@rebasepro/app 0.22.0 → 0.23.0

package/dist/index.es.js

@@ -1,15 +1,15 @@
 import React, { createContext, useCallback, useContext, useEffect, useId, useLayoutEffect, useMemo, useRef, useState } from "react";
-import { Alert, AlertTriangleIcon, ArrowLeftIcon, Avatar, Button, Card, CenteredView, CheckIcon, Checkbox, Chip, CircleUserIcon, CircularProgress, Dialog, DialogActions, DialogContent, DialogTitle, ErrorBoundary, IconButton, LanguagesIcon, LoadingButton, LucideIconByName, MailIcon, Menu, MenuItem, MoonIcon, Popover, SearchBar, SunIcon, SunMoonIcon, Tab, Tabs, TextField, Tooltip, Trash2Icon, Typography, Wand2Icon, cls, colorClassesMapping, coolIconKeys, defaultBorderMixin, getColorSchemeForKey, getColorSchemeForSeed, iconKeys, iconSize, lazyChunk } from "@rebasepro/ui";
-import { ALL_WHERE_FILTER_OPS, DEFAULT_DATA_SOURCE_KEY, DEFAULT_FILTERABLE_RELATION_KINDS, DEFAULT_STORAGE_SOURCE_KEY, EntityReference, EntityRelation, GeoPoint, RebaseApiError, Vector, getDataSourceCapabilities, isLazyComponentRef, isRelationalCollectionConfig, resourceKeyOf } from "@rebasepro/types";
+import { Alert, AlertTriangleIcon, ArrowLeftIcon, Avatar, Button, Card, CenteredView, CheckCircle2Icon, CheckIcon, Checkbox, Chip, CircleUserIcon, CircularProgress, Dialog, DialogActions, DialogContent, DialogTitle, ErrorBoundary, IconButton, LanguagesIcon, LoadingButton, LucideIconByName, MailIcon, Menu, MenuItem, MoonIcon, Popover, SearchBar, Select, SelectItem, SunIcon, SunMoonIcon, Tab, Tabs, TextField, Tooltip, Trash2Icon, Typography, Wand2Icon, cls, colorClassesMapping, coolIconKeys, defaultBorderMixin, getColorSchemeForKey, getColorSchemeForSeed, iconKeys, iconSize, lazyChunk } from "@rebasepro/ui";
+import { ALL_WHERE_FILTER_OPS, DEFAULT_DATA_SOURCE_KEY, DEFAULT_FILTERABLE_RELATION_KINDS, DEFAULT_STORAGE_SOURCE_KEY, EntityReference, EntityRelation, GeoPoint, RebaseApiError, Vector, getDataSourceCapabilities, isLazyComponentRef, isPublicStoragePath, isRelationalCollectionConfig, resourceKeyOf } from "@rebasepro/types";
 import { UNRENDERED_SLOTS, resolveAdminCollection } from "@rebasepro/cms-types";
 import { Fragment, jsx, jsxs } from "react/jsx-runtime";
 import { SnackbarProvider as SnackbarProvider$1, useSnackbar } from "notistack";
 import { buildRebaseData, canCreateEntity, canDeleteEntity, canEditEntity, canReadCollection, evaluateCondition, getChildViewDeclaringProperties, getChildViewRelationPropertyKeys, getEntityChildViews, getLabelOrConfigFrom, getPrimaryKeys, getSubcollections, isPropertyBuilder, normalizeOrderBy, resolveStorageFilenameString, resolveStoragePathString, resolveStorageSource, serializeOrderBy, stripCollectionPath, wrapAsEntityData, wrapAsSdkData } from "@rebasepro/common";
 import { getTitlePropertyKey as getTitlePropertyKey$1, removeInitialAndTrailingSlashes as removeInitialAndTrailingSlashes$1 } from "@rebasepro/app";
+import { deepEqual } from "fast-equals";
 import { Link, Routes, createBrowserRouter, useBlocker, useLocation } from "react-router";
 import { generateForeignKeyName, hashString, isArrayValue, isObject, isPlainObject, isRecordValue, mergeDeep, randomString, readStoredJson, slugify, writeStoredJson } from "@rebasepro/utils";
 import { I18nextProvider, initReactI18next, useTranslation as useTranslation$1 } from "react-i18next";
-import { deepEqual } from "fast-equals";
 import i18next from "i18next";
 import { RouterProvider } from "react-router/dom";
 import Fuse from "fuse.js";
@@ -40,28 +40,39 @@ function PluginProviderStack({ plugins, scope, scopeProps, children }) {
 /**
 * Render-less component that manages plugin lifecycle hooks.
 *
-* - Calls `lifecycle.onMount(context)` when plugins mount.
-* - Calls `lifecycle.onUnmount()` when plugins unmount.
-* - Subscribes to auth state changes and calls `lifecycle.onAuthStateChange`.
+* - Calls `lifecycle.onMount(context)` once, the first time auth is ready.
+* - Calls `lifecycle.onAuthStateChange(user)` on every change of user after
+*   that — `null` on sign-out, the new user on the next sign-in.
+* - Calls `lifecycle.onUnmount()` when the Rebase tree unmounts.
+*
+* Mounted for as long as there are plugins, signed in or not. It used to be
+* mounted only while a user was signed in, so a sign-out unmounted it and the
+* next sign-in mounted a fresh one — `onAuthStateChange` could never see the
+* user change, and never fired.
 *
 * Mount this component inside the Rebase tree, below PluginProviderStack,
 * so that the RebaseContext is fully available.
 *
 * @internal
 */
-function PluginLifecycleManager({ plugins, context }) {
+function PluginLifecycleManager({ plugins, context, authReady }) {
 	const mountedRef = useRef(false);
-	const prevUserRef = useRef(void 0);
+	const prevUidRef = useRef(null);
+	const currentUser = context.authController?.user ?? null;
 	useEffect(() => {
-		if (mountedRef.current) return;
+		if (!authReady || mountedRef.current) return;
 		mountedRef.current = true;
+		prevUidRef.current = currentUser?.uid ?? null;
 		for (const plugin of plugins) if (plugin.lifecycle?.onMount) try {
 			const result = plugin.lifecycle.onMount(context);
 			if (result instanceof Promise) result.catch((err) => console.error(`[Rebase] Plugin "${plugin.key}" onMount error:`, err));
 		} catch (err) {
 			console.error(`[Rebase] Plugin "${plugin.key}" onMount error:`, err);
 		}
+	}, [authReady]);
+	useEffect(() => {
 		return () => {
+			if (!mountedRef.current) return;
 			mountedRef.current = false;
 			for (const plugin of plugins) if (plugin.lifecycle?.onUnmount) try {
 				plugin.lifecycle.onUnmount();
@@ -70,14 +81,11 @@ function PluginLifecycleManager({ plugins, context }) {
 			}
 		};
 	}, []);
-	const currentUser = context.authController?.user ?? null;
 	useEffect(() => {
-		if (prevUserRef.current === void 0) {
-			prevUserRef.current = currentUser;
-			return;
-		}
-		if (prevUserRef.current?.uid === currentUser?.uid) return;
-		prevUserRef.current = currentUser;
+		if (!mountedRef.current) return;
+		const currUid = currentUser?.uid ?? null;
+		if (prevUidRef.current === currUid) return;
+		prevUidRef.current = currUid;
 		for (const plugin of plugins) if (plugin.lifecycle?.onAuthStateChange) try {
 			plugin.lifecycle.onAuthStateChange(currentUser);
 		} catch (err) {
@@ -646,6 +654,21 @@ function getEntityTitlePropertyKey(collection, propertyConfigs) {
 	return getTitlePropertyKey$1(collection);
 }
 //#endregion
+//#region src/hooks/data/useStableFilterValues.ts
+/**
+* The same filter object for as long as its contents stay the same.
+*
+* Callers write filters inline — the hooks guide does — so every render hands
+* a data hook a new object. Used as an effect dependency by identity, that
+* re-subscribed on every render, and every delivery rendered again: a
+* subscribe loop against the server for as long as the component was mounted.
+*/
+function useStableFilterValues(filterValues) {
+	const ref = useRef(filterValues);
+	if (!deepEqual(ref.current, filterValues)) ref.current = filterValues;
+	return ref.current;
+}
+//#endregion
 //#region src/hooks/data/useCollection.tsx
 /**
 * This hook is used to fetch collections using a given collection
@@ -665,7 +688,7 @@ function useCollection({ path, collection, filterValues, sortBy, itemCount, offs
 	const sortByProperty = sortBy ? sortBy[0] : void 0;
 	const currentSort = sortBy ? sortBy[1] : void 0;
 	const orderByParams = sortBy ? [String(sortBy[0]), sortBy[1]] : void 0;
-	const whereParams = filterValues && Object.keys(filterValues).length > 0 ? filterValues : void 0;
+	const whereParams = useStableFilterValues(filterValues && Object.keys(filterValues).length > 0 ? filterValues : void 0);
 	const [data, setData] = useState([]);
 	const [dataLoading, setDataLoading] = useState(false);
 	const [dataLoadingError, setDataLoadingError] = useState();
@@ -734,7 +757,7 @@ function useCollection({ path, collection, filterValues, sortBy, itemCount, offs
 		page,
 		currentSort,
 		sortByProperty,
-		filterValues,
+		whereParams,
 		searchString,
 		dataClient,
 		collection
@@ -917,7 +940,7 @@ var useRebaseContext = () => {
 	const analyticsController = useAnalyticsController();
 	const effectiveRoleController = useEffectiveRoleController();
 	const databaseAdmin = useContext(DatabaseAdminContext);
-	const rebaseContextRef = React.useRef({
+	return React.useMemo(() => ({
 		authController,
 		data,
 		storageSource,
@@ -929,22 +952,7 @@ var useRebaseContext = () => {
 		effectiveRoleController,
 		databaseAdmin,
 		client
-	});
-	React.useEffect(() => {
-		rebaseContextRef.current = {
-			authController,
-			data,
-			storageSource,
-			snackbarController,
-			userConfigPersistence,
-			dialogsController,
-			customizationController,
-			analyticsController,
-			effectiveRoleController,
-			databaseAdmin,
-			client
-		};
-	}, [
+	}), [
 		authController,
 		data,
 		storageSource,
@@ -957,7 +965,6 @@ var useRebaseContext = () => {
 		databaseAdmin,
 		client
 	]);
-	return rebaseContextRef.current;
 };
 //#endregion
 //#region src/hooks/data/useFetch.tsx
@@ -1061,6 +1068,7 @@ var DEFAULT_PAGE_SIZE$1 = 10;
 */
 function useRelationSelector({ path, collection, fixedFilter, pageSize = DEFAULT_PAGE_SIZE$1, getLabelFromEntity, getDescriptionFromEntity, descriptionProperty, enabled = true }) {
 	const dataClient = useData();
+	const stableFixedFilter = useStableFilterValues(fixedFilter);
 	const [items, setItems] = useState([]);
 	const [isLoading, setIsLoading] = useState(false);
 	const isLoadingRef = useRef(false);
@@ -1116,7 +1124,7 @@ function useRelationSelector({ path, collection, fixedFilter, pageSize = DEFAULT
 		cleanupSubscription();
 		setError(void 0);
 		setLoading(true);
-		const whereParams = fixedFilter && Object.keys(fixedFilter).length > 0 ? fixedFilter : void 0;
+		const whereParams = stableFixedFilter && Object.keys(stableFixedFilter).length > 0 ? stableFixedFilter : void 0;
 		const onEntitiesUpdate = (res) => {
 			const newItems = res.data.map((e) => entityToRelationItem(e));
 			hasLoadedRef.current = true;
@@ -1169,7 +1177,7 @@ function useRelationSelector({ path, collection, fixedFilter, pageSize = DEFAULT
 	}, [
 		dataClient,
 		path,
-		fixedFilter,
+		stableFixedFilter,
 		limit,
 		currentSearch,
 		entityToRelationItem,
@@ -1522,222 +1530,686 @@ function useUnsavedChangesDialog(when, onOk) {
 	]);
 }
 //#endregion
-//#region src/hooks/useAuthSubscription.ts
-function useAuthSubscription(authClient) {
-	const currentSession = authClient?.getSession();
-	const [user, setUser] = useState(currentSession?.user ?? null);
-	const [authLoading, setAuthLoading] = useState(false);
-	const [authError, setAuthError] = useState();
-	const [loginSkipped, setLoginSkipped] = useState(false);
-	const [extra, setExtra] = useState();
-	/**
-	* Whether asking the server "who am I?" could possibly answer.
-	*
-	* A client configured with `persistSession: false` and JSON auth — the
-	* shape used when one client borrows another's credential, as the hosted
-	* Studio does — has no stored session and no auth cookie, so the probe
-	* below is guaranteed to 401. Sending it anyway put three failing
-	* `GET /auth/me` calls on the wire per mount, each one landing in the
-	* *customer's* request log as an authentication failure against their own
-	* backend.
-	*
-	* A client that does not implement the capability is treated as "might
-	* work" — the historical behaviour.
-	*/
-	const mayHaveRestorableSession = authClient?.canRestoreSession?.() ?? true;
-	/**
-	* `true` only while a probe is genuinely outstanding.
-	*
-	* It used to be seeded from `!currentSession` alone, which left a client
-	* that cannot restore a session — and therefore never runs the probe that
-	* clears the flag — reporting "still loading" forever. Anything gated on
-	* `initialLoading` (a spinner, a redirect to the login view) would never
-	* resolve.
-	*/
-	const [initialLoading, setInitialLoading] = useState(!currentSession && mayHaveRestorableSession);
-	useEffect(() => {
-		if (!authClient) return;
-		if (!currentSession && mayHaveRestorableSession) {
-			setInitialLoading(true);
-			authClient.getUser().then((user) => {
-				if (user) setUser(user);
-				setAuthError(void 0);
-			}).catch((e) => {
-				const status = e?.status;
-				if (status === 401 || status === 403) {
-					setAuthError(void 0);
-					return;
-				}
-				setAuthError(e instanceof Error ? e : new Error(String(e)));
-			}).finally(() => {
-				setInitialLoading(false);
-			});
-		}
-	}, [
-		authClient,
-		currentSession,
-		mayHaveRestorableSession
-	]);
-	useEffect(() => {
-		if (!authClient) return;
-		return authClient.onAuthStateChange((event, session) => {
-			if (event === "SIGNED_IN" || event === "USER_UPDATED" || event === "TOKEN_REFRESHED") setUser(session?.user ?? null);
-			else if (event === "SIGNED_OUT") setUser(null);
-		});
-	}, [authClient]);
-	const signOut = useCallback(async () => {
-		if (!authClient) return;
-		setAuthLoading(true);
-		try {
-			await authClient.signOut();
-		} finally {
-			setAuthLoading(false);
-		}
-	}, [authClient]);
-	const getAuthToken = useCallback(async () => {
-		if (!authClient) return "";
-		const session = authClient.getSession();
-		if (!session) return "";
-		if (session.expiresAt < Date.now()) try {
-			return (await authClient.refreshSession()).accessToken;
-		} catch (e) {
-			return "";
-		}
-		return session.accessToken;
-	}, [authClient]);
-	return useMemo(() => ({
-		user,
-		initialLoading: authClient ? initialLoading : false,
-		authLoading,
-		signOut,
-		authError,
-		getAuthToken,
-		loginSkipped,
-		extra,
-		setExtra
-	}), [
-		user,
-		initialLoading,
-		authLoading,
-		signOut,
-		authError,
-		getAuthToken,
-		loginSkipped,
-		extra,
-		setExtra,
-		authClient
-	]);
-}
-//#endregion
-//#region src/hooks/useAdminModeController.tsx
-/**
-* Hook to retrieve the current admin mode (`"cms"` | `"studio"`), and `setMode`
-* to change it.
-*
-* Consider that in order to use this hook you need to have a parent
-* `Rebase`
-*
-* @see AdminModeController
-* @group Hooks and utilities
-*/
-var useAdminModeController = () => useContext(AdminModeControllerContext);
-//#endregion
-//#region src/util/local_storage.ts
+//#region src/components/common/useScrollRestoration.tsx
+var collectionScrollCache = /* @__PURE__ */ new Map();
 /**
-* localStorage that tolerates not being there.
-*
-* `typeof window !== "undefined"` was the guard these call sites used, and it
-* answers the wrong question: it says "am I in a browser", not "can I read
-* storage". Three things make that distinction real rather than theoretical:
-*
-* - A browser can have storage **disabled**. Safari in private mode, a blocked
-*   third-party cookie policy, and a sandboxed iframe all give you a `window`
-*   whose `localStorage` property *throws on access* — a SecurityError raised
-*   before any method is called, which no amount of null-checking the result
-*   catches.
-* - A test environment can be **half torn down**. jsdom is disposed at the end
-*   of a file while React is still finishing a concurrent render, so `window`
-*   survives as a husk and `localStorage.getItem` is no longer a function.
-*   That is how this was found: `TypeError: localStorage.getItem is not a
-*   function`, thrown out of a render, failing a suite in which every one of
-*   709 tests passed.
-* - Server rendering has no `window` at all, which is the only case the old
-*   guard actually covered.
+* Forget every collection's scroll position and the rows kept with it.
 *
-* Reading a UI preference is never worth a crash. Every function here fails to
-* `null` / no-op, so a user with storage switched off gets the default
-* appearance instead of a blank page.
+* The rows are what the signed-in user was allowed to read, and a table seeds
+* its first render from them, so they must not outlive that user's session.
 */
-/** The Storage object, or null when it is absent, blocked, or not usable. */
-function usableStorage() {
-	try {
-		if (typeof window === "undefined") return null;
-		const candidate = window.localStorage;
-		return typeof candidate?.getItem === "function" ? candidate : null;
-	} catch {
-		return null;
-	}
-}
-/** The stored string for `key`, or null if it is unset or unreadable. */
-function readStoredString(key) {
-	try {
-		return usableStorage()?.getItem(key) ?? null;
-	} catch {
-		return null;
-	}
-}
-/** Persist `value` under `key`. A no-op when storage is unavailable. */
-function writeStoredString(key, value) {
-	try {
-		usableStorage()?.setItem(key, value);
-	} catch {}
+function clearCollectionScrollCache() {
+	collectionScrollCache.clear();
 }
-/** Remove `key`. A no-op when storage is unavailable. */
-function removeStoredString(key) {
-	try {
-		usableStorage()?.removeItem(key);
-	} catch {}
+function useScrollRestoration() {
+	const updateCollectionScroll = ({ path, filters, scrollOffset, data }) => {
+		collectionScrollCache.set(createCacheKey(path, filters), {
+			scrollOffset,
+			data
+		});
+	};
+	const getCollectionScroll = (path, filters) => {
+		return collectionScrollCache.get(createCacheKey(path, filters));
+	};
+	return {
+		getCollectionScroll,
+		updateCollectionScroll
+	};
 }
-//#endregion
-//#region src/hooks/useBuildAdminModeController.tsx
-/**
-* Use this hook to build an admin mode controller that determines
-* whether the UI shows Developer or Editor tools.
-*/
-function useBuildAdminModeController() {
-	const stored = readStoredString("rebase-admin-mode");
-	const migrated = stored === "content" ? "cms" : stored;
-	const [mode, setMode] = useState((migrated === "cms" || migrated === "studio" ? migrated : null) ?? "cms");
-	const setModeInternal = useCallback((newMode) => {
-		writeStoredString("rebase-admin-mode", newMode);
-		setMode(newMode);
-	}, []);
-	return useMemo(() => ({
-		mode,
-		setMode: setModeInternal
-	}), [mode, setModeInternal]);
+function createCacheKey(path, filters) {
+	if (!filters) return path;
+	return `${path}?${filters ? Object.keys(filters).map((key) => {
+		return `${key}=${JSON.stringify(filters[key])}`;
+	}).join("&") : ""}`;
 }
 //#endregion
-//#region src/hooks/useBuildEffectiveRoleController.tsx
+//#region src/util/entity_cache.ts
+var LOCAL_STORAGE_PREFIX = "entity_cache::";
 /**
-* Use this hook to build an effective role controller that determines
-* what role is simulated in Editor mode when Dev mode is active.
+* The in-session handoff channel: an edit in flight, parked here by the layout
+* that is being replaced and picked up by the one taking over — the split's
+* "hide list", full screen's "show list", the side panel's "open full screen".
+* A record loaded from it opens *dirty*, because that is what it is for.
 *
-* It uses localStorage to persist the simulated role across reloads.
+* Deliberately **not** hydrated from `sessionStorage`, and it is the one thing
+* here that isn't. The persisted half of this file is the local-changes backup:
+* a draft that outlives a reload, offered back through the banner or applied on
+* open, according to the collection's `localChangesBackup`. Loading those
+* drafts into this map on startup made every one of them look like a handoff —
+* the first visit to the record after a reload silently opened dirty carrying a
+* draft the user had walked away from, and the banner that exists to ask about
+* it never appeared.
 */
-function useBuildEffectiveRoleController() {
-	const [effectiveRole, setEffectiveRole] = useState(readStoredString("rebase-effective-role") ?? null);
-	const setRoleInternal = useCallback((newRole) => {
-		if (newRole) writeStoredString("rebase-effective-role", newRole);
-		else removeStoredString("rebase-effective-role");
-		setEffectiveRole(newRole);
-	}, []);
-	return useMemo(() => ({
-		effectiveRole,
-		setEffectiveRole: setRoleInternal
-	}), [effectiveRole, setRoleInternal]);
-}
-//#endregion
+var entityCache = /* @__PURE__ */ new Map();
+var isSessionStorageAvailable = typeof sessionStorage !== "undefined";
+function customReplacer(key) {
+	const value = this[key];
+	if (value instanceof Date) return {
+		__type: "Date",
+		value: value.toISOString()
+	};
+	if (value instanceof EntityReference) return {
+		__type: "EntityReference",
+		id: value.id,
+		path: value.path,
+		driver: value.driver,
+		databaseId: value.databaseId
+	};
+	if (value instanceof EntityRelation) return {
+		__type: "EntityRelation",
+		id: value.id,
+		path: value.path,
+		data: value.data
+	};
+	if (value instanceof GeoPoint) return {
+		__type: "GeoPoint",
+		latitude: value.latitude,
+		longitude: value.longitude
+	};
+	if (value instanceof Vector) return {
+		__type: "Vector",
+		value: value.value
+	};
+	return value;
+}
+function customReviver(_key, value) {
+	if (value && typeof value === "object" && "__type" in value) {
+		const record = value;
+		switch (record.__type) {
+			case "date":
+			case "Date": return new Date(record.value);
+			case "reference":
+			case "EntityReference": return new EntityReference({
+				id: record.id,
+				path: record.path,
+				driver: record.driver,
+				databaseId: record.databaseId
+			});
+			case "relation":
+			case "EntityRelation": return new EntityRelation(record.id, record.path, record.data);
+			case "GeoPoint": return new GeoPoint(record.latitude, record.longitude);
+			case "Vector": return new Vector(record.value);
+			default: return value;
+		}
+	}
+	return value;
+}
+/**
+* Saves data to the local-changes backup in `sessionStorage`.
+*
+* The backup only — a draft that survives a reload is not an edit in flight.
+* {@link saveEntityToMemoryCache} is the other channel; see {@link entityCache}
+* for what separates them.
+* @param path - The unique path/key for the data.
+* @param data - The data to cache and persist.
+*/
+function saveEntityToCache(path, data) {
+	if (isSessionStorageAvailable) try {
+		const key = LOCAL_STORAGE_PREFIX + path;
+		const entityString = JSON.stringify(data, customReplacer);
+		sessionStorage.setItem(key, entityString);
+	} catch (error) {
+		console.error(`Failed to save entity for path "${path}" to sessionStorage:`, error);
+	}
+}
+/**
+* Consumes a handoff. The channel is one-shot: whoever picks an edit up owns it
+* from then on, and an edit left behind here is one that reopens a record dirty
+* long after the user stopped looking at it.
+*/
+function removeEntityFromMemoryCache(path) {
+	entityCache.delete(path);
+}
+/**
+* Parks an edit in flight for the layout about to take over. See
+* {@link entityCache}: this is the handoff, not the backup.
+*/
+function saveEntityToMemoryCache(path, data) {
+	entityCache.set(path, data);
+}
+function getEntityFromMemoryCache(path) {
+	return entityCache.get(path);
+}
+/**
+* Drops every edit in flight. They were parked by a user who is no longer
+* signed in, so nobody is taking them over.
+*/
+function clearEntityMemoryCache() {
+	entityCache.clear();
+}
+/**
+* Drops the whole local-changes backup: every draft in `sessionStorage`, for
+* every record. For when the drafts belong to somebody other than the user now
+* signed in.
+*/
+function clearEntityDrafts() {
+	if (!isSessionStorageAvailable) return;
+	try {
+		const keys = [];
+		for (let i = 0; i < sessionStorage.length; i++) {
+			const key = sessionStorage.key(i);
+			if (key?.startsWith(LOCAL_STORAGE_PREFIX)) keys.push(key);
+		}
+		for (const key of keys) sessionStorage.removeItem(key);
+	} catch (error) {
+		console.error("Failed to clear the local-changes backup from sessionStorage:", error);
+	}
+}
+/**
+* Retrieves a entity from the local-changes backup in `sessionStorage`.
+*
+* The backup only — the handoff channel is read through
+* {@link getEntityFromMemoryCache}, and the two mean different things to the
+* form that receives them.
+* @param path - The unique path/key for the entity.
+* @returns The cached entity or `undefined` if not found.
+*/
+function getEntityFromCache(path) {
+	if (isSessionStorageAvailable) try {
+		const key = LOCAL_STORAGE_PREFIX + path;
+		const entityString = sessionStorage.getItem(key);
+		if (entityString) return JSON.parse(entityString, customReviver);
+	} catch (error) {
+		console.error(`Failed to load entity for path "${path}" from sessionStorage:`, error);
+	}
+}
+/**
+* Removes a entity from both the in-memory cache and `sessionStorage`.
+* @param path - The unique path/key for the entity to remove.
+*/
+function removeEntityFromCache(path) {
+	console.debug("Removing entity from cache", path);
+	entityCache.delete(path);
+	if (isSessionStorageAvailable) try {
+		const key = LOCAL_STORAGE_PREFIX + path;
+		sessionStorage.removeItem(key);
+	} catch (error) {
+		console.error(`Failed to remove entity for path "${path}" from sessionStorage:`, error);
+	}
+}
+function flattenKeys(obj, prefix = "", result = []) {
+	if (isObject(obj) || Array.isArray(obj)) if (!isPlainObject(obj) && prefix) result.push(prefix);
+	else {
+		const record = obj;
+		for (const key in record) if (Object.prototype.hasOwnProperty.call(record, key)) {
+			const newKey = prefix ? Array.isArray(obj) ? `${prefix}[${key}]` : `${prefix}.${key}` : key;
+			const val = record[key];
+			if (isObject(val) || Array.isArray(val)) flattenKeys(val, newKey, result);
+			else result.push(newKey);
+		}
+	}
+	return result;
+}
+//#endregion
+//#region src/collections/entity-display-cache.ts
+/** The identity of one role of one record, as a cache key. */
+function entityDisplayKey(path, entityId, role) {
+	return `${role} ${path} ${entityId ?? ""}`;
+}
+/**
+* One shared store, so every surface agrees on a record and resolves it once.
+*
+* Module-level rather than a provider: two app instances on one page share a
+* cache keyed by collection path and record id, which *is* the same record.
+* A resolved title is what the signed-in user was allowed to read, though, so
+* the store is emptied with the rest of the session's caches when that user
+* signs out (`clearSessionCaches`).
+*
+* Built on first use rather than at module scope. Importing a module should not
+* construct anything: it runs during SSR where there is nothing to cache, and it
+* made the modules that read this store unimportable from any test that stubs
+* `@rebasepro/app`.
+*/
+var sharedCache;
+function getSharedEntityDisplayCache() {
+	if (!sharedCache) sharedCache = new EntityDisplayCache();
+	return sharedCache;
+}
+var EntityDisplayCache = class {
+	entries = /* @__PURE__ */ new Map();
+	listeners = /* @__PURE__ */ new Set();
+	/**
+	* The resolved value, or `undefined` when this pair has not been resolved
+	* yet. `null` is a resolved absence, and the two must stay distinct: a
+	* caller that reads "not yet" as "nothing" flickers its fallback in on every
+	* mount.
+	*/
+	peek(key) {
+		const entry = this.entries.get(key);
+		if (!entry || "promise" in entry) return void 0;
+		return entry.value;
+	}
+	/** True while a resolution for this pair is in flight. */
+	isLoading(key) {
+		const entry = this.entries.get(key);
+		return Boolean(entry && "promise" in entry);
+	}
+	/**
+	* Resolve once per record and role. Concurrent callers share the first
+	* call's promise; later callers get the cached value with no promise at all.
+	*
+	* A resolver that throws is recorded as "nothing" rather than retried: the
+	* alternative is every render re-running a call that just failed. And it is
+	* reported here, which is a correction.
+	*
+	* It used to say "the caller that saw the rejection is the one that logs
+	* it", and `useEntityDisplay` duly attached a `.catch()` that warned. But
+	* both failure paths below swallow and return a *resolved* promise, so that
+	* catch could never run — the two halves each did the reasonable thing and
+	* between them the log was unreachable. A resolver that blew up produced a
+	* blank chip and total silence, which is the failure mode
+	* `EntityDisplayResolver`'s own contract ("treated as `undefined` and logged
+	* once") exists to rule out.
+	*
+	* Reporting belongs here for the reason the caller could not do it: this is
+	* the one place that runs exactly once per key, so "once" is a property of
+	* the code rather than a hope about how many components mount.
+	*/
+	resolve(key, resolver) {
+		const entry = this.entries.get(key);
+		if (entry) return "promise" in entry ? entry.promise : Promise.resolve(entry.value);
+		let produced;
+		try {
+			produced = resolver();
+		} catch (error) {
+			this.fail(key, error);
+			return Promise.resolve(null);
+		}
+		if (!isPromise(produced)) {
+			const value = normalize(produced);
+			this.set(key, value);
+			return Promise.resolve(value);
+		}
+		const promise = produced.then((resolved) => {
+			const value = normalize(resolved);
+			this.set(key, value);
+			return value;
+		}).catch((error) => {
+			this.fail(key, error);
+			return null;
+		});
+		this.entries.set(key, { promise });
+		return promise;
+	}
+	/**
+	* Drop what is known about a record, so the next ask resolves again. Called
+	* after a write: the row that just saved may be called something else now.
+	*/
+	invalidate(path, entityId) {
+		const suffix = ` ${path} ${entityId ?? ""}`;
+		let changed = false;
+		for (const key of [...this.entries.keys()]) if (entityId === void 0 ? key.includes(` ${path} `) || key.endsWith(` ${path} `) : key.endsWith(suffix)) {
+			this.entries.delete(key);
+			changed = true;
+		}
+		if (changed) this.emit();
+	}
+	/** Drop everything. The user signed out, or the app swapped datasource. */
+	clear() {
+		if (this.entries.size === 0) return;
+		this.entries.clear();
+		this.emit();
+	}
+	subscribe(listener) {
+		this.listeners.add(listener);
+		return () => {
+			this.listeners.delete(listener);
+		};
+	}
+	set(key, value) {
+		this.entries.set(key, { value });
+		this.emit();
+	}
+	/**
+	* Record a failed resolution as "nothing", and say so once.
+	*
+	* The key is the message: it is `<role> <path> <id>`, which is exactly what a
+	* reader needs to find the resolver that blew up. A warning with no key would
+	* tell them a display resolver failed somewhere in a list of fifty rows.
+	*
+	* `console.warn` rather than a thrown error, because this runs while a row is
+	* rendering: the contract is that a title which cannot be fetched must not
+	* take down the row that shows it.
+	*/
+	fail(key, error) {
+		console.warn(`[rebase] Could not resolve display value for ${key}:`, error);
+		this.set(key, null);
+	}
+	emit() {
+		for (const listener of [...this.listeners]) listener();
+	}
+};
+/**
+* Empty strings and empty arrays are absences, not values — a title of `"  "`
+* would otherwise beat the derived one and render as a blank heading.
+*/
+function normalize(value) {
+	if (value === void 0 || value === null) return null;
+	if (typeof value === "string") {
+		const trimmed = value.trim();
+		return trimmed.length > 0 ? trimmed : null;
+	}
+	if (Array.isArray(value)) return value.length > 0 ? value : null;
+	return value;
+}
+function isPromise(value) {
+	return typeof value?.then === "function";
+}
+//#endregion
+//#region src/auth/session_caches.ts
+/**
+* Who the tab's cached state was read or written as. Kept in `sessionStorage`
+* as well as in memory because the local-changes backup is: a reload keeps the
+* drafts, so it has to keep the name of the user they belong to.
+*/
+var OWNER_STORAGE_KEY = "rebase::session_cache_owner";
+var ownerInMemory;
+function readOwner() {
+	try {
+		if (typeof sessionStorage !== "undefined") return sessionStorage.getItem(OWNER_STORAGE_KEY) ?? ownerInMemory;
+	} catch {}
+	return ownerInMemory;
+}
+function writeOwner(userId) {
+	ownerInMemory = userId;
+	try {
+		if (typeof sessionStorage !== "undefined") sessionStorage.setItem(OWNER_STORAGE_KEY, userId);
+	} catch {}
+}
+/**
+* Empty every module-level cache that holds data read as the signed-in user:
+* fetched records, each table's scroll position and the rows kept with it,
+* edits parked for a layout handoff, and resolved display values (the titles
+* on relation chips and breadcrumbs).
+*
+* All of them are keyed by path and id only, with no user in the key, and the
+* views seed their first render from them — so without this the next user to
+* sign in to the tab is shown what the last one could read. Called by both auth
+* controllers on `SIGNED_OUT`.
+*
+* The local-changes backup is not cleared here: a sign-out is also how a
+* rejected refresh token ends a session, and the backup exists for that user
+* coming back. {@link bindSessionCachesToUser} drops it when somebody else
+* signs in instead.
+*/
+function clearSessionCaches() {
+	clearFetchCache();
+	clearCollectionScrollCache();
+	clearEntityMemoryCache();
+	getSharedEntityDisplayCache().clear();
+}
+/**
+* Record that the tab now acts as `userId`. When that is not who the caches
+* were filled for, everything goes — the session caches, and the drafts the
+* other user left in the local-changes backup.
+*
+* Call it before the new user is rendered: the views read these caches in
+* their first render, before any effect of the auth controller would run.
+*/
+function bindSessionCachesToUser(userId) {
+	const owner = readOwner();
+	if (owner !== void 0 && owner !== userId) {
+		clearSessionCaches();
+		clearEntityDrafts();
+	}
+	if (owner !== userId) writeOwner(userId);
+}
+//#endregion
+//#region src/hooks/useAuthSubscription.ts
+/**
+* Sets the user, first making sure the tab's caches were filled for them.
+* Before the state update, not in an effect: the views read those caches in
+* the very render the new user arrives in.
+*/
+function adoptUser(user) {
+	if (user) bindSessionCachesToUser(user.uid);
+	return user;
+}
+function useAuthSubscription(authClient) {
+	const currentSession = authClient?.getSession();
+	const [user, setUser] = useState(() => adoptUser(currentSession?.user ?? null));
+	const [authLoading, setAuthLoading] = useState(false);
+	const [authError, setAuthError] = useState();
+	const [loginSkipped, setLoginSkipped] = useState(false);
+	const [extra, setExtra] = useState();
+	/**
+	* Whether asking the server "who am I?" could possibly answer.
+	*
+	* A client configured with `persistSession: false` and JSON auth — the
+	* shape used when one client borrows another's credential, as the hosted
+	* Studio does — has no stored session and no auth cookie, so the probe
+	* below is guaranteed to 401. Sending it anyway put three failing
+	* `GET /auth/me` calls on the wire per mount, each one landing in the
+	* *customer's* request log as an authentication failure against their own
+	* backend.
+	*
+	* A client that does not implement the capability is treated as "might
+	* work" — the historical behaviour.
+	*/
+	const mayHaveRestorableSession = authClient?.canRestoreSession?.() ?? true;
+	/**
+	* `true` only while a probe is genuinely outstanding.
+	*
+	* It used to be seeded from `!currentSession` alone, which left a client
+	* that cannot restore a session — and therefore never runs the probe that
+	* clears the flag — reporting "still loading" forever. Anything gated on
+	* `initialLoading` (a spinner, a redirect to the login view) would never
+	* resolve.
+	*/
+	const [initialLoading, setInitialLoading] = useState(!currentSession && mayHaveRestorableSession);
+	/**
+	* `true` until the client has finished restoring a session on its own.
+	*
+	* The first `getSession()` above is provisional while that runs: the SDK
+	* holds an expired stored session during its boot refresh, and when the
+	* refresh is rejected it drops the session without emitting anything. So
+	* the user is read again once the restore settles, and the app does not
+	* render as signed in before then.
+	*/
+	const [restoring, setRestoring] = useState(Boolean(authClient?.isInitialized));
+	useEffect(() => {
+		if (!authClient?.isInitialized) {
+			setRestoring(false);
+			return;
+		}
+		let cancelled = false;
+		setRestoring(true);
+		authClient.isInitialized().catch(() => {}).then(() => {
+			if (cancelled) return;
+			setUser(adoptUser(authClient.getSession()?.user ?? null));
+			setRestoring(false);
+		});
+		return () => {
+			cancelled = true;
+		};
+	}, [authClient]);
+	useEffect(() => {
+		if (!authClient) return;
+		if (!currentSession && mayHaveRestorableSession) {
+			setInitialLoading(true);
+			authClient.getUser().then((user) => {
+				if (user) setUser(adoptUser(user));
+				setAuthError(void 0);
+			}).catch((e) => {
+				const status = e?.status;
+				if (status === 401 || status === 403) {
+					setAuthError(void 0);
+					return;
+				}
+				setAuthError(e instanceof Error ? e : new Error(String(e)));
+			}).finally(() => {
+				setInitialLoading(false);
+			});
+		}
+	}, [
+		authClient,
+		currentSession,
+		mayHaveRestorableSession
+	]);
+	useEffect(() => {
+		if (!authClient) return;
+		return authClient.onAuthStateChange((event, session) => {
+			if (event === "SIGNED_IN" || event === "USER_UPDATED" || event === "TOKEN_REFRESHED") setUser(adoptUser(session?.user ?? null));
+			else if (event === "SIGNED_OUT") {
+				clearSessionCaches();
+				setUser(null);
+			}
+		});
+	}, [authClient]);
+	const signOut = useCallback(async () => {
+		if (!authClient) return;
+		setAuthLoading(true);
+		try {
+			await authClient.signOut();
+		} finally {
+			setAuthLoading(false);
+		}
+	}, [authClient]);
+	const getAuthToken = useCallback(async () => {
+		if (!authClient) return "";
+		const session = authClient.getSession();
+		if (!session) return "";
+		if (session.expiresAt < Date.now()) try {
+			return (await authClient.refreshSession()).accessToken;
+		} catch (e) {
+			return "";
+		}
+		return session.accessToken;
+	}, [authClient]);
+	return useMemo(() => ({
+		user,
+		initialLoading: authClient ? initialLoading || restoring : false,
+		authLoading,
+		signOut,
+		authError,
+		getAuthToken,
+		loginSkipped,
+		extra,
+		setExtra
+	}), [
+		user,
+		initialLoading,
+		restoring,
+		authLoading,
+		signOut,
+		authError,
+		getAuthToken,
+		loginSkipped,
+		extra,
+		setExtra,
+		authClient
+	]);
+}
+//#endregion
+//#region src/hooks/useAdminModeController.tsx
+/**
+* Hook to retrieve the current admin mode (`"cms"` | `"studio"`), and `setMode`
+* to change it.
+*
+* Consider that in order to use this hook you need to have a parent
+* `Rebase`
+*
+* @see AdminModeController
+* @group Hooks and utilities
+*/
+var useAdminModeController = () => useContext(AdminModeControllerContext);
+//#endregion
+//#region src/util/local_storage.ts
+/**
+* localStorage that tolerates not being there.
+*
+* `typeof window !== "undefined"` was the guard these call sites used, and it
+* answers the wrong question: it says "am I in a browser", not "can I read
+* storage". Three things make that distinction real rather than theoretical:
+*
+* - A browser can have storage **disabled**. Safari in private mode, a blocked
+*   third-party cookie policy, and a sandboxed iframe all give you a `window`
+*   whose `localStorage` property *throws on access* — a SecurityError raised
+*   before any method is called, which no amount of null-checking the result
+*   catches.
+* - A test environment can be **half torn down**. jsdom is disposed at the end
+*   of a file while React is still finishing a concurrent render, so `window`
+*   survives as a husk and `localStorage.getItem` is no longer a function.
+*   That is how this was found: `TypeError: localStorage.getItem is not a
+*   function`, thrown out of a render, failing a suite in which every one of
+*   709 tests passed.
+* - Server rendering has no `window` at all, which is the only case the old
+*   guard actually covered.
+*
+* Reading a UI preference is never worth a crash. Every function here fails to
+* `null` / no-op, so a user with storage switched off gets the default
+* appearance instead of a blank page.
+*/
+/** The Storage object, or null when it is absent, blocked, or not usable. */
+function usableStorage() {
+	try {
+		if (typeof window === "undefined") return null;
+		const candidate = window.localStorage;
+		return typeof candidate?.getItem === "function" ? candidate : null;
+	} catch {
+		return null;
+	}
+}
+/** The stored string for `key`, or null if it is unset or unreadable. */
+function readStoredString(key) {
+	try {
+		return usableStorage()?.getItem(key) ?? null;
+	} catch {
+		return null;
+	}
+}
+/** Persist `value` under `key`. A no-op when storage is unavailable. */
+function writeStoredString(key, value) {
+	try {
+		usableStorage()?.setItem(key, value);
+	} catch {}
+}
+/** Remove `key`. A no-op when storage is unavailable. */
+function removeStoredString(key) {
+	try {
+		usableStorage()?.removeItem(key);
+	} catch {}
+}
+//#endregion
+//#region src/hooks/useBuildAdminModeController.tsx
+/**
+* Use this hook to build an admin mode controller that determines
+* whether the UI shows Developer or Editor tools.
+*/
+function useBuildAdminModeController() {
+	const stored = readStoredString("rebase-admin-mode");
+	const migrated = stored === "content" ? "cms" : stored;
+	const [mode, setMode] = useState((migrated === "cms" || migrated === "studio" ? migrated : null) ?? "cms");
+	const setModeInternal = useCallback((newMode) => {
+		writeStoredString("rebase-admin-mode", newMode);
+		setMode(newMode);
+	}, []);
+	return useMemo(() => ({
+		mode,
+		setMode: setModeInternal
+	}), [mode, setModeInternal]);
+}
+//#endregion
+//#region src/hooks/useBuildEffectiveRoleController.tsx
+/**
+* Use this hook to build an effective role controller that determines
+* what role is simulated in Editor mode when Dev mode is active.
+*
+* It uses localStorage to persist the simulated role across reloads.
+*/
+function useBuildEffectiveRoleController() {
+	const [effectiveRole, setEffectiveRole] = useState(readStoredString("rebase-effective-role") ?? null);
+	const setRoleInternal = useCallback((newRole) => {
+		if (newRole) writeStoredString("rebase-effective-role", newRole);
+		else removeStoredString("rebase-effective-role");
+		setEffectiveRole(newRole);
+	}, []);
+	return useMemo(() => ({
+		effectiveRole,
+		setEffectiveRole: setRoleInternal
+	}), [effectiveRole, setRoleInternal]);
+}
+//#endregion
 //#region src/hooks/useModeController.tsx
 /**
 * Hook to retrieve the current mode ("light" | "dark"), and `setMode`
@@ -2246,6 +2718,14 @@ function ApiConfigProvider({ apiUrl, apiPath = DEFAULT_API_PATH, getAuthToken, c
 * React hook for using backend storage API as a StorageSource
 */
 /**
+* A storage key as it goes into a URL path: each segment encoded, the `/`
+* between them kept. A raw key with `#`, `?` or `%` in it cut the URL short or
+* made the server's decode throw.
+*/
+function encodeStorageKey(key) {
+	return key.split("/").map(encodeURIComponent).join("/");
+}
+/**
 * Hook to create a StorageSource that uses the backend storage REST API.
 * Use this for self-hosted Rebase with local or S3 storage.
 *
@@ -2303,7 +2783,7 @@ function useBackendStorageSource({ apiUrl, apiPath = DEFAULT_API_PATH, getAuthTo
 	const getSignedUrl = useCallback(async (keyOrUrl, bucket) => {
 		const cacheKey = bucket ? `${bucket}/${keyOrUrl}` : keyOrUrl;
 		const cached = urlsCache.get(cacheKey);
-		if (cached) return cached;
+		if (cached && (cached.expiresAt === void 0 || cached.expiresAt > Date.now())) return cached.config;
 		let filePath = keyOrUrl;
 		if (filePath && (filePath.startsWith("local://") || filePath.startsWith("s3://"))) filePath = filePath.substring(filePath.indexOf("://") + 3);
 		if (bucket && filePath && !filePath.startsWith(bucket)) filePath = `${bucket}/${filePath}`;
@@ -2311,7 +2791,13 @@ function useBackendStorageSource({ apiUrl, apiPath = DEFAULT_API_PATH, getAuthTo
 			url: null,
 			fileNotFound: true
 		};
-		const response = await fetchWithAuth(`${storageBasePath}/metadata/${filePath}`);
+		const fileUrl = `${storageBasePath}/file/${encodeStorageKey(filePath)}`;
+		if (isPublicStoragePath(filePath)) {
+			const publicConfig = { url: fileUrl };
+			urlsCache.set(cacheKey, { config: publicConfig });
+			return publicConfig;
+		}
+		const response = await fetchWithAuth(`${storageBasePath}/metadata/${encodeStorageKey(filePath)}`);
 		if (response.status === 404) return {
 			url: null,
 			fileNotFound: true
@@ -2321,13 +2807,23 @@ function useBackendStorageSource({ apiUrl, apiPath = DEFAULT_API_PATH, getAuthTo
 			throw new Error(error.error || "Failed to get download URL");
 		}
 		const result = await response.json();
-		const token = await getAuthToken();
-		const tokenQuery = token ? `?token=${token}` : "";
+		if (result.data.public) {
+			const publicConfig = {
+				url: fileUrl,
+				metadata: result.data
+			};
+			urlsCache.set(cacheKey, { config: publicConfig });
+			return publicConfig;
+		}
+		const scopedToken = result.data.token;
 		const downloadConfig = {
-			url: `${storageBasePath}/file/${filePath}${tokenQuery}`,
+			url: scopedToken ? `${fileUrl}?token=${encodeURIComponent(scopedToken)}` : fileUrl,
 			metadata: result.data
 		};
-		urlsCache.set(cacheKey, downloadConfig);
+		urlsCache.set(cacheKey, {
+			config: downloadConfig,
+			expiresAt: result.data.tokenExpiresIn ? Date.now() + (result.data.tokenExpiresIn - 10) * 1e3 : void 0
+		});
 		return downloadConfig;
 	}, [
 		fetchWithAuth,
@@ -2338,17 +2834,15 @@ function useBackendStorageSource({ apiUrl, apiPath = DEFAULT_API_PATH, getAuthTo
 	* Get file as a File object
 	*/
 	const getObject = useCallback(async (key, bucket) => {
-		let filePath = key;
-		if (filePath && (filePath.startsWith("local://") || filePath.startsWith("s3://"))) filePath = filePath.substring(filePath.indexOf("://") + 3);
-		if (bucket && filePath && !filePath.startsWith(bucket)) filePath = `${bucket}/${filePath}`;
-		if (!filePath || filePath.trim() === "" || filePath === "/") return null;
-		const response = await fetchWithAuth(`${storageBasePath}/file/${filePath}`);
+		const downloadConfig = await getSignedUrl(key, bucket);
+		if (downloadConfig.fileNotFound || !downloadConfig.url) return null;
+		const response = await fetch(downloadConfig.url);
 		if (response.status === 404) return null;
 		if (!response.ok) throw new Error("Failed to get file");
 		const blob = await response.blob();
-		const fileName = filePath.split("/").pop() || "file";
+		const fileName = (bucket ? `${bucket}/${key}` : key).split("/").pop() || "file";
 		return new File([blob], fileName, { type: blob.type });
-	}, [fetchWithAuth, storageBasePath]);
+	}, [getSignedUrl]);
 	/**
 	* Delete a file
 	*/
@@ -2357,7 +2851,7 @@ function useBackendStorageSource({ apiUrl, apiPath = DEFAULT_API_PATH, getAuthTo
 		if (filePath && (filePath.startsWith("local://") || filePath.startsWith("s3://"))) filePath = filePath.substring(filePath.indexOf("://") + 3);
 		if (bucket && filePath && !filePath.startsWith(bucket)) filePath = `${bucket}/${filePath}`;
 		if (!filePath || filePath.trim() === "" || filePath === "/") return;
-		const response = await fetchWithAuth(`${storageBasePath}/file/${filePath}`, { method: "DELETE" });
+		const response = await fetchWithAuth(`${storageBasePath}/file/${encodeStorageKey(filePath)}`, { method: "DELETE" });
 		if (!response.ok && response.status !== 404) {
 			const error = await response.json().catch(() => ({ error: "Failed to delete file" }));
 			throw new Error(error.error || "Failed to delete file");
@@ -3091,7 +3585,7 @@ var DEFAULT_PAGE_SIZE = 50;
 * @param fixedFilterFromProps
 * @param updateUrl
 */
-function useDataTableController({ path, collection, scrollRestoration, entitiesDisplayedFirst, lastDeleteTimestamp: _lastDeleteTimestamp, fixedFilter: fixedFilterFromProps, updateUrl }) {
+function useDataTableController({ path, collection, scrollRestoration, entitiesDisplayedFirst, lastDeleteTimestamp, fixedFilter: fixedFilterFromProps, updateUrl }) {
 	const { defaultFilter, sort, fixedFilter: fixedFilterFromCollection } = collection;
 	const [popupCell, setPopupCell] = React.useState(void 0);
 	const dataClient = useData();
@@ -3100,10 +3594,7 @@ function useDataTableController({ path, collection, scrollRestoration, entitiesD
 	const pageSize = typeof collection.pagination === "number" && collection.pagination > 0 ? collection.pagination : 50;
 	const location = useLocation();
 	const [searchString, setSearchString] = React.useState(() => {
-		if (updateUrl) {
-			const urlSearch = new URLSearchParams(location.search).get("search");
-			return urlSearch ? decodeURIComponent(urlSearch) : void 0;
-		}
+		if (updateUrl) return parseSearchString(location.search);
 	});
 	const checkFilterCombination = useCallback((filterValues, sortBy) => {
 		return true;
@@ -3120,23 +3611,26 @@ function useDataTableController({ path, collection, scrollRestoration, entitiesD
 	const [filterValues, setFilterValues] = React.useState(fixedFilter ?? (updateUrl ? filterUrl : void 0) ?? defaultFilter ?? void 0);
 	const [sortBy, setSortBy] = React.useState((updateUrl ? sortUrl : void 0) ?? sortInternal);
 	const lastSyncedSearchRef = React.useRef(location.search);
+	const lastWrittenListStateRef = React.useRef(void 0);
 	useEffect(() => {
 		if (!updateUrl) return;
 		if (lastSyncedSearchRef.current === location.search) return;
 		lastSyncedSearchRef.current = location.search;
 		const { filterValues: urlFilterValues, sortBy: urlSortBy } = parseFilterAndSort(location.search);
+		const urlSearchString = parseSearchString(location.search);
+		if (encodeListState(urlFilterValues, urlSortBy, urlSearchString) === lastWrittenListStateRef.current) return;
 		if (!fixedFilter) setFilterValues(urlFilterValues ?? defaultFilter);
 		if (urlSortBy && fixedFilter && !checkFilterCombination(fixedFilter, urlSortBy)) console.warn("URL sort is not compatible with the force filter.");
-		else setSortBy(urlSortBy);
-		const urlSearch = new URLSearchParams(location.search).get("search");
-		setSearchString(urlSearch ? decodeURIComponent(urlSearch) : void 0);
+		else setSortBy(urlSortBy ?? sortInternal);
+		setSearchString(urlSearchString);
 	}, [
 		location.search,
 		updateUrl,
 		fixedFilter,
-		checkFilterCombination
+		checkFilterCombination,
+		sortInternal
 	]);
-	useUpdateUrl(filterValues, sortBy, searchString, updateUrl);
+	useUpdateUrl(filterValues, sortBy, searchString, updateUrl, lastWrittenListStateRef);
 	const collectionScroll = scrollRestoration?.getCollectionScroll(path, filterValues);
 	/**
 	* How many rows to ask for on mount: as many as were loaded last time this
@@ -3216,6 +3710,7 @@ function useDataTableController({ path, collection, scrollRestoration, entitiesD
 		else setFilterValues(updatedFilter);
 	}, [fixedFilter]);
 	useEffect(() => {
+		let cancelled = false;
 		setDataLoading(true);
 		const onEntitiesUpdate = async (entities) => {
 			if (collection.browserCallbacks?.afterRead) try {
@@ -3237,6 +3732,7 @@ function useDataTableController({ path, collection, scrollRestoration, entitiesD
 			} catch (_e) {
 				console.error(_e);
 			}
+			if (cancelled) return;
 			setDataLoading(false);
 			setDataLoadingError(void 0);
 			setRawData(entities.map((e) => ({ ...e })));
@@ -3244,6 +3740,7 @@ function useDataTableController({ path, collection, scrollRestoration, entitiesD
 			populateFetchCache(path, entities);
 		};
 		const onError = (error) => {
+			if (cancelled) return;
 			console.error("ERROR", error);
 			setDataLoading(false);
 			setRawData((prev) => prev && prev.length > 0 ? prev : []);
@@ -3261,24 +3758,25 @@ function useDataTableController({ path, collection, scrollRestoration, entitiesD
 			searchString,
 			include: includeParams
 		}), (res) => onEntitiesUpdate(res.data), onError);
-		else {
-			accessor.find(toFindParams({
-				where: whereParams,
-				limit: itemCount,
-				orderBy: orderByParams,
-				searchString,
-				include: includeParams
-			})).then((res) => onEntitiesUpdate(res.data)).catch(onError);
-			unsubscribe = () => void 0;
-		}
-		return unsubscribe;
+		else accessor.find(toFindParams({
+			where: whereParams,
+			limit: itemCount,
+			orderBy: orderByParams,
+			searchString,
+			include: includeParams
+		})).then((res) => onEntitiesUpdate(res.data)).catch(onError);
+		return () => {
+			cancelled = true;
+			unsubscribe?.();
+		};
 	}, [
 		dataClient,
 		path,
 		itemCount,
 		sortKey,
 		filterValues,
-		searchString
+		searchString,
+		Boolean(dataClient.collection(path).listen) ? void 0 : lastDeleteTimestamp
 	]);
 	const data = useDataOrder({
 		data: rawData,
@@ -3324,7 +3822,7 @@ function useDataTableController({ path, collection, scrollRestoration, entitiesD
 		popupCell
 	]);
 }
-function useUpdateUrl(filterValues, sortBy, searchString, updateUrl) {
+function useUpdateUrl(filterValues, sortBy, searchString, updateUrl, lastWrittenListStateRef) {
 	useEffect(() => {
 		if (updateUrl) {
 			const existingParams = new URLSearchParams(window.location.search);
@@ -3332,16 +3830,12 @@ function useUpdateUrl(filterValues, sortBy, searchString, updateUrl) {
 			existingParams.forEach((value, key) => {
 				if (key.startsWith("__") && key !== "__sort" && key !== "__sort_order") preservedParams.set(key, value);
 			});
-			const filterSortState = encodeFilterAndSort(filterValues, sortBy);
-			const search = searchString ? `search=${encodeURIComponent(searchString)}` : "";
-			const state = [
-				preservedParams.toString(),
-				filterSortState,
-				search
-			].filter(Boolean).join("&");
+			const listState = encodeListState(filterValues, sortBy, searchString);
+			lastWrittenListStateRef.current = listState;
+			const state = [preservedParams.toString(), listState].filter(Boolean).join("&");
 			const hash = window.location.hash;
-			if (state === "") window.history.replaceState({}, "", `${window.location.pathname}${hash}`);
-			else window.history.replaceState({}, "", `?${state}${hash}`);
+			if (state === "") window.history.replaceState(window.history.state, "", `${window.location.pathname}${hash}`);
+			else window.history.replaceState(window.history.state, "", `?${state}${hash}`);
 		}
 	}, [
 		filterValues,
@@ -3350,16 +3844,31 @@ function useUpdateUrl(filterValues, sortBy, searchString, updateUrl) {
 		updateUrl
 	]);
 }
+/**
+* The part of the query string this hook owns — filters, sort and search — in
+* the one canonical spelling, so two states can be compared by what they would
+* write.
+*/
+function encodeListState(filterValues, sortBy, searchString) {
+	const search = searchString ? `search=${encodeURIComponent(searchString)}` : "";
+	return [encodeFilterAndSort(filterValues, sortBy), search].filter(Boolean).join("&");
+}
+function parseSearchString(search) {
+	return new URLSearchParams(search).get("search") || void 0;
+}
+var OP_SUFFIX = "_op";
+var VALUE_SUFFIX = "_value";
 function encodeFilterAndSort(filterValues, sortBy) {
-	const entries = {};
+	const entries = [];
 	if (sortBy && sortBy.length > 0) {
-		entries["__sort"] = sortBy.map(([field]) => encodeURIComponent(field)).join(",");
-		entries["__sort_order"] = sortBy.map(([, direction]) => direction).join(",");
+		entries.push(["__sort", sortBy.map(([field]) => encodeURIComponent(field)).join(",")]);
+		entries.push(["__sort_order", sortBy.map(([, direction]) => direction).join(",")]);
 	}
 	if (filterValues) Object.entries(filterValues).forEach(([key, value]) => {
 		if (value) {
-			const [op, val] = (Array.isArray(value[0]) ? value : [value])[0] || [];
-			if (op) {
+			const conditions = Array.isArray(value[0]) ? value : [value];
+			for (const [op, val] of conditions) {
+				if (!op) continue;
 				let encodedValue = val;
 				try {
 					if (typeof val === "object") {
@@ -3376,14 +3885,13 @@ function encodeFilterAndSort(filterValues, sortBy) {
 					encodedValue = val;
 				}
 				if (encodedValue !== void 0) {
-					entries[encodeURIComponent(`${key}_op`)] = encodeURIComponent(op);
-					entries[encodeURIComponent(`${key}_value`)] = encodedValue ? encodeURIComponent(String(encodedValue)) : "null";
+					entries.push([encodeURIComponent(`${key}${OP_SUFFIX}`), encodeURIComponent(op)]);
+					entries.push([encodeURIComponent(`${key}${VALUE_SUFFIX}`), encodedValue === null ? "null" : encodeURIComponent(String(encodedValue))]);
 				}
 			}
 		}
 	});
-	if (!Object.keys(entries).length) return "";
-	return Object.entries(entries).map(([key, value]) => `${key}=${value}`).join("&");
+	return entries.map(([key, value]) => `${key}=${value}`).join("&");
 }
 function parseFilterAndSort(search) {
 	const entries = new URLSearchParams(search);
@@ -3394,11 +3902,13 @@ function parseFilterAndSort(search) {
 			const directions = (entries.get("__sort_order") ?? "").split(",");
 			const keys = value.split(",").map((field) => decodeURIComponent(field).trim()).filter(Boolean).map((field, index) => [field, directions[index] === "desc" ? "desc" : "asc"]);
 			sortBy = keys.length > 0 ? keys : void 0;
-		} else if (key.endsWith("_op")) {
-			const field = key.replace("_op", "");
-			const filterOp = decodeURIComponent(value);
-			const filterValStr = entries.get(`${field}_value`);
-			if (filterValStr !== null) filterValues[field] = [filterOp, decodeString(filterValStr)];
+		} else if (key.endsWith(OP_SUFFIX) && !(key.slice(0, -3) in filterValues)) {
+			const field = key.slice(0, -3);
+			const ops = entries.getAll(key);
+			const values = entries.getAll(`${field}${VALUE_SUFFIX}`);
+			const conditions = ops.slice(0, values.length).map((op, index) => [decodeURIComponent(op), decodeString(values[index])]);
+			if (conditions.length === 1) filterValues[field] = conditions[0];
+			else if (conditions.length > 1) filterValues[field] = conditions;
 		}
 	});
 	return {
@@ -3455,30 +3965,6 @@ function decodeString(val) {
 	return parsedFilterVal;
 }
 //#endregion
-//#region src/components/common/useScrollRestoration.tsx
-var collectionScrollCache = /* @__PURE__ */ new Map();
-function useScrollRestoration() {
-	const updateCollectionScroll = ({ path, filters, scrollOffset, data }) => {
-		collectionScrollCache.set(createCacheKey(path, filters), {
-			scrollOffset,
-			data
-		});
-	};
-	const getCollectionScroll = (path, filters) => {
-		return collectionScrollCache.get(createCacheKey(path, filters));
-	};
-	return {
-		getCollectionScroll,
-		updateCollectionScroll
-	};
-}
-function createCacheKey(path, filters) {
-	if (!filters) return path;
-	return `${path}?${filters ? Object.keys(filters).map((key) => {
-		return `${key}=${JSON.stringify(filters[key])}`;
-	}).join("&") : ""}`;
-}
-//#endregion
 //#region src/components/common/table_height.tsx
 function getRowHeight(size) {
 	switch (size) {
@@ -3861,6 +4347,15 @@ function UserSettingsView() {
 	const authController = useAuthController();
 	const user = authController.user;
 	const { t } = useTranslation();
+	const authControllerRef = useRef(authController);
+	authControllerRef.current = authController;
+	const mountedRef = useRef(true);
+	useEffect(() => {
+		mountedRef.current = true;
+		return () => {
+			mountedRef.current = false;
+		};
+	}, []);
 	const hasPasswordChange = !!authController.changePassword;
 	const [activeTab, setActiveTab] = useState("profile");
 	const [displayName, setDisplayName] = useState(user?.displayName || "");
@@ -3915,7 +4410,7 @@ function UserSettingsView() {
 				setNewPassword("");
 				setConfirmPassword("");
 				setTimeout(() => {
-					authController.signOut();
+					if (mountedRef.current && authControllerRef.current.user) authControllerRef.current.signOut();
 				}, 2e3);
 			}
 		} catch (e) {
@@ -4656,6 +5151,74 @@ function authErrorMessage(error, t) {
 	return error instanceof Error ? error.message : String(error);
 }
 //#endregion
+//#region src/components/LoginView/email-link.ts
+var ACTIONS = ["reset-password", "verify-email"];
+function readEmailLinkAction(location) {
+	const token = new URLSearchParams(location.search).get("token");
+	if (!token) return null;
+	const lastSegment = location.pathname.replace(/\/+$/, "").split("/").pop();
+	const kind = ACTIONS.find((action) => action === lastSegment);
+	return kind ? {
+		kind,
+		token
+	} : null;
+}
+/**
+* Where the app lives: the link's own address without the action segment and
+* its token. `/admin/reset-password?token=…` becomes `/admin/`.
+*/
+function appAddressOfEmailLink(location) {
+	const withoutAction = location.pathname.replace(/\/+$/, "").replace(/\/[^/]*$/, "");
+	return `${location.origin}${withoutAction}/`;
+}
+//#endregion
+//#region src/components/LoginView/mfa-required.ts
+function isFactor(value) {
+	return typeof value === "object" && value !== null && "id" in value && typeof value.id === "string" && value.id.length > 0 && "factorType" in value && typeof value.factorType === "string";
+}
+/**
+* The pending sign-in an `MFA_REQUIRED` refusal describes, or `null` for any
+* other error — including an `MFA_REQUIRED` without the token or a factor to
+* answer with, which no code step could finish.
+*/
+function readMfaRequired(error) {
+	if (!(error instanceof Error) || !("code" in error) || error.code !== "MFA_REQUIRED") return null;
+	const details = "details" in error ? error.details : void 0;
+	if (typeof details !== "object" || details === null) return null;
+	const mfaToken = "mfaToken" in details ? details.mfaToken : void 0;
+	const factors = "factors" in details && Array.isArray(details.factors) ? details.factors.filter(isFactor) : [];
+	if (typeof mfaToken !== "string" || !mfaToken || factors.length === 0) return null;
+	return {
+		mfaToken,
+		factors
+	};
+}
+/** Whether this controller can take a sign-in through its second step. */
+function canAnswerMfa(authController) {
+	return Boolean(authController.startMfaChallenge && authController.verifyMfaChallenge);
+}
+/**
+* What a refused challenge means for the code step.
+*
+* - `invalid-code`: the code was wrong; the same challenge takes another.
+* - `exhausted`: the challenge has had its five attempts; the next code needs
+*   a new one.
+* - `expired`: the sign-in itself is over. The pending token lasts five
+*   minutes from the password, and once it has lapsed both routes refuse the
+*   caller as unauthenticated; a challenge that lapsed, or a sign-in revoked
+*   meanwhile, ends the same way. Only a new sign-in gets a new token.
+*/
+function classifyMfaRefusal(error) {
+	if (!(error instanceof Error)) return "other";
+	const code = "code" in error && typeof error.code === "string" ? error.code : void 0;
+	const status = "status" in error && typeof error.status === "number" ? error.status : void 0;
+	if (code === "INVALID_CODE") return "invalid-code";
+	if (code === "CHALLENGE_EXHAUSTED") return "exhausted";
+	if (code === "INVALID_CHALLENGE" || code === "SESSION_REVOKED") return "expired";
+	if (status === 401 && (code === void 0 || code === "UNAUTHORIZED")) return "expired";
+	return "other";
+}
+//#endregion
 //#region src/components/LoginView/LoginView.tsx
 /**
 * The shared field background mixin (`dark:bg-black/30`) is invisible on the
@@ -4695,6 +5258,18 @@ function isUserCancellation(code) {
 	].includes(code);
 }
 /**
+* The controller's last refused sign-in, as a sign-in screen should show it:
+* not at all once a user is present — a stale failure must not sit over a
+* screen that has since succeeded — and not at all for an `MFA_REQUIRED` this
+* view can take to its code step, where it is a cue rather than a failure.
+*/
+function signInRefusal(authController) {
+	const error = authController.authProviderError;
+	if (!error || authController.user) return null;
+	if (canAnswerMfa(authController) && readMfaRequired(error)) return null;
+	return error;
+}
+/**
 * Generic login view component that works with any AuthControllerExtended.
 * Feature-detects capabilities to show/hide login methods.
 * @group Core
@@ -4702,11 +5277,25 @@ function isUserCancellation(code) {
 function LoginView({ logo, authController, noUserComponent, disableSignupScreen = false, disabled = false, notAllowedError, googleClientId, githubClientId, linkedinClientId, title, subtitle, needsSetup, registrationEnabled, additionalComponent, topComponent, defaultEmail, defaultPassword, onNewsletterOptIn }) {
 	const { mode: colorMode, setMode: setColorMode } = useModeController();
 	const { t } = useTranslation();
-	const [mode, setMode] = useState("buttons");
+	const [emailLink] = useState(() => typeof window === "undefined" ? null : readEmailLinkAction(window.location));
+	const [mode, setMode] = useState(emailLink?.kind ?? "buttons");
 	const [fadeIn, setFadeIn] = useState(false);
 	const [viewVisible, setViewVisible] = useState(true);
 	const [providerError, setProviderError] = useState(null);
 	const [newsletterOptIn, setNewsletterOptIn] = useState(false);
+	const [pendingMfa, setPendingMfa] = useState(null);
+	const mfaAnswerable = canAnswerMfa(authController);
+	useEffect(() => {
+		if (!mfaAnswerable || authController.user) return;
+		const pending = readMfaRequired(authController.authProviderError);
+		if (!pending) return;
+		setProviderError(null);
+		setPendingMfa(pending);
+	}, [
+		authController.authProviderError,
+		authController.user,
+		mfaAnswerable
+	]);
 	const authControllerRef = useRef(authController);
 	authControllerRef.current = authController;
 	/**
@@ -4760,7 +5349,7 @@ function LoginView({ logo, authController, noUserComponent, disableSignupScreen
 		const result = consumeOAuthCallback(window.location.search);
 		if (result.status === "none") return;
 		const cleanUrl = window.location.origin + window.location.pathname;
-		window.history.replaceState({}, document.title, cleanUrl);
+		window.history.replaceState(window.history.state, document.title, cleanUrl);
 		if (result.status === "error") {
 			console.error(`OAuth sign-in failed: ${result.error}`);
 			if (!isUserCancellation(result.error)) setProviderError(`Sign-in failed: ${result.error}`);
@@ -4790,7 +5379,8 @@ function LoginView({ logo, authController, noUserComponent, disableSignupScreen
 		alt: "Logo"
 	});
 	else logoComponent = /* @__PURE__ */ jsx(RebaseLogo, {});
-	const controllerError = authController.authProviderError && !authController.user ? authErrorMessage(authController.authProviderError, t) : null;
+	const refusal = signInRefusal(authController);
+	const controllerError = refusal ? authErrorMessage(refusal, t) : null;
 	const buttonsErrorMessage = providerError ?? controllerError;
 	let notAllowedMessage;
 	if (notAllowedError) if (typeof notAllowedError === "string") notAllowedMessage = notAllowedError;
@@ -4846,125 +5436,144 @@ function LoginView({ logo, authController, noUserComponent, disableSignupScreen
 				}),
 				/* @__PURE__ */ jsxs("div", {
 					className: cls("w-full transition-opacity duration-150", viewVisible ? "opacity-100" : "opacity-0"),
-					children: [isBootstrapMode && !authController.user && /* @__PURE__ */ jsx(LoginForm, {
-						authController,
-						registrationMode: true,
-						onClose: () => {},
-						onForgotPassword: () => {},
-						disableSignupScreen: false,
-						bootstrapMode: true,
-						defaultEmail,
-						defaultPassword,
-						onSignedIn: subscribeIfOptedIn,
-						newsletterOptIn,
-						setNewsletterOptIn,
-						showNewsletterOptIn: Boolean(onNewsletterOptIn)
-					}), !isBootstrapMode && /* @__PURE__ */ jsxs(Fragment, { children: [
-						mode === "buttons" && /* @__PURE__ */ jsxs("div", {
-							className: "w-full flex flex-col gap-3 mt-2",
-							children: [
-								buttonsErrorMessage && /* @__PURE__ */ jsx(ErrorView, { error: buttonsErrorMessage }),
-								(title || subtitle) && /* @__PURE__ */ jsxs("div", {
-									className: "text-center mb-2",
-									children: [title && /* @__PURE__ */ jsx(Typography, {
-										variant: "h6",
-										className: "mb-0.5 font-semibold",
-										children: title
-									}), subtitle && /* @__PURE__ */ jsx(Typography, {
-										variant: "body2",
-										color: "secondary",
-										className: "mb-4",
-										children: subtitle
-									})]
-								}),
-								topComponent && /* @__PURE__ */ jsx("div", {
-									className: "w-full",
-									children: topComponent
-								}),
-								onNewsletterOptIn && /* @__PURE__ */ jsxs("label", {
-									className: cls("flex items-center gap-2 cursor-pointer", (topComponent || title || subtitle) && "-mt-3"),
-									children: [/* @__PURE__ */ jsx(Checkbox, {
-										checked: newsletterOptIn,
-										onCheckedChange: (checked) => setNewsletterOptIn(checked === true),
-										size: "small"
-									}), /* @__PURE__ */ jsx(Typography, {
-										variant: "caption",
-										color: "secondary",
-										className: "select-none",
-										children: t("join_newsletter")
-									})]
-								}),
-								/* @__PURE__ */ jsx(LoginButton, {
-									disabled,
-									text: "Sign in with email",
-									icon: /* @__PURE__ */ jsx(MailIcon, {}),
-									onClick: () => switchMode("login")
-								}),
-								hasGoogleLogin && googleClientId && /* @__PURE__ */ jsx(GoogleLoginButton, {
-									disabled,
-									googleClientId,
-									authController,
-									onSignedIn: () => subscribeIfOptedIn(authControllerRef.current.user?.email),
-									onError: setProviderError
-								}),
-								hasGitHubLogin && githubClientId && /* @__PURE__ */ jsx(GitHubLoginButton, {
-									disabled,
-									githubClientId
-								}),
-								hasLinkedinLogin && linkedinClientId && /* @__PURE__ */ jsx(LinkedInLoginButton, {
-									disabled,
-									linkedinClientId
-								}),
-								showRegistration && /* @__PURE__ */ jsx("div", {
-									className: "mt-2 text-center",
-									children: /* @__PURE__ */ jsxs(Typography, {
-										variant: "body2",
-										color: "secondary",
-										children: [
-											"Don't have an account?",
-											" ",
-											/* @__PURE__ */ jsx("button", {
-												type: "button",
-												className: "font-semibold hover:underline cursor-pointer text-primary dark:text-primary-light",
-												onClick: () => switchMode("register"),
-												children: "Create one"
-											})
-										]
-									})
-								})
-							]
-						}),
-						mode === "login" && /* @__PURE__ */ jsx(LoginForm, {
-							authController,
-							registrationMode: false,
-							onClose: () => switchMode("buttons"),
-							onForgotPassword: hasPasswordReset ? () => switchMode("forgot") : void 0,
-							noUserComponent,
-							disableSignupScreen,
-							switchToRegister: showRegistration ? () => switchMode("register") : void 0,
-							defaultEmail,
-							defaultPassword,
-							onSignedIn: subscribeIfOptedIn
-						}),
-						mode === "register" && /* @__PURE__ */ jsx(LoginForm, {
+					children: [
+						isBootstrapMode && !authController.user && /* @__PURE__ */ jsx(LoginForm, {
 							authController,
 							registrationMode: true,
-							onClose: () => switchMode("buttons"),
-							onForgotPassword: hasPasswordReset ? () => switchMode("forgot") : void 0,
-							noUserComponent,
-							disableSignupScreen,
-							switchToLogin: () => switchMode("login"),
+							onClose: () => {},
+							onForgotPassword: () => {},
+							disableSignupScreen: false,
+							bootstrapMode: true,
 							defaultEmail,
 							defaultPassword,
-							onSignedIn: subscribeIfOptedIn
+							onSignedIn: subscribeIfOptedIn,
+							newsletterOptIn,
+							setNewsletterOptIn,
+							showNewsletterOptIn: Boolean(onNewsletterOptIn)
 						}),
-						mode === "forgot" && authController.forgotPassword && /* @__PURE__ */ jsx(ForgotPasswordForm, {
+						!isBootstrapMode && pendingMfa && /* @__PURE__ */ jsx(MfaChallengeForm, {
+							pending: pendingMfa,
 							authController,
-							onClose: () => switchMode("login")
-						})
-					] })]
+							onBack: () => setPendingMfa(null),
+							onSignedIn: () => subscribeIfOptedIn(authControllerRef.current.user?.email)
+						}, pendingMfa.mfaToken),
+						!isBootstrapMode && !pendingMfa && /* @__PURE__ */ jsxs(Fragment, { children: [
+							mode === "buttons" && /* @__PURE__ */ jsxs("div", {
+								className: "w-full flex flex-col gap-3 mt-2",
+								children: [
+									buttonsErrorMessage && /* @__PURE__ */ jsx(ErrorView, { error: buttonsErrorMessage }),
+									(title || subtitle) && /* @__PURE__ */ jsxs("div", {
+										className: "text-center mb-2",
+										children: [title && /* @__PURE__ */ jsx(Typography, {
+											variant: "h6",
+											className: "mb-0.5 font-semibold",
+											children: title
+										}), subtitle && /* @__PURE__ */ jsx(Typography, {
+											variant: "body2",
+											color: "secondary",
+											className: "mb-4",
+											children: subtitle
+										})]
+									}),
+									topComponent && /* @__PURE__ */ jsx("div", {
+										className: "w-full",
+										children: topComponent
+									}),
+									onNewsletterOptIn && /* @__PURE__ */ jsxs("label", {
+										className: cls("flex items-center gap-2 cursor-pointer", (topComponent || title || subtitle) && "-mt-3"),
+										children: [/* @__PURE__ */ jsx(Checkbox, {
+											checked: newsletterOptIn,
+											onCheckedChange: (checked) => setNewsletterOptIn(checked === true),
+											size: "small"
+										}), /* @__PURE__ */ jsx(Typography, {
+											variant: "caption",
+											color: "secondary",
+											className: "select-none",
+											children: t("join_newsletter")
+										})]
+									}),
+									/* @__PURE__ */ jsx(LoginButton, {
+										disabled,
+										text: "Sign in with email",
+										icon: /* @__PURE__ */ jsx(MailIcon, {}),
+										onClick: () => switchMode("login")
+									}),
+									hasGoogleLogin && googleClientId && /* @__PURE__ */ jsx(GoogleLoginButton, {
+										disabled,
+										googleClientId,
+										authController,
+										onSignedIn: () => subscribeIfOptedIn(authControllerRef.current.user?.email),
+										onError: setProviderError
+									}),
+									hasGitHubLogin && githubClientId && /* @__PURE__ */ jsx(GitHubLoginButton, {
+										disabled,
+										githubClientId
+									}),
+									hasLinkedinLogin && linkedinClientId && /* @__PURE__ */ jsx(LinkedInLoginButton, {
+										disabled,
+										linkedinClientId
+									}),
+									showRegistration && /* @__PURE__ */ jsx("div", {
+										className: "mt-2 text-center",
+										children: /* @__PURE__ */ jsxs(Typography, {
+											variant: "body2",
+											color: "secondary",
+											children: [
+												"Don't have an account?",
+												" ",
+												/* @__PURE__ */ jsx("button", {
+													type: "button",
+													className: "font-semibold hover:underline cursor-pointer text-primary dark:text-primary-light",
+													onClick: () => switchMode("register"),
+													children: "Create one"
+												})
+											]
+										})
+									})
+								]
+							}),
+							mode === "login" && /* @__PURE__ */ jsx(LoginForm, {
+								authController,
+								registrationMode: false,
+								onClose: () => switchMode("buttons"),
+								onForgotPassword: hasPasswordReset ? () => switchMode("forgot") : void 0,
+								noUserComponent,
+								disableSignupScreen,
+								switchToRegister: showRegistration ? () => switchMode("register") : void 0,
+								defaultEmail,
+								defaultPassword,
+								onSignedIn: subscribeIfOptedIn
+							}),
+							mode === "register" && /* @__PURE__ */ jsx(LoginForm, {
+								authController,
+								registrationMode: true,
+								onClose: () => switchMode("buttons"),
+								onForgotPassword: hasPasswordReset ? () => switchMode("forgot") : void 0,
+								noUserComponent,
+								disableSignupScreen,
+								switchToLogin: () => switchMode("login"),
+								defaultEmail,
+								defaultPassword,
+								onSignedIn: subscribeIfOptedIn
+							}),
+							mode === "forgot" && authController.forgotPassword && /* @__PURE__ */ jsx(ForgotPasswordForm, {
+								authController,
+								onClose: () => switchMode("login")
+							}),
+							mode === "reset-password" && emailLink?.kind === "reset-password" && /* @__PURE__ */ jsx(ResetPasswordForm, {
+								token: emailLink.token,
+								authController,
+								onDone: leaveEmailLink
+							}),
+							mode === "verify-email" && emailLink?.kind === "verify-email" && /* @__PURE__ */ jsx(VerifyEmailView, {
+								token: emailLink.token,
+								authController,
+								onDone: leaveEmailLink
+							})
+						] })
+					]
 				}),
-				additionalComponent && !isBootstrapMode && mode === "buttons" && /* @__PURE__ */ jsx("div", {
+				additionalComponent && !isBootstrapMode && mode === "buttons" && !pendingMfa && /* @__PURE__ */ jsx("div", {
 					className: "w-full",
 					children: additionalComponent
 				})
@@ -5020,10 +5629,15 @@ function GoogleLoginButton({ disabled, googleClientId, authController, onSignedI
 	onSignedInRef.current = onSignedIn;
 	const onErrorRef = useRef(onError);
 	onErrorRef.current = onError;
-	useEffect(() => {
-		if (!authController.googleLogin) return;
+	/**
+	* Build Google's code client, if its script has arrived. Google's script
+	* tag is `async`, so it routinely lands after this button has mounted:
+	* the click tries again rather than trusting whatever the mount saw.
+	*/
+	const ensureCodeClient = useCallback(() => {
+		if (codeClientRef.current || !authController.googleLogin) return codeClientRef.current;
 		const google = window.google;
-		if (!google || codeClientRef.current) return;
+		if (!google) return null;
 		codeClientRef.current = google.accounts.oauth2.initCodeClient({
 			client_id: googleClientId,
 			scope: "openid email profile",
@@ -5046,15 +5660,20 @@ function GoogleLoginButton({ disabled, googleClientId, authController, onSignedI
 				}
 			}
 		});
+		return codeClientRef.current;
 	}, [googleClientId, authController]);
+	useEffect(() => {
+		ensureCodeClient();
+	}, [ensureCodeClient]);
 	const handleClick = () => {
-		if (!codeClientRef.current) {
+		const codeClient = ensureCodeClient();
+		if (!codeClient) {
 			console.error("Google Sign-In not loaded");
 			onErrorRef.current?.("Google Sign-In could not be loaded. Check your connection or any script blockers, then try again.");
 			return;
 		}
 		onErrorRef.current?.(null);
-		codeClientRef.current.requestCode();
+		codeClient.requestCode();
 	};
 	return /* @__PURE__ */ jsx(LoginButton, {
 		disabled,
@@ -5159,8 +5778,8 @@ function LoginForm({ onClose, onForgotPassword, authController, registrationMode
 				})
 			}),
 			(() => {
-				const err = authController.authProviderError;
-				if (!err || authController.user) return null;
+				const err = signInRefusal(authController);
+				if (!err) return null;
 				return /* @__PURE__ */ jsx("div", {
 					className: "w-full mb-2",
 					children: /* @__PURE__ */ jsx(ErrorView, { error: authErrorMessage(err, t) })
@@ -5318,6 +5937,396 @@ function LoginForm({ onClose, onForgotPassword, authController, registrationMode
 		]
 	});
 }
+/** How a factor is named in the picker: the name its owner gave it, if any. */
+function factorName(factor, index, t) {
+	if (factor.friendlyName) return factor.friendlyName;
+	return `${factor.factorType === "totp" ? t("auth_mfa_factor_totp") : factor.factorType} ${index + 1}`;
+}
+/**
+* The second step of a sign-in refused with `MFA_REQUIRED`: a code from the
+* authenticator app, or one of the recovery codes, in the same field — the
+* server tries the one and then the other.
+*
+* The challenge is opened on the first submit and answered by every code
+* after it until it is spent, which is after five wrong ones: the next code
+* then opens a new one. The pending token behind both lasts five minutes from
+* the password; once it has lapsed nothing here can help, so the step says so
+* and sends the visitor back to sign in again.
+*/
+function MfaChallengeForm({ pending, authController, onBack, onSignedIn }) {
+	const { t } = useTranslation();
+	const factorFieldId = useId();
+	const codeId = useId();
+	const [factorId, setFactorId] = useState(pending.factors[0].id);
+	const [code, setCode] = useState("");
+	const [challengeId, setChallengeId] = useState(null);
+	const [submitting, setSubmitting] = useState(false);
+	const [error, setError] = useState(null);
+	const [expired, setExpired] = useState(false);
+	const chooseFactor = (id) => {
+		setFactorId(id);
+		setChallengeId(null);
+		setError(null);
+	};
+	const handleSubmit = async (event) => {
+		event.preventDefault();
+		const answer = code.trim();
+		const { startMfaChallenge, verifyMfaChallenge } = authController;
+		if (!answer || submitting || expired || !startMfaChallenge || !verifyMfaChallenge) return;
+		setError(null);
+		setSubmitting(true);
+		try {
+			const id = challengeId ?? await startMfaChallenge(pending.mfaToken, factorId);
+			setChallengeId(id);
+			await verifyMfaChallenge(pending.mfaToken, id, answer);
+			onSignedIn?.();
+		} catch (err) {
+			switch (classifyMfaRefusal(err)) {
+				case "invalid-code":
+					setCode("");
+					setError(t("auth_mfa_code_invalid"));
+					break;
+				case "exhausted":
+					setCode("");
+					setChallengeId(null);
+					setError(t("auth_mfa_challenge_exhausted"));
+					break;
+				case "expired":
+					setExpired(true);
+					setError(t("auth_mfa_expired"));
+					break;
+				default: setError(authErrorMessage(err, t));
+			}
+		} finally {
+			setSubmitting(false);
+		}
+	};
+	return /* @__PURE__ */ jsxs("form", {
+		onSubmit: handleSubmit,
+		className: "flex flex-col w-full gap-1 mt-2",
+		children: [
+			/* @__PURE__ */ jsx("div", {
+				className: "w-full mb-2 -ml-2.5",
+				children: /* @__PURE__ */ jsx(IconButton, {
+					onClick: onBack,
+					"aria-label": t("back"),
+					children: /* @__PURE__ */ jsx(ArrowLeftIcon, {})
+				})
+			}),
+			/* @__PURE__ */ jsx(Typography, {
+				variant: "h6",
+				className: "mb-0.5",
+				children: t("auth_mfa_title")
+			}),
+			/* @__PURE__ */ jsx(Typography, {
+				variant: "body2",
+				color: "secondary",
+				className: "mb-5",
+				children: t("auth_mfa_subtitle")
+			}),
+			error && /* @__PURE__ */ jsx("div", {
+				className: "w-full mb-3",
+				children: /* @__PURE__ */ jsx(ErrorView, { error })
+			}),
+			pending.factors.length > 1 && /* @__PURE__ */ jsxs("div", {
+				className: "w-full mb-3",
+				children: [/* @__PURE__ */ jsx(Typography, {
+					variant: "label",
+					component: "label",
+					color: "secondary",
+					className: "mb-1",
+					htmlFor: factorFieldId,
+					children: t("auth_mfa_factor_label")
+				}), /* @__PURE__ */ jsx(Select, {
+					id: factorFieldId,
+					"aria-label": t("auth_mfa_factor_label"),
+					value: factorId,
+					onValueChange: chooseFactor,
+					disabled: submitting || expired,
+					size: "medium",
+					fullWidth: true,
+					children: pending.factors.map((factor, index) => /* @__PURE__ */ jsx(SelectItem, {
+						value: factor.id,
+						children: factorName(factor, index, t)
+					}, factor.id))
+				})]
+			}),
+			/* @__PURE__ */ jsxs("div", {
+				className: "w-full mb-3",
+				children: [/* @__PURE__ */ jsx(Typography, {
+					variant: "label",
+					component: "label",
+					color: "secondary",
+					className: "mb-1",
+					htmlFor: codeId,
+					children: t("auth_mfa_code_label")
+				}), /* @__PURE__ */ jsx(TextField, {
+					id: codeId,
+					className: loginFieldClasses,
+					autoFocus: true,
+					autoComplete: "one-time-code",
+					autoCapitalize: "none",
+					spellCheck: false,
+					value: code,
+					disabled: expired,
+					type: "text",
+					size: "medium",
+					onChange: (event) => setCode(event.target.value)
+				})]
+			}),
+			expired ? /* @__PURE__ */ jsx(Button, {
+				onClick: onBack,
+				variant: "filled",
+				color: "primary",
+				size: "large",
+				className: "w-full mt-1",
+				children: t("auth_mfa_sign_in_again")
+			}) : /* @__PURE__ */ jsx(LoadingButton, {
+				type: "submit",
+				variant: "filled",
+				color: "primary",
+				className: "w-full mt-1",
+				size: "large",
+				loading: submitting,
+				disabled: submitting || !code.trim(),
+				children: t("auth_mfa_verify")
+			})
+		]
+	});
+}
+/**
+* Leave an email link for the app's own address, with a fresh load.
+*
+* The router, when there is one, still stands on `/reset-password`: rewriting
+* the address under it would leave it rendering a route that does not exist
+* the moment the user signs in. A load starts it where the app starts, and the
+* spent token leaves the address bar and the history entry with it.
+*/
+function leaveEmailLink() {
+	window.location.replace(appAddressOfEmailLink(window.location));
+}
+/** What to say about a refused email-link token, or any other failure. */
+function emailLinkErrorMessage(error, t) {
+	if (error instanceof Error && "code" in error && error.code === "INVALID_TOKEN") return t("auth_link_invalid_or_expired");
+	return authErrorMessage(error, t);
+}
+/**
+* The step a reset link opens: a new password for the account the token was
+* issued to. An invitation sends the same link, so this is also where an
+* invited user — created without a password — sets their first one.
+*/
+function ResetPasswordForm({ token, authController, onDone }) {
+	const { t } = useTranslation();
+	const passwordId = useId();
+	const confirmationId = useId();
+	const [password, setPassword] = useState("");
+	const [confirmation, setConfirmation] = useState("");
+	const [submitting, setSubmitting] = useState(false);
+	const [error, setError] = useState(null);
+	const [changed, setChanged] = useState(false);
+	const handleSubmit = async (event) => {
+		event.preventDefault();
+		setError(null);
+		if (!authController.resetPassword) {
+			setError(t("auth_password_reset_unavailable"));
+			return;
+		}
+		if (password !== confirmation) {
+			setError(t("passwords_dont_match"));
+			return;
+		}
+		setSubmitting(true);
+		try {
+			await authController.resetPassword(token, password);
+			setChanged(true);
+		} catch (err) {
+			setError(emailLinkErrorMessage(err, t));
+		} finally {
+			setSubmitting(false);
+		}
+	};
+	if (changed) return /* @__PURE__ */ jsxs("div", {
+		className: "flex flex-col w-full gap-4 mt-2",
+		children: [/* @__PURE__ */ jsxs("div", {
+			className: "flex flex-col items-center text-center rounded-xl p-6 bg-surface-raised",
+			children: [
+				/* @__PURE__ */ jsx(CheckCircle2Icon, {
+					size: iconSize.large,
+					className: "mb-3 text-primary"
+				}),
+				/* @__PURE__ */ jsx(Typography, {
+					variant: "subtitle1",
+					className: "mb-2",
+					children: t("auth_password_changed_title")
+				}),
+				/* @__PURE__ */ jsx(Typography, {
+					variant: "body2",
+					color: "secondary",
+					children: t("auth_password_changed_body")
+				})
+			]
+		}), /* @__PURE__ */ jsx(Button, {
+			onClick: onDone,
+			variant: "filled",
+			color: "primary",
+			size: "large",
+			className: "w-full",
+			children: t("auth_continue_to_sign_in")
+		})]
+	});
+	return /* @__PURE__ */ jsxs("form", {
+		onSubmit: handleSubmit,
+		className: "flex flex-col w-full gap-1 mt-2",
+		children: [
+			/* @__PURE__ */ jsx("div", {
+				className: "w-full mb-2 -ml-2.5",
+				children: /* @__PURE__ */ jsx(IconButton, {
+					onClick: onDone,
+					"aria-label": t("back"),
+					children: /* @__PURE__ */ jsx(ArrowLeftIcon, {})
+				})
+			}),
+			/* @__PURE__ */ jsx(Typography, {
+				variant: "h6",
+				className: "mb-0.5",
+				children: t("auth_new_password_title")
+			}),
+			/* @__PURE__ */ jsx(Typography, {
+				variant: "body2",
+				color: "secondary",
+				className: "mb-5",
+				children: t("auth_new_password_subtitle")
+			}),
+			error && /* @__PURE__ */ jsx("div", {
+				className: "w-full mb-3",
+				children: /* @__PURE__ */ jsx(ErrorView, { error })
+			}),
+			/* @__PURE__ */ jsxs("div", {
+				className: "w-full mb-3",
+				children: [/* @__PURE__ */ jsx(Typography, {
+					variant: "label",
+					component: "label",
+					color: "secondary",
+					className: "mb-1",
+					htmlFor: passwordId,
+					children: t("new_password")
+				}), /* @__PURE__ */ jsx(TextField, {
+					id: passwordId,
+					className: loginFieldClasses,
+					autoFocus: true,
+					autoComplete: "new-password",
+					value: password,
+					type: "password",
+					size: "medium",
+					onChange: (event) => setPassword(event.target.value)
+				})]
+			}),
+			/* @__PURE__ */ jsxs("div", {
+				className: "w-full mb-1",
+				children: [/* @__PURE__ */ jsx(Typography, {
+					variant: "label",
+					component: "label",
+					color: "secondary",
+					className: "mb-1",
+					htmlFor: confirmationId,
+					children: t("confirm_password")
+				}), /* @__PURE__ */ jsx(TextField, {
+					id: confirmationId,
+					className: loginFieldClasses,
+					autoComplete: "new-password",
+					value: confirmation,
+					type: "password",
+					size: "medium",
+					onChange: (event) => setConfirmation(event.target.value)
+				})]
+			}),
+			/* @__PURE__ */ jsx(Typography, {
+				variant: "caption",
+				color: "secondary",
+				className: "mb-3",
+				children: t("auth_password_requirements")
+			}),
+			/* @__PURE__ */ jsx(LoadingButton, {
+				type: "submit",
+				variant: "filled",
+				color: "primary",
+				className: "w-full mt-1",
+				size: "large",
+				loading: submitting,
+				disabled: submitting || !password || !confirmation,
+				children: t("auth_set_password")
+			})
+		]
+	});
+}
+/**
+* The step a verification link opens. There is nothing to ask: the token is
+* spent as soon as the screen opens, and the result is what it shows.
+*/
+function VerifyEmailView({ token, authController, onDone }) {
+	const { t } = useTranslation();
+	const [status, setStatus] = useState("verifying");
+	const [error, setError] = useState(null);
+	const requestedRef = useRef(false);
+	useEffect(() => {
+		if (requestedRef.current) return;
+		requestedRef.current = true;
+		if (!authController.verifyEmail) {
+			setError(t("auth_email_verification_unavailable"));
+			setStatus("failed");
+			return;
+		}
+		authController.verifyEmail(token).then(() => setStatus("verified")).catch((err) => {
+			setError(emailLinkErrorMessage(err, t));
+			setStatus("failed");
+		});
+	}, [
+		authController,
+		token,
+		t
+	]);
+	if (status === "verifying") return /* @__PURE__ */ jsxs("div", {
+		className: "flex flex-col items-center w-full gap-4 mt-6 mb-4",
+		children: [/* @__PURE__ */ jsx(CircularProgress, { size: "small" }), /* @__PURE__ */ jsx(Typography, {
+			variant: "body2",
+			color: "secondary",
+			children: t("auth_verifying_email")
+		})]
+	});
+	return /* @__PURE__ */ jsxs("div", {
+		className: "flex flex-col w-full gap-4 mt-2",
+		children: [status === "verified" ? /* @__PURE__ */ jsxs("div", {
+			className: "flex flex-col items-center text-center rounded-xl p-6 bg-surface-raised",
+			children: [
+				/* @__PURE__ */ jsx(CheckCircle2Icon, {
+					size: iconSize.large,
+					className: "mb-3 text-primary"
+				}),
+				/* @__PURE__ */ jsx(Typography, {
+					variant: "subtitle1",
+					className: "mb-2",
+					children: t("auth_email_verified_title")
+				}),
+				/* @__PURE__ */ jsx(Typography, {
+					variant: "body2",
+					color: "secondary",
+					children: t("auth_email_verified_body")
+				})
+			]
+		}) : /* @__PURE__ */ jsxs(Fragment, { children: [/* @__PURE__ */ jsx(Typography, {
+			variant: "h6",
+			className: "mb-0.5",
+			children: t("auth_email_verification_failed_title")
+		}), error && /* @__PURE__ */ jsx(ErrorView, { error })] }), /* @__PURE__ */ jsx(Button, {
+			onClick: onDone,
+			variant: "filled",
+			color: "primary",
+			size: "large",
+			className: "w-full",
+			children: t("auth_continue_to_sign_in")
+		})]
+	});
+}
 function ForgotPasswordForm({ onClose, authController }) {
 	const [email, setEmail] = useState("");
 	const [submitted, setSubmitted] = useState(false);
@@ -6050,6 +7059,30 @@ var en = {
 	auth_have_account: "Have an account?",
 	auth_sign_in: "Sign In",
 	auth_sign_up: "Sign Up",
+	auth_new_password_title: "Set a new password",
+	auth_new_password_subtitle: "Choose the password you will sign in with from now on.",
+	auth_password_requirements: "Password must be 8+ characters with uppercase, lowercase, and a number",
+	auth_set_password: "Set password",
+	auth_password_changed_title: "Password changed",
+	auth_password_changed_body: "Sign in with your new password.",
+	auth_continue_to_sign_in: "Continue to sign in",
+	auth_link_invalid_or_expired: "This link is invalid or has expired. Request a new one from the sign-in screen.",
+	auth_password_reset_unavailable: "Password reset is not available on this backend.",
+	auth_verifying_email: "Confirming your email address…",
+	auth_email_verified_title: "Email confirmed",
+	auth_email_verified_body: "Your email address is confirmed. You can sign in now.",
+	auth_email_verification_failed_title: "Email not confirmed",
+	auth_email_verification_unavailable: "Email verification is not available on this backend.",
+	auth_mfa_title: "Two-step verification",
+	auth_mfa_subtitle: "Enter the code from your authenticator app, or one of your recovery codes.",
+	auth_mfa_factor_label: "Verify with",
+	auth_mfa_factor_totp: "Authenticator app",
+	auth_mfa_code_label: "Verification code",
+	auth_mfa_verify: "Verify",
+	auth_mfa_code_invalid: "That code is not right. Try the current code from your authenticator app, or a recovery code.",
+	auth_mfa_challenge_exhausted: "Too many wrong codes. Enter a new code from your authenticator app to try again.",
+	auth_mfa_expired: "This sign-in has expired. Sign in again to continue.",
+	auth_mfa_sign_in_again: "Sign in again",
 	auto_setup_collections_button: "Automatically set up collections",
 	auto_setup_collections_title: "Automatically set up collections?",
 	auto_setup_collections_desc: "This will automatically create collection configs for collections that are <b>NOT</b> already mapped",
@@ -6212,10 +7245,12 @@ var en = {
 	studio_sql_cannot_edit_missing_query: "Cannot edit rows: The underlying query is missing.",
 	studio_sql_cannot_resolve_table: "Could not resolve table/primary key",
 	studio_sql_missing_pk: "Row is missing primary key column(s): {{columns}}. Cannot safely update.",
+	studio_sql_cannot_edit_other_connection: "These rows were read from another database or as another role. Run the query again to edit them.",
 	studio_sql_update_failed: "Failed to update: {{message}}",
 	studio_sql_execution_not_supported: "SQL execution is not supported by the current data source.",
 	studio_sql_error_executing: "An error occurred while executing the query.",
 	studio_sql_error_explaining: "An error occurred while explaining the query.",
+	studio_sql_explain_single_statement: "Explain works on one statement at a time. Select the statement to explain and try again.",
 	studio_sql_save_first_to_favorite: "Please save the snippet first before favoriting.",
 	studio_sql_collections_label: "Collections:",
 	studio_sql_admin_collections_tooltip: "Tables in this query that are mapped to collections",
@@ -6262,6 +7297,9 @@ var en = {
 	studio_rls_enable_force_rls: "Enable Force RLS",
 	studio_rls_disable_force_rls: "Disable Force RLS",
 	studio_rls_edit: "Edit",
+	studio_rls_edit_generated: "{{policy}} is generated by Rebase for every collection, so there is no rule of yours to edit. Add a policy of your own instead.",
+	studio_rls_edit_not_declared: "{{policy}} exists only in the database, so there is no rule in your code to edit. Import it to the codebase first.",
+	studio_rls_edit_several_operations: "{{policy}} is one of the policies a single rule compiles to, one per operation. Edit that rule in the collection's source file.",
 	studio_rls_delete: "Delete",
 	studio_rls_confirm_delete_title: "Delete Policy",
 	studio_rls_confirm_delete_body: "Are you sure you want to delete this policy? This action cannot be undone.",
@@ -6442,6 +7480,8 @@ var en = {
 	studio_cron_denied_title: "You cannot list this project's cron jobs",
 	studio_cron_denied_hint: "Nothing is wrong with the project. The cron API is admin-only, and the signed-in account was refused.",
 	studio_cron_read_failed: "Could not read this project's cron jobs",
+	studio_cron_logs_read_failed: "Could not read this job's executions",
+	studio_cron_logs_denied_title: "You cannot read this job's executions",
 	studio_api_keys_denied_title: "You cannot list this project's API keys",
 	studio_api_keys_denied_hint: "Nothing is wrong with the project. Managing API keys is an admin operation, and the signed-in account was refused.",
 	studio_api_keys_read_failed: "Could not read this project's API keys",
@@ -6460,6 +7500,7 @@ var en = {
 	studio_api_keys_status_active: "Active",
 	studio_api_keys_status_expired: "Expired",
 	studio_api_keys_status_revoked: "Revoked",
+	studio_api_keys_inactive_heading: "Revoked / Expired",
 	studio_api_keys_stat_status: "Status",
 	studio_api_keys_stat_last_used: "Last used",
 	studio_api_keys_stat_expires: "Expires",
@@ -7067,6 +8108,30 @@ var es = {
 	auth_have_account: "¿Tienes una cuenta?",
 	auth_sign_in: "Iniciar Sesión",
 	auth_sign_up: "Regístrate",
+	auth_new_password_title: "Establece una nueva contraseña",
+	auth_new_password_subtitle: "Elige la contraseña con la que iniciarás sesión a partir de ahora.",
+	auth_password_requirements: "La contraseña debe tener al menos 8 caracteres, con mayúsculas, minúsculas y un número",
+	auth_set_password: "Establecer contraseña",
+	auth_password_changed_title: "Contraseña cambiada",
+	auth_password_changed_body: "Inicia sesión con tu nueva contraseña.",
+	auth_continue_to_sign_in: "Continuar al inicio de sesión",
+	auth_link_invalid_or_expired: "Este enlace no es válido o ha caducado. Solicita uno nuevo desde la pantalla de inicio de sesión.",
+	auth_password_reset_unavailable: "El restablecimiento de contraseña no está disponible en este backend.",
+	auth_verifying_email: "Confirmando tu dirección de correo…",
+	auth_email_verified_title: "Correo confirmado",
+	auth_email_verified_body: "Tu dirección de correo está confirmada. Ya puedes iniciar sesión.",
+	auth_email_verification_failed_title: "Correo no confirmado",
+	auth_email_verification_unavailable: "La verificación de correo no está disponible en este backend.",
+	auth_mfa_title: "Verificación en dos pasos",
+	auth_mfa_subtitle: "Introduce el código de tu aplicación de autenticación o uno de tus códigos de recuperación.",
+	auth_mfa_factor_label: "Verificar con",
+	auth_mfa_factor_totp: "Aplicación de autenticación",
+	auth_mfa_code_label: "Código de verificación",
+	auth_mfa_verify: "Verificar",
+	auth_mfa_code_invalid: "Ese código no es correcto. Prueba el código actual de tu aplicación de autenticación o un código de recuperación.",
+	auth_mfa_challenge_exhausted: "Demasiados códigos incorrectos. Introduce un código nuevo de tu aplicación de autenticación para volver a intentarlo.",
+	auth_mfa_expired: "Este inicio de sesión ha caducado. Vuelve a iniciar sesión para continuar.",
+	auth_mfa_sign_in_again: "Volver a iniciar sesión",
 	auto_setup_collections_button: "Configurar colecciones automáticamente",
 	auto_setup_collections_title: "¿Configurar colecciones automáticamente?",
 	auto_setup_collections_desc: "Esto creará automáticamente la configuración de las colecciones que <b>NO</b> estén mapeadas",
@@ -7229,10 +8294,12 @@ var es = {
 	studio_sql_cannot_edit_missing_query: "No se pueden editar las filas: falta la consulta subyacente.",
 	studio_sql_cannot_resolve_table: "No se pudo determinar la tabla ni la clave primaria",
 	studio_sql_missing_pk: "A la fila le faltan columnas de clave primaria: {{columns}}. No se puede actualizar con seguridad.",
+	studio_sql_cannot_edit_other_connection: "Estas filas se leyeron de otra base de datos o con otro rol. Vuelve a ejecutar la consulta para editarlas.",
 	studio_sql_update_failed: "Error al actualizar: {{message}}",
 	studio_sql_execution_not_supported: "La fuente de datos actual no admite la ejecución de SQL.",
 	studio_sql_error_executing: "Se produjo un error al ejecutar la consulta.",
 	studio_sql_error_explaining: "Se produjo un error al explicar la consulta.",
+	studio_sql_explain_single_statement: "Explain funciona con una sola sentencia a la vez. Selecciona la sentencia que quieres explicar y vuelve a intentarlo.",
 	studio_sql_save_first_to_favorite: "Guarda el fragmento antes de marcarlo como favorito.",
 	studio_sql_collections_label: "Collections:",
 	studio_sql_admin_collections_tooltip: "Tables in this query that are mapped as admin collections",
@@ -7279,6 +8346,9 @@ var es = {
 	studio_rls_enable_force_rls: "Activar RLS forzada",
 	studio_rls_disable_force_rls: "Desactivar RLS forzada",
 	studio_rls_edit: "Edit",
+	studio_rls_edit_generated: "Rebase genera {{policy}} para todas las colecciones, así que no hay ninguna regla tuya que editar. Añade una política propia en su lugar.",
+	studio_rls_edit_not_declared: "{{policy}} solo existe en la base de datos, así que no hay ninguna regla en tu código que editar. Impórtala primero al código.",
+	studio_rls_edit_several_operations: "{{policy}} es una de las políticas en las que se compila una sola regla, una por operación. Edita esa regla en el archivo fuente de la colección.",
 	studio_rls_delete: "Delete",
 	studio_rls_confirm_delete_title: "Eliminar política",
 	studio_rls_confirm_delete_body: "¿Seguro que quieres eliminar esta política? Esta acción no se puede deshacer.",
@@ -7459,6 +8529,8 @@ var es = {
 	studio_cron_denied_title: "No puedes listar las tareas cron de este proyecto",
 	studio_cron_denied_hint: "El proyecto está bien. La API de cron es solo para administradores, y la cuenta con la sesión iniciada fue rechazada.",
 	studio_cron_read_failed: "No se han podido leer las tareas cron de este proyecto",
+	studio_cron_logs_read_failed: "No se han podido leer las ejecuciones de esta tarea",
+	studio_cron_logs_denied_title: "No puedes leer las ejecuciones de esta tarea",
 	studio_api_keys_denied_title: "No puedes listar las claves de API de este proyecto",
 	studio_api_keys_denied_hint: "El proyecto está bien. Gestionar claves de API es una operación de administrador, y la cuenta con la sesión iniciada fue rechazada.",
 	studio_api_keys_read_failed: "No se han podido leer las claves de API de este proyecto",
@@ -7477,6 +8549,7 @@ var es = {
 	studio_api_keys_status_active: "Activa",
 	studio_api_keys_status_expired: "Caducada",
 	studio_api_keys_status_revoked: "Revocada",
+	studio_api_keys_inactive_heading: "Revocadas / Caducadas",
 	studio_api_keys_stat_status: "Estado",
 	studio_api_keys_stat_last_used: "Último uso",
 	studio_api_keys_stat_expires: "Caduca",
@@ -8076,6 +9149,30 @@ var de = {
 	auth_have_account: "Haben Sie bereits ein Konto?",
 	auth_sign_in: "Anmelden",
 	auth_sign_up: "Registrieren",
+	auth_new_password_title: "Neues Passwort festlegen",
+	auth_new_password_subtitle: "Wähle das Passwort, mit dem du dich ab jetzt anmeldest.",
+	auth_password_requirements: "Das Passwort muss mindestens 8 Zeichen lang sein und Groß- und Kleinbuchstaben sowie eine Zahl enthalten",
+	auth_set_password: "Passwort festlegen",
+	auth_password_changed_title: "Passwort geändert",
+	auth_password_changed_body: "Melde dich mit deinem neuen Passwort an.",
+	auth_continue_to_sign_in: "Weiter zur Anmeldung",
+	auth_link_invalid_or_expired: "Dieser Link ist ungültig oder abgelaufen. Fordere auf dem Anmeldebildschirm einen neuen an.",
+	auth_password_reset_unavailable: "Das Zurücksetzen des Passworts ist in diesem Backend nicht verfügbar.",
+	auth_verifying_email: "Deine E-Mail-Adresse wird bestätigt…",
+	auth_email_verified_title: "E-Mail bestätigt",
+	auth_email_verified_body: "Deine E-Mail-Adresse ist bestätigt. Du kannst dich jetzt anmelden.",
+	auth_email_verification_failed_title: "E-Mail nicht bestätigt",
+	auth_email_verification_unavailable: "Die E-Mail-Bestätigung ist in diesem Backend nicht verfügbar.",
+	auth_mfa_title: "Bestätigung in zwei Schritten",
+	auth_mfa_subtitle: "Gib den Code aus deiner Authenticator-App oder einen deiner Wiederherstellungscodes ein.",
+	auth_mfa_factor_label: "Bestätigen mit",
+	auth_mfa_factor_totp: "Authenticator-App",
+	auth_mfa_code_label: "Bestätigungscode",
+	auth_mfa_verify: "Bestätigen",
+	auth_mfa_code_invalid: "Dieser Code stimmt nicht. Versuche den aktuellen Code aus deiner Authenticator-App oder einen Wiederherstellungscode.",
+	auth_mfa_challenge_exhausted: "Zu viele falsche Codes. Gib einen neuen Code aus deiner Authenticator-App ein, um es erneut zu versuchen.",
+	auth_mfa_expired: "Diese Anmeldung ist abgelaufen. Melde dich erneut an, um fortzufahren.",
+	auth_mfa_sign_in_again: "Erneut anmelden",
 	auto_setup_collections_button: "Sammlungen automatisch einrichten",
 	auto_setup_collections_title: "Sammlungen automatisch einrichten?",
 	auto_setup_collections_desc: "Dadurch werden automatisch Sammlungskonfigurationen für Sammlungen erstellt, die noch <b>NICHT</b> zugeordnet sind.",
@@ -8238,10 +9335,12 @@ var de = {
 	studio_sql_cannot_edit_missing_query: "Zeilen können nicht bearbeitet werden: Die zugrunde liegende Abfrage fehlt.",
 	studio_sql_cannot_resolve_table: "Tabelle bzw. Primärschlüssel konnte nicht ermittelt werden",
 	studio_sql_missing_pk: "In der Zeile fehlen die Primärschlüsselspalten: {{columns}}. Eine sichere Aktualisierung ist nicht möglich.",
+	studio_sql_cannot_edit_other_connection: "Diese Zeilen wurden aus einer anderen Datenbank oder mit einer anderen Rolle gelesen. Führen Sie die Abfrage erneut aus, um sie zu bearbeiten.",
 	studio_sql_update_failed: "Aktualisierung fehlgeschlagen: {{message}}",
 	studio_sql_execution_not_supported: "Die aktuelle Datenquelle unterstützt keine SQL-Ausführung.",
 	studio_sql_error_executing: "Beim Ausführen der Abfrage ist ein Fehler aufgetreten.",
 	studio_sql_error_explaining: "Beim Erklären der Abfrage ist ein Fehler aufgetreten.",
+	studio_sql_explain_single_statement: "Explain erklärt jeweils nur eine Anweisung. Markieren Sie die Anweisung, die erklärt werden soll, und versuchen Sie es erneut.",
 	studio_sql_save_first_to_favorite: "Bitte speichern Sie das Snippet, bevor Sie es zu den Favoriten hinzufügen.",
 	studio_sql_collections_label: "Collections:",
 	studio_sql_admin_collections_tooltip: "Tables in this query that are mapped as admin collections",
@@ -8288,6 +9387,9 @@ var de = {
 	studio_rls_enable_force_rls: "Erzwungene RLS aktivieren",
 	studio_rls_disable_force_rls: "Erzwungene RLS deaktivieren",
 	studio_rls_edit: "Edit",
+	studio_rls_edit_generated: "{{policy}} wird von Rebase für jede Collection erzeugt, es gibt also keine eigene Regel zum Bearbeiten. Legen Sie stattdessen eine eigene Policy an.",
+	studio_rls_edit_not_declared: "{{policy}} existiert nur in der Datenbank, in Ihrem Code gibt es also keine Regel zum Bearbeiten. Importieren Sie sie zuerst in die Codebasis.",
+	studio_rls_edit_several_operations: "{{policy}} ist eine der Policies, zu denen eine einzelne Regel kompiliert wird, eine pro Operation. Bearbeiten Sie diese Regel in der Quelldatei der Collection.",
 	studio_rls_delete: "Delete",
 	studio_rls_confirm_delete_title: "Richtlinie löschen",
 	studio_rls_confirm_delete_body: "Möchten Sie diese Richtlinie wirklich löschen? Dieser Vorgang kann nicht rückgängig gemacht werden.",
@@ -8468,6 +9570,8 @@ var de = {
 	studio_cron_denied_title: "Du darfst die Cron-Jobs dieses Projekts nicht auflisten",
 	studio_cron_denied_hint: "Mit dem Projekt ist alles in Ordnung. Die Cron-API ist nur für Admins, und das angemeldete Konto wurde abgelehnt.",
 	studio_cron_read_failed: "Die Cron-Jobs dieses Projekts konnten nicht gelesen werden",
+	studio_cron_logs_read_failed: "Die Ausführungen dieses Jobs konnten nicht gelesen werden",
+	studio_cron_logs_denied_title: "Du darfst die Ausführungen dieses Jobs nicht lesen",
 	studio_api_keys_denied_title: "Du darfst die API-Schlüssel dieses Projekts nicht auflisten",
 	studio_api_keys_denied_hint: "Mit dem Projekt ist alles in Ordnung. Das Verwalten von API-Schlüsseln ist eine Admin-Aktion, und das angemeldete Konto wurde abgelehnt.",
 	studio_api_keys_read_failed: "Die API-Schlüssel dieses Projekts konnten nicht gelesen werden",
@@ -8486,6 +9590,7 @@ var de = {
 	studio_api_keys_status_active: "Aktiv",
 	studio_api_keys_status_expired: "Abgelaufen",
 	studio_api_keys_status_revoked: "Widerrufen",
+	studio_api_keys_inactive_heading: "Widerrufen / Abgelaufen",
 	studio_api_keys_stat_status: "Status",
 	studio_api_keys_stat_last_used: "Zuletzt verwendet",
 	studio_api_keys_stat_expires: "Läuft ab",
@@ -9085,6 +10190,30 @@ var fr = {
 	auth_have_account: "Vous avez déjà un compte ?",
 	auth_sign_in: "Se connecter",
 	auth_sign_up: "S'inscrire",
+	auth_new_password_title: "Définir un nouveau mot de passe",
+	auth_new_password_subtitle: "Choisissez le mot de passe avec lequel vous vous connecterez désormais.",
+	auth_password_requirements: "Le mot de passe doit comporter au moins 8 caractères, avec des majuscules, des minuscules et un chiffre",
+	auth_set_password: "Définir le mot de passe",
+	auth_password_changed_title: "Mot de passe modifié",
+	auth_password_changed_body: "Connectez-vous avec votre nouveau mot de passe.",
+	auth_continue_to_sign_in: "Continuer vers la connexion",
+	auth_link_invalid_or_expired: "Ce lien est invalide ou a expiré. Demandez-en un nouveau depuis l'écran de connexion.",
+	auth_password_reset_unavailable: "La réinitialisation du mot de passe n'est pas disponible sur ce backend.",
+	auth_verifying_email: "Confirmation de votre adresse e-mail…",
+	auth_email_verified_title: "E-mail confirmé",
+	auth_email_verified_body: "Votre adresse e-mail est confirmée. Vous pouvez maintenant vous connecter.",
+	auth_email_verification_failed_title: "E-mail non confirmé",
+	auth_email_verification_unavailable: "La vérification de l'e-mail n'est pas disponible sur ce backend.",
+	auth_mfa_title: "Validation en deux étapes",
+	auth_mfa_subtitle: "Saisissez le code de votre application d'authentification, ou l'un de vos codes de récupération.",
+	auth_mfa_factor_label: "Valider avec",
+	auth_mfa_factor_totp: "Application d'authentification",
+	auth_mfa_code_label: "Code de vérification",
+	auth_mfa_verify: "Valider",
+	auth_mfa_code_invalid: "Ce code n'est pas le bon. Essayez le code actuel de votre application d'authentification, ou un code de récupération.",
+	auth_mfa_challenge_exhausted: "Trop de codes erronés. Saisissez un nouveau code de votre application d'authentification pour réessayer.",
+	auth_mfa_expired: "Cette connexion a expiré. Reconnectez-vous pour continuer.",
+	auth_mfa_sign_in_again: "Se reconnecter",
 	auto_setup_collections_button: "Configurer les collections automatiquement",
 	auto_setup_collections_title: "Configurer les collections automatiquement ?",
 	auto_setup_collections_desc: "Cela créera automatiquement des configurations de collection pour les collections qui ne sont <b>PAS</b> déjà mappées",
@@ -9247,10 +10376,12 @@ var fr = {
 	studio_sql_cannot_edit_missing_query: "Impossible de modifier les lignes : la requête sous-jacente est absente.",
 	studio_sql_cannot_resolve_table: "Impossible de déterminer la table ou la clé primaire",
 	studio_sql_missing_pk: "La ligne n'a pas les colonnes de clé primaire : {{columns}}. Mise à jour impossible en toute sécurité.",
+	studio_sql_cannot_edit_other_connection: "Ces lignes ont été lues dans une autre base de données ou avec un autre rôle. Exécutez à nouveau la requête pour les modifier.",
 	studio_sql_update_failed: "Échec de la mise à jour : {{message}}",
 	studio_sql_execution_not_supported: "La source de données actuelle ne prend pas en charge l'exécution de SQL.",
 	studio_sql_error_executing: "Une erreur s'est produite lors de l'exécution de la requête.",
 	studio_sql_error_explaining: "Une erreur s'est produite lors de l'analyse de la requête.",
+	studio_sql_explain_single_statement: "Explain ne traite qu'une instruction à la fois. Sélectionnez l'instruction à expliquer et réessayez.",
 	studio_sql_save_first_to_favorite: "Enregistrez l'extrait avant de l'ajouter aux favoris.",
 	studio_sql_collections_label: "Collections:",
 	studio_sql_admin_collections_tooltip: "Tables in this query that are mapped as admin collections",
@@ -9297,6 +10428,9 @@ var fr = {
 	studio_rls_enable_force_rls: "Activer la RLS forcée",
 	studio_rls_disable_force_rls: "Désactiver la RLS forcée",
 	studio_rls_edit: "Edit",
+	studio_rls_edit_generated: "{{policy}} est générée par Rebase pour chaque collection : aucune règle à vous n'est à modifier. Ajoutez plutôt votre propre politique.",
+	studio_rls_edit_not_declared: "{{policy}} n'existe que dans la base de données : aucune règle de votre code n'est à modifier. Importez-la d'abord dans le code.",
+	studio_rls_edit_several_operations: "{{policy}} fait partie des politiques qu'une seule règle produit, une par opération. Modifiez cette règle dans le fichier source de la collection.",
 	studio_rls_delete: "Delete",
 	studio_rls_confirm_delete_title: "Supprimer la politique",
 	studio_rls_confirm_delete_body: "Voulez-vous vraiment supprimer cette politique ? Cette action est irréversible.",
@@ -9477,6 +10611,8 @@ var fr = {
 	studio_cron_denied_title: "Vous ne pouvez pas lister les tâches cron de ce projet",
 	studio_cron_denied_hint: "Le projet n'a rien d'anormal. L'API cron est réservée aux administrateurs, et le compte connecté a été refusé.",
 	studio_cron_read_failed: "Impossible de lire les tâches cron de ce projet",
+	studio_cron_logs_read_failed: "Impossible de lire les exécutions de cette tâche",
+	studio_cron_logs_denied_title: "Vous ne pouvez pas lire les exécutions de cette tâche",
 	studio_api_keys_denied_title: "Vous ne pouvez pas lister les clés d'API de ce projet",
 	studio_api_keys_denied_hint: "Le projet n'a rien d'anormal. Gérer les clés d'API est une opération d'administrateur, et le compte connecté a été refusé.",
 	studio_api_keys_read_failed: "Impossible de lire les clés d'API de ce projet",
@@ -9495,6 +10631,7 @@ var fr = {
 	studio_api_keys_status_active: "Active",
 	studio_api_keys_status_expired: "Expirée",
 	studio_api_keys_status_revoked: "Révoquée",
+	studio_api_keys_inactive_heading: "Révoquées / Expirées",
 	studio_api_keys_stat_status: "Statut",
 	studio_api_keys_stat_last_used: "Dernière utilisation",
 	studio_api_keys_stat_expires: "Expire",
@@ -10094,6 +11231,30 @@ var it = {
 	auth_have_account: "Hai già un account?",
 	auth_sign_in: "Accedi",
 	auth_sign_up: "Registrati",
+	auth_new_password_title: "Imposta una nuova password",
+	auth_new_password_subtitle: "Scegli la password con cui accederai d'ora in poi.",
+	auth_password_requirements: "La password deve avere almeno 8 caratteri, con maiuscole, minuscole e un numero",
+	auth_set_password: "Imposta password",
+	auth_password_changed_title: "Password modificata",
+	auth_password_changed_body: "Accedi con la tua nuova password.",
+	auth_continue_to_sign_in: "Continua all'accesso",
+	auth_link_invalid_or_expired: "Questo link non è valido o è scaduto. Richiedine uno nuovo dalla schermata di accesso.",
+	auth_password_reset_unavailable: "Il ripristino della password non è disponibile su questo backend.",
+	auth_verifying_email: "Conferma del tuo indirizzo email in corso…",
+	auth_email_verified_title: "Email confermata",
+	auth_email_verified_body: "Il tuo indirizzo email è confermato. Ora puoi accedere.",
+	auth_email_verification_failed_title: "Email non confermata",
+	auth_email_verification_unavailable: "La verifica dell'email non è disponibile su questo backend.",
+	auth_mfa_title: "Verifica in due passaggi",
+	auth_mfa_subtitle: "Inserisci il codice della tua app di autenticazione o uno dei tuoi codici di recupero.",
+	auth_mfa_factor_label: "Verifica con",
+	auth_mfa_factor_totp: "App di autenticazione",
+	auth_mfa_code_label: "Codice di verifica",
+	auth_mfa_verify: "Verifica",
+	auth_mfa_code_invalid: "Questo codice non è corretto. Prova il codice attuale della tua app di autenticazione o un codice di recupero.",
+	auth_mfa_challenge_exhausted: "Troppi codici errati. Inserisci un nuovo codice dalla tua app di autenticazione per riprovare.",
+	auth_mfa_expired: "Questo accesso è scaduto. Accedi di nuovo per continuare.",
+	auth_mfa_sign_in_again: "Accedi di nuovo",
 	auto_setup_collections_button: "Configura le collezioni automaticamente",
 	auto_setup_collections_title: "Configurazione automatica delle collezioni",
 	auto_setup_collections_desc: "Configura le collezioni automaticamente in base ai dati Firestore esistenti. Lascia che Rebase configuri il pannello di amministrazione perfetto per te.",
@@ -10256,10 +11417,12 @@ var it = {
 	studio_sql_cannot_edit_missing_query: "Impossibile modificare le righe: manca la query sottostante.",
 	studio_sql_cannot_resolve_table: "Impossibile determinare la tabella o la chiave primaria",
 	studio_sql_missing_pk: "Alla riga mancano le colonne della chiave primaria: {{columns}}. Impossibile aggiornarla in sicurezza.",
+	studio_sql_cannot_edit_other_connection: "Queste righe sono state lette da un altro database o con un altro ruolo. Esegui di nuovo la query per modificarle.",
 	studio_sql_update_failed: "Aggiornamento non riuscito: {{message}}",
 	studio_sql_execution_not_supported: "L'origine dati attuale non supporta l'esecuzione di SQL.",
 	studio_sql_error_executing: "Si è verificato un errore durante l'esecuzione della query.",
 	studio_sql_error_explaining: "Si è verificato un errore durante l'analisi della query.",
+	studio_sql_explain_single_statement: "Explain funziona su una sola istruzione alla volta. Seleziona l'istruzione da spiegare e riprova.",
 	studio_sql_save_first_to_favorite: "Salva il frammento prima di aggiungerlo ai preferiti.",
 	studio_sql_collections_label: "Collections:",
 	studio_sql_admin_collections_tooltip: "Tables in this query that are mapped as admin collections",
@@ -10306,6 +11469,9 @@ var it = {
 	studio_rls_enable_force_rls: "Attiva RLS forzata",
 	studio_rls_disable_force_rls: "Disattiva RLS forzata",
 	studio_rls_edit: "Edit",
+	studio_rls_edit_generated: "{{policy}} è generata da Rebase per ogni collection, quindi non c'è una tua regola da modificare. Aggiungi invece una policy tua.",
+	studio_rls_edit_not_declared: "{{policy}} esiste solo nel database, quindi nel tuo codice non c'è una regola da modificare. Importala prima nel codice.",
+	studio_rls_edit_several_operations: "{{policy}} è una delle policy in cui viene compilata una singola regola, una per operazione. Modifica quella regola nel file sorgente della collection.",
 	studio_rls_delete: "Delete",
 	studio_rls_confirm_delete_title: "Elimina criterio",
 	studio_rls_confirm_delete_body: "Vuoi davvero eliminare questo criterio? L'operazione non può essere annullata.",
@@ -10486,6 +11652,8 @@ var it = {
 	studio_cron_denied_title: "Non puoi elencare i processi cron di questo progetto",
 	studio_cron_denied_hint: "Il progetto non ha nulla che non va. L'API cron è riservata agli amministratori, e l'account connesso è stato rifiutato.",
 	studio_cron_read_failed: "Non è stato possibile leggere i processi cron di questo progetto",
+	studio_cron_logs_read_failed: "Non è stato possibile leggere le esecuzioni di questo processo",
+	studio_cron_logs_denied_title: "Non puoi leggere le esecuzioni di questo processo",
 	studio_api_keys_denied_title: "Non puoi elencare le chiavi API di questo progetto",
 	studio_api_keys_denied_hint: "Il progetto non ha nulla che non va. Gestire le chiavi API è un'operazione da amministratore, e l'account connesso è stato rifiutato.",
 	studio_api_keys_read_failed: "Non è stato possibile leggere le chiavi API di questo progetto",
@@ -10504,6 +11672,7 @@ var it = {
 	studio_api_keys_status_active: "Attiva",
 	studio_api_keys_status_expired: "Scaduta",
 	studio_api_keys_status_revoked: "Revocata",
+	studio_api_keys_inactive_heading: "Revocate / Scadute",
 	studio_api_keys_stat_status: "Stato",
 	studio_api_keys_stat_last_used: "Ultimo utilizzo",
 	studio_api_keys_stat_expires: "Scade",
@@ -11103,6 +12272,30 @@ var hi = {
 	auth_have_account: "क्या आपके पास एक खाता है?",
 	auth_sign_in: "साइन इन करें",
 	auth_sign_up: "साइन अप करें",
+	auth_new_password_title: "नया पासवर्ड सेट करें",
+	auth_new_password_subtitle: "वह पासवर्ड चुनें जिससे आप अब से साइन इन करेंगे।",
+	auth_password_requirements: "पासवर्ड कम से कम 8 अक्षरों का होना चाहिए, जिसमें बड़े और छोटे अक्षर और एक संख्या हो",
+	auth_set_password: "पासवर्ड सेट करें",
+	auth_password_changed_title: "पासवर्ड बदल गया",
+	auth_password_changed_body: "अपने नए पासवर्ड से साइन इन करें।",
+	auth_continue_to_sign_in: "साइन इन पर जारी रखें",
+	auth_link_invalid_or_expired: "यह लिंक अमान्य है या इसकी समय-सीमा समाप्त हो गई है। साइन-इन स्क्रीन से नया लिंक मंगवाएँ।",
+	auth_password_reset_unavailable: "इस बैकएंड पर पासवर्ड रीसेट उपलब्ध नहीं है।",
+	auth_verifying_email: "आपके ईमेल पते की पुष्टि हो रही है…",
+	auth_email_verified_title: "ईमेल की पुष्टि हो गई",
+	auth_email_verified_body: "आपके ईमेल पते की पुष्टि हो गई है। अब आप साइन इन कर सकते हैं।",
+	auth_email_verification_failed_title: "ईमेल की पुष्टि नहीं हुई",
+	auth_email_verification_unavailable: "इस बैकएंड पर ईमेल सत्यापन उपलब्ध नहीं है।",
+	auth_mfa_title: "दो-चरणीय सत्यापन",
+	auth_mfa_subtitle: "अपने ऑथेंटिकेटर ऐप का कोड या अपना कोई रिकवरी कोड दर्ज करें।",
+	auth_mfa_factor_label: "इससे सत्यापित करें",
+	auth_mfa_factor_totp: "ऑथेंटिकेटर ऐप",
+	auth_mfa_code_label: "सत्यापन कोड",
+	auth_mfa_verify: "सत्यापित करें",
+	auth_mfa_code_invalid: "यह कोड सही नहीं है। अपने ऑथेंटिकेटर ऐप का मौजूदा कोड या कोई रिकवरी कोड आज़माएँ।",
+	auth_mfa_challenge_exhausted: "बहुत अधिक गलत कोड। फिर से प्रयास करने के लिए अपने ऑथेंटिकेटर ऐप से नया कोड दर्ज करें।",
+	auth_mfa_expired: "यह साइन-इन समाप्त हो गया है। जारी रखने के लिए फिर से साइन इन करें।",
+	auth_mfa_sign_in_again: "फिर से साइन इन करें",
 	auto_setup_collections_button: "संग्रहों को स्वचालित रूप से सेट करें",
 	auto_setup_collections_title: "संग्रहों की स्वचालित सेटअप",
 	auto_setup_collections_desc: "अपने मौजूदा Firestore डेटा के आधार पर संग्रहों को स्वचालित रूप से सेट करें। Rebase को आपके लिए परफेक्ट एडमिन पैनल कॉन्फ़िगर करने दें।",
@@ -11265,10 +12458,12 @@ var hi = {
 	studio_sql_cannot_edit_missing_query: "पंक्तियाँ संपादित नहीं की जा सकतीं: अंतर्निहित क्वेरी अनुपलब्ध है।",
 	studio_sql_cannot_resolve_table: "तालिका/प्राथमिक कुंजी निर्धारित नहीं हो सकी",
 	studio_sql_missing_pk: "पंक्ति में प्राथमिक कुंजी स्तंभ अनुपलब्ध हैं: {{columns}}। सुरक्षित रूप से अपडेट नहीं किया जा सकता।",
+	studio_sql_cannot_edit_other_connection: "ये पंक्तियाँ किसी अन्य डेटाबेस से या किसी अन्य भूमिका के रूप में पढ़ी गई थीं। इन्हें संपादित करने के लिए क्वेरी फिर से चलाएँ।",
 	studio_sql_update_failed: "अपडेट विफल: {{message}}",
 	studio_sql_execution_not_supported: "वर्तमान डेटा स्रोत SQL निष्पादन का समर्थन नहीं करता।",
 	studio_sql_error_executing: "क्वेरी चलाते समय एक त्रुटि हुई।",
 	studio_sql_error_explaining: "क्वेरी का विश्लेषण करते समय एक त्रुटि हुई।",
+	studio_sql_explain_single_statement: "Explain एक बार में केवल एक स्टेटमेंट पर काम करता है। जिस स्टेटमेंट को समझाना है उसे चुनें और फिर से प्रयास करें।",
 	studio_sql_save_first_to_favorite: "पसंदीदा में जोड़ने से पहले स्निपेट सहेजें।",
 	studio_sql_collections_label: "Collections:",
 	studio_sql_admin_collections_tooltip: "Tables in this query that are mapped as admin collections",
@@ -11315,6 +12510,9 @@ var hi = {
 	studio_rls_enable_force_rls: "बाध्य RLS सक्षम करें",
 	studio_rls_disable_force_rls: "बाध्य RLS निष्क्रिय करें",
 	studio_rls_edit: "Edit",
+	studio_rls_edit_generated: "{{policy}} को Rebase हर कलेक्शन के लिए बनाता है, इसलिए संपादित करने के लिए आपका कोई नियम नहीं है। इसके बजाय अपनी पॉलिसी जोड़ें।",
+	studio_rls_edit_not_declared: "{{policy}} केवल डेटाबेस में मौजूद है, इसलिए आपके कोड में संपादित करने के लिए कोई नियम नहीं है। पहले इसे कोडबेस में इम्पोर्ट करें।",
+	studio_rls_edit_several_operations: "{{policy}} उन पॉलिसियों में से एक है जिनमें एक ही नियम कंपाइल होता है, हर ऑपरेशन के लिए एक। उस नियम को कलेक्शन की सोर्स फ़ाइल में संपादित करें।",
 	studio_rls_delete: "Delete",
 	studio_rls_confirm_delete_title: "नीति हटाएँ",
 	studio_rls_confirm_delete_body: "क्या आप वाकई यह नीति हटाना चाहते हैं? यह क्रिया पूर्ववत नहीं की जा सकती।",
@@ -11495,6 +12693,8 @@ var hi = {
 	studio_cron_denied_title: "आप इस प्रोजेक्ट के क्रॉन जॉब सूचीबद्ध नहीं कर सकते",
 	studio_cron_denied_hint: "प्रोजेक्ट में कोई गड़बड़ी नहीं है। क्रॉन API केवल एडमिन के लिए है, और साइन-इन किए गए खाते को मना कर दिया गया।",
 	studio_cron_read_failed: "इस प्रोजेक्ट के क्रॉन जॉब नहीं पढ़े जा सके",
+	studio_cron_logs_read_failed: "इस जॉब के रन नहीं पढ़े जा सके",
+	studio_cron_logs_denied_title: "आप इस जॉब के रन नहीं पढ़ सकते",
 	studio_api_keys_denied_title: "आप इस प्रोजेक्ट की API कुंजियाँ सूचीबद्ध नहीं कर सकते",
 	studio_api_keys_denied_hint: "प्रोजेक्ट में कोई गड़बड़ी नहीं है। API कुंजियाँ प्रबंधित करना एडमिन कार्य है, और साइन-इन किए गए खाते को मना कर दिया गया।",
 	studio_api_keys_read_failed: "इस प्रोजेक्ट की API कुंजियाँ नहीं पढ़ी जा सकीं",
@@ -11513,6 +12713,7 @@ var hi = {
 	studio_api_keys_status_active: "सक्रिय",
 	studio_api_keys_status_expired: "समाप्त",
 	studio_api_keys_status_revoked: "निरस्त",
+	studio_api_keys_inactive_heading: "निरस्त / समाप्त",
 	studio_api_keys_stat_status: "स्थिति",
 	studio_api_keys_stat_last_used: "अंतिम उपयोग",
 	studio_api_keys_stat_expires: "समाप्ति",
@@ -12117,6 +13318,30 @@ var pt = {
 	auth_have_account: "Já tem uma conta?",
 	auth_sign_in: "Iniciar Sessão",
 	auth_sign_up: "Registar",
+	auth_new_password_title: "Definir uma nova palavra-passe",
+	auth_new_password_subtitle: "Escolha a palavra-passe com que vai iniciar sessão a partir de agora.",
+	auth_password_requirements: "A palavra-passe deve ter pelo menos 8 caracteres, com maiúsculas, minúsculas e um número",
+	auth_set_password: "Definir palavra-passe",
+	auth_password_changed_title: "Palavra-passe alterada",
+	auth_password_changed_body: "Inicie sessão com a sua nova palavra-passe.",
+	auth_continue_to_sign_in: "Continuar para iniciar sessão",
+	auth_link_invalid_or_expired: "Esta ligação é inválida ou expirou. Peça uma nova no ecrã de início de sessão.",
+	auth_password_reset_unavailable: "A reposição da palavra-passe não está disponível neste backend.",
+	auth_verifying_email: "A confirmar o seu endereço de email…",
+	auth_email_verified_title: "Email confirmado",
+	auth_email_verified_body: "O seu endereço de email está confirmado. Já pode iniciar sessão.",
+	auth_email_verification_failed_title: "Email não confirmado",
+	auth_email_verification_unavailable: "A verificação de email não está disponível neste backend.",
+	auth_mfa_title: "Verificação em dois passos",
+	auth_mfa_subtitle: "Introduza o código da sua aplicação de autenticação ou um dos seus códigos de recuperação.",
+	auth_mfa_factor_label: "Verificar com",
+	auth_mfa_factor_totp: "Aplicação de autenticação",
+	auth_mfa_code_label: "Código de verificação",
+	auth_mfa_verify: "Verificar",
+	auth_mfa_code_invalid: "Esse código não está correto. Experimente o código atual da sua aplicação de autenticação ou um código de recuperação.",
+	auth_mfa_challenge_exhausted: "Demasiados códigos errados. Introduza um novo código da sua aplicação de autenticação para tentar novamente.",
+	auth_mfa_expired: "Este início de sessão expirou. Inicie sessão novamente para continuar.",
+	auth_mfa_sign_in_again: "Iniciar sessão novamente",
 	auto_setup_collections_button: "Configurar coleções automaticamente",
 	auto_setup_collections_title: "Configurar coleções automaticamente?",
 	auto_setup_collections_desc: "Isto criará automaticamente configurações de coleção para coleções que <b>NÃO</b> estão já mapeadas",
@@ -12279,10 +13504,12 @@ var pt = {
 	studio_sql_cannot_edit_missing_query: "Não é possível editar as linhas: falta a consulta subjacente.",
 	studio_sql_cannot_resolve_table: "Não foi possível determinar a tabela ou a chave primária",
 	studio_sql_missing_pk: "Faltam colunas de chave primária na linha: {{columns}}. Não é possível atualizar em segurança.",
+	studio_sql_cannot_edit_other_connection: "Estas linhas foram lidas de outra base de dados ou com outra função. Execute a consulta novamente para editá-las.",
 	studio_sql_update_failed: "Falha ao atualizar: {{message}}",
 	studio_sql_execution_not_supported: "A fonte de dados atual não suporta a execução de SQL.",
 	studio_sql_error_executing: "Ocorreu um erro ao executar a consulta.",
 	studio_sql_error_explaining: "Ocorreu um erro ao explicar a consulta.",
+	studio_sql_explain_single_statement: "O Explain funciona com uma instrução de cada vez. Selecione a instrução a explicar e tente novamente.",
 	studio_sql_save_first_to_favorite: "Guarde o excerto antes de o marcar como favorito.",
 	studio_sql_collections_label: "Collections:",
 	studio_sql_admin_collections_tooltip: "Tables in this query that are mapped as admin collections",
@@ -12329,6 +13556,9 @@ var pt = {
 	studio_rls_enable_force_rls: "Ativar RLS forçada",
 	studio_rls_disable_force_rls: "Desativar RLS forçada",
 	studio_rls_edit: "Edit",
+	studio_rls_edit_generated: "{{policy}} é gerada pelo Rebase para todas as coleções, por isso não há nenhuma regra sua para editar. Adicione antes uma política sua.",
+	studio_rls_edit_not_declared: "{{policy}} existe apenas na base de dados, por isso não há nenhuma regra no seu código para editar. Importe-a primeiro para o código.",
+	studio_rls_edit_several_operations: "{{policy}} é uma das políticas em que uma única regra é compilada, uma por operação. Edite essa regra no ficheiro de origem da coleção.",
 	studio_rls_delete: "Delete",
 	studio_rls_confirm_delete_title: "Eliminar política",
 	studio_rls_confirm_delete_body: "Tem a certeza de que pretende eliminar esta política? Esta ação não pode ser anulada.",
@@ -12509,6 +13739,8 @@ var pt = {
 	studio_cron_denied_title: "Não pode listar as tarefas cron deste projeto",
 	studio_cron_denied_hint: "O projeto não tem nada de errado. A API de cron é apenas para administradores, e a conta com sessão iniciada foi recusada.",
 	studio_cron_read_failed: "Não foi possível ler as tarefas cron deste projeto",
+	studio_cron_logs_read_failed: "Não foi possível ler as execuções desta tarefa",
+	studio_cron_logs_denied_title: "Não pode ler as execuções desta tarefa",
 	studio_api_keys_denied_title: "Não pode listar as chaves de API deste projeto",
 	studio_api_keys_denied_hint: "O projeto não tem nada de errado. Gerir chaves de API é uma operação de administrador, e a conta com sessão iniciada foi recusada.",
 	studio_api_keys_read_failed: "Não foi possível ler as chaves de API deste projeto",
@@ -12527,6 +13759,7 @@ var pt = {
 	studio_api_keys_status_active: "Ativa",
 	studio_api_keys_status_expired: "Expirada",
 	studio_api_keys_status_revoked: "Revogada",
+	studio_api_keys_inactive_heading: "Revogadas / Expiradas",
 	studio_api_keys_stat_status: "Estado",
 	studio_api_keys_stat_last_used: "Última utilização",
 	studio_api_keys_stat_expires: "Expira",
@@ -12573,6 +13806,7 @@ var REBASE_LOCALE_STORAGE_KEY = "rebase_locale";
 function RebaseI18nProvider({ locale = "en", translations, children }) {
 	const i18nRef = useRef(null);
 	const [ready, setReady] = React.useState(false);
+	const propLanguageRef = useRef(null);
 	if (!i18nRef.current) {
 		const instance = i18next.createInstance();
 		const resources = buildResources(translations);
@@ -12590,13 +13824,20 @@ function RebaseI18nProvider({ locale = "en", translations, children }) {
 			setReady(true);
 		});
 		instance.on("languageChanged", (lng) => {
+			if (propLanguageRef.current === lng) {
+				propLanguageRef.current = null;
+				return;
+			}
 			if (typeof window !== "undefined") writeStoredString(REBASE_LOCALE_STORAGE_KEY, lng);
 		});
 		i18nRef.current = instance;
 	}
 	useEffect(() => {
 		if (i18nRef.current && i18nRef.current.language !== locale) {
-			if (!Boolean(readStoredString("rebase_locale"))) i18nRef.current.changeLanguage(locale);
+			if (!Boolean(readStoredString("rebase_locale"))) {
+				propLanguageRef.current = locale;
+				i18nRef.current.changeLanguage(locale);
+			}
 		}
 	}, [locale]);
 	useEffect(() => {
@@ -12844,7 +14085,7 @@ function Rebase(props) {
 		propertyConfigs,
 		componentsProp
 	]);
-	const analyticsController = useMemo(() => ({ onAnalyticsEvent }), []);
+	const analyticsController = useMemo(() => ({ onAnalyticsEvent }), [onAnalyticsEvent]);
 	const fallbackEffectiveRoleController = useBuildEffectiveRoleController();
 	const activeEffectiveRoleController = effectiveRoleController ?? fallbackEffectiveRoleController;
 	const modeController = useBuildModeController();
@@ -12932,9 +14173,10 @@ function RebaseInternal({ loading, children }) {
 		plugins,
 		scope: "root",
 		scopeProps: { context },
-		children: [authReady && /* @__PURE__ */ jsx(PluginLifecycleManager, {
+		children: [/* @__PURE__ */ jsx(PluginLifecycleManager, {
 			plugins,
-			context
+			context,
+			authReady
 		}), childrenResult]
 	});
 	return childrenResult;
@@ -13007,8 +14249,10 @@ function useRebaseAuthController(props = {}) {
 			return;
 		}
 		isMountedRef.current = true;
+		let latestUpdate = 0;
 		const updateState = async (session) => {
 			if (!isMountedRef.current) return;
+			const update = ++latestUpdate;
 			let userToSet = session?.user ?? null;
 			const defineRolesFor = defineRolesForRef.current;
 			if (userToSet && defineRolesFor) try {
@@ -13020,12 +14264,27 @@ function useRebaseAuthController(props = {}) {
 			} catch (e) {
 				console.error("Error defining roles:", e);
 			}
-			if (isMountedRef.current) setUser(userToSet);
+			if (update !== latestUpdate) return;
+			if (isMountedRef.current) {
+				if (userToSet) bindSessionCachesToUser(userToSet.uid);
+				setUser(userToSet);
+			}
 		};
+		let latestConfigRequest = 0;
+		function loadAuthConfig() {
+			if (!auth) return;
+			const request = ++latestConfigRequest;
+			auth.getAuthConfig().then((config) => {
+				if (isMountedRef.current && request === latestConfigRequest) setAuthConfig(config);
+			}).catch((e) => {
+				console.warn("[Rebase] Could not load the backend auth configuration; the login view will fall back to defaults.", e);
+			});
+		}
 		const syncState = async (event, session) => {
+			if (event === "SIGNED_IN" || event === "SIGNED_OUT") loadAuthConfig();
+			if (event === "SIGNED_OUT") clearSessionCaches();
 			await updateState(session);
 			if (event === "SIGNED_OUT") {
-				clearFetchCache();
 				if (isMountedRef.current) setLoginSkipped(false);
 				onSignOutRef.current?.();
 			}
@@ -13039,11 +14298,7 @@ function useRebaseAuthController(props = {}) {
 		}).catch(() => {
 			if (isMountedRef.current) setInitialLoading(false);
 		});
-		auth.getAuthConfig().then((config) => {
-			if (isMountedRef.current) setAuthConfig(config);
-		}).catch((e) => {
-			console.warn("[Rebase] Could not load the backend auth configuration; the login view will fall back to defaults.", e);
-		});
+		loadAuthConfig();
 		const unsubscribe = auth.onAuthStateChange(syncState);
 		return () => {
 			isMountedRef.current = false;
@@ -13124,6 +14379,37 @@ function useRebaseAuthController(props = {}) {
 			setAuthLoading(false);
 		}
 	}, [auth]);
+	/**
+	* Open the challenge that finishes a sign-in refused with `MFA_REQUIRED`.
+	*
+	* `mfaToken` is that refusal's `details.mfaToken`, sent on this request
+	* only. Every sign-in method above lands such a refusal in
+	* `authProviderError`, which is where the login view reads it from.
+	*/
+	const startMfaChallenge = useCallback(async (mfaToken, factorId) => {
+		if (!auth?.mfa) throw new Error("Rebase client with MFA is required");
+		const { challengeId } = await auth.mfa.challenge(factorId, { mfaToken });
+		return challengeId;
+	}, [auth]);
+	/**
+	* Answer that challenge. On success the SDK adopts the session and emits
+	* SIGNED_IN, which sets the user like any other sign-in.
+	*
+	* A refused code is rethrown and NOT recorded in `authProviderError`: the
+	* code step reports it itself, and the refusal it would replace is the
+	* `MFA_REQUIRED` that says a sign-in is still waiting for its second
+	* factor.
+	*/
+	const verifyMfaChallenge = useCallback(async (mfaToken, challengeId, code) => {
+		if (!auth?.mfa) throw new Error("Rebase client with MFA is required");
+		setAuthLoading(true);
+		try {
+			await auth.mfa.verifyChallenge(challengeId, code, { mfaToken });
+			setAuthProviderError(null);
+		} finally {
+			setAuthLoading(false);
+		}
+	}, [auth]);
 	const skipLogin = useCallback(() => {
 		setLoginSkipped(true);
 		setUser(null);
@@ -13156,6 +14442,10 @@ function useRebaseAuthController(props = {}) {
 			setAuthLoading(false);
 		}
 	}, [auth]);
+	const verifyEmail = useCallback(async (token) => {
+		if (!auth?.verifyEmail) throw new Error("Rebase client with email verification is required");
+		await auth.verifyEmail(token);
+	}, [auth]);
 	const changePassword = useCallback(async (oldPassword, newPassword) => {
 		if (!auth) throw new Error("Rebase client with auth is required");
 		setAuthLoading(true);
@@ -13219,6 +14509,7 @@ function useRebaseAuthController(props = {}) {
 		skipLogin,
 		forgotPassword,
 		resetPassword,
+		verifyEmail,
 		changePassword,
 		updateProfile,
 		fetchSessions,
@@ -13226,6 +14517,8 @@ function useRebaseAuthController(props = {}) {
 		revokeAllSessions,
 		clearError,
 		setAuthProviderError,
+		startMfaChallenge: auth?.mfa ? startMfaChallenge : void 0,
+		verifyMfaChallenge: auth?.mfa ? verifyMfaChallenge : void 0,
 		extra,
 		setExtra,
 		capabilities: {
@@ -13358,264 +14651,111 @@ var iconKeysMap = iconKeys.reduce((acc, key) => {
 * Render an icon element from a string key or existing React element.
 *
 * Whether a key names an icon is decided here, against `iconKeys` — an array
-* of strings. The component behind the key is fetched by `LucideIconByName` on
-* first use: this used to index lucide's full `icons` map, which is the whole
-* library and cannot be tree-shaken.
-*/
-function getIcon(iconKey, className, color, size) {
-	if (React.isValidElement(iconKey)) return iconKey;
-	if (!iconKey) return void 0;
-	if (typeof iconKey === "string") {
-		const lowerKey = iconKey.toLowerCase();
-		const slugifiedKey = slugify(iconKey).replace(/-/g, "_");
-		const mappedKey = iconKeysMap[iconKey] || iconKeysMap[lowerKey] || iconKeysMap[slugifiedKey];
-		if (!mappedKey) return;
-		return /* @__PURE__ */ jsx(LucideIconByName, {
-			name: mappedKey,
-			size: typeof size === "number" ? size : iconSize[size ?? "medium"],
-			className: cls(color ? colorClassesMapping[color] : "", "select-none shrink-0", className)
-		});
-	}
-	console.warn("Invalid icon key provided:", iconKey);
-}
-var IconForView = React.memo(function IconForView({ collectionOrView, className, color, size = "medium" }) {
-	if (!collectionOrView) return /* @__PURE__ */ jsx(Fragment, {});
-	const icon = getIcon(collectionOrView.icon, className, color, size);
-	if (collectionOrView?.icon && icon) return icon;
-	let pathname = slugify(("singularName" in collectionOrView ? collectionOrView.singularName : void 0) ?? collectionOrView.name).replace(/-/g, "_");
-	let key;
-	if (pathname in iconKeysMap) key = iconKeysMap[pathname];
-	if (!key) {
-		pathname = slugify(collectionOrView.slug).replace(/-/g, "_");
-		if (pathname in iconKeysMap) key = iconKeysMap[pathname];
-	}
-	const iconsCount = coolIconKeys.length;
-	if (!key) key = coolIconKeys[hashString(collectionOrView.slug) % iconsCount];
-	const sizeInPx = typeof size === "number" ? size : iconSize[size];
-	return /* @__PURE__ */ jsx(LucideIconByName, {
-		name: key,
-		size: sizeInPx,
-		className: cls(color ? colorClassesMapping[color] : "", "select-none shrink-0", className)
-	});
-}, (prevProps, nextProps) => {
-	return deepEqual(prevProps.collectionOrView?.icon, nextProps.collectionOrView?.icon) && prevProps.collectionOrView?.name === nextProps.collectionOrView?.name && prevProps.collectionOrView?.slug === nextProps.collectionOrView?.slug && prevProps.collectionOrView?.singularName === nextProps.collectionOrView?.singularName && deepEqual(prevProps.color, nextProps.color) && prevProps.className === nextProps.className && prevProps.size === nextProps.size;
-});
-//#endregion
-//#region src/util/createFormexStub.tsx
-function createFormexStub(values) {
-	const errorMessage = "You are in a read-only context. You cannot modify the formex controller.";
-	return {
-		debugId: "",
-		values,
-		initialValues: values,
-		touched: {},
-		dirty: false,
-		errors: {},
-		submitCount: 0,
-		isSubmitting: false,
-		isValidating: false,
-		version: 0,
-		canUndo: false,
-		canRedo: false,
-		setValues: () => {
-			throw new Error(errorMessage);
-		},
-		setTouched(touched) {
-			throw new Error(errorMessage);
-		},
-		setFieldValue: () => {
-			throw new Error(errorMessage);
-		},
-		setFieldTouched: () => {
-			throw new Error(errorMessage);
-		},
-		setDirty: () => {
-			throw new Error(errorMessage);
-		},
-		setSubmitCount: () => {
-			throw new Error(errorMessage);
-		},
-		setFieldError: () => {
-			throw new Error(errorMessage);
-		},
-		handleChange: () => {
-			throw new Error(errorMessage);
-		},
-		handleBlur: () => {
-			throw new Error(errorMessage);
-		},
-		handleSubmit: () => {
-			throw new Error(errorMessage);
-		},
-		validate: () => {
-			throw new Error(errorMessage);
-		},
-		resetForm: () => {
-			throw new Error(errorMessage);
-		},
-		setSubmitting: () => {
-			throw new Error(errorMessage);
-		},
-		undo: () => {
-			throw new Error(errorMessage);
-		},
-		redo: () => {
-			throw new Error(errorMessage);
-		}
-	};
-}
-//#endregion
-//#region src/util/entity_cache.ts
-var LOCAL_STORAGE_PREFIX = "entity_cache::";
-/**
-* The in-session handoff channel: an edit in flight, parked here by the layout
-* that is being replaced and picked up by the one taking over — the split's
-* "hide list", full screen's "show list", the side panel's "open full screen".
-* A record loaded from it opens *dirty*, because that is what it is for.
-*
-* Deliberately **not** hydrated from `sessionStorage`, and it is the one thing
-* here that isn't. The persisted half of this file is the local-changes backup:
-* a draft that outlives a reload, offered back through the banner or applied on
-* open, according to the collection's `localChangesBackup`. Loading those
-* drafts into this map on startup made every one of them look like a handoff —
-* the first visit to the record after a reload silently opened dirty carrying a
-* draft the user had walked away from, and the banner that exists to ask about
-* it never appeared.
-*/
-var entityCache = /* @__PURE__ */ new Map();
-var isSessionStorageAvailable = typeof sessionStorage !== "undefined";
-function customReplacer(key) {
-	const value = this[key];
-	if (value instanceof Date) return {
-		__type: "Date",
-		value: value.toISOString()
-	};
-	if (value instanceof EntityReference) return {
-		__type: "EntityReference",
-		id: value.id,
-		path: value.path,
-		driver: value.driver,
-		databaseId: value.databaseId
-	};
-	if (value instanceof EntityRelation) return {
-		__type: "EntityRelation",
-		id: value.id,
-		path: value.path,
-		data: value.data
-	};
-	if (value instanceof GeoPoint) return {
-		__type: "GeoPoint",
-		latitude: value.latitude,
-		longitude: value.longitude
-	};
-	if (value instanceof Vector) return {
-		__type: "Vector",
-		value: value.value
-	};
-	return value;
-}
-function customReviver(_key, value) {
-	if (value && typeof value === "object" && "__type" in value) {
-		const record = value;
-		switch (record.__type) {
-			case "date":
-			case "Date": return new Date(record.value);
-			case "reference":
-			case "EntityReference": return new EntityReference({
-				id: record.id,
-				path: record.path,
-				driver: record.driver,
-				databaseId: record.databaseId
-			});
-			case "relation":
-			case "EntityRelation": return new EntityRelation(record.id, record.path, record.data);
-			case "GeoPoint": return new GeoPoint(record.latitude, record.longitude);
-			case "Vector": return new Vector(record.value);
-			default: return value;
-		}
-	}
-	return value;
-}
-/**
-* Saves data to the local-changes backup in `sessionStorage`.
-*
-* The backup only — a draft that survives a reload is not an edit in flight.
-* {@link saveEntityToMemoryCache} is the other channel; see {@link entityCache}
-* for what separates them.
-* @param path - The unique path/key for the data.
-* @param data - The data to cache and persist.
-*/
-function saveEntityToCache(path, data) {
-	if (isSessionStorageAvailable) try {
-		const key = LOCAL_STORAGE_PREFIX + path;
-		const entityString = JSON.stringify(data, customReplacer);
-		sessionStorage.setItem(key, entityString);
-	} catch (error) {
-		console.error(`Failed to save entity for path "${path}" to sessionStorage:`, error);
-	}
-}
-/**
-* Consumes a handoff. The channel is one-shot: whoever picks an edit up owns it
-* from then on, and an edit left behind here is one that reopens a record dirty
-* long after the user stopped looking at it.
-*/
-function removeEntityFromMemoryCache(path) {
-	entityCache.delete(path);
-}
-/**
-* Parks an edit in flight for the layout about to take over. See
-* {@link entityCache}: this is the handoff, not the backup.
-*/
-function saveEntityToMemoryCache(path, data) {
-	entityCache.set(path, data);
-}
-function getEntityFromMemoryCache(path) {
-	return entityCache.get(path);
-}
-/**
-* Retrieves a entity from the local-changes backup in `sessionStorage`.
-*
-* The backup only — the handoff channel is read through
-* {@link getEntityFromMemoryCache}, and the two mean different things to the
-* form that receives them.
-* @param path - The unique path/key for the entity.
-* @returns The cached entity or `undefined` if not found.
-*/
-function getEntityFromCache(path) {
-	if (isSessionStorageAvailable) try {
-		const key = LOCAL_STORAGE_PREFIX + path;
-		const entityString = sessionStorage.getItem(key);
-		if (entityString) return JSON.parse(entityString, customReviver);
-	} catch (error) {
-		console.error(`Failed to load entity for path "${path}" from sessionStorage:`, error);
-	}
-}
-/**
-* Removes a entity from both the in-memory cache and `sessionStorage`.
-* @param path - The unique path/key for the entity to remove.
+* of strings. The component behind the key is fetched by `LucideIconByName` on
+* first use: this used to index lucide's full `icons` map, which is the whole
+* library and cannot be tree-shaken.
 */
-function removeEntityFromCache(path) {
-	console.debug("Removing entity from cache", path);
-	entityCache.delete(path);
-	if (isSessionStorageAvailable) try {
-		const key = LOCAL_STORAGE_PREFIX + path;
-		sessionStorage.removeItem(key);
-	} catch (error) {
-		console.error(`Failed to remove entity for path "${path}" from sessionStorage:`, error);
+function getIcon(iconKey, className, color, size) {
+	if (React.isValidElement(iconKey)) return iconKey;
+	if (!iconKey) return void 0;
+	if (typeof iconKey === "string") {
+		const lowerKey = iconKey.toLowerCase();
+		const slugifiedKey = slugify(iconKey).replace(/-/g, "_");
+		const mappedKey = iconKeysMap[iconKey] || iconKeysMap[lowerKey] || iconKeysMap[slugifiedKey];
+		if (!mappedKey) return;
+		return /* @__PURE__ */ jsx(LucideIconByName, {
+			name: mappedKey,
+			size: typeof size === "number" ? size : iconSize[size ?? "medium"],
+			className: cls(color ? colorClassesMapping[color] : "", "select-none shrink-0", className)
+		});
 	}
+	console.warn("Invalid icon key provided:", iconKey);
 }
-function flattenKeys(obj, prefix = "", result = []) {
-	if (isObject(obj) || Array.isArray(obj)) if (!isPlainObject(obj) && prefix) result.push(prefix);
-	else {
-		const record = obj;
-		for (const key in record) if (Object.prototype.hasOwnProperty.call(record, key)) {
-			const newKey = prefix ? Array.isArray(obj) ? `${prefix}[${key}]` : `${prefix}.${key}` : key;
-			const val = record[key];
-			if (isObject(val) || Array.isArray(val)) flattenKeys(val, newKey, result);
-			else result.push(newKey);
-		}
+var IconForView = React.memo(function IconForView({ collectionOrView, className, color, size = "medium" }) {
+	if (!collectionOrView) return /* @__PURE__ */ jsx(Fragment, {});
+	const icon = getIcon(collectionOrView.icon, className, color, size);
+	if (collectionOrView?.icon && icon) return icon;
+	let pathname = slugify(("singularName" in collectionOrView ? collectionOrView.singularName : void 0) ?? collectionOrView.name).replace(/-/g, "_");
+	let key;
+	if (pathname in iconKeysMap) key = iconKeysMap[pathname];
+	if (!key) {
+		pathname = slugify(collectionOrView.slug).replace(/-/g, "_");
+		if (pathname in iconKeysMap) key = iconKeysMap[pathname];
 	}
-	return result;
+	const iconsCount = coolIconKeys.length;
+	if (!key) key = coolIconKeys[hashString(collectionOrView.slug) % iconsCount];
+	const sizeInPx = typeof size === "number" ? size : iconSize[size];
+	return /* @__PURE__ */ jsx(LucideIconByName, {
+		name: key,
+		size: sizeInPx,
+		className: cls(color ? colorClassesMapping[color] : "", "select-none shrink-0", className)
+	});
+}, (prevProps, nextProps) => {
+	return deepEqual(prevProps.collectionOrView?.icon, nextProps.collectionOrView?.icon) && prevProps.collectionOrView?.name === nextProps.collectionOrView?.name && prevProps.collectionOrView?.slug === nextProps.collectionOrView?.slug && prevProps.collectionOrView?.singularName === nextProps.collectionOrView?.singularName && deepEqual(prevProps.color, nextProps.color) && prevProps.className === nextProps.className && prevProps.size === nextProps.size;
+});
+//#endregion
+//#region src/util/createFormexStub.tsx
+function createFormexStub(values) {
+	const errorMessage = "You are in a read-only context. You cannot modify the formex controller.";
+	return {
+		debugId: "",
+		values,
+		initialValues: values,
+		touched: {},
+		dirty: false,
+		errors: {},
+		submitCount: 0,
+		isSubmitting: false,
+		isValidating: false,
+		version: 0,
+		canUndo: false,
+		canRedo: false,
+		setValues: () => {
+			throw new Error(errorMessage);
+		},
+		setTouched(touched) {
+			throw new Error(errorMessage);
+		},
+		setFieldValue: () => {
+			throw new Error(errorMessage);
+		},
+		setFieldTouched: () => {
+			throw new Error(errorMessage);
+		},
+		setDirty: () => {
+			throw new Error(errorMessage);
+		},
+		setSubmitCount: () => {
+			throw new Error(errorMessage);
+		},
+		setFieldError: () => {
+			throw new Error(errorMessage);
+		},
+		handleChange: () => {
+			throw new Error(errorMessage);
+		},
+		handleBlur: () => {
+			throw new Error(errorMessage);
+		},
+		handleSubmit: () => {
+			throw new Error(errorMessage);
+		},
+		validate: () => {
+			throw new Error(errorMessage);
+		},
+		resetForm: () => {
+			throw new Error(errorMessage);
+		},
+		setSubmitting: () => {
+			throw new Error(errorMessage);
+		},
+		undo: () => {
+			throw new Error(errorMessage);
+		},
+		redo: () => {
+			throw new Error(errorMessage);
+		}
+	};
 }
 //#endregion
 //#region src/util/useStorageUploadController.tsx
@@ -14300,142 +15440,6 @@ function getEntityImagePreviewPropertyKey(collection) {
 	}
 }
 //#endregion
-//#region src/collections/entity-display-cache.ts
-/** The identity of one role of one record, as a cache key. */
-function entityDisplayKey(path, entityId, role) {
-	return `${role} ${path} ${entityId ?? ""}`;
-}
-var EntityDisplayCache = class {
-	entries = /* @__PURE__ */ new Map();
-	listeners = /* @__PURE__ */ new Set();
-	/**
-	* The resolved value, or `undefined` when this pair has not been resolved
-	* yet. `null` is a resolved absence, and the two must stay distinct: a
-	* caller that reads "not yet" as "nothing" flickers its fallback in on every
-	* mount.
-	*/
-	peek(key) {
-		const entry = this.entries.get(key);
-		if (!entry || "promise" in entry) return void 0;
-		return entry.value;
-	}
-	/** True while a resolution for this pair is in flight. */
-	isLoading(key) {
-		const entry = this.entries.get(key);
-		return Boolean(entry && "promise" in entry);
-	}
-	/**
-	* Resolve once per record and role. Concurrent callers share the first
-	* call's promise; later callers get the cached value with no promise at all.
-	*
-	* A resolver that throws is recorded as "nothing" rather than retried: the
-	* alternative is every render re-running a call that just failed. And it is
-	* reported here, which is a correction.
-	*
-	* It used to say "the caller that saw the rejection is the one that logs
-	* it", and `useEntityDisplay` duly attached a `.catch()` that warned. But
-	* both failure paths below swallow and return a *resolved* promise, so that
-	* catch could never run — the two halves each did the reasonable thing and
-	* between them the log was unreachable. A resolver that blew up produced a
-	* blank chip and total silence, which is the failure mode
-	* `EntityDisplayResolver`'s own contract ("treated as `undefined` and logged
-	* once") exists to rule out.
-	*
-	* Reporting belongs here for the reason the caller could not do it: this is
-	* the one place that runs exactly once per key, so "once" is a property of
-	* the code rather than a hope about how many components mount.
-	*/
-	resolve(key, resolver) {
-		const entry = this.entries.get(key);
-		if (entry) return "promise" in entry ? entry.promise : Promise.resolve(entry.value);
-		let produced;
-		try {
-			produced = resolver();
-		} catch (error) {
-			this.fail(key, error);
-			return Promise.resolve(null);
-		}
-		if (!isPromise(produced)) {
-			const value = normalize(produced);
-			this.set(key, value);
-			return Promise.resolve(value);
-		}
-		const promise = produced.then((resolved) => {
-			const value = normalize(resolved);
-			this.set(key, value);
-			return value;
-		}).catch((error) => {
-			this.fail(key, error);
-			return null;
-		});
-		this.entries.set(key, { promise });
-		return promise;
-	}
-	/**
-	* Drop what is known about a record, so the next ask resolves again. Called
-	* after a write: the row that just saved may be called something else now.
-	*/
-	invalidate(path, entityId) {
-		const suffix = ` ${path} ${entityId ?? ""}`;
-		let changed = false;
-		for (const key of [...this.entries.keys()]) if (entityId === void 0 ? key.includes(` ${path} `) || key.endsWith(` ${path} `) : key.endsWith(suffix)) {
-			this.entries.delete(key);
-			changed = true;
-		}
-		if (changed) this.emit();
-	}
-	/** Drop everything. The user signed out, or the app swapped datasource. */
-	clear() {
-		if (this.entries.size === 0) return;
-		this.entries.clear();
-		this.emit();
-	}
-	subscribe(listener) {
-		this.listeners.add(listener);
-		return () => {
-			this.listeners.delete(listener);
-		};
-	}
-	set(key, value) {
-		this.entries.set(key, { value });
-		this.emit();
-	}
-	/**
-	* Record a failed resolution as "nothing", and say so once.
-	*
-	* The key is the message: it is `<role> <path> <id>`, which is exactly what a
-	* reader needs to find the resolver that blew up. A warning with no key would
-	* tell them a display resolver failed somewhere in a list of fifty rows.
-	*
-	* `console.warn` rather than a thrown error, because this runs while a row is
-	* rendering: the contract is that a title which cannot be fetched must not
-	* take down the row that shows it.
-	*/
-	fail(key, error) {
-		console.warn(`[rebase] Could not resolve display value for ${key}:`, error);
-		this.set(key, null);
-	}
-	emit() {
-		for (const listener of [...this.listeners]) listener();
-	}
-};
-/**
-* Empty strings and empty arrays are absences, not values — a title of `"  "`
-* would otherwise beat the derived one and render as a blank heading.
-*/
-function normalize(value) {
-	if (value === void 0 || value === null) return null;
-	if (typeof value === "string") {
-		const trimmed = value.trim();
-		return trimmed.length > 0 ? trimmed : null;
-	}
-	if (Array.isArray(value)) return value.length > 0 ? value : null;
-	return value;
-}
-function isPromise(value) {
-	return typeof value?.then === "function";
-}
-//#endregion
 //#region src/collections/filter-operator-resolution.ts
 /**
 * Default operators offered per property type, before engine capabilities and
@@ -15219,6 +16223,6 @@ function getTitlePropertyKeyForValues(collection, values, entityId) {
 	return candidates[0];
 }
 //#endregion
-export { AIIcon, AIModifiedIndicator, AdminModeControllerContext, AdminModeControllerProvider, AnalyticsContext, ApiConfigProvider, AuthControllerContext, CONTAINER_FULL_WIDTH, CollectionComponentOverrideProvider, CollectionResolverRegistrationContext, CollectionScopeContext, CollectionScopeProvider, ComponentOverrideContext, ConfirmationDialog, CustomizationControllerContext, DEFAULT_API_PATH, DEFAULT_PAGE_SIZE, DataDriverContext, DataSourcesContext, DialogsControllerContext, DialogsProvider, EffectiveRoleControllerContext, EffectiveRoleControllerProvider, EntityDisplayCache, ErrorTooltip, ErrorView, FORM_CONTAINER_WIDTH, GlobalComponentOverrideProvider, IconForView, LanguageToggle, LoginView, ModeControllerContext, ModeControllerProvider, NavigationBlockerProvider, NotFoundPage, PluginProviderStack, REBASE_LOCALE_STORAGE_KEY, Rebase, RebaseAuth, RebaseClientInstanceContext, RebaseDataContext, RebaseI18nProvider, RebaseLogo, RebaseRegistryProvider, RebaseRouter, RebaseRoutes, SIDE_PANEL_DEFAULT_WIDTH, STUDIO_NAVIGATION_GROUPS, SUMMARY_RANK, SchemaDriftBanner, SchemaDriftProvider, SnackbarProvider, StorageSourceContext, StorageSourcesContext, StudioBridgeContext, StudioBridgeProvider, StudioBridgeRegistryContext, StudioBridgeRegistryProvider, UnsavedChangesDialog, UserConfigurationPersistenceContext, UserDisplay, UserSelectPopover, UserSettingsView, addInitialSlash, apiBaseOf, applyPropertyConditions, buildCollapsedDefaults, buildEnumLabel, canSummariseProperty, clearAuthConfigCache, clearFetchCache, createAuthConfigCache, createFormexStub, deleteEntityWithCallbacks, deriveSpan, en, entityDisplayKey, es, fetchAuthConfig, fillRows, flattenKeys, getAdminEntityChildViews, getAdminSubcollections, getCollectionBySlugWithin, getCollectionPathsCombinations, getColorScheme, getColumnKeysForProperty, getDisplayPropertyKey, getDisplayResolver, getEntityFromCache, getEntityFromMemoryCache, getEntityImagePreviewPropertyKey, getEntityPreviewKeys, getEntityTitlePropertyKey, getFormFieldKeys, getIcon, getLastSegment, getLeadingRelationTitleKey, getLocalChangesBackup, getNavigationEntriesFromPath, getParentReferencesFromPath, getPropertyInPath, getRedundantChildViewColumnIds, getRelationIncludeParams, getRowHeight, getSubcollectionColumnId, getTitlePropertyCandidates, getTitlePropertyKey, getTitlePropertyKeyForValues, hasDeclaredDisplay, iconsSearch, isAuditTimestamp, isDisabled, isEnumValueDisabled, isFilterableRelation, isHidden, isIdPropertyEditable, isLongTextProperty, isReadOnly, isSchemaDriftError, isStorageProperty, looksLikeIdentifierValue, populateFetchCache, rankSummaryProperty, readStoredString, removeEntityFromCache, removeEntityFromMemoryCache, removeInitialAndTrailingSlashes, removeInitialSlash, removeStoredString, removeTrailingSlash, resolveCollectionPathIds, resolveComponentRef, resolveDefaultSelectedView, resolveFilterOperators, resolveFormLayout, saveEntityToCache, saveEntityToMemoryCache, saveEntityWithCallbacks, useAdminModeController, useAnalyticsController, useApiBase, useApiConfig, useAuthController, useAuthSubscription, useBackendStorageSource, useBridgeRegistration, useBrowserTitleAndIcon, useBuildAdminModeController, useBuildEffectiveRoleController, useBuildLocalConfigurationPersistence, useBuildModeController, useClipboard, useCollapsedGroups, useCollection, useCollectionScope, useColumnIds, useComponentOverride, useCustomizationController, useData, useDataSources, useDataTableController, useDebouncedData, useDialogsController, useEffectiveRoleController, useFetch, useLargeLayout, useModeController, useNavigationBlocker, useNavigationGroupLabel, usePermissions, useRebaseAuthController, useRebaseClient, useRebaseContext, useRebaseRegistry, useRebaseRegistryDispatch, useRelationSelector, useResolvedComponent, useRestoreScroll, useSchemaDriftContext, useScrollRestoration, useSlot, useSnackbarController, useStorageSource, useStorageSources, useStorageUploadController, useStudioBreadcrumbs, useStudioCapabilities, useStudioCollectionRegistry, useStudioNavigationState, useStudioSchemaEditing, useStudioSidePanelController, useStudioUrlController, useTranslation, useUnsavedChangesDialog, useUserConfigurationPersistence, writeStoredString };
+export { AIIcon, AIModifiedIndicator, AdminModeControllerContext, AdminModeControllerProvider, AnalyticsContext, ApiConfigProvider, AuthControllerContext, CONTAINER_FULL_WIDTH, CollectionComponentOverrideProvider, CollectionResolverRegistrationContext, CollectionScopeContext, CollectionScopeProvider, ComponentOverrideContext, ConfirmationDialog, CustomizationControllerContext, DEFAULT_API_PATH, DEFAULT_PAGE_SIZE, DataDriverContext, DataSourcesContext, DialogsControllerContext, DialogsProvider, EffectiveRoleControllerContext, EffectiveRoleControllerProvider, EntityDisplayCache, ErrorTooltip, ErrorView, FORM_CONTAINER_WIDTH, GlobalComponentOverrideProvider, IconForView, LanguageToggle, LoginView, ModeControllerContext, ModeControllerProvider, NavigationBlockerProvider, NotFoundPage, PluginProviderStack, REBASE_LOCALE_STORAGE_KEY, Rebase, RebaseAuth, RebaseClientInstanceContext, RebaseDataContext, RebaseI18nProvider, RebaseLogo, RebaseRegistryProvider, RebaseRouter, RebaseRoutes, SIDE_PANEL_DEFAULT_WIDTH, STUDIO_NAVIGATION_GROUPS, SUMMARY_RANK, SchemaDriftBanner, SchemaDriftProvider, SnackbarProvider, StorageSourceContext, StorageSourcesContext, StudioBridgeContext, StudioBridgeProvider, StudioBridgeRegistryContext, StudioBridgeRegistryProvider, UnsavedChangesDialog, UserConfigurationPersistenceContext, UserDisplay, UserSelectPopover, UserSettingsView, addInitialSlash, apiBaseOf, applyPropertyConditions, buildCollapsedDefaults, buildEnumLabel, canSummariseProperty, clearAuthConfigCache, clearCollectionScrollCache, clearEntityDrafts, clearEntityMemoryCache, clearFetchCache, createAuthConfigCache, createFormexStub, deleteEntityWithCallbacks, deriveSpan, en, entityDisplayKey, es, fetchAuthConfig, fillRows, flattenKeys, getAdminEntityChildViews, getAdminSubcollections, getCollectionBySlugWithin, getCollectionPathsCombinations, getColorScheme, getColumnKeysForProperty, getDisplayPropertyKey, getDisplayResolver, getEntityFromCache, getEntityFromMemoryCache, getEntityImagePreviewPropertyKey, getEntityPreviewKeys, getEntityTitlePropertyKey, getFormFieldKeys, getIcon, getLastSegment, getLeadingRelationTitleKey, getLocalChangesBackup, getNavigationEntriesFromPath, getParentReferencesFromPath, getPropertyInPath, getRedundantChildViewColumnIds, getRelationIncludeParams, getRowHeight, getSharedEntityDisplayCache, getSubcollectionColumnId, getTitlePropertyCandidates, getTitlePropertyKey, getTitlePropertyKeyForValues, hasDeclaredDisplay, iconsSearch, isAuditTimestamp, isDisabled, isEnumValueDisabled, isFilterableRelation, isHidden, isIdPropertyEditable, isLongTextProperty, isReadOnly, isSchemaDriftError, isStorageProperty, looksLikeIdentifierValue, populateFetchCache, rankSummaryProperty, readStoredString, removeEntityFromCache, removeEntityFromMemoryCache, removeInitialAndTrailingSlashes, removeInitialSlash, removeStoredString, removeTrailingSlash, resolveCollectionPathIds, resolveComponentRef, resolveDefaultSelectedView, resolveFilterOperators, resolveFormLayout, saveEntityToCache, saveEntityToMemoryCache, saveEntityWithCallbacks, useAdminModeController, useAnalyticsController, useApiBase, useApiConfig, useAuthController, useAuthSubscription, useBackendStorageSource, useBridgeRegistration, useBrowserTitleAndIcon, useBuildAdminModeController, useBuildEffectiveRoleController, useBuildLocalConfigurationPersistence, useBuildModeController, useClipboard, useCollapsedGroups, useCollection, useCollectionScope, useColumnIds, useComponentOverride, useCustomizationController, useData, useDataSources, useDataTableController, useDebouncedData, useDialogsController, useEffectiveRoleController, useFetch, useLargeLayout, useModeController, useNavigationBlocker, useNavigationGroupLabel, usePermissions, useRebaseAuthController, useRebaseClient, useRebaseContext, useRebaseRegistry, useRebaseRegistryDispatch, useRelationSelector, useResolvedComponent, useRestoreScroll, useSchemaDriftContext, useScrollRestoration, useSlot, useSnackbarController, useStorageSource, useStorageSources, useStorageUploadController, useStudioBreadcrumbs, useStudioCapabilities, useStudioCollectionRegistry, useStudioNavigationState, useStudioSchemaEditing, useStudioSidePanelController, useStudioUrlController, useTranslation, useUnsavedChangesDialog, useUserConfigurationPersistence, writeStoredString };
 
 //# sourceMappingURL=index.es.js.map