@rebasepro/server 0.10.1-canary.b1e3dbf → 0.10.1-canary.ed8caed

package/dist/api/ast-schema-editor.d.ts

@@ -1,3 +1,13 @@
+/**
+ * Move presentation keys into the `admin` block.
+ *
+ * `ADMIN_COLLECTION_KEYS` comes from `@rebasepro/types` rather than being spelled
+ * out here, so adding a field to `AdminCollectionOptions` cannot leave this writer
+ * behind. Any such key already inside `admin` wins over a top-level copy: the
+ * nested one is what the file said, and a flat duplicate is the view model's
+ * flattening leaking back.
+ */
+export declare function nestAdminKeys(collectionData: Record<string, unknown>): Record<string, unknown>;
 export declare class AstSchemaEditor {
     private project;
     private collectionsDir;

package/dist/api/rest/api-generator.d.ts

@@ -41,6 +41,20 @@ export declare class RestApiGenerator {
      * slug, never an id.
      */
     private enforceSubcollectionApiKeyPermission;
+    /**
+     * The collection a nested path writes into — the target of the relation its
+     * last segment names.
+     *
+     * Needed so a nested write can be checked against a schema at all. Without
+     * it these routes skipped `assertKnownWriteFields` entirely, which is why a
+     * typo `POST /posts` rejected with a 400 while the same typo on
+     * `POST /authors/1/posts` reached the database.
+     *
+     * Returns `undefined` rather than throwing when the path cannot be walked:
+     * the driver raises the authoritative error a moment later, and duplicating
+     * it here would report a resolution failure as a validation failure.
+     */
+    private resolveNestedWriteCollection;
     /**
      * Get the request-scoped driver. Throws if none is set — never falls
      * back to the unscoped `this.driver` to avoid bypassing RLS/auth.

package/dist/index.es.js

@@ -2,7 +2,7 @@ import { createRequire as __createRequire } from "module";
 import process from "process";
 __createRequire(import.meta.url);
 import { _ as __toESM, a as generateRefreshToken, c as getRefreshTokenTtlMs, d as verifyAccessToken, f as verifyDownloadToken, g as __require, h as __exportAll, i as generateDownloadToken, l as hashRefreshToken, m as __commonJSMin, n as configureJwt, o as getAccessTokenExpiry, p as require_jsonwebtoken, r as generateAccessToken, s as getRefreshTokenExpiry, t as MAX_COOKIE_AGE_MS } from "./jwt-Dj7r7QX7.js";
-import { _ as EntityRelation, a as DEFAULT_DATA_SOURCE_KEY, b as RebaseApiError, c as policy, d as isPostgresCollectionConfig, f as CANONICAL_TO_REST, g as EntityReference, h as toCanonicalOp, i as DEFAULT_STORAGE_SOURCE_KEY, l as getCollectionDataPath, m as REST_TO_CANONICAL, n as serializeCollections, o as getDataSourceCapabilities, p as NULL_OPS, r as SCHEMA_VERSION_HEADER, s as isSQLAdmin, t as computeSchemaVersion, u as getDeclaredSubcollections, v as GeoPoint, x as RebaseClientError, y as Vector } from "./src-BITicbgD.js";
+import { S as RebaseClientError, _ as EntityReference, a as DEFAULT_DATA_SOURCE_KEY, b as Vector, c as policy, d as isPostgresCollectionConfig, g as toCanonicalOp, h as REST_TO_CANONICAL, i as DEFAULT_STORAGE_SOURCE_KEY, l as getCollectionDataPath, m as NULL_OPS, n as serializeCollections, o as getDataSourceCapabilities, p as CANONICAL_TO_REST, r as SCHEMA_VERSION_HEADER, s as isSQLAdmin, t as computeSchemaVersion, u as getDeclaredSubcollections, v as EntityRelation, x as RebaseApiError, y as GeoPoint } from "./src-DRUswG_w.js";
 import { t as logger } from "./logger-BYU66ENZ.js";
 import { t as nativeDynamicImport } from "./dynamic-import-Dvh-K5fl.js";
 import { createHash, randomBytes, randomInt, randomUUID } from "node:crypto";
@@ -1309,6 +1309,19 @@ function sanitizeRelation(relation, sourceCollection, resolveCollection) {
 	if (newRelation.cardinality === "many" && newRelation.direction === "inverse" && !newRelation.foreignKeyOnTarget && !newRelation.joinPath && !newRelation.inverseRelationName) throw new Error(`Configuration Error in relation from '${sourceCollection.name}': An 'inverse' one-to-many relation requires a 'foreignKeyOnTarget'. Check the relation config for '${newRelation.relationName}'`);
 	return newRelation;
 }
+/**
+* Whether the target rows of this relation are reached through a junction — a
+* many-to-many, or a multi-hop `joinPath`.
+*
+* The distinction decides what a write "through" the relation may touch: a
+* junction-backed target is shared with other parents, so the parent owns the
+* *link* and not the row. The backend enforces that (an unlink rather than a
+* delete) and the admin renders it (remove-from-parent rather than delete), so
+* the predicate lives here rather than once per side.
+*/
+function isJunctionBackedRelation(relation) {
+	return Boolean(relation.through) || Boolean(relation.joinPath && relation.joinPath.length > 1);
+}
 /** WeakMap cache — same collection instance always yields the same relation map. */
 var _resolvedRelationsCache = /* @__PURE__ */ new WeakMap();
 function resolveCollectionRelations(collection) {
@@ -1385,34 +1398,115 @@ function findRelation(resolvedRelations, key) {
 }
 //#endregion
 //#region ../common/src/util/resolutions.ts
-function getSubcollections(collection) {
-	if (collection.childCollections) return collection.childCollections() ?? [];
-	const declaredSubcollections = getDeclaredSubcollections(collection);
-	if (getDataSourceCapabilities(collection.engine).supportsSubcollections && declaredSubcollections) return declaredSubcollections() ?? [];
-	if (getDataSourceCapabilities(collection.engine).supportsRelations) {
-		const resolvedRelations = resolveCollectionRelations(collection);
-		return Object.values(resolvedRelations).filter((r) => r.cardinality === "many").map((r) => {
-			const target = r.target();
-			if (!target) return void 0;
-			const relationKey = r.relationName || target.slug;
-			let customName;
-			if (collection.properties) {
-				const prop = Object.entries(collection.properties).find(([_, p]) => p.type === "relation" && p.relationName === relationKey);
-				if (prop && prop[1].name) customName = prop[1].name;
+/**
+* Relation identities that only ever appear *below* the top level of
+* `properties` — inside a `map`, an `array`, or a `oneOf` branch.
+*
+* A relation declared at the top level is a list hanging off the record and
+* earns a tab. One declared inside a map is a field of that map. Both end up in
+* the collection's flat `relations` array after normalization, so the shape of
+* `properties` is the only remaining evidence of which is which.
+*
+* An identity declared in both places is *not* nested-only, and keeps its tab.
+*/
+function getNestedRelationIdentities(properties) {
+	const topLevel = /* @__PURE__ */ new Set();
+	const nested = /* @__PURE__ */ new Set();
+	const walk = (props, depth) => {
+		if (!props) return;
+		for (const [key, property] of Object.entries(props)) {
+			if (!property) continue;
+			if (property.type === "relation") {
+				const relProp = property;
+				(depth === 0 ? topLevel : nested).add(relProp.relationName ?? key);
+			} else if (property.type === "map") walk(property.properties, depth + 1);
+			else if (property.type === "array") {
+				const arrayProp = property;
+				if (Array.isArray(arrayProp.of)) arrayProp.of.forEach((p) => walk({ entry: p }, depth + 1));
+				else if (arrayProp.of) walk({ entry: arrayProp.of }, depth + 1);
+				if (arrayProp.oneOf?.properties) walk(arrayProp.oneOf.properties, depth + 1);
 			}
-			const baseOverrides = { slug: relationKey };
-			if (customName) {
-				baseOverrides.name = customName;
-				baseOverrides.singularName = customName;
+		}
+	};
+	walk(properties, 0);
+	for (const identity of topLevel) nested.delete(identity);
+	return nested;
+}
+/**
+* The lists rendered inside an entity view of `collection` — its tabs.
+*
+* The single derivation. There used to be two that disagreed: this one, and a
+* copy in `CollectionRegistry.normalizeCollection` that stamped each child with
+* the *target collection's* slug instead of the relation key. Since the
+* registry ran first and cached its answer onto `childCollections`, its version
+* was the one that won, and the frontend addressed child listings by a segment
+* the backend could not resolve.
+*
+* Order of precedence:
+*   1. `childCollections` — the explicit escape hatch for custom drivers.
+*   2. `subcollections` on an engine that has real containment (Firestore).
+*   3. many-relations on an engine that has relations (SQL).
+*/
+function getEntityChildViews(collection) {
+	const asSubcollections = (collections) => collections.filter(Boolean).map((child) => ({
+		key: child.slug,
+		collection: child,
+		source: { kind: "subcollection" }
+	}));
+	if (collection.childCollections) return asSubcollections(collection.childCollections() ?? []);
+	const capabilities = getDataSourceCapabilities(collection.engine);
+	const declaredSubcollections = getDeclaredSubcollections(collection);
+	if (capabilities.supportsSubcollections && declaredSubcollections) return asSubcollections(declaredSubcollections() ?? []);
+	if (!capabilities.supportsRelations) return [];
+	const resolvedRelations = resolveCollectionRelations(collection);
+	const nestedOnly = getNestedRelationIdentities(collection.properties);
+	const views = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const [relationKey, relation] of Object.entries(resolvedRelations)) {
+		if (relation.cardinality !== "many") continue;
+		const identity = relation.relationName ?? relationKey;
+		if (seen.has(identity)) continue;
+		if (nestedOnly.has(identity)) continue;
+		let target;
+		try {
+			target = relation.target();
+		} catch {
+			continue;
+		}
+		if (!target) continue;
+		seen.add(identity);
+		const customName = Object.entries(collection.properties ?? {}).find(([propKey, p]) => p.type === "relation" && (p.relationName ?? propKey) === identity)?.[1]?.name;
+		const base = {
+			...target,
+			slug: relationKey,
+			...customName ? {
+				name: customName,
+				singularName: customName
+			} : {}
+		};
+		views.push({
+			key: relationKey,
+			collection: relation.overrides ? mergeDeep(base, relation.overrides) : base,
+			source: {
+				kind: "relation",
+				relationKey,
+				mode: isJunctionBackedRelation(relation) ? "linked" : "owned",
+				targetSlug: target.slug
 			}
-			const targetWithOverrides = {
-				...target,
-				...baseOverrides
-			};
-			return r.overrides ? mergeDeep(targetWithOverrides, r.overrides) : targetWithOverrides;
-		}).filter((c) => Boolean(c));
+		});
 	}
-	return [];
+	return views;
+}
+/**
+* The child views of `collection` as bare collections.
+*
+* The flattened view of {@link getEntityChildViews}, for navigation code that
+* only needs to match a path segment against a slug. Anything that cares *what
+* kind* of list it is showing — chiefly the admin, which must not offer a
+* global delete on a shared row — should read the views instead.
+*/
+function getSubcollections(collection) {
+	return getEntityChildViews(collection).map((view) => view.collection);
 }
 policy.or(policy.serverContext(), policy.rolesOverlap(["admin"]));
 policy.or(policy.serverContext(), policy.rolesOverlap(["admin"]));
@@ -1689,39 +1783,9 @@ policy.or(policy.serverContext(), policy.rolesOverlap(["admin"]));
 		return jsonLogic;
 	});
 })))();
-//#endregion
-//#region ../common/src/util/filter-operator-resolution.ts
-/**
-* Default operators offered per property type, before engine capabilities and
-* per-property narrowing are applied. These mirror what the built-in filter
-* fields can render.
-*/
-var COMPARISON_OPS = [
-	"==",
-	"!=",
-	">",
-	">=",
-	"<",
-	"<="
-];
-var NULL_CHECK_OPS = ["is-null", "is-not-null"];
-var MEMBERSHIP_OPS = ["in", "not-in"];
-var PATTERN_OPS = [
-	"like",
-	"ilike",
-	"not-like",
-	"not-ilike"
-];
-[
-	...COMPARISON_OPS,
-	...MEMBERSHIP_OPS,
-	...PATTERN_OPS,
-	...NULL_CHECK_OPS
-], [
-	...COMPARISON_OPS,
-	...MEMBERSHIP_OPS,
-	...NULL_CHECK_OPS
-], [...COMPARISON_OPS, ...NULL_CHECK_OPS], [...NULL_CHECK_OPS], [...MEMBERSHIP_OPS, ...NULL_CHECK_OPS], [...MEMBERSHIP_OPS, ...NULL_CHECK_OPS];
+/**
+* Apply PropertyConditions to a resolved property, evaluating all JSON Logic rules.
+*/
 //#endregion
 //#region ../../node_modules/.pnpm/fast-equals@6.0.0/node_modules/fast-equals/dist/es/index.mjs
 var { getOwnPropertyNames, getOwnPropertySymbols } = Object;
@@ -2338,18 +2402,6 @@ var CollectionRegistry = class {
 			relResult.relations = mergedRelations;
 		}
 		result.properties = this.normalizeProperties(result.properties, mergedRelations);
-		if (!result.childCollections) {
-			const capabilities = getDataSourceCapabilities(result.engine);
-			const declaredSubcollections = getDeclaredSubcollections(result);
-			if (capabilities.supportsSubcollections && declaredSubcollections) result.childCollections = declaredSubcollections;
-			else if (capabilities.supportsRelations && relResult.relations) {
-				const manyRelations = relResult.relations.filter((r) => r.cardinality === "many");
-				if (manyRelations.length > 0) result.childCollections = () => manyRelations.map((r) => {
-					const target = r.target();
-					return r.overrides ? mergeDeep(target, r.overrides) : target;
-				});
-			}
-		}
 		return result;
 	}
 	/**
@@ -2448,9 +2500,7 @@ var CollectionRegistry = class {
 			const relation = findRelation(resolveCollectionRelations(currentCollection), relationKey);
 			if (!relation) throw new Error(`Relation '${relationKey}' not found in collection '${currentCollection.slug}'`);
 			const target = relation.target();
-			const targetRelationKey = relation.relationName || target.slug;
-			const targetSlug = relation.overrides?.slug ?? targetRelationKey;
-			currentCollection = this.get(targetSlug) || this.normalizeCollection(target);
+			currentCollection = this.collectionsByTableName.get(getTableName(target)) ?? this.normalizeCollection(target);
 			if (i + 1 < pathSegments.length) {}
 		}
 		return currentCollection;
@@ -2485,7 +2535,7 @@ var CollectionRegistry = class {
 				if (!subcollections || subcollections.length === 0) throw new Error(`No subcollections found for ${currentCollection.slug} in path: ${path}`);
 				const subcollection = subcollections.find((c) => c.slug === subcollectionSlug);
 				if (!subcollection) throw new Error(`Subcollection '${subcollectionSlug}' not found in ${currentCollection.slug}`);
-				currentCollection = this.get(subcollection.slug) || this.normalizeCollection(subcollection);
+				currentCollection = this.normalizeCollection(subcollection);
 				collections.push(currentCollection);
 			}
 		}
@@ -4054,6 +4104,34 @@ var RestApiGenerator = class {
 		this.enforceApiKeyPermission(c, collectionPath.split("/").pop());
 	}
 	/**
+	* The collection a nested path writes into — the target of the relation its
+	* last segment names.
+	*
+	* Needed so a nested write can be checked against a schema at all. Without
+	* it these routes skipped `assertKnownWriteFields` entirely, which is why a
+	* typo `POST /posts` rejected with a 400 while the same typo on
+	* `POST /authors/1/posts` reached the database.
+	*
+	* Returns `undefined` rather than throwing when the path cannot be walked:
+	* the driver raises the authoritative error a moment later, and duplicating
+	* it here would report a resolution failure as a validation failure.
+	*/
+	resolveNestedWriteCollection(collectionPath) {
+		const segments = collectionPath.split("/").filter((s) => s && s !== "undefined");
+		let current = this.collections.find((c) => c.slug === segments[0]);
+		for (let i = 2; i < segments.length && current; i += 2) {
+			const relation = findRelation(resolveCollectionRelations(current), segments[i]);
+			if (!relation) return void 0;
+			try {
+				const target = relation.target();
+				current = this.collections.find((c) => c.slug === target?.slug) ?? target;
+			} catch {
+				return;
+			}
+		}
+		return current;
+	}
+	/**
 	* Get the request-scoped driver. Throws if none is set — never falls
 	* back to the unscoped `this.driver` to avoid bypassing RLS/auth.
 	*/
@@ -4294,7 +4372,9 @@ var RestApiGenerator = class {
 				}) : 0;
 				return c.json({ count: total });
 			} else if (parsed.id) {
-				const entity = await driver.fetchOne({
+				const queryOptions = this.parseQuery(c.req.queries());
+				const fetchService = driver.restFetchService;
+				const entity = fetchService ? await fetchService.fetchOneForRest(parsed.collectionPath, parsed.id, queryOptions.include) : await driver.fetchOne({
 					path: parsed.collectionPath,
 					id: parsed.id
 				});
@@ -4304,13 +4384,18 @@ var RestApiGenerator = class {
 				const queryDict = c.req.queries();
 				const queryOptions = this.parseQuery(queryDict);
 				const searchString = Array.isArray(queryDict.searchString) ? queryDict.searchString[queryDict.searchString.length - 1] : void 0;
-				const entities = await driver.fetchCollection({
-					path: parsed.collectionPath,
+				const fetchService = driver.restFetchService;
+				const listOptions = {
 					filter: queryOptions.where,
 					limit: queryOptions.limit,
+					offset: queryOptions.offset,
 					orderBy: queryOptions.orderBy?.[0]?.field,
 					order: queryOptions.orderBy?.[0]?.direction === "desc" ? "desc" : "asc",
 					searchString
+				};
+				const entities = fetchService ? await fetchService.fetchCollectionForRest(parsed.collectionPath, listOptions, queryOptions.include) : await driver.fetchCollection({
+					path: parsed.collectionPath,
+					...listOptions
 				});
 				const total = driver.count ? await driver.count({
 					path: parsed.collectionPath,
@@ -4336,6 +4421,8 @@ var RestApiGenerator = class {
 			const driver = this.getScopedDriver(c);
 			this.enforceSubcollectionApiKeyPermission(c, parsed.collectionPath);
 			const body = await parseJsonBody(c);
+			const targetCollection = this.resolveNestedWriteCollection(parsed.collectionPath);
+			if (targetCollection) assertKnownWriteFields(body, targetCollection);
 			const entity = await driver.save({
 				path: parsed.collectionPath,
 				values: body,
@@ -4352,6 +4439,8 @@ var RestApiGenerator = class {
 			const driver = this.getScopedDriver(c);
 			this.enforceSubcollectionApiKeyPermission(c, parsed.collectionPath);
 			const body = await parseJsonBody(c);
+			const targetCollection = this.resolveNestedWriteCollection(parsed.collectionPath);
+			if (targetCollection) assertKnownWriteFields(body, targetCollection);
 			const entity = await driver.save({
 				path: parsed.collectionPath,
 				id: parsed.id,
@@ -12888,6 +12977,7 @@ async function verifyGoogleAccessToken(accessToken, expectedClientId) {
 function createGoogleProvider(config) {
 	const clientId = typeof config === "string" ? config : config.clientId;
 	const clientSecret = typeof config === "string" ? void 0 : config.clientSecret;
+	if (!clientSecret) console.warn("[Rebase] Google provider configured without a client secret. ID-token and access-token sign-in still work, but the authorization-code flow used by the admin login button will fail. Set GOOGLE_CLIENT_SECRET to enable it.");
 	let googleClient;
 	async function getClient() {
 		if (!googleClient) {
@@ -14580,7 +14670,7 @@ function buildAdapterAuthMiddleware(adapter, requireAuth, publicRead) {
 function createStorageRoutes(config) {
 	const router = new Hono();
 	router.onError(errorHandler);
-	const { controller, registry, sources: declaredSources, requireAuth: requireAuth$1 = true, publicRead = false, authAdapter, authorize } = config;
+	const { controller, registry, sources: declaredSources, requireAuth: requireAuth$1 = true, publicRead = false, authAdapter, authorize, authorizeData } = config;
 	/**
 	* Run the per-object authorization hook, if one is configured.
 	*
@@ -14601,7 +14691,8 @@ function createStorageRoutes(config) {
 				bucket,
 				operation,
 				user,
-				storageId: storageId ?? void 0
+				storageId: storageId ?? void 0,
+				data: authorizeData?.()
 			});
 		} catch {
 			allowed = false;
@@ -15043,7 +15134,7 @@ function assertStorageAccessControlConfigured(state, isProduction) {
 //#region src/init/docs.ts
 async function mountOpenApiDocs(app, basePath, enableSwagger, activeCollections, requireAuth) {
 	if (enableSwagger === false || activeCollections.length === 0) return;
-	const { generateOpenApiSpec } = await import("./openapi-generator-DqSIwNLV.js");
+	const { generateOpenApiSpec } = await import("./openapi-generator-C3_pTcsb.js");
 	app.get(`${basePath}/docs`, (c) => {
 		const spec = generateOpenApiSpec(activeCollections, {
 			basePath,
@@ -15545,6 +15636,34 @@ function createAuth(transport, options) {
 		transport.setToken(null);
 		emit("SIGNED_OUT", null);
 	}
+	/**
+	* Recover from a 401 on an ordinary API request.
+	*
+	* Returns `true` when the caller should retry — we minted a fresh access
+	* token. When the refresh is rejected *fatally* (the refresh token itself
+	* is invalid, expired or revoked) this client can no longer act as the
+	* user at all, so we drop the session and emit `SIGNED_OUT`. UIs gate on
+	* that event, so they show their login screen instead of leaving the user
+	* staring at "Invalid or expired token" on every view.
+	*
+	* Transient failures (offline, 5xx, backend restarting) keep the session:
+	* the scheduled refresh backs off and retries, and the token is very
+	* likely still good once the backend answers again.
+	*/
+	async function handleUnauthorized() {
+		if (!currentSession) return false;
+		if (authFlowMode !== "cookie" && !currentSession.refreshToken) {
+			abandonSessionLocally();
+			return false;
+		}
+		try {
+			await refreshSession();
+			return true;
+		} catch (err) {
+			if (isFatalRefreshError(err)) abandonSessionLocally();
+			return false;
+		}
+	}
 	async function attemptScheduledRefresh(attempt) {
 		try {
 			await refreshSession();
@@ -16046,6 +16165,7 @@ function createAuth(transport, options) {
 		signInWithSpotify,
 		signOut,
 		refreshSession,
+		handleUnauthorized,
 		getUser,
 		findUserByEmail,
 		updateUser,
@@ -20189,14 +20309,7 @@ function createRebaseClient(options) {
 				} catch (e) {}
 				return session?.accessToken || options.token || "";
 			},
-			onUnauthorized: options.onUnauthorized || (async () => {
-				try {
-					await auth.refreshSession();
-					return true;
-				} catch (e) {
-					return false;
-				}
-			})
+			onUnauthorized: options.onUnauthorized || (() => auth.handleUnauthorized())
 		});
 		auth.onAuthStateChange((event, session) => {
 			if (!ws) return;
@@ -20206,14 +20319,7 @@ function createRebaseClient(options) {
 			}
 		});
 	}
-	if (!options.onUnauthorized) transport.setOnUnauthorized(async () => {
-		try {
-			await auth.refreshSession();
-			return true;
-		} catch (e) {
-			return false;
-		}
-	});
+	if (!options.onUnauthorized) transport.setOnUnauthorized(() => auth.handleUnauthorized());
 	/**
 	* Suggest the closest known collection key for a mistyped accessor.
 	* Uses edit-distance-1 and prefix matching — no external dependency.
@@ -20951,7 +21057,7 @@ async function _initializeRebaseBackend(config) {
 	if (schemaEditorEnabled && config.collectionsDir) {
 		let editorModule;
 		try {
-			editorModule = await import("./schema-editor-routes-D3ef8zu1.js");
+			editorModule = await import("./schema-editor-routes-CF-g0gVN.js");
 		} catch (err) {
 			if (err?.code === "ERR_MODULE_NOT_FOUND") logger.warn("Schema Editor disabled: its dependency ts-morph is not installed. Run `npm install ts-morph@28.0.0` to enable it.");
 			else throw err;
@@ -20963,6 +21069,7 @@ async function _initializeRebaseBackend(config) {
 			logger.info("Schema Editor mounted", { path: `${basePath}/schema-editor` });
 		}
 	}
+	const storageAuthorizeData = {};
 	if (storageController) {
 		const storageMaxSize = (config.storage && typeof config.storage === "object" && "type" in config.storage ? config.storage.maxFileSize : void 0) ?? 50 * 1024 * 1024;
 		assertStorageAccessControlConfigured({
@@ -20977,7 +21084,8 @@ async function _initializeRebaseBackend(config) {
 			requireAuth: resolveRequireAuth(config.auth),
 			publicRead: config.storagePublicRead === true,
 			authAdapter,
-			authorize: config.storageAuthorize
+			authorize: config.storageAuthorize,
+			authorizeData: () => storageAuthorizeData.current
 		});
 		const storageRouter = new Hono();
 		if (apiKeyPreAuth) storageRouter.use("/*", apiKeyPreAuth, createStorageApiKeyGuard());
@@ -21056,6 +21164,7 @@ async function _initializeRebaseBackend(config) {
 		roles: ["admin"]
 	};
 	const defaultData = buildSdkData(await scopeDataDriver(defaultDriver, serviceIdentity));
+	storageAuthorizeData.current = defaultData;
 	const dataSourcesByKey = {};
 	for (const driverKey of driverRegistry.list()) {
 		if (driverKey === "(default)") continue;
@@ -22457,8 +22566,11 @@ var DEV_PORT_FILENAME = ".rebase-dev-port";
 * Try to `listen` on `startPort`. If the port is busy (`EADDRINUSE`), increment
 * and retry up to `maxAttempts` times.
 *
-* When a port file already exists (written by a previous run), the saved port
-* is tried first to maintain port affinity across tsx watch restarts.
+* When a port file written by a previous run exists *and that run asked for the
+* same `startPort`*, the port it landed on is tried first, so tsx watch restarts
+* keep the address the frontend was configured with. A different `startPort` means
+* the configuration changed and the file is ignored — an explicitly requested port
+* is never overridden by a stale one.
 *
 * Resolves with the port that was actually bound.
 *
@@ -22486,8 +22598,10 @@ function listenWithPortRetry(server, startPort, options) {
 	if (portFileDir) try {
 		const portFile = path.join(portFileDir, DEV_PORT_FILENAME);
 		if (fs.existsSync(portFile)) {
-			const saved = parseInt(fs.readFileSync(portFile, "utf-8").trim(), 10);
-			if (saved > 0 && saved < 65536 && saved !== startPort) affinityPort = saved;
+			const [savedRaw, requestedRaw] = fs.readFileSync(portFile, "utf-8").trim().split(/\s+/);
+			const saved = parseInt(savedRaw, 10);
+			const requestedThen = requestedRaw === void 0 ? NaN : parseInt(requestedRaw, 10);
+			if (saved > 0 && saved < 65536 && saved !== startPort && (Number.isNaN(requestedThen) || requestedThen === startPort)) affinityPort = saved;
 		}
 	} catch {}
 	return new Promise((resolve, reject) => {
@@ -22505,24 +22619,29 @@ function listenWithPortRetry(server, startPort, options) {
 			}
 			const port = portsToTry[index];
 			attempt++;
-			const onError = (err) => {
-				if (err.code === "EADDRINUSE") {
-					server.removeListener("error", onError);
-					tryNext(index + 1);
-				} else reject(err);
-			};
-			server.once("error", onError);
-			server.listen(port, host, () => {
-				server.removeListener("error", onError);
+			const onListening = () => {
+				cleanup();
 				if (portFileDir) {
 					try {
 						const portFile = path.join(portFileDir, DEV_PORT_FILENAME);
-						fs.writeFileSync(portFile, String(port), "utf-8");
+						fs.writeFileSync(portFile, `${port} ${startPort}`, "utf-8");
 					} catch {}
 					writeStateFile(portFileDir, port, options?.serviceKey);
 				}
 				resolve(port);
-			});
+			};
+			const onError = (err) => {
+				cleanup();
+				if (err.code === "EADDRINUSE") tryNext(index + 1);
+				else reject(err);
+			};
+			function cleanup() {
+				server.removeListener("listening", onListening);
+				server.removeListener("error", onError);
+			}
+			server.once("error", onError);
+			server.once("listening", onListening);
+			server.listen(port, host);
 		}
 		tryNext(0);
 	});
@@ -23744,6 +23863,7 @@ async function bootFromBundle(options = {}) {
 	const server = createServer(getRequestListener(app.fetch));
 	const usersCollection = await loadUsersCollection(bundle);
 	const storage = resolveStorageSources(process.env, storageSourceDefs, path.join(bundle.dir, "uploads"));
+	await ensureCollectionSchema(bundle, dataSources, env);
 	const backend = await initializeRebaseBackend({
 		server,
 		app,
@@ -23953,6 +24073,32 @@ async function runFromBundle(options = {}) {
 		process.exit(1);
 	}
 }
+/**
+* Bring the database's collection tables up to date before serving.
+*
+* Delegates to whichever driver bootstrapped the default data source; a driver
+* without `ensureCollectionSchema` (a schemaless one, or an older build) simply
+* skips, which is why this cannot break an existing deployment.
+*
+* Failure is fatal on purpose. Booting anyway would produce exactly the state
+* this exists to prevent — an app that answers sign-in and 500s every data
+* request — and a crash-looping pod with the DDL error in its logs is a far
+* better signal than a running one that silently cannot serve.
+*/
+async function ensureCollectionSchema(bundle, dataSources, env) {
+	if ((env.REBASE_MIGRATE_ON_BOOT || "ensure") === "none") {
+		logger.info("REBASE_MIGRATE_ON_BOOT=none — leaving the database schema untouched.");
+		return;
+	}
+	if ((bundle.manifest.mode ?? "cms") !== "cms") return;
+	if (!bundle.collectionsDir) return;
+	const primary = dataSources[0];
+	if (!primary?.bootstrapper.ensureCollectionSchema) return;
+	const collections = await loadCollectionsFromDirectory(bundle.collectionsDir);
+	if (collections.length === 0) return;
+	const { applied } = await primary.bootstrapper.ensureCollectionSchema(collections, primary.connection, (message) => logger.info(`schema: ${message}`));
+	logger.info(applied > 0 ? `Applied ${applied} additive schema change(s) before boot.` : "Collection schema is up to date.");
+}
 //#endregion
 //#region src/api/contract-routes.ts
 var contract_routes_exports = /* @__PURE__ */ __exportAll({ createContractRoutes: () => createContractRoutes });