@rebasepro/server 0.16.0 → 0.16.1-canary.g701140a

package/dist/index.es.js

@@ -4,25 +4,27 @@ __createRequire(import.meta.url);
 import { A as GeoPoint, M as RebaseApiError, N as RebaseClientError, O as EntityReference, S as toSnakeCase, _ as fieldKeyForColumn, b as buildCompositeId, c as collectAllPages, d as normalizeOrderBy, f as serializeOrderBy, g as getEffectiveSecurityRules, h as resolveDataSource, j as Vector, k as EntityRelation, l as paginateFind, m as createDataSourceRegistry, n as buildSdkData, o as serializeFilter, p as CollectionRegistry, s as serializeLogicalCondition, t as buildRoutedRebaseData, u as resolveFindWindow, v as findRelation, x as resolvePrimaryKeys, y as resolveCollectionRelations } from "./src-BPfYOeN4.js";
 import { c as DEFAULT_DATA_SOURCE_KEY, g as toCanonicalOp, i as getCollectionDataPath, m as parseRelationAggregateSort, n as RLS_ROLES_SQL, o as isPostgresCollectionConfig, r as RLS_UID_SQL, t as RLS_JWT_SQL } from "./src-CrCxd8km.js";
 import { n as ADMIN_PROPERTY_KEYS, t as ADMIN_COLLECTION_KEYS } from "./admin_block-DLILvzle.js";
-import { a as isDuplicateObjectRace, i as isConcurrentDdlRace, n as createDdlBootstrapper, o as revokeInternalTableSql, s as isSQLAdmin, t as CONCURRENT_DDL_SQLSTATES } from "./ddl-bootstrap-Cywoj8Ta.js";
-import { C as canonicalStorageKey, D as findStorageSuffixCollision, E as DEFAULT_STORAGE_SOURCE_KEY, O as normalizeStorageSources, S as canonicalStorageId, b as InvalidStorageKeyError, c as getJwks, d as hasAsymmetricSigningKey, i as generateDownloadToken, k as storageEnvSuffix, n as configureJwt, p as isJwtConfigured, v as normalizePemFromEnv, x as canonicalStorageBucket, y as InvalidStorageBucketError } from "./jwt-DxH9fLPt.js";
-import { n as createContractRoutes, r as computeSchemaVersion } from "./contract-routes-DZ-LBpSL.js";
-import { $ as createAdapterAuthMiddleware, A as _coercedNumber, B as validatePasswordStrength, C as providerVerifiedEmail, Ct as parseQueryOptions, D as _enum, E as ZodNumber, Et as isPublicStoragePath, F as createEmailService, G as getPasswordResetTemplate, H as generateSecurePassword, I as assertEmailLinkBases, J as resolveEmailBranding, K as getUserInvitationTemplate, L as resolveEmailLinkBase, M as createDataRateLimiter, N as MemoryRateLimitStore, O as object, P as SMTPEmailService, Q as raw, R as resolveAuthHooks, S as pkceTokenParams, St as parseGroupBy, T as createBuiltinAuthAdapter, Tt as PUBLIC_STORAGE_PREFIX, U as getEmailVerificationTemplate, V as verifyPassword, W as getMagicLinkTemplate, X as escapeHtml, Y as RawHtml, Z as html, _ as verifyOidcIdToken, _t as scopeDataDriver, a as resolveRateLimitStoreKind, at as publicObjectAuth, b as createGoogleProvider, bt as orderByEntriesToTuples, c as createSlackProvider, ct as requireAuth, d as createDiscordProvider, dt as createStorageApiKeyGuard, et as createAuthMiddleware, f as createTwitterProvider, ft as isApiKeyToken, g as tryVerifyOidcIdToken, gt as SERVICE_IDENTITY, h as createMicrosoftProvider, ht as safeCompare, i as createApiKeyStore, it as optionalAuth, j as DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT, k as string, l as createBitbucketProvider, lt as createApiKeyPreAuth, m as createAppleProvider, mt as extractBearerToken, n as createCustomAuthAdapter, nt as extractUserFromToken, o as createSqlRateLimitStore, ot as queryTokenAuth, p as createFacebookProvider, pt as validateApiKey, q as getWelcomeEmailTemplate, r as createApiKeyRoutes, rt as fileTokenAuth, s as createSpotifyProvider, st as requireAdmin, tt as createRequireAuth, u as createGitLabProvider, ut as createFunctionApiKeyGuard, v as createGitHubProvider, vt as httpMethodToOperation, w as createJwksRoutes, wt as resolveListLimitParam, x as oauthCodeFlowSchema, xt as parseAggregateSelect, y as createLinkedinProvider, yt as isOperationAllowed, z as hashPassword } from "./auth-5Et5mnUA.js";
-import { t as logger } from "./logger-DfvF_8r-.js";
-import { n as errorHandler, t as ApiError } from "./errors-EBYiaJ2E.js";
+import { a as isDuplicateObjectRace, i as isConcurrentDdlRace, n as createDdlBootstrapper, o as revokeInternalTableSql, s as isSQLAdmin, t as CONCURRENT_DDL_SQLSTATES } from "./ddl-bootstrap-CFLhcvfQ.js";
+import { C as canonicalStorageKey, D as findStorageSuffixCollision, E as DEFAULT_STORAGE_SOURCE_KEY, O as normalizeStorageSources, S as canonicalStorageId, b as InvalidStorageKeyError, c as getJwks, d as hasAsymmetricSigningKey, i as generateDownloadToken, k as storageEnvSuffix, n as configureJwt, p as isJwtConfigured, v as normalizePemFromEnv, x as canonicalStorageBucket, y as InvalidStorageBucketError } from "./jwt-BbJi0TR0.js";
+import { n as createContractRoutes, r as computeSchemaVersion } from "./contract-routes-BEq7euZg.js";
+import { $ as html, A as _coercedNumber, B as resolveAuthHooks, C as providerVerifiedEmail, Ct as orderByEntriesToTuples, D as _enum, Dt as resolveListLimitParam, E as ZodNumber, Et as parseQueryOptions, F as extractLinks, G as getEmailVerificationTemplate, H as validatePasswordStrength, I as SMTPEmailService, J as getUserInvitationTemplate, K as getMagicLinkTemplate, L as createEmailService, M as createDataRateLimiter, N as MemoryRateLimitStore, O as object, Ot as PUBLIC_STORAGE_PREFIX, P as createDevEmailSink, Q as escapeHtml, R as assertEmailLinkBases, S as pkceTokenParams, St as isOperationAllowed, T as createBuiltinAuthAdapter, Tt as parseGroupBy, U as verifyPassword, V as hashPassword, W as generateSecurePassword, X as resolveEmailBranding, Y as getWelcomeEmailTemplate, Z as RawHtml, _ as verifyOidcIdToken, _t as safeCompare, a as resolveRateLimitStoreKind, at as fileTokenAuth, b as createGoogleProvider, bt as hasAdministrativeRole, c as createSlackProvider, ct as queryTokenAuth, d as createDiscordProvider, dt as createApiKeyPreAuth, et as raw, f as createTwitterProvider, ft as createFunctionApiKeyGuard, g as tryVerifyOidcIdToken, gt as extractBearerToken, h as createMicrosoftProvider, ht as validateApiKey, i as createApiKeyStore, it as extractUserFromToken, j as DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT, k as string, kt as isPublicStoragePath, l as createBitbucketProvider, lt as requireAdmin, m as createAppleProvider, mt as isApiKeyToken, n as createCustomAuthAdapter, nt as createAuthMiddleware, o as createSqlRateLimitStore, ot as optionalAuth, p as createFacebookProvider, pt as createStorageApiKeyGuard, q as getPasswordResetTemplate, r as createApiKeyRoutes, rt as createRequireAuth, s as createSpotifyProvider, st as publicObjectAuth, tt as createAdapterAuthMiddleware, u as createGitLabProvider, ut as requireAuth, v as createGitHubProvider, vt as SERVICE_IDENTITY, w as createJwksRoutes, wt as parseAggregateSelect, x as oauthCodeFlowSchema, xt as httpMethodToOperation, y as createLinkedinProvider, yt as scopeDataDriver, z as resolveEmailLinkBase } from "./auth-B0IV-irB.js";
+import { r as hostEnv, t as logger } from "./logger-TdvXIGqR.js";
+import { n as errorHandler, t as ApiError } from "./errors-D_LwNKRM.js";
 import { t as logMiddleware } from "./logs-routes-CWBLQj2l.js";
 import { n as DOCUMENT_MIME_TYPES, r as IMAGE_MIME_TYPES, t as DEFAULT_MAX_FILE_SIZE } from "./types-DSnOC4mF.js";
 import { t as S3StorageController } from "./S3StorageController-B2EDXXMH.js";
 import { t as GCSStorageController } from "./GCSStorageController-BEmDYFKc.js";
-import { n as loadFunctionsFromDirectory } from "./function-loader-DDS1v7YX.js";
+import { n as loadFunctionsFromDirectory, r as loadFunctionsWithDiagnostics } from "./function-loader-BrLmC_-y.js";
 import { t as createFunctionRoutes } from "./function-routes-Btcez1T-.js";
-import { n as loadCronJobsFromDirectory, r as loadCronJobsWithDiagnostics } from "./cron-loader-YhhQeVBM.js";
-import { r as validateCronExpression, t as CronScheduler } from "./cron-scheduler-DIpYBmZP.js";
-import { t as createCronRoutes } from "./cron-routes-maM_RlUu.js";
-import { t as createCronStore } from "./cron-store-DfH_4Cd9.js";
-import { a as parseBackupTimestamp, i as parseBackupDestination, n as createBackupRoutes, o as readBackupBytes, r as listBackupObjects } from "./backup-C6ljYVTp.js";
-import { i as createJobStore, n as createJobQueue, r as defaultBackoff } from "./jobs-CyOKXXlu.js";
+import "./proxy-QJKSS-CV.js";
+import "./request-timeout-OofPCHQT.js";
 import { t as FunctionSelectionError } from "./selection-_z6TM1DB.js";
+import { n as loadCronJobsFromDirectory, r as loadCronJobsWithDiagnostics } from "./cron-loader-BMvtW6-J.js";
+import { r as validateCronExpression, t as CronScheduler } from "./cron-scheduler-Buf-uVam.js";
+import { t as createCronRoutes } from "./cron-routes-BvYk-Kmi.js";
+import { t as createCronStore } from "./cron-store-CpfttP4f.js";
+import { a as parseBackupTimestamp, i as parseBackupDestination, n as createBackupRoutes, o as readBackupBytes, r as listBackupObjects } from "./backup-BJ86ah4T.js";
+import { i as createJobStore, n as createJobQueue, r as defaultBackoff } from "./jobs-CSlBZ8dn.js";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import * as fs$2 from "fs";
 import fs, { existsSync } from "fs";
@@ -41,6 +43,7 @@ import fs$1 from "node:fs";
 import fsp from "node:fs/promises";
 import os from "node:os";
 import { mkdir, open, unlink, writeFile } from "fs/promises";
+import { env, getRuntimeKey } from "hono/adapter";
 import { sql } from "drizzle-orm";
 import { lookup } from "node:dns/promises";
 import { isIP } from "node:net";
@@ -161,7 +164,7 @@ var PROPERTY_KEYS_BY_TYPE = {
 	],
 	geopoint: [],
 	binary: [],
-	vector: ["dimensions"],
+	vector: ["dimensions", "index"],
 	reference: [
 		"isId",
 		"path",
@@ -3032,6 +3035,138 @@ function isStorageController(obj) {
 	return typeof controller.putObject === "function" && typeof controller.getSignedUrl === "function" && typeof controller.deleteObject === "function" && typeof controller.listObjects === "function" && typeof controller.getType === "function";
 }
 //#endregion
+//#region src/storage/cache-headers.ts
+/**
+* A weak validator built from size and modification time.
+*
+* Weak (`W/`) because it is not a digest of the body: two different bodies of
+* the same length written in the same millisecond would collide. That is the
+* same trade nginx makes for static files, and the alternative — hashing every
+* object on every request — costs more than it saves for content this server is
+* already streaming from somewhere else.
+*/
+function buildEntityTag(size, lastModifiedMs) {
+	return `W/"${size.toString(16)}-${Math.floor(lastModifiedMs).toString(16)}"`;
+}
+function objectValidators(size, lastModifiedMs) {
+	const seconds = Math.floor(lastModifiedMs / 1e3) * 1e3;
+	return {
+		etag: buildEntityTag(size, lastModifiedMs),
+		lastModified: new Date(seconds).toUTCString(),
+		lastModifiedMs: seconds
+	};
+}
+function cacheControl(options) {
+	const parts = [options.isPublic ? "public" : "private", `max-age=${options.maxAgeSeconds}`];
+	if (options.isPublic && options.staleWhileRevalidateSeconds) parts.push(`stale-while-revalidate=${options.staleWhileRevalidateSeconds}`);
+	parts.push("must-revalidate");
+	return parts.join(", ");
+}
+/** Every `ETag` in an `If-None-Match` header, unquoted comparison-ready. */
+function parseIfNoneMatch(header) {
+	return header.split(",").map((part) => part.trim()).filter(Boolean);
+}
+/**
+* Weak comparison, which is the only comparison `If-None-Match` on a GET is
+* allowed to use (RFC 9110 §8.8.3.2). `W/"x"` and `"x"` are the same entity for
+* this purpose, so the prefix is stripped from both sides before comparing.
+*/
+function weakMatch(a, b) {
+	const strip = (v) => v.startsWith("W/") ? v.slice(2) : v;
+	return strip(a) === strip(b);
+}
+/**
+* Whether the request already holds this exact representation.
+*
+* `If-None-Match` wins outright when present: it is an exact validator, whereas
+* `If-Modified-Since` has second resolution and is only consulted in its
+* absence — again the order RFC 9110 requires.
+*/
+function isNotModified(c, validators) {
+	const ifNoneMatch = c.req.header("if-none-match");
+	if (ifNoneMatch) {
+		const tags = parseIfNoneMatch(ifNoneMatch);
+		return tags.includes("*") || tags.some((tag) => weakMatch(tag, validators.etag));
+	}
+	const ifModifiedSince = c.req.header("if-modified-since");
+	if (ifModifiedSince) {
+		const since = Date.parse(ifModifiedSince);
+		if (!Number.isNaN(since)) return validators.lastModifiedMs <= since;
+	}
+	return false;
+}
+/**
+* Put the validators and the cache policy on a response.
+*
+* Applied to the 304 as well as the 200: a 304 that omits them tells the client
+* nothing about how long the answer holds, so the next load revalidates again
+* immediately and the round trip repeats forever.
+*/
+function applyCacheHeaders(c, validators, options) {
+	c.header("ETag", validators.etag);
+	c.header("Last-Modified", validators.lastModified);
+	c.header("Cache-Control", cacheControl(options));
+	c.header("Vary", "Authorization");
+}
+//#endregion
+//#region src/storage/range.ts
+/**
+* Parse a `Range` header against an object of `size` bytes.
+*
+* Deliberately conservative: anything malformed, multi-range, or in a unit other
+* than bytes resolves to `none`, which serves the whole object. A range request
+* answered with `200` is always legal; a range answered wrongly is a corrupted
+* download.
+*/
+function parseRange(header, size) {
+	if (!header) return { kind: "none" };
+	const match = /^bytes=(.*)$/i.exec(header.trim());
+	if (!match) return { kind: "none" };
+	const spec = match[1].trim();
+	if (spec.includes(",")) return { kind: "none" };
+	const parts = /^(\d*)-(\d*)$/.exec(spec);
+	if (!parts) return { kind: "none" };
+	const [, rawStart, rawEnd] = parts;
+	if (size === 0) return { kind: "unsatisfiable" };
+	let start;
+	let end;
+	if (rawStart === "") {
+		if (rawEnd === "") return { kind: "none" };
+		const suffix = Number(rawEnd);
+		if (!Number.isSafeInteger(suffix)) return { kind: "none" };
+		if (suffix === 0) return { kind: "unsatisfiable" };
+		start = Math.max(0, size - suffix);
+		end = size - 1;
+	} else {
+		start = Number(rawStart);
+		if (!Number.isSafeInteger(start)) return { kind: "none" };
+		if (start >= size) return { kind: "unsatisfiable" };
+		if (rawEnd === "") end = size - 1;
+		else {
+			end = Number(rawEnd);
+			if (!Number.isSafeInteger(end)) return { kind: "none" };
+			end = Math.min(end, size - 1);
+		}
+		if (end < start) return { kind: "unsatisfiable" };
+	}
+	return {
+		kind: "range",
+		range: {
+			start,
+			end,
+			length: end - start + 1
+		}
+	};
+}
+/** The `Content-Range` for a served range. */
+function contentRange(range, size) {
+	return `bytes ${range.start}-${range.end}/${size}`;
+}
+/** The `Content-Range` for a `416`, which names the size and no range. */
+function unsatisfiableContentRange(size) {
+	return `bytes */${size}`;
+}
+//#endregion
 //#region src/storage/image-transform.ts
 /**
 * Image Transformation Service
@@ -3893,11 +4028,20 @@ function createStorageRoutes(config) {
 		await checkAuthorized(c, "read", resolvedPath, bucket, storageId);
 		c.header("X-Content-Type-Options", "nosniff");
 		const transformKeyPrefix = `${storageId || "(default)"}/${bucket}/${resolvedPath}`;
+		const sharedCacheable = publicRead === true || isPublicStoragePath(resolvedPath);
+		const cachePolicy = (maxAgeSeconds) => ({
+			isPublic: sharedCacheable,
+			maxAgeSeconds,
+			staleWhileRevalidateSeconds: 86400
+		});
+		const OBJECT_MAX_AGE = 60;
+		const TRANSFORM_MAX_AGE = 3600;
 		const transformOpts = transformOptionsOrBadRequest(c.req.query());
 		if (resolved.getType() === "local") {
 			const absolutePath = resolved.getAbsolutePath(resolvedPath, bucket ?? "default");
+			let localStat;
 			try {
-				await fsp.access(absolutePath);
+				localStat = await fsp.stat(absolutePath);
 			} catch {
 				throw ApiError.notFound("File not found");
 			}
@@ -3908,31 +4052,75 @@ function createStorageRoutes(config) {
 				contentType = JSON.parse(metadataRaw).contentType || contentType;
 			} catch {}
 			if (transformOpts && isTransformableImage(contentType)) {
-				const transformed = await transformOnce(transformCache.buildKey(transformKeyPrefix, transformOpts), transformOpts, async () => Buffer.from(await fsp.readFile(absolutePath)));
+				const sourceVersion = buildEntityTag(localStat.size, localStat.mtimeMs);
+				const transformed = await transformOnce(transformCache.buildKey(`${transformKeyPrefix}@${sourceVersion}`, transformOpts), transformOpts, async () => Buffer.from(await fsp.readFile(absolutePath)));
+				const validators = objectValidators(transformed.data.byteLength, localStat.mtimeMs);
+				applyCacheHeaders(c, validators, cachePolicy(TRANSFORM_MAX_AGE));
+				if (isNotModified(c, validators)) return c.body(null, 304);
 				c.header("Content-Type", transformed.contentType);
-				c.header("Cache-Control", "public, max-age=31536000, immutable");
 				return c.body(new Uint8Array(transformed.data));
 			}
-			const fileContent = await fsp.readFile(absolutePath);
+			const validators = objectValidators(localStat.size, localStat.mtimeMs);
+			applyCacheHeaders(c, validators, cachePolicy(OBJECT_MAX_AGE));
 			const served = resolveServedContentType(contentType);
 			c.header("Content-Type", served.contentType);
 			if (served.attachment) c.header("Content-Disposition", "attachment");
+			c.header("Accept-Ranges", "bytes");
+			if (isNotModified(c, validators)) return c.body(null, 304);
+			const localRange = parseRange(c.req.header("range"), localStat.size);
+			if (localRange.kind === "unsatisfiable") {
+				c.header("Content-Range", unsatisfiableContentRange(localStat.size));
+				return c.body(null, 416);
+			}
+			if (localRange.kind === "range") {
+				const { start, length } = localRange.range;
+				const handle = await fsp.open(absolutePath, "r");
+				try {
+					const buffer = Buffer.alloc(length);
+					await handle.read(buffer, 0, length, start);
+					c.header("Content-Range", contentRange(localRange.range, localStat.size));
+					c.header("Content-Length", String(length));
+					return c.body(new Uint8Array(buffer), 206);
+				} finally {
+					await handle.close();
+				}
+			}
+			c.header("Content-Length", String(localStat.size));
+			const fileContent = await fsp.readFile(absolutePath);
 			return c.body(new Uint8Array(fileContent));
 		}
 		const fileObject = await resolved.getObject(resolvedPath, bucket);
 		if (!fileObject) throw ApiError.notFound("File not found");
 		const remoteContentType = fileObject.type || "application/octet-stream";
 		if (transformOpts && isTransformableImage(remoteContentType)) {
-			const transformed = await transformOnce(transformCache.buildKey(transformKeyPrefix, transformOpts), transformOpts, async () => Buffer.from(await fileObject.arrayBuffer()));
+			const sourceVersion = buildEntityTag(fileObject.size, fileObject.lastModified);
+			const transformed = await transformOnce(transformCache.buildKey(`${transformKeyPrefix}@${sourceVersion}`, transformOpts), transformOpts, async () => Buffer.from(await fileObject.arrayBuffer()));
+			const validators = objectValidators(transformed.data.byteLength, fileObject.lastModified);
+			applyCacheHeaders(c, validators, cachePolicy(TRANSFORM_MAX_AGE));
+			if (isNotModified(c, validators)) return c.body(null, 304);
 			c.header("Content-Type", transformed.contentType);
-			c.header("Cache-Control", "public, max-age=31536000, immutable");
 			return c.body(new Uint8Array(transformed.data));
 		}
 		const servedRemote = resolveServedContentType(remoteContentType);
 		c.header("Content-Type", servedRemote.contentType);
 		if (servedRemote.attachment) c.header("Content-Disposition", "attachment");
-		c.header("Cache-Control", "public, max-age=3600, immutable");
+		const remoteValidators = objectValidators(fileObject.size, fileObject.lastModified);
+		applyCacheHeaders(c, remoteValidators, cachePolicy(OBJECT_MAX_AGE));
+		c.header("Accept-Ranges", "bytes");
+		if (isNotModified(c, remoteValidators)) return c.body(null, 304);
+		const remoteRange = parseRange(c.req.header("range"), fileObject.size);
+		if (remoteRange.kind === "unsatisfiable") {
+			c.header("Content-Range", unsatisfiableContentRange(fileObject.size));
+			return c.body(null, 416);
+		}
 		const buf = await fileObject.arrayBuffer();
+		if (remoteRange.kind === "range") {
+			const { start, end, length } = remoteRange.range;
+			c.header("Content-Range", contentRange(remoteRange.range, fileObject.size));
+			c.header("Content-Length", String(length));
+			return c.body(new Uint8Array(buf.slice(start, end + 1)), 206);
+		}
+		c.header("Content-Length", String(fileObject.size));
 		return c.body(new Uint8Array(buf));
 	});
 	/**
@@ -4161,6 +4349,114 @@ function assertStorageAccessControlConfigured(state, isProduction) {
 	logger.warn(STORAGE_NO_ACCESS_CONTROL_MESSAGE);
 }
 //#endregion
+//#region src/storage/policies.ts
+var StoragePolicyError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "StoragePolicyError";
+	}
+};
+var ALL_OPERATIONS = [
+	"read",
+	"write",
+	"delete",
+	"list"
+];
+/**
+* Split a key into segments, dropping empty ones.
+*
+* Empty segments come from a leading slash or a `//`, and treating them as real
+* would let `users//x` match a pattern expecting a captured segment with the
+* empty string. Keys reaching here are already sanitized against traversal; this
+* is about matching, not safety.
+*/
+function segmentsOf(value) {
+	return value.split("/").filter((segment) => segment.length > 0);
+}
+function compile(policy, index) {
+	const label = `storagePolicies[${index}]`;
+	if (typeof policy.path !== "string" || policy.path.trim() === "") throw new StoragePolicyError(`${label}: \`path\` must be a non-empty string.`);
+	const segments = segmentsOf(policy.path);
+	if (segments.length === 0) throw new StoragePolicyError(`${label}: \`path\` "${policy.path}" names no segments. Use "**" to match every key.`);
+	const starIndex = segments.indexOf("**");
+	if (starIndex !== -1 && starIndex !== segments.length - 1) throw new StoragePolicyError(`${label}: "**" is only allowed as the last segment of \`path\`, and "${policy.path}" puts it in the middle. Use "*" for a single segment.`);
+	const captures = segments.filter((s) => s.startsWith(":")).map((s) => s.slice(1));
+	for (const name of captures) {
+		if (name === "") throw new StoragePolicyError(`${label}: a ":" placeholder in "${policy.path}" has no name.`);
+		if (captures.filter((c) => c === name).length > 1) throw new StoragePolicyError(`${label}: "${policy.path}" captures ":${name}" twice, so one would silently win.`);
+	}
+	if (policy.operations !== void 0) {
+		if (!Array.isArray(policy.operations) || policy.operations.length === 0) throw new StoragePolicyError(`${label}: \`operations\` is empty, so this policy grants nothing. Remove it to grant all, or name the operations.`);
+		for (const operation of policy.operations) if (!ALL_OPERATIONS.includes(operation)) throw new StoragePolicyError(`${label}: \`operations\` names "${operation}", which is not a storage operation. Use ${ALL_OPERATIONS.map((o) => `"${o}"`).join(", ")}.`);
+	}
+	if (policy.allow !== "public" && policy.allow !== "authenticated" && typeof policy.allow !== "function") throw new StoragePolicyError(`${label}: \`allow\` must be "public", "authenticated", or a function. A policy with no \`allow\` grants nothing, which is never what was meant.`);
+	return {
+		segments,
+		trailing: starIndex !== -1,
+		operations: new Set(policy.operations ?? ALL_OPERATIONS),
+		allow: policy.allow,
+		source: policy.path
+	};
+}
+/** Match a key's segments against a compiled pattern, capturing as it goes. */
+function match(compiled, key) {
+	const keySegments = segmentsOf(key);
+	const pattern = compiled.trailing ? compiled.segments.slice(0, -1) : compiled.segments;
+	if (compiled.trailing ? keySegments.length < pattern.length : keySegments.length !== pattern.length) return;
+	const params = {};
+	for (let i = 0; i < pattern.length; i++) {
+		const expected = pattern[i];
+		const actual = keySegments[i];
+		if (expected === "*") continue;
+		if (expected.startsWith(":")) {
+			params[expected.slice(1)] = actual;
+			continue;
+		}
+		if (expected !== actual) return void 0;
+	}
+	return params;
+}
+/**
+* Compile a policy list into a {@link StorageAuthorize}.
+*
+* Compiled once, at boot, so a malformed pattern fails the start rather than the
+* first upload. `fallback` is an explicit `storageAuthorize`, consulted only
+* when no policy matched.
+*/
+function compileStoragePolicies(policies, fallback) {
+	if (!Array.isArray(policies)) throw new StoragePolicyError("`storagePolicies` must be an array.");
+	const compiled = policies.map(compile);
+	return async (ctx) => {
+		for (const policy of compiled) {
+			if (!policy.operations.has(ctx.operation)) continue;
+			const params = match(policy, ctx.key);
+			if (!params) continue;
+			if (policy.allow === "public") return true;
+			if (policy.allow === "authenticated") {
+				if (ctx.user?.uid) return true;
+				continue;
+			}
+			if (await policy.allow({
+				...ctx,
+				params
+			})) return true;
+		}
+		if (fallback) return await fallback(ctx);
+		return false;
+	};
+}
+/**
+* The access-control function for a configuration, or `undefined` when it
+* declares none.
+*
+* Kept separate from {@link compileStoragePolicies} so `init` has one call to
+* make and one thing to reason about: policies, a hook, both, or neither.
+*/
+function resolveStorageAccessControl(config) {
+	if (config.storagePolicies?.length) return compileStoragePolicies(config.storagePolicies, config.storageAuthorize);
+	return config.storageAuthorize;
+}
+//#endregion
 //#region src/init/docs.ts
 /**
 * Serve the OpenAPI document, and Swagger UI outside production.
@@ -4256,6 +4552,101 @@ function createHealthCheck(defaultDriver, authSchemaCheck) {
 	};
 }
 //#endregion
+//#region src/functions/wait-until.ts
+/**
+* Pending background work, on a process-global slot for the reason given in
+* `../singleton.ts`: two copies of this module in one process must not each
+* hold half the work, or shutdown drains one half and drops the other.
+*/
+var PENDING_SLOT = Symbol.for("@rebasepro/server:pending-background-work");
+function pending() {
+	const global = globalThis;
+	if (!global[PENDING_SLOT]) global[PENDING_SLOT] = /* @__PURE__ */ new Set();
+	return global[PENDING_SLOT];
+}
+/**
+* Keep `work` alive past the response, on any runtime.
+*
+* Hand it a promise or a function returning one. Nothing is awaited: the
+* response goes out immediately, exactly as an un-awaited call would.
+*
+* What it buys, per host:
+*
+* - **Isolate hosts** (Workers, Deno Deploy, Vercel Edge): the host is told to
+*   keep the isolate alive until the promise settles. Without this the work is
+*   dropped when the response resolves.
+* - **Node**: the promise is tracked so {@link drainBackgroundWork} can wait for
+*   it during graceful shutdown instead of the process exiting out from under
+*   it.
+*
+* On every host a rejection is logged rather than left to the unhandled-rejection
+* handler, so the failure names the function it came from.
+*
+* @example
+* ```ts
+* app.post("/orders", requireAuth, async (c) => {
+*     const order = await createOrder(c);
+*     waitUntil(c, notifyWarehouse(order));   // caller does not wait for this
+*     return c.json({ id: order.id });
+* });
+* ```
+*/
+function waitUntil(c, work) {
+	let promise;
+	try {
+		promise = typeof work === "function" ? Promise.resolve(work()) : work;
+	} catch (error) {
+		logBackgroundFailure(c, error);
+		return;
+	}
+	const tracked = promise.catch((error) => {
+		logBackgroundFailure(c, error);
+	});
+	const set = pending();
+	set.add(tracked);
+	tracked.finally(() => set.delete(tracked));
+	try {
+		c.executionCtx?.waitUntil?.(tracked);
+	} catch {}
+}
+function logBackgroundFailure(c, error) {
+	logger.error("[functions] Background work failed after the response was sent", {
+		method: c.req?.method,
+		path: c.req?.path,
+		error: error instanceof Error ? error : new Error(String(error))
+	});
+}
+/** How many background promises are still in flight. Diagnostics and tests. */
+function pendingBackgroundWork() {
+	return pending().size;
+}
+/**
+* Wait for tracked background work to finish, up to `timeoutMs`.
+*
+* Called by the shutdown path after the server stops accepting connections. It
+* resolves to the number of promises still outstanding when it returned — `0`
+* for a clean drain, more than that for a timeout, which is worth a log line
+* because it means work was dropped.
+*
+* Rejections do not propagate: every tracked promise has already had a `catch`
+* attached by {@link waitUntil}.
+*/
+async function drainBackgroundWork(timeoutMs = 5e3) {
+	const set = pending();
+	if (set.size === 0) return 0;
+	let timer;
+	const expired = new Promise((resolve) => {
+		timer = setTimeout(() => resolve("timeout"), timeoutMs);
+		timer.unref?.();
+	});
+	try {
+		await Promise.race([Promise.allSettled([...set]), expired]);
+	} finally {
+		if (timer) clearTimeout(timer);
+	}
+	return set.size;
+}
+//#endregion
 //#region src/init/shutdown.ts
 /**
 * Install graceful-shutdown signal handlers for a Rebase backend.
@@ -4326,10 +4717,14 @@ function createShutdown(config) {
 					config.cronScheduler.stop();
 					logger.info("Cron scheduler stopped");
 				}
+				if (config.rlsAudit) config.rlsAudit.stop();
 				if (config.jobQueue) {
 					await config.jobQueue.stop();
 					logger.info("Job queue stopped");
 				}
+				const drainBudget = timeoutMs > 0 ? Math.min(5e3, timeoutMs) : 5e3;
+				const stillPending = await drainBackgroundWork(drainBudget);
+				if (stillPending > 0) logger.warn(`${stillPending} background task(s) handed to waitUntil() did not finish within ${drainBudget}ms and are being dropped. Give them an AbortSignal, or move work this long into a cron job or the job queue, where it is restartable.`);
 				for (const [key, rt] of Object.entries(config.realtimeServices)) try {
 					if (typeof rt.destroy === "function") {
 						await rt.destroy();
@@ -4354,6 +4749,147 @@ function createShutdown(config) {
 	};
 }
 //#endregion
+//#region src/rls-audit/index.ts
+/**
+* The row-level-security audit, on a schedule.
+*
+* `@rebasepro/rls-check` is a thorough, read-only audit of a database's RLS —
+* more thorough, on security specifically, than the dashboard advisors it
+* competes with. And nobody runs it, because it is a command, and a command is
+* something you have to remember. A check that has to be remembered is a check
+* that reports a clean database right up until the day it matters.
+*
+* This runs it on a timer against the database the server is already using, and
+* makes the result readable without a terminal. Nothing else about the checker
+* changes: same package, same checks, same output.
+*
+* ## Why it is off by default
+*
+* It opens its own connection and introspects the whole catalog. That is cheap
+* and read-only, but it is not nothing, and a background query nobody asked for
+* is a poor default for a library. Enabling it is one line, and the boot log
+* says so when it is off.
+*
+* ## Why the scanner is injected rather than imported
+*
+* `@rebasepro/server` is engine-agnostic — it has no `pg` and no other database
+* driver, deliberately. `@rebasepro/rls-check` has `pg`, because it connects to
+* Postgres. Importing it here would put a Postgres driver in the install of
+* every Mongo and Firebase user, for a feature none of them can use, and an
+* audit of row-level security is a Postgres concept living in the one package
+* that is supposed to know nothing about Postgres.
+*
+* So the scan function is handed in:
+*
+* ```ts
+* import { scan } from "@rebasepro/rls-check";
+* rlsAudit: { enabled: true, scan }
+* ```
+*
+* Everything else — the schedule, the summary, the status, the admin route —
+* lives here and is engine-agnostic in fact as well as in principle.
+*/
+var SEVERITY_ORDER = [
+	"info",
+	"low",
+	"medium",
+	"high",
+	"critical"
+];
+/** Rank for comparison. Unknown severities sort lowest rather than throwing. */
+var rank = (severity) => {
+	const index = SEVERITY_ORDER.indexOf(severity);
+	return index === -1 ? 0 : index;
+};
+var DEFAULT_INTERVAL_MS = 1440 * 60 * 1e3;
+var DEFAULT_STATEMENT_TIMEOUT_MS = 3e4;
+/** One line naming what the run found, at the right level to be noticed. */
+function summarize(result, warnAt) {
+	const counts = /* @__PURE__ */ new Map();
+	for (const finding of result.findings) counts.set(finding.severity, (counts.get(finding.severity) ?? 0) + 1);
+	const worst = result.findings.reduce((acc, f) => rank(f.severity) > rank(acc) ? f.severity : acc, "info");
+	if (result.findings.length === 0) return {
+		level: "info",
+		message: `RLS audit clean: ${result.stats.tables} table(s), ${result.stats.policies} polic(ies), ${result.stats.checksRun} check(s), no findings.`
+	};
+	const breakdown = [...SEVERITY_ORDER].reverse().filter((severity) => counts.get(severity)).map((severity) => `${counts.get(severity)} ${severity}`).join(", ");
+	const message = `RLS audit found ${result.findings.length} issue(s) — ${breakdown}. ${result.stats.tablesWithoutRls} table(s) without RLS. Read the detail at GET /api/admin/rls-audit, or run \`npx @rebasepro/rls-check\` for the full report.`;
+	return {
+		level: rank(worst) >= rank(warnAt) ? "warn" : "info",
+		message
+	};
+}
+/**
+* Create the audit. Nothing runs until {@link RlsAudit.start}.
+*
+* Because the scanner is supplied by the caller, the schedule, the summary and
+* the failure handling are all testable without a database and without
+* `@rebasepro/rls-check` present.
+*/
+function createRlsAudit(config) {
+	const enabled = config.enabled === true;
+	const intervalMs = config.intervalMs ?? DEFAULT_INTERVAL_MS;
+	const warnAt = config.warnAtSeverity ?? "high";
+	const connectionString = config.connectionString ?? process.env.DATABASE_URL;
+	let timer;
+	let status = { enabled };
+	if (enabled && !config.scan) status = {
+		enabled: false,
+		reason: "The scheduled RLS audit is enabled but no scanner was supplied. Pass `scan` from `@rebasepro/rls-check`: `rlsAudit: { enabled: true, scan }`."
+	};
+	else if (enabled && !connectionString) status = {
+		enabled: false,
+		reason: "The scheduled RLS audit is enabled but no connection string is available. Set DATABASE_URL, or pass `rlsAudit.connectionString`."
+	};
+	const runnable = enabled && !!connectionString && !!config.scan;
+	const run = async () => {
+		if (!runnable) return;
+		try {
+			const result = await config.scan({
+				connectionString,
+				schemas: config.schemas,
+				statementTimeoutMs: config.statementTimeoutMs ?? DEFAULT_STATEMENT_TIMEOUT_MS
+			});
+			const { level, message } = summarize(result, warnAt);
+			logger[level](`[rls-audit] ${message}`);
+			status = {
+				enabled: true,
+				lastRunAt: result.scannedAt,
+				result
+			};
+		} catch (err) {
+			const detail = err instanceof Error ? err.message : String(err);
+			logger.error(`[rls-audit] Scan failed: ${detail}`);
+			status = {
+				...status,
+				enabled: true,
+				lastRunAt: (/* @__PURE__ */ new Date()).toISOString(),
+				lastError: detail
+			};
+		}
+	};
+	return {
+		start() {
+			if (!runnable) {
+				if (status.reason) logger.warn(`[rls-audit] ${status.reason}`);
+				return;
+			}
+			if (timer) return;
+			timer = setInterval(() => {
+				run();
+			}, intervalMs);
+			timer.unref?.();
+			if (config.runOnBoot !== false) run();
+		},
+		stop() {
+			if (timer) clearInterval(timer);
+			timer = void 0;
+		},
+		runNow: run,
+		status: () => status
+	};
+}
+//#endregion
 //#region src/init/surfaces.ts
 /** Every surface, in a stable order. */
 var ALL_RUNTIME_SURFACES = [
@@ -4383,7 +4919,8 @@ function resolveSurfaces(options) {
 function resolveOwnership(options) {
 	return {
 		cronScheduler: options?.cronScheduler ?? true,
-		jobWorkers: options?.jobWorkers ?? true
+		jobWorkers: options?.jobWorkers ?? true,
+		rlsAudit: options?.rlsAudit ?? true
 	};
 }
 /** The surfaces a process is not serving, for a boot log line. */
@@ -10385,8 +10922,35 @@ function createHistoryRoutes(params) {
 * version or not — reads the same live client.
 */
 var INSTANCE_SLOT = Symbol.for("@rebasepro/server:singleton-instance");
+/**
+* A *function* that answers "which client is this call for", for hosts where
+* one answer per process is the wrong shape.
+*
+* A Node server boots once and serves every request from the same client, so
+* {@link INSTANCE_SLOT} is the whole story. An isolate-based host is different
+* in a way that matters: the environment arrives attached to the **request**,
+* not to the module, so there is nothing to publish at import time, and an
+* isolate can be reused across requests that must not share state. Such a host
+* registers a resolver — typically reading an `AsyncLocalStorage` populated per
+* request — and it is consulted first.
+*
+* This exists now, before there is a host that needs it, because of what it
+* protects: `rebase` is a lazy Proxy, so every property access already goes
+* through `getInstance()`. Backing that lookup with a resolver is therefore the
+* entire porting story for the singleton — **no function anyone has already
+* written changes**. Take the resolver away and the only alternative is asking
+* users to thread a client through their handlers, which is a rewrite of every
+* function file in existence.
+*/
+var RESOLVER_SLOT = Symbol.for("@rebasepro/server:singleton-resolver");
 function getInstance() {
-	return globalThis[INSTANCE_SLOT] ?? null;
+	const global = globalThis;
+	const resolver = global[RESOLVER_SLOT];
+	if (resolver) {
+		const resolved = resolver();
+		if (resolved) return resolved;
+	}
+	return global[INSTANCE_SLOT] ?? null;
 }
 function setInstance(client) {
 	globalThis[INSTANCE_SLOT] = client;
@@ -10403,7 +10967,7 @@ function _initRebase(client) {
 * Throws an error if used in a non-test environment to prevent production abuse.
 */
 function _setRebaseMock(mockInstance) {
-	if (process.env.NODE_ENV !== "test") throw new Error("_setRebaseMock can only be called in a test environment (NODE_ENV=test).");
+	if (hostEnv().NODE_ENV !== "test") throw new Error("_setRebaseMock can only be called in a test environment (NODE_ENV=test).");
 	setInstance({
 		...getInstance() || {},
 		...mockInstance
@@ -10413,7 +10977,7 @@ function _setRebaseMock(mockInstance) {
 * @internal Resets the singleton instance, useful for afterEach() in test suites.
 */
 function _resetRebaseMock() {
-	if (process.env.NODE_ENV !== "test") throw new Error("_resetRebaseMock can only be called in a test environment.");
+	if (hostEnv().NODE_ENV !== "test") throw new Error("_resetRebaseMock can only be called in a test environment.");
 	setInstance(null);
 }
 /**
@@ -10865,7 +11429,7 @@ async function _initializeRebaseBackend(config) {
 			]) {
 				const providerConfig = safeAuthConfig[key];
 				if (providerConfig && requiredFields.every((f) => Boolean(providerConfig[f]))) {
-					const createFn = (await import("./auth-5Et5mnUA.js").then((n) => n.t))[factory];
+					const createFn = (await import("./auth-B0IV-irB.js").then((n) => n.t))[factory];
 					oauthProviders.push(createFn(providerConfig));
 				}
 			}
@@ -10879,6 +11443,7 @@ async function _initializeRebaseBackend(config) {
 				disableSelfRegistration: safeAuthConfig.disableSelfRegistration ?? false,
 				allowAnonymous: safeAuthConfig.allowAnonymous ?? false,
 				allowUserLookup: safeAuthConfig.allowUserLookup ?? false,
+				captcha: safeAuthConfig.captcha,
 				defaultRole: safeAuthConfig.defaultRole,
 				oauthProviders,
 				allowedRedirectUris: safeAuthConfig.allowedRedirectUris,
@@ -10965,7 +11530,7 @@ async function _initializeRebaseBackend(config) {
 	let schemaEditorOff = schemaEditorUnavailable();
 	let schemaEditorRoutes;
 	if (!schemaEditorOff && config.collectionsDir) try {
-		schemaEditorRoutes = (await import("./schema-editor-routes-CV9k0w3G.js")).createSchemaEditorRoutes(config.collectionsDir);
+		schemaEditorRoutes = (await import("./schema-editor-routes-Cax2XTRj.js")).createSchemaEditorRoutes(config.collectionsDir);
 	} catch (err) {
 		if (err?.code === "ERR_MODULE_NOT_FOUND") {
 			schemaEditorOff = {
@@ -10998,8 +11563,12 @@ async function _initializeRebaseBackend(config) {
 	const storageAuthorizeData = {};
 	if (storageController) {
 		const storageMaxSize = (config.storage && typeof config.storage === "object" && "type" in config.storage ? config.storage.maxFileSize : void 0) ?? 50 * 1024 * 1024;
+		const storageAccessControl = resolveStorageAccessControl({
+			storagePolicies: config.storagePolicies,
+			storageAuthorize: config.storageAuthorize
+		});
 		assertStorageAccessControlConfigured({
-			hasAuthorize: !!config.storageAuthorize,
+			hasAuthorize: !!config.storageAuthorize || !!config.storagePolicies?.length,
 			publicRead: config.storagePublicRead === true,
 			allowAnyAuthenticated: config.storageInsecureAllowAnyAuthenticated === true
 		}, isProduction);
@@ -11010,7 +11579,7 @@ async function _initializeRebaseBackend(config) {
 			requireAuth: resolveRequireAuth(config.auth),
 			publicRead: config.storagePublicRead === true,
 			authAdapter,
-			authorize: config.storageAuthorize,
+			authorize: storageAccessControl,
 			authorizeData: () => storageAuthorizeData.current
 		});
 		const storageRouter = new Hono();
@@ -11147,9 +11716,9 @@ async function _initializeRebaseBackend(config) {
 		if (driver && "client" in driver) driver.client = serverClient;
 	}
 	if (config.functionsDir && surfaces.functions) {
-		const { loadFunctionsWithDiagnostics } = await import("./function-loader-DDS1v7YX.js").then((n) => n.t);
+		const { loadFunctionsWithDiagnostics } = await import("./function-loader-BrLmC_-y.js").then((n) => n.t);
 		const { createFunctionRoutes } = await import("./function-routes-Btcez1T-.js").then((n) => n.n);
-		const { createFunctionsRequestTimeout, resolveFunctionsTimeoutMs } = await import("./request-timeout-BuFoEKwT.js");
+		const { createFunctionsRequestTimeout, resolveFunctionsTimeoutMs } = await import("./request-timeout-OofPCHQT.js").then((n) => n.t);
 		const { functions: allFunctions, problems } = await loadFunctionsWithDiagnostics(config.functionsDir);
 		const { selectFunctions } = await import("./selection-_z6TM1DB.js").then((n) => n.n);
 		const loadedFunctions = selectFunctions(allFunctions, config.functionsSelection);
@@ -11190,7 +11759,7 @@ async function _initializeRebaseBackend(config) {
 		else logger.warn(`Function routes mounted at ${basePath}/functions, but no functions loaded from ${config.functionsDir}. ` + (problems.length > 0 ? `${problems.length} file(s) were skipped — see the messages above.` : "The directory holds no .ts/.js function files."));
 	}
 	if (config.functionsUpstream && !surfaces.functions) {
-		const { createFunctionsProxy } = await import("./proxy-Bj5DVllb.js");
+		const { createFunctionsProxy } = await import("./proxy-QJKSS-CV.js").then((n) => n.t);
 		config.app.route(`${basePath}/functions`, createFunctionsProxy({
 			upstream: config.functionsUpstream,
 			basePath: `${basePath}/functions`
@@ -11202,10 +11771,10 @@ async function _initializeRebaseBackend(config) {
 	}
 	let cronScheduler;
 	if (config.cronsDir && (surfaces.cron || ownership.cronScheduler)) {
-		const { loadCronJobsWithDiagnostics } = await import("./cron-loader-YhhQeVBM.js").then((n) => n.t);
-		const { CronScheduler } = await import("./cron-scheduler-DIpYBmZP.js").then((n) => n.n);
-		const { createCronRoutes } = await import("./cron-routes-maM_RlUu.js").then((n) => n.n);
-		const { createCronStore } = await import("./cron-store-DfH_4Cd9.js").then((n) => n.n);
+		const { loadCronJobsWithDiagnostics } = await import("./cron-loader-BMvtW6-J.js").then((n) => n.t);
+		const { CronScheduler } = await import("./cron-scheduler-Buf-uVam.js").then((n) => n.n);
+		const { createCronRoutes } = await import("./cron-routes-BvYk-Kmi.js").then((n) => n.n);
+		const { createCronStore } = await import("./cron-store-CpfttP4f.js").then((n) => n.n);
 		const { jobs: loadedCronJobs, problems: cronProblems } = await loadCronJobsWithDiagnostics(config.cronsDir);
 		cronScheduler = new CronScheduler();
 		cronScheduler.setClient(serverSingleton);
@@ -11235,7 +11804,7 @@ async function _initializeRebaseBackend(config) {
 	}
 	let jobQueue;
 	if (config.jobs?.enabled) {
-		const { createJobStore, createJobQueue } = await import("./jobs-CyOKXXlu.js").then((n) => n.t);
+		const { createJobStore, createJobQueue } = await import("./jobs-CSlBZ8dn.js").then((n) => n.t);
 		const store = createJobStore(defaultDriver);
 		if (store) {
 			await store.ensureTable();
@@ -11246,8 +11815,9 @@ async function _initializeRebaseBackend(config) {
 			} else logger.info("Job queue available for enqueue, workers NOT started in this process", { tasks: Object.keys(config.jobs.tasks ?? {}).length });
 		} else logger.warn("Job queue requested but unavailable on this driver — `rebase.jobs.enqueue` will throw, and webhook deliveries fall back to the in-memory queue.");
 	}
+	let rlsAudit;
 	if (surfaces.admin) {
-		const { createBackupRoutes, parseBackupDestination } = await import("./backup-C6ljYVTp.js").then((n) => n.t);
+		const { createBackupRoutes, parseBackupDestination } = await import("./backup-BJ86ah4T.js").then((n) => n.t);
 		const backupRouter = new Hono();
 		applyAdminGate(backupRouter, "Backup");
 		backupRouter.route("/", createBackupRoutes({
@@ -11260,6 +11830,16 @@ async function _initializeRebaseBackend(config) {
 		config.app.route(`${basePath}/admin/backups`, backupRouter);
 		logger.debug("Backup admin routes mounted", { path: `${basePath}/admin/backups` });
 	}
+	if (surfaces.admin) {
+		const rlsAuditRouter = new Hono();
+		applyAdminGate(rlsAuditRouter, "RLS audit");
+		rlsAuditRouter.get("/", (c) => c.json(rlsAudit ? rlsAudit.status() : {
+			enabled: false,
+			reason: config.rlsAudit?.enabled ? "This process serves the admin surface but does not own the RLS audit." : "The scheduled RLS audit is off. Set `rlsAudit.enabled` to turn it on."
+		}));
+		config.app.route(`${basePath}/admin/rls-audit`, rlsAuditRouter);
+		logger.debug("RLS audit admin routes mounted", { path: `${basePath}/admin/rls-audit` });
+	}
 	if (surfaces.admin) {
 		const { default: logsRoutes } = await import("./logs-routes-CWBLQj2l.js").then((n) => n.n);
 		const logsRouter = new Hono();
@@ -11269,7 +11849,7 @@ async function _initializeRebaseBackend(config) {
 		logger.debug("Logs routes mounted", { path: `${basePath}/logs` });
 	}
 	if (surfaces.meta) {
-		const { createContractRoutes } = await import("./contract-routes-DZ-LBpSL.js").then((n) => n.t);
+		const { createContractRoutes } = await import("./contract-routes-BEq7euZg.js").then((n) => n.t);
 		const contractRouter = new Hono();
 		if (adminSurfacesGated) {
 			if (apiKeyPreAuth) contractRouter.use("/contract", apiKeyPreAuth);
@@ -11298,10 +11878,15 @@ async function _initializeRebaseBackend(config) {
 	logger.debug("Rebase Backend Initialized");
 	const authSchemaCheck = authConfigResult?.schemaHealthCheck;
 	const healthCheck = createHealthCheck(defaultDriver, authSchemaCheck ? () => authSchemaCheck.call(authConfigResult) : void 0);
+	if (config.rlsAudit?.enabled && ownership.rlsAudit) {
+		rlsAudit = createRlsAudit(config.rlsAudit);
+		rlsAudit.start();
+	}
 	const shutdown = createShutdown({
 		server: config.server,
 		cronScheduler,
 		jobQueue,
+		rlsAudit,
 		realtimeServices
 	});
 	/**
@@ -11385,6 +11970,276 @@ function defineFunction(definition) {
 	return returned instanceof Hono ? returned : app;
 }
 //#endregion
+//#region src/functions/context.ts
+function read(c, key) {
+	return c.get(key);
+}
+/**
+* The authenticated caller, or `undefined` for an anonymous request.
+*
+* **`undefined` is not a permission decision.** The functions router mounts its
+* auth middleware with `requireAuth: false` on purpose — a webhook receiver has
+* no token to send — so an anonymous caller reaches the handler and reads
+* `undefined` here while the handler runs on regardless. Use {@link requireAuth}
+* (or a `!user` branch that returns 401) to make it a decision.
+*
+* A caller who presented a *bad* token never gets this far: both auth
+* middlewares reject an unverifiable token with 401 before the router is
+* reached, precisely so an expired session cannot be silently downgraded to an
+* anonymous one.
+*/
+function getUser(c) {
+	const raw = read(c, "user");
+	if (!raw || typeof raw !== "object") return void 0;
+	const record = raw;
+	const uid = typeof record.uid === "string" ? record.uid : typeof record.userId === "string" ? record.userId : void 0;
+	if (uid === void 0) return void 0;
+	const roles = Array.isArray(record.roles) ? record.roles.filter((role) => typeof role === "string") : [];
+	return {
+		...record,
+		uid,
+		roles
+	};
+}
+/** The caller's id, or `undefined` when nobody is signed in. */
+function getUserId(c) {
+	return getUser(c)?.uid;
+}
+/** The caller's roles. Empty for an anonymous request — never `undefined`. */
+function getRoles(c) {
+	return getUser(c)?.roles ?? [];
+}
+/**
+* Whether the caller holds **any** of the named roles.
+*
+* Any rather than all, because that is what a route guard means by a list of
+* roles; require several by calling this more than once.
+*/
+function hasRole(c, ...roles) {
+	if (roles.length === 0) return false;
+	const held = new Set(getRoles(c));
+	return roles.some((role) => held.has(role));
+}
+/**
+* Whether the caller holds an administrative role.
+*
+* Delegates to the single definition in `auth/admin-roles.ts` — which is
+* `admin` **or** `schema-admin` — rather than comparing against `"admin"`.
+* Those two lists disagreed once, and the gap made every public registrant an
+* administrator; see that file.
+*/
+function isAdmin(c) {
+	return hasAdministrativeRole(getRoles(c));
+}
+/** Whether the request carries an identity at all. */
+function isAuthenticated(c) {
+	return getUser(c) !== void 0;
+}
+/**
+* The request-scoped data driver: reads and writes run as **the caller**, with
+* your row-level security policies evaluated against their identity.
+*
+* This is the accessor to reach for when a function serves user-facing data.
+* `rebase.dataAsAdmin` is the other one, and it is not the same thing — it runs
+* as `{ uid: "service", roles: ["admin"] }` for every caller alike, which is
+* correct for trusted background work and wrong for a request.
+*
+* `undefined` only when no Rebase auth middleware ran (see
+* {@link identityResolved}); inside a function mounted by the framework it is
+* always present, anonymous requests included — they get an anon-scoped driver
+* so policies still have an identity to evaluate.
+*/
+function getDriver(c) {
+	return read(c, "driver");
+}
+/**
+* {@link getDriver}, but throws instead of handing back `undefined`.
+*
+* For the common case where a handler cannot proceed without it and would
+* otherwise write `c.get("driver")!` — an assertion that turns a wiring problem
+* into `Cannot read properties of undefined (reading 'fetchCollection')` twenty
+* lines away from the cause.
+*/
+function requireDriver(c) {
+	const driver = getDriver(c);
+	if (!driver) throw new Error("No request-scoped driver on this context. A Rebase auth middleware populates it before any custom function runs, so this means the handler was mounted outside the functions router — e.g. added to your own Hono app directly. Mount it from the functions directory, or use `rebase.dataAsAdmin` if the work is genuinely service-scoped.");
+	return driver;
+}
+/**
+* The API key this request authenticated with, masked, or `undefined` when it
+* did not use one.
+*
+* Useful for attribution and for per-key behaviour. The permission check itself
+* has already happened — reaching a handler means the key was allowed to.
+*/
+function getApiKey(c) {
+	return read(c, "apiKey");
+}
+/**
+* The correlation id for this request — generated, or taken from an inbound
+* `X-Request-ID`.
+*
+* Log it. It is the only thing that ties a line written inside a function to
+* the framework's own lines for the same request.
+*/
+function getRequestId(c) {
+	return read(c, "requestId");
+}
+/**
+* Whether a Rebase auth middleware has run on this request.
+*
+* Both middlewares populate `driver` for *every* outcome, anonymous included,
+* and populate `user` whenever there is one. So "neither is set" does not mean
+* "anonymous" — it means nothing resolved the identity, and treating that as
+* anonymous is the dangerous reading. The guards use this to tell a genuinely
+* anonymous caller (401) from a misconfigured mount (500), because answering
+* 401 to the second sends whoever is debugging it to look at the token.
+*/
+function identityResolved(c) {
+	return read(c, "user") !== void 0 || read(c, "driver") !== void 0;
+}
+//#endregion
+//#region src/functions/guards.ts
+/**
+* The answer to "a guard ran, but no middleware had resolved anything".
+*
+* Deliberately a 500 and not a 401. A 401 tells the caller their credential is
+* the problem, and here the caller's credential was never looked at — sending
+* them to check their token is sending them to the one place the answer is not.
+*/
+function unresolvedIdentity() {
+	return { error: {
+		message: "This route's identity was never resolved: no Rebase auth middleware ran before the guard. A function loaded from the functions directory always has one. This usually means the Hono app was mounted onto your own server directly, bypassing the functions router.",
+		code: "AUTH_MIDDLEWARE_MISSING"
+	} };
+}
+/**
+* Reject callers holding none of the named roles with 403.
+*
+* Any of them, not all — require several by chaining the guard twice. Naming no
+* role at all is a programming error and throws at module load rather than at
+* request time, because `requireRole()` with an empty list would otherwise read
+* as a guard while admitting everyone.
+*
+* @example
+* ```ts
+* app.post("/publish", requireAuth, requireRole("editor", "admin"), handler);
+* ```
+*/
+function requireRole(...roles) {
+	if (roles.length === 0) throw new Error("requireRole() needs at least one role. An empty list would admit every signed-in caller while reading as a restriction.");
+	const allowed = new Set(roles);
+	return async (c, next) => {
+		if (!getUser(c)) {
+			if (!identityResolved(c)) return c.json(unresolvedIdentity(), 500);
+			return c.json({ error: {
+				message: "Authentication required",
+				code: "UNAUTHORIZED"
+			} }, 401);
+		}
+		if (!getRoles(c).some((role) => allowed.has(role))) return c.json({ error: {
+			message: `This operation requires one of these roles: ${roles.join(", ")}`,
+			code: "FORBIDDEN"
+		} }, 403);
+		return next();
+	};
+}
+//#endregion
+//#region src/functions/runtime-env.ts
+/**
+* Every environment variable visible to this request.
+*
+* `c.env` on workerd, `Deno.env` on Deno, `process.env` on Node, Bun and
+* Vercel's edge runtime. Reading it through here rather than through `process`
+* is the whole of what makes a function's configuration portable.
+*/
+function getEnv(c) {
+	return env(c);
+}
+/**
+* One environment variable, or `undefined`.
+*
+* Trimmed, and a blank value counts as absent — declaring a variable and
+* leaving it empty is the ordinary way to write a compose file or a `.env`
+* line, and nobody has ever meant `""` by it.
+*/
+function env$1(c, name) {
+	const raw = getEnv(c)[name];
+	if (typeof raw !== "string") return void 0;
+	const trimmed = raw.trim();
+	return trimmed === "" ? void 0 : trimmed;
+}
+/**
+* One environment variable, or a thrown error naming it.
+*
+* For configuration a handler cannot run without. Throwing here — inside the
+* request — is deliberately better than the module-scope `process.env.KEY!`
+* it replaces: that one takes the whole *file* down at load time, and the
+* loader reports it as "this function could not be imported", which names the
+* file but not the variable. This fails one request, with the name in the
+* message, while every other route in the file keeps serving.
+*/
+function requireEnv(c, name) {
+	const value = env$1(c, name);
+	if (value === void 0) throw new Error(`Missing required environment variable ${name}. Set it on the process (or as a binding, on a host that has them) — and read it inside the handler, not at module scope, so the same file works on both.`);
+	return value;
+}
+/**
+* Which host this is: `"node"`, `"workerd"`, `"deno"`, `"bun"`, `"edge-light"`,
+* `"fastly"` or `"other"`.
+*
+* Use it to *degrade*, not to branch a whole implementation — a function that
+* needs two implementations is two functions. It is honest about one thing in
+* particular: a Node-only capability, such as `rebase.sql()`, can check this
+* and say so, instead of failing at the call.
+*/
+function runtimeKey() {
+	return getRuntimeKey();
+}
+/** Whether this is a Node-like host — Node itself, or Bun's Node compatibility. */
+function isNodeRuntime() {
+	const key = getRuntimeKey();
+	return key === "node" || key === "bun";
+}
+/**
+* Build something expensive once per environment, on first use, from inside a
+* request.
+*
+* This is the sanctioned replacement for the module-scope client:
+*
+* ```ts
+* // Don't: runs at import time, before bindings exist on some hosts.
+* const stripe = new Stripe(process.env.STRIPE_SECRET_KEY!);
+*
+* // Do: runs on first request, reads that request's configuration.
+* const stripe = lazyResource(env => new Stripe(env.STRIPE_SECRET_KEY!));
+* app.post("/", async (c) => { await stripe(c).charges.list(); });
+* ```
+*
+* The factory runs once per distinct environment object and the result is
+* cached against it. On Node that is once per process, because `process.env` is
+* one object for the life of the process — identical to the module-scope
+* version in cost, and unlike it, deferred until configuration exists. On a
+* host that hands each request a fresh binding object it is once per object,
+* which is the only correct answer there: caching across bindings would serve
+* one tenant's client to another.
+*
+* A {@link WeakMap} holds the cache, so an environment object the host has
+* finished with takes the resource with it.
+*/
+function lazyResource(factory) {
+	const cache = /* @__PURE__ */ new WeakMap();
+	return (c) => {
+		const bindings = getEnv(c);
+		if (!bindings || typeof bindings !== "object") return factory(bindings ?? {});
+		const existing = cache.get(bindings);
+		if (existing !== void 0) return existing;
+		const created = factory(bindings);
+		cache.set(bindings, created);
+		return created;
+	};
+}
+//#endregion
 //#region src/cron/define-cron.ts
 /**
 * Typed authoring helper for a cron job file. Identity at runtime —
@@ -11469,6 +12324,130 @@ var authJwt = () => {
 	return sql.raw(RLS_JWT_SQL);
 };
 //#endregion
+//#region src/dev-secrets.ts
+/**
+* Development secrets that survive a restart.
+*
+* `loadEnv` generates `JWT_SECRET` and `REBASE_SERVICE_KEY` when they are unset
+* outside production, so a developer can start without setting anything up. It
+* generated them **freshly on every boot**, which meant every restart of the dev
+* server silently invalidated the previous run's tokens: you were logged out of
+* your own app because you edited a file, and the API key you had just made
+* stopped working.
+*
+* The CLI already worked around it for scaffolded projects by writing a stable
+* `JWT_SECRET` into `.env` at `rebase init` — the comment there says exactly
+* why. That leaves anyone who did not scaffold, and anyone running from a
+* container with no `.env`, with the logout-on-restart behaviour.
+*
+* So the generated values are cached in a file beside the other dev-state
+* files — `.rebase-dev-port` and `.rebase-dev-url` follow the same convention
+* and are gitignored in the same place.
+*
+* ## What this does not change
+*
+* Production. `loadEnv` refuses to start when a secret was auto-generated and
+* `NODE_ENV=production`, and that is untouched: this only makes the
+* already-generated development values stable. There is no path by which a
+* cached secret becomes a production one.
+*
+* ## Failing soft
+*
+* A read-only filesystem, a container without a writable working directory, a
+* permissions problem — none of these should stop a development server from
+* starting. Every failure here falls back to the previous behaviour, an
+* ephemeral secret, and says so once at debug level.
+*/
+/** Beside `.rebase-dev-port` and `.rebase-dev-url`, and gitignored with them. */
+var DEV_SECRETS_FILENAME = ".rebase-dev-secrets.json";
+/** Owner read/write only. These are secrets, even development ones. */
+var FILE_MODE = 384;
+/** Whether these environment variables describe a test runner. */
+function detectTestRunner(env) {
+	return Boolean(env.JEST_WORKER_ID || env.VITEST || env.VITEST_WORKER_ID || env.NODE_ENV === "test");
+}
+/**
+* Whether a test runner started this process, decided **once at import**.
+*
+* Read at call time it would be wrong, and provably so: `env.test.ts` does
+* `process.env = {}` in its `beforeEach`, which erases `NODE_ENV` and
+* `JEST_WORKER_ID` alike. A predicate consulting the live environment therefore
+* sees a bare object and concludes "development", which is how the first version
+* of this dropped a `.rebase-dev-secrets.json` into `packages/server` on every
+* test run.
+*
+* Whether a test runner is hosting the process is a fact about the process, not
+* about whatever a test has since done to `process.env`, so it is captured
+* before any test can rewrite it.
+*/
+var TEST_RUNNER_DETECTED = detectTestRunner(process.env);
+/**
+* Whether generated secrets should be cached at all.
+*
+* Not in production — `loadEnv` refuses to boot there on a generated secret, so
+* there is nothing to cache and no path by which a cached one becomes a
+* production one.
+*
+* Not under a test runner: a test must not inherit a secret a previous run left
+* behind, and a library call has no business writing into a suite's working
+* directory. `inTestRunner` is a parameter only so this predicate can be tested
+* on its own; callers pass nothing.
+*/
+function shouldCacheDevSecrets(env = process.env, inTestRunner = TEST_RUNNER_DETECTED) {
+	if (inTestRunner) return false;
+	return env.NODE_ENV !== "production";
+}
+/** `REBASE_DEV_SECRETS_FILE`, or the conventional name in the working directory. */
+function resolveDevSecretsFile(env = process.env) {
+	const override = env.REBASE_DEV_SECRETS_FILE?.trim();
+	if (override) return path$2.resolve(override);
+	return path$2.join(process.cwd(), DEV_SECRETS_FILENAME);
+}
+/**
+* Open the cache.
+*
+* Reading a malformed file is treated as an empty cache rather than an error:
+* the file is ours, it holds regenerable values, and refusing to boot over a
+* corrupted convenience cache would be worse than rewriting it.
+*/
+function openDevSecretStore(file = resolveDevSecretsFile()) {
+	let cache = {};
+	let usable = true;
+	try {
+		if (fs$2.existsSync(file)) {
+			const parsed = JSON.parse(fs$2.readFileSync(file, "utf-8"));
+			if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+				for (const [key, value] of Object.entries(parsed)) if (typeof value === "string" && value.length > 0) cache[key] = value;
+			}
+		}
+	} catch {
+		cache = {};
+	}
+	const flush = () => {
+		try {
+			fs$2.mkdirSync(path$2.dirname(file), { recursive: true });
+			fs$2.writeFileSync(file, `${JSON.stringify(cache, null, 2)}\n`, { mode: FILE_MODE });
+			fs$2.chmodSync(file, FILE_MODE);
+		} catch (err) {
+			if (usable) {
+				usable = false;
+				logger.debug(`[dev-secrets] Could not write ${file}, so generated development secrets will not survive a restart: ${err instanceof Error ? err.message : String(err)}`);
+			}
+		}
+	};
+	return {
+		file,
+		get usable() {
+			return usable;
+		},
+		get: (name) => cache[name],
+		set: (name, value) => {
+			cache[name] = value;
+			flush();
+		}
+	};
+}
+//#endregion
 //#region src/env.ts
 /**
 * Generate a cryptographically secure random secret (hex-encoded).
@@ -11586,14 +12565,24 @@ function loadEnv(options) {
 	const isProduction = process.env.NODE_ENV === "production";
 	const autoGeneratedSecrets = [];
 	if (!isProduction) {
-		if (!process.env.JWT_SECRET) {
-			process.env.JWT_SECRET = generateSecret();
-			autoGeneratedSecrets.push("JWT_SECRET");
-		}
-		if (!process.env.REBASE_SERVICE_KEY) {
-			process.env.REBASE_SERVICE_KEY = generateSecret();
-			autoGeneratedSecrets.push("REBASE_SERVICE_KEY");
-		}
+		const devSecrets = shouldCacheDevSecrets() ? openDevSecretStore() : void 0;
+		const reused = [];
+		const ensure = (name) => {
+			if (process.env[name]) return;
+			const cached = devSecrets?.get(name);
+			if (cached) {
+				process.env[name] = cached;
+				reused.push(name);
+			} else {
+				const generated = generateSecret();
+				process.env[name] = generated;
+				devSecrets?.set(name, generated);
+			}
+			autoGeneratedSecrets.push(name);
+		};
+		ensure("JWT_SECRET");
+		ensure("REBASE_SERVICE_KEY");
+		if (autoGeneratedSecrets.length > 0 && reused.length !== autoGeneratedSecrets.length && devSecrets?.usable) logger.info(`Generated development ${autoGeneratedSecrets.length > 1 ? "secrets" : "secret"} (${autoGeneratedSecrets.join(", ")}) and cached them in ${DEV_SECRETS_FILENAME} so a restart does not log you out. Set them explicitly for anything that is not a development machine.`);
 	}
 	const env = (options?.extend ? rebaseEnvSchema.merge(options.extend) : rebaseEnvSchema).superRefine((data, ctx) => {
 		const d = data;
@@ -12774,6 +13763,18 @@ var bootEnvExtension = object({
 		"false",
 		""
 	]).default("false").transform((v) => v === "true"),
+	/**
+	* Bot protection. Enabled by setting both — a provider without a secret
+	* cannot verify anything, and is refused at boot rather than ignored.
+	*/
+	CAPTCHA_PROVIDER: _enum([
+		"turnstile",
+		"hcaptcha",
+		""
+	]).optional(),
+	CAPTCHA_SECRET: string().optional(),
+	/** Comma-separated: register, login, forgotPassword, magicLink. */
+	CAPTCHA_ROUTES: string().optional(),
 	AUTH_COOKIE_SAME_SITE: _enum([
 		"Strict",
 		"Lax",
@@ -12874,6 +13875,19 @@ var bootEnvExtension = object({
 		""
 	]).optional().transform((v) => v === void 0 || v === "" ? void 0 : v === "true"),
 	/**
+	* Override whether this process runs the scheduled RLS audit. Unset follows
+	* the role.
+	*
+	* Unlike cron and the job workers this is not claim-protected — every owner
+	* scans on its own timer, which is redundant rather than unsafe — so a split
+	* deployment sets it false everywhere but one process.
+	*/
+	REBASE_RLS_AUDIT: _enum([
+		"true",
+		"false",
+		""
+	]).optional().transform((v) => v === void 0 || v === "" ? void 0 : v === "true"),
+	/**
 	* Comma-separated function names this process serves. Unset means all.
 	*
 	* `functions` role only. A name that is not in the bundle is a boot failure,
@@ -13023,7 +14037,8 @@ var ROLES = {
 		},
 		ownership: {
 			cronScheduler: false,
-			jobWorkers: false
+			jobWorkers: false,
+			rlsAudit: false
 		},
 		provisionSchema: false
 	},
@@ -13067,6 +14082,7 @@ function resolveRole(env) {
 	const ownership = { ...base.ownership };
 	if (env.REBASE_CRON_SCHEDULER !== void 0) ownership.cronScheduler = env.REBASE_CRON_SCHEDULER;
 	if (env.REBASE_JOB_WORKERS !== void 0) ownership.jobWorkers = env.REBASE_JOB_WORKERS;
+	if (env.REBASE_RLS_AUDIT !== void 0) ownership.rlsAudit = env.REBASE_RLS_AUDIT;
 	return {
 		role,
 		surfaces: { ...base.surfaces },
@@ -13504,13 +14520,51 @@ async function initializeDataSources(sources, schema, resolveFrom = []) {
 //#endregion
 //#region src/boot/options.ts
 /**
-* Build the email configuration, or `undefined` when no SMTP host is set.
+* True when an emailed link would be followable — i.e. when there is an
+* absolute base to build one from. Mirrors `assertEmailLinkBases`, which
+* refuses the boot otherwise.
+*/
+function hasAbsoluteLinkBase(value) {
+	if (!value) return false;
+	try {
+		const url = new URL(value);
+		return url.protocol === "http:" || url.protocol === "https:";
+	} catch {
+		return false;
+	}
+}
+/**
+* Build the email configuration.
+*
+* With `SMTP_HOST`, that is a real SMTP transport. Without it, outside
+* production, it is the development sink: mail is captured and its links are
+* printed, so `POST /auth/magic-link` and `POST /auth/forgot-password` complete
+* on a fresh project instead of answering `503 EMAIL_NOT_CONFIGURED`. The token
+* was always minted and valid; only delivery was missing.
+*
+* Three conditions, all required, none configurable:
+*
+*  - no `SMTP_HOST` — a configured mail server always wins;
+*  - `NODE_ENV` is not `production` — a captured reset mail carries a working
+*    token, so this must not be reachable there (see `dev-sink.ts`);
+*  - an absolute `FRONTEND_URL`, or the emailed link has no base and is dead on
+*    arrival — which is the condition `assertEmailLinkBases` fails the boot on.
 *
-* Without it the auth adapter still works; password-reset and verification mail
-* simply has nowhere to go, which the auth routes report for themselves.
+* When any of those does not hold this returns `undefined`, exactly as before,
+* and the auth routes report the missing service for themselves.
 */
 function resolveEmailOptions(env) {
-	if (!env.SMTP_HOST) return void 0;
+	if (!env.SMTP_HOST) {
+		if (env.NODE_ENV === "production") return void 0;
+		if (!hasAbsoluteLinkBase(env.FRONTEND_URL)) return void 0;
+		return {
+			from: env.SMTP_FROM || `${env.APP_NAME} <noreply@rebase.pro>`,
+			sendEmail: createDevEmailSink().sendEmail,
+			appName: env.APP_NAME,
+			logoUrl: env.EMAIL_LOGO_URL,
+			resetPasswordUrl: env.FRONTEND_URL
+		};
+	}
 	return {
 		from: env.SMTP_FROM || `${env.APP_NAME} <noreply@rebase.pro>`,
 		smtp: {
@@ -13529,6 +14583,24 @@ function resolveEmailOptions(env) {
 	};
 }
 /**
+* Bot protection from the environment, or `undefined` when it is not configured.
+*
+* Both halves are required together. A provider with no secret cannot verify
+* anything, so it is left off here and `resolveCaptchaVerifier` refuses the boot
+* if something else turns it on — the one failure this feature must not have is
+* being silently absent while the config says otherwise.
+*/
+function resolveCaptchaOptions(env) {
+	if (!env.CAPTCHA_PROVIDER || !env.CAPTCHA_SECRET) return void 0;
+	const routes = env.CAPTCHA_ROUTES?.split(",").map((part) => part.trim()).filter(Boolean);
+	return {
+		enabled: true,
+		provider: env.CAPTCHA_PROVIDER,
+		secret: env.CAPTCHA_SECRET,
+		...routes?.length ? { routes } : {}
+	};
+}
+/**
 * Build the auth configuration from the environment and the bundle's users
 * collection.
 *
@@ -13552,6 +14624,7 @@ function resolveAuthOptions(env, usersCollection) {
 		disableSelfRegistration: env.DISABLE_SELF_REGISTRATION,
 		allowAnonymous: env.ALLOW_ANONYMOUS,
 		allowUserLookup: env.AUTH_ALLOW_USER_LOOKUP,
+		captcha: resolveCaptchaOptions(env),
 		email: resolveEmailOptions(env),
 		cookieAuth: { sameSite: env.AUTH_COOKIE_SAME_SITE || "Lax" }
 	};
@@ -14322,6 +15395,6 @@ function warnOnUnusableBundleShape(bundle) {
 	logger.warn(`This bundle declares a config package at "${bundle.manifest.entry.config}", but no collections directory resolved inside it, so no collections were loaded and no tables will be created. Rebuild with \`rebase build\` and check the manifest's \`entry.collections\`.`);
 }
 //#endregion
-export { ApiError, BlockedUrlError, BundleError, CONCURRENT_DDL_SQLSTATES, CronScheduler, DEFAULT_DRIVER_ID, DEFAULT_MAX_FILE_SIZE, DEFAULT_STORAGE_ID, DOCUMENT_MIME_TYPES, DefaultDriverRegistry, DefaultStorageRegistry, GCSStorageController, IMAGE_MIME_TYPES, LocalStorageController, MetricsRegistry, RawHtml, S3StorageController, SMTPEmailService, TransformCache, TusHandler, UnknownStorageSourceError, WEBHOOK_DELIVERY_TASK, WebhookDispatcher, _resetRebaseMock, _setRebaseMock, applyCollectionDefaults, assertAllowedOutboundUrl, assertCollectionConfigs, assertDistinctSuffixes, assertEmailLinkBases, assertWriteRequestValid, authJwt, authRoles, authUid, blockedAddressReason, bootFromBundle, classifySurface, cleanupDevPortFile, createAppleProvider, createBackupRoutes, createBitbucketProvider, createBuiltinAuthAdapter, createContractRoutes, createCronRoutes, createCronStore, createCustomAuthAdapter, createDdlBootstrapper, createDiscordProvider, createEmailService, createFacebookProvider, createFunctionRoutes, createGitHubProvider, createGitLabProvider, createGoogleProvider, createHistoryRoutes, createJobQueue, createJobStore, createJwksRoutes, createLinkedinProvider, createMetricsMiddleware, createMetricsRoutes, createMicrosoftProvider, createSlackProvider, createSourceBundle, createSpotifyProvider, createStorageController, createStorageRoutes, createTwitterProvider, defaultBackoff, defineCron, defineFunction, envSuffixForKey, errorHandler, escapeHtml, extractUserFromToken, fileTokenAuth, findCollectionConfigProblems, generateSecurePassword, getEmailVerificationTemplate, getJwks, getMagicLinkTemplate, getPasswordResetTemplate, getUserInvitationTemplate, getWelcomeEmailTemplate, hasAsymmetricSigningKey, hashPassword, html, httpMethodToOperation, initializeDataSource, initializeDataSources, initializeRebaseBackend, installShutdownHandlers, isApiKeyToken, isAuthAdapter, isConcurrentDdlRace, isDatabaseAdapter, isDuplicateObjectRace, isLocalhostOrigin, isOperationAllowed, isTransformableImage, listBackupObjects, listenWithPortRetry, loadBootEnv, loadBundle, loadBundleConfigExports, loadBundleSchema, loadCollectionsFromDirectory, loadCronJobsFromDirectory, loadCronJobsWithDiagnostics, loadDeclaredStorageSources, loadEnv, loadFunctionsFromDirectory, loadUsersCollection, logger, oauthCodeFlowSchema, optionalAuth, parseBackupDestination, parseBackupTimestamp, parseTransformOptions, pkceTokenParams, providerVerifiedEmail, queryTokenAuth, raw, readBackupBytes, readBundleManifest, rebase, requireAdmin, requireAuth, resolveAuthHooks, resolveAuthOptions, resolveCorsOrigin, resolveDataSources, resolveEmailBranding, resolveEmailLinkBase, resolveEmailOptions, resolveRequireAuth, resolveStorageBackend, resolveStorageSources, runFromBundle, safeCompare, serveSPA, transformImage, tryVerifyOidcIdToken, unknownKeyPolicyFromEnv, validateApiKey, validateCronExpression, validatePasswordStrength, verifyOidcIdToken, verifyPassword };
+export { ApiError, BlockedUrlError, BundleError, CONCURRENT_DDL_SQLSTATES, CronScheduler, DEFAULT_DRIVER_ID, DEFAULT_MAX_FILE_SIZE, DEFAULT_STORAGE_ID, DOCUMENT_MIME_TYPES, DefaultDriverRegistry, DefaultStorageRegistry, GCSStorageController, IMAGE_MIME_TYPES, LocalStorageController, MetricsRegistry, RawHtml, S3StorageController, SMTPEmailService, StoragePolicyError, TransformCache, TusHandler, UnknownStorageSourceError, WEBHOOK_DELIVERY_TASK, WebhookDispatcher, _resetRebaseMock, _setRebaseMock, applyCollectionDefaults, assertAllowedOutboundUrl, assertCollectionConfigs, assertDistinctSuffixes, assertEmailLinkBases, assertWriteRequestValid, authJwt, authRoles, authUid, blockedAddressReason, bootFromBundle, classifySurface, cleanupDevPortFile, compileStoragePolicies, createAppleProvider, createBackupRoutes, createBitbucketProvider, createBuiltinAuthAdapter, createContractRoutes, createCronRoutes, createCronStore, createCustomAuthAdapter, createDdlBootstrapper, createDevEmailSink, createDiscordProvider, createEmailService, createFacebookProvider, createFunctionRoutes, createGitHubProvider, createGitLabProvider, createGoogleProvider, createHistoryRoutes, createJobQueue, createJobStore, createJwksRoutes, createLinkedinProvider, createMetricsMiddleware, createMetricsRoutes, createMicrosoftProvider, createRlsAudit, createSlackProvider, createSourceBundle, createSpotifyProvider, createStorageController, createStorageRoutes, createTwitterProvider, defaultBackoff, defineCron, defineFunction, drainBackgroundWork, envSuffixForKey, errorHandler, escapeHtml, extractLinks, extractUserFromToken, fileTokenAuth, findCollectionConfigProblems, generateSecurePassword, getApiKey, getDriver, getEmailVerificationTemplate, getEnv, getJwks, getMagicLinkTemplate, getPasswordResetTemplate, getRequestId, getRoles, getUser, getUserId, getUserInvitationTemplate, getWelcomeEmailTemplate, hasAsymmetricSigningKey, hasRole, hashPassword, html, httpMethodToOperation, identityResolved, initializeDataSource, initializeDataSources, initializeRebaseBackend, installShutdownHandlers, isAdmin, isApiKeyToken, isAuthAdapter, isAuthenticated, isConcurrentDdlRace, isDatabaseAdapter, isDuplicateObjectRace, isLocalhostOrigin, isNodeRuntime, isOperationAllowed, isTransformableImage, lazyResource, listBackupObjects, listenWithPortRetry, loadBootEnv, loadBundle, loadBundleConfigExports, loadBundleSchema, loadCollectionsFromDirectory, loadCronJobsFromDirectory, loadCronJobsWithDiagnostics, loadDeclaredStorageSources, loadEnv, loadFunctionsFromDirectory, loadFunctionsWithDiagnostics, loadUsersCollection, logger, oauthCodeFlowSchema, optionalAuth, parseBackupDestination, parseBackupTimestamp, parseTransformOptions, pendingBackgroundWork, pkceTokenParams, providerVerifiedEmail, queryTokenAuth, raw, readBackupBytes, readBundleManifest, rebase, requireAdmin, requireAuth, requireDriver, requireEnv, requireRole, resolveAuthHooks, resolveAuthOptions, resolveCorsOrigin, resolveDataSources, resolveEmailBranding, resolveEmailLinkBase, resolveEmailOptions, resolveRequireAuth, resolveStorageAccessControl, resolveStorageBackend, resolveStorageSources, runFromBundle, runtimeKey, safeCompare, serveSPA, summarize as summarizeRlsScan, transformImage, tryVerifyOidcIdToken, unknownKeyPolicyFromEnv, validateApiKey, validateCronExpression, validatePasswordStrength, verifyOidcIdToken, verifyPassword, waitUntil };
 
 //# sourceMappingURL=index.es.js.map