@rebasepro/server 0.21.0 → 0.21.1-canary.g8c5a265

package/dist/{auth-gzoRjnuh.js → auth-BvBllZjy.js}

@@ -3,13 +3,13 @@ import __rebaseProcess from "process";
 globalThis.process ??= __rebaseProcess;
 __rebaseCreateRequire(import.meta.url);
 import { i as __toESM, n as __exportAll } from "./rolldown-runtime-dW7B1o5h.js";
-import { P as revokeInternalTableSql, at as isAnonymousUid, it as ANONYMOUS_USER_ID } from "./src-DW1cQ_28.js";
+import { P as revokeInternalTableSql, at as isAnonymousUid, it as ANONYMOUS_USER_ID } from "./src-Caz7nREj.js";
 import "./src-Br6ARbs6.js";
 import { n as createDdlBootstrapper, o as isSQLAdmin } from "./ddl-bootstrap-CfNvxMuK.js";
 import { t as firstSqlRow } from "./sql-rows-C6GEc2oE.js";
 import { r as logger } from "./logger-DO2PZc4i.js";
 import { n as errorHandler, t as ApiError } from "./errors-DMImyqyR.js";
-import { a as resolveListLimitParam } from "./query-parser-uqzkZ82i.js";
+import { a as resolveListLimitParam } from "./query-parser-DUl8d557.js";
 import { C as require_jsonwebtoken, E as randomInt$1, O as sha256Hex, _ as verifyAccessToken, b as verifyMfaPendingToken, c as getAccessTokenExpiry, d as getRefreshTokenTtlMs, f as hasAsymmetricSigningKey, i as generateDownloadToken, l as getJwks, m as isJwtConfigured, n as configureJwt, o as generateMfaPendingToken, p as hashRefreshToken, r as generateAccessToken, s as generateRefreshToken, t as MAX_COOKIE_AGE_MS, u as getRefreshTokenExpiry, v as verifyDownloadToken, w as constantTimeEqual } from "./jwt-C4OW-DNq.js";
 import { n as hasAdministrativeRole, r as isAdministrativeRole, t as ADMINISTRATIVE_ROLES } from "./admin-roles-vYdp_Pil.js";
 import { c as tryCanonicalStorageKey, i as canonicalStorageId } from "./keys-Qfc4XieN.js";
@@ -154,1687 +154,1719 @@ function isFunctionAllowed(permissions, functionName, operation) {
 	return false;
 }
 //#endregion
-//#region src/auth/token-revocation.ts
+//#region src/email/html.ts
 /**
-* Has this access token been revoked?
-*
-* `logout`, `change-password`, `reset-password` and `DELETE /auth/sessions` all
-* stamp a `tokensValidAfter` watermark on the user. Every one of them also
-* deletes refresh-token rows, which is what made the gap easy to miss: the
-* session really is gone, and the *refresh* path really does check the
-* watermark — so signing out looked like it worked.
-*
-* The access token was untouched. It is a bearer credential that nothing
-* consulted a database about, so it stayed valid for its full lifetime after
-* every one of those actions. "Sign out everywhere" left the stolen token
-* working; so did changing your password because you thought it had leaked.
-*
-* The watermark had exactly one read in the repository, on refresh. This adds
-* the other one.
-*
-* ## Cost
-*
-* One indexed lookup per request, on the paths that already make one. The
-* adapter re-reads roles for every authenticated request; the admin routes now
-* do too. Both call this with the row they were already fetching in mind — a
-* repository that wants to serve both from one query is free to cache
-* internally, but nothing here assumes it.
+* HTML escaping for email bodies.
 *
-* ## Failure
+* Every default template interpolates values the server does not control — a
+* `displayName` chosen at registration, an `appName` from config, a link base a
+* host set — into markup that is then mailed, signed by the sending domain, to
+* an address the same request chose. Unescaped, that turns `POST /auth/register`
+* into a way to deliver arbitrary HTML (a heading, an anchor) from a domain
+* whose SPF and DKIM check out.
 *
-* Fails **open**, deliberately, and this is the one place in the auth stack
-* where that is right. The watermark is an extra revocation signal layered over
-* a token that has already been verified — signature, expiry and purpose all
-* checked. Refusing every request when the database is unreachable would turn a
-* transient outage into a total sign-out of an entire deployment, and the
-* attacker this protects against needs to have already stolen a live token. The
-* failure is logged at warn so it is visible rather than silent.
+* The fix is deliberately not five escaping calls at five interpolation sites:
+* a sixth template would simply forget. Templates are built with the {@link html}
+* tag, which escapes *every* interpolated value by default, and markup that is
+* meant to pass through verbatim — the static style strings, a nested fragment —
+* must say so with {@link raw}. Forgetting `raw` produces visibly escaped text
+* in a test; forgetting to escape is invisible until someone exploits it.
 */
-async function isAccessTokenRevoked(authRepo, payload) {
-	if (typeof authRepo.getTokensValidAfter !== "function") return false;
-	if (typeof payload.iat !== "number") return false;
-	let validAfter;
-	try {
-		validAfter = await authRepo.getTokensValidAfter(payload.uid);
-	} catch (error) {
-		logger.warn("[Auth] Could not read the token revocation watermark; allowing the request", {
-			uid: payload.uid,
-			error
-		});
-		return false;
-	}
-	if (!validAfter) return false;
-	return payload.iat < Math.floor(validAfter.getTime() / 1e3);
-}
-//#endregion
-//#region src/auth/rls-scope.ts
-var import_jsonwebtoken = /* @__PURE__ */ __toESM(require_jsonwebtoken(), 1);
 /**
-* The identity the trusted server plane runs as: `rebase.dataAsAdmin`, and any
-* caller presenting the service key.
-*
-* Naming it makes the privilege legible, because it is narrower than it reads.
-* This is **not** an RLS bypass — a driver scoped with it is an
-* `AuthenticatedPostgresBackendDriver`, so every statement runs in a
-* transaction that has done `SET LOCAL ROLE rebase_user` with
-* `app.uid = 'service'`, and policies are evaluated. Two consequences worth
-* knowing before you write a policy:
-*
-* - It passes the default policies through their `rolesOverlap(['admin'])`
-*   arm — the same arm an application user holding the `admin` role passes.
-* - `policy.serverContext()` compiles to `rebase.uid() IS NULL` and is therefore
-*   **false** for it. A collection with `disableDefaultPolicies: true` whose
-*   only rule is `serverContext()` denies these writes (42501) and returns
-*   zero rows for these reads.
+* Markup that has already been vetted and must be interpolated verbatim.
 *
-* The true bypass is `rebase.sql()`, which runs on the owner connection and
-* never goes near `withAuth`.
+* Only ever construct this from a string literal in this package's own source
+* (or from the {@link html} tag, which produces one). Wrapping user input in
+* `raw()` defeats the entire mechanism.
 */
-var SERVICE_IDENTITY = {
-	uid: "service",
-	roles: ["admin"]
+var RawHtml = class {
+	value;
+	constructor(value) {
+		this.value = value;
+	}
+	toString() {
+		return this.value;
+	}
 };
 /**
-* Returns true if the driver supports RLS scoping via `withAuth()`.
+* Mark a static, author-controlled string as safe to interpolate unescaped.
 */
-function isRLSScopedDriver(driver) {
-	return "withAuth" in driver && typeof driver.withAuth === "function";
+function raw(markup) {
+	return new RawHtml(markup);
 }
 /**
-* Can this driver run a request as a specific user?
-*
-* The same question `scopeDataDriver` asks internally, exported because one
-* caller must act on the answer BEFORE it has a request to scope.
+* Escape the five characters that can change the meaning of HTML text or of a
+* quoted attribute value.
 *
-* `scopeDataDriver` returns the driver unscoped when the answer is no, which is
-* the right behaviour for `/api/data` — Mongo has no row-level security and
-* never claimed to, and the route's own checks still apply. It is the wrong
-* behaviour for a surface whose entire promise is "this runs as you": there,
-* an unscoped driver silently means "runs as the database owner". So the MCP
-* surface asks this at boot and declines to mount rather than degrade.
+* `&` goes first: escaping it after the others would double-escape the entities
+* they just produced. `'` is included because it is a legal attribute delimiter,
+* and `"` because it is the one this file uses.
 */
-function supportsRlsScoping(driver) {
-	return isRLSScopedDriver(driver);
+function escapeHtml(value) {
+	return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 }
 /**
-* Scope a DataDriver via `withAuth()` for RLS.
-*
-* SECURITY: If `withAuth()` is available but fails, the error is re-thrown
-* so the request is **denied** rather than proceeding with unscoped access
-* (fail-closed behavior).
-*
-* If the driver does not support RLS, the original driver is returned.
-*
-* @param driver - The DataDriver to scope.
-* @param user   - The authenticated user identity for RLS.
-* @returns The RLS-scoped DataDriver (or the original if RLS is unsupported).
+* Render one interpolated value: pass {@link RawHtml} through, drop nullish,
+* escape everything else.
 */
-async function scopeDataDriver(driver, user) {
-	if (isRLSScopedDriver(driver)) return await driver.withAuth(user);
-	return driver;
+function interpolate(value) {
+	if (value instanceof RawHtml) return value.value;
+	if (value === null || value === void 0) return "";
+	return escapeHtml(String(value));
 }
-//#endregion
-//#region src/auth/crypto-utils.ts
-/**
-* Cryptographic utility functions for auth.
-*
-* @module
-*/
 /**
-* Constant-time string comparison to prevent timing attacks.
-*
-* Used for comparing service keys, tokens, and other secrets where
-* timing side-channels could leak information about the expected value.
+* Tagged template for email markup. Every `${...}` is escaped unless it is
+* {@link RawHtml}.
 *
-* The implementation lives in `utils/portable-crypto.ts`, which does this over
-* UTF-8 bytes without `node:crypto` — this function is on the request path, and
-* the byte-level reasoning it depends on is documented there.
+* Returns `RawHtml` so fragments nest without being escaped a second time:
 *
-* @param a - First string to compare.
-* @param b - Second string to compare.
-* @returns `true` if the strings are identical, `false` otherwise.
+* ```ts
+* const button = url ? html`<a href="${url}">Open</a>` : raw("");
+* const body = html`<div>${button}</div>`;
+* ```
 */
-function safeCompare(a, b) {
-	return constantTimeEqual(a, b);
+function html(strings, ...values) {
+	let out = strings[0];
+	for (let i = 0; i < values.length; i++) out += interpolate(values[i]) + strings[i + 1];
+	return new RawHtml(out);
 }
 //#endregion
-//#region src/auth/bearer-token.ts
-/**
-* Parsing of the `Authorization: Bearer <token>` header.
-*
-* Its own module rather than a helper inside `middleware.ts`, because the
-* API-key middleware needs it too and `middleware.ts` already imports from
-* there — putting it in either one would close an import cycle.
-*
-* @module
-*/
+//#region src/email/templates.ts
 /**
-* Pull the token out of an `Authorization: Bearer <token>` header.
-*
-* RFC 7235 §2.1 makes the auth-scheme name case-insensitive, and plenty of
-* clients send `bearer` — HTTP libraries that lower-case what they emit,
-* hand-written curl, proxies that normalise headers. Matching `"Bearer "`
-* exactly turned those into a 401 that, from the caller's side, is
-* indistinguishable from a rejected token; people spend an afternoon
-* regenerating credentials that were fine. Only the scheme is folded — the
-* token itself is returned byte-for-byte.
+* Default email templates for authentication emails.
 *
-* Returns `undefined` when there is no header or it names another scheme.
-* That is deliberately distinct from an empty token (`Bearer ` with nothing
-* after it), which callers still route into verification so it fails as a bad
-* token rather than as a missing header.
-*/
-function extractBearerToken(authHeader) {
-	if (!authHeader) return void 0;
-	const separator = authHeader.indexOf(" ");
-	if (separator < 0) return void 0;
-	if (authHeader.slice(0, separator).toLowerCase() !== "bearer") return void 0;
-	return authHeader.slice(separator + 1);
-}
-//#endregion
-//#region src/auth/api-keys/api-key-middleware.ts
-/**
-* Check whether a token looks like a Rebase API key.
+* Every HTML body is built with the `html` tag from `./html`, which escapes each
+* interpolated value unless it is explicitly marked `raw`. `displayName` reaches
+* these templates straight from the registration body, and the resulting mail is
+* sent — signed by the sending domain — to an address the same anonymous request
+* chose, so an unescaped interpolation here is a phishing primitive, not a
+* rendering glitch. Escaping lives in the tag rather than at the call sites so a
+* sixth template inherits it instead of having to remember it.
 */
-function isApiKeyToken(token) {
-	return token.startsWith("rk_");
-}
 /**
-* Hash a plaintext API key token for database lookup.
+* Get a greeting name for the user.
 *
-* Async because it hashes with WebCrypto rather than `node:crypto` — the sole
-* caller was already awaiting the store lookup this feeds.
+* Returns the raw value — `displayName` is whatever the account was registered
+* with, including markup. Escaping is the `html` tag's job, so that a template
+* that interpolates the greeting into text (the plain-text bodies below) and one
+* that interpolates it into markup can share this.
 */
-function hashToken$1(token) {
-	return sha256Hex(token);
+function getGreeting(user) {
+	return user.displayName || user.email.split("@")[0];
 }
 /**
-* Validate an API key token and populate the Hono context.
-*
-* Returns `true` if the key is valid and context has been populated,
-* or returns an error Response if the key is invalid.
+* Common email styles.
 *
-* This is NOT a standalone middleware — it's called from within
-* `createAuthMiddleware()` when a `rk_` prefixed token is detected.
+* `raw` because these are static, author-written CSS — the one category of
+* interpolation the `html` tag lets through unescaped. (Escaping them would
+* survive an HTML parser but not every mail client's CSS parser: the
+* `'Segoe UI'` quotes would arrive as entities.)
 */
-async function validateApiKey(c, token, options) {
-	const { store, driver } = options;
-	const hash = await hashToken$1(token);
-	const apiKey = await store.findByKeyHash(hash);
-	if (!apiKey) return c.json({ error: {
-		message: "Invalid API key",
-		code: "UNAUTHORIZED"
-	} }, 401);
-	if (apiKey.revoked_at) return c.json({ error: {
-		message: "API key has been revoked",
-		code: "UNAUTHORIZED"
-	} }, 401);
-	if (apiKey.expires_at && new Date(apiKey.expires_at) < /* @__PURE__ */ new Date()) return c.json({ error: {
-		message: "API key has expired",
-		code: "UNAUTHORIZED"
-	} }, 401);
-	const uid = `api-key:${apiKey.id}`;
-	const roles = apiKey.admin ? ["admin", "service"] : ["service"];
-	c.set("user", {
-		uid,
-		roles
-	});
-	const masked = {
-		id: apiKey.id,
-		name: apiKey.name,
-		key_prefix: apiKey.key_prefix,
-		permissions: apiKey.permissions,
-		admin: apiKey.admin,
-		rate_limit: apiKey.rate_limit,
-		created_by: apiKey.created_by,
-		created_at: apiKey.created_at,
-		updated_at: apiKey.updated_at,
-		last_used_at: apiKey.last_used_at,
-		expires_at: apiKey.expires_at,
-		revoked_at: apiKey.revoked_at
-	};
-	c.set("apiKey", masked);
-	try {
-		const scopedDriver = await scopeDataDriver(driver, {
-			uid,
-			roles
-		});
-		c.set("driver", scopedDriver);
-	} catch (error) {
-		logger.error("[AUTH] RLS scoping failed for API key", { error });
-		return c.json({ error: {
-			message: "Internal authentication error",
-			code: "INTERNAL_ERROR"
-		} }, 500);
-	}
-	const lastTouch = lastUsedTouchedAt.get(apiKey.id);
-	const now = Date.now();
-	if (!lastTouch || now - lastTouch >= LAST_USED_DEBOUNCE_MS) {
-		lastUsedTouchedAt.set(apiKey.id, now);
-		store.updateLastUsed(apiKey.id).catch(() => {});
-	}
-	return true;
-}
-/** Per-process debounce state for last_used_at touches. */
-var lastUsedTouchedAt = /* @__PURE__ */ new Map();
-var LAST_USED_DEBOUNCE_MS = 6e4;
+var styles = {
+	container: raw(`
+        font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif;
+        max-width: 600px;
+        margin: 0 auto;
+        padding: 40px 20px;
+        background-color: #f8fafc;
+    `),
+	card: raw(`
+        background-color: #ffffff;
+        border-radius: 12px;
+        padding: 40px;
+        box-shadow: 0 4px 6px -1px rgba(0, 0, 0, 0.1);
+    `),
+	heading: raw(`
+        color: #1e293b;
+        font-size: 24px;
+        font-weight: 600;
+        margin: 0 0 20px 0;
+    `),
+	paragraph: raw(`
+        color: #475569;
+        font-size: 16px;
+        line-height: 1.6;
+        margin: 0 0 20px 0;
+    `),
+	button: raw(`
+        display: inline-block;
+        background-color: #3b82f6;
+        color: #ffffff;
+        font-size: 16px;
+        font-weight: 600;
+        text-decoration: none;
+        padding: 14px 28px;
+        border-radius: 8px;
+        margin: 20px 0;
+    `),
+	footer: raw(`
+        color: #94a3b8;
+        font-size: 14px;
+        margin-top: 30px;
+        padding-top: 20px;
+        border-top: 1px solid #e2e8f0;
+    `),
+	warning: raw(`
+        color: #64748b;
+        font-size: 14px;
+        background-color: #fef3c7;
+        padding: 12px 16px;
+        border-radius: 6px;
+        margin-top: 20px;
+    `),
+	/**
+	* The one-time code itself. Monospace so the digits line up, spaced so a
+	* `1` and a `7` are not read as one glyph, and large enough to be copied by
+	* eye from a phone onto another device — which is the entire flow.
+	*/
+	code: raw(`
+        display: inline-block;
+        font-family: 'SFMono-Regular', Consolas, 'Liberation Mono', Menlo, monospace;
+        font-size: 34px;
+        font-weight: 700;
+        letter-spacing: 10px;
+        color: #1e293b;
+        background-color: #f1f5f9;
+        border-radius: 10px;
+        padding: 18px 20px 18px 30px;
+    `)
+};
 /**
-* Shared 403 response for API-key permission denials outside the REST
-* generator (storage and functions guards). One envelope, one code — a
-* change to the error contract happens in one place.
+* The app name every template falls back to when `email.appName` is unset.
 */
-function forbidApiKey(c, operation, resource, grantHint) {
-	return c.json({ error: {
-		message: `API key does not have "${operation}" permission for ${resource}. Grant it with a permission entry like { "collection": "${grantHint}", "operations": ["${operation}"] }.`,
-		code: "API_KEY_FORBIDDEN"
-	} }, 403);
-}
+var DEFAULT_APP_NAME = "Rebase";
 /**
-* Permission guard for API-key requests to the storage router.
-*
-* Storage previously did not accept API keys at all (`rk_` tokens were
-* misparsed as JWTs and 401'd). Now that the pre-auth middleware
-* authenticates them, this guard decides what they may do: the key needs a
-* `"storage"` permission entry (or the global `"*"` wildcard) covering the
-* operation derived from the HTTP method. Requests not authenticated via an
-* API key pass through to the storage router's own auth gates.
+* The Rebase mark, hosted. Mail clients do not render SVG (Gmail strips it
+* outright), so this is the PNG rather than `logo.svg`, and it is an absolute
+* URL rather than a data URI because Gmail blocks those in `<img src>` too.
+*/
+var REBASE_LOGO_URL = "https://rebase.pro/img/logo_small.png";
+/**
+* Whether a configured logo can actually be fetched by a mail client.
 *
-* TUS resumable-upload routes (`/tus`, `/tus/:id`) are classified as `write`
-* for EVERY method: the protocol's offset check is a GET and its cancel is a
-* DELETE, but both are steps of an upload — a write-scoped key must be able
-* to complete (and abort) its own resumable upload without also holding
-* `read`/`delete` on stored objects.
+* A relative path, a `data:` URI or a `file:` URL all produce a broken image in
+* the recipient's inbox rather than an error anyone would see, so an unusable
+* value renders no logo at all instead. This is deliberately not a boot-time
+* assert like `assertEmailLinkBases`: a dead link makes the mail useless, a
+* missing logo only makes it plain.
 */
-function createStorageApiKeyGuard() {
-	return async (c, next) => {
-		const apiKey = c.get("apiKey");
-		if (!apiKey) return next();
-		const operation = /\/tus(\/|$)/.test(c.req.path) ? "write" : httpMethodToOperation(c.req.method);
-		if (!isStorageAllowed(apiKey.permissions, operation)) return forbidApiKey(c, operation, "storage", "storage");
-		return next();
-	};
+function isMailableImageUrl(url) {
+	if (!url) return false;
+	try {
+		const { protocol } = new URL(url);
+		return protocol === "https:" || protocol === "http:";
+	} catch {
+		return false;
+	}
 }
 /**
-* Permission guard for API-key requests to the custom-functions router.
-*
-* The collection permission guard lives in the REST generator and never sees
-* function routes, so before this middleware existed ANY valid API key —
-* however narrowly scoped — could invoke every custom function. This guard
-* closes that: API-key requests must hold a `"functions"`/`"functions/<name>"`
-* permission entry (or the global `"*"` wildcard) for the derived operation.
-*
-* Non-API-key requests (JWT, service key, anonymous) pass through untouched —
-* functions decide their own auth for those, as before.
+* Whether this config still carries the stock app name — i.e. nobody has
+* branded this install.
 *
-* @param mountPrefix - The path the functions router is mounted at
-*                      (e.g. `/api/functions`), used to extract the function
-*                      name from the request path.
+* Testing against the *value* rather than against `undefined` is deliberate and
+* load-bearing: `APP_NAME` is declared `z.string().default("Rebase")` in the
+* cloud, in the demo app and in the eject template, so `appName` arrives here as
+* the literal string "Rebase" even when the operator set nothing. Keying the
+* fallback on `appName === undefined` would mean the logo never appeared in any
+* Rebase-run product.
 */
-function createFunctionApiKeyGuard(mountPrefix) {
-	return async (c, next) => {
-		const apiKey = c.get("apiKey");
-		if (!apiKey) return next();
-		const path = c.req.path;
-		const idx = path.indexOf(mountPrefix);
-		const rawName = (idx < 0 ? "" : path.slice(idx + mountPrefix.length)).split("/").filter(Boolean)[0] ?? "";
-		let functionName;
-		try {
-			functionName = decodeURIComponent(rawName);
-		} catch {
-			functionName = rawName;
-		}
-		const operation = httpMethodToOperation(c.req.method);
-		if (!isFunctionAllowed(apiKey.permissions, functionName, operation)) return forbidApiKey(c, operation, functionName ? `function "${functionName}"` : "the functions index", `functions${functionName ? `/${functionName}` : ""}`);
-		return next();
-	};
+function isUnbranded(appName) {
+	return !appName || appName === DEFAULT_APP_NAME;
 }
 /**
-* Standalone pre-auth middleware for `rk_` bearer tokens.
-*
-* Routers whose auth gate is JWT-based (`requireAuth` / `createRequireAuth` —
-* the admin surfaces: admin users/roles, api-keys management, cron, backups,
-* logs, schema editor) don't know about API keys. Mounting this middleware in
-* front of them authenticates `rk_` tokens and populates the request context;
-* the downstream gates then see the already-resolved user and apply their
-* role checks (`requireAdmin`) as usual — so an `admin: true` key passes and
-* a non-admin key is rejected with 403.
+* Resolve the branding a template should render from the email config.
 *
-* Requests without an `rk_` bearer token pass through untouched. An invalid,
-* revoked, or expired `rk_` token is rejected here (401) rather than falling
-* through to be misparsed as a JWT.
+* The fallback is asymmetric on purpose. `appName` falls back to "Rebase"
+* because an unconfigured app has no better name to show. The *logo* is stricter:
+* an app that named itself "Acme" but set no `logoUrl` gets no logo at all,
+* because the alternative is mailing Acme's users a Rebase mark from Acme's
+* domain. Only an install that has not renamed itself is treated as Rebase's own.
 */
-function createApiKeyPreAuth(options) {
-	return async (c, next) => {
-		if (c.get("apiKey")) return next();
-		const token = extractBearerToken(c.req.header("authorization")) ?? "";
-		if (!token || !isApiKeyToken(token)) return next();
-		const result = await validateApiKey(c, token, options);
-		if (result !== true) return result;
-		return next();
+function resolveEmailBranding(config) {
+	const logoUrl = config?.logoUrl ?? (isUnbranded(config?.appName) ? REBASE_LOGO_URL : void 0);
+	return {
+		appName: config?.appName || DEFAULT_APP_NAME,
+		logoUrl: isMailableImageUrl(logoUrl) ? logoUrl : void 0
 	};
 }
-//#endregion
-//#region src/auth/middleware.ts
 /**
-* Answer a refusal with the canonical envelope, through the same formatter
-* every route uses.
+* The logo block that sits above the card in every default template.
 *
-* These middlewares used to hand-build `c.json({ error: { message, code } },
-* 401)` — seven near-copies of it, which is how they came to omit `requestId`
-* while every other error on the server carried it: the one string a bug report
-* quotes was missing from precisely the errors an app hits most. It also meant
-* a routine 401 (a client refreshing before it knows whether a session exists)
-* logged like an incident, because `ApiError.expected` never reached the
-* logger.
+* `width`/`height` are attributes as well as CSS because Outlook's Word renderer
+* ignores the style block. `alt` carries the app name, for screen readers and
+* for the very common case of a client that blocks remote images on a first
+* email from an unknown sender.
 *
-* `errorHandler` is *called* rather than thrown to. A throw only becomes an
-* envelope where an `onError` is registered, and these middlewares are mounted
-* by callers this package does not control — `defineFunction` hands users a
-* Hono app and invites them to put `requireAuth` on a route of it. Making the
-* status depend on the mount point would turn a 401 into a 500 for exactly
-* those callers. Calling the formatter directly gets the envelope with none of
-* that.
+* The type styling on the `<img>` is what that blocked case falls back to: alt
+* text inherits it, and at the body's 16px "Rebase" overflows a 48px box and
+* renders as "Rebas". 12px plus `height: auto` — CSS the clients that block
+* images do read, while Outlook still sizes from the attributes — lets the name
+* through intact.
 */
-function refuse(c, error) {
-	return errorHandler(error, c);
+function renderHeader(appName, logoUrl) {
+	if (!logoUrl) return raw("");
+	return html`
+        <div style="text-align: center; margin-bottom: 24px;">
+            <img src="${logoUrl}" width="48" height="48" alt="${appName}"
+                 style="display: inline-block; width: 48px; height: auto; border: 0; outline: none; text-decoration: none; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif; font-size: 12px; color: #64748b;">
+        </div>
+`;
 }
 /**
-* Hono middleware that requires a valid JWT token via Authorization header.
-* Returns 401 if token is missing or invalid.
-*
-* **Security:** Tokens are only accepted via the `Authorization: Bearer`
-* header. Query-string tokens (`?token=`) are intentionally NOT accepted
-* here because URLs leak into access logs, proxies, Referer headers, and
-* browser history. Use {@link queryTokenAuth} on routes that legitimately
-* need query-string tokens (e.g. storage file serving for `<img src>`).
-*/
-var requireAuth = async (c, next) => {
-	if (c.get("user")) return next();
-	const token = extractBearerToken(c.req.header("authorization"));
-	if (token === void 0) return refuse(c, ApiError.unauthenticated("Authorization header missing or invalid"));
-	const payload = await verifyAccessToken(token);
-	if (!payload) return refuse(c, ApiError.unauthenticated("Invalid or expired token"));
-	c.set("user", payload);
-	return next();
-};
-/**
-* Factory that creates a requireAuth middleware with optional service key support.
-*
-* When `serviceKey` is provided, the middleware will check if the Bearer token
-* matches the service key using constant-time comparison. If it matches, the
-* request is authenticated as a service user with admin privileges.
-*
-* This allows admin routes (which use standalone requireAuth + requireAdmin)
-* to be accessed via service keys for scripts and server-to-server calls.
+* Default password reset email template
 */
-function createRequireAuth(options) {
-	if (!options?.serviceKey && !options?.resolveRoles && !options?.revocationRepo) return requireAuth;
-	const key = options.serviceKey;
-	const resolveRoles = options.resolveRoles;
-	const revocationRepo = options.revocationRepo;
-	return async (c, next) => {
-		if (c.get("user")) return next();
-		const token = extractBearerToken(c.req.header("authorization"));
-		if (token === void 0) return refuse(c, ApiError.unauthenticated("Authorization header missing or invalid"));
-		if (key !== void 0 && safeCompare(token, key)) {
-			c.set("user", {
-				uid: "service",
-				roles: ["admin"]
-			});
-			return next();
-		}
-		const payload = await verifyAccessToken(token);
-		if (!payload) return refuse(c, ApiError.unauthenticated("Invalid or expired token"));
-		if (resolveRoles || revocationRepo) try {
-			if (revocationRepo && await isAccessTokenRevoked(revocationRepo, payload)) return refuse(c, ApiError.unauthorized("Session has been revoked", "SESSION_REVOKED"));
-			c.set("user", resolveRoles ? {
-				...payload,
-				roles: await resolveRoles(payload.uid)
-			} : payload);
-			return next();
-		} catch (error) {
-			logger.warn("[Auth] Could not resolve roles for an admin-gated request", {
-				uid: payload.uid,
-				error
-			});
-			return c.json({ error: {
-				message: "Could not verify your permissions. Please try again.",
-				code: "ROLE_LOOKUP_FAILED"
-			} }, 503);
-		}
-		c.set("user", payload);
-		return next();
+function getPasswordResetTemplate(resetUrl, user, appName = DEFAULT_APP_NAME, logoUrl) {
+	const greeting = getGreeting(user);
+	const subject = `Reset your ${appName} password`;
+	const body = html`
+<!DOCTYPE html>
+<html>
+<head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>${subject}</title>
+</head>
+<body style="margin: 0; padding: 0; background-color: #f8fafc;">
+    <div style="${styles.container}">${renderHeader(appName, logoUrl)}
+        <div style="${styles.card}">
+            <h1 style="${styles.heading}">Reset Your Password</h1>
+            
+            <p style="${styles.paragraph}">
+                Hi ${greeting},
+            </p>
+            
+            <p style="${styles.paragraph}">
+                We received a request to reset your password for your ${appName} account. 
+                Click the button below to create a new password:
+            </p>
+            
+            <div style="text-align: center;">
+                <a href="${resetUrl}" style="${styles.button}">Reset Password</a>
+            </div>
+            
+            <p style="${styles.paragraph}">
+                Or copy and paste this link into your browser:
+            </p>
+            <p style="color: #3b82f6; word-break: break-all; font-size: 14px;">
+                ${resetUrl}
+            </p>
+            
+            <div style="${styles.warning}">
+                ⏰ This link will expire in 1 hour for security reasons.
+            </div>
+            
+            <div style="${styles.footer}">
+                <p style="margin: 0;">
+                    If you didn't request a password reset, you can safely ignore this email. 
+                    Your password will remain unchanged.
+                </p>
+            </div>
+        </div>
+    </div>
+</body>
+</html>
+    `;
+	const text = `
+Reset Your Password
+
+Hi ${greeting},
+
+We received a request to reset your password for your ${appName} account.
+
+Click this link to create a new password:
+${resetUrl}
+
+This link will expire in 1 hour for security reasons.
+
+If you didn't request a password reset, you can safely ignore this email.
+Your password will remain unchanged.
+    `.trim();
+	return {
+		subject,
+		html: body.toString().trim(),
+		text
 	};
 }
 /**
-* Middleware that requires the user to have an admin or schema-admin role.
-* Must be used AFTER requireAuth or on a route where user is guaranteed.
-*/
-var requireAdmin = async (c, next) => {
-	const user = c.get("user");
-	if (!user) return refuse(c, ApiError.unauthorized("User not authenticated. requireAuth middleware is missing?"));
-	if (!hasAdministrativeRole(typeof user === "object" && user !== null && "roles" in user ? user.roles || [] : [])) return refuse(c, ApiError.forbidden("Admin privileges required for this operation"));
-	return next();
-};
-/**
-* Middleware that optionally extracts user from JWT via Authorization header.
-* Does not return 401 if token is missing — allows anonymous access.
-*
-* Query-string tokens are NOT accepted here. Use {@link queryTokenAuth}
-* on routes that need them.
-*/
-var optionalAuth = async (c, next) => {
-	if (c.get("user")) return next();
-	const token = extractBearerToken(c.req.header("authorization"));
-	if (token !== void 0 && isJwtConfigured()) {
-		const payload = await verifyAccessToken(token);
-		if (payload) c.set("user", payload);
-	}
-	return next();
-};
-/**
-* Extract user from token - for WebSocket authentication
+* Default email verification template
 */
-async function extractUserFromToken(token) {
-	if (!isJwtConfigured()) return null;
-	return verifyAccessToken(token);
+function getEmailVerificationTemplate(verifyUrl, user, appName = DEFAULT_APP_NAME, logoUrl) {
+	const greeting = getGreeting(user);
+	const subject = `Verify your ${appName} email address`;
+	const body = html`
+<!DOCTYPE html>
+<html>
+<head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>${subject}</title>
+</head>
+<body style="margin: 0; padding: 0; background-color: #f8fafc;">
+    <div style="${styles.container}">${renderHeader(appName, logoUrl)}
+        <div style="${styles.card}">
+            <h1 style="${styles.heading}">Verify Your Email</h1>
+            
+            <p style="${styles.paragraph}">
+                Hi ${greeting},
+            </p>
+            
+            <p style="${styles.paragraph}">
+                Thanks for signing up for ${appName}! Please verify your email address 
+                by clicking the button below:
+            </p>
+            
+            <div style="text-align: center;">
+                <a href="${verifyUrl}" style="${styles.button}">Verify Email Address</a>
+            </div>
+            
+            <p style="${styles.paragraph}">
+                Or copy and paste this link into your browser:
+            </p>
+            <p style="color: #3b82f6; word-break: break-all; font-size: 14px;">
+                ${verifyUrl}
+            </p>
+            
+            <div style="${styles.footer}">
+                <p style="margin: 0;">
+                    If you didn't create an account with ${appName}, you can safely ignore this email.
+                </p>
+            </div>
+        </div>
+    </div>
+</body>
+</html>
+    `;
+	const text = `
+Verify Your Email
+
+Hi ${greeting},
+
+Thanks for signing up for ${appName}! Please verify your email address by clicking this link:
+${verifyUrl}
+
+If you didn't create an account with ${appName}, you can safely ignore this email.
+    `.trim();
+	return {
+		subject,
+		html: body.toString().trim(),
+		text
+	};
 }
 /**
-* Create a configurable auth middleware that handles:
-* 1. Token extraction (via custom validator or JWT Bearer token)
-* 2. RLS-scoped DataDriver via withAuth()
-* 3. Enforcement (401 when requireAuth is true and no user)
-*
-* **Secure by default:** `requireAuth` defaults to `true`. Anonymous
-* access is only allowed when the developer explicitly opts out by
-* setting `requireAuth: false`, indicating that Postgres RLS policies
-* fully control access.
-*
-* **Fail-closed:** The raw unscoped driver is never placed in the
-* request context. Every code path either scopes via `withAuth()` or
-* rejects the request. This prevents silent RLS bypass.
-*
-* This is the single source of truth for HTTP auth in Rebase.
-* Use this instead of manually parsing tokens in route handlers.
+* Default user invitation email template
+* Sent when an admin creates a new user account
 */
-function createAuthMiddleware(options) {
-	const { driver: baseDriver, resolveDriver, requireAuth: enforceAuth = true, validator, serviceKey, apiKeyStore } = options;
-	return async (c, next) => {
-		const driver = resolveDriver ? resolveDriver(c) : baseDriver;
-		if (validator) try {
-			const authResult = await validator(c);
-			if (authResult && typeof authResult === "object") {
-				const id = "uid" in authResult ? authResult.uid : void 0;
-				if (id) {
-					const roles = authResult.roles || [];
-					c.set("user", {
-						uid: id,
-						roles
-					});
-					const user = {
-						uid: id,
-						roles,
-						...authResult
-					};
-					c.set("driver", await scopeDataDriver(driver, user));
-				} else c.set("driver", await scopeDataDriver(driver, {
-					uid: ANONYMOUS_USER_ID,
-					roles: ["anon"]
-				}));
-			} else if (authResult === true) {
-				c.set("user", {
-					uid: "default",
-					roles: []
-				});
-				c.set("driver", await scopeDataDriver(driver, {
-					uid: "default",
-					roles: []
-				}));
-			} else c.set("driver", await scopeDataDriver(driver, {
-				uid: ANONYMOUS_USER_ID,
-				roles: ["anon"]
-			}));
-		} catch (error) {
-			return refuse(c, ApiError.unauthenticated("Unauthorized"));
-		}
-		else {
-			const token = extractBearerToken(c.req.header("authorization"));
-			if (token !== void 0) if (serviceKey && safeCompare(token, serviceKey)) {
-				c.set("user", {
-					uid: "service",
-					roles: ["admin"]
-				});
-				try {
-					c.set("driver", await scopeDataDriver(driver, {
-						uid: "service",
-						roles: ["admin"]
-					}));
-				} catch (error) {
-					logger.error("[AUTH] RLS scoping failed for service key", { error });
-					return c.json({ error: {
-						message: "Internal authentication error",
-						code: "INTERNAL_ERROR"
-					} }, 500);
-				}
-			} else if (apiKeyStore && isApiKeyToken(token)) {
-				const result = await validateApiKey(c, token, {
-					store: apiKeyStore,
-					driver
-				});
-				if (result !== true) return result;
-			} else {
-				const payload = await extractUserFromToken(token);
-				if (payload) {
-					c.set("user", payload);
-					try {
-						const user = {
-							uid: payload.uid,
-							roles: payload.roles,
-							isAnonymous: payload.isAnonymous === true,
-							claims: payload.claims
-						};
-						c.set("driver", await scopeDataDriver(driver, user));
-					} catch (error) {
-						logger.error("[AUTH] RLS scoping failed for authenticated user", { error });
-						return c.json({ error: {
-							message: "Internal authentication error",
-							code: "INTERNAL_ERROR"
-						} }, 500);
-					}
-				} else return refuse(c, ApiError.unauthenticated("Invalid or expired token"));
-			}
-			else try {
-				c.set("driver", await scopeDataDriver(driver, {
-					uid: ANONYMOUS_USER_ID,
-					roles: ["anon"]
-				}));
-			} catch (error) {
-				logger.error("[AUTH] Failed to create anon-scoped driver", { error });
-				return c.json({ error: {
-					message: "Server configuration error",
-					code: "INTERNAL_ERROR"
-				} }, 500);
-			}
-		}
-		if (enforceAuth && !c.get("user")) return refuse(c, ApiError.unauthenticated("Unauthorized: Authentication required. This is the API-level gate, not a row rule — a collection granting public reads still needs a caller. Set AUTH_REQUIRE=false (or `auth.requireAuth: false`) to let RLS alone decide."));
-		return next();
+function getUserInvitationTemplate(setPasswordUrl, user, appName = DEFAULT_APP_NAME, logoUrl) {
+	const greeting = getGreeting(user);
+	const subject = `You've been invited to ${appName}`;
+	const body = html`
+<!DOCTYPE html>
+<html>
+<head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>${subject}</title>
+</head>
+<body style="margin: 0; padding: 0; background-color: #f8fafc;">
+    <div style="${styles.container}">${renderHeader(appName, logoUrl)}
+        <div style="${styles.card}">
+            <h1 style="${styles.heading}">Welcome to ${appName}!</h1>
+            
+            <p style="${styles.paragraph}">
+                Hi ${greeting},
+            </p>
+            
+            <p style="${styles.paragraph}">
+                An account has been created for you on ${appName}. 
+                Click the button below to set your password and get started:
+            </p>
+            
+            <div style="text-align: center;">
+                <a href="${setPasswordUrl}" style="${styles.button}">Set Your Password</a>
+            </div>
+            
+            <p style="${styles.paragraph}">
+                Or copy and paste this link into your browser:
+            </p>
+            <p style="color: #3b82f6; word-break: break-all; font-size: 14px;">
+                ${setPasswordUrl}
+            </p>
+            
+            <div style="${styles.warning}">
+                ⏰ This link will expire in 1 hour for security reasons.
+            </div>
+            
+            <div style="${styles.footer}">
+                <p style="margin: 0;">
+                    If you weren't expecting this invitation, you can safely ignore this email.
+                </p>
+            </div>
+        </div>
+    </div>
+</body>
+</html>
+    `;
+	const text = `
+Welcome to ${appName}!
+
+Hi ${greeting},
+
+An account has been created for you on ${appName}.
+
+Click this link to set your password and get started:
+${setPasswordUrl}
+
+This link will expire in 1 hour for security reasons.
+
+If you weren't expecting this invitation, you can safely ignore this email.
+    `.trim();
+	return {
+		subject,
+		html: body.toString().trim(),
+		text
 	};
 }
 /**
-* Middleware that authenticates via a `?token=` query parameter.
-*
-* **Use sparingly.** Tokens in URLs leak into access logs, proxy logs,
-* Referer headers, and browser history. This middleware exists solely for
-* routes where the consumer cannot set HTTP headers — e.g. `<img src>`,
-* `<a href>` for file downloads, or similar browser-native requests.
-*
-* Apply it **before** `requireAuth` or `optionalAuth` on the specific
-* route that needs it. Those middlewares will see the user context this
-* middleware sets and skip their own 401 check.
-*
-* @example
-* ```ts
-* router.get("/file/*", queryTokenAuth, readAuthMiddleware, handler);
-* ```
+* Default welcome email template
+* Sent automatically when a new user registers
 */
-var queryTokenAuth = async (c, next) => {
-	if (extractBearerToken(c.req.header("authorization")) !== void 0) return next();
-	const queryToken = c.req.query("token");
-	if (queryToken && isJwtConfigured()) {
-		const payload = await verifyAccessToken(queryToken);
-		if (payload) c.set("user", payload);
-	}
-	return next();
-};
+function getWelcomeEmailTemplate(user, appName = DEFAULT_APP_NAME, loginUrl, logoUrl) {
+	const greeting = getGreeting(user);
+	const url = loginUrl || "";
+	const subject = `Welcome to ${appName}`;
+	const body = html`
+<!DOCTYPE html>
+<html>
+<head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>${subject}</title>
+</head>
+<body style="margin: 0; padding: 0; background-color: #f8fafc;">
+    <div style="${styles.container}">${renderHeader(appName, logoUrl)}
+        <div style="${styles.card}">
+            <h1 style="${styles.heading}">Welcome to ${appName}</h1>
+
+            <p style="${styles.paragraph}">
+                Hi ${greeting},
+            </p>
+
+            <p style="${styles.paragraph}">
+                Your ${appName} account is ready.
+            </p>
+
+            ${url ? html`
+            <div style="text-align: center;">
+                <a href="${url}" style="${styles.button}">Open ${appName}</a>
+            </div>
+            ` : raw("")}
+
+            <p style="${styles.paragraph}">
+                If you have any questions, just reply to this email.
+            </p>
+
+            <div style="${styles.footer}">
+                <p style="margin: 0;">
+                    You received this because an account was created with this email address at ${appName}.
+                </p>
+            </div>
+        </div>
+    </div>
+</body>
+</html>
+    `;
+	const text = `
+Welcome to ${appName}
+
+Hi ${greeting},
+
+Your ${appName} account is ready.
+
+${url ? `Open ${appName}: ${url}` : ""}
+
+If you have any questions, just reply to this email.
+    `.trim();
+	return {
+		subject,
+		html: body.toString().trim(),
+		text
+	};
+}
 /**
-* Authorizes anonymous access to **public** storage objects (those under the
-* public prefix), which are served token-less via stable, permanent URLs.
+* Default one-time sign-in code email.
 *
-* Runs on the storage `/file/*` and `/metadata/*` routes, *after* the token
-* middleware and *before* the read-auth gate. If the request is already
-* authenticated (Bearer or scoped token), it does nothing. Otherwise, when the
-* requested object path is public, it sets a minimal "public" principal so the
-* downstream `requireAuth` gate lets the read through. Private paths are left
-* untouched, so they still require a valid token.
+* The code is the entire content, so it is set large and repeated in the
+* plain-text part: somebody is about to copy it by eye onto another device,
+* which is the whole reason this flow exists rather than a link.
 */
-var publicObjectAuth = async (c, next) => {
-	if (c.get("user")) return next();
-	const prefix = c.req.routePath.replace("/*", "");
-	const fullPath = c.req.path;
-	const idx = fullPath.indexOf(prefix);
-	const rawPath = idx < 0 ? "" : fullPath.substring(idx + prefix.length + 1);
-	if (rawPath && isPublicStoragePath(decodeURIComponent(rawPath))) c.set("user", {
-		uid: "public",
-		roles: ["public"]
-	});
-	return next();
-};
+function getEmailOtpTemplate(code, user, appName = DEFAULT_APP_NAME, logoUrl) {
+	const greeting = getGreeting(user);
+	const subject = `${code} is your ${appName} sign-in code`;
+	const body = html`
+<!DOCTYPE html>
+<html>
+<head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>${subject}</title>
+</head>
+<body style="margin: 0; padding: 0; background-color: #f8fafc;">
+    <div style="${styles.container}">${renderHeader(appName, logoUrl)}
+        <div style="${styles.card}">
+            <h1 style="${styles.heading}">Your sign-in code</h1>
+
+            <p style="${styles.paragraph}">
+                Hi ${greeting},
+            </p>
+
+            <p style="${styles.paragraph}">
+                Enter this code to finish signing in to ${appName}:
+            </p>
+
+            <div style="text-align: center; margin: 32px 0;">
+                <span style="${styles.code}">${code}</span>
+            </div>
+
+            <div style="${styles.warning}">
+                ⏰ This code expires in 10 minutes and can only be used once.
+            </div>
+
+            <div style="${styles.footer}">
+                <p style="margin: 0;">
+                    If you didn't try to sign in, you can safely ignore this email.
+                    We will never ask you for this code.
+                </p>
+            </div>
+        </div>
+    </div>
+</body>
+</html>
+    `;
+	const text = `
+Your ${appName} sign-in code
+
+Hi ${greeting},
+
+Enter this code to finish signing in:
+
+    ${code}
+
+This code expires in 10 minutes and can only be used once.
+
+If you didn't try to sign in, you can safely ignore this email. We will never
+ask you for this code.
+    `.trim();
+	return {
+		subject,
+		html: body.toString().trim(),
+		text
+	};
+}
 /**
-* Helper to match paths for scoped file tokens.
-* Matches exact paths or prefixes (exact folder prefixes or ending with /).
-*
-* The traversal check is defence in depth, not the load-bearing defence.
+* Default magic link email template
+*/
+function getMagicLinkTemplate(magicLinkUrl, user, appName = DEFAULT_APP_NAME, logoUrl) {
+	const greeting = getGreeting(user);
+	const subject = `Sign in to ${appName}`;
+	const body = html`
+<!DOCTYPE html>
+<html>
+<head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>${subject}</title>
+</head>
+<body style="margin: 0; padding: 0; background-color: #f8fafc;">
+    <div style="${styles.container}">${renderHeader(appName, logoUrl)}
+        <div style="${styles.card}">
+            <h1 style="${styles.heading}">Sign In to ${appName}</h1>
+            
+            <p style="${styles.paragraph}">
+                Hi ${greeting},
+            </p>
+            
+            <p style="${styles.paragraph}">
+                We received a request to sign in to your ${appName} account. 
+                Click the button below to log in:
+            </p>
+            
+            <div style="text-align: center;">
+                <a href="${magicLinkUrl}" style="${styles.button}">Sign In</a>
+            </div>
+            
+            <p style="${styles.paragraph}">
+                Or copy and paste this link into your browser:
+            </p>
+            <p style="color: #3b82f6; word-break: break-all; font-size: 14px;">
+                ${magicLinkUrl}
+            </p>
+            
+            <div style="${styles.warning}">
+                ⏰ This link will expire in 15 minutes for security reasons and can only be used once.
+            </div>
+            
+            <div style="${styles.footer}">
+                <p style="margin: 0;">
+                    If you didn't request this sign-in link, you can safely ignore this email. 
+                    No action is needed.
+                </p>
+            </div>
+        </div>
+    </div>
+</body>
+</html>
+    `;
+	const text = `
+Sign In to ${appName}
+
+Hi ${greeting},
+
+We received a request to sign in to your ${appName} account.
+
+Click this link to log in:
+${magicLinkUrl}
+
+This link will expire in 15 minutes for security reasons and can only be used once.
+
+If you didn't request this sign-in link, you can safely ignore this email.
+No action is needed.
+    `.trim();
+	return {
+		subject,
+		html: body.toString().trim(),
+		text
+	};
+}
+//#endregion
+//#region src/auth/admin-user-ops.ts
+/**
+* Admin User Operations
 *
-* A prefix comparison is a lie for any path containing `..`: `user1/../user2/x`
-* starts with `user1/`, so a token scoped to `user1/` would authorize reading
-* user2's file — and the storage controller would not object, because its own
-* guard stops a path escaping the *bucket*, and that one resolves to `user2/x`,
-* comfortably inside it. The grant is what would be escaped, and this is the
-* only layer that knows what was granted.
+* Shared utilities and orchestration for admin-initiated user management
+* (user creation via REST API, password reset via admin panel).
 *
-* Nothing arrives here in that shape today: the URL parser resolves `..` (and
-* `%2e%2e`, which the WHATWG spec treats as a dot for normalization) before
-* Hono routes the request, so this comparison already runs on a resolved path.
-* But that is a guarantee of the runtime rather than of this code, and it is
-* one line to not depend on it. The same rule already guards the public-object
-* path — see `isPublicStoragePath`.
+* Hook resolution order:
+* 1. Collection-level hook (`auth.onCreateUser` on the collection) — closest to the data
+* 2. Backend-level hook (`AuthHooks.onAdminCreateUser`) — global override
+* 3. Built-in default — framework fallback
+*/
+/**
+* Generate a cryptographically secure random password that meets strength requirements.
+*
+* 16 characters, guaranteed at least one uppercase, one lowercase, one digit.
+* Ambiguous characters (0, O, 1, l, I) are excluded.
 */
-function isPathMatch(requested, allowed) {
-	if (requested.split("/").some((seg) => seg === "..")) return false;
-	if (requested === allowed) return true;
-	if (allowed.endsWith("/")) return requested.startsWith(allowed);
-	return requested.startsWith(allowed + "/");
+function generateSecurePassword() {
+	const upper = "ABCDEFGHJKLMNPQRSTUVWXYZ";
+	const lower = "abcdefghjkmnpqrstuvwxyz";
+	const digits = "23456789";
+	const all = "ABCDEFGHJKLMNPQRSTUVWXYZabcdefghjkmnpqrstuvwxyz23456789";
+	const pick = (chars) => chars[randomInt(chars.length)];
+	const parts = [
+		pick(upper),
+		pick(lower),
+		pick(digits)
+	];
+	for (let i = parts.length; i < 16; i++) parts.push(pick(all));
+	for (let i = parts.length - 1; i > 0; i--) {
+		const j = randomInt(i + 1);
+		[parts[i], parts[j]] = [parts[j], parts[i]];
+	}
+	return parts.join("");
 }
 /**
-* Middleware that authenticates file-serving routes using scoped download tokens.
-* It enforces that only scoped "file-read" tokens can access "/file/*" and "?token=" query params.
-* Full access JWTs are explicitly rejected on "/file/*" routes, and in the "?token=" query param.
+* Generate a cryptographically secure random token (80 hex characters).
 */
-var fileTokenAuth = async (c, next) => {
-	const isFileRoute = c.req.path.includes("/storage/file/");
-	const authHeader = c.req.header("authorization");
-	const queryToken = c.req.query("token");
-	const extractWildcard = (ctx) => {
-		const prefix = ctx.req.routePath.replace("/*", "");
-		const fullPath = ctx.req.path;
-		const idx = fullPath.indexOf(prefix);
-		if (idx < 0) return "";
-		return fullPath.substring(idx + prefix.length + 1);
-	};
-	/**
-	* Must agree with `parseBucketAndPath` in `storage/routes.ts`, because the
-	* path a token GRANTS is minted there and the path a request ASKS FOR is
-	* derived here. `/metadata` canonicalizes before signing, so a raw
-	* comparison here would 403 an otherwise-valid request for any key whose
-	* URL form is not already canonical (`a//b.txt`, `a/./b.txt`).
-	*
-	* A key that cannot be canonicalized yields null, which matches no grant —
-	* the same fail-closed answer `isPathMatch` gives a `..` segment.
-	*/
-	const parseBucketPath = (filePath) => {
-		const parts = filePath.split("/");
-		if (parts.length > 1 && parts[0].toLowerCase() === "default") return {
-			bucket: "default",
-			resolvedPath: tryCanonicalStorageKey(parts.slice(1).join("/"))
-		};
-		return {
-			bucket: "default",
-			resolvedPath: tryCanonicalStorageKey(filePath)
-		};
-	};
-	/**
-	* Decide what a valid download token entitles this request to.
-	*
-	* One function rather than a copy per token location: a Bearer token and a
-	* `?token=` are the same grant presented two ways, and the whole failure
-	* this guards against is two places disagreeing about what was granted.
-	*
-	* `"no-path"` is distinct from the two denials because the caller treats it
-	* differently — a request with no object path at all is not a denied read,
-	* it is a request this middleware has nothing to say about, and on
-	* `/metadata/*` it must still reach the downstream auth gate.
-	*/
-	const evaluateGrant = (payload) => {
-		if (canonicalStorageId(c.req.query("storageId")) !== payload.storageId) return "deny-storage";
-		const rawPath = extractWildcard(c);
-		if (!rawPath) return "no-path";
-		const { bucket, resolvedPath } = parseBucketPath(decodeURIComponent(rawPath));
-		if (resolvedPath === null) return "deny-path";
-		return isPathMatch(`${bucket}/${resolvedPath}`, payload.path) ? "grant" : "deny-path";
-	};
-	/**
-	* Which half of the scope failed is named in the message. The holder of the
-	* token already knows both values, so this reveals nothing to an attacker —
-	* and without it, a client that forgets to forward `?storageId=` on the file
-	* URL reports a "path mismatch" for a path that matches perfectly.
-	*/
-	const denyMismatch = (outcome) => refuse(c, ApiError.forbidden(outcome === "deny-storage" ? "Forbidden: Scoped token storage mismatch" : "Forbidden: Scoped token path mismatch"));
-	const bearerToken = extractBearerToken(authHeader);
-	if (bearerToken !== void 0) {
-		const payload = await verifyDownloadToken(bearerToken);
-		if (payload) {
-			const outcome = evaluateGrant(payload);
-			if (outcome === "grant") {
-				c.set("user", {
-					uid: "download-token",
-					roles: ["reader"]
-				});
-				return next();
-			}
-			if (outcome !== "no-path") return denyMismatch(outcome);
-		}
-		if (isFileRoute) return refuse(c, ApiError.unauthenticated("Unauthorized: Access JWT not allowed on file routes"));
-		return next();
-	}
-	if (queryToken) {
-		const payload = await verifyDownloadToken(queryToken);
-		if (payload) {
-			const outcome = evaluateGrant(payload);
-			if (outcome === "grant") {
-				c.set("user", {
-					uid: "download-token",
-					roles: ["reader"]
-				});
-				return next();
-			}
-			if (outcome !== "no-path") return denyMismatch(outcome);
-		}
-		return refuse(c, ApiError.unauthenticated("Unauthorized: Invalid or unauthorized token"));
-	}
-	return next();
-};
-//#endregion
-//#region src/auth/adapter-middleware.ts
+function generateSecureToken() {
+	return randomBytes(40).toString("hex");
+}
 /**
-* Create a Hono middleware that uses an `AuthAdapter` for request verification.
+* Hash a token for database storage using SHA-256.
 */
-function createAdapterAuthMiddleware(options) {
-	const { adapter, driver: baseDriver, resolveDriver, requireAuth: enforceAuth = true, apiKeyStore } = options;
-	return async (c, next) => {
-		const driver = resolveDriver ? resolveDriver(c) : baseDriver;
-		const presentedToken = extractBearerToken(c.req.header("authorization"));
-		if (apiKeyStore) {
-			const token = presentedToken ?? "";
-			if (token.startsWith("rk_")) {
-				const result = await validateApiKey(c, token, {
-					store: apiKeyStore,
-					driver
-				});
-				if (result === true) return next();
-				return result;
-			}
-		}
-		let authenticatedUser = null;
-		try {
-			authenticatedUser = await adapter.verifyRequest(c.req.raw);
-		} catch (error) {
-			return refuse(c, ApiError.unauthenticated("Unauthorized"));
-		}
-		if (authenticatedUser) {
-			c.set("user", {
-				uid: authenticatedUser.uid,
-				email: authenticatedUser.email,
-				roles: authenticatedUser.roles,
-				isAnonymous: authenticatedUser.isAnonymous === true
-			});
-			try {
-				c.set("driver", await scopeDataDriver(driver, {
-					uid: authenticatedUser.uid,
-					roles: authenticatedUser.roles,
-					isAnonymous: authenticatedUser.isAnonymous === true
-				}));
-			} catch (error) {
-				logger.error("[AUTH-ADAPTER] RLS scoping failed for authenticated user", { error });
-				return refuse(c, ApiError.internal("Internal authentication error"));
-			}
-		} else {
-			if (presentedToken !== void 0) return refuse(c, ApiError.unauthenticated("Invalid or expired token"));
-			try {
-				c.set("driver", await scopeDataDriver(driver, {
-					uid: ANONYMOUS_USER_ID,
-					roles: ["anon"]
-				}));
-			} catch (error) {
-				logger.error("[AUTH-ADAPTER] Failed to create anon-scoped driver", { error });
-				return refuse(c, ApiError.internal("Server configuration error"));
-			}
-		}
-		if (enforceAuth && !c.get("user")) return refuse(c, ApiError.unauthenticated("Unauthorized: Authentication required. This is the API-level gate, not a row rule — a collection granting public reads still needs a caller. Set AUTH_REQUIRE=false (or `auth.requireAuth: false`) to let RLS alone decide."));
-		return next();
-	};
+function hashToken$1(token) {
+	return createHash("sha256").update(token).digest("hex");
 }
-//#endregion
-//#region src/email/html.ts
 /**
-* HTML escaping for email bodies.
-*
-* Every default template interpolates values the server does not control — a
-* `displayName` chosen at registration, an `appName` from config, a link base a
-* host set — into markup that is then mailed, signed by the sending domain, to
-* an address the same request chose. Unescaped, that turns `POST /auth/register`
-* into a way to deliver arbitrary HTML (a heading, an anchor) from a domain
-* whose SPF and DKIM check out.
+* Build the `AuthCollectionContext` facade from server internals.
 *
-* The fix is deliberately not five escaping calls at five interpolation sites:
-* a sixth template would simply forget. Templates are built with the {@link html}
-* tag, which escapes *every* interpolated value by default, and markup that is
-* meant to pass through verbatim — the static style strings, a nested fragment —
-* must say so with {@link raw}. Forgetting `raw` produces visibly escaped text
-* in a test; forgetting to escape is invisible until someone exploits it.
+* This is the simplified context exposed to collection-level auth hooks,
+* keeping them decoupled from internal interfaces like `AuthRepository`.
 */
+function buildCollectionContext(ctx) {
+	const isEmailConfigured = !!(ctx.emailService && ctx.emailService.isConfigured());
+	return {
+		hashPassword: (password) => ctx.resolvedHooks.hashPassword(password),
+		sendEmail: isEmailConfigured ? (options) => ctx.emailService.send(options) : void 0,
+		emailConfigured: isEmailConfigured,
+		appName: ctx.emailConfig?.appName || "Rebase",
+		resetPasswordUrl: ctx.emailConfig?.resetPasswordUrl || ""
+	};
+}
 /**
-* Markup that has already been vetted and must be interpolated verbatim.
+* Prepare user values for an admin-initiated user creation.
 *
-* Only ever construct this from a string literal in this package's own source
-* (or from the {@link html} tag, which produces one). Wrapping user input in
-* `raw()` defeats the entire mechanism.
+* Resolution order:
+* 1. Collection-level `auth.onCreateUser` — closest to the data
+* 2. Backend-level `AuthHooks.onAdminCreateUser` — global override
+* 3. Built-in default — generate password → hash → normalize email
+*
+* The caller is responsible for persisting (via `driver.save()`).
 */
-var RawHtml = class {
-	value;
-	constructor(value) {
-		this.value = value;
+async function prepareAdminUserValues(body, ctx) {
+	const { resolvedHooks, collectionAuthConfig } = ctx;
+	if (collectionAuthConfig?.onCreateUser) {
+		const collectionCtx = buildCollectionContext(ctx);
+		const hookResult = await collectionAuthConfig.onCreateUser(body, collectionCtx);
+		return {
+			values: hookResult.values,
+			clearPassword: hookResult.temporaryPassword,
+			hookHandledEmail: true,
+			invitationSent: hookResult.invitationSent ?? false
+		};
 	}
-	toString() {
-		return this.value;
+	if (resolvedHooks.onAdminCreateUser) {
+		const hookResult = await resolvedHooks.onAdminCreateUser(body, {
+			authRepo: ctx.authRepo,
+			emailService: ctx.emailService,
+			emailConfig: ctx.emailConfig,
+			hashPassword: (password) => resolvedHooks.hashPassword(password)
+		});
+		return {
+			values: hookResult.values,
+			clearPassword: hookResult.temporaryPassword,
+			hookHandledEmail: true,
+			invitationSent: hookResult.invitationSent ?? false
+		};
 	}
-};
-/**
-* Mark a static, author-controlled string as safe to interpolate unescaped.
-*/
-function raw(markup) {
-	return new RawHtml(markup);
+	const password = body.password;
+	const clearPassword = password || generateSecurePassword();
+	const passwordHash = await resolvedHooks.hashPassword(clearPassword);
+	const values = { ...body };
+	values.passwordHash = passwordHash;
+	if (values.email) values.email = normalizeEmail(values.email);
+	values.emailVerified = true;
+	delete values.password;
+	return {
+		values,
+		clearPassword: password ? void 0 : clearPassword,
+		hookHandledEmail: false,
+		invitationSent: false
+	};
 }
 /**
-* Escape the five characters that can change the meaning of HTML text or of a
-* quoted attribute value.
+* Handle post-creation work for admin-created users.
 *
-* `&` goes first: escaping it after the others would double-escape the entities
-* they just produced. `'` is included because it is a legal attribute delimiter,
-* and `"` because it is the one this file uses.
+* Sends an invitation email (password-reset link) if email is configured
+* and no explicit password was provided. Falls back to returning the
+* temporary password if email fails or is not configured.
 */
-function escapeHtml(value) {
-	return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+async function finalizeAdminUserCreation(entity, clearPassword, ctx) {
+	if (!clearPassword) return { invitationSent: false };
+	if (!!(ctx.emailService && ctx.emailService.isConfigured())) try {
+		const token = generateSecureToken();
+		const tokenHash = hashToken$1(token);
+		const expiresAt = new Date(Date.now() + 1440 * 60 * 1e3);
+		await ctx.authRepo.createPasswordResetToken(entity.id, tokenHash, expiresAt);
+		const setPasswordUrl = `${ctx.emailConfig?.resetPasswordUrl || ""}/reset-password?token=${token}`;
+		const { appName, logoUrl } = resolveEmailBranding(ctx.emailConfig);
+		const templateFn = ctx.emailConfig?.templates?.userInvitation;
+		const emailContent = templateFn ? templateFn(setPasswordUrl, {
+			email: entity.values.email,
+			displayName: entity.values.displayName
+		}) : getUserInvitationTemplate(setPasswordUrl, {
+			email: entity.values.email,
+			displayName: entity.values.displayName
+		}, appName, logoUrl);
+		await ctx.emailService.send({
+			to: entity.values.email,
+			subject: emailContent.subject,
+			html: emailContent.html,
+			text: emailContent.text
+		});
+		return { invitationSent: true };
+	} catch (emailError) {
+		logger.error("Failed to send reset email", { error: emailError instanceof Error ? emailError.message : emailError });
+		return {
+			temporaryPassword: clearPassword,
+			invitationSent: false,
+			emailDeliveryFailed: true
+		};
+	}
+	return {
+		temporaryPassword: clearPassword,
+		invitationSent: false
+	};
 }
 /**
-* Render one interpolated value: pass {@link RawHtml} through, drop nullish,
-* escape everything else.
+* The step after a new user's row is written: who delivers the credentials,
+* and what the create response says about it.
+*
+* A create hook that ran owns delivery. What it reported is the answer: the
+* invitation it says it sent, and the temporary password it chose, which the
+* admin has to see because it is the one the user will be told. The framework
+* sends nothing of its own. Without a hook, `finalize` runs: the built-in
+* invitation, or the generated password when email is not configured or fails.
+*
+* Both doors that create a user call this, the auth collection's REST route
+* and `POST /admin/users`. The second used to call `finalizeAdminUserCreation`
+* directly and read neither `hookHandledEmail` nor `invitationSent`, so it
+* handled a hook's password as if the framework had generated it. With email
+* configured it sent its own invitation, a second one when the hook had sent
+* its own, and left the password out of the response. The decision lives here
+* so that the two doors cannot disagree about it again.
+*
+* The result has exactly the fields a create response carries, with absent
+* ones left out.
 */
-function interpolate(value) {
-	if (value instanceof RawHtml) return value.value;
-	if (value === null || value === void 0) return "";
-	return escapeHtml(String(value));
+async function completeUserCreation(prepared, finalize) {
+	const result = prepared.hookHandledEmail ? {
+		temporaryPassword: prepared.clearPassword,
+		invitationSent: prepared.invitationSent
+	} : finalize ? await finalize(prepared.clearPassword) : { invitationSent: false };
+	return {
+		invitationSent: result.invitationSent,
+		...result.temporaryPassword ? { temporaryPassword: result.temporaryPassword } : {},
+		...result.emailDeliveryFailed ? { emailDeliveryFailed: true } : {}
+	};
 }
+//#endregion
+//#region src/auth/token-revocation.ts
 /**
-* Tagged template for email markup. Every `${...}` is escaped unless it is
-* {@link RawHtml}.
+* Has this access token been revoked?
 *
-* Returns `RawHtml` so fragments nest without being escaped a second time:
+* `logout`, `change-password`, `reset-password` and `DELETE /auth/sessions` all
+* stamp a `tokensValidAfter` watermark on the user. Every one of them also
+* deletes refresh-token rows, which is what made the gap easy to miss: the
+* session really is gone, and the *refresh* path really does check the
+* watermark — so signing out looked like it worked.
 *
-* ```ts
-* const button = url ? html`<a href="${url}">Open</a>` : raw("");
-* const body = html`<div>${button}</div>`;
-* ```
+* The access token was untouched. It is a bearer credential that nothing
+* consulted a database about, so it stayed valid for its full lifetime after
+* every one of those actions. "Sign out everywhere" left the stolen token
+* working; so did changing your password because you thought it had leaked.
+*
+* The watermark had exactly one read in the repository, on refresh. This adds
+* the other one.
+*
+* ## Cost
+*
+* One indexed lookup per request, on the paths that already make one. The
+* adapter re-reads roles for every authenticated request; the admin routes now
+* do too. Both call this with the row they were already fetching in mind — a
+* repository that wants to serve both from one query is free to cache
+* internally, but nothing here assumes it.
+*
+* ## Failure
+*
+* Fails **open**, deliberately, and this is the one place in the auth stack
+* where that is right. The watermark is an extra revocation signal layered over
+* a token that has already been verified — signature, expiry and purpose all
+* checked. Refusing every request when the database is unreachable would turn a
+* transient outage into a total sign-out of an entire deployment, and the
+* attacker this protects against needs to have already stolen a live token. The
+* failure is logged at warn so it is visible rather than silent.
 */
-function html(strings, ...values) {
-	let out = strings[0];
-	for (let i = 0; i < values.length; i++) out += interpolate(values[i]) + strings[i + 1];
-	return new RawHtml(out);
+async function isAccessTokenRevoked(authRepo, payload) {
+	if (typeof authRepo.getTokensValidAfter !== "function") return false;
+	if (typeof payload.iat !== "number") return false;
+	let validAfter;
+	try {
+		validAfter = await authRepo.getTokensValidAfter(payload.uid);
+	} catch (error) {
+		logger.warn("[Auth] Could not read the token revocation watermark; allowing the request", {
+			uid: payload.uid,
+			error
+		});
+		return false;
+	}
+	if (!validAfter) return false;
+	return payload.iat < Math.floor(validAfter.getTime() / 1e3);
 }
 //#endregion
-//#region src/email/templates.ts
+//#region src/auth/rls-scope.ts
+var import_jsonwebtoken = /* @__PURE__ */ __toESM(require_jsonwebtoken(), 1);
 /**
-* Default email templates for authentication emails.
+* The identity the trusted server plane runs as: `rebase.dataAsAdmin`, and any
+* caller presenting the service key.
 *
-* Every HTML body is built with the `html` tag from `./html`, which escapes each
-* interpolated value unless it is explicitly marked `raw`. `displayName` reaches
-* these templates straight from the registration body, and the resulting mail is
-* sent — signed by the sending domain — to an address the same anonymous request
-* chose, so an unescaped interpolation here is a phishing primitive, not a
-* rendering glitch. Escaping lives in the tag rather than at the call sites so a
-* sixth template inherits it instead of having to remember it.
+* Naming it makes the privilege legible, because it is narrower than it reads.
+* This is **not** an RLS bypass — a driver scoped with it is an
+* `AuthenticatedPostgresBackendDriver`, so every statement runs in a
+* transaction that has done `SET LOCAL ROLE rebase_user` with
+* `app.uid = 'service'`, and policies are evaluated. Two consequences worth
+* knowing before you write a policy:
+*
+* - It passes the default policies through their `rolesOverlap(['admin'])`
+*   arm — the same arm an application user holding the `admin` role passes.
+* - `policy.serverContext()` compiles to `rebase.uid() IS NULL` and is therefore
+*   **false** for it. A collection with `disableDefaultPolicies: true` whose
+*   only rule is `serverContext()` denies these writes (42501) and returns
+*   zero rows for these reads.
+*
+* The true bypass is `rebase.sql()`, which runs on the owner connection and
+* never goes near `withAuth`.
 */
+var SERVICE_IDENTITY = {
+	uid: "service",
+	roles: ["admin"]
+};
 /**
-* Get a greeting name for the user.
-*
-* Returns the raw value — `displayName` is whatever the account was registered
-* with, including markup. Escaping is the `html` tag's job, so that a template
-* that interpolates the greeting into text (the plain-text bodies below) and one
-* that interpolates it into markup can share this.
+* Returns true if the driver supports RLS scoping via `withAuth()`.
 */
-function getGreeting(user) {
-	return user.displayName || user.email.split("@")[0];
+function isRLSScopedDriver(driver) {
+	return "withAuth" in driver && typeof driver.withAuth === "function";
 }
 /**
-* Common email styles.
+* Can this driver run a request as a specific user?
 *
-* `raw` because these are static, author-written CSS — the one category of
-* interpolation the `html` tag lets through unescaped. (Escaping them would
-* survive an HTML parser but not every mail client's CSS parser: the
-* `'Segoe UI'` quotes would arrive as entities.)
-*/
-var styles = {
-	container: raw(`
-        font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif;
-        max-width: 600px;
-        margin: 0 auto;
-        padding: 40px 20px;
-        background-color: #f8fafc;
-    `),
-	card: raw(`
-        background-color: #ffffff;
-        border-radius: 12px;
-        padding: 40px;
-        box-shadow: 0 4px 6px -1px rgba(0, 0, 0, 0.1);
-    `),
-	heading: raw(`
-        color: #1e293b;
-        font-size: 24px;
-        font-weight: 600;
-        margin: 0 0 20px 0;
-    `),
-	paragraph: raw(`
-        color: #475569;
-        font-size: 16px;
-        line-height: 1.6;
-        margin: 0 0 20px 0;
-    `),
-	button: raw(`
-        display: inline-block;
-        background-color: #3b82f6;
-        color: #ffffff;
-        font-size: 16px;
-        font-weight: 600;
-        text-decoration: none;
-        padding: 14px 28px;
-        border-radius: 8px;
-        margin: 20px 0;
-    `),
-	footer: raw(`
-        color: #94a3b8;
-        font-size: 14px;
-        margin-top: 30px;
-        padding-top: 20px;
-        border-top: 1px solid #e2e8f0;
-    `),
-	warning: raw(`
-        color: #64748b;
-        font-size: 14px;
-        background-color: #fef3c7;
-        padding: 12px 16px;
-        border-radius: 6px;
-        margin-top: 20px;
-    `),
-	/**
-	* The one-time code itself. Monospace so the digits line up, spaced so a
-	* `1` and a `7` are not read as one glyph, and large enough to be copied by
-	* eye from a phone onto another device — which is the entire flow.
-	*/
-	code: raw(`
-        display: inline-block;
-        font-family: 'SFMono-Regular', Consolas, 'Liberation Mono', Menlo, monospace;
-        font-size: 34px;
-        font-weight: 700;
-        letter-spacing: 10px;
-        color: #1e293b;
-        background-color: #f1f5f9;
-        border-radius: 10px;
-        padding: 18px 20px 18px 30px;
-    `)
-};
+* The same question `scopeDataDriver` asks internally, exported because one
+* caller must act on the answer BEFORE it has a request to scope.
+*
+* `scopeDataDriver` returns the driver unscoped when the answer is no, which is
+* the right behaviour for `/api/data` — Mongo has no row-level security and
+* never claimed to, and the route's own checks still apply. It is the wrong
+* behaviour for a surface whose entire promise is "this runs as you": there,
+* an unscoped driver silently means "runs as the database owner". So the MCP
+* surface asks this at boot and declines to mount rather than degrade.
+*/
+function supportsRlsScoping(driver) {
+	return isRLSScopedDriver(driver);
+}
 /**
-* The app name every template falls back to when `email.appName` is unset.
+* Scope a DataDriver via `withAuth()` for RLS.
+*
+* SECURITY: If `withAuth()` is available but fails, the error is re-thrown
+* so the request is **denied** rather than proceeding with unscoped access
+* (fail-closed behavior).
+*
+* If the driver does not support RLS, the original driver is returned.
+*
+* @param driver - The DataDriver to scope.
+* @param user   - The authenticated user identity for RLS.
+* @returns The RLS-scoped DataDriver (or the original if RLS is unsupported).
 */
-var DEFAULT_APP_NAME = "Rebase";
+async function scopeDataDriver(driver, user) {
+	if (isRLSScopedDriver(driver)) return await driver.withAuth(user);
+	return driver;
+}
+//#endregion
+//#region src/auth/crypto-utils.ts
 /**
-* The Rebase mark, hosted. Mail clients do not render SVG (Gmail strips it
-* outright), so this is the PNG rather than `logo.svg`, and it is an absolute
-* URL rather than a data URI because Gmail blocks those in `<img src>` too.
+* Cryptographic utility functions for auth.
+*
+* @module
 */
-var REBASE_LOGO_URL = "https://rebase.pro/img/logo_small.png";
 /**
-* Whether a configured logo can actually be fetched by a mail client.
+* Constant-time string comparison to prevent timing attacks.
 *
-* A relative path, a `data:` URI or a `file:` URL all produce a broken image in
-* the recipient's inbox rather than an error anyone would see, so an unusable
-* value renders no logo at all instead. This is deliberately not a boot-time
-* assert like `assertEmailLinkBases`: a dead link makes the mail useless, a
-* missing logo only makes it plain.
+* Used for comparing service keys, tokens, and other secrets where
+* timing side-channels could leak information about the expected value.
+*
+* The implementation lives in `utils/portable-crypto.ts`, which does this over
+* UTF-8 bytes without `node:crypto` — this function is on the request path, and
+* the byte-level reasoning it depends on is documented there.
+*
+* @param a - First string to compare.
+* @param b - Second string to compare.
+* @returns `true` if the strings are identical, `false` otherwise.
 */
-function isMailableImageUrl(url) {
-	if (!url) return false;
-	try {
-		const { protocol } = new URL(url);
-		return protocol === "https:" || protocol === "http:";
-	} catch {
-		return false;
-	}
+function safeCompare(a, b) {
+	return constantTimeEqual(a, b);
 }
+//#endregion
+//#region src/auth/bearer-token.ts
 /**
-* Whether this config still carries the stock app name — i.e. nobody has
-* branded this install.
+* Parsing of the `Authorization: Bearer <token>` header.
 *
-* Testing against the *value* rather than against `undefined` is deliberate and
-* load-bearing: `APP_NAME` is declared `z.string().default("Rebase")` in the
-* cloud, in the demo app and in the eject template, so `appName` arrives here as
-* the literal string "Rebase" even when the operator set nothing. Keying the
-* fallback on `appName === undefined` would mean the logo never appeared in any
-* Rebase-run product.
+* Its own module rather than a helper inside `middleware.ts`, because the
+* API-key middleware needs it too and `middleware.ts` already imports from
+* there — putting it in either one would close an import cycle.
+*
+* @module
 */
-function isUnbranded(appName) {
-	return !appName || appName === DEFAULT_APP_NAME;
-}
 /**
-* Resolve the branding a template should render from the email config.
+* Pull the token out of an `Authorization: Bearer <token>` header.
 *
-* The fallback is asymmetric on purpose. `appName` falls back to "Rebase"
-* because an unconfigured app has no better name to show. The *logo* is stricter:
-* an app that named itself "Acme" but set no `logoUrl` gets no logo at all,
-* because the alternative is mailing Acme's users a Rebase mark from Acme's
-* domain. Only an install that has not renamed itself is treated as Rebase's own.
+* RFC 7235 §2.1 makes the auth-scheme name case-insensitive, and plenty of
+* clients send `bearer` — HTTP libraries that lower-case what they emit,
+* hand-written curl, proxies that normalise headers. Matching `"Bearer "`
+* exactly turned those into a 401 that, from the caller's side, is
+* indistinguishable from a rejected token; people spend an afternoon
+* regenerating credentials that were fine. Only the scheme is folded — the
+* token itself is returned byte-for-byte.
+*
+* Returns `undefined` when there is no header or it names another scheme.
+* That is deliberately distinct from an empty token (`Bearer ` with nothing
+* after it), which callers still route into verification so it fails as a bad
+* token rather than as a missing header.
 */
-function resolveEmailBranding(config) {
-	const logoUrl = config?.logoUrl ?? (isUnbranded(config?.appName) ? REBASE_LOGO_URL : void 0);
-	return {
-		appName: config?.appName || DEFAULT_APP_NAME,
-		logoUrl: isMailableImageUrl(logoUrl) ? logoUrl : void 0
-	};
+function extractBearerToken(authHeader) {
+	if (!authHeader) return void 0;
+	const separator = authHeader.indexOf(" ");
+	if (separator < 0) return void 0;
+	if (authHeader.slice(0, separator).toLowerCase() !== "bearer") return void 0;
+	return authHeader.slice(separator + 1);
 }
+//#endregion
+//#region src/auth/api-keys/api-key-middleware.ts
 /**
-* The logo block that sits above the card in every default template.
-*
-* `width`/`height` are attributes as well as CSS because Outlook's Word renderer
-* ignores the style block. `alt` carries the app name, for screen readers and
-* for the very common case of a client that blocks remote images on a first
-* email from an unknown sender.
+* Check whether a token looks like a Rebase API key.
+*/
+function isApiKeyToken(token) {
+	return token.startsWith("rk_");
+}
+/**
+* Hash a plaintext API key token for database lookup.
 *
-* The type styling on the `<img>` is what that blocked case falls back to: alt
-* text inherits it, and at the body's 16px "Rebase" overflows a 48px box and
-* renders as "Rebas". 12px plus `height: auto` — CSS the clients that block
-* images do read, while Outlook still sizes from the attributes — lets the name
-* through intact.
+* Async because it hashes with WebCrypto rather than `node:crypto` — the sole
+* caller was already awaiting the store lookup this feeds.
 */
-function renderHeader(appName, logoUrl) {
-	if (!logoUrl) return raw("");
-	return html`
-        <div style="text-align: center; margin-bottom: 24px;">
-            <img src="${logoUrl}" width="48" height="48" alt="${appName}"
-                 style="display: inline-block; width: 48px; height: auto; border: 0; outline: none; text-decoration: none; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif; font-size: 12px; color: #64748b;">
-        </div>
-`;
+function hashToken(token) {
+	return sha256Hex(token);
 }
 /**
-* Default password reset email template
+* Validate an API key token and populate the Hono context.
+*
+* Returns `true` if the key is valid and context has been populated,
+* or returns an error Response if the key is invalid.
+*
+* This is NOT a standalone middleware — it's called from within
+* `createAuthMiddleware()` when a `rk_` prefixed token is detected.
 */
-function getPasswordResetTemplate(resetUrl, user, appName = DEFAULT_APP_NAME, logoUrl) {
-	const greeting = getGreeting(user);
-	const subject = `Reset your ${appName} password`;
-	const body = html`
-<!DOCTYPE html>
-<html>
-<head>
-    <meta charset="utf-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>${subject}</title>
-</head>
-<body style="margin: 0; padding: 0; background-color: #f8fafc;">
-    <div style="${styles.container}">${renderHeader(appName, logoUrl)}
-        <div style="${styles.card}">
-            <h1 style="${styles.heading}">Reset Your Password</h1>
-            
-            <p style="${styles.paragraph}">
-                Hi ${greeting},
-            </p>
-            
-            <p style="${styles.paragraph}">
-                We received a request to reset your password for your ${appName} account. 
-                Click the button below to create a new password:
-            </p>
-            
-            <div style="text-align: center;">
-                <a href="${resetUrl}" style="${styles.button}">Reset Password</a>
-            </div>
-            
-            <p style="${styles.paragraph}">
-                Or copy and paste this link into your browser:
-            </p>
-            <p style="color: #3b82f6; word-break: break-all; font-size: 14px;">
-                ${resetUrl}
-            </p>
-            
-            <div style="${styles.warning}">
-                ⏰ This link will expire in 1 hour for security reasons.
-            </div>
-            
-            <div style="${styles.footer}">
-                <p style="margin: 0;">
-                    If you didn't request a password reset, you can safely ignore this email. 
-                    Your password will remain unchanged.
-                </p>
-            </div>
-        </div>
-    </div>
-</body>
-</html>
-    `;
-	const text = `
-Reset Your Password
-
-Hi ${greeting},
-
-We received a request to reset your password for your ${appName} account.
-
-Click this link to create a new password:
-${resetUrl}
-
-This link will expire in 1 hour for security reasons.
-
-If you didn't request a password reset, you can safely ignore this email.
-Your password will remain unchanged.
-    `.trim();
-	return {
-		subject,
-		html: body.toString().trim(),
-		text
+async function validateApiKey(c, token, options) {
+	const { store, driver } = options;
+	const hash = await hashToken(token);
+	const apiKey = await store.findByKeyHash(hash);
+	if (!apiKey) return c.json({ error: {
+		message: "Invalid API key",
+		code: "UNAUTHORIZED"
+	} }, 401);
+	if (apiKey.revoked_at) return c.json({ error: {
+		message: "API key has been revoked",
+		code: "UNAUTHORIZED"
+	} }, 401);
+	if (apiKey.expires_at && new Date(apiKey.expires_at) < /* @__PURE__ */ new Date()) return c.json({ error: {
+		message: "API key has expired",
+		code: "UNAUTHORIZED"
+	} }, 401);
+	const uid = `api-key:${apiKey.id}`;
+	const roles = apiKey.admin ? ["admin", "service"] : ["service"];
+	c.set("user", {
+		uid,
+		roles
+	});
+	const masked = {
+		id: apiKey.id,
+		name: apiKey.name,
+		key_prefix: apiKey.key_prefix,
+		permissions: apiKey.permissions,
+		admin: apiKey.admin,
+		rate_limit: apiKey.rate_limit,
+		created_by: apiKey.created_by,
+		created_at: apiKey.created_at,
+		updated_at: apiKey.updated_at,
+		last_used_at: apiKey.last_used_at,
+		expires_at: apiKey.expires_at,
+		revoked_at: apiKey.revoked_at
 	};
+	c.set("apiKey", masked);
+	try {
+		const scopedDriver = await scopeDataDriver(driver, {
+			uid,
+			roles
+		});
+		c.set("driver", scopedDriver);
+	} catch (error) {
+		logger.error("[AUTH] RLS scoping failed for API key", { error });
+		return c.json({ error: {
+			message: "Internal authentication error",
+			code: "INTERNAL_ERROR"
+		} }, 500);
+	}
+	const lastTouch = lastUsedTouchedAt.get(apiKey.id);
+	const now = Date.now();
+	if (!lastTouch || now - lastTouch >= LAST_USED_DEBOUNCE_MS) {
+		lastUsedTouchedAt.set(apiKey.id, now);
+		store.updateLastUsed(apiKey.id).catch(() => {});
+	}
+	return true;
 }
+/** Per-process debounce state for last_used_at touches. */
+var lastUsedTouchedAt = /* @__PURE__ */ new Map();
+var LAST_USED_DEBOUNCE_MS = 6e4;
 /**
-* Default email verification template
+* Shared 403 response for API-key permission denials outside the REST
+* generator (storage and functions guards). One envelope, one code — a
+* change to the error contract happens in one place.
 */
-function getEmailVerificationTemplate(verifyUrl, user, appName = DEFAULT_APP_NAME, logoUrl) {
-	const greeting = getGreeting(user);
-	const subject = `Verify your ${appName} email address`;
-	const body = html`
-<!DOCTYPE html>
-<html>
-<head>
-    <meta charset="utf-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>${subject}</title>
-</head>
-<body style="margin: 0; padding: 0; background-color: #f8fafc;">
-    <div style="${styles.container}">${renderHeader(appName, logoUrl)}
-        <div style="${styles.card}">
-            <h1 style="${styles.heading}">Verify Your Email</h1>
-            
-            <p style="${styles.paragraph}">
-                Hi ${greeting},
-            </p>
-            
-            <p style="${styles.paragraph}">
-                Thanks for signing up for ${appName}! Please verify your email address 
-                by clicking the button below:
-            </p>
-            
-            <div style="text-align: center;">
-                <a href="${verifyUrl}" style="${styles.button}">Verify Email Address</a>
-            </div>
-            
-            <p style="${styles.paragraph}">
-                Or copy and paste this link into your browser:
-            </p>
-            <p style="color: #3b82f6; word-break: break-all; font-size: 14px;">
-                ${verifyUrl}
-            </p>
-            
-            <div style="${styles.footer}">
-                <p style="margin: 0;">
-                    If you didn't create an account with ${appName}, you can safely ignore this email.
-                </p>
-            </div>
-        </div>
-    </div>
-</body>
-</html>
-    `;
-	const text = `
-Verify Your Email
-
-Hi ${greeting},
-
-Thanks for signing up for ${appName}! Please verify your email address by clicking this link:
-${verifyUrl}
-
-If you didn't create an account with ${appName}, you can safely ignore this email.
-    `.trim();
-	return {
-		subject,
-		html: body.toString().trim(),
-		text
-	};
+function forbidApiKey(c, operation, resource, grantHint) {
+	return c.json({ error: {
+		message: `API key does not have "${operation}" permission for ${resource}. Grant it with a permission entry like { "collection": "${grantHint}", "operations": ["${operation}"] }.`,
+		code: "API_KEY_FORBIDDEN"
+	} }, 403);
 }
 /**
-* Default user invitation email template
-* Sent when an admin creates a new user account
+* Permission guard for API-key requests to the storage router.
+*
+* Storage previously did not accept API keys at all (`rk_` tokens were
+* misparsed as JWTs and 401'd). Now that the pre-auth middleware
+* authenticates them, this guard decides what they may do: the key needs a
+* `"storage"` permission entry (or the global `"*"` wildcard) covering the
+* operation derived from the HTTP method. Requests not authenticated via an
+* API key pass through to the storage router's own auth gates.
+*
+* TUS resumable-upload routes (`/tus`, `/tus/:id`) are classified as `write`
+* for EVERY method: the protocol's offset check is a GET and its cancel is a
+* DELETE, but both are steps of an upload — a write-scoped key must be able
+* to complete (and abort) its own resumable upload without also holding
+* `read`/`delete` on stored objects.
 */
-function getUserInvitationTemplate(setPasswordUrl, user, appName = DEFAULT_APP_NAME, logoUrl) {
-	const greeting = getGreeting(user);
-	const subject = `You've been invited to ${appName}`;
-	const body = html`
-<!DOCTYPE html>
-<html>
-<head>
-    <meta charset="utf-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>${subject}</title>
-</head>
-<body style="margin: 0; padding: 0; background-color: #f8fafc;">
-    <div style="${styles.container}">${renderHeader(appName, logoUrl)}
-        <div style="${styles.card}">
-            <h1 style="${styles.heading}">Welcome to ${appName}!</h1>
-            
-            <p style="${styles.paragraph}">
-                Hi ${greeting},
-            </p>
-            
-            <p style="${styles.paragraph}">
-                An account has been created for you on ${appName}. 
-                Click the button below to set your password and get started:
-            </p>
-            
-            <div style="text-align: center;">
-                <a href="${setPasswordUrl}" style="${styles.button}">Set Your Password</a>
-            </div>
-            
-            <p style="${styles.paragraph}">
-                Or copy and paste this link into your browser:
-            </p>
-            <p style="color: #3b82f6; word-break: break-all; font-size: 14px;">
-                ${setPasswordUrl}
-            </p>
-            
-            <div style="${styles.warning}">
-                ⏰ This link will expire in 1 hour for security reasons.
-            </div>
-            
-            <div style="${styles.footer}">
-                <p style="margin: 0;">
-                    If you weren't expecting this invitation, you can safely ignore this email.
-                </p>
-            </div>
-        </div>
-    </div>
-</body>
-</html>
-    `;
-	const text = `
-Welcome to ${appName}!
-
-Hi ${greeting},
-
-An account has been created for you on ${appName}.
-
-Click this link to set your password and get started:
-${setPasswordUrl}
-
-This link will expire in 1 hour for security reasons.
-
-If you weren't expecting this invitation, you can safely ignore this email.
-    `.trim();
-	return {
-		subject,
-		html: body.toString().trim(),
-		text
+function createStorageApiKeyGuard() {
+	return async (c, next) => {
+		const apiKey = c.get("apiKey");
+		if (!apiKey) return next();
+		const operation = /\/tus(\/|$)/.test(c.req.path) ? "write" : httpMethodToOperation(c.req.method);
+		if (!isStorageAllowed(apiKey.permissions, operation)) return forbidApiKey(c, operation, "storage", "storage");
+		return next();
 	};
 }
 /**
-* Default welcome email template
-* Sent automatically when a new user registers
-*/
-function getWelcomeEmailTemplate(user, appName = DEFAULT_APP_NAME, loginUrl, logoUrl) {
-	const greeting = getGreeting(user);
-	const url = loginUrl || "";
-	const subject = `Welcome to ${appName}`;
-	const body = html`
-<!DOCTYPE html>
-<html>
-<head>
-    <meta charset="utf-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>${subject}</title>
-</head>
-<body style="margin: 0; padding: 0; background-color: #f8fafc;">
-    <div style="${styles.container}">${renderHeader(appName, logoUrl)}
-        <div style="${styles.card}">
-            <h1 style="${styles.heading}">Welcome to ${appName}</h1>
-
-            <p style="${styles.paragraph}">
-                Hi ${greeting},
-            </p>
-
-            <p style="${styles.paragraph}">
-                Your ${appName} account is ready.
-            </p>
-
-            ${url ? html`
-            <div style="text-align: center;">
-                <a href="${url}" style="${styles.button}">Open ${appName}</a>
-            </div>
-            ` : raw("")}
-
-            <p style="${styles.paragraph}">
-                If you have any questions, just reply to this email.
-            </p>
-
-            <div style="${styles.footer}">
-                <p style="margin: 0;">
-                    You received this because an account was created with this email address at ${appName}.
-                </p>
-            </div>
-        </div>
-    </div>
-</body>
-</html>
-    `;
-	const text = `
-Welcome to ${appName}
-
-Hi ${greeting},
-
-Your ${appName} account is ready.
-
-${url ? `Open ${appName}: ${url}` : ""}
-
-If you have any questions, just reply to this email.
-    `.trim();
-	return {
-		subject,
-		html: body.toString().trim(),
-		text
+* Permission guard for API-key requests to the custom-functions router.
+*
+* The collection permission guard lives in the REST generator and never sees
+* function routes, so before this middleware existed ANY valid API key —
+* however narrowly scoped — could invoke every custom function. This guard
+* closes that: API-key requests must hold a `"functions"`/`"functions/<name>"`
+* permission entry (or the global `"*"` wildcard) for the derived operation.
+*
+* Non-API-key requests (JWT, service key, anonymous) pass through untouched —
+* functions decide their own auth for those, as before.
+*
+* @param mountPrefix - The path the functions router is mounted at
+*                      (e.g. `/api/functions`), used to extract the function
+*                      name from the request path.
+*/
+function createFunctionApiKeyGuard(mountPrefix) {
+	return async (c, next) => {
+		const apiKey = c.get("apiKey");
+		if (!apiKey) return next();
+		const path = c.req.path;
+		const idx = path.indexOf(mountPrefix);
+		const rawName = (idx < 0 ? "" : path.slice(idx + mountPrefix.length)).split("/").filter(Boolean)[0] ?? "";
+		let functionName;
+		try {
+			functionName = decodeURIComponent(rawName);
+		} catch {
+			functionName = rawName;
+		}
+		const operation = httpMethodToOperation(c.req.method);
+		if (!isFunctionAllowed(apiKey.permissions, functionName, operation)) return forbidApiKey(c, operation, functionName ? `function "${functionName}"` : "the functions index", `functions${functionName ? `/${functionName}` : ""}`);
+		return next();
 	};
 }
 /**
-* Default one-time sign-in code email.
+* Standalone pre-auth middleware for `rk_` bearer tokens.
 *
-* The code is the entire content, so it is set large and repeated in the
-* plain-text part: somebody is about to copy it by eye onto another device,
-* which is the whole reason this flow exists rather than a link.
+* Routers whose auth gate is JWT-based (`requireAuth` / `createRequireAuth` —
+* the admin surfaces: admin users/roles, api-keys management, cron, backups,
+* logs, schema editor) don't know about API keys. Mounting this middleware in
+* front of them authenticates `rk_` tokens and populates the request context;
+* the downstream gates then see the already-resolved user and apply their
+* role checks (`requireAdmin`) as usual — so an `admin: true` key passes and
+* a non-admin key is rejected with 403.
+*
+* Requests without an `rk_` bearer token pass through untouched. An invalid,
+* revoked, or expired `rk_` token is rejected here (401) rather than falling
+* through to be misparsed as a JWT.
 */
-function getEmailOtpTemplate(code, user, appName = DEFAULT_APP_NAME, logoUrl) {
-	const greeting = getGreeting(user);
-	const subject = `${code} is your ${appName} sign-in code`;
-	const body = html`
-<!DOCTYPE html>
-<html>
-<head>
-    <meta charset="utf-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>${subject}</title>
-</head>
-<body style="margin: 0; padding: 0; background-color: #f8fafc;">
-    <div style="${styles.container}">${renderHeader(appName, logoUrl)}
-        <div style="${styles.card}">
-            <h1 style="${styles.heading}">Your sign-in code</h1>
-
-            <p style="${styles.paragraph}">
-                Hi ${greeting},
-            </p>
-
-            <p style="${styles.paragraph}">
-                Enter this code to finish signing in to ${appName}:
-            </p>
-
-            <div style="text-align: center; margin: 32px 0;">
-                <span style="${styles.code}">${code}</span>
-            </div>
-
-            <div style="${styles.warning}">
-                ⏰ This code expires in 10 minutes and can only be used once.
-            </div>
-
-            <div style="${styles.footer}">
-                <p style="margin: 0;">
-                    If you didn't try to sign in, you can safely ignore this email.
-                    We will never ask you for this code.
-                </p>
-            </div>
-        </div>
-    </div>
-</body>
-</html>
-    `;
-	const text = `
-Your ${appName} sign-in code
-
-Hi ${greeting},
-
-Enter this code to finish signing in:
-
-    ${code}
-
-This code expires in 10 minutes and can only be used once.
-
-If you didn't try to sign in, you can safely ignore this email. We will never
-ask you for this code.
-    `.trim();
-	return {
-		subject,
-		html: body.toString().trim(),
-		text
+function createApiKeyPreAuth(options) {
+	return async (c, next) => {
+		if (c.get("apiKey")) return next();
+		const token = extractBearerToken(c.req.header("authorization")) ?? "";
+		if (!token || !isApiKeyToken(token)) return next();
+		const result = await validateApiKey(c, token, options);
+		if (result !== true) return result;
+		return next();
 	};
 }
+//#endregion
+//#region src/auth/middleware.ts
 /**
-* Default magic link email template
+* Answer a refusal with the canonical envelope, through the same formatter
+* every route uses.
+*
+* These middlewares used to hand-build `c.json({ error: { message, code } },
+* 401)` — seven near-copies of it, which is how they came to omit `requestId`
+* while every other error on the server carried it: the one string a bug report
+* quotes was missing from precisely the errors an app hits most. It also meant
+* a routine 401 (a client refreshing before it knows whether a session exists)
+* logged like an incident, because `ApiError.expected` never reached the
+* logger.
+*
+* `errorHandler` is *called* rather than thrown to. A throw only becomes an
+* envelope where an `onError` is registered, and these middlewares are mounted
+* by callers this package does not control — `defineFunction` hands users a
+* Hono app and invites them to put `requireAuth` on a route of it. Making the
+* status depend on the mount point would turn a 401 into a 500 for exactly
+* those callers. Calling the formatter directly gets the envelope with none of
+* that.
 */
-function getMagicLinkTemplate(magicLinkUrl, user, appName = DEFAULT_APP_NAME, logoUrl) {
-	const greeting = getGreeting(user);
-	const subject = `Sign in to ${appName}`;
-	const body = html`
-<!DOCTYPE html>
-<html>
-<head>
-    <meta charset="utf-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>${subject}</title>
-</head>
-<body style="margin: 0; padding: 0; background-color: #f8fafc;">
-    <div style="${styles.container}">${renderHeader(appName, logoUrl)}
-        <div style="${styles.card}">
-            <h1 style="${styles.heading}">Sign In to ${appName}</h1>
-            
-            <p style="${styles.paragraph}">
-                Hi ${greeting},
-            </p>
-            
-            <p style="${styles.paragraph}">
-                We received a request to sign in to your ${appName} account. 
-                Click the button below to log in:
-            </p>
-            
-            <div style="text-align: center;">
-                <a href="${magicLinkUrl}" style="${styles.button}">Sign In</a>
-            </div>
-            
-            <p style="${styles.paragraph}">
-                Or copy and paste this link into your browser:
-            </p>
-            <p style="color: #3b82f6; word-break: break-all; font-size: 14px;">
-                ${magicLinkUrl}
-            </p>
-            
-            <div style="${styles.warning}">
-                ⏰ This link will expire in 15 minutes for security reasons and can only be used once.
-            </div>
-            
-            <div style="${styles.footer}">
-                <p style="margin: 0;">
-                    If you didn't request this sign-in link, you can safely ignore this email. 
-                    No action is needed.
-                </p>
-            </div>
-        </div>
-    </div>
-</body>
-</html>
-    `;
-	const text = `
-Sign In to ${appName}
-
-Hi ${greeting},
-
-We received a request to sign in to your ${appName} account.
-
-Click this link to log in:
-${magicLinkUrl}
-
-This link will expire in 15 minutes for security reasons and can only be used once.
-
-If you didn't request this sign-in link, you can safely ignore this email.
-No action is needed.
-    `.trim();
-	return {
-		subject,
-		html: body.toString().trim(),
-		text
+function refuse(c, error) {
+	return errorHandler(error, c);
+}
+/**
+* Hono middleware that requires a valid JWT token via Authorization header.
+* Returns 401 if token is missing or invalid.
+*
+* **Security:** Tokens are only accepted via the `Authorization: Bearer`
+* header. Query-string tokens (`?token=`) are intentionally NOT accepted
+* here because URLs leak into access logs, proxies, Referer headers, and
+* browser history. Use {@link queryTokenAuth} on routes that legitimately
+* need query-string tokens (e.g. storage file serving for `<img src>`).
+*/
+var requireAuth = async (c, next) => {
+	if (c.get("user")) return next();
+	const token = extractBearerToken(c.req.header("authorization"));
+	if (token === void 0) return refuse(c, ApiError.unauthenticated("Authorization header missing or invalid"));
+	const payload = await verifyAccessToken(token);
+	if (!payload) return refuse(c, ApiError.unauthenticated("Invalid or expired token"));
+	c.set("user", payload);
+	return next();
+};
+/**
+* Factory that creates a requireAuth middleware with optional service key support.
+*
+* When `serviceKey` is provided, the middleware will check if the Bearer token
+* matches the service key using constant-time comparison. If it matches, the
+* request is authenticated as a service user with admin privileges.
+*
+* This allows admin routes (which use standalone requireAuth + requireAdmin)
+* to be accessed via service keys for scripts and server-to-server calls.
+*/
+function createRequireAuth(options) {
+	if (!options?.serviceKey && !options?.resolveRoles && !options?.revocationRepo) return requireAuth;
+	const key = options.serviceKey;
+	const resolveRoles = options.resolveRoles;
+	const revocationRepo = options.revocationRepo;
+	return async (c, next) => {
+		if (c.get("user")) return next();
+		const token = extractBearerToken(c.req.header("authorization"));
+		if (token === void 0) return refuse(c, ApiError.unauthenticated("Authorization header missing or invalid"));
+		if (key !== void 0 && safeCompare(token, key)) {
+			c.set("user", {
+				uid: "service",
+				roles: ["admin"]
+			});
+			return next();
+		}
+		const payload = await verifyAccessToken(token);
+		if (!payload) return refuse(c, ApiError.unauthenticated("Invalid or expired token"));
+		if (resolveRoles || revocationRepo) try {
+			if (revocationRepo && await isAccessTokenRevoked(revocationRepo, payload)) return refuse(c, ApiError.unauthorized("Session has been revoked", "SESSION_REVOKED"));
+			c.set("user", resolveRoles ? {
+				...payload,
+				roles: await resolveRoles(payload.uid)
+			} : payload);
+			return next();
+		} catch (error) {
+			logger.warn("[Auth] Could not resolve roles for an admin-gated request", {
+				uid: payload.uid,
+				error
+			});
+			return c.json({ error: {
+				message: "Could not verify your permissions. Please try again.",
+				code: "ROLE_LOOKUP_FAILED"
+			} }, 503);
+		}
+		c.set("user", payload);
+		return next();
 	};
 }
-//#endregion
-//#region src/auth/admin-user-ops.ts
 /**
-* Admin User Operations
-*
-* Shared utilities and orchestration for admin-initiated user management
-* (user creation via REST API, password reset via admin panel).
-*
-* Hook resolution order:
-* 1. Collection-level hook (`auth.onCreateUser` on the collection) — closest to the data
-* 2. Backend-level hook (`AuthHooks.onAdminCreateUser`) — global override
-* 3. Built-in default — framework fallback
+* Middleware that requires the user to have an admin or schema-admin role.
+* Must be used AFTER requireAuth or on a route where user is guaranteed.
 */
+var requireAdmin = async (c, next) => {
+	const user = c.get("user");
+	if (!user) return refuse(c, ApiError.unauthorized("User not authenticated. requireAuth middleware is missing?"));
+	if (!hasAdministrativeRole(typeof user === "object" && user !== null && "roles" in user ? user.roles || [] : [])) return refuse(c, ApiError.forbidden("Admin privileges required for this operation"));
+	return next();
+};
 /**
-* Generate a cryptographically secure random password that meets strength requirements.
+* Middleware that optionally extracts user from JWT via Authorization header.
+* Does not return 401 if token is missing — allows anonymous access.
 *
-* 16 characters, guaranteed at least one uppercase, one lowercase, one digit.
-* Ambiguous characters (0, O, 1, l, I) are excluded.
+* Query-string tokens are NOT accepted here. Use {@link queryTokenAuth}
+* on routes that need them.
 */
-function generateSecurePassword() {
-	const upper = "ABCDEFGHJKLMNPQRSTUVWXYZ";
-	const lower = "abcdefghjkmnpqrstuvwxyz";
-	const digits = "23456789";
-	const all = "ABCDEFGHJKLMNPQRSTUVWXYZabcdefghjkmnpqrstuvwxyz23456789";
-	const pick = (chars) => chars[randomInt(chars.length)];
-	const parts = [
-		pick(upper),
-		pick(lower),
-		pick(digits)
-	];
-	for (let i = parts.length; i < 16; i++) parts.push(pick(all));
-	for (let i = parts.length - 1; i > 0; i--) {
-		const j = randomInt(i + 1);
-		[parts[i], parts[j]] = [parts[j], parts[i]];
+var optionalAuth = async (c, next) => {
+	if (c.get("user")) return next();
+	const token = extractBearerToken(c.req.header("authorization"));
+	if (token !== void 0 && isJwtConfigured()) {
+		const payload = await verifyAccessToken(token);
+		if (payload) c.set("user", payload);
 	}
-	return parts.join("");
-}
+	return next();
+};
 /**
-* Generate a cryptographically secure random token (80 hex characters).
+* Extract user from token - for WebSocket authentication
 */
-function generateSecureToken() {
-	return randomBytes(40).toString("hex");
+async function extractUserFromToken(token) {
+	if (!isJwtConfigured()) return null;
+	return verifyAccessToken(token);
 }
 /**
-* Hash a token for database storage using SHA-256.
+* Create a configurable auth middleware that handles:
+* 1. Token extraction (via custom validator or JWT Bearer token)
+* 2. RLS-scoped DataDriver via withAuth()
+* 3. Enforcement (401 when requireAuth is true and no user)
+*
+* **Secure by default:** `requireAuth` defaults to `true`. Anonymous
+* access is only allowed when the developer explicitly opts out by
+* setting `requireAuth: false`, indicating that Postgres RLS policies
+* fully control access.
+*
+* **Fail-closed:** The raw unscoped driver is never placed in the
+* request context. Every code path either scopes via `withAuth()` or
+* rejects the request. This prevents silent RLS bypass.
+*
+* This is the single source of truth for HTTP auth in Rebase.
+* Use this instead of manually parsing tokens in route handlers.
 */
-function hashToken(token) {
-	return createHash("sha256").update(token).digest("hex");
+function createAuthMiddleware(options) {
+	const { driver: baseDriver, resolveDriver, requireAuth: enforceAuth = true, validator, serviceKey, apiKeyStore } = options;
+	return async (c, next) => {
+		const driver = resolveDriver ? resolveDriver(c) : baseDriver;
+		if (validator) try {
+			const authResult = await validator(c);
+			if (authResult && typeof authResult === "object") {
+				const id = "uid" in authResult ? authResult.uid : void 0;
+				if (id) {
+					const roles = authResult.roles || [];
+					c.set("user", {
+						uid: id,
+						roles
+					});
+					const user = {
+						uid: id,
+						roles,
+						...authResult
+					};
+					c.set("driver", await scopeDataDriver(driver, user));
+				} else c.set("driver", await scopeDataDriver(driver, {
+					uid: ANONYMOUS_USER_ID,
+					roles: ["anon"]
+				}));
+			} else if (authResult === true) {
+				c.set("user", {
+					uid: "default",
+					roles: []
+				});
+				c.set("driver", await scopeDataDriver(driver, {
+					uid: "default",
+					roles: []
+				}));
+			} else c.set("driver", await scopeDataDriver(driver, {
+				uid: ANONYMOUS_USER_ID,
+				roles: ["anon"]
+			}));
+		} catch (error) {
+			return refuse(c, ApiError.unauthenticated("Unauthorized"));
+		}
+		else {
+			const token = extractBearerToken(c.req.header("authorization"));
+			if (token !== void 0) if (serviceKey && safeCompare(token, serviceKey)) {
+				c.set("user", {
+					uid: "service",
+					roles: ["admin"]
+				});
+				try {
+					c.set("driver", await scopeDataDriver(driver, {
+						uid: "service",
+						roles: ["admin"]
+					}));
+				} catch (error) {
+					logger.error("[AUTH] RLS scoping failed for service key", { error });
+					return c.json({ error: {
+						message: "Internal authentication error",
+						code: "INTERNAL_ERROR"
+					} }, 500);
+				}
+			} else if (apiKeyStore && isApiKeyToken(token)) {
+				const result = await validateApiKey(c, token, {
+					store: apiKeyStore,
+					driver
+				});
+				if (result !== true) return result;
+			} else {
+				const payload = await extractUserFromToken(token);
+				if (payload) {
+					c.set("user", payload);
+					try {
+						const user = {
+							uid: payload.uid,
+							roles: payload.roles,
+							isAnonymous: payload.isAnonymous === true,
+							claims: payload.claims
+						};
+						c.set("driver", await scopeDataDriver(driver, user));
+					} catch (error) {
+						logger.error("[AUTH] RLS scoping failed for authenticated user", { error });
+						return c.json({ error: {
+							message: "Internal authentication error",
+							code: "INTERNAL_ERROR"
+						} }, 500);
+					}
+				} else return refuse(c, ApiError.unauthenticated("Invalid or expired token"));
+			}
+			else try {
+				c.set("driver", await scopeDataDriver(driver, {
+					uid: ANONYMOUS_USER_ID,
+					roles: ["anon"]
+				}));
+			} catch (error) {
+				logger.error("[AUTH] Failed to create anon-scoped driver", { error });
+				return c.json({ error: {
+					message: "Server configuration error",
+					code: "INTERNAL_ERROR"
+				} }, 500);
+			}
+		}
+		if (enforceAuth && !c.get("user")) return refuse(c, ApiError.unauthenticated("Unauthorized: Authentication required. This is the API-level gate, not a row rule — a collection granting public reads still needs a caller. Set AUTH_REQUIRE=false (or `auth.requireAuth: false`) to let RLS alone decide."));
+		return next();
+	};
 }
 /**
-* Build the `AuthCollectionContext` facade from server internals.
+* Middleware that authenticates via a `?token=` query parameter.
+*
+* **Use sparingly.** Tokens in URLs leak into access logs, proxy logs,
+* Referer headers, and browser history. This middleware exists solely for
+* routes where the consumer cannot set HTTP headers — e.g. `<img src>`,
+* `<a href>` for file downloads, or similar browser-native requests.
+*
+* Apply it **before** `requireAuth` or `optionalAuth` on the specific
+* route that needs it. Those middlewares will see the user context this
+* middleware sets and skip their own 401 check.
+*
+* @example
+* ```ts
+* router.get("/file/*", queryTokenAuth, readAuthMiddleware, handler);
+* ```
+*/
+var queryTokenAuth = async (c, next) => {
+	if (extractBearerToken(c.req.header("authorization")) !== void 0) return next();
+	const queryToken = c.req.query("token");
+	if (queryToken && isJwtConfigured()) {
+		const payload = await verifyAccessToken(queryToken);
+		if (payload) c.set("user", payload);
+	}
+	return next();
+};
+/**
+* Authorizes anonymous access to **public** storage objects (those under the
+* public prefix), which are served token-less via stable, permanent URLs.
+*
+* Runs on the storage `/file/*` and `/metadata/*` routes, *after* the token
+* middleware and *before* the read-auth gate. If the request is already
+* authenticated (Bearer or scoped token), it does nothing. Otherwise, when the
+* requested object path is public, it sets a minimal "public" principal so the
+* downstream `requireAuth` gate lets the read through. Private paths are left
+* untouched, so they still require a valid token.
+*/
+var publicObjectAuth = async (c, next) => {
+	if (c.get("user")) return next();
+	const prefix = c.req.routePath.replace("/*", "");
+	const fullPath = c.req.path;
+	const idx = fullPath.indexOf(prefix);
+	const rawPath = idx < 0 ? "" : fullPath.substring(idx + prefix.length + 1);
+	if (rawPath && isPublicStoragePath(decodeURIComponent(rawPath))) c.set("user", {
+		uid: "public",
+		roles: ["public"]
+	});
+	return next();
+};
+/**
+* Helper to match paths for scoped file tokens.
+* Matches exact paths or prefixes (exact folder prefixes or ending with /).
+*
+* The traversal check is defence in depth, not the load-bearing defence.
+*
+* A prefix comparison is a lie for any path containing `..`: `user1/../user2/x`
+* starts with `user1/`, so a token scoped to `user1/` would authorize reading
+* user2's file — and the storage controller would not object, because its own
+* guard stops a path escaping the *bucket*, and that one resolves to `user2/x`,
+* comfortably inside it. The grant is what would be escaped, and this is the
+* only layer that knows what was granted.
 *
-* This is the simplified context exposed to collection-level auth hooks,
-* keeping them decoupled from internal interfaces like `AuthRepository`.
+* Nothing arrives here in that shape today: the URL parser resolves `..` (and
+* `%2e%2e`, which the WHATWG spec treats as a dot for normalization) before
+* Hono routes the request, so this comparison already runs on a resolved path.
+* But that is a guarantee of the runtime rather than of this code, and it is
+* one line to not depend on it. The same rule already guards the public-object
+* path — see `isPublicStoragePath`.
 */
-function buildCollectionContext(ctx) {
-	const isEmailConfigured = !!(ctx.emailService && ctx.emailService.isConfigured());
-	return {
-		hashPassword: (password) => ctx.resolvedHooks.hashPassword(password),
-		sendEmail: isEmailConfigured ? (options) => ctx.emailService.send(options) : void 0,
-		emailConfigured: isEmailConfigured,
-		appName: ctx.emailConfig?.appName || "Rebase",
-		resetPasswordUrl: ctx.emailConfig?.resetPasswordUrl || ""
-	};
+function isPathMatch(requested, allowed) {
+	if (requested.split("/").some((seg) => seg === "..")) return false;
+	if (requested === allowed) return true;
+	if (allowed.endsWith("/")) return requested.startsWith(allowed);
+	return requested.startsWith(allowed + "/");
 }
 /**
-* Prepare user values for an admin-initiated user creation.
-*
-* Resolution order:
-* 1. Collection-level `auth.onCreateUser` — closest to the data
-* 2. Backend-level `AuthHooks.onAdminCreateUser` — global override
-* 3. Built-in default — generate password → hash → normalize email
-*
-* The caller is responsible for persisting (via `driver.save()`).
+* Middleware that authenticates file-serving routes using scoped download tokens.
+* It enforces that only scoped "file-read" tokens can access "/file/*" and "?token=" query params.
+* Full access JWTs are explicitly rejected on "/file/*" routes, and in the "?token=" query param.
 */
-async function prepareAdminUserValues(body, ctx) {
-	const { resolvedHooks, collectionAuthConfig } = ctx;
-	if (collectionAuthConfig?.onCreateUser) {
-		const collectionCtx = buildCollectionContext(ctx);
-		const hookResult = await collectionAuthConfig.onCreateUser(body, collectionCtx);
-		return {
-			values: hookResult.values,
-			clearPassword: hookResult.temporaryPassword,
-			hookHandledEmail: true,
-			invitationSent: hookResult.invitationSent ?? false
+var fileTokenAuth = async (c, next) => {
+	const isFileRoute = c.req.path.includes("/storage/file/");
+	const authHeader = c.req.header("authorization");
+	const queryToken = c.req.query("token");
+	const extractWildcard = (ctx) => {
+		const prefix = ctx.req.routePath.replace("/*", "");
+		const fullPath = ctx.req.path;
+		const idx = fullPath.indexOf(prefix);
+		if (idx < 0) return "";
+		return fullPath.substring(idx + prefix.length + 1);
+	};
+	/**
+	* Must agree with `parseBucketAndPath` in `storage/routes.ts`, because the
+	* path a token GRANTS is minted there and the path a request ASKS FOR is
+	* derived here. `/metadata` canonicalizes before signing, so a raw
+	* comparison here would 403 an otherwise-valid request for any key whose
+	* URL form is not already canonical (`a//b.txt`, `a/./b.txt`).
+	*
+	* A key that cannot be canonicalized yields null, which matches no grant —
+	* the same fail-closed answer `isPathMatch` gives a `..` segment.
+	*/
+	const parseBucketPath = (filePath) => {
+		const parts = filePath.split("/");
+		if (parts.length > 1 && parts[0].toLowerCase() === "default") return {
+			bucket: "default",
+			resolvedPath: tryCanonicalStorageKey(parts.slice(1).join("/"))
 		};
-	}
-	if (resolvedHooks.onAdminCreateUser) {
-		const hookResult = await resolvedHooks.onAdminCreateUser(body, {
-			authRepo: ctx.authRepo,
-			emailService: ctx.emailService,
-			emailConfig: ctx.emailConfig,
-			hashPassword: (password) => resolvedHooks.hashPassword(password)
-		});
 		return {
-			values: hookResult.values,
-			clearPassword: hookResult.temporaryPassword,
-			hookHandledEmail: true,
-			invitationSent: hookResult.invitationSent ?? false
+			bucket: "default",
+			resolvedPath: tryCanonicalStorageKey(filePath)
 		};
-	}
-	const password = body.password;
-	const clearPassword = password || generateSecurePassword();
-	const passwordHash = await resolvedHooks.hashPassword(clearPassword);
-	const values = { ...body };
-	values.passwordHash = passwordHash;
-	if (values.email) values.email = normalizeEmail(values.email);
-	values.emailVerified = true;
-	delete values.password;
-	return {
-		values,
-		clearPassword: password ? void 0 : clearPassword,
-		hookHandledEmail: false,
-		invitationSent: false
 	};
-}
+	/**
+	* Decide what a valid download token entitles this request to.
+	*
+	* One function rather than a copy per token location: a Bearer token and a
+	* `?token=` are the same grant presented two ways, and the whole failure
+	* this guards against is two places disagreeing about what was granted.
+	*
+	* `"no-path"` is distinct from the two denials because the caller treats it
+	* differently — a request with no object path at all is not a denied read,
+	* it is a request this middleware has nothing to say about, and on
+	* `/metadata/*` it must still reach the downstream auth gate.
+	*/
+	const evaluateGrant = (payload) => {
+		if (canonicalStorageId(c.req.query("storageId")) !== payload.storageId) return "deny-storage";
+		const rawPath = extractWildcard(c);
+		if (!rawPath) return "no-path";
+		const { bucket, resolvedPath } = parseBucketPath(decodeURIComponent(rawPath));
+		if (resolvedPath === null) return "deny-path";
+		return isPathMatch(`${bucket}/${resolvedPath}`, payload.path) ? "grant" : "deny-path";
+	};
+	/**
+	* Which half of the scope failed is named in the message. The holder of the
+	* token already knows both values, so this reveals nothing to an attacker —
+	* and without it, a client that forgets to forward `?storageId=` on the file
+	* URL reports a "path mismatch" for a path that matches perfectly.
+	*/
+	const denyMismatch = (outcome) => refuse(c, ApiError.forbidden(outcome === "deny-storage" ? "Forbidden: Scoped token storage mismatch" : "Forbidden: Scoped token path mismatch"));
+	const bearerToken = extractBearerToken(authHeader);
+	if (bearerToken !== void 0) {
+		const payload = await verifyDownloadToken(bearerToken);
+		if (payload) {
+			const outcome = evaluateGrant(payload);
+			if (outcome === "grant") {
+				c.set("user", {
+					uid: "download-token",
+					roles: ["reader"]
+				});
+				return next();
+			}
+			if (outcome !== "no-path") return denyMismatch(outcome);
+		}
+		if (isFileRoute) return refuse(c, ApiError.unauthenticated("Unauthorized: Access JWT not allowed on file routes"));
+		return next();
+	}
+	if (queryToken) {
+		const payload = await verifyDownloadToken(queryToken);
+		if (payload) {
+			const outcome = evaluateGrant(payload);
+			if (outcome === "grant") {
+				c.set("user", {
+					uid: "download-token",
+					roles: ["reader"]
+				});
+				return next();
+			}
+			if (outcome !== "no-path") return denyMismatch(outcome);
+		}
+		return refuse(c, ApiError.unauthenticated("Unauthorized: Invalid or unauthorized token"));
+	}
+	return next();
+};
+//#endregion
+//#region src/auth/adapter-middleware.ts
 /**
-* Handle post-creation work for admin-created users.
-*
-* Sends an invitation email (password-reset link) if email is configured
-* and no explicit password was provided. Falls back to returning the
-* temporary password if email fails or is not configured.
+* Create a Hono middleware that uses an `AuthAdapter` for request verification.
 */
-async function finalizeAdminUserCreation(entity, clearPassword, ctx) {
-	if (!clearPassword) return { invitationSent: false };
-	if (!!(ctx.emailService && ctx.emailService.isConfigured())) try {
-		const token = generateSecureToken();
-		const tokenHash = hashToken(token);
-		const expiresAt = new Date(Date.now() + 1440 * 60 * 1e3);
-		await ctx.authRepo.createPasswordResetToken(entity.id, tokenHash, expiresAt);
-		const setPasswordUrl = `${ctx.emailConfig?.resetPasswordUrl || ""}/reset-password?token=${token}`;
-		const { appName, logoUrl } = resolveEmailBranding(ctx.emailConfig);
-		const templateFn = ctx.emailConfig?.templates?.userInvitation;
-		const emailContent = templateFn ? templateFn(setPasswordUrl, {
-			email: entity.values.email,
-			displayName: entity.values.displayName
-		}) : getUserInvitationTemplate(setPasswordUrl, {
-			email: entity.values.email,
-			displayName: entity.values.displayName
-		}, appName, logoUrl);
-		await ctx.emailService.send({
-			to: entity.values.email,
-			subject: emailContent.subject,
-			html: emailContent.html,
-			text: emailContent.text
-		});
-		return { invitationSent: true };
-	} catch (emailError) {
-		logger.error("Failed to send reset email", { error: emailError instanceof Error ? emailError.message : emailError });
-		return {
-			temporaryPassword: clearPassword,
-			invitationSent: false,
-			emailDeliveryFailed: true
-		};
-	}
-	return {
-		temporaryPassword: clearPassword,
-		invitationSent: false
+function createAdapterAuthMiddleware(options) {
+	const { adapter, driver: baseDriver, resolveDriver, requireAuth: enforceAuth = true, apiKeyStore } = options;
+	return async (c, next) => {
+		const driver = resolveDriver ? resolveDriver(c) : baseDriver;
+		const presentedToken = extractBearerToken(c.req.header("authorization"));
+		if (apiKeyStore) {
+			const token = presentedToken ?? "";
+			if (token.startsWith("rk_")) {
+				const result = await validateApiKey(c, token, {
+					store: apiKeyStore,
+					driver
+				});
+				if (result === true) return next();
+				return result;
+			}
+		}
+		let authenticatedUser = null;
+		try {
+			authenticatedUser = await adapter.verifyRequest(c.req.raw);
+		} catch (error) {
+			return refuse(c, ApiError.unauthenticated("Unauthorized"));
+		}
+		if (authenticatedUser) {
+			c.set("user", {
+				uid: authenticatedUser.uid,
+				email: authenticatedUser.email,
+				roles: authenticatedUser.roles,
+				isAnonymous: authenticatedUser.isAnonymous === true
+			});
+			try {
+				c.set("driver", await scopeDataDriver(driver, {
+					uid: authenticatedUser.uid,
+					roles: authenticatedUser.roles,
+					isAnonymous: authenticatedUser.isAnonymous === true
+				}));
+			} catch (error) {
+				logger.error("[AUTH-ADAPTER] RLS scoping failed for authenticated user", { error });
+				return refuse(c, ApiError.internal("Internal authentication error"));
+			}
+		} else {
+			if (presentedToken !== void 0) return refuse(c, ApiError.unauthenticated("Invalid or expired token"));
+			try {
+				c.set("driver", await scopeDataDriver(driver, {
+					uid: ANONYMOUS_USER_ID,
+					roles: ["anon"]
+				}));
+			} catch (error) {
+				logger.error("[AUTH-ADAPTER] Failed to create anon-scoped driver", { error });
+				return refuse(c, ApiError.internal("Server configuration error"));
+			}
+		}
+		if (enforceAuth && !c.get("user")) return refuse(c, ApiError.unauthenticated("Unauthorized: Authentication required. This is the API-level gate, not a row rule — a collection granting public reads still needs a caller. Set AUTH_REQUIRE=false (or `auth.requireAuth: false`) to let RLS alone decide."));
+		return next();
 	};
 }
 //#endregion
@@ -3774,7 +3806,7 @@ function mountMagicLinkRoutes(deps) {
 		if (user) {
 			if (ops.beforeLogin) await ops.beforeLogin(email, "magic-link");
 			const token = generateSecureToken();
-			const tokenHash = hashToken(token);
+			const tokenHash = hashToken$1(token);
 			const expiresAt = getMagicLinkExpiry();
 			await authRepo.createMagicLinkToken(user.id, tokenHash, expiresAt);
 			const magicLinkUrl = `${resolveEmailLinkBase(emailConfig, "magicLink")}/auth/magic-link?token=${token}`;
@@ -3809,7 +3841,7 @@ function mountMagicLinkRoutes(deps) {
 	*/
 	router.post("/magic-link/verify", strictAuthLimiter, async (c) => {
 		const { token } = parseBody(verifyMagicLinkSchema, await c.req.json());
-		const tokenHash = hashToken(token);
+		const tokenHash = hashToken$1(token);
 		const storedToken = await authRepo.findValidMagicLinkToken(tokenHash);
 		if (!storedToken) throw ApiError.badRequest("Invalid or expired magic link", "INVALID_TOKEN");
 		await authRepo.markMagicLinkTokenUsed(tokenHash);
@@ -3964,7 +3996,7 @@ function mountOtpRoutes(deps) {
 		if (ops.beforeLogin) await ops.beforeLogin(email, "otp");
 		if (user) {
 			const code = generateOtpCode();
-			await authRepo.createMagicLinkToken(user.id, hashToken(otpTokenMaterial(user.email, code)), new Date(Date.now() + OTP_TTL_MS));
+			await authRepo.createMagicLinkToken(user.id, hashToken$1(otpTokenMaterial(user.email, code)), new Date(Date.now() + OTP_TTL_MS));
 			const { appName, logoUrl } = resolveEmailBranding(emailConfig);
 			const templateFn = emailConfig?.templates?.emailOtp;
 			const content = templateFn ? templateFn(code, {
@@ -3994,7 +4026,7 @@ function mountOtpRoutes(deps) {
 	*/
 	router.post("/otp/verify", strictAuthLimiter, captureOtpEmail, otpVerificationLimiter, async (c) => {
 		const { email, code } = parseBody(verifySchema, await c.req.json());
-		const tokenHash = hashToken(otpTokenMaterial(email, code));
+		const tokenHash = hashToken$1(otpTokenMaterial(email, code));
 		const storedToken = await authRepo.findValidMagicLinkToken(tokenHash);
 		if (!storedToken) throw ApiError.badRequest("Invalid or expired code", "INVALID_CODE");
 		await authRepo.markMagicLinkTokenUsed(tokenHash);
@@ -4477,7 +4509,7 @@ function createAuthRoutes(config) {
 		const user = await authRepo.getUserByEmail(email);
 		if (user) {
 			const token = generateSecureToken();
-			const tokenHash = hashToken(token);
+			const tokenHash = hashToken$1(token);
 			const expiresAt = getPasswordResetExpiry();
 			await authRepo.createPasswordResetToken(user.id, tokenHash, expiresAt);
 			const resetUrl = `${resolveEmailLinkBase(emailConfig, "resetPassword")}/reset-password?token=${token}`;
@@ -4512,7 +4544,7 @@ function createAuthRoutes(config) {
 		const { token, password } = parseBody(resetPasswordSchema, await c.req.json());
 		const passwordValidation = ops.validatePasswordStrength(password);
 		if (!passwordValidation.valid) throw ApiError.badRequest(passwordValidation.errors.join(". "), "WEAK_PASSWORD");
-		const tokenHash = hashToken(token);
+		const tokenHash = hashToken$1(token);
 		const storedToken = await authRepo.findValidPasswordResetToken(tokenHash);
 		if (!storedToken) throw ApiError.badRequest("Invalid or expired reset token", "INVALID_TOKEN");
 		const passwordHash = await ops.hashPassword(password);
@@ -4569,7 +4601,7 @@ function createAuthRoutes(config) {
 		if (!user) throw ApiError.notFound("User not found");
 		if (user.emailVerified) throw ApiError.badRequest("Email is already verified", "ALREADY_VERIFIED");
 		const token = generateSecureToken();
-		await authRepo.setVerificationToken(user.id, hashToken(token));
+		await authRepo.setVerificationToken(user.id, hashToken$1(token));
 		const verifyUrl = `${resolveEmailLinkBase(emailConfig, "verifyEmail")}/verify-email?token=${token}`;
 		const { appName, logoUrl } = resolveEmailBranding(emailConfig);
 		const templateFn = emailConfig?.templates?.emailVerification;
@@ -4598,7 +4630,7 @@ function createAuthRoutes(config) {
 	router.get("/verify-email", async (c) => {
 		const token = c.req.query("token");
 		if (!token) throw ApiError.badRequest("Verification token is required", "INVALID_INPUT");
-		const user = await authRepo.getUserByVerificationToken(hashToken(token));
+		const user = await authRepo.getUserByVerificationToken(hashToken$1(token));
 		if (!user) throw ApiError.badRequest("Invalid or expired verification token", "INVALID_TOKEN");
 		await authRepo.setEmailVerified(user.id, true);
 		return c.json({
@@ -4831,7 +4863,7 @@ function createResetPasswordRoute(config) {
 			invitationSent = hookResult.invitationSent ?? false;
 		} else if (!!(emailService && emailService.isConfigured())) try {
 			const token = generateSecureToken();
-			const tokenHash = hashToken(token);
+			const tokenHash = hashToken$1(token);
 			const expiresAt = new Date(Date.now() + 3600 * 1e3);
 			await authRepo.createPasswordResetToken(existing.id, tokenHash, expiresAt);
 			const setPasswordUrl = `${emailConfig?.resetPasswordUrl || ""}/reset-password?token=${token}`;
@@ -5069,22 +5101,20 @@ function createAdminUsersRoute(config) {
 		if (ops.beforeUserCreate) createData = await ops.beforeUserCreate(createData);
 		const user = await authRepo.createUser(createData);
 		if (roles && Array.isArray(roles)) await authRepo.setUserRoles(user.id, roles);
-		const finalizeResult = await finalizeAdminUserCreation({
+		const delivery = await completeUserCreation(prepResult, (clearPassword) => finalizeAdminUserCreation({
 			id: user.id,
 			values: prepResult.values
-		}, prepResult.clearPassword, {
+		}, clearPassword, {
 			authRepo,
 			emailService,
 			emailConfig,
 			resolvedHooks: ops,
 			collectionAuthConfig
-		});
+		}));
 		const adminUser = toAdminUser(user, await authRepo.getUserRoleIds(user.id));
 		return c.json({
 			user: adminUser,
-			invitationSent: finalizeResult.invitationSent,
-			...finalizeResult.temporaryPassword ? { temporaryPassword: finalizeResult.temporaryPassword } : {},
-			...finalizeResult.emailDeliveryFailed ? { emailDeliveryFailed: true } : {}
+			...delivery
 		}, 201);
 	});
 	router.put("/users/:uid", requireAdmin, async (c) => {
@@ -7076,7 +7106,7 @@ var auth_exports = /* @__PURE__ */ __exportAll({
 	hasAsymmetricSigningKey: () => hasAsymmetricSigningKey,
 	hashPassword: () => hashPassword,
 	hashRefreshToken: () => hashRefreshToken,
-	hashToken: () => hashToken,
+	hashToken: () => hashToken$1,
 	httpMethodToOperation: () => httpMethodToOperation,
 	isApiKeyToken: () => isApiKeyToken,
 	isJwtConfigured: () => isJwtConfigured,
@@ -7105,6 +7135,6 @@ var auth_exports = /* @__PURE__ */ __exportAll({
 	verifyPassword: () => verifyPassword
 });
 //#endregion
-export { RawHtml as $, defaultAuthLimiter as A, resolveEmailLinkBase as B, providerVerifiedEmail as C, httpMethodToOperation as Ct, DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT as D, isBootstrapWindowOpen as E, isPublicStoragePath as Et, extractLinks as F, generateSecurePassword as G, hashPassword as H, registerDevEmailSink as I, getMagicLinkTemplate as J, getEmailOtpTemplate as K, SMTPEmailService as L, activeDevEmailSink as M, clearActiveDevEmailSink as N, createDataRateLimiter as O, createDevEmailSink as P, resolveEmailBranding as Q, createEmailService as R, pkceTokenParams as S, supportsRlsScoping as St, createBuiltinAuthAdapter as T, PUBLIC_STORAGE_PREFIX as Tt, validatePasswordStrength as U, resolveAuthHooks as V, verifyPassword as W, getUserInvitationTemplate as X, getPasswordResetTemplate as Y, getWelcomeEmailTemplate as Z, verifyOidcIdToken as _, validateApiKey as _t, resolveRateLimitStoreKind as a, createRequireAuth as at, createGoogleProvider as b, SERVICE_IDENTITY as bt, createSlackProvider as c, optionalAuth as ct, createDiscordProvider as d, requireAdmin as dt, escapeHtml as et, createTwitterProvider as f, requireAuth as ft, tryVerifyOidcIdToken as g, isApiKeyToken as gt, createMicrosoftProvider as h, createStorageApiKeyGuard as ht, createApiKeyStore as i, createAuthMiddleware as it, MemoryRateLimitStore as j, createRateLimiter as k, createBitbucketProvider as l, publicObjectAuth as lt, createAppleProvider as m, createFunctionApiKeyGuard as mt, createCustomAuthAdapter as n, raw as nt, createSqlRateLimitStore as o, extractUserFromToken as ot, createFacebookProvider as p, createApiKeyPreAuth as pt, getEmailVerificationTemplate as q, createApiKeyRoutes as r, createAdapterAuthMiddleware as rt, createSpotifyProvider as s, fileTokenAuth as st, auth_exports as t, html as tt, createGitLabProvider as u, queryTokenAuth as ut, createGitHubProvider as v, extractBearerToken as vt, createJwksRoutes as w, isOperationAllowed as wt, oauthCodeFlowSchema as x, scopeDataDriver as xt, createLinkedinProvider as y, safeCompare as yt, assertEmailLinkBases as z };
+export { requireAdmin as $, defaultAuthLimiter as A, resolveEmailLinkBase as B, providerVerifiedEmail as C, raw as Ct, DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT as D, isPublicStoragePath as Dt, isBootstrapWindowOpen as E, PUBLIC_STORAGE_PREFIX as Et, extractLinks as F, createAdapterAuthMiddleware as G, hashPassword as H, registerDevEmailSink as I, extractUserFromToken as J, createAuthMiddleware as K, SMTPEmailService as L, activeDevEmailSink as M, clearActiveDevEmailSink as N, createDataRateLimiter as O, createDevEmailSink as P, queryTokenAuth as Q, createEmailService as R, pkceTokenParams as S, html as St, createBuiltinAuthAdapter as T, isOperationAllowed as Tt, validatePasswordStrength as U, resolveAuthHooks as V, verifyPassword as W, optionalAuth as X, fileTokenAuth as Y, publicObjectAuth as Z, verifyOidcIdToken as _, getUserInvitationTemplate as _t, resolveRateLimitStoreKind as a, validateApiKey as at, createGoogleProvider as b, RawHtml as bt, createSlackProvider as c, SERVICE_IDENTITY as ct, createDiscordProvider as d, completeUserCreation as dt, requireAuth as et, createTwitterProvider as f, generateSecurePassword as ft, tryVerifyOidcIdToken as g, getPasswordResetTemplate as gt, createMicrosoftProvider as h, getMagicLinkTemplate as ht, createApiKeyStore as i, isApiKeyToken as it, MemoryRateLimitStore as j, createRateLimiter as k, createBitbucketProvider as l, scopeDataDriver as lt, createAppleProvider as m, getEmailVerificationTemplate as mt, createCustomAuthAdapter as n, createFunctionApiKeyGuard as nt, createSqlRateLimitStore as o, extractBearerToken as ot, createFacebookProvider as p, getEmailOtpTemplate as pt, createRequireAuth as q, createApiKeyRoutes as r, createStorageApiKeyGuard as rt, createSpotifyProvider as s, safeCompare as st, auth_exports as t, createApiKeyPreAuth as tt, createGitLabProvider as u, supportsRlsScoping as ut, createGitHubProvider as v, getWelcomeEmailTemplate as vt, createJwksRoutes as w, httpMethodToOperation as wt, oauthCodeFlowSchema as x, escapeHtml as xt, createLinkedinProvider as y, resolveEmailBranding as yt, assertEmailLinkBases as z };
 
-//# sourceMappingURL=auth-gzoRjnuh.js.map
+//# sourceMappingURL=auth-BvBllZjy.js.map