@rebasepro/server 0.20.0 → 0.21.0

package/dist/index.es.js

@@ -2,17 +2,16 @@ import { createRequire as __rebaseCreateRequire } from "module";
 import __rebaseProcess from "process";
 globalThis.process ??= __rebaseProcess;
 __rebaseCreateRequire(import.meta.url);
-import { $ as isFieldOperation, A as createDataSourceRegistry, B as resolveCollectionRelations, D as restrictedFieldNames, E as effectiveAccess, F as securityRuleToConditions, G as suggestNearMiss, H as buildCompositeId, I as fieldKeyForColumn, K as toSnakeCase, L as findRelation, M as resolveDataSource, N as getEffectiveSecurityRules, O as defaultUsersCollection, Q as hasFieldOperation, R as getTableName, S as cursorToStartAfter, T as canWriteField, U as resolvePrimaryKeys, V as enumToObjectEntries, W as hydrateRegExp, X as BATCH_REF_KEY, Z as FIELD_OPERATORS, at as Vector, c as collectAllPages, ct as isUnsupported, g as topLevelIncludeNames, h as serializeInclude, it as GeoPoint, j as isRelationalCollection, k as CollectionRegistry, l as paginateFind, lt as unsupportedMethod, n as buildSdkData, nt as EntityReference, o as serializeFilter, ot as RebaseApiError, p as mergeIncludeSpecs, rt as EntityRelation, s as serializeLogicalCondition, st as RebaseClientError, t as buildRoutedRebaseData, u as resolveFindWindow, v as normalizeOrderBy, y as serializeOrderBy } from "./src-DqZ9YiGA.js";
+import { A as createDataSourceRegistry, B as findRelation, D as restrictedFieldNames, E as effectiveAccess, F as getJunctionConfigForRelation, G as buildCompositeId, I as getEffectiveSecurityRules, J as suggestNearMiss, K as resolvePrimaryKeys, M as resolveDataSource, O as defaultUsersCollection, P as revokeInternalTableSql, R as securityRuleToConditions, S as cursorToStartAfter, T as canWriteField, U as resolveCollectionRelations, V as getTableName, W as enumToObjectEntries, X as unref, Y as toSnakeCase, c as collectAllPages, dt as GeoPoint, et as BATCH_REF_KEY, ft as Vector, g as topLevelIncludeNames, gt as unsupportedMethod, h as serializeInclude, ht as isUnsupported, j as isRelationalCollection, k as CollectionRegistry, l as paginateFind, lt as EntityReference, mt as RebaseClientError, n as buildSdkData, nt as hasFieldOperation, o as serializeFilter, ot as JUNCTION_PIVOT_KEY, p as mergeIncludeSpecs, pt as RebaseApiError, q as hydrateRegExp, rt as isFieldOperation, s as serializeLogicalCondition, st as isManyToMany, t as buildRoutedRebaseData, tt as FIELD_OPERATORS, u as resolveFindWindow, ut as EntityRelation, v as normalizeOrderBy, y as serializeOrderBy, z as fieldKeyForColumn } from "./src-DW1cQ_28.js";
 import { E as DEFAULT_DATA_SOURCE_KEY, F as sortKeyToString, I as toCanonicalOp, P as parseRelationAggregateSort, S as getCollectionDataPath, _ as resourceKinds, a as resourceToStorageSource, b as RLS_UID_SQL, c as DEFAULT_STORAGE_SOURCE_KEY, d as DEFAULT_RESOURCE_KEY, f as buildResourceGraph, g as resourceKind, h as resourceKeyOf, i as resourceToDataSource, l as findStorageSuffixCollision, m as resourceEnvSuffix, n as declaredQueueConsumers, o as setQueueRuntime, p as resolveResourceRefs, r as declaredSubscriptions, s as setTopicRuntime, u as storageEnvSuffix, v as RLS_JWT_SQL, w as isPostgresCollectionConfig, y as RLS_ROLES_SQL } from "./src-Br6ARbs6.js";
-import { n as ADMIN_PROPERTY_KEYS, t as ADMIN_COLLECTION_KEYS } from "./admin_block-0Xu0r6eZ.js";
+import { n as ADMIN_PROPERTY_KEYS, t as ADMIN_COLLECTION_KEYS } from "./admin_block-DxKLmdiv.js";
 import { a as isDuplicateObjectRace, i as isConcurrentDdlRace, n as createDdlBootstrapper, o as isSQLAdmin, s as isSchemaEditingAdmin, t as CONCURRENT_DDL_SQLSTATES } from "./ddl-bootstrap-CfNvxMuK.js";
 import { i as SCHEMA_VERSION_HEADER, n as createContractRoutes, r as computeSchemaVersion } from "./contract-routes-eLxV0le1.js";
-import { $ as escapeHtml, A as MemoryRateLimitStore, B as resolveAuthHooks, C as providerVerifiedEmail, Ct as PUBLIC_STORAGE_PREFIX, D as DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT, E as isBootstrapWindowOpen, F as registerDevEmailSink, G as getEmailOtpTemplate, H as validatePasswordStrength, I as SMTPEmailService, J as getPasswordResetTemplate, K as getEmailVerificationTemplate, L as createEmailService, M as clearActiveDevEmailSink, N as createDevEmailSink, O as createDataRateLimiter, P as extractLinks, Q as RawHtml, R as assertEmailLinkBases, S as pkceTokenParams, St as isOperationAllowed, T as createBuiltinAuthAdapter, U as verifyPassword, V as hashPassword, W as generateSecurePassword, X as getWelcomeEmailTemplate, Y as getUserInvitationTemplate, Z as resolveEmailBranding, _ as verifyOidcIdToken, _t as extractBearerToken, a as resolveRateLimitStoreKind, at as extractUserFromToken, b as createGoogleProvider, bt as scopeDataDriver, c as createSlackProvider, ct as publicObjectAuth, d as createDiscordProvider, dt as requireAuth, et as html, f as createTwitterProvider, ft as createApiKeyPreAuth, g as tryVerifyOidcIdToken, gt as validateApiKey, h as createMicrosoftProvider, ht as isApiKeyToken, i as createApiKeyStore, it as createRequireAuth, j as activeDevEmailSink, k as defaultAuthLimiter, l as createBitbucketProvider, lt as queryTokenAuth, m as createAppleProvider, mt as createStorageApiKeyGuard, n as createCustomAuthAdapter, nt as createAdapterAuthMiddleware, o as createSqlRateLimitStore, ot as fileTokenAuth, p as createFacebookProvider, pt as createFunctionApiKeyGuard, q as getMagicLinkTemplate, r as createApiKeyRoutes, rt as createAuthMiddleware, s as createSpotifyProvider, st as optionalAuth, tt as raw, u as createGitLabProvider, ut as requireAdmin, v as createGitHubProvider, vt as safeCompare, w as createJwksRoutes, wt as isPublicStoragePath, x as oauthCodeFlowSchema, xt as httpMethodToOperation, y as createLinkedinProvider, yt as SERVICE_IDENTITY, z as resolveEmailLinkBase } from "./auth-DJsLXsCR.js";
-import { t as revokeInternalTableSql } from "./internal-tables-DYVcFFSv.js";
+import { $ as RawHtml, A as defaultAuthLimiter, B as resolveEmailLinkBase, C as providerVerifiedEmail, Ct as httpMethodToOperation, D as DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT, E as isBootstrapWindowOpen, Et as isPublicStoragePath, F as extractLinks, G as generateSecurePassword, H as hashPassword, I as registerDevEmailSink, J as getMagicLinkTemplate, K as getEmailOtpTemplate, L as SMTPEmailService, M as activeDevEmailSink, N as clearActiveDevEmailSink, O as createDataRateLimiter, P as createDevEmailSink, Q as resolveEmailBranding, R as createEmailService, S as pkceTokenParams, St as supportsRlsScoping, T as createBuiltinAuthAdapter, Tt as PUBLIC_STORAGE_PREFIX, U as validatePasswordStrength, V as resolveAuthHooks, W as verifyPassword, X as getUserInvitationTemplate, Y as getPasswordResetTemplate, Z as getWelcomeEmailTemplate, _ as verifyOidcIdToken, _t as validateApiKey, a as resolveRateLimitStoreKind, at as createRequireAuth, b as createGoogleProvider, bt as SERVICE_IDENTITY, c as createSlackProvider, ct as optionalAuth, d as createDiscordProvider, dt as requireAdmin, et as escapeHtml, f as createTwitterProvider, ft as requireAuth, g as tryVerifyOidcIdToken, gt as isApiKeyToken, h as createMicrosoftProvider, ht as createStorageApiKeyGuard, i as createApiKeyStore, it as createAuthMiddleware, j as MemoryRateLimitStore, k as createRateLimiter, l as createBitbucketProvider, lt as publicObjectAuth, m as createAppleProvider, mt as createFunctionApiKeyGuard, n as createCustomAuthAdapter, nt as raw, o as createSqlRateLimitStore, ot as extractUserFromToken, p as createFacebookProvider, pt as createApiKeyPreAuth, q as getEmailVerificationTemplate, r as createApiKeyRoutes, rt as createAdapterAuthMiddleware, s as createSpotifyProvider, st as fileTokenAuth, tt as html, u as createGitLabProvider, ut as queryTokenAuth, v as createGitHubProvider, vt as extractBearerToken, w as createJwksRoutes, wt as isOperationAllowed, x as oauthCodeFlowSchema, xt as scopeDataDriver, y as createLinkedinProvider, yt as safeCompare, z as assertEmailLinkBases } from "./auth-gzoRjnuh.js";
 import { i as rawQueryLoggingEnabled, n as describeCauseChain, o as setLogLevel, r as logger, s as hostEnv } from "./logger-DO2PZc4i.js";
 import { n as errorHandler, r as schemaDriftRemedy, t as ApiError } from "./errors-DMImyqyR.js";
-import { a as resolveListLimitParam, c as HARD_DELETE_QUERY_PARAM, i as parseQueryOptions, l as parseHardDelete, n as parseAggregateSelect, o as assertReadableFields, r as parseGroupBy, s as requestViewer, t as orderByEntriesToTuples } from "./query-parser-BQiPZrM-.js";
-import { S as sha256Hex, c as getJwks, d as hasAsymmetricSigningKey, i as generateDownloadToken, n as configureJwt, p as isJwtConfigured, v as normalizePemFromEnv } from "./jwt-DATvkKB_.js";
+import { a as resolveListLimitParam, c as HARD_DELETE_QUERY_PARAM, i as parseQueryOptions, l as parseHardDelete, n as parseAggregateSelect, o as assertReadableFields, r as parseGroupBy, s as requestViewer, t as orderByEntriesToTuples } from "./query-parser-uqzkZ82i.js";
+import { D as sha256Bytes, O as sha256Hex, S as normalizePemFromEnv, T as randomHex, _ as verifyAccessToken, a as generateMcpAccessToken, f as hasAsymmetricSigningKey, g as signPurposeToken, i as generateDownloadToken, l as getJwks, m as isJwtConfigured, n as configureJwt, w as constantTimeEqual, x as verifyPurposeToken, y as verifyMcpAccessToken } from "./jwt-C4OW-DNq.js";
 import { a as canonicalStorageKey, i as canonicalStorageId, n as InvalidStorageKeyError, r as canonicalStorageBucket, t as InvalidStorageBucketError } from "./keys-Qfc4XieN.js";
 import { t as logMiddleware } from "./logs-routes-DnJINsMu.js";
 import { n as DOCUMENT_MIME_TYPES, r as IMAGE_MIME_TYPES, t as DEFAULT_MAX_FILE_SIZE } from "./types-BfKcm9do.js";
@@ -25,11 +24,11 @@ import "./request-timeout-BR-OBwES.js";
 import { t as FunctionSelectionError } from "./selection-CRpqKUbt.js";
 import { n as loadCronJobsFromDirectory, r as loadCronJobsWithDiagnostics } from "./cron-loader-CQjvjpEw.js";
 import { r as validateCronExpression, t as CronScheduler } from "./cron-scheduler-D47tdB9T.js";
-import { t as createCronRoutes } from "./cron-routes-Bfwni8Zg.js";
-import { t as createCronStore } from "./cron-store-Bsiw4Q6u.js";
+import { t as createCronRoutes } from "./cron-routes-BamgO0Xr.js";
+import { t as createCronStore } from "./cron-store-yXOyIEmn.js";
 import { a as parseBackupTimestamp, i as parseBackupDestination, n as createBackupRoutes, o as readBackupBytes, r as listBackupObjects } from "./backup-DGu0v9Ku.js";
-import { i as createJobStore, n as createJobQueue, r as defaultBackoff } from "./jobs-CW5lm_Ix.js";
-import { t as METRIC_SERIES } from "./history-store-D4RVK-uZ.js";
+import { a as currentAmbientTransaction, i as createJobStore, n as createJobQueue, r as defaultBackoff } from "./jobs-DZ8DLLcU.js";
+import { t as METRIC_SERIES } from "./history-store-C9EtGtoL.js";
 import { createHash, createSign, randomBytes } from "node:crypto";
 import * as fs$3 from "fs";
 import fs, { existsSync } from "fs";
@@ -756,6 +755,48 @@ var TENANT_FIELD_TYPES = /* @__PURE__ */ new Set([
 *   claims hook cannot assert them. A tenancy rule reading `uid` as a tenant
 *   would compile and would mean something nobody intended.
 */
+/**
+* The collection object read as a config, for the two helpers that want a whole
+* one.
+*
+* This module runs *before* anything has turned the user's config into a
+* `CollectionConfig` — that is what it is for — so what it holds is an open
+* record, and `getTableName` and `getEffectiveSecurityRules` are both typed on
+* the finished type. Nothing structural bridges the two, so the conversion is
+* irreducible here; what it should not be is scattered, which is how two call
+* sites came to spell it `as unknown as CollectionConfig` independently.
+*
+* Both helpers read fields this module has already checked by the time they are
+* called, and both are total on a record that is missing them — `getTableName`
+* falls back through `slug` to `name` to `""`, and an absent `securityRules` is
+* an empty rule list. Prefer {@link dataSourceOf} where only the routing fields
+* are wanted: it checks them instead of claiming them.
+*/
+function asCollectionConfig(collection) {
+	return collection;
+}
+/**
+* The three fields {@link isRelationalCollection} reads, taken off a collection
+* object this module has not finished validating.
+*
+* `isRelationalCollection` wants a `DataSourceResolvable` —
+* `{ dataSource?: string; engine?: string; databaseId?: string }` — and what
+* this file holds is a `Record<string, unknown>` straight out of the user's
+* config, whose values are `unknown`. The call sites answered that mismatch
+* with `collection as unknown as CollectionConfig`, which names a type nothing
+* here asks for and asserts far more than the question needs: a config
+* declaring `engine: 42` was read as an engine and routed on.
+*
+* Checking the three is what this module is for.
+*/
+function dataSourceOf(collection) {
+	const text = (value) => typeof value === "string" ? value : void 0;
+	return {
+		dataSource: text(collection.dataSource),
+		engine: text(collection.engine),
+		databaseId: text(collection.databaseId)
+	};
+}
 function checkTenant(collection, at, collect) {
 	const declared = collection.tenant;
 	if (declared === void 0) return;
@@ -763,7 +804,7 @@ function checkTenant(collection, at, collect) {
 		collect.error(`${at}.tenant`, "`tenant` must be an object — `{ field, from }`.");
 		return;
 	}
-	if (!isRelationalCollection(collection)) {
+	if (!isRelationalCollection(dataSourceOf(collection))) {
 		collect.error(`${at}.tenant`, "`tenant` is Postgres-only: row-level security is what enforces the boundary, and an application-layer filter on an engine without it is one a raw query goes around. Remove `tenant`, or move this collection to a Postgres data source.");
 		return;
 	}
@@ -840,7 +881,7 @@ function checkTenant(collection, at, collect) {
 */
 function checkPrimaryKeyStrategy(collection, at, collect) {
 	if (!isPlainObject$3(collection.properties)) return;
-	if (!isRelationalCollection(collection)) return;
+	if (!isRelationalCollection(dataSourceOf(collection))) return;
 	const ids = Object.entries(collection.properties).filter(([, property]) => isPlainObject$3(property) && Boolean(property.isId)).map(([key, property]) => [key, property]);
 	if (ids.length > 1) collect.error(`${at}.properties`, `${ids.length} properties are marked \`isId\` (${ids.map(([key]) => `\`${key}\``).join(", ")}), and composite primary keys are not supported: the generated table would carry two PRIMARY KEY clauses, which Postgres refuses, and the boot-time schema ensure would create the table without the second column. Give exactly one property \`isId\`, and express the second key with \`indexes: [{ on: [...], unique: true, reason: "…" }]\`.`);
 	for (const [key, property] of ids) {
@@ -993,7 +1034,7 @@ function checkCollectionsTogether(collections, sources, collect) {
 			if (seen) seen.push(index);
 			else bySlug.set(slug, [index]);
 		}
-		const table = getTableName(collection);
+		const table = getTableName(asCollectionConfig(collection));
 		if (!table) return;
 		const qualified = `${typeof collection.schema === "string" && collection.schema ? collection.schema : "public"}.${table}`;
 		const seen = byTable.get(qualified);
@@ -1084,7 +1125,7 @@ function checkTenantMemberships(collections, collect) {
 			collect.error(`${path}.collection`, `\`membership.collection: "${slug}"\` names no collection in this project. The policy compiles to a subquery over its table, so a slug nothing resolves to is a policy over a table that does not exist — which fails to apply and leaves the collection denying every row.`);
 			continue;
 		}
-		if (!isRelationalCollection(target)) {
+		if (!isRelationalCollection(dataSourceOf(target))) {
 			collect.error(`${path}.collection`, `'${slug}' is not stored in Postgres, so there is no table for the tenancy policy's subquery to read. Both collections have to live in the same SQL database.`);
 			continue;
 		}
@@ -1093,7 +1134,7 @@ function checkTenantMemberships(collections, collect) {
 			if (isPlainObject$3(targetProperties[name])) continue;
 			collect.error(`${path}.${key}`, `'${slug}' has no property '${name}'. The tenancy policy reads it inside a subquery, and a policy naming a column that does not exist fails to apply — which leaves the table with RLS enabled and no policy, denying every row.`);
 		}
-		if (!grantsSelfRead(target, userField)) collect.error(`${path}.collection`, `'${slug}' does not let a signed-in caller read their own membership rows, and the tenancy policy on '${at}' is a subquery over it — evaluated as the caller, so '${slug}'s own RLS applies inside it. Every Rebase table denies by default, so as written that subquery is false for everybody and '${at}' returns no rows to anyone but \`admin\`. Add the rule that makes it readable:
+		if (!grantsSelfRead(asCollectionConfig(target), userField)) collect.error(`${path}.collection`, `'${slug}' does not let a signed-in caller read their own membership rows, and the tenancy policy on '${at}' is a subquery over it — evaluated as the caller, so '${slug}'s own RLS applies inside it. Every Rebase table denies by default, so as written that subquery is false for everybody and '${at}' returns no rows to anyone but \`admin\`. Add the rule that makes it readable:
       securityRules: [{ name: "${slug}_self_read", operations: ["select"], ownerField: "${userField}" }]`, "incoherent");
 	}
 }
@@ -2016,6 +2057,48 @@ function createRoutedRealtimeService(opts) {
 //#endregion
 //#region src/api/rest/write-validation.ts
 /**
+* The relations of `collection` that reach through a junction carrying its own
+* columns, each with the synthetic collection those columns are declared on.
+*
+* Keyed by the relation's wire name, which is what a membership write names
+* (`{ tags: [...] }`). A junction with no `through.properties` is not here at
+* all: there is nothing a `_pivot` could legally say about it, and the write
+* path refuses one with the relation named.
+*/
+function junctionsWithPayload(collection) {
+	const out = [];
+	for (const [key, relation] of Object.entries(resolveCollectionRelations(collection))) {
+		if (!isManyToMany(relation)) continue;
+		if (Object.keys(relation.through.properties).length === 0) continue;
+		out.push([key, getJunctionConfigForRelation(relation.through)]);
+	}
+	return out;
+}
+/**
+* The `_pivot` objects in a membership value, with the index each came from.
+*
+* Tolerant on purpose: a value that is not an array, an element that is a bare
+* id, and a `_pivot` that is not an object are all *someone else's* error to
+* report — `relationLinkElements` in the driver refuses an element with no id,
+* and a non-object `_pivot` is refused where it is serialized. Reporting them
+* twice, differently, is how two layers come to disagree about what a request
+* meant.
+*/
+function pivotsIn(value) {
+	if (!Array.isArray(value)) return [];
+	const out = [];
+	value.forEach((element, index) => {
+		if (!element || typeof element !== "object" || Array.isArray(element)) return;
+		const pivot = element[JUNCTION_PIVOT_KEY];
+		if (!pivot || typeof pivot !== "object" || Array.isArray(pivot)) return;
+		out.push({
+			index,
+			pivot
+		});
+	});
+	return out;
+}
+/**
 * The two ways a field can be closed to a write, told apart.
 *
 * `excluded` is `access.write: []` — the server's own column, closed to every
@@ -2129,6 +2212,7 @@ function assertKnownWriteFields(values, collection, options) {
 	for (const name of restrictedFieldNames(collection, options?.viewer, "write").declared) known.delete(name);
 	for (const relation of Object.values(resolveCollectionRelations(collection))) if (relation.kind === "belongsTo") known.add(fieldKeyForColumn(collection, relation.localKey));
 	for (const field of options?.extraKnownFields ?? []) known.add(field);
+	for (const [key, junction] of junctionsWithPayload(collection)) for (const { pivot } of pivotsIn(values[key])) assertKnownWriteFields(pivot, junction, { viewer: options?.viewer });
 	const unknown = Object.keys(values).filter((key) => !known.has(key));
 	if (unknown.length === 0) return;
 	if (unknown.includes("id") && !known.has("id")) {
@@ -2392,7 +2476,7 @@ function isCallerSupplied(property) {
 * (`author`) or the foreign-key column under its wire name (`authorId`). Both
 * put the same value in the same column.
 */
-function collectMissingRequired(values, collection, into) {
+function collectMissingRequired(values, collection, into, at) {
 	if (collection.callbacks?.beforeSave) return;
 	const properties = collection.properties ?? {};
 	/** Relation property name → the FK wire key that also satisfies it. */
@@ -2408,10 +2492,11 @@ function collectMissingRequired(values, collection, into) {
 		if (supplied(key)) continue;
 		const alias = relationAlias.get(key);
 		if (alias && supplied(alias)) continue;
+		const field = at ? `${at}.${key}` : key;
 		into.push({
-			field: key,
+			field,
 			code: "required",
-			message: property.validation.requiredMessage ?? `'${key}' is required.`
+			message: property.validation.requiredMessage ?? `'${field}' is required.`
 		});
 	}
 }
@@ -2466,6 +2551,14 @@ function assertWriteValuesValid(values, collection, options) {
 		const property = properties[key];
 		if (property) collectViolations(key, property, value, violations);
 	}
+	for (const [key, junction] of junctionsWithPayload(collection)) for (const { index, pivot } of pivotsIn(values[key])) {
+		const at = `${key}[${index}].${JUNCTION_PIVOT_KEY}`;
+		for (const [pivotKey, pivotValue] of Object.entries(pivot)) {
+			const property = junction.properties?.[pivotKey];
+			if (property) collectViolations(`${at}.${pivotKey}`, property, pivotValue, violations);
+		}
+		if (options?.status === "new" || options?.status === "copy") collectMissingRequired(pivot, junction, violations, at);
+	}
 	if (options?.status === "new" || options?.status === "copy") collectMissingRequired(values, collection, violations);
 	if (violations.length === 0) return;
 	const where = options?.rowIndex !== void 0 ? `Row ${options.rowIndex}: ` : "";
@@ -3539,6 +3632,70 @@ var RestApiGenerator = class {
 		return current;
 	}
 	/**
+	* `PATCH <collection>/<id>/<relation>/<targetId>` with a `_pivot` body: set
+	* the columns that one many-to-many link carries.
+	*
+	* The membership array on the parent (`PATCH posts/1 { tags: [...] }`) sets
+	* *which* links exist; this sets what one of them holds. They are separate
+	* because the array cannot express a single-link edit without either
+	* unlinking everything it omits or re-sending the whole set — and re-sending
+	* the set to change one `role` is exactly the lost update that the
+	* membership diff exists to avoid.
+	*
+	* Validated against the junction's own properties, through the same
+	* `assertWriteRequestValid` a row's values go through: `required`, `enum`,
+	* `min`/`max`/`matches` and per-field `access.write` mean the same thing on
+	* a payload column as on a collection's, or the promise that they are
+	* "declared exactly like collection properties" is not one.
+	*/
+	async updateRelationPivotFromBody(c, driver, collectionPath, targetId, body) {
+		const extras = Object.keys(body).filter((key) => key !== JUNCTION_PIVOT_KEY);
+		if (extras.length > 0) throw ApiError.badRequest(`A \`${JUNCTION_PIVOT_KEY}\` write sets the link's own columns, so it cannot also carry ${extras.map((k) => `'${k}'`).join(", ")} — those belong to the row on the far side. Send them as a separate request to the same address without \`_pivot\`.`, "VALIDATION_UNKNOWN_FIELDS", {
+			fields: extras,
+			path: collectionPath
+		});
+		const pivot = body[JUNCTION_PIVOT_KEY];
+		if (!pivot || typeof pivot !== "object" || Array.isArray(pivot)) throw ApiError.badRequest(`\`${JUNCTION_PIVOT_KEY}\` must be an object of the junction's columns.`, "VALIDATION_CONSTRAINT", { path: collectionPath });
+		const junction = this.resolveJunctionCollection(collectionPath);
+		if (!junction) throw ApiError.badRequest(`'${collectionPath}' does not reach its target through a \`manyToMany\` that declares \`through.properties\`, so there is no link payload to write.`, "RELATION_HAS_NO_PIVOT", { path: collectionPath });
+		assertWriteRequestValid(pivot, junction, { viewer: requestViewer(c) });
+		if (!driver.updateRelationPivot) throw ApiError.badRequest("This data source cannot write junction columns.", "RELATION_PIVOT_UNSUPPORTED", { path: collectionPath });
+		await driver.updateRelationPivot({
+			path: collectionPath,
+			targetId,
+			pivot
+		});
+		return new Response(null, { status: 204 });
+	}
+	/**
+	* The synthetic collection standing in for the junction a nested path's last
+	* hop reaches through, or `undefined` when that hop is not a `manyToMany`
+	* carrying `through.properties`.
+	*
+	* Built from the relation rather than by walking every collection: the same
+	* `getJunctionConfigForRelation` the schema planner and the driver use, so
+	* the shape validated here is the shape the columns were emitted from.
+	*/
+	resolveJunctionCollection(collectionPath) {
+		const segments = collectionPath.split("/").filter((s) => s && s !== "undefined");
+		if (segments.length < 3) return void 0;
+		let current = this.collections.find((c) => c.slug === segments[0]);
+		let relation;
+		for (let i = 2; i < segments.length && current; i += 2) {
+			relation = findRelation(resolveCollectionRelations(current), segments[i]);
+			if (!relation) return void 0;
+			try {
+				const target = relation.target();
+				current = this.collections.find((c) => c.slug === target?.slug) ?? target;
+			} catch {
+				return;
+			}
+		}
+		if (!relation || !isManyToMany(relation)) return void 0;
+		if (Object.keys(relation.through.properties).length === 0) return void 0;
+		return getJunctionConfigForRelation(relation.through);
+	}
+	/**
 	* Get the request-scoped driver. Throws if none is set — never falls
 	* back to the unscoped `this.driver` to avoid bypassing RLS/auth.
 	*/
@@ -4090,6 +4247,7 @@ var RestApiGenerator = class {
 			const driver = this.getScopedDriver(c);
 			this.enforceSubcollectionApiKeyPermission(c, parsed.collectionPath);
 			const body = await parseJsonBody(c);
+			if ("_pivot" in body) return this.updateRelationPivotFromBody(c, driver, parsed.collectionPath, parsed.id, body);
 			const targetCollection = this.resolveNestedWriteCollection(parsed.collectionPath);
 			if (targetCollection) {
 				assertKnownWriteFields(body, targetCollection, { viewer: requestViewer(c) });
@@ -7042,7 +7200,7 @@ async function mountOpenApiDocs(app, basePath, enableSwagger, serverCollections,
 		basePath,
 		requireAuth
 	}));
-	const { generateOpenApiSpec } = await import("./openapi-generator-DGyLbISS.js");
+	const { generateOpenApiSpec } = await import("./openapi-generator-CAFKF36E.js");
 	generateOpenApiSpecFn = generateOpenApiSpec;
 	if (isPublic) app.get(`${basePath}/docs`, (c) => spec(c));
 	else app.get(`${basePath}/docs`, createRequireAuth({}), requireAdmin, (c) => spec(c));
@@ -7206,7 +7364,10 @@ async function drainBackgroundWork(timeoutMs = 5e3) {
 	let timer;
 	const expired = new Promise((resolve) => {
 		timer = setTimeout(() => resolve("timeout"), timeoutMs);
-		timer.unref?.();
+		if (timer !== void 0 && typeof timer === "object") {
+			const release = timer.unref;
+			if (typeof release === "function") release.call(timer);
+		}
 	});
 	try {
 		await Promise.race([Promise.allSettled([...set]), expired]);
@@ -8391,19 +8552,42 @@ var ALL_RUNTIME_SURFACES = [
 	"functions",
 	"cron",
 	"meta",
-	"realtime"
+	"realtime",
+	"mcp"
 ];
 /**
-* Resolve a partial surface set against the default, which is everything on.
+* Surfaces that default to OFF, against the rule below.
 *
-* Defaulting to on rather than off is the whole compatibility story: a caller
-* that says nothing gets the process this server has always booted, and a
-* surface added later is mounted by every existing deployment without anyone
-* editing a list.
+* `mcp` is the first, and the exception is deliberate. The default-on rule is a
+* compatibility story — a caller that says nothing gets the process this server
+* has always booted — and it is the right rule for a surface that exposes
+* something the deployment already exposes by another name. It is the wrong
+* rule for this one.
+*
+* `mcp` mounts an OAuth authorization server that issues credentials to
+* third-party software, on a public path, to anyone who completes a consent
+* screen. Defaulting it on would mean every existing deployment starts doing
+* that at the next upgrade, because a library was updated — nobody would have
+* decided it, and most operators would not know it had happened. "A surface
+* added later is mounted by every existing deployment without anyone editing a
+* list" is precisely what must NOT happen here.
+*
+* So the compatibility story for this surface is inverted: an operator opts in
+* once, and everything else keeps behaving exactly as it did.
+*/
+var DEFAULT_OFF = ["mcp"];
+/**
+* Resolve a partial surface set against the default, which is everything on
+* except {@link DEFAULT_OFF}.
+*
+* Defaulting to on rather than off is the compatibility story: a caller that
+* says nothing gets the process this server has always booted, and a surface
+* added later is mounted by every existing deployment without anyone editing a
+* list. See {@link DEFAULT_OFF} for the one place that rule is wrong and why.
 */
 function resolveSurfaces(options) {
 	const resolved = {};
-	for (const surface of ALL_RUNTIME_SURFACES) resolved[surface] = options?.[surface] ?? true;
+	for (const surface of ALL_RUNTIME_SURFACES) resolved[surface] = options?.[surface] ?? !DEFAULT_OFF.includes(surface);
 	return resolved;
 }
 /** Resolve partial ownership against the default, which is owning everything. */
@@ -8414,10 +8598,62 @@ function resolveOwnership(options) {
 		rlsAudit: options?.rlsAudit ?? true
 	};
 }
-/** The surfaces a process is not serving, for a boot log line. */
+/** The surfaces a process is not serving. Literal: off is off, however it got there. */
 function disabledSurfaces(resolved) {
 	return ALL_RUNTIME_SURFACES.filter((surface) => !resolved[surface]);
 }
+/**
+* The surfaces whose absence is worth a line in the boot log.
+*
+* NOT the same question as {@link disabledSurfaces}, and conflating them made
+* every deployment in the fleet announce itself as partial.
+*
+* The line exists to tell one thing from another: a request answering 404
+* because this process was never meant to serve it is, from the client side,
+* indistinguishable from a broken deployment. That is worth saying — about a
+* surface somebody TURNED OFF.
+*
+* A {@link DEFAULT_OFF} surface is a different fact. Nobody turned `mcp` off;
+* it has never been on, and a deployment without it is not partial, it is the
+* deployment. Counting it made `offSurfaces` non-empty on every single boot —
+* managed tenant, self-hosted container, local dev — so a line that means
+* "somebody trimmed this process" started appearing on processes nobody had
+* trimmed. `split-roles-e2e.test.ts` calls this "the compatibility assertion for
+* the whole feature", and it has been failing since the MCP surface landed.
+*
+* An operator who explicitly disables a default-off surface still gets no line,
+* which is right: the process serves exactly what it would have served anyway.
+*/
+function trimmedSurfaces(resolved) {
+	return disabledSurfaces(resolved).filter((surface) => !DEFAULT_OFF.includes(surface));
+}
+//#endregion
+//#region src/init/callback-client.ts
+/**
+* Give every data source's driver the server client its callbacks read as
+* `context.client`.
+*
+* A driver is created before the client — the client depends on the mounted
+* Hono app — so the client is injected afterwards. It used to be injected into
+* the DEFAULT driver only. Each declared `database(...)` gets a bootstrapper and
+* a driver of its own, so a collection on a second source ran its callbacks with
+* `context.client === undefined`, typed as present through a cast in the driver:
+* a `beforeSave` calling `context.client.functions.invoke(...)` worked on the
+* default database and threw on the other one.
+*
+* Returns how many drivers took the client, which is what a test can hold.
+*/
+function injectCallbackClient(results, client) {
+	let injected = 0;
+	for (const result of results) {
+		const driver = result.internals?.driver;
+		if (driver && "client" in driver) {
+			driver.client = client;
+			injected++;
+		}
+	}
+	return injected;
+}
 //#endregion
 //#region src/init/process-safety.ts
 /**
@@ -8467,6 +8703,1750 @@ function installUnhandledRejectionHandler() {
 	};
 }
 //#endregion
+//#region src/mcp/oauth-store.ts
+var CLIENTS = "rebase.oauth_clients";
+var CODES = "rebase.oauth_authorization_codes";
+var REFRESH = "rebase.oauth_refresh_tokens";
+var CONSENTS = "rebase.oauth_consents";
+/** Every table this store owns, for the revoke sweep and for tests. */
+var OAUTH_TABLES = [
+	CLIENTS,
+	CODES,
+	REFRESH,
+	CONSENTS
+];
+/**
+* How long an authorization code lives.
+*
+* OAuth 2.1 says a code SHOULD be short-lived and names one minute as the
+* benchmark. The code never leaves the user-agent's redirect hop, so there is
+* no legitimate flow that needs longer, and a code sitting in browser history
+* or a proxy log stops being useful within a minute of being written there.
+*/
+var AUTHORIZATION_CODE_TTL_MS = 6e4;
+/**
+* A store backed by the driver's SQL escape hatch.
+*
+* Returns null when the driver cannot run SQL — Mongo, for one. The OAuth
+* surface is then not mounted at all rather than half-mounted: an authorization
+* server that cannot persist a code is not a degraded authorization server, it
+* is one that hands out credentials it cannot check.
+*/
+function createOAuthStore(driver) {
+	const admin = driver.admin;
+	if (!isSQLAdmin(admin)) return null;
+	const exec = (sql, params) => admin.executeSql(sql, params ? { params } : void 0);
+	const ddl = createDdlBootstrapper((sql) => exec(sql), "oauth-store");
+	return {
+		async ensureTables() {
+			await ddl.ensureObject(CLIENTS, `
+                CREATE TABLE IF NOT EXISTS ${CLIENTS} (
+                    client_id                  text PRIMARY KEY,
+                    client_secret_hash         text,
+                    client_name                text NOT NULL,
+                    redirect_uris              text[] NOT NULL,
+                    grant_types                text[] NOT NULL,
+                    scope                      text NOT NULL,
+                    token_endpoint_auth_method text NOT NULL,
+                    created_at                 timestamptz NOT NULL DEFAULT now()
+                )
+            `);
+			await ddl.ensureObject(CODES, `
+                CREATE TABLE IF NOT EXISTS ${CODES} (
+                    code_hash             text PRIMARY KEY,
+                    client_id             text NOT NULL,
+                    uid                   text NOT NULL,
+                    roles                 text[] NOT NULL DEFAULT '{}',
+                    redirect_uri          text NOT NULL,
+                    code_challenge        text NOT NULL,
+                    code_challenge_method text NOT NULL,
+                    scope                 text NOT NULL,
+                    resource              text NOT NULL,
+                    expires_at            timestamptz NOT NULL,
+                    consumed_at           timestamptz
+                )
+            `);
+			await ddl.ensureObject(REFRESH, `
+                CREATE TABLE IF NOT EXISTS ${REFRESH} (
+                    token_hash  text PRIMARY KEY,
+                    family      text NOT NULL,
+                    client_id   text NOT NULL,
+                    uid         text NOT NULL,
+                    roles       text[] NOT NULL DEFAULT '{}',
+                    scope       text NOT NULL,
+                    resource    text NOT NULL,
+                    issued_at   timestamptz NOT NULL DEFAULT now(),
+                    expires_at  timestamptz NOT NULL,
+                    consumed_at timestamptz,
+                    revoked_at  timestamptz
+                )
+            `);
+			await ddl.ensureObject(`${REFRESH} family index`, `
+                CREATE INDEX IF NOT EXISTS oauth_refresh_family_idx ON ${REFRESH} (family)
+            `);
+			await ddl.ensureObject(CONSENTS, `
+                CREATE TABLE IF NOT EXISTS ${CONSENTS} (
+                    uid        text NOT NULL,
+                    client_id  text NOT NULL,
+                    scope      text NOT NULL,
+                    granted_at timestamptz NOT NULL DEFAULT now(),
+                    PRIMARY KEY (uid, client_id)
+                )
+            `);
+			for (const table of OAUTH_TABLES) {
+				const [schema, name] = table.split(".");
+				await ddl.step(`revoke ${table}`, () => exec(revokeInternalTableSql(schema, name)));
+			}
+			await ddl.step("sweep expired codes", () => exec(`DELETE FROM ${CODES} WHERE expires_at < now() - interval '1 hour'`));
+			await ddl.step("sweep expired refresh tokens", () => exec(`DELETE FROM ${REFRESH} WHERE expires_at < now() - interval '30 days'`));
+			const missing = [];
+			for (const table of OAUTH_TABLES) if ((await exec(`SELECT to_regclass($1) AS present`, [table]))[0]?.present == null) missing.push(table);
+			if (missing.length > 0) throw new Error(`The OAuth tables were not created: ${missing.join(", ")}. The MCP surface cannot be served without them — check the boot log above for the statement that failed, which is usually a permissions problem on the \`rebase\` schema.`);
+		},
+		async registerClient(client) {
+			await exec(`INSERT INTO ${CLIENTS}
+                    (client_id, client_secret_hash, client_name, redirect_uris,
+                     grant_types, scope, token_endpoint_auth_method)
+                 VALUES ($1, $2, $3, $4, $5, $6, $7)`, [
+				client.clientId,
+				client.clientSecretHash,
+				client.clientName,
+				client.redirectUris,
+				client.grantTypes,
+				client.scope,
+				client.tokenEndpointAuthMethod
+			]);
+		},
+		async getClient(clientId) {
+			const row = (await exec(`SELECT * FROM ${CLIENTS} WHERE client_id = $1`, [clientId]))[0];
+			if (!row) return null;
+			return {
+				clientId: String(row.client_id),
+				clientSecretHash: row.client_secret_hash == null ? null : String(row.client_secret_hash),
+				clientName: String(row.client_name),
+				redirectUris: toStringArray(row.redirect_uris),
+				grantTypes: toStringArray(row.grant_types),
+				scope: String(row.scope),
+				tokenEndpointAuthMethod: String(row.token_endpoint_auth_method)
+			};
+		},
+		async countClients() {
+			const rows = await exec(`SELECT count(*)::int AS n FROM ${CLIENTS}`);
+			return Number(rows[0]?.n ?? 0);
+		},
+		async saveAuthorizationCode(code, record, expiresAt) {
+			await exec(`INSERT INTO ${CODES}
+                    (code_hash, client_id, uid, roles, redirect_uri,
+                     code_challenge, code_challenge_method, scope, resource, expires_at)
+                 VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)`, [
+				await sha256Hex(code),
+				record.clientId,
+				record.uid,
+				record.roles,
+				record.redirectUri,
+				record.codeChallenge,
+				record.codeChallengeMethod,
+				record.scope,
+				record.resource,
+				expiresAt.toISOString()
+			]);
+		},
+		async consumeAuthorizationCode(code) {
+			const row = (await exec(`UPDATE ${CODES}
+                    SET consumed_at = now()
+                  WHERE code_hash = $1
+                    AND consumed_at IS NULL
+                    AND expires_at > now()
+              RETURNING client_id, uid, roles, redirect_uri,
+                        code_challenge, code_challenge_method, scope, resource`, [await sha256Hex(code)]))[0];
+			if (!row) return null;
+			return {
+				clientId: String(row.client_id),
+				uid: String(row.uid),
+				roles: toStringArray(row.roles),
+				redirectUri: String(row.redirect_uri),
+				codeChallenge: String(row.code_challenge),
+				codeChallengeMethod: String(row.code_challenge_method),
+				scope: String(row.scope),
+				resource: String(row.resource)
+			};
+		},
+		async saveRefreshToken(token, record, expiresAt) {
+			await exec(`INSERT INTO ${REFRESH}
+                    (token_hash, family, client_id, uid, roles, scope, resource, expires_at)
+                 VALUES ($1, $2, $3, $4, $5, $6, $7, $8)`, [
+				await sha256Hex(token),
+				record.family,
+				record.clientId,
+				record.uid,
+				record.roles,
+				record.scope,
+				record.resource,
+				expiresAt.toISOString()
+			]);
+		},
+		async consumeRefreshToken(token) {
+			const hash = await sha256Hex(token);
+			const row = (await exec(`UPDATE ${REFRESH}
+                    SET consumed_at = now()
+                  WHERE token_hash = $1
+                    AND consumed_at IS NULL
+                    AND revoked_at IS NULL
+                    AND expires_at > now()
+              RETURNING family, client_id, uid, roles, scope, resource`, [hash]))[0];
+			if (row) return {
+				family: String(row.family),
+				clientId: String(row.client_id),
+				uid: String(row.uid),
+				roles: toStringArray(row.roles),
+				scope: String(row.scope),
+				resource: String(row.resource)
+			};
+			const family = (await exec(`SELECT family FROM ${REFRESH} WHERE token_hash = $1 AND consumed_at IS NOT NULL`, [hash]))[0]?.family;
+			if (family) {
+				logger.error("[oauth] Refresh token replayed — revoking the whole family", { family });
+				await exec(`UPDATE ${REFRESH} SET revoked_at = now() WHERE family = $1 AND revoked_at IS NULL`, [String(family)]);
+			}
+			return null;
+		},
+		async revokeFamily(family) {
+			await exec(`UPDATE ${REFRESH} SET revoked_at = now() WHERE family = $1 AND revoked_at IS NULL`, [family]);
+		},
+		async revokeTokenForClient(token, clientId) {
+			return (await exec(`UPDATE ${REFRESH}
+                    SET revoked_at = now()
+                  WHERE revoked_at IS NULL
+                    AND family = (
+                        SELECT family FROM ${REFRESH}
+                         WHERE token_hash = $1 AND client_id = $2
+                    )
+              RETURNING token_hash`, [await sha256Hex(token), clientId])).length > 0;
+		},
+		async recordConsent(uid, clientId, scope) {
+			await exec(`INSERT INTO ${CONSENTS} (uid, client_id, scope)
+                 VALUES ($1, $2, $3)
+                 ON CONFLICT (uid, client_id)
+                 DO UPDATE SET scope = EXCLUDED.scope, granted_at = now()`, [
+				uid,
+				clientId,
+				scope
+			]);
+		},
+		async listGrants(uid) {
+			return (await exec(`SELECT c.client_id,
+                        COALESCE(cl.client_name, '(unknown application)') AS client_name,
+                        c.scope,
+                        c.granted_at,
+                        (SELECT count(*)::int
+                           FROM ${REFRESH} r
+                          WHERE r.uid = c.uid
+                            AND r.client_id = c.client_id
+                            AND r.revoked_at IS NULL
+                            AND r.consumed_at IS NULL
+                            AND r.expires_at > now()) AS active_tokens
+                   FROM ${CONSENTS} c
+                   LEFT JOIN ${CLIENTS} cl ON cl.client_id = c.client_id
+                  WHERE c.uid = $1
+                  ORDER BY c.granted_at DESC`, [uid])).map((row) => ({
+				clientId: String(row.client_id),
+				clientName: String(row.client_name),
+				scope: String(row.scope),
+				grantedAt: new Date(String(row.granted_at)).toISOString(),
+				activeTokens: Number(row.active_tokens ?? 0)
+			}));
+		},
+		async revokeGrant(uid, clientId) {
+			const revoked = await exec(`UPDATE ${REFRESH}
+                    SET revoked_at = now()
+                  WHERE uid = $1 AND client_id = $2 AND revoked_at IS NULL
+              RETURNING token_hash`, [uid, clientId]);
+			const consent = await exec(`DELETE FROM ${CONSENTS} WHERE uid = $1 AND client_id = $2 RETURNING client_id`, [uid, clientId]);
+			const found = revoked.length > 0 || consent.length > 0;
+			if (found) logger.info("[oauth] Grant revoked by the user", {
+				uid,
+				clientId,
+				refreshTokensRevoked: revoked.length
+			});
+			return found;
+		}
+	};
+}
+/**
+* Read a `text[]` column back as strings.
+*
+* Drivers disagree about array columns: `pg` parses them into a JS array, while
+* a driver that goes through a generic JSON path can hand back the Postgres
+* literal `{a,b}`. Normalising here keeps that disagreement out of every caller.
+*/
+function toStringArray(value) {
+	if (Array.isArray(value)) return value.map(String);
+	if (typeof value === "string") {
+		const inner = value.replace(/^\{|\}$/g, "");
+		if (!inner) return [];
+		return inner.split(",").map((s) => s.replace(/^"|"$/g, ""));
+	}
+	return [];
+}
+//#endregion
+//#region src/mcp/oauth-metadata.ts
+/**
+* The discovery documents and the small pure rules the OAuth surface is built
+* from: canonical URIs, PKCE, scopes, redirect-URI matching.
+*
+* Everything here is a function of its arguments. That is deliberate — these
+* are the parts a specification pins down exactly, and the parts where being
+* approximately right is indistinguishable from being wrong until a client
+* refuses to connect. Keeping them free of Hono, of the database and of the
+* server's config means the tests can state the spec's rules directly.
+*
+* References, because every rule below traces to one:
+*   RFC 9728  OAuth 2.0 Protected Resource Metadata
+*   RFC 8414  OAuth 2.0 Authorization Server Metadata
+*   RFC 7591  Dynamic Client Registration
+*   RFC 8707  Resource Indicators
+*   RFC 7636  PKCE
+*   OAuth 2.1 draft-ietf-oauth-v2-1
+*/
+/**
+* What a token may do at `/mcp`.
+*
+* Two, and no more. RFC 9728 asks `scopes_supported` to be the minimal set that
+* makes the resource usable, and the MCP specification's scope-minimization
+* guidance points the same way: a client that only needs to read should be able
+* to ask for exactly that, and a consent screen listing eleven fine-grained
+* permissions is one nobody reads.
+*
+* They are not a substitute for RLS. A `mcp:read` token still reads through the
+* user's own policies — the scope decides whether the tool exists for this
+* session, the database decides which rows come back.
+*/
+var MCP_SCOPES = ["mcp:read", "mcp:write"];
+/** The scope a client gets when it asks for nothing in particular. */
+var DEFAULT_MCP_SCOPE = "mcp:read";
+/**
+* The canonical resource identifier for this server's MCP endpoint.
+*
+* RFC 8707 §2 and the MCP specification agree on the shape: an absolute URI,
+* lowercase scheme and host, no fragment, and — where the spec expresses a
+* preference — no trailing slash. Clients send this back as the `resource`
+* parameter and the token's audience is bound to it, so a value that disagrees
+* with what the client computed rejects every token. It is worth being fussy.
+*/
+function canonicalResourceUri(publicUrl, mcpPath = "/mcp") {
+	const url = new URL(publicUrl);
+	url.hash = "";
+	url.search = "";
+	url.protocol = url.protocol.toLowerCase();
+	url.hostname = url.hostname.toLowerCase();
+	const base = url.origin;
+	const path = mcpPath.startsWith("/") ? mcpPath : `/${mcpPath}`;
+	return path === "/" ? base : `${base}${path.replace(/\/+$/, "")}`;
+}
+/** The issuer identifier: the origin, with no path. */
+function issuerFor(publicUrl) {
+	return new URL(publicUrl).origin;
+}
+/**
+* Where the protected-resource metadata for a given resource lives.
+*
+* RFC 9728 §3.1 inserts `.well-known/oauth-protected-resource` **between** the
+* host and the resource's own path — `https://h/mcp` is described at
+* `https://h/.well-known/oauth-protected-resource/mcp`, not at
+* `…/mcp/.well-known/…`. Getting this backwards is a 404 the client reports as
+* "no authorization server", which points at everything except the path.
+*/
+function protectedResourceMetadataPath(mcpPath = "/mcp") {
+	const path = mcpPath.startsWith("/") ? mcpPath : `/${mcpPath}`;
+	return path === "/" ? "/.well-known/oauth-protected-resource" : `/.well-known/oauth-protected-resource${path.replace(/\/+$/, "")}`;
+}
+function protectedResourceMetadata(publicUrl, mcpPath = "/mcp") {
+	return {
+		resource: canonicalResourceUri(publicUrl, mcpPath),
+		authorization_servers: [issuerFor(publicUrl)],
+		scopes_supported: [...MCP_SCOPES],
+		bearer_methods_supported: ["header"],
+		resource_documentation: "https://rebase.pro/docs/ai/mcp"
+	};
+}
+function authorizationServerMetadata(publicUrl, oauthBasePath) {
+	const issuer = issuerFor(publicUrl);
+	const base = `${issuer}${oauthBasePath}`;
+	return {
+		issuer,
+		authorization_endpoint: `${base}/authorize`,
+		token_endpoint: `${base}/token`,
+		registration_endpoint: `${base}/register`,
+		revocation_endpoint: `${base}/revoke`,
+		revocation_endpoint_auth_methods_supported: [
+			"client_secret_post",
+			"client_secret_basic",
+			"none"
+		],
+		scopes_supported: [...MCP_SCOPES],
+		response_types_supported: ["code"],
+		grant_types_supported: ["authorization_code", "refresh_token"],
+		code_challenge_methods_supported: ["S256"],
+		token_endpoint_auth_methods_supported: [
+			"client_secret_post",
+			"client_secret_basic",
+			"none"
+		],
+		authorization_response_iss_parameter_supported: true,
+		service_documentation: "https://rebase.pro/docs/ai/mcp"
+	};
+}
+/**
+* Verify a PKCE code verifier against the challenge recorded at authorize time.
+*
+* RFC 7636 §4.6: BASE64URL(SHA256(ASCII(verifier))) === challenge, with the
+* base64url unpadded. Only S256 is accepted — `plain` compares the verifier to
+* itself, which protects against nothing once the code has leaked, and OAuth
+* 2.1 removes it.
+*/
+async function verifyPkce(verifier, challenge, method) {
+	if (method !== "S256") return false;
+	if (!/^[A-Za-z0-9\-._~]{43,128}$/.test(verifier)) return false;
+	return base64UrlEncode(await sha256Bytes(verifier)) === challenge;
+}
+/** Unpadded base64url, as every one of these RFCs means it. */
+function base64UrlEncode(bytes) {
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+/**
+* Is `candidate` one of the client's registered redirect URIs?
+*
+* Exact string comparison, which is what OAuth 2.1 §4.1.2.1 requires and what
+* closes open redirection. No prefix matching, no ignoring the query, no
+* "same origin is close enough" — every one of those has been the published
+* root cause of a token-stealing redirect, because an attacker who controls any
+* path or parameter on a permitted origin controls where the code lands.
+*
+* The one concession is loopback: RFC 8252 §7.3 requires the port to be ignored
+* for `http://127.0.0.1` and `http://[::1]`, because a native client binds an
+* ephemeral port it cannot know at registration time. `localhost` is
+* deliberately NOT included — RFC 8252 §8.3 recommends against it, since it
+* resolves through a name service an attacker may influence.
+*/
+function redirectUriAllowed(candidate, registered) {
+	if (registered.includes(candidate)) return true;
+	let url;
+	try {
+		url = new URL(candidate);
+	} catch {
+		return false;
+	}
+	if (url.protocol !== "http:") return false;
+	if (url.hostname !== "127.0.0.1" && url.hostname !== "[::1]" && url.hostname !== "::1") return false;
+	return registered.some((entry) => {
+		let known;
+		try {
+			known = new URL(entry);
+		} catch {
+			return false;
+		}
+		return known.protocol === url.protocol && known.hostname === url.hostname && known.pathname === url.pathname && known.search === url.search;
+	});
+}
+/**
+* Narrow a requested scope to what this server issues.
+*
+* An unknown scope is dropped rather than refused. RFC 6749 §3.3 allows either,
+* and dropping is what keeps a client that asks for `openid profile email` out
+* of habit from failing to connect at all — it gets the MCP scopes it is
+* entitled to and none of the ones it invented.
+*/
+function narrowScope(requested) {
+	if (!requested) return DEFAULT_MCP_SCOPE;
+	const granted = requested.split(/\s+/).filter(Boolean).filter((s) => MCP_SCOPES.includes(s));
+	return granted.length ? [...new Set(granted)].join(" ") : DEFAULT_MCP_SCOPE;
+}
+/** Does a granted scope string carry this permission? */
+function scopeAllows(scope, needed) {
+	return scope.split(/\s+/).filter(Boolean).includes(needed);
+}
+/**
+* The `WWW-Authenticate` value for an unauthenticated request.
+*
+* RFC 6750 §3 plus the MCP specification's requirement that the challenge point
+* at the protected-resource metadata: a client with no token discovers the
+* entire authorization server from this one header, so an omitted
+* `resource_metadata` is what makes a server look like it has no auth at all.
+*/
+function bearerChallenge(publicUrl, mcpPath, scope) {
+	const parts = [`Bearer resource_metadata="${`${issuerFor(publicUrl)}${protectedResourceMetadataPath(mcpPath)}`}"`];
+	if (scope) parts.push(`scope="${scope}"`);
+	return parts.join(", ");
+}
+/** The 403 challenge for a token that is valid but too narrow. */
+function insufficientScopeChallenge(publicUrl, mcpPath, needed, description) {
+	const metadataUrl = `${issuerFor(publicUrl)}${protectedResourceMetadataPath(mcpPath)}`;
+	return [
+		`Bearer error="insufficient_scope"`,
+		`scope="${needed}"`,
+		`resource_metadata="${metadataUrl}"`,
+		`error_description="${description.replace(/"/g, "'")}"`
+	].join(", ");
+}
+/**
+* Does the `resource` a client asked for name this server?
+*
+* RFC 8707 lets a client send a resource more specific than the one the server
+* advertises, so this compares on origin plus path prefix rather than equality
+* — `https://h/mcp` accepts `https://h/mcp` and rejects `https://h/mcpx` and
+* anything on another origin. Rejecting is the point: a token minted for
+* another audience must never be usable here, and the check that stops that
+* starts at the authorize request.
+*/
+function resourceMatches(requested, canonical) {
+	let asked;
+	try {
+		asked = new URL(requested);
+	} catch {
+		return false;
+	}
+	if (asked.hash) return false;
+	const mine = new URL(canonical);
+	if (asked.origin.toLowerCase() !== mine.origin.toLowerCase()) return false;
+	const askedPath = asked.pathname.replace(/\/+$/, "");
+	const minePath = mine.pathname.replace(/\/+$/, "");
+	return askedPath === minePath || askedPath.startsWith(`${minePath}/`);
+}
+//#endregion
+//#region src/mcp/consent-page.ts
+/**
+* The headers a consent screen must carry.
+*
+* `frame-ancestors 'none'` and `X-Frame-Options` are the ones that matter, and
+* they were missing. A consent screen is the single page in an OAuth flow that
+* must not be frameable: an attacker who can iframe it, make it transparent and
+* float a button under the user's cursor gets "Allow" pressed for a client they
+* registered — clickjacking, with the prize being the victim's data. The user
+* sees nothing, because the page they consented on was never visible.
+*
+* The rest follows from what the page is. `no-store`, because the HTML embeds a
+* signed authorization request. `no-referrer`, so the `client_id` and `state`
+* in this URL do not travel to whatever the redirect target loads. `form-action
+* 'self'`, so an injection cannot repoint the form at its own collector.
+*/
+function consentPageHeaders(nonce) {
+	return {
+		"Content-Type": "text/html; charset=utf-8",
+		"X-Frame-Options": "DENY",
+		"Content-Security-Policy": [
+			"default-src 'none'",
+			`script-src 'nonce-${nonce}'`,
+			"style-src 'unsafe-inline'",
+			"connect-src 'self'",
+			"form-action 'self'",
+			"frame-ancestors 'none'",
+			"base-uri 'none'"
+		].join("; "),
+		"Referrer-Policy": "no-referrer",
+		"Cache-Control": "no-store",
+		"X-Content-Type-Options": "nosniff"
+	};
+}
+function renderConsentPage(params) {
+	const clientName = escapeHtml$2(params.clientName.slice(0, 120));
+	return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="robots" content="noindex, nofollow">
+<title>Authorize ${clientName}</title>
+<style>
+  :root {
+    color-scheme: light dark;
+    --bg: #f6f7f9; --card: #ffffff; --ink: #16181d; --muted: #5b6472;
+    --line: #e3e6ea; --accent: #2f6df6; --danger: #b42318;
+  }
+  @media (prefers-color-scheme: dark) {
+    :root { --bg:#0f1115; --card:#171a21; --ink:#e9ecf1; --muted:#9aa4b2; --line:#262b34; }
+  }
+  * { box-sizing: border-box; }
+  body {
+    margin: 0; min-height: 100vh; display: grid; place-items: center; padding: 24px;
+    background: var(--bg); color: var(--ink);
+    font: 15px/1.55 system-ui, -apple-system, "Segoe UI", Roboto, sans-serif;
+  }
+  .card {
+    width: 100%; max-width: 460px; background: var(--card);
+    border: 1px solid var(--line); border-radius: 14px; padding: 28px;
+  }
+  h1 { font-size: 19px; margin: 0 0 6px; letter-spacing: -0.01em; }
+  .resource { color: var(--muted); font-size: 13px; margin: 0 0 20px; word-break: break-all; }
+  ul { margin: 0 0 8px; padding-left: 20px; }
+  li { margin: 6px 0; }
+  li strong { font-weight: 550; }
+  .limits {
+    margin: 18px 0 22px; padding: 12px 14px; border-radius: 9px;
+    background: color-mix(in srgb, var(--accent) 8%, transparent);
+    border: 1px solid color-mix(in srgb, var(--accent) 22%, transparent);
+    font-size: 13.5px; color: var(--muted);
+  }
+  label { display: block; font-size: 13px; color: var(--muted); margin: 12px 0 5px; }
+  input[type=email], input[type=password] {
+    width: 100%; padding: 9px 11px; border-radius: 8px;
+    border: 1px solid var(--line); background: var(--bg); color: var(--ink); font: inherit;
+  }
+  .row { display: flex; gap: 10px; margin-top: 22px; }
+  button {
+    flex: 1; padding: 10px 14px; border-radius: 8px; font: inherit; font-weight: 550; cursor: pointer;
+    border: 1px solid var(--line); background: transparent; color: var(--ink);
+  }
+  button.primary { background: var(--accent); border-color: var(--accent); color: #fff; }
+  button[disabled] { opacity: .55; cursor: progress; }
+  .error { color: var(--danger); font-size: 13px; margin-top: 12px; min-height: 1em; }
+  .who { font-size: 13px; color: var(--muted); margin-top: 4px; }
+</style>
+</head>
+<body>
+<main class="card">
+  <h1>&ldquo;${clientName}&rdquo; wants access to your account</h1>
+  <p class="resource">${escapeHtml$2(params.resource)}</p>
+
+  <p style="margin:0 0 8px">If you allow it, this application will be able to:</p>
+  <ul>${params.scopeDescriptions.map((s) => `<li><strong>${escapeHtml$2(s.description)}</strong></li>`).join("")}</ul>
+
+  <div class="limits">
+    It will act <strong>as you</strong>, and can never see more than you can:
+    every row it reads is filtered by the same permissions that apply when you
+    use this application yourself. You can disconnect it later, which stops it
+    renewing its access.
+  </div>
+
+  <form id="consent" method="post" action="${escapeAttr(params.decisionUrl)}">
+    <input type="hidden" name="request_token" value="${escapeAttr(params.requestToken)}">
+    <input type="hidden" name="session_token" id="session_token" value="">
+    <input type="hidden" name="decision" id="decision" value="allow">
+
+    <div id="signin">
+      <label for="email">Email</label>
+      <input type="email" id="email" name="email" autocomplete="username" required>
+      <label for="password">Password</label>
+      <input type="password" id="password" name="password" autocomplete="current-password" required>
+    </div>
+    <p class="who" id="who" hidden></p>
+
+    <div class="row">
+      <button type="button" id="deny">Deny</button>
+      <button type="submit" class="primary" id="allow">Allow</button>
+    </div>
+    <p class="error" id="error"></p>
+  </form>
+</main>
+
+<script nonce="${escapeAttr(params.nonce)}">
+(function () {
+  var form = document.getElementById("consent");
+  var email = document.getElementById("email");
+  var password = document.getElementById("password");
+  var sessionToken = document.getElementById("session_token");
+  var decision = document.getElementById("decision");
+  var error = document.getElementById("error");
+  var allow = document.getElementById("allow");
+
+  document.getElementById("deny").addEventListener("click", function () {
+    decision.value = "deny";
+    // The password fields are required, and a denial must not be blocked by
+    // them: refusing is the one answer that should never need a credential.
+    email.removeAttribute("required");
+    password.removeAttribute("required");
+    form.submit();
+  });
+
+  form.addEventListener("submit", function (event) {
+    if (decision.value === "deny") return;
+    if (sessionToken.value) return;      // already signed in; let it post
+
+    event.preventDefault();
+    error.textContent = "";
+    allow.disabled = true;
+
+    // The password goes to the EXISTING login endpoint and nowhere else. This
+    // page never posts it to the OAuth surface, which sees only the resulting
+    // session token.
+    fetch(${JSON.stringify(params.loginUrl)}, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ email: email.value, password: password.value })
+    })
+      .then(function (res) { return res.json().then(function (b) { return { ok: res.ok, body: b }; }); })
+      .then(function (r) {
+        // buildAuthResponse returns { user, tokens: { accessToken } }. The
+        // flatter spellings are fallbacks rather than guesses: the login
+        // response passes through applyTransformHook, so a deployment can
+        // legitimately reshape it, and a consent screen that broke because
+        // someone customised their auth response would be a very hard failure
+        // to attribute.
+        //
+        // No backticks anywhere in this script: it lives inside a template
+        // literal, and one would end the string early — which is exactly how
+        // this comment broke the build the first time it was written.
+        var tokens = (r.body && r.body.tokens) || {};
+        var token = tokens.accessToken || (r.body && (r.body.accessToken || r.body.access_token));
+        if (!r.ok || !token) {
+          throw new Error((r.body && (r.body.error || r.body.message)) || "Sign-in failed.");
+        }
+        sessionToken.value = token;
+        form.submit();
+      })
+      .catch(function (err) {
+        allow.disabled = false;
+        error.textContent = err.message || "Sign-in failed.";
+      });
+  });
+})();
+<\/script>
+</body>
+</html>`;
+}
+function escapeHtml$2(value) {
+	return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+/**
+* Escape for an attribute value.
+*
+* Same as {@link escapeHtml} today, kept separate because the two have
+* different jobs and the attribute one must never be relaxed — a client name
+* containing a quote would otherwise close the attribute and open an event
+* handler.
+*/
+function escapeAttr(value) {
+	return escapeHtml$2(value);
+}
+//#endregion
+//#region src/mcp/oauth-routes.ts
+/**
+* The OAuth 2.1 authorization server that issues tokens for `/mcp`.
+*
+* Three endpoints and a decision handler:
+*
+*   POST /register            RFC 7591 dynamic client registration
+*   GET  /authorize           the user-facing consent hop
+*   POST /authorize/decision  what the consent page posts back
+*   POST /token               code and refresh grants
+*
+* The one shape worth explaining up front is `/authorize/decision`. This server
+* already has a login endpoint, a password policy, rate limits and whatever MFA
+* the deployment configured, and duplicating any of that here would mean a
+* second credential path with its own bugs. So the consent page never sees a
+* password: it posts to the EXISTING `${basePath}/auth/login`, gets an ordinary
+* session token back, and hands that to `/authorize/decision` as proof of who
+* is consenting. This file authenticates a person exactly once, with the same
+* function `/api/data` uses, and otherwise deals only in grants.
+*
+* The authorization request itself is carried across that hop as a signed,
+* 10-minute token rather than as form fields. Without that, `/authorize/
+* decision` would mint a code for whatever `client_id` and `redirect_uri` its
+* caller typed — an open code-minting endpoint that skips every check
+* `/authorize` performs.
+*/
+/** How long an issued MCP access token lives. */
+var ACCESS_TOKEN_TTL_SECONDS = 3600;
+/** How long a refresh token lives. Rotated on every use. */
+var REFRESH_TOKEN_TTL_MS = 720 * 60 * 60 * 1e3;
+/** How long the signed authorization request survives the login hop. */
+var AUTHORIZE_REQUEST_TTL_SECONDS = 600;
+/**
+* A ceiling on open dynamic registration.
+*
+* RFC 7591 registration has to be open for the MCP flow to work at all — the
+* client is a piece of software the operator has never heard of, and there is
+* nobody to hand a client ID to in advance. Open means anyone can POST, so the
+* table is a free write for the internet. The cap turns "unbounded rows" into
+* "a bounded, boring amount of junk", which is the difference between a nuisance
+* and a disk-exhaustion vector.
+*/
+var MAX_REGISTERED_CLIENTS = 5e3;
+function createOAuthRoutes(config) {
+	const router = new Hono();
+	const { store, publicUrl, mcpPath } = config;
+	const issuer = issuerFor(publicUrl);
+	const canonicalResource = canonicalResourceUri(publicUrl, mcpPath);
+	/**
+	* Registration is an unauthenticated write, so it gets the tightest limit here.
+	*
+	* The cap above bounds the *total* damage; this bounds the rate at which one
+	* source can approach it. Without both, a single host can fill five thousand
+	* rows in a few seconds and every legitimate client that arrives afterwards is
+	* refused — the cap turns into the denial of service rather than the defence
+	* against one. Ten registrations in fifteen minutes is generous for the real
+	* pattern, which is a person connecting an application once.
+	*/
+	const registrationLimiter = createRateLimiter({
+		windowMs: 900 * 1e3,
+		limit: 10,
+		message: "Too many client registrations from this address. Try again later."
+	});
+	/**
+	* The token endpoint, which is where a stolen code or refresh token gets spent.
+	*
+	* Looser than registration because a busy deployment legitimately refreshes
+	* often — one token per client per hour, times however many clients a user has
+	* connected, times however many users share an egress IP. 120 in fifteen
+	* minutes leaves that comfortable while making an offline guessing loop against
+	* a code or a client secret pointless: both are 256 bits, so the limit is
+	* belt-and-braces rather than the actual protection.
+	*/
+	const tokenLimiter = createRateLimiter({
+		windowMs: 900 * 1e3,
+		limit: 120,
+		message: "Too many token requests, please try again later."
+	});
+	/**
+	* The authorize endpoint and its decision hop.
+	*
+	* Rendering a consent page is cheap, but the decision hop verifies a session
+	* token on every call, and an unauthenticated caller can drive it. Shared
+	* between the two because they are two halves of one flow and a limit that
+	* only covers the cheap half is decorative.
+	*/
+	const authorizeLimiter = createRateLimiter({
+		windowMs: 900 * 1e3,
+		limit: 60,
+		message: "Too many authorization requests, please try again later."
+	});
+	router.post("/register", registrationLimiter, async (c) => {
+		if (!config.allowDynamicRegistration) return c.json({
+			error: "access_denied",
+			error_description: "Dynamic client registration is disabled on this deployment."
+		}, 403);
+		let body;
+		try {
+			body = await c.req.json();
+		} catch {
+			return c.json({
+				error: "invalid_client_metadata",
+				error_description: "Body must be JSON."
+			}, 400);
+		}
+		const redirectUris = Array.isArray(body.redirect_uris) ? body.redirect_uris.map(String) : [];
+		if (redirectUris.length === 0) return c.json({
+			error: "invalid_redirect_uri",
+			error_description: "At least one redirect_uri is required."
+		}, 400);
+		for (const uri of redirectUris) {
+			const problem = redirectUriProblem(uri);
+			if (problem) return c.json({
+				error: "invalid_redirect_uri",
+				error_description: `${uri}: ${problem}`
+			}, 400);
+		}
+		if (await store.countClients() >= MAX_REGISTERED_CLIENTS) {
+			logger.error("[oauth] Registration refused: client cap reached", { cap: MAX_REGISTERED_CLIENTS });
+			return c.json({
+				error: "invalid_client_metadata",
+				error_description: "This deployment has reached its registered-client limit."
+			}, 400);
+		}
+		const isPublic = (typeof body.token_endpoint_auth_method === "string" ? body.token_endpoint_auth_method : "client_secret_post") === "none";
+		const clientId = `mcp_${randomHex(16)}`;
+		const clientSecret = isPublic ? null : randomHex(32);
+		const grantTypes = Array.isArray(body.grant_types) && body.grant_types.length ? body.grant_types.map(String).filter((g) => g === "authorization_code" || g === "refresh_token") : ["authorization_code", "refresh_token"];
+		if (!grantTypes.includes("authorization_code")) return c.json({
+			error: "invalid_client_metadata",
+			error_description: "Only authorization_code (with optional refresh_token) is supported."
+		}, 400);
+		const scope = narrowScope(typeof body.scope === "string" ? body.scope : void 0);
+		await store.registerClient({
+			clientId,
+			clientSecretHash: clientSecret ? await sha256Hex(clientSecret) : null,
+			clientName: typeof body.client_name === "string" && body.client_name.trim() ? body.client_name.slice(0, 200) : "Unnamed MCP client",
+			redirectUris,
+			grantTypes,
+			scope,
+			tokenEndpointAuthMethod: isPublic ? "none" : "client_secret_post"
+		});
+		logger.info("[oauth] Registered MCP client", {
+			clientId,
+			redirectUris
+		});
+		return c.json({
+			client_id: clientId,
+			...clientSecret ? { client_secret: clientSecret } : {},
+			client_id_issued_at: Math.floor(Date.now() / 1e3),
+			...clientSecret ? { client_secret_expires_at: 0 } : {},
+			redirect_uris: redirectUris,
+			grant_types: grantTypes,
+			response_types: ["code"],
+			token_endpoint_auth_method: isPublic ? "none" : "client_secret_post",
+			scope
+		}, 201);
+	});
+	router.get("/authorize", authorizeLimiter, async (c) => {
+		const q = c.req.query();
+		const clientId = q.client_id;
+		if (!clientId) return authorizeInputError(c, "invalid_request", "client_id is required.");
+		const client = await store.getClient(clientId);
+		if (!client) return authorizeInputError(c, "invalid_client", "Unknown client_id.");
+		const redirectUri = q.redirect_uri;
+		if (!redirectUri) return authorizeInputError(c, "invalid_request", "redirect_uri is required.");
+		if (!redirectUriAllowed(redirectUri, client.redirectUris)) return authorizeInputError(c, "invalid_request", "redirect_uri does not match a registered redirect URI for this client.");
+		const state = q.state;
+		if (state !== void 0 && state.length > 512) return authorizeInputError(c, "invalid_request", "state is too long (512 characters maximum).");
+		const fail = (error, description) => c.redirect(errorRedirect(redirectUri, error, description, state, issuer), 302);
+		if (q.response_type !== "code") return fail("unsupported_response_type", "Only the authorization code flow is supported.");
+		const codeChallenge = q.code_challenge;
+		if (!codeChallenge) return fail("invalid_request", "code_challenge is required (PKCE).");
+		const codeChallengeMethod = q.code_challenge_method ?? "plain";
+		if (codeChallengeMethod !== "S256") return fail("invalid_request", "code_challenge_method must be S256.");
+		const resource = q.resource;
+		if (!resource) return fail("invalid_request", "resource is required (RFC 8707).");
+		if (!resourceMatches(resource, canonicalResource)) return fail("invalid_target", `resource must identify ${canonicalResource}.`);
+		const scope = narrowScope(q.scope);
+		const requestToken = await signPurposeToken("mcp-authorize-request", {
+			clientId,
+			redirectUri,
+			codeChallenge,
+			codeChallengeMethod,
+			scope,
+			resource: canonicalResource,
+			...state ? { state } : {}
+		}, AUTHORIZE_REQUEST_TTL_SECONDS);
+		const nonce = randomHex(16);
+		return c.body(renderConsentPage({
+			clientName: client.clientName,
+			scope,
+			scopeDescriptions: describeScopes(scope),
+			requestToken,
+			loginUrl: `${config.authBasePath}/login`,
+			decisionUrl: `${c.req.path}/decision`,
+			resource: canonicalResource,
+			nonce
+		}), 200, consentPageHeaders(nonce));
+	});
+	/**
+	* What the consent page posts once the person has signed in and pressed
+	* Allow. Mints the authorization code and sends it home.
+	*/
+	router.post("/authorize/decision", authorizeLimiter, async (c) => {
+		const form = await c.req.parseBody();
+		const requestToken = String(form.request_token ?? "");
+		const sessionToken = String(form.session_token ?? "");
+		const approved = String(form.decision ?? "") === "allow";
+		const request = await verifyPurposeToken("mcp-authorize-request", requestToken);
+		if (!request) return c.html("<h1>This authorization request has expired</h1><p>Start again from the application that sent you here.</p>", 400);
+		if (!approved) return c.redirect(errorRedirect(request.redirectUri, "access_denied", "The user declined.", request.state, issuer), 302);
+		const session = await verifyAccessToken(sessionToken);
+		if (!session) return c.redirect(errorRedirect(request.redirectUri, "access_denied", "Not signed in.", request.state, issuer), 302);
+		const code = randomHex(32);
+		await store.saveAuthorizationCode(code, {
+			clientId: request.clientId,
+			uid: session.uid,
+			roles: session.roles ?? [],
+			redirectUri: request.redirectUri,
+			codeChallenge: request.codeChallenge,
+			codeChallengeMethod: request.codeChallengeMethod,
+			scope: request.scope,
+			resource: request.resource
+		}, new Date(Date.now() + AUTHORIZATION_CODE_TTL_MS));
+		await store.recordConsent(session.uid, request.clientId, request.scope);
+		const target = new URL(request.redirectUri);
+		target.searchParams.set("code", code);
+		if (request.state) target.searchParams.set("state", request.state);
+		target.searchParams.set("iss", issuer);
+		logger.info("[oauth] Authorization code issued", {
+			clientId: request.clientId,
+			uid: session.uid,
+			scope: request.scope
+		});
+		return c.redirect(target.toString(), 302);
+	});
+	router.post("/token", tokenLimiter, async (c) => {
+		const form = await c.req.parseBody();
+		const grantType = String(form.grant_type ?? "");
+		const clientId = String(form.client_id ?? "") || basicAuthClientId(c.req.header("authorization"));
+		if (!clientId) return c.json({
+			error: "invalid_client",
+			error_description: "client_id is required."
+		}, 401);
+		const client = await store.getClient(clientId);
+		if (!client) return c.json({
+			error: "invalid_client",
+			error_description: "Unknown client."
+		}, 401);
+		if (client.clientSecretHash) {
+			const presented = String(form.client_secret ?? "") || basicAuthSecret(c.req.header("authorization"));
+			if (!presented || !constantTimeEqual(await sha256Hex(presented), client.clientSecretHash)) return c.json({
+				error: "invalid_client",
+				error_description: "Client authentication failed."
+			}, 401);
+		}
+		if (grantType === "authorization_code") return handleAuthorizationCodeGrant(c, form, client);
+		if (grantType === "refresh_token") return handleRefreshGrant(c, form, client);
+		return c.json({
+			error: "unsupported_grant_type",
+			error_description: "Supported grants: authorization_code, refresh_token."
+		}, 400);
+	});
+	async function handleAuthorizationCodeGrant(c, form, client) {
+		const code = String(form.code ?? "");
+		if (!code) return c.json({
+			error: "invalid_request",
+			error_description: "code is required."
+		}, 400);
+		const record = await store.consumeAuthorizationCode(code);
+		if (!record) return c.json({
+			error: "invalid_grant",
+			error_description: "Code is invalid, expired or already used."
+		}, 400);
+		if (record.clientId !== client.clientId) {
+			logger.error("[oauth] Code redeemed by the wrong client", {
+				mintedFor: record.clientId,
+				presentedBy: client.clientId
+			});
+			return c.json({
+				error: "invalid_grant",
+				error_description: "Code was not issued to this client."
+			}, 400);
+		}
+		if (String(form.redirect_uri ?? "") !== record.redirectUri) return c.json({
+			error: "invalid_grant",
+			error_description: "redirect_uri does not match the authorization request."
+		}, 400);
+		if (!await verifyPkce(String(form.code_verifier ?? ""), record.codeChallenge, record.codeChallengeMethod)) return c.json({
+			error: "invalid_grant",
+			error_description: "PKCE verification failed."
+		}, 400);
+		if (!resourceMatches(form.resource ? String(form.resource) : record.resource, record.resource)) return c.json({
+			error: "invalid_target",
+			error_description: "resource does not match the authorization request."
+		}, 400);
+		return issueTokens(c, {
+			clientId: record.clientId,
+			uid: record.uid,
+			roles: record.roles,
+			scope: record.scope,
+			resource: record.resource,
+			family: randomHex(16)
+		});
+	}
+	async function handleRefreshGrant(c, form, client) {
+		const presented = String(form.refresh_token ?? "");
+		if (!presented) return c.json({
+			error: "invalid_request",
+			error_description: "refresh_token is required."
+		}, 400);
+		const record = await store.consumeRefreshToken(presented);
+		if (!record) return c.json({
+			error: "invalid_grant",
+			error_description: "Refresh token is invalid, expired or revoked."
+		}, 400);
+		if (record.clientId !== client.clientId) {
+			await store.revokeFamily(record.family);
+			return c.json({
+				error: "invalid_grant",
+				error_description: "Refresh token was not issued to this client."
+			}, 400);
+		}
+		const held = new Set(record.scope.split(" ").filter(Boolean));
+		let scope = record.scope;
+		if (form.scope) {
+			const granted = narrowScope(String(form.scope)).split(" ").filter(Boolean).filter((s) => held.has(s));
+			if (granted.length === 0) return c.json({
+				error: "invalid_scope",
+				error_description: "The requested scope is not a subset of the scope originally granted."
+			}, 400);
+			scope = granted.join(" ");
+		}
+		return issueTokens(c, {
+			clientId: record.clientId,
+			uid: record.uid,
+			roles: record.roles,
+			scope,
+			resource: record.resource,
+			family: record.family
+		});
+	}
+	async function issueTokens(c, grant) {
+		const accessToken = await generateMcpAccessToken({
+			uid: grant.uid,
+			roles: grant.roles,
+			scope: grant.scope,
+			clientId: grant.clientId,
+			aud: grant.resource,
+			iss: issuer
+		}, ACCESS_TOKEN_TTL_SECONDS);
+		const refreshToken = randomHex(32);
+		await store.saveRefreshToken(refreshToken, {
+			clientId: grant.clientId,
+			uid: grant.uid,
+			roles: grant.roles,
+			scope: grant.scope,
+			resource: grant.resource,
+			family: grant.family
+		}, new Date(Date.now() + REFRESH_TOKEN_TTL_MS));
+		c.header("Cache-Control", "no-store");
+		c.header("Pragma", "no-cache");
+		return c.json({
+			access_token: accessToken,
+			token_type: "Bearer",
+			expires_in: ACCESS_TOKEN_TTL_SECONDS,
+			refresh_token: refreshToken,
+			scope: grant.scope
+		});
+	}
+	/**
+	* Who is asking, from an ORDINARY session token.
+	*
+	* Deliberately not an MCP token. These endpoints are how a person governs
+	* the applications they have authorized, and letting one of those
+	* applications present its own token here would let it enumerate the
+	* others — or revoke them. A grant to read your data is not a grant to
+	* manage your grants.
+	*/
+	async function sessionUser(c) {
+		const header = c.req.header("authorization") ?? "";
+		if (!header.toLowerCase().startsWith("bearer ")) return null;
+		const session = await verifyAccessToken(header.slice(7).trim());
+		return session ? { uid: session.uid } : null;
+	}
+	router.get("/grants", async (c) => {
+		const user = await sessionUser(c);
+		if (!user) return c.json({
+			error: "unauthorized",
+			error_description: "Sign in to see connected applications."
+		}, 401);
+		return c.json({ grants: await store.listGrants(user.uid) });
+	});
+	router.delete("/grants/:clientId", async (c) => {
+		const user = await sessionUser(c);
+		if (!user) return c.json({
+			error: "unauthorized",
+			error_description: "Sign in to disconnect an application."
+		}, 401);
+		if (!await store.revokeGrant(user.uid, c.req.param("clientId"))) return c.json({
+			error: "not_found",
+			error_description: "You have not connected that application."
+		}, 404);
+		return c.json({
+			revoked: true,
+			note: "Refresh tokens are revoked immediately. An access token already issued keeps working until it expires, at most one hour."
+		});
+	});
+	/**
+	* RFC 7009 token revocation, for a client retiring its own credential.
+	*
+	* Separate from `/grants` above and answering a different question: this is
+	* a client saying "I am done with this token", where that one is a person
+	* saying "I am done with this application". A client cannot revoke another
+	* client's token — the family it names has to belong to it — and the
+	* response is 200 either way, which RFC 7009 §2.2 requires: an error would
+	* turn this endpoint into an oracle for which tokens exist.
+	*/
+	router.post("/revoke", tokenLimiter, async (c) => {
+		const form = await c.req.parseBody();
+		const clientId = String(form.client_id ?? "") || basicAuthClientId(c.req.header("authorization"));
+		const token = String(form.token ?? "");
+		if (clientId && token) {
+			const client = await store.getClient(clientId);
+			if (client) {
+				if (client.clientSecretHash) {
+					const presented = String(form.client_secret ?? "") || basicAuthSecret(c.req.header("authorization"));
+					if (!presented || !constantTimeEqual(await sha256Hex(presented), client.clientSecretHash)) return c.json({ error: "invalid_client" }, 401);
+				}
+				await store.revokeTokenForClient(token, clientId);
+			}
+		}
+		return c.body(null, 200);
+	});
+	return router;
+}
+/**
+* Why a redirect URI cannot be registered, or null if it can.
+*
+* Refusing at registration is cheaper than refusing at authorize time, and it
+* means a stored row is never itself the hazard.
+*/
+function redirectUriProblem(uri) {
+	let url;
+	try {
+		url = new URL(uri);
+	} catch {
+		return "not an absolute URI";
+	}
+	if (url.hash) return "must not contain a fragment";
+	if (url.protocol === "https:") return null;
+	if (url.protocol === "http:") return url.hostname === "127.0.0.1" || url.hostname === "[::1]" || url.hostname === "::1" ? null : "http is only allowed for loopback redirects";
+	if (/^[a-z][a-z0-9+.-]*:$/.test(url.protocol) && url.protocol.includes(".")) return null;
+	return `scheme ${url.protocol} is not allowed`;
+}
+/** Build the error redirect an authorization failure sends to the client. */
+function errorRedirect(redirectUri, error, description, state, issuer) {
+	const url = new URL(redirectUri);
+	url.searchParams.set("error", error);
+	url.searchParams.set("error_description", description);
+	if (state) url.searchParams.set("state", state);
+	url.searchParams.set("iss", issuer);
+	return url.toString();
+}
+/** An error we must NOT redirect: render it instead. */
+function authorizeInputError(c, error, description) {
+	return c.html(`<!doctype html><meta charset="utf-8"><title>Authorization error</title><h1>${escapeHtml$1(error)}</h1><p>${escapeHtml$1(description)}</p><p>This request was not redirected back to the application, because the details it sent could not be trusted.</p>`, 400);
+}
+function escapeHtml$1(value) {
+	return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+/** Human-readable consent lines, one per granted scope. */
+function describeScopes(scope) {
+	const text = {
+		"mcp:read": "Read data you already have access to",
+		"mcp:write": "Create, change and delete data you already have access to"
+	};
+	return scope.split(" ").filter((s) => MCP_SCOPES.includes(s)).map((s) => ({
+		scope: s,
+		description: text[s]
+	}));
+}
+function decodeBasic(header) {
+	if (!header?.startsWith("Basic ")) return null;
+	try {
+		const decoded = atob(header.slice(6));
+		const at = decoded.indexOf(":");
+		if (at < 0) return null;
+		return {
+			id: decodeURIComponent(decoded.slice(0, at)),
+			secret: decodeURIComponent(decoded.slice(at + 1))
+		};
+	} catch {
+		return null;
+	}
+}
+function basicAuthClientId(header) {
+	return decodeBasic(header)?.id ?? "";
+}
+function basicAuthSecret(header) {
+	return decodeBasic(header)?.secret ?? "";
+}
+//#endregion
+//#region src/mcp/mcp-tools.ts
+/** How many rows a single call may return, whatever it asks for. */
+var MAX_ROWS = 200;
+var DEFAULT_ROWS = 25;
+/**
+* Resolve a collection the caller named.
+*
+* Refuses anything not in the registry rather than passing the string to the
+* driver. A collection path is interpolated into a table name downstream, and
+* "the caller may name any table" is how an integration becomes a way to read
+* `rebase.oauth_clients`.
+*/
+function resolveCollection(ctx, raw) {
+	const path = String(raw ?? "");
+	const found = ctx.collections.find((c) => c.slug === path || getCollectionDataPath(c) === path);
+	if (!found) throw new McpToolError(`Unknown collection "${path}". Call list_collections to see what exists.`);
+	return found;
+}
+/** An error whose message is safe to hand back to the model. */
+var McpToolError = class extends Error {};
+/** The caller's own driver: RLS-scoped, every time, with no way to skip it. */
+async function scopedDriver(ctx) {
+	return scopeDataDriver(ctx.driver, {
+		uid: ctx.caller.uid,
+		roles: ctx.caller.roles,
+		isAnonymous: false
+	});
+}
+function collectionPath(collection) {
+	return getCollectionDataPath(collection);
+}
+function clampLimit(raw) {
+	const asked = Number(raw ?? DEFAULT_ROWS);
+	if (!Number.isFinite(asked) || asked <= 0) return DEFAULT_ROWS;
+	return Math.min(Math.floor(asked), MAX_ROWS);
+}
+/** A non-negative row offset. `NaN`, `-1` and `"soon"` all mean "from the start". */
+function clampOffset(raw) {
+	const asked = Number(raw ?? 0);
+	if (!Number.isFinite(asked) || asked <= 0) return 0;
+	return Math.floor(asked);
+}
+/**
+* A field name the collection actually declares.
+*
+* Every caller-supplied identifier that reaches the driver goes through here.
+* `filter` had this check from the start and `orderBy` did not, which is the
+* same class of gap twice over: an identifier is not a value, so it cannot be
+* bound as a parameter, and whether it is safe depends entirely on what the
+* driver does with it. The registry is the only thing that knows which names
+* are real, so the check belongs here rather than in each driver's hope that
+* it quoted everything.
+*
+* `id` is admitted alongside the declared properties because every collection
+* has one and none of them declare it.
+*/
+function assertKnownField(collection, field, what) {
+	const properties = collection.properties ?? {};
+	if (field !== "id" && !(field in properties)) throw new McpToolError(`"${field}" is not a field of ${collectionPath(collection)}, so it cannot be used to ${what}. Known fields: ${["id", ...Object.keys(properties)].join(", ")}.`);
+	return field;
+}
+/**
+* Translate the model's filter object into the driver's filter shape.
+*
+* The wire form is `{ field: [op, value] }` — `FilterValues` — and it is
+* accepted only for fields the collection actually declares. An unknown field
+* is refused rather than dropped: silently ignoring a filter turns "show me the
+* unpaid invoices" into "show me every invoice", which is a worse answer than
+* an error and looks like a correct one.
+*/
+function buildFilter(collection, raw) {
+	if (raw == null) return void 0;
+	if (typeof raw !== "object" || Array.isArray(raw)) throw new McpToolError("filter must be an object of { field: [operator, value] }.");
+	const filter = {};
+	for (const [field, condition] of Object.entries(raw)) {
+		assertKnownField(collection, field, "filter");
+		if (!Array.isArray(condition) || condition.length !== 2 || typeof condition[0] !== "string") throw new McpToolError(`filter.${field} must be [operator, value], e.g. ["==", "paid"].`);
+		filter[field] = [condition[0], condition[1]];
+	}
+	return filter;
+}
+var MCP_TOOLS = [
+	{
+		name: "list_collections",
+		description: "List the collections in this project, with their fields. Call this first — every other tool takes a collection name from here.",
+		requiredScope: "mcp:read",
+		inputSchema: {
+			type: "object",
+			properties: {},
+			additionalProperties: false
+		},
+		async run(_args, ctx) {
+			return { collections: ctx.collections.map((c) => ({
+				name: collectionPath(c),
+				title: c.name,
+				description: c.description ?? null,
+				fields: Object.entries(c.properties ?? {}).filter(([, property]) => !property.excludeFromApi).map(([key, property]) => ({
+					name: key,
+					type: property.type ?? "unknown",
+					title: property.name ?? key,
+					description: property.description ?? null
+				}))
+			})) };
+		}
+	},
+	{
+		name: "query_collection",
+		description: "Read rows from a collection. Returns only rows the signed-in user is allowed to see, so an empty result can mean 'none match' or 'none visible to you'.",
+		requiredScope: "mcp:read",
+		inputSchema: {
+			type: "object",
+			properties: {
+				collection: {
+					type: "string",
+					description: "Collection name from list_collections."
+				},
+				filter: {
+					type: "object",
+					description: "Field conditions, e.g. {\"status\": [\"==\", \"paid\"], \"total\": [\">\", 100]}.",
+					additionalProperties: { type: "array" }
+				},
+				orderBy: {
+					type: "string",
+					description: "Field to sort by."
+				},
+				order: {
+					type: "string",
+					enum: ["asc", "desc"],
+					description: "Sort direction."
+				},
+				limit: {
+					type: "number",
+					description: `Rows to return (max ${MAX_ROWS}).`
+				},
+				offset: {
+					type: "number",
+					description: "Rows to skip."
+				}
+			},
+			required: ["collection"],
+			additionalProperties: false
+		},
+		async run(args, ctx) {
+			const collection = resolveCollection(ctx, args.collection);
+			const driver = await scopedDriver(ctx);
+			const limit = clampLimit(args.limit);
+			const rows = await driver.fetchCollection({
+				path: collectionPath(collection),
+				collection,
+				filter: buildFilter(collection, args.filter),
+				limit,
+				offset: clampOffset(args.offset),
+				orderBy: args.orderBy ? [[assertKnownField(collection, String(args.orderBy), "sort"), args.order === "desc" ? "desc" : "asc"]] : void 0
+			});
+			return {
+				collection: collectionPath(collection),
+				count: rows.length,
+				truncated: rows.length === limit,
+				rows
+			};
+		}
+	},
+	{
+		name: "get_document",
+		description: "Read one row by id. Fails if the signed-in user cannot see it.",
+		requiredScope: "mcp:read",
+		inputSchema: {
+			type: "object",
+			properties: {
+				collection: { type: "string" },
+				id: { type: "string" }
+			},
+			required: ["collection", "id"],
+			additionalProperties: false
+		},
+		async run(args, ctx) {
+			const collection = resolveCollection(ctx, args.collection);
+			const row = await (await scopedDriver(ctx)).fetchOne({
+				path: collectionPath(collection),
+				collection,
+				id: String(args.id)
+			});
+			if (!row) throw new McpToolError(`No row with id "${args.id}" in ${collectionPath(collection)}.`);
+			return row;
+		}
+	},
+	{
+		name: "create_document",
+		description: "Create a row. Subject to the same permissions as creating it in the app.",
+		requiredScope: "mcp:write",
+		inputSchema: {
+			type: "object",
+			properties: {
+				collection: { type: "string" },
+				values: {
+					type: "object",
+					description: "Field values for the new row."
+				},
+				id: {
+					type: "string",
+					description: "Optional explicit id."
+				}
+			},
+			required: ["collection", "values"],
+			additionalProperties: false
+		},
+		async run(args, ctx) {
+			const collection = resolveCollection(ctx, args.collection);
+			const saved = await (await scopedDriver(ctx)).save({
+				path: collectionPath(collection),
+				collection,
+				values: args.values,
+				id: args.id ? String(args.id) : void 0,
+				status: "new"
+			});
+			logger.info("[mcp] Row created", {
+				collection: collectionPath(collection),
+				uid: ctx.caller.uid,
+				clientId: ctx.caller.clientId
+			});
+			return saved;
+		}
+	},
+	{
+		name: "update_document",
+		description: "Change fields on an existing row. Only the fields given are touched.",
+		requiredScope: "mcp:write",
+		inputSchema: {
+			type: "object",
+			properties: {
+				collection: { type: "string" },
+				id: { type: "string" },
+				values: {
+					type: "object",
+					description: "Fields to change."
+				}
+			},
+			required: [
+				"collection",
+				"id",
+				"values"
+			],
+			additionalProperties: false
+		},
+		async run(args, ctx) {
+			const collection = resolveCollection(ctx, args.collection);
+			const saved = await (await scopedDriver(ctx)).save({
+				path: collectionPath(collection),
+				collection,
+				values: args.values,
+				id: String(args.id),
+				status: "existing"
+			});
+			logger.info("[mcp] Row updated", {
+				collection: collectionPath(collection),
+				id: String(args.id),
+				uid: ctx.caller.uid,
+				clientId: ctx.caller.clientId
+			});
+			return saved;
+		}
+	},
+	{
+		name: "delete_document",
+		description: "Delete a row by id. This cannot be undone.",
+		requiredScope: "mcp:write",
+		inputSchema: {
+			type: "object",
+			properties: {
+				collection: { type: "string" },
+				id: { type: "string" }
+			},
+			required: ["collection", "id"],
+			additionalProperties: false
+		},
+		async run(args, ctx) {
+			const collection = resolveCollection(ctx, args.collection);
+			await (await scopedDriver(ctx)).delete({
+				row: {
+					id: String(args.id),
+					path: collectionPath(collection)
+				},
+				collection
+			});
+			logger.info("[mcp] Row deleted", {
+				collection: collectionPath(collection),
+				id: String(args.id),
+				uid: ctx.caller.uid,
+				clientId: ctx.caller.clientId
+			});
+			return {
+				deleted: true,
+				id: String(args.id)
+			};
+		}
+	}
+];
+/** The tools a caller holding `scope` may see and call. */
+function toolsForScope(scope) {
+	return MCP_TOOLS.filter((tool) => scopeAllows(scope, tool.requiredScope));
+}
+/** Look up a tool by name, honouring scope — an unlisted tool is not callable. */
+function findTool(name, scope) {
+	return toolsForScope(scope).find((tool) => tool.name === name);
+}
+//#endregion
+//#region src/mcp/mcp-routes.ts
+/**
+* The MCP endpoint: an OAuth 2.1 resource server speaking JSON-RPC.
+*
+* The protocol subset is deliberately hand-written rather than taken from
+* `@modelcontextprotocol/sdk`. The SDK's HTTP transport is built around Node's
+* `req`/`res`, this server is Hono, and the adapter would be more code than the
+* protocol — which, for a server that offers tools and neither prompts nor
+* sampling, is `initialize`, `tools/list`, `tools/call` and `ping`. It also
+* keeps a dependency out of `@rebasepro/server`, whose import graph feeds the
+* portable functions bundle.
+*
+* Streamable HTTP, in its simplest legal form: a POST carrying one JSON-RPC
+* message, answered with one JSON response. The specification permits a server
+* to answer `application/json` instead of opening an SSE stream, and nothing
+* here pushes server-initiated messages, so `GET /mcp` returns 405 with an
+* `Allow` header rather than pretending to hold a stream open.
+*
+* The authorization half is the part that matters, and it runs before any of
+* the above: no token is 401 with the `WWW-Authenticate` challenge that tells a
+* client where the authorization server is, a token for the wrong audience is
+* 401, and a token too narrow for the tool it names is 403 `insufficient_scope`.
+*/
+/**
+* The protocol revisions this server implements.
+*
+* `initialize` echoes back the client's version when we know it, and our own
+* latest when we do not — which is what the specification asks for and what
+* keeps a client one revision ahead from failing the handshake outright.
+*/
+var SUPPORTED_PROTOCOL_VERSIONS = ["2025-06-18", "2025-03-26"];
+var LATEST_PROTOCOL_VERSION = SUPPORTED_PROTOCOL_VERSIONS[0];
+/** JSON-RPC 2.0 error codes, plus the one MCP adds. */
+var PARSE_ERROR = -32700;
+var INVALID_REQUEST = -32600;
+var METHOD_NOT_FOUND = -32601;
+var INVALID_PARAMS = -32602;
+var INTERNAL_ERROR = -32603;
+/**
+* The `.well-known` documents.
+*
+* Mounted at the ROOT, not under `basePath`, because RFC 8414 and RFC 9728 both
+* define the path relative to the origin — the same reason `jwks.json` sits
+* there. A client fetches these before it has any token, so they are public and
+* uncredentialed by design.
+*/
+function createMcpWellKnownRoutes(config) {
+	const wellKnown = new Hono();
+	const resourcePath = protectedResourceMetadataPath(config.mcpPath);
+	const serveResourceMetadata = (c) => c.json(protectedResourceMetadata(config.publicUrl, config.mcpPath));
+	wellKnown.get(resourcePath, serveResourceMetadata);
+	wellKnown.get("/.well-known/oauth-protected-resource", serveResourceMetadata);
+	wellKnown.get("/.well-known/oauth-authorization-server", (c) => c.json(authorizationServerMetadata(config.publicUrl, config.oauthBasePath)));
+	return wellKnown;
+}
+/** The MCP endpoint itself. */
+function createMcpRoutes(config) {
+	const router = new Hono();
+	const canonicalResource = canonicalResourceUri(config.publicUrl, config.mcpPath);
+	/**
+	* Nothing is served without a token bound to THIS resource.
+	*
+	* The challenge on a 401 is the client's entire discovery path: with no
+	* token it knows only the URL, and `resource_metadata` is what turns that
+	* into an authorization server, a registration endpoint and a consent
+	* screen. Omitting it makes a protected server look like a broken one.
+	*/
+	async function authenticate(c) {
+		const header = c.req.header("authorization") ?? "";
+		if (!header.toLowerCase().startsWith("bearer ")) return c.json({
+			error: "unauthorized",
+			error_description: "An OAuth access token is required."
+		}, 401, { "WWW-Authenticate": bearerChallenge(config.publicUrl, config.mcpPath, DEFAULT_MCP_SCOPE) });
+		const payload = await verifyMcpAccessToken(header.slice(7).trim(), canonicalResource);
+		if (!payload) return c.json({
+			error: "invalid_token",
+			error_description: "The access token is invalid, expired, or for another resource."
+		}, 401, { "WWW-Authenticate": bearerChallenge(config.publicUrl, config.mcpPath, DEFAULT_MCP_SCOPE) });
+		return {
+			uid: payload.uid,
+			roles: payload.roles,
+			scope: payload.scope,
+			clientId: payload.clientId
+		};
+	}
+	router.post("/", async (c) => {
+		const caller = await authenticate(c);
+		if (caller instanceof Response) return caller;
+		let message;
+		try {
+			message = await c.req.json();
+		} catch {
+			return c.json(rpcError(null, PARSE_ERROR, "Invalid JSON."), 400);
+		}
+		if (Array.isArray(message)) {
+			const replies = [];
+			for (const item of message) {
+				const reply = await dispatch(c, item, caller);
+				if (reply) replies.push(reply);
+			}
+			return replies.length ? c.json(replies) : c.body(null, 202);
+		}
+		const reply = await dispatch(c, message, caller);
+		return reply ? c.json(reply) : c.body(null, 202);
+	});
+	/**
+	* No server-initiated stream.
+	*
+	* A client opens `GET /mcp` to receive messages the server starts. This one
+	* never does — it answers tool calls and nothing else — so the honest reply
+	* is 405 with `Allow`, not an SSE stream that stays silent forever and
+	* leaves the client waiting on a heartbeat that is not coming.
+	*/
+	router.get("/", async (c) => {
+		const caller = await authenticate(c);
+		if (caller instanceof Response) return caller;
+		return c.json({
+			error: "method_not_allowed",
+			error_description: "This server does not open server-initiated streams."
+		}, 405, { Allow: "POST, DELETE" });
+	});
+	/** Session teardown. Stateless here, so there is nothing to tear down. */
+	router.delete("/", (c) => c.body(null, 204));
+	async function dispatch(c, message, caller) {
+		if (typeof message !== "object" || message === null) return rpcError(null, INVALID_REQUEST, "A JSON-RPC message must be an object.");
+		const { id = null, method, params } = message;
+		if (typeof method !== "string") return rpcError(id, INVALID_REQUEST, "`method` is required.");
+		const isNotification = id === null || id === void 0;
+		const reply = await route();
+		return isNotification ? null : reply;
+		async function route() {
+			switch (method) {
+				case "initialize": {
+					const asked = typeof params?.protocolVersion === "string" ? params.protocolVersion : void 0;
+					return rpcResult(id, {
+						protocolVersion: asked && SUPPORTED_PROTOCOL_VERSIONS.includes(asked) ? asked : LATEST_PROTOCOL_VERSION,
+						capabilities: { tools: { listChanged: false } },
+						serverInfo: config.serverInfo,
+						instructions: "Data tools for this Rebase project. Every call runs as the signed-in user, so results are limited to what that user is allowed to see. Call list_collections first to learn the schema."
+					});
+				}
+				case "notifications/initialized":
+				case "notifications/cancelled": return null;
+				case "ping": return rpcResult(id, {});
+				case "tools/list": return rpcResult(id, { tools: toolsForScope(caller.scope).map((tool) => ({
+					name: tool.name,
+					description: tool.description,
+					inputSchema: tool.inputSchema
+				})) });
+				case "tools/call": return callTool(c, id, params, caller);
+				default: return rpcError(id, METHOD_NOT_FOUND, `Unknown method: ${method}`);
+			}
+		}
+	}
+	async function callTool(c, id, params, caller) {
+		const name = typeof params?.name === "string" ? params.name : "";
+		const args = params?.arguments ?? {};
+		const tool = findTool(name, caller.scope);
+		if (!tool) {
+			const outOfScope = toolsForScope("mcp:read mcp:write").find((t) => t.name === name);
+			if (outOfScope) {
+				c.header("WWW-Authenticate", insufficientScopeChallenge(config.publicUrl, config.mcpPath, outOfScope.requiredScope, `${name} requires the ${outOfScope.requiredScope} scope`));
+				return rpcError(id, INVALID_PARAMS, `"${name}" requires the ${outOfScope.requiredScope} scope, which this token does not hold.`);
+			}
+			return rpcError(id, METHOD_NOT_FOUND, `Unknown tool: ${name}`);
+		}
+		const driver = config.getDriver();
+		if (!driver) return rpcError(id, INTERNAL_ERROR, "The data layer is not ready.");
+		try {
+			const result = await tool.run(args, {
+				driver,
+				collections: config.getCollections(),
+				caller
+			});
+			return rpcResult(id, {
+				content: [{
+					type: "text",
+					text: JSON.stringify(result, null, 2)
+				}],
+				structuredContent: result
+			});
+		} catch (error) {
+			const message = error instanceof McpToolError ? error.message : "The call failed. This is usually a permission rule refusing the operation for your account.";
+			if (!(error instanceof McpToolError)) logger.error("[mcp] Tool call failed", {
+				tool: name,
+				uid: caller.uid,
+				clientId: caller.clientId,
+				error
+			});
+			return rpcResult(id, {
+				content: [{
+					type: "text",
+					text: message
+				}],
+				isError: true
+			});
+		}
+	}
+	return router;
+}
+function rpcResult(id, result) {
+	return {
+		jsonrpc: "2.0",
+		id,
+		result
+	};
+}
+function rpcError(id, code, message) {
+	return {
+		jsonrpc: "2.0",
+		id,
+		error: {
+			code,
+			message
+		}
+	};
+}
+//#endregion
 //#region src/auth/collection-callback-warning.ts
 /** The data callbacks the auth write path does not run. */
 var DATA_CALLBACKS = [
@@ -11074,6 +13054,23 @@ var CHANNEL_MESSAGE_TYPES = /* @__PURE__ */ new Set([
 	"channel_history"
 ]);
 /**
+* The other direction: the frame types the *server* addresses by channel.
+*
+* Not the mirror of {@link CHANNEL_MESSAGE_TYPES} — a request and its answer
+* have different names (`presence_state` is the one type in both) — so the two
+* sets are listed separately rather than derived from each other. These are
+* exactly the members of `ChannelMessage`; adding one here without declaring it
+* there leaves the handler with a frame it cannot read.
+*/
+var CHANNEL_FRAME_TYPES = /* @__PURE__ */ new Set([
+	"broadcast",
+	"presence_state",
+	"presence_diff",
+	"channel_history",
+	"error",
+	"ERROR"
+]);
+/**
 * Low-level realtime WebSocket client.
 *
 * @internal Not a stable app-facing API. `createRebaseClient()` constructs and
@@ -11084,6 +13081,28 @@ var CHANNEL_MESSAGE_TYPES = /* @__PURE__ */ new Set([
 * `@rebasepro/client-postgres` was removed; its surface may change without a
 * major bump.
 */
+/**
+* Narrow a frame to the collection-update shape. See its use below.
+*
+* `WebSocketMessage.type` is `string`, so the message types that extend it do
+* not form a discriminated union and `type === "collection_update"` narrows
+* nothing on its own.
+*/
+function isCollectionUpdate(message) {
+	return message.type === "collection_update";
+}
+/**
+* Narrow a frame to one of the channel-addressed shapes.
+*
+* Both halves of the test are load-bearing. The type says which member of
+* {@link ChannelMessage} it is; `channel` is what a channel frame is *addressed
+* by*, and an `ERROR` from a server older than the change that names the
+* channel has none — it is a generic error, and falls through to the catch-all
+* warning rather than being delivered to a channel that was never named.
+*/
+function isChannelMessage(message) {
+	return typeof message.channel === "string" && CHANNEL_FRAME_TYPES.has(message.type);
+}
 var RebaseWebSocketClient = class {
 	websocketUrl;
 	ws = null;
@@ -11267,6 +13286,7 @@ var RebaseWebSocketClient = class {
 			clearTimeout(this.reconnectTimeout);
 			this.reconnectTimeout = null;
 		}
+		this.suspendSubscribeWatchdogs();
 		if (this.ws) {
 			this.ws.onclose = null;
 			this.ws.onerror = null;
@@ -11448,7 +13468,7 @@ var RebaseWebSocketClient = class {
 			}
 			return;
 		}
-		if (typeof message.channel === "string" && (type === "broadcast" || type === "presence_state" || type === "presence_diff" || type === "channel_history" || type === "ERROR" || type === "error")) {
+		if (isChannelMessage(message)) {
 			const handlers = this.channelHandlers.get(message.channel);
 			if (handlers) for (const handler of [...handlers]) try {
 				handler(message);
@@ -11457,15 +13477,16 @@ var RebaseWebSocketClient = class {
 			}
 			return;
 		}
-		if (subscriptionId && type === "collection_update") {
+		if (subscriptionId && isCollectionUpdate(message)) {
+			const collectionUpdate = message;
 			const subscriptionKey = this.backendToCollectionKey.get(subscriptionId);
 			if (subscriptionKey) {
 				const collectionSub = this.collectionSubscriptions.get(subscriptionKey);
 				if (collectionSub) {
 					const incomingRows = message.rows || [];
-					const updatePks = message.pks;
+					const updatePks = collectionUpdate.pks;
 					if (updatePks) collectionSub.pks = updatePks;
-					const updateMeta = message.meta;
+					const updateMeta = collectionUpdate.meta;
 					if (updateMeta) collectionSub.latestMeta = updateMeta;
 					const rows = this.mergeRows(collectionSub.latestData, incomingRows, collectionSub.pks);
 					collectionSub.latestData = rows;
@@ -12329,7 +14350,7 @@ var RebaseRealtimeChannel = class {
 		this.catchUpInFlight = true;
 		if (this.catchUpTimeout) clearTimeout(this.catchUpTimeout);
 		this.catchUpTimeout = setTimeout(() => this.abandonCatchUp(), CATCH_UP_TIMEOUT_MS);
-		this.catchUpTimeout.unref?.();
+		unref(this.catchUpTimeout);
 		try {
 			await this.send("channel_history", {
 				sinceSeq: this.lastSeq,
@@ -12375,7 +14396,7 @@ var RebaseRealtimeChannel = class {
 				if (!this.trackedState) return;
 				this.send("presence_track", { state: this.trackedState }).catch(() => {});
 			}, PRESENCE_HEARTBEAT_MS);
-			this.heartbeat.unref?.();
+			unref(this.heartbeat);
 		}
 	}
 	/** Stop publishing presence, without leaving the channel. */
@@ -12503,12 +14524,11 @@ var RebaseRealtimeChannel = class {
 	handle(message) {
 		switch (message.type) {
 			case "presence_state":
-				this.presences = message.presences ?? {};
+				this.presences = message.presences;
 				this.emitPresence();
 				break;
 			case "presence_diff": {
-				const joins = message.joins ?? {};
-				const leaves = message.leaves ?? {};
+				const { joins, leaves } = message;
 				for (const [id, state] of Object.entries(joins)) this.presences[id] = state;
 				for (const id of Object.keys(leaves)) delete this.presences[id];
 				this.emitPresence({
@@ -12518,7 +14538,7 @@ var RebaseRealtimeChannel = class {
 				break;
 			}
 			case "broadcast": {
-				const seq = typeof message.seq === "number" ? message.seq : void 0;
+				const seq = message.seq;
 				const event = {
 					event: message.event,
 					payload: message.payload,
@@ -12543,9 +14563,7 @@ var RebaseRealtimeChannel = class {
 					clearTimeout(this.catchUpTimeout);
 					this.catchUpTimeout = null;
 				}
-				const entries = message.messages ?? [];
-				const retained = message.retained === true;
-				const latestSeq = typeof message.latestSeq === "number" ? message.latestSeq : void 0;
+				const { messages: entries, retained, latestSeq } = message;
 				for (const resolve of this.historyWaiters.splice(0)) resolve({
 					messages: entries,
 					retained,
@@ -12567,8 +14585,8 @@ var RebaseRealtimeChannel = class {
 			case "ERROR":
 			case "error": {
 				const raw = message.payload?.error;
-				const asObject = typeof raw === "object" && raw !== null ? raw : void 0;
-				const text = asObject?.message ?? (typeof raw === "string" ? raw : void 0) ?? (typeof message.error === "string" ? message.error : void 0) ?? "The server refused a channel operation.";
+				const asObject = typeof raw === "object" ? raw : void 0;
+				const text = asObject?.message ?? (typeof raw === "string" ? raw : void 0) ?? message.error ?? "The server refused a channel operation.";
 				const error = new RebaseApiError(text, { ...asObject?.code ? { code: asObject.code } : {} });
 				if (this.errorHandlers.size === 0) {
 					console.warn(`[Rebase] Channel "${this.name}" error${asObject?.code ? ` (${asObject.code})` : ""}: ${text}. Attach \`channel.onError(...)\` to handle it.`);
@@ -12863,7 +14881,7 @@ var ConnectivityMonitor = class {
 			this.timer = void 0;
 			this.onRetryDue?.();
 		}, delay);
-		this.timer.unref?.();
+		unref(this.timer);
 	}
 	clearPendingTimer() {
 		if (this.timer !== void 0) {
@@ -13509,6 +15527,31 @@ function generateOfflineNumericId() {
 	lastOfflineNumericId = lastOfflineNumericId === 0 ? candidate : Math.min(candidate, lastOfflineNumericId - 1);
 	return lastOfflineNumericId;
 }
+/**
+* The row an optimistic write puts in the cache before the server has seen it.
+*
+* It is NOT an `M`, and saying so is the point of collecting this in one place.
+* `M` is the row as the database has it — every server default, every generated
+* column, every `afterRead` transform. What an optimistic write has is the
+* fields the caller supplied (plus, on an update, whatever was already cached)
+* and an id, which may itself be a locally-minted placeholder.
+*
+* The two are reconciled when the queued write drains and the server's row
+* replaces this one. Until then the SDK hands the caller this, under `M`,
+* because that is what the offline API's return type promises — and there is
+* nothing in this file that can make that promise true.
+*
+* So: one deliberate assertion, named, rather than five spread across the
+* create / createMany / update / upsert paths, each free to assemble the fields
+* differently. Fixing it properly means the offline surface saying what it
+* actually returns, which is a change to its public types.
+*/
+function optimisticRow(fields, id) {
+	return {
+		...fields,
+		id
+	};
+}
 var MISSING = "\0missing";
 /**
 * Replays to spend on a mutation whose idempotency key the server is still
@@ -13595,7 +15638,7 @@ var OfflineManager = class {
 		if ((config.crossTab ?? this.store instanceof IndexedDBOfflineStore) && typeof BroadcastChannel !== "undefined") try {
 			this.channel = new BroadcastChannel("rebase-offline");
 			this.channel.onmessage = (event) => this.onBroadcast(event.data);
-			this.channel.unref?.();
+			unref(this.channel);
 		} catch {}
 		this.api = {
 			sync: () => this.sync(),
@@ -13758,10 +15801,7 @@ var OfflineManager = class {
 				}
 				const providedId = id ?? data.id;
 				const rowId = providedId ?? this.mintOfflineId(slug);
-				const row = {
-					...data,
-					id: rowId
-				};
+				const row = optimisticRow(data, rowId);
 				await this.enqueue({
 					collection: slug,
 					type: "create",
@@ -13789,10 +15829,7 @@ var OfflineManager = class {
 					if (!isNetworkError(error)) throw error;
 					this.connectivity.markFailure();
 				}
-				const rows = data.map((r) => ({
-					...r,
-					id: r.id ?? this.mintOfflineId(slug)
-				}));
+				const rows = data.map((r) => optimisticRow(r, r.id ?? this.mintOfflineId(slug)));
 				const rollback = {};
 				for (const row of rows) {
 					const key = String(row.id);
@@ -13835,10 +15872,7 @@ var OfflineManager = class {
 				}
 				const rowId = data.id;
 				if (options?.onConflict?.length || rowId === void 0) throw new RebaseClientError(`Cannot upsert into "${slug}" while offline: the row it would replace can only be found by the server. Upserting on the primary key, with the key in the row, is queued; upserting on a natural key is not.`, { code: "OFFLINE_UPSERT_UNSUPPORTED" });
-				const row = {
-					...data,
-					id: rowId
-				};
+				const row = optimisticRow(data, rowId);
 				await this.enqueue({
 					collection: slug,
 					type: "createMany",
@@ -13870,11 +15904,10 @@ var OfflineManager = class {
 				for (const { id, data } of updates) {
 					const base = this.rawLocalRow(slug, id);
 					rollback[String(id)] = base ?? null;
-					optimistic.push({
+					optimistic.push(optimisticRow({
 						...base ?? {},
-						...data,
-						id
-					});
+						...data
+					}, id));
 				}
 				await this.enqueue({
 					collection: slug,
@@ -13937,11 +15970,10 @@ var OfflineManager = class {
 					data,
 					rollback: { rows: { [String(id)]: base ?? null } }
 				});
-				const optimistic = {
+				const optimistic = optimisticRow({
 					...base ?? {},
-					...data,
-					id
-				};
+					...data
+				}, id);
 				this.setLocalRow(slug, id, optimistic);
 				this.notifyCollection(slug);
 				return optimistic;
@@ -16610,7 +18642,7 @@ async function _initializeRebaseBackend(config) {
 	const isProduction = process.env.NODE_ENV === "production";
 	const surfaces = resolveSurfaces(config.surfaces);
 	const ownership = resolveOwnership(config.ownership);
-	const offSurfaces = disabledSurfaces(surfaces);
+	const offSurfaces = trimmedSurfaces(surfaces);
 	if (offSurfaces.length > 0) logger.info("Partial runtime surface — some routes are not served by this process", {
 		serving: ALL_RUNTIME_SURFACES.filter((surface) => surfaces[surface]),
 		notServing: offSurfaces
@@ -16947,7 +18979,7 @@ async function _initializeRebaseBackend(config) {
 			]) {
 				const providerConfig = safeAuthConfig[key];
 				if (providerConfig && requiredFields.every((f) => Boolean(providerConfig[f]))) {
-					const createFn = (await import("./auth-DJsLXsCR.js").then((n) => n.t))[factory];
+					const createFn = (await import("./auth-gzoRjnuh.js").then((n) => n.t))[factory];
 					oauthProviders.push(createFn(providerConfig));
 				}
 			}
@@ -17000,6 +19032,51 @@ async function _initializeRebaseBackend(config) {
 		config.app.route("/.well-known", createJwksRoutes());
 		if (hasAsymmetricSigningKey()) logger.info("Access tokens are signed asymmetrically; public keys at /.well-known/jwks.json");
 	}
+	if (surfaces.mcp) {
+		const publicUrl = process.env.REBASE_PUBLIC_URL;
+		const driver = defaultDriver;
+		if (!publicUrl) logger.warn("[mcp] Surface enabled but REBASE_PUBLIC_URL is not set — not mounting. Set it to this deployment's externally reachable origin, e.g. https://app.example.com");
+		else if (!isJwtConfigured()) logger.warn("[mcp] Surface enabled but no JWT secret is configured — not mounting.");
+		else if (!driver || !supportsRlsScoping(driver)) logger.error("[mcp] Surface enabled but this data driver cannot scope by user — not mounting. Every MCP call must run under the caller's own row-level security; a driver without `withAuth()` would run them as the database owner instead.");
+		else {
+			const store = createOAuthStore(driver);
+			if (!store) logger.error("[mcp] Surface enabled but the driver cannot persist OAuth state — not mounting.");
+			else {
+				let ready = true;
+				try {
+					await store.ensureTables();
+				} catch (error) {
+					ready = false;
+					logger.error("[mcp] Could not prepare the OAuth tables — not mounting.", { error });
+				}
+				if (ready) {
+					const mcpPath = "/mcp";
+					const oauthBasePath = `${basePath}/oauth`;
+					const mcpConfig = {
+						publicUrl,
+						mcpPath,
+						oauthBasePath,
+						getDriver: () => defaultDriver,
+						getCollections: () => activeCollections,
+						serverInfo: {
+							name: "rebase",
+							version: readRuntimeVersion([process.cwd()]) ?? "unknown"
+						}
+					};
+					config.app.route("/", createMcpWellKnownRoutes(mcpConfig));
+					config.app.route(mcpPath, createMcpRoutes(mcpConfig));
+					config.app.route(oauthBasePath, createOAuthRoutes({
+						store,
+						publicUrl,
+						mcpPath,
+						authBasePath: `${basePath}/auth`,
+						allowDynamicRegistration: process.env.REBASE_MCP_OPEN_REGISTRATION !== "false"
+					}));
+					logger.info(`MCP endpoint mounted at ${publicUrl}${mcpPath} (OAuth at ${oauthBasePath})`);
+				}
+			}
+		}
+	}
 	const adminSurfacesGated = !!authAdapter && (isAuthAdapter(config.auth) || !!config.auth.jwtSecret);
 	const applyAdminGate = (router, surface) => {
 		if (!adminSurfacesGated) {
@@ -17057,7 +19134,7 @@ async function _initializeRebaseBackend(config) {
 	let schemaEditorOff = schemaEditorUnavailable();
 	let schemaEditorRoutes;
 	if (!schemaEditorOff && config.collectionsDir) try {
-		schemaEditorRoutes = (await import("./schema-editor-routes-C3TLZqAC.js")).createSchemaEditorRoutes(config.collectionsDir);
+		schemaEditorRoutes = (await import("./schema-editor-routes-BKOmdf4M.js")).createSchemaEditorRoutes(config.collectionsDir);
 	} catch (err) {
 		if (err?.code === "ERR_MODULE_NOT_FOUND") {
 			schemaEditorOff = {
@@ -17124,7 +19201,7 @@ async function _initializeRebaseBackend(config) {
 				},
 				writeSource: schemaEditorRoutes ? async (change) => {
 					const applyEdit = async (dir, collectionId, collection) => {
-						const { AstSchemaEditor } = await import("./ast-schema-editor-C6mDz0XN.js");
+						const { AstSchemaEditor } = await import("./ast-schema-editor-CslO8Oje.js");
 						await new AstSchemaEditor(dir).saveCollection(collectionId, collection, { partial: false });
 					};
 					if (remoteRepo) {
@@ -17344,10 +19421,7 @@ async function _initializeRebaseBackend(config) {
 	const serverSingleton = serverClient;
 	_initRebase(serverSingleton);
 	logger.debug("Rebase singleton initialized");
-	if (defaultDriverResult.internals) {
-		const driver = defaultDriverResult.internals.driver;
-		if (driver && "client" in driver) driver.client = serverClient;
-	}
+	injectCallbackClient(driverResults.values(), serverClient);
 	if (config.functionsDir && surfaces.functions) {
 		const { loadFunctionsWithDiagnostics } = await import("./function-loader-xnbDAPfa.js").then((n) => n.t);
 		const { createFunctionRoutes } = await import("./function-routes-C4nB2h0z.js").then((n) => n.n);
@@ -17406,8 +19480,8 @@ async function _initializeRebaseBackend(config) {
 	if (surfaces.cron || config.cronsDir && ownership.cronScheduler) {
 		const { loadCronJobsWithDiagnostics } = await import("./cron-loader-CQjvjpEw.js").then((n) => n.t);
 		const { CronScheduler } = await import("./cron-scheduler-D47tdB9T.js").then((n) => n.n);
-		const { createCronRoutes } = await import("./cron-routes-Bfwni8Zg.js").then((n) => n.n);
-		const { createCronStore } = await import("./cron-store-Bsiw4Q6u.js").then((n) => n.n);
+		const { createCronRoutes } = await import("./cron-routes-BamgO0Xr.js").then((n) => n.n);
+		const { createCronStore } = await import("./cron-store-yXOyIEmn.js").then((n) => n.n);
 		const { jobs: loadedCronJobs, problems: cronProblems } = config.cronsDir ? await loadCronJobsWithDiagnostics(config.cronsDir) : {
 			jobs: [],
 			problems: []
@@ -17464,7 +19538,7 @@ async function _initializeRebaseBackend(config) {
 	}
 	let metricsHistory;
 	try {
-		const { createMetricsHistory } = await import("./history-recorder-r5_IzSHK.js");
+		const { createMetricsHistory } = await import("./history-recorder-hBGuXcZc.js");
 		metricsHistory = createMetricsHistory(defaultDriver);
 		if (metricsHistory) {
 			await metricsHistory.ensure();
@@ -17476,7 +19550,7 @@ async function _initializeRebaseBackend(config) {
 	}
 	let jobQueue;
 	if (config.jobs?.enabled) {
-		const { createJobStore, createJobQueue } = await import("./jobs-CW5lm_Ix.js").then((n) => n.t);
+		const { createJobStore, createJobQueue } = await import("./jobs-DZ8DLLcU.js").then((n) => n.t);
 		const store = createJobStore(defaultDriver);
 		if (store) {
 			await store.ensureTable();
@@ -18489,19 +20563,29 @@ var WebhookDispatcher = class {
 	* for a third party. It also means a receiver that is down can no longer
 	* fail the customer's write.
 	*
-	* The cost, when no `jobQueue` is configured: the queue is in-process and
-	* in-memory. A crash or a deploy between the enqueue and the delivery drops
-	* the event, and a receiver may see the notification a few milliseconds
-	* before the row it describes is committed. Use {@link flush} on shutdown,
-	* and `onDelivery` to record failures.
+	* Called inside a write — from a callback — the deliveries are held until
+	* that write commits and dropped if it rolls back. They used to go out
+	* whatever happened to the row: a receiver could hear about a change a few
+	* milliseconds before it committed, or about one that never did.
 	*
-	* With `jobQueue` set, only the second half of that remains: the delivery
-	* becomes a row in `rebase.jobs` and survives the crash, the deploy and the
-	* pod being rescheduled.
+	* The cost, when no `jobQueue` is configured: the queue is in-process and
+	* in-memory. A crash or a deploy between the commit and the delivery drops
+	* the event. Use {@link flush} on shutdown, and `onDelivery` to record
+	* failures. With `jobQueue` set, the delivery becomes a row in
+	* `rebase.jobs` and survives the deploy and the pod being rescheduled — the
+	* only gap left is a crash between the commit and that insert.
 	*/
 	enqueueEntityChange(table, event, id, entity, previousEntity) {
 		const jobs = this.buildDeliveries(table, event, entity, previousEntity);
 		if (jobs.length === 0) return;
+		const ambient = currentAmbientTransaction();
+		if (ambient) {
+			ambient.afterCommit(() => this.dispatchDeliveries(jobs));
+			return;
+		}
+		this.dispatchDeliveries(jobs);
+	}
+	dispatchDeliveries(jobs) {
 		if (this.options.jobQueue) {
 			for (const job of jobs) this.options.jobQueue.enqueue(WEBHOOK_DELIVERY_TASK, {
 				webhookId: job.webhook.id,
@@ -19544,6 +21628,32 @@ var bootEnvExtension = z$1.object({
 		""
 	]).optional().transform((v) => v === void 0 || v === "" ? void 0 : v === "true"),
 	/**
+	* Serve `/mcp` and the OAuth authorization server that issues its tokens,
+	* so AI clients can read and write this project **as the signed-in user**.
+	*
+	* Off unless set, and unlike every other surface no role turns it on. The
+	* others describe a process shape; this one is a decision to hand
+	* credentials to third-party software, and it should be made by a person
+	* rather than inherited from a container's job title.
+	*
+	* `REBASE_PUBLIC_URL` must be set alongside it: every document the surface
+	* serves names absolute URLs, and the token audience is one of them. With
+	* it missing the surface declines to mount and says so.
+	*/
+	REBASE_MCP_ENABLED: z$1.enum([
+		"true",
+		"false",
+		""
+	]).optional().transform((v) => v === void 0 || v === "" ? void 0 : v === "true"),
+	/**
+	* This deployment's externally reachable origin, e.g. `https://app.example.com`.
+	*
+	* Read by the MCP surface, which cannot derive it: taking the origin from
+	* the `Host` header would make the issuer identity — and the audience its
+	* own tokens are checked against — a value the caller supplies.
+	*/
+	REBASE_PUBLIC_URL: z$1.string().url().optional(),
+	/**
 	* Comma-separated function names this process serves. Unset means all.
 	*
 	* `functions` role only. A name that is not in the bundle is a boot failure,
@@ -19770,9 +21880,11 @@ function resolveRole(env) {
 	if (env.REBASE_CRON_SCHEDULER !== void 0) ownership.cronScheduler = env.REBASE_CRON_SCHEDULER;
 	if (env.REBASE_JOB_WORKERS !== void 0) ownership.jobWorkers = env.REBASE_JOB_WORKERS;
 	if (env.REBASE_RLS_AUDIT !== void 0) ownership.rlsAudit = env.REBASE_RLS_AUDIT;
+	const surfaces = { ...base.surfaces };
+	if (env.REBASE_MCP_ENABLED !== void 0) surfaces.mcp = env.REBASE_MCP_ENABLED;
 	return {
 		role,
-		surfaces: { ...base.surfaces },
+		surfaces,
 		ownership,
 		provisionSchema: base.provisionSchema,
 		functionsSelection: {
@@ -20196,6 +22308,31 @@ function resolveAuthOptions(env, usersCollection) {
 }
 //#endregion
 //#region src/metrics/index.ts
+/**
+* Paths that are the platform OBSERVING this process, not traffic to it.
+*
+* `/metrics` is scraped by the control plane for the console's live view and
+* for the rollout gate, and the middleware is installed on `/*` before the
+* route is mounted — so every scrape counted itself. At a scrape every few
+* seconds that is ~20/min forever, which on a real tenant added up to 23,000
+* requests a day of pure self-observation, dwarfing its actual traffic by
+* three orders of magnitude and putting a 0.0% error rate and a flat 9ms
+* latency over the top of whatever the app was really doing.
+*
+* Excluded rather than relabelled: a request the platform makes to look at the
+* tenant is not the tenant's traffic under any label, and leaving it in a row
+* of its own would still have it dominating every total on the page.
+*/
+var UNCOUNTED_PATHS = /* @__PURE__ */ new Set([
+	"/metrics",
+	"/health",
+	"/livez",
+	"/readyz"
+]);
+/** Whether a path is the platform looking in, rather than a request served. */
+function isUncountedPath(pathname) {
+	return UNCOUNTED_PATHS.has(pathname);
+}
 var LATENCY_BUCKETS_MS = [
 	5,
 	10,
@@ -20372,7 +22509,7 @@ var MetricsRegistry = class MetricsRegistry {
 */
 function classifySurface(pathname, basePath = "/api") {
 	const prefix = basePath.endsWith("/") ? basePath.slice(0, -1) : basePath;
-	if (!pathname.startsWith(prefix)) return { surface: "other" };
+	if (!pathname.startsWith(prefix)) return { surface: "app" };
 	const [head, second] = pathname.slice(prefix.length).replace(/^\/+/, "").split("/");
 	switch (head) {
 		case "data": return {
@@ -20402,7 +22539,9 @@ function createMetricsMiddleware(basePath = "/api") {
 	let known;
 	const middleware = async (c, next) => {
 		const started = performance.now();
-		const { surface, collection } = classifySurface(new URL(c.req.url).pathname, basePath);
+		const pathname = new URL(c.req.url).pathname;
+		if (isUncountedPath(pathname)) return next();
+		const { surface, collection } = classifySurface(pathname, basePath);
 		try {
 			await next();
 		} finally {
@@ -20800,7 +22939,10 @@ async function downloadTo(tarball, options, fetchImpl) {
 	} finally {
 		clearTimeout(timer);
 	}
-	if (!response.ok) throw new Error(`${response.status} ${response.statusText}`);
+	if (!response.ok) {
+		const retryAfter = response.headers?.get?.("retry-after") ?? void 0;
+		throw new Error(`${response.status} ${response.statusText}` + (retryAfter ? ` (retry-after: ${retryAfter})` : ""));
+	}
 	if (!response.body) throw new Error("empty response body");
 	await pipeline(Readable.fromWeb(response.body), createWriteStream(tarball));
 	const { size } = fs$1.statSync(tarball);
@@ -20815,6 +22957,34 @@ async function downloadTo(tarball, options, fetchImpl) {
 * refuse. Writing the whole tarball first means a truncated download is caught
 * by `tar` as a corrupt archive, which is an error.
 */
+/**
+* The 4xx statuses that mean "not yet" rather than "no".
+*
+* 429 is a server asking to be asked again; 408 is it saying the attempt ran out
+* of time. Both clear on their own, and both are indistinguishable from a bad
+* credential to a rule that reads only the first digit.
+*/
+function isTransientStatus(detail) {
+	return /^(429|408) /.test(detail);
+}
+/**
+* The wait a `Retry-After` asks for, in milliseconds, or undefined.
+*
+* Seconds or an HTTP date, per RFC 9110. Capped, because this runs during a
+* pod's startup probe window: a server asking for five minutes gets the cap and
+* another attempt, which is better than a container marked unhealthy while it
+* politely waits.
+*/
+function retryAfterMs(detail, now = Date.now()) {
+	const raw = /\(retry-after: ([^)]+)\)/.exec(detail)?.[1]?.trim();
+	if (!raw) return void 0;
+	const seconds = Number(raw);
+	const ms = Number.isFinite(seconds) ? seconds * 1e3 : Number.isFinite(Date.parse(raw)) ? Date.parse(raw) - now : NaN;
+	if (!Number.isFinite(ms)) return void 0;
+	return Math.min(Math.max(ms, 0), MAX_RETRY_AFTER_MS);
+}
+/** Ceiling on an honoured `Retry-After`. See `retryAfterMs`. */
+var MAX_RETRY_AFTER_MS = 3e4;
 async function fetchBundle(options) {
 	const fetchImpl = options.fetchImpl ?? fetch;
 	const extract = options.extract ?? extractWithTar;
@@ -20831,13 +23001,15 @@ async function fetchBundle(options) {
 	} catch (error) {
 		lastError = error;
 		const detail = error instanceof Error ? error.message : String(error);
-		if (/^4\d\d /.test(detail) || attempt === attempts) break;
+		if (/^4\d\d /.test(detail) && !isTransientStatus(detail) || attempt === attempts) break;
+		const wait = retryAfterMs(detail) ?? retryDelayMs;
 		logger.warn("Bundle download failed; retrying", {
 			attempt,
 			of: attempts,
-			error: detail
+			error: detail,
+			waitMs: wait
 		});
-		await new Promise((resolve) => setTimeout(resolve, retryDelayMs));
+		await new Promise((resolve) => setTimeout(resolve, wait));
 	}
 	if (lastError) {
 		fs$1.rmSync(tarball, { force: true });
@@ -21433,6 +23605,7 @@ var TOPOLOGY_ENV_VARS = [
 	"REBASE_CRON_SCHEDULER",
 	"REBASE_JOB_WORKERS",
 	"REBASE_RLS_AUDIT",
+	"REBASE_MCP_ENABLED",
 	"REBASE_MIGRATE_ON_BOOT",
 	"TRUSTED_PROXY_HOPS",
 	"REBASE_RATE_LIMIT_STORE",
@@ -21493,6 +23666,6 @@ var RUNTIME_STARTUP_BUDGET_SECONDS = 300;
 /** Where a bundle is mounted, and what the runtime is told to read. */
 var RUNTIME_BUNDLE_MOUNT = "/bundle";
 //#endregion
-export { ACCOUNT_SCOPED_STORAGE_BASES, ApiError, BATCH_REF_KEY, BlockedUrlError, BundleError, CONCURRENT_DDL_SQLSTATES, CollectionConfigError, CronScheduler, DEFAULT_DRIVER_ID, DEFAULT_MAX_FILE_SIZE, DEFAULT_STORAGE_ID, DOCUMENT_MIME_TYPES, DefaultDriverRegistry, DefaultStorageRegistry, ETAG_HEADER, FIELD_OPERATORS, GCSStorageController, IF_MATCH_HEADER, IMAGE_MIME_TYPES, LocalStorageController, MetricsRegistry, RUNTIME_BUNDLE_MOUNT, RUNTIME_HEALTH_PATH, RUNTIME_LIVENESS_PATH, RUNTIME_MIN_TERMINATION_GRACE_SECONDS, RUNTIME_PRESTOP_DRAIN_SECONDS, RUNTIME_PROBE_PATHS, RUNTIME_STARTUP_BUDGET_SECONDS, RawHtml, S3StorageController, SMTPEmailService, StoragePolicyError, TOPOLOGY_ENV_VARS, TransformCache, TusHandler, UPLOAD_COLLECTION_FIELD, UPLOAD_PROPERTY_FIELD, UnknownStorageSourceError, WEBHOOK_DELIVERY_TASK, WebhookDispatcher, _resetRebaseMock, _setRebaseMock, activeDevEmailSink, applyCollectionDefaults, assertAllowedOutboundUrl, assertCollectionConfigs, assertDistinctSuffixes, assertEmailLinkBases, assertEveryKindBindable, assertFieldOpsValid, assertIfMatch, assertNoFieldOpsOnCreate, assertUploadWithinPropertyLimits, assertWriteRequestValid, authJwt, authRoles, authUid, blockedAddressReason, bootFromBundle, classifySurface, cleanupDevPortFile, clearActiveDevEmailSink, compileStoragePolicies, configureJwt, createAppleProvider, createBackupRoutes, createBitbucketProvider, createBuiltinAuthAdapter, createContractRoutes, createCronRoutes, createCronStore, createCustomAuthAdapter, createDdlBootstrapper, createDevEmailSink, createDiscordProvider, createEmailService, createFacebookProvider, createFunctionRoutes, createGitHubProvider, createGitLabProvider, createGoogleProvider, createHistoryRoutes, createJobQueue, createJobStore, createJwksRoutes, createLinkedinProvider, createMetricsMiddleware, createMetricsRoutes, createMicrosoftProvider, createRlsAudit, createSlackProvider, createSourceBundle, createSpotifyProvider, createStorageController, createStorageRoutes, createTwitterProvider, createUnconfiguredEmailService, createUploadConstraintResolver, declaredUniqueTargets, defaultBackoff, defineCron, defineFunction, drainBackgroundWork, envSuffixForKey, errorHandler, escapeHtml, extractLinks, extractUserFromToken, fileTokenAuth, findCollectionConfigProblems, generateSecurePassword, getApiKey, getDriver, getEmailOtpTemplate, getEmailVerificationTemplate, getEnv, getJwks, getMagicLinkTemplate, getPasswordResetTemplate, getRequestId, getRoles, getUser, getUserId, getUserInvitationTemplate, getWelcomeEmailTemplate, hasAsymmetricSigningKey, hasFieldOps, hasRole, hashPassword, html, httpMethodToOperation, identityResolved, implicitDeclaration, initializeDataSource, initializeDataSources, initializeRebaseBackend, installShutdownHandlers, isAcceptedFile, isAdmin, isApiKeyToken, isAuthAdapter, isAuthenticated, isConcurrentDdlRace, isDatabaseAdapter, isDuplicateObjectRace, isLocalhostOrigin, isNodeRuntime, isOperationAllowed, isTopologyEnvVar, isTransformableImage, lazyResource, listBackupObjects, listenWithPortRetry, loadBootEnv, loadBundle, loadBundleConfigExports, loadBundleSchema, loadCollectionsFromDirectory, loadCronJobsFromDirectory, loadCronJobsWithDiagnostics, loadEnv, loadFunctionsFromDirectory, loadFunctionsWithDiagnostics, loadUsersCollection, logger, looksLikeFieldOp, oauthCodeFlowSchema, optionalAuth, parseBackupDestination, parseBackupTimestamp, parseFieldOp, parseTransformOptions, pendingBackgroundWork, pkceTokenParams, providerVerifiedEmail, queryTokenAuth, raw, rawQueryLoggingEnabled, readBackupBytes, readBundleManifest, readUploadPropertyContext, rebase, registerDevEmailSink, registerResourceResolver, requireAdmin, requireAuth, requireDriver, requireEnv, requireRole, resolveAuthHooks, resolveAuthOptions, resolveBatchRefs, resolveConflictTarget, resolveCorsOrigin, resolveDataSources, resolveEmailBranding, resolveEmailLinkBase, resolveEmailOptions, resolveRequireAuth, resolveStorageAccessControl, resolveStorageBackend, resolveStorageSources, resourceResolver, resourceResolvers, rowETag, runFromBundle, runtimeKey, safeCompare, schemaDriftRemedy, serveSPA, splitFieldOps, summarize as summarizeRlsScan, transformImage, tryVerifyOidcIdToken, unbindableKinds, unknownKeyPolicyFromEnv, validateApiKey, validateCronExpression, validatePasswordStrength, verifyOidcIdToken, verifyPassword, versionProperty, waitUntil, z };
+export { ACCOUNT_SCOPED_STORAGE_BASES, ApiError, BATCH_REF_KEY, BlockedUrlError, BundleError, CONCURRENT_DDL_SQLSTATES, CollectionConfigError, CronScheduler, DEFAULT_DRIVER_ID, DEFAULT_MAX_FILE_SIZE, DEFAULT_STORAGE_ID, DOCUMENT_MIME_TYPES, DefaultDriverRegistry, DefaultStorageRegistry, ETAG_HEADER, FIELD_OPERATORS, GCSStorageController, IF_MATCH_HEADER, IMAGE_MIME_TYPES, LocalStorageController, MetricsRegistry, RUNTIME_BUNDLE_MOUNT, RUNTIME_HEALTH_PATH, RUNTIME_LIVENESS_PATH, RUNTIME_MIN_TERMINATION_GRACE_SECONDS, RUNTIME_PRESTOP_DRAIN_SECONDS, RUNTIME_PROBE_PATHS, RUNTIME_STARTUP_BUDGET_SECONDS, RawHtml, S3StorageController, SMTPEmailService, StoragePolicyError, TOPOLOGY_ENV_VARS, TransformCache, TusHandler, UPLOAD_COLLECTION_FIELD, UPLOAD_PROPERTY_FIELD, UnknownStorageSourceError, WEBHOOK_DELIVERY_TASK, WebhookDispatcher, _resetRebaseMock, _setRebaseMock, activeDevEmailSink, applyCollectionDefaults, assertAllowedOutboundUrl, assertCollectionConfigs, assertDistinctSuffixes, assertEmailLinkBases, assertEveryKindBindable, assertFieldOpsValid, assertIfMatch, assertNoFieldOpsOnCreate, assertUploadWithinPropertyLimits, assertWriteRequestValid, authJwt, authRoles, authUid, blockedAddressReason, bootFromBundle, classifySurface, cleanupDevPortFile, clearActiveDevEmailSink, compileStoragePolicies, configureJwt, createAppleProvider, createBackupRoutes, createBitbucketProvider, createBuiltinAuthAdapter, createContractRoutes, createCronRoutes, createCronStore, createCustomAuthAdapter, createDdlBootstrapper, createDevEmailSink, createDiscordProvider, createEmailService, createFacebookProvider, createFunctionRoutes, createGitHubProvider, createGitLabProvider, createGoogleProvider, createHistoryRoutes, createJobQueue, createJobStore, createJwksRoutes, createLinkedinProvider, createMetricsMiddleware, createMetricsRoutes, createMicrosoftProvider, createRlsAudit, createSlackProvider, createSourceBundle, createSpotifyProvider, createStorageController, createStorageRoutes, createTwitterProvider, createUnconfiguredEmailService, createUploadConstraintResolver, declaredUniqueTargets, defaultBackoff, defineCron, defineFunction, drainBackgroundWork, envSuffixForKey, errorHandler, escapeHtml, extractLinks, extractUserFromToken, fileTokenAuth, findCollectionConfigProblems, generateSecurePassword, getApiKey, getDriver, getEmailOtpTemplate, getEmailVerificationTemplate, getEnv, getJwks, getMagicLinkTemplate, getPasswordResetTemplate, getRequestId, getRoles, getUser, getUserId, getUserInvitationTemplate, getWelcomeEmailTemplate, hasAsymmetricSigningKey, hasFieldOps, hasRole, hashPassword, html, httpMethodToOperation, identityResolved, implicitDeclaration, initializeDataSource, initializeDataSources, initializeRebaseBackend, installShutdownHandlers, isAcceptedFile, isAdmin, isApiKeyToken, isAuthAdapter, isAuthenticated, isConcurrentDdlRace, isDatabaseAdapter, isDuplicateObjectRace, isLocalhostOrigin, isNodeRuntime, isOperationAllowed, isTopologyEnvVar, isTransformableImage, isUncountedPath, lazyResource, listBackupObjects, listenWithPortRetry, loadBootEnv, loadBundle, loadBundleConfigExports, loadBundleSchema, loadCollectionsFromDirectory, loadCronJobsFromDirectory, loadCronJobsWithDiagnostics, loadEnv, loadFunctionsFromDirectory, loadFunctionsWithDiagnostics, loadUsersCollection, logger, looksLikeFieldOp, oauthCodeFlowSchema, optionalAuth, parseBackupDestination, parseBackupTimestamp, parseFieldOp, parseTransformOptions, pendingBackgroundWork, pkceTokenParams, providerVerifiedEmail, queryTokenAuth, raw, rawQueryLoggingEnabled, readBackupBytes, readBundleManifest, readUploadPropertyContext, rebase, registerDevEmailSink, registerResourceResolver, requireAdmin, requireAuth, requireDriver, requireEnv, requireRole, resolveAuthHooks, resolveAuthOptions, resolveBatchRefs, resolveConflictTarget, resolveCorsOrigin, resolveDataSources, resolveEmailBranding, resolveEmailLinkBase, resolveEmailOptions, resolveRequireAuth, resolveStorageAccessControl, resolveStorageBackend, resolveStorageSources, resourceResolver, resourceResolvers, rowETag, runFromBundle, runtimeKey, safeCompare, schemaDriftRemedy, serveSPA, splitFieldOps, summarize as summarizeRlsScan, transformImage, tryVerifyOidcIdToken, unbindableKinds, unknownKeyPolicyFromEnv, validateApiKey, validateCronExpression, validatePasswordStrength, verifyOidcIdToken, verifyPassword, versionProperty, waitUntil, z };
 
 //# sourceMappingURL=index.es.js.map