@rebasepro/server 0.24.0 → 0.24.1-canary.g56af4a4

package/dist/{auth-DMLngxn_.js → auth-OPq_FeMs.js}

@@ -3,14 +3,17 @@ import __rebaseProcess from "process";
 globalThis.process ??= __rebaseProcess;
 __rebaseCreateRequire(import.meta.url);
 import { i as __toESM, n as __exportAll } from "./rolldown-runtime-dW7B1o5h.js";
-import { P as revokeInternalTableSql, ct as isAnonymousUid, st as ANONYMOUS_USER_ID } from "./src-I3aG1PcY.js";
-import { _ as scopesForRoles, a as KEY_MANAGEMENT_SCOPES, b as validateScopes, c as intersectScopes, d as isDataPlaneScope, f as knownScopes, g as scopesBeyond, h as scopeGrantsAny, i as EMPTY_ACCESS_MODEL, l as isAdminScope, m as scopeGrants, n as ADMIN_SCOPES, o as SCOPE_TARGETS, p as parseScope, r as BUILT_IN_SCOPES, s as hasAdminRole, t as ADMIN_ROLE, u as isBuiltInScope, v as summarizeRoles } from "./src-CatHFUym.js";
+import { r as toSnakeCase } from "./strings.es-BeZWAodn.js";
+import { B as rewriteLegacyRlsFunctions, _ as scopesForRoles, a as KEY_MANAGEMENT_SCOPES, b as validateScopes, c as intersectScopes, d as isDataPlaneScope, f as knownScopes, g as scopesBeyond, h as scopeGrantsAny, i as EMPTY_ACCESS_MODEL, l as isAdminScope, m as scopeGrants, n as ADMIN_SCOPES, o as SCOPE_TARGETS, p as parseScope, r as BUILT_IN_SCOPES, s as hasAdminRole, t as ADMIN_ROLE, u as isBuiltInScope, v as summarizeRoles } from "./src-CatHFUym.js";
+import { n as isAnonymousUid, r as policy, t as ANONYMOUS_USER_ID } from "./policy-PdzX-Opd.js";
 import { t as isSQLAdmin } from "./backend-DTAOsLQc.js";
+import { t as IMPERSONATE_HEADER } from "./auth_adapter-CIItCTc8.js";
+import { n as revokeInternalTableSql, t as REBASE_USER_ROLE } from "./internal-tables-L2t39RdT.js";
 import { t as firstSqlRow } from "./sql-rows-C6GEc2oE.js";
+import { a as resolveListLimitParam } from "./query-parser-DK9eMkb9.js";
 import { r as logger } from "./logger-D-S-hO5e.js";
 import { i as isDataException, r as errorHandler, t as ApiError } from "./errors-D6_y86c5.js";
-import { a as resolveListLimitParam } from "./query-parser-BgiKJKvc.js";
-import { D as constantTimeEqual, E as require_jsonwebtoken, S as verifyMfaPendingToken, a as generateAccessToken, b as verifyDownloadToken, c as generateMfaPendingToken, d as getJwks, f as getRefreshTokenExpiry, g as isJwtConfigured, h as hashRefreshToken, i as customClaimsOf, j as sha256Hex, k as randomInt$1, l as generateRefreshToken, m as hasAsymmetricSigningKey, n as configureJwt, o as generateDownloadToken, p as getRefreshTokenTtlMs, r as configuredJwtSecret, t as MAX_COOKIE_AGE_MS, u as getAccessTokenExpiry, y as verifyAccessToken } from "./jwt-R6bSPMjk.js";
+import { D as constantTimeEqual, E as require_jsonwebtoken, S as verifyMfaPendingToken, a as generateAccessToken, b as verifyDownloadToken, c as generateMfaPendingToken, d as getJwks, f as getRefreshTokenExpiry, g as isJwtConfigured, h as hashRefreshToken, i as customClaimsOf, j as sha256Hex, k as randomInt$1, l as generateRefreshToken, m as hasAsymmetricSigningKey, n as configureJwt, o as generateDownloadToken, p as getRefreshTokenTtlMs, r as configuredJwtSecret, t as MAX_COOKIE_AGE_MS, u as getAccessTokenExpiry, y as verifyAccessToken } from "./jwt-Bqcu7cGt.js";
 import { a as canonicalStorageId, o as canonicalStorageKey, r as InvalidStorageKeyError } from "./keys-GAVZqbqx.js";
 import { n as createDdlBootstrapper } from "./ddl-bootstrap-BaqMSa4Y.js";
 import { createHash, randomBytes, randomInt } from "node:crypto";
@@ -20,20 +23,6 @@ import { createCipheriv, createDecipheriv, createHash as createHash$1, createHma
 import { getConnInfo } from "@hono/node-server/conninfo";
 import { createMiddleware } from "hono/factory";
 import { z } from "zod";
-//#region ../types/src/types/auth_adapter.ts
-/**
-* The request header that asks for a data-plane request to run as another
-* user, named by uid.
-*
-* The server honours it only on a signed-in administrator's own session —
-* never on an API key or the service key — and only through an adapter that
-* implements {@link AuthAdapter.resolveUser}. Everywhere else a request that
-* carries it is refused, never run as its caller.
-*
-* @group Auth
-*/
-var IMPERSONATE_HEADER = "x-rebase-impersonate";
-//#endregion
 //#region ../types/src/controllers/storage.ts
 /**
 * Path prefix that marks an object as **public**. Files stored under this
@@ -102,8 +91,8 @@ function isPublicStoragePath(path) {
 * so the key `default/photo.png` sent as it is names the root `photo.png`:
 * {@link defaultBucketPath} is the spelling that names the key itself.
 *
-* Shared by every storage source that talks to those routes — the SDK's and
-* the admin panel's `useBackendStorageSource` — so they address an object alike.
+* Shared by every storage source that talks to those routes, so they address
+* an object alike.
 *
 * @group Models
 */
@@ -169,6 +158,476 @@ function normalizeEmail(email) {
 	return typeof email === "string" ? email.trim().toLowerCase() : email;
 }
 //#endregion
+//#region ../common/src/util/policy/sqlToPolicy.ts
+/**
+* A tiny, regex-based SQL "parser" for security rules.
+*
+* This is NOT a full SQL parser. It is designed to handle the subset of SQL
+* commonly used in `USING` and `WITH CHECK` clauses, enough to drive the
+* optimistic client-side UI decision.
+*
+* It handles:
+* - `field = 'literal'`
+* - `field != 'literal'`
+* - `field = current_setting('app.uid')` (or the legacy `app.user_id`)
+* - `A AND B`, `A OR B` — only where the keyword is at the top level
+* - `true`
+* - `IN (...)` (as optimistic true)
+*
+* For anything it doesn't understand, it returns a `raw` expression, which
+* the evaluator treats as "unknown" (and usually optimistic true).
+*
+* **This output also round-trips back into DDL** via `policyToPostgres` (the
+* schema/policy generators), so decomposing a clause the parser only partly
+* understands is not a cosmetic mistake — it emits invalid SQL. When in doubt,
+* prefer `raw`: it is reproduced verbatim.
+*/
+/** True when `keyword` starts at `i` as a standalone word. */
+function isKeywordAt(upper, i, keyword) {
+	if (!upper.startsWith(keyword, i)) return false;
+	const before = i === 0 ? " " : upper[i - 1];
+	const after = upper[i + keyword.length] ?? " ";
+	return /[\s()]/.test(before) && /[\s()]/.test(after);
+}
+/**
+* Split `sql` on a boolean keyword, but only where it sits at paren depth 0 and
+* outside a string literal. Returns null when it never does, so the caller
+* leaves the clause alone.
+*
+* This used to be `sql.split(/ AND /i)`, which tore subqueries in half: the
+* `AND` inside
+*   `EXISTS (SELECT 1 FROM organization_members m WHERE m.org = t.org AND m.user_id = rebase.uid())`
+* split the expression, and re-emitting the halves produced
+*   `(EXISTS (...) AND m.user_id = rebase.uid())`
+* where `m` is no longer in scope — SQL that Postgres rejects outright with
+* "missing FROM-clause entry for table". Returning null instead keeps such a
+* clause as a `raw` expression, which round-trips verbatim.
+*/
+function splitTopLevel(sql, keyword) {
+	const upper = sql.toUpperCase();
+	const parts = [];
+	let depth = 0;
+	let inString = false;
+	let start = 0;
+	for (let i = 0; i < sql.length; i++) {
+		const ch = sql[i];
+		if (inString) {
+			if (ch === "'") if (sql[i + 1] === "'") i++;
+			else inString = false;
+			continue;
+		}
+		if (ch === "'") {
+			inString = true;
+			continue;
+		}
+		if (ch === "(") {
+			depth++;
+			continue;
+		}
+		if (ch === ")") {
+			depth--;
+			continue;
+		}
+		if (depth === 0 && isKeywordAt(upper, i, keyword)) {
+			parts.push(sql.slice(start, i));
+			i += keyword.length - 1;
+			start = i + 1;
+		}
+	}
+	if (parts.length === 0) return null;
+	parts.push(sql.slice(start));
+	const trimmedParts = parts.map((p) => p.trim()).filter((p) => p.length > 0);
+	return trimmedParts.length > 1 ? trimmedParts : null;
+}
+/** `SELECT` as the first word of `sql`. */
+var STARTS_WITH_SELECT = /^select(?=[\s(])/i;
+/**
+* Drop redundant wrapping parens (`(a AND b)` → `a AND b`), never `(a) AND (b)`
+* — and never the parens of a scalar subquery: `(SELECT x)` without them is not
+* an expression at all, and re-emitted bare it is a syntax error inside
+* `USING (…)`.
+*/
+function stripOuterParens(sql) {
+	let s = sql.trim();
+	while (wrapsWhole(s) && !STARTS_WITH_SELECT.test(s.slice(1).trim())) s = s.slice(1, -1).trim();
+	return s;
+}
+/** Whether `s` is one parenthesised group: `(a AND b)`, not `(a) AND (b)`. */
+function wrapsWhole(s) {
+	if (!s.startsWith("(") || !s.endsWith(")")) return false;
+	let depth = 0;
+	let inString = false;
+	for (let i = 0; i < s.length; i++) {
+		const ch = s[i];
+		if (inString) {
+			if (ch === "'") if (s[i + 1] === "'") i++;
+			else inString = false;
+			continue;
+		}
+		if (ch === "'") {
+			inString = true;
+			continue;
+		}
+		if (ch === "(") depth++;
+		else if (ch === ")") {
+			depth--;
+			if (depth === 0 && i < s.length - 1) return false;
+		}
+	}
+	return true;
+}
+/** `x` when `s` is exactly `(SELECT x)`, otherwise null. */
+function scalarSubqueryBody(s) {
+	if (!wrapsWhole(s)) return null;
+	const inner = s.slice(1, -1).trim();
+	return STARTS_WITH_SELECT.test(inner) ? inner.slice(6).trim() : null;
+}
+/** Whether any part of `expr` fell through to `raw`. */
+function containsRaw(expr) {
+	switch (expr.kind) {
+		case "raw": return true;
+		case "and":
+		case "or": return expr.operands.some(containsRaw);
+		case "not": return containsRaw(expr.operand);
+		case "existsIn": return containsRaw(expr.where);
+		default: return false;
+	}
+}
+function sqlToPolicy(sql) {
+	const trimmed = stripOuterParens(rewriteLegacyRlsFunctions(sql).trim());
+	const subqueryBody = scalarSubqueryBody(trimmed);
+	if (subqueryBody !== null) {
+		const inner = sqlToPolicy(subqueryBody);
+		return containsRaw(inner) ? policy.raw(trimmed) : inner;
+	}
+	if (trimmed.toLowerCase() === "true") return policy.true();
+	if (trimmed.toLowerCase() === "false") return policy.false();
+	const overlapMatch = trimmed.match(/^string_to_array\s*\(\s*rebase\.roles\(\)\s*,\s*','\s*\)\s*&&\s*ARRAY\s*\[(.+)\]$/i);
+	if (overlapMatch) {
+		const roles = overlapMatch[1].split(",").map((s) => s.trim().replace(/^'|'$/g, ""));
+		return policy.rolesOverlap(roles);
+	}
+	const containMatch = trimmed.match(/^string_to_array\s*\(\s*rebase\.roles\(\)\s*,\s*','\s*\)\s*@>\s*ARRAY\s*\[(.+)\]$/i);
+	if (containMatch) {
+		const roles = containMatch[1].split(",").map((s) => s.trim().replace(/^'|'$/g, ""));
+		return policy.rolesContain(roles);
+	}
+	const orParts = splitTopLevel(trimmed, "OR");
+	if (orParts) return policy.or(...orParts.map(sqlToPolicy));
+	const andParts = splitTopLevel(trimmed, "AND");
+	if (andParts) return policy.and(...andParts.map(sqlToPolicy));
+	const match = trimmed.match(/^(.+?)\s*(!?=)\s*(.+)$/);
+	if (match) {
+		const [, leftStr, op, rightStr] = match;
+		const left = parseOperand(leftStr.trim());
+		const right = parseOperand(rightStr.trim());
+		if (left && right) return policy.compare(left, op === "=" ? "eq" : "neq", right);
+	}
+	return policy.raw(trimmed);
+}
+/**
+* Literals from other BaaS platforms that people compare `rebase.uid()` against
+* out of habit. Mirrors the driver's `FOREIGN_CONVENTION_ROLES` guard on
+* `pgRoles`, one surface over: the same muscle memory inside a `using:` string
+* is the more dangerous spelling, because it inverts a rule instead of
+* emptying a table.
+*/
+/**
+* A `Map`, not an object literal.
+*
+* As `Record<string, string>` this was indexed with a literal taken straight
+* out of a policy, so every key on `Object.prototype` answered: a rule
+* comparing `rebase.uid()` to `"valueOf"`, `"toString"`, `"constructor"` or
+* `"hasOwnProperty"` found a truthy "platform" and reported an anonymous-grant
+* risk that does not exist — with the matched function interpolated into the
+* explanation as the platform's name. A security warning that fires on
+* innocent input is worse than none: it is what teaches people to skip the
+* warnings that are real.
+*
+* Same shape as the prototype-pollution class swept out of `setIn`, `getIn`,
+* `mergeDeep` and `unflattenObject` — a data-derived key reaching a plain
+* object. Found by a property test, on the input `"valueOf"`.
+*/
+var FOREIGN_CONVENTION_UIDS = /* @__PURE__ */ new Map([
+	["anon", "Supabase"],
+	["authenticated", "Supabase"],
+	["service_role", "Supabase"]
+]);
+new RegExp(String.raw`rebase\.uid\(\)\s*=\s*'(${[...FOREIGN_CONVENTION_UIDS.keys()].join("|")})'`, "i");
+function parseOperand(str) {
+	if (/^current_setting\s*\(\s*'app\.(uid|user_id)'\s*\)$/i.test(str) || /^rebase\.uid\(\)$/i.test(str)) return policy.authUid();
+	if (/^\(\s*select\s+rebase\.uid\(\)(?:\s+as\s+"?uid"?)?\s*\)$/i.test(str)) return policy.authUid();
+	const literal = parseSingleQuoted(str);
+	if (literal !== null) return policy.literal(literal);
+	if (/^-?\d+$/.test(str)) return policy.literal(Number(str));
+	if (/^-?\d*\.\d+$/.test(str)) return policy.literal(Number(str));
+	if (/^true$/i.test(str)) return policy.literal(true);
+	if (/^false$/i.test(str)) return policy.literal(false);
+	if (/^null$/i.test(str)) return policy.literal(null);
+	if (/^\w+$/.test(str) && toSnakeCase(str) !== "") return policy.field(str);
+	return null;
+}
+/**
+* Decode a single-quoted SQL literal, or null when `str` is not exactly one.
+*
+* Rejecting is as important as decoding: `'a' = 'b'` is two literals and an
+* operator, not one literal whose body contains a quote, and a regex anchored
+* on the outer quotes would happily read it as the latter. Every interior quote
+* must therefore be part of a `''` pair.
+*/
+function parseSingleQuoted(str) {
+	if (str.length < 2 || !str.startsWith("'") || !str.endsWith("'")) return null;
+	const body = str.slice(1, -1);
+	let out = "";
+	for (let i = 0; i < body.length; i++) {
+		if (body[i] !== "'") {
+			out += body[i];
+			continue;
+		}
+		if (body[i + 1] === "'") {
+			out += "'";
+			i++;
+			continue;
+		}
+		return null;
+	}
+	return out;
+}
+//#endregion
+//#region ../common/src/util/policy/securityRuleToConditions.ts
+/**
+* Desugars a {@link SecurityRule} — its `access`/`ownerField`/`roles` shortcuts,
+* structured `condition`/`check`, and raw `using`/`withCheck` — into a single
+* normalized {@link PolicyExpression} pair.
+*
+* **This is the linchpin against drift:** both the Postgres DDL generators and
+* the client-side evaluator consume this one function, so there is exactly one
+* definition of what a rule means. In particular, application `roles` are folded
+* into the expression here (AND'd with the base condition, matching how Postgres
+* generates the clause) rather than being handled separately by each consumer.
+*/
+function securityRuleToConditions(rule) {
+	return {
+		usingExpr: withRoles(baseUsing(rule), rule),
+		withCheckExpr: withRoles(baseWithCheck(rule), rule)
+	};
+}
+function baseUsing(rule) {
+	if (rule.condition) return rule.condition;
+	if (rule.using != null) return sqlToPolicy(rule.using);
+	if (rule.access === "public") return policy.true();
+	if (rule.ownerField) return policy.compare(policy.field(rule.ownerField), "eq", policy.authUid());
+	return null;
+}
+function baseWithCheck(rule) {
+	if (rule.check) return rule.check;
+	if (rule.withCheck != null) return sqlToPolicy(rule.withCheck);
+	return baseUsing(rule);
+}
+/**
+* AND the base condition with an application-role check, or produce a roles-only
+* condition when there is no base. Mirrors the Postgres generator so that a
+* role-scoped restrictive rule denies exactly the same set of users on both
+* sides.
+*/
+function withRoles(base, rule) {
+	if (!rule.roles || rule.roles.length === 0) return base;
+	const rolesExpr = policy.rolesOverlap(rule.roles);
+	if (rule.mode === "restrictive") return base ? policy.or(policy.not(rolesExpr), base) : policy.not(rolesExpr);
+	return base ? policy.and(base, rolesExpr) : rolesExpr;
+}
+//#endregion
+//#region ../common/src/util/policy/evaluatePolicy.ts
+/**
+* Evaluates a {@link PolicyExpression} against a user + row, using three-valued
+* (Kleene) logic so that `"unknown"` sub-results propagate soundly.
+*
+* This is the JavaScript twin of {@link policyToPostgres}: both derive from the
+* same expression, so the admin UI matches database enforcement by construction
+* for every non-raw rule.
+*/
+function evaluatePolicy(expr, ctx) {
+	switch (expr.kind) {
+		case "true": return true;
+		case "false": return false;
+		case "and": return kleeneAnd$1(expr.operands.map((o) => evaluatePolicy(o, ctx)));
+		case "or": return kleeneOr(expr.operands.map((o) => evaluatePolicy(o, ctx)));
+		case "not": return kleeneNot(evaluatePolicy(expr.operand, ctx));
+		case "compare": return evaluateCompare(expr.op, expr.left, expr.right, ctx);
+		case "rolesOverlap": {
+			const userRoles = ctx.roles ?? [];
+			return expr.roles.some((r) => r === "public" || userRoles.includes(r));
+		}
+		case "rolesContain": {
+			const userRoles = ctx.roles ?? [];
+			return expr.roles.every((r) => r === "public" || userRoles.includes(r));
+		}
+		case "authenticated": return ctx.uid != null && !isAnonymousUid(ctx.uid);
+		case "registered": return ctx.uid != null && !isAnonymousUid(ctx.uid) && ctx.isAnonymous !== true;
+		case "serverContext": return false;
+		case "existsIn": return "unknown";
+		case "raw": return "unknown";
+	}
+}
+function kleeneAnd$1(values) {
+	if (values.some((v) => v === false)) return false;
+	if (values.some((v) => v === "unknown")) return "unknown";
+	return true;
+}
+function kleeneOr(values) {
+	if (values.some((v) => v === true)) return true;
+	if (values.some((v) => v === "unknown")) return "unknown";
+	return false;
+}
+function kleeneNot(value) {
+	if (value === "unknown") return "unknown";
+	return !value;
+}
+function resolveOperand(operand, ctx) {
+	switch (operand.kind) {
+		case "literal": return {
+			known: true,
+			value: operand.value
+		};
+		case "authUid": return {
+			known: true,
+			value: ctx.uid ?? "anonymous"
+		};
+		case "authRoles": return {
+			known: true,
+			value: ctx.roles ?? []
+		};
+		case "field":
+			if (!ctx.entity) return { known: false };
+			return {
+				known: true,
+				value: ctx.entity.values[operand.name]
+			};
+		case "outerField": return { known: false };
+		case "authClaim": return { known: false };
+	}
+}
+function evaluateCompare(op, left, right, ctx) {
+	const l = resolveOperand(left, ctx);
+	const r = resolveOperand(right, ctx);
+	if (!l.known || !r.known) return "unknown";
+	const a = l.value;
+	const b = r.value;
+	if (a === null || b === null) return "unknown";
+	if (op === "eq") return a === b;
+	if (op === "neq") return a !== b;
+	if (typeof a === "string" && typeof b === "string") {
+		if (op === "lt") return a < b;
+		if (op === "lte") return a <= b;
+		if (op === "gt") return a > b;
+		if (op === "gte") return a >= b;
+	}
+	if (typeof a === "number" && typeof b === "number") {
+		if (op === "lt") return a < b;
+		if (op === "lte") return a <= b;
+		if (op === "gt") return a > b;
+		if (op === "gte") return a >= b;
+	}
+	if (typeof a === "bigint" && typeof b === "bigint") {
+		if (op === "lt") return a < b;
+		if (op === "lte") return a <= b;
+		if (op === "gt") return a > b;
+		if (op === "gte") return a >= b;
+	}
+	return "unknown";
+}
+//#endregion
+//#region ../common/src/util/permissions.ts
+/** Combine clause results with AND under three-valued (Kleene) logic. */
+function kleeneAnd(values) {
+	if (values.some((v) => v === false)) return false;
+	if (values.some((v) => v === "unknown")) return "unknown";
+	return true;
+}
+/** The operations a rule covers, mirroring the Postgres generator's resolution. */
+function ruleOperations(rule) {
+	return rule.operations && rule.operations.length > 0 ? rule.operations : [rule.operation ?? "all"];
+}
+function ruleApplies(rule, targetOperation) {
+	const ops = ruleOperations(rule);
+	return ops.includes(targetOperation) || ops.includes("all");
+}
+/**
+* Evaluate a single rule for one operation, returning a tri-state.
+*
+* A `null` clause (the rule contributes no condition for a required clause)
+* denies — matching Postgres, which emits `USING (false)` / `WITH CHECK (false)`
+* in that case. USING applies to SELECT/UPDATE/DELETE; WITH CHECK to
+* INSERT/UPDATE; both must pass for UPDATE.
+*/
+function evaluateRuleForOperation(rule, ctx, targetOperation, clauses = "both") {
+	const { usingExpr, withCheckExpr } = securityRuleToConditions(rule);
+	const clause = (expr) => expr === null ? false : evaluatePolicy(expr, ctx);
+	const needsUsing = targetOperation !== "insert" && clauses !== "withCheck";
+	const needsWithCheck = (targetOperation === "insert" || targetOperation === "update") && clauses !== "using";
+	const results = [];
+	if (needsUsing) results.push(clause(usingExpr));
+	if (needsWithCheck) results.push(clause(withCheckExpr));
+	return kleeneAnd(results);
+}
+function resolveTriState(value, onUnknown) {
+	if (value === "unknown") return onUnknown === "allow";
+	return value;
+}
+/**
+* Decide whether an operation is permitted for a user on a (possibly null) row,
+* by evaluating the collection's security rules with the shared policy model —
+* the same model compiled to Postgres RLS DDL, so the decision matches database
+* enforcement for every non-raw rule.
+*
+* Engine-independent by design. `securityRules` are a declaration about the
+* data, not about Postgres: the engine decides *who* enforces them (Postgres
+* compiles them to RLS DDL, a document driver applies them in-process), never
+* *whether* they hold. Gating this function on the engine's `supportsRLS`
+* capability is what made every `{ onUnknown: "deny" }` call site in the Mongo
+* driver return `true` before it evaluated anything — and it did so only for
+* collections that spelled their engine out, so declaring `engine: "mongodb"`
+* was what switched authorization off.
+*
+* @param options.onUnknown how to treat rules that cannot be decided
+*   client-side (raw SQL, or row predicates with no row). Defaults to `"allow"`
+*   for optimistic UI gating; enforcement callers should pass `"deny"`.
+* @param options.clauses which half of each rule to evaluate. See
+*   {@link PolicyClauses}; defaults to `"both"`.
+*/
+function checkOperation(collection, authContext, entity, targetOperation, options) {
+	const onUnknown = options?.onUnknown ?? "allow";
+	const clauses = options?.clauses ?? "both";
+	const securityRules = collection.securityRules;
+	if (!securityRules || securityRules.length === 0) return true;
+	const applicableRules = securityRules.filter((r) => ruleApplies(r, targetOperation));
+	if (applicableRules.length === 0) return false;
+	const ctx = {
+		uid: authContext.user?.uid,
+		roles: authContext.user?.roles ?? [],
+		isAnonymous: authContext.user?.isAnonymous === true,
+		entity
+	};
+	let grantedByPermissive = false;
+	let deniedByRestrictive = false;
+	let hasPermissive = false;
+	for (const rule of applicableRules) {
+		const mode = rule.mode || "permissive";
+		const passed = resolveTriState(evaluateRuleForOperation(rule, ctx, targetOperation, clauses), onUnknown);
+		if (mode === "restrictive") {
+			if (!passed) {
+				deniedByRestrictive = true;
+				break;
+			}
+		} else {
+			hasPermissive = true;
+			if (passed) grantedByPermissive = true;
+		}
+	}
+	if (deniedByRestrictive) return false;
+	return hasPermissive ? grantedByPermissive : false;
+}
+//#endregion
 //#region src/auth/api-keys/http-operation.ts
 /**
 * Map an HTTP method to the operation it performs.
@@ -1155,6 +1614,37 @@ function buildCollectionContext(ctx) {
 	};
 }
 /**
+* The body field with which an administrator waives the password policy for
+* one create — an import of accounts whose passwords another system chose.
+* An instruction to the door, never data: it reaches neither the row nor a
+* create hook.
+*/
+var SKIP_PASSWORD_POLICY_FIELD = "skipPasswordPolicy";
+/**
+* Hold a create body's chosen `password` to the password policy, as
+* registration and every other door that sets a password are, and return the
+* body without {@link SKIP_PASSWORD_POLICY_FIELD}.
+*
+* The flag waives the policy only when the door says the caller may waive it
+* (`options.mayWaivePasswordPolicy`, an administrator); from anyone else it
+* waives nothing, and a refusal says so.
+*
+* @throws ApiError 400 `WEAK_PASSWORD`
+*/
+function enforceCreationPasswordPolicy(body, resolvedHooks, options) {
+	const { [SKIP_PASSWORD_POLICY_FIELD]: skipRequested, ...rest } = body;
+	const waived = skipRequested === true && options?.mayWaivePasswordPolicy === true;
+	const password = rest.password;
+	if (!waived && typeof password === "string" && password !== "") {
+		const validation = resolvedHooks.validatePasswordStrength(password);
+		if (!validation.valid) {
+			const refusedWaiver = skipRequested === true ? `. \`${SKIP_PASSWORD_POLICY_FIELD}\` is honoured only for administrators and the service key` : "";
+			throw ApiError.badRequest(`Password too weak: ${validation.errors.join(". ")}${refusedWaiver}`, "WEAK_PASSWORD");
+		}
+	}
+	return rest;
+}
+/**
 * Prepare user values for an admin-initiated user creation.
 *
 * Resolution order:
@@ -1162,10 +1652,14 @@ function buildCollectionContext(ctx) {
 * 2. Backend-level `AuthHooks.onAdminCreateUser` — global override
 * 3. Built-in default — generate password → hash → normalize email
 *
+* Before any of them, a chosen password is held to the password policy
+* ({@link enforceCreationPasswordPolicy}).
+*
 * The caller is responsible for persisting (via `driver.save()`).
 */
-async function prepareAdminUserValues(body, ctx) {
+async function prepareAdminUserValues(rawBody, ctx, options) {
 	const { resolvedHooks, collectionAuthConfig } = ctx;
+	const body = enforceCreationPasswordPolicy(rawBody, resolvedHooks, options);
 	if (collectionAuthConfig?.onCreateUser) {
 		const collectionCtx = buildCollectionContext(ctx);
 		const hookResult = await collectionAuthConfig.onCreateUser(body, collectionCtx);
@@ -1662,6 +2156,30 @@ function extractBearerToken(authHeader) {
 }
 //#endregion
 //#region src/auth/access.ts
+/**
+* How a personal key finds its owner in an account store: the account as it
+* is now — a missing or disabled one is no owner — and its roles.
+*
+* One read where the store answers both at once: `getAccountAccessState`, the
+* statement every access token is already judged against, which reads roles
+* and `disabled_at` together. Otherwise the account, then its roles — the two
+* reads this always made, one round trip more per request.
+*/
+function keyOwnerResolverFor(repo) {
+	if (typeof repo.getAccountAccessState === "function") {
+		const readAccount = repo.getAccountAccessState.bind(repo);
+		return async (uid) => {
+			const account = await readAccount(uid);
+			if (!account || account.disabled) return null;
+			return { roles: account.roles };
+		};
+	}
+	return async (uid) => {
+		const user = await repo.getUserById(uid);
+		if (!user || user.disabled) return null;
+		return { roles: await repo.getUserRoleIds(uid) };
+	};
+}
 var configured = EMPTY_ACCESS_MODEL;
 var keyOwners;
 /** The access model the running backend serves. Built-ins only until boot configures it. */
@@ -1753,6 +2271,13 @@ function callerScopes(c) {
 	if (!user) return [];
 	return scopesForRoles(rolesOf(user), configured);
 }
+/**
+* Whether this request's caller holds the `admin` role. The service key signs
+* in as one.
+*/
+function callerIsAdmin(c) {
+	return hasAdminRole(rolesOf(c.get("user")));
+}
 /** Does this request's caller hold `scope`, on `target` when one is given? */
 function hasScope(c, scope, target) {
 	return scopeGrants(callerScopes(c), scope, target);
@@ -2249,6 +2774,42 @@ function tryRequestedStorageObject(wildcard) {
 	}
 }
 //#endregion
+//#region src/storage/request-principals.ts
+/**
+* The two principals a storage read can be granted without a user: the reader
+* of a declared-public object, and the bearer of a download token.
+*
+* `checkAuthorized` does not ask the `storageAuthorize` hook about either — the
+* public prefix and the token are the authorization. That skip used to be
+* decided on the principal's `uid` string (`"public"`, `"download-token"`), so
+* any identity carrying that uid skipped the hook: a custom `AuthAdapter` whose
+* `verifyRequest` returns `{ uid: "public" }` for a guest could then upload,
+* delete and list anywhere, with the hook never asked.
+*
+* Each principal is now one object, set only by the middleware that granted
+* it (`publicObjectAuth`, `fileTokenAuth`) and recognised by identity. An
+* adapter builds a new object per request, so it can name the uid but never be
+* the grant.
+*/
+/** The principal `publicObjectAuth` grants an anonymous read of a public object. */
+var PUBLIC_OBJECT_PRINCIPAL = Object.freeze({
+	uid: "public",
+	roles: ["public"]
+});
+/** The principal `fileTokenAuth` grants a read covered by a valid download token. */
+var DOWNLOAD_TOKEN_PRINCIPAL = Object.freeze({
+	uid: "download-token",
+	roles: ["reader"]
+});
+/** Whether `user` is the grant `publicObjectAuth` made — the object, not the uid. */
+function isPublicObjectGrant(user) {
+	return user === PUBLIC_OBJECT_PRINCIPAL;
+}
+/** Whether `user` is the grant `fileTokenAuth` made — the object, not the uid. */
+function isDownloadTokenGrant(user) {
+	return user === DOWNLOAD_TOKEN_PRINCIPAL;
+}
+//#endregion
 //#region src/auth/middleware.ts
 /**
 * Answer a refusal with the canonical envelope, through the same formatter
@@ -2564,10 +3125,7 @@ var queryTokenAuth = async (c, next) => {
 var publicObjectAuth = async (c, next) => {
 	if (c.get("user")) return next();
 	const requested = tryRequestedStorageObject(storageRequestWildcard(c));
-	if (requested && isPublicStorageKey(requested.key)) c.set("user", {
-		uid: "public",
-		roles: ["public"]
-	});
+	if (requested && isPublicStorageKey(requested.key)) c.set("user", PUBLIC_OBJECT_PRINCIPAL);
 	return next();
 };
 /**
@@ -2638,10 +3196,7 @@ var fileTokenAuth = async (c, next) => {
 		if (payload) {
 			const outcome = evaluateGrant(payload);
 			if (outcome === "grant") {
-				c.set("user", {
-					uid: "download-token",
-					roles: ["reader"]
-				});
+				c.set("user", DOWNLOAD_TOKEN_PRINCIPAL);
 				return next();
 			}
 			if (outcome !== "no-path") return denyMismatch(outcome);
@@ -2654,10 +3209,7 @@ var fileTokenAuth = async (c, next) => {
 		if (payload) {
 			const outcome = evaluateGrant(payload);
 			if (outcome === "grant") {
-				c.set("user", {
-					uid: "download-token",
-					roles: ["reader"]
-				});
+				c.set("user", DOWNLOAD_TOKEN_PRINCIPAL);
 				return next();
 			}
 			if (outcome !== "no-path") return denyMismatch(outcome);
@@ -2920,6 +3472,18 @@ function assertSafeHeaders(headers) {
 		if (/[\r\n]/.test(value)) throw new Error(`Invalid value for email header "${name}": header values cannot contain CR or LF. A newline here would end the header and begin another one.`);
 	}
 }
+/** Connections a burst of mail may hold open at once, unless `smtp.maxConnections` says otherwise. */
+var DEFAULT_MAX_CONNECTIONS = 5;
+/**
+* How long the connection pool may sit unused before it is closed.
+*
+* Long enough that a burst — a team invited at once, a `Promise.all` over
+* `email.send` — reuses its connections; short enough that a quiet server
+* holds no socket open to the provider, and that a script which sends one
+* message and finishes is not kept alive by an idle connection for the ten
+* minutes nodemailer would otherwise wait.
+*/
+var POOL_IDLE_CLOSE_MS = 5e3;
 /** `<abc@host>` → `abc@host`. See EmailSendResult.messageId for why. */
 function normalizeMessageId(value) {
 	if (typeof value !== "string") return void 0;
@@ -2944,6 +3508,10 @@ var SMTPEmailService = class {
 	* life of the process.
 	*/
 	transporterReady = null;
+	/** Sends between their start and their end — the pool is never closed under one. */
+	sending = 0;
+	/** Closes the pool once it has been unused for {@link POOL_IDLE_CLOSE_MS}. */
+	idleTimer;
 	constructor(config) {
 		this.config = config;
 	}
@@ -2976,10 +3544,15 @@ var SMTPEmailService = class {
 				}
 			}
 			this.transporter = nodemailer.createTransport({
+				pool: true,
+				maxConnections: this.config.smtp.maxConnections ?? DEFAULT_MAX_CONNECTIONS,
 				name: smtpName,
 				host: this.config.smtp.host,
 				port: this.config.smtp.port,
 				secure: this.config.smtp.secure ?? this.config.smtp.port === 465,
+				connectionTimeout: this.config.smtp.timeoutMs ?? 3e4,
+				greetingTimeout: this.config.smtp.timeoutMs ?? 3e4,
+				socketTimeout: this.config.smtp.timeoutMs ?? 3e4,
 				auth: this.config.smtp.auth ? {
 					user: this.config.smtp.auth.user,
 					pass: this.config.smtp.auth.pass
@@ -2999,6 +3572,16 @@ var SMTPEmailService = class {
 	async send(options) {
 		assertSafeHeaders(options.headers);
 		if (this.config.sendEmail) return await this.config.sendEmail(options) ?? {};
+		this.sending++;
+		clearTimeout(this.idleTimer);
+		try {
+			return await this.sendOverSmtp(options);
+		} finally {
+			this.sending--;
+			this.closeWhenIdle();
+		}
+	}
+	async sendOverSmtp(options) {
 		await this.ensureTransporter();
 		if (!this.transporter) throw new Error("Email service not configured. Provide SMTP config or sendEmail function.");
 		const to = Array.isArray(options.to) ? options.to.join(", ") : options.to;
@@ -3023,6 +3606,35 @@ var SMTPEmailService = class {
 			throw new Error(`Failed to send email: ${message}`);
 		}
 	}
+	/** Arm the idle close once nothing is sending. */
+	closeWhenIdle() {
+		if (this.sending > 0 || !this.transporter) return;
+		clearTimeout(this.idleTimer);
+		this.idleTimer = setTimeout(() => {
+			this.idleTimer = void 0;
+			if (this.sending === 0) this.releaseTransporter();
+		}, POOL_IDLE_CLOSE_MS);
+		this.idleTimer.unref?.();
+	}
+	/**
+	* Close the pool and forget it; the next send builds a fresh one. A closed
+	* nodemailer pool accepts nothing more, so it cannot be kept and reused.
+	*/
+	releaseTransporter() {
+		const transporter = this.transporter;
+		this.transporter = null;
+		this.transporterReady = null;
+		transporter?.close?.();
+	}
+	/**
+	* Close the connection pool now, rather than when it next goes idle — for
+	* a shutdown. A send after this opens a new pool.
+	*/
+	close() {
+		clearTimeout(this.idleTimer);
+		this.idleTimer = void 0;
+		if (this.sending === 0) this.releaseTransporter();
+	}
 	/**
 	* Verify SMTP connection (useful for startup checks)
 	*/
@@ -3171,29 +3783,35 @@ var MemoryRateLimitStore = class {
 	}
 	async hit(key, windowMs, limit) {
 		const now = this.now();
-		const timestamps = (this.store.get(key) ?? []).filter((t) => now - t < windowMs);
-		if (timestamps.length >= limit) {
-			this.store.set(key, timestamps);
-			return {
-				allowed: false,
-				remaining: 0,
-				retryAfterMs: Math.max(0, timestamps[0] + windowMs - now)
+		let window = this.store.get(key);
+		if (!window) {
+			window = {
+				stamps: [],
+				head: 0,
+				ordered: true
 			};
+			this.store.set(key, window);
 		}
-		timestamps.push(now);
-		this.store.set(key, timestamps);
+		expire(window, now, windowMs);
+		const live = window.stamps.length - window.head;
+		if (live >= limit) return {
+			allowed: false,
+			remaining: 0,
+			retryAfterMs: Math.max(0, window.stamps[window.head] + windowMs - now)
+		};
+		if (live > 0 && now < window.stamps[window.stamps.length - 1]) window.ordered = false;
+		window.stamps.push(now);
 		return {
 			allowed: true,
-			remaining: limit - timestamps.length,
+			remaining: limit - (live + 1),
 			retryAfterMs: 0
 		};
 	}
 	sweep(windowMs) {
 		const now = this.now();
-		for (const [key, timestamps] of this.store.entries()) {
-			const live = timestamps.filter((t) => now - t < windowMs);
-			if (live.length === 0) this.store.delete(key);
-			else this.store.set(key, live);
+		for (const [key, window] of this.store.entries()) {
+			expire(window, now, windowMs);
+			if (window.head === window.stamps.length) this.store.delete(key);
 		}
 	}
 	dispose() {
@@ -3202,6 +3820,25 @@ var MemoryRateLimitStore = class {
 		this.store.clear();
 	}
 };
+/** Drop the hits at least `windowMs` old — `now - t < windowMs` stays, as before. */
+function expire(window, now, windowMs) {
+	if (!window.ordered) {
+		window.stamps = window.stamps.slice(window.head).filter((t) => now - t < windowMs);
+		window.head = 0;
+		if (window.stamps.length === 0) window.ordered = true;
+		return;
+	}
+	const { stamps } = window;
+	let head = window.head;
+	while (head < stamps.length && now - stamps[head] >= windowMs) head++;
+	if (head === stamps.length) {
+		window.stamps = [];
+		window.head = 0;
+	} else if (head >= 32 && head * 2 >= stamps.length) {
+		window.stamps = stamps.slice(head);
+		window.head = 0;
+	} else window.head = head;
+}
 //#endregion
 //#region src/auth/rate-limiter.ts
 /**
@@ -3269,12 +3906,15 @@ function namedStore(name, windowMs) {
 */
 function createRateLimiter(options = {}) {
 	const trustedProxyHops = resolveTrustedProxyHops(options.trustedProxyHops);
-	const { windowMs = 900 * 1e3, limit = 100, keyGenerator = (c) => defaultKeyGenerator(c, trustedProxyHops), message = "Too many requests, please try again later.", name, store = name ? namedStore(name, windowMs) : new MemoryRateLimitStore(windowMs), resolveLimit } = options;
+	const { windowMs = 900 * 1e3, limit = 100, keyGenerator = (c) => defaultKeyGenerator(c, trustedProxyHops), message = "Too many requests, please try again later.", name, store = name ? namedStore(name, windowMs) : new MemoryRateLimitStore(windowMs), resolveLimit, cost } = options;
 	return async (c, next) => {
 		const effectiveLimit = resolveLimit ? await resolveLimit(c) : limit;
 		if (effectiveLimit === null) return next();
 		const activeLimit = effectiveLimit ?? limit;
-		const decision = await store.hit(await keyGenerator(c), windowMs, activeLimit);
+		const key = await keyGenerator(c);
+		let decision = await store.hit(key, windowMs, activeLimit);
+		const charge = cost ? Math.max(1, Math.floor(await cost(c))) : 1;
+		for (let hit = 1; hit < charge && decision.allowed; hit++) decision = await store.hit(key, windowMs, activeLimit);
 		c.header("X-RateLimit-Limit", String(activeLimit));
 		c.header("X-RateLimit-Remaining", String(decision.remaining));
 		if (!decision.allowed) {
@@ -3496,7 +4136,7 @@ var DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT = 3e3;
 * set them, and one that already has a proxy doing this should pass
 * `enabled: false` rather than pay for it twice.
 */
-function createDataRateLimiter(config = {}) {
+function createDataRateLimiter(config = {}, options = {}) {
 	const { windowMs = 900 * 1e3, store = new MemoryRateLimitStore(windowMs) } = config;
 	const trustedProxyHops = resolveTrustedProxyHops(config.trustedProxyHops);
 	const bucketFor = dataRateLimitBuckets(config);
@@ -3540,7 +4180,16 @@ function createDataRateLimiter(config = {}) {
 		const token = extractBearerToken(c.req.header("authorization"));
 		return token !== void 0 && safeCompare(token, config.serviceKey);
 	};
-	const bucketOf = async (c) => {
+	const bucketsByRequest = /* @__PURE__ */ new WeakMap();
+	const bucketOf = (c) => {
+		let bucket = bucketsByRequest.get(c);
+		if (!bucket) {
+			bucket = resolveBucket(c);
+			bucketsByRequest.set(c, bucket);
+		}
+		return bucket;
+	};
+	const resolveBucket = async (c) => {
 		if (c.get("user")?.uid === SERVICE_IDENTITY.uid) return null;
 		if (isServiceKey(c)) return null;
 		const apiKey = c.get("apiKey");
@@ -3555,7 +4204,8 @@ function createDataRateLimiter(config = {}) {
 		store,
 		message: "Too many requests, please try again later.",
 		keyGenerator: async (c) => (await bucketOf(c))?.key ?? `ip:${defaultKeyGenerator(c, trustedProxyHops)}`,
-		resolveLimit: async (c) => (await bucketOf(c))?.limit ?? null
+		resolveLimit: async (c) => (await bucketOf(c))?.limit ?? null,
+		cost: options.cost
 	});
 }
 /**
@@ -4455,7 +5105,7 @@ function mountMfaRoutes(opts) {
 	router.delete("/mfa/unenroll", strictAuthLimiter, requireLiveSession, async (c) => {
 		const userCtx = c.get("user");
 		if (!userCtx) throw ApiError.unauthorized("Not authenticated");
-		if (userCtx.aal !== "aal2") throw ApiError.forbidden("MFA verification required to unenroll. Please re-authenticate with your second factor.", "AAL2_REQUIRED");
+		await requireStepUpForFactorChange(userCtx);
 		const unenrollSchema = z.object({ factorId: z.string().min(1, "Factor ID is required") });
 		const { factorId } = parseBody(unenrollSchema, await c.req.json());
 		const factor = await authRepo.getMfaFactorById(factorId);
@@ -4534,6 +5184,31 @@ function isBootstrapWindowOpen(env = process.env) {
 	return env.NODE_ENV !== "production";
 }
 /**
+* Whether the users table is empty — the question behind the bootstrap window.
+*
+* Through `AuthRepository.firstUserIds` when the repository has it: one
+* unordered `LIMIT 1` read. Otherwise through `listUsersPaginated`, which also
+* counts and sorts the whole table, so it is only the fallback.
+*/
+async function isUserTableEmpty(repo) {
+	if (repo.firstUserIds) return (await repo.firstUserIds(1)).length === 0;
+	const { total } = await repo.listUsersPaginated({ limit: 1 });
+	return total === 0;
+}
+/**
+* Whether the account just created is the only one there is. Two ids at most:
+* whether anyone else exists, and, when nobody does, whether it is this one.
+* Same fallback as {@link isUserTableEmpty}.
+*/
+async function isOnlyUser(repo, uid) {
+	if (repo.firstUserIds) {
+		const ids = await repo.firstUserIds(2);
+		return ids.length === 1 && ids[0] === uid;
+	}
+	const { users, total } = await repo.listUsersPaginated({ limit: 2 });
+	return total === 1 && users[0]?.id === uid;
+}
+/**
 * What to tell a caller who hit an empty production database with the window
 * shut. Named here so the register route and the bootstrap route say the same
 * thing.
@@ -4885,7 +5560,7 @@ function mountSessionRoutes(opts) {
 			if (!signedOutUid) {
 				const accessToken = extractBearerToken(c.req.header("authorization"));
 				if (accessToken !== void 0) {
-					const { verifyAccessToken } = await import("./jwt-R6bSPMjk.js").then((n) => n._);
+					const { verifyAccessToken } = await import("./jwt-Bqcu7cGt.js").then((n) => n._);
 					signedOutUid = (await verifyAccessToken(accessToken))?.uid;
 				}
 			}
@@ -5692,18 +6367,6 @@ function createAuthRoutes(config) {
 		return dummyHash;
 	}
 	/**
-	* Is the account just created the only one there is?
-	*
-	* Two rows at most: the total says whether anyone else exists, and the
-	* one row left when nobody does says whether it is this account. It used
-	* to be `listUsers()` — the whole users table, password hashes included,
-	* on every sign-up, to compare its length with one.
-	*/
-	async function isOnlyUser(uid) {
-		const { users, total } = await authRepo.listUsersPaginated({ limit: 2 });
-		return total === 1 && users[0]?.id === uid;
-	}
-	/**
 	* Helper to generate and store session tokens.
 	*
 	* Every route that signs somebody in comes through here — password login,
@@ -5760,8 +6423,7 @@ function createAuthRoutes(config) {
 		if (config.disableSelfRegistration) throw ApiError.forbidden("Registration is disabled", "REGISTRATION_DISABLED");
 		let bootstrapRegistration = false;
 		if (!isRegistrationAllowed()) {
-			const { total } = await authRepo.listUsersPaginated({ limit: 1 });
-			bootstrapRegistration = total === 0;
+			bootstrapRegistration = await isUserTableEmpty(authRepo);
 			if (!bootstrapRegistration) throw ApiError.forbidden("Registration is disabled", "REGISTRATION_DISABLED");
 			if (!isBootstrapWindowOpen()) throw ApiError.forbidden(SETUP_REQUIRED_MESSAGE, "SETUP_REQUIRED");
 		}
@@ -5788,7 +6450,7 @@ function createAuthRoutes(config) {
 		};
 		if (ops.beforeUserCreate) createData = await ops.beforeUserCreate(createData);
 		const user = await authRepo.createUser(createData);
-		const isFirstUser = await isOnlyUser(user.id);
+		const isFirstUser = await isOnlyUser(authRepo, user.id);
 		if (bootstrapRegistration && !isFirstUser) {
 			await authRepo.deleteUser(user.id);
 			throw ApiError.forbidden("Registration is disabled", "REGISTRATION_DISABLED");
@@ -5931,8 +6593,7 @@ function createAuthRoutes(config) {
 					if (config.disableSelfRegistration) throw ApiError.forbidden(noSignupsMessage, "REGISTRATION_DISABLED");
 					let bootstrapRegistration = false;
 					if (!isRegistrationAllowed()) {
-						const { total } = await authRepo.listUsersPaginated({ limit: 1 });
-						bootstrapRegistration = total === 0;
+						bootstrapRegistration = await isUserTableEmpty(authRepo);
 						if (!bootstrapRegistration) throw ApiError.forbidden(noSignupsMessage, "REGISTRATION_DISABLED");
 						if (!isBootstrapWindowOpen()) throw ApiError.forbidden(SETUP_REQUIRED_MESSAGE, "SETUP_REQUIRED");
 					}
@@ -5950,7 +6611,7 @@ function createAuthRoutes(config) {
 					} catch (err) {
 						logger.error("[AuthHooks] afterUserCreate error", { error: err instanceof Error ? err.message : err });
 					}
-					const isFirstUser = await isOnlyUser(user.id);
+					const isFirstUser = await isOnlyUser(authRepo, user.id);
 					if (bootstrapRegistration && !isFirstUser) {
 						await authRepo.deleteUser(user.id);
 						throw ApiError.forbidden(noSignupsMessage, "REGISTRATION_DISABLED");
@@ -6499,7 +7160,7 @@ function createResetPasswordRoute(config) {
 		const chosenPassword = body.password ? body.password : void 0;
 		if (chosenPassword) {
 			const validation = ops.validatePasswordStrength(chosenPassword);
-			if (!validation.valid) throw ApiError.badRequest(`Password too weak: ${validation.errors.join(", ")}`);
+			if (!validation.valid) throw ApiError.badRequest(`Password too weak: ${validation.errors.join(", ")}`, "WEAK_PASSWORD");
 		} else if (collectionAuthConfig?.onResetPassword) {
 			const isEmailConfigured = !!(emailService && emailService.isConfigured());
 			const hookResult = await collectionAuthConfig.onResetPassword(existing.id, {
@@ -6595,12 +7256,101 @@ function createAdminRolesRoute(config) {
 	return router;
 }
 //#endregion
+//#region src/auth/user-picking.ts
+var collectionsForPicking = () => [];
+/** Tell the picker which collections this backend serves. Called once at boot. */
+function configureUserPicking(collections) {
+	collectionsForPicking = collections;
+}
+function propertyReferencesUsers(property) {
+	if (!property) return false;
+	if (property.type === "string" && property.userSelect === true) return true;
+	if (property.type === "map") return propertiesReferenceUsers(property.properties);
+	if (property.type === "array") {
+		const of = property.of;
+		if (Array.isArray(of)) return of.some(propertyReferencesUsers);
+		if (of) return propertyReferencesUsers(of);
+		return propertiesReferenceUsers(property.oneOf?.properties);
+	}
+	return false;
+}
+/** Whether any property, at any depth, is a `userSelect` field. */
+function propertiesReferenceUsers(properties) {
+	return !!properties && Object.values(properties).some(propertyReferencesUsers);
+}
+/** Whether any part of a policy is raw SQL the evaluator cannot decide. */
+function containsRawSql(expr) {
+	if (!expr) return false;
+	switch (expr.kind) {
+		case "raw": return true;
+		case "and":
+		case "or": return expr.operands.some(containsRawSql);
+		case "not": return containsRawSql(expr.operand);
+		case "existsIn": return containsRawSql(expr.where);
+		default: return false;
+	}
+}
+/**
+* The rule with each clause that holds raw SQL read as `false`, so an
+* undecidable rule never grants (permissive) and always refuses
+* (restrictive). The clauses are carried already desugared — roles folded
+* in — so nothing else in the rule is read again.
+*/
+function failClosedOnRawSql(rule) {
+	const { usingExpr, withCheckExpr } = securityRuleToConditions(rule);
+	if (!containsRawSql(usingExpr) && !containsRawSql(withCheckExpr)) return rule;
+	const clause = (expr) => expr === null || containsRawSql(expr) ? policy.false() : expr;
+	return {
+		operation: rule.operation,
+		operations: rule.operations,
+		mode: rule.mode,
+		name: rule.name,
+		condition: clause(usingExpr),
+		check: clause(withCheckExpr)
+	};
+}
+/** The signed-in person behind a request, as the policy evaluator reads one. */
+function personOf(c) {
+	const user = c.get("user");
+	if (typeof user !== "object" || user === null) return null;
+	const uid = typeof user.uid === "string" ? user.uid : void 0;
+	if (!uid || isAnonymousUid(uid)) return null;
+	if ("isAnonymous" in user && user.isAnonymous === true) return null;
+	return {
+		uid,
+		roles: Array.isArray(user.roles) ? user.roles.filter((role) => typeof role === "string") : [],
+		isAnonymous: false,
+		displayName: null,
+		email: null,
+		photoURL: null,
+		providerId: "custom"
+	};
+}
+/**
+* Whether this request's caller may read the user picker: they hold
+* `users:read`, or they may write a collection with a `userSelect` field.
+*/
+function mayPickUsers(c) {
+	if (hasScope(c, "users:read")) return true;
+	const person = personOf(c);
+	if (!person) return false;
+	return collectionsForPicking().some((collection) => {
+		if (!propertiesReferenceUsers(collection.properties) || !hasScope(c, "data:write", collection.slug)) return false;
+		const judged = collection.securityRules ? {
+			...collection,
+			securityRules: collection.securityRules.map(failClosedOnRawSql)
+		} : collection;
+		return checkOperation(judged, { user: person }, null, "insert") || checkOperation(judged, { user: person }, null, "update");
+	});
+}
+//#endregion
 //#region src/auth/admin-users-route.ts
 /**
 * Standalone admin endpoint for user management.
 *
 * Mounts:
 *   GET /users
+*   GET /users/pick
 *   GET /users/:uid
 *   POST /users
 *   PUT /users/:uid
@@ -6732,6 +7482,48 @@ function createAdminUsersRoute(config) {
 			offset: result.offset
 		});
 	});
+	/**
+	* The user picker's read: who a `userSelect` field can name, as id, name,
+	* email and avatar — nothing an administrator's list carries beyond that.
+	* Open to anyone who may write a collection with such a field, as well as
+	* to `users:read` ({@link mayPickUsers}). Registered before `/users/:uid`,
+	* which would otherwise take `pick` for an id.
+	*
+	* `?ids=a,b` resolves the users a stored value names; otherwise a page of
+	* `?search=`, `?limit=` (25 by default) and `?offset=`.
+	*/
+	router.get("/users/pick", async (c) => {
+		if (!mayPickUsers(c)) throw new ApiError(403, "SCOPE_MISSING", "Picking a user needs write access to a collection with a user field, or the \"users:read\" scope.", { requiredScope: "users:read" });
+		const toPickedUser = (u) => ({
+			uid: u.id,
+			email: u.email,
+			displayName: u.displayName ?? null,
+			photoURL: u.photoUrl ?? null
+		});
+		const idsParam = c.req.query("ids");
+		if (idsParam !== void 0) {
+			const ids = [...new Set(idsParam.split(",").map((id) => id.trim()).filter(Boolean))].slice(0, MAX_USER_IDS_PER_LOOKUP);
+			const users = (await Promise.all(ids.map((id) => authRepo.getUserById(id)))).filter((u) => !!u).map(toPickedUser);
+			return c.json({
+				users,
+				limit: ids.length,
+				offset: 0
+			});
+		}
+		const limit = resolveListLimitParam(c.req.query("limit"), { defaultLimit: 25 });
+		const offsetParam = c.req.query("offset");
+		const offset = offsetParam ? Math.max(0, parseInt(offsetParam, 10) || 0) : 0;
+		const result = await authRepo.listUsersPaginated({
+			limit,
+			offset,
+			search: c.req.query("search") || void 0
+		});
+		return c.json({
+			users: result.users.map(toPickedUser),
+			limit: result.limit,
+			offset: result.offset
+		});
+	});
 	router.get("/users/:uid", requireScope("users:read"), async (c) => {
 		const uid = c.req.param("uid");
 		const result = await authRepo.getUserWithRoles(uid);
@@ -6751,7 +7543,7 @@ function createAdminUsersRoute(config) {
 			emailConfig,
 			resolvedHooks: ops,
 			collectionAuthConfig
-		});
+		}, { mayWaivePasswordPolicy: callerIsAdmin(c) });
 		let createData = {
 			email: prepResult.values.email,
 			passwordHash: prepResult.values.passwordHash,
@@ -6803,7 +7595,7 @@ function createAdminUsersRoute(config) {
 		let passwordHash;
 		if (password) {
 			const validation = ops.validatePasswordStrength(password);
-			if (!validation.valid) throw ApiError.badRequest(`Password too weak: ${validation.errors.join(". ")}`);
+			if (!validation.valid) throw ApiError.badRequest(`Password too weak: ${validation.errors.join(". ")}`, "WEAK_PASSWORD");
 			passwordHash = await ops.hashPassword(password);
 		}
 		if (Object.keys(updates).length > 0) await authRepo.updateUser(uid, updates);
@@ -7060,14 +7852,14 @@ function createBuiltinAuthAdapter(config) {
 			router.route("/", adminUsersRoute);
 			return router;
 		},
-		async prepareUserCreation(values, collectionAuth) {
+		async prepareUserCreation(values, collectionAuth, options) {
 			return prepareAdminUserValues(values, {
 				authRepo: authRepository,
 				emailService,
 				emailConfig,
 				resolvedHooks: resolvedOps,
 				collectionAuthConfig: collectionAuth ?? collectionAuthConfig
-			});
+			}, options);
 		},
 		describeUserCreationContract(collectionAuth) {
 			if ((collectionAuth ?? collectionAuthConfig)?.onCreateUser || resolvedOps.onAdminCreateUser) return {
@@ -7076,7 +7868,8 @@ function createBuiltinAuthAdapter(config) {
 			};
 			return {
 				validate: true,
-				extraFields: ["password"]
+				extraFields: ["password", SKIP_PASSWORD_POLICY_FIELD],
+				independent: !authHooks?.hashPassword
 			};
 		},
 		async finalizeUserCreation(entity, clearPassword) {
@@ -7095,7 +7888,7 @@ function createBuiltinAuthAdapter(config) {
 		async getCapabilities() {
 			let needsSetup = false;
 			try {
-				needsSetup = (await authRepository.listUsersPaginated({ limit: 1 })).total === 0 && isBootstrapWindowOpen();
+				needsSetup = isBootstrapWindowOpen() && await isUserTableEmpty(authRepository);
 			} catch (error) {
 				logger.warn("[Auth] Could not count users for `needsSetup`; reporting the backend as already set up.", { error: error instanceof Error ? error.message : String(error) });
 			}
@@ -8500,6 +9293,78 @@ function scopesFromStoredPermissions(permissions, admin) {
 */
 var TABLE = "rebase.api_keys";
 /**
+* Drops `rebase.idx_api_keys_hash` — a plain btree on `key_hash`, next to the
+* UNIQUE (key_hash) constraint's own index — but only while a valid, unique,
+* non-partial btree on the table leads with the same column, so a lookup is
+* never left without one. Under a one-second `lock_timeout`, local to this
+* statement's transaction: `DROP INDEX` takes the table's ACCESS EXCLUSIVE lock.
+* A no-op read once the index is gone.
+*/
+var DROP_DUPLICATE_KEY_HASH_INDEX_SQL = `
+DO $rebase_drop_hash_index$
+BEGIN
+    IF EXISTS (
+        SELECT 1
+        FROM pg_index d
+        JOIN pg_class ic ON ic.oid = d.indexrelid
+        JOIN pg_namespace n ON n.oid = ic.relnamespace
+        WHERE n.nspname = 'rebase' AND ic.relname = 'idx_api_keys_hash' AND d.indnatts = 1
+          AND EXISTS (
+              SELECT 1 FROM pg_index o
+              JOIN pg_class oc ON oc.oid = o.indexrelid
+              JOIN pg_am am ON am.oid = oc.relam
+              WHERE o.indrelid = d.indrelid AND o.indexrelid <> d.indexrelid
+                AND o.indisvalid AND o.indisunique AND o.indpred IS NULL AND o.indexprs IS NULL
+                AND am.amname = 'btree' AND o.indkey[0] = d.indkey[0])
+    ) THEN
+        PERFORM set_config('lock_timeout', '1000ms', true);
+        DROP INDEX IF EXISTS rebase.idx_api_keys_hash;
+    END IF;
+END
+$rebase_drop_hash_index$`.trim();
+/** The relations `ensureTable` creates in `rebase`: the table and its two indexes. */
+var BOOT_RELATIONS = [
+	"api_keys",
+	"idx_api_keys_prefix",
+	"idx_api_keys_owner"
+];
+/** The columns `ensureTable` adds to a table created before scopes. */
+var BOOT_COLUMNS = [
+	"kind",
+	"scopes",
+	"roles",
+	"owner_uid"
+];
+/**
+* One catalogue read answering whether `ensureTable` has anything to do. It
+* returns one row: whether the table, its indexes and the scope columns are
+* there, whether the duplicate hash index and the pre-scopes `permissions`
+* column are gone, and whether the end-user role still holds a privilege (the
+* same test `revokeInternalTableSql` makes before it revokes). `readable` is
+* the connection's own access, the question `isReadable` asks.
+*/
+var BOOT_STATE_SQL = (() => {
+	const list = (names) => names.map((name) => `'${name}'`).join(", ");
+	const target = `(SELECT oid FROM pg_roles WHERE rolname = '${REBASE_USER_ROLE}')`;
+	const columnCount = (names) => `(SELECT count(*) FROM pg_attribute a WHERE a.attrelid = to_regclass('${TABLE}') AND a.attnum > 0 AND NOT a.attisdropped AND a.attname IN (${list(names)}))::int`;
+	return `
+SELECT
+    (SELECT count(*) FROM pg_class c WHERE c.relnamespace = to_regnamespace('rebase')
+       AND c.relname IN (${list(BOOT_RELATIONS)}))::int AS present,
+    (SELECT count(*) FROM pg_class c WHERE c.relnamespace = to_regnamespace('rebase')
+       AND c.relname = 'idx_api_keys_hash')::int AS stale,
+    ${columnCount(BOOT_COLUMNS)} AS columns,
+    ${columnCount(["permissions"])} AS legacy,
+    (SELECT count(*) FROM pg_class c
+     WHERE c.oid = to_regclass('${TABLE}') AND NOT c.relrowsecurity AND ${target} IS NOT NULL
+       AND (c.relacl IS NULL
+            OR EXISTS (SELECT 1 FROM aclexplode(c.relacl) a WHERE a.grantee = ${target})
+            OR EXISTS (SELECT 1 FROM pg_attribute att, aclexplode(att.attacl) a
+                       WHERE att.attrelid = c.oid AND att.attacl IS NOT NULL AND a.grantee = ${target})))::int AS granted,
+    (has_schema_privilege('rebase', 'USAGE') AND has_table_privilege(to_regclass('${TABLE}'), 'SELECT')) AS readable
+WHERE to_regnamespace('rebase') IS NOT NULL`.trim();
+})();
+/**
 * Generate a plaintext API key with the `rk_live_` prefix.
 *
 * Format: `rk_live_` + 32 random hex characters.
@@ -8609,8 +9474,29 @@ function createApiKeyStore(driver) {
 		}
 		if (rows.length > 0) logger.info(`[api-key-store] Gave ${rows.length} stored API key(s) their scopes.`);
 	}
+	/**
+	* Whether a boot has nothing to do, from {@link BOOT_STATE_SQL}. Every
+	* statement below is a no-op on such a database, but not a free one: each
+	* `ADD COLUMN IF NOT EXISTS` queues for the table's ACCESS EXCLUSIVE lock
+	* before it finds the column there, each `CREATE INDEX IF NOT EXISTS` takes
+	* a SHARE lock, and the `REVOKE` rewrites the table's catalogue row. Anything
+	* missing, granted or legacy — or a read that fails, as it does on a driver
+	* that is not Postgres — runs the full bootstrap, exactly as before.
+	*/
+	async function bootIsCurrent() {
+		try {
+			const row = (await exec(BOOT_STATE_SQL))[0];
+			return row !== void 0 && Number(row.present) === BOOT_RELATIONS.length && Number(row.stale) === 0 && Number(row.columns) === BOOT_COLUMNS.length && Number(row.legacy) === 0 && Number(row.granted) === 0 && row.readable === true;
+		} catch {
+			return false;
+		}
+	}
 	return {
 		async ensureTable() {
+			if (await bootIsCurrent()) {
+				logger.debug("✅ API keys table ready");
+				return;
+			}
 			await ddl.ensureObject("Creating schema rebase", "CREATE SCHEMA IF NOT EXISTS rebase");
 			await ddl.ensureObject(`Creating ${TABLE}`, `
                 CREATE TABLE IF NOT EXISTS ${TABLE} (
@@ -8631,10 +9517,11 @@ function createApiKeyStore(driver) {
                     revoked_at TIMESTAMPTZ
                 )
             `);
-			await ddl.ensureObject("Creating idx_api_keys_hash", `
-                CREATE INDEX IF NOT EXISTS idx_api_keys_hash
-                ON ${TABLE}(key_hash)
-            `);
+			try {
+				await exec(DROP_DUPLICATE_KEY_HASH_INDEX_SQL);
+			} catch (err) {
+				logger.warn(`[api-key-store] Left the duplicate idx_api_keys_hash in place for now: ${err instanceof Error ? err.message : String(err)}`);
+			}
 			await ddl.ensureObject("Creating idx_api_keys_prefix", `
                 CREATE INDEX IF NOT EXISTS idx_api_keys_prefix
                 ON ${TABLE}(key_prefix)
@@ -9180,6 +10067,6 @@ var auth_exports = /* @__PURE__ */ __exportAll({
 	verifyPassword: () => verifyPassword
 });
 //#endregion
-export { queryTokenAuth as $, createDataRateLimiter as A, getEmailChangeNoticeTemplate as At, SMTPEmailService as B, escapeHtml as Bt, pkceTokenParams as C, scopeDataDriver as Ct, isBootstrapWindowOpen as D, generateSecurePassword as Dt, createBuiltinAuthAdapter as E, completeUserCreation as Et, activeDevEmailSink as F, getPasswordResetTemplate as Ft, verifyPassword as G, isPublicStorageKey as Gt, resolveAuthHooks as H, raw as Ht, clearActiveDevEmailSink as I, getUserInvitationTemplate as It, createRequireAuth as J, IMPERSONATE_HEADER as Jt, createAdapterAuthMiddleware as K, isPublicStoragePath as Kt, createDevEmailSink as L, getWelcomeEmailTemplate as Lt, defaultAuthLimiter as M, getEmailOtpTemplate as Mt, setSharedRateLimitStore as N, getEmailVerificationTemplate as Nt, DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT as O, assertEmailLinkBases as Ot, MemoryRateLimitStore as P, getMagicLinkTemplate as Pt, publicObjectAuth as Q, extractLinks as R, resolveEmailBranding as Rt, oauthCodeFlowSchema as S, SERVICE_IDENTITY as St, createJwksRoutes as T, isAccessTokenRevoked as Tt, hashPassword as U, httpMethodToOperation as Ut, createEmailService as V, html as Vt, validatePasswordStrength as W, PUBLIC_STORAGE_PREFIX as Wt, fileTokenAuth as X, extractUserFromToken as Y, optionalAuth as Z, tryVerifyOidcIdToken as _, hasScope as _t, createApiKeyStore as a, decideImpersonation as at, createLinkedinProvider as b, extractBearerToken as bt, createSpotifyProvider as c, createFunctionScopeGuard as ct, createGitLabProvider as d, resolveApiKey as dt, requireAdmin as et, createDiscordProvider as f, validateApiKey as ft, createMicrosoftProvider as g, getAccessModel as gt, createAppleProvider as h, configureAccess as ht, createPersonalKeyRoutes as i, storageRequestWildcard as it, createRateLimiter as j, getEmailChangeTemplate as jt, createDataRateLimitCheck as k, resolveEmailLinkBase as kt, createSlackProvider as l, createTusScopeGuard as lt, createFacebookProvider as m, callerScopes as mt, createCustomAuthAdapter as n, requestedStorageObject as nt, resolveRateLimitStoreKind as o, refuseUnhonouredImpersonation as ot, createTwitterProvider as p, accessModelFromCollections as pt, createAuthMiddleware as q, storageObjectPath as qt, createApiKeyRoutes as r, storageObjectOfPath as rt, createSqlRateLimitStore as s, createApiKeyPreAuth as st, auth_exports as t, requireAuth as tt, createBitbucketProvider as u, isApiKeyToken as ut, verifyOidcIdToken as v, requireScope as vt, providerVerifiedEmail as w, supportsRlsScoping as wt, createGoogleProvider as x, safeCompare as xt, createGitHubProvider as y, requireScopeByMethod as yt, registerDevEmailSink as z, RawHtml as zt };
+export { publicObjectAuth as $, storageObjectPath as $t, createDataRateLimitCheck as A, isAccessTokenRevoked as At, registerDevEmailSink as B, getPasswordResetTemplate as Bt, pkceTokenParams as C, requireScope as Ct, configureUserPicking as D, SERVICE_IDENTITY as Dt, createBuiltinAuthAdapter as E, safeCompare as Et, MemoryRateLimitStore as F, getEmailChangeNoticeTemplate as Ft, validatePasswordStrength as G, escapeHtml as Gt, createEmailService as H, getWelcomeEmailTemplate as Ht, activeDevEmailSink as I, getEmailChangeTemplate as It, createAuthMiddleware as J, httpMethodToOperation as Jt, verifyPassword as K, html as Kt, clearActiveDevEmailSink as L, getEmailOtpTemplate as Lt, createRateLimiter as M, generateSecurePassword as Mt, defaultAuthLimiter as N, assertEmailLinkBases as Nt, isBootstrapWindowOpen as O, scopeDataDriver as Ot, setSharedRateLimitStore as P, resolveEmailLinkBase as Pt, optionalAuth as Q, isPublicStoragePath as Qt, createDevEmailSink as R, getEmailVerificationTemplate as Rt, oauthCodeFlowSchema as S, keyOwnerResolverFor as St, createJwksRoutes as T, extractBearerToken as Tt, resolveAuthHooks as U, resolveEmailBranding as Ut, SMTPEmailService as V, getUserInvitationTemplate as Vt, hashPassword as W, RawHtml as Wt, extractUserFromToken as X, PUBLIC_STORAGE_PREFIX as Xt, createRequireAuth as Y, securityRuleToConditions as Yt, fileTokenAuth as Z, isPublicStorageKey as Zt, tryVerifyOidcIdToken as _, accessModelFromCollections as _t, createApiKeyStore as a, isPublicObjectGrant as at, createLinkedinProvider as b, getAccessModel as bt, createSpotifyProvider as c, storageRequestWildcard as ct, createGitLabProvider as d, createApiKeyPreAuth as dt, queryTokenAuth as et, createDiscordProvider as f, createFunctionScopeGuard as ft, createMicrosoftProvider as g, validateApiKey as gt, createAppleProvider as h, resolveApiKey as ht, createPersonalKeyRoutes as i, isDownloadTokenGrant as it, createDataRateLimiter as j, completeUserCreation as jt, DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT as k, supportsRlsScoping as kt, createSlackProvider as l, decideImpersonation as lt, createFacebookProvider as m, isApiKeyToken as mt, createCustomAuthAdapter as n, requireAuth as nt, resolveRateLimitStoreKind as o, requestedStorageObject as ot, createTwitterProvider as p, createTusScopeGuard as pt, createAdapterAuthMiddleware as q, raw as qt, createApiKeyRoutes as r, PUBLIC_OBJECT_PRINCIPAL as rt, createSqlRateLimitStore as s, storageObjectOfPath as st, auth_exports as t, requireAdmin as tt, createBitbucketProvider as u, refuseUnhonouredImpersonation as ut, verifyOidcIdToken as v, callerScopes as vt, providerVerifiedEmail as w, requireScopeByMethod as wt, createGoogleProvider as x, hasScope as xt, createGitHubProvider as y, configureAccess as yt, extractLinks as z, getMagicLinkTemplate as zt };
 
-//# sourceMappingURL=auth-DMLngxn_.js.map
+//# sourceMappingURL=auth-OPq_FeMs.js.map