@rebasepro/server 0.16.0 → 0.16.1-canary.g2d1aec8

package/dist/index.es.js

@@ -4,43 +4,50 @@ __createRequire(import.meta.url);
 import { A as GeoPoint, M as RebaseApiError, N as RebaseClientError, O as EntityReference, S as toSnakeCase, _ as fieldKeyForColumn, b as buildCompositeId, c as collectAllPages, d as normalizeOrderBy, f as serializeOrderBy, g as getEffectiveSecurityRules, h as resolveDataSource, j as Vector, k as EntityRelation, l as paginateFind, m as createDataSourceRegistry, n as buildSdkData, o as serializeFilter, p as CollectionRegistry, s as serializeLogicalCondition, t as buildRoutedRebaseData, u as resolveFindWindow, v as findRelation, x as resolvePrimaryKeys, y as resolveCollectionRelations } from "./src-BPfYOeN4.js";
 import { c as DEFAULT_DATA_SOURCE_KEY, g as toCanonicalOp, i as getCollectionDataPath, m as parseRelationAggregateSort, n as RLS_ROLES_SQL, o as isPostgresCollectionConfig, r as RLS_UID_SQL, t as RLS_JWT_SQL } from "./src-CrCxd8km.js";
 import { n as ADMIN_PROPERTY_KEYS, t as ADMIN_COLLECTION_KEYS } from "./admin_block-DLILvzle.js";
-import { a as isDuplicateObjectRace, i as isConcurrentDdlRace, n as createDdlBootstrapper, o as revokeInternalTableSql, s as isSQLAdmin, t as CONCURRENT_DDL_SQLSTATES } from "./ddl-bootstrap-Cywoj8Ta.js";
-import { C as canonicalStorageKey, D as findStorageSuffixCollision, E as DEFAULT_STORAGE_SOURCE_KEY, O as normalizeStorageSources, S as canonicalStorageId, b as InvalidStorageKeyError, c as getJwks, d as hasAsymmetricSigningKey, i as generateDownloadToken, k as storageEnvSuffix, n as configureJwt, p as isJwtConfigured, v as normalizePemFromEnv, x as canonicalStorageBucket, y as InvalidStorageBucketError } from "./jwt-DxH9fLPt.js";
-import { n as createContractRoutes, r as computeSchemaVersion } from "./contract-routes-DZ-LBpSL.js";
-import { $ as createAdapterAuthMiddleware, A as _coercedNumber, B as validatePasswordStrength, C as providerVerifiedEmail, Ct as parseQueryOptions, D as _enum, E as ZodNumber, Et as isPublicStoragePath, F as createEmailService, G as getPasswordResetTemplate, H as generateSecurePassword, I as assertEmailLinkBases, J as resolveEmailBranding, K as getUserInvitationTemplate, L as resolveEmailLinkBase, M as createDataRateLimiter, N as MemoryRateLimitStore, O as object, P as SMTPEmailService, Q as raw, R as resolveAuthHooks, S as pkceTokenParams, St as parseGroupBy, T as createBuiltinAuthAdapter, Tt as PUBLIC_STORAGE_PREFIX, U as getEmailVerificationTemplate, V as verifyPassword, W as getMagicLinkTemplate, X as escapeHtml, Y as RawHtml, Z as html, _ as verifyOidcIdToken, _t as scopeDataDriver, a as resolveRateLimitStoreKind, at as publicObjectAuth, b as createGoogleProvider, bt as orderByEntriesToTuples, c as createSlackProvider, ct as requireAuth, d as createDiscordProvider, dt as createStorageApiKeyGuard, et as createAuthMiddleware, f as createTwitterProvider, ft as isApiKeyToken, g as tryVerifyOidcIdToken, gt as SERVICE_IDENTITY, h as createMicrosoftProvider, ht as safeCompare, i as createApiKeyStore, it as optionalAuth, j as DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT, k as string, l as createBitbucketProvider, lt as createApiKeyPreAuth, m as createAppleProvider, mt as extractBearerToken, n as createCustomAuthAdapter, nt as extractUserFromToken, o as createSqlRateLimitStore, ot as queryTokenAuth, p as createFacebookProvider, pt as validateApiKey, q as getWelcomeEmailTemplate, r as createApiKeyRoutes, rt as fileTokenAuth, s as createSpotifyProvider, st as requireAdmin, tt as createRequireAuth, u as createGitLabProvider, ut as createFunctionApiKeyGuard, v as createGitHubProvider, vt as httpMethodToOperation, w as createJwksRoutes, wt as resolveListLimitParam, x as oauthCodeFlowSchema, xt as parseAggregateSelect, y as createLinkedinProvider, yt as isOperationAllowed, z as hashPassword } from "./auth-5Et5mnUA.js";
-import { t as logger } from "./logger-DfvF_8r-.js";
-import { n as errorHandler, t as ApiError } from "./errors-EBYiaJ2E.js";
+import { a as isDuplicateObjectRace, c as isSchemaEditingAdmin, i as isConcurrentDdlRace, n as createDdlBootstrapper, o as revokeInternalTableSql, s as isSQLAdmin, t as CONCURRENT_DDL_SQLSTATES } from "./ddl-bootstrap-DgSnERYN.js";
+import { C as canonicalStorageKey, D as findStorageSuffixCollision, E as DEFAULT_STORAGE_SOURCE_KEY, O as normalizeStorageSources, S as canonicalStorageId, b as InvalidStorageKeyError, c as getJwks, d as hasAsymmetricSigningKey, i as generateDownloadToken, k as storageEnvSuffix, n as configureJwt, p as isJwtConfigured, v as normalizePemFromEnv, x as canonicalStorageBucket, y as InvalidStorageBucketError } from "./jwt-BbJi0TR0.js";
+import { n as createContractRoutes, r as computeSchemaVersion } from "./contract-routes-BEq7euZg.js";
+import { $ as html, A as _coercedNumber, B as resolveAuthHooks, C as providerVerifiedEmail, Ct as orderByEntriesToTuples, D as _enum, Dt as resolveListLimitParam, E as ZodNumber, Et as parseQueryOptions, F as extractLinks, G as getEmailVerificationTemplate, H as validatePasswordStrength, I as SMTPEmailService, J as getUserInvitationTemplate, K as getMagicLinkTemplate, L as createEmailService, M as createDataRateLimiter, N as MemoryRateLimitStore, O as object, Ot as PUBLIC_STORAGE_PREFIX, P as createDevEmailSink, Q as escapeHtml, R as assertEmailLinkBases, S as pkceTokenParams, St as isOperationAllowed, T as createBuiltinAuthAdapter, Tt as parseGroupBy, U as verifyPassword, V as hashPassword, W as generateSecurePassword, X as resolveEmailBranding, Y as getWelcomeEmailTemplate, Z as RawHtml, _ as verifyOidcIdToken, _t as safeCompare, a as resolveRateLimitStoreKind, at as fileTokenAuth, b as createGoogleProvider, bt as hasAdministrativeRole, c as createSlackProvider, ct as queryTokenAuth, d as createDiscordProvider, dt as createApiKeyPreAuth, et as raw, f as createTwitterProvider, ft as createFunctionApiKeyGuard, g as tryVerifyOidcIdToken, gt as extractBearerToken, h as createMicrosoftProvider, ht as validateApiKey, i as createApiKeyStore, it as extractUserFromToken, j as DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT, k as string, kt as isPublicStoragePath, l as createBitbucketProvider, lt as requireAdmin, m as createAppleProvider, mt as isApiKeyToken, n as createCustomAuthAdapter, nt as createAuthMiddleware, o as createSqlRateLimitStore, ot as optionalAuth, p as createFacebookProvider, pt as createStorageApiKeyGuard, q as getPasswordResetTemplate, r as createApiKeyRoutes, rt as createRequireAuth, s as createSpotifyProvider, st as publicObjectAuth, tt as createAdapterAuthMiddleware, u as createGitLabProvider, ut as requireAuth, v as createGitHubProvider, vt as SERVICE_IDENTITY, w as createJwksRoutes, wt as parseAggregateSelect, x as oauthCodeFlowSchema, xt as httpMethodToOperation, y as createLinkedinProvider, yt as scopeDataDriver, z as resolveEmailLinkBase } from "./auth-C74dqR2B.js";
+import { r as hostEnv, t as logger } from "./logger-TdvXIGqR.js";
+import { n as errorHandler, t as ApiError } from "./errors-D_LwNKRM.js";
 import { t as logMiddleware } from "./logs-routes-CWBLQj2l.js";
 import { n as DOCUMENT_MIME_TYPES, r as IMAGE_MIME_TYPES, t as DEFAULT_MAX_FILE_SIZE } from "./types-DSnOC4mF.js";
 import { t as S3StorageController } from "./S3StorageController-B2EDXXMH.js";
 import { t as GCSStorageController } from "./GCSStorageController-BEmDYFKc.js";
-import { n as loadFunctionsFromDirectory } from "./function-loader-DDS1v7YX.js";
+import { n as loadFunctionsFromDirectory, r as loadFunctionsWithDiagnostics } from "./function-loader-BrLmC_-y.js";
 import { t as createFunctionRoutes } from "./function-routes-Btcez1T-.js";
-import { n as loadCronJobsFromDirectory, r as loadCronJobsWithDiagnostics } from "./cron-loader-YhhQeVBM.js";
-import { r as validateCronExpression, t as CronScheduler } from "./cron-scheduler-DIpYBmZP.js";
-import { t as createCronRoutes } from "./cron-routes-maM_RlUu.js";
-import { t as createCronStore } from "./cron-store-DfH_4Cd9.js";
-import { a as parseBackupTimestamp, i as parseBackupDestination, n as createBackupRoutes, o as readBackupBytes, r as listBackupObjects } from "./backup-C6ljYVTp.js";
-import { i as createJobStore, n as createJobQueue, r as defaultBackoff } from "./jobs-CyOKXXlu.js";
+import "./proxy-QJKSS-CV.js";
+import "./request-timeout-OofPCHQT.js";
 import { t as FunctionSelectionError } from "./selection-_z6TM1DB.js";
-import { createHash, randomBytes, randomUUID } from "node:crypto";
-import * as fs$2 from "fs";
+import { n as loadCronJobsFromDirectory, r as loadCronJobsWithDiagnostics } from "./cron-loader-BMvtW6-J.js";
+import { r as validateCronExpression, t as CronScheduler } from "./cron-scheduler-Buf-uVam.js";
+import { t as createCronRoutes } from "./cron-routes-BvYk-Kmi.js";
+import { t as createCronStore } from "./cron-store-CyF-oInV.js";
+import { a as parseBackupTimestamp, i as parseBackupDestination, n as createBackupRoutes, o as readBackupBytes, r as listBackupObjects } from "./backup-BJ86ah4T.js";
+import { i as createJobStore, n as createJobQueue, r as defaultBackoff } from "./jobs-Bn6nhY8J.js";
+import { createHash, createSign, randomBytes, randomUUID } from "node:crypto";
+import * as fs$3 from "fs";
 import fs, { existsSync } from "fs";
-import * as path$2 from "path";
+import * as path$3 from "path";
 import path, { join } from "path";
 import { pathToFileURL } from "url";
 import { Hono } from "hono";
 import { promisify } from "util";
 import * as crypto$1 from "crypto";
 import { createHmac, randomUUID as randomUUID$1 } from "crypto";
+import * as path$2 from "node:path";
 import path$1 from "node:path";
 import { bodyLimit } from "hono/body-limit";
 import { csrf } from "hono/csrf";
 import { compress } from "hono/compress";
 import fs$1 from "node:fs";
+import * as fs$2 from "node:fs/promises";
 import fsp from "node:fs/promises";
 import os from "node:os";
 import { mkdir, open, unlink, writeFile } from "fs/promises";
+import { execFile } from "node:child_process";
+import { promisify as promisify$1 } from "node:util";
+import { env, getRuntimeKey } from "hono/adapter";
 import { sql } from "drizzle-orm";
 import { lookup } from "node:dns/promises";
 import { isIP } from "node:net";
@@ -49,8 +56,14 @@ import { createServer } from "http";
 import { cors } from "hono/cors";
 import { secureHeaders } from "hono/secure-headers";
 import { getRequestListener } from "@hono/node-server";
-import { execFile } from "node:child_process";
-import { promisify as promisify$1 } from "node:util";
+//#region ../types/src/types/schema_editing.ts
+var DEFAULT_COMMIT_PATHS = {
+	schemaFile: "backend/src/schema.generated.ts",
+	ddlFile: "drizzle/schema.sql",
+	policiesFile: "drizzle/policies.sql",
+	searchFile: "drizzle/search.sql"
+};
+//#endregion
 //#region src/collections/BackendCollectionRegistry.ts
 /**
 * Backend-agnostic collection registry.
@@ -161,7 +174,7 @@ var PROPERTY_KEYS_BY_TYPE = {
 	],
 	geopoint: [],
 	binary: [],
-	vector: ["dimensions"],
+	vector: ["dimensions", "index"],
 	reference: [
 		"isId",
 		"path",
@@ -464,8 +477,8 @@ async function importModule(filePath) {
 /** Read `defaultSecurityRules` from a collections directory's index module. */
 async function readDefaults(directory) {
 	for (const name of ["index.ts", "index.js"]) {
-		const indexPath = path$2.join(directory, name);
-		if (!fs$2.existsSync(indexPath)) continue;
+		const indexPath = path$3.join(directory, name);
+		if (!fs$3.existsSync(indexPath)) continue;
 		try {
 			return { defaultSecurityRules: (await importModule(indexPath)).defaultSecurityRules };
 		} catch (err) {
@@ -502,23 +515,23 @@ function applyCollectionDefaults(collections, defaults) {
 * rejects.
 */
 async function loadCollectionsFromDirectory(source, options = {}) {
-	const resolved = path$2.resolve(source);
+	const resolved = path$3.resolve(source);
 	const validate = (collections) => {
 		if (options.validate !== false) assertCollectionConfigs(collections, options.validate ?? {});
 		return collections;
 	};
-	if (!fs$2.existsSync(resolved)) {
+	if (!fs$3.existsSync(resolved)) {
 		logger.warn(`[collections] Not found: ${resolved}`);
 		return [];
 	}
-	if (!fs$2.statSync(resolved).isDirectory()) {
+	if (!fs$3.statSync(resolved).isDirectory()) {
 		const mod = await importModule(resolved);
 		return validate(applyCollectionDefaults([...mod.backendCollections || mod.collections || []], { defaultSecurityRules: mod.defaultSecurityRules }));
 	}
 	const collections = [];
 	const failures = [];
-	for (const file of fs$2.readdirSync(resolved).filter(isCollectionFile)) try {
-		const mod = await importModule(path$2.join(resolved, file));
+	for (const file of fs$3.readdirSync(resolved).filter(isCollectionFile)) try {
+		const mod = await importModule(path$3.join(resolved, file));
 		if (mod?.default) collections.push(mod.default);
 		else failures.push(`${file}: no default export`);
 	} catch (err) {
@@ -2632,13 +2645,13 @@ function configureMiddlewares(app, basePath, isProduction, config) {
 /**
 * Local filesystem storage controller
 */
-var mkdir$1 = promisify(fs$2.mkdir);
-var writeFile$1 = promisify(fs$2.writeFile);
-var readFile = promisify(fs$2.readFile);
-var unlink$1 = promisify(fs$2.unlink);
-var readdir = promisify(fs$2.readdir);
-var stat = promisify(fs$2.stat);
-var access = promisify(fs$2.access);
+var mkdir$1 = promisify(fs$3.mkdir);
+var writeFile$1 = promisify(fs$3.writeFile);
+var readFile = promisify(fs$3.readFile);
+var unlink$1 = promisify(fs$3.unlink);
+var readdir = promisify(fs$3.readdir);
+var stat = promisify(fs$3.stat);
+var access = promisify(fs$3.access);
 /**
 * Remove initial and trailing slashes from a path.
 * Handles paths like "/images/", "images/", "/images" → "images"
@@ -2658,7 +2671,7 @@ var LocalStorageController = class {
 	basePath;
 	constructor(config) {
 		this.config = config;
-		this.basePath = path$2.resolve(config.basePath);
+		this.basePath = path$3.resolve(config.basePath);
 	}
 	getType() {
 		return "local";
@@ -2699,10 +2712,10 @@ var LocalStorageController = class {
 	* depend on it having run.
 	*/
 	getFullPath(storagePath, bucket) {
-		const bucketPath = path$2.resolve(this.basePath, bucket || "default");
-		if (!bucketPath.startsWith(this.basePath + path$2.sep)) throw new Error("Path traversal detected: bucket resolves outside the storage root.");
-		const resolved = path$2.resolve(bucketPath, storagePath);
-		if (!resolved.startsWith(bucketPath + path$2.sep) && resolved !== bucketPath) throw new Error("Path traversal detected: resolved storage path is outside the bucket directory.");
+		const bucketPath = path$3.resolve(this.basePath, bucket || "default");
+		if (!bucketPath.startsWith(this.basePath + path$3.sep)) throw new Error("Path traversal detected: bucket resolves outside the storage root.");
+		const resolved = path$3.resolve(bucketPath, storagePath);
+		if (!resolved.startsWith(bucketPath + path$3.sep) && resolved !== bucketPath) throw new Error("Path traversal detected: resolved storage path is outside the bucket directory.");
 		return resolved;
 	}
 	/**
@@ -2720,7 +2733,7 @@ var LocalStorageController = class {
 		const usedBucket = bucket || "default";
 		const fullStoragePath = key;
 		const fullPath = this.getFullPath(fullStoragePath, usedBucket);
-		await this.ensureDir(path$2.dirname(fullPath));
+		await this.ensureDir(path$3.dirname(fullPath));
 		const arrayBuffer = await file.arrayBuffer();
 		await writeFile$1(fullPath, Buffer.from(arrayBuffer));
 		await writeFile$1(`${fullPath}.metadata.json`, JSON.stringify({
@@ -2749,7 +2762,7 @@ var LocalStorageController = class {
 		resolvedPath = normalizeStoragePath(resolvedPath);
 		const fullPath = this.getFullPath(resolvedPath, resolvedBucket);
 		try {
-			await access(fullPath, fs$2.constants.R_OK);
+			await access(fullPath, fs$3.constants.R_OK);
 		} catch {
 			return {
 				url: null,
@@ -2765,7 +2778,7 @@ var LocalStorageController = class {
 			metadata = {
 				bucket: resolvedBucket ?? "default",
 				fullPath: resolvedPath,
-				name: path$2.basename(resolvedPath),
+				name: path$3.basename(resolvedPath),
 				size: fileStat.size,
 				contentType: savedMetadata.contentType || "application/octet-stream",
 				customMetadata: savedMetadata
@@ -2776,7 +2789,7 @@ var LocalStorageController = class {
 				metadata = {
 					bucket: resolvedBucket ?? "default",
 					fullPath: resolvedPath,
-					name: path$2.basename(resolvedPath),
+					name: path$3.basename(resolvedPath),
 					size: fileStat.size,
 					contentType: "application/octet-stream",
 					customMetadata: {}
@@ -2802,7 +2815,7 @@ var LocalStorageController = class {
 		resolvedPath = normalizeStoragePath(resolvedPath);
 		const fullPath = this.getFullPath(resolvedPath, resolvedBucket);
 		try {
-			await access(fullPath, fs$2.constants.R_OK);
+			await access(fullPath, fs$3.constants.R_OK);
 			const buffer = await readFile(fullPath);
 			let contentType = "application/octet-stream";
 			try {
@@ -2810,7 +2823,7 @@ var LocalStorageController = class {
 				contentType = JSON.parse(metadataContent).contentType || contentType;
 			} catch {}
 			const blob = new Blob([buffer], { type: contentType });
-			return new File([blob], path$2.basename(resolvedPath), { type: contentType });
+			return new File([blob], path$3.basename(resolvedPath), { type: contentType });
 		} catch {
 			return null;
 		}
@@ -2830,12 +2843,12 @@ var LocalStorageController = class {
 		if (!resolvedPath) return;
 		const fullPath = this.getFullPath(resolvedPath, resolvedBucket);
 		try {
-			await access(fullPath, fs$2.constants.F_OK);
+			await access(fullPath, fs$3.constants.F_OK);
 		} catch {
 			return;
 		}
 		try {
-			if ((await stat(fullPath)).isDirectory()) await fs$2.promises.rmdir(fullPath);
+			if ((await stat(fullPath)).isDirectory()) await fs$3.promises.rmdir(fullPath);
 			else {
 				await unlink$1(fullPath);
 				try {
@@ -2856,7 +2869,7 @@ var LocalStorageController = class {
 		const items = [];
 		const prefixes = [];
 		try {
-			await access(fullPath, fs$2.constants.R_OK);
+			await access(fullPath, fs$3.constants.R_OK);
 			const entries = await readdir(fullPath, { withFileTypes: true });
 			let count = 0;
 			const maxResults = options?.maxResults ?? 1e3;
@@ -3032,6 +3045,138 @@ function isStorageController(obj) {
 	return typeof controller.putObject === "function" && typeof controller.getSignedUrl === "function" && typeof controller.deleteObject === "function" && typeof controller.listObjects === "function" && typeof controller.getType === "function";
 }
 //#endregion
+//#region src/storage/cache-headers.ts
+/**
+* A weak validator built from size and modification time.
+*
+* Weak (`W/`) because it is not a digest of the body: two different bodies of
+* the same length written in the same millisecond would collide. That is the
+* same trade nginx makes for static files, and the alternative — hashing every
+* object on every request — costs more than it saves for content this server is
+* already streaming from somewhere else.
+*/
+function buildEntityTag(size, lastModifiedMs) {
+	return `W/"${size.toString(16)}-${Math.floor(lastModifiedMs).toString(16)}"`;
+}
+function objectValidators(size, lastModifiedMs) {
+	const seconds = Math.floor(lastModifiedMs / 1e3) * 1e3;
+	return {
+		etag: buildEntityTag(size, lastModifiedMs),
+		lastModified: new Date(seconds).toUTCString(),
+		lastModifiedMs: seconds
+	};
+}
+function cacheControl(options) {
+	const parts = [options.isPublic ? "public" : "private", `max-age=${options.maxAgeSeconds}`];
+	if (options.isPublic && options.staleWhileRevalidateSeconds) parts.push(`stale-while-revalidate=${options.staleWhileRevalidateSeconds}`);
+	parts.push("must-revalidate");
+	return parts.join(", ");
+}
+/** Every `ETag` in an `If-None-Match` header, unquoted comparison-ready. */
+function parseIfNoneMatch(header) {
+	return header.split(",").map((part) => part.trim()).filter(Boolean);
+}
+/**
+* Weak comparison, which is the only comparison `If-None-Match` on a GET is
+* allowed to use (RFC 9110 §8.8.3.2). `W/"x"` and `"x"` are the same entity for
+* this purpose, so the prefix is stripped from both sides before comparing.
+*/
+function weakMatch(a, b) {
+	const strip = (v) => v.startsWith("W/") ? v.slice(2) : v;
+	return strip(a) === strip(b);
+}
+/**
+* Whether the request already holds this exact representation.
+*
+* `If-None-Match` wins outright when present: it is an exact validator, whereas
+* `If-Modified-Since` has second resolution and is only consulted in its
+* absence — again the order RFC 9110 requires.
+*/
+function isNotModified(c, validators) {
+	const ifNoneMatch = c.req.header("if-none-match");
+	if (ifNoneMatch) {
+		const tags = parseIfNoneMatch(ifNoneMatch);
+		return tags.includes("*") || tags.some((tag) => weakMatch(tag, validators.etag));
+	}
+	const ifModifiedSince = c.req.header("if-modified-since");
+	if (ifModifiedSince) {
+		const since = Date.parse(ifModifiedSince);
+		if (!Number.isNaN(since)) return validators.lastModifiedMs <= since;
+	}
+	return false;
+}
+/**
+* Put the validators and the cache policy on a response.
+*
+* Applied to the 304 as well as the 200: a 304 that omits them tells the client
+* nothing about how long the answer holds, so the next load revalidates again
+* immediately and the round trip repeats forever.
+*/
+function applyCacheHeaders(c, validators, options) {
+	c.header("ETag", validators.etag);
+	c.header("Last-Modified", validators.lastModified);
+	c.header("Cache-Control", cacheControl(options));
+	c.header("Vary", "Authorization");
+}
+//#endregion
+//#region src/storage/range.ts
+/**
+* Parse a `Range` header against an object of `size` bytes.
+*
+* Deliberately conservative: anything malformed, multi-range, or in a unit other
+* than bytes resolves to `none`, which serves the whole object. A range request
+* answered with `200` is always legal; a range answered wrongly is a corrupted
+* download.
+*/
+function parseRange(header, size) {
+	if (!header) return { kind: "none" };
+	const match = /^bytes=(.*)$/i.exec(header.trim());
+	if (!match) return { kind: "none" };
+	const spec = match[1].trim();
+	if (spec.includes(",")) return { kind: "none" };
+	const parts = /^(\d*)-(\d*)$/.exec(spec);
+	if (!parts) return { kind: "none" };
+	const [, rawStart, rawEnd] = parts;
+	if (size === 0) return { kind: "unsatisfiable" };
+	let start;
+	let end;
+	if (rawStart === "") {
+		if (rawEnd === "") return { kind: "none" };
+		const suffix = Number(rawEnd);
+		if (!Number.isSafeInteger(suffix)) return { kind: "none" };
+		if (suffix === 0) return { kind: "unsatisfiable" };
+		start = Math.max(0, size - suffix);
+		end = size - 1;
+	} else {
+		start = Number(rawStart);
+		if (!Number.isSafeInteger(start)) return { kind: "none" };
+		if (start >= size) return { kind: "unsatisfiable" };
+		if (rawEnd === "") end = size - 1;
+		else {
+			end = Number(rawEnd);
+			if (!Number.isSafeInteger(end)) return { kind: "none" };
+			end = Math.min(end, size - 1);
+		}
+		if (end < start) return { kind: "unsatisfiable" };
+	}
+	return {
+		kind: "range",
+		range: {
+			start,
+			end,
+			length: end - start + 1
+		}
+	};
+}
+/** The `Content-Range` for a served range. */
+function contentRange(range, size) {
+	return `bytes ${range.start}-${range.end}/${size}`;
+}
+/** The `Content-Range` for a `416`, which names the size and no range. */
+function unsatisfiableContentRange(size) {
+	return `bytes */${size}`;
+}
+//#endregion
 //#region src/storage/image-transform.ts
 /**
 * Image Transformation Service
@@ -3893,11 +4038,20 @@ function createStorageRoutes(config) {
 		await checkAuthorized(c, "read", resolvedPath, bucket, storageId);
 		c.header("X-Content-Type-Options", "nosniff");
 		const transformKeyPrefix = `${storageId || "(default)"}/${bucket}/${resolvedPath}`;
+		const sharedCacheable = publicRead === true || isPublicStoragePath(resolvedPath);
+		const cachePolicy = (maxAgeSeconds) => ({
+			isPublic: sharedCacheable,
+			maxAgeSeconds,
+			staleWhileRevalidateSeconds: 86400
+		});
+		const OBJECT_MAX_AGE = 60;
+		const TRANSFORM_MAX_AGE = 3600;
 		const transformOpts = transformOptionsOrBadRequest(c.req.query());
 		if (resolved.getType() === "local") {
 			const absolutePath = resolved.getAbsolutePath(resolvedPath, bucket ?? "default");
+			let localStat;
 			try {
-				await fsp.access(absolutePath);
+				localStat = await fsp.stat(absolutePath);
 			} catch {
 				throw ApiError.notFound("File not found");
 			}
@@ -3908,31 +4062,75 @@ function createStorageRoutes(config) {
 				contentType = JSON.parse(metadataRaw).contentType || contentType;
 			} catch {}
 			if (transformOpts && isTransformableImage(contentType)) {
-				const transformed = await transformOnce(transformCache.buildKey(transformKeyPrefix, transformOpts), transformOpts, async () => Buffer.from(await fsp.readFile(absolutePath)));
+				const sourceVersion = buildEntityTag(localStat.size, localStat.mtimeMs);
+				const transformed = await transformOnce(transformCache.buildKey(`${transformKeyPrefix}@${sourceVersion}`, transformOpts), transformOpts, async () => Buffer.from(await fsp.readFile(absolutePath)));
+				const validators = objectValidators(transformed.data.byteLength, localStat.mtimeMs);
+				applyCacheHeaders(c, validators, cachePolicy(TRANSFORM_MAX_AGE));
+				if (isNotModified(c, validators)) return c.body(null, 304);
 				c.header("Content-Type", transformed.contentType);
-				c.header("Cache-Control", "public, max-age=31536000, immutable");
 				return c.body(new Uint8Array(transformed.data));
 			}
-			const fileContent = await fsp.readFile(absolutePath);
+			const validators = objectValidators(localStat.size, localStat.mtimeMs);
+			applyCacheHeaders(c, validators, cachePolicy(OBJECT_MAX_AGE));
 			const served = resolveServedContentType(contentType);
 			c.header("Content-Type", served.contentType);
 			if (served.attachment) c.header("Content-Disposition", "attachment");
+			c.header("Accept-Ranges", "bytes");
+			if (isNotModified(c, validators)) return c.body(null, 304);
+			const localRange = parseRange(c.req.header("range"), localStat.size);
+			if (localRange.kind === "unsatisfiable") {
+				c.header("Content-Range", unsatisfiableContentRange(localStat.size));
+				return c.body(null, 416);
+			}
+			if (localRange.kind === "range") {
+				const { start, length } = localRange.range;
+				const handle = await fsp.open(absolutePath, "r");
+				try {
+					const buffer = Buffer.alloc(length);
+					await handle.read(buffer, 0, length, start);
+					c.header("Content-Range", contentRange(localRange.range, localStat.size));
+					c.header("Content-Length", String(length));
+					return c.body(new Uint8Array(buffer), 206);
+				} finally {
+					await handle.close();
+				}
+			}
+			c.header("Content-Length", String(localStat.size));
+			const fileContent = await fsp.readFile(absolutePath);
 			return c.body(new Uint8Array(fileContent));
 		}
 		const fileObject = await resolved.getObject(resolvedPath, bucket);
 		if (!fileObject) throw ApiError.notFound("File not found");
 		const remoteContentType = fileObject.type || "application/octet-stream";
 		if (transformOpts && isTransformableImage(remoteContentType)) {
-			const transformed = await transformOnce(transformCache.buildKey(transformKeyPrefix, transformOpts), transformOpts, async () => Buffer.from(await fileObject.arrayBuffer()));
+			const sourceVersion = buildEntityTag(fileObject.size, fileObject.lastModified);
+			const transformed = await transformOnce(transformCache.buildKey(`${transformKeyPrefix}@${sourceVersion}`, transformOpts), transformOpts, async () => Buffer.from(await fileObject.arrayBuffer()));
+			const validators = objectValidators(transformed.data.byteLength, fileObject.lastModified);
+			applyCacheHeaders(c, validators, cachePolicy(TRANSFORM_MAX_AGE));
+			if (isNotModified(c, validators)) return c.body(null, 304);
 			c.header("Content-Type", transformed.contentType);
-			c.header("Cache-Control", "public, max-age=31536000, immutable");
 			return c.body(new Uint8Array(transformed.data));
 		}
 		const servedRemote = resolveServedContentType(remoteContentType);
 		c.header("Content-Type", servedRemote.contentType);
 		if (servedRemote.attachment) c.header("Content-Disposition", "attachment");
-		c.header("Cache-Control", "public, max-age=3600, immutable");
+		const remoteValidators = objectValidators(fileObject.size, fileObject.lastModified);
+		applyCacheHeaders(c, remoteValidators, cachePolicy(OBJECT_MAX_AGE));
+		c.header("Accept-Ranges", "bytes");
+		if (isNotModified(c, remoteValidators)) return c.body(null, 304);
+		const remoteRange = parseRange(c.req.header("range"), fileObject.size);
+		if (remoteRange.kind === "unsatisfiable") {
+			c.header("Content-Range", unsatisfiableContentRange(fileObject.size));
+			return c.body(null, 416);
+		}
 		const buf = await fileObject.arrayBuffer();
+		if (remoteRange.kind === "range") {
+			const { start, end, length } = remoteRange.range;
+			c.header("Content-Range", contentRange(remoteRange.range, fileObject.size));
+			c.header("Content-Length", String(length));
+			return c.body(new Uint8Array(buf.slice(start, end + 1)), 206);
+		}
+		c.header("Content-Length", String(fileObject.size));
 		return c.body(new Uint8Array(buf));
 	});
 	/**
@@ -4161,6 +4359,114 @@ function assertStorageAccessControlConfigured(state, isProduction) {
 	logger.warn(STORAGE_NO_ACCESS_CONTROL_MESSAGE);
 }
 //#endregion
+//#region src/storage/policies.ts
+var StoragePolicyError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "StoragePolicyError";
+	}
+};
+var ALL_OPERATIONS = [
+	"read",
+	"write",
+	"delete",
+	"list"
+];
+/**
+* Split a key into segments, dropping empty ones.
+*
+* Empty segments come from a leading slash or a `//`, and treating them as real
+* would let `users//x` match a pattern expecting a captured segment with the
+* empty string. Keys reaching here are already sanitized against traversal; this
+* is about matching, not safety.
+*/
+function segmentsOf(value) {
+	return value.split("/").filter((segment) => segment.length > 0);
+}
+function compile(policy, index) {
+	const label = `storagePolicies[${index}]`;
+	if (typeof policy.path !== "string" || policy.path.trim() === "") throw new StoragePolicyError(`${label}: \`path\` must be a non-empty string.`);
+	const segments = segmentsOf(policy.path);
+	if (segments.length === 0) throw new StoragePolicyError(`${label}: \`path\` "${policy.path}" names no segments. Use "**" to match every key.`);
+	const starIndex = segments.indexOf("**");
+	if (starIndex !== -1 && starIndex !== segments.length - 1) throw new StoragePolicyError(`${label}: "**" is only allowed as the last segment of \`path\`, and "${policy.path}" puts it in the middle. Use "*" for a single segment.`);
+	const captures = segments.filter((s) => s.startsWith(":")).map((s) => s.slice(1));
+	for (const name of captures) {
+		if (name === "") throw new StoragePolicyError(`${label}: a ":" placeholder in "${policy.path}" has no name.`);
+		if (captures.filter((c) => c === name).length > 1) throw new StoragePolicyError(`${label}: "${policy.path}" captures ":${name}" twice, so one would silently win.`);
+	}
+	if (policy.operations !== void 0) {
+		if (!Array.isArray(policy.operations) || policy.operations.length === 0) throw new StoragePolicyError(`${label}: \`operations\` is empty, so this policy grants nothing. Remove it to grant all, or name the operations.`);
+		for (const operation of policy.operations) if (!ALL_OPERATIONS.includes(operation)) throw new StoragePolicyError(`${label}: \`operations\` names "${operation}", which is not a storage operation. Use ${ALL_OPERATIONS.map((o) => `"${o}"`).join(", ")}.`);
+	}
+	if (policy.allow !== "public" && policy.allow !== "authenticated" && typeof policy.allow !== "function") throw new StoragePolicyError(`${label}: \`allow\` must be "public", "authenticated", or a function. A policy with no \`allow\` grants nothing, which is never what was meant.`);
+	return {
+		segments,
+		trailing: starIndex !== -1,
+		operations: new Set(policy.operations ?? ALL_OPERATIONS),
+		allow: policy.allow,
+		source: policy.path
+	};
+}
+/** Match a key's segments against a compiled pattern, capturing as it goes. */
+function match(compiled, key) {
+	const keySegments = segmentsOf(key);
+	const pattern = compiled.trailing ? compiled.segments.slice(0, -1) : compiled.segments;
+	if (compiled.trailing ? keySegments.length < pattern.length : keySegments.length !== pattern.length) return;
+	const params = {};
+	for (let i = 0; i < pattern.length; i++) {
+		const expected = pattern[i];
+		const actual = keySegments[i];
+		if (expected === "*") continue;
+		if (expected.startsWith(":")) {
+			params[expected.slice(1)] = actual;
+			continue;
+		}
+		if (expected !== actual) return void 0;
+	}
+	return params;
+}
+/**
+* Compile a policy list into a {@link StorageAuthorize}.
+*
+* Compiled once, at boot, so a malformed pattern fails the start rather than the
+* first upload. `fallback` is an explicit `storageAuthorize`, consulted only
+* when no policy matched.
+*/
+function compileStoragePolicies(policies, fallback) {
+	if (!Array.isArray(policies)) throw new StoragePolicyError("`storagePolicies` must be an array.");
+	const compiled = policies.map(compile);
+	return async (ctx) => {
+		for (const policy of compiled) {
+			if (!policy.operations.has(ctx.operation)) continue;
+			const params = match(policy, ctx.key);
+			if (!params) continue;
+			if (policy.allow === "public") return true;
+			if (policy.allow === "authenticated") {
+				if (ctx.user?.uid) return true;
+				continue;
+			}
+			if (await policy.allow({
+				...ctx,
+				params
+			})) return true;
+		}
+		if (fallback) return await fallback(ctx);
+		return false;
+	};
+}
+/**
+* The access-control function for a configuration, or `undefined` when it
+* declares none.
+*
+* Kept separate from {@link compileStoragePolicies} so `init` has one call to
+* make and one thing to reason about: policies, a hook, both, or neither.
+*/
+function resolveStorageAccessControl(config) {
+	if (config.storagePolicies?.length) return compileStoragePolicies(config.storagePolicies, config.storageAuthorize);
+	return config.storageAuthorize;
+}
+//#endregion
 //#region src/init/docs.ts
 /**
 * Serve the OpenAPI document, and Swagger UI outside production.
@@ -4256,6 +4562,101 @@ function createHealthCheck(defaultDriver, authSchemaCheck) {
 	};
 }
 //#endregion
+//#region src/functions/wait-until.ts
+/**
+* Pending background work, on a process-global slot for the reason given in
+* `../singleton.ts`: two copies of this module in one process must not each
+* hold half the work, or shutdown drains one half and drops the other.
+*/
+var PENDING_SLOT = Symbol.for("@rebasepro/server:pending-background-work");
+function pending() {
+	const global = globalThis;
+	if (!global[PENDING_SLOT]) global[PENDING_SLOT] = /* @__PURE__ */ new Set();
+	return global[PENDING_SLOT];
+}
+/**
+* Keep `work` alive past the response, on any runtime.
+*
+* Hand it a promise or a function returning one. Nothing is awaited: the
+* response goes out immediately, exactly as an un-awaited call would.
+*
+* What it buys, per host:
+*
+* - **Isolate hosts** (Workers, Deno Deploy, Vercel Edge): the host is told to
+*   keep the isolate alive until the promise settles. Without this the work is
+*   dropped when the response resolves.
+* - **Node**: the promise is tracked so {@link drainBackgroundWork} can wait for
+*   it during graceful shutdown instead of the process exiting out from under
+*   it.
+*
+* On every host a rejection is logged rather than left to the unhandled-rejection
+* handler, so the failure names the function it came from.
+*
+* @example
+* ```ts
+* app.post("/orders", requireAuth, async (c) => {
+*     const order = await createOrder(c);
+*     waitUntil(c, notifyWarehouse(order));   // caller does not wait for this
+*     return c.json({ id: order.id });
+* });
+* ```
+*/
+function waitUntil(c, work) {
+	let promise;
+	try {
+		promise = typeof work === "function" ? Promise.resolve(work()) : work;
+	} catch (error) {
+		logBackgroundFailure(c, error);
+		return;
+	}
+	const tracked = promise.catch((error) => {
+		logBackgroundFailure(c, error);
+	});
+	const set = pending();
+	set.add(tracked);
+	tracked.finally(() => set.delete(tracked));
+	try {
+		c.executionCtx?.waitUntil?.(tracked);
+	} catch {}
+}
+function logBackgroundFailure(c, error) {
+	logger.error("[functions] Background work failed after the response was sent", {
+		method: c.req?.method,
+		path: c.req?.path,
+		error: error instanceof Error ? error : new Error(String(error))
+	});
+}
+/** How many background promises are still in flight. Diagnostics and tests. */
+function pendingBackgroundWork() {
+	return pending().size;
+}
+/**
+* Wait for tracked background work to finish, up to `timeoutMs`.
+*
+* Called by the shutdown path after the server stops accepting connections. It
+* resolves to the number of promises still outstanding when it returned — `0`
+* for a clean drain, more than that for a timeout, which is worth a log line
+* because it means work was dropped.
+*
+* Rejections do not propagate: every tracked promise has already had a `catch`
+* attached by {@link waitUntil}.
+*/
+async function drainBackgroundWork(timeoutMs = 5e3) {
+	const set = pending();
+	if (set.size === 0) return 0;
+	let timer;
+	const expired = new Promise((resolve) => {
+		timer = setTimeout(() => resolve("timeout"), timeoutMs);
+		timer.unref?.();
+	});
+	try {
+		await Promise.race([Promise.allSettled([...set]), expired]);
+	} finally {
+		if (timer) clearTimeout(timer);
+	}
+	return set.size;
+}
+//#endregion
 //#region src/init/shutdown.ts
 /**
 * Install graceful-shutdown signal handlers for a Rebase backend.
@@ -4280,77 +4681,1072 @@ function createHealthCheck(defaultDriver, authSchemaCheck) {
 * installShutdownHandlers(backend, { onCleanup: () => pool.end() });
 * ```
 */
-function installShutdownHandlers(backend, options = {}) {
-	const { onCleanup, timeoutMs = 15e3, signals = ["SIGTERM", "SIGINT"], exit = process.exit } = options;
-	let shuttingDown = false;
-	const shutdownSequence = async (signal) => {
-		if (shuttingDown) return;
-		shuttingDown = true;
-		logger.info(`Received ${signal}, shutting down gracefully...`);
-		const forceTimer = setTimeout(() => {
-			logger.error(`Shutdown timed out after ${Math.round(timeoutMs / 1e3)}s. Forcefully exiting.`);
-			exit(1);
-		}, timeoutMs);
-		forceTimer.unref();
+function installShutdownHandlers(backend, options = {}) {
+	const { onCleanup, timeoutMs = 15e3, signals = ["SIGTERM", "SIGINT"], exit = process.exit } = options;
+	let shuttingDown = false;
+	const shutdownSequence = async (signal) => {
+		if (shuttingDown) return;
+		shuttingDown = true;
+		logger.info(`Received ${signal}, shutting down gracefully...`);
+		const forceTimer = setTimeout(() => {
+			logger.error(`Shutdown timed out after ${Math.round(timeoutMs / 1e3)}s. Forcefully exiting.`);
+			exit(1);
+		}, timeoutMs);
+		forceTimer.unref();
+		try {
+			await backend.shutdown(timeoutMs);
+			if (onCleanup) await onCleanup();
+			clearTimeout(forceTimer);
+			logger.info("Graceful shutdown complete.");
+			exit(0);
+		} catch (err) {
+			logger.error("Error during shutdown cleanup:", { error: err instanceof Error ? err : new Error(String(err)) });
+			exit(1);
+		}
+	};
+	const listeners = signals.map((signal) => {
+		const listener = () => {
+			shutdownSequence(signal);
+		};
+		process.on(signal, listener);
+		return {
+			signal,
+			listener
+		};
+	});
+	return () => {
+		for (const { signal, listener } of listeners) process.removeListener(signal, listener);
+	};
+}
+function createShutdown(config) {
+	return (timeoutMs = 15e3) => {
+		return new Promise((resolve) => {
+			(async () => {
+				logger.info("Shutting down Rebase Backend...");
+				if (config.cronScheduler) {
+					config.cronScheduler.stop();
+					logger.info("Cron scheduler stopped");
+				}
+				if (config.rlsAudit) config.rlsAudit.stop();
+				if (config.jobQueue) {
+					await config.jobQueue.stop();
+					logger.info("Job queue stopped");
+				}
+				const drainBudget = timeoutMs > 0 ? Math.min(5e3, timeoutMs) : 5e3;
+				const stillPending = await drainBackgroundWork(drainBudget);
+				if (stillPending > 0) logger.warn(`${stillPending} background task(s) handed to waitUntil() did not finish within ${drainBudget}ms and are being dropped. Give them an AbortSignal, or move work this long into a cron job or the job queue, where it is restartable.`);
+				for (const [key, rt] of Object.entries(config.realtimeServices)) try {
+					if (typeof rt.destroy === "function") {
+						await rt.destroy();
+						logger.info(`Realtime service "${key}" destroyed`);
+					} else if (typeof rt.stopListening === "function") {
+						await rt.stopListening();
+						logger.info(`Realtime service "${key}" LISTEN client stopped`);
+					}
+				} catch (err) {
+					logger.warn(`Error destroying realtime service "${key}":`, { error: err });
+				}
+				config.server.close(() => {
+					logger.info("HTTP server closed");
+					resolve();
+				});
+				if (timeoutMs > 0) setTimeout(() => {
+					logger.warn(`Forced shutdown after ${timeoutMs / 1e3}s timeout`);
+					resolve();
+				}, timeoutMs).unref();
+			})();
+		});
+	};
+}
+//#endregion
+//#region src/schema-edit/apply-schema-change.ts
+/**
+* The plan says the change is not applicable.
+*
+* Re-checked here rather than trusted from the planner: this module is the one
+* that writes and runs things, so the guarantee belongs where the consequence
+* is. A caller that built a plan by hand cannot route around it.
+*/
+var UnapplicableChangeError = class extends Error {
+	classified;
+	constructor(message, classified) {
+		super(message);
+		this.classified = classified;
+		this.name = "UnapplicableChangeError";
+	}
+};
+var DirtyWorkingTreeError = class extends Error {
+	paths;
+	constructor(paths) {
+		super("The working tree has uncommitted changes to files this would commit:\n" + paths.map((p) => `  • ${p}`).join("\n") + "\n  Commit or stash them first. A schema change must not sweep up work in progress.");
+		this.paths = paths;
+		this.name = "DirtyWorkingTreeError";
+	}
+};
+/**
+* Generate the commit, land it, then run the DDL.
+*
+* Throws only for things that mean *nothing happened*: a change the ensure path
+* cannot express, a dirty tree, or a failed commit. Once the commit lands,
+* every outcome is a result.
+*/
+async function applySchemaChange(input) {
+	const commit = input.plan;
+	if (!commit.classified.applicable) throw new UnapplicableChangeError("This change cannot be applied to a running database:\n" + commit.classified.changes.filter((change) => change.verdict !== "safe").map((change) => `  • ${change.detail}${change.remedy ? `\n    ${change.remedy}` : ""}`).join("\n"), commit.classified);
+	const plannedPaths = [...commit.files.map((file) => file.path), ...input.sourcePaths ?? []];
+	const dirty = (await input.repository.dirtyPaths()).filter((path) => plannedPaths.includes(path));
+	if (dirty.length > 0) throw new DirtyWorkingTreeError(dirty);
+	const branch = await input.repository.currentBranch();
+	const files = [...input.writeSource ? await input.writeSource() : [], ...commit.files];
+	const paths = files.map((file) => file.path);
+	await input.repository.writeFiles(files);
+	const sha = await input.repository.commit(paths, commit.message);
+	const committed = {
+		sha,
+		branch,
+		files: paths
+	};
+	if (commit.statements.length === 0) return {
+		committed,
+		applied: true,
+		statements: [],
+		classified: commit.classified,
+		summary: `Committed ${sha.slice(0, 9)} on ${branch}. No DDL was needed.`
+	};
+	try {
+		await input.apply(commit.statements);
+		return {
+			committed,
+			applied: true,
+			statements: commit.statements,
+			classified: commit.classified,
+			summary: `Committed ${sha.slice(0, 9)} on ${branch} and applied ${commit.statements.length} statement(s).`
+		};
+	} catch (err) {
+		const detail = err instanceof Error ? err.message : String(err);
+		return {
+			committed,
+			applied: false,
+			applyError: detail,
+			statements: commit.statements,
+			classified: commit.classified,
+			summary: `Committed ${sha.slice(0, 9)} on ${branch}, but the database was not changed: ${detail}. The change will be applied on the next boot.`
+		};
+	}
+}
+//#endregion
+//#region src/schema-edit/schema-edit-permissions.ts
+/**
+* A caller whose identity is a credential rather than a person.
+*
+* Two shapes, both set by the auth middleware:
+*
+* - the service key resolves to `uid: "service"` with `roles: ["admin"]`;
+* - an API key resolves to `uid: "api-key:<id>"`, with `service` among its
+*   roles and `admin` too when the key is an admin key.
+*
+* Detected by uid rather than by role, because `service` is also a role a
+* person could be granted, and a person with an unfortunate role name should
+* not lose the ability to commit under their own name.
+*/
+function machineKindOf(uid) {
+	if (uid === "service") return "service-key";
+	if (uid.startsWith("api-key:")) return "api-key";
+}
+/** Read the caller off the request context's `user`. */
+function classifyPrincipal(user) {
+	if (!user || typeof user !== "object") return {
+		kind: "anonymous",
+		uid: "",
+		roles: []
+	};
+	const { uid, roles } = user;
+	if (typeof uid !== "string" || uid.length === 0) return {
+		kind: "anonymous",
+		uid: "",
+		roles: []
+	};
+	const roleList = Array.isArray(roles) ? roles.filter((r) => typeof r === "string") : [];
+	const machineKind = machineKindOf(uid);
+	return {
+		kind: machineKind ? "machine" : "person",
+		uid,
+		roles: roleList,
+		machineKind
+	};
+}
+var MACHINE_REFUSAL = {
+	"service-key": "This request is authenticated with the server's service key, which identifies the server rather than a person. Applying a schema change writes a commit to your repository, and that commit needs an author.",
+	"api-key": "This request is authenticated with an API key, which identifies a credential rather than a person. Applying a schema change writes a commit to your repository, and that commit needs an author."
+};
+/**
+* What this caller may do.
+*
+* Assumes the admin gate has already run — this refines that decision rather
+* than replacing it, and an anonymous caller should never have reached here.
+* Handled anyway, because a capability function that trusts its caller to have
+* checked is one bad refactor away from granting everything.
+*/
+function schemaEditCapabilities(principal, policy = {}) {
+	if (principal.kind === "anonymous") return {
+		plan: false,
+		apply: false,
+		code: "UNAUTHORIZED",
+		reason: "This request carries no identity."
+	};
+	if (principal.kind === "machine" && !policy.allowMachineApply) return {
+		plan: true,
+		apply: false,
+		code: "SCHEMA_EDIT_REQUIRES_A_PERSON",
+		reason: `${MACHINE_REFUSAL[principal.machineKind ?? "api-key"]} Sign in as a user to apply it, or set \`liveSchema.allowMachineApply\` if an automated schema change is what you want.`
+	};
+	return {
+		plan: true,
+		apply: true
+	};
+}
+/**
+* The git identity for a machine that has been allowed to apply.
+*
+* Named for what it is. An operator reading `git log` a month from now should
+* be able to tell a change somebody made from one a pipeline made, and a
+* credential wearing a person-shaped name is how that distinction is lost.
+*/
+function machineCommitAuthor(principal) {
+	return {
+		name: principal.machineKind === "service-key" ? "Rebase service key" : `Rebase API key (${principal.uid.replace(/^api-key:/, "")})`,
+		email: `${principal.uid.replace(/[^A-Za-z0-9._-]/g, "-")}@machines.noreply.rebase.pro`
+	};
+}
+//#endregion
+//#region src/api/live-schema-routes.ts
+/**
+* Creating and altering collections against a running backend.
+*
+* The existing schema editor rewrites collection source and is off in
+* production, for an honest reason: a deployed server's files are rebuilt from
+* the repository on every deploy, so an edit there would be discarded. These
+* routes are the answer to that — they commit the change to the repository the
+* server is running in, and *then* apply the DDL, so the edit survives the next
+* deploy because the deploy is built from it.
+*
+* Two routes, and the first one is the important one.
+*
+* ## Why `plan` exists separately from `apply`
+*
+* `POST /plan` has no side effects and answers what would happen. That is not a
+* convenience: a schema change has three possible verdicts and two of them are
+* refusals, so a UI that could only try-and-see would be asking people to
+* discover `needs-migration` by pressing a button on a live database.
+*
+* It also surfaces the `diverges` cases, which are the ones nothing else in the
+* system reports — a required property that will arrive nullable, an enum value
+* that will never land. Those apply "successfully" today and leave a database
+* that does not match its configuration.
+*
+* ## What these routes will not do
+*
+* Anything the boot-time ensure path cannot express. No drops, no type changes,
+* no primary keys. The planner refuses them and this refuses to route around it
+* — `applySchemaChange` re-checks rather than trusting the plan it is handed.
+*/
+/**
+* The git identity for the caller.
+*
+* `undefined` when the request carries no user — a service key, say — which
+* lets the repository fall back to its own git config rather than inventing a
+* name for somebody.
+*/
+function commitAuthor(user) {
+	if (!user || typeof user !== "object") return void 0;
+	const { uid, email, displayName } = user;
+	if (!uid) return void 0;
+	return {
+		name: displayName || email || uid,
+		email: email || `${uid}@users.noreply.rebase.pro`
+	};
+}
+/**
+* What a collection id may contain.
+*
+* The same alphabet the AST editor sanitises to, stated at the boundary
+* instead. The id becomes a *filename* — `<collectionsDir>/<id>.ts` — in two
+* places, and only one of them checked it: the editor refuses a traversal when
+* it writes, but the caller derives the same path first, to hand the dirty
+* check the paths it is about to touch. A refusal that arrives one layer in is
+* a refusal that the layer above already acted on.
+*/
+var SAFE_COLLECTION_ID = /^[A-Za-z0-9_-]+$/;
+var parseProposed = (body) => {
+	const candidate = body;
+	if (!candidate?.collectionId || typeof candidate.collectionId !== "string") throw ApiError.badRequest("`collectionId` is required.", "INVALID_CHANGE");
+	if (!SAFE_COLLECTION_ID.test(candidate.collectionId)) throw ApiError.badRequest(`"${candidate.collectionId}" is not a usable collection id. It becomes a filename, so it may contain only letters, numbers, underscores and hyphens.`, "INVALID_CHANGE");
+	if (!candidate.collection || typeof candidate.collection !== "object") throw ApiError.badRequest("`collection` is required.", "INVALID_CHANGE");
+	return {
+		collectionId: candidate.collectionId,
+		collection: candidate.collection
+	};
+};
+/**
+* The proposed collection set: everything as it is, with one collection
+* replaced or added.
+*/
+function proposedCollections(current, change) {
+	const next = {
+		...change.collection,
+		slug: change.collectionId
+	};
+	const replaced = current.map((collection) => collection.slug === change.collectionId ? next : collection);
+	return replaced.some((collection) => collection.slug === change.collectionId) ? replaced : [...replaced, next];
+}
+function createLiveSchemaRoutes(config) {
+	const router = new Hono();
+	router.onError(errorHandler);
+	/**
+	* Whether this backend can edit its schema, and what is missing when it
+	* cannot.
+	*
+	* Every optional surface in this API answers `GET …/status` — see
+	* `docs/api-conventions.md`. The panel asks before it offers the control,
+	* because the alternative is a button that looks available and fails on
+	* press with a refusal the person could have been told about up front.
+	*
+	* Ordered by how fundamental the obstacle is: a driver that cannot plan is
+	* a different conversation from a missing dependency, which is a different
+	* conversation from a deployment with no source. Reporting the first one
+	* that applies is what keeps the message actionable.
+	*/
+	router.get("/status", (c) => {
+		const admin = config.getAdmin();
+		const repository = config.getRepository();
+		if (!isSchemaEditingAdmin(admin)) return c.json({
+			enabled: false,
+			canPlan: false,
+			code: "SCHEMA_EDITING_UNSUPPORTED",
+			reason: "This backend's driver cannot plan schema changes. Live editing is available on Postgres."
+		});
+		if (!config.writeSource) return c.json({
+			enabled: false,
+			canPlan: true,
+			code: "SCHEMA_EDITOR_MISSING_DEPENDENCY",
+			reason: "Rewriting collection source needs `ts-morph`, which is not installed on this server. Run `pnpm add -D ts-morph@28.0.0` to enable it."
+		});
+		if (!repository) return c.json({
+			enabled: false,
+			canPlan: true,
+			code: "SCHEMA_EDITING_NO_REPOSITORY",
+			reason: "There is no repository to commit to. Live schema editing writes the change to your project's source before applying it, so it needs the project mounted — a deployment running from a built bundle has compiled output and no source to edit."
+		});
+		const capabilities = schemaEditCapabilities(classifyPrincipal(c.get("user")), config.policy);
+		return c.json({
+			enabled: true,
+			canPlan: capabilities.plan,
+			canApply: capabilities.apply,
+			applyRefusedBecause: capabilities.reason,
+			applyRefusedCode: capabilities.code,
+			repository: repository.root
+		});
+	});
+	/** The admin, or a refusal naming what is missing rather than a 500. */
+	const requirePlanner = () => {
+		const admin = config.getAdmin();
+		if (!isSchemaEditingAdmin(admin)) throw ApiError.serviceUnavailable("This backend's driver cannot plan schema changes. Live editing is available on Postgres.", "SCHEMA_EDITING_UNSUPPORTED");
+		return admin;
+	};
+	const requireRepository = (author) => {
+		const repository = config.getRepository(author);
+		if (!repository) throw ApiError.serviceUnavailable("There is no repository to commit to. Live schema editing writes the change to your project's source before applying it, so it needs the project mounted — a deployment running from a built bundle has compiled output and no source to edit.", "SCHEMA_EDITING_NO_REPOSITORY");
+		return repository;
+	};
+	/**
+	* What would happen. No side effects, and deliberately reachable even when
+	* there is no repository — knowing a change is blocked is useful before
+	* knowing where it would be committed.
+	*/
+	router.post("/plan", async (c) => {
+		const change = parseProposed(await c.req.json());
+		const admin = requirePlanner();
+		const capabilities = schemaEditCapabilities(classifyPrincipal(c.get("user")), config.policy);
+		if (!capabilities.plan) throw ApiError.forbidden(capabilities.reason ?? "This caller may not plan schema changes.", capabilities.code ?? "FORBIDDEN");
+		const before = config.getCollections();
+		const after = proposedCollections(before, change);
+		const plan = await admin.planSchemaChange(before, after, { paths: config.commitPaths });
+		return c.json({
+			applicable: plan.classified.applicable,
+			verdict: plan.classified.verdict,
+			changes: plan.classified.changes,
+			statements: plan.statements,
+			files: plan.files.map((file) => file.path),
+			message: plan.message,
+			withheldConstraints: plan.withheldConstraints ?? []
+		});
+	});
+	router.post("/apply", async (c) => {
+		const change = parseProposed(await c.req.json());
+		const admin = requirePlanner();
+		const principal = classifyPrincipal(c.get("user"));
+		const capabilities = schemaEditCapabilities(principal, config.policy);
+		if (!capabilities.apply) throw ApiError.forbidden(capabilities.reason ?? "This caller may not apply schema changes.", capabilities.code ?? "FORBIDDEN");
+		const author = principal.kind === "machine" ? machineCommitAuthor(principal) : commitAuthor(c.get("user"));
+		const repository = requireRepository(author);
+		const before = config.getCollections();
+		const after = proposedCollections(before, change);
+		const plan = await admin.planSchemaChange(before, after, { paths: config.commitPaths });
+		if (!plan.classified.applicable) {
+			const blocking = plan.classified.changes.filter((c) => c.verdict !== "safe");
+			throw ApiError.badRequest("This change cannot be applied to a running database:\n" + blocking.map((c) => `  • ${c.detail}${c.remedy ? `\n    ${c.remedy}` : ""}`).join("\n"), "SCHEMA_CHANGE_UNAPPLICABLE", { changes: plan.classified.changes });
+		}
+		try {
+			const result = await applySchemaChange({
+				plan,
+				repository,
+				sourcePaths: config.sourcePathsFor?.(change) ?? [],
+				writeSource: config.writeSource ? () => config.writeSource(change) : void 0,
+				apply: async (statements) => {
+					const sql = config.getAdmin();
+					if (!isSQLAdmin(sql)) throw new Error("The driver cannot run SQL, so the change cannot be applied here.");
+					for (const statement of statements) await sql.executeSql(statement);
+				}
+			});
+			logger.info(`[schema-edit] ${result.summary}`);
+			return c.json({
+				...result,
+				withheldConstraints: plan.withheldConstraints ?? []
+			});
+		} catch (err) {
+			if (err instanceof UnapplicableChangeError) throw ApiError.badRequest(err.message, "SCHEMA_CHANGE_UNAPPLICABLE", { changes: err.classified.changes });
+			if (err instanceof DirtyWorkingTreeError) throw ApiError.conflict(err.message, "SCHEMA_EDIT_DIRTY_TREE");
+			throw ApiError.badRequest(err instanceof Error ? err.message : String(err), "SCHEMA_CHANGE_FAILED");
+		}
+	});
+	return router;
+}
+//#endregion
+//#region src/api/mount.ts
+/**
+* Mounting a surface at its canonical path, and at the path it used to have.
+*
+* Several admin-only surfaces grew up at the top level — `/api/cron`,
+* `/api/logs`, `/api/schema-editor` — while the ones added later went under
+* `/api/admin`. Nothing was wrong with either choice on its own; what was wrong
+* was having both, because the shape of the path stopped predicting whether a
+* caller needed to be an admin. `docs/api-conventions.md` states the rule the
+* repo now follows and this module is how existing callers survive it.
+*
+* ## Why an alias rather than a redirect
+*
+* A 308 would be correct and would break things anyway: `fetch` follows
+* redirects but drops an `Authorization` header on a cross-origin hop, and a
+* good deal of client code posts to these paths with one attached. An alias
+* serves the same handler at both paths, so nothing observable changes for a
+* caller that has not moved yet.
+*
+* The alias is not silent. Every response through it carries `Deprecation` and
+* a `Link` naming the successor, which is what makes the old path removable
+* later: an operator can find the callers in their own logs rather than
+* discovering them when the path is gone.
+*/
+/**
+* Mount `router` at its canonical path, and at its legacy path when it has one.
+*
+* The same router instance serves both, so the two paths cannot drift: there is
+* one set of handlers and one gate, and an alias that forgot to apply the admin
+* gate is not a state this can reach.
+*/
+function mountWithLegacyAlias(app, router, options) {
+	app.route(options.canonical, router);
+	if (!options.legacy) {
+		logger.debug(`${options.surface} routes mounted`, { path: options.canonical });
+		return;
+	}
+	const alias = new Hono();
+	alias.use("/*", async (c, next) => {
+		await next();
+		c.header("Deprecation", "true");
+		c.header("Link", `<${options.canonical}>; rel="successor-version"`);
+	});
+	alias.route("/", router);
+	app.route(options.legacy, alias);
+	logger.debug(`${options.surface} routes mounted`, {
+		path: options.canonical,
+		deprecatedAlias: options.legacy
+	});
+}
+function findProjectRoot(startDir, levels = 5) {
+	let dir = path$1.resolve(startDir);
+	for (let i = 0; i <= levels; i++) {
+		if (fs$1.existsSync(path$1.join(dir, "rebase.json"))) return dir;
+		const parent = path$1.dirname(dir);
+		if (parent === dir) return void 0;
+		dir = parent;
+	}
+}
+/**
+* The generated-artifact paths for a project, expressed relative to the
+* repository that will hold the commit.
+*
+* Returns `undefined` when there is nothing to correct — no project marker, or
+* a project that *is* the repository — so the caller passes no override and the
+* defaults stand. Saying "no change needed" is different from saying
+* "the change is a no-op prefix", and only the first leaves the existing
+* behaviour untouched for every project that already worked.
+*/
+function commitPathsFor(collectionsDir, repositoryRoot) {
+	const projectRoot = findProjectRoot(collectionsDir);
+	if (!projectRoot) return void 0;
+	const prefix = path$1.relative(path$1.resolve(repositoryRoot), projectRoot);
+	if (prefix === "" || prefix.startsWith("..")) return void 0;
+	const relocate = (p) => path$1.posix.join(...prefix.split(path$1.sep), p);
+	return {
+		schemaFile: relocate(DEFAULT_COMMIT_PATHS.schemaFile),
+		ddlFile: relocate(DEFAULT_COMMIT_PATHS.ddlFile),
+		policiesFile: relocate(DEFAULT_COMMIT_PATHS.policiesFile),
+		searchFile: relocate(DEFAULT_COMMIT_PATHS.searchFile)
+	};
+}
+//#endregion
+//#region src/schema-edit/github-repository.ts
+/**
+* A {@link SchemaEditRepository} backed by a repository on GitHub.
+*
+* This is the implementation for a deployment whose source is not on the
+* machine — a Cloud tenant runs a built bundle, and its repository lives
+* somewhere else entirely. The local one commits with `git`; this one has no
+* working tree at all and uses the Git Data API, which creates a blob, a tree,
+* a commit and moves a ref in four calls. Nothing is cloned.
+*
+* ## Authentication
+*
+* A GitHub App, not a token per project. The app holds one private key
+* globally; each project stores an `installationId`, which is not a secret. A
+* per-project personal access token would mean a credential to hold, rotate and
+* leak for every customer.
+*
+* Three steps, and the middle one is the one people miss:
+*
+* 1. sign a JWT with the private key — RS256, `iss` the app's id, ten minutes
+*    at most, which authenticates *the app* and can touch no repository;
+* 2. exchange it for an **installation access token**, which expires in an hour
+*    and is what can actually write;
+* 3. use that token as the bearer for the Git Data calls.
+*
+* The token is cached until shortly before it expires, because minting one is a
+* round trip and a schema edit makes several calls.
+*
+* ## What `dirtyPaths` means without a working tree
+*
+* Nothing, directly — there is no tree to be dirty. The equivalent hazard is the
+* branch moving under us between reading its head and writing a commit onto it,
+* and that is handled where it belongs: the commit is created against the head
+* read at the start, and updating the ref is **not** forced, so GitHub rejects
+* it if anything else landed meanwhile. A lost race is a refusal, never a
+* silent overwrite of somebody's commit.
+*/
+var GITHUB_API = "https://api.github.com";
+/** GitHub caps app JWTs at ten minutes; nine leaves room for clock skew. */
+var APP_JWT_TTL_SECONDS = 540;
+/** Renew an installation token this long before it lapses. */
+var TOKEN_REFRESH_MARGIN_MS = 6e4;
+var GitHubApiError = class extends Error {
+	status;
+	path;
+	constructor(status, path, detail) {
+		super(`GitHub ${path} failed with ${status}: ${detail}`);
+		this.status = status;
+		this.path = path;
+		this.name = "GitHubApiError";
+	}
+};
+/** base64url, which JWT requires and `Buffer` does not produce by default. */
+var b64url = (input) => Buffer.from(input).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+/**
+* A JWT authenticating the app itself.
+*
+* `iat` is backdated by a minute: GitHub rejects a token whose `iat` is in its
+* future, and a server clock a few seconds fast is enough to trigger it.
+*/
+function createAppJwt(appId, privateKey, nowMs) {
+	const issued = Math.floor(nowMs / 1e3) - 60;
+	const header = b64url(JSON.stringify({
+		alg: "RS256",
+		typ: "JWT"
+	}));
+	const payload = b64url(JSON.stringify({
+		iat: issued,
+		exp: issued + APP_JWT_TTL_SECONDS,
+		iss: appId
+	}));
+	const signer = createSign("RSA-SHA256");
+	signer.update(`${header}.${payload}`);
+	signer.end();
+	return `${header}.${payload}.${b64url(signer.sign(privateKey))}`;
+}
+function createGitHubRepository(options) {
+	const doFetch = options.fetchImpl ?? fetch;
+	const now = options.now ?? (() => Date.now());
+	const { owner, repo, branch } = options;
+	/** Files staged by `writeFiles`, held until `commit`. */
+	let staged = [];
+	let token;
+	const call = async (path, init) => {
+		const { auth, ...rest } = init;
+		const response = await doFetch(`${GITHUB_API}${path}`, {
+			...rest,
+			headers: {
+				accept: "application/vnd.github+json",
+				"x-github-api-version": "2022-11-28",
+				authorization: `Bearer ${auth}`,
+				"content-type": "application/json",
+				...rest.headers ?? {}
+			}
+		});
+		if (!response.ok) throw new GitHubApiError(response.status, path, (await response.text()).slice(0, 400));
+		return await response.json();
+	};
+	/**
+	* The bearer for the Git Data calls.
+	*
+	* A token is already one. An app has to mint one: sign a JWT with the
+	* private key, which authenticates the *app* and can touch no repository,
+	* then exchange it for an installation token, which expires in an hour and
+	* is what can actually write. Cached until shortly before it lapses,
+	* because a schema edit makes several calls and minting is a round trip.
+	*/
+	const bearer = async () => {
+		if (options.auth.kind === "token") return options.auth.token;
+		if (token && token.expiresAtMs - TOKEN_REFRESH_MARGIN_MS > now()) return token.value;
+		const jwt = createAppJwt(options.auth.appId, options.auth.privateKey, now());
+		const minted = await call(`/app/installations/${options.auth.installationId}/access_tokens`, {
+			method: "POST",
+			auth: jwt
+		});
+		token = {
+			value: minted.token,
+			expiresAtMs: Date.parse(minted.expires_at)
+		};
+		return token.value;
+	};
+	return {
+		root: `${owner}/${repo}`,
+		async currentBranch() {
+			return branch;
+		},
+		async dirtyPaths() {
+			return [];
+		},
+		async writeFiles(files) {
+			staged = files;
+		},
+		/**
+		* One file's current contents, read from the branch this commits onto.
+		*
+		* `undefined` for a file that is not there — a collection being created
+		* has no source yet — and that is a normal answer rather than a
+		* failure. Anything else is surfaced: a 403 from a token without
+		* `contents:read` must not be mistaken for an empty repository, or the
+		* editor would rewrite from nothing and the commit would delete
+		* somebody's collection.
+		*/
+		async readFile(filePath) {
+			const auth = await bearer();
+			const response = await doFetch(`${GITHUB_API}/repos/${owner}/${repo}/contents/${filePath.split("/").map(encodeURIComponent).join("/")}?ref=${encodeURIComponent(branch)}`, { headers: {
+				accept: "application/vnd.github+json",
+				"x-github-api-version": "2022-11-28",
+				authorization: `Bearer ${auth}`
+			} });
+			if (response.status === 404) return void 0;
+			if (!response.ok) throw new GitHubApiError(response.status, `/repos/${owner}/${repo}/contents/${filePath}`, (await response.text()).slice(0, 400));
+			const body = await response.json();
+			if (typeof body.content !== "string") return void 0;
+			if (body.encoding && body.encoding !== "base64") return void 0;
+			return Buffer.from(body.content, "base64").toString("utf8");
+		},
+		async commit(paths, message) {
+			if (staged.length === 0) throw new Error("Refusing to commit with nothing staged.");
+			const auth = await bearer();
+			const base = `/repos/${owner}/${repo}`;
+			const headSha = (await call(`${base}/git/ref/heads/${encodeURIComponent(branch)}`, { auth })).object.sha;
+			const head = await call(`${base}/git/commits/${headSha}`, { auth });
+			const tree = await Promise.all(staged.filter((file) => paths.includes(file.path)).map(async (file) => {
+				const blob = await call(`${base}/git/blobs`, {
+					method: "POST",
+					auth,
+					body: JSON.stringify({
+						content: file.contents,
+						encoding: "utf-8"
+					})
+				});
+				return {
+					path: file.path,
+					mode: "100644",
+					type: "blob",
+					sha: blob.sha
+				};
+			}));
+			const created = await call(`${base}/git/trees`, {
+				method: "POST",
+				auth,
+				body: JSON.stringify({
+					base_tree: head.tree.sha,
+					tree
+				})
+			});
+			const commit = await call(`${base}/git/commits`, {
+				method: "POST",
+				auth,
+				body: JSON.stringify({
+					message,
+					tree: created.sha,
+					parents: [headSha],
+					...options.author ? { author: {
+						...options.author,
+						date: new Date(now()).toISOString()
+					} } : {}
+				})
+			});
+			await call(`${base}/git/refs/heads/${encodeURIComponent(branch)}`, {
+				method: "PATCH",
+				auth,
+				body: JSON.stringify({
+					sha: commit.sha,
+					force: false
+				})
+			});
+			staged = [];
+			return commit.sha;
+		}
+	};
+}
+//#endregion
+//#region src/schema-edit/remote-source.ts
+/**
+* Rewriting a collection whose source is not on this machine.
+*
+* A bundle deployment — every Cloud tenant, and any self-host running built
+* output — ships *compiled* collections. The AST editor rewrites the
+* TypeScript, opening it from a directory on disk, so there is nothing for it
+* to open. That single fact is why live schema editing was local-only: not
+* authentication, not the Git Data API, which have worked for a while, but the
+* editor needing a file.
+*
+* So the file is brought to it. Read the current source from the repository,
+* put it in a scratch directory shaped the way the editor expects, let the
+* editor do exactly what it does locally, and read the result back. The editor
+* is unchanged and untouched — which matters, because it is the part that knows
+* how to preserve a collection file's imports, comments and formatting, and a
+* second implementation of that for the remote case would be a second thing to
+* get wrong.
+*
+* ## What the scratch directory holds
+*
+* One file: the collection being edited. Not the whole directory.
+*
+* The editor resolves `<dir>/<id>.ts` and rewrites it in place; it does not
+* read its siblings to do that. Fetching them all would be a request per
+* collection on every save, for files nothing reads. A collection that does not
+* exist yet is simply absent, which is the same state the editor sees locally
+* when somebody adds one.
+*/
+/**
+* Fetch, rewrite, and return the changed file — without leaving anything behind.
+*
+* The scratch directory is removed on every path, including the failing one. It
+* holds a copy of the customer's collection source, and a temp directory that
+* accumulates those on a long-running server is a slow leak of exactly the
+* thing worth not leaking.
+*/
+async function rewriteRemoteCollection(options, collectionId, collection) {
+	const { repository, collectionsPath, edit } = options;
+	if (!repository.readFile) throw new Error("This repository cannot read a file, so the collection source cannot be rewritten for a deployment that has none on disk.");
+	const repoPath = `${collectionsPath.replace(/\/+$/, "")}/${collectionId}.ts`;
+	const existing = await repository.readFile(repoPath);
+	const scratch = await fsp.mkdtemp(path$1.join(os.tmpdir(), "rebase-remote-source-"));
+	try {
+		if (existing !== void 0) await fsp.writeFile(path$1.join(scratch, `${collectionId}.ts`), existing, "utf8");
+		await edit(scratch, collectionId, collection);
+		return [{
+			path: repoPath,
+			contents: await fsp.readFile(path$1.join(scratch, `${collectionId}.ts`), "utf8")
+		}];
+	} finally {
+		await fsp.rm(scratch, {
+			recursive: true,
+			force: true
+		});
+	}
+}
+//#endregion
+//#region src/schema-edit/local-git-repository.ts
+/**
+* A {@link SchemaEditRepository} backed by the working tree the server is
+* running in.
+*
+* This is the implementation for the two deployment shapes that have their
+* source on disk — `rebase dev` on a developer's machine, and a self-host with
+* the project mounted. Both have a `.git` next to the collections, so a commit
+* is a local `git commit`: nothing to authenticate, nothing to fetch, no token.
+*
+* The remote implementation, for a Cloud tenant whose repository lives on
+* GitHub, satisfies the same interface and is a separate file. Neither knows
+* about the other.
+*
+* ## Why it stages paths explicitly
+*
+* Never `git add -A`. A schema change runs while somebody may have unrelated
+* work in the tree, and sweeping that into a commit nobody wrote is worse than
+* refusing — it is a commit that cannot be reviewed because nobody knows what
+* is in it. `applySchemaChange` refuses up front when the tree already has
+* *our* files modified; this stages the exact list and nothing else.
+*/
+var run$1 = promisify$1(execFile);
+var GitCommandError = class extends Error {
+	constructor(command, detail) {
+		super(`git ${command} failed: ${detail}`);
+		this.name = "GitCommandError";
+	}
+};
+/**
+* `--` before paths, always: a file called `main` would otherwise be read as a
+* revision, and the failure mode is a command that does something else entirely.
+*/
+async function git(root, args) {
+	try {
+		const { stdout } = await run$1("git", [
+			"-c",
+			"core.fsmonitor=false",
+			...args
+		], {
+			cwd: root,
+			maxBuffer: 32 * 1024 * 1024
+		});
+		return stdout;
+	} catch (err) {
+		const detail = err instanceof Error ? err.stderr?.trim() || err.message : String(err);
+		throw new GitCommandError(args[0] ?? "", detail);
+	}
+}
+/**
+* The top of the working tree containing `startDir`, or undefined.
+*
+* Resolved by asking git rather than by walking for a `.git`, because a
+* worktree's `.git` is a file and a submodule's is neither where nor what a
+* naive walk expects.
+*/
+async function findRepositoryRoot(startDir) {
+	try {
+		const root = (await git(startDir, ["rev-parse", "--show-toplevel"])).trim();
+		return root.length > 0 ? root : void 0;
+	} catch {
+		return;
+	}
+}
+function createLocalGitRepository(options) {
+	const { root } = options;
+	return {
+		root,
+		async currentBranch() {
+			const branch = (await git(root, [
+				"rev-parse",
+				"--abbrev-ref",
+				"HEAD"
+			])).trim();
+			if (branch === "HEAD") throw new GitCommandError("rev-parse", "the working tree is on a detached HEAD, so there is no branch to commit to. Check out a branch first.");
+			return branch;
+		},
+		async dirtyPaths() {
+			const out = await git(root, [
+				"status",
+				"--porcelain=v1",
+				"-z"
+			]);
+			const paths = [];
+			for (const entry of out.split("\0")) {
+				if (!entry) continue;
+				const file = entry.slice(3);
+				if (file) paths.push(file);
+			}
+			return paths;
+		},
+		async writeFiles(files) {
+			for (const file of files) {
+				const absolute = path$2.resolve(root, file.path);
+				if (!absolute.startsWith(path$2.resolve(root) + path$2.sep)) throw new Error(`Refusing to write outside the repository: ${file.path}`);
+				await fs$2.mkdir(path$2.dirname(absolute), { recursive: true });
+				await fs$2.writeFile(absolute, file.contents, "utf8");
+			}
+		},
+		async commit(paths, message) {
+			if (paths.length === 0) throw new Error("Refusing to commit an empty path list.");
+			await git(root, [
+				"add",
+				"--",
+				...paths
+			]);
+			if ((await git(root, [
+				"diff",
+				"--cached",
+				"--name-only",
+				"--",
+				...paths
+			])).trim() === "") return (await git(root, ["rev-parse", "HEAD"])).trim();
+			const identity = options.author ? [
+				"-c",
+				`user.name=${options.author.name}`,
+				"-c",
+				`user.email=${options.author.email}`
+			] : [];
+			await git(root, [
+				...identity,
+				"commit",
+				"--only",
+				"-m",
+				message,
+				"--",
+				...paths
+			]);
+			return (await git(root, ["rev-parse", "HEAD"])).trim();
+		}
+	};
+}
+//#endregion
+//#region src/rls-audit/index.ts
+/**
+* The row-level-security audit, on a schedule.
+*
+* `@rebasepro/rls-check` is a thorough, read-only audit of a database's RLS —
+* more thorough, on security specifically, than the dashboard advisors it
+* competes with. And nobody runs it, because it is a command, and a command is
+* something you have to remember. A check that has to be remembered is a check
+* that reports a clean database right up until the day it matters.
+*
+* This runs it on a timer against the database the server is already using, and
+* makes the result readable without a terminal. Nothing else about the checker
+* changes: same package, same checks, same output.
+*
+* ## Why it is off by default
+*
+* It opens its own connection and introspects the whole catalog. That is cheap
+* and read-only, but it is not nothing, and a background query nobody asked for
+* is a poor default for a library. Enabling it is one line, and the boot log
+* says so when it is off.
+*
+* ## Why the scanner is injected rather than imported
+*
+* `@rebasepro/server` is engine-agnostic — it has no `pg` and no other database
+* driver, deliberately. `@rebasepro/rls-check` has `pg`, because it connects to
+* Postgres. Importing it here would put a Postgres driver in the install of
+* every Mongo and Firebase user, for a feature none of them can use, and an
+* audit of row-level security is a Postgres concept living in the one package
+* that is supposed to know nothing about Postgres.
+*
+* So the scan function is handed in:
+*
+* ```ts
+* import { scan } from "@rebasepro/rls-check";
+* rlsAudit: { enabled: true, scan }
+* ```
+*
+* Everything else — the schedule, the summary, the status, the admin route —
+* lives here and is engine-agnostic in fact as well as in principle.
+*/
+var SEVERITY_ORDER = [
+	"info",
+	"low",
+	"medium",
+	"high",
+	"critical"
+];
+/** Rank for comparison. Unknown severities sort lowest rather than throwing. */
+var rank = (severity) => {
+	const index = SEVERITY_ORDER.indexOf(severity);
+	return index === -1 ? 0 : index;
+};
+var DEFAULT_INTERVAL_MS = 1440 * 60 * 1e3;
+var DEFAULT_STATEMENT_TIMEOUT_MS = 3e4;
+/** One line naming what the run found, at the right level to be noticed. */
+function summarize(result, warnAt) {
+	const counts = /* @__PURE__ */ new Map();
+	for (const finding of result.findings) counts.set(finding.severity, (counts.get(finding.severity) ?? 0) + 1);
+	const worst = result.findings.reduce((acc, f) => rank(f.severity) > rank(acc) ? f.severity : acc, "info");
+	if (result.findings.length === 0) return {
+		level: "info",
+		message: `RLS audit clean: ${result.stats.tables} table(s), ${result.stats.policies} polic(ies), ${result.stats.checksRun} check(s), no findings.`
+	};
+	const breakdown = [...SEVERITY_ORDER].reverse().filter((severity) => counts.get(severity)).map((severity) => `${counts.get(severity)} ${severity}`).join(", ");
+	const message = `RLS audit found ${result.findings.length} issue(s) — ${breakdown}. ${result.stats.tablesWithoutRls} table(s) without RLS. Read the detail at GET /api/admin/rls-audit, or run \`npx @rebasepro/rls-check\` for the full report.`;
+	return {
+		level: rank(worst) >= rank(warnAt) ? "warn" : "info",
+		message
+	};
+}
+/**
+* Create the audit. Nothing runs until {@link RlsAudit.start}.
+*
+* Because the scanner is supplied by the caller, the schedule, the summary and
+* the failure handling are all testable without a database and without
+* `@rebasepro/rls-check` present.
+*/
+function createRlsAudit(config) {
+	const enabled = config.enabled === true;
+	const intervalMs = config.intervalMs ?? DEFAULT_INTERVAL_MS;
+	const warnAt = config.warnAtSeverity ?? "high";
+	const connectionString = config.connectionString ?? process.env.DATABASE_URL;
+	let timer;
+	let status = { enabled };
+	if (enabled && !config.scan) status = {
+		enabled: false,
+		reason: "The scheduled RLS audit is enabled but no scanner was supplied. Pass `scan` from `@rebasepro/rls-check`: `rlsAudit: { enabled: true, scan }`."
+	};
+	else if (enabled && !connectionString) status = {
+		enabled: false,
+		reason: "The scheduled RLS audit is enabled but no connection string is available. Set DATABASE_URL, or pass `rlsAudit.connectionString`."
+	};
+	const runnable = enabled && !!connectionString && !!config.scan;
+	const run = async () => {
+		if (!runnable) return;
 		try {
-			await backend.shutdown(timeoutMs);
-			if (onCleanup) await onCleanup();
-			clearTimeout(forceTimer);
-			logger.info("Graceful shutdown complete.");
-			exit(0);
+			const result = await config.scan({
+				connectionString,
+				schemas: config.schemas,
+				statementTimeoutMs: config.statementTimeoutMs ?? DEFAULT_STATEMENT_TIMEOUT_MS
+			});
+			const { level, message } = summarize(result, warnAt);
+			logger[level](`[rls-audit] ${message}`);
+			status = {
+				enabled: true,
+				lastRunAt: result.scannedAt,
+				result
+			};
 		} catch (err) {
-			logger.error("Error during shutdown cleanup:", { error: err instanceof Error ? err : new Error(String(err)) });
-			exit(1);
+			const detail = err instanceof Error ? err.message : String(err);
+			logger.error(`[rls-audit] Scan failed: ${detail}`);
+			status = {
+				...status,
+				enabled: true,
+				lastRunAt: (/* @__PURE__ */ new Date()).toISOString(),
+				lastError: detail
+			};
 		}
 	};
-	const listeners = signals.map((signal) => {
-		const listener = () => {
-			shutdownSequence(signal);
-		};
-		process.on(signal, listener);
-		return {
-			signal,
-			listener
-		};
-	});
-	return () => {
-		for (const { signal, listener } of listeners) process.removeListener(signal, listener);
-	};
-}
-function createShutdown(config) {
-	return (timeoutMs = 15e3) => {
-		return new Promise((resolve) => {
-			(async () => {
-				logger.info("Shutting down Rebase Backend...");
-				if (config.cronScheduler) {
-					config.cronScheduler.stop();
-					logger.info("Cron scheduler stopped");
-				}
-				if (config.jobQueue) {
-					await config.jobQueue.stop();
-					logger.info("Job queue stopped");
-				}
-				for (const [key, rt] of Object.entries(config.realtimeServices)) try {
-					if (typeof rt.destroy === "function") {
-						await rt.destroy();
-						logger.info(`Realtime service "${key}" destroyed`);
-					} else if (typeof rt.stopListening === "function") {
-						await rt.stopListening();
-						logger.info(`Realtime service "${key}" LISTEN client stopped`);
-					}
-				} catch (err) {
-					logger.warn(`Error destroying realtime service "${key}":`, { error: err });
-				}
-				config.server.close(() => {
-					logger.info("HTTP server closed");
-					resolve();
-				});
-				if (timeoutMs > 0) setTimeout(() => {
-					logger.warn(`Forced shutdown after ${timeoutMs / 1e3}s timeout`);
-					resolve();
-				}, timeoutMs).unref();
-			})();
-		});
+	return {
+		start() {
+			if (!runnable) {
+				if (status.reason) logger.warn(`[rls-audit] ${status.reason}`);
+				return;
+			}
+			if (timer) return;
+			timer = setInterval(() => {
+				run();
+			}, intervalMs);
+			timer.unref?.();
+			if (config.runOnBoot !== false) run();
+		},
+		stop() {
+			if (timer) clearInterval(timer);
+			timer = void 0;
+		},
+		runNow: run,
+		status: () => status
 	};
 }
 //#endregion
@@ -4383,7 +5779,8 @@ function resolveSurfaces(options) {
 function resolveOwnership(options) {
 	return {
 		cronScheduler: options?.cronScheduler ?? true,
-		jobWorkers: options?.jobWorkers ?? true
+		jobWorkers: options?.jobWorkers ?? true,
+		rlsAudit: options?.rlsAudit ?? true
 	};
 }
 /** The surfaces a process is not serving, for a boot log line. */
@@ -10385,8 +11782,35 @@ function createHistoryRoutes(params) {
 * version or not — reads the same live client.
 */
 var INSTANCE_SLOT = Symbol.for("@rebasepro/server:singleton-instance");
+/**
+* A *function* that answers "which client is this call for", for hosts where
+* one answer per process is the wrong shape.
+*
+* A Node server boots once and serves every request from the same client, so
+* {@link INSTANCE_SLOT} is the whole story. An isolate-based host is different
+* in a way that matters: the environment arrives attached to the **request**,
+* not to the module, so there is nothing to publish at import time, and an
+* isolate can be reused across requests that must not share state. Such a host
+* registers a resolver — typically reading an `AsyncLocalStorage` populated per
+* request — and it is consulted first.
+*
+* This exists now, before there is a host that needs it, because of what it
+* protects: `rebase` is a lazy Proxy, so every property access already goes
+* through `getInstance()`. Backing that lookup with a resolver is therefore the
+* entire porting story for the singleton — **no function anyone has already
+* written changes**. Take the resolver away and the only alternative is asking
+* users to thread a client through their handlers, which is a rewrite of every
+* function file in existence.
+*/
+var RESOLVER_SLOT = Symbol.for("@rebasepro/server:singleton-resolver");
 function getInstance() {
-	return globalThis[INSTANCE_SLOT] ?? null;
+	const global = globalThis;
+	const resolver = global[RESOLVER_SLOT];
+	if (resolver) {
+		const resolved = resolver();
+		if (resolved) return resolved;
+	}
+	return global[INSTANCE_SLOT] ?? null;
 }
 function setInstance(client) {
 	globalThis[INSTANCE_SLOT] = client;
@@ -10403,7 +11827,7 @@ function _initRebase(client) {
 * Throws an error if used in a non-test environment to prevent production abuse.
 */
 function _setRebaseMock(mockInstance) {
-	if (process.env.NODE_ENV !== "test") throw new Error("_setRebaseMock can only be called in a test environment (NODE_ENV=test).");
+	if (hostEnv().NODE_ENV !== "test") throw new Error("_setRebaseMock can only be called in a test environment (NODE_ENV=test).");
 	setInstance({
 		...getInstance() || {},
 		...mockInstance
@@ -10413,7 +11837,7 @@ function _setRebaseMock(mockInstance) {
 * @internal Resets the singleton instance, useful for afterEach() in test suites.
 */
 function _resetRebaseMock() {
-	if (process.env.NODE_ENV !== "test") throw new Error("_resetRebaseMock can only be called in a test environment.");
+	if (hostEnv().NODE_ENV !== "test") throw new Error("_resetRebaseMock can only be called in a test environment.");
 	setInstance(null);
 }
 /**
@@ -10865,7 +12289,7 @@ async function _initializeRebaseBackend(config) {
 			]) {
 				const providerConfig = safeAuthConfig[key];
 				if (providerConfig && requiredFields.every((f) => Boolean(providerConfig[f]))) {
-					const createFn = (await import("./auth-5Et5mnUA.js").then((n) => n.t))[factory];
+					const createFn = (await import("./auth-C74dqR2B.js").then((n) => n.t))[factory];
 					oauthProviders.push(createFn(providerConfig));
 				}
 			}
@@ -10879,6 +12303,7 @@ async function _initializeRebaseBackend(config) {
 				disableSelfRegistration: safeAuthConfig.disableSelfRegistration ?? false,
 				allowAnonymous: safeAuthConfig.allowAnonymous ?? false,
 				allowUserLookup: safeAuthConfig.allowUserLookup ?? false,
+				captcha: safeAuthConfig.captcha,
 				defaultRole: safeAuthConfig.defaultRole,
 				oauthProviders,
 				allowedRedirectUris: safeAuthConfig.allowedRedirectUris,
@@ -10965,7 +12390,7 @@ async function _initializeRebaseBackend(config) {
 	let schemaEditorOff = schemaEditorUnavailable();
 	let schemaEditorRoutes;
 	if (!schemaEditorOff && config.collectionsDir) try {
-		schemaEditorRoutes = (await import("./schema-editor-routes-CV9k0w3G.js")).createSchemaEditorRoutes(config.collectionsDir);
+		schemaEditorRoutes = (await import("./schema-editor-routes-yh2cQcdJ.js")).createSchemaEditorRoutes(config.collectionsDir);
 	} catch (err) {
 		if (err?.code === "ERR_MODULE_NOT_FOUND") {
 			schemaEditorOff = {
@@ -10988,18 +12413,101 @@ async function _initializeRebaseBackend(config) {
 			code: schemaEditorOff.code,
 			message: schemaEditorOff.message
 		} }, 501));
-		config.app.route(`${basePath}/schema-editor`, schemaEditorRouter);
-		if (schemaEditorRoutes) logger.debug("Schema Editor mounted", { path: `${basePath}/schema-editor` });
-		else logger.debug("Schema Editor unavailable", {
-			path: `${basePath}/schema-editor`,
-			code: schemaEditorOff.code
+		const remoteRepo = config.liveSchema?.repository;
+		const canEditSchema = Boolean(config.collectionsDir) || Boolean(remoteRepo);
+		if (!canEditSchema) {
+			const unconfigured = new Hono();
+			applyAdminGate(unconfigured, "Live schema editing");
+			unconfigured.all("/*", (c) => c.json({ error: {
+				code: "SCHEMA_EDITING_NO_COLLECTIONS_DIR",
+				message: "Live schema editing needs `collectionsDir` — the directory holding this project's collection definitions — or `liveSchema.repository`, a repository to fetch them from. This server was started with neither, so there is nothing for it to edit."
+			} }, 501));
+			mountWithLegacyAlias(config.app, unconfigured, {
+				canonical: `${basePath}/admin/schema`,
+				surface: "Live schema editing (unconfigured)"
+			});
+		}
+		if (canEditSchema) {
+			const collectionsDir = config.collectionsDir;
+			const repositoryRoot = collectionsDir ? await findRepositoryRoot(collectionsDir) : void 0;
+			const liveSchemaRouter = new Hono();
+			applyAdminGate(liveSchemaRouter, "Live schema editing");
+			const commitPaths = remoteRepo ? commitPathsFor(path$1.join("/", remoteRepo.collectionsPath ?? "config/collections"), "/") : collectionsDir && repositoryRoot ? commitPathsFor(collectionsDir, repositoryRoot) : void 0;
+			if (commitPaths) logger.debug("Live schema editing commit paths relocated", { commitPaths });
+			liveSchemaRouter.route("/", createLiveSchemaRoutes({
+				commitPaths,
+				policy: { allowMachineApply: config.liveSchema?.allowMachineApply ?? process.env.REBASE_LIVE_SCHEMA_ALLOW_MACHINE_APPLY === "true" },
+				getCollections: () => collectionRegistry.getRawCollections(),
+				getAdmin: () => defaultDriver.admin,
+				getRepository: (author) => {
+					if (remoteRepo) return createGitHubRepository({
+						auth: remoteRepo.auth,
+						owner: remoteRepo.owner,
+						repo: remoteRepo.repo,
+						branch: remoteRepo.branch ?? "main",
+						author
+					});
+					if (!repositoryRoot) return void 0;
+					return createLocalGitRepository({
+						root: repositoryRoot,
+						author
+					});
+				},
+				writeSource: schemaEditorRoutes ? async (change) => {
+					const applyEdit = async (dir, collectionId, collection) => {
+						const { AstSchemaEditor } = await import("./ast-schema-editor-BpFYpT38.js");
+						await new AstSchemaEditor(dir).saveCollection(collectionId, collection, { partial: false });
+					};
+					if (remoteRepo) {
+						const repository = config.liveSchema?.repository ? createGitHubRepository({
+							auth: remoteRepo.auth,
+							owner: remoteRepo.owner,
+							repo: remoteRepo.repo,
+							branch: remoteRepo.branch ?? "main"
+						}) : void 0;
+						if (!repository) return [];
+						return rewriteRemoteCollection({
+							repository,
+							collectionsPath: remoteRepo.collectionsPath ?? "config/collections",
+							edit: applyEdit
+						}, change.collectionId, change.collection);
+					}
+					await applyEdit(collectionsDir, change.collectionId, change.collection);
+					const file = path$1.join(collectionsDir, `${change.collectionId}.ts`);
+					const contents = await fsp.readFile(file, "utf8");
+					return [{
+						path: path$1.relative(repositoryRoot, file),
+						contents
+					}];
+				} : void 0,
+				sourcePathsFor: (change) => {
+					if (remoteRepo) return [`${(remoteRepo.collectionsPath ?? "config/collections").replace(/\/+$/, "")}/${change.collectionId}.ts`];
+					if (!collectionsDir || !repositoryRoot) return [];
+					return [path$1.relative(repositoryRoot, path$1.join(collectionsDir, `${change.collectionId}.ts`))];
+				}
+			}));
+			mountWithLegacyAlias(config.app, liveSchemaRouter, {
+				canonical: `${basePath}/admin/schema`,
+				surface: "Live schema editing"
+			});
+			logger.debug("Live schema editing repository", { repository: repositoryRoot ?? "(none — refusals only)" });
+		}
+		mountWithLegacyAlias(config.app, schemaEditorRouter, {
+			canonical: `${basePath}/admin/schema-editor`,
+			legacy: `${basePath}/schema-editor`,
+			surface: "Schema editor"
 		});
+		if (!schemaEditorRoutes) logger.debug("Schema Editor unavailable", { code: schemaEditorOff.code });
 	}
 	const storageAuthorizeData = {};
 	if (storageController) {
 		const storageMaxSize = (config.storage && typeof config.storage === "object" && "type" in config.storage ? config.storage.maxFileSize : void 0) ?? 50 * 1024 * 1024;
+		const storageAccessControl = resolveStorageAccessControl({
+			storagePolicies: config.storagePolicies,
+			storageAuthorize: config.storageAuthorize
+		});
 		assertStorageAccessControlConfigured({
-			hasAuthorize: !!config.storageAuthorize,
+			hasAuthorize: !!config.storageAuthorize || !!config.storagePolicies?.length,
 			publicRead: config.storagePublicRead === true,
 			allowAnyAuthenticated: config.storageInsecureAllowAnyAuthenticated === true
 		}, isProduction);
@@ -11010,7 +12518,7 @@ async function _initializeRebaseBackend(config) {
 			requireAuth: resolveRequireAuth(config.auth),
 			publicRead: config.storagePublicRead === true,
 			authAdapter,
-			authorize: config.storageAuthorize,
+			authorize: storageAccessControl,
 			authorizeData: () => storageAuthorizeData.current
 		});
 		const storageRouter = new Hono();
@@ -11147,9 +12655,9 @@ async function _initializeRebaseBackend(config) {
 		if (driver && "client" in driver) driver.client = serverClient;
 	}
 	if (config.functionsDir && surfaces.functions) {
-		const { loadFunctionsWithDiagnostics } = await import("./function-loader-DDS1v7YX.js").then((n) => n.t);
+		const { loadFunctionsWithDiagnostics } = await import("./function-loader-BrLmC_-y.js").then((n) => n.t);
 		const { createFunctionRoutes } = await import("./function-routes-Btcez1T-.js").then((n) => n.n);
-		const { createFunctionsRequestTimeout, resolveFunctionsTimeoutMs } = await import("./request-timeout-BuFoEKwT.js");
+		const { createFunctionsRequestTimeout, resolveFunctionsTimeoutMs } = await import("./request-timeout-OofPCHQT.js").then((n) => n.t);
 		const { functions: allFunctions, problems } = await loadFunctionsWithDiagnostics(config.functionsDir);
 		const { selectFunctions } = await import("./selection-_z6TM1DB.js").then((n) => n.n);
 		const loadedFunctions = selectFunctions(allFunctions, config.functionsSelection);
@@ -11190,7 +12698,7 @@ async function _initializeRebaseBackend(config) {
 		else logger.warn(`Function routes mounted at ${basePath}/functions, but no functions loaded from ${config.functionsDir}. ` + (problems.length > 0 ? `${problems.length} file(s) were skipped — see the messages above.` : "The directory holds no .ts/.js function files."));
 	}
 	if (config.functionsUpstream && !surfaces.functions) {
-		const { createFunctionsProxy } = await import("./proxy-Bj5DVllb.js");
+		const { createFunctionsProxy } = await import("./proxy-QJKSS-CV.js").then((n) => n.t);
 		config.app.route(`${basePath}/functions`, createFunctionsProxy({
 			upstream: config.functionsUpstream,
 			basePath: `${basePath}/functions`
@@ -11202,10 +12710,10 @@ async function _initializeRebaseBackend(config) {
 	}
 	let cronScheduler;
 	if (config.cronsDir && (surfaces.cron || ownership.cronScheduler)) {
-		const { loadCronJobsWithDiagnostics } = await import("./cron-loader-YhhQeVBM.js").then((n) => n.t);
-		const { CronScheduler } = await import("./cron-scheduler-DIpYBmZP.js").then((n) => n.n);
-		const { createCronRoutes } = await import("./cron-routes-maM_RlUu.js").then((n) => n.n);
-		const { createCronStore } = await import("./cron-store-DfH_4Cd9.js").then((n) => n.n);
+		const { loadCronJobsWithDiagnostics } = await import("./cron-loader-BMvtW6-J.js").then((n) => n.t);
+		const { CronScheduler } = await import("./cron-scheduler-Buf-uVam.js").then((n) => n.n);
+		const { createCronRoutes } = await import("./cron-routes-BvYk-Kmi.js").then((n) => n.n);
+		const { createCronStore } = await import("./cron-store-CyF-oInV.js").then((n) => n.n);
 		const { jobs: loadedCronJobs, problems: cronProblems } = await loadCronJobsWithDiagnostics(config.cronsDir);
 		cronScheduler = new CronScheduler();
 		cronScheduler.setClient(serverSingleton);
@@ -11220,7 +12728,11 @@ async function _initializeRebaseBackend(config) {
 		const cronRouter = new Hono();
 		applyAdminGate(cronRouter, "Cron");
 		cronRouter.route("/", createCronRoutes(cronScheduler, cronProblems.length));
-		if (surfaces.cron) config.app.route(`${basePath}/cron`, cronRouter);
+		if (surfaces.cron) mountWithLegacyAlias(config.app, cronRouter, {
+			canonical: `${basePath}/admin/cron`,
+			legacy: `${basePath}/cron`,
+			surface: "Cron"
+		});
 		if (loadedCronJobs.length > 0 && !ownership.cronScheduler) logger.info("Cron jobs registered but NOT scheduled in this process", {
 			count: loadedCronJobs.length,
 			reason: "this process does not own the cron scheduler"
@@ -11235,7 +12747,7 @@ async function _initializeRebaseBackend(config) {
 	}
 	let jobQueue;
 	if (config.jobs?.enabled) {
-		const { createJobStore, createJobQueue } = await import("./jobs-CyOKXXlu.js").then((n) => n.t);
+		const { createJobStore, createJobQueue } = await import("./jobs-Bn6nhY8J.js").then((n) => n.t);
 		const store = createJobStore(defaultDriver);
 		if (store) {
 			await store.ensureTable();
@@ -11246,8 +12758,9 @@ async function _initializeRebaseBackend(config) {
 			} else logger.info("Job queue available for enqueue, workers NOT started in this process", { tasks: Object.keys(config.jobs.tasks ?? {}).length });
 		} else logger.warn("Job queue requested but unavailable on this driver — `rebase.jobs.enqueue` will throw, and webhook deliveries fall back to the in-memory queue.");
 	}
+	let rlsAudit;
 	if (surfaces.admin) {
-		const { createBackupRoutes, parseBackupDestination } = await import("./backup-C6ljYVTp.js").then((n) => n.t);
+		const { createBackupRoutes, parseBackupDestination } = await import("./backup-BJ86ah4T.js").then((n) => n.t);
 		const backupRouter = new Hono();
 		applyAdminGate(backupRouter, "Backup");
 		backupRouter.route("/", createBackupRoutes({
@@ -11260,16 +12773,29 @@ async function _initializeRebaseBackend(config) {
 		config.app.route(`${basePath}/admin/backups`, backupRouter);
 		logger.debug("Backup admin routes mounted", { path: `${basePath}/admin/backups` });
 	}
+	if (surfaces.admin) {
+		const rlsAuditRouter = new Hono();
+		applyAdminGate(rlsAuditRouter, "RLS audit");
+		rlsAuditRouter.get("/", (c) => c.json(rlsAudit ? rlsAudit.status() : {
+			enabled: false,
+			reason: config.rlsAudit?.enabled ? "This process serves the admin surface but does not own the RLS audit." : "The scheduled RLS audit is off. Set `rlsAudit.enabled` to turn it on."
+		}));
+		config.app.route(`${basePath}/admin/rls-audit`, rlsAuditRouter);
+		logger.debug("RLS audit admin routes mounted", { path: `${basePath}/admin/rls-audit` });
+	}
 	if (surfaces.admin) {
 		const { default: logsRoutes } = await import("./logs-routes-CWBLQj2l.js").then((n) => n.n);
 		const logsRouter = new Hono();
 		applyAdminGate(logsRouter, "Logs");
 		logsRouter.route("/", logsRoutes);
-		config.app.route(`${basePath}/logs`, logsRouter);
-		logger.debug("Logs routes mounted", { path: `${basePath}/logs` });
+		mountWithLegacyAlias(config.app, logsRouter, {
+			canonical: `${basePath}/admin/logs`,
+			legacy: `${basePath}/logs`,
+			surface: "Logs"
+		});
 	}
 	if (surfaces.meta) {
-		const { createContractRoutes } = await import("./contract-routes-DZ-LBpSL.js").then((n) => n.t);
+		const { createContractRoutes } = await import("./contract-routes-BEq7euZg.js").then((n) => n.t);
 		const contractRouter = new Hono();
 		if (adminSurfacesGated) {
 			if (apiKeyPreAuth) contractRouter.use("/contract", apiKeyPreAuth);
@@ -11298,10 +12824,15 @@ async function _initializeRebaseBackend(config) {
 	logger.debug("Rebase Backend Initialized");
 	const authSchemaCheck = authConfigResult?.schemaHealthCheck;
 	const healthCheck = createHealthCheck(defaultDriver, authSchemaCheck ? () => authSchemaCheck.call(authConfigResult) : void 0);
+	if (config.rlsAudit?.enabled && ownership.rlsAudit) {
+		rlsAudit = createRlsAudit(config.rlsAudit);
+		rlsAudit.start();
+	}
 	const shutdown = createShutdown({
 		server: config.server,
 		cronScheduler,
 		jobQueue,
+		rlsAudit,
 		realtimeServices
 	});
 	/**
@@ -11385,6 +12916,276 @@ function defineFunction(definition) {
 	return returned instanceof Hono ? returned : app;
 }
 //#endregion
+//#region src/functions/context.ts
+function read(c, key) {
+	return c.get(key);
+}
+/**
+* The authenticated caller, or `undefined` for an anonymous request.
+*
+* **`undefined` is not a permission decision.** The functions router mounts its
+* auth middleware with `requireAuth: false` on purpose — a webhook receiver has
+* no token to send — so an anonymous caller reaches the handler and reads
+* `undefined` here while the handler runs on regardless. Use {@link requireAuth}
+* (or a `!user` branch that returns 401) to make it a decision.
+*
+* A caller who presented a *bad* token never gets this far: both auth
+* middlewares reject an unverifiable token with 401 before the router is
+* reached, precisely so an expired session cannot be silently downgraded to an
+* anonymous one.
+*/
+function getUser(c) {
+	const raw = read(c, "user");
+	if (!raw || typeof raw !== "object") return void 0;
+	const record = raw;
+	const uid = typeof record.uid === "string" ? record.uid : typeof record.userId === "string" ? record.userId : void 0;
+	if (uid === void 0) return void 0;
+	const roles = Array.isArray(record.roles) ? record.roles.filter((role) => typeof role === "string") : [];
+	return {
+		...record,
+		uid,
+		roles
+	};
+}
+/** The caller's id, or `undefined` when nobody is signed in. */
+function getUserId(c) {
+	return getUser(c)?.uid;
+}
+/** The caller's roles. Empty for an anonymous request — never `undefined`. */
+function getRoles(c) {
+	return getUser(c)?.roles ?? [];
+}
+/**
+* Whether the caller holds **any** of the named roles.
+*
+* Any rather than all, because that is what a route guard means by a list of
+* roles; require several by calling this more than once.
+*/
+function hasRole(c, ...roles) {
+	if (roles.length === 0) return false;
+	const held = new Set(getRoles(c));
+	return roles.some((role) => held.has(role));
+}
+/**
+* Whether the caller holds an administrative role.
+*
+* Delegates to the single definition in `auth/admin-roles.ts` — which is
+* `admin` **or** `schema-admin` — rather than comparing against `"admin"`.
+* Those two lists disagreed once, and the gap made every public registrant an
+* administrator; see that file.
+*/
+function isAdmin(c) {
+	return hasAdministrativeRole(getRoles(c));
+}
+/** Whether the request carries an identity at all. */
+function isAuthenticated(c) {
+	return getUser(c) !== void 0;
+}
+/**
+* The request-scoped data driver: reads and writes run as **the caller**, with
+* your row-level security policies evaluated against their identity.
+*
+* This is the accessor to reach for when a function serves user-facing data.
+* `rebase.dataAsAdmin` is the other one, and it is not the same thing — it runs
+* as `{ uid: "service", roles: ["admin"] }` for every caller alike, which is
+* correct for trusted background work and wrong for a request.
+*
+* `undefined` only when no Rebase auth middleware ran (see
+* {@link identityResolved}); inside a function mounted by the framework it is
+* always present, anonymous requests included — they get an anon-scoped driver
+* so policies still have an identity to evaluate.
+*/
+function getDriver(c) {
+	return read(c, "driver");
+}
+/**
+* {@link getDriver}, but throws instead of handing back `undefined`.
+*
+* For the common case where a handler cannot proceed without it and would
+* otherwise write `c.get("driver")!` — an assertion that turns a wiring problem
+* into `Cannot read properties of undefined (reading 'fetchCollection')` twenty
+* lines away from the cause.
+*/
+function requireDriver(c) {
+	const driver = getDriver(c);
+	if (!driver) throw new Error("No request-scoped driver on this context. A Rebase auth middleware populates it before any custom function runs, so this means the handler was mounted outside the functions router — e.g. added to your own Hono app directly. Mount it from the functions directory, or use `rebase.dataAsAdmin` if the work is genuinely service-scoped.");
+	return driver;
+}
+/**
+* The API key this request authenticated with, masked, or `undefined` when it
+* did not use one.
+*
+* Useful for attribution and for per-key behaviour. The permission check itself
+* has already happened — reaching a handler means the key was allowed to.
+*/
+function getApiKey(c) {
+	return read(c, "apiKey");
+}
+/**
+* The correlation id for this request — generated, or taken from an inbound
+* `X-Request-ID`.
+*
+* Log it. It is the only thing that ties a line written inside a function to
+* the framework's own lines for the same request.
+*/
+function getRequestId(c) {
+	return read(c, "requestId");
+}
+/**
+* Whether a Rebase auth middleware has run on this request.
+*
+* Both middlewares populate `driver` for *every* outcome, anonymous included,
+* and populate `user` whenever there is one. So "neither is set" does not mean
+* "anonymous" — it means nothing resolved the identity, and treating that as
+* anonymous is the dangerous reading. The guards use this to tell a genuinely
+* anonymous caller (401) from a misconfigured mount (500), because answering
+* 401 to the second sends whoever is debugging it to look at the token.
+*/
+function identityResolved(c) {
+	return read(c, "user") !== void 0 || read(c, "driver") !== void 0;
+}
+//#endregion
+//#region src/functions/guards.ts
+/**
+* The answer to "a guard ran, but no middleware had resolved anything".
+*
+* Deliberately a 500 and not a 401. A 401 tells the caller their credential is
+* the problem, and here the caller's credential was never looked at — sending
+* them to check their token is sending them to the one place the answer is not.
+*/
+function unresolvedIdentity() {
+	return { error: {
+		message: "This route's identity was never resolved: no Rebase auth middleware ran before the guard. A function loaded from the functions directory always has one. This usually means the Hono app was mounted onto your own server directly, bypassing the functions router.",
+		code: "AUTH_MIDDLEWARE_MISSING"
+	} };
+}
+/**
+* Reject callers holding none of the named roles with 403.
+*
+* Any of them, not all — require several by chaining the guard twice. Naming no
+* role at all is a programming error and throws at module load rather than at
+* request time, because `requireRole()` with an empty list would otherwise read
+* as a guard while admitting everyone.
+*
+* @example
+* ```ts
+* app.post("/publish", requireAuth, requireRole("editor", "admin"), handler);
+* ```
+*/
+function requireRole(...roles) {
+	if (roles.length === 0) throw new Error("requireRole() needs at least one role. An empty list would admit every signed-in caller while reading as a restriction.");
+	const allowed = new Set(roles);
+	return async (c, next) => {
+		if (!getUser(c)) {
+			if (!identityResolved(c)) return c.json(unresolvedIdentity(), 500);
+			return c.json({ error: {
+				message: "Authentication required",
+				code: "UNAUTHORIZED"
+			} }, 401);
+		}
+		if (!getRoles(c).some((role) => allowed.has(role))) return c.json({ error: {
+			message: `This operation requires one of these roles: ${roles.join(", ")}`,
+			code: "FORBIDDEN"
+		} }, 403);
+		return next();
+	};
+}
+//#endregion
+//#region src/functions/runtime-env.ts
+/**
+* Every environment variable visible to this request.
+*
+* `c.env` on workerd, `Deno.env` on Deno, `process.env` on Node, Bun and
+* Vercel's edge runtime. Reading it through here rather than through `process`
+* is the whole of what makes a function's configuration portable.
+*/
+function getEnv(c) {
+	return env(c);
+}
+/**
+* One environment variable, or `undefined`.
+*
+* Trimmed, and a blank value counts as absent — declaring a variable and
+* leaving it empty is the ordinary way to write a compose file or a `.env`
+* line, and nobody has ever meant `""` by it.
+*/
+function env$1(c, name) {
+	const raw = getEnv(c)[name];
+	if (typeof raw !== "string") return void 0;
+	const trimmed = raw.trim();
+	return trimmed === "" ? void 0 : trimmed;
+}
+/**
+* One environment variable, or a thrown error naming it.
+*
+* For configuration a handler cannot run without. Throwing here — inside the
+* request — is deliberately better than the module-scope `process.env.KEY!`
+* it replaces: that one takes the whole *file* down at load time, and the
+* loader reports it as "this function could not be imported", which names the
+* file but not the variable. This fails one request, with the name in the
+* message, while every other route in the file keeps serving.
+*/
+function requireEnv(c, name) {
+	const value = env$1(c, name);
+	if (value === void 0) throw new Error(`Missing required environment variable ${name}. Set it on the process (or as a binding, on a host that has them) — and read it inside the handler, not at module scope, so the same file works on both.`);
+	return value;
+}
+/**
+* Which host this is: `"node"`, `"workerd"`, `"deno"`, `"bun"`, `"edge-light"`,
+* `"fastly"` or `"other"`.
+*
+* Use it to *degrade*, not to branch a whole implementation — a function that
+* needs two implementations is two functions. It is honest about one thing in
+* particular: a Node-only capability, such as `rebase.sql()`, can check this
+* and say so, instead of failing at the call.
+*/
+function runtimeKey() {
+	return getRuntimeKey();
+}
+/** Whether this is a Node-like host — Node itself, or Bun's Node compatibility. */
+function isNodeRuntime() {
+	const key = getRuntimeKey();
+	return key === "node" || key === "bun";
+}
+/**
+* Build something expensive once per environment, on first use, from inside a
+* request.
+*
+* This is the sanctioned replacement for the module-scope client:
+*
+* ```ts
+* // Don't: runs at import time, before bindings exist on some hosts.
+* const stripe = new Stripe(process.env.STRIPE_SECRET_KEY!);
+*
+* // Do: runs on first request, reads that request's configuration.
+* const stripe = lazyResource(env => new Stripe(env.STRIPE_SECRET_KEY!));
+* app.post("/", async (c) => { await stripe(c).charges.list(); });
+* ```
+*
+* The factory runs once per distinct environment object and the result is
+* cached against it. On Node that is once per process, because `process.env` is
+* one object for the life of the process — identical to the module-scope
+* version in cost, and unlike it, deferred until configuration exists. On a
+* host that hands each request a fresh binding object it is once per object,
+* which is the only correct answer there: caching across bindings would serve
+* one tenant's client to another.
+*
+* A {@link WeakMap} holds the cache, so an environment object the host has
+* finished with takes the resource with it.
+*/
+function lazyResource(factory) {
+	const cache = /* @__PURE__ */ new WeakMap();
+	return (c) => {
+		const bindings = getEnv(c);
+		if (!bindings || typeof bindings !== "object") return factory(bindings ?? {});
+		const existing = cache.get(bindings);
+		if (existing !== void 0) return existing;
+		const created = factory(bindings);
+		cache.set(bindings, created);
+		return created;
+	};
+}
+//#endregion
 //#region src/cron/define-cron.ts
 /**
 * Typed authoring helper for a cron job file. Identity at runtime —
@@ -11469,6 +13270,130 @@ var authJwt = () => {
 	return sql.raw(RLS_JWT_SQL);
 };
 //#endregion
+//#region src/dev-secrets.ts
+/**
+* Development secrets that survive a restart.
+*
+* `loadEnv` generates `JWT_SECRET` and `REBASE_SERVICE_KEY` when they are unset
+* outside production, so a developer can start without setting anything up. It
+* generated them **freshly on every boot**, which meant every restart of the dev
+* server silently invalidated the previous run's tokens: you were logged out of
+* your own app because you edited a file, and the API key you had just made
+* stopped working.
+*
+* The CLI already worked around it for scaffolded projects by writing a stable
+* `JWT_SECRET` into `.env` at `rebase init` — the comment there says exactly
+* why. That leaves anyone who did not scaffold, and anyone running from a
+* container with no `.env`, with the logout-on-restart behaviour.
+*
+* So the generated values are cached in a file beside the other dev-state
+* files — `.rebase-dev-port` and `.rebase-dev-url` follow the same convention
+* and are gitignored in the same place.
+*
+* ## What this does not change
+*
+* Production. `loadEnv` refuses to start when a secret was auto-generated and
+* `NODE_ENV=production`, and that is untouched: this only makes the
+* already-generated development values stable. There is no path by which a
+* cached secret becomes a production one.
+*
+* ## Failing soft
+*
+* A read-only filesystem, a container without a writable working directory, a
+* permissions problem — none of these should stop a development server from
+* starting. Every failure here falls back to the previous behaviour, an
+* ephemeral secret, and says so once at debug level.
+*/
+/** Beside `.rebase-dev-port` and `.rebase-dev-url`, and gitignored with them. */
+var DEV_SECRETS_FILENAME = ".rebase-dev-secrets.json";
+/** Owner read/write only. These are secrets, even development ones. */
+var FILE_MODE = 384;
+/** Whether these environment variables describe a test runner. */
+function detectTestRunner(env) {
+	return Boolean(env.JEST_WORKER_ID || env.VITEST || env.VITEST_WORKER_ID || env.NODE_ENV === "test");
+}
+/**
+* Whether a test runner started this process, decided **once at import**.
+*
+* Read at call time it would be wrong, and provably so: `env.test.ts` does
+* `process.env = {}` in its `beforeEach`, which erases `NODE_ENV` and
+* `JEST_WORKER_ID` alike. A predicate consulting the live environment therefore
+* sees a bare object and concludes "development", which is how the first version
+* of this dropped a `.rebase-dev-secrets.json` into `packages/server` on every
+* test run.
+*
+* Whether a test runner is hosting the process is a fact about the process, not
+* about whatever a test has since done to `process.env`, so it is captured
+* before any test can rewrite it.
+*/
+var TEST_RUNNER_DETECTED = detectTestRunner(process.env);
+/**
+* Whether generated secrets should be cached at all.
+*
+* Not in production — `loadEnv` refuses to boot there on a generated secret, so
+* there is nothing to cache and no path by which a cached one becomes a
+* production one.
+*
+* Not under a test runner: a test must not inherit a secret a previous run left
+* behind, and a library call has no business writing into a suite's working
+* directory. `inTestRunner` is a parameter only so this predicate can be tested
+* on its own; callers pass nothing.
+*/
+function shouldCacheDevSecrets(env = process.env, inTestRunner = TEST_RUNNER_DETECTED) {
+	if (inTestRunner) return false;
+	return env.NODE_ENV !== "production";
+}
+/** `REBASE_DEV_SECRETS_FILE`, or the conventional name in the working directory. */
+function resolveDevSecretsFile(env = process.env) {
+	const override = env.REBASE_DEV_SECRETS_FILE?.trim();
+	if (override) return path$3.resolve(override);
+	return path$3.join(process.cwd(), DEV_SECRETS_FILENAME);
+}
+/**
+* Open the cache.
+*
+* Reading a malformed file is treated as an empty cache rather than an error:
+* the file is ours, it holds regenerable values, and refusing to boot over a
+* corrupted convenience cache would be worse than rewriting it.
+*/
+function openDevSecretStore(file = resolveDevSecretsFile()) {
+	let cache = {};
+	let usable = true;
+	try {
+		if (fs$3.existsSync(file)) {
+			const parsed = JSON.parse(fs$3.readFileSync(file, "utf-8"));
+			if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+				for (const [key, value] of Object.entries(parsed)) if (typeof value === "string" && value.length > 0) cache[key] = value;
+			}
+		}
+	} catch {
+		cache = {};
+	}
+	const flush = () => {
+		try {
+			fs$3.mkdirSync(path$3.dirname(file), { recursive: true });
+			fs$3.writeFileSync(file, `${JSON.stringify(cache, null, 2)}\n`, { mode: FILE_MODE });
+			fs$3.chmodSync(file, FILE_MODE);
+		} catch (err) {
+			if (usable) {
+				usable = false;
+				logger.debug(`[dev-secrets] Could not write ${file}, so generated development secrets will not survive a restart: ${err instanceof Error ? err.message : String(err)}`);
+			}
+		}
+	};
+	return {
+		file,
+		get usable() {
+			return usable;
+		},
+		get: (name) => cache[name],
+		set: (name, value) => {
+			cache[name] = value;
+			flush();
+		}
+	};
+}
+//#endregion
 //#region src/env.ts
 /**
 * Generate a cryptographically secure random secret (hex-encoded).
@@ -11586,14 +13511,24 @@ function loadEnv(options) {
 	const isProduction = process.env.NODE_ENV === "production";
 	const autoGeneratedSecrets = [];
 	if (!isProduction) {
-		if (!process.env.JWT_SECRET) {
-			process.env.JWT_SECRET = generateSecret();
-			autoGeneratedSecrets.push("JWT_SECRET");
-		}
-		if (!process.env.REBASE_SERVICE_KEY) {
-			process.env.REBASE_SERVICE_KEY = generateSecret();
-			autoGeneratedSecrets.push("REBASE_SERVICE_KEY");
-		}
+		const devSecrets = shouldCacheDevSecrets() ? openDevSecretStore() : void 0;
+		const reused = [];
+		const ensure = (name) => {
+			if (process.env[name]) return;
+			const cached = devSecrets?.get(name);
+			if (cached) {
+				process.env[name] = cached;
+				reused.push(name);
+			} else {
+				const generated = generateSecret();
+				process.env[name] = generated;
+				devSecrets?.set(name, generated);
+			}
+			autoGeneratedSecrets.push(name);
+		};
+		ensure("JWT_SECRET");
+		ensure("REBASE_SERVICE_KEY");
+		if (autoGeneratedSecrets.length > 0 && reused.length !== autoGeneratedSecrets.length && devSecrets?.usable) logger.info(`Generated development ${autoGeneratedSecrets.length > 1 ? "secrets" : "secret"} (${autoGeneratedSecrets.join(", ")}) and cached them in ${DEV_SECRETS_FILENAME} so a restart does not log you out. Set them explicitly for anything that is not a development machine.`);
 	}
 	const env = (options?.extend ? rebaseEnvSchema.merge(options.extend) : rebaseEnvSchema).superRefine((data, ctx) => {
 		const d = data;
@@ -12338,7 +14273,7 @@ function serveSPA(app, config) {
 	const rawBase = config.basePath ?? "/";
 	const basePath = rawBase !== "/" ? rawBase.replace(/\/+$/, "") : "/";
 	const isRoot = basePath === "/";
-	if (!fs$2.existsSync(frontendPath)) {
+	if (!fs$3.existsSync(frontendPath)) {
 		logger.warn(`⚠️ Frontend build path does not exist: ${frontendPath}`);
 		logger.warn("   SPA serving is disabled. Build your frontend first.");
 		return;
@@ -12352,7 +14287,7 @@ function serveSPA(app, config) {
 	});
 	app.use(scope, responseCompression());
 	app.use(scope, serveStatic({
-		root: path$2.relative(process.cwd(), frontendPath),
+		root: path$3.relative(process.cwd(), frontendPath),
 		precompressed: true,
 		...isRoot ? {} : { rewriteRequestPath: (p) => p.slice(basePath.length) || "/" }
 	}));
@@ -12365,7 +14300,7 @@ function serveSPA(app, config) {
 	app.get(scope, async (c, next) => {
 		if (allExcludePaths.some((p) => isUnderPath(c.req.path, p))) return next();
 		if (isAssetRequest(c.req.path, c.req.header("sec-fetch-dest"))) return c.text("Not found", 404);
-		const indexPath = path$2.join(frontendPath, indexFile);
+		const indexPath = path$3.join(frontendPath, indexFile);
 		if (!cachedHtml) try {
 			cachedHtml = await fsp.readFile(indexPath, "utf-8");
 		} catch {
@@ -12774,6 +14709,18 @@ var bootEnvExtension = object({
 		"false",
 		""
 	]).default("false").transform((v) => v === "true"),
+	/**
+	* Bot protection. Enabled by setting both — a provider without a secret
+	* cannot verify anything, and is refused at boot rather than ignored.
+	*/
+	CAPTCHA_PROVIDER: _enum([
+		"turnstile",
+		"hcaptcha",
+		""
+	]).optional(),
+	CAPTCHA_SECRET: string().optional(),
+	/** Comma-separated: register, login, forgotPassword, magicLink. */
+	CAPTCHA_ROUTES: string().optional(),
 	AUTH_COOKIE_SAME_SITE: _enum([
 		"Strict",
 		"Lax",
@@ -12874,6 +14821,19 @@ var bootEnvExtension = object({
 		""
 	]).optional().transform((v) => v === void 0 || v === "" ? void 0 : v === "true"),
 	/**
+	* Override whether this process runs the scheduled RLS audit. Unset follows
+	* the role.
+	*
+	* Unlike cron and the job workers this is not claim-protected — every owner
+	* scans on its own timer, which is redundant rather than unsafe — so a split
+	* deployment sets it false everywhere but one process.
+	*/
+	REBASE_RLS_AUDIT: _enum([
+		"true",
+		"false",
+		""
+	]).optional().transform((v) => v === void 0 || v === "" ? void 0 : v === "true"),
+	/**
 	* Comma-separated function names this process serves. Unset means all.
 	*
 	* `functions` role only. A name that is not in the bundle is a boot failure,
@@ -13023,7 +14983,8 @@ var ROLES = {
 		},
 		ownership: {
 			cronScheduler: false,
-			jobWorkers: false
+			jobWorkers: false,
+			rlsAudit: false
 		},
 		provisionSchema: false
 	},
@@ -13067,6 +15028,7 @@ function resolveRole(env) {
 	const ownership = { ...base.ownership };
 	if (env.REBASE_CRON_SCHEDULER !== void 0) ownership.cronScheduler = env.REBASE_CRON_SCHEDULER;
 	if (env.REBASE_JOB_WORKERS !== void 0) ownership.jobWorkers = env.REBASE_JOB_WORKERS;
+	if (env.REBASE_RLS_AUDIT !== void 0) ownership.rlsAudit = env.REBASE_RLS_AUDIT;
 	return {
 		role,
 		surfaces: { ...base.surfaces },
@@ -13504,13 +15466,51 @@ async function initializeDataSources(sources, schema, resolveFrom = []) {
 //#endregion
 //#region src/boot/options.ts
 /**
-* Build the email configuration, or `undefined` when no SMTP host is set.
+* True when an emailed link would be followable — i.e. when there is an
+* absolute base to build one from. Mirrors `assertEmailLinkBases`, which
+* refuses the boot otherwise.
+*/
+function hasAbsoluteLinkBase(value) {
+	if (!value) return false;
+	try {
+		const url = new URL(value);
+		return url.protocol === "http:" || url.protocol === "https:";
+	} catch {
+		return false;
+	}
+}
+/**
+* Build the email configuration.
 *
-* Without it the auth adapter still works; password-reset and verification mail
-* simply has nowhere to go, which the auth routes report for themselves.
+* With `SMTP_HOST`, that is a real SMTP transport. Without it, outside
+* production, it is the development sink: mail is captured and its links are
+* printed, so `POST /auth/magic-link` and `POST /auth/forgot-password` complete
+* on a fresh project instead of answering `503 EMAIL_NOT_CONFIGURED`. The token
+* was always minted and valid; only delivery was missing.
+*
+* Three conditions, all required, none configurable:
+*
+*  - no `SMTP_HOST` — a configured mail server always wins;
+*  - `NODE_ENV` is not `production` — a captured reset mail carries a working
+*    token, so this must not be reachable there (see `dev-sink.ts`);
+*  - an absolute `FRONTEND_URL`, or the emailed link has no base and is dead on
+*    arrival — which is the condition `assertEmailLinkBases` fails the boot on.
+*
+* When any of those does not hold this returns `undefined`, exactly as before,
+* and the auth routes report the missing service for themselves.
 */
 function resolveEmailOptions(env) {
-	if (!env.SMTP_HOST) return void 0;
+	if (!env.SMTP_HOST) {
+		if (env.NODE_ENV === "production") return void 0;
+		if (!hasAbsoluteLinkBase(env.FRONTEND_URL)) return void 0;
+		return {
+			from: env.SMTP_FROM || `${env.APP_NAME} <noreply@rebase.pro>`,
+			sendEmail: createDevEmailSink().sendEmail,
+			appName: env.APP_NAME,
+			logoUrl: env.EMAIL_LOGO_URL,
+			resetPasswordUrl: env.FRONTEND_URL
+		};
+	}
 	return {
 		from: env.SMTP_FROM || `${env.APP_NAME} <noreply@rebase.pro>`,
 		smtp: {
@@ -13529,6 +15529,24 @@ function resolveEmailOptions(env) {
 	};
 }
 /**
+* Bot protection from the environment, or `undefined` when it is not configured.
+*
+* Both halves are required together. A provider with no secret cannot verify
+* anything, so it is left off here and `resolveCaptchaVerifier` refuses the boot
+* if something else turns it on — the one failure this feature must not have is
+* being silently absent while the config says otherwise.
+*/
+function resolveCaptchaOptions(env) {
+	if (!env.CAPTCHA_PROVIDER || !env.CAPTCHA_SECRET) return void 0;
+	const routes = env.CAPTCHA_ROUTES?.split(",").map((part) => part.trim()).filter(Boolean);
+	return {
+		enabled: true,
+		provider: env.CAPTCHA_PROVIDER,
+		secret: env.CAPTCHA_SECRET,
+		...routes?.length ? { routes } : {}
+	};
+}
+/**
 * Build the auth configuration from the environment and the bundle's users
 * collection.
 *
@@ -13552,6 +15570,7 @@ function resolveAuthOptions(env, usersCollection) {
 		disableSelfRegistration: env.DISABLE_SELF_REGISTRATION,
 		allowAnonymous: env.ALLOW_ANONYMOUS,
 		allowUserLookup: env.AUTH_ALLOW_USER_LOOKUP,
+		captcha: resolveCaptchaOptions(env),
 		email: resolveEmailOptions(env),
 		cookieAuth: { sameSite: env.AUTH_COOKIE_SAME_SITE || "Lax" }
 	};
@@ -14322,6 +16341,6 @@ function warnOnUnusableBundleShape(bundle) {
 	logger.warn(`This bundle declares a config package at "${bundle.manifest.entry.config}", but no collections directory resolved inside it, so no collections were loaded and no tables will be created. Rebuild with \`rebase build\` and check the manifest's \`entry.collections\`.`);
 }
 //#endregion
-export { ApiError, BlockedUrlError, BundleError, CONCURRENT_DDL_SQLSTATES, CronScheduler, DEFAULT_DRIVER_ID, DEFAULT_MAX_FILE_SIZE, DEFAULT_STORAGE_ID, DOCUMENT_MIME_TYPES, DefaultDriverRegistry, DefaultStorageRegistry, GCSStorageController, IMAGE_MIME_TYPES, LocalStorageController, MetricsRegistry, RawHtml, S3StorageController, SMTPEmailService, TransformCache, TusHandler, UnknownStorageSourceError, WEBHOOK_DELIVERY_TASK, WebhookDispatcher, _resetRebaseMock, _setRebaseMock, applyCollectionDefaults, assertAllowedOutboundUrl, assertCollectionConfigs, assertDistinctSuffixes, assertEmailLinkBases, assertWriteRequestValid, authJwt, authRoles, authUid, blockedAddressReason, bootFromBundle, classifySurface, cleanupDevPortFile, createAppleProvider, createBackupRoutes, createBitbucketProvider, createBuiltinAuthAdapter, createContractRoutes, createCronRoutes, createCronStore, createCustomAuthAdapter, createDdlBootstrapper, createDiscordProvider, createEmailService, createFacebookProvider, createFunctionRoutes, createGitHubProvider, createGitLabProvider, createGoogleProvider, createHistoryRoutes, createJobQueue, createJobStore, createJwksRoutes, createLinkedinProvider, createMetricsMiddleware, createMetricsRoutes, createMicrosoftProvider, createSlackProvider, createSourceBundle, createSpotifyProvider, createStorageController, createStorageRoutes, createTwitterProvider, defaultBackoff, defineCron, defineFunction, envSuffixForKey, errorHandler, escapeHtml, extractUserFromToken, fileTokenAuth, findCollectionConfigProblems, generateSecurePassword, getEmailVerificationTemplate, getJwks, getMagicLinkTemplate, getPasswordResetTemplate, getUserInvitationTemplate, getWelcomeEmailTemplate, hasAsymmetricSigningKey, hashPassword, html, httpMethodToOperation, initializeDataSource, initializeDataSources, initializeRebaseBackend, installShutdownHandlers, isApiKeyToken, isAuthAdapter, isConcurrentDdlRace, isDatabaseAdapter, isDuplicateObjectRace, isLocalhostOrigin, isOperationAllowed, isTransformableImage, listBackupObjects, listenWithPortRetry, loadBootEnv, loadBundle, loadBundleConfigExports, loadBundleSchema, loadCollectionsFromDirectory, loadCronJobsFromDirectory, loadCronJobsWithDiagnostics, loadDeclaredStorageSources, loadEnv, loadFunctionsFromDirectory, loadUsersCollection, logger, oauthCodeFlowSchema, optionalAuth, parseBackupDestination, parseBackupTimestamp, parseTransformOptions, pkceTokenParams, providerVerifiedEmail, queryTokenAuth, raw, readBackupBytes, readBundleManifest, rebase, requireAdmin, requireAuth, resolveAuthHooks, resolveAuthOptions, resolveCorsOrigin, resolveDataSources, resolveEmailBranding, resolveEmailLinkBase, resolveEmailOptions, resolveRequireAuth, resolveStorageBackend, resolveStorageSources, runFromBundle, safeCompare, serveSPA, transformImage, tryVerifyOidcIdToken, unknownKeyPolicyFromEnv, validateApiKey, validateCronExpression, validatePasswordStrength, verifyOidcIdToken, verifyPassword };
+export { ApiError, BlockedUrlError, BundleError, CONCURRENT_DDL_SQLSTATES, CronScheduler, DEFAULT_DRIVER_ID, DEFAULT_MAX_FILE_SIZE, DEFAULT_STORAGE_ID, DOCUMENT_MIME_TYPES, DefaultDriverRegistry, DefaultStorageRegistry, GCSStorageController, IMAGE_MIME_TYPES, LocalStorageController, MetricsRegistry, RawHtml, S3StorageController, SMTPEmailService, StoragePolicyError, TransformCache, TusHandler, UnknownStorageSourceError, WEBHOOK_DELIVERY_TASK, WebhookDispatcher, _resetRebaseMock, _setRebaseMock, applyCollectionDefaults, assertAllowedOutboundUrl, assertCollectionConfigs, assertDistinctSuffixes, assertEmailLinkBases, assertWriteRequestValid, authJwt, authRoles, authUid, blockedAddressReason, bootFromBundle, classifySurface, cleanupDevPortFile, compileStoragePolicies, createAppleProvider, createBackupRoutes, createBitbucketProvider, createBuiltinAuthAdapter, createContractRoutes, createCronRoutes, createCronStore, createCustomAuthAdapter, createDdlBootstrapper, createDevEmailSink, createDiscordProvider, createEmailService, createFacebookProvider, createFunctionRoutes, createGitHubProvider, createGitLabProvider, createGoogleProvider, createHistoryRoutes, createJobQueue, createJobStore, createJwksRoutes, createLinkedinProvider, createMetricsMiddleware, createMetricsRoutes, createMicrosoftProvider, createRlsAudit, createSlackProvider, createSourceBundle, createSpotifyProvider, createStorageController, createStorageRoutes, createTwitterProvider, defaultBackoff, defineCron, defineFunction, drainBackgroundWork, envSuffixForKey, errorHandler, escapeHtml, extractLinks, extractUserFromToken, fileTokenAuth, findCollectionConfigProblems, generateSecurePassword, getApiKey, getDriver, getEmailVerificationTemplate, getEnv, getJwks, getMagicLinkTemplate, getPasswordResetTemplate, getRequestId, getRoles, getUser, getUserId, getUserInvitationTemplate, getWelcomeEmailTemplate, hasAsymmetricSigningKey, hasRole, hashPassword, html, httpMethodToOperation, identityResolved, initializeDataSource, initializeDataSources, initializeRebaseBackend, installShutdownHandlers, isAdmin, isApiKeyToken, isAuthAdapter, isAuthenticated, isConcurrentDdlRace, isDatabaseAdapter, isDuplicateObjectRace, isLocalhostOrigin, isNodeRuntime, isOperationAllowed, isTransformableImage, lazyResource, listBackupObjects, listenWithPortRetry, loadBootEnv, loadBundle, loadBundleConfigExports, loadBundleSchema, loadCollectionsFromDirectory, loadCronJobsFromDirectory, loadCronJobsWithDiagnostics, loadDeclaredStorageSources, loadEnv, loadFunctionsFromDirectory, loadFunctionsWithDiagnostics, loadUsersCollection, logger, oauthCodeFlowSchema, optionalAuth, parseBackupDestination, parseBackupTimestamp, parseTransformOptions, pendingBackgroundWork, pkceTokenParams, providerVerifiedEmail, queryTokenAuth, raw, readBackupBytes, readBundleManifest, rebase, requireAdmin, requireAuth, requireDriver, requireEnv, requireRole, resolveAuthHooks, resolveAuthOptions, resolveCorsOrigin, resolveDataSources, resolveEmailBranding, resolveEmailLinkBase, resolveEmailOptions, resolveRequireAuth, resolveStorageAccessControl, resolveStorageBackend, resolveStorageSources, runFromBundle, runtimeKey, safeCompare, serveSPA, summarize as summarizeRlsScan, transformImage, tryVerifyOidcIdToken, unknownKeyPolicyFromEnv, validateApiKey, validateCronExpression, validatePasswordStrength, verifyOidcIdToken, verifyPassword, waitUntil };
 
 //# sourceMappingURL=index.es.js.map