@rebasepro/server 0.16.0 → 0.16.1-canary.g041c925

package/dist/index.es.js

@@ -1,46 +1,56 @@
-import { createRequire as __createRequire } from "module";
-import process from "process";
-__createRequire(import.meta.url);
-import { A as GeoPoint, M as RebaseApiError, N as RebaseClientError, O as EntityReference, S as toSnakeCase, _ as fieldKeyForColumn, b as buildCompositeId, c as collectAllPages, d as normalizeOrderBy, f as serializeOrderBy, g as getEffectiveSecurityRules, h as resolveDataSource, j as Vector, k as EntityRelation, l as paginateFind, m as createDataSourceRegistry, n as buildSdkData, o as serializeFilter, p as CollectionRegistry, s as serializeLogicalCondition, t as buildRoutedRebaseData, u as resolveFindWindow, v as findRelation, x as resolvePrimaryKeys, y as resolveCollectionRelations } from "./src-BPfYOeN4.js";
-import { c as DEFAULT_DATA_SOURCE_KEY, g as toCanonicalOp, i as getCollectionDataPath, m as parseRelationAggregateSort, n as RLS_ROLES_SQL, o as isPostgresCollectionConfig, r as RLS_UID_SQL, t as RLS_JWT_SQL } from "./src-CrCxd8km.js";
-import { n as ADMIN_PROPERTY_KEYS, t as ADMIN_COLLECTION_KEYS } from "./admin_block-DLILvzle.js";
-import { a as isDuplicateObjectRace, i as isConcurrentDdlRace, n as createDdlBootstrapper, o as revokeInternalTableSql, s as isSQLAdmin, t as CONCURRENT_DDL_SQLSTATES } from "./ddl-bootstrap-Cywoj8Ta.js";
-import { C as canonicalStorageKey, D as findStorageSuffixCollision, E as DEFAULT_STORAGE_SOURCE_KEY, O as normalizeStorageSources, S as canonicalStorageId, b as InvalidStorageKeyError, c as getJwks, d as hasAsymmetricSigningKey, i as generateDownloadToken, k as storageEnvSuffix, n as configureJwt, p as isJwtConfigured, v as normalizePemFromEnv, x as canonicalStorageBucket, y as InvalidStorageBucketError } from "./jwt-DxH9fLPt.js";
-import { n as createContractRoutes, r as computeSchemaVersion } from "./contract-routes-DZ-LBpSL.js";
-import { $ as createAdapterAuthMiddleware, A as _coercedNumber, B as validatePasswordStrength, C as providerVerifiedEmail, Ct as parseQueryOptions, D as _enum, E as ZodNumber, Et as isPublicStoragePath, F as createEmailService, G as getPasswordResetTemplate, H as generateSecurePassword, I as assertEmailLinkBases, J as resolveEmailBranding, K as getUserInvitationTemplate, L as resolveEmailLinkBase, M as createDataRateLimiter, N as MemoryRateLimitStore, O as object, P as SMTPEmailService, Q as raw, R as resolveAuthHooks, S as pkceTokenParams, St as parseGroupBy, T as createBuiltinAuthAdapter, Tt as PUBLIC_STORAGE_PREFIX, U as getEmailVerificationTemplate, V as verifyPassword, W as getMagicLinkTemplate, X as escapeHtml, Y as RawHtml, Z as html, _ as verifyOidcIdToken, _t as scopeDataDriver, a as resolveRateLimitStoreKind, at as publicObjectAuth, b as createGoogleProvider, bt as orderByEntriesToTuples, c as createSlackProvider, ct as requireAuth, d as createDiscordProvider, dt as createStorageApiKeyGuard, et as createAuthMiddleware, f as createTwitterProvider, ft as isApiKeyToken, g as tryVerifyOidcIdToken, gt as SERVICE_IDENTITY, h as createMicrosoftProvider, ht as safeCompare, i as createApiKeyStore, it as optionalAuth, j as DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT, k as string, l as createBitbucketProvider, lt as createApiKeyPreAuth, m as createAppleProvider, mt as extractBearerToken, n as createCustomAuthAdapter, nt as extractUserFromToken, o as createSqlRateLimitStore, ot as queryTokenAuth, p as createFacebookProvider, pt as validateApiKey, q as getWelcomeEmailTemplate, r as createApiKeyRoutes, rt as fileTokenAuth, s as createSpotifyProvider, st as requireAdmin, tt as createRequireAuth, u as createGitLabProvider, ut as createFunctionApiKeyGuard, v as createGitHubProvider, vt as httpMethodToOperation, w as createJwksRoutes, wt as resolveListLimitParam, x as oauthCodeFlowSchema, xt as parseAggregateSelect, y as createLinkedinProvider, yt as isOperationAllowed, z as hashPassword } from "./auth-5Et5mnUA.js";
-import { t as logger } from "./logger-DfvF_8r-.js";
-import { n as errorHandler, t as ApiError } from "./errors-EBYiaJ2E.js";
-import { t as logMiddleware } from "./logs-routes-CWBLQj2l.js";
-import { n as DOCUMENT_MIME_TYPES, r as IMAGE_MIME_TYPES, t as DEFAULT_MAX_FILE_SIZE } from "./types-DSnOC4mF.js";
-import { t as S3StorageController } from "./S3StorageController-B2EDXXMH.js";
-import { t as GCSStorageController } from "./GCSStorageController-BEmDYFKc.js";
-import { n as loadFunctionsFromDirectory } from "./function-loader-DDS1v7YX.js";
-import { t as createFunctionRoutes } from "./function-routes-Btcez1T-.js";
-import { n as loadCronJobsFromDirectory, r as loadCronJobsWithDiagnostics } from "./cron-loader-YhhQeVBM.js";
-import { r as validateCronExpression, t as CronScheduler } from "./cron-scheduler-DIpYBmZP.js";
-import { t as createCronRoutes } from "./cron-routes-maM_RlUu.js";
-import { t as createCronStore } from "./cron-store-DfH_4Cd9.js";
-import { a as parseBackupTimestamp, i as parseBackupDestination, n as createBackupRoutes, o as readBackupBytes, r as listBackupObjects } from "./backup-C6ljYVTp.js";
-import { i as createJobStore, n as createJobQueue, r as defaultBackoff } from "./jobs-CyOKXXlu.js";
-import { t as FunctionSelectionError } from "./selection-_z6TM1DB.js";
-import { createHash, randomBytes, randomUUID } from "node:crypto";
-import * as fs$2 from "fs";
+import { createRequire as __rebaseCreateRequire } from "module";
+import __rebaseProcess from "process";
+globalThis.process ??= __rebaseProcess;
+__rebaseCreateRequire(import.meta.url);
+import { A as GeoPoint, M as RebaseApiError, N as RebaseClientError, O as EntityReference, S as toSnakeCase, _ as fieldKeyForColumn, b as buildCompositeId, c as collectAllPages, d as normalizeOrderBy, f as serializeOrderBy, g as getEffectiveSecurityRules, h as resolveDataSource, j as Vector, k as EntityRelation, l as paginateFind, m as createDataSourceRegistry, n as buildSdkData, o as serializeFilter, p as CollectionRegistry, s as serializeLogicalCondition, t as buildRoutedRebaseData, u as resolveFindWindow, v as findRelation, x as resolvePrimaryKeys, y as resolveCollectionRelations } from "./src-C5vFEj-t.js";
+import { a as RLS_JWT_SQL, b as toCanonicalOp, c as getCollectionDataPath, f as DEFAULT_DATA_SOURCE_KEY, i as buildResourceGraph, n as setTopicRuntime, o as RLS_ROLES_SQL, s as RLS_UID_SQL, t as declaredSubscriptions, u as isPostgresCollectionConfig, v as parseRelationAggregateSort } from "./src-6VqGNeDB.js";
+import { n as ADMIN_PROPERTY_KEYS, t as ADMIN_COLLECTION_KEYS } from "./admin_block-BeypnEfb.js";
+import { a as isDuplicateObjectRace, c as isSchemaEditingAdmin, i as isConcurrentDdlRace, n as createDdlBootstrapper, o as revokeInternalTableSql, s as isSQLAdmin, t as CONCURRENT_DDL_SQLSTATES } from "./ddl-bootstrap-euwN8FOy.js";
+import { C as canonicalStorageKey, D as findStorageSuffixCollision, E as DEFAULT_STORAGE_SOURCE_KEY, O as normalizeStorageSources, S as canonicalStorageId, b as InvalidStorageKeyError, c as getJwks, d as hasAsymmetricSigningKey, i as generateDownloadToken, k as storageEnvSuffix, n as configureJwt, p as isJwtConfigured, v as normalizePemFromEnv, x as canonicalStorageBucket, y as InvalidStorageBucketError } from "./jwt-CpMqxVct.js";
+import { n as createContractRoutes, r as computeSchemaVersion } from "./contract-routes-DDSRyGSl.js";
+import { $ as html, A as activeDevEmailSink, B as hashPassword, C as providerVerifiedEmail, Ct as PUBLIC_STORAGE_PREFIX, D as createDataRateLimiter, E as DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT, F as SMTPEmailService, G as getEmailVerificationTemplate, H as verifyPassword, I as createEmailService, J as getUserInvitationTemplate, K as getMagicLinkTemplate, L as assertEmailLinkBases, M as createDevEmailSink, N as extractLinks, O as defaultAuthLimiter, P as registerDevEmailSink, Q as escapeHtml, R as resolveEmailLinkBase, S as pkceTokenParams, St as isOperationAllowed, T as createBuiltinAuthAdapter, U as generateSecurePassword, V as validatePasswordStrength, W as getEmailOtpTemplate, X as resolveEmailBranding, Y as getWelcomeEmailTemplate, Z as RawHtml, _ as verifyOidcIdToken, _t as safeCompare, a as resolveRateLimitStoreKind, at as fileTokenAuth, b as createGoogleProvider, bt as hasAdministrativeRole, c as createSlackProvider, ct as queryTokenAuth, d as createDiscordProvider, dt as createApiKeyPreAuth, et as raw, f as createTwitterProvider, ft as createFunctionApiKeyGuard, g as tryVerifyOidcIdToken, gt as extractBearerToken, h as createMicrosoftProvider, ht as validateApiKey, i as createApiKeyStore, it as extractUserFromToken, j as clearActiveDevEmailSink, k as MemoryRateLimitStore, l as createBitbucketProvider, lt as requireAdmin, m as createAppleProvider, mt as isApiKeyToken, n as createCustomAuthAdapter, nt as createAuthMiddleware, o as createSqlRateLimitStore, ot as optionalAuth, p as createFacebookProvider, pt as createStorageApiKeyGuard, q as getPasswordResetTemplate, r as createApiKeyRoutes, rt as createRequireAuth, s as createSpotifyProvider, st as publicObjectAuth, tt as createAdapterAuthMiddleware, u as createGitLabProvider, ut as requireAuth, v as createGitHubProvider, vt as SERVICE_IDENTITY, w as createJwksRoutes, wt as isPublicStoragePath, x as oauthCodeFlowSchema, xt as httpMethodToOperation, y as createLinkedinProvider, yt as scopeDataDriver, z as resolveAuthHooks } from "./auth-DzarZhLS.js";
+import { r as hostEnv, t as logger } from "./logger-DS03e908.js";
+import { n as errorHandler, t as ApiError } from "./errors-DBwpj9N8.js";
+import { a as resolveListLimitParam, i as parseQueryOptions, n as parseAggregateSelect, r as parseGroupBy, t as orderByEntriesToTuples } from "./query-parser-C3hHu17g.js";
+import { c as _coercedNumber, i as object, n as _enum, o as string, t as ZodNumber } from "./schemas-DBxgjM9A.js";
+import { t as logMiddleware } from "./logs-routes-DB72iQSr.js";
+import { n as DOCUMENT_MIME_TYPES, r as IMAGE_MIME_TYPES, t as DEFAULT_MAX_FILE_SIZE } from "./types-BfKcm9do.js";
+import { t as S3StorageController } from "./S3StorageController-CWvvrRpF.js";
+import { t as GCSStorageController } from "./GCSStorageController-Bl7nmhdv.js";
+import { n as loadFunctionsFromDirectory, r as loadFunctionsWithDiagnostics } from "./function-loader-LLdmBFoL.js";
+import { t as createFunctionRoutes } from "./function-routes-ClT6UQpD.js";
+import "./proxy-CMymhnwG.js";
+import "./request-timeout-C8gkc-j7.js";
+import { t as FunctionSelectionError } from "./selection-CRpqKUbt.js";
+import { n as loadCronJobsFromDirectory, r as loadCronJobsWithDiagnostics } from "./cron-loader-d9WMFENB.js";
+import { r as validateCronExpression, t as CronScheduler } from "./cron-scheduler-BB82dWuU.js";
+import { t as createCronRoutes } from "./cron-routes-B_GKclr5.js";
+import { t as createCronStore } from "./cron-store-BTZqwkM1.js";
+import { a as parseBackupTimestamp, i as parseBackupDestination, n as createBackupRoutes, o as readBackupBytes, r as listBackupObjects } from "./backup-CRdZkA6c.js";
+import { i as createJobStore, n as createJobQueue, r as defaultBackoff } from "./jobs-CeZzdeR8.js";
+import { createHash, createSign, randomBytes, randomUUID } from "node:crypto";
+import * as fs$3 from "fs";
 import fs, { existsSync } from "fs";
-import * as path$2 from "path";
+import * as path$3 from "path";
 import path, { join } from "path";
 import { pathToFileURL } from "url";
 import { Hono } from "hono";
 import { promisify } from "util";
 import * as crypto$1 from "crypto";
 import { createHmac, randomUUID as randomUUID$1 } from "crypto";
+import * as path$2 from "node:path";
 import path$1 from "node:path";
 import { bodyLimit } from "hono/body-limit";
 import { csrf } from "hono/csrf";
 import { compress } from "hono/compress";
-import fs$1 from "node:fs";
+import fs$1, { createWriteStream } from "node:fs";
+import * as fs$2 from "node:fs/promises";
 import fsp from "node:fs/promises";
 import os from "node:os";
 import { mkdir, open, unlink, writeFile } from "fs/promises";
+import { execFile } from "node:child_process";
+import { promisify as promisify$1 } from "node:util";
+import { env, getRuntimeKey } from "hono/adapter";
 import { sql } from "drizzle-orm";
 import { lookup } from "node:dns/promises";
 import { isIP } from "node:net";
@@ -49,8 +59,16 @@ import { createServer } from "http";
 import { cors } from "hono/cors";
 import { secureHeaders } from "hono/secure-headers";
 import { getRequestListener } from "@hono/node-server";
-import { execFile } from "node:child_process";
-import { promisify as promisify$1 } from "node:util";
+import { Readable } from "node:stream";
+import { pipeline } from "node:stream/promises";
+//#region ../types/src/types/schema_editing.ts
+var DEFAULT_COMMIT_PATHS = {
+	schemaFile: "backend/src/schema.generated.ts",
+	ddlFile: "drizzle/schema.sql",
+	policiesFile: "drizzle/policies.sql",
+	searchFile: "drizzle/search.sql"
+};
+//#endregion
 //#region src/collections/BackendCollectionRegistry.ts
 /**
 * Backend-agnostic collection registry.
@@ -136,7 +154,28 @@ var BASE_PROPERTY_KEYS = [
 	"metadata",
 	"admin"
 ];
-/** The keys each property `type` adds on top of {@link BASE_PROPERTY_KEYS}. */
+/**
+* Keys valid at the TOP LEVEL of a property, by type.
+*
+* Presentation is not among them. It moved into the property's `admin` block in
+* 0.11, and `PROPERTY_MIGRATIONS` carries a hint for every key in
+* `ADMIN_PROPERTY_KEYS` telling an author to move it — generated from that list,
+* so it cannot fall behind.
+*
+* Seven of those keys were nevertheless listed here, on the four types they used
+* to live on: `fixedFilter`, `includeId`, `includeEntityLink` (reference and
+* relation), `widget` (relation), `sortable`, `canAddElements` (array) and
+* `previewProperties` (map). This allowlist is consulted first, so on exactly
+* those types the key was accepted, the migration hint was never reached, and
+* nothing read the value — a config written against the pre-0.11 shape booted
+* clean with the option silently dropped, while the identical key on any other
+* type failed with a helpful message. The inconsistency is what made it hard to
+* see: it looked like the feature worked on the types it was documented for.
+*
+* The rule this file now keeps: nothing in `ADMIN_PROPERTY_KEYS` belongs in any
+* list here. `admin-keys-are-not-top-level.test.ts` asserts it for every key and
+* every type, so a key added to the admin block later cannot be added here too.
+*/
 var PROPERTY_KEYS_BY_TYPE = {
 	string: [
 		"columnType",
@@ -161,35 +200,22 @@ var PROPERTY_KEYS_BY_TYPE = {
 	],
 	geopoint: [],
 	binary: [],
-	vector: ["dimensions"],
-	reference: [
-		"isId",
-		"path",
-		"fixedFilter",
-		"includeId",
-		"includeEntityLink"
-	],
+	vector: ["dimensions", "index"],
+	reference: ["isId", "path"],
 	relation: [
 		"isId",
 		"relation",
-		"resolvedRelation",
-		"fixedFilter",
-		"includeId",
-		"includeEntityLink",
-		"widget"
+		"resolvedRelation"
 	],
 	array: [
 		"columnType",
 		"of",
-		"oneOf",
-		"sortable",
-		"canAddElements"
+		"oneOf"
 	],
 	map: [
 		"columnType",
 		"properties",
 		"propertiesOrder",
-		"previewProperties",
 		"keyValue"
 	]
 };
@@ -233,11 +259,20 @@ var RELATION_LINK_FIELDS = [
 	"joinPath",
 	"cardinality"
 ];
+/**
+* Keys that no longer exist *inside* the `admin` block.
+*
+* Checked by name, not by completeness — see `checkCollection`.
+*/
+var ADMIN_BLOCK_MIGRATIONS = { titleProperty: { fix: "`titleProperty` was replaced by `admin.display.title` — the same string works there, and `display.title` also takes a resolver for a title the record does not carry" } };
 /** Collection-level keys that no longer exist at the top level. */
-var COLLECTION_MIGRATIONS = { editable: { fix: "`editable` was removed in 0.10 — collections are editable by default. Delete it, or use `admin.disableDefaultActions` to take actions away" } };
+var COLLECTION_MIGRATIONS = {
+	editable: { fix: "`editable` was removed in 0.10 — collections are editable by default. Delete it, or use `admin.disableDefaultActions` to take actions away" },
+	...ADMIN_BLOCK_MIGRATIONS
+};
 for (const key of ADMIN_COLLECTION_KEYS) COLLECTION_MIGRATIONS[key] = {
 	fix: `\`${key}\` moved into the collection's \`admin\` block in 0.11 — write \`admin: { ${key}: … }\``,
-	codemod: "node scripts/codemod/collections-admin-block.mjs"
+	codemod: "node tooling/scripts/codemod/collections-admin-block.mjs"
 };
 /** Property-level keys that no longer exist at the top level of a property. */
 var PROPERTY_MIGRATIONS = {
@@ -267,7 +302,7 @@ var RELATION_PROPERTY_MIGRATIONS = {
 	overrides: { fix: "move `overrides` inside `relation`" },
 	relationName: { fix: "move `relationName` inside `relation` — `relation: { kind: …, relationName: … }`" }
 };
-var RELATION_UNION_CODEMOD = "node scripts/codemod/relations-tagged-union.mjs";
+var RELATION_UNION_CODEMOD = "node tooling/scripts/codemod/relations-tagged-union.mjs";
 /** Fields the old flat `Relation` carried that the tagged union does not. */
 var RELATION_MIGRATIONS = {
 	direction: {
@@ -365,7 +400,7 @@ function checkProperty(property, path, collect) {
 	const type = property.type;
 	if (typeof type !== "string") collect.error(path, "a property has no `type`.");
 	else if (!PROPERTY_TYPES.includes(type)) collect.error(path, `\`type: "${type}"\` is not a property type. Expected one of ${PROPERTY_TYPES.join(", ")}.`);
-	const allowed = /* @__PURE__ */ new Set([...BASE_PROPERTY_KEYS, ...typeof type === "string" ? PROPERTY_KEYS_BY_TYPE[type] ?? [] : []]);
+	const allowed = /* @__PURE__ */ new Set([...BASE_PROPERTY_KEYS, ...typeof type === "string" && type in PROPERTY_KEYS_BY_TYPE ? PROPERTY_KEYS_BY_TYPE[type] : []]);
 	for (const key of Object.keys(property)) {
 		if (allowed.has(key)) continue;
 		if (type === "relation" && RELATION_PROPERTY_MIGRATIONS[key]) {
@@ -413,6 +448,9 @@ function checkCollection(collection, index, collect) {
 		}
 		collect.unknown(`${at}.${key}`, key, "collection");
 	}
+	if (isPlainObject$1(collection.admin)) {
+		for (const [key, migration] of Object.entries(ADMIN_BLOCK_MIGRATIONS)) if (key in collection.admin) collect.migrated(`${at}.admin.${key}`, key, migration);
+	}
 	if (isPlainObject$1(collection.properties)) checkProperties(collection.properties, `${at}.properties`, collect);
 	else if (collection.properties !== void 0) collect.error(`${at}.properties`, "`properties` must be an object keyed by property name.");
 	if (Array.isArray(collection.relations)) collection.relations.forEach((relation, i) => {
@@ -464,8 +502,8 @@ async function importModule(filePath) {
 /** Read `defaultSecurityRules` from a collections directory's index module. */
 async function readDefaults(directory) {
 	for (const name of ["index.ts", "index.js"]) {
-		const indexPath = path$2.join(directory, name);
-		if (!fs$2.existsSync(indexPath)) continue;
+		const indexPath = path$3.join(directory, name);
+		if (!fs$3.existsSync(indexPath)) continue;
 		try {
 			return { defaultSecurityRules: (await importModule(indexPath)).defaultSecurityRules };
 		} catch (err) {
@@ -502,23 +540,23 @@ function applyCollectionDefaults(collections, defaults) {
 * rejects.
 */
 async function loadCollectionsFromDirectory(source, options = {}) {
-	const resolved = path$2.resolve(source);
+	const resolved = path$3.resolve(source);
 	const validate = (collections) => {
 		if (options.validate !== false) assertCollectionConfigs(collections, options.validate ?? {});
 		return collections;
 	};
-	if (!fs$2.existsSync(resolved)) {
+	if (!fs$3.existsSync(resolved)) {
 		logger.warn(`[collections] Not found: ${resolved}`);
 		return [];
 	}
-	if (!fs$2.statSync(resolved).isDirectory()) {
+	if (!fs$3.statSync(resolved).isDirectory()) {
 		const mod = await importModule(resolved);
 		return validate(applyCollectionDefaults([...mod.backendCollections || mod.collections || []], { defaultSecurityRules: mod.defaultSecurityRules }));
 	}
 	const collections = [];
 	const failures = [];
-	for (const file of fs$2.readdirSync(resolved).filter(isCollectionFile)) try {
-		const mod = await importModule(path$2.join(resolved, file));
+	for (const file of fs$3.readdirSync(resolved).filter(isCollectionFile)) try {
+		const mod = await importModule(path$3.join(resolved, file));
 		if (mod?.default) collections.push(mod.default);
 		else failures.push(`${file}: no default export`);
 	} catch (err) {
@@ -533,7 +571,7 @@ async function loadCollectionsFromDirectory(source, options = {}) {
 * Telling a *stale* driver apart from a driver that never had the feature.
 *
 * The managed runtime is two halves that version independently. The image
-* supplies `@rebasepro/server` — `docker/entrypoint.mjs` symlinks it over
+* supplies `@rebasepro/server` — `infra/docker/entrypoint.mjs` symlinks it over
 * whatever the bundle installed, so the boot harness is always the image's. The
 * **driver** is not redirected: `@rebasepro/server-postgres` comes from the
 * bundle's `deps.declared`, pinned to whatever the project's `package.json`
@@ -705,7 +743,7 @@ function readPackageVersion(packageDir) {
 * The version of `@rebasepro/server` this deployment is actually running.
 *
 * Resolved from the same roots the drivers are, and that is the point rather
-* than a convenience. In a managed container `docker/entrypoint.mjs` replaces
+* than a convenience. In a managed container `infra/docker/entrypoint.mjs` replaces
 * `/bundle/node_modules/@rebasepro/server` with a link to the image's copy, so
 * reading the manifest *through the bundle* reports the version that will
 * really execute — which is exactly the number the driver has to be compared
@@ -2215,15 +2253,14 @@ var RestApiGenerator = class {
 		* gateway in front of this API would reject partial updates the server
 		* would have accepted.
 		*
-		* PUT stays mounted on the same handler rather than being changed or
-		* removed: every published SDK sends it, and altering its semantics to
-		* be a true replace would silently start nulling columns that callers
-		* had simply omitted for years — a data-loss change disguised as a
-		* standards fix. So PATCH is the honest name, PUT is the compatible one,
-		* and both do the documented thing.
+		* PUT was mounted on the same handler for a while so that published
+		* SDKs kept working. It is gone: two verbs for one operation meant the
+		* spec had to describe the same route twice, one of them marked
+		* deprecated, and a merge served under a verb that means replace is a
+		* contract nobody can generate against. `update()` in the SDK sends
+		* PATCH.
 		*/
 		this.router.patch(`${basePath}/:id`, updateEntity);
-		this.router.put(`${basePath}/:id`, updateEntity);
 		this.router.delete(`${basePath}/:id`, async (c) => {
 			this.enforceApiKeyPermission(c, collection.slug);
 			const id = c.req.param("id");
@@ -2393,7 +2430,6 @@ var RestApiGenerator = class {
 			return c.json(response);
 		};
 		this.router.patch("/:parent/:parentId/:rest{.+}", updateNested);
-		this.router.put("/:parent/:parentId/:rest{.+}", updateNested);
 		this.router.delete("/:parent/:parentId/:rest{.+}", async (c, next) => {
 			const rest = c.req.param("rest");
 			if (!rest || rest === "undefined") return next();
@@ -2632,13 +2668,13 @@ function configureMiddlewares(app, basePath, isProduction, config) {
 /**
 * Local filesystem storage controller
 */
-var mkdir$1 = promisify(fs$2.mkdir);
-var writeFile$1 = promisify(fs$2.writeFile);
-var readFile = promisify(fs$2.readFile);
-var unlink$1 = promisify(fs$2.unlink);
-var readdir = promisify(fs$2.readdir);
-var stat = promisify(fs$2.stat);
-var access = promisify(fs$2.access);
+var mkdir$1 = promisify(fs$3.mkdir);
+var writeFile$1 = promisify(fs$3.writeFile);
+var readFile = promisify(fs$3.readFile);
+var unlink$1 = promisify(fs$3.unlink);
+var readdir = promisify(fs$3.readdir);
+var stat = promisify(fs$3.stat);
+var access = promisify(fs$3.access);
 /**
 * Remove initial and trailing slashes from a path.
 * Handles paths like "/images/", "images/", "/images" → "images"
@@ -2658,7 +2694,7 @@ var LocalStorageController = class {
 	basePath;
 	constructor(config) {
 		this.config = config;
-		this.basePath = path$2.resolve(config.basePath);
+		this.basePath = path$3.resolve(config.basePath);
 	}
 	getType() {
 		return "local";
@@ -2699,10 +2735,10 @@ var LocalStorageController = class {
 	* depend on it having run.
 	*/
 	getFullPath(storagePath, bucket) {
-		const bucketPath = path$2.resolve(this.basePath, bucket || "default");
-		if (!bucketPath.startsWith(this.basePath + path$2.sep)) throw new Error("Path traversal detected: bucket resolves outside the storage root.");
-		const resolved = path$2.resolve(bucketPath, storagePath);
-		if (!resolved.startsWith(bucketPath + path$2.sep) && resolved !== bucketPath) throw new Error("Path traversal detected: resolved storage path is outside the bucket directory.");
+		const bucketPath = path$3.resolve(this.basePath, bucket || "default");
+		if (!bucketPath.startsWith(this.basePath + path$3.sep)) throw new Error("Path traversal detected: bucket resolves outside the storage root.");
+		const resolved = path$3.resolve(bucketPath, storagePath);
+		if (!resolved.startsWith(bucketPath + path$3.sep) && resolved !== bucketPath) throw new Error("Path traversal detected: resolved storage path is outside the bucket directory.");
 		return resolved;
 	}
 	/**
@@ -2720,7 +2756,7 @@ var LocalStorageController = class {
 		const usedBucket = bucket || "default";
 		const fullStoragePath = key;
 		const fullPath = this.getFullPath(fullStoragePath, usedBucket);
-		await this.ensureDir(path$2.dirname(fullPath));
+		await this.ensureDir(path$3.dirname(fullPath));
 		const arrayBuffer = await file.arrayBuffer();
 		await writeFile$1(fullPath, Buffer.from(arrayBuffer));
 		await writeFile$1(`${fullPath}.metadata.json`, JSON.stringify({
@@ -2749,7 +2785,7 @@ var LocalStorageController = class {
 		resolvedPath = normalizeStoragePath(resolvedPath);
 		const fullPath = this.getFullPath(resolvedPath, resolvedBucket);
 		try {
-			await access(fullPath, fs$2.constants.R_OK);
+			await access(fullPath, fs$3.constants.R_OK);
 		} catch {
 			return {
 				url: null,
@@ -2765,7 +2801,7 @@ var LocalStorageController = class {
 			metadata = {
 				bucket: resolvedBucket ?? "default",
 				fullPath: resolvedPath,
-				name: path$2.basename(resolvedPath),
+				name: path$3.basename(resolvedPath),
 				size: fileStat.size,
 				contentType: savedMetadata.contentType || "application/octet-stream",
 				customMetadata: savedMetadata
@@ -2776,7 +2812,7 @@ var LocalStorageController = class {
 				metadata = {
 					bucket: resolvedBucket ?? "default",
 					fullPath: resolvedPath,
-					name: path$2.basename(resolvedPath),
+					name: path$3.basename(resolvedPath),
 					size: fileStat.size,
 					contentType: "application/octet-stream",
 					customMetadata: {}
@@ -2802,7 +2838,7 @@ var LocalStorageController = class {
 		resolvedPath = normalizeStoragePath(resolvedPath);
 		const fullPath = this.getFullPath(resolvedPath, resolvedBucket);
 		try {
-			await access(fullPath, fs$2.constants.R_OK);
+			await access(fullPath, fs$3.constants.R_OK);
 			const buffer = await readFile(fullPath);
 			let contentType = "application/octet-stream";
 			try {
@@ -2810,7 +2846,7 @@ var LocalStorageController = class {
 				contentType = JSON.parse(metadataContent).contentType || contentType;
 			} catch {}
 			const blob = new Blob([buffer], { type: contentType });
-			return new File([blob], path$2.basename(resolvedPath), { type: contentType });
+			return new File([blob], path$3.basename(resolvedPath), { type: contentType });
 		} catch {
 			return null;
 		}
@@ -2830,12 +2866,12 @@ var LocalStorageController = class {
 		if (!resolvedPath) return;
 		const fullPath = this.getFullPath(resolvedPath, resolvedBucket);
 		try {
-			await access(fullPath, fs$2.constants.F_OK);
+			await access(fullPath, fs$3.constants.F_OK);
 		} catch {
 			return;
 		}
 		try {
-			if ((await stat(fullPath)).isDirectory()) await fs$2.promises.rmdir(fullPath);
+			if ((await stat(fullPath)).isDirectory()) await fs$3.promises.rmdir(fullPath);
 			else {
 				await unlink$1(fullPath);
 				try {
@@ -2856,7 +2892,7 @@ var LocalStorageController = class {
 		const items = [];
 		const prefixes = [];
 		try {
-			await access(fullPath, fs$2.constants.R_OK);
+			await access(fullPath, fs$3.constants.R_OK);
 			const entries = await readdir(fullPath, { withFileTypes: true });
 			let count = 0;
 			const maxResults = options?.maxResults ?? 1e3;
@@ -3032,6 +3068,138 @@ function isStorageController(obj) {
 	return typeof controller.putObject === "function" && typeof controller.getSignedUrl === "function" && typeof controller.deleteObject === "function" && typeof controller.listObjects === "function" && typeof controller.getType === "function";
 }
 //#endregion
+//#region src/storage/cache-headers.ts
+/**
+* A weak validator built from size and modification time.
+*
+* Weak (`W/`) because it is not a digest of the body: two different bodies of
+* the same length written in the same millisecond would collide. That is the
+* same trade nginx makes for static files, and the alternative — hashing every
+* object on every request — costs more than it saves for content this server is
+* already streaming from somewhere else.
+*/
+function buildEntityTag(size, lastModifiedMs) {
+	return `W/"${size.toString(16)}-${Math.floor(lastModifiedMs).toString(16)}"`;
+}
+function objectValidators(size, lastModifiedMs) {
+	const seconds = Math.floor(lastModifiedMs / 1e3) * 1e3;
+	return {
+		etag: buildEntityTag(size, lastModifiedMs),
+		lastModified: new Date(seconds).toUTCString(),
+		lastModifiedMs: seconds
+	};
+}
+function cacheControl(options) {
+	const parts = [options.isPublic ? "public" : "private", `max-age=${options.maxAgeSeconds}`];
+	if (options.isPublic && options.staleWhileRevalidateSeconds) parts.push(`stale-while-revalidate=${options.staleWhileRevalidateSeconds}`);
+	parts.push("must-revalidate");
+	return parts.join(", ");
+}
+/** Every `ETag` in an `If-None-Match` header, unquoted comparison-ready. */
+function parseIfNoneMatch(header) {
+	return header.split(",").map((part) => part.trim()).filter(Boolean);
+}
+/**
+* Weak comparison, which is the only comparison `If-None-Match` on a GET is
+* allowed to use (RFC 9110 §8.8.3.2). `W/"x"` and `"x"` are the same entity for
+* this purpose, so the prefix is stripped from both sides before comparing.
+*/
+function weakMatch(a, b) {
+	const strip = (v) => v.startsWith("W/") ? v.slice(2) : v;
+	return strip(a) === strip(b);
+}
+/**
+* Whether the request already holds this exact representation.
+*
+* `If-None-Match` wins outright when present: it is an exact validator, whereas
+* `If-Modified-Since` has second resolution and is only consulted in its
+* absence — again the order RFC 9110 requires.
+*/
+function isNotModified(c, validators) {
+	const ifNoneMatch = c.req.header("if-none-match");
+	if (ifNoneMatch) {
+		const tags = parseIfNoneMatch(ifNoneMatch);
+		return tags.includes("*") || tags.some((tag) => weakMatch(tag, validators.etag));
+	}
+	const ifModifiedSince = c.req.header("if-modified-since");
+	if (ifModifiedSince) {
+		const since = Date.parse(ifModifiedSince);
+		if (!Number.isNaN(since)) return validators.lastModifiedMs <= since;
+	}
+	return false;
+}
+/**
+* Put the validators and the cache policy on a response.
+*
+* Applied to the 304 as well as the 200: a 304 that omits them tells the client
+* nothing about how long the answer holds, so the next load revalidates again
+* immediately and the round trip repeats forever.
+*/
+function applyCacheHeaders(c, validators, options) {
+	c.header("ETag", validators.etag);
+	c.header("Last-Modified", validators.lastModified);
+	c.header("Cache-Control", cacheControl(options));
+	c.header("Vary", "Authorization");
+}
+//#endregion
+//#region src/storage/range.ts
+/**
+* Parse a `Range` header against an object of `size` bytes.
+*
+* Deliberately conservative: anything malformed, multi-range, or in a unit other
+* than bytes resolves to `none`, which serves the whole object. A range request
+* answered with `200` is always legal; a range answered wrongly is a corrupted
+* download.
+*/
+function parseRange(header, size) {
+	if (!header) return { kind: "none" };
+	const match = /^bytes=(.*)$/i.exec(header.trim());
+	if (!match) return { kind: "none" };
+	const spec = match[1].trim();
+	if (spec.includes(",")) return { kind: "none" };
+	const parts = /^(\d*)-(\d*)$/.exec(spec);
+	if (!parts) return { kind: "none" };
+	const [, rawStart, rawEnd] = parts;
+	if (size === 0) return { kind: "unsatisfiable" };
+	let start;
+	let end;
+	if (rawStart === "") {
+		if (rawEnd === "") return { kind: "none" };
+		const suffix = Number(rawEnd);
+		if (!Number.isSafeInteger(suffix)) return { kind: "none" };
+		if (suffix === 0) return { kind: "unsatisfiable" };
+		start = Math.max(0, size - suffix);
+		end = size - 1;
+	} else {
+		start = Number(rawStart);
+		if (!Number.isSafeInteger(start)) return { kind: "none" };
+		if (start >= size) return { kind: "unsatisfiable" };
+		if (rawEnd === "") end = size - 1;
+		else {
+			end = Number(rawEnd);
+			if (!Number.isSafeInteger(end)) return { kind: "none" };
+			end = Math.min(end, size - 1);
+		}
+		if (end < start) return { kind: "unsatisfiable" };
+	}
+	return {
+		kind: "range",
+		range: {
+			start,
+			end,
+			length: end - start + 1
+		}
+	};
+}
+/** The `Content-Range` for a served range. */
+function contentRange(range, size) {
+	return `bytes ${range.start}-${range.end}/${size}`;
+}
+/** The `Content-Range` for a `416`, which names the size and no range. */
+function unsatisfiableContentRange(size) {
+	return `bytes */${size}`;
+}
+//#endregion
 //#region src/storage/image-transform.ts
 /**
 * Image Transformation Service
@@ -3292,6 +3460,221 @@ var TransformCache = class {
 	}
 };
 //#endregion
+//#region src/storage/path-pattern.ts
+/**
+* The storage key pattern language, in one place.
+*
+* `storagePolicies` invented it and `storageTriggers` needs exactly the same
+* thing: match a key segment by segment, capture the named segments, and refuse
+* a pattern that would silently do something other than it says. Two copies of
+* a matcher used for access control is one copy too many — the day they drift
+* is the day a policy and a trigger disagree about what `users/:uid/**` means,
+* and only one of them is enforcing anything.
+*
+* The rules:
+*
+* - a literal segment matches itself
+* - `*` matches exactly one segment
+* - `:name` matches one segment and captures it
+* - `**` matches the rest of the key, including nothing, and is only allowed as
+*   the final segment
+*
+* Compilation is strict and happens at boot: a `**` in the middle, a `:` with
+* no name, or the same capture twice are all errors, because each of them is a
+* pattern whose author believed something the matcher does not do.
+*/
+/** A pattern that cannot be compiled. Thrown at boot, never per request. */
+var StoragePatternError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "StoragePatternError";
+	}
+};
+/**
+* Split a key into segments, dropping empty ones.
+*
+* Empty segments come from a leading slash or a `//`, and treating them as real
+* would let `users//x` match a pattern expecting a captured segment with the
+* empty string. Keys reaching here are already sanitized against traversal; this
+* is about matching, not safety.
+*/
+function segmentsOf(value) {
+	return value.split("/").filter((segment) => segment.length > 0);
+}
+/**
+* Compile a pattern, or throw {@link StoragePatternError}.
+*
+* `label` names the thing being compiled in any error — `storagePolicies[2]`,
+* `storageTriggers[0]` — so a boot failure points at the line to edit.
+*/
+function compileStoragePattern(path, label) {
+	if (typeof path !== "string" || path.trim() === "") throw new StoragePatternError(`${label}: \`path\` must be a non-empty string.`);
+	const segments = segmentsOf(path);
+	if (segments.length === 0) throw new StoragePatternError(`${label}: \`path\` "${path}" names no segments. Use "**" to match every key.`);
+	const starIndex = segments.indexOf("**");
+	if (starIndex !== -1 && starIndex !== segments.length - 1) throw new StoragePatternError(`${label}: "**" is only allowed as the last segment of \`path\`, and "${path}" puts it in the middle. Use "*" for a single segment.`);
+	const captures = segments.filter((s) => s.startsWith(":")).map((s) => s.slice(1));
+	for (const name of captures) {
+		if (name === "") throw new StoragePatternError(`${label}: a ":" placeholder in "${path}" has no name.`);
+		if (captures.filter((c) => c === name).length > 1) throw new StoragePatternError(`${label}: "${path}" captures ":${name}" twice, so one would silently win.`);
+	}
+	return {
+		segments,
+		trailing: starIndex !== -1,
+		source: path
+	};
+}
+/**
+* Match a key against a compiled pattern.
+*
+* Returns the captured segments on a match — an empty object for a pattern that
+* captures nothing — and `undefined` on a miss. The distinction matters: a
+* pattern with no `:name` still matches, and `{}` is a match while `undefined`
+* is not.
+*/
+function matchStoragePattern(compiled, key) {
+	const keySegments = segmentsOf(key);
+	const pattern = compiled.trailing ? compiled.segments.slice(0, -1) : compiled.segments;
+	if (compiled.trailing ? keySegments.length < pattern.length : keySegments.length !== pattern.length) return;
+	const params = {};
+	for (let i = 0; i < pattern.length; i++) {
+		const expected = pattern[i];
+		const actual = keySegments[i];
+		if (expected === "*") continue;
+		if (expected.startsWith(":")) {
+			params[expected.slice(1)] = actual;
+			continue;
+		}
+		if (expected !== actual) return void 0;
+	}
+	return params;
+}
+//#endregion
+//#region src/storage/triggers.ts
+/**
+* Storage triggers: run something when an object lands, or when one goes.
+*
+* Every other write in the product can be reacted to — a row has `beforeSave`
+* and `afterSave`, a schedule has a cron job, an outbound event has a webhook —
+* and an upload had nothing. So the ordinary things an upload implies (thumbnail
+* a photo, index a document, write a row recording what arrived, tell somebody)
+* had to be done by the client after the upload returned, which means they are
+* not done at all when the client goes away between the two calls.
+*
+* ```ts
+* storageTriggers: [
+*     {
+*         path: "uploads/:uid/**",
+*         events: ["finalize"],
+*         handler: async ({ key, params, size }) => {
+*             await jobs.enqueue("index-upload", { key, uid: params.uid, size });
+*         }
+*     }
+* ]
+* ```
+*
+* The pattern language is `storagePolicies`', to the letter — see
+* `path-pattern.ts`, which both compile through.
+*
+* ## What a handler can rely on
+*
+* **`finalize` fires after the object is durably written**, never before, and
+* never for a write that failed. **`delete` fires after the object is gone.**
+* Both carry the key exactly as the storage controller saw it — the canonical
+* one, the same string `storageAuthorize` was asked about.
+*
+* ## What a handler must not rely on
+*
+* **Delivery is best-effort, and a throwing handler does not fail the request.**
+* The object is already stored by the time a `finalize` handler runs; answering
+* the client with an error would say the upload failed when it did not, and
+* clients retry uploads. So a handler that throws is logged and the response is
+* unchanged. If the work must happen, the handler should enqueue a job — that
+* is durable, retried, and observable — rather than being the durable step
+* itself.
+*
+* **Handlers are awaited**, in declaration order, before the response is sent.
+* That is deliberate: firing and forgetting would leave a promise running after
+* the response, which a serverless runtime is free to freeze mid-flight. The
+* cost is that a slow handler is a slow upload, which is the other reason to
+* enqueue rather than to work here.
+*
+* **Renditions and other internal writes do not fire triggers.** Only a write
+* that came through the API does. The image-transform cache writes derived
+* objects straight to the controller, and a trigger firing on those would
+* recurse.
+*/
+/**
+* A request's principal, in the shape a trigger is documented to receive.
+*
+* Hono's `user` variable is typed `AuthResult`, which admits `true` — some
+* middleware sets a bare boolean to mean "authenticated, with no identity
+* attached". A trigger asking "who did this?" is better told `null` than
+* `true`, and better told `null` than a `{}` with no `uid`.
+*/
+function triggerUser(raw) {
+	if (!raw || typeof raw !== "object") return null;
+	const user = raw;
+	if (typeof user.uid !== "string") return null;
+	return {
+		uid: user.uid,
+		...typeof user.email === "string" ? { email: user.email } : {},
+		...Array.isArray(user.roles) ? { roles: user.roles } : {}
+	};
+}
+var StorageTriggerError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "StorageTriggerError";
+	}
+};
+var ALL_EVENTS = ["finalize", "delete"];
+/**
+* Compile a trigger list into a dispatcher, or throw
+* {@link StorageTriggerError}.
+*
+* Compiled at boot so a malformed pattern fails the start rather than the first
+* upload — and, worse, rather than failing *silently* by matching nothing.
+*/
+function compileStorageTriggers(triggers) {
+	if (!Array.isArray(triggers)) throw new StorageTriggerError("`storageTriggers` must be an array.");
+	const compiled = triggers.map((trigger, index) => {
+		const label = `storageTriggers[${index}]`;
+		if (typeof trigger?.handler !== "function") throw new StorageTriggerError(`${label}: \`handler\` must be a function. A trigger with no handler runs nothing, which is never what was meant.`);
+		if (trigger.events !== void 0) {
+			if (!Array.isArray(trigger.events) || trigger.events.length === 0) throw new StorageTriggerError(`${label}: \`events\` is empty, so this trigger never fires. Remove it to take the default, or name the events.`);
+			for (const event of trigger.events) if (!ALL_EVENTS.includes(event)) throw new StorageTriggerError(`${label}: \`events\` names "${event}", which is not a storage event. Use ${ALL_EVENTS.map((e) => `"${e}"`).join(" or ")}.`);
+		}
+		let pattern;
+		try {
+			pattern = compileStoragePattern(trigger.path, label);
+		} catch (err) {
+			throw err instanceof StoragePatternError ? new StorageTriggerError(err.message) : err;
+		}
+		return {
+			pattern,
+			events: new Set(trigger.events ?? ["finalize"]),
+			name: trigger.name ?? trigger.path,
+			handler: trigger.handler
+		};
+	});
+	return async (ctx) => {
+		for (const trigger of compiled) {
+			if (!trigger.events.has(ctx.event)) continue;
+			const params = matchStoragePattern(trigger.pattern, ctx.key);
+			if (!params) continue;
+			try {
+				await trigger.handler({
+					...ctx,
+					params
+				});
+			} catch (err) {
+				logger.error(`[storage] Trigger "${trigger.name}" threw on ${ctx.event} of "${ctx.key}". The object is unaffected and the request was not failed.`, { error: err instanceof Error ? err.message : String(err) });
+			}
+		}
+	};
+}
+//#endregion
 //#region src/storage/tus-handler.ts
 /**
 * TUS Protocol Handler
@@ -3317,13 +3700,15 @@ var TusHandler = class {
 	storageController;
 	storageRegistry;
 	authorizeUpload;
+	onFinalized;
 	uploads = /* @__PURE__ */ new Map();
 	tusDir;
 	cleanupTimer;
-	constructor(storageBaseDir, storageController, storageRegistry, authorizeUpload) {
+	constructor(storageBaseDir, storageController, storageRegistry, authorizeUpload, onFinalized) {
 		this.storageController = storageController;
 		this.storageRegistry = storageRegistry;
 		this.authorizeUpload = authorizeUpload;
+		this.onFinalized = onFinalized;
 		this.tusDir = join(storageBaseDir, ".tus-uploads");
 	}
 	/** Ensure the temp directory exists. */
@@ -3417,7 +3802,8 @@ var TusHandler = class {
 			bucket,
 			storageId,
 			key,
-			completed: false
+			completed: false,
+			user: triggerUser(c.get("user"))
 		};
 		this.uploads.set(id, upload);
 		const reqUrl = new URL(c.req.url);
@@ -3536,6 +3922,14 @@ var TusHandler = class {
 			} catch {}
 			this.uploads.delete(upload.id);
 			logger.info(`[TUS] Upload ${upload.id} finalized → ${fileName}`, storageId ? { storageId } : {});
+			await this.onFinalized?.({
+				key: fileName,
+				bucket: upload.bucket,
+				storageId,
+				size: data.byteLength,
+				contentType: mimeType,
+				user: upload.user
+			});
 		} catch (err) {
 			logger.error(`[TUS] Failed to finalize upload ${upload.id}`, { error: err });
 			if (err instanceof ApiError) throw err;
@@ -3544,6 +3938,142 @@ var TusHandler = class {
 	}
 };
 //#endregion
+//#region src/storage/rendition-cache.ts
+/**
+* Derived image renditions, kept in the storage source rather than in memory.
+*
+* ## The problem this solves
+*
+* A transform — `?width=400&format=webp` — is a decode, a resize and an encode.
+* The result is held in an in-process LRU, which makes it free for the second
+* request that asks the same instance for the same variant, and free for
+* nothing else. Two consequences follow, and both are the ordinary case rather
+* than an edge one:
+*
+*  - **per-instance.** Two replicas behind a load balancer each compute every
+*    variant, and a third replica added under load starts by recomputing all of
+*    them — at exactly the moment there is least CPU to spare;
+*  - **cold after a deploy.** The cache does not survive a restart, so every
+*    release re-does the entire catalogue's worth of work.
+*
+* Writing the rendition back to the storage source fixes both, because the
+* storage source is the one thing every instance already shares and no deploy
+* touches.
+*
+* ## Why it is opt-in
+*
+* This makes a `GET` write to the operator's bucket. That costs money per
+* object, it puts files somebody did not upload into a place they own, and on a
+* bucket whose credentials are read-only it cannot work at all. None of those
+* is a decision to make on an operator's behalf while they are not looking, so
+* it is off unless asked for — and when a write does fail, the request still
+* succeeds from memory and the failure is reported once rather than per request.
+*
+* ## What is stored, and where
+*
+* One object per (source object, transform, source version), under a reserved
+* prefix in the same bucket as the source. The key is the SHA-256 of the same
+* cache key the in-memory cache uses, so it already carries the source's
+* version: replacing an image changes its key, and the old rendition is
+* abandoned rather than served. Abandoned renditions are not collected — set a
+* lifecycle rule on the prefix, which is why the prefix is a single fixed one.
+*
+* The prefix is refused as a caller-supplied key at the route layer. Without
+* that, a rendition is an object at a path nobody authorized: `storageAuthorize`
+* and the declarative policies both reason about the *source* key, and a
+* rendition sits under a different one.
+*/
+/**
+* Where renditions live inside the source bucket.
+*
+* Fixed rather than configurable: it is the target of a lifecycle rule and of
+* the route-layer refusal below, and both of those are worth being able to
+* write down once, in the documentation, for every deployment.
+*/
+var RENDITION_PREFIX = "_rebase/renditions/";
+/** True for a key that names the reserved rendition space. */
+function isRenditionKey(key) {
+	return key.startsWith(RENDITION_PREFIX);
+}
+/**
+* Extensions for what `transformImage` can emit.
+*
+* The extension is cosmetic — the content type is read back from the object's
+* own metadata — but an unreadable bucket listing is a bucket nobody can reason
+* about, and `…-a3f9.webp` is the difference.
+*/
+var EXTENSIONS = {
+	"image/webp": "webp",
+	"image/avif": "avif",
+	"image/jpeg": "jpg",
+	"image/png": "png"
+};
+/**
+* The object key for a rendition.
+*
+* Hashed rather than derived from the source path: the source key can be up to
+* 1024 characters and the transform options are a JSON object, so a readable
+* composition would exceed key limits on exactly the paths people use — deep
+* per-user prefixes. The source key is kept in the object's metadata, where it
+* is available to anyone auditing the prefix and to nothing on the hot path.
+*/
+function renditionKey(cacheKey, contentType) {
+	const digest = createHash("sha256").update(cacheKey).digest("hex");
+	const extension = EXTENSIONS[contentType];
+	return `${RENDITION_PREFIX}${digest}${extension ? `.${extension}` : ""}`;
+}
+/**
+* A rendition's key when reading, where the content type is not yet known.
+*
+* Reads try the known extensions rather than storing an index: four `getObject`
+* calls at worst is still one round trip in the common case — the first
+* candidate is the format the request asked for — and an index is a second
+* thing to keep consistent with the objects it describes.
+*/
+function renditionKeyCandidates(cacheKey, preferred) {
+	const digest = createHash("sha256").update(cacheKey).digest("hex");
+	const extensions = Object.values(EXTENSIONS);
+	return (preferred && EXTENSIONS[preferred] ? [EXTENSIONS[preferred], ...extensions.filter((e) => e !== EXTENSIONS[preferred])] : extensions).map((extension) => `${RENDITION_PREFIX}${digest}.${extension}`);
+}
+function createDurableRenditionCache() {
+	let writeFailureAnnounced = false;
+	return {
+		async get(controller, cacheKey, bucket) {
+			for (const key of renditionKeyCandidates(cacheKey)) try {
+				const object = await controller.getObject(key, bucket);
+				if (!object) continue;
+				return {
+					data: Buffer.from(await object.arrayBuffer()),
+					contentType: object.type || "application/octet-stream"
+				};
+			} catch {
+				continue;
+			}
+			return null;
+		},
+		async put(controller, cacheKey, bucket, rendition) {
+			const key = renditionKey(cacheKey, rendition.contentType);
+			try {
+				await controller.putObject({
+					file: new File([new Uint8Array(rendition.data)], key.split("/").pop(), { type: rendition.contentType }),
+					key,
+					bucket,
+					metadata: {
+						contentType: rendition.contentType,
+						rebaseRendition: "1"
+					},
+					public: false
+				});
+			} catch (err) {
+				if (!writeFailureAnnounced) {
+					writeFailureAnnounced = true;
+					logger.warn(`[storage] Could not write an image rendition to the storage source, so transforms stay in the per-instance memory cache. Check that the bucket credentials permit writes under "${RENDITION_PREFIX}".`, { error: err instanceof Error ? err.message : String(err) });
+				}
+			}
+		}
+	};
+}
+//#endregion
 //#region src/storage/routes.ts
 /**
 * Storage REST API routes using Hono
@@ -3553,43 +4083,44 @@ var TusHandler = class {
 * to target a named storage backend. When omitted, the default backend
 * is used.
 */
-/** Shared image transform cache (LRU, 500 entries, 1 hour TTL). */
-var transformCache = new TransformCache();
-/**
-* Transforms currently being computed, keyed the same way the cache is.
-*
-* Without it, N concurrent requests for one uncached variant run N full
-* decode+encode pipelines — the cache only helps the requests that arrive
-* after the first one has finished. Joining the in-flight promise makes a
-* thundering herd cost one decode.
-*/
-var transformsInFlight = /* @__PURE__ */ new Map();
+var createTransformMemory = () => ({
+	cache: new TransformCache(),
+	inFlight: /* @__PURE__ */ new Map()
+});
 /**
 * Compute a transform, or join the one already running for this key.
 *
 * `loadSource` is only called on a real miss, so the concurrent requests that
 * join an in-flight transform do not each read the source object either.
 */
-async function transformOnce(cacheKey, options, loadSource) {
-	const cached = transformCache.get(cacheKey);
+async function transformOnce(memory, cacheKey, options, loadSource, durable) {
+	const cached = memory.cache.get(cacheKey);
 	if (cached) return cached;
-	const running = transformsInFlight.get(cacheKey);
+	const running = memory.inFlight.get(cacheKey);
 	if (running) return running;
 	const pending = (async () => {
 		try {
+			if (durable) {
+				const stored = await durable.cache.get(durable.controller, cacheKey, durable.bucket);
+				if (stored) {
+					memory.cache.set(cacheKey, stored.data, stored.contentType);
+					return stored;
+				}
+			}
 			const result = await transformImage(await loadSource(), options);
-			transformCache.set(cacheKey, result.data, result.contentType);
+			memory.cache.set(cacheKey, result.data, result.contentType);
+			if (durable) await durable.cache.put(durable.controller, cacheKey, durable.bucket, result);
 			return result;
 		} catch (err) {
 			if (err instanceof TransformOverloadedError) throw ApiError.serviceUnavailable(err.message, "TRANSFORM_OVERLOADED");
 			throw err;
 		}
 	})();
-	transformsInFlight.set(cacheKey, pending);
+	memory.inFlight.set(cacheKey, pending);
 	try {
 		return await pending;
 	} finally {
-		transformsInFlight.delete(cacheKey);
+		memory.inFlight.delete(cacheKey);
 	}
 }
 /**
@@ -3662,7 +4193,9 @@ function extractWildcardPath(c) {
 */
 function canonicalKeyOrBadRequest(key) {
 	try {
-		return canonicalStorageKey(key);
+		const canonical = canonicalStorageKey(key);
+		if (isRenditionKey(canonical)) throw new InvalidStorageKeyError(`"${RENDITION_PREFIX}" is reserved for derived image renditions and cannot be read or written directly.`);
+		return canonical;
 	} catch (err) {
 		throw new ApiError(400, "INVALID_STORAGE_KEY", err instanceof InvalidStorageKeyError ? err.message : "Invalid storage key");
 	}
@@ -3745,6 +4278,9 @@ function createStorageRoutes(config) {
 	const router = new Hono();
 	router.onError(errorHandler);
 	const { controller, registry, sources: declaredSources, requireAuth: requireAuth$1 = true, publicRead = false, authAdapter, authorize, authorizeData } = config;
+	const durableRenditions = config.renditionCache?.enabled ? createDurableRenditionCache() : void 0;
+	const transformMemory = createTransformMemory();
+	const fireTrigger = config.triggers?.length ? compileStorageTriggers(config.triggers) : void 0;
 	/**
 	* Run the per-object authorization hook, if one is configured.
 	*
@@ -3873,6 +4409,16 @@ function createStorageRoutes(config) {
 			metadata: Object.keys(metadata).length > 0 ? metadata : void 0,
 			bucket
 		});
+		await fireTrigger?.({
+			event: "finalize",
+			key: finalKey,
+			bucket,
+			storageId: canonicalStorageId(storageId),
+			size: uploadedFile.size,
+			contentType: uploadedFile.type || void 0,
+			user: triggerUser(c.get("user")),
+			at: (/* @__PURE__ */ new Date()).toISOString()
+		});
 		return c.json({
 			success: true,
 			data: result
@@ -3893,11 +4439,20 @@ function createStorageRoutes(config) {
 		await checkAuthorized(c, "read", resolvedPath, bucket, storageId);
 		c.header("X-Content-Type-Options", "nosniff");
 		const transformKeyPrefix = `${storageId || "(default)"}/${bucket}/${resolvedPath}`;
+		const sharedCacheable = publicRead === true || isPublicStoragePath(resolvedPath);
+		const cachePolicy = (maxAgeSeconds) => ({
+			isPublic: sharedCacheable,
+			maxAgeSeconds,
+			staleWhileRevalidateSeconds: 86400
+		});
+		const OBJECT_MAX_AGE = 60;
+		const TRANSFORM_MAX_AGE = 3600;
 		const transformOpts = transformOptionsOrBadRequest(c.req.query());
 		if (resolved.getType() === "local") {
 			const absolutePath = resolved.getAbsolutePath(resolvedPath, bucket ?? "default");
+			let localStat;
 			try {
-				await fsp.access(absolutePath);
+				localStat = await fsp.stat(absolutePath);
 			} catch {
 				throw ApiError.notFound("File not found");
 			}
@@ -3908,31 +4463,85 @@ function createStorageRoutes(config) {
 				contentType = JSON.parse(metadataRaw).contentType || contentType;
 			} catch {}
 			if (transformOpts && isTransformableImage(contentType)) {
-				const transformed = await transformOnce(transformCache.buildKey(transformKeyPrefix, transformOpts), transformOpts, async () => Buffer.from(await fsp.readFile(absolutePath)));
+				const sourceVersion = buildEntityTag(localStat.size, localStat.mtimeMs);
+				const cacheKey = transformMemory.cache.buildKey(`${transformKeyPrefix}@${sourceVersion}`, transformOpts);
+				const transformed = await transformOnce(transformMemory, cacheKey, transformOpts, async () => Buffer.from(await fsp.readFile(absolutePath)), durableRenditions ? {
+					cache: durableRenditions,
+					controller: resolved,
+					bucket
+				} : void 0);
+				const validators = objectValidators(transformed.data.byteLength, localStat.mtimeMs);
+				applyCacheHeaders(c, validators, cachePolicy(TRANSFORM_MAX_AGE));
+				if (isNotModified(c, validators)) return c.body(null, 304);
 				c.header("Content-Type", transformed.contentType);
-				c.header("Cache-Control", "public, max-age=31536000, immutable");
 				return c.body(new Uint8Array(transformed.data));
 			}
-			const fileContent = await fsp.readFile(absolutePath);
+			const validators = objectValidators(localStat.size, localStat.mtimeMs);
+			applyCacheHeaders(c, validators, cachePolicy(OBJECT_MAX_AGE));
 			const served = resolveServedContentType(contentType);
 			c.header("Content-Type", served.contentType);
 			if (served.attachment) c.header("Content-Disposition", "attachment");
+			c.header("Accept-Ranges", "bytes");
+			if (isNotModified(c, validators)) return c.body(null, 304);
+			const localRange = parseRange(c.req.header("range"), localStat.size);
+			if (localRange.kind === "unsatisfiable") {
+				c.header("Content-Range", unsatisfiableContentRange(localStat.size));
+				return c.body(null, 416);
+			}
+			if (localRange.kind === "range") {
+				const { start, length } = localRange.range;
+				const handle = await fsp.open(absolutePath, "r");
+				try {
+					const buffer = Buffer.alloc(length);
+					await handle.read(buffer, 0, length, start);
+					c.header("Content-Range", contentRange(localRange.range, localStat.size));
+					c.header("Content-Length", String(length));
+					return c.body(new Uint8Array(buffer), 206);
+				} finally {
+					await handle.close();
+				}
+			}
+			c.header("Content-Length", String(localStat.size));
+			const fileContent = await fsp.readFile(absolutePath);
 			return c.body(new Uint8Array(fileContent));
 		}
 		const fileObject = await resolved.getObject(resolvedPath, bucket);
 		if (!fileObject) throw ApiError.notFound("File not found");
 		const remoteContentType = fileObject.type || "application/octet-stream";
 		if (transformOpts && isTransformableImage(remoteContentType)) {
-			const transformed = await transformOnce(transformCache.buildKey(transformKeyPrefix, transformOpts), transformOpts, async () => Buffer.from(await fileObject.arrayBuffer()));
+			const sourceVersion = buildEntityTag(fileObject.size, fileObject.lastModified);
+			const cacheKey = transformMemory.cache.buildKey(`${transformKeyPrefix}@${sourceVersion}`, transformOpts);
+			const transformed = await transformOnce(transformMemory, cacheKey, transformOpts, async () => Buffer.from(await fileObject.arrayBuffer()), durableRenditions ? {
+				cache: durableRenditions,
+				controller: resolved,
+				bucket
+			} : void 0);
+			const validators = objectValidators(transformed.data.byteLength, fileObject.lastModified);
+			applyCacheHeaders(c, validators, cachePolicy(TRANSFORM_MAX_AGE));
+			if (isNotModified(c, validators)) return c.body(null, 304);
 			c.header("Content-Type", transformed.contentType);
-			c.header("Cache-Control", "public, max-age=31536000, immutable");
 			return c.body(new Uint8Array(transformed.data));
 		}
 		const servedRemote = resolveServedContentType(remoteContentType);
 		c.header("Content-Type", servedRemote.contentType);
 		if (servedRemote.attachment) c.header("Content-Disposition", "attachment");
-		c.header("Cache-Control", "public, max-age=3600, immutable");
+		const remoteValidators = objectValidators(fileObject.size, fileObject.lastModified);
+		applyCacheHeaders(c, remoteValidators, cachePolicy(OBJECT_MAX_AGE));
+		c.header("Accept-Ranges", "bytes");
+		if (isNotModified(c, remoteValidators)) return c.body(null, 304);
+		const remoteRange = parseRange(c.req.header("range"), fileObject.size);
+		if (remoteRange.kind === "unsatisfiable") {
+			c.header("Content-Range", unsatisfiableContentRange(fileObject.size));
+			return c.body(null, 416);
+		}
 		const buf = await fileObject.arrayBuffer();
+		if (remoteRange.kind === "range") {
+			const { start, end, length } = remoteRange.range;
+			c.header("Content-Range", contentRange(remoteRange.range, fileObject.size));
+			c.header("Content-Length", String(length));
+			return c.body(new Uint8Array(buf.slice(start, end + 1)), 206);
+		}
+		c.header("Content-Length", String(fileObject.size));
 		return c.body(new Uint8Array(buf));
 	});
 	/**
@@ -3980,6 +4589,14 @@ function createStorageRoutes(config) {
 		const { bucket, resolvedPath } = parseBucketAndPath(filePath);
 		await checkAuthorized(c, "delete", resolvedPath, bucket, storageId);
 		await resolved.deleteObject(resolvedPath, bucket);
+		await fireTrigger?.({
+			event: "delete",
+			key: resolvedPath,
+			bucket,
+			storageId: canonicalStorageId(storageId),
+			user: triggerUser(c.get("user")),
+			at: (/* @__PURE__ */ new Date()).toISOString()
+		});
 		return c.json({
 			success: true,
 			message: "File deleted"
@@ -4040,6 +4657,17 @@ function createStorageRoutes(config) {
 	const defaultCtrl = getDefaultController();
 	const tusHandler = new TusHandler(defaultCtrl.getType() === "local" ? defaultCtrl.getBasePath() : process.env.STORAGE_PATH || "./uploads", defaultCtrl, registry, authorize ? async (c, key, bucket, storageId) => {
 		await checkAuthorized(c, "write", key, bucket, storageId);
+	} : void 0, fireTrigger ? async (event) => {
+		await fireTrigger({
+			event: "finalize",
+			key: event.key,
+			bucket: event.bucket,
+			storageId: canonicalStorageId(event.storageId),
+			size: event.size,
+			contentType: event.contentType,
+			user: event.user,
+			at: (/* @__PURE__ */ new Date()).toISOString()
+		});
 	} : void 0);
 	tusHandler.startCleanup();
 	router.options("/tus", (_c) => tusHandler.options());
@@ -4091,11 +4719,11 @@ async function createStorageController(config) {
 	switch (config.type) {
 		case "local": return new LocalStorageController(config);
 		case "s3": {
-			const { S3StorageController } = await import("./S3StorageController-B2EDXXMH.js").then((n) => n.n);
+			const { S3StorageController } = await import("./S3StorageController-CWvvrRpF.js").then((n) => n.n);
 			return new S3StorageController(config);
 		}
 		case "gcs": {
-			const { GCSStorageController } = await import("./GCSStorageController-BEmDYFKc.js").then((n) => n.n);
+			const { GCSStorageController } = await import("./GCSStorageController-Bl7nmhdv.js").then((n) => n.n);
 			return new GCSStorageController(config);
 		}
 		default: throw new Error(`Unknown storage type: ${config.type}. Built-in types: local, s3, gcs. For other providers, implement the StorageController interface directly.`);
@@ -4161,6 +4789,79 @@ function assertStorageAccessControlConfigured(state, isProduction) {
 	logger.warn(STORAGE_NO_ACCESS_CONTROL_MESSAGE);
 }
 //#endregion
+//#region src/storage/policies.ts
+var StoragePolicyError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "StoragePolicyError";
+	}
+};
+var ALL_OPERATIONS = [
+	"read",
+	"write",
+	"delete",
+	"list"
+];
+function compile(policy, index) {
+	const label = `storagePolicies[${index}]`;
+	let pattern;
+	try {
+		pattern = compileStoragePattern(policy.path, label);
+	} catch (err) {
+		throw err instanceof StoragePatternError ? new StoragePolicyError(err.message) : err;
+	}
+	if (policy.operations !== void 0) {
+		if (!Array.isArray(policy.operations) || policy.operations.length === 0) throw new StoragePolicyError(`${label}: \`operations\` is empty, so this policy grants nothing. Remove it to grant all, or name the operations.`);
+		for (const operation of policy.operations) if (!ALL_OPERATIONS.includes(operation)) throw new StoragePolicyError(`${label}: \`operations\` names "${operation}", which is not a storage operation. Use ${ALL_OPERATIONS.map((o) => `"${o}"`).join(", ")}.`);
+	}
+	if (policy.allow !== "public" && policy.allow !== "authenticated" && typeof policy.allow !== "function") throw new StoragePolicyError(`${label}: \`allow\` must be "public", "authenticated", or a function. A policy with no \`allow\` grants nothing, which is never what was meant.`);
+	return {
+		pattern,
+		operations: new Set(policy.operations ?? ALL_OPERATIONS),
+		allow: policy.allow
+	};
+}
+/**
+* Compile a policy list into a {@link StorageAuthorize}.
+*
+* Compiled once, at boot, so a malformed pattern fails the start rather than the
+* first upload. `fallback` is an explicit `storageAuthorize`, consulted only
+* when no policy matched.
+*/
+function compileStoragePolicies(policies, fallback) {
+	if (!Array.isArray(policies)) throw new StoragePolicyError("`storagePolicies` must be an array.");
+	const compiled = policies.map(compile);
+	return async (ctx) => {
+		for (const policy of compiled) {
+			if (!policy.operations.has(ctx.operation)) continue;
+			const params = matchStoragePattern(policy.pattern, ctx.key);
+			if (!params) continue;
+			if (policy.allow === "public") return true;
+			if (policy.allow === "authenticated") {
+				if (ctx.user?.uid) return true;
+				continue;
+			}
+			if (await policy.allow({
+				...ctx,
+				params
+			})) return true;
+		}
+		if (fallback) return await fallback(ctx);
+		return false;
+	};
+}
+/**
+* The access-control function for a configuration, or `undefined` when it
+* declares none.
+*
+* Kept separate from {@link compileStoragePolicies} so `init` has one call to
+* make and one thing to reason about: policies, a hook, both, or neither.
+*/
+function resolveStorageAccessControl(config) {
+	if (config.storagePolicies?.length) return compileStoragePolicies(config.storagePolicies, config.storageAuthorize);
+	return config.storageAuthorize;
+}
+//#endregion
 //#region src/init/docs.ts
 /**
 * Serve the OpenAPI document, and Swagger UI outside production.
@@ -4173,7 +4874,7 @@ function assertStorageAccessControlConfigured(state, isProduction) {
 */
 async function mountOpenApiDocs(app, basePath, enableSwagger, serverCollections, requireAuth) {
 	if (enableSwagger === false || serverCollections.length === 0) return;
-	const { generateOpenApiSpec } = await import("./openapi-generator-BCKJRUS4.js");
+	const { generateOpenApiSpec } = await import("./openapi-generator-wFJo22gg.js");
 	app.get(`${basePath}/docs`, (c) => {
 		const spec = generateOpenApiSpec(serverCollections, {
 			basePath,
@@ -4256,6 +4957,101 @@ function createHealthCheck(defaultDriver, authSchemaCheck) {
 	};
 }
 //#endregion
+//#region src/functions/wait-until.ts
+/**
+* Pending background work, on a process-global slot for the reason given in
+* `../singleton.ts`: two copies of this module in one process must not each
+* hold half the work, or shutdown drains one half and drops the other.
+*/
+var PENDING_SLOT = Symbol.for("@rebasepro/server:pending-background-work");
+function pending() {
+	const global = globalThis;
+	if (!global[PENDING_SLOT]) global[PENDING_SLOT] = /* @__PURE__ */ new Set();
+	return global[PENDING_SLOT];
+}
+/**
+* Keep `work` alive past the response, on any runtime.
+*
+* Hand it a promise or a function returning one. Nothing is awaited: the
+* response goes out immediately, exactly as an un-awaited call would.
+*
+* What it buys, per host:
+*
+* - **Isolate hosts** (Workers, Deno Deploy, Vercel Edge): the host is told to
+*   keep the isolate alive until the promise settles. Without this the work is
+*   dropped when the response resolves.
+* - **Node**: the promise is tracked so {@link drainBackgroundWork} can wait for
+*   it during graceful shutdown instead of the process exiting out from under
+*   it.
+*
+* On every host a rejection is logged rather than left to the unhandled-rejection
+* handler, so the failure names the function it came from.
+*
+* @example
+* ```ts
+* app.post("/orders", requireAuth, async (c) => {
+*     const order = await createOrder(c);
+*     waitUntil(c, notifyWarehouse(order));   // caller does not wait for this
+*     return c.json({ id: order.id });
+* });
+* ```
+*/
+function waitUntil(c, work) {
+	let promise;
+	try {
+		promise = typeof work === "function" ? Promise.resolve(work()) : work;
+	} catch (error) {
+		logBackgroundFailure(c, error);
+		return;
+	}
+	const tracked = promise.catch((error) => {
+		logBackgroundFailure(c, error);
+	});
+	const set = pending();
+	set.add(tracked);
+	tracked.finally(() => set.delete(tracked));
+	try {
+		c.executionCtx?.waitUntil?.(tracked);
+	} catch {}
+}
+function logBackgroundFailure(c, error) {
+	logger.error("[functions] Background work failed after the response was sent", {
+		method: c.req?.method,
+		path: c.req?.path,
+		error: error instanceof Error ? error : new Error(String(error))
+	});
+}
+/** How many background promises are still in flight. Diagnostics and tests. */
+function pendingBackgroundWork() {
+	return pending().size;
+}
+/**
+* Wait for tracked background work to finish, up to `timeoutMs`.
+*
+* Called by the shutdown path after the server stops accepting connections. It
+* resolves to the number of promises still outstanding when it returned — `0`
+* for a clean drain, more than that for a timeout, which is worth a log line
+* because it means work was dropped.
+*
+* Rejections do not propagate: every tracked promise has already had a `catch`
+* attached by {@link waitUntil}.
+*/
+async function drainBackgroundWork(timeoutMs = 5e3) {
+	const set = pending();
+	if (set.size === 0) return 0;
+	let timer;
+	const expired = new Promise((resolve) => {
+		timer = setTimeout(() => resolve("timeout"), timeoutMs);
+		timer.unref?.();
+	});
+	try {
+		await Promise.race([Promise.allSettled([...set]), expired]);
+	} finally {
+		if (timer) clearTimeout(timer);
+	}
+	return set.size;
+}
+//#endregion
 //#region src/init/shutdown.ts
 /**
 * Install graceful-shutdown signal handlers for a Rebase backend.
@@ -4326,10 +5122,14 @@ function createShutdown(config) {
 					config.cronScheduler.stop();
 					logger.info("Cron scheduler stopped");
 				}
+				if (config.rlsAudit) config.rlsAudit.stop();
 				if (config.jobQueue) {
 					await config.jobQueue.stop();
 					logger.info("Job queue stopped");
 				}
+				const drainBudget = timeoutMs > 0 ? Math.min(5e3, timeoutMs) : 5e3;
+				const stillPending = await drainBackgroundWork(drainBudget);
+				if (stillPending > 0) logger.warn(`${stillPending} background task(s) handed to waitUntil() did not finish within ${drainBudget}ms and are being dropped. Give them an AbortSignal, or move work this long into a cron job or the job queue, where it is restartable.`);
 				for (const [key, rt] of Object.entries(config.realtimeServices)) try {
 					if (typeof rt.destroy === "function") {
 						await rt.destroy();
@@ -4354,18 +5154,1053 @@ function createShutdown(config) {
 	};
 }
 //#endregion
-//#region src/init/surfaces.ts
-/** Every surface, in a stable order. */
-var ALL_RUNTIME_SURFACES = [
-	"auth",
-	"data",
-	"storage",
-	"admin",
-	"functions",
-	"cron",
-	"meta",
-	"realtime"
-];
+//#region src/schema-edit/apply-schema-change.ts
+/**
+* The plan says the change is not applicable.
+*
+* Re-checked here rather than trusted from the planner: this module is the one
+* that writes and runs things, so the guarantee belongs where the consequence
+* is. A caller that built a plan by hand cannot route around it.
+*/
+var UnapplicableChangeError = class extends Error {
+	classified;
+	constructor(message, classified) {
+		super(message);
+		this.classified = classified;
+		this.name = "UnapplicableChangeError";
+	}
+};
+var DirtyWorkingTreeError = class extends Error {
+	paths;
+	constructor(paths) {
+		super("The working tree has uncommitted changes to files this would commit:\n" + paths.map((p) => `  • ${p}`).join("\n") + "\n  Commit or stash them first. A schema change must not sweep up work in progress.");
+		this.paths = paths;
+		this.name = "DirtyWorkingTreeError";
+	}
+};
+/**
+* Generate the commit, land it, then run the DDL.
+*
+* Throws only for things that mean *nothing happened*: a change the ensure path
+* cannot express, a dirty tree, or a failed commit. Once the commit lands,
+* every outcome is a result.
+*/
+async function applySchemaChange(input) {
+	const commit = input.plan;
+	if (!commit.classified.applicable) throw new UnapplicableChangeError("This change cannot be applied to a running database:\n" + commit.classified.changes.filter((change) => change.verdict !== "safe").map((change) => `  • ${change.detail}${change.remedy ? `\n    ${change.remedy}` : ""}`).join("\n"), commit.classified);
+	const plannedPaths = [...commit.files.map((file) => file.path), ...input.sourcePaths ?? []];
+	const dirty = (await input.repository.dirtyPaths()).filter((path) => plannedPaths.includes(path));
+	if (dirty.length > 0) throw new DirtyWorkingTreeError(dirty);
+	const branch = await input.repository.currentBranch();
+	const files = [...input.writeSource ? await input.writeSource() : [], ...commit.files];
+	const paths = files.map((file) => file.path);
+	await input.repository.writeFiles(files);
+	const sha = await input.repository.commit(paths, commit.message);
+	const committed = {
+		sha,
+		branch,
+		files: paths
+	};
+	if (commit.statements.length === 0) return {
+		committed,
+		applied: true,
+		statements: [],
+		classified: commit.classified,
+		summary: `Committed ${sha.slice(0, 9)} on ${branch}. No DDL was needed.`
+	};
+	try {
+		await input.apply(commit.statements);
+		return {
+			committed,
+			applied: true,
+			statements: commit.statements,
+			classified: commit.classified,
+			summary: `Committed ${sha.slice(0, 9)} on ${branch} and applied ${commit.statements.length} statement(s).`
+		};
+	} catch (err) {
+		const detail = err instanceof Error ? err.message : String(err);
+		return {
+			committed,
+			applied: false,
+			applyError: detail,
+			statements: commit.statements,
+			classified: commit.classified,
+			summary: `Committed ${sha.slice(0, 9)} on ${branch}, but the database was not changed: ${detail}. The change will be applied on the next boot.`
+		};
+	}
+}
+//#endregion
+//#region src/schema-edit/schema-edit-permissions.ts
+/**
+* A caller whose identity is a credential rather than a person.
+*
+* Two shapes, both set by the auth middleware:
+*
+* - the service key resolves to `uid: "service"` with `roles: ["admin"]`;
+* - an API key resolves to `uid: "api-key:<id>"`, with `service` among its
+*   roles and `admin` too when the key is an admin key.
+*
+* Detected by uid rather than by role, because `service` is also a role a
+* person could be granted, and a person with an unfortunate role name should
+* not lose the ability to commit under their own name.
+*/
+function machineKindOf(uid) {
+	if (uid === "service") return "service-key";
+	if (uid.startsWith("api-key:")) return "api-key";
+}
+/** Read the caller off the request context's `user`. */
+function classifyPrincipal(user) {
+	if (!user || typeof user !== "object") return {
+		kind: "anonymous",
+		uid: "",
+		roles: []
+	};
+	const { uid, roles } = user;
+	if (typeof uid !== "string" || uid.length === 0) return {
+		kind: "anonymous",
+		uid: "",
+		roles: []
+	};
+	const roleList = Array.isArray(roles) ? roles.filter((r) => typeof r === "string") : [];
+	const machineKind = machineKindOf(uid);
+	return {
+		kind: machineKind ? "machine" : "person",
+		uid,
+		roles: roleList,
+		machineKind
+	};
+}
+var MACHINE_REFUSAL = {
+	"service-key": "This request is authenticated with the server's service key, which identifies the server rather than a person. Applying a schema change writes a commit to your repository, and that commit needs an author.",
+	"api-key": "This request is authenticated with an API key, which identifies a credential rather than a person. Applying a schema change writes a commit to your repository, and that commit needs an author."
+};
+/**
+* What this caller may do.
+*
+* Assumes the admin gate has already run — this refines that decision rather
+* than replacing it, and an anonymous caller should never have reached here.
+* Handled anyway, because a capability function that trusts its caller to have
+* checked is one bad refactor away from granting everything.
+*/
+function schemaEditCapabilities(principal, policy = {}) {
+	if (principal.kind === "anonymous") return {
+		plan: false,
+		apply: false,
+		code: "UNAUTHORIZED",
+		reason: "This request carries no identity."
+	};
+	if (principal.kind === "machine" && !policy.allowMachineApply) return {
+		plan: true,
+		apply: false,
+		code: "SCHEMA_EDIT_REQUIRES_A_PERSON",
+		reason: `${MACHINE_REFUSAL[principal.machineKind ?? "api-key"]} Sign in as a user to apply it, or set \`liveSchema.allowMachineApply\` if an automated schema change is what you want.`
+	};
+	return {
+		plan: true,
+		apply: true
+	};
+}
+/**
+* The git identity for a machine that has been allowed to apply.
+*
+* Named for what it is. An operator reading `git log` a month from now should
+* be able to tell a change somebody made from one a pipeline made, and a
+* credential wearing a person-shaped name is how that distinction is lost.
+*/
+function machineCommitAuthor(principal) {
+	return {
+		name: principal.machineKind === "service-key" ? "Rebase service key" : `Rebase API key (${principal.uid.replace(/^api-key:/, "")})`,
+		email: `${principal.uid.replace(/[^A-Za-z0-9._-]/g, "-")}@machines.noreply.rebase.pro`
+	};
+}
+//#endregion
+//#region src/api/live-schema-routes.ts
+/**
+* Creating and altering collections against a running backend.
+*
+* The existing schema editor rewrites collection source and is off in
+* production, for an honest reason: a deployed server's files are rebuilt from
+* the repository on every deploy, so an edit there would be discarded. These
+* routes are the answer to that — they commit the change to the repository the
+* server is running in, and *then* apply the DDL, so the edit survives the next
+* deploy because the deploy is built from it.
+*
+* Two routes, and the first one is the important one.
+*
+* ## Why `plan` exists separately from `apply`
+*
+* `POST /plan` has no side effects and answers what would happen. That is not a
+* convenience: a schema change has three possible verdicts and two of them are
+* refusals, so a UI that could only try-and-see would be asking people to
+* discover `needs-migration` by pressing a button on a live database.
+*
+* It also surfaces the `diverges` cases, which are the ones nothing else in the
+* system reports — a required property that will arrive nullable, an enum value
+* that will never land. Those apply "successfully" today and leave a database
+* that does not match its configuration.
+*
+* ## What these routes will not do
+*
+* Anything the boot-time ensure path cannot express. No drops, no type changes,
+* no primary keys. The planner refuses them and this refuses to route around it
+* — `applySchemaChange` re-checks rather than trusting the plan it is handed.
+*/
+/**
+* The git identity for the caller.
+*
+* `undefined` when the request carries no user — a service key, say — which
+* lets the repository fall back to its own git config rather than inventing a
+* name for somebody.
+*/
+function commitAuthor(user) {
+	if (!user || typeof user !== "object") return void 0;
+	const { uid, email, displayName } = user;
+	if (!uid) return void 0;
+	return {
+		name: displayName || email || uid,
+		email: email || `${uid}@users.noreply.rebase.pro`
+	};
+}
+/**
+* What a collection id may contain.
+*
+* The same alphabet the AST editor sanitises to, stated at the boundary
+* instead. The id becomes a *filename* — `<collectionsDir>/<id>.ts` — in two
+* places, and only one of them checked it: the editor refuses a traversal when
+* it writes, but the caller derives the same path first, to hand the dirty
+* check the paths it is about to touch. A refusal that arrives one layer in is
+* a refusal that the layer above already acted on.
+*/
+var SAFE_COLLECTION_ID = /^[A-Za-z0-9_-]+$/;
+var parseProposed = (body) => {
+	const candidate = body;
+	if (!candidate?.collectionId || typeof candidate.collectionId !== "string") throw ApiError.badRequest("`collectionId` is required.", "INVALID_CHANGE");
+	if (!SAFE_COLLECTION_ID.test(candidate.collectionId)) throw ApiError.badRequest(`"${candidate.collectionId}" is not a usable collection id. It becomes a filename, so it may contain only letters, numbers, underscores and hyphens.`, "INVALID_CHANGE");
+	if (!candidate.collection || typeof candidate.collection !== "object") throw ApiError.badRequest("`collection` is required.", "INVALID_CHANGE");
+	return {
+		collectionId: candidate.collectionId,
+		collection: candidate.collection
+	};
+};
+/**
+* The proposed collection set: everything as it is, with one collection
+* replaced or added.
+*/
+function proposedCollections(current, change) {
+	const next = {
+		...change.collection,
+		slug: change.collectionId
+	};
+	const replaced = current.map((collection) => collection.slug === change.collectionId ? next : collection);
+	return replaced.some((collection) => collection.slug === change.collectionId) ? replaced : [...replaced, next];
+}
+/**
+* What still has to happen after this change lands, if anything.
+*
+* Only one thing so far, and it is the one that would otherwise be silent: a
+* project that replays migrations needs this change recorded as one, or its
+* next environment is built without it.
+*/
+function followUpFor(config, statements) {
+	if (statements.length === 0) return [];
+	if (!config.usesVersionedMigrations?.()) return [];
+	return ["This project keeps versioned migrations, and applying here does not write one — a migration needs Atlas and a throwaway database, which a running server does not have. `drizzle/schema.sql` has been committed and is what Atlas diffs against, so run `rebase db generate` to record this change. Without it, the next environment built by replaying migrations will not have it."];
+}
+function createLiveSchemaRoutes(config) {
+	const router = new Hono();
+	router.onError(errorHandler);
+	/**
+	* Whether this backend can edit its schema, and what is missing when it
+	* cannot.
+	*
+	* Every optional surface in this API answers `GET …/status` — see
+	* `docs/api-conventions.md`. The panel asks before it offers the control,
+	* because the alternative is a button that looks available and fails on
+	* press with a refusal the person could have been told about up front.
+	*
+	* Ordered by how fundamental the obstacle is: a driver that cannot plan is
+	* a different conversation from a missing dependency, which is a different
+	* conversation from a deployment with no source. Reporting the first one
+	* that applies is what keeps the message actionable.
+	*/
+	router.get("/status", async (c) => {
+		const admin = config.getAdmin();
+		const repository = config.getRepository();
+		if (!isSchemaEditingAdmin(admin)) return c.json({
+			enabled: false,
+			canPlan: false,
+			code: "SCHEMA_EDITING_UNSUPPORTED",
+			reason: "This backend's driver cannot plan schema changes. Live editing is available on Postgres."
+		});
+		if (!config.writeSource) return c.json({
+			enabled: false,
+			canPlan: true,
+			code: "SCHEMA_EDITOR_MISSING_DEPENDENCY",
+			reason: "Rewriting collection source needs `ts-morph`, which is not installed on this server. Run `pnpm add -D ts-morph@28.0.0` to enable it."
+		});
+		if (!repository) return c.json({
+			enabled: false,
+			canPlan: true,
+			code: "SCHEMA_EDITING_NO_REPOSITORY",
+			reason: "There is no repository to commit to. Live schema editing writes the change to your project's source before applying it, so it needs the project mounted — a deployment running from a built bundle has compiled output and no source to edit."
+		});
+		const capabilities = schemaEditCapabilities(classifyPrincipal(c.get("user")), config.policy);
+		let branch;
+		try {
+			branch = await repository.currentBranch();
+		} catch {
+			branch = void 0;
+		}
+		return c.json({
+			enabled: true,
+			canPlan: capabilities.plan,
+			canApply: capabilities.apply,
+			applyRefusedBecause: capabilities.reason,
+			applyRefusedCode: capabilities.code,
+			repository: repository.root,
+			branch
+		});
+	});
+	/** The admin, or a refusal naming what is missing rather than a 500. */
+	const requirePlanner = () => {
+		const admin = config.getAdmin();
+		if (!isSchemaEditingAdmin(admin)) throw ApiError.serviceUnavailable("This backend's driver cannot plan schema changes. Live editing is available on Postgres.", "SCHEMA_EDITING_UNSUPPORTED");
+		return admin;
+	};
+	const requireRepository = (author) => {
+		const repository = config.getRepository(author);
+		if (!repository) throw ApiError.serviceUnavailable("There is no repository to commit to. Live schema editing writes the change to your project's source before applying it, so it needs the project mounted — a deployment running from a built bundle has compiled output and no source to edit.", "SCHEMA_EDITING_NO_REPOSITORY");
+		return repository;
+	};
+	/**
+	* What would happen. No side effects, and deliberately reachable even when
+	* there is no repository — knowing a change is blocked is useful before
+	* knowing where it would be committed.
+	*/
+	router.post("/plan", async (c) => {
+		const change = parseProposed(await c.req.json());
+		const admin = requirePlanner();
+		const capabilities = schemaEditCapabilities(classifyPrincipal(c.get("user")), config.policy);
+		if (!capabilities.plan) throw ApiError.forbidden(capabilities.reason ?? "This caller may not plan schema changes.", capabilities.code ?? "FORBIDDEN");
+		const before = config.getCollections();
+		const after = proposedCollections(before, change);
+		const plan = await admin.planSchemaChange(before, after, { paths: config.commitPaths });
+		return c.json({
+			applicable: plan.classified.applicable,
+			verdict: plan.classified.verdict,
+			changes: plan.classified.changes,
+			statements: plan.statements,
+			files: plan.files.map((file) => file.path),
+			message: plan.message,
+			withheldConstraints: plan.withheldConstraints ?? [],
+			followUp: followUpFor(config, plan.statements)
+		});
+	});
+	router.post("/apply", async (c) => {
+		const change = parseProposed(await c.req.json());
+		const admin = requirePlanner();
+		const principal = classifyPrincipal(c.get("user"));
+		const capabilities = schemaEditCapabilities(principal, config.policy);
+		if (!capabilities.apply) throw ApiError.forbidden(capabilities.reason ?? "This caller may not apply schema changes.", capabilities.code ?? "FORBIDDEN");
+		const author = principal.kind === "machine" ? machineCommitAuthor(principal) : commitAuthor(c.get("user"));
+		const repository = requireRepository(author);
+		const before = config.getCollections();
+		const after = proposedCollections(before, change);
+		const plan = await admin.planSchemaChange(before, after, { paths: config.commitPaths });
+		if (!plan.classified.applicable) {
+			const blocking = plan.classified.changes.filter((c) => c.verdict !== "safe");
+			throw ApiError.badRequest("This change cannot be applied to a running database:\n" + blocking.map((c) => `  • ${c.detail}${c.remedy ? `\n    ${c.remedy}` : ""}`).join("\n"), "SCHEMA_CHANGE_UNAPPLICABLE", { changes: plan.classified.changes });
+		}
+		try {
+			const result = await applySchemaChange({
+				plan,
+				repository,
+				sourcePaths: config.sourcePathsFor?.(change) ?? [],
+				writeSource: config.writeSource ? () => config.writeSource(change) : void 0,
+				apply: async (statements) => {
+					const sql = config.getAdmin();
+					if (!isSQLAdmin(sql)) throw new Error("The driver cannot run SQL, so the change cannot be applied here.");
+					for (const statement of statements) await sql.executeSql(statement);
+				}
+			});
+			logger.info(`[schema-edit] ${result.summary}`);
+			return c.json({
+				...result,
+				withheldConstraints: plan.withheldConstraints ?? [],
+				followUp: followUpFor(config, plan.statements)
+			});
+		} catch (err) {
+			if (err instanceof UnapplicableChangeError) throw ApiError.badRequest(err.message, "SCHEMA_CHANGE_UNAPPLICABLE", { changes: err.classified.changes });
+			if (err instanceof DirtyWorkingTreeError) throw ApiError.conflict(err.message, "SCHEMA_EDIT_DIRTY_TREE");
+			throw ApiError.badRequest(err instanceof Error ? err.message : String(err), "SCHEMA_CHANGE_FAILED");
+		}
+	});
+	return router;
+}
+//#endregion
+//#region src/api/mount.ts
+/**
+* Mounting a surface at its canonical path, and at the path it used to have.
+*
+* Several admin-only surfaces grew up at the top level — `/api/cron`,
+* `/api/logs`, `/api/schema-editor` — while the ones added later went under
+* `/api/admin`. Nothing was wrong with either choice on its own; what was wrong
+* was having both, because the shape of the path stopped predicting whether a
+* caller needed to be an admin. `docs/api-conventions.md` states the rule the
+* repo now follows and this module is how existing callers survive it.
+*
+* ## Why an alias rather than a redirect
+*
+* A 308 would be correct and would break things anyway: `fetch` follows
+* redirects but drops an `Authorization` header on a cross-origin hop, and a
+* good deal of client code posts to these paths with one attached. An alias
+* serves the same handler at both paths, so nothing observable changes for a
+* caller that has not moved yet.
+*
+* The alias is not silent. Every response through it carries `Deprecation` and
+* a `Link` naming the successor, which is what makes the old path removable
+* later: an operator can find the callers in their own logs rather than
+* discovering them when the path is gone.
+*/
+/**
+* Mount `router` at its canonical path, and at its legacy path when it has one.
+*
+* The same router instance serves both, so the two paths cannot drift: there is
+* one set of handlers and one gate, and an alias that forgot to apply the admin
+* gate is not a state this can reach.
+*/
+function mountWithLegacyAlias(app, router, options) {
+	app.route(options.canonical, router);
+	if (!options.legacy) {
+		logger.debug(`${options.surface} routes mounted`, { path: options.canonical });
+		return;
+	}
+	const alias = new Hono();
+	alias.use("/*", async (c, next) => {
+		await next();
+		c.header("Deprecation", "true");
+		c.header("Link", `<${options.canonical}>; rel="successor-version"`);
+	});
+	alias.route("/", router);
+	app.route(options.legacy, alias);
+	logger.debug(`${options.surface} routes mounted`, {
+		path: options.canonical,
+		deprecatedAlias: options.legacy
+	});
+}
+function findProjectRoot(startDir, levels = 5) {
+	let dir = path$1.resolve(startDir);
+	for (let i = 0; i <= levels; i++) {
+		if (fs$1.existsSync(path$1.join(dir, "rebase.json"))) return dir;
+		const parent = path$1.dirname(dir);
+		if (parent === dir) return void 0;
+		dir = parent;
+	}
+}
+/**
+* The generated-artifact paths for a project, expressed relative to the
+* repository that will hold the commit.
+*
+* Returns `undefined` when there is nothing to correct — no project marker, or
+* a project that *is* the repository — so the caller passes no override and the
+* defaults stand. Saying "no change needed" is different from saying
+* "the change is a no-op prefix", and only the first leaves the existing
+* behaviour untouched for every project that already worked.
+*/
+function commitPathsFor(collectionsDir, repositoryRoot) {
+	const projectRoot = findProjectRoot(collectionsDir);
+	if (!projectRoot) return void 0;
+	const prefix = path$1.relative(path$1.resolve(repositoryRoot), projectRoot);
+	if (prefix === "" || prefix.startsWith("..")) return void 0;
+	const relocate = (p) => path$1.posix.join(...prefix.split(path$1.sep), p);
+	return {
+		schemaFile: relocate(DEFAULT_COMMIT_PATHS.schemaFile),
+		ddlFile: relocate(DEFAULT_COMMIT_PATHS.ddlFile),
+		policiesFile: relocate(DEFAULT_COMMIT_PATHS.policiesFile),
+		searchFile: relocate(DEFAULT_COMMIT_PATHS.searchFile)
+	};
+}
+/**
+* Does this project keep versioned migrations?
+*
+* It matters because live schema editing does not write one, and cannot: a
+* migration is Atlas's format with an integrity file, minted by an external
+* binary against a throwaway database. A server process has neither.
+*
+* What it *does* write is `drizzle/schema.sql`, which is exactly the input
+* `rebase db generate` diffs against — so the migration is one command away.
+* The hazard is nobody saying so. A project that deploys by replaying
+* migrations would build its next environment without this change, having been
+* told the change was applied.
+*/
+function usesVersionedMigrations(collectionsDir) {
+	const projectRoot = findProjectRoot(collectionsDir);
+	if (!projectRoot) return false;
+	const dir = path$1.join(projectRoot, "drizzle", "migrations");
+	try {
+		return fs$1.existsSync(dir) && fs$1.readdirSync(dir).some((f) => f.endsWith(".sql"));
+	} catch {
+		return true;
+	}
+}
+//#endregion
+//#region src/schema-edit/github-repository.ts
+/**
+* A {@link SchemaEditRepository} backed by a repository on GitHub.
+*
+* This is the implementation for a deployment whose source is not on the
+* machine — a Cloud tenant runs a built bundle, and its repository lives
+* somewhere else entirely. The local one commits with `git`; this one has no
+* working tree at all and uses the Git Data API, which creates a blob, a tree,
+* a commit and moves a ref in four calls. Nothing is cloned.
+*
+* ## Authentication
+*
+* A GitHub App, not a token per project. The app holds one private key
+* globally; each project stores an `installationId`, which is not a secret. A
+* per-project personal access token would mean a credential to hold, rotate and
+* leak for every customer.
+*
+* Three steps, and the middle one is the one people miss:
+*
+* 1. sign a JWT with the private key — RS256, `iss` the app's id, ten minutes
+*    at most, which authenticates *the app* and can touch no repository;
+* 2. exchange it for an **installation access token**, which expires in an hour
+*    and is what can actually write;
+* 3. use that token as the bearer for the Git Data calls.
+*
+* The token is cached until shortly before it expires, because minting one is a
+* round trip and a schema edit makes several calls.
+*
+* ## What `dirtyPaths` means without a working tree
+*
+* Nothing, directly — there is no tree to be dirty. The equivalent hazard is the
+* branch moving under us between reading its head and writing a commit onto it,
+* and that is handled where it belongs: the commit is created against the head
+* read at the start, and updating the ref is **not** forced, so GitHub rejects
+* it if anything else landed meanwhile. A lost race is a refusal, never a
+* silent overwrite of somebody's commit.
+*/
+var GITHUB_API = "https://api.github.com";
+/** GitHub caps app JWTs at ten minutes; nine leaves room for clock skew. */
+var APP_JWT_TTL_SECONDS = 540;
+/** Renew an installation token this long before it lapses. */
+var TOKEN_REFRESH_MARGIN_MS = 6e4;
+var GitHubApiError = class extends Error {
+	status;
+	path;
+	constructor(status, path, detail) {
+		super(`GitHub ${path} failed with ${status}: ${detail}`);
+		this.status = status;
+		this.path = path;
+		this.name = "GitHubApiError";
+	}
+};
+/** base64url, which JWT requires and `Buffer` does not produce by default. */
+var b64url = (input) => Buffer.from(input).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+/**
+* A JWT authenticating the app itself.
+*
+* `iat` is backdated by a minute: GitHub rejects a token whose `iat` is in its
+* future, and a server clock a few seconds fast is enough to trigger it.
+*/
+function createAppJwt(appId, privateKey, nowMs) {
+	const issued = Math.floor(nowMs / 1e3) - 60;
+	const header = b64url(JSON.stringify({
+		alg: "RS256",
+		typ: "JWT"
+	}));
+	const payload = b64url(JSON.stringify({
+		iat: issued,
+		exp: issued + APP_JWT_TTL_SECONDS,
+		iss: appId
+	}));
+	const signer = createSign("RSA-SHA256");
+	signer.update(`${header}.${payload}`);
+	signer.end();
+	return `${header}.${payload}.${b64url(signer.sign(privateKey))}`;
+}
+function createGitHubRepository(options) {
+	const doFetch = options.fetchImpl ?? fetch;
+	const now = options.now ?? (() => Date.now());
+	const { owner, repo, branch } = options;
+	/** Files staged by `writeFiles`, held until `commit`. */
+	let staged = [];
+	let token;
+	const call = async (path, init) => {
+		const { auth, ...rest } = init;
+		const response = await doFetch(`${GITHUB_API}${path}`, {
+			...rest,
+			headers: {
+				accept: "application/vnd.github+json",
+				"x-github-api-version": "2022-11-28",
+				authorization: `Bearer ${auth}`,
+				"content-type": "application/json",
+				...rest.headers ?? {}
+			}
+		});
+		if (!response.ok) throw new GitHubApiError(response.status, path, (await response.text()).slice(0, 400));
+		return await response.json();
+	};
+	/**
+	* The bearer for the Git Data calls.
+	*
+	* A token is already one. An app has to mint one: sign a JWT with the
+	* private key, which authenticates the *app* and can touch no repository,
+	* then exchange it for an installation token, which expires in an hour and
+	* is what can actually write. Cached until shortly before it lapses,
+	* because a schema edit makes several calls and minting is a round trip.
+	*/
+	const bearer = async () => {
+		if (options.auth.kind === "token") return options.auth.token;
+		if (token && token.expiresAtMs - TOKEN_REFRESH_MARGIN_MS > now()) return token.value;
+		const jwt = createAppJwt(options.auth.appId, options.auth.privateKey, now());
+		const minted = await call(`/app/installations/${options.auth.installationId}/access_tokens`, {
+			method: "POST",
+			auth: jwt
+		});
+		token = {
+			value: minted.token,
+			expiresAtMs: Date.parse(minted.expires_at)
+		};
+		return token.value;
+	};
+	return {
+		root: `${owner}/${repo}`,
+		async currentBranch() {
+			return branch;
+		},
+		async dirtyPaths() {
+			return [];
+		},
+		async writeFiles(files) {
+			staged = files;
+		},
+		/**
+		* One file's current contents, read from the branch this commits onto.
+		*
+		* `undefined` for a file that is not there — a collection being created
+		* has no source yet — and that is a normal answer rather than a
+		* failure. Anything else is surfaced: a 403 from a token without
+		* `contents:read` must not be mistaken for an empty repository, or the
+		* editor would rewrite from nothing and the commit would delete
+		* somebody's collection.
+		*/
+		async readFile(filePath) {
+			const auth = await bearer();
+			const response = await doFetch(`${GITHUB_API}/repos/${owner}/${repo}/contents/${filePath.split("/").map(encodeURIComponent).join("/")}?ref=${encodeURIComponent(branch)}`, { headers: {
+				accept: "application/vnd.github+json",
+				"x-github-api-version": "2022-11-28",
+				authorization: `Bearer ${auth}`
+			} });
+			if (response.status === 404) return void 0;
+			if (!response.ok) throw new GitHubApiError(response.status, `/repos/${owner}/${repo}/contents/${filePath}`, (await response.text()).slice(0, 400));
+			const body = await response.json();
+			if (typeof body.content !== "string") return void 0;
+			if (body.encoding && body.encoding !== "base64") return void 0;
+			return Buffer.from(body.content, "base64").toString("utf8");
+		},
+		async commit(paths, message) {
+			if (staged.length === 0) throw new Error("Refusing to commit with nothing staged.");
+			const auth = await bearer();
+			const base = `/repos/${owner}/${repo}`;
+			const headSha = (await call(`${base}/git/ref/heads/${encodeURIComponent(branch)}`, { auth })).object.sha;
+			const head = await call(`${base}/git/commits/${headSha}`, { auth });
+			const tree = await Promise.all(staged.filter((file) => paths.includes(file.path)).map(async (file) => {
+				const blob = await call(`${base}/git/blobs`, {
+					method: "POST",
+					auth,
+					body: JSON.stringify({
+						content: file.contents,
+						encoding: "utf-8"
+					})
+				});
+				return {
+					path: file.path,
+					mode: "100644",
+					type: "blob",
+					sha: blob.sha
+				};
+			}));
+			const created = await call(`${base}/git/trees`, {
+				method: "POST",
+				auth,
+				body: JSON.stringify({
+					base_tree: head.tree.sha,
+					tree
+				})
+			});
+			const commit = await call(`${base}/git/commits`, {
+				method: "POST",
+				auth,
+				body: JSON.stringify({
+					message,
+					tree: created.sha,
+					parents: [headSha],
+					...options.author ? { author: {
+						...options.author,
+						date: new Date(now()).toISOString()
+					} } : {}
+				})
+			});
+			await call(`${base}/git/refs/heads/${encodeURIComponent(branch)}`, {
+				method: "PATCH",
+				auth,
+				body: JSON.stringify({
+					sha: commit.sha,
+					force: false
+				})
+			});
+			staged = [];
+			return commit.sha;
+		}
+	};
+}
+//#endregion
+//#region src/schema-edit/remote-source.ts
+/**
+* Rewriting a collection whose source is not on this machine.
+*
+* A bundle deployment — every Cloud tenant, and any self-host running built
+* output — ships *compiled* collections. The AST editor rewrites the
+* TypeScript, opening it from a directory on disk, so there is nothing for it
+* to open. That single fact is why live schema editing was local-only: not
+* authentication, not the Git Data API, which have worked for a while, but the
+* editor needing a file.
+*
+* So the file is brought to it. Read the current source from the repository,
+* put it in a scratch directory shaped the way the editor expects, let the
+* editor do exactly what it does locally, and read the result back. The editor
+* is unchanged and untouched — which matters, because it is the part that knows
+* how to preserve a collection file's imports, comments and formatting, and a
+* second implementation of that for the remote case would be a second thing to
+* get wrong.
+*
+* ## What the scratch directory holds
+*
+* One file: the collection being edited. Not the whole directory.
+*
+* The editor resolves `<dir>/<id>.ts` and rewrites it in place; it does not
+* read its siblings to do that. Fetching them all would be a request per
+* collection on every save, for files nothing reads. A collection that does not
+* exist yet is simply absent, which is the same state the editor sees locally
+* when somebody adds one.
+*/
+/**
+* Fetch, rewrite, and return the changed file — without leaving anything behind.
+*
+* The scratch directory is removed on every path, including the failing one. It
+* holds a copy of the customer's collection source, and a temp directory that
+* accumulates those on a long-running server is a slow leak of exactly the
+* thing worth not leaking.
+*/
+async function rewriteRemoteCollection(options, collectionId, collection) {
+	const { repository, collectionsPath, edit } = options;
+	if (!repository.readFile) throw new Error("This repository cannot read a file, so the collection source cannot be rewritten for a deployment that has none on disk.");
+	const repoPath = `${collectionsPath.replace(/\/+$/, "")}/${collectionId}.ts`;
+	const existing = await repository.readFile(repoPath);
+	const scratch = await fsp.mkdtemp(path$1.join(os.tmpdir(), "rebase-remote-source-"));
+	try {
+		if (existing !== void 0) await fsp.writeFile(path$1.join(scratch, `${collectionId}.ts`), existing, "utf8");
+		await edit(scratch, collectionId, collection);
+		return [{
+			path: repoPath,
+			contents: await fsp.readFile(path$1.join(scratch, `${collectionId}.ts`), "utf8")
+		}];
+	} finally {
+		await fsp.rm(scratch, {
+			recursive: true,
+			force: true
+		});
+	}
+}
+//#endregion
+//#region src/schema-edit/local-git-repository.ts
+/**
+* A {@link SchemaEditRepository} backed by the working tree the server is
+* running in.
+*
+* This is the implementation for the two deployment shapes that have their
+* source on disk — `rebase dev` on a developer's machine, and a self-host with
+* the project mounted. Both have a `.git` next to the collections, so a commit
+* is a local `git commit`: nothing to authenticate, nothing to fetch, no token.
+*
+* The remote implementation, for a Cloud tenant whose repository lives on
+* GitHub, satisfies the same interface and is a separate file. Neither knows
+* about the other.
+*
+* ## Why it stages paths explicitly
+*
+* Never `git add -A`. A schema change runs while somebody may have unrelated
+* work in the tree, and sweeping that into a commit nobody wrote is worse than
+* refusing — it is a commit that cannot be reviewed because nobody knows what
+* is in it. `applySchemaChange` refuses up front when the tree already has
+* *our* files modified; this stages the exact list and nothing else.
+*/
+var run$1 = promisify$1(execFile);
+var GitCommandError = class extends Error {
+	constructor(command, detail) {
+		super(`git ${command} failed: ${detail}`);
+		this.name = "GitCommandError";
+	}
+};
+/**
+* `--` before paths, always: a file called `main` would otherwise be read as a
+* revision, and the failure mode is a command that does something else entirely.
+*/
+async function git(root, args) {
+	try {
+		const { stdout } = await run$1("git", [
+			"-c",
+			"core.fsmonitor=false",
+			...args
+		], {
+			cwd: root,
+			maxBuffer: 32 * 1024 * 1024
+		});
+		return stdout;
+	} catch (err) {
+		const detail = err instanceof Error ? err.stderr?.trim() || err.message : String(err);
+		throw new GitCommandError(args[0] ?? "", detail);
+	}
+}
+/**
+* The top of the working tree containing `startDir`, or undefined.
+*
+* Resolved by asking git rather than by walking for a `.git`, because a
+* worktree's `.git` is a file and a submodule's is neither where nor what a
+* naive walk expects.
+*/
+async function findRepositoryRoot(startDir) {
+	try {
+		const root = (await git(startDir, ["rev-parse", "--show-toplevel"])).trim();
+		return root.length > 0 ? root : void 0;
+	} catch {
+		return;
+	}
+}
+function createLocalGitRepository(options) {
+	const { root } = options;
+	return {
+		root,
+		async currentBranch() {
+			const branch = (await git(root, [
+				"rev-parse",
+				"--abbrev-ref",
+				"HEAD"
+			])).trim();
+			if (branch === "HEAD") throw new GitCommandError("rev-parse", "the working tree is on a detached HEAD, so there is no branch to commit to. Check out a branch first.");
+			return branch;
+		},
+		async dirtyPaths() {
+			const out = await git(root, [
+				"status",
+				"--porcelain=v1",
+				"-z"
+			]);
+			const paths = [];
+			for (const entry of out.split("\0")) {
+				if (!entry) continue;
+				const file = entry.slice(3);
+				if (file) paths.push(file);
+			}
+			return paths;
+		},
+		async writeFiles(files) {
+			for (const file of files) {
+				const absolute = path$2.resolve(root, file.path);
+				if (!absolute.startsWith(path$2.resolve(root) + path$2.sep)) throw new Error(`Refusing to write outside the repository: ${file.path}`);
+				await fs$2.mkdir(path$2.dirname(absolute), { recursive: true });
+				await fs$2.writeFile(absolute, file.contents, "utf8");
+			}
+		},
+		async commit(paths, message) {
+			if (paths.length === 0) throw new Error("Refusing to commit an empty path list.");
+			await git(root, [
+				"add",
+				"--",
+				...paths
+			]);
+			if ((await git(root, [
+				"diff",
+				"--cached",
+				"--name-only",
+				"--",
+				...paths
+			])).trim() === "") return (await git(root, ["rev-parse", "HEAD"])).trim();
+			const identity = options.author ? [
+				"-c",
+				`user.name=${options.author.name}`,
+				"-c",
+				`user.email=${options.author.email}`
+			] : [];
+			await git(root, [
+				...identity,
+				"commit",
+				"--only",
+				"-m",
+				message,
+				"--",
+				...paths
+			]);
+			return (await git(root, ["rev-parse", "HEAD"])).trim();
+		}
+	};
+}
+//#endregion
+//#region src/rls-audit/index.ts
+/**
+* The row-level-security audit, on a schedule.
+*
+* `@rebasepro/rls-check` is a thorough, read-only audit of a database's RLS —
+* more thorough, on security specifically, than the dashboard advisors it
+* competes with. And nobody runs it, because it is a command, and a command is
+* something you have to remember. A check that has to be remembered is a check
+* that reports a clean database right up until the day it matters.
+*
+* This runs it on a timer against the database the server is already using, and
+* makes the result readable without a terminal. Nothing else about the checker
+* changes: same package, same checks, same output.
+*
+* ## Why it is off by default
+*
+* It opens its own connection and introspects the whole catalog. That is cheap
+* and read-only, but it is not nothing, and a background query nobody asked for
+* is a poor default for a library. Enabling it is one line, and the boot log
+* says so when it is off.
+*
+* ## Why the scanner is injected rather than imported
+*
+* `@rebasepro/server` is engine-agnostic — it has no `pg` and no other database
+* driver, deliberately. `@rebasepro/rls-check` has `pg`, because it connects to
+* Postgres. Importing it here would put a Postgres driver in the install of
+* every Mongo and Firebase user, for a feature none of them can use, and an
+* audit of row-level security is a Postgres concept living in the one package
+* that is supposed to know nothing about Postgres.
+*
+* So the scan function is handed in:
+*
+* ```ts
+* import { scan } from "@rebasepro/rls-check";
+* rlsAudit: { enabled: true, scan }
+* ```
+*
+* Everything else — the schedule, the summary, the status, the admin route —
+* lives here and is engine-agnostic in fact as well as in principle.
+*/
+var SEVERITY_ORDER = [
+	"info",
+	"low",
+	"medium",
+	"high",
+	"critical"
+];
+/** Rank for comparison. Unknown severities sort lowest rather than throwing. */
+var rank = (severity) => {
+	const index = SEVERITY_ORDER.indexOf(severity);
+	return index === -1 ? 0 : index;
+};
+var DEFAULT_INTERVAL_MS = 1440 * 60 * 1e3;
+var DEFAULT_STATEMENT_TIMEOUT_MS = 3e4;
+/** One line naming what the run found, at the right level to be noticed. */
+function summarize(result, warnAt) {
+	const counts = /* @__PURE__ */ new Map();
+	for (const finding of result.findings) counts.set(finding.severity, (counts.get(finding.severity) ?? 0) + 1);
+	const worst = result.findings.reduce((acc, f) => rank(f.severity) > rank(acc) ? f.severity : acc, "info");
+	if (result.findings.length === 0) return {
+		level: "info",
+		message: `RLS audit clean: ${result.stats.tables} table(s), ${result.stats.policies} polic(ies), ${result.stats.checksRun} check(s), no findings.`
+	};
+	const breakdown = [...SEVERITY_ORDER].reverse().filter((severity) => counts.get(severity)).map((severity) => `${counts.get(severity)} ${severity}`).join(", ");
+	const message = `RLS audit found ${result.findings.length} issue(s) — ${breakdown}. ${result.stats.tablesWithoutRls} table(s) without RLS. Read the detail at GET /api/admin/rls-audit, or run \`npx @rebasepro/rls-check\` for the full report.`;
+	return {
+		level: rank(worst) >= rank(warnAt) ? "warn" : "info",
+		message
+	};
+}
+/**
+* Create the audit. Nothing runs until {@link RlsAudit.start}.
+*
+* Because the scanner is supplied by the caller, the schedule, the summary and
+* the failure handling are all testable without a database and without
+* `@rebasepro/rls-check` present.
+*/
+function createRlsAudit(config) {
+	const enabled = config.enabled === true;
+	const intervalMs = config.intervalMs ?? DEFAULT_INTERVAL_MS;
+	const warnAt = config.warnAtSeverity ?? "high";
+	const connectionString = config.connectionString ?? process.env.DATABASE_URL;
+	let timer;
+	let status = { enabled };
+	if (enabled && !config.scan) status = {
+		enabled: false,
+		reason: "The scheduled RLS audit is enabled but no scanner was supplied. Pass `scan` from `@rebasepro/rls-check`: `rlsAudit: { enabled: true, scan }`."
+	};
+	else if (enabled && !connectionString) status = {
+		enabled: false,
+		reason: "The scheduled RLS audit is enabled but no connection string is available. Set DATABASE_URL, or pass `rlsAudit.connectionString`."
+	};
+	const runnable = enabled && !!connectionString && !!config.scan;
+	const run = async () => {
+		if (!runnable) return;
+		try {
+			const result = await config.scan({
+				connectionString,
+				schemas: config.schemas,
+				statementTimeoutMs: config.statementTimeoutMs ?? DEFAULT_STATEMENT_TIMEOUT_MS
+			});
+			const { level, message } = summarize(result, warnAt);
+			logger[level](`[rls-audit] ${message}`);
+			status = {
+				enabled: true,
+				lastRunAt: result.scannedAt,
+				result
+			};
+		} catch (err) {
+			const detail = err instanceof Error ? err.message : String(err);
+			logger.error(`[rls-audit] Scan failed: ${detail}`);
+			status = {
+				...status,
+				enabled: true,
+				lastRunAt: (/* @__PURE__ */ new Date()).toISOString(),
+				lastError: detail
+			};
+		}
+	};
+	return {
+		start() {
+			if (!runnable) {
+				if (status.reason) logger.warn(`[rls-audit] ${status.reason}`);
+				return;
+			}
+			if (timer) return;
+			timer = setInterval(() => {
+				run();
+			}, intervalMs);
+			timer.unref?.();
+			if (config.runOnBoot !== false) run();
+		},
+		stop() {
+			if (timer) clearInterval(timer);
+			timer = void 0;
+		},
+		runNow: run,
+		status: () => status
+	};
+}
+//#endregion
+//#region src/init/surfaces.ts
+/** Every surface, in a stable order. */
+var ALL_RUNTIME_SURFACES = [
+	"auth",
+	"data",
+	"storage",
+	"admin",
+	"functions",
+	"cron",
+	"meta",
+	"realtime"
+];
 /**
 * Resolve a partial surface set against the default, which is everything on.
 *
@@ -4383,7 +6218,8 @@ function resolveSurfaces(options) {
 function resolveOwnership(options) {
 	return {
 		cronScheduler: options?.cronScheduler ?? true,
-		jobWorkers: options?.jobWorkers ?? true
+		jobWorkers: options?.jobWorkers ?? true,
+		rlsAudit: options?.rlsAudit ?? true
 	};
 }
 /** The surfaces a process is not serving, for a boot log line. */
@@ -4516,7 +6352,7 @@ function isServerLikeEnvironment() {
 * Emitted once per client. Kept as a constant so the wording is testable and
 * greppable — this is the string a user will paste into a search.
 */
-var ANONYMOUS_SERVER_CLIENT_WARNING = "[rebase] This client was created outside a browser with no credential — no `token`, no auth token getter, and no cookie auth flow — so every request runs as an anonymous caller. Row-level security will return only publicly readable rows, which is usually nothing and occasionally the wrong thing. Inside a cron or function handler, use the `client` you were handed instead of building a new one: its data plane is already admin-scoped. In a standalone script or job, pass the service key as `token`. If you really do want anonymous access, pass `anonymous: true` to silence this.";
+var ANONYMOUS_SERVER_CLIENT_WARNING = "[rebase] This client was created outside a browser with no credential — no `token`, no auth token getter, and no cookie auth flow — so every request runs as an anonymous caller. Row-level security will return only publicly readable rows, which is usually nothing and occasionally the wrong thing. Inside a cron or function handler, use the `rebase` you were handed instead of building a new one: its data plane is already admin-scoped. In a standalone script or job, pass the service key as `token`. If you really do want anonymous access, pass `anonymous: true` to silence this.";
 /**
 * Refuse a filter whose *value* is missing.
 *
@@ -5402,6 +7238,49 @@ function createAuth(transport, options) {
 			refreshToken: session.refreshToken
 		};
 	}
+	/**
+	* Ask for a six-digit sign-in code by email.
+	*
+	* Answers the same thing whether or not the address has an account — do not
+	* use the result to tell a person whether they are registered, because it
+	* does not know.
+	*/
+	async function sendEmailOtp(email) {
+		const res = await getFetch()(authUrl("/otp"), {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify({ email })
+		});
+		const body = await res.json().catch(() => ({}));
+		if (!res.ok) throwApiError(res.status, body, res.statusText);
+		return body;
+	}
+	/**
+	* Trade a code for a session.
+	*
+	* The address is sent with the code because the code is only valid for it:
+	* that is what keeps a six-digit guess a guess against one account rather
+	* than against every account at once.
+	*/
+	async function verifyEmailOtp(email, code) {
+		const res = await getFetch()(authUrl("/otp/verify"), {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify({
+				email,
+				code
+			}),
+			credentials: authFlowMode === "cookie" ? "include" : void 0
+		});
+		const body = await res.json().catch(() => ({}));
+		if (!res.ok) throwApiError(res.status, body, res.statusText);
+		const session = handleAuthResponse(body, "SIGNED_IN");
+		return {
+			user: session.user,
+			accessToken: session.accessToken,
+			refreshToken: session.refreshToken
+		};
+	}
 	async function getSessions() {
 		return (await transport.request(authPath + "/sessions", { method: "GET" })).sessions;
 	}
@@ -5492,6 +7371,8 @@ function createAuth(transport, options) {
 		verifyEmail,
 		sendMagicLink,
 		verifyMagicLink,
+		sendEmailOtp,
+		verifyEmailOtp,
 		getSessions,
 		revokeSession,
 		revokeAllSessions,
@@ -5861,23 +7742,17 @@ function createCollectionClient(transport, slug, ws) {
 			})).data || [];
 		},
 		/**
-		* Still `PUT`, deliberately, even though the server now serves `PATCH`
-		* on the same handler and `PATCH` is the honest verb for a merge.
-		*
-		* The two are interchangeable server-side, so switching buys nothing at
-		* runtime — and it costs compatibility in the direction that fails
-		* quietly. A 0.14 client talking to a 0.13 server would send `PATCH` to
-		* a route that does not exist and get a **404**, which is
-		* indistinguishable from "that row is gone". Every write would look like
-		* a missing record.
+		* `PATCH`, the verb for a merge — `update(id, data: Partial<M>)` sends
+		* only the keys the caller named and the server merges the rest.
 		*
-		* `PATCH` is what the OpenAPI spec advertises, so anyone generating a
-		* client gets the correct verb; this stays on `PUT` until the oldest
-		* supported server is one that serves both.
+		* It was `PUT` for a while, on a route that served both so older
+		* clients kept working. The alias is gone: the OpenAPI spec, the SDK
+		* and the route now name one verb, and a spec-validating gateway in
+		* front of the API sees the operation the server actually implements.
 		*/
 		async update(id, data) {
 			return await transport.request(`${basePath}/${encodeURIComponent(String(id))}`, {
-				method: "PUT",
+				method: "PATCH",
 				body: JSON.stringify(data)
 			});
 		},
@@ -6021,7 +7896,8 @@ function createCollectionClient(transport, slug, ws) {
 				offset: window.driverOffset,
 				orderBy: normalizeOrderBy(params?.orderBy),
 				searchString: params?.searchString,
-				searchExplain: params?.searchExplain
+				searchExplain: params?.searchExplain,
+				vectorSearch: params?.vectorSearch
 			}, (incomingRows) => {
 				const currentUpdateId = ++lastUpdateId;
 				const requestedLimit = window.limit;
@@ -6097,6 +7973,27 @@ function createFunctionsClient(transport) {
 *                    When set, it is forwarded to the server so the correct
 *                    `StorageController` is resolved from the registry.
 */
+/**
+* A storage key, encoded for a URL path.
+*
+* Every call below interpolated the key raw, and the server decodes what it
+* receives — so three ordinary filenames did three different wrong things:
+*
+*   `Invoice #12.pdf`  the `#` began the fragment, the server saw
+*                      `default/Invoice ` and looked up a key that is not the
+*                      file — and a scoped `?token=` after it was swallowed too
+*   `100% done.png`    `decodeURIComponent` threw URIError → 500
+*   `a%2Fb.png`        decoded to `a/b.png`, silently resolving a DIFFERENT
+*                      object
+*
+* Per SEGMENT, because `/` is the key's own separator and must survive; every
+* other character is encoded, including a literal `%`. Verified to round-trip
+* through the server's decode for all of the above, plus `+`, accented
+* characters and a trailing `%`.
+*/
+function encodeStorageKey(key) {
+	return key.split("/").map(encodeURIComponent).join("/");
+}
 function createStorage(transport, storageId) {
 	const urlsCache = /* @__PURE__ */ new Map();
 	/**
@@ -6142,15 +8039,15 @@ function createStorage(transport, storageId) {
 			fileNotFound: true
 		};
 		if (isPublicStoragePath(filePath)) {
-			const publicConfig = { url: withStorageId(`${fileUrlBase()}/storage/file/${filePath}`) };
+			const publicConfig = { url: withStorageId(`${fileUrlBase()}/storage/file/${encodeStorageKey(filePath)}`) };
 			urlsCache.set(cacheKey, { config: publicConfig });
 			return publicConfig;
 		}
 		try {
-			const result = await transport.request(withStorageId(`/storage/metadata/${filePath}`));
+			const result = await transport.request(withStorageId(`/storage/metadata/${encodeStorageKey(filePath)}`));
 			if (result.data.public) {
 				const publicConfig = {
-					url: withStorageId(`${fileUrlBase()}/storage/file/${filePath}`),
+					url: withStorageId(`${fileUrlBase()}/storage/file/${encodeStorageKey(filePath)}`),
 					metadata: result.data
 				};
 				urlsCache.set(cacheKey, { config: publicConfig });
@@ -6159,7 +8056,7 @@ function createStorage(transport, storageId) {
 			const scopedToken = result.data.token;
 			const tokenQuery = scopedToken ? `?token=${scopedToken}` : "";
 			const downloadConfig = {
-				url: withStorageId(`${fileUrlBase()}/storage/file/${filePath}${tokenQuery}`),
+				url: withStorageId(`${fileUrlBase()}/storage/file/${encodeStorageKey(filePath)}${tokenQuery}`),
 				metadata: result.data
 			};
 			const expiresAt = result.data.tokenExpiresIn ? Date.now() + (result.data.tokenExpiresIn - 10) * 1e3 : void 0;
@@ -6192,7 +8089,7 @@ function createStorage(transport, storageId) {
 		if (bucket && filePath && !filePath.startsWith(bucket)) filePath = `${bucket}/${filePath}`;
 		if (!filePath || filePath.trim() === "" || filePath === "/") return;
 		try {
-			await transport.request(withStorageId(`/storage/file/${filePath}`), { method: "DELETE" });
+			await transport.request(withStorageId(`/storage/file/${encodeStorageKey(filePath)}`), { method: "DELETE" });
 		} catch (e) {
 			if (!(e instanceof Error && "status" in e && e.status === 404)) throw e;
 		}
@@ -6313,7 +8210,6 @@ var RebaseWebSocketClient = class {
 	websocketUrl;
 	ws = null;
 	getAuthToken;
-	subscriptions = /* @__PURE__ */ new Map();
 	listeners = /* @__PURE__ */ new Map();
 	/** Channel-name → handlers, for broadcast and presence frames. */
 	channelHandlers = /* @__PURE__ */ new Map();
@@ -6808,17 +8704,6 @@ var RebaseWebSocketClient = class {
 				}
 			}
 		}
-		if (subscriptionId && this.subscriptions.has(subscriptionId)) {
-			const callback = this.subscriptions.get(subscriptionId);
-			if (!callback) throw new Error(`Subscription callback not found for subscriptionId: ${subscriptionId}`);
-			if (message.type === "ERROR" || message.error) {
-				if (callback.onError) {
-					const { errorMessage, errorCode } = extractMessageError(message);
-					callback.onError(new RebaseApiError(errorMessage, { code: errorCode }));
-				}
-			} else callback.onUpdate(message);
-			return;
-		}
 		if (type === "ERROR" || type === "error" || message.error) {
 			const { errorMessage, errorCode } = extractMessageError(message);
 			console.warn(`[Rebase] Realtime error from the server${errorCode ? ` (${errorCode})` : ""}: ${errorMessage}`);
@@ -10385,8 +12270,35 @@ function createHistoryRoutes(params) {
 * version or not — reads the same live client.
 */
 var INSTANCE_SLOT = Symbol.for("@rebasepro/server:singleton-instance");
+/**
+* A *function* that answers "which client is this call for", for hosts where
+* one answer per process is the wrong shape.
+*
+* A Node server boots once and serves every request from the same client, so
+* {@link INSTANCE_SLOT} is the whole story. An isolate-based host is different
+* in a way that matters: the environment arrives attached to the **request**,
+* not to the module, so there is nothing to publish at import time, and an
+* isolate can be reused across requests that must not share state. Such a host
+* registers a resolver — typically reading an `AsyncLocalStorage` populated per
+* request — and it is consulted first.
+*
+* This exists now, before there is a host that needs it, because of what it
+* protects: `rebase` is a lazy Proxy, so every property access already goes
+* through `getInstance()`. Backing that lookup with a resolver is therefore the
+* entire porting story for the singleton — **no function anyone has already
+* written changes**. Take the resolver away and the only alternative is asking
+* users to thread a client through their handlers, which is a rewrite of every
+* function file in existence.
+*/
+var RESOLVER_SLOT = Symbol.for("@rebasepro/server:singleton-resolver");
 function getInstance() {
-	return globalThis[INSTANCE_SLOT] ?? null;
+	const global = globalThis;
+	const resolver = global[RESOLVER_SLOT];
+	if (resolver) {
+		const resolved = resolver();
+		if (resolved) return resolved;
+	}
+	return global[INSTANCE_SLOT] ?? null;
 }
 function setInstance(client) {
 	globalThis[INSTANCE_SLOT] = client;
@@ -10403,7 +12315,7 @@ function _initRebase(client) {
 * Throws an error if used in a non-test environment to prevent production abuse.
 */
 function _setRebaseMock(mockInstance) {
-	if (process.env.NODE_ENV !== "test") throw new Error("_setRebaseMock can only be called in a test environment (NODE_ENV=test).");
+	if (hostEnv().NODE_ENV !== "test") throw new Error("_setRebaseMock can only be called in a test environment (NODE_ENV=test).");
 	setInstance({
 		...getInstance() || {},
 		...mockInstance
@@ -10413,7 +12325,7 @@ function _setRebaseMock(mockInstance) {
 * @internal Resets the singleton instance, useful for afterEach() in test suites.
 */
 function _resetRebaseMock() {
-	if (process.env.NODE_ENV !== "test") throw new Error("_resetRebaseMock can only be called in a test environment.");
+	if (hostEnv().NODE_ENV !== "test") throw new Error("_resetRebaseMock can only be called in a test environment.");
 	setInstance(null);
 }
 /**
@@ -10526,6 +12438,199 @@ function resolveRequireAuth(auth) {
 	return auth.requireAuth !== false;
 }
 //#endregion
+//#region src/boot/resource-adapters.ts
+/**
+* The graph, expressed as the shapes the existing subsystems already take.
+*
+* The data layer consumes `DataSourceDefinition[]` and the storage layer
+* consumes `StorageSourceDefinition[]`, and both work. Nothing about the
+* resource graph requires rewriting them: the graph is a better *declaration*,
+* not a different runtime. So it is translated at the boundary, once, and
+* everything downstream is untouched.
+*
+* Doing it the other way round — teaching each subsystem to read the graph —
+* would have meant touching the pool manager, the storage registry and the
+* collection resolver to land a config change, which is how a config change
+* becomes a rewrite and then does not ship.
+*/
+/**
+* The graph and the two subsystems spell "the unnamed one" identically today,
+* but they are three separate constants and nothing stops them drifting. Mapped
+* explicitly so a future divergence is a compile error here rather than a
+* default database that silently fails to bind.
+*/
+function toDataSourceKey(key) {
+	return key === "(default)" ? DEFAULT_DATA_SOURCE_KEY : key;
+}
+function toStorageSourceKey(key) {
+	return key === "(default)" ? DEFAULT_STORAGE_SOURCE_KEY : key;
+}
+/** Databases in the graph, as the data layer's definitions. */
+function graphToDataSources(graph) {
+	return graph.resources.filter((r) => r.kind === "database").map((r) => ({
+		key: toDataSourceKey(r.key),
+		engine: r.engine,
+		transport: r.transport,
+		...typeof r.options.databaseId === "string" ? { databaseId: r.options.databaseId } : {},
+		...r.label !== void 0 ? { label: r.label } : {}
+	}));
+}
+/** Buckets in the graph, as the storage layer's definitions. */
+function graphToStorageSources(graph) {
+	return graph.resources.filter((r) => r.kind === "bucket").map((r) => ({
+		key: toStorageSourceKey(r.key),
+		engine: r.engine,
+		transport: r.transport,
+		...r.label !== void 0 ? { label: r.label } : {}
+	}));
+}
+/** Topics in the graph, for the runtime to publish through and the worker to wire. */
+function graphTopics(graph) {
+	return graph.resources.filter((r) => r.kind === "topic");
+}
+/**
+* Configuration keys the resource graph replaced.
+*
+* Each was a way to declare a resource somewhere other than a declaration, and
+* every one of them is gone. There is no compatibility mode: a config still
+* carrying one is refused at boot, by name, with the replacement in the
+* message.
+*
+* Silence here would be the exact failure this model was built to remove. The
+* old storage path accepted a `storageSources` export, merged it with
+* `rebase.json`, and discarded whichever engine lost — a declaration accepted
+* and then ignored. Leaving the key readable but inert would reproduce that
+* with better intentions.
+*/
+var REPLACED_CONFIG_KEYS = {
+	dataSources: "declare each one with database(\"<key>\") in your config's resources.ts, then run `rebase resources --write`",
+	storageSources: "declare each one with bucket(\"<key>\") in your config's resources.ts, then run `rebase resources --write`"
+};
+/**
+* Refuse a config still carrying a replaced key.
+*
+* Throws on the first one rather than collecting: unlike a manifest, where a
+* reader wants every problem at once, this is a single edit per key and the
+* message is long enough that three of them would bury each other.
+*/
+function assertNoReplacedResourceConfig(config) {
+	for (const [key, remedy] of Object.entries(REPLACED_CONFIG_KEYS)) {
+		if (config[key] === void 0) continue;
+		throw new Error(`\`${key}\` is no longer read. Resources are declared in config code now, so that there is one place to look and nothing to merge.\n\n  To migrate: ${remedy}.\n\nRefused rather than ignored: a key that is accepted and then does nothing is the failure this replaced.`);
+	}
+}
+//#endregion
+//#region src/topics/runtime.ts
+/**
+* Topics, on the durable job queue.
+*
+* ## Why fan out at publish time
+*
+* Publishing writes **one job row per subscription**, not one row for the
+* event. That is the shape SNS→SQS has and the reason is the same: each
+* subscriber then retries on its own schedule, and a subscription that is
+* broken or slow neither blocks the others nor causes them to run again. A
+* single row per event forces one retry policy across every consumer, so the
+* fourth attempt of a failing audit log re-delivers a welcome email that
+* already went out.
+*
+* It also makes "did this subscriber get it" a row somebody can look at, which
+* is the property the job queue was built for: work that gives up is *kept*,
+* because a queue that silently drops what it could not deliver is
+* indistinguishable from one with nothing to do.
+*
+* ## What at-least-once means here
+*
+* A handler can see the same event twice — a worker that dies holding a job
+* releases it after the visibility timeout, and the next worker starts the
+* handler again from the top. Handlers must tolerate that. It is the honest
+* name for what a retrying queue does, which is why `at-most-once` is refused
+* at declaration rather than quietly given the other guarantee.
+*
+* ## Transactional publish
+*
+* `enqueue` is a row insert, so a publish inside a transaction that rolls back
+* was never published — the difference between "email sent for an order that
+* does not exist" and nothing having happened at all.
+*/
+/** The job task name a subscription's deliveries are recorded under. */
+function topicTaskName(topic, subscription) {
+	return `topic:${topic}:${subscription}`;
+}
+/**
+* Build the job handlers every declared subscription needs.
+*
+* Returned rather than registered, because the queue takes its whole task map
+* at construction — and a task map assembled in one place is one somebody can
+* print.
+*/
+function topicJobHandlers() {
+	const tasks = {};
+	for (const sub of declaredSubscriptions()) {
+		const task = topicTaskName(sub.topic, sub.name);
+		tasks[task] = (async (ctx) => {
+			await sub.handler(ctx.payload, {
+				attempt: ctx.attempt,
+				topic: sub.topic,
+				subscription: sub.name
+			});
+		});
+	}
+	return tasks;
+}
+/**
+* Topics warned about having no subscriber.
+*
+* Once per topic rather than per event: a topic nobody subscribes to is a
+* legitimate intermediate state while somebody builds the other half, but "I
+* published and nothing happened" is expensive to debug in silence, and a
+* per-event warning would bury the real log under a loop.
+*/
+var warnedEmpty = /* @__PURE__ */ new Set();
+/**
+* Build the runtime topics publish through.
+*
+* Publishing to a topic nothing declared throws. The handle API makes it hard
+* to reach, but a string name from an ejected project or a dynamic caller can —
+* and enqueueing under a task no worker handles would write rows nobody ever
+* runs.
+*/
+function createTopicRuntime(options) {
+	const { queue, topics } = options;
+	const declared = new Map(topics.map((t) => [t.key, t]));
+	return { async publish(topic, event) {
+		const declaration = declared.get(topic);
+		if (!declaration) {
+			const known = [...declared.keys()].sort().join(", ") || "none";
+			throw new Error(`Cannot publish to topic "${topic}": nothing declares it. Declared topics: ${known}. Enqueueing it anyway would write rows no worker handles.`);
+		}
+		const subs = declaredSubscriptions(topic);
+		if (subs.length === 0) {
+			if (!warnedEmpty.has(topic)) {
+				warnedEmpty.add(topic);
+				logger.warn(`[topics] Published to "${topic}", which has no subscriptions — the event is dropped. Declare one with topic.subscription(name, handler).`);
+			}
+			return;
+		}
+		const topicAttempts = typeof declaration.options.maxAttempts === "number" ? declaration.options.maxAttempts : void 0;
+		for (const sub of subs) await queue.enqueue(topicTaskName(topic, sub.name), event, { maxAttempts: sub.maxAttempts ?? topicAttempts ?? 5 });
+	} };
+}
+/**
+* Install the runtime, and hand back a teardown.
+*
+* Publishing without one throws rather than resolving — an event that
+* disappears into a resolved promise is the failure a queue exists to
+* prevent — so it is installed for exactly as long as a backend is up.
+*/
+function installTopicRuntime(options) {
+	setTopicRuntime(createTopicRuntime(options));
+	return () => {
+		setTopicRuntime(null);
+		warnedEmpty.clear();
+	};
+}
+//#endregion
 //#region src/init.ts
 /**
 * Type guard to detect whether the `auth` config is an `AuthAdapter`
@@ -10581,6 +12686,10 @@ async function initializeRebaseBackend(config) {
 async function _initializeRebaseBackend(config) {
 	if (config.logging?.level) configureLogLevel(config.logging.level);
 	else configureLogLevel();
+	assertNoReplacedResourceConfig(config);
+	const resourceGraph = buildResourceGraph();
+	const declaredDataSources = graphToDataSources(resourceGraph);
+	const declaredStorageSources = graphToStorageSources(resourceGraph);
 	logger.debug("Initializing Rebase Backend");
 	installUnhandledRejectionHandler();
 	const basePath = config.basePath || "/api";
@@ -10594,7 +12703,7 @@ async function _initializeRebaseBackend(config) {
 	});
 	configureMiddlewares(config.app, basePath, isProduction, config);
 	const collectionRegistry = new BackendCollectionRegistry();
-	const dataSourceRegistry = createDataSourceRegistry(config.dataSources);
+	const dataSourceRegistry = createDataSourceRegistry(declaredDataSources.length > 0 ? declaredDataSources : void 0);
 	collectionRegistry.setDataSources(dataSourceRegistry);
 	if (config.callbacks) collectionRegistry.setGlobalCallbacks(config.callbacks);
 	let activeCollections = config.collections || [];
@@ -10621,7 +12730,7 @@ async function _initializeRebaseBackend(config) {
 	let defaultDriverId = DEFAULT_DRIVER_ID;
 	let defaultDriverResult = void 0;
 	const provisionTarget = provisionTargetFor(bootstrappers, config.database, config.provisioningDriverResult);
-	const provisionable = collectionsStoredBy(activeCollections, { engine: provisionTarget.engine }, (config.dataSources ?? []).map((source) => ({
+	const provisionable = collectionsStoredBy(activeCollections, { engine: provisionTarget.engine }, declaredDataSources.map((source) => ({
 		key: source.key,
 		engine: source.engine ?? provisionTarget.engine
 	})));
@@ -10789,7 +12898,7 @@ async function _initializeRebaseBackend(config) {
 	} : void 0;
 	const { storageRegistry, storageController } = await initializeStorage(config.storage, isProduction);
 	if (config.auth) {
-		config.app.get(`${basePath}/auth/config`, async (c) => {
+		config.app.get(`${basePath}/auth/config`, defaultAuthLimiter, async (c) => {
 			const capabilities = await authAdapter.getCapabilities();
 			return c.json(capabilities);
 		});
@@ -10865,7 +12974,7 @@ async function _initializeRebaseBackend(config) {
 			]) {
 				const providerConfig = safeAuthConfig[key];
 				if (providerConfig && requiredFields.every((f) => Boolean(providerConfig[f]))) {
-					const createFn = (await import("./auth-5Et5mnUA.js").then((n) => n.t))[factory];
+					const createFn = (await import("./auth-DzarZhLS.js").then((n) => n.t))[factory];
 					oauthProviders.push(createFn(providerConfig));
 				}
 			}
@@ -10879,6 +12988,7 @@ async function _initializeRebaseBackend(config) {
 				disableSelfRegistration: safeAuthConfig.disableSelfRegistration ?? false,
 				allowAnonymous: safeAuthConfig.allowAnonymous ?? false,
 				allowUserLookup: safeAuthConfig.allowUserLookup ?? false,
+				captcha: safeAuthConfig.captcha,
 				defaultRole: safeAuthConfig.defaultRole,
 				oauthProviders,
 				allowedRedirectUris: safeAuthConfig.allowedRedirectUris,
@@ -10886,6 +12996,7 @@ async function _initializeRebaseBackend(config) {
 				authHooks: safeAuthConfig.hooks,
 				collectionAuthConfig,
 				enableMagicLink: safeAuthConfig.magicLink ?? false,
+				enableEmailOtp: safeAuthConfig.emailOtp ?? false,
 				cookieAuth: safeAuthConfig.cookieAuth
 			});
 			if (safeAuthConfig.cookieAuth) {
@@ -10965,7 +13076,7 @@ async function _initializeRebaseBackend(config) {
 	let schemaEditorOff = schemaEditorUnavailable();
 	let schemaEditorRoutes;
 	if (!schemaEditorOff && config.collectionsDir) try {
-		schemaEditorRoutes = (await import("./schema-editor-routes-CV9k0w3G.js")).createSchemaEditorRoutes(config.collectionsDir);
+		schemaEditorRoutes = (await import("./schema-editor-routes-CRKMZnXu.js")).createSchemaEditorRoutes(config.collectionsDir);
 	} catch (err) {
 		if (err?.code === "ERR_MODULE_NOT_FOUND") {
 			schemaEditorOff = {
@@ -10988,30 +13099,116 @@ async function _initializeRebaseBackend(config) {
 			code: schemaEditorOff.code,
 			message: schemaEditorOff.message
 		} }, 501));
-		config.app.route(`${basePath}/schema-editor`, schemaEditorRouter);
-		if (schemaEditorRoutes) logger.debug("Schema Editor mounted", { path: `${basePath}/schema-editor` });
-		else logger.debug("Schema Editor unavailable", {
-			path: `${basePath}/schema-editor`,
-			code: schemaEditorOff.code
+		const remoteRepo = config.liveSchema?.repository;
+		const canEditSchema = Boolean(config.collectionsDir) || Boolean(remoteRepo);
+		if (!canEditSchema) {
+			const unconfigured = new Hono();
+			applyAdminGate(unconfigured, "Live schema editing");
+			unconfigured.all("/*", (c) => c.json({ error: {
+				code: "SCHEMA_EDITING_NO_COLLECTIONS_DIR",
+				message: "Live schema editing needs `collectionsDir` — the directory holding this project's collection definitions — or `liveSchema.repository`, a repository to fetch them from. This server was started with neither, so there is nothing for it to edit."
+			} }, 501));
+			mountWithLegacyAlias(config.app, unconfigured, {
+				canonical: `${basePath}/admin/schema`,
+				surface: "Live schema editing (unconfigured)"
+			});
+		}
+		if (canEditSchema) {
+			const collectionsDir = config.collectionsDir;
+			const repositoryRoot = collectionsDir ? await findRepositoryRoot(collectionsDir) : void 0;
+			const liveSchemaRouter = new Hono();
+			applyAdminGate(liveSchemaRouter, "Live schema editing");
+			const commitPaths = remoteRepo ? commitPathsFor(path$1.join("/", remoteRepo.collectionsPath ?? "config/collections"), "/") : collectionsDir && repositoryRoot ? commitPathsFor(collectionsDir, repositoryRoot) : void 0;
+			if (commitPaths) logger.debug("Live schema editing commit paths relocated", { commitPaths });
+			liveSchemaRouter.route("/", createLiveSchemaRoutes({
+				commitPaths,
+				usesVersionedMigrations: collectionsDir ? () => usesVersionedMigrations(collectionsDir) : void 0,
+				policy: { allowMachineApply: config.liveSchema?.allowMachineApply ?? process.env.REBASE_LIVE_SCHEMA_ALLOW_MACHINE_APPLY === "true" },
+				getCollections: () => collectionRegistry.getRawCollections(),
+				getAdmin: () => defaultDriver.admin,
+				getRepository: (author) => {
+					if (remoteRepo) return createGitHubRepository({
+						auth: remoteRepo.auth,
+						owner: remoteRepo.owner,
+						repo: remoteRepo.repo,
+						branch: remoteRepo.branch ?? "main",
+						author
+					});
+					if (!repositoryRoot) return void 0;
+					return createLocalGitRepository({
+						root: repositoryRoot,
+						author
+					});
+				},
+				writeSource: schemaEditorRoutes ? async (change) => {
+					const applyEdit = async (dir, collectionId, collection) => {
+						const { AstSchemaEditor } = await import("./ast-schema-editor-CDGgrIn7.js");
+						await new AstSchemaEditor(dir).saveCollection(collectionId, collection, { partial: false });
+					};
+					if (remoteRepo) {
+						const repository = config.liveSchema?.repository ? createGitHubRepository({
+							auth: remoteRepo.auth,
+							owner: remoteRepo.owner,
+							repo: remoteRepo.repo,
+							branch: remoteRepo.branch ?? "main"
+						}) : void 0;
+						if (!repository) return [];
+						return rewriteRemoteCollection({
+							repository,
+							collectionsPath: remoteRepo.collectionsPath ?? "config/collections",
+							edit: applyEdit
+						}, change.collectionId, change.collection);
+					}
+					await applyEdit(collectionsDir, change.collectionId, change.collection);
+					const file = path$1.join(collectionsDir, `${change.collectionId}.ts`);
+					const contents = await fsp.readFile(file, "utf8");
+					return [{
+						path: path$1.relative(repositoryRoot, file),
+						contents
+					}];
+				} : void 0,
+				sourcePathsFor: (change) => {
+					if (remoteRepo) return [`${(remoteRepo.collectionsPath ?? "config/collections").replace(/\/+$/, "")}/${change.collectionId}.ts`];
+					if (!collectionsDir || !repositoryRoot) return [];
+					return [path$1.relative(repositoryRoot, path$1.join(collectionsDir, `${change.collectionId}.ts`))];
+				}
+			}));
+			mountWithLegacyAlias(config.app, liveSchemaRouter, {
+				canonical: `${basePath}/admin/schema`,
+				surface: "Live schema editing"
+			});
+			logger.debug("Live schema editing repository", { repository: repositoryRoot ?? "(none — refusals only)" });
+		}
+		mountWithLegacyAlias(config.app, schemaEditorRouter, {
+			canonical: `${basePath}/admin/schema-editor`,
+			legacy: `${basePath}/schema-editor`,
+			surface: "Schema editor"
 		});
+		if (!schemaEditorRoutes) logger.debug("Schema Editor unavailable", { code: schemaEditorOff.code });
 	}
 	const storageAuthorizeData = {};
 	if (storageController) {
 		const storageMaxSize = (config.storage && typeof config.storage === "object" && "type" in config.storage ? config.storage.maxFileSize : void 0) ?? 50 * 1024 * 1024;
+		const storageAccessControl = resolveStorageAccessControl({
+			storagePolicies: config.storagePolicies,
+			storageAuthorize: config.storageAuthorize
+		});
 		assertStorageAccessControlConfigured({
-			hasAuthorize: !!config.storageAuthorize,
+			hasAuthorize: !!config.storageAuthorize || !!config.storagePolicies?.length,
 			publicRead: config.storagePublicRead === true,
 			allowAnyAuthenticated: config.storageInsecureAllowAnyAuthenticated === true
 		}, isProduction);
 		const storageRoutes = createStorageRoutes({
 			controller: storageController,
 			registry: storageRegistry,
-			sources: config.storageSources,
+			sources: declaredStorageSources.length > 0 ? declaredStorageSources : void 0,
 			requireAuth: resolveRequireAuth(config.auth),
 			publicRead: config.storagePublicRead === true,
 			authAdapter,
-			authorize: config.storageAuthorize,
-			authorizeData: () => storageAuthorizeData.current
+			authorize: storageAccessControl,
+			authorizeData: () => storageAuthorizeData.current,
+			renditionCache: config.storageRenditionCache,
+			triggers: config.storageTriggers
 		});
 		const storageRouter = new Hono();
 		if (apiKeyPreAuth) storageRouter.use("/*", apiKeyPreAuth, createStorageApiKeyGuard());
@@ -11147,11 +13344,11 @@ async function _initializeRebaseBackend(config) {
 		if (driver && "client" in driver) driver.client = serverClient;
 	}
 	if (config.functionsDir && surfaces.functions) {
-		const { loadFunctionsWithDiagnostics } = await import("./function-loader-DDS1v7YX.js").then((n) => n.t);
-		const { createFunctionRoutes } = await import("./function-routes-Btcez1T-.js").then((n) => n.n);
-		const { createFunctionsRequestTimeout, resolveFunctionsTimeoutMs } = await import("./request-timeout-BuFoEKwT.js");
+		const { loadFunctionsWithDiagnostics } = await import("./function-loader-LLdmBFoL.js").then((n) => n.t);
+		const { createFunctionRoutes } = await import("./function-routes-ClT6UQpD.js").then((n) => n.n);
+		const { createFunctionsRequestTimeout, resolveFunctionsTimeoutMs } = await import("./request-timeout-C8gkc-j7.js").then((n) => n.t);
 		const { functions: allFunctions, problems } = await loadFunctionsWithDiagnostics(config.functionsDir);
-		const { selectFunctions } = await import("./selection-_z6TM1DB.js").then((n) => n.n);
+		const { selectFunctions } = await import("./selection-CRpqKUbt.js").then((n) => n.n);
 		const loadedFunctions = selectFunctions(allFunctions, config.functionsSelection);
 		if (loadedFunctions.length !== allFunctions.length) logger.info("Serving a subset of this bundle's functions", {
 			serving: loadedFunctions.map((fn) => fn.name),
@@ -11179,7 +13376,7 @@ async function _initializeRebaseBackend(config) {
 			...rateLimitConfig,
 			anonymous: rateLimitConfig.anonymousFunctions !== void 0 ? rateLimitConfig.anonymousFunctions : DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT
 		}));
-		const fnRoutes = createFunctionRoutes(loadedFunctions, problems.length);
+		const fnRoutes = createFunctionRoutes(loadedFunctions, problems.length, `${basePath}/functions`);
 		functionsRouter.route("/", fnRoutes);
 		config.app.route(`${basePath}/functions`, functionsRouter);
 		if (loadedFunctions.length > 0) logger.info("Mounted custom functions", {
@@ -11190,7 +13387,7 @@ async function _initializeRebaseBackend(config) {
 		else logger.warn(`Function routes mounted at ${basePath}/functions, but no functions loaded from ${config.functionsDir}. ` + (problems.length > 0 ? `${problems.length} file(s) were skipped — see the messages above.` : "The directory holds no .ts/.js function files."));
 	}
 	if (config.functionsUpstream && !surfaces.functions) {
-		const { createFunctionsProxy } = await import("./proxy-Bj5DVllb.js");
+		const { createFunctionsProxy } = await import("./proxy-CMymhnwG.js").then((n) => n.t);
 		config.app.route(`${basePath}/functions`, createFunctionsProxy({
 			upstream: config.functionsUpstream,
 			basePath: `${basePath}/functions`
@@ -11202,10 +13399,10 @@ async function _initializeRebaseBackend(config) {
 	}
 	let cronScheduler;
 	if (config.cronsDir && (surfaces.cron || ownership.cronScheduler)) {
-		const { loadCronJobsWithDiagnostics } = await import("./cron-loader-YhhQeVBM.js").then((n) => n.t);
-		const { CronScheduler } = await import("./cron-scheduler-DIpYBmZP.js").then((n) => n.n);
-		const { createCronRoutes } = await import("./cron-routes-maM_RlUu.js").then((n) => n.n);
-		const { createCronStore } = await import("./cron-store-DfH_4Cd9.js").then((n) => n.n);
+		const { loadCronJobsWithDiagnostics } = await import("./cron-loader-d9WMFENB.js").then((n) => n.t);
+		const { CronScheduler } = await import("./cron-scheduler-BB82dWuU.js").then((n) => n.n);
+		const { createCronRoutes } = await import("./cron-routes-B_GKclr5.js").then((n) => n.n);
+		const { createCronStore } = await import("./cron-store-BTZqwkM1.js").then((n) => n.n);
 		const { jobs: loadedCronJobs, problems: cronProblems } = await loadCronJobsWithDiagnostics(config.cronsDir);
 		cronScheduler = new CronScheduler();
 		cronScheduler.setClient(serverSingleton);
@@ -11220,7 +13417,11 @@ async function _initializeRebaseBackend(config) {
 		const cronRouter = new Hono();
 		applyAdminGate(cronRouter, "Cron");
 		cronRouter.route("/", createCronRoutes(cronScheduler, cronProblems.length));
-		if (surfaces.cron) config.app.route(`${basePath}/cron`, cronRouter);
+		if (surfaces.cron) mountWithLegacyAlias(config.app, cronRouter, {
+			canonical: `${basePath}/admin/cron`,
+			legacy: `${basePath}/cron`,
+			surface: "Cron"
+		});
 		if (loadedCronJobs.length > 0 && !ownership.cronScheduler) logger.info("Cron jobs registered but NOT scheduled in this process", {
 			count: loadedCronJobs.length,
 			reason: "this process does not own the cron scheduler"
@@ -11233,21 +13434,45 @@ async function _initializeRebaseBackend(config) {
 			});
 		} else logger.warn(`Cron routes mounted at ${basePath}/cron, but no jobs loaded from ${config.cronsDir}. ` + (cronProblems.length > 0 ? `Nothing is scheduled — ${cronProblems.length} file(s) were skipped, see the messages above.` : "The directory holds no .ts/.js cron files, so nothing is scheduled."));
 	}
+	const declaredTopics = graphTopics(buildResourceGraph());
+	const topicTasks = declaredTopics.length > 0 ? topicJobHandlers() : {};
+	if (declaredTopics.length > 0) {
+		config = {
+			...config,
+			jobs: {
+				...config.jobs,
+				enabled: true,
+				tasks: {
+					...config.jobs?.tasks ?? {},
+					...topicTasks
+				}
+			}
+		};
+		logger.debug(`[topics] ${declaredTopics.length} topic(s), ${Object.keys(topicTasks).length} subscription(s) wired onto the job queue`);
+	}
 	let jobQueue;
 	if (config.jobs?.enabled) {
-		const { createJobStore, createJobQueue } = await import("./jobs-CyOKXXlu.js").then((n) => n.t);
+		const { createJobStore, createJobQueue } = await import("./jobs-CeZzdeR8.js").then((n) => n.t);
 		const store = createJobStore(defaultDriver);
 		if (store) {
 			await store.ensureTable();
 			jobQueue = createJobQueue(store, config.jobs);
+			if (declaredTopics.length > 0) installTopicRuntime({
+				queue: jobQueue,
+				topics: declaredTopics
+			});
 			if (ownership.jobWorkers) {
 				jobQueue.start();
 				logger.info("Job queue started", { tasks: Object.keys(config.jobs.tasks ?? {}).length });
 			} else logger.info("Job queue available for enqueue, workers NOT started in this process", { tasks: Object.keys(config.jobs.tasks ?? {}).length });
-		} else logger.warn("Job queue requested but unavailable on this driver — `rebase.jobs.enqueue` will throw, and webhook deliveries fall back to the in-memory queue.");
+		} else if (declaredTopics.length > 0) throw new Error(`This project declares ${declaredTopics.length} topic(s) — ${declaredTopics.map((t) => t.key).join(", ")} — but the durable job queue is not available on this database driver, and topics are delivered as job rows.
+
+Use a driver that supports the job queue, or remove the topic declarations. Refusing to boot rather than starting a backend where every publish throws.`);
+		else logger.warn("Job queue requested but unavailable on this driver — `rebase.jobs.enqueue` will throw, and webhook deliveries fall back to the in-memory queue.");
 	}
+	let rlsAudit;
 	if (surfaces.admin) {
-		const { createBackupRoutes, parseBackupDestination } = await import("./backup-C6ljYVTp.js").then((n) => n.t);
+		const { createBackupRoutes, parseBackupDestination } = await import("./backup-CRdZkA6c.js").then((n) => n.t);
 		const backupRouter = new Hono();
 		applyAdminGate(backupRouter, "Backup");
 		backupRouter.route("/", createBackupRoutes({
@@ -11261,15 +13486,52 @@ async function _initializeRebaseBackend(config) {
 		logger.debug("Backup admin routes mounted", { path: `${basePath}/admin/backups` });
 	}
 	if (surfaces.admin) {
-		const { default: logsRoutes } = await import("./logs-routes-CWBLQj2l.js").then((n) => n.n);
+		const rlsAuditRouter = new Hono();
+		applyAdminGate(rlsAuditRouter, "RLS audit");
+		rlsAuditRouter.get("/", (c) => c.json(rlsAudit ? rlsAudit.status() : {
+			enabled: false,
+			reason: config.rlsAudit?.enabled ? "This process serves the admin surface but does not own the RLS audit." : "The scheduled RLS audit is off. Set `rlsAudit.enabled` to turn it on."
+		}));
+		config.app.route(`${basePath}/admin/rls-audit`, rlsAuditRouter);
+		logger.debug("RLS audit admin routes mounted", { path: `${basePath}/admin/rls-audit` });
+	}
+	if (surfaces.admin) {
+		const devMailRouter = new Hono();
+		applyAdminGate(devMailRouter, "Development mailbox");
+		const unavailable = { error: {
+			code: "DEV_MAILBOX_UNAVAILABLE",
+			message: "No development mailbox is active. Mail is captured only when SMTP_HOST is unset and NODE_ENV is not production; with a mail server configured, messages are delivered rather than held here."
+		} };
+		devMailRouter.get("/", (c) => {
+			const sink = activeDevEmailSink();
+			if (!sink) return c.json(unavailable, 501);
+			return c.json({
+				enabled: true,
+				messages: sink.list()
+			});
+		});
+		devMailRouter.delete("/", (c) => {
+			const sink = activeDevEmailSink();
+			if (!sink) return c.json(unavailable, 501);
+			sink.clear();
+			return c.json({ cleared: true });
+		});
+		config.app.route(`${basePath}/admin/dev/emails`, devMailRouter);
+		logger.debug("Development mailbox admin routes mounted", { path: `${basePath}/admin/dev/emails` });
+	}
+	if (surfaces.admin) {
+		const { default: logsRoutes } = await import("./logs-routes-DB72iQSr.js").then((n) => n.n);
 		const logsRouter = new Hono();
 		applyAdminGate(logsRouter, "Logs");
 		logsRouter.route("/", logsRoutes);
-		config.app.route(`${basePath}/logs`, logsRouter);
-		logger.debug("Logs routes mounted", { path: `${basePath}/logs` });
+		mountWithLegacyAlias(config.app, logsRouter, {
+			canonical: `${basePath}/admin/logs`,
+			legacy: `${basePath}/logs`,
+			surface: "Logs"
+		});
 	}
 	if (surfaces.meta) {
-		const { createContractRoutes } = await import("./contract-routes-DZ-LBpSL.js").then((n) => n.t);
+		const { createContractRoutes } = await import("./contract-routes-DDSRyGSl.js").then((n) => n.t);
 		const contractRouter = new Hono();
 		if (adminSurfacesGated) {
 			if (apiKeyPreAuth) contractRouter.use("/contract", apiKeyPreAuth);
@@ -11298,10 +13560,15 @@ async function _initializeRebaseBackend(config) {
 	logger.debug("Rebase Backend Initialized");
 	const authSchemaCheck = authConfigResult?.schemaHealthCheck;
 	const healthCheck = createHealthCheck(defaultDriver, authSchemaCheck ? () => authSchemaCheck.call(authConfigResult) : void 0);
+	if (config.rlsAudit?.enabled && ownership.rlsAudit) {
+		rlsAudit = createRlsAudit(config.rlsAudit);
+		rlsAudit.start();
+	}
 	const shutdown = createShutdown({
 		server: config.server,
 		cronScheduler,
 		jobQueue,
+		rlsAudit,
 		realtimeServices
 	});
 	/**
@@ -11326,63 +13593,333 @@ async function _initializeRebaseBackend(config) {
 				attached++;
 			}
 		}
-		if (attached === 0) logger.warn(`[callbacks] Collection "${slug}" not found in any registry — callbacks not attached.`);
-	};
-	return {
-		driverRegistry,
-		driver: defaultDriver,
-		setCollectionCallbacks,
-		realtimeServices,
-		realtimeService: effectiveRealtimeService,
-		auth: authConfigResult,
-		history: historyConfigResult,
-		storageRegistry,
-		storageController,
-		collectionRegistry,
-		cronScheduler,
-		jobQueue,
-		healthCheck,
-		shutdown
+		if (attached === 0) logger.warn(`[callbacks] Collection "${slug}" not found in any registry — callbacks not attached.`);
+	};
+	return {
+		driverRegistry,
+		driver: defaultDriver,
+		setCollectionCallbacks,
+		realtimeServices,
+		realtimeService: effectiveRealtimeService,
+		auth: authConfigResult,
+		history: historyConfigResult,
+		storageRegistry,
+		storageController,
+		collectionRegistry,
+		cronScheduler,
+		jobQueue,
+		healthCheck,
+		shutdown
+	};
+}
+//#endregion
+//#region src/functions/define-function.ts
+/**
+* Typed authoring contract for a custom backend function.
+*
+* A custom function is a file in the `functionsDir` that default-exports a
+* Hono app; the loader mounts it at `/<filename>`. `defineFunction` is the
+* typed opt-in for that contract: it hands you a pre-typed `Hono<HonoEnv>`
+* app (so `c.var.user` / `c.var.driver` are typed) plus a
+* {@link RebaseFunctionContext}, and returns exactly the Hono app the loader
+* already accepts — so it is fully interchangeable with a plain
+* `export default new Hono()`.
+*
+* @example
+* ```ts
+* import { defineFunction, requireAuth } from "@rebasepro/server";
+*
+* export default defineFunction((app, { rebase }) => {
+*     app.use("/*", requireAuth);
+*     app.get("/home", async (c) => {
+*         // `rebase.sql` runs on the owner connection: no RLS, no policies,
+*         // every row. It is the most privileged thing in this context —
+*         // more so than `dataAsAdmin`, which is merely admin-scoped.
+*         const [stats] = await rebase.sql(`SELECT count(*) AS n FROM orders`);
+*         return c.json({ orders: Number(stats.n) });
+*     });
+* });
+* ```
+*
+* @param definition Receives the function's Hono app and the typed context.
+*   Register routes on the provided `app` and return nothing, or return your
+*   own `Hono<HonoEnv>` app to use instead.
+* @returns The Hono app to default-export from the function file.
+*/
+function defineFunction(definition) {
+	const app = new Hono();
+	const returned = definition(app, { rebase });
+	return returned instanceof Hono ? returned : app;
+}
+//#endregion
+//#region src/functions/context.ts
+function read(c, key) {
+	return c.get(key);
+}
+/**
+* The authenticated caller, or `undefined` for an anonymous request.
+*
+* **`undefined` is not a permission decision.** The functions router mounts its
+* auth middleware with `requireAuth: false` on purpose — a webhook receiver has
+* no token to send — so an anonymous caller reaches the handler and reads
+* `undefined` here while the handler runs on regardless. Use {@link requireAuth}
+* (or a `!user` branch that returns 401) to make it a decision.
+*
+* A caller who presented a *bad* token never gets this far: both auth
+* middlewares reject an unverifiable token with 401 before the router is
+* reached, precisely so an expired session cannot be silently downgraded to an
+* anonymous one.
+*/
+function getUser(c) {
+	const raw = read(c, "user");
+	if (!raw || typeof raw !== "object") return void 0;
+	const record = raw;
+	const uid = typeof record.uid === "string" ? record.uid : void 0;
+	if (uid === void 0) return void 0;
+	const roles = Array.isArray(record.roles) ? record.roles.filter((role) => typeof role === "string") : [];
+	return {
+		...record,
+		uid,
+		roles
+	};
+}
+/** The caller's id, or `undefined` when nobody is signed in. */
+function getUserId(c) {
+	return getUser(c)?.uid;
+}
+/** The caller's roles. Empty for an anonymous request — never `undefined`. */
+function getRoles(c) {
+	return getUser(c)?.roles ?? [];
+}
+/**
+* Whether the caller holds **any** of the named roles.
+*
+* Any rather than all, because that is what a route guard means by a list of
+* roles; require several by calling this more than once.
+*/
+function hasRole(c, ...roles) {
+	if (roles.length === 0) return false;
+	const held = new Set(getRoles(c));
+	return roles.some((role) => held.has(role));
+}
+/**
+* Whether the caller holds an administrative role.
+*
+* Delegates to the single definition in `auth/admin-roles.ts` — which is
+* `admin` **or** `schema-admin` — rather than comparing against `"admin"`.
+* Those two lists disagreed once, and the gap made every public registrant an
+* administrator; see that file.
+*/
+function isAdmin(c) {
+	return hasAdministrativeRole(getRoles(c));
+}
+/** Whether the request carries an identity at all. */
+function isAuthenticated(c) {
+	return getUser(c) !== void 0;
+}
+/**
+* The request-scoped data driver: reads and writes run as **the caller**, with
+* your row-level security policies evaluated against their identity.
+*
+* This is the accessor to reach for when a function serves user-facing data.
+* `rebase.dataAsAdmin` is the other one, and it is not the same thing — it runs
+* as `{ uid: "service", roles: ["admin"] }` for every caller alike, which is
+* correct for trusted background work and wrong for a request.
+*
+* `undefined` only when no Rebase auth middleware ran (see
+* {@link identityResolved}); inside a function mounted by the framework it is
+* always present, anonymous requests included — they get an anon-scoped driver
+* so policies still have an identity to evaluate.
+*/
+function getDriver(c) {
+	return read(c, "driver");
+}
+/**
+* {@link getDriver}, but throws instead of handing back `undefined`.
+*
+* For the common case where a handler cannot proceed without it and would
+* otherwise write `c.get("driver")!` — an assertion that turns a wiring problem
+* into `Cannot read properties of undefined (reading 'fetchCollection')` twenty
+* lines away from the cause.
+*/
+function requireDriver(c) {
+	const driver = getDriver(c);
+	if (!driver) throw new Error("No request-scoped driver on this context. A Rebase auth middleware populates it before any custom function runs, so this means the handler was mounted outside the functions router — e.g. added to your own Hono app directly. Mount it from the functions directory, or use `rebase.dataAsAdmin` if the work is genuinely service-scoped.");
+	return driver;
+}
+/**
+* The API key this request authenticated with, masked, or `undefined` when it
+* did not use one.
+*
+* Useful for attribution and for per-key behaviour. The permission check itself
+* has already happened — reaching a handler means the key was allowed to.
+*/
+function getApiKey(c) {
+	return read(c, "apiKey");
+}
+/**
+* The correlation id for this request — generated, or taken from an inbound
+* `X-Request-ID`.
+*
+* Log it. It is the only thing that ties a line written inside a function to
+* the framework's own lines for the same request.
+*/
+function getRequestId(c) {
+	return read(c, "requestId");
+}
+/**
+* Whether a Rebase auth middleware has run on this request.
+*
+* Both middlewares populate `driver` for *every* outcome, anonymous included,
+* and populate `user` whenever there is one. So "neither is set" does not mean
+* "anonymous" — it means nothing resolved the identity, and treating that as
+* anonymous is the dangerous reading. The guards use this to tell a genuinely
+* anonymous caller (401) from a misconfigured mount (500), because answering
+* 401 to the second sends whoever is debugging it to look at the token.
+*/
+function identityResolved(c) {
+	return read(c, "user") !== void 0 || read(c, "driver") !== void 0;
+}
+//#endregion
+//#region src/functions/guards.ts
+/**
+* The answer to "a guard ran, but no middleware had resolved anything".
+*
+* Deliberately a 500 and not a 401. A 401 tells the caller their credential is
+* the problem, and here the caller's credential was never looked at — sending
+* them to check their token is sending them to the one place the answer is not.
+*/
+function unresolvedIdentity() {
+	return { error: {
+		message: "This route's identity was never resolved: no Rebase auth middleware ran before the guard. A function loaded from the functions directory always has one. This usually means the Hono app was mounted onto your own server directly, bypassing the functions router.",
+		code: "AUTH_MIDDLEWARE_MISSING"
+	} };
+}
+/**
+* Reject callers holding none of the named roles with 403.
+*
+* Any of them, not all — require several by chaining the guard twice. Naming no
+* role at all is a programming error and throws at module load rather than at
+* request time, because `requireRole()` with an empty list would otherwise read
+* as a guard while admitting everyone.
+*
+* @example
+* ```ts
+* app.post("/publish", requireAuth, requireRole("editor", "admin"), handler);
+* ```
+*/
+function requireRole(...roles) {
+	if (roles.length === 0) throw new Error("requireRole() needs at least one role. An empty list would admit every signed-in caller while reading as a restriction.");
+	const allowed = new Set(roles);
+	return async (c, next) => {
+		if (!getUser(c)) {
+			if (!identityResolved(c)) return c.json(unresolvedIdentity(), 500);
+			return c.json({ error: {
+				message: "Authentication required",
+				code: "UNAUTHORIZED"
+			} }, 401);
+		}
+		if (!getRoles(c).some((role) => allowed.has(role))) return c.json({ error: {
+			message: `This operation requires one of these roles: ${roles.join(", ")}`,
+			code: "FORBIDDEN"
+		} }, 403);
+		return next();
 	};
 }
 //#endregion
-//#region src/functions/define-function.ts
+//#region src/functions/runtime-env.ts
 /**
-* Typed authoring contract for a custom backend function.
+* Every environment variable visible to this request.
 *
-* A custom function is a file in the `functionsDir` that default-exports a
-* Hono app; the loader mounts it at `/<filename>`. `defineFunction` is the
-* typed opt-in for that contract: it hands you a pre-typed `Hono<HonoEnv>`
-* app (so `c.var.user` / `c.var.driver` are typed) plus a
-* {@link RebaseFunctionContext}, and returns exactly the Hono app the loader
-* already accepts — so it is fully interchangeable with a plain
-* `export default new Hono()`.
+* `c.env` on workerd, `Deno.env` on Deno, `process.env` on Node, Bun and
+* Vercel's edge runtime. Reading it through here rather than through `process`
+* is the whole of what makes a function's configuration portable.
+*/
+function getEnv(c) {
+	return env(c);
+}
+/**
+* One environment variable, or `undefined`.
+*
+* Trimmed, and a blank value counts as absent — declaring a variable and
+* leaving it empty is the ordinary way to write a compose file or a `.env`
+* line, and nobody has ever meant `""` by it.
+*/
+function env$1(c, name) {
+	const raw = getEnv(c)[name];
+	if (typeof raw !== "string") return void 0;
+	const trimmed = raw.trim();
+	return trimmed === "" ? void 0 : trimmed;
+}
+/**
+* One environment variable, or a thrown error naming it.
+*
+* For configuration a handler cannot run without. Throwing here — inside the
+* request — is deliberately better than the module-scope `process.env.KEY!`
+* it replaces: that one takes the whole *file* down at load time, and the
+* loader reports it as "this function could not be imported", which names the
+* file but not the variable. This fails one request, with the name in the
+* message, while every other route in the file keeps serving.
+*/
+function requireEnv(c, name) {
+	const value = env$1(c, name);
+	if (value === void 0) throw new Error(`Missing required environment variable ${name}. Set it on the process (or as a binding, on a host that has them) — and read it inside the handler, not at module scope, so the same file works on both.`);
+	return value;
+}
+/**
+* Which host this is: `"node"`, `"workerd"`, `"deno"`, `"bun"`, `"edge-light"`,
+* `"fastly"` or `"other"`.
+*
+* Use it to *degrade*, not to branch a whole implementation — a function that
+* needs two implementations is two functions. It is honest about one thing in
+* particular: a Node-only capability, such as `rebase.sql()`, can check this
+* and say so, instead of failing at the call.
+*/
+function runtimeKey() {
+	return getRuntimeKey();
+}
+/** Whether this is a Node-like host — Node itself, or Bun's Node compatibility. */
+function isNodeRuntime() {
+	const key = getRuntimeKey();
+	return key === "node" || key === "bun";
+}
+/**
+* Build something expensive once per environment, on first use, from inside a
+* request.
+*
+* This is the sanctioned replacement for the module-scope client:
 *
-* @example
 * ```ts
-* import { defineFunction, requireAuth } from "@rebasepro/server";
+* // Don't: runs at import time, before bindings exist on some hosts.
+* const stripe = new Stripe(process.env.STRIPE_SECRET_KEY!);
 *
-* export default defineFunction((app, { rebase }) => {
-*     app.use("/*", requireAuth);
-*     app.get("/home", async (c) => {
-*         // `rebase.sql` runs on the owner connection: no RLS, no policies,
-*         // every row. It is the most privileged thing in this context —
-*         // more so than `dataAsAdmin`, which is merely admin-scoped.
-*         const [stats] = await rebase.sql(`SELECT count(*) AS n FROM orders`);
-*         return c.json({ orders: Number(stats.n) });
-*     });
-* });
+* // Do: runs on first request, reads that request's configuration.
+* const stripe = lazyResource(env => new Stripe(env.STRIPE_SECRET_KEY!));
+* app.post("/", async (c) => { await stripe(c).charges.list(); });
 * ```
 *
-* @param definition Receives the function's Hono app and the typed context.
-*   Register routes on the provided `app` and return nothing, or return your
-*   own `Hono<HonoEnv>` app to use instead.
-* @returns The Hono app to default-export from the function file.
+* The factory runs once per distinct environment object and the result is
+* cached against it. On Node that is once per process, because `process.env` is
+* one object for the life of the process — identical to the module-scope
+* version in cost, and unlike it, deferred until configuration exists. On a
+* host that hands each request a fresh binding object it is once per object,
+* which is the only correct answer there: caching across bindings would serve
+* one tenant's client to another.
+*
+* A {@link WeakMap} holds the cache, so an environment object the host has
+* finished with takes the resource with it.
 */
-function defineFunction(definition) {
-	const app = new Hono();
-	const returned = definition(app, { rebase });
-	return returned instanceof Hono ? returned : app;
+function lazyResource(factory) {
+	const cache = /* @__PURE__ */ new WeakMap();
+	return (c) => {
+		const bindings = getEnv(c);
+		if (!bindings || typeof bindings !== "object") return factory(bindings ?? {});
+		const existing = cache.get(bindings);
+		if (existing !== void 0) return existing;
+		const created = factory(bindings);
+		cache.set(bindings, created);
+		return created;
+	};
 }
 //#endregion
 //#region src/cron/define-cron.ts
@@ -11469,6 +14006,130 @@ var authJwt = () => {
 	return sql.raw(RLS_JWT_SQL);
 };
 //#endregion
+//#region src/dev-secrets.ts
+/**
+* Development secrets that survive a restart.
+*
+* `loadEnv` generates `JWT_SECRET` and `REBASE_SERVICE_KEY` when they are unset
+* outside production, so a developer can start without setting anything up. It
+* generated them **freshly on every boot**, which meant every restart of the dev
+* server silently invalidated the previous run's tokens: you were logged out of
+* your own app because you edited a file, and the API key you had just made
+* stopped working.
+*
+* The CLI already worked around it for scaffolded projects by writing a stable
+* `JWT_SECRET` into `.env` at `rebase init` — the comment there says exactly
+* why. That leaves anyone who did not scaffold, and anyone running from a
+* container with no `.env`, with the logout-on-restart behaviour.
+*
+* So the generated values are cached in a file beside the other dev-state
+* files — `.rebase-dev-port` and `.rebase-dev-url` follow the same convention
+* and are gitignored in the same place.
+*
+* ## What this does not change
+*
+* Production. `loadEnv` refuses to start when a secret was auto-generated and
+* `NODE_ENV=production`, and that is untouched: this only makes the
+* already-generated development values stable. There is no path by which a
+* cached secret becomes a production one.
+*
+* ## Failing soft
+*
+* A read-only filesystem, a container without a writable working directory, a
+* permissions problem — none of these should stop a development server from
+* starting. Every failure here falls back to the previous behaviour, an
+* ephemeral secret, and says so once at debug level.
+*/
+/** Beside `.rebase-dev-port` and `.rebase-dev-url`, and gitignored with them. */
+var DEV_SECRETS_FILENAME = ".rebase-dev-secrets.json";
+/** Owner read/write only. These are secrets, even development ones. */
+var FILE_MODE = 384;
+/** Whether these environment variables describe a test runner. */
+function detectTestRunner(env) {
+	return Boolean(env.JEST_WORKER_ID || env.VITEST || env.VITEST_WORKER_ID || env.NODE_ENV === "test");
+}
+/**
+* Whether a test runner started this process, decided **once at import**.
+*
+* Read at call time it would be wrong, and provably so: `env.test.ts` does
+* `process.env = {}` in its `beforeEach`, which erases `NODE_ENV` and
+* `JEST_WORKER_ID` alike. A predicate consulting the live environment therefore
+* sees a bare object and concludes "development", which is how the first version
+* of this dropped a `.rebase-dev-secrets.json` into `packages/server` on every
+* test run.
+*
+* Whether a test runner is hosting the process is a fact about the process, not
+* about whatever a test has since done to `process.env`, so it is captured
+* before any test can rewrite it.
+*/
+var TEST_RUNNER_DETECTED = detectTestRunner(process.env);
+/**
+* Whether generated secrets should be cached at all.
+*
+* Not in production — `loadEnv` refuses to boot there on a generated secret, so
+* there is nothing to cache and no path by which a cached one becomes a
+* production one.
+*
+* Not under a test runner: a test must not inherit a secret a previous run left
+* behind, and a library call has no business writing into a suite's working
+* directory. `inTestRunner` is a parameter only so this predicate can be tested
+* on its own; callers pass nothing.
+*/
+function shouldCacheDevSecrets(env = process.env, inTestRunner = TEST_RUNNER_DETECTED) {
+	if (inTestRunner) return false;
+	return env.NODE_ENV !== "production";
+}
+/** `REBASE_DEV_SECRETS_FILE`, or the conventional name in the working directory. */
+function resolveDevSecretsFile(env = process.env) {
+	const override = env.REBASE_DEV_SECRETS_FILE?.trim();
+	if (override) return path$3.resolve(override);
+	return path$3.join(process.cwd(), DEV_SECRETS_FILENAME);
+}
+/**
+* Open the cache.
+*
+* Reading a malformed file is treated as an empty cache rather than an error:
+* the file is ours, it holds regenerable values, and refusing to boot over a
+* corrupted convenience cache would be worse than rewriting it.
+*/
+function openDevSecretStore(file = resolveDevSecretsFile()) {
+	let cache = {};
+	let usable = true;
+	try {
+		if (fs$3.existsSync(file)) {
+			const parsed = JSON.parse(fs$3.readFileSync(file, "utf-8"));
+			if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+				for (const [key, value] of Object.entries(parsed)) if (typeof value === "string" && value.length > 0) cache[key] = value;
+			}
+		}
+	} catch {
+		cache = {};
+	}
+	const flush = () => {
+		try {
+			fs$3.mkdirSync(path$3.dirname(file), { recursive: true });
+			fs$3.writeFileSync(file, `${JSON.stringify(cache, null, 2)}\n`, { mode: FILE_MODE });
+			fs$3.chmodSync(file, FILE_MODE);
+		} catch (err) {
+			if (usable) {
+				usable = false;
+				logger.debug(`[dev-secrets] Could not write ${file}, so generated development secrets will not survive a restart: ${err instanceof Error ? err.message : String(err)}`);
+			}
+		}
+	};
+	return {
+		file,
+		get usable() {
+			return usable;
+		},
+		get: (name) => cache[name],
+		set: (name, value) => {
+			cache[name] = value;
+			flush();
+		}
+	};
+}
+//#endregion
 //#region src/env.ts
 /**
 * Generate a cryptographically secure random secret (hex-encoded).
@@ -11586,14 +14247,24 @@ function loadEnv(options) {
 	const isProduction = process.env.NODE_ENV === "production";
 	const autoGeneratedSecrets = [];
 	if (!isProduction) {
-		if (!process.env.JWT_SECRET) {
-			process.env.JWT_SECRET = generateSecret();
-			autoGeneratedSecrets.push("JWT_SECRET");
-		}
-		if (!process.env.REBASE_SERVICE_KEY) {
-			process.env.REBASE_SERVICE_KEY = generateSecret();
-			autoGeneratedSecrets.push("REBASE_SERVICE_KEY");
-		}
+		const devSecrets = shouldCacheDevSecrets() ? openDevSecretStore() : void 0;
+		const reused = [];
+		const ensure = (name) => {
+			if (process.env[name]) return;
+			const cached = devSecrets?.get(name);
+			if (cached) {
+				process.env[name] = cached;
+				reused.push(name);
+			} else {
+				const generated = generateSecret();
+				process.env[name] = generated;
+				devSecrets?.set(name, generated);
+			}
+			autoGeneratedSecrets.push(name);
+		};
+		ensure("JWT_SECRET");
+		ensure("REBASE_SERVICE_KEY");
+		if (autoGeneratedSecrets.length > 0 && reused.length !== autoGeneratedSecrets.length && devSecrets?.usable) logger.info(`Generated development ${autoGeneratedSecrets.length > 1 ? "secrets" : "secret"} (${autoGeneratedSecrets.join(", ")}) and cached them in ${DEV_SECRETS_FILENAME} so a restart does not log you out. Set them explicitly for anything that is not a development machine.`);
 	}
 	const env = (options?.extend ? rebaseEnvSchema.merge(options.extend) : rebaseEnvSchema).superRefine((data, ctx) => {
 		const d = data;
@@ -12338,7 +15009,7 @@ function serveSPA(app, config) {
 	const rawBase = config.basePath ?? "/";
 	const basePath = rawBase !== "/" ? rawBase.replace(/\/+$/, "") : "/";
 	const isRoot = basePath === "/";
-	if (!fs$2.existsSync(frontendPath)) {
+	if (!fs$3.existsSync(frontendPath)) {
 		logger.warn(`⚠️ Frontend build path does not exist: ${frontendPath}`);
 		logger.warn("   SPA serving is disabled. Build your frontend first.");
 		return;
@@ -12352,7 +15023,7 @@ function serveSPA(app, config) {
 	});
 	app.use(scope, responseCompression());
 	app.use(scope, serveStatic({
-		root: path$2.relative(process.cwd(), frontendPath),
+		root: path$3.relative(process.cwd(), frontendPath),
 		precompressed: true,
 		...isRoot ? {} : { rewriteRequestPath: (p) => p.slice(basePath.length) || "/" }
 	}));
@@ -12365,7 +15036,7 @@ function serveSPA(app, config) {
 	app.get(scope, async (c, next) => {
 		if (allExcludePaths.some((p) => isUnderPath(c.req.path, p))) return next();
 		if (isAssetRequest(c.req.path, c.req.header("sec-fetch-dest"))) return c.text("Not found", 404);
-		const indexPath = path$2.join(frontendPath, indexFile);
+		const indexPath = path$3.join(frontendPath, indexFile);
 		if (!cachedHtml) try {
 			cachedHtml = await fsp.readFile(indexPath, "utf-8");
 		} catch {
@@ -12387,6 +15058,14 @@ var BundleError = class extends Error {
 		this.name = "BundleError";
 	}
 };
+/**
+* The file that makes a directory a bundle.
+*
+* Exported because `fetch-bundle.ts` has to recognise the same thing after
+* unpacking, and when it had its own idea of the name — `rebase-bundle.json`,
+* which nothing has ever written — every download was rejected as "not a Rebase
+* bundle". A marker with two spellings is a marker with none.
+*/
 var MANIFEST_FILENAME = "manifest.json";
 /**
 * Bring a format-1 manifest up to the shape the rest of this runtime expects.
@@ -12652,6 +15331,55 @@ async function loadUsersCollection(bundle) {
 	}
 }
 //#endregion
+//#region src/boot/resource-loading.ts
+/**
+* Getting a bundle's resource declarations into the registry at boot.
+*
+* The graph could be read from the committed `rebase.resources.json`, and a
+* *host* does exactly that — it is the artifact that lets a console decide what
+* to provision without running anything. A running backend cannot, for one
+* reason: the file records that a subscription exists, and the backend needs
+* the *function*. Handlers only exist once the module declaring them has been
+* evaluated.
+*
+* So the runtime evaluates, and the file is for readers who do not. That the
+* two agree is what `rebase resources --check` gates.
+*
+* The config index is imported for its exports elsewhere, and re-exporting
+* `resources.ts` from it would be enough — but only if every project remembers
+* to. This imports it directly instead, so a project that forgets gets its
+* resources anyway rather than a backend that boots with none and says nothing.
+*/
+/** Where a project's declarations live, relative to its config directory. */
+var RESOURCE_ENTRIES = [
+	"resources.js",
+	"resources.ts",
+	"resources/index.js",
+	"resources/index.ts"
+];
+/**
+* Evaluate a bundle's resource declarations and return the graph.
+*
+* A project with no `resources.ts` is normal and returns whatever the config
+* index already registered — which for most projects is nothing, and a single
+* default database is then synthesised downstream exactly as before.
+*/
+async function loadBundleResourceGraph(bundle) {
+	const configEntry = bundle.manifest.entry?.config;
+	if (configEntry) {
+		const configDir = resolveBundlePath(bundle.dir, configEntry, "config");
+		const entry = RESOURCE_ENTRIES.map((name) => path.join(configDir, name)).find((candidate) => fs.existsSync(candidate));
+		if (entry) try {
+			await import(pathToFileURL(entry).href);
+		} catch (err) {
+			throw new Error(`Could not load resource declarations from ${entry}: ${err instanceof Error ? err.message : String(err)}. Refusing to boot: every database, bucket and topic this project declares lives in that module, and starting without them would answer requests against resources nobody bound.`);
+		}
+	}
+	const graph = buildResourceGraph();
+	if (graph.resources.length > 0) logger.debug(`[resources] ${graph.resources.length} declared: ` + graph.resources.map((r) => `${r.kind}:${r.key}`).join(", "));
+	return graph;
+}
+//#endregion
 //#region src/boot/env.ts
 /**
 * The environment a bundle-booted runtime understands.
@@ -12716,7 +15444,7 @@ var bootEnvExtension = object({
 	* `push` is in the enum and is **not** distinguished from `ensure` anywhere
 	* in the boot path; nothing implements "reconcile destructively" here. The
 	* published image goes further and refuses to start on it
-	* (`docker/entrypoint.mjs`), because a full push computes a diff and will
+	* (`infra/docker/entrypoint.mjs`), because a full push computes a diff and will
 	* happily `DROP COLUMN` — and a container restart must never be able to
 	* destroy a production column as a side effect of rescheduling. Reshaping
 	* and destructive changes stay a deliberate `rebase db generate` + `rebase
@@ -12755,6 +15483,16 @@ var bootEnvExtension = object({
 		""
 	]).default("false").transform((v) => v === "true"),
 	/**
+	* Write derived image renditions back to the storage source, so a transform
+	* survives a restart and is computed once across instances rather than once
+	* per instance. Costs one PUT per new variant; see `rendition-cache.ts`.
+	*/
+	STORAGE_RENDITION_CACHE: _enum([
+		"true",
+		"false",
+		""
+	]).default("false").transform((v) => v === "true"),
+	/**
 	* Opt out of the storage access-control boot guard, restoring the behaviour
 	* where any authenticated user may read, overwrite, delete or list any key.
 	* Only defensible when every signed-in user is trusted with every file.
@@ -12774,6 +15512,36 @@ var bootEnvExtension = object({
 		"false",
 		""
 	]).default("false").transform((v) => v === "true"),
+	/**
+	* Passwordless email sign-in, both shapes of it.
+	*
+	* Both were code-level flags only, so a bundle deployment — the shape every
+	* self-hosted and managed project runs — could not turn either on without
+	* rebuilding. That is the wrong place for the switch: whether a deployment
+	* wants passwordless login is a property of the deployment.
+	*/
+	AUTH_MAGIC_LINK: _enum([
+		"true",
+		"false",
+		""
+	]).default("false").transform((v) => v === "true"),
+	AUTH_EMAIL_OTP: _enum([
+		"true",
+		"false",
+		""
+	]).default("false").transform((v) => v === "true"),
+	/**
+	* Bot protection. Enabled by setting both — a provider without a secret
+	* cannot verify anything, and is refused at boot rather than ignored.
+	*/
+	CAPTCHA_PROVIDER: _enum([
+		"turnstile",
+		"hcaptcha",
+		""
+	]).optional(),
+	CAPTCHA_SECRET: string().optional(),
+	/** Comma-separated: register, login, forgotPassword, magicLink, emailOtp. */
+	CAPTCHA_ROUTES: string().optional(),
 	AUTH_COOKIE_SAME_SITE: _enum([
 		"Strict",
 		"Lax",
@@ -12874,6 +15642,19 @@ var bootEnvExtension = object({
 		""
 	]).optional().transform((v) => v === void 0 || v === "" ? void 0 : v === "true"),
 	/**
+	* Override whether this process runs the scheduled RLS audit. Unset follows
+	* the role.
+	*
+	* Unlike cron and the job workers this is not claim-protected — every owner
+	* scans on its own timer, which is redundant rather than unsafe — so a split
+	* deployment sets it false everywhere but one process.
+	*/
+	REBASE_RLS_AUDIT: _enum([
+		"true",
+		"false",
+		""
+	]).optional().transform((v) => v === void 0 || v === "" ? void 0 : v === "true"),
+	/**
 	* Comma-separated function names this process serves. Unset means all.
 	*
 	* `functions` role only. A name that is not in the bundle is a boot failure,
@@ -13023,7 +15804,8 @@ var ROLES = {
 		},
 		ownership: {
 			cronScheduler: false,
-			jobWorkers: false
+			jobWorkers: false,
+			rlsAudit: false
 		},
 		provisionSchema: false
 	},
@@ -13067,6 +15849,7 @@ function resolveRole(env) {
 	const ownership = { ...base.ownership };
 	if (env.REBASE_CRON_SCHEDULER !== void 0) ownership.cronScheduler = env.REBASE_CRON_SCHEDULER;
 	if (env.REBASE_JOB_WORKERS !== void 0) ownership.jobWorkers = env.REBASE_JOB_WORKERS;
+	if (env.REBASE_RLS_AUDIT !== void 0) ownership.rlsAudit = env.REBASE_RLS_AUDIT;
 	return {
 		role,
 		surfaces: { ...base.surfaces },
@@ -13504,13 +16287,51 @@ async function initializeDataSources(sources, schema, resolveFrom = []) {
 //#endregion
 //#region src/boot/options.ts
 /**
-* Build the email configuration, or `undefined` when no SMTP host is set.
+* True when an emailed link would be followable — i.e. when there is an
+* absolute base to build one from. Mirrors `assertEmailLinkBases`, which
+* refuses the boot otherwise.
+*/
+function hasAbsoluteLinkBase(value) {
+	if (!value) return false;
+	try {
+		const url = new URL(value);
+		return url.protocol === "http:" || url.protocol === "https:";
+	} catch {
+		return false;
+	}
+}
+/**
+* Build the email configuration.
+*
+* With `SMTP_HOST`, that is a real SMTP transport. Without it, outside
+* production, it is the development sink: mail is captured and its links are
+* printed, so `POST /auth/magic-link` and `POST /auth/forgot-password` complete
+* on a fresh project instead of answering `503 EMAIL_NOT_CONFIGURED`. The token
+* was always minted and valid; only delivery was missing.
 *
-* Without it the auth adapter still works; password-reset and verification mail
-* simply has nowhere to go, which the auth routes report for themselves.
+* Three conditions, all required, none configurable:
+*
+*  - no `SMTP_HOST` — a configured mail server always wins;
+*  - `NODE_ENV` is not `production` — a captured reset mail carries a working
+*    token, so this must not be reachable there (see `dev-sink.ts`);
+*  - an absolute `FRONTEND_URL`, or the emailed link has no base and is dead on
+*    arrival — which is the condition `assertEmailLinkBases` fails the boot on.
+*
+* When any of those does not hold this returns `undefined`, exactly as before,
+* and the auth routes report the missing service for themselves.
 */
 function resolveEmailOptions(env) {
-	if (!env.SMTP_HOST) return void 0;
+	if (!env.SMTP_HOST) {
+		if (env.NODE_ENV === "production") return void 0;
+		if (!hasAbsoluteLinkBase(env.FRONTEND_URL)) return void 0;
+		return {
+			from: env.SMTP_FROM || `${env.APP_NAME} <noreply@rebase.pro>`,
+			sendEmail: registerDevEmailSink(createDevEmailSink()).sendEmail,
+			appName: env.APP_NAME,
+			logoUrl: env.EMAIL_LOGO_URL,
+			resetPasswordUrl: env.FRONTEND_URL
+		};
+	}
 	return {
 		from: env.SMTP_FROM || `${env.APP_NAME} <noreply@rebase.pro>`,
 		smtp: {
@@ -13529,6 +16350,24 @@ function resolveEmailOptions(env) {
 	};
 }
 /**
+* Bot protection from the environment, or `undefined` when it is not configured.
+*
+* Both halves are required together. A provider with no secret cannot verify
+* anything, so it is left off here and `resolveCaptchaVerifier` refuses the boot
+* if something else turns it on — the one failure this feature must not have is
+* being silently absent while the config says otherwise.
+*/
+function resolveCaptchaOptions(env) {
+	if (!env.CAPTCHA_PROVIDER || !env.CAPTCHA_SECRET) return void 0;
+	const routes = env.CAPTCHA_ROUTES?.split(",").map((part) => part.trim()).filter(Boolean);
+	return {
+		enabled: true,
+		provider: env.CAPTCHA_PROVIDER,
+		secret: env.CAPTCHA_SECRET,
+		...routes?.length ? { routes } : {}
+	};
+}
+/**
 * Build the auth configuration from the environment and the bundle's users
 * collection.
 *
@@ -13552,6 +16391,9 @@ function resolveAuthOptions(env, usersCollection) {
 		disableSelfRegistration: env.DISABLE_SELF_REGISTRATION,
 		allowAnonymous: env.ALLOW_ANONYMOUS,
 		allowUserLookup: env.AUTH_ALLOW_USER_LOOKUP,
+		captcha: resolveCaptchaOptions(env),
+		magicLink: env.AUTH_MAGIC_LINK,
+		emailOtp: env.AUTH_EMAIL_OTP,
 		email: resolveEmailOptions(env),
 		cookieAuth: { sameSite: env.AUTH_COOKIE_SAME_SITE || "Lax" }
 	};
@@ -13820,25 +16662,44 @@ function createMetricsRoutes(registry, token) {
 //#endregion
 //#region src/boot/fetch-bundle.ts
 /**
-* Fetching a bundle at boot, for platforms with no init container.
-*
-* A bundle normally arrives on disk before the process starts: `rebase build`
-* writes one, a container image carries one, and on Kubernetes an init container
-* fetches one into a shared volume before the runtime container runs. All three
-* mean `runFromBundle` can assume the files are already there.
-*
-* Serverless platforms have no init container. Cloud Run starts one container
-* and nothing else, so the choice is between baking a per-tenant image — a build
-* on every deploy and an image per tenant to garbage-collect — or fetching at
-* boot. This is the second.
+* Fetching a bundle at boot.
+*
+* A bundle arrives one of two ways: already on disk (`rebase build` wrote one,
+* or a container image carries one at `/bundle`), or over HTTP from a stable
+* URL. This is the second, and it is now the *only* mechanism for fetching one
+* — Kubernetes deployments used to run a separate init container that did the
+* same three jobs into a shared volume, and it was deleted in favour of this.
+*
+* ## Why there was a second implementation, and why it is gone
+*
+* The init container existed because this path could not actually be used: it
+* looked for a marker file called `rebase-bundle.json` that nothing has ever
+* written — the CLI writes `manifest.json` — so every real bundle was rejected
+* as "not a Rebase bundle". The only thing that ever produced the file it
+* wanted was its own test. So `REBASE_BUNDLE_URL` had never worked against a
+* bundle from `rebase build`, on Cloud Run or under the Helm chart's
+* `bundle.mode: url`, and Kubernetes grew an init container instead.
+*
+* That init container is where the worst failure in the managed path lived. It
+* held three copies of the dependency tree at once (archive, npm cache,
+* extracted `node_modules`), and above its ephemeral-storage grant `npm
+* install` neither errored nor got evicted — it went to sleep in `epoll_wait`
+* and stayed there, with no log line, no event and no exit code anywhere. The
+* only symptom was the control plane reporting that the deploy did not become
+* ready.
+*
+* Doing the work here instead does not make dependency installation need less
+* disk. What it changes is that the work happens inside a process that has a
+* logger, so running out of room is reported as running out of room.
 *
 * ## Every start, not just the first
 *
-* The fetch has to be cheap and repeatable because it runs on *every* cold
-* start: a scale-from-zero, an instance recycled after an hour idle, a new
-* revision. That is also why the platform's bundle URL is deliberately a stable
-* endpoint rather than a signed expiring one — an instance starting for the
-* first time in three days needs the same URL to work.
+* The fetch has to be cheap and repeatable because it runs on *every* start: a
+* scale-from-zero, an instance recycled after an hour idle, a node drain, an
+* eviction, a new revision. That is also why the platform's bundle URL is
+* deliberately a stable endpoint rather than a signed expiring one — a pod
+* rescheduled at 3am needs the same URL to work, and a URL that had expired
+* would mean a tenant stays down until a human triggers a fresh deploy.
 *
 * ## It refuses rather than half-unpacking
 *
@@ -13883,11 +16744,144 @@ async function extractWithTar(tarball, destination) {
 * refuse. Writing the whole tarball first means a truncated download is caught
 * by `tar` as a corrupt archive, which is an error.
 */
-async function fetchBundle(options) {
-	const fetchImpl = options.fetchImpl ?? fetch;
-	const extract = options.extract ?? extractWithTar;
-	const destination = options.destination ?? fs$1.mkdtempSync(path$1.join(os.tmpdir(), "rebase-bundle-"));
-	fs$1.mkdirSync(destination, { recursive: true });
+/**
+* Install the bundle's declared dependencies, in place.
+*
+* `npm ci` when a lockfile is present and `npm install` otherwise — a bundle
+* that shipped a lockfile gets a reproducible install, one that did not still
+* boots.
+*
+* `--ignore-scripts` is not optional. The runtime image's entrypoint refuses to
+* run lifecycle scripts, and an install that ran them here would void that
+* guarantee at every pod start, executing arbitrary code from the dependency
+* tree before the process this is meant to be booting exists.
+*
+* The npm cache is dropped afterwards because it is, at that point, a
+* byte-for-byte duplicate of the tree beside it and nothing reads it again —
+* the runtime never installs twice in one process. Keeping it doubles the
+* high-water mark on a disk that is usually the binding constraint.
+*/
+async function installBundleDependencies(bundleRoot, exec = run) {
+	if (!fs$1.existsSync(path$1.join(bundleRoot, "package.json"))) return;
+	if (fs$1.existsSync(path$1.join(bundleRoot, "node_modules"))) {
+		logger.debug("Bundle already carries node_modules; skipping install");
+		return;
+	}
+	const args = fs$1.existsSync(path$1.join(bundleRoot, "package-lock.json")) ? [
+		"ci",
+		"--omit=dev",
+		"--ignore-scripts",
+		"--no-audit",
+		"--no-fund"
+	] : [
+		"install",
+		"--omit=dev",
+		"--ignore-scripts",
+		"--no-audit",
+		"--no-fund"
+	];
+	logger.info("Installing bundle dependencies", {
+		command: `npm ${args[0]}`,
+		cwd: bundleRoot
+	});
+	const started = Date.now();
+	try {
+		await exec("npm", args, {
+			cwd: bundleRoot,
+			maxBuffer: 32 * 1024 * 1024
+		});
+	} catch (error) {
+		fs$1.rmSync(path$1.join(bundleRoot, "node_modules"), {
+			recursive: true,
+			force: true
+		});
+		const detail = error instanceof Error ? error.message : String(error);
+		const outOfSpace = /ENOSPC|no space left/i.test(detail);
+		throw new Error(`Installing the bundle's dependencies failed: ${detail}` + (outOfSpace ? " — the volume ran out of space. An install needs room for the archive, npm's cache and the extracted tree at once; raise the pod's ephemeral-storage request, or vendor node_modules into the bundle at build time." : ""));
+	}
+	logger.info("Bundle dependencies installed", { ms: Date.now() - started });
+	dedupeRuntimePackages(bundleRoot, imageModulesDir());
+	await exec("npm", [
+		"cache",
+		"clean",
+		"--force"
+	], { cwd: bundleRoot }).catch(() => void 0);
+}
+function imageModulesDir() {
+	return process.env["REBASE_RUNTIME_MODULES"] || void 0;
+}
+/**
+* The packages the runtime image supplies to a fetched bundle.
+*
+* Must match `RUNTIME_PROVIDED` in `packages/cli/src/bundle.ts` and in
+* `infra/docker/entrypoint.mjs`; `tooling/scripts/test/runtime-provided.test.mjs` fails if any
+* of the three drift. The bundler STRIPS these from a bundle's declared
+* dependencies on the promise that the image supplies them, so a shorter list
+* here means the builder removed a dependency that nothing then provides, and
+* every function and cron importing it fails to load with `Cannot find package`
+* behind a container that reports itself healthy.
+*
+* This list carried only `@rebasepro/server` while the bundler stripped five —
+* the same four-package gap that broke the non-fetch path, reproduced on the
+* fetch path because this list was written before that fix and no gate watched
+* this file.
+*/
+var RUNTIME_PROVIDED_PACKAGES = [
+	"@rebasepro/server",
+	"@rebasepro/types",
+	"@rebasepro/client",
+	"@rebasepro/common",
+	"@rebasepro/utils"
+];
+/**
+* Collapse a duplicate framework copy in the bundle onto the image's.
+*
+* Node resolves a module's identity by its real path, so replacing the
+* duplicate with a symlink makes the two one instance again. It is also the
+* honest version of what was already true: the image's copy is the one that
+* booted and owns the process, so a bundle pinning a different version was
+* never running that version — it just carried a second, dead one alongside it.
+*
+* Non-fatal by design. A project with no custom functions is unaffected by the
+* duplicate, and refusing to boot over it would turn a degraded start into no
+* start at all.
+*
+* @param imageModules the runtime image's own `node_modules`. Absent, there is
+*   nothing to dedupe against and this is a no-op — which is the case in every
+*   context except a container built from the runtime image.
+*/
+function dedupeRuntimePackages(bundleRoot, imageModules) {
+	if (!imageModules || !fs$1.existsSync(imageModules)) return [];
+	const deduped = [];
+	for (const pkg of RUNTIME_PROVIDED_PACKAGES) {
+		const provided = path$1.join(imageModules, pkg);
+		const inBundle = path$1.join(bundleRoot, "node_modules", pkg);
+		if (!fs$1.existsSync(provided)) continue;
+		let stat = null;
+		try {
+			stat = fs$1.lstatSync(inBundle);
+		} catch {}
+		if (stat?.isSymbolicLink()) continue;
+		try {
+			fs$1.mkdirSync(path$1.dirname(inBundle), { recursive: true });
+			if (stat) fs$1.rmSync(inBundle, {
+				recursive: true,
+				force: true
+			});
+			fs$1.symlinkSync(provided, inBundle, "dir");
+			deduped.push(pkg);
+			logger.info(stat ? "Deduped a bundle package onto the runtime's own copy" : "Linked the runtime's own copy into the bundle", { package: pkg });
+		} catch (error) {
+			logger.warn("Could not link a bundle package; custom functions may not see the runtime", {
+				package: pkg,
+				error: error instanceof Error ? error.message : String(error)
+			});
+		}
+	}
+	return deduped;
+}
+/** One download attempt, streamed to `destination`. */
+async function downloadTo(tarball, options, fetchImpl) {
 	const controller = new AbortController();
 	const timer = setTimeout(() => controller.abort(), options.timeoutMs ?? 6e4);
 	let response;
@@ -13896,25 +16890,63 @@ async function fetchBundle(options) {
 			headers: options.token ? { authorization: `Bearer ${options.token}` } : {},
 			signal: controller.signal
 		});
-	} catch (error) {
-		throw new Error(`Could not download the bundle from ${options.url}: ` + (error instanceof Error ? error.message : String(error)));
 	} finally {
 		clearTimeout(timer);
 	}
-	if (!response.ok) throw new Error(`Could not download the bundle from ${options.url}: ${response.status} ${response.statusText}`);
+	if (!response.ok) throw new Error(`${response.status} ${response.statusText}`);
+	if (!response.body) throw new Error("empty response body");
+	await pipeline(Readable.fromWeb(response.body), createWriteStream(tarball));
+	const { size } = fs$1.statSync(tarball);
+	if (size === 0) throw new Error("the bundle is empty");
+}
+/**
+* Download, unpack and prepare a bundle, returning the directory it landed in.
+*
+* Downloads to a file rather than streaming into `tar`, deliberately. A stream
+* that dies mid-transfer leaves `tar` having successfully extracted a prefix of
+* the archive and exiting 0 — the half-unpacked bundle this module exists to
+* refuse. Writing the whole tarball first means a truncated download is caught
+* by `tar` as a corrupt archive, which is an error.
+*/
+async function fetchBundle(options) {
+	const fetchImpl = options.fetchImpl ?? fetch;
+	const extract = options.extract ?? extractWithTar;
+	const attempts = Math.max(1, options.attempts ?? 6);
+	const retryDelayMs = options.retryDelayMs ?? 3e3;
+	const destination = options.destination ?? fs$1.mkdtempSync(path$1.join(os.tmpdir(), "rebase-bundle-"));
+	fs$1.mkdirSync(destination, { recursive: true });
 	const tarball = path$1.join(destination, "bundle.tar.gz");
-	const body = Buffer.from(await response.arrayBuffer());
-	if (body.length === 0) throw new Error(`The bundle at ${options.url} is empty.`);
-	fs$1.writeFileSync(tarball, body);
+	let lastError;
+	for (let attempt = 1; attempt <= attempts; attempt++) try {
+		await downloadTo(tarball, options, fetchImpl);
+		lastError = void 0;
+		break;
+	} catch (error) {
+		lastError = error;
+		const detail = error instanceof Error ? error.message : String(error);
+		if (/^4\d\d /.test(detail) || attempt === attempts) break;
+		logger.warn("Bundle download failed; retrying", {
+			attempt,
+			of: attempts,
+			error: detail
+		});
+		await new Promise((resolve) => setTimeout(resolve, retryDelayMs));
+	}
+	if (lastError) {
+		fs$1.rmSync(tarball, { force: true });
+		throw new Error(`Could not download the bundle from ${options.url}: ` + (lastError instanceof Error ? lastError.message : String(lastError)));
+	}
+	const { size } = fs$1.statSync(tarball);
 	try {
 		await extract(tarball, destination);
 	} catch (error) {
-		throw new Error(`The bundle downloaded from ${options.url} could not be unpacked (${body.length} bytes): ` + (error instanceof Error ? error.message : String(error)));
+		throw new Error(`The bundle downloaded from ${options.url} could not be unpacked (${size} bytes): ` + (error instanceof Error ? error.message : String(error)));
 	} finally {
 		fs$1.rmSync(tarball, { force: true });
 	}
 	const root = bundleRootIn(destination);
-	if (!root) throw new Error(`The bundle downloaded from ${options.url} unpacked without a rebase-bundle.json. It is not a Rebase bundle, or it was truncated.`);
+	if (!root) throw new Error(`The bundle downloaded from ${options.url} unpacked without a ${MANIFEST_FILENAME}. It is not a Rebase bundle, or it was truncated.`);
+	if (options.installDependencies ?? true) await (options.installImpl ?? installBundleDependencies)(root);
 	return root;
 }
 /**
@@ -13926,11 +16958,11 @@ async function fetchBundle(options) {
 * files, and both are things a build script does.
 */
 function bundleRootIn(directory) {
-	if (fs$1.existsSync(path$1.join(directory, "rebase-bundle.json"))) return directory;
+	if (fs$1.existsSync(path$1.join(directory, "manifest.json"))) return directory;
 	for (const entry of fs$1.readdirSync(directory, { withFileTypes: true })) {
 		if (!entry.isDirectory()) continue;
 		const nested = path$1.join(directory, entry.name);
-		if (fs$1.existsSync(path$1.join(nested, "rebase-bundle.json"))) return nested;
+		if (fs$1.existsSync(path$1.join(nested, "manifest.json"))) return nested;
 	}
 	return null;
 }
@@ -13953,7 +16985,8 @@ function bundleRootIn(directory) {
 async function bootFromBundle(options = {}) {
 	const fetchedDir = !options.bundleDir && !options.bundle && shouldFetchBundle() ? await fetchBundle({
 		url: process.env[BUNDLE_URL_ENV],
-		token: process.env[BUNDLE_TOKEN_ENV]
+		token: process.env[BUNDLE_TOKEN_ENV],
+		destination: process.env["REBASE_BUNDLE_FETCH_DIR"] || void 0
 	}) : void 0;
 	const bundleDir = options.bundleDir || fetchedDir || process.env.REBASE_BUNDLE || path.resolve(process.cwd(), "dist-bundle");
 	const bundle = options.bundle ?? loadBundle(bundleDir);
@@ -13973,9 +17006,12 @@ async function bootFromBundle(options = {}) {
 		...runtimeRole.ownership
 	});
 	const configExports = await loadBundleConfigExports(bundle);
-	const dataSourceDefs = configExports.dataSources;
-	const declaredStorage = normalizeStorageSources(bundle.manifest.storage?.sources, configExports.storageSources);
-	const storageSourceDefs = declaredStorage.length > 0 ? declaredStorage : void 0;
+	assertNoReplacedResourceConfig(configExports);
+	const resourceGraph = await loadBundleResourceGraph(bundle);
+	const graphDataSources = graphToDataSources(resourceGraph);
+	const graphStorageSources = graphToStorageSources(resourceGraph);
+	const dataSourceDefs = graphDataSources.length > 0 ? graphDataSources : void 0;
+	const storageSourceDefs = graphStorageSources.length > 0 ? graphStorageSources : void 0;
 	const resolvedSources = resolveDataSources(process.env, dataSourceDefs);
 	const schema = await loadBundleSchema(bundle);
 	const driverRoots = bundleResolutionRoots(bundle.dir);
@@ -14010,11 +17046,10 @@ async function bootFromBundle(options = {}) {
 		functionsSelection: runtimeRole.functionsSelection,
 		functionsUpstream: runtimeRole.functionsUpstream,
 		bootstrappers: dataSources.map((s) => s.bootstrapper),
-		dataSources: dataSourceDefs,
 		storage,
-		storageSources: storageSourceDefs,
 		storageAuthorize: configExports.storageAuthorize,
 		storagePublicRead: env.STORAGE_PUBLIC_READ,
+		storageRenditionCache: { enabled: env.STORAGE_RENDITION_CACHE },
 		storageInsecureAllowAnyAuthenticated: env.STORAGE_ALLOW_ANY_AUTHENTICATED,
 		callbacks: configExports.callbacks,
 		auth: resolveAuthOptions(env, usersCollection),
@@ -14192,9 +17227,13 @@ async function bootStaticApp(bundle, devRoot, options) {
 		port = await listenWithPortRetry(server, requestedPort, { portFileDir: devRoot });
 		logger.info(`Server running at http://localhost:${port}`);
 	}
-	const noopBackend = { shutdown: async () => {} };
+	const staticBackend = { shutdown: async () => {
+		await new Promise((resolve) => {
+			server.close(() => resolve());
+		});
+	} };
 	if (options.handleSignals !== false) {
-		installShutdownHandlers(noopBackend, { onCleanup: async () => {
+		installShutdownHandlers(staticBackend, { onCleanup: async () => {
 			if (!isProduction) cleanupDevPortFile(devRoot);
 		} });
 		if (!isProduction) process.on("exit", () => cleanupDevPortFile(devRoot));
@@ -14202,7 +17241,7 @@ async function bootStaticApp(bundle, devRoot, options) {
 	return {
 		app,
 		server,
-		backend: noopBackend,
+		backend: staticBackend,
 		bundle,
 		env: {
 			NODE_ENV: process.env.NODE_ENV ?? "development",
@@ -14322,6 +17361,160 @@ function warnOnUnusableBundleShape(bundle) {
 	logger.warn(`This bundle declares a config package at "${bundle.manifest.entry.config}", but no collections directory resolved inside it, so no collections were loaded and no tables will be created. Rebuild with \`rebase build\` and check the manifest's \`entry.collections\`.`);
 }
 //#endregion
-export { ApiError, BlockedUrlError, BundleError, CONCURRENT_DDL_SQLSTATES, CronScheduler, DEFAULT_DRIVER_ID, DEFAULT_MAX_FILE_SIZE, DEFAULT_STORAGE_ID, DOCUMENT_MIME_TYPES, DefaultDriverRegistry, DefaultStorageRegistry, GCSStorageController, IMAGE_MIME_TYPES, LocalStorageController, MetricsRegistry, RawHtml, S3StorageController, SMTPEmailService, TransformCache, TusHandler, UnknownStorageSourceError, WEBHOOK_DELIVERY_TASK, WebhookDispatcher, _resetRebaseMock, _setRebaseMock, applyCollectionDefaults, assertAllowedOutboundUrl, assertCollectionConfigs, assertDistinctSuffixes, assertEmailLinkBases, assertWriteRequestValid, authJwt, authRoles, authUid, blockedAddressReason, bootFromBundle, classifySurface, cleanupDevPortFile, createAppleProvider, createBackupRoutes, createBitbucketProvider, createBuiltinAuthAdapter, createContractRoutes, createCronRoutes, createCronStore, createCustomAuthAdapter, createDdlBootstrapper, createDiscordProvider, createEmailService, createFacebookProvider, createFunctionRoutes, createGitHubProvider, createGitLabProvider, createGoogleProvider, createHistoryRoutes, createJobQueue, createJobStore, createJwksRoutes, createLinkedinProvider, createMetricsMiddleware, createMetricsRoutes, createMicrosoftProvider, createSlackProvider, createSourceBundle, createSpotifyProvider, createStorageController, createStorageRoutes, createTwitterProvider, defaultBackoff, defineCron, defineFunction, envSuffixForKey, errorHandler, escapeHtml, extractUserFromToken, fileTokenAuth, findCollectionConfigProblems, generateSecurePassword, getEmailVerificationTemplate, getJwks, getMagicLinkTemplate, getPasswordResetTemplate, getUserInvitationTemplate, getWelcomeEmailTemplate, hasAsymmetricSigningKey, hashPassword, html, httpMethodToOperation, initializeDataSource, initializeDataSources, initializeRebaseBackend, installShutdownHandlers, isApiKeyToken, isAuthAdapter, isConcurrentDdlRace, isDatabaseAdapter, isDuplicateObjectRace, isLocalhostOrigin, isOperationAllowed, isTransformableImage, listBackupObjects, listenWithPortRetry, loadBootEnv, loadBundle, loadBundleConfigExports, loadBundleSchema, loadCollectionsFromDirectory, loadCronJobsFromDirectory, loadCronJobsWithDiagnostics, loadDeclaredStorageSources, loadEnv, loadFunctionsFromDirectory, loadUsersCollection, logger, oauthCodeFlowSchema, optionalAuth, parseBackupDestination, parseBackupTimestamp, parseTransformOptions, pkceTokenParams, providerVerifiedEmail, queryTokenAuth, raw, readBackupBytes, readBundleManifest, rebase, requireAdmin, requireAuth, resolveAuthHooks, resolveAuthOptions, resolveCorsOrigin, resolveDataSources, resolveEmailBranding, resolveEmailLinkBase, resolveEmailOptions, resolveRequireAuth, resolveStorageBackend, resolveStorageSources, runFromBundle, safeCompare, serveSPA, transformImage, tryVerifyOidcIdToken, unknownKeyPolicyFromEnv, validateApiKey, validateCronExpression, validatePasswordStrength, verifyOidcIdToken, verifyPassword };
+//#region src/deploy/pod-contract.ts
+/**
+* What every deployment of this runtime must get right about the pod.
+*
+* There are two things that place a Rebase runtime in Kubernetes — the Helm
+* chart in `infra/charts/rebase`, for self-hosting, and the control plane's
+* `buildManagedContainer`, for cloud tenants — and they were written months
+* apart by people solving different problems. Rendering both for the same unit
+* and diffing them (2026-08-22) turned up four disagreements, and in three of
+* them the chart was doing the thing this runtime's own source warns against.
+*
+* The disagreements were not in the parts that *should* differ. A managed pod
+* takes its environment from a tenant Secret and a self-hosted one takes it from
+* a values file; a managed pod is scheduled onto spot capacity its plan sold it
+* and a self-hosted one goes where the operator says. Those are different jobs
+* and they produce different manifests, correctly.
+*
+* What must not differ is anything that is really a statement about *this
+* process*: which endpoint answers what, which variables decide the topology,
+* where the bundle is mounted. Those are not deployment preferences. They are
+* facts about the runtime, and a deployment that gets one wrong produces a
+* cluster that looks healthy — which is why they are stated here, in the
+* runtime, rather than twice in the things that deploy it.
+*
+* The chart cannot import this module. `tooling/scripts/check-chart.mjs` renders the
+* chart and asserts it against these values instead, so the chart conforms by
+* gate where the control plane conforms by construction.
+*/
+/**
+* Endpoints this runtime guarantees on every role, and what each one means.
+*
+* `/livez` is dependency-free — it answers "this process is running" and
+* nothing else. `/health` opens the default driver and every configured
+* secondary, and **answers 503 when any of them is unreachable**
+* (`boot.ts`, the `healthPaths` handler).
+*
+* That difference is the whole reason both exist, and it is stated at the
+* `/livez` registration in `boot.ts`: "`/health` touches the database, so a
+* database blip would make an orchestrator kill an otherwise healthy process."
+*/
+var RUNTIME_HEALTH_PATH = "/health";
+var RUNTIME_LIVENESS_PATH = "/livez";
+/**
+* Which endpoint each Kubernetes probe must target.
+*
+* The rule follows from what the probe *does* when it fails:
+*
+* - **liveness** restarts the container. A database outage must therefore never
+*   fail it, or an unreachable database turns into a cluster-wide restart loop
+*   that clears the moment the database returns and looks, in the logs, like
+*   the application crashed. `/livez`.
+* - **readiness** removes the pod from its Service. That is exactly what should
+*   happen when the database is unreachable — the pod cannot serve. `/health`.
+* - **startup** decides when the other two begin. Its job is "has this process
+*   finished booting", and booting may include fetching a bundle, installing
+*   dependencies and checking the schema. It must not also require the database
+*   to be *up*, or a cold database is indistinguishable from a broken image:
+*   the pod never passes startup, liveness never gets to run, and the pod
+*   CrashLoops with nothing in its output about a database. `/livez`.
+*
+* A probe targeting the wrong one of these fails silently in the direction that
+* looks like an application bug, which is why this is a contract and not a
+* default.
+*/
+var RUNTIME_PROBE_PATHS = {
+	liveness: RUNTIME_LIVENESS_PATH,
+	readiness: RUNTIME_HEALTH_PATH,
+	startup: RUNTIME_LIVENESS_PATH
+};
+/**
+* Environment variables that decide *topology* — which surfaces a process
+* mounts, which singletons it owns, where it forwards.
+*
+* These are the platform's or the operator's decision expressed by the thing
+* doing the deploying, and they must never be settable by whoever supplies the
+* project's own environment. The cloud learned this the expensive way: a tenant
+* who set `REBASE_ROLE=worker` in their project variables got a pod that served
+* no HTTP at all, and because `/health` answers on **every** role the readiness
+* probe passed, the rollout reported success, and every request 404'd.
+*
+* Kubernetes only lets `env` shadow `envFrom` for names it **lists**, so
+* neutralising one of these means naming it explicitly. An empty value is read
+* by the runtime as unset, which is why the cloud pins most of them to `""`
+* rather than to a value: the entry exists to take the decision away from the
+* project, not to make it here.
+*/
+var TOPOLOGY_ENV_VARS = [
+	"REBASE_ROLE",
+	"REBASE_FUNCTIONS_ONLY",
+	"REBASE_FUNCTIONS_EXCLUDE",
+	"REBASE_FUNCTIONS_UPSTREAM",
+	"REBASE_CRON_SCHEDULER",
+	"REBASE_JOB_WORKERS",
+	"REBASE_RLS_AUDIT",
+	"REBASE_MIGRATE_ON_BOOT",
+	"TRUSTED_PROXY_HOPS",
+	"REBASE_RATE_LIMIT_STORE",
+	"REBASE_REQUIRE_SCHEMA_MATCH"
+];
+/** Whether a variable name is one the deployer owns rather than the project. */
+function isTopologyEnvVar(name) {
+	return TOPOLOGY_ENV_VARS.includes(name);
+}
+/**
+* Seconds to keep answering after Kubernetes decides to remove this pod.
+*
+* `installShutdownHandlers` drains on SIGTERM — it stops the scheduler, tears
+* down realtime and closes the HTTP server, finishing what is in flight. What
+* it cannot do is stop *new* requests arriving: kubelet sends SIGTERM and the
+* endpoint controller removes the pod from its Service **concurrently**, so for
+* as long as endpoint removal takes to propagate, the ingress is still routing
+* to a process that has already stopped accepting connections.
+*
+* A `preStop` sleep is the only thing that orders those two. The pod keeps
+* serving for this long *before* SIGTERM is sent, which is time the ingress
+* uses to stop sending it anything.
+*
+* Anything greater than zero fixes the ordering; five seconds is what the
+* control plane has run in production.
+*/
+var RUNTIME_PRESTOP_DRAIN_SECONDS = 5;
+/**
+* The floor for `terminationGracePeriodSeconds`.
+*
+* The pod must outlive `preStop` *plus* the drain that follows it, or kubelet
+* SIGKILLs mid-drain and the graceful shutdown was decoration. The drain's own
+* default is 15s (`ShutdownHandlerOptions.timeoutMs`), and Kubernetes' default
+* grace period is 30s — so the stock configuration has room, and this exists to
+* say how much before someone raises the drain.
+*/
+var RUNTIME_MIN_TERMINATION_GRACE_SECONDS = 20;
+/**
+* How long a deployment must let this runtime take to answer for the first time.
+*
+* Nothing answers until boot is finished. `runFromBundle` binds the socket
+* **last** — after the bundle is read, the drivers connect and, on the process
+* that owns it, the schema DDL runs (`boot.ts`, "schema DDL happens during
+* boot, above"). So the gap between the container starting and `/livez`
+* answering is a whole provisioning run, not a framework warming up.
+*
+* A deployment with no startup probe measures that gap with its *liveness*
+* probe instead, and liveness restarts the container. On the control plane's
+* settings that is 20s of grace plus three 20s failures — 80 seconds — after
+* which a slow first boot is killed and retried, and each retry starts from the
+* beginning. It does not converge; it loops, and the logs show a pod that never
+* finished starting rather than a database that was slow.
+*
+* So a startup probe is not optional here, and its budget is this. A healthy
+* pod passes it on the first check and nothing is spent.
+*/
+var RUNTIME_STARTUP_BUDGET_SECONDS = 300;
+/** Where a bundle is mounted, and what the runtime is told to read. */
+var RUNTIME_BUNDLE_MOUNT = "/bundle";
+//#endregion
+export { ApiError, BlockedUrlError, BundleError, CONCURRENT_DDL_SQLSTATES, CronScheduler, DEFAULT_DRIVER_ID, DEFAULT_MAX_FILE_SIZE, DEFAULT_STORAGE_ID, DOCUMENT_MIME_TYPES, DefaultDriverRegistry, DefaultStorageRegistry, GCSStorageController, IMAGE_MIME_TYPES, LocalStorageController, MetricsRegistry, RUNTIME_BUNDLE_MOUNT, RUNTIME_HEALTH_PATH, RUNTIME_LIVENESS_PATH, RUNTIME_MIN_TERMINATION_GRACE_SECONDS, RUNTIME_PRESTOP_DRAIN_SECONDS, RUNTIME_PROBE_PATHS, RUNTIME_STARTUP_BUDGET_SECONDS, RawHtml, S3StorageController, SMTPEmailService, StoragePolicyError, TOPOLOGY_ENV_VARS, TransformCache, TusHandler, UnknownStorageSourceError, WEBHOOK_DELIVERY_TASK, WebhookDispatcher, _resetRebaseMock, _setRebaseMock, activeDevEmailSink, applyCollectionDefaults, assertAllowedOutboundUrl, assertCollectionConfigs, assertDistinctSuffixes, assertEmailLinkBases, assertWriteRequestValid, authJwt, authRoles, authUid, blockedAddressReason, bootFromBundle, classifySurface, cleanupDevPortFile, clearActiveDevEmailSink, compileStoragePolicies, createAppleProvider, createBackupRoutes, createBitbucketProvider, createBuiltinAuthAdapter, createContractRoutes, createCronRoutes, createCronStore, createCustomAuthAdapter, createDdlBootstrapper, createDevEmailSink, createDiscordProvider, createEmailService, createFacebookProvider, createFunctionRoutes, createGitHubProvider, createGitLabProvider, createGoogleProvider, createHistoryRoutes, createJobQueue, createJobStore, createJwksRoutes, createLinkedinProvider, createMetricsMiddleware, createMetricsRoutes, createMicrosoftProvider, createRlsAudit, createSlackProvider, createSourceBundle, createSpotifyProvider, createStorageController, createStorageRoutes, createTwitterProvider, defaultBackoff, defineCron, defineFunction, drainBackgroundWork, envSuffixForKey, errorHandler, escapeHtml, extractLinks, extractUserFromToken, fileTokenAuth, findCollectionConfigProblems, generateSecurePassword, getApiKey, getDriver, getEmailOtpTemplate, getEmailVerificationTemplate, getEnv, getJwks, getMagicLinkTemplate, getPasswordResetTemplate, getRequestId, getRoles, getUser, getUserId, getUserInvitationTemplate, getWelcomeEmailTemplate, hasAsymmetricSigningKey, hasRole, hashPassword, html, httpMethodToOperation, identityResolved, initializeDataSource, initializeDataSources, initializeRebaseBackend, installShutdownHandlers, isAdmin, isApiKeyToken, isAuthAdapter, isAuthenticated, isConcurrentDdlRace, isDatabaseAdapter, isDuplicateObjectRace, isLocalhostOrigin, isNodeRuntime, isOperationAllowed, isTopologyEnvVar, isTransformableImage, lazyResource, listBackupObjects, listenWithPortRetry, loadBootEnv, loadBundle, loadBundleConfigExports, loadBundleSchema, loadCollectionsFromDirectory, loadCronJobsFromDirectory, loadCronJobsWithDiagnostics, loadDeclaredStorageSources, loadEnv, loadFunctionsFromDirectory, loadFunctionsWithDiagnostics, loadUsersCollection, logger, oauthCodeFlowSchema, optionalAuth, parseBackupDestination, parseBackupTimestamp, parseTransformOptions, pendingBackgroundWork, pkceTokenParams, providerVerifiedEmail, queryTokenAuth, raw, readBackupBytes, readBundleManifest, rebase, registerDevEmailSink, requireAdmin, requireAuth, requireDriver, requireEnv, requireRole, resolveAuthHooks, resolveAuthOptions, resolveCorsOrigin, resolveDataSources, resolveEmailBranding, resolveEmailLinkBase, resolveEmailOptions, resolveRequireAuth, resolveStorageAccessControl, resolveStorageBackend, resolveStorageSources, runFromBundle, runtimeKey, safeCompare, serveSPA, summarize as summarizeRlsScan, transformImage, tryVerifyOidcIdToken, unknownKeyPolicyFromEnv, validateApiKey, validateCronExpression, validatePasswordStrength, verifyOidcIdToken, verifyPassword, waitUntil };
 
 //# sourceMappingURL=index.es.js.map