToStorageSource(declaration) {
+	return {
+		key: declaration.key === "(default)" ? DEFAULT_STORAGE_SOURCE_KEY : declaration.key,
+		engine: declaration.engine,
+		transport: declaration.transport,
+		...typeof declaration.options.account === "string" ? { account: declaration.options.account } : {},
+		...declaration.options.default === true ? { default: true } : {},
+		...declaration.label !== void 0 ? { label: declaration.label } : {}
+	};
+}
+//#endregion
+export { REST_TO_CANONICAL as A, isPostgresCollectionConfig as C, ALL_WHERE_FILTER_OPS as D, getDataSourceCapabilities as E, parseRelationAggregateSort as M, sortKeyToString as N, CANONICAL_TO_REST as O, toCanonicalOp as P, getDeclaredSubcollections as S, DEFAULT_DATA_SOURCE_KEY as T, resourceKinds as _, resourceToStorageSource as a, RLS_UID_SQL as b, DEFAULT_STORAGE_SOURCE_KEY as c, DEFAULT_RESOURCE_KEY as d, buildResourceGraph as f, resourceKind as g, resourceKeyOf as h, resourceToDataSource as i, isRelationAggregateSort as j, NULL_OPS as k, findStorageSuffixCollision as l, resourceEnvSuffix as m, declaredQueueConsumers as n, setQueueRuntime as o, resolveResourceRefs as p, declaredSubscriptions as r, setTopicRuntime as s, declareCron as t, storageEnvSuffix as u, RLS_JWT_SQL as v, isRelationalCollectionConfig as w, getCollectionDataPath as x, RLS_ROLES_SQL as y };
+
+//# sourceMappingURL=src-DHK4fHkw.js.map