@rebasepro/server 0.14.1 → 0.14.2-canary.g27a129e

package/dist/{admin_block-H86dCPsj.js → admin_block-DLILvzle.js}

@@ -38,6 +38,7 @@ var ADMIN_COLLECTION_KEYS = [
 	"additionalFields",
 	"alwaysApplyDefaultValues",
 	"components",
+	"customViews",
 	"defaultEntityAction",
 	"defaultFilter",
 	"defaultSelectedView",
@@ -181,4 +182,4 @@ function nestAdminPropertyKeys(property) {
 //#endregion
 export { nestAdminPropertyKeys as i, ADMIN_PROPERTY_KEYS as n, nestAdminCollectionKeys as r, ADMIN_COLLECTION_KEYS as t };
 
-//# sourceMappingURL=admin_block-H86dCPsj.js.map
+//# sourceMappingURL=admin_block-DLILvzle.js.map

package/dist/admin_block-DLILvzle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin_block-DLILvzle.js","names":[],"sources":["../../types/src/types/admin_block.ts"],"sourcesContent":["/**\n * The keys of a collection's admin block, as data.\n *\n * There is no *type* for the block in this package any more, and that is the point:\n * `admin` is not declared on `BaseCollectionConfig` or on any property here, so a\n * BaaS install cannot even write one. `@rebasepro/admin-types` adds the field back by\n * declaration merging, which is why installing it is what makes the admin surface\n * appear.\n *\n * The *list* still has to live here, because three runtime consumers need it and two\n * of them are core — see below.\n */\n\n/**\n * Every key that belongs inside a collection's `admin` block, as data.\n *\n * The type that describes these fields is `AdminCollectionOptions` in\n * `@rebasepro/admin-types`, and it is erased at build time — but three runtime\n * consumers need the list, and two of them are core:\n *\n * - `serializeCollections`, to drop the block from the contract\n * - the ts-morph schema editor in `@rebasepro/server`, which rewrites collection\n *   files on disk from the admin panel and has to know where each key goes. A key\n *   missing from this list gets written to the *top level* of the file, where the\n *   backend ignores it and the panel never finds it again.\n * - the `collections-admin-block` codemod\n *\n * `@rebasepro/admin-types` re-exports this and asserts it names only real option\n * keys; the count is pinned by a test there.\n *\n * @group Models\n */\nexport const ADMIN_COLLECTION_KEYS = [\n    \"Actions\",\n    \"additionalFields\",\n    \"alwaysApplyDefaultValues\",\n    \"components\",\n    \"customViews\",\n    \"defaultEntityAction\",\n    \"defaultFilter\",\n    \"defaultSelectedView\",\n    \"defaultSize\",\n    \"defaultViewMode\",\n    \"disableDefaultActions\",\n    \"display\",\n    \"enabledViews\",\n    \"entityActions\",\n    \"entityViews\",\n    \"exportable\",\n    \"filterPresets\",\n    \"fixedFilter\",\n    \"form\",\n    \"formAutoSave\",\n    \"formView\",\n    \"group\",\n    \"hideFromEntityViews\",\n    \"hideFromNavigation\",\n    \"hideIdFromCollection\",\n    \"hideIdFromForm\",\n    \"icon\",\n    \"includeJsonView\",\n    \"inlineEditing\",\n    \"kanban\",\n    \"listProperties\",\n    \"localChangesBackup\",\n    \"openEntityMode\",\n    \"orderProperty\",\n    \"pagination\",\n    \"previewProperties\",\n    \"propertiesOrder\",\n    \"selectionController\",\n    \"selectionEnabled\",\n    \"sideDialogWidth\",\n    \"sort\",\n    \"titleProperty\"\n] as const;\n\n/** A key of a collection's `admin` block. @group Models */\nexport type AdminCollectionKey = typeof ADMIN_COLLECTION_KEYS[number];\n\n/**\n * Every key that belongs inside a *property's* `admin` block, as data.\n *\n * The union of `AdminPropertyOptions` and its per-type extensions\n * (`AdminStringOptions`, `AdminArrayOptions`, …) in `@rebasepro/admin-types`.\n * It lives here for the same reason {@link ADMIN_COLLECTION_KEYS} does: the\n * runtime consumers are core packages that the BaaS guard forbids from\n * importing `@rebasepro/admin-types`. Here it is the boot-time collection\n * validator in `@rebasepro/server`, which has to tell \"you left `readOnly` at\n * the top of the property, where nothing reads it\" apart from \"you invented a\n * key we have never heard of\".\n *\n * `@rebasepro/admin-types` re-exports this and asserts it names only real\n * option keys.\n *\n * @group Models\n */\nexport const ADMIN_PROPERTY_KEYS = [\n    \"canAddElements\",\n    \"clearable\",\n    \"columnWidth\",\n    \"customProps\",\n    \"disabled\",\n    \"expanded\",\n    \"Field\",\n    \"Filter\",\n    \"filterOperators\",\n    \"fixedFilter\",\n    \"hideFromCollection\",\n    \"includeEntityLink\",\n    \"includeId\",\n    \"markdown\",\n    \"minimalistView\",\n    \"multiline\",\n    \"Preview\",\n    \"previewAsTag\",\n    \"previewProperties\",\n    \"readOnly\",\n    \"sortable\",\n    \"span\",\n    \"spreadChildren\",\n    \"urlPreview\",\n    \"widget\",\n] as const;\n\n/** A key of a property's `admin` block. @group Models */\nexport type AdminPropertyKey = typeof ADMIN_PROPERTY_KEYS[number];\n\n/**\n * Move flattened admin keys back down into the `admin` block.\n *\n * The admin panel works with a *flat* view model — the block merged onto the\n * collection — so what comes back from a form has `icon` and `defaultViewMode`\n * at the top level while `admin` still holds whatever the file was loaded with.\n * This is the way back.\n *\n * **The top-level value wins.** It is the one the form just wrote; the block is\n * the copy the collection was loaded with, and preferring it resolves every edit\n * in favour of the value the user changed away from.\n *\n * This lives here, next to the key lists, because it had two implementations —\n * `toAdminCollectionConfig` in `@rebasepro/admin-types` and `nestAdminKeys` in\n * `@rebasepro/server`'s schema editor — that agreed on everything except that\n * precedence, which is the only part that decides whether a save is visible.\n *\n * @group Models\n */\nexport function nestAdminKeysOf(\n    source: Record<string, unknown>,\n    adminKeys: readonly string[]\n): Record<string, unknown> {\n    const keys = new Set<string>(adminKeys);\n    const top: Record<string, unknown> = {};\n    const block: Record<string, unknown> = { ...((source.admin as Record<string, unknown> | undefined) ?? {}) };\n\n    for (const [key, value] of Object.entries(source)) {\n        if (key === \"admin\") continue;\n        if (keys.has(key)) block[key] = value;\n        else top[key] = value;\n    }\n\n    if (Object.keys(block).length > 0) top.admin = block;\n    return top;\n}\n\n/**\n * {@link nestAdminKeysOf} for a collection.\n *\n * @group Models\n */\nexport function nestAdminCollectionKeys(collection: Record<string, unknown>): Record<string, unknown> {\n    return nestAdminKeysOf(collection, ADMIN_COLLECTION_KEYS);\n}\n\n/**\n * {@link nestAdminKeysOf} for a property, applied to its children too.\n *\n * A map property carries `properties`, an array property carries `of`, and both\n * hold properties with `admin` blocks of their own. A flat `readOnly` left on a\n * child is as dead — and as fatal at the next boot — as one left on the parent,\n * so the walk goes all the way down.\n *\n * @group Models\n */\nexport function nestAdminPropertyKeys(property: Record<string, unknown>): Record<string, unknown> {\n    const nested = nestAdminKeysOf(property, ADMIN_PROPERTY_KEYS);\n\n    const children = nested.properties;\n    if (children && typeof children === \"object\" && !Array.isArray(children)) {\n        nested.properties = Object.fromEntries(\n            Object.entries(children as Record<string, unknown>).map(([key, child]) => [\n                key,\n                child && typeof child === \"object\" && !Array.isArray(child)\n                    ? nestAdminPropertyKeys(child as Record<string, unknown>)\n                    : child\n            ])\n        );\n    }\n\n    const of = nested.of;\n    if (Array.isArray(of)) {\n        nested.of = of.map(entry => entry && typeof entry === \"object\" && !Array.isArray(entry)\n            ? nestAdminPropertyKeys(entry as Record<string, unknown>)\n            : entry);\n    } else if (of && typeof of === \"object\") {\n        nested.of = nestAdminPropertyKeys(of as Record<string, unknown>);\n    }\n\n    return nested;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCA,IAAa,wBAAwB;CACjC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACJ;;;;;;;;;;;;;;;;;;AAsBA,IAAa,sBAAsB;CAC/B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACJ;;;;;;;;;;;;;;;;;;;;AAwBA,SAAgB,gBACZ,QACA,WACuB;CACvB,MAAM,OAAO,IAAI,IAAY,SAAS;CACtC,MAAM,MAA+B,CAAC;CACtC,MAAM,QAAiC,EAAE,GAAK,OAAO,SAAiD,CAAC,EAAG;CAE1G,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,MAAM,GAAG;EAC/C,IAAI,QAAQ,SAAS;EACrB,IAAI,KAAK,IAAI,GAAG,GAAG,MAAM,OAAO;OAC3B,IAAI,OAAO;CACpB;CAEA,IAAI,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,GAAG,IAAI,QAAQ;CAC/C,OAAO;AACX;;;;;;AAOA,SAAgB,wBAAwB,YAA8D;CAClG,OAAO,gBAAgB,YAAY,qBAAqB;AAC5D;;;;;;;;;;;AAYA,SAAgB,sBAAsB,UAA4D;CAC9F,MAAM,SAAS,gBAAgB,UAAU,mBAAmB;CAE5D,MAAM,WAAW,OAAO;CACxB,IAAI,YAAY,OAAO,aAAa,YAAY,CAAC,MAAM,QAAQ,QAAQ,GACnE,OAAO,aAAa,OAAO,YACvB,OAAO,QAAQ,QAAmC,CAAC,CAAC,KAAK,CAAC,KAAK,WAAW,CACtE,KACA,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IACpD,sBAAsB,KAAgC,IACtD,KACV,CAAC,CACL;CAGJ,MAAM,KAAK,OAAO;CAClB,IAAI,MAAM,QAAQ,EAAE,GAChB,OAAO,KAAK,GAAG,KAAI,UAAS,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAChF,sBAAsB,KAAgC,IACtD,KAAK;MACR,IAAI,MAAM,OAAO,OAAO,UAC3B,OAAO,KAAK,sBAAsB,EAA6B;CAGnE,OAAO;AACX"}

package/dist/api/logs-routes.d.ts

@@ -9,19 +9,34 @@ export interface LogEntry {
     message: string;
     metadata?: Record<string, unknown>;
 }
+/** What a caller can narrow the log by, in either direction (query or stream). */
+export interface LogFilterOptions {
+    level?: string;
+    source?: string;
+    search?: string;
+    since?: string;
+}
+/** Notified for every entry pushed, in push order. */
+export type LogListener = (entry: LogEntry) => void;
 declare class LogRingBuffer {
     private buffer;
     private maxSize;
     private idCounter;
+    private listeners;
     constructor(maxSize?: number);
     push(entry: Omit<LogEntry, "id">): void;
-    query(options: {
-        level?: string;
-        source?: string;
-        search?: string;
+    /**
+     * Follow the buffer. Returns the unsubscribe — call it, always: a listener
+     * left behind holds its whole closure, and on this class that closure is a
+     * pending-entry array.
+     *
+     * A listener must not log. It is called from inside `push`, so anything that
+     * reaches `addLog` from here recurses until the stack gives out.
+     */
+    subscribe(listener: LogListener): () => void;
+    query(options: LogFilterOptions & {
         limit?: number;
         offset?: number;
-        since?: string;
     }): {
         entries: LogEntry[];
         total: number;
@@ -31,7 +46,31 @@ declare class LogRingBuffer {
 export declare const logBuffer: LogRingBuffer;
 /** Add a log entry */
 export declare function addLog(level: LogEntry["level"], source: LogEntry["source"], message: string, metadata?: Record<string, unknown>): void;
+export interface LogMiddlewareOptions {
+    /**
+     * Paths this sink ignores, matched exactly against `c.req.path`.
+     *
+     * For requests whose only reason to exist is to read the log. Recording
+     * those makes the reader the loudest thing in its own output, and on a quiet
+     * server it is also the thing evicting real entries out of the ring.
+     */
+    ignorePaths?: string[];
+}
 /** Hono middleware to log API requests */
-export declare function logMiddleware(): MiddlewareHandler<HonoEnv>;
-declare const app: Hono<HonoEnv, import("hono/types").BlankSchema, "/">;
-export default app;
+export declare function logMiddleware(options?: LogMiddlewareOptions): MiddlewareHandler<HonoEnv>;
+/**
+ * The stream's timings, injectable only so they can be tested.
+ *
+ * The defaults above are the contract and nothing in production passes this. A
+ * heartbeat is a 25-second wait to observe, and a suite that cannot observe it is
+ * a suite where the keepalive can rot — which surfaces as "the tail dies after a
+ * few minutes behind the load balancer", months later, on someone else's cluster.
+ */
+export interface LogStreamTiming {
+    flushMs?: number;
+    heartbeatMs?: number;
+    maxPending?: number;
+}
+export declare function createLogsRoutes(timing?: LogStreamTiming): Hono<HonoEnv>;
+declare const _default: Hono<HonoEnv, import("hono/types").BlankSchema, "/">;
+export default _default;

package/dist/auth/index.d.ts

@@ -41,6 +41,10 @@ export { createRateLimiter, defaultAuthLimiter, strictAuthLimiter, createDataRat
 export type { DataRateLimitConfig } from "./rate-limiter";
 export { MemoryRateLimitStore } from "./rate-limit-store";
 export type { RateLimitStore, RateLimitDecision } from "./rate-limit-store";
+export { createSqlRateLimitStore } from "./sql-rate-limit-store";
+export type { SqlRateLimitStoreOptions } from "./sql-rate-limit-store";
+export { resolveRateLimitStoreKind, RateLimitStoreConfigurationError } from "./resolve-rate-limit-store";
+export type { RateLimitStoreKind, RateLimitStoreEnv } from "./resolve-rate-limit-store";
 export { createApiKeyStore, createApiKeyRoutes, isApiKeyToken, validateApiKey, httpMethodToOperation, isOperationAllowed } from "./api-keys";
 export type { ApiKey, ApiKeyMasked, ApiKeyPermission, ApiKeyWithSecret, CreateApiKeyRequest, UpdateApiKeyRequest, ApiKeyStore, ApiKeyOperation } from "./api-keys";
 export { createBuiltinAuthAdapter } from "./builtin-auth-adapter";

package/dist/auth/resolve-rate-limit-store.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Choosing where rate-limit counts live, from configuration and environment.
+ *
+ * Pure, and separate from both stores, because the decision is the risk. Getting
+ * it wrong in either direction is silent: a deployment that wanted shared counts
+ * and got per-process ones enforces N times its limit, and a single-container
+ * deployment that got shared ones pays a database round trip on every request
+ * for a count nobody is sharing with.
+ *
+ * ## Why memory is still the default
+ *
+ * The same reason `role.ts` gives for having no channel-bus refusal: **a process
+ * cannot read its own replica count.** A single container scaled to three needs
+ * a shared store exactly as much as a split deployment does, and neither is
+ * visible from inside one process. So this does not guess. It stays on the
+ * default that costs nothing, and the deployment that knows it has peers says
+ * so — with one environment variable, which is the same sentence whether it is
+ * written in a compose file, a Helm value, or a platform-pinned pod spec.
+ */
+/** Where a deployment keeps its rate-limit counts. */
+export type RateLimitStoreKind = "memory" | "sql";
+/** The environment this module reads. Narrowed so it can be called with a literal. */
+export interface RateLimitStoreEnv {
+    /** `memory` (default) or `sql`. */
+    REBASE_RATE_LIMIT_STORE?: string;
+}
+/**
+ * A refusal to boot, phrased as the variable to change.
+ *
+ * Its own class so `bootFromBundle` can present it as a configuration problem
+ * rather than a crash, matching `RoleConfigurationError`.
+ */
+export declare class RateLimitStoreConfigurationError extends Error {
+    readonly hint?: string | undefined;
+    constructor(message: string, hint?: string | undefined);
+}
+/**
+ * Which store this process should build.
+ *
+ * A misspelled value **refuses to boot** rather than falling back to memory.
+ * Every other outcome here is silent — the whole failure mode of this setting is
+ * that nothing looks wrong — so the one moment it can be caught is the moment it
+ * is read. `REBASE_RATE_LIMIT_STORE=postgres` is the obvious thing to type and
+ * would otherwise be a per-replica limit wearing the shape of a shared one.
+ *
+ * A blank or whitespace-only value is *unset*, not invalid:
+ * `REBASE_RATE_LIMIT_STORE=${SOMETHING}` with `SOMETHING` undefined is the
+ * ordinary way to write a compose file, and it is how the platform neutralises a
+ * tenant's own variable.
+ */
+export declare function resolveRateLimitStoreKind(env: RateLimitStoreEnv): RateLimitStoreKind;

package/dist/auth/sql-rate-limit-store.d.ts

@@ -0,0 +1,63 @@
+/**
+ * A rate-limit store every process in a deployment shares.
+ *
+ * {@link MemoryRateLimitStore} counts in one process's memory, so N replicas
+ * enforce N times the limit between them. That is fine for the single container
+ * almost every deployment runs, and wrong the moment a deployment splits — an
+ * `api` pod and a `functions` pod each grant a caller the full allowance, and
+ * nothing anywhere reports it. A limit that silently lets through 3× the traffic
+ * is worse than no limit, because it is believed.
+ *
+ * So this keeps the counts in Postgres, on the same seam the cron store already
+ * uses: `DataDriver.admin.executeSql`. No new dependency, no new service, and it
+ * degrades on a driver with no SQL (Mongo) rather than failing to boot.
+ *
+ * ## Why two buckets rather than one row per hit
+ *
+ * The memory store keeps a timestamp per hit, which is exact and costs a row per
+ * request here. This keeps **one row per key per window** and approximates the
+ * same sliding behaviour by weighting the previous window by how much of it is
+ * still in view:
+ *
+ *     estimate = current + previous × (1 − elapsed ÷ window)
+ *
+ * At the moment a window rolls over the previous bucket counts fully and decays
+ * to nothing by the end, so the boundary burst a fixed window allows — spend the
+ * whole allowance in the last second, spend it again in the first second of the
+ * next — is bounded rather than free. This is the standard approximation and its
+ * error is at most one window's distribution skew, which for a floor against
+ * runaway clients is not a number worth a row per request.
+ *
+ * ## Why a denied hit is given back
+ *
+ * `INSERT … ON CONFLICT DO UPDATE … RETURNING` is atomic per row, which is what
+ * the interface demands: two concurrent hits cannot both read `limit - 1` and
+ * both be allowed. But it means the count is incremented *before* the decision,
+ * so a request that turns out to be over the limit has already been charged for.
+ *
+ * The memory store does not charge denied hits, and a store whose semantics
+ * differ from the default is a store nobody can safely switch to — the limit
+ * would tighten for reasons an operator would attribute to their traffic. So a
+ * denial issues a compensating decrement. That is a second statement, on the
+ * path that is by definition the rare one; the allowed path stays at one.
+ */
+import type { DataDriver } from "@rebasepro/types";
+import type { RateLimitStore } from "./rate-limit-store.js";
+export interface SqlRateLimitStoreOptions {
+    /** How often to delete expired buckets. Defaults to 5 minutes. */
+    sweepMs?: number;
+    /**
+     * Clock, for tests. Driving the window directly beats sleeping through half
+     * of one — a real sleep overruns on a loaded machine and takes the hits it
+     * expected to still be in the window with it.
+     */
+    now?: () => number;
+}
+/**
+ * Build the store, or `undefined` if this driver cannot back it.
+ *
+ * Returning `undefined` rather than throwing matches `createCronStore`: a
+ * deployment on a driver with no SQL admin should degrade to per-process counts
+ * with a warning, not refuse to serve.
+ */
+export declare function createSqlRateLimitStore(driver: DataDriver, options?: SqlRateLimitStoreOptions): RateLimitStore | undefined;

package/dist/{auth-BobZVd0j.js → auth-DIKS1rsI.js}

@@ -2,10 +2,10 @@ import { createRequire as __createRequire } from "module";
 import process from "process";
 __createRequire(import.meta.url);
 import { i as __toESM, n as __exportAll } from "./rolldown-runtime-DSJWtz9O.js";
-import { C as ListLimitError, D as isAnonymousUid, E as ANONYMOUS_USER_ID, T as resolveClientListLimit, a as deserializeLogicalCondition, i as deserializeFilter, r as UnknownFilterOperatorError } from "./src-8XDWyDfR.js";
-import "./src-Cz9nMgUR.js";
+import { C as ListLimitError, D as isAnonymousUid, E as ANONYMOUS_USER_ID, T as resolveClientListLimit, a as deserializeLogicalCondition, i as deserializeFilter, r as UnknownFilterOperatorError } from "./src-B-E7RjdN.js";
+import "./src-CrCxd8km.js";
 import { n as createDdlBootstrapper, o as revokeInternalTableSql, s as isSQLAdmin } from "./ddl-bootstrap-Cywoj8Ta.js";
-import { S as canonicalStorageId, T as require_jsonwebtoken, _ as verifyMfaPendingToken, a as generateMfaPendingToken, c as getJwks, d as hasAsymmetricSigningKey, f as hashRefreshToken, g as verifyDownloadToken, h as verifyAccessToken, i as generateDownloadToken, l as getRefreshTokenExpiry, n as configureJwt, o as generateRefreshToken, p as isJwtConfigured, r as generateAccessToken, s as getAccessTokenExpiry, t as MAX_COOKIE_AGE_MS, u as getRefreshTokenTtlMs, w as tryCanonicalStorageKey } from "./jwt-VJyXTdQQ.js";
+import { S as canonicalStorageId, T as require_jsonwebtoken, _ as verifyMfaPendingToken, a as generateMfaPendingToken, c as getJwks, d as hasAsymmetricSigningKey, f as hashRefreshToken, g as verifyDownloadToken, h as verifyAccessToken, i as generateDownloadToken, l as getRefreshTokenExpiry, n as configureJwt, o as generateRefreshToken, p as isJwtConfigured, r as generateAccessToken, s as getAccessTokenExpiry, t as MAX_COOKIE_AGE_MS, u as getRefreshTokenTtlMs, w as tryCanonicalStorageKey } from "./jwt-DxH9fLPt.js";
 import { t as logger } from "./logger-DfvF_8r-.js";
 import { n as errorHandler, t as ApiError } from "./errors-EBYiaJ2E.js";
 import { createHash, randomBytes, randomInt } from "node:crypto";
@@ -7366,7 +7366,7 @@ function mountSessionRoutes(opts) {
 		clearRefreshCookie(c, config.cookieAuth);
 		const accessToken = extractBearerToken(c.req.header("authorization"));
 		if (ops.afterLogout && accessToken !== void 0) {
-			const { verifyAccessToken } = await import("./jwt-VJyXTdQQ.js").then((n) => n.m);
+			const { verifyAccessToken } = await import("./jwt-DxH9fLPt.js").then((n) => n.m);
 			const payload = verifyAccessToken(accessToken);
 			if (payload) ops.afterLogout(payload.uid).catch((err) => {
 				logger.error("[AuthHooks] afterLogout error", { error: err instanceof Error ? err.message : err });
@@ -8022,12 +8022,13 @@ function createAuthRoutes(config) {
 						photoUrl: user.photoUrl || externalUser.photoUrl || void 0
 					});
 				} else {
-					if (config.disableSelfRegistration) throw ApiError.forbidden("Registration is disabled", "REGISTRATION_DISABLED");
+					const noSignupsMessage = `No account exists for this ${provider.id} identity, and new sign-ups are disabled on this backend. Ask an administrator to create your account.`;
+					if (config.disableSelfRegistration) throw ApiError.forbidden(noSignupsMessage, "REGISTRATION_DISABLED");
 					let bootstrapRegistration = false;
 					if (!isRegistrationAllowed()) {
 						const { total } = await authRepo.listUsersPaginated({ limit: 1 });
 						bootstrapRegistration = total === 0;
-						if (!bootstrapRegistration) throw ApiError.forbidden("Registration is disabled", "REGISTRATION_DISABLED");
+						if (!bootstrapRegistration) throw ApiError.forbidden(noSignupsMessage, "REGISTRATION_DISABLED");
 					}
 					user = await authRepo.createUser({
 						email: normalizeEmail(externalUser.email),
@@ -8045,7 +8046,7 @@ function createAuthRoutes(config) {
 					const isFirstUser = allUsers.length === 1 && allUsers[0].id === user.id;
 					if (bootstrapRegistration && !isFirstUser) {
 						await authRepo.deleteUser(user.id);
-						throw ApiError.forbidden("Registration is disabled", "REGISTRATION_DISABLED");
+						throw ApiError.forbidden(noSignupsMessage, "REGISTRATION_DISABLED");
 					}
 					if (isFirstUser) await authRepo.setUserRoles(user.id, ["admin"]);
 					else if (config.defaultRole) await authRepo.assignDefaultRole(user.id, config.defaultRole);
@@ -10036,6 +10037,198 @@ function createSpotifyProvider(config) {
 	};
 }
 //#endregion
+//#region src/auth/sql-rate-limit-store.ts
+var SCHEMA = "rebase";
+var TABLE_NAME = "rate_limit_hits";
+var TABLE$1 = `${SCHEMA}.${TABLE_NAME}`;
+/** How often expired buckets are deleted. */
+var DEFAULT_SWEEP_MS = 300 * 1e3;
+/**
+* Build the store, or `undefined` if this driver cannot back it.
+*
+* Returning `undefined` rather than throwing matches `createCronStore`: a
+* deployment on a driver with no SQL admin should degrade to per-process counts
+* with a warning, not refuse to serve.
+*/
+function createSqlRateLimitStore(driver, options = {}) {
+	const admin = driver.admin;
+	if (!isSQLAdmin(admin)) {
+		logger.warn("⚠️ [rate-limit] The configured driver has no SQL admin, so rate-limit counts cannot be shared between processes. Falling back to this process's memory — each replica will enforce the limit independently.");
+		return;
+	}
+	const exec = (sqlText, options) => admin.executeSql(sqlText, options?.params ? { params: options.params } : void 0);
+	const ddl = createDdlBootstrapper(exec, "rate-limit-store");
+	const now = options.now ?? Date.now;
+	const sweepMs = options.sweepMs ?? DEFAULT_SWEEP_MS;
+	let sweepTimer;
+	let ready;
+	/**
+	* Create the table once, and remember whether it worked.
+	*
+	* Lazily rather than at boot because the store is constructed while routes
+	* are being mounted, and an `await` there would put a database round trip on
+	* the boot path of every deployment — including the ones that never take a
+	* request. The first request pays for it.
+	*
+	* The result is cached even on failure: a store that cannot create its table
+	* must not retry the DDL on every request, which would turn one broken
+	* permission into a per-request query storm.
+	*
+	* Readiness is decided by reading the table, never by the DDL not throwing —
+	* `ensureObject` routes through `step`, which logs a failure and returns
+	* normally. Keying on the absence of an exception would report a table that
+	* was never created as ready, and every later request would fall into the
+	* per-request error path instead of the one-time fallback.
+	*/
+	async function ensureReady() {
+		if (!ready) ready = (async () => {
+			try {
+				await ddl.ensureObject("Creating schema rebase", "CREATE SCHEMA IF NOT EXISTS rebase");
+				await ddl.ensureObject(`Creating ${TABLE$1}`, `
+                        CREATE TABLE IF NOT EXISTS ${TABLE$1} (
+                            key TEXT NOT NULL,
+                            bucket BIGINT NOT NULL,
+                            hits INTEGER NOT NULL DEFAULT 0,
+                            expires_at TIMESTAMPTZ NOT NULL,
+                            PRIMARY KEY (key, bucket)
+                        )
+                    `);
+				await ddl.ensureObject("Creating idx_rate_limit_hits_expiry", `
+                        CREATE INDEX IF NOT EXISTS idx_rate_limit_hits_expiry
+                        ON ${TABLE$1}(expires_at)
+                    `);
+				const readable = await ddl.isReadable(TABLE$1);
+				if (readable) await ddl.step("Revoking end-user access to rate_limit_hits", () => exec(revokeInternalTableSql(SCHEMA, TABLE_NAME)));
+				else logger.error("[rate-limit] The shared rate-limit table could not be created, so counts stay per-process. Every replica will enforce the limit independently.");
+				return readable;
+			} catch (err) {
+				logger.error("[rate-limit] Could not prepare the shared rate-limit table. Falling back to per-process counts for the life of this process.", { error: err instanceof Error ? err.message : String(err) });
+				return false;
+			}
+		})();
+		return ready;
+	}
+	function startSweeping() {
+		if (sweepTimer) return;
+		sweepTimer = setInterval(() => {
+			exec(`DELETE FROM ${TABLE$1} WHERE expires_at < now()`).catch((err) => {
+				logger.debug("[rate-limit] Bucket sweep failed", { error: err instanceof Error ? err.message : String(err) });
+			});
+		}, sweepMs);
+		sweepTimer.unref?.();
+	}
+	return {
+		async hit(key, windowMs, limit) {
+			if (!await ensureReady()) return {
+				allowed: true,
+				remaining: limit,
+				retryAfterMs: 0
+			};
+			startSweeping();
+			const at = now();
+			const bucket = Math.floor(at / windowMs);
+			const carry = 1 - (at - bucket * windowMs) / windowMs;
+			const expiresAt = new Date((bucket + 2) * windowMs).toISOString();
+			let current;
+			let previous;
+			try {
+				const row = firstRow(await exec(`WITH bumped AS (
+                         INSERT INTO ${TABLE$1} AS r (key, bucket, hits, expires_at)
+                         VALUES ($1, $2, 1, $3)
+                         ON CONFLICT (key, bucket)
+                         DO UPDATE SET hits = r.hits + 1, expires_at = EXCLUDED.expires_at
+                         RETURNING hits
+                     )
+                     SELECT
+                         (SELECT hits FROM bumped) AS current,
+                         COALESCE((SELECT hits FROM ${TABLE$1} WHERE key = $1 AND bucket = $4), 0) AS previous`, { params: [
+					key,
+					bucket,
+					expiresAt,
+					bucket - 1
+				] }));
+				current = Number(row?.current ?? 1);
+				previous = Number(row?.previous ?? 0);
+			} catch (err) {
+				logger.debug("[rate-limit] Shared count unavailable for this request", { error: err instanceof Error ? err.message : String(err) });
+				return {
+					allowed: true,
+					remaining: limit,
+					retryAfterMs: 0
+				};
+			}
+			const estimate = current + previous * carry;
+			if (estimate > limit) {
+				exec(`UPDATE ${TABLE$1} SET hits = GREATEST(hits - 1, 0) WHERE key = $1 AND bucket = $2`, { params: [key, bucket] }).catch(() => {});
+				return {
+					allowed: false,
+					remaining: 0,
+					retryAfterMs: Math.max(0, (bucket + 1) * windowMs - at)
+				};
+			}
+			return {
+				allowed: true,
+				remaining: Math.max(0, Math.floor(limit - estimate)),
+				retryAfterMs: 0
+			};
+		},
+		dispose() {
+			if (sweepTimer) clearInterval(sweepTimer);
+			sweepTimer = void 0;
+		}
+	};
+}
+/**
+* The first row of whatever shape this driver returns.
+*
+* `SqlExec` declares an array of rows, but drivers in this repository have also
+* returned a `{ rows }` envelope through the same escape hatch. Reading one
+* shape only is how a store silently counts nothing and reports every caller as
+* being on their first request — a limiter that never limits, with no error
+* anywhere. Tolerating both costs one line.
+*/
+function firstRow(result) {
+	if (Array.isArray(result)) return result[0];
+	const rows = result?.rows;
+	return Array.isArray(rows) ? rows[0] : void 0;
+}
+//#endregion
+//#region src/auth/resolve-rate-limit-store.ts
+/**
+* A refusal to boot, phrased as the variable to change.
+*
+* Its own class so `bootFromBundle` can present it as a configuration problem
+* rather than a crash, matching `RoleConfigurationError`.
+*/
+var RateLimitStoreConfigurationError = class extends Error {
+	hint;
+	constructor(message, hint) {
+		super(message);
+		this.hint = hint;
+		this.name = "RateLimitStoreConfigurationError";
+	}
+};
+/**
+* Which store this process should build.
+*
+* A misspelled value **refuses to boot** rather than falling back to memory.
+* Every other outcome here is silent — the whole failure mode of this setting is
+* that nothing looks wrong — so the one moment it can be caught is the moment it
+* is read. `REBASE_RATE_LIMIT_STORE=postgres` is the obvious thing to type and
+* would otherwise be a per-replica limit wearing the shape of a shared one.
+*
+* A blank or whitespace-only value is *unset*, not invalid:
+* `REBASE_RATE_LIMIT_STORE=${SOMETHING}` with `SOMETHING` undefined is the
+* ordinary way to write a compose file, and it is how the platform neutralises a
+* tenant's own variable.
+*/
+function resolveRateLimitStoreKind(env) {
+	const raw = (env.REBASE_RATE_LIMIT_STORE ?? "").trim().toLowerCase();
+	if (raw === "") return "memory";
+	if (raw === "memory" || raw === "sql") return raw;
+	throw new RateLimitStoreConfigurationError(`REBASE_RATE_LIMIT_STORE="${raw}" is not a rate-limit store.`, "Use \"sql\" to share counts across processes, or \"memory\" (the default) to keep them in this process. A deployment running more than one replica or more than one role wants \"sql\" — otherwise each process enforces the whole limit by itself.");
+}
+//#endregion
 //#region src/auth/api-keys/api-key-store.ts
 /**
 * Database operations for Service API Keys.
@@ -10433,6 +10626,7 @@ function createCustomAuthAdapter(options) {
 //#region src/auth/index.ts
 var auth_exports = /* @__PURE__ */ __exportAll({
 	MemoryRateLimitStore: () => MemoryRateLimitStore,
+	RateLimitStoreConfigurationError: () => RateLimitStoreConfigurationError,
 	apiKeyKeyGenerator: () => apiKeyKeyGenerator,
 	configureJwt: () => configureJwt,
 	createAdapterAuthMiddleware: () => createAdapterAuthMiddleware,
@@ -10457,6 +10651,7 @@ var auth_exports = /* @__PURE__ */ __exportAll({
 	createResetPasswordRoute: () => createResetPasswordRoute,
 	createSlackProvider: () => createSlackProvider,
 	createSpotifyProvider: () => createSpotifyProvider,
+	createSqlRateLimitStore: () => createSqlRateLimitStore,
 	createTwitterProvider: () => createTwitterProvider,
 	decideOAuthAutoLink: () => decideOAuthAutoLink,
 	defaultAuthLimiter: () => defaultAuthLimiter,
@@ -10490,6 +10685,7 @@ var auth_exports = /* @__PURE__ */ __exportAll({
 	requireAdmin: () => requireAdmin,
 	requireAuth: () => requireAuth,
 	resolveAuthHooks: () => resolveAuthHooks,
+	resolveRateLimitStoreKind: () => resolveRateLimitStoreKind,
 	safeCompare: () => safeCompare,
 	strictAuthLimiter: () => strictAuthLimiter,
 	tryVerifyOidcIdToken: () => tryVerifyOidcIdToken,
@@ -10501,6 +10697,6 @@ var auth_exports = /* @__PURE__ */ __exportAll({
 	verifyPassword: () => verifyPassword
 });
 //#endregion
-export { extractUserFromToken as $, createDataRateLimiter as A, generateSecurePassword as B, createBuiltinAuthAdapter as C, isPublicStoragePath as Ct, string as D, object as E, resolveEmailLinkBase as F, getWelcomeEmailTemplate as G, getMagicLinkTemplate as H, resolveAuthHooks as I, html as J, RawHtml as K, hashPassword as L, SMTPEmailService as M, createEmailService as N, _coercedNumber as O, assertEmailLinkBases as P, createRequireAuth as Q, validatePasswordStrength as R, createJwksRoutes as S, PUBLIC_STORAGE_PREFIX as St, _enum as T, getPasswordResetTemplate as U, getEmailVerificationTemplate as V, getUserInvitationTemplate as W, createAdapterAuthMiddleware as X, raw as Y, createAuthMiddleware as Z, createLinkedinProvider as _, orderByEntriesToTuples as _t, createSpotifyProvider as a, requireAuth as at, pkceTokenParams as b, parseQueryOptions as bt, createGitLabProvider as c, createStorageApiKeyGuard as ct, createFacebookProvider as d, extractBearerToken as dt, fileTokenAuth as et, createAppleProvider as f, safeCompare as ft, createGitHubProvider as g, isOperationAllowed as gt, verifyOidcIdToken as h, httpMethodToOperation as ht, createApiKeyStore as i, requireAdmin as it, MemoryRateLimitStore as j, DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT as k, createDiscordProvider as l, isApiKeyToken as lt, tryVerifyOidcIdToken as m, scopeDataDriver as mt, createCustomAuthAdapter as n, publicObjectAuth as nt, createSlackProvider as o, createApiKeyPreAuth as ot, createMicrosoftProvider as p, SERVICE_IDENTITY as pt, escapeHtml as q, createApiKeyRoutes as r, queryTokenAuth as rt, createBitbucketProvider as s, createFunctionApiKeyGuard as st, auth_exports as t, optionalAuth as tt, createTwitterProvider as u, validateApiKey as ut, createGoogleProvider as v, parseAggregateSelect as vt, ZodNumber as w, providerVerifiedEmail as x, resolveListLimitParam as xt, oauthCodeFlowSchema as y, parseGroupBy as yt, verifyPassword as z };
+export { createAuthMiddleware as $, _coercedNumber as A, validatePasswordStrength as B, providerVerifiedEmail as C, resolveListLimitParam as Ct, _enum as D, ZodNumber as E, createEmailService as F, getPasswordResetTemplate as G, generateSecurePassword as H, assertEmailLinkBases as I, RawHtml as J, getUserInvitationTemplate as K, resolveEmailLinkBase as L, createDataRateLimiter as M, MemoryRateLimitStore as N, object as O, SMTPEmailService as P, createAdapterAuthMiddleware as Q, resolveAuthHooks as R, pkceTokenParams as S, parseQueryOptions as St, createBuiltinAuthAdapter as T, isPublicStoragePath as Tt, getEmailVerificationTemplate as U, verifyPassword as V, getMagicLinkTemplate as W, html as X, escapeHtml as Y, raw as Z, verifyOidcIdToken as _, httpMethodToOperation as _t, resolveRateLimitStoreKind as a, queryTokenAuth as at, createGoogleProvider as b, parseAggregateSelect as bt, createSlackProvider as c, createApiKeyPreAuth as ct, createDiscordProvider as d, isApiKeyToken as dt, createRequireAuth as et, createTwitterProvider as f, validateApiKey as ft, tryVerifyOidcIdToken as g, scopeDataDriver as gt, createMicrosoftProvider as h, SERVICE_IDENTITY as ht, createApiKeyStore as i, publicObjectAuth as it, DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT as j, string as k, createBitbucketProvider as l, createFunctionApiKeyGuard as lt, createAppleProvider as m, safeCompare as mt, createCustomAuthAdapter as n, fileTokenAuth as nt, createSqlRateLimitStore as o, requireAdmin as ot, createFacebookProvider as p, extractBearerToken as pt, getWelcomeEmailTemplate as q, createApiKeyRoutes as r, optionalAuth as rt, createSpotifyProvider as s, requireAuth as st, auth_exports as t, extractUserFromToken as tt, createGitLabProvider as u, createStorageApiKeyGuard as ut, createGitHubProvider as v, isOperationAllowed as vt, createJwksRoutes as w, PUBLIC_STORAGE_PREFIX as wt, oauthCodeFlowSchema as x, parseGroupBy as xt, createLinkedinProvider as y, orderByEntriesToTuples as yt, hashPassword as z };
 
-//# sourceMappingURL=auth-BobZVd0j.js.map
+//# sourceMappingURL=auth-DIKS1rsI.js.map