@rebasepro/server 0.25.0 → 0.25.1

package/dist/index.es.js

@@ -7,38 +7,38 @@ import { a as MAX_LIST_LIMIT, c as RebaseClientError, l as isUnsupported, n as s
 import { C as isFieldOperation, T as EntityRelation, _ as normalizeOrderBy, b as BATCH_REF_KEY, c as collectAllPages, g as OrderBySpecError, l as paginateFind, m as normalizeInclude, p as mergeIncludeSpecs, r as deserializeFilter, t as RESERVED_QUERY_KEYS, u as resolveFindWindow, v as serializeOrderBy, x as FIELD_OPERATORS, y as withRelationReferencesOnly } from "./filter-dialect-O1HK6Nvr.js";
 import { A as DEFAULT_RESOURCE_KEY, C as declaredSubscriptions, D as setTopicRuntime, E as setQueueRuntime, F as resourceKind, G as DEFAULT_DATA_SOURCE_KEY, H as getDeclaredSubcollections, I as resourceKinds, K as getDataSourceCapabilities, L as RLS_JWT_SQL, M as resolveResourceRefs, N as resourceEnvSuffix, O as DEFAULT_STORAGE_SOURCE_KEY, P as resourceKeyOf, R as RLS_ROLES_SQL, S as declaredQueueConsumers, T as resourceToStorageSource, U as isPostgresCollectionConfig, V as getCollectionDataPath, _ as scopesForRoles, c as intersectScopes, et as sortKeyToString, h as scopeGrantsAny, j as buildResourceGraph, k as storageEnvSuffix, m as scopeGrants, p as parseScope, q as ALL_WHERE_FILTER_OPS, s as hasAdminRole, w as resourceToDataSource, y as summarizeScopes, z as RLS_UID_SQL } from "./src-D5Y3N-S4.js";
 import { a as nestCollectionPatchPaths, c as ADMIN_PROPERTY_KEYS, i as isCollectionPatch, n as collectionPatchProblems, r as diffCollections, s as ADMIN_COLLECTION_KEYS, t as applyCollectionPatch } from "./collection_patch-BRu-BvDv.js";
-import { a as softDeleteFieldOf, c as JUNCTION_PIVOT_KEY, i as restoresSoftDeletedRow, l as hasForeignKeyOnTarget, n as buildCollectionSchema, o as buildTenantSecurityRule, s as INCLUDE_COUNT_KEY, t as buildCollectionInputSchema, u as isManyToMany } from "./openapi-generator-BamY6-ga.js";
+import { a as softDeleteFieldOf, c as JUNCTION_PIVOT_KEY, i as restoresSoftDeletedRow, l as hasForeignKeyOnTarget, n as buildCollectionSchema, o as buildTenantSecurityRule, s as INCLUDE_COUNT_KEY, t as buildCollectionInputSchema, u as isManyToMany } from "./openapi-generator-BjHr6upl.js";
 import { n as isAnonymousUid, r as policy } from "./policy-PdzX-Opd.js";
 import { n as isSchemaEditingAdmin, t as isSQLAdmin } from "./backend-DTAOsLQc.js";
-import { a as parseEnvBoolean, i as validateCronExpression, t as CronScheduler } from "./cron-scheduler-D1DT0nw5.js";
+import { a as parseEnvBoolean, i as validateCronExpression, t as CronScheduler } from "./cron-scheduler-B04ACoUE.js";
 import { n as isValidAppHost, r as reservedPrefixFor, t as SCHEMA_VERSION_HEADER } from "./project_manifest-R6y_KHms.js";
-import { n as createContractRoutes, r as computeSchemaVersion } from "./contract-routes-DiFwiLg2.js";
-import { $ as optionalAuth, $t as raw, A as createAuthLimiters, At as setDefaultAccessControl, B as registerDevEmailSink, Bt as resolveEmailLinkBase, C as createPersonalKeyRoutes, Ct as configureAccess, D as configureUserPicking, Dt as processAccessControl, E as createBuiltinAuthAdapter, Et as keyOwnerResolverFor, F as MemoryRateLimitStore, Ft as supportsRlsScoping, G as validatePasswordStrength, Gt as getMagicLinkTemplate, H as createEmailService, Ht as getEmailChangeTemplate, I as activeDevEmailSink, It as isAccessTokenRevoked, J as createAdapterAuthMiddleware, Jt as getWelcomeEmailTemplate, K as verifyPassword, Kt as getPasswordResetTemplate, L as clearActiveDevEmailSink, Lt as completeUserCreation, M as createDataRateLimiter, Mt as safeCompare, N as createRateLimiter, Nt as SERVICE_IDENTITY, O as isBootstrapWindowOpen, Ot as requireScope, P as setSharedRateLimitStore, Pt as scopeDataDriver, Q as fileTokenAuth, Qt as html, R as createDevEmailSink, Rt as generateSecurePassword, S as createApiKeyRoutes, St as callerScopes, T as createJwksRoutes, Tt as hasScope, U as resolveAuthHooks, Ut as getEmailOtpTemplate, V as SMTPEmailService, Vt as getEmailChangeNoticeTemplate, W as hashPassword, Wt as getEmailVerificationTemplate, X as createRequireAuth, Xt as RawHtml, Y as createAuthMiddleware, Yt as resolveEmailBranding, Z as extractUserFromToken, Zt as escapeHtml, _ as oauthCodeFlowSchema, _t as isApiKeyToken, a as createBitbucketProvider, an as storageObjectPath, at as userFromToken, b as resolveRateLimitStoreKind, bt as accessModelFromCollections, c as createTwitterProvider, ct as isPublicObjectGrant, d as createMicrosoftProvider, dt as storageRequestWildcard, en as httpMethodToOperation, et as publicObjectAuth, f as tryVerifyOidcIdToken, ft as decideImpersonation, g as createGoogleProvider, gt as createTusScopeGuard, h as createLinkedinProvider, ht as createFunctionScopeGuard, i as createSlackProvider, in as isPublicStoragePath, it as requireAuth, j as createDataRateLimitCheck, jt as extractBearerToken, k as DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT, kt as requireScopeByMethod, l as createFacebookProvider, lt as requestedStorageObject, m as createGitHubProvider, mt as createApiKeyPreAuth, n as createCustomAuthAdapter, nn as PUBLIC_STORAGE_PREFIX, nt as refuse$1, o as createGitLabProvider, ot as PUBLIC_OBJECT_PRINCIPAL, p as verifyOidcIdToken, pt as refuseUnhonouredImpersonation, q as adapterRefusal, qt as getUserInvitationTemplate, r as createSpotifyProvider, rn as isPublicStorageKey, rt as requireAdmin, s as createDiscordProvider, st as isDownloadTokenGrant, tn as securityRuleToConditions, tt as queryTokenAuth, u as createAppleProvider, ut as storageObjectOfPath, v as pkceTokenParams, vt as resolveApiKey, w as createApiKeyStore, wt as getAccessModel, x as createSqlRateLimitStore, xt as accessOf, y as providerVerifiedEmail, yt as validateApiKey, z as extractLinks, zt as assertEmailLinkBases } from "./auth-CteGWxsL.js";
-import { a as redactSensitiveText, i as rawQueryLoggingEnabled, l as hostEnv, n as describeCauseChain, o as setLogLevel, r as logger, s as setLogOutput } from "./logger-Bt32sHFw.js";
-import { a as apiHiddenFieldNames, c as fieldKeyForColumn, d as isJunctionBackedRelation, g as toWireKey, h as resolveRelation, l as findRelation, m as resolveCollectionRelations, n as HARD_DELETE_QUERY_PARAM, p as relationDeclaringProperty, r as parseHardDelete, s as restrictedFieldNames, u as getTableName } from "./soft-delete-params-BAgpmBvp.js";
+import { n as createContractRoutes, r as computeSchemaVersion } from "./contract-routes-CsFXW7j4.js";
+import { $ as optionalAuth, $t as raw, A as createAuthLimiters, At as setDefaultAccessControl, B as registerDevEmailSink, Bt as resolveEmailLinkBase, C as createPersonalKeyRoutes, Ct as configureAccess, D as configureUserPicking, Dt as processAccessControl, E as createBuiltinAuthAdapter, Et as keyOwnerResolverFor, F as MemoryRateLimitStore, Ft as supportsRlsScoping, G as validatePasswordStrength, Gt as getMagicLinkTemplate, H as createEmailService, Ht as getEmailChangeTemplate, I as activeDevEmailSink, It as isAccessTokenRevoked, J as createAdapterAuthMiddleware, Jt as getWelcomeEmailTemplate, K as verifyPassword, Kt as getPasswordResetTemplate, L as clearActiveDevEmailSink, Lt as completeUserCreation, M as createDataRateLimiter, Mt as safeCompare, N as createRateLimiter, Nt as SERVICE_IDENTITY, O as isBootstrapWindowOpen, Ot as requireScope, P as setSharedRateLimitStore, Pt as scopeDataDriver, Q as fileTokenAuth, Qt as html, R as createDevEmailSink, Rt as generateSecurePassword, S as createApiKeyRoutes, St as callerScopes, T as createJwksRoutes, Tt as hasScope, U as resolveAuthHooks, Ut as getEmailOtpTemplate, V as SMTPEmailService, Vt as getEmailChangeNoticeTemplate, W as hashPassword, Wt as getEmailVerificationTemplate, X as createRequireAuth, Xt as RawHtml, Y as createAuthMiddleware, Yt as resolveEmailBranding, Z as extractUserFromToken, Zt as escapeHtml, _ as oauthCodeFlowSchema, _t as isApiKeyToken, a as createBitbucketProvider, an as storageObjectPath, at as userFromToken, b as resolveRateLimitStoreKind, bt as accessModelFromCollections, c as createTwitterProvider, ct as isPublicObjectGrant, d as createMicrosoftProvider, dt as storageRequestWildcard, en as httpMethodToOperation, et as publicObjectAuth, f as tryVerifyOidcIdToken, ft as decideImpersonation, g as createGoogleProvider, gt as createTusScopeGuard, h as createLinkedinProvider, ht as createFunctionScopeGuard, i as createSlackProvider, in as isPublicStoragePath, it as requireAuth, j as createDataRateLimitCheck, jt as extractBearerToken, k as DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT, kt as requireScopeByMethod, l as createFacebookProvider, lt as requestedStorageObject, m as createGitHubProvider, mt as createApiKeyPreAuth, n as createCustomAuthAdapter, nn as PUBLIC_STORAGE_PREFIX, nt as refuse$1, o as createGitLabProvider, ot as PUBLIC_OBJECT_PRINCIPAL, p as verifyOidcIdToken, pt as refuseUnhonouredImpersonation, q as adapterRefusal, qt as getUserInvitationTemplate, r as createSpotifyProvider, rn as isPublicStorageKey, rt as requireAdmin, s as createDiscordProvider, st as isDownloadTokenGrant, tn as securityRuleToConditions, tt as queryTokenAuth, u as createAppleProvider, ut as storageObjectOfPath, v as pkceTokenParams, vt as resolveApiKey, w as createApiKeyStore, wt as getAccessModel, x as createSqlRateLimitStore, xt as accessOf, y as providerVerifiedEmail, yt as validateApiKey, z as extractLinks, zt as assertEmailLinkBases } from "./auth-Dkvo2tTJ.js";
+import { a as logger, c as setLogLevel, d as hostEnv, i as logLevelEnabled, l as setLogOutput, o as rawQueryLoggingEnabled, r as describeCauseChain, s as redactSensitiveText, t as _setLogLineHook } from "./logger-CW8pmTS6.js";
+import { a as apiHiddenFieldNames, c as fieldKeyForColumn, d as isJunctionBackedRelation, g as toWireKey, h as resolveRelation, l as findRelation, m as resolveCollectionRelations, n as HARD_DELETE_QUERY_PARAM, p as relationDeclaringProperty, r as parseHardDelete, s as restrictedFieldNames, u as getTableName } from "./soft-delete-params-BmlVwecC.js";
 import { c as createTransport, d as parseRebaseJson, h as unref, l as defaultCodeForStatus, m as withETag, o as createCollectionClient, p as etagOf, r as SDKQueryBuilder, u as invalidBulkBody } from "./offline-store-BhYXViha-BW5j1We_.js";
 import "./resumable-upload-threshold-CKv-Ry0l.js";
 import { n as revokeInternalTableSql } from "./internal-tables-L2t39RdT.js";
 import { i as warnDeprecated } from "./load-failure-L5hvfDoG.js";
-import { a as resolveListLimitParam, c as assertReadableFields, d as decodeCursor$1, f as reconcileCursorOrder, i as parseQueryOptions, l as requestViewer, n as parseAggregateSelect, o as assertNoHiddenAggregateNames, r as parseGroupBy, s as assertQueryFieldsReadable, t as orderByEntriesToTuples, u as cursorToStartAfter } from "./query-parser-CGohjyWI.js";
-import { a as isDataException, i as errorHandler, n as DATABASE_UNAVAILABLE_MESSAGE, o as isDatabaseUnreachable, r as declaredErrorAnswer, s as schemaDriftRemedy, t as ApiError } from "./errors-_ytoGi8A.js";
-import { C as randomHex, E as sha256Hex, S as constantTimeEqual, T as sha256Bytes, b as normalizePemFromEnv, d as hasAsymmetricSigningKey, g as setDefaultJwtService, h as processJwtService, l as getJwks, m as jwtOf, n as configureJwt, r as createJwtService, y as verifyJwt } from "./jwt-YhciR93H.js";
+import { a as resolveListLimitParam, c as assertReadableFields, d as decodeCursor$1, f as reconcileCursorOrder, i as parseQueryOptions, l as requestViewer, n as parseAggregateSelect, o as assertNoHiddenAggregateNames, r as parseGroupBy, s as assertQueryFieldsReadable, t as orderByEntriesToTuples, u as cursorToStartAfter } from "./query-parser-otFZqJsC.js";
+import { a as isDataException, i as errorHandler, n as DATABASE_UNAVAILABLE_MESSAGE, o as isDatabaseUnreachable, r as declaredErrorAnswer, s as schemaDriftRemedy, t as ApiError } from "./errors-OMWkKSH-.js";
+import { C as randomHex, E as sha256Hex, S as constantTimeEqual, T as sha256Bytes, b as normalizePemFromEnv, d as hasAsymmetricSigningKey, g as setDefaultJwtService, h as processJwtService, l as getJwks, m as jwtOf, n as configureJwt, r as createJwtService, y as verifyJwt } from "./jwt-D3oFauZI.js";
 import { a as canonicalStorageId, i as canonicalStorageBucket, n as InvalidStorageBucketError, o as canonicalStorageKey, r as InvalidStorageKeyError, t as InvalidListOptionsError } from "./keys-COzQ2aE8.js";
-import { t as logMiddleware } from "./logs-routes-CelTiS7C.js";
-import { a as readStreamFully, c as DOCUMENT_MIME_TYPES, i as fileWebStream, l as IMAGE_MIME_TYPES, r as bytesView, s as DEFAULT_MAX_FILE_SIZE, t as validateUploadedFile } from "./upload-validation-I9cCUBIW.js";
-import { t as S3StorageController } from "./S3StorageController-qevJ0pVE.js";
-import { t as GCSStorageController } from "./GCSStorageController-C7ARrDAp.js";
-import { a as isDuplicateObjectRace, i as isConcurrentDdlRace, n as createDdlBootstrapper, t as CONCURRENT_DDL_SQLSTATES } from "./ddl-bootstrap-BNqi2NZe.js";
-import { t as createCronStore } from "./cron-store-DEpVstUU.js";
-import { i as loadFunctionsWithDiagnostics, n as loadFunctions, r as loadFunctionsFromDirectory } from "./function-loader-DbCSoNJj.js";
-import { a as getDriver, c as getUser, d as identityResolved, f as isAdmin, i as getApiKey, l as getUserId, m as requireDriver, o as getRequestId, p as isAuthenticated, r as requireRole, s as getRoles, t as createFunctionRoutes, u as hasRole } from "./function-routes-DNV4RUF0.js";
-import "./proxy-BEKbsil6.js";
-import "./request-timeout-CRny5KD0.js";
+import { t as logMiddleware } from "./logs-routes-CBt7mMIL.js";
+import { a as readStreamFully, c as DOCUMENT_MIME_TYPES, i as fileWebStream, l as IMAGE_MIME_TYPES, r as bytesView, s as DEFAULT_MAX_FILE_SIZE, t as validateUploadedFile } from "./upload-validation-Bgo626uY.js";
+import { t as S3StorageController } from "./S3StorageController-D00EFa5P.js";
+import { t as GCSStorageController } from "./GCSStorageController-CRd9bFrc.js";
+import { a as isDuplicateObjectRace, i as isConcurrentDdlRace, n as createDdlBootstrapper, t as CONCURRENT_DDL_SQLSTATES } from "./ddl-bootstrap-Ck20GSIX.js";
+import { t as createCronStore } from "./cron-store-DkyfuLOH.js";
+import { i as loadFunctionsWithDiagnostics, n as loadFunctions, r as loadFunctionsFromDirectory } from "./function-loader-KKDqTcIr.js";
+import { a as getDriver, c as getUser, d as identityResolved, f as isAdmin, i as getApiKey, l as getUserId, m as requireDriver, o as getRequestId, p as isAuthenticated, r as requireRole, s as getRoles, t as createFunctionRoutes, u as hasRole } from "./function-routes-RxrCHNuM.js";
+import "./proxy-CH8Jsovg.js";
+import "./request-timeout-59crS-9u.js";
 import { t as FunctionSelectionError } from "./selection-CRpqKUbt.js";
-import { a as loadCrons, i as loadCronJobsWithDiagnostics, n as declareCrons, r as loadCronJobsFromDirectory } from "./cron-loader-NHqRfKF0.js";
-import { t as createCronRoutes } from "./cron-routes-Dhf82HzT.js";
-import { a as listBackupObjects, c as readBackupBytes, i as backupStorageFromEnv, n as createBackupLinkRoutes, o as parseBackupDestination, r as createBackupRoutes, s as parseBackupTimestamp } from "./backup-Dq0lyJ_D.js";
-import { a as defaultBackoff, i as createJobQueue, n as createJobStore, o as currentAmbientTransaction, r as PermanentJobError } from "./jobs-8G-_agld.js";
+import { a as loadCrons, i as loadCronJobsWithDiagnostics, n as declareCrons, r as loadCronJobsFromDirectory } from "./cron-loader-Dj6lA4HQ.js";
+import { t as createCronRoutes } from "./cron-routes-CwbLZguO.js";
+import { a as listBackupObjects, c as readBackupBytes, i as backupStorageFromEnv, n as createBackupLinkRoutes, o as parseBackupDestination, r as createBackupRoutes, s as parseBackupTimestamp } from "./backup-B9m3cb3X.js";
+import { a as defaultBackoff, i as createJobQueue, n as createJobStore, o as currentAmbientTransaction, r as PermanentJobError } from "./jobs-h1WRq3cp.js";
 import { t as METRIC_SERIES } from "./history-store-DPofGVDp.js";
 import { createHash, createSign, randomBytes } from "node:crypto";
 import * as path$2 from "node:path";
@@ -57,17 +57,17 @@ import { createHmac, randomUUID as randomUUID$1 } from "crypto";
 import { createMiddleware } from "hono/factory";
 import { z, z as z$1 } from "zod";
 import { routePath } from "hono/route";
+import { AsyncLocalStorage } from "node:async_hooks";
+import fs$1, { createWriteStream } from "node:fs";
 import { csrf } from "hono/csrf";
 import { COMPRESSIBLE_CONTENT_TYPE_REGEX, compress } from "hono/compress";
 import { pipeline } from "stream/promises";
-import fs$1, { createWriteStream } from "node:fs";
 import * as fs$2 from "node:fs/promises";
 import fsp from "node:fs/promises";
 import os from "node:os";
 import { mkdir, open, readFile, readdir, stat, unlink, writeFile } from "fs/promises";
 import { execFile } from "node:child_process";
 import { promisify as promisify$1 } from "node:util";
-import { AsyncLocalStorage } from "node:async_hooks";
 import { env, getRuntimeKey } from "hono/adapter";
 import { sql } from "drizzle-orm";
 import net from "net";
@@ -6617,6 +6617,37 @@ function realtimeLostError() {
 function realtimeDebugOn() {
 	return Reflect.get(globalThis, "__REBASE_DEBUG_REALTIME__") === true;
 }
+/**
+* Connection chatter: the socket opened, signed in, closed, is redialling.
+*
+* `console.debug` where that is a debug level — a browser's console hides it
+* unless Verbose is asked for. Not in Node, where `console.debug` is
+* `console.log`: a script's `listen()` opened its stdout with "Connected to
+* PostgreSQL backend" and "WebSocket auto-authenticated", ahead of what the
+* script prints. There it is written only while realtime debugging is on.
+*/
+function connectionDebug(...args) {
+	if (!(typeof window !== "undefined" || typeof document !== "undefined") && !realtimeDebugOn()) return;
+	console.debug(...args);
+}
+/**
+* The codes an `AUTHENTICATE` is refused with when the server will not honour
+* the session: the token does not verify or has expired, the session was
+* revoked or its account is gone (`SESSION_REVOKED`), the account is disabled
+* (`ACCOUNT_DISABLED`) — the codes the HTTP routes answer the same token with.
+* An answer, not a failure: asking again with the same token gets the same one.
+*/
+var SESSION_REFUSAL_CODES = /* @__PURE__ */ new Set([
+	"INVALID_TOKEN",
+	"TOKEN_EXPIRED",
+	"JWT_EXPIRED",
+	"SESSION_REVOKED",
+	"ACCOUNT_DISABLED",
+	"SESSION_ENDED"
+]);
+function isSessionRefusal(error) {
+	return error instanceof RebaseApiError && typeof error.code === "string" && SESSION_REFUSAL_CODES.has(error.code);
+}
 /** The ceiling of the reconnect backoff. */
 var MAX_RECONNECT_DELAY_MS = 3e4;
 /**
@@ -6962,7 +6993,7 @@ var RebaseWebSocketClient = class {
 		if (this.closedByCaller) return;
 		if (this.connectionState !== "reconnecting" && this.connectionState !== "disconnected") return;
 		if (this.ws) return;
-		console.debug(`${reason} — retrying the realtime connection`);
+		connectionDebug(`${reason} — retrying the realtime connection`);
 		if (this.reconnectTimeout) {
 			clearTimeout(this.reconnectTimeout);
 			this.reconnectTimeout = null;
@@ -6994,6 +7025,24 @@ var RebaseWebSocketClient = class {
 	}
 	onlineListener = null;
 	visibilityListener = null;
+	/** The session this socket's server refused, and why. Cleared when a socket opens. */
+	refusedSession = null;
+	/**
+	* Whether `error` is the server refusing the session `token` signs in as —
+	* revoked, its account gone or disabled, a token that does not verify. Said
+	* once per socket and token, as a warning that names the code.
+	*/
+	noteSessionRefused(token, error) {
+		if (!isSessionRefusal(error)) return false;
+		if (this.refusedSession?.token !== token) {
+			this.refusedSession = {
+				token,
+				error
+			};
+			console.warn(`[Rebase] Realtime: the server refused this session (${error.code}: ${error.message}). The socket is connected but not signed in, and what needs an account is refused with that code.`);
+		}
+		return true;
+	}
 	/**
 	* Authenticate the WebSocket connection
 	*/
@@ -7042,10 +7091,10 @@ var RebaseWebSocketClient = class {
 		if (this.isConnected && !this.isAuthenticated && !this.authPromise) this.getAuthToken().then((token) => {
 			if (!this.ws) return;
 			if (token) this.authenticate(token).catch((e) => {
-				if (this.ws) console.debug("WebSocket auto-auth skipped:", e?.message || e);
+				if (this.ws) connectionDebug("WebSocket auto-auth skipped:", e?.message || e);
 			});
 		}).catch((e) => {
-			if (this.ws) console.debug("WebSocket auto-auth skipped:", e?.message || e);
+			if (this.ws) connectionDebug("WebSocket auto-auth skipped:", e?.message || e);
 		});
 	}
 	/**
@@ -7061,6 +7110,7 @@ var RebaseWebSocketClient = class {
 		if (permanent) this.removeNetworkListeners();
 		this.isAuthenticated = false;
 		this.authPromise = null;
+		this.refusedSession = null;
 		if (this.reconnectTimeout) {
 			clearTimeout(this.reconnectTimeout);
 			this.reconnectTimeout = null;
@@ -7095,7 +7145,7 @@ var RebaseWebSocketClient = class {
 			const socket = new this.WebSocketConstructor(withOptIns(this.websocketUrl));
 			this.ws = socket;
 			this.ws.onopen = async () => {
-				console.debug("Connected to PostgreSQL backend");
+				connectionDebug("Connected to PostgreSQL backend");
 				const wasReconnect = this.hadConnection;
 				this.hadConnection = true;
 				this.isConnected = true;
@@ -7104,14 +7154,18 @@ var RebaseWebSocketClient = class {
 				this.outageReported = false;
 				this.gaveUp = false;
 				this.setState("connected");
-				if (this.getAuthToken && !this.isAuthenticated) try {
-					const token = await this.getAuthToken();
-					if (token) {
-						await this.authenticate(token);
-						console.debug("WebSocket auto-authenticated");
+				this.refusedSession = null;
+				if (this.getAuthToken && !this.isAuthenticated) {
+					let token = null;
+					try {
+						token = await this.getAuthToken();
+						if (token) {
+							await this.authenticate(token);
+							connectionDebug("WebSocket auto-authenticated");
+						}
+					} catch (error) {
+						if (!(token && this.noteSessionRefused(token, error))) connectionDebug("WebSocket connected, not signed in yet:", error?.message || error);
 					}
-				} catch (error) {
-					console.debug("WebSocket connected without auth:", error?.message || error);
 				}
 				this.emit(wasReconnect ? "reconnect" : "connect");
 				this.processMessageQueue(wasReconnect);
@@ -7128,7 +7182,7 @@ var RebaseWebSocketClient = class {
 				}
 			};
 			const onClosed = () => {
-				console.debug("Disconnected from PostgreSQL backend");
+				connectionDebug("Disconnected from PostgreSQL backend");
 				this.stopLivenessWatch();
 				this.forgetServerOptIns();
 				if (this.ws === socket) this.ws = null;
@@ -7258,7 +7312,7 @@ var RebaseWebSocketClient = class {
 		this.reconnectAttempts = Math.min(this.reconnectAttempts + 1, 30);
 		const ceiling = Math.min(1e3 * Math.pow(2, this.reconnectAttempts), MAX_RECONNECT_DELAY_MS);
 		const delay = MIN_RECONNECT_DELAY_MS + Math.floor(Math.random() * (ceiling - MIN_RECONNECT_DELAY_MS));
-		console.debug(`Attempting to reconnect in ${delay}ms (attempt ${this.reconnectAttempts})`);
+		connectionDebug(`Attempting to reconnect in ${delay}ms (attempt ${this.reconnectAttempts})`);
 		if (this.reconnectTimeout) clearTimeout(this.reconnectTimeout);
 		this.reconnectTimeout = setTimeout(() => {
 			this.reconnectTimeout = null;
@@ -7527,31 +7581,36 @@ var RebaseWebSocketClient = class {
 	}
 	async runAuthentication(retryCount) {
 		let lastError = null;
-		for (let attempt = 0; attempt < retryCount; attempt++) try {
-			const token = await this.getAuthToken();
-			if (!token) throw new Error("user not logged in");
-			await this.authenticate(token);
-			console.debug("WebSocket authenticated on demand");
-			return;
-		} catch (error) {
-			lastError = error;
-			const errMsg = error instanceof Error ? error.message : String(error);
-			if (errMsg.includes("not logged in") || errMsg.includes("Session expired")) {
-				console.warn("WebSocket auth failed: user not logged in");
-				throw error;
-			}
-			if (errMsg.includes("still loading")) {
+		for (let attempt = 0; attempt < retryCount; attempt++) {
+			let token = null;
+			try {
+				token = await this.getAuthToken();
+				if (!token) throw new Error("user not logged in");
+				if (this.refusedSession?.token === token) throw this.refusedSession.error;
+				await this.authenticate(token);
+				connectionDebug("WebSocket authenticated on demand");
+				return;
+			} catch (error) {
+				lastError = error;
+				if (token && this.noteSessionRefused(token, error)) throw error;
+				const errMsg = error instanceof Error ? error.message : String(error);
+				if (errMsg.includes("not logged in") || errMsg.includes("Session expired")) {
+					console.warn("WebSocket auth failed: user not logged in");
+					throw error;
+				}
+				if (errMsg.includes("still loading")) {
+					if (attempt < retryCount - 1) {
+						const delay = Math.min(500 * (attempt + 1), 2e3);
+						await new Promise((resolve) => setTimeout(resolve, delay));
+						continue;
+					}
+				}
 				if (attempt < retryCount - 1) {
-					const delay = Math.min(500 * (attempt + 1), 2e3);
+					const delay = Math.min(1e3 * (attempt + 1), 3e3);
+					connectionDebug(`WebSocket auth attempt ${attempt + 1} failed, retrying in ${delay}ms...`);
 					await new Promise((resolve) => setTimeout(resolve, delay));
-					continue;
 				}
 			}
-			if (attempt < retryCount - 1) {
-				const delay = Math.min(1e3 * (attempt + 1), 3e3);
-				console.debug(`WebSocket auth attempt ${attempt + 1} failed, retrying in ${delay}ms...`);
-				await new Promise((resolve) => setTimeout(resolve, delay));
-			}
 		}
 		console.warn("WebSocket on-demand auth failed after retries:", lastError);
 		throw lastError;
@@ -7563,7 +7622,7 @@ var RebaseWebSocketClient = class {
 			const token = await this.getAuthToken();
 			if (!token) throw new Error("user not logged in");
 			await this.authenticate(token);
-			console.debug("WebSocket reauthenticated successfully");
+			connectionDebug("WebSocket reauthenticated successfully");
 		} catch (error) {
 			console.error("WebSocket reauthentication failed:", error);
 			throw error;
@@ -7637,6 +7696,10 @@ var RebaseWebSocketClient = class {
 			await this.ensureAuthenticated();
 		} catch (error) {
 			if (!(isSubscriptionFrame && isNotSignedIn(error))) {
+				if (error instanceof RebaseApiError) {
+					reject(error);
+					return;
+				}
 				reject(new RebaseApiError(error instanceof Error ? error.message : "Authentication required"));
 				return;
 			}
@@ -8249,7 +8312,7 @@ var RebaseWebSocketClient = class {
 	* we need to re-register everything to resume receiving updates.
 	*/
 	resubscribeAll() {
-		console.debug(`[WS] Re-subscribing: ${this.collectionSubscriptions.size} collection(s), ${this.singleSubscriptions.size} row(ies)`);
+		connectionDebug(`[WS] Re-subscribing: ${this.collectionSubscriptions.size} collection(s), ${this.singleSubscriptions.size} row(ies)`);
 		for (const [key, sub] of this.collectionSubscriptions.entries()) {
 			if (sub.subscribeInFlight) continue;
 			const oldBackendId = sub.backendSubscriptionId;
@@ -14802,6 +14865,99 @@ function recordMountPath() {
 	};
 }
 //#endregion
+//#region src/backend/boot-announcements.ts
+/**
+* What a backend says while it is built, held until it serves.
+*
+* `createRebaseBackend` builds everything and mounts nothing, and its build
+* logs the boot: the connection's posture, change capture, the per-boot key,
+* which process owns the schema. Those lines are the server's to print — a
+* server mounts the backend a moment later and they are its boot log. A
+* script builds a backend to call `backend.rebase` or `backend.fetch` and
+* never mounts it, and there the same lines were the first thing on its
+* stdout, ahead of the JSON it exists to print (`tsx script.ts > out.json`).
+*
+* So the info lines said inside the build — by this package or a driver, in
+* the build's async context — are held, and written when the backend first
+* serves: `mount()`, a route group, `attachRealtime()` or `start()`. They come
+* out in the order they were said, with the time they were said, before
+* anything the mount says itself; a server's boot reads as it did. A backend
+* that never serves never writes them, and what it logs at info afterwards —
+* the request log of `backend.fetch`, its shutdown — is not written either:
+* that is a library talking to itself.
+*
+* Not held, ever:
+* - warnings and errors, which say something is wrong and are written at once;
+* - anything at `LOG_LEVEL=debug`, which asks for every line as it happens;
+* - a line from anywhere outside the build — the application's own, another
+*   backend's, a request a served backend answers.
+*
+* A build that throws writes what it held: the lines before a failure are the
+* failure's context.
+*
+* Host-side: the build's context is an `AsyncLocalStorage`, so this module is
+* never reachable from `@rebasepro/server/functions`. The logger asks it
+* through `LogLineHook`, which needs nothing from Node.
+*
+* @module
+*/
+/**
+* The most lines one build holds. A build says a few dozen; past this they are
+* written as they come rather than kept, so a pathological build cannot grow
+* the buffer without bound.
+*/
+var MAX_HELD_LINES = 500;
+var context = new AsyncLocalStorage();
+var installed = false;
+/**
+* Point the logger at the build contexts. Once per copy of this module; a hook
+* another copy installed first is asked about every line that is not ours.
+*/
+function installHook() {
+	if (installed) return;
+	installed = true;
+	const previous = _setLogLineHook((level, write) => {
+		const own = context.getStore();
+		if (own) return own.offer(level, write);
+		return previous ? previous(level, write) : false;
+	});
+}
+var Announcements = class {
+	phase = "building";
+	held = [];
+	run(fn) {
+		installHook();
+		return context.run(this, fn);
+	}
+	/** Whether this backend takes the line: holds it, or does not write it. */
+	offer(level, write) {
+		if (this.phase === "serving") return false;
+		if (level === "warn" || level === "error") return false;
+		if (logLevelEnabled("debug")) return false;
+		if (this.phase === "built") return true;
+		if (this.held.length >= MAX_HELD_LINES) return false;
+		this.held.push(write);
+		return true;
+	}
+	built() {
+		if (this.phase === "building") this.phase = "built";
+	}
+	failed() {
+		this.serve();
+	}
+	serve() {
+		if (this.phase === "serving") return;
+		this.phase = "serving";
+		const held = this.held;
+		this.held = [];
+		for (const write of held) write();
+	}
+};
+/** Announcements for one backend about to be built. */
+function createBootAnnouncements() {
+	return new Announcements();
+}
+//#endregion
 //#region src/utils/byte-size.ts
 /**
 * A byte count as an operator reads it in an error message: `10MB`, `1.5MB`,
@@ -14825,6 +14981,93 @@ function trim(value) {
 	return Number.isInteger(rounded) ? String(rounded) : rounded.toFixed(1);
 }
 //#endregion
+//#region src/utils/dev-dependency-command.ts
+/**
+* "Install this optional dependency", spelled so it works where the reader
+* types it: from the project root, in the project's own package manager.
+*
+* A scaffolded project is a workspace whose backend is the member `backend`,
+* and the backend runs there. A bare `pnpm add -D <pkg>` typed at the root —
+* where a reader is, reading `rebase dev`'s output or the admin panel —
+* refuses with `ERR_PNPM_ADDING_TO_ROOT`, so the command names the member.
+*
+* The same rules as the driver's `describeDevAddCommand`
+* (`@rebasepro/server-postgres`, `cli-helpers.ts`), which the CLI prints for
+* atlas. That package depends on this one, not the other way round, so the
+* server keeps its own copy. Host-side: it reads the file system.
+*
+* @module
+*/
+var LOCKFILES = [
+	["pnpm-lock.yaml", "pnpm"],
+	["bun.lock", "bun"],
+	["bun.lockb", "bun"],
+	["yarn.lock", "yarn"],
+	["package-lock.json", "npm"]
+];
+/** Which package manager built the project, read off the nearest lockfile at or above `startDir`. pnpm when none. */
+function projectPackageManager(startDir) {
+	for (let dir = path.resolve(startDir);; dir = path.dirname(dir)) {
+		for (const [file, manager] of LOCKFILES) if (fs$1.existsSync(path.join(dir, file))) return manager;
+		if (path.dirname(dir) === dir) return "pnpm";
+	}
+}
+function isWorkspaceRoot(dir) {
+	if (fs$1.existsSync(path.join(dir, "pnpm-workspace.yaml"))) return true;
+	try {
+		const manifest = JSON.parse(fs$1.readFileSync(path.join(dir, "package.json"), "utf8"));
+		return typeof manifest === "object" && manifest !== null && "workspaces" in manifest;
+	} catch {
+		return false;
+	}
+}
+/**
+* The workspace member `startDir` is in, relative to the workspace root —
+* `backend` in a scaffold — or null at that root and outside any workspace.
+*/
+function workspaceMember(startDir) {
+	let member = path.resolve(startDir);
+	while (!fs$1.existsSync(path.join(member, "package.json"))) {
+		const parent = path.dirname(member);
+		if (parent === member) return null;
+		member = parent;
+	}
+	for (let dir = path.dirname(member);; dir = path.dirname(dir)) {
+		if (isWorkspaceRoot(dir)) return path.relative(dir, member).split(path.sep).join("/");
+		if (path.dirname(dir) === dir) return null;
+	}
+}
+/** A path as one shell word: as it is when it needs no quoting, single-quoted otherwise. */
+var shellWord = (value) => /^[\w./-]+$/.test(value) ? value : `'${value.replace(/'/g, "'\\''")}'`;
+/**
+* `add -D <spec>` for the package the backend in `startDir` runs from, typed
+* at the project root: `pnpm --dir backend add -D ts-morph@28.0.0` in a
+* scaffold, `pnpm add -D ts-morph@28.0.0` where the backend is the project.
+*/
+function devDependencyInstallCommand(spec, startDir = process.cwd()) {
+	const member = workspaceMember(startDir);
+	const dir = member === null ? null : shellWord(member);
+	switch (projectPackageManager(startDir)) {
+		case "npm": return dir ? `npm install -D ${spec} -w ${dir}` : `npm install -D ${spec}`;
+		case "yarn": return dir ? `yarn --cwd ${dir} add -D ${spec}` : `yarn add -D ${spec}`;
+		case "bun": return dir ? `bun add -d ${spec} --cwd ${dir}` : `bun add -d ${spec}`;
+		default: return dir ? `pnpm --dir ${dir} add -D ${spec}` : `pnpm add -D ${spec}`;
+	}
+}
+/** The `ts-morph` the schema editor is built against: the server's optional peer. */
+var TS_MORPH = "ts-morph@28.0.0";
+/**
+* How to turn on what needs `ts-morph`, as the end of a sentence that has
+* said it is missing: "Run `pnpm --dir backend add -D ts-morph@28.0.0` from
+* the project root, then restart the backend, to enable it."
+*
+* `pnpm`, never `npm`, in a pnpm project: running npm inside one rewrites
+* node_modules into a hoisted layout pnpm then disagrees with (docs/bug-classes.md §5).
+*/
+function tsMorphInstallSentence(startDir = process.cwd()) {
+	return `Run \`${devDependencyInstallCommand(TS_MORPH, startDir)}\`${workspaceMember(startDir) === null ? "" : " from the project root"}, then restart the backend, to enable it.`;
+}
+//#endregion
 //#region src/utils/compression.ts
 /**
 * Below this many bytes a body is sent as it is. Hono's own default: gzip's
@@ -18442,11 +18685,11 @@ async function createStorageController(config) {
 	switch (config.type) {
 		case "local": return new LocalStorageController(config);
 		case "s3": {
-			const { S3StorageController } = await import("./S3StorageController-qevJ0pVE.js").then((n) => n.n);
+			const { S3StorageController } = await import("./S3StorageController-D00EFa5P.js").then((n) => n.n);
 			return new S3StorageController(config);
 		}
 		case "gcs": {
-			const { GCSStorageController } = await import("./GCSStorageController-C7ARrDAp.js").then((n) => n.n);
+			const { GCSStorageController } = await import("./GCSStorageController-CRd9bFrc.js").then((n) => n.n);
 			return new GCSStorageController(config);
 		}
 		default: throw new Error(`Unknown storage type: ${config.type}. Built-in types: local, s3, gcs. For other providers, implement the StorageController interface directly.`);
@@ -18685,7 +18928,7 @@ function noCollectionsCause(unprotected) {
 * routes wherever and as often as the application asks.
 */
 async function loadOpenApiGenerator() {
-	const { generateOpenApiSpec } = await import("./openapi-generator-BamY6-ga.js").then((n) => n.r);
+	const { generateOpenApiSpec } = await import("./openapi-generator-BjHr6upl.js").then((n) => n.r);
 	return generateOpenApiSpec;
 }
 /**
@@ -19778,7 +20021,7 @@ function createLiveSchemaRoutes(config) {
 				enabled: false,
 				canPlan: true,
 				code: off?.code ?? "SCHEMA_EDITOR_MISSING_DEPENDENCY",
-				reason: off?.message ?? "Rewriting collection source needs `ts-morph`, which is not installed on this server. Run `pnpm add -D ts-morph@28.0.0` to enable it."
+				reason: off?.message ?? `Rewriting collection source needs \`ts-morph\`, which is not installed on this server. ${tsMorphInstallSentence()}`
 			});
 		}
 		if (!repository) return c.json({
@@ -25989,8 +26232,23 @@ function resolveProvision(provision) {
 * which {@link setDefaultBackend} sets and `initializeRebaseBackend` sets for
 * its backend. The one process-wide setting it touches is the log level, and
 * only when `logging.level` is given: the logger is the process's.
+*
+* What the build logs at info is written when the backend first serves — see
+* `boot-announcements.ts` — so a script that builds one and never mounts it
+* prints nothing of the boot's on its stdout.
 */
 async function createRebaseBackend(options) {
+	const announcements = createBootAnnouncements();
+	try {
+		const backend = await announcements.run(() => buildRebaseBackend(options, announcements));
+		announcements.built();
+		return backend;
+	} catch (error) {
+		announcements.failed();
+		throw error;
+	}
+}
+async function buildRebaseBackend(options, announcements) {
 	const config = options;
 	const provision = resolveProvision(config.provision);
 	if (config.logging?.level !== void 0) setLogLevel(config.logging.level);
@@ -26270,7 +26528,7 @@ async function createRebaseBackend(options) {
 	const platformTokenPreAuth = createPlatformTokenPreAuth(await platformTokensFromEnv(process.env));
 	let backupLinkRouter;
 	if (surfaces.admin) {
-		const { createBackupLinkRoutes, backupDestinationFromEnv } = await import("./backup-Dq0lyJ_D.js").then((n) => n.t);
+		const { createBackupLinkRoutes, backupDestinationFromEnv } = await import("./backup-B9m3cb3X.js").then((n) => n.t);
 		backupLinkRouter = createBackupLinkRoutes({ getDestination: () => backupDestinationFromEnv(process.env) });
 	}
 	const apiKeyRouter = apiKeyStore && surfaces.admin ? createApiKeyRoutes({
@@ -26415,7 +26673,7 @@ async function createRebaseBackend(options) {
 			]) {
 				const providerConfig = safeAuthConfig[key];
 				if (providerConfig && requiredFields.every((f) => Boolean(providerConfig[f]))) {
-					const createFn = (await import("./auth-CteGWxsL.js").then((n) => n.t))[factory];
+					const createFn = (await import("./auth-Dkvo2tTJ.js").then((n) => n.t))[factory];
 					oauthProviders.push(createFn(providerConfig));
 				}
 			}
@@ -26527,6 +26785,21 @@ async function createRebaseBackend(options) {
 		}));
 		if (announce) logger.info(`MCP endpoint mounted at ${publicUrl}${mcpPath} (OAuth at ${oauthBasePath})`);
 	};
+	const mountWarnings = [];
+	const warnOnMount = (group, message) => {
+		mountWarnings.push({
+			group,
+			message,
+			said: false
+		});
+	};
+	const sayMountWarnings = (groups) => {
+		for (const warning of mountWarnings) {
+			if (warning.said || !groups.has(warning.group)) continue;
+			warning.said = true;
+			logger.warn(warning.message);
+		}
+	};
 	const adminSurfacesGated = !!authAdapter && (isAuthAdapter(config.auth) || !!config.auth.jwtSecret);
 	const adminGate = (scopes) => [
 		provideServices,
@@ -26538,9 +26811,9 @@ async function createRebaseBackend(options) {
 		}),
 		typeof scopes === "string" ? requireScope(scopes) : requireScopeByMethod(scopes)
 	];
-	const applyAdminGate = (router, surface, scopes) => {
+	const applyAdminGate = (router, surface, scopes, mountedWith = "admin") => {
 		if (!adminSurfacesGated) {
-			logger.warn(`${surface} routes are mounted but DISABLED: no authentication is configured (no auth adapter and no auth.jwtSecret), so there is no way to tell an admin from an anonymous caller. They answer 501 until auth is configured.`);
+			warnOnMount(mountedWith, `${surface} routes are mounted but DISABLED: no authentication is configured (no auth adapter and no auth.jwtSecret), so there is no way to tell an admin from an anonymous caller. They answer 501 until auth is configured.`);
 			router.use("/*", async (c) => c.json({ error: {
 				code: "ADMIN_SURFACE_UNAVAILABLE",
 				message: `${surface} is admin-only, and this server has no authentication configured to identify an admin with. Set auth.jwtSecret (or pass an AuthAdapter) to enable it.`
@@ -26591,18 +26864,31 @@ async function createRebaseBackend(options) {
 	let schemaEditorRoutes;
 	let schemaSourceEditor;
 	if (!schemaEditorOff && config.collectionsDir) try {
-		const editorModule = await import("./schema-editor-routes-CnNGCayU.js");
+		const editorModule = await import("./schema-editor-routes-Bsut0bCC.js");
 		schemaSourceEditor = editorModule.createSchemaSourceEditor(config.collectionsDir);
 		schemaEditorRoutes = editorModule.createSchemaEditorRoutes(schemaSourceEditor);
 	} catch (err) {
 		if (err?.code === "ERR_MODULE_NOT_FOUND") {
 			schemaEditorOff = {
 				code: "SCHEMA_EDITOR_MISSING_DEPENDENCY",
-				message: "The schema editor needs `ts-morph`, which is not installed on this server. Run `pnpm add -D ts-morph@28.0.0` to enable it."
+				message: "The schema editor needs `ts-morph`, which is not installed on this server. " + tsMorphInstallSentence()
 			};
-			logger.warn(`Schema Editor disabled: ${schemaEditorOff.message}`);
+			logger.debug(`Schema Editor disabled: ${schemaEditorOff.message}`);
 		} else throw err;
 	}
+	/**
+	* The missing `ts-morph`, said the first time the editor is asked for —
+	* the admin panel's collection editor asks both schema surfaces for their
+	* status — rather than at boot. Once per backend.
+	*/
+	let toldEditorNeedsTsMorph = false;
+	const sayEditorNeedsTsMorph = async (_c, next) => {
+		if (!toldEditorNeedsTsMorph && schemaEditorOff?.code === "SCHEMA_EDITOR_MISSING_DEPENDENCY") {
+			toldEditorNeedsTsMorph = true;
+			logger.warn(`Schema Editor disabled: ${schemaEditorOff.message}`);
+		}
+		await next();
+	};
 	let liveSchemaSurface;
 	let schemaEditorSurface;
 	if (surfaces.admin) {
@@ -26611,6 +26897,7 @@ async function createRebaseBackend(options) {
 			read: "schema:read",
 			write: "schema:write"
 		});
+		schemaEditorRouter.use("/*", sayEditorNeedsTsMorph);
 		schemaEditorRouter.get("/status", (c) => c.json(schemaEditorOff ? {
 			enabled: false,
 			reason: schemaEditorOff.message,
@@ -26632,7 +26919,7 @@ async function createRebaseBackend(options) {
 				if (err?.code !== "ERR_MODULE_NOT_FOUND") throw err;
 				remoteEditingOff = {
 					code: "SCHEMA_EDITOR_MISSING_DEPENDENCY",
-					message: "Live schema editing rewrites collection source with `ts-morph`, which is not installed on this server. Run `pnpm add -D ts-morph@28.0.0` to enable it."
+					message: `Live schema editing rewrites collection source with \`ts-morph\`, which is not installed on this server. ${tsMorphInstallSentence()}`
 				};
 				logger.warn(`Live schema editing disabled: ${remoteEditingOff.message}`);
 			}
@@ -26653,6 +26940,7 @@ async function createRebaseBackend(options) {
 			const liveSchemaRouter = new Hono();
 			let undeployedCommit;
 			applyAdminGate(liveSchemaRouter, "Live schema editing", "schema:read");
+			liveSchemaRouter.use("/*", sayEditorNeedsTsMorph);
 			const commitPaths = remoteRepo ? commitPathsFor(path.join("/", remoteRepo.collectionsPath ?? "config/collections"), "/") : collectionsDir && repositoryRoot ? commitPathsFor(collectionsDir, repositoryRoot) : void 0;
 			if (commitPaths) logger.debug("Live schema editing commit paths relocated", { commitPaths });
 			liveSchemaRouter.route("/", createLiveSchemaRoutes({
@@ -26869,7 +27157,7 @@ async function createRebaseBackend(options) {
 		realtime: false,
 		token: internalServiceKey,
 		fetch: async (input, init) => {
-			return await inProcessApp().request(input, init);
+			return await announcements.run(() => inProcessApp().request(input, init));
 		}
 	});
 	const serviceIdentity = SERVICE_IDENTITY;
@@ -26930,9 +27218,9 @@ async function createRebaseBackend(options) {
 	injectCallbackClient(driverResults.values(), serverClient);
 	let functionsSurface;
 	if ((config.functionsDir || config.functions) && surfaces.functions) {
-		const { functionList, readFunctionsDirectory } = await import("./function-loader-DbCSoNJj.js").then((n) => n.t);
-		const { createFunctionRoutes } = await import("./function-routes-DNV4RUF0.js").then((n) => n.n);
-		const { createFunctionsRequestTimeout, resolveFunctionsTimeoutMs } = await import("./request-timeout-CRny5KD0.js").then((n) => n.t);
+		const { functionList, readFunctionsDirectory } = await import("./function-loader-KKDqTcIr.js").then((n) => n.t);
+		const { createFunctionRoutes } = await import("./function-routes-RxrCHNuM.js").then((n) => n.n);
+		const { createFunctionsRequestTimeout, resolveFunctionsTimeoutMs } = await import("./request-timeout-59crS-9u.js").then((n) => n.t);
 		const { functions: functionRecord, problems } = config.functions ? {
 			functions: config.functions,
 			problems: []
@@ -26982,7 +27270,7 @@ async function createRebaseBackend(options) {
 		else logger.warn(`Function routes are served, but no functions loaded from ${config.functionsDir ?? "the `functions` option"}. ` + (problems.length > 0 ? `${problems.length} file(s) were skipped — see the messages above.` : "The directory holds no .ts/.js function files."));
 	}
 	if (config.functionsUpstream && !surfaces.functions) {
-		const { createFunctionsProxy } = await import("./proxy-BEKbsil6.js").then((n) => n.t);
+		const { createFunctionsProxy } = await import("./proxy-CH8Jsovg.js").then((n) => n.t);
 		functionsSurface = createFunctionsProxy({ upstream: config.functionsUpstream });
 		logger.info("Forwarding custom functions to another process", { upstream: config.functionsUpstream });
 	}
@@ -26991,10 +27279,10 @@ async function createRebaseBackend(options) {
 	/** How many cron jobs `start()` schedules in this process. */
 	let cronJobsToSchedule = 0;
 	if (surfaces.cron || (config.cronsDir || config.crons) && ownership.cronScheduler) {
-		const { cronJobsFrom, readCronsDirectory } = await import("./cron-loader-NHqRfKF0.js").then((n) => n.t);
-		const { CronScheduler } = await import("./cron-scheduler-D1DT0nw5.js").then((n) => n.n);
-		const { createCronRoutes } = await import("./cron-routes-Dhf82HzT.js").then((n) => n.n);
-		const { createCronStore } = await import("./cron-store-DEpVstUU.js").then((n) => n.n);
+		const { cronJobsFrom, readCronsDirectory } = await import("./cron-loader-Dj6lA4HQ.js").then((n) => n.t);
+		const { CronScheduler } = await import("./cron-scheduler-B04ACoUE.js").then((n) => n.n);
+		const { createCronRoutes } = await import("./cron-routes-CwbLZguO.js").then((n) => n.n);
+		const { createCronStore } = await import("./cron-store-DkyfuLOH.js").then((n) => n.n);
 		const { crons: cronRecord, problems: cronProblems } = config.crons ? {
 			crons: config.crons,
 			problems: []
@@ -27023,7 +27311,7 @@ async function createRebaseBackend(options) {
 		applyAdminGate(cronRouter, "Cron", {
 			read: "cron:read",
 			write: "cron:write"
-		});
+		}, "cron");
 		cronRouter.route("/", createCronRoutes(cronScheduler, cronProblems.length));
 		cronSurface = cronRouter;
 		if (loadedCronJobs.length > 0 && !ownership.cronScheduler) logger.info("Cron jobs registered but NOT scheduled in this process", {
@@ -27055,7 +27343,7 @@ async function createRebaseBackend(options) {
 	}
 	let metricsHistory;
 	try {
-		const { createMetricsHistory } = await import("./history-recorder-RZ1Ow4YY.js");
+		const { createMetricsHistory } = await import("./history-recorder-B2rkuhuy.js");
 		metricsHistory = createMetricsHistory(defaultDriver);
 		if (metricsHistory && provision.database) await metricsHistory.ensure();
 	} catch (err) {
@@ -27064,7 +27352,7 @@ async function createRebaseBackend(options) {
 	}
 	let jobQueue;
 	if (jobsOptions?.enabled) {
-		const { createJobStore, createJobQueue } = await import("./jobs-8G-_agld.js").then((n) => n.t);
+		const { createJobStore, createJobQueue } = await import("./jobs-h1WRq3cp.js").then((n) => n.t);
 		const store = createJobStore(defaultDriver);
 		if (store) {
 			if (provision.database) await store.ensureTable();
@@ -27104,7 +27392,7 @@ Use a driver that supports the job queue, or remove the declarations. Refusing t
 	let logsSurface;
 	let metaSurface;
 	if (surfaces.admin) {
-		const { createBackupRoutes, backupDestinationFromEnv, readBackupSchedule } = await import("./backup-Dq0lyJ_D.js").then((n) => n.t);
+		const { createBackupRoutes, backupDestinationFromEnv, readBackupSchedule } = await import("./backup-B9m3cb3X.js").then((n) => n.t);
 		const backupRouter = new Hono();
 		applyAdminGate(backupRouter, "Backup", "backups:read");
 		const scheduler = cronScheduler;
@@ -27125,7 +27413,7 @@ Use a driver that supports the job queue, or remove the declarations. Refusing t
 		rlsAuditSurface = rlsAuditRouter;
 	}
 	if (surfaces.admin) {
-		const { createSqlExportRoutes } = await import("./sql-export-routes-BgTJ7K3S.js");
+		const { createSqlExportRoutes } = await import("./sql-export-routes-DmB_uZ4l.js");
 		const sqlExportRouter = new Hono();
 		applyAdminGate(sqlExportRouter, "SQL export", "database:write");
 		sqlExportRouter.route("/", createSqlExportRoutes({ getAdmin: () => defaultDriver.admin }));
@@ -27155,14 +27443,14 @@ Use a driver that supports the job queue, or remove the declarations. Refusing t
 		devMailSurface = devMailRouter;
 	}
 	if (surfaces.admin) {
-		const { createLogsRoutes } = await import("./logs-routes-CelTiS7C.js").then((n) => n.n);
+		const { createLogsRoutes } = await import("./logs-routes-CBt7mMIL.js").then((n) => n.n);
 		const logsRouter = new Hono();
 		applyAdminGate(logsRouter, "Logs", "logs:read");
 		logsRouter.route("/", createLogsRoutes({}, { closeSignal: longLivedResponses.signal }));
 		logsSurface = logsRouter;
 	}
 	if (surfaces.meta) {
-		const { createContractRoutes } = await import("./contract-routes-DiFwiLg2.js").then((n) => n.t);
+		const { createContractRoutes } = await import("./contract-routes-CsFXW7j4.js").then((n) => n.t);
 		const contractRouter = new Hono();
 		if (adminSurfacesGated) contractRouter.use("/contract", ...adminGate("schema:read"));
 		else {
@@ -27170,7 +27458,7 @@ Use a driver that supports the job queue, or remove the declarations. Refusing t
 				code: "CONTRACT_UNAVAILABLE",
 				message: "The project contract is only served when authentication is configured, because it describes every table and relation in the project."
 			} }, 404));
-			logger.warn("Contract endpoint disabled: no auth is configured (no adapter or no jwtSecret), and it would otherwise expose the full collection schema to anyone. `/api/meta/schema-version` is still served.");
+			warnOnMount("meta", "Contract endpoint disabled: no auth is configured (no adapter or no jwtSecret), and it would otherwise expose the full collection schema to anyone. `/api/meta/schema-version` is still served.");
 		}
 		contractRouter.route("/", createContractRoutes({
 			collectionRegistry,
@@ -27231,7 +27519,8 @@ Use a driver that supports the job queue, or remove the declarations. Refusing t
 		if (surfaces[surface]) return;
 		throw new Error(`routes.${surface}(): this backend was created with \`surfaces: { ${surface}: false }\`, so it built no ${surface} routes. Create it with the ${surface} surface on to mount them.`);
 	};
-	const routes = {
+	/** The groups as they are built. `mountInto` and the public {@link routes} below compose from these. */
+	const groups = {
 		auth: () => {
 			requireSurface("auth");
 			const authGroup = group();
@@ -27280,6 +27569,25 @@ Use a driver that supports the job queue, or remove the declarations. Refusing t
 			return group(metaSurface);
 		}
 	};
+	/**
+	* The groups an application mounts one by one. Asking for one is serving:
+	* what the build said is written, and the group's own warnings with it.
+	*/
+	const servedGroup = (name) => () => {
+		const router = groups[name]();
+		announcements.serve();
+		sayMountWarnings(/* @__PURE__ */ new Set([name]));
+		return router;
+	};
+	const routes = {
+		auth: servedGroup("auth"),
+		data: servedGroup("data"),
+		storage: servedGroup("storage"),
+		functions: servedGroup("functions"),
+		admin: servedGroup("admin"),
+		cron: servedGroup("cron"),
+		meta: servedGroup("meta")
+	};
 	/** The base path the application last mounted at — where the SDK's socket dials by default. */
 	let mountedBasePath;
 	/**
@@ -27293,6 +27601,14 @@ Use a driver that supports the job queue, or remove the declarations. Refusing t
 	*/
 	const mountInto = (app, basePathOption, announce) => {
 		const basePath = basePathOption || "/api";
+		if (announce) {
+			announcements.serve();
+			const mounted = /* @__PURE__ */ new Set();
+			if (surfaces.admin) mounted.add("admin");
+			if (surfaces.cron && cronSurface) mounted.add("cron");
+			if (surfaces.meta && metaSurface) mounted.add("meta");
+			sayMountWarnings(mounted);
+		}
 		installRootErrorHandler(app);
 		installUnmatchedApiEnvelope(app, basePath);
 		const middlewares = configureMiddlewares(app, basePath, isProduction, announce ? config : {
@@ -27300,8 +27616,8 @@ Use a driver that supports the job queue, or remove the declarations. Refusing t
 			corsHandled: true
 		});
 		app.use(`${basePath}/*`, refuseUnhonouredImpersonation([`${basePath}/data`, `${basePath}/functions`]));
-		if (surfaces.admin) app.route(`${basePath}/admin`, routes.admin());
-		if (surfaces.auth) app.route(`${basePath}/auth`, routes.auth());
+		if (surfaces.admin) app.route(`${basePath}/admin`, groups.admin());
+		if (surfaces.auth) app.route(`${basePath}/auth`, groups.auth());
 		if (jwt.isConfigured() && surfaces.auth) {
 			app.route("/.well-known", createJwksRoutes(jwt));
 			if (announce && jwt.hasAsymmetricSigningKey()) logger.info("Access tokens are signed asymmetrically; public keys at /.well-known/jwks.json");
@@ -27309,12 +27625,12 @@ Use a driver that supports the job queue, or remove the declarations. Refusing t
 		mountMcp(app, basePath, announce);
 		if (schemaEditorSurface) app.route(`${basePath}/schema-editor`, deprecatedAlias(schemaEditorSurface, `${basePath}/admin/schema-editor`));
 		if (surfaces.storage) {
-			app.route(`${basePath}/storage`, routes.storage());
+			app.route(`${basePath}/storage`, groups.storage());
 			if (storageCarriesUploadLimit) middlewares.exemptFromBodyLimit(`${basePath}/storage${STORAGE_UPLOAD_PATH}`);
 			else if (announce) logger.info("Storage not configured — /storage/sources lists none, every other /storage route returns 501 STORAGE_NOT_CONFIGURED");
 		}
 		if (surfaces.data) {
-			app.route(`${basePath}/data`, routes.data());
+			app.route(`${basePath}/data`, groups.data());
 			if (announce && activeCollections.length === 0) logger.info("No collections to serve — /data returns 404 NO_COLLECTIONS");
 			mountOpenApiDocs(app, basePath, {
 				enableSwagger: config.enableSwagger,
@@ -27327,15 +27643,15 @@ Use a driver that supports the job queue, or remove the declarations. Refusing t
 			});
 		}
 		if (functionsSurface) {
-			app.route(`${basePath}/functions`, routes.functions());
+			app.route(`${basePath}/functions`, groups.functions());
 			if (announce) logger.debug("Function routes mounted", { path: `${basePath}/functions` });
 		}
 		if (surfaces.cron && cronSurface) {
-			app.route(`${basePath}/admin/cron`, routes.cron());
+			app.route(`${basePath}/admin/cron`, groups.cron());
 			app.route(`${basePath}/cron`, deprecatedAlias(cronSurface, `${basePath}/admin/cron`));
 		}
 		if (logsSurface) app.route(`${basePath}/logs`, deprecatedAlias(logsSurface, `${basePath}/admin/logs`));
-		if (surfaces.meta && metaSurface) app.route(`${basePath}/meta`, routes.meta());
+		if (surfaces.meta && metaSurface) app.route(`${basePath}/meta`, groups.meta());
 		if (announce) logger.debug("Rebase backend mounted", { basePath });
 	};
 	let inProcess;
@@ -27348,6 +27664,7 @@ Use a driver that supports the job queue, or remove the declarations. Refusing t
 	};
 	let realtimeAttached = false;
 	const attachRealtime = async (server, attachOptions = {}) => {
+		announcements.serve();
 		if (!surfaces.realtime || !defaultBootstrapper.initializeWebsockets || !effectiveRealtimeService) return;
 		if (realtimeAttached) throw new Error("attachRealtime(): this backend's websocket is already attached to a server.");
 		realtimeAttached = true;
@@ -27365,6 +27682,7 @@ Use a driver that supports the job queue, or remove the declarations. Refusing t
 	let authTokenSweep;
 	let historyRetentionSweep;
 	const start = () => {
+		announcements.serve();
 		if (started) return;
 		started = true;
 		runInBackendScope(ownScope, startTimers);
@@ -27406,7 +27724,7 @@ Use a driver that supports the job queue, or remove the declarations. Refusing t
 			persistClaims: config.cronPersistence !== false
 		});
 	};
-	const shutdown = (timeoutMs, shutdownOptions = {}) => createShutdown({
+	const shutdown = (timeoutMs, shutdownOptions = {}) => announcements.run(() => createShutdown({
 		server: shutdownOptions.server,
 		cronScheduler,
 		jobQueue,
@@ -27417,7 +27735,7 @@ Use a driver that supports the job queue, or remove the declarations. Refusing t
 		realtimeServices,
 		closeLongLivedResponses: () => longLivedResponses.abort(),
 		emailService
-	})(timeoutMs);
+	})(timeoutMs));
 	logger.debug("Rebase Backend Initialized");
 	return {
 		rebase: serverSingleton,
@@ -27436,7 +27754,7 @@ Use a driver that supports the job queue, or remove the declarations. Refusing t
 		cronScheduler,
 		jobQueue,
 		routes,
-		fetch: async (request) => await inProcessApp().fetch(request),
+		fetch: async (request) => await announcements.run(() => inProcessApp().fetch(request)),
 		mount: (app, mountOptions = {}) => {
 			mountInto(app, mountOptions.basePath, true);
 			mountedBasePath = mountOptions.basePath || "/api";
@@ -29121,14 +29439,14 @@ function listenWithPortRetry(server, startPort, options) {
 			const onListening = () => {
 				cleanup();
 				const bound = boundPort(server) ?? port;
-				if (portFileDir) {
-					try {
-						const portFile = path$1.join(portFileDir, DEV_PORT_FILENAME);
-						fs.writeFileSync(portFile, `${bound} ${startPort}`, "utf-8");
-					} catch {}
-					writeStateFile(portFileDir, bound, options?.serviceKey);
+				if (!portFileDir) {
+					resolve(bound);
+					return;
 				}
-				resolve(bound);
+				heldByAnotherServer(portFileDir, bound).catch(() => false).then((held) => {
+					if (!held) writeDevFiles(portFileDir, bound, startPort, options?.serviceKey);
+					resolve(bound);
+				});
 			};
 			/**
 			* Say which port was refused and which one is next.
@@ -29174,18 +29492,116 @@ function listenWithPortRetry(server, startPort, options) {
 	});
 }
 /**
+* What this process wrote into each project's `.rebase-dev-port`, by
+* directory, so that stopping removes the file only while it still says that.
+*/
+var writtenPortFiles = /* @__PURE__ */ new Map();
+function stateFilePath(dir) {
+	return path$1.join(dir, ".rebase", "state.json");
+}
+/** The pid and port `.rebase/state.json` names, or `null` when there is none to read. */
+function readStateOwner(dir) {
+	let raw;
+	try {
+		raw = fs.readFileSync(stateFilePath(dir), "utf-8");
+	} catch {
+		return null;
+	}
+	try {
+		const parsed = JSON.parse(raw);
+		if (typeof parsed !== "object" || parsed === null) return {
+			pid: null,
+			port: null
+		};
+		return {
+			pid: "pid" in parsed && typeof parsed.pid === "number" && Number.isInteger(parsed.pid) && parsed.pid > 0 ? parsed.pid : null,
+			port: "port" in parsed && typeof parsed.port === "number" && Number.isInteger(parsed.port) ? parsed.port : null
+		};
+	} catch {
+		return {
+			pid: null,
+			port: null
+		};
+	}
+}
+/** Is *some* process with this pid running? EPERM means it is, as someone else. */
+function processAlive(pid) {
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch (error) {
+		return error.code === "EPERM";
+	}
+}
+/**
+* Whether `rebase dev` started this server.
+*
+* It states `REBASE_DEV_PORT_EXPLICIT`, true or false, on every backend it
+* spawns (see `options.explicit` above), so the variable reading as either at
+* all is the mark. The dev files are named for that server and describe it
+* first.
+*/
+function startedByRebaseDev() {
+	return parseEnvBoolean(process.env.REBASE_DEV_PORT_EXPLICIT) !== void 0;
+}
+/**
+* Whether another server in this project holds the dev files, so this one must
+* leave them alone.
+*
+* `rebase start` beside `rebase dev` is the documented local check, and both
+* bind through {@link listenWithPortRetry}. The files used to belong to
+* whoever bound last: `start` took them over while it ran, so `rebase
+* api-keys`, `generate-sdk` and MCP discovery all reached it rather than dev,
+* and when it stopped it deleted them under a dev that was still serving —
+* `api-keys list` then answered "This project's server is not running".
+*
+* So the files belong to the server `state.json` names while that server is
+* still there: its pid alive, and its port answering, because a pid alone can
+* be a stranger's after a crash and a reboot. A server on the very port it
+* names is not "another" one — that is a `tsx watch` restart, or a crash this
+* server has replaced. A server `rebase dev` started takes the files over in
+* every case: they are its own.
+*/
+async function heldByAnotherServer(dir, bound) {
+	if (startedByRebaseDev()) return false;
+	const owner = readStateOwner(dir);
+	if (!owner || owner.pid === null || owner.pid === process.pid) return false;
+	if (owner.port === null || owner.port === bound) return false;
+	if (!processAlive(owner.pid)) return false;
+	return loopbackInUse(owner.port);
+}
+/** Write `.rebase-dev-port` and `.rebase/state.json` for a server this process just bound. */
+function writeDevFiles(dir, bound, requested, serviceKey) {
+	try {
+		const contents = `${bound} ${requested}`;
+		fs.writeFileSync(path$1.join(dir, DEV_PORT_FILENAME), contents, "utf-8");
+		writtenPortFiles.set(path$1.resolve(dir), contents);
+	} catch {}
+	writeStateFile(dir, bound, serviceKey);
+}
+/**
 * Clean up the dev port file and state file (call on graceful shutdown).
 *
+* Only this process's own: `state.json` while it names this pid, and
+* `.rebase-dev-port` while it holds what this process wrote and no other
+* server has taken `state.json` over. A `rebase start` that stopped beside a
+* running `rebase dev` used to delete dev's files — see `heldByAnotherServer`.
+*
 * @internal Not part of the stable public API. See {@link listenWithPortRetry}.
 */
 function cleanupDevPortFile(dir) {
-	try {
-		const portFile = path$1.join(dir, DEV_PORT_FILENAME);
-		if (fs.existsSync(portFile)) fs.unlinkSync(portFile);
+	const owner = readStateOwner(dir);
+	const ownsState = owner?.pid === process.pid;
+	if (ownsState) try {
+		fs.unlinkSync(stateFilePath(dir));
 	} catch {}
+	const key = path$1.resolve(dir);
+	const wrote = writtenPortFiles.get(key);
+	if (wrote === void 0 || !(ownsState || owner === null)) return;
 	try {
-		const stateFile = path$1.join(dir, ".rebase", "state.json");
-		if (fs.existsSync(stateFile)) fs.unlinkSync(stateFile);
+		const portFile = path$1.join(dir, DEV_PORT_FILENAME);
+		if (fs.readFileSync(portFile, "utf-8") === wrote) fs.unlinkSync(portFile);
+		writtenPortFiles.delete(key);
 	} catch {}
 }
 /**