@rebasepro/server 0.21.2-canary.g1ea48be → 0.23.0

package/dist/{auth-DZXQRmYD.js → auth-B-GIMpDG.js}

@@ -3,20 +3,21 @@ import __rebaseProcess from "process";
 globalThis.process ??= __rebaseProcess;
 __rebaseCreateRequire(import.meta.url);
 import { i as __toESM, n as __exportAll } from "./rolldown-runtime-dW7B1o5h.js";
-import { P as revokeInternalTableSql, at as isAnonymousUid, it as ANONYMOUS_USER_ID } from "./src-BYax9_rm.js";
-import "./src-Br6ARbs6.js";
-import { n as createDdlBootstrapper, o as isSQLAdmin } from "./ddl-bootstrap-CfNvxMuK.js";
+import { F as revokeInternalTableSql, ct as ANONYMOUS_USER_ID, lt as isAnonymousUid } from "./src-pmvW7BFx.js";
+import "./src-vkcwKXbT.js";
+import { t as isSQLAdmin } from "./backend-DTAOsLQc.js";
 import { t as firstSqlRow } from "./sql-rows-C6GEc2oE.js";
 import { r as logger } from "./logger-DO2PZc4i.js";
 import { r as errorHandler, t as ApiError } from "./errors-DWsX4yTd.js";
-import { a as resolveListLimitParam } from "./query-parser-CoIOmflr.js";
-import { C as require_jsonwebtoken, E as randomInt$1, O as sha256Hex, _ as verifyAccessToken, b as verifyMfaPendingToken, c as getAccessTokenExpiry, d as getRefreshTokenTtlMs, f as hasAsymmetricSigningKey, i as generateDownloadToken, l as getJwks, m as isJwtConfigured, n as configureJwt, o as generateMfaPendingToken, p as hashRefreshToken, r as generateAccessToken, s as generateRefreshToken, t as MAX_COOKIE_AGE_MS, u as getRefreshTokenExpiry, v as verifyDownloadToken, w as constantTimeEqual } from "./jwt-C4OW-DNq.js";
+import { a as resolveListLimitParam } from "./query-parser-DGRVFNM3.js";
+import { C as require_jsonwebtoken, E as randomInt$1, O as sha256Hex, _ as verifyAccessToken, b as verifyMfaPendingToken, c as getAccessTokenExpiry, d as getRefreshTokenTtlMs, f as hasAsymmetricSigningKey, i as generateDownloadToken, l as getJwks, m as isJwtConfigured, n as configureJwt, o as generateMfaPendingToken, p as hashRefreshToken, r as generateAccessToken, s as generateRefreshToken, t as MAX_COOKIE_AGE_MS, u as getRefreshTokenExpiry, v as verifyDownloadToken, w as constantTimeEqual } from "./jwt-DnQHNFCl.js";
 import { n as hasAdministrativeRole, r as isAdministrativeRole, t as ADMINISTRATIVE_ROLES } from "./admin-roles-vYdp_Pil.js";
-import { c as tryCanonicalStorageKey, i as canonicalStorageId } from "./keys-Qfc4XieN.js";
+import { a as canonicalStorageId, l as tryCanonicalStorageKey } from "./keys-CogCQpxG.js";
+import { n as createDdlBootstrapper } from "./ddl-bootstrap-C6mo0Kmz.js";
 import { createHash, randomBytes, randomInt } from "node:crypto";
 import { Hono } from "hono";
 import { promisify } from "util";
-import { createCipheriv, createDecipheriv, createHash as createHash$1, createHmac, createPublicKey, randomBytes as randomBytes$1, randomUUID, scrypt, timingSafeEqual } from "crypto";
+import { createCipheriv, createDecipheriv, createHash as createHash$1, createHmac, createPublicKey, randomBytes as randomBytes$1, randomUUID as randomUUID$1, scrypt, timingSafeEqual } from "crypto";
 import { getConnInfo } from "@hono/node-server/conninfo";
 import { createMiddleware } from "hono/factory";
 import { z } from "zod";
@@ -553,6 +554,16 @@ If you didn't create an account with ${appName}, you can safely ignore this emai
 	};
 }
 /**
+* How long an invitation's set-password link stays valid.
+*
+* One number for both halves: `finalizeAdminUserCreation` mints the token for
+* this long and the template below tells the invitee this long. They were two
+* literals, and the email said "1 hour" for a token that lived 24 — so an
+* invitee who opened it the next morning believed the link was dead.
+*/
+var USER_INVITATION_LINK_TTL_MS = 1440 * 60 * 1e3;
+var USER_INVITATION_LINK_TTL_HOURS = USER_INVITATION_LINK_TTL_MS / (3600 * 1e3);
+/**
 * Default user invitation email template
 * Sent when an admin creates a new user account
 */
@@ -593,7 +604,7 @@ function getUserInvitationTemplate(setPasswordUrl, user, appName = DEFAULT_APP_N
             </p>
             
             <div style="${styles.warning}">
-                ⏰ This link will expire in 1 hour for security reasons.
+                ⏰ This link will expire in ${USER_INVITATION_LINK_TTL_HOURS} hours for security reasons.
             </div>
             
             <div style="${styles.footer}">
@@ -616,7 +627,7 @@ An account has been created for you on ${appName}.
 Click this link to set your password and get started:
 ${setPasswordUrl}
 
-This link will expire in 1 hour for security reasons.
+This link will expire in ${USER_INVITATION_LINK_TTL_HOURS} hours for security reasons.
 
 If you weren't expecting this invitation, you can safely ignore this email.
     `.trim();
@@ -838,12 +849,86 @@ No action is needed.
 	};
 }
 //#endregion
+//#region src/email/link-base.ts
+/**
+* The config fields consulted for each link kind, most specific first.
+*
+* `resetPasswordUrl` is the general fallback because it is the only one any boot
+* path sets, and in every real deployment all three point at the same frontend.
+*/
+var LINK_BASE_FIELDS = {
+	resetPassword: ["resetPasswordUrl"],
+	verifyEmail: ["verifyEmailUrl", "resetPasswordUrl"],
+	magicLink: ["magicLinkUrl", "resetPasswordUrl"]
+};
+/**
+* True when `value` is an absolute `http(s)` URL — the only kind a mail client
+* can follow. A protocol-relative or path-only base is treated as missing.
+*/
+function isAbsoluteHttpUrl(value) {
+	try {
+		const url = new URL(value);
+		return url.protocol === "http:" || url.protocol === "https:";
+	} catch {
+		return false;
+	}
+}
+/** Drop a trailing slash so callers can append `/verify-email?token=…`. */
+function normalizeBase(value) {
+	return value.replace(/\/+$/, "");
+}
+/**
+* The absolute base URL for a link kind, or `""` when the config has none.
+*
+* Callers append their path to the result. `""` is only reachable on a config
+* that never went through {@link assertEmailLinkBases} — a hand-constructed
+* `SMTPEmailService` in a test, say — and is kept rather than thrown so that a
+* misconfiguration cannot turn a password-reset request into a 500 that
+* distinguishes existing accounts from missing ones.
+*/
+function resolveEmailLinkBase(config, kind) {
+	if (!config) return "";
+	for (const field of LINK_BASE_FIELDS[kind]) {
+		const value = config[field];
+		if (typeof value === "string" && isAbsoluteHttpUrl(value)) return normalizeBase(value);
+	}
+	return "";
+}
+/**
+* Throw when an email configuration cannot produce a followable link of every
+* kind it sends.
+*
+* Called from `createEmailService`, i.e. from every boot path that wires email
+* up (the managed runtime, both driver bootstrappers, and any app that passes
+* `auth.email`). A base that is set but relative is reported separately from one
+* that is missing, because the two have different fixes.
+*/
+function assertEmailLinkBases(config) {
+	const relative = [
+		"resetPasswordUrl",
+		"verifyEmailUrl",
+		"magicLinkUrl"
+	].filter((field) => typeof config[field] === "string" && config[field] !== "" && !isAbsoluteHttpUrl(config[field]));
+	if (relative.length > 0) throw new Error(`Email is configured with a relative link base: ${relative.map((f) => `email.${f}`).join(", ")}. Emailed links must be absolute (e.g. "https://app.example.com") — a mail client has no base document to resolve a relative href against, so the link is dead.`);
+	const unresolved = Object.keys(LINK_BASE_FIELDS).filter((kind) => !resolveEmailLinkBase(config, kind));
+	if (unresolved.length === Object.keys(LINK_BASE_FIELDS).length) throw new Error("Email is configured but no base URL for emailed links is set. Password-reset, verification and magic-link emails would carry relative hrefs, which are dead links in every mail client. Set FRONTEND_URL (or `auth.email.resetPasswordUrl`) to an absolute URL such as \"https://app.example.com\".");
+	if (unresolved.length > 0) throw new Error(`Email is configured without a base URL for ${unresolved.map((kind) => LINK_KIND_LABELS[kind]).join(" and ")} emails, so their links would be relative hrefs — dead in every mail client. Those links fall back to \`auth.email.resetPasswordUrl\` only: set FRONTEND_URL (or \`auth.email.resetPasswordUrl\`) to an absolute URL such as "https://app.example.com".`);
+}
+/** How each link kind is named in a boot error. */
+var LINK_KIND_LABELS = {
+	resetPassword: "password-reset",
+	verifyEmail: "verification",
+	magicLink: "magic-link"
+};
+//#endregion
 //#region src/auth/admin-user-ops.ts
 /**
 * Admin User Operations
 *
 * Shared utilities and orchestration for admin-initiated user management
-* (user creation via REST API, password reset via admin panel).
+* (user creation via REST API, password reset via admin panel), and the rules
+* user administration holds to whichever door it arrives by — the admin user
+* routes, or the auth collection through the data API.
 *
 * Hook resolution order:
 * 1. Collection-level hook (`auth.onCreateUser` on the collection) — closest to the data
@@ -965,9 +1050,9 @@ async function finalizeAdminUserCreation(entity, clearPassword, ctx) {
 	if (!!(ctx.emailService && ctx.emailService.isConfigured())) try {
 		const token = generateSecureToken();
 		const tokenHash = hashToken$1(token);
-		const expiresAt = new Date(Date.now() + 1440 * 60 * 1e3);
+		const expiresAt = new Date(Date.now() + USER_INVITATION_LINK_TTL_MS);
 		await ctx.authRepo.createPasswordResetToken(entity.id, tokenHash, expiresAt);
-		const setPasswordUrl = `${ctx.emailConfig?.resetPasswordUrl || ""}/reset-password?token=${token}`;
+		const setPasswordUrl = `${resolveEmailLinkBase(ctx.emailConfig, "resetPassword")}/reset-password?token=${token}`;
 		const { appName, logoUrl } = resolveEmailBranding(ctx.emailConfig);
 		const templateFn = ctx.emailConfig?.templates?.userInvitation;
 		const emailContent = templateFn ? templateFn(setPasswordUrl, {
@@ -1029,6 +1114,88 @@ async function completeUserCreation(prepared, finalize) {
 		...result.emailDeliveryFailed ? { emailDeliveryFailed: true } : {}
 	};
 }
+/**
+* Refuse a change that leaves no administrator: `leaving` are users losing the
+* role (demoted, or deleted), and the project must keep at least one.
+*
+* Judged over the whole set, so a bulk write that takes every admin at once is
+* refused even though each of its rows alone would leave one behind.
+*/
+async function assertAdministratorsRemain(authRepo, leaving, message) {
+	const admins = [];
+	for (const uid of new Set(leaving)) if ((await authRepo.getUserRoleIds(uid)).includes("admin")) admins.push(uid);
+	if (admins.length === 0) return;
+	const { total } = await authRepo.listUsersPaginated({
+		roleId: "admin",
+		limit: 1
+	});
+	if (total <= admins.length) throw ApiError.forbidden(message, "LAST_ADMIN");
+}
+/** Refuse deleting these users when that would leave the project with no administrator. */
+async function assertUserDeletionsAllowed(authRepo, uids) {
+	await assertAdministratorsRemain(authRepo, uids, uids.length > 1 ? "Cannot delete every administrator" : "Cannot delete the last administrator");
+}
+/** Refuse setting these users' roles when that would leave the project with no administrator. */
+async function assertRoleChangesAllowed(authRepo, changes) {
+	await assertAdministratorsRemain(authRepo, changes.filter((change) => !change.roles.includes("admin")).map((change) => change.uid), changes.length > 1 ? "Cannot demote every administrator" : "Cannot demote the last administrator");
+}
+/**
+* A user's new email, in the form sign-in looks it up by — or a 409 when
+* another account holds it.
+*
+* Sign-in, password reset and magic links all find the account by
+* `normalizeEmail(input)`. An address stored as typed is one those lookups
+* never match: its owner is locked out, and registering the address again hits
+* the case-insensitive unique index.
+*/
+async function normalizeUserEmailChange(authRepo, uid, email) {
+	const normalized = normalizeEmail(email);
+	const holder = await authRepo.getUserByEmail(normalized);
+	if (holder && holder.id !== uid) throw ApiError.conflict("Email already registered", "EMAIL_EXISTS");
+	return normalized;
+}
+/**
+* Run `afterUserDelete` without letting it fail the deletion it follows: the
+* user is already gone, so a failing listener is logged, not answered.
+*/
+function runAfterUserDelete(resolvedHooks, uid) {
+	if (!resolvedHooks.afterUserDelete) return;
+	resolvedHooks.afterUserDelete(uid).catch((err) => {
+		logger.error("[AuthHooks] afterUserDelete error", { error: err instanceof Error ? err.message : err });
+	});
+}
+/**
+* The auth adapter's side of user administration through the auth collection
+* (`AuthAdapter.prepareUserUpdates` and the deletion pair): the admin user
+* routes' rules and hooks, for the data API's writes to the same rows.
+*/
+function authCollectionUserAdmin(ctx) {
+	const { authRepo, resolvedHooks } = ctx;
+	return {
+		async prepareUserUpdates(updates) {
+			await assertRoleChangesAllowed(authRepo, updates.flatMap(({ uid, values }) => Array.isArray(values.roles) ? [{
+				uid,
+				roles: values.roles
+			}] : []));
+			const prepared = [];
+			for (const { uid, values } of updates) prepared.push(typeof values.email === "string" ? {
+				...values,
+				email: await normalizeUserEmailChange(authRepo, uid, values.email)
+			} : values);
+			return prepared;
+		},
+		async prepareUserDeletions(uids) {
+			await assertUserDeletionsAllowed(authRepo, uids);
+			if (resolvedHooks.beforeUserDelete) for (const uid of uids) await resolvedHooks.beforeUserDelete(uid);
+		},
+		async finalizeUserDeletions(uids) {
+			for (const uid of uids) {
+				await authRepo.deleteAllRefreshTokensForUser(uid);
+				runAfterUserDelete(resolvedHooks, uid);
+			}
+		}
+	};
+}
 //#endregion
 //#region src/auth/token-revocation.ts
 /**
@@ -1124,6 +1291,9 @@ async function revokeAllSessions(authRepo, uid) {
 * `test/password-change-revokes-sessions.test.ts` holds every route that sets a
 * password to this, and fails if anything but this function calls
 * `updatePassword`.
+*
+* `null` removes the password instead, for the same reason and with the same
+* revocation: see `confirmAddressOwnership`.
 */
 async function replaceUserPassword(authRepo, uid, passwordHash) {
 	await authRepo.updatePassword(uid, passwordHash);
@@ -1881,7 +2051,7 @@ function createAdapterAuthMiddleware(options) {
 		try {
 			authenticatedUser = await adapter.verifyRequest(c.req.raw);
 		} catch (error) {
-			return refuse(c, ApiError.unauthenticated("Unauthorized"));
+			return refuse(c, error instanceof ApiError && error.statusCode >= 400 ? error : ApiError.unauthenticated("Unauthorized"));
 		}
 		if (authenticatedUser) {
 			c.set("user", {
@@ -1894,7 +2064,8 @@ function createAdapterAuthMiddleware(options) {
 				c.set("driver", await scopeDataDriver(driver, {
 					uid: authenticatedUser.uid,
 					roles: authenticatedUser.roles,
-					isAnonymous: authenticatedUser.isAnonymous === true
+					isAnonymous: authenticatedUser.isAnonymous === true,
+					...authenticatedUser.claims ? { claims: authenticatedUser.claims } : {}
 				}));
 			} catch (error) {
 				logger.error("[AUTH-ADAPTER] RLS scoping failed for authenticated user", { error });
@@ -1962,6 +2133,7 @@ async function verifyPassword(password, storedHash) {
 	if (!saltHex || !hashHex) return false;
 	const salt = Buffer.from(saltHex, "hex");
 	const storedKey = Buffer.from(hashHex, "hex");
+	if (storedKey.length !== KEY_LENGTH) return false;
 	return timingSafeEqual(await scryptAsync(password, salt, KEY_LENGTH, SCRYPT_PARAMS), storedKey);
 }
 //#endregion
@@ -2020,69 +2192,6 @@ function resolveAuthHooks(hooks) {
 	};
 }
 //#endregion
-//#region src/email/link-base.ts
-/**
-* The config fields consulted for each link kind, most specific first.
-*
-* `resetPasswordUrl` is the general fallback because it is the only one any boot
-* path sets, and in every real deployment all three point at the same frontend.
-*/
-var LINK_BASE_FIELDS = {
-	resetPassword: ["resetPasswordUrl"],
-	verifyEmail: ["verifyEmailUrl", "resetPasswordUrl"],
-	magicLink: ["magicLinkUrl", "resetPasswordUrl"]
-};
-/**
-* True when `value` is an absolute `http(s)` URL — the only kind a mail client
-* can follow. A protocol-relative or path-only base is treated as missing.
-*/
-function isAbsoluteHttpUrl(value) {
-	try {
-		const url = new URL(value);
-		return url.protocol === "http:" || url.protocol === "https:";
-	} catch {
-		return false;
-	}
-}
-/** Drop a trailing slash so callers can append `/verify-email?token=…`. */
-function normalizeBase(value) {
-	return value.replace(/\/+$/, "");
-}
-/**
-* The absolute base URL for a link kind, or `""` when the config has none.
-*
-* Callers append their path to the result. `""` is only reachable on a config
-* that never went through {@link assertEmailLinkBases} — a hand-constructed
-* `SMTPEmailService` in a test, say — and is kept rather than thrown so that a
-* misconfiguration cannot turn a password-reset request into a 500 that
-* distinguishes existing accounts from missing ones.
-*/
-function resolveEmailLinkBase(config, kind) {
-	if (!config) return "";
-	for (const field of LINK_BASE_FIELDS[kind]) {
-		const value = config[field];
-		if (typeof value === "string" && isAbsoluteHttpUrl(value)) return normalizeBase(value);
-	}
-	return "";
-}
-/**
-* Throw when an email configuration cannot produce a followable link.
-*
-* Called from `createEmailService`, i.e. from every boot path that wires email
-* up (the managed runtime, both driver bootstrappers, and any app that passes
-* `auth.email`). A base that is set but relative is reported separately from one
-* that is missing, because the two have different fixes.
-*/
-function assertEmailLinkBases(config) {
-	const relative = [
-		"resetPasswordUrl",
-		"verifyEmailUrl",
-		"magicLinkUrl"
-	].filter((field) => typeof config[field] === "string" && config[field] !== "" && !isAbsoluteHttpUrl(config[field]));
-	if (relative.length > 0) throw new Error(`Email is configured with a relative link base: ${relative.map((f) => `email.${f}`).join(", ")}. Emailed links must be absolute (e.g. "https://app.example.com") — a mail client has no base document to resolve a relative href against, so the link is dead.`);
-	if (!resolveEmailLinkBase(config, "resetPassword") && !resolveEmailLinkBase(config, "verifyEmail")) throw new Error("Email is configured but no base URL for emailed links is set. Password-reset, verification and magic-link emails would carry relative hrefs, which are dead links in every mail client. Set FRONTEND_URL (or `auth.email.resetPasswordUrl`) to an absolute URL such as \"https://app.example.com\".");
-}
-//#endregion
 //#region src/email/smtp-email-service.ts
 var _nodemailer;
 async function loadNodemailer() {
@@ -2136,16 +2245,32 @@ function normalizeMessageId(value) {
 var SMTPEmailService = class {
 	transporter = null;
 	config;
-	_initialized = false;
+	/**
+	* The transporter being built, shared by every send that arrives while it
+	* is.
+	*
+	* A flag set before the `await` said "initialised" while nodemailer was
+	* still loading, so a second send in that window found no transporter and
+	* threw "Email service not configured" — the first burst of mail after a
+	* boot lost every message but one. Every caller awaits this one promise
+	* instead. Cleared on failure, so one bad moment is not remembered for the
+	* life of the process.
+	*/
+	transporterReady = null;
 	constructor(config) {
 		this.config = config;
 	}
 	/**
 	* Lazily initialize the SMTP transporter on first use
 	*/
-	async ensureTransporter() {
-		if (this._initialized) return;
-		this._initialized = true;
+	ensureTransporter() {
+		if (!this.transporterReady) this.transporterReady = this.buildTransporter().catch((error) => {
+			this.transporterReady = null;
+			throw error;
+		});
+		return this.transporterReady;
+	}
+	async buildTransporter() {
 		if (this.config.smtp) {
 			const nodemailer = await loadNodemailer();
 			let smtpName = this.config.smtp.name;
@@ -2422,13 +2547,42 @@ function warnIfProxiedButUntrusted(hasForwardedFor) {
 	logger.warn("[RateLimit] Requests carry X-Forwarded-For but TRUSTED_PROXY_HOPS is 0, so it is being ignored and every client behind the proxy shares one rate-limit bucket. If this server really is behind a reverse proxy, set TRUSTED_PROXY_HOPS to the number of proxies in front of it (1 for a single ingress or load balancer). If it is exposed directly, this warning means someone is sending the header themselves and 0 is the correct setting.");
 }
 /**
+* The store this deployment shares its counts in, when it has one.
+*
+* Module state, because the limiters that read it are module constants: the
+* auth limiters are built at import time, before `initializeRebaseBackend`
+* has read `REBASE_RATE_LIMIT_STORE` or `rateLimit.store`, so they cannot be
+* handed the store the way the data limiter is. Without this they each kept a
+* private memory store whatever the deployment asked for, and on N replicas
+* every login, reset, OTP and MFA limit was N times looser than configured.
+*/
+var sharedRateLimitStore;
+/**
+* Point every named limiter at the deployment's shared store — or, with
+* `undefined`, back at its own memory. Called once per boot with the store
+* the data limiters use, and only when that store is shared (SQL, or one the
+* operator supplied): the default memory store is swept on the data window,
+* which is not every limiter's window.
+*/
+function setSharedRateLimitStore(store) {
+	sharedRateLimitStore = store;
+}
+/** The deployment's store under `name` when there is one, this limiter's own memory otherwise. */
+function namedStore(name, windowMs) {
+	const local = new MemoryRateLimitStore(windowMs);
+	return {
+		hit: (key, window, limit) => sharedRateLimitStore ? sharedRateLimitStore.hit(`${name}:${key}`, window, limit) : local.hit(key, window, limit),
+		dispose: () => local.dispose()
+	};
+}
+/**
 * Create a rate-limiting middleware.
 *
 * Uses a sliding window: only hits within the last `windowMs` are counted.
 */
 function createRateLimiter(options = {}) {
 	const trustedProxyHops = resolveTrustedProxyHops(options.trustedProxyHops);
-	const { windowMs = 900 * 1e3, limit = 100, keyGenerator = (c) => defaultKeyGenerator(c, trustedProxyHops), message = "Too many requests, please try again later.", store = new MemoryRateLimitStore(windowMs), resolveLimit } = options;
+	const { windowMs = 900 * 1e3, limit = 100, keyGenerator = (c) => defaultKeyGenerator(c, trustedProxyHops), message = "Too many requests, please try again later.", name, store = name ? namedStore(name, windowMs) : new MemoryRateLimitStore(windowMs), resolveLimit } = options;
 	return async (c, next) => {
 		const effectiveLimit = resolveLimit ? await resolveLimit(c) : limit;
 		if (effectiveLimit === null) return next();
@@ -2490,26 +2644,36 @@ function socketAddress(c) {
 * anonymous callers throttle each other than that any of them throttles nobody.
 */
 function defaultKeyGenerator(c, trustedProxyHops = resolveTrustedProxyHops()) {
+	return clientAddress((name) => c.req.header(name), () => socketAddress(c), trustedProxyHops);
+}
+/**
+* {@link defaultKeyGenerator}'s rule, over a request's headers and connection
+* address rather than a Hono context — so a door that is not an HTTP request
+* (the realtime socket's upgrade request) reads the caller's address the same
+* way.
+*/
+function clientAddress(header, connectionAddress, trustedProxyHops) {
 	if (trustedProxyHops === 0) {
-		warnIfProxiedButUntrusted(!!c.req.header("x-forwarded-for"));
-		return socketAddress(c) ?? "unknown";
+		warnIfProxiedButUntrusted(!!header("x-forwarded-for"));
+		return connectionAddress() ?? "unknown";
 	}
 	{
-		const forwardedFor = c.req.header("x-forwarded-for");
+		const forwardedFor = header("x-forwarded-for");
 		if (forwardedFor) {
 			const ips = forwardedFor.split(",").map((s) => s.trim()).filter(Boolean);
 			if (ips.length > 0) return ips[Math.max(0, ips.length - trustedProxyHops)];
 		}
-		const realIp = c.req.header("x-real-ip");
+		const realIp = header("x-real-ip");
 		if (realIp) return realIp;
 	}
-	return socketAddress(c) ?? "unknown";
+	return connectionAddress() ?? "unknown";
 }
 /**
 * Pre-configured rate limiter for general auth endpoints (login, register).
 * 200 requests per 15 minutes per IP.
 */
 var defaultAuthLimiter = createRateLimiter({
+	name: "auth-default",
 	windowMs: 900 * 1e3,
 	limit: 200,
 	message: "Too many authentication attempts, please try again later."
@@ -2519,6 +2683,7 @@ var defaultAuthLimiter = createRateLimiter({
 * 50 requests per 15 minutes per IP.
 */
 var strictAuthLimiter = createRateLimiter({
+	name: "auth-strict",
 	windowMs: 900 * 1e3,
 	limit: 50,
 	message: "Too many requests to this sensitive endpoint, please try again later."
@@ -2577,6 +2742,7 @@ var captureRecipientEmail = async (c, next) => {
 * the limiter is never silently a no-op.
 */
 var recipientEmailLimiter = createRateLimiter({
+	name: "auth-recipient-email",
 	windowMs: 900 * 1e3,
 	limit: 5,
 	keyGenerator: (c) => {
@@ -2592,6 +2758,7 @@ async function notBefore$1(startedAt, floorMs, result) {
 	return result;
 }
 var verificationEmailLimiter = createRateLimiter({
+	name: "auth-verification-email",
 	windowMs: 900 * 1e3,
 	limit: 5,
 	keyGenerator: (c) => {
@@ -2632,8 +2799,9 @@ var DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT = 3e3;
 * `enabled: false` rather than pay for it twice.
 */
 function createDataRateLimiter(config = {}) {
-	const { windowMs = 900 * 1e3, apiKey: apiKeyLimit = 1e3, user: userLimit = 1e3, anonymous: anonLimit = 300, store = new MemoryRateLimitStore(windowMs) } = config;
+	const { windowMs = 900 * 1e3, store = new MemoryRateLimitStore(windowMs) } = config;
 	const trustedProxyHops = resolveTrustedProxyHops(config.trustedProxyHops);
+	const bucketFor = dataRateLimitBuckets(config);
 	/**
 	* Who this request is, for bucketing only.
 	*
@@ -2664,25 +2832,81 @@ function createDataRateLimiter(config = {}) {
 		if (!payload?.uid || isAnonymousUid(payload.uid)) return void 0;
 		return payload.uid;
 	};
+	const bucketOf = async (c) => {
+		if (c.get("user")?.uid === SERVICE_IDENTITY.uid) return null;
+		const apiKey = c.get("apiKey");
+		return bucketFor({
+			apiKey,
+			uid: apiKey ? void 0 : await identify(c),
+			address: () => defaultKeyGenerator(c, trustedProxyHops)
+		});
+	};
 	return createRateLimiter({
 		windowMs,
 		store,
 		message: "Too many requests, please try again later.",
-		keyGenerator: async (c) => {
-			const key = c.get("apiKey");
-			if (key) return `api-key:${key.id}`;
-			const uid = await identify(c);
-			if (uid) return `user:${uid}`;
-			return `ip:${defaultKeyGenerator(c, trustedProxyHops)}`;
-		},
-		resolveLimit: async (c) => {
-			if (c.get("user")?.uid === SERVICE_IDENTITY.uid) return null;
-			const key = c.get("apiKey");
-			if (key) return key.rate_limit ?? apiKeyLimit;
-			return await identify(c) ? userLimit : anonLimit;
-		}
+		keyGenerator: async (c) => (await bucketOf(c))?.key ?? `ip:${defaultKeyGenerator(c, trustedProxyHops)}`,
+		resolveLimit: async (c) => (await bucketOf(c))?.limit ?? null
 	});
 }
+/**
+* The data API's per-caller limit, as a check rather than a middleware — for
+* the door into the same data that is not an HTTP request.
+*
+* The realtime socket serves the rows the data API serves, one frame per
+* request. It counted them per connection only, so a caller bought more budget
+* by opening more sockets, and a frame never met the per-person limit its HTTP
+* twin does. Built from the same config and store as
+* {@link createDataRateLimiter}, it puts a caller in the same bucket under the
+* same key: one person's allowance, spent through either door.
+*/
+function createDataRateLimitCheck(config = {}) {
+	const { windowMs = 900 * 1e3, store = new MemoryRateLimitStore(windowMs) } = config;
+	const trustedProxyHops = resolveTrustedProxyHops(config.trustedProxyHops);
+	const bucketFor = dataRateLimitBuckets(config);
+	return async (caller) => {
+		if (caller.uid === SERVICE_IDENTITY.uid) return null;
+		const bucket = bucketFor({
+			uid: caller.uid !== void 0 && !isAnonymousUid(caller.uid) ? caller.uid : void 0,
+			address: () => clientAddress(caller.header, () => caller.socketAddress, trustedProxyHops)
+		});
+		return bucket ? store.hit(bucket.key, windowMs, bucket.limit) : null;
+	};
+}
+/**
+* Which bucket a data request counts in — the rule both doors share.
+*
+* Most specific first: an API key by its id, at its own `rate_limit`; a
+* signed-in user by their uid; anyone else by address at the anonymous
+* allowance, or not at all when that is `null`.
+*
+* The service key never reaches here: it is not a caller to bound. It is the
+* deployment's own credential and already reaches every row through
+* `SERVICE_IDENTITY`, so a limit on it protects nothing that is not already
+* open to whoever holds it — while reliably stopping the backfills,
+* migrations, imports and server-to-server jobs the key exists for, which
+* arrive as thousands of legitimate requests. A managed deployment has no
+* `rateLimit` surface to raise. Each door recognises it itself, where its
+* identity is known.
+*/
+function dataRateLimitBuckets(config) {
+	const { apiKey: apiKeyLimit = 1e3, user: userLimit = 1e3, anonymous: anonLimit = 300 } = config;
+	return (who) => {
+		if (who.apiKey) return {
+			key: `api-key:${who.apiKey.id}`,
+			limit: who.apiKey.rate_limit ?? apiKeyLimit
+		};
+		if (who.uid) return {
+			key: `user:${who.uid}`,
+			limit: userLimit
+		};
+		if (anonLimit === null) return null;
+		return {
+			key: `ip:${who.address()}`,
+			limit: anonLimit
+		};
+	};
+}
 //#endregion
 //#region src/auth/captcha.ts
 /**
@@ -3226,7 +3450,8 @@ async function resolveStepUpPrincipal(c) {
 	if (existing?.uid) return {
 		uid: existing.uid,
 		aal: existing.aal === "aal2" ? "aal2" : "aal1",
-		pending: false
+		pending: false,
+		iat: existing.iat
 	};
 	const token = extractBearerToken(c.req.header("authorization"));
 	if (token === void 0) return null;
@@ -3234,13 +3459,15 @@ async function resolveStepUpPrincipal(c) {
 	if (session) return {
 		uid: session.uid,
 		aal: session.aal === "aal2" ? "aal2" : "aal1",
-		pending: false
+		pending: false,
+		iat: session.iat
 	};
 	const pending = await verifyMfaPendingToken(token);
 	if (pending) return {
 		uid: pending.uid,
 		aal: "aal1",
-		pending: true
+		pending: true,
+		iat: pending.iat
 	};
 	return null;
 }
@@ -3253,6 +3480,7 @@ async function resolveStepUpPrincipal(c) {
 * front of this one — they bound different things.
 */
 var mfaVerificationLimiter = createRateLimiter({
+	name: "auth-mfa-verify",
 	windowMs: 900 * 1e3,
 	limit: MFA_VERIFICATION_ATTEMPTS_PER_WINDOW,
 	keyGenerator: async (c) => `mfa-verify:${(await resolveStepUpPrincipal(c))?.uid ?? "unidentified"}`,
@@ -3263,6 +3491,26 @@ function mountMfaRoutes(opts) {
 	const authRepo = config.authRepo;
 	const emailConfig = config.emailConfig;
 	/**
+	* The caller of a challenge route, refused if the user has since ended
+	* every session.
+	*
+	* These two routes resolve their own caller, because a sign-in that
+	* answered `MFA_REQUIRED` has no session yet, and so they skipped the
+	* revocation mark that `requireLiveSession` checks everywhere else. A
+	* stolen access token that had enrolled its own factor (allowed at `aal1`
+	* while the account had none) kept working here after the victim signed
+	* out everywhere or changed their password, and the verify route then
+	* minted it a new session dated after the mark, which the mark could not
+	* reach. The pending token is a first factor accepted at its `iat`, so it
+	* is held to the same mark.
+	*/
+	async function resolveLiveStepUpPrincipal(c) {
+		const principal = await resolveStepUpPrincipal(c);
+		if (!principal) throw ApiError.unauthorized("Not authenticated");
+		if (await isAccessTokenRevoked(authRepo, principal)) throw ApiError.unauthorized("Session has been revoked", "SESSION_REVOKED");
+		return principal;
+	}
+	/**
 	* Changing which factors an account trusts is itself a privileged act.
 	*
 	* An account that already has a verified factor may only gain or confirm
@@ -3359,8 +3607,7 @@ function mountMfaRoutes(opts) {
 	* `MFA_REQUIRED`, or to step an existing session up to `aal2`.
 	*/
 	router.post("/mfa/challenge", strictAuthLimiter, async (c) => {
-		const principal = await resolveStepUpPrincipal(c);
-		if (!principal) throw ApiError.unauthorized("Not authenticated");
+		const principal = await resolveLiveStepUpPrincipal(c);
 		const challengeSchema = z.object({ factorId: z.string().min(1, "Factor ID is required") });
 		const { factorId } = parseBody(challengeSchema, await c.req.json());
 		const factor = await authRepo.getMfaFactorById(factorId);
@@ -3380,8 +3627,7 @@ function mountMfaRoutes(opts) {
 	* minted, at `aal2`.
 	*/
 	router.post("/mfa/challenge/verify", strictAuthLimiter, mfaVerificationLimiter, async (c) => {
-		const principal = await resolveStepUpPrincipal(c);
-		if (!principal) throw ApiError.unauthorized("Not authenticated");
+		const principal = await resolveLiveStepUpPrincipal(c);
 		const challengeVerifySchema = z.object({
 			challengeId: z.string().min(1, "Challenge ID is required"),
 			code: z.string().min(1, "Code is required")
@@ -3391,7 +3637,8 @@ function mountMfaRoutes(opts) {
 		if (!challenge) throw ApiError.badRequest("Invalid or expired challenge", "INVALID_CHALLENGE");
 		const factor = await authRepo.getMfaFactorById(challenge.factorId);
 		if (!factor || factor.uid !== principal.uid) throw ApiError.notFound("MFA factor not found");
-		if ((challenge.attempts ?? 0) >= MAX_CHALLENGE_ATTEMPTS) {
+		const attempts = (challenge.attempts ?? 0) >= MAX_CHALLENGE_ATTEMPTS ? 6 : typeof authRepo.recordMfaChallengeAttempt === "function" ? await authRepo.recordMfaChallengeAttempt(challengeId) : void 0;
+		if (attempts !== void 0 && attempts > MAX_CHALLENGE_ATTEMPTS) {
 			logger.warn("[Security Audit] MFA challenge attempt limit reached", {
 				eventType: "auth.mfa.challenge.exhausted",
 				uid: principal.uid,
@@ -3406,7 +3653,6 @@ function mountMfaRoutes(opts) {
 			isValid = await authRepo.useRecoveryCode(principal.uid, codeHash);
 		}
 		if (!isValid) {
-			const attempts = typeof authRepo.recordMfaChallengeAttempt === "function" ? await authRepo.recordMfaChallengeAttempt(challengeId) : void 0;
 			logger.warn("[Security Audit] MFA verification failed", {
 				eventType: "auth.mfa.verify.failure",
 				uid: principal.uid,
@@ -3597,7 +3843,7 @@ function isAnonymousAuthOpen(policy) {
 //#endregion
 //#region src/auth/session-routes.ts
 function mountSessionRoutes(opts) {
-	const { router, config, ops, parseBody, buildAuthResponse, createSessionAndTokens, applyTransformHook, requireLiveSession } = opts;
+	const { router, config, ops, parseBody, buildAuthResponse, createSessionAndTokens, applyTransformHook, requireLiveSession, registerCaptcha } = opts;
 	const authRepo = config.authRepo;
 	/**
 	* Refuse the anonymous routes unless the deployment opted in.
@@ -3640,7 +3886,7 @@ function mountSessionRoutes(opts) {
 		clearRefreshCookie(c, config.cookieAuth);
 		const accessToken = extractBearerToken(c.req.header("authorization"));
 		if (ops.afterLogout && accessToken !== void 0) {
-			const { verifyAccessToken } = await import("./jwt-C4OW-DNq.js").then((n) => n.h);
+			const { verifyAccessToken } = await import("./jwt-DnQHNFCl.js").then((n) => n.h);
 			const payload = await verifyAccessToken(accessToken);
 			if (payload) ops.afterLogout(payload.uid).catch((err) => {
 				logger.error("[AuthHooks] afterLogout error", { error: err instanceof Error ? err.message : err });
@@ -3791,14 +4037,21 @@ function mountSessionRoutes(opts) {
 			logger.error("[AuthHooks] onAuthenticated error", { error: err instanceof Error ? err.message : err });
 		});
 		const authResponse = buildAuthResponse(user, roleIds, accessToken, refreshToken, "anonymous");
-		const finalResponse = await applyTransformHook(authResponse, "anonymous", c.req.raw, user.id);
-		return c.json(finalResponse, 201);
+		const transformedResponse = await applyTransformHook(authResponse, "anonymous", c.req.raw, user.id);
+		return c.json(redactRefreshToken(transformedResponse, c, refreshToken, config.cookieAuth), 201);
 	});
 	/**
 	* POST /auth/anonymous/link
 	* Upgrade an anonymous user to a permanent account with email/password
+	*
+	* This is registration: before it the row is a guest, after it an account
+	* that signs in with a password. So it answers to registration's controls,
+	* the `register` captcha and `beforeUserCreate` on the credentials the
+	* account is getting. `/anonymous` carries neither, deliberately, because
+	* apps mint guests on page load; the two in a row used to be a way to make
+	* an account that passed neither.
 	*/
-	router.post("/anonymous/link", strictAuthLimiter, requireLiveSession, async (c) => {
+	router.post("/anonymous/link", strictAuthLimiter, requireLiveSession, ...registerCaptcha ? [registerCaptcha] : [], async (c) => {
 		assertAnonymousAuthOpen();
 		const userCtx = c.get("user");
 		if (!userCtx) throw ApiError.unauthorized("Not authenticated");
@@ -3809,16 +4062,105 @@ function mountSessionRoutes(opts) {
 		if (!passwordValidation.valid) throw ApiError.badRequest(passwordValidation.errors.join(". "), "WEAK_PASSWORD");
 		if (await authRepo.getUserByEmail(normalizeEmail(email))) throw ApiError.conflict("Email already registered", "EMAIL_EXISTS");
 		const passwordHash = await ops.hashPassword(password);
-		const updatedUser = await authRepo.updateUser(user.id, {
+		let linkData = {
 			email: normalizeEmail(email),
-			passwordHash,
+			passwordHash
+		};
+		if (ops.beforeUserCreate) linkData = await ops.beforeUserCreate(linkData);
+		const updatedUser = await authRepo.updateUser(user.id, {
+			...linkData,
+			email: normalizeEmail(linkData.email),
+			passwordHash: linkData.passwordHash,
 			isAnonymous: false
 		});
 		if (!updatedUser) throw ApiError.notFound("User not found");
 		const { roleIds, accessToken, refreshToken } = await createSessionAndTokens(user.id, c.req.header("user-agent") || "unknown", c.req.header("x-forwarded-for") || "unknown");
 		const authResponse = buildAuthResponse(updatedUser, roleIds, accessToken, refreshToken, "password");
-		const finalResponse = await applyTransformHook(authResponse, "anonymous", c.req.raw, user.id);
-		return c.json(finalResponse);
+		const transformedResponse = await applyTransformHook(authResponse, "anonymous", c.req.raw, user.id);
+		return c.json(redactRefreshToken(transformedResponse, c, refreshToken, config.cookieAuth));
+	});
+}
+//#endregion
+//#region src/auth/address-ownership.ts
+/**
+* What happens when the owner of an address proves it for the first time.
+*
+* Nothing verifies the address an account is made with: `POST /auth/register`
+* takes whatever it is given, and so does a sign-in through a provider that
+* does not vouch for the address (Spotify and Facebook never do; Discord and
+* multi-tenant Microsoft sometimes do not). So anyone can make an account for
+* someone else's address and leave a way in on it — a password, or the
+* provider identity they signed up with — then wait for the owner.
+*
+* The owner turns up by proving the address: a magic link, an email code or a
+* password reset, each read out of their inbox. That proof used to mark the
+* account verified and leave the attacker's way in where it was, so the owner
+* and the attacker shared the account from then on. Now the proof also removes
+* everything on the account that nobody proved: the password, every identity
+* whose provider did not vouch for this address, and every session.
+*
+* @module
+*/
+/**
+* The profile stored with a linked OAuth identity.
+*
+* `emailVerified` is recorded so that a later proof of the address can tell an
+* identity whose provider vouched for it from one whose provider did not.
+*/
+function identityProfileData(profile) {
+	return {
+		email: profile.email,
+		emailVerified: profile.emailVerified === true
+	};
+}
+/**
+* Did this identity's provider vouch for `email` when it was linked?
+*
+* Only whoever controls the inbox can hold a provider account that vouches for
+* the address, so such an identity is the owner's. An identity linked before
+* the flag was recorded reads as not vouching: it is detached, and if its
+* provider does vouch, the next sign-in with it links it again.
+*/
+function identityVouchesForAddress(identity, email) {
+	const profile = identity.profileData;
+	return profile?.emailVerified === true && typeof profile.email === "string" && normalizeEmail(profile.email) === normalizeEmail(email);
+}
+/**
+* Settle an account whose address its owner has just proven, and mark it
+* verified.
+*
+* Call it only for an account that is not yet verified, from a route that has
+* just consumed something mailed to the address. It detaches every identity
+* whose provider did not vouch for the address, sets the password to
+* `passwordHash` — the one the owner just chose on a reset, or `null` to remove
+* the one somebody else may have registered with — and ends every session, in
+* that order and before the account is marked verified.
+*
+* A repository that cannot detach an identity makes this refuse with 409 when
+* there is one to detach. Marking the account verified with the identity still
+* on it is the takeover itself, and leaving the account unverified while
+* signing the owner in would share the account all the same.
+*/
+async function confirmAddressOwnership(authRepo, user, passwordHash) {
+	const unproven = (await authRepo.getUserIdentities(user.id)).filter((identity) => !identityVouchesForAddress(identity, user.email));
+	if (unproven.length > 0) {
+		if (typeof authRepo.unlinkUserIdentity !== "function") {
+			logger.error("[Security Audit] Proof of address refused: the account has sign-in methods nobody proved, and this auth repository cannot remove them", {
+				eventType: "auth.address_proof.refused",
+				uid: user.id,
+				providers: unproven.map((identity) => identity.provider)
+			});
+			throw ApiError.conflict("This account has sign-in methods that were added before its email address was verified, and this backend cannot remove them. Ask an administrator to review the account.", "UNVERIFIED_IDENTITIES");
+		}
+		for (const identity of unproven) await authRepo.unlinkUserIdentity(user.id, identity.provider, identity.providerId);
+	}
+	await replaceUserPassword(authRepo, user.id, passwordHash);
+	await authRepo.setEmailVerified(user.id, true);
+	if (unproven.length > 0 || user.passwordHash) logger.info("[Security Audit] First proof of address removed sign-in methods nobody proved", {
+		eventType: "auth.address_proof.cleared",
+		uid: user.id,
+		removedProviders: unproven.map((identity) => identity.provider),
+		replacedPassword: Boolean(user.passwordHash)
 	});
 }
 //#endregion
@@ -3845,13 +4187,22 @@ function mountMagicLinkRoutes(deps) {
 	/**
 	* POST /auth/magic-link
 	* Request a magic link email
+	*
+	* Answers the same words whether or not the address has an account, and
+	* is held to the same three things as its siblings `/otp` and
+	* `/forgot-password` so that nothing else answers the question either:
+	* the same response time, a per-address send limit, and `beforeLogin` on
+	* every attempt. This route had none of the three — the SMTP send was
+	* awaited only for a real account, and the only limit was per IP — so its
+	* timing named the customers and a spread-out run could fill one inbox.
 	*/
-	router.post("/magic-link", strictAuthLimiter, ...captchaMiddleware ? [captchaMiddleware] : [], async (c) => {
+	router.post("/magic-link", strictAuthLimiter, captureRecipientEmail, recipientEmailLimiter, ...captchaMiddleware ? [captchaMiddleware] : [], async (c) => {
+		const startedAt = Date.now();
 		const { email } = parseBody(magicLinkSchema, await c.req.json());
 		if (!isEmailConfigured()) throw ApiError.serviceUnavailable("Email service not configured. Magic link login is not available.", "EMAIL_NOT_CONFIGURED");
 		const user = await authRepo.getUserByEmail(email);
+		if (ops.beforeLogin) await ops.beforeLogin(email, "magic-link");
 		if (user) {
-			if (ops.beforeLogin) await ops.beforeLogin(email, "magic-link");
 			const token = generateSecureToken();
 			const tokenHash = hashToken$1(token);
 			const expiresAt = getMagicLinkExpiry();
@@ -3866,21 +4217,19 @@ function mountMagicLinkRoutes(deps) {
 				email: user.email,
 				displayName: user.displayName
 			}, appName, logoUrl);
-			try {
-				await emailService.send({
-					to: user.email,
-					subject: emailContent.subject,
-					html: emailContent.html,
-					text: emailContent.text
-				});
-			} catch (emailError) {
+			emailService.send({
+				to: user.email,
+				subject: emailContent.subject,
+				html: emailContent.html,
+				text: emailContent.text
+			}).catch((emailError) => {
 				logger.error("Failed to send magic link email", { error: emailError instanceof Error ? emailError.message : emailError });
-			}
+			});
 		}
-		return c.json({
+		return notBefore$1(startedAt, 400, c.json({
 			success: true,
 			message: "If an account with that email exists, a magic link has been sent."
-		});
+		}));
 	});
 	/**
 	* POST /auth/magic-link/verify
@@ -3892,19 +4241,23 @@ function mountMagicLinkRoutes(deps) {
 		const storedToken = await authRepo.findValidMagicLinkToken(tokenHash);
 		if (!storedToken) throw ApiError.badRequest("Invalid or expired magic link", "INVALID_TOKEN");
 		await authRepo.markMagicLinkTokenUsed(tokenHash);
-		const user = await authRepo.getUserById(storedToken.uid);
+		let user = await authRepo.getUserById(storedToken.uid);
 		if (!user) throw ApiError.badRequest("Invalid or expired magic link", "INVALID_TOKEN");
 		if (!user.emailVerified) {
-			await authRepo.setEmailVerified(user.id, true);
-			user.emailVerified = true;
+			await confirmAddressOwnership(authRepo, user, null);
+			user = {
+				...user,
+				emailVerified: true,
+				passwordHash: null
+			};
 		}
 		const { roleIds, accessToken, refreshToken } = await createSessionAndTokens(user.id, c.req.header("user-agent") || "unknown", c.req.header("x-forwarded-for") || "unknown");
 		if (ops.onAuthenticated) ops.onAuthenticated(user, "magic-link").catch((err) => {
 			logger.error("[AuthHooks] onAuthenticated error", { error: err instanceof Error ? err.message : err });
 		});
 		const authResponse = buildAuthResponse(user, roleIds, accessToken, refreshToken, "magic-link");
-		const finalResponse = await applyTransformHook(authResponse, "magic-link", c.req.raw, user.id);
-		return c.json(finalResponse);
+		const transformedResponse = await applyTransformHook(authResponse, "magic-link", c.req.raw, user.id);
+		return c.json(redactRefreshToken(transformedResponse, c, refreshToken, config.cookieAuth));
 	});
 }
 //#endregion
@@ -3949,6 +4302,7 @@ function otpTokenMaterial(email, code) {
 * replicas with the default, the effective budget is five attempts per replica.
 */
 var otpVerificationLimiter = createRateLimiter({
+	name: "auth-otp-verify",
 	windowMs: 900 * 1e3,
 	limit: OTP_ATTEMPTS_PER_WINDOW,
 	keyGenerator: (c) => {
@@ -3969,6 +4323,7 @@ var otpVerificationLimiter = createRateLimiter({
 * and useless as a mail bomb, matching `verificationEmailLimiter`.
 */
 var otpSendLimiter = createRateLimiter({
+	name: "auth-otp-send",
 	windowMs: 900 * 1e3,
 	limit: 5,
 	keyGenerator: (c) => {
@@ -4077,19 +4432,23 @@ function mountOtpRoutes(deps) {
 		const storedToken = await authRepo.findValidMagicLinkToken(tokenHash);
 		if (!storedToken) throw ApiError.badRequest("Invalid or expired code", "INVALID_CODE");
 		await authRepo.markMagicLinkTokenUsed(tokenHash);
-		const user = await authRepo.getUserById(storedToken.uid);
+		let user = await authRepo.getUserById(storedToken.uid);
 		if (!user) throw ApiError.badRequest("Invalid or expired code", "INVALID_CODE");
 		if (!user.emailVerified) {
-			await authRepo.setEmailVerified(user.id, true);
-			user.emailVerified = true;
+			await confirmAddressOwnership(authRepo, user, null);
+			user = {
+				...user,
+				emailVerified: true,
+				passwordHash: null
+			};
 		}
 		const { roleIds, accessToken, refreshToken } = await createSessionAndTokens(user.id, c.req.header("user-agent") || "unknown", c.req.header("x-forwarded-for") || "unknown");
 		if (ops.onAuthenticated) ops.onAuthenticated(user, "otp").catch((err) => {
 			logger.error("[AuthHooks] onAuthenticated error", { error: err instanceof Error ? err.message : err });
 		});
 		const authResponse = buildAuthResponse(user, roleIds, accessToken, refreshToken, "otp");
-		const finalResponse = await applyTransformHook(authResponse, "otp", c.req.raw, user.id);
-		return c.json(finalResponse);
+		const transformedResponse = await applyTransformHook(authResponse, "otp", c.req.raw, user.id);
+		return c.json(redactRefreshToken(transformedResponse, c, refreshToken, config.cookieAuth));
 	});
 }
 //#endregion
@@ -4097,26 +4456,34 @@ function mountOtpRoutes(deps) {
 /**
 * May an OAuth identity be attached to a pre-existing account found *by email*?
 *
-* Both sides have to be trustworthy, and only one of them used to be checked:
+* Both sides have to be trustworthy:
 *
 *  - the **provider** must have verified the address, or the caller has not
 *    shown they control it;
-*  - the **local account** must itself be trustworthy — either its address was
-*    verified, or it has no password at all (it was created by an OAuth
-*    sign-in or an invitation, so there is no credential an attacker could
-*    have planted in advance).
-*
-* A refusal is not a dead end: `POST /auth/link/<provider>` attaches the
-* identity once the caller proves ownership by holding a session.
+*  - the **local account**'s address must have been verified too. Whoever
+*    made an unverified account never proved the address, and every way in
+*    they left on it — a password, an identity from a provider that did not
+*    vouch for the address — would go on opening the account the owner is
+*    about to be signed into.
+*
+* The second rule used to exempt an account with no password, on the theory
+* that one made by an OAuth sign-in holds no credential an attacker could have
+* planted. It holds exactly one: the identity it was made with, which is an
+* attacker's whenever the provider did not vouch for the address.
+*
+* A refusal is not a dead end. `POST /auth/link/<provider>` attaches the
+* identity once the caller proves ownership by holding a session, and proving
+* the address (a magic link, an email code, a password reset) verifies the
+* account — removing what nobody proved — after which this answers yes.
 */
 function decideOAuthAutoLink(args) {
 	if (args.providerEmailVerified !== true) return {
 		allowed: false,
 		reason: "provider-email-unverified"
 	};
-	if (Boolean(args.existingUser.passwordHash) && !args.existingUser.emailVerified) return {
+	if (!args.existingUser.emailVerified) return {
 		allowed: false,
-		reason: "local-account-unverified"
+		reason: args.existingUser.passwordHash ? "local-account-unverified" : "local-account-unverified-passwordless"
 	};
 	return { allowed: true };
 }
@@ -4292,6 +4659,18 @@ function createAuthRoutes(config) {
 		});
 	}
 	/**
+	* Is the account just created the only one there is?
+	*
+	* Two rows at most: the total says whether anyone else exists, and the
+	* one row left when nobody does says whether it is this account. It used
+	* to be `listUsers()` — the whole users table, password hashes included,
+	* on every sign-up, to compare its length with one.
+	*/
+	async function isOnlyUser(uid) {
+		const { users, total } = await authRepo.listUsersPaginated({ limit: 2 });
+		return total === 1 && users[0]?.id === uid;
+	}
+	/**
 	* Helper to generate and store session tokens.
 	*
 	* Every route that signs somebody in comes through here — password login,
@@ -4325,7 +4704,7 @@ function createAuthRoutes(config) {
 		const accessToken = await generateAccessToken(uid, roleIds, aal, customClaims, isAnonymous);
 		const refreshToken = generateRefreshToken();
 		await authRepo.createRefreshToken(uid, await hashRefreshToken(refreshToken), getRefreshTokenExpiry(), userAgent, ipAddress, {
-			id: randomUUID(),
+			id: randomUUID$1(),
 			startedAt: /* @__PURE__ */ new Date(),
 			aal
 		});
@@ -4360,8 +4739,7 @@ function createAuthRoutes(config) {
 		};
 		if (ops.beforeUserCreate) createData = await ops.beforeUserCreate(createData);
 		const user = await authRepo.createUser(createData);
-		const existingUsers = await authRepo.listUsers();
-		const isFirstUser = existingUsers.length === 1 && existingUsers[0].id === user.id;
+		const isFirstUser = await isOnlyUser(user.id);
 		if (bootstrapRegistration && !isFirstUser) {
 			await authRepo.deleteUser(user.id);
 			throw ApiError.forbidden("Registration is disabled", "REGISTRATION_DISABLED");
@@ -4424,21 +4802,46 @@ function createAuthRoutes(config) {
 		return c.json(finalResponse);
 	});
 	/**
+	* Turn an OAuth request body into the provider's profile of the caller.
+	*
+	* Both OAuth doors come through here — sign-in and `/link/<provider>` —
+	* because both end with that provider identity resolving to an account,
+	* so both need the same two controls. The link door used to spend the
+	* code without the first and echo the provider's error without the second:
+	* a victim's code leaked through a stale registered URI could be linked to
+	* the attacker's account, after which the victim's own "Sign in with …"
+	* landed there.
+	*
+	* The redirect URI is allowlisted before the code is spent. The provider's
+	* own registered-URI match authorises *every* URI on that OAuth client — a
+	* leftover localhost entry, a staging host, a second product sharing the
+	* client id — and any of them can mint a code this backend would otherwise
+	* accept.
+	*
+	* A provider's error message is logged, never returned: its token-endpoint
+	* error body routinely echoes the client_id, the redirect URI and
+	* diagnostics about the credential state.
+	*/
+	async function verifyProviderPayload(provider, payload) {
+		const requestedRedirectUri = typeof payload === "object" && payload !== null && "redirectUri" in payload ? payload.redirectUri : void 0;
+		if (typeof requestedRedirectUri === "string" && !isRedirectUriAllowed(requestedRedirectUri, config.allowedRedirectUris)) throw ApiError.badRequest("redirectUri is not allowed for this backend", "REDIRECT_URI_NOT_ALLOWED");
+		let externalUser;
+		try {
+			externalUser = await provider.verify(payload);
+		} catch (err) {
+			logger.error(`[OAuth] ${provider.id} verification threw`, { error: err instanceof Error ? err.message : String(err) });
+			throw ApiError.unauthorized(`Invalid ${provider.id} credentials`, "OAUTH_ERROR");
+		}
+		if (!externalUser) throw ApiError.unauthorized(`Invalid ${provider.id} credentials`, "INVALID_TOKEN");
+		return externalUser;
+	}
+	/**
 	* Dynamically mount OAuth provider routes
 	*/
 	if (config.oauthProviders && config.oauthProviders.length > 0) for (const provider of config.oauthProviders) {
 		router.post(`/${provider.id}`, defaultAuthLimiter, async (c) => {
 			const payload = parseBody(provider.schema, await c.req.json());
-			const requestedRedirectUri = payload.redirectUri;
-			if (typeof requestedRedirectUri === "string" && !isRedirectUriAllowed(requestedRedirectUri, config.allowedRedirectUris)) throw ApiError.badRequest("redirectUri is not allowed for this backend", "REDIRECT_URI_NOT_ALLOWED");
-			let externalUser;
-			try {
-				externalUser = await provider.verify(payload);
-			} catch (err) {
-				logger.error(`[OAuth] ${provider.id} verification threw`, { error: err instanceof Error ? err.message : String(err) });
-				throw ApiError.unauthorized(`Invalid ${provider.id} credentials`, "OAUTH_ERROR");
-			}
-			if (!externalUser) throw ApiError.unauthorized(`Invalid ${provider.id} credentials`, "INVALID_TOKEN");
+			const externalUser = await verifyProviderPayload(provider, payload);
 			let user = await authRepo.getUserByIdentity(provider.id, externalUser.providerId);
 			if (!user) {
 				user = await authRepo.getUserByEmail(externalUser.email);
@@ -4451,7 +4854,7 @@ function createAuthRoutes(config) {
 						reason: decision.reason,
 						provider: provider.id
 					});
-					await authRepo.linkUserIdentity(user.id, provider.id, externalUser.providerId, { email: externalUser.email });
+					await authRepo.linkUserIdentity(user.id, provider.id, externalUser.providerId, identityProfileData(externalUser));
 					await authRepo.updateUser(user.id, {
 						displayName: user.displayName || externalUser.displayName || void 0,
 						photoUrl: user.photoUrl || externalUser.photoUrl || void 0
@@ -4472,14 +4875,13 @@ function createAuthRoutes(config) {
 						photoUrl: externalUser.photoUrl || void 0,
 						emailVerified: externalUser.emailVerified === true
 					});
-					await authRepo.linkUserIdentity(user.id, provider.id, externalUser.providerId, { email: externalUser.email });
+					await authRepo.linkUserIdentity(user.id, provider.id, externalUser.providerId, identityProfileData(externalUser));
 					if (ops.afterUserCreate) try {
 						await ops.afterUserCreate(user);
 					} catch (err) {
 						logger.error("[AuthHooks] afterUserCreate error", { error: err instanceof Error ? err.message : err });
 					}
-					const allUsers = await authRepo.listUsers();
-					const isFirstUser = allUsers.length === 1 && allUsers[0].id === user.id;
+					const isFirstUser = await isOnlyUser(user.id);
 					if (bootstrapRegistration && !isFirstUser) {
 						await authRepo.deleteUser(user.id);
 						throw ApiError.forbidden(noSignupsMessage, "REGISTRATION_DISABLED");
@@ -4522,26 +4924,21 @@ function createAuthRoutes(config) {
 			const userCtx = c.get("user");
 			if (!userCtx) throw ApiError.unauthorized("Not authenticated");
 			const payload = parseBody(provider.schema, await c.req.json());
-			let externalUser;
-			try {
-				externalUser = await provider.verify(payload);
-			} catch (err) {
-				const msg = err instanceof Error ? err.message : String(err);
-				throw ApiError.unauthorized(`${provider.id} link failed: ${msg}`, "OAUTH_ERROR");
-			}
-			if (!externalUser) throw ApiError.unauthorized(`Invalid ${provider.id} credentials`, "INVALID_TOKEN");
+			const externalUser = await verifyProviderPayload(provider, payload);
 			const identityOwner = await authRepo.getUserByIdentity(provider.id, externalUser.providerId);
 			if (identityOwner && identityOwner.id !== userCtx.uid) throw ApiError.conflict(`That ${provider.id} account is already linked to a different user.`, "IDENTITY_ALREADY_LINKED");
 			if (identityOwner) return c.json({
 				success: true,
 				provider: provider.id,
-				alreadyLinked: true
+				alreadyLinked: true,
+				photoURL: externalUser.photoUrl ?? null
 			});
-			await authRepo.linkUserIdentity(userCtx.uid, provider.id, externalUser.providerId, { email: externalUser.email });
+			await authRepo.linkUserIdentity(userCtx.uid, provider.id, externalUser.providerId, identityProfileData(externalUser));
 			return c.json({
 				success: true,
 				provider: provider.id,
-				alreadyLinked: false
+				alreadyLinked: false,
+				photoURL: externalUser.photoUrl ?? null
 			});
 		});
 	}
@@ -4595,7 +4992,9 @@ function createAuthRoutes(config) {
 		const storedToken = await authRepo.findValidPasswordResetToken(tokenHash);
 		if (!storedToken) throw ApiError.badRequest("Invalid or expired reset token", "INVALID_TOKEN");
 		const passwordHash = await ops.hashPassword(password);
-		await replaceUserPassword(authRepo, storedToken.uid, passwordHash);
+		const account = await authRepo.getUserById(storedToken.uid);
+		if (account && !account.emailVerified) await confirmAddressOwnership(authRepo, account, passwordHash);
+		else await replaceUserPassword(authRepo, storedToken.uid, passwordHash);
 		await authRepo.markPasswordResetTokenUsed(tokenHash);
 		if (ops.onPasswordReset) ops.onPasswordReset(storedToken.uid).catch((err) => {
 			logger.error("[AuthHooks] onPasswordReset error", { error: err instanceof Error ? err.message : err });
@@ -4748,7 +5147,14 @@ function createAuthRoutes(config) {
 		};
 		if (!supersededAt) if (authRepo.markRefreshTokenRotated) await authRepo.markRefreshTokenRotated(tokenHash);
 		else await authRepo.deleteRefreshToken(tokenHash);
-		await authRepo.createRefreshToken(storedToken.uid, await hashRefreshToken(newRefreshToken), getRefreshTokenExpiry(), userAgent, ipAddress, session);
+		const presentedKept = Boolean(supersededAt) || typeof authRepo.markRefreshTokenRotated === "function";
+		if (await authRepo.createRefreshToken(storedToken.uid, await hashRefreshToken(newRefreshToken), getRefreshTokenExpiry(), userAgent, ipAddress, presentedKept ? {
+			...session,
+			rotatedFrom: tokenHash
+		} : session) === false) {
+			clearRefreshCookie(c, config.cookieAuth);
+			throw ApiError.unauthorized("Session has been revoked", "SESSION_REVOKED");
+		}
 		authRepo.pruneRefreshTokens?.(storedToken.uid, session.id, new Date(Date.now() - reuseWindowMs)).catch((err) => {
 			logger.warn("[Auth] Refresh token prune failed", { error: err instanceof Error ? err.message : String(err) });
 		});
@@ -4775,7 +5181,8 @@ function createAuthRoutes(config) {
 		buildAuthResponse,
 		createSessionAndTokens,
 		applyTransformHook,
-		requireLiveSession
+		requireLiveSession,
+		registerCaptcha: captcha.register
 	});
 	mountMfaRoutes({
 		router,
@@ -4910,7 +5317,7 @@ function createResetPasswordRoute(config) {
 			const expiresAt = new Date(Date.now() + 3600 * 1e3);
 			await authRepo.createPasswordResetToken(existing.id, tokenHash, expiresAt);
 			try {
-				const setPasswordUrl = `${emailConfig?.resetPasswordUrl || ""}/reset-password?token=${token}`;
+				const setPasswordUrl = `${resolveEmailLinkBase(emailConfig, "resetPassword")}/reset-password?token=${token}`;
 				const { appName, logoUrl } = resolveEmailBranding(emailConfig);
 				const templateFn = emailConfig?.templates?.passwordReset;
 				const emailContent = templateFn ? templateFn(setPasswordUrl, {
@@ -5032,15 +5439,18 @@ function createAdminUsersRoute(config) {
 		}
 		const uid = "uid" in user ? user.uid : void 0;
 		if (!uid) throw ApiError.unauthorized("User ID not found in auth context");
-		if (isAnonymousUid(uid)) {
+		const refuseAnonymousCaller = () => {
 			logger.warn("[Security Audit] Bootstrap denied: anonymous caller", {
 				eventType: "auth.bootstrap.denied.anonymous",
 				callerId: uid
 			});
 			throw ApiError.forbidden("An anonymous session cannot claim the initial admin role. Register a real account and bootstrap from it, or assign the admin role using the service key.", "BOOTSTRAP_ANONYMOUS");
-		}
-		if (!await authRepo.getUserById(uid)) throw ApiError.notFound("Authenticated user does not exist in the database.", "USER_NOT_FOUND");
-		const registeredUsers = users.filter((u) => !isAnonymousUid(u.id));
+		};
+		if (isAnonymousUid(uid)) refuseAnonymousCaller();
+		const caller = await authRepo.getUserById(uid);
+		if (!caller) throw ApiError.notFound("Authenticated user does not exist in the database.", "USER_NOT_FOUND");
+		if (caller.isAnonymous === true) refuseAnonymousCaller();
+		const registeredUsers = users.filter((u) => u.isAnonymous !== true && !isAnonymousUid(u.id));
 		if (registeredUsers.length > 0) {
 			const earliest = registeredUsers.reduce((a, b) => {
 				const at = new Date(a.createdAt).getTime();
@@ -5135,7 +5545,8 @@ function createAdminUsersRoute(config) {
 			passwordHash: prepResult.values.passwordHash,
 			displayName: prepResult.values.displayName,
 			photoUrl: prepResult.values.photoUrl,
-			metadata: prepResult.values.metadata
+			metadata: prepResult.values.metadata,
+			emailVerified: prepResult.values.emailVerified === true
 		};
 		if (ops.beforeUserCreate) createData = await ops.beforeUserCreate(createData);
 		const user = await authRepo.createUser(createData);
@@ -5160,8 +5571,12 @@ function createAdminUsersRoute(config) {
 		const uid = c.req.param("uid");
 		const { password, email, displayName, roles } = await c.req.json();
 		if (!await authRepo.getUserById(uid)) throw ApiError.notFound("User not found");
+		if (roles !== void 0 && Array.isArray(roles)) await assertRoleChangesAllowed(authRepo, [{
+			uid,
+			roles
+		}]);
 		const updates = {};
-		if (email !== void 0) updates.email = normalizeEmail(email);
+		if (email !== void 0) updates.email = await normalizeUserEmailChange(authRepo, uid, email);
 		if (displayName !== void 0) updates.displayName = displayName;
 		let passwordHash;
 		if (password) {
@@ -5171,17 +5586,7 @@ function createAdminUsersRoute(config) {
 		}
 		if (Object.keys(updates).length > 0) await authRepo.updateUser(uid, updates);
 		if (passwordHash) await replaceUserPassword(authRepo, uid, passwordHash);
-		if (roles !== void 0 && Array.isArray(roles)) {
-			const wasAdmin = (await authRepo.getUserRoleIds(uid)).includes("admin");
-			const willBeAdmin = roles.includes("admin");
-			if (wasAdmin && !willBeAdmin) {
-				if ((await authRepo.listUsersPaginated({
-					roleId: "admin",
-					limit: 1
-				})).total <= 1) throw ApiError.forbidden("Cannot demote the last administrator", "LAST_ADMIN");
-			}
-			await authRepo.setUserRoles(uid, roles);
-		}
+		if (roles !== void 0 && Array.isArray(roles)) await authRepo.setUserRoles(uid, roles);
 		const result = await authRepo.getUserWithRoles(uid);
 		const adminUser = toAdminUser(result.user, result.roles.map((r) => r.id));
 		return c.json({ user: adminUser });
@@ -5190,17 +5595,11 @@ function createAdminUsersRoute(config) {
 		const uid = c.req.param("uid");
 		if (c.get("user")?.uid === uid) throw ApiError.badRequest("Cannot delete your own account", "SELF_DELETE");
 		if (!await authRepo.getUserById(uid)) throw ApiError.notFound("User not found");
-		if ((await authRepo.getUserRoleIds(uid)).includes("admin")) {
-			if ((await authRepo.listUsersPaginated({
-				roleId: "admin",
-				limit: 1
-			})).total <= 1) throw ApiError.forbidden("Cannot delete the last administrator", "LAST_ADMIN");
-		}
+		await assertUserDeletionsAllowed(authRepo, [uid]);
 		if (ops.beforeUserDelete) await ops.beforeUserDelete(uid);
+		await authRepo.deleteAllRefreshTokensForUser(uid);
 		await authRepo.deleteUser(uid);
-		if (ops.afterUserDelete) ops.afterUserDelete(uid).catch((err) => {
-			logger.error("[AuthHooks] afterUserDelete error", { error: err instanceof Error ? err.message : err });
-		});
+		runAfterUserDelete(ops, uid);
 		return c.json({ success: true });
 	});
 	return router;
@@ -5217,6 +5616,29 @@ function createAdminUsersRoute(config) {
 function createBuiltinAuthAdapter(config) {
 	const { authRepository, emailService, emailConfig, allowRegistration = false, disableSelfRegistration = false, allowAnonymous = false, allowUserLookup = false, captcha, defaultRole, oauthProviders = [], allowedRedirectUris, serviceKey, authHooks, collectionAuthConfig, enableMagicLink = false, enableEmailOtp = false, cookieAuth } = config;
 	const resolvedOps = resolveAuthHooks(authHooks);
+	/**
+	* The caller's roles as the database has them now.
+	*
+	* Read per request because the token's `roles` claim can be a whole
+	* access-token lifetime stale — a demoted admin still holds a token that
+	* says `admin`. So when the read fails, falling back to the claim hands
+	* that token exactly the access the lookup exists to take away; during a
+	* database blip it scoped a demoted admin with admin RLS. This refuses
+	* instead, with the 503 `createRequireAuth` already gives the admin
+	* routes: the adapter middleware answers with it, and the socket treats
+	* a throwing adapter as an invalid token.
+	*/
+	async function resolveLiveRoles(uid) {
+		try {
+			return await authRepository.getUserRoleIds(uid);
+		} catch (error) {
+			logger.warn("[Auth] Could not resolve roles for a request; refusing it", {
+				uid,
+				error
+			});
+			throw new ApiError(503, "ROLE_LOOKUP_FAILED", "Could not verify your permissions. Please try again.");
+		}
+	}
 	return {
 		id: "rebase-builtin",
 		serviceKey,
@@ -5239,15 +5661,7 @@ function createBuiltinAuthAdapter(config) {
 				});
 				return null;
 			}
-			let roles = payload.roles || [];
-			try {
-				roles = await authRepository.getUserRoleIds(payload.uid);
-			} catch (err) {
-				logger.warn("Role lookup from repository failed, using token roles as fallback", {
-					uid: payload.uid,
-					error: err
-				});
-			}
+			const roles = await resolveLiveRoles(payload.uid);
 			const isAdmin = hasAdministrativeRole(roles);
 			return {
 				uid: payload.uid,
@@ -5256,6 +5670,7 @@ function createBuiltinAuthAdapter(config) {
 				roles,
 				isAdmin,
 				isAnonymous: payload.isAnonymous === true,
+				...payload.claims ? { claims: payload.claims } : {},
 				rawToken: token
 			};
 		},
@@ -5276,15 +5691,7 @@ function createBuiltinAuthAdapter(config) {
 				});
 				return null;
 			}
-			let roles = payload.roles || [];
-			try {
-				roles = await authRepository.getUserRoleIds(payload.uid);
-			} catch (err) {
-				logger.warn("Role lookup from repository failed, using token roles as fallback", {
-					uid: payload.uid,
-					error: err
-				});
-			}
+			const roles = await resolveLiveRoles(payload.uid);
 			const isAdmin = hasAdministrativeRole(roles);
 			return {
 				uid: payload.uid,
@@ -5293,6 +5700,7 @@ function createBuiltinAuthAdapter(config) {
 				roles,
 				isAdmin,
 				isAnonymous: payload.isAnonymous === true,
+				...payload.claims ? { claims: payload.claims } : {},
 				rawToken: token
 			};
 		},
@@ -5371,6 +5779,10 @@ function createBuiltinAuthAdapter(config) {
 				collectionAuthConfig
 			});
 		},
+		...authCollectionUserAdmin({
+			authRepo: authRepository,
+			resolvedHooks: resolvedOps
+		}),
 		async getCapabilities() {
 			let needsSetup = false;
 			try {
@@ -5444,6 +5856,7 @@ function createUserManagementFromRepo(repo, resolvedOps) {
 		},
 		async deleteUser(id) {
 			if (resolvedOps.beforeUserDelete) await resolvedOps.beforeUserDelete(id);
+			await repo.deleteAllRefreshTokensForUser(id);
 			await repo.deleteUser(id);
 			if (resolvedOps.afterUserDelete) resolvedOps.afterUserDelete(id).catch((err) => {
 				logger.error("[AuthHooks] afterUserDelete error", { error: err instanceof Error ? err.message : err });
@@ -7177,6 +7590,6 @@ var auth_exports = /* @__PURE__ */ __exportAll({
 	verifyPassword: () => verifyPassword
 });
 //#endregion
-export { requireAdmin as $, defaultAuthLimiter as A, resolveEmailLinkBase as B, providerVerifiedEmail as C, raw as Ct, DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT as D, isPublicStoragePath as Dt, isBootstrapWindowOpen as E, PUBLIC_STORAGE_PREFIX as Et, extractLinks as F, createAdapterAuthMiddleware as G, hashPassword as H, registerDevEmailSink as I, extractUserFromToken as J, createAuthMiddleware as K, SMTPEmailService as L, activeDevEmailSink as M, clearActiveDevEmailSink as N, createDataRateLimiter as O, createDevEmailSink as P, queryTokenAuth as Q, createEmailService as R, pkceTokenParams as S, html as St, createBuiltinAuthAdapter as T, isOperationAllowed as Tt, validatePasswordStrength as U, resolveAuthHooks as V, verifyPassword as W, optionalAuth as X, fileTokenAuth as Y, publicObjectAuth as Z, verifyOidcIdToken as _, getUserInvitationTemplate as _t, resolveRateLimitStoreKind as a, validateApiKey as at, createGoogleProvider as b, RawHtml as bt, createSlackProvider as c, SERVICE_IDENTITY as ct, createDiscordProvider as d, completeUserCreation as dt, requireAuth as et, createTwitterProvider as f, generateSecurePassword as ft, tryVerifyOidcIdToken as g, getPasswordResetTemplate as gt, createMicrosoftProvider as h, getMagicLinkTemplate as ht, createApiKeyStore as i, isApiKeyToken as it, MemoryRateLimitStore as j, createRateLimiter as k, createBitbucketProvider as l, scopeDataDriver as lt, createAppleProvider as m, getEmailVerificationTemplate as mt, createCustomAuthAdapter as n, createFunctionApiKeyGuard as nt, createSqlRateLimitStore as o, extractBearerToken as ot, createFacebookProvider as p, getEmailOtpTemplate as pt, createRequireAuth as q, createApiKeyRoutes as r, createStorageApiKeyGuard as rt, createSpotifyProvider as s, safeCompare as st, auth_exports as t, createApiKeyPreAuth as tt, createGitLabProvider as u, supportsRlsScoping as ut, createGitHubProvider as v, getWelcomeEmailTemplate as vt, createJwksRoutes as w, httpMethodToOperation as wt, oauthCodeFlowSchema as x, escapeHtml as xt, createLinkedinProvider as y, resolveEmailBranding as yt, assertEmailLinkBases as z };
+export { requireAdmin as $, createRateLimiter as A, isPublicStoragePath as At, createEmailService as B, providerVerifiedEmail as C, RawHtml as Ct, DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT as D, httpMethodToOperation as Dt, isBootstrapWindowOpen as E, raw as Et, clearActiveDevEmailSink as F, createAdapterAuthMiddleware as G, hashPassword as H, createDevEmailSink as I, extractUserFromToken as J, createAuthMiddleware as K, extractLinks as L, setSharedRateLimitStore as M, MemoryRateLimitStore as N, createDataRateLimitCheck as O, isOperationAllowed as Ot, activeDevEmailSink as P, queryTokenAuth as Q, registerDevEmailSink as R, pkceTokenParams as S, resolveEmailBranding as St, createBuiltinAuthAdapter as T, html as Tt, validatePasswordStrength as U, resolveAuthHooks as V, verifyPassword as W, optionalAuth as X, fileTokenAuth as Y, publicObjectAuth as Z, verifyOidcIdToken as _, getEmailVerificationTemplate as _t, resolveRateLimitStoreKind as a, validateApiKey as at, createGoogleProvider as b, getUserInvitationTemplate as bt, createSlackProvider as c, SERVICE_IDENTITY as ct, createDiscordProvider as d, isAccessTokenRevoked as dt, requireAuth as et, createTwitterProvider as f, completeUserCreation as ft, tryVerifyOidcIdToken as g, getEmailOtpTemplate as gt, createMicrosoftProvider as h, resolveEmailLinkBase as ht, createApiKeyStore as i, isApiKeyToken as it, defaultAuthLimiter as j, createDataRateLimiter as k, PUBLIC_STORAGE_PREFIX as kt, createBitbucketProvider as l, scopeDataDriver as lt, createAppleProvider as m, assertEmailLinkBases as mt, createCustomAuthAdapter as n, createFunctionApiKeyGuard as nt, createSqlRateLimitStore as o, extractBearerToken as ot, createFacebookProvider as p, generateSecurePassword as pt, createRequireAuth as q, createApiKeyRoutes as r, createStorageApiKeyGuard as rt, createSpotifyProvider as s, safeCompare as st, auth_exports as t, createApiKeyPreAuth as tt, createGitLabProvider as u, supportsRlsScoping as ut, createGitHubProvider as v, getMagicLinkTemplate as vt, createJwksRoutes as w, escapeHtml as wt, oauthCodeFlowSchema as x, getWelcomeEmailTemplate as xt, createLinkedinProvider as y, getPasswordResetTemplate as yt, SMTPEmailService as z };
 
-//# sourceMappingURL=auth-DZXQRmYD.js.map
+//# sourceMappingURL=auth-B-GIMpDG.js.map