@rebasepro/server 0.14.0 → 0.14.1

package/dist/index.es.js

@@ -1,15 +1,15 @@
 import { createRequire as __createRequire } from "module";
 import process from "process";
 __createRequire(import.meta.url);
-import { A as RebaseApiError, D as EntityRelation, E as EntityReference, O as GeoPoint, _ as resolveCollectionRelations, b as toSnakeCase, c as collectAllPages, d as CollectionRegistry, f as createDataSourceRegistry, g as findRelation, h as fieldKeyForColumn, j as RebaseClientError, k as Vector, l as paginateFind, m as getEffectiveSecurityRules, n as buildSdkData, o as serializeFilter, p as resolveDataSource, s as serializeLogicalCondition, t as buildRoutedRebaseData, u as resolveFindWindow, v as buildCompositeId, y as resolvePrimaryKeys } from "./src-C7rkDGxA.js";
+import { A as GeoPoint, M as RebaseApiError, N as RebaseClientError, O as EntityReference, S as toSnakeCase, _ as fieldKeyForColumn, b as buildCompositeId, c as collectAllPages, d as normalizeOrderBy, f as serializeOrderBy, g as getEffectiveSecurityRules, h as resolveDataSource, j as Vector, k as EntityRelation, l as paginateFind, m as createDataSourceRegistry, n as buildSdkData, o as serializeFilter, p as CollectionRegistry, s as serializeLogicalCondition, t as buildRoutedRebaseData, u as resolveFindWindow, v as findRelation, x as resolvePrimaryKeys, y as resolveCollectionRelations } from "./src-8XDWyDfR.js";
 import { c as DEFAULT_DATA_SOURCE_KEY, i as getCollectionDataPath, m as toCanonicalOp, n as RLS_ROLES_SQL, o as isPostgresCollectionConfig, r as RLS_UID_SQL, t as RLS_JWT_SQL } from "./src-Cz9nMgUR.js";
 import { n as ADMIN_PROPERTY_KEYS, t as ADMIN_COLLECTION_KEYS } from "./admin_block-H86dCPsj.js";
-import { i as isSQLAdmin, r as revokeInternalTableSql } from "./ddl-bootstrap-BhXbTnBl.js";
+import { a as isDuplicateObjectRace, i as isConcurrentDdlRace, n as createDdlBootstrapper, o as revokeInternalTableSql, s as isSQLAdmin, t as CONCURRENT_DDL_SQLSTATES } from "./ddl-bootstrap-Cywoj8Ta.js";
+import { C as canonicalStorageKey, D as findStorageSuffixCollision, E as DEFAULT_STORAGE_SOURCE_KEY, O as normalizeStorageSources, S as canonicalStorageId, b as InvalidStorageKeyError, c as getJwks, d as hasAsymmetricSigningKey, i as generateDownloadToken, k as storageEnvSuffix, n as configureJwt, p as isJwtConfigured, v as normalizePemFromEnv, x as canonicalStorageBucket, y as InvalidStorageBucketError } from "./jwt-VJyXTdQQ.js";
 import { n as createContractRoutes } from "./contract-routes-Bet-eCNJ.js";
-import { $ as fileTokenAuth, A as MemoryRateLimitStore, B as getEmailVerificationTemplate, C as ZodNumber, Ct as isPublicStoragePath, D as _coercedNumber, E as string, F as resolveAuthHooks, G as RawHtml, H as getPasswordResetTemplate, I as hashPassword, J as raw, K as escapeHtml, L as validatePasswordStrength, M as createEmailService, N as assertEmailLinkBases, O as DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT, P as resolveEmailLinkBase, Q as extractUserFromToken, R as verifyPassword, S as createBuiltinAuthAdapter, St as PUBLIC_STORAGE_PREFIX, T as object, U as getUserInvitationTemplate, V as getMagicLinkTemplate, W as getWelcomeEmailTemplate, X as createAuthMiddleware, Y as createAdapterAuthMiddleware, Z as createRequireAuth, _ as createLinkedinProvider, _t as scopeDataDriver, a as createSpotifyProvider, at as InvalidStorageBucketError, b as pkceTokenParams, bt as parseQueryOptions, c as createGitLabProvider, ct as canonicalStorageKey, d as createFacebookProvider, dt as createStorageApiKeyGuard, et as optionalAuth, f as createAppleProvider, ft as isApiKeyToken, g as createGitHubProvider, gt as SERVICE_IDENTITY, h as verifyOidcIdToken, ht as safeCompare, i as createApiKeyStore, it as requireAuth, j as SMTPEmailService, k as createDataRateLimiter, l as createDiscordProvider, lt as createApiKeyPreAuth, m as tryVerifyOidcIdToken, mt as extractBearerToken, n as createCustomAuthAdapter, nt as queryTokenAuth, o as createSlackProvider, ot as InvalidStorageKeyError, p as createMicrosoftProvider, pt as validateApiKey, q as html, r as createApiKeyRoutes, rt as requireAdmin, s as createBitbucketProvider, st as canonicalStorageBucket, tt as publicObjectAuth, u as createTwitterProvider, ut as createFunctionApiKeyGuard, v as createGoogleProvider, vt as httpMethodToOperation, w as _enum, x as providerVerifiedEmail, xt as resolveListLimitParam, y as oauthCodeFlowSchema, yt as isOperationAllowed, z as generateSecurePassword } from "./auth-CYoPVf-E.js";
+import { $ as extractUserFromToken, A as createDataRateLimiter, B as generateSecurePassword, C as createBuiltinAuthAdapter, Ct as isPublicStoragePath, D as string, E as object, F as resolveEmailLinkBase, G as getWelcomeEmailTemplate, H as getMagicLinkTemplate, I as resolveAuthHooks, J as html, K as RawHtml, L as hashPassword, M as SMTPEmailService, N as createEmailService, O as _coercedNumber, P as assertEmailLinkBases, Q as createRequireAuth, R as validatePasswordStrength, S as createJwksRoutes, St as PUBLIC_STORAGE_PREFIX, T as _enum, U as getPasswordResetTemplate, V as getEmailVerificationTemplate, W as getUserInvitationTemplate, X as createAdapterAuthMiddleware, Y as raw, Z as createAuthMiddleware, _ as createLinkedinProvider, _t as orderByEntriesToTuples, a as createSpotifyProvider, at as requireAuth, b as pkceTokenParams, bt as parseQueryOptions, c as createGitLabProvider, ct as createStorageApiKeyGuard, d as createFacebookProvider, dt as extractBearerToken, et as fileTokenAuth, f as createAppleProvider, ft as safeCompare, g as createGitHubProvider, gt as isOperationAllowed, h as verifyOidcIdToken, ht as httpMethodToOperation, i as createApiKeyStore, it as requireAdmin, j as MemoryRateLimitStore, k as DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT, l as createDiscordProvider, lt as isApiKeyToken, m as tryVerifyOidcIdToken, mt as scopeDataDriver, n as createCustomAuthAdapter, nt as publicObjectAuth, o as createSlackProvider, ot as createApiKeyPreAuth, p as createMicrosoftProvider, pt as SERVICE_IDENTITY, q as escapeHtml, r as createApiKeyRoutes, rt as queryTokenAuth, s as createBitbucketProvider, st as createFunctionApiKeyGuard, tt as optionalAuth, u as createTwitterProvider, ut as validateApiKey, v as createGoogleProvider, vt as parseAggregateSelect, w as ZodNumber, x as providerVerifiedEmail, xt as resolveListLimitParam, y as oauthCodeFlowSchema, yt as parseGroupBy, z as verifyPassword } from "./auth-BobZVd0j.js";
 import { t as logger } from "./logger-DfvF_8r-.js";
 import { n as errorHandler, t as ApiError } from "./errors-EBYiaJ2E.js";
-import { i as generateDownloadToken, n as configureJwt } from "./jwt-_IFqfTOg.js";
 import { t as logMiddleware } from "./logs-routes-BYA72C_C.js";
 import { n as DOCUMENT_MIME_TYPES, r as IMAGE_MIME_TYPES, t as DEFAULT_MAX_FILE_SIZE } from "./types-DSnOC4mF.js";
 import { t as S3StorageController } from "./S3StorageController-B2EDXXMH.js";
@@ -19,8 +19,10 @@ import { t as createFunctionRoutes } from "./function-routes-Btcez1T-.js";
 import { n as loadCronJobsFromDirectory, r as loadCronJobsWithDiagnostics } from "./cron-loader-YhhQeVBM.js";
 import { r as validateCronExpression, t as CronScheduler } from "./cron-scheduler-DIpYBmZP.js";
 import { t as createCronRoutes } from "./cron-routes-maM_RlUu.js";
-import { t as createCronStore } from "./cron-store-Dvr4Y1sZ.js";
+import { t as createCronStore } from "./cron-store-CB1x-Ken.js";
 import { a as parseBackupTimestamp, i as parseBackupDestination, n as createBackupRoutes, o as readBackupBytes, r as listBackupObjects } from "./backup-C6ljYVTp.js";
+import { i as createJobStore, n as createJobQueue, r as defaultBackoff } from "./jobs-DR4SjGrD.js";
+import { t as FunctionSelectionError } from "./selection-_z6TM1DB.js";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import * as fs$2 from "fs";
 import fs, { existsSync } from "fs";
@@ -49,153 +51,6 @@ import { secureHeaders } from "hono/secure-headers";
 import { getRequestListener } from "@hono/node-server";
 import { execFile } from "node:child_process";
 import { promisify as promisify$1 } from "node:util";
-//#region ../types/src/types/storage_source.ts
-/**
-* Describes a named storage backend — a place files live.
-*
-* Declared once and shared front + back: the frontend uses it to decide
-* transport (HTTP proxy vs direct SDK), the backend uses the same `key`
-* to resolve a StorageController, and collection properties reference
-* a definition by its `key` via `StorageConfig.storageSource`.
-*
-* This mirrors the {@link DataSourceDefinition} pattern used for databases.
-*
-* @group Models
-*/
-/**
-* The default storage source key, used when a property does not specify
-* a `storageSource`. Shared by the frontend and backend registries so
-* both agree on "the default storage backend".
-* @group Models
-*/
-var DEFAULT_STORAGE_SOURCE_KEY = "(default)";
-/**
-* The environment-variable suffix for a storage or data source key.
-*
-* `""` for the default source — so a single-bucket project keeps configuring
-* plain `S3_BUCKET` — and `__<KEY>` for every named one, uppercased with
-* non-alphanumerics collapsed to underscores: `media-cdn` → `S3_BUCKET__MEDIA_CDN`.
-*
-* The rule derives the variable name from the declared key rather than
-* discovering keys by scanning the environment. Scanning would have to guess how
-* `S3_BUCKET__MEDIA_CDN` splits into a key; deriving cannot be ambiguous, and a
-* typo surfaces as a missing source at boot instead of a silently ignored
-* variable.
-*
-* It lives in this package, with no dependencies, because four things must agree
-* on it exactly: the CLI (validating a build), the runtime (reading its own
-* environment), the control plane (writing a tenant's Secret), and the docs. A
-* second implementation of a naming convention is a second chance to disagree.
-*
-* @group Models
-*/
-function storageEnvSuffix(key, defaultKey = DEFAULT_STORAGE_SOURCE_KEY) {
-	if (!key || key === defaultKey) return "";
-	const normalized = key.replace(/[^A-Za-z0-9]+/g, "_").replace(/^_+|_+$/g, "").toUpperCase();
-	if (!normalized) throw new Error(`Source key "${key}" cannot be turned into an environment variable name. Use a key containing at least one letter or digit.`);
-	return `__${normalized}`;
-}
-/**
-* Two distinct keys that collapse onto the same variable name, or `null`.
-*
-* `media-cdn` and `media_cdn` are different source keys but the same suffix, so
-* without this one of them silently reads the other's configuration. Returns the
-* offending pair rather than throwing, so each caller can raise it in its own
-* idiom — a `BundleError` at boot, a build failure in the CLI, a rejected deploy
-* in a control plane.
-*
-* @group Models
-*/
-function findStorageSuffixCollision(keys, defaultKey = DEFAULT_STORAGE_SOURCE_KEY) {
-	const seen = /* @__PURE__ */ new Map();
-	for (const key of keys) {
-		const suffix = storageEnvSuffix(key, defaultKey);
-		const existing = seen.get(suffix);
-		if (existing !== void 0 && existing !== key) return {
-			a: existing,
-			b: key,
-			suffix
-		};
-		seen.set(suffix, key);
-	}
-	return null;
-}
-/**
-* Merge the two places a project may declare storage sources into one list.
-*
-* `rebase.json` is authoritative for every field it states. Config code may add
-* sources it does not mention and fill in fields it left out, but may not
-* contradict it: the manifest is what a host reads to decide which buckets need
-* configuring, and a runtime that quietly disagreed with it would put the
-* console back to describing a topology the tenant does not have — the exact
-* failure this whole mechanism exists to end.
-*
-* Note what is *not* here: no default source is invented when both inputs are
-* empty. That decision belongs to the resolver, which knows whether declaring
-* nothing means "one plain bucket" (it does) or "no storage at all".
-*
-* @group Models
-*/
-function normalizeStorageSources(declared, exported) {
-	const merged = /* @__PURE__ */ new Map();
-	const declaredEntries = Array.isArray(declared) ? declared.filter((d) => d?.key).map((d) => [d.key, d]) : Object.entries(declared ?? {});
-	for (const [key, config] of declaredEntries) merged.set(key, {
-		key,
-		engine: config.engine,
-		transport: config.transport ?? "server",
-		...config.label !== void 0 ? { label: config.label } : {}
-	});
-	for (const definition of exported ?? []) {
-		if (!definition?.key) continue;
-		const existing = merged.get(definition.key);
-		if (!existing) {
-			merged.set(definition.key, {
-				key: definition.key,
-				engine: definition.engine,
-				transport: definition.transport ?? "server",
-				...definition.label !== void 0 ? { label: definition.label } : {}
-			});
-			continue;
-		}
-		if (existing.label === void 0 && definition.label !== void 0) existing.label = definition.label;
-	}
-	return Array.from(merged.values());
-}
-//#endregion
-//#region ../common/src/data/sort-dialect.ts
-/**
-* Sort-order wire codec.
-*
-* This is the ONLY module that knows about the colon-delimited wire format
-* (`"field:direction"`) used in HTTP query parameters.
-* Everything else speaks {@link OrderByTuple} exclusively.
-*
-* Mirrors the filter architecture in `filter-dialect.ts`.
-*
-* @module
-*/
-/**
-* Serialize an {@link OrderByTuple} to the wire format `"field:direction"`.
-*
-* **Runtime tolerance:** if the input is already a well-formed wire string
-* (from an untyped JS caller), it is returned unchanged.
-* This is undocumented tolerance, not public API — don't rely on it.
-*
-* @param orderBy - A canonical `[field, direction]` tuple, or at runtime
-*   possibly a pre-serialized string (undocumented tolerance).
-* @returns The wire-format string, or `undefined` if the input is falsy.
-*
-* @remarks
-* Field names containing `:` are representable in the tuple form but
-* **not** on the wire — this is an inherent limitation of the colon-delimited
-* encoding and is not resolved here.
-*/
-function serializeOrderBy(orderBy) {
-	if (!orderBy) return void 0;
-	if (typeof orderBy === "string") return orderBy;
-	return `${orderBy[0]}:${orderBy[1]}`;
-}
-//#endregion
 //#region src/collections/BackendCollectionRegistry.ts
 /**
 * Backend-agnostic collection registry.
@@ -673,6 +528,344 @@ async function loadCollectionsFromDirectory(source, options = {}) {
 	return validate(applyCollectionDefaults(collections, await readDefaults(resolved)));
 }
 //#endregion
+//#region src/boot/version-skew.ts
+/**
+* Telling a *stale* driver apart from a driver that never had the feature.
+*
+* The managed runtime is two halves that version independently. The image
+* supplies `@rebasepro/server` — `docker/entrypoint.mjs` symlinks it over
+* whatever the bundle installed, so the boot harness is always the image's. The
+* **driver** is not redirected: `@rebasepro/server-postgres` comes from the
+* bundle's `deps.declared`, pinned to whatever the project's `package.json`
+* asked npm for. Shipping a new image therefore does not ship a new driver, and
+* a fix that spans both packages reaches a tenant only after an npm publish AND
+* a rebuild.
+*
+* That split has a nasty failure mode, and it has already burned a day. Boot
+* looks for an optional capability, does not find it, and reports the honest
+* local fact — "this driver does not implement collection-table creation" —
+* which is exactly what a schemaless driver looks like. But a driver that is
+* merely *older than the runtime asking* looks identical, and the two want
+* opposite responses: one is "this database is not managed by Rebase, carry on",
+* the other is "your tables were never created and every data route is about to
+* 500". Naming the versions is what separates them, so these helpers exist to
+* put both numbers in front of whoever reads the log.
+*/
+/** The package whose version defines "the runtime" for skew purposes. */
+var RUNTIME_PACKAGE = "@rebasepro/server";
+/**
+* Locate a package by walking `node_modules` up from a directory.
+*
+* Lives here rather than in `driver.ts` because both the driver loader and the
+* version check need it, and `driver.ts` already imports this module.
+*/
+function findPackageDir(fromDir, packageName) {
+	let dir = path.resolve(fromDir);
+	for (;;) {
+		const candidate = path.join(dir, "node_modules", ...packageName.split("/"));
+		if (fs.existsSync(path.join(candidate, "package.json"))) return candidate;
+		const parent = path.dirname(dir);
+		if (parent === dir) return void 0;
+		dir = parent;
+	}
+}
+/**
+* Parse the subset of semver the workspace actually publishes.
+*
+* Deliberately lenient: an unparseable version yields `undefined` and every
+* comparison then declines to judge, because a wrong "your driver is old"
+* warning on a fork's custom version string is worse than no warning at all.
+*/
+function parseVersion(version) {
+	const match = /^(\d+)\.(\d+)\.(\d+)(?:-(.+))?$/.exec(version.trim());
+	if (!match) return void 0;
+	return {
+		parts: [
+			Number(match[1]),
+			Number(match[2]),
+			Number(match[3])
+		],
+		prerelease: match[4]
+	};
+}
+/**
+* Compare two versions, or `undefined` when either cannot be parsed.
+*
+* Follows semver on the one rule that matters here: a prerelease sorts *below*
+* the release it leads to, so `0.12.1-canary.g7f1150f` < `0.12.1`. Without that
+* rule every canary would read as newer than the stable it precedes, and the
+* canaries are precisely where fixes land first.
+*/
+function compareVersions(a, b) {
+	const left = parseVersion(a);
+	const right = parseVersion(b);
+	if (!left || !right) return void 0;
+	for (let i = 0; i < 3; i++) if (left.parts[i] !== right.parts[i]) return left.parts[i] < right.parts[i] ? -1 : 1;
+	if (left.prerelease === right.prerelease) return 0;
+	if (left.prerelease === void 0) return 1;
+	if (right.prerelease === void 0) return -1;
+	return left.prerelease < right.prerelease ? -1 : 1;
+}
+/**
+* Describe how a driver's version relates to the runtime asking it for work.
+*
+* Returns `stale: false` whenever it cannot tell — an unknown version, an
+* unparseable one, a driver that is newer. Silence beats a confident wrong
+* diagnosis, and the caller still prints its own local fact either way.
+*/
+function describeDriverSkew(driverVersion, runtimeVersion) {
+	if (!driverVersion || !runtimeVersion) return { stale: false };
+	const order = compareVersions(driverVersion, runtimeVersion);
+	if (order === void 0) return { stale: false };
+	if (order < 0) return {
+		stale: true,
+		detail: `The driver is at ${driverVersion} while this runtime is ${runtimeVersion} — the driver is OLDER, so this is very likely a stale pin rather than a driver that never had the capability.`
+	};
+	return {
+		stale: false,
+		detail: `Driver ${driverVersion}, runtime ${runtimeVersion}.`
+	};
+}
+/**
+* How to get a project's schema applied, written once and owned by the runtime.
+*
+* This text lives in `@rebasepro/server` on purpose. The equivalent guidance in
+* the Postgres driver's schema-drift warning can only ever be as current as the
+* driver a tenant pinned — so the tenants who most need to be told "your driver
+* is too old" are exactly the ones whose driver still prints the old advice.
+* The image's copy of this package is never stale, so guidance printed from
+* here always reflects the platform as it is today.
+*
+* Both audiences get a line because the runtime cannot reliably tell which one
+* it is serving, and naming only the pnpm scripts — as this once did everywhere
+* — tells a managed operator to run a command that structurally cannot reach
+* their in-cluster database.
+*/
+function schemaRecoveryGuidance(options = {}) {
+	const lines = [
+		"  To apply this project's schema:",
+		"    • Managed cloud: the runtime applies tables and RLS at boot (unless",
+		"      REBASE_MIGRATE_ON_BOOT=none). `rebase db push` cannot reach a tenant's",
+		"      in-cluster database — redeploy instead."
+	];
+	if (options.staleDriver) lines.push("      Because the driver is pinned by your bundle, bump the", "      `@rebasepro/server-postgres` version in your project's package.json", "      and redeploy — a newer platform image alone will NOT update it.");
+	lines.push("    • Self-host: run `rebase db push` (dev) or `rebase db migrate` (prod).");
+	return lines.join("\n");
+}
+/**
+* The installed version of a package, read from its `package.json`.
+*
+* Returns `undefined` rather than throwing for every failure — a missing or
+* malformed manifest degrades the diagnosis, and must never take down a boot
+* that would otherwise have served.
+*/
+function readPackageVersion(packageDir) {
+	try {
+		const pkg = JSON.parse(fs.readFileSync(path.join(packageDir, "package.json"), "utf8"));
+		return typeof pkg.version === "string" ? pkg.version : void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* The version of `@rebasepro/server` this deployment is actually running.
+*
+* Resolved from the same roots the drivers are, and that is the point rather
+* than a convenience. In a managed container `docker/entrypoint.mjs` replaces
+* `/bundle/node_modules/@rebasepro/server` with a link to the image's copy, so
+* reading the manifest *through the bundle* reports the version that will
+* really execute — which is exactly the number the driver has to be compared
+* against. Reading this package's own manifest by module path would report the
+* same thing in the happy case and quietly lie in the case that matters: a
+* bundle whose link did not happen.
+*
+* Returns `undefined` when the package cannot be found; every caller treats
+* that as "cannot judge" and stays quiet.
+*/
+function readRuntimeVersion(roots) {
+	for (const root of roots) {
+		const dir = findPackageDir(root, RUNTIME_PACKAGE);
+		const version = dir ? readPackageVersion(dir) : void 0;
+		if (version) return version;
+	}
+}
+//#endregion
+//#region src/boot/provision.ts
+/**
+* Name the object that is missing a method, in a way that points somewhere.
+*
+* What is missing is the method on the ADAPTER — the only object this module
+* ever sees — which is not the same as the driver package lacking the code. So
+* a resolved package name is quoted as the adapter's *origin*, and an adapter
+* the application built itself is described as exactly that, with no package
+* name attached for the reader to go and bump.
+*/
+function describeAdapter(target) {
+	return target.driverPackage ? `the adapter from "${target.driverPackage}" (engine "${target.engine}")` : `this project's "${target.engine}" adapter`;
+}
+function provisioningDisabled(env = process.env) {
+	return (env.REBASE_MIGRATE_ON_BOOT || "ensure") === "none";
+}
+/**
+* Create any collection tables the database is missing, before serving.
+*
+* Additive only: the driver may create missing tables, columns and enum types,
+* and may never drop or rewrite. Destructive changes stay a deliberate
+* migration, because this runs unattended with nobody reading a diff.
+*
+* Every path out of here says why, at info or louder. Guaranteeing the tables
+* exist is this function's entire job, so "it declined, and said nothing" is the
+* one outcome it must never produce: a deployment that skips comes up answering
+* sign-in and 500ing every `/api/data/*` route, and the operator's only evidence
+* is what these lines print.
+*
+* Note that silence is still possible one level up — if nothing CALLS this, no
+* line is printed and the absence is the only signal. That is precisely the bug
+* this module was extracted to make structurally impossible, and it is why the
+* outcome is reported back to the driver rather than only logged.
+*
+* Failure is fatal on purpose. Booting anyway would produce exactly the state
+* this exists to prevent, and a crash-looping pod with the DDL error in its logs
+* is a far better signal than a running one that silently cannot serve.
+*/
+async function provisionCollectionTables(collections, target, options = {}) {
+	const skip = (reason, level = "info") => {
+		logger[level](`Collection schema: skipped — ${reason}`);
+		return {
+			status: "skipped",
+			reason
+		};
+	};
+	if (options.provision === false) return skip("this process does not provision the schema — another process in this deployment owns it.");
+	if (provisioningDisabled(options.env ?? process.env)) return skip("REBASE_MIGRATE_ON_BOOT=none, leaving the database schema untouched.");
+	if (options.introspecting) return skip("this project declares no collections, so they are read from the database rather than from code.");
+	if (collections.length === 0) return skip("no collections resolved for this data source.");
+	if (!target.bootstrapper.ensureCollectionSchema) return skip(`${describeAdapter(target)} does not expose collection-table creation. The driver package may well implement it on a class the adapter does not forward, so check the adapter's shape before blaming its version. Collection tables will NOT be created, so every /api/data route will fail on a missing relation.
+` + schemaRecoveryGuidance(), "warn");
+	const { applied } = await target.bootstrapper.ensureCollectionSchema(collections, target.driverResult, (message) => logger.debug(`schema: ${message}`));
+	if (applied > 0) logger.info(`Applied ${applied} additive schema change(s) before boot.`);
+	else logger.debug("Collection schema is up to date.");
+	return {
+		status: "applied",
+		applied
+	};
+}
+/**
+* Apply the collections' RLS policies — the companion to
+* {@link provisionCollectionTables}, which creates the tables this makes
+* servable.
+*
+* Runs after auth is initialized, not alongside table creation: the generated
+* policies call the `auth.*` helper functions and `CREATE POLICY` validates
+* those exist. Tables without policies are not servable either — authenticated
+* requests run as a restricted role, so a read with no policy returns nothing.
+*
+* The benign gates return quietly here rather than logging the same reason
+* twice: table provisioning already ran on this same boot and explained itself.
+* The one thing this does say out loud is a driver that created tables but
+* cannot apply policies — that is the difference between a served collection and
+* a 401, and it must not pass in silence.
+*/
+async function provisionCollectionPolicies(collections, target, options = {}) {
+	if (options.provision === false) {
+		logger.info("Collection RLS policies: not applied by this process — another process in this deployment owns them.");
+		return {
+			status: "skipped",
+			reason: "another process provisions"
+		};
+	}
+	if (provisioningDisabled(options.env ?? process.env)) return {
+		status: "skipped",
+		reason: "REBASE_MIGRATE_ON_BOOT=none"
+	};
+	if (options.introspecting) return {
+		status: "skipped",
+		reason: "collections are introspected"
+	};
+	if (collections.length === 0) return {
+		status: "skipped",
+		reason: "no collections"
+	};
+	if (!target.bootstrapper.ensureCollectionPolicies) {
+		const reason = `${describeAdapter(target)} does not apply RLS policies at boot`;
+		logger.warn(`Collection policies: skipped — ${reason}. Collections are not row-secured until policies are applied — depending on the driver's grants that means reads are denied or that they are unfiltered. Do not serve traffic until this is resolved.
+` + schemaRecoveryGuidance());
+		return {
+			status: "skipped",
+			reason
+		};
+	}
+	const { applied } = await target.bootstrapper.ensureCollectionPolicies(collections, target.driverResult, (message) => logger.debug(`policies: ${message}`));
+	if (applied > 0) logger.info(`Applied ${applied} RLS policy statement(s) before serving.`);
+	else logger.debug("RLS policies are up to date.");
+	return {
+		status: "applied",
+		applied
+	};
+}
+/**
+* The collections a data source's engine is the store for.
+*
+* A project's collections directory holds *every* collection it declares,
+* whatever engine serves it — that is the point of `dataSource` routing. What it
+* is not is a list of tables to create: handing the whole directory to the
+* primary source's bootstrapper made a Firestore collection declared alongside
+* the Postgres ones arrive as an empty Postgres table, with RLS policies, while
+* the app went on reading its documents from Firestore.
+*
+* Excluding is deliberately conservative. A collection that names neither an
+* `engine` nor a `dataSource` belongs to whichever source is primary — the
+* "postgres" that `resolveDataSource` falls back to there is a default, not a
+* declaration, and must not exclude anything on its own. Only a collection that
+* explicitly routes to a *different* engine is dropped, so a project running two
+* sources on the same engine is unaffected.
+*
+* Takes the shapes it actually reads rather than an `InitializedDataSource`, so
+* the path that has data sources and the path that has only an adapter can share
+* one implementation instead of growing a second one that drifts.
+*/
+function collectionsStoredBy(collections, primary, dataSources) {
+	const registry = createDataSourceRegistry(dataSources.map((source) => ({
+		key: source.key,
+		engine: source.engine
+	})));
+	return collections.filter((collection) => {
+		const declared = collection.engine ?? (collection.dataSource ? resolveDataSource(collection, registry).engine : void 0);
+		if (!declared) return true;
+		return declared === primary.engine;
+	});
+}
+/** Say what was routed elsewhere, so a missing table is never a silent one. */
+function logForeignCollections(all, stored, primary) {
+	if (stored.length === all.length) return;
+	const foreign = all.filter((c) => !stored.includes(c)).map((c) => c.slug);
+	logger.info(`Skipping ${foreign.length} collection(s) served by another engine, not "${primary.engine}": ${foreign.join(", ")}. Their storage is not managed by this data source.`);
+}
+/**
+* Which bootstrapper provisions, and what to call it in a message.
+*
+* The default source is the one that stores this project's collections, so it
+* is the one asked to create them; `dataSources[0]` is the bundle path's
+* equivalent of the same choice.
+*
+* `driverResult` is deliberately left undefined here. The hooks run BEFORE
+* `initializeDriver`, so there is no driver result to pass, and unlike the
+* bundle path — where the coordinator opens the connection itself — an app that
+* built its own adapter never handed the framework a connection handle. The
+* adapter has one: it was constructed with it. So the contract is that an
+* adapter falls back to its own connection when no result is supplied, which is
+* the only shape that works for both paths.
+*/
+function provisionTargetFor(bootstrappers, adapter, driverResult) {
+	const primary = bootstrappers.find((b) => b.isDefault) ?? bootstrappers[0];
+	return {
+		driverPackage: void 0,
+		engine: primary?.type ?? adapter?.type ?? "unknown",
+		bootstrapper: primary ?? {},
+		driverResult
+	};
+}
+//#endregion
 //#region src/services/driver-registry.ts
 /**
 * The default driver identifier used when:
@@ -1083,6 +1276,35 @@ function projectResponseFields(rows, fields, collection, options) {
 		return projected;
 	});
 }
+/**
+* Both write checks, as one call, for a transport that is not the REST router.
+*
+* The REST routes run `assertKnownWriteFields` and `assertWriteValuesValid`
+* back to back on the caller's body, seven times over — and they were the only
+* place either ran. The WebSocket `SAVE` handler took a client payload straight
+* to `driver.save`, so the same write arrived validated through one door and
+* unvalidated through the other: `PATCH /api/data/users/1 { age: 999 }` was a
+* 400, and the socket wrote it.
+*
+* Exported for the sockets in `@rebasepro/server-postgres` and
+* `@rebasepro/server-mongo`, which are the other request boundaries. Not the
+* route builder — `index.ts` keeps that internal, and this is a rule rather
+* than wiring.
+*
+* It stays at the boundary rather than moving into the driver deliberately: it
+* validates what a *caller sent*, before `beforeSave` gets a chance to fill in
+* or rewrite anything. In-process writes through `rebase.data` are trusted
+* server code and are not run through it, which is the placement the REST layer
+* already chose.
+*
+* @param values     the caller's payload, exactly as it arrived
+* @param collection resolved from the registry by path — never the copy the
+*                   client sent, or the rules would be the caller's to pick
+*/
+function assertWriteRequestValid(values, collection) {
+	assertKnownWriteFields(values, collection);
+	assertWriteValuesValid(values, collection);
+}
 //#endregion
 //#region src/api/rest/idempotency.ts
 /**
@@ -1482,6 +1704,25 @@ var RestApiGenerator = class {
 			const total = await this.countRawEntities(driver, resolvedCollection, queryOptions, searchString);
 			return c.json({ count: total });
 		});
+		this.router.get(`${basePath}/aggregate`, async (c) => {
+			this.enforceApiKeyPermission(c, collection.slug);
+			const queryDict = c.req.queries();
+			const queryOptions = this.parseQuery(queryDict);
+			const searchString = Array.isArray(queryDict.searchString) ? queryDict.searchString[queryDict.searchString.length - 1] : void 0;
+			const aggregates = parseAggregateSelect(queryDict.select);
+			if (!aggregates) throw ApiError.badRequest("`select` is required, e.g. `?select=count()` or `?select=sum(total)&groupBy=status`.", "MISSING_AGGREGATE_SELECT");
+			const fetchService = this.getScopedDriver(c).restFetchService;
+			if (!fetchService?.aggregate) throw new ApiError(501, "AGGREGATE_NOT_SUPPORTED", "Aggregates are not implemented for this backend's data driver.");
+			const data = await fetchService.aggregate(collection.slug, {
+				aggregates,
+				groupBy: parseGroupBy(queryDict.groupBy),
+				filter: queryOptions.where,
+				logical: queryOptions.logical,
+				searchString,
+				limit: queryOptions.limit
+			});
+			return c.json({ data });
+		});
 		this.router.get(basePath, async (c) => {
 			this.enforceApiKeyPermission(c, collection.slug);
 			const queryDict = c.req.queries();
@@ -1495,12 +1736,11 @@ var RestApiGenerator = class {
 				logical: queryOptions.logical,
 				limit: queryOptions.limit,
 				offset: queryOptions.offset,
-				orderBy: queryOptions.orderBy?.[0]?.field,
-				order: queryOptions.orderBy?.[0]?.direction === "desc" ? "desc" : "asc",
+				orderBy: orderByEntriesToTuples(queryOptions.orderBy),
 				searchString,
 				searchExplain,
 				vectorSearch: queryOptions.vectorSearch
-			}, queryOptions.include) : await this.fetchRawCollection(driver, resolvedCollection, queryOptions, searchString);
+			}, queryOptions.include) : await this.fetchRawCollection(driver, resolvedCollection, queryOptions, searchString, searchExplain);
 			const total = await this.countRawEntities(driver, resolvedCollection, queryOptions, searchString);
 			return c.json({
 				data: projectResponseFields(entities, queryOptions.fields, resolvedCollection, { include: queryOptions.include }),
@@ -1829,7 +2069,8 @@ var RestApiGenerator = class {
 					path: parsed.collectionPath,
 					filter: queryOptions.where,
 					logical: queryOptions.logical,
-					searchString
+					searchString,
+					vectorSearch: queryOptions.vectorSearch
 				}) : 0;
 				return c.json({ count: total });
 			} else if (parsed.id) {
@@ -1853,9 +2094,9 @@ var RestApiGenerator = class {
 					logical: queryOptions.logical,
 					limit: queryOptions.limit,
 					offset: queryOptions.offset,
-					orderBy: queryOptions.orderBy?.[0]?.field,
-					order: queryOptions.orderBy?.[0]?.direction === "desc" ? "desc" : "asc",
-					searchString
+					orderBy: orderByEntriesToTuples(queryOptions.orderBy),
+					searchString,
+					vectorSearch: queryOptions.vectorSearch
 				};
 				const entities = fetchService ? await fetchService.fetchCollectionForRest(parsed.collectionPath, listOptions, queryOptions.include) : await driver.fetchCollection({
 					path: parsed.collectionPath,
@@ -1865,7 +2106,8 @@ var RestApiGenerator = class {
 					path: parsed.collectionPath,
 					filter: queryOptions.where,
 					logical: queryOptions.logical,
-					searchString
+					searchString,
+					vectorSearch: queryOptions.vectorSearch
 				}) : entities.length;
 				const listCollection = this.resolveNestedWriteCollection(parsed.collectionPath);
 				return c.json({
@@ -1960,17 +2202,17 @@ var RestApiGenerator = class {
 	/**
 	* Fetch raw collection data without Entity wrapper (fallback for non-Postgres)
 	*/
-	async fetchRawCollection(driver, collection, queryOptions, searchString) {
+	async fetchRawCollection(driver, collection, queryOptions, searchString, searchExplain) {
 		return await driver.fetchCollection({
 			path: getCollectionDataPath(collection),
 			collection,
 			filter: queryOptions.where,
 			logical: queryOptions.logical,
 			limit: queryOptions.limit,
-			orderBy: queryOptions.orderBy?.[0]?.field,
-			order: queryOptions.orderBy?.[0]?.direction === "desc" ? "desc" : "asc",
-			startAfter: queryOptions.offset ? String(queryOptions.offset) : void 0,
+			orderBy: orderByEntriesToTuples(queryOptions.orderBy),
+			offset: queryOptions.offset,
 			searchString,
+			searchExplain,
 			vectorSearch: queryOptions.vectorSearch
 		});
 	}
@@ -1983,7 +2225,8 @@ var RestApiGenerator = class {
 			collection,
 			filter: queryOptions.where,
 			logical: queryOptions.logical,
-			searchString
+			searchString,
+			vectorSearch: queryOptions.vectorSearch
 		}) : 0;
 	}
 	/**
@@ -2410,34 +2653,157 @@ var LocalStorageController = class {
 				else items.push(ref);
 				count++;
 			}
-			return {
-				items,
-				prefixes,
-				nextPageToken: scanned < entries.length ? String(scanned) : void 0
-			};
-		} catch (error) {
-			const code = error?.code;
-			if (code === "ENOENT" || code === "ENOTDIR") return {
-				items: [],
-				prefixes: []
-			};
-			throw error;
+			return {
+				items,
+				prefixes,
+				nextPageToken: scanned < entries.length ? String(scanned) : void 0
+			};
+		} catch (error) {
+			const code = error?.code;
+			if (code === "ENOENT" || code === "ENOTDIR") return {
+				items: [],
+				prefixes: []
+			};
+			throw error;
+		}
+	}
+	/**
+	* Get the absolute filesystem path for serving files
+	* Used by the storage routes to serve files directly
+	*/
+	getAbsolutePath(key, bucket) {
+		return this.getFullPath(key, bucket);
+	}
+	/**
+	* Get the base path for the storage
+	*/
+	getBasePath() {
+		return this.basePath;
+	}
+};
+//#endregion
+//#region src/storage/storage-registry.ts
+/**
+* Storage Registry
+*
+* Manages multiple storage controllers for Rebase backend.
+* Allows different storage backends for different use cases.
+*
+* Usage:
+* - Single storage: Pass a single StorageController → maps to "(default)"
+* - Multiple storages: Pass a map of { storageId: StorageController }
+* - String properties use `storageId` in their config to specify which storage to use
+* - Properties without `storageId` fallback to "(default)"
+*/
+/**
+* The default storage identifier used when:
+* - A single storage controller is provided (not a map)
+* - A property doesn't specify a storageId
+*
+* An alias rather than a second `"(default)"` literal: the same string is the
+* registry key here, the source key a project declares in `rebase.json`, and
+* the scope baked into a download token. Two literals that must stay equal are
+* a divergence waiting to happen — and this one would silently unscope tokens.
+*/
+var DEFAULT_STORAGE_ID = DEFAULT_STORAGE_SOURCE_KEY;
+/**
+* A request named a storage source that is not registered.
+*
+* This used to be a `logger.warn` and a fallback to the default source, which
+* is the wrong answer in a way that is hard to notice: the caller asks for
+* `media`, the `storageAuthorize` hook is asked about `media`, and the bytes
+* are read from — or written to — `(default)`. A hook that widens access for
+* one named source therefore widens it for the default one, and the object the
+* hook approved is not the object the request touched. That is the same shape
+* as the non-canonical-key bypass: the check and the read disagree about which
+* object is in play.
+*
+* The failure is silent by construction. Both sources hold the *same key*,
+* because that is what makes a caller reach for a second source in the first
+* place, so the fallback returns plausible bytes rather than an error.
+*
+* It is also reachable without an attacker: a source declared in `rebase.json`
+* but not configured by the environment is skipped at boot and never
+* registered, while `GET /sources` still advertises it. The client asks for a
+* source it was told exists and silently gets a different bucket's contents.
+*
+* Carries `knownKeys` so the route layer can tell a typo from a source that was
+* declared but never configured — two different answers to the caller. The
+* registry itself does not know what was *declared*, only what was registered,
+* so it does not make that decision.
+*/
+var UnknownStorageSourceError = class extends Error {
+	storageId;
+	knownKeys;
+	constructor(storageId, knownKeys) {
+		super(`[StorageRegistry] Storage source "${storageId}" is not registered. Registered sources: ${knownKeys.length > 0 ? knownKeys.map((k) => `"${k}"`).join(", ") : "(none)"}.`);
+		this.storageId = storageId;
+		this.knownKeys = knownKeys;
+		this.name = "UnknownStorageSourceError";
+	}
+};
+/**
+* Default implementation of StorageRegistry
+*/
+var DefaultStorageRegistry = class DefaultStorageRegistry {
+	controllers = /* @__PURE__ */ new Map();
+	/**
+	* Create a StorageRegistry from either a single controller or a map
+	* @param input - Single StorageController (maps to "(default)") or Record<string, StorageController>
+	*/
+	static create(input) {
+		const registry = new DefaultStorageRegistry();
+		if (isStorageController(input)) registry.register(DEFAULT_STORAGE_ID, input);
+		else {
+			for (const [id, controller] of Object.entries(input)) if (isStorageController(controller)) registry.register(id, controller);
+			if (!registry.has(DEFAULT_STORAGE_ID) && registry.size() > 0) {
+				const firstId = Object.keys(input).find((k) => isStorageController(input[k]));
+				if (firstId) {
+					logger.warn(`[StorageRegistry] No "${DEFAULT_STORAGE_ID}" storage provided. Using "${firstId}" as the default.`);
+					registry.register(DEFAULT_STORAGE_ID, input[firstId]);
+				}
+			}
 		}
+		return registry;
 	}
-	/**
-	* Get the absolute filesystem path for serving files
-	* Used by the storage routes to serve files directly
-	*/
-	getAbsolutePath(key, bucket) {
-		return this.getFullPath(key, bucket);
+	register(id, controller) {
+		if (this.controllers.has(id)) logger.warn(`[StorageRegistry] Overwriting storage with id "${id}"`);
+		this.controllers.set(id, controller);
 	}
-	/**
-	* Get the base path for the storage
-	*/
-	getBasePath() {
-		return this.basePath;
+	getDefault() {
+		const controller = this.controllers.get(DEFAULT_STORAGE_ID);
+		if (!controller) throw new Error(`[StorageRegistry] No default storage registered. Register one with id "${DEFAULT_STORAGE_ID}" or pass a single StorageController.`);
+		return controller;
+	}
+	get(id) {
+		return this.controllers.get(canonicalStorageId(id));
+	}
+	getOrDefault(id) {
+		const key = canonicalStorageId(id);
+		if (key === DEFAULT_STORAGE_ID) return this.getDefault();
+		const controller = this.controllers.get(key);
+		if (controller) return controller;
+		throw new UnknownStorageSourceError(key, this.list());
+	}
+	has(id) {
+		return this.controllers.has(canonicalStorageId(id));
+	}
+	list() {
+		return Array.from(this.controllers.keys());
+	}
+	size() {
+		return this.controllers.size;
 	}
 };
+/**
+* Type guard to check if an object is a StorageController
+* vs a Record<string, StorageController> (multiple storages)
+*/
+function isStorageController(obj) {
+	if (typeof obj !== "object" || obj === null) return false;
+	const controller = obj;
+	return typeof controller.putObject === "function" && typeof controller.getSignedUrl === "function" && typeof controller.deleteObject === "function" && typeof controller.listObjects === "function" && typeof controller.getType === "function";
+}
 //#endregion
 //#region src/storage/image-transform.ts
 /**
@@ -2810,6 +3176,7 @@ var TusHandler = class {
 			throw new ApiError(400, "INVALID_STORAGE_BUCKET", err instanceof InvalidStorageBucketError ? err.message : "Invalid storage bucket");
 		}
 		const storageId = metadata.storageId || c.req.query("storageId") || void 0;
+		if (storageId !== void 0 && this.storageRegistry && !this.storageRegistry.has(canonicalStorageId(storageId))) throw new ApiError(400, "UNKNOWN_STORAGE_SOURCE", `Unknown storage source "${storageId}". Available: ${this.storageRegistry.list().map((k) => `"${k}"`).join(", ") || "(none)"}.`, void 0, true);
 		if (this.authorizeUpload) await this.authorizeUpload(c, key, bucket || "default", storageId);
 		const filePath = join(this.tusDir, id);
 		await writeFile(filePath, Buffer.alloc(0));
@@ -2912,7 +3279,12 @@ var TusHandler = class {
 	async finalize(upload) {
 		const storageId = upload.storageId;
 		let targetController = this.storageController;
-		if (this.storageRegistry) targetController = storageId ? this.storageRegistry.getOrDefault(storageId) : this.storageRegistry.getDefault();
+		if (this.storageRegistry) try {
+			targetController = storageId ? this.storageRegistry.getOrDefault(storageId) : this.storageRegistry.getDefault();
+		} catch (err) {
+			if (!(err instanceof UnknownStorageSourceError)) throw err;
+			targetController = void 0;
+		}
 		if (!targetController) {
 			logger.error("[TUS] Upload received but no StorageController is configured — nothing can be written", {
 				uploadId: upload.id,
@@ -3074,8 +3446,8 @@ function canonicalKeyOrBadRequest(key) {
 * The bucket's counterpart to {@link canonicalKeyOrBadRequest}, and it exists
 * for the same reason: the value routes a write, so it has to be checked where
 * it enters rather than where it is used. Applied at every entry point a bucket
-* has — this route's multipart body, the `?bucket=` query, and the TUS
-* `Upload-Metadata` header.
+* has — this route's multipart body, the folder route's JSON body, the
+* `?bucket=` query, and the TUS `Upload-Metadata` header.
 */
 function canonicalBucketOrBadRequest(bucket) {
 	try {
@@ -3175,13 +3547,46 @@ function createStorageRoutes(config) {
 		if (!allowed) throw ApiError.forbidden("Not authorized for this object");
 	};
 	/**
-	* Resolve the storage controller for a request.
-	* Looks up by `storageId` in the registry, falls back to the single
-	* controller, and finally to the registry default.
+	* Resolve the storage controller for a request, or refuse the request.
+	*
+	* A `storageId` that names no registered source used to fall back to the
+	* default one. That is silently wrong: the `storageAuthorize` hook is asked
+	* about the source the caller named while the bytes come from `(default)`,
+	* so the object the hook approved is not the object the request touched —
+	* and because the two sources hold the same key, the fallback returns
+	* plausible bytes instead of an error.
+	*
+	* The caller gets one of two answers, because they are two different
+	* problems with two different fixes:
+	*
+	* - **501** if the source *is* declared in `rebase.json` but has no
+	*   credentials in this environment. It was skipped at boot rather than
+	*   crash-looping the backend, but `GET /sources` still advertises it, so a
+	*   client asking for it is not confused — the deployment is incomplete.
+	*   501 (not 503) for the same reason the whole-storage stub uses it: this
+	*   is permanent until someone configures it, and the client's offline
+	*   queue retries 503 forever.
+	* - **400** otherwise. The id names nothing this deployment has ever heard
+	*   of, which is a caller mistake. `expected`, so one client holding a
+	*   stale source name does not write a warning per request forever.
 	*/
+	const declaredKeys = new Set((declaredSources ?? []).map((s) => s.key));
+	const refuseUnknownSource = (storageId, knownKeys) => {
+		if (declaredKeys.has(storageId)) throw new ApiError(501, "STORAGE_SOURCE_NOT_CONFIGURED", `Storage source "${storageId}" is declared but not configured on this deployment, so it cannot be read from or written to. Set its credentials (the ${storageId} suffixed environment variables) and redeploy.`);
+		throw new ApiError(400, "UNKNOWN_STORAGE_SOURCE", `Unknown storage source "${storageId}". Available: ${knownKeys.length > 0 ? knownKeys.map((k) => `"${k}"`).join(", ") : "(none)"}.`, void 0, true);
+	};
 	const resolveController = (storageId) => {
-		if (registry) return registry.getOrDefault(storageId);
-		if (controller) return controller;
+		if (registry) try {
+			return registry.getOrDefault(storageId);
+		} catch (err) {
+			if (err instanceof UnknownStorageSourceError) return refuseUnknownSource(err.storageId, err.knownKeys);
+			throw err;
+		}
+		if (controller) {
+			const requested = canonicalStorageId(storageId);
+			if (requested !== "(default)") return refuseUnknownSource(requested, [DEFAULT_STORAGE_SOURCE_KEY]);
+			return controller;
+		}
 		throw new Error("No storage controller or registry available");
 	};
 	/** Get the default controller (used for TUS and base-path derivation). */
@@ -3263,7 +3668,7 @@ function createStorageRoutes(config) {
 		const transformKeyPrefix = `${storageId || "(default)"}/${bucket}/${resolvedPath}`;
 		const transformOpts = transformOptionsOrBadRequest(c.req.query());
 		if (resolved.getType() === "local") {
-			const absolutePath = resolved.getAbsolutePath(resolvedPath, bucket);
+			const absolutePath = resolved.getAbsolutePath(resolvedPath, bucket ?? "default");
 			try {
 				await fsp.access(absolutePath);
 			} catch {
@@ -3324,7 +3729,7 @@ function createStorageRoutes(config) {
 			const scopedPath = `${bucket}/${resolvedPath}`;
 			if (isPublicStoragePath(scopedPath)) downloadConfig.metadata.public = true;
 			else {
-				downloadConfig.metadata.token = generateDownloadToken(scopedPath, 300);
+				downloadConfig.metadata.token = generateDownloadToken(scopedPath, 300, storageId);
 				downloadConfig.metadata.tokenExpiresIn = 300;
 			}
 		}
@@ -3384,9 +3789,10 @@ function createStorageRoutes(config) {
 		const storageId = typeof body.storageId === "string" ? body.storageId : c.req.query("storageId");
 		if (!folderPath || typeof folderPath !== "string") throw ApiError.badRequest("Folder path is required");
 		const resolved = resolveController(storageId);
-		const { bucket, resolvedPath } = parseBucketAndPath(folderPath);
+		const { resolvedPath } = parseBucketAndPath(folderPath);
+		const bucket = canonicalBucketOrBadRequest(typeof body.bucket === "string" ? body.bucket : void 0);
 		if (!resolvedPath || resolvedPath.trim() === "") throw ApiError.badRequest("Invalid folder path");
-		await checkAuthorized(c, "write", resolvedPath, bucket, storageId);
+		await checkAuthorized(c, "write", resolvedPath, bucket ?? "default", storageId);
 		if (resolved.getType() === "local") {
 			const absolutePath = resolved.getAbsolutePath(resolvedPath, bucket);
 			fs$1.mkdirSync(absolutePath, { recursive: true });
@@ -3395,7 +3801,8 @@ function createStorageRoutes(config) {
 			const emptyFile = new File([], key, { type: "application/x-directory" });
 			await resolved.putObject({
 				file: emptyFile,
-				key
+				key,
+				bucket
 			});
 		}
 		return c.json({
@@ -3446,77 +3853,6 @@ function createStorageRoutes(config) {
 	return router;
 }
 //#endregion
-//#region src/storage/storage-registry.ts
-/**
-* The default storage identifier used when:
-* - A single storage controller is provided (not a map)
-* - A property doesn't specify a storageId
-*/
-var DEFAULT_STORAGE_ID = "(default)";
-/**
-* Default implementation of StorageRegistry
-*/
-var DefaultStorageRegistry = class DefaultStorageRegistry {
-	controllers = /* @__PURE__ */ new Map();
-	/**
-	* Create a StorageRegistry from either a single controller or a map
-	* @param input - Single StorageController (maps to "(default)") or Record<string, StorageController>
-	*/
-	static create(input) {
-		const registry = new DefaultStorageRegistry();
-		if (isStorageController(input)) registry.register(DEFAULT_STORAGE_ID, input);
-		else {
-			for (const [id, controller] of Object.entries(input)) if (isStorageController(controller)) registry.register(id, controller);
-			if (!registry.has("(default)") && registry.size() > 0) {
-				const firstId = Object.keys(input).find((k) => isStorageController(input[k]));
-				if (firstId) {
-					logger.warn(`[StorageRegistry] No "${DEFAULT_STORAGE_ID}" storage provided. Using "${firstId}" as the default.`);
-					registry.register(DEFAULT_STORAGE_ID, input[firstId]);
-				}
-			}
-		}
-		return registry;
-	}
-	register(id, controller) {
-		if (this.controllers.has(id)) logger.warn(`[StorageRegistry] Overwriting storage with id "${id}"`);
-		this.controllers.set(id, controller);
-	}
-	getDefault() {
-		const controller = this.controllers.get(DEFAULT_STORAGE_ID);
-		if (!controller) throw new Error(`[StorageRegistry] No default storage registered. Register one with id "${DEFAULT_STORAGE_ID}" or pass a single StorageController.`);
-		return controller;
-	}
-	get(id) {
-		if (id === void 0 || id === null) return this.controllers.get(DEFAULT_STORAGE_ID);
-		return this.controllers.get(id);
-	}
-	getOrDefault(id) {
-		if (id === void 0 || id === null) return this.getDefault();
-		const controller = this.controllers.get(id);
-		if (controller) return controller;
-		logger.warn(`[StorageRegistry] Storage "${id}" not found, falling back to "${DEFAULT_STORAGE_ID}"`);
-		return this.getDefault();
-	}
-	has(id) {
-		return this.controllers.has(id);
-	}
-	list() {
-		return Array.from(this.controllers.keys());
-	}
-	size() {
-		return this.controllers.size;
-	}
-};
-/**
-* Type guard to check if an object is a StorageController
-* vs a Record<string, StorageController> (multiple storages)
-*/
-function isStorageController(obj) {
-	if (typeof obj !== "object" || obj === null) return false;
-	const controller = obj;
-	return typeof controller.putObject === "function" && typeof controller.getSignedUrl === "function" && typeof controller.deleteObject === "function" && typeof controller.listObjects === "function" && typeof controller.getType === "function";
-}
-//#endregion
 //#region src/storage/index.ts
 /**
 * Create a storage controller from a config object.
@@ -3610,7 +3946,7 @@ function assertStorageAccessControlConfigured(state, isProduction) {
 */
 async function mountOpenApiDocs(app, basePath, enableSwagger, serverCollections, requireAuth) {
 	if (enableSwagger === false || serverCollections.length === 0) return;
-	const { generateOpenApiSpec } = await import("./openapi-generator-DPKtUC9X.js");
+	const { generateOpenApiSpec } = await import("./openapi-generator-DQeQ_q2f.js");
 	app.get(`${basePath}/docs`, (c) => {
 		const spec = generateOpenApiSpec(serverCollections, {
 			basePath,
@@ -3763,6 +4099,10 @@ function createShutdown(config) {
 					config.cronScheduler.stop();
 					logger.info("Cron scheduler stopped");
 				}
+				if (config.jobQueue) {
+					await config.jobQueue.stop();
+					logger.info("Job queue stopped");
+				}
 				for (const [key, rt] of Object.entries(config.realtimeServices)) try {
 					if (typeof rt.destroy === "function") {
 						await rt.destroy();
@@ -3787,6 +4127,42 @@ function createShutdown(config) {
 	};
 }
 //#endregion
+//#region src/init/surfaces.ts
+/** Every surface, in a stable order. */
+var ALL_RUNTIME_SURFACES = [
+	"auth",
+	"data",
+	"storage",
+	"admin",
+	"functions",
+	"cron",
+	"meta"
+];
+/**
+* Resolve a partial surface set against the default, which is everything on.
+*
+* Defaulting to on rather than off is the whole compatibility story: a caller
+* that says nothing gets the process this server has always booted, and a
+* surface added later is mounted by every existing deployment without anyone
+* editing a list.
+*/
+function resolveSurfaces(options) {
+	const resolved = {};
+	for (const surface of ALL_RUNTIME_SURFACES) resolved[surface] = options?.[surface] ?? true;
+	return resolved;
+}
+/** Resolve partial ownership against the default, which is owning everything. */
+function resolveOwnership(options) {
+	return {
+		cronScheduler: options?.cronScheduler ?? true,
+		jobWorkers: options?.jobWorkers ?? true
+	};
+}
+/** The surfaces a process is not serving, for a boot log line. */
+function disabledSurfaces(resolved) {
+	return ALL_RUNTIME_SURFACES.filter((surface) => !resolved[surface]);
+}
+//#endregion
 //#region src/init/process-safety.ts
 /**
 * Installed once per process. The singleton is process-global for the same
@@ -5092,9 +5468,15 @@ var SDKQueryBuilder = class {
 	}
 	/**
 	* Order the results by a specific column.
+	*
+	* Call it again to add a tie-breaker rather than replace the sort: keys
+	* apply in the order they were added, so
+	* `.orderBy("roles").orderBy("created_at", "desc")` sorts by role and
+	* shows the newest first within each one.
 	*/
 	orderBy(column, direction = "asc") {
-		this.params.orderBy = [column, direction];
+		const existing = normalizeOrderBy(this.params.orderBy) ?? [];
+		this.params.orderBy = [...existing, [column, direction]];
 		return this;
 	}
 	/**
@@ -5409,8 +5791,7 @@ function createCollectionClient(transport, slug, ws) {
 				logical: params?.logical,
 				limit: params?.limit,
 				offset: window.driverOffset,
-				orderBy: params?.orderBy?.[0],
-				order: params?.orderBy?.[1],
+				orderBy: normalizeOrderBy(params?.orderBy),
 				searchString: params?.searchString,
 				searchExplain: params?.searchExplain
 			}, (incomingRows) => {
@@ -7894,27 +8275,43 @@ function matchesParams(row, params) {
 * Sort in place, Postgres-style: nulls last ascending, first descending, with
 * the row id as a tiebreak so paging through an unsorted-but-equal run does
 * not shuffle rows between pages.
+*
+* The tiebreak runs *descending*, which is not a taste: every server-side sort
+* ends on `id DESC` — `FetchService.buildOrderExpressions` appends it to make
+* the ordering total, and the keyset cursor is built to match. This ran
+* ascending, so two rows sharing a sort value came back from the local overlay
+* in the opposite order to the server's, and {@link isLocallySortable} called
+* that page exactly reproducible while it was not.
 */
 function sortRows(rows, orderBy) {
-	if (!orderBy) return rows;
-	const [field, direction = "asc"] = orderBy;
-	const sign = direction === "desc" ? -1 : 1;
+	const keys = normalizeOrderBy(orderBy);
+	if (!keys) return rows;
 	return rows.sort((a, b) => {
-		const av = a[field];
-		const bv = b[field];
-		const aNull = isNullish(toComparable(av));
-		const bNull = isNullish(toComparable(bv));
-		if (aNull || bNull) {
-			if (aNull && bNull) return tiebreak(a, b);
-			return (aNull ? 1 : -1) * (direction === "desc" ? -1 : 1);
-		}
-		const cmp = compareValues(av, bv);
-		if (cmp === void 0 || cmp === 0) return tiebreak(a, b);
-		return cmp * sign;
+		for (const [field, direction = "asc"] of keys) {
+			const cmp = compareOnKey(a, b, field, direction);
+			if (cmp !== 0) return cmp;
+		}
+		return tiebreak(a, b);
 	});
 }
+/** One key's verdict: negative, positive, or 0 for "these two are equal here". */
+function compareOnKey(a, b, field, direction) {
+	const av = a[field];
+	const bv = b[field];
+	const aNull = isNullish(toComparable(av));
+	const bNull = isNullish(toComparable(bv));
+	if (aNull || bNull) {
+		if (aNull && bNull) return 0;
+		return (aNull ? 1 : -1) * (direction === "desc" ? -1 : 1);
+	}
+	const cmp = compareValues(av, bv);
+	if (cmp === void 0 || cmp === 0) return 0;
+	return cmp * (direction === "desc" ? -1 : 1);
+}
+/** The last word, and the server's: `id DESC`. */
 function tiebreak(a, b) {
-	return compareValues(a.id, b.id) ?? 0;
+	const cmp = compareValues(a.id, b.id);
+	return cmp === void 0 ? 0 : -cmp;
 }
 /**
 * Resolve `page`/`offset`/`limit` the way the server does.
@@ -8009,17 +8406,16 @@ function isExactlyEvaluable(params) {
 * comparator.
 */
 function isLocallySortable(rows, orderBy) {
-	if (!orderBy) return true;
-	const [field] = orderBy;
-	for (const row of rows) {
+	const keys = normalizeOrderBy(orderBy);
+	if (!keys) return true;
+	return keys.every(([field]) => rows.every((row) => {
 		const value = toComparable(row[field]);
-		if (isNullish(value)) continue;
-		if (typeof value === "number" || typeof value === "boolean") continue;
-		if (typeof value === "bigint") continue;
-		if (typeof value === "string" && value.trim() !== "" && !Number.isNaN(Number(value))) continue;
+		if (isNullish(value)) return true;
+		if (typeof value === "number" || typeof value === "boolean") return true;
+		if (typeof value === "bigint") return true;
+		if (typeof value === "string" && value.trim() !== "" && !Number.isNaN(Number(value))) return true;
 		return false;
-	}
-	return true;
+	}));
 }
 /** Run a full query — filter, sort, paginate — over a set of rows. */
 function runLocalQuery(rows, params) {
@@ -9946,6 +10342,13 @@ async function _initializeRebaseBackend(config) {
 	installUnhandledRejectionHandler();
 	const basePath = config.basePath || "/api";
 	const isProduction = process.env.NODE_ENV === "production";
+	const surfaces = resolveSurfaces(config.surfaces);
+	const ownership = resolveOwnership(config.ownership);
+	const offSurfaces = disabledSurfaces(surfaces);
+	if (offSurfaces.length > 0) logger.info("Partial runtime surface — some routes are not served by this process", {
+		serving: ALL_RUNTIME_SURFACES.filter((surface) => surfaces[surface]),
+		notServing: offSurfaces
+	});
 	configureMiddlewares(config.app, basePath, isProduction, config);
 	const collectionRegistry = new BackendCollectionRegistry();
 	const dataSourceRegistry = createDataSourceRegistry(config.dataSources);
@@ -9974,6 +10377,16 @@ async function _initializeRebaseBackend(config) {
 	if (bootstrappers.length === 0) throw new Error("No bootstrappers or database adapter provided. Cannot initialize database drivers.");
 	let defaultDriverId = DEFAULT_DRIVER_ID;
 	let defaultDriverResult = void 0;
+	const provisionTarget = provisionTargetFor(bootstrappers, config.database, config.provisioningDriverResult);
+	const provisionable = collectionsStoredBy(activeCollections, { engine: provisionTarget.engine }, (config.dataSources ?? []).map((source) => ({
+		key: source.key,
+		engine: source.engine ?? provisionTarget.engine
+	})));
+	logForeignCollections(activeCollections, provisionable, { engine: provisionTarget.engine });
+	const schemaOutcome = await provisionCollectionTables(provisionable, provisionTarget, {
+		introspecting: introspectCollections,
+		provision: config.provisionSchema ?? true
+	});
 	for (const bootstrapper of bootstrappers) {
 		const b = bootstrapper;
 		logger.debug("Running bootstrapper for driver", { driverId: b.id || bootstrapper.type });
@@ -9982,7 +10395,11 @@ async function _initializeRebaseBackend(config) {
 			collections: activeCollections,
 			collectionRegistry,
 			introspectCollections,
-			baas: config.baas
+			baas: config.baas,
+			schemaProvisioning: {
+				attempted: schemaOutcome.status === "applied",
+				reason: schemaOutcome.status === "skipped" ? schemaOutcome.reason : void 0
+			}
 		});
 		delegates[b.id || bootstrapper.type] = driverResult.driver;
 		if (introspectCollections) {
@@ -10057,7 +10474,9 @@ async function _initializeRebaseBackend(config) {
 		if (safeAuthConfig.jwtSecret) configureJwt({
 			secret: safeAuthConfig.jwtSecret,
 			accessExpiresIn: safeAuthConfig.accessExpiresIn || "1h",
-			refreshExpiresIn: safeAuthConfig.refreshExpiresIn || "30d"
+			refreshExpiresIn: safeAuthConfig.refreshExpiresIn || "30d",
+			signingKeys: safeAuthConfig.signingKeys,
+			activeKid: safeAuthConfig.activeKid
 		});
 		if (safeAuthConfig.serviceKey) {
 			if (safeAuthConfig.serviceKey.length < 32) throw new Error("REBASE_SERVICE_KEY is too short. Must be at least 32 characters. Generate one with: node -e \"logger.info(require('crypto').randomBytes(48).toString('base64'))\"");
@@ -10070,6 +10489,10 @@ async function _initializeRebaseBackend(config) {
 			logger.info("Authentication initialized");
 		} else logger.warn("Auth requested but default bootstrapper does not support initializeAuth");
 	}
+	await provisionCollectionPolicies(provisionable, provisionTarget, {
+		introspecting: introspectCollections,
+		provision: config.provisionSchema ?? true
+	});
 	let historyConfigResult = void 0;
 	if (config.history) if (defaultBootstrapper.initializeHistory) {
 		logger.debug("Bootstrapping entity history via driver protocol");
@@ -10094,8 +10517,8 @@ async function _initializeRebaseBackend(config) {
 		store: apiKeyStore,
 		driver: defaultDriver
 	}) : void 0;
-	if (apiKeyPreAuth) config.app.use(`${basePath}/admin/*`, apiKeyPreAuth);
-	if (apiKeyStore) {
+	if (apiKeyPreAuth && surfaces.admin) config.app.use(`${basePath}/admin/*`, apiKeyPreAuth);
+	if (apiKeyStore && surfaces.admin) {
 		const apiKeyRoutes = createApiKeyRoutes({
 			store: apiKeyStore,
 			serviceKey: internalServiceKey
@@ -10185,7 +10608,7 @@ async function _initializeRebaseBackend(config) {
 			]) {
 				const providerConfig = safeAuthConfig[key];
 				if (providerConfig && requiredFields.every((f) => Boolean(providerConfig[f]))) {
-					const createFn = (await import("./auth-CYoPVf-E.js").then((n) => n.t))[factory];
+					const createFn = (await import("./auth-BobZVd0j.js").then((n) => n.t))[factory];
 					oauthProviders.push(createFn(providerConfig));
 				}
 			}
@@ -10212,14 +10635,14 @@ async function _initializeRebaseBackend(config) {
 				if (!isProduction && !process.env.CORS_ORIGINS && !process.env.FRONTEND_URL) logger.warn("[Auth] Cookie authentication (cookieAuth) is enabled, but no CORS restrictions are detected. Browser-based clients will require credentials: 'include' and the server MUST NOT use Access-Control-Allow-Origin: '*'. Ensure CORS_ORIGINS is set to your frontend URL.");
 			}
 		}
-		if (authAdapter && authAdapter.createAuthRoutes) {
+		if (authAdapter && authAdapter.createAuthRoutes && surfaces.auth) {
 			const authRoutes = authAdapter.createAuthRoutes();
 			if (authRoutes) {
 				config.app.route(`${basePath}/auth`, authRoutes);
 				logger.debug("Auth routes mounted via adapter", { adapter: authAdapter.id });
 			}
 		}
-		if (authAdapter && authAdapter.createAdminRoutes) {
+		if (authAdapter && authAdapter.createAdminRoutes && surfaces.admin) {
 			const adminRoutes = authAdapter.createAdminRoutes();
 			if (adminRoutes) {
 				config.app.route(`${basePath}/admin`, adminRoutes);
@@ -10227,6 +10650,10 @@ async function _initializeRebaseBackend(config) {
 			}
 		}
 	}
+	if (isJwtConfigured() && surfaces.auth) {
+		config.app.route("/.well-known", createJwksRoutes());
+		if (hasAsymmetricSigningKey()) logger.info("Access tokens are signed asymmetrically; public keys at /.well-known/jwks.json");
+	}
 	const adminSurfacesGated = !!authAdapter && (isAuthAdapter(config.auth) || !!config.auth.jwtSecret);
 	const applyAdminGate = (router, surface) => {
 		if (!adminSurfacesGated) {
@@ -10291,7 +10718,7 @@ async function _initializeRebaseBackend(config) {
 			logger.warn(`Schema Editor disabled: ${schemaEditorOff.message}`);
 		} else throw err;
 	}
-	{
+	if (surfaces.admin) {
 		const schemaEditorRouter = new Hono();
 		applyAdminGate(schemaEditorRouter, "Schema editor");
 		schemaEditorRouter.get("/status", (c) => c.json(schemaEditorOff ? {
@@ -10342,15 +10769,17 @@ async function _initializeRebaseBackend(config) {
 			}
 		}));
 		storageRouter.route("/", storageRoutes);
-		config.app.route(`${basePath}/storage`, storageRouter);
+		if (surfaces.storage) config.app.route(`${basePath}/storage`, storageRouter);
 	} else {
 		const storageStub = new Hono();
 		storageStub.all("/*", (c) => c.json({ error: {
 			message: "File storage is not configured on this deployment, so uploads and downloads are disabled. Configure a storage backend (STORAGE_TYPE=s3 or STORAGE_TYPE=gcs plus its bucket and credentials) and redeploy.",
 			code: "STORAGE_NOT_CONFIGURED"
 		} }, 501));
-		config.app.route(`${basePath}/storage`, storageStub);
-		logger.info("Storage not configured — /storage returns 501 STORAGE_NOT_CONFIGURED");
+		if (surfaces.storage) {
+			config.app.route(`${basePath}/storage`, storageStub);
+			logger.info("Storage not configured — /storage returns 501 STORAGE_NOT_CONFIGURED");
+		}
 	}
 	const serverCollections = activeCollections.filter((collection) => resolveDataSource(collection, dataSourceRegistry).transport === "server");
 	if (activeCollections.length > 0) {
@@ -10399,9 +10828,9 @@ async function _initializeRebaseBackend(config) {
 		}
 		const restGenerator = new RestApiGenerator(serverCollections, defaultDriver, authAdapter);
 		dataRouter.route("/", restGenerator.generateRoutes());
-		config.app.route(`${basePath}/data`, dataRouter);
+		if (surfaces.data) config.app.route(`${basePath}/data`, dataRouter);
 	}
-	await mountOpenApiDocs(config.app, basePath, config.enableSwagger, serverCollections, resolveRequireAuth(config.auth));
+	if (surfaces.data) await mountOpenApiDocs(config.app, basePath, config.enableSwagger, serverCollections, resolveRequireAuth(config.auth));
 	const serverClient = createRebaseClient({
 		baseUrl: "http://localhost",
 		apiPath: basePath,
@@ -10460,11 +10889,17 @@ async function _initializeRebaseBackend(config) {
 		const driver = defaultDriverResult.internals.driver;
 		if (driver && "client" in driver) driver.client = serverClient;
 	}
-	if (config.functionsDir) {
+	if (config.functionsDir && surfaces.functions) {
 		const { loadFunctionsWithDiagnostics } = await import("./function-loader-DDS1v7YX.js").then((n) => n.t);
 		const { createFunctionRoutes } = await import("./function-routes-Btcez1T-.js").then((n) => n.n);
-		const { createFunctionsRequestTimeout, resolveFunctionsTimeoutMs } = await import("./request-timeout-RivJsME0.js");
-		const { functions: loadedFunctions, problems } = await loadFunctionsWithDiagnostics(config.functionsDir);
+		const { createFunctionsRequestTimeout, resolveFunctionsTimeoutMs } = await import("./request-timeout-BuFoEKwT.js");
+		const { functions: allFunctions, problems } = await loadFunctionsWithDiagnostics(config.functionsDir);
+		const { selectFunctions } = await import("./selection-_z6TM1DB.js").then((n) => n.n);
+		const loadedFunctions = selectFunctions(allFunctions, config.functionsSelection);
+		if (loadedFunctions.length !== allFunctions.length) logger.info("Serving a subset of this bundle's functions", {
+			serving: loadedFunctions.map((fn) => fn.name),
+			notServing: allFunctions.filter((fn) => !loadedFunctions.includes(fn)).map((fn) => fn.name)
+		});
 		const functionsRouter = new Hono();
 		functionsRouter.onError(errorHandler);
 		const functionsTimeoutMs = resolveFunctionsTimeoutMs(config.functionsTimeoutMs);
@@ -10497,12 +10932,23 @@ async function _initializeRebaseBackend(config) {
 		});
 		else logger.warn(`Function routes mounted at ${basePath}/functions, but no functions loaded from ${config.functionsDir}. ` + (problems.length > 0 ? `${problems.length} file(s) were skipped — see the messages above.` : "The directory holds no .ts/.js function files."));
 	}
+	if (config.functionsUpstream && !surfaces.functions) {
+		const { createFunctionsProxy } = await import("./proxy-Bj5DVllb.js");
+		config.app.route(`${basePath}/functions`, createFunctionsProxy({
+			upstream: config.functionsUpstream,
+			basePath: `${basePath}/functions`
+		}));
+		logger.info("Forwarding custom functions to another process", {
+			path: `${basePath}/functions`,
+			upstream: config.functionsUpstream
+		});
+	}
 	let cronScheduler;
-	if (config.cronsDir) {
+	if (config.cronsDir && (surfaces.cron || ownership.cronScheduler)) {
 		const { loadCronJobsWithDiagnostics } = await import("./cron-loader-YhhQeVBM.js").then((n) => n.t);
 		const { CronScheduler } = await import("./cron-scheduler-DIpYBmZP.js").then((n) => n.n);
 		const { createCronRoutes } = await import("./cron-routes-maM_RlUu.js").then((n) => n.n);
-		const { createCronStore } = await import("./cron-store-Dvr4Y1sZ.js").then((n) => n.n);
+		const { createCronStore } = await import("./cron-store-CB1x-Ken.js").then((n) => n.n);
 		const { jobs: loadedCronJobs, problems: cronProblems } = await loadCronJobsWithDiagnostics(config.cronsDir);
 		cronScheduler = new CronScheduler();
 		cronScheduler.setClient(serverSingleton);
@@ -10517,8 +10963,12 @@ async function _initializeRebaseBackend(config) {
 		const cronRouter = new Hono();
 		applyAdminGate(cronRouter, "Cron");
 		cronRouter.route("/", createCronRoutes(cronScheduler, cronProblems.length));
-		config.app.route(`${basePath}/cron`, cronRouter);
-		if (loadedCronJobs.length > 0) {
+		if (surfaces.cron) config.app.route(`${basePath}/cron`, cronRouter);
+		if (loadedCronJobs.length > 0 && !ownership.cronScheduler) logger.info("Cron jobs registered but NOT scheduled in this process", {
+			count: loadedCronJobs.length,
+			reason: "this process does not own the cron scheduler"
+		});
+		else if (loadedCronJobs.length > 0) {
 			cronScheduler.start();
 			logger.info("Mounted cron jobs", {
 				count: loadedCronJobs.length,
@@ -10526,7 +10976,20 @@ async function _initializeRebaseBackend(config) {
 			});
 		} else logger.warn(`Cron routes mounted at ${basePath}/cron, but no jobs loaded from ${config.cronsDir}. ` + (cronProblems.length > 0 ? `Nothing is scheduled — ${cronProblems.length} file(s) were skipped, see the messages above.` : "The directory holds no .ts/.js cron files, so nothing is scheduled."));
 	}
-	{
+	let jobQueue;
+	if (config.jobs?.enabled) {
+		const { createJobStore, createJobQueue } = await import("./jobs-DR4SjGrD.js").then((n) => n.t);
+		const store = createJobStore(defaultDriver);
+		if (store) {
+			await store.ensureTable();
+			jobQueue = createJobQueue(store, config.jobs);
+			if (ownership.jobWorkers) {
+				jobQueue.start();
+				logger.info("Job queue started", { tasks: Object.keys(config.jobs.tasks ?? {}).length });
+			} else logger.info("Job queue available for enqueue, workers NOT started in this process", { tasks: Object.keys(config.jobs.tasks ?? {}).length });
+		} else logger.warn("Job queue requested but unavailable on this driver — `rebase.jobs.enqueue` will throw, and webhook deliveries fall back to the in-memory queue.");
+	}
+	if (surfaces.admin) {
 		const { createBackupRoutes, parseBackupDestination } = await import("./backup-C6ljYVTp.js").then((n) => n.t);
 		const backupRouter = new Hono();
 		applyAdminGate(backupRouter, "Backup");
@@ -10540,7 +11003,7 @@ async function _initializeRebaseBackend(config) {
 		config.app.route(`${basePath}/admin/backups`, backupRouter);
 		logger.debug("Backup admin routes mounted", { path: `${basePath}/admin/backups` });
 	}
-	{
+	if (surfaces.admin) {
 		const { default: logsRoutes } = await import("./logs-routes-BYA72C_C.js").then((n) => n.n);
 		const logsRouter = new Hono();
 		applyAdminGate(logsRouter, "Logs");
@@ -10548,7 +11011,7 @@ async function _initializeRebaseBackend(config) {
 		config.app.route(`${basePath}/logs`, logsRouter);
 		logger.debug("Logs routes mounted", { path: `${basePath}/logs` });
 	}
-	{
+	if (surfaces.meta) {
 		const { createContractRoutes } = await import("./contract-routes-Bet-eCNJ.js").then((n) => n.t);
 		const contractRouter = new Hono();
 		if (adminSurfacesGated) {
@@ -10581,6 +11044,7 @@ async function _initializeRebaseBackend(config) {
 	const shutdown = createShutdown({
 		server: config.server,
 		cronScheduler,
+		jobQueue,
 		realtimeServices
 	});
 	/**
@@ -10619,6 +11083,7 @@ async function _initializeRebaseBackend(config) {
 		storageController,
 		collectionRegistry,
 		cronScheduler,
+		jobQueue,
 		healthCheck,
 		shutdown
 	};
@@ -10811,6 +11276,22 @@ var rebaseEnvSchema = object({
 	DATABASE_URL: string().url("DATABASE_URL must be a valid URL"),
 	ADMIN_CONNECTION_STRING: string().url().optional(),
 	JWT_SECRET: string().min(32, "JWT_SECRET must be at least 32 characters long"),
+	/**
+	* PEM private key for signing access tokens asymmetrically, so anything
+	* holding the JWKS can verify a session without being able to mint one.
+	* Optional — without it, tokens stay HS256 and nothing changes.
+	*
+	* Accepts a PEM with real newlines, a PEM with `\n` escapes (how most
+	* secret managers and `.env` files carry a multi-line value), or base64 of
+	* the whole PEM.
+	*/
+	JWT_PRIVATE_KEY: string().optional(),
+	/**
+	* Names {@link rebaseEnvSchema.JWT_PRIVATE_KEY} in the token header and in
+	* the JWKS. Rotation depends on the old and new keys being
+	* distinguishable, so change this whenever the key changes.
+	*/
+	JWT_KEY_ID: string().default("default"),
 	JWT_ACCESS_EXPIRES_IN: string().default("1h"),
 	JWT_REFRESH_EXPIRES_IN: string().default("400d"),
 	GOOGLE_CLIENT_ID: string().optional(),
@@ -11032,6 +11513,14 @@ async function assertAllowedOutboundUrl(rawUrl, options = {}) {
 }
 //#endregion
 //#region src/services/webhook-service.ts
+/**
+* The task name a queued webhook delivery is stored under.
+*
+* Namespaced, and frozen: it is written into `rebase.jobs` rows that outlive
+* the deploy that wrote them, so renaming it would strand every delivery
+* already queued under the old name until they dead-lettered.
+*/
+var WEBHOOK_DELIVERY_TASK = "rebase.webhook.deliver";
 /** Read at most this much of a response before cancelling the rest. */
 var MAX_RESPONSE_BYTES = 64 * 1024;
 var WebhookDispatcher = class {
@@ -11085,21 +11574,64 @@ var WebhookDispatcher = class {
 	* for a third party. It also means a receiver that is down can no longer
 	* fail the customer's write.
 	*
-	* The cost, stated plainly: the queue is in-process and in-memory. A crash
-	* or a deploy between the enqueue and the delivery drops the event, and a
-	* receiver may see the notification a few milliseconds before the row it
-	* describes is committed. Use {@link flush} on shutdown, and
-	* `onDelivery` to record failures.
+	* The cost, when no `jobQueue` is configured: the queue is in-process and
+	* in-memory. A crash or a deploy between the enqueue and the delivery drops
+	* the event, and a receiver may see the notification a few milliseconds
+	* before the row it describes is committed. Use {@link flush} on shutdown,
+	* and `onDelivery` to record failures.
+	*
+	* With `jobQueue` set, only the second half of that remains: the delivery
+	* becomes a row in `rebase.jobs` and survives the crash, the deploy and the
+	* pod being rescheduled.
 	*/
 	enqueueEntityChange(table, event, id, entity, previousEntity) {
 		const jobs = this.buildDeliveries(table, event, entity, previousEntity);
 		if (jobs.length === 0) return;
+		if (this.options.jobQueue) {
+			for (const job of jobs) this.options.jobQueue.enqueue(WEBHOOK_DELIVERY_TASK, {
+				webhookId: job.webhook.id,
+				event: job.event,
+				payload: job.payload
+			}).catch((error) => {
+				logger.error("[webhooks] Could not queue a delivery; falling back to in-process", { error });
+				this.queue.push(job);
+				this.startDraining();
+			});
+			return;
+		}
 		this.queue.push(...jobs);
 		this.startDraining();
 	}
 	/**
+	* Deliver one queued job, as the worker runs it.
+	*
+	* One attempt, and it throws on failure. The retries belong to the queue
+	* now: keeping both would multiply — three in-process attempts inside each
+	* of three job attempts is nine deliveries and about two minutes of holding
+	* a worker slot — and only the queue's retries survive a restart, which is
+	* the whole reason for moving.
+	*/
+	async deliverQueuedJob(job) {
+		const webhook = this.webhooks.find((w) => w.id === job.webhookId);
+		if (!webhook) {
+			logger.warn(`[webhooks] Dropping a queued delivery for unknown or disabled webhook "${job.webhookId}"`);
+			return;
+		}
+		const { result, terminal } = await this.deliver(webhook, job.event, job.payload, 1);
+		this.options.onDelivery?.(result);
+		if (result.success) return;
+		if (terminal) {
+			logger.error(`[webhooks] "${webhook.id}" failed permanently: ${result.responseBody.slice(0, 200)}`);
+			return;
+		}
+		throw new Error(`Webhook "${webhook.id}" responded ${result.statusCode}: ${result.responseBody.slice(0, 200)}`);
+	}
+	/**
 	* Wait for every queued delivery to finish. For graceful shutdown, and for
 	* tests that need to observe what {@link enqueueEntityChange} sent.
+	*
+	* In-process deliveries only — with a `jobQueue` configured there is
+	* nothing here to wait for, because the deliveries are rows.
 	*/
 	async flush() {
 		while (this.draining) await this.draining;
@@ -11299,7 +11831,7 @@ function listenWithPortRetry(server, startPort, options) {
 		server.once("error", onError);
 		server.listen(startPort, host, () => {
 			server.removeListener("error", onError);
-			resolve(startPort);
+			resolve(boundPort(server) ?? startPort);
 		});
 	});
 	let affinityPort = null;
@@ -11329,14 +11861,15 @@ function listenWithPortRetry(server, startPort, options) {
 			attempt++;
 			const onListening = () => {
 				cleanup();
+				const bound = boundPort(server) ?? port;
 				if (portFileDir) {
 					try {
 						const portFile = path.join(portFileDir, DEV_PORT_FILENAME);
-						fs.writeFileSync(portFile, `${port} ${startPort}`, "utf-8");
+						fs.writeFileSync(portFile, `${bound} ${startPort}`, "utf-8");
 					} catch {}
-					writeStateFile(portFileDir, port, options?.serviceKey);
+					writeStateFile(portFileDir, bound, options?.serviceKey);
 				}
-				resolve(port);
+				resolve(bound);
 			};
 			const onError = (err) => {
 				cleanup();
@@ -11404,6 +11937,18 @@ function writeStateFile(projectRoot, port, serviceKey) {
 		fs.chmodSync(stateFile, 384);
 	} catch {}
 }
+/**
+* The port a server is actually listening on, or `undefined` if it cannot say.
+*
+* `Server.address()` returns a string for a UNIX socket and `null` before the
+* socket is bound, so neither is a port and both fall back to the caller's own
+* answer rather than being coerced into a number.
+*/
+function boundPort(server) {
+	const address = server.address();
+	if (!address || typeof address === "string") return void 0;
+	return address.port;
+}
 //#endregion
 //#region src/serve-spa.ts
 /**
@@ -11895,7 +12440,64 @@ var bootEnvExtension = object({
 		""
 	]).default("true").transform((v) => v !== "false"),
 	/** Comma-separated origins allowed to make credentialed cross-origin calls. */
-	CORS_ORIGINS: string().optional()
+	CORS_ORIGINS: string().optional(),
+	/**
+	* Which part of the project this process serves.
+	*
+	* `all` — everything, in one process. The default, and what every existing
+	* deployment gets by setting nothing.
+	*
+	* The other three exist so one image and one bundle can be booted several
+	* times over, each serving a different part: `api` (data, auth, admin,
+	* storage, meta), `functions` (custom functions only), `worker` (no HTTP
+	* surface at all — cron and the job queue).
+	*
+	* See `resolveRole` in `boot/role.ts` for exactly what each one mounts and
+	* owns, and for the combinations that refuse to boot.
+	*/
+	REBASE_ROLE: _enum([
+		"all",
+		"api",
+		"functions",
+		"worker",
+		""
+	]).default("all").transform((v) => v === "" ? "all" : v),
+	/**
+	* Override whether this process runs the cron scheduler's timers.
+	*
+	* Separate from the role because "which URLs answer" and "which timers fire"
+	* are independent questions: a three-way split wants cron off the `api`
+	* process, a two-way split wants it on. Unset follows the role.
+	*/
+	REBASE_CRON_SCHEDULER: _enum([
+		"true",
+		"false",
+		""
+	]).optional().transform((v) => v === void 0 || v === "" ? void 0 : v === "true"),
+	/** Override whether this process runs job-queue workers. Unset follows the role. */
+	REBASE_JOB_WORKERS: _enum([
+		"true",
+		"false",
+		""
+	]).optional().transform((v) => v === void 0 || v === "" ? void 0 : v === "true"),
+	/**
+	* Comma-separated function names this process serves. Unset means all.
+	*
+	* `functions` role only. A name that is not in the bundle is a boot failure,
+	* not a warning — the deployment exists to serve that function, and a typo
+	* that silently serves nothing is the failure this must not have.
+	*/
+	REBASE_FUNCTIONS_ONLY: string().optional(),
+	/** Comma-separated function names to skip. Applied after `_ONLY`. */
+	REBASE_FUNCTIONS_EXCLUDE: string().optional(),
+	/**
+	* Base URL of the process serving `/api/functions/*`.
+	*
+	* `api` role only. Set it and this process forwards those requests there
+	* instead of mounting them, so a split deployment presents the identical URL
+	* surface and nobody has to run a reverse proxy to try one.
+	*/
+	REBASE_FUNCTIONS_UPSTREAM: string().optional()
 });
 /**
 * Load and validate the environment for a bundle boot.
@@ -11952,24 +12554,152 @@ function resolveEnableSwagger(env) {
 	return env.NODE_ENV === "production" ? false : void 0;
 }
 /**
-* Build the CORS origin policy.
+* Build the CORS origin policy.
+*
+* Production serves an explicit allow-list and nothing else. `loadEnv` already
+* refuses to start a production process with neither `CORS_ORIGINS` nor
+* `FRONTEND_URL`, so an empty list here can only mean the values were blank
+* strings — still worth failing on, because the alternative is an API that
+* quietly rejects its own frontend.
+*/
+function resolveCorsOrigin(env) {
+	if (!(env.NODE_ENV === "production")) return (origin) => {
+		if (!origin) return "*";
+		return isLocalhostOrigin(origin) ? origin : null;
+	};
+	const allowed = (env.CORS_ORIGINS || env.FRONTEND_URL || "").split(",").map((s) => s.trim()).filter(Boolean);
+	if (allowed.length === 0) throw new Error("CORS_ORIGINS or FRONTEND_URL must be set in production. Example: CORS_ORIGINS=https://yourdomain.com");
+	if (allowed.includes("*")) throw new Error("CORS_ORIGINS cannot be \"*\" — the API sends credentials, and browsers refuse a wildcard origin on credentialed requests. List the exact origins.");
+	return (origin) => allowed.includes(origin) ? origin : null;
+}
+//#endregion
+//#region src/boot/role.ts
+/**
+* A refusal to boot, phrased as the variable to change.
+*
+* Its own class so `bootFromBundle` can present it as a configuration problem
+* rather than a crash. Every message names the variable and the fix, because the
+* reader is looking at a container that will not start and has one line of log
+* to work from.
+*/
+var RoleConfigurationError = class extends Error {
+	hint;
+	constructor(message, hint) {
+		super(message);
+		this.hint = hint;
+		this.name = "RoleConfigurationError";
+	}
+};
+/**
+* What each role serves and owns.
+*
+* Read as a table, deliberately. `api` keeps cron and the job workers so that
+* the common two-service split (`api` + `functions`) is complete without a third
+* container; a deployment that wants them off the request path adds a `worker`
+* and sets `REBASE_CRON_SCHEDULER=false` on the api. `functions` runs no timers
+* at all — a function process is scaled by request load and replaced at will, so
+* giving it scheduled work would make its replica count mean something.
+*/
+var ROLES = {
+	all: {
+		surfaces: {},
+		ownership: {},
+		provisionSchema: true
+	},
+	api: {
+		surfaces: { functions: false },
+		ownership: {},
+		provisionSchema: true
+	},
+	functions: {
+		surfaces: {
+			auth: false,
+			data: false,
+			storage: false,
+			admin: false,
+			cron: false,
+			meta: false
+		},
+		ownership: {
+			cronScheduler: false,
+			jobWorkers: false
+		},
+		provisionSchema: false
+	},
+	worker: {
+		surfaces: {
+			auth: false,
+			data: false,
+			storage: false,
+			admin: false,
+			functions: false,
+			cron: false,
+			meta: false
+		},
+		ownership: {},
+		provisionSchema: false
+	}
+};
+/** Split a comma-separated list, dropping blanks. */
+function parseNameList(raw) {
+	if (!raw) return [];
+	return raw.split(",").map((name) => name.trim()).filter(Boolean);
+}
+/**
+* Resolve the process shape, or refuse.
+*
+* @throws RoleConfigurationError for a combination that would boot into a state
+*   nobody meant — see the refusals inline. Each one is a refusal rather than a
+*   warning because its failure mode is silent: a second process racing schema
+*   DDL, or presence quietly not crossing instances, is not something an
+*   operator finds by reading logs.
+*/
+function resolveRole(env) {
+	const role = env.REBASE_ROLE ?? "all";
+	const base = ROLES[role];
+	if (!base) throw new RoleConfigurationError(`REBASE_ROLE="${role}" is not a role.`, `Use one of: ${Object.keys(ROLES).join(", ")}.`);
+	const migrate = env.REBASE_MIGRATE_ON_BOOT || "ensure";
+	if (!base.provisionSchema && migrate !== "none") throw new RoleConfigurationError(`REBASE_ROLE="${role}" cannot also provision the database schema (REBASE_MIGRATE_ON_BOOT="${migrate}").`, "Set REBASE_MIGRATE_ON_BOOT=none on this process. Exactly one process in a split deployment provisions the schema, and that is the one running REBASE_ROLE=api (or all).");
+	if (env.REBASE_FUNCTIONS_UPSTREAM && role !== "api") throw new RoleConfigurationError(`REBASE_FUNCTIONS_UPSTREAM is only read by REBASE_ROLE=api, and this process is "${role}".`, role === "functions" ? "A functions process serves those routes; it does not forward them. Set the upstream on the api process instead." : "Remove it, or set REBASE_ROLE=api on this process.");
+	if (Boolean(env.REBASE_FUNCTIONS_ONLY || env.REBASE_FUNCTIONS_EXCLUDE) && role !== "functions") throw new RoleConfigurationError(`REBASE_FUNCTIONS_ONLY / REBASE_FUNCTIONS_EXCLUDE are only read by REBASE_ROLE=functions, and this process is "${role}".`, "Set them on the functions process, or set REBASE_ROLE=functions here.");
+	const ownership = { ...base.ownership };
+	if (env.REBASE_CRON_SCHEDULER !== void 0) ownership.cronScheduler = env.REBASE_CRON_SCHEDULER;
+	if (env.REBASE_JOB_WORKERS !== void 0) ownership.jobWorkers = env.REBASE_JOB_WORKERS;
+	return {
+		role,
+		surfaces: { ...base.surfaces },
+		ownership,
+		provisionSchema: base.provisionSchema,
+		functionsSelection: {
+			only: parseNameList(env.REBASE_FUNCTIONS_ONLY),
+			exclude: parseNameList(env.REBASE_FUNCTIONS_EXCLUDE)
+		},
+		functionsUpstream: env.REBASE_FUNCTIONS_UPSTREAM?.trim() || void 0
+	};
+}
+/**
+* ## Why there is no channel-bus refusal here
 *
-* Production serves an explicit allow-list and nothing else. `loadEnv` already
-* refuses to start a production process with neither `CORS_ORIGINS` nor
-* `FRONTEND_URL`, so an empty list here can only mean the values were blank
-* strings — still worth failing on, because the alternative is an API that
-* quietly rejects its own frontend.
+* Splitting `api` from `functions` was expected to need one: the in-memory
+* channel bus is the default, and broadcast and presence do not cross processes
+* on it. It turns out to be the wrong place to check, for two reasons.
+*
+* The first is that a role split does not create the problem. Only the roles
+* that mount the API serve websockets at all — a `functions` process has no
+* realtime clients to keep in sync, and a `worker` has no HTTP surface. What
+* makes the bus matter is the *replica count* of the websocket-serving process,
+* which is exactly as true for a single `all` deployment scaled to three as it
+* is for a split one, and which no process can read from its own environment.
+*
+* The second is that the runtime already answers it better than a guess from
+* configuration could: `RealtimeService.warnIfMemoryBusOnMultiplePods` fires on
+* *evidence* — the first notification seen from another instance while the bus
+* is still in-memory. That is a fact rather than an inference, and it catches
+* the scaled-`all` case this would have missed.
+*
+* So: no refusal, and the operator guidance belongs in the deployment docs
+* beside the replica count, not here.
 */
-function resolveCorsOrigin(env) {
-	if (!(env.NODE_ENV === "production")) return (origin) => {
-		if (!origin) return "*";
-		return isLocalhostOrigin(origin) ? origin : null;
-	};
-	const allowed = (env.CORS_ORIGINS || env.FRONTEND_URL || "").split(",").map((s) => s.trim()).filter(Boolean);
-	if (allowed.length === 0) throw new Error("CORS_ORIGINS or FRONTEND_URL must be set in production. Example: CORS_ORIGINS=https://yourdomain.com");
-	if (allowed.includes("*")) throw new Error("CORS_ORIGINS cannot be \"*\" — the API sends credentials, and browsers refuse a wildcard origin on credentialed requests. List the exact origins.");
-	return (origin) => allowed.includes(origin) ? origin : null;
-}
 //#endregion
 //#region src/boot/sources.ts
 /**
@@ -12190,168 +12920,6 @@ function loadDeclaredStorageSources(startDir, levels = 5) {
 	return [];
 }
 //#endregion
-//#region src/boot/version-skew.ts
-/**
-* Telling a *stale* driver apart from a driver that never had the feature.
-*
-* The managed runtime is two halves that version independently. The image
-* supplies `@rebasepro/server` — `docker/entrypoint.mjs` symlinks it over
-* whatever the bundle installed, so the boot harness is always the image's. The
-* **driver** is not redirected: `@rebasepro/server-postgres` comes from the
-* bundle's `deps.declared`, pinned to whatever the project's `package.json`
-* asked npm for. Shipping a new image therefore does not ship a new driver, and
-* a fix that spans both packages reaches a tenant only after an npm publish AND
-* a rebuild.
-*
-* That split has a nasty failure mode, and it has already burned a day. Boot
-* looks for an optional capability, does not find it, and reports the honest
-* local fact — "this driver does not implement collection-table creation" —
-* which is exactly what a schemaless driver looks like. But a driver that is
-* merely *older than the runtime asking* looks identical, and the two want
-* opposite responses: one is "this database is not managed by Rebase, carry on",
-* the other is "your tables were never created and every data route is about to
-* 500". Naming the versions is what separates them, so these helpers exist to
-* put both numbers in front of whoever reads the log.
-*/
-/** The package whose version defines "the runtime" for skew purposes. */
-var RUNTIME_PACKAGE = "@rebasepro/server";
-/**
-* Locate a package by walking `node_modules` up from a directory.
-*
-* Lives here rather than in `driver.ts` because both the driver loader and the
-* version check need it, and `driver.ts` already imports this module.
-*/
-function findPackageDir(fromDir, packageName) {
-	let dir = path.resolve(fromDir);
-	for (;;) {
-		const candidate = path.join(dir, "node_modules", ...packageName.split("/"));
-		if (fs.existsSync(path.join(candidate, "package.json"))) return candidate;
-		const parent = path.dirname(dir);
-		if (parent === dir) return void 0;
-		dir = parent;
-	}
-}
-/**
-* Parse the subset of semver the workspace actually publishes.
-*
-* Deliberately lenient: an unparseable version yields `undefined` and every
-* comparison then declines to judge, because a wrong "your driver is old"
-* warning on a fork's custom version string is worse than no warning at all.
-*/
-function parseVersion(version) {
-	const match = /^(\d+)\.(\d+)\.(\d+)(?:-(.+))?$/.exec(version.trim());
-	if (!match) return void 0;
-	return {
-		parts: [
-			Number(match[1]),
-			Number(match[2]),
-			Number(match[3])
-		],
-		prerelease: match[4]
-	};
-}
-/**
-* Compare two versions, or `undefined` when either cannot be parsed.
-*
-* Follows semver on the one rule that matters here: a prerelease sorts *below*
-* the release it leads to, so `0.12.1-canary.g7f1150f` < `0.12.1`. Without that
-* rule every canary would read as newer than the stable it precedes, and the
-* canaries are precisely where fixes land first.
-*/
-function compareVersions(a, b) {
-	const left = parseVersion(a);
-	const right = parseVersion(b);
-	if (!left || !right) return void 0;
-	for (let i = 0; i < 3; i++) if (left.parts[i] !== right.parts[i]) return left.parts[i] < right.parts[i] ? -1 : 1;
-	if (left.prerelease === right.prerelease) return 0;
-	if (left.prerelease === void 0) return 1;
-	if (right.prerelease === void 0) return -1;
-	return left.prerelease < right.prerelease ? -1 : 1;
-}
-/**
-* Describe how a driver's version relates to the runtime asking it for work.
-*
-* Returns `stale: false` whenever it cannot tell — an unknown version, an
-* unparseable one, a driver that is newer. Silence beats a confident wrong
-* diagnosis, and the caller still prints its own local fact either way.
-*/
-function describeDriverSkew(driverVersion, runtimeVersion) {
-	if (!driverVersion || !runtimeVersion) return { stale: false };
-	const order = compareVersions(driverVersion, runtimeVersion);
-	if (order === void 0) return { stale: false };
-	if (order < 0) return {
-		stale: true,
-		detail: `The driver is at ${driverVersion} while this runtime is ${runtimeVersion} — the driver is OLDER, so this is very likely a stale pin rather than a driver that never had the capability.`
-	};
-	return {
-		stale: false,
-		detail: `Driver ${driverVersion}, runtime ${runtimeVersion}.`
-	};
-}
-/**
-* How to get a project's schema applied, written once and owned by the runtime.
-*
-* This text lives in `@rebasepro/server` on purpose. The equivalent guidance in
-* the Postgres driver's schema-drift warning can only ever be as current as the
-* driver a tenant pinned — so the tenants who most need to be told "your driver
-* is too old" are exactly the ones whose driver still prints the old advice.
-* The image's copy of this package is never stale, so guidance printed from
-* here always reflects the platform as it is today.
-*
-* Both audiences get a line because the runtime cannot reliably tell which one
-* it is serving, and naming only the pnpm scripts — as this once did everywhere
-* — tells a managed operator to run a command that structurally cannot reach
-* their in-cluster database.
-*/
-function schemaRecoveryGuidance(options = {}) {
-	const lines = [
-		"  To apply this project's schema:",
-		"    • Managed cloud: the runtime applies tables and RLS at boot (unless",
-		"      REBASE_MIGRATE_ON_BOOT=none). `rebase db push` cannot reach a tenant's",
-		"      in-cluster database — redeploy instead."
-	];
-	if (options.staleDriver) lines.push("      Because the driver is pinned by your bundle, bump the", "      `@rebasepro/server-postgres` version in your project's package.json", "      and redeploy — a newer platform image alone will NOT update it.");
-	lines.push("    • Self-host: run `rebase db push` (dev) or `rebase db migrate` (prod).");
-	return lines.join("\n");
-}
-/**
-* The installed version of a package, read from its `package.json`.
-*
-* Returns `undefined` rather than throwing for every failure — a missing or
-* malformed manifest degrades the diagnosis, and must never take down a boot
-* that would otherwise have served.
-*/
-function readPackageVersion(packageDir) {
-	try {
-		const pkg = JSON.parse(fs.readFileSync(path.join(packageDir, "package.json"), "utf8"));
-		return typeof pkg.version === "string" ? pkg.version : void 0;
-	} catch {
-		return;
-	}
-}
-/**
-* The version of `@rebasepro/server` this deployment is actually running.
-*
-* Resolved from the same roots the drivers are, and that is the point rather
-* than a convenience. In a managed container `docker/entrypoint.mjs` replaces
-* `/bundle/node_modules/@rebasepro/server` with a link to the image's copy, so
-* reading the manifest *through the bundle* reports the version that will
-* really execute — which is exactly the number the driver has to be compared
-* against. Reading this package's own manifest by module path would report the
-* same thing in the happy case and quietly lie in the case that matters: a
-* bundle whose link did not happen.
-*
-* Returns `undefined` when the package cannot be found; every caller treats
-* that as "cannot judge" and stays quiet.
-*/
-function readRuntimeVersion(roots) {
-	for (const root of roots) {
-		const dir = findPackageDir(root, RUNTIME_PACKAGE);
-		const version = dir ? readPackageVersion(dir) : void 0;
-		if (version) return version;
-	}
-}
-//#endregion
 //#region src/boot/driver.ts
 /**
 * Run a trivial query against a source, to see whether it answers.
@@ -12567,6 +13135,10 @@ function resolveAuthOptions(env, usersCollection) {
 	const auth = {
 		collection: usersCollection,
 		jwtSecret: env.JWT_SECRET,
+		signingKeys: env.JWT_PRIVATE_KEY ? [{
+			kid: env.JWT_KEY_ID,
+			privateKey: normalizePemFromEnv(env.JWT_PRIVATE_KEY)
+		}] : void 0,
 		accessExpiresIn: env.JWT_ACCESS_EXPIRES_IN,
 		refreshExpiresIn: env.JWT_REFRESH_EXPIRES_IN,
 		serviceKey: env.REBASE_SERVICE_KEY,
@@ -12990,6 +13562,11 @@ async function bootFromBundle(options = {}) {
 	if (bundle.manifest.kind === "static") return bootStaticApp(bundle, devRoot, options);
 	const env = loadBootEnv();
 	const isProduction = env.NODE_ENV === "production";
+	const runtimeRole = resolveRole(env);
+	if (runtimeRole.role !== "all") logger.info(`Runtime role: ${runtimeRole.role}`, {
+		provisionsSchema: runtimeRole.provisionSchema,
+		...runtimeRole.ownership
+	});
 	const configExports = await loadBundleConfigExports(bundle);
 	const dataSourceDefs = configExports.dataSources;
 	const declaredStorage = normalizeStorageSources(bundle.manifest.storage?.sources, configExports.storageSources);
@@ -13013,14 +13590,20 @@ async function bootFromBundle(options = {}) {
 	const server = createServer(getRequestListener(app.fetch));
 	const usersCollection = await loadUsersCollection(bundle);
 	const storage = resolveStorageSources(process.env, storageSourceDefs, path.join(bundle.dir, "uploads"));
-	await ensureCollectionSchema(bundle, dataSources, env);
+	warnOnUnusableBundleShape(bundle);
 	const backend = await initializeRebaseBackend({
 		server,
 		app,
 		basePath: env.REBASE_BASE_PATH,
+		provisioningDriverResult: dataSources[0] ? { internals: dataSources[0].connection } : void 0,
 		collectionsDir: bundle.collectionsDir,
 		functionsDir: bundle.functionsDir,
 		cronsDir: bundle.cronsDir,
+		provisionSchema: options.provisionSchema ?? runtimeRole.provisionSchema,
+		surfaces: runtimeRole.surfaces,
+		ownership: runtimeRole.ownership,
+		functionsSelection: runtimeRole.functionsSelection,
+		functionsUpstream: runtimeRole.functionsUpstream,
 		bootstrappers: dataSources.map((s) => s.bootstrapper),
 		dataSources: dataSourceDefs,
 		storage,
@@ -13040,7 +13623,6 @@ async function bootFromBundle(options = {}) {
 		runtimeVersion: bundle.manifest.runtime?.builtAgainst,
 		schemaEditor: false
 	});
-	await ensureCollectionPolicies(bundle, dataSources, env);
 	metrics?.setKnownCollections(backend.collectionRegistry.getCollections().map((collection) => collection.slug).filter((slug) => Boolean(slug)));
 	const healthPaths = ["/health", `${(env.REBASE_BASE_PATH || "/api").replace(/\/$/, "")}/health`];
 	for (const healthPath of [...new Set(healthPaths)]) app.get(healthPath, async (c) => {
@@ -13079,6 +13661,7 @@ async function bootFromBundle(options = {}) {
 				"/health",
 				"/livez",
 				"/metrics",
+				"/.well-known",
 				...siblings
 			],
 			spa: staticApp.spa
@@ -13090,10 +13673,12 @@ async function bootFromBundle(options = {}) {
 			server.once("error", reject);
 			server.listen(env.PORT, () => {
 				server.removeListener("error", reject);
+				const address = server.address();
+				if (address && typeof address === "object") port = address.port;
 				resolve();
 			});
 		});
-		logger.info(`Rebase runtime listening on port ${env.PORT}`);
+		logger.info(`Rebase runtime listening on port ${port}`);
 	} else {
 		port = await listenWithPortRetry(server, env.PORT, {
 			portFileDir: devRoot,
@@ -13227,7 +13812,7 @@ async function runFromBundle(options = {}) {
 	try {
 		return await bootFromBundle(options);
 	} catch (err) {
-		if (err instanceof BundleError) {
+		if (err instanceof BundleError || err instanceof RoleConfigurationError || err instanceof FunctionSelectionError) {
 			logger.error(err.message);
 			if (err.hint) logger.error(err.hint);
 		} else logger.error("Failed to start the Rebase runtime", { error: err instanceof Error ? err : new Error(String(err)) });
@@ -13259,158 +13844,25 @@ function warnOnDriverSkew(dataSources, runtimeVersion) {
 	}
 }
 /**
-* The collections a data source's engine is the store for.
-*
-* A bundle's collections directory holds *every* collection the project
-* declares, whatever engine serves it — that is the point of `dataSource`
-* routing. What it is not is a list of tables to create: handing the whole
-* directory to the primary source's bootstrapper made a Firestore collection
-* declared alongside the Postgres ones arrive as an empty Postgres table, with
-* RLS policies, while the app went on reading its documents from Firestore.
-*
-* Excluding is deliberately conservative. A collection that names neither an
-* `engine` nor a `dataSource` belongs to whichever source is primary — the
-* "postgres" that `resolveDataSource` falls back to there is a default, not a
-* declaration, and must not exclude anything on its own. Only a collection that
-* explicitly routes to a *different* engine is dropped, so a project running two
-* sources on the same engine is unaffected.
-*/
-function collectionsStoredBy(collections, primary, dataSources) {
-	const registry = createDataSourceRegistry(dataSources.map((source) => ({
-		key: source.key,
-		engine: source.engine
-	})));
-	return collections.filter((collection) => {
-		const declared = collection.engine ?? (collection.dataSource ? resolveDataSource(collection, registry).engine : void 0);
-		if (!declared) return true;
-		return declared === primary.engine;
-	});
-}
-/** Say what was routed elsewhere, so a missing table is never a silent one. */
-function logForeignCollections(all, stored, primary) {
-	if (stored.length === all.length) return;
-	const foreign = all.filter((c) => !stored.includes(c)).map((c) => c.slug);
-	logger.info(`Skipping ${foreign.length} collection(s) served by another engine, not "${primary.engine}": ${foreign.join(", ")}. Their storage is not managed by this data source.`);
-}
-/**
-* Bring the database's collection tables up to date before serving.
-*
-* Delegates to whichever driver bootstrapped the default data source; a driver
-* without `ensureCollectionSchema` (a schemaless one, or an older build) skips
-* rather than failing, which is why this cannot break an existing deployment.
-*
-* Every path out of here says why, at info or louder. Guaranteeing the tables
-* exist is this function's entire job, so "it declined, and said nothing" is the
-* one outcome it must never produce: a deployment that skips comes up answering
-* sign-in and 500ing every `/api/data/*` route, and the operator's only evidence
-* is what these lines print. Silence here has already sent one investigation
-* chasing a stale runtime image that was not stale.
-*
-* Failure is fatal on purpose. Booting anyway would produce exactly the state
-* this exists to prevent — an app that answers sign-in and 500s every data
-* request — and a crash-looping pod with the DDL error in its logs is a far
-* better signal than a running one that silently cannot serve.
-*/
-async function ensureCollectionSchema(bundle, dataSources, env) {
-	const skip = (reason, level = "info") => {
-		logger[level](`Collection schema: skipped — ${reason}`);
-	};
-	if ((env.REBASE_MIGRATE_ON_BOOT || "ensure") === "none") {
-		skip("REBASE_MIGRATE_ON_BOOT=none, leaving the database schema untouched.");
-		return;
-	}
-	if (bundle.manifest.kind !== "backend") {
-		skip(`this bundle's kind is "${bundle.manifest.kind}", which serves no database.`);
-		return;
-	}
-	if (!bundle.manifest.entry?.config) {
-		skip("this bundle declares no config package, so its collections are read from the database rather than from code.");
-		return;
-	}
-	if (!bundle.collectionsDir) {
-		skip(`this bundle declares a config package at "${bundle.manifest.entry.config}", but no collections directory resolved inside it. Rebuild with \`rebase build\` and check the manifest's \`entry.collections\`.`, "warn");
-		return;
-	}
-	const primary = dataSources[0];
-	if (!primary) {
-		skip("no data source was initialized for this runtime.", "warn");
-		return;
-	}
-	if (!primary.bootstrapper.ensureCollectionSchema) {
-		const skew = describeDriverSkew(primary.driverVersion, readRuntimeVersion(bundleResolutionRoots(bundle.dir)));
-		skip(`the adapter from "${primary.driverPackage}" (engine "${primary.engine}") does not expose collection-table creation. ` + (skew.detail ? `${skew.detail} ` : "") + "The driver package may well implement it on a class the adapter does not forward, so check the adapter's shape before blaming its version. Collection tables will NOT be created, so every /api/data route will fail on a missing relation.\n" + schemaRecoveryGuidance({ staleDriver: skew.stale }), "warn");
-		return;
-	}
-	const loaded = await loadCollectionsFromDirectory(bundle.collectionsDir);
-	if (loaded.length === 0) {
-		skip(`no collections were loaded from "${bundle.collectionsDir}".`, "warn");
-		return;
-	}
-	const collections = collectionsStoredBy(loaded, primary, dataSources);
-	logForeignCollections(loaded, collections, primary);
-	if (collections.length === 0) {
-		skip(`none of the ${loaded.length} declared collection(s) are stored by the "${primary.engine}" data source.`);
-		return;
-	}
-	const { applied } = await primary.bootstrapper.ensureCollectionSchema(collections, preInitDriverResult(primary), (message) => logger.debug(`schema: ${message}`));
-	if (applied > 0) logger.info(`Applied ${applied} additive schema change(s) before boot.`);
-	else logger.debug("Collection schema is up to date.");
-}
-/**
-* The `InitializedDriver` to hand a bootstrapper before any driver exists.
+* Warn about a bundle whose shape makes provisioning impossible.
 *
-* Both schema hooks are declared to take the result of `initializeDriver`, but
-* they deliberately run *before* it: the tables have to exist before the driver
-* introspects them and registers collections. So there is no real result to
-* pass, and the field the hooks actually read is `internals` — the driver's own
-* opaque handle, which at this point is exactly the connection the coordinator
-* just opened (`{ db, pool }`, where `db` is the drizzle instance).
+* `initializeRebaseBackend` provisions the collection schema for every boot
+* path, and it decides from what actually resolved: a project with no
+* collections reads them from the database and creates nothing. That rule is
+* right, but from inside the runtime it cannot tell "this project declares no
+* collections" from "this build lost them" — and the second is a broken build
+* that silently serves an empty API.
 *
-* Wrapping it matters: the connection passed *bare* type-checks through any cast
-* and then reads `undefined.db` inside the driver, which surfaces as a boot
-* crash — `TypeError: Cannot read properties of undefined (reading 'db')` — on
-* every project whose driver implements these hooks. The cast is narrowed to the
-* one field a pre-init result cannot honestly supply, rather than `as never`
-* blanketing the whole argument.
+* Only the bundle knows the difference, so this is the one piece of the old
+* bundle-side provisioning worth keeping here. It warns; it never provisions.
 */
-function preInitDriverResult(source) {
-	return { internals: source.connection };
-}
-/**
-* Apply the project's RLS policies before serving — the companion to
-* {@link ensureCollectionSchema}, which creates the tables this makes servable.
-*
-* Runs after `initializeRebaseBackend`, not alongside table creation: the
-* generated policies call the `auth.*` helper functions, and `CREATE POLICY`
-* validates those exist, so this cannot run before auth is initialized. The
-* gate conditions mirror `ensureCollectionSchema` (mode, bundle shape, driver
-* support) — and because that function already ran and explained any skip on
-* this same boot, the benign gates here return quietly rather than logging the
-* same reason twice. The one thing it does say out loud is a driver that
-* created tables but cannot apply policies: that is the difference between a
-* served collection and a 401, and it must not pass in silence.
-*/
-async function ensureCollectionPolicies(bundle, dataSources, env) {
-	if ((env.REBASE_MIGRATE_ON_BOOT || "ensure") === "none") return;
+function warnOnUnusableBundleShape(bundle) {
 	if (bundle.manifest.kind !== "backend") return;
 	if (!bundle.manifest.entry?.config) return;
-	if (!bundle.collectionsDir) return;
-	const primary = dataSources[0];
-	if (!primary) return;
-	if (!primary.bootstrapper.ensureCollectionPolicies) {
-		const skew = describeDriverSkew(primary.driverVersion, readRuntimeVersion(bundleResolutionRoots(bundle.dir)));
-		logger.warn(`Collection policies: skipped — the "${primary.driverPackage}" driver (engine "${primary.engine}") does not apply RLS policies at boot. ` + (skew.detail ? `${skew.detail} ` : "") + "Collections are not row-secured until policies are applied — depending on the driver's grants that means reads are denied or that they are unfiltered. Do not serve traffic until this is resolved.\n" + schemaRecoveryGuidance({ staleDriver: skew.stale }));
-		return;
-	}
-	const loaded = await loadCollectionsFromDirectory(bundle.collectionsDir);
-	if (loaded.length === 0) return;
-	const collections = collectionsStoredBy(loaded, primary, dataSources);
-	if (collections.length === 0) return;
-	const { applied } = await primary.bootstrapper.ensureCollectionPolicies(collections, preInitDriverResult(primary), (message) => logger.debug(`policies: ${message}`));
-	if (applied > 0) logger.info(`Applied ${applied} RLS policy statement(s) before serving.`);
-	else logger.debug("RLS policies are up to date.");
+	if (bundle.collectionsDir) return;
+	logger.warn(`This bundle declares a config package at "${bundle.manifest.entry.config}", but no collections directory resolved inside it, so no collections were loaded and no tables will be created. Rebuild with \`rebase build\` and check the manifest's \`entry.collections\`.`);
 }
 //#endregion
-export { ApiError, BlockedUrlError, BundleError, CronScheduler, DEFAULT_DRIVER_ID, DEFAULT_MAX_FILE_SIZE, DEFAULT_STORAGE_ID, DOCUMENT_MIME_TYPES, DefaultDriverRegistry, DefaultStorageRegistry, GCSStorageController, IMAGE_MIME_TYPES, LocalStorageController, MetricsRegistry, RawHtml, S3StorageController, SMTPEmailService, TransformCache, TusHandler, WebhookDispatcher, _resetRebaseMock, _setRebaseMock, applyCollectionDefaults, assertAllowedOutboundUrl, assertCollectionConfigs, assertDistinctSuffixes, assertEmailLinkBases, authJwt, authRoles, authUid, blockedAddressReason, bootFromBundle, classifySurface, cleanupDevPortFile, createAppleProvider, createBackupRoutes, createBitbucketProvider, createBuiltinAuthAdapter, createContractRoutes, createCronRoutes, createCronStore, createCustomAuthAdapter, createDiscordProvider, createEmailService, createFacebookProvider, createFunctionRoutes, createGitHubProvider, createGitLabProvider, createGoogleProvider, createHistoryRoutes, createLinkedinProvider, createMetricsMiddleware, createMetricsRoutes, createMicrosoftProvider, createSlackProvider, createSourceBundle, createSpotifyProvider, createStorageController, createStorageRoutes, createTwitterProvider, defineCron, defineFunction, envSuffixForKey, errorHandler, escapeHtml, extractUserFromToken, fileTokenAuth, findCollectionConfigProblems, generateSecurePassword, getEmailVerificationTemplate, getMagicLinkTemplate, getPasswordResetTemplate, getUserInvitationTemplate, getWelcomeEmailTemplate, hashPassword, html, httpMethodToOperation, initializeDataSource, initializeDataSources, initializeRebaseBackend, installShutdownHandlers, isApiKeyToken, isAuthAdapter, isDatabaseAdapter, isLocalhostOrigin, isOperationAllowed, isTransformableImage, listBackupObjects, listenWithPortRetry, loadBootEnv, loadBundle, loadBundleConfigExports, loadBundleSchema, loadCollectionsFromDirectory, loadCronJobsFromDirectory, loadCronJobsWithDiagnostics, loadDeclaredStorageSources, loadEnv, loadFunctionsFromDirectory, loadUsersCollection, logger, oauthCodeFlowSchema, optionalAuth, parseBackupDestination, parseBackupTimestamp, parseTransformOptions, pkceTokenParams, providerVerifiedEmail, queryTokenAuth, raw, readBackupBytes, readBundleManifest, rebase, requireAdmin, requireAuth, resolveAuthHooks, resolveAuthOptions, resolveCorsOrigin, resolveDataSources, resolveEmailLinkBase, resolveEmailOptions, resolveRequireAuth, resolveStorageBackend, resolveStorageSources, runFromBundle, safeCompare, serveSPA, transformImage, tryVerifyOidcIdToken, unknownKeyPolicyFromEnv, validateApiKey, validateCronExpression, validatePasswordStrength, verifyOidcIdToken, verifyPassword };
+export { ApiError, BlockedUrlError, BundleError, CONCURRENT_DDL_SQLSTATES, CronScheduler, DEFAULT_DRIVER_ID, DEFAULT_MAX_FILE_SIZE, DEFAULT_STORAGE_ID, DOCUMENT_MIME_TYPES, DefaultDriverRegistry, DefaultStorageRegistry, GCSStorageController, IMAGE_MIME_TYPES, LocalStorageController, MetricsRegistry, RawHtml, S3StorageController, SMTPEmailService, TransformCache, TusHandler, UnknownStorageSourceError, WEBHOOK_DELIVERY_TASK, WebhookDispatcher, _resetRebaseMock, _setRebaseMock, applyCollectionDefaults, assertAllowedOutboundUrl, assertCollectionConfigs, assertDistinctSuffixes, assertEmailLinkBases, assertWriteRequestValid, authJwt, authRoles, authUid, blockedAddressReason, bootFromBundle, classifySurface, cleanupDevPortFile, createAppleProvider, createBackupRoutes, createBitbucketProvider, createBuiltinAuthAdapter, createContractRoutes, createCronRoutes, createCronStore, createCustomAuthAdapter, createDdlBootstrapper, createDiscordProvider, createEmailService, createFacebookProvider, createFunctionRoutes, createGitHubProvider, createGitLabProvider, createGoogleProvider, createHistoryRoutes, createJobQueue, createJobStore, createJwksRoutes, createLinkedinProvider, createMetricsMiddleware, createMetricsRoutes, createMicrosoftProvider, createSlackProvider, createSourceBundle, createSpotifyProvider, createStorageController, createStorageRoutes, createTwitterProvider, defaultBackoff, defineCron, defineFunction, envSuffixForKey, errorHandler, escapeHtml, extractUserFromToken, fileTokenAuth, findCollectionConfigProblems, generateSecurePassword, getEmailVerificationTemplate, getJwks, getMagicLinkTemplate, getPasswordResetTemplate, getUserInvitationTemplate, getWelcomeEmailTemplate, hasAsymmetricSigningKey, hashPassword, html, httpMethodToOperation, initializeDataSource, initializeDataSources, initializeRebaseBackend, installShutdownHandlers, isApiKeyToken, isAuthAdapter, isConcurrentDdlRace, isDatabaseAdapter, isDuplicateObjectRace, isLocalhostOrigin, isOperationAllowed, isTransformableImage, listBackupObjects, listenWithPortRetry, loadBootEnv, loadBundle, loadBundleConfigExports, loadBundleSchema, loadCollectionsFromDirectory, loadCronJobsFromDirectory, loadCronJobsWithDiagnostics, loadDeclaredStorageSources, loadEnv, loadFunctionsFromDirectory, loadUsersCollection, logger, oauthCodeFlowSchema, optionalAuth, parseBackupDestination, parseBackupTimestamp, parseTransformOptions, pkceTokenParams, providerVerifiedEmail, queryTokenAuth, raw, readBackupBytes, readBundleManifest, rebase, requireAdmin, requireAuth, resolveAuthHooks, resolveAuthOptions, resolveCorsOrigin, resolveDataSources, resolveEmailLinkBase, resolveEmailOptions, resolveRequireAuth, resolveStorageBackend, resolveStorageSources, runFromBundle, safeCompare, serveSPA, transformImage, tryVerifyOidcIdToken, unknownKeyPolicyFromEnv, validateApiKey, validateCronExpression, validatePasswordStrength, verifyOidcIdToken, verifyPassword };
 
 //# sourceMappingURL=index.es.js.map