@rebasepro/server 0.11.1-canary.gfadf355 → 0.12.0

package/dist/auth/api-keys/api-key-types.d.ts

@@ -1,26 +1,15 @@
 /**
  * Type definitions for Service API Keys.
  *
- * API keys provide machine-to-machine authentication for scripts, cron jobs,
- * and third-party integrations. Each key is scoped to specific collections
- * and operations via the `ApiKeyPermission` model.
+ * The wire contract — permissions, the masked key, the create/update payloads —
+ * lives in `@rebasepro/types`, because the client SDK needs the same shapes and
+ * the two declarations had already drifted apart. Only {@link ApiKey}, the
+ * database row carrying `key_hash`, is server-side and stays here.
  *
  * @module
  */
-/**
- * A single permission entry scoping an API key to a collection and set of operations.
- *
- * Use `"*"` as the collection value to grant access to all collections
- * (and all custom functions). Custom functions are addressed with the
- * `functions` namespace: `"functions"` grants every function,
- * `"functions/<name>"` grants a single one.
- */
-export interface ApiKeyPermission {
-    /** Collection slug, `"functions"`/`"functions/<name>"`, or `"*"` for everything. */
-    collection: string;
-    /** Allowed operations on the collection. */
-    operations: ("read" | "write" | "delete")[];
-}
+import type { ApiKeyPermission } from "@rebasepro/types";
+export type { ApiKeyPermission, ApiKeyMasked, ApiKeyWithSecret, CreateApiKeyRequest, UpdateApiKeyRequest } from "@rebasepro/types";
 /**
  * Full database row for an API key.
  * The `key_hash` is never exposed via the API — only stored for lookup.
@@ -54,56 +43,3 @@ export interface ApiKey {
     expires_at: string | null;
     revoked_at: string | null;
 }
-/**
- * Masked version of an API key, safe for API responses.
- * Omits `key_hash` and shows only the prefix.
- */
-export interface ApiKeyMasked {
-    id: string;
-    name: string;
-    key_prefix: string;
-    permissions: ApiKeyPermission[];
-    /** When true, the key is granted the `admin` role (admin routes + RLS `default_admin` policies). */
-    admin: boolean;
-    rate_limit: number | null;
-    created_by: string;
-    created_at: string;
-    updated_at: string;
-    last_used_at: string | null;
-    expires_at: string | null;
-    revoked_at: string | null;
-}
-/**
- * Request body for creating a new API key.
- */
-export interface CreateApiKeyRequest {
-    name: string;
-    permissions: ApiKeyPermission[];
-    /** When true, grants the `admin` role (admin routes + RLS `default_admin` policies). */
-    admin?: boolean;
-    /** Requests per 15-minute window. Omit or `null` to use the server default (1000/window). */
-    rate_limit?: number | null;
-    /** ISO-8601 expiration timestamp. Omit for no expiration. */
-    expires_at?: string | null;
-}
-/**
- * Request body for updating an existing API key.
- * All fields are optional — only provided fields are updated.
- */
-export interface UpdateApiKeyRequest {
-    name?: string;
-    permissions?: ApiKeyPermission[];
-    /** When true, grants the `admin` role (admin routes + RLS `default_admin` policies). */
-    admin?: boolean;
-    rate_limit?: number | null;
-    expires_at?: string | null;
-}
-/**
- * Returned exactly once when a key is created.
- * The `key` field contains the full plaintext key — it is never stored
- * or returned again after creation.
- */
-export interface ApiKeyWithSecret extends ApiKeyMasked {
-    /** Full plaintext API key (e.g. `rk_live_abc123...`). */
-    key: string;
-}

package/dist/auth/builtin-auth-adapter.d.ts

@@ -28,6 +28,17 @@ export interface BuiltinAuthAdapterConfig {
     emailConfig?: EmailConfig;
     /** Whether to allow new user registration. */
     allowRegistration?: boolean;
+    /**
+     * Hard kill switch: block self-registration outright, including the
+     * first-user bootstrap window that an empty database would otherwise open.
+     *
+     * Was declared on the route module and read by both config endpoints, but
+     * never plumbed through here — so nothing a user of the framework could
+     * write ever reached it, and the tests that covered it passed only because
+     * they built `createAuthRoutes` directly, bypassing this adapter (the sole
+     * wiring path a real backend uses).
+     */
+    disableSelfRegistration?: boolean;
     /** Whether to expose the authenticated email→minimal-profile lookup route. */
     allowUserLookup?: boolean;
     /** Default role to assign to new users. */

package/dist/auth/registration-policy.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Whether a registration may proceed — computed in exactly one place.
+ *
+ * This predicate had drifted across three independent implementations, which is
+ * the shape the bug always takes: one endpoint *advertises* that registration is
+ * open, another *enforces* that it is closed, and the user lands on a form that
+ * can only ever 403.
+ *
+ *   1. `POST /auth/register` (routes.ts) — enforces.
+ *   2. `GET /auth/config` (session-routes.ts) — advertises.
+ *   3. `getCapabilities()` (builtin-auth-adapter.ts) — also advertises, and is
+ *      the one that actually answers `GET /auth/config` on a real backend:
+ *      `init.ts` registers that path directly *before* mounting the auth router,
+ *      so Hono resolves it first and the session-routes copy never runs for it.
+ *
+ * Two of the three had already been fixed for the empty-database case when the
+ * third was still returning `allowRegistration || needsSetup` — missing the kill
+ * switch entirely. The fix is not to correct the third copy but to delete all
+ * three: every caller now goes through this function, so the next term added
+ * here reaches every surface at once.
+ *
+ * The rule itself:
+ *
+ *   - `disableSelfRegistration` is absolute. It blocks even the first user, for
+ *     operators who provision accounts out of band and never want a public
+ *     first-come-first-admin window.
+ *   - Otherwise an **empty** user table always admits the first registration,
+ *     which auto-promotes to admin. Without this a backend deployed with
+ *     `allowRegistration: false` is a dead end: `POST /admin/bootstrap` needs an
+ *     authenticated caller, and an empty database cannot produce one.
+ *   - Otherwise `allowRegistration` decides, as it always did.
+ */
+export interface RegistrationPolicy {
+    /** The hard kill switch. Blocks registration including first-user bootstrap. */
+    disableSelfRegistration?: boolean;
+    /** Steady-state self-registration, once at least one user exists. */
+    allowRegistration?: boolean;
+    /**
+     * True when the user table is empty — the bootstrap window.
+     *
+     * Callers that already know this (the config endpoints compute it to report
+     * `needsSetup`) pass it directly. `POST /auth/register` must not: it serves
+     * anonymous callers, so it checks {@link isSteadyStateRegistrationOpen}
+     * first and only pays for the count when that says no.
+     */
+    needsSetup: boolean;
+}
+/** The full predicate, for callers that already know whether setup is needed. */
+export declare function isRegistrationOpen(policy: RegistrationPolicy): boolean;
+/**
+ * The same predicate with the bootstrap window assumed closed.
+ *
+ * Exists so `POST /auth/register` can reject the common case without counting
+ * rows. A `false` here does **not** mean "refuse" — it means "the answer depends
+ * on whether the table is empty, so now go and look".
+ */
+export declare function isSteadyStateRegistrationOpen(policy: Omit<RegistrationPolicy, "needsSetup">): boolean;

package/dist/boot/driver.d.ts

@@ -1,7 +1,16 @@
 import type { BackendBootstrapper } from "@rebasepro/types";
 import type { ResolvedDataSourceConfig } from "./sources";
-/** The connection handle a driver hands back. */
-export interface DatabaseConnection {
+/**
+ * The connection handle a driver hands back at boot: the client object, the
+ * pool to close on shutdown, and how to probe it.
+ *
+ * Named `DatabaseConnection` until that collided with `DatabaseConnection` in
+ * `@rebasepro/types` — an abstract `{ type, isConnected, close() }` that
+ * `MongoDBConnection` implements. The two share no field, and both are public:
+ * one is re-exported from `@rebasepro/server`'s index, the other from
+ * `@rebasepro/types`, packages that are installed together.
+ */
+export interface DriverConnection {
     db: unknown;
     /**
      * Present for pool-based drivers. Closed during shutdown, and used to probe
@@ -31,7 +40,7 @@ export interface InitializedDataSource {
     engine: string;
     driverPackage: string;
     bootstrapper: BackendBootstrapper;
-    connection: DatabaseConnection;
+    connection: DriverConnection;
 }
 export interface BundleSchema {
     tables?: Record<string, unknown>;
@@ -55,3 +64,8 @@ export declare function initializeDataSource(source: ResolvedDataSourceConfig, s
  * order a human would expect.
  */
 export declare function initializeDataSources(sources: ResolvedDataSourceConfig[], schema: BundleSchema | undefined, resolveFrom?: string[]): Promise<InitializedDataSource[]>;
+/**
+ * @deprecated Use {@link DriverConnection}. This name collides with
+ * `DatabaseConnection` from `@rebasepro/types`, which is a different shape.
+ */
+export type DatabaseConnection = DriverConnection;

package/dist/boot/env.d.ts

@@ -78,11 +78,11 @@ declare const bootEnvExtension: z.ZodObject<{
     MICROSOFT_CLIENT_ID: z.ZodOptional<z.ZodString>;
     MICROSOFT_CLIENT_SECRET: z.ZodOptional<z.ZodString>;
     REBASE_BASE_PATH: z.ZodDefault<z.ZodString>;
-    REBASE_ENABLE_SWAGGER: z.ZodPipe<z.ZodDefault<z.ZodEnum<{
+    REBASE_ENABLE_SWAGGER: z.ZodPipe<z.ZodOptional<z.ZodEnum<{
         "": "";
         true: "true";
         false: "false";
-    }>>, z.ZodTransform<boolean, "" | "true" | "false">>;
+    }>>, z.ZodTransform<boolean | undefined, "" | "true" | "false" | undefined>>;
     REBASE_MAX_BODY_SIZE: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
     REBASE_COMPRESSION: z.ZodPipe<z.ZodDefault<z.ZodEnum<{
         "": "";
@@ -115,6 +115,20 @@ export declare function loadBootEnv(): RebaseBootEnv;
  */
 export declare function isLocalhostOrigin(origin: string): boolean;
 /** A CORS origin resolver of the shape Hono's `cors()` middleware expects. */
+/**
+ * Whether this process serves the OpenAPI docs.
+ *
+ * An explicit `REBASE_ENABLE_SWAGGER` wins in either direction. Left unset, the
+ * docs follow the environment: on in development, where they are part of how a
+ * scaffolded project is meant to be explored, and off in production, where the
+ * spec enumerates every collection and field to anyone who asks for it.
+ *
+ * Returning `undefined` for development is the point rather than an oversight —
+ * it hands the decision to the server's own policy in `init/docs.ts`, which also
+ * knows to withhold the Swagger UI while still serving the spec. Two defaults
+ * that can disagree about the same route is the bug this replaces.
+ */
+export declare function resolveEnableSwagger(env: RebaseBootEnv): boolean | undefined;
 export type CorsOriginResolver = (origin: string) => string | null;
 /**
  * Build the CORS origin policy.

package/dist/env.d.ts

@@ -22,6 +22,11 @@ declare const rebaseEnvSchema: z.ZodObject<{
         true: "true";
         false: "false";
     }>>, z.ZodTransform<boolean, "" | "true" | "false">>;
+    DISABLE_SELF_REGISTRATION: z.ZodPipe<z.ZodOptional<z.ZodEnum<{
+        "": "";
+        true: "true";
+        false: "false";
+    }>>, z.ZodTransform<boolean, "" | "true" | "false" | undefined>>;
     ALLOW_LOCALHOST_IN_PRODUCTION: z.ZodPipe<z.ZodOptional<z.ZodEnum<{
         "": "";
         true: "true";

package/dist/index.d.ts

@@ -48,7 +48,7 @@ export { resolveAuthOptions, resolveEmailOptions } from "./boot/options";
 export { envSuffixForKey, assertDistinctSuffixes, loadDeclaredStorageSources, resolveDataSources, resolveStorageSources, resolveStorageBackend } from "./boot/sources";
 export type { ResolvedDataSourceConfig, EnvBag } from "./boot/sources";
 export { initializeDataSource, initializeDataSources } from "./boot/driver";
-export type { InitializedDataSource, DatabaseConnection, BundleSchema } from "./boot/driver";
+export type { InitializedDataSource, DriverConnection, DatabaseConnection, BundleSchema } from "./boot/driver";
 export { MetricsRegistry, createMetricsMiddleware, createMetricsRoutes, classifySurface } from "./metrics";
 export type { MetricSurface, MetricsHandle } from "./metrics";
 export { createContractRoutes } from "./api/contract-routes";

package/dist/index.es.js

@@ -2,8 +2,8 @@ import { createRequire as __createRequire } from "module";
 import process from "process";
 __createRequire(import.meta.url);
 import { i as __toESM, n as __exportAll } from "./chunk-DSJWtz9O.js";
-import { C as EntityRelation, D as RebaseClientError, E as RebaseApiError, S as EntityReference, T as Vector, _ as ADMIN_PROPERTY_KEYS, a as findStorageSuffixCollision, c as DEFAULT_DATA_SOURCE_KEY, g as ADMIN_COLLECTION_KEYS, h as isPostgresCollectionConfig, i as DEFAULT_STORAGE_SOURCE_KEY, n as serializeCollections, o as normalizeStorageSources, p as getCollectionDataPath, r as SCHEMA_VERSION_HEADER, s as storageEnvSuffix, t as computeSchemaVersion, u as isSQLAdmin, w as GeoPoint, x as toCanonicalOp } from "./src-DzAgLF8X.js";
-import { _ as toSnakeCase, a as deserializeFilter, c as serializeLogicalCondition, d as CollectionRegistry, f as createDataSourceRegistry, g as buildCompositeId, h as resolveCollectionRelations, i as buildSdkData, l as collectAllPages, m as findRelation, n as serializeOrderBy, o as deserializeLogicalCondition, p as resolveDataSource, r as buildRoutedRebaseData, s as serializeFilter, t as deserializeOrderBy, u as paginateFind } from "./src-CyC3JXAq.js";
+import { C as EntityReference, D as RebaseApiError, E as Vector, O as RebaseClientError, S as toCanonicalOp, T as GeoPoint, _ as ADMIN_COLLECTION_KEYS, a as findStorageSuffixCollision, c as isSQLAdmin, d as getCollectionDataPath, h as DEFAULT_DATA_SOURCE_KEY, i as DEFAULT_STORAGE_SOURCE_KEY, n as serializeCollections, o as normalizeStorageSources, p as isPostgresCollectionConfig, r as SCHEMA_VERSION_HEADER, s as storageEnvSuffix, t as computeSchemaVersion, v as ADMIN_PROPERTY_KEYS, w as EntityRelation } from "./src-Ivjud8jD.js";
+import { _ as toSnakeCase, a as deserializeFilter, c as serializeLogicalCondition, d as CollectionRegistry, f as createDataSourceRegistry, g as buildCompositeId, h as resolveCollectionRelations, i as buildSdkData, l as collectAllPages, m as findRelation, n as serializeOrderBy, o as deserializeLogicalCondition, p as resolveDataSource, r as buildRoutedRebaseData, s as serializeFilter, t as deserializeOrderBy, u as paginateFind } from "./src-CoOAMnBh.js";
 import { t as logger } from "./logger-BYU66ENZ.js";
 import { a as generateRefreshToken, c as getRefreshTokenTtlMs, d as verifyAccessToken, f as verifyDownloadToken, i as generateDownloadToken, l as hashRefreshToken, n as configureJwt, o as getAccessTokenExpiry, p as require_jsonwebtoken, r as generateAccessToken, s as getRefreshTokenExpiry, t as MAX_COOKIE_AGE_MS } from "./jwt-D-eI6TTu.js";
 import { t as nativeDynamicImport } from "./dynamic-import-Dvh-K5fl.js";
@@ -7714,6 +7714,26 @@ function redactRefreshToken(response, c, refreshToken, config) {
 	};
 }
 //#endregion
+//#region src/auth/registration-policy.ts
+/** The full predicate, for callers that already know whether setup is needed. */
+function isRegistrationOpen(policy) {
+	if (policy.disableSelfRegistration) return false;
+	return policy.needsSetup || !!policy.allowRegistration;
+}
+/**
+* The same predicate with the bootstrap window assumed closed.
+*
+* Exists so `POST /auth/register` can reject the common case without counting
+* rows. A `false` here does **not** mean "refuse" — it means "the answer depends
+* on whether the table is empty, so now go and look".
+*/
+function isSteadyStateRegistrationOpen(policy) {
+	return isRegistrationOpen({
+		...policy,
+		needsSetup: false
+	});
+}
+//#endregion
 //#region src/auth/session-routes.ts
 function mountSessionRoutes(opts) {
 	const { router, config, ops, parseBody, buildAuthResponse, createSessionAndTokens, applyTransformHook } = opts;
@@ -7875,13 +7895,34 @@ function mountSessionRoutes(opts) {
 	});
 	/**
 	* GET /auth/config
-	* Get public auth configuration
+	* Get public auth configuration.
+	*
+	* ⚠️ SHADOWED on a backend booted through `initializeRebaseBackend`.
+	* `init.ts` registers `${basePath}/auth/config` directly and only mounts
+	* this router afterwards, so Hono resolves that registration first and this
+	* handler never runs. The live implementation is `getCapabilities()` in
+	* `builtin-auth-adapter.ts`.
+	*
+	* Both return `needsSetup` and `registrationEnabled`, so the response shape
+	* cannot tell them apart — which is how a fix for the empty-database dead
+	* end was once applied here, to no effect, while the live copy kept
+	* advertising the wrong answer. `bootstrap-e2e.test.ts` pins which handler
+	* actually answers.
+	*
+	* It is kept because this router is also mounted standalone (tests, and any
+	* embedder that wires `createAuthRoutes` without init.ts). If you change the
+	* registration rule, change it in `registration-policy.ts` — both callers
+	* read it from there, so neither can drift again.
 	*/
 	router.get("/config", defaultAuthLimiter, async (c) => {
 		let needsSetup;
 		if (config.isBootstrapCompleted) needsSetup = !await config.isBootstrapCompleted();
 		else needsSetup = (await authRepo.listUsers()).length === 0;
-		const registrationAllowed = needsSetup || !!config.allowRegistration;
+		const registrationAllowed = isRegistrationOpen({
+			disableSelfRegistration: config.disableSelfRegistration,
+			allowRegistration: config.allowRegistration,
+			needsSetup
+		});
 		const enabledProviders = (config.oauthProviders || []).map((p) => p.id);
 		return c.json({
 			needsSetup,
@@ -8121,13 +8162,22 @@ function createAuthRoutes(config) {
 		return !!(emailService && emailService.isConfigured());
 	}
 	/**
-	* Check if registration is allowed.
-	* Registration is only allowed when explicitly enabled via `allowRegistration`.
-	* First-user bootstrap must use POST /admin/bootstrap instead.
+	* Whether registration is open without consulting the user table.
+	*
+	* The rule lives in `registration-policy.ts` and is shared with both config
+	* endpoints, so what this route enforces and what they advertise cannot
+	* drift apart — which is exactly how the empty-database dead end happened.
+	*
+	* `false` here does not mean "refuse": it means the answer depends on
+	* whether the table is empty, which `POST /auth/register` checks only at
+	* that point, because it serves anonymous callers and a count per rejected
+	* attempt is a free hit on the database.
 	*/
 	function isRegistrationAllowed() {
-		if (config.disableSelfRegistration) return false;
-		return !!allowRegistration;
+		return isSteadyStateRegistrationOpen({
+			disableSelfRegistration: config.disableSelfRegistration,
+			allowRegistration
+		});
 	}
 	/**
 	* Send welcome email to a newly registered user (fire-and-forget).
@@ -8183,7 +8233,12 @@ function createAuthRoutes(config) {
 	router.post("/register", defaultAuthLimiter, async (c) => {
 		const { email, password, displayName } = parseBody(registerSchema, await c.req.json());
 		if (config.disableSelfRegistration) throw ApiError.forbidden("Registration is disabled", "REGISTRATION_DISABLED");
-		if (!isRegistrationAllowed()) throw ApiError.forbidden("Registration is disabled", "REGISTRATION_DISABLED");
+		let bootstrapRegistration = false;
+		if (!isRegistrationAllowed()) {
+			const { total } = await authRepo.listUsersPaginated({ limit: 1 });
+			bootstrapRegistration = total === 0;
+			if (!bootstrapRegistration) throw ApiError.forbidden("Registration is disabled", "REGISTRATION_DISABLED");
+		}
 		const passwordValidation = ops.validatePasswordStrength(password);
 		if (!passwordValidation.valid) throw ApiError.badRequest(passwordValidation.errors.join(". "), "WEAK_PASSWORD");
 		if (await authRepo.getUserByEmail(email)) throw ApiError.conflict("Email already registered", "EMAIL_EXISTS");
@@ -8196,7 +8251,12 @@ function createAuthRoutes(config) {
 		if (ops.beforeUserCreate) createData = await ops.beforeUserCreate(createData);
 		const user = await authRepo.createUser(createData);
 		const existingUsers = await authRepo.listUsers();
-		if (existingUsers.length === 1 && existingUsers[0].id === user.id) await authRepo.setUserRoles(user.id, ["admin"]);
+		const isFirstUser = existingUsers.length === 1 && existingUsers[0].id === user.id;
+		if (bootstrapRegistration && !isFirstUser) {
+			await authRepo.deleteUser(user.id);
+			throw ApiError.forbidden("Registration is disabled", "REGISTRATION_DISABLED");
+		}
+		if (isFirstUser) await authRepo.setUserRoles(user.id, ["admin"]);
 		else if (config.defaultRole) await authRepo.assignDefaultRole(user.id, config.defaultRole);
 		const { roleIds, accessToken, refreshToken } = await createSessionAndTokens(user.id, c.req.header("user-agent") || "unknown", c.req.header("x-forwarded-for") || "unknown");
 		sendWelcomeEmail({
@@ -8936,7 +8996,7 @@ function createAdminUsersRoute(config) {
 * when the user passes a plain `RebaseAuthConfig` object.
 */
 function createBuiltinAuthAdapter(config) {
-	const { authRepository, emailService, emailConfig, allowRegistration = false, allowUserLookup = false, defaultRole, oauthProviders = [], serviceKey, authHooks, collectionAuthConfig, enableMagicLink = false, cookieAuth } = config;
+	const { authRepository, emailService, emailConfig, allowRegistration = false, disableSelfRegistration = false, allowUserLookup = false, defaultRole, oauthProviders = [], serviceKey, authHooks, collectionAuthConfig, enableMagicLink = false, cookieAuth } = config;
 	const resolvedOps = resolveAuthHooks(authHooks);
 	return {
 		id: "rebase-builtin",
@@ -9009,6 +9069,7 @@ function createBuiltinAuthAdapter(config) {
 				emailService,
 				emailConfig,
 				allowRegistration,
+				disableSelfRegistration,
 				allowUserLookup,
 				defaultRole,
 				oauthProviders,
@@ -9078,11 +9139,16 @@ function createBuiltinAuthAdapter(config) {
 				needsSetup = (await authRepository.listUsersPaginated({ limit: 1 })).total === 0;
 			} catch {}
 			const enabledProviders = oauthProviders.map((p) => p.id);
+			const registrationAllowed = isRegistrationOpen({
+				disableSelfRegistration,
+				allowRegistration,
+				needsSetup
+			});
 			return {
 				hasBuiltInAuthRoutes: true,
 				emailPasswordLogin: true,
-				registration: allowRegistration || needsSetup,
-				registrationEnabled: allowRegistration || needsSetup,
+				registration: registrationAllowed,
+				registrationEnabled: registrationAllowed,
 				passwordReset: !!emailService?.isConfigured(),
 				adminPasswordReset: true,
 				sessionManagement: true,
@@ -12374,7 +12440,7 @@ function assertStorageAccessControlConfigured(state, isProduction) {
 //#region src/init/docs.ts
 async function mountOpenApiDocs(app, basePath, enableSwagger, activeCollections, requireAuth) {
 	if (enableSwagger === false || activeCollections.length === 0) return;
-	const { generateOpenApiSpec } = await import("./openapi-generator-DUocM036.js");
+	const { generateOpenApiSpec } = await import("./openapi-generator-Bjzmb5cn.js");
 	app.get(`${basePath}/docs`, (c) => {
 		const spec = generateOpenApiSpec(activeCollections, {
 			basePath,
@@ -18393,6 +18459,7 @@ async function _initializeRebaseBackend(config) {
 				emailService: authConfigResult.emailService,
 				emailConfig: safeAuthConfig.email,
 				allowRegistration: safeAuthConfig.allowRegistration ?? false,
+				disableSelfRegistration: safeAuthConfig.disableSelfRegistration ?? false,
 				allowUserLookup: safeAuthConfig.allowUserLookup ?? false,
 				defaultRole: safeAuthConfig.defaultRole,
 				oauthProviders,
@@ -18435,7 +18502,7 @@ async function _initializeRebaseBackend(config) {
 	if (schemaEditorEnabled && config.collectionsDir) {
 		let editorModule;
 		try {
-			editorModule = await import("./schema-editor-routes-CbKEoeiH.js");
+			editorModule = await import("./schema-editor-routes-DDxfOIid.js");
 		} catch (err) {
 			if (err?.code === "ERR_MODULE_NOT_FOUND") logger.warn("Schema Editor disabled: its dependency ts-morph is not installed. Run `npm install ts-morph@28.0.0` to enable it.");
 			else throw err;
@@ -19982,6 +20049,7 @@ var rebaseEnvSchema = object({
 	GOOGLE_CLIENT_SECRET: string().optional(),
 	REBASE_SERVICE_KEY: string().optional(),
 	ALLOW_REGISTRATION: boolString,
+	DISABLE_SELF_REGISTRATION: optionalBoolString,
 	ALLOW_LOCALHOST_IN_PRODUCTION: optionalBoolString,
 	CORS_ORIGINS: string().optional(),
 	FRONTEND_URL: string().optional(),
@@ -20727,11 +20795,27 @@ var bootEnvExtension = object({
 	MICROSOFT_CLIENT_ID: string().optional(),
 	MICROSOFT_CLIENT_SECRET: string().optional(),
 	REBASE_BASE_PATH: string().default("/api"),
+	/**
+	* The OpenAPI surface: `/api/docs` (the spec) and `/api/swagger` (the UI).
+	*
+	* Deliberately tri-state, and resolved against NODE_ENV by
+	* {@link resolveEnableSwagger} rather than defaulted here. Unset means "on
+	* in development, off in production" — an explicit `true` or `false` always
+	* wins in both.
+	*
+	* It used to default to `"false"` outright, which reads as a safe default
+	* and was not one: the runtime is how every scaffolded project boots, so
+	* the docs disappeared from projects that never asked for that. `rebase
+	* init` prints "docs are at /api/swagger" on completion, the headless
+	* README repeats it, and the console's API Explorer fetches `/api/docs` —
+	* all three 404'd against a project running the runtime, and the baas e2e
+	* failed on exactly that.
+	*/
 	REBASE_ENABLE_SWAGGER: _enum([
 		"true",
 		"false",
 		""
-	]).default("false").transform((v) => v === "true"),
+	]).optional().transform((v) => v === void 0 || v === "" ? void 0 : v === "true"),
 	/**
 	* Maximum request body size, in **bytes**.
 	*
@@ -20791,6 +20875,24 @@ function isLocalhostOrigin(origin) {
 		return false;
 	}
 }
+/** A CORS origin resolver of the shape Hono's `cors()` middleware expects. */
+/**
+* Whether this process serves the OpenAPI docs.
+*
+* An explicit `REBASE_ENABLE_SWAGGER` wins in either direction. Left unset, the
+* docs follow the environment: on in development, where they are part of how a
+* scaffolded project is meant to be explored, and off in production, where the
+* spec enumerates every collection and field to anyone who asks for it.
+*
+* Returning `undefined` for development is the point rather than an oversight —
+* it hands the decision to the server's own policy in `init/docs.ts`, which also
+* knows to withhold the Swagger UI while still serving the spec. Two defaults
+* that can disagree about the same route is the bug this replaces.
+*/
+function resolveEnableSwagger(env) {
+	if (env.REBASE_ENABLE_SWAGGER !== void 0) return env.REBASE_ENABLE_SWAGGER;
+	return env.NODE_ENV === "production" ? false : void 0;
+}
 /**
 * Build the CORS origin policy.
 *
@@ -21241,6 +21343,7 @@ function resolveAuthOptions(env, usersCollection) {
 		serviceKey: env.REBASE_SERVICE_KEY,
 		requireAuth: env.AUTH_REQUIRE,
 		allowRegistration: env.ALLOW_REGISTRATION,
+		disableSelfRegistration: env.DISABLE_SELF_REGISTRATION,
 		allowUserLookup: env.AUTH_ALLOW_USER_LOOKUP,
 		email: resolveEmailOptions(env),
 		cookieAuth: { sameSite: env.AUTH_COOKIE_SAME_SITE || "Lax" }
@@ -21578,7 +21681,7 @@ async function bootFromBundle(options = {}) {
 		callbacks: configExports.callbacks,
 		auth: resolveAuthOptions(env, usersCollection),
 		history: env.REBASE_HISTORY,
-		enableSwagger: env.REBASE_ENABLE_SWAGGER,
+		enableSwagger: resolveEnableSwagger(env),
 		compression: env.REBASE_COMPRESSION,
 		maxBodySize: env.REBASE_MAX_BODY_SIZE,
 		logging: env.LOG_LEVEL ? { level: env.LOG_LEVEL } : void 0,