@rebasepro/server 0.13.1-canary.gf57a27e → 0.14.0

package/dist/index.es.js

@@ -1,27 +1,27 @@
 import { createRequire as __createRequire } from "module";
 import process from "process";
 __createRequire(import.meta.url);
-import { C as EntityReference, E as Vector, T as GeoPoint, _ as resolvePrimaryKeys, a as serializeFilter, b as resolveClientListLimit, c as paginateFind, d as createDataSourceRegistry, f as resolveDataSource, g as buildCompositeId, h as resolveCollectionRelations, i as deserializeLogicalCondition, l as resolveFindWindow, m as findRelation, n as buildSdkData, o as serializeLogicalCondition, p as getEffectiveSecurityRules, r as deserializeFilter, s as collectAllPages, t as buildRoutedRebaseData, u as CollectionRegistry, v as toSnakeCase, w as EntityRelation } from "./src-DVb5a0bp.js";
-import { c as DEFAULT_DATA_SOURCE_KEY, i as getCollectionDataPath, n as RLS_ROLES_SQL, o as isPostgresCollectionConfig, p as toCanonicalOp, r as RLS_UID_SQL, t as RLS_JWT_SQL } from "./src-Ca6NhxKs.js";
-import { n as ADMIN_PROPERTY_KEYS, t as ADMIN_COLLECTION_KEYS } from "./admin_block-CLeUMG8G.js";
-import { i as isSQLAdmin, r as revokeInternalTableSql } from "./ddl-bootstrap-Bp3mr6Td.js";
-import { n as createContractRoutes } from "./contract-routes-FSt0Nyfk.js";
-import { $ as safeCompare, A as getEmailVerificationTemplate, B as optionalAuth, C as createDataRateLimiter, D as validatePasswordStrength, E as hashPassword, F as createAdapterAuthMiddleware, G as InvalidStorageKeyError, H as queryTokenAuth, I as createAuthMiddleware, J as createFunctionApiKeyGuard, K as canonicalStorageKey, L as createRequireAuth, M as getPasswordResetTemplate, N as getUserInvitationTemplate, O as verifyPassword, P as getWelcomeEmailTemplate, Q as extractBearerToken, R as extractUserFromToken, S as _coercedNumber, T as resolveAuthHooks, U as requireAdmin, V as publicObjectAuth, W as requireAuth, X as isApiKeyToken, Y as createStorageApiKeyGuard, Z as validateApiKey, _ as createBuiltinAuthAdapter, a as createSpotifyProvider, b as object, c as createGitLabProvider, d as createFacebookProvider, et as scopeDataDriver, f as createAppleProvider, g as createGoogleProvider, h as createLinkedinProvider, i as createApiKeyStore, it as isPublicStoragePath, j as getMagicLinkTemplate, k as generateSecurePassword, l as createDiscordProvider, m as createGitHubProvider, n as createCustomAuthAdapter, nt as isOperationAllowed, o as createSlackProvider, p as createMicrosoftProvider, q as createApiKeyPreAuth, r as createApiKeyRoutes, rt as PUBLIC_STORAGE_PREFIX, s as createBitbucketProvider, tt as httpMethodToOperation, u as createTwitterProvider, v as ZodNumber, w as MemoryRateLimitStore, x as string, y as _enum, z as fileTokenAuth } from "./auth-BANhRhN9.js";
-import { t as logger } from "./logger-BYU66ENZ.js";
-import { n as errorHandler, t as ApiError } from "./errors-BpudWAVU.js";
-import { i as generateDownloadToken, n as configureJwt } from "./jwt-CzeviDcB.js";
+import { A as RebaseApiError, D as EntityRelation, E as EntityReference, O as GeoPoint, _ as resolveCollectionRelations, b as toSnakeCase, c as collectAllPages, d as CollectionRegistry, f as createDataSourceRegistry, g as findRelation, h as fieldKeyForColumn, j as RebaseClientError, k as Vector, l as paginateFind, m as getEffectiveSecurityRules, n as buildSdkData, o as serializeFilter, p as resolveDataSource, s as serializeLogicalCondition, t as buildRoutedRebaseData, u as resolveFindWindow, v as buildCompositeId, y as resolvePrimaryKeys } from "./src-C7rkDGxA.js";
+import { c as DEFAULT_DATA_SOURCE_KEY, i as getCollectionDataPath, m as toCanonicalOp, n as RLS_ROLES_SQL, o as isPostgresCollectionConfig, r as RLS_UID_SQL, t as RLS_JWT_SQL } from "./src-Cz9nMgUR.js";
+import { n as ADMIN_PROPERTY_KEYS, t as ADMIN_COLLECTION_KEYS } from "./admin_block-H86dCPsj.js";
+import { i as isSQLAdmin, r as revokeInternalTableSql } from "./ddl-bootstrap-BhXbTnBl.js";
+import { n as createContractRoutes } from "./contract-routes-Bet-eCNJ.js";
+import { $ as fileTokenAuth, A as MemoryRateLimitStore, B as getEmailVerificationTemplate, C as ZodNumber, Ct as isPublicStoragePath, D as _coercedNumber, E as string, F as resolveAuthHooks, G as RawHtml, H as getPasswordResetTemplate, I as hashPassword, J as raw, K as escapeHtml, L as validatePasswordStrength, M as createEmailService, N as assertEmailLinkBases, O as DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT, P as resolveEmailLinkBase, Q as extractUserFromToken, R as verifyPassword, S as createBuiltinAuthAdapter, St as PUBLIC_STORAGE_PREFIX, T as object, U as getUserInvitationTemplate, V as getMagicLinkTemplate, W as getWelcomeEmailTemplate, X as createAuthMiddleware, Y as createAdapterAuthMiddleware, Z as createRequireAuth, _ as createLinkedinProvider, _t as scopeDataDriver, a as createSpotifyProvider, at as InvalidStorageBucketError, b as pkceTokenParams, bt as parseQueryOptions, c as createGitLabProvider, ct as canonicalStorageKey, d as createFacebookProvider, dt as createStorageApiKeyGuard, et as optionalAuth, f as createAppleProvider, ft as isApiKeyToken, g as createGitHubProvider, gt as SERVICE_IDENTITY, h as verifyOidcIdToken, ht as safeCompare, i as createApiKeyStore, it as requireAuth, j as SMTPEmailService, k as createDataRateLimiter, l as createDiscordProvider, lt as createApiKeyPreAuth, m as tryVerifyOidcIdToken, mt as extractBearerToken, n as createCustomAuthAdapter, nt as queryTokenAuth, o as createSlackProvider, ot as InvalidStorageKeyError, p as createMicrosoftProvider, pt as validateApiKey, q as html, r as createApiKeyRoutes, rt as requireAdmin, s as createBitbucketProvider, st as canonicalStorageBucket, tt as publicObjectAuth, u as createTwitterProvider, ut as createFunctionApiKeyGuard, v as createGoogleProvider, vt as httpMethodToOperation, w as _enum, x as providerVerifiedEmail, xt as resolveListLimitParam, y as oauthCodeFlowSchema, yt as isOperationAllowed, z as generateSecurePassword } from "./auth-CYoPVf-E.js";
+import { t as logger } from "./logger-DfvF_8r-.js";
+import { n as errorHandler, t as ApiError } from "./errors-EBYiaJ2E.js";
+import { i as generateDownloadToken, n as configureJwt } from "./jwt-_IFqfTOg.js";
 import { t as logMiddleware } from "./logs-routes-BYA72C_C.js";
 import { n as DOCUMENT_MIME_TYPES, r as IMAGE_MIME_TYPES, t as DEFAULT_MAX_FILE_SIZE } from "./types-DSnOC4mF.js";
 import { t as S3StorageController } from "./S3StorageController-B2EDXXMH.js";
 import { t as GCSStorageController } from "./GCSStorageController-BEmDYFKc.js";
-import { n as loadFunctionsFromDirectory } from "./function-loader-B_1fYfUY.js";
-import { t as createFunctionRoutes } from "./function-routes-C0cLIy3N.js";
-import { n as loadCronJobsFromDirectory } from "./cron-loader-B1S2MCSl.js";
-import { r as validateCronExpression, t as CronScheduler } from "./cron-scheduler-CsQtYLMq.js";
-import { t as createCronRoutes } from "./cron-routes-D5a9v1HY.js";
-import { t as createCronStore } from "./cron-store-ZbjfuvMb.js";
-import { a as parseBackupTimestamp, i as parseBackupDestination, n as createBackupRoutes, o as readBackupBytes, r as listBackupObjects } from "./backup-BJiY_mM-.js";
-import { randomBytes, randomUUID } from "node:crypto";
+import { n as loadFunctionsFromDirectory } from "./function-loader-DDS1v7YX.js";
+import { t as createFunctionRoutes } from "./function-routes-Btcez1T-.js";
+import { n as loadCronJobsFromDirectory, r as loadCronJobsWithDiagnostics } from "./cron-loader-YhhQeVBM.js";
+import { r as validateCronExpression, t as CronScheduler } from "./cron-scheduler-DIpYBmZP.js";
+import { t as createCronRoutes } from "./cron-routes-maM_RlUu.js";
+import { t as createCronStore } from "./cron-store-Dvr4Y1sZ.js";
+import { a as parseBackupTimestamp, i as parseBackupDestination, n as createBackupRoutes, o as readBackupBytes, r as listBackupObjects } from "./backup-C6ljYVTp.js";
+import { createHash, randomBytes, randomUUID } from "node:crypto";
 import * as fs$2 from "fs";
 import fs, { existsSync } from "fs";
 import * as path$2 from "path";
@@ -37,73 +37,18 @@ import { csrf } from "hono/csrf";
 import { compress } from "hono/compress";
 import fs$1 from "node:fs";
 import fsp from "node:fs/promises";
+import os from "node:os";
 import { mkdir, open, unlink, writeFile } from "fs/promises";
 import { sql } from "drizzle-orm";
+import { lookup } from "node:dns/promises";
+import { isIP } from "node:net";
 import { serveStatic } from "@hono/node-server/serve-static";
 import { createServer } from "http";
 import { cors } from "hono/cors";
 import { secureHeaders } from "hono/secure-headers";
 import { getRequestListener } from "@hono/node-server";
-import os from "node:os";
 import { execFile } from "node:child_process";
 import { promisify as promisify$1 } from "node:util";
-//#region ../types/src/errors.ts
-/**
-* The single error type thrown across the entire Rebase client surface —
-* HTTP data/control-plane calls, realtime/WebSocket operations, and
-* client-side logic errors (e.g. an unknown collection accessor). A `catch`
-* block only ever needs to check for this one class:
-*
-* ```ts
-* import { RebaseApiError } from "@rebasepro/client"; // re-exported
-*
-* try {
-*   await client.data.products.update(id, { price: 9 });
-* } catch (e) {
-*   if (e instanceof RebaseApiError) {
-*     if (e.status === 404) { ... }   // HTTP failures carry a status
-*     console.error(e.code, e.details);
-*   }
-* }
-* ```
-*
-* `status` is present for HTTP failures and `undefined` otherwise, so its
-* presence distinguishes transport-level errors from realtime/logic errors.
-*
-* @group Errors
-*/
-var RebaseApiError = class extends Error {
-	/** HTTP status code, or `undefined` for non-HTTP errors. */
-	status;
-	/** Stable machine-readable error code, when the server supplied one. See {@link RebaseErrorCode}. */
-	code;
-	/** Structured error payload from the server, when present. */
-	details;
-	constructor(message, init = {}) {
-		super(message);
-		this.name = "RebaseApiError";
-		this.status = init.status;
-		this.code = init.code;
-		this.details = init.details;
-		if (init.cause !== void 0) this.cause = init.cause;
-	}
-};
-/**
-* Client-side logic error — raised before any request is made (e.g. accessing
-* an unknown collection accessor when a typed dictionary is configured).
-*
-* A subclass of {@link RebaseApiError} (with no `status`), so a single
-* `catch (e) { if (e instanceof RebaseApiError) ... }` handles it too.
-*
-* @group Errors
-*/
-var RebaseClientError = class extends RebaseApiError {
-	constructor(message) {
-		super(message);
-		this.name = "RebaseClientError";
-	}
-};
-//#endregion
 //#region ../types/src/types/storage_source.ts
 /**
 * Describes a named storage backend — a place files live.
@@ -250,23 +195,6 @@ function serializeOrderBy(orderBy) {
 	if (typeof orderBy === "string") return orderBy;
 	return `${orderBy[0]}:${orderBy[1]}`;
 }
-/**
-* Deserialize a wire-format `"field:direction"` string into an {@link OrderByTuple}.
-*
-* Lenient parsing (matches existing server behaviour):
-* - Bare field name (no colon): `"name"` → `["name", "asc"]`
-* - Unknown direction: `"name:foo"` → `["name", "asc"]`
-* - Empty / falsy input: → `undefined`
-*
-* @param raw - The wire-format string from an HTTP query parameter.
-* @returns The canonical tuple, or `undefined` if the input is empty/falsy.
-*/
-function deserializeOrderBy(raw) {
-	if (!raw) return void 0;
-	const idx = raw.indexOf(":");
-	if (idx === -1) return [raw, "asc"];
-	return [raw.slice(0, idx), raw.slice(idx + 1) === "desc" ? "desc" : "asc"];
-}
 //#endregion
 //#region src/collections/BackendCollectionRegistry.ts
 /**
@@ -544,6 +472,35 @@ function checkRelation(relation, path, collect) {
 		for (const field of RELATION_LINK_FIELDS) if (relation[field] !== void 0 && !allowed.includes(field)) collect.error(`${path}.${field}`, `\`${field}\` is not valid on a "${kind}" relation. A "${kind}" takes ${allowed.length ? allowed.map((a) => `\`${a}\``).join(" and ") : "no link field"}.`);
 	}
 }
+/**
+* `validation.matches`, checked by compiling it.
+*
+* This file is about key *identity* and this is a value — but it is a value
+* with the property the file exists for: no runtime signal. `toPattern` in
+* `write-validation.ts` builds the `RegExp` per request and answers `undefined`
+* when the pattern will not compile, and the caller reads
+* `if (pattern && !pattern.test(value))` — so a pattern with an unclosed
+* bracket does not reject the write, it removes the rule. Every value passes,
+* for the lifetime of the deployment, and the only trace is that the author
+* believes a validation is running.
+*
+* Fatal for the reason a renamed key is fatal: the author wrote a rule to keep
+* something out of their database, and a minute of downtime beats finding out
+* from the data.
+*
+* A `RegExp` literal cannot be wrong here — the engine already compiled it — so
+* only strings are checked.
+*/
+function checkValidationPattern(validation, path, collect) {
+	if (!isPlainObject$1(validation)) return;
+	const matches = validation.matches;
+	if (typeof matches !== "string") return;
+	try {
+		new RegExp(matches);
+	} catch (e) {
+		collect.error(`${path}.matches`, `\`matches: ${JSON.stringify(matches)}\` is not a valid regular expression (${e instanceof Error ? e.message : String(e)}). It would compile to nothing at write time, which does not reject values — it silently drops the rule, and every value passes.`);
+	}
+}
 function checkProperty(property, path, collect) {
 	if (typeof property === "function") return;
 	if (!isPlainObject$1(property)) {
@@ -571,6 +528,7 @@ function checkProperty(property, path, collect) {
 		collect.unknown(`${path}.${key}`, key, `property (\`${String(type)}\`)`);
 	}
 	if (type === "relation" && property.relation !== void 0) checkRelation(property.relation, `${path}.relation`, collect);
+	checkValidationPattern(property.validation, `${path}.validation`, collect);
 	if (type === "array") {
 		const of = property.of;
 		if (Array.isArray(of)) of.forEach((entry, index) => checkProperty(entry, `${path}.of[${index}]`, collect));
@@ -785,6 +743,20 @@ function isDataDriverDelegate(obj) {
 //#endregion
 //#region src/services/routed-realtime-service.ts
 /**
+* Channel/presence/broadcast messages are engine-agnostic pub/sub — which is
+* why they go to a provider that implements them, not to whichever provider a
+* bootstrapper happened to mark `isDefault`.
+*/
+var CHANNEL_MESSAGE_TYPES$1 = /* @__PURE__ */ new Set([
+	"join_channel",
+	"leave_channel",
+	"broadcast",
+	"presence_track",
+	"presence_untrack",
+	"presence_state",
+	"channel_history"
+]);
+/**
 * Compose multiple per-engine {@link RealtimeProvider}s into one that routes
 * each subscription to the provider owning the subscribed collection — the
 * realtime counterpart of `buildRoutedRebaseData`.
@@ -794,8 +766,9 @@ function isDataDriverDelegate(obj) {
 * - `subscribe_collection` / `subscribe_entity` → the provider for the
 *   collection's data source (by `payload.path`).
 * - `unsubscribe` → forwarded to all providers (a no-op on non-owners).
-* - channel / presence / broadcast → the default provider (these are global
-*   pub/sub, not bound to an engine).
+* - channel / presence / broadcast → the first provider that declares
+*   `supportsChannels` (these are global pub/sub, not bound to an engine — but
+*   they are not implemented by every engine either).
 * - `addClient` and lifecycle (`onServerReady`/`destroy`/`stopListening`) →
 *   all providers (each registers its own ws close handler for cleanup).
 */
@@ -809,6 +782,30 @@ function createRoutedRealtimeService(opts) {
 		const key = resolveKey(path);
 		return asWs(providers[key] ?? providers[defaultKey] ?? Object.values(providers)[0]);
 	};
+	/**
+	* The provider channel frames go to, resolved once and reported once.
+	*
+	* By capability, not by default-ness: the default provider is whichever
+	* bootstrapper set `isDefault`, and routing pub/sub there sends every
+	* broadcast, presence update and catch-up request into an engine that may
+	* not implement any of them. When the default *does* support channels it is
+	* still preferred, so single-engine behaviour is unchanged.
+	*/
+	let channelRouting;
+	const forChannels = () => {
+		if (!channelRouting) {
+			const entries = Object.entries(providers);
+			const supports = ([, p]) => asWs(p).supportsChannels === true;
+			const chosen = entries.find(([key]) => key === defaultKey && supports([key, providers[key]])) ?? entries.find(supports);
+			channelRouting = chosen ? {
+				provider: asWs(chosen[1]),
+				key: chosen[0]
+			} : {};
+			if (chosen) logger.info(`📡 [Realtime] Channels, presence and broadcast are served by the "${chosen[0]}" data source.`);
+			else logger.error(`❌ [Realtime] No configured realtime provider implements channels, presence or broadcast — every channel frame will be refused. Configured sources: [${entries.map(([k]) => k).join(", ")}]. Channels currently require a Postgres data source.`);
+		}
+		return channelRouting.provider;
+	};
 	return {
 		addClient(clientId, ws) {
 			for (const p of all()) p.addClient?.(clientId, ws);
@@ -823,6 +820,12 @@ function createRoutedRealtimeService(opts) {
 				await Promise.all(all().map((p) => p.handleClientMessage(clientId, message, authContext)));
 				return;
 			}
+			if (CHANNEL_MESSAGE_TYPES$1.has(type)) {
+				const provider = forChannels();
+				if (!provider) throw new Error(`Channels are not supported by any configured data source — "${type}" refused.`);
+				await provider.handleClientMessage(clientId, message, authContext);
+				return;
+			}
 			await fallback().handleClientMessage(clientId, message, authContext);
 		},
 		subscribeToCollection(subscriptionId, config, callback) {
@@ -849,236 +852,22 @@ function createRoutedRealtimeService(opts) {
 	};
 }
 //#endregion
-//#region src/api/rest/query-parser.ts
-function getLastValue(val) {
-	if (Array.isArray(val)) return val[val.length - 1];
-	return val;
-}
-/**
-* Parse an `or(...)` / `and(...)` logical group from its wire form.
-*
-* The wire carries the inner conditions wrapped in parens (e.g.
-* `(status.eq.active,age.gte.18)`); we re-attach the `or`/`and` prefix and
-* delegate to the canonical filter dialect (`@rebasepro/common`). Values are
-* preserved as strings — type coercion is the schema-aware driver's job, so
-* this path stays byte-for-byte consistent with the SDK/admin path (which
-* also parses via the shared dialect).
-*/
-function parseLogicalGroup(type, raw) {
-	let inner = String(raw).trim();
-	if (inner.startsWith("(") && inner.endsWith(")")) inner = inner.slice(1, -1);
-	inner = inner.trim();
-	if (!inner) return void 0;
-	let parsed;
-	try {
-		parsed = deserializeLogicalCondition(`${type}(${inner})`);
-	} catch (e) {
-		throw ApiError.badRequest(`Invalid \`${type}\` parameter: ${e instanceof Error ? e.message : String(e)}`, "INVALID_LOGICAL_GROUP");
-	}
-	return "type" in parsed ? parsed : void 0;
-}
-/**
-* Parse the `?where=` JSON filter object.
-*
-* This is the dialect the OpenAPI document publishes on every
-* `GET /api/data/{slug}` — `{"status":["==","active"]}`: field → canonical
-* `[WhereFilterOp, value]` tuple. It is normalized through the same
-* `deserializeFilter` as the `?field=op.value` params below, so a value that
-* arrives as a PostgREST dot-string (`{"status":"eq.active"}`) or as a bare
-* scalar (`{"status":"active"}`) compiles to the same condition. Unlike the
-* querystring dialect, JSON carries types — a number stays a number.
-*
-* A malformed value is a 400 rather than a silent drop: dropping the filter
-* would run the read unfiltered and return everything RLS happens to allow.
-*/
-function parseWhereParam(raw) {
-	const str = String(raw).trim();
-	if (!str) return void 0;
-	let parsed;
-	try {
-		parsed = JSON.parse(str);
-	} catch {
-		throw ApiError.badRequest("Invalid `where` parameter: expected a JSON object, e.g. {\"status\":[\"==\",\"active\"]}", "INVALID_WHERE");
-	}
-	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw ApiError.badRequest("Invalid `where` parameter: expected a JSON object mapping fields to conditions, e.g. {\"status\":[\"==\",\"active\"]}", "INVALID_WHERE");
-	const filter = deserializeFilter(parsed);
-	return Object.keys(filter).length > 0 ? filter : void 0;
-}
-function invalidOrderBy(detail) {
-	throw ApiError.badRequest(`Invalid \`orderBy\` parameter: ${detail}. Expected \`field\`, \`field:desc\`, or a JSON array like [{"field":"created_at","direction":"desc"}]`, "INVALID_ORDER_BY");
-}
-/** `asc`/`desc`, in any case. Anything else is a request to sort in a way that does not exist. */
-function toDirection(raw, context) {
-	if (raw === void 0 || raw === null) return "asc";
-	if (typeof raw !== "string") invalidOrderBy(`${context} has a non-string \`direction\``);
-	const lowered = raw.toLowerCase();
-	if (lowered !== "asc" && lowered !== "desc") invalidOrderBy(`${context} has direction '${raw}'`);
-	return lowered;
-}
-/** One entry: the canonical `{field, direction}`, or the `field:direction` shorthand as a string. */
-function toOrderByEntry(raw, index) {
-	const context = `entry ${index}`;
-	if (typeof raw === "string") {
-		const tuple = deserializeOrderBy(raw);
-		if (!tuple || !tuple[0]) invalidOrderBy(`${context} is an empty field name`);
-		return {
-			field: tuple[0],
-			direction: toDirection(tuple[1], context)
-		};
-	}
-	if (typeof raw !== "object" || raw === null || Array.isArray(raw)) invalidOrderBy(`${context} is not a field name or a {field, direction} object`);
-	const entry = raw;
-	if (typeof entry.field !== "string" || entry.field.trim() === "") invalidOrderBy(`${context} has no \`field\``);
-	return {
-		field: entry.field,
-		direction: toDirection(entry.direction, context)
-	};
-}
-/**
-* Parse the `orderBy` query parameter.
-*
-* The field *name* has been validated against the schema for a while — an
-* `?orderBy=titel` is a 400 rather than 200 with unsorted rows, on the grounds
-* that silently dropping the sort leaves the caller believing in an order that
-* is not there. The parameter's *shape* was never checked the same way, and it
-* failed in exactly the same silent manner one layer earlier: whatever
-* `JSON.parse` returned was assigned to an option declared as an array of
-* `{field, direction}`, and the REST layer reads only `orderBy[0].field`. So
-* `?orderBy={"field":"name"}` — an object rather than an array, and the most
-* natural thing for a client to try — read `undefined`, dropped the ORDER BY,
-* and answered 200. So did a number, a boolean, `null`, and `["name"]`.
-*
-* This refuses those, the way `parseWhereParam` above already refuses a
-* malformed filter and for the same reason. What it keeps working is every
-* shape that worked before: the `field` and `field:desc` shorthands, and the
-* canonical JSON array.
-*/
-function parseOrderByParam(raw) {
-	if (Array.isArray(raw)) return raw.length === 0 ? void 0 : raw.map(toOrderByEntry);
-	const str = String(raw).trim();
-	if (!str) return void 0;
-	let parsed;
-	try {
-		parsed = JSON.parse(str);
-	} catch {
-		return [toOrderByEntry(str, 0)];
-	}
-	if (Array.isArray(parsed)) {
-		if (parsed.length === 0) return void 0;
-		return parsed.map(toOrderByEntry);
-	}
-	if (typeof parsed === "string") return [toOrderByEntry(parsed, 0)];
-	if (typeof parsed === "object" && parsed !== null) invalidOrderBy("a single object was given where a JSON array was expected");
-	invalidOrderBy(`${typeof parsed} is not a field name or a list of them`);
-}
-/**
-* Parse query parameters into QueryOptions
-*/
-function parseQueryOptions(query, limits = {}) {
-	const options = {};
-	const rawLimit = getLastValue(query.limit);
-	const offsetVal = getLastValue(query.offset);
-	if (offsetVal) options.offset = parseInt(String(offsetVal));
-	const pageVal = getLastValue(query.page);
-	if (pageVal) {
-		const page = parseInt(String(pageVal));
-		const limit = resolveClientListLimit(rawLimit, {
-			defaultLimit: limits.defaultLimit,
-			maxLimit: limits.maxLimit
-		});
-		options.offset = (page - 1) * limit;
-	}
-	const orVal = getLastValue(query.or);
-	const andVal = getLastValue(query.and);
-	if (orVal) {
-		const logical = parseLogicalGroup("or", orVal);
-		if (logical) options.logical = logical;
-	} else if (andVal) {
-		const logical = parseLogicalGroup("and", andVal);
-		if (logical) options.logical = logical;
-	}
-	const reservedQueryKeys = [
-		"limit",
-		"offset",
-		"page",
-		"orderBy",
-		"include",
-		"fields",
-		"searchString",
-		"searchExplain",
-		"vector_search",
-		"vector",
-		"vector_distance",
-		"vector_threshold",
-		"or",
-		"and",
-		"where"
-	];
-	const filterDict = {};
-	for (const [key, rawValue] of Object.entries(query)) {
-		if (reservedQueryKeys.includes(key)) continue;
-		filterDict[key] = rawValue;
-	}
-	const whereVal = getLastValue(query.where);
-	const where = {
-		...whereVal !== void 0 && whereVal !== null ? parseWhereParam(whereVal) : void 0,
-		...deserializeFilter(filterDict)
-	};
-	if (Object.keys(where).length > 0) options.where = where;
-	const orderByVal = getLastValue(query.orderBy);
-	if (orderByVal) options.orderBy = parseOrderByParam(orderByVal);
-	const includeVal = getLastValue(query.include);
-	if (includeVal) {
-		const includeStr = String(includeVal).trim();
-		if (includeStr === "*") options.include = ["*"];
-		else options.include = includeStr.split(",").map((s) => s.trim()).filter(Boolean);
-	}
-	const fieldsVal = getLastValue(query.fields);
-	if (fieldsVal) options.fields = String(fieldsVal).trim().split(",").map((s) => s.trim()).filter(Boolean);
-	const vectorSearchVal = getLastValue(query.vector_search);
-	const vectorVal = getLastValue(query.vector);
-	if (vectorSearchVal && vectorVal) {
-		const vectorStr = String(vectorVal);
-		let decoded;
-		try {
-			decoded = JSON.parse(vectorStr);
-		} catch {
-			decoded = void 0;
-		}
-		if (!Array.isArray(decoded) || !decoded.every((v) => typeof v === "number")) throw ApiError.badRequest("Invalid `vector` format. Expected a JSON array of numbers, e.g. [0.1,0.2,0.3]", "INVALID_VECTOR");
-		const queryVector = decoded;
-		const distanceParamVal = getLastValue(query.vector_distance);
-		const distanceParam = distanceParamVal ? String(distanceParamVal) : "cosine";
-		if (distanceParam !== "cosine" && distanceParam !== "l2" && distanceParam !== "inner_product") throw ApiError.badRequest(`Invalid \`vector_distance\`: ${distanceParam}. Expected: cosine, l2, or inner_product`, "INVALID_VECTOR_DISTANCE");
-		const vectorSearch = {
-			property: String(vectorSearchVal),
-			vector: queryVector,
-			distance: distanceParam
-		};
-		const thresholdVal = getLastValue(query.vector_threshold);
-		if (thresholdVal) {
-			const threshold = parseFloat(String(thresholdVal));
-			if (isNaN(threshold)) throw ApiError.badRequest("Invalid `vector_threshold`. Expected a number.", "INVALID_VECTOR_THRESHOLD");
-			vectorSearch.threshold = threshold;
-		}
-		options.vectorSearch = vectorSearch;
-	}
-	options.limit = resolveClientListLimit(rawLimit, {
-		vectorSearch: !!options.vectorSearch,
-		defaultLimit: limits.defaultLimit,
-		maxLimit: limits.maxLimit
-	});
-	return options;
-}
-//#endregion
 //#region src/api/rest/write-validation.ts
 /**
 * Reject a write naming a field the collection does not have.
 *
-* Unknown keys used to travel all the way into the INSERT, where Postgres
-* rejected them — so a typo came back as `column "titel" does not exist`,
-* phrased by the database, from a stack the caller cannot see, and only if the
-* column really was absent. It is a request problem and belongs in a 400.
+* An unknown key does *not* reach the INSERT and come back as `column "titel"
+* does not exist`, which is what this comment used to claim. Drizzle builds
+* INSERT and UPDATE from the table's own column list, so a key the table does
+* not carry is left out of the statement: the write answers 201 having stored
+* nothing under that name. A typo is a request problem, it belongs in a 400,
+* and nothing below this was ever going to raise one.
+*
+* This is the config-level check and it is skipped on several paths (see the
+* `strictWrites` bail below, and the auth-adapter contract at the call site).
+* `assertWritableColumns` in the Postgres driver is the backstop every write
+* passes through, including in-process `rebase.data` writes that never come
+* near this layer.
 *
 * What counts as known:
 * - a declared property (for an introspected BaaS collection these *are* the
@@ -1093,7 +882,7 @@ function assertKnownWriteFields(values, collection, options) {
 	if (collection.strictWrites === false) return;
 	if (!collection.properties || Object.keys(collection.properties).length === 0) return;
 	const known = new Set(Object.keys(collection.properties));
-	for (const relation of Object.values(resolveCollectionRelations(collection))) if (relation.kind === "belongsTo") known.add(relation.localKey);
+	for (const relation of Object.values(resolveCollectionRelations(collection))) if (relation.kind === "belongsTo") known.add(fieldKeyForColumn(collection, relation.localKey));
 	for (const field of options?.extraKnownFields ?? []) known.add(field);
 	const unknown = Object.keys(values).filter((key) => !known.has(key));
 	if (unknown.length === 0) return;
@@ -1106,6 +895,145 @@ function assertKnownWriteFields(values, collection, options) {
 	throw ApiError.badRequest(`${where}'${collection.slug}' has no field${unknown.length > 1 ? "s" : ""} ${unknown.map((f) => `'${f}'`).join(", ")}. Known fields: ${[...known].sort().map((f) => `'${f}'`).join(", ")}.`, "VALIDATION_UNKNOWN_FIELDS");
 }
 /**
+* The number a constraint should judge, or `undefined` if the value is not one.
+*
+* A JSON body may carry `"5"` for a number column and Postgres accepts it, so
+* the string form is judged too — refusing to look at it would leave the exact
+* bypass this function exists to close.
+*/
+function asNumber(value) {
+	if (typeof value === "number") return Number.isNaN(value) ? void 0 : value;
+	if (typeof value === "string" && value.trim() !== "") {
+		const parsed = Number(value);
+		return Number.isNaN(parsed) ? void 0 : parsed;
+	}
+}
+/** The instant a constraint should judge, or `undefined` if the value is not one. */
+function asDate(value) {
+	if (value instanceof Date) return Number.isNaN(value.getTime()) ? void 0 : value;
+	if (typeof value === "string" || typeof value === "number") {
+		const parsed = new Date(value);
+		return Number.isNaN(parsed.getTime()) ? void 0 : parsed;
+	}
+}
+/**
+* `validation.matches` as a regex that can be tested repeatedly.
+*
+* A `RegExp` carrying `g` or `y` keeps `lastIndex` between calls, so the same
+* pattern would accept and reject the same value on alternate rows of a bulk
+* write. Rebuilt without those flags.
+*/
+function toPattern(matches) {
+	try {
+		if (typeof matches === "string") return new RegExp(matches);
+		return new RegExp(matches.source, matches.flags.replace(/[gy]/g, ""));
+	} catch {
+		return;
+	}
+}
+function collectViolations(key, property, value, into) {
+	if (value === null || value === void 0) return;
+	switch (property.type) {
+		case "string": {
+			const rules = property.validation;
+			if (!rules || typeof value !== "string") return;
+			if (rules.length !== void 0 && value.length !== rules.length) into.push(`'${key}' must be exactly ${rules.length} character${rules.length === 1 ? "" : "s"} long (received ${value.length}).`);
+			if (rules.min !== void 0 && value.length < rules.min) into.push(`'${key}' must be at least ${rules.min} character${rules.min === 1 ? "" : "s"} long (received ${value.length}).`);
+			if (rules.max !== void 0 && value.length > rules.max) into.push(`'${key}' must be at most ${rules.max} character${rules.max === 1 ? "" : "s"} long (received ${value.length}).`);
+			if (rules.matches !== void 0) {
+				const pattern = toPattern(rules.matches);
+				if (pattern && !pattern.test(value)) into.push(rules.matchesMessage ?? `'${key}' does not match the required pattern ${pattern}.`);
+			}
+			return;
+		}
+		case "number": {
+			const rules = property.validation;
+			if (!rules) return;
+			const num = asNumber(value);
+			if (num === void 0) return;
+			if (rules.integer && !Number.isInteger(num)) into.push(`'${key}' must be a whole number (received ${num}).`);
+			if (rules.positive && !(num > 0)) into.push(`'${key}' must be positive (received ${num}).`);
+			if (rules.negative && !(num < 0)) into.push(`'${key}' must be negative (received ${num}).`);
+			if (rules.min !== void 0 && num < rules.min) into.push(`'${key}' must be at least ${rules.min} (received ${num}).`);
+			if (rules.max !== void 0 && num > rules.max) into.push(`'${key}' must be at most ${rules.max} (received ${num}).`);
+			if (rules.moreThan !== void 0 && !(num > rules.moreThan)) into.push(`'${key}' must be greater than ${rules.moreThan} (received ${num}).`);
+			if (rules.lessThan !== void 0 && !(num < rules.lessThan)) into.push(`'${key}' must be less than ${rules.lessThan} (received ${num}).`);
+			return;
+		}
+		case "date": {
+			const rules = property.validation;
+			if (!rules) return;
+			const date = asDate(value);
+			if (date === void 0) return;
+			const min = rules.min !== void 0 ? asDate(rules.min) : void 0;
+			const max = rules.max !== void 0 ? asDate(rules.max) : void 0;
+			if (min && date.getTime() < min.getTime()) into.push(`'${key}' must not be before ${min.toISOString()}.`);
+			if (max && date.getTime() > max.getTime()) into.push(`'${key}' must not be after ${max.toISOString()}.`);
+			return;
+		}
+		case "array": {
+			if (!Array.isArray(value)) return;
+			const rules = property.validation;
+			if (rules?.min !== void 0 && value.length < rules.min) into.push(`'${key}' must have at least ${rules.min} item${rules.min === 1 ? "" : "s"} (received ${value.length}).`);
+			if (rules?.max !== void 0 && value.length > rules.max) into.push(`'${key}' must have at most ${rules.max} item${rules.max === 1 ? "" : "s"} (received ${value.length}).`);
+			const of = property.of;
+			if (of && !Array.isArray(of)) value.forEach((item, index) => collectViolations(`${key}[${index}]`, of, item, into));
+			return;
+		}
+		case "map": {
+			if (typeof value !== "object" || value === null || Array.isArray(value)) return;
+			const properties = property.properties;
+			if (!properties) return;
+			for (const [subKey, subValue] of Object.entries(value)) {
+				const subProperty = properties[subKey];
+				if (subProperty) collectViolations(`${key}.${subKey}`, subProperty, subValue, into);
+			}
+			return;
+		}
+		default:
+	}
+}
+/**
+* Reject a write whose values break the constraints the collection declares.
+*
+* `validation.min`, `max`, `matches`, `positive`, `integer` and the date and
+* array bounds were read by exactly three things: the DDL generators (for
+* `integer` and for a `varchar` width), and the admin's client-side form. No
+* layer on the write path looked at them, no `CHECK` constraint was emitted,
+* and the generated OpenAPI published every one of them as `minimum`,
+* `maximum`, `minLength`, `maxLength` and `pattern`. So the docs' own example —
+* `price: { type: "number", validation: { min: 0 } }` — accepted `-5000` with a
+* 201 while the spec said it would not, and any client or gateway generated
+* from that spec believed the server was checking.
+*
+* Only `required` is left to the database, where it is a NOT NULL: a partial
+* update legitimately omits keys, and this function sees one request's values,
+* not the row they land on.
+*
+* A value of the wrong *type* is not this function's business — that reaches
+* Postgres, which types every column and gives a 400 through the driver's
+* SQLSTATE mapping. Constraints are checked against values of the right type,
+* plus the numeric-string form a JSON body may carry for a number column.
+*
+* Every failing field is reported at once. A form that fixes one field per
+* round trip is the reason validation errors get ignored.
+*/
+function assertWriteValuesValid(values, collection, options) {
+	const properties = collection.properties;
+	if (!properties || !values) return;
+	const violations = [];
+	for (const [key, value] of Object.entries(values)) {
+		const property = properties[key];
+		if (property) collectViolations(key, property, value, violations);
+	}
+	if (violations.length === 0) return;
+	const where = options?.rowIndex !== void 0 ? `Row ${options.rowIndex}: ` : "";
+	throw ApiError.badRequest(`${where}${violations.join(" ")}`, "VALIDATION_CONSTRAINT", {
+		collection: collection.slug,
+		violations
+	});
+}
+/**
 * Narrow response rows to the fields the caller asked for.
 *
 * `?fields=id,title` is documented in the generated OpenAPI — "Comma-separated
@@ -1136,7 +1064,7 @@ function projectResponseFields(rows, fields, collection, options) {
 	const declared = new Set(Object.keys(collection.properties ?? {}));
 	for (const [key, relation] of Object.entries(resolveCollectionRelations(collection))) {
 		declared.add(key);
-		if (relation.kind === "belongsTo") declared.add(relation.localKey);
+		if (relation.kind === "belongsTo") declared.add(fieldKeyForColumn(collection, relation.localKey));
 	}
 	for (const included of options?.include ?? []) declared.add(included);
 	declared.add("id");
@@ -1173,6 +1101,9 @@ function projectResponseFields(rows, fields, collection, options) {
 * generated on the client, so keying on the id alone would let anyone who
 * learned (or guessed) another user's id replay their key and be handed that
 * user's row back — a read of someone else's data through a write endpoint.
+* That is also why an unauthenticated caller gets no idempotency at all: every
+* anonymous request shares one principal, so honouring a key there would hand
+* one visitor's stored response to the next one who sent the same string.
 */
 var TABLE = "\"rebase\".\"idempotency_keys\"";
 /**
@@ -1183,15 +1114,75 @@ var TABLE = "\"rebase\".\"idempotency_keys\"";
 */
 var TTL_HOURS = 24;
 /**
-* The principal a key belongs to; anonymous and service writes share a sentinel.
+* How long a claim that has not answered yet is presumed to still be running.
+*
+* A claim is taken before the write and given back after it, so every exit the
+* process does not survive — a rolled pod, an OOM kill, a node drain, a
+* `complete` that itself fails — leaves the row pending with nobody coming back
+* for it. Reusing the 24-hour replay window as the lease made that
+* indistinguishable from a request still in flight, so every retry of that key
+* was refused for a day: the mechanism turned a write that plain retrying would
+* have completed into permanent loss, which is worse than not having it at all.
+*
+* The number trades the two ways it can be wrong, and both are bounded. Too
+* short and a genuinely slow write has its key taken over by its own retry —
+* the duplicate this exists to prevent. Too long and a crashed claim refuses
+* its retries for that long. A minute outlasts any write the row cap allows
+* and stays well inside the window the offline queue keeps retrying for.
+*/
+var PENDING_LEASE_SECONDS = 60;
+/**
+* How long to wait before attempting the table creation again after it failed.
+*
+* `ensure`'s answer used to be memoised unconditionally, so one transient DDL
+* failure — a database still starting, a lock on the `rebase` schema, a sibling
+* pod running the same `CREATE TABLE IF NOT EXISTS` — disabled idempotency on
+* that pod for the life of the process after a single log line. A failure is
+* retried instead, and the cooldown is what stops every keyed request re-running
+* DDL against a database that is genuinely unhappy.
+*/
+var ENSURE_RETRY_COOLDOWN_MS = 3e4;
+/**
+* The principal a key belongs to, or `undefined` when there is nobody to scope
+* it to and the key must therefore be ignored.
 *
-* The NUL is written as an escape, not as a raw byte in the source. The
-* sentinel itself is deliberate — a uid can never contain one — but written
-* literally it makes this file test as binary, and every repo-wide grep then
-* skips all 124 lines of it silently. Identical at runtime.
+* Anonymous callers are a supported configuration — `auth.requireAuth: false`
+* delegates access control to RLS — and they used to share one sentinel
+* principal, which is exactly the cross-principal replay the note above says
+* must not happen: two visitors of a public form who send the same key string
+* are handed each other's stored response. Refusing the key degrades them to no
+* idempotency, which is what they had before this table existed.
 */
 function principal(uid) {
-	return uid && uid.length > 0 ? uid : "\0anon";
+	return uid && uid.length > 0 ? uid : void 0;
+}
+/**
+* A stable rendering of a JSON value: one body always produces one string,
+* whatever order its keys arrived in.
+*
+* `JSON.stringify` preserves insertion order, so two encodings of the same
+* object would fingerprint differently and a legitimate retry would be refused
+* as a reused key. Only JSON types reach here — the value came from `JSON.parse`.
+*/
+function stableStringify(value) {
+	if (value === null || typeof value !== "object") return JSON.stringify(value) ?? "null";
+	if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`;
+	return `{${Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([k, v]) => `${JSON.stringify(k)}:${stableStringify(v)}`).join(",")}}`;
+}
+/**
+* What a key was claimed *for*, so presenting it on a different request is
+* caught instead of silently replaying the first one's answer.
+*
+* Nothing about the request used to enter the key, so `createMany(rows, { key })`
+* followed by `deleteMany(ids, { key })` — the reusable business id the docs
+* recommended — answered the delete with the create's `200` body and deleted
+* nothing. Method and path separate the routes; the body separates a re-run
+* carrying corrected rows from the retry of an unanswered one, which is the
+* difference between "here is your earlier answer" and silently discarding a
+* correction.
+*/
+function requestFingerprint(method, path, body) {
+	return createHash("sha256").update(`${method.toUpperCase()} ${path}\n${stableStringify(body)}`).digest("hex");
 }
 /**
 * Returns `undefined` when the driver cannot run SQL, which disables the whole
@@ -1208,9 +1199,19 @@ function createIdempotencyStore(driver) {
 	if (!isSQLAdmin(admin)) return void 0;
 	const exec = (sql, params) => admin.executeSql(sql, params ? { params } : void 0);
 	let ready;
+	let retryEnsureAt = 0;
+	let warnedAnonymous = false;
+	/** Said once per process: it is a deployment fact, not a per-request event. */
+	const warnAnonymous = () => {
+		if (warnedAnonymous) return;
+		warnedAnonymous = true;
+		logger.warn("Idempotency-Key ignored for an unauthenticated request — keys are scoped to a signed-in principal, and honouring one here would replay a stored response to whoever sends the same key next. A replayed write from an anonymous client may insert a duplicate row.");
+	};
 	/** Created on first use: most deployments never send a key at all. */
 	const ensure = () => {
-		ready ??= (async () => {
+		if (ready) return ready;
+		if (Date.now() < retryEnsureAt) return Promise.resolve(false);
+		ready = (async () => {
 			try {
 				await exec("CREATE SCHEMA IF NOT EXISTS rebase");
 				await exec(`
@@ -1222,29 +1223,44 @@ function createIdempotencyStore(driver) {
                         PRIMARY KEY (uid, key)
                     )
                 `);
+				await exec(`ALTER TABLE ${TABLE} ADD COLUMN IF NOT EXISTS fingerprint TEXT`);
 				await exec(`CREATE INDEX IF NOT EXISTS idx_idempotency_created ON ${TABLE}(created_at)`);
 				await exec(revokeInternalTableSql("rebase", "idempotency_keys"));
 				return true;
 			} catch (error) {
+				retryEnsureAt = Date.now() + ENSURE_RETRY_COOLDOWN_MS;
 				logger.warn("Idempotency keys unavailable — a replayed offline write may insert a duplicate row.", { detail: error instanceof Error ? error.message : String(error) });
 				return false;
 			}
-		})();
+		})().then((ok) => {
+			if (!ok) ready = void 0;
+			return ok;
+		});
 		return ready;
 	};
 	return {
-		async claim(key, uid) {
-			if (!key || !await ensure()) return { status: "claimed" };
+		async claim(key, uid, fingerprint) {
+			const owner = principal(uid);
+			if (key && !owner) warnAnonymous();
+			if (!key || !owner || !await ensure()) return { status: "claimed" };
 			try {
-				if ((await exec(`INSERT INTO ${TABLE} (key, uid, response, created_at)
-                     VALUES ($1, $2, NULL, NOW())
+				if ((await exec(`INSERT INTO ${TABLE} (key, uid, fingerprint, response, created_at)
+                     VALUES ($1, $2, $3, NULL, NOW())
                      ON CONFLICT (uid, key) DO UPDATE
-                       SET response = NULL, created_at = NOW()
-                       WHERE ${TABLE}.created_at < NOW() - INTERVAL '${TTL_HOURS} hours'
-                     RETURNING 1 AS claimed`, [key, principal(uid)])).length > 0) return { status: "claimed" };
-				const row = (await exec(`SELECT response, response IS NULL AS pending FROM ${TABLE}
-                     WHERE uid = $1 AND key = $2`, [principal(uid), key]))[0];
+                       SET response = NULL, created_at = NOW(), fingerprint = EXCLUDED.fingerprint
+                       WHERE (${TABLE}.response IS NULL
+                              AND ${TABLE}.created_at < NOW() - INTERVAL '${PENDING_LEASE_SECONDS} seconds')
+                          OR (${TABLE}.response IS NOT NULL
+                              AND ${TABLE}.created_at < NOW() - INTERVAL '${TTL_HOURS} hours')
+                     RETURNING 1 AS claimed`, [
+					key,
+					owner,
+					fingerprint
+				])).length > 0) return { status: "claimed" };
+				const row = (await exec(`SELECT response, response IS NULL AS pending, fingerprint FROM ${TABLE}
+                     WHERE uid = $1 AND key = $2`, [owner, key]))[0];
 				if (!row) return { status: "claimed" };
+				if (row.fingerprint != null && row.fingerprint !== fingerprint) return { status: "mismatch" };
 				if (row.pending) return { status: "in-flight" };
 				return {
 					status: "replay",
@@ -1255,10 +1271,11 @@ function createIdempotencyStore(driver) {
 			}
 		},
 		async complete(key, uid, response) {
-			if (!key || !await ensure()) return;
+			const owner = principal(uid);
+			if (!key || !owner || !await ensure()) return;
 			try {
 				await exec(`UPDATE ${TABLE} SET response = $3::jsonb WHERE uid = $1 AND key = $2`, [
-					principal(uid),
+					owner,
 					key,
 					JSON.stringify(response ?? null)
 				]);
@@ -1266,9 +1283,10 @@ function createIdempotencyStore(driver) {
 			} catch {}
 		},
 		async release(key, uid) {
-			if (!key || !await ensure()) return;
+			const owner = principal(uid);
+			if (!key || !owner || !await ensure()) return;
 			try {
-				await exec(`DELETE FROM ${TABLE} WHERE uid = $1 AND key = $2 AND response IS NULL`, [principal(uid), key]);
+				await exec(`DELETE FROM ${TABLE} WHERE uid = $1 AND key = $2 AND response IS NULL`, [owner, key]);
 			} catch {}
 		}
 	};
@@ -1293,6 +1311,18 @@ async function parseJsonBody(c) {
 	}
 }
 /**
+* A live key presented on a different request than the one it was claimed for.
+*
+* Refused rather than replayed, because the replay is the dangerous answer: a
+* delete sent under the key of an earlier create used to be handed the create's
+* `200` and its rows, so the caller saw a success for rows that are still
+* there. A `422` names the mistake instead — the key is well-formed, the
+* request is not repeatable under it.
+*/
+function idempotencyKeyReused(key) {
+	return new ApiError(422, "IDEMPOTENCY_KEY_REUSED", `Idempotency-Key '${key}' was already used for a different request. A key names one write: use a new key for each distinct request, and re-send the identical request to replay its answer.`);
+}
+/**
 * Lightweight REST API generator that leverages existing Rebase DataDriver.
 * Supports `include` query parameter for eager-loading relations via Drizzle.
 */
@@ -1341,17 +1371,52 @@ var RestApiGenerator = class {
 			this.createCollectionRoutes(collection);
 		});
 		this.createSubcollectionRoutes();
+		this.createUnmatchedRoute();
 		return this.router;
 	}
 	/**
+	* Answer anything left under `/api/data` in the canonical error envelope.
+	*
+	* Without this, `GET /api/data/nonexistent` fell through to Hono's default
+	* handler and came back as the plain text `404 Not Found` — the one error
+	* on the data API that is not `{"error":{"message","code","requestId"}}`.
+	* A client that does `res.json()` on the error path got a parse failure
+	* where every other 4xx hands it a code, so a mistyped collection name
+	* surfaced as "invalid JSON" rather than "no such collection".
+	*
+	* Registered after every real route, so a request reaches it only when the
+	* slug is unknown *or* the method/sub-path is: those are different
+	* mistakes, and the message says which. The collection list is deliberately
+	* not enumerated — an unauthenticated request to this same URL is answered
+	* 401 before routing, on purpose, and echoing the full set of slugs back
+	* would undo that for any signed-in caller.
+	*
+	* Every answer here is `expected`, so it logs at debug (see
+	* {@link ApiError.expected}). This path used to log *nothing at all* —
+	* Hono's default 404 never reaches `errorHandler` — so routing it through
+	* the handler at warn would have traded a missing error envelope for a
+	* `⚠️` line on every request from any frontend holding a stale slug. The
+	* envelope is the fix; the log volume is not part of it.
+	*/
+	createUnmatchedRoute() {
+		const known = new Set(this.collections.map((collection) => collection.slug));
+		const notFound = (message) => new ApiError(404, "NOT_FOUND", message, void 0, true);
+		this.router.all("/:slug{.*}", (c) => {
+			const slug = (c.req.param("slug") ?? "").split("/")[0];
+			if (!slug) throw notFound("No collection in the request path. Expected /api/data/<collection>.");
+			if (known.has(slug)) throw notFound(`No ${c.req.method} route on collection '${slug}' at this path.`);
+			throw notFound(`Unknown collection '${slug}'. It is not defined in this backend, or its route is not exposed.`);
+		});
+	}
+	/**
 	* Check API key permissions for a collection operation.
 	* Throws 403 if the key doesn't have the required permission.
 	* No-ops if the request is not authenticated via an API key.
 	*/
-	enforceApiKeyPermission(c, collectionSlug) {
+	enforceApiKeyPermission(c, collectionSlug, operationOverride) {
 		const apiKey = c.get("apiKey");
 		if (!apiKey) return;
-		const operation = httpMethodToOperation(c.req.method);
+		const operation = operationOverride ?? httpMethodToOperation(c.req.method);
 		if (!isOperationAllowed(apiKey.permissions, collectionSlug, operation)) throw ApiError.forbidden(`API key does not have "${operation}" permission for collection "${collectionSlug}"`, "API_KEY_FORBIDDEN");
 	}
 	/**
@@ -1372,7 +1437,7 @@ var RestApiGenerator = class {
 	* Needed so a nested write can be checked against a schema at all. Without
 	* it these routes skipped `assertKnownWriteFields` entirely, which is why a
 	* typo `POST /posts` rejected with a 400 while the same typo on
-	* `POST /authors/1/posts` reached the database.
+	* `POST /authors/1/posts` was dropped from the statement and answered 201.
 	*
 	* Returns `undefined` rather than throwing when the path cannot be walked:
 	* the driver raises the authoritative error a moment later, and duplicating
@@ -1466,13 +1531,18 @@ var RestApiGenerator = class {
 		* failure, complete on success — and getting one of those steps wrong
 		* is exactly the bug the key exists to prevent. Written once so the
 		* three cannot drift into three different notions of "already done".
+		*
+		* `body` is what the key is claimed *for*: the same key on a different
+		* request is a caller mistake, and replaying a create's answer to a
+		* delete would report a deletion that never happened.
 		*/
-		const withIdempotency = async (c, run, respond) => {
+		const withIdempotency = async (c, body, run, respond) => {
 			const idempotencyKey = c.req.header(IDEMPOTENCY_HEADER);
 			const uid = c.get("user")?.uid;
 			const store = this.idempotency();
-			const claimed = idempotencyKey && store ? await store.claim(idempotencyKey, uid) : void 0;
+			const claimed = idempotencyKey && store ? await store.claim(idempotencyKey, uid, requestFingerprint(c.req.method, c.req.path, body)) : void 0;
 			if (claimed?.status === "replay") return respond(claimed.response);
+			if (claimed?.status === "mismatch") throw idempotencyKeyReused(idempotencyKey);
 			if (claimed?.status === "in-flight") throw ApiError.conflict(`A request with Idempotency-Key '${idempotencyKey}' is already in progress. Retry once it has answered; its result will be replayed.`, "IDEMPOTENCY_KEY_IN_PROGRESS");
 			let response;
 			try {
@@ -1511,8 +1581,11 @@ var RestApiGenerator = class {
 			});
 			if (body.upsert !== void 0 && typeof body.upsert !== "boolean") throw ApiError.badRequest("`upsert` must be a boolean.", "INVALID_BULK_BODY");
 			if (!driver.saveMany) throw ApiError.badRequest("This collection's data source does not support bulk writes.", "BULK_UNSUPPORTED");
-			rows.forEach((row, rowIndex) => assertKnownWriteFields(row, resolvedCollection, { rowIndex }));
-			return withIdempotency(c, async () => {
+			rows.forEach((row, rowIndex) => {
+				assertKnownWriteFields(row, resolvedCollection, { rowIndex });
+				assertWriteValuesValid(row, resolvedCollection, { rowIndex });
+			});
+			return withIdempotency(c, body, async () => {
 				const written = await driver.saveMany({
 					path,
 					rows,
@@ -1541,8 +1614,9 @@ var RestApiGenerator = class {
 				if (entry.id === void 0 || entry.id === null || entry.id === "") throw ApiError.badRequest(`Entry ${rowIndex} of \`updates\` is missing \`id\`. Each entry must be { id, data }.`, "INVALID_BULK_BODY");
 				if (typeof entry.data !== "object" || entry.data === null || Array.isArray(entry.data)) throw ApiError.badRequest(`Entry ${rowIndex} of \`updates\` is missing \`data\`, or it is not an object.`, "INVALID_BULK_BODY");
 				assertKnownWriteFields(entry.data, resolvedCollection, { rowIndex });
+				assertWriteValuesValid(entry.data, resolvedCollection, { rowIndex });
 			});
-			return withIdempotency(c, async () => {
+			return withIdempotency(c, body, async () => {
 				const written = await driver.updateMany({
 					path,
 					updates: updates.map((entry) => ({
@@ -1558,7 +1632,7 @@ var RestApiGenerator = class {
 			}, (result) => c.json(result));
 		});
 		this.router.post(`${basePath}/bulk/delete`, async (c) => {
-			this.enforceApiKeyPermission(c, collection.slug);
+			this.enforceApiKeyPermission(c, collection.slug, "delete");
 			const driver = this.getScopedDriver(c);
 			const path = collection.slug;
 			const body = await parseJsonBody(c);
@@ -1567,7 +1641,7 @@ var RestApiGenerator = class {
 			if (ids.length === 0) return c.json({ meta: { deleted: 0 } });
 			if (ids.some((id) => typeof id !== "string" && typeof id !== "number")) throw ApiError.badRequest("Every entry in `ids` must be a string or a number.", "INVALID_BULK_BODY");
 			if (!driver.deleteMany) throw ApiError.badRequest("This collection's data source does not support bulk deletes.", "BULK_UNSUPPORTED");
-			return withIdempotency(c, async () => {
+			return withIdempotency(c, body, async () => {
 				await driver.deleteMany({
 					path,
 					ids,
@@ -1584,10 +1658,15 @@ var RestApiGenerator = class {
 			const isAuth = collection.auth;
 			const isAuthCollection = isAuth === true || isAuth && typeof isAuth === "object" && isAuth.enabled === true;
 			const collectionAuthConfig = typeof isAuth === "object" ? isAuth : void 0;
-			if (!isAuthCollection) assertKnownWriteFields(body, resolvedCollection);
-			else {
+			if (!isAuthCollection) {
+				assertKnownWriteFields(body, resolvedCollection);
+				assertWriteValuesValid(body, resolvedCollection);
+			} else {
 				const contract = this.authAdapter?.describeUserCreationContract?.(collectionAuthConfig);
-				if (contract?.validate) assertKnownWriteFields(body, resolvedCollection, { extraKnownFields: contract.extraFields });
+				if (contract?.validate) {
+					assertKnownWriteFields(body, resolvedCollection, { extraKnownFields: contract.extraFields });
+					assertWriteValuesValid(body, resolvedCollection);
+				}
 			}
 			if (isAuthCollection && this.authAdapter?.prepareUserCreation) {
 				const prepared = await this.authAdapter.prepareUserCreation(body, collectionAuthConfig);
@@ -1615,8 +1694,9 @@ var RestApiGenerator = class {
 			const idempotencyKey = c.req.header(IDEMPOTENCY_HEADER);
 			const uid = c.get("user")?.uid;
 			const store = this.idempotency();
-			const claimed = idempotencyKey && store ? await store.claim(idempotencyKey, uid) : void 0;
+			const claimed = idempotencyKey && store ? await store.claim(idempotencyKey, uid, requestFingerprint(c.req.method, c.req.path, body)) : void 0;
 			if (claimed?.status === "replay") return c.json(claimed.response, 201);
+			if (claimed?.status === "mismatch") throw idempotencyKeyReused(idempotencyKey);
 			if (claimed?.status === "in-flight") throw ApiError.conflict(`A request with Idempotency-Key '${idempotencyKey}' is already in progress. Retry once it has answered; its result will be replayed.`, "IDEMPOTENCY_KEY_IN_PROGRESS");
 			let response;
 			try {
@@ -1645,6 +1725,7 @@ var RestApiGenerator = class {
 			})) throw ApiError.notFound("Entity not found");
 			const body = await parseJsonBody(c);
 			assertKnownWriteFields(body, resolvedCollection);
+			assertWriteValuesValid(body, resolvedCollection);
 			const entity = await driver.save({
 				path: getCollectionDataPath(collection),
 				id: String(id),
@@ -1808,7 +1889,10 @@ var RestApiGenerator = class {
 			this.enforceSubcollectionApiKeyPermission(c, parsed.collectionPath);
 			const body = await parseJsonBody(c);
 			const targetCollection = this.resolveNestedWriteCollection(parsed.collectionPath);
-			if (targetCollection) assertKnownWriteFields(body, targetCollection);
+			if (targetCollection) {
+				assertKnownWriteFields(body, targetCollection);
+				assertWriteValuesValid(body, targetCollection);
+			}
 			const entity = await driver.save({
 				path: parsed.collectionPath,
 				values: body,
@@ -1827,7 +1911,10 @@ var RestApiGenerator = class {
 			this.enforceSubcollectionApiKeyPermission(c, parsed.collectionPath);
 			const body = await parseJsonBody(c);
 			const targetCollection = this.resolveNestedWriteCollection(parsed.collectionPath);
-			if (targetCollection) assertKnownWriteFields(body, targetCollection);
+			if (targetCollection) {
+				assertKnownWriteFields(body, targetCollection);
+				assertWriteValuesValid(body, targetCollection);
+			}
 			const entity = await driver.save({
 				path: parsed.collectionPath,
 				id: parsed.id,
@@ -2047,7 +2134,7 @@ function configureMiddlewares(app, basePath, isProduction, config) {
 	app.use(`${basePath}/*`, requestId());
 	if (config.compression !== false) {
 		app.use(`${basePath}/*`, responseCompression());
-		logger.info("Response compression enabled");
+		logger.debug("Response compression enabled");
 	}
 	const maxBodySize = config.maxBodySize ?? 10 * 1024 * 1024;
 	if (maxBodySize > 0) {
@@ -2060,11 +2147,11 @@ function configureMiddlewares(app, basePath, isProduction, config) {
 				} }, 413);
 			}
 		}));
-		logger.info("Request body limit configured", { maxSizeMB: Math.round(maxBodySize / 1024 / 1024) });
+		logger.debug("Request body limit configured", { maxSizeMB: Math.round(maxBodySize / 1024 / 1024) });
 	}
 	if (config.csrf?.origin) {
 		app.use(`${basePath}/*`, csrf({ origin: config.csrf.origin }));
-		logger.info("CSRF protection enabled");
+		logger.debug("CSRF protection enabled");
 	}
 	if (!config.corsHandled && !process.env.CORS_ORIGINS && !process.env.FRONTEND_URL) logger.warn((isProduction ? "[PRODUCTION] " : "") + "No CORS configuration detected (CORS_ORIGINS / FRONTEND_URL not set). If your app does not install its own CORS middleware, the API may accept requests from any origin. Set CORS_ORIGINS to restrict access.");
 	app.use(`${basePath}/*`, requestLogger());
@@ -2118,7 +2205,7 @@ var LocalStorageController = class {
 	}
 	/**
 	* Get the full filesystem path for a storage path, with a traversal guard
-	* that keeps the result inside the bucket directory.
+	* that keeps the result inside the storage root.
 	*
 	* Defaults the bucket the way `putObject` does.
 	*
@@ -2129,10 +2216,22 @@ var LocalStorageController = class {
 	* design), and `listObjects` returned an empty page. So the obvious
 	* `putObject({ key })` → `getObject(key)` did not round-trip and nothing
 	* said why. One default, applied everywhere, removes the whole class.
+	*
+	* Two boundaries, checked separately, because there are two of them. The
+	* key must stay inside its bucket — that check always worked. The bucket
+	* must stay inside the storage root, and that one did not exist: the guard
+	* derived `bucketPath` from the caller's `bucket` and then asked whether
+	* the result was inside `bucketPath`, so `bucket = "../../etc"` made the
+	* reference point `/etc` and `/etc/passwd` is comfortably inside it. A
+	* guard whose reference point moves with its input is not a guard. The
+	* route boundary rejects such a bucket outright
+	* (`canonicalStorageBucket`); this is the layer underneath that does not
+	* depend on it having run.
 	*/
 	getFullPath(storagePath, bucket) {
-		const bucketPath = path$2.join(this.basePath, bucket ?? "default");
-		const resolved = path$2.resolve(path$2.join(bucketPath, storagePath));
+		const bucketPath = path$2.resolve(this.basePath, bucket || "default");
+		if (!bucketPath.startsWith(this.basePath + path$2.sep)) throw new Error("Path traversal detected: bucket resolves outside the storage root.");
+		const resolved = path$2.resolve(bucketPath, storagePath);
 		if (!resolved.startsWith(bucketPath + path$2.sep) && resolved !== bucketPath) throw new Error("Path traversal detected: resolved storage path is outside the bucket directory.");
 		return resolved;
 	}
@@ -2148,7 +2247,7 @@ var LocalStorageController = class {
 	}
 	async putObject({ file, key, metadata, bucket }) {
 		this.validateFile(file);
-		const usedBucket = bucket ?? "default";
+		const usedBucket = bucket || "default";
 		const fullStoragePath = key;
 		const fullPath = this.getFullPath(fullStoragePath, usedBucket);
 		await this.ensureDir(path$2.dirname(fullPath));
@@ -2378,38 +2477,63 @@ var VALID_FITS = /* @__PURE__ */ new Set([
 	"outside"
 ]);
 /**
+* A transform request naming parameters outside the declared bounds.
+*
+* Surfaced as a 400 by the route. Out-of-range values used to be *clamped*:
+* `width=99999` silently became 4096 and `format=tiff` silently became webp,
+* so the caller debugged a wrongly-sized `<img>` in the browser instead of
+* reading an error. A bound that rewrites its input is invisible, and this
+* endpoint's bounds are load-bearing — see {@link runTransform}.
+*/
+var InvalidTransformOptionsError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "InvalidTransformOptionsError";
+	}
+};
+/**
+* Parse a bounded integer parameter, or throw.
+*
+* Strict digits only: `parseInt` accepted `300px` and `12abc`, which is a
+* second way for a caller to get a transform they did not describe.
+*/
+function boundedInt(name, raw, min, max) {
+	if (!/^\d+$/.test(raw)) throw new InvalidTransformOptionsError(`Invalid '${name}': expected an integer between ${min} and ${max}.`);
+	const value = parseInt(raw, 10);
+	if (value < min || value > max) throw new InvalidTransformOptionsError(`Invalid '${name}': must be between ${min} and ${max}, got ${value}.`);
+	return value;
+}
+/**
 * Parse transform options from URL query parameters.
 * Returns `null` when no transformation is requested.
+*
+* Throws {@link InvalidTransformOptionsError} for anything outside the bounds
+* declared here — these are the whole parameter surface of an endpoint that is
+* reachable anonymously for public objects, so what it accepts has to be a
+* closed, stated set rather than "whatever we could coerce into range".
 */
 function parseTransformOptions(query) {
 	const opts = {};
 	let hasTransform = false;
 	if (query.width) {
-		const w = parseInt(query.width, 10);
-		if (!Number.isNaN(w) && w > 0) {
-			opts.width = Math.min(w, MAX_DIMENSION);
-			hasTransform = true;
-		}
+		opts.width = boundedInt("width", query.width, 1, MAX_DIMENSION);
+		hasTransform = true;
 	}
 	if (query.height) {
-		const h = parseInt(query.height, 10);
-		if (!Number.isNaN(h) && h > 0) {
-			opts.height = Math.min(h, MAX_DIMENSION);
-			hasTransform = true;
-		}
+		opts.height = boundedInt("height", query.height, 1, MAX_DIMENSION);
+		hasTransform = true;
 	}
 	if (query.quality) {
-		const q = parseInt(query.quality, 10);
-		if (!Number.isNaN(q)) {
-			opts.quality = Math.min(Math.max(q, MIN_QUALITY), MAX_QUALITY);
-			hasTransform = true;
-		}
+		opts.quality = boundedInt("quality", query.quality, MIN_QUALITY, MAX_QUALITY);
+		hasTransform = true;
 	}
-	if (query.format && VALID_FORMATS.has(query.format)) {
+	if (query.format) {
+		if (!VALID_FORMATS.has(query.format)) throw new InvalidTransformOptionsError(`Invalid 'format': expected one of ${[...VALID_FORMATS].join(", ")}.`);
 		opts.format = query.format;
 		hasTransform = true;
 	}
-	if (query.fit && VALID_FITS.has(query.fit)) {
+	if (query.fit) {
+		if (!VALID_FITS.has(query.fit)) throw new InvalidTransformOptionsError(`Invalid 'fit': expected one of ${[...VALID_FITS].join(", ")}.`);
 		opts.fit = query.fit;
 		hasTransform = true;
 	}
@@ -2427,9 +2551,72 @@ function isTransformableImage(contentType) {
 	return contentType.startsWith("image/") && !contentType.includes("svg") && !contentType.includes("gif");
 }
 /**
+* A transform refused because the server is already doing as many as it will.
+*
+* Surfaced as a 503 by the route.
+*/
+var TransformOverloadedError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "TransformOverloadedError";
+	}
+};
+/**
+* A bounded work queue.
+*
+* A transform is seconds of libvips CPU and a full-resolution bitmap in RSS,
+* and `GET /file/*?width=…` is reachable anonymously for public objects — so
+* without a bound, a few hundred bytes per request buys unlimited pod CPU, and
+* enough of them at once buys the heap too. `maxConcurrent` caps the CPU and
+* memory in flight; `maxQueued` is what keeps an unbounded backlog from
+* becoming the same problem one level up, refusing fast (503) instead of
+* accepting work the process will not get to.
+*/
+var TransformQueue = class {
+	maxConcurrent;
+	maxQueued;
+	active = 0;
+	waiting = [];
+	constructor(maxConcurrent, maxQueued) {
+		this.maxConcurrent = maxConcurrent;
+		this.maxQueued = maxQueued;
+	}
+	/** Number of tasks running plus waiting. Exposed for tests and metrics. */
+	get depth() {
+		return this.active + this.waiting.length;
+	}
+	async run(work) {
+		if (this.active >= this.maxConcurrent) {
+			if (this.waiting.length >= this.maxQueued) throw new TransformOverloadedError("Image transformation is at capacity. Retry shortly.");
+			await new Promise((resolve) => this.waiting.push(resolve));
+		}
+		this.active++;
+		try {
+			return await work();
+		} finally {
+			this.active--;
+			this.waiting.shift()?.();
+		}
+	}
+};
+/**
+* The queue every transform goes through.
+*
+* Small on purpose: transforms are CPU-bound, so more concurrency than cores
+* buys nothing but resident bitmaps.
+*/
+var transformQueue = new TransformQueue(Math.max(1, Math.min(4, os.availableParallelism?.() ?? os.cpus().length)), 64);
+/**
 * Apply image transformations and return the result buffer + content type.
+*
+* Runs on {@link transformQueue}: the work is bounded, and callers past the
+* bound get {@link TransformOverloadedError} rather than a share of a
+* saturated CPU.
 */
 async function transformImage(buffer, options) {
+	return transformQueue.run(() => runTransform(buffer, options));
+}
+async function runTransform(buffer, options) {
 	let pipeline = (await getSharp())(buffer);
 	if (options.width || options.height) pipeline = pipeline.resize({
 		width: options.width,
@@ -2556,6 +2743,7 @@ var TusHandler = class {
 		this.cleanupTimer = setInterval(() => {
 			this.cleanupStale();
 		}, 6e4);
+		this.cleanupTimer.unref?.();
 	}
 	/** Remove uploads that have been idle for longer than UPLOAD_EXPIRY_MS. */
 	async cleanupStale() {
@@ -2615,7 +2803,14 @@ var TusHandler = class {
 		} catch (err) {
 			throw new ApiError(400, "INVALID_STORAGE_KEY", err instanceof InvalidStorageKeyError ? err.message : "Invalid storage key");
 		}
-		if (this.authorizeUpload) await this.authorizeUpload(c, key, metadata.bucket || "default");
+		let bucket;
+		try {
+			bucket = canonicalStorageBucket(metadata.bucket);
+		} catch (err) {
+			throw new ApiError(400, "INVALID_STORAGE_BUCKET", err instanceof InvalidStorageBucketError ? err.message : "Invalid storage bucket");
+		}
+		const storageId = metadata.storageId || c.req.query("storageId") || void 0;
+		if (this.authorizeUpload) await this.authorizeUpload(c, key, bucket || "default", storageId);
 		const filePath = join(this.tusDir, id);
 		await writeFile(filePath, Buffer.alloc(0));
 		const upload = {
@@ -2625,7 +2820,8 @@ var TusHandler = class {
 			metadata,
 			createdAt: Date.now(),
 			filePath,
-			bucket: metadata.bucket || void 0,
+			bucket,
+			storageId,
 			key,
 			completed: false
 		};
@@ -2697,16 +2893,32 @@ var TusHandler = class {
 		});
 	}
 	/**
-	* Move a completed upload into the storage controller.
+	* Move a fully-received upload into the storage controller.
+	*
+	* Everything here used to be best-effort: no controller warned and
+	* returned, a failing `putObject` was caught and logged, and either way the
+	* `PATCH` that carried the last chunk answered `204` with
+	* `Upload-Offset: <size>` — which in TUS is the server saying "I have your
+	* file". The object did not exist. For the one operation a user can spend
+	* minutes on, the failure mode was silent data loss with a success code.
+	*
+	* `completed` is now set only once the bytes are stored, and that matters
+	* twice over: a "completed" upload is refused a retry (`patch` answers
+	* "Upload already completed") and is skipped by the stale sweeper, so
+	* marking it up front both locked the client out of retrying and leaked the
+	* temp file forever. Left false, a client that retries sends an empty chunk
+	* at `offset === size`, which lands straight back here.
 	*/
 	async finalize(upload) {
-		upload.completed = true;
-		const storageId = upload.metadata.storageId;
+		const storageId = upload.storageId;
 		let targetController = this.storageController;
 		if (this.storageRegistry) targetController = storageId ? this.storageRegistry.getOrDefault(storageId) : this.storageRegistry.getDefault();
 		if (!targetController) {
-			logger.warn("[TUS] Upload completed but no StorageController configured. Temp file remains:", { filePath: upload.filePath });
-			return;
+			logger.error("[TUS] Upload received but no StorageController is configured — nothing can be written", {
+				uploadId: upload.id,
+				storageId
+			});
+			throw new ApiError(503, "STORAGE_NOT_CONFIGURED", storageId ? `Storage source "${storageId}" is not configured on this server, so the upload cannot be stored.` : "No storage is configured on this server, so the upload cannot be stored.");
 		}
 		try {
 			const { readFile } = await import("fs/promises");
@@ -2719,6 +2931,7 @@ var TusHandler = class {
 				key: fileName,
 				bucket: upload.bucket
 			});
+			upload.completed = true;
 			try {
 				await unlink(upload.filePath);
 			} catch {}
@@ -2726,6 +2939,8 @@ var TusHandler = class {
 			logger.info(`[TUS] Upload ${upload.id} finalized → ${fileName}`, storageId ? { storageId } : {});
 		} catch (err) {
 			logger.error(`[TUS] Failed to finalize upload ${upload.id}`, { error: err });
+			if (err instanceof ApiError) throw err;
+			throw new ApiError(502, "STORAGE_WRITE_FAILED", `Upload ${upload.id} was received but could not be stored: ` + (err instanceof Error ? err.message : String(err)));
 		}
 	}
 };
@@ -2742,6 +2957,82 @@ var TusHandler = class {
 /** Shared image transform cache (LRU, 500 entries, 1 hour TTL). */
 var transformCache = new TransformCache();
 /**
+* Transforms currently being computed, keyed the same way the cache is.
+*
+* Without it, N concurrent requests for one uncached variant run N full
+* decode+encode pipelines — the cache only helps the requests that arrive
+* after the first one has finished. Joining the in-flight promise makes a
+* thundering herd cost one decode.
+*/
+var transformsInFlight = /* @__PURE__ */ new Map();
+/**
+* Compute a transform, or join the one already running for this key.
+*
+* `loadSource` is only called on a real miss, so the concurrent requests that
+* join an in-flight transform do not each read the source object either.
+*/
+async function transformOnce(cacheKey, options, loadSource) {
+	const cached = transformCache.get(cacheKey);
+	if (cached) return cached;
+	const running = transformsInFlight.get(cacheKey);
+	if (running) return running;
+	const pending = (async () => {
+		try {
+			const result = await transformImage(await loadSource(), options);
+			transformCache.set(cacheKey, result.data, result.contentType);
+			return result;
+		} catch (err) {
+			if (err instanceof TransformOverloadedError) throw ApiError.serviceUnavailable(err.message, "TRANSFORM_OVERLOADED");
+			throw err;
+		}
+	})();
+	transformsInFlight.set(cacheKey, pending);
+	try {
+		return await pending;
+	} finally {
+		transformsInFlight.delete(cacheKey);
+	}
+}
+/**
+* Content types served inline. Everything else is handed back as
+* `application/octet-stream` with `Content-Disposition: attachment`.
+*
+* The stored content type is the *uploader's claim* — `putObject` writes
+* `file.type` from the multipart part, and TUS takes it from a request header;
+* nothing sniffs the bytes. Echoing that claim back as the response type turns
+* `/api/storage/file/*` into an HTML hosting endpoint on the API origin, and
+* where `cookieAuth` is enabled the refresh cookie is `Path=/` on exactly that
+* origin — so an uploaded page can fetch `/api/auth/refresh` same-origin and
+* read out a fresh access token, `HttpOnly` notwithstanding.
+*
+* `image/svg+xml` is deliberately absent: an SVG is a document that can carry
+* script. `text/html` and `application/xhtml+xml` are absent for the same
+* reason, and are what the attack actually uses.
+*/
+var INLINE_CONTENT_TYPE_PREFIXES = [
+	"image/",
+	"video/",
+	"audio/"
+];
+var INLINE_CONTENT_TYPES = /* @__PURE__ */ new Set(["application/pdf", "text/plain"]);
+/**
+* Decide what to actually serve for a stored content type.
+*
+* Returns the type to send and whether to force a download. The check is an
+* allowlist rather than a blocklist of dangerous types: the set of types a
+* browser will execute grows, and the set we want to render inline does not.
+*/
+function resolveServedContentType(storedContentType) {
+	const base = storedContentType.split(";")[0].trim().toLowerCase();
+	return (base.includes("svg") ? false : INLINE_CONTENT_TYPES.has(base) || INLINE_CONTENT_TYPE_PREFIXES.some((p) => base.startsWith(p))) ? {
+		contentType: storedContentType,
+		attachment: false
+	} : {
+		contentType: "application/octet-stream",
+		attachment: true
+	};
+}
+/**
 * Extract the wildcard portion of a route path from the full request path.
 *
 * Hono's `c.req.param('*')` does not work reliably in sub-routers mounted
@@ -2778,6 +3069,33 @@ function canonicalKeyOrBadRequest(key) {
 	}
 }
 /**
+* Canonicalize a caller-supplied bucket name, answering 400 when it is not one.
+*
+* The bucket's counterpart to {@link canonicalKeyOrBadRequest}, and it exists
+* for the same reason: the value routes a write, so it has to be checked where
+* it enters rather than where it is used. Applied at every entry point a bucket
+* has — this route's multipart body, the `?bucket=` query, and the TUS
+* `Upload-Metadata` header.
+*/
+function canonicalBucketOrBadRequest(bucket) {
+	try {
+		return canonicalStorageBucket(bucket);
+	} catch (err) {
+		throw new ApiError(400, "INVALID_STORAGE_BUCKET", err instanceof InvalidStorageBucketError ? err.message : "Invalid storage bucket");
+	}
+}
+/**
+* Parse image transform query parameters, answering 400 when they are out of
+* bounds rather than clamping them to something the caller did not ask for.
+*/
+function transformOptionsOrBadRequest(query) {
+	try {
+		return parseTransformOptions(query);
+	} catch (err) {
+		throw new ApiError(400, "INVALID_TRANSFORM_OPTIONS", err instanceof InvalidTransformOptionsError ? err.message : "Invalid image transform options");
+	}
+}
+/**
 * Build adapter-aware auth middleware for storage routes.
 *
 * When an `AuthAdapter` is provided, token verification is delegated to the
@@ -2886,8 +3204,9 @@ function createStorageRoutes(config) {
 	*
 	* A key that cannot be canonicalized (a real `..` segment, a null byte) is
 	* a 400, not a repaired key. The `LocalStorageController` traversal guard
-	* (`getFullPath`) is still the load-bearing defence for the *bucket*
-	* boundary; this is what defends the boundary the hook drew inside it.
+	* (`getFullPath`) is the load-bearing defence for the *storage root*, and
+	* `canonicalStorageBucket` for the bucket the caller names; this is what
+	* defends the boundary the hook drew inside them.
 	*/
 	const parseBucketAndPath = (filePath) => {
 		const parts = filePath.split("/");
@@ -2910,7 +3229,7 @@ function createStorageRoutes(config) {
 		const uploadedFile = body["file"];
 		if (!uploadedFile || typeof uploadedFile === "string") throw ApiError.badRequest("No file provided");
 		const key = typeof body["key"] === "string" ? body["key"] : "";
-		const bucket = typeof body["bucket"] === "string" ? body["bucket"] : void 0;
+		const bucket = canonicalBucketOrBadRequest(typeof body["bucket"] === "string" ? body["bucket"] : void 0);
 		const storageId = typeof body["storageId"] === "string" ? body["storageId"] : c.req.query("storageId");
 		const finalKey = canonicalKeyOrBadRequest(key || uploadedFile.name || "unnamed");
 		const metadata = {};
@@ -2938,15 +3257,13 @@ function createStorageRoutes(config) {
 		const filePath = decodeURIComponent(rawPath);
 		const storageId = c.req.query("storageId");
 		const resolved = resolveController(storageId);
-		{
-			const { bucket, resolvedPath } = parseBucketAndPath(filePath);
-			await checkAuthorized(c, "read", resolvedPath, bucket, storageId);
-		}
-		const transformOpts = parseTransformOptions(c.req.query());
+		const { bucket, resolvedPath } = parseBucketAndPath(filePath);
+		await checkAuthorized(c, "read", resolvedPath, bucket, storageId);
+		c.header("X-Content-Type-Options", "nosniff");
+		const transformKeyPrefix = `${storageId || "(default)"}/${bucket}/${resolvedPath}`;
+		const transformOpts = transformOptionsOrBadRequest(c.req.query());
 		if (resolved.getType() === "local") {
-			const localController = resolved;
-			const { bucket, resolvedPath } = parseBucketAndPath(filePath);
-			const absolutePath = localController.getAbsolutePath(resolvedPath, bucket);
+			const absolutePath = resolved.getAbsolutePath(resolvedPath, bucket);
 			try {
 				await fsp.access(absolutePath);
 			} catch {
@@ -2958,37 +3275,30 @@ function createStorageRoutes(config) {
 				const metadataRaw = await fsp.readFile(metadataPath, "utf-8");
 				contentType = JSON.parse(metadataRaw).contentType || contentType;
 			} catch {}
-			const fileContent = await fsp.readFile(absolutePath);
 			if (transformOpts && isTransformableImage(contentType)) {
-				const cacheKey = transformCache.buildKey(filePath, transformOpts);
-				let cached = transformCache.get(cacheKey);
-				if (!cached) {
-					cached = await transformImage(Buffer.from(fileContent), transformOpts);
-					transformCache.set(cacheKey, cached.data, cached.contentType);
-				}
-				c.header("Content-Type", cached.contentType);
+				const transformed = await transformOnce(transformCache.buildKey(transformKeyPrefix, transformOpts), transformOpts, async () => Buffer.from(await fsp.readFile(absolutePath)));
+				c.header("Content-Type", transformed.contentType);
 				c.header("Cache-Control", "public, max-age=31536000, immutable");
-				return c.body(new Uint8Array(cached.data));
+				return c.body(new Uint8Array(transformed.data));
 			}
-			c.header("Content-Type", contentType);
+			const fileContent = await fsp.readFile(absolutePath);
+			const served = resolveServedContentType(contentType);
+			c.header("Content-Type", served.contentType);
+			if (served.attachment) c.header("Content-Disposition", "attachment");
 			return c.body(new Uint8Array(fileContent));
 		}
-		const { bucket: parsedBucket, resolvedPath: parsedPath } = parseBucketAndPath(filePath);
-		const fileObject = await resolved.getObject(parsedPath, parsedBucket);
+		const fileObject = await resolved.getObject(resolvedPath, bucket);
 		if (!fileObject) throw ApiError.notFound("File not found");
 		const remoteContentType = fileObject.type || "application/octet-stream";
 		if (transformOpts && isTransformableImage(remoteContentType)) {
-			const cacheKey = transformCache.buildKey(filePath, transformOpts);
-			let cached = transformCache.get(cacheKey);
-			if (!cached) {
-				cached = await transformImage(Buffer.from(await fileObject.arrayBuffer()), transformOpts);
-				transformCache.set(cacheKey, cached.data, cached.contentType);
-			}
-			c.header("Content-Type", cached.contentType);
+			const transformed = await transformOnce(transformCache.buildKey(transformKeyPrefix, transformOpts), transformOpts, async () => Buffer.from(await fileObject.arrayBuffer()));
+			c.header("Content-Type", transformed.contentType);
 			c.header("Cache-Control", "public, max-age=31536000, immutable");
-			return c.body(new Uint8Array(cached.data));
+			return c.body(new Uint8Array(transformed.data));
 		}
-		c.header("Content-Type", remoteContentType);
+		const servedRemote = resolveServedContentType(remoteContentType);
+		c.header("Content-Type", servedRemote.contentType);
+		if (servedRemote.attachment) c.header("Content-Disposition", "attachment");
 		c.header("Cache-Control", "public, max-age=3600, immutable");
 		const buf = await fileObject.arrayBuffer();
 		return c.body(new Uint8Array(buf));
@@ -3048,7 +3358,7 @@ function createStorageRoutes(config) {
 	*/
 	router.get("/list", writeAuthMiddleware, async (c) => {
 		const storagePrefix = canonicalKeyOrBadRequest(c.req.query("prefix") || c.req.query("path") || "");
-		const bucket = c.req.query("bucket");
+		const bucket = canonicalBucketOrBadRequest(c.req.query("bucket"));
 		const maxResults = c.req.query("maxResults");
 		const pageToken = c.req.query("pageToken");
 		const storageId = c.req.query("storageId");
@@ -3094,8 +3404,8 @@ function createStorageRoutes(config) {
 		}, 201);
 	});
 	const defaultCtrl = getDefaultController();
-	const tusHandler = new TusHandler(defaultCtrl.getType() === "local" ? defaultCtrl.getBasePath() : process.env.STORAGE_PATH || "./uploads", defaultCtrl, registry, authorize ? async (c, key, bucket) => {
-		await checkAuthorized(c, "write", key, bucket, c.req.query("storageId"));
+	const tusHandler = new TusHandler(defaultCtrl.getType() === "local" ? defaultCtrl.getBasePath() : process.env.STORAGE_PATH || "./uploads", defaultCtrl, registry, authorize ? async (c, key, bucket, storageId) => {
+		await checkAuthorized(c, "write", key, bucket, storageId);
 	} : void 0);
 	tusHandler.startCleanup();
 	router.options("/tus", (_c) => tusHandler.options());
@@ -3232,7 +3542,7 @@ async function createStorageController(config) {
 //#region src/init/storage.ts
 async function initializeStorage(storageConfig, isProduction) {
 	if (!storageConfig) return {};
-	logger.info("Configuring storage");
+	logger.debug("Configuring storage");
 	const controllers = {};
 	const toController = async (entry, label) => {
 		if (typeof entry.putObject === "function") return entry;
@@ -3289,11 +3599,20 @@ function assertStorageAccessControlConfigured(state, isProduction) {
 }
 //#endregion
 //#region src/init/docs.ts
-async function mountOpenApiDocs(app, basePath, enableSwagger, activeCollections, requireAuth) {
-	if (enableSwagger === false || activeCollections.length === 0) return;
-	const { generateOpenApiSpec } = await import("./openapi-generator-VB0MUH8h.js");
+/**
+* Serve the OpenAPI document, and Swagger UI outside production.
+*
+* `serverCollections` must be the collections the REST routes were generated
+* from — the ones whose data source has a `"server"` transport — not every
+* active collection. A direct-transport collection is served by the client
+* against its own backend; documenting it here publishes a full set of CRUD
+* paths that 404, with a Try-It button next to each.
+*/
+async function mountOpenApiDocs(app, basePath, enableSwagger, serverCollections, requireAuth) {
+	if (enableSwagger === false || serverCollections.length === 0) return;
+	const { generateOpenApiSpec } = await import("./openapi-generator-DPKtUC9X.js");
 	app.get(`${basePath}/docs`, (c) => {
-		const spec = generateOpenApiSpec(activeCollections, {
+		const spec = generateOpenApiSpec(serverCollections, {
 			basePath,
 			requireAuth
 		});
@@ -3468,6 +3787,54 @@ function createShutdown(config) {
 	};
 }
 //#endregion
+//#region src/init/process-safety.ts
+/**
+* Installed once per process. The singleton is process-global for the same
+* reason (see `singleton.ts`): more than one copy of this module can be loaded
+* — the image ships one at `/app/node_modules` and a project's bundle installs
+* another — and each copy would otherwise add its own listener.
+*/
+var HANDLER_SLOT = Symbol.for("@rebasepro/server:unhandled-rejection-handler");
+/**
+* Log unhandled promise rejections instead of letting Node terminate the
+* process.
+*
+* Node has terminated on an unhandled rejection since v15. Hono catches
+* anything thrown or rejected inside an awaited handler, so the ordinary
+* request path is covered — but a fire-and-forget `void syncToCrm(body)`, a
+* `setTimeout(async () => …)`, or an unawaited `.then()` in one custom function
+* rejects outside Hono's frame. The default outcome is that one project's
+* floating promise ends the process; on the managed runtime that process is
+* shared, so every other tenant on the pod goes with it, and the request log
+* points nowhere because the request itself succeeded.
+*
+* A logged rejection is the better trade here: the process keeps serving, and
+* the stack reaches the operator. `uncaughtException` is deliberately **not**
+* handled — a synchronous throw that escaped every frame leaves the process in
+* a state we cannot reason about, and swallowing it would be a worse bargain
+* than a restart.
+*
+* Set `REBASE_EXIT_ON_UNHANDLED_REJECTION=1` to restore Node's default.
+*
+* @returns An uninstall function (used by tests), or `undefined` when nothing
+* was installed.
+*/
+function installUnhandledRejectionHandler() {
+	if (process.env.REBASE_EXIT_ON_UNHANDLED_REJECTION === "1") return void 0;
+	const slot = globalThis;
+	if (slot[HANDLER_SLOT]) return void 0;
+	const handler = (reason) => {
+		const error = reason instanceof Error ? reason : new Error(String(reason));
+		logger.error("Unhandled promise rejection — the process kept running. This is almost always a fire-and-forget call in application code (a custom function, a cron job, a callback). Await it, or attach a .catch().", { error });
+	};
+	slot[HANDLER_SLOT] = handler;
+	process.on("unhandledRejection", handler);
+	return () => {
+		process.removeListener("unhandledRejection", handler);
+		delete slot[HANDLER_SLOT];
+	};
+}
+//#endregion
 //#region src/auth/collection-callback-warning.ts
 /** The data callbacks the auth write path does not run. */
 var DATA_CALLBACKS = [
@@ -3674,6 +4041,23 @@ function createTransport(config, environment) {
 			...init?.headers || {}
 		};
 	}
+	/**
+	* The refusal for a success status carrying a body this client cannot read.
+	*
+	* The first 120 characters go in the message because they identify the
+	* sender at a glance: `<!doctype html>` says "you are talking to a web
+	* server, not to this API" faster than any wording here could.
+	*
+	* One function for both the first attempt and the post-refresh retry — the
+	* retry is a second copy of this whole response-reading path, and copies
+	* are how one of them ends up fixed and the other not.
+	*/
+	function unreadableResponse(status, text) {
+		return new RebaseApiError(`The server answered ${status} with a body that is not JSON, so there is nothing to return. This usually means the request reached something other than the Rebase API — a single-page-app fallback serving index.html, or a proxy error page — so check the API URL configuration (e.g. VITE_API_URL). The body began: ${JSON.stringify(text.slice(0, 120))}`, {
+			status,
+			code: "INVALID_JSON_RESPONSE"
+		});
+	}
 	async function request(path, init) {
 		const url = resolveBaseUrl(config.baseUrl) + apiPath + path;
 		let activeToken = token;
@@ -3691,9 +4075,27 @@ function createTransport(config, environment) {
 		if (res.status === 204) return void 0;
 		const text = await res.text().catch(() => "");
 		let body = {};
+		/**
+		* Whether the body was there and could not be read as JSON.
+		*
+		* On an error status this does not matter — the status is the answer
+		* and the message falls back to `statusText`. On a *success* status it
+		* is the whole answer, and `{}` was being returned as though the server
+		* had sent it: `find()` answered `{}` instead of an array, `getOne()`
+		* an empty object, with nothing thrown.
+		*
+		* The case that produces it is not exotic. Point `VITE_API_URL` at the
+		* frontend's own host and `/api/data/posts` lands on the SPA fallback,
+		* which answers `200` with `index.html` — so the misconfiguration the
+		* 404 branch below spends four lines explaining reaches the caller, in
+		* its most common form, as an empty success.
+		*/
+		let unreadableBody = false;
 		if (text) try {
 			body = JSON.parse(text, rebaseReviver);
-		} catch (e) {}
+		} catch (e) {
+			unreadableBody = true;
+		}
 		const getErrorField = (obj, field) => {
 			const err = obj?.error;
 			if (err && typeof err === "object" && err !== null) return err[field];
@@ -3713,9 +4115,12 @@ function createTransport(config, environment) {
 				if (retryRes.status === 204) return void 0;
 				const retryText = await retryRes.text().catch(() => "");
 				let retryBody = {};
+				let retryUnreadable = false;
 				if (retryText) try {
 					retryBody = JSON.parse(retryText, rebaseReviver);
-				} catch (e) {}
+				} catch (e) {
+					retryUnreadable = true;
+				}
 				if (!retryRes.ok) {
 					let fallbackMessage = retryRes.statusText;
 					if (retryRes.status === 404 && !fallbackMessage) fallbackMessage = `Endpoint not found (${init?.method || "GET"} ${path}). This usually means the collection is not registered on the backend, or the frontend API URL configuration (e.g. VITE_API_URL) is missing or pointing to the wrong host.`;
@@ -3725,6 +4130,7 @@ function createTransport(config, environment) {
 						details: getErrorField(retryBody, "details")
 					});
 				}
+				if (retryUnreadable) throw unreadableResponse(retryRes.status, retryText);
 				return retryBody;
 			}
 		}
@@ -3737,6 +4143,7 @@ function createTransport(config, environment) {
 				details: getErrorField(body, "details")
 			});
 		}
+		if (unreadableBody) throw unreadableResponse(res.status, text);
 		return body;
 	}
 	return {
@@ -5287,9 +5694,11 @@ var CHANNEL_MESSAGE_TYPES = /* @__PURE__ */ new Set([
 *
 * @internal Not a stable app-facing API. `createRebaseClient()` constructs and
 * manages this internally (exposed as `client.ws`, typed by the minimal
-* `RebaseWebSocket` contract in `@rebasepro/types`). It is re-exported from the
-* package root only because the `@rebasepro/client-postgres` driver
-* instantiates it directly; its surface may change without a major bump.
+* `RebaseWebSocket` contract in `@rebasepro/types`). It stays exported from the
+* package root for the same reason it always was — a data-source driver may
+* instantiate it directly — but nothing in this repo does since
+* `@rebasepro/client-postgres` was removed; its surface may change without a
+* major bump.
 */
 var RebaseWebSocketClient = class {
 	websocketUrl;
@@ -5799,6 +6208,11 @@ var RebaseWebSocketClient = class {
 					callback.onError(new RebaseApiError(errorMessage, { code: errorCode }));
 				}
 			} else callback.onUpdate(message);
+			return;
+		}
+		if (type === "ERROR" || type === "error" || message.error) {
+			const { errorMessage, errorCode } = extractMessageError(message);
+			console.warn(`[Rebase] Realtime error from the server${errorCode ? ` (${errorCode})` : ""}: ${errorMessage}`);
 		}
 	}
 	async ensureAuthenticated(retryCount = 3) {
@@ -6905,11 +7319,29 @@ var RETRYABLE_STATUSES = /* @__PURE__ */ new Set([
 	503,
 	504
 ]);
+/**
+* The server holds this key for a request it has not answered yet.
+*
+* It is a 409 like a duplicate row is a 409, and nothing but the code separates
+* them — one means "your write is already there", the other means "your write
+* may not have happened at all, ask again".
+*/
+var IDEMPOTENCY_IN_PROGRESS = "IDEMPOTENCY_KEY_IN_PROGRESS";
+/**
+* Is the server still answering an earlier attempt of this same write?
+*
+* The only correct response is to ask again — which is exactly what the
+* server's own message says, and exactly what this SDK used not to do.
+*/
+function isIdempotencyInProgressError(error) {
+	return error instanceof RebaseApiError && error.status === 409 && error.code === IDEMPOTENCY_IN_PROGRESS;
+}
 /** Is this failure worth another attempt later? */
 function isRetryableError(error) {
 	if (isNetworkError(error)) return true;
-	if (error instanceof RebaseApiError) return error.status !== void 0 && RETRYABLE_STATUSES.has(error.status);
-	return false;
+	if (!(error instanceof RebaseApiError)) return false;
+	if (isIdempotencyInProgressError(error)) return true;
+	return error.status !== void 0 && RETRYABLE_STATUSES.has(error.status);
 }
 /**
 * Did this write fail because the row is already there?
@@ -6921,10 +7353,16 @@ function isRetryableError(error) {
 * The queue uses this to recognise its own earlier attempt. A create whose
 * response was lost is replayed, and for a row carrying an id the SDK generated
 * the server can only be rejecting it because the first attempt actually landed.
+*
+* Which is why the status alone cannot decide it: `IDEMPOTENCY_KEY_IN_PROGRESS`
+* is a 409 that means the opposite — the row may not exist at all. Read as a
+* duplicate, the queue looked for a row that was never written, found nothing,
+* concluded there was nothing left to do and deleted the write from the queue.
 */
 function isDuplicateKeyError(error) {
 	if (!(error instanceof RebaseApiError)) return false;
-	return error.code === "23505" || error.status === 409;
+	if (error.code === "23505") return true;
+	return error.status === 409 && !isIdempotencyInProgressError(error);
 }
 var ConnectivityMonitor = class {
 	state = "online";
@@ -7494,6 +7932,25 @@ function resolvePagination(params) {
 		offset
 	};
 }
+/** `<`, `<=`, `>`, `>=` — the operators whose answer depends on a collation. */
+var ORDERING_OPS = /* @__PURE__ */ new Set([
+	"<",
+	"<=",
+	">",
+	">="
+]);
+/** Does any condition in this `where` clause order its operands? */
+function whereOrders(where) {
+	if (!where) return false;
+	for (const condition of Object.values(where)) if ((isTuple(condition) ? [condition] : condition.filter(isTuple)).some(([op]) => ORDERING_OPS.has(op))) return true;
+	return false;
+}
+/** The same question, through an `and(...)`/`or(...)` tree. */
+function logicalOrders(condition, depth = 0) {
+	if (!condition || depth > 32) return false;
+	if ("type" in condition) return (condition.conditions ?? []).some((c) => logicalOrders(c, depth + 1));
+	return ORDERING_OPS.has(condition.operator);
+}
 /**
 * Can a locally evaluated answer to `params` be trusted to match the server's,
 * assuming the cache holds every row of the collection?
@@ -7501,12 +7958,67 @@ function resolvePagination(params) {
 * `include` pulls in rows from other collections that this evaluator never
 * sees, and `searchString` is only approximated — both make the local answer a
 * best effort rather than an equivalent one.
+*
+* **Ordering comparisons are refused, and that is the interesting one.**
+* `compareValues` falls back to an `Intl.Collator` for operands it cannot read
+* as numbers or instants. PostgreSQL orders text by the *database's* collation,
+* which is a property of the server this process has never been told: under the
+* C collation `'apple' < 'Banana'` is false, under `en_US.UTF-8` it is true,
+* and the collator says true. So `["<", "Banana"]` selects a different set here
+* than it does there — silently, and in whichever direction the deployment
+* happens to have been created.
+*
+* The refusal covers *every* ordering comparison rather than only the ones with
+* a string operand, because the operand type does not settle it: a numeric
+* bound against a text column (`["<", 10]` on a `varchar`) also reaches the
+* collator, and nothing in `params` says what the column holds. Conservative on
+* purpose — the cost is that a query combining an ordering filter with
+* *unsynced local writes* stops placing those writes optimistically, which is a
+* degraded answer rather than a wrong one. Claiming exactness we do not have is
+* the other way round.
+*
+* This says nothing about ordering *results*; that is a separate claim with a
+* separate answer, because a sort changes which rows come first and not which
+* rows match. See {@link isLocallySortable}.
 */
 function isExactlyEvaluable(params) {
 	if (!params) return true;
 	if (params.include && params.include.length > 0) return false;
 	if (params.searchString) return false;
 	if (params.vectorSearch) return false;
+	if (whereOrders(params.where)) return false;
+	if (logicalOrders(params.logical)) return false;
+	return true;
+}
+/**
+* Would sorting `rows` locally reproduce the order the server would have sent?
+*
+* Asked of the rows rather than of the query, because unlike a filter this one
+* *is* decidable from the data in hand: {@link compareValues} reaches the
+* collator only when it cannot read both operands as numbers, and `toComparable`
+* has already turned dates and relations into numbers and ids by then. If every
+* value on the sort column normalises to a number, the collator is unreachable
+* and the local order is the server's order.
+*
+* A text column is therefore refused — see {@link isExactlyEvaluable} for why
+* the two cannot be made to agree — and so is a column this page happens to see
+* only as strings, which is the same thing from here.
+*
+* Nulls are fine either way: they are ordered by an explicit rule (last
+* ascending, first descending) that matches Postgres and never reaches the
+* comparator.
+*/
+function isLocallySortable(rows, orderBy) {
+	if (!orderBy) return true;
+	const [field] = orderBy;
+	for (const row of rows) {
+		const value = toComparable(row[field]);
+		if (isNullish(value)) continue;
+		if (typeof value === "number" || typeof value === "boolean") continue;
+		if (typeof value === "bigint") continue;
+		if (typeof value === "string" && value.trim() !== "" && !Number.isNaN(Number(value))) continue;
+		return false;
+	}
 	return true;
 }
 /** Run a full query — filter, sort, paginate — over a set of rows. */
@@ -7536,6 +8048,17 @@ function generateOfflineId() {
 	return `off-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
 }
 var MISSING = "\0missing";
+/**
+* Replays to spend on a mutation whose idempotency key the server is still
+* holding, when the app has not asked for more.
+*
+* Retries double from a second and cap at the sync interval, so the default
+* budget of five covers about half a minute — less than the lease a server
+* gives a claim nobody came back for. This many outlast it with room for a slow
+* batch, and the count is what stops a server that never releases the key from
+* blocking the queue behind it indefinitely.
+*/
+var IN_PROGRESS_MIN_RETRIES = 12;
 var OfflineManager = class {
 	store;
 	maxCachedQueries;
@@ -8225,7 +8748,8 @@ var OfflineManager = class {
 			rows.push(entry.row);
 			added++;
 		}
-		if (params?.orderBy) sortRows(rows, params.orderBy);
+		const orderIsLocal = isLocallySortable(rows, params?.orderBy);
+		if (params?.orderBy && orderIsLocal) sortRows(rows, params.orderBy);
 		return {
 			data: rows,
 			meta: {
@@ -8236,7 +8760,7 @@ var OfflineManager = class {
 			},
 			fromCache,
 			hasPendingWrites: rows.some((row) => this.hasPending(slug, row.id)),
-			partial: !exact
+			partial: !exact || !orderIsLocal
 		};
 	}
 	localFind(slug, params) {
@@ -8551,7 +9075,8 @@ var OfflineManager = class {
 						}
 						op.attempts = (op.attempts ?? 0) + 1;
 						op.lastError = error?.message ?? String(error);
-						if (isRetryableError(error) && op.attempts < this.maxRetries) {
+						const limit = isIdempotencyInProgressError(error) ? Math.max(this.maxRetries, IN_PROGRESS_MIN_RETRIES) : this.maxRetries;
+						if (isRetryableError(error) && op.attempts < limit) {
 							await this.store.enqueue(this.queueKey(op), op).catch(() => void 0);
 							this.connectivity.deferRetry();
 							this.patchStatus({ lastError: op.lastError });
@@ -9083,6 +9608,10 @@ channel: (name, options) => {
 }
 //#endregion
 //#region src/history/history-routes.ts
+/** Entries returned when the caller names no `?limit`. */
+var HISTORY_DEFAULT_LIMIT = 20;
+/** Most entries one history read will serve. Above it the request is refused. */
+var HISTORY_MAX_LIMIT = 100;
 function createHistoryRoutes(params) {
 	const { historyService, registry } = params;
 	const router = new Hono();
@@ -9131,22 +9660,24 @@ function createHistoryRoutes(params) {
 	* GET /:slug/:id/history - List history entries for a entity
 	*
 	* Query params:
-	*   limit  (default 20)
+	*   limit  (default 20, maximum 100 — above that the request is refused)
 	*   offset (default 0)
 	*/
 	router.get("/:slug/:id/history", async (c) => {
 		const slug = c.req.param("slug");
 		const id = c.req.param("id");
-		const parsedLimit = parseInt(c.req.query("limit") ?? "20", 10);
+		const limit = resolveListLimitParam(c.req.query("limit"), {
+			defaultLimit: HISTORY_DEFAULT_LIMIT,
+			maxLimit: HISTORY_MAX_LIMIT
+		});
 		const parsedOffset = parseInt(c.req.query("offset") ?? "0", 10);
-		const limit = Number.isNaN(parsedLimit) ? 20 : parsedLimit;
 		const offset = Number.isNaN(parsedOffset) ? 0 : parsedOffset;
 		const collection = registry.getCollections().find((col) => col.slug === slug || false);
 		if (!collection) throw ApiError.notFound(`Collection '${slug}' not found`);
 		if (!collection.history) throw ApiError.badRequest(`History is not enabled for collection '${slug}'`);
 		await authorizeEntityRead(c, collection, id);
 		const tableName = collection.slug;
-		const appliedLimit = Math.min(limit, 100);
+		const appliedLimit = limit;
 		const appliedOffset = Math.max(offset, 0);
 		const result = await historyService.fetchHistory(tableName, id, {
 			limit: appliedLimit,
@@ -9197,126 +9728,6 @@ function createHistoryRoutes(params) {
 	return router;
 }
 //#endregion
-//#region src/email/smtp-email-service.ts
-var _nodemailer;
-async function loadNodemailer() {
-	if (!_nodemailer) try {
-		_nodemailer = await import("nodemailer");
-	} catch {
-		throw new Error("nodemailer is required for SMTP email. Install it: pnpm add nodemailer");
-	}
-	return _nodemailer;
-}
-/**
-* Safely parse a hostname from a URL string
-*/
-function getHostname(urlStr) {
-	try {
-		return new URL(urlStr.includes("://") ? urlStr : `https://${urlStr}`).hostname;
-	} catch {
-		return;
-	}
-}
-/**
-* SMTP Email Service implementation using Nodemailer
-*/
-var SMTPEmailService = class {
-	transporter = null;
-	config;
-	_initialized = false;
-	constructor(config) {
-		this.config = config;
-	}
-	/**
-	* Lazily initialize the SMTP transporter on first use
-	*/
-	async ensureTransporter() {
-		if (this._initialized) return;
-		this._initialized = true;
-		if (this.config.smtp) {
-			const nodemailer = await loadNodemailer();
-			let smtpName = this.config.smtp.name;
-			if (!smtpName) {
-				const urlsToTry = [
-					process.env.FRONTEND_URL,
-					this.config.resetPasswordUrl,
-					this.config.verifyEmailUrl
-				];
-				for (const urlStr of urlsToTry) if (urlStr) {
-					const hostname = getHostname(urlStr);
-					if (hostname) {
-						smtpName = hostname;
-						break;
-					}
-				}
-			}
-			this.transporter = nodemailer.createTransport({
-				name: smtpName,
-				host: this.config.smtp.host,
-				port: this.config.smtp.port,
-				secure: this.config.smtp.secure ?? this.config.smtp.port === 465,
-				auth: this.config.smtp.auth ? {
-					user: this.config.smtp.auth.user,
-					pass: this.config.smtp.auth.pass
-				} : void 0
-			});
-		}
-	}
-	/**
-	* Check if the email service is properly configured
-	*/
-	isConfigured() {
-		return !!(this.config.smtp || this.config.sendEmail);
-	}
-	/**
-	* Send an email using SMTP or custom send function
-	*/
-	async send(options) {
-		if (this.config.sendEmail) {
-			await this.config.sendEmail(options);
-			return;
-		}
-		await this.ensureTransporter();
-		if (!this.transporter) throw new Error("Email service not configured. Provide SMTP config or sendEmail function.");
-		const to = Array.isArray(options.to) ? options.to.join(", ") : options.to;
-		try {
-			await this.transporter.sendMail({
-				from: this.config.from,
-				to,
-				subject: options.subject,
-				html: options.html,
-				text: options.text,
-				replyTo: options.replyTo
-			});
-		} catch (error) {
-			const message = error instanceof Error ? error.message : String(error);
-			logger.error("Failed to send email", { detail: message });
-			throw new Error(`Failed to send email: ${message}`);
-		}
-	}
-	/**
-	* Verify SMTP connection (useful for startup checks)
-	*/
-	async verifyConnection() {
-		await this.ensureTransporter();
-		if (!this.transporter) return !!this.config.sendEmail;
-		try {
-			await this.transporter.verify();
-			return true;
-		} catch (error) {
-			const message = error instanceof Error ? error.message : String(error);
-			logger.error("SMTP connection verification failed", { detail: message });
-			return false;
-		}
-	}
-};
-/**
-* Create an email service from configuration
-*/
-function createEmailService(config) {
-	return new SMTPEmailService(config);
-}
-//#endregion
 //#region src/singleton.ts
 /**
 * The backing instance lives on a process-global slot, NOT in a module-local
@@ -9377,14 +9788,30 @@ function _resetRebaseMock() {
 * **Admin data plane** (`rebase.dataAsAdmin`):
 * Backed by the native DataDriver — calls go directly to the database without
 * JSON serialization, HTTP dispatch, or middleware overhead. The driver is
-* scoped as `{ uid: "service", roles: ["admin"] }`, so **every read and write
-* bypasses row-level-security policies**. No `REBASE_SERVICE_KEY` is required.
-*
-* ⚠️ Because it bypasses RLS, `rebase.dataAsAdmin` is for trusted background
-* work (cron jobs, migrations, service tasks) — **not** for serving user-facing
-* data. Inside a request handler, run user-scoped queries through the
-* request-scoped driver (`c.var.driver`), which carries the caller's identity
-* so RLS applies.
+* scoped once as `{ uid: "service", roles: ["admin"] }` (`SERVICE_IDENTITY`),
+* which makes it **admin-scoped, not RLS-bypassing**: every read and write runs
+* in a transaction that has done `SET LOCAL ROLE rebase_user` with
+* `app.uid = 'service'`, and policies are evaluated against that. No
+* `REBASE_SERVICE_KEY` is required.
+*
+* It clears the default policies through their `rolesOverlap(['admin'])` arm —
+* which is why the difference rarely shows. It shows when you write your own:
+*
+* - `policy.serverContext()` compiles to `auth.uid() IS NULL` and is therefore
+*   **false** for this accessor. A collection with `disableDefaultPolicies:
+*   true` whose rule is `serverContext()` denies these writes (`42501`) and
+*   returns zero rows — HTTP 200, empty — for these reads.
+* - Its reach equals an `admin`-roled application user's reach. It is not a
+*   private door.
+*
+* `rebase.sql()` *is* an unconditional bypass — it runs on the owner connection
+* and never goes through `withAuth`. Of the two accessors on this object, the
+* quieter one is the more privileged.
+*
+* ⚠️ `rebase.dataAsAdmin` is for trusted background work (cron jobs,
+* migrations, service tasks) — **not** for serving user-facing data. Inside a
+* request handler, run user-scoped queries through the request-scoped driver
+* (`c.var.driver`), which carries the caller's identity.
 *
 * `rebase.data` is **gone from the type**: `RebaseServerClient` omits it, so the
 * admin-scoped accessor has exactly one name and the privilege is visible at the
@@ -9400,7 +9827,8 @@ function _resetRebaseMock() {
 * ```typescript
 * import { rebase } from "@rebasepro/server";
 *
-* // In a cron job, hook, or trusted service file (admin scope, bypasses RLS):
+* // In a cron job, hook, or trusted service file (admin scope, RLS evaluated
+* // as `{ uid: "service", roles: ["admin"] }`):
 * await rebase.email.send({ to: "admin@co.com", subject: "Alert", html: "<p>Hi</p>" });
 * const jobs = await rebase.dataAsAdmin.jobs.find({ limit: 10 });
 * ```
@@ -9514,7 +9942,8 @@ async function initializeRebaseBackend(config) {
 async function _initializeRebaseBackend(config) {
 	if (config.logging?.level) configureLogLevel(config.logging.level);
 	else configureLogLevel();
-	logger.info("Initializing Rebase Backend");
+	logger.debug("Initializing Rebase Backend");
+	installUnhandledRejectionHandler();
 	const basePath = config.basePath || "/api";
 	const isProduction = process.env.NODE_ENV === "production";
 	configureMiddlewares(config.app, basePath, isProduction, config);
@@ -9532,13 +9961,14 @@ async function _initializeRebaseBackend(config) {
 		});
 	}
 	const introspectCollections = activeCollections.length === 0;
-	logger.info(introspectCollections ? "No collections declared — deriving them from the database schema" : "Serving declared collections");
+	if (introspectCollections) logger.info("No collections declared — deriving them from the database schema");
+	else logger.debug("Serving declared collections");
 	const realtimeServices = {};
 	const delegates = {};
 	let bootstrappers = config.bootstrappers || [];
 	if (config.database) {
 		const dbAdapter = config.database;
-		logger.info("Using DatabaseAdapter", { type: dbAdapter.type });
+		logger.debug("Using DatabaseAdapter", { type: dbAdapter.type });
 		bootstrappers = [wrapDatabaseAdapter(dbAdapter)];
 	}
 	if (bootstrappers.length === 0) throw new Error("No bootstrappers or database adapter provided. Cannot initialize database drivers.");
@@ -9546,7 +9976,7 @@ async function _initializeRebaseBackend(config) {
 	let defaultDriverResult = void 0;
 	for (const bootstrapper of bootstrappers) {
 		const b = bootstrapper;
-		logger.info("Running bootstrapper for driver", { driverId: b.id || bootstrapper.type });
+		logger.debug("Running bootstrapper for driver", { driverId: b.id || bootstrapper.type });
 		if (b.isDefault) defaultDriverId = b.id || bootstrapper.type;
 		const driverResult = await bootstrapper.initializeDriver({
 			collections: activeCollections,
@@ -9604,7 +10034,7 @@ async function _initializeRebaseBackend(config) {
 		authAdapter = config.auth;
 		serviceKey = authAdapter.serviceKey;
 		if (authAdapter.initialize) await authAdapter.initialize();
-		logger.info("Using AuthAdapter", { id: authAdapter.id });
+		logger.debug("Using AuthAdapter", { id: authAdapter.id });
 		authConfigResult = { userService: authAdapter.userManagement ?? {} };
 	} else {
 		const safeAuthConfig = config.auth;
@@ -9615,7 +10045,7 @@ async function _initializeRebaseBackend(config) {
 			});
 			if (foundAuthCollection) {
 				safeAuthConfig.collection = foundAuthCollection;
-				logger.info("Auto-discovered auth collection from collection definitions", { slug: foundAuthCollection.slug });
+				logger.debug("Auto-discovered auth collection from collection definitions", { slug: foundAuthCollection.slug });
 			}
 		}
 		if (safeAuthConfig.collection) {
@@ -9632,17 +10062,17 @@ async function _initializeRebaseBackend(config) {
 		if (safeAuthConfig.serviceKey) {
 			if (safeAuthConfig.serviceKey.length < 32) throw new Error("REBASE_SERVICE_KEY is too short. Must be at least 32 characters. Generate one with: node -e \"logger.info(require('crypto').randomBytes(48).toString('base64'))\"");
 			serviceKey = safeAuthConfig.serviceKey;
-			logger.info("Service key configured for script/server-to-server authentication");
+			logger.debug("Service key configured for script/server-to-server authentication");
 		}
 		if (defaultBootstrapper.initializeAuth) {
-			logger.info("Bootstrapping authentication via driver protocol");
+			logger.debug("Bootstrapping authentication via driver protocol");
 			authConfigResult = await defaultBootstrapper.initializeAuth(config.auth, defaultDriverResult);
 			logger.info("Authentication initialized");
 		} else logger.warn("Auth requested but default bootstrapper does not support initializeAuth");
 	}
 	let historyConfigResult = void 0;
 	if (config.history) if (defaultBootstrapper.initializeHistory) {
-		logger.info("Bootstrapping entity history via driver protocol");
+		logger.debug("Bootstrapping entity history via driver protocol");
 		historyConfigResult = await defaultBootstrapper.initializeHistory(config.history, defaultDriverResult);
 		if (historyConfigResult?.historyService && defaultDriverResult.internals) {
 			const driver = defaultDriverResult.internals.driver;
@@ -9658,7 +10088,7 @@ async function _initializeRebaseBackend(config) {
 	if (apiKeyStoreResult) {
 		apiKeyStore = apiKeyStoreResult;
 		await apiKeyStore.ensureTable();
-		logger.info("Service API Keys initialized");
+		logger.debug("Service API Keys initialized");
 	}
 	const apiKeyPreAuth = apiKeyStore ? createApiKeyPreAuth({
 		store: apiKeyStore,
@@ -9671,7 +10101,7 @@ async function _initializeRebaseBackend(config) {
 			serviceKey: internalServiceKey
 		});
 		config.app.route(`${basePath}/admin/api-keys`, apiKeyRoutes);
-		logger.info("API key admin routes mounted", { path: `${basePath}/admin/api-keys` });
+		logger.debug("API key admin routes mounted", { path: `${basePath}/admin/api-keys` });
 	}
 	const rateLimitConfig = config.rateLimit?.enabled !== false ? {
 		...config.rateLimit,
@@ -9755,7 +10185,7 @@ async function _initializeRebaseBackend(config) {
 			]) {
 				const providerConfig = safeAuthConfig[key];
 				if (providerConfig && requiredFields.every((f) => Boolean(providerConfig[f]))) {
-					const createFn = (await import("./auth-BANhRhN9.js").then((n) => n.t))[factory];
+					const createFn = (await import("./auth-CYoPVf-E.js").then((n) => n.t))[factory];
 					oauthProviders.push(createFn(providerConfig));
 				}
 			}
@@ -9767,9 +10197,11 @@ async function _initializeRebaseBackend(config) {
 				emailConfig: safeAuthConfig.email,
 				allowRegistration: safeAuthConfig.allowRegistration ?? false,
 				disableSelfRegistration: safeAuthConfig.disableSelfRegistration ?? false,
+				allowAnonymous: safeAuthConfig.allowAnonymous ?? false,
 				allowUserLookup: safeAuthConfig.allowUserLookup ?? false,
 				defaultRole: safeAuthConfig.defaultRole,
 				oauthProviders,
+				allowedRedirectUris: safeAuthConfig.allowedRedirectUris,
 				serviceKey: serviceKey || internalServiceKey,
 				authHooks: safeAuthConfig.hooks,
 				collectionAuthConfig,
@@ -9784,14 +10216,14 @@ async function _initializeRebaseBackend(config) {
 			const authRoutes = authAdapter.createAuthRoutes();
 			if (authRoutes) {
 				config.app.route(`${basePath}/auth`, authRoutes);
-				logger.info("Auth routes mounted via adapter", { adapter: authAdapter.id });
+				logger.debug("Auth routes mounted via adapter", { adapter: authAdapter.id });
 			}
 		}
 		if (authAdapter && authAdapter.createAdminRoutes) {
 			const adminRoutes = authAdapter.createAdminRoutes();
 			if (adminRoutes) {
 				config.app.route(`${basePath}/admin`, adminRoutes);
-				logger.info("Admin routes mounted via adapter", { adapter: authAdapter.id });
+				logger.debug("Admin routes mounted via adapter", { adapter: authAdapter.id });
 			}
 		}
 	}
@@ -9849,7 +10281,7 @@ async function _initializeRebaseBackend(config) {
 	let schemaEditorOff = schemaEditorUnavailable();
 	let schemaEditorRoutes;
 	if (!schemaEditorOff && config.collectionsDir) try {
-		schemaEditorRoutes = (await import("./schema-editor-routes-BqjzvvWU.js")).createSchemaEditorRoutes(config.collectionsDir);
+		schemaEditorRoutes = (await import("./schema-editor-routes-CRcS3ArS.js")).createSchemaEditorRoutes(config.collectionsDir);
 	} catch (err) {
 		if (err?.code === "ERR_MODULE_NOT_FOUND") {
 			schemaEditorOff = {
@@ -9873,7 +10305,7 @@ async function _initializeRebaseBackend(config) {
 			message: schemaEditorOff.message
 		} }, 501));
 		config.app.route(`${basePath}/schema-editor`, schemaEditorRouter);
-		if (schemaEditorRoutes) logger.info("Schema Editor mounted", { path: `${basePath}/schema-editor` });
+		if (schemaEditorRoutes) logger.debug("Schema Editor mounted", { path: `${basePath}/schema-editor` });
 		else logger.debug("Schema Editor unavailable", {
 			path: `${basePath}/schema-editor`,
 			code: schemaEditorOff.code
@@ -9899,6 +10331,7 @@ async function _initializeRebaseBackend(config) {
 		});
 		const storageRouter = new Hono();
 		if (apiKeyPreAuth) storageRouter.use("/*", apiKeyPreAuth, createStorageApiKeyGuard());
+		if (rateLimitConfig) storageRouter.use("/*", createDataRateLimiter(rateLimitConfig));
 		storageRouter.use("/upload", bodyLimit({
 			maxSize: storageMaxSize,
 			onError: (c) => {
@@ -9919,6 +10352,7 @@ async function _initializeRebaseBackend(config) {
 		config.app.route(`${basePath}/storage`, storageStub);
 		logger.info("Storage not configured — /storage returns 501 STORAGE_NOT_CONFIGURED");
 	}
+	const serverCollections = activeCollections.filter((collection) => resolveDataSource(collection, dataSourceRegistry).transport === "server");
 	if (activeCollections.length > 0) {
 		const dataRouter = new Hono();
 		dataRouter.onError(errorHandler);
@@ -9926,7 +10360,10 @@ async function _initializeRebaseBackend(config) {
 		if (!dataRequireAuth) logger.warn("Data routes running WITHOUT authentication enforcement. Access control is fully delegated to Postgres RLS policies. If no RLS policies exist, data is publicly accessible. Set auth.requireAuth to true (or remove it) to require authentication.");
 		else {
 			const publicSelect = activeCollections.filter((c) => getEffectiveSecurityRules(c).some((rule) => "access" in rule && rule.access === "public" && (rule.operation === "select" || rule.operation === "all" || Array.isArray(rule.operations) && rule.operations.includes("select")))).map((c) => c.slug);
-			if (publicSelect.length > 0) logger.info(`${publicSelect.length} collection(s) grant unfiltered reads (${publicSelect.join(", ")}), but every /api/data route still requires a token: \`access: "public"\` widens which ROWS a caller sees, not who may call. An unauthenticated read answers 401 regardless. To let RLS alone decide — the usual choice for a public website reading its own backend — set AUTH_REQUIRE=false (or \`auth.requireAuth: false\`).`);
+			if (publicSelect.length > 0) {
+				logger.info(`${publicSelect.length} collection(s) grant unfiltered reads (${publicSelect.join(", ")}) — reads still require a token. Set AUTH_REQUIRE=false to let RLS alone decide: https://rebase.pro/docs/collections/security-rules`);
+				logger.debug("`access: \"public\"` widens which ROWS a caller sees, not who may call, so an unauthenticated read of a public collection answers 401 rather than returning rows. Setting AUTH_REQUIRE=false (or `auth.requireAuth: false`) removes the API-level gate and delegates the decision entirely to the Postgres RLS policies — the usual choice for a public website reading its own backend.");
+			}
 		}
 		const dataPathMarker = `${basePath}/data/`;
 		const resolveRequestDriver = (reqPath) => {
@@ -9960,24 +10397,21 @@ async function _initializeRebaseBackend(config) {
 			});
 			dataRouter.route("/", historyRoutes);
 		}
-		const restGenerator = new RestApiGenerator(activeCollections.filter((collection) => resolveDataSource(collection, dataSourceRegistry).transport === "server"), defaultDriver, authAdapter);
+		const restGenerator = new RestApiGenerator(serverCollections, defaultDriver, authAdapter);
 		dataRouter.route("/", restGenerator.generateRoutes());
 		config.app.route(`${basePath}/data`, dataRouter);
 	}
-	await mountOpenApiDocs(config.app, basePath, config.enableSwagger, activeCollections, resolveRequireAuth(config.auth));
+	await mountOpenApiDocs(config.app, basePath, config.enableSwagger, serverCollections, resolveRequireAuth(config.auth));
 	const serverClient = createRebaseClient({
 		baseUrl: "http://localhost",
 		apiPath: basePath,
-		websocketUrl: "",
+		realtime: false,
 		token: internalServiceKey,
 		fetch: async (input, init) => {
 			return await config.app.request(input, init);
 		}
 	});
-	const serviceIdentity = {
-		uid: "service",
-		roles: ["admin"]
-	};
+	const serviceIdentity = SERVICE_IDENTITY;
 	const defaultData = buildSdkData(await scopeDataDriver(defaultDriver, serviceIdentity));
 	storageAuthorizeData.current = defaultData;
 	const dataSourcesByKey = {};
@@ -9996,20 +10430,20 @@ async function _initializeRebaseBackend(config) {
 		data: serverData,
 		dataAsAdmin: serverData
 	});
-	logger.info("Native data plane attached to singleton (bypasses HTTP loop)");
+	logger.debug("Native data plane attached to singleton (bypasses HTTP loop)");
 	if (storageController) {
 		Object.assign(serverClient, { storage: storageController });
-		logger.info("Native storage attached to singleton (bypasses HTTP loop)");
+		logger.debug("Native storage attached to singleton (bypasses HTTP loop)");
 	}
 	let emailService;
 	if (authConfigResult?.emailService) emailService = authConfigResult.emailService;
 	else if (config.auth && !isAuthAdapter(config.auth) && config.auth.email) emailService = createEmailService(config.auth.email);
 	if (emailService) {
 		Object.assign(serverClient, { email: emailService });
-		logger.info("Email service attached to singleton", { configured: emailService.isConfigured() });
+		logger.debug("Email service attached to singleton", { configured: emailService.isConfigured() });
 		if (emailService.isConfigured() && typeof emailService.verifyConnection === "function") emailService.verifyConnection().then((success) => {
 			if (!success) logger.warn("Warning: SMTP connection verification failed. Email delivery may fail.");
-			else logger.info("SMTP connection verified successfully.");
+			else logger.debug("SMTP connection verified successfully.");
 		}).catch((err) => {
 			logger.warn("Warning: SMTP connection verification failed. Email delivery may fail.", { error: err });
 		});
@@ -10017,56 +10451,59 @@ async function _initializeRebaseBackend(config) {
 	const driverAdmin = defaultBootstrapper.getAdmin?.(defaultDriverResult);
 	if (isSQLAdmin(driverAdmin)) {
 		Object.assign(serverClient, { sql: (query, options) => driverAdmin.executeSql(query, options) });
-		logger.info("SQL capability attached to singleton");
+		logger.debug("SQL capability attached to singleton");
 	}
 	const serverSingleton = serverClient;
 	_initRebase(serverSingleton);
-	logger.info("Rebase singleton initialized");
+	logger.debug("Rebase singleton initialized");
 	if (defaultDriverResult.internals) {
 		const driver = defaultDriverResult.internals.driver;
 		if (driver && "client" in driver) driver.client = serverClient;
 	}
 	if (config.functionsDir) {
-		const { loadFunctionsFromDirectory } = await import("./function-loader-B_1fYfUY.js").then((n) => n.t);
-		const { createFunctionRoutes } = await import("./function-routes-C0cLIy3N.js").then((n) => n.n);
-		const loadedFunctions = await loadFunctionsFromDirectory(config.functionsDir);
-		if (loadedFunctions.length > 0) {
-			const functionsRouter = new Hono();
-			functionsRouter.onError(errorHandler);
-			const functionsRequireAuth = false;
-			if (authAdapter) functionsRouter.use("/*", createAdapterAuthMiddleware({
-				adapter: authAdapter,
-				driver: defaultDriver,
-				requireAuth: functionsRequireAuth,
-				apiKeyStore
-			}));
-			else functionsRouter.use("/*", createAuthMiddleware({
-				driver: defaultDriver,
-				requireAuth: functionsRequireAuth,
-				serviceKey: internalServiceKey,
-				apiKeyStore
-			}));
-			functionsRouter.use("/*", createFunctionApiKeyGuard(`${basePath}/functions`));
-			if (rateLimitConfig) functionsRouter.use("/*", createDataRateLimiter({
-				...rateLimitConfig,
-				anonymous: null
-			}));
-			const fnRoutes = createFunctionRoutes(loadedFunctions);
-			functionsRouter.route("/", fnRoutes);
-			config.app.route(`${basePath}/functions`, functionsRouter);
-			logger.info("Mounted custom functions", {
-				count: loadedFunctions.length,
-				path: `${basePath}/functions`
-			});
-		}
+		const { loadFunctionsWithDiagnostics } = await import("./function-loader-DDS1v7YX.js").then((n) => n.t);
+		const { createFunctionRoutes } = await import("./function-routes-Btcez1T-.js").then((n) => n.n);
+		const { createFunctionsRequestTimeout, resolveFunctionsTimeoutMs } = await import("./request-timeout-RivJsME0.js");
+		const { functions: loadedFunctions, problems } = await loadFunctionsWithDiagnostics(config.functionsDir);
+		const functionsRouter = new Hono();
+		functionsRouter.onError(errorHandler);
+		const functionsTimeoutMs = resolveFunctionsTimeoutMs(config.functionsTimeoutMs);
+		if (functionsTimeoutMs > 0) functionsRouter.use("/*", createFunctionsRequestTimeout(functionsTimeoutMs));
+		const functionsRequireAuth = false;
+		if (authAdapter) functionsRouter.use("/*", createAdapterAuthMiddleware({
+			adapter: authAdapter,
+			driver: defaultDriver,
+			requireAuth: functionsRequireAuth,
+			apiKeyStore
+		}));
+		else functionsRouter.use("/*", createAuthMiddleware({
+			driver: defaultDriver,
+			requireAuth: functionsRequireAuth,
+			serviceKey: internalServiceKey,
+			apiKeyStore
+		}));
+		functionsRouter.use("/*", createFunctionApiKeyGuard(`${basePath}/functions`));
+		if (rateLimitConfig) functionsRouter.use("/*", createDataRateLimiter({
+			...rateLimitConfig,
+			anonymous: rateLimitConfig.anonymousFunctions !== void 0 ? rateLimitConfig.anonymousFunctions : DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT
+		}));
+		const fnRoutes = createFunctionRoutes(loadedFunctions, problems.length);
+		functionsRouter.route("/", fnRoutes);
+		config.app.route(`${basePath}/functions`, functionsRouter);
+		if (loadedFunctions.length > 0) logger.info("Mounted custom functions", {
+			count: loadedFunctions.length,
+			path: `${basePath}/functions`,
+			timeoutMs: functionsTimeoutMs
+		});
+		else logger.warn(`Function routes mounted at ${basePath}/functions, but no functions loaded from ${config.functionsDir}. ` + (problems.length > 0 ? `${problems.length} file(s) were skipped — see the messages above.` : "The directory holds no .ts/.js function files."));
 	}
 	let cronScheduler;
 	if (config.cronsDir) {
-		const { loadCronJobsFromDirectory } = await import("./cron-loader-B1S2MCSl.js").then((n) => n.t);
-		const { CronScheduler } = await import("./cron-scheduler-CsQtYLMq.js").then((n) => n.n);
-		const { createCronRoutes } = await import("./cron-routes-D5a9v1HY.js").then((n) => n.n);
-		const { createCronStore } = await import("./cron-store-ZbjfuvMb.js").then((n) => n.n);
-		const loadedCronJobs = await loadCronJobsFromDirectory(config.cronsDir);
+		const { loadCronJobsWithDiagnostics } = await import("./cron-loader-YhhQeVBM.js").then((n) => n.t);
+		const { CronScheduler } = await import("./cron-scheduler-DIpYBmZP.js").then((n) => n.n);
+		const { createCronRoutes } = await import("./cron-routes-maM_RlUu.js").then((n) => n.n);
+		const { createCronStore } = await import("./cron-store-Dvr4Y1sZ.js").then((n) => n.n);
+		const { jobs: loadedCronJobs, problems: cronProblems } = await loadCronJobsWithDiagnostics(config.cronsDir);
 		cronScheduler = new CronScheduler();
 		cronScheduler.setClient(serverSingleton);
 		if (loadedCronJobs.length > 0) {
@@ -10079,7 +10516,7 @@ async function _initializeRebaseBackend(config) {
 		}
 		const cronRouter = new Hono();
 		applyAdminGate(cronRouter, "Cron");
-		cronRouter.route("/", createCronRoutes(cronScheduler));
+		cronRouter.route("/", createCronRoutes(cronScheduler, cronProblems.length));
 		config.app.route(`${basePath}/cron`, cronRouter);
 		if (loadedCronJobs.length > 0) {
 			cronScheduler.start();
@@ -10087,10 +10524,10 @@ async function _initializeRebaseBackend(config) {
 				count: loadedCronJobs.length,
 				path: `${basePath}/cron`
 			});
-		} else logger.warn(`Cron routes mounted at ${basePath}/cron, but no jobs loaded from ${config.cronsDir}. Nothing is scheduled — check the messages above for files that failed to load.`);
+		} else logger.warn(`Cron routes mounted at ${basePath}/cron, but no jobs loaded from ${config.cronsDir}. ` + (cronProblems.length > 0 ? `Nothing is scheduled — ${cronProblems.length} file(s) were skipped, see the messages above.` : "The directory holds no .ts/.js cron files, so nothing is scheduled."));
 	}
 	{
-		const { createBackupRoutes, parseBackupDestination } = await import("./backup-BJiY_mM-.js").then((n) => n.t);
+		const { createBackupRoutes, parseBackupDestination } = await import("./backup-C6ljYVTp.js").then((n) => n.t);
 		const backupRouter = new Hono();
 		applyAdminGate(backupRouter, "Backup");
 		backupRouter.route("/", createBackupRoutes({
@@ -10101,7 +10538,7 @@ async function _initializeRebaseBackend(config) {
 			storage: storageController
 		}));
 		config.app.route(`${basePath}/admin/backups`, backupRouter);
-		logger.info("Backup admin routes mounted", { path: `${basePath}/admin/backups` });
+		logger.debug("Backup admin routes mounted", { path: `${basePath}/admin/backups` });
 	}
 	{
 		const { default: logsRoutes } = await import("./logs-routes-BYA72C_C.js").then((n) => n.n);
@@ -10109,10 +10546,10 @@ async function _initializeRebaseBackend(config) {
 		applyAdminGate(logsRouter, "Logs");
 		logsRouter.route("/", logsRoutes);
 		config.app.route(`${basePath}/logs`, logsRouter);
-		logger.info("Logs routes mounted", { path: `${basePath}/logs` });
+		logger.debug("Logs routes mounted", { path: `${basePath}/logs` });
 	}
 	{
-		const { createContractRoutes } = await import("./contract-routes-FSt0Nyfk.js").then((n) => n.t);
+		const { createContractRoutes } = await import("./contract-routes-Bet-eCNJ.js").then((n) => n.t);
 		const contractRouter = new Hono();
 		if (adminSurfacesGated) {
 			if (apiKeyPreAuth) contractRouter.use("/contract", apiKeyPreAuth);
@@ -10130,7 +10567,7 @@ async function _initializeRebaseBackend(config) {
 			runtimeVersion: config.runtimeVersion
 		}));
 		config.app.route(`${basePath}/meta`, contractRouter);
-		logger.info("Contract routes mounted", { path: `${basePath}/meta` });
+		logger.debug("Contract routes mounted", { path: `${basePath}/meta` });
 	}
 	const effectiveRealtimeService = Object.keys(realtimeServices).length > 1 ? createRoutedRealtimeService({
 		providers: realtimeServices,
@@ -10138,7 +10575,7 @@ async function _initializeRebaseBackend(config) {
 		resolveKey: keyForCollectionPath
 	}) : defaultRealtimeService;
 	if (defaultBootstrapper.initializeWebsockets && effectiveRealtimeService) await defaultBootstrapper.initializeWebsockets(config.server, effectiveRealtimeService, defaultDriver, config.auth, authAdapter);
-	logger.info("Rebase Backend Initialized");
+	logger.debug("Rebase Backend Initialized");
 	const authSchemaCheck = authConfigResult?.schemaHealthCheck;
 	const healthCheck = createHealthCheck(defaultDriver, authSchemaCheck ? () => authSchemaCheck.call(authConfigResult) : void 0);
 	const shutdown = createShutdown({
@@ -10206,6 +10643,9 @@ async function _initializeRebaseBackend(config) {
 * export default defineFunction((app, { rebase }) => {
 *     app.use("/*", requireAuth);
 *     app.get("/home", async (c) => {
+*         // `rebase.sql` runs on the owner connection: no RLS, no policies,
+*         // every row. It is the most privileged thing in this context —
+*         // more so than `dataAsAdmin`, which is merely admin-scoped.
 *         const [stats] = await rebase.sql(`SELECT count(*) AS n FROM orders`);
 *         return c.json({ orders: Number(stats.n) });
 *     });
@@ -10231,6 +10671,17 @@ function defineFunction(definition) {
 *
 * @see {@link defineFunction} for the equivalent custom-functions helper.
 *
+* `ctx.rebase` is the `rebase` singleton itself — the same object a custom
+* function is handed — so `rebase.dataAsAdmin` here is **admin-scoped, not an
+* RLS bypass**: it is scoped once at boot as `SERVICE_IDENTITY`
+* (`{ uid: "service", roles: ["admin"] }`), and your policies are evaluated
+* against that identity, not skipped. See that constant's docblock. It clears
+* the default policies through their `rolesOverlap(['admin'])` arm, which is why
+* the distinction rarely shows; it shows against hand-written rules, where
+* `policy.serverContext()` (`auth.uid() IS NULL`) is **false** for it. Use
+* `rebase.sql()` when you need the genuine bypass — owner connection, no
+* policies.
+*
 * @example
 * ```ts
 * import { defineCron } from "@rebasepro/server";
@@ -10239,8 +10690,9 @@ function defineFunction(definition) {
 *     name: "Nightly cleanup",
 *     schedule: "0 3 * * *",
 *     async handler({ rebase, log }) {
-*         // `dataAsAdmin` bypasses RLS. A cron has no per-request user, so
-*         // there is no policy to fall back on — scope the filters yourself.
+*         // `dataAsAdmin` runs as the service identity, with the `admin` role.
+*         // A cron has no per-request user to narrow that, so scope the
+*         // filters yourself — RLS will not do it for you here.
 *         const { data: expired } = await rebase.dataAsAdmin.sessions.find({
 *             where: { expired: ["==", true] },
 *         });
@@ -10366,6 +10818,7 @@ var rebaseEnvSchema = object({
 	REBASE_SERVICE_KEY: string().optional(),
 	ALLOW_REGISTRATION: boolString,
 	DISABLE_SELF_REGISTRATION: optionalBoolString,
+	ALLOW_ANONYMOUS: optionalBoolString,
 	ALLOW_LOCALHOST_IN_PRODUCTION: optionalBoolString,
 	CORS_ORIGINS: string().optional(),
 	FRONTEND_URL: string().optional(),
@@ -10429,7 +10882,158 @@ function loadEnv(options) {
 	return env;
 }
 //#endregion
+//#region src/services/outbound-url-guard.ts
+/**
+* Refusal to send a request to a destination the guard does not allow.
+*
+* Distinct from a network error on purpose: a blocked destination is
+* *terminal* — retrying it re-runs the same refusal — while an `ENOTFOUND`
+* or a refused connection is worth another attempt.
+*/
+var BlockedUrlError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "BlockedUrlError";
+	}
+};
+/** Names that mean "this machine" or "this network" before DNS is even asked. */
+var BLOCKED_HOST_SUFFIXES = [
+	".localhost",
+	".local",
+	".internal",
+	".home.arpa"
+];
+async function defaultLookup(hostname) {
+	return (await lookup(hostname, {
+		all: true,
+		verbatim: true
+	})).map((e) => e.address);
+}
+/**
+* Parse an IPv6 literal into its 16 bytes. Returns `null` for anything that is
+* not one — the caller has already established the string *is* an IPv6 address
+* via `isIP`, so `null` here means "shape we do not model", which is treated as
+* blocked rather than allowed.
+*/
+function parseIpv6(address) {
+	let text = address;
+	const zone = text.indexOf("%");
+	if (zone !== -1) text = text.slice(0, zone);
+	let tail = [];
+	const lastColon = text.lastIndexOf(":");
+	const maybeV4 = text.slice(lastColon + 1);
+	if (maybeV4.includes(".")) {
+		if (isIP(maybeV4) !== 4) return null;
+		tail = maybeV4.split(".").map(Number);
+		text = text.slice(0, lastColon);
+		if (text.endsWith(":")) text += ":";
+	}
+	const halves = text.split("::");
+	if (halves.length > 2) return null;
+	const head = halves[0] ? halves[0].split(":") : [];
+	const rest = halves.length === 2 ? halves[1] ? halves[1].split(":") : [] : [];
+	const missing = 8 - tail.length / 2 - head.length - rest.length;
+	if (halves.length === 1 ? missing !== 0 : missing < 0) return null;
+	const all = [
+		...head,
+		...new Array(halves.length === 2 ? missing : 0).fill("0"),
+		...rest
+	];
+	const bytes = [];
+	for (const group of all) {
+		const value = Number.parseInt(group, 16);
+		if (!Number.isFinite(value) || value < 0 || value > 65535 || !/^[0-9a-fA-F]{1,4}$/.test(group)) return null;
+		bytes.push(value >> 8 & 255, value & 255);
+	}
+	return [...bytes, ...tail];
+}
+/**
+* Why this IPv4 address must not be a webhook destination, or `null` if it is
+* an ordinary public address.
+*/
+function blockedIpv4Reason(bytes) {
+	const [a, b] = bytes;
+	if (a === 0) return "\"this network\" (0.0.0.0/8)";
+	if (a === 10) return "private (10.0.0.0/8)";
+	if (a === 127) return "loopback (127.0.0.0/8)";
+	if (a === 169 && b === 254) return "link-local (169.254.0.0/16) — the cloud metadata range";
+	if (a === 172 && b >= 16 && b <= 31) return "private (172.16.0.0/12)";
+	if (a === 192 && b === 168) return "private (192.168.0.0/16)";
+	if (a === 100 && b >= 64 && b <= 127) return "carrier-grade NAT (100.64.0.0/10)";
+	if (a === 192 && b === 0 && bytes[2] === 0) return "IETF protocol assignments (192.0.0.0/24)";
+	if (a === 198 && (b === 18 || b === 19)) return "benchmarking (198.18.0.0/15)";
+	if (a >= 224) return "multicast, reserved or broadcast (224.0.0.0/4 and above)";
+	return null;
+}
+/**
+* Why this address must not be a webhook destination, or `null` if it is an
+* ordinary public address. Exported for tests and for anyone else adding an
+* outbound call whose destination comes from data.
+*/
+function blockedAddressReason(address) {
+	const version = isIP(address);
+	if (version === 4) return blockedIpv4Reason(address.split(".").map(Number));
+	if (version !== 6) return `not an IP address: ${address}`;
+	const bytes = parseIpv6(address);
+	if (!bytes || bytes.length !== 16) return `unparseable IPv6 address: ${address}`;
+	const low32 = bytes.slice(12);
+	const isMapped = bytes.slice(0, 10).every((x) => x === 0) && bytes[10] === 255 && bytes[11] === 255;
+	const isCompat = bytes.slice(0, 12).every((x) => x === 0) && !(low32[0] === 0 && low32[1] === 0);
+	const isNat64 = bytes[0] === 0 && bytes[1] === 100 && bytes[2] === 255 && bytes[3] === 155;
+	if (isMapped || isCompat || isNat64) return blockedIpv4Reason(low32);
+	if (bytes[0] === 32 && bytes[1] === 2) return blockedIpv4Reason(bytes.slice(2, 6));
+	if (bytes.every((x) => x === 0)) return "unspecified (::)";
+	if (bytes.slice(0, 15).every((x) => x === 0) && bytes[15] === 1) return "loopback (::1)";
+	if (bytes[0] === 254 && (bytes[1] & 192) === 128) return "link-local (fe80::/10)";
+	if ((bytes[0] & 254) === 252) return "unique local (fc00::/7)";
+	if (bytes[0] === 255) return "multicast (ff00::/8)";
+	return null;
+}
+/**
+* Resolve and validate a destination before anything connects to it.
+*
+* Three checks, in order, because each is cheaper than the next: the scheme,
+* the hostname, then every address the hostname resolves to. *Every* address —
+* a name that answers with one public and one private record is a rebinding
+* attempt, and taking the first record would let it through.
+*
+* Known limit: this is validate-then-fetch. Between the lookup here and the
+* connection the runtime makes there is a second resolution this code does not
+* see, so a TTL-0 name that flips between answers can still land on a blocked
+* address. Closing that needs the socket pinned to the address checked here,
+* which Node's global `fetch` does not expose without an undici dispatcher.
+* The redirect policy in {@link WebhookDispatcher} closes the much wider
+* version of the same hole — a receiver that simply *points* at the internal
+* address.
+*
+* @throws BlockedUrlError when the destination is not allowed. DNS failures
+* are rethrown as they are, so callers can tell "never send this" from
+* "could not send this right now".
+*/
+async function assertAllowedOutboundUrl(rawUrl, options = {}) {
+	let url;
+	try {
+		url = new URL(rawUrl);
+	} catch {
+		throw new BlockedUrlError(`Invalid webhook URL: ${JSON.stringify(rawUrl)}`);
+	}
+	if (url.protocol !== "https:" && url.protocol !== "http:") throw new BlockedUrlError(`Webhook URL must be http(s), got "${url.protocol}" in ${url.href}`);
+	if (options.allowPrivateNetworks) return url;
+	const hostname = url.hostname.startsWith("[") ? url.hostname.slice(1, -1) : url.hostname;
+	const lowered = hostname.toLowerCase();
+	if (lowered === "localhost" || BLOCKED_HOST_SUFFIXES.some((suffix) => lowered.endsWith(suffix))) throw new BlockedUrlError(`Webhook URL host "${hostname}" is an internal name`);
+	const addresses = isIP(hostname) ? [hostname] : await (options.lookup ?? defaultLookup)(hostname);
+	if (addresses.length === 0) throw new BlockedUrlError(`Webhook URL host "${hostname}" resolved to no addresses`);
+	for (const address of addresses) {
+		const reason = blockedAddressReason(address);
+		if (reason) throw new BlockedUrlError(`Webhook URL host "${hostname}" resolves to ${address}, which is ${reason}. Set allowPrivateNetworks to deliver to it anyway.`);
+	}
+	return url;
+}
+//#endregion
 //#region src/services/webhook-service.ts
+/** Read at most this much of a response before cancelling the rest. */
+var MAX_RESPONSE_BYTES = 64 * 1024;
 var WebhookDispatcher = class {
 	webhooks = [];
 	maxRetries = 3;
@@ -10438,33 +11042,103 @@ var WebhookDispatcher = class {
 		5e3,
 		15e3
 	];
+	options;
+	timeoutMs;
+	queue = [];
+	draining = null;
+	constructor(options = {}) {
+		this.options = options;
+		this.timeoutMs = options.timeoutMs ?? 1e4;
+	}
 	/** Register webhooks to watch */
 	setWebhooks(webhooks) {
 		this.webhooks = webhooks.filter((w) => w.enabled);
 	}
-	/** Called when a entity changes — checks if any webhook matches */
+	/**
+	* Called when a entity changes — checks if any webhook matches, and awaits
+	* every delivery, retries included.
+	*
+	* **Do not await this inside a collection callback.** `afterSave` and
+	* `afterDelete` run inside the write's Postgres transaction, so awaiting a
+	* delivery here holds a pooled connection and the row's locks for as long
+	* as the receiver takes to answer — up to ~36s across three attempts, per
+	* matching webhook. Use {@link enqueueEntityChange} there; this method is
+	* for a custom function or a job that wants the results.
+	*/
 	async onEntityChange(table, event, id, entity, previousEntity) {
-		const matchingWebhooks = this.webhooks.filter((w) => w.table === table && w.events.includes(event));
-		if (matchingWebhooks.length === 0) return [];
+		const jobs = this.buildDeliveries(table, event, entity, previousEntity);
 		const results = [];
-		for (const webhook of matchingWebhooks) {
-			const payload = {
+		for (const job of jobs) {
+			const result = await this.deliverWithRetry(job.webhook, job.event, job.payload);
+			this.options.onDelivery?.(result);
+			results.push(result);
+		}
+		return results;
+	}
+	/**
+	* Queue the same deliveries and return immediately.
+	*
+	* This is the form a collection callback wants. `afterSave` is awaited
+	* *inside* the transaction that wrote the row, so anything it awaits is
+	* transaction time; queueing hands the HTTP to a drain loop that runs
+	* after the callback returns, and the transaction commits without waiting
+	* for a third party. It also means a receiver that is down can no longer
+	* fail the customer's write.
+	*
+	* The cost, stated plainly: the queue is in-process and in-memory. A crash
+	* or a deploy between the enqueue and the delivery drops the event, and a
+	* receiver may see the notification a few milliseconds before the row it
+	* describes is committed. Use {@link flush} on shutdown, and
+	* `onDelivery` to record failures.
+	*/
+	enqueueEntityChange(table, event, id, entity, previousEntity) {
+		const jobs = this.buildDeliveries(table, event, entity, previousEntity);
+		if (jobs.length === 0) return;
+		this.queue.push(...jobs);
+		this.startDraining();
+	}
+	/**
+	* Wait for every queued delivery to finish. For graceful shutdown, and for
+	* tests that need to observe what {@link enqueueEntityChange} sent.
+	*/
+	async flush() {
+		while (this.draining) await this.draining;
+	}
+	startDraining() {
+		if (this.draining) return;
+		const run = this.drainQueue().finally(() => {
+			if (this.draining === run) this.draining = null;
+		});
+		this.draining = run;
+	}
+	async drainQueue() {
+		while (this.queue.length > 0) {
+			const job = this.queue.shift();
+			try {
+				const result = await this.deliverWithRetry(job.webhook, job.event, job.payload);
+				this.options.onDelivery?.(result);
+			} catch {}
+		}
+	}
+	/** The payload each matching webhook gets for this change. */
+	buildDeliveries(table, event, entity, previousEntity) {
+		return this.webhooks.filter((w) => w.table === table && w.events.includes(event)).map((webhook) => ({
+			webhook,
+			event,
+			payload: {
 				type: event,
 				table,
 				record: entity,
 				old_record: event === "UPDATE" ? previousEntity : void 0,
 				schema: "public",
 				timestamp: (/* @__PURE__ */ new Date()).toISOString()
-			};
-			const result = await this.deliverWithRetry(webhook, event, payload);
-			results.push(result);
-		}
-		return results;
+			}
+		}));
 	}
 	async deliverWithRetry(webhook, event, payload) {
 		for (let attempt = 1; attempt <= this.maxRetries; attempt++) {
-			const result = await this.deliver(webhook, event, payload, attempt);
-			if (result.success) return result;
+			const { result, terminal } = await this.deliver(webhook, event, payload, attempt);
+			if (result.success || terminal) return result;
 			if (attempt < this.maxRetries) {
 				const backoff = this.retryDelays[attempt - 1] ?? this.retryDelays[this.retryDelays.length - 1];
 				await new Promise((r) => setTimeout(r, backoff));
@@ -10491,41 +11165,106 @@ var WebhookDispatcher = class {
 			...webhook.headers || {}
 		};
 		if (webhook.secret) headers["X-Webhook-Signature"] = `sha256=${createHmac("sha256", webhook.secret).update(body).digest("hex")}`;
+		const controller = new AbortController();
+		const timeout = setTimeout(() => controller.abort(), this.timeoutMs);
 		try {
-			const controller = new AbortController();
-			const timeout = setTimeout(() => controller.abort(), 1e4);
-			const response = await fetch(webhook.url, {
+			const url = await assertAllowedOutboundUrl(webhook.url, {
+				allowPrivateNetworks: this.options.allowPrivateNetworks,
+				lookup: this.options.lookup
+			});
+			const response = await fetch(url.href, {
 				method: "POST",
 				headers,
 				body,
-				signal: controller.signal
+				signal: controller.signal,
+				redirect: "manual"
 			});
-			clearTimeout(timeout);
-			const responseBody = await response.text().catch(() => "");
+			if (response.status >= 300 && response.status < 400) {
+				const location = typeof response.headers?.get === "function" ? response.headers.get("location") : null;
+				return {
+					terminal: true,
+					result: {
+						webhookId: webhook.id,
+						event,
+						payload,
+						statusCode: response.status,
+						responseBody: `Webhook receivers must not redirect: HTTP ${response.status}` + (location ? ` to ${location}` : "") + ". The redirect target is not re-validated, so it is not followed.",
+						success: false,
+						attemptNumber
+					}
+				};
+			}
+			const responseBody = await this.readCappedBody(response);
 			const success = response.status >= 200 && response.status < 300;
 			return {
-				webhookId: webhook.id,
-				event,
-				payload,
-				statusCode: response.status,
-				responseBody: responseBody.slice(0, 1e3),
-				success,
-				attemptNumber
+				terminal: false,
+				result: {
+					webhookId: webhook.id,
+					event,
+					payload,
+					statusCode: response.status,
+					responseBody: responseBody.slice(0, 1e3),
+					success,
+					attemptNumber
+				}
 			};
 		} catch (error) {
 			const message = error instanceof Error ? error.message : String(error);
 			return {
-				webhookId: webhook.id,
-				event,
-				payload,
-				statusCode: 0,
-				responseBody: message.slice(0, 1e3),
-				success: false,
-				attemptNumber
+				terminal: error instanceof BlockedUrlError,
+				result: {
+					webhookId: webhook.id,
+					event,
+					payload,
+					statusCode: 0,
+					responseBody: message.slice(0, 1e3),
+					success: false,
+					attemptNumber
+				}
 			};
+		} finally {
+			clearTimeout(timeout);
 		}
 	}
+	/**
+	* Read at most {@link MAX_RESPONSE_BYTES} of the response and cancel the
+	* rest, so a receiver cannot buffer a 10 GB body into the pod before the
+	* caller truncates it to 1000 characters.
+	*/
+	async readCappedBody(response) {
+		const stream = response.body;
+		if (!stream || typeof stream.getReader !== "function") return await response.text().catch(() => "");
+		const reader = stream.getReader();
+		const chunks = [];
+		let total = 0;
+		try {
+			for (;;) {
+				const { done, value } = await reader.read();
+				if (done) break;
+				if (!value) continue;
+				chunks.push(value);
+				total += value.byteLength;
+				if (total >= MAX_RESPONSE_BYTES) break;
+			}
+		} catch {
+			return new TextDecoder().decode(concat(chunks, total));
+		} finally {
+			await reader.cancel().catch(() => void 0);
+		}
+		return new TextDecoder().decode(concat(chunks, total));
+	}
 };
+function concat(chunks, total) {
+	const out = new Uint8Array(total);
+	let offset = 0;
+	for (const chunk of chunks) {
+		const room = out.length - offset;
+		if (room <= 0) break;
+		out.set(chunk.length > room ? chunk.subarray(0, room) : chunk, offset);
+		offset += chunk.length;
+	}
+	return out;
+}
 //#endregion
 //#region src/utils/dev-port.ts
 var MAX_PORT_ATTEMPTS = 20;
@@ -10686,10 +11425,11 @@ function isUnderPath(requestPath, prefix) {
 * Serve a Single Page Application from an Hono app.
 *
 * @internal Not part of the stable public API. Exported only because the
-* official app template (`packages/cli/templates/template/backend/src/index.ts`
-* and `app/backend/src/index.ts`) calls it to serve the built frontend in
-* production. Its request-handling behavior is an implementation detail and
-* may change without a major version bump.
+* entrypoint `rebase eject` writes
+* (`packages/cli/templates/eject/backend/src/index.ts`) and `app/backend/src/index.ts`
+* call it to serve the built frontend in production — the scaffolded template
+* has no entrypoint of its own. Its request-handling behavior is an
+* implementation detail and may change without a major version bump.
 */
 function serveSPA(app, config) {
 	const { frontendPath, apiBasePath = "/api", excludePaths = [], indexFile = "index.html", spa = true } = config;
@@ -11833,6 +12573,7 @@ function resolveAuthOptions(env, usersCollection) {
 		requireAuth: env.AUTH_REQUIRE,
 		allowRegistration: env.ALLOW_REGISTRATION,
 		disableSelfRegistration: env.DISABLE_SELF_REGISTRATION,
+		allowAnonymous: env.ALLOW_ANONYMOUS,
 		allowUserLookup: env.AUTH_ALLOW_USER_LOOKUP,
 		email: resolveEmailOptions(env),
 		cookieAuth: { sameSite: env.AUTH_COOKIE_SAME_SITE || "Lax" }
@@ -12240,7 +12981,7 @@ async function bootFromBundle(options = {}) {
 	const bundleDir = options.bundleDir || fetchedDir || process.env.REBASE_BUNDLE || path.resolve(process.cwd(), "dist-bundle");
 	const bundle = options.bundle ?? loadBundle(bundleDir);
 	const devRoot = process.env.REBASE_DEV_PROJECT_ROOT || process.cwd();
-	logger.info("Loaded bundle", {
+	logger.debug("Loaded bundle", {
 		app: bundle.manifest.app,
 		kind: bundle.manifest.kind,
 		schemaVersion: bundle.manifest.schemaVersion,
@@ -12611,8 +13352,9 @@ async function ensureCollectionSchema(bundle, dataSources, env) {
 		skip(`none of the ${loaded.length} declared collection(s) are stored by the "${primary.engine}" data source.`);
 		return;
 	}
-	const { applied } = await primary.bootstrapper.ensureCollectionSchema(collections, preInitDriverResult(primary), (message) => logger.info(`schema: ${message}`));
-	logger.info(applied > 0 ? `Applied ${applied} additive schema change(s) before boot.` : "Collection schema is up to date.");
+	const { applied } = await primary.bootstrapper.ensureCollectionSchema(collections, preInitDriverResult(primary), (message) => logger.debug(`schema: ${message}`));
+	if (applied > 0) logger.info(`Applied ${applied} additive schema change(s) before boot.`);
+	else logger.debug("Collection schema is up to date.");
 }
 /**
 * The `InitializedDriver` to hand a bootstrapper before any driver exists.
@@ -12657,17 +13399,18 @@ async function ensureCollectionPolicies(bundle, dataSources, env) {
 	if (!primary) return;
 	if (!primary.bootstrapper.ensureCollectionPolicies) {
 		const skew = describeDriverSkew(primary.driverVersion, readRuntimeVersion(bundleResolutionRoots(bundle.dir)));
-		logger.warn(`Collection policies: skipped — the "${primary.driverPackage}" driver (engine "${primary.engine}") does not apply RLS policies at boot. ` + (skew.detail ? `${skew.detail} ` : "") + "Collections will deny reads until policies are applied.\n" + schemaRecoveryGuidance({ staleDriver: skew.stale }));
+		logger.warn(`Collection policies: skipped — the "${primary.driverPackage}" driver (engine "${primary.engine}") does not apply RLS policies at boot. ` + (skew.detail ? `${skew.detail} ` : "") + "Collections are not row-secured until policies are applied — depending on the driver's grants that means reads are denied or that they are unfiltered. Do not serve traffic until this is resolved.\n" + schemaRecoveryGuidance({ staleDriver: skew.stale }));
 		return;
 	}
 	const loaded = await loadCollectionsFromDirectory(bundle.collectionsDir);
 	if (loaded.length === 0) return;
 	const collections = collectionsStoredBy(loaded, primary, dataSources);
 	if (collections.length === 0) return;
-	const { applied } = await primary.bootstrapper.ensureCollectionPolicies(collections, preInitDriverResult(primary), (message) => logger.info(`policies: ${message}`));
-	logger.info(applied > 0 ? `Applied ${applied} RLS policy statement(s) before serving.` : "RLS policies are up to date.");
+	const { applied } = await primary.bootstrapper.ensureCollectionPolicies(collections, preInitDriverResult(primary), (message) => logger.debug(`policies: ${message}`));
+	if (applied > 0) logger.info(`Applied ${applied} RLS policy statement(s) before serving.`);
+	else logger.debug("RLS policies are up to date.");
 }
 //#endregion
-export { ApiError, BundleError, CronScheduler, DEFAULT_DRIVER_ID, DEFAULT_MAX_FILE_SIZE, DEFAULT_STORAGE_ID, DOCUMENT_MIME_TYPES, DefaultDriverRegistry, DefaultStorageRegistry, GCSStorageController, IMAGE_MIME_TYPES, LocalStorageController, MetricsRegistry, S3StorageController, SMTPEmailService, TransformCache, TusHandler, WebhookDispatcher, _resetRebaseMock, _setRebaseMock, applyCollectionDefaults, assertCollectionConfigs, assertDistinctSuffixes, authJwt, authRoles, authUid, bootFromBundle, classifySurface, cleanupDevPortFile, createAppleProvider, createBackupRoutes, createBitbucketProvider, createBuiltinAuthAdapter, createContractRoutes, createCronRoutes, createCronStore, createCustomAuthAdapter, createDiscordProvider, createEmailService, createFacebookProvider, createFunctionRoutes, createGitHubProvider, createGitLabProvider, createGoogleProvider, createHistoryRoutes, createLinkedinProvider, createMetricsMiddleware, createMetricsRoutes, createMicrosoftProvider, createSlackProvider, createSourceBundle, createSpotifyProvider, createStorageController, createStorageRoutes, createTwitterProvider, defineCron, defineFunction, envSuffixForKey, errorHandler, extractUserFromToken, fileTokenAuth, findCollectionConfigProblems, generateSecurePassword, getEmailVerificationTemplate, getMagicLinkTemplate, getPasswordResetTemplate, getUserInvitationTemplate, getWelcomeEmailTemplate, hashPassword, httpMethodToOperation, initializeDataSource, initializeDataSources, initializeRebaseBackend, installShutdownHandlers, isApiKeyToken, isAuthAdapter, isDatabaseAdapter, isLocalhostOrigin, isOperationAllowed, isTransformableImage, listBackupObjects, listenWithPortRetry, loadBootEnv, loadBundle, loadBundleConfigExports, loadBundleSchema, loadCollectionsFromDirectory, loadCronJobsFromDirectory, loadDeclaredStorageSources, loadEnv, loadFunctionsFromDirectory, loadUsersCollection, logger, optionalAuth, parseBackupDestination, parseBackupTimestamp, parseTransformOptions, queryTokenAuth, readBackupBytes, readBundleManifest, rebase, requireAdmin, requireAuth, resolveAuthHooks, resolveAuthOptions, resolveCorsOrigin, resolveDataSources, resolveEmailOptions, resolveRequireAuth, resolveStorageBackend, resolveStorageSources, runFromBundle, safeCompare, serveSPA, transformImage, unknownKeyPolicyFromEnv, validateApiKey, validateCronExpression, validatePasswordStrength, verifyPassword };
+export { ApiError, BlockedUrlError, BundleError, CronScheduler, DEFAULT_DRIVER_ID, DEFAULT_MAX_FILE_SIZE, DEFAULT_STORAGE_ID, DOCUMENT_MIME_TYPES, DefaultDriverRegistry, DefaultStorageRegistry, GCSStorageController, IMAGE_MIME_TYPES, LocalStorageController, MetricsRegistry, RawHtml, S3StorageController, SMTPEmailService, TransformCache, TusHandler, WebhookDispatcher, _resetRebaseMock, _setRebaseMock, applyCollectionDefaults, assertAllowedOutboundUrl, assertCollectionConfigs, assertDistinctSuffixes, assertEmailLinkBases, authJwt, authRoles, authUid, blockedAddressReason, bootFromBundle, classifySurface, cleanupDevPortFile, createAppleProvider, createBackupRoutes, createBitbucketProvider, createBuiltinAuthAdapter, createContractRoutes, createCronRoutes, createCronStore, createCustomAuthAdapter, createDiscordProvider, createEmailService, createFacebookProvider, createFunctionRoutes, createGitHubProvider, createGitLabProvider, createGoogleProvider, createHistoryRoutes, createLinkedinProvider, createMetricsMiddleware, createMetricsRoutes, createMicrosoftProvider, createSlackProvider, createSourceBundle, createSpotifyProvider, createStorageController, createStorageRoutes, createTwitterProvider, defineCron, defineFunction, envSuffixForKey, errorHandler, escapeHtml, extractUserFromToken, fileTokenAuth, findCollectionConfigProblems, generateSecurePassword, getEmailVerificationTemplate, getMagicLinkTemplate, getPasswordResetTemplate, getUserInvitationTemplate, getWelcomeEmailTemplate, hashPassword, html, httpMethodToOperation, initializeDataSource, initializeDataSources, initializeRebaseBackend, installShutdownHandlers, isApiKeyToken, isAuthAdapter, isDatabaseAdapter, isLocalhostOrigin, isOperationAllowed, isTransformableImage, listBackupObjects, listenWithPortRetry, loadBootEnv, loadBundle, loadBundleConfigExports, loadBundleSchema, loadCollectionsFromDirectory, loadCronJobsFromDirectory, loadCronJobsWithDiagnostics, loadDeclaredStorageSources, loadEnv, loadFunctionsFromDirectory, loadUsersCollection, logger, oauthCodeFlowSchema, optionalAuth, parseBackupDestination, parseBackupTimestamp, parseTransformOptions, pkceTokenParams, providerVerifiedEmail, queryTokenAuth, raw, readBackupBytes, readBundleManifest, rebase, requireAdmin, requireAuth, resolveAuthHooks, resolveAuthOptions, resolveCorsOrigin, resolveDataSources, resolveEmailLinkBase, resolveEmailOptions, resolveRequireAuth, resolveStorageBackend, resolveStorageSources, runFromBundle, safeCompare, serveSPA, transformImage, tryVerifyOidcIdToken, unknownKeyPolicyFromEnv, validateApiKey, validateCronExpression, validatePasswordStrength, verifyOidcIdToken, verifyPassword };
 
 //# sourceMappingURL=index.es.js.map