@rebasepro/server 0.16.1-canary.gef08a6e → 0.17.0

package/dist/index.es.js

@@ -4,11 +4,11 @@ globalThis.process ??= __rebaseProcess;
 __rebaseCreateRequire(import.meta.url);
 import { A as GeoPoint, M as RebaseApiError, N as RebaseClientError, O as EntityReference, S as toSnakeCase, _ as fieldKeyForColumn, b as buildCompositeId, c as collectAllPages, d as normalizeOrderBy, f as serializeOrderBy, g as getEffectiveSecurityRules, h as resolveDataSource, j as Vector, k as EntityRelation, l as paginateFind, m as createDataSourceRegistry, n as buildSdkData, o as serializeFilter, p as CollectionRegistry, s as serializeLogicalCondition, t as buildRoutedRebaseData, u as resolveFindWindow, v as findRelation, x as resolvePrimaryKeys, y as resolveCollectionRelations } from "./src-B-CmIFMr.js";
 import { a as RLS_JWT_SQL, b as toCanonicalOp, c as getCollectionDataPath, f as DEFAULT_DATA_SOURCE_KEY, i as buildResourceGraph, n as setTopicRuntime, o as RLS_ROLES_SQL, s as RLS_UID_SQL, t as declaredSubscriptions, u as isPostgresCollectionConfig, v as parseRelationAggregateSort } from "./src-Cdsw7DqV.js";
-import { n as ADMIN_PROPERTY_KEYS, t as ADMIN_COLLECTION_KEYS } from "./admin_block-BeypnEfb.js";
+import { n as ADMIN_PROPERTY_KEYS, t as ADMIN_COLLECTION_KEYS } from "./admin_block-BX6YULvJ.js";
 import { a as isDuplicateObjectRace, i as isConcurrentDdlRace, n as createDdlBootstrapper, o as isSQLAdmin, s as isSchemaEditingAdmin, t as CONCURRENT_DDL_SQLSTATES } from "./ddl-bootstrap-5YZCZ8qk.js";
-import { C as canonicalStorageKey, D as findStorageSuffixCollision, E as DEFAULT_STORAGE_SOURCE_KEY, O as normalizeStorageSources, S as canonicalStorageId, b as InvalidStorageKeyError, c as getJwks, d as hasAsymmetricSigningKey, i as generateDownloadToken, k as storageEnvSuffix, n as configureJwt, p as isJwtConfigured, v as normalizePemFromEnv, x as canonicalStorageBucket, y as InvalidStorageBucketError } from "./jwt-DoHkMMWF.js";
+import { A as findStorageSuffixCollision, C as canonicalStorageKey, M as storageEnvSuffix, O as sha256Hex, S as canonicalStorageId, b as InvalidStorageKeyError, c as getJwks, d as hasAsymmetricSigningKey, i as generateDownloadToken, j as normalizeStorageSources, k as DEFAULT_STORAGE_SOURCE_KEY, n as configureJwt, p as isJwtConfigured, v as normalizePemFromEnv, x as canonicalStorageBucket, y as InvalidStorageBucketError } from "./jwt-5VN4C6ln.js";
 import { n as createContractRoutes, r as computeSchemaVersion } from "./contract-routes-D8TvxPLo.js";
-import { $ as html, A as activeDevEmailSink, B as hashPassword, C as providerVerifiedEmail, Ct as PUBLIC_STORAGE_PREFIX, D as createDataRateLimiter, E as DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT, F as SMTPEmailService, G as getEmailVerificationTemplate, H as verifyPassword, I as createEmailService, J as getUserInvitationTemplate, K as getMagicLinkTemplate, L as assertEmailLinkBases, M as createDevEmailSink, N as extractLinks, O as defaultAuthLimiter, P as registerDevEmailSink, Q as escapeHtml, R as resolveEmailLinkBase, S as pkceTokenParams, St as isOperationAllowed, T as createBuiltinAuthAdapter, U as generateSecurePassword, V as validatePasswordStrength, W as getEmailOtpTemplate, X as resolveEmailBranding, Y as getWelcomeEmailTemplate, Z as RawHtml, _ as verifyOidcIdToken, _t as safeCompare, a as resolveRateLimitStoreKind, at as fileTokenAuth, b as createGoogleProvider, bt as hasAdministrativeRole, c as createSlackProvider, ct as queryTokenAuth, d as createDiscordProvider, dt as createApiKeyPreAuth, et as raw, f as createTwitterProvider, ft as createFunctionApiKeyGuard, g as tryVerifyOidcIdToken, gt as extractBearerToken, h as createMicrosoftProvider, ht as validateApiKey, i as createApiKeyStore, it as extractUserFromToken, j as clearActiveDevEmailSink, k as MemoryRateLimitStore, l as createBitbucketProvider, lt as requireAdmin, m as createAppleProvider, mt as isApiKeyToken, n as createCustomAuthAdapter, nt as createAuthMiddleware, o as createSqlRateLimitStore, ot as optionalAuth, p as createFacebookProvider, pt as createStorageApiKeyGuard, q as getPasswordResetTemplate, r as createApiKeyRoutes, rt as createRequireAuth, s as createSpotifyProvider, st as publicObjectAuth, tt as createAdapterAuthMiddleware, u as createGitLabProvider, ut as requireAuth, v as createGitHubProvider, vt as SERVICE_IDENTITY, w as createJwksRoutes, wt as isPublicStoragePath, x as oauthCodeFlowSchema, xt as httpMethodToOperation, y as createLinkedinProvider, yt as scopeDataDriver, z as resolveAuthHooks } from "./auth-DU-nUjPp.js";
+import { $ as html, A as activeDevEmailSink, B as hashPassword, C as providerVerifiedEmail, Ct as PUBLIC_STORAGE_PREFIX, D as createDataRateLimiter, E as DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT, F as SMTPEmailService, G as getEmailVerificationTemplate, H as verifyPassword, I as createEmailService, J as getUserInvitationTemplate, K as getMagicLinkTemplate, L as assertEmailLinkBases, M as createDevEmailSink, N as extractLinks, O as defaultAuthLimiter, P as registerDevEmailSink, Q as escapeHtml, R as resolveEmailLinkBase, S as pkceTokenParams, St as isOperationAllowed, T as createBuiltinAuthAdapter, U as generateSecurePassword, V as validatePasswordStrength, W as getEmailOtpTemplate, X as resolveEmailBranding, Y as getWelcomeEmailTemplate, Z as RawHtml, _ as verifyOidcIdToken, _t as safeCompare, a as resolveRateLimitStoreKind, at as fileTokenAuth, b as createGoogleProvider, bt as hasAdministrativeRole, c as createSlackProvider, ct as queryTokenAuth, d as createDiscordProvider, dt as createApiKeyPreAuth, et as raw, f as createTwitterProvider, ft as createFunctionApiKeyGuard, g as tryVerifyOidcIdToken, gt as extractBearerToken, h as createMicrosoftProvider, ht as validateApiKey, i as createApiKeyStore, it as extractUserFromToken, j as clearActiveDevEmailSink, k as MemoryRateLimitStore, l as createBitbucketProvider, lt as requireAdmin, m as createAppleProvider, mt as isApiKeyToken, n as createCustomAuthAdapter, nt as createAuthMiddleware, o as createSqlRateLimitStore, ot as optionalAuth, p as createFacebookProvider, pt as createStorageApiKeyGuard, q as getPasswordResetTemplate, r as createApiKeyRoutes, rt as createRequireAuth, s as createSpotifyProvider, st as publicObjectAuth, tt as createAdapterAuthMiddleware, u as createGitLabProvider, ut as requireAuth, v as createGitHubProvider, vt as SERVICE_IDENTITY, w as createJwksRoutes, wt as isPublicStoragePath, x as oauthCodeFlowSchema, xt as httpMethodToOperation, y as createLinkedinProvider, yt as scopeDataDriver, z as resolveAuthHooks } from "./auth-BVPx33qB.js";
 import { t as revokeInternalTableSql } from "./internal-tables-DpxfPaEB.js";
 import { r as hostEnv, t as logger } from "./logger-DS03e908.js";
 import { n as errorHandler, t as ApiError } from "./errors-DBwpj9N8.js";
@@ -30,7 +30,7 @@ import { t as createCronStore } from "./cron-store-CbFfQhbg.js";
 import { a as parseBackupTimestamp, i as parseBackupDestination, n as createBackupRoutes, o as readBackupBytes, r as listBackupObjects } from "./backup-CRdZkA6c.js";
 import { i as createJobStore, n as createJobQueue, r as defaultBackoff } from "./jobs-B2ELModo.js";
 import { t as METRIC_SERIES } from "./history-store-oiqhb3HU.js";
-import { createHash, createSign, randomBytes, randomUUID } from "node:crypto";
+import { createHash, createSign, randomBytes } from "node:crypto";
 import * as fs$3 from "fs";
 import fs, { existsSync } from "fs";
 import * as path$3 from "path";
@@ -39,9 +39,7 @@ import { pathToFileURL } from "url";
 import { Hono } from "hono";
 import { promisify } from "util";
 import * as crypto$1 from "crypto";
-import { createHmac, randomUUID as randomUUID$1 } from "crypto";
-import * as path$2 from "node:path";
-import path$1 from "node:path";
+import { createHmac, randomUUID } from "crypto";
 import { bodyLimit } from "hono/body-limit";
 import { csrf } from "hono/csrf";
 import { compress } from "hono/compress";
@@ -50,12 +48,12 @@ import * as fs$2 from "node:fs/promises";
 import fsp from "node:fs/promises";
 import os from "node:os";
 import { mkdir, open, unlink, writeFile } from "fs/promises";
+import * as path$2 from "node:path";
+import path$1 from "node:path";
 import { execFile } from "node:child_process";
 import { promisify as promisify$1 } from "node:util";
 import { env, getRuntimeKey } from "hono/adapter";
 import { sql } from "drizzle-orm";
-import { lookup } from "node:dns/promises";
-import { isIP } from "node:net";
 import { serveStatic } from "@hono/node-server/serve-static";
 import { createServer } from "http";
 import { cors } from "hono/cors";
@@ -136,6 +134,7 @@ var COLLECTION_KEYS = /* @__PURE__ */ new Set([
 	"securityRules",
 	"schema",
 	"search",
+	"indexes",
 	"path",
 	"subcollections",
 	"admin"
@@ -325,22 +324,39 @@ var ProblemCollector = class {
 	constructor(unknownKeys) {
 		this.unknownKeys = unknownKeys;
 	}
-	error(path, message) {
+	error(path, message, kind = "incoherent") {
 		this.problems.push({
 			severity: "error",
+			kind,
+			path,
+			message
+		});
+	}
+	/**
+	* Config that parses but cannot do what it says.
+	*
+	* Not gated on `unknownKeys`: that policy is about keys this version has
+	* never heard of, where silence is defensible. This is the opposite —
+	* every key is recognised, and the combination is known to be wrong.
+	*/
+	warn(path, message) {
+		this.problems.push({
+			severity: "warning",
+			kind: "incoherent",
 			path,
 			message
 		});
 	}
 	/** A key we know moved or died. Always fatal — we know exactly what to do. */
 	migrated(path, key, migration) {
-		this.error(path, `\`${key}\` is no longer read here. ${migration.fix}.` + (migration.codemod ? ` Run \`${migration.codemod}\` to migrate the whole project.` : ""));
+		this.error(path, `\`${key}\` is no longer read here. ${migration.fix}.` + (migration.codemod ? ` Run \`${migration.codemod}\` to migrate the whole project.` : ""), "key");
 	}
 	/** A key nobody recognises. Might be metadata, might be newer than us. */
 	unknown(path, key, context) {
 		if (this.unknownKeys === "off") return;
 		this.problems.push({
 			severity: this.unknownKeys === "error" ? "error" : "warning",
+			kind: "key",
 			path,
 			message: `\`${key}\` is not a known ${context} key and is being ignored. If it is deliberate metadata this is safe; if it is a typo or a key from an older version, the feature it configures is silently absent.`
 		});
@@ -433,6 +449,40 @@ function checkProperty(property, path, collect) {
 function checkProperties(properties, path, collect) {
 	for (const [key, property] of Object.entries(properties)) checkProperty(property, `${path}.${key}`, collect);
 }
+/**
+* A board's two halves, checked against each other and against `properties`.
+*
+* Every failure here parses cleanly, boots, serves rows and renders a board.
+* The only symptom is that dragging does not stick — which no test, no
+* typecheck and no config review catches, because the config is *valid*, just
+* incoherent. The panel says so in an amber bar, but only to whoever opens the
+* board; this says it to whoever starts the server.
+*
+* The order key is a `fractional-indexing` key in the base36, lower-case
+* alphabet (`"i0"`, `"i1"`, `"i0i"`) — a string, always. Postgres does the
+* sorting and its default collation is not byte ordering, which is why the
+* alphabet is single-case; see `useKanbanDragAndDrop.ts` in the admin.
+*/
+function checkBoardConfig(collection, at, collect) {
+	const admin = isPlainObject$1(collection.admin) ? collection.admin : void 0;
+	if (!admin) return;
+	const orderProperty = admin.orderProperty;
+	if ((isPlainObject$1(admin.kanban) || Array.isArray(admin.enabledViews) && admin.enabledViews.includes("kanban") || admin.defaultViewMode === "kanban") && orderProperty === void 0) collect.warn(`${at}.admin.orderProperty`, "this collection renders a Kanban board but declares no `orderProperty`, so a card's position within a column has nowhere to be stored and resets on the next read. (Moving a card *between* columns still works — that writes `kanban.columnProperty`.) Add a hidden string property and name it here: `__order: { name: \"Order\", type: \"string\", admin: { disabled: true, hideFromCollection: true } }`.");
+	if (orderProperty === void 0) return;
+	if (typeof orderProperty !== "string" || !orderProperty) {
+		collect.error(`${at}.admin.orderProperty`, "`orderProperty` must be the key of a property in this collection.");
+		return;
+	}
+	if (!isPlainObject$1(collection.properties)) return;
+	const target = collection.properties[orderProperty];
+	if (target === void 0) {
+		collect.error(`${at}.admin.orderProperty`, `\`orderProperty: "${orderProperty}"\` names no property in this collection. Nothing reads or writes it, so the board cannot be reordered at all.`);
+		return;
+	}
+	if (typeof target === "function") return;
+	if (!isPlainObject$1(target)) return;
+	if (target.type !== "string") collect.error(`${at}.properties.${orderProperty}`, `\`orderProperty\` names a \`${String(target.type)}\` property, and an order key is a string — a \`fractional-indexing\` key such as "i0" or "i0i", not an index. Stored values can never be valid, so the board asks to be initialised forever and the initialisation itself fails writing a string into this column. Change it to \`type: "string"\`.`);
+}
 function checkCollection(collection, index, collect) {
 	if (!isPlainObject$1(collection)) {
 		collect.error(`collection[${index}]`, "a collection must be an object.");
@@ -455,6 +505,7 @@ function checkCollection(collection, index, collect) {
 	}
 	if (isPlainObject$1(collection.properties)) checkProperties(collection.properties, `${at}.properties`, collect);
 	else if (collection.properties !== void 0) collect.error(`${at}.properties`, "`properties` must be an object keyed by property name.");
+	checkBoardConfig(collection, at, collect);
 	if (Array.isArray(collection.relations)) collection.relations.forEach((relation, i) => {
 		const name = isPlainObject$1(relation) && typeof relation.relationName === "string" ? relation.relationName : String(i);
 		checkRelation(relation, `${at}.relations[${name}]`, collect);
@@ -487,11 +538,15 @@ function assertCollectionConfigs(collections, options = {}) {
 	if (problems.length === 0) return;
 	const warnings = problems.filter((p) => p.severity === "warning");
 	const errors = problems.filter((p) => p.severity === "error");
-	if (warnings.length > 0) logger.warn(`[collections] ${warnings.length} unrecognised key(s) in the collection config, ignored:\n\n` + render(warnings) + "\n\nSet REBASE_STRICT_COLLECTION_CONFIG=error to make these fail the boot.\n");
+	const unknownWarnings = warnings.filter((p) => p.kind === "key");
+	const incoherentWarnings = warnings.filter((p) => p.kind === "incoherent");
+	if (unknownWarnings.length > 0) logger.warn(`[collections] ${unknownWarnings.length} unrecognised key(s) in the collection config, ignored:\n\n` + render(unknownWarnings) + "\n\nSet REBASE_STRICT_COLLECTION_CONFIG=error to make these fail the boot.\n");
+	if (incoherentWarnings.length > 0) logger.warn(`[collections] ${incoherentWarnings.length} collection(s) configured for something they cannot do:\n\n` + render(incoherentWarnings) + "\n");
 	if (errors.length === 0) return;
-	throw new Error(`${errors.length} problem(s) in the collection config.\n\nThese keys are not read by this version. Nothing would have failed at runtime — whatever they configure would simply be absent — so they are fatal at boot instead.
-
-` + render(errors) + "\n");
+	const deadKeys = errors.filter((p) => p.kind === "key");
+	const incoherent = errors.filter((p) => p.kind === "incoherent");
+	const sections = [deadKeys.length > 0 ? "These keys are not read by this version. Nothing would have failed at runtime — whatever they configure would simply be absent — so they are fatal at boot instead.\n\n" + render(deadKeys) : void 0, incoherent.length > 0 ? "These parse, and cannot do what they say. Nothing would have failed at runtime — the feature would simply not work — so they are fatal at boot instead.\n\n" + render(incoherent) : void 0].filter(Boolean);
+	throw new Error(`${errors.length} problem(s) in the collection config.\n\n` + sections.join("\n\n") + "\n");
 }
 //#endregion
 //#region src/collections/loader.ts
@@ -1670,7 +1725,7 @@ function stableStringify(value) {
 * correction.
 */
 function requestFingerprint(method, path, body) {
-	return createHash("sha256").update(`${method.toUpperCase()} ${path}\n${stableStringify(body)}`).digest("hex");
+	return sha256Hex(`${method.toUpperCase()} ${path}\n${stableStringify(body)}`);
 }
 /**
 * Returns `undefined` when the driver cannot run SQL, which disables the whole
@@ -2046,7 +2101,7 @@ var RestApiGenerator = class {
 			const idempotencyKey = c.req.header(IDEMPOTENCY_HEADER);
 			const uid = c.get("user")?.uid;
 			const store = this.idempotency();
-			const claimed = idempotencyKey && store ? await store.claim(idempotencyKey, uid, requestFingerprint(c.req.method, c.req.path, body)) : void 0;
+			const claimed = idempotencyKey && store ? await store.claim(idempotencyKey, uid, await requestFingerprint(c.req.method, c.req.path, body)) : void 0;
 			if (claimed?.status === "replay") return respond(claimed.response);
 			if (claimed?.status === "mismatch") throw idempotencyKeyReused(idempotencyKey);
 			if (claimed?.status === "in-flight") throw ApiError.conflict(`A request with Idempotency-Key '${idempotencyKey}' is already in progress. Retry once it has answered; its result will be replayed.`, "IDEMPOTENCY_KEY_IN_PROGRESS");
@@ -2200,7 +2255,7 @@ var RestApiGenerator = class {
 			const idempotencyKey = c.req.header(IDEMPOTENCY_HEADER);
 			const uid = c.get("user")?.uid;
 			const store = this.idempotency();
-			const claimed = idempotencyKey && store ? await store.claim(idempotencyKey, uid, requestFingerprint(c.req.method, c.req.path, body)) : void 0;
+			const claimed = idempotencyKey && store ? await store.claim(idempotencyKey, uid, await requestFingerprint(c.req.method, c.req.path, body)) : void 0;
 			if (claimed?.status === "replay") return c.json(claimed.response, 201);
 			if (claimed?.status === "mismatch") throw idempotencyKeyReused(idempotencyKey);
 			if (claimed?.status === "in-flight") throw ApiError.conflict(`A request with Idempotency-Key '${idempotencyKey}' is already in progress. Retry once it has answered; its result will be replayed.`, "IDEMPOTENCY_KEY_IN_PROGRESS");
@@ -2255,14 +2310,33 @@ var RestApiGenerator = class {
 		* gateway in front of this API would reject partial updates the server
 		* would have accepted.
 		*
-		* PUT was mounted on the same handler for a while so that published
-		* SDKs kept working. It is gone: two verbs for one operation meant the
-		* spec had to describe the same route twice, one of them marked
-		* deprecated, and a merge served under a verb that means replace is a
-		* contract nobody can generate against. `update()` in the SDK sends
-		* PATCH.
+		* PUT is mounted on the same handler, and is **not** in the generated
+		* spec: the contract is PATCH, and a client generated from the spec can
+		* only ever send it. The alias exists because dropping it was shipped
+		* ahead of the clients that needed it — every published SDK up to and
+		* including 0.16.0 sends PUT from `collection.update()`, so a control
+		* plane that had already dropped the alias answered `rebase cloud
+		* stop | start | restart` with a 404 naming the caller's own collection.
+		* A verb removal is only safe once the oldest client in the field speaks
+		* the new one.
+		*
+		* Delete it when no released SDK sends PUT any more — i.e. one release
+		* after the first published client whose `update()` sends PATCH, giving
+		* the field a version to move to.
+		*
+		* `Deprecation: true` is RFC 8594's signal, and how a caller finds out
+		* before that happens. No `Sunset` date: the removal is gated on which
+		* SDKs are in the field rather than on a calendar, and inventing a date
+		* we would not honour is worse than saying only what is true. Set inline
+		* rather than through a wrapper — a wrapper has to name the handler's
+		* return type, and Hono's is worth neither widening nor casting for one
+		* header at two call sites.
 		*/
 		this.router.patch(`${basePath}/:id`, updateEntity);
+		this.router.put(`${basePath}/:id`, (c) => {
+			c.header("Deprecation", "true");
+			return updateEntity(c);
+		});
 		this.router.delete(`${basePath}/:id`, async (c) => {
 			this.enforceApiKeyPermission(c, collection.slug);
 			const id = c.req.param("id");
@@ -2432,6 +2506,10 @@ var RestApiGenerator = class {
 			return c.json(response);
 		};
 		this.router.patch("/:parent/:parentId/:rest{.+}", updateNested);
+		this.router.put("/:parent/:parentId/:rest{.+}", (c, next) => {
+			c.header("Deprecation", "true");
+			return updateNested(c, next);
+		});
 		this.router.delete("/:parent/:parentId/:rest{.+}", async (c, next) => {
 			const rest = c.req.param("rest");
 			if (!rest || rest === "undefined") return next();
@@ -2576,32 +2654,12 @@ function responseCompression() {
 }
 //#endregion
 //#region src/utils/request-id.ts
-/**
-* X-Request-ID Middleware for Hono.
-*
-* Generates a unique request identifier (UUID v4) for every inbound
-* request, or propagates an existing `X-Request-ID` header from the
-* caller. The ID is:
-*
-* 1. Stored in the Hono context (`c.get("requestId")`)
-* 2. Echoed back on the response as `X-Request-ID`
-*
-* Downstream middleware and handlers (request logger, error handler,
-* etc.) read the ID from context to include it in log entries and
-* error responses, enabling end-to-end request tracing across services.
-*
-* @example
-* ```ts
-* import { requestId } from "@rebasepro/server";
-* app.use("/*", requestId());
-* ```
-*/
 var REQUEST_ID_HEADER = "X-Request-ID";
 var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function requestId() {
 	return async (c, next) => {
 		const incoming = c.req.header(REQUEST_ID_HEADER);
-		const id = incoming && UUID_RE.test(incoming) ? incoming : randomUUID();
+		const id = incoming && UUID_RE.test(incoming) ? incoming : crypto.randomUUID();
 		c.set("requestId", id);
 		await next();
 		c.header(REQUEST_ID_HEADER, id);
@@ -3775,7 +3833,7 @@ var TusHandler = class {
 		if (Number.isNaN(uploadLength) || uploadLength <= 0) throw ApiError.badRequest("Invalid Upload-Length");
 		if (uploadLength > MAX_UPLOAD_SIZE) throw new ApiError(413, "PAYLOAD_TOO_LARGE", `Upload-Length exceeds maximum of ${MAX_UPLOAD_SIZE} bytes`);
 		const metadata = this.parseMetadata(c.req.header("Upload-Metadata") || "");
-		const id = randomUUID$1();
+		const id = randomUUID();
 		const rawKey = metadata.key || metadata.filename || "";
 		let key;
 		try {
@@ -4567,7 +4625,7 @@ function createStorageRoutes(config) {
 			const scopedPath = `${bucket}/${resolvedPath}`;
 			if (isPublicStoragePath(scopedPath)) downloadConfig.metadata.public = true;
 			else {
-				downloadConfig.metadata.token = generateDownloadToken(scopedPath, 300, storageId);
+				downloadConfig.metadata.token = await generateDownloadToken(scopedPath, 300, storageId);
 				downloadConfig.metadata.tokenExpiresIn = 300;
 			}
 		}
@@ -4865,6 +4923,8 @@ function resolveStorageAccessControl(config) {
 }
 //#endregion
 //#region src/init/docs.ts
+/** Bound once the generator is imported; the route closes over it. */
+var generateOpenApiSpecFn = null;
 /**
 * Serve the OpenAPI document, and Swagger UI outside production.
 *
@@ -4875,15 +4935,16 @@ function resolveStorageAccessControl(config) {
 * paths that 404, with a Try-It button next to each.
 */
 async function mountOpenApiDocs(app, basePath, enableSwagger, serverCollections, requireAuth) {
-	if (enableSwagger === false || serverCollections.length === 0) return;
+	if (serverCollections.length === 0) return;
+	const isPublic = enableSwagger !== false;
+	const spec = (c) => c.json(generateOpenApiSpecFn(serverCollections, {
+		basePath,
+		requireAuth
+	}));
 	const { generateOpenApiSpec } = await import("./openapi-generator-FFGT0H6O.js");
-	app.get(`${basePath}/docs`, (c) => {
-		const spec = generateOpenApiSpec(serverCollections, {
-			basePath,
-			requireAuth
-		});
-		return c.json(spec);
-	});
+	generateOpenApiSpecFn = generateOpenApiSpec;
+	if (isPublic) app.get(`${basePath}/docs`, (c) => spec(c));
+	else app.get(`${basePath}/docs`, createRequireAuth({}), requireAdmin, (c) => spec(c));
 	if (process.env.NODE_ENV !== "production") {
 		app.get(`${basePath}/swagger`, (c) => {
 			return c.html(`<!DOCTYPE html>
@@ -12977,7 +13038,7 @@ async function _initializeRebaseBackend(config) {
 			]) {
 				const providerConfig = safeAuthConfig[key];
 				if (providerConfig && requiredFields.every((f) => Boolean(providerConfig[f]))) {
-					const createFn = (await import("./auth-DU-nUjPp.js").then((n) => n.t))[factory];
+					const createFn = (await import("./auth-BVPx33qB.js").then((n) => n.t))[factory];
 					oauthProviders.push(createFn(providerConfig));
 				}
 			}
@@ -13079,7 +13140,7 @@ async function _initializeRebaseBackend(config) {
 	let schemaEditorOff = schemaEditorUnavailable();
 	let schemaEditorRoutes;
 	if (!schemaEditorOff && config.collectionsDir) try {
-		schemaEditorRoutes = (await import("./schema-editor-routes-Bf5h5Emf.js")).createSchemaEditorRoutes(config.collectionsDir);
+		schemaEditorRoutes = (await import("./schema-editor-routes-BWCIqZoT.js")).createSchemaEditorRoutes(config.collectionsDir);
 	} catch (err) {
 		if (err?.code === "ERR_MODULE_NOT_FOUND") {
 			schemaEditorOff = {
@@ -13145,7 +13206,7 @@ async function _initializeRebaseBackend(config) {
 				},
 				writeSource: schemaEditorRoutes ? async (change) => {
 					const applyEdit = async (dir, collectionId, collection) => {
-						const { AstSchemaEditor } = await import("./ast-schema-editor-BrarYZCq.js");
+						const { AstSchemaEditor } = await import("./ast-schema-editor-BLADP9O2.js");
 						await new AstSchemaEditor(dir).saveCollection(collectionId, collection, { partial: false });
 					};
 					if (remoteRepo) {
@@ -14307,6 +14368,55 @@ function loadEnv(options) {
 	return env;
 }
 //#endregion
+//#region src/utils/ip-address.ts
+/**
+* `net.isIP`, without `node:net`.
+*
+* The SSRF guard in `services/outbound-url-guard.ts` needs to know whether a
+* host is already a literal address before it decides whether to resolve it.
+* That is pure string parsing — it opens no socket and asks nothing of the
+* platform — but importing it from `node:net` pinned the guard to a Node
+* process anyway. The guard's only other host dependency, the resolver, is
+* already injectable, so this is what stood between it and running anywhere.
+*
+* That matters more here than the line count suggests. On a host with no
+* `dns.lookup` the guard has to be given a resolver (DNS-over-HTTPS, or the
+* platform's own), and a module that cannot be *imported* there cannot be
+* given anything. The alternative — an isolate deployment quietly running
+* without the guard — is how a webhook destination becomes a way to read the
+* metadata endpoint.
+*
+* The grammar is Node's own, transcribed from `lib/internal/net.js`, and
+* `test/property/ip-address.property.test.ts` holds it to that by comparing against
+* `net.isIP` over generated addresses. Transcribing a validator by eye and
+* declaring it equivalent is not a thing to do to a security boundary; being
+* able to *check* the claim on every run is what makes it acceptable.
+*
+* @module
+*/
+var IPV4_SEGMENT = "(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])";
+var IPV4 = `(?:${IPV4_SEGMENT}\\.){3}${IPV4_SEGMENT}`;
+var IPV4_RE = new RegExp(`^${IPV4}$`);
+var IPV6_SEGMENT = "(?:[0-9a-fA-F]{1,4})";
+/**
+* One alternative per position the `::` elision can occupy, which is why this
+* is nine branches rather than something shorter and wrong: a compact pattern
+* that admits two elisions, or a trailing dotted quad in the wrong place,
+* accepts strings the resolver would reject and the guard would then judge on
+* bytes it invented.
+*/
+var IPV6 = `(?:(?:${IPV6_SEGMENT}:){7}(?:${IPV6_SEGMENT}|:)|(?:${IPV6_SEGMENT}:){6}(?:${IPV4}|:${IPV6_SEGMENT}|:)|(?:${IPV6_SEGMENT}:){5}(?::${IPV4}|(?::${IPV6_SEGMENT}){1,2}|:)|(?:${IPV6_SEGMENT}:){4}(?:(?::${IPV6_SEGMENT}){0,1}:${IPV4}|(?::${IPV6_SEGMENT}){1,3}|:)|(?:${IPV6_SEGMENT}:){3}(?:(?::${IPV6_SEGMENT}){0,2}:${IPV4}|(?::${IPV6_SEGMENT}){1,4}|:)|(?:${IPV6_SEGMENT}:){2}(?:(?::${IPV6_SEGMENT}){0,3}:${IPV4}|(?::${IPV6_SEGMENT}){1,5}|:)|(?:${IPV6_SEGMENT}:){1}(?:(?::${IPV6_SEGMENT}){0,4}:${IPV4}|(?::${IPV6_SEGMENT}){1,6}|:)|(?::(?:(?::${IPV6_SEGMENT}){0,5}:${IPV4}|(?::${IPV6_SEGMENT}){1,7}|:)))(?:%[0-9a-zA-Z-.:]{1,})?`;
+var IPV6_RE = new RegExp(`^${IPV6}$`);
+/**
+* `4`, `6`, or `0` for anything that is not an IP address — the same three
+* answers, for the same inputs, as `net.isIP`.
+*/
+function ipVersion(address) {
+	if (IPV4_RE.test(address)) return 4;
+	if (IPV6_RE.test(address)) return 6;
+	return 0;
+}
+//#endregion
 //#region src/services/outbound-url-guard.ts
 /**
 * Refusal to send a request to a destination the guard does not allow.
@@ -14328,8 +14438,27 @@ var BLOCKED_HOST_SUFFIXES = [
 	".internal",
 	".home.arpa"
 ];
+/**
+* The resolver when the caller supplies none: Node's.
+*
+* Loaded on use rather than imported at the top, which is what keeps this
+* module — the check standing between a stored URL and the pod's own metadata
+* endpoint — loadable on a runtime that has no `node:dns`. There the caller
+* passes {@link OutboundUrlGuardOptions.lookup} instead, pointing at whatever
+* the host resolves names with.
+*
+* A host with neither fails **closed**, and says which of the two it is
+* missing: the alternative to resolving a name is not "allow it", it is "do
+* not send".
+*/
 async function defaultLookup(hostname) {
-	return (await lookup(hostname, {
+	let dns;
+	try {
+		dns = await import("node:dns/promises");
+	} catch {
+		throw new BlockedUrlError(`Cannot check where "${hostname}" points: this runtime has no \`node:dns\`, and no \`lookup\` was supplied to the outbound URL guard. Pass one — the guard cannot be skipped, because skipping it is what makes a stored URL a way to reach the internal network.`);
+	}
+	return (await dns.lookup(hostname, {
 		all: true,
 		verbatim: true
 	})).map((e) => e.address);
@@ -14348,7 +14477,7 @@ function parseIpv6(address) {
 	const lastColon = text.lastIndexOf(":");
 	const maybeV4 = text.slice(lastColon + 1);
 	if (maybeV4.includes(".")) {
-		if (isIP(maybeV4) !== 4) return null;
+		if (ipVersion(maybeV4) !== 4) return null;
 		tail = maybeV4.split(".").map(Number);
 		text = text.slice(0, lastColon);
 		if (text.endsWith(":")) text += ":";
@@ -14396,7 +14525,7 @@ function blockedIpv4Reason(bytes) {
 * outbound call whose destination comes from data.
 */
 function blockedAddressReason(address) {
-	const version = isIP(address);
+	const version = ipVersion(address);
 	if (version === 4) return blockedIpv4Reason(address.split(".").map(Number));
 	if (version !== 6) return `not an IP address: ${address}`;
 	const bytes = parseIpv6(address);
@@ -14447,7 +14576,7 @@ async function assertAllowedOutboundUrl(rawUrl, options = {}) {
 	const hostname = url.hostname.startsWith("[") ? url.hostname.slice(1, -1) : url.hostname;
 	const lowered = hostname.toLowerCase();
 	if (lowered === "localhost" || BLOCKED_HOST_SUFFIXES.some((suffix) => lowered.endsWith(suffix))) throw new BlockedUrlError(`Webhook URL host "${hostname}" is an internal name`);
-	const addresses = isIP(hostname) ? [hostname] : await (options.lookup ?? defaultLookup)(hostname);
+	const addresses = ipVersion(hostname) ? [hostname] : await (options.lookup ?? defaultLookup)(hostname);
 	if (addresses.length === 0) throw new BlockedUrlError(`Webhook URL host "${hostname}" resolved to no addresses`);
 	for (const address of addresses) {
 		const reason = blockedAddressReason(address);
@@ -14636,7 +14765,7 @@ var WebhookDispatcher = class {
 			"Content-Type": "application/json",
 			"X-Webhook-Id": webhook.id,
 			"X-Webhook-Event": event,
-			"X-Webhook-Delivery": randomUUID$1(),
+			"X-Webhook-Delivery": randomUUID(),
 			"X-Webhook-Attempt": String(attemptNumber),
 			...webhook.headers || {}
 		};
@@ -16780,6 +16909,29 @@ var BUNDLE_URL_ENV = "REBASE_BUNDLE_URL";
 /** Bearer token for that fetch. Does not expire — see the module note. */
 var BUNDLE_TOKEN_ENV = "REBASE_BUNDLE_TOKEN";
 /**
+* Records which URL produced the tree sitting in the fetch directory.
+*
+* Reusing an already-unpacked bundle is what makes a restart cheap, but "there
+* is a bundle here" is not the same question as "is it the bundle we were told
+* to run". Anything that fills the directory behind the runtime's back — an
+* orphaned `fetch-bundle` init container left on a Deployment, a stale volume —
+* used to win over the URL, and the pod then served whatever it found while
+* every deploy reported success. The URL is the instruction; this is how a
+* restart tells whether the disk already satisfies it.
+*
+* `infra/docker/entrypoint.mjs` reads this file by the same name to decide
+* whether to fetch at all — keep the two in step.
+*/
+var BUNDLE_SOURCE_FILENAME = ".rebase-bundle-source";
+/** What the tree in `destination` was fetched from, or null if unknown. */
+function unpackedBundleSource(destination) {
+	try {
+		return fs$1.readFileSync(path$1.join(destination, BUNDLE_SOURCE_FILENAME), "utf8").trim();
+	} catch {
+		return null;
+	}
+}
+/**
 * Whether this process should fetch its bundle rather than read one from disk.
 *
 * An explicit `REBASE_BUNDLE` — a path — always wins. A platform that mounted a
@@ -16789,14 +16941,28 @@ var BUNDLE_TOKEN_ENV = "REBASE_BUNDLE_TOKEN";
 function shouldFetchBundle(env = process.env) {
 	return Boolean(env["REBASE_BUNDLE_URL"]) && !env.REBASE_BUNDLE;
 }
+/**
+* Whether the system `tar` is GNU tar.
+*
+* Asked rather than assumed, because the answer differs between a developer's
+* machine and the Linux image the same code runs in, and the flags below are
+* GNU spellings that bsdtar rejects outright. Probed once per process.
+*/
+var gnuTar;
+function isGnuTar() {
+	gnuTar ??= run("tar", ["--version"]).then(({ stdout }) => /GNU tar/.test(String(stdout))).catch(() => false);
+	return gnuTar;
+}
 /** Untar with the system `tar`, which every base image has. */
 async function extractWithTar(tarball, destination) {
-	await run("tar", [
+	const args = [
 		"-xzmf",
 		tarball,
 		"-C",
 		destination
-	]);
+	];
+	if (await isGnuTar()) args.push("--no-same-owner", "--no-same-permissions", "--no-overwrite-dir");
+	await run("tar", args);
 }
 /**
 * Download and unpack a bundle, returning the directory it landed in.
@@ -16999,6 +17165,21 @@ async function fetchBundle(options) {
 		fs$1.rmSync(tarball, { force: true });
 		throw new Error(`Could not download the bundle from ${options.url}: ` + (lastError instanceof Error ? lastError.message : String(lastError)));
 	}
+	const previous = unpackedBundleSource(destination);
+	if (previous !== null && previous !== options.url) {
+		logger.info("Discarding a bundle unpacked from a different source", {
+			previous,
+			replacing: options.url
+		});
+		for (const entry of fs$1.readdirSync(destination)) {
+			const victim = path$1.join(destination, entry);
+			if (victim === tarball) continue;
+			fs$1.rmSync(victim, {
+				recursive: true,
+				force: true
+			});
+		}
+	}
 	const { size } = fs$1.statSync(tarball);
 	try {
 		await extract(tarball, destination);
@@ -17009,6 +17190,7 @@ async function fetchBundle(options) {
 	}
 	const root = bundleRootIn(destination);
 	if (!root) throw new Error(`The bundle downloaded from ${options.url} unpacked without a ${MANIFEST_FILENAME}. It is not a Rebase bundle, or it was truncated.`);
+	fs$1.writeFileSync(path$1.join(destination, BUNDLE_SOURCE_FILENAME), options.url);
 	if (options.installDependencies ?? true) await (options.installImpl ?? installBundleDependencies)(root);
 	return root;
 }
@@ -17578,6 +17760,6 @@ var RUNTIME_STARTUP_BUDGET_SECONDS = 300;
 /** Where a bundle is mounted, and what the runtime is told to read. */
 var RUNTIME_BUNDLE_MOUNT = "/bundle";
 //#endregion
-export { ApiError, BlockedUrlError, BundleError, CONCURRENT_DDL_SQLSTATES, CronScheduler, DEFAULT_DRIVER_ID, DEFAULT_MAX_FILE_SIZE, DEFAULT_STORAGE_ID, DOCUMENT_MIME_TYPES, DefaultDriverRegistry, DefaultStorageRegistry, GCSStorageController, IMAGE_MIME_TYPES, LocalStorageController, MetricsRegistry, RUNTIME_BUNDLE_MOUNT, RUNTIME_HEALTH_PATH, RUNTIME_LIVENESS_PATH, RUNTIME_MIN_TERMINATION_GRACE_SECONDS, RUNTIME_PRESTOP_DRAIN_SECONDS, RUNTIME_PROBE_PATHS, RUNTIME_STARTUP_BUDGET_SECONDS, RawHtml, S3StorageController, SMTPEmailService, StoragePolicyError, TOPOLOGY_ENV_VARS, TransformCache, TusHandler, UnknownStorageSourceError, WEBHOOK_DELIVERY_TASK, WebhookDispatcher, _resetRebaseMock, _setRebaseMock, activeDevEmailSink, applyCollectionDefaults, assertAllowedOutboundUrl, assertCollectionConfigs, assertDistinctSuffixes, assertEmailLinkBases, assertWriteRequestValid, authJwt, authRoles, authUid, blockedAddressReason, bootFromBundle, classifySurface, cleanupDevPortFile, clearActiveDevEmailSink, compileStoragePolicies, createAppleProvider, createBackupRoutes, createBitbucketProvider, createBuiltinAuthAdapter, createContractRoutes, createCronRoutes, createCronStore, createCustomAuthAdapter, createDdlBootstrapper, createDevEmailSink, createDiscordProvider, createEmailService, createFacebookProvider, createFunctionRoutes, createGitHubProvider, createGitLabProvider, createGoogleProvider, createHistoryRoutes, createJobQueue, createJobStore, createJwksRoutes, createLinkedinProvider, createMetricsMiddleware, createMetricsRoutes, createMicrosoftProvider, createRlsAudit, createSlackProvider, createSourceBundle, createSpotifyProvider, createStorageController, createStorageRoutes, createTwitterProvider, defaultBackoff, defineCron, defineFunction, drainBackgroundWork, envSuffixForKey, errorHandler, escapeHtml, extractLinks, extractUserFromToken, fileTokenAuth, findCollectionConfigProblems, generateSecurePassword, getApiKey, getDriver, getEmailOtpTemplate, getEmailVerificationTemplate, getEnv, getJwks, getMagicLinkTemplate, getPasswordResetTemplate, getRequestId, getRoles, getUser, getUserId, getUserInvitationTemplate, getWelcomeEmailTemplate, hasAsymmetricSigningKey, hasRole, hashPassword, html, httpMethodToOperation, identityResolved, initializeDataSource, initializeDataSources, initializeRebaseBackend, installShutdownHandlers, isAdmin, isApiKeyToken, isAuthAdapter, isAuthenticated, isConcurrentDdlRace, isDatabaseAdapter, isDuplicateObjectRace, isLocalhostOrigin, isNodeRuntime, isOperationAllowed, isTopologyEnvVar, isTransformableImage, lazyResource, listBackupObjects, listenWithPortRetry, loadBootEnv, loadBundle, loadBundleConfigExports, loadBundleSchema, loadCollectionsFromDirectory, loadCronJobsFromDirectory, loadCronJobsWithDiagnostics, loadDeclaredStorageSources, loadEnv, loadFunctionsFromDirectory, loadFunctionsWithDiagnostics, loadUsersCollection, logger, oauthCodeFlowSchema, optionalAuth, parseBackupDestination, parseBackupTimestamp, parseTransformOptions, pendingBackgroundWork, pkceTokenParams, providerVerifiedEmail, queryTokenAuth, raw, readBackupBytes, readBundleManifest, rebase, registerDevEmailSink, requireAdmin, requireAuth, requireDriver, requireEnv, requireRole, resolveAuthHooks, resolveAuthOptions, resolveCorsOrigin, resolveDataSources, resolveEmailBranding, resolveEmailLinkBase, resolveEmailOptions, resolveRequireAuth, resolveStorageAccessControl, resolveStorageBackend, resolveStorageSources, runFromBundle, runtimeKey, safeCompare, serveSPA, summarize as summarizeRlsScan, transformImage, tryVerifyOidcIdToken, unknownKeyPolicyFromEnv, validateApiKey, validateCronExpression, validatePasswordStrength, verifyOidcIdToken, verifyPassword, waitUntil };
+export { ApiError, BlockedUrlError, BundleError, CONCURRENT_DDL_SQLSTATES, CronScheduler, DEFAULT_DRIVER_ID, DEFAULT_MAX_FILE_SIZE, DEFAULT_STORAGE_ID, DOCUMENT_MIME_TYPES, DefaultDriverRegistry, DefaultStorageRegistry, GCSStorageController, IMAGE_MIME_TYPES, LocalStorageController, MetricsRegistry, RUNTIME_BUNDLE_MOUNT, RUNTIME_HEALTH_PATH, RUNTIME_LIVENESS_PATH, RUNTIME_MIN_TERMINATION_GRACE_SECONDS, RUNTIME_PRESTOP_DRAIN_SECONDS, RUNTIME_PROBE_PATHS, RUNTIME_STARTUP_BUDGET_SECONDS, RawHtml, S3StorageController, SMTPEmailService, StoragePolicyError, TOPOLOGY_ENV_VARS, TransformCache, TusHandler, UnknownStorageSourceError, WEBHOOK_DELIVERY_TASK, WebhookDispatcher, _resetRebaseMock, _setRebaseMock, activeDevEmailSink, applyCollectionDefaults, assertAllowedOutboundUrl, assertCollectionConfigs, assertDistinctSuffixes, assertEmailLinkBases, assertWriteRequestValid, authJwt, authRoles, authUid, blockedAddressReason, bootFromBundle, classifySurface, cleanupDevPortFile, clearActiveDevEmailSink, compileStoragePolicies, configureJwt, createAppleProvider, createBackupRoutes, createBitbucketProvider, createBuiltinAuthAdapter, createContractRoutes, createCronRoutes, createCronStore, createCustomAuthAdapter, createDdlBootstrapper, createDevEmailSink, createDiscordProvider, createEmailService, createFacebookProvider, createFunctionRoutes, createGitHubProvider, createGitLabProvider, createGoogleProvider, createHistoryRoutes, createJobQueue, createJobStore, createJwksRoutes, createLinkedinProvider, createMetricsMiddleware, createMetricsRoutes, createMicrosoftProvider, createRlsAudit, createSlackProvider, createSourceBundle, createSpotifyProvider, createStorageController, createStorageRoutes, createTwitterProvider, defaultBackoff, defineCron, defineFunction, drainBackgroundWork, envSuffixForKey, errorHandler, escapeHtml, extractLinks, extractUserFromToken, fileTokenAuth, findCollectionConfigProblems, generateSecurePassword, getApiKey, getDriver, getEmailOtpTemplate, getEmailVerificationTemplate, getEnv, getJwks, getMagicLinkTemplate, getPasswordResetTemplate, getRequestId, getRoles, getUser, getUserId, getUserInvitationTemplate, getWelcomeEmailTemplate, hasAsymmetricSigningKey, hasRole, hashPassword, html, httpMethodToOperation, identityResolved, initializeDataSource, initializeDataSources, initializeRebaseBackend, installShutdownHandlers, isAdmin, isApiKeyToken, isAuthAdapter, isAuthenticated, isConcurrentDdlRace, isDatabaseAdapter, isDuplicateObjectRace, isLocalhostOrigin, isNodeRuntime, isOperationAllowed, isTopologyEnvVar, isTransformableImage, lazyResource, listBackupObjects, listenWithPortRetry, loadBootEnv, loadBundle, loadBundleConfigExports, loadBundleSchema, loadCollectionsFromDirectory, loadCronJobsFromDirectory, loadCronJobsWithDiagnostics, loadDeclaredStorageSources, loadEnv, loadFunctionsFromDirectory, loadFunctionsWithDiagnostics, loadUsersCollection, logger, oauthCodeFlowSchema, optionalAuth, parseBackupDestination, parseBackupTimestamp, parseTransformOptions, pendingBackgroundWork, pkceTokenParams, providerVerifiedEmail, queryTokenAuth, raw, readBackupBytes, readBundleManifest, rebase, registerDevEmailSink, requireAdmin, requireAuth, requireDriver, requireEnv, requireRole, resolveAuthHooks, resolveAuthOptions, resolveCorsOrigin, resolveDataSources, resolveEmailBranding, resolveEmailLinkBase, resolveEmailOptions, resolveRequireAuth, resolveStorageAccessControl, resolveStorageBackend, resolveStorageSources, runFromBundle, runtimeKey, safeCompare, serveSPA, summarize as summarizeRlsScan, transformImage, tryVerifyOidcIdToken, unknownKeyPolicyFromEnv, validateApiKey, validateCronExpression, validatePasswordStrength, verifyOidcIdToken, verifyPassword, waitUntil };
 
 //# sourceMappingURL=index.es.js.map