@rebasepro/server 0.13.0 → 0.13.1-canary.g249daa1

package/dist/{admin_block-CcSGdH7M.js → admin_block-CLeUMG8G.js}

@@ -44,6 +44,7 @@ var ADMIN_COLLECTION_KEYS = [
 	"defaultSize",
 	"defaultViewMode",
 	"disableDefaultActions",
+	"display",
 	"enabledViews",
 	"entityActions",
 	"entityViews",
@@ -54,6 +55,7 @@ var ADMIN_COLLECTION_KEYS = [
 	"formAutoSave",
 	"formView",
 	"group",
+	"hideFromEntityViews",
 	"hideFromNavigation",
 	"hideIdFromCollection",
 	"hideIdFromForm",
@@ -121,4 +123,4 @@ var ADMIN_PROPERTY_KEYS = [
 //#endregion
 export { ADMIN_PROPERTY_KEYS as n, ADMIN_COLLECTION_KEYS as t };
 
-//# sourceMappingURL=admin_block-CcSGdH7M.js.map
+//# sourceMappingURL=admin_block-CLeUMG8G.js.map

package/dist/admin_block-CLeUMG8G.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin_block-CLeUMG8G.js","names":[],"sources":["../../types/src/types/admin_block.ts"],"sourcesContent":["/**\n * The keys of a collection's admin block, as data.\n *\n * There is no *type* for the block in this package any more, and that is the point:\n * `admin` is not declared on `BaseCollectionConfig` or on any property here, so a\n * BaaS install cannot even write one. `@rebasepro/admin-types` adds the field back by\n * declaration merging, which is why installing it is what makes the admin surface\n * appear.\n *\n * The *list* still has to live here, because three runtime consumers need it and two\n * of them are core — see below.\n */\n\n/**\n * Every key that belongs inside a collection's `admin` block, as data.\n *\n * The type that describes these fields is `AdminCollectionOptions` in\n * `@rebasepro/admin-types`, and it is erased at build time — but three runtime\n * consumers need the list, and two of them are core:\n *\n * - `serializeCollections`, to drop the block from the contract\n * - the ts-morph schema editor in `@rebasepro/server`, which rewrites collection\n *   files on disk from the admin panel and has to know where each key goes. A key\n *   missing from this list gets written to the *top level* of the file, where the\n *   backend ignores it and the panel never finds it again.\n * - the `collections-admin-block` codemod\n *\n * `@rebasepro/admin-types` re-exports this and asserts it names only real option\n * keys; the count is pinned by a test there.\n *\n * @group Models\n */\nexport const ADMIN_COLLECTION_KEYS = [\n    \"Actions\",\n    \"additionalFields\",\n    \"alwaysApplyDefaultValues\",\n    \"components\",\n    \"defaultEntityAction\",\n    \"defaultFilter\",\n    \"defaultSelectedView\",\n    \"defaultSize\",\n    \"defaultViewMode\",\n    \"disableDefaultActions\",\n    \"display\",\n    \"enabledViews\",\n    \"entityActions\",\n    \"entityViews\",\n    \"exportable\",\n    \"filterPresets\",\n    \"fixedFilter\",\n    \"form\",\n    \"formAutoSave\",\n    \"formView\",\n    \"group\",\n    \"hideFromEntityViews\",\n    \"hideFromNavigation\",\n    \"hideIdFromCollection\",\n    \"hideIdFromForm\",\n    \"icon\",\n    \"includeJsonView\",\n    \"inlineEditing\",\n    \"kanban\",\n    \"listProperties\",\n    \"localChangesBackup\",\n    \"openEntityMode\",\n    \"orderProperty\",\n    \"pagination\",\n    \"previewProperties\",\n    \"propertiesOrder\",\n    \"selectionController\",\n    \"selectionEnabled\",\n    \"sideDialogWidth\",\n    \"sort\",\n    \"titleProperty\"\n] as const;\n\n/** A key of a collection's `admin` block. @group Models */\nexport type AdminCollectionKey = typeof ADMIN_COLLECTION_KEYS[number];\n\n/**\n * Every key that belongs inside a *property's* `admin` block, as data.\n *\n * The union of `AdminPropertyOptions` and its per-type extensions\n * (`AdminStringOptions`, `AdminArrayOptions`, …) in `@rebasepro/admin-types`.\n * It lives here for the same reason {@link ADMIN_COLLECTION_KEYS} does: the\n * runtime consumers are core packages that the BaaS guard forbids from\n * importing `@rebasepro/admin-types`. Here it is the boot-time collection\n * validator in `@rebasepro/server`, which has to tell \"you left `readOnly` at\n * the top of the property, where nothing reads it\" apart from \"you invented a\n * key we have never heard of\".\n *\n * `@rebasepro/admin-types` re-exports this and asserts it names only real\n * option keys.\n *\n * @group Models\n */\nexport const ADMIN_PROPERTY_KEYS = [\n    \"canAddElements\",\n    \"clearable\",\n    \"columnWidth\",\n    \"customProps\",\n    \"disabled\",\n    \"expanded\",\n    \"Field\",\n    \"Filter\",\n    \"filterOperators\",\n    \"fixedFilter\",\n    \"hideFromCollection\",\n    \"includeEntityLink\",\n    \"includeId\",\n    \"markdown\",\n    \"minimalistView\",\n    \"multiline\",\n    \"Preview\",\n    \"previewAsTag\",\n    \"previewProperties\",\n    \"readOnly\",\n    \"sortable\",\n    \"span\",\n    \"spreadChildren\",\n    \"urlPreview\",\n    \"widget\",\n] as const;\n\n/** A key of a property's `admin` block. @group Models */\nexport type AdminPropertyKey = typeof ADMIN_PROPERTY_KEYS[number];\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCA,IAAa,wBAAwB;CACjC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACJ;;;;;;;;;;;;;;;;;;AAsBA,IAAa,sBAAsB;CAC/B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACJ"}

package/dist/api/errors.d.ts

@@ -55,12 +55,6 @@ export interface RebaseApiError extends Error {
     code?: string;
     details?: unknown;
 }
-/**
- * Type guard for errors that carry optional API metadata (statusCode, code, details).
- * Returns true for any Error instance — the optional properties are then
- * checked via normal property access.
- */
-export declare function isRebaseApiError(error: unknown): error is RebaseApiError;
 /**
  * Hono error-handling middleware (`app.onError`).
  * Converts any error into the canonical `{ error: { message, code } }` shape.

package/dist/api/openapi-generator.d.ts

@@ -12,5 +12,19 @@ export interface OpenApiGeneratorOptions {
     basePath?: string;
     /** Whether auth is enabled on data routes. Defaults to true. */
     requireAuth?: boolean;
+    /**
+     * The list-pagination bounds the REST layer applies, so the spec states the
+     * ones a request will actually meet.
+     *
+     * These were hardcoded as `default: 20, maximum: 100` — neither of which
+     * the server has ever used. The spec drives the API Explorer and is what a
+     * generated client is built from, so an understated ceiling is a request
+     * the client refuses to make, and an overstated one is a 400 nobody
+     * predicted.
+     */
+    listLimits?: {
+        defaultLimit?: number;
+        maxLimit?: number;
+    };
 }
 export declare function generateOpenApiSpec(collections: CollectionConfig[], options?: OpenApiGeneratorOptions): Record<string, unknown>;

package/dist/api/rest/idempotency.d.ts

@@ -1,9 +1,46 @@
 import { DataDriver } from "@rebasepro/types";
+/**
+ * What a caller may do with a key.
+ *
+ * `claimed` is the only outcome that permits the write. Recalling and then
+ * writing was not atomic: two requests carrying one key both missed the recall,
+ * both wrote, and `ON CONFLICT DO NOTHING` protected only the second row in
+ * *this* table — the duplicate row in the caller's collection, which is the
+ * thing the mechanism exists to prevent, was inserted anyway. The offline queue
+ * is shared across tabs, so two tabs reconnecting together is the ordinary case
+ * rather than an exotic one.
+ */
+export type IdempotencyClaim = 
+/** This key has already been answered; serve that answer again. */
+{
+    status: "replay";
+    response: unknown;
+}
+/** Another request holds this key and has not answered yet. */
+ | {
+    status: "in-flight";
+}
+/** The key is ours; do the write, then `complete` or `release` it. */
+ | {
+    status: "claimed";
+};
 export interface IdempotencyStore {
-    /** What this key answered before, or `undefined` if it is new. */
-    recall(key: string, uid: string | undefined): Promise<unknown | undefined>;
-    /** Record what this key answered. Never throws — see {@link createIdempotencyStore}. */
-    remember(key: string, uid: string | undefined, response: unknown): Promise<void>;
+    /**
+     * Take the key if it is free, atomically. Never throws — a store that
+     * cannot answer reports `claimed`, which degrades to no idempotency rather
+     * than to a refused write.
+     */
+    claim(key: string, uid: string | undefined): Promise<IdempotencyClaim>;
+    /** Record what this key answered. Never throws. */
+    complete(key: string, uid: string | undefined, response: unknown): Promise<void>;
+    /**
+     * Give the key back after the write it was claimed for failed.
+     *
+     * Without this a transient failure strands the key: every retry would be
+     * told `in-flight` until the row aged out, turning one failed write into a
+     * day of refusals.
+     */
+    release(key: string, uid: string | undefined): Promise<void>;
 }
 /**
  * Returns `undefined` when the driver cannot run SQL, which disables the whole

package/dist/api/rest/write-validation.d.ts

@@ -33,11 +33,18 @@ export declare function assertKnownWriteFields(values: Record<string, unknown>,
  * This shapes the *response*, which is what the parameter says it does; it is
  * not a column pushdown, so it saves bandwidth rather than database work.
  *
- * `id` always survives. Rows are addressed by it everywhere above this layer —
- * the admin table, realtime reconciliation, the offline cache — and a row that
- * arrives without one is not a smaller row, it is an unusable one. Asking for
- * `fields=title` and being unable to open the record you clicked is a worse
- * answer than one extra key.
+ * The collection's key always survives. Rows are addressed by it everywhere
+ * above this layer — the admin table, realtime reconciliation, the offline
+ * cache — and a row that arrives without one is not a smaller row, it is an
+ * unusable one. Asking for `fields=title` and being unable to open the record
+ * you clicked is a worse answer than one extra key.
+ *
+ * That is a statement about the key, not about the name `id`: a collection
+ * keyed on `slug`, or on `user_id + role_id`, was projected down to the fields
+ * asked for and nothing else, which is the very outcome the paragraph above
+ * describes. `assertKnownWriteFields` one function up already has a dedicated
+ * error for collections with no `id` column, so this layer had no excuse for
+ * assuming one.
  */
 export declare function projectResponseFields<T extends Record<string, unknown>>(rows: T[], fields: readonly string[] | undefined, collection: CollectionConfig, options?: {
     include?: readonly string[];

package/dist/auth/index.d.ts

@@ -1,5 +1,5 @@
 export * from "./interfaces";
-export { configureJwt, generateAccessToken, verifyAccessToken, generateRefreshToken, hashRefreshToken, getRefreshTokenExpiry, getAccessTokenExpiry, generateDownloadToken, verifyDownloadToken } from "./jwt";
+export { configureJwt, isJwtConfigured, generateAccessToken, verifyAccessToken, generateRefreshToken, hashRefreshToken, getRefreshTokenExpiry, getAccessTokenExpiry, generateDownloadToken, verifyDownloadToken } from "./jwt";
 export type { JwtConfig, AccessTokenPayload, DownloadTokenPayload } from "./jwt";
 export { hashPassword, verifyPassword, validatePasswordStrength } from "./password";
 export { safeCompare } from "./crypto-utils";

package/dist/auth/jwt.d.ts

@@ -30,6 +30,18 @@ export interface AccessTokenPayload {
  * Validates the secret strength to prevent deployment with default/weak secrets.
  */
 export declare function configureJwt(config: JwtConfig): void;
+/**
+ * Has this server been given a JWT secret?
+ *
+ * False on every backend that authenticates through an adapter — Firebase,
+ * Clerk, anything with its own tokens — because nothing calls
+ * {@link configureJwt} there. Signing paths still throw when it is false, since
+ * asking for a token from a server that cannot mint one is a mistake worth
+ * hearing about. Paths whose contract is *"tolerate the absence of auth"* must
+ * ask first: `optionalAuth` crashing a request because this backend does not do
+ * JWT is a 500 on a route that had already decided anonymous was acceptable.
+ */
+export declare function isJwtConfigured(): boolean;
 /**
  * Generate an access token (short-lived, 1 hour by default)
  */

package/dist/{auth-CuC9M2x6.js → auth-BANhRhN9.js}

@@ -2,38 +2,18 @@ import { createRequire as __createRequire } from "module";
 import process from "process";
 __createRequire(import.meta.url);
 import { i as __toESM, n as __exportAll } from "./rolldown-runtime-DSJWtz9O.js";
-import { _ as ANONYMOUS_USER_ID, v as isAnonymousUid } from "./src-Cum9kox5.js";
-import "./src-_qQ3RNCK.js";
-import { t as isSQLAdmin } from "./backend-CIxN4FVm.js";
+import { S as isAnonymousUid, b as resolveClientListLimit, x as ANONYMOUS_USER_ID } from "./src-DVb5a0bp.js";
+import "./src-Ca6NhxKs.js";
+import { i as isSQLAdmin, r as revokeInternalTableSql, t as createDdlBootstrapper } from "./ddl-bootstrap-Bp3mr6Td.js";
 import { t as logger } from "./logger-BYU66ENZ.js";
-import { n as errorHandler, t as ApiError } from "./errors-CgkCzoj7.js";
-import { a as generateRefreshToken, c as getRefreshTokenTtlMs, d as verifyAccessToken, f as verifyDownloadToken, i as generateDownloadToken, l as hashRefreshToken, n as configureJwt, o as getAccessTokenExpiry, p as require_jsonwebtoken, r as generateAccessToken, s as getRefreshTokenExpiry, t as MAX_COOKIE_AGE_MS } from "./jwt-DD6EtpGj.js";
+import { n as errorHandler, t as ApiError } from "./errors-BpudWAVU.js";
+import { a as generateRefreshToken, c as getRefreshTokenTtlMs, f as verifyAccessToken, i as generateDownloadToken, l as hashRefreshToken, m as require_jsonwebtoken, n as configureJwt, o as getAccessTokenExpiry, p as verifyDownloadToken, r as generateAccessToken, s as getRefreshTokenExpiry, t as MAX_COOKIE_AGE_MS, u as isJwtConfigured } from "./jwt-CzeviDcB.js";
 import { createHash, randomBytes, randomInt } from "node:crypto";
 import { Hono } from "hono";
 import { promisify } from "util";
 import { createCipheriv, createDecipheriv, createHash as createHash$1, createHmac, randomBytes as randomBytes$1, randomUUID as randomUUID$1, scrypt, timingSafeEqual } from "crypto";
-/** Hard ceiling clamped onto any client-supplied `limit`, on every surface. */
-var MAX_LIST_LIMIT = 1e3;
-/**
-* Resolve a client-supplied list `limit` into a safe, always-defined value.
-*
-* - A provided limit is coerced to an integer and clamped to `[1, maxLimit]`,
-*   so `0`, negatives, and absurd values can never bypass the cap.
-* - An absent / blank / non-numeric limit falls back to the mode default:
-*   `vectorDefaultLimit` for a vector search, otherwise `defaultLimit`.
-*
-* The return is never `undefined` — no ingress that routes its client limit
-* through this can produce an unbounded read.
-*/
-function resolveClientListLimit(rawLimit, opts = {}) {
-	const maxLimit = opts.maxLimit ?? 1e3;
-	if (rawLimit != null && String(rawLimit).trim() !== "") {
-		const parsed = typeof rawLimit === "number" ? rawLimit : parseInt(String(rawLimit), 10);
-		if (Number.isFinite(parsed)) return Math.min(Math.max(1, Math.floor(parsed)), maxLimit);
-	}
-	return opts.vectorSearch ? opts.vectorDefaultLimit ?? 10 : opts.defaultLimit ?? 50;
-}
-//#endregion
+import path from "node:path";
+import { getConnInfo } from "@hono/node-server/conninfo";
 //#region ../types/src/controllers/storage.ts
 /**
 * Path prefix that marks an object as **public**. Files stored under this
@@ -461,6 +441,91 @@ function createApiKeyPreAuth(options) {
 	};
 }
 //#endregion
+//#region src/storage/keys.ts
+/**
+* Canonical storage keys.
+*
+* Storage is not under RLS, so a `storageAuthorize` hook is the whole access
+* control model — and a hook can only be correct if the key it is shown is the
+* key that is written. That is the invariant this module exists to hold: one
+* canonical string, computed once per request, handed to the hook, to the
+* controller, and to the download token alike.
+*
+* ## Why rejecting beats stripping
+*
+* The previous `sanitizeStorageKey` *stripped* `../` in a single pass. Two
+* things were wrong with that, and only one of them was the obvious one.
+*
+* The obvious one: a single pass is not a fixed point. `....//` contains `../`
+* at offset 2, so removing it leaves `../` behind — the sanitizer manufactured
+* the traversal it was there to remove. `users/alice/....//bob/x` came out as
+* `users/alice/../bob/x`, which a prefix hook reads as alice's (it starts with
+* `users/alice/`) and the filesystem reads as bob's. The hook approved one
+* object and the controller wrote another.
+*
+* The subtler one, and the reason this is a rewrite rather than a loop: even a
+* correct strip is a silent rewrite. A caller who asks to store at `a/../b` and
+* gets an object at `a/b` was not protected, they were misled — and every later
+* read, ownership row and audit line now refers to a path nobody chose. So a key
+* that means something other than what it says is refused (400), not repaired.
+*
+* Note what is NOT traversal under this rule: `....` is an ordinary directory
+* name, and `users/alice/....//bob/x` canonicalizes to
+* `users/alice/..../bob/x` — still comfortably inside alice's prefix, which is
+* exactly right. Only a real `..` segment is refused.
+*/
+/** Longest key accepted, in UTF-16 code units. Matches the previous cap. */
+var MAX_STORAGE_KEY_LENGTH = 1024;
+/**
+* A key that cannot be canonicalized. Carries no path back to the caller
+* beyond what they sent, so it is safe to surface as a 400 message.
+*/
+var InvalidStorageKeyError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "InvalidStorageKeyError";
+	}
+};
+/**
+* Canonicalize a caller-supplied storage key, or throw
+* {@link InvalidStorageKeyError}.
+*
+* Normalizations applied (safe, idempotent, and meaning-preserving):
+* - leading slashes removed — `/a/b` and `a/b` name the same object
+* - `.` segments and repeated slashes collapsed
+*
+* Refusals (the key means something other than what it says):
+* - any `..` segment, on either separator, at any depth
+* - null bytes
+* - keys longer than {@link MAX_STORAGE_KEY_LENGTH}
+*
+* A trailing slash is preserved: it is how the folder route marks a prefix.
+*/
+function canonicalStorageKey(rawKey) {
+	if (rawKey.includes("\0")) throw new InvalidStorageKeyError("Storage key contains a null byte.");
+	if (rawKey.length > 1024) throw new InvalidStorageKeyError(`Storage key exceeds the maximum length of ${MAX_STORAGE_KEY_LENGTH} characters.`);
+	if (rawKey.split(/[\\/]/).some((segment) => segment === "..")) throw new InvalidStorageKeyError("Storage key contains a '..' path segment. Keys must name an object directly.");
+	const withoutLeadingSlashes = rawKey.replace(/^\/+/, "");
+	if (withoutLeadingSlashes === "") return "";
+	const normalized = path.posix.normalize(withoutLeadingSlashes);
+	if (normalized === "." || normalized === "./") return "";
+	return normalized.replace(/^\.\//, "").replace(/^\/+/, "");
+}
+/**
+* Canonicalize, or return `null` when the key is not canonicalizable.
+*
+* For callers that must fail closed without an exception — the download-token
+* middleware compares a request path against a granted path, and a key it
+* cannot canonicalize simply matches nothing.
+*/
+function tryCanonicalStorageKey(rawKey) {
+	try {
+		return canonicalStorageKey(rawKey);
+	} catch {
+		return null;
+	}
+}
+//#endregion
 //#region src/auth/middleware.ts
 /**
 * Hono middleware that requires a valid JWT token via Authorization header.
@@ -551,7 +616,7 @@ var requireAdmin = async (c, next) => {
 var optionalAuth = async (c, next) => {
 	if (c.get("user")) return next();
 	const token = extractBearerToken(c.req.header("authorization"));
-	if (token !== void 0) {
+	if (token !== void 0 && isJwtConfigured()) {
 		const payload = verifyAccessToken(token);
 		if (payload) c.set("user", payload);
 	}
@@ -561,6 +626,7 @@ var optionalAuth = async (c, next) => {
 * Extract user from token - for WebSocket authentication
 */
 function extractUserFromToken(token) {
+	if (!isJwtConfigured()) return null;
 	return verifyAccessToken(token);
 }
 /**
@@ -711,7 +777,7 @@ function createAuthMiddleware(options) {
 var queryTokenAuth = async (c, next) => {
 	if (extractBearerToken(c.req.header("authorization")) !== void 0) return next();
 	const queryToken = c.req.query("token");
-	if (queryToken) {
+	if (queryToken && isJwtConfigured()) {
 		const payload = verifyAccessToken(queryToken);
 		if (payload) c.set("user", payload);
 	}
@@ -782,15 +848,25 @@ var fileTokenAuth = async (c, next) => {
 		if (idx < 0) return "";
 		return fullPath.substring(idx + prefix.length + 1);
 	};
+	/**
+	* Must agree with `parseBucketAndPath` in `storage/routes.ts`, because the
+	* path a token GRANTS is minted there and the path a request ASKS FOR is
+	* derived here. `/metadata` canonicalizes before signing, so a raw
+	* comparison here would 403 an otherwise-valid request for any key whose
+	* URL form is not already canonical (`a//b.txt`, `a/./b.txt`).
+	*
+	* A key that cannot be canonicalized yields null, which matches no grant —
+	* the same fail-closed answer `isPathMatch` gives a `..` segment.
+	*/
 	const parseBucketPath = (filePath) => {
 		const parts = filePath.split("/");
 		if (parts.length > 1 && parts[0].toLowerCase() === "default") return {
 			bucket: "default",
-			resolvedPath: parts.slice(1).join("/")
+			resolvedPath: tryCanonicalStorageKey(parts.slice(1).join("/"))
 		};
 		return {
 			bucket: "default",
-			resolvedPath: filePath
+			resolvedPath: tryCanonicalStorageKey(filePath)
 		};
 	};
 	const bearerToken = extractBearerToken(authHeader);
@@ -800,7 +876,8 @@ var fileTokenAuth = async (c, next) => {
 			const rawPath = extractWildcard(c);
 			if (rawPath) {
 				const { bucket, resolvedPath } = parseBucketPath(decodeURIComponent(rawPath));
-				if (isPathMatch(`${bucket}/${resolvedPath}`, payload.path)) {
+				const requestedFullPath = resolvedPath === null ? null : `${bucket}/${resolvedPath}`;
+				if (requestedFullPath !== null && isPathMatch(requestedFullPath, payload.path)) {
 					c.set("user", {
 						uid: "download-token",
 						roles: ["reader"]
@@ -824,7 +901,8 @@ var fileTokenAuth = async (c, next) => {
 			const rawPath = extractWildcard(c);
 			if (rawPath) {
 				const { bucket, resolvedPath } = parseBucketPath(decodeURIComponent(rawPath));
-				if (isPathMatch(`${bucket}/${resolvedPath}`, payload.path)) {
+				const requestedFullPath = resolvedPath === null ? null : `${bucket}/${resolvedPath}`;
+				if (requestedFullPath !== null && isPathMatch(requestedFullPath, payload.path)) {
 					c.set("user", {
 						uid: "download-token",
 						roles: ["reader"]
@@ -1458,11 +1536,11 @@ async function finalizeAdminUserCreation(entity, clearPassword, ctx) {
 		await ctx.authRepo.createPasswordResetToken(entity.id, tokenHash, expiresAt);
 		const setPasswordUrl = `${ctx.emailConfig?.resetPasswordUrl || ""}/reset-password?token=${token}`;
 		const appName = ctx.emailConfig?.appName || "Rebase";
-		const templateFn = ctx.emailConfig?.templates?.passwordReset;
+		const templateFn = ctx.emailConfig?.templates?.userInvitation;
 		const emailContent = templateFn ? templateFn(setPasswordUrl, {
 			email: entity.values.email,
 			displayName: entity.values.displayName
-		}) : getPasswordResetTemplate(setPasswordUrl, {
+		}) : getUserInvitationTemplate(setPasswordUrl, {
 			email: entity.values.email,
 			displayName: entity.values.displayName
 		}, appName);
@@ -1491,6 +1569,11 @@ async function finalizeAdminUserCreation(entity, clearPassword, ctx) {
 var scryptAsync = promisify(scrypt);
 var SALT_LENGTH = 32;
 var KEY_LENGTH = 64;
+var SCRYPT_PARAMS = {
+	N: 16384,
+	r: 8,
+	p: 1
+};
 /**
 * Password requirements:
 * - Minimum 8 characters
@@ -1515,7 +1598,7 @@ function validatePasswordStrength(password) {
 */
 async function hashPassword(password) {
 	const salt = randomBytes$1(SALT_LENGTH);
-	const derivedKey = await scryptAsync(password, salt, KEY_LENGTH);
+	const derivedKey = await scryptAsync(password, salt, KEY_LENGTH, SCRYPT_PARAMS);
 	return `${salt.toString("hex")}:${derivedKey.toString("hex")}`;
 }
 /**
@@ -1527,7 +1610,7 @@ async function verifyPassword(password, storedHash) {
 	if (!saltHex || !hashHex) return false;
 	const salt = Buffer.from(saltHex, "hex");
 	const storedKey = Buffer.from(hashHex, "hex");
-	return timingSafeEqual(await scryptAsync(password, salt, KEY_LENGTH), storedKey);
+	return timingSafeEqual(await scryptAsync(password, salt, KEY_LENGTH, SCRYPT_PARAMS), storedKey);
 }
 //#endregion
 //#region src/auth/auth-hooks.ts
@@ -1686,7 +1769,23 @@ function createRateLimiter(options = {}) {
 	};
 }
 /**
-* Default key generator: extract client IP from standard headers.
+* The address the socket is actually connected to, or `undefined` on a runtime
+* that cannot say. Unforgeable, unlike every header below.
+*
+* `getConnInfo` is Node-specific and throws elsewhere, so the failure is
+* swallowed: a runtime without connection info falls back to the shared bucket,
+* which is a availability trade the caller cannot exploit.
+*/
+function socketAddress(c) {
+	try {
+		return getConnInfo(c).remote.address;
+	} catch {
+		return;
+	}
+}
+/**
+* Default key generator: the client's address, from the most trustworthy source
+* this deployment has.
 *
 * `X-Forwarded-For` is a client-writable header; only the entries appended by
 * trusted reverse proxies can be believed. With `trustedProxyHops` proxies in
@@ -1695,8 +1794,20 @@ function createRateLimiter(options = {}) {
 * client-supplied and must be ignored. This is what prevents a caller from
 * spoofing `X-Forwarded-For` to spread its requests across many rate-limit keys.
 *
-* With `trustedProxyHops === 0` (server exposed directly, no proxy),
-* `X-Forwarded-For` is not trusted at all and `X-Real-IP` is used instead.
+* `X-Real-IP` is the *same* kind of header and needs the same rule, which it
+* did not have: it was read unconditionally, including under
+* `trustedProxyHops === 0` — the mode whose entire meaning is "no proxy is in
+* front of me". With no proxy there, nothing writes `X-Real-IP` except the
+* caller, so the key was theirs to choose: one header per request bought an
+* unlimited number of buckets, and the limiters on login, registration and
+* password reset counted to one. The reasoning had been done carefully for one
+* spelling of a proxy header and not carried to its twin.
+*
+* So `X-Real-IP` is now believed only where a proxy is declared to exist. With
+* none, the connection's own address is used — unforgeable, and available
+* because the server runs on `@hono/node-server`. `"unknown"` is the last
+* resort only, and it is a single shared bucket by design: better that
+* anonymous callers throttle each other than that any of them throttles nobody.
 */
 function defaultKeyGenerator(c, trustedProxyHops = resolveTrustedProxyHops()) {
 	if (trustedProxyHops > 0) {
@@ -1705,8 +1816,10 @@ function defaultKeyGenerator(c, trustedProxyHops = resolveTrustedProxyHops()) {
 			const ips = forwardedFor.split(",").map((s) => s.trim()).filter(Boolean);
 			if (ips.length > 0) return ips[Math.max(0, ips.length - trustedProxyHops)];
 		}
+		const realIp = c.req.header("x-real-ip");
+		if (realIp) return realIp;
 	}
-	return c.req.header("x-real-ip") || "unknown";
+	return socketAddress(c) ?? "unknown";
 }
 /**
 * Pre-configured rate limiter for general auth endpoints (login, register).
@@ -6168,7 +6281,7 @@ function mountSessionRoutes(opts) {
 		clearRefreshCookie(c, config.cookieAuth);
 		const accessToken = extractBearerToken(c.req.header("authorization"));
 		if (ops.afterLogout && accessToken !== void 0) {
-			const { verifyAccessToken } = await import("./jwt-DD6EtpGj.js").then((n) => n.u);
+			const { verifyAccessToken } = await import("./jwt-CzeviDcB.js").then((n) => n.d);
 			const payload = verifyAccessToken(accessToken);
 			if (payload) ops.afterLogout(payload.uid).catch((err) => {
 				logger.error("[AuthHooks] afterLogout error", { error: err instanceof Error ? err.message : err });
@@ -6549,11 +6662,6 @@ function createAuthRoutes(config) {
 		newPassword: string().min(1, "New password is required").max(128)
 	});
 	const refreshSchema = object({ refreshToken: string().min(1).optional() });
-	object({ refreshToken: string().optional() });
-	object({
-		displayName: string().max(255).optional(),
-		photoURL: string().url().max(2048).optional()
-	});
 	/** Parse a Zod schema against the request body, throwing ApiError on failure */
 	function parseBody(schema, body) {
 		const result = schema.safeParse(body);
@@ -8591,44 +8699,45 @@ function createApiKeyStore(driver) {
 		return;
 	}
 	const exec = (sqlText, options) => admin.executeSql(sqlText, options?.params ? { params: options.params } : void 0);
+	const ddl = createDdlBootstrapper(exec, "api-key-store");
 	return {
 		async ensureTable() {
-			try {
-				await exec("CREATE SCHEMA IF NOT EXISTS rebase");
-				await exec(`
-                    CREATE TABLE IF NOT EXISTS ${TABLE} (
-                        id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
-                        name TEXT NOT NULL,
-                        key_prefix TEXT NOT NULL,
-                        key_hash TEXT NOT NULL UNIQUE,
-                        permissions JSONB NOT NULL DEFAULT '[]'::jsonb,
-                        admin BOOLEAN NOT NULL DEFAULT FALSE,
-                        rate_limit INTEGER,
-                        created_by TEXT NOT NULL,
-                        created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
-                        updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
-                        last_used_at TIMESTAMPTZ,
-                        expires_at TIMESTAMPTZ,
-                        revoked_at TIMESTAMPTZ
-                    )
-                `);
-				await exec(`
-                    CREATE INDEX IF NOT EXISTS idx_api_keys_hash
-                    ON ${TABLE}(key_hash)
-                `);
-				await exec(`
-                    CREATE INDEX IF NOT EXISTS idx_api_keys_prefix
-                    ON ${TABLE}(key_prefix)
-                `);
-				await exec(`
-                    ALTER TABLE ${TABLE}
-                    ADD COLUMN IF NOT EXISTS admin BOOLEAN NOT NULL DEFAULT FALSE
-                `);
-				logger.info("✅ API keys table ready");
-			} catch (err) {
-				logger.error("❌ Failed to create API keys table", { error: err });
-				logger.warn("⚠️ Continuing without API keys support.");
+			await ddl.ensureObject("Creating schema rebase", "CREATE SCHEMA IF NOT EXISTS rebase");
+			await ddl.ensureObject(`Creating ${TABLE}`, `
+                CREATE TABLE IF NOT EXISTS ${TABLE} (
+                    id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
+                    name TEXT NOT NULL,
+                    key_prefix TEXT NOT NULL,
+                    key_hash TEXT NOT NULL UNIQUE,
+                    permissions JSONB NOT NULL DEFAULT '[]'::jsonb,
+                    admin BOOLEAN NOT NULL DEFAULT FALSE,
+                    rate_limit INTEGER,
+                    created_by TEXT NOT NULL,
+                    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+                    updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+                    last_used_at TIMESTAMPTZ,
+                    expires_at TIMESTAMPTZ,
+                    revoked_at TIMESTAMPTZ
+                )
+            `);
+			await ddl.ensureObject("Creating idx_api_keys_hash", `
+                CREATE INDEX IF NOT EXISTS idx_api_keys_hash
+                ON ${TABLE}(key_hash)
+            `);
+			await ddl.ensureObject("Creating idx_api_keys_prefix", `
+                CREATE INDEX IF NOT EXISTS idx_api_keys_prefix
+                ON ${TABLE}(key_prefix)
+            `);
+			await ddl.ensureObject(`Adding ${TABLE}.admin`, `
+                ALTER TABLE ${TABLE}
+                ADD COLUMN IF NOT EXISTS admin BOOLEAN NOT NULL DEFAULT FALSE
+            `);
+			if (!await ddl.isReadable(TABLE)) {
+				logger.error(`❌ [api-key-store] ${TABLE} is unavailable — every API-key authenticated request will be rejected on this instance, and the table could not be taken back off the end-user role.`);
+				return;
 			}
+			await ddl.step("Revoking end-user access to api_keys", () => exec(revokeInternalTableSql("rebase", "api_keys")));
+			logger.info("✅ API keys table ready");
 		},
 		async createApiKey(request, createdBy) {
 			const plaintext = generateApiKey();
@@ -8939,6 +9048,7 @@ var auth_exports = /* @__PURE__ */ __exportAll({
 	hashToken: () => hashToken,
 	httpMethodToOperation: () => httpMethodToOperation,
 	isApiKeyToken: () => isApiKeyToken,
+	isJwtConfigured: () => isJwtConfigured,
 	isOperationAllowed: () => isOperationAllowed,
 	mountMagicLinkRoutes: () => mountMagicLinkRoutes,
 	optionalAuth: () => optionalAuth,
@@ -8956,6 +9066,6 @@ var auth_exports = /* @__PURE__ */ __exportAll({
 	verifyPassword: () => verifyPassword
 });
 //#endregion
-export { httpMethodToOperation as $, getEmailVerificationTemplate as A, optionalAuth as B, createDataRateLimiter as C, validatePasswordStrength as D, hashPassword as E, createAdapterAuthMiddleware as F, createApiKeyPreAuth as G, queryTokenAuth as H, createAuthMiddleware as I, isApiKeyToken as J, createFunctionApiKeyGuard as K, createRequireAuth as L, getPasswordResetTemplate as M, getUserInvitationTemplate as N, verifyPassword as O, getWelcomeEmailTemplate as P, scopeDataDriver as Q, extractUserFromToken as R, _coercedNumber as S, resolveAuthHooks as T, requireAdmin as U, publicObjectAuth as V, requireAuth as W, extractBearerToken as X, validateApiKey as Y, safeCompare as Z, createBuiltinAuthAdapter as _, createSpotifyProvider as a, object as b, createGitLabProvider as c, createFacebookProvider as d, isOperationAllowed as et, createAppleProvider as f, createGoogleProvider as g, createLinkedinProvider as h, createApiKeyStore as i, resolveClientListLimit as it, getMagicLinkTemplate as j, generateSecurePassword as k, createDiscordProvider as l, createGitHubProvider as m, createCustomAuthAdapter as n, isPublicStoragePath as nt, createSlackProvider as o, createMicrosoftProvider as p, createStorageApiKeyGuard as q, createApiKeyRoutes as r, MAX_LIST_LIMIT as rt, createBitbucketProvider as s, auth_exports as t, PUBLIC_STORAGE_PREFIX as tt, createTwitterProvider as u, ZodNumber as v, MemoryRateLimitStore as w, string as x, _enum as y, fileTokenAuth as z };
+export { safeCompare as $, getEmailVerificationTemplate as A, optionalAuth as B, createDataRateLimiter as C, validatePasswordStrength as D, hashPassword as E, createAdapterAuthMiddleware as F, InvalidStorageKeyError as G, queryTokenAuth as H, createAuthMiddleware as I, createFunctionApiKeyGuard as J, canonicalStorageKey as K, createRequireAuth as L, getPasswordResetTemplate as M, getUserInvitationTemplate as N, verifyPassword as O, getWelcomeEmailTemplate as P, extractBearerToken as Q, extractUserFromToken as R, _coercedNumber as S, resolveAuthHooks as T, requireAdmin as U, publicObjectAuth as V, requireAuth as W, isApiKeyToken as X, createStorageApiKeyGuard as Y, validateApiKey as Z, createBuiltinAuthAdapter as _, createSpotifyProvider as a, object as b, createGitLabProvider as c, createFacebookProvider as d, scopeDataDriver as et, createAppleProvider as f, createGoogleProvider as g, createLinkedinProvider as h, createApiKeyStore as i, isPublicStoragePath as it, getMagicLinkTemplate as j, generateSecurePassword as k, createDiscordProvider as l, createGitHubProvider as m, createCustomAuthAdapter as n, isOperationAllowed as nt, createSlackProvider as o, createMicrosoftProvider as p, createApiKeyPreAuth as q, createApiKeyRoutes as r, PUBLIC_STORAGE_PREFIX as rt, createBitbucketProvider as s, auth_exports as t, httpMethodToOperation as tt, createTwitterProvider as u, ZodNumber as v, MemoryRateLimitStore as w, string as x, _enum as y, fileTokenAuth as z };
 
-//# sourceMappingURL=auth-CuC9M2x6.js.map
+//# sourceMappingURL=auth-BANhRhN9.js.map