@rebasepro/server 0.13.0 → 0.13.1-canary.g06dbe5b

package/dist/index.es.js

@@ -1,27 +1,27 @@
 import { createRequire as __createRequire } from "module";
 import process from "process";
 __createRequire(import.meta.url);
-import { S as Vector, a as serializeFilter, b as EntityRelation, c as paginateFind, d as resolveDataSource, f as getEffectiveSecurityRules, g as toSnakeCase, h as buildCompositeId, i as deserializeLogicalCondition, l as CollectionRegistry, m as resolveCollectionRelations, n as buildSdkData, o as serializeLogicalCondition, p as findRelation, r as deserializeFilter, s as collectAllPages, t as buildRoutedRebaseData, u as createDataSourceRegistry, x as GeoPoint, y as EntityReference } from "./src-Cum9kox5.js";
-import { a as DEFAULT_DATA_SOURCE_KEY, r as isPostgresCollectionConfig, t as getCollectionDataPath, u as toCanonicalOp } from "./src-_qQ3RNCK.js";
-import { n as ADMIN_PROPERTY_KEYS, t as ADMIN_COLLECTION_KEYS } from "./admin_block-CcSGdH7M.js";
-import { t as isSQLAdmin } from "./backend-CIxN4FVm.js";
-import { n as createContractRoutes } from "./contract-routes-Dj8i5AiM.js";
-import { $ as httpMethodToOperation, A as getEmailVerificationTemplate, B as optionalAuth, C as createDataRateLimiter, D as validatePasswordStrength, E as hashPassword, F as createAdapterAuthMiddleware, G as createApiKeyPreAuth, H as queryTokenAuth, I as createAuthMiddleware, J as isApiKeyToken, K as createFunctionApiKeyGuard, L as createRequireAuth, M as getPasswordResetTemplate, N as getUserInvitationTemplate, O as verifyPassword, P as getWelcomeEmailTemplate, Q as scopeDataDriver, R as extractUserFromToken, S as _coercedNumber, T as resolveAuthHooks, U as requireAdmin, V as publicObjectAuth, W as requireAuth, X as extractBearerToken, Y as validateApiKey, Z as safeCompare, _ as createBuiltinAuthAdapter, a as createSpotifyProvider, b as object, c as createGitLabProvider, d as createFacebookProvider, et as isOperationAllowed, f as createAppleProvider, g as createGoogleProvider, h as createLinkedinProvider, i as createApiKeyStore, it as resolveClientListLimit, j as getMagicLinkTemplate, k as generateSecurePassword, l as createDiscordProvider, m as createGitHubProvider, n as createCustomAuthAdapter, nt as isPublicStoragePath, o as createSlackProvider, p as createMicrosoftProvider, q as createStorageApiKeyGuard, r as createApiKeyRoutes, s as createBitbucketProvider, tt as PUBLIC_STORAGE_PREFIX, u as createTwitterProvider, v as ZodNumber, w as MemoryRateLimitStore, x as string, y as _enum, z as fileTokenAuth } from "./auth-CuC9M2x6.js";
-import { t as logger } from "./logger-BYU66ENZ.js";
-import { n as errorHandler, r as isRebaseApiError, t as ApiError } from "./errors-CgkCzoj7.js";
-import { i as generateDownloadToken, n as configureJwt } from "./jwt-DD6EtpGj.js";
+import { D as Vector, E as GeoPoint, O as RebaseApiError, T as EntityRelation, _ as resolvePrimaryKeys, a as serializeFilter, c as paginateFind, d as createDataSourceRegistry, f as resolveDataSource, g as buildCompositeId, h as resolveCollectionRelations, k as RebaseClientError, l as resolveFindWindow, m as findRelation, n as buildSdkData, o as serializeLogicalCondition, p as getEffectiveSecurityRules, s as collectAllPages, t as buildRoutedRebaseData, u as CollectionRegistry, v as toSnakeCase, w as EntityReference } from "./src-By48Ffg0.js";
+import { c as DEFAULT_DATA_SOURCE_KEY, i as getCollectionDataPath, n as RLS_ROLES_SQL, o as isPostgresCollectionConfig, p as toCanonicalOp, r as RLS_UID_SQL, t as RLS_JWT_SQL } from "./src-Ca6NhxKs.js";
+import { n as ADMIN_PROPERTY_KEYS, t as ADMIN_COLLECTION_KEYS } from "./admin_block-H86dCPsj.js";
+import { i as isSQLAdmin, r as revokeInternalTableSql } from "./ddl-bootstrap-BhXbTnBl.js";
+import { n as createContractRoutes } from "./contract-routes-BB1U05sS.js";
+import { $ as fileTokenAuth, A as MemoryRateLimitStore, B as getEmailVerificationTemplate, C as ZodNumber, Ct as isPublicStoragePath, D as _coercedNumber, E as string, F as resolveAuthHooks, G as RawHtml, H as getPasswordResetTemplate, I as hashPassword, J as raw, K as escapeHtml, L as validatePasswordStrength, M as createEmailService, N as assertEmailLinkBases, O as DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT, P as resolveEmailLinkBase, Q as extractUserFromToken, R as verifyPassword, S as createBuiltinAuthAdapter, St as PUBLIC_STORAGE_PREFIX, T as object, U as getUserInvitationTemplate, V as getMagicLinkTemplate, W as getWelcomeEmailTemplate, X as createAuthMiddleware, Y as createAdapterAuthMiddleware, Z as createRequireAuth, _ as createLinkedinProvider, _t as scopeDataDriver, a as createSpotifyProvider, at as InvalidStorageBucketError, b as pkceTokenParams, bt as parseQueryOptions, c as createGitLabProvider, ct as canonicalStorageKey, d as createFacebookProvider, dt as createStorageApiKeyGuard, et as optionalAuth, f as createAppleProvider, ft as isApiKeyToken, g as createGitHubProvider, gt as SERVICE_IDENTITY, h as verifyOidcIdToken, ht as safeCompare, i as createApiKeyStore, it as requireAuth, j as SMTPEmailService, k as createDataRateLimiter, l as createDiscordProvider, lt as createApiKeyPreAuth, m as tryVerifyOidcIdToken, mt as extractBearerToken, n as createCustomAuthAdapter, nt as queryTokenAuth, o as createSlackProvider, ot as InvalidStorageKeyError, p as createMicrosoftProvider, pt as validateApiKey, q as html, r as createApiKeyRoutes, rt as requireAdmin, s as createBitbucketProvider, st as canonicalStorageBucket, tt as publicObjectAuth, u as createTwitterProvider, ut as createFunctionApiKeyGuard, v as createGoogleProvider, vt as httpMethodToOperation, w as _enum, x as providerVerifiedEmail, xt as resolveListLimitParam, y as oauthCodeFlowSchema, yt as isOperationAllowed, z as generateSecurePassword } from "./auth-DkAHqvf5.js";
+import { t as logger } from "./logger-DfvF_8r-.js";
+import { n as errorHandler, t as ApiError } from "./errors-B1WZEdsK.js";
+import { i as generateDownloadToken, n as configureJwt } from "./jwt-Cuq6MwNy.js";
 import { t as logMiddleware } from "./logs-routes-BYA72C_C.js";
 import { n as DOCUMENT_MIME_TYPES, r as IMAGE_MIME_TYPES, t as DEFAULT_MAX_FILE_SIZE } from "./types-DSnOC4mF.js";
 import { t as S3StorageController } from "./S3StorageController-B2EDXXMH.js";
 import { t as GCSStorageController } from "./GCSStorageController-BEmDYFKc.js";
-import { n as loadFunctionsFromDirectory } from "./function-loader-B_1fYfUY.js";
-import { t as createFunctionRoutes } from "./function-routes-C0cLIy3N.js";
-import { n as loadCronJobsFromDirectory } from "./cron-loader-B1S2MCSl.js";
-import { r as validateCronExpression, t as CronScheduler } from "./cron-scheduler-B3RFt0HS.js";
-import { t as createCronRoutes } from "./cron-routes-CrQ0tK-_.js";
-import { t as createCronStore } from "./cron-store-BywZsyfZ.js";
-import { a as parseBackupTimestamp, i as parseBackupDestination, n as createBackupRoutes, o as readBackupBytes, r as listBackupObjects } from "./backup-CVggVhR2.js";
-import { randomBytes, randomUUID } from "node:crypto";
+import { n as loadFunctionsFromDirectory } from "./function-loader-D1SwtCa5.js";
+import { t as createFunctionRoutes } from "./function-routes-Btcez1T-.js";
+import { n as loadCronJobsFromDirectory } from "./cron-loader-3U5aGILy.js";
+import { r as validateCronExpression, t as CronScheduler } from "./cron-scheduler-FJAaCAXm.js";
+import { t as createCronRoutes } from "./cron-routes-rZgwlOz4.js";
+import { t as createCronStore } from "./cron-store-9NmUDfzL.js";
+import { a as parseBackupTimestamp, i as parseBackupDestination, n as createBackupRoutes, o as readBackupBytes, r as listBackupObjects } from "./backup-DLluVyuA.js";
+import { createHash, randomBytes, randomUUID } from "node:crypto";
 import * as fs$2 from "fs";
 import fs, { existsSync } from "fs";
 import * as path$2 from "path";
@@ -31,79 +31,24 @@ import { Hono } from "hono";
 import { promisify } from "util";
 import * as crypto$1 from "crypto";
 import { createHmac, randomUUID as randomUUID$1 } from "crypto";
+import path$1 from "node:path";
 import { bodyLimit } from "hono/body-limit";
 import { csrf } from "hono/csrf";
 import { compress } from "hono/compress";
 import fs$1 from "node:fs";
 import fsp from "node:fs/promises";
+import os from "node:os";
 import { mkdir, open, unlink, writeFile } from "fs/promises";
 import { sql } from "drizzle-orm";
+import { lookup } from "node:dns/promises";
+import { isIP } from "node:net";
 import { serveStatic } from "@hono/node-server/serve-static";
 import { createServer } from "http";
 import { cors } from "hono/cors";
 import { secureHeaders } from "hono/secure-headers";
 import { getRequestListener } from "@hono/node-server";
-import path$1 from "node:path";
-import os from "node:os";
 import { execFile } from "node:child_process";
 import { promisify as promisify$1 } from "node:util";
-//#region ../types/src/errors.ts
-/**
-* The single error type thrown across the entire Rebase client surface —
-* HTTP data/control-plane calls, realtime/WebSocket operations, and
-* client-side logic errors (e.g. an unknown collection accessor). A `catch`
-* block only ever needs to check for this one class:
-*
-* ```ts
-* import { RebaseApiError } from "@rebasepro/client"; // re-exported
-*
-* try {
-*   await client.data.products.update(id, { price: 9 });
-* } catch (e) {
-*   if (e instanceof RebaseApiError) {
-*     if (e.status === 404) { ... }   // HTTP failures carry a status
-*     console.error(e.code, e.details);
-*   }
-* }
-* ```
-*
-* `status` is present for HTTP failures and `undefined` otherwise, so its
-* presence distinguishes transport-level errors from realtime/logic errors.
-*
-* @group Errors
-*/
-var RebaseApiError = class extends Error {
-	/** HTTP status code, or `undefined` for non-HTTP errors. */
-	status;
-	/** Stable machine-readable error code, when the server supplied one. */
-	code;
-	/** Structured error payload from the server, when present. */
-	details;
-	constructor(message, init = {}) {
-		super(message);
-		this.name = "RebaseApiError";
-		this.status = init.status;
-		this.code = init.code;
-		this.details = init.details;
-		if (init.cause !== void 0) this.cause = init.cause;
-	}
-};
-/**
-* Client-side logic error — raised before any request is made (e.g. accessing
-* an unknown collection accessor when a typed dictionary is configured).
-*
-* A subclass of {@link RebaseApiError} (with no `status`), so a single
-* `catch (e) { if (e instanceof RebaseApiError) ... }` handles it too.
-*
-* @group Errors
-*/
-var RebaseClientError = class extends RebaseApiError {
-	constructor(message) {
-		super(message);
-		this.name = "RebaseClientError";
-	}
-};
-//#endregion
 //#region ../types/src/types/storage_source.ts
 /**
 * Describes a named storage backend — a place files live.
@@ -250,23 +195,6 @@ function serializeOrderBy(orderBy) {
 	if (typeof orderBy === "string") return orderBy;
 	return `${orderBy[0]}:${orderBy[1]}`;
 }
-/**
-* Deserialize a wire-format `"field:direction"` string into an {@link OrderByTuple}.
-*
-* Lenient parsing (matches existing server behaviour):
-* - Bare field name (no colon): `"name"` → `["name", "asc"]`
-* - Unknown direction: `"name:foo"` → `["name", "asc"]`
-* - Empty / falsy input: → `undefined`
-*
-* @param raw - The wire-format string from an HTTP query parameter.
-* @returns The canonical tuple, or `undefined` if the input is empty/falsy.
-*/
-function deserializeOrderBy(raw) {
-	if (!raw) return void 0;
-	const idx = raw.indexOf(":");
-	if (idx === -1) return [raw, "asc"];
-	return [raw.slice(0, idx), raw.slice(idx + 1) === "desc" ? "desc" : "asc"];
-}
 //#endregion
 //#region src/collections/BackendCollectionRegistry.ts
 /**
@@ -311,7 +239,6 @@ function unknownKeyPolicyFromEnv(env = process.env) {
 	].includes(raw)) return "off";
 	return "warn";
 }
-/** `BaseCollectionConfig`, plus every engine-specific field, plus the `admin` block. */
 var COLLECTION_KEYS = /* @__PURE__ */ new Set([
 	"slug",
 	"name",
@@ -333,6 +260,7 @@ var COLLECTION_KEYS = /* @__PURE__ */ new Set([
 	"relations",
 	"securityRules",
 	"schema",
+	"search",
 	"path",
 	"subcollections",
 	"admin"
@@ -785,6 +713,20 @@ function isDataDriverDelegate(obj) {
 //#endregion
 //#region src/services/routed-realtime-service.ts
 /**
+* Channel/presence/broadcast messages are engine-agnostic pub/sub — which is
+* why they go to a provider that implements them, not to whichever provider a
+* bootstrapper happened to mark `isDefault`.
+*/
+var CHANNEL_MESSAGE_TYPES$1 = /* @__PURE__ */ new Set([
+	"join_channel",
+	"leave_channel",
+	"broadcast",
+	"presence_track",
+	"presence_untrack",
+	"presence_state",
+	"channel_history"
+]);
+/**
 * Compose multiple per-engine {@link RealtimeProvider}s into one that routes
 * each subscription to the provider owning the subscribed collection — the
 * realtime counterpart of `buildRoutedRebaseData`.
@@ -794,8 +736,9 @@ function isDataDriverDelegate(obj) {
 * - `subscribe_collection` / `subscribe_entity` → the provider for the
 *   collection's data source (by `payload.path`).
 * - `unsubscribe` → forwarded to all providers (a no-op on non-owners).
-* - channel / presence / broadcast → the default provider (these are global
-*   pub/sub, not bound to an engine).
+* - channel / presence / broadcast → the first provider that declares
+*   `supportsChannels` (these are global pub/sub, not bound to an engine — but
+*   they are not implemented by every engine either).
 * - `addClient` and lifecycle (`onServerReady`/`destroy`/`stopListening`) →
 *   all providers (each registers its own ws close handler for cleanup).
 */
@@ -809,6 +752,30 @@ function createRoutedRealtimeService(opts) {
 		const key = resolveKey(path);
 		return asWs(providers[key] ?? providers[defaultKey] ?? Object.values(providers)[0]);
 	};
+	/**
+	* The provider channel frames go to, resolved once and reported once.
+	*
+	* By capability, not by default-ness: the default provider is whichever
+	* bootstrapper set `isDefault`, and routing pub/sub there sends every
+	* broadcast, presence update and catch-up request into an engine that may
+	* not implement any of them. When the default *does* support channels it is
+	* still preferred, so single-engine behaviour is unchanged.
+	*/
+	let channelRouting;
+	const forChannels = () => {
+		if (!channelRouting) {
+			const entries = Object.entries(providers);
+			const supports = ([, p]) => asWs(p).supportsChannels === true;
+			const chosen = entries.find(([key]) => key === defaultKey && supports([key, providers[key]])) ?? entries.find(supports);
+			channelRouting = chosen ? {
+				provider: asWs(chosen[1]),
+				key: chosen[0]
+			} : {};
+			if (chosen) logger.info(`📡 [Realtime] Channels, presence and broadcast are served by the "${chosen[0]}" data source.`);
+			else logger.error(`❌ [Realtime] No configured realtime provider implements channels, presence or broadcast — every channel frame will be refused. Configured sources: [${entries.map(([k]) => k).join(", ")}]. Channels currently require a Postgres data source.`);
+		}
+		return channelRouting.provider;
+	};
 	return {
 		addClient(clientId, ws) {
 			for (const p of all()) p.addClient?.(clientId, ws);
@@ -823,6 +790,12 @@ function createRoutedRealtimeService(opts) {
 				await Promise.all(all().map((p) => p.handleClientMessage(clientId, message, authContext)));
 				return;
 			}
+			if (CHANNEL_MESSAGE_TYPES$1.has(type)) {
+				const provider = forChannels();
+				if (!provider) throw new Error(`Channels are not supported by any configured data source — "${type}" refused.`);
+				await provider.handleClientMessage(clientId, message, authContext);
+				return;
+			}
 			await fallback().handleClientMessage(clientId, message, authContext);
 		},
 		subscribeToCollection(subscriptionId, config, callback) {
@@ -849,173 +822,22 @@ function createRoutedRealtimeService(opts) {
 	};
 }
 //#endregion
-//#region src/api/rest/query-parser.ts
-function getLastValue(val) {
-	if (Array.isArray(val)) return val[val.length - 1];
-	return val;
-}
-/**
-* Parse an `or(...)` / `and(...)` logical group from its wire form.
-*
-* The wire carries the inner conditions wrapped in parens (e.g.
-* `(status.eq.active,age.gte.18)`); we re-attach the `or`/`and` prefix and
-* delegate to the canonical filter dialect (`@rebasepro/common`). Values are
-* preserved as strings — type coercion is the schema-aware driver's job, so
-* this path stays byte-for-byte consistent with the SDK/admin path (which
-* also parses via the shared dialect).
-*/
-function parseLogicalGroup(type, raw) {
-	let inner = String(raw).trim();
-	if (inner.startsWith("(") && inner.endsWith(")")) inner = inner.slice(1, -1);
-	inner = inner.trim();
-	if (!inner) return void 0;
-	const parsed = deserializeLogicalCondition(`${type}(${inner})`);
-	return "type" in parsed ? parsed : void 0;
-}
-/**
-* Parse the `?where=` JSON filter object.
-*
-* This is the dialect the OpenAPI document publishes on every
-* `GET /api/data/{slug}` — `{"status":["==","active"]}`: field → canonical
-* `[WhereFilterOp, value]` tuple. It is normalized through the same
-* `deserializeFilter` as the `?field=op.value` params below, so a value that
-* arrives as a PostgREST dot-string (`{"status":"eq.active"}`) or as a bare
-* scalar (`{"status":"active"}`) compiles to the same condition. Unlike the
-* querystring dialect, JSON carries types — a number stays a number.
-*
-* A malformed value is a 400 rather than a silent drop: dropping the filter
-* would run the read unfiltered and return everything RLS happens to allow.
-*/
-function parseWhereParam(raw) {
-	const str = String(raw).trim();
-	if (!str) return void 0;
-	let parsed;
-	try {
-		parsed = JSON.parse(str);
-	} catch {
-		throw ApiError.badRequest("Invalid `where` parameter: expected a JSON object, e.g. {\"status\":[\"==\",\"active\"]}", "INVALID_WHERE");
-	}
-	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw ApiError.badRequest("Invalid `where` parameter: expected a JSON object mapping fields to conditions, e.g. {\"status\":[\"==\",\"active\"]}", "INVALID_WHERE");
-	const filter = deserializeFilter(parsed);
-	return Object.keys(filter).length > 0 ? filter : void 0;
-}
-/**
-* Parse query parameters into QueryOptions
-*/
-function parseQueryOptions(query, limits = {}) {
-	const options = {};
-	const rawLimit = getLastValue(query.limit);
-	const offsetVal = getLastValue(query.offset);
-	if (offsetVal) options.offset = parseInt(String(offsetVal));
-	const pageVal = getLastValue(query.page);
-	if (pageVal) {
-		const page = parseInt(String(pageVal));
-		const limit = resolveClientListLimit(rawLimit, {
-			defaultLimit: limits.defaultLimit,
-			maxLimit: limits.maxLimit
-		});
-		options.offset = (page - 1) * limit;
-	}
-	const orVal = getLastValue(query.or);
-	const andVal = getLastValue(query.and);
-	if (orVal) {
-		const logical = parseLogicalGroup("or", orVal);
-		if (logical) options.logical = logical;
-	} else if (andVal) {
-		const logical = parseLogicalGroup("and", andVal);
-		if (logical) options.logical = logical;
-	}
-	const reservedQueryKeys = [
-		"limit",
-		"offset",
-		"page",
-		"orderBy",
-		"include",
-		"fields",
-		"searchString",
-		"vector_search",
-		"vector",
-		"vector_distance",
-		"vector_threshold",
-		"or",
-		"and",
-		"where"
-	];
-	const filterDict = {};
-	for (const [key, rawValue] of Object.entries(query)) {
-		if (reservedQueryKeys.includes(key)) continue;
-		filterDict[key] = rawValue;
-	}
-	const whereVal = getLastValue(query.where);
-	const where = {
-		...whereVal !== void 0 && whereVal !== null ? parseWhereParam(whereVal) : void 0,
-		...deserializeFilter(filterDict)
-	};
-	if (Object.keys(where).length > 0) options.where = where;
-	const orderByVal = getLastValue(query.orderBy);
-	if (orderByVal) try {
-		options.orderBy = typeof orderByVal === "string" ? JSON.parse(orderByVal) : orderByVal;
-	} catch {
-		if (typeof orderByVal === "string") {
-			const parsed = deserializeOrderBy(orderByVal);
-			if (parsed) options.orderBy = [{
-				field: parsed[0],
-				direction: parsed[1]
-			}];
-		}
-	}
-	const includeVal = getLastValue(query.include);
-	if (includeVal) {
-		const includeStr = String(includeVal).trim();
-		if (includeStr === "*") options.include = ["*"];
-		else options.include = includeStr.split(",").map((s) => s.trim()).filter(Boolean);
-	}
-	const fieldsVal = getLastValue(query.fields);
-	if (fieldsVal) options.fields = String(fieldsVal).trim().split(",").map((s) => s.trim()).filter(Boolean);
-	const vectorSearchVal = getLastValue(query.vector_search);
-	const vectorVal = getLastValue(query.vector);
-	if (vectorSearchVal && vectorVal) {
-		const vectorStr = String(vectorVal);
-		let decoded;
-		try {
-			decoded = JSON.parse(vectorStr);
-		} catch {
-			decoded = void 0;
-		}
-		if (!Array.isArray(decoded) || !decoded.every((v) => typeof v === "number")) throw ApiError.badRequest("Invalid `vector` format. Expected a JSON array of numbers, e.g. [0.1,0.2,0.3]", "INVALID_VECTOR");
-		const queryVector = decoded;
-		const distanceParamVal = getLastValue(query.vector_distance);
-		const distanceParam = distanceParamVal ? String(distanceParamVal) : "cosine";
-		if (distanceParam !== "cosine" && distanceParam !== "l2" && distanceParam !== "inner_product") throw ApiError.badRequest(`Invalid \`vector_distance\`: ${distanceParam}. Expected: cosine, l2, or inner_product`, "INVALID_VECTOR_DISTANCE");
-		const vectorSearch = {
-			property: String(vectorSearchVal),
-			vector: queryVector,
-			distance: distanceParam
-		};
-		const thresholdVal = getLastValue(query.vector_threshold);
-		if (thresholdVal) {
-			const threshold = parseFloat(String(thresholdVal));
-			if (isNaN(threshold)) throw ApiError.badRequest("Invalid `vector_threshold`. Expected a number.", "INVALID_VECTOR_THRESHOLD");
-			vectorSearch.threshold = threshold;
-		}
-		options.vectorSearch = vectorSearch;
-	}
-	options.limit = resolveClientListLimit(rawLimit, {
-		vectorSearch: !!options.vectorSearch,
-		defaultLimit: limits.defaultLimit,
-		maxLimit: limits.maxLimit
-	});
-	return options;
-}
-//#endregion
 //#region src/api/rest/write-validation.ts
 /**
 * Reject a write naming a field the collection does not have.
 *
-* Unknown keys used to travel all the way into the INSERT, where Postgres
-* rejected them — so a typo came back as `column "titel" does not exist`,
-* phrased by the database, from a stack the caller cannot see, and only if the
-* column really was absent. It is a request problem and belongs in a 400.
+* An unknown key does *not* reach the INSERT and come back as `column "titel"
+* does not exist`, which is what this comment used to claim. Drizzle builds
+* INSERT and UPDATE from the table's own column list, so a key the table does
+* not carry is left out of the statement: the write answers 201 having stored
+* nothing under that name. A typo is a request problem, it belongs in a 400,
+* and nothing below this was ever going to raise one.
+*
+* This is the config-level check and it is skipped on several paths (see the
+* `strictWrites` bail below, and the auth-adapter contract at the call site).
+* `assertWritableColumns` in the Postgres driver is the backstop every write
+* passes through, including in-process `rebase.data` writes that never come
+* near this layer.
 *
 * What counts as known:
 * - a declared property (for an introspected BaaS collection these *are* the
@@ -1043,6 +865,145 @@ function assertKnownWriteFields(values, collection, options) {
 	throw ApiError.badRequest(`${where}'${collection.slug}' has no field${unknown.length > 1 ? "s" : ""} ${unknown.map((f) => `'${f}'`).join(", ")}. Known fields: ${[...known].sort().map((f) => `'${f}'`).join(", ")}.`, "VALIDATION_UNKNOWN_FIELDS");
 }
 /**
+* The number a constraint should judge, or `undefined` if the value is not one.
+*
+* A JSON body may carry `"5"` for a number column and Postgres accepts it, so
+* the string form is judged too — refusing to look at it would leave the exact
+* bypass this function exists to close.
+*/
+function asNumber(value) {
+	if (typeof value === "number") return Number.isNaN(value) ? void 0 : value;
+	if (typeof value === "string" && value.trim() !== "") {
+		const parsed = Number(value);
+		return Number.isNaN(parsed) ? void 0 : parsed;
+	}
+}
+/** The instant a constraint should judge, or `undefined` if the value is not one. */
+function asDate(value) {
+	if (value instanceof Date) return Number.isNaN(value.getTime()) ? void 0 : value;
+	if (typeof value === "string" || typeof value === "number") {
+		const parsed = new Date(value);
+		return Number.isNaN(parsed.getTime()) ? void 0 : parsed;
+	}
+}
+/**
+* `validation.matches` as a regex that can be tested repeatedly.
+*
+* A `RegExp` carrying `g` or `y` keeps `lastIndex` between calls, so the same
+* pattern would accept and reject the same value on alternate rows of a bulk
+* write. Rebuilt without those flags.
+*/
+function toPattern(matches) {
+	try {
+		if (typeof matches === "string") return new RegExp(matches);
+		return new RegExp(matches.source, matches.flags.replace(/[gy]/g, ""));
+	} catch {
+		return;
+	}
+}
+function collectViolations(key, property, value, into) {
+	if (value === null || value === void 0) return;
+	switch (property.type) {
+		case "string": {
+			const rules = property.validation;
+			if (!rules || typeof value !== "string") return;
+			if (rules.length !== void 0 && value.length !== rules.length) into.push(`'${key}' must be exactly ${rules.length} character${rules.length === 1 ? "" : "s"} long (received ${value.length}).`);
+			if (rules.min !== void 0 && value.length < rules.min) into.push(`'${key}' must be at least ${rules.min} character${rules.min === 1 ? "" : "s"} long (received ${value.length}).`);
+			if (rules.max !== void 0 && value.length > rules.max) into.push(`'${key}' must be at most ${rules.max} character${rules.max === 1 ? "" : "s"} long (received ${value.length}).`);
+			if (rules.matches !== void 0) {
+				const pattern = toPattern(rules.matches);
+				if (pattern && !pattern.test(value)) into.push(rules.matchesMessage ?? `'${key}' does not match the required pattern ${pattern}.`);
+			}
+			return;
+		}
+		case "number": {
+			const rules = property.validation;
+			if (!rules) return;
+			const num = asNumber(value);
+			if (num === void 0) return;
+			if (rules.integer && !Number.isInteger(num)) into.push(`'${key}' must be a whole number (received ${num}).`);
+			if (rules.positive && !(num > 0)) into.push(`'${key}' must be positive (received ${num}).`);
+			if (rules.negative && !(num < 0)) into.push(`'${key}' must be negative (received ${num}).`);
+			if (rules.min !== void 0 && num < rules.min) into.push(`'${key}' must be at least ${rules.min} (received ${num}).`);
+			if (rules.max !== void 0 && num > rules.max) into.push(`'${key}' must be at most ${rules.max} (received ${num}).`);
+			if (rules.moreThan !== void 0 && !(num > rules.moreThan)) into.push(`'${key}' must be greater than ${rules.moreThan} (received ${num}).`);
+			if (rules.lessThan !== void 0 && !(num < rules.lessThan)) into.push(`'${key}' must be less than ${rules.lessThan} (received ${num}).`);
+			return;
+		}
+		case "date": {
+			const rules = property.validation;
+			if (!rules) return;
+			const date = asDate(value);
+			if (date === void 0) return;
+			const min = rules.min !== void 0 ? asDate(rules.min) : void 0;
+			const max = rules.max !== void 0 ? asDate(rules.max) : void 0;
+			if (min && date.getTime() < min.getTime()) into.push(`'${key}' must not be before ${min.toISOString()}.`);
+			if (max && date.getTime() > max.getTime()) into.push(`'${key}' must not be after ${max.toISOString()}.`);
+			return;
+		}
+		case "array": {
+			if (!Array.isArray(value)) return;
+			const rules = property.validation;
+			if (rules?.min !== void 0 && value.length < rules.min) into.push(`'${key}' must have at least ${rules.min} item${rules.min === 1 ? "" : "s"} (received ${value.length}).`);
+			if (rules?.max !== void 0 && value.length > rules.max) into.push(`'${key}' must have at most ${rules.max} item${rules.max === 1 ? "" : "s"} (received ${value.length}).`);
+			const of = property.of;
+			if (of && !Array.isArray(of)) value.forEach((item, index) => collectViolations(`${key}[${index}]`, of, item, into));
+			return;
+		}
+		case "map": {
+			if (typeof value !== "object" || value === null || Array.isArray(value)) return;
+			const properties = property.properties;
+			if (!properties) return;
+			for (const [subKey, subValue] of Object.entries(value)) {
+				const subProperty = properties[subKey];
+				if (subProperty) collectViolations(`${key}.${subKey}`, subProperty, subValue, into);
+			}
+			return;
+		}
+		default:
+	}
+}
+/**
+* Reject a write whose values break the constraints the collection declares.
+*
+* `validation.min`, `max`, `matches`, `positive`, `integer` and the date and
+* array bounds were read by exactly three things: the DDL generators (for
+* `integer` and for a `varchar` width), and the admin's client-side form. No
+* layer on the write path looked at them, no `CHECK` constraint was emitted,
+* and the generated OpenAPI published every one of them as `minimum`,
+* `maximum`, `minLength`, `maxLength` and `pattern`. So the docs' own example —
+* `price: { type: "number", validation: { min: 0 } }` — accepted `-5000` with a
+* 201 while the spec said it would not, and any client or gateway generated
+* from that spec believed the server was checking.
+*
+* Only `required` is left to the database, where it is a NOT NULL: a partial
+* update legitimately omits keys, and this function sees one request's values,
+* not the row they land on.
+*
+* A value of the wrong *type* is not this function's business — that reaches
+* Postgres, which types every column and gives a 400 through the driver's
+* SQLSTATE mapping. Constraints are checked against values of the right type,
+* plus the numeric-string form a JSON body may carry for a number column.
+*
+* Every failing field is reported at once. A form that fixes one field per
+* round trip is the reason validation errors get ignored.
+*/
+function assertWriteValuesValid(values, collection, options) {
+	const properties = collection.properties;
+	if (!properties || !values) return;
+	const violations = [];
+	for (const [key, value] of Object.entries(values)) {
+		const property = properties[key];
+		if (property) collectViolations(key, property, value, violations);
+	}
+	if (violations.length === 0) return;
+	const where = options?.rowIndex !== void 0 ? `Row ${options.rowIndex}: ` : "";
+	throw ApiError.badRequest(`${where}${violations.join(" ")}`, "VALIDATION_CONSTRAINT", {
+		collection: collection.slug,
+		violations
+	});
+}
+/**
 * Narrow response rows to the fields the caller asked for.
 *
 * `?fields=id,title` is documented in the generated OpenAPI — "Comma-separated
@@ -1055,11 +1016,18 @@ function assertKnownWriteFields(values, collection, options) {
 * This shapes the *response*, which is what the parameter says it does; it is
 * not a column pushdown, so it saves bandwidth rather than database work.
 *
-* `id` always survives. Rows are addressed by it everywhere above this layer —
-* the admin table, realtime reconciliation, the offline cache — and a row that
-* arrives without one is not a smaller row, it is an unusable one. Asking for
-* `fields=title` and being unable to open the record you clicked is a worse
-* answer than one extra key.
+* The collection's key always survives. Rows are addressed by it everywhere
+* above this layer — the admin table, realtime reconciliation, the offline
+* cache — and a row that arrives without one is not a smaller row, it is an
+* unusable one. Asking for `fields=title` and being unable to open the record
+* you clicked is a worse answer than one extra key.
+*
+* That is a statement about the key, not about the name `id`: a collection
+* keyed on `slug`, or on `user_id + role_id`, was projected down to the fields
+* asked for and nothing else, which is the very outcome the paragraph above
+* describes. `assertKnownWriteFields` one function up already has a dedicated
+* error for collections with no `id` column, so this layer had no excuse for
+* assuming one.
 */
 function projectResponseFields(rows, fields, collection, options) {
 	if (!fields || fields.length === 0) return rows;
@@ -1077,7 +1045,8 @@ function projectResponseFields(rows, fields, collection, options) {
 			collection: collection.slug
 		});
 	}
-	const keep = /* @__PURE__ */ new Set([...fields, "id"]);
+	const primaryKeys = resolvePrimaryKeys(collection).map((key) => key.fieldName);
+	const keep = /* @__PURE__ */ new Set([...fields, ...primaryKeys.length > 0 ? primaryKeys : ["id"]]);
 	return rows.map((row) => {
 		const projected = {};
 		for (const key of Object.keys(row)) if (keep.has(key)) projected[key] = row[key];
@@ -1102,6 +1071,9 @@ function projectResponseFields(rows, fields, collection, options) {
 * generated on the client, so keying on the id alone would let anyone who
 * learned (or guessed) another user's id replay their key and be handed that
 * user's row back — a read of someone else's data through a write endpoint.
+* That is also why an unauthenticated caller gets no idempotency at all: every
+* anonymous request shares one principal, so honouring a key there would hand
+* one visitor's stored response to the next one who sent the same string.
 */
 var TABLE = "\"rebase\".\"idempotency_keys\"";
 /**
@@ -1112,15 +1084,75 @@ var TABLE = "\"rebase\".\"idempotency_keys\"";
 */
 var TTL_HOURS = 24;
 /**
-* The principal a key belongs to; anonymous and service writes share a sentinel.
+* How long a claim that has not answered yet is presumed to still be running.
+*
+* A claim is taken before the write and given back after it, so every exit the
+* process does not survive — a rolled pod, an OOM kill, a node drain, a
+* `complete` that itself fails — leaves the row pending with nobody coming back
+* for it. Reusing the 24-hour replay window as the lease made that
+* indistinguishable from a request still in flight, so every retry of that key
+* was refused for a day: the mechanism turned a write that plain retrying would
+* have completed into permanent loss, which is worse than not having it at all.
+*
+* The number trades the two ways it can be wrong, and both are bounded. Too
+* short and a genuinely slow write has its key taken over by its own retry —
+* the duplicate this exists to prevent. Too long and a crashed claim refuses
+* its retries for that long. A minute outlasts any write the row cap allows
+* and stays well inside the window the offline queue keeps retrying for.
+*/
+var PENDING_LEASE_SECONDS = 60;
+/**
+* How long to wait before attempting the table creation again after it failed.
 *
-* The NUL is written as an escape, not as a raw byte in the source. The
-* sentinel itself is deliberate — a uid can never contain one — but written
-* literally it makes this file test as binary, and every repo-wide grep then
-* skips all 124 lines of it silently. Identical at runtime.
+* `ensure`'s answer used to be memoised unconditionally, so one transient DDL
+* failure — a database still starting, a lock on the `rebase` schema, a sibling
+* pod running the same `CREATE TABLE IF NOT EXISTS` — disabled idempotency on
+* that pod for the life of the process after a single log line. A failure is
+* retried instead, and the cooldown is what stops every keyed request re-running
+* DDL against a database that is genuinely unhappy.
+*/
+var ENSURE_RETRY_COOLDOWN_MS = 3e4;
+/**
+* The principal a key belongs to, or `undefined` when there is nobody to scope
+* it to and the key must therefore be ignored.
+*
+* Anonymous callers are a supported configuration — `auth.requireAuth: false`
+* delegates access control to RLS — and they used to share one sentinel
+* principal, which is exactly the cross-principal replay the note above says
+* must not happen: two visitors of a public form who send the same key string
+* are handed each other's stored response. Refusing the key degrades them to no
+* idempotency, which is what they had before this table existed.
 */
 function principal(uid) {
-	return uid && uid.length > 0 ? uid : "\0anon";
+	return uid && uid.length > 0 ? uid : void 0;
+}
+/**
+* A stable rendering of a JSON value: one body always produces one string,
+* whatever order its keys arrived in.
+*
+* `JSON.stringify` preserves insertion order, so two encodings of the same
+* object would fingerprint differently and a legitimate retry would be refused
+* as a reused key. Only JSON types reach here — the value came from `JSON.parse`.
+*/
+function stableStringify(value) {
+	if (value === null || typeof value !== "object") return JSON.stringify(value) ?? "null";
+	if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`;
+	return `{${Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([k, v]) => `${JSON.stringify(k)}:${stableStringify(v)}`).join(",")}}`;
+}
+/**
+* What a key was claimed *for*, so presenting it on a different request is
+* caught instead of silently replaying the first one's answer.
+*
+* Nothing about the request used to enter the key, so `createMany(rows, { key })`
+* followed by `deleteMany(ids, { key })` — the reusable business id the docs
+* recommended — answered the delete with the create's `200` body and deleted
+* nothing. Method and path separate the routes; the body separates a re-run
+* carrying corrected rows from the retry of an unanswered one, which is the
+* difference between "here is your earlier answer" and silently discarding a
+* correction.
+*/
+function requestFingerprint(method, path, body) {
+	return createHash("sha256").update(`${method.toUpperCase()} ${path}\n${stableStringify(body)}`).digest("hex");
 }
 /**
 * Returns `undefined` when the driver cannot run SQL, which disables the whole
@@ -1137,9 +1169,19 @@ function createIdempotencyStore(driver) {
 	if (!isSQLAdmin(admin)) return void 0;
 	const exec = (sql, params) => admin.executeSql(sql, params ? { params } : void 0);
 	let ready;
+	let retryEnsureAt = 0;
+	let warnedAnonymous = false;
+	/** Said once per process: it is a deployment fact, not a per-request event. */
+	const warnAnonymous = () => {
+		if (warnedAnonymous) return;
+		warnedAnonymous = true;
+		logger.warn("Idempotency-Key ignored for an unauthenticated request — keys are scoped to a signed-in principal, and honouring one here would replay a stored response to whoever sends the same key next. A replayed write from an anonymous client may insert a duplicate row.");
+	};
 	/** Created on first use: most deployments never send a key at all. */
 	const ensure = () => {
-		ready ??= (async () => {
+		if (ready) return ready;
+		if (Date.now() < retryEnsureAt) return Promise.resolve(false);
+		ready = (async () => {
 			try {
 				await exec("CREATE SCHEMA IF NOT EXISTS rebase");
 				await exec(`
@@ -1151,36 +1193,71 @@ function createIdempotencyStore(driver) {
                         PRIMARY KEY (uid, key)
                     )
                 `);
+				await exec(`ALTER TABLE ${TABLE} ADD COLUMN IF NOT EXISTS fingerprint TEXT`);
 				await exec(`CREATE INDEX IF NOT EXISTS idx_idempotency_created ON ${TABLE}(created_at)`);
+				await exec(revokeInternalTableSql("rebase", "idempotency_keys"));
 				return true;
 			} catch (error) {
+				retryEnsureAt = Date.now() + ENSURE_RETRY_COOLDOWN_MS;
 				logger.warn("Idempotency keys unavailable — a replayed offline write may insert a duplicate row.", { detail: error instanceof Error ? error.message : String(error) });
 				return false;
 			}
-		})();
+		})().then((ok) => {
+			if (!ok) ready = void 0;
+			return ok;
+		});
 		return ready;
 	};
 	return {
-		async recall(key, uid) {
-			if (!key || !await ensure()) return void 0;
+		async claim(key, uid, fingerprint) {
+			const owner = principal(uid);
+			if (key && !owner) warnAnonymous();
+			if (!key || !owner || !await ensure()) return { status: "claimed" };
 			try {
-				return (await exec(`SELECT response FROM ${TABLE}
-                     WHERE uid = $1 AND key = $2 AND created_at > NOW() - INTERVAL '${TTL_HOURS} hours'`, [principal(uid), key]))[0]?.response;
+				if ((await exec(`INSERT INTO ${TABLE} (key, uid, fingerprint, response, created_at)
+                     VALUES ($1, $2, $3, NULL, NOW())
+                     ON CONFLICT (uid, key) DO UPDATE
+                       SET response = NULL, created_at = NOW(), fingerprint = EXCLUDED.fingerprint
+                       WHERE (${TABLE}.response IS NULL
+                              AND ${TABLE}.created_at < NOW() - INTERVAL '${PENDING_LEASE_SECONDS} seconds')
+                          OR (${TABLE}.response IS NOT NULL
+                              AND ${TABLE}.created_at < NOW() - INTERVAL '${TTL_HOURS} hours')
+                     RETURNING 1 AS claimed`, [
+					key,
+					owner,
+					fingerprint
+				])).length > 0) return { status: "claimed" };
+				const row = (await exec(`SELECT response, response IS NULL AS pending, fingerprint FROM ${TABLE}
+                     WHERE uid = $1 AND key = $2`, [owner, key]))[0];
+				if (!row) return { status: "claimed" };
+				if (row.fingerprint != null && row.fingerprint !== fingerprint) return { status: "mismatch" };
+				if (row.pending) return { status: "in-flight" };
+				return {
+					status: "replay",
+					response: row.response
+				};
 			} catch {
-				return;
+				return { status: "claimed" };
 			}
 		},
-		async remember(key, uid, response) {
-			if (!key || !await ensure()) return;
+		async complete(key, uid, response) {
+			const owner = principal(uid);
+			if (!key || !owner || !await ensure()) return;
 			try {
-				await exec(`INSERT INTO ${TABLE} (key, uid, response) VALUES ($1, $2, $3::jsonb)
-                     ON CONFLICT (uid, key) DO NOTHING`, [
+				await exec(`UPDATE ${TABLE} SET response = $3::jsonb WHERE uid = $1 AND key = $2`, [
+					owner,
 					key,
-					principal(uid),
 					JSON.stringify(response ?? null)
 				]);
 				if (Math.random() < .01) await exec(`DELETE FROM ${TABLE} WHERE created_at < NOW() - INTERVAL '${TTL_HOURS} hours'`);
 			} catch {}
+		},
+		async release(key, uid) {
+			const owner = principal(uid);
+			if (!key || !owner || !await ensure()) return;
+			try {
+				await exec(`DELETE FROM ${TABLE} WHERE uid = $1 AND key = $2 AND response IS NULL`, [owner, key]);
+			} catch {}
 		}
 	};
 }
@@ -1204,6 +1281,18 @@ async function parseJsonBody(c) {
 	}
 }
 /**
+* A live key presented on a different request than the one it was claimed for.
+*
+* Refused rather than replayed, because the replay is the dangerous answer: a
+* delete sent under the key of an earlier create used to be handed the create's
+* `200` and its rows, so the caller saw a success for rows that are still
+* there. A `422` names the mistake instead — the key is well-formed, the
+* request is not repeatable under it.
+*/
+function idempotencyKeyReused(key) {
+	return new ApiError(422, "IDEMPOTENCY_KEY_REUSED", `Idempotency-Key '${key}' was already used for a different request. A key names one write: use a new key for each distinct request, and re-send the identical request to replay its answer.`);
+}
+/**
 * Lightweight REST API generator that leverages existing Rebase DataDriver.
 * Supports `include` query parameter for eager-loading relations via Drizzle.
 */
@@ -1283,7 +1372,7 @@ var RestApiGenerator = class {
 	* Needed so a nested write can be checked against a schema at all. Without
 	* it these routes skipped `assertKnownWriteFields` entirely, which is why a
 	* typo `POST /posts` rejected with a 400 while the same typo on
-	* `POST /authors/1/posts` reached the database.
+	* `POST /authors/1/posts` was dropped from the statement and answered 201.
 	*
 	* Returns `undefined` rather than throwing when the path cannot be walked:
 	* the driver raises the authoritative error a moment later, and duplicating
@@ -1333,6 +1422,7 @@ var RestApiGenerator = class {
 			const queryDict = c.req.queries();
 			const queryOptions = this.parseQuery(queryDict);
 			const searchString = Array.isArray(queryDict.searchString) ? queryDict.searchString[queryDict.searchString.length - 1] : void 0;
+			const searchExplain = (Array.isArray(queryDict.searchExplain) ? queryDict.searchExplain[queryDict.searchExplain.length - 1] : void 0) === "true";
 			const driver = this.getScopedDriver(c);
 			const fetchService = driver.restFetchService;
 			const entities = fetchService ? await fetchService.fetchCollectionForRest(collection.slug, {
@@ -1343,6 +1433,7 @@ var RestApiGenerator = class {
 				orderBy: queryOptions.orderBy?.[0]?.field,
 				order: queryOptions.orderBy?.[0]?.direction === "desc" ? "desc" : "asc",
 				searchString,
+				searchExplain,
 				vectorSearch: queryOptions.vectorSearch
 			}, queryOptions.include) : await this.fetchRawCollection(driver, resolvedCollection, queryOptions, searchString);
 			const total = await this.countRawEntities(driver, resolvedCollection, queryOptions, searchString);
@@ -1367,121 +1458,241 @@ var RestApiGenerator = class {
 			if (!entity) throw ApiError.notFound("Entity not found");
 			return c.json(projectResponseFields([entity], queryOptions.fields, resolvedCollection, { include: queryOptions.include })[0]);
 		});
+		/**
+		* Run a bulk handler under an idempotency key.
+		*
+		* All three bulk routes need the identical claim-before-write dance —
+		* claim, replay on a repeat, 409 while one is in flight, release on
+		* failure, complete on success — and getting one of those steps wrong
+		* is exactly the bug the key exists to prevent. Written once so the
+		* three cannot drift into three different notions of "already done".
+		*
+		* `body` is what the key is claimed *for*: the same key on a different
+		* request is a caller mistake, and replaying a create's answer to a
+		* delete would report a deletion that never happened.
+		*/
+		const withIdempotency = async (c, body, run, respond) => {
+			const idempotencyKey = c.req.header(IDEMPOTENCY_HEADER);
+			const uid = c.get("user")?.uid;
+			const store = this.idempotency();
+			const claimed = idempotencyKey && store ? await store.claim(idempotencyKey, uid, requestFingerprint(c.req.method, c.req.path, body)) : void 0;
+			if (claimed?.status === "replay") return respond(claimed.response);
+			if (claimed?.status === "mismatch") throw idempotencyKeyReused(idempotencyKey);
+			if (claimed?.status === "in-flight") throw ApiError.conflict(`A request with Idempotency-Key '${idempotencyKey}' is already in progress. Retry once it has answered; its result will be replayed.`, "IDEMPOTENCY_KEY_IN_PROGRESS");
+			let response;
+			try {
+				response = await run();
+			} catch (error) {
+				if (claimed?.status === "claimed" && idempotencyKey && store) await store.release(idempotencyKey, uid);
+				throw error;
+			}
+			if (claimed?.status === "claimed" && idempotencyKey && store) await store.complete(idempotencyKey, uid, response);
+			return respond(response);
+		};
+		/**
+		* Validate the envelope every bulk route shares: an array, non-empty,
+		* of objects, within the row cap.
+		*
+		* The cap is the load-bearing one. A batch is a single transaction that
+		* holds its locks for its whole duration, so an unbounded one is a
+		* self-inflicted outage — and the message names both the limit and the
+		* actual count so the caller can chunk to it rather than guess.
+		*/
+		const assertBulkShape = (items, field, requireObjects) => {
+			if (!Array.isArray(items)) throw ApiError.badRequest(`Expected a JSON body of { ${field}: [...] }.`, "INVALID_BULK_BODY");
+			if (requireObjects && items.some((it) => typeof it !== "object" || it === null || Array.isArray(it))) throw ApiError.badRequest(`Every entry in \`${field}\` must be an object.`, "INVALID_BULK_BODY");
+			if (items.length > this.maxBulkRows) throw ApiError.badRequest(`Too many rows: ${items.length} exceeds the ${this.maxBulkRows}-row limit for a single bulk write. Send it in chunks of ${this.maxBulkRows} or fewer.`, "BULK_TOO_LARGE");
+		};
 		this.router.post(`${basePath}/bulk`, async (c) => {
 			this.enforceApiKeyPermission(c, collection.slug);
 			const driver = this.getScopedDriver(c);
 			const path = collection.slug;
 			const body = await parseJsonBody(c);
-			if (!Array.isArray(body?.rows)) throw ApiError.badRequest("Expected a JSON body of { rows: [...] }.", "INVALID_BULK_BODY");
-			if (body.rows.length === 0) return c.json({
+			assertBulkShape(body?.rows, "rows", true);
+			const rows = body.rows;
+			if (rows.length === 0) return c.json({
 				data: [],
 				meta: { written: 0 }
 			});
-			if (body.rows.some((row) => typeof row !== "object" || row === null || Array.isArray(row))) throw ApiError.badRequest("Every entry in `rows` must be an object.", "INVALID_BULK_BODY");
 			if (body.upsert !== void 0 && typeof body.upsert !== "boolean") throw ApiError.badRequest("`upsert` must be a boolean.", "INVALID_BULK_BODY");
-			const maxRows = this.maxBulkRows;
-			if (body.rows.length > maxRows) throw ApiError.badRequest(`Too many rows: ${body.rows.length} exceeds the ${maxRows}-row limit for a single bulk write. Send it in chunks of ${maxRows} or fewer.`, "BULK_TOO_LARGE");
 			if (!driver.saveMany) throw ApiError.badRequest("This collection's data source does not support bulk writes.", "BULK_UNSUPPORTED");
-			body.rows.forEach((row, rowIndex) => assertKnownWriteFields(row, resolvedCollection, { rowIndex }));
-			const rows = await driver.saveMany({
-				path,
-				rows: body.rows,
-				collection: resolvedCollection,
-				upsert: body.upsert === true
+			rows.forEach((row, rowIndex) => {
+				assertKnownWriteFields(row, resolvedCollection, { rowIndex });
+				assertWriteValuesValid(row, resolvedCollection, { rowIndex });
 			});
-			return c.json({
-				data: rows.map((row) => this.formatResponse(row)),
-				meta: { written: rows.length }
+			return withIdempotency(c, body, async () => {
+				const written = await driver.saveMany({
+					path,
+					rows,
+					collection: resolvedCollection,
+					upsert: body.upsert === true
+				});
+				return {
+					data: written.map((row) => this.formatResponse(row)),
+					meta: { written: written.length }
+				};
+			}, (result) => c.json(result));
+		});
+		this.router.patch(`${basePath}/bulk`, async (c) => {
+			this.enforceApiKeyPermission(c, collection.slug);
+			const driver = this.getScopedDriver(c);
+			const path = collection.slug;
+			const body = await parseJsonBody(c);
+			assertBulkShape(body?.updates, "updates", true);
+			const updates = body.updates;
+			if (updates.length === 0) return c.json({
+				data: [],
+				meta: { written: 0 }
+			});
+			if (!driver.updateMany) throw ApiError.badRequest("This collection's data source does not support bulk updates.", "BULK_UNSUPPORTED");
+			updates.forEach((entry, rowIndex) => {
+				if (entry.id === void 0 || entry.id === null || entry.id === "") throw ApiError.badRequest(`Entry ${rowIndex} of \`updates\` is missing \`id\`. Each entry must be { id, data }.`, "INVALID_BULK_BODY");
+				if (typeof entry.data !== "object" || entry.data === null || Array.isArray(entry.data)) throw ApiError.badRequest(`Entry ${rowIndex} of \`updates\` is missing \`data\`, or it is not an object.`, "INVALID_BULK_BODY");
+				assertKnownWriteFields(entry.data, resolvedCollection, { rowIndex });
+				assertWriteValuesValid(entry.data, resolvedCollection, { rowIndex });
 			});
+			return withIdempotency(c, body, async () => {
+				const written = await driver.updateMany({
+					path,
+					updates: updates.map((entry) => ({
+						id: entry.id,
+						values: entry.data
+					})),
+					collection: resolvedCollection
+				});
+				return {
+					data: written.map((row) => this.formatResponse(row)),
+					meta: { written: written.length }
+				};
+			}, (result) => c.json(result));
+		});
+		this.router.post(`${basePath}/bulk/delete`, async (c) => {
+			this.enforceApiKeyPermission(c, collection.slug);
+			const driver = this.getScopedDriver(c);
+			const path = collection.slug;
+			const body = await parseJsonBody(c);
+			assertBulkShape(body?.ids, "ids", false);
+			const ids = body.ids;
+			if (ids.length === 0) return c.json({ meta: { deleted: 0 } });
+			if (ids.some((id) => typeof id !== "string" && typeof id !== "number")) throw ApiError.badRequest("Every entry in `ids` must be a string or a number.", "INVALID_BULK_BODY");
+			if (!driver.deleteMany) throw ApiError.badRequest("This collection's data source does not support bulk deletes.", "BULK_UNSUPPORTED");
+			return withIdempotency(c, body, async () => {
+				await driver.deleteMany({
+					path,
+					ids,
+					collection: resolvedCollection
+				});
+				return { meta: { deleted: ids.length } };
+			}, (result) => c.json(result));
 		});
 		this.router.post(basePath, async (c) => {
-			try {
-				this.enforceApiKeyPermission(c, collection.slug);
-				const driver = this.getScopedDriver(c);
-				const path = collection.slug;
-				const body = await parseJsonBody(c);
-				const isAuth = collection.auth;
-				const isAuthCollection = isAuth === true || isAuth && typeof isAuth === "object" && isAuth.enabled === true;
-				const collectionAuthConfig = typeof isAuth === "object" ? isAuth : void 0;
-				if (!isAuthCollection) assertKnownWriteFields(body, resolvedCollection);
-				else {
-					const contract = this.authAdapter?.describeUserCreationContract?.(collectionAuthConfig);
-					if (contract?.validate) assertKnownWriteFields(body, resolvedCollection, { extraKnownFields: contract.extraFields });
-				}
-				if (isAuthCollection && this.authAdapter?.prepareUserCreation) {
-					const prepared = await this.authAdapter.prepareUserCreation(body, collectionAuthConfig);
-					const entity = await driver.save({
-						path,
-						values: prepared.values,
-						collection: resolvedCollection,
-						status: "new"
-					});
-					const result = prepared.hookHandledEmail ? {
-						temporaryPassword: prepared.clearPassword,
-						invitationSent: prepared.invitationSent
-					} : this.authAdapter.finalizeUserCreation ? await this.authAdapter.finalizeUserCreation({
-						id: entity.id,
-						values: entity
-					}, prepared.clearPassword) : { invitationSent: false };
-					const response = this.formatResponse(entity);
-					return c.json({
-						...response,
-						invitationSent: result.invitationSent,
-						...result.temporaryPassword ? { temporaryPassword: result.temporaryPassword } : {},
-						..."emailDeliveryFailed" in result && result.emailDeliveryFailed ? { emailDeliveryFailed: true } : {}
-					}, 201);
-				}
-				const idempotencyKey = c.req.header(IDEMPOTENCY_HEADER);
-				const uid = c.get("user")?.uid;
-				const store = this.idempotency();
-				if (idempotencyKey && store) {
-					const already = await store.recall(idempotencyKey, uid);
-					if (already !== void 0) return c.json(already, 201);
+			this.enforceApiKeyPermission(c, collection.slug);
+			const driver = this.getScopedDriver(c);
+			const path = collection.slug;
+			const body = await parseJsonBody(c);
+			const isAuth = collection.auth;
+			const isAuthCollection = isAuth === true || isAuth && typeof isAuth === "object" && isAuth.enabled === true;
+			const collectionAuthConfig = typeof isAuth === "object" ? isAuth : void 0;
+			if (!isAuthCollection) {
+				assertKnownWriteFields(body, resolvedCollection);
+				assertWriteValuesValid(body, resolvedCollection);
+			} else {
+				const contract = this.authAdapter?.describeUserCreationContract?.(collectionAuthConfig);
+				if (contract?.validate) {
+					assertKnownWriteFields(body, resolvedCollection, { extraKnownFields: contract.extraFields });
+					assertWriteValuesValid(body, resolvedCollection);
 				}
+			}
+			if (isAuthCollection && this.authAdapter?.prepareUserCreation) {
+				const prepared = await this.authAdapter.prepareUserCreation(body, collectionAuthConfig);
 				const entity = await driver.save({
 					path,
-					values: body,
+					values: prepared.values,
 					collection: resolvedCollection,
 					status: "new"
 				});
+				const result = prepared.hookHandledEmail ? {
+					temporaryPassword: prepared.clearPassword,
+					invitationSent: prepared.invitationSent
+				} : this.authAdapter.finalizeUserCreation ? await this.authAdapter.finalizeUserCreation({
+					id: entity.id,
+					values: entity
+				}, prepared.clearPassword) : { invitationSent: false };
 				const response = this.formatResponse(entity);
-				if (idempotencyKey && store) await store.remember(idempotencyKey, uid, response);
-				return c.json(response, 201);
-			} catch (error) {
-				if (isRebaseApiError(error) && !error.code) {
-					if (!(error instanceof TypeError || error instanceof RangeError || error instanceof SyntaxError || error instanceof ReferenceError)) error.code = "BAD_REQUEST";
-				}
-				throw error;
+				return c.json({
+					...response,
+					invitationSent: result.invitationSent,
+					...result.temporaryPassword ? { temporaryPassword: result.temporaryPassword } : {},
+					..."emailDeliveryFailed" in result && result.emailDeliveryFailed ? { emailDeliveryFailed: true } : {}
+				}, 201);
 			}
-		});
-		this.router.put(`${basePath}/:id`, async (c) => {
+			const idempotencyKey = c.req.header(IDEMPOTENCY_HEADER);
+			const uid = c.get("user")?.uid;
+			const store = this.idempotency();
+			const claimed = idempotencyKey && store ? await store.claim(idempotencyKey, uid, requestFingerprint(c.req.method, c.req.path, body)) : void 0;
+			if (claimed?.status === "replay") return c.json(claimed.response, 201);
+			if (claimed?.status === "mismatch") throw idempotencyKeyReused(idempotencyKey);
+			if (claimed?.status === "in-flight") throw ApiError.conflict(`A request with Idempotency-Key '${idempotencyKey}' is already in progress. Retry once it has answered; its result will be replayed.`, "IDEMPOTENCY_KEY_IN_PROGRESS");
+			let response;
 			try {
-				this.enforceApiKeyPermission(c, collection.slug);
-				const id = c.req.param("id");
-				const driver = this.getScopedDriver(c);
-				if (!await driver.fetchOne({
-					path: getCollectionDataPath(collection),
-					id: String(id),
-					collection: resolvedCollection
-				})) throw ApiError.notFound("Entity not found");
-				const body = await parseJsonBody(c);
-				assertKnownWriteFields(body, resolvedCollection);
 				const entity = await driver.save({
-					path: getCollectionDataPath(collection),
-					id: String(id),
+					path,
 					values: body,
 					collection: resolvedCollection,
-					status: "existing"
+					status: "new"
 				});
-				const response = this.formatResponse(entity);
-				return c.json(response);
+				response = this.formatResponse(entity);
 			} catch (error) {
-				if (isRebaseApiError(error) && !error.code) {
-					if (!(error instanceof TypeError || error instanceof RangeError || error instanceof SyntaxError || error instanceof ReferenceError)) error.code = "BAD_REQUEST";
-				}
+				if (claimed?.status === "claimed" && idempotencyKey && store) await store.release(idempotencyKey, uid);
 				throw error;
 			}
+			if (claimed?.status === "claimed" && idempotencyKey && store) await store.complete(idempotencyKey, uid, response);
+			return c.json(response, 201);
 		});
+		const updateEntity = async (c) => {
+			this.enforceApiKeyPermission(c, collection.slug);
+			const id = c.req.param("id");
+			const driver = this.getScopedDriver(c);
+			if (!await driver.fetchOne({
+				path: getCollectionDataPath(collection),
+				id: String(id),
+				collection: resolvedCollection
+			})) throw ApiError.notFound("Entity not found");
+			const body = await parseJsonBody(c);
+			assertKnownWriteFields(body, resolvedCollection);
+			assertWriteValuesValid(body, resolvedCollection);
+			const entity = await driver.save({
+				path: getCollectionDataPath(collection),
+				id: String(id),
+				values: body,
+				collection: resolvedCollection,
+				status: "existing"
+			});
+			const response = this.formatResponse(entity);
+			return c.json(response);
+		};
+		/**
+		* The verb that matches what this actually does.
+		*
+		* The handler merges: it writes the columns in the body and leaves the
+		* rest alone, which is what the SDK's `update(id, data: Partial<M>)`
+		* sends. PUT was the only route, and PUT means replace — so the
+		* generated OpenAPI spec described a full replacement while the server
+		* performed a merge, and it reused the *create* input schema for it,
+		* `required` fields and all. A client generated from that spec was
+		* given a contract the server does not implement, and a spec-validating
+		* gateway in front of this API would reject partial updates the server
+		* would have accepted.
+		*
+		* PUT stays mounted on the same handler rather than being changed or
+		* removed: every published SDK sends it, and altering its semantics to
+		* be a true replace would silently start nulling columns that callers
+		* had simply omitted for years — a data-loss change disguised as a
+		* standards fix. So PATCH is the honest name, PUT is the compatible one,
+		* and both do the documented thing.
+		*/
+		this.router.patch(`${basePath}/:id`, updateEntity);
+		this.router.put(`${basePath}/:id`, updateEntity);
 		this.router.delete(`${basePath}/:id`, async (c) => {
 			this.enforceApiKeyPermission(c, collection.slug);
 			const id = c.req.param("id");
@@ -1552,6 +1763,7 @@ var RestApiGenerator = class {
 				const total = driver.count ? await driver.count({
 					path: parsed.collectionPath,
 					filter: queryOptions.where,
+					logical: queryOptions.logical,
 					searchString
 				}) : 0;
 				return c.json({ count: total });
@@ -1563,7 +1775,9 @@ var RestApiGenerator = class {
 					id: parsed.id
 				});
 				if (!entity) throw ApiError.notFound("Entity not found");
-				return c.json(entity);
+				const nestedCollection = this.resolveNestedWriteCollection(parsed.collectionPath);
+				if (!nestedCollection) return c.json(entity);
+				return c.json(projectResponseFields([entity], queryOptions.fields, nestedCollection, { include: queryOptions.include })[0]);
 			} else {
 				const queryDict = c.req.queries();
 				const queryOptions = this.parseQuery(queryDict);
@@ -1588,8 +1802,9 @@ var RestApiGenerator = class {
 					logical: queryOptions.logical,
 					searchString
 				}) : entities.length;
+				const listCollection = this.resolveNestedWriteCollection(parsed.collectionPath);
 				return c.json({
-					data: entities,
+					data: listCollection ? projectResponseFields(entities, queryOptions.fields, listCollection, { include: queryOptions.include }) : entities,
 					meta: {
 						total,
 						limit: queryOptions.limit,
@@ -1609,7 +1824,10 @@ var RestApiGenerator = class {
 			this.enforceSubcollectionApiKeyPermission(c, parsed.collectionPath);
 			const body = await parseJsonBody(c);
 			const targetCollection = this.resolveNestedWriteCollection(parsed.collectionPath);
-			if (targetCollection) assertKnownWriteFields(body, targetCollection);
+			if (targetCollection) {
+				assertKnownWriteFields(body, targetCollection);
+				assertWriteValuesValid(body, targetCollection);
+			}
 			const entity = await driver.save({
 				path: parsed.collectionPath,
 				values: body,
@@ -1618,7 +1836,7 @@ var RestApiGenerator = class {
 			const response = this.formatResponse(entity);
 			return c.json(response, 201);
 		});
-		this.router.put("/:parent/:parentId/:rest{.+}", async (c, next) => {
+		const updateNested = async (c, next) => {
 			const rest = c.req.param("rest");
 			if (!rest || rest === "undefined") return next();
 			const rawPath = `${c.req.param("parent")}/${c.req.param("parentId")}/${rest}`;
@@ -1628,7 +1846,10 @@ var RestApiGenerator = class {
 			this.enforceSubcollectionApiKeyPermission(c, parsed.collectionPath);
 			const body = await parseJsonBody(c);
 			const targetCollection = this.resolveNestedWriteCollection(parsed.collectionPath);
-			if (targetCollection) assertKnownWriteFields(body, targetCollection);
+			if (targetCollection) {
+				assertKnownWriteFields(body, targetCollection);
+				assertWriteValuesValid(body, targetCollection);
+			}
 			const entity = await driver.save({
 				path: parsed.collectionPath,
 				id: parsed.id,
@@ -1637,7 +1858,9 @@ var RestApiGenerator = class {
 			});
 			const response = this.formatResponse(entity);
 			return c.json(response);
-		});
+		};
+		this.router.patch("/:parent/:parentId/:rest{.+}", updateNested);
+		this.router.put("/:parent/:parentId/:rest{.+}", updateNested);
 		this.router.delete("/:parent/:parentId/:rest{.+}", async (c, next) => {
 			const rest = c.req.param("rest");
 			if (!rest || rest === "undefined") return next();
@@ -1917,7 +2140,7 @@ var LocalStorageController = class {
 	}
 	/**
 	* Get the full filesystem path for a storage path, with a traversal guard
-	* that keeps the result inside the bucket directory.
+	* that keeps the result inside the storage root.
 	*
 	* Defaults the bucket the way `putObject` does.
 	*
@@ -1928,10 +2151,22 @@ var LocalStorageController = class {
 	* design), and `listObjects` returned an empty page. So the obvious
 	* `putObject({ key })` → `getObject(key)` did not round-trip and nothing
 	* said why. One default, applied everywhere, removes the whole class.
+	*
+	* Two boundaries, checked separately, because there are two of them. The
+	* key must stay inside its bucket — that check always worked. The bucket
+	* must stay inside the storage root, and that one did not exist: the guard
+	* derived `bucketPath` from the caller's `bucket` and then asked whether
+	* the result was inside `bucketPath`, so `bucket = "../../etc"` made the
+	* reference point `/etc` and `/etc/passwd` is comfortably inside it. A
+	* guard whose reference point moves with its input is not a guard. The
+	* route boundary rejects such a bucket outright
+	* (`canonicalStorageBucket`); this is the layer underneath that does not
+	* depend on it having run.
 	*/
 	getFullPath(storagePath, bucket) {
-		const bucketPath = path$2.join(this.basePath, bucket ?? "default");
-		const resolved = path$2.resolve(path$2.join(bucketPath, storagePath));
+		const bucketPath = path$2.resolve(this.basePath, bucket || "default");
+		if (!bucketPath.startsWith(this.basePath + path$2.sep)) throw new Error("Path traversal detected: bucket resolves outside the storage root.");
+		const resolved = path$2.resolve(bucketPath, storagePath);
 		if (!resolved.startsWith(bucketPath + path$2.sep) && resolved !== bucketPath) throw new Error("Path traversal detected: resolved storage path is outside the bucket directory.");
 		return resolved;
 	}
@@ -1947,7 +2182,7 @@ var LocalStorageController = class {
 	}
 	async putObject({ file, key, metadata, bucket }) {
 		this.validateFile(file);
-		const usedBucket = bucket ?? "default";
+		const usedBucket = bucket || "default";
 		const fullStoragePath = key;
 		const fullPath = this.getFullPath(fullStoragePath, usedBucket);
 		await this.ensureDir(path$2.dirname(fullPath));
@@ -2177,38 +2412,63 @@ var VALID_FITS = /* @__PURE__ */ new Set([
 	"outside"
 ]);
 /**
+* A transform request naming parameters outside the declared bounds.
+*
+* Surfaced as a 400 by the route. Out-of-range values used to be *clamped*:
+* `width=99999` silently became 4096 and `format=tiff` silently became webp,
+* so the caller debugged a wrongly-sized `<img>` in the browser instead of
+* reading an error. A bound that rewrites its input is invisible, and this
+* endpoint's bounds are load-bearing — see {@link runTransform}.
+*/
+var InvalidTransformOptionsError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "InvalidTransformOptionsError";
+	}
+};
+/**
+* Parse a bounded integer parameter, or throw.
+*
+* Strict digits only: `parseInt` accepted `300px` and `12abc`, which is a
+* second way for a caller to get a transform they did not describe.
+*/
+function boundedInt(name, raw, min, max) {
+	if (!/^\d+$/.test(raw)) throw new InvalidTransformOptionsError(`Invalid '${name}': expected an integer between ${min} and ${max}.`);
+	const value = parseInt(raw, 10);
+	if (value < min || value > max) throw new InvalidTransformOptionsError(`Invalid '${name}': must be between ${min} and ${max}, got ${value}.`);
+	return value;
+}
+/**
 * Parse transform options from URL query parameters.
 * Returns `null` when no transformation is requested.
+*
+* Throws {@link InvalidTransformOptionsError} for anything outside the bounds
+* declared here — these are the whole parameter surface of an endpoint that is
+* reachable anonymously for public objects, so what it accepts has to be a
+* closed, stated set rather than "whatever we could coerce into range".
 */
 function parseTransformOptions(query) {
 	const opts = {};
 	let hasTransform = false;
 	if (query.width) {
-		const w = parseInt(query.width, 10);
-		if (!Number.isNaN(w) && w > 0) {
-			opts.width = Math.min(w, MAX_DIMENSION);
-			hasTransform = true;
-		}
+		opts.width = boundedInt("width", query.width, 1, MAX_DIMENSION);
+		hasTransform = true;
 	}
 	if (query.height) {
-		const h = parseInt(query.height, 10);
-		if (!Number.isNaN(h) && h > 0) {
-			opts.height = Math.min(h, MAX_DIMENSION);
-			hasTransform = true;
-		}
+		opts.height = boundedInt("height", query.height, 1, MAX_DIMENSION);
+		hasTransform = true;
 	}
 	if (query.quality) {
-		const q = parseInt(query.quality, 10);
-		if (!Number.isNaN(q)) {
-			opts.quality = Math.min(Math.max(q, MIN_QUALITY), MAX_QUALITY);
-			hasTransform = true;
-		}
+		opts.quality = boundedInt("quality", query.quality, MIN_QUALITY, MAX_QUALITY);
+		hasTransform = true;
 	}
-	if (query.format && VALID_FORMATS.has(query.format)) {
+	if (query.format) {
+		if (!VALID_FORMATS.has(query.format)) throw new InvalidTransformOptionsError(`Invalid 'format': expected one of ${[...VALID_FORMATS].join(", ")}.`);
 		opts.format = query.format;
 		hasTransform = true;
 	}
-	if (query.fit && VALID_FITS.has(query.fit)) {
+	if (query.fit) {
+		if (!VALID_FITS.has(query.fit)) throw new InvalidTransformOptionsError(`Invalid 'fit': expected one of ${[...VALID_FITS].join(", ")}.`);
 		opts.fit = query.fit;
 		hasTransform = true;
 	}
@@ -2226,9 +2486,72 @@ function isTransformableImage(contentType) {
 	return contentType.startsWith("image/") && !contentType.includes("svg") && !contentType.includes("gif");
 }
 /**
+* A transform refused because the server is already doing as many as it will.
+*
+* Surfaced as a 503 by the route.
+*/
+var TransformOverloadedError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "TransformOverloadedError";
+	}
+};
+/**
+* A bounded work queue.
+*
+* A transform is seconds of libvips CPU and a full-resolution bitmap in RSS,
+* and `GET /file/*?width=…` is reachable anonymously for public objects — so
+* without a bound, a few hundred bytes per request buys unlimited pod CPU, and
+* enough of them at once buys the heap too. `maxConcurrent` caps the CPU and
+* memory in flight; `maxQueued` is what keeps an unbounded backlog from
+* becoming the same problem one level up, refusing fast (503) instead of
+* accepting work the process will not get to.
+*/
+var TransformQueue = class {
+	maxConcurrent;
+	maxQueued;
+	active = 0;
+	waiting = [];
+	constructor(maxConcurrent, maxQueued) {
+		this.maxConcurrent = maxConcurrent;
+		this.maxQueued = maxQueued;
+	}
+	/** Number of tasks running plus waiting. Exposed for tests and metrics. */
+	get depth() {
+		return this.active + this.waiting.length;
+	}
+	async run(work) {
+		if (this.active >= this.maxConcurrent) {
+			if (this.waiting.length >= this.maxQueued) throw new TransformOverloadedError("Image transformation is at capacity. Retry shortly.");
+			await new Promise((resolve) => this.waiting.push(resolve));
+		}
+		this.active++;
+		try {
+			return await work();
+		} finally {
+			this.active--;
+			this.waiting.shift()?.();
+		}
+	}
+};
+/**
+* The queue every transform goes through.
+*
+* Small on purpose: transforms are CPU-bound, so more concurrency than cores
+* buys nothing but resident bitmaps.
+*/
+var transformQueue = new TransformQueue(Math.max(1, Math.min(4, os.availableParallelism?.() ?? os.cpus().length)), 64);
+/**
 * Apply image transformations and return the result buffer + content type.
+*
+* Runs on {@link transformQueue}: the work is bounded, and callers past the
+* bound get {@link TransformOverloadedError} rather than a share of a
+* saturated CPU.
 */
 async function transformImage(buffer, options) {
+	return transformQueue.run(() => runTransform(buffer, options));
+}
+async function runTransform(buffer, options) {
 	let pipeline = (await getSharp())(buffer);
 	if (options.width || options.height) pipeline = pipeline.resize({
 		width: options.width,
@@ -2355,6 +2678,7 @@ var TusHandler = class {
 		this.cleanupTimer = setInterval(() => {
 			this.cleanupStale();
 		}, 6e4);
+		this.cleanupTimer.unref?.();
 	}
 	/** Remove uploads that have been idle for longer than UPLOAD_EXPIRY_MS. */
 	async cleanupStale() {
@@ -2406,11 +2730,22 @@ var TusHandler = class {
 		if (Number.isNaN(uploadLength) || uploadLength <= 0) throw ApiError.badRequest("Invalid Upload-Length");
 		if (uploadLength > MAX_UPLOAD_SIZE) throw new ApiError(413, "PAYLOAD_TOO_LARGE", `Upload-Length exceeds maximum of ${MAX_UPLOAD_SIZE} bytes`);
 		const metadata = this.parseMetadata(c.req.header("Upload-Metadata") || "");
-		if (this.authorizeUpload) {
-			const key = metadata.key || metadata.filename || "";
-			await this.authorizeUpload(c, key, metadata.bucket || "default");
-		}
 		const id = randomUUID$1();
+		const rawKey = metadata.key || metadata.filename || "";
+		let key;
+		try {
+			key = canonicalStorageKey(rawKey) || id;
+		} catch (err) {
+			throw new ApiError(400, "INVALID_STORAGE_KEY", err instanceof InvalidStorageKeyError ? err.message : "Invalid storage key");
+		}
+		let bucket;
+		try {
+			bucket = canonicalStorageBucket(metadata.bucket);
+		} catch (err) {
+			throw new ApiError(400, "INVALID_STORAGE_BUCKET", err instanceof InvalidStorageBucketError ? err.message : "Invalid storage bucket");
+		}
+		const storageId = metadata.storageId || c.req.query("storageId") || void 0;
+		if (this.authorizeUpload) await this.authorizeUpload(c, key, bucket || "default", storageId);
 		const filePath = join(this.tusDir, id);
 		await writeFile(filePath, Buffer.alloc(0));
 		const upload = {
@@ -2420,8 +2755,9 @@ var TusHandler = class {
 			metadata,
 			createdAt: Date.now(),
 			filePath,
-			bucket: metadata.bucket || void 0,
-			key: metadata.key || metadata.filename || void 0,
+			bucket,
+			storageId,
+			key,
 			completed: false
 		};
 		this.uploads.set(id, upload);
@@ -2496,7 +2832,7 @@ var TusHandler = class {
 	*/
 	async finalize(upload) {
 		upload.completed = true;
-		const storageId = upload.metadata.storageId;
+		const storageId = upload.storageId;
 		let targetController = this.storageController;
 		if (this.storageRegistry) targetController = storageId ? this.storageRegistry.getOrDefault(storageId) : this.storageRegistry.getDefault();
 		if (!targetController) {
@@ -2506,7 +2842,7 @@ var TusHandler = class {
 		try {
 			const { readFile } = await import("fs/promises");
 			const data = await readFile(upload.filePath);
-			const fileName = upload.key || upload.metadata.filename || upload.id;
+			const fileName = upload.key;
 			const mimeType = upload.metadata.contentType || upload.metadata.filetype || "application/octet-stream";
 			const file = new File([new Uint8Array(data)], fileName, { type: mimeType });
 			await targetController.putObject({
@@ -2537,6 +2873,82 @@ var TusHandler = class {
 /** Shared image transform cache (LRU, 500 entries, 1 hour TTL). */
 var transformCache = new TransformCache();
 /**
+* Transforms currently being computed, keyed the same way the cache is.
+*
+* Without it, N concurrent requests for one uncached variant run N full
+* decode+encode pipelines — the cache only helps the requests that arrive
+* after the first one has finished. Joining the in-flight promise makes a
+* thundering herd cost one decode.
+*/
+var transformsInFlight = /* @__PURE__ */ new Map();
+/**
+* Compute a transform, or join the one already running for this key.
+*
+* `loadSource` is only called on a real miss, so the concurrent requests that
+* join an in-flight transform do not each read the source object either.
+*/
+async function transformOnce(cacheKey, options, loadSource) {
+	const cached = transformCache.get(cacheKey);
+	if (cached) return cached;
+	const running = transformsInFlight.get(cacheKey);
+	if (running) return running;
+	const pending = (async () => {
+		try {
+			const result = await transformImage(await loadSource(), options);
+			transformCache.set(cacheKey, result.data, result.contentType);
+			return result;
+		} catch (err) {
+			if (err instanceof TransformOverloadedError) throw ApiError.serviceUnavailable(err.message, "TRANSFORM_OVERLOADED");
+			throw err;
+		}
+	})();
+	transformsInFlight.set(cacheKey, pending);
+	try {
+		return await pending;
+	} finally {
+		transformsInFlight.delete(cacheKey);
+	}
+}
+/**
+* Content types served inline. Everything else is handed back as
+* `application/octet-stream` with `Content-Disposition: attachment`.
+*
+* The stored content type is the *uploader's claim* — `putObject` writes
+* `file.type` from the multipart part, and TUS takes it from a request header;
+* nothing sniffs the bytes. Echoing that claim back as the response type turns
+* `/api/storage/file/*` into an HTML hosting endpoint on the API origin, and
+* where `cookieAuth` is enabled the refresh cookie is `Path=/` on exactly that
+* origin — so an uploaded page can fetch `/api/auth/refresh` same-origin and
+* read out a fresh access token, `HttpOnly` notwithstanding.
+*
+* `image/svg+xml` is deliberately absent: an SVG is a document that can carry
+* script. `text/html` and `application/xhtml+xml` are absent for the same
+* reason, and are what the attack actually uses.
+*/
+var INLINE_CONTENT_TYPE_PREFIXES = [
+	"image/",
+	"video/",
+	"audio/"
+];
+var INLINE_CONTENT_TYPES = /* @__PURE__ */ new Set(["application/pdf", "text/plain"]);
+/**
+* Decide what to actually serve for a stored content type.
+*
+* Returns the type to send and whether to force a download. The check is an
+* allowlist rather than a blocklist of dangerous types: the set of types a
+* browser will execute grows, and the set we want to render inline does not.
+*/
+function resolveServedContentType(storedContentType) {
+	const base = storedContentType.split(";")[0].trim().toLowerCase();
+	return (base.includes("svg") ? false : INLINE_CONTENT_TYPES.has(base) || INLINE_CONTENT_TYPE_PREFIXES.some((p) => base.startsWith(p))) ? {
+		contentType: storedContentType,
+		attachment: false
+	} : {
+		contentType: "application/octet-stream",
+		attachment: true
+	};
+}
+/**
 * Extract the wildcard portion of a route path from the full request path.
 *
 * Hono's `c.req.param('*')` does not work reliably in sub-routers mounted
@@ -2556,16 +2968,48 @@ function extractWildcardPath(c) {
 	return fullPath.substring(idx + prefix.length + 1);
 }
 /**
-* Sanitize a user-supplied storage key to prevent path traversal and other attacks.
-* Removes null bytes, ../ sequences, leading slashes, and limits length.
+* Canonicalize a caller-supplied storage key, answering 400 when it names
+* something other than what it says.
+*
+* The single place a request's key becomes canonical. Every route runs its key
+* through this before anything else touches it, so the authorize hook, the
+* storage controller and the minted download token are all looking at the same
+* string — which is the only thing that makes the hook's answer meaningful.
+* See `keys.ts` for why an unacceptable key is refused rather than repaired.
+*/
+function canonicalKeyOrBadRequest(key) {
+	try {
+		return canonicalStorageKey(key);
+	} catch (err) {
+		throw new ApiError(400, "INVALID_STORAGE_KEY", err instanceof InvalidStorageKeyError ? err.message : "Invalid storage key");
+	}
+}
+/**
+* Canonicalize a caller-supplied bucket name, answering 400 when it is not one.
+*
+* The bucket's counterpart to {@link canonicalKeyOrBadRequest}, and it exists
+* for the same reason: the value routes a write, so it has to be checked where
+* it enters rather than where it is used. Applied at every entry point a bucket
+* has — this route's multipart body, the `?bucket=` query, and the TUS
+* `Upload-Metadata` header.
+*/
+function canonicalBucketOrBadRequest(bucket) {
+	try {
+		return canonicalStorageBucket(bucket);
+	} catch (err) {
+		throw new ApiError(400, "INVALID_STORAGE_BUCKET", err instanceof InvalidStorageBucketError ? err.message : "Invalid storage bucket");
+	}
+}
+/**
+* Parse image transform query parameters, answering 400 when they are out of
+* bounds rather than clamping them to something the caller did not ask for.
 */
-function sanitizeStorageKey(key) {
-	let sanitized = key;
-	sanitized = sanitized.replace(/\0/g, "");
-	sanitized = sanitized.replace(/\.\.\/|\.\.\\/g, "");
-	sanitized = sanitized.replace(/^\/+/, "");
-	sanitized = sanitized.slice(0, 1024);
-	return sanitized;
+function transformOptionsOrBadRequest(query) {
+	try {
+		return parseTransformOptions(query);
+	} catch (err) {
+		throw new ApiError(400, "INVALID_TRANSFORM_OPTIONS", err instanceof InvalidTransformOptionsError ? err.message : "Invalid image transform options");
+	}
 }
 /**
 * Build adapter-aware auth middleware for storage routes.
@@ -2669,25 +3113,26 @@ function createStorageRoutes(config) {
 	/**
 	* Parse bucket and path from a combined file path.
 	*
-	* The resolved path is run through `sanitizeStorageKey` here — the same
-	* function the upload route applies to incoming keys — so that read,
-	* delete, metadata and folder routes strip `../`, null bytes and leading
-	* slashes before the path reaches the controller, the authorize hook, or
-	* the download-token it mints. The `LocalStorageController` traversal guard
-	* (`getFullPath`) remains the load-bearing defence; this is the same
-	* normalization on the write and read sides so a `..%2f` read/delete cannot
-	* even reach it as a raw traversal string (it 404s as a normal miss instead
-	* of throwing, and never leaks whether an escape was attempted).
+	* The resolved path is canonicalized here — by the same function the upload
+	* route applies to incoming keys — so read, delete, metadata and folder
+	* routes agree with the write side about what a key means before it reaches
+	* the controller, the authorize hook, or the download token it mints.
+	*
+	* A key that cannot be canonicalized (a real `..` segment, a null byte) is
+	* a 400, not a repaired key. The `LocalStorageController` traversal guard
+	* (`getFullPath`) is the load-bearing defence for the *storage root*, and
+	* `canonicalStorageBucket` for the bucket the caller names; this is what
+	* defends the boundary the hook drew inside them.
 	*/
 	const parseBucketAndPath = (filePath) => {
 		const parts = filePath.split("/");
 		if (parts.length > 1 && parts[0].toLowerCase() === "default") return {
 			bucket: "default",
-			resolvedPath: sanitizeStorageKey(parts.slice(1).join("/"))
+			resolvedPath: canonicalKeyOrBadRequest(parts.slice(1).join("/"))
 		};
 		return {
 			bucket: "default",
-			resolvedPath: sanitizeStorageKey(filePath)
+			resolvedPath: canonicalKeyOrBadRequest(filePath)
 		};
 	};
 	/**
@@ -2700,9 +3145,9 @@ function createStorageRoutes(config) {
 		const uploadedFile = body["file"];
 		if (!uploadedFile || typeof uploadedFile === "string") throw ApiError.badRequest("No file provided");
 		const key = typeof body["key"] === "string" ? body["key"] : "";
-		const bucket = typeof body["bucket"] === "string" ? body["bucket"] : void 0;
+		const bucket = canonicalBucketOrBadRequest(typeof body["bucket"] === "string" ? body["bucket"] : void 0);
 		const storageId = typeof body["storageId"] === "string" ? body["storageId"] : c.req.query("storageId");
-		const finalKey = sanitizeStorageKey(key || uploadedFile.name || "unnamed");
+		const finalKey = canonicalKeyOrBadRequest(key || uploadedFile.name || "unnamed");
 		const metadata = {};
 		for (const [k, value] of Object.entries(body)) if (k.startsWith("metadata_")) metadata[k.replace("metadata_", "")] = value;
 		await checkAuthorized(c, "write", finalKey, bucket ?? "default", storageId);
@@ -2728,15 +3173,13 @@ function createStorageRoutes(config) {
 		const filePath = decodeURIComponent(rawPath);
 		const storageId = c.req.query("storageId");
 		const resolved = resolveController(storageId);
-		{
-			const { bucket, resolvedPath } = parseBucketAndPath(filePath);
-			await checkAuthorized(c, "read", resolvedPath, bucket, storageId);
-		}
-		const transformOpts = parseTransformOptions(c.req.query());
+		const { bucket, resolvedPath } = parseBucketAndPath(filePath);
+		await checkAuthorized(c, "read", resolvedPath, bucket, storageId);
+		c.header("X-Content-Type-Options", "nosniff");
+		const transformKeyPrefix = `${storageId || "(default)"}/${bucket}/${resolvedPath}`;
+		const transformOpts = transformOptionsOrBadRequest(c.req.query());
 		if (resolved.getType() === "local") {
-			const localController = resolved;
-			const { bucket, resolvedPath } = parseBucketAndPath(filePath);
-			const absolutePath = localController.getAbsolutePath(resolvedPath, bucket);
+			const absolutePath = resolved.getAbsolutePath(resolvedPath, bucket);
 			try {
 				await fsp.access(absolutePath);
 			} catch {
@@ -2748,37 +3191,30 @@ function createStorageRoutes(config) {
 				const metadataRaw = await fsp.readFile(metadataPath, "utf-8");
 				contentType = JSON.parse(metadataRaw).contentType || contentType;
 			} catch {}
-			const fileContent = await fsp.readFile(absolutePath);
 			if (transformOpts && isTransformableImage(contentType)) {
-				const cacheKey = transformCache.buildKey(filePath, transformOpts);
-				let cached = transformCache.get(cacheKey);
-				if (!cached) {
-					cached = await transformImage(Buffer.from(fileContent), transformOpts);
-					transformCache.set(cacheKey, cached.data, cached.contentType);
-				}
-				c.header("Content-Type", cached.contentType);
+				const transformed = await transformOnce(transformCache.buildKey(transformKeyPrefix, transformOpts), transformOpts, async () => Buffer.from(await fsp.readFile(absolutePath)));
+				c.header("Content-Type", transformed.contentType);
 				c.header("Cache-Control", "public, max-age=31536000, immutable");
-				return c.body(new Uint8Array(cached.data));
+				return c.body(new Uint8Array(transformed.data));
 			}
-			c.header("Content-Type", contentType);
+			const fileContent = await fsp.readFile(absolutePath);
+			const served = resolveServedContentType(contentType);
+			c.header("Content-Type", served.contentType);
+			if (served.attachment) c.header("Content-Disposition", "attachment");
 			return c.body(new Uint8Array(fileContent));
 		}
-		const { bucket: parsedBucket, resolvedPath: parsedPath } = parseBucketAndPath(filePath);
-		const fileObject = await resolved.getObject(parsedPath, parsedBucket);
+		const fileObject = await resolved.getObject(resolvedPath, bucket);
 		if (!fileObject) throw ApiError.notFound("File not found");
 		const remoteContentType = fileObject.type || "application/octet-stream";
 		if (transformOpts && isTransformableImage(remoteContentType)) {
-			const cacheKey = transformCache.buildKey(filePath, transformOpts);
-			let cached = transformCache.get(cacheKey);
-			if (!cached) {
-				cached = await transformImage(Buffer.from(await fileObject.arrayBuffer()), transformOpts);
-				transformCache.set(cacheKey, cached.data, cached.contentType);
-			}
-			c.header("Content-Type", cached.contentType);
+			const transformed = await transformOnce(transformCache.buildKey(transformKeyPrefix, transformOpts), transformOpts, async () => Buffer.from(await fileObject.arrayBuffer()));
+			c.header("Content-Type", transformed.contentType);
 			c.header("Cache-Control", "public, max-age=31536000, immutable");
-			return c.body(new Uint8Array(cached.data));
+			return c.body(new Uint8Array(transformed.data));
 		}
-		c.header("Content-Type", remoteContentType);
+		const servedRemote = resolveServedContentType(remoteContentType);
+		c.header("Content-Type", servedRemote.contentType);
+		if (servedRemote.attachment) c.header("Content-Disposition", "attachment");
 		c.header("Cache-Control", "public, max-age=3600, immutable");
 		const buf = await fileObject.arrayBuffer();
 		return c.body(new Uint8Array(buf));
@@ -2837,8 +3273,8 @@ function createStorageRoutes(config) {
 	* GET /list - List files in a path
 	*/
 	router.get("/list", writeAuthMiddleware, async (c) => {
-		const storagePrefix = sanitizeStorageKey(c.req.query("prefix") || c.req.query("path") || "");
-		const bucket = c.req.query("bucket");
+		const storagePrefix = canonicalKeyOrBadRequest(c.req.query("prefix") || c.req.query("path") || "");
+		const bucket = canonicalBucketOrBadRequest(c.req.query("bucket"));
 		const maxResults = c.req.query("maxResults");
 		const pageToken = c.req.query("pageToken");
 		const storageId = c.req.query("storageId");
@@ -2884,8 +3320,8 @@ function createStorageRoutes(config) {
 		}, 201);
 	});
 	const defaultCtrl = getDefaultController();
-	const tusHandler = new TusHandler(defaultCtrl.getType() === "local" ? defaultCtrl.getBasePath() : process.env.STORAGE_PATH || "./uploads", defaultCtrl, registry, authorize ? async (c, key, bucket) => {
-		await checkAuthorized(c, "write", sanitizeStorageKey(key), bucket, c.req.query("storageId"));
+	const tusHandler = new TusHandler(defaultCtrl.getType() === "local" ? defaultCtrl.getBasePath() : process.env.STORAGE_PATH || "./uploads", defaultCtrl, registry, authorize ? async (c, key, bucket, storageId) => {
+		await checkAuthorized(c, "write", key, bucket, storageId);
 	} : void 0);
 	tusHandler.startCleanup();
 	router.options("/tus", (_c) => tusHandler.options());
@@ -3079,11 +3515,20 @@ function assertStorageAccessControlConfigured(state, isProduction) {
 }
 //#endregion
 //#region src/init/docs.ts
-async function mountOpenApiDocs(app, basePath, enableSwagger, activeCollections, requireAuth) {
-	if (enableSwagger === false || activeCollections.length === 0) return;
-	const { generateOpenApiSpec } = await import("./openapi-generator-BEwyiaAr.js");
+/**
+* Serve the OpenAPI document, and Swagger UI outside production.
+*
+* `serverCollections` must be the collections the REST routes were generated
+* from — the ones whose data source has a `"server"` transport — not every
+* active collection. A direct-transport collection is served by the client
+* against its own backend; documenting it here publishes a full set of CRUD
+* paths that 404, with a Try-It button next to each.
+*/
+async function mountOpenApiDocs(app, basePath, enableSwagger, serverCollections, requireAuth) {
+	if (enableSwagger === false || serverCollections.length === 0) return;
+	const { generateOpenApiSpec } = await import("./openapi-generator-BQxxxDpb.js");
 	app.get(`${basePath}/docs`, (c) => {
-		const spec = generateOpenApiSpec(activeCollections, {
+		const spec = generateOpenApiSpec(serverCollections, {
 			basePath,
 			requireAuth
 		});
@@ -3258,6 +3703,54 @@ function createShutdown(config) {
 	};
 }
 //#endregion
+//#region src/init/process-safety.ts
+/**
+* Installed once per process. The singleton is process-global for the same
+* reason (see `singleton.ts`): more than one copy of this module can be loaded
+* — the image ships one at `/app/node_modules` and a project's bundle installs
+* another — and each copy would otherwise add its own listener.
+*/
+var HANDLER_SLOT = Symbol.for("@rebasepro/server:unhandled-rejection-handler");
+/**
+* Log unhandled promise rejections instead of letting Node terminate the
+* process.
+*
+* Node has terminated on an unhandled rejection since v15. Hono catches
+* anything thrown or rejected inside an awaited handler, so the ordinary
+* request path is covered — but a fire-and-forget `void syncToCrm(body)`, a
+* `setTimeout(async () => …)`, or an unawaited `.then()` in one custom function
+* rejects outside Hono's frame. The default outcome is that one project's
+* floating promise ends the process; on the managed runtime that process is
+* shared, so every other tenant on the pod goes with it, and the request log
+* points nowhere because the request itself succeeded.
+*
+* A logged rejection is the better trade here: the process keeps serving, and
+* the stack reaches the operator. `uncaughtException` is deliberately **not**
+* handled — a synchronous throw that escaped every frame leaves the process in
+* a state we cannot reason about, and swallowing it would be a worse bargain
+* than a restart.
+*
+* Set `REBASE_EXIT_ON_UNHANDLED_REJECTION=1` to restore Node's default.
+*
+* @returns An uninstall function (used by tests), or `undefined` when nothing
+* was installed.
+*/
+function installUnhandledRejectionHandler() {
+	if (process.env.REBASE_EXIT_ON_UNHANDLED_REJECTION === "1") return void 0;
+	const slot = globalThis;
+	if (slot[HANDLER_SLOT]) return void 0;
+	const handler = (reason) => {
+		const error = reason instanceof Error ? reason : new Error(String(reason));
+		logger.error("Unhandled promise rejection — the process kept running. This is almost always a fire-and-forget call in application code (a custom function, a cron job, a callback). Await it, or attach a .catch().", { error });
+	};
+	slot[HANDLER_SLOT] = handler;
+	process.on("unhandledRejection", handler);
+	return () => {
+		process.removeListener("unhandledRejection", handler);
+		delete slot[HANDLER_SLOT];
+	};
+}
+//#endregion
 //#region src/auth/collection-callback-warning.ts
 /** The data callbacks the auth write path does not run. */
 var DATA_CALLBACKS = [
@@ -3378,7 +3871,17 @@ function buildQueryString(params) {
 		const wire = serializeOrderBy(params.orderBy);
 		if (wire) parts.push(`orderBy=${encodeURIComponent(wire)}`);
 	}
-	if (params.searchString) parts.push(`searchString=${encodeURIComponent(params.searchString)}`);
+	if (params.searchString) {
+		parts.push(`searchString=${encodeURIComponent(params.searchString)}`);
+		if (params.searchExplain) parts.push("searchExplain=true");
+	}
+	if (params.vectorSearch) {
+		const vs = params.vectorSearch;
+		parts.push(`vector_search=${encodeURIComponent(vs.property)}`);
+		parts.push(`vector=${encodeURIComponent(JSON.stringify(vs.vector))}`);
+		if (vs.distance) parts.push(`vector_distance=${encodeURIComponent(vs.distance)}`);
+		if (vs.threshold !== void 0) parts.push(`vector_threshold=${encodeURIComponent(String(vs.threshold))}`);
+	}
 	if (params.include && params.include.length > 0) parts.push(`include=${encodeURIComponent(params.include.join(","))}`);
 	if (params.logical) {
 		const root = params.logical;
@@ -3418,6 +3921,13 @@ function resolveBaseUrl(configured) {
 function createTransport(config, environment) {
 	const fetchFn = config.fetch || globalThis.fetch;
 	const apiPath = config.apiPath || "/api";
+	for (const field of ["baseUrl", "storageUrlOrigin"]) {
+		const value = config[field];
+		if (!value || !apiPath) continue;
+		const trimmed = value.replace(/\/+$/, "");
+		if (!trimmed.endsWith(apiPath)) continue;
+		console.warn(`[Rebase] ${field} ${JSON.stringify(value)} already ends with the API path ${JSON.stringify(apiPath)}, which is appended to it — requests will go to ${trimmed}${apiPath}/… and 404. Pass the origin only (${JSON.stringify(trimmed.slice(0, trimmed.length - apiPath.length) || "/")}), or set \`apiPath\` if the server really does mount the API one level deeper.`);
+	}
 	let token = config.token;
 	let tokenGetter;
 	let onUnauthorizedHandler = config.onUnauthorized;
@@ -3601,6 +4111,11 @@ function createAuth(transport, options) {
 	const authFlowMode = opts.authFlowMode || "json";
 	const STORAGE_KEY = "rebase_auth";
 	const REFRESH_BUFFER_MS = 12e4;
+	/**
+	* The largest delay `setTimeout` can hold — 2^31 - 1 ms, about 24.8 days.
+	* Anything larger is silently clamped to 1ms by Node and every browser.
+	*/
+	const MAX_TIMER_DELAY_MS = 2147483647;
 	const MAX_REFRESH_RETRIES = 5;
 	const REFRESH_RETRY_BASE_MS = 1e3;
 	const REFRESH_RETRY_MAX_MS = 3e4;
@@ -3628,7 +4143,9 @@ function createAuth(transport, options) {
 	function emit(event, session) {
 		for (const fn of listeners) try {
 			fn(event, session);
-		} catch (e) {}
+		} catch (e) {
+			console.error("Error in auth state change listener:", e);
+		}
 	}
 	function saveSession(session) {
 		if (!persistSession || authFlowMode === "cookie") return;
@@ -3732,6 +4249,10 @@ function createAuth(transport, options) {
 			attemptScheduledRefresh(0);
 			return;
 		}
+		if (delay > MAX_TIMER_DELAY_MS) {
+			refreshTimeout = setTimeout(() => scheduleRefresh(expiresAt), MAX_TIMER_DELAY_MS);
+			return;
+		}
 		refreshTimeout = setTimeout(() => {
 			attemptScheduledRefresh(0);
 		}, delay);
@@ -4468,9 +4989,55 @@ var SDKQueryBuilder = class {
 	}
 	/**
 	* Set a free-text search string if supported by the backend.
+	*
+	* By default this is a substring match across the collection's top-level
+	* string properties. A Postgres collection that declares a `search` block
+	* gets ranked full-text matching over the fields it named instead, and each
+	* row comes back with a `_score` you can sort on:
+	*
+	* ```ts
+	* client.data.talents.search("auditor iso 14001").orderBy("_score", "desc").find()
+	* ```
+	*
+	* Pass `{ explain: true }` to have each row report which of the declared
+	* fields matched, with a highlighted snippet, on `_matches`:
+	*
+	* ```ts
+	* const { data } = await client.data.talents.search("iso 14001", { explain: true }).find();
+	* data[0]._matches
+	* // [{ field: "questionnaire.certifications", snippet: "<mark>ISO</mark> <mark>14001</mark> Lead Auditor" }]
+	* ```
 	*/
-	search(searchString) {
+	search(searchString, options) {
 		this.params.searchString = searchString;
+		if (options?.explain !== void 0) this.params.searchExplain = options.explain;
+		return this;
+	}
+	/**
+	* Order rows by nearest-neighbour distance to `vector`.
+	*
+	* The server has supported this from the REST layer since vectors landed;
+	* this is the SDK reaching it. Results come back closest-first with a
+	* `_distance` on each row, and any `where` / `orderBy` on the same query is
+	* a filter applied before the ordering — distance decides the order.
+	*
+	* You supply the query vector. Rebase stores and searches embeddings; it
+	* does not produce them, so this is where whatever model you already use
+	* for the stored vectors gets called.
+	*
+	* @param property - Name of the `vector` property to compare against.
+	* @param vector - The query embedding. Its length must match the property's
+	*                 declared `dimensions`, or the server answers 400.
+	* @example
+	* client.data.docs.vectorSearch("embedding", queryVector, { threshold: 0.35 }).limit(10).find()
+	*/
+	vectorSearch(property, vector, options) {
+		this.params.vectorSearch = {
+			property,
+			vector,
+			...options?.distance !== void 0 && { distance: options.distance },
+			...options?.threshold !== void 0 && { threshold: options.threshold }
+		};
 		return this;
 	}
 	/**
@@ -4506,6 +5073,11 @@ var SDKQueryBuilder = class {
 		return this.collection.listen(this.params, onUpdate, onError);
 	}
 };
+/**
+* Counts currently in flight, keyed by the exact request they issue. Entries
+* live only for the duration of the request — see `count()` for why.
+*/
+var inflightCounts = /* @__PURE__ */ new Map();
 function createCollectionClient(transport, slug, ws) {
 	const basePath = `/data/${slug}`;
 	const client = {
@@ -4550,18 +5122,63 @@ function createCollectionClient(transport, slug, ws) {
 				body: JSON.stringify({
 					rows: data,
 					...options?.upsert ? { upsert: true } : {}
-				})
+				}),
+				...options?.idempotencyKey ? { headers: { "Idempotency-Key": options.idempotencyKey } } : {}
 			})).data || [];
 		},
+		/**
+		* Still `PUT`, deliberately, even though the server now serves `PATCH`
+		* on the same handler and `PATCH` is the honest verb for a merge.
+		*
+		* The two are interchangeable server-side, so switching buys nothing at
+		* runtime — and it costs compatibility in the direction that fails
+		* quietly. A 0.14 client talking to a 0.13 server would send `PATCH` to
+		* a route that does not exist and get a **404**, which is
+		* indistinguishable from "that row is gone". Every write would look like
+		* a missing record.
+		*
+		* `PATCH` is what the OpenAPI spec advertises, so anyone generating a
+		* client gets the correct verb; this stays on `PUT` until the oldest
+		* supported server is one that serves both.
+		*/
 		async update(id, data) {
 			return await transport.request(`${basePath}/${encodeURIComponent(String(id))}`, {
 				method: "PUT",
 				body: JSON.stringify(data)
 			});
 		},
+		async updateMany(updates, options) {
+			if (!Array.isArray(updates)) throw new TypeError("updateMany expects an array of { id, data } entries.");
+			if (updates.length === 0) return [];
+			return (await transport.request(`${basePath}/bulk`, {
+				method: "PATCH",
+				body: JSON.stringify({ updates }),
+				...options?.idempotencyKey ? { headers: { "Idempotency-Key": options.idempotencyKey } } : {}
+			})).data || [];
+		},
 		async delete(id) {
 			await transport.request(`${basePath}/${encodeURIComponent(String(id))}`, { method: "DELETE" });
 		},
+		/**
+		* `POST .../bulk/delete`, not `DELETE .../bulk`.
+		*
+		* The honest verb would take the ids in a DELETE body, and that is the
+		* one request shape the HTTP ecosystem handles unreliably: bodies on
+		* DELETE are permitted but widely dropped by proxies and CDNs, and
+		* several OpenAPI generators ignore `requestBody` on a DELETE
+		* operation, so a generated client would send the request without its
+		* ids. A backend deployed behind arbitrary ingress cannot take that
+		* bet. Same reason `:batchDelete` exists in Google's API guidelines.
+		*/
+		async deleteMany(ids, options) {
+			if (!Array.isArray(ids)) throw new TypeError("deleteMany expects an array of ids.");
+			if (ids.length === 0) return;
+			await transport.request(`${basePath}/bulk/delete`, {
+				method: "POST",
+				body: JSON.stringify({ ids }),
+				...options?.idempotencyKey ? { headers: { "Idempotency-Key": options.idempotencyKey } } : {}
+			});
+		},
 		async count(params) {
 			const qs = buildQueryString({
 				...params,
@@ -4569,12 +5186,28 @@ function createCollectionClient(transport, slug, ws) {
 				offset: void 0,
 				include: void 0
 			});
-			return (await transport.request(basePath + "/count" + qs, { method: "GET" })).count ?? 0;
+			const key = basePath + "/count" + qs;
+			const inflight = inflightCounts.get(key);
+			if (inflight) return inflight;
+			const request = transport.request(key, { method: "GET" }).then((raw) => raw.count ?? 0);
+			inflightCounts.set(key, request);
+			try {
+				return await request;
+			} finally {
+				inflightCounts.delete(key);
+			}
 		},
 		observe(params, onResult, onError, options) {
 			let closed = false;
-			const emit = (result) => {
+			let liveDelivered = false;
+			let signature;
+			const deliver = (result, fromLive) => {
 				if (closed) return;
+				if (fromLive) liveDelivered = true;
+				else if (liveDelivered) return;
+				const next = `${result.meta?.total ?? ""}|${JSON.stringify(result.data)}`;
+				if (signature !== void 0 && next === signature) return;
+				signature = next;
 				onResult({
 					...result,
 					fromCache: false,
@@ -4582,10 +5215,10 @@ function createCollectionClient(transport, slug, ws) {
 					partial: false
 				});
 			};
-			client.find(params).then(emit).catch((error) => {
+			client.find(params).then((result) => deliver(result, false)).catch((error) => {
 				if (!closed) onError?.(error);
 			});
-			const live = options?.realtime !== false && client.listen ? client.listen(params, emit, onError) : void 0;
+			const live = options?.realtime !== false && client.listen ? client.listen(params, (result) => deliver(result, true), onError) : void 0;
 			return () => {
 				closed = true;
 				live?.();
@@ -4593,17 +5226,24 @@ function createCollectionClient(transport, slug, ws) {
 		},
 		observeById(id, onResult, onError, options) {
 			let closed = false;
-			const emit = (row) => {
+			let liveDelivered = false;
+			let signature;
+			const deliver = (row, fromLive) => {
 				if (closed) return;
+				if (fromLive) liveDelivered = true;
+				else if (liveDelivered) return;
+				const next = row === void 0 ? "\0missing" : JSON.stringify(row);
+				if (signature !== void 0 && next === signature) return;
+				signature = next;
 				onResult(row, {
 					fromCache: false,
 					hasPendingWrites: false
 				});
 			};
-			client.findById(id).then(emit).catch((error) => {
+			client.findById(id).then((row) => deliver(row, false)).catch((error) => {
 				if (!closed) onError?.(error);
 			});
-			const live = options?.realtime !== false && client.listenById ? client.listenById(id, emit, onError) : void 0;
+			const live = options?.realtime !== false && client.listenById ? client.listenById(id, (row) => deliver(row, true), onError) : void 0;
 			return () => {
 				closed = true;
 				live?.();
@@ -4623,8 +5263,11 @@ function createCollectionClient(transport, slug, ws) {
 		offset(count) {
 			return new SDKQueryBuilder(client).offset(count);
 		},
-		search(searchString) {
-			return new SDKQueryBuilder(client).search(searchString);
+		search(searchString, options) {
+			return new SDKQueryBuilder(client).search(searchString, options);
+		},
+		vectorSearch(property, vector, options) {
+			return new SDKQueryBuilder(client).vectorSearch(property, vector, options);
 		},
 		include(...relations) {
 			return new SDKQueryBuilder(client).include(...relations);
@@ -4634,51 +5277,44 @@ function createCollectionClient(transport, slug, ws) {
 		client.listen = (params, onUpdate, onError) => {
 			let active = true;
 			let lastUpdateId = 0;
+			let lastKnownTotal;
+			const window = resolveFindWindow(params);
 			const unsub = ws.listenCollection({
 				path: slug,
 				filter: params?.where,
+				logical: params?.logical,
 				limit: params?.limit,
-				startAfter: params?.offset ? String(params.offset) : void 0,
+				offset: window.driverOffset,
 				orderBy: params?.orderBy?.[0],
 				order: params?.orderBy?.[1],
-				searchString: params?.searchString
-			}, (incomingRows) => {
-				const currentUpdateId = ++lastUpdateId;
-				const requestedLimit = params?.limit || 20;
-				const offset = params?.offset || 0;
-				const rows = incomingRows;
-				const heuristicTotal = rows.length;
-				const heuristicHasMore = rows.length >= requestedLimit;
-				if (client.count) client.count(params).then((total) => {
-					if (active && currentUpdateId === lastUpdateId) onUpdate({
-						data: rows,
-						meta: {
-							total,
-							limit: requestedLimit,
-							offset,
-							hasMore: offset + rows.length < total
-						}
-					});
-				}).catch(() => {
-					if (active && currentUpdateId === lastUpdateId) onUpdate({
+				searchString: params?.searchString,
+				searchExplain: params?.searchExplain
+			}, (incomingRows) => {
+				const currentUpdateId = ++lastUpdateId;
+				const requestedLimit = window.limit;
+				const offset = window.offset;
+				const rows = incomingRows;
+				const emit = (total, hasMore) => {
+					if (!active || currentUpdateId !== lastUpdateId) return;
+					onUpdate({
 						data: rows,
 						meta: {
-							total: heuristicTotal,
+							total,
 							limit: requestedLimit,
 							offset,
-							hasMore: heuristicHasMore
+							hasMore
 						}
 					});
+				};
+				const emitWithoutCount = () => emit(offset + rows.length, rows.length >= requestedLimit);
+				if (client.count) client.count(params).then((total) => {
+					lastKnownTotal = total;
+					emit(total, offset + rows.length < total);
+				}).catch(() => {
+					if (lastKnownTotal !== void 0) emit(lastKnownTotal, offset + rows.length < lastKnownTotal);
+					else emitWithoutCount();
 				});
-				else onUpdate({
-					data: rows,
-					meta: {
-						total: heuristicTotal,
-						limit: requestedLimit,
-						offset,
-						hasMore: heuristicHasMore
-					}
-				});
+				else emitWithoutCount();
 			}, onError);
 			return () => {
 				active = false;
@@ -5446,6 +6082,11 @@ var RebaseWebSocketClient = class {
 					callback.onError(new RebaseApiError(errorMessage, { code: errorCode }));
 				}
 			} else callback.onUpdate(message);
+			return;
+		}
+		if (type === "ERROR" || type === "error" || message.error) {
+			const { errorMessage, errorCode } = extractMessageError(message);
+			console.warn(`[Rebase] Realtime error from the server${errorCode ? ` (${errorCode})` : ""}: ${errorMessage}`);
 		}
 	}
 	async ensureAuthenticated(retryCount = 3) {
@@ -6061,15 +6702,10 @@ var RebaseWebSocketClient = class {
 		}
 	}
 	createCollectionSubscriptionKey(props) {
+		const { collection, ...query } = props;
 		const key = {
-			path: props.path,
-			filter: props.filter,
-			limit: props.limit,
-			startAfter: props.startAfter,
-			orderBy: props.orderBy,
-			order: props.order,
-			searchString: props.searchString,
-			collection: props.collection?.name
+			...query,
+			collection: collection?.name
 		};
 		return JSON.stringify(key, (_, value) => {
 			if (value && typeof value === "object" && !Array.isArray(value)) return Object.keys(value).sort().reduce((sorted, k) => {
@@ -6557,11 +7193,29 @@ var RETRYABLE_STATUSES = /* @__PURE__ */ new Set([
 	503,
 	504
 ]);
+/**
+* The server holds this key for a request it has not answered yet.
+*
+* It is a 409 like a duplicate row is a 409, and nothing but the code separates
+* them — one means "your write is already there", the other means "your write
+* may not have happened at all, ask again".
+*/
+var IDEMPOTENCY_IN_PROGRESS = "IDEMPOTENCY_KEY_IN_PROGRESS";
+/**
+* Is the server still answering an earlier attempt of this same write?
+*
+* The only correct response is to ask again — which is exactly what the
+* server's own message says, and exactly what this SDK used not to do.
+*/
+function isIdempotencyInProgressError(error) {
+	return error instanceof RebaseApiError && error.status === 409 && error.code === IDEMPOTENCY_IN_PROGRESS;
+}
 /** Is this failure worth another attempt later? */
 function isRetryableError(error) {
 	if (isNetworkError(error)) return true;
-	if (error instanceof RebaseApiError) return error.status !== void 0 && RETRYABLE_STATUSES.has(error.status);
-	return false;
+	if (!(error instanceof RebaseApiError)) return false;
+	if (isIdempotencyInProgressError(error)) return true;
+	return error.status !== void 0 && RETRYABLE_STATUSES.has(error.status);
 }
 /**
 * Did this write fail because the row is already there?
@@ -6573,10 +7227,16 @@ function isRetryableError(error) {
 * The queue uses this to recognise its own earlier attempt. A create whose
 * response was lost is replayed, and for a row carrying an id the SDK generated
 * the server can only be rejecting it because the first attempt actually landed.
+*
+* Which is why the status alone cannot decide it: `IDEMPOTENCY_KEY_IN_PROGRESS`
+* is a 409 that means the opposite — the row may not exist at all. Read as a
+* duplicate, the queue looked for a row that was never written, found nothing,
+* concluded there was nothing left to do and deleted the write from the queue.
 */
 function isDuplicateKeyError(error) {
 	if (!(error instanceof RebaseApiError)) return false;
-	return error.code === "23505" || error.status === 409;
+	if (error.code === "23505") return true;
+	return error.status === 409 && !isIdempotencyInProgressError(error);
 }
 var ConnectivityMonitor = class {
 	state = "online";
@@ -6982,14 +7642,23 @@ function looseEquals(a, b) {
 */
 function likeToRegExp(pattern, caseInsensitive) {
 	let source = "^";
+	let lastWasWildcard = false;
 	for (let i = 0; i < pattern.length; i++) {
 		const char = pattern[i];
 		if (char === "\\" && i + 1 < pattern.length) {
 			source += pattern[i + 1].replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 			i++;
-		} else if (char === "%") source += "[\\s\\S]*";
-		else if (char === "_") source += "[\\s\\S]";
-		else source += char.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+			lastWasWildcard = false;
+		} else if (char === "%") {
+			if (!lastWasWildcard) source += "[\\s\\S]*";
+			lastWasWildcard = true;
+		} else if (char === "_") {
+			source += "[\\s\\S]";
+			lastWasWildcard = false;
+		} else {
+			source += char.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+			lastWasWildcard = false;
+		}
 	}
 	return new RegExp(source + "$", caseInsensitive ? "i" : "");
 }
@@ -7121,14 +7790,41 @@ function sortRows(rows, orderBy) {
 function tiebreak(a, b) {
 	return compareValues(a.id, b.id) ?? 0;
 }
-/** Resolve `page`/`offset`/`limit` the way the server does. */
+/**
+* Resolve `page`/`offset`/`limit` the way the server does.
+*
+* It did not: this defaulted an absent limit to 20 while `/api/data` pages by
+* 50, so the same `observe()` answered with 20 rows from the local database and
+* 50 from the network — a list that changed length depending on which side
+* answered, with `page` striding differently on each. Delegated now, so the
+* sentence above is true by construction rather than by agreement.
+*/
 function resolvePagination(params) {
-	const limit = params?.limit ?? 20;
+	const { limit, offset } = resolveFindWindow(params);
 	return {
 		limit,
-		offset: params?.page != null ? Math.max(0, (params.page - 1) * limit) : params?.offset ?? 0
+		offset
 	};
 }
+/** `<`, `<=`, `>`, `>=` — the operators whose answer depends on a collation. */
+var ORDERING_OPS = /* @__PURE__ */ new Set([
+	"<",
+	"<=",
+	">",
+	">="
+]);
+/** Does any condition in this `where` clause order its operands? */
+function whereOrders(where) {
+	if (!where) return false;
+	for (const condition of Object.values(where)) if ((isTuple(condition) ? [condition] : condition.filter(isTuple)).some(([op]) => ORDERING_OPS.has(op))) return true;
+	return false;
+}
+/** The same question, through an `and(...)`/`or(...)` tree. */
+function logicalOrders(condition, depth = 0) {
+	if (!condition || depth > 32) return false;
+	if ("type" in condition) return (condition.conditions ?? []).some((c) => logicalOrders(c, depth + 1));
+	return ORDERING_OPS.has(condition.operator);
+}
 /**
 * Can a locally evaluated answer to `params` be trusted to match the server's,
 * assuming the cache holds every row of the collection?
@@ -7136,11 +7832,67 @@ function resolvePagination(params) {
 * `include` pulls in rows from other collections that this evaluator never
 * sees, and `searchString` is only approximated — both make the local answer a
 * best effort rather than an equivalent one.
+*
+* **Ordering comparisons are refused, and that is the interesting one.**
+* `compareValues` falls back to an `Intl.Collator` for operands it cannot read
+* as numbers or instants. PostgreSQL orders text by the *database's* collation,
+* which is a property of the server this process has never been told: under the
+* C collation `'apple' < 'Banana'` is false, under `en_US.UTF-8` it is true,
+* and the collator says true. So `["<", "Banana"]` selects a different set here
+* than it does there — silently, and in whichever direction the deployment
+* happens to have been created.
+*
+* The refusal covers *every* ordering comparison rather than only the ones with
+* a string operand, because the operand type does not settle it: a numeric
+* bound against a text column (`["<", 10]` on a `varchar`) also reaches the
+* collator, and nothing in `params` says what the column holds. Conservative on
+* purpose — the cost is that a query combining an ordering filter with
+* *unsynced local writes* stops placing those writes optimistically, which is a
+* degraded answer rather than a wrong one. Claiming exactness we do not have is
+* the other way round.
+*
+* This says nothing about ordering *results*; that is a separate claim with a
+* separate answer, because a sort changes which rows come first and not which
+* rows match. See {@link isLocallySortable}.
 */
 function isExactlyEvaluable(params) {
 	if (!params) return true;
 	if (params.include && params.include.length > 0) return false;
 	if (params.searchString) return false;
+	if (params.vectorSearch) return false;
+	if (whereOrders(params.where)) return false;
+	if (logicalOrders(params.logical)) return false;
+	return true;
+}
+/**
+* Would sorting `rows` locally reproduce the order the server would have sent?
+*
+* Asked of the rows rather than of the query, because unlike a filter this one
+* *is* decidable from the data in hand: {@link compareValues} reaches the
+* collator only when it cannot read both operands as numbers, and `toComparable`
+* has already turned dates and relations into numbers and ids by then. If every
+* value on the sort column normalises to a number, the collator is unreachable
+* and the local order is the server's order.
+*
+* A text column is therefore refused — see {@link isExactlyEvaluable} for why
+* the two cannot be made to agree — and so is a column this page happens to see
+* only as strings, which is the same thing from here.
+*
+* Nulls are fine either way: they are ordered by an explicit rule (last
+* ascending, first descending) that matches Postgres and never reaches the
+* comparator.
+*/
+function isLocallySortable(rows, orderBy) {
+	if (!orderBy) return true;
+	const [field] = orderBy;
+	for (const row of rows) {
+		const value = toComparable(row[field]);
+		if (isNullish(value)) continue;
+		if (typeof value === "number" || typeof value === "boolean") continue;
+		if (typeof value === "bigint") continue;
+		if (typeof value === "string" && value.trim() !== "" && !Number.isNaN(Number(value))) continue;
+		return false;
+	}
 	return true;
 }
 /** Run a full query — filter, sort, paginate — over a set of rows. */
@@ -7170,6 +7922,17 @@ function generateOfflineId() {
 	return `off-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
 }
 var MISSING = "\0missing";
+/**
+* Replays to spend on a mutation whose idempotency key the server is still
+* holding, when the app has not asked for more.
+*
+* Retries double from a second and cap at the sync interval, so the default
+* budget of five covers about half a minute — less than the lease a server
+* gives a claim nobody came back for. This many outlast it with room for a slow
+* batch, and the count is what stops a server that never releases the key from
+* blocking the queue behind it indefinitely.
+*/
+var IN_PROGRESS_MIN_RETRIES = 12;
 var OfflineManager = class {
 	store;
 	maxCachedQueries;
@@ -7450,6 +8213,72 @@ var OfflineManager = class {
 				this.notifyCollection(slug);
 				return rows;
 			},
+			updateMany: async (updates, options) => {
+				await this.ensureCollection(slug);
+				if (!Array.isArray(updates)) throw new TypeError("updateMany expects an array of { id, data } entries.");
+				if (updates.length === 0) return [];
+				const anyPending = updates.some((u) => this.hasPending(slug, u.id));
+				if (this.connectivity.shouldAttempt() && !anyPending) try {
+					const rows = await inner.updateMany(updates, options);
+					this.connectivity.markSuccess();
+					await this.ingest(slug, rows);
+					this.notifyCollection(slug);
+					return rows;
+				} catch (error) {
+					if (!isNetworkError(error)) throw error;
+					this.connectivity.markFailure();
+				}
+				const rollback = {};
+				const optimistic = [];
+				for (const { id, data } of updates) {
+					const base = this.rawLocalRow(slug, id);
+					rollback[String(id)] = base ?? null;
+					optimistic.push({
+						...base ?? {},
+						...data,
+						id
+					});
+				}
+				await this.enqueue({
+					collection: slug,
+					type: "updateMany",
+					updates: updates.map((u) => ({
+						id: u.id,
+						data: u.data
+					})),
+					rollback: { rows: rollback }
+				});
+				for (const row of optimistic) this.setLocalRow(slug, row.id, row);
+				this.notifyCollection(slug);
+				return optimistic;
+			},
+			deleteMany: async (ids, options) => {
+				await this.ensureCollection(slug);
+				if (!Array.isArray(ids)) throw new TypeError("deleteMany expects an array of ids.");
+				if (ids.length === 0) return;
+				const anyPending = ids.some((id) => this.hasPending(slug, id));
+				if (this.connectivity.shouldAttempt() && !anyPending) try {
+					await inner.deleteMany(ids, options);
+					this.connectivity.markSuccess();
+					for (const id of ids) this.removeLocalRow(slug, id, true);
+					this.notifyCollection(slug);
+					this.scheduleRefresh(slug);
+					return;
+				} catch (error) {
+					if (!isNetworkError(error)) throw error;
+					this.connectivity.markFailure();
+				}
+				const rollback = {};
+				for (const id of ids) rollback[String(id)] = this.rawLocalRow(slug, id) ?? null;
+				await this.enqueue({
+					collection: slug,
+					type: "deleteMany",
+					ids,
+					rollback: { rows: rollback }
+				});
+				for (const id of ids) this.removeLocalRow(slug, id, false);
+				this.notifyCollection(slug);
+			},
 			update: async (id, data) => {
 				await this.ensureCollection(slug);
 				if (this.connectivity.shouldAttempt() && !this.hasPending(slug, id)) try {
@@ -7528,7 +8357,8 @@ var OfflineManager = class {
 			orderBy: (column, direction) => new SDKQueryBuilder(wrapped).orderBy(column, direction),
 			limit: (count) => new SDKQueryBuilder(wrapped).limit(count),
 			offset: (count) => new SDKQueryBuilder(wrapped).offset(count),
-			search: (searchString) => new SDKQueryBuilder(wrapped).search(searchString),
+			search: (searchString, options) => new SDKQueryBuilder(wrapped).search(searchString, options),
+			vectorSearch: (property, vector, options) => new SDKQueryBuilder(wrapped).vectorSearch(property, vector, options),
 			include: (...relations) => new SDKQueryBuilder(wrapped).include(...relations)
 		};
 		if (inner.listen) wrapped.listen = (params, onUpdate, onError) => inner.listen(params, (response) => {
@@ -7748,9 +8578,8 @@ var OfflineManager = class {
 		if (!state) return {
 			data: [],
 			meta: {
+				...resolvePagination(params),
 				total: 0,
-				limit: params?.limit ?? 20,
-				offset: params?.offset ?? 0,
 				hasMore: false
 			},
 			fromCache: true,
@@ -7786,16 +8615,15 @@ var OfflineManager = class {
 		}
 		let added = 0;
 		const offset = snapshot.offset ?? 0;
-		if (exact && offset === 0) {
-			for (const [key, entry] of state.rows) {
-				if (seen.has(key) || !this.hasPending(slug, key)) continue;
-				if (!this.isLocallyCreated(slug, key)) continue;
-				if (!matchesParams(entry.row, params)) continue;
-				rows.push(entry.row);
-				added++;
-			}
-			if (added > 0 && params?.orderBy) sortRows(rows, params.orderBy);
+		if (exact && offset === 0) for (const [key, entry] of state.rows) {
+			if (seen.has(key) || !this.hasPending(slug, key)) continue;
+			if (!this.isLocallyCreated(slug, key)) continue;
+			if (!matchesParams(entry.row, params)) continue;
+			rows.push(entry.row);
+			added++;
 		}
+		const orderIsLocal = isLocallySortable(rows, params?.orderBy);
+		if (params?.orderBy && orderIsLocal) sortRows(rows, params.orderBy);
 		return {
 			data: rows,
 			meta: {
@@ -7806,7 +8634,7 @@ var OfflineManager = class {
 			},
 			fromCache,
 			hasPendingWrites: rows.some((row) => this.hasPending(slug, row.id)),
-			partial: !exact
+			partial: !exact || !orderIsLocal
 		};
 	}
 	localFind(slug, params) {
@@ -7942,17 +8770,17 @@ var OfflineManager = class {
 		return row;
 	}
 	recordSnapshot(slug, params, result) {
+		const window = resolvePagination(params);
 		const meta = result.meta ?? {
 			total: result.data?.length ?? 0,
-			limit: 20,
-			offset: 0,
+			...window,
 			hasMore: false
 		};
 		const snapshot = {
 			ids: (result.data ?? []).map((row) => row.id).filter((id) => id !== void 0),
 			total: meta.total ?? result.data?.length ?? 0,
-			limit: meta.limit ?? params?.limit ?? 20,
-			offset: meta.offset ?? params?.offset ?? 0,
+			limit: meta.limit ?? window.limit,
+			offset: meta.offset ?? window.offset,
 			hasMore: meta.hasMore ?? false
 		};
 		const state = this.collectionState(slug);
@@ -8121,7 +8949,8 @@ var OfflineManager = class {
 						}
 						op.attempts = (op.attempts ?? 0) + 1;
 						op.lastError = error?.message ?? String(error);
-						if (isRetryableError(error) && op.attempts < this.maxRetries) {
+						const limit = isIdempotencyInProgressError(error) ? Math.max(this.maxRetries, IN_PROGRESS_MIN_RETRIES) : this.maxRetries;
+						if (isRetryableError(error) && op.attempts < limit) {
 							await this.store.enqueue(this.queueKey(op), op).catch(() => void 0);
 							this.connectivity.deferRetry();
 							this.patchStatus({ lastError: op.lastError });
@@ -8167,11 +8996,25 @@ var OfflineManager = class {
 			await this.adoptServerRow(op, op.id, row);
 		} else if (op.type === "createMany") {
 			const queued = op.data ?? [];
-			const rows = await inner.createMany(queued, op.upsert ? { upsert: true } : void 0);
+			const rows = await inner.createMany(queued, {
+				...op.upsert ? { upsert: true } : {},
+				idempotencyKey: op.mutationId
+			});
 			for (let i = 0; i < rows.length; i++) await this.adoptServerRow(op, queued[i]?.id, rows[i]);
+		} else if (op.type === "updateMany") {
+			const queued = op.updates ?? [];
+			const rows = await inner.updateMany(queued.map((u) => ({
+				id: u.id,
+				data: u.data
+			})), { idempotencyKey: op.mutationId });
+			for (let i = 0; i < rows.length; i++) await this.ingestReplaced(op, queued[i].id, rows[i]);
 		} else if (op.type === "update") {
 			const row = await inner.update(op.id, op.data);
 			await this.ingestReplaced(op, op.id, row);
+		} else if (op.type === "deleteMany") {
+			const ids = op.ids ?? [];
+			await inner.deleteMany(ids, { idempotencyKey: op.mutationId });
+			for (const id of ids) this.removeLocalRow(op.collection, id, true);
 		} else if (op.type === "delete") {
 			await inner.delete(op.id);
 			this.removeLocalRow(op.collection, op.id, true);
@@ -8414,23 +9257,37 @@ var OfflineManager = class {
 /**
 * Derive a WebSocket URL from an HTTP base URL.
 * `http://` → `ws://`, `https://` → `wss://`.
+*
+* A backend mounted under a path is the reason `baseUrl` accepts one, so the
+* path is kept. It used to be kept for an absolute `baseUrl` and dropped for a
+* relative one — resolved through `.origin` — so one deployment dialled two
+* different sockets depending on whether its config said `"/backend"` or
+* `"https://app.example.com/backend"`.
+*
+* Returns `""` when there is nothing to resolve against: a relative `baseUrl`
+* outside a browser has no origin, and inventing one would dial somewhere
+* arbitrary. The caller warns rather than leaving that silent.
 */
 function deriveWebSocketUrl(baseUrl) {
+	const toWsProtocol = (url) => {
+		const secure = /^(https|wss):/i.test(url);
+		return url.replace(/^https?:\/\//i, secure ? "wss://" : "ws://").replace(/^wss?:\/\//i, secure ? "wss://" : "ws://").replace(/\/$/, "");
+	};
 	if (typeof window !== "undefined") {
-		let absoluteUrl = "";
+		let absoluteUrl;
 		if (!baseUrl) absoluteUrl = window.location.origin;
 		else if (/^https?:\/\//i.test(baseUrl) || /^wss?:\/\//i.test(baseUrl)) absoluteUrl = baseUrl;
 		else try {
-			absoluteUrl = new URL(baseUrl, window.location.href).origin;
+			const resolved = new URL(baseUrl, window.location.href);
+			absoluteUrl = resolved.origin + resolved.pathname;
 		} catch {
 			absoluteUrl = window.location.origin;
 		}
-		const protocol = absoluteUrl.startsWith("https:") || absoluteUrl.startsWith("wss:") ? "wss:" : "ws:";
-		return absoluteUrl.replace(/^https?:\/\//i, `${protocol}//`).replace(/^wss?:\/\//i, `${protocol}//`).replace(/\/$/, "");
+		return toWsProtocol(absoluteUrl);
 	}
 	if (!baseUrl) return "";
 	if (!/^https?:\/\//i.test(baseUrl) && !/^wss?:\/\//i.test(baseUrl)) return "";
-	return baseUrl.replace(/^https?:\/\//i, (match) => match.toLowerCase() === "https://" ? "wss://" : "ws://").replace(/\/$/, "");
+	return toWsProtocol(baseUrl);
 }
 function createRebaseClient(options) {
 	const transport = createTransport(options, { credentialOutOfBand: options.auth?.authFlowMode === "cookie" });
@@ -8458,7 +9315,11 @@ function createRebaseClient(options) {
 		});
 		return storageSourcesPromise;
 	};
-	const resolvedWsUrl = options.realtime !== false ? options.websocketUrl ?? deriveWebSocketUrl(options.baseUrl) : void 0;
+	const realtimeEnabled = options.realtime !== false;
+	const resolvedWsUrl = realtimeEnabled ? options.websocketUrl ?? deriveWebSocketUrl(options.baseUrl) : void 0;
+	const realtimeUnreachable = realtimeEnabled && !resolvedWsUrl;
+	const unreachableReason = `no WebSocket URL could be derived from baseUrl ${JSON.stringify(options.baseUrl ?? null)} — outside a browser there is no page origin to resolve a relative URL against. Pass an absolute \`baseUrl\`, set \`websocketUrl\` explicitly, or pass \`realtime: false\` to say this was intended.`;
+	if (realtimeUnreachable) console.warn(`[Rebase] Realtime is enabled but ${unreachableReason} Live queries will fall back to a single fetch and channels will throw.`);
 	let ws;
 	/** One channel object per name — see `realtime.channel`. */
 	const realtimeChannels = /* @__PURE__ */ new Map();
@@ -8578,7 +9439,7 @@ function createRebaseClient(options) {
 		* cut off the others.
 		*/
 channel: (name, options) => {
-			if (!ws) throw new RebaseClientError("Realtime is disabled on this client (realtime: false), so channels are unavailable.");
+			if (!ws) throw new RebaseClientError(realtimeUnreachable ? `Realtime is enabled but ${unreachableReason}` : "Realtime is disabled on this client (realtime: false), so channels are unavailable.");
 			let existing = realtimeChannels.get(name);
 			if (!existing) {
 				existing = new RebaseRealtimeChannel(name, ws, options);
@@ -8621,39 +9482,88 @@ channel: (name, options) => {
 }
 //#endregion
 //#region src/history/history-routes.ts
+/** Entries returned when the caller names no `?limit`. */
+var HISTORY_DEFAULT_LIMIT = 20;
+/** Most entries one history read will serve. Above it the request is refused. */
+var HISTORY_MAX_LIMIT = 100;
 function createHistoryRoutes(params) {
-	const { historyService, registry, driver } = params;
+	const { historyService, registry } = params;
 	const router = new Hono();
 	router.onError(errorHandler);
 	/**
+	* Both halves of the authorization the REST generator applies to every
+	* other route on this router, for the row whose history is being asked for.
+	*
+	* `historyService` reads `rebase.entity_history` through the *privileged*
+	* handle the bootstrapper built — not `c.get("driver")` — and it has to:
+	* history is one table shadowing every audited collection, so it cannot
+	* carry their row policies, and `ensure-history-table` revokes it from
+	* `rebase_user` outright for exactly that reason. Nothing about the read is
+	* therefore scoped to the caller. That makes this function the *entire*
+	* access-control model for the route, the same way `storageAuthorize` is
+	* for storage.
+	*
+	* It asks the two questions the data API already answers, in its order:
+	*
+	*  - the API key's permission list, via the same predicate
+	*    `RestApiGenerator.enforceApiKeyPermission` uses, and keyed on the
+	*    request's own method so that reverting needs `write` and listing needs
+	*    `read` — a key scoped to no collection, or to a different one, or to
+	*    reading only, must not get past this;
+	*  - RLS, by fetching the row itself through the request-scoped driver.
+	*    A row the caller may not read comes back undefined, and its history is
+	*    then a 404 rather than a 403, because a 403 confirms the row exists.
+	*
+	* A missing scoped driver is an internal error, never a fallback to the
+	* unscoped one — the same rule, and the same reason, as
+	* {@link RestApiGenerator.getScopedDriver}.
+	*/
+	async function authorizeEntityRead(c, collection, id) {
+		const apiKey = c.get("apiKey");
+		const operation = httpMethodToOperation(c.req.method);
+		if (apiKey && !isOperationAllowed(apiKey.permissions, collection.slug, operation)) throw ApiError.forbidden(`API key does not have "${operation}" permission for collection "${collection.slug}"`, "API_KEY_FORBIDDEN");
+		const scoped = c.get("driver");
+		if (!scoped) throw ApiError.internal("Scoped driver not available");
+		if (!await scoped.fetchOne({
+			path: collection.slug,
+			id,
+			collection
+		})) throw ApiError.notFound(`Entity '${id}' not found in collection '${collection.slug}'`);
+	}
+	/**
 	* GET /:slug/:id/history - List history entries for a entity
 	*
 	* Query params:
-	*   limit  (default 20)
+	*   limit  (default 20, maximum 100 — above that the request is refused)
 	*   offset (default 0)
 	*/
 	router.get("/:slug/:id/history", async (c) => {
 		const slug = c.req.param("slug");
 		const id = c.req.param("id");
-		const parsedLimit = parseInt(c.req.query("limit") ?? "20", 10);
+		const limit = resolveListLimitParam(c.req.query("limit"), {
+			defaultLimit: HISTORY_DEFAULT_LIMIT,
+			maxLimit: HISTORY_MAX_LIMIT
+		});
 		const parsedOffset = parseInt(c.req.query("offset") ?? "0", 10);
-		const limit = Number.isNaN(parsedLimit) ? 20 : parsedLimit;
 		const offset = Number.isNaN(parsedOffset) ? 0 : parsedOffset;
 		const collection = registry.getCollections().find((col) => col.slug === slug || false);
 		if (!collection) throw ApiError.notFound(`Collection '${slug}' not found`);
 		if (!collection.history) throw ApiError.badRequest(`History is not enabled for collection '${slug}'`);
+		await authorizeEntityRead(c, collection, id);
 		const tableName = collection.slug;
+		const appliedLimit = limit;
+		const appliedOffset = Math.max(offset, 0);
 		const result = await historyService.fetchHistory(tableName, id, {
-			limit: Math.min(limit, 100),
-			offset: Math.max(offset, 0)
+			limit: appliedLimit,
+			offset: appliedOffset
 		});
 		return c.json({
 			data: result.data,
 			meta: {
 				total: result.total,
-				limit,
-				offset,
-				hasMore: offset + result.data.length < result.total
+				limit: appliedLimit,
+				offset: appliedOffset,
+				hasMore: appliedOffset + result.data.length < result.total
 			}
 		});
 	});
@@ -8669,12 +9579,13 @@ function createHistoryRoutes(params) {
 		const collection = registry.getCollections().find((col) => col.slug === slug || false);
 		if (!collection) throw ApiError.notFound(`Collection '${slug}' not found`);
 		if (!collection.history) throw ApiError.badRequest(`History is not enabled for collection '${slug}'`);
+		await authorizeEntityRead(c, collection, id);
 		const historyEntry = await historyService.fetchHistoryEntry(historyId);
 		if (!historyEntry) throw ApiError.notFound(`History entry '${historyId}' not found`);
 		const tableName = collection.slug;
 		if (historyEntry.entity_id !== String(id) || historyEntry.table_name !== tableName) throw ApiError.badRequest("History entry does not belong to this entity");
 		if (!historyEntry.values) throw ApiError.badRequest("Cannot revert: history entry has no stored values");
-		const authDriver = c.get("driver") || driver;
+		const authDriver = c.get("driver");
 		const path = collection.slug;
 		const savedEntity = await authDriver.save({
 			path,
@@ -8691,126 +9602,6 @@ function createHistoryRoutes(params) {
 	return router;
 }
 //#endregion
-//#region src/email/smtp-email-service.ts
-var _nodemailer;
-async function loadNodemailer() {
-	if (!_nodemailer) try {
-		_nodemailer = await import("nodemailer");
-	} catch {
-		throw new Error("nodemailer is required for SMTP email. Install it: pnpm add nodemailer");
-	}
-	return _nodemailer;
-}
-/**
-* Safely parse a hostname from a URL string
-*/
-function getHostname(urlStr) {
-	try {
-		return new URL(urlStr.includes("://") ? urlStr : `https://${urlStr}`).hostname;
-	} catch {
-		return;
-	}
-}
-/**
-* SMTP Email Service implementation using Nodemailer
-*/
-var SMTPEmailService = class {
-	transporter = null;
-	config;
-	_initialized = false;
-	constructor(config) {
-		this.config = config;
-	}
-	/**
-	* Lazily initialize the SMTP transporter on first use
-	*/
-	async ensureTransporter() {
-		if (this._initialized) return;
-		this._initialized = true;
-		if (this.config.smtp) {
-			const nodemailer = await loadNodemailer();
-			let smtpName = this.config.smtp.name;
-			if (!smtpName) {
-				const urlsToTry = [
-					process.env.FRONTEND_URL,
-					this.config.resetPasswordUrl,
-					this.config.verifyEmailUrl
-				];
-				for (const urlStr of urlsToTry) if (urlStr) {
-					const hostname = getHostname(urlStr);
-					if (hostname) {
-						smtpName = hostname;
-						break;
-					}
-				}
-			}
-			this.transporter = nodemailer.createTransport({
-				name: smtpName,
-				host: this.config.smtp.host,
-				port: this.config.smtp.port,
-				secure: this.config.smtp.secure ?? this.config.smtp.port === 465,
-				auth: this.config.smtp.auth ? {
-					user: this.config.smtp.auth.user,
-					pass: this.config.smtp.auth.pass
-				} : void 0
-			});
-		}
-	}
-	/**
-	* Check if the email service is properly configured
-	*/
-	isConfigured() {
-		return !!(this.config.smtp || this.config.sendEmail);
-	}
-	/**
-	* Send an email using SMTP or custom send function
-	*/
-	async send(options) {
-		if (this.config.sendEmail) {
-			await this.config.sendEmail(options);
-			return;
-		}
-		await this.ensureTransporter();
-		if (!this.transporter) throw new Error("Email service not configured. Provide SMTP config or sendEmail function.");
-		const to = Array.isArray(options.to) ? options.to.join(", ") : options.to;
-		try {
-			await this.transporter.sendMail({
-				from: this.config.from,
-				to,
-				subject: options.subject,
-				html: options.html,
-				text: options.text,
-				replyTo: options.replyTo
-			});
-		} catch (error) {
-			const message = error instanceof Error ? error.message : String(error);
-			logger.error("Failed to send email", { detail: message });
-			throw new Error(`Failed to send email: ${message}`);
-		}
-	}
-	/**
-	* Verify SMTP connection (useful for startup checks)
-	*/
-	async verifyConnection() {
-		await this.ensureTransporter();
-		if (!this.transporter) return !!this.config.sendEmail;
-		try {
-			await this.transporter.verify();
-			return true;
-		} catch (error) {
-			const message = error instanceof Error ? error.message : String(error);
-			logger.error("SMTP connection verification failed", { detail: message });
-			return false;
-		}
-	}
-};
-/**
-* Create an email service from configuration
-*/
-function createEmailService(config) {
-	return new SMTPEmailService(config);
-}
-//#endregion
 //#region src/singleton.ts
 /**
 * The backing instance lives on a process-global slot, NOT in a module-local
@@ -8871,14 +9662,30 @@ function _resetRebaseMock() {
 * **Admin data plane** (`rebase.dataAsAdmin`):
 * Backed by the native DataDriver — calls go directly to the database without
 * JSON serialization, HTTP dispatch, or middleware overhead. The driver is
-* scoped as `{ uid: "service", roles: ["admin"] }`, so **every read and write
-* bypasses row-level-security policies**. No `REBASE_SERVICE_KEY` is required.
-*
-* ⚠️ Because it bypasses RLS, `rebase.dataAsAdmin` is for trusted background
-* work (cron jobs, migrations, service tasks) — **not** for serving user-facing
-* data. Inside a request handler, run user-scoped queries through the
-* request-scoped driver (`c.var.driver`), which carries the caller's identity
-* so RLS applies.
+* scoped once as `{ uid: "service", roles: ["admin"] }` (`SERVICE_IDENTITY`),
+* which makes it **admin-scoped, not RLS-bypassing**: every read and write runs
+* in a transaction that has done `SET LOCAL ROLE rebase_user` with
+* `app.uid = 'service'`, and policies are evaluated against that. No
+* `REBASE_SERVICE_KEY` is required.
+*
+* It clears the default policies through their `rolesOverlap(['admin'])` arm —
+* which is why the difference rarely shows. It shows when you write your own:
+*
+* - `policy.serverContext()` compiles to `auth.uid() IS NULL` and is therefore
+*   **false** for this accessor. A collection with `disableDefaultPolicies:
+*   true` whose rule is `serverContext()` denies these writes (`42501`) and
+*   returns zero rows — HTTP 200, empty — for these reads.
+* - Its reach equals an `admin`-roled application user's reach. It is not a
+*   private door.
+*
+* `rebase.sql()` *is* an unconditional bypass — it runs on the owner connection
+* and never goes through `withAuth`. Of the two accessors on this object, the
+* quieter one is the more privileged.
+*
+* ⚠️ `rebase.dataAsAdmin` is for trusted background work (cron jobs,
+* migrations, service tasks) — **not** for serving user-facing data. Inside a
+* request handler, run user-scoped queries through the request-scoped driver
+* (`c.var.driver`), which carries the caller's identity.
 *
 * `rebase.data` is **gone from the type**: `RebaseServerClient` omits it, so the
 * admin-scoped accessor has exactly one name and the privilege is visible at the
@@ -8894,7 +9701,8 @@ function _resetRebaseMock() {
 * ```typescript
 * import { rebase } from "@rebasepro/server";
 *
-* // In a cron job, hook, or trusted service file (admin scope, bypasses RLS):
+* // In a cron job, hook, or trusted service file (admin scope, RLS evaluated
+* // as `{ uid: "service", roles: ["admin"] }`):
 * await rebase.email.send({ to: "admin@co.com", subject: "Alert", html: "<p>Hi</p>" });
 * const jobs = await rebase.dataAsAdmin.jobs.find({ limit: 10 });
 * ```
@@ -9009,6 +9817,7 @@ async function _initializeRebaseBackend(config) {
 	if (config.logging?.level) configureLogLevel(config.logging.level);
 	else configureLogLevel();
 	logger.info("Initializing Rebase Backend");
+	installUnhandledRejectionHandler();
 	const basePath = config.basePath || "/api";
 	const isProduction = process.env.NODE_ENV === "production";
 	configureMiddlewares(config.app, basePath, isProduction, config);
@@ -9249,7 +10058,7 @@ async function _initializeRebaseBackend(config) {
 			]) {
 				const providerConfig = safeAuthConfig[key];
 				if (providerConfig && requiredFields.every((f) => Boolean(providerConfig[f]))) {
-					const createFn = (await import("./auth-CuC9M2x6.js").then((n) => n.t))[factory];
+					const createFn = (await import("./auth-DkAHqvf5.js").then((n) => n.t))[factory];
 					oauthProviders.push(createFn(providerConfig));
 				}
 			}
@@ -9264,6 +10073,7 @@ async function _initializeRebaseBackend(config) {
 				allowUserLookup: safeAuthConfig.allowUserLookup ?? false,
 				defaultRole: safeAuthConfig.defaultRole,
 				oauthProviders,
+				allowedRedirectUris: safeAuthConfig.allowedRedirectUris,
 				serviceKey: serviceKey || internalServiceKey,
 				authHooks: safeAuthConfig.hooks,
 				collectionAuthConfig,
@@ -9343,7 +10153,7 @@ async function _initializeRebaseBackend(config) {
 	let schemaEditorOff = schemaEditorUnavailable();
 	let schemaEditorRoutes;
 	if (!schemaEditorOff && config.collectionsDir) try {
-		schemaEditorRoutes = (await import("./schema-editor-routes-CbF20Mf1.js")).createSchemaEditorRoutes(config.collectionsDir);
+		schemaEditorRoutes = (await import("./schema-editor-routes-DZFKGXgq.js")).createSchemaEditorRoutes(config.collectionsDir);
 	} catch (err) {
 		if (err?.code === "ERR_MODULE_NOT_FOUND") {
 			schemaEditorOff = {
@@ -9413,6 +10223,7 @@ async function _initializeRebaseBackend(config) {
 		config.app.route(`${basePath}/storage`, storageStub);
 		logger.info("Storage not configured — /storage returns 501 STORAGE_NOT_CONFIGURED");
 	}
+	const serverCollections = activeCollections.filter((collection) => resolveDataSource(collection, dataSourceRegistry).transport === "server");
 	if (activeCollections.length > 0) {
 		const dataRouter = new Hono();
 		dataRouter.onError(errorHandler);
@@ -9454,11 +10265,11 @@ async function _initializeRebaseBackend(config) {
 			});
 			dataRouter.route("/", historyRoutes);
 		}
-		const restGenerator = new RestApiGenerator(activeCollections.filter((collection) => resolveDataSource(collection, dataSourceRegistry).transport === "server"), defaultDriver, authAdapter);
+		const restGenerator = new RestApiGenerator(serverCollections, defaultDriver, authAdapter);
 		dataRouter.route("/", restGenerator.generateRoutes());
 		config.app.route(`${basePath}/data`, dataRouter);
 	}
-	await mountOpenApiDocs(config.app, basePath, config.enableSwagger, activeCollections, resolveRequireAuth(config.auth));
+	await mountOpenApiDocs(config.app, basePath, config.enableSwagger, serverCollections, resolveRequireAuth(config.auth));
 	const serverClient = createRebaseClient({
 		baseUrl: "http://localhost",
 		apiPath: basePath,
@@ -9468,10 +10279,7 @@ async function _initializeRebaseBackend(config) {
 			return await config.app.request(input, init);
 		}
 	});
-	const serviceIdentity = {
-		uid: "service",
-		roles: ["admin"]
-	};
+	const serviceIdentity = SERVICE_IDENTITY;
 	const defaultData = buildSdkData(await scopeDataDriver(defaultDriver, serviceIdentity));
 	storageAuthorizeData.current = defaultData;
 	const dataSourcesByKey = {};
@@ -9513,55 +10321,59 @@ async function _initializeRebaseBackend(config) {
 		Object.assign(serverClient, { sql: (query, options) => driverAdmin.executeSql(query, options) });
 		logger.info("SQL capability attached to singleton");
 	}
-	_initRebase(serverClient);
+	const serverSingleton = serverClient;
+	_initRebase(serverSingleton);
 	logger.info("Rebase singleton initialized");
 	if (defaultDriverResult.internals) {
 		const driver = defaultDriverResult.internals.driver;
 		if (driver && "client" in driver) driver.client = serverClient;
 	}
 	if (config.functionsDir) {
-		const { loadFunctionsFromDirectory } = await import("./function-loader-B_1fYfUY.js").then((n) => n.t);
-		const { createFunctionRoutes } = await import("./function-routes-C0cLIy3N.js").then((n) => n.n);
-		const loadedFunctions = await loadFunctionsFromDirectory(config.functionsDir);
-		if (loadedFunctions.length > 0) {
-			const functionsRouter = new Hono();
-			functionsRouter.onError(errorHandler);
-			const functionsRequireAuth = false;
-			if (authAdapter) functionsRouter.use("/*", createAdapterAuthMiddleware({
-				adapter: authAdapter,
-				driver: defaultDriver,
-				requireAuth: functionsRequireAuth,
-				apiKeyStore
-			}));
-			else functionsRouter.use("/*", createAuthMiddleware({
-				driver: defaultDriver,
-				requireAuth: functionsRequireAuth,
-				serviceKey: internalServiceKey,
-				apiKeyStore
-			}));
-			functionsRouter.use("/*", createFunctionApiKeyGuard(`${basePath}/functions`));
-			if (rateLimitConfig) functionsRouter.use("/*", createDataRateLimiter({
-				...rateLimitConfig,
-				anonymous: null
-			}));
-			const fnRoutes = createFunctionRoutes(loadedFunctions);
-			functionsRouter.route("/", fnRoutes);
-			config.app.route(`${basePath}/functions`, functionsRouter);
-			logger.info("Mounted custom functions", {
-				count: loadedFunctions.length,
-				path: `${basePath}/functions`
-			});
-		}
+		const { loadFunctionsWithDiagnostics } = await import("./function-loader-D1SwtCa5.js").then((n) => n.t);
+		const { createFunctionRoutes } = await import("./function-routes-Btcez1T-.js").then((n) => n.n);
+		const { createFunctionsRequestTimeout, resolveFunctionsTimeoutMs } = await import("./request-timeout-RivJsME0.js");
+		const { functions: loadedFunctions, problems } = await loadFunctionsWithDiagnostics(config.functionsDir);
+		const functionsRouter = new Hono();
+		functionsRouter.onError(errorHandler);
+		const functionsTimeoutMs = resolveFunctionsTimeoutMs(config.functionsTimeoutMs);
+		if (functionsTimeoutMs > 0) functionsRouter.use("/*", createFunctionsRequestTimeout(functionsTimeoutMs));
+		const functionsRequireAuth = false;
+		if (authAdapter) functionsRouter.use("/*", createAdapterAuthMiddleware({
+			adapter: authAdapter,
+			driver: defaultDriver,
+			requireAuth: functionsRequireAuth,
+			apiKeyStore
+		}));
+		else functionsRouter.use("/*", createAuthMiddleware({
+			driver: defaultDriver,
+			requireAuth: functionsRequireAuth,
+			serviceKey: internalServiceKey,
+			apiKeyStore
+		}));
+		functionsRouter.use("/*", createFunctionApiKeyGuard(`${basePath}/functions`));
+		if (rateLimitConfig) functionsRouter.use("/*", createDataRateLimiter({
+			...rateLimitConfig,
+			anonymous: rateLimitConfig.anonymousFunctions !== void 0 ? rateLimitConfig.anonymousFunctions : DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT
+		}));
+		const fnRoutes = createFunctionRoutes(loadedFunctions, problems.length);
+		functionsRouter.route("/", fnRoutes);
+		config.app.route(`${basePath}/functions`, functionsRouter);
+		if (loadedFunctions.length > 0) logger.info("Mounted custom functions", {
+			count: loadedFunctions.length,
+			path: `${basePath}/functions`,
+			timeoutMs: functionsTimeoutMs
+		});
+		else logger.warn(`Function routes mounted at ${basePath}/functions, but no functions loaded from ${config.functionsDir}. ` + (problems.length > 0 ? `${problems.length} file(s) were skipped — see the messages above.` : "The directory holds no .ts/.js function files."));
 	}
 	let cronScheduler;
 	if (config.cronsDir) {
-		const { loadCronJobsFromDirectory } = await import("./cron-loader-B1S2MCSl.js").then((n) => n.t);
-		const { CronScheduler } = await import("./cron-scheduler-B3RFt0HS.js").then((n) => n.n);
-		const { createCronRoutes } = await import("./cron-routes-CrQ0tK-_.js").then((n) => n.n);
-		const { createCronStore } = await import("./cron-store-BywZsyfZ.js").then((n) => n.n);
+		const { loadCronJobsFromDirectory } = await import("./cron-loader-3U5aGILy.js").then((n) => n.t);
+		const { CronScheduler } = await import("./cron-scheduler-FJAaCAXm.js").then((n) => n.n);
+		const { createCronRoutes } = await import("./cron-routes-rZgwlOz4.js").then((n) => n.n);
+		const { createCronStore } = await import("./cron-store-9NmUDfzL.js").then((n) => n.n);
 		const loadedCronJobs = await loadCronJobsFromDirectory(config.cronsDir);
 		cronScheduler = new CronScheduler();
-		cronScheduler.setClient(serverClient);
+		cronScheduler.setClient(serverSingleton);
 		if (loadedCronJobs.length > 0) {
 			cronScheduler.registerJobs(loadedCronJobs);
 			const store = defaultBootstrapper.getAdmin?.(defaultDriverResult) && config.cronPersistence !== false ? createCronStore(defaultDriver) : void 0;
@@ -9583,7 +10395,7 @@ async function _initializeRebaseBackend(config) {
 		} else logger.warn(`Cron routes mounted at ${basePath}/cron, but no jobs loaded from ${config.cronsDir}. Nothing is scheduled — check the messages above for files that failed to load.`);
 	}
 	{
-		const { createBackupRoutes, parseBackupDestination } = await import("./backup-CVggVhR2.js").then((n) => n.t);
+		const { createBackupRoutes, parseBackupDestination } = await import("./backup-DLluVyuA.js").then((n) => n.t);
 		const backupRouter = new Hono();
 		applyAdminGate(backupRouter, "Backup");
 		backupRouter.route("/", createBackupRoutes({
@@ -9605,7 +10417,7 @@ async function _initializeRebaseBackend(config) {
 		logger.info("Logs routes mounted", { path: `${basePath}/logs` });
 	}
 	{
-		const { createContractRoutes } = await import("./contract-routes-Dj8i5AiM.js").then((n) => n.t);
+		const { createContractRoutes } = await import("./contract-routes-BB1U05sS.js").then((n) => n.t);
 		const contractRouter = new Hono();
 		if (adminSurfacesGated) {
 			if (apiKeyPreAuth) contractRouter.use("/contract", apiKeyPreAuth);
@@ -9699,7 +10511,10 @@ async function _initializeRebaseBackend(config) {
 * export default defineFunction((app, { rebase }) => {
 *     app.use("/*", requireAuth);
 *     app.get("/home", async (c) => {
-*         const [stats] = await rebase.sql!(`SELECT count(*) AS n FROM orders`);
+*         // `rebase.sql` runs on the owner connection: no RLS, no policies,
+*         // every row. It is the most privileged thing in this context —
+*         // more so than `dataAsAdmin`, which is merely admin-scoped.
+*         const [stats] = await rebase.sql(`SELECT count(*) AS n FROM orders`);
 *         return c.json({ orders: Number(stats.n) });
 *     });
 * });
@@ -9724,6 +10539,17 @@ function defineFunction(definition) {
 *
 * @see {@link defineFunction} for the equivalent custom-functions helper.
 *
+* `ctx.rebase` is the `rebase` singleton itself — the same object a custom
+* function is handed — so `rebase.dataAsAdmin` here is **admin-scoped, not an
+* RLS bypass**: it is scoped once at boot as `SERVICE_IDENTITY`
+* (`{ uid: "service", roles: ["admin"] }`), and your policies are evaluated
+* against that identity, not skipped. See that constant's docblock. It clears
+* the default policies through their `rolesOverlap(['admin'])` arm, which is why
+* the distinction rarely shows; it shows against hand-written rules, where
+* `policy.serverContext()` (`auth.uid() IS NULL`) is **false** for it. Use
+* `rebase.sql()` when you need the genuine bypass — owner connection, no
+* policies.
+*
 * @example
 * ```ts
 * import { defineCron } from "@rebasepro/server";
@@ -9731,12 +10557,15 @@ function defineFunction(definition) {
 * export default defineCron({
 *     name: "Nightly cleanup",
 *     schedule: "0 3 * * *",
-*     async handler({ client, log }) {
-*         const { data: expired } = await client.data.sessions.find({
+*     async handler({ rebase, log }) {
+*         // `dataAsAdmin` runs as the service identity, with the `admin` role.
+*         // A cron has no per-request user to narrow that, so scope the
+*         // filters yourself — RLS will not do it for you here.
+*         const { data: expired } = await rebase.dataAsAdmin.sessions.find({
 *             where: { expired: ["==", true] },
 *         });
 *         for (const session of expired) {
-*             await client.data.sessions.delete(session.id);
+*             await rebase.dataAsAdmin.sessions.delete(session.id as string);
 *         }
 *         log(`Deleted ${expired.length} expired sessions`);
 *     },
@@ -9749,36 +10578,41 @@ function defineCron(definition) {
 //#endregion
 //#region src/utils/sql.ts
 /**
-* Returns a SQL chunk calling `auth.uid()` — the current user's ID.
-* This is a PostgreSQL RLS helper function created in the `auth` schema
+* Returns a SQL chunk calling `rebase.uid()` — the current user's ID.
+* This is a PostgreSQL RLS helper function created in the `rebase` schema
 * that reads `app.uid` set per-transaction by `withAuth()`.
 *
+* The function moved from `auth.uid()` to `rebase.uid()` in 1.0 — `auth` is
+* Supabase's schema, and taking it meant Rebase could not be pointed at a
+* database that already had one. Use this helper rather than writing the call
+* by hand and the move costs you nothing.
+*
 * @example
 * sql`${table.uid} = ${authUid()}`
 */
 var authUid = () => {
-	return sql`auth.uid()`;
+	return sql.raw(RLS_UID_SQL);
 };
 /**
-* Returns a SQL chunk calling `auth.roles()` — the current user's roles
+* Returns a SQL chunk calling `rebase.roles()` — the current user's roles
 * as a comma-separated string.
 * Reads `app.user_roles` set per-transaction by `withAuth()`.
 *
 * @example
-* sql`auth.roles() ~ 'admin'`
+* sql`${authRoles()} ~ 'admin'`
 */
 var authRoles = () => {
-	return sql`auth.roles()`;
+	return sql.raw(RLS_ROLES_SQL);
 };
 /**
-* Returns a SQL chunk calling `auth.jwt()` — the full JWT claims as JSONB.
+* Returns a SQL chunk calling `rebase.jwt()` — the full JWT claims as JSONB.
 * Reads `app.jwt` set per-transaction by `withAuth()`.
 *
 * @example
-* sql`auth.jwt()->>'sub'`
+* sql`${authJwt()}->>'sub'`
 */
 var authJwt = () => {
-	return sql`auth.jwt()`;
+	return sql.raw(RLS_JWT_SQL);
 };
 //#endregion
 //#region src/env.ts
@@ -9915,7 +10749,158 @@ function loadEnv(options) {
 	return env;
 }
 //#endregion
+//#region src/services/outbound-url-guard.ts
+/**
+* Refusal to send a request to a destination the guard does not allow.
+*
+* Distinct from a network error on purpose: a blocked destination is
+* *terminal* — retrying it re-runs the same refusal — while an `ENOTFOUND`
+* or a refused connection is worth another attempt.
+*/
+var BlockedUrlError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "BlockedUrlError";
+	}
+};
+/** Names that mean "this machine" or "this network" before DNS is even asked. */
+var BLOCKED_HOST_SUFFIXES = [
+	".localhost",
+	".local",
+	".internal",
+	".home.arpa"
+];
+async function defaultLookup(hostname) {
+	return (await lookup(hostname, {
+		all: true,
+		verbatim: true
+	})).map((e) => e.address);
+}
+/**
+* Parse an IPv6 literal into its 16 bytes. Returns `null` for anything that is
+* not one — the caller has already established the string *is* an IPv6 address
+* via `isIP`, so `null` here means "shape we do not model", which is treated as
+* blocked rather than allowed.
+*/
+function parseIpv6(address) {
+	let text = address;
+	const zone = text.indexOf("%");
+	if (zone !== -1) text = text.slice(0, zone);
+	let tail = [];
+	const lastColon = text.lastIndexOf(":");
+	const maybeV4 = text.slice(lastColon + 1);
+	if (maybeV4.includes(".")) {
+		if (isIP(maybeV4) !== 4) return null;
+		tail = maybeV4.split(".").map(Number);
+		text = text.slice(0, lastColon);
+		if (text.endsWith(":")) text += ":";
+	}
+	const halves = text.split("::");
+	if (halves.length > 2) return null;
+	const head = halves[0] ? halves[0].split(":") : [];
+	const rest = halves.length === 2 ? halves[1] ? halves[1].split(":") : [] : [];
+	const missing = 8 - tail.length / 2 - head.length - rest.length;
+	if (halves.length === 1 ? missing !== 0 : missing < 0) return null;
+	const all = [
+		...head,
+		...new Array(halves.length === 2 ? missing : 0).fill("0"),
+		...rest
+	];
+	const bytes = [];
+	for (const group of all) {
+		const value = Number.parseInt(group, 16);
+		if (!Number.isFinite(value) || value < 0 || value > 65535 || !/^[0-9a-fA-F]{1,4}$/.test(group)) return null;
+		bytes.push(value >> 8 & 255, value & 255);
+	}
+	return [...bytes, ...tail];
+}
+/**
+* Why this IPv4 address must not be a webhook destination, or `null` if it is
+* an ordinary public address.
+*/
+function blockedIpv4Reason(bytes) {
+	const [a, b] = bytes;
+	if (a === 0) return "\"this network\" (0.0.0.0/8)";
+	if (a === 10) return "private (10.0.0.0/8)";
+	if (a === 127) return "loopback (127.0.0.0/8)";
+	if (a === 169 && b === 254) return "link-local (169.254.0.0/16) — the cloud metadata range";
+	if (a === 172 && b >= 16 && b <= 31) return "private (172.16.0.0/12)";
+	if (a === 192 && b === 168) return "private (192.168.0.0/16)";
+	if (a === 100 && b >= 64 && b <= 127) return "carrier-grade NAT (100.64.0.0/10)";
+	if (a === 192 && b === 0 && bytes[2] === 0) return "IETF protocol assignments (192.0.0.0/24)";
+	if (a === 198 && (b === 18 || b === 19)) return "benchmarking (198.18.0.0/15)";
+	if (a >= 224) return "multicast, reserved or broadcast (224.0.0.0/4 and above)";
+	return null;
+}
+/**
+* Why this address must not be a webhook destination, or `null` if it is an
+* ordinary public address. Exported for tests and for anyone else adding an
+* outbound call whose destination comes from data.
+*/
+function blockedAddressReason(address) {
+	const version = isIP(address);
+	if (version === 4) return blockedIpv4Reason(address.split(".").map(Number));
+	if (version !== 6) return `not an IP address: ${address}`;
+	const bytes = parseIpv6(address);
+	if (!bytes || bytes.length !== 16) return `unparseable IPv6 address: ${address}`;
+	const low32 = bytes.slice(12);
+	const isMapped = bytes.slice(0, 10).every((x) => x === 0) && bytes[10] === 255 && bytes[11] === 255;
+	const isCompat = bytes.slice(0, 12).every((x) => x === 0) && !(low32[0] === 0 && low32[1] === 0);
+	const isNat64 = bytes[0] === 0 && bytes[1] === 100 && bytes[2] === 255 && bytes[3] === 155;
+	if (isMapped || isCompat || isNat64) return blockedIpv4Reason(low32);
+	if (bytes[0] === 32 && bytes[1] === 2) return blockedIpv4Reason(bytes.slice(2, 6));
+	if (bytes.every((x) => x === 0)) return "unspecified (::)";
+	if (bytes.slice(0, 15).every((x) => x === 0) && bytes[15] === 1) return "loopback (::1)";
+	if (bytes[0] === 254 && (bytes[1] & 192) === 128) return "link-local (fe80::/10)";
+	if ((bytes[0] & 254) === 252) return "unique local (fc00::/7)";
+	if (bytes[0] === 255) return "multicast (ff00::/8)";
+	return null;
+}
+/**
+* Resolve and validate a destination before anything connects to it.
+*
+* Three checks, in order, because each is cheaper than the next: the scheme,
+* the hostname, then every address the hostname resolves to. *Every* address —
+* a name that answers with one public and one private record is a rebinding
+* attempt, and taking the first record would let it through.
+*
+* Known limit: this is validate-then-fetch. Between the lookup here and the
+* connection the runtime makes there is a second resolution this code does not
+* see, so a TTL-0 name that flips between answers can still land on a blocked
+* address. Closing that needs the socket pinned to the address checked here,
+* which Node's global `fetch` does not expose without an undici dispatcher.
+* The redirect policy in {@link WebhookDispatcher} closes the much wider
+* version of the same hole — a receiver that simply *points* at the internal
+* address.
+*
+* @throws BlockedUrlError when the destination is not allowed. DNS failures
+* are rethrown as they are, so callers can tell "never send this" from
+* "could not send this right now".
+*/
+async function assertAllowedOutboundUrl(rawUrl, options = {}) {
+	let url;
+	try {
+		url = new URL(rawUrl);
+	} catch {
+		throw new BlockedUrlError(`Invalid webhook URL: ${JSON.stringify(rawUrl)}`);
+	}
+	if (url.protocol !== "https:" && url.protocol !== "http:") throw new BlockedUrlError(`Webhook URL must be http(s), got "${url.protocol}" in ${url.href}`);
+	if (options.allowPrivateNetworks) return url;
+	const hostname = url.hostname.startsWith("[") ? url.hostname.slice(1, -1) : url.hostname;
+	const lowered = hostname.toLowerCase();
+	if (lowered === "localhost" || BLOCKED_HOST_SUFFIXES.some((suffix) => lowered.endsWith(suffix))) throw new BlockedUrlError(`Webhook URL host "${hostname}" is an internal name`);
+	const addresses = isIP(hostname) ? [hostname] : await (options.lookup ?? defaultLookup)(hostname);
+	if (addresses.length === 0) throw new BlockedUrlError(`Webhook URL host "${hostname}" resolved to no addresses`);
+	for (const address of addresses) {
+		const reason = blockedAddressReason(address);
+		if (reason) throw new BlockedUrlError(`Webhook URL host "${hostname}" resolves to ${address}, which is ${reason}. Set allowPrivateNetworks to deliver to it anyway.`);
+	}
+	return url;
+}
+//#endregion
 //#region src/services/webhook-service.ts
+/** Read at most this much of a response before cancelling the rest. */
+var MAX_RESPONSE_BYTES = 64 * 1024;
 var WebhookDispatcher = class {
 	webhooks = [];
 	maxRetries = 3;
@@ -9924,35 +10909,107 @@ var WebhookDispatcher = class {
 		5e3,
 		15e3
 	];
+	options;
+	timeoutMs;
+	queue = [];
+	draining = null;
+	constructor(options = {}) {
+		this.options = options;
+		this.timeoutMs = options.timeoutMs ?? 1e4;
+	}
 	/** Register webhooks to watch */
 	setWebhooks(webhooks) {
 		this.webhooks = webhooks.filter((w) => w.enabled);
 	}
-	/** Called when a entity changes — checks if any webhook matches */
+	/**
+	* Called when a entity changes — checks if any webhook matches, and awaits
+	* every delivery, retries included.
+	*
+	* **Do not await this inside a collection callback.** `afterSave` and
+	* `afterDelete` run inside the write's Postgres transaction, so awaiting a
+	* delivery here holds a pooled connection and the row's locks for as long
+	* as the receiver takes to answer — up to ~36s across three attempts, per
+	* matching webhook. Use {@link enqueueEntityChange} there; this method is
+	* for a custom function or a job that wants the results.
+	*/
 	async onEntityChange(table, event, id, entity, previousEntity) {
-		const matchingWebhooks = this.webhooks.filter((w) => w.table === table && w.events.includes(event));
-		if (matchingWebhooks.length === 0) return [];
+		const jobs = this.buildDeliveries(table, event, entity, previousEntity);
 		const results = [];
-		for (const webhook of matchingWebhooks) {
-			const payload = {
+		for (const job of jobs) {
+			const result = await this.deliverWithRetry(job.webhook, job.event, job.payload);
+			this.options.onDelivery?.(result);
+			results.push(result);
+		}
+		return results;
+	}
+	/**
+	* Queue the same deliveries and return immediately.
+	*
+	* This is the form a collection callback wants. `afterSave` is awaited
+	* *inside* the transaction that wrote the row, so anything it awaits is
+	* transaction time; queueing hands the HTTP to a drain loop that runs
+	* after the callback returns, and the transaction commits without waiting
+	* for a third party. It also means a receiver that is down can no longer
+	* fail the customer's write.
+	*
+	* The cost, stated plainly: the queue is in-process and in-memory. A crash
+	* or a deploy between the enqueue and the delivery drops the event, and a
+	* receiver may see the notification a few milliseconds before the row it
+	* describes is committed. Use {@link flush} on shutdown, and
+	* `onDelivery` to record failures.
+	*/
+	enqueueEntityChange(table, event, id, entity, previousEntity) {
+		const jobs = this.buildDeliveries(table, event, entity, previousEntity);
+		if (jobs.length === 0) return;
+		this.queue.push(...jobs);
+		this.startDraining();
+	}
+	/**
+	* Wait for every queued delivery to finish. For graceful shutdown, and for
+	* tests that need to observe what {@link enqueueEntityChange} sent.
+	*/
+	async flush() {
+		while (this.draining) await this.draining;
+	}
+	startDraining() {
+		if (this.draining) return;
+		const run = this.drainQueue().finally(() => {
+			if (this.draining === run) this.draining = null;
+		});
+		this.draining = run;
+	}
+	async drainQueue() {
+		while (this.queue.length > 0) {
+			const job = this.queue.shift();
+			try {
+				const result = await this.deliverWithRetry(job.webhook, job.event, job.payload);
+				this.options.onDelivery?.(result);
+			} catch {}
+		}
+	}
+	/** The payload each matching webhook gets for this change. */
+	buildDeliveries(table, event, entity, previousEntity) {
+		return this.webhooks.filter((w) => w.table === table && w.events.includes(event)).map((webhook) => ({
+			webhook,
+			event,
+			payload: {
 				type: event,
 				table,
 				record: entity,
 				old_record: event === "UPDATE" ? previousEntity : void 0,
 				schema: "public",
 				timestamp: (/* @__PURE__ */ new Date()).toISOString()
-			};
-			const result = await this.deliverWithRetry(webhook, event, payload);
-			results.push(result);
-		}
-		return results;
+			}
+		}));
 	}
 	async deliverWithRetry(webhook, event, payload) {
 		for (let attempt = 1; attempt <= this.maxRetries; attempt++) {
-			const result = await this.deliver(webhook, event, payload, attempt);
-			if (result.success) return result;
-			if (attempt < this.maxRetries) await new Promise((r) => setTimeout(r, this.retryDelays[attempt - 1]));
-			else return result;
+			const { result, terminal } = await this.deliver(webhook, event, payload, attempt);
+			if (result.success || terminal) return result;
+			if (attempt < this.maxRetries) {
+				const backoff = this.retryDelays[attempt - 1] ?? this.retryDelays[this.retryDelays.length - 1];
+				await new Promise((r) => setTimeout(r, backoff));
+			} else return result;
 		}
 		return {
 			webhookId: webhook.id,
@@ -9975,41 +11032,106 @@ var WebhookDispatcher = class {
 			...webhook.headers || {}
 		};
 		if (webhook.secret) headers["X-Webhook-Signature"] = `sha256=${createHmac("sha256", webhook.secret).update(body).digest("hex")}`;
+		const controller = new AbortController();
+		const timeout = setTimeout(() => controller.abort(), this.timeoutMs);
 		try {
-			const controller = new AbortController();
-			const timeout = setTimeout(() => controller.abort(), 1e4);
-			const response = await fetch(webhook.url, {
+			const url = await assertAllowedOutboundUrl(webhook.url, {
+				allowPrivateNetworks: this.options.allowPrivateNetworks,
+				lookup: this.options.lookup
+			});
+			const response = await fetch(url.href, {
 				method: "POST",
 				headers,
 				body,
-				signal: controller.signal
+				signal: controller.signal,
+				redirect: "manual"
 			});
-			clearTimeout(timeout);
-			const responseBody = await response.text().catch(() => "");
+			if (response.status >= 300 && response.status < 400) {
+				const location = typeof response.headers?.get === "function" ? response.headers.get("location") : null;
+				return {
+					terminal: true,
+					result: {
+						webhookId: webhook.id,
+						event,
+						payload,
+						statusCode: response.status,
+						responseBody: `Webhook receivers must not redirect: HTTP ${response.status}` + (location ? ` to ${location}` : "") + ". The redirect target is not re-validated, so it is not followed.",
+						success: false,
+						attemptNumber
+					}
+				};
+			}
+			const responseBody = await this.readCappedBody(response);
 			const success = response.status >= 200 && response.status < 300;
 			return {
-				webhookId: webhook.id,
-				event,
-				payload,
-				statusCode: response.status,
-				responseBody: responseBody.slice(0, 1e3),
-				success,
-				attemptNumber
+				terminal: false,
+				result: {
+					webhookId: webhook.id,
+					event,
+					payload,
+					statusCode: response.status,
+					responseBody: responseBody.slice(0, 1e3),
+					success,
+					attemptNumber
+				}
 			};
 		} catch (error) {
 			const message = error instanceof Error ? error.message : String(error);
 			return {
-				webhookId: webhook.id,
-				event,
-				payload,
-				statusCode: 0,
-				responseBody: message.slice(0, 1e3),
-				success: false,
-				attemptNumber
+				terminal: error instanceof BlockedUrlError,
+				result: {
+					webhookId: webhook.id,
+					event,
+					payload,
+					statusCode: 0,
+					responseBody: message.slice(0, 1e3),
+					success: false,
+					attemptNumber
+				}
 			};
+		} finally {
+			clearTimeout(timeout);
+		}
+	}
+	/**
+	* Read at most {@link MAX_RESPONSE_BYTES} of the response and cancel the
+	* rest, so a receiver cannot buffer a 10 GB body into the pod before the
+	* caller truncates it to 1000 characters.
+	*/
+	async readCappedBody(response) {
+		const stream = response.body;
+		if (!stream || typeof stream.getReader !== "function") return await response.text().catch(() => "");
+		const reader = stream.getReader();
+		const chunks = [];
+		let total = 0;
+		try {
+			for (;;) {
+				const { done, value } = await reader.read();
+				if (done) break;
+				if (!value) continue;
+				chunks.push(value);
+				total += value.byteLength;
+				if (total >= MAX_RESPONSE_BYTES) break;
+			}
+		} catch {
+			return new TextDecoder().decode(concat(chunks, total));
+		} finally {
+			await reader.cancel().catch(() => void 0);
 		}
+		return new TextDecoder().decode(concat(chunks, total));
 	}
 };
+function concat(chunks, total) {
+	const out = new Uint8Array(total);
+	let offset = 0;
+	for (const chunk of chunks) {
+		const room = out.length - offset;
+		if (room <= 0) break;
+		out.set(chunk.length > room ? chunk.subarray(0, room) : chunk, offset);
+		offset += chunk.length;
+	}
+	return out;
+}
 //#endregion
 //#region src/utils/dev-port.ts
 var MAX_PORT_ATTEMPTS = 20;
@@ -10170,10 +11292,11 @@ function isUnderPath(requestPath, prefix) {
 * Serve a Single Page Application from an Hono app.
 *
 * @internal Not part of the stable public API. Exported only because the
-* official app template (`packages/cli/templates/template/backend/src/index.ts`
-* and `app/backend/src/index.ts`) calls it to serve the built frontend in
-* production. Its request-handling behavior is an implementation detail and
-* may change without a major version bump.
+* entrypoint `rebase eject` writes
+* (`packages/cli/templates/eject/backend/src/index.ts`) and `app/backend/src/index.ts`
+* call it to serve the built frontend in production — the scaffolded template
+* has no entrypoint of its own. Its request-handling behavior is an
+* implementation detail and may change without a major version bump.
 */
 function serveSPA(app, config) {
 	const { frontendPath, apiBasePath = "/api", excludePaths = [], indexFile = "index.html", spa = true } = config;
@@ -11785,7 +12908,8 @@ async function bootFromBundle(options = {}) {
 	});
 	await ensureCollectionPolicies(bundle, dataSources, env);
 	metrics?.setKnownCollections(backend.collectionRegistry.getCollections().map((collection) => collection.slug).filter((slug) => Boolean(slug)));
-	app.get("/health", async (c) => {
+	const healthPaths = ["/health", `${(env.REBASE_BASE_PATH || "/api").replace(/\/$/, "")}/health`];
+	for (const healthPath of [...new Set(healthPaths)]) app.get(healthPath, async (c) => {
 		const result = await backend.healthCheck();
 		const unhealthy = (await Promise.all(dataSources.filter((source) => source.key !== DEFAULT_DATA_SOURCE_KEY).map(async (source) => ({
 			key: source.key,
@@ -11891,7 +13015,7 @@ async function bootStaticApp(bundle, devRoot, options) {
 	if (metrics) app.use("/*", metrics.middleware);
 	const server = createServer(getRequestListener(app.fetch));
 	app.get("/livez", (c) => c.json({ status: "ok" }));
-	app.get("/health", (c) => c.json({
+	for (const healthPath of [.../* @__PURE__ */ new Set(["/health", `${basePath.replace(/\/$/, "")}/health`])]) app.get(healthPath, (c) => c.json({
 		status: "ok",
 		latencyMs: 0
 	}));
@@ -12001,6 +13125,40 @@ function warnOnDriverSkew(dataSources, runtimeVersion) {
 	}
 }
 /**
+* The collections a data source's engine is the store for.
+*
+* A bundle's collections directory holds *every* collection the project
+* declares, whatever engine serves it — that is the point of `dataSource`
+* routing. What it is not is a list of tables to create: handing the whole
+* directory to the primary source's bootstrapper made a Firestore collection
+* declared alongside the Postgres ones arrive as an empty Postgres table, with
+* RLS policies, while the app went on reading its documents from Firestore.
+*
+* Excluding is deliberately conservative. A collection that names neither an
+* `engine` nor a `dataSource` belongs to whichever source is primary — the
+* "postgres" that `resolveDataSource` falls back to there is a default, not a
+* declaration, and must not exclude anything on its own. Only a collection that
+* explicitly routes to a *different* engine is dropped, so a project running two
+* sources on the same engine is unaffected.
+*/
+function collectionsStoredBy(collections, primary, dataSources) {
+	const registry = createDataSourceRegistry(dataSources.map((source) => ({
+		key: source.key,
+		engine: source.engine
+	})));
+	return collections.filter((collection) => {
+		const declared = collection.engine ?? (collection.dataSource ? resolveDataSource(collection, registry).engine : void 0);
+		if (!declared) return true;
+		return declared === primary.engine;
+	});
+}
+/** Say what was routed elsewhere, so a missing table is never a silent one. */
+function logForeignCollections(all, stored, primary) {
+	if (stored.length === all.length) return;
+	const foreign = all.filter((c) => !stored.includes(c)).map((c) => c.slug);
+	logger.info(`Skipping ${foreign.length} collection(s) served by another engine, not "${primary.engine}": ${foreign.join(", ")}. Their storage is not managed by this data source.`);
+}
+/**
 * Bring the database's collection tables up to date before serving.
 *
 * Delegates to whichever driver bootstrapped the default data source; a driver
@@ -12049,11 +13207,17 @@ async function ensureCollectionSchema(bundle, dataSources, env) {
 		skip(`the adapter from "${primary.driverPackage}" (engine "${primary.engine}") does not expose collection-table creation. ` + (skew.detail ? `${skew.detail} ` : "") + "The driver package may well implement it on a class the adapter does not forward, so check the adapter's shape before blaming its version. Collection tables will NOT be created, so every /api/data route will fail on a missing relation.\n" + schemaRecoveryGuidance({ staleDriver: skew.stale }), "warn");
 		return;
 	}
-	const collections = await loadCollectionsFromDirectory(bundle.collectionsDir);
-	if (collections.length === 0) {
+	const loaded = await loadCollectionsFromDirectory(bundle.collectionsDir);
+	if (loaded.length === 0) {
 		skip(`no collections were loaded from "${bundle.collectionsDir}".`, "warn");
 		return;
 	}
+	const collections = collectionsStoredBy(loaded, primary, dataSources);
+	logForeignCollections(loaded, collections, primary);
+	if (collections.length === 0) {
+		skip(`none of the ${loaded.length} declared collection(s) are stored by the "${primary.engine}" data source.`);
+		return;
+	}
 	const { applied } = await primary.bootstrapper.ensureCollectionSchema(collections, preInitDriverResult(primary), (message) => logger.info(`schema: ${message}`));
 	logger.info(applied > 0 ? `Applied ${applied} additive schema change(s) before boot.` : "Collection schema is up to date.");
 }
@@ -12103,12 +13267,14 @@ async function ensureCollectionPolicies(bundle, dataSources, env) {
 		logger.warn(`Collection policies: skipped — the "${primary.driverPackage}" driver (engine "${primary.engine}") does not apply RLS policies at boot. ` + (skew.detail ? `${skew.detail} ` : "") + "Collections will deny reads until policies are applied.\n" + schemaRecoveryGuidance({ staleDriver: skew.stale }));
 		return;
 	}
-	const collections = await loadCollectionsFromDirectory(bundle.collectionsDir);
+	const loaded = await loadCollectionsFromDirectory(bundle.collectionsDir);
+	if (loaded.length === 0) return;
+	const collections = collectionsStoredBy(loaded, primary, dataSources);
 	if (collections.length === 0) return;
 	const { applied } = await primary.bootstrapper.ensureCollectionPolicies(collections, preInitDriverResult(primary), (message) => logger.info(`policies: ${message}`));
 	logger.info(applied > 0 ? `Applied ${applied} RLS policy statement(s) before serving.` : "RLS policies are up to date.");
 }
 //#endregion
-export { ApiError, BundleError, CronScheduler, DEFAULT_DRIVER_ID, DEFAULT_MAX_FILE_SIZE, DEFAULT_STORAGE_ID, DOCUMENT_MIME_TYPES, DefaultDriverRegistry, DefaultStorageRegistry, GCSStorageController, IMAGE_MIME_TYPES, LocalStorageController, MetricsRegistry, S3StorageController, SMTPEmailService, TransformCache, TusHandler, WebhookDispatcher, _resetRebaseMock, _setRebaseMock, applyCollectionDefaults, assertCollectionConfigs, assertDistinctSuffixes, authJwt, authRoles, authUid, bootFromBundle, classifySurface, cleanupDevPortFile, createAppleProvider, createBackupRoutes, createBitbucketProvider, createBuiltinAuthAdapter, createContractRoutes, createCronRoutes, createCronStore, createCustomAuthAdapter, createDiscordProvider, createEmailService, createFacebookProvider, createFunctionRoutes, createGitHubProvider, createGitLabProvider, createGoogleProvider, createHistoryRoutes, createLinkedinProvider, createMetricsMiddleware, createMetricsRoutes, createMicrosoftProvider, createSlackProvider, createSourceBundle, createSpotifyProvider, createStorageController, createStorageRoutes, createTwitterProvider, defineCron, defineFunction, envSuffixForKey, errorHandler, extractUserFromToken, fileTokenAuth, findCollectionConfigProblems, generateSecurePassword, getEmailVerificationTemplate, getMagicLinkTemplate, getPasswordResetTemplate, getUserInvitationTemplate, getWelcomeEmailTemplate, hashPassword, httpMethodToOperation, initializeDataSource, initializeDataSources, initializeRebaseBackend, installShutdownHandlers, isApiKeyToken, isAuthAdapter, isDatabaseAdapter, isLocalhostOrigin, isOperationAllowed, isRebaseApiError, isTransformableImage, listBackupObjects, listenWithPortRetry, loadBootEnv, loadBundle, loadBundleConfigExports, loadBundleSchema, loadCollectionsFromDirectory, loadCronJobsFromDirectory, loadDeclaredStorageSources, loadEnv, loadFunctionsFromDirectory, loadUsersCollection, logger, optionalAuth, parseBackupDestination, parseBackupTimestamp, parseTransformOptions, queryTokenAuth, readBackupBytes, readBundleManifest, rebase, requireAdmin, requireAuth, resolveAuthHooks, resolveAuthOptions, resolveCorsOrigin, resolveDataSources, resolveEmailOptions, resolveRequireAuth, resolveStorageBackend, resolveStorageSources, runFromBundle, safeCompare, serveSPA, transformImage, unknownKeyPolicyFromEnv, validateApiKey, validateCronExpression, validatePasswordStrength, verifyPassword };
+export { ApiError, BlockedUrlError, BundleError, CronScheduler, DEFAULT_DRIVER_ID, DEFAULT_MAX_FILE_SIZE, DEFAULT_STORAGE_ID, DOCUMENT_MIME_TYPES, DefaultDriverRegistry, DefaultStorageRegistry, GCSStorageController, IMAGE_MIME_TYPES, LocalStorageController, MetricsRegistry, RawHtml, S3StorageController, SMTPEmailService, TransformCache, TusHandler, WebhookDispatcher, _resetRebaseMock, _setRebaseMock, applyCollectionDefaults, assertAllowedOutboundUrl, assertCollectionConfigs, assertDistinctSuffixes, assertEmailLinkBases, authJwt, authRoles, authUid, blockedAddressReason, bootFromBundle, classifySurface, cleanupDevPortFile, createAppleProvider, createBackupRoutes, createBitbucketProvider, createBuiltinAuthAdapter, createContractRoutes, createCronRoutes, createCronStore, createCustomAuthAdapter, createDiscordProvider, createEmailService, createFacebookProvider, createFunctionRoutes, createGitHubProvider, createGitLabProvider, createGoogleProvider, createHistoryRoutes, createLinkedinProvider, createMetricsMiddleware, createMetricsRoutes, createMicrosoftProvider, createSlackProvider, createSourceBundle, createSpotifyProvider, createStorageController, createStorageRoutes, createTwitterProvider, defineCron, defineFunction, envSuffixForKey, errorHandler, escapeHtml, extractUserFromToken, fileTokenAuth, findCollectionConfigProblems, generateSecurePassword, getEmailVerificationTemplate, getMagicLinkTemplate, getPasswordResetTemplate, getUserInvitationTemplate, getWelcomeEmailTemplate, hashPassword, html, httpMethodToOperation, initializeDataSource, initializeDataSources, initializeRebaseBackend, installShutdownHandlers, isApiKeyToken, isAuthAdapter, isDatabaseAdapter, isLocalhostOrigin, isOperationAllowed, isTransformableImage, listBackupObjects, listenWithPortRetry, loadBootEnv, loadBundle, loadBundleConfigExports, loadBundleSchema, loadCollectionsFromDirectory, loadCronJobsFromDirectory, loadDeclaredStorageSources, loadEnv, loadFunctionsFromDirectory, loadUsersCollection, logger, oauthCodeFlowSchema, optionalAuth, parseBackupDestination, parseBackupTimestamp, parseTransformOptions, pkceTokenParams, providerVerifiedEmail, queryTokenAuth, raw, readBackupBytes, readBundleManifest, rebase, requireAdmin, requireAuth, resolveAuthHooks, resolveAuthOptions, resolveCorsOrigin, resolveDataSources, resolveEmailLinkBase, resolveEmailOptions, resolveRequireAuth, resolveStorageBackend, resolveStorageSources, runFromBundle, safeCompare, serveSPA, transformImage, tryVerifyOidcIdToken, unknownKeyPolicyFromEnv, validateApiKey, validateCronExpression, validatePasswordStrength, verifyOidcIdToken, verifyPassword };
 
 //# sourceMappingURL=index.es.js.map