@rebasepro/server 0.21.0 → 0.21.1

package/dist/index.es.js

@@ -2,33 +2,33 @@ import { createRequire as __rebaseCreateRequire } from "module";
 import __rebaseProcess from "process";
 globalThis.process ??= __rebaseProcess;
 __rebaseCreateRequire(import.meta.url);
-import { A as createDataSourceRegistry, B as findRelation, D as restrictedFieldNames, E as effectiveAccess, F as getJunctionConfigForRelation, G as buildCompositeId, I as getEffectiveSecurityRules, J as suggestNearMiss, K as resolvePrimaryKeys, M as resolveDataSource, O as defaultUsersCollection, P as revokeInternalTableSql, R as securityRuleToConditions, S as cursorToStartAfter, T as canWriteField, U as resolveCollectionRelations, V as getTableName, W as enumToObjectEntries, X as unref, Y as toSnakeCase, c as collectAllPages, dt as GeoPoint, et as BATCH_REF_KEY, ft as Vector, g as topLevelIncludeNames, gt as unsupportedMethod, h as serializeInclude, ht as isUnsupported, j as isRelationalCollection, k as CollectionRegistry, l as paginateFind, lt as EntityReference, mt as RebaseClientError, n as buildSdkData, nt as hasFieldOperation, o as serializeFilter, ot as JUNCTION_PIVOT_KEY, p as mergeIncludeSpecs, pt as RebaseApiError, q as hydrateRegExp, rt as isFieldOperation, s as serializeLogicalCondition, st as isManyToMany, t as buildRoutedRebaseData, tt as FIELD_OPERATORS, u as resolveFindWindow, ut as EntityRelation, v as normalizeOrderBy, y as serializeOrderBy, z as fieldKeyForColumn } from "./src-DW1cQ_28.js";
+import { A as createDataSourceRegistry, B as findRelation, D as restrictedFieldNames, E as effectiveAccess, F as getJunctionConfigForRelation, G as buildCompositeId, I as getEffectiveSecurityRules, J as suggestNearMiss, K as resolvePrimaryKeys, M as resolveDataSource, O as defaultUsersCollection, P as revokeInternalTableSql, R as securityRuleToConditions, S as cursorToStartAfter, T as canWriteField, U as resolveCollectionRelations, V as getTableName, W as enumToObjectEntries, X as unref, Y as toSnakeCase, c as collectAllPages, dt as GeoPoint, et as BATCH_REF_KEY, ft as Vector, g as topLevelIncludeNames, gt as unsupportedMethod, h as serializeInclude, ht as isUnsupported, j as isRelationalCollection, k as CollectionRegistry, l as paginateFind, lt as EntityReference, mt as RebaseClientError, n as buildSdkData, nt as hasFieldOperation, o as serializeFilter, ot as JUNCTION_PIVOT_KEY, p as mergeIncludeSpecs, pt as RebaseApiError, q as hydrateRegExp, rt as isFieldOperation, s as serializeLogicalCondition, st as isManyToMany, t as buildRoutedRebaseData, tt as FIELD_OPERATORS, u as resolveFindWindow, ut as EntityRelation, v as normalizeOrderBy, y as serializeOrderBy, z as fieldKeyForColumn } from "./src-Caz7nREj.js";
 import { E as DEFAULT_DATA_SOURCE_KEY, F as sortKeyToString, I as toCanonicalOp, P as parseRelationAggregateSort, S as getCollectionDataPath, _ as resourceKinds, a as resourceToStorageSource, b as RLS_UID_SQL, c as DEFAULT_STORAGE_SOURCE_KEY, d as DEFAULT_RESOURCE_KEY, f as buildResourceGraph, g as resourceKind, h as resourceKeyOf, i as resourceToDataSource, l as findStorageSuffixCollision, m as resourceEnvSuffix, n as declaredQueueConsumers, o as setQueueRuntime, p as resolveResourceRefs, r as declaredSubscriptions, s as setTopicRuntime, u as storageEnvSuffix, v as RLS_JWT_SQL, w as isPostgresCollectionConfig, y as RLS_ROLES_SQL } from "./src-Br6ARbs6.js";
 import { n as ADMIN_PROPERTY_KEYS, t as ADMIN_COLLECTION_KEYS } from "./admin_block-DxKLmdiv.js";
 import { a as isDuplicateObjectRace, i as isConcurrentDdlRace, n as createDdlBootstrapper, o as isSQLAdmin, s as isSchemaEditingAdmin, t as CONCURRENT_DDL_SQLSTATES } from "./ddl-bootstrap-CfNvxMuK.js";
+import { i as parseEnvBoolean, r as validateCronExpression, t as CronScheduler } from "./cron-scheduler-COPQxlEq.js";
 import { i as SCHEMA_VERSION_HEADER, n as createContractRoutes, r as computeSchemaVersion } from "./contract-routes-eLxV0le1.js";
-import { $ as RawHtml, A as defaultAuthLimiter, B as resolveEmailLinkBase, C as providerVerifiedEmail, Ct as httpMethodToOperation, D as DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT, E as isBootstrapWindowOpen, Et as isPublicStoragePath, F as extractLinks, G as generateSecurePassword, H as hashPassword, I as registerDevEmailSink, J as getMagicLinkTemplate, K as getEmailOtpTemplate, L as SMTPEmailService, M as activeDevEmailSink, N as clearActiveDevEmailSink, O as createDataRateLimiter, P as createDevEmailSink, Q as resolveEmailBranding, R as createEmailService, S as pkceTokenParams, St as supportsRlsScoping, T as createBuiltinAuthAdapter, Tt as PUBLIC_STORAGE_PREFIX, U as validatePasswordStrength, V as resolveAuthHooks, W as verifyPassword, X as getUserInvitationTemplate, Y as getPasswordResetTemplate, Z as getWelcomeEmailTemplate, _ as verifyOidcIdToken, _t as validateApiKey, a as resolveRateLimitStoreKind, at as createRequireAuth, b as createGoogleProvider, bt as SERVICE_IDENTITY, c as createSlackProvider, ct as optionalAuth, d as createDiscordProvider, dt as requireAdmin, et as escapeHtml, f as createTwitterProvider, ft as requireAuth, g as tryVerifyOidcIdToken, gt as isApiKeyToken, h as createMicrosoftProvider, ht as createStorageApiKeyGuard, i as createApiKeyStore, it as createAuthMiddleware, j as MemoryRateLimitStore, k as createRateLimiter, l as createBitbucketProvider, lt as publicObjectAuth, m as createAppleProvider, mt as createFunctionApiKeyGuard, n as createCustomAuthAdapter, nt as raw, o as createSqlRateLimitStore, ot as extractUserFromToken, p as createFacebookProvider, pt as createApiKeyPreAuth, q as getEmailVerificationTemplate, r as createApiKeyRoutes, rt as createAdapterAuthMiddleware, s as createSpotifyProvider, st as fileTokenAuth, tt as html, u as createGitLabProvider, ut as queryTokenAuth, v as createGitHubProvider, vt as extractBearerToken, w as createJwksRoutes, wt as isOperationAllowed, x as oauthCodeFlowSchema, xt as scopeDataDriver, y as createLinkedinProvider, yt as safeCompare, z as assertEmailLinkBases } from "./auth-gzoRjnuh.js";
+import { $ as requireAdmin, A as defaultAuthLimiter, B as resolveEmailLinkBase, C as providerVerifiedEmail, Ct as raw, D as DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT, Dt as isPublicStoragePath, E as isBootstrapWindowOpen, Et as PUBLIC_STORAGE_PREFIX, F as extractLinks, G as createAdapterAuthMiddleware, H as hashPassword, I as registerDevEmailSink, J as extractUserFromToken, K as createAuthMiddleware, L as SMTPEmailService, M as activeDevEmailSink, N as clearActiveDevEmailSink, O as createDataRateLimiter, P as createDevEmailSink, Q as queryTokenAuth, R as createEmailService, S as pkceTokenParams, St as html, T as createBuiltinAuthAdapter, Tt as isOperationAllowed, U as validatePasswordStrength, V as resolveAuthHooks, W as verifyPassword, X as optionalAuth, Y as fileTokenAuth, Z as publicObjectAuth, _ as verifyOidcIdToken, _t as getUserInvitationTemplate, a as resolveRateLimitStoreKind, at as validateApiKey, b as createGoogleProvider, bt as RawHtml, c as createSlackProvider, ct as SERVICE_IDENTITY, d as createDiscordProvider, dt as completeUserCreation, et as requireAuth, f as createTwitterProvider, ft as generateSecurePassword, g as tryVerifyOidcIdToken, gt as getPasswordResetTemplate, h as createMicrosoftProvider, ht as getMagicLinkTemplate, i as createApiKeyStore, it as isApiKeyToken, j as MemoryRateLimitStore, k as createRateLimiter, l as createBitbucketProvider, lt as scopeDataDriver, m as createAppleProvider, mt as getEmailVerificationTemplate, n as createCustomAuthAdapter, nt as createFunctionApiKeyGuard, o as createSqlRateLimitStore, ot as extractBearerToken, p as createFacebookProvider, pt as getEmailOtpTemplate, q as createRequireAuth, r as createApiKeyRoutes, rt as createStorageApiKeyGuard, s as createSpotifyProvider, st as safeCompare, tt as createApiKeyPreAuth, u as createGitLabProvider, ut as supportsRlsScoping, v as createGitHubProvider, vt as getWelcomeEmailTemplate, w as createJwksRoutes, wt as httpMethodToOperation, x as oauthCodeFlowSchema, xt as escapeHtml, y as createLinkedinProvider, yt as resolveEmailBranding, z as assertEmailLinkBases } from "./auth-BS4WBA10.js";
 import { i as rawQueryLoggingEnabled, n as describeCauseChain, o as setLogLevel, r as logger, s as hostEnv } from "./logger-DO2PZc4i.js";
-import { n as errorHandler, r as schemaDriftRemedy, t as ApiError } from "./errors-DMImyqyR.js";
-import { a as resolveListLimitParam, c as HARD_DELETE_QUERY_PARAM, i as parseQueryOptions, l as parseHardDelete, n as parseAggregateSelect, o as assertReadableFields, r as parseGroupBy, s as requestViewer, t as orderByEntriesToTuples } from "./query-parser-uqzkZ82i.js";
+import { i as schemaDriftRemedy, n as declaredErrorAnswer, r as errorHandler, t as ApiError } from "./errors-DWsX4yTd.js";
+import { a as resolveListLimitParam, c as HARD_DELETE_QUERY_PARAM, i as parseQueryOptions, l as parseHardDelete, n as parseAggregateSelect, o as assertReadableFields, r as parseGroupBy, s as requestViewer, t as orderByEntriesToTuples } from "./query-parser-C-rl30ce.js";
 import { D as sha256Bytes, O as sha256Hex, S as normalizePemFromEnv, T as randomHex, _ as verifyAccessToken, a as generateMcpAccessToken, f as hasAsymmetricSigningKey, g as signPurposeToken, i as generateDownloadToken, l as getJwks, m as isJwtConfigured, n as configureJwt, w as constantTimeEqual, x as verifyPurposeToken, y as verifyMcpAccessToken } from "./jwt-C4OW-DNq.js";
 import { a as canonicalStorageKey, i as canonicalStorageId, n as InvalidStorageKeyError, r as canonicalStorageBucket, t as InvalidStorageBucketError } from "./keys-Qfc4XieN.js";
-import { t as logMiddleware } from "./logs-routes-DnJINsMu.js";
+import { t as logMiddleware } from "./logs-routes-3EEzPjhl.js";
 import { n as DOCUMENT_MIME_TYPES, r as IMAGE_MIME_TYPES, t as DEFAULT_MAX_FILE_SIZE } from "./types-BfKcm9do.js";
 import { t as S3StorageController } from "./S3StorageController-Dcuf8lMA.js";
 import { t as GCSStorageController } from "./GCSStorageController-CLIJXwGS.js";
 import { n as loadFunctionsFromDirectory, r as loadFunctionsWithDiagnostics } from "./function-loader-xnbDAPfa.js";
-import { a as getDriver, c as getUser, d as identityResolved, f as isAdmin, i as getApiKey, l as getUserId, m as requireDriver, o as getRequestId, p as isAuthenticated, r as requireRole, s as getRoles, t as createFunctionRoutes, u as hasRole } from "./function-routes-C4nB2h0z.js";
+import { a as getDriver, c as getUser, d as identityResolved, f as isAdmin, i as getApiKey, l as getUserId, m as requireDriver, o as getRequestId, p as isAuthenticated, r as requireRole, s as getRoles, t as createFunctionRoutes, u as hasRole } from "./function-routes-Chet4-lB.js";
 import "./proxy-Czngl3p9.js";
-import "./request-timeout-BR-OBwES.js";
+import "./request-timeout-C_4C2BeR.js";
 import { t as FunctionSelectionError } from "./selection-CRpqKUbt.js";
 import { n as loadCronJobsFromDirectory, r as loadCronJobsWithDiagnostics } from "./cron-loader-CQjvjpEw.js";
-import { r as validateCronExpression, t as CronScheduler } from "./cron-scheduler-D47tdB9T.js";
-import { t as createCronRoutes } from "./cron-routes-BamgO0Xr.js";
-import { t as createCronStore } from "./cron-store-yXOyIEmn.js";
-import { a as parseBackupTimestamp, i as parseBackupDestination, n as createBackupRoutes, o as readBackupBytes, r as listBackupObjects } from "./backup-DGu0v9Ku.js";
-import { a as currentAmbientTransaction, i as createJobStore, n as createJobQueue, r as defaultBackoff } from "./jobs-DZ8DLLcU.js";
-import { t as METRIC_SERIES } from "./history-store-C9EtGtoL.js";
+import { t as createCronRoutes } from "./cron-routes-B_wlLybo.js";
+import { t as createCronStore } from "./cron-store-Dp0X7zRB.js";
+import { a as parseBackupTimestamp, i as parseBackupDestination, n as createBackupRoutes, o as readBackupBytes, r as listBackupObjects } from "./backup-DzI9jLwc.js";
+import { a as currentAmbientTransaction, i as createJobStore, n as createJobQueue, r as defaultBackoff } from "./jobs-1IkI4Lle.js";
+import { t as METRIC_SERIES } from "./history-store-By2R_G1b.js";
 import { createHash, createSign, randomBytes } from "node:crypto";
 import * as fs$3 from "fs";
 import fs, { existsSync } from "fs";
@@ -116,26 +116,19 @@ var CollectionConfigError = class extends Error {
 /**
 * Read the unknown-key policy from the environment.
 *
-* `REBASE_STRICT_COLLECTION_CONFIG` accepts `error`/`strict`/`1`/`true` to
-* escalate, `off`/`0`/`false` to silence, and anything else warns.
+* `REBASE_STRICT_COLLECTION_CONFIG` accepts `error`/`strict` or any spelling of
+* yes to escalate, `none` or any spelling of no to silence, and anything else
+* warns. Yes and no are {@link parseEnvBoolean}'s, the same as every other
+* variable's.
 */
 function unknownKeyPolicyFromEnv(env = process.env) {
 	const raw = env.REBASE_STRICT_COLLECTION_CONFIG?.trim().toLowerCase();
 	if (!raw) return "warn";
-	if ([
-		"error",
-		"strict",
-		"1",
-		"true",
-		"yes"
-	].includes(raw)) return "error";
-	if ([
-		"off",
-		"0",
-		"false",
-		"no",
-		"none"
-	].includes(raw)) return "off";
+	if (raw === "error" || raw === "strict") return "error";
+	if (raw === "none") return "off";
+	const flag = parseEnvBoolean(raw);
+	if (flag === true) return "error";
+	if (flag === false) return "off";
 	return "warn";
 }
 var COLLECTION_KEYS = /* @__PURE__ */ new Set([
@@ -2031,11 +2024,11 @@ function createRoutedRealtimeService(opts) {
 			}
 			await fallback().handleClientMessage(clientId, message, authContext);
 		},
-		subscribeToCollection(subscriptionId, config, callback) {
-			forPath(config.path).subscribeToCollection(subscriptionId, config, callback);
+		subscribeToCollection(...args) {
+			forPath(args[1].path).subscribeToCollection(...args);
 		},
-		subscribeToOne(subscriptionId, config, callback) {
-			forPath(config.path).subscribeToOne(subscriptionId, config, callback);
+		subscribeToOne(...args) {
+			forPath(args[1].path).subscribeToOne(...args);
 		},
 		unsubscribe(subscriptionId) {
 			for (const p of all()) p.unsubscribe(subscriptionId);
@@ -4002,19 +3995,15 @@ var RestApiGenerator = class {
 					collection: resolvedCollection,
 					status: "new"
 				});
-				const result = prepared.hookHandledEmail ? {
-					temporaryPassword: prepared.clearPassword,
-					invitationSent: prepared.invitationSent
-				} : this.authAdapter.finalizeUserCreation ? await this.authAdapter.finalizeUserCreation({
+				const finalize = this.authAdapter.finalizeUserCreation?.bind(this.authAdapter);
+				const delivery = await completeUserCreation(prepared, finalize && ((clearPassword) => finalize({
 					id: entity.id,
 					values: entity
-				}, prepared.clearPassword) : { invitationSent: false };
+				}, clearPassword)));
 				const response = this.formatResponse(entity);
 				return c.json({
 					...response,
-					invitationSent: result.invitationSent,
-					...result.temporaryPassword ? { temporaryPassword: result.temporaryPassword } : {},
-					..."emailDeliveryFailed" in result && result.emailDeliveryFailed ? { emailDeliveryFailed: true } : {}
+					...delivery
 				}, 201);
 			}
 			return this.runIdempotent(c, body, async () => {
@@ -4123,8 +4112,7 @@ var RestApiGenerator = class {
 					hard: parseHardDelete(c.req.query(HARD_DELETE_QUERY_PARAM)),
 					row: {
 						id: String(id),
-						path: getCollectionDataPath(collection),
-						values: existingEntity
+						path: getCollectionDataPath(collection)
 					},
 					collection: resolvedCollection
 				});
@@ -4276,18 +4264,16 @@ var RestApiGenerator = class {
 			const driver = this.getScopedDriver(c);
 			this.enforceSubcollectionApiKeyPermission(c, parsed.collectionPath);
 			const hardDelete = parseHardDelete(c.req.query(HARD_DELETE_QUERY_PARAM));
-			const existingEntity = await driver.fetchOne({
+			if (!await driver.fetchOne({
 				path: parsed.collectionPath,
 				id: parsed.id,
 				withDeleted: hardDelete ? true : void 0
-			});
-			if (!existingEntity) throw this.entityNotFound(parsed.collectionPath, parsed.id);
+			})) throw this.entityNotFound(parsed.collectionPath, parsed.id);
 			await driver.delete({
 				hard: hardDelete,
 				row: {
 					id: parsed.id,
-					path: parsed.collectionPath,
-					values: existingEntity
+					path: parsed.collectionPath
 				}
 			});
 			return new Response(null, { status: 204 });
@@ -4653,19 +4639,190 @@ function requestLogger(options) {
 	};
 }
 //#endregion
+//#region src/deploy/pod-contract.ts
+/**
+* What every deployment of this runtime must get right about the pod.
+*
+* There are two things that place a Rebase runtime in Kubernetes — the Helm
+* chart in `infra/charts/rebase`, for self-hosting, and the control plane's
+* `buildManagedContainer`, for cloud tenants — and they were written months
+* apart by people solving different problems. Rendering both for the same unit
+* and diffing them (2026-08-22) turned up four disagreements, and in three of
+* them the chart was doing the thing this runtime's own source warns against.
+*
+* The disagreements were not in the parts that *should* differ. A managed pod
+* takes its environment from a tenant Secret and a self-hosted one takes it from
+* a values file; a managed pod is scheduled onto spot capacity its plan sold it
+* and a self-hosted one goes where the operator says. Those are different jobs
+* and they produce different manifests, correctly.
+*
+* What must not differ is anything that is really a statement about *this
+* process*: which endpoint answers what, which variables decide the topology,
+* where the bundle is mounted. Those are not deployment preferences. They are
+* facts about the runtime, and a deployment that gets one wrong produces a
+* cluster that looks healthy — which is why they are stated here, in the
+* runtime, rather than twice in the things that deploy it.
+*
+* The chart cannot import this module. `tooling/scripts/check-chart.mjs` renders the
+* chart and asserts it against these values instead, so the chart conforms by
+* gate where the control plane conforms by construction.
+*/
+/**
+* Endpoints this runtime guarantees on every role, and what each one means.
+*
+* `/livez` is dependency-free — it answers "this process is running" and
+* nothing else. `/health` opens the default driver and every configured
+* secondary, and **answers 503 when any of them is unreachable**
+* (`boot.ts`, the `healthPaths` handler).
+*
+* That difference is the whole reason both exist, and it is stated at the
+* `/livez` registration in `boot.ts`: "`/health` touches the database, so a
+* database blip would make an orchestrator kill an otherwise healthy process."
+*/
+var RUNTIME_HEALTH_PATH = "/health";
+var RUNTIME_LIVENESS_PATH = "/livez";
+/**
+* Which endpoint each Kubernetes probe must target.
+*
+* The rule follows from what the probe *does* when it fails:
+*
+* - **liveness** restarts the container. A database outage must therefore never
+*   fail it, or an unreachable database turns into a cluster-wide restart loop
+*   that clears the moment the database returns and looks, in the logs, like
+*   the application crashed. `/livez`.
+* - **readiness** removes the pod from its Service. That is exactly what should
+*   happen when the database is unreachable — the pod cannot serve. `/health`.
+* - **startup** decides when the other two begin. Its job is "has this process
+*   finished booting", and booting may include fetching a bundle, installing
+*   dependencies and checking the schema. It must not also require the database
+*   to be *up*, or a cold database is indistinguishable from a broken image:
+*   the pod never passes startup, liveness never gets to run, and the pod
+*   CrashLoops with nothing in its output about a database. `/livez`.
+*
+* A probe targeting the wrong one of these fails silently in the direction that
+* looks like an application bug, which is why this is a contract and not a
+* default.
+*/
+var RUNTIME_PROBE_PATHS = {
+	liveness: RUNTIME_LIVENESS_PATH,
+	readiness: RUNTIME_HEALTH_PATH,
+	startup: RUNTIME_LIVENESS_PATH
+};
+/**
+* Environment variables that decide *topology* — which surfaces a process
+* mounts, which singletons it owns, where it forwards.
+*
+* These are the platform's or the operator's decision expressed by the thing
+* doing the deploying, and they must never be settable by whoever supplies the
+* project's own environment. The cloud learned this the expensive way: a tenant
+* who set `REBASE_ROLE=worker` in their project variables got a pod that served
+* no HTTP at all, and because `/health` answers on **every** role the readiness
+* probe passed, the rollout reported success, and every request 404'd.
+*
+* Kubernetes only lets `env` shadow `envFrom` for names it **lists**, so
+* neutralising one of these means naming it explicitly. An empty value is read
+* by the runtime as unset, which is why the cloud pins most of them to `""`
+* rather than to a value: the entry exists to take the decision away from the
+* project, not to make it here.
+*/
+var TOPOLOGY_ENV_VARS = [
+	"REBASE_ROLE",
+	"REBASE_FUNCTIONS_ONLY",
+	"REBASE_FUNCTIONS_EXCLUDE",
+	"REBASE_FUNCTIONS_UPSTREAM",
+	"REBASE_CRON_SCHEDULER",
+	"REBASE_JOB_WORKERS",
+	"REBASE_RLS_AUDIT",
+	"REBASE_MCP_ENABLED",
+	"REBASE_MIGRATE_ON_BOOT",
+	"TRUSTED_PROXY_HOPS",
+	"REBASE_RATE_LIMIT_STORE",
+	"REBASE_REQUIRE_SCHEMA_MATCH"
+];
+/** Whether a variable name is one the deployer owns rather than the project. */
+function isTopologyEnvVar(name) {
+	return TOPOLOGY_ENV_VARS.includes(name);
+}
+/**
+* Seconds to keep answering after Kubernetes decides to remove this pod.
+*
+* `installShutdownHandlers` drains on SIGTERM — it stops the scheduler, tears
+* down realtime and closes the HTTP server, finishing what is in flight. What
+* it cannot do is stop *new* requests arriving: kubelet sends SIGTERM and the
+* endpoint controller removes the pod from its Service **concurrently**, so for
+* as long as endpoint removal takes to propagate, the ingress is still routing
+* to a process that has already stopped accepting connections.
+*
+* A `preStop` sleep is the only thing that orders those two. The pod keeps
+* serving for this long *before* SIGTERM is sent, which is time the ingress
+* uses to stop sending it anything.
+*
+* Anything greater than zero fixes the ordering; five seconds is what the
+* control plane has run in production.
+*/
+var RUNTIME_PRESTOP_DRAIN_SECONDS = 5;
+/**
+* The floor for `terminationGracePeriodSeconds`.
+*
+* The pod must outlive `preStop` *plus* the drain that follows it, or kubelet
+* SIGKILLs mid-drain and the graceful shutdown was decoration. The drain's own
+* default is 15s (`ShutdownHandlerOptions.timeoutMs`), and Kubernetes' default
+* grace period is 30s — so the stock configuration has room, and this exists to
+* say how much before someone raises the drain.
+*/
+var RUNTIME_MIN_TERMINATION_GRACE_SECONDS = 20;
+/**
+* How long a deployment must let this runtime take to answer for the first time.
+*
+* Nothing answers until boot is finished. `runFromBundle` binds the socket
+* **last** — after the bundle is read, the drivers connect and, on the process
+* that owns it, the schema DDL runs (`boot.ts`, "schema DDL happens during
+* boot, above"). So the gap between the container starting and `/livez`
+* answering is a whole provisioning run, not a framework warming up.
+*
+* A deployment with no startup probe measures that gap with its *liveness*
+* probe instead, and liveness restarts the container. On the control plane's
+* settings that is 20s of grace plus three 20s failures — 80 seconds — after
+* which a slow first boot is killed and retried, and each retry starts from the
+* beginning. It does not converge; it loops, and the logs show a pod that never
+* finished starting rather than a database that was slow.
+*
+* So a startup probe is not optional here, and its budget is this. A healthy
+* pod passes it on the first check and nothing is spent.
+*/
+var RUNTIME_STARTUP_BUDGET_SECONDS = 300;
+/** Where a bundle is mounted, and what the runtime is told to read. */
+var RUNTIME_BUNDLE_MOUNT = "/bundle";
+/**
+* The request-body limit every API route has by default (`maxBodySize`,
+* `REBASE_MAX_BODY_SIZE`), in bytes.
+*
+* It is not the largest body the runtime accepts. `POST /storage/upload` is
+* exempt from it and meets the storage config's `maxFileSize` instead, whose
+* default is `DEFAULT_MAX_FILE_SIZE` (`storage/types.ts`), 50 MB. A proxy in
+* front of the runtime has to allow more than the larger of the two. Otherwise
+* it refuses uploads the runtime would accept, with its own error page in
+* place of the runtime's JSON 413. The chart's ingress was left at 12m after
+* the upload route got its own limit, and admin-panel uploads between 12 and
+* 50 MB failed that way.
+*/
+var RUNTIME_DEFAULT_MAX_BODY_SIZE = 10 * 1024 * 1024;
+//#endregion
 //#region src/init/middlewares.ts
 function configureMiddlewares(app, basePath, isProduction, config) {
+	const carriesOwnBodyLimit = /* @__PURE__ */ new Set();
 	app.use(`${basePath}/*`, requestId());
 	if (config.compression !== false) {
 		app.use(`${basePath}/*`, responseCompression());
 		logger.debug("Response compression enabled");
 	}
-	const maxBodySize = config.maxBodySize ?? 10 * 1024 * 1024;
+	const maxBodySize = config.maxBodySize ?? 10485760;
 	if (maxBodySize > 0) {
-		app.use(`${basePath}/*`, bodyLimit({
+		const limitBody = bodyLimit({
 			maxSize: maxBodySize,
 			onError: (c) => errorHandler(new ApiError(413, "PAYLOAD_TOO_LARGE", `Request body too large. Maximum size is ${Math.round(maxBodySize / 1024 / 1024)}MB.`), c)
-		}));
+		});
+		app.use(`${basePath}/*`, (c, next) => carriesOwnBodyLimit.has(c.req.path) ? next() : limitBody(c, next));
 		logger.debug("Request body limit configured", { maxSizeMB: Math.round(maxBodySize / 1024 / 1024) });
 	}
 	if (config.csrf?.origin) {
@@ -4675,6 +4832,9 @@ function configureMiddlewares(app, basePath, isProduction, config) {
 	if (!config.corsHandled && !process.env.CORS_ORIGINS && !process.env.FRONTEND_URL) logger.warn((isProduction ? "[PRODUCTION] " : "") + "No CORS configuration detected (CORS_ORIGINS / FRONTEND_URL not set). If your app does not install its own CORS middleware, the API may accept requests from any origin. Set CORS_ORIGINS to restrict access.");
 	app.use(`${basePath}/*`, requestLogger());
 	app.use(`${basePath}/*`, logMiddleware({ ignorePaths: [`${basePath}/logs/stream`] }));
+	return { exemptFromBodyLimit: (path) => {
+		carriesOwnBodyLimit.add(path);
+	} };
 }
 //#endregion
 //#region src/storage/LocalStorageController.ts
@@ -7013,6 +7173,25 @@ async function createStorageController(config) {
 }
 //#endregion
 //#region src/init/storage.ts
+/**
+* Whether `FORCE_LOCAL_STORAGE` says a durable volume is mounted, so a `local`
+* backend may serve in production.
+*
+* The one reader of the variable: this guard and the `bucket` resolver that
+* `rebase status` asks both call it, so status cannot promise a backend boot
+* is about to drop. It used to be `!process.env.FORCE_LOCAL_STORAGE` in both,
+* which is a test for "set", not for "true" — `FORCE_LOCAL_STORAGE=false` and
+* `=0` read as forced, and the guard stood down for the operator who had just
+* said there was no volume.
+*
+* Only an explicit yes forces. `loadEnv` parses the variable to the same
+* boolean and refuses a value outside `true`/`false`/blank before storage is
+* initialised; this reads the raw environment because a backend assembled
+* without `loadEnv` still has to get the same answer.
+*/
+function localStorageForced(env = process.env) {
+	return parseEnvBoolean(env.FORCE_LOCAL_STORAGE) === true;
+}
 async function initializeStorage(storageConfig, isProduction) {
 	if (!storageConfig) return {};
 	logger.debug("Configuring storage");
@@ -7020,7 +7199,7 @@ async function initializeStorage(storageConfig, isProduction) {
 	const toController = async (entry, label) => {
 		if (typeof entry.putObject === "function") return entry;
 		const conf = entry;
-		if (isProduction && conf.type === "local" && !process.env.FORCE_LOCAL_STORAGE) {
+		if (isProduction && conf.type === "local" && !localStorageForced()) {
 			logger.error(`Storage backend "${label}" is set to "local" in production — DISABLED. Local storage is the container filesystem, so uploaded files would be destroyed on the next restart or redeploy. File uploads will be refused until storage is configured: set S3-compatible storage (STORAGE_TYPE=s3) or GCS (STORAGE_TYPE=gcs), or pass a custom StorageController. If this deployment really does have a durable volume mounted at the storage path, set FORCE_LOCAL_STORAGE=true.`);
 			return;
 		}
@@ -7200,7 +7379,7 @@ async function mountOpenApiDocs(app, basePath, enableSwagger, serverCollections,
 		basePath,
 		requireAuth
 	}));
-	const { generateOpenApiSpec } = await import("./openapi-generator-CAFKF36E.js");
+	const { generateOpenApiSpec } = await import("./openapi-generator-BDpoKZQ9.js");
 	generateOpenApiSpecFn = generateOpenApiSpec;
 	if (isPublic) app.get(`${basePath}/docs`, (c) => spec(c));
 	else app.get(`${basePath}/docs`, createRequireAuth({}), requireAdmin, (c) => spec(c));
@@ -8688,7 +8867,7 @@ var HANDLER_SLOT = Symbol.for("@rebasepro/server:unhandled-rejection-handler");
 * was installed.
 */
 function installUnhandledRejectionHandler() {
-	if (process.env.REBASE_EXIT_ON_UNHANDLED_REJECTION === "1") return void 0;
+	if (parseEnvBoolean(process.env.REBASE_EXIT_ON_UNHANDLED_REJECTION) === true) return void 0;
 	const slot = globalThis;
 	if (slot[HANDLER_SLOT]) return void 0;
 	const handler = (reason) => {
@@ -13039,6 +13218,20 @@ function extractMessageError(message) {
 	};
 }
 /**
+* The error an `ERROR` frame describes, with the server's `details` when it
+* sent them — `{ stage, path }` for a collection-callback refusal, the object
+* the REST envelope carries for the same veto. `status` stays `undefined`:
+* a frame is not an HTTP response (see `RebaseErrorInit.status`).
+*/
+function frameError(message) {
+	const { errorMessage, errorCode } = extractMessageError(message);
+	const errPayload = message.payload?.error;
+	return new RebaseApiError(errorMessage, {
+		code: errorCode,
+		details: typeof errPayload === "object" && errPayload !== null ? errPayload.details : void 0
+	});
+}
+/**
 * Broadcast and presence frames.
 *
 * Fire-and-forget (the server sends no response envelope), and exempt from the
@@ -13432,8 +13625,7 @@ var RebaseWebSocketClient = class {
 				else this.sendEntitySubscribe(subscriptionKey);
 				return;
 			}
-			const { errorMessage, errorCode } = extractMessageError(message);
-			const error = new RebaseApiError(errorMessage, { code: errorCode });
+			const error = frameError(message);
 			if (messageType === "subscribe_collection") this.failCollectionSubscription(subscriptionKey, error);
 			else this.failEntitySubscription(subscriptionKey, error);
 		}).catch((err) => {
@@ -13450,17 +13642,13 @@ var RebaseWebSocketClient = class {
 				this.pendingRequests.delete(requestId);
 				this.handleAuthFailure().then((refreshed) => {
 					if (refreshed && pendingReq.message) this.doSendMessage(pendingReq.message, pendingReq.resolve, pendingReq.reject).catch(pendingReq.reject);
-					else {
-						const { errorMessage, errorCode } = extractMessageError(message);
-						pendingReq.reject(new RebaseApiError(errorMessage, { code: errorCode }));
-					}
+					else pendingReq.reject(frameError(message));
 				}).catch((err) => {
 					pendingReq.reject(err);
 				});
 			} else {
 				this.pendingRequests.delete(requestId);
-				const { errorMessage, errorCode } = extractMessageError(message);
-				pendingReq.reject(new RebaseApiError(errorMessage, { code: errorCode }));
+				pendingReq.reject(frameError(message));
 			}
 			else {
 				this.pendingRequests.delete(requestId);
@@ -13544,8 +13732,7 @@ var RebaseWebSocketClient = class {
 					if (collectionSub.subscribeTimeout) clearTimeout(collectionSub.subscribeTimeout);
 					collectionSub.subscribeTimeout = void 0;
 					collectionSub.subscribeInFlight = false;
-					const { errorMessage, errorCode } = extractMessageError(message);
-					const error = new RebaseApiError(errorMessage, { code: errorCode });
+					const error = frameError(message);
 					collectionSub.callbacks.forEach((callback) => {
 						if (callback.onError) callback.onError(error);
 					});
@@ -13563,8 +13750,7 @@ var RebaseWebSocketClient = class {
 					if (entitySub.subscribeTimeout) clearTimeout(entitySub.subscribeTimeout);
 					entitySub.subscribeTimeout = void 0;
 					entitySub.subscribeInFlight = false;
-					const { errorMessage, errorCode } = extractMessageError(message);
-					const error = new RebaseApiError(errorMessage, { code: errorCode });
+					const error = frameError(message);
 					entitySub.callbacks.forEach((callback) => {
 						if (callback.onError) callback.onError(error);
 					});
@@ -18005,10 +18191,16 @@ function readAccountVar(env, base, suffix, accountSuffix) {
 	if (own !== void 0 || accountSuffix === void 0) return own;
 	return readVar(env, base, accountSuffix);
 }
+/**
+* A boolean binding, spelled the way every other variable is.
+*
+* `undefined` when unset or unrecognised, which the S3 controller reads as
+* "decide from the endpoint". An exact `=== "true"` used to turn `=1` into an
+* explicit `false`, switching path-style off for a MinIO endpoint whose
+* default would have switched it on.
+*/
 function readAccountBool(env, base, suffix, accountSuffix) {
-	const raw = readAccountVar(env, base, suffix, accountSuffix);
-	if (raw === void 0) return void 0;
-	return raw === "true";
+	return parseEnvBoolean(readAccountVar(env, base, suffix, accountSuffix));
 }
 /**
 * Guard against two distinct keys collapsing onto the same variable name.
@@ -18330,7 +18522,7 @@ var bucketResolver = {
 			standsIn: config.standsInFor,
 			detail: `${config.standsInFor} declared and unbound; a local directory stands in, in development only`
 		};
-		if (config.type === "local") return context.production && !env.FORCE_LOCAL_STORAGE ? {
+		if (config.type === "local") return context.production && !localStorageForced(env) ? {
 			state: "unbound",
 			detail: "local storage is dropped in production — a container's filesystem is erased on restart. Bind an object store, or set FORCE_LOCAL_STORAGE=true on a durable volume."
 		} : {
@@ -18649,7 +18841,7 @@ async function _initializeRebaseBackend(config) {
 	});
 	installRootErrorHandler(config.app);
 	installUnmatchedApiEnvelope(config.app, basePath);
-	configureMiddlewares(config.app, basePath, isProduction, config);
+	const middlewares = configureMiddlewares(config.app, basePath, isProduction, config);
 	const collectionRegistry = new BackendCollectionRegistry();
 	const dataSourceRegistry = createDataSourceRegistry(declaredDataSources.length > 0 ? declaredDataSources : void 0);
 	collectionRegistry.setDataSources(dataSourceRegistry);
@@ -18979,7 +19171,7 @@ async function _initializeRebaseBackend(config) {
 			]) {
 				const providerConfig = safeAuthConfig[key];
 				if (providerConfig && requiredFields.every((f) => Boolean(providerConfig[f]))) {
-					const createFn = (await import("./auth-gzoRjnuh.js").then((n) => n.t))[factory];
+					const createFn = (await import("./auth-BS4WBA10.js").then((n) => n.t))[factory];
 					oauthProviders.push(createFn(providerConfig));
 				}
 			}
@@ -19070,7 +19262,7 @@ async function _initializeRebaseBackend(config) {
 						publicUrl,
 						mcpPath,
 						authBasePath: `${basePath}/auth`,
-						allowDynamicRegistration: process.env.REBASE_MCP_OPEN_REGISTRATION !== "false"
+						allowDynamicRegistration: parseEnvBoolean(process.env.REBASE_MCP_OPEN_REGISTRATION) !== false
 					}));
 					logger.info(`MCP endpoint mounted at ${publicUrl}${mcpPath} (OAuth at ${oauthBasePath})`);
 				}
@@ -19134,7 +19326,7 @@ async function _initializeRebaseBackend(config) {
 	let schemaEditorOff = schemaEditorUnavailable();
 	let schemaEditorRoutes;
 	if (!schemaEditorOff && config.collectionsDir) try {
-		schemaEditorRoutes = (await import("./schema-editor-routes-BKOmdf4M.js")).createSchemaEditorRoutes(config.collectionsDir);
+		schemaEditorRoutes = (await import("./schema-editor-routes-DdLihzp0.js")).createSchemaEditorRoutes(config.collectionsDir);
 	} catch (err) {
 		if (err?.code === "ERR_MODULE_NOT_FOUND") {
 			schemaEditorOff = {
@@ -19182,7 +19374,7 @@ async function _initializeRebaseBackend(config) {
 				commitPaths,
 				sourceEditingOff: schemaEditorOff,
 				usesVersionedMigrations: collectionsDir ? () => usesVersionedMigrations(collectionsDir) : void 0,
-				policy: { allowMachineApply: config.liveSchema?.allowMachineApply ?? process.env.REBASE_LIVE_SCHEMA_ALLOW_MACHINE_APPLY === "true" },
+				policy: { allowMachineApply: config.liveSchema?.allowMachineApply ?? parseEnvBoolean(process.env.REBASE_LIVE_SCHEMA_ALLOW_MACHINE_APPLY) === true },
 				getCollections: () => collectionRegistry.getRawCollections(),
 				getAdmin: () => defaultDriver.admin,
 				getRepository: (author) => {
@@ -19247,7 +19439,7 @@ async function _initializeRebaseBackend(config) {
 	}
 	const storageAuthorizeData = {};
 	if (storageController) {
-		const storageMaxSize = (config.storage && typeof config.storage === "object" && "type" in config.storage ? config.storage.maxFileSize : void 0) ?? 50 * 1024 * 1024;
+		const storageMaxSize = (config.storage && typeof config.storage === "object" && "type" in config.storage ? config.storage.maxFileSize : void 0) ?? 52428800;
 		const storageAccessControl = resolveStorageAccessControl({
 			storagePolicies: config.storagePolicies,
 			storageAuthorize: config.storageAuthorize,
@@ -19275,12 +19467,16 @@ async function _initializeRebaseBackend(config) {
 		const storageRouter = new Hono();
 		if (apiKeyPreAuth) storageRouter.use("/*", apiKeyPreAuth, createStorageApiKeyGuard());
 		if (rateLimitConfig) storageRouter.use("/*", createDataRateLimiter(rateLimitConfig));
-		storageRouter.use("/upload", bodyLimit({
+		const uploadPath = "/upload";
+		storageRouter.use(uploadPath, bodyLimit({
 			maxSize: storageMaxSize,
 			onError: (c) => errorHandler(new ApiError(413, "PAYLOAD_TOO_LARGE", `File too large. Maximum upload size is ${Math.round(storageMaxSize / 1024 / 1024)}MB.`), c)
 		}));
 		storageRouter.route("/", storageRoutes);
-		if (surfaces.storage) config.app.route(`${basePath}/storage`, storageRouter);
+		if (surfaces.storage) {
+			config.app.route(`${basePath}/storage`, storageRouter);
+			middlewares.exemptFromBodyLimit(`${basePath}/storage${uploadPath}`);
+		}
 	} else {
 		const storageStub = new Hono();
 		storageStub.all("/*", (c) => c.json({ error: {
@@ -19424,8 +19620,8 @@ async function _initializeRebaseBackend(config) {
 	injectCallbackClient(driverResults.values(), serverClient);
 	if (config.functionsDir && surfaces.functions) {
 		const { loadFunctionsWithDiagnostics } = await import("./function-loader-xnbDAPfa.js").then((n) => n.t);
-		const { createFunctionRoutes } = await import("./function-routes-C4nB2h0z.js").then((n) => n.n);
-		const { createFunctionsRequestTimeout, resolveFunctionsTimeoutMs } = await import("./request-timeout-BR-OBwES.js").then((n) => n.t);
+		const { createFunctionRoutes } = await import("./function-routes-Chet4-lB.js").then((n) => n.n);
+		const { createFunctionsRequestTimeout, resolveFunctionsTimeoutMs } = await import("./request-timeout-C_4C2BeR.js").then((n) => n.t);
 		const { functions: allFunctions, problems } = await loadFunctionsWithDiagnostics(config.functionsDir);
 		const { selectFunctions } = await import("./selection-CRpqKUbt.js").then((n) => n.n);
 		const loadedFunctions = selectFunctions(allFunctions, config.functionsSelection);
@@ -19479,9 +19675,9 @@ async function _initializeRebaseBackend(config) {
 	let cronScheduler;
 	if (surfaces.cron || config.cronsDir && ownership.cronScheduler) {
 		const { loadCronJobsWithDiagnostics } = await import("./cron-loader-CQjvjpEw.js").then((n) => n.t);
-		const { CronScheduler } = await import("./cron-scheduler-D47tdB9T.js").then((n) => n.n);
-		const { createCronRoutes } = await import("./cron-routes-BamgO0Xr.js").then((n) => n.n);
-		const { createCronStore } = await import("./cron-store-yXOyIEmn.js").then((n) => n.n);
+		const { CronScheduler } = await import("./cron-scheduler-COPQxlEq.js").then((n) => n.n);
+		const { createCronRoutes } = await import("./cron-routes-B_wlLybo.js").then((n) => n.n);
+		const { createCronStore } = await import("./cron-store-Dp0X7zRB.js").then((n) => n.n);
 		const { jobs: loadedCronJobs, problems: cronProblems } = config.cronsDir ? await loadCronJobsWithDiagnostics(config.cronsDir) : {
 			jobs: [],
 			problems: []
@@ -19538,7 +19734,7 @@ async function _initializeRebaseBackend(config) {
 	}
 	let metricsHistory;
 	try {
-		const { createMetricsHistory } = await import("./history-recorder-hBGuXcZc.js");
+		const { createMetricsHistory } = await import("./history-recorder-5VKT7nss.js");
 		metricsHistory = createMetricsHistory(defaultDriver);
 		if (metricsHistory) {
 			await metricsHistory.ensure();
@@ -19550,7 +19746,7 @@ async function _initializeRebaseBackend(config) {
 	}
 	let jobQueue;
 	if (config.jobs?.enabled) {
-		const { createJobStore, createJobQueue } = await import("./jobs-DZ8DLLcU.js").then((n) => n.t);
+		const { createJobStore, createJobQueue } = await import("./jobs-1IkI4Lle.js").then((n) => n.t);
 		const store = createJobStore(defaultDriver);
 		if (store) {
 			await store.ensureTable();
@@ -19576,7 +19772,7 @@ Use a driver that supports the job queue, or remove the declarations. Refusing t
 	}
 	let rlsAudit;
 	if (surfaces.admin) {
-		const { createBackupRoutes, parseBackupDestination } = await import("./backup-DGu0v9Ku.js").then((n) => n.t);
+		const { createBackupRoutes, parseBackupDestination } = await import("./backup-DzI9jLwc.js").then((n) => n.t);
 		const backupRouter = new Hono();
 		applyAdminGate(backupRouter, "Backup");
 		backupRouter.route("/", createBackupRoutes({
@@ -19624,7 +19820,7 @@ Use a driver that supports the job queue, or remove the declarations. Refusing t
 		logger.debug("Development mailbox admin routes mounted", { path: `${basePath}/admin/dev/emails` });
 	}
 	if (surfaces.admin) {
-		const { default: logsRoutes } = await import("./logs-routes-DnJINsMu.js").then((n) => n.n);
+		const { default: logsRoutes } = await import("./logs-routes-3EEzPjhl.js").then((n) => n.n);
 		const logsRouter = new Hono();
 		applyAdminGate(logsRouter, "Logs");
 		logsRouter.route("/", logsRoutes);
@@ -20860,7 +21056,7 @@ function listenWithPortRetry(server, startPort, options) {
 	const host = options?.host ?? "0.0.0.0";
 	const maxAttempts = options?.maxAttempts ?? MAX_PORT_ATTEMPTS;
 	const portFileDir = options?.portFileDir;
-	const explicit = options?.explicit ?? process.env.REBASE_DEV_PORT_EXPLICIT === "true";
+	const explicit = options?.explicit ?? parseEnvBoolean(process.env.REBASE_DEV_PORT_EXPLICIT) === true;
 	if (process.env.NODE_ENV === "production") return new Promise((resolve, reject) => {
 		const onError = (err) => {
 			reject(err);
@@ -23291,7 +23487,7 @@ async function bootStaticApp(bundle, devRoot, options) {
 	const isProduction = process.env.NODE_ENV === "production";
 	const requestedPort = Number(process.env.PORT ?? "3001") || 3001;
 	const basePath = process.env.REBASE_BASE_PATH || "/api";
-	const metricsEnabled = process.env.REBASE_METRICS === "true";
+	const metricsEnabled = parseEnvBoolean(process.env.REBASE_METRICS) === true;
 	const metricsToken = process.env.REBASE_METRICS_TOKEN;
 	const app = new Hono();
 	installRootErrorHandler(app);
@@ -23511,161 +23707,6 @@ function warnOnUnusableBundleShape(bundle) {
 	logger.warn(`This bundle declares collections at "${bundle.manifest.entry.collections}", but that directory did not resolve, so no collections were loaded and no tables will be created. Rebuild with \`rebase build\`.`);
 }
 //#endregion
-//#region src/deploy/pod-contract.ts
-/**
-* What every deployment of this runtime must get right about the pod.
-*
-* There are two things that place a Rebase runtime in Kubernetes — the Helm
-* chart in `infra/charts/rebase`, for self-hosting, and the control plane's
-* `buildManagedContainer`, for cloud tenants — and they were written months
-* apart by people solving different problems. Rendering both for the same unit
-* and diffing them (2026-08-22) turned up four disagreements, and in three of
-* them the chart was doing the thing this runtime's own source warns against.
-*
-* The disagreements were not in the parts that *should* differ. A managed pod
-* takes its environment from a tenant Secret and a self-hosted one takes it from
-* a values file; a managed pod is scheduled onto spot capacity its plan sold it
-* and a self-hosted one goes where the operator says. Those are different jobs
-* and they produce different manifests, correctly.
-*
-* What must not differ is anything that is really a statement about *this
-* process*: which endpoint answers what, which variables decide the topology,
-* where the bundle is mounted. Those are not deployment preferences. They are
-* facts about the runtime, and a deployment that gets one wrong produces a
-* cluster that looks healthy — which is why they are stated here, in the
-* runtime, rather than twice in the things that deploy it.
-*
-* The chart cannot import this module. `tooling/scripts/check-chart.mjs` renders the
-* chart and asserts it against these values instead, so the chart conforms by
-* gate where the control plane conforms by construction.
-*/
-/**
-* Endpoints this runtime guarantees on every role, and what each one means.
-*
-* `/livez` is dependency-free — it answers "this process is running" and
-* nothing else. `/health` opens the default driver and every configured
-* secondary, and **answers 503 when any of them is unreachable**
-* (`boot.ts`, the `healthPaths` handler).
-*
-* That difference is the whole reason both exist, and it is stated at the
-* `/livez` registration in `boot.ts`: "`/health` touches the database, so a
-* database blip would make an orchestrator kill an otherwise healthy process."
-*/
-var RUNTIME_HEALTH_PATH = "/health";
-var RUNTIME_LIVENESS_PATH = "/livez";
-/**
-* Which endpoint each Kubernetes probe must target.
-*
-* The rule follows from what the probe *does* when it fails:
-*
-* - **liveness** restarts the container. A database outage must therefore never
-*   fail it, or an unreachable database turns into a cluster-wide restart loop
-*   that clears the moment the database returns and looks, in the logs, like
-*   the application crashed. `/livez`.
-* - **readiness** removes the pod from its Service. That is exactly what should
-*   happen when the database is unreachable — the pod cannot serve. `/health`.
-* - **startup** decides when the other two begin. Its job is "has this process
-*   finished booting", and booting may include fetching a bundle, installing
-*   dependencies and checking the schema. It must not also require the database
-*   to be *up*, or a cold database is indistinguishable from a broken image:
-*   the pod never passes startup, liveness never gets to run, and the pod
-*   CrashLoops with nothing in its output about a database. `/livez`.
-*
-* A probe targeting the wrong one of these fails silently in the direction that
-* looks like an application bug, which is why this is a contract and not a
-* default.
-*/
-var RUNTIME_PROBE_PATHS = {
-	liveness: RUNTIME_LIVENESS_PATH,
-	readiness: RUNTIME_HEALTH_PATH,
-	startup: RUNTIME_LIVENESS_PATH
-};
-/**
-* Environment variables that decide *topology* — which surfaces a process
-* mounts, which singletons it owns, where it forwards.
-*
-* These are the platform's or the operator's decision expressed by the thing
-* doing the deploying, and they must never be settable by whoever supplies the
-* project's own environment. The cloud learned this the expensive way: a tenant
-* who set `REBASE_ROLE=worker` in their project variables got a pod that served
-* no HTTP at all, and because `/health` answers on **every** role the readiness
-* probe passed, the rollout reported success, and every request 404'd.
-*
-* Kubernetes only lets `env` shadow `envFrom` for names it **lists**, so
-* neutralising one of these means naming it explicitly. An empty value is read
-* by the runtime as unset, which is why the cloud pins most of them to `""`
-* rather than to a value: the entry exists to take the decision away from the
-* project, not to make it here.
-*/
-var TOPOLOGY_ENV_VARS = [
-	"REBASE_ROLE",
-	"REBASE_FUNCTIONS_ONLY",
-	"REBASE_FUNCTIONS_EXCLUDE",
-	"REBASE_FUNCTIONS_UPSTREAM",
-	"REBASE_CRON_SCHEDULER",
-	"REBASE_JOB_WORKERS",
-	"REBASE_RLS_AUDIT",
-	"REBASE_MCP_ENABLED",
-	"REBASE_MIGRATE_ON_BOOT",
-	"TRUSTED_PROXY_HOPS",
-	"REBASE_RATE_LIMIT_STORE",
-	"REBASE_REQUIRE_SCHEMA_MATCH"
-];
-/** Whether a variable name is one the deployer owns rather than the project. */
-function isTopologyEnvVar(name) {
-	return TOPOLOGY_ENV_VARS.includes(name);
-}
-/**
-* Seconds to keep answering after Kubernetes decides to remove this pod.
-*
-* `installShutdownHandlers` drains on SIGTERM — it stops the scheduler, tears
-* down realtime and closes the HTTP server, finishing what is in flight. What
-* it cannot do is stop *new* requests arriving: kubelet sends SIGTERM and the
-* endpoint controller removes the pod from its Service **concurrently**, so for
-* as long as endpoint removal takes to propagate, the ingress is still routing
-* to a process that has already stopped accepting connections.
-*
-* A `preStop` sleep is the only thing that orders those two. The pod keeps
-* serving for this long *before* SIGTERM is sent, which is time the ingress
-* uses to stop sending it anything.
-*
-* Anything greater than zero fixes the ordering; five seconds is what the
-* control plane has run in production.
-*/
-var RUNTIME_PRESTOP_DRAIN_SECONDS = 5;
-/**
-* The floor for `terminationGracePeriodSeconds`.
-*
-* The pod must outlive `preStop` *plus* the drain that follows it, or kubelet
-* SIGKILLs mid-drain and the graceful shutdown was decoration. The drain's own
-* default is 15s (`ShutdownHandlerOptions.timeoutMs`), and Kubernetes' default
-* grace period is 30s — so the stock configuration has room, and this exists to
-* say how much before someone raises the drain.
-*/
-var RUNTIME_MIN_TERMINATION_GRACE_SECONDS = 20;
-/**
-* How long a deployment must let this runtime take to answer for the first time.
-*
-* Nothing answers until boot is finished. `runFromBundle` binds the socket
-* **last** — after the bundle is read, the drivers connect and, on the process
-* that owns it, the schema DDL runs (`boot.ts`, "schema DDL happens during
-* boot, above"). So the gap between the container starting and `/livez`
-* answering is a whole provisioning run, not a framework warming up.
-*
-* A deployment with no startup probe measures that gap with its *liveness*
-* probe instead, and liveness restarts the container. On the control plane's
-* settings that is 20s of grace plus three 20s failures — 80 seconds — after
-* which a slow first boot is killed and retried, and each retry starts from the
-* beginning. It does not converge; it loops, and the logs show a pod that never
-* finished starting rather than a database that was slow.
-*
-* So a startup probe is not optional here, and its budget is this. A healthy
-* pod passes it on the first check and nothing is spent.
-*/
-var RUNTIME_STARTUP_BUDGET_SECONDS = 300;
-/** Where a bundle is mounted, and what the runtime is told to read. */
-var RUNTIME_BUNDLE_MOUNT = "/bundle";
-//#endregion
-export { ACCOUNT_SCOPED_STORAGE_BASES, ApiError, BATCH_REF_KEY, BlockedUrlError, BundleError, CONCURRENT_DDL_SQLSTATES, CollectionConfigError, CronScheduler, DEFAULT_DRIVER_ID, DEFAULT_MAX_FILE_SIZE, DEFAULT_STORAGE_ID, DOCUMENT_MIME_TYPES, DefaultDriverRegistry, DefaultStorageRegistry, ETAG_HEADER, FIELD_OPERATORS, GCSStorageController, IF_MATCH_HEADER, IMAGE_MIME_TYPES, LocalStorageController, MetricsRegistry, RUNTIME_BUNDLE_MOUNT, RUNTIME_HEALTH_PATH, RUNTIME_LIVENESS_PATH, RUNTIME_MIN_TERMINATION_GRACE_SECONDS, RUNTIME_PRESTOP_DRAIN_SECONDS, RUNTIME_PROBE_PATHS, RUNTIME_STARTUP_BUDGET_SECONDS, RawHtml, S3StorageController, SMTPEmailService, StoragePolicyError, TOPOLOGY_ENV_VARS, TransformCache, TusHandler, UPLOAD_COLLECTION_FIELD, UPLOAD_PROPERTY_FIELD, UnknownStorageSourceError, WEBHOOK_DELIVERY_TASK, WebhookDispatcher, _resetRebaseMock, _setRebaseMock, activeDevEmailSink, applyCollectionDefaults, assertAllowedOutboundUrl, assertCollectionConfigs, assertDistinctSuffixes, assertEmailLinkBases, assertEveryKindBindable, assertFieldOpsValid, assertIfMatch, assertNoFieldOpsOnCreate, assertUploadWithinPropertyLimits, assertWriteRequestValid, authJwt, authRoles, authUid, blockedAddressReason, bootFromBundle, classifySurface, cleanupDevPortFile, clearActiveDevEmailSink, compileStoragePolicies, configureJwt, createAppleProvider, createBackupRoutes, createBitbucketProvider, createBuiltinAuthAdapter, createContractRoutes, createCronRoutes, createCronStore, createCustomAuthAdapter, createDdlBootstrapper, createDevEmailSink, createDiscordProvider, createEmailService, createFacebookProvider, createFunctionRoutes, createGitHubProvider, createGitLabProvider, createGoogleProvider, createHistoryRoutes, createJobQueue, createJobStore, createJwksRoutes, createLinkedinProvider, createMetricsMiddleware, createMetricsRoutes, createMicrosoftProvider, createRlsAudit, createSlackProvider, createSourceBundle, createSpotifyProvider, createStorageController, createStorageRoutes, createTwitterProvider, createUnconfiguredEmailService, createUploadConstraintResolver, declaredUniqueTargets, defaultBackoff, defineCron, defineFunction, drainBackgroundWork, envSuffixForKey, errorHandler, escapeHtml, extractLinks, extractUserFromToken, fileTokenAuth, findCollectionConfigProblems, generateSecurePassword, getApiKey, getDriver, getEmailOtpTemplate, getEmailVerificationTemplate, getEnv, getJwks, getMagicLinkTemplate, getPasswordResetTemplate, getRequestId, getRoles, getUser, getUserId, getUserInvitationTemplate, getWelcomeEmailTemplate, hasAsymmetricSigningKey, hasFieldOps, hasRole, hashPassword, html, httpMethodToOperation, identityResolved, implicitDeclaration, initializeDataSource, initializeDataSources, initializeRebaseBackend, installShutdownHandlers, isAcceptedFile, isAdmin, isApiKeyToken, isAuthAdapter, isAuthenticated, isConcurrentDdlRace, isDatabaseAdapter, isDuplicateObjectRace, isLocalhostOrigin, isNodeRuntime, isOperationAllowed, isTopologyEnvVar, isTransformableImage, isUncountedPath, lazyResource, listBackupObjects, listenWithPortRetry, loadBootEnv, loadBundle, loadBundleConfigExports, loadBundleSchema, loadCollectionsFromDirectory, loadCronJobsFromDirectory, loadCronJobsWithDiagnostics, loadEnv, loadFunctionsFromDirectory, loadFunctionsWithDiagnostics, loadUsersCollection, logger, looksLikeFieldOp, oauthCodeFlowSchema, optionalAuth, parseBackupDestination, parseBackupTimestamp, parseFieldOp, parseTransformOptions, pendingBackgroundWork, pkceTokenParams, providerVerifiedEmail, queryTokenAuth, raw, rawQueryLoggingEnabled, readBackupBytes, readBundleManifest, readUploadPropertyContext, rebase, registerDevEmailSink, registerResourceResolver, requireAdmin, requireAuth, requireDriver, requireEnv, requireRole, resolveAuthHooks, resolveAuthOptions, resolveBatchRefs, resolveConflictTarget, resolveCorsOrigin, resolveDataSources, resolveEmailBranding, resolveEmailLinkBase, resolveEmailOptions, resolveRequireAuth, resolveStorageAccessControl, resolveStorageBackend, resolveStorageSources, resourceResolver, resourceResolvers, rowETag, runFromBundle, runtimeKey, safeCompare, schemaDriftRemedy, serveSPA, splitFieldOps, summarize as summarizeRlsScan, transformImage, tryVerifyOidcIdToken, unbindableKinds, unknownKeyPolicyFromEnv, validateApiKey, validateCronExpression, validatePasswordStrength, verifyOidcIdToken, verifyPassword, versionProperty, waitUntil, z };
+export { ACCOUNT_SCOPED_STORAGE_BASES, ApiError, BATCH_REF_KEY, BlockedUrlError, BundleError, CONCURRENT_DDL_SQLSTATES, CollectionConfigError, CronScheduler, DEFAULT_DRIVER_ID, DEFAULT_MAX_FILE_SIZE, DEFAULT_STORAGE_ID, DOCUMENT_MIME_TYPES, DefaultDriverRegistry, DefaultStorageRegistry, ETAG_HEADER, FIELD_OPERATORS, GCSStorageController, IF_MATCH_HEADER, IMAGE_MIME_TYPES, LocalStorageController, MetricsRegistry, RUNTIME_BUNDLE_MOUNT, RUNTIME_DEFAULT_MAX_BODY_SIZE, RUNTIME_HEALTH_PATH, RUNTIME_LIVENESS_PATH, RUNTIME_MIN_TERMINATION_GRACE_SECONDS, RUNTIME_PRESTOP_DRAIN_SECONDS, RUNTIME_PROBE_PATHS, RUNTIME_STARTUP_BUDGET_SECONDS, RawHtml, S3StorageController, SMTPEmailService, StoragePolicyError, TOPOLOGY_ENV_VARS, TransformCache, TusHandler, UPLOAD_COLLECTION_FIELD, UPLOAD_PROPERTY_FIELD, UnknownStorageSourceError, WEBHOOK_DELIVERY_TASK, WebhookDispatcher, _resetRebaseMock, _setRebaseMock, activeDevEmailSink, applyCollectionDefaults, assertAllowedOutboundUrl, assertCollectionConfigs, assertDistinctSuffixes, assertEmailLinkBases, assertEveryKindBindable, assertFieldOpsValid, assertIfMatch, assertNoFieldOpsOnCreate, assertUploadWithinPropertyLimits, assertWriteRequestValid, authJwt, authRoles, authUid, blockedAddressReason, bootFromBundle, classifySurface, cleanupDevPortFile, clearActiveDevEmailSink, compileStoragePolicies, configureJwt, createAppleProvider, createBackupRoutes, createBitbucketProvider, createBuiltinAuthAdapter, createContractRoutes, createCronRoutes, createCronStore, createCustomAuthAdapter, createDdlBootstrapper, createDevEmailSink, createDiscordProvider, createEmailService, createFacebookProvider, createFunctionRoutes, createGitHubProvider, createGitLabProvider, createGoogleProvider, createHistoryRoutes, createJobQueue, createJobStore, createJwksRoutes, createLinkedinProvider, createMetricsMiddleware, createMetricsRoutes, createMicrosoftProvider, createRlsAudit, createSlackProvider, createSourceBundle, createSpotifyProvider, createStorageController, createStorageRoutes, createTwitterProvider, createUnconfiguredEmailService, createUploadConstraintResolver, declaredErrorAnswer, declaredUniqueTargets, defaultBackoff, defineCron, defineFunction, drainBackgroundWork, envSuffixForKey, errorHandler, escapeHtml, extractLinks, extractUserFromToken, fileTokenAuth, findCollectionConfigProblems, generateSecurePassword, getApiKey, getDriver, getEmailOtpTemplate, getEmailVerificationTemplate, getEnv, getJwks, getMagicLinkTemplate, getPasswordResetTemplate, getRequestId, getRoles, getUser, getUserId, getUserInvitationTemplate, getWelcomeEmailTemplate, hasAsymmetricSigningKey, hasFieldOps, hasRole, hashPassword, html, httpMethodToOperation, identityResolved, implicitDeclaration, initializeDataSource, initializeDataSources, initializeRebaseBackend, installShutdownHandlers, isAcceptedFile, isAdmin, isApiKeyToken, isAuthAdapter, isAuthenticated, isConcurrentDdlRace, isDatabaseAdapter, isDuplicateObjectRace, isLocalhostOrigin, isNodeRuntime, isOperationAllowed, isTopologyEnvVar, isTransformableImage, isUncountedPath, lazyResource, listBackupObjects, listenWithPortRetry, loadBootEnv, loadBundle, loadBundleConfigExports, loadBundleSchema, loadCollectionsFromDirectory, loadCronJobsFromDirectory, loadCronJobsWithDiagnostics, loadEnv, loadFunctionsFromDirectory, loadFunctionsWithDiagnostics, loadUsersCollection, logger, looksLikeFieldOp, oauthCodeFlowSchema, optionalAuth, parseBackupDestination, parseBackupTimestamp, parseFieldOp, parseTransformOptions, pendingBackgroundWork, pkceTokenParams, providerVerifiedEmail, queryTokenAuth, raw, rawQueryLoggingEnabled, readBackupBytes, readBundleManifest, readUploadPropertyContext, rebase, registerDevEmailSink, registerResourceResolver, requireAdmin, requireAuth, requireDriver, requireEnv, requireRole, resolveAuthHooks, resolveAuthOptions, resolveBatchRefs, resolveConflictTarget, resolveCorsOrigin, resolveDataSources, resolveEmailBranding, resolveEmailLinkBase, resolveEmailOptions, resolveRequireAuth, resolveStorageAccessControl, resolveStorageBackend, resolveStorageSources, resourceResolver, resourceResolvers, rowETag, runFromBundle, runtimeKey, safeCompare, schemaDriftRemedy, serveSPA, splitFieldOps, summarize as summarizeRlsScan, transformImage, tryVerifyOidcIdToken, unbindableKinds, unknownKeyPolicyFromEnv, validateApiKey, validateCronExpression, validatePasswordStrength, verifyOidcIdToken, verifyPassword, versionProperty, waitUntil, z };
 
 //# sourceMappingURL=index.es.js.map