@rebasepro/server 0.25.0 → 0.26.0

package/dist/{auth-CteGWxsL.js → auth-izI7AEzC.js}

@@ -3,20 +3,18 @@ import __rebaseProcess from "process";
 globalThis.process ??= __rebaseProcess;
 __rebaseCreateRequire(import.meta.url);
 import { i as __toESM, n as __exportAll } from "./rolldown-runtime-dW7B1o5h.js";
-import { r as toSnakeCase } from "./strings.es-BeZWAodn.js";
-import { B as rewriteLegacyRlsFunctions, _ as scopesForRoles, a as KEY_MANAGEMENT_SCOPES, b as validateScopes, c as intersectScopes, d as isDataPlaneScope, f as knownScopes, g as scopesBeyond, h as scopeGrantsAny, i as EMPTY_ACCESS_MODEL, l as isAdminScope, m as scopeGrants, n as ADMIN_SCOPES, o as SCOPE_TARGETS, p as parseScope, r as BUILT_IN_SCOPES, s as hasAdminRole, t as ADMIN_ROLE, u as isBuiltInScope, v as summarizeRoles } from "./src-D5Y3N-S4.js";
+import { V as rewriteLegacyRlsFunctions, _ as scopesBeyond, a as KEY_MANAGEMENT_SCOPES, f as knownScopes, l as isAdminScope, m as roleNameProblem, o as SCOPE_TARGETS, p as parseScope, s as hasAdminRole, u as isBuiltInScope, x as validateScopes, y as summarizeRoles } from "./src-Bh9LRPb9.js";
 import { n as isAnonymousUid, r as policy, t as ANONYMOUS_USER_ID } from "./policy-PdzX-Opd.js";
-import { t as isSQLAdmin } from "./backend-DTAOsLQc.js";
-import { t as IMPERSONATE_HEADER } from "./auth_adapter-CIItCTc8.js";
-import { r as logger } from "./logger-Bt32sHFw.js";
+import { n as isSQLAdmin } from "./backend-CaG_Jyso.js";
+import { $ as accessTokenRefusalError, C as queryTokenAuth, E as requireAuth, G as isApiKeyToken, J as extractBearerToken, K as resolveApiKey, L as applySimulation, P as applyImpersonation, T as requireAdmin, X as SERVICE_IDENTITY, Y as safeCompare, Z as scopeDataDriver, _ as createAuthMiddleware, a as assertMayManageAccount, at as httpMethodToOperation, b as fileTokenAuth, c as configureAccess, f as processAccessControl, h as requireScopeByMethod, i as assertMayGrantRoles, l as getAccessModel, m as requireScope, n as accessModelFromCollections, nt as replaceUserPassword, o as callerIsAdmin, p as readRoleNames, q as validateApiKey, r as accessOf, rt as revokeAllSessions, s as callerScopes, t as AccessModelError, tt as judgeAccessToken, u as hasScope, v as createRequireAuth, w as refuse, x as optionalAuth, y as extractUserFromToken } from "./access-BFAUvsSs.js";
+import { a as logger } from "./logger-CW8pmTS6.js";
+import { r as toSnakeCase } from "./strings.es-B7QLnHh2.js";
 import { n as revokeInternalTableSql, t as REBASE_USER_ROLE } from "./internal-tables-L2t39RdT.js";
 import { t as firstSqlRow } from "./sql-rows-C6GEc2oE.js";
-import { a as resolveListLimitParam } from "./query-parser-CGohjyWI.js";
-import { a as isDataException, i as errorHandler, o as isDatabaseUnreachable, t as ApiError } from "./errors-_ytoGi8A.js";
-import { E as sha256Hex, S as constantTimeEqual, _ as verifyAccessToken, a as generateAccessToken, c as getAccessTokenExpiry, d as hasAsymmetricSigningKey, f as hashRefreshToken, h as processJwtService, i as customClaimsOf, l as getJwks, m as jwtOf, n as configureJwt, o as generateDownloadToken, p as isJwtConfigured, s as generateRefreshToken, t as MAX_COOKIE_AGE_MS, u as getRefreshTokenExpiry, v as verifyDownloadToken, w as randomInt$1, x as require_jsonwebtoken } from "./jwt-YhciR93H.js";
-import { a as canonicalStorageId, o as canonicalStorageKey, r as InvalidStorageKeyError } from "./keys-COzQ2aE8.js";
-import { n as scopeGuardProblem } from "./admin-roles-DI9RsgN3.js";
-import { n as createDdlBootstrapper } from "./ddl-bootstrap-BNqi2NZe.js";
+import { a as resolveListLimitParam } from "./query-parser-CDXWf2hH.js";
+import { _ as verifyAccessToken, a as generateAccessToken, c as getAccessTokenExpiry, d as hasAsymmetricSigningKey, f as hashRefreshToken, h as processJwtService, i as customClaimsOf, l as getJwks, m as jwtOf, n as configureJwt, o as generateDownloadToken, p as isJwtConfigured, s as generateRefreshToken, t as MAX_COOKIE_AGE_MS, u as getRefreshTokenExpiry, v as verifyDownloadToken, w as randomInt$1, x as require_jsonwebtoken } from "./jwt-rDS0884_.js";
+import { c as provisioningExec, n as SchemaChangeRefusedError, r as createDdlBootstrapper } from "./ddl-bootstrap-CjRrn12l.js";
+import { a as isDataException, c as warnIfDatabaseClosed, i as errorHandler, o as isDatabaseUnreachable, t as ApiError } from "./errors-OMWkKSH-.js";
 import { createHash, randomBytes, randomInt } from "node:crypto";
 import { Hono } from "hono";
 import { promisify } from "util";
@@ -24,108 +22,6 @@ import { createCipheriv, createDecipheriv, createHash as createHash$1, createHma
 import { getConnInfo } from "@hono/node-server/conninfo";
 import { createMiddleware } from "hono/factory";
 import { z } from "zod";
-//#region ../types/src/controllers/storage.ts
-/**
-* Path prefix that marks an object as **public**. Files stored under this
-* prefix are served without any auth token via a stable, permanent,
-* CDN-cacheable URL (see {@link StorageSource.getSignedUrl}). Shared by the
-* client SDK and the backend so both agree on which objects are public.
-*
-* @group Models
-*/
-var PUBLIC_STORAGE_PREFIX = "public/";
-/**
-* True when a storage **key** is public: it lies under
-* {@link PUBLIC_STORAGE_PREFIX}.
-*
-* The key is read exactly as it is — the canonical key within its bucket, the
-* one the server stores, serves, and hands a `storageAuthorize` hook as
-* `key` — and nothing is parsed out of it. That is the difference from
-* {@link isPublicStoragePath}, which reads a client-side *path* and so strips
-* a `scheme://` and a leading `default/` bucket segment first. On a key both are
-* wrong: `default/public/x` is a key in a folder called `default`, and a
-* request path `notes://public/x` names the key `notes:/public/x`. Neither is
-* public, and the server decides on this function so that it never says they
-* are.
-*
-* @group Models
-*/
-function isPublicStorageKey(key) {
-	if (!key || !key.startsWith("public/")) return false;
-	return !key.split(/[\\/]/).includes("..");
-}
-/**
-* True when a storage key or client-side path points at a public object
-* (lives under {@link PUBLIC_STORAGE_PREFIX}).
-*
-* For a path as a client holds it: a `scheme://` prefix and a single leading
-* `default/` bucket segment are stripped first. The server and a
-* `storageAuthorize` hook, which hold the canonical key, use
-* {@link isPublicStorageKey}.
-*
-* @group Models
-*/
-function isPublicStoragePath(path) {
-	if (!path) return false;
-	let p = path;
-	const scheme = p.indexOf("://");
-	if (scheme !== -1) p = p.substring(scheme + 3);
-	p = p.replace(/^\/+/, "");
-	if (p.split("/").some((seg) => seg === "..")) return false;
-	return p.startsWith("public/") || p.startsWith(`default/public/`);
-}
-/**
-* The path the storage routes address an object by, from a key or from the
-* `storageUrl` an upload returned (`<scheme>://<bucket>/<key>`, which is what a
-* property with `includeBucketUrl: true` keeps in its column).
-*
-* The routes address a source's objects by key. On S3 and GCS the bucket in a
-* `storageUrl` is always the source's own — the server refuses any other — so
-* it is dropped: sent along, `s3://acme-media/products/a.png` reached the
-* server as the key `acme-media/products/a.png`, the preview found nothing and
-* a delete reported success while the object stayed. It worked on local disk
-* only, because `local://default/<key>` happens to carry the one bucket
-* segment the routes recognise — which is kept, as is any other local bucket.
-*
-* A bare key whose first folder is `default` is sent behind that bucket
-* segment. The routes read one leading `default/` (in any case) as the bucket,
-* so the key `default/photo.png` sent as it is names the root `photo.png`:
-* {@link defaultBucketPath} is the spelling that names the key itself.
-*
-* Shared by every storage source that talks to those routes, so they address
-* an object alike.
-*
-* @group Models
-*/
-function storageObjectPath(keyOrUrl, bucket) {
-	let filePath = keyOrUrl;
-	let bucketQualified = false;
-	const scheme = /^(local|s3|gs):\/\//.exec(filePath);
-	if (scheme) {
-		filePath = filePath.substring(scheme[0].length);
-		if (scheme[1] !== "local") {
-			const slash = filePath.indexOf("/");
-			if (slash > 0) filePath = filePath.substring(slash + 1);
-		} else bucketQualified = true;
-	}
-	if (bucket && filePath) {
-		if (!filePath.startsWith(`${bucket}/`)) filePath = `${bucket}/${filePath}`;
-		bucketQualified = true;
-	}
-	return bucketQualified ? filePath : defaultBucketPath(filePath);
-}
-/**
-* The request path of a key in the default bucket: the key itself, unless the
-* routes would read its first folder as the bucket — a first folder named
-* `default`, matched as the routes match it (case-insensitively, and only when
-* something follows it). Then the bucket segment goes in front, so exactly the
-* one segment the routes strip is the one added.
-*/
-function defaultBucketPath(key) {
-	const segments = key.split("/");
-	return segments.length > 1 && segments[0].toLowerCase() === "default" ? `default/${key}` : key;
-}
-//#endregion
 //#region ../common/src/util/email.ts
 /**
 * Email normalization — one implementation, because the database enforces it.
@@ -283,6 +179,21 @@ function scalarSubqueryBody(s) {
 	const inner = s.slice(1, -1).trim();
 	return STARTS_WITH_SELECT.test(inner) ? inner.slice(6).trim() : null;
 }
+/**
+* The names in a role array's body — `'admin', 'editor'`, each with or without
+* Postgres's `::text` — or `null` when an element is anything else. A quote
+* or a comma inside a name is not split into roles that were never there: the
+* clause stays raw and round-trips verbatim.
+*/
+function roleArrayElements(list) {
+	const roles = [];
+	for (const element of list.split(",")) {
+		const match = /^'([^',]*)'(?:::text)?$/.exec(element.trim());
+		if (!match) return null;
+		roles.push(match[1]);
+	}
+	return roles;
+}
 /** Whether any part of `expr` fell through to `raw`. */
 function containsRaw(expr) {
 	switch (expr.kind) {
@@ -303,16 +214,9 @@ function sqlToPolicy(sql) {
 	}
 	if (trimmed.toLowerCase() === "true") return policy.true();
 	if (trimmed.toLowerCase() === "false") return policy.false();
-	const overlapMatch = trimmed.match(/^string_to_array\s*\(\s*rebase\.roles\(\)\s*,\s*','\s*\)\s*&&\s*ARRAY\s*\[(.+)\]$/i);
-	if (overlapMatch) {
-		const roles = overlapMatch[1].split(",").map((s) => s.trim().replace(/^'|'$/g, ""));
-		return policy.rolesOverlap(roles);
-	}
-	const containMatch = trimmed.match(/^string_to_array\s*\(\s*rebase\.roles\(\)\s*,\s*','\s*\)\s*@>\s*ARRAY\s*\[(.+)\]$/i);
-	if (containMatch) {
-		const roles = containMatch[1].split(",").map((s) => s.trim().replace(/^'|'$/g, ""));
-		return policy.rolesContain(roles);
-	}
+	const rolesMatch = trimmed.match(/^string_to_array\s*\(\s*rebase\.roles\(\)\s*,\s*','(?:::text)?\s*\)\s*(&&|@>)\s*ARRAY\s*\[(.+)\]$/i);
+	const roles = rolesMatch ? roleArrayElements(rolesMatch[2]) : null;
+	if (rolesMatch && roles) return rolesMatch[1] === "&&" ? policy.rolesOverlap(roles) : policy.rolesContain(roles);
 	const orParts = splitTopLevel(trimmed, "OR");
 	if (orParts) return policy.or(...orParts.map(sqlToPolicy));
 	const andParts = splitTopLevel(trimmed, "AND");
@@ -629,26 +533,188 @@ function checkOperation(collection, authContext, entity, targetOperation, option
 	return hasPermissive ? grantedByPermissive : false;
 }
 //#endregion
-//#region src/auth/api-keys/http-operation.ts
+//#region src/auth/resolve-rate-limit-store.ts
+/**
+* A refusal to boot, phrased as the variable to change.
+*
+* Its own class so `bootFromBundle` can present it as a configuration problem
+* rather than a crash, matching `RoleConfigurationError`.
+*/
+var RateLimitStoreConfigurationError = class extends Error {
+	hint;
+	constructor(message, hint) {
+		super(message);
+		this.hint = hint;
+		this.name = "RateLimitStoreConfigurationError";
+	}
+};
 /**
-* Map an HTTP method to the operation it performs.
+* Which store this process should build.
 *
-* - `GET`, `HEAD`, `OPTIONS` → `"read"`
-* - `POST`, `PUT`, `PATCH`  → `"write"`
-* - `DELETE`                → `"delete"`
+* A misspelled value **refuses to boot** rather than falling back to memory.
+* Every other outcome here is silent — the whole failure mode of this setting is
+* that nothing looks wrong — so the one moment it can be caught is the moment it
+* is read. `REBASE_RATE_LIMIT_STORE=postgres` is the obvious thing to type and
+* would otherwise be a per-replica limit wearing the shape of a shared one.
 *
-* Any other method is a `"write"`: a verb this does not know is not assumed
-* to be harmless.
+* A blank or whitespace-only value is *unset*, not invalid:
+* `REBASE_RATE_LIMIT_STORE=${SOMETHING}` with `SOMETHING` undefined is the
+* ordinary way to write a compose file, and it is how the platform neutralises a
+* tenant's own variable.
 */
-function httpMethodToOperation(method) {
-	switch (method.toUpperCase()) {
-		case "GET":
-		case "HEAD":
-		case "OPTIONS": return "read";
-		case "DELETE": return "delete";
-		default: return "write";
+function resolveRateLimitStoreKind(env) {
+	const raw = (env.REBASE_RATE_LIMIT_STORE ?? "").trim().toLowerCase();
+	if (raw === "") return "memory";
+	if (raw === "memory" || raw === "sql") return raw;
+	throw new RateLimitStoreConfigurationError(`REBASE_RATE_LIMIT_STORE="${raw}" is not a rate-limit store.`, "Use \"sql\" to share counts across processes, or \"memory\" (the default) to keep them in this process. A deployment running more than one replica or more than one role wants \"sql\" — otherwise each process enforces the whole limit by itself.");
+}
+//#endregion
+//#region src/auth/sql-rate-limit-store.ts
+var SCHEMA = "rebase";
+var TABLE_NAME = "rate_limit_hits";
+var TABLE$1 = `${SCHEMA}.${TABLE_NAME}`;
+/** How often expired buckets are deleted. */
+var DEFAULT_SWEEP_MS = 300 * 1e3;
+function createSqlRateLimitStore(driver, options = {}) {
+	const admin = driver.admin;
+	if (!isSQLAdmin(admin)) {
+		logger.warn("⚠️ [rate-limit] The configured driver has no SQL admin, so rate-limit counts cannot be shared between processes. Falling back to this process's memory — each replica will enforce the limit independently.");
+		return;
+	}
+	const exec = provisioningExec((sqlText, execOptions) => admin.executeSql(sqlText, execOptions?.params ? { params: execOptions.params } : void 0), options.provision);
+	const ddl = createDdlBootstrapper(exec, "rate-limit-store");
+	const now = options.now ?? Date.now;
+	const sweepMs = options.sweepMs ?? DEFAULT_SWEEP_MS;
+	let sweepTimer;
+	let ready;
+	/**
+	* Create the table once, and remember whether it worked.
+	*
+	* Lazily rather than at boot because the store is constructed while routes
+	* are being mounted, and an `await` there would put a database round trip on
+	* the boot path of every deployment — including the ones that never take a
+	* request. The first request pays for it.
+	*
+	* The result is cached even on failure: a store that cannot create its table
+	* must not retry the DDL on every request, which would turn one broken
+	* permission into a per-request query storm.
+	*
+	* Readiness is decided by reading the table, never by the DDL not throwing —
+	* `ensureObject` routes through `step`, which logs a failure and returns
+	* normally. Keying on the absence of an exception would report a table that
+	* was never created as ready, and every later request would fall into the
+	* per-request error path instead of the one-time fallback.
+	*/
+	async function ensureReady() {
+		if (!ready) ready = (async () => {
+			try {
+				await ddl.ensureObject("Creating schema rebase", "CREATE SCHEMA IF NOT EXISTS rebase");
+				await ddl.ensureObject(`Creating ${TABLE$1}`, `
+                        CREATE TABLE IF NOT EXISTS ${TABLE$1} (
+                            key TEXT NOT NULL,
+                            bucket BIGINT NOT NULL,
+                            hits INTEGER NOT NULL DEFAULT 0,
+                            expires_at TIMESTAMPTZ NOT NULL,
+                            PRIMARY KEY (key, bucket)
+                        )
+                    `);
+				await ddl.ensureObject("Creating idx_rate_limit_hits_expiry", `
+                        CREATE INDEX IF NOT EXISTS idx_rate_limit_hits_expiry
+                        ON ${TABLE$1}(expires_at)
+                    `);
+				const readable = await ddl.isReadable(TABLE$1);
+				if (readable) await ddl.step("Revoking end-user access to rate_limit_hits", () => exec(revokeInternalTableSql(SCHEMA, TABLE_NAME)));
+				else if (options.provision === false) logger.error(`[rate-limit] ${TABLE$1} does not exist, and this backend changes nothing in its database, so counts stay per-process. Every replica will enforce the limit independently until a provisioning run creates the table.`);
+				else logger.error("[rate-limit] The shared rate-limit table could not be created, so counts stay per-process. Every replica will enforce the limit independently.");
+				return readable;
+			} catch (err) {
+				logger.error("[rate-limit] Could not prepare the shared rate-limit table. Falling back to per-process counts for the life of this process.", { error: err instanceof Error ? err.message : String(err) });
+				return false;
+			}
+		})();
+		return ready;
+	}
+	function startSweeping() {
+		if (sweepTimer) return;
+		sweepTimer = setInterval(() => {
+			exec(`DELETE FROM ${TABLE$1} WHERE expires_at < now()`).catch((err) => {
+				logger.debug("[rate-limit] Bucket sweep failed", { error: err instanceof Error ? err.message : String(err) });
+			});
+		}, sweepMs);
+		sweepTimer.unref?.();
 	}
+	return {
+		ensureTable: ensureReady,
+		async hit(key, windowMs, limit) {
+			if (!await ensureReady()) return {
+				allowed: true,
+				remaining: limit,
+				retryAfterMs: 0
+			};
+			startSweeping();
+			const at = now();
+			const bucket = Math.floor(at / windowMs);
+			const carry = 1 - (at - bucket * windowMs) / windowMs;
+			const expiresAt = new Date((bucket + 2) * windowMs).toISOString();
+			let current;
+			let previous;
+			try {
+				const row = firstRow(await exec(`WITH bumped AS (
+                         INSERT INTO ${TABLE$1} AS r (key, bucket, hits, expires_at)
+                         VALUES ($1, $2, 1, $3)
+                         ON CONFLICT (key, bucket)
+                         DO UPDATE SET hits = r.hits + 1, expires_at = EXCLUDED.expires_at
+                         RETURNING hits
+                     )
+                     SELECT
+                         (SELECT hits FROM bumped) AS current,
+                         COALESCE((SELECT hits FROM ${TABLE$1} WHERE key = $1 AND bucket = $4), 0) AS previous`, { params: [
+					key,
+					bucket,
+					expiresAt,
+					bucket - 1
+				] }));
+				current = Number(row?.current ?? 1);
+				previous = Number(row?.previous ?? 0);
+			} catch (err) {
+				logger.debug("[rate-limit] Shared count unavailable for this request", { error: err instanceof Error ? err.message : String(err) });
+				return {
+					allowed: true,
+					remaining: limit,
+					retryAfterMs: 0
+				};
+			}
+			const estimate = current + previous * carry;
+			if (estimate > limit) {
+				exec(`UPDATE ${TABLE$1} SET hits = GREATEST(hits - 1, 0) WHERE key = $1 AND bucket = $2`, { params: [key, bucket] }).catch(() => {});
+				return {
+					allowed: false,
+					remaining: 0,
+					retryAfterMs: Math.max(0, (bucket + 1) * windowMs - at)
+				};
+			}
+			return {
+				allowed: true,
+				remaining: Math.max(0, Math.floor(limit - estimate)),
+				retryAfterMs: 0
+			};
+		},
+		dispose() {
+			if (sweepTimer) clearInterval(sweepTimer);
+			sweepTimer = void 0;
+		}
+	};
 }
+/**
+* The first row of whatever shape this driver returns.
+*
+* `SqlExec` declares an array of rows, but drivers in this repository have also
+* returned a `{ rows }` envelope through the same escape hatch. Reading one
+* shape only is how a store silently counts nothing and reports every caller as
+* being on their first request — a limiter that never limits, with no error
+* anywhere. Tolerating both costs one line.
+*/
+var firstRow = firstSqlRow;
 //#endregion
 //#region src/email/html.ts
 /**
@@ -1660,6 +1726,7 @@ function enforceCreationPasswordPolicy(body, resolvedHooks, options) {
 */
 async function prepareAdminUserValues(rawBody, ctx, options) {
 	const { resolvedHooks, collectionAuthConfig } = ctx;
+	if (rawBody.roles !== void 0 && rawBody.roles !== null) readRoleNames(rawBody.roles);
 	const body = enforceCreationPasswordPolicy(rawBody, resolvedHooks, options);
 	if (collectionAuthConfig?.onCreateUser) {
 		const collectionCtx = buildCollectionContext(ctx);
@@ -1822,1509 +1889,46 @@ async function normalizeUserEmailChange(authRepo, uid, email) {
 */
 function runAfterUserDelete(resolvedHooks, uid) {
 	if (!resolvedHooks.afterUserDelete) return;
-	resolvedHooks.afterUserDelete(uid).catch((err) => {
-		logger.error("[AuthHooks] afterUserDelete error", { error: err instanceof Error ? err.message : err });
-	});
-}
-/**
-* The auth adapter's side of user administration through the auth collection
-* (`AuthAdapter.prepareUserUpdates` and the deletion pair): the admin user
-* routes' rules and hooks, for the data API's writes to the same rows.
-*/
-function authCollectionUserAdmin(ctx) {
-	const { authRepo, resolvedHooks } = ctx;
-	return {
-		async prepareUserUpdates(updates) {
-			await assertRoleChangesAllowed(authRepo, updates.flatMap(({ uid, values }) => Array.isArray(values.roles) ? [{
-				uid,
-				roles: values.roles
-			}] : []));
-			const prepared = [];
-			for (const { uid, values } of updates) prepared.push(typeof values.email === "string" ? {
-				...values,
-				email: await normalizeUserEmailChange(authRepo, uid, values.email)
-			} : values);
-			return prepared;
-		},
-		async prepareUserDeletions(uids) {
-			await assertUserDeletionsAllowed(authRepo, uids);
-			if (resolvedHooks.beforeUserDelete) for (const uid of uids) await resolvedHooks.beforeUserDelete(uid);
-		},
-		async finalizeUserDeletions(uids) {
-			for (const uid of uids) {
-				await authRepo.deleteAllRefreshTokensForUser(uid);
-				runAfterUserDelete(resolvedHooks, uid);
-			}
-		}
-	};
-}
-//#endregion
-//#region src/auth/token-revocation.ts
-/**
-* Has this access token been revoked?
-*
-* Everything that ends every session a user holds — a password change or reset
-* of any kind, and `DELETE /auth/sessions` — goes through
-* {@link revokeAllSessions}, which stamps a `tokensValidAfter` watermark on the
-* user. It also deletes refresh-token rows, which is what made the gap easy to
-* miss: the session really is gone, and the *refresh* path really does check
-* the watermark — so signing out looked like it worked.
-*
-* The access token was untouched. It is a bearer credential that nothing
-* consulted a database about, so it stayed valid for its full lifetime after
-* every one of those actions. "Sign out everywhere" left the stolen token
-* working; so did changing your password because you thought it had leaked.
-*
-* The watermark had exactly one read in the repository, on refresh. This adds
-* the other one.
-*
-* ## Cost
-*
-* One indexed lookup per request, on the paths that already make one. The
-* adapter re-reads roles for every authenticated request; the admin routes now
-* do too. Both call this with the row they were already fetching in mind — a
-* repository that wants to serve both from one query is free to cache
-* internally, but nothing here assumes it.
-*
-* ## Failure
-*
-* Fails **open**, deliberately, and this is the one place in the auth stack
-* where that is right. The watermark is an extra revocation signal layered over
-* a token that has already been verified — signature, expiry and purpose all
-* checked. Refusing every request when the database is unreachable would turn a
-* transient outage into a total sign-out of an entire deployment, and the
-* attacker this protects against needs to have already stolen a live token. The
-* failure is logged at warn so it is visible rather than silent.
-*/
-async function isAccessTokenRevoked(authRepo, payload) {
-	if (typeof authRepo.getTokensValidAfter !== "function") return false;
-	if (typeof payload.iat !== "number") return false;
-	let validAfter;
-	try {
-		validAfter = await authRepo.getTokensValidAfter(payload.uid);
-	} catch (error) {
-		logger.warn("[Auth] Could not read the token revocation watermark; allowing the request", {
-			uid: payload.uid,
-			error
-		});
-		return false;
-	}
-	return issuedBefore(payload, validAfter);
-}
-/**
-* Is the account behind this verified access token still the one that may use
-* it — and with which roles?
-*
-* A verified signature says who the token was minted for, an hour ago at
-* most. This asks the database what has happened to that account since. Every
-* door that honours an access token — the data plane, the admin gates, the
-* realtime socket — asks it here, so they cannot disagree about it.
-*
-* They did. A deleted account read as "not revoked": the watermark lives on
-* the user row, so once the row was gone there was no watermark, and the
-* roles lookup answered `[]` rather than "nobody". A token its owner had
-* revoked came back to life when an administrator deleted the account, as an
-* authenticated principal with that uid, for the rest of its lifetime. MCP
-* refresh and personal API keys already treated a missing account as revoked;
-* the main door did not.
-*
-* Throws when the repository does. Unlike the watermark read on its own, this
-* one decides the roles a request runs with, so a failure is a refusal (the
-* callers answer 503) rather than a guess.
-*
-* Except one failure that is an answer: the store refusing the uid as a value
-* its id column cannot hold — `u1` against a UUID key. That names no account,
-* exactly as a well-formed id nobody has does, so it is `account-deleted` and
-* the caller answers 401. Answered as a failure it was a 503 asking the
-* client to try again, which it would do forever.
-*/
-async function judgeAccessToken(authRepo, payload) {
-	try {
-		return await readAccessVerdict(authRepo, payload);
-	} catch (error) {
-		if (isDataException(error)) return {
-			live: false,
-			refusal: "account-deleted"
-		};
-		throw error;
-	}
-}
-async function readAccessVerdict(authRepo, payload) {
-	let roles;
-	let validAfter = null;
-	if (typeof authRepo.getAccountAccessState === "function") {
-		const state = await authRepo.getAccountAccessState(payload.uid, payload.sid);
-		if (!state) return {
-			live: false,
-			refusal: "account-deleted"
-		};
-		if (state.disabled) return {
-			live: false,
-			refusal: "account-disabled"
-		};
-		roles = state.roles;
-		validAfter = state.tokensValidAfter;
-		if (payload.sid && state.sessionActive === false) return {
-			live: false,
-			refusal: "session-revoked"
-		};
-	} else {
-		if (typeof authRepo.getUserWithRoles === "function") {
-			const account = await authRepo.getUserWithRoles(payload.uid);
-			if (!account) return {
-				live: false,
-				refusal: "account-deleted"
-			};
-			if (account.user.disabled) return {
-				live: false,
-				refusal: "account-disabled"
-			};
-			roles = account.roles;
-		}
-		if (typeof authRepo.getTokensValidAfter === "function") validAfter = await authRepo.getTokensValidAfter(payload.uid);
-	}
-	if (issuedBefore(payload, validAfter)) return {
-		live: false,
-		refusal: "revoked"
-	};
-	return {
-		live: true,
-		roles
-	};
-}
-/**
-* The 401 a door answers an access token with when {@link judgeAccessToken}
-* refuses it — one wording and one code for each reason, wherever the token
-* was presented.
-*
-* `SESSION_REVOKED` for a token whose session or account is gone: the client
-* SDK answers it with a refresh, which the refresh route refuses for the same
-* reason, and the client signs out. `ACCOUNT_DISABLED` for an account an
-* administrator switched off, which no refresh can mend.
-*/
-function accessTokenRefusalError(refusal) {
-	switch (refusal) {
-		case "account-disabled": return ApiError.unauthorized("This account has been disabled", "ACCOUNT_DISABLED");
-		case "account-deleted": return ApiError.unauthorized("This account no longer exists", "SESSION_REVOKED");
-		case "revoked":
-		case "session-revoked": return ApiError.unauthorized("Session has been revoked", "SESSION_REVOKED");
-	}
-}
-/** The watermark comparison {@link isAccessTokenRevoked} and the judge share. */
-function issuedBefore(payload, validAfter) {
-	if (!validAfter || typeof payload.iat !== "number") return false;
-	return payload.iat < Math.floor(validAfter.getTime() / 1e3);
-}
-/**
-* End every session this user holds, on every device.
-*
-* Two writes, because each covers what the other cannot. Deleting the refresh
-* rows ends the sessions that exist at this instant, and on a repository
-* without the watermark it is the only revocation there is. The watermark
-* voids what the delete cannot see: a refresh already in flight that inserts
-* its rotated token a moment after the delete ran, and every access token
-* already handed out, which {@link isAccessTokenRevoked} refuses from here on.
-*
-* The watermark write does not fail the caller. By the time it runs the
-* credential has usually already changed and the rows are gone, so a 500 would
-* tell someone their password did not change when it did. It is logged, because
-* a failure here leaves access tokens working until they expire.
-*/
-async function revokeAllSessions(authRepo, uid) {
-	await authRepo.deleteAllRefreshTokensForUser(uid);
-	try {
-		await authRepo.setTokensValidAfter?.(uid, /* @__PURE__ */ new Date());
-	} catch (error) {
-		logger.warn("[Auth] Could not write the token revocation watermark; access tokens issued before now stay valid until they expire", {
-			uid,
-			error
-		});
-	}
-}
-/**
-* Replace a user's password and end every session they hold.
-*
-* The one way a password hash is written over an existing account. A new
-* password is what someone sets when they believe the old one — or a session
-* signed in with it — is in someone else's hands, so a password change that
-* leaves those sessions alive does not do the thing it was done for.
-*
-* It used to be a pair of lines repeated after each `updatePassword`, and it
-* reached the two self-service routes and none of the admin ones: an
-* administrator resetting a phished account left the attacker's refresh token
-* minting access tokens for the rest of its lifetime.
-* `test/password-change-revokes-sessions.test.ts` holds every route that sets a
-* password to this, and fails if anything but this function calls
-* `updatePassword`.
-*
-* `null` removes the password instead, for the same reason and with the same
-* revocation: see `confirmAddressOwnership`.
-*/
-async function replaceUserPassword(authRepo, uid, passwordHash) {
-	await authRepo.updatePassword(uid, passwordHash);
-	await revokeAllSessions(authRepo, uid);
-	await authRepo.deleteAllPasswordResetTokensForUser?.(uid);
-}
-//#endregion
-//#region src/auth/rls-scope.ts
-var import_jsonwebtoken = /* @__PURE__ */ __toESM(require_jsonwebtoken(), 1);
-/**
-* The identity the trusted server plane runs as: `rebase.dataAsAdmin`, and any
-* caller presenting the service key.
-*
-* Naming it makes the privilege legible, because it is narrower than it reads.
-* This is **not** an RLS bypass — a driver scoped with it is an
-* `AuthenticatedPostgresBackendDriver`, so every statement runs in a
-* transaction that has done `SET LOCAL ROLE rebase_user` with
-* `app.uid = 'service'`, and policies are evaluated. Two consequences worth
-* knowing before you write a policy:
-*
-* - It passes the default policies through their `rolesOverlap(['admin'])`
-*   arm — the same arm an application user holding the `admin` role passes.
-* - `policy.serverContext()` compiles to `rebase.uid() IS NULL` and is therefore
-*   **false** for it. A collection with `disableDefaultPolicies: true` whose
-*   only rule is `serverContext()` denies these writes (42501) and returns
-*   zero rows for these reads.
-*
-* The true bypass is `rebase.sql()`, which runs on the owner connection and
-* never goes near `withAuth`.
-*/
-var SERVICE_IDENTITY = {
-	uid: "service",
-	roles: ["admin"]
-};
-/**
-* Returns true if the driver supports RLS scoping via `withAuth()`.
-*/
-function isRLSScopedDriver(driver) {
-	return "withAuth" in driver && typeof driver.withAuth === "function";
-}
-/**
-* Can this driver run a request as a specific user?
-*
-* The same question `scopeDataDriver` asks internally, exported because one
-* caller must act on the answer BEFORE it has a request to scope.
-*
-* `scopeDataDriver` returns the driver unscoped when the answer is no, which is
-* the right behaviour for `/api/data` — Mongo has no row-level security and
-* never claimed to, and the route's own checks still apply. It is the wrong
-* behaviour for a surface whose entire promise is "this runs as you": there,
-* an unscoped driver silently means "runs as the database owner". So the MCP
-* surface asks this at boot and declines to mount rather than degrade.
-*/
-function supportsRlsScoping(driver) {
-	return isRLSScopedDriver(driver);
-}
-/**
-* Scope a DataDriver via `withAuth()` for RLS.
-*
-* SECURITY: If `withAuth()` is available but fails, the error is re-thrown
-* so the request is **denied** rather than proceeding with unscoped access
-* (fail-closed behavior).
-*
-* If the driver does not support RLS, the original driver is returned.
-*
-* @param driver - The DataDriver to scope.
-* @param user   - The authenticated user identity for RLS.
-* @returns The RLS-scoped DataDriver (or the original if RLS is unsupported).
-*/
-async function scopeDataDriver(driver, user) {
-	if (isRLSScopedDriver(driver)) return await driver.withAuth(user);
-	return driver;
-}
-//#endregion
-//#region src/auth/crypto-utils.ts
-/**
-* Cryptographic utility functions for auth.
-*
-* @module
-*/
-/**
-* Constant-time string comparison to prevent timing attacks.
-*
-* Used for comparing service keys, tokens, and other secrets where
-* timing side-channels could leak information about the expected value.
-*
-* The implementation lives in `utils/portable-crypto.ts`, which does this over
-* UTF-8 bytes without `node:crypto` — this function is on the request path, and
-* the byte-level reasoning it depends on is documented there.
-*
-* @param a - First string to compare.
-* @param b - Second string to compare.
-* @returns `true` if the strings are identical, `false` otherwise.
-*/
-function safeCompare(a, b) {
-	return constantTimeEqual(a, b);
-}
-//#endregion
-//#region src/auth/bearer-token.ts
-/**
-* Parsing of the `Authorization: Bearer <token>` header.
-*
-* Its own module rather than a helper inside `middleware.ts`, because the
-* API-key middleware needs it too and `middleware.ts` already imports from
-* there — putting it in either one would close an import cycle.
-*
-* @module
-*/
-/**
-* Pull the token out of an `Authorization: Bearer <token>` header.
-*
-* RFC 7235 §2.1 makes the auth-scheme name case-insensitive, and plenty of
-* clients send `bearer` — HTTP libraries that lower-case what they emit,
-* hand-written curl, proxies that normalise headers. Matching `"Bearer "`
-* exactly turned those into a 401 that, from the caller's side, is
-* indistinguishable from a rejected token; people spend an afternoon
-* regenerating credentials that were fine. Only the scheme is folded — the
-* token itself is returned byte-for-byte.
-*
-* Returns `undefined` when there is no header or it names another scheme.
-* That is deliberately distinct from an empty token (`Bearer ` with nothing
-* after it), which callers still route into verification so it fails as a bad
-* token rather than as a missing header.
-*/
-function extractBearerToken(authHeader) {
-	if (!authHeader) return void 0;
-	const separator = authHeader.indexOf(" ");
-	if (separator < 0) return void 0;
-	if (authHeader.slice(0, separator).toLowerCase() !== "bearer") return void 0;
-	return authHeader.slice(separator + 1);
-}
-//#endregion
-//#region src/auth/access.ts
-/**
-* How a personal key finds its owner in an account store: the account as it
-* is now — a missing or disabled one is no owner — and its roles.
-*
-* One read where the store answers both at once: `getAccountAccessState`, the
-* statement every access token is already judged against, which reads roles
-* and `disabled_at` together. Otherwise the account, then its roles — the two
-* reads this always made, one round trip more per request.
-*/
-function keyOwnerResolverFor(repo) {
-	if (typeof repo.getAccountAccessState === "function") {
-		const readAccount = repo.getAccountAccessState.bind(repo);
-		return async (uid) => {
-			const account = await readAccount(uid);
-			if (!account || account.disabled) return null;
-			return { roles: account.roles };
-		};
-	}
-	return async (uid) => {
-		const user = await repo.getUserById(uid);
-		if (!user || user.disabled) return null;
-		return { roles: await repo.getUserRoleIds(uid) };
-	};
-}
-/**
-* What the module-level API answers for: {@link getAccessModel},
-* {@link getKeyOwnerResolver}, and every scope check on a route mounted
-* outside any backend. Built-ins only until {@link configureAccess} or a
-* backend installed as the process default sets it.
-*/
-var processAccess = { model: EMPTY_ACCESS_MODEL };
-/** The process default's access model. Built-ins only until one is configured. */
-function getAccessModel() {
-	return processAccess.model;
-}
-/**
-* Set the process default's access model, and — when the app enables
-* `auth.personalKeys` and has an account store to read owners from — how
-* personal keys find their owner. For a test, or a server wired by hand that
-* uses the module-level API; a backend built by `createRebaseBackend` carries
-* its own.
-*/
-function configureAccess(options) {
-	processAccess = {
-		model: options.model,
-		resolveKeyOwner: options.resolveKeyOwner
-	};
-}
-/** @internal See {@link defaultAccessControl}. */
-function setDefaultAccessControl(access) {
-	processAccess = access;
-}
-/**
-* The process default as an {@link AccessControl} that follows it — what a
-* route or a key check built outside any backend falls back to.
-*/
-var processAccessControl = {
-	get model() {
-		return processAccess.model;
-	},
-	get resolveKeyOwner() {
-		return processAccess.resolveKeyOwner;
-	}
-};
-/**
-* The access control serving this request: the backend's whose route group is
-* answering it, or the process default for a route mounted outside any.
-*/
-function accessOf(c) {
-	return c.get("services")?.access ?? processAccessControl;
-}
-/** The resource names Rebase's own scopes use; an app scope may not reuse one. */
-var BUILT_IN_RESOURCES = new Set(BUILT_IN_SCOPES.map((scope) => scope.slice(0, scope.indexOf(":"))));
-/** A declaration the access model cannot be built from. Fails the boot. */
-var AccessModelError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "AccessModelError";
-	}
-};
-/**
-* Build the access model from the users collection's `auth` block, refusing
-* anything that would read as a grant it is not.
-*
-* - `admin` may not be declared: it is built in and holds everything, and a
-*   declaration would either repeat that or quietly narrow it.
-* - An app scope may not reuse a built-in resource name (`logs:export`): the
-*   built-in resources are Rebase's, and a reader of `logs:*` should not have
-*   to know which half is whose.
-* - A role may not list a data-plane scope: a person's data access is the
-*   collection's `securityRules`, so `data:write` on a role would grant nothing
-*   and look like it granted something.
-*/
-function accessModelFromCollections(collections) {
-	const authCollection = collections.find((collection) => {
-		const auth = collection.auth;
-		return auth === true || !!auth && typeof auth === "object" && auth.enabled === true;
-	});
-	const auth = authCollection && typeof authCollection.auth === "object" ? authCollection.auth : void 0;
-	const declaredScopes = { ...auth?.scopes ?? {} };
-	const declaredRoles = { ...auth?.roles ?? {} };
-	const where = `the "${authCollection?.slug ?? "users"}" collection's auth block`;
-	for (const [name, definition] of Object.entries(declaredScopes)) {
-		const parsed = parseScope(name);
-		if (!parsed || parsed.target !== void 0) throw new AccessModelError(`auth.scopes: "${name}" in ${where} is not a scope name. Name scopes resource:action, lower-case, without a target — for example "project:deploy".`);
-		const resource = name.slice(0, name.indexOf(":"));
-		if (BUILT_IN_RESOURCES.has(resource)) throw new AccessModelError(`auth.scopes: "${name}" in ${where} uses the built-in resource "${resource}". App scopes need their own resource name; the built-in ones are ${[...BUILT_IN_RESOURCES].join(", ")}.`);
-		if (typeof definition?.label !== "string" || definition.label.trim() === "") throw new AccessModelError(`auth.scopes: "${name}" in ${where} needs a label — it is what a person granting it reads.`);
-	}
-	const model = {
-		roles: declaredRoles,
-		scopes: declaredScopes
-	};
-	for (const [role, definition] of Object.entries(declaredRoles)) {
-		if (role === "admin") throw new AccessModelError(`auth.roles: "admin" in ${where} is built in — it holds every scope — and cannot be declared. Declare a role with another name for a narrower set.`);
-		if (!Array.isArray(definition?.scopes)) throw new AccessModelError(`auth.roles: "${role}" in ${where} needs a scopes list.`);
-		const dataPlane = definition.scopes.filter((scope) => isDataPlaneScope(parseScope(scope)?.scope ?? ""));
-		if (dataPlane.length > 0) throw new AccessModelError(`auth.roles: "${role}" in ${where} lists ${dataPlane.join(", ")}. Every signed-in person already holds the data plane; what they may do with rows is the collection's securityRules. List admin-plane and app scopes only.`);
-		const problems = validateScopes(definition.scopes, model);
-		if (problems.length > 0) throw new AccessModelError(`auth.roles: "${role}" in ${where} lists ${problems.map((p) => `"${p.scope}" (${p.reason})`).join(", ")}. Role scopes are ${ADMIN_SCOPES.join(", ")} and the app's own auth.scopes.`);
-	}
-	return model;
-}
-/** Narrow a context's user to the roles it carries. */
-function rolesOf(user) {
-	if (typeof user !== "object" || user === null || !("roles" in user)) return [];
-	const roles = user.roles;
-	return Array.isArray(roles) ? roles.filter((role) => typeof role === "string") : [];
-}
-/**
-* Everything the caller of this request may do. Empty for a request with no
-* caller.
-*/
-function callerScopes(c) {
-	const narrowed = c.get("scopes");
-	if (narrowed) return narrowed;
-	const user = c.get("user");
-	if (!user) return [];
-	return scopesForRoles(rolesOf(user), accessOf(c).model);
-}
-/**
-* Whether this request's caller holds the `admin` role. The service key signs
-* in as one.
-*/
-function callerIsAdmin(c) {
-	return hasAdminRole(rolesOf(c.get("user")));
-}
-/** Does this request's caller hold `scope`, on `target` when one is given? */
-function hasScope(c, scope, target) {
-	return scopeGrants(callerScopes(c), scope, target);
-}
-/**
-* The refusal for a missing scope, worded for whoever is holding the
-* credential. `details.requiredScope` names it for clients that branch.
-*/
-function scopeMissing(c, scope, target) {
-	const wanted = target !== void 0 ? `${scope}:${target}` : scope;
-	return new ApiError(403, "SCOPE_MISSING", c.get("apiKey") !== void 0 ? `This API key does not hold the "${wanted}" scope. Create a key that includes it.` : c.get("scopes") ? `This token does not hold the "${wanted}" scope. Reconnect and grant it.` : `Your account does not hold the "${wanted}" scope. A role that lists it (auth.roles on the users collection) grants it; the admin role holds every scope.`, { requiredScope: wanted });
-}
-/**
-* Refuse a request whose caller does not hold `scope`.
-*
-* `scope` is a built-in scope or one this backend declares under
-* `auth.scopes`. A name no caller could ever hold — not a scope name, a typo
-* of a built-in one (`data:raed`) — throws as the route is registered; an app
-* scope the backend answering does not declare is answered
-* `500 SCOPE_NOT_DECLARED`, naming the declaration to add.
-*
-* `target` narrows the check to one collection, bucket, function or app
-* resource, and may be read from the request. A guard, not an authenticator:
-* it judges the caller an auth middleware identified, so mount it after one —
-* `requireAuth`, or a route group's own. A request with no caller is refused
-* as unauthenticated, not as unscoped.
-*
-* @example
-* ```ts
-* app.post("/deploy/:project", requireAuth, requireScope("project:deploy", c => c.req.param("project")), handler);
-* ```
-*/
-function requireScope(scope, target) {
-	const problem = scopeGuardProblem(scope, typeof target === "string" ? target : void 0);
-	if (problem) throw new Error(problem);
-	return async (c, next) => {
-		if (!c.get("user")) return refuse(c, noCallerRefusal(c));
-		const undeclared = scopeGuardProblem(scope, void 0, Object.keys(accessOf(c).model.scopes));
-		if (undeclared) return refuse(c, new ApiError(500, "SCOPE_NOT_DECLARED", undeclared));
-		const resolvedTarget = typeof target === "function" ? target(c) : target;
-		if (!hasScope(c, scope, resolvedTarget)) return refuse(c, scopeMissing(c, scope, resolvedTarget));
-		return next();
-	};
-}
-/**
-* The 401 for a guard that found no caller.
-*
-* A request that sent a credential, on a route where no auth middleware ran —
-* it sets `driver` for every caller, anonymous included — never had that
-* credential read. "Authentication required" sends whoever holds a valid
-* session to check it, so this names the wiring instead.
-*/
-function noCallerRefusal(c) {
-	if (c.req.header("authorization") !== void 0 && c.get("driver") === void 0) return ApiError.unauthenticated("Authentication required: this request carries a credential, but nothing on this route verified it. requireScope judges the caller an auth middleware identified; put requireAuth in front of it — app.post(path, requireAuth, requireScope(scope), handler).");
-	return ApiError.unauthenticated("Authentication required");
-}
-/**
-* Refuse a request unless its caller holds the scope for its HTTP method:
-* `read` for GET and HEAD, `write` for everything else. For an admin surface
-* whose reads and writes split exactly along the method.
-*/
-function requireScopeByMethod(scopes) {
-	const read = requireScope(scopes.read);
-	const write = requireScope(scopes.write);
-	return async (c, next) => {
-		const method = c.req.method.toUpperCase();
-		return (method === "GET" || method === "HEAD" ? read : write)(c, next);
-	};
-}
-/**
-* What a set of roles holds beyond this request's caller — the scopes, plus
-* `admin` itself when the roles include it and the caller does not hold it.
-* Empty when the caller covers every one.
-*
-* `admin` is named separately because it is more than its scopes: it is the
-* RLS role that reads every row, so a role listing every admin-plane scope
-* still cannot hand it out.
-*/
-function beyondCaller(c, roles) {
-	const beyond = scopesBeyond(scopesForRoles(roles, accessOf(c).model), callerScopes(c));
-	if (hasAdminRole(roles) && !hasAdminRole(rolesOf(c.get("user")))) beyond.unshift(ADMIN_ROLE);
-	return beyond;
-}
-/**
-* Refuse to let the caller act on an account — edit it, reset its password,
-* delete it — when that account holds anything the caller does not.
-*
-* `users:write` is the scope that lets a support role manage accounts, and
-* without this it would also let that role reset an administrator's password
-* and sign in as them.
-*/
-function assertMayManageAccount(c, targetRoles) {
-	const beyond = beyondCaller(c, targetRoles);
-	if (beyond.length > 0) throw new ApiError(403, "ACCOUNT_OUTRANKS_CALLER", `This account holds ${beyond.join(", ")}, which you do not, so you cannot change it.`, { beyond });
-}
-/** Refuse to let the caller grant roles that hold anything the caller does not. */
-function assertMayGrantRoles(c, roles) {
-	const beyond = beyondCaller(c, roles);
-	if (beyond.length > 0) throw new ApiError(403, "ROLE_EXCEEDS_CALLER", `These roles hold ${beyond.join(", ")}, which you do not, so you cannot grant them.`, { beyond });
-}
-//#endregion
-//#region src/auth/api-keys/api-key-middleware.ts
-/**
-* Check whether a token looks like a Rebase API key.
-*/
-function isApiKeyToken(token) {
-	return token.startsWith("rk_");
-}
-/**
-* Verify a presented key: it exists, is live, and — for a personal key —
-* personal keys are on and its owner still exists. Records the use.
-*
-* `access` is the backend the key belongs to: whether it takes personal keys,
-* how it finds their owners, and what their roles hold. The process default
-* when omitted.
-*/
-async function resolveApiKey(store, token, access = processAccessControl) {
-	const apiKey = await store.findByKeyHash(await sha256Hex(token));
-	if (!apiKey) return { message: "Invalid API key" };
-	if (apiKey.revoked_at) return { message: "API key has been revoked" };
-	if (apiKey.expires_at && new Date(apiKey.expires_at) < /* @__PURE__ */ new Date()) return { message: "API key has expired" };
-	let identity;
-	if (apiKey.kind === "personal") {
-		const resolveOwner = access.resolveKeyOwner;
-		if (!resolveOwner || !apiKey.owner_uid) return { message: "Personal API keys are switched off on this backend" };
-		const owner = await resolveOwner(apiKey.owner_uid);
-		if (!owner) return { message: "The account this API key acts as no longer exists" };
-		identity = {
-			uid: apiKey.owner_uid,
-			roles: owner.roles,
-			scopes: intersectScopes(apiKey.scopes, scopesForRoles(owner.roles, access.model))
-		};
-	} else identity = {
-		uid: `api-key:${apiKey.id}`,
-		roles: ["service", ...apiKey.roles.filter((role) => role !== "service")],
-		scopes: apiKey.scopes
-	};
-	const lastTouch = lastUsedTouchedAt.get(apiKey.id);
-	const now = Date.now();
-	if (!lastTouch || now - lastTouch >= LAST_USED_DEBOUNCE_MS) {
-		lastUsedTouchedAt.set(apiKey.id, now);
-		store.updateLastUsed(apiKey.id).catch(() => {});
-	}
-	const masked = {
-		id: apiKey.id,
-		name: apiKey.name,
-		kind: apiKey.kind,
-		key_prefix: apiKey.key_prefix,
-		scopes: apiKey.scopes,
-		roles: apiKey.roles,
-		owner_uid: apiKey.owner_uid,
-		rate_limit: apiKey.rate_limit,
-		created_by: apiKey.created_by,
-		created_at: apiKey.created_at,
-		updated_at: apiKey.updated_at,
-		last_used_at: apiKey.last_used_at,
-		expires_at: apiKey.expires_at,
-		revoked_at: apiKey.revoked_at
-	};
-	return {
-		...identity,
-		apiKey: masked
-	};
-}
-/** Per-process debounce state for last_used_at touches. */
-var lastUsedTouchedAt = /* @__PURE__ */ new Map();
-var LAST_USED_DEBOUNCE_MS = 6e4;
-/**
-* Validate an API key token and populate the Hono context: `user`, `apiKey`,
-* `scopes` and the RLS-scoped `driver`.
-*
-* Returns `true` when the context is populated, or the error Response.
-*/
-async function validateApiKey(c, token, options) {
-	const resolved = await resolveApiKey(options.store, token, accessOf(c));
-	if (!("uid" in resolved)) return errorHandler(ApiError.unauthenticated(resolved.message), c);
-	c.set("user", {
-		uid: resolved.uid,
-		roles: resolved.roles
-	});
-	c.set("apiKey", resolved.apiKey);
-	c.set("scopes", resolved.scopes);
-	try {
-		c.set("driver", await scopeDataDriver(options.driver, {
-			uid: resolved.uid,
-			roles: resolved.roles
-		}));
-	} catch (error) {
-		logger.error("[AUTH] RLS scoping failed for API key", { error });
-		return errorHandler(ApiError.internal("Internal authentication error"), c);
-	}
-	return true;
-}
-/**
-* The 403 for a credential that lacks a data-plane scope outside the REST
-* generator (storage and functions). Names the scope that would grant it.
-*/
-function forbidScope(c, scope, target) {
-	const wanted = target !== void 0 && target !== "" ? `${scope}:${target}` : scope;
-	return errorHandler(new ApiError(403, "SCOPE_MISSING", `This credential does not hold the "${wanted}" scope.`, { requiredScope: wanted }), c);
-}
-/** Whether this request's caller holds `scope` — on `target` when given. */
-function callerHolds(c, scope, target) {
-	const narrowed = c.get("scopes");
-	if (!narrowed) return true;
-	return target === void 0 ? scopeGrantsAny(narrowed, scope) : scopeGrants(narrowed, scope, target);
-}
-/**
-* Scope guard for the resumable-upload routes (`/tus/:id`).
-*
-* Every step of an upload — the offset check (HEAD), the chunks (PATCH), the
-* cancel (DELETE) — is part of writing it, so all of them need
-* `storage:write`. Which source the upload writes to was checked when it was
-* created; these steps only reach an upload the same caller owns.
-*/
-function createTusScopeGuard() {
-	return async (c, next) => {
-		if (/\/tus\/[^/]+$/.test(c.req.path) && c.get("user") && !callerHolds(c, "storage:write")) return forbidScope(c, "storage:write");
-		return next();
-	};
-}
-/**
-* Scope guard for the custom-functions router: a narrowed credential needs
-* `functions:invoke` on the function it calls. The functions index — the
-* listing at the mount point itself — needs the unqualified scope.
-*
-* People pass: what a person may do inside a function is the function's own
-* business, as it always was.
-*
-* @param mountPrefix - The path the functions router is mounted at
-*                      (e.g. `/api/functions`), used to extract the function
-*                      name from the request path. Omitted, it is the
-*                      `mountPath` the functions group recorded for this
-*                      request — wherever the application mounted it.
-*/
-function createFunctionScopeGuard(mountPrefix) {
-	return async (c, next) => {
-		const narrowed = c.get("scopes");
-		if (!narrowed) return next();
-		const path = c.req.path;
-		const prefix = mountPrefix ?? c.get("mountPath") ?? "";
-		const idx = path.indexOf(prefix);
-		const rawName = (idx < 0 ? "" : path.slice(idx + prefix.length)).split("/").filter(Boolean)[0] ?? "";
-		let functionName;
-		try {
-			functionName = decodeURIComponent(rawName);
-		} catch {
-			functionName = rawName;
-		}
-		if (!(functionName === "" ? scopeGrants(narrowed, "functions:invoke") : scopeGrants(narrowed, "functions:invoke", functionName))) return forbidScope(c, "functions:invoke", functionName);
-		return next();
-	};
-}
-/**
-* Pre-auth middleware for `rk_` bearer tokens.
-*
-* Routers whose auth gate is JWT-based (`createRequireAuth` — the admin
-* surfaces, the key routes) don't know about API keys. Mounted in front of
-* them, this authenticates `rk_` tokens and populates the request context; the
-* downstream gates then see the already-resolved caller and check its scopes.
-*
-* Requests without an `rk_` bearer token pass through untouched. An invalid,
-* revoked, or expired `rk_` token is rejected here (401) rather than falling
-* through to be misparsed as a JWT.
-*/
-function createApiKeyPreAuth(options) {
-	return async (c, next) => {
-		if (c.get("apiKey")) return next();
-		const token = extractBearerToken(c.req.header("authorization")) ?? "";
-		if (!token || !isApiKeyToken(token)) return next();
-		const result = await validateApiKey(c, token, options);
-		if (result !== true) return result;
-		return next();
-	};
-}
-//#endregion
-//#region src/auth/impersonation.ts
-var ADMIN_ONLY = "Only a signed-in administrator can run a request as another user.";
-var NOT_A_PERSON = {
-	"api-key": {
-		reason: "api-key",
-		message: "An API key cannot run a request as another user. Send it with an administrator's session instead."
-	},
-	"service-key": {
-		reason: "service-key",
-		message: "The service key cannot run a request as another user. Send it with an administrator's session instead."
-	},
-	none: {
-		reason: "anonymous",
-		message: ADMIN_ONLY
-	}
-};
-/**
-* Decide whether this caller may act as the user they named, and who that
-* user is now.
-*
-* The one decision both doors take — the HTTP data plane through
-* {@link applyImpersonation}, the realtime socket at `AUTHENTICATE` and before
-* every frame after it. The caller is judged before the named user is looked
-* up, so the answer to a caller who may not impersonate says nothing about
-* whether the uid exists.
-*
-* Throws when a lookup fails: that is not an answer about anyone, and each
-* door refuses it its own way.
-*/
-async function decideImpersonation(request) {
-	const { credential, caller, resolveUser, audit } = request;
-	const targetUid = request.requestedUid.trim();
-	const refuse = (reason, error) => {
-		if (audit) logger.warn("[Security Audit] Refused a request to act as another user", {
-			eventType: "auth.impersonation.refused",
-			reason,
-			callerUid: caller?.uid,
-			requestedUid: targetUid,
-			...audit
-		});
-		return { refused: error };
-	};
-	if (targetUid === "") return refuse("malformed", ApiError.badRequest(`The ${IMPERSONATE_HEADER} header names no user. Send the uid of the user to act as, or leave the header out.`, "IMPERSONATION_INVALID"));
-	if (credential !== "session") {
-		const { reason, message } = NOT_A_PERSON[credential];
-		return refuse(reason, ApiError.forbidden(message, "IMPERSONATION_FORBIDDEN"));
-	}
-	if (!caller || !hasAdminRole(caller.roles)) return refuse("not-admin", ApiError.forbidden(ADMIN_ONLY, "IMPERSONATION_FORBIDDEN"));
-	if (!resolveUser) return refuse("unavailable", new ApiError(501, "IMPERSONATION_UNAVAILABLE", "This backend's auth cannot run a request as another user: its auth adapter does not implement resolveUser."));
-	const self = await resolveUser(caller.uid);
-	if (!self || !hasAdminRole(self.roles)) return refuse("not-admin", ApiError.forbidden(ADMIN_ONLY, "IMPERSONATION_FORBIDDEN"));
-	const target = await resolveUser(targetUid);
-	if (!target) return refuse("unknown-target", ApiError.notFound(`No active user has the id "${targetUid}", so there is nobody to run this request as.`, "IMPERSONATION_TARGET_NOT_FOUND"));
-	if (audit) logger.info("[Security Audit] Ran a request as another user", {
-		eventType: "auth.impersonation",
-		impersonatorUid: caller.uid,
-		targetUid: target.uid,
-		targetRoles: target.roles,
-		...audit
-	});
-	return {
-		granted: target,
-		impersonator: caller.uid
-	};
-}
-/** The caller the auth middleware put on the context, narrowed. */
-function callerOf(c) {
-	const user = c.get("user");
-	if (typeof user !== "object" || user === null) return void 0;
-	const uid = "uid" in user && typeof user.uid === "string" && user.uid !== "" ? user.uid : void 0;
-	if (uid === void 0) return void 0;
-	return {
-		uid,
-		roles: "roles" in user && Array.isArray(user.roles) ? user.roles.filter((role) => typeof role === "string") : []
-	};
-}
-/**
-* Honour or refuse this request's {@link IMPERSONATE_HEADER}.
-*
-* Called by the data-plane auth middlewares once the caller is on the context
-* and its driver is scoped. When the header names a user the caller may act
-* as, the context's `user` and `driver` are replaced with that user's and
-* `impersonator` names the caller.
-*
-* @returns The refusal to send, or `undefined` to carry on — as the caller
-*          when the header is absent, as the named user when it was granted.
-*/
-async function applyImpersonation(c, { credential, driver, resolveUser }) {
-	const requested = c.req.header(IMPERSONATE_HEADER);
-	if (requested === void 0) return void 0;
-	const caller = callerOf(c);
-	let decision;
-	try {
-		decision = await decideImpersonation({
-			requestedUid: requested,
-			credential,
-			caller,
-			resolveUser,
-			audit: {
-				door: "http",
-				method: c.req.method,
-				path: c.req.path,
-				requestId: c.get("requestId")
-			}
-		});
-	} catch (error) {
-		return errorHandler(error instanceof Error ? error : new Error(String(error)), c);
-	}
-	if ("refused" in decision) return errorHandler(decision.refused, c);
-	const target = decision.granted;
-	const isAnonymous = target.isAnonymous === true;
-	c.set("user", {
-		uid: target.uid,
-		email: target.email,
-		roles: target.roles,
-		isAnonymous
-	});
-	c.set("impersonator", { uid: decision.impersonator });
-	try {
-		c.set("driver", await scopeDataDriver(driver, {
-			uid: target.uid,
-			roles: target.roles,
-			isAnonymous,
-			...target.claims ? { claims: target.claims } : {}
-		}));
-	} catch (error) {
-		logger.error("[AUTH] RLS scoping failed for an impersonated request", { error });
-		return errorHandler(ApiError.internal("Internal authentication error"), c);
-	}
-}
-/**
-* Refuse {@link IMPERSONATE_HEADER} on every route that does not honour it.
-*
-* Only the data API and custom functions run a request as another user; the
-* rest — storage, auth, the admin surfaces — authenticate the caller and
-* ignore the header. Ignored, a request asking to act as B would be answered
-* as the administrator who sent it, which is the one outcome impersonation
-* must never have. Mounted ahead of every route, so a surface added later is
-* refused until it is listed here as honouring the header.
-*
-* @param honouredMounts - The mount points whose auth middleware applies the
-*        header (`/api/data`, `/api/functions`). A path is under one when it
-*        is the mount itself or continues it with a `/`.
-*/
-function refuseUnhonouredImpersonation(honouredMounts) {
-	return async (c, next) => {
-		if (c.req.header("x-rebase-impersonate") === void 0) return next();
-		const path = c.req.path;
-		if (honouredMounts.some((mount) => path === mount || path.startsWith(`${mount}/`))) return next();
-		logger.warn("[Security Audit] Refused a request to act as another user", {
-			eventType: "auth.impersonation.refused",
-			reason: "unsupported-route",
-			method: c.req.method,
-			path,
-			requestId: c.get("requestId")
-		});
-		return errorHandler(ApiError.badRequest(`This route cannot run as another user, so it refuses the ${IMPERSONATE_HEADER} header. Only the data API and custom functions honour it.`, "IMPERSONATION_UNSUPPORTED"), c);
-	};
-}
-//#endregion
-//#region src/storage/requested-object.ts
-/**
-* Which object a storage request's URL path names.
-*
-* Three parties read the path of a `GET /file/*`, `GET /metadata/*` or
-* `DELETE /file/*`: the route, which serves or deletes an object;
-* `publicObjectAuth`, which lets an anonymous caller through when that object
-* is public; and `fileTokenAuth`, which compares it with the path a download
-* token grants. A decision is only about the object acted on if it is made on
-* the same key, so all three derive it here — the wildcard, the decoding, the
-* bucket segment and the canonical key — and none of them spells a step of its
-* own.
-*
-* They used to. `publicObjectAuth` judged the raw path with a check that strips
-* everything up to a `://`, while the route canonicalized it, folding `//` to
-* `/`: `GET /file/notes://public/secret.txt` was public to the one and served
-* the private key `notes:/public/secret.txt` from the other, with the authorize
-* hook never asked.
-*
-* Nothing here parses a scheme. A request path is a key, optionally behind the
-* one bucket segment the routes recognise; a `://` in it is a `:` followed by
-* an empty segment, and canonicalization folds the empty segment away.
-*/
-/**
-* The wildcard part of a storage route's path, still percent-encoded.
-*
-* Hono's `c.req.param('*')` does not work reliably in sub-routers mounted
-* via `app.route(prefix, subRouter)`. Instead it is derived from the
-* fully-resolved `c.req.path` and `c.req.routePath`.
-*
-* For a route `/metadata/*` mounted at `/api/storage`, a request to
-* `/api/storage/metadata/default/file.jpg` yields routePath
-* `/api/storage/metadata/*`. The prefix (everything before `/*`) is stripped,
-* plus one character for the trailing `/`, to obtain `default/file.jpg`.
-*/
-function storageRequestWildcard(c) {
-	const prefix = c.req.routePath.replace("/*", "");
-	const fullPath = c.req.path;
-	const idx = fullPath.indexOf(prefix);
-	if (idx < 0) return "";
-	return fullPath.substring(idx + prefix.length + 1);
-}
-/**
-* The object a decoded path names: a key, behind an optional `default/` bucket
-* segment (matched case-insensitively). Throws {@link InvalidStorageKeyError}
-* when the key cannot be canonicalized.
-*
-* For a path that is already text — the folder route's JSON body. A URL path
-* goes through {@link requestedStorageObject}, which decodes it first.
-*/
-function storageObjectOfPath(decodedPath) {
-	const parts = decodedPath.split("/");
-	return {
-		bucket: "default",
-		key: canonicalStorageKey(parts.length > 1 && parts[0].toLowerCase() === "default" ? parts.slice(1).join("/") : decodedPath)
-	};
-}
-/**
-* The object a request's wildcard path names, or {@link InvalidStorageKeyError}.
-*
-* The wildcard arrives as Hono leaves it — `decodeURI`d, with the reserved
-* characters (`/`, `:`, `%25` among them) still escaped — so one
-* `decodeURIComponent` yields the path the client encoded. A `%` that does not
-* begin an escape names no key, and is refused like any other key that cannot be
-* canonicalized rather than thrown as a `URIError`.
-*/
-function requestedStorageObject(wildcard) {
-	let decoded;
-	try {
-		decoded = decodeURIComponent(wildcard);
-	} catch {
-		throw new InvalidStorageKeyError("Storage path is not valid percent-encoding: a '%' must begin an escape such as '%25' (a literal '%').");
-	}
-	return storageObjectOfPath(decoded);
-}
-/**
-* {@link requestedStorageObject}, or `null` when the path names no object.
-*
-* For the middleware, which must fail closed without an exception: a path that
-* names no object is neither public nor covered by any download token, and the
-* route answers it with a 400 of its own.
-*/
-function tryRequestedStorageObject(wildcard) {
-	try {
-		return requestedStorageObject(wildcard);
-	} catch (err) {
-		if (err instanceof InvalidStorageKeyError) return null;
-		throw err;
-	}
-}
-//#endregion
-//#region src/storage/request-principals.ts
-/**
-* The two principals a storage read can be granted without a user: the reader
-* of a declared-public object, and the bearer of a download token.
-*
-* `checkAuthorized` does not ask the `storageAuthorize` hook about either — the
-* public prefix and the token are the authorization. That skip used to be
-* decided on the principal's `uid` string (`"public"`, `"download-token"`), so
-* any identity carrying that uid skipped the hook: a custom `AuthAdapter` whose
-* `verifyRequest` returns `{ uid: "public" }` for a guest could then upload,
-* delete and list anywhere, with the hook never asked.
-*
-* Each principal is now one object, set only by the middleware that granted
-* it (`publicObjectAuth`, `fileTokenAuth`) and recognised by identity. An
-* adapter builds a new object per request, so it can name the uid but never be
-* the grant.
-*/
-/** The principal `publicObjectAuth` grants an anonymous read of a public object. */
-var PUBLIC_OBJECT_PRINCIPAL = Object.freeze({
-	uid: "public",
-	roles: ["public"]
-});
-/** The principal `fileTokenAuth` grants a read covered by a valid download token. */
-var DOWNLOAD_TOKEN_PRINCIPAL = Object.freeze({
-	uid: "download-token",
-	roles: ["reader"]
-});
-/** Whether `user` is the grant `publicObjectAuth` made — the object, not the uid. */
-function isPublicObjectGrant(user) {
-	return user === PUBLIC_OBJECT_PRINCIPAL;
-}
-/** Whether `user` is the grant `fileTokenAuth` made — the object, not the uid. */
-function isDownloadTokenGrant(user) {
-	return user === DOWNLOAD_TOKEN_PRINCIPAL;
-}
-//#endregion
-//#region src/auth/middleware.ts
-/**
-* Answer a refusal with the canonical envelope, through the same formatter
-* every route uses.
-*
-* These middlewares used to hand-build `c.json({ error: { message, code } },
-* 401)` — seven near-copies of it, which is how they came to omit `requestId`
-* while every other error on the server carried it: the one string a bug report
-* quotes was missing from precisely the errors an app hits most. It also meant
-* a routine 401 (a client refreshing before it knows whether a session exists)
-* logged like an incident, because `ApiError.expected` never reached the
-* logger.
-*
-* `errorHandler` is *called* rather than thrown to. A throw only becomes an
-* envelope where an `onError` is registered, and these middlewares are mounted
-* by callers this package does not control — `defineFunction` hands users a
-* Hono app and invites them to put `requireAuth` on a route of it. Making the
-* status depend on the mount point would turn a 401 into a 500 for exactly
-* those callers. Calling the formatter directly gets the envelope with none of
-* that.
-*/
-function refuse(c, error) {
-	return errorHandler(error, c);
-}
-/**
-* Hono middleware that requires a valid JWT token via Authorization header.
-* Returns 401 if token is missing or invalid.
-*
-* **Security:** Tokens are only accepted via the `Authorization: Bearer`
-* header. Query-string tokens (`?token=`) are intentionally NOT accepted
-* here because URLs leak into access logs, proxies, Referer headers, and
-* browser history. Use {@link queryTokenAuth} on routes that legitimately
-* need query-string tokens (e.g. storage file serving for `<img src>`).
-*/
-var requireAuth = async (c, next) => {
-	if (c.get("user")) return next();
-	const token = extractBearerToken(c.req.header("authorization"));
-	if (token === void 0) return refuse(c, ApiError.unauthenticated("Authorization header missing or invalid"));
-	const payload = await jwtOf(c).verifyAccessToken(token);
-	if (!payload) return refuse(c, ApiError.unauthenticated("Invalid or expired token"));
-	c.set("user", payload);
-	return next();
-};
-/**
-* Factory that creates a requireAuth middleware with optional service key support.
-*
-* When `serviceKey` is provided, the middleware will check if the Bearer token
-* matches the service key using constant-time comparison. If it matches, the
-* request is authenticated as a service user with admin privileges.
-*
-* This allows admin routes (which use standalone requireAuth + requireAdmin)
-* to be accessed via service keys for scripts and server-to-server calls.
-*/
-function createRequireAuth(options) {
-	if (!options?.serviceKey && !options?.resolveRoles && !options?.revocationRepo) return requireAuth;
-	const key = options.serviceKey;
-	const resolveRoles = options.resolveRoles;
-	const revocationRepo = options.revocationRepo;
-	return async (c, next) => {
-		if (c.get("user")) return next();
-		const token = extractBearerToken(c.req.header("authorization"));
-		if (token === void 0) return refuse(c, ApiError.unauthenticated("Authorization header missing or invalid"));
-		if (key !== void 0 && safeCompare(token, key)) {
-			c.set("user", {
-				uid: "service",
-				roles: ["admin"]
-			});
-			return next();
-		}
-		const payload = await jwtOf(c).verifyAccessToken(token);
-		if (!payload) return refuse(c, ApiError.unauthenticated("Invalid or expired token"));
-		if (resolveRoles || revocationRepo) try {
-			let judgedRoles;
-			if (revocationRepo) {
-				const verdict = await judgeAccessToken(revocationRepo, payload);
-				if (!verdict.live) return refuse(c, accessTokenRefusalError(verdict.refusal));
-				judgedRoles = verdict.roles;
-			}
-			c.set("user", resolveRoles ? {
-				...payload,
-				roles: judgedRoles ?? await resolveRoles(payload.uid)
-			} : payload);
-			return next();
-		} catch (error) {
-			if (isDatabaseUnreachable(error)) {
-				logger.warn("[Auth] Could not resolve roles for an admin-gated request: the database is unreachable", { uid: payload.uid });
-				return refuse(c, ApiError.databaseUnavailable());
-			}
-			logger.warn("[Auth] Could not resolve roles for an admin-gated request", {
-				uid: payload.uid,
-				error
-			});
-			return refuse(c, ApiError.serviceUnavailable("Could not verify your permissions. Please try again.", "ROLE_LOOKUP_FAILED"));
-		}
-		c.set("user", payload);
-		return next();
-	};
-}
-/**
-* Middleware that requires the user to hold the `admin` role, which holds
-* every scope. Must be used AFTER requireAuth or on a route where user is
-* guaranteed.
-*
-* Prefer `requireScope` from `./access` for anything a scope names: a scope
-* can be granted to a narrower role and to a key, and `admin` cannot.
-*/
-var requireAdmin = async (c, next) => {
-	const user = c.get("user");
-	if (!user) return refuse(c, ApiError.unauthorized("User not authenticated. requireAuth middleware is missing?"));
-	if (!hasAdminRole(typeof user === "object" && user !== null && "roles" in user && Array.isArray(user.roles) ? user.roles.filter((role) => typeof role === "string") : [])) return refuse(c, ApiError.forbidden("Admin privileges required for this operation"));
-	return next();
-};
-/**
-* Middleware that optionally extracts user from JWT via Authorization header.
-* Does not return 401 if token is missing — allows anonymous access.
-*
-* Query-string tokens are NOT accepted here. Use {@link queryTokenAuth}
-* on routes that need them.
-*/
-var optionalAuth = async (c, next) => {
-	if (c.get("user")) return next();
-	const token = extractBearerToken(c.req.header("authorization"));
-	const jwt = jwtOf(c);
-	if (token !== void 0 && jwt.isConfigured()) {
-		const payload = await jwt.verifyAccessToken(token);
-		if (payload) c.set("user", payload);
-	}
-	return next();
-};
-/**
-* Who a session token names, as `jwt` verifies it — or "nobody" rather than a
-* throw on a backend with no JWT of its own, so a socket closes as
-* unauthenticated, which is the outcome this describes.
-*/
-async function userFromToken(jwt, token) {
-	if (!jwt.isConfigured()) return null;
-	return jwt.verifyAccessToken(token);
-}
-/**
-* Extract user from token - for WebSocket authentication. Answers for the
-* process default; a backend's own socket verifies with its own keys.
-*/
-async function extractUserFromToken(token) {
-	return userFromToken(processJwtService, token);
-}
-/**
-* Create a configurable auth middleware that handles:
-* 1. Token extraction (via custom validator or JWT Bearer token)
-* 2. RLS-scoped DataDriver via withAuth()
-* 3. Enforcement (401 when requireAuth is true and no user)
-*
-* **Secure by default:** `requireAuth` defaults to `true`. Anonymous
-* access is only allowed when the developer explicitly opts out by
-* setting `requireAuth: false`, indicating that Postgres RLS policies
-* fully control access.
-*
-* **Fail-closed:** The raw unscoped driver is never placed in the
-* request context. Every code path either scopes via `withAuth()` or
-* rejects the request. This prevents silent RLS bypass.
-*
-* This is the single source of truth for HTTP auth in Rebase.
-* Use this instead of manually parsing tokens in route handlers.
-*/
-function createAuthMiddleware(options) {
-	const { driver: baseDriver, resolveDriver, requireAuth: enforceAuth = true, validator, serviceKey, apiKeyStore } = options;
-	return async (c, next) => {
-		const driver = resolveDriver ? resolveDriver(c) : baseDriver;
-		let credential = "none";
-		if (validator) try {
-			const authResult = await validator(c);
-			if (authResult && typeof authResult === "object") {
-				const id = "uid" in authResult ? authResult.uid : void 0;
-				if (id) {
-					const roles = authResult.roles || [];
-					credential = "session";
-					c.set("user", {
-						uid: id,
-						roles
-					});
-					const user = {
-						uid: id,
-						roles,
-						...authResult
-					};
-					c.set("driver", await scopeDataDriver(driver, user));
-				} else c.set("driver", await scopeDataDriver(driver, {
-					uid: ANONYMOUS_USER_ID,
-					roles: ["anon"]
-				}));
-			} else if (authResult === true) {
-				credential = "session";
-				c.set("user", {
-					uid: "default",
-					roles: []
-				});
-				c.set("driver", await scopeDataDriver(driver, {
-					uid: "default",
-					roles: []
-				}));
-			} else c.set("driver", await scopeDataDriver(driver, {
-				uid: ANONYMOUS_USER_ID,
-				roles: ["anon"]
-			}));
-		} catch (error) {
-			return refuse(c, ApiError.unauthenticated("Unauthorized"));
-		}
-		else {
-			const token = extractBearerToken(c.req.header("authorization"));
-			if (token !== void 0) if (serviceKey && safeCompare(token, serviceKey)) {
-				const serviceUser = {
-					uid: "service",
-					roles: ["admin"]
-				};
-				credential = "service-key";
-				c.set("user", serviceUser);
-				try {
-					c.set("driver", await scopeDataDriver(driver, {
-						uid: "service",
-						roles: ["admin"]
-					}));
-				} catch (error) {
-					logger.error("[AUTH] RLS scoping failed for service key", { error });
-					return c.json({ error: {
-						message: "Internal authentication error",
-						code: "INTERNAL_ERROR"
-					} }, 500);
-				}
-			} else if (apiKeyStore && isApiKeyToken(token)) {
-				const result = await validateApiKey(c, token, {
-					store: apiKeyStore,
-					driver
-				});
-				if (result !== true) return result;
-				credential = "api-key";
-			} else {
-				const payload = await userFromToken(jwtOf(c), token);
-				if (payload) {
-					credential = "session";
-					c.set("user", payload);
-					try {
-						const user = {
-							uid: payload.uid,
-							roles: payload.roles,
-							isAnonymous: payload.isAnonymous === true,
-							claims: payload.claims
-						};
-						c.set("driver", await scopeDataDriver(driver, user));
-					} catch (error) {
-						logger.error("[AUTH] RLS scoping failed for authenticated user", { error });
-						return c.json({ error: {
-							message: "Internal authentication error",
-							code: "INTERNAL_ERROR"
-						} }, 500);
-					}
-				} else return refuse(c, ApiError.unauthenticated("Invalid or expired token"));
-			}
-			else try {
-				c.set("driver", await scopeDataDriver(driver, {
-					uid: ANONYMOUS_USER_ID,
-					roles: ["anon"]
-				}));
-			} catch (error) {
-				logger.error("[AUTH] Failed to create anon-scoped driver", { error });
-				return c.json({ error: {
-					message: "Server configuration error",
-					code: "INTERNAL_ERROR"
-				} }, 500);
-			}
-		}
-		const refused = await applyImpersonation(c, {
-			credential,
-			driver
-		});
-		if (refused) return refused;
-		if (enforceAuth && !c.get("user")) return refuse(c, ApiError.unauthenticated("Unauthorized: Authentication required. This is the API-level gate, not a row rule — a collection granting public reads still needs a caller. Set AUTH_REQUIRE=false (or `auth.requireAuth: false`) to let RLS alone decide."));
-		return next();
-	};
-}
-/**
-* Middleware that authenticates via a `?token=` query parameter.
-*
-* **Use sparingly.** Tokens in URLs leak into access logs, proxy logs,
-* Referer headers, and browser history. This middleware exists solely for
-* routes where the consumer cannot set HTTP headers — e.g. `<img src>`,
-* `<a href>` for file downloads, or similar browser-native requests.
-*
-* Apply it **before** `requireAuth` or `optionalAuth` on the specific
-* route that needs it. Those middlewares will see the user context this
-* middleware sets and skip their own 401 check.
-*
-* @example
-* ```ts
-* router.get("/file/*", queryTokenAuth, readAuthMiddleware, handler);
-* ```
-*/
-var queryTokenAuth = async (c, next) => {
-	if (extractBearerToken(c.req.header("authorization")) !== void 0) return next();
-	const queryToken = c.req.query("token");
-	const jwt = jwtOf(c);
-	if (queryToken && jwt.isConfigured()) {
-		const payload = await jwt.verifyAccessToken(queryToken);
-		if (payload) c.set("user", payload);
-	}
-	return next();
-};
-/**
-* Authorizes anonymous access to **public** storage objects (those under the
-* public prefix), which are served token-less via stable, permanent URLs.
-*
-* Runs on the storage `/file/*` and `/metadata/*` routes, *after* the token
-* middleware and *before* the read-auth gate. If the request is already
-* authenticated (Bearer or scoped token), it does nothing. Otherwise, when the
-* requested object path is public, it sets a minimal "public" principal so the
-* downstream `requireAuth` gate lets the read through. Private paths are left
-* untouched, so they still require a valid token.
-*
-* Public means the object the route will serve is public, so the decision is
-* made on that object's canonical key, derived by the route's own function
-* (`requestedStorageObject`). It used to be made on the raw path, through a
-* check that strips a `scheme://`: `notes://public/secret.txt` read as
-* `public/secret.txt` here while the route served the private
-* `notes:/public/secret.txt`, and the authorize hook — not asked about this
-* principal — never saw it.
-*/
-var publicObjectAuth = async (c, next) => {
-	if (c.get("user")) return next();
-	const requested = tryRequestedStorageObject(storageRequestWildcard(c));
-	if (requested && isPublicStorageKey(requested.key)) c.set("user", PUBLIC_OBJECT_PRINCIPAL);
-	return next();
-};
-/**
-* Helper to match paths for scoped file tokens.
-* Matches exact paths or prefixes (exact folder prefixes or ending with /).
-*
-* The traversal check is defence in depth, not the load-bearing defence.
-*
-* A prefix comparison is a lie for any path containing `..`: `user1/../user2/x`
-* starts with `user1/`, so a token scoped to `user1/` would authorize reading
-* user2's file — and the storage controller would not object, because its own
-* guard stops a path escaping the *bucket*, and that one resolves to `user2/x`,
-* comfortably inside it. The grant is what would be escaped, and this is the
-* only layer that knows what was granted.
-*
-* Nothing arrives here in that shape today: the URL parser resolves `..` (and
-* `%2e%2e`, which the WHATWG spec treats as a dot for normalization) before
-* Hono routes the request, so this comparison already runs on a resolved path.
-* But that is a guarantee of the runtime rather than of this code, and it is
-* one line to not depend on it. The same rule already guards the public-object
-* path — see `isPublicStorageKey`.
-*/
-function isPathMatch(requested, allowed) {
-	if (requested.split("/").some((seg) => seg === "..")) return false;
-	if (requested === allowed) return true;
-	if (allowed.endsWith("/")) return requested.startsWith(allowed);
-	return requested.startsWith(allowed + "/");
+	resolvedHooks.afterUserDelete(uid).catch((err) => {
+		logger.error("[AuthHooks] afterUserDelete error", { error: err instanceof Error ? err.message : err });
+	});
 }
 /**
-* Middleware that authenticates file-serving routes using scoped download tokens.
-* It enforces that only scoped "file-read" tokens can access "/file/*" and "?token=" query params.
-* Full access JWTs are explicitly rejected on "/file/*" routes, and in the "?token=" query param.
+* The auth adapter's side of user administration through the auth collection
+* (`AuthAdapter.prepareUserUpdates` and the deletion pair): the admin user
+* routes' rules and hooks, for the data API's writes to the same rows.
 */
-var fileTokenAuth = async (c, next) => {
-	const isFileRoute = c.req.path.includes("/storage/file/");
-	const authHeader = c.req.header("authorization");
-	const queryToken = c.req.query("token");
-	/**
-	* Decide what a valid download token entitles this request to.
-	*
-	* One function rather than a copy per token location: a Bearer token and a
-	* `?token=` are the same grant presented two ways, and the whole failure
-	* this guards against is two places disagreeing about what was granted.
-	*
-	* `"no-path"` is distinct from the two denials because the caller treats it
-	* differently — a request with no object path at all is not a denied read,
-	* it is a request this middleware has nothing to say about, and on
-	* `/metadata/*` it must still reach the downstream auth gate.
-	*/
-	const evaluateGrant = (payload) => {
-		if (canonicalStorageId(c.req.query("storageId")) !== payload.storageId) return "deny-storage";
-		const rawPath = storageRequestWildcard(c);
-		if (!rawPath) return "no-path";
-		const requested = tryRequestedStorageObject(rawPath);
-		if (requested === null) return "deny-path";
-		return isPathMatch(`${requested.bucket}/${requested.key}`, payload.path) ? "grant" : "deny-path";
-	};
-	/**
-	* Which half of the scope failed is named in the message. The holder of the
-	* token already knows both values, so this reveals nothing to an attacker —
-	* and without it, a client that forgets to forward `?storageId=` on the file
-	* URL reports a "path mismatch" for a path that matches perfectly.
-	*/
-	const denyMismatch = (outcome) => refuse(c, ApiError.forbidden(outcome === "deny-storage" ? "Forbidden: Scoped token storage mismatch" : "Forbidden: Scoped token path mismatch"));
-	const bearerToken = extractBearerToken(authHeader);
-	if (bearerToken !== void 0) {
-		const token = bearerToken;
-		const payload = await jwtOf(c).verifyDownloadToken(token);
-		if (payload) {
-			const outcome = evaluateGrant(payload);
-			if (outcome === "grant") {
-				c.set("user", DOWNLOAD_TOKEN_PRINCIPAL);
-				return next();
-			}
-			if (outcome !== "no-path") return denyMismatch(outcome);
-		}
-		if (isFileRoute) return refuse(c, ApiError.unauthenticated("Unauthorized: Access JWT not allowed on file routes"));
-		return next();
-	}
-	if (queryToken) {
-		const payload = await jwtOf(c).verifyDownloadToken(queryToken);
-		if (payload) {
-			const outcome = evaluateGrant(payload);
-			if (outcome === "grant") {
-				c.set("user", DOWNLOAD_TOKEN_PRINCIPAL);
-				return next();
+function authCollectionUserAdmin(ctx) {
+	const { authRepo, resolvedHooks } = ctx;
+	return {
+		async prepareUserUpdates(updates) {
+			for (const { values } of updates) if (values.roles !== void 0 && values.roles !== null) readRoleNames(values.roles);
+			await assertRoleChangesAllowed(authRepo, updates.flatMap(({ uid, values }) => Array.isArray(values.roles) ? [{
+				uid,
+				roles: values.roles
+			}] : []));
+			const prepared = [];
+			for (const { uid, values } of updates) prepared.push(typeof values.email === "string" ? {
+				...values,
+				email: await normalizeUserEmailChange(authRepo, uid, values.email)
+			} : values);
+			return prepared;
+		},
+		async prepareUserDeletions(uids) {
+			await assertUserDeletionsAllowed(authRepo, uids);
+			if (resolvedHooks.beforeUserDelete) for (const uid of uids) await resolvedHooks.beforeUserDelete(uid);
+		},
+		async finalizeUserDeletions(uids) {
+			for (const uid of uids) {
+				await authRepo.deleteAllRefreshTokensForUser(uid);
+				runAfterUserDelete(resolvedHooks, uid);
 			}
-			if (outcome !== "no-path") return denyMismatch(outcome);
 		}
-		return refuse(c, ApiError.unauthenticated("Unauthorized: Invalid or unauthorized token"));
-	}
-	return next();
-};
+	};
+}
 //#endregion
 //#region src/auth/adapter-middleware.ts
+var import_jsonwebtoken = /* @__PURE__ */ __toESM(require_jsonwebtoken(), 1);
 /**
 * What a request is refused with when `adapter.verifyRequest` throws: the
 * adapter's own answer when it gave one, otherwise a 401 — fail closed either
@@ -3353,6 +1957,11 @@ function createAdapterAuthMiddleware(options) {
 					driver
 				});
 				if (result !== true) return result;
+				const refusedSimulation = await applySimulation(c, {
+					credential: "api-key",
+					driver
+				});
+				if (refusedSimulation) return refusedSimulation;
 				const refused = await applyImpersonation(c, {
 					credential: "api-key",
 					driver
@@ -3397,13 +2006,22 @@ function createAdapterAuthMiddleware(options) {
 				return refuse(c, ApiError.internal("Server configuration error"));
 			}
 		}
+		const credential = !authenticatedUser ? "none" : authenticatedUser.uid === SERVICE_IDENTITY.uid ? "service-key" : "session";
+		const resolveUser = adapter.resolveUser ? adapter.resolveUser.bind(adapter) : void 0;
+		const refusedSimulation = await applySimulation(c, {
+			credential,
+			driver,
+			resolveUser,
+			apiKeyStore
+		});
+		if (refusedSimulation) return refusedSimulation;
 		const refused = await applyImpersonation(c, {
-			credential: !authenticatedUser ? "none" : authenticatedUser.uid === SERVICE_IDENTITY.uid ? "service-key" : "session",
+			credential,
 			driver,
-			resolveUser: adapter.resolveUser ? adapter.resolveUser.bind(adapter) : void 0
+			resolveUser
 		});
 		if (refused) return refused;
-		if (enforceAuth && !c.get("user")) return refuse(c, ApiError.unauthenticated("Unauthorized: Authentication required. This is the API-level gate, not a row rule — a collection granting public reads still needs a caller. Set AUTH_REQUIRE=false (or `auth.requireAuth: false`) to let RLS alone decide."));
+		if (enforceAuth && !c.get("user") && !c.get("simulation")) return refuse(c, ApiError.unauthenticated("Unauthorized: Authentication required. This is the API-level gate, not a row rule — a collection granting public reads still needs a caller. Set AUTH_REQUIRE=false (or `auth.requireAuth: false`) to let RLS alone decide."));
 		return next();
 	};
 }
@@ -3847,6 +2465,13 @@ function createDevEmailSink(options = {}) {
 }
 var activeSink;
 /**
+* Every sink registered, by the `sendEmail` it hands out: what lets a backend
+* serve the mailbox it was given rather than the process's last one. With two
+* backends in one development process, the slot above made B's admins read
+* A's users' reset and magic links.
+*/
+var sinksBySender = /* @__PURE__ */ new WeakMap();
+/**
 * Make `sink` the process's development mailbox.
 *
 * Returns the sink, so this can wrap the construction it replaces. In
@@ -3859,8 +2484,18 @@ function registerDevEmailSink(sink) {
 		return sink;
 	}
 	activeSink = sink;
+	sinksBySender.set(sink.sendEmail, sink);
 	return sink;
 }
+/**
+* The registered mailbox whose `sendEmail` this is — the sink a backend's
+* `auth.email.sendEmail` came from — or `undefined` when it is some other
+* sender, or the process is production.
+*/
+function devEmailSinkFor(sendEmail) {
+	if (process.env.NODE_ENV === "production" || !sendEmail) return void 0;
+	return sinksBySender.get(sendEmail);
+}
 /** The registered mailbox, if there is one. */
 function activeDevEmailSink() {
 	return process.env.NODE_ENV === "production" ? void 0 : activeSink;
@@ -4340,6 +2975,11 @@ function createDataRateLimiter(config = {}, options = {}) {
 	const resolveBucket = async (c) => {
 		if (c.get("user")?.uid === SERVICE_IDENTITY.uid) return null;
 		if (isServiceKey(c)) return null;
+		const impersonator = c.get("impersonator");
+		if (impersonator?.uid) return bucketFor({
+			uid: impersonator.uid,
+			address: () => defaultKeyGenerator(c, trustedProxyHops)
+		});
 		const apiKey = c.get("apiKey");
 		return bucketFor({
 			apiKey,
@@ -6258,36 +4898,29 @@ function mountOtpRoutes(deps) {
 /**
 * May an OAuth identity be attached to a pre-existing account found *by email*?
 *
-* Both sides have to be trustworthy:
-*
-*  - the **provider** must have verified the address, or the caller has not
-*    shown they control it;
-*  - the **local account**'s address must have been verified too. Whoever
-*    made an unverified account never proved the address, and every way in
-*    they left on it — a password, an identity from a provider that did not
-*    vouch for the address — would go on opening the account the owner is
-*    about to be signed into.
+* Only when the **provider** verified the address. Otherwise the caller has
+* not shown they control it, and linking would hand them the account.
 *
-* The second rule used to exempt an account with no password, on the theory
-* that one made by an OAuth sign-in holds no credential an attacker could have
-* planted. It holds exactly one: the identity it was made with, which is an
-* attacker's whenever the provider did not vouch for the address.
-*
-* A refusal is not a dead end. `POST /auth/link/<provider>` attaches the
-* identity once the caller proves ownership by holding a session, and proving
-* the address (a magic link, an email code, a password reset) verifies the
-* account — removing what nobody proved — after which this answers yes.
+* When it did, the caller has proven the address exactly as reading a code out
+* of the inbox does: only the inbox's owner can hold a provider account that
+* vouches for it. If the **local account**'s address was never verified,
+* whoever made it never proved the address, and every way in they left on it —
+* a password, an identity from a provider that did not vouch for the address,
+* a live session — would go on opening the account the owner is about to be
+* signed into. So that case answers `provesAddress: true`, and the route
+* removes those ways in before it links (the pre-hijack defence). It used to
+* refuse instead, which left the owner of the address locked out of their own
+* address until they found a magic link or a reset.
 */
 function decideOAuthAutoLink(args) {
 	if (args.providerEmailVerified !== true) return {
 		allowed: false,
 		reason: "provider-email-unverified"
 	};
-	if (!args.existingUser.emailVerified) return {
-		allowed: false,
-		reason: args.existingUser.passwordHash ? "local-account-unverified" : "local-account-unverified-passwordless"
+	return {
+		allowed: true,
+		provesAddress: !args.existingUser.emailVerified
 	};
-	return { allowed: true };
 }
 /**
 * Is `redirectUri` one the operator authorised?
@@ -6743,10 +5376,18 @@ function createAuthRoutes(config) {
 						providerEmailVerified: externalUser.emailVerified,
 						existingUser: user
 					});
-					if (!decision.allowed) throw new ApiError(403, "EMAIL_NOT_VERIFIED", `An account with this email already exists with a different sign-in method. ${decision.reason === "provider-email-unverified" ? `${provider.id} has not verified this email address, so it cannot be linked automatically.` : "That account's email address was never verified, so it cannot be linked automatically."} Sign in with your existing method, then POST to /auth/link/${provider.id} to link ${provider.id} to your account.`, {
+					if (!decision.allowed) throw new ApiError(403, "EMAIL_NOT_VERIFIED", `An account with this email already exists with a different sign-in method. ${provider.id} has not verified this email address, so it cannot be linked automatically. Sign in with your existing method, then POST to /auth/link/${provider.id} to link ${provider.id} to your account.`, {
 						reason: decision.reason,
 						provider: provider.id
 					});
+					if (decision.provesAddress) {
+						await confirmAddressOwnership(authRepo, user, null);
+						user = {
+							...user,
+							emailVerified: true,
+							passwordHash: null
+						};
+					}
 					await authRepo.linkUserIdentity(user.id, provider.id, externalUser.providerId, identityProfileData(externalUser));
 					await authRepo.updateUser(user.id, {
 						displayName: user.displayName || externalUser.displayName || void 0,
@@ -7710,9 +6351,10 @@ function createAdminUsersRoute(config) {
 	});
 	router.post("/users", requireScope("users:write"), async (c) => {
 		const body = await c.req.json();
-		const { email, roles } = body;
+		const { email } = body;
 		if (!email) throw ApiError.badRequest("Email is required");
-		if (roles !== void 0 && Array.isArray(roles)) assertMayGrantRoles(c, roles.filter((role) => typeof role === "string"));
+		const roles = body.roles === void 0 || body.roles === null ? void 0 : readRoleNames(body.roles);
+		if (roles !== void 0) assertMayGrantRoles(c, roles);
 		if (await authRepo.getUserByEmail(normalizeEmail(email))) throw ApiError.conflict("A user with this email already exists");
 		const prepResult = await prepareAdminUserValues(body, {
 			authRepo,
@@ -7731,7 +6373,7 @@ function createAdminUsersRoute(config) {
 		};
 		if (ops.beforeUserCreate) createData = await ops.beforeUserCreate(createData);
 		const user = await authRepo.createUser(createData);
-		if (roles && Array.isArray(roles)) await authRepo.setUserRoles(user.id, roles);
+		if (roles !== void 0) await authRepo.setUserRoles(user.id, roles);
 		const delivery = await completeUserCreation(prepResult, (clearPassword) => finalizeAdminUserCreation({
 			id: user.id,
 			values: prepResult.values
@@ -7750,7 +6392,9 @@ function createAdminUsersRoute(config) {
 	});
 	router.put("/users/:uid", requireScope("users:write"), async (c) => {
 		const uid = c.req.param("uid");
-		const { password, email, displayName, roles, disabled } = await c.req.json();
+		const body = await c.req.json();
+		const { password, email, displayName, disabled } = body;
+		const roles = body.roles === void 0 || body.roles === null ? void 0 : readRoleNames(body.roles);
 		if (!await authRepo.getUserById(uid)) throw ApiError.notFound("User not found");
 		if (disabled !== void 0) {
 			if (typeof disabled !== "boolean") throw ApiError.badRequest("`disabled` must be true or false", "INVALID_INPUT");
@@ -7759,8 +6403,8 @@ function createAdminUsersRoute(config) {
 			if (typeof authRepo.setUserDisabled !== "function") throw new ApiError(501, "NOT_SUPPORTED", "This backend's auth repository cannot disable accounts.");
 		}
 		assertMayManageAccount(c, await authRepo.getUserRoleIds(uid));
-		if (roles !== void 0 && Array.isArray(roles)) {
-			assertMayGrantRoles(c, roles.filter((role) => typeof role === "string"));
+		if (roles !== void 0) {
+			assertMayGrantRoles(c, roles);
 			await assertRoleChangesAllowed(authRepo, [{
 				uid,
 				roles
@@ -7777,7 +6421,7 @@ function createAdminUsersRoute(config) {
 		}
 		if (Object.keys(updates).length > 0) await authRepo.updateUser(uid, updates);
 		if (passwordHash) await replaceUserPassword(authRepo, uid, passwordHash);
-		if (roles !== void 0 && Array.isArray(roles)) await authRepo.setUserRoles(uid, roles);
+		if (roles !== void 0) await authRepo.setUserRoles(uid, roles);
 		if (typeof disabled === "boolean" && authRepo.setUserDisabled) {
 			await authRepo.setUserDisabled(uid, disabled);
 			if (disabled) await revokeAllSessions(authRepo, uid);
@@ -7877,7 +6521,7 @@ function createBuiltinAuthAdapter(config) {
 	*/
 	function lookupRefusal(line, uid, error) {
 		if (isDatabaseUnreachable(error)) {
-			logger.warn(`${line}: the database is unreachable`, { uid });
+			if (!warnIfDatabaseClosed(error)) logger.warn(`${line}: the database is unreachable`, { uid });
 			return ApiError.databaseUnavailable();
 		}
 		logger.warn(line, {
@@ -8277,7 +6921,7 @@ function scopesFromStoredPermissions(permissions, admin) {
 *
 * @module
 */
-var TABLE$1 = "rebase.api_keys";
+var TABLE = "rebase.api_keys";
 /**
 * Drops `rebase.idx_api_keys_hash` — a plain btree on `key_hash`, next to the
 * UNIQUE (key_hash) constraint's own index — but only while a valid, unique,
@@ -8332,7 +6976,7 @@ var BOOT_COLUMNS = [
 var BOOT_STATE_SQL = (() => {
 	const list = (names) => names.map((name) => `'${name}'`).join(", ");
 	const target = `(SELECT oid FROM pg_roles WHERE rolname = '${REBASE_USER_ROLE}')`;
-	const columnCount = (names) => `(SELECT count(*) FROM pg_attribute a WHERE a.attrelid = to_regclass('${TABLE$1}') AND a.attnum > 0 AND NOT a.attisdropped AND a.attname IN (${list(names)}))::int`;
+	const columnCount = (names) => `(SELECT count(*) FROM pg_attribute a WHERE a.attrelid = to_regclass('${TABLE}') AND a.attnum > 0 AND NOT a.attisdropped AND a.attname IN (${list(names)}))::int`;
 	return `
 SELECT
     (SELECT count(*) FROM pg_class c WHERE c.relnamespace = to_regnamespace('rebase')
@@ -8342,12 +6986,12 @@ SELECT
     ${columnCount(BOOT_COLUMNS)} AS columns,
     ${columnCount(["permissions"])} AS legacy,
     (SELECT count(*) FROM pg_class c
-     WHERE c.oid = to_regclass('${TABLE$1}') AND NOT c.relrowsecurity AND ${target} IS NOT NULL
+     WHERE c.oid = to_regclass('${TABLE}') AND NOT c.relrowsecurity AND ${target} IS NOT NULL
        AND (c.relacl IS NULL
             OR EXISTS (SELECT 1 FROM aclexplode(c.relacl) a WHERE a.grantee = ${target})
             OR EXISTS (SELECT 1 FROM pg_attribute att, aclexplode(att.attacl) a
                        WHERE att.attrelid = c.oid AND att.attacl IS NOT NULL AND a.grantee = ${target})))::int AS granted,
-    (has_schema_privilege('rebase', 'USAGE') AND has_table_privilege(to_regclass('${TABLE$1}'), 'SELECT')) AS readable
+    (has_schema_privilege('rebase', 'USAGE') AND has_table_privilege(to_regclass('${TABLE}'), 'SELECT')) AS readable
 WHERE to_regnamespace('rebase') IS NOT NULL`.trim();
 })();
 /**
@@ -8432,13 +7076,13 @@ function rowToApiKey(row) {
 *
 * Returns `undefined` if the driver does not support `executeSql`.
 */
-function createApiKeyStore(driver) {
+function createApiKeyStore(driver, options = {}) {
 	const admin = driver.admin;
 	if (!isSQLAdmin(admin)) {
 		logger.warn("⚠️ [api-key-store] DataDriver does not support SQL admin — API keys will not be available.");
 		return;
 	}
-	const exec = (sqlText, options) => admin.executeSql(sqlText, options?.params ? { params: options.params } : void 0);
+	const exec = provisioningExec((sqlText, execOptions) => admin.executeSql(sqlText, execOptions?.params ? { params: execOptions.params } : void 0), options.provision);
 	const ddl = createDdlBootstrapper(exec, "api-key-store");
 	/**
 	* Give every row stored before scopes existed the scopes it now holds.
@@ -8449,10 +7093,10 @@ function createApiKeyStore(driver) {
 	* runtime that predates scopes still reads its own keys after a rollback.
 	*/
 	async function backfillScopes() {
-		const rows = await exec(`SELECT id, permissions, admin FROM ${TABLE$1} WHERE scopes IS NULL`);
+		const rows = await exec(`SELECT id, permissions, admin FROM ${TABLE} WHERE scopes IS NULL`);
 		for (const row of rows) {
 			const { scopes, roles } = scopesFromStoredPermissions(parseStoredPermissions(row.permissions), row.admin === true);
-			await exec(`UPDATE ${TABLE$1} SET scopes = $1::jsonb, roles = $2::jsonb WHERE id = $3 AND scopes IS NULL`, { params: [
+			await exec(`UPDATE ${TABLE} SET scopes = $1::jsonb, roles = $2::jsonb WHERE id = $3 AND scopes IS NULL`, { params: [
 				JSON.stringify(scopes),
 				JSON.stringify(roles),
 				row.id
@@ -8484,8 +7128,8 @@ function createApiKeyStore(driver) {
 				return;
 			}
 			await ddl.ensureObject("Creating schema rebase", "CREATE SCHEMA IF NOT EXISTS rebase");
-			await ddl.ensureObject(`Creating ${TABLE$1}`, `
-                CREATE TABLE IF NOT EXISTS ${TABLE$1} (
+			await ddl.ensureObject(`Creating ${TABLE}`, `
+                CREATE TABLE IF NOT EXISTS ${TABLE} (
                     id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
                     name TEXT NOT NULL,
                     kind TEXT NOT NULL DEFAULT 'service',
@@ -8506,35 +7150,42 @@ function createApiKeyStore(driver) {
 			try {
 				await exec(DROP_DUPLICATE_KEY_HASH_INDEX_SQL);
 			} catch (err) {
-				logger.warn(`[api-key-store] Left the duplicate idx_api_keys_hash in place for now: ${err instanceof Error ? err.message : String(err)}`);
+				if (!(err instanceof SchemaChangeRefusedError)) logger.warn(`[api-key-store] Left the duplicate idx_api_keys_hash in place for now: ${err instanceof Error ? err.message : String(err)}`);
 			}
 			await ddl.ensureObject("Creating idx_api_keys_prefix", `
                 CREATE INDEX IF NOT EXISTS idx_api_keys_prefix
-                ON ${TABLE$1}(key_prefix)
+                ON ${TABLE}(key_prefix)
             `);
-			await ddl.ensureObject(`Adding ${TABLE$1}.kind`, `
-                ALTER TABLE ${TABLE$1} ADD COLUMN IF NOT EXISTS kind TEXT NOT NULL DEFAULT 'service'
+			await ddl.ensureObject(`Adding ${TABLE}.kind`, `
+                ALTER TABLE ${TABLE} ADD COLUMN IF NOT EXISTS kind TEXT NOT NULL DEFAULT 'service'
             `);
-			await ddl.ensureObject(`Adding ${TABLE$1}.scopes`, `
-                ALTER TABLE ${TABLE$1} ADD COLUMN IF NOT EXISTS scopes JSONB
+			await ddl.ensureObject(`Adding ${TABLE}.scopes`, `
+                ALTER TABLE ${TABLE} ADD COLUMN IF NOT EXISTS scopes JSONB
             `);
-			await ddl.ensureObject(`Adding ${TABLE$1}.roles`, `
-                ALTER TABLE ${TABLE$1} ADD COLUMN IF NOT EXISTS roles JSONB NOT NULL DEFAULT '[]'::jsonb
+			await ddl.ensureObject(`Adding ${TABLE}.roles`, `
+                ALTER TABLE ${TABLE} ADD COLUMN IF NOT EXISTS roles JSONB NOT NULL DEFAULT '[]'::jsonb
             `);
-			await ddl.ensureObject(`Adding ${TABLE$1}.owner_uid`, `
-                ALTER TABLE ${TABLE$1} ADD COLUMN IF NOT EXISTS owner_uid TEXT
+			await ddl.ensureObject(`Adding ${TABLE}.owner_uid`, `
+                ALTER TABLE ${TABLE} ADD COLUMN IF NOT EXISTS owner_uid TEXT
             `);
 			await ddl.ensureObject("Creating idx_api_keys_owner", `
                 CREATE INDEX IF NOT EXISTS idx_api_keys_owner
-                ON ${TABLE$1}(owner_uid) WHERE owner_uid IS NOT NULL
+                ON ${TABLE}(owner_uid) WHERE owner_uid IS NOT NULL
             `);
-			if (!await ddl.isReadable(TABLE$1)) {
-				logger.error(`❌ [api-key-store] ${TABLE$1} is unavailable — every API-key authenticated request will be rejected on this instance, and the table could not be taken back off the end-user role.`);
+			if (!await ddl.isReadable(TABLE)) {
+				logger.error(options.provision === false ? `❌ [api-key-store] ${TABLE} does not exist, and this backend changes nothing in its database — every API-key authenticated request will be rejected on this instance until a provisioning run creates it.` : `❌ [api-key-store] ${TABLE} is unavailable — every API-key authenticated request will be rejected on this instance, and the table could not be taken back off the end-user role.`);
 				return;
 			}
 			await ddl.step("Revoking end-user access to api_keys", () => exec(revokeInternalTableSql("rebase", "api_keys")));
-			if ((await exec(`SELECT 1 FROM information_schema.columns
-                 WHERE table_schema = 'rebase' AND table_name = 'api_keys' AND column_name = 'permissions'`)).length > 0) await ddl.step("Backfilling API key scopes", backfillScopes);
+			const legacyColumns = await exec(`SELECT 1 FROM information_schema.columns
+                 WHERE table_schema = 'rebase' AND table_name = 'api_keys' AND column_name = 'permissions'`);
+			if (options.provision === false) try {
+				await exec(`SELECT ${BOOT_COLUMNS.join(", ")} FROM ${TABLE} WHERE false`);
+			} catch {
+				logger.error(`❌ [api-key-store] ${TABLE} is out of date — it lacks one of ${BOOT_COLUMNS.join(", ")}, which this release reads. This backend changes nothing in its database; a provisioning run adds them.`);
+			}
+			if (legacyColumns.length > 0 && options.provision === false) logger.warn(`⚠️ [api-key-store] ${TABLE} still has the pre-scopes \`permissions\` column. Keys stored before scopes are given theirs by a provisioning run; this backend changes nothing in its database.`);
+			else if (legacyColumns.length > 0) await ddl.step("Backfilling API key scopes", backfillScopes);
 			logger.debug("✅ API keys table ready");
 		},
 		async createApiKey(key, createdBy) {
@@ -8542,7 +7193,7 @@ function createApiKeyStore(driver) {
 			const hash = hashKey(plaintext);
 			const prefix = keyPrefix(plaintext);
 			return {
-				...toMasked(rowToApiKey((await exec(`INSERT INTO ${TABLE$1} (name, kind, key_prefix, key_hash, scopes, roles, owner_uid, rate_limit, created_by, expires_at)
+				...toMasked(rowToApiKey((await exec(`INSERT INTO ${TABLE} (name, kind, key_prefix, key_hash, scopes, roles, owner_uid, rate_limit, created_by, expires_at)
                  VALUES ($1, $2, $3, $4, $5::jsonb, $6::jsonb, $7, $8, $9, $10)
                  RETURNING *`, { params: [
 					key.name,
@@ -8560,23 +7211,23 @@ function createApiKeyStore(driver) {
 			};
 		},
 		async findByKeyHash(hash) {
-			const rows = await exec(`SELECT * FROM ${TABLE$1}
+			const rows = await exec(`SELECT * FROM ${TABLE}
                  WHERE key_hash = $1
                  LIMIT 1`, { params: [hash] });
 			if (rows.length === 0) return null;
 			return rowToApiKey(rows[0]);
 		},
 		async listApiKeys(filter) {
-			return (filter.kind === "personal" ? await exec(`SELECT * FROM ${TABLE$1}
+			return (filter.kind === "personal" ? await exec(`SELECT * FROM ${TABLE}
                      WHERE kind = 'personal' AND owner_uid = $1
                      ORDER BY created_at DESC`, { params: [filter.owner_uid] }) : await exec(`
-                    SELECT * FROM ${TABLE$1}
+                    SELECT * FROM ${TABLE}
                     WHERE kind = 'service'
                     ORDER BY created_at DESC
                 `)).map((r) => toMasked(rowToApiKey(r)));
 		},
 		async getApiKeyById(id) {
-			const rows = await exec(`SELECT * FROM ${TABLE$1}
+			const rows = await exec(`SELECT * FROM ${TABLE}
                  WHERE id = $1
                  LIMIT 1`, { params: [id] });
 			if (rows.length === 0) return null;
@@ -8609,7 +7260,7 @@ function createApiKeyStore(driver) {
 			if (setClauses.length === 0) return this.getApiKeyById(id);
 			setClauses.push("updated_at = NOW()");
 			params.push(id);
-			const rows = await exec(`UPDATE ${TABLE$1}
+			const rows = await exec(`UPDATE ${TABLE}
                  SET ${setClauses.join(", ")}
                  WHERE id = $${paramIdx} AND kind = 'service'
                  RETURNING *`, { params });
@@ -8617,17 +7268,17 @@ function createApiKeyStore(driver) {
 			return toMasked(rowToApiKey(rows[0]));
 		},
 		async revokeApiKey(id, owner_uid) {
-			return (owner_uid === void 0 ? await exec(`UPDATE ${TABLE$1}
+			return (owner_uid === void 0 ? await exec(`UPDATE ${TABLE}
                      SET revoked_at = NOW(), updated_at = NOW()
                      WHERE id = $1 AND kind = 'service' AND revoked_at IS NULL
-                     RETURNING id`, { params: [id] }) : await exec(`UPDATE ${TABLE$1}
+                     RETURNING id`, { params: [id] }) : await exec(`UPDATE ${TABLE}
                      SET revoked_at = NOW(), updated_at = NOW()
                      WHERE id = $1 AND kind = 'personal' AND owner_uid = $2 AND revoked_at IS NULL
                      RETURNING id`, { params: [id, owner_uid] })).length > 0;
 		},
 		async updateLastUsed(id) {
 			try {
-				await exec(`UPDATE ${TABLE$1}
+				await exec(`UPDATE ${TABLE}
                      SET last_used_at = NOW()
                      WHERE id = $1`, { params: [id] });
 			} catch (err) {
@@ -8658,10 +7309,20 @@ function readScopesField(value) {
 	if (!Array.isArray(value) || value.length === 0 || value.some((entry) => typeof entry !== "string")) throw ApiError.badRequest("scopes must be a non-empty array of scope strings, e.g. [\"data:read\", \"data:write:posts\"]", "INVALID_INPUT");
 	return [...new Set(value.map((entry) => entry.trim()))];
 }
-/** Read a `roles` body field: an array of non-empty strings, deduplicated, without `service`. */
+/**
+* Read a `roles` body field: an array of role names, trimmed, deduplicated,
+* without `service`. A key's roles reach RLS joined by `,` in `app.user_roles`,
+* so a name `roleNameProblem` refuses — `"editor,admin"` — is refused here too.
+*/
 function readRolesField(value) {
 	if (!Array.isArray(value) || value.some((entry) => typeof entry !== "string" || entry.trim() === "")) throw ApiError.badRequest("roles must be an array of role names", "INVALID_INPUT");
-	return [...new Set(value.map((entry) => entry.trim()))].filter((role) => role !== "service");
+	const trimmed = value.map((entry) => String(entry).trim());
+	const problems = trimmed.flatMap((name) => {
+		const problem = roleNameProblem(name);
+		return problem ? [`${JSON.stringify(name)} ${problem}`] : [];
+	});
+	if (problems.length > 0) throw new ApiError(400, "INVALID_ROLE", `Not valid role names: ${problems.join("; ")}. A role name is a non-empty string without , { } " \\ or control characters.`, { problems });
+	return [...new Set(trimmed)].filter((role) => role !== "service");
 }
 /**
 * Refuse scopes that are malformed, unknown, aimed at a target that does not
@@ -8707,6 +7368,24 @@ function assertRolesGrantable(requested, minterRoles) {
 	const beyond = requested.filter((role) => !minterRoles.includes(role));
 	if (beyond.length > 0) throw new ApiError(403, "ROLE_EXCEEDS_CREATOR", `A key cannot run as a role the account creating it does not hold: ${beyond.join(", ")}.`, { roles: beyond });
 }
+/**
+* Refuse changing or revoking a key that holds more than the caller — a role
+* they do not hold, or a scope beyond theirs. An admin manages any key.
+*
+* The same ceiling as minting, applied to the key as it already is: a
+* `keys:write` role could otherwise widen an admin-role key it could never
+* have minted to every data scope, or revoke the key an admin's integration
+* runs on. `assertMayManageAccount` is the same rule for accounts.
+*/
+function assertMayManageKey(existing, managerRoles, managerScopes) {
+	if (hasAdminRole(managerRoles)) return;
+	const roles = existing.roles.filter((role) => !managerRoles.includes(role));
+	const scopes = scopesBeyond(existing.scopes, managerScopes);
+	if (roles.length > 0 || scopes.length > 0) throw new ApiError(403, "KEY_OUTRANKS_CALLER", `This key holds ${[...roles.map((role) => `the role ${role}`), ...scopes].join(", ")}, which you do not, so you cannot change or revoke it.`, {
+		roles,
+		scopes
+	});
+}
 /** Read an optional `expires_at`: absent, null, or a future ISO-8601 instant. */
 function readExpiresAt(value, requireFuture) {
 	if (value === void 0) return void 0;
@@ -8803,6 +7482,11 @@ function createApiKeyRoutes(options) {
 		read: "keys:read",
 		write: "keys:write"
 	}));
+	const existingServiceKey = async (id) => {
+		const key = await store.getApiKeyById(id);
+		if (!key || key.kind !== "service") throw ApiError.notFound("API key not found");
+		return key;
+	};
 	router.get("/", async (c) => {
 		const keys = await store.listApiKeys({ kind: "service" });
 		return c.json({ keys });
@@ -8851,11 +7535,13 @@ function createApiKeyRoutes(options) {
 		if (rateLimit !== void 0) updates.rate_limit = rateLimit;
 		const expiresAt = readExpiresAt(body.expires_at, false);
 		if (expiresAt !== void 0) updates.expires_at = expiresAt;
+		assertMayManageKey(await existingServiceKey(id), minter.roles, callerScopes(c));
 		const key = await store.updateApiKey(id, updates);
 		if (!key) throw ApiError.notFound("API key not found");
 		return c.json({ key });
 	});
 	router.delete("/:id", async (c) => {
+		assertMayManageKey(await existingServiceKey(c.req.param("id")), caller(c).roles, callerScopes(c));
 		if (!await store.revokeApiKey(c.req.param("id"))) throw ApiError.notFound("API key not found or already revoked");
 		return c.json({ success: true });
 	});
@@ -8925,194 +7611,6 @@ function createPersonalKeyRoutes(options) {
 	return router;
 }
 //#endregion
-//#region src/auth/sql-rate-limit-store.ts
-var SCHEMA = "rebase";
-var TABLE_NAME = "rate_limit_hits";
-var TABLE = `${SCHEMA}.${TABLE_NAME}`;
-/** How often expired buckets are deleted. */
-var DEFAULT_SWEEP_MS = 300 * 1e3;
-/**
-* Build the store, or `undefined` if this driver cannot back it.
-*
-* Returning `undefined` rather than throwing matches `createCronStore`: a
-* deployment on a driver with no SQL admin should degrade to per-process counts
-* with a warning, not refuse to serve.
-*/
-function createSqlRateLimitStore(driver, options = {}) {
-	const admin = driver.admin;
-	if (!isSQLAdmin(admin)) {
-		logger.warn("⚠️ [rate-limit] The configured driver has no SQL admin, so rate-limit counts cannot be shared between processes. Falling back to this process's memory — each replica will enforce the limit independently.");
-		return;
-	}
-	const exec = (sqlText, options) => admin.executeSql(sqlText, options?.params ? { params: options.params } : void 0);
-	const ddl = createDdlBootstrapper(exec, "rate-limit-store");
-	const now = options.now ?? Date.now;
-	const sweepMs = options.sweepMs ?? DEFAULT_SWEEP_MS;
-	let sweepTimer;
-	let ready;
-	/**
-	* Create the table once, and remember whether it worked.
-	*
-	* Lazily rather than at boot because the store is constructed while routes
-	* are being mounted, and an `await` there would put a database round trip on
-	* the boot path of every deployment — including the ones that never take a
-	* request. The first request pays for it.
-	*
-	* The result is cached even on failure: a store that cannot create its table
-	* must not retry the DDL on every request, which would turn one broken
-	* permission into a per-request query storm.
-	*
-	* Readiness is decided by reading the table, never by the DDL not throwing —
-	* `ensureObject` routes through `step`, which logs a failure and returns
-	* normally. Keying on the absence of an exception would report a table that
-	* was never created as ready, and every later request would fall into the
-	* per-request error path instead of the one-time fallback.
-	*/
-	async function ensureReady() {
-		if (!ready) ready = (async () => {
-			try {
-				await ddl.ensureObject("Creating schema rebase", "CREATE SCHEMA IF NOT EXISTS rebase");
-				await ddl.ensureObject(`Creating ${TABLE}`, `
-                        CREATE TABLE IF NOT EXISTS ${TABLE} (
-                            key TEXT NOT NULL,
-                            bucket BIGINT NOT NULL,
-                            hits INTEGER NOT NULL DEFAULT 0,
-                            expires_at TIMESTAMPTZ NOT NULL,
-                            PRIMARY KEY (key, bucket)
-                        )
-                    `);
-				await ddl.ensureObject("Creating idx_rate_limit_hits_expiry", `
-                        CREATE INDEX IF NOT EXISTS idx_rate_limit_hits_expiry
-                        ON ${TABLE}(expires_at)
-                    `);
-				const readable = await ddl.isReadable(TABLE);
-				if (readable) await ddl.step("Revoking end-user access to rate_limit_hits", () => exec(revokeInternalTableSql(SCHEMA, TABLE_NAME)));
-				else logger.error("[rate-limit] The shared rate-limit table could not be created, so counts stay per-process. Every replica will enforce the limit independently.");
-				return readable;
-			} catch (err) {
-				logger.error("[rate-limit] Could not prepare the shared rate-limit table. Falling back to per-process counts for the life of this process.", { error: err instanceof Error ? err.message : String(err) });
-				return false;
-			}
-		})();
-		return ready;
-	}
-	function startSweeping() {
-		if (sweepTimer) return;
-		sweepTimer = setInterval(() => {
-			exec(`DELETE FROM ${TABLE} WHERE expires_at < now()`).catch((err) => {
-				logger.debug("[rate-limit] Bucket sweep failed", { error: err instanceof Error ? err.message : String(err) });
-			});
-		}, sweepMs);
-		sweepTimer.unref?.();
-	}
-	return {
-		async hit(key, windowMs, limit) {
-			if (!await ensureReady()) return {
-				allowed: true,
-				remaining: limit,
-				retryAfterMs: 0
-			};
-			startSweeping();
-			const at = now();
-			const bucket = Math.floor(at / windowMs);
-			const carry = 1 - (at - bucket * windowMs) / windowMs;
-			const expiresAt = new Date((bucket + 2) * windowMs).toISOString();
-			let current;
-			let previous;
-			try {
-				const row = firstRow(await exec(`WITH bumped AS (
-                         INSERT INTO ${TABLE} AS r (key, bucket, hits, expires_at)
-                         VALUES ($1, $2, 1, $3)
-                         ON CONFLICT (key, bucket)
-                         DO UPDATE SET hits = r.hits + 1, expires_at = EXCLUDED.expires_at
-                         RETURNING hits
-                     )
-                     SELECT
-                         (SELECT hits FROM bumped) AS current,
-                         COALESCE((SELECT hits FROM ${TABLE} WHERE key = $1 AND bucket = $4), 0) AS previous`, { params: [
-					key,
-					bucket,
-					expiresAt,
-					bucket - 1
-				] }));
-				current = Number(row?.current ?? 1);
-				previous = Number(row?.previous ?? 0);
-			} catch (err) {
-				logger.debug("[rate-limit] Shared count unavailable for this request", { error: err instanceof Error ? err.message : String(err) });
-				return {
-					allowed: true,
-					remaining: limit,
-					retryAfterMs: 0
-				};
-			}
-			const estimate = current + previous * carry;
-			if (estimate > limit) {
-				exec(`UPDATE ${TABLE} SET hits = GREATEST(hits - 1, 0) WHERE key = $1 AND bucket = $2`, { params: [key, bucket] }).catch(() => {});
-				return {
-					allowed: false,
-					remaining: 0,
-					retryAfterMs: Math.max(0, (bucket + 1) * windowMs - at)
-				};
-			}
-			return {
-				allowed: true,
-				remaining: Math.max(0, Math.floor(limit - estimate)),
-				retryAfterMs: 0
-			};
-		},
-		dispose() {
-			if (sweepTimer) clearInterval(sweepTimer);
-			sweepTimer = void 0;
-		}
-	};
-}
-/**
-* The first row of whatever shape this driver returns.
-*
-* `SqlExec` declares an array of rows, but drivers in this repository have also
-* returned a `{ rows }` envelope through the same escape hatch. Reading one
-* shape only is how a store silently counts nothing and reports every caller as
-* being on their first request — a limiter that never limits, with no error
-* anywhere. Tolerating both costs one line.
-*/
-var firstRow = firstSqlRow;
-//#endregion
-//#region src/auth/resolve-rate-limit-store.ts
-/**
-* A refusal to boot, phrased as the variable to change.
-*
-* Its own class so `bootFromBundle` can present it as a configuration problem
-* rather than a crash, matching `RoleConfigurationError`.
-*/
-var RateLimitStoreConfigurationError = class extends Error {
-	hint;
-	constructor(message, hint) {
-		super(message);
-		this.hint = hint;
-		this.name = "RateLimitStoreConfigurationError";
-	}
-};
-/**
-* Which store this process should build.
-*
-* A misspelled value **refuses to boot** rather than falling back to memory.
-* Every other outcome here is silent — the whole failure mode of this setting is
-* that nothing looks wrong — so the one moment it can be caught is the moment it
-* is read. `REBASE_RATE_LIMIT_STORE=postgres` is the obvious thing to type and
-* would otherwise be a per-replica limit wearing the shape of a shared one.
-*
-* A blank or whitespace-only value is *unset*, not invalid:
-* `REBASE_RATE_LIMIT_STORE=${SOMETHING}` with `SOMETHING` undefined is the
-* ordinary way to write a compose file, and it is how the platform neutralises a
-* tenant's own variable.
-*/
-function resolveRateLimitStoreKind(env) {
-	const raw = (env.REBASE_RATE_LIMIT_STORE ?? "").trim().toLowerCase();
-	if (raw === "") return "memory";
-	if (raw === "memory" || raw === "sql") return raw;
-	throw new RateLimitStoreConfigurationError(`REBASE_RATE_LIMIT_STORE="${raw}" is not a rate-limit store.`, "Use \"sql\" to share counts across processes, or \"memory\" (the default) to keep them in this process. A deployment running more than one replica or more than one role wants \"sql\" — otherwise each process enforces the whole limit by itself.");
-}
-//#endregion
 //#region src/auth/oauth-code-flow.ts
 /**
 * Build the request schema for an authorization-code provider.
@@ -10260,6 +8758,6 @@ var auth_exports = /* @__PURE__ */ __exportAll({
 	verifyPassword: () => verifyPassword
 });
 //#endregion
-export { optionalAuth as $, raw as $t, createAuthLimiters as A, setDefaultAccessControl as At, registerDevEmailSink as B, resolveEmailLinkBase as Bt, createPersonalKeyRoutes as C, configureAccess as Ct, configureUserPicking as D, processAccessControl as Dt, createBuiltinAuthAdapter as E, keyOwnerResolverFor as Et, MemoryRateLimitStore as F, supportsRlsScoping as Ft, validatePasswordStrength as G, getMagicLinkTemplate as Gt, createEmailService as H, getEmailChangeTemplate as Ht, activeDevEmailSink as I, isAccessTokenRevoked as It, createAdapterAuthMiddleware as J, getWelcomeEmailTemplate as Jt, verifyPassword as K, getPasswordResetTemplate as Kt, clearActiveDevEmailSink as L, completeUserCreation as Lt, createDataRateLimiter as M, safeCompare as Mt, createRateLimiter as N, SERVICE_IDENTITY as Nt, isBootstrapWindowOpen as O, requireScope as Ot, setSharedRateLimitStore as P, scopeDataDriver as Pt, fileTokenAuth as Q, html as Qt, createDevEmailSink as R, generateSecurePassword as Rt, createApiKeyRoutes as S, callerScopes as St, createJwksRoutes as T, hasScope as Tt, resolveAuthHooks as U, getEmailOtpTemplate as Ut, SMTPEmailService as V, getEmailChangeNoticeTemplate as Vt, hashPassword as W, getEmailVerificationTemplate as Wt, createRequireAuth as X, RawHtml as Xt, createAuthMiddleware as Y, resolveEmailBranding as Yt, extractUserFromToken as Z, escapeHtml as Zt, oauthCodeFlowSchema as _, isApiKeyToken as _t, createBitbucketProvider as a, storageObjectPath as an, userFromToken as at, resolveRateLimitStoreKind as b, accessModelFromCollections as bt, createTwitterProvider as c, isPublicObjectGrant as ct, createMicrosoftProvider as d, storageRequestWildcard as dt, httpMethodToOperation as en, publicObjectAuth as et, tryVerifyOidcIdToken as f, decideImpersonation as ft, createGoogleProvider as g, createTusScopeGuard as gt, createLinkedinProvider as h, createFunctionScopeGuard as ht, createSlackProvider as i, isPublicStoragePath as in, requireAuth as it, createDataRateLimitCheck as j, extractBearerToken as jt, DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT as k, requireScopeByMethod as kt, createFacebookProvider as l, requestedStorageObject as lt, createGitHubProvider as m, createApiKeyPreAuth as mt, createCustomAuthAdapter as n, PUBLIC_STORAGE_PREFIX as nn, refuse as nt, createGitLabProvider as o, PUBLIC_OBJECT_PRINCIPAL as ot, verifyOidcIdToken as p, refuseUnhonouredImpersonation as pt, adapterRefusal as q, getUserInvitationTemplate as qt, createSpotifyProvider as r, isPublicStorageKey as rn, requireAdmin as rt, createDiscordProvider as s, isDownloadTokenGrant as st, auth_exports as t, securityRuleToConditions as tn, queryTokenAuth as tt, createAppleProvider as u, storageObjectOfPath as ut, pkceTokenParams as v, resolveApiKey as vt, createApiKeyStore as w, getAccessModel as wt, createSqlRateLimitStore as x, accessOf as xt, providerVerifiedEmail as y, validateApiKey as yt, extractLinks as z, assertEmailLinkBases as zt };
+export { getEmailChangeTemplate as $, createDataRateLimiter as A, SMTPEmailService as B, createJwksRoutes as C, DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT as D, isBootstrapWindowOpen as E, clearActiveDevEmailSink as F, verifyPassword as G, resolveAuthHooks as H, createDevEmailSink as I, completeUserCreation as J, adapterRefusal as K, devEmailSinkFor as L, setSharedRateLimitStore as M, MemoryRateLimitStore as N, createAuthLimiters as O, activeDevEmailSink as P, getEmailChangeNoticeTemplate as Q, extractLinks as R, createApiKeyStore as S, configureUserPicking as T, hashPassword as U, createEmailService as V, validatePasswordStrength as W, assertEmailLinkBases as X, generateSecurePassword as Y, resolveEmailLinkBase as Z, oauthCodeFlowSchema as _, createBitbucketProvider as a, getWelcomeEmailTemplate as at, createApiKeyRoutes as b, createTwitterProvider as c, escapeHtml as ct, createMicrosoftProvider as d, createSqlRateLimitStore as dt, getEmailOtpTemplate as et, tryVerifyOidcIdToken as f, resolveRateLimitStoreKind as ft, createGoogleProvider as g, createLinkedinProvider as h, createSlackProvider as i, getUserInvitationTemplate as it, createRateLimiter as j, createDataRateLimitCheck as k, createFacebookProvider as l, html as lt, createGitHubProvider as m, createCustomAuthAdapter as n, getMagicLinkTemplate as nt, createGitLabProvider as o, resolveEmailBranding as ot, verifyOidcIdToken as p, securityRuleToConditions as pt, createAdapterAuthMiddleware as q, createSpotifyProvider as r, getPasswordResetTemplate as rt, createDiscordProvider as s, RawHtml as st, auth_exports as t, getEmailVerificationTemplate as tt, createAppleProvider as u, raw as ut, pkceTokenParams as v, createBuiltinAuthAdapter as w, createPersonalKeyRoutes as x, providerVerifiedEmail as y, registerDevEmailSink as z };
 
-//# sourceMappingURL=auth-CteGWxsL.js.map
+//# sourceMappingURL=auth-izI7AEzC.js.map