@rebasepro/server 0.11.1-canary.gfd39654 → 0.12.0

package/dist/index.es.js

@@ -2,8 +2,8 @@ import { createRequire as __createRequire } from "module";
 import process from "process";
 __createRequire(import.meta.url);
 import { i as __toESM, n as __exportAll } from "./chunk-DSJWtz9O.js";
-import { C as RebaseClientError, S as RebaseApiError, _ as toCanonicalOp, a as DEFAULT_DATA_SOURCE_KEY, b as GeoPoint, f as isPostgresCollectionConfig, i as DEFAULT_STORAGE_SOURCE_KEY, n as serializeCollections, r as SCHEMA_VERSION_HEADER, s as isSQLAdmin, t as computeSchemaVersion, u as getCollectionDataPath, v as EntityReference, x as Vector, y as EntityRelation } from "./src-BYbxB4PR.js";
-import { a as deserializeFilter, c as serializeLogicalCondition, d as resolveDataSource, f as findRelation, h as toSnakeCase, i as buildSdkData, l as CollectionRegistry, m as buildCompositeId, n as serializeOrderBy, o as deserializeLogicalCondition, p as resolveCollectionRelations, r as buildRoutedRebaseData, s as serializeFilter, t as deserializeOrderBy, u as createDataSourceRegistry } from "./src-q6_elgGZ.js";
+import { C as EntityReference, D as RebaseApiError, E as Vector, O as RebaseClientError, S as toCanonicalOp, T as GeoPoint, _ as ADMIN_COLLECTION_KEYS, a as findStorageSuffixCollision, c as isSQLAdmin, d as getCollectionDataPath, h as DEFAULT_DATA_SOURCE_KEY, i as DEFAULT_STORAGE_SOURCE_KEY, n as serializeCollections, o as normalizeStorageSources, p as isPostgresCollectionConfig, r as SCHEMA_VERSION_HEADER, s as storageEnvSuffix, t as computeSchemaVersion, v as ADMIN_PROPERTY_KEYS, w as EntityRelation } from "./src-Ivjud8jD.js";
+import { _ as toSnakeCase, a as deserializeFilter, c as serializeLogicalCondition, d as CollectionRegistry, f as createDataSourceRegistry, g as buildCompositeId, h as resolveCollectionRelations, i as buildSdkData, l as collectAllPages, m as findRelation, n as serializeOrderBy, o as deserializeLogicalCondition, p as resolveDataSource, r as buildRoutedRebaseData, s as serializeFilter, t as deserializeOrderBy, u as paginateFind } from "./src-CoOAMnBh.js";
 import { t as logger } from "./logger-BYU66ENZ.js";
 import { a as generateRefreshToken, c as getRefreshTokenTtlMs, d as verifyAccessToken, f as verifyDownloadToken, i as generateDownloadToken, l as hashRefreshToken, n as configureJwt, o as getAccessTokenExpiry, p as require_jsonwebtoken, r as generateAccessToken, s as getRefreshTokenExpiry, t as MAX_COOKIE_AGE_MS } from "./jwt-D-eI6TTu.js";
 import { t as nativeDynamicImport } from "./dynamic-import-Dvh-K5fl.js";
@@ -93,6 +93,359 @@ var BackendCollectionRegistry = class extends CollectionRegistry {
 	}
 };
 //#endregion
+//#region src/collections/validate-config.ts
+/**
+* Read the unknown-key policy from the environment.
+*
+* `REBASE_STRICT_COLLECTION_CONFIG` accepts `error`/`strict`/`1`/`true` to
+* escalate, `off`/`0`/`false` to silence, and anything else warns.
+*/
+function unknownKeyPolicyFromEnv(env = process.env) {
+	const raw = env.REBASE_STRICT_COLLECTION_CONFIG?.trim().toLowerCase();
+	if (!raw) return "warn";
+	if ([
+		"error",
+		"strict",
+		"1",
+		"true",
+		"yes"
+	].includes(raw)) return "error";
+	if ([
+		"off",
+		"0",
+		"false",
+		"no",
+		"none"
+	].includes(raw)) return "off";
+	return "warn";
+}
+/** `BaseCollectionConfig`, plus every engine-specific field, plus the `admin` block. */
+var COLLECTION_KEYS = new Set([
+	"slug",
+	"name",
+	"singularName",
+	"description",
+	"childCollections",
+	"dataSource",
+	"engine",
+	"databaseId",
+	"properties",
+	"auth",
+	"disableDefaultPolicies",
+	"callbacks",
+	"ownerId",
+	"metadata",
+	"history",
+	"strictWrites",
+	"table",
+	"relations",
+	"securityRules",
+	"schema",
+	"path",
+	"subcollections",
+	"admin"
+]);
+/** `BaseProperty` — legal on a property of any type. */
+var BASE_PROPERTY_KEYS = [
+	"type",
+	"name",
+	"description",
+	"propertyConfig",
+	"columnName",
+	"defaultValue",
+	"validation",
+	"excludeFromApi",
+	"dynamicProps",
+	"conditions",
+	"callbacks",
+	"metadata",
+	"admin"
+];
+/** The keys each property `type` adds on top of {@link BASE_PROPERTY_KEYS}. */
+var PROPERTY_KEYS_BY_TYPE = {
+	string: [
+		"columnType",
+		"isId",
+		"enum",
+		"storage",
+		"userSelect",
+		"email",
+		"url"
+	],
+	number: [
+		"columnType",
+		"isId",
+		"enum"
+	],
+	boolean: [],
+	date: [
+		"columnType",
+		"mode",
+		"timezone",
+		"autoValue"
+	],
+	geopoint: [],
+	binary: [],
+	vector: ["dimensions"],
+	reference: [
+		"isId",
+		"path",
+		"fixedFilter",
+		"includeId",
+		"includeEntityLink"
+	],
+	relation: [
+		"isId",
+		"relation",
+		"resolvedRelation",
+		"fixedFilter",
+		"includeId",
+		"includeEntityLink",
+		"widget"
+	],
+	array: [
+		"columnType",
+		"of",
+		"oneOf",
+		"sortable",
+		"canAddElements"
+	],
+	map: [
+		"columnType",
+		"properties",
+		"propertiesOrder",
+		"previewProperties",
+		"keyValue"
+	]
+};
+var PROPERTY_TYPES = Object.keys(PROPERTY_KEYS_BY_TYPE);
+/** `RelationBase` plus the fields of every `kind` in the tagged union. */
+var RELATION_KEYS = new Set([
+	"kind",
+	"relationName",
+	"target",
+	"onUpdate",
+	"onDelete",
+	"overrides",
+	"validation",
+	"localKey",
+	"foreignKeyOnTarget",
+	"through",
+	"joinPath",
+	"cardinality"
+]);
+var RELATION_KINDS = [
+	"belongsTo",
+	"hasOne",
+	"hasMany",
+	"manyToMany",
+	"via"
+];
+/** Which link field each `kind` admits. Anything else is a leftover shape. */
+var RELATION_FIELDS_BY_KIND = {
+	belongsTo: ["localKey"],
+	hasOne: ["foreignKeyOnTarget"],
+	hasMany: ["foreignKeyOnTarget"],
+	manyToMany: ["through"],
+	via: ["joinPath", "cardinality"]
+};
+var RELATION_LINK_FIELDS = [
+	"localKey",
+	"foreignKeyOnTarget",
+	"through",
+	"joinPath",
+	"cardinality"
+];
+/** Collection-level keys that no longer exist at the top level. */
+var COLLECTION_MIGRATIONS = { editable: { fix: "`editable` was removed in 0.10 — collections are editable by default. Delete it, or use `admin.disableDefaultActions` to take actions away" } };
+for (const key of ADMIN_COLLECTION_KEYS) COLLECTION_MIGRATIONS[key] = {
+	fix: `\`${key}\` moved into the collection's \`admin\` block in 0.11 — write \`admin: { ${key}: … }\``,
+	codemod: "node scripts/codemod/collections-admin-block.mjs"
+};
+/** Property-level keys that no longer exist at the top level of a property. */
+var PROPERTY_MIGRATIONS = {
+	ui: { fix: "`ui` was renamed to `admin` in 0.11, to match the collection's block — rename the key" },
+	editable: { fix: "`editable` was removed in 0.10 — properties are editable by default. Use `admin.readOnly` or `admin.disabled` instead" }
+};
+for (const key of ADMIN_PROPERTY_KEYS) PROPERTY_MIGRATIONS[key] = { fix: `\`${key}\` belongs in the property's \`admin\` block — write \`admin: { ${key}: … }\`` };
+/**
+* The flat relation fields that `RelationProperty` used to carry.
+*
+* All of them moved into the nested `relation` object. Two of them do not
+* survive the move at all: `direction` and `inverseRelationName` were how the
+* old shape said which side owned the link, and the `kind` discriminant says it
+* now.
+*/
+var RELATION_PROPERTY_MIGRATIONS = {
+	target: { fix: "move `target` inside `relation` — `relation: { kind: …, target: … }`" },
+	cardinality: { fix: "`cardinality` is implied by the relation's `kind` (`belongsTo`/`hasOne` are one, `hasMany`/`manyToMany` are many); it survives only on `relation: { kind: \"via\" }`" },
+	direction: { fix: "`direction` was removed — the `kind` says which side owns the link. `owning` + one is `belongsTo`, `inverse` + one is `hasOne`, `inverse` + many is `hasMany`, `owning` + many is `manyToMany`" },
+	inverseRelationName: { fix: "`inverseRelationName` was removed — name the far side with `relation: { kind: \"hasMany\", foreignKeyOnTarget: … }` instead of pointing at it" },
+	localKey: { fix: "move `localKey` inside `relation` — `relation: { kind: \"belongsTo\", localKey: … }`" },
+	foreignKeyOnTarget: { fix: "move `foreignKeyOnTarget` inside `relation` — `relation: { kind: \"hasOne\" | \"hasMany\", foreignKeyOnTarget: … }`" },
+	through: { fix: "move `through` inside `relation` — `relation: { kind: \"manyToMany\", through: … }`" },
+	joinPath: { fix: "move `joinPath` inside `relation` — `relation: { kind: \"via\", joinPath: … }`" },
+	onUpdate: { fix: "move `onUpdate` inside `relation`" },
+	onDelete: { fix: "move `onDelete` inside `relation`" },
+	overrides: { fix: "move `overrides` inside `relation`" },
+	relationName: { fix: "move `relationName` inside `relation` — `relation: { kind: …, relationName: … }`" }
+};
+var RELATION_UNION_CODEMOD = "node scripts/codemod/relations-tagged-union.mjs";
+/** Fields the old flat `Relation` carried that the tagged union does not. */
+var RELATION_MIGRATIONS = {
+	direction: {
+		fix: RELATION_PROPERTY_MIGRATIONS.direction.fix,
+		codemod: RELATION_UNION_CODEMOD
+	},
+	inverseRelationName: {
+		fix: RELATION_PROPERTY_MIGRATIONS.inverseRelationName.fix,
+		codemod: RELATION_UNION_CODEMOD
+	}
+};
+function isPlainObject$2(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+var ProblemCollector = class {
+	unknownKeys;
+	problems = [];
+	constructor(unknownKeys) {
+		this.unknownKeys = unknownKeys;
+	}
+	error(path, message) {
+		this.problems.push({
+			severity: "error",
+			path,
+			message
+		});
+	}
+	/** A key we know moved or died. Always fatal — we know exactly what to do. */
+	migrated(path, key, migration) {
+		this.error(path, `\`${key}\` is no longer read here. ${migration.fix}.` + (migration.codemod ? ` Run \`${migration.codemod}\` to migrate the whole project.` : ""));
+	}
+	/** A key nobody recognises. Might be metadata, might be newer than us. */
+	unknown(path, key, context) {
+		if (this.unknownKeys === "off") return;
+		this.problems.push({
+			severity: this.unknownKeys === "error" ? "error" : "warning",
+			path,
+			message: `\`${key}\` is not a known ${context} key and is being ignored. If it is deliberate metadata this is safe; if it is a typo or a key from an older version, the feature it configures is silently absent.`
+		});
+	}
+};
+function checkRelation(relation, path, collect) {
+	if (!isPlainObject$2(relation)) return;
+	const kind = relation.kind;
+	if (typeof kind !== "string") collect.error(path, `a relation has no \`kind\`. Relations became a tagged union in 0.11 — pick one of ${RELATION_KINDS.join(", ")}. Run \`${RELATION_UNION_CODEMOD}\` to migrate the whole project.`);
+	else if (!RELATION_KINDS.includes(kind)) collect.error(path, `\`kind: "${kind}"\` is not a relation kind. Expected one of ${RELATION_KINDS.join(", ")}.`);
+	for (const key of Object.keys(relation)) {
+		const migration = RELATION_MIGRATIONS[key];
+		if (migration) {
+			collect.migrated(`${path}.${key}`, key, migration);
+			continue;
+		}
+		if (!RELATION_KEYS.has(key)) collect.unknown(`${path}.${key}`, key, "relation");
+	}
+	if (typeof kind === "string" && RELATION_FIELDS_BY_KIND[kind]) {
+		const allowed = RELATION_FIELDS_BY_KIND[kind];
+		for (const field of RELATION_LINK_FIELDS) if (relation[field] !== void 0 && !allowed.includes(field)) collect.error(`${path}.${field}`, `\`${field}\` is not valid on a "${kind}" relation. A "${kind}" takes ${allowed.length ? allowed.map((a) => `\`${a}\``).join(" and ") : "no link field"}.`);
+	}
+}
+function checkProperty(property, path, collect) {
+	if (typeof property === "function") return;
+	if (!isPlainObject$2(property)) {
+		collect.error(path, "a property must be an object.");
+		return;
+	}
+	const type = property.type;
+	if (typeof type !== "string") collect.error(path, "a property has no `type`.");
+	else if (!PROPERTY_TYPES.includes(type)) collect.error(path, `\`type: "${type}"\` is not a property type. Expected one of ${PROPERTY_TYPES.join(", ")}.`);
+	const allowed = new Set([...BASE_PROPERTY_KEYS, ...typeof type === "string" ? PROPERTY_KEYS_BY_TYPE[type] ?? [] : []]);
+	for (const key of Object.keys(property)) {
+		if (allowed.has(key)) continue;
+		if (type === "relation" && RELATION_PROPERTY_MIGRATIONS[key]) {
+			collect.migrated(`${path}.${key}`, key, {
+				...RELATION_PROPERTY_MIGRATIONS[key],
+				codemod: RELATION_UNION_CODEMOD
+			});
+			continue;
+		}
+		const migration = PROPERTY_MIGRATIONS[key];
+		if (migration) {
+			collect.migrated(`${path}.${key}`, key, migration);
+			continue;
+		}
+		collect.unknown(`${path}.${key}`, key, `property (\`${String(type)}\`)`);
+	}
+	if (type === "relation" && property.relation !== void 0) checkRelation(property.relation, `${path}.relation`, collect);
+	if (type === "array") {
+		const of = property.of;
+		if (Array.isArray(of)) of.forEach((entry, index) => checkProperty(entry, `${path}.of[${index}]`, collect));
+		else if (of !== void 0) checkProperty(of, `${path}.of`, collect);
+		const oneOf = property.oneOf;
+		if (isPlainObject$2(oneOf) && isPlainObject$2(oneOf.properties)) checkProperties(oneOf.properties, `${path}.oneOf.properties`, collect);
+	}
+	if (type === "map" && isPlainObject$2(property.properties)) checkProperties(property.properties, `${path}.properties`, collect);
+}
+function checkProperties(properties, path, collect) {
+	for (const [key, property] of Object.entries(properties)) checkProperty(property, `${path}.${key}`, collect);
+}
+function checkCollection(collection, index, collect) {
+	if (!isPlainObject$2(collection)) {
+		collect.error(`collection[${index}]`, "a collection must be an object.");
+		return;
+	}
+	const slug = typeof collection.slug === "string" && collection.slug ? collection.slug : void 0;
+	const at = slug ?? `collection[${index}]`;
+	if (!slug) collect.error(at, "a collection has no `slug`. It is the collection's identity — the URL, the API path and the key every relation targets.");
+	for (const key of Object.keys(collection)) {
+		if (COLLECTION_KEYS.has(key)) continue;
+		const migration = COLLECTION_MIGRATIONS[key];
+		if (migration) {
+			collect.migrated(`${at}.${key}`, key, migration);
+			continue;
+		}
+		collect.unknown(`${at}.${key}`, key, "collection");
+	}
+	if (isPlainObject$2(collection.properties)) checkProperties(collection.properties, `${at}.properties`, collect);
+	else if (collection.properties !== void 0) collect.error(`${at}.properties`, "`properties` must be an object keyed by property name.");
+	if (Array.isArray(collection.relations)) collection.relations.forEach((relation, i) => {
+		checkRelation(relation, `${at}.relations[${isPlainObject$2(relation) && typeof relation.relationName === "string" ? relation.relationName : String(i)}]`, collect);
+	});
+}
+/**
+* Every problem across every collection, in one pass.
+*
+* Pure: it logs nothing and throws nothing, so callers that want to render the
+* list themselves (the doctor, a test) can.
+*/
+function findCollectionConfigProblems(collections, options = {}) {
+	const collect = new ProblemCollector(options.unknownKeys ?? unknownKeyPolicyFromEnv());
+	collections.forEach((collection, index) => checkCollection(collection, index, collect));
+	return collect.problems;
+}
+function render(problems) {
+	return problems.map((p) => `  • ${p.path}\n      ${p.message}`).join("\n\n");
+}
+/**
+* Warn about everything questionable, then refuse to boot if anything is wrong.
+*
+* Warnings are logged even when there are errors: someone migrating wants the
+* whole picture in one run, and the second-most annoying thing after a broken
+* boot is a boot that breaks again on something it could have told you the
+* first time.
+*/
+function assertCollectionConfigs(collections, options = {}) {
+	const problems = findCollectionConfigProblems(collections, options);
+	if (problems.length === 0) return;
+	const warnings = problems.filter((p) => p.severity === "warning");
+	const errors = problems.filter((p) => p.severity === "error");
+	if (warnings.length > 0) logger.warn(`[collections] ${warnings.length} unrecognised key(s) in the collection config, ignored:\n\n` + render(warnings) + "\n\nSet REBASE_STRICT_COLLECTION_CONFIG=error to make these fail the boot.\n");
+	if (errors.length === 0) return;
+	throw new Error(`${errors.length} problem(s) in the collection config.\n\nThese keys are not read by this version. Nothing would have failed at runtime — whatever they configure would simply be absent — so they are fatal at boot instead.
+
+` + render(errors) + "\n");
+}
+//#endregion
 //#region src/collections/loader.ts
 function isCollectionFile(file) {
 	return (file.endsWith(".ts") || file.endsWith(".js")) && !file.startsWith(".") && !file.includes(".test.") && !file.endsWith(".d.ts") && file !== "index.ts" && file !== "index.js";
@@ -132,16 +485,27 @@ function applyCollectionDefaults(collections, defaults) {
 * configuration error, and continuing produces the worst outcome available: an
 * API missing a route, or a policy file missing a table, with a successful exit
 * code. Both read as "no data" rather than as a failure.
-*/
-async function loadCollectionsFromDirectory(source) {
+*
+* Every collection is strict-parsed on the way out — see `validate-config` for
+* why a key that moved is fatal and a key nobody recognises only warns. It
+* happens here, at the one definition of "the collections", so the runtime, the
+* schema generator, the policy generator and the doctor all see the same
+* verdict rather than three of them silently accepting a config the fourth
+* rejects.
+*/
+async function loadCollectionsFromDirectory(source, options = {}) {
 	const resolved = path$1.resolve(source);
+	const validate = (collections) => {
+		if (options.validate !== false) assertCollectionConfigs(collections, options.validate ?? {});
+		return collections;
+	};
 	if (!fs$2.existsSync(resolved)) {
 		logger.warn(`[collections] Not found: ${resolved}`);
 		return [];
 	}
 	if (!fs$2.statSync(resolved).isDirectory()) {
 		const mod = await importModule(resolved);
-		return applyCollectionDefaults([...mod.backendCollections || mod.collections || []], { defaultSecurityRules: mod.defaultSecurityRules });
+		return validate(applyCollectionDefaults([...mod.backendCollections || mod.collections || []], { defaultSecurityRules: mod.defaultSecurityRules }));
 	}
 	const collections = [];
 	const failures = [];
@@ -153,7 +517,7 @@ async function loadCollectionsFromDirectory(source) {
 		failures.push(`${file}: ${err instanceof Error ? err.message : String(err)}`);
 	}
 	if (failures.length > 0) throw new Error(`Could not load ${failures.length} collection file(s) from ${resolved}:\n` + failures.map((f) => `  • ${f}`).join("\n") + "\n\nEvery collection file must import cleanly and default-export a collection.");
-	return applyCollectionDefaults(collections, await readDefaults(resolved));
+	return validate(applyCollectionDefaults(collections, await readDefaults(resolved)));
 }
 //#endregion
 //#region src/services/driver-registry.ts
@@ -528,6 +892,33 @@ function parseLogicalGroup(type, raw) {
 	return "type" in parsed ? parsed : void 0;
 }
 /**
+* Parse the `?where=` JSON filter object.
+*
+* This is the dialect the OpenAPI document publishes on every
+* `GET /api/data/{slug}` — `{"status":["==","active"]}`: field → canonical
+* `[WhereFilterOp, value]` tuple. It is normalized through the same
+* `deserializeFilter` as the `?field=op.value` params below, so a value that
+* arrives as a PostgREST dot-string (`{"status":"eq.active"}`) or as a bare
+* scalar (`{"status":"active"}`) compiles to the same condition. Unlike the
+* querystring dialect, JSON carries types — a number stays a number.
+*
+* A malformed value is a 400 rather than a silent drop: dropping the filter
+* would run the read unfiltered and return everything RLS happens to allow.
+*/
+function parseWhereParam(raw) {
+	const str = String(raw).trim();
+	if (!str) return void 0;
+	let parsed;
+	try {
+		parsed = JSON.parse(str);
+	} catch {
+		throw ApiError.badRequest("Invalid `where` parameter: expected a JSON object, e.g. {\"status\":[\"==\",\"active\"]}", "INVALID_WHERE");
+	}
+	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw ApiError.badRequest("Invalid `where` parameter: expected a JSON object mapping fields to conditions, e.g. {\"status\":[\"==\",\"active\"]}", "INVALID_WHERE");
+	const filter = deserializeFilter(parsed);
+	return Object.keys(filter).length > 0 ? filter : void 0;
+}
+/**
 * Parse query parameters into QueryOptions
 */
 function parseQueryOptions(query, limits = {}) {
@@ -566,14 +957,19 @@ function parseQueryOptions(query, limits = {}) {
 		"vector_distance",
 		"vector_threshold",
 		"or",
-		"and"
+		"and",
+		"where"
 	];
 	const filterDict = {};
 	for (const [key, rawValue] of Object.entries(query)) {
 		if (reservedQueryKeys.includes(key)) continue;
 		filterDict[key] = rawValue;
 	}
-	const where = deserializeFilter(filterDict);
+	const whereVal = getLastValue(query.where);
+	const where = {
+		...whereVal !== void 0 && whereVal !== null ? parseWhereParam(whereVal) : void 0,
+		...deserializeFilter(filterDict)
+	};
 	if (Object.keys(where).length > 0) options.where = where;
 	const orderByVal = getLastValue(query.orderBy);
 	if (orderByVal) try {
@@ -599,16 +995,17 @@ function parseQueryOptions(query, limits = {}) {
 	const vectorVal = getLastValue(query.vector);
 	if (vectorSearchVal && vectorVal) {
 		const vectorStr = String(vectorVal);
-		let queryVector;
+		let decoded;
 		try {
-			queryVector = JSON.parse(vectorStr);
-			if (!Array.isArray(queryVector) || !queryVector.every((v) => typeof v === "number")) throw new Error("Expected array of numbers");
+			decoded = JSON.parse(vectorStr);
 		} catch {
-			throw new Error("Invalid vector format. Expected JSON array of numbers, e.g. [0.1,0.2,0.3]");
+			decoded = void 0;
 		}
+		if (!Array.isArray(decoded) || !decoded.every((v) => typeof v === "number")) throw ApiError.badRequest("Invalid `vector` format. Expected a JSON array of numbers, e.g. [0.1,0.2,0.3]", "INVALID_VECTOR");
+		const queryVector = decoded;
 		const distanceParamVal = getLastValue(query.vector_distance);
 		const distanceParam = distanceParamVal ? String(distanceParamVal) : "cosine";
-		if (distanceParam !== "cosine" && distanceParam !== "l2" && distanceParam !== "inner_product") throw new Error(`Invalid vector_distance: ${distanceParam}. Expected: cosine, l2, or inner_product`);
+		if (distanceParam !== "cosine" && distanceParam !== "l2" && distanceParam !== "inner_product") throw ApiError.badRequest(`Invalid \`vector_distance\`: ${distanceParam}. Expected: cosine, l2, or inner_product`, "INVALID_VECTOR_DISTANCE");
 		const vectorSearch = {
 			property: String(vectorSearchVal),
 			vector: queryVector,
@@ -617,7 +1014,7 @@ function parseQueryOptions(query, limits = {}) {
 		const thresholdVal = getLastValue(query.vector_threshold);
 		if (thresholdVal) {
 			const threshold = parseFloat(String(thresholdVal));
-			if (isNaN(threshold)) throw new Error("Invalid vector_threshold. Expected a number.");
+			if (isNaN(threshold)) throw ApiError.badRequest("Invalid `vector_threshold`. Expected a number.", "INVALID_VECTOR_THRESHOLD");
 			vectorSearch.threshold = threshold;
 		}
 		options.vectorSearch = vectorSearch;
@@ -765,7 +1162,14 @@ var TABLE$2 = "\"rebase\".\"idempotency_keys\"";
 * by a scheduled job — there is no cron guaranteed to be running.
 */
 var TTL_HOURS = 24;
-/** The principal a key belongs to; anonymous and service writes share a sentinel. */
+/**
+* The principal a key belongs to; anonymous and service writes share a sentinel.
+*
+* The NUL is written as an escape, not as a raw byte in the source. The
+* sentinel itself is deliberate — a uid can never contain one — but written
+* literally it makes this file test as binary, and every repo-wide grep then
+* skips all 124 lines of it silently. Identical at runtime.
+*/
 function principal(uid) {
 	return uid && uid.length > 0 ? uid : "\0anon";
 }
@@ -7310,6 +7714,26 @@ function redactRefreshToken(response, c, refreshToken, config) {
 	};
 }
 //#endregion
+//#region src/auth/registration-policy.ts
+/** The full predicate, for callers that already know whether setup is needed. */
+function isRegistrationOpen(policy) {
+	if (policy.disableSelfRegistration) return false;
+	return policy.needsSetup || !!policy.allowRegistration;
+}
+/**
+* The same predicate with the bootstrap window assumed closed.
+*
+* Exists so `POST /auth/register` can reject the common case without counting
+* rows. A `false` here does **not** mean "refuse" — it means "the answer depends
+* on whether the table is empty, so now go and look".
+*/
+function isSteadyStateRegistrationOpen(policy) {
+	return isRegistrationOpen({
+		...policy,
+		needsSetup: false
+	});
+}
+//#endregion
 //#region src/auth/session-routes.ts
 function mountSessionRoutes(opts) {
 	const { router, config, ops, parseBody, buildAuthResponse, createSessionAndTokens, applyTransformHook } = opts;
@@ -7471,13 +7895,34 @@ function mountSessionRoutes(opts) {
 	});
 	/**
 	* GET /auth/config
-	* Get public auth configuration
+	* Get public auth configuration.
+	*
+	* ⚠️ SHADOWED on a backend booted through `initializeRebaseBackend`.
+	* `init.ts` registers `${basePath}/auth/config` directly and only mounts
+	* this router afterwards, so Hono resolves that registration first and this
+	* handler never runs. The live implementation is `getCapabilities()` in
+	* `builtin-auth-adapter.ts`.
+	*
+	* Both return `needsSetup` and `registrationEnabled`, so the response shape
+	* cannot tell them apart — which is how a fix for the empty-database dead
+	* end was once applied here, to no effect, while the live copy kept
+	* advertising the wrong answer. `bootstrap-e2e.test.ts` pins which handler
+	* actually answers.
+	*
+	* It is kept because this router is also mounted standalone (tests, and any
+	* embedder that wires `createAuthRoutes` without init.ts). If you change the
+	* registration rule, change it in `registration-policy.ts` — both callers
+	* read it from there, so neither can drift again.
 	*/
 	router.get("/config", defaultAuthLimiter, async (c) => {
 		let needsSetup;
 		if (config.isBootstrapCompleted) needsSetup = !await config.isBootstrapCompleted();
 		else needsSetup = (await authRepo.listUsers()).length === 0;
-		const registrationAllowed = needsSetup || !!config.allowRegistration;
+		const registrationAllowed = isRegistrationOpen({
+			disableSelfRegistration: config.disableSelfRegistration,
+			allowRegistration: config.allowRegistration,
+			needsSetup
+		});
 		const enabledProviders = (config.oauthProviders || []).map((p) => p.id);
 		return c.json({
 			needsSetup,
@@ -7717,13 +8162,22 @@ function createAuthRoutes(config) {
 		return !!(emailService && emailService.isConfigured());
 	}
 	/**
-	* Check if registration is allowed.
-	* Registration is only allowed when explicitly enabled via `allowRegistration`.
-	* First-user bootstrap must use POST /admin/bootstrap instead.
+	* Whether registration is open without consulting the user table.
+	*
+	* The rule lives in `registration-policy.ts` and is shared with both config
+	* endpoints, so what this route enforces and what they advertise cannot
+	* drift apart — which is exactly how the empty-database dead end happened.
+	*
+	* `false` here does not mean "refuse": it means the answer depends on
+	* whether the table is empty, which `POST /auth/register` checks only at
+	* that point, because it serves anonymous callers and a count per rejected
+	* attempt is a free hit on the database.
 	*/
 	function isRegistrationAllowed() {
-		if (config.disableSelfRegistration) return false;
-		return !!allowRegistration;
+		return isSteadyStateRegistrationOpen({
+			disableSelfRegistration: config.disableSelfRegistration,
+			allowRegistration
+		});
 	}
 	/**
 	* Send welcome email to a newly registered user (fire-and-forget).
@@ -7779,7 +8233,12 @@ function createAuthRoutes(config) {
 	router.post("/register", defaultAuthLimiter, async (c) => {
 		const { email, password, displayName } = parseBody(registerSchema, await c.req.json());
 		if (config.disableSelfRegistration) throw ApiError.forbidden("Registration is disabled", "REGISTRATION_DISABLED");
-		if (!isRegistrationAllowed()) throw ApiError.forbidden("Registration is disabled", "REGISTRATION_DISABLED");
+		let bootstrapRegistration = false;
+		if (!isRegistrationAllowed()) {
+			const { total } = await authRepo.listUsersPaginated({ limit: 1 });
+			bootstrapRegistration = total === 0;
+			if (!bootstrapRegistration) throw ApiError.forbidden("Registration is disabled", "REGISTRATION_DISABLED");
+		}
 		const passwordValidation = ops.validatePasswordStrength(password);
 		if (!passwordValidation.valid) throw ApiError.badRequest(passwordValidation.errors.join(". "), "WEAK_PASSWORD");
 		if (await authRepo.getUserByEmail(email)) throw ApiError.conflict("Email already registered", "EMAIL_EXISTS");
@@ -7792,7 +8251,12 @@ function createAuthRoutes(config) {
 		if (ops.beforeUserCreate) createData = await ops.beforeUserCreate(createData);
 		const user = await authRepo.createUser(createData);
 		const existingUsers = await authRepo.listUsers();
-		if (existingUsers.length === 1 && existingUsers[0].id === user.id) await authRepo.setUserRoles(user.id, ["admin"]);
+		const isFirstUser = existingUsers.length === 1 && existingUsers[0].id === user.id;
+		if (bootstrapRegistration && !isFirstUser) {
+			await authRepo.deleteUser(user.id);
+			throw ApiError.forbidden("Registration is disabled", "REGISTRATION_DISABLED");
+		}
+		if (isFirstUser) await authRepo.setUserRoles(user.id, ["admin"]);
 		else if (config.defaultRole) await authRepo.assignDefaultRole(user.id, config.defaultRole);
 		const { roleIds, accessToken, refreshToken } = await createSessionAndTokens(user.id, c.req.header("user-agent") || "unknown", c.req.header("x-forwarded-for") || "unknown");
 		sendWelcomeEmail({
@@ -8532,7 +8996,7 @@ function createAdminUsersRoute(config) {
 * when the user passes a plain `RebaseAuthConfig` object.
 */
 function createBuiltinAuthAdapter(config) {
-	const { authRepository, emailService, emailConfig, allowRegistration = false, allowUserLookup = false, defaultRole, oauthProviders = [], serviceKey, authHooks, collectionAuthConfig, enableMagicLink = false, cookieAuth } = config;
+	const { authRepository, emailService, emailConfig, allowRegistration = false, disableSelfRegistration = false, allowUserLookup = false, defaultRole, oauthProviders = [], serviceKey, authHooks, collectionAuthConfig, enableMagicLink = false, cookieAuth } = config;
 	const resolvedOps = resolveAuthHooks(authHooks);
 	return {
 		id: "rebase-builtin",
@@ -8605,6 +9069,7 @@ function createBuiltinAuthAdapter(config) {
 				emailService,
 				emailConfig,
 				allowRegistration,
+				disableSelfRegistration,
 				allowUserLookup,
 				defaultRole,
 				oauthProviders,
@@ -8674,11 +9139,16 @@ function createBuiltinAuthAdapter(config) {
 				needsSetup = (await authRepository.listUsersPaginated({ limit: 1 })).total === 0;
 			} catch {}
 			const enabledProviders = oauthProviders.map((p) => p.id);
+			const registrationAllowed = isRegistrationOpen({
+				disableSelfRegistration,
+				allowRegistration,
+				needsSetup
+			});
 			return {
 				hasBuiltInAuthRoutes: true,
 				emailPasswordLogin: true,
-				registration: allowRegistration || needsSetup,
-				registrationEnabled: allowRegistration || needsSetup,
+				registration: registrationAllowed,
+				registrationEnabled: registrationAllowed,
 				passwordReset: !!emailService?.isConfigured(),
 				adminPasswordReset: true,
 				sessionManagement: true,
@@ -11970,7 +12440,7 @@ function assertStorageAccessControlConfigured(state, isProduction) {
 //#region src/init/docs.ts
 async function mountOpenApiDocs(app, basePath, enableSwagger, activeCollections, requireAuth) {
 	if (enableSwagger === false || activeCollections.length === 0) return;
-	const { generateOpenApiSpec } = await import("./openapi-generator-CeOnlAJ3.js");
+	const { generateOpenApiSpec } = await import("./openapi-generator-Bjzmb5cn.js");
 	app.get(`${basePath}/docs`, (c) => {
 		const spec = generateOpenApiSpec(activeCollections, {
 			basePath,
@@ -12206,6 +12676,25 @@ function rebaseReviver(_key, value) {
 	}
 	return value;
 }
+/**
+* True when there is no browser to have signed a user in — a Node script, a
+* cron job, an edge worker.
+*
+* Anonymous is an ordinary, correct state in a browser: before sign-in, on a
+* marketing page, for public reads. Warning there would be noise that teaches
+* people to ignore warnings, so the guard is off entirely. This uses the same
+* `typeof window` test as {@link resolveBaseUrl}, and additionally treats a
+* defined `document` as a browser so an SSR shim or test harness that installs
+* only one of the two is still excluded.
+*/
+function isServerLikeEnvironment() {
+	return typeof window === "undefined" && typeof document === "undefined";
+}
+/**
+* Emitted once per client. Kept as a constant so the wording is testable and
+* greppable — this is the string a user will paste into a search.
+*/
+var ANONYMOUS_SERVER_CLIENT_WARNING = "[rebase] This client was created outside a browser with no credential — no `token`, no auth token getter, and no cookie auth flow — so every request runs as an anonymous caller. Row-level security will return only publicly readable rows, which is usually nothing and occasionally the wrong thing. Inside a cron or function handler, use the `client` you were handed instead of building a new one: its data plane is already admin-scoped. In a standalone script or job, pass the service key as `token`. If you really do want anonymous access, pass `anonymous: true` to silence this.";
 function buildQueryString(params) {
 	if (!params) return "";
 	const parts = [];
@@ -12252,12 +12741,31 @@ function resolveBaseUrl(configured) {
 	if (typeof window !== "undefined" && window.location?.origin) return window.location.origin;
 	return "";
 }
-function createTransport(config) {
+function createTransport(config, environment) {
 	const fetchFn = config.fetch || globalThis.fetch;
 	const apiPath = config.apiPath || "/api";
 	let token = config.token;
 	let tokenGetter;
 	let onUnauthorizedHandler = config.onUnauthorized;
+	/** Once per client, never per request — log spam is its own bug. */
+	let anonymousWarningIssued = false;
+	/**
+	* Warn a server-side caller that it built a client that can only ever be
+	* anonymous. Deliberately checked at the *first request* rather than at
+	* construction: `setToken()` / `setAuthTokenGetter()` and a server-side
+	* `auth.signIn…()` (which calls `transport.setToken`) all land after the
+	* constructor, and warning at construction would fire on every one of them.
+	*/
+	function warnIfAnonymousServerClient(activeToken) {
+		if (anonymousWarningIssued) return;
+		if (activeToken) return;
+		if (tokenGetter) return;
+		if (config.anonymous) return;
+		if (environment?.credentialOutOfBand) return;
+		if (!isServerLikeEnvironment()) return;
+		anonymousWarningIssued = true;
+		console.warn(ANONYMOUS_SERVER_CLIENT_WARNING);
+	}
 	function getHeaders(activeToken, init) {
 		return {
 			"Content-Type": "application/json",
@@ -12272,6 +12780,7 @@ function createTransport(config) {
 			const fetched = await tokenGetter();
 			if (fetched !== null && fetched !== void 0) activeToken = fetched;
 		} catch (e) {}
+		warnIfAnonymousServerClient(activeToken);
 		const headers = getHeaders(activeToken, init);
 		if (init?.body instanceof FormData) delete headers["Content-Type"];
 		const res = await fetchFn(url, {
@@ -13309,6 +13818,12 @@ function createCollectionClient(transport, slug, ws) {
 				meta: raw.meta
 			};
 		},
+		iterate(params) {
+			return paginateFind((p) => client.find(p), params, slug);
+		},
+		findAll(params) {
+			return collectAllPages((p) => client.find(p), params, slug);
+		},
 		async findById(id) {
 			try {
 				const raw = await transport.request(`${basePath}/${encodeURIComponent(String(id))}`, { method: "GET" });
@@ -16109,6 +16624,8 @@ var OfflineManager = class {
 					meta: answer.meta
 				};
 			},
+			iterate: (params) => paginateFind((p) => wrapped.find(p), params, slug),
+			findAll: (params) => collectAllPages((p) => wrapped.find(p), params, slug),
 			findById: async (id) => {
 				await this.ensureCollection(slug);
 				if (this.connectivity.shouldAttempt()) try {
@@ -17176,7 +17693,7 @@ function deriveWebSocketUrl(baseUrl) {
 	return baseUrl.replace(/^https?:\/\//i, (match) => match.toLowerCase() === "https://" ? "wss://" : "ws://").replace(/\/$/, "");
 }
 function createRebaseClient(options) {
-	const transport = createTransport(options);
+	const transport = createTransport(options, { credentialOutOfBand: options.auth?.authFlowMode === "cookie" });
 	const auth = createAuth(transport, options.auth);
 	const admin = createAdmin(transport, options.admin);
 	const cron = createCron(transport, options.cron);
@@ -17553,13 +18070,37 @@ function createEmailService(config) {
 }
 //#endregion
 //#region src/singleton.ts
-var _instance = null;
+/**
+* The backing instance lives on a process-global slot, NOT in a module-local
+* variable — because more than one copy of this module can be loaded into one
+* process, and a module-local would leave every copy but the booting one dead.
+*
+* That is the normal layout under the managed runtime, not an edge case: the
+* image ships the framework at `/app/node_modules`, while a project's bundle
+* installs its own dependencies into `/bundle/node_modules` — and every custom
+* function imports `defineFunction` from `@rebasepro/server`, which resolves to
+* the bundle's transitively-installed copy. `initializeRebaseBackend()` then ran
+* against `/app`'s copy while every function held `/bundle`'s, so `rebase.data`,
+* `rebase.storage` and `rebase.dataAsAdmin` threw "server not initialized yet"
+* on EVERY request, forever, in an otherwise healthy process.
+*
+* `Symbol.for` is the fix because its registry is per-process rather than
+* per-module: whichever copy boots publishes here, and every other copy — same
+* version or not — reads the same live client.
+*/
+var INSTANCE_SLOT = Symbol.for("@rebasepro/server:singleton-instance");
+function getInstance() {
+	return globalThis[INSTANCE_SLOT] ?? null;
+}
+function setInstance(client) {
+	globalThis[INSTANCE_SLOT] = client;
+}
 /**
 * @internal Called once during server initialization to set the backing instance.
 * This is invoked by `initializeRebaseBackend()` — never call it manually.
 */
 function _initRebase(client) {
-	_instance = client;
+	setInstance(client);
 }
 /**
 * @internal Allows overriding the underlying instance for unit testing.
@@ -17567,17 +18108,17 @@ function _initRebase(client) {
 */
 function _setRebaseMock(mockInstance) {
 	if (process.env.NODE_ENV !== "test") throw new Error("_setRebaseMock can only be called in a test environment (NODE_ENV=test).");
-	_instance = {
-		..._instance || {},
+	setInstance({
+		...getInstance() || {},
 		...mockInstance
-	};
+	});
 }
 /**
 * @internal Resets the singleton instance, useful for afterEach() in test suites.
 */
 function _resetRebaseMock() {
 	if (process.env.NODE_ENV !== "test") throw new Error("_resetRebaseMock can only be called in a test environment.");
-	_instance = null;
+	setInstance(null);
 }
 /**
 * The server-side Rebase singleton.
@@ -17616,8 +18157,9 @@ function _resetRebaseMock() {
 */
 var rebase = new Proxy({}, {
 	get(_, prop) {
-		if (!_instance) throw new Error(`rebase.${String(prop)}: server not initialized yet. The singleton is available after Rebase starts — don't call it at import time.`);
-		return _instance[prop];
+		const instance = getInstance();
+		if (!instance) throw new Error(`rebase.${String(prop)}: server not initialized yet. The singleton is available after Rebase starts — don't call it at import time.`);
+		return instance[prop];
 	},
 	set(_, prop) {
 		throw new Error(`Cannot set rebase.${String(prop)} directly. The singleton is read-only. Use _initRebase() during server startup.`);
@@ -17664,21 +18206,17 @@ async function _initializeRebaseBackend(config) {
 	const dataSourceRegistry = createDataSourceRegistry(config.dataSources);
 	collectionRegistry.setDataSources(dataSourceRegistry);
 	if (config.callbacks) collectionRegistry.setGlobalCallbacks(config.callbacks);
-	const mode = config.mode ?? "cms";
-	logger.info(mode === "baas" ? "Starting in baas mode — collections derived from the database schema" : "Starting in cms mode — collections from config");
 	let activeCollections = config.collections || [];
-	if (mode === "baas") {
-		if (activeCollections.length > 0 || config.collectionsDir) {
-			logger.warn("Ignoring configured collections: baas mode derives them from the database schema. Remove `collections`/`collectionsDir`, or use mode: \"cms\" to serve them.");
-			activeCollections = [];
-		}
-	} else if (config.collectionsDir && activeCollections.length === 0) {
+	if (activeCollections.length > 0) assertCollectionConfigs(activeCollections);
+	if (config.collectionsDir && activeCollections.length === 0) {
 		activeCollections = await loadCollectionsFromDirectory(config.collectionsDir);
 		logger.info("Auto-discovered collections", {
 			count: activeCollections.length,
 			dir: config.collectionsDir
 		});
 	}
+	const introspectCollections = activeCollections.length === 0;
+	logger.info(introspectCollections ? "No collections declared — deriving them from the database schema" : "Serving declared collections");
 	const realtimeServices = {};
 	const delegates = {};
 	let bootstrappers = config.bootstrappers || [];
@@ -17706,16 +18244,16 @@ async function _initializeRebaseBackend(config) {
 		const driverResult = await bootstrapper.initializeDriver({
 			collections: activeCollections,
 			collectionRegistry,
-			mode,
+			introspectCollections,
 			baas: config.baas
 		});
 		delegates[b.id || bootstrapper.type] = driverResult.driver;
-		if (mode === "baas") {
+		if (introspectCollections) {
 			const driverName = b.id || bootstrapper.type;
-			if (!driverResult.collections) throw new Error(`Driver "${driverName}" does not support baas mode: it cannot derive collections from the database schema. Use mode: "cms" and declare collections explicitly, or use a driver that implements introspection (e.g. @rebasepro/server-postgres).`);
+			if (!driverResult.collections) throw new Error(`Driver "${driverName}" cannot derive collections from the database schema, and this project declared none. Declare collections, or use a driver that implements introspection (e.g. @rebasepro/server-postgres).`);
 			if (driverResult.collections.length === 0) logger.warn(`Driver "${driverName}" found no tables to serve. The data API will not be mounted. Create tables (migrations, SQL, any tool) and restart.`);
 		}
-		if (driverResult.collections?.length) activeCollections = [...activeCollections, ...driverResult.collections];
+		if (introspectCollections && driverResult.collections?.length) activeCollections = [...activeCollections, ...driverResult.collections];
 		if ((b.id || bootstrapper.type) === defaultDriverId || !defaultDriverResult) defaultDriverResult = driverResult;
 		if (bootstrapper.initializeRealtime) {
 			const realtime = await bootstrapper.initializeRealtime({}, driverResult);
@@ -17921,6 +18459,7 @@ async function _initializeRebaseBackend(config) {
 				emailService: authConfigResult.emailService,
 				emailConfig: safeAuthConfig.email,
 				allowRegistration: safeAuthConfig.allowRegistration ?? false,
+				disableSelfRegistration: safeAuthConfig.disableSelfRegistration ?? false,
 				allowUserLookup: safeAuthConfig.allowUserLookup ?? false,
 				defaultRole: safeAuthConfig.defaultRole,
 				oauthProviders,
@@ -17958,12 +18497,12 @@ async function _initializeRebaseBackend(config) {
 		if (apiKeyPreAuth) router.use("/*", apiKeyPreAuth);
 		router.use("/*", createRequireAuth({ serviceKey: internalServiceKey }), requireAdmin);
 	};
-	const schemaEditorEnabled = config.schemaEditor ?? (!!config.collectionsDir && process.env.NODE_ENV !== "production" && mode === "cms");
+	const schemaEditorEnabled = config.schemaEditor ?? (!!config.collectionsDir && !introspectCollections && process.env.NODE_ENV !== "production");
 	if (schemaEditorEnabled && !config.collectionsDir) logger.warn("schemaEditor is enabled but no collectionsDir is set — the schema editor has nowhere to write. Skipping.");
 	if (schemaEditorEnabled && config.collectionsDir) {
 		let editorModule;
 		try {
-			editorModule = await import("./schema-editor-routes-BFpXKkPD.js");
+			editorModule = await import("./schema-editor-routes-DDxfOIid.js");
 		} catch (err) {
 			if (err?.code === "ERR_MODULE_NOT_FOUND") logger.warn("Schema Editor disabled: its dependency ts-morph is not installed. Run `npm install ts-morph@28.0.0` to enable it.");
 			else throw err;
@@ -18215,7 +18754,6 @@ async function _initializeRebaseBackend(config) {
 		contractRouter.route("/", createContractRoutes({
 			collectionRegistry,
 			schemaVersion: config.schemaVersion,
-			mode,
 			runtimeVersion: config.runtimeVersion
 		}));
 		config.app.route(`${basePath}/meta`, contractRouter);
@@ -18488,6 +19026,97 @@ function defineCron(definition) {
 	return definition;
 }
 //#endregion
+//#region src/cron/scale-to-zero.ts
+/**
+* Scale-to-zero detection for the cron scheduler.
+*
+* The scheduler drives jobs with in-process `setTimeout`. That works on any
+* always-running instance, but on a platform that freezes or evicts the
+* container between requests (Cloud Run with `--min-instances=0`, AWS Lambda,
+* Vercel functions) the timers simply never fire — the process boots, logs the
+* jobs as registered, and silently runs nothing.
+*
+* None of these platforms expose their scaling floor to the container, so this
+* detection is a heuristic: it identifies the *platform*, not the setting. It
+* is a warning only — it must never influence boot.
+*
+* Environment variables used here were verified against vendor documentation:
+*  - `K_SERVICE` / `K_REVISION` / `K_CONFIGURATION` — Cloud Run services
+*    (Cloud Run container contract; no variable exposes min-instances).
+*  - `CLOUD_RUN_JOB` — Cloud Run jobs (same contract).
+*  - `AWS_LAMBDA_FUNCTION_NAME` — reserved AWS Lambda runtime variable.
+*  - `VERCEL=1` — Vercel system environment variable, available at runtime.
+*  - `KUBERNETES_SERVICE_HOST` — injected into every pod by the kubelet. Used
+*    as an *exclusion*: a Deployment pod runs continuously, and Knative on
+*    Kubernetes also sets `K_SERVICE`, so a pod is never warned about.
+*/
+/** Environment variable that permanently silences the scale-to-zero warning. */
+var CRON_ALWAYS_ON_ENV = "REBASE_CRON_ALWAYS_ON";
+/** Accepts the usual truthy spellings; anything else (including "") is false. */
+function isTruthy(value) {
+	if (!value) return false;
+	const normalised = value.trim().toLowerCase();
+	return normalised === "1" || normalised === "true" || normalised === "yes" || normalised === "on";
+}
+/**
+* Identify a runtime whose instances can be frozen or torn down between
+* requests. Returns `undefined` when the platform is unknown or known to run
+* continuously.
+*/
+function detectFreezableRuntime(env = process.env) {
+	if (env.KUBERNETES_SERVICE_HOST) return void 0;
+	if (env.K_SERVICE) {
+		const signals = ["K_SERVICE"];
+		if (env.K_REVISION) signals.push("K_REVISION");
+		if (env.K_CONFIGURATION) signals.push("K_CONFIGURATION");
+		return {
+			platform: "Cloud Run",
+			signals
+		};
+	}
+	if (env.CLOUD_RUN_JOB) return {
+		platform: "Cloud Run Jobs",
+		signals: ["CLOUD_RUN_JOB"]
+	};
+	if (env.AWS_LAMBDA_FUNCTION_NAME) return {
+		platform: "AWS Lambda",
+		signals: ["AWS_LAMBDA_FUNCTION_NAME"]
+	};
+	if (env.VERCEL === "1") return {
+		platform: "Vercel",
+		signals: ["VERCEL"]
+	};
+}
+/** How many job ids to name before collapsing the rest into "+N more". */
+var MAX_NAMED_JOBS = 10;
+/**
+* Build the boot-time warning, or `undefined` when it does not apply.
+*
+* Fires only when all of the following hold:
+*  1. `NODE_ENV=production` — a laptop or CI run is not at risk.
+*  2. At least one *enabled* job is registered — nothing to lose otherwise.
+*  3. The environment looks like a freezable platform (see above).
+*  4. `REBASE_CRON_ALWAYS_ON` is not set to a truthy value.
+*/
+function buildScaleToZeroWarning(jobs, env = process.env) {
+	if (env.NODE_ENV !== "production") return void 0;
+	if (isTruthy(env["REBASE_CRON_ALWAYS_ON"])) return void 0;
+	const enabled = jobs.filter((job) => job.enabled).map((job) => job.id);
+	if (enabled.length === 0) return void 0;
+	const runtime = detectFreezableRuntime(env);
+	if (!runtime) return void 0;
+	const named = enabled.slice(0, MAX_NAMED_JOBS);
+	const list = enabled.length > named.length ? `${named.join(", ")} (+${enabled.length - named.length} more)` : named.join(", ");
+	return {
+		message: `[cron] ${runtime.platform} detected — in-process timers do not fire while an instance is frozen or scaled to zero, so ${enabled.length} enabled job(s) may never run: ${list}; drive them from an external scheduler instead (POST /api/cron/:id/trigger, e.g. Cloud Scheduler). ${runtime.platform} does not expose its scaling floor to the container, so an always-warm deployment cannot be confirmed from inside the process — set ${CRON_ALWAYS_ON_ENV}=1 to silence this if at least one instance is pinned warm.`,
+		data: {
+			platform: runtime.platform,
+			signals: runtime.signals,
+			jobs: enabled
+		}
+	};
+}
+//#endregion
 //#region src/cron/cron-scheduler.ts
 var cron_scheduler_exports = /* @__PURE__ */ __exportAll({
 	CronScheduler: () => CronScheduler,
@@ -18696,6 +19325,7 @@ var CronScheduler = class {
 		});
 		for (const [id, job] of this.jobs) if (job.enabled) this.scheduleNext(id);
 		if (!this.store) logger.warn("[cron] No cron store attached — runs are uncoordinated; with multiple app instances every instance will execute every job");
+		this.warnIfScaleToZero();
 		logger.info(`⏰ Cron scheduler started with ${this.jobs.size} job(s)`);
 	}
 	/**
@@ -18789,6 +19419,23 @@ var CronScheduler = class {
 		return this.executeJob(job, true);
 	}
 	/**
+	* Warn once at start when the process looks like it is running on a
+	* platform that freezes or evicts instances between requests, where the
+	* in-process timers this scheduler relies on never fire.
+	*
+	* Advisory only: any failure here is swallowed so a detection bug can
+	* never take a production boot down.
+	*/
+	warnIfScaleToZero() {
+		try {
+			const warning = buildScaleToZeroWarning([...this.jobs.values()].map((job) => ({
+				id: job.id,
+				enabled: job.enabled
+			})));
+			if (warning) logger.warn(warning.message, warning.data);
+		} catch {}
+	}
+	/**
 	* Schedule the next execution for a job.
 	*
 	* Safety guarantees:
@@ -19402,6 +20049,7 @@ var rebaseEnvSchema = object({
 	GOOGLE_CLIENT_SECRET: string().optional(),
 	REBASE_SERVICE_KEY: string().optional(),
 	ALLOW_REGISTRATION: boolString,
+	DISABLE_SELF_REGISTRATION: optionalBoolString,
 	ALLOW_LOCALHOST_IN_PRODUCTION: optionalBoolString,
 	CORS_ORIGINS: string().optional(),
 	FRONTEND_URL: string().optional(),
@@ -19465,6 +20113,102 @@ function loadEnv(options) {
 	return env;
 }
 //#endregion
+//#region src/services/webhook-service.ts
+var WebhookDispatcher = class {
+	webhooks = [];
+	maxRetries = 3;
+	retryDelays = [
+		1e3,
+		5e3,
+		15e3
+	];
+	/** Register webhooks to watch */
+	setWebhooks(webhooks) {
+		this.webhooks = webhooks.filter((w) => w.enabled);
+	}
+	/** Called when a entity changes — checks if any webhook matches */
+	async onEntityChange(table, event, id, entity, previousEntity) {
+		const matchingWebhooks = this.webhooks.filter((w) => w.table === table && w.events.includes(event));
+		if (matchingWebhooks.length === 0) return [];
+		const results = [];
+		for (const webhook of matchingWebhooks) {
+			const payload = {
+				type: event,
+				table,
+				record: entity,
+				old_record: event === "UPDATE" ? previousEntity : void 0,
+				schema: "public",
+				timestamp: (/* @__PURE__ */ new Date()).toISOString()
+			};
+			const result = await this.deliverWithRetry(webhook, event, payload);
+			results.push(result);
+		}
+		return results;
+	}
+	async deliverWithRetry(webhook, event, payload) {
+		for (let attempt = 1; attempt <= this.maxRetries; attempt++) {
+			const result = await this.deliver(webhook, event, payload, attempt);
+			if (result.success) return result;
+			if (attempt < this.maxRetries) await new Promise((r) => setTimeout(r, this.retryDelays[attempt - 1]));
+			else return result;
+		}
+		return {
+			webhookId: webhook.id,
+			event,
+			payload,
+			statusCode: 0,
+			responseBody: "Max retries exceeded",
+			success: false,
+			attemptNumber: this.maxRetries
+		};
+	}
+	async deliver(webhook, event, payload, attemptNumber) {
+		const body = JSON.stringify(payload);
+		const headers = {
+			"Content-Type": "application/json",
+			"X-Webhook-Id": webhook.id,
+			"X-Webhook-Event": event,
+			"X-Webhook-Delivery": randomUUID$1(),
+			"X-Webhook-Attempt": String(attemptNumber),
+			...webhook.headers || {}
+		};
+		if (webhook.secret) headers["X-Webhook-Signature"] = `sha256=${createHmac("sha256", webhook.secret).update(body).digest("hex")}`;
+		try {
+			const controller = new AbortController();
+			const timeout = setTimeout(() => controller.abort(), 1e4);
+			const response = await fetch(webhook.url, {
+				method: "POST",
+				headers,
+				body,
+				signal: controller.signal
+			});
+			clearTimeout(timeout);
+			const responseBody = await response.text().catch(() => "");
+			const success = response.status >= 200 && response.status < 300;
+			return {
+				webhookId: webhook.id,
+				event,
+				payload,
+				statusCode: response.status,
+				responseBody: responseBody.slice(0, 1e3),
+				success,
+				attemptNumber
+			};
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			return {
+				webhookId: webhook.id,
+				event,
+				payload,
+				statusCode: 0,
+				responseBody: message.slice(0, 1e3),
+				success: false,
+				attemptNumber
+			};
+		}
+	}
+};
+//#endregion
 //#region src/utils/dev-port.ts
 var MAX_PORT_ATTEMPTS = 20;
 /** Filename written next to the project `.env` so the CLI can read it. */
@@ -19606,6 +20350,21 @@ function writeStateFile(projectRoot, port, serviceKey) {
 //#endregion
 //#region src/serve-spa.ts
 /**
+* Is `requestPath` the excluded path `prefix`, or something beneath it?
+*
+* Segment-aware on purpose. A plain `startsWith` reads "/api" as excluding
+* "/apidocs", and "/admin" as excluding "/administrators" — both ordinary
+* client-side routes of the app rooted at "/", both then answered with a 404
+* because the SPA fallback declined them and nothing else claims the path.
+* `apiBasePath` is always in the exclusion list, so this reached single-app
+* setups too, not just the multi-app ones the list was added for.
+*/
+function isUnderPath(requestPath, prefix) {
+	const trimmed = prefix.replace(/\/+$/, "");
+	if (trimmed === "") return true;
+	return requestPath === trimmed || requestPath.startsWith(`${trimmed}/`);
+}
+/**
 * Serve a Single Page Application from an Hono app.
 *
 * @internal Not part of the stable public API. Exported only because the
@@ -19615,21 +20374,30 @@ function writeStateFile(projectRoot, port, serviceKey) {
 * may change without a major version bump.
 */
 function serveSPA(app, config) {
-	const { frontendPath, apiBasePath = "/api", excludePaths = [], indexFile = "index.html" } = config;
+	const { frontendPath, apiBasePath = "/api", excludePaths = [], indexFile = "index.html", spa = true } = config;
+	const rawBase = config.basePath ?? "/";
+	const basePath = rawBase !== "/" ? rawBase.replace(/\/+$/, "") : "/";
+	const isRoot = basePath === "/";
 	if (!fs$2.existsSync(frontendPath)) {
 		logger.warn(`⚠️ Frontend build path does not exist: ${frontendPath}`);
 		logger.warn("   SPA serving is disabled. Build your frontend first.");
 		return;
 	}
-	app.use("/*", responseCompression());
-	app.use("/*", serveStatic({
+	const scope = isRoot ? "/*" : `${basePath}/*`;
+	app.use(scope, responseCompression());
+	app.use(scope, serveStatic({
 		root: path$1.relative(process.cwd(), frontendPath),
-		precompressed: true
+		precompressed: true,
+		...isRoot ? {} : { rewriteRequestPath: (p) => p.slice(basePath.length) || "/" }
 	}));
+	if (!spa) {
+		logger.info(`✅ Static serving enabled at ${basePath} from: ${frontendPath}`);
+		return;
+	}
 	const allExcludePaths = [apiBasePath, ...excludePaths];
 	let cachedHtml = null;
-	app.get("*", async (c, next) => {
-		if (allExcludePaths.some((p) => c.req.path.startsWith(p))) return next();
+	app.get(scope, async (c, next) => {
+		if (allExcludePaths.some((p) => isUnderPath(c.req.path, p))) return next();
 		const indexPath = path$1.join(frontendPath, indexFile);
 		if (!cachedHtml) try {
 			cachedHtml = await fsp.readFile(indexPath, "utf-8");
@@ -19639,7 +20407,7 @@ function serveSPA(app, config) {
 		}
 		return c.html(cachedHtml);
 	});
-	logger.info(`✅ SPA serving enabled from: ${frontendPath}`);
+	logger.info(`✅ SPA serving enabled at ${basePath} from: ${frontendPath}`);
 }
 //#endregion
 //#region src/boot/bundle.ts
@@ -19654,6 +20422,36 @@ var BundleError = class extends Error {
 };
 var MANIFEST_FILENAME = "manifest.json";
 /**
+* Bring a format-1 manifest up to the shape the rest of this runtime expects.
+*
+* Old bundles booting on a new runtime is the case the format version exists to
+* protect, so this is not a courtesy — it is the contract. A project built
+* before the rename ships `mode` and a single `entry.static` directory string,
+* and without this it would boot with no `kind` (so every gate keyed on
+* `kind === "backend"` would skip) and an `entry.static` the loader would try to
+* iterate as a list.
+*
+* In place, and only ever filling in what is absent, so a format-2 manifest
+* passes through untouched.
+*/
+function upgradeLegacyManifest(manifest) {
+	const legacy = manifest;
+	if (!legacy.kind) legacy.kind = legacy.mode === "static" ? "static" : "backend";
+	const entry = legacy.entry;
+	if (!entry) return;
+	if (typeof entry.static === "string") entry.static = [{
+		path: "/",
+		dir: entry.static,
+		spa: true
+	}];
+	else if (!entry.static && typeof entry.admin === "string") entry.static = [{
+		path: "/",
+		dir: entry.admin,
+		spa: true
+	}];
+	delete entry.admin;
+}
+/**
 * Read and validate a bundle's manifest.
 *
 * The checks here are the runtime half of the compatibility contract, and they
@@ -19671,7 +20469,8 @@ function readBundleManifest(bundleDir) {
 		throw new BundleError(`${manifestPath} is not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
 	}
 	if (typeof manifest.bundleFormat !== "number") throw new BundleError(`${manifestPath} is missing "bundleFormat".`);
-	if (manifest.bundleFormat > 1) throw new BundleError(`This bundle uses format ${manifest.bundleFormat}, but this runtime understands up to 1.`, "Upgrade the runtime image, or rebuild the bundle with a matching CLI.");
+	if (manifest.bundleFormat > 2) throw new BundleError(`This bundle uses format ${manifest.bundleFormat}, but this runtime understands up to 2.`, "Upgrade the runtime image, or rebuild the bundle with a matching CLI.");
+	upgradeLegacyManifest(manifest);
 	const contract = manifest.runtime?.contract;
 	if (typeof contract === "number" && contract !== 1) throw new BundleError(`This bundle targets runtime contract v${contract}, but this runtime implements v1.`, contract > 1 ? "Upgrade the runtime image to a version that implements the newer contract." : "Rebuild the bundle against the current runtime (`rebase build`), or run a runtime image from the previous major.");
 	return manifest;
@@ -19720,8 +20519,14 @@ function loadBundle(bundleDir) {
 		collectionsDir: entry.collections ? resolveEntry(entry.collections, "collections") : entry.config ? resolveEntry(path.join(entry.config, "collections"), "collections") : void 0,
 		functionsDir: resolveEntry(entry.functions, "functions"),
 		cronsDir: resolveEntry(entry.crons, "crons"),
-		adminDir: resolveEntry(entry.admin, "admin"),
-		staticDir: resolveEntry(entry.static, "static")
+		staticApps: (entry.static ?? []).map((item) => {
+			const resolved = resolveEntry(item.dir, `static app "${item.path}"`);
+			return resolved ? {
+				path: item.path,
+				dir: resolved,
+				spa: item.spa !== false
+			} : void 0;
+		}).filter((item) => item !== void 0).sort((a, b) => b.path.length - a.path.length)
 	};
 }
 /**
@@ -19770,7 +20575,7 @@ function createSourceBundle(options) {
 	return {
 		dir,
 		manifest: {
-			bundleFormat: 1,
+			bundleFormat: 2,
 			runtime: {
 				range: `^1`,
 				builtAgainst: "source",
@@ -19778,7 +20583,7 @@ function createSourceBundle(options) {
 			},
 			schemaVersion: "",
 			app: options.app ?? "backend",
-			mode: options.mode ?? "cms",
+			kind: "backend",
 			entry: {
 				config: options.config ?? configDir,
 				collections: collectionsDir,
@@ -19797,8 +20602,7 @@ function createSourceBundle(options) {
 		collectionsDir: resolve(collectionsDir),
 		functionsDir: resolve(options.functions),
 		cronsDir: resolve(options.crons),
-		adminDir: void 0,
-		staticDir: void 0
+		staticApps: []
 	};
 }
 /**
@@ -19991,11 +20795,27 @@ var bootEnvExtension = object({
 	MICROSOFT_CLIENT_ID: string().optional(),
 	MICROSOFT_CLIENT_SECRET: string().optional(),
 	REBASE_BASE_PATH: string().default("/api"),
+	/**
+	* The OpenAPI surface: `/api/docs` (the spec) and `/api/swagger` (the UI).
+	*
+	* Deliberately tri-state, and resolved against NODE_ENV by
+	* {@link resolveEnableSwagger} rather than defaulted here. Unset means "on
+	* in development, off in production" — an explicit `true` or `false` always
+	* wins in both.
+	*
+	* It used to default to `"false"` outright, which reads as a safe default
+	* and was not one: the runtime is how every scaffolded project boots, so
+	* the docs disappeared from projects that never asked for that. `rebase
+	* init` prints "docs are at /api/swagger" on completion, the headless
+	* README repeats it, and the console's API Explorer fetches `/api/docs` —
+	* all three 404'd against a project running the runtime, and the baas e2e
+	* failed on exactly that.
+	*/
 	REBASE_ENABLE_SWAGGER: _enum([
 		"true",
 		"false",
 		""
-	]).default("false").transform((v) => v === "true"),
+	]).optional().transform((v) => v === void 0 || v === "" ? void 0 : v === "true"),
 	/**
 	* Maximum request body size, in **bytes**.
 	*
@@ -20055,6 +20875,24 @@ function isLocalhostOrigin(origin) {
 		return false;
 	}
 }
+/** A CORS origin resolver of the shape Hono's `cors()` middleware expects. */
+/**
+* Whether this process serves the OpenAPI docs.
+*
+* An explicit `REBASE_ENABLE_SWAGGER` wins in either direction. Left unset, the
+* docs follow the environment: on in development, where they are part of how a
+* scaffolded project is meant to be explored, and off in production, where the
+* spec enumerates every collection and field to anyone who asks for it.
+*
+* Returning `undefined` for development is the point rather than an oversight —
+* it hands the decision to the server's own policy in `init/docs.ts`, which also
+* knows to withhold the Swagger UI while still serving the spec. Two defaults
+* that can disagree about the same route is the bug this replaces.
+*/
+function resolveEnableSwagger(env) {
+	if (env.REBASE_ENABLE_SWAGGER !== void 0) return env.REBASE_ENABLE_SWAGGER;
+	return env.NODE_ENV === "production" ? false : void 0;
+}
 /**
 * Build the CORS origin policy.
 *
@@ -20081,12 +20919,17 @@ function resolveCorsOrigin(env) {
 *
 * The default key maps to no suffix at all, which is what keeps every existing
 * single-database deployment working untouched.
+*
+* The rule itself lives in `@rebasepro/types` so the CLI and any control plane
+* derive identical names from identical keys; this wrapper exists only to raise
+* it as a `BundleError`, which is what the rest of boot reports failures as.
 */
 function envSuffixForKey(key, defaultKey) {
-	if (!key || key === defaultKey) return "";
-	const normalized = key.replace(/[^A-Za-z0-9]+/g, "_").replace(/^_+|_+$/g, "").toUpperCase();
-	if (!normalized) throw new BundleError(`Source key "${key}" cannot be turned into an environment variable name.`, "Use a key containing at least one letter or digit.");
-	return `__${normalized}`;
+	try {
+		return storageEnvSuffix(key, defaultKey);
+	} catch (err) {
+		throw new BundleError(`Source key "${key}" cannot be turned into an environment variable name.`, "Use a key containing at least one letter or digit.");
+	}
 }
 /** Read `<base>` for the default source, `<base>__<KEY>` for a named one. */
 function readVar(env, base, suffix) {
@@ -20105,13 +20948,8 @@ function readBool(env, base, suffix) {
 * without this check one of them would silently read the other's configuration.
 */
 function assertDistinctSuffixes(definitions, defaultKey, what) {
-	const seen = /* @__PURE__ */ new Map();
-	for (const def of definitions) {
-		const suffix = envSuffixForKey(def.key, defaultKey);
-		const existing = seen.get(suffix);
-		if (existing !== void 0 && existing !== def.key) throw new BundleError(`${what} keys "${existing}" and "${def.key}" both map to the same environment variable suffix "${suffix || "(none)"}".`, "Rename one of them so each source has its own configuration.");
-		seen.set(suffix, def.key);
-	}
+	const collision = findStorageSuffixCollision(definitions.map((d) => d.key), defaultKey);
+	if (collision) throw new BundleError(`${what} keys "${collision.a}" and "${collision.b}" both map to the same environment variable suffix "${collision.suffix || "(none)"}".`, "Rename one of them so each source has its own configuration.");
 }
 /** Which driver package backs a given engine, before env overrides. */
 var ENGINE_DRIVERS = {
@@ -20188,23 +21026,37 @@ function resolvePoolConfig(env, suffix) {
 */
 function resolveStorageBackend(env, key, engineHint, defaultBasePath) {
 	const suffix = envSuffixForKey(key, DEFAULT_STORAGE_SOURCE_KEY);
-	const type = (readVar(env, "STORAGE_TYPE", suffix) || engineHint || "").toLowerCase();
+	const declaredType = readVar(env, "STORAGE_TYPE", suffix);
+	const type = (declaredType || engineHint || "").toLowerCase();
+	const explicit = Boolean(declaredType);
 	if (type === "s3") {
 		const bucket = readVar(env, "S3_BUCKET", suffix);
-		if (!bucket) throw new BundleError(`Storage source "${key}" is set to s3 but has no bucket — set ${`S3_BUCKET${suffix}`}.`);
+		if (!bucket) {
+			if (!explicit) return void 0;
+			throw new BundleError(`Storage source "${key}" is set to s3 but has no bucket — set ${`S3_BUCKET${suffix}`}.`);
+		}
+		const accessKeyId = readVar(env, "S3_ACCESS_KEY_ID", suffix);
+		const secretAccessKey = readVar(env, "S3_SECRET_ACCESS_KEY", suffix);
+		if (!accessKeyId || !secretAccessKey) {
+			if (!explicit) return void 0;
+			throw new BundleError(`Storage source "${key}" is set to s3 with a bucket but no credentials — set ${[!accessKeyId && `S3_ACCESS_KEY_ID${suffix}`, !secretAccessKey && `S3_SECRET_ACCESS_KEY${suffix}`].filter(Boolean).join(" and ")}.`, "A bucket without credentials cannot be reached: every upload fails when the request is signed.");
+		}
 		return {
 			type: "s3",
 			bucket,
 			region: readVar(env, "S3_REGION", suffix) || "auto",
-			accessKeyId: readVar(env, "S3_ACCESS_KEY_ID", suffix) || "",
-			secretAccessKey: readVar(env, "S3_SECRET_ACCESS_KEY", suffix) || "",
+			accessKeyId,
+			secretAccessKey,
 			endpoint: readVar(env, "S3_ENDPOINT", suffix),
 			forcePathStyle: readBool(env, "S3_FORCE_PATH_STYLE", suffix)
 		};
 	}
 	if (type === "gcs") {
 		const bucket = readVar(env, "GCS_BUCKET", suffix);
-		if (!bucket) throw new BundleError(`Storage source "${key}" is set to gcs but has no bucket — set ${`GCS_BUCKET${suffix}`}.`);
+		if (!bucket) {
+			if (!explicit) return void 0;
+			throw new BundleError(`Storage source "${key}" is set to gcs but has no bucket — set ${`GCS_BUCKET${suffix}`}.`);
+		}
 		return {
 			type: "gcs",
 			bucket,
@@ -20240,6 +21092,45 @@ function resolveStorageSources(env, definitions, defaultBasePath) {
 	}
 	return Object.keys(result).length > 0 ? result : void 0;
 }
+/**
+* Read a project's declared storage sources from its `rebase.json`.
+*
+* A managed bundle carries its topology in `manifest.json`, resolved at build
+* time. A **custom** runtime has no manifest — it builds its own image and its
+* own entrypoint — so without this it would have to re-declare in code what
+* `rebase.json` already says, and the two would drift. Since a custom image
+* contains the repository anyway, reading the file it already ships is what
+* keeps one declaration authoritative for both runtimes.
+*
+* Walks up from `startDir` because an entrypoint lives at `backend/src` in the
+* scaffolded layout and somewhere else in a hand-rolled one. A missing,
+* unreadable or malformed file means "declared nothing" — one default source —
+* which is the correct reading of every project that predates this and must
+* never be an error: a storage declaration is optional, and failing to boot a
+* whole backend over an absent optional file would be the worse bug.
+*/
+function loadDeclaredStorageSources(startDir, levels = 5) {
+	let dir = startDir;
+	for (let i = 0; i <= levels; i++) {
+		const candidate = path.join(dir, "rebase.json");
+		if (fs.existsSync(candidate)) {
+			let declared;
+			try {
+				declared = JSON.parse(fs.readFileSync(candidate, "utf8"))?.storage;
+			} catch (err) {
+				logger.warn(`Could not read storage sources from ${candidate}: ${err instanceof Error ? err.message : String(err)}. Continuing with a single default storage source.`);
+				return [];
+			}
+			const sources = normalizeStorageSources(declared, void 0);
+			assertDistinctSuffixes(sources, DEFAULT_STORAGE_SOURCE_KEY, "Storage source");
+			return sources;
+		}
+		const parent = path.dirname(dir);
+		if (parent === dir) break;
+		dir = parent;
+	}
+	return [];
+}
 //#endregion
 //#region src/boot/driver.ts
 /**
@@ -20452,6 +21343,7 @@ function resolveAuthOptions(env, usersCollection) {
 		serviceKey: env.REBASE_SERVICE_KEY,
 		requireAuth: env.AUTH_REQUIRE,
 		allowRegistration: env.ALLOW_REGISTRATION,
+		disableSelfRegistration: env.DISABLE_SELF_REGISTRATION,
 		allowUserLookup: env.AUTH_ALLOW_USER_LOOKUP,
 		email: resolveEmailOptions(env),
 		cookieAuth: { sameSite: env.AUTH_COOKIE_SAME_SITE || "Lax" }
@@ -20741,16 +21633,17 @@ async function bootFromBundle(options = {}) {
 	const devRoot = process.env.REBASE_DEV_PROJECT_ROOT || process.cwd();
 	logger.info("Loaded bundle", {
 		app: bundle.manifest.app,
-		mode: bundle.manifest.mode,
+		kind: bundle.manifest.kind,
 		schemaVersion: bundle.manifest.schemaVersion,
 		builtAgainst: bundle.manifest.runtime?.builtAgainst
 	});
-	if (bundle.manifest.mode === "static") return bootStaticApp(bundle, devRoot, options);
+	if (bundle.manifest.kind === "static") return bootStaticApp(bundle, devRoot, options);
 	const env = loadBootEnv();
 	const isProduction = env.NODE_ENV === "production";
 	const configExports = await loadBundleConfigExports(bundle);
 	const dataSourceDefs = configExports.dataSources;
-	const storageSourceDefs = configExports.storageSources;
+	const declaredStorage = normalizeStorageSources(bundle.manifest.storage?.sources, configExports.storageSources);
+	const storageSourceDefs = declaredStorage.length > 0 ? declaredStorage : void 0;
 	const dataSources = await initializeDataSources(resolveDataSources(process.env, dataSourceDefs), await loadBundleSchema(bundle), [
 		bundle.dir,
 		path.join(bundle.dir, "backend"),
@@ -20775,7 +21668,6 @@ async function bootFromBundle(options = {}) {
 		server,
 		app,
 		basePath: env.REBASE_BASE_PATH,
-		mode: bundle.manifest.mode ?? "cms",
 		collectionsDir: bundle.collectionsDir,
 		functionsDir: bundle.functionsDir,
 		cronsDir: bundle.cronsDir,
@@ -20789,7 +21681,7 @@ async function bootFromBundle(options = {}) {
 		callbacks: configExports.callbacks,
 		auth: resolveAuthOptions(env, usersCollection),
 		history: env.REBASE_HISTORY,
-		enableSwagger: env.REBASE_ENABLE_SWAGGER,
+		enableSwagger: resolveEnableSwagger(env),
 		compression: env.REBASE_COMPRESSION,
 		maxBodySize: env.REBASE_MAX_BODY_SIZE,
 		logging: env.LOG_LEVEL ? { level: env.LOG_LEVEL } : void 0,
@@ -20821,20 +21713,24 @@ async function bootFromBundle(options = {}) {
 		if (!env.REBASE_METRICS_TOKEN) logger.warn("Metrics are enabled without REBASE_METRICS_TOKEN — /metrics is readable by anyone who can reach this port. Set a token, or keep the port on a private network.");
 		app.route("/metrics", createMetricsRoutes(metrics.registry, env.REBASE_METRICS_TOKEN));
 	}
-	if (env.REBASE_SERVE_STATIC) {
-		const staticRoot = bundle.staticDir ?? bundle.adminDir;
-		if (staticRoot) {
-			logger.info("Serving static assets", { path: staticRoot });
-			serveSPA(app, {
-				frontendPath: staticRoot,
-				apiBasePath: env.REBASE_BASE_PATH,
-				excludePaths: [
-					"/health",
-					"/livez",
-					"/metrics"
-				]
-			});
-		}
+	if (env.REBASE_SERVE_STATIC) for (const staticApp of bundle.staticApps) {
+		const siblings = bundle.staticApps.filter((other) => other !== staticApp).map((other) => other.path).filter((other) => other !== "/");
+		logger.info("Serving static assets", {
+			path: staticApp.dir,
+			at: staticApp.path
+		});
+		serveSPA(app, {
+			frontendPath: staticApp.dir,
+			basePath: staticApp.path,
+			apiBasePath: env.REBASE_BASE_PATH,
+			excludePaths: [
+				"/health",
+				"/livez",
+				"/metrics",
+				...siblings
+			],
+			spa: staticApp.spa
+		});
 	}
 	let port = env.PORT;
 	if (options.listen !== false) if (isProduction) {
@@ -20886,8 +21782,7 @@ async function bootFromBundle(options = {}) {
 * backend — the only difference is what the bundle contains.
 */
 async function bootStaticApp(bundle, devRoot, options) {
-	const staticRoot = bundle.staticDir ?? bundle.adminDir;
-	if (!staticRoot) throw new BundleError("A static bundle declares no assets to serve.", "Its manifest has `mode: \"static\"` but no `entry.static` — rebuild the app with `rebase build`.");
+	if (bundle.staticApps.length === 0) throw new BundleError("A static bundle declares no assets to serve.", "Its manifest has `kind: \"static\"` but no `entry.static` — rebuild the app with `rebase build`.");
 	const isProduction = process.env.NODE_ENV === "production";
 	const requestedPort = Number(process.env.PORT ?? "3001") || 3001;
 	const basePath = process.env.REBASE_BASE_PATH || "/api";
@@ -20907,19 +21802,26 @@ async function bootStaticApp(bundle, devRoot, options) {
 		latencyMs: 0
 	}));
 	if (metrics) app.route("/metrics", createMetricsRoutes(metrics.registry, metricsToken));
-	logger.info("Serving static app", {
-		app: bundle.manifest.app,
-		path: staticRoot
-	});
-	serveSPA(app, {
-		frontendPath: staticRoot,
-		apiBasePath: basePath,
-		excludePaths: [
-			"/health",
-			"/livez",
-			"/metrics"
-		]
-	});
+	for (const staticApp of bundle.staticApps) {
+		const siblings = bundle.staticApps.filter((other) => other !== staticApp).map((other) => other.path).filter((other) => other !== "/");
+		logger.info("Serving static app", {
+			app: bundle.manifest.app,
+			path: staticApp.dir,
+			at: staticApp.path
+		});
+		serveSPA(app, {
+			frontendPath: staticApp.dir,
+			basePath: staticApp.path,
+			apiBasePath: basePath,
+			excludePaths: [
+				"/health",
+				"/livez",
+				"/metrics",
+				...siblings
+			],
+			spa: staticApp.spa
+		});
+	}
 	let port = requestedPort;
 	if (options.listen !== false) if (isProduction) {
 		await new Promise((resolve, reject) => {
@@ -20997,7 +21899,8 @@ async function ensureCollectionSchema(bundle, dataSources, env) {
 		logger.info("REBASE_MIGRATE_ON_BOOT=none — leaving the database schema untouched.");
 		return;
 	}
-	if ((bundle.manifest.mode ?? "cms") !== "cms") return;
+	if (bundle.manifest.kind !== "backend") return;
+	if (!bundle.manifest.entry?.config) return;
 	if (!bundle.collectionsDir) return;
 	const primary = dataSources[0];
 	if (!primary?.bootstrapper.ensureCollectionSchema) return;
@@ -21043,7 +21946,6 @@ function createContractRoutes(config) {
 				version: config.runtimeVersion ?? "unknown",
 				contract: 1
 			},
-			mode: config.mode,
 			collections: serialized,
 			collectionSlugs: collections.map((collection) => collection.slug).filter((slug) => Boolean(slug)).sort(),
 			generatedAt: (/* @__PURE__ */ new Date()).toISOString()
@@ -21062,15 +21964,12 @@ function createContractRoutes(config) {
 	router.get("/schema-version", (c) => {
 		const schemaVersion = schemaVersionOf(config.collectionRegistry.getRawCollections());
 		c.header(SCHEMA_VERSION_HEADER, schemaVersion);
-		return c.json({
-			schemaVersion,
-			mode: config.mode
-		});
+		return c.json({ schemaVersion });
 	});
 	logger.debug("Contract routes mounted");
 	return router;
 }
 //#endregion
-export { ApiError, BundleError, CronScheduler, DEFAULT_DRIVER_ID, DEFAULT_MAX_FILE_SIZE, DEFAULT_STORAGE_ID, DOCUMENT_MIME_TYPES, DefaultDriverRegistry, DefaultStorageRegistry, GCSStorageController, IMAGE_MIME_TYPES, LocalStorageController, MetricsRegistry, S3StorageController, SMTPEmailService, TransformCache, TusHandler, _resetRebaseMock, _setRebaseMock, applyCollectionDefaults, authJwt, authRoles, authUid, bootFromBundle, classifySurface, cleanupDevPortFile, createAppleProvider, createBackupRoutes, createBitbucketProvider, createBuiltinAuthAdapter, createContractRoutes, createCronRoutes, createCronStore, createCustomAuthAdapter, createDiscordProvider, createEmailService, createFacebookProvider, createFunctionRoutes, createGitHubProvider, createGitLabProvider, createGoogleProvider, createHistoryRoutes, createLinkedinProvider, createMetricsMiddleware, createMetricsRoutes, createMicrosoftProvider, createSlackProvider, createSourceBundle, createSpotifyProvider, createStorageController, createStorageRoutes, createTwitterProvider, defineCron, defineFunction, envSuffixForKey, errorHandler, extractUserFromToken, fileTokenAuth, generateSecurePassword, getEmailVerificationTemplate, getMagicLinkTemplate, getPasswordResetTemplate, getUserInvitationTemplate, getWelcomeEmailTemplate, hashPassword, httpMethodToOperation, initializeDataSource, initializeDataSources, initializeRebaseBackend, installShutdownHandlers, isApiKeyToken, isAuthAdapter, isDatabaseAdapter, isLocalhostOrigin, isOperationAllowed, isRebaseApiError, isTransformableImage, listBackupObjects, listenWithPortRetry, loadBootEnv, loadBundle, loadBundleConfigExports, loadBundleSchema, loadCollectionsFromDirectory, loadCronJobsFromDirectory, loadEnv, loadFunctionsFromDirectory, loadUsersCollection, logger, optionalAuth, parseBackupDestination, parseBackupTimestamp, parseTransformOptions, queryTokenAuth, readBackupBytes, readBundleManifest, rebase, requireAdmin, requireAuth, resolveAuthHooks, resolveAuthOptions, resolveCorsOrigin, resolveDataSources, resolveEmailOptions, resolveStorageBackend, resolveStorageSources, runFromBundle, safeCompare, serveSPA, transformImage, validateApiKey, validateCronExpression, validatePasswordStrength, verifyPassword };
+export { ApiError, BundleError, CronScheduler, DEFAULT_DRIVER_ID, DEFAULT_MAX_FILE_SIZE, DEFAULT_STORAGE_ID, DOCUMENT_MIME_TYPES, DefaultDriverRegistry, DefaultStorageRegistry, GCSStorageController, IMAGE_MIME_TYPES, LocalStorageController, MetricsRegistry, S3StorageController, SMTPEmailService, TransformCache, TusHandler, WebhookDispatcher, _resetRebaseMock, _setRebaseMock, applyCollectionDefaults, assertCollectionConfigs, assertDistinctSuffixes, authJwt, authRoles, authUid, bootFromBundle, classifySurface, cleanupDevPortFile, createAppleProvider, createBackupRoutes, createBitbucketProvider, createBuiltinAuthAdapter, createContractRoutes, createCronRoutes, createCronStore, createCustomAuthAdapter, createDiscordProvider, createEmailService, createFacebookProvider, createFunctionRoutes, createGitHubProvider, createGitLabProvider, createGoogleProvider, createHistoryRoutes, createLinkedinProvider, createMetricsMiddleware, createMetricsRoutes, createMicrosoftProvider, createSlackProvider, createSourceBundle, createSpotifyProvider, createStorageController, createStorageRoutes, createTwitterProvider, defineCron, defineFunction, envSuffixForKey, errorHandler, extractUserFromToken, fileTokenAuth, findCollectionConfigProblems, generateSecurePassword, getEmailVerificationTemplate, getMagicLinkTemplate, getPasswordResetTemplate, getUserInvitationTemplate, getWelcomeEmailTemplate, hashPassword, httpMethodToOperation, initializeDataSource, initializeDataSources, initializeRebaseBackend, installShutdownHandlers, isApiKeyToken, isAuthAdapter, isDatabaseAdapter, isLocalhostOrigin, isOperationAllowed, isRebaseApiError, isTransformableImage, listBackupObjects, listenWithPortRetry, loadBootEnv, loadBundle, loadBundleConfigExports, loadBundleSchema, loadCollectionsFromDirectory, loadCronJobsFromDirectory, loadDeclaredStorageSources, loadEnv, loadFunctionsFromDirectory, loadUsersCollection, logger, optionalAuth, parseBackupDestination, parseBackupTimestamp, parseTransformOptions, queryTokenAuth, readBackupBytes, readBundleManifest, rebase, requireAdmin, requireAuth, resolveAuthHooks, resolveAuthOptions, resolveCorsOrigin, resolveDataSources, resolveEmailOptions, resolveStorageBackend, resolveStorageSources, runFromBundle, safeCompare, serveSPA, transformImage, unknownKeyPolicyFromEnv, validateApiKey, validateCronExpression, validatePasswordStrength, verifyPassword };
 
 //# sourceMappingURL=index.es.js.map