@rebasepro/server 0.15.0 → 0.16.0

package/dist/index.es.js

@@ -1,13 +1,13 @@
 import { createRequire as __createRequire } from "module";
 import process from "process";
 __createRequire(import.meta.url);
-import { A as GeoPoint, M as RebaseApiError, N as RebaseClientError, O as EntityReference, S as toSnakeCase, _ as fieldKeyForColumn, b as buildCompositeId, c as collectAllPages, d as normalizeOrderBy, f as serializeOrderBy, g as getEffectiveSecurityRules, h as resolveDataSource, j as Vector, k as EntityRelation, l as paginateFind, m as createDataSourceRegistry, n as buildSdkData, o as serializeFilter, p as CollectionRegistry, s as serializeLogicalCondition, t as buildRoutedRebaseData, u as resolveFindWindow, v as findRelation, x as resolvePrimaryKeys, y as resolveCollectionRelations } from "./src-B-E7RjdN.js";
+import { A as GeoPoint, M as RebaseApiError, N as RebaseClientError, O as EntityReference, S as toSnakeCase, _ as fieldKeyForColumn, b as buildCompositeId, c as collectAllPages, d as normalizeOrderBy, f as serializeOrderBy, g as getEffectiveSecurityRules, h as resolveDataSource, j as Vector, k as EntityRelation, l as paginateFind, m as createDataSourceRegistry, n as buildSdkData, o as serializeFilter, p as CollectionRegistry, s as serializeLogicalCondition, t as buildRoutedRebaseData, u as resolveFindWindow, v as findRelation, x as resolvePrimaryKeys, y as resolveCollectionRelations } from "./src-BPfYOeN4.js";
 import { c as DEFAULT_DATA_SOURCE_KEY, g as toCanonicalOp, i as getCollectionDataPath, m as parseRelationAggregateSort, n as RLS_ROLES_SQL, o as isPostgresCollectionConfig, r as RLS_UID_SQL, t as RLS_JWT_SQL } from "./src-CrCxd8km.js";
 import { n as ADMIN_PROPERTY_KEYS, t as ADMIN_COLLECTION_KEYS } from "./admin_block-DLILvzle.js";
 import { a as isDuplicateObjectRace, i as isConcurrentDdlRace, n as createDdlBootstrapper, o as revokeInternalTableSql, s as isSQLAdmin, t as CONCURRENT_DDL_SQLSTATES } from "./ddl-bootstrap-Cywoj8Ta.js";
 import { C as canonicalStorageKey, D as findStorageSuffixCollision, E as DEFAULT_STORAGE_SOURCE_KEY, O as normalizeStorageSources, S as canonicalStorageId, b as InvalidStorageKeyError, c as getJwks, d as hasAsymmetricSigningKey, i as generateDownloadToken, k as storageEnvSuffix, n as configureJwt, p as isJwtConfigured, v as normalizePemFromEnv, x as canonicalStorageBucket, y as InvalidStorageBucketError } from "./jwt-DxH9fLPt.js";
-import { n as createContractRoutes } from "./contract-routes-DDNj4_J1.js";
-import { $ as createAuthMiddleware, A as _coercedNumber, B as validatePasswordStrength, C as providerVerifiedEmail, Ct as resolveListLimitParam, D as _enum, E as ZodNumber, F as createEmailService, G as getPasswordResetTemplate, H as generateSecurePassword, I as assertEmailLinkBases, J as RawHtml, K as getUserInvitationTemplate, L as resolveEmailLinkBase, M as createDataRateLimiter, N as MemoryRateLimitStore, O as object, P as SMTPEmailService, Q as createAdapterAuthMiddleware, R as resolveAuthHooks, S as pkceTokenParams, St as parseQueryOptions, T as createBuiltinAuthAdapter, Tt as isPublicStoragePath, U as getEmailVerificationTemplate, V as verifyPassword, W as getMagicLinkTemplate, X as html, Y as escapeHtml, Z as raw, _ as verifyOidcIdToken, _t as httpMethodToOperation, a as resolveRateLimitStoreKind, at as queryTokenAuth, b as createGoogleProvider, bt as parseAggregateSelect, c as createSlackProvider, ct as createApiKeyPreAuth, d as createDiscordProvider, dt as isApiKeyToken, et as createRequireAuth, f as createTwitterProvider, ft as validateApiKey, g as tryVerifyOidcIdToken, gt as scopeDataDriver, h as createMicrosoftProvider, ht as SERVICE_IDENTITY, i as createApiKeyStore, it as publicObjectAuth, j as DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT, k as string, l as createBitbucketProvider, lt as createFunctionApiKeyGuard, m as createAppleProvider, mt as safeCompare, n as createCustomAuthAdapter, nt as fileTokenAuth, o as createSqlRateLimitStore, ot as requireAdmin, p as createFacebookProvider, pt as extractBearerToken, q as getWelcomeEmailTemplate, r as createApiKeyRoutes, rt as optionalAuth, s as createSpotifyProvider, st as requireAuth, tt as extractUserFromToken, u as createGitLabProvider, ut as createStorageApiKeyGuard, v as createGitHubProvider, vt as isOperationAllowed, w as createJwksRoutes, wt as PUBLIC_STORAGE_PREFIX, x as oauthCodeFlowSchema, xt as parseGroupBy, y as createLinkedinProvider, yt as orderByEntriesToTuples, z as hashPassword } from "./auth-DIKS1rsI.js";
+import { n as createContractRoutes, r as computeSchemaVersion } from "./contract-routes-DZ-LBpSL.js";
+import { $ as createAdapterAuthMiddleware, A as _coercedNumber, B as validatePasswordStrength, C as providerVerifiedEmail, Ct as parseQueryOptions, D as _enum, E as ZodNumber, Et as isPublicStoragePath, F as createEmailService, G as getPasswordResetTemplate, H as generateSecurePassword, I as assertEmailLinkBases, J as resolveEmailBranding, K as getUserInvitationTemplate, L as resolveEmailLinkBase, M as createDataRateLimiter, N as MemoryRateLimitStore, O as object, P as SMTPEmailService, Q as raw, R as resolveAuthHooks, S as pkceTokenParams, St as parseGroupBy, T as createBuiltinAuthAdapter, Tt as PUBLIC_STORAGE_PREFIX, U as getEmailVerificationTemplate, V as verifyPassword, W as getMagicLinkTemplate, X as escapeHtml, Y as RawHtml, Z as html, _ as verifyOidcIdToken, _t as scopeDataDriver, a as resolveRateLimitStoreKind, at as publicObjectAuth, b as createGoogleProvider, bt as orderByEntriesToTuples, c as createSlackProvider, ct as requireAuth, d as createDiscordProvider, dt as createStorageApiKeyGuard, et as createAuthMiddleware, f as createTwitterProvider, ft as isApiKeyToken, g as tryVerifyOidcIdToken, gt as SERVICE_IDENTITY, h as createMicrosoftProvider, ht as safeCompare, i as createApiKeyStore, it as optionalAuth, j as DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT, k as string, l as createBitbucketProvider, lt as createApiKeyPreAuth, m as createAppleProvider, mt as extractBearerToken, n as createCustomAuthAdapter, nt as extractUserFromToken, o as createSqlRateLimitStore, ot as queryTokenAuth, p as createFacebookProvider, pt as validateApiKey, q as getWelcomeEmailTemplate, r as createApiKeyRoutes, rt as fileTokenAuth, s as createSpotifyProvider, st as requireAdmin, tt as createRequireAuth, u as createGitLabProvider, ut as createFunctionApiKeyGuard, v as createGitHubProvider, vt as httpMethodToOperation, w as createJwksRoutes, wt as resolveListLimitParam, x as oauthCodeFlowSchema, xt as parseAggregateSelect, y as createLinkedinProvider, yt as isOperationAllowed, z as hashPassword } from "./auth-5Et5mnUA.js";
 import { t as logger } from "./logger-DfvF_8r-.js";
 import { n as errorHandler, t as ApiError } from "./errors-EBYiaJ2E.js";
 import { t as logMiddleware } from "./logs-routes-CWBLQj2l.js";
@@ -19,9 +19,9 @@ import { t as createFunctionRoutes } from "./function-routes-Btcez1T-.js";
 import { n as loadCronJobsFromDirectory, r as loadCronJobsWithDiagnostics } from "./cron-loader-YhhQeVBM.js";
 import { r as validateCronExpression, t as CronScheduler } from "./cron-scheduler-DIpYBmZP.js";
 import { t as createCronRoutes } from "./cron-routes-maM_RlUu.js";
-import { t as createCronStore } from "./cron-store-BBGvOA-9.js";
+import { t as createCronStore } from "./cron-store-DfH_4Cd9.js";
 import { a as parseBackupTimestamp, i as parseBackupDestination, n as createBackupRoutes, o as readBackupBytes, r as listBackupObjects } from "./backup-C6ljYVTp.js";
-import { i as createJobStore, n as createJobQueue, r as defaultBackoff } from "./jobs-BOEOIGAm.js";
+import { i as createJobStore, n as createJobQueue, r as defaultBackoff } from "./jobs-CyOKXXlu.js";
 import { t as FunctionSelectionError } from "./selection-_z6TM1DB.js";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import * as fs$2 from "fs";
@@ -607,22 +607,56 @@ function compareVersions(a, b) {
 	return left.prerelease < right.prerelease ? -1 : 1;
 }
 /**
+* Does `version` lead `against` by at least a minor?
+*
+* Compares the `(major, minor)` pair and ignores the patch, which is the whole
+* point: it separates "pinned one fix ahead", a supported and deliberate thing,
+* from "built against a framework this image predates". Pre-1.0 the minor is the
+* breaking-change axis, so the same tuple comparison is right on both sides of
+* 1.0 without a special case.
+*
+* `undefined` when either version is unparseable, so the caller declines to
+* judge rather than guessing.
+*/
+function leadsByMinorOrMore(version, against) {
+	const left = parseVersion(version);
+	const right = parseVersion(against);
+	if (!left || !right) return void 0;
+	if (left.parts[0] !== right.parts[0]) return left.parts[0] > right.parts[0];
+	return left.parts[1] > right.parts[1];
+}
+/**
 * Describe how a driver's version relates to the runtime asking it for work.
 *
-* Returns `stale: false` whenever it cannot tell — an unknown version, an
-* unparseable one, a driver that is newer. Silence beats a confident wrong
-* diagnosis, and the caller still prints its own local fact either way.
+* Both directions are reportable, for opposite reasons. A driver **behind** the
+* runtime lacks capabilities the runtime will ask for, and reports their absence
+* in language indistinguishable from a driver that never had them. A driver
+* **ahead** by a minor carries half of a feature whose other half lives in
+* `@rebasepro/server` — and the image supplies that half, so the bundle's code
+* runs against a harness that does not know about it.
+*
+* Returns both flags false whenever it cannot tell: an unknown version, an
+* unparseable one, or a gap too small to mean anything. Silence beats a
+* confident wrong diagnosis, and the caller still prints its own local fact.
 */
 function describeDriverSkew(driverVersion, runtimeVersion) {
-	if (!driverVersion || !runtimeVersion) return { stale: false };
+	if (!driverVersion || !runtimeVersion) return {
+		stale: false,
+		ahead: false
+	};
 	const order = compareVersions(driverVersion, runtimeVersion);
-	if (order === void 0) return { stale: false };
+	if (order === void 0) return {
+		stale: false,
+		ahead: false
+	};
 	if (order < 0) return {
 		stale: true,
+		ahead: false,
 		detail: `The driver is at ${driverVersion} while this runtime is ${runtimeVersion} — the driver is OLDER, so this is very likely a stale pin rather than a driver that never had the capability.`
 	};
 	return {
 		stale: false,
+		ahead: leadsByMinorOrMore(driverVersion, runtimeVersion) === true,
 		detail: `Driver ${driverVersion}, runtime ${runtimeVersion}.`
 	};
 }
@@ -866,6 +900,198 @@ function provisionTargetFor(bootstrappers, adapter, driverResult) {
 	};
 }
 //#endregion
+//#region src/boot/schema-stamp.ts
+/**
+* Does the schema in the database match the collections this process was built
+* from?
+*
+* A split deployment can run several processes from one bundle, and — once a
+* deployment can pin them to *different* bundles — from more than one. They all
+* share one database, and only one of them provisions it. So a process can come
+* up perfectly, pass every probe, and query a column the schema owner has not
+* created yet, or rely on a policy it has not applied. Neither fails in a way
+* anybody sees: the first is a SQL error on one route, the second is a 200 with
+* zero rows.
+*
+* The check is a stamp. The process that provisions writes the version of the
+* collections it just applied into the database; every process compares its own
+* against what it finds. Same table, same shape and the same "unstamped is not
+* an error" rule as the auth schema version, which exists for exactly this class
+* of failure one subsystem over.
+*
+* ## Why the database and not the api
+*
+* The obvious design is an HTTP call to the api's `/api/meta/schema-version`.
+* It is worse in three ways. It needs the api's address configured on every
+* other process, so it adds a variable whose absence disables the check
+* silently. It makes booting depend on another process already being up, which
+* turns a rollout ordering problem into a boot failure. And it asks the wrong
+* question: what breaks is the *database* not matching, and two processes can
+* agree with each other while both disagree with it.
+*
+* The database is also the only answer that works for a `worker`, which has no
+* reason to know any URL, and for a single `all` deployment scaled to three,
+* where there is no api to ask.
+*
+* ## Why both sides compute rather than read
+*
+* Both the stamp and the comparison are computed from the collections the
+* process actually loaded, never from the `schemaVersion` a bundle manifest
+* declares. A declared value is not evidence: `/api/meta/schema-version` returns
+* the manifest's own number verbatim when the bundle has one, which is why
+* comparing that endpoint to that manifest is a check that passes on a bundle
+* whose declared version is nonsense — verified, once, on a fixture corrupted to
+* `v1:deadbeefdeadbeef`. Computing on both sides means the comparison is between
+* two things that were derived, so agreeing means something.
+*
+* ## A driver that predates this
+*
+* The image supplies `@rebasepro/server`; the *driver* comes from the bundle,
+* pinned to whatever the project's package.json asked npm for. So a current
+* runtime routinely runs against a driver older than itself, and that driver has
+* neither hook. Absence is treated as "this driver does not record a version" —
+* the same answer as a driver that never will — and the check silently does
+* nothing rather than failing a boot over a capability the deployment cannot
+* supply. It starts working when the project's driver is next updated. See
+* `version-skew.ts` for the general shape of this problem.
+*/
+/**
+* Compare, without acting.
+*
+* Separated from {@link enforceSchemaStamp} because the decision is the part
+* worth testing and the part that is wrong in a way nobody sees. Every branch
+* here has a test.
+*/
+function decideSchemaStamp(input) {
+	if (input.supported === false) return {
+		status: "skipped",
+		reason: "this driver does not record a collections schema version"
+	};
+	if (input.introspecting) return {
+		status: "skipped",
+		reason: "collections are derived from the database, so they cannot disagree with it"
+	};
+	if (input.databaseVersion === null) return { status: "unstamped" };
+	if (input.databaseVersion === input.processVersion) return {
+		status: "match",
+		version: input.processVersion
+	};
+	return {
+		status: "mismatch",
+		database: input.databaseVersion,
+		process: input.processVersion
+	};
+}
+/**
+* A refusal to serve against a schema this process does not match.
+*
+* Its own class so the boot paths can present it as a configuration problem
+* rather than a crash, matching `RoleConfigurationError`.
+*/
+var SchemaVersionMismatchError = class extends Error {
+	databaseVersion;
+	processVersion;
+	constructor(databaseVersion, processVersion, message) {
+		super(message);
+		this.databaseVersion = databaseVersion;
+		this.processVersion = processVersion;
+		this.name = "SchemaVersionMismatchError";
+	}
+};
+/**
+* Read the policy from the environment.
+*
+* Warning is the default because refusing would fail a rollout *mid-flight*: for
+* the whole window between the schema owner rolling and the last unit following,
+* the units that have not rolled yet legitimately disagree. That window is
+* normal, and a deployment that turns it into a crash loop has traded a silent
+* problem for a loud outage.
+*
+* `refuse` is for the deployment that would rather not serve at all than serve
+* wrong — and for CI, where the window does not exist.
+*/
+function resolveSchemaMismatchPolicy(env = process.env) {
+	const raw = (env.REBASE_REQUIRE_SCHEMA_MATCH ?? "").trim().toLowerCase();
+	return raw === "true" || raw === "1" ? "refuse" : "warn";
+}
+/**
+* The message a mismatch prints, or throws.
+*
+* One function so the warning and the refusal say exactly the same thing — an
+* operator who raises the policy from `warn` to `refuse` should not have to
+* learn a second description of the same fact.
+*/
+function describeMismatch(databaseVersion, processVersion) {
+	return `The database was last provisioned from a different set of collections than this process was built from (database ${databaseVersion}, this process ${processVersion}).\n  A process running ahead of the schema queries columns that do not exist yet, and relies on RLS policies that have not been applied —\n  the first is a SQL error on one route, the second is an empty result with a 200. A process running behind is normal during a rollout.\n  Roll the process that owns the schema first (REBASE_ROLE=api, or the migration Job), then the rest. Set REBASE_REQUIRE_SCHEMA_MATCH=true to refuse the boot instead of warning.`;
+}
+/**
+* Stamp, or compare and report.
+*
+* The provisioning process writes; everyone else reads. A process that both
+* provisions and would compare has nothing to compare against — it is the
+* authority — so it stamps and returns.
+*
+* Every failure to read or write is swallowed with a warning rather than
+* propagated. This check exists to make a silent problem visible; letting it
+* take down a boot it was only supposed to describe would be a strictly worse
+* trade, and a database that refuses one small write is already telling the
+* operator something through other channels.
+*/
+async function enforceSchemaStamp(options) {
+	const { collections, read, stamp, provisioned, introspecting } = options;
+	if (introspecting) return {
+		status: "skipped",
+		reason: "collections are derived from the database, so they cannot disagree with it"
+	};
+	if (!read && !stamp) return {
+		status: "skipped",
+		reason: "this driver does not record a collections schema version"
+	};
+	const processVersion = computeSchemaVersion(collections);
+	if (provisioned) {
+		if (!stamp) return {
+			status: "skipped",
+			reason: "this driver cannot record a collections schema version"
+		};
+		try {
+			await stamp(processVersion);
+			logger.debug(`🔖 [schema] Stamped the collections schema version: ${processVersion}`);
+		} catch (error) {
+			logger.warn("⚠️ [schema] Could not record the collections schema version. Other processes cannot check themselves against this database until one boots that can.", { error });
+		}
+		return {
+			status: "match",
+			version: processVersion
+		};
+	}
+	if (!read) return {
+		status: "skipped",
+		reason: "this driver cannot read a collections schema version"
+	};
+	let databaseVersion;
+	try {
+		databaseVersion = await read();
+	} catch (error) {
+		logger.warn("⚠️ [schema] Could not read the collections schema version from the database.", { error });
+		return {
+			status: "skipped",
+			reason: "the stamp could not be read"
+		};
+	}
+	const verdict = decideSchemaStamp({
+		processVersion,
+		databaseVersion,
+		introspecting
+	});
+	if (verdict.status === "unstamped") logger.debug("🔖 [schema] This database carries no collections schema version yet — it will be stamped by the process that provisions it.");
+	else if (verdict.status === "mismatch") {
+		const message = describeMismatch(verdict.database, verdict.process);
+		if ((options.policy ?? "warn") === "refuse") throw new SchemaVersionMismatchError(verdict.database, verdict.process, message);
+		logger.warn(`⚠️ [schema] ${message}`);
+	}
+	return verdict;
+}
+//#endregion
 //#region src/services/driver-registry.ts
 /**
 * The default driver identifier used when:
@@ -3947,7 +4173,7 @@ function assertStorageAccessControlConfigured(state, isProduction) {
 */
 async function mountOpenApiDocs(app, basePath, enableSwagger, serverCollections, requireAuth) {
 	if (enableSwagger === false || serverCollections.length === 0) return;
-	const { generateOpenApiSpec } = await import("./openapi-generator-DLiiGD9X.js");
+	const { generateOpenApiSpec } = await import("./openapi-generator-BCKJRUS4.js");
 	app.get(`${basePath}/docs`, (c) => {
 		const spec = generateOpenApiSpec(serverCollections, {
 			basePath,
@@ -4137,7 +4363,8 @@ var ALL_RUNTIME_SURFACES = [
 	"admin",
 	"functions",
 	"cron",
-	"meta"
+	"meta",
+	"realtime"
 ];
 /**
 * Resolve a partial surface set against the default, which is everything on.
@@ -10207,7 +10434,7 @@ function _resetRebaseMock() {
 * It clears the default policies through their `rolesOverlap(['admin'])` arm —
 * which is why the difference rarely shows. It shows when you write your own:
 *
-* - `policy.serverContext()` compiles to `auth.uid() IS NULL` and is therefore
+* - `policy.serverContext()` compiles to `rebase.uid() IS NULL` and is therefore
 *   **false** for this accessor. A collection with `disableDefaultPolicies:
 *   true` whose rule is `serverContext()` denies these writes (`42501`) and
 *   returns zero rows — HTTP 200, empty — for these reads.
@@ -10342,6 +10569,8 @@ function wrapDatabaseAdapter(dbAdapter) {
 		initializeWebsockets: dbAdapter.initializeWebsockets,
 		ensureCollectionSchema: dbAdapter.ensureCollectionSchema ? (collections, driverResult, log) => dbAdapter.ensureCollectionSchema(collections, driverResult, log) : void 0,
 		ensureCollectionPolicies: dbAdapter.ensureCollectionPolicies ? (collections, driverResult, log) => dbAdapter.ensureCollectionPolicies(collections, driverResult, log) : void 0,
+		readCollectionsSchemaVersion: dbAdapter.readCollectionsSchemaVersion ? (driverResult) => dbAdapter.readCollectionsSchemaVersion(driverResult) : void 0,
+		stampCollectionsSchemaVersion: dbAdapter.stampCollectionsSchemaVersion ? (version, driverResult) => dbAdapter.stampCollectionsSchemaVersion(version, driverResult) : void 0,
 		getAdmin: dbAdapter.getAdmin,
 		mountRoutes: dbAdapter.mountRoutes
 	};
@@ -10413,6 +10642,10 @@ async function _initializeRebaseBackend(config) {
 			schemaProvisioning: {
 				attempted: schemaOutcome.status === "applied",
 				reason: schemaOutcome.status === "skipped" ? schemaOutcome.reason : void 0
+			},
+			realtime: {
+				subscribe: surfaces.realtime,
+				provision: config.provisionSchema ?? true
 			}
 		});
 		delegates[b.id || bootstrapper.type] = driverResult.driver;
@@ -10503,10 +10736,18 @@ async function _initializeRebaseBackend(config) {
 			logger.info("Authentication initialized");
 		} else logger.warn("Auth requested but default bootstrapper does not support initializeAuth");
 	}
-	await provisionCollectionPolicies(provisionable, provisionTarget, {
+	const policyOutcome = await provisionCollectionPolicies(provisionable, provisionTarget, {
 		introspecting: introspectCollections,
 		provision: config.provisionSchema ?? true
 	});
+	await enforceSchemaStamp({
+		collections: provisionable,
+		provisioned: schemaOutcome.status === "applied" && policyOutcome.status === "applied",
+		introspecting: introspectCollections,
+		policy: resolveSchemaMismatchPolicy(),
+		read: provisionTarget.bootstrapper.readCollectionsSchemaVersion ? () => provisionTarget.bootstrapper.readCollectionsSchemaVersion(provisionTarget.driverResult) : void 0,
+		stamp: provisionTarget.bootstrapper.stampCollectionsSchemaVersion ? (version) => provisionTarget.bootstrapper.stampCollectionsSchemaVersion(version, provisionTarget.driverResult) : void 0
+	});
 	let historyConfigResult = void 0;
 	if (config.history) if (defaultBootstrapper.initializeHistory) {
 		logger.debug("Bootstrapping entity history via driver protocol");
@@ -10624,7 +10865,7 @@ async function _initializeRebaseBackend(config) {
 			]) {
 				const providerConfig = safeAuthConfig[key];
 				if (providerConfig && requiredFields.every((f) => Boolean(providerConfig[f]))) {
-					const createFn = (await import("./auth-DIKS1rsI.js").then((n) => n.t))[factory];
+					const createFn = (await import("./auth-5Et5mnUA.js").then((n) => n.t))[factory];
 					oauthProviders.push(createFn(providerConfig));
 				}
 			}
@@ -10964,7 +11205,7 @@ async function _initializeRebaseBackend(config) {
 		const { loadCronJobsWithDiagnostics } = await import("./cron-loader-YhhQeVBM.js").then((n) => n.t);
 		const { CronScheduler } = await import("./cron-scheduler-DIpYBmZP.js").then((n) => n.n);
 		const { createCronRoutes } = await import("./cron-routes-maM_RlUu.js").then((n) => n.n);
-		const { createCronStore } = await import("./cron-store-BBGvOA-9.js").then((n) => n.n);
+		const { createCronStore } = await import("./cron-store-DfH_4Cd9.js").then((n) => n.n);
 		const { jobs: loadedCronJobs, problems: cronProblems } = await loadCronJobsWithDiagnostics(config.cronsDir);
 		cronScheduler = new CronScheduler();
 		cronScheduler.setClient(serverSingleton);
@@ -10994,7 +11235,7 @@ async function _initializeRebaseBackend(config) {
 	}
 	let jobQueue;
 	if (config.jobs?.enabled) {
-		const { createJobStore, createJobQueue } = await import("./jobs-BOEOIGAm.js").then((n) => n.t);
+		const { createJobStore, createJobQueue } = await import("./jobs-CyOKXXlu.js").then((n) => n.t);
 		const store = createJobStore(defaultDriver);
 		if (store) {
 			await store.ensureTable();
@@ -11028,7 +11269,7 @@ async function _initializeRebaseBackend(config) {
 		logger.debug("Logs routes mounted", { path: `${basePath}/logs` });
 	}
 	if (surfaces.meta) {
-		const { createContractRoutes } = await import("./contract-routes-DDNj4_J1.js").then((n) => n.t);
+		const { createContractRoutes } = await import("./contract-routes-DZ-LBpSL.js").then((n) => n.t);
 		const contractRouter = new Hono();
 		if (adminSurfacesGated) {
 			if (apiKeyPreAuth) contractRouter.use("/contract", apiKeyPreAuth);
@@ -11053,7 +11294,7 @@ async function _initializeRebaseBackend(config) {
 		defaultKey: defaultDriverId,
 		resolveKey: keyForCollectionPath
 	}) : defaultRealtimeService;
-	if (defaultBootstrapper.initializeWebsockets && effectiveRealtimeService) await defaultBootstrapper.initializeWebsockets(config.server, effectiveRealtimeService, defaultDriver, config.auth, authAdapter);
+	if (surfaces.realtime && defaultBootstrapper.initializeWebsockets && effectiveRealtimeService) await defaultBootstrapper.initializeWebsockets(config.server, effectiveRealtimeService, defaultDriver, config.auth, authAdapter);
 	logger.debug("Rebase Backend Initialized");
 	const authSchemaCheck = authConfigResult?.schemaHealthCheck;
 	const healthCheck = createHealthCheck(defaultDriver, authSchemaCheck ? () => authSchemaCheck.call(authConfigResult) : void 0);
@@ -11159,7 +11400,7 @@ function defineFunction(definition) {
 * against that identity, not skipped. See that constant's docblock. It clears
 * the default policies through their `rolesOverlap(['admin'])` arm, which is why
 * the distinction rarely shows; it shows against hand-written rules, where
-* `policy.serverContext()` (`auth.uid() IS NULL`) is **false** for it. Use
+* `policy.serverContext()` (`rebase.uid() IS NULL`) is **false** for it. Use
 * `rebase.sql()` when you need the genuine bypass — owner connection, no
 * policies.
 *
@@ -12040,6 +12281,49 @@ function isAssetRequest(requestPath, destination) {
 	return ASSET_EXTENSIONS.has(lastSegment.slice(dot + 1).toLowerCase());
 }
 /**
+* Does this filename carry a content hash, and may it therefore be cached forever?
+*
+* The two answers a build needs are opposites, and picking wrong in either
+* direction is a real bug. A hashed chunk (`index-vgugiqRO.js`) can be
+* `immutable` for a year because a new build gives it a new URL. `index.html`
+* cannot be cached at all: it is the document naming those hashed chunks, so a
+* cached copy pins a tab to the previous deploy's filenames, which the new build
+* no longer contains — the page dies on a 404 for a chunk, and the user has no
+* way to know a reload is what they need.
+*
+* Erring toward "not hashed" is therefore the safe direction: the cost is a
+* revalidation that usually answers 304, against serving a year-stale file with
+* no way to recall it. So this demands positive evidence of a hash rather than
+* assuming one — a segment of 8+ characters after the last `-` that is not
+* ordinary lowercase prose. Vite and Rollup emit base64url digests, which
+* essentially always carry a digit or a capital; a hand-written
+* `vendor-analytics.js` does not, and gets revalidated.
+*
+* Deliberately not "everything under /assets/": that is a Vite convention, not a
+* guarantee, and a build that drops an unhashed file there would have it pinned
+* in every visitor's cache for a year with no way to correct it.
+*/
+function isContentHashed(requestPath) {
+	const lastSegment = requestPath.slice(requestPath.lastIndexOf("/") + 1);
+	const dot = lastSegment.lastIndexOf(".");
+	if (dot <= 0) return false;
+	const stem = lastSegment.slice(0, dot);
+	const dash = stem.lastIndexOf("-");
+	if (dash < 0) return false;
+	const suffix = stem.slice(dash + 1);
+	if (suffix.length < 8) return false;
+	if (!/^[A-Za-z0-9_-]+$/.test(suffix)) return false;
+	return /[0-9A-Z]/.test(suffix);
+}
+/** A year, and never revalidated: the URL changes when the bytes do. */
+var IMMUTABLE_CACHE = "public, max-age=31536000, immutable";
+/**
+* Store it, but check before using it. Not `no-store`: revalidation answers 304
+* on an unchanged document, which is cheaper than re-sending it, and correctness
+* here needs freshness rather than absence.
+*/
+var REVALIDATE_CACHE = "no-cache";
+/**
 * Serve a Single Page Application from an Hono app.
 *
 * @internal Not part of the stable public API. Exported only because the
@@ -12060,6 +12344,12 @@ function serveSPA(app, config) {
 		return;
 	}
 	const scope = isRoot ? "/*" : `${basePath}/*`;
+	app.use(scope, async (c, next) => {
+		await next();
+		if (c.res.headers.has("cache-control")) return;
+		if (c.res.status !== 200) return;
+		c.header("Cache-Control", isContentHashed(c.req.path) ? IMMUTABLE_CACHE : REVALIDATE_CACHE);
+	});
 	app.use(scope, responseCompression());
 	app.use(scope, serveStatic({
 		root: path$2.relative(process.cwd(), frontendPath),
@@ -12386,6 +12676,19 @@ var bootEnvExtension = object({
 	SMTP_NAME: string().optional(),
 	APP_NAME: string().default("Rebase"),
 	/**
+	* Logo shown above the card in the default email templates, at 48x48.
+	*
+	* Must be a PNG or JPG on an absolute `http(s)` URL: mail clients do not
+	* render SVG and block `data:` URIs, and the image is fetched by the
+	* recipient's client rather than by this process. Anything else renders no
+	* logo rather than a broken image — see `resolveEmailBranding`.
+	*
+	* Left unset, an app that still answers to the default `APP_NAME` gets the
+	* Rebase mark and one that has renamed itself gets nothing. This is the only
+	* way a managed tenant, which ships no code of its own, can set its own.
+	*/
+	EMAIL_LOGO_URL: string().optional(),
+	/**
 	* Serve the bundle's static/admin assets from this process.
 	*
 	* Default on, because a self-hosted single-container deployment is the case
@@ -12400,13 +12703,24 @@ var bootEnvExtension = object({
 	/**
 	* What the runtime may do to the database schema at boot.
 	*
-	* - `none` (default in production) — touch nothing. Schema changes are a
-	*   deliberate, reviewable step, not a side effect of a restart.
-	* - `ensure` — create the auth/system tables if missing, never touch
-	*   collection tables. The default outside production.
-	* - `push` — reconcile collection tables with the bundle's schema. Convenient
-	*   for a local compose stack; in production it means a container restart can
-	*   rewrite the schema, so it must be asked for explicitly.
+	* - `none` — touch nothing. The schema is provisioned by something else: a
+	*   migration step, or another process in a split deployment.
+	* - anything else, **including unset** — run the additive provisioning pass
+	*   in `boot/provision.ts`: create missing tables, columns and enum types,
+	*   never drop or rewrite one.
+	*
+	* The default is `ensure` everywhere, production included — see
+	* `provisioningDisabled`, which is the single place the value is read and
+	* which only asks whether it is `none`.
+	*
+	* `push` is in the enum and is **not** distinguished from `ensure` anywhere
+	* in the boot path; nothing implements "reconcile destructively" here. The
+	* published image goes further and refuses to start on it
+	* (`docker/entrypoint.mjs`), because a full push computes a diff and will
+	* happily `DROP COLUMN` — and a container restart must never be able to
+	* destroy a production column as a side effect of rescheduling. Reshaping
+	* and destructive changes stay a deliberate `rebase db generate` + `rebase
+	* db migrate`, or a reviewed `rebase db push` from a checkout.
 	*/
 	REBASE_MIGRATE_ON_BOOT: _enum([
 		"none",
@@ -12477,8 +12791,13 @@ var bootEnvExtension = object({
 	*
 	* Deliberately tri-state, and resolved against NODE_ENV by
 	* {@link resolveEnableSwagger} rather than defaulted here. Unset means "on
-	* in development, off in production" — an explicit `true` or `false` always
-	* wins in both.
+	* in development, off in production"; `false` turns both off anywhere.
+	*
+	* `true` in production is only half a switch, and the asymmetry is in
+	* `init/docs.ts` rather than here: the *spec* at `/api/docs` is served
+	* whenever this is not `false`, but the Swagger *UI* at `/api/swagger` is
+	* gated on `NODE_ENV !== "production"` independently and this variable
+	* cannot open it.
 	*
 	* It used to default to `"false"` outright, which reads as a safe default
 	* and was not one: the runtime is how every scaffolded project boots, so
@@ -12673,6 +12992,13 @@ var RoleConfigurationError = class extends Error {
 * and sets `REBASE_CRON_SCHEDULER=false` on the api. `functions` runs no timers
 * at all — a function process is scaled by request load and replaced at will, so
 * giving it scheduled work would make its replica count mean something.
+*
+* `realtime` is off for the same two, and it is the surface whose cost is paid
+* whether or not anyone calls it: a process that consumes change events holds a
+* dedicated `LISTEN` connection outside the pool for as long as it runs, and
+* only a process serving websockets has anybody to deliver to. Writes made *by*
+* these processes are still heard — capture is database triggers, so a change is
+* published by the database rather than by whichever pod made it.
 */
 var ROLES = {
 	all: {
@@ -12692,7 +13018,8 @@ var ROLES = {
 			storage: false,
 			admin: false,
 			cron: false,
-			meta: false
+			meta: false,
+			realtime: false
 		},
 		ownership: {
 			cronScheduler: false,
@@ -12708,7 +13035,8 @@ var ROLES = {
 			admin: false,
 			functions: false,
 			cron: false,
-			meta: false
+			meta: false,
+			realtime: false
 		},
 		ownership: {},
 		provisionSchema: false
@@ -13116,6 +13444,8 @@ function adapterToBootstrapper(adapter, id, isDefault) {
 		initializeWebsockets: adapter.initializeWebsockets,
 		ensureCollectionSchema: adapter.ensureCollectionSchema ? (collections, driverResult, log) => adapter.ensureCollectionSchema(collections, driverResult, log) : void 0,
 		ensureCollectionPolicies: adapter.ensureCollectionPolicies ? (collections, driverResult, log) => adapter.ensureCollectionPolicies(collections, driverResult, log) : void 0,
+		readCollectionsSchemaVersion: adapter.readCollectionsSchemaVersion ? (driverResult) => adapter.readCollectionsSchemaVersion(driverResult) : void 0,
+		stampCollectionsSchemaVersion: adapter.stampCollectionsSchemaVersion ? (version, driverResult) => adapter.stampCollectionsSchemaVersion(version, driverResult) : void 0,
 		getAdmin: adapter.getAdmin,
 		mountRoutes: adapter.mountRoutes
 	};
@@ -13194,6 +13524,7 @@ function resolveEmailOptions(env) {
 			name: env.SMTP_NAME
 		},
 		appName: env.APP_NAME,
+		logoUrl: env.EMAIL_LOGO_URL,
 		resetPasswordUrl: env.FRONTEND_URL
 	};
 }
@@ -13938,17 +14269,37 @@ async function runFromBundle(options = {}) {
 * driver. Nothing detected that before this: the halves simply disagreed in
 * silence until some capability turned out to be missing three layers down.
 *
-* A warning rather than a refusal. Old drivers are usually fine — the pairing is
+* A warning rather than a refusal. Either pairing can be fine — both are
 * supported, and a boot that dies on version arithmetic would be a far worse
 * failure than the drift it is guarding against. This only has to make the skew
 * *visible*, so that the next person reading the log starts from the right
 * question.
+*
+* ## Both directions, because only one of them was ever reported
+*
+* A driver *behind* the runtime was the original case: the platform ships a fix,
+* every tenant rolls onto the new image, and none of them run the fixed driver.
+*
+* A driver *ahead* by a minor is the mirror image and was silent until it cost
+* another day. It is not the deliberate pin this check used to assume — that is
+* a patch bump, and still says nothing. It is what a floating runtime range
+* produces when the image lags: a bundle built against a framework the image
+* predates, so a feature split across `@rebasepro/server` and the driver has
+* only its driver half present. Nothing errors. The half that landed reads
+* config the older harness never sets, defaults it, and a subsystem — realtime
+* channels, in the case that prompted this — is inert in a process that passes
+* every probe. The fix is the opposite of the stale case, which is exactly why
+* the two need separate sentences: bump the *image*, not the package.json.
 */
 function warnOnDriverSkew(dataSources, runtimeVersion) {
 	if (!runtimeVersion) return;
 	for (const source of dataSources) {
-		if (!describeDriverSkew(source.driverVersion, runtimeVersion).stale) continue;
-		logger.warn(`Driver version skew on data source "${source.key}": "${source.driverPackage}" is at ${source.driverVersion}, this runtime is ${runtimeVersion}. A driver is installed from your bundle's dependencies, NOT supplied by the platform image, so a newer runtime does not update it. Capabilities added after ${source.driverVersion} are unavailable to this deployment — bump "${source.driverPackage}" in your project's package.json and redeploy.`);
+		const skew = describeDriverSkew(source.driverVersion, runtimeVersion);
+		if (skew.stale) {
+			logger.warn(`Driver version skew on data source "${source.key}": "${source.driverPackage}" is at ${source.driverVersion}, this runtime is ${runtimeVersion}. A driver is installed from your bundle's dependencies, NOT supplied by the platform image, so a newer runtime does not update it. Capabilities added after ${source.driverVersion} are unavailable to this deployment — bump "${source.driverPackage}" in your project's package.json and redeploy.`);
+			continue;
+		}
+		if (skew.ahead) logger.warn(`Driver version skew on data source "${source.key}": "${source.driverPackage}" is at ${source.driverVersion}, this runtime is ${runtimeVersion}. The driver is AHEAD of the platform image by a minor or more. Your bundle supplies the driver while the image supplies \`@rebasepro/server\`, so a feature spanning both packages has only its driver half running here — the other half is missing, and the usual symptom is a subsystem that is silently inert rather than one that errors. Deploy a newer platform image (or pin the runtime version), or pin "${source.driverPackage}" back to ${runtimeVersion} in your project's package.json.`);
 	}
 }
 /**
@@ -13971,6 +14322,6 @@ function warnOnUnusableBundleShape(bundle) {
 	logger.warn(`This bundle declares a config package at "${bundle.manifest.entry.config}", but no collections directory resolved inside it, so no collections were loaded and no tables will be created. Rebuild with \`rebase build\` and check the manifest's \`entry.collections\`.`);
 }
 //#endregion
-export { ApiError, BlockedUrlError, BundleError, CONCURRENT_DDL_SQLSTATES, CronScheduler, DEFAULT_DRIVER_ID, DEFAULT_MAX_FILE_SIZE, DEFAULT_STORAGE_ID, DOCUMENT_MIME_TYPES, DefaultDriverRegistry, DefaultStorageRegistry, GCSStorageController, IMAGE_MIME_TYPES, LocalStorageController, MetricsRegistry, RawHtml, S3StorageController, SMTPEmailService, TransformCache, TusHandler, UnknownStorageSourceError, WEBHOOK_DELIVERY_TASK, WebhookDispatcher, _resetRebaseMock, _setRebaseMock, applyCollectionDefaults, assertAllowedOutboundUrl, assertCollectionConfigs, assertDistinctSuffixes, assertEmailLinkBases, assertWriteRequestValid, authJwt, authRoles, authUid, blockedAddressReason, bootFromBundle, classifySurface, cleanupDevPortFile, createAppleProvider, createBackupRoutes, createBitbucketProvider, createBuiltinAuthAdapter, createContractRoutes, createCronRoutes, createCronStore, createCustomAuthAdapter, createDdlBootstrapper, createDiscordProvider, createEmailService, createFacebookProvider, createFunctionRoutes, createGitHubProvider, createGitLabProvider, createGoogleProvider, createHistoryRoutes, createJobQueue, createJobStore, createJwksRoutes, createLinkedinProvider, createMetricsMiddleware, createMetricsRoutes, createMicrosoftProvider, createSlackProvider, createSourceBundle, createSpotifyProvider, createStorageController, createStorageRoutes, createTwitterProvider, defaultBackoff, defineCron, defineFunction, envSuffixForKey, errorHandler, escapeHtml, extractUserFromToken, fileTokenAuth, findCollectionConfigProblems, generateSecurePassword, getEmailVerificationTemplate, getJwks, getMagicLinkTemplate, getPasswordResetTemplate, getUserInvitationTemplate, getWelcomeEmailTemplate, hasAsymmetricSigningKey, hashPassword, html, httpMethodToOperation, initializeDataSource, initializeDataSources, initializeRebaseBackend, installShutdownHandlers, isApiKeyToken, isAuthAdapter, isConcurrentDdlRace, isDatabaseAdapter, isDuplicateObjectRace, isLocalhostOrigin, isOperationAllowed, isTransformableImage, listBackupObjects, listenWithPortRetry, loadBootEnv, loadBundle, loadBundleConfigExports, loadBundleSchema, loadCollectionsFromDirectory, loadCronJobsFromDirectory, loadCronJobsWithDiagnostics, loadDeclaredStorageSources, loadEnv, loadFunctionsFromDirectory, loadUsersCollection, logger, oauthCodeFlowSchema, optionalAuth, parseBackupDestination, parseBackupTimestamp, parseTransformOptions, pkceTokenParams, providerVerifiedEmail, queryTokenAuth, raw, readBackupBytes, readBundleManifest, rebase, requireAdmin, requireAuth, resolveAuthHooks, resolveAuthOptions, resolveCorsOrigin, resolveDataSources, resolveEmailLinkBase, resolveEmailOptions, resolveRequireAuth, resolveStorageBackend, resolveStorageSources, runFromBundle, safeCompare, serveSPA, transformImage, tryVerifyOidcIdToken, unknownKeyPolicyFromEnv, validateApiKey, validateCronExpression, validatePasswordStrength, verifyOidcIdToken, verifyPassword };
+export { ApiError, BlockedUrlError, BundleError, CONCURRENT_DDL_SQLSTATES, CronScheduler, DEFAULT_DRIVER_ID, DEFAULT_MAX_FILE_SIZE, DEFAULT_STORAGE_ID, DOCUMENT_MIME_TYPES, DefaultDriverRegistry, DefaultStorageRegistry, GCSStorageController, IMAGE_MIME_TYPES, LocalStorageController, MetricsRegistry, RawHtml, S3StorageController, SMTPEmailService, TransformCache, TusHandler, UnknownStorageSourceError, WEBHOOK_DELIVERY_TASK, WebhookDispatcher, _resetRebaseMock, _setRebaseMock, applyCollectionDefaults, assertAllowedOutboundUrl, assertCollectionConfigs, assertDistinctSuffixes, assertEmailLinkBases, assertWriteRequestValid, authJwt, authRoles, authUid, blockedAddressReason, bootFromBundle, classifySurface, cleanupDevPortFile, createAppleProvider, createBackupRoutes, createBitbucketProvider, createBuiltinAuthAdapter, createContractRoutes, createCronRoutes, createCronStore, createCustomAuthAdapter, createDdlBootstrapper, createDiscordProvider, createEmailService, createFacebookProvider, createFunctionRoutes, createGitHubProvider, createGitLabProvider, createGoogleProvider, createHistoryRoutes, createJobQueue, createJobStore, createJwksRoutes, createLinkedinProvider, createMetricsMiddleware, createMetricsRoutes, createMicrosoftProvider, createSlackProvider, createSourceBundle, createSpotifyProvider, createStorageController, createStorageRoutes, createTwitterProvider, defaultBackoff, defineCron, defineFunction, envSuffixForKey, errorHandler, escapeHtml, extractUserFromToken, fileTokenAuth, findCollectionConfigProblems, generateSecurePassword, getEmailVerificationTemplate, getJwks, getMagicLinkTemplate, getPasswordResetTemplate, getUserInvitationTemplate, getWelcomeEmailTemplate, hasAsymmetricSigningKey, hashPassword, html, httpMethodToOperation, initializeDataSource, initializeDataSources, initializeRebaseBackend, installShutdownHandlers, isApiKeyToken, isAuthAdapter, isConcurrentDdlRace, isDatabaseAdapter, isDuplicateObjectRace, isLocalhostOrigin, isOperationAllowed, isTransformableImage, listBackupObjects, listenWithPortRetry, loadBootEnv, loadBundle, loadBundleConfigExports, loadBundleSchema, loadCollectionsFromDirectory, loadCronJobsFromDirectory, loadCronJobsWithDiagnostics, loadDeclaredStorageSources, loadEnv, loadFunctionsFromDirectory, loadUsersCollection, logger, oauthCodeFlowSchema, optionalAuth, parseBackupDestination, parseBackupTimestamp, parseTransformOptions, pkceTokenParams, providerVerifiedEmail, queryTokenAuth, raw, readBackupBytes, readBundleManifest, rebase, requireAdmin, requireAuth, resolveAuthHooks, resolveAuthOptions, resolveCorsOrigin, resolveDataSources, resolveEmailBranding, resolveEmailLinkBase, resolveEmailOptions, resolveRequireAuth, resolveStorageBackend, resolveStorageSources, runFromBundle, safeCompare, serveSPA, transformImage, tryVerifyOidcIdToken, unknownKeyPolicyFromEnv, validateApiKey, validateCronExpression, validatePasswordStrength, verifyOidcIdToken, verifyPassword };
 
 //# sourceMappingURL=index.es.js.map