@rebasepro/server 0.17.3 → 0.18.0

package/dist/{auth-DkbzMZUS.js → auth-BRiOuyq8.js}

@@ -3,15 +3,17 @@ import __rebaseProcess from "process";
 globalThis.process ??= __rebaseProcess;
 __rebaseCreateRequire(import.meta.url);
 import { i as __toESM, n as __exportAll } from "./rolldown-runtime-dW7B1o5h.js";
-import { D as isAnonymousUid, E as ANONYMOUS_USER_ID } from "./src-C9gKj23J.js";
-import "./src-CcOl05Oq.js";
-import { n as createDdlBootstrapper, o as isSQLAdmin } from "./ddl-bootstrap-5YZCZ8qk.js";
-import { D as randomInt$1, E as constantTimeEqual, O as sha256Hex, S as canonicalStorageId, T as require_jsonwebtoken, _ as verifyMfaPendingToken, a as generateMfaPendingToken, c as getJwks, d as hasAsymmetricSigningKey, f as hashRefreshToken, g as verifyDownloadToken, h as verifyAccessToken, i as generateDownloadToken, l as getRefreshTokenExpiry, n as configureJwt, o as generateRefreshToken, p as isJwtConfigured, r as generateAccessToken, s as getAccessTokenExpiry, t as MAX_COOKIE_AGE_MS, u as getRefreshTokenTtlMs, w as tryCanonicalStorageKey } from "./jwt-DNeOn39r.js";
+import { A as ANONYMOUS_USER_ID, j as isAnonymousUid } from "./src-Dq-I3Ybx.js";
+import "./src-DHK4fHkw.js";
+import { n as createDdlBootstrapper, o as isSQLAdmin } from "./ddl-bootstrap-CfNvxMuK.js";
 import { t as revokeInternalTableSql } from "./internal-tables-DYVcFFSv.js";
-import { t as logger } from "./logger-DS03e908.js";
-import { n as errorHandler, t as ApiError } from "./errors-DBwpj9N8.js";
-import { a as resolveListLimitParam } from "./query-parser-DqXNaBIH.js";
-import { i as object, o as string } from "./schemas-DBxgjM9A.js";
+import { r as logger } from "./logger-DO2PZc4i.js";
+import { n as errorHandler, t as ApiError } from "./errors-HjfaPlvY.js";
+import { a as resolveListLimitParam } from "./query-parser-C68Q9EX4.js";
+import { S as sha256Hex, _ as verifyMfaPendingToken, a as generateMfaPendingToken, b as constantTimeEqual, c as getJwks, d as hasAsymmetricSigningKey, f as hashRefreshToken, g as verifyDownloadToken, h as verifyAccessToken, i as generateDownloadToken, l as getRefreshTokenExpiry, n as configureJwt, o as generateRefreshToken, p as isJwtConfigured, r as generateAccessToken, s as getAccessTokenExpiry, t as MAX_COOKIE_AGE_MS, u as getRefreshTokenTtlMs, x as randomInt$1, y as require_jsonwebtoken } from "./jwt-DkhXwMzR.js";
+import { n as hasAdministrativeRole, r as isAdministrativeRole, t as ADMINISTRATIVE_ROLES } from "./admin-roles-vYdp_Pil.js";
+import { c as tryCanonicalStorageKey, i as canonicalStorageId } from "./keys-g8lbVC_o.js";
+import { Rn as string, Tn as object } from "./schemas-C3234HWE.js";
 import { createHash, randomBytes, randomInt } from "node:crypto";
 import { Hono } from "hono";
 import { promisify } from "util";
@@ -205,35 +207,6 @@ async function isAccessTokenRevoked(authRepo, payload) {
 	return payload.iat < Math.floor(validAfter.getTime() / 1e3);
 }
 //#endregion
-//#region src/auth/admin-roles.ts
-/**
-* Which role names carry administrative privilege.
-*
-* One definition, because there used to be several and they disagreed.
-* `requireAdmin` accepted `admin` **or** `schema-admin`; the guard that refuses
-* a dangerous `defaultRole` compared against `admin` alone. So
-* `AUTH_DEFAULT_ROLE=schema-admin` passed the guard and made every public
-* registrant an administrator — and, since a `schema-admin` may edit users, one
-* of them could then grant themselves real `admin` and keep it.
-*
-* The guard and the check have to read the same list or the gap comes back, so
-* neither of them owns it.
-*
-* `schema-admin` is here deliberately: it can reach the schema editor and the
-* SQL surfaces, which is administrative by any definition that matters. If a
-* genuinely lesser role is added later, it does not belong in this list — it
-* belongs in a capability check of its own.
-*/
-var ADMINISTRATIVE_ROLES = ["admin", "schema-admin"];
-/** Does this single role name carry administrative privilege? */
-function isAdministrativeRole(role) {
-	return ADMINISTRATIVE_ROLES.includes(role);
-}
-/** Does any role in this list carry administrative privilege? */
-function hasAdministrativeRole(roles) {
-	return !!roles?.some(isAdministrativeRole);
-}
-//#endregion
 //#region src/auth/rls-scope.ts
 var import_jsonwebtoken = /* @__PURE__ */ __toESM(require_jsonwebtoken(), 1);
 /**
@@ -527,6 +500,29 @@ function createApiKeyPreAuth(options) {
 //#endregion
 //#region src/auth/middleware.ts
 /**
+* Answer a refusal with the canonical envelope, through the same formatter
+* every route uses.
+*
+* These middlewares used to hand-build `c.json({ error: { message, code } },
+* 401)` — seven near-copies of it, which is how they came to omit `requestId`
+* while every other error on the server carried it: the one string a bug report
+* quotes was missing from precisely the errors an app hits most. It also meant
+* a routine 401 (a client refreshing before it knows whether a session exists)
+* logged like an incident, because `ApiError.expected` never reached the
+* logger.
+*
+* `errorHandler` is *called* rather than thrown to. A throw only becomes an
+* envelope where an `onError` is registered, and these middlewares are mounted
+* by callers this package does not control — `defineFunction` hands users a
+* Hono app and invites them to put `requireAuth` on a route of it. Making the
+* status depend on the mount point would turn a 401 into a 500 for exactly
+* those callers. Calling the formatter directly gets the envelope with none of
+* that.
+*/
+function refuse(c, error) {
+	return errorHandler(error, c);
+}
+/**
 * Hono middleware that requires a valid JWT token via Authorization header.
 * Returns 401 if token is missing or invalid.
 *
@@ -539,15 +535,9 @@ function createApiKeyPreAuth(options) {
 var requireAuth = async (c, next) => {
 	if (c.get("user")) return next();
 	const token = extractBearerToken(c.req.header("authorization"));
-	if (token === void 0) return c.json({ error: {
-		message: "Authorization header missing or invalid",
-		code: "UNAUTHORIZED"
-	} }, 401);
+	if (token === void 0) return refuse(c, ApiError.unauthenticated("Authorization header missing or invalid"));
 	const payload = await verifyAccessToken(token);
-	if (!payload) return c.json({ error: {
-		message: "Invalid or expired token",
-		code: "UNAUTHORIZED"
-	} }, 401);
+	if (!payload) return refuse(c, ApiError.unauthenticated("Invalid or expired token"));
 	c.set("user", payload);
 	return next();
 };
@@ -562,18 +552,15 @@ var requireAuth = async (c, next) => {
 * to be accessed via service keys for scripts and server-to-server calls.
 */
 function createRequireAuth(options) {
-	if (!options?.serviceKey) return requireAuth;
+	if (!options?.serviceKey && !options?.resolveRoles && !options?.revocationRepo) return requireAuth;
 	const key = options.serviceKey;
 	const resolveRoles = options.resolveRoles;
 	const revocationRepo = options.revocationRepo;
 	return async (c, next) => {
 		if (c.get("user")) return next();
 		const token = extractBearerToken(c.req.header("authorization"));
-		if (token === void 0) return c.json({ error: {
-			message: "Authorization header missing or invalid",
-			code: "UNAUTHORIZED"
-		} }, 401);
-		if (safeCompare(token, key)) {
+		if (token === void 0) return refuse(c, ApiError.unauthenticated("Authorization header missing or invalid"));
+		if (key !== void 0 && safeCompare(token, key)) {
 			c.set("user", {
 				uid: "service",
 				roles: ["admin"]
@@ -581,19 +568,13 @@ function createRequireAuth(options) {
 			return next();
 		}
 		const payload = await verifyAccessToken(token);
-		if (!payload) return c.json({ error: {
-			message: "Invalid or expired token",
-			code: "UNAUTHORIZED"
-		} }, 401);
-		if (resolveRoles) try {
-			if (revocationRepo && await isAccessTokenRevoked(revocationRepo, payload)) return c.json({ error: {
-				message: "Session has been revoked",
-				code: "SESSION_REVOKED"
-			} }, 401);
-			c.set("user", {
+		if (!payload) return refuse(c, ApiError.unauthenticated("Invalid or expired token"));
+		if (resolveRoles || revocationRepo) try {
+			if (revocationRepo && await isAccessTokenRevoked(revocationRepo, payload)) return refuse(c, ApiError.unauthorized("Session has been revoked", "SESSION_REVOKED"));
+			c.set("user", resolveRoles ? {
 				...payload,
 				roles: await resolveRoles(payload.uid)
-			});
+			} : payload);
 			return next();
 		} catch (error) {
 			logger.warn("[Auth] Could not resolve roles for an admin-gated request", {
@@ -615,14 +596,8 @@ function createRequireAuth(options) {
 */
 var requireAdmin = async (c, next) => {
 	const user = c.get("user");
-	if (!user) return c.json({ error: {
-		message: "User not authenticated. requireAuth middleware is missing?",
-		code: "UNAUTHORIZED"
-	} }, 401);
-	if (!hasAdministrativeRole(typeof user === "object" && user !== null && "roles" in user ? user.roles || [] : [])) return c.json({ error: {
-		message: "Admin privileges required for this operation",
-		code: "FORBIDDEN"
-	} }, 403);
+	if (!user) return refuse(c, ApiError.unauthorized("User not authenticated. requireAuth middleware is missing?"));
+	if (!hasAdministrativeRole(typeof user === "object" && user !== null && "roles" in user ? user.roles || [] : [])) return refuse(c, ApiError.forbidden("Admin privileges required for this operation"));
 	return next();
 };
 /**
@@ -704,10 +679,7 @@ function createAuthMiddleware(options) {
 				roles: ["anon"]
 			}));
 		} catch (error) {
-			return c.json({ error: {
-				message: "Unauthorized",
-				code: "UNAUTHORIZED"
-			} }, 401);
+			return refuse(c, ApiError.unauthenticated("Unauthorized"));
 		}
 		else {
 			const token = extractBearerToken(c.req.header("authorization"));
@@ -741,7 +713,8 @@ function createAuthMiddleware(options) {
 					try {
 						const user = {
 							uid: payload.uid,
-							roles: payload.roles
+							roles: payload.roles,
+							isAnonymous: payload.isAnonymous === true
 						};
 						c.set("driver", await scopeDataDriver(driver, user));
 					} catch (error) {
@@ -751,10 +724,7 @@ function createAuthMiddleware(options) {
 							code: "INTERNAL_ERROR"
 						} }, 500);
 					}
-				} else return c.json({ error: {
-					message: "Invalid or expired token",
-					code: "UNAUTHORIZED"
-				} }, 401);
+				} else return refuse(c, ApiError.unauthenticated("Invalid or expired token"));
 			}
 			else try {
 				c.set("driver", await scopeDataDriver(driver, {
@@ -769,10 +739,7 @@ function createAuthMiddleware(options) {
 				} }, 500);
 			}
 		}
-		if (enforceAuth && !c.get("user")) return c.json({ error: {
-			message: "Unauthorized: Authentication required",
-			code: "UNAUTHORIZED"
-		} }, 401);
+		if (enforceAuth && !c.get("user")) return refuse(c, ApiError.unauthenticated("Unauthorized: Authentication required. This is the API-level gate, not a row rule — a collection granting public reads still needs a caller. Set AUTH_REQUIRE=false (or `auth.requireAuth: false`) to let RLS alone decide."));
 		return next();
 	};
 }
@@ -914,10 +881,7 @@ var fileTokenAuth = async (c, next) => {
 	* and without it, a client that forgets to forward `?storageId=` on the file
 	* URL reports a "path mismatch" for a path that matches perfectly.
 	*/
-	const denyMismatch = (outcome) => c.json({ error: {
-		message: outcome === "deny-storage" ? "Forbidden: Scoped token storage mismatch" : "Forbidden: Scoped token path mismatch",
-		code: "FORBIDDEN"
-	} }, 403);
+	const denyMismatch = (outcome) => refuse(c, ApiError.forbidden(outcome === "deny-storage" ? "Forbidden: Scoped token storage mismatch" : "Forbidden: Scoped token path mismatch"));
 	const bearerToken = extractBearerToken(authHeader);
 	if (bearerToken !== void 0) {
 		const payload = await verifyDownloadToken(bearerToken);
@@ -932,10 +896,7 @@ var fileTokenAuth = async (c, next) => {
 			}
 			if (outcome !== "no-path") return denyMismatch(outcome);
 		}
-		if (isFileRoute) return c.json({ error: {
-			message: "Unauthorized: Access JWT not allowed on file routes",
-			code: "UNAUTHORIZED"
-		} }, 401);
+		if (isFileRoute) return refuse(c, ApiError.unauthenticated("Unauthorized: Access JWT not allowed on file routes"));
 		return next();
 	}
 	if (queryToken) {
@@ -951,10 +912,7 @@ var fileTokenAuth = async (c, next) => {
 			}
 			if (outcome !== "no-path") return denyMismatch(outcome);
 		}
-		return c.json({ error: {
-			message: "Unauthorized: Invalid or unauthorized token",
-			code: "UNAUTHORIZED"
-		} }, 401);
+		return refuse(c, ApiError.unauthenticated("Unauthorized: Invalid or unauthorized token"));
 	}
 	return next();
 };
@@ -983,34 +941,27 @@ function createAdapterAuthMiddleware(options) {
 		try {
 			authenticatedUser = await adapter.verifyRequest(c.req.raw);
 		} catch (error) {
-			return c.json({ error: {
-				message: "Unauthorized",
-				code: "UNAUTHORIZED"
-			} }, 401);
+			return refuse(c, ApiError.unauthenticated("Unauthorized"));
 		}
 		if (authenticatedUser) {
 			c.set("user", {
 				uid: authenticatedUser.uid,
 				email: authenticatedUser.email,
-				roles: authenticatedUser.roles
+				roles: authenticatedUser.roles,
+				isAnonymous: authenticatedUser.isAnonymous === true
 			});
 			try {
 				c.set("driver", await scopeDataDriver(driver, {
 					uid: authenticatedUser.uid,
-					roles: authenticatedUser.roles
+					roles: authenticatedUser.roles,
+					isAnonymous: authenticatedUser.isAnonymous === true
 				}));
 			} catch (error) {
 				logger.error("[AUTH-ADAPTER] RLS scoping failed for authenticated user", { error });
-				return c.json({ error: {
-					message: "Internal authentication error",
-					code: "INTERNAL_ERROR"
-				} }, 500);
+				return refuse(c, ApiError.internal("Internal authentication error"));
 			}
 		} else {
-			if (presentedToken !== void 0) return c.json({ error: {
-				message: "Invalid or expired token",
-				code: "UNAUTHORIZED"
-			} }, 401);
+			if (presentedToken !== void 0) return refuse(c, ApiError.unauthenticated("Invalid or expired token"));
 			try {
 				c.set("driver", await scopeDataDriver(driver, {
 					uid: ANONYMOUS_USER_ID,
@@ -1018,16 +969,10 @@ function createAdapterAuthMiddleware(options) {
 				}));
 			} catch (error) {
 				logger.error("[AUTH-ADAPTER] Failed to create anon-scoped driver", { error });
-				return c.json({ error: {
-					message: "Server configuration error",
-					code: "INTERNAL_ERROR"
-				} }, 500);
+				return refuse(c, ApiError.internal("Server configuration error"));
 			}
 		}
-		if (enforceAuth && !c.get("user")) return c.json({ error: {
-			message: "Unauthorized: Authentication required",
-			code: "UNAUTHORIZED"
-		} }, 401);
+		if (enforceAuth && !c.get("user")) return refuse(c, ApiError.unauthenticated("Unauthorized: Authentication required. This is the API-level gate, not a row rule — a collection granting public reads still needs a caller. Set AUTH_REQUIRE=false (or `auth.requireAuth: false`) to let RLS alone decide."));
 		return next();
 	};
 }
@@ -1511,7 +1456,7 @@ If you weren't expecting this invitation, you can safely ignore this email.
 function getWelcomeEmailTemplate(user, appName = DEFAULT_APP_NAME, loginUrl, logoUrl) {
 	const greeting = getGreeting(user);
 	const url = loginUrl || "";
-	const subject = `¡Bienvenido/a a ${appName}!`;
+	const subject = `Welcome to ${appName}`;
 	const body = html`
 <!DOCTYPE html>
 <html>
@@ -1523,35 +1468,29 @@ function getWelcomeEmailTemplate(user, appName = DEFAULT_APP_NAME, loginUrl, log
 <body style="margin: 0; padding: 0; background-color: #f8fafc;">
     <div style="${styles.container}">${renderHeader(appName, logoUrl)}
         <div style="${styles.card}">
-            <h1 style="${styles.heading}">¡Bienvenido/a a ${appName}!</h1>
-            
-            <p style="${styles.paragraph}">
-                Hola ${greeting},
-            </p>
-            
+            <h1 style="${styles.heading}">Welcome to ${appName}</h1>
+
             <p style="${styles.paragraph}">
-                Tu cuenta en ${appName} ha sido creada exitosamente. 
-                Estamos encantados de tenerte con nosotros.
+                Hi ${greeting},
             </p>
-            
+
             <p style="${styles.paragraph}">
-                Ya puedes acceder a tu panel y empezar a explorar todas las oportunidades 
-                que tenemos para ti.
+                Your ${appName} account is ready.
             </p>
 
             ${url ? html`
             <div style="text-align: center;">
-                <a href="${url}" style="${styles.button}">Ir a mi Panel</a>
+                <a href="${url}" style="${styles.button}">Open ${appName}</a>
             </div>
             ` : raw("")}
-            
+
             <p style="${styles.paragraph}">
-                Si tienes alguna pregunta, no dudes en contactarnos respondiendo a este correo.
+                If you have any questions, just reply to this email.
             </p>
-            
+
             <div style="${styles.footer}">
                 <p style="margin: 0;">
-                    Este correo fue enviado porque se creó una cuenta con esta dirección de email en ${appName}.
+                    You received this because an account was created with this email address at ${appName}.
                 </p>
             </div>
         </div>
@@ -1560,17 +1499,15 @@ function getWelcomeEmailTemplate(user, appName = DEFAULT_APP_NAME, loginUrl, log
 </html>
     `;
 	const text = `
-¡Bienvenido/a a ${appName}!
-
-Hola ${greeting},
+Welcome to ${appName}
 
-Tu cuenta en ${appName} ha sido creada exitosamente. Estamos encantados de tenerte con nosotros.
+Hi ${greeting},
 
-Ya puedes acceder a tu panel y empezar a explorar todas las oportunidades que tenemos para ti.
+Your ${appName} account is ready.
 
-${url ? `Ir a mi panel: ${url}` : ""}
+${url ? `Open ${appName}: ${url}` : ""}
 
-Si tienes alguna pregunta, no dudes en contactarnos respondiendo a este correo.
+If you have any questions, just reply to this email.
     `.trim();
 	return {
 		subject,
@@ -2509,6 +2446,55 @@ var strictAuthLimiter = createRateLimiter({
 * useless as a mail bomb. Unauthenticated requests fall back to the IP bucket so
 * the limiter is never a no-op if it is ever mounted before the auth middleware.
 */
+/**
+* Read the recipient address out of the body, so a limiter can key on it.
+*
+* A limiter runs before the handler, and Hono caches a parsed body — so this
+* reads a clone, stashes the address, and lets the handler read the same
+* request normally. Without it the limiters below have no account to key on
+* and collapse into one global bucket, which is a limiter in name only.
+*
+* A malformed body is left to the handler, which reports it with the message
+* that names the field; failing here would answer 429 to bad JSON.
+*/
+var captureRecipientEmail = async (c, next) => {
+	try {
+		const body = await c.req.json();
+		if (typeof body?.email === "string") c.set("recipientEmail", body.email.trim().toLowerCase());
+	} catch {}
+	await next();
+};
+/**
+* Per-ADDRESS throttle for a route that mails an address the caller named.
+*
+* `strictAuthLimiter` bounds a machine, and a machine is the attacker's to
+* multiply. The mailbox being filled belongs to somebody who cannot rotate
+* anything, and the domain the messages come from is this deployment's
+* reputation — so a distributed run against one address passed the IP limiter
+* untouched and cost the operator their sender score.
+*
+* Five per fifteen minutes: generous for "I didn't get it, send it again",
+* useless as a mail bomb. The same numbers as `verificationEmailLimiter`,
+* which bounds the same act for a signed-in caller.
+*
+* Falls back to the IP bucket for a request whose body named no address, so
+* the limiter is never silently a no-op.
+*/
+var recipientEmailLimiter = createRateLimiter({
+	windowMs: 900 * 1e3,
+	limit: 5,
+	keyGenerator: (c) => {
+		const email = c.get("recipientEmail");
+		return email ? `recipient-email:${email}` : `recipient-email:ip:${defaultKeyGenerator(c)}`;
+	},
+	message: "Too many emails requested for this address, please try again later."
+});
+/** Hold a result until at least `floorMs` has passed since `startedAt`. */
+async function notBefore$1(startedAt, floorMs, result) {
+	const remaining = floorMs - (Date.now() - startedAt);
+	if (remaining > 0) await new Promise((resolve) => setTimeout(resolve, remaining));
+	return result;
+}
 var verificationEmailLimiter = createRateLimiter({
 	windowMs: 900 * 1e3,
 	limit: 5,
@@ -3176,7 +3162,7 @@ var mfaVerificationLimiter = createRateLimiter({
 	message: "Too many verification attempts for this account, please try again later."
 });
 function mountMfaRoutes(opts) {
-	const { router, config, ops, parseBody, buildAuthResponse, createSessionAndTokens, applyTransformHook } = opts;
+	const { router, config, ops, parseBody, buildAuthResponse, createSessionAndTokens, applyTransformHook, requireLiveSession } = opts;
 	const authRepo = config.authRepo;
 	const emailConfig = config.emailConfig;
 	/**
@@ -3217,7 +3203,7 @@ function mountMfaRoutes(opts) {
 	* POST /auth/mfa/enroll
 	* Start MFA enrollment: generate TOTP secret and recovery codes
 	*/
-	router.post("/mfa/enroll", strictAuthLimiter, requireAuth, async (c) => {
+	router.post("/mfa/enroll", strictAuthLimiter, requireLiveSession, async (c) => {
 		const userCtx = c.get("user");
 		if (!userCtx) throw ApiError.unauthorized("Not authenticated");
 		await requireStepUpForFactorChange(userCtx);
@@ -3250,7 +3236,7 @@ function mountMfaRoutes(opts) {
 	* POST /auth/mfa/verify
 	* Verify TOTP code to complete MFA enrollment
 	*/
-	router.post("/mfa/verify", strictAuthLimiter, requireAuth, mfaVerificationLimiter, async (c) => {
+	router.post("/mfa/verify", strictAuthLimiter, requireLiveSession, mfaVerificationLimiter, async (c) => {
 		const userCtx = c.get("user");
 		if (!userCtx) throw ApiError.unauthorized("Not authenticated");
 		await requireStepUpForFactorChange(userCtx);
@@ -3359,7 +3345,7 @@ function mountMfaRoutes(opts) {
 	* GET /auth/mfa/factors
 	* List enrolled MFA factors for the current user
 	*/
-	router.get("/mfa/factors", strictAuthLimiter, requireAuth, async (c) => {
+	router.get("/mfa/factors", strictAuthLimiter, requireLiveSession, async (c) => {
 		const userCtx = c.get("user");
 		if (!userCtx) throw ApiError.unauthorized("Not authenticated");
 		const factors = await authRepo.getMfaFactors(userCtx.uid);
@@ -3375,7 +3361,7 @@ function mountMfaRoutes(opts) {
 	* DELETE /auth/mfa/unenroll
 	* Remove an MFA factor
 	*/
-	router.delete("/mfa/unenroll", strictAuthLimiter, requireAuth, async (c) => {
+	router.delete("/mfa/unenroll", strictAuthLimiter, requireLiveSession, async (c) => {
 		const userCtx = c.get("user");
 		if (!userCtx) throw ApiError.unauthorized("Not authenticated");
 		if (userCtx.aal !== "aal2") throw ApiError.forbidden("MFA verification required to unenroll. Please re-authenticate with your second factor.", "AAL2_REQUIRED");
@@ -3440,10 +3426,32 @@ async function assertMfaSatisfied(authRepo, uid) {
 }
 //#endregion
 //#region src/auth/registration-policy.ts
+/**
+* Whether the first-come-first-admin window exists at all.
+*
+* On a laptop it should: the person at the keyboard is the operator, and a
+* fresh database that nobody can administer is a dead end. On anything with a
+* public hostname it must not: the shipped artifacts bring DNS and TLS up
+* before the operator has typed anything, `GET /auth/config` advertises
+* `needsSetup`, and whoever reaches `POST /auth/register` first owns the
+* deployment. So the window is open outside production and closed inside it,
+* where the operator names the first admin with `REBASE_ADMIN_EMAIL` /
+* `REBASE_ADMIN_PASSWORD` (see `seed-admin.ts`) or assigns the role with the
+* service key — two ways in, neither of which is a race.
+*/
+function isBootstrapWindowOpen(env = process.env) {
+	return env.NODE_ENV !== "production";
+}
+/**
+* What to tell a caller who hit an empty production database with the window
+* shut. Named here so the register route and the bootstrap route say the same
+* thing.
+*/
+var SETUP_REQUIRED_MESSAGE = "This deployment has no administrator yet, and in production the first account is not promoted automatically. Set REBASE_ADMIN_EMAIL and REBASE_ADMIN_PASSWORD before the first boot, or assign the admin role with the service key.";
 /** The full predicate, for callers that already know whether setup is needed. */
 function isRegistrationOpen(policy) {
 	if (policy.disableSelfRegistration) return false;
-	return policy.needsSetup || !!policy.allowRegistration;
+	return policy.needsSetup && (policy.bootstrapWindowOpen ?? isBootstrapWindowOpen()) || !!policy.allowRegistration;
 }
 /**
 * The same predicate with the bootstrap window assumed closed.
@@ -3492,7 +3500,7 @@ function isAnonymousAuthOpen(policy) {
 //#endregion
 //#region src/auth/session-routes.ts
 function mountSessionRoutes(opts) {
-	const { router, config, ops, parseBody, buildAuthResponse, createSessionAndTokens, applyTransformHook } = opts;
+	const { router, config, ops, parseBody, buildAuthResponse, createSessionAndTokens, applyTransformHook, requireLiveSession } = opts;
 	const authRepo = config.authRepo;
 	/**
 	* Refuse the anonymous routes unless the deployment opted in.
@@ -3535,7 +3543,7 @@ function mountSessionRoutes(opts) {
 		clearRefreshCookie(c, config.cookieAuth);
 		const accessToken = extractBearerToken(c.req.header("authorization"));
 		if (ops.afterLogout && accessToken !== void 0) {
-			const { verifyAccessToken } = await import("./jwt-DNeOn39r.js").then((n) => n.m);
+			const { verifyAccessToken } = await import("./jwt-DkhXwMzR.js").then((n) => n.m);
 			const payload = await verifyAccessToken(accessToken);
 			if (payload) ops.afterLogout(payload.uid).catch((err) => {
 				logger.error("[AuthHooks] afterLogout error", { error: err instanceof Error ? err.message : err });
@@ -3547,7 +3555,7 @@ function mountSessionRoutes(opts) {
 	* GET /auth/sessions
 	* Get active refresh tokens (sessions) for the current user
 	*/
-	router.get("/sessions", requireAuth, async (c) => {
+	router.get("/sessions", requireLiveSession, async (c) => {
 		const userCtx = c.get("user");
 		if (!userCtx) throw ApiError.unauthorized("Not authenticated");
 		const currentRefreshToken = c.req.header("x-refresh-token");
@@ -3573,7 +3581,7 @@ function mountSessionRoutes(opts) {
 	* DELETE /auth/sessions
 	* Delete all refresh tokens for the current user (remote logout every device)
 	*/
-	router.delete("/sessions", requireAuth, async (c) => {
+	router.delete("/sessions", requireLiveSession, async (c) => {
 		const userCtx = c.get("user");
 		if (!userCtx) throw ApiError.unauthorized("Not authenticated");
 		await authRepo.deleteAllRefreshTokensForUser(userCtx.uid);
@@ -3587,7 +3595,7 @@ function mountSessionRoutes(opts) {
 	* DELETE /auth/sessions/:id
 	* Delete a specific refresh token (remote logout)
 	*/
-	router.delete("/sessions/:id", requireAuth, async (c) => {
+	router.delete("/sessions/:id", requireLiveSession, async (c) => {
 		const userCtx = c.get("user");
 		if (!userCtx) throw ApiError.unauthorized("Not authenticated");
 		const id = c.req.param("id");
@@ -3604,7 +3612,7 @@ function mountSessionRoutes(opts) {
 	* GET /auth/me
 	* Get current authenticated user
 	*/
-	router.get("/me", requireAuth, async (c) => {
+	router.get("/me", requireLiveSession, async (c) => {
 		const userCtx = c.get("user");
 		if (!userCtx) throw ApiError.unauthorized("Not authenticated");
 		const result = await authRepo.getUserWithRoles(userCtx.uid);
@@ -3629,7 +3637,7 @@ function mountSessionRoutes(opts) {
 	* server function. Never returns the email, roles, metadata, or any other
 	* field of the looked-up user.
 	*/
-	if (config.allowUserLookup) router.post("/find-user", defaultAuthLimiter, requireAuth, async (c) => {
+	if (config.allowUserLookup) router.post("/find-user", defaultAuthLimiter, requireLiveSession, async (c) => {
 		if (!c.get("user")) throw ApiError.unauthorized("Not authenticated");
 		const { email } = parseBody(findUserSchema, await c.req.json());
 		const user = await authRepo.getUserByEmail(normalizeEmail(email));
@@ -3643,7 +3651,7 @@ function mountSessionRoutes(opts) {
 	* PATCH /auth/me
 	* Update current authenticated user profile
 	*/
-	router.patch("/me", requireAuth, async (c) => {
+	router.patch("/me", requireLiveSession, async (c) => {
 		const userCtx = c.get("user");
 		if (!userCtx) throw ApiError.unauthorized("Not authenticated");
 		const { displayName, photoURL } = parseBody(updateProfileSchema, await c.req.json());
@@ -3694,7 +3702,7 @@ function mountSessionRoutes(opts) {
 	* POST /auth/anonymous/link
 	* Upgrade an anonymous user to a permanent account with email/password
 	*/
-	router.post("/anonymous/link", strictAuthLimiter, requireAuth, async (c) => {
+	router.post("/anonymous/link", strictAuthLimiter, requireLiveSession, async (c) => {
 		assertAnonymousAuthOpen();
 		const userCtx = c.get("user");
 		if (!userCtx) throw ApiError.unauthorized("Not authenticated");
@@ -3853,6 +3861,53 @@ var otpVerificationLimiter = createRateLimiter({
 	message: "Too many verification attempts for this account, please try again later."
 });
 /**
+* Per-address throttle on code *delivery*.
+*
+* The verification limiter below has always been keyed per address; the send
+* route had only `strictAuthLimiter`, which is keyed per IP. An IP is the
+* attacker's to rotate and the mailbox under attack is not, so a distributed
+* run put an unbounded number of messages into one person's inbox — from this
+* deployment's domain, which is the reputation that pays for it.
+*
+* Five per fifteen minutes is generous for "I didn't get it, send it again"
+* and useless as a mail bomb, matching `verificationEmailLimiter`.
+*/
+var otpSendLimiter = createRateLimiter({
+	windowMs: 900 * 1e3,
+	limit: 5,
+	keyGenerator: (c) => {
+		return `otp-send:${c.get("otpEmail") ?? "unidentified"}`;
+	},
+	message: "Too many sign-in codes requested for this account, please try again later."
+});
+/**
+* How long the send route takes, whoever asked.
+*
+* The route answers the same words for a known and an unknown address, which is
+* the point — but it did not take the same TIME. A known address meant a token
+* insert, a template render and an SMTP round trip; an unknown one meant
+* returning immediately. The difference is measurable from anywhere, so the
+* endpoint that refuses to say whether an account exists said it anyway, one
+* address at a time and at whatever rate the IP limiter allowed.
+*
+* Two things close it, and both are needed. The mail is sent off the response
+* path (below), which removes the largest and most variable part. And the
+* handler is held to a floor, which covers the rest — the token write, the
+* template — without needing the two branches to be instruction-for-instruction
+* equal, which is not a property anyone can maintain.
+*
+* 400ms is chosen to sit above the slow branch's normal cost rather than to
+* be pleasant: it is a login step a person takes once, and the alternative is
+* an enumeration oracle.
+*/
+var OTP_SEND_FLOOR_MS = 400;
+/** Hold a result until at least `floorMs` has passed since `startedAt`. */
+async function notBefore(startedAt, floorMs, result) {
+	const remaining = floorMs - (Date.now() - startedAt);
+	if (remaining > 0) await new Promise((resolve) => setTimeout(resolve, remaining));
+	return result;
+}
+/**
 * Read the address out of the body and put it where the limiter can key on it.
 *
 * The limiter runs before the handler, and Hono has already consumed nothing —
@@ -3884,12 +3939,13 @@ function mountOtpRoutes(deps) {
 	* alternative is an oracle that turns this endpoint into a way to ask "is
 	* this person a customer?", one address at a time.
 	*/
-	router.post("/otp", strictAuthLimiter, ...captchaMiddleware ? [captchaMiddleware] : [], async (c) => {
+	router.post("/otp", strictAuthLimiter, captureOtpEmail, otpSendLimiter, ...captchaMiddleware ? [captchaMiddleware] : [], async (c) => {
+		const startedAt = Date.now();
 		const { email } = parseBody(requestSchema, await c.req.json());
 		if (!isEmailConfigured()) throw ApiError.serviceUnavailable("Email service not configured. One-time code login is not available.", "EMAIL_NOT_CONFIGURED");
 		const user = await authRepo.getUserByEmail(email);
+		if (ops.beforeLogin) await ops.beforeLogin(email, "otp");
 		if (user) {
-			if (ops.beforeLogin) await ops.beforeLogin(email, "otp");
 			const code = generateOtpCode();
 			await authRepo.createMagicLinkToken(user.id, hashToken(otpTokenMaterial(user.email, code)), new Date(Date.now() + OTP_TTL_MS));
 			const { appName, logoUrl } = resolveEmailBranding(emailConfig);
@@ -3901,22 +3957,20 @@ function mountOtpRoutes(deps) {
 				email: user.email,
 				displayName: user.displayName
 			}, appName, logoUrl);
-			try {
-				await emailService.send({
-					to: user.email,
-					subject: content.subject,
-					html: content.html,
-					text: content.text
-				});
-			} catch (emailError) {
+			emailService.send({
+				to: user.email,
+				subject: content.subject,
+				html: content.html,
+				text: content.text
+			}).catch((emailError) => {
 				logger.error("Failed to send one-time code email", { error: emailError instanceof Error ? emailError.message : emailError });
-			}
+			});
 		}
-		return c.json({
+		return notBefore(startedAt, OTP_SEND_FLOOR_MS, c.json({
 			success: true,
 			message: "If an account with that email exists, a sign-in code has been sent.",
 			expiresInSeconds: OTP_TTL_MS / 1e3
-		});
+		}));
 	});
 	/**
 	* POST /auth/otp/verify — trade a code for a session.
@@ -4037,6 +4091,19 @@ function createAuthRoutes(config) {
 	const router = new Hono();
 	router.onError(errorHandler);
 	const authRepo = config.authRepo;
+	/**
+	* `requireAuth`, plus the question of whether the session still exists.
+	*
+	* Plain `requireAuth` verifies the signature and the expiry and stops
+	* there, so an access token stays good for its full hour after the account
+	* behind it has signed out everywhere or reset its password — the
+	* revocation watermark those write is checked on the data plane and was not
+	* checked here. On the three self-service routes below that mattered
+	* disproportionately: `/link/<provider>` attaches an OAuth identity to the
+	* account, so a stolen token could be turned into a permanent way back in
+	* AFTER the victim had done the one thing that is supposed to end it.
+	*/
+	const requireLiveSession = createRequireAuth({ revocationRepo: authRepo });
 	const { emailService, emailConfig, allowRegistration = false } = config;
 	const ops = resolveAuthHooks(config.authHooks);
 	/**
@@ -4145,9 +4212,11 @@ function createAuthRoutes(config) {
 		if (!options?.skipMfaGate) await assertMfaSatisfied(authRepo, uid);
 		const aal = options?.aal ?? "aal1";
 		const roleIds = (await authRepo.getUserRoles(uid)).map((r) => r.id);
+		const sessionUser = await authRepo.getUserById(uid);
+		const isAnonymous = sessionUser?.isAnonymous === true;
 		let customClaims;
 		if (ops.customizeAccessToken) {
-			const user = await authRepo.getUserById(uid);
+			const user = sessionUser;
 			if (user) {
 				const defaultClaims = {
 					uid,
@@ -4157,7 +4226,7 @@ function createAuthRoutes(config) {
 				customClaims = await ops.customizeAccessToken(defaultClaims, user);
 			}
 		}
-		const accessToken = await generateAccessToken(uid, roleIds, aal, customClaims);
+		const accessToken = await generateAccessToken(uid, roleIds, aal, customClaims, isAnonymous);
 		const refreshToken = generateRefreshToken();
 		await authRepo.createRefreshToken(uid, await hashRefreshToken(refreshToken), getRefreshTokenExpiry(), userAgent, ipAddress, {
 			id: randomUUID(),
@@ -4182,6 +4251,7 @@ function createAuthRoutes(config) {
 			const { total } = await authRepo.listUsersPaginated({ limit: 1 });
 			bootstrapRegistration = total === 0;
 			if (!bootstrapRegistration) throw ApiError.forbidden("Registration is disabled", "REGISTRATION_DISABLED");
+			if (!isBootstrapWindowOpen()) throw ApiError.forbidden(SETUP_REQUIRED_MESSAGE, "SETUP_REQUIRED");
 		}
 		const passwordValidation = ops.validatePasswordStrength(password);
 		if (!passwordValidation.valid) throw ApiError.badRequest(passwordValidation.errors.join(". "), "WEAK_PASSWORD");
@@ -4200,8 +4270,11 @@ function createAuthRoutes(config) {
 			await authRepo.deleteUser(user.id);
 			throw ApiError.forbidden("Registration is disabled", "REGISTRATION_DISABLED");
 		}
-		if (isFirstUser) await authRepo.setUserRoles(user.id, ["admin"]);
-		else if (config.defaultRole) await authRepo.assignDefaultRole(user.id, config.defaultRole);
+		if (isFirstUser && isBootstrapWindowOpen()) await authRepo.setUserRoles(user.id, ["admin"]);
+		else {
+			if (isFirstUser) logger.warn("[Auth] First account registered in production without promotion; set REBASE_ADMIN_EMAIL/REBASE_ADMIN_PASSWORD or use the service key to assign admin.");
+			if (config.defaultRole) await authRepo.assignDefaultRole(user.id, config.defaultRole);
+		}
 		const { roleIds, accessToken, refreshToken } = await createSessionAndTokens(user.id, c.req.header("user-agent") || "unknown", c.req.header("x-forwarded-for") || "unknown");
 		sendWelcomeEmail({
 			email: user.email,
@@ -4295,6 +4368,7 @@ function createAuthRoutes(config) {
 						const { total } = await authRepo.listUsersPaginated({ limit: 1 });
 						bootstrapRegistration = total === 0;
 						if (!bootstrapRegistration) throw ApiError.forbidden(noSignupsMessage, "REGISTRATION_DISABLED");
+						if (!isBootstrapWindowOpen()) throw ApiError.forbidden(SETUP_REQUIRED_MESSAGE, "SETUP_REQUIRED");
 					}
 					user = await authRepo.createUser({
 						email: normalizeEmail(externalUser.email),
@@ -4314,7 +4388,7 @@ function createAuthRoutes(config) {
 						await authRepo.deleteUser(user.id);
 						throw ApiError.forbidden(noSignupsMessage, "REGISTRATION_DISABLED");
 					}
-					if (isFirstUser) await authRepo.setUserRoles(user.id, ["admin"]);
+					if (isFirstUser && isBootstrapWindowOpen()) await authRepo.setUserRoles(user.id, ["admin"]);
 					else if (config.defaultRole) await authRepo.assignDefaultRole(user.id, config.defaultRole);
 					sendWelcomeEmail({
 						email: user.email,
@@ -4348,7 +4422,7 @@ function createAuthRoutes(config) {
 		* email plays no part in the decision, so its verification status
 		* is irrelevant.
 		*/
-		router.post(`/link/${provider.id}`, defaultAuthLimiter, requireAuth, async (c) => {
+		router.post(`/link/${provider.id}`, defaultAuthLimiter, requireLiveSession, async (c) => {
 			const userCtx = c.get("user");
 			if (!userCtx) throw ApiError.unauthorized("Not authenticated");
 			const payload = parseBody(provider.schema, await c.req.json());
@@ -4379,7 +4453,8 @@ function createAuthRoutes(config) {
 	* POST /auth/forgot-password
 	* Request password reset email
 	*/
-	router.post("/forgot-password", strictAuthLimiter, ...captcha.forgotPassword ? [captcha.forgotPassword] : [], async (c) => {
+	router.post("/forgot-password", strictAuthLimiter, captureRecipientEmail, recipientEmailLimiter, ...captcha.forgotPassword ? [captcha.forgotPassword] : [], async (c) => {
+		const startedAt = Date.now();
 		const { email } = parseBody(forgotPasswordSchema, await c.req.json());
 		if (!isEmailConfigured()) throw ApiError.serviceUnavailable("Email service not configured. Password reset is not available.", "EMAIL_NOT_CONFIGURED");
 		const user = await authRepo.getUserByEmail(email);
@@ -4398,21 +4473,19 @@ function createAuthRoutes(config) {
 				email: user.email,
 				displayName: user.displayName
 			}, appName, logoUrl);
-			try {
-				await emailService.send({
-					to: user.email,
-					subject: emailContent.subject,
-					html: emailContent.html,
-					text: emailContent.text
-				});
-			} catch (emailError) {
+			emailService.send({
+				to: user.email,
+				subject: emailContent.subject,
+				html: emailContent.html,
+				text: emailContent.text
+			}).catch((emailError) => {
 				logger.error("Failed to send password reset email", { error: emailError instanceof Error ? emailError.message : emailError });
-			}
+			});
 		}
-		return c.json({
+		return notBefore$1(startedAt, 400, c.json({
 			success: true,
 			message: "If an account with that email exists, a password reset link has been sent."
-		});
+		}));
 	});
 	/**
 	* POST /auth/reset-password
@@ -4442,7 +4515,7 @@ function createAuthRoutes(config) {
 	* POST /auth/change-password
 	* Change password for authenticated user
 	*/
-	router.post("/change-password", requireAuth, async (c) => {
+	router.post("/change-password", requireLiveSession, async (c) => {
 		const userCtx = c.get("user");
 		if (!userCtx) throw ApiError.unauthorized("Not authenticated");
 		const { oldPassword, newPassword } = parseBody(changePasswordSchema, await c.req.json());
@@ -4471,7 +4544,7 @@ function createAuthRoutes(config) {
 	* here: the address is unverified by construction, so an attacker can hold a
 	* session for a mailbox that is not theirs.
 	*/
-	router.post("/send-verification", strictAuthLimiter, requireAuth, verificationEmailLimiter, async (c) => {
+	router.post("/send-verification", strictAuthLimiter, requireLiveSession, verificationEmailLimiter, async (c) => {
 		const userCtx = c.get("user");
 		if (!userCtx) throw ApiError.unauthorized("Not authenticated");
 		if (!isEmailConfigured()) throw ApiError.serviceUnavailable("Email service not configured. Email verification is not available.", "EMAIL_NOT_CONFIGURED");
@@ -4572,7 +4645,7 @@ function createAuthRoutes(config) {
 			};
 			customClaims = await ops.customizeAccessToken(defaultClaims, user);
 		}
-		const newAccessToken = await generateAccessToken(storedToken.uid, roleIds, sessionAal, customClaims);
+		const newAccessToken = await generateAccessToken(storedToken.uid, roleIds, sessionAal, customClaims, user?.isAnonymous === true);
 		const newRefreshToken = generateRefreshToken();
 		const userAgent = c.req.header("user-agent") || "unknown";
 		const ipAddress = c.req.header("x-forwarded-for") || "unknown";
@@ -4609,7 +4682,8 @@ function createAuthRoutes(config) {
 		parseBody,
 		buildAuthResponse,
 		createSessionAndTokens,
-		applyTransformHook
+		applyTransformHook,
+		requireLiveSession
 	});
 	mountMfaRoutes({
 		router,
@@ -4618,7 +4692,8 @@ function createAuthRoutes(config) {
 		parseBody,
 		buildAuthResponse,
 		createSessionAndTokens,
-		applyTransformHook
+		applyTransformHook,
+		requireLiveSession
 	});
 	if (config.enableMagicLink) mountMagicLinkRoutes({
 		router,
@@ -4863,6 +4938,10 @@ function createAdminUsersRoute(config) {
 			break;
 		}
 		if (hasAdmin) throw ApiError.forbidden("Admin users already exist. Bootstrap not allowed.", "BOOTSTRAP_COMPLETED");
+		if (!isBootstrapWindowOpen()) {
+			logger.warn("[Security Audit] Bootstrap denied: the first-admin window is closed in production", { eventType: "auth.bootstrap.denied.production" });
+			throw ApiError.forbidden(SETUP_REQUIRED_MESSAGE, "SETUP_REQUIRED");
+		}
 		const uid = "uid" in user ? user.uid : void 0;
 		if (!uid) throw ApiError.unauthorized("User ID not found in auth context");
 		if (isAnonymousUid(uid)) {
@@ -5088,6 +5167,7 @@ function createBuiltinAuthAdapter(config) {
 				displayName: payload.displayName ?? null,
 				roles,
 				isAdmin,
+				isAnonymous: payload.isAnonymous === true,
 				rawToken: token
 			};
 		},
@@ -5124,6 +5204,7 @@ function createBuiltinAuthAdapter(config) {
 				displayName: payload.displayName ?? null,
 				roles,
 				isAdmin,
+				isAnonymous: payload.isAnonymous === true,
 				rawToken: token
 			};
 		},
@@ -5205,7 +5286,7 @@ function createBuiltinAuthAdapter(config) {
 		async getCapabilities() {
 			let needsSetup = false;
 			try {
-				needsSetup = (await authRepository.listUsersPaginated({ limit: 1 })).total === 0;
+				needsSetup = (await authRepository.listUsersPaginated({ limit: 1 })).total === 0 && isBootstrapWindowOpen();
 			} catch (error) {
 				logger.warn("[Auth] Could not count users for `needsSetup`; reporting the backend as already set up.", { error: error instanceof Error ? error.message : String(error) });
 			}
@@ -6801,17 +6882,21 @@ function validatePermissions(permissions) {
 * edges left to get wrong.
 */
 var rejectApiKeyAuth = async (c, next) => {
-	if (c.get("apiKey")) throw ApiError.forbidden("API keys cannot manage API keys. Authenticate as an admin user, or use the service key.", "API_KEY_SELF_MANAGEMENT_FORBIDDEN");
+	if (c.get("apiKey")) throw ApiError.forbidden("API keys cannot manage API keys. Authenticate as an admin user, or use the service key — REBASE_SERVICE_KEY in this server's environment, or `rebase cloud env reveal REBASE_SERVICE_KEY` on Rebase Cloud.", "API_KEY_SELF_MANAGEMENT_FORBIDDEN");
 	return next();
 };
 /**
 * Create admin routes for API key management.
 */
 function createApiKeyRoutes(options) {
-	const { store, serviceKey } = options;
+	const { store, serviceKey, resolveRoles, revocationRepo } = options;
 	const router = new Hono();
 	router.onError(errorHandler);
-	router.use("/*", createRequireAuth({ serviceKey }));
+	router.use("/*", createRequireAuth({
+		serviceKey,
+		resolveRoles,
+		revocationRepo
+	}));
 	router.use("/*", rejectApiKeyAuth);
 	router.use("/*", requireAdmin);
 	router.get("/", async (c) => {
@@ -7007,6 +7092,6 @@ var auth_exports = /* @__PURE__ */ __exportAll({
 	verifyPassword: () => verifyPassword
 });
 //#endregion
-export { html as $, activeDevEmailSink as A, hashPassword as B, providerVerifiedEmail as C, PUBLIC_STORAGE_PREFIX as Ct, createDataRateLimiter as D, DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT as E, SMTPEmailService as F, getEmailVerificationTemplate as G, verifyPassword as H, createEmailService as I, getUserInvitationTemplate as J, getMagicLinkTemplate as K, assertEmailLinkBases as L, createDevEmailSink as M, extractLinks as N, defaultAuthLimiter as O, registerDevEmailSink as P, escapeHtml as Q, resolveEmailLinkBase as R, pkceTokenParams as S, isOperationAllowed as St, createBuiltinAuthAdapter as T, generateSecurePassword as U, validatePasswordStrength as V, getEmailOtpTemplate as W, resolveEmailBranding as X, getWelcomeEmailTemplate as Y, RawHtml as Z, verifyOidcIdToken as _, safeCompare as _t, resolveRateLimitStoreKind as a, fileTokenAuth as at, createGoogleProvider as b, hasAdministrativeRole as bt, createSlackProvider as c, queryTokenAuth as ct, createDiscordProvider as d, createApiKeyPreAuth as dt, raw as et, createTwitterProvider as f, createFunctionApiKeyGuard as ft, tryVerifyOidcIdToken as g, extractBearerToken as gt, createMicrosoftProvider as h, validateApiKey as ht, createApiKeyStore as i, extractUserFromToken as it, clearActiveDevEmailSink as j, MemoryRateLimitStore as k, createBitbucketProvider as l, requireAdmin as lt, createAppleProvider as m, isApiKeyToken as mt, createCustomAuthAdapter as n, createAuthMiddleware as nt, createSqlRateLimitStore as o, optionalAuth as ot, createFacebookProvider as p, createStorageApiKeyGuard as pt, getPasswordResetTemplate as q, createApiKeyRoutes as r, createRequireAuth as rt, createSpotifyProvider as s, publicObjectAuth as st, auth_exports as t, createAdapterAuthMiddleware as tt, createGitLabProvider as u, requireAuth as ut, createGitHubProvider as v, SERVICE_IDENTITY as vt, createJwksRoutes as w, isPublicStoragePath as wt, oauthCodeFlowSchema as x, httpMethodToOperation as xt, createLinkedinProvider as y, scopeDataDriver as yt, resolveAuthHooks as z };
+export { escapeHtml as $, MemoryRateLimitStore as A, resolveAuthHooks as B, providerVerifiedEmail as C, PUBLIC_STORAGE_PREFIX as Ct, DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT as D, isBootstrapWindowOpen as E, registerDevEmailSink as F, getEmailOtpTemplate as G, validatePasswordStrength as H, SMTPEmailService as I, getPasswordResetTemplate as J, getEmailVerificationTemplate as K, createEmailService as L, clearActiveDevEmailSink as M, createDevEmailSink as N, createDataRateLimiter as O, extractLinks as P, RawHtml as Q, assertEmailLinkBases as R, pkceTokenParams as S, isOperationAllowed as St, createBuiltinAuthAdapter as T, verifyPassword as U, hashPassword as V, generateSecurePassword as W, getWelcomeEmailTemplate as X, getUserInvitationTemplate as Y, resolveEmailBranding as Z, verifyOidcIdToken as _, extractBearerToken as _t, resolveRateLimitStoreKind as a, extractUserFromToken as at, createGoogleProvider as b, scopeDataDriver as bt, createSlackProvider as c, publicObjectAuth as ct, createDiscordProvider as d, requireAuth as dt, html as et, createTwitterProvider as f, createApiKeyPreAuth as ft, tryVerifyOidcIdToken as g, validateApiKey as gt, createMicrosoftProvider as h, isApiKeyToken as ht, createApiKeyStore as i, createRequireAuth as it, activeDevEmailSink as j, defaultAuthLimiter as k, createBitbucketProvider as l, queryTokenAuth as lt, createAppleProvider as m, createStorageApiKeyGuard as mt, createCustomAuthAdapter as n, createAdapterAuthMiddleware as nt, createSqlRateLimitStore as o, fileTokenAuth as ot, createFacebookProvider as p, createFunctionApiKeyGuard as pt, getMagicLinkTemplate as q, createApiKeyRoutes as r, createAuthMiddleware as rt, createSpotifyProvider as s, optionalAuth as st, auth_exports as t, raw as tt, createGitLabProvider as u, requireAdmin as ut, createGitHubProvider as v, safeCompare as vt, createJwksRoutes as w, isPublicStoragePath as wt, oauthCodeFlowSchema as x, httpMethodToOperation as xt, createLinkedinProvider as y, SERVICE_IDENTITY as yt, resolveEmailLinkBase as z };
 
-//# sourceMappingURL=auth-DkbzMZUS.js.map
+//# sourceMappingURL=auth-BRiOuyq8.js.map