@rebasepro/server 0.14.1-canary.g7e666eb → 0.14.1

package/dist/index.es.js

@@ -4,10 +4,10 @@ __createRequire(import.meta.url);
 import { A as GeoPoint, M as RebaseApiError, N as RebaseClientError, O as EntityReference, S as toSnakeCase, _ as fieldKeyForColumn, b as buildCompositeId, c as collectAllPages, d as normalizeOrderBy, f as serializeOrderBy, g as getEffectiveSecurityRules, h as resolveDataSource, j as Vector, k as EntityRelation, l as paginateFind, m as createDataSourceRegistry, n as buildSdkData, o as serializeFilter, p as CollectionRegistry, s as serializeLogicalCondition, t as buildRoutedRebaseData, u as resolveFindWindow, v as findRelation, x as resolvePrimaryKeys, y as resolveCollectionRelations } from "./src-8XDWyDfR.js";
 import { c as DEFAULT_DATA_SOURCE_KEY, i as getCollectionDataPath, m as toCanonicalOp, n as RLS_ROLES_SQL, o as isPostgresCollectionConfig, r as RLS_UID_SQL, t as RLS_JWT_SQL } from "./src-Cz9nMgUR.js";
 import { n as ADMIN_PROPERTY_KEYS, t as ADMIN_COLLECTION_KEYS } from "./admin_block-H86dCPsj.js";
-import { i as isSQLAdmin, r as revokeInternalTableSql } from "./ddl-bootstrap-BhXbTnBl.js";
-import { C as DEFAULT_STORAGE_SOURCE_KEY, E as storageEnvSuffix, T as normalizeStorageSources, _ as InvalidStorageKeyError, b as canonicalStorageKey, g as InvalidStorageBucketError, i as generateDownloadToken, n as configureJwt, v as canonicalStorageBucket, w as findStorageSuffixCollision, y as canonicalStorageId } from "./jwt-CYGFT0ih.js";
+import { a as isDuplicateObjectRace, i as isConcurrentDdlRace, n as createDdlBootstrapper, o as revokeInternalTableSql, s as isSQLAdmin, t as CONCURRENT_DDL_SQLSTATES } from "./ddl-bootstrap-Cywoj8Ta.js";
+import { C as canonicalStorageKey, D as findStorageSuffixCollision, E as DEFAULT_STORAGE_SOURCE_KEY, O as normalizeStorageSources, S as canonicalStorageId, b as InvalidStorageKeyError, c as getJwks, d as hasAsymmetricSigningKey, i as generateDownloadToken, k as storageEnvSuffix, n as configureJwt, p as isJwtConfigured, v as normalizePemFromEnv, x as canonicalStorageBucket, y as InvalidStorageBucketError } from "./jwt-VJyXTdQQ.js";
 import { n as createContractRoutes } from "./contract-routes-Bet-eCNJ.js";
-import { $ as fileTokenAuth, A as MemoryRateLimitStore, B as getEmailVerificationTemplate, C as ZodNumber, D as _coercedNumber, E as string, F as resolveAuthHooks, G as RawHtml, H as getPasswordResetTemplate, I as hashPassword, J as raw, K as escapeHtml, L as validatePasswordStrength, M as createEmailService, N as assertEmailLinkBases, O as DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT, P as resolveEmailLinkBase, Q as extractUserFromToken, R as verifyPassword, S as createBuiltinAuthAdapter, T as object, U as getUserInvitationTemplate, V as getMagicLinkTemplate, W as getWelcomeEmailTemplate, X as createAuthMiddleware, Y as createAdapterAuthMiddleware, Z as createRequireAuth, _ as createLinkedinProvider, _t as parseQueryOptions, a as createSpotifyProvider, at as createApiKeyPreAuth, b as pkceTokenParams, bt as isPublicStoragePath, c as createGitLabProvider, ct as isApiKeyToken, d as createFacebookProvider, dt as safeCompare, et as optionalAuth, f as createAppleProvider, ft as SERVICE_IDENTITY, g as createGitHubProvider, gt as orderByEntriesToTuples, h as verifyOidcIdToken, ht as isOperationAllowed, i as createApiKeyStore, it as requireAuth, j as SMTPEmailService, k as createDataRateLimiter, l as createDiscordProvider, lt as validateApiKey, m as tryVerifyOidcIdToken, mt as httpMethodToOperation, n as createCustomAuthAdapter, nt as queryTokenAuth, o as createSlackProvider, ot as createFunctionApiKeyGuard, p as createMicrosoftProvider, pt as scopeDataDriver, q as html, r as createApiKeyRoutes, rt as requireAdmin, s as createBitbucketProvider, st as createStorageApiKeyGuard, tt as publicObjectAuth, u as createTwitterProvider, ut as extractBearerToken, v as createGoogleProvider, vt as resolveListLimitParam, w as _enum, x as providerVerifiedEmail, y as oauthCodeFlowSchema, yt as PUBLIC_STORAGE_PREFIX, z as generateSecurePassword } from "./auth-BQcdhMBL.js";
+import { $ as extractUserFromToken, A as createDataRateLimiter, B as generateSecurePassword, C as createBuiltinAuthAdapter, Ct as isPublicStoragePath, D as string, E as object, F as resolveEmailLinkBase, G as getWelcomeEmailTemplate, H as getMagicLinkTemplate, I as resolveAuthHooks, J as html, K as RawHtml, L as hashPassword, M as SMTPEmailService, N as createEmailService, O as _coercedNumber, P as assertEmailLinkBases, Q as createRequireAuth, R as validatePasswordStrength, S as createJwksRoutes, St as PUBLIC_STORAGE_PREFIX, T as _enum, U as getPasswordResetTemplate, V as getEmailVerificationTemplate, W as getUserInvitationTemplate, X as createAdapterAuthMiddleware, Y as raw, Z as createAuthMiddleware, _ as createLinkedinProvider, _t as orderByEntriesToTuples, a as createSpotifyProvider, at as requireAuth, b as pkceTokenParams, bt as parseQueryOptions, c as createGitLabProvider, ct as createStorageApiKeyGuard, d as createFacebookProvider, dt as extractBearerToken, et as fileTokenAuth, f as createAppleProvider, ft as safeCompare, g as createGitHubProvider, gt as isOperationAllowed, h as verifyOidcIdToken, ht as httpMethodToOperation, i as createApiKeyStore, it as requireAdmin, j as MemoryRateLimitStore, k as DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT, l as createDiscordProvider, lt as isApiKeyToken, m as tryVerifyOidcIdToken, mt as scopeDataDriver, n as createCustomAuthAdapter, nt as publicObjectAuth, o as createSlackProvider, ot as createApiKeyPreAuth, p as createMicrosoftProvider, pt as SERVICE_IDENTITY, q as escapeHtml, r as createApiKeyRoutes, rt as queryTokenAuth, s as createBitbucketProvider, st as createFunctionApiKeyGuard, tt as optionalAuth, u as createTwitterProvider, ut as validateApiKey, v as createGoogleProvider, vt as parseAggregateSelect, w as ZodNumber, x as providerVerifiedEmail, xt as resolveListLimitParam, y as oauthCodeFlowSchema, yt as parseGroupBy, z as verifyPassword } from "./auth-BobZVd0j.js";
 import { t as logger } from "./logger-DfvF_8r-.js";
 import { n as errorHandler, t as ApiError } from "./errors-EBYiaJ2E.js";
 import { t as logMiddleware } from "./logs-routes-BYA72C_C.js";
@@ -19,8 +19,10 @@ import { t as createFunctionRoutes } from "./function-routes-Btcez1T-.js";
 import { n as loadCronJobsFromDirectory, r as loadCronJobsWithDiagnostics } from "./cron-loader-YhhQeVBM.js";
 import { r as validateCronExpression, t as CronScheduler } from "./cron-scheduler-DIpYBmZP.js";
 import { t as createCronRoutes } from "./cron-routes-maM_RlUu.js";
-import { t as createCronStore } from "./cron-store-D5dUNviq.js";
+import { t as createCronStore } from "./cron-store-CB1x-Ken.js";
 import { a as parseBackupTimestamp, i as parseBackupDestination, n as createBackupRoutes, o as readBackupBytes, r as listBackupObjects } from "./backup-C6ljYVTp.js";
+import { i as createJobStore, n as createJobQueue, r as defaultBackoff } from "./jobs-DR4SjGrD.js";
+import { t as FunctionSelectionError } from "./selection-_z6TM1DB.js";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import * as fs$2 from "fs";
 import fs, { existsSync } from "fs";
@@ -526,6 +528,344 @@ async function loadCollectionsFromDirectory(source, options = {}) {
 	return validate(applyCollectionDefaults(collections, await readDefaults(resolved)));
 }
 //#endregion
+//#region src/boot/version-skew.ts
+/**
+* Telling a *stale* driver apart from a driver that never had the feature.
+*
+* The managed runtime is two halves that version independently. The image
+* supplies `@rebasepro/server` — `docker/entrypoint.mjs` symlinks it over
+* whatever the bundle installed, so the boot harness is always the image's. The
+* **driver** is not redirected: `@rebasepro/server-postgres` comes from the
+* bundle's `deps.declared`, pinned to whatever the project's `package.json`
+* asked npm for. Shipping a new image therefore does not ship a new driver, and
+* a fix that spans both packages reaches a tenant only after an npm publish AND
+* a rebuild.
+*
+* That split has a nasty failure mode, and it has already burned a day. Boot
+* looks for an optional capability, does not find it, and reports the honest
+* local fact — "this driver does not implement collection-table creation" —
+* which is exactly what a schemaless driver looks like. But a driver that is
+* merely *older than the runtime asking* looks identical, and the two want
+* opposite responses: one is "this database is not managed by Rebase, carry on",
+* the other is "your tables were never created and every data route is about to
+* 500". Naming the versions is what separates them, so these helpers exist to
+* put both numbers in front of whoever reads the log.
+*/
+/** The package whose version defines "the runtime" for skew purposes. */
+var RUNTIME_PACKAGE = "@rebasepro/server";
+/**
+* Locate a package by walking `node_modules` up from a directory.
+*
+* Lives here rather than in `driver.ts` because both the driver loader and the
+* version check need it, and `driver.ts` already imports this module.
+*/
+function findPackageDir(fromDir, packageName) {
+	let dir = path.resolve(fromDir);
+	for (;;) {
+		const candidate = path.join(dir, "node_modules", ...packageName.split("/"));
+		if (fs.existsSync(path.join(candidate, "package.json"))) return candidate;
+		const parent = path.dirname(dir);
+		if (parent === dir) return void 0;
+		dir = parent;
+	}
+}
+/**
+* Parse the subset of semver the workspace actually publishes.
+*
+* Deliberately lenient: an unparseable version yields `undefined` and every
+* comparison then declines to judge, because a wrong "your driver is old"
+* warning on a fork's custom version string is worse than no warning at all.
+*/
+function parseVersion(version) {
+	const match = /^(\d+)\.(\d+)\.(\d+)(?:-(.+))?$/.exec(version.trim());
+	if (!match) return void 0;
+	return {
+		parts: [
+			Number(match[1]),
+			Number(match[2]),
+			Number(match[3])
+		],
+		prerelease: match[4]
+	};
+}
+/**
+* Compare two versions, or `undefined` when either cannot be parsed.
+*
+* Follows semver on the one rule that matters here: a prerelease sorts *below*
+* the release it leads to, so `0.12.1-canary.g7f1150f` < `0.12.1`. Without that
+* rule every canary would read as newer than the stable it precedes, and the
+* canaries are precisely where fixes land first.
+*/
+function compareVersions(a, b) {
+	const left = parseVersion(a);
+	const right = parseVersion(b);
+	if (!left || !right) return void 0;
+	for (let i = 0; i < 3; i++) if (left.parts[i] !== right.parts[i]) return left.parts[i] < right.parts[i] ? -1 : 1;
+	if (left.prerelease === right.prerelease) return 0;
+	if (left.prerelease === void 0) return 1;
+	if (right.prerelease === void 0) return -1;
+	return left.prerelease < right.prerelease ? -1 : 1;
+}
+/**
+* Describe how a driver's version relates to the runtime asking it for work.
+*
+* Returns `stale: false` whenever it cannot tell — an unknown version, an
+* unparseable one, a driver that is newer. Silence beats a confident wrong
+* diagnosis, and the caller still prints its own local fact either way.
+*/
+function describeDriverSkew(driverVersion, runtimeVersion) {
+	if (!driverVersion || !runtimeVersion) return { stale: false };
+	const order = compareVersions(driverVersion, runtimeVersion);
+	if (order === void 0) return { stale: false };
+	if (order < 0) return {
+		stale: true,
+		detail: `The driver is at ${driverVersion} while this runtime is ${runtimeVersion} — the driver is OLDER, so this is very likely a stale pin rather than a driver that never had the capability.`
+	};
+	return {
+		stale: false,
+		detail: `Driver ${driverVersion}, runtime ${runtimeVersion}.`
+	};
+}
+/**
+* How to get a project's schema applied, written once and owned by the runtime.
+*
+* This text lives in `@rebasepro/server` on purpose. The equivalent guidance in
+* the Postgres driver's schema-drift warning can only ever be as current as the
+* driver a tenant pinned — so the tenants who most need to be told "your driver
+* is too old" are exactly the ones whose driver still prints the old advice.
+* The image's copy of this package is never stale, so guidance printed from
+* here always reflects the platform as it is today.
+*
+* Both audiences get a line because the runtime cannot reliably tell which one
+* it is serving, and naming only the pnpm scripts — as this once did everywhere
+* — tells a managed operator to run a command that structurally cannot reach
+* their in-cluster database.
+*/
+function schemaRecoveryGuidance(options = {}) {
+	const lines = [
+		"  To apply this project's schema:",
+		"    • Managed cloud: the runtime applies tables and RLS at boot (unless",
+		"      REBASE_MIGRATE_ON_BOOT=none). `rebase db push` cannot reach a tenant's",
+		"      in-cluster database — redeploy instead."
+	];
+	if (options.staleDriver) lines.push("      Because the driver is pinned by your bundle, bump the", "      `@rebasepro/server-postgres` version in your project's package.json", "      and redeploy — a newer platform image alone will NOT update it.");
+	lines.push("    • Self-host: run `rebase db push` (dev) or `rebase db migrate` (prod).");
+	return lines.join("\n");
+}
+/**
+* The installed version of a package, read from its `package.json`.
+*
+* Returns `undefined` rather than throwing for every failure — a missing or
+* malformed manifest degrades the diagnosis, and must never take down a boot
+* that would otherwise have served.
+*/
+function readPackageVersion(packageDir) {
+	try {
+		const pkg = JSON.parse(fs.readFileSync(path.join(packageDir, "package.json"), "utf8"));
+		return typeof pkg.version === "string" ? pkg.version : void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* The version of `@rebasepro/server` this deployment is actually running.
+*
+* Resolved from the same roots the drivers are, and that is the point rather
+* than a convenience. In a managed container `docker/entrypoint.mjs` replaces
+* `/bundle/node_modules/@rebasepro/server` with a link to the image's copy, so
+* reading the manifest *through the bundle* reports the version that will
+* really execute — which is exactly the number the driver has to be compared
+* against. Reading this package's own manifest by module path would report the
+* same thing in the happy case and quietly lie in the case that matters: a
+* bundle whose link did not happen.
+*
+* Returns `undefined` when the package cannot be found; every caller treats
+* that as "cannot judge" and stays quiet.
+*/
+function readRuntimeVersion(roots) {
+	for (const root of roots) {
+		const dir = findPackageDir(root, RUNTIME_PACKAGE);
+		const version = dir ? readPackageVersion(dir) : void 0;
+		if (version) return version;
+	}
+}
+//#endregion
+//#region src/boot/provision.ts
+/**
+* Name the object that is missing a method, in a way that points somewhere.
+*
+* What is missing is the method on the ADAPTER — the only object this module
+* ever sees — which is not the same as the driver package lacking the code. So
+* a resolved package name is quoted as the adapter's *origin*, and an adapter
+* the application built itself is described as exactly that, with no package
+* name attached for the reader to go and bump.
+*/
+function describeAdapter(target) {
+	return target.driverPackage ? `the adapter from "${target.driverPackage}" (engine "${target.engine}")` : `this project's "${target.engine}" adapter`;
+}
+function provisioningDisabled(env = process.env) {
+	return (env.REBASE_MIGRATE_ON_BOOT || "ensure") === "none";
+}
+/**
+* Create any collection tables the database is missing, before serving.
+*
+* Additive only: the driver may create missing tables, columns and enum types,
+* and may never drop or rewrite. Destructive changes stay a deliberate
+* migration, because this runs unattended with nobody reading a diff.
+*
+* Every path out of here says why, at info or louder. Guaranteeing the tables
+* exist is this function's entire job, so "it declined, and said nothing" is the
+* one outcome it must never produce: a deployment that skips comes up answering
+* sign-in and 500ing every `/api/data/*` route, and the operator's only evidence
+* is what these lines print.
+*
+* Note that silence is still possible one level up — if nothing CALLS this, no
+* line is printed and the absence is the only signal. That is precisely the bug
+* this module was extracted to make structurally impossible, and it is why the
+* outcome is reported back to the driver rather than only logged.
+*
+* Failure is fatal on purpose. Booting anyway would produce exactly the state
+* this exists to prevent, and a crash-looping pod with the DDL error in its logs
+* is a far better signal than a running one that silently cannot serve.
+*/
+async function provisionCollectionTables(collections, target, options = {}) {
+	const skip = (reason, level = "info") => {
+		logger[level](`Collection schema: skipped — ${reason}`);
+		return {
+			status: "skipped",
+			reason
+		};
+	};
+	if (options.provision === false) return skip("this process does not provision the schema — another process in this deployment owns it.");
+	if (provisioningDisabled(options.env ?? process.env)) return skip("REBASE_MIGRATE_ON_BOOT=none, leaving the database schema untouched.");
+	if (options.introspecting) return skip("this project declares no collections, so they are read from the database rather than from code.");
+	if (collections.length === 0) return skip("no collections resolved for this data source.");
+	if (!target.bootstrapper.ensureCollectionSchema) return skip(`${describeAdapter(target)} does not expose collection-table creation. The driver package may well implement it on a class the adapter does not forward, so check the adapter's shape before blaming its version. Collection tables will NOT be created, so every /api/data route will fail on a missing relation.
+` + schemaRecoveryGuidance(), "warn");
+	const { applied } = await target.bootstrapper.ensureCollectionSchema(collections, target.driverResult, (message) => logger.debug(`schema: ${message}`));
+	if (applied > 0) logger.info(`Applied ${applied} additive schema change(s) before boot.`);
+	else logger.debug("Collection schema is up to date.");
+	return {
+		status: "applied",
+		applied
+	};
+}
+/**
+* Apply the collections' RLS policies — the companion to
+* {@link provisionCollectionTables}, which creates the tables this makes
+* servable.
+*
+* Runs after auth is initialized, not alongside table creation: the generated
+* policies call the `auth.*` helper functions and `CREATE POLICY` validates
+* those exist. Tables without policies are not servable either — authenticated
+* requests run as a restricted role, so a read with no policy returns nothing.
+*
+* The benign gates return quietly here rather than logging the same reason
+* twice: table provisioning already ran on this same boot and explained itself.
+* The one thing this does say out loud is a driver that created tables but
+* cannot apply policies — that is the difference between a served collection and
+* a 401, and it must not pass in silence.
+*/
+async function provisionCollectionPolicies(collections, target, options = {}) {
+	if (options.provision === false) {
+		logger.info("Collection RLS policies: not applied by this process — another process in this deployment owns them.");
+		return {
+			status: "skipped",
+			reason: "another process provisions"
+		};
+	}
+	if (provisioningDisabled(options.env ?? process.env)) return {
+		status: "skipped",
+		reason: "REBASE_MIGRATE_ON_BOOT=none"
+	};
+	if (options.introspecting) return {
+		status: "skipped",
+		reason: "collections are introspected"
+	};
+	if (collections.length === 0) return {
+		status: "skipped",
+		reason: "no collections"
+	};
+	if (!target.bootstrapper.ensureCollectionPolicies) {
+		const reason = `${describeAdapter(target)} does not apply RLS policies at boot`;
+		logger.warn(`Collection policies: skipped — ${reason}. Collections are not row-secured until policies are applied — depending on the driver's grants that means reads are denied or that they are unfiltered. Do not serve traffic until this is resolved.
+` + schemaRecoveryGuidance());
+		return {
+			status: "skipped",
+			reason
+		};
+	}
+	const { applied } = await target.bootstrapper.ensureCollectionPolicies(collections, target.driverResult, (message) => logger.debug(`policies: ${message}`));
+	if (applied > 0) logger.info(`Applied ${applied} RLS policy statement(s) before serving.`);
+	else logger.debug("RLS policies are up to date.");
+	return {
+		status: "applied",
+		applied
+	};
+}
+/**
+* The collections a data source's engine is the store for.
+*
+* A project's collections directory holds *every* collection it declares,
+* whatever engine serves it — that is the point of `dataSource` routing. What it
+* is not is a list of tables to create: handing the whole directory to the
+* primary source's bootstrapper made a Firestore collection declared alongside
+* the Postgres ones arrive as an empty Postgres table, with RLS policies, while
+* the app went on reading its documents from Firestore.
+*
+* Excluding is deliberately conservative. A collection that names neither an
+* `engine` nor a `dataSource` belongs to whichever source is primary — the
+* "postgres" that `resolveDataSource` falls back to there is a default, not a
+* declaration, and must not exclude anything on its own. Only a collection that
+* explicitly routes to a *different* engine is dropped, so a project running two
+* sources on the same engine is unaffected.
+*
+* Takes the shapes it actually reads rather than an `InitializedDataSource`, so
+* the path that has data sources and the path that has only an adapter can share
+* one implementation instead of growing a second one that drifts.
+*/
+function collectionsStoredBy(collections, primary, dataSources) {
+	const registry = createDataSourceRegistry(dataSources.map((source) => ({
+		key: source.key,
+		engine: source.engine
+	})));
+	return collections.filter((collection) => {
+		const declared = collection.engine ?? (collection.dataSource ? resolveDataSource(collection, registry).engine : void 0);
+		if (!declared) return true;
+		return declared === primary.engine;
+	});
+}
+/** Say what was routed elsewhere, so a missing table is never a silent one. */
+function logForeignCollections(all, stored, primary) {
+	if (stored.length === all.length) return;
+	const foreign = all.filter((c) => !stored.includes(c)).map((c) => c.slug);
+	logger.info(`Skipping ${foreign.length} collection(s) served by another engine, not "${primary.engine}": ${foreign.join(", ")}. Their storage is not managed by this data source.`);
+}
+/**
+* Which bootstrapper provisions, and what to call it in a message.
+*
+* The default source is the one that stores this project's collections, so it
+* is the one asked to create them; `dataSources[0]` is the bundle path's
+* equivalent of the same choice.
+*
+* `driverResult` is deliberately left undefined here. The hooks run BEFORE
+* `initializeDriver`, so there is no driver result to pass, and unlike the
+* bundle path — where the coordinator opens the connection itself — an app that
+* built its own adapter never handed the framework a connection handle. The
+* adapter has one: it was constructed with it. So the contract is that an
+* adapter falls back to its own connection when no result is supplied, which is
+* the only shape that works for both paths.
+*/
+function provisionTargetFor(bootstrappers, adapter, driverResult) {
+	const primary = bootstrappers.find((b) => b.isDefault) ?? bootstrappers[0];
+	return {
+		driverPackage: void 0,
+		engine: primary?.type ?? adapter?.type ?? "unknown",
+		bootstrapper: primary ?? {},
+		driverResult
+	};
+}
+//#endregion
 //#region src/services/driver-registry.ts
 /**
 * The default driver identifier used when:
@@ -1364,6 +1704,25 @@ var RestApiGenerator = class {
 			const total = await this.countRawEntities(driver, resolvedCollection, queryOptions, searchString);
 			return c.json({ count: total });
 		});
+		this.router.get(`${basePath}/aggregate`, async (c) => {
+			this.enforceApiKeyPermission(c, collection.slug);
+			const queryDict = c.req.queries();
+			const queryOptions = this.parseQuery(queryDict);
+			const searchString = Array.isArray(queryDict.searchString) ? queryDict.searchString[queryDict.searchString.length - 1] : void 0;
+			const aggregates = parseAggregateSelect(queryDict.select);
+			if (!aggregates) throw ApiError.badRequest("`select` is required, e.g. `?select=count()` or `?select=sum(total)&groupBy=status`.", "MISSING_AGGREGATE_SELECT");
+			const fetchService = this.getScopedDriver(c).restFetchService;
+			if (!fetchService?.aggregate) throw new ApiError(501, "AGGREGATE_NOT_SUPPORTED", "Aggregates are not implemented for this backend's data driver.");
+			const data = await fetchService.aggregate(collection.slug, {
+				aggregates,
+				groupBy: parseGroupBy(queryDict.groupBy),
+				filter: queryOptions.where,
+				logical: queryOptions.logical,
+				searchString,
+				limit: queryOptions.limit
+			});
+			return c.json({ data });
+		});
 		this.router.get(basePath, async (c) => {
 			this.enforceApiKeyPermission(c, collection.slug);
 			const queryDict = c.req.queries();
@@ -3587,7 +3946,7 @@ function assertStorageAccessControlConfigured(state, isProduction) {
 */
 async function mountOpenApiDocs(app, basePath, enableSwagger, serverCollections, requireAuth) {
 	if (enableSwagger === false || serverCollections.length === 0) return;
-	const { generateOpenApiSpec } = await import("./openapi-generator-BWL8F2La.js");
+	const { generateOpenApiSpec } = await import("./openapi-generator-DQeQ_q2f.js");
 	app.get(`${basePath}/docs`, (c) => {
 		const spec = generateOpenApiSpec(serverCollections, {
 			basePath,
@@ -3740,6 +4099,10 @@ function createShutdown(config) {
 					config.cronScheduler.stop();
 					logger.info("Cron scheduler stopped");
 				}
+				if (config.jobQueue) {
+					await config.jobQueue.stop();
+					logger.info("Job queue stopped");
+				}
 				for (const [key, rt] of Object.entries(config.realtimeServices)) try {
 					if (typeof rt.destroy === "function") {
 						await rt.destroy();
@@ -3764,7 +4127,43 @@ function createShutdown(config) {
 	};
 }
 //#endregion
-//#region src/init/process-safety.ts
+//#region src/init/surfaces.ts
+/** Every surface, in a stable order. */
+var ALL_RUNTIME_SURFACES = [
+	"auth",
+	"data",
+	"storage",
+	"admin",
+	"functions",
+	"cron",
+	"meta"
+];
+/**
+* Resolve a partial surface set against the default, which is everything on.
+*
+* Defaulting to on rather than off is the whole compatibility story: a caller
+* that says nothing gets the process this server has always booted, and a
+* surface added later is mounted by every existing deployment without anyone
+* editing a list.
+*/
+function resolveSurfaces(options) {
+	const resolved = {};
+	for (const surface of ALL_RUNTIME_SURFACES) resolved[surface] = options?.[surface] ?? true;
+	return resolved;
+}
+/** Resolve partial ownership against the default, which is owning everything. */
+function resolveOwnership(options) {
+	return {
+		cronScheduler: options?.cronScheduler ?? true,
+		jobWorkers: options?.jobWorkers ?? true
+	};
+}
+/** The surfaces a process is not serving, for a boot log line. */
+function disabledSurfaces(resolved) {
+	return ALL_RUNTIME_SURFACES.filter((surface) => !resolved[surface]);
+}
+//#endregion
+//#region src/init/process-safety.ts
 /**
 * Installed once per process. The singleton is process-global for the same
 * reason (see `singleton.ts`): more than one copy of this module can be loaded
@@ -7876,6 +8275,13 @@ function matchesParams(row, params) {
 * Sort in place, Postgres-style: nulls last ascending, first descending, with
 * the row id as a tiebreak so paging through an unsorted-but-equal run does
 * not shuffle rows between pages.
+*
+* The tiebreak runs *descending*, which is not a taste: every server-side sort
+* ends on `id DESC` — `FetchService.buildOrderExpressions` appends it to make
+* the ordering total, and the keyset cursor is built to match. This ran
+* ascending, so two rows sharing a sort value came back from the local overlay
+* in the opposite order to the server's, and {@link isLocallySortable} called
+* that page exactly reproducible while it was not.
 */
 function sortRows(rows, orderBy) {
 	const keys = normalizeOrderBy(orderBy);
@@ -7902,8 +8308,10 @@ function compareOnKey(a, b, field, direction) {
 	if (cmp === void 0 || cmp === 0) return 0;
 	return cmp * (direction === "desc" ? -1 : 1);
 }
+/** The last word, and the server's: `id DESC`. */
 function tiebreak(a, b) {
-	return compareValues(a.id, b.id) ?? 0;
+	const cmp = compareValues(a.id, b.id);
+	return cmp === void 0 ? 0 : -cmp;
 }
 /**
 * Resolve `page`/`offset`/`limit` the way the server does.
@@ -9934,6 +10342,13 @@ async function _initializeRebaseBackend(config) {
 	installUnhandledRejectionHandler();
 	const basePath = config.basePath || "/api";
 	const isProduction = process.env.NODE_ENV === "production";
+	const surfaces = resolveSurfaces(config.surfaces);
+	const ownership = resolveOwnership(config.ownership);
+	const offSurfaces = disabledSurfaces(surfaces);
+	if (offSurfaces.length > 0) logger.info("Partial runtime surface — some routes are not served by this process", {
+		serving: ALL_RUNTIME_SURFACES.filter((surface) => surfaces[surface]),
+		notServing: offSurfaces
+	});
 	configureMiddlewares(config.app, basePath, isProduction, config);
 	const collectionRegistry = new BackendCollectionRegistry();
 	const dataSourceRegistry = createDataSourceRegistry(config.dataSources);
@@ -9962,6 +10377,16 @@ async function _initializeRebaseBackend(config) {
 	if (bootstrappers.length === 0) throw new Error("No bootstrappers or database adapter provided. Cannot initialize database drivers.");
 	let defaultDriverId = DEFAULT_DRIVER_ID;
 	let defaultDriverResult = void 0;
+	const provisionTarget = provisionTargetFor(bootstrappers, config.database, config.provisioningDriverResult);
+	const provisionable = collectionsStoredBy(activeCollections, { engine: provisionTarget.engine }, (config.dataSources ?? []).map((source) => ({
+		key: source.key,
+		engine: source.engine ?? provisionTarget.engine
+	})));
+	logForeignCollections(activeCollections, provisionable, { engine: provisionTarget.engine });
+	const schemaOutcome = await provisionCollectionTables(provisionable, provisionTarget, {
+		introspecting: introspectCollections,
+		provision: config.provisionSchema ?? true
+	});
 	for (const bootstrapper of bootstrappers) {
 		const b = bootstrapper;
 		logger.debug("Running bootstrapper for driver", { driverId: b.id || bootstrapper.type });
@@ -9970,7 +10395,11 @@ async function _initializeRebaseBackend(config) {
 			collections: activeCollections,
 			collectionRegistry,
 			introspectCollections,
-			baas: config.baas
+			baas: config.baas,
+			schemaProvisioning: {
+				attempted: schemaOutcome.status === "applied",
+				reason: schemaOutcome.status === "skipped" ? schemaOutcome.reason : void 0
+			}
 		});
 		delegates[b.id || bootstrapper.type] = driverResult.driver;
 		if (introspectCollections) {
@@ -10045,7 +10474,9 @@ async function _initializeRebaseBackend(config) {
 		if (safeAuthConfig.jwtSecret) configureJwt({
 			secret: safeAuthConfig.jwtSecret,
 			accessExpiresIn: safeAuthConfig.accessExpiresIn || "1h",
-			refreshExpiresIn: safeAuthConfig.refreshExpiresIn || "30d"
+			refreshExpiresIn: safeAuthConfig.refreshExpiresIn || "30d",
+			signingKeys: safeAuthConfig.signingKeys,
+			activeKid: safeAuthConfig.activeKid
 		});
 		if (safeAuthConfig.serviceKey) {
 			if (safeAuthConfig.serviceKey.length < 32) throw new Error("REBASE_SERVICE_KEY is too short. Must be at least 32 characters. Generate one with: node -e \"logger.info(require('crypto').randomBytes(48).toString('base64'))\"");
@@ -10058,6 +10489,10 @@ async function _initializeRebaseBackend(config) {
 			logger.info("Authentication initialized");
 		} else logger.warn("Auth requested but default bootstrapper does not support initializeAuth");
 	}
+	await provisionCollectionPolicies(provisionable, provisionTarget, {
+		introspecting: introspectCollections,
+		provision: config.provisionSchema ?? true
+	});
 	let historyConfigResult = void 0;
 	if (config.history) if (defaultBootstrapper.initializeHistory) {
 		logger.debug("Bootstrapping entity history via driver protocol");
@@ -10082,8 +10517,8 @@ async function _initializeRebaseBackend(config) {
 		store: apiKeyStore,
 		driver: defaultDriver
 	}) : void 0;
-	if (apiKeyPreAuth) config.app.use(`${basePath}/admin/*`, apiKeyPreAuth);
-	if (apiKeyStore) {
+	if (apiKeyPreAuth && surfaces.admin) config.app.use(`${basePath}/admin/*`, apiKeyPreAuth);
+	if (apiKeyStore && surfaces.admin) {
 		const apiKeyRoutes = createApiKeyRoutes({
 			store: apiKeyStore,
 			serviceKey: internalServiceKey
@@ -10173,7 +10608,7 @@ async function _initializeRebaseBackend(config) {
 			]) {
 				const providerConfig = safeAuthConfig[key];
 				if (providerConfig && requiredFields.every((f) => Boolean(providerConfig[f]))) {
-					const createFn = (await import("./auth-BQcdhMBL.js").then((n) => n.t))[factory];
+					const createFn = (await import("./auth-BobZVd0j.js").then((n) => n.t))[factory];
 					oauthProviders.push(createFn(providerConfig));
 				}
 			}
@@ -10200,14 +10635,14 @@ async function _initializeRebaseBackend(config) {
 				if (!isProduction && !process.env.CORS_ORIGINS && !process.env.FRONTEND_URL) logger.warn("[Auth] Cookie authentication (cookieAuth) is enabled, but no CORS restrictions are detected. Browser-based clients will require credentials: 'include' and the server MUST NOT use Access-Control-Allow-Origin: '*'. Ensure CORS_ORIGINS is set to your frontend URL.");
 			}
 		}
-		if (authAdapter && authAdapter.createAuthRoutes) {
+		if (authAdapter && authAdapter.createAuthRoutes && surfaces.auth) {
 			const authRoutes = authAdapter.createAuthRoutes();
 			if (authRoutes) {
 				config.app.route(`${basePath}/auth`, authRoutes);
 				logger.debug("Auth routes mounted via adapter", { adapter: authAdapter.id });
 			}
 		}
-		if (authAdapter && authAdapter.createAdminRoutes) {
+		if (authAdapter && authAdapter.createAdminRoutes && surfaces.admin) {
 			const adminRoutes = authAdapter.createAdminRoutes();
 			if (adminRoutes) {
 				config.app.route(`${basePath}/admin`, adminRoutes);
@@ -10215,6 +10650,10 @@ async function _initializeRebaseBackend(config) {
 			}
 		}
 	}
+	if (isJwtConfigured() && surfaces.auth) {
+		config.app.route("/.well-known", createJwksRoutes());
+		if (hasAsymmetricSigningKey()) logger.info("Access tokens are signed asymmetrically; public keys at /.well-known/jwks.json");
+	}
 	const adminSurfacesGated = !!authAdapter && (isAuthAdapter(config.auth) || !!config.auth.jwtSecret);
 	const applyAdminGate = (router, surface) => {
 		if (!adminSurfacesGated) {
@@ -10279,7 +10718,7 @@ async function _initializeRebaseBackend(config) {
 			logger.warn(`Schema Editor disabled: ${schemaEditorOff.message}`);
 		} else throw err;
 	}
-	{
+	if (surfaces.admin) {
 		const schemaEditorRouter = new Hono();
 		applyAdminGate(schemaEditorRouter, "Schema editor");
 		schemaEditorRouter.get("/status", (c) => c.json(schemaEditorOff ? {
@@ -10330,15 +10769,17 @@ async function _initializeRebaseBackend(config) {
 			}
 		}));
 		storageRouter.route("/", storageRoutes);
-		config.app.route(`${basePath}/storage`, storageRouter);
+		if (surfaces.storage) config.app.route(`${basePath}/storage`, storageRouter);
 	} else {
 		const storageStub = new Hono();
 		storageStub.all("/*", (c) => c.json({ error: {
 			message: "File storage is not configured on this deployment, so uploads and downloads are disabled. Configure a storage backend (STORAGE_TYPE=s3 or STORAGE_TYPE=gcs plus its bucket and credentials) and redeploy.",
 			code: "STORAGE_NOT_CONFIGURED"
 		} }, 501));
-		config.app.route(`${basePath}/storage`, storageStub);
-		logger.info("Storage not configured — /storage returns 501 STORAGE_NOT_CONFIGURED");
+		if (surfaces.storage) {
+			config.app.route(`${basePath}/storage`, storageStub);
+			logger.info("Storage not configured — /storage returns 501 STORAGE_NOT_CONFIGURED");
+		}
 	}
 	const serverCollections = activeCollections.filter((collection) => resolveDataSource(collection, dataSourceRegistry).transport === "server");
 	if (activeCollections.length > 0) {
@@ -10387,9 +10828,9 @@ async function _initializeRebaseBackend(config) {
 		}
 		const restGenerator = new RestApiGenerator(serverCollections, defaultDriver, authAdapter);
 		dataRouter.route("/", restGenerator.generateRoutes());
-		config.app.route(`${basePath}/data`, dataRouter);
+		if (surfaces.data) config.app.route(`${basePath}/data`, dataRouter);
 	}
-	await mountOpenApiDocs(config.app, basePath, config.enableSwagger, serverCollections, resolveRequireAuth(config.auth));
+	if (surfaces.data) await mountOpenApiDocs(config.app, basePath, config.enableSwagger, serverCollections, resolveRequireAuth(config.auth));
 	const serverClient = createRebaseClient({
 		baseUrl: "http://localhost",
 		apiPath: basePath,
@@ -10448,11 +10889,17 @@ async function _initializeRebaseBackend(config) {
 		const driver = defaultDriverResult.internals.driver;
 		if (driver && "client" in driver) driver.client = serverClient;
 	}
-	if (config.functionsDir) {
+	if (config.functionsDir && surfaces.functions) {
 		const { loadFunctionsWithDiagnostics } = await import("./function-loader-DDS1v7YX.js").then((n) => n.t);
 		const { createFunctionRoutes } = await import("./function-routes-Btcez1T-.js").then((n) => n.n);
 		const { createFunctionsRequestTimeout, resolveFunctionsTimeoutMs } = await import("./request-timeout-BuFoEKwT.js");
-		const { functions: loadedFunctions, problems } = await loadFunctionsWithDiagnostics(config.functionsDir);
+		const { functions: allFunctions, problems } = await loadFunctionsWithDiagnostics(config.functionsDir);
+		const { selectFunctions } = await import("./selection-_z6TM1DB.js").then((n) => n.n);
+		const loadedFunctions = selectFunctions(allFunctions, config.functionsSelection);
+		if (loadedFunctions.length !== allFunctions.length) logger.info("Serving a subset of this bundle's functions", {
+			serving: loadedFunctions.map((fn) => fn.name),
+			notServing: allFunctions.filter((fn) => !loadedFunctions.includes(fn)).map((fn) => fn.name)
+		});
 		const functionsRouter = new Hono();
 		functionsRouter.onError(errorHandler);
 		const functionsTimeoutMs = resolveFunctionsTimeoutMs(config.functionsTimeoutMs);
@@ -10485,12 +10932,23 @@ async function _initializeRebaseBackend(config) {
 		});
 		else logger.warn(`Function routes mounted at ${basePath}/functions, but no functions loaded from ${config.functionsDir}. ` + (problems.length > 0 ? `${problems.length} file(s) were skipped — see the messages above.` : "The directory holds no .ts/.js function files."));
 	}
+	if (config.functionsUpstream && !surfaces.functions) {
+		const { createFunctionsProxy } = await import("./proxy-Bj5DVllb.js");
+		config.app.route(`${basePath}/functions`, createFunctionsProxy({
+			upstream: config.functionsUpstream,
+			basePath: `${basePath}/functions`
+		}));
+		logger.info("Forwarding custom functions to another process", {
+			path: `${basePath}/functions`,
+			upstream: config.functionsUpstream
+		});
+	}
 	let cronScheduler;
-	if (config.cronsDir) {
+	if (config.cronsDir && (surfaces.cron || ownership.cronScheduler)) {
 		const { loadCronJobsWithDiagnostics } = await import("./cron-loader-YhhQeVBM.js").then((n) => n.t);
 		const { CronScheduler } = await import("./cron-scheduler-DIpYBmZP.js").then((n) => n.n);
 		const { createCronRoutes } = await import("./cron-routes-maM_RlUu.js").then((n) => n.n);
-		const { createCronStore } = await import("./cron-store-D5dUNviq.js").then((n) => n.n);
+		const { createCronStore } = await import("./cron-store-CB1x-Ken.js").then((n) => n.n);
 		const { jobs: loadedCronJobs, problems: cronProblems } = await loadCronJobsWithDiagnostics(config.cronsDir);
 		cronScheduler = new CronScheduler();
 		cronScheduler.setClient(serverSingleton);
@@ -10505,8 +10963,12 @@ async function _initializeRebaseBackend(config) {
 		const cronRouter = new Hono();
 		applyAdminGate(cronRouter, "Cron");
 		cronRouter.route("/", createCronRoutes(cronScheduler, cronProblems.length));
-		config.app.route(`${basePath}/cron`, cronRouter);
-		if (loadedCronJobs.length > 0) {
+		if (surfaces.cron) config.app.route(`${basePath}/cron`, cronRouter);
+		if (loadedCronJobs.length > 0 && !ownership.cronScheduler) logger.info("Cron jobs registered but NOT scheduled in this process", {
+			count: loadedCronJobs.length,
+			reason: "this process does not own the cron scheduler"
+		});
+		else if (loadedCronJobs.length > 0) {
 			cronScheduler.start();
 			logger.info("Mounted cron jobs", {
 				count: loadedCronJobs.length,
@@ -10514,7 +10976,20 @@ async function _initializeRebaseBackend(config) {
 			});
 		} else logger.warn(`Cron routes mounted at ${basePath}/cron, but no jobs loaded from ${config.cronsDir}. ` + (cronProblems.length > 0 ? `Nothing is scheduled — ${cronProblems.length} file(s) were skipped, see the messages above.` : "The directory holds no .ts/.js cron files, so nothing is scheduled."));
 	}
-	{
+	let jobQueue;
+	if (config.jobs?.enabled) {
+		const { createJobStore, createJobQueue } = await import("./jobs-DR4SjGrD.js").then((n) => n.t);
+		const store = createJobStore(defaultDriver);
+		if (store) {
+			await store.ensureTable();
+			jobQueue = createJobQueue(store, config.jobs);
+			if (ownership.jobWorkers) {
+				jobQueue.start();
+				logger.info("Job queue started", { tasks: Object.keys(config.jobs.tasks ?? {}).length });
+			} else logger.info("Job queue available for enqueue, workers NOT started in this process", { tasks: Object.keys(config.jobs.tasks ?? {}).length });
+		} else logger.warn("Job queue requested but unavailable on this driver — `rebase.jobs.enqueue` will throw, and webhook deliveries fall back to the in-memory queue.");
+	}
+	if (surfaces.admin) {
 		const { createBackupRoutes, parseBackupDestination } = await import("./backup-C6ljYVTp.js").then((n) => n.t);
 		const backupRouter = new Hono();
 		applyAdminGate(backupRouter, "Backup");
@@ -10528,7 +11003,7 @@ async function _initializeRebaseBackend(config) {
 		config.app.route(`${basePath}/admin/backups`, backupRouter);
 		logger.debug("Backup admin routes mounted", { path: `${basePath}/admin/backups` });
 	}
-	{
+	if (surfaces.admin) {
 		const { default: logsRoutes } = await import("./logs-routes-BYA72C_C.js").then((n) => n.n);
 		const logsRouter = new Hono();
 		applyAdminGate(logsRouter, "Logs");
@@ -10536,7 +11011,7 @@ async function _initializeRebaseBackend(config) {
 		config.app.route(`${basePath}/logs`, logsRouter);
 		logger.debug("Logs routes mounted", { path: `${basePath}/logs` });
 	}
-	{
+	if (surfaces.meta) {
 		const { createContractRoutes } = await import("./contract-routes-Bet-eCNJ.js").then((n) => n.t);
 		const contractRouter = new Hono();
 		if (adminSurfacesGated) {
@@ -10569,6 +11044,7 @@ async function _initializeRebaseBackend(config) {
 	const shutdown = createShutdown({
 		server: config.server,
 		cronScheduler,
+		jobQueue,
 		realtimeServices
 	});
 	/**
@@ -10607,6 +11083,7 @@ async function _initializeRebaseBackend(config) {
 		storageController,
 		collectionRegistry,
 		cronScheduler,
+		jobQueue,
 		healthCheck,
 		shutdown
 	};
@@ -10799,6 +11276,22 @@ var rebaseEnvSchema = object({
 	DATABASE_URL: string().url("DATABASE_URL must be a valid URL"),
 	ADMIN_CONNECTION_STRING: string().url().optional(),
 	JWT_SECRET: string().min(32, "JWT_SECRET must be at least 32 characters long"),
+	/**
+	* PEM private key for signing access tokens asymmetrically, so anything
+	* holding the JWKS can verify a session without being able to mint one.
+	* Optional — without it, tokens stay HS256 and nothing changes.
+	*
+	* Accepts a PEM with real newlines, a PEM with `\n` escapes (how most
+	* secret managers and `.env` files carry a multi-line value), or base64 of
+	* the whole PEM.
+	*/
+	JWT_PRIVATE_KEY: string().optional(),
+	/**
+	* Names {@link rebaseEnvSchema.JWT_PRIVATE_KEY} in the token header and in
+	* the JWKS. Rotation depends on the old and new keys being
+	* distinguishable, so change this whenever the key changes.
+	*/
+	JWT_KEY_ID: string().default("default"),
 	JWT_ACCESS_EXPIRES_IN: string().default("1h"),
 	JWT_REFRESH_EXPIRES_IN: string().default("400d"),
 	GOOGLE_CLIENT_ID: string().optional(),
@@ -11020,6 +11513,14 @@ async function assertAllowedOutboundUrl(rawUrl, options = {}) {
 }
 //#endregion
 //#region src/services/webhook-service.ts
+/**
+* The task name a queued webhook delivery is stored under.
+*
+* Namespaced, and frozen: it is written into `rebase.jobs` rows that outlive
+* the deploy that wrote them, so renaming it would strand every delivery
+* already queued under the old name until they dead-lettered.
+*/
+var WEBHOOK_DELIVERY_TASK = "rebase.webhook.deliver";
 /** Read at most this much of a response before cancelling the rest. */
 var MAX_RESPONSE_BYTES = 64 * 1024;
 var WebhookDispatcher = class {
@@ -11073,21 +11574,64 @@ var WebhookDispatcher = class {
 	* for a third party. It also means a receiver that is down can no longer
 	* fail the customer's write.
 	*
-	* The cost, stated plainly: the queue is in-process and in-memory. A crash
-	* or a deploy between the enqueue and the delivery drops the event, and a
-	* receiver may see the notification a few milliseconds before the row it
-	* describes is committed. Use {@link flush} on shutdown, and
-	* `onDelivery` to record failures.
+	* The cost, when no `jobQueue` is configured: the queue is in-process and
+	* in-memory. A crash or a deploy between the enqueue and the delivery drops
+	* the event, and a receiver may see the notification a few milliseconds
+	* before the row it describes is committed. Use {@link flush} on shutdown,
+	* and `onDelivery` to record failures.
+	*
+	* With `jobQueue` set, only the second half of that remains: the delivery
+	* becomes a row in `rebase.jobs` and survives the crash, the deploy and the
+	* pod being rescheduled.
 	*/
 	enqueueEntityChange(table, event, id, entity, previousEntity) {
 		const jobs = this.buildDeliveries(table, event, entity, previousEntity);
 		if (jobs.length === 0) return;
+		if (this.options.jobQueue) {
+			for (const job of jobs) this.options.jobQueue.enqueue(WEBHOOK_DELIVERY_TASK, {
+				webhookId: job.webhook.id,
+				event: job.event,
+				payload: job.payload
+			}).catch((error) => {
+				logger.error("[webhooks] Could not queue a delivery; falling back to in-process", { error });
+				this.queue.push(job);
+				this.startDraining();
+			});
+			return;
+		}
 		this.queue.push(...jobs);
 		this.startDraining();
 	}
 	/**
+	* Deliver one queued job, as the worker runs it.
+	*
+	* One attempt, and it throws on failure. The retries belong to the queue
+	* now: keeping both would multiply — three in-process attempts inside each
+	* of three job attempts is nine deliveries and about two minutes of holding
+	* a worker slot — and only the queue's retries survive a restart, which is
+	* the whole reason for moving.
+	*/
+	async deliverQueuedJob(job) {
+		const webhook = this.webhooks.find((w) => w.id === job.webhookId);
+		if (!webhook) {
+			logger.warn(`[webhooks] Dropping a queued delivery for unknown or disabled webhook "${job.webhookId}"`);
+			return;
+		}
+		const { result, terminal } = await this.deliver(webhook, job.event, job.payload, 1);
+		this.options.onDelivery?.(result);
+		if (result.success) return;
+		if (terminal) {
+			logger.error(`[webhooks] "${webhook.id}" failed permanently: ${result.responseBody.slice(0, 200)}`);
+			return;
+		}
+		throw new Error(`Webhook "${webhook.id}" responded ${result.statusCode}: ${result.responseBody.slice(0, 200)}`);
+	}
+	/**
 	* Wait for every queued delivery to finish. For graceful shutdown, and for
 	* tests that need to observe what {@link enqueueEntityChange} sent.
+	*
+	* In-process deliveries only — with a `jobQueue` configured there is
+	* nothing here to wait for, because the deliveries are rows.
 	*/
 	async flush() {
 		while (this.draining) await this.draining;
@@ -11287,7 +11831,7 @@ function listenWithPortRetry(server, startPort, options) {
 		server.once("error", onError);
 		server.listen(startPort, host, () => {
 			server.removeListener("error", onError);
-			resolve(startPort);
+			resolve(boundPort(server) ?? startPort);
 		});
 	});
 	let affinityPort = null;
@@ -11317,14 +11861,15 @@ function listenWithPortRetry(server, startPort, options) {
 			attempt++;
 			const onListening = () => {
 				cleanup();
+				const bound = boundPort(server) ?? port;
 				if (portFileDir) {
 					try {
 						const portFile = path.join(portFileDir, DEV_PORT_FILENAME);
-						fs.writeFileSync(portFile, `${port} ${startPort}`, "utf-8");
+						fs.writeFileSync(portFile, `${bound} ${startPort}`, "utf-8");
 					} catch {}
-					writeStateFile(portFileDir, port, options?.serviceKey);
+					writeStateFile(portFileDir, bound, options?.serviceKey);
 				}
-				resolve(port);
+				resolve(bound);
 			};
 			const onError = (err) => {
 				cleanup();
@@ -11392,6 +11937,18 @@ function writeStateFile(projectRoot, port, serviceKey) {
 		fs.chmodSync(stateFile, 384);
 	} catch {}
 }
+/**
+* The port a server is actually listening on, or `undefined` if it cannot say.
+*
+* `Server.address()` returns a string for a UNIX socket and `null` before the
+* socket is bound, so neither is a port and both fall back to the caller's own
+* answer rather than being coerced into a number.
+*/
+function boundPort(server) {
+	const address = server.address();
+	if (!address || typeof address === "string") return void 0;
+	return address.port;
+}
 //#endregion
 //#region src/serve-spa.ts
 /**
@@ -11883,7 +12440,64 @@ var bootEnvExtension = object({
 		""
 	]).default("true").transform((v) => v !== "false"),
 	/** Comma-separated origins allowed to make credentialed cross-origin calls. */
-	CORS_ORIGINS: string().optional()
+	CORS_ORIGINS: string().optional(),
+	/**
+	* Which part of the project this process serves.
+	*
+	* `all` — everything, in one process. The default, and what every existing
+	* deployment gets by setting nothing.
+	*
+	* The other three exist so one image and one bundle can be booted several
+	* times over, each serving a different part: `api` (data, auth, admin,
+	* storage, meta), `functions` (custom functions only), `worker` (no HTTP
+	* surface at all — cron and the job queue).
+	*
+	* See `resolveRole` in `boot/role.ts` for exactly what each one mounts and
+	* owns, and for the combinations that refuse to boot.
+	*/
+	REBASE_ROLE: _enum([
+		"all",
+		"api",
+		"functions",
+		"worker",
+		""
+	]).default("all").transform((v) => v === "" ? "all" : v),
+	/**
+	* Override whether this process runs the cron scheduler's timers.
+	*
+	* Separate from the role because "which URLs answer" and "which timers fire"
+	* are independent questions: a three-way split wants cron off the `api`
+	* process, a two-way split wants it on. Unset follows the role.
+	*/
+	REBASE_CRON_SCHEDULER: _enum([
+		"true",
+		"false",
+		""
+	]).optional().transform((v) => v === void 0 || v === "" ? void 0 : v === "true"),
+	/** Override whether this process runs job-queue workers. Unset follows the role. */
+	REBASE_JOB_WORKERS: _enum([
+		"true",
+		"false",
+		""
+	]).optional().transform((v) => v === void 0 || v === "" ? void 0 : v === "true"),
+	/**
+	* Comma-separated function names this process serves. Unset means all.
+	*
+	* `functions` role only. A name that is not in the bundle is a boot failure,
+	* not a warning — the deployment exists to serve that function, and a typo
+	* that silently serves nothing is the failure this must not have.
+	*/
+	REBASE_FUNCTIONS_ONLY: string().optional(),
+	/** Comma-separated function names to skip. Applied after `_ONLY`. */
+	REBASE_FUNCTIONS_EXCLUDE: string().optional(),
+	/**
+	* Base URL of the process serving `/api/functions/*`.
+	*
+	* `api` role only. Set it and this process forwards those requests there
+	* instead of mounting them, so a split deployment presents the identical URL
+	* surface and nobody has to run a reverse proxy to try one.
+	*/
+	REBASE_FUNCTIONS_UPSTREAM: string().optional()
 });
 /**
 * Load and validate the environment for a bundle boot.
@@ -11959,6 +12573,134 @@ function resolveCorsOrigin(env) {
 	return (origin) => allowed.includes(origin) ? origin : null;
 }
 //#endregion
+//#region src/boot/role.ts
+/**
+* A refusal to boot, phrased as the variable to change.
+*
+* Its own class so `bootFromBundle` can present it as a configuration problem
+* rather than a crash. Every message names the variable and the fix, because the
+* reader is looking at a container that will not start and has one line of log
+* to work from.
+*/
+var RoleConfigurationError = class extends Error {
+	hint;
+	constructor(message, hint) {
+		super(message);
+		this.hint = hint;
+		this.name = "RoleConfigurationError";
+	}
+};
+/**
+* What each role serves and owns.
+*
+* Read as a table, deliberately. `api` keeps cron and the job workers so that
+* the common two-service split (`api` + `functions`) is complete without a third
+* container; a deployment that wants them off the request path adds a `worker`
+* and sets `REBASE_CRON_SCHEDULER=false` on the api. `functions` runs no timers
+* at all — a function process is scaled by request load and replaced at will, so
+* giving it scheduled work would make its replica count mean something.
+*/
+var ROLES = {
+	all: {
+		surfaces: {},
+		ownership: {},
+		provisionSchema: true
+	},
+	api: {
+		surfaces: { functions: false },
+		ownership: {},
+		provisionSchema: true
+	},
+	functions: {
+		surfaces: {
+			auth: false,
+			data: false,
+			storage: false,
+			admin: false,
+			cron: false,
+			meta: false
+		},
+		ownership: {
+			cronScheduler: false,
+			jobWorkers: false
+		},
+		provisionSchema: false
+	},
+	worker: {
+		surfaces: {
+			auth: false,
+			data: false,
+			storage: false,
+			admin: false,
+			functions: false,
+			cron: false,
+			meta: false
+		},
+		ownership: {},
+		provisionSchema: false
+	}
+};
+/** Split a comma-separated list, dropping blanks. */
+function parseNameList(raw) {
+	if (!raw) return [];
+	return raw.split(",").map((name) => name.trim()).filter(Boolean);
+}
+/**
+* Resolve the process shape, or refuse.
+*
+* @throws RoleConfigurationError for a combination that would boot into a state
+*   nobody meant — see the refusals inline. Each one is a refusal rather than a
+*   warning because its failure mode is silent: a second process racing schema
+*   DDL, or presence quietly not crossing instances, is not something an
+*   operator finds by reading logs.
+*/
+function resolveRole(env) {
+	const role = env.REBASE_ROLE ?? "all";
+	const base = ROLES[role];
+	if (!base) throw new RoleConfigurationError(`REBASE_ROLE="${role}" is not a role.`, `Use one of: ${Object.keys(ROLES).join(", ")}.`);
+	const migrate = env.REBASE_MIGRATE_ON_BOOT || "ensure";
+	if (!base.provisionSchema && migrate !== "none") throw new RoleConfigurationError(`REBASE_ROLE="${role}" cannot also provision the database schema (REBASE_MIGRATE_ON_BOOT="${migrate}").`, "Set REBASE_MIGRATE_ON_BOOT=none on this process. Exactly one process in a split deployment provisions the schema, and that is the one running REBASE_ROLE=api (or all).");
+	if (env.REBASE_FUNCTIONS_UPSTREAM && role !== "api") throw new RoleConfigurationError(`REBASE_FUNCTIONS_UPSTREAM is only read by REBASE_ROLE=api, and this process is "${role}".`, role === "functions" ? "A functions process serves those routes; it does not forward them. Set the upstream on the api process instead." : "Remove it, or set REBASE_ROLE=api on this process.");
+	if (Boolean(env.REBASE_FUNCTIONS_ONLY || env.REBASE_FUNCTIONS_EXCLUDE) && role !== "functions") throw new RoleConfigurationError(`REBASE_FUNCTIONS_ONLY / REBASE_FUNCTIONS_EXCLUDE are only read by REBASE_ROLE=functions, and this process is "${role}".`, "Set them on the functions process, or set REBASE_ROLE=functions here.");
+	const ownership = { ...base.ownership };
+	if (env.REBASE_CRON_SCHEDULER !== void 0) ownership.cronScheduler = env.REBASE_CRON_SCHEDULER;
+	if (env.REBASE_JOB_WORKERS !== void 0) ownership.jobWorkers = env.REBASE_JOB_WORKERS;
+	return {
+		role,
+		surfaces: { ...base.surfaces },
+		ownership,
+		provisionSchema: base.provisionSchema,
+		functionsSelection: {
+			only: parseNameList(env.REBASE_FUNCTIONS_ONLY),
+			exclude: parseNameList(env.REBASE_FUNCTIONS_EXCLUDE)
+		},
+		functionsUpstream: env.REBASE_FUNCTIONS_UPSTREAM?.trim() || void 0
+	};
+}
+/**
+* ## Why there is no channel-bus refusal here
+*
+* Splitting `api` from `functions` was expected to need one: the in-memory
+* channel bus is the default, and broadcast and presence do not cross processes
+* on it. It turns out to be the wrong place to check, for two reasons.
+*
+* The first is that a role split does not create the problem. Only the roles
+* that mount the API serve websockets at all — a `functions` process has no
+* realtime clients to keep in sync, and a `worker` has no HTTP surface. What
+* makes the bus matter is the *replica count* of the websocket-serving process,
+* which is exactly as true for a single `all` deployment scaled to three as it
+* is for a split one, and which no process can read from its own environment.
+*
+* The second is that the runtime already answers it better than a guess from
+* configuration could: `RealtimeService.warnIfMemoryBusOnMultiplePods` fires on
+* *evidence* — the first notification seen from another instance while the bus
+* is still in-memory. That is a fact rather than an inference, and it catches
+* the scaled-`all` case this would have missed.
+*
+* So: no refusal, and the operator guidance belongs in the deployment docs
+* beside the replica count, not here.
+*/
+//#endregion
 //#region src/boot/sources.ts
 /**
 * Convert a source key into the suffix used in environment variable names.
@@ -12178,168 +12920,6 @@ function loadDeclaredStorageSources(startDir, levels = 5) {
 	return [];
 }
 //#endregion
-//#region src/boot/version-skew.ts
-/**
-* Telling a *stale* driver apart from a driver that never had the feature.
-*
-* The managed runtime is two halves that version independently. The image
-* supplies `@rebasepro/server` — `docker/entrypoint.mjs` symlinks it over
-* whatever the bundle installed, so the boot harness is always the image's. The
-* **driver** is not redirected: `@rebasepro/server-postgres` comes from the
-* bundle's `deps.declared`, pinned to whatever the project's `package.json`
-* asked npm for. Shipping a new image therefore does not ship a new driver, and
-* a fix that spans both packages reaches a tenant only after an npm publish AND
-* a rebuild.
-*
-* That split has a nasty failure mode, and it has already burned a day. Boot
-* looks for an optional capability, does not find it, and reports the honest
-* local fact — "this driver does not implement collection-table creation" —
-* which is exactly what a schemaless driver looks like. But a driver that is
-* merely *older than the runtime asking* looks identical, and the two want
-* opposite responses: one is "this database is not managed by Rebase, carry on",
-* the other is "your tables were never created and every data route is about to
-* 500". Naming the versions is what separates them, so these helpers exist to
-* put both numbers in front of whoever reads the log.
-*/
-/** The package whose version defines "the runtime" for skew purposes. */
-var RUNTIME_PACKAGE = "@rebasepro/server";
-/**
-* Locate a package by walking `node_modules` up from a directory.
-*
-* Lives here rather than in `driver.ts` because both the driver loader and the
-* version check need it, and `driver.ts` already imports this module.
-*/
-function findPackageDir(fromDir, packageName) {
-	let dir = path.resolve(fromDir);
-	for (;;) {
-		const candidate = path.join(dir, "node_modules", ...packageName.split("/"));
-		if (fs.existsSync(path.join(candidate, "package.json"))) return candidate;
-		const parent = path.dirname(dir);
-		if (parent === dir) return void 0;
-		dir = parent;
-	}
-}
-/**
-* Parse the subset of semver the workspace actually publishes.
-*
-* Deliberately lenient: an unparseable version yields `undefined` and every
-* comparison then declines to judge, because a wrong "your driver is old"
-* warning on a fork's custom version string is worse than no warning at all.
-*/
-function parseVersion(version) {
-	const match = /^(\d+)\.(\d+)\.(\d+)(?:-(.+))?$/.exec(version.trim());
-	if (!match) return void 0;
-	return {
-		parts: [
-			Number(match[1]),
-			Number(match[2]),
-			Number(match[3])
-		],
-		prerelease: match[4]
-	};
-}
-/**
-* Compare two versions, or `undefined` when either cannot be parsed.
-*
-* Follows semver on the one rule that matters here: a prerelease sorts *below*
-* the release it leads to, so `0.12.1-canary.g7f1150f` < `0.12.1`. Without that
-* rule every canary would read as newer than the stable it precedes, and the
-* canaries are precisely where fixes land first.
-*/
-function compareVersions(a, b) {
-	const left = parseVersion(a);
-	const right = parseVersion(b);
-	if (!left || !right) return void 0;
-	for (let i = 0; i < 3; i++) if (left.parts[i] !== right.parts[i]) return left.parts[i] < right.parts[i] ? -1 : 1;
-	if (left.prerelease === right.prerelease) return 0;
-	if (left.prerelease === void 0) return 1;
-	if (right.prerelease === void 0) return -1;
-	return left.prerelease < right.prerelease ? -1 : 1;
-}
-/**
-* Describe how a driver's version relates to the runtime asking it for work.
-*
-* Returns `stale: false` whenever it cannot tell — an unknown version, an
-* unparseable one, a driver that is newer. Silence beats a confident wrong
-* diagnosis, and the caller still prints its own local fact either way.
-*/
-function describeDriverSkew(driverVersion, runtimeVersion) {
-	if (!driverVersion || !runtimeVersion) return { stale: false };
-	const order = compareVersions(driverVersion, runtimeVersion);
-	if (order === void 0) return { stale: false };
-	if (order < 0) return {
-		stale: true,
-		detail: `The driver is at ${driverVersion} while this runtime is ${runtimeVersion} — the driver is OLDER, so this is very likely a stale pin rather than a driver that never had the capability.`
-	};
-	return {
-		stale: false,
-		detail: `Driver ${driverVersion}, runtime ${runtimeVersion}.`
-	};
-}
-/**
-* How to get a project's schema applied, written once and owned by the runtime.
-*
-* This text lives in `@rebasepro/server` on purpose. The equivalent guidance in
-* the Postgres driver's schema-drift warning can only ever be as current as the
-* driver a tenant pinned — so the tenants who most need to be told "your driver
-* is too old" are exactly the ones whose driver still prints the old advice.
-* The image's copy of this package is never stale, so guidance printed from
-* here always reflects the platform as it is today.
-*
-* Both audiences get a line because the runtime cannot reliably tell which one
-* it is serving, and naming only the pnpm scripts — as this once did everywhere
-* — tells a managed operator to run a command that structurally cannot reach
-* their in-cluster database.
-*/
-function schemaRecoveryGuidance(options = {}) {
-	const lines = [
-		"  To apply this project's schema:",
-		"    • Managed cloud: the runtime applies tables and RLS at boot (unless",
-		"      REBASE_MIGRATE_ON_BOOT=none). `rebase db push` cannot reach a tenant's",
-		"      in-cluster database — redeploy instead."
-	];
-	if (options.staleDriver) lines.push("      Because the driver is pinned by your bundle, bump the", "      `@rebasepro/server-postgres` version in your project's package.json", "      and redeploy — a newer platform image alone will NOT update it.");
-	lines.push("    • Self-host: run `rebase db push` (dev) or `rebase db migrate` (prod).");
-	return lines.join("\n");
-}
-/**
-* The installed version of a package, read from its `package.json`.
-*
-* Returns `undefined` rather than throwing for every failure — a missing or
-* malformed manifest degrades the diagnosis, and must never take down a boot
-* that would otherwise have served.
-*/
-function readPackageVersion(packageDir) {
-	try {
-		const pkg = JSON.parse(fs.readFileSync(path.join(packageDir, "package.json"), "utf8"));
-		return typeof pkg.version === "string" ? pkg.version : void 0;
-	} catch {
-		return;
-	}
-}
-/**
-* The version of `@rebasepro/server` this deployment is actually running.
-*
-* Resolved from the same roots the drivers are, and that is the point rather
-* than a convenience. In a managed container `docker/entrypoint.mjs` replaces
-* `/bundle/node_modules/@rebasepro/server` with a link to the image's copy, so
-* reading the manifest *through the bundle* reports the version that will
-* really execute — which is exactly the number the driver has to be compared
-* against. Reading this package's own manifest by module path would report the
-* same thing in the happy case and quietly lie in the case that matters: a
-* bundle whose link did not happen.
-*
-* Returns `undefined` when the package cannot be found; every caller treats
-* that as "cannot judge" and stays quiet.
-*/
-function readRuntimeVersion(roots) {
-	for (const root of roots) {
-		const dir = findPackageDir(root, RUNTIME_PACKAGE);
-		const version = dir ? readPackageVersion(dir) : void 0;
-		if (version) return version;
-	}
-}
-//#endregion
 //#region src/boot/driver.ts
 /**
 * Run a trivial query against a source, to see whether it answers.
@@ -12555,6 +13135,10 @@ function resolveAuthOptions(env, usersCollection) {
 	const auth = {
 		collection: usersCollection,
 		jwtSecret: env.JWT_SECRET,
+		signingKeys: env.JWT_PRIVATE_KEY ? [{
+			kid: env.JWT_KEY_ID,
+			privateKey: normalizePemFromEnv(env.JWT_PRIVATE_KEY)
+		}] : void 0,
 		accessExpiresIn: env.JWT_ACCESS_EXPIRES_IN,
 		refreshExpiresIn: env.JWT_REFRESH_EXPIRES_IN,
 		serviceKey: env.REBASE_SERVICE_KEY,
@@ -12978,6 +13562,11 @@ async function bootFromBundle(options = {}) {
 	if (bundle.manifest.kind === "static") return bootStaticApp(bundle, devRoot, options);
 	const env = loadBootEnv();
 	const isProduction = env.NODE_ENV === "production";
+	const runtimeRole = resolveRole(env);
+	if (runtimeRole.role !== "all") logger.info(`Runtime role: ${runtimeRole.role}`, {
+		provisionsSchema: runtimeRole.provisionSchema,
+		...runtimeRole.ownership
+	});
 	const configExports = await loadBundleConfigExports(bundle);
 	const dataSourceDefs = configExports.dataSources;
 	const declaredStorage = normalizeStorageSources(bundle.manifest.storage?.sources, configExports.storageSources);
@@ -13001,14 +13590,20 @@ async function bootFromBundle(options = {}) {
 	const server = createServer(getRequestListener(app.fetch));
 	const usersCollection = await loadUsersCollection(bundle);
 	const storage = resolveStorageSources(process.env, storageSourceDefs, path.join(bundle.dir, "uploads"));
-	await ensureCollectionSchema(bundle, dataSources, env);
+	warnOnUnusableBundleShape(bundle);
 	const backend = await initializeRebaseBackend({
 		server,
 		app,
 		basePath: env.REBASE_BASE_PATH,
+		provisioningDriverResult: dataSources[0] ? { internals: dataSources[0].connection } : void 0,
 		collectionsDir: bundle.collectionsDir,
 		functionsDir: bundle.functionsDir,
 		cronsDir: bundle.cronsDir,
+		provisionSchema: options.provisionSchema ?? runtimeRole.provisionSchema,
+		surfaces: runtimeRole.surfaces,
+		ownership: runtimeRole.ownership,
+		functionsSelection: runtimeRole.functionsSelection,
+		functionsUpstream: runtimeRole.functionsUpstream,
 		bootstrappers: dataSources.map((s) => s.bootstrapper),
 		dataSources: dataSourceDefs,
 		storage,
@@ -13028,7 +13623,6 @@ async function bootFromBundle(options = {}) {
 		runtimeVersion: bundle.manifest.runtime?.builtAgainst,
 		schemaEditor: false
 	});
-	await ensureCollectionPolicies(bundle, dataSources, env);
 	metrics?.setKnownCollections(backend.collectionRegistry.getCollections().map((collection) => collection.slug).filter((slug) => Boolean(slug)));
 	const healthPaths = ["/health", `${(env.REBASE_BASE_PATH || "/api").replace(/\/$/, "")}/health`];
 	for (const healthPath of [...new Set(healthPaths)]) app.get(healthPath, async (c) => {
@@ -13067,6 +13661,7 @@ async function bootFromBundle(options = {}) {
 				"/health",
 				"/livez",
 				"/metrics",
+				"/.well-known",
 				...siblings
 			],
 			spa: staticApp.spa
@@ -13078,10 +13673,12 @@ async function bootFromBundle(options = {}) {
 			server.once("error", reject);
 			server.listen(env.PORT, () => {
 				server.removeListener("error", reject);
+				const address = server.address();
+				if (address && typeof address === "object") port = address.port;
 				resolve();
 			});
 		});
-		logger.info(`Rebase runtime listening on port ${env.PORT}`);
+		logger.info(`Rebase runtime listening on port ${port}`);
 	} else {
 		port = await listenWithPortRetry(server, env.PORT, {
 			portFileDir: devRoot,
@@ -13215,7 +13812,7 @@ async function runFromBundle(options = {}) {
 	try {
 		return await bootFromBundle(options);
 	} catch (err) {
-		if (err instanceof BundleError) {
+		if (err instanceof BundleError || err instanceof RoleConfigurationError || err instanceof FunctionSelectionError) {
 			logger.error(err.message);
 			if (err.hint) logger.error(err.hint);
 		} else logger.error("Failed to start the Rebase runtime", { error: err instanceof Error ? err : new Error(String(err)) });
@@ -13247,158 +13844,25 @@ function warnOnDriverSkew(dataSources, runtimeVersion) {
 	}
 }
 /**
-* The collections a data source's engine is the store for.
+* Warn about a bundle whose shape makes provisioning impossible.
 *
-* A bundle's collections directory holds *every* collection the project
-* declares, whatever engine serves it — that is the point of `dataSource`
-* routing. What it is not is a list of tables to create: handing the whole
-* directory to the primary source's bootstrapper made a Firestore collection
-* declared alongside the Postgres ones arrive as an empty Postgres table, with
-* RLS policies, while the app went on reading its documents from Firestore.
+* `initializeRebaseBackend` provisions the collection schema for every boot
+* path, and it decides from what actually resolved: a project with no
+* collections reads them from the database and creates nothing. That rule is
+* right, but from inside the runtime it cannot tell "this project declares no
+* collections" from "this build lost them" — and the second is a broken build
+* that silently serves an empty API.
 *
-* Excluding is deliberately conservative. A collection that names neither an
-* `engine` nor a `dataSource` belongs to whichever source is primary — the
-* "postgres" that `resolveDataSource` falls back to there is a default, not a
-* declaration, and must not exclude anything on its own. Only a collection that
-* explicitly routes to a *different* engine is dropped, so a project running two
-* sources on the same engine is unaffected.
+* Only the bundle knows the difference, so this is the one piece of the old
+* bundle-side provisioning worth keeping here. It warns; it never provisions.
 */
-function collectionsStoredBy(collections, primary, dataSources) {
-	const registry = createDataSourceRegistry(dataSources.map((source) => ({
-		key: source.key,
-		engine: source.engine
-	})));
-	return collections.filter((collection) => {
-		const declared = collection.engine ?? (collection.dataSource ? resolveDataSource(collection, registry).engine : void 0);
-		if (!declared) return true;
-		return declared === primary.engine;
-	});
-}
-/** Say what was routed elsewhere, so a missing table is never a silent one. */
-function logForeignCollections(all, stored, primary) {
-	if (stored.length === all.length) return;
-	const foreign = all.filter((c) => !stored.includes(c)).map((c) => c.slug);
-	logger.info(`Skipping ${foreign.length} collection(s) served by another engine, not "${primary.engine}": ${foreign.join(", ")}. Their storage is not managed by this data source.`);
-}
-/**
-* Bring the database's collection tables up to date before serving.
-*
-* Delegates to whichever driver bootstrapped the default data source; a driver
-* without `ensureCollectionSchema` (a schemaless one, or an older build) skips
-* rather than failing, which is why this cannot break an existing deployment.
-*
-* Every path out of here says why, at info or louder. Guaranteeing the tables
-* exist is this function's entire job, so "it declined, and said nothing" is the
-* one outcome it must never produce: a deployment that skips comes up answering
-* sign-in and 500ing every `/api/data/*` route, and the operator's only evidence
-* is what these lines print. Silence here has already sent one investigation
-* chasing a stale runtime image that was not stale.
-*
-* Failure is fatal on purpose. Booting anyway would produce exactly the state
-* this exists to prevent — an app that answers sign-in and 500s every data
-* request — and a crash-looping pod with the DDL error in its logs is a far
-* better signal than a running one that silently cannot serve.
-*/
-async function ensureCollectionSchema(bundle, dataSources, env) {
-	const skip = (reason, level = "info") => {
-		logger[level](`Collection schema: skipped — ${reason}`);
-	};
-	if ((env.REBASE_MIGRATE_ON_BOOT || "ensure") === "none") {
-		skip("REBASE_MIGRATE_ON_BOOT=none, leaving the database schema untouched.");
-		return;
-	}
-	if (bundle.manifest.kind !== "backend") {
-		skip(`this bundle's kind is "${bundle.manifest.kind}", which serves no database.`);
-		return;
-	}
-	if (!bundle.manifest.entry?.config) {
-		skip("this bundle declares no config package, so its collections are read from the database rather than from code.");
-		return;
-	}
-	if (!bundle.collectionsDir) {
-		skip(`this bundle declares a config package at "${bundle.manifest.entry.config}", but no collections directory resolved inside it. Rebuild with \`rebase build\` and check the manifest's \`entry.collections\`.`, "warn");
-		return;
-	}
-	const primary = dataSources[0];
-	if (!primary) {
-		skip("no data source was initialized for this runtime.", "warn");
-		return;
-	}
-	if (!primary.bootstrapper.ensureCollectionSchema) {
-		const skew = describeDriverSkew(primary.driverVersion, readRuntimeVersion(bundleResolutionRoots(bundle.dir)));
-		skip(`the adapter from "${primary.driverPackage}" (engine "${primary.engine}") does not expose collection-table creation. ` + (skew.detail ? `${skew.detail} ` : "") + "The driver package may well implement it on a class the adapter does not forward, so check the adapter's shape before blaming its version. Collection tables will NOT be created, so every /api/data route will fail on a missing relation.\n" + schemaRecoveryGuidance({ staleDriver: skew.stale }), "warn");
-		return;
-	}
-	const loaded = await loadCollectionsFromDirectory(bundle.collectionsDir);
-	if (loaded.length === 0) {
-		skip(`no collections were loaded from "${bundle.collectionsDir}".`, "warn");
-		return;
-	}
-	const collections = collectionsStoredBy(loaded, primary, dataSources);
-	logForeignCollections(loaded, collections, primary);
-	if (collections.length === 0) {
-		skip(`none of the ${loaded.length} declared collection(s) are stored by the "${primary.engine}" data source.`);
-		return;
-	}
-	const { applied } = await primary.bootstrapper.ensureCollectionSchema(collections, preInitDriverResult(primary), (message) => logger.debug(`schema: ${message}`));
-	if (applied > 0) logger.info(`Applied ${applied} additive schema change(s) before boot.`);
-	else logger.debug("Collection schema is up to date.");
-}
-/**
-* The `InitializedDriver` to hand a bootstrapper before any driver exists.
-*
-* Both schema hooks are declared to take the result of `initializeDriver`, but
-* they deliberately run *before* it: the tables have to exist before the driver
-* introspects them and registers collections. So there is no real result to
-* pass, and the field the hooks actually read is `internals` — the driver's own
-* opaque handle, which at this point is exactly the connection the coordinator
-* just opened (`{ db, pool }`, where `db` is the drizzle instance).
-*
-* Wrapping it matters: the connection passed *bare* type-checks through any cast
-* and then reads `undefined.db` inside the driver, which surfaces as a boot
-* crash — `TypeError: Cannot read properties of undefined (reading 'db')` — on
-* every project whose driver implements these hooks. The cast is narrowed to the
-* one field a pre-init result cannot honestly supply, rather than `as never`
-* blanketing the whole argument.
-*/
-function preInitDriverResult(source) {
-	return { internals: source.connection };
-}
-/**
-* Apply the project's RLS policies before serving — the companion to
-* {@link ensureCollectionSchema}, which creates the tables this makes servable.
-*
-* Runs after `initializeRebaseBackend`, not alongside table creation: the
-* generated policies call the `auth.*` helper functions, and `CREATE POLICY`
-* validates those exist, so this cannot run before auth is initialized. The
-* gate conditions mirror `ensureCollectionSchema` (mode, bundle shape, driver
-* support) — and because that function already ran and explained any skip on
-* this same boot, the benign gates here return quietly rather than logging the
-* same reason twice. The one thing it does say out loud is a driver that
-* created tables but cannot apply policies: that is the difference between a
-* served collection and a 401, and it must not pass in silence.
-*/
-async function ensureCollectionPolicies(bundle, dataSources, env) {
-	if ((env.REBASE_MIGRATE_ON_BOOT || "ensure") === "none") return;
+function warnOnUnusableBundleShape(bundle) {
 	if (bundle.manifest.kind !== "backend") return;
 	if (!bundle.manifest.entry?.config) return;
-	if (!bundle.collectionsDir) return;
-	const primary = dataSources[0];
-	if (!primary) return;
-	if (!primary.bootstrapper.ensureCollectionPolicies) {
-		const skew = describeDriverSkew(primary.driverVersion, readRuntimeVersion(bundleResolutionRoots(bundle.dir)));
-		logger.warn(`Collection policies: skipped — the "${primary.driverPackage}" driver (engine "${primary.engine}") does not apply RLS policies at boot. ` + (skew.detail ? `${skew.detail} ` : "") + "Collections are not row-secured until policies are applied — depending on the driver's grants that means reads are denied or that they are unfiltered. Do not serve traffic until this is resolved.\n" + schemaRecoveryGuidance({ staleDriver: skew.stale }));
-		return;
-	}
-	const loaded = await loadCollectionsFromDirectory(bundle.collectionsDir);
-	if (loaded.length === 0) return;
-	const collections = collectionsStoredBy(loaded, primary, dataSources);
-	if (collections.length === 0) return;
-	const { applied } = await primary.bootstrapper.ensureCollectionPolicies(collections, preInitDriverResult(primary), (message) => logger.debug(`policies: ${message}`));
-	if (applied > 0) logger.info(`Applied ${applied} RLS policy statement(s) before serving.`);
-	else logger.debug("RLS policies are up to date.");
+	if (bundle.collectionsDir) return;
+	logger.warn(`This bundle declares a config package at "${bundle.manifest.entry.config}", but no collections directory resolved inside it, so no collections were loaded and no tables will be created. Rebuild with \`rebase build\` and check the manifest's \`entry.collections\`.`);
 }
 //#endregion
-export { ApiError, BlockedUrlError, BundleError, CronScheduler, DEFAULT_DRIVER_ID, DEFAULT_MAX_FILE_SIZE, DEFAULT_STORAGE_ID, DOCUMENT_MIME_TYPES, DefaultDriverRegistry, DefaultStorageRegistry, GCSStorageController, IMAGE_MIME_TYPES, LocalStorageController, MetricsRegistry, RawHtml, S3StorageController, SMTPEmailService, TransformCache, TusHandler, UnknownStorageSourceError, WebhookDispatcher, _resetRebaseMock, _setRebaseMock, applyCollectionDefaults, assertAllowedOutboundUrl, assertCollectionConfigs, assertDistinctSuffixes, assertEmailLinkBases, assertWriteRequestValid, authJwt, authRoles, authUid, blockedAddressReason, bootFromBundle, classifySurface, cleanupDevPortFile, createAppleProvider, createBackupRoutes, createBitbucketProvider, createBuiltinAuthAdapter, createContractRoutes, createCronRoutes, createCronStore, createCustomAuthAdapter, createDiscordProvider, createEmailService, createFacebookProvider, createFunctionRoutes, createGitHubProvider, createGitLabProvider, createGoogleProvider, createHistoryRoutes, createLinkedinProvider, createMetricsMiddleware, createMetricsRoutes, createMicrosoftProvider, createSlackProvider, createSourceBundle, createSpotifyProvider, createStorageController, createStorageRoutes, createTwitterProvider, defineCron, defineFunction, envSuffixForKey, errorHandler, escapeHtml, extractUserFromToken, fileTokenAuth, findCollectionConfigProblems, generateSecurePassword, getEmailVerificationTemplate, getMagicLinkTemplate, getPasswordResetTemplate, getUserInvitationTemplate, getWelcomeEmailTemplate, hashPassword, html, httpMethodToOperation, initializeDataSource, initializeDataSources, initializeRebaseBackend, installShutdownHandlers, isApiKeyToken, isAuthAdapter, isDatabaseAdapter, isLocalhostOrigin, isOperationAllowed, isTransformableImage, listBackupObjects, listenWithPortRetry, loadBootEnv, loadBundle, loadBundleConfigExports, loadBundleSchema, loadCollectionsFromDirectory, loadCronJobsFromDirectory, loadCronJobsWithDiagnostics, loadDeclaredStorageSources, loadEnv, loadFunctionsFromDirectory, loadUsersCollection, logger, oauthCodeFlowSchema, optionalAuth, parseBackupDestination, parseBackupTimestamp, parseTransformOptions, pkceTokenParams, providerVerifiedEmail, queryTokenAuth, raw, readBackupBytes, readBundleManifest, rebase, requireAdmin, requireAuth, resolveAuthHooks, resolveAuthOptions, resolveCorsOrigin, resolveDataSources, resolveEmailLinkBase, resolveEmailOptions, resolveRequireAuth, resolveStorageBackend, resolveStorageSources, runFromBundle, safeCompare, serveSPA, transformImage, tryVerifyOidcIdToken, unknownKeyPolicyFromEnv, validateApiKey, validateCronExpression, validatePasswordStrength, verifyOidcIdToken, verifyPassword };
+export { ApiError, BlockedUrlError, BundleError, CONCURRENT_DDL_SQLSTATES, CronScheduler, DEFAULT_DRIVER_ID, DEFAULT_MAX_FILE_SIZE, DEFAULT_STORAGE_ID, DOCUMENT_MIME_TYPES, DefaultDriverRegistry, DefaultStorageRegistry, GCSStorageController, IMAGE_MIME_TYPES, LocalStorageController, MetricsRegistry, RawHtml, S3StorageController, SMTPEmailService, TransformCache, TusHandler, UnknownStorageSourceError, WEBHOOK_DELIVERY_TASK, WebhookDispatcher, _resetRebaseMock, _setRebaseMock, applyCollectionDefaults, assertAllowedOutboundUrl, assertCollectionConfigs, assertDistinctSuffixes, assertEmailLinkBases, assertWriteRequestValid, authJwt, authRoles, authUid, blockedAddressReason, bootFromBundle, classifySurface, cleanupDevPortFile, createAppleProvider, createBackupRoutes, createBitbucketProvider, createBuiltinAuthAdapter, createContractRoutes, createCronRoutes, createCronStore, createCustomAuthAdapter, createDdlBootstrapper, createDiscordProvider, createEmailService, createFacebookProvider, createFunctionRoutes, createGitHubProvider, createGitLabProvider, createGoogleProvider, createHistoryRoutes, createJobQueue, createJobStore, createJwksRoutes, createLinkedinProvider, createMetricsMiddleware, createMetricsRoutes, createMicrosoftProvider, createSlackProvider, createSourceBundle, createSpotifyProvider, createStorageController, createStorageRoutes, createTwitterProvider, defaultBackoff, defineCron, defineFunction, envSuffixForKey, errorHandler, escapeHtml, extractUserFromToken, fileTokenAuth, findCollectionConfigProblems, generateSecurePassword, getEmailVerificationTemplate, getJwks, getMagicLinkTemplate, getPasswordResetTemplate, getUserInvitationTemplate, getWelcomeEmailTemplate, hasAsymmetricSigningKey, hashPassword, html, httpMethodToOperation, initializeDataSource, initializeDataSources, initializeRebaseBackend, installShutdownHandlers, isApiKeyToken, isAuthAdapter, isConcurrentDdlRace, isDatabaseAdapter, isDuplicateObjectRace, isLocalhostOrigin, isOperationAllowed, isTransformableImage, listBackupObjects, listenWithPortRetry, loadBootEnv, loadBundle, loadBundleConfigExports, loadBundleSchema, loadCollectionsFromDirectory, loadCronJobsFromDirectory, loadCronJobsWithDiagnostics, loadDeclaredStorageSources, loadEnv, loadFunctionsFromDirectory, loadUsersCollection, logger, oauthCodeFlowSchema, optionalAuth, parseBackupDestination, parseBackupTimestamp, parseTransformOptions, pkceTokenParams, providerVerifiedEmail, queryTokenAuth, raw, readBackupBytes, readBundleManifest, rebase, requireAdmin, requireAuth, resolveAuthHooks, resolveAuthOptions, resolveCorsOrigin, resolveDataSources, resolveEmailLinkBase, resolveEmailOptions, resolveRequireAuth, resolveStorageBackend, resolveStorageSources, runFromBundle, safeCompare, serveSPA, transformImage, tryVerifyOidcIdToken, unknownKeyPolicyFromEnv, validateApiKey, validateCronExpression, validatePasswordStrength, verifyOidcIdToken, verifyPassword };
 
 //# sourceMappingURL=index.es.js.map