@rebasepro/server 0.17.3 → 0.18.0

package/dist/api/types.d.ts

@@ -20,11 +20,66 @@ export type HonoEnv = {
          * bucket — a limiter in name only. See `auth/otp-routes.ts`.
          */
         otpEmail?: string;
+        /**
+         * The address a mail-sending auth route named, lower-cased.
+         *
+         * The generalisation of `otpEmail`, for the same reason and used the
+         * same way: `recipientEmailLimiter` bounds how many messages one
+         * MAILBOX receives, and the address it keys on lives in a body the
+         * limiter runs before anyone has parsed. See `auth/rate-limiter.ts`.
+         */
+        recipientEmail?: string;
         driver?: DataDriver;
         /** Set when the request is authenticated via a Service API Key. */
         apiKey?: ApiKeyMasked;
         /** Unique request correlation ID (generated or propagated from X-Request-ID header). */
         requestId?: string;
+        /**
+         * The collection this request is about, when it is about one.
+         *
+         * Set by the REST generator from the first path segment, validated
+         * against the collections it actually serves — so it is a slug this
+         * backend knows, not whatever the caller typed. Read by the request
+         * logger: "a 403 on /api/data/orders" and "a 403" are different amounts
+         * of help at 3am, and the path alone does not survive being aggregated.
+         */
+        collection?: string;
+        /**
+         * What the error handler answered, for the request log line.
+         *
+         * The handler and the request logger both wrote a line for the same
+         * failed request, each holding half of it: the handler had the code and
+         * the message, the logger had the user and the latency. Neither was
+         * enough, and two lines per failure is its own cost. The handler now
+         * leaves what it knows here and stays quiet where the logger will
+         * speak. See `utils/request-logger.ts`.
+         */
+        errorSummary?: {
+            code: string;
+            message: string;
+        };
+        /**
+         * Set by `requestLogger` before the handler runs, so the error handler
+         * can tell whether one line per request is already guaranteed.
+         *
+         * A router mounted without the request logger — a project wiring routes
+         * onto its own Hono app — still gets the handler's own line, because
+         * there nothing else would report the failure at all.
+         */
+        requestLogged?: boolean;
+        /**
+         * The caller's `x-rebase-schema` stamp and this server's, when they
+         * disagree.
+         *
+         * Set by `createSchemaDriftDetector` and read only by the error handler,
+         * which attaches it as the cause of a 400 or 404 the request would have
+         * produced anyway. Never a reason to refuse: an SDK generated against an
+         * older schema is usually still compatible.
+         */
+        schemaDrift?: {
+            client: string;
+            server: string;
+        };
     };
 };
 /**

package/dist/{ast-schema-editor-CvkYOvri.js → ast-schema-editor-CNgFJ3NF.js}

@@ -2,8 +2,8 @@ import { createRequire as __rebaseCreateRequire } from "module";
 import __rebaseProcess from "process";
 globalThis.process ??= __rebaseProcess;
 __rebaseCreateRequire(import.meta.url);
-import "./src-CcOl05Oq.js";
-import { i as nestAdminPropertyKeys, r as nestAdminCollectionKeys } from "./admin_block-BX6YULvJ.js";
+import "./src-DHK4fHkw.js";
+import { i as nestAdminPropertyKeys, r as nestAdminCollectionKeys } from "./admin_block-0Xu0r6eZ.js";
 import * as fs$1 from "fs";
 import * as path$1 from "path";
 import { IndentationText, Node, Project, SyntaxKind } from "ts-morph";
@@ -19,6 +19,20 @@ import { IndentationText, Node, Project, SyntaxKind } from "ts-morph";
 */
 var COLLECTION_FACTORIES = /* @__PURE__ */ new Set(["defineCollection"]);
 /**
+* The only relation-target expression this editor will write through verbatim.
+*
+* A relation's `target` is emitted as SOURCE, not as a string literal, because
+* it has to be `() => otherCollection`. The test for "is this already a thunk?"
+* used to be "does it contain an arrow", which `() => { require("child_process")
+* .execSync("…") }` also satisfies — and `rebase dev` re-imports the file the
+* moment it changes, so the payload ran without anyone deploying anything.
+*
+* An arrow returning a single identifier is the whole grammar. Anything else is
+* read as a collection name and turned into a thunk by `targetThunk`, which
+* resolves it against the collections directory and refuses a name with no file.
+*/
+var ARROW_TO_IDENTIFIER = /^\(\s*\)\s*=>\s*[A-Za-z_$][A-Za-z0-9_$]*$/;
+/**
 * A value that must be emitted as source code rather than as JSON.
 *
 * Everything reaching the writer has been through `JSON.stringify` on the wire,
@@ -204,7 +218,7 @@ var AstSchemaEditor = class AstSchemaEditor {
 						const init = oldProp.getInitializer();
 						if (init) {
 							const kind = init.getKind();
-							if (kind === SyntaxKind.ArrowFunction || kind === SyntaxKind.FunctionExpression || kind === SyntaxKind.Identifier || kind === SyntaxKind.CallExpression || kind === SyntaxKind.JsxElement || name === "target" || name === "callbacks" || name === "permissions" || name === "securityRules") preservedProps.push(`${AstSchemaEditor.quoteKey(name)}: ${init.getText()}`);
+							if (kind === SyntaxKind.ArrowFunction || kind === SyntaxKind.FunctionExpression || kind === SyntaxKind.Identifier || kind === SyntaxKind.CallExpression || kind === SyntaxKind.JsxElement || name === "target" || name === "callbacks" || name === "browserCallbacks" || name === "permissions" || name === "securityRules") preservedProps.push(`${AstSchemaEditor.quoteKey(name)}: ${init.getText()}`);
 						}
 					}
 				}
@@ -333,7 +347,7 @@ var AstSchemaEditor = class AstSchemaEditor {
 				const newInit = this.convertJsonToAstString(collectionData[key], 1, oldAstNode);
 				if (prop) prop.setInitializer(newInit);
 				else collectionObj.addPropertyAssignment({
-					name: key,
+					name: AstSchemaEditor.quoteKey(key),
 					initializer: newInit
 				});
 			}
@@ -378,8 +392,10 @@ var AstSchemaEditor = class AstSchemaEditor {
 			const relationName = typeof relation.relationName === "string" ? relation.relationName : void 0;
 			const rawTarget = relation.target;
 			let targetText;
-			if (typeof rawTarget === "string" && rawTarget.trim().length > 0) targetText = rawTarget.includes("=>") ? rawTarget.trim() : this.targetThunk(file, rawTarget.trim());
-			else if (relationName && oldTargetsByName.has(relationName)) targetText = oldTargetsByName.get(relationName);
+			if (typeof rawTarget === "string" && rawTarget.trim().length > 0) {
+				const trimmed = rawTarget.trim();
+				targetText = ARROW_TO_IDENTIFIER.test(trimmed) ? trimmed : this.targetThunk(file, trimmed);
+			} else if (relationName && oldTargetsByName.has(relationName)) targetText = oldTargetsByName.get(relationName);
 			else if (value.length === oldElements.length) targetText = anonymousTargetsByIndex[index];
 			if (!targetText) throw new Error(`Relation "${relationName ?? `#${index}`}" on collection "${collectionId}" has no target collection. Pick one before saving.`);
 			relation.target = new RawExpression(targetText);
@@ -426,4 +442,4 @@ var AstSchemaEditor = class AstSchemaEditor {
 //#endregion
 export { AstSchemaEditor };
 
-//# sourceMappingURL=ast-schema-editor-CvkYOvri.js.map
+//# sourceMappingURL=ast-schema-editor-CNgFJ3NF.js.map

package/dist/ast-schema-editor-CNgFJ3NF.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ast-schema-editor-CNgFJ3NF.js","names":[],"sources":["../src/api/ast-schema-editor.ts"],"sourcesContent":["import { Project, SyntaxKind, Node, ObjectLiteralExpression, ObjectLiteralElementLike, PropertyAssignment, SourceFile, IndentationText } from \"ts-morph\";\nimport { nestAdminCollectionKeys, nestAdminPropertyKeys } from \"@rebasepro/types\";\nimport * as path from \"path\";\nimport * as fs from \"fs\";\n\n/**\n * The helpers a collection file may be wrapped in.\n *\n * `rebase init` scaffolds every collection as\n * `const postsCollection = defineCollection({ … })` — a call expression, not the\n * bare object literal `rebase introspect` emits. An editor that only understood\n * the bare form found nothing to patch in any stock project, and then rewrote the\n * file from the panel's JSON: no wrapper, no imports, no relation thunks.\n */\nconst COLLECTION_FACTORIES = new Set([\"defineCollection\"]);\n\n/**\n * The only relation-target expression this editor will write through verbatim.\n *\n * A relation's `target` is emitted as SOURCE, not as a string literal, because\n * it has to be `() => otherCollection`. The test for \"is this already a thunk?\"\n * used to be \"does it contain an arrow\", which `() => { require(\"child_process\")\n * .execSync(\"…\") }` also satisfies — and `rebase dev` re-imports the file the\n * moment it changes, so the payload ran without anyone deploying anything.\n *\n * An arrow returning a single identifier is the whole grammar. Anything else is\n * read as a collection name and turned into a thunk by `targetThunk`, which\n * resolves it against the collections directory and refuses a name with no file.\n */\nconst ARROW_TO_IDENTIFIER = /^\\(\\s*\\)\\s*=>\\s*[A-Za-z_$][A-Za-z0-9_$]*$/;\n\n/**\n * A value that must be emitted as source code rather than as JSON.\n *\n * Everything reaching the writer has been through `JSON.stringify` on the wire,\n * so a function-valued key arrives either missing or as a string. A relation's\n * `target` is a thunk in the file and a slug in the payload; this is how the\n * thunk gets written back.\n */\nclass RawExpression {\n    constructor(public readonly text: string) {\n    }\n}\n\n/**\n * Move presentation keys into the `admin` block.\n *\n * The rule itself lives in `@rebasepro/types`, next to `ADMIN_COLLECTION_KEYS`,\n * because `@rebasepro/cms-types` has to apply the identical one on the panel's\n * side and this package cannot import that one. Two copies used to exist and\n * they disagreed about precedence, which decided whether a presentation edit was\n * saved or silently reverted to the value the user had just changed away from.\n */\nexport function nestAdminKeys(collectionData: Record<string, unknown>): Record<string, unknown> {\n    return nestAdminCollectionKeys(collectionData);\n}\n\nexport class AstSchemaEditor {\n    private project: Project;\n    private collectionsDir: string;\n\n    constructor(collectionsDir: string) {\n        this.project = new Project({\n            manipulationSettings: {\n                indentationText: IndentationText.FourSpaces\n            }\n        });\n        if (fs.existsSync(collectionsDir)) {\n            this.project.addSourceFilesAtPaths(`${collectionsDir}/**/*.ts`);\n        }\n        this.collectionsDir = path.resolve(collectionsDir);\n    }\n\n    /**\n     * Sanitize collectionId to prevent path traversal attacks.\n     * Only allows alphanumeric characters, underscores, and hyphens.\n     */\n    /**\n     * The variable name the generated file binds the collection to.\n     *\n     * `sanitizeCollectionId` guards the FILENAME, and permits hyphens and a\n     * leading digit — both legal in a filename and neither legal in a\n     * JavaScript identifier. So a collection created from the admin panel as\n     * `my-notes` (the documented slug shape) or `2024 Archive` (auto-slugged to\n     * `2024_archive`) wrote:\n     *\n     *     const my-notesCollection: CollectionConfig = …      \"',' expected\"\n     *     const 2024_archiveCollection: CollectionConfig = …  \"Numeric separators\n     *                                                          are not allowed here\"\n     *\n     * The panel reported success, and the next boot failed for EVERY collection\n     * in the directory — the loader imports all of them — while the editor could\n     * no longer parse the file it had just written, so it could not fix itself.\n     *\n     * Separators camel-case rather than vanish, so `my-notes` and `my_notes`\n     * stay distinct; a leading digit is prefixed rather than stripped, so\n     * `2024_archive` stays distinct from `archive`. Byte-identical for every\n     * slug that already produced a valid identifier.\n     */\n    private static collectionVarName(safeId: string): string {\n        const camel = safeId.replace(/[-_]+([a-zA-Z0-9])/g, (_, char: string) => char.toUpperCase());\n        const identifier = /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(camel) ? camel : `c${camel.replace(/^[0-9]/, (d) => d)}`;\n        return /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(identifier) ? identifier : `c${identifier.replace(/[^A-Za-z0-9_$]/g, \"\")}`;\n    }\n\n    private sanitizeCollectionId(collectionId: string): string {\n        const sanitized = collectionId.replace(/[^a-zA-Z0-9_-]/g, \"\");\n        if (!sanitized || sanitized !== collectionId) {\n            throw new Error(`Invalid collection ID: \"${collectionId}\". Only alphanumeric characters, underscores, and hyphens are allowed.`);\n        }\n        return sanitized;\n    }\n\n    /**\n     * Resolve a file path and ensure it falls within the collectionsDir.\n     */\n    private safePath(filename: string): string {\n        const resolved = path.resolve(this.collectionsDir, filename);\n        if (!resolved.startsWith(this.collectionsDir + path.sep) && resolved !== this.collectionsDir) {\n            throw new Error(\"Path traversal detected: resolved path is outside the collections directory.\");\n        }\n        return resolved;\n    }\n\n    private getCollectionFile(collectionId: string) {\n        const safeId = this.sanitizeCollectionId(collectionId);\n        const filePath = this.safePath(`${safeId}.ts`);\n        let file = this.project.getSourceFile(filePath);\n        if (!file && fs.existsSync(filePath)) {\n            this.project.addSourceFilesAtPaths(`${this.collectionsDir}/**/*.ts`);\n            file = this.project.getSourceFile(filePath);\n        }\n        return file;\n    }\n\n    /**\n     * Find the object literal a collection is declared with, through whatever\n     * wraps it.\n     *\n     * `defineCollection({ … })` is the shape `rebase init` writes and the one the\n     * docs recommend; `satisfies` / `as` / parentheses are the other ways an\n     * author can dress the same literal. Returning `null` for any of them meant\n     * the three callers below each failed differently, and the worst of them\n     * overwrote the file.\n     */\n    private unwrapCollectionObject(node: Node | undefined): ObjectLiteralExpression | null {\n        if (!node) return null;\n        if (Node.isObjectLiteralExpression(node)) return node;\n        if (Node.isParenthesizedExpression(node) ||\n            Node.isAsExpression(node) ||\n            Node.isSatisfiesExpression(node) ||\n            Node.isTypeAssertion(node) ||\n            Node.isNonNullExpression(node)) {\n            return this.unwrapCollectionObject(node.getExpression());\n        }\n        if (Node.isCallExpression(node)) {\n            // `defineCollection`, `admin.defineCollection`, `defineCollection<Post>`\n            const callee = node.getExpression().getText().split(\".\").pop();\n            if (callee && COLLECTION_FACTORIES.has(callee)) {\n                return this.unwrapCollectionObject(node.getArguments()[0]);\n            }\n        }\n        return null;\n    }\n\n    private getCollectionObject(collectionId: string): ObjectLiteralExpression | null {\n        const file = this.getCollectionFile(collectionId);\n        if (!file) return null;\n\n        const defaultExport = file.getDefaultExportSymbol();\n        if (defaultExport) {\n            const declaration = defaultExport.getDeclarations()[0];\n            if (declaration && declaration.getKind() === SyntaxKind.ExportAssignment) {\n                const expr = declaration.asKind(SyntaxKind.ExportAssignment)?.getExpression();\n                if (expr && expr.getKind() === SyntaxKind.Identifier) {\n                    const varName = expr.getText();\n                    const varDecl = file.getVariableDeclaration(varName);\n                    const unwrapped = this.unwrapCollectionObject(varDecl?.getInitializer());\n                    if (unwrapped) return unwrapped;\n                } else {\n                    // `export default defineCollection({ … })`\n                    const unwrapped = this.unwrapCollectionObject(expr);\n                    if (unwrapped) return unwrapped;\n                }\n            }\n        }\n        // Fallback: the first VariableDeclaration that holds a collection literal\n        for (const varDecl of file.getVariableDeclarations()) {\n            const init = this.unwrapCollectionObject(varDecl.getInitializer());\n            if (init) return init;\n        }\n        return null;\n    }\n\n    /**\n     * The collection's object literal, or a refusal that says what to do.\n     *\n     * Every caller needs this to be all-or-nothing: a missing object literal used\n     * to mean \"throw\", \"report success and do nothing\" and \"recreate the file\n     * from scratch\" depending on which method you called.\n     */\n    private requireCollectionObject(collectionId: string): ObjectLiteralExpression {\n        const file = this.getCollectionFile(collectionId);\n        if (!file) {\n            throw new Error(`Collection \"${collectionId}\" has no file at ${path.join(this.collectionsDir, `${collectionId}.ts`)}.`);\n        }\n        const collectionObj = this.getCollectionObject(collectionId);\n        if (!collectionObj) {\n            throw new Error(this.unreadableFileMessage(collectionId, file));\n        }\n        return collectionObj;\n    }\n\n    private unreadableFileMessage(collectionId: string, file: SourceFile): string {\n        return `Could not find the collection object in ${file.getFilePath()}. ` +\n            \"The schema editor can only edit a collection declared as `const x = defineCollection({ … })` \" +\n            \"or `const x: CollectionConfig = { … }` and exported as the file's default. \" +\n            `Edit \"${collectionId}\" in code instead.`;\n    }\n\n    /** Look a key up on an object literal, quoted or not. */\n    private findProperty(obj: ObjectLiteralExpression, name: string): ObjectLiteralElementLike | undefined {\n        return obj.getProperty((p: ObjectLiteralElementLike) =>\n            \"getName\" in p &&\n            typeof (p as PropertyAssignment).getName === \"function\" &&\n            ((p as PropertyAssignment).getName() === name ||\n                (p as PropertyAssignment).getName() === `\"${name}\"` ||\n                (p as PropertyAssignment).getName() === `'${name}'`));\n    }\n\n    private static quoteKey(key: string): string {\n        return /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(key) ? key : JSON.stringify(key);\n    }\n\n    private static isPlainObject(value: unknown): value is Record<string, unknown> {\n        return typeof value === \"object\" && value !== null && !Array.isArray(value) && !(value instanceof RawExpression);\n    }\n\n    private convertJsonToAstString(obj: unknown, indentLevel = 0, oldAstNode?: ObjectLiteralExpression): string {\n        // Base TS-morph parses arrays as 2 levels deep from the property key:\n        // PropertiesObject = level 1, PropertyConfig = level 2.\n        // We calibrate the spacing multiples to keep the items flush with standard TS format.\n        const indentStr = \"    \";\n        const indent = indentStr.repeat(indentLevel);\n        const innerIndent = indentStr.repeat(indentLevel + 1);\n\n        if (obj instanceof RawExpression) {\n            return obj.text;\n        }\n        if (obj === null || obj === undefined) {\n            return \"undefined\";\n        }\n        if (typeof obj === \"string\") {\n            return JSON.stringify(obj);\n        }\n        if (typeof obj === \"number\" || typeof obj === \"boolean\") {\n            return String(obj);\n        }\n        if (Array.isArray(obj)) {\n            if (obj.length === 0) return \"[]\";\n            const items = obj.map(item => this.convertJsonToAstString(item, indentLevel + 1));\n            return `[\\n${innerIndent}${items.join(`,\\n${innerIndent}`)}\\n${indent}]`;\n        }\n        if (typeof obj === \"object\") {\n            const record = obj as Record<string, unknown>;\n            const keys = Object.keys(record);\n\n            // Collect preserved AST properties\n            const preservedProps: string[] = [];\n            if (oldAstNode) {\n                const oldProps = oldAstNode.getProperties();\n                for (const oldProp of oldProps) {\n                    if (oldProp.isKind(SyntaxKind.PropertyAssignment)) {\n                        const nameNode = oldProp.getNameNode();\n                        let name = nameNode.getText();\n                        if (name.startsWith('\"') && name.endsWith('\"')) name = name.slice(1, -1);\n                        if (name.startsWith(\"'\") && name.endsWith(\"'\")) name = name.slice(1, -1);\n\n                        // If the JSON object doesn't have this key, check if we should preserve it\n                        if (!(name in record)) {\n                            const init = oldProp.getInitializer();\n                            if (init) {\n                                const kind = init.getKind();\n                                const isCode = kind === SyntaxKind.ArrowFunction ||\n                                    kind === SyntaxKind.FunctionExpression ||\n                                    kind === SyntaxKind.Identifier ||\n                                    kind === SyntaxKind.CallExpression ||\n                                    kind === SyntaxKind.JsxElement;\n\n                                if (isCode || name === \"target\" || name === \"callbacks\" || name === \"browserCallbacks\" || name === \"permissions\" || name === \"securityRules\") {\n                                    // Preserve this property exactly as it was\n                                    preservedProps.push(`${AstSchemaEditor.quoteKey(name)}: ${init.getText()}`);\n                                }\n                            }\n                        }\n                    }\n                }\n            }\n\n            if (keys.length === 0 && preservedProps.length === 0) return \"{}\";\n\n            const props = keys.map(key => {\n                const keyStr = AstSchemaEditor.quoteKey(key);\n\n                // If the value is an object, pass the old AST node to recurse\n                let childAstNode: ObjectLiteralExpression | undefined;\n                if (oldAstNode && AstSchemaEditor.isPlainObject(record[key])) {\n                    const oldProp = this.findProperty(oldAstNode, key);\n                    if (oldProp && oldProp.isKind(SyntaxKind.PropertyAssignment)) {\n                        childAstNode = oldProp.getInitializerIfKind(SyntaxKind.ObjectLiteralExpression);\n                    }\n                }\n\n                return `${keyStr}: ${this.convertJsonToAstString(record[key], indentLevel + 1, childAstNode)}`;\n            });\n\n            const allProps = [...props, ...preservedProps];\n            return `{\\n${innerIndent}${allProps.join(`,\\n${innerIndent}`)}\\n${indent}}`;\n        }\n        return \"undefined\";\n    }\n\n    /**\n     * Write only the keys the patch names, leaving every sibling alone.\n     *\n     * A patch says what changed, not what the collection is. The panel sends one\n     * — `{ propertiesOrder }` is what adding a column posts — and rewriting the\n     * `admin` block from it deleted the collection's icon, group, list columns\n     * and kanban config in the same write.\n     */\n    private mergeIntoObjectLiteral(target: ObjectLiteralExpression, data: Record<string, unknown>, indentLevel: number): void {\n        for (const [key, value] of Object.entries(data)) {\n            const existing = this.findProperty(target, key);\n            const existingObj = existing && existing.isKind(SyntaxKind.PropertyAssignment)\n                ? existing.getInitializerIfKind(SyntaxKind.ObjectLiteralExpression)\n                : undefined;\n\n            if (existingObj && AstSchemaEditor.isPlainObject(value)) {\n                this.mergeIntoObjectLiteral(existingObj, value, indentLevel + 1);\n                continue;\n            }\n\n            const initializer = this.convertJsonToAstString(value, indentLevel, existingObj);\n            if (existing && existing.isKind(SyntaxKind.PropertyAssignment)) {\n                existing.setInitializer(initializer);\n            } else {\n                target.addPropertyAssignment({\n                    name: AstSchemaEditor.quoteKey(key),\n                    initializer\n                });\n            }\n        }\n    }\n\n    public async saveProperty(collectionId: string, propertyKey: string, propertyConfig: Record<string, unknown>) {\n        const collectionObj = this.requireCollectionObject(collectionId);\n\n        // The panel's property forms bind to the flat names — `readOnly`,\n        // `hideFromCollection` — while on disk they belong inside the property's\n        // own `admin` block. Written flat they are not merely ignored: the boot\n        // validator treats a moved key as fatal.\n        const nestedConfig = nestAdminPropertyKeys(propertyConfig);\n\n        let propertiesProp = collectionObj.getProperty(\"properties\") as PropertyAssignment;\n        if (!propertiesProp) {\n            propertiesProp = collectionObj.addPropertyAssignment({\n                name: \"properties\",\n                initializer: \"{}\"\n            });\n        }\n\n        const propsObj = propertiesProp.getInitializerIfKind(SyntaxKind.ObjectLiteralExpression);\n        if (propsObj) {\n            const existingProp = this.findProperty(propsObj, propertyKey);\n\n            let oldPropAstNode: ObjectLiteralExpression | undefined;\n            if (existingProp && existingProp.isKind(SyntaxKind.PropertyAssignment)) {\n                oldPropAstNode = existingProp.getInitializerIfKind(SyntaxKind.ObjectLiteralExpression);\n            }\n\n            const newInitializer = this.convertJsonToAstString(nestedConfig, 2, oldPropAstNode);\n\n            if (existingProp) {\n                if (existingProp.isKind(SyntaxKind.PropertyAssignment)) {\n                    existingProp.setInitializer(newInitializer);\n                }\n            } else {\n                propsObj.addPropertyAssignment({\n                    name: AstSchemaEditor.quoteKey(propertyKey),\n                    initializer: newInitializer\n                });\n            }\n\n            const file = this.getCollectionFile(collectionId);\n            if (file) {\n                file.formatText();\n            }\n            await this.project.save();\n        }\n    }\n\n    public async deleteProperty(collectionId: string, propertyKey: string) {\n        const collectionObj = this.requireCollectionObject(collectionId);\n\n        const propertiesProp = collectionObj.getProperty(\"properties\") as PropertyAssignment;\n        if (propertiesProp) {\n            const propsObj = propertiesProp.getInitializerIfKind(SyntaxKind.ObjectLiteralExpression);\n            if (propsObj) {\n                const existingProp = this.findProperty(propsObj, propertyKey);\n                if (existingProp) {\n                    existingProp.remove();\n                    const file = this.getCollectionFile(collectionId);\n                    if (file) {\n                        file.formatText();\n                    }\n                    await this.project.save();\n                }\n            }\n        }\n    }\n\n    /**\n     * Write a collection back to its file.\n     *\n     * `partial` is the difference between \"this is the collection\" and \"this is\n     * what changed about it\". The panel sends both — a full save from the editor\n     * dialog, and a one-key patch whenever a property is added, deleted or\n     * reordered — and they cannot be told apart by looking at the payload. Read\n     * as a full save, a patch deletes everything it does not mention, including\n     * `securityRules`; the loader then hands the collection the directory\n     * default, which in the scaffold is `access: \"public\"`.\n     */\n    public async saveCollection(collectionId: string, collectionData: Record<string, unknown>, options: { partial?: boolean } = {}) {\n        const partial = options.partial === true;\n        let file = this.getCollectionFile(collectionId);\n        const collectionObj = file ? this.getCollectionObject(collectionId) : null;\n\n        if (file && !collectionObj) {\n            // The file is there and we could not read it. Recreating it from the\n            // panel's JSON would drop the imports, the callbacks and the relation\n            // thunks that JSON cannot carry.\n            throw new Error(this.unreadableFileMessage(collectionId, file));\n        }\n\n        if (!file || !collectionObj) {\n            if (partial) {\n                throw new Error(`Cannot apply a partial update to \"${collectionId}\": it has no collection file yet.`);\n            }\n            // Create a new file\n            const safeId = this.sanitizeCollectionId(collectionId);\n            const newFilePath = this.safePath(`${safeId}.ts`);\n            if (fs.existsSync(newFilePath)) {\n                throw new Error(`Refusing to overwrite ${newFilePath}: a file for \"${collectionId}\" already exists but could not be parsed.`);\n            }\n            const varName = `${AstSchemaEditor.collectionVarName(safeId)}Collection`;\n            file = this.project.createSourceFile(newFilePath, `import { CollectionConfig } from \"@rebasepro/types\";\\n\\nconst ${varName}: CollectionConfig = ${this.convertJsonToAstString(nestAdminKeys(collectionData))};\\n\\nexport default ${varName};\\n`);\n        } else {\n            // Update root level properties gracefully\n\n            if (!partial) {\n                // Force delete securityRules if empty or undefined to handle Formex / serialization stripping\n                if (!(\"securityRules\" in collectionData) || collectionData.securityRules === undefined || (Array.isArray(collectionData.securityRules) && collectionData.securityRules.length === 0)) {\n                    const srProp = collectionObj.getProperty(\"securityRules\");\n                    if (srProp) {\n                        srProp.remove();\n                    }\n\n                    // If it was in collectionData as an empty array, delete it so the loop below doesn't add it back as \"[]\"\n                    // Actually, if it's \"[]\", omitting it entirely from the TS file achieves the same logical effect (no RLS rules)\n                    // and correctly triggers \"unmapped policies\" if the DB still has them.\n                    delete collectionData[\"securityRules\"];\n                }\n            }\n\n            // The panel works with a flat view model — presentation merged onto the\n            // collection — so what arrives here has `icon` and `listProperties` at\n            // the top level. On disk they belong inside `admin`. Writing them flat\n            // would produce a file the backend loads and ignores and the panel\n            // never reads back, which looks exactly like the edit not saving.\n            collectionData = nestAdminKeys(collectionData);\n\n            for (const key of Object.keys(collectionData)) {\n                if (key === \"relations\") {\n                    this.writeRelations(collectionId, file, collectionObj, collectionData[key]);\n                    continue;\n                }\n\n                const prop = collectionObj.getProperty(key) as PropertyAssignment;\n\n                let oldAstNode: ObjectLiteralExpression | undefined;\n                if (prop && prop.isKind(SyntaxKind.PropertyAssignment)) {\n                    oldAstNode = prop.getInitializerIfKind(SyntaxKind.ObjectLiteralExpression);\n                }\n\n                if (partial && oldAstNode && AstSchemaEditor.isPlainObject(collectionData[key])) {\n                    this.mergeIntoObjectLiteral(oldAstNode, collectionData[key] as Record<string, unknown>, 2);\n                    continue;\n                }\n\n                const newInit = this.convertJsonToAstString(collectionData[key], 1, oldAstNode);\n                if (prop) {\n                    prop.setInitializer(newInit);\n                } else {\n                    collectionObj.addPropertyAssignment({\n                        // `quoteKey`, like every other site that emits a key.\n                        // This one did not, and ts-morph writes a property name\n                        // out verbatim — so a top-level key of\n                        // `injected: (() => { … })(), tail` closed the property\n                        // and opened an expression, which `rebase dev` then\n                        // re-imported and ran. The rest of this file has always\n                        // quoted; this was the one that did not.\n                        name: AstSchemaEditor.quoteKey(key),\n                        initializer: newInit\n                    });\n                }\n            }\n        }\n        if (file) {\n            file.formatText();\n        }\n        await this.project.save();\n    }\n\n    /**\n     * Write the collection-level `relations` array.\n     *\n     * Relations are the one key whose values are not all data: `target` is a\n     * thunk in the file, and the panel sends the target collection's slug (or,\n     * for a relation it did not touch, nothing at all — `JSON.stringify` drops\n     * the function). So each entry's target is resolved in that order: a slug\n     * becomes `() => xCollection` plus the import it needs, and anything else\n     * falls back to the thunk already in the file.\n     *\n     * This used to be a `continue` with a comment saying relations were handled\n     * elsewhere. Nothing handled them; every edit in the Relations tab was\n     * dropped without a word.\n     */\n    private writeRelations(collectionId: string, file: SourceFile, collectionObj: ObjectLiteralExpression, value: unknown): void {\n        if (!Array.isArray(value)) return;\n\n        const existing = this.findProperty(collectionObj, \"relations\");\n        const oldArray = existing && existing.isKind(SyntaxKind.PropertyAssignment)\n            ? existing.getInitializerIfKind(SyntaxKind.ArrayLiteralExpression)\n            : undefined;\n\n        const oldElements = oldArray?.getElements() ?? [];\n        const oldTargetsByName = new Map<string, string>();\n        // Only for entries the file left unnamed — `relationName` is optional, and\n        // those cannot be matched any other way. Positional matching is off the\n        // moment the array's length changes, because then a position no longer\n        // means the same relation.\n        const anonymousTargetsByIndex: (string | undefined)[] = [];\n        oldElements.forEach((element, index) => {\n            const elementObj = element.asKind(SyntaxKind.ObjectLiteralExpression);\n            if (!elementObj) return;\n            const targetProp = this.findProperty(elementObj, \"target\");\n            const targetInit = targetProp && targetProp.isKind(SyntaxKind.PropertyAssignment)\n                ? targetProp.getInitializer()\n                : undefined;\n            if (!targetInit) return;\n\n            const nameProp = this.findProperty(elementObj, \"relationName\");\n            const nameInit = nameProp && nameProp.isKind(SyntaxKind.PropertyAssignment)\n                ? nameProp.getInitializerIfKind(SyntaxKind.StringLiteral)\n                : undefined;\n            if (nameInit) oldTargetsByName.set(nameInit.getLiteralValue(), targetInit.getText());\n            else anonymousTargetsByIndex[index] = targetInit.getText();\n        });\n\n        const items = value.map((entry, index) => {\n            if (!AstSchemaEditor.isPlainObject(entry)) return entry;\n            const relation: Record<string, unknown> = { ...entry };\n            const relationName = typeof relation.relationName === \"string\" ? relation.relationName : undefined;\n            const rawTarget = relation.target;\n\n            let targetText: string | undefined;\n            if (typeof rawTarget === \"string\" && rawTarget.trim().length > 0) {\n                const trimmed = rawTarget.trim();\n                // A target that already looks like a thunk is written into the\n                // file as source, so \"contains an arrow\" is not a good enough\n                // reason to trust it: `() => { require(\"child_process\")… }` also\n                // contains one. Only the exact shape this emits is accepted —\n                // an arrow returning one identifier — and anything else is\n                // treated as a collection NAME and turned into a thunk here,\n                // which is the path that was always safe.\n                targetText = ARROW_TO_IDENTIFIER.test(trimmed)\n                    ? trimmed\n                    : this.targetThunk(file, trimmed);\n            } else if (relationName && oldTargetsByName.has(relationName)) {\n                targetText = oldTargetsByName.get(relationName);\n            } else if (value.length === oldElements.length) {\n                targetText = anonymousTargetsByIndex[index];\n            }\n\n            if (!targetText) {\n                throw new Error(`Relation \"${relationName ?? `#${index}`}\" on collection \"${collectionId}\" has no target collection. Pick one before saving.`);\n            }\n\n            relation.target = new RawExpression(targetText);\n            return relation;\n        });\n\n        const initializer = this.convertJsonToAstString(items, 1);\n        if (existing && existing.isKind(SyntaxKind.PropertyAssignment)) {\n            existing.setInitializer(initializer);\n        } else {\n            collectionObj.addPropertyAssignment({ name: \"relations\", initializer });\n        }\n    }\n\n    /**\n     * `() => targetCollection` for a target named by its slug, importing it if\n     * the file does not already.\n     */\n    private targetThunk(file: SourceFile, targetSlug: string): string {\n        const targetFile = this.getCollectionFile(targetSlug);\n        if (!targetFile) {\n            throw new Error(`Cannot link to collection \"${targetSlug}\": no file for it in ${this.collectionsDir}.`);\n        }\n\n        const identifier = this.getDefaultExportName(targetFile);\n        if (!identifier) {\n            throw new Error(`Cannot link to collection \"${targetSlug}\": ${targetFile.getFilePath()} has no default export to import.`);\n        }\n\n        if (targetFile.getFilePath() !== file.getFilePath() && !this.hasDefaultImport(file, identifier)) {\n            const relative = path.relative(path.dirname(file.getFilePath()), targetFile.getFilePath())\n                .split(path.sep)\n                .join(\"/\")\n                .replace(/\\.tsx?$/, \".js\");\n            file.addImportDeclaration({\n                defaultImport: identifier,\n                moduleSpecifier: relative.startsWith(\".\") ? relative : `./${relative}`\n            });\n        }\n\n        return `() => ${identifier}`;\n    }\n\n    private hasDefaultImport(file: SourceFile, identifier: string): boolean {\n        return file.getImportDeclarations().some(decl => decl.getDefaultImport()?.getText() === identifier);\n    }\n\n    private getDefaultExportName(file: SourceFile): string | undefined {\n        const declaration = file.getDefaultExportSymbol()?.getDeclarations()[0];\n        const expr = declaration?.asKind(SyntaxKind.ExportAssignment)?.getExpression();\n        if (expr && expr.getKind() === SyntaxKind.Identifier) return expr.getText();\n\n        for (const varDecl of file.getVariableDeclarations()) {\n            if (this.unwrapCollectionObject(varDecl.getInitializer())) return varDecl.getName();\n        }\n        return undefined;\n    }\n\n    public async deleteCollection(collectionId: string) {\n        const file = this.getCollectionFile(collectionId);\n        if (file) {\n            file.deleteImmediatelySync();\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAcA,IAAM,uCAAuB,IAAI,IAAI,CAAC,kBAAkB,CAAC;;;;;;;;;;;;;;AAezD,IAAM,sBAAsB;;;;;;;;;AAU5B,IAAM,gBAAN,MAAoB;CACY;CAA5B,YAAY,MAA8B;EAAd,KAAA,OAAA;CAC5B;AACJ;;;;;;;;;;AAWA,SAAgB,cAAc,gBAAkE;CAC5F,OAAO,wBAAwB,cAAc;AACjD;AAEA,IAAa,kBAAb,MAAa,gBAAgB;CACzB;CACA;CAEA,YAAY,gBAAwB;EAChC,KAAK,UAAU,IAAI,QAAQ,EACvB,sBAAsB,EAClB,iBAAiB,gBAAgB,WACrC,EACJ,CAAC;EACD,IAAI,KAAG,WAAW,cAAc,GAC5B,KAAK,QAAQ,sBAAsB,GAAG,eAAe,SAAS;EAElE,KAAK,iBAAiB,OAAK,QAAQ,cAAc;CACrD;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4BA,OAAe,kBAAkB,QAAwB;EACrD,MAAM,QAAQ,OAAO,QAAQ,wBAAwB,GAAG,SAAiB,KAAK,YAAY,CAAC;EAC3F,MAAM,aAAa,6BAA6B,KAAK,KAAK,IAAI,QAAQ,IAAI,MAAM,QAAQ,WAAW,MAAM,CAAC;EAC1G,OAAO,6BAA6B,KAAK,UAAU,IAAI,aAAa,IAAI,WAAW,QAAQ,mBAAmB,EAAE;CACpH;CAEA,qBAA6B,cAA8B;EACvD,MAAM,YAAY,aAAa,QAAQ,mBAAmB,EAAE;EAC5D,IAAI,CAAC,aAAa,cAAc,cAC5B,MAAM,IAAI,MAAM,2BAA2B,aAAa,uEAAuE;EAEnI,OAAO;CACX;;;;CAKA,SAAiB,UAA0B;EACvC,MAAM,WAAW,OAAK,QAAQ,KAAK,gBAAgB,QAAQ;EAC3D,IAAI,CAAC,SAAS,WAAW,KAAK,iBAAiB,OAAK,GAAG,KAAK,aAAa,KAAK,gBAC1E,MAAM,IAAI,MAAM,8EAA8E;EAElG,OAAO;CACX;CAEA,kBAA0B,cAAsB;EAC5C,MAAM,SAAS,KAAK,qBAAqB,YAAY;EACrD,MAAM,WAAW,KAAK,SAAS,GAAG,OAAO,IAAI;EAC7C,IAAI,OAAO,KAAK,QAAQ,cAAc,QAAQ;EAC9C,IAAI,CAAC,QAAQ,KAAG,WAAW,QAAQ,GAAG;GAClC,KAAK,QAAQ,sBAAsB,GAAG,KAAK,eAAe,SAAS;GACnE,OAAO,KAAK,QAAQ,cAAc,QAAQ;EAC9C;EACA,OAAO;CACX;;;;;;;;;;;CAYA,uBAA+B,MAAwD;EACnF,IAAI,CAAC,MAAM,OAAO;EAClB,IAAI,KAAK,0BAA0B,IAAI,GAAG,OAAO;EACjD,IAAI,KAAK,0BAA0B,IAAI,KACnC,KAAK,eAAe,IAAI,KACxB,KAAK,sBAAsB,IAAI,KAC/B,KAAK,gBAAgB,IAAI,KACzB,KAAK,oBAAoB,IAAI,GAC7B,OAAO,KAAK,uBAAuB,KAAK,cAAc,CAAC;EAE3D,IAAI,KAAK,iBAAiB,IAAI,GAAG;GAE7B,MAAM,SAAS,KAAK,cAAc,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI;GAC7D,IAAI,UAAU,qBAAqB,IAAI,MAAM,GACzC,OAAO,KAAK,uBAAuB,KAAK,aAAa,CAAC,CAAC,EAAE;EAEjE;EACA,OAAO;CACX;CAEA,oBAA4B,cAAsD;EAC9E,MAAM,OAAO,KAAK,kBAAkB,YAAY;EAChD,IAAI,CAAC,MAAM,OAAO;EAElB,MAAM,gBAAgB,KAAK,uBAAuB;EAClD,IAAI,eAAe;GACf,MAAM,cAAc,cAAc,gBAAgB,CAAC,CAAC;GACpD,IAAI,eAAe,YAAY,QAAQ,MAAM,WAAW,kBAAkB;IACtE,MAAM,OAAO,YAAY,OAAO,WAAW,gBAAgB,CAAC,EAAE,cAAc;IAC5E,IAAI,QAAQ,KAAK,QAAQ,MAAM,WAAW,YAAY;KAClD,MAAM,UAAU,KAAK,QAAQ;KAC7B,MAAM,UAAU,KAAK,uBAAuB,OAAO;KACnD,MAAM,YAAY,KAAK,uBAAuB,SAAS,eAAe,CAAC;KACvE,IAAI,WAAW,OAAO;IAC1B,OAAO;KAEH,MAAM,YAAY,KAAK,uBAAuB,IAAI;KAClD,IAAI,WAAW,OAAO;IAC1B;GACJ;EACJ;EAEA,KAAK,MAAM,WAAW,KAAK,wBAAwB,GAAG;GAClD,MAAM,OAAO,KAAK,uBAAuB,QAAQ,eAAe,CAAC;GACjE,IAAI,MAAM,OAAO;EACrB;EACA,OAAO;CACX;;;;;;;;CASA,wBAAgC,cAA+C;EAC3E,MAAM,OAAO,KAAK,kBAAkB,YAAY;EAChD,IAAI,CAAC,MACD,MAAM,IAAI,MAAM,eAAe,aAAa,mBAAmB,OAAK,KAAK,KAAK,gBAAgB,GAAG,aAAa,IAAI,EAAE,EAAE;EAE1H,MAAM,gBAAgB,KAAK,oBAAoB,YAAY;EAC3D,IAAI,CAAC,eACD,MAAM,IAAI,MAAM,KAAK,sBAAsB,cAAc,IAAI,CAAC;EAElE,OAAO;CACX;CAEA,sBAA8B,cAAsB,MAA0B;EAC1E,OAAO,2CAA2C,KAAK,YAAY,EAAE,sLAGxD,aAAa;CAC9B;;CAGA,aAAqB,KAA8B,MAAoD;EACnG,OAAO,IAAI,aAAa,MACpB,aAAa,KACb,OAAQ,EAAyB,YAAY,eAC3C,EAAyB,QAAQ,MAAM,QACpC,EAAyB,QAAQ,MAAM,IAAI,KAAK,MAChD,EAAyB,QAAQ,MAAM,IAAI,KAAK,GAAG;CAChE;CAEA,OAAe,SAAS,KAAqB;EACzC,OAAO,6BAA6B,KAAK,GAAG,IAAI,MAAM,KAAK,UAAU,GAAG;CAC5E;CAEA,OAAe,cAAc,OAAkD;EAC3E,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK,KAAK,EAAE,iBAAiB;CACtG;CAEA,uBAA+B,KAAc,cAAc,GAAG,YAA8C;EAIxG,MAAM,YAAY;EAClB,MAAM,SAAS,UAAU,OAAO,WAAW;EAC3C,MAAM,cAAc,UAAU,OAAO,cAAc,CAAC;EAEpD,IAAI,eAAe,eACf,OAAO,IAAI;EAEf,IAAI,QAAQ,QAAQ,QAAQ,KAAA,GACxB,OAAO;EAEX,IAAI,OAAO,QAAQ,UACf,OAAO,KAAK,UAAU,GAAG;EAE7B,IAAI,OAAO,QAAQ,YAAY,OAAO,QAAQ,WAC1C,OAAO,OAAO,GAAG;EAErB,IAAI,MAAM,QAAQ,GAAG,GAAG;GACpB,IAAI,IAAI,WAAW,GAAG,OAAO;GAE7B,OAAO,MAAM,cADC,IAAI,KAAI,SAAQ,KAAK,uBAAuB,MAAM,cAAc,CAAC,CACpD,CAAA,CAAM,KAAK,MAAM,aAAa,EAAE,IAAI,OAAO;EAC1E;EACA,IAAI,OAAO,QAAQ,UAAU;GACzB,MAAM,SAAS;GACf,MAAM,OAAO,OAAO,KAAK,MAAM;GAG/B,MAAM,iBAA2B,CAAC;GAClC,IAAI,YAAY;IACZ,MAAM,WAAW,WAAW,cAAc;IAC1C,KAAK,MAAM,WAAW,UAClB,IAAI,QAAQ,OAAO,WAAW,kBAAkB,GAAG;KAE/C,IAAI,OADa,QAAQ,YACd,CAAA,CAAS,QAAQ;KAC5B,IAAI,KAAK,WAAW,IAAG,KAAK,KAAK,SAAS,IAAG,GAAG,OAAO,KAAK,MAAM,GAAG,EAAE;KACvE,IAAI,KAAK,WAAW,GAAG,KAAK,KAAK,SAAS,GAAG,GAAG,OAAO,KAAK,MAAM,GAAG,EAAE;KAGvE,IAAI,EAAE,QAAQ,SAAS;MACnB,MAAM,OAAO,QAAQ,eAAe;MACpC,IAAI,MAAM;OACN,MAAM,OAAO,KAAK,QAAQ;OAO1B,IANe,SAAS,WAAW,iBAC/B,SAAS,WAAW,sBACpB,SAAS,WAAW,cACpB,SAAS,WAAW,kBACpB,SAAS,WAAW,cAEV,SAAS,YAAY,SAAS,eAAe,SAAS,sBAAsB,SAAS,iBAAiB,SAAS,iBAEzH,eAAe,KAAK,GAAG,gBAAgB,SAAS,IAAI,EAAE,IAAI,KAAK,QAAQ,GAAG;MAElF;KACJ;IACJ;GAER;GAEA,IAAI,KAAK,WAAW,KAAK,eAAe,WAAW,GAAG,OAAO;GAkB7D,OAAO,MAAM,cAAc,CADT,GAfJ,KAAK,KAAI,QAAO;IAC1B,MAAM,SAAS,gBAAgB,SAAS,GAAG;IAG3C,IAAI;IACJ,IAAI,cAAc,gBAAgB,cAAc,OAAO,IAAI,GAAG;KAC1D,MAAM,UAAU,KAAK,aAAa,YAAY,GAAG;KACjD,IAAI,WAAW,QAAQ,OAAO,WAAW,kBAAkB,GACvD,eAAe,QAAQ,qBAAqB,WAAW,uBAAuB;IAEtF;IAEA,OAAO,GAAG,OAAO,IAAI,KAAK,uBAAuB,OAAO,MAAM,cAAc,GAAG,YAAY;GAC/F,CAEqB,GAAO,GAAG,cACJ,CAAA,CAAS,KAAK,MAAM,aAAa,EAAE,IAAI,OAAO;EAC7E;EACA,OAAO;CACX;;;;;;;;;CAUA,uBAA+B,QAAiC,MAA+B,aAA2B;EACtH,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,IAAI,GAAG;GAC7C,MAAM,WAAW,KAAK,aAAa,QAAQ,GAAG;GAC9C,MAAM,cAAc,YAAY,SAAS,OAAO,WAAW,kBAAkB,IACvE,SAAS,qBAAqB,WAAW,uBAAuB,IAChE,KAAA;GAEN,IAAI,eAAe,gBAAgB,cAAc,KAAK,GAAG;IACrD,KAAK,uBAAuB,aAAa,OAAO,cAAc,CAAC;IAC/D;GACJ;GAEA,MAAM,cAAc,KAAK,uBAAuB,OAAO,aAAa,WAAW;GAC/E,IAAI,YAAY,SAAS,OAAO,WAAW,kBAAkB,GACzD,SAAS,eAAe,WAAW;QAEnC,OAAO,sBAAsB;IACzB,MAAM,gBAAgB,SAAS,GAAG;IAClC;GACJ,CAAC;EAET;CACJ;CAEA,MAAa,aAAa,cAAsB,aAAqB,gBAAyC;EAC1G,MAAM,gBAAgB,KAAK,wBAAwB,YAAY;EAM/D,MAAM,eAAe,sBAAsB,cAAc;EAEzD,IAAI,iBAAiB,cAAc,YAAY,YAAY;EAC3D,IAAI,CAAC,gBACD,iBAAiB,cAAc,sBAAsB;GACjD,MAAM;GACN,aAAa;EACjB,CAAC;EAGL,MAAM,WAAW,eAAe,qBAAqB,WAAW,uBAAuB;EACvF,IAAI,UAAU;GACV,MAAM,eAAe,KAAK,aAAa,UAAU,WAAW;GAE5D,IAAI;GACJ,IAAI,gBAAgB,aAAa,OAAO,WAAW,kBAAkB,GACjE,iBAAiB,aAAa,qBAAqB,WAAW,uBAAuB;GAGzF,MAAM,iBAAiB,KAAK,uBAAuB,cAAc,GAAG,cAAc;GAElF,IAAI;QACI,aAAa,OAAO,WAAW,kBAAkB,GACjD,aAAa,eAAe,cAAc;GAAA,OAG9C,SAAS,sBAAsB;IAC3B,MAAM,gBAAgB,SAAS,WAAW;IAC1C,aAAa;GACjB,CAAC;GAGL,MAAM,OAAO,KAAK,kBAAkB,YAAY;GAChD,IAAI,MACA,KAAK,WAAW;GAEpB,MAAM,KAAK,QAAQ,KAAK;EAC5B;CACJ;CAEA,MAAa,eAAe,cAAsB,aAAqB;EAGnE,MAAM,iBAFgB,KAAK,wBAAwB,YAE5B,CAAA,CAAc,YAAY,YAAY;EAC7D,IAAI,gBAAgB;GAChB,MAAM,WAAW,eAAe,qBAAqB,WAAW,uBAAuB;GACvF,IAAI,UAAU;IACV,MAAM,eAAe,KAAK,aAAa,UAAU,WAAW;IAC5D,IAAI,cAAc;KACd,aAAa,OAAO;KACpB,MAAM,OAAO,KAAK,kBAAkB,YAAY;KAChD,IAAI,MACA,KAAK,WAAW;KAEpB,MAAM,KAAK,QAAQ,KAAK;IAC5B;GACJ;EACJ;CACJ;;;;;;;;;;;;CAaA,MAAa,eAAe,cAAsB,gBAAyC,UAAiC,CAAC,GAAG;EAC5H,MAAM,UAAU,QAAQ,YAAY;EACpC,IAAI,OAAO,KAAK,kBAAkB,YAAY;EAC9C,MAAM,gBAAgB,OAAO,KAAK,oBAAoB,YAAY,IAAI;EAEtE,IAAI,QAAQ,CAAC,eAIT,MAAM,IAAI,MAAM,KAAK,sBAAsB,cAAc,IAAI,CAAC;EAGlE,IAAI,CAAC,QAAQ,CAAC,eAAe;GACzB,IAAI,SACA,MAAM,IAAI,MAAM,qCAAqC,aAAa,kCAAkC;GAGxG,MAAM,SAAS,KAAK,qBAAqB,YAAY;GACrD,MAAM,cAAc,KAAK,SAAS,GAAG,OAAO,IAAI;GAChD,IAAI,KAAG,WAAW,WAAW,GACzB,MAAM,IAAI,MAAM,yBAAyB,YAAY,gBAAgB,aAAa,0CAA0C;GAEhI,MAAM,UAAU,GAAG,gBAAgB,kBAAkB,MAAM,EAAE;GAC7D,OAAO,KAAK,QAAQ,iBAAiB,aAAa,iEAAiE,QAAQ,uBAAuB,KAAK,uBAAuB,cAAc,cAAc,CAAC,EAAE,sBAAsB,QAAQ,IAAI;EACnP,OAAO;GAGH,IAAI,CAAC;QAEG,EAAE,mBAAmB,mBAAmB,eAAe,kBAAkB,KAAA,KAAc,MAAM,QAAQ,eAAe,aAAa,KAAK,eAAe,cAAc,WAAW,GAAI;KAClL,MAAM,SAAS,cAAc,YAAY,eAAe;KACxD,IAAI,QACA,OAAO,OAAO;KAMlB,OAAO,eAAe;IAC1B;;GAQJ,iBAAiB,cAAc,cAAc;GAE7C,KAAK,MAAM,OAAO,OAAO,KAAK,cAAc,GAAG;IAC3C,IAAI,QAAQ,aAAa;KACrB,KAAK,eAAe,cAAc,MAAM,eAAe,eAAe,IAAI;KAC1E;IACJ;IAEA,MAAM,OAAO,cAAc,YAAY,GAAG;IAE1C,IAAI;IACJ,IAAI,QAAQ,KAAK,OAAO,WAAW,kBAAkB,GACjD,aAAa,KAAK,qBAAqB,WAAW,uBAAuB;IAG7E,IAAI,WAAW,cAAc,gBAAgB,cAAc,eAAe,IAAI,GAAG;KAC7E,KAAK,uBAAuB,YAAY,eAAe,MAAiC,CAAC;KACzF;IACJ;IAEA,MAAM,UAAU,KAAK,uBAAuB,eAAe,MAAM,GAAG,UAAU;IAC9E,IAAI,MACA,KAAK,eAAe,OAAO;SAE3B,cAAc,sBAAsB;KAQhC,MAAM,gBAAgB,SAAS,GAAG;KAClC,aAAa;IACjB,CAAC;GAET;EACJ;EACA,IAAI,MACA,KAAK,WAAW;EAEpB,MAAM,KAAK,QAAQ,KAAK;CAC5B;;;;;;;;;;;;;;;CAgBA,eAAuB,cAAsB,MAAkB,eAAwC,OAAsB;EACzH,IAAI,CAAC,MAAM,QAAQ,KAAK,GAAG;EAE3B,MAAM,WAAW,KAAK,aAAa,eAAe,WAAW;EAK7D,MAAM,eAJW,YAAY,SAAS,OAAO,WAAW,kBAAkB,IACpE,SAAS,qBAAqB,WAAW,sBAAsB,IAC/D,KAAA,EAAA,EAEwB,YAAY,KAAK,CAAC;EAChD,MAAM,mCAAmB,IAAI,IAAoB;EAKjD,MAAM,0BAAkD,CAAC;EACzD,YAAY,SAAS,SAAS,UAAU;GACpC,MAAM,aAAa,QAAQ,OAAO,WAAW,uBAAuB;GACpE,IAAI,CAAC,YAAY;GACjB,MAAM,aAAa,KAAK,aAAa,YAAY,QAAQ;GACzD,MAAM,aAAa,cAAc,WAAW,OAAO,WAAW,kBAAkB,IAC1E,WAAW,eAAe,IAC1B,KAAA;GACN,IAAI,CAAC,YAAY;GAEjB,MAAM,WAAW,KAAK,aAAa,YAAY,cAAc;GAC7D,MAAM,WAAW,YAAY,SAAS,OAAO,WAAW,kBAAkB,IACpE,SAAS,qBAAqB,WAAW,aAAa,IACtD,KAAA;GACN,IAAI,UAAU,iBAAiB,IAAI,SAAS,gBAAgB,GAAG,WAAW,QAAQ,CAAC;QAC9E,wBAAwB,SAAS,WAAW,QAAQ;EAC7D,CAAC;EAED,MAAM,QAAQ,MAAM,KAAK,OAAO,UAAU;GACtC,IAAI,CAAC,gBAAgB,cAAc,KAAK,GAAG,OAAO;GAClD,MAAM,WAAoC,EAAE,GAAG,MAAM;GACrD,MAAM,eAAe,OAAO,SAAS,iBAAiB,WAAW,SAAS,eAAe,KAAA;GACzF,MAAM,YAAY,SAAS;GAE3B,IAAI;GACJ,IAAI,OAAO,cAAc,YAAY,UAAU,KAAK,CAAC,CAAC,SAAS,GAAG;IAC9D,MAAM,UAAU,UAAU,KAAK;IAQ/B,aAAa,oBAAoB,KAAK,OAAO,IACvC,UACA,KAAK,YAAY,MAAM,OAAO;GACxC,OAAO,IAAI,gBAAgB,iBAAiB,IAAI,YAAY,GACxD,aAAa,iBAAiB,IAAI,YAAY;QAC3C,IAAI,MAAM,WAAW,YAAY,QACpC,aAAa,wBAAwB;GAGzC,IAAI,CAAC,YACD,MAAM,IAAI,MAAM,aAAa,gBAAgB,IAAI,QAAQ,mBAAmB,aAAa,oDAAoD;GAGjJ,SAAS,SAAS,IAAI,cAAc,UAAU;GAC9C,OAAO;EACX,CAAC;EAED,MAAM,cAAc,KAAK,uBAAuB,OAAO,CAAC;EACxD,IAAI,YAAY,SAAS,OAAO,WAAW,kBAAkB,GACzD,SAAS,eAAe,WAAW;OAEnC,cAAc,sBAAsB;GAAE,MAAM;GAAa;EAAY,CAAC;CAE9E;;;;;CAMA,YAAoB,MAAkB,YAA4B;EAC9D,MAAM,aAAa,KAAK,kBAAkB,UAAU;EACpD,IAAI,CAAC,YACD,MAAM,IAAI,MAAM,8BAA8B,WAAW,uBAAuB,KAAK,eAAe,EAAE;EAG1G,MAAM,aAAa,KAAK,qBAAqB,UAAU;EACvD,IAAI,CAAC,YACD,MAAM,IAAI,MAAM,8BAA8B,WAAW,KAAK,WAAW,YAAY,EAAE,kCAAkC;EAG7H,IAAI,WAAW,YAAY,MAAM,KAAK,YAAY,KAAK,CAAC,KAAK,iBAAiB,MAAM,UAAU,GAAG;GAC7F,MAAM,WAAW,OAAK,SAAS,OAAK,QAAQ,KAAK,YAAY,CAAC,GAAG,WAAW,YAAY,CAAC,CAAC,CACrF,MAAM,OAAK,GAAG,CAAC,CACf,KAAK,GAAG,CAAC,CACT,QAAQ,WAAW,KAAK;GAC7B,KAAK,qBAAqB;IACtB,eAAe;IACf,iBAAiB,SAAS,WAAW,GAAG,IAAI,WAAW,KAAK;GAChE,CAAC;EACL;EAEA,OAAO,SAAS;CACpB;CAEA,iBAAyB,MAAkB,YAA6B;EACpE,OAAO,KAAK,sBAAsB,CAAC,CAAC,MAAK,SAAQ,KAAK,iBAAiB,CAAC,EAAE,QAAQ,MAAM,UAAU;CACtG;CAEA,qBAA6B,MAAsC;EAE/D,MAAM,QADc,KAAK,uBAAuB,CAAC,EAAE,gBAAgB,CAAC,CAAC,GAAA,EAC3C,OAAO,WAAW,gBAAgB,CAAC,EAAE,cAAc;EAC7E,IAAI,QAAQ,KAAK,QAAQ,MAAM,WAAW,YAAY,OAAO,KAAK,QAAQ;EAE1E,KAAK,MAAM,WAAW,KAAK,wBAAwB,GAC/C,IAAI,KAAK,uBAAuB,QAAQ,eAAe,CAAC,GAAG,OAAO,QAAQ,QAAQ;CAG1F;CAEA,MAAa,iBAAiB,cAAsB;EAChD,MAAM,OAAO,KAAK,kBAAkB,YAAY;EAChD,IAAI,MACA,KAAK,sBAAsB;CAEnC;AACJ"}

package/dist/auth/api-keys/api-key-routes.d.ts

@@ -13,6 +13,18 @@ import type { ApiKeyStore } from "./api-key-store.js";
 export interface ApiKeyRouteOptions {
     store: ApiKeyStore;
     serviceKey?: string;
+    /**
+     * Read the caller's roles from the database rather than from their token.
+     *
+     * Without it this router trusted the `roles` claim, and a key minted here
+     * never expires and may carry `admin: true` — so an administrator demoted
+     * an hour ago could still mint themselves permanent admin access, and the
+     * demotion would not take effect until a token nobody can see had run out.
+     * See `createRequireAuth`.
+     */
+    resolveRoles?: (uid: string) => Promise<string[]>;
+    /** Repository for the token-revocation watermark. See `createRequireAuth`. */
+    revocationRepo?: Pick<import("../interfaces.js").AuthRepository, "getTokensValidAfter">;
 }
 /**
  * Create admin routes for API key management.

package/dist/auth/auth-hooks.d.ts

@@ -147,8 +147,19 @@ export interface AuthHooks {
     /**
      * Customize JWT access token claims before signing.
      *
-     * Return the modified claims object. The returned claims are merged
-     * into the JWT payload alongside standard claims (uid, roles).
+     * Return the modified claims object. The returned claims are merged into
+     * the JWT payload BESIDE the identity claims, never over them: `uid`,
+     * `roles` and `aal` are written last and a value returned for any of them
+     * is discarded.
+     *
+     * That is not a limitation of the hook, it is what keeps it safe to have.
+     * `uid` is who the whole request is — down to the identity the database
+     * evaluates its policies against — `roles` is what the admin gate reads,
+     * and `aal` is whether a second factor was actually passed. The obvious
+     * implementation of this hook spreads the claims it was handed and adds a
+     * field, and one that merges a user-controlled profile object returns
+     * whatever that object happened to contain. Add facts about a session
+     * here; the session's subject is decided by the server.
      *
      * @param claims - The default claims that would be included.
      * @param user - The authenticated user data.

package/dist/auth/exclude-auth-secrets.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Force `excludeFromApi` onto the auth collection's secret columns.
+ *
+ * Mutates in place and must therefore run BEFORE the collections are registered:
+ * each registry re-normalizes what it is given, and a flag set afterwards
+ * reaches whichever copy happened to be mutated and no others.
+ *
+ * @returns the columns it had to fix, per collection — for the caller to log and
+ *          for tests to assert on.
+ */
+export declare function enforceAuthSecretExclusion(collections: readonly unknown[]): Array<{
+    slug: string;
+    columns: string[];
+}>;

package/dist/auth/jwt.d.ts

@@ -33,6 +33,21 @@ export interface AccessTokenPayload {
     roles: string[];
     /** Authentication Assurance Level: aal1 = password/oauth, aal2 = MFA verified */
     aal?: "aal1" | "aal2";
+    /**
+     * Whether this session is a GUEST: anonymous sign-in rather than an account.
+     *
+     * An identity claim, written by the server and never taken from a custom
+     * claims hook — see {@link generateAccessToken}. It is here rather than
+     * looked up per request because everything downstream needs it and nothing
+     * downstream has a database: the RLS identity carries it into
+     * `rebase.is_anonymous()`, and the WebSocket path has only the token.
+     *
+     * Absent means "not a guest". A token minted before this claim existed is
+     * therefore read as an ordinary account, which is the behaviour that
+     * deployment already had — the alternative would reclassify every session
+     * in flight at the moment of a deploy.
+     */
+    isAnonymous?: boolean;
     /**
      * When the token was issued, in seconds since the epoch — the standard JWT
      * `iat` claim, which the signer behind `jwt-crypto.ts` sets on every token
@@ -90,7 +105,13 @@ export declare function isJwtConfigured(): boolean;
 /**
  * Generate an access token (short-lived, 1 hour by default)
  */
-export declare function generateAccessToken(uid: string, roles: string[], aal?: "aal1" | "aal2", customClaims?: Record<string, unknown>): Promise<string>;
+export declare function generateAccessToken(uid: string, roles: string[], aal?: "aal1" | "aal2", customClaims?: Record<string, unknown>, 
+/**
+ * Whether this session is a guest — anonymous sign-in rather than an
+ * account. Written into the token so the RLS identity and the WebSocket
+ * path can tell the two apart without a database lookup.
+ */
+isAnonymous?: boolean): Promise<string>;
 /**
  * Get the expiration time of an access token in milliseconds from now
  */

package/dist/auth/mfa-routes.d.ts

@@ -1,4 +1,4 @@
-import { Hono } from "hono";
+import { Hono, type MiddlewareHandler } from "hono";
 import { z } from "zod";
 import { HonoEnv } from "../api/types.js";
 import type { AuthModuleConfig } from "./routes.js";
@@ -7,6 +7,15 @@ import type { AuthResponsePayload, TransformAuthResponseContext } from "@rebasep
 interface MfaRoutesConfig {
     router: Hono<HonoEnv>;
     config: AuthModuleConfig;
+    /**
+     * The caller's guard for a signed-in user, with the revocation watermark
+     * consulted. Enrolling, confirming or removing a factor is a persistence
+     * move — the second one the 2026-09-02 audit named — so a token the user
+     * has signed out everywhere must not reach it. `routes.ts` builds this
+     * from the same repository the refresh path checks; the plain
+     * `requireAuth` only verifies the signature.
+     */
+    requireLiveSession: MiddlewareHandler<HonoEnv>;
     ops: ReturnType<typeof resolveAuthHooks>;
     parseBody: <T>(schema: z.ZodSchema<T>, body: unknown) => T;
     buildAuthResponse: (user: {

package/dist/auth/middleware.d.ts

@@ -3,6 +3,7 @@ import type { AuthRepository } from "./interfaces.js";
 import { DataDriver } from "@rebasepro/types";
 import { AccessTokenPayload } from "./jwt.js";
 import type { HonoEnv } from "../api/types.js";
+import { ApiError } from "../api/errors.js";
 import type { ApiKeyStore } from "./api-keys/api-key-store.js";
 import { extractBearerToken } from "./bearer-token.js";
 export { extractBearerToken };
@@ -62,6 +63,27 @@ export interface AuthMiddlewareOptions {
      */
     apiKeyStore?: ApiKeyStore;
 }
+/**
+ * Answer a refusal with the canonical envelope, through the same formatter
+ * every route uses.
+ *
+ * These middlewares used to hand-build `c.json({ error: { message, code } },
+ * 401)` — seven near-copies of it, which is how they came to omit `requestId`
+ * while every other error on the server carried it: the one string a bug report
+ * quotes was missing from precisely the errors an app hits most. It also meant
+ * a routine 401 (a client refreshing before it knows whether a session exists)
+ * logged like an incident, because `ApiError.expected` never reached the
+ * logger.
+ *
+ * `errorHandler` is *called* rather than thrown to. A throw only becomes an
+ * envelope where an `onError` is registered, and these middlewares are mounted
+ * by callers this package does not control — `defineFunction` hands users a
+ * Hono app and invites them to put `requireAuth` on a route of it. Making the
+ * status depend on the mount point would turn a 401 into a 500 for exactly
+ * those callers. Calling the formatter directly gets the envelope with none of
+ * that.
+ */
+export declare function refuse(c: Context<HonoEnv>, error: ApiError): Response;
 /**
  * Hono middleware that requires a valid JWT token via Authorization header.
  * Returns 401 if token is missing or invalid.

package/dist/auth/rate-limiter.d.ts

@@ -94,6 +94,56 @@ export declare const strictAuthLimiter: MiddlewareHandler<HonoEnv>;
  * useless as a mail bomb. Unauthenticated requests fall back to the IP bucket so
  * the limiter is never a no-op if it is ever mounted before the auth middleware.
  */
+/**
+ * Read the recipient address out of the body, so a limiter can key on it.
+ *
+ * A limiter runs before the handler, and Hono caches a parsed body — so this
+ * reads a clone, stashes the address, and lets the handler read the same
+ * request normally. Without it the limiters below have no account to key on
+ * and collapse into one global bucket, which is a limiter in name only.
+ *
+ * A malformed body is left to the handler, which reports it with the message
+ * that names the field; failing here would answer 429 to bad JSON.
+ */
+export declare const captureRecipientEmail: MiddlewareHandler<HonoEnv>;
+/**
+ * Per-ADDRESS throttle for a route that mails an address the caller named.
+ *
+ * `strictAuthLimiter` bounds a machine, and a machine is the attacker's to
+ * multiply. The mailbox being filled belongs to somebody who cannot rotate
+ * anything, and the domain the messages come from is this deployment's
+ * reputation — so a distributed run against one address passed the IP limiter
+ * untouched and cost the operator their sender score.
+ *
+ * Five per fifteen minutes: generous for "I didn't get it, send it again",
+ * useless as a mail bomb. The same numbers as `verificationEmailLimiter`,
+ * which bounds the same act for a signed-in caller.
+ *
+ * Falls back to the IP bucket for a request whose body named no address, so
+ * the limiter is never silently a no-op.
+ */
+export declare const recipientEmailLimiter: MiddlewareHandler<HonoEnv>;
+/**
+ * How long a route that answers "if an account exists…" takes, whoever asked.
+ *
+ * These routes deliberately answer the same words for a known and an unknown
+ * address. They did not take the same TIME: a known address meant a token
+ * insert, a template render and an SMTP round trip, and an unknown one meant
+ * returning immediately. That difference is measurable from anywhere, so an
+ * endpoint that refuses to say whether an account exists said it anyway, one
+ * address at a time.
+ *
+ * The mail is sent off the response path at each call site, which removes the
+ * largest and most variable part; this floor covers the rest without requiring
+ * the two branches to be instruction-for-instruction equal, which is not a
+ * property anyone can maintain across a refactor.
+ *
+ * 400ms is chosen to sit above the slow branch rather than to be pleasant: it
+ * is a step a person takes once, and the alternative is an enumeration oracle.
+ */
+export declare const RECIPIENT_ROUTE_FLOOR_MS = 400;
+/** Hold a result until at least `floorMs` has passed since `startedAt`. */
+export declare function notBefore<T>(startedAt: number, floorMs: number, result: T): Promise<T>;
 export declare const verificationEmailLimiter: MiddlewareHandler<HonoEnv>;
 /**
  * Key generator for API-key-based rate limiting.

package/dist/auth/registration-policy.d.ts

@@ -44,7 +44,34 @@ export interface RegistrationPolicy {
      * first and only pays for the count when that says no.
      */
     needsSetup: boolean;
+    /**
+     * Whether an empty table may still be claimed by whoever registers first.
+     * Defaults to {@link isBootstrapWindowOpen}; tests pass it explicitly.
+     */
+    bootstrapWindowOpen?: boolean;
 }
+/**
+ * Whether the first-come-first-admin window exists at all.
+ *
+ * On a laptop it should: the person at the keyboard is the operator, and a
+ * fresh database that nobody can administer is a dead end. On anything with a
+ * public hostname it must not: the shipped artifacts bring DNS and TLS up
+ * before the operator has typed anything, `GET /auth/config` advertises
+ * `needsSetup`, and whoever reaches `POST /auth/register` first owns the
+ * deployment. So the window is open outside production and closed inside it,
+ * where the operator names the first admin with `REBASE_ADMIN_EMAIL` /
+ * `REBASE_ADMIN_PASSWORD` (see `seed-admin.ts`) or assigns the role with the
+ * service key — two ways in, neither of which is a race.
+ */
+export declare function isBootstrapWindowOpen(env?: {
+    NODE_ENV?: string;
+}): boolean;
+/**
+ * What to tell a caller who hit an empty production database with the window
+ * shut. Named here so the register route and the bootstrap route say the same
+ * thing.
+ */
+export declare const SETUP_REQUIRED_MESSAGE: string;
 /** The full predicate, for callers that already know whether setup is needed. */
 export declare function isRegistrationOpen(policy: RegistrationPolicy): boolean;
 /**

package/dist/auth/rls-scope.d.ts

@@ -50,7 +50,15 @@ export declare const SERVICE_IDENTITY: {
  * @param user   - The authenticated user identity for RLS.
  * @returns The RLS-scoped DataDriver (or the original if RLS is unsupported).
  */
-export declare function scopeDataDriver(driver: DataDriver, user: {
+export declare function scopeDataDriver(driver: DataDriver, 
+/**
+ * `isAnonymous` rides along so a policy can tell a GUEST — an anonymous
+ * sign-in — from an account. It is a real user row with a real uid, so
+ * without this the database sees the same principal either way. See
+ * `rebase.is_anonymous()`.
+ */
+user: {
     uid: string;
     roles?: string[];
+    isAnonymous?: boolean;
 }): Promise<DataDriver>;

package/dist/auth/routes.d.ts

@@ -99,7 +99,14 @@ export interface CookieAuthConfig {
     path?: string;
     /** SameSite attribute (default: "Lax"). */
     sameSite?: "Strict" | "Lax" | "None";
-    /** Force the Secure flag. Defaults to `true` when SameSite is "None", otherwise auto-detected from the request protocol. */
+    /**
+     * The Secure flag. Defaults to `true`, and `false` is the only way off —
+     * see `AUTH_COOKIE_SECURE`. It used to be inferred from the request
+     * protocol, which reads `http` behind any TLS-terminating proxy, so a
+     * months-lived credential travelled in cleartext in the commonest
+     * production topology. Set it `false` only for a deployment genuinely
+     * served over plain http.
+     */
     secure?: boolean;
 }
 export declare function createAuthRoutes(config: AuthModuleConfig): Hono<HonoEnv>;

package/dist/auth/seed-admin.d.ts

@@ -0,0 +1,73 @@
+import type { UserManagementAdapter } from "@rebasepro/types";
+/**
+ * Create the operator's admin account from the environment, before anyone else
+ * can claim it.
+ *
+ * Every fresh Rebase deployment has a window between "the database is empty"
+ * and "the operator has registered", and the registration policy deliberately
+ * admits the first registration and promotes it to admin — otherwise an empty
+ * database is a dead end, since `POST /admin/bootstrap` needs a caller who is
+ * already signed in. That is a reasonable rule for a laptop and a bad one for
+ * anything with a public hostname: the shipped artifacts bring DNS and TLS up
+ * before their operator has typed anything, so the window is open to the
+ * internet, and whoever reaches the form first owns the deployment.
+ *
+ * A closed window needs a way in that is not a race, which is this: the
+ * operator names the first account in the same place they already put the
+ * database URL and the JWT secret. Then the artifacts can ship with
+ * self-registration off and nothing is left to be claimed.
+ *
+ * Runs only against an EMPTY user table. Not "no admin exists" — a deployment
+ * that has users has already been bootstrapped, and minting an admin into it
+ * from an environment variable would be a way to take over a running system by
+ * editing a manifest.
+ *
+ * And runs only where the window it replaces is CLOSED — production. The two are
+ * one mechanism with two halves, and running both halves at once is what broke
+ * the documented first run: `rebase init` writes `REBASE_ADMIN_EMAIL` and a
+ * generated password into `.env` for the compose stack, `rebase dev` reads the
+ * same `.env`, and the account appeared before the developer opened the app. The
+ * quickstart's first step — register, become the admin — then produced a
+ * role-less account, because the table was no longer empty and the window had
+ * been spent by a boot nobody watched. Outside production the first registration
+ * is the way in, so the variables are announced and ignored.
+ */
+export interface SeedAdminEnv {
+    REBASE_ADMIN_EMAIL?: string;
+    REBASE_ADMIN_PASSWORD?: string;
+    /** Decides whether the seed is this deployment's way in at all. */
+    NODE_ENV?: string;
+}
+export type SeedAdminOutcome = 
+/** Created, with the new user's id. */
+{
+    status: "created";
+    uid: string;
+}
+/** Nothing was asked for. */
+ | {
+    status: "not-requested";
+}
+/** Asked for, but the deployment already has users. */
+ | {
+    status: "already-bootstrapped";
+}
+/**
+ * Asked for where the first registration is still the way in — development.
+ * Announced at boot and not acted on.
+ */
+ | {
+    status: "window-open";
+}
+/** Asked for incompletely, or the create failed. `reason` has been logged. */
+ | {
+    status: "skipped";
+    reason: string;
+};
+/**
+ * @param users  The adapter's user management, or undefined when the deployment
+ *               has no built-in user store to seed into.
+ * @param env    Where the credentials come from. Injected so the test does not
+ *               have to mutate `process.env`.
+ */
+export declare function seedInitialAdmin(users: UserManagementAdapter | undefined, env?: SeedAdminEnv): Promise<SeedAdminOutcome>;

package/dist/auth/session-routes.d.ts

@@ -1,12 +1,22 @@
 import { Hono } from "hono";
 import { z } from "zod";
 import { HonoEnv } from "../api/types.js";
+import type { MiddlewareHandler } from "hono";
 import type { AuthModuleConfig } from "./routes.js";
 import type { AuthResponsePayload, TransformAuthResponseContext } from "@rebasepro/types";
 import type { resolveAuthHooks } from "./auth-hooks.js";
 interface SessionRoutesConfig {
     router: Hono<HonoEnv>;
     config: AuthModuleConfig;
+    /**
+     * The caller's guard for a signed-in user, with the revocation watermark
+     * consulted. Listing and revoking sessions, `/me`, user lookup and linking
+     * an anonymous account all describe or change the account, and a token the
+     * user has signed out everywhere must not reach them. `routes.ts` builds
+     * this from the same repository the refresh path checks; the plain
+     * `requireAuth` only verifies the signature.
+     */
+    requireLiveSession: MiddlewareHandler<HonoEnv>;
     ops: ReturnType<typeof resolveAuthHooks>;
     parseBody: <T>(schema: z.ZodSchema<T>, body: unknown) => T;
     buildAuthResponse: (user: {