@rebasepro/server 0.25.1 → 0.26.0

package/dist/index.es.js

@@ -3,43 +3,47 @@ import __rebaseProcess from "process";
 globalThis.process ??= __rebaseProcess;
 __rebaseCreateRequire(import.meta.url);
 import { r as __require, t as __commonJSMin } from "./rolldown-runtime-dW7B1o5h.js";
-import { a as MAX_LIST_LIMIT, c as RebaseClientError, l as isUnsupported, n as suggestNearMiss, r as toSnakeCase, s as RebaseApiError, u as unsupportedMethod } from "./strings.es-BeZWAodn.js";
-import { C as isFieldOperation, T as EntityRelation, _ as normalizeOrderBy, b as BATCH_REF_KEY, c as collectAllPages, g as OrderBySpecError, l as paginateFind, m as normalizeInclude, p as mergeIncludeSpecs, r as deserializeFilter, t as RESERVED_QUERY_KEYS, u as resolveFindWindow, v as serializeOrderBy, x as FIELD_OPERATORS, y as withRelationReferencesOnly } from "./filter-dialect-O1HK6Nvr.js";
-import { A as DEFAULT_RESOURCE_KEY, C as declaredSubscriptions, D as setTopicRuntime, E as setQueueRuntime, F as resourceKind, G as DEFAULT_DATA_SOURCE_KEY, H as getDeclaredSubcollections, I as resourceKinds, K as getDataSourceCapabilities, L as RLS_JWT_SQL, M as resolveResourceRefs, N as resourceEnvSuffix, O as DEFAULT_STORAGE_SOURCE_KEY, P as resourceKeyOf, R as RLS_ROLES_SQL, S as declaredQueueConsumers, T as resourceToStorageSource, U as isPostgresCollectionConfig, V as getCollectionDataPath, _ as scopesForRoles, c as intersectScopes, et as sortKeyToString, h as scopeGrantsAny, j as buildResourceGraph, k as storageEnvSuffix, m as scopeGrants, p as parseScope, q as ALL_WHERE_FILTER_OPS, s as hasAdminRole, w as resourceToDataSource, y as summarizeScopes, z as RLS_UID_SQL } from "./src-D5Y3N-S4.js";
+import { a as RebaseClientError, i as RebaseApiError, n as MAX_LIST_LIMIT, o as isUnsupported, s as unsupportedMethod } from "./data_driver-D0mg1Y_x.js";
+import { C as isFieldOperation, T as EntityRelation, _ as normalizeOrderBy, b as BATCH_REF_KEY, c as collectAllPages, g as OrderBySpecError, l as paginateFind, m as normalizeInclude, p as mergeIncludeSpecs, r as deserializeFilter, t as RESERVED_QUERY_KEYS, u as resolveFindWindow, v as serializeOrderBy, x as FIELD_OPERATORS, y as withRelationReferencesOnly } from "./filter-dialect-TrKFWLqT.js";
+import { A as storageEnvSuffix, B as RLS_UID_SQL, C as declaredQueueConsumers, D as setQueueRuntime, E as resourceToStorageSource, F as resourceKeyOf, H as getCollectionDataPath, I as resourceKind, J as ALL_WHERE_FILTER_OPS, K as DEFAULT_DATA_SOURCE_KEY, L as resourceKinds, M as buildResourceGraph, N as resolveResourceRefs, O as setTopicRuntime, P as resourceEnvSuffix, R as RLS_JWT_SQL, T as resourceToDataSource, U as getDeclaredSubcollections, W as isPostgresCollectionConfig, b as summarizeScopes, c as intersectScopes, g as scopeGrantsAny, h as scopeGrants, j as DEFAULT_RESOURCE_KEY, k as DEFAULT_STORAGE_SOURCE_KEY, p as parseScope, q as getDataSourceCapabilities, s as hasAdminRole, tt as sortKeyToString, v as scopesForRoles, w as declaredSubscriptions, z as RLS_ROLES_SQL } from "./src-Bh9LRPb9.js";
 import { a as nestCollectionPatchPaths, c as ADMIN_PROPERTY_KEYS, i as isCollectionPatch, n as collectionPatchProblems, r as diffCollections, s as ADMIN_COLLECTION_KEYS, t as applyCollectionPatch } from "./collection_patch-BRu-BvDv.js";
-import { a as softDeleteFieldOf, c as JUNCTION_PIVOT_KEY, i as restoresSoftDeletedRow, l as hasForeignKeyOnTarget, n as buildCollectionSchema, o as buildTenantSecurityRule, s as INCLUDE_COUNT_KEY, t as buildCollectionInputSchema, u as isManyToMany } from "./openapi-generator-BjHr6upl.js";
+import { a as softDeleteFieldOf, c as JUNCTION_PIVOT_KEY, i as restoresSoftDeletedRow, l as hasForeignKeyOnTarget, n as buildCollectionSchema, o as buildTenantSecurityRule, s as INCLUDE_COUNT_KEY, t as buildCollectionInputSchema, u as isManyToMany } from "./openapi-generator-CyxEtYEX.js";
 import { n as isAnonymousUid, r as policy } from "./policy-PdzX-Opd.js";
-import { n as isSchemaEditingAdmin, t as isSQLAdmin } from "./backend-DTAOsLQc.js";
-import { a as parseEnvBoolean, i as validateCronExpression, t as CronScheduler } from "./cron-scheduler-B04ACoUE.js";
+import { n as isSQLAdmin, r as isSchemaEditingAdmin } from "./backend-CaG_Jyso.js";
+import { a as parseEnvBoolean, i as validateCronExpression, t as CronScheduler } from "./cron-scheduler-Be7CNghL.js";
+import { s as simulationHeaders } from "./auth_adapter-B7RUMk6e.js";
 import { n as isValidAppHost, r as reservedPrefixFor, t as SCHEMA_VERSION_HEADER } from "./project_manifest-R6y_KHms.js";
-import { n as createContractRoutes, r as computeSchemaVersion } from "./contract-routes-CsFXW7j4.js";
-import { $ as optionalAuth, $t as raw, A as createAuthLimiters, At as setDefaultAccessControl, B as registerDevEmailSink, Bt as resolveEmailLinkBase, C as createPersonalKeyRoutes, Ct as configureAccess, D as configureUserPicking, Dt as processAccessControl, E as createBuiltinAuthAdapter, Et as keyOwnerResolverFor, F as MemoryRateLimitStore, Ft as supportsRlsScoping, G as validatePasswordStrength, Gt as getMagicLinkTemplate, H as createEmailService, Ht as getEmailChangeTemplate, I as activeDevEmailSink, It as isAccessTokenRevoked, J as createAdapterAuthMiddleware, Jt as getWelcomeEmailTemplate, K as verifyPassword, Kt as getPasswordResetTemplate, L as clearActiveDevEmailSink, Lt as completeUserCreation, M as createDataRateLimiter, Mt as safeCompare, N as createRateLimiter, Nt as SERVICE_IDENTITY, O as isBootstrapWindowOpen, Ot as requireScope, P as setSharedRateLimitStore, Pt as scopeDataDriver, Q as fileTokenAuth, Qt as html, R as createDevEmailSink, Rt as generateSecurePassword, S as createApiKeyRoutes, St as callerScopes, T as createJwksRoutes, Tt as hasScope, U as resolveAuthHooks, Ut as getEmailOtpTemplate, V as SMTPEmailService, Vt as getEmailChangeNoticeTemplate, W as hashPassword, Wt as getEmailVerificationTemplate, X as createRequireAuth, Xt as RawHtml, Y as createAuthMiddleware, Yt as resolveEmailBranding, Z as extractUserFromToken, Zt as escapeHtml, _ as oauthCodeFlowSchema, _t as isApiKeyToken, a as createBitbucketProvider, an as storageObjectPath, at as userFromToken, b as resolveRateLimitStoreKind, bt as accessModelFromCollections, c as createTwitterProvider, ct as isPublicObjectGrant, d as createMicrosoftProvider, dt as storageRequestWildcard, en as httpMethodToOperation, et as publicObjectAuth, f as tryVerifyOidcIdToken, ft as decideImpersonation, g as createGoogleProvider, gt as createTusScopeGuard, h as createLinkedinProvider, ht as createFunctionScopeGuard, i as createSlackProvider, in as isPublicStoragePath, it as requireAuth, j as createDataRateLimitCheck, jt as extractBearerToken, k as DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT, kt as requireScopeByMethod, l as createFacebookProvider, lt as requestedStorageObject, m as createGitHubProvider, mt as createApiKeyPreAuth, n as createCustomAuthAdapter, nn as PUBLIC_STORAGE_PREFIX, nt as refuse$1, o as createGitLabProvider, ot as PUBLIC_OBJECT_PRINCIPAL, p as verifyOidcIdToken, pt as refuseUnhonouredImpersonation, q as adapterRefusal, qt as getUserInvitationTemplate, r as createSpotifyProvider, rn as isPublicStorageKey, rt as requireAdmin, s as createDiscordProvider, st as isDownloadTokenGrant, tn as securityRuleToConditions, tt as queryTokenAuth, u as createAppleProvider, ut as storageObjectOfPath, v as pkceTokenParams, vt as resolveApiKey, w as createApiKeyStore, wt as getAccessModel, x as createSqlRateLimitStore, xt as accessOf, y as providerVerifiedEmail, yt as validateApiKey, z as extractLinks, zt as assertEmailLinkBases } from "./auth-Dkvo2tTJ.js";
+import { n as createContractRoutes, r as computeSchemaVersion } from "./contract-routes-CU2A3JnF.js";
+import { A as isPublicObjectGrant, C as queryTokenAuth, D as userFromToken, E as requireAuth, F as decideImpersonation, G as isApiKeyToken, H as createApiKeyPreAuth, I as refuseUnhonouredImpersonation, J as extractBearerToken, K as resolveApiKey, M as storageObjectOfPath, N as storageRequestWildcard, O as PUBLIC_OBJECT_PRINCIPAL, Q as supportsRlsScoping, S as publicObjectAuth, T as requireAdmin, U as createFunctionScopeGuard, V as reportSimulatedContext, W as createTusScopeGuard, X as SERVICE_IDENTITY, Y as safeCompare, Z as scopeDataDriver, _ as createAuthMiddleware, at as httpMethodToOperation, b as fileTokenAuth, c as configureAccess, ct as isPublicStoragePath, d as keyOwnerResolverFor, et as isAccessTokenRevoked, f as processAccessControl, g as setDefaultAccessControl, h as requireScopeByMethod, it as refuseSimulatedWrite, j as requestedStorageObject, k as isDownloadTokenGrant, l as getAccessModel, lt as storageObjectPath, m as requireScope, n as accessModelFromCollections, ot as PUBLIC_STORAGE_PREFIX, q as validateApiKey, r as accessOf, s as callerScopes, st as isPublicStorageKey, u as hasScope, v as createRequireAuth, w as refuse$1, x as optionalAuth, y as extractUserFromToken } from "./access-BFAUvsSs.js";
 import { a as logger, c as setLogLevel, d as hostEnv, i as logLevelEnabled, l as setLogOutput, o as rawQueryLoggingEnabled, r as describeCauseChain, s as redactSensitiveText, t as _setLogLineHook } from "./logger-CW8pmTS6.js";
-import { a as apiHiddenFieldNames, c as fieldKeyForColumn, d as isJunctionBackedRelation, g as toWireKey, h as resolveRelation, l as findRelation, m as resolveCollectionRelations, n as HARD_DELETE_QUERY_PARAM, p as relationDeclaringProperty, r as parseHardDelete, s as restrictedFieldNames, u as getTableName } from "./soft-delete-params-BmlVwecC.js";
-import { c as createTransport, d as parseRebaseJson, h as unref, l as defaultCodeForStatus, m as withETag, o as createCollectionClient, p as etagOf, r as SDKQueryBuilder, u as invalidBulkBody } from "./offline-store-BhYXViha-BW5j1We_.js";
+import { n as suggestNearMiss, r as toSnakeCase } from "./strings.es-B7QLnHh2.js";
+import { a as findRelation, d as resolveRelation, f as toWireKey, i as fieldKeyForColumn, l as relationDeclaringProperty, o as getTableName, r as restrictedFieldNames, s as isJunctionBackedRelation, t as apiHiddenFieldNames, u as resolveCollectionRelations } from "./field-access-DYsvjI_P.js";
+import { c as createTransport, d as parseRebaseJson, h as unref, l as defaultCodeForStatus, m as withETag, o as createCollectionClient, p as etagOf, r as SDKQueryBuilder, u as invalidBulkBody } from "./offline-store-BhYXViha-YTmjBpo2.js";
+import { $ as getEmailChangeTemplate, A as createDataRateLimiter, B as SMTPEmailService, C as createJwksRoutes, D as DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT, E as isBootstrapWindowOpen, F as clearActiveDevEmailSink, G as verifyPassword, H as resolveAuthHooks, I as createDevEmailSink, J as completeUserCreation, K as adapterRefusal, L as devEmailSinkFor, M as setSharedRateLimitStore, N as MemoryRateLimitStore, O as createAuthLimiters, P as activeDevEmailSink, Q as getEmailChangeNoticeTemplate, R as extractLinks, S as createApiKeyStore, T as configureUserPicking, U as hashPassword, V as createEmailService, W as validatePasswordStrength, X as assertEmailLinkBases, Y as generateSecurePassword, Z as resolveEmailLinkBase, _ as oauthCodeFlowSchema, a as createBitbucketProvider, at as getWelcomeEmailTemplate, b as createApiKeyRoutes, c as createTwitterProvider, ct as escapeHtml, d as createMicrosoftProvider, dt as createSqlRateLimitStore, et as getEmailOtpTemplate, f as tryVerifyOidcIdToken, ft as resolveRateLimitStoreKind, g as createGoogleProvider, h as createLinkedinProvider, i as createSlackProvider, it as getUserInvitationTemplate, j as createRateLimiter, k as createDataRateLimitCheck, l as createFacebookProvider, lt as html, m as createGitHubProvider, n as createCustomAuthAdapter, nt as getMagicLinkTemplate, o as createGitLabProvider, ot as resolveEmailBranding, p as verifyOidcIdToken, pt as securityRuleToConditions, q as createAdapterAuthMiddleware, r as createSpotifyProvider, rt as getPasswordResetTemplate, s as createDiscordProvider, st as RawHtml, tt as getEmailVerificationTemplate, u as createAppleProvider, ut as raw, v as pkceTokenParams, w as createBuiltinAuthAdapter, x as createPersonalKeyRoutes, y as providerVerifiedEmail, z as registerDevEmailSink } from "./auth-izI7AEzC.js";
 import "./resumable-upload-threshold-CKv-Ry0l.js";
 import { n as revokeInternalTableSql } from "./internal-tables-L2t39RdT.js";
 import { i as warnDeprecated } from "./load-failure-L5hvfDoG.js";
-import { a as resolveListLimitParam, c as assertReadableFields, d as decodeCursor$1, f as reconcileCursorOrder, i as parseQueryOptions, l as requestViewer, n as parseAggregateSelect, o as assertNoHiddenAggregateNames, r as parseGroupBy, s as assertQueryFieldsReadable, t as orderByEntriesToTuples, u as cursorToStartAfter } from "./query-parser-otFZqJsC.js";
+import { a as resolveListLimitParam, c as assertReadableFields, d as decodeCursor$1, f as reconcileCursorOrder, i as parseQueryOptions, l as requestViewer, n as parseAggregateSelect, o as assertNoHiddenAggregateNames, r as parseGroupBy, s as assertQueryFieldsReadable, t as orderByEntriesToTuples, u as cursorToStartAfter } from "./query-parser-CDXWf2hH.js";
+import { C as randomHex, E as sha256Hex, S as constantTimeEqual, T as sha256Bytes, b as normalizePemFromEnv, d as hasAsymmetricSigningKey, g as setDefaultJwtService, h as processJwtService, l as getJwks, m as jwtOf, n as configureJwt, r as createJwtService, y as verifyJwt } from "./jwt-rDS0884_.js";
+import { a as isConcurrentDdlRace, c as provisioningExec, l as withoutLeadingComments, o as isDuplicateObjectRace, r as createDdlBootstrapper, s as isSchemaChange, t as CONCURRENT_DDL_SQLSTATES } from "./ddl-bootstrap-CjRrn12l.js";
+import { t as createCronStore } from "./cron-store-DLn11M8H.js";
 import { a as isDataException, i as errorHandler, n as DATABASE_UNAVAILABLE_MESSAGE, o as isDatabaseUnreachable, r as declaredErrorAnswer, s as schemaDriftRemedy, t as ApiError } from "./errors-OMWkKSH-.js";
-import { C as randomHex, E as sha256Hex, S as constantTimeEqual, T as sha256Bytes, b as normalizePemFromEnv, d as hasAsymmetricSigningKey, g as setDefaultJwtService, h as processJwtService, l as getJwks, m as jwtOf, n as configureJwt, r as createJwtService, y as verifyJwt } from "./jwt-D3oFauZI.js";
-import { a as canonicalStorageId, i as canonicalStorageBucket, n as InvalidStorageBucketError, o as canonicalStorageKey, r as InvalidStorageKeyError, t as InvalidListOptionsError } from "./keys-COzQ2aE8.js";
+import { n as HARD_DELETE_QUERY_PARAM, r as parseHardDelete } from "./soft-delete-params-BRONCOA2.js";
+import { a as canonicalStorageId, i as canonicalStorageBucket, n as InvalidStorageBucketError, o as canonicalStorageKey, r as InvalidStorageKeyError, t as InvalidListOptionsError } from "./keys-BXcdRNhJ.js";
 import { t as logMiddleware } from "./logs-routes-CBt7mMIL.js";
 import { a as readStreamFully, c as DOCUMENT_MIME_TYPES, i as fileWebStream, l as IMAGE_MIME_TYPES, r as bytesView, s as DEFAULT_MAX_FILE_SIZE, t as validateUploadedFile } from "./upload-validation-Bgo626uY.js";
-import { t as S3StorageController } from "./S3StorageController-D00EFa5P.js";
-import { t as GCSStorageController } from "./GCSStorageController-CRd9bFrc.js";
-import { a as isDuplicateObjectRace, i as isConcurrentDdlRace, n as createDdlBootstrapper, t as CONCURRENT_DDL_SQLSTATES } from "./ddl-bootstrap-Ck20GSIX.js";
-import { t as createCronStore } from "./cron-store-DkyfuLOH.js";
-import { i as loadFunctionsWithDiagnostics, n as loadFunctions, r as loadFunctionsFromDirectory } from "./function-loader-KKDqTcIr.js";
+import { t as S3StorageController } from "./S3StorageController-Bl5shp94.js";
+import { t as GCSStorageController } from "./GCSStorageController-40FyFeSx.js";
+import { a as isHonoLike, i as loadFunctionsWithDiagnostics, n as loadFunctions, r as loadFunctionsFromDirectory } from "./function-loader-B8YzXEsQ.js";
 import { a as getDriver, c as getUser, d as identityResolved, f as isAdmin, i as getApiKey, l as getUserId, m as requireDriver, o as getRequestId, p as isAuthenticated, r as requireRole, s as getRoles, t as createFunctionRoutes, u as hasRole } from "./function-routes-RxrCHNuM.js";
-import "./proxy-CH8Jsovg.js";
-import "./request-timeout-59crS-9u.js";
+import "./proxy-BYir8tWK.js";
+import "./request-timeout-DVjo-c_8.js";
 import { t as FunctionSelectionError } from "./selection-CRpqKUbt.js";
-import { a as loadCrons, i as loadCronJobsWithDiagnostics, n as declareCrons, r as loadCronJobsFromDirectory } from "./cron-loader-Dj6lA4HQ.js";
-import { t as createCronRoutes } from "./cron-routes-CwbLZguO.js";
-import { a as listBackupObjects, c as readBackupBytes, i as backupStorageFromEnv, n as createBackupLinkRoutes, o as parseBackupDestination, r as createBackupRoutes, s as parseBackupTimestamp } from "./backup-B9m3cb3X.js";
-import { a as defaultBackoff, i as createJobQueue, n as createJobStore, o as currentAmbientTransaction, r as PermanentJobError } from "./jobs-h1WRq3cp.js";
-import { t as METRIC_SERIES } from "./history-store-DPofGVDp.js";
+import { a as loadCrons, i as loadCronJobsWithDiagnostics, n as declareCrons, r as loadCronJobsFromDirectory } from "./cron-loader-mMhqbVsl.js";
+import { t as createCronRoutes } from "./cron-routes-Cs33j_Kr.js";
+import { a as listBackupObjects, c as readBackupBytes, i as backupStorageFromEnv, n as createBackupLinkRoutes, o as parseBackupDestination, r as createBackupRoutes, s as parseBackupTimestamp } from "./backup-BVbHoKo8.js";
+import { a as defaultBackoff, i as createJobQueue, n as createJobStore, o as currentAmbientTransaction, r as PermanentJobError } from "./jobs-Co6Ni5HP.js";
+import { t as METRIC_SERIES } from "./history-store-BQz5YCkW.js";
 import { createHash, createSign, randomBytes } from "node:crypto";
 import * as path$2 from "node:path";
 import path from "node:path";
@@ -302,9 +306,10 @@ var HANDLER_SLOT = Symbol.for("@rebasepro/server:unhandled-rejection-handler");
 * request path is covered — but a fire-and-forget `void syncToCrm(body)`, a
 * `setTimeout(async () => …)`, or an unawaited `.then()` in one custom function
 * rejects outside Hono's frame. The default outcome is that one project's
-* floating promise ends the process; on the managed runtime that process is
-* shared, so every other tenant on the pod goes with it, and the request log
-* points nowhere because the request itself succeeded.
+* floating promise ends the process, and with it every other route the
+* project serves — its data API, auth, realtime — and the request log points
+* nowhere because the request itself succeeded. On the managed runtime a
+* project usually has one instance, so that is an outage until it restarts.
 *
 * A logged rejection is the better trade here: the process keeps serving, and
 * the stack reaches the operator. `uncaughtException` is deliberately **not**
@@ -1714,6 +1719,75 @@ async function afterBurst() {
 	for (let turn = 0; turn < BURST_TURNS; turn++) await void 0;
 }
 //#endregion
+//#region ../common/src/util/callbacks.ts
+/**
+* Helper function to recursively check if there are any callbacks in the properties.
+*/
+function hasPropertyCallbacks(properties, callbackName) {
+	if (!properties) return false;
+	for (const property of Object.values(properties)) {
+		if (property.callbacks?.[callbackName]) return true;
+		if (property.type === "map" && property.properties) {
+			if (hasPropertyCallbacks(property.properties, callbackName)) return true;
+		} else if (property.type === "array" && property.of) {
+			const ofs = Array.isArray(property.of) ? property.of : [property.of];
+			for (const of of ofs) {
+				if (of.callbacks?.[callbackName]) return true;
+				if (of.type === "map" && of.properties && hasPropertyCallbacks(of.properties, callbackName)) return true;
+			}
+		}
+	}
+	return false;
+}
+/**
+* Recursively process properties to apply field-level hooks.
+*/
+async function processProperties(properties, values, previousValues, propsContext, callbackName) {
+	if (!values || typeof values !== "object") return values;
+	const result = { ...values };
+	for (const [key, property] of Object.entries(properties)) {
+		if (result[key] === void 0) continue;
+		let currentValue = result[key];
+		const previousValue = previousValues?.[key];
+		if (property.type === "array" && Array.isArray(currentValue)) {
+			if (property.of && !Array.isArray(property.of)) currentValue = await Promise.all(currentValue.map(async (item, index) => {
+				const prevItem = Array.isArray(previousValue) ? previousValue[index] : void 0;
+				return (await processProperties({ "_tmp": property.of }, { "_tmp": item }, { "_tmp": prevItem }, propsContext, callbackName))["_tmp"];
+			}));
+		} else if (property.type === "map" && property.properties && typeof currentValue === "object") currentValue = await processProperties(property.properties, currentValue, previousValue ?? {}, propsContext, callbackName);
+		if (property.callbacks?.[callbackName]) {
+			const cbRes = await Promise.resolve(property.callbacks[callbackName]({
+				...propsContext,
+				value: currentValue,
+				previousValue
+			}));
+			if (cbRes !== void 0) currentValue = cbRes;
+		}
+		result[key] = currentValue;
+	}
+	return result;
+}
+/**
+* Helper function to extract field-level PropertyCallbacks from a properties schema
+* and wrap them into an CollectionCallbacks object recursively.
+*/
+var buildPropertyCallbacks = (properties) => {
+	if (!properties) return void 0;
+	const propertyCallbacks = {};
+	if (hasPropertyCallbacks(properties, "afterRead")) propertyCallbacks.afterRead = async (props) => {
+		const row = props.row;
+		const processedValues = await processProperties(properties, row, row, props, "afterRead");
+		return {
+			...props.row,
+			...processedValues
+		};
+	};
+	if (hasPropertyCallbacks(properties, "beforeSave")) propertyCallbacks.beforeSave = async (props) => {
+		return await processProperties(properties, props.values, props.previousValues ?? {}, props, "beforeSave");
+	};
+	return Object.keys(propertyCallbacks).length > 0 ? propertyCallbacks : void 0;
+};
+//#endregion
 //#region ../common/src/data/filter-conditions.ts
 /**
 * Read one field's filter as the list of conditions it stands for.
@@ -5847,6 +5921,8 @@ function createAdmin(transport, options) {
 		if (options?.search) params.set("search", options.search);
 		if (options?.orderBy) params.set("orderBy", options.orderBy);
 		if (options?.orderDir) params.set("orderDir", options.orderDir);
+		if (options?.role) params.set("role", options.role);
+		if (options?.ids) params.set("ids", options.ids.join(","));
 		const qs = params.toString();
 		return transport.request(adminPath + "/users" + (qs ? "?" + qs : ""), { method: "GET" });
 	}
@@ -6606,10 +6682,23 @@ function requestTimeoutError(written) {
 * connection has been down for longer than a blip. The registration is kept and
 * resumes when the socket is back.
 */
-function realtimeLostError() {
+function realtimeLostError(refusal) {
+	if (refusal) return new RebaseApiError(`The server refused this realtime connection (${refusal.code}: ${refusal.message}), so live data is not updating. The client keeps retrying, more slowly each time, and refreshes this subscription once it is let in.`, {
+		code: "CONNECTION_LOST",
+		details: { reason: refusal.code },
+		cause: refusal
+	});
 	return new RebaseApiError("The realtime connection is down, so live data is not updating. The client keeps reconnecting and refreshes this subscription when the connection is back.", { code: "CONNECTION_LOST" });
 }
 /**
+* Whether `error` is the server refusing this socket for its per-user ceiling
+* (`REALTIME_MAX_SOCKETS_PER_USER`): it answers AUTHENTICATE with
+* `TOO_MANY_SOCKETS` and closes the socket.
+*/
+function isSocketCeilingRefusal(error) {
+	return error instanceof RebaseApiError && error.code === "TOO_MANY_SOCKETS";
+}
+/**
 * Whether realtime debugging is on: `globalThis.__REBASE_DEBUG_REALTIME__ = true`,
 * set from a console or a test. While it is, each refetched row that differs
 * from the one held is explained key by key with `console.debug`.
@@ -6618,17 +6707,28 @@ function realtimeDebugOn() {
 	return Reflect.get(globalThis, "__REBASE_DEBUG_REALTIME__") === true;
 }
 /**
-* Connection chatter: the socket opened, signed in, closed, is redialling.
-*
-* `console.debug` where that is a debug level — a browser's console hides it
-* unless Verbose is asked for. Not in Node, where `console.debug` is
-* `console.log`: a script's `listen()` opened its stdout with "Connected to
-* PostgreSQL backend" and "WebSocket auto-authenticated", ahead of what the
-* script prints. There it is written only while realtime debugging is on.
+* The `localStorage` key that turns connection logging on for one browser,
+* without a code change or a rebuild: `localStorage.setItem("rebase_debug", "1")`
+* in its console. For a page that loads the client as a plain script, where
+* `createRebaseClient({ debug: true })` means editing and redeploying the site.
 */
-function connectionDebug(...args) {
-	if (!(typeof window !== "undefined" || typeof document !== "undefined") && !realtimeDebugOn()) return;
-	console.debug(...args);
+var DEBUG_STORAGE_KEY = "rebase_debug";
+/**
+* Whether connection logging was switched on from outside the code:
+* `globalThis.__REBASE_DEBUG__`, `globalThis.__REBASE_DEBUG_REALTIME__` (which
+* also explains refetched rows), or {@link DEBUG_STORAGE_KEY} in this
+* browser's `localStorage`. Read at each line, so it can be switched on in a
+* console without reloading a page whose socket is already open.
+*/
+function debugSwitchedOn() {
+	if (Reflect.get(globalThis, "__REBASE_DEBUG__") === true || realtimeDebugOn()) return true;
+	if (typeof window === "undefined" || typeof localStorage === "undefined") return false;
+	try {
+		const value = localStorage.getItem(DEBUG_STORAGE_KEY);
+		return value === "1" || value === "true";
+	} catch {
+		return false;
+	}
 }
 /**
 * The codes an `AUTHENTICATE` is refused with when the server will not honour
@@ -6950,11 +7050,28 @@ var RebaseWebSocketClient = class {
 	onUnauthorized;
 	refreshInProgress = null;
 	impersonate;
+	debug;
+	/**
+	* Connection chatter: the socket opened, signed in, closed, is redialling.
+	*
+	* Silent unless asked for, with the `debug` option or
+	* {@link debugSwitchedOn}. It used to go to `console.debug` in every
+	* browser: a public page printed "Connected to PostgreSQL backend" and
+	* "WebSocket auto-authenticated" to each visitor's console, naming the
+	* backend on every load. In Node, where `console.debug` is `console.log`,
+	* it opened a script's stdout ahead of what the script prints. Warnings and
+	* errors are not chatter and are always written.
+	*/
+	connectionDebug(...args) {
+		if (!this.debug && !debugSwitchedOn()) return;
+		console.debug(...args);
+	}
 	constructor(config) {
 		this.websocketUrl = config.websocketUrl;
 		this.getAuthToken = config.getAuthToken;
 		this.onUnauthorized = config.onUnauthorized;
 		this.impersonate = config.impersonate;
+		this.debug = config.debug === true;
 		this.WebSocketConstructor = config.WebSocket || (typeof WebSocket !== "undefined" ? WebSocket : void 0);
 	}
 	/**
@@ -6993,7 +7110,7 @@ var RebaseWebSocketClient = class {
 		if (this.closedByCaller) return;
 		if (this.connectionState !== "reconnecting" && this.connectionState !== "disconnected") return;
 		if (this.ws) return;
-		connectionDebug(`${reason} — retrying the realtime connection`);
+		this.connectionDebug(`${reason} — retrying the realtime connection`);
 		if (this.reconnectTimeout) {
 			clearTimeout(this.reconnectTimeout);
 			this.reconnectTimeout = null;
@@ -7043,6 +7160,21 @@ var RebaseWebSocketClient = class {
 		}
 		return true;
 	}
+	/** Whether the current run of ceiling refusals has been said in the console. */
+	socketCeilingWarned = false;
+	/**
+	* The server refused this socket for its per-user ceiling. Said once per
+	* run of refusals, as a warning, and reported to every registration at
+	* once as an outage — a refusal is not a blip that the next dial fixes.
+	*/
+	noteSocketCeiling(error) {
+		if (!this.socketCeilingWarned) {
+			this.socketCeilingWarned = true;
+			console.warn(`[Rebase] Realtime: the server refused this connection (${error.code}: ${error.message}). Live data is not updating; the client retries, more slowly each time, until another connection closes.`);
+		}
+		this.clearOutageTimer();
+		this.reportConnectionLost(error);
+	}
 	/**
 	* Authenticate the WebSocket connection
 	*/
@@ -7091,10 +7223,10 @@ var RebaseWebSocketClient = class {
 		if (this.isConnected && !this.isAuthenticated && !this.authPromise) this.getAuthToken().then((token) => {
 			if (!this.ws) return;
 			if (token) this.authenticate(token).catch((e) => {
-				if (this.ws) connectionDebug("WebSocket auto-auth skipped:", e?.message || e);
+				if (this.ws) this.connectionDebug("WebSocket auto-auth skipped:", e?.message || e);
 			});
 		}).catch((e) => {
-			if (this.ws) connectionDebug("WebSocket auto-auth skipped:", e?.message || e);
+			if (this.ws) this.connectionDebug("WebSocket auto-auth skipped:", e?.message || e);
 		});
 	}
 	/**
@@ -7145,15 +7277,12 @@ var RebaseWebSocketClient = class {
 			const socket = new this.WebSocketConstructor(withOptIns(this.websocketUrl));
 			this.ws = socket;
 			this.ws.onopen = async () => {
-				connectionDebug("Connected to PostgreSQL backend");
+				this.connectionDebug("Connected to PostgreSQL backend");
 				const wasReconnect = this.hadConnection;
 				this.hadConnection = true;
 				this.isConnected = true;
-				this.reconnectAttempts = 0;
-				this.clearOutageTimer();
-				this.outageReported = false;
 				this.gaveUp = false;
-				this.setState("connected");
+				if (!this.outageReported) this.setState("connected");
 				this.refusedSession = null;
 				if (this.getAuthToken && !this.isAuthenticated) {
 					let token = null;
@@ -7161,12 +7290,22 @@ var RebaseWebSocketClient = class {
 						token = await this.getAuthToken();
 						if (token) {
 							await this.authenticate(token);
-							connectionDebug("WebSocket auto-authenticated");
+							this.connectionDebug("WebSocket auto-authenticated");
 						}
 					} catch (error) {
-						if (!(token && this.noteSessionRefused(token, error))) connectionDebug("WebSocket connected, not signed in yet:", error?.message || error);
+						if (isSocketCeilingRefusal(error)) {
+							this.noteSocketCeiling(error);
+							return;
+						}
+						if (!(token && this.noteSessionRefused(token, error))) this.connectionDebug("WebSocket connected, not signed in yet:", error?.message || error);
 					}
 				}
+				if (this.ws !== socket) return;
+				this.reconnectAttempts = 0;
+				this.clearOutageTimer();
+				this.outageReported = false;
+				this.socketCeilingWarned = false;
+				this.setState("connected");
 				this.emit(wasReconnect ? "reconnect" : "connect");
 				this.processMessageQueue(wasReconnect);
 				if (wasReconnect) this.resubscribeAll();
@@ -7182,7 +7321,7 @@ var RebaseWebSocketClient = class {
 				}
 			};
 			const onClosed = () => {
-				connectionDebug("Disconnected from PostgreSQL backend");
+				this.connectionDebug("Disconnected from PostgreSQL backend");
 				this.stopLivenessWatch();
 				this.forgetServerOptIns();
 				if (this.ws === socket) this.ws = null;
@@ -7312,7 +7451,7 @@ var RebaseWebSocketClient = class {
 		this.reconnectAttempts = Math.min(this.reconnectAttempts + 1, 30);
 		const ceiling = Math.min(1e3 * Math.pow(2, this.reconnectAttempts), MAX_RECONNECT_DELAY_MS);
 		const delay = MIN_RECONNECT_DELAY_MS + Math.floor(Math.random() * (ceiling - MIN_RECONNECT_DELAY_MS));
-		connectionDebug(`Attempting to reconnect in ${delay}ms (attempt ${this.reconnectAttempts})`);
+		this.connectionDebug(`Attempting to reconnect in ${delay}ms (attempt ${this.reconnectAttempts})`);
 		if (this.reconnectTimeout) clearTimeout(this.reconnectTimeout);
 		this.reconnectTimeout = setTimeout(() => {
 			this.reconnectTimeout = null;
@@ -7338,11 +7477,11 @@ var RebaseWebSocketClient = class {
 		if (this.outageTimer) clearTimeout(this.outageTimer);
 		this.outageTimer = null;
 	}
-	reportConnectionLost() {
+	reportConnectionLost(refusal) {
 		if (this.outageReported) return;
 		this.outageReported = true;
 		this.setState("disconnected");
-		const error = realtimeLostError();
+		const error = realtimeLostError(refusal);
 		for (const subscription of this.collectionSubscriptions.values()) this.notifyError(subscription.callbacks, error);
 		for (const subscription of this.singleSubscriptions.values()) this.notifyError(subscription.callbacks, error);
 		for (const handler of [...this.connectionLostHandlers]) try {
@@ -7588,7 +7727,7 @@ var RebaseWebSocketClient = class {
 				if (!token) throw new Error("user not logged in");
 				if (this.refusedSession?.token === token) throw this.refusedSession.error;
 				await this.authenticate(token);
-				connectionDebug("WebSocket authenticated on demand");
+				this.connectionDebug("WebSocket authenticated on demand");
 				return;
 			} catch (error) {
 				lastError = error;
@@ -7607,7 +7746,7 @@ var RebaseWebSocketClient = class {
 				}
 				if (attempt < retryCount - 1) {
 					const delay = Math.min(1e3 * (attempt + 1), 3e3);
-					connectionDebug(`WebSocket auth attempt ${attempt + 1} failed, retrying in ${delay}ms...`);
+					this.connectionDebug(`WebSocket auth attempt ${attempt + 1} failed, retrying in ${delay}ms...`);
 					await new Promise((resolve) => setTimeout(resolve, delay));
 				}
 			}
@@ -7622,7 +7761,7 @@ var RebaseWebSocketClient = class {
 			const token = await this.getAuthToken();
 			if (!token) throw new Error("user not logged in");
 			await this.authenticate(token);
-			connectionDebug("WebSocket reauthenticated successfully");
+			this.connectionDebug("WebSocket reauthenticated successfully");
 		} catch (error) {
 			console.error("WebSocket reauthentication failed:", error);
 			throw error;
@@ -8312,7 +8451,7 @@ var RebaseWebSocketClient = class {
 	* we need to re-register everything to resume receiving updates.
 	*/
 	resubscribeAll() {
-		connectionDebug(`[WS] Re-subscribing: ${this.collectionSubscriptions.size} collection(s), ${this.singleSubscriptions.size} row(ies)`);
+		this.connectionDebug(`[WS] Re-subscribing: ${this.collectionSubscriptions.size} collection(s), ${this.singleSubscriptions.size} row(ies)`);
 		for (const [key, sub] of this.collectionSubscriptions.entries()) {
 			if (sub.subscribeInFlight) continue;
 			const oldBackendId = sub.backendSubscriptionId;
@@ -8600,12 +8739,28 @@ var RebaseRealtimeChannel = class {
 	*/
 	async broadcast(event, payload) {
 		await this.join();
+		this.rememberOwnSender(this.transport.socketClientId);
 		await this.send("broadcast", {
 			event,
 			payload
 		});
 	}
 	/**
+	* The socket ids this channel has broadcast from — the current one and the
+	* ones before a reconnect. A message in history from any of them is this
+	* client's own, and a sender is never sent its own messages: replayed after
+	* a reconnect whose `broadcast_ack` was lost, it was applied twice.
+	*/
+	ownSenderIds = /* @__PURE__ */ new Set();
+	rememberOwnSender(id) {
+		if (id === void 0 || this.ownSenderIds.has(id)) return;
+		this.ownSenderIds.add(id);
+		if (this.ownSenderIds.size > 16) {
+			const oldest = this.ownSenderIds.values().next().value;
+			if (oldest !== void 0) this.ownSenderIds.delete(oldest);
+		}
+	}
+	/**
 	* Observe refusals about this channel.
 	*
 	* `CHANNEL_FORBIDDEN` when an authorizer refuses a join, a broadcast or a
@@ -8778,7 +8933,7 @@ var RebaseRealtimeChannel = class {
 				for (const entry of entries) {
 					if (entry.seq <= this.lastSeq) continue;
 					this.lastSeq = entry.seq;
-					if (ownId !== void 0 && entry.senderId === ownId) continue;
+					if (ownId !== void 0 && (entry.senderId === ownId || entry.senderId !== void 0 && this.ownSenderIds.has(entry.senderId))) continue;
 					this.deliver({
 						event: entry.event,
 						payload: entry.payload,
@@ -8925,7 +9080,7 @@ var LazyOfflineManager = class {
 	keepsLastUser;
 	constructor(config, createInner) {
 		this.keepsLastUser = config.keepLastUser === true;
-		import("./offline-BrqCRgih-BtDB1ecy.js").then(({ OfflineManager: Engine }) => {
+		import("./offline-AvuEcg7u-DFHL98OT.js").then(({ OfflineManager: Engine }) => {
 			const engine = new Engine(config, createInner);
 			this.engine = engine;
 			const queued = this.queued;
@@ -9000,6 +9155,9 @@ var LazyOfflineManager = class {
 	setScope(uid, options) {
 		this.run((engine) => engine.setScope(uid, options)).catch(() => void 0);
 	}
+	onReachedUnconfirmed(listener) {
+		return this.subscribe((engine) => engine.onReachedUnconfirmed(listener));
+	}
 	async resumeLastUser() {
 		await await this.run((engine) => engine.resumeLastUser());
 	}
@@ -9155,7 +9313,8 @@ function createRebaseClient(options) {
 			websocketUrl: resolvedWsUrl,
 			getAuthToken: () => transport.resolveToken(),
 			onUnauthorized: () => onUnauthorized(),
-			impersonate: options.impersonate
+			impersonate: options.impersonate,
+			debug: options.debug
 		});
 		let realtimeUid = auth.getSession()?.user?.uid ?? null;
 		auth.onAuthStateChange((event, session) => {
@@ -9232,15 +9391,19 @@ function createRebaseClient(options) {
 		});
 		if (offlineManager.keepsLastUser) {
 			let confirming = false;
-			offlineManager.api.onStatusChange((status) => {
-				if (!status.online || !status.unverifiedUser || confirming || auth.getSession()) return;
+			const confirm = () => {
+				if (confirming || auth.getSession()) return;
 				confirming = true;
 				auth.refreshSession().catch((error) => {
 					if (error instanceof RebaseApiError && error.status !== void 0 && error.status >= 400 && error.status < 500 && !auth.getSession()) offlineManager.setScope(void 0);
 				}).finally(() => {
 					confirming = false;
 				});
+			};
+			offlineManager.api.onStatusChange((status) => {
+				if (status.online && status.unverifiedUser) confirm();
 			});
+			offlineManager.onReachedUnconfirmed(confirm);
 		}
 	}
 	/**
@@ -9301,11 +9464,12 @@ function createRebaseClient(options) {
 					}
 				});
 			}
+			const slug = toSnakeCase(prop);
 			if (!untypedWarned) {
 				untypedWarned = true;
-				console.warn(`[Rebase] Untyped data access detected (client.data.${prop}). Collection names are resolved via snake_case conversion, which may cause silent 404s at request time. Pass a \`collections\` dictionary to createRebaseClient() or use the generated SDK for type-safe access.`);
+				console.warn(`[Rebase] Untyped data access detected: client.data.${prop} was sent to /data/${slug}, its name in snake_case, because this client has no \`collections\` dictionary. A collection whose slug is not that (a kebab-case slug, a renamed accessor) answers 404. With generated types, pass \`collections: collectionsDictionary\` (from generated/sdk/database.types) to createRebaseClient(); a typed client needs it. Otherwise use client.data.collection("<slug>").`);
 			}
-			return collection(toSnakeCase(prop));
+			return collection(slug);
 		},
 		has(_target, prop) {
 			if (prop === "collection") return true;
@@ -9372,6 +9536,28 @@ channel: (name, options) => {
 			onUnauthorized = handler;
 		},
 		resolveToken: transport.resolveToken,
+		simulate: (simulation) => {
+			const derived = createRebaseClient({
+				baseUrl: options.baseUrl,
+				apiPath: options.apiPath,
+				fetch: options.fetch,
+				collections: options.collections,
+				schemaVersion: options.schemaVersion,
+				headers: {
+					...options.headers ?? {},
+					...simulationHeaders(simulation)
+				},
+				realtime: false,
+				auth: {
+					storage: createMemoryStorage(),
+					persistSession: false,
+					autoRefresh: false
+				}
+			});
+			derived.setAuthTokenGetter(() => transport.resolveToken());
+			derived.setOnUnauthorized(() => onUnauthorized());
+			return derived;
+		},
 		baseUrl: transport.baseUrl,
 		apiPath: transport.apiPath,
 		collection,
@@ -10721,6 +10907,251 @@ async function loadCollectionsFromDirectory(source, options = {}) {
 	return validate(applyCollectionDefaults(collections, await readDefaults(resolved)), sources);
 }
 //#endregion
+//#region src/api/rest/idempotency.ts
+/**
+* Remembering what a write already answered, so replaying it does not do it twice.
+*
+* The offline queue replays a mutation whenever it did not see the response —
+* which includes every case where the write *committed* and the ACK was lost to
+* a dropped connection. For a collection whose id the client chooses, the replay
+* collides on that id and the client can recognise its own earlier attempt. For
+* a collection with a serial id it cannot: the server ignored the id the client
+* invented and assigned its own, so the replay is indistinguishable from a new
+* row and inserts a second one. The scaffold's own collections use
+* `isId: "increment"`, so that is the default case, not an exotic one.
+*
+* A key is honoured only for the principal that created it. Mutation ids are
+* generated on the client, so keying on the id alone would let anyone who
+* learned (or guessed) another user's id replay their key and be handed that
+* user's row back — a read of someone else's data through a write endpoint.
+* That is also why an unauthenticated caller gets no idempotency at all: every
+* anonymous request shares one principal, so honouring a key there would hand
+* one visitor's stored response to the next one who sent the same string.
+*/
+var TABLE = "\"rebase\".\"idempotency_keys\"";
+/**
+* How long a replay is recognised. Long enough to cover an offline stretch and
+* a retry schedule; short enough that the table stays small and a key cannot be
+* replayed indefinitely. Rows past this are pruned opportunistically rather than
+* by a scheduled job — there is no cron guaranteed to be running.
+*/
+var TTL_HOURS = 24;
+/**
+* How long a claim that has not answered yet is presumed to still be running.
+*
+* A claim is taken before the write and given back after it, so every exit the
+* process does not survive — a rolled pod, an OOM kill, a node drain, a
+* `complete` that itself fails — leaves the row pending with nobody coming back
+* for it. Reusing the 24-hour replay window as the lease made that
+* indistinguishable from a request still in flight, so every retry of that key
+* was refused for a day: the mechanism turned a write that plain retrying would
+* have completed into permanent loss, which is worse than not having it at all.
+*
+* The number trades the two ways it can be wrong, and both are bounded. Too
+* short and a genuinely slow write has its key taken over by its own retry —
+* the duplicate this exists to prevent. Too long and a crashed claim refuses
+* its retries for that long. A minute outlasts any write the row cap allows
+* and stays well inside the window the offline queue keeps retrying for.
+*/
+var PENDING_LEASE_SECONDS = 60;
+/**
+* How long to wait before attempting the table creation again after it failed.
+*
+* `ensure`'s answer used to be memoised unconditionally, so one transient DDL
+* failure — a database still starting, a lock on the `rebase` schema, a sibling
+* pod running the same `CREATE TABLE IF NOT EXISTS` — disabled idempotency on
+* that pod for the life of the process after a single log line. A failure is
+* retried instead, and the cooldown is what stops every keyed request re-running
+* DDL against a database that is genuinely unhappy.
+*/
+var ENSURE_RETRY_COOLDOWN_MS = 3e4;
+/**
+* The principal a key belongs to, or `undefined` when there is nobody to scope
+* it to and the key must therefore be ignored.
+*
+* Anonymous callers are a supported configuration — `auth.requireAuth: false`
+* delegates access control to RLS — and they used to share one sentinel
+* principal, which is exactly the cross-principal replay the note above says
+* must not happen: two visitors of a public form who send the same key string
+* are handed each other's stored response. Refusing the key degrades them to no
+* idempotency, which is what they had before this table existed.
+*/
+function principal(uid) {
+	return uid && uid.length > 0 ? uid : void 0;
+}
+/**
+* A stable rendering of a JSON value: one body always produces one string,
+* whatever order its keys arrived in.
+*
+* `JSON.stringify` preserves insertion order, so two encodings of the same
+* object would fingerprint differently and a legitimate retry would be refused
+* as a reused key. Only JSON types reach here — the value came from `JSON.parse`.
+*/
+function stableStringify$1(value) {
+	if (value === null || typeof value !== "object") return JSON.stringify(value) ?? "null";
+	if (Array.isArray(value)) return `[${value.map(stableStringify$1).join(",")}]`;
+	return `{${Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([k, v]) => `${JSON.stringify(k)}:${stableStringify$1(v)}`).join(",")}}`;
+}
+/**
+* A query string with its parameters in a fixed order, so one request written
+* two ways is one request. Sorted by name only: the sort is stable, so a
+* repeated parameter keeps the order its values were sent in.
+*/
+function canonicalQuery(query) {
+	return [...query.entries()].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([name, value]) => `${encodeURIComponent(name)}=${encodeURIComponent(value)}`).join("&");
+}
+/**
+* What a key was claimed *for*, so presenting it on a different request is
+* caught instead of silently replaying the first one's answer.
+*
+* Nothing about the request used to enter the key, so `createMany(rows, { key })`
+* followed by `deleteMany(ids, { key })` — the reusable business id the docs
+* recommended — answered the delete with the create's `200` body and deleted
+* nothing. Method and path separate the routes; the body separates a re-run
+* carrying corrected rows from the retry of an unanswered one, which is the
+* difference between "here is your earlier answer" and silently discarding a
+* correction.
+*
+* The query string separates instructions sent to one path: `?hard=true` purges
+* where the same `DELETE` without it soft-deletes, and `?on_conflict=` makes a
+* create an upsert. Left out, a purge sent under the soft delete's key was
+* answered with that delete's `204` and never ran. A request with no query
+* string fingerprints exactly as it did before one could enter.
+*/
+function requestFingerprint(method, path, body, query) {
+	const search = query ? canonicalQuery(query) : "";
+	return sha256Hex(`${method.toUpperCase()} ${path}${search ? `?${search}` : ""}\n${stableStringify$1(body)}`);
+}
+/**
+* Returns `undefined` when the driver cannot run SQL, which disables the whole
+* mechanism rather than failing writes: a document backend has no table to put
+* this in, and refusing to serve is far worse than the duplicate this prevents.
+*
+* Every method swallows its own errors for the same reason. A write must not
+* fail because the bookkeeping around it did — the worst case of a failed
+* `remember` is the duplicate we already have today, while a thrown error would
+* reject a write the database has already accepted.
+*/
+function createIdempotencyStore(driver, options = {}) {
+	const admin = driver.admin;
+	if (!isSQLAdmin(admin)) return void 0;
+	const exec = (sql, params) => admin.executeSql(sql, params ? { params } : void 0);
+	let ready;
+	let retryEnsureAt = 0;
+	let warnedAnonymous = false;
+	let warnedMissing = false;
+	/**
+	* What a backend that may not create the table does instead: read it, with
+	* every column the statements below name, so a table an older release made
+	* — without `fingerprint` — counts as absent rather than failing each claim.
+	*/
+	const probe = async () => {
+		try {
+			await exec(`SELECT key, uid, fingerprint, response, created_at FROM ${TABLE} WHERE false`);
+			return true;
+		} catch (error) {
+			retryEnsureAt = Date.now() + ENSURE_RETRY_COOLDOWN_MS;
+			if (!warnedMissing) {
+				warnedMissing = true;
+				logger.warn(`Idempotency keys unavailable — ${TABLE} is missing or out of date, and this backend changes nothing in its database. Idempotency-Key is ignored, so a replayed offline write may insert a duplicate row, until the table is created by a provisioning run.`, { detail: error instanceof Error ? error.message : String(error) });
+			}
+			return false;
+		}
+	};
+	/** Said once per process: it is a deployment fact, not a per-request event. */
+	const warnAnonymous = () => {
+		if (warnedAnonymous) return;
+		warnedAnonymous = true;
+		logger.warn("Idempotency-Key ignored for an unauthenticated request — keys are scoped to a signed-in principal, and honouring one here would replay a stored response to whoever sends the same key next. A replayed write from an anonymous client may insert a duplicate row.");
+	};
+	/** Created on first use: most deployments never send a key at all. */
+	const ensure = () => {
+		if (ready) return ready;
+		if (Date.now() < retryEnsureAt) return Promise.resolve(false);
+		ready = (options.provision === false ? probe() : (async () => {
+			try {
+				await exec("CREATE SCHEMA IF NOT EXISTS rebase");
+				await exec(`
+                    CREATE TABLE IF NOT EXISTS ${TABLE} (
+                        key TEXT NOT NULL,
+                        uid TEXT NOT NULL,
+                        response JSONB,
+                        created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+                        PRIMARY KEY (uid, key)
+                    )
+                `);
+				await exec(`ALTER TABLE ${TABLE} ADD COLUMN IF NOT EXISTS fingerprint TEXT`);
+				await exec(`CREATE INDEX IF NOT EXISTS idx_idempotency_created ON ${TABLE}(created_at)`);
+				await exec(revokeInternalTableSql("rebase", "idempotency_keys"));
+				return true;
+			} catch (error) {
+				retryEnsureAt = Date.now() + ENSURE_RETRY_COOLDOWN_MS;
+				logger.warn("Idempotency keys unavailable — a replayed offline write may insert a duplicate row.", { detail: error instanceof Error ? error.message : String(error) });
+				return false;
+			}
+		})()).then((ok) => {
+			if (!ok) ready = void 0;
+			return ok;
+		});
+		return ready;
+	};
+	return {
+		async claim(key, uid, fingerprint) {
+			const owner = principal(uid);
+			if (key && !owner) warnAnonymous();
+			if (!key || !owner || !await ensure()) return { status: "claimed" };
+			try {
+				if ((await exec(`INSERT INTO ${TABLE} (key, uid, fingerprint, response, created_at)
+                     VALUES ($1, $2, $3, NULL, NOW())
+                     ON CONFLICT (uid, key) DO UPDATE
+                       SET response = NULL, created_at = NOW(), fingerprint = EXCLUDED.fingerprint
+                       WHERE (${TABLE}.response IS NULL
+                              AND ${TABLE}.created_at < NOW() - INTERVAL '${PENDING_LEASE_SECONDS} seconds')
+                          OR (${TABLE}.response IS NOT NULL
+                              AND ${TABLE}.created_at < NOW() - INTERVAL '${TTL_HOURS} hours')
+                     RETURNING 1 AS claimed`, [
+					key,
+					owner,
+					fingerprint
+				])).length > 0) return { status: "claimed" };
+				const row = (await exec(`SELECT response, response IS NULL AS pending, fingerprint FROM ${TABLE}
+                     WHERE uid = $1 AND key = $2`, [owner, key]))[0];
+				if (!row) return { status: "claimed" };
+				if (row.fingerprint != null && row.fingerprint !== fingerprint) return { status: "mismatch" };
+				if (row.pending) return { status: "in-flight" };
+				return {
+					status: "replay",
+					response: row.response
+				};
+			} catch {
+				return { status: "claimed" };
+			}
+		},
+		async complete(key, uid, response) {
+			const owner = principal(uid);
+			if (!key || !owner || !await ensure()) return;
+			try {
+				await exec(`UPDATE ${TABLE} SET response = $3::jsonb WHERE uid = $1 AND key = $2`, [
+					owner,
+					key,
+					JSON.stringify(response ?? null)
+				]);
+				if (Math.random() < .01) await exec(`DELETE FROM ${TABLE} WHERE created_at < NOW() - INTERVAL '${TTL_HOURS} hours'`);
+			} catch {}
+		},
+		async release(key, uid) {
+			const owner = principal(uid);
+			if (!key || !owner || !await ensure()) return;
+			try {
+				await exec(`DELETE FROM ${TABLE} WHERE uid = $1 AND key = $2 AND response IS NULL`, [owner, key]);
+			} catch {}
+		},
+		ensureTable: ensure
+	};
+}
+/** The header the client sends. Matches the widely used Stripe/IETF spelling. */
+var IDEMPOTENCY_HEADER = "Idempotency-Key";
+//#endregion
 //#region src/boot/version-skew.ts
 /**
 * Telling a *stale* driver apart from a driver that never had the feature.
@@ -10930,10 +11361,65 @@ function readRuntimeVersion(roots) {
 function describeAdapter(target) {
 	return target.driverPackage ? `the adapter from "${target.driverPackage}" (engine "${target.engine}")` : `this project's "${target.engine}" adapter`;
 }
+/** `REBASE_MIGRATE_ON_BOOT=none` opts a deployment out of both phases. */
 function provisioningDisabled(env = process.env) {
 	return (env.REBASE_MIGRATE_ON_BOOT || "ensure") === "none";
 }
 /**
+* `REBASE_PROVISION`: whether this deployment may change its own database.
+*
+* `false` is the answer for a database whose schema changes only through a
+* change process somebody else runs. The backend is then built with
+* `provision: false`: no table, column, index, type, function, trigger,
+* policy, role or grant is created or altered — at boot, or later by a request
+* that would have created a table on first use — and none of the bookkeeping
+* writes a provisioning boot makes (the first admin account, version stamps)
+* happens either. What the database lacks is reported, by name, instead.
+*
+* Wider than `REBASE_MIGRATE_ON_BOOT=none`, and deliberately a second
+* variable rather than a new meaning for that one. `none` has only ever turned
+* off the *collection* schema; the framework's own tables stayed current on
+* every boot, and deployments rely on that — the chart's migration-Job
+* topology runs every api pod with `none`. Widening `none` would stop those
+* pods keeping `rebase.*` current on the next upgrade, silently.
+*
+* A blank value is unset, for the same reason as `REBASE_PROVISION_ONLY`: a
+* compose file writes `${REBASE_PROVISION}` with nothing behind it all the
+* time. Anything else that is not a yes or a no is refused rather than
+* guessed at — read as `true`, a typo would leave a change-managed database
+* being changed.
+*/
+function resolveProvisionEnv(env = process.env) {
+	const raw = (env.REBASE_PROVISION ?? "").trim();
+	if (raw === "" || raw === "true") return true;
+	if (raw === "false") return false;
+	throw new Error(`REBASE_PROVISION must be "true" or "false" (got "${env.REBASE_PROVISION}"). \`false\` keeps every schema change out of this backend's boot.`);
+}
+/**
+* Create, now, the tables a serving process would otherwise create on first
+* use: the idempotency keys every keyed write needs, the cron tables the
+* hourly sweeps claim their slots in, and the shared rate-limit counters when
+* `REBASE_RATE_LIMIT_STORE=sql` asks for them.
+*
+* What a provisioning run calls. A deployment whose serving processes run with
+* `REBASE_PROVISION=false` never creates anything, so this run is the only
+* place those tables can come from — and its recorded SQL is only the whole
+* schema those processes need if it made them.
+*/
+async function provisionFirstUseTables(driver, env = process.env) {
+	await createCronStore(driver)?.ensureTable();
+	const idempotency = createIdempotencyStore(driver);
+	if (idempotency && !await idempotency.ensureTable()) logger.warn("Provisioning: the idempotency-key table could not be created; see the error above.");
+	if (resolveRateLimitStoreKind(env) === "sql") {
+		const rateLimits = createSqlRateLimitStore(driver);
+		if (rateLimits && !await rateLimits.ensureTable()) logger.warn("Provisioning: the shared rate-limit table could not be created; see the error above.");
+	}
+}
+/** The one line a backend that provisions nothing says about it, at boot. */
+var PROVISIONING_OFF_NOTICE = "Provisioning is off: this backend changes nothing in its database — no tables, columns, indexes, functions, triggers, policies, roles or grants. What the database lacks is reported below, by name.";
+/** Why each provisioning step skips on such a backend, phrased to follow "skipped —". */
+var PROVISIONING_OFF_SKIP_REASON = "this backend changes nothing in its database (provisioning is off), so the schema is left to whatever manages it.";
+/**
 * Ask the database whether it is there, before boot's first real query.
 *
 * Ordering is the whole point. Provisioning is the first thing in boot that
@@ -10982,7 +11468,7 @@ async function provisionCollectionTables(collections, target, options = {}) {
 			reason
 		};
 	};
-	if (options.provision === false) return skip("this process does not provision the schema — another process in this deployment owns it.");
+	if (options.provision === false) return skip(options.skipReason ?? "this process does not provision the schema — another process in this deployment owns it.");
 	if (provisioningDisabled(options.env ?? process.env)) return skip("REBASE_MIGRATE_ON_BOOT=none, leaving the database schema untouched.");
 	if (options.introspecting) return skip("this project declares no collections, so they are read from the database rather than from code.");
 	if (collections.length === 0) return skip("no collections resolved for this data source.");
@@ -11014,10 +11500,10 @@ async function provisionCollectionTables(collections, target, options = {}) {
 */
 async function provisionCollectionPolicies(collections, target, options = {}) {
 	if (options.provision === false) {
-		logger.info("Collection RLS policies: not applied by this process — another process in this deployment owns them.");
+		logger.info(options.skipReason ? `Collection RLS policies: not applied — ${options.skipReason}` : "Collection RLS policies: not applied by this process — another process in this deployment owns them.");
 		return {
 			status: "skipped",
-			reason: "another process provisions"
+			reason: options.skipReason ?? "another process provisions"
 		};
 	}
 	if (provisioningDisabled(options.env ?? process.env)) return {
@@ -11517,6 +12003,9 @@ function createRoutedRealtimeService(opts) {
 		async stopListening() {
 			await Promise.all(all().map((p) => p.stopListening?.()));
 		},
+		setScopeRunner(run) {
+			for (const p of all()) p.setScopeRunner?.(run);
+		},
 		health() {
 			return Object.entries(providers).flatMap(([key, p]) => (p.health?.() ?? []).map((listener) => ({
 				...listener,
@@ -12568,11 +13057,11 @@ function versionProperty(collection) {
 * fetched two ways from carrying two different tags, which would make every
 * `If-Match` a coin toss.
 */
-function stableStringify$1(value) {
+function stableStringify(value) {
 	if (value === null || typeof value !== "object") return JSON.stringify(value) ?? "null";
 	if (value instanceof Date) return JSON.stringify(value.toISOString());
-	if (Array.isArray(value)) return `[${value.map(stableStringify$1).join(",")}]`;
-	return `{${Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([k, v]) => `${JSON.stringify(k)}:${stableStringify$1(v)}`).join(",")}}`;
+	if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`;
+	return `{${Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([k, v]) => `${JSON.stringify(k)}:${stableStringify(v)}`).join(",")}}`;
 }
 /**
 * The entity tag for a row: quoted, per RFC 9110, and strong.
@@ -12587,7 +13076,7 @@ async function rowETag(row, collection) {
 	if (!row) return void 0;
 	const versionKey = versionProperty(collection);
 	const version = versionKey !== void 0 ? row[versionKey] : void 0;
-	return `"${await sha256Hex(version !== void 0 && version !== null ? `v:${renderVersion(version)}` : `r:${stableStringify$1(row)}`)}"`;
+	return `"${await sha256Hex(version !== void 0 && version !== null ? `v:${renderVersion(version)}` : `r:${stableStringify(row)}`)}"`;
 }
 /**
 * The version column's value, as the text a tag is hashed from.
@@ -12600,7 +13089,7 @@ async function rowETag(row, collection) {
 */
 function renderVersion(version) {
 	if (version instanceof Date) return version.toISOString();
-	return typeof version === "object" ? stableStringify$1(version) : String(version);
+	return typeof version === "object" ? stableStringify(version) : String(version);
 }
 /**
 * Split an `If-Match` header into the tags it lists.
@@ -12964,231 +13453,6 @@ async function deletingAuthCollectionUsers(adapter, collection, uids, remove) {
 	return result;
 }
 //#endregion
-//#region src/api/rest/idempotency.ts
-/**
-* Remembering what a write already answered, so replaying it does not do it twice.
-*
-* The offline queue replays a mutation whenever it did not see the response —
-* which includes every case where the write *committed* and the ACK was lost to
-* a dropped connection. For a collection whose id the client chooses, the replay
-* collides on that id and the client can recognise its own earlier attempt. For
-* a collection with a serial id it cannot: the server ignored the id the client
-* invented and assigned its own, so the replay is indistinguishable from a new
-* row and inserts a second one. The scaffold's own collections use
-* `isId: "increment"`, so that is the default case, not an exotic one.
-*
-* A key is honoured only for the principal that created it. Mutation ids are
-* generated on the client, so keying on the id alone would let anyone who
-* learned (or guessed) another user's id replay their key and be handed that
-* user's row back — a read of someone else's data through a write endpoint.
-* That is also why an unauthenticated caller gets no idempotency at all: every
-* anonymous request shares one principal, so honouring a key there would hand
-* one visitor's stored response to the next one who sent the same string.
-*/
-var TABLE = "\"rebase\".\"idempotency_keys\"";
-/**
-* How long a replay is recognised. Long enough to cover an offline stretch and
-* a retry schedule; short enough that the table stays small and a key cannot be
-* replayed indefinitely. Rows past this are pruned opportunistically rather than
-* by a scheduled job — there is no cron guaranteed to be running.
-*/
-var TTL_HOURS = 24;
-/**
-* How long a claim that has not answered yet is presumed to still be running.
-*
-* A claim is taken before the write and given back after it, so every exit the
-* process does not survive — a rolled pod, an OOM kill, a node drain, a
-* `complete` that itself fails — leaves the row pending with nobody coming back
-* for it. Reusing the 24-hour replay window as the lease made that
-* indistinguishable from a request still in flight, so every retry of that key
-* was refused for a day: the mechanism turned a write that plain retrying would
-* have completed into permanent loss, which is worse than not having it at all.
-*
-* The number trades the two ways it can be wrong, and both are bounded. Too
-* short and a genuinely slow write has its key taken over by its own retry —
-* the duplicate this exists to prevent. Too long and a crashed claim refuses
-* its retries for that long. A minute outlasts any write the row cap allows
-* and stays well inside the window the offline queue keeps retrying for.
-*/
-var PENDING_LEASE_SECONDS = 60;
-/**
-* How long to wait before attempting the table creation again after it failed.
-*
-* `ensure`'s answer used to be memoised unconditionally, so one transient DDL
-* failure — a database still starting, a lock on the `rebase` schema, a sibling
-* pod running the same `CREATE TABLE IF NOT EXISTS` — disabled idempotency on
-* that pod for the life of the process after a single log line. A failure is
-* retried instead, and the cooldown is what stops every keyed request re-running
-* DDL against a database that is genuinely unhappy.
-*/
-var ENSURE_RETRY_COOLDOWN_MS = 3e4;
-/**
-* The principal a key belongs to, or `undefined` when there is nobody to scope
-* it to and the key must therefore be ignored.
-*
-* Anonymous callers are a supported configuration — `auth.requireAuth: false`
-* delegates access control to RLS — and they used to share one sentinel
-* principal, which is exactly the cross-principal replay the note above says
-* must not happen: two visitors of a public form who send the same key string
-* are handed each other's stored response. Refusing the key degrades them to no
-* idempotency, which is what they had before this table existed.
-*/
-function principal(uid) {
-	return uid && uid.length > 0 ? uid : void 0;
-}
-/**
-* A stable rendering of a JSON value: one body always produces one string,
-* whatever order its keys arrived in.
-*
-* `JSON.stringify` preserves insertion order, so two encodings of the same
-* object would fingerprint differently and a legitimate retry would be refused
-* as a reused key. Only JSON types reach here — the value came from `JSON.parse`.
-*/
-function stableStringify(value) {
-	if (value === null || typeof value !== "object") return JSON.stringify(value) ?? "null";
-	if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`;
-	return `{${Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([k, v]) => `${JSON.stringify(k)}:${stableStringify(v)}`).join(",")}}`;
-}
-/**
-* A query string with its parameters in a fixed order, so one request written
-* two ways is one request. Sorted by name only: the sort is stable, so a
-* repeated parameter keeps the order its values were sent in.
-*/
-function canonicalQuery(query) {
-	return [...query.entries()].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([name, value]) => `${encodeURIComponent(name)}=${encodeURIComponent(value)}`).join("&");
-}
-/**
-* What a key was claimed *for*, so presenting it on a different request is
-* caught instead of silently replaying the first one's answer.
-*
-* Nothing about the request used to enter the key, so `createMany(rows, { key })`
-* followed by `deleteMany(ids, { key })` — the reusable business id the docs
-* recommended — answered the delete with the create's `200` body and deleted
-* nothing. Method and path separate the routes; the body separates a re-run
-* carrying corrected rows from the retry of an unanswered one, which is the
-* difference between "here is your earlier answer" and silently discarding a
-* correction.
-*
-* The query string separates instructions sent to one path: `?hard=true` purges
-* where the same `DELETE` without it soft-deletes, and `?on_conflict=` makes a
-* create an upsert. Left out, a purge sent under the soft delete's key was
-* answered with that delete's `204` and never ran. A request with no query
-* string fingerprints exactly as it did before one could enter.
-*/
-function requestFingerprint(method, path, body, query) {
-	const search = query ? canonicalQuery(query) : "";
-	return sha256Hex(`${method.toUpperCase()} ${path}${search ? `?${search}` : ""}\n${stableStringify(body)}`);
-}
-/**
-* Returns `undefined` when the driver cannot run SQL, which disables the whole
-* mechanism rather than failing writes: a document backend has no table to put
-* this in, and refusing to serve is far worse than the duplicate this prevents.
-*
-* Every method swallows its own errors for the same reason. A write must not
-* fail because the bookkeeping around it did — the worst case of a failed
-* `remember` is the duplicate we already have today, while a thrown error would
-* reject a write the database has already accepted.
-*/
-function createIdempotencyStore(driver) {
-	const admin = driver.admin;
-	if (!isSQLAdmin(admin)) return void 0;
-	const exec = (sql, params) => admin.executeSql(sql, params ? { params } : void 0);
-	let ready;
-	let retryEnsureAt = 0;
-	let warnedAnonymous = false;
-	/** Said once per process: it is a deployment fact, not a per-request event. */
-	const warnAnonymous = () => {
-		if (warnedAnonymous) return;
-		warnedAnonymous = true;
-		logger.warn("Idempotency-Key ignored for an unauthenticated request — keys are scoped to a signed-in principal, and honouring one here would replay a stored response to whoever sends the same key next. A replayed write from an anonymous client may insert a duplicate row.");
-	};
-	/** Created on first use: most deployments never send a key at all. */
-	const ensure = () => {
-		if (ready) return ready;
-		if (Date.now() < retryEnsureAt) return Promise.resolve(false);
-		ready = (async () => {
-			try {
-				await exec("CREATE SCHEMA IF NOT EXISTS rebase");
-				await exec(`
-                    CREATE TABLE IF NOT EXISTS ${TABLE} (
-                        key TEXT NOT NULL,
-                        uid TEXT NOT NULL,
-                        response JSONB,
-                        created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
-                        PRIMARY KEY (uid, key)
-                    )
-                `);
-				await exec(`ALTER TABLE ${TABLE} ADD COLUMN IF NOT EXISTS fingerprint TEXT`);
-				await exec(`CREATE INDEX IF NOT EXISTS idx_idempotency_created ON ${TABLE}(created_at)`);
-				await exec(revokeInternalTableSql("rebase", "idempotency_keys"));
-				return true;
-			} catch (error) {
-				retryEnsureAt = Date.now() + ENSURE_RETRY_COOLDOWN_MS;
-				logger.warn("Idempotency keys unavailable — a replayed offline write may insert a duplicate row.", { detail: error instanceof Error ? error.message : String(error) });
-				return false;
-			}
-		})().then((ok) => {
-			if (!ok) ready = void 0;
-			return ok;
-		});
-		return ready;
-	};
-	return {
-		async claim(key, uid, fingerprint) {
-			const owner = principal(uid);
-			if (key && !owner) warnAnonymous();
-			if (!key || !owner || !await ensure()) return { status: "claimed" };
-			try {
-				if ((await exec(`INSERT INTO ${TABLE} (key, uid, fingerprint, response, created_at)
-                     VALUES ($1, $2, $3, NULL, NOW())
-                     ON CONFLICT (uid, key) DO UPDATE
-                       SET response = NULL, created_at = NOW(), fingerprint = EXCLUDED.fingerprint
-                       WHERE (${TABLE}.response IS NULL
-                              AND ${TABLE}.created_at < NOW() - INTERVAL '${PENDING_LEASE_SECONDS} seconds')
-                          OR (${TABLE}.response IS NOT NULL
-                              AND ${TABLE}.created_at < NOW() - INTERVAL '${TTL_HOURS} hours')
-                     RETURNING 1 AS claimed`, [
-					key,
-					owner,
-					fingerprint
-				])).length > 0) return { status: "claimed" };
-				const row = (await exec(`SELECT response, response IS NULL AS pending, fingerprint FROM ${TABLE}
-                     WHERE uid = $1 AND key = $2`, [owner, key]))[0];
-				if (!row) return { status: "claimed" };
-				if (row.fingerprint != null && row.fingerprint !== fingerprint) return { status: "mismatch" };
-				if (row.pending) return { status: "in-flight" };
-				return {
-					status: "replay",
-					response: row.response
-				};
-			} catch {
-				return { status: "claimed" };
-			}
-		},
-		async complete(key, uid, response) {
-			const owner = principal(uid);
-			if (!key || !owner || !await ensure()) return;
-			try {
-				await exec(`UPDATE ${TABLE} SET response = $3::jsonb WHERE uid = $1 AND key = $2`, [
-					owner,
-					key,
-					JSON.stringify(response ?? null)
-				]);
-				if (Math.random() < .01) await exec(`DELETE FROM ${TABLE} WHERE created_at < NOW() - INTERVAL '${TTL_HOURS} hours'`);
-			} catch {}
-		},
-		async release(key, uid) {
-			const owner = principal(uid);
-			if (!key || !owner || !await ensure()) return;
-			try {
-				await exec(`DELETE FROM ${TABLE} WHERE uid = $1 AND key = $2 AND response IS NULL`, [owner, key]);
-			} catch {}
-		}
-	};
-}
-/** The header the client sends. Matches the widely used Stripe/IETF spelling. */
-var IDEMPOTENCY_HEADER = "Idempotency-Key";
-//#endregion
 //#region src/api/rest/query-body.ts
 /**
 * `POST /<collection>/query`: a listing whose parameters travel in the body.
@@ -13376,11 +13640,12 @@ var RestApiGenerator = class RestApiGenerator {
 	maxBulkRows;
 	listLimits;
 	authAdapter;
-	constructor(collections, driver, authAdapter, maxBulkRows = DEFAULT_MAX_BULK_ROWS, listLimits = {}) {
+	constructor(collections, driver, authAdapter, maxBulkRows = DEFAULT_MAX_BULK_ROWS, listLimits = {}, storeOptions = {}) {
 		this.collections = collections;
 		this.driver = driver;
 		this.authAdapter = authAdapter;
 		this.maxBulkRows = maxBulkRows;
+		this.provision = storeOptions.provision;
 		this.listLimits = {
 			defaultLimit: listLimits.defaultLimit ?? 50,
 			maxLimit: listLimits.maxLimit ?? 1e3
@@ -13392,8 +13657,9 @@ var RestApiGenerator = class RestApiGenerator {
 	* for SQL support and creates a table, and most requests never send a key.
 	*/
 	idempotencyStore;
+	provision;
 	idempotency() {
-		this.idempotencyStore ??= createIdempotencyStore(this.driver) ?? null;
+		this.idempotencyStore ??= createIdempotencyStore(this.driver, { provision: this.provision }) ?? null;
 		return this.idempotencyStore ?? void 0;
 	}
 	/**
@@ -13636,10 +13902,12 @@ var RestApiGenerator = class RestApiGenerator {
 	* an API key or a token.
 	*/
 	enforceApiKeyPermission(c, collectionSlug, operationOverride) {
+		const operation = operationOverride ?? httpMethodToOperation(c.req.method);
+		refuseSimulatedWrite(c, operation);
 		const narrowed = c.get("scopes");
 		if (!Array.isArray(narrowed)) return;
 		const held = narrowed.filter((entry) => typeof entry === "string");
-		const scope = `data:${operationOverride ?? httpMethodToOperation(c.req.method)}`;
+		const scope = `data:${operation}`;
 		if (!scopeGrants(held, scope, collectionSlug)) throw new ApiError(403, "SCOPE_MISSING", `This credential does not hold "${scope}" for collection "${collectionSlug}". A key needs "${scope}" or "${scope}:${collectionSlug}".`, { requiredScope: `${scope}:${collectionSlug}` });
 	}
 	/**
@@ -14693,6 +14961,41 @@ function createUnconfiguredEmailService() {
 	};
 }
 //#endregion
+//#region src/auth/adapter-service-key.ts
+function withBackendServiceKey(adapter, serviceKey) {
+	let key = serviceKey;
+	const prototype = Object.getPrototypeOf(adapter);
+	const plainObject = prototype === Object.prototype || prototype === null;
+	const bound = /* @__PURE__ */ new Map();
+	return new Proxy(adapter, {
+		get(target, property, receiver) {
+			if (property === "serviceKey") return key;
+			if (plainObject) return Reflect.get(target, property, receiver);
+			const value = Reflect.get(target, property, target);
+			if (typeof value !== "function") return value;
+			const original = value;
+			const cached = bound.get(property);
+			if (cached && cached.original === original) return cached.bound;
+			const fresh = original.bind(target);
+			bound.set(property, {
+				original,
+				bound: fresh
+			});
+			return fresh;
+		},
+		set(target, property, value, receiver) {
+			if (property === "serviceKey") {
+				key = value;
+				return true;
+			}
+			return plainObject ? Reflect.set(target, property, value, receiver) : Reflect.set(target, property, value, target);
+		},
+		has(target, property) {
+			return property === "serviceKey" || Reflect.has(target, property);
+		}
+	});
+}
+//#endregion
 //#region src/api/schema-drift.ts
 /**
 * Notice that a caller was generated against an older schema than this one.
@@ -14791,11 +15094,12 @@ function installRootErrorHandler(app) {
 *   `boot.ts` registers `/api/health` *after* `initializeRebaseBackend` returns.
 *   A catch-all would have swallowed the health probe.
 *
-* Post-processing has neither problem: it converts a 404 that came back as
-* anything but JSON, and leaves the ones that are already an envelope — a
-* storage miss, an unknown collection, an unknown function — exactly as their
-* route wrote them. Scoped to `basePath`, so an app serving its own pages at `/`
-* keeps answering its own way for the pages.
+* Post-processing has neither problem: it converts Hono's own default answer —
+* `404 Not Found`, `text/plain` — and leaves every 404 something wrote exactly
+* as it was written: the envelopes routes answer (a storage miss, an unknown
+* collection, an unknown function), a function's own text or HTML 404, and an
+* application's own `notFound`. Scoped to `basePath`, so an app serving its own
+* pages at `/` keeps answering its own way for the pages.
 *
 * `expected`, so it logs at debug. A 404 from a frontend holding a stale link is
 * routine, and a `⚠️` per request would trade a missing envelope for noise
@@ -14806,12 +15110,31 @@ function installUnmatchedApiEnvelope(app, basePath) {
 	app.use(`${prefix}/*`, async (c, next) => {
 		await next();
 		if (c.res.status !== 404) return;
-		if ((c.res.headers.get("content-type") ?? "").includes("application/json")) return;
 		if (c.req.matchedRoutes.some((route) => route.method !== "ALL")) return;
+		if (!await isHonoDefaultNotFound(c.res)) return;
 		c.res = errorHandler(new ApiError(404, "NOT_FOUND", `No route for ${c.req.method} ${c.req.path} on this backend.`, void 0, true), c);
 	});
 	logger.debug("Unmatched API routes answer the JSON envelope", { prefix });
 }
+/** What Hono's built-in not-found handler answers: `c.text("404 Not Found", 404)`. */
+var HONO_DEFAULT_NOT_FOUND_BODY = "404 Not Found";
+/**
+* Whether a 404 is Hono's default answer rather than one a handler wrote.
+*
+* Read from a clone, and only for `text/plain` — the content type Hono's
+* default carries — so a JSON envelope, an HTML page or a stream of any other
+* type is never read here.
+*/
+async function isHonoDefaultNotFound(res) {
+	if (!(res.headers.get("content-type") ?? "").startsWith("text/plain")) return false;
+	const length = res.headers.get("content-length");
+	if (length !== null && Number(length) !== 13) return false;
+	try {
+		return await res.clone().text() === HONO_DEFAULT_NOT_FOUND_BODY;
+	} catch {
+		return false;
+	}
+}
 /** Whether `onError` has been called on this app. */
 function hasOwnErrorHandler(app) {
 	const current = app.errorHandler;
@@ -15311,6 +15634,8 @@ var TOPOLOGY_ENV_VARS = [
 	"REBASE_RLS_AUDIT",
 	"REBASE_MCP_ENABLED",
 	"REBASE_MIGRATE_ON_BOOT",
+	"REBASE_PROVISION",
+	"REBASE_PROVISION_ONLY",
 	"TRUSTED_PROXY_HOPS",
 	"REBASE_RATE_LIMIT_STORE",
 	"REBASE_REQUIRE_SCHEMA_MATCH"
@@ -15468,6 +15793,30 @@ function customMetadataOfSidecar(sidecar) {
 }
 /** What the metadata kept beside an object is named: `<key>.metadata.json`. */
 var METADATA_SUFFIX = ".metadata.json";
+/** A listing page token: `n.` and the last entry name a page read, base64url. */
+var LISTING_TOKEN_PREFIX = "n.";
+function encodeListingToken(name) {
+	return LISTING_TOKEN_PREFIX + Buffer.from(name, "utf-8").toString("base64url");
+}
+/** The entry name a token this listing issued names, or `undefined` for any other string. */
+function decodeListingToken(token) {
+	if (!token.startsWith(LISTING_TOKEN_PREFIX)) return void 0;
+	const encoded = token.slice(2);
+	if (!/^[A-Za-z0-9_-]+$/.test(encoded)) return void 0;
+	const name = Buffer.from(encoded, "base64url").toString("utf-8");
+	return name && encodeListingToken(name) === token ? name : void 0;
+}
+/** The index of the first of `entries` (in name order) named after `name`. */
+function firstEntryAfter(entries, name) {
+	let low = 0;
+	let high = entries.length;
+	while (low < high) {
+		const mid = low + high >>> 1;
+		if (entries[mid].name <= name) low = mid + 1;
+		else high = mid;
+	}
+	return low;
+}
 /**
 * Refuse a key that names one of local storage's own files rather than an
 * object: the metadata beside an object, or a write in progress.
@@ -15609,6 +15958,17 @@ var LocalStorageController = class {
 		}
 	}
 	/**
+	* See {@link StorageController.storageLocation}: the default bucket's
+	* directory, with the storage root's links resolved.
+	*/
+	storageLocation() {
+		let root = this.basePath;
+		try {
+			root = fs$3.realpathSync(this.basePath);
+		} catch {}
+		return `local:${path$3.join(root, DEFAULT_BUCKET)}`;
+	}
+	/**
 	* Ensure directory exists, creating it if necessary
 	*/
 	async ensureDir(dirPath) {
@@ -15860,14 +16220,15 @@ var LocalStorageController = class {
 		const maxResults = options?.maxResults ?? 1e3;
 		if (!Number.isInteger(maxResults) || maxResults < 1) throw new InvalidListOptionsError(`maxResults must be a whole number of at least 1, got ${maxResults}.`);
 		const pageToken = options?.pageToken;
-		if (pageToken && !/^\d+$/.test(pageToken)) throw new InvalidListOptionsError(`"${pageToken}" is not a page token this listing issued.`);
-		const startIndex = pageToken ? parseInt(pageToken, 10) : 0;
+		const after = pageToken ? decodeListingToken(pageToken) : void 0;
+		if (pageToken && after === void 0) throw new InvalidListOptionsError(`"${pageToken}" is not a page token this listing issued.`);
 		const normalizedPath = normalizeStoragePath(prefix);
 		const fullPath = this.getFullPath(normalizedPath, options?.bucket);
 		const items = [];
 		const prefixes = [];
 		try {
-			const entries = await this.listingEntries(fullPath, startIndex > 0);
+			const entries = await this.listingEntries(fullPath, after !== void 0);
+			const startIndex = after === void 0 ? 0 : firstEntryAfter(entries, after);
 			let count = 0;
 			let scanned = startIndex;
 			for (let i = startIndex; i < entries.length && count < maxResults; i++) {
@@ -15889,7 +16250,7 @@ var LocalStorageController = class {
 				count++;
 			}
 			await describeListed(items, (ref) => path$3.join(fullPath, ref.name));
-			const nextPageToken = scanned < entries.length ? String(scanned) : void 0;
+			const nextPageToken = scanned < entries.length && scanned > 0 ? encodeListingToken(entries[scanned - 1].name) : void 0;
 			if (!nextPageToken) this.listingSnapshots.delete(fullPath);
 			return {
 				items,
@@ -15908,11 +16269,11 @@ var LocalStorageController = class {
 	/**
 	* A folder's entries for a listing page.
 	*
-	* A page token is an index into these entries, and every continuation
-	* page used to read the whole folder again to find its place: a folder of
+	* A page token names the last of these entries a page read, and every
+	* continuation page used to read the whole folder again to find its place: a folder of
 	* n entries listed in pages of p cost n/p full reads. A first page reads
 	* the folder and, when there is a next page, keeps the read; a
-	* continuation page indexes into it while all of these hold:
+	* continuation page finds its place in it while all of these hold:
 	*
 	*  - the folder's mtime is the one read with it. Adding, removing or
 	*    renaming an entry changes it, which is the invalidation;
@@ -15928,7 +16289,7 @@ var LocalStorageController = class {
 		const kept = this.listingSnapshots.get(fullPath);
 		if (continuation && kept && kept.mtimeMs === mtimeMs && readAt - kept.readAt < LISTING_SNAPSHOT_TTL_MS) return kept.entries;
 		this.listingSnapshots.delete(fullPath);
-		const entries = await fs$3.promises.readdir(fullPath, { withFileTypes: true });
+		const entries = (await fs$3.promises.readdir(fullPath, { withFileTypes: true })).sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
 		if (readAt - mtimeMs > LISTING_SNAPSHOT_RACY_MS && entries.length <= LISTING_SNAPSHOT_MAX_ENTRIES) {
 			this.listingSnapshots.set(fullPath, {
 				entries,
@@ -17124,6 +17485,28 @@ function createDurableRenditionCache() {
 	};
 }
 //#endregion
+//#region src/storage/maintenance-keys.ts
+/**
+* Where storage maintenance keeps its own records inside a source: the state
+* and result of an orphan scan (`rebase storage orphans`), which a worker
+* writes and any server process reads back.
+*
+* Reserved at the route layer like the rendition space, in both directions. A
+* scan's result is the list a later delete acts on, so a caller who could
+* write one could name files for an administrator's delete to remove; and it
+* lists keys a caller may not be allowed to see.
+*/
+var MAINTENANCE_PREFIX = "_rebase/maintenance/";
+/**
+* True for a key in the reserved maintenance space — the prefix itself, or
+* anything under it. Folded the way the filesystem under a local bucket folds
+* it, as {@link isRenditionKey} is.
+*/
+function isMaintenanceKey(key) {
+	const folded = key.replace(/\\/g, "/").normalize("NFKC").toLowerCase();
+	return folded.startsWith("_rebase/maintenance/") || folded === "_rebase/maintenance/".slice(0, -1);
+}
+//#endregion
 //#region src/storage/request-keys.ts
 /**
 * The checks a caller-supplied key, bucket and storage source go through
@@ -17169,12 +17552,14 @@ function objectOfPathOrBadRequest(path) {
 }
 /**
 * Run a canonicalization, refuse what it yields when that is the reserved
-* rendition space, and turn either refusal into a 400.
+* rendition or maintenance space, and turn either refusal into a 400.
 */
 function addressableOrBadRequest(canonicalize) {
 	try {
 		const canonical = canonicalize();
-		if (isRenditionKey(typeof canonical === "string" ? canonical : canonical.key)) throw new InvalidStorageKeyError(`"${RENDITION_PREFIX}" is reserved for derived image renditions and cannot be read or written directly.`);
+		const key = typeof canonical === "string" ? canonical : canonical.key;
+		if (isRenditionKey(key)) throw new InvalidStorageKeyError(`"${RENDITION_PREFIX}" is reserved for derived image renditions and cannot be read or written directly.`);
+		if (isMaintenanceKey(key)) throw new InvalidStorageKeyError(`"${MAINTENANCE_PREFIX}" is reserved for storage maintenance and cannot be read or written directly.`);
 		return canonical;
 	} catch (err) {
 		throw new ApiError(400, "INVALID_STORAGE_KEY", err instanceof InvalidStorageKeyError ? err.message : "Invalid storage key");
@@ -18685,11 +19070,11 @@ async function createStorageController(config) {
 	switch (config.type) {
 		case "local": return new LocalStorageController(config);
 		case "s3": {
-			const { S3StorageController } = await import("./S3StorageController-D00EFa5P.js").then((n) => n.n);
+			const { S3StorageController } = await import("./S3StorageController-Bl5shp94.js").then((n) => n.n);
 			return new S3StorageController(config);
 		}
 		case "gcs": {
-			const { GCSStorageController } = await import("./GCSStorageController-CRd9bFrc.js").then((n) => n.n);
+			const { GCSStorageController } = await import("./GCSStorageController-40FyFeSx.js").then((n) => n.n);
 			return new GCSStorageController(config);
 		}
 		default: throw new Error(`Unknown storage type: ${config.type}. Built-in types: local, s3, gcs. For other providers, implement the StorageController interface directly.`);
@@ -18928,7 +19313,7 @@ function noCollectionsCause(unprotected) {
 * routes wherever and as often as the application asks.
 */
 async function loadOpenApiGenerator() {
-	const { generateOpenApiSpec } = await import("./openapi-generator-BjHr6upl.js").then((n) => n.r);
+	const { generateOpenApiSpec } = await import("./openapi-generator-CyxEtYEX.js").then((n) => n.r);
 	return generateOpenApiSpec;
 }
 /**
@@ -19275,6 +19660,12 @@ function createShutdown(config) {
 			forceTimer?.unref();
 			const workDeadline = timeoutMs > 0 ? Date.now() + Math.floor(timeoutMs * WORK_DRAIN_SHARE) : void 0;
 			const workBudget = () => workDeadline === void 0 ? void 0 : Math.max(0, workDeadline - Date.now());
+			const deadline = timeoutMs > 0 ? Date.now() + timeoutMs : void 0;
+			const timeLeft = () => deadline === void 0 ? void 0 : Math.max(0, deadline - Date.now() - 100);
+			const drainWaitUntil = async (drainBudget, last) => {
+				const stillPending = await drainBackgroundWork(drainBudget);
+				if (stillPending > 0 && last) logger.warn(`${stillPending} background task(s) handed to waitUntil() did not finish within ${drainBudget}ms and are being dropped. Give them an AbortSignal, or move work this long into a cron job or the job queue, where it is restartable.`);
+			};
 			(async () => {
 				logger.info("Shutting down Rebase Backend...");
 				const cronStopped = config.cronScheduler ? Promise.resolve(config.cronScheduler.stop(workBudget())).then(() => logger.info("Cron scheduler stopped"), (err) => logger.warn("Error stopping the cron scheduler:", { error: err })) : void 0;
@@ -19282,6 +19673,7 @@ function createShutdown(config) {
 				const sweepStopped = Promise.resolve(config.authTokenSweep?.stop()).catch((err) => logger.warn("Error stopping the expired-token sweep:", { error: err }));
 				const historySweepStopped = Promise.resolve(config.historyRetentionSweep?.stop()).catch((err) => logger.warn("Error stopping the history retention sweep:", { error: err }));
 				config.stopMetricsSampler?.();
+				config.ownedRateLimitStore?.dispose?.();
 				if (config.jobQueue) {
 					await config.jobQueue.stop(workBudget());
 					logger.info("Job queue stopped");
@@ -19289,9 +19681,7 @@ function createShutdown(config) {
 				await cronStopped;
 				await sweepStopped;
 				await historySweepStopped;
-				const drainBudget = Math.min(5e3, workBudget() ?? 5e3);
-				const stillPending = await drainBackgroundWork(drainBudget);
-				if (stillPending > 0) logger.warn(`${stillPending} background task(s) handed to waitUntil() did not finish within ${drainBudget}ms and are being dropped. Give them an AbortSignal, or move work this long into a cron job or the job queue, where it is restartable.`);
+				await drainWaitUntil(Math.min(5e3, workBudget() ?? 5e3), !config.server);
 				for (const [key, rt] of Object.entries(config.realtimeServices)) try {
 					if (typeof rt.destroy === "function") {
 						await rt.destroy();
@@ -19316,9 +19706,11 @@ function createShutdown(config) {
 				server.close(() => {
 					clearInterval(sweepIdle);
 					logger.info("HTTP server closed");
-					clearTimeout(forceTimer);
-					closeEmail();
-					resolve();
+					drainWaitUntil(Math.min(5e3, timeLeft() ?? 5e3), true).then(() => {
+						clearTimeout(forceTimer);
+						closeEmail();
+						resolve();
+					});
 				});
 			})();
 		});
@@ -20037,12 +20429,13 @@ function createLiveSchemaRoutes(config) {
 		} catch {
 			branch = void 0;
 		}
+		const databaseOff = config.databaseChangesOff;
 		return c.json({
 			enabled: true,
 			canPlan: capabilities.plan,
-			canApply: capabilities.apply,
-			applyRefusedBecause: capabilities.reason,
-			applyRefusedCode: capabilities.code,
+			canApply: capabilities.apply && !databaseOff,
+			applyRefusedBecause: databaseOff?.message ?? capabilities.reason,
+			applyRefusedCode: databaseOff?.code ?? capabilities.code,
 			repository: repository.root,
 			branch
 		});
@@ -20085,6 +20478,7 @@ function createLiveSchemaRoutes(config) {
 		const body = await readBody(c);
 		const change = parseProposed(body);
 		const sourceOnly = isRecord(body) && body.sourceOnly === true;
+		if (config.databaseChangesOff && !sourceOnly) throw ApiError.conflict(config.databaseChangesOff.message, config.databaseChangesOff.code);
 		const admin = requirePlanner();
 		const principal = classifyPrincipal(c.get("user"));
 		const capabilities = schemaEditCapabilities(principal, config.policy);
@@ -20559,6 +20953,39 @@ async function rewriteRemoteCollection(options, collectionId, change) {
 	}
 }
 //#endregion
+//#region src/schema-edit/deployed-schema-guard.ts
+var RepositoryAheadOfDeploymentError = class extends Error {
+	paths;
+	constructor(paths, branch) {
+		super(`The repository's ${paths.join(", ")} ${paths.length === 1 ? "is" : "are"} not what the collections this deployment runs generate, so a schema change is committed that this deployment is not running yet: one made here, or one pushed to ${branch}. Deploy it, then make the next change. Until then a change here is planned against the collections this deployment runs, and its commit would rewrite ${paths.length === 1 ? "that file" : "those files"} without the change waiting to deploy. If nothing is waiting to deploy, the file was generated by another Rebase version, reformatted, or edited by hand: run \`rebase schema generate\` with the version this deployment runs, commit the result and deploy it. Nothing was changed.`);
+		this.paths = paths;
+		this.name = "RepositoryAheadOfDeploymentError";
+	}
+};
+/** Line endings and trailing whitespace are not schema. */
+var normalize = (contents) => contents.replace(/\r\n?/g, "\n").split("\n").map((line) => line.trimEnd()).join("\n").trimEnd();
+/**
+* Refuse when the repository's generated files differ from `served`, the files
+* the collections this deployment serves generate.
+*
+* A file the repository does not have is not a difference: nothing has
+* committed one, so there is no change in it for a commit to leave out. A
+* repository that cannot read a file cannot be checked, and is refused: the
+* remote write path reads every file it edits, so that repository could not
+* make the change either.
+*/
+async function refuseWhenRepositoryIsAhead(repository, served) {
+	if (!repository.readFile) throw new Error("This repository cannot read a file, so whether it holds a change this deployment is not running yet cannot be checked. Nothing was changed.");
+	const differing = [];
+	for (const file of served) {
+		if (file.deleted) continue;
+		const committed = await repository.readFile(file.path);
+		if (committed === void 0) continue;
+		if (normalize(committed) !== normalize(file.contents)) differing.push(file.path);
+	}
+	if (differing.length > 0) throw new RepositoryAheadOfDeploymentError(differing, await repository.currentBranch());
+}
+//#endregion
 //#region src/schema-edit/local-source.ts
 /**
 * Writing a live schema change into the collection source on this machine.
@@ -21063,7 +21490,7 @@ function startExpiredTokenSweep(wiring) {
 	const repo = wiring.authRepo;
 	if (!wiring.ownsTimers || !repo || typeof repo.deleteExpiredTokens !== "function") return void 0;
 	const deleteExpiredTokens = repo.deleteExpiredTokens.bind(repo);
-	const store = wiring.persistClaims !== false && isSQLAdmin(wiring.driver.admin) ? createCronStore(wiring.driver) : void 0;
+	const store = wiring.persistClaims !== false && isSQLAdmin(wiring.driver.admin) ? createCronStore(wiring.driver, { provision: wiring.provision }) : void 0;
 	let ready;
 	const sweep = createExpiredTokenSweep({
 		authRepo: { deleteExpiredTokens },
@@ -21156,7 +21583,7 @@ function startHistoryRetentionSweep(wiring) {
 	const service = wiring.historyService;
 	if (!wiring.ownsTimers || !service || typeof service.pruneExpired !== "function") return void 0;
 	const pruneExpired = service.pruneExpired.bind(service);
-	const store = wiring.persistClaims !== false && isSQLAdmin(wiring.driver.admin) ? createCronStore(wiring.driver) : void 0;
+	const store = wiring.persistClaims !== false && isSQLAdmin(wiring.driver.admin) ? createCronStore(wiring.driver, { provision: wiring.provision }) : void 0;
 	let ready;
 	const sweep = createHistoryRetentionSweep({
 		pruneExpired,
@@ -21411,6 +21838,15 @@ function forEachString(value, visit, depth = 0) {
 	else if (typeof value === "object" && !(value instanceof Date)) for (const element of Object.values(value)) forEachString(element, visit, depth + 1);
 }
 /**
+* Whether reading a collection through `fetchCollection` could hide a row or
+* change a value: a `beforeQuery` or an `afterRead`, the collection's own, a
+* global one, or a property's.
+*/
+function hasReadHooks(collection, globalCallbacks) {
+	const own = collection.callbacks;
+	return Boolean(own?.beforeQuery || own?.afterRead || globalCallbacks?.beforeQuery || globalCallbacks?.afterRead || collection.properties && buildPropertyCallbacks(collection.properties)?.afterRead);
+}
+/**
 * Remove from `keys` every key some row names.
 *
 * Every row of every collection is read — soft-deleted rows too, since a
@@ -21418,51 +21854,162 @@ function forEachString(value, visit, depth = 0) {
 * serves the collection. What is left in `keys` afterwards is named by no row.
 * A collection that could not be read is returned, and its rows count for
 * nothing: a caller must not treat what is left as unused when any is.
+*
+* Rows are read as stored, through the driver's `scanStoredRows`. A driver
+* without it is read through `fetchCollection` only for a collection with no
+* read hooks: a `beforeQuery` scoping rows to `context.user` — there is none
+* here — or an `afterRead` rewriting a file field would hide a reference, and
+* the file it names would be deleted as unused. Such a collection is
+* returned as unscanned instead.
 */
 async function removeReferencedKeys(keys, collections, driverFor, options = {}) {
 	const pageSize = options.pageSize ?? 500;
 	const scanned = [];
 	const unscanned = [];
+	const progress = options.progress;
 	const visit = (text) => {
 		if (keys.size === 0) return;
 		for (const key of keysNamedBy(text)) keys.delete(key);
 	};
+	const pageRead = (rows) => {
+		for (const row of rows) forEachString(row, visit);
+		if (progress) progress.rowsScanned += rows.length;
+		options.onProgress?.();
+		options.signal?.throwIfAborted();
+	};
+	const notRead = (entry) => {
+		unscanned.push(entry);
+		progress?.unscanned.push(entry);
+	};
+	if (progress) progress.collectionsTotal += collections.length;
 	for (const collection of collections) {
-		const driver = driverFor(collection);
-		if (!driver) {
-			unscanned.push({
-				collection: collection.slug,
-				reason: "no data driver serves it here"
-			});
-			continue;
-		}
+		options.signal?.throwIfAborted();
+		if (progress) progress.currentCollection = collection.slug;
 		try {
-			let after;
-			for (;;) {
-				const rows = await driver.fetchCollection({
+			const driver = driverFor(collection);
+			if (!driver) {
+				notRead({
+					collection: collection.slug,
+					reason: "no data driver serves it here"
+				});
+				continue;
+			}
+			try {
+				if (driver.scanStoredRows) for await (const rows of driver.scanStoredRows({
 					path: collection.slug,
 					collection,
-					limit: pageSize,
-					withDeleted: true,
-					...after ? { startAfter: after } : {}
+					pageSize
+				})) pageRead(rows);
+				else if (hasReadHooks(collection, options.globalCallbacks)) {
+					notRead({
+						collection: collection.slug,
+						reason: "it has a beforeQuery or afterRead hook, and its data driver cannot read its rows past them"
+					});
+					continue;
+				} else {
+					let after;
+					for (;;) {
+						const rows = await driver.fetchCollection({
+							path: collection.slug,
+							collection,
+							limit: pageSize,
+							withDeleted: true,
+							...after ? { startAfter: after } : {}
+						});
+						pageRead(rows);
+						if (rows.length < pageSize) break;
+						after = rows[rows.length - 1];
+					}
+				}
+				scanned.push(collection.slug);
+			} catch (error) {
+				if (options.signal?.aborted) throw error;
+				notRead({
+					collection: collection.slug,
+					reason: error instanceof Error ? error.message : String(error)
 				});
-				for (const row of rows) forEachString(row, visit);
-				if (rows.length < pageSize) break;
-				after = rows[rows.length - 1];
 			}
-			scanned.push(collection.slug);
-		} catch (error) {
-			unscanned.push({
-				collection: collection.slug,
-				reason: error instanceof Error ? error.message : String(error)
+		} finally {
+			if (progress) {
+				progress.collectionsScanned++;
+				progress.currentCollection = void 0;
+			}
+		}
+	}
+	options.onProgress?.();
+	return {
+		scanned,
+		unscanned
+	};
+}
+/** How row history is named among the scanned and unscanned collections. */
+var HISTORY_SCAN_NAME = "(row history)";
+/**
+* Remove from `keys` every key a history entry names, in its values or its
+* previous values. Resolves to why history could not be read, if it could not.
+*/
+async function removeKeysInHistory(keys, history, options = {}) {
+	if (!history.scanStoredValues) return {
+		collection: HISTORY_SCAN_NAME,
+		reason: "this backend's history service cannot be scanned"
+	};
+	try {
+		for await (const values of history.scanStoredValues()) {
+			if (keys.size === 0) return void 0;
+			forEachString(values, (text) => {
+				for (const key of keysNamedBy(text)) keys.delete(key);
 			});
+			if (options.progress) options.progress.historyEntriesScanned += values.length;
+			options.onProgress?.();
+			options.signal?.throwIfAborted();
 		}
+		return;
+	} catch (error) {
+		if (options.signal?.aborted) throw error;
+		return {
+			collection: HISTORY_SCAN_NAME,
+			reason: error instanceof Error ? error.message : String(error)
+		};
+	}
+}
+/**
+* Remove from `keys` every key a row or a history entry names: the rows of
+* every collection, then history when the backend keeps it. What is left is
+* named by nothing — unless `unscanned` is not empty.
+*/
+async function removeKeysNamedAnywhere(keys, options) {
+	const { scanned, unscanned } = await removeReferencedKeys(keys, options.collections, options.driverFor, {
+		globalCallbacks: options.globalCallbacks,
+		progress: options.progress,
+		onProgress: options.onProgress,
+		signal: options.signal
+	});
+	if (options.history) {
+		if (options.progress) options.progress.phase = "history";
+		options.onProgress?.();
+		const history = await removeKeysInHistory(keys, options.history, options);
+		if (history) {
+			unscanned.push(history);
+			options.progress?.unscanned.push(history);
+		} else scanned.push(HISTORY_SCAN_NAME);
 	}
 	return {
 		scanned,
 		unscanned
 	};
 }
+/** A progress record at the start of a scan. */
+function emptyScanProgress() {
+	return {
+		phase: "listing",
+		filesScanned: 0,
+		rowsScanned: 0,
+		historyEntriesScanned: 0,
+		collectionsScanned: 0,
+		collectionsTotal: 0,
+		unscanned: []
+	};
+}
 /**
 * The objects of one source that no row names.
 *
@@ -21471,18 +22018,24 @@ async function removeReferencedKeys(keys, collections, driverFor, options = {})
 *        is saved. One whose age the listing does not say is not either.
 */
 async function findOrphans(options) {
+	const progress = options.progress;
 	const all = [];
 	let cursor;
+	if (progress) progress.phase = "listing";
 	do {
+		options.signal?.throwIfAborted();
 		const page = await walkObjects(options.controller, {
 			cursor,
 			limit: 1e3
 		});
 		all.push(...page.objects);
+		if (progress) progress.filesScanned = all.length;
+		options.onProgress?.();
 		cursor = page.cursor;
 	} while (cursor);
 	const unnamed = new Set(all.map((object) => object.key));
-	const { scanned, unscanned } = await removeReferencedKeys(unnamed, options.collections, options.driverFor);
+	if (progress) progress.phase = "rows";
+	const { scanned, unscanned } = await removeKeysNamedAnywhere(unnamed, options);
 	const cutoff = (options.now ?? Date.now()) - options.olderThanMs;
 	const orphans = [];
 	let recent = 0;
@@ -21493,6 +22046,7 @@ async function findOrphans(options) {
 		else recent++;
 	}
 	orphans.sort((a, b) => a.key.localeCompare(b.key));
+	if (progress) progress.phase = "done";
 	return {
 		objects: all.length,
 		orphans,
@@ -21501,6 +22055,93 @@ async function findOrphans(options) {
 		unscanned
 	};
 }
+/** How far a stored object's time may stray from the listing's and still be the same version. */
+var SAME_VERSION_SLACK_MS = 1e3;
+/**
+* Delete the orphans an earlier scan found — each only if it is still one.
+*
+* Every row and history entry is read again, against the candidates alone
+* (the source is not listed again): a row written since the scan may name one
+* now. When a collection cannot be read, nothing is deleted. Then, right
+* before each delete, the object is asked for again: one that is gone, was
+* written again since the scan (another size or time), or is now inside the
+* grace period is kept.
+*/
+async function deleteScannedOrphans(options) {
+	const progress = options.progress;
+	const unnamed = new Set(options.candidates.map((candidate) => candidate.key));
+	if (progress) progress.phase = "rows";
+	const { unscanned } = await removeKeysNamedAnywhere(unnamed, options);
+	const result = {
+		deleted: [],
+		kept: [],
+		failed: [],
+		unscanned
+	};
+	if (unscanned.length > 0) return result;
+	if (progress) progress.phase = "deleting";
+	options.onProgress?.();
+	const now = options.now ?? Date.now;
+	for (const candidate of options.candidates) {
+		options.signal?.throwIfAborted();
+		if (!unnamed.has(candidate.key)) {
+			result.kept.push({
+				key: candidate.key,
+				reason: "a row or a history entry names it now"
+			});
+			continue;
+		}
+		try {
+			const current = await versionOf(options.controller, candidate.key, candidate);
+			const scannedAt = candidate.updated ? Date.parse(candidate.updated) : NaN;
+			if (current === null) result.kept.push({
+				key: candidate.key,
+				reason: "it is gone already"
+			});
+			else if (candidate.size !== void 0 && current.size !== candidate.size || !Number.isFinite(scannedAt) || Math.abs(current.lastModified - scannedAt) > SAME_VERSION_SLACK_MS) result.kept.push({
+				key: candidate.key,
+				reason: "it was written again since the scan"
+			});
+			else if (current.lastModified > now() - options.olderThanMs) result.kept.push({
+				key: candidate.key,
+				reason: "it is newer than the grace period"
+			});
+			else {
+				await options.controller.deleteObject(candidate.key);
+				result.deleted.push(candidate.key);
+				options.onDeleted?.(candidate.key);
+			}
+		} catch (error) {
+			result.failed.push({
+				key: candidate.key,
+				error: error instanceof Error ? error.message : String(error)
+			});
+		}
+		options.onProgress?.();
+	}
+	if (progress) progress.phase = "done";
+	return result;
+}
+/**
+* An object's size and modification time now, or `null` when there is no such
+* object. A source without `statObject` says only its size, and the time is
+* then taken to be the one the scan listed.
+*/
+async function versionOf(controller, key, listed) {
+	if (controller.statObject) {
+		const info = await controller.statObject(key);
+		return info ? {
+			size: info.size,
+			lastModified: info.lastModified
+		} : null;
+	}
+	const size = await sizeIn(controller, key);
+	if (size === void 0) return null;
+	return {
+		size,
+		lastModified: listed.updated ? Date.parse(listed.updated) : NaN
+	};
+}
 /**
 * Copy the objects under a folder of one source into another, under the same
 * keys, `limit` objects per call. Hand the returned `cursor` back for the next
@@ -21567,6 +22208,77 @@ async function moveObjects(options) {
 		cursor: page.cursor
 	};
 }
+/**
+* List the source again after a move and name every file it did not move,
+* `limit` source objects per call; hand the returned `cursor` back for the
+* next ones.
+*
+* Defence in depth: a move reports what its own walk saw, and a walk that
+* skipped files (as the local listing's page token once did, over a folder
+* the move was emptying) reported success over the half it moved. A fresh
+* listing does not share the walk's state. With `deleteSource`, every file
+* still in the source is not moved; without it, a file the target holds no
+* copy of the same size of.
+*/
+async function verifyMove(options) {
+	const page = await walkObjects(options.from, {
+		prefix: options.prefix,
+		cursor: options.cursor,
+		limit: options.limit ?? 100
+	});
+	const notMoved = [];
+	for (const object of page.objects) {
+		let copy;
+		try {
+			copy = await sizeIn(options.to, object.key);
+		} catch (error) {
+			notMoved.push({
+				key: object.key,
+				reason: `the target could not be asked for it: ${error instanceof Error ? error.message : String(error)}`
+			});
+			continue;
+		}
+		const held = copy !== void 0 && (object.size === void 0 || copy === object.size);
+		if (options.deleteSource) notMoved.push({
+			key: object.key,
+			reason: held ? "still in the source; the target holds a copy, so running the move again deletes it" : "still in the source, and the target has no copy of the same size"
+		});
+		else if (copy === void 0) notMoved.push({
+			key: object.key,
+			reason: "the target has no copy"
+		});
+		else if (!held) notMoved.push({
+			key: object.key,
+			reason: `the target's copy is ${copy} bytes, the source's ${object.size}`
+		});
+	}
+	return {
+		checked: page.objects.length,
+		notMoved,
+		cursor: page.cursor
+	};
+}
+/**
+* Whether two sources store in the same place — one bucket or directory under
+* two names. Asked by their `storageLocation` when both can say; otherwise by
+* a probe object written to `a` under the internal folder, looked for in `b`,
+* and deleted.
+*/
+async function storesInSamePlace(a, b) {
+	const here = a.storageLocation?.();
+	const there = b.storageLocation?.();
+	if (here !== void 0 && there !== void 0) return here === there;
+	const key = `${INTERNAL_FOLDER}/move-probe/${randomUUID$1()}`;
+	await a.putObject({
+		file: new File(["probe"], "probe", { type: "text/plain" }),
+		key
+	}, { uploadLimits: false });
+	try {
+		return await sizeIn(b, key) !== void 0;
+	} finally {
+		await a.deleteObject(key).catch(() => void 0);
+	}
+}
 /** An object's size in a source, or `undefined` when it has no such object. */
 async function sizeIn(controller, key) {
 	if (controller.statObject) return (await controller.statObject(key))?.size;
@@ -21580,42 +22292,411 @@ async function customMetadataOf(controller, key) {
 	return custom && Object.keys(custom).length > 0 ? custom : void 0;
 }
 //#endregion
+//#region src/storage/orphan-scans.ts
+/**
+* The orphan scan as background work: `rebase storage orphans` on a project
+* too big to scan inside one HTTP request.
+*
+* A scan reads every object of a source and every row of every collection,
+* plus history, before it can call anything unused. On a big project that is
+* minutes, and an ingress in front of the server answers 504 long before. So
+* a scan is started, runs in the background, and is asked about:
+*
+*   start  — writes the scan's record, then enqueues a `storage.orphans` job
+*            on the durable job queue, or — on a backend that runs no job
+*            queue — runs it in this process, in the background, and says so;
+*   status — the record: progress while it runs (files listed, rows read,
+*            collections that could not be read), the report when it is done;
+*   delete — only from a completed scan, recent, that read every collection.
+*            It is background work too: every row and history entry is read
+*            again against the scan's candidates alone, and each file is asked
+*            for again right before it is deleted.
+*
+* The record lives in the scanned source itself, under the reserved
+* `_rebase/maintenance/` folder, so whichever process runs the scan (a worker
+* pod) and whichever answers the status (any api pod) read the same one, on
+* any database driver, with nothing added to the schema.
+*/
+/** The job task a scan, or a scan's delete, runs as. Frozen: workers of another release claim it by name. */
+var STORAGE_ORPHANS_TASK = "storage.orphans";
+/** Where scan records are kept inside the scanned source. */
+var ORPHAN_SCAN_FOLDER = `${MAINTENANCE_PREFIX}orphan-scans`;
+/**
+* How long after it completed a scan's result may still be deleted from.
+* Every candidate is checked again before it goes, so this is not what keeps
+* a file in use; it keeps a delete acting on what the person just read.
+*/
+var ORPHAN_SCAN_TTL_MS = 15 * 6e4;
+/** A queued scan nobody has started after this long gets a note saying why that may be. */
+var QUEUED_NOTE_AFTER_MS = 6e4;
+/** The least time between two writes of a running scan's record. */
+var PROGRESS_WRITE_INTERVAL_MS = 2e3;
+/** Records older than this are deleted when the next scan of their source starts. */
+var RECORD_RETENTION_MS = 168 * 36e5;
+var SCAN_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+/**
+* The storage source a request names, or the 404 that lists the ones served.
+*/
+function resolveStorageSource(sources, rawId, label) {
+	if (rawId !== void 0 && typeof rawId !== "string") throw ApiError.badRequest(`\`${label}\` must be a storage source key.`);
+	const id = canonicalStorageId(rawId);
+	const controller = sources.registry ? sources.registry.get(id) : id === "(default)" ? sources.controller : void 0;
+	if (!controller) throw new ApiError(404, "UNKNOWN_STORAGE_SOURCE", `This server has no storage source "${id}". It serves ${(sources.registry?.list() ?? (sources.controller ? ["(default)"] : [])).map((key) => `"${key}"`).join(", ") || "none"}.`);
+	return controller;
+}
+/** `olderThanHours` as a request sends it, checked. */
+function parseOlderThanHours(raw) {
+	if (raw === void 0 || raw === "") return 24;
+	const hours = Number(raw);
+	if (!Number.isFinite(hours) || hours < 0) throw ApiError.badRequest("`olderThanHours` must be a number of hours, 0 or more.");
+	return hours;
+}
+var recordKey = (id) => `${ORPHAN_SCAN_FOLDER}/${id}.json`;
+var messageOf = (error) => error instanceof Error ? error.message : String(error);
+/** Whether a value read back from a source is a scan record. Only shape enough to act on it safely. */
+function isScanState(value, id) {
+	if (!value || typeof value !== "object") return false;
+	const record = value;
+	return record.id === id && typeof record.storageId === "string" && typeof record.status === "string" && typeof record.olderThanHours === "number" && !!record.progress && typeof record.progress === "object";
+}
+/**
+* Writes a running scan's record at most every {@link PROGRESS_WRITE_INTERVAL_MS},
+* one write at a time, in order.
+*/
+function progressWriter(write, now) {
+	let last = 0;
+	let chain = Promise.resolve();
+	const enqueue = () => {
+		chain = chain.then(write).catch((error) => {
+			logger.warn("[storage] Could not record an orphan scan's progress", { error });
+		});
+		return chain;
+	};
+	return {
+		tick() {
+			if (now() - last < PROGRESS_WRITE_INTERVAL_MS) return;
+			last = now();
+			enqueue();
+		},
+		/** Write now, after any write in flight, and wait for it. */
+		async flush() {
+			last = now();
+			await enqueue();
+		}
+	};
+}
+function createOrphanScanService(config) {
+	const now = config.now ?? Date.now;
+	const iso = () => new Date(now()).toISOString();
+	const sourceOf = (rawId) => resolveStorageSource(config, rawId, "storageId");
+	async function read(controller, id) {
+		if (!SCAN_ID.test(id)) return void 0;
+		const file = await controller.getObject(recordKey(id));
+		if (!file) return void 0;
+		let parsed;
+		try {
+			parsed = JSON.parse(await file.text());
+		} catch {
+			return;
+		}
+		return isScanState(parsed, id) ? parsed : void 0;
+	}
+	async function write(controller, state) {
+		state.updatedAt = iso();
+		if (state.deletion && (state.deletion.status === "queued" || state.deletion.status === "running")) state.deletion.updatedAt = state.updatedAt;
+		const body = JSON.stringify(state);
+		await controller.putObject({
+			file: new File([body], `${state.id}.json`, { type: "application/json" }),
+			key: recordKey(state.id)
+		}, { uploadLimits: false });
+	}
+	/** Delete records past retention, best effort: a scan never fails over housekeeping. */
+	async function prune(controller) {
+		try {
+			const cutoff = now() - RECORD_RETENTION_MS;
+			let pageToken;
+			do {
+				const page = await controller.listObjects(ORPHAN_SCAN_FOLDER, {
+					maxResults: 1e3,
+					pageToken
+				});
+				for (const item of page.items) {
+					const written = item.updated ? Date.parse(item.updated) : NaN;
+					if (Number.isFinite(written) && written < cutoff) await controller.deleteObject(item.fullPath).catch(() => void 0);
+				}
+				pageToken = page.nextPageToken;
+			} while (pageToken);
+		} catch (error) {
+			logger.debug("[storage] Could not prune old orphan scan records", { error });
+		}
+	}
+	/** Hand a scan or a delete to the job queue, or run it here in the background. Resolves with who runs it. */
+	async function dispatch(payload) {
+		const queue = config.jobs?.();
+		if (queue) {
+			const jobId = await queue.enqueue(STORAGE_ORPHANS_TASK, payload, { maxAttempts: 1 });
+			return {
+				runner: "worker",
+				...jobId ? { jobId } : {}
+			};
+		}
+		setImmediate(() => {
+			runTask(payload).catch((error) => {
+				logger.error("[storage] An orphan scan running in this process failed", {
+					scanId: payload.scanId,
+					error
+				});
+			});
+		});
+		return { runner: "in-process" };
+	}
+	/** The record as a caller should read it: a stalled run said as failed, a long queue explained. */
+	function asReported(state) {
+		const reported = { ...state };
+		const age = (at) => now() - (at ? Date.parse(at) : 0);
+		const waiting = `It is a "${STORAGE_ORPHANS_TASK}" job on the job queue, run by a process whose job workers are on (the all or worker role, REBASE_JOB_WORKERS) and that runs this release.`;
+		if (state.status === "running" && age(state.updatedAt) > 6e5) {
+			reported.status = "failed";
+			reported.error = `The scan stopped reporting progress ${Math.round(age(state.updatedAt) / 6e4)} minutes ago: the process running it stopped (a deploy, a restart or a crash). Start another scan.`;
+		} else if (state.status === "queued" && age(state.createdAt) > QUEUED_NOTE_AFTER_MS) if (state.runner === "worker") reported.note = `No job worker has started this scan yet. ${waiting}`;
+		else {
+			reported.status = "failed";
+			reported.error = "The scan was to run in the server process that was asked, and never started: that process restarted. Start another scan.";
+		}
+		const deletion = state.deletion;
+		if (deletion && deletion.status === "running" && age(deletion.updatedAt) > 6e5) reported.deletion = {
+			...deletion,
+			status: "failed",
+			error: "The delete stopped reporting progress: the process running it stopped. Some files may have been deleted. Start another scan to see what is left."
+		};
+		else if (deletion && deletion.status === "queued" && age(deletion.requestedAt) > QUEUED_NOTE_AFTER_MS) reported.deletion = deletion.runner === "worker" ? {
+			...deletion,
+			note: `No job worker has started this delete yet. ${waiting}`
+		} : {
+			...deletion,
+			status: "failed",
+			error: "The delete was to run in the server process that was asked, and never started. Nothing was deleted."
+		};
+		return reported;
+	}
+	async function runScan(controller, state, signal) {
+		state.status = "running";
+		state.startedAt = iso();
+		state.progress = emptyScanProgress();
+		await write(controller, state);
+		const writer = progressWriter(() => write(controller, state), now);
+		try {
+			state.result = await findOrphans({
+				controller,
+				collections: config.collections(),
+				driverFor: config.driverFor,
+				globalCallbacks: config.globalCallbacks?.(),
+				history: config.history,
+				olderThanMs: state.olderThanHours * 36e5,
+				now: now(),
+				progress: state.progress,
+				onProgress: () => writer.tick(),
+				signal
+			});
+			state.status = "completed";
+			state.completedAt = iso();
+		} catch (error) {
+			state.status = "failed";
+			state.error = signal?.aborted ? `The scan was stopped: ${messageOf(signal.reason ?? error)}. A scan is one job attempt, limited by jobs.timeoutMs (15 minutes by default); raise it, or set it to 0, for a source this big.` : messageOf(error);
+			throw error;
+		} finally {
+			await writer.flush();
+		}
+	}
+	async function runDeletion(controller, state, signal) {
+		const deletion = state.deletion;
+		const result = state.result;
+		if (!deletion || !result) return;
+		deletion.status = "running";
+		deletion.startedAt = iso();
+		deletion.progress = {
+			...emptyScanProgress(),
+			phase: "rows",
+			candidates: result.orphans.length,
+			deleted: 0
+		};
+		await write(controller, state);
+		const writer = progressWriter(() => write(controller, state), now);
+		try {
+			const outcome = await deleteScannedOrphans({
+				controller,
+				candidates: result.orphans,
+				collections: config.collections(),
+				driverFor: config.driverFor,
+				globalCallbacks: config.globalCallbacks?.(),
+				history: config.history,
+				olderThanMs: state.olderThanHours * 36e5,
+				now,
+				progress: deletion.progress,
+				onProgress: () => writer.tick(),
+				onDeleted: () => {
+					deletion.progress.deleted++;
+				},
+				signal
+			});
+			deletion.result = {
+				deleted: outcome.deleted,
+				kept: outcome.kept,
+				failed: outcome.failed
+			};
+			if (outcome.unscanned.length > 0) {
+				deletion.status = "failed";
+				deletion.error = "Some collections could not be read again, so a file they name now would look unused. Nothing was deleted: " + outcome.unscanned.map((entry) => `${entry.collection} (${entry.reason})`).join("; ");
+			} else deletion.status = "completed";
+			deletion.completedAt = iso();
+		} catch (error) {
+			deletion.status = "failed";
+			deletion.error = messageOf(signal?.aborted ? signal.reason ?? error : error);
+			throw error;
+		} finally {
+			await writer.flush();
+		}
+	}
+	async function runTask(payload, signal) {
+		const controller = sourceOf(payload.storageId);
+		const state = await read(controller, payload.scanId);
+		if (!state) {
+			logger.warn("[storage] An orphan scan job names a scan its source holds no record of; nothing to do", { ...payload });
+			return;
+		}
+		if (payload.mode === "scan") {
+			if (state.status !== "queued") return;
+			await runScan(controller, state, signal);
+		} else {
+			if (state.deletion?.status !== "queued") return;
+			await runDeletion(controller, state, signal);
+		}
+	}
+	return {
+		async start(options) {
+			const controller = sourceOf(options.storageId);
+			const storageId = canonicalStorageId(options.storageId);
+			const olderThanHours = options.olderThanHours ?? 24;
+			await prune(controller);
+			const at = iso();
+			const state = {
+				id: randomUUID$1(),
+				storageId,
+				olderThanHours,
+				runner: config.jobs?.() ? "worker" : "in-process",
+				status: "queued",
+				createdAt: at,
+				updatedAt: at,
+				progress: emptyScanProgress()
+			};
+			await write(controller, state);
+			const { runner, jobId } = await dispatch({
+				scanId: state.id,
+				storageId,
+				mode: "scan"
+			});
+			return {
+				...state,
+				runner,
+				...jobId ? { jobId } : {}
+			};
+		},
+		async status(storageId, id) {
+			const state = await read(sourceOf(storageId), id);
+			return state ? asReported(state) : void 0;
+		},
+		async requestDeletion(storageId, id) {
+			const controller = sourceOf(storageId);
+			const stored = await read(controller, id);
+			if (!stored) throw new ApiError(404, "STORAGE_SCAN_NOT_FOUND", `Source "${canonicalStorageId(storageId)}" holds no orphan scan "${id}". Scans are kept for 7 days; start another.`);
+			const state = asReported(stored);
+			if (state.status !== "completed" || !state.result || !state.completedAt) throw new ApiError(409, "STORAGE_SCAN_NOT_COMPLETE", state.status === "failed" ? `Scan "${id}" failed (${state.error ?? "no reason recorded"}), so it found nothing to delete. Start another scan.` : `Scan "${id}" is ${state.status}. Nothing is deleted until it has completed; ask for its status until it has.`, { status: state.status });
+			const unscanned = state.result.unscanned;
+			if (unscanned.length > 0) throw ApiError.conflict("Some collections could not be read, so a file they name would look unused. Nothing was deleted: " + unscanned.map((entry) => `${entry.collection} (${entry.reason})`).join("; "), "STORAGE_SCAN_INCOMPLETE", { unscanned });
+			const age = now() - Date.parse(state.completedAt);
+			if (!(age <= 9e5)) throw new ApiError(409, "STORAGE_SCAN_EXPIRED", `Scan "${id}" completed ${Math.round(age / 6e4)} minutes ago; a delete acts only on a scan that completed in the last ${ORPHAN_SCAN_TTL_MS / 6e4} minutes. Nothing was deleted. Start another scan.`);
+			if (state.deletion && state.deletion.status !== "failed") throw new ApiError(409, "STORAGE_SCAN_DELETION_STARTED", `The orphans of scan "${id}" are already being deleted (${state.deletion.status}). Ask for its status.`, { status: state.deletion.status });
+			const at = iso();
+			stored.deletion = {
+				status: "queued",
+				runner: config.jobs?.() ? "worker" : "in-process",
+				requestedAt: at,
+				updatedAt: at,
+				progress: {
+					...emptyScanProgress(),
+					phase: "rows",
+					candidates: state.result.orphans.length,
+					deleted: 0
+				}
+			};
+			await write(controller, stored);
+			const { runner, jobId } = await dispatch({
+				scanId: id,
+				storageId: stored.storageId,
+				mode: "delete"
+			});
+			stored.deletion.runner = runner;
+			if (jobId) stored.deletion.jobId = jobId;
+			return asReported(stored);
+		},
+		runTask
+	};
+}
+//#endregion
 //#region src/storage/maintenance-routes.ts
 /**
 * `/admin/storage` — the routes behind `rebase storage orphans` and
 * `rebase storage move`. Admin-only; the caller mounts them behind the admin
-* gate (`database:read` to read, `database:write` to delete or move).
+* gate (`database:read` to read, `database:write` for every other method).
 *
-*   GET    /orphans?storageId=&olderThanHours=   objects no row names
-*   DELETE /orphans?storageId=&olderThanHours=   delete them, found again first
+*   POST   /orphans/scans?storageId=&olderThanHours=   start a scan, in the background
+*   GET    /orphans/scans/:id?storageId=               its progress, then its report
+*   DELETE /orphans?scan=:id&storageId=                delete a completed scan's orphans, in the background
+*   GET    /orphans?storageId=&olderThanHours=         deprecated: a scan inside the request
+*   DELETE /orphans?storageId=&olderThanHours=         deprecated: scan and delete inside the request
 *   POST   /move  { from, to, prefix?, cursor?, limit?, deleteSource? }
+*   POST   /move/verify  (the same body)            what a move left behind
 */
-/** The default grace period: an upload whose row is not saved yet is a day old at most. */
-var DEFAULT_OLDER_THAN_HOURS = 24;
+/** Where the scan-in-a-request routes send their callers. */
+var SCAN_SUCCESSOR = "/api/admin/storage/orphans/scans";
+/** Mark a response of a deprecated scan-in-a-request route, and say so once per process. */
+function deprecatedScan(c, what) {
+	c.header("Deprecation", "true");
+	c.header("Link", `<${SCAN_SUCCESSOR}>; rel="successor-version"`);
+	warnDeprecated(`storage.orphans.${what}`, `${what} /api/admin/storage/orphans without ?scan= scans inside the request, which an ingress times out on a big project. Start a scan with POST /api/admin/storage/orphans/scans, ask GET /api/admin/storage/orphans/scans/:id, and delete with DELETE /api/admin/storage/orphans?scan=:id. \`rebase storage orphans\` does this; the in-request form will be removed in a later release.`);
+}
 function createStorageMaintenanceRoutes(config) {
 	const router = new Hono();
-	const sourceOf = (rawId, label) => {
-		if (rawId !== void 0 && typeof rawId !== "string") throw ApiError.badRequest(`\`${label}\` must be a storage source key.`);
-		const id = canonicalStorageId(rawId);
-		const controller = config.registry ? config.registry.get(id) : id === "(default)" ? config.controller : void 0;
-		if (!controller) throw new ApiError(404, "UNKNOWN_STORAGE_SOURCE", `This server has no storage source "${id}". It serves ${(config.registry?.list() ?? (config.controller ? ["(default)"] : [])).map((key) => `"${key}"`).join(", ") || "none"}.`);
-		return controller;
-	};
-	const olderThanMs = (raw) => {
-		if (raw === void 0 || raw === "") return DEFAULT_OLDER_THAN_HOURS * 36e5;
-		const hours = Number(raw);
-		if (!Number.isFinite(hours) || hours < 0) throw ApiError.badRequest("`olderThanHours` must be a number of hours, 0 or more.");
-		return hours * 36e5;
-	};
+	const scans = config.orphanScans ?? createOrphanScanService(config);
+	const sourceOf = (rawId, label) => resolveStorageSource(config, rawId, label);
 	const report = async (storageId, olderThan) => {
 		return findOrphans({
 			controller: sourceOf(storageId, "storageId"),
 			collections: config.collections(),
 			driverFor: config.driverFor,
-			olderThanMs: olderThanMs(olderThan)
+			globalCallbacks: config.globalCallbacks?.(),
+			history: config.history,
+			olderThanMs: parseOlderThanHours(olderThan) * 36e5
 		});
 	};
+	router.post("/orphans/scans", async (c) => {
+		const olderThanHours = parseOlderThanHours(c.req.query("olderThanHours"));
+		const state = await scans.start({
+			storageId: c.req.query("storageId"),
+			olderThanHours
+		});
+		return c.json({ data: state }, 202);
+	});
+	router.get("/orphans/scans/:id", async (c) => {
+		const storageId = c.req.query("storageId");
+		const id = c.req.param("id");
+		const state = await scans.status(storageId, id);
+		if (!state) throw new ApiError(404, "STORAGE_SCAN_NOT_FOUND", `Source "${canonicalStorageId(storageId)}" holds no orphan scan "${id}". Scans are kept for 7 days; start another.`);
+		return c.json({ data: state });
+	});
+	/** @deprecated Start a scan with `POST /orphans/scans` instead. Kept for one release. */
 	router.get("/orphans", async (c) => {
+		deprecatedScan(c, "GET");
 		const storageId = c.req.query("storageId");
 		const found = await report(storageId, c.req.query("olderThanHours"));
 		return c.json({ data: {
@@ -21625,6 +22706,12 @@ function createStorageMaintenanceRoutes(config) {
 	});
 	router.delete("/orphans", async (c) => {
 		const storageId = c.req.query("storageId");
+		const scanId = c.req.query("scan");
+		if (scanId !== void 0) {
+			const state = await scans.requestDeletion(storageId, scanId);
+			return c.json({ data: state }, 202);
+		}
+		deprecatedScan(c, "DELETE");
 		const controller = sourceOf(storageId, "storageId");
 		const found = await report(storageId, c.req.query("olderThanHours"));
 		if (found.unscanned.length > 0) throw ApiError.conflict("Some collections could not be read, so a file they name would look unused. Nothing was deleted: " + found.unscanned.map((entry) => `${entry.collection} (${entry.reason})`).join("; "), "STORAGE_SCAN_INCOMPLETE", { unscanned: found.unscanned });
@@ -21646,7 +22733,8 @@ function createStorageMaintenanceRoutes(config) {
 			recent: found.recent
 		} });
 	});
-	router.post("/move", async (c) => {
+	/** A move's JSON body, checked: the two sources, and the walk's options. */
+	const moveRequest = async (c) => {
 		const body = await c.req.json().catch(() => void 0);
 		if (!body || typeof body !== "object" || Array.isArray(body)) throw ApiError.badRequest("The body must be a JSON object: { from, to, prefix?, cursor?, limit?, deleteSource? }.");
 		const field = (name) => body[name];
@@ -21658,10 +22746,45 @@ function createStorageMaintenanceRoutes(config) {
 		const limit = field("limit");
 		const deleteSource = field("deleteSource");
 		if (prefix !== void 0 && typeof prefix !== "string" || cursor !== void 0 && typeof cursor !== "string" || limit !== void 0 && (typeof limit !== "number" || !Number.isInteger(limit) || limit < 1 || limit > 500) || deleteSource !== void 0 && typeof deleteSource !== "boolean") throw ApiError.badRequest("`prefix` and `cursor` are strings, `limit` a whole number from 1 to 500, `deleteSource` a boolean.");
+		return {
+			fromId,
+			toId,
+			from: sourceOf(field("from"), "from"),
+			to: sourceOf(field("to"), "to"),
+			prefix,
+			cursor,
+			limit,
+			deleteSource
+		};
+	};
+	router.post("/move", async (c) => {
+		const { fromId, toId, from, to, prefix, cursor, limit, deleteSource } = await moveRequest(c);
+		if (deleteSource && await storesInSamePlace(from, to)) throw new ApiError(400, "STORAGE_SAME_LOCATION", `"${fromId}" and "${toId}" store in the same place, so deleting the source's copy would delete the only one. Nothing was moved or deleted. Point the property at the other source instead; its files are already there.`);
 		try {
 			const result = await moveObjects({
-				from: sourceOf(field("from"), "from"),
-				to: sourceOf(field("to"), "to"),
+				from,
+				to,
+				prefix,
+				cursor,
+				limit,
+				deleteSource
+			});
+			return c.json({ data: {
+				from: fromId,
+				to: toId,
+				...result
+			} });
+		} catch (error) {
+			if (error instanceof InvalidMaintenanceRequestError) throw ApiError.badRequest(error.message);
+			throw error;
+		}
+	});
+	router.post("/move/verify", async (c) => {
+		const { fromId, toId, from, to, prefix, cursor, limit, deleteSource } = await moveRequest(c);
+		try {
+			const result = await verifyMove({
+				from,
+				to,
 				prefix,
 				cursor,
 				limit,
@@ -21711,11 +22834,12 @@ var AUTHORIZATION_CODE_TTL_MS = 6e4;
 * server that cannot persist a code is not a degraded authorization server, it
 * is one that hands out credentials it cannot check.
 */
-function createOAuthStore(driver) {
+function createOAuthStore(driver, options = {}) {
 	const admin = driver.admin;
 	if (!isSQLAdmin(admin)) return null;
-	const exec = (sql, params) => admin.executeSql(sql, params ? { params } : void 0);
-	const ddl = createDdlBootstrapper((sql) => exec(sql), "oauth-store");
+	const run = provisioningExec((sql, execOptions) => admin.executeSql(sql, execOptions?.params ? { params: execOptions.params } : void 0), options.provision);
+	const exec = (sql, params) => run(sql, params ? { params } : void 0);
+	const ddl = createDdlBootstrapper(run, "oauth-store");
 	const sweepCodes = () => exec(`DELETE FROM ${CODES} WHERE expires_at < now() - interval '1 hour'`);
 	const sweepRefreshTokens = () => exec(`DELETE FROM ${REFRESH} WHERE expires_at < now() - interval '30 days'`);
 	let lastSweep = Date.now();
@@ -21792,6 +22916,7 @@ function createOAuthStore(driver) {
 			lastSweep = Date.now();
 			const missing = [];
 			for (const table of OAUTH_TABLES) if ((await exec(`SELECT to_regclass($1) AS present`, [table]))[0]?.present == null) missing.push(table);
+			if (missing.length > 0 && options.provision === false) throw new Error(`The OAuth tables do not exist: ${missing.join(", ")}, and this backend changes nothing in its database. A provisioning run with the MCP surface on creates them.`);
 			if (missing.length > 0) throw new Error(`The OAuth tables were not created: ${missing.join(", ")}. The MCP surface cannot be served without them — check the boot log above for the statement that failed, which is usually a permissions problem on the \`rebase\` schema.`);
 		},
 		async registerClient(client) {
@@ -22277,6 +23402,9 @@ function consentPageHeaders(nonce) {
 }
 function renderConsentPage(params) {
 	const clientName = escapeHtml$2(params.clientName.slice(0, 120));
+	const resource = escapeHtml$2(params.resource);
+	const destination = describeRedirect(params.redirectUri);
+	const permissions = params.scopeDescriptions.map((s) => `<li><strong>${escapeHtml$2(s.description)}</strong></li>`).join("");
 	return `<!doctype html>
 <html lang="en">
 <head>
@@ -22328,15 +23456,31 @@ function renderConsentPage(params) {
   button[disabled] { opacity: .55; cursor: progress; }
   .error { color: var(--danger); font-size: 13px; margin-top: 12px; min-height: 1em; }
   .who { font-size: 13px; color: var(--muted); margin-top: 4px; }
+  .destination {
+    margin: 0 0 18px; padding: 12px 14px; border-radius: 9px; font-size: 13.5px;
+    border: 1px solid var(--line); background: var(--bg); word-break: break-all;
+  }
+  .destination strong { font-size: 15px; color: var(--ink); }
+  .destination span { display: block; color: var(--muted); margin-top: 4px; word-break: normal; }
+  .note { font-size: 12.5px; color: var(--muted); margin: 14px 0 0; }
+  input[inputmode=text] {
+    width: 100%; padding: 9px 11px; border-radius: 8px; letter-spacing: .08em;
+    border: 1px solid var(--line); background: var(--bg); color: var(--ink); font: inherit;
+  }
 </style>
 </head>
 <body>
 <main class="card">
   <h1>&ldquo;${clientName}&rdquo; wants access to your account</h1>
-  <p class="resource">${escapeHtml$2(params.resource)}</p>
+  <p class="resource">${resource}</p>
+
+  <p class="destination">
+    After you allow, you will be sent back to <strong>${escapeHtml$2(destination.label)}</strong>
+    <span>${escapeHtml$2(destination.note)}</span>
+  </p>
 
   <p style="margin:0 0 8px">If you allow it, this application will be able to:</p>
-  <ul>${params.scopeDescriptions.map((s) => `<li><strong>${escapeHtml$2(s.description)}</strong></li>`).join("")}</ul>
+  <ul>${permissions}</ul>
 
   <div class="limits">
     It will act <strong>as you</strong>, and can never see more than you can:
@@ -22355,6 +23499,13 @@ function renderConsentPage(params) {
       <input type="email" id="email" name="email" autocomplete="username" required>
       <label for="password">Password</label>
       <input type="password" id="password" name="password" autocomplete="current-password" required>
+      <p class="note">Signed in to this app with Google, GitHub or an email link before? This screen
+      needs a password. Use &ldquo;Forgot password&rdquo; on the app's sign-in screen to set one, then
+      come back.</p>
+    </div>
+    <div id="mfa" hidden>
+      <label for="mfa_code">Code from your authenticator app, or a recovery code</label>
+      <input type="text" id="mfa_code" name="mfa_code" inputmode="text" autocomplete="one-time-code">
     </div>
     <p class="who" id="who" hidden></p>
 
@@ -22371,20 +23522,136 @@ function renderConsentPage(params) {
   var form = document.getElementById("consent");
   var email = document.getElementById("email");
   var password = document.getElementById("password");
+  var signin = document.getElementById("signin");
+  var mfa = document.getElementById("mfa");
+  var mfaCode = document.getElementById("mfa_code");
   var sessionToken = document.getElementById("session_token");
   var decision = document.getElementById("decision");
   var error = document.getElementById("error");
   var allow = document.getElementById("allow");
 
+  // Set once the password was accepted and the account answered MFA_REQUIRED.
+  var mfaToken = null;
+  var factorId = null;
+  var challengeId = null;
+
   document.getElementById("deny").addEventListener("click", function () {
     decision.value = "deny";
-    // The password fields are required, and a denial must not be blocked by
+    // The credential fields are required, and a denial must not be blocked by
     // them: refusing is the one answer that should never need a credential.
-    email.removeAttribute("required");
-    password.removeAttribute("required");
+    email.required = false;
+    password.required = false;
+    mfaCode.required = false;
     form.submit();
   });
 
+  // The words to show for a failed answer. The canonical envelope is
+  // { error: { message, code } }; the flat spellings are what an OAuth-style
+  // body or a deployment's transformed auth response may carry instead.
+  function messageOf(r, fallback) {
+    var b = r.body;
+    if (b && b.error && typeof b.error === "object" && typeof b.error.message === "string") return b.error.message;
+    if (b && typeof b.error_description === "string") return b.error_description;
+    if (b && typeof b.message === "string") return b.message;
+    if (b && typeof b.error === "string") return b.error;
+    return fallback + (r.status ? " (HTTP " + r.status + ")." : ".");
+  }
+  function codeOf(r) {
+    var b = r.body;
+    return (b && b.error && typeof b.error === "object" && b.error.code) || null;
+  }
+  function failure(message) {
+    var err = new Error(message);
+    err.shown = true;
+    return err;
+  }
+
+  // A body that is not JSON (a proxy's HTML error page) is a failure with no
+  // message, not a parse error to print.
+  function post(url, body, bearer) {
+    var headers = { "Content-Type": "application/json" };
+    if (bearer) headers.Authorization = "Bearer " + bearer;
+    return fetch(url, { method: "POST", headers: headers, body: JSON.stringify(body) })
+      .then(function (res) {
+        return res.json().then(
+          function (b) { return { ok: res.ok, status: res.status, body: b }; },
+          function () { return { ok: res.ok, status: res.status, body: null }; }
+        );
+      });
+  }
+
+  // buildAuthResponse returns { user, tokens: { accessToken } }. The flatter
+  // spellings are fallbacks rather than guesses: the response passes through
+  // applyTransformHook, so a deployment can legitimately reshape it.
+  //
+  // No backticks anywhere in this script: it lives inside a template literal,
+  // and one would end the string early.
+  function sessionFrom(r) {
+    var tokens = (r.body && r.body.tokens) || {};
+    return tokens.accessToken || (r.body && (r.body.accessToken || r.body.access_token)) || null;
+  }
+
+  function finish(token) {
+    sessionToken.value = token;
+    form.submit();
+  }
+
+  function openChallenge() {
+    return post(${JSON.stringify(params.mfaChallengeUrl)}, { factorId: factorId }, mfaToken).then(function (r) {
+      if (!r.ok || !r.body || !r.body.challengeId) throw failure(messageOf(r, "Could not start the second step"));
+      challengeId = r.body.challengeId;
+    });
+  }
+
+  function signIn() {
+    // The password goes to the EXISTING login endpoint and nowhere else. This
+    // page never posts it to the OAuth surface, which sees only the resulting
+    // session token.
+    return post(${JSON.stringify(params.loginUrl)}, { email: email.value, password: password.value }).then(function (r) {
+      var token = sessionFrom(r);
+      if (r.ok && token) return finish(token);
+
+      var details = r.body && r.body.error && r.body.error.details;
+      if (codeOf(r) === "MFA_REQUIRED" && details && details.mfaToken) {
+        var factors = details.factors || [];
+        var factor = null;
+        for (var i = 0; i < factors.length; i++) {
+          if (factors[i].factorType === "totp") { factor = factors[i]; break; }
+        }
+        factor = factor || factors[0];
+        if (!factor) throw failure("This account needs a second factor, but has none this screen can use.");
+        mfaToken = details.mfaToken;
+        factorId = factor.id;
+        return openChallenge().then(function () {
+          signin.hidden = true;
+          email.required = false;
+          password.required = false;
+          mfa.hidden = false;
+          mfaCode.required = true;
+          allow.textContent = "Verify and allow";
+          mfaCode.focus();
+        });
+      }
+      throw failure(messageOf(r, "Sign-in failed"));
+    });
+  }
+
+  function verifyCode() {
+    var code = String(mfaCode.value || "").trim();
+    return post(${JSON.stringify(params.mfaVerifyUrl)}, { challengeId: challengeId, code: code }, mfaToken).then(function (r) {
+      var token = sessionFrom(r);
+      if (r.ok && token) return finish(token);
+      var message = messageOf(r, "Verification failed");
+      var errorCode = codeOf(r);
+      // A spent or expired challenge cannot take another guess; open a fresh
+      // one so the person can simply type the next code.
+      if (errorCode === "CHALLENGE_EXHAUSTED" || errorCode === "INVALID_CHALLENGE") {
+        return openChallenge().then(function () { throw failure(message + " Enter a new code."); });
+      }
+      throw failure(message);
+    });
+  }
+
   form.addEventListener("submit", function (event) {
     if (decision.value === "deny") return;
     if (sessionToken.value) return;      // already signed in; let it post
@@ -22393,37 +23660,11 @@ function renderConsentPage(params) {
     error.textContent = "";
     allow.disabled = true;
 
-    // The password goes to the EXISTING login endpoint and nowhere else. This
-    // page never posts it to the OAuth surface, which sees only the resulting
-    // session token.
-    fetch(${JSON.stringify(params.loginUrl)}, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ email: email.value, password: password.value })
-    })
-      .then(function (res) { return res.json().then(function (b) { return { ok: res.ok, body: b }; }); })
-      .then(function (r) {
-        // buildAuthResponse returns { user, tokens: { accessToken } }. The
-        // flatter spellings are fallbacks rather than guesses: the login
-        // response passes through applyTransformHook, so a deployment can
-        // legitimately reshape it, and a consent screen that broke because
-        // someone customised their auth response would be a very hard failure
-        // to attribute.
-        //
-        // No backticks anywhere in this script: it lives inside a template
-        // literal, and one would end the string early — which is exactly how
-        // this comment broke the build the first time it was written.
-        var tokens = (r.body && r.body.tokens) || {};
-        var token = tokens.accessToken || (r.body && (r.body.accessToken || r.body.access_token));
-        if (!r.ok || !token) {
-          throw new Error((r.body && (r.body.error || r.body.message)) || "Sign-in failed.");
-        }
-        sessionToken.value = token;
-        form.submit();
-      })
+    (mfaToken ? verifyCode() : signIn())
+      .then(function () { allow.disabled = false; })
       .catch(function (err) {
         allow.disabled = false;
-        error.textContent = err.message || "Sign-in failed.";
+        error.textContent = (err && err.shown && err.message) || "Sign-in failed.";
       });
   });
 })();
@@ -22431,6 +23672,41 @@ function renderConsentPage(params) {
 </body>
 </html>`;
 }
+/**
+* What to call the redirect target on the consent screen.
+*
+* The host, not the whole URI: a path is the registrant's to dress up
+* ("/claude/official/callback"), the host is what they must own. A loopback
+* redirect is a native client on this person's own machine; a private-use
+* scheme (`com.example.app:/cb`) has no host, so it is shown whole.
+*/
+function describeRedirect(redirectUri) {
+	const unverified = "This server has not verified that this address belongs to the application named above. Allow only if you recognise it.";
+	let url;
+	try {
+		url = new URL(redirectUri);
+	} catch {
+		return {
+			label: redirectUri.slice(0, 200),
+			note: unverified
+		};
+	}
+	if (url.protocol === "http:" || url.protocol === "https:") {
+		const host = url.host;
+		if (url.hostname === "127.0.0.1" || url.hostname === "[::1]" || url.hostname === "::1" || url.hostname === "localhost") return {
+			label: `${host} (this computer)`,
+			note: "An application running on this computer receives the access. It is not verified by this server."
+		};
+		return {
+			label: host,
+			note: unverified
+		};
+	}
+	return {
+		label: redirectUri.slice(0, 200),
+		note: unverified
+	};
+}
 function escapeHtml$2(value) {
 	return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 }
@@ -22661,6 +23937,9 @@ function createOAuthRoutes(config) {
 			scopeDescriptions: describeScopes(scope),
 			requestToken,
 			loginUrl: `${config.authBasePath}/login`,
+			mfaChallengeUrl: `${config.authBasePath}/mfa/challenge`,
+			mfaVerifyUrl: `${config.authBasePath}/mfa/challenge/verify`,
+			redirectUri,
 			decisionUrl: `${c.req.path}/decision`,
 			resource: canonicalResource,
 			nonce
@@ -23091,7 +24370,8 @@ async function scopedDriver(ctx) {
 	return scopeDataDriver(ctx.driver, {
 		uid: ctx.caller.uid,
 		roles: ctx.caller.roles,
-		isAnonymous: false
+		isAnonymous: false,
+		...ctx.caller.credential ? { credential: ctx.caller.credential } : {}
 	});
 }
 /**
@@ -23223,6 +24503,10 @@ function readOptions(args, collection, ctx) {
 	}
 	if (args.limit !== void 0 && args.limit !== null) query.limit = String(args.limit);
 	if (args.offset !== void 0 && args.offset !== null) query.offset = String(args.offset);
+	if (args.deleted !== void 0 && args.deleted !== null) {
+		if (args.deleted !== "include" && args.deleted !== "only") throw new McpToolError("`deleted` takes \"include\" (live rows and trashed ones) or \"only\" (trashed rows alone). Omit it for the live rows.");
+		query.deleted = args.deleted;
+	}
 	return parseQueryOptions(query, {}, {
 		collection,
 		viewer: viewerOf(ctx)
@@ -23261,6 +24545,16 @@ var WHERE_ARG = {
 	type: "object",
 	description: "Filter, as the SDK's `where` and REST's `?where=`: field → [operator, value], e.g. {\"status\": [\"==\", \"paid\"], \"total\": [\">\", 100]}. Several conditions on one field: {\"total\": [[\">=\", 10], [\"<\", 100]]}. A belongsTo relation is filtered by its foreign key, as the rows carry it (e.g. \"authorId\"). Operators: " + ALL_WHERE_FILTER_OPS.join(", ") + "."
 };
+/**
+* REST's `?deleted=`. Without it every read hides the trash, so a row
+* delete_document sent there could never be found again to restore — while
+* describe_collection told the model that update_document restores it.
+*/
+var DELETED_ARG = {
+	type: "string",
+	enum: ["include", "only"],
+	description: "On a collection with a `softDeleteField` (see describe_collection): \"only\" reads the trashed rows alone, \"include\" reads them with the live ones. Omit it for the live rows."
+};
 var SEARCH_ARG = {
 	type: "string",
 	description: "Text search, as REST's `searchString`: matches rows whose text fields contain it (or the collection's declared full-text search)."
@@ -23329,7 +24623,8 @@ var MCP_TOOLS = [
 				offset: {
 					type: "number",
 					description: "Rows to skip."
-				}
+				},
+				deleted: DELETED_ARG
 			},
 			required: ["collection"],
 			additionalProperties: false
@@ -23354,7 +24649,8 @@ var MCP_TOOLS = [
 			properties: {
 				collection: COLLECTION_ARG,
 				where: WHERE_ARG,
-				searchString: SEARCH_ARG
+				searchString: SEARCH_ARG,
+				deleted: DELETED_ARG
 			},
 			required: ["collection"],
 			additionalProperties: false
@@ -23484,7 +24780,7 @@ var MCP_TOOLS = [
 	},
 	{
 		name: "delete_document",
-		description: "Delete a row by id. This cannot be undone.",
+		description: "Delete a row by id. On a collection with a `softDeleteField` (see describe_collection) the row goes to the trash: query_collection with `deleted: \"only\"` finds it, and update_document setting that field to null restores it. On any other collection the delete is permanent.",
 		requiredScope: "data:delete",
 		inputSchema: {
 			type: "object",
@@ -23650,7 +24946,12 @@ function createMcpRoutes(config) {
 				uid: resolved.uid,
 				roles: resolved.roles,
 				scopes: resolved.scopes,
-				clientId: `api-key:${resolved.apiKey.id}`
+				clientId: `api-key:${resolved.apiKey.id}`,
+				credential: {
+					kind: resolved.apiKey.kind,
+					id: resolved.apiKey.id,
+					name: resolved.apiKey.name
+				}
 			};
 		}
 		const payload = await jwt.verifyMcpAccessToken(token, canonicalResource);
@@ -23658,9 +24959,36 @@ function createMcpRoutes(config) {
 			error: "invalid_token",
 			error_description: "The access token is invalid, expired, or for another resource."
 		}, 401, { "WWW-Authenticate": bearerChallenge(config.publicUrl, config.mcpPath, DEFAULT_MCP_SCOPE) });
+		let roles = payload.roles;
+		if (config.identity) {
+			const refused = () => c.json({
+				error: "invalid_token",
+				error_description: "The account behind this access token is no longer active, or signed out."
+			}, 401, { "WWW-Authenticate": bearerChallenge(config.publicUrl, config.mcpPath, DEFAULT_MCP_SCOPE) });
+			const revocation = config.identity.revocation;
+			if (revocation && await isAccessTokenRevoked(revocation, {
+				uid: payload.uid,
+				iat: payload.iat
+			})) return refused();
+			let current;
+			try {
+				current = await config.identity.currentRoles(payload.uid);
+			} catch (error) {
+				logger.error("[mcp] Could not read the account behind an access token", {
+					uid: payload.uid,
+					error
+				});
+				return c.json({
+					error: "temporarily_unavailable",
+					error_description: "The account could not be checked. Try again."
+				}, 503, { "Retry-After": "1" });
+			}
+			if (!current) return refused();
+			roles = current;
+		}
 		return {
 			uid: payload.uid,
-			roles: payload.roles,
+			roles,
 			scopes: scopeList(upgradeStoredMcpScope(payload.scope)),
 			clientId: payload.clientId
 		};
@@ -24479,6 +25807,7 @@ function createHistoryRoutes(params) {
 	* {@link RestApiGenerator.getScopedDriver}.
 	*/
 	async function authorizeEntityRead(c, collection, id) {
+		refuseSimulatedWrite(c, httpMethodToOperation(c.req.method));
 		const narrowed = c.get("scopes");
 		const scope = `data:${httpMethodToOperation(c.req.method)}`;
 		if (narrowed && !scopeGrants(narrowed, scope, collection.slug)) throw new ApiError(403, "SCOPE_MISSING", `This credential does not hold "${scope}" for collection "${collection.slug}".`, { requiredScope: `${scope}:${collection.slug}` });
@@ -26210,12 +27539,14 @@ function resolveProvision(provision) {
 	if (typeof provision === "boolean") return {
 		database: provision,
 		collections: provision,
-		realtime: provision
+		realtime: provision,
+		off: !provision
 	};
 	return {
 		database: true,
 		collections: provision.collections ?? true,
-		realtime: provision.realtime ?? true
+		realtime: provision.realtime ?? true,
+		off: false
 	};
 }
 /**
@@ -26233,6 +27564,12 @@ function resolveProvision(provision) {
 * its backend. The one process-wide setting it touches is the log level, and
 * only when `logging.level` is given: the logger is the process's.
 *
+* What it reads process-wide is the resource graph: the `database()`,
+* `bucket()`, `topic()` and `queue()` declarations are module-level values,
+* and every backend in the process sees all of them. So a process holds one
+* project's resources — several backends of that project are fine, two
+* projects declaring different resources are not.
+*
 * What the build logs at info is written when the backend first serves — see
 * `boot-announcements.ts` — so a script that builds one and never mounts it
 * prints nothing of the boot's on its stdout.
@@ -26249,8 +27586,13 @@ async function createRebaseBackend(options) {
 	}
 }
 async function buildRebaseBackend(options, announcements) {
-	const config = options;
+	const config = {
+		...options,
+		auth: options.auth && !isAuthAdapter(options.auth) ? { ...options.auth } : options.auth
+	};
 	const provision = resolveProvision(config.provision);
+	if (provision.off) logger.info(PROVISIONING_OFF_NOTICE);
+	const provisionSkipReason = provision.off ? PROVISIONING_OFF_SKIP_REASON : void 0;
 	if (config.logging?.level !== void 0) setLogLevel(config.logging.level);
 	assertNoReplacedResourceConfig(config);
 	assertOneSourceEach(config);
@@ -26324,7 +27666,8 @@ async function buildRebaseBackend(options, announcements) {
 	await verifyProvisioningConnection(provisionTarget);
 	let schemaOutcome = await provisionCollectionTables(provisionable, provisionTarget, {
 		introspecting: introspectCollections,
-		provision: provision.collections
+		provision: provision.collections,
+		skipReason: provisionSkipReason
 	});
 	for (const target of provisionTargets.slice(1)) {
 		const mine = provisionableBy.get(target) ?? [];
@@ -26333,7 +27676,8 @@ async function buildRebaseBackend(options, announcements) {
 		await verifyProvisioningConnection(target);
 		const outcome = await provisionCollectionTables(mine, target, {
 			introspecting: introspectCollections,
-			provision: provision.collections
+			provision: provision.collections,
+			skipReason: provisionSkipReason
 		});
 		if (outcome.status === "applied" && schemaOutcome.status === "applied") schemaOutcome = {
 			status: "applied",
@@ -26459,7 +27803,8 @@ async function buildRebaseBackend(options, announcements) {
 	}
 	const policyOutcome = await provisionCollectionPolicies(provisionable, provisionTarget, {
 		introspecting: introspectCollections,
-		provision: provision.collections
+		provision: provision.collections,
+		skipReason: provisionSkipReason
 	});
 	for (const target of provisionTargets.slice(1)) {
 		const mine = provisionableBy.get(target) ?? [];
@@ -26467,7 +27812,8 @@ async function buildRebaseBackend(options, announcements) {
 		if (provision.collections && !provisioningDisabled() && target.bootstrapper.ensureRlsRuntime) await target.bootstrapper.ensureRlsRuntime(target.driverResult);
 		await provisionCollectionPolicies(mine, target, {
 			introspecting: introspectCollections,
-			provision: provision.collections
+			provision: provision.collections,
+			skipReason: provisionSkipReason
 		});
 	}
 	for (const bootstrapper of bootstrappers) {
@@ -26493,14 +27839,15 @@ async function buildRebaseBackend(options, announcements) {
 		}
 		logger.info("Entity history initialized");
 	} else logger.warn("History requested but default bootstrapper does not support initializeHistory");
+	if (config.functionsUpstream && !surfaces.functions && !serviceKey) throw new Error("REBASE_FUNCTIONS_UPSTREAM is set but REBASE_SERVICE_KEY is not. This process's own rebase.functions calls reach the functions process with the service key, so set REBASE_SERVICE_KEY to the same value on this process and on the functions process.");
 	const internalServiceKey = serviceKey || randomBytes(48).toString("base64");
 	if (!serviceKey) logger.info("No REBASE_SERVICE_KEY configured. Generated internal per-boot key for singleton control-plane APIs.");
-	if (authAdapter && !authAdapter.serviceKey) authAdapter.serviceKey = internalServiceKey;
+	if (authAdapter && !authAdapter.serviceKey) authAdapter = withBackendServiceKey(authAdapter, internalServiceKey);
 	let apiKeyStore;
-	const apiKeyStoreResult = createApiKeyStore(defaultDriver);
+	const apiKeyStoreResult = createApiKeyStore(defaultDriver, { provision: provision.database });
 	if (apiKeyStoreResult) {
 		apiKeyStore = apiKeyStoreResult;
-		if (provision.database) await apiKeyStore.ensureTable();
+		await apiKeyStore.ensureTable();
 		logger.debug("Service API Keys initialized");
 	}
 	const adminIdentityRepo = authConfigResult?.authRepository ?? authConfigResult?.userService;
@@ -26528,7 +27875,7 @@ async function buildRebaseBackend(options, announcements) {
 	const platformTokenPreAuth = createPlatformTokenPreAuth(await platformTokensFromEnv(process.env));
 	let backupLinkRouter;
 	if (surfaces.admin) {
-		const { createBackupLinkRoutes, backupDestinationFromEnv } = await import("./backup-B9m3cb3X.js").then((n) => n.t);
+		const { createBackupLinkRoutes, backupDestinationFromEnv } = await import("./backup-BVbHoKo8.js").then((n) => n.t);
 		backupLinkRouter = createBackupLinkRoutes({ getDestination: () => backupDestinationFromEnv(process.env) });
 	}
 	const apiKeyRouter = apiKeyStore && surfaces.admin ? createApiKeyRoutes({
@@ -26555,7 +27902,7 @@ async function buildRebaseBackend(options, announcements) {
 		...adminGateIdentity
 	});
 	const rateLimitWindowMs = config.rateLimit?.windowMs ?? 900 * 1e3;
-	const sharedRateLimitStore = config.rateLimit?.store ?? (resolveRateLimitStoreKind(process.env) === "sql" ? createSqlRateLimitStore(defaultDriver) : void 0);
+	const sharedRateLimitStore = config.rateLimit?.store ?? (resolveRateLimitStoreKind(process.env) === "sql" ? createSqlRateLimitStore(defaultDriver, { provision: provision.database }) : void 0);
 	const rateLimitStore = sharedRateLimitStore ?? new MemoryRateLimitStore(rateLimitWindowMs);
 	const authLimiters = createAuthLimiters(sharedRateLimitStore);
 	const rateLimitConfig = config.rateLimit?.enabled !== false ? {
@@ -26673,7 +28020,7 @@ async function buildRebaseBackend(options, announcements) {
 			]) {
 				const providerConfig = safeAuthConfig[key];
 				if (providerConfig && requiredFields.every((f) => Boolean(providerConfig[f]))) {
-					const createFn = (await import("./auth-Dkvo2tTJ.js").then((n) => n.t))[factory];
+					const createFn = (await import("./auth-izI7AEzC.js").then((n) => n.t))[factory];
 					oauthProviders.push(createFn(providerConfig));
 				}
 			}
@@ -26714,11 +28061,12 @@ async function buildRebaseBackend(options, announcements) {
 			const authRoutes = authAdapter.createAuthRoutes();
 			if (authRoutes) adapterAuthRouter = adapterRouter(authRoutes, "Auth");
 		}
-		if (authAdapter && authAdapter.createAdminRoutes && surfaces.admin) {
+		if (authAdapter && authAdapter.createAdminRoutes) {
 			const adminRoutes = authAdapter.createAdminRoutes();
 			if (adminRoutes) adapterAdminRouter = adapterRouter(adminRoutes, "Admin");
 		}
 		if (provision.database) await seedInitialAdmin(authAdapter?.userManagement);
+		else if (process.env.REBASE_ADMIN_EMAIL?.trim()) logger.info("REBASE_ADMIN_EMAIL is set, but this backend changes nothing in its database, so no admin account is seeded here. The provisioning run seeds it.");
 	}
 	services.authAdapter = authAdapter;
 	let mcpReady;
@@ -26729,11 +28077,11 @@ async function buildRebaseBackend(options, announcements) {
 		else if (!jwt.isConfigured()) logger.warn("[mcp] Surface enabled but no JWT secret is configured — not mounting.");
 		else if (!driver || !supportsRlsScoping(driver)) logger.error("[mcp] Surface enabled but this data driver cannot scope by user — not mounting. Every MCP call must run under the caller's own row-level security; a driver without `withAuth()` would run them as the database owner instead.");
 		else {
-			const store = createOAuthStore(driver);
+			const store = createOAuthStore(driver, { provision: provision.database });
 			if (!store) logger.error("[mcp] Surface enabled but the driver cannot persist OAuth state — not mounting.");
 			else {
 				let ready = true;
-				if (provision.database) try {
+				try {
 					await store.ensureTables();
 				} catch (error) {
 					ready = false;
@@ -26756,8 +28104,10 @@ async function buildRebaseBackend(options, announcements) {
 		const { store, publicUrl } = mcpReady;
 		const mcpPath = "/mcp";
 		const oauthBasePath = `${basePath}/oauth`;
+		const identity = grantIdentityFromRepository(adminIdentityRepo);
 		const mcpConfig = {
 			jwt,
+			identity,
 			publicUrl,
 			mcpPath,
 			oauthBasePath,
@@ -26773,16 +28123,16 @@ async function buildRebaseBackend(options, announcements) {
 			resolveApiKey: apiKeyStore ? (token) => resolveApiKey(apiKeyStore, token, access) : void 0
 		};
 		app.route("/", createMcpWellKnownRoutes(mcpConfig));
-		app.route(mcpPath, createMcpRoutes(mcpConfig));
-		app.route(oauthBasePath, createOAuthRoutes({
+		app.route(mcpPath, group(createMcpRoutes(mcpConfig)));
+		app.route(oauthBasePath, group(createOAuthRoutes({
 			store,
 			jwt,
 			publicUrl,
 			mcpPath,
 			authBasePath: `${basePath}/auth`,
 			allowDynamicRegistration: parseEnvBoolean(process.env.REBASE_MCP_OPEN_REGISTRATION) !== false,
-			identity: grantIdentityFromRepository(adminIdentityRepo)
-		}));
+			identity
+		})));
 		if (announce) logger.info(`MCP endpoint mounted at ${publicUrl}${mcpPath} (OAuth at ${oauthBasePath})`);
 	};
 	const mountWarnings = [];
@@ -26864,7 +28214,7 @@ async function buildRebaseBackend(options, announcements) {
 	let schemaEditorRoutes;
 	let schemaSourceEditor;
 	if (!schemaEditorOff && config.collectionsDir) try {
-		const editorModule = await import("./schema-editor-routes-Bsut0bCC.js");
+		const editorModule = await import("./schema-editor-routes-Dc3DU_jm.js");
 		schemaSourceEditor = editorModule.createSchemaSourceEditor(config.collectionsDir);
 		schemaEditorRoutes = editorModule.createSchemaEditorRoutes(schemaSourceEditor);
 	} catch (err) {
@@ -26914,7 +28264,7 @@ async function buildRebaseBackend(options, announcements) {
 		let remoteEditingOff;
 		if (remoteRepo) {
 			try {
-				remoteEditor = await import("./ast-schema-editor-mCeSC03x.js");
+				remoteEditor = await import("./ast-schema-editor-madTa9Hh.js");
 			} catch (err) {
 				if (err?.code !== "ERR_MODULE_NOT_FOUND") throw err;
 				remoteEditingOff = {
@@ -26938,7 +28288,6 @@ async function buildRebaseBackend(options, announcements) {
 			const collectionsDir = config.collectionsDir;
 			const repositoryRoot = collectionsDir ? await findRepositoryRoot(collectionsDir) : void 0;
 			const liveSchemaRouter = new Hono();
-			let undeployedCommit;
 			applyAdminGate(liveSchemaRouter, "Live schema editing", "schema:read");
 			liveSchemaRouter.use("/*", sayEditorNeedsTsMorph);
 			const commitPaths = remoteRepo ? commitPathsFor(path.join("/", remoteRepo.collectionsPath ?? "config/collections"), "/") : collectionsDir && repositoryRoot ? commitPathsFor(collectionsDir, repositoryRoot) : void 0;
@@ -26946,29 +28295,23 @@ async function buildRebaseBackend(options, announcements) {
 			liveSchemaRouter.route("/", createLiveSchemaRoutes({
 				commitPaths,
 				sourceEditingOff: remoteRepo ? remoteEditingOff : schemaEditorOff,
+				databaseChangesOff: provision.off ? {
+					code: "SCHEMA_EDITING_PROVISIONING_OFF",
+					message: "This deployment changes nothing in its database (provisioning is off), so a change cannot be applied from here. Commit it as source only, and let the process that changes this database apply it."
+				} : void 0,
 				usesVersionedMigrations: collectionsDir ? () => usesVersionedMigrations(collectionsDir) : void 0,
 				policy: { allowMachineApply: config.liveSchema?.allowMachineApply ?? parseEnvBoolean(process.env.REBASE_LIVE_SCHEMA_ALLOW_MACHINE_APPLY) === true },
 				getCollections: () => collectionRegistry.getRawCollections(),
 				getAdmin: () => defaultDriver.admin,
 				resolveAuthorIdentity: (uid) => readAccountIdentity(authAdapter, uid),
 				getRepository: (author) => {
-					if (remoteRepo) {
-						const repository = createGitHubRepository({
-							auth: remoteRepo.auth,
-							owner: remoteRepo.owner,
-							repo: remoteRepo.repo,
-							branch: remoteRepo.branch ?? "main",
-							author
-						});
-						return {
-							...repository,
-							commit: async (paths, message) => {
-								const sha = await repository.commit(paths, message);
-								undeployedCommit = sha;
-								return sha;
-							}
-						};
-					}
+					if (remoteRepo) return createGitHubRepository({
+						auth: remoteRepo.auth,
+						owner: remoteRepo.owner,
+						repo: remoteRepo.repo,
+						branch: remoteRepo.branch ?? "main",
+						author
+					});
 					if (!repositoryRoot) return void 0;
 					return createLocalGitRepository({
 						root: repositoryRoot,
@@ -26976,15 +28319,20 @@ async function buildRebaseBackend(options, announcements) {
 					});
 				},
 				writeSource: remoteRepo ? remoteEditor ? async (change) => {
-					if (undeployedCommit) throw new Error(`This deployment already committed a schema change (${undeployedCommit.slice(0, 9)}) that it is not running yet. Deploy that commit, then make the next change: until then a change here is planned against the collections this deployment runs, and its generated schema files would leave the first change out. Nothing was changed.`);
+					const repository = createGitHubRepository({
+						auth: remoteRepo.auth,
+						owner: remoteRepo.owner,
+						repo: remoteRepo.repo,
+						branch: remoteRepo.branch ?? "main"
+					});
+					const admin = defaultDriver.admin;
+					if (isSchemaEditingAdmin(admin)) {
+						const served = collectionRegistry.getRawCollections();
+						await refuseWhenRepositoryIsAhead(repository, (await admin.planSchemaChange(served, served, { paths: commitPaths })).files);
+					}
 					const { AstSchemaEditor } = remoteEditor;
 					return rewriteRemoteCollection({
-						repository: createGitHubRepository({
-							auth: remoteRepo.auth,
-							owner: remoteRepo.owner,
-							repo: remoteRepo.repo,
-							branch: remoteRepo.branch ?? "main"
-						}),
+						repository,
 						collectionsPath: remoteRepo.collectionsPath ?? "config/collections",
 						edit: async (dir, collectionId, edit) => {
 							const editor = new AstSchemaEditor(dir);
@@ -27016,6 +28364,8 @@ async function buildRebaseBackend(options, announcements) {
 	const storageAuthorizeData = {};
 	let storageSurface;
 	let storageMaintenanceSurface;
+	/** The orphan scan's background half, whenever storage is on: the job queue's `storage.orphans` handler. */
+	let orphanScans;
 	/** Whether the storage group carries its own upload body limit, in place of the global one. */
 	let storageCarriesUploadLimit = false;
 	if (storageRegistry || storageController) {
@@ -27034,6 +28384,19 @@ async function buildRebaseBackend(options, announcements) {
 			publicRead: config.storagePublicRead === true,
 			allowAnyAuthenticated: config.storageInsecureAllowAnyAuthenticated === true
 		}, isProduction);
+		const maintenanceSources = {
+			registry: storageRegistry,
+			controller: storageController,
+			collections: () => collectionRegistry.getRawCollections(),
+			driverFor: (collection) => {
+				const key = resolveDataSource(collection, dataSourceRegistry).key;
+				return !key || key === "(default)" ? defaultDriver : driverRegistry.get(key);
+			},
+			globalCallbacks: () => collectionRegistry.getGlobalCallbacks(),
+			history: historyConfigResult?.historyService,
+			jobs: () => jobQueue
+		};
+		orphanScans = createOrphanScanService(maintenanceSources);
 		if (surfaces.admin) {
 			const maintenanceRouter = new Hono();
 			applyAdminGate(maintenanceRouter, "Storage maintenance", {
@@ -27041,13 +28404,8 @@ async function buildRebaseBackend(options, announcements) {
 				write: "database:write"
 			});
 			maintenanceRouter.route("/", createStorageMaintenanceRoutes({
-				registry: storageRegistry,
-				controller: storageController,
-				collections: () => collectionRegistry.getRawCollections(),
-				driverFor: (collection) => {
-					const key = resolveDataSource(collection, dataSourceRegistry).key;
-					return !key || key === "(default)" ? defaultDriver : driverRegistry.get(key);
-				}
+				...maintenanceSources,
+				orphanScans
 			}));
 			storageMaintenanceSurface = maintenanceRouter;
 		}
@@ -27137,7 +28495,7 @@ async function buildRebaseBackend(options, announcements) {
 			});
 			dataRouter.route("/", historyRoutes);
 		}
-		const restGenerator = new RestApiGenerator(serverCollections, defaultDriver, authAdapter);
+		const restGenerator = new RestApiGenerator(serverCollections, defaultDriver, authAdapter, void 0, void 0, { provision: provision.database });
 		dataRouter.route("/", restGenerator.generateRoutes());
 		dataSurface = dataRouter;
 	} else {
@@ -27206,21 +28564,38 @@ async function buildRebaseBackend(options, announcements) {
 	}
 	const driverAdmin = defaultBootstrapper.getAdmin?.(defaultDriverResult);
 	if (isSQLAdmin(driverAdmin)) {
-		Object.assign(serverClient, { sql: (query, sqlOptions) => driverAdmin.executeSql(query, sqlOptions && {
-			role: sqlOptions.role,
-			params: sqlOptions.params,
-			...sqlOptions.database !== void 0 ? { database: resourceKeyOf(sqlOptions.database) } : {}
-		}) });
+		const sqlAdminFor = (key) => {
+			if (key === "(default)" || key === defaultDriverId) return driverAdmin;
+			const source = bootstrappers.find((b) => (b.id || b.type) === key);
+			if (!source) {
+				const known = bootstrappers.map((b) => `"${b.id || b.type}"`).join(", ");
+				throw new Error(`rebase.sql: no data source "${key}" is configured on this backend. Configured: ${known}. Declare it with database("${key}") in config/resources.ts and bind it — \`rebase status\` shows which variable.`);
+			}
+			const result = driverResults.get(source);
+			const admin = result ? source.getAdmin?.(result) : void 0;
+			if (!isSQLAdmin(admin)) throw new Error(`rebase.sql: data source "${key}" is not a SQL database, so it cannot run raw SQL.`);
+			return admin;
+		};
+		Object.assign(serverClient, { sql: async (query, sqlOptions) => {
+			return (sqlOptions?.database !== void 0 ? sqlAdminFor(resourceKeyOf(sqlOptions.database)) : driverAdmin).executeSql(query, sqlOptions && {
+				role: sqlOptions.role,
+				params: sqlOptions.params
+			});
+		} });
 		logger.debug("SQL capability attached to singleton");
 	}
 	const serverSingleton = serverClient;
 	const ownScope = { rebase: serverSingleton };
+	const runInOwnScope = (fn) => runInBackendScope(ownScope, fn);
+	const realtimeProviders = new Set(Object.values(realtimeServices));
+	if (defaultRealtimeService) realtimeProviders.add(defaultRealtimeService);
+	for (const provider of realtimeProviders) provider.setScopeRunner?.(runInOwnScope);
 	injectCallbackClient(driverResults.values(), serverClient);
 	let functionsSurface;
 	if ((config.functionsDir || config.functions) && surfaces.functions) {
-		const { functionList, readFunctionsDirectory } = await import("./function-loader-KKDqTcIr.js").then((n) => n.t);
+		const { functionList, readFunctionsDirectory } = await import("./function-loader-B8YzXEsQ.js").then((n) => n.t);
 		const { createFunctionRoutes } = await import("./function-routes-RxrCHNuM.js").then((n) => n.n);
-		const { createFunctionsRequestTimeout, resolveFunctionsTimeoutMs } = await import("./request-timeout-59crS-9u.js").then((n) => n.t);
+		const { createFunctionsRequestTimeout, resolveFunctionsTimeoutMs } = await import("./request-timeout-DVjo-c_8.js").then((n) => n.t);
 		const { functions: functionRecord, problems } = config.functions ? {
 			functions: config.functions,
 			problems: []
@@ -27269,20 +28644,21 @@ async function buildRebaseBackend(options, announcements) {
 		});
 		else logger.warn(`Function routes are served, but no functions loaded from ${config.functionsDir ?? "the `functions` option"}. ` + (problems.length > 0 ? `${problems.length} file(s) were skipped — see the messages above.` : "The directory holds no .ts/.js function files."));
 	}
+	const forwardsFunctionsOnlyInProcess = !surfaces.functions && !surfaces.auth && !surfaces.data && !surfaces.storage && !surfaces.admin && !surfaces.meta;
 	if (config.functionsUpstream && !surfaces.functions) {
-		const { createFunctionsProxy } = await import("./proxy-CH8Jsovg.js").then((n) => n.t);
+		const { createFunctionsProxy } = await import("./proxy-BYir8tWK.js").then((n) => n.t);
 		functionsSurface = createFunctionsProxy({ upstream: config.functionsUpstream });
-		logger.info("Forwarding custom functions to another process", { upstream: config.functionsUpstream });
+		logger.info(forwardsFunctionsOnlyInProcess ? "Forwarding this process's own function calls (rebase.functions) to another process" : "Forwarding custom functions to another process", { upstream: config.functionsUpstream });
 	}
 	let cronScheduler;
 	let cronSurface;
 	/** How many cron jobs `start()` schedules in this process. */
 	let cronJobsToSchedule = 0;
 	if (surfaces.cron || (config.cronsDir || config.crons) && ownership.cronScheduler) {
-		const { cronJobsFrom, readCronsDirectory } = await import("./cron-loader-Dj6lA4HQ.js").then((n) => n.t);
-		const { CronScheduler } = await import("./cron-scheduler-B04ACoUE.js").then((n) => n.n);
-		const { createCronRoutes } = await import("./cron-routes-CwbLZguO.js").then((n) => n.n);
-		const { createCronStore } = await import("./cron-store-DkyfuLOH.js").then((n) => n.n);
+		const { cronJobsFrom, readCronsDirectory } = await import("./cron-loader-mMhqbVsl.js").then((n) => n.t);
+		const { CronScheduler } = await import("./cron-scheduler-Be7CNghL.js").then((n) => n.n);
+		const { createCronRoutes } = await import("./cron-routes-Cs33j_Kr.js").then((n) => n.n);
+		const { createCronStore } = await import("./cron-store-DLn11M8H.js").then((n) => n.n);
 		const { crons: cronRecord, problems: cronProblems } = config.crons ? {
 			crons: config.crons,
 			problems: []
@@ -27301,9 +28677,9 @@ async function buildRebaseBackend(options, announcements) {
 		cronScheduler.setClient(serverSingleton);
 		if (loadedCronJobs.length > 0) {
 			cronScheduler.registerJobs(loadedCronJobs);
-			const store = defaultBootstrapper.getAdmin?.(defaultDriverResult) && config.cronPersistence !== false ? createCronStore(defaultDriver) : void 0;
+			const store = defaultBootstrapper.getAdmin?.(defaultDriverResult) && config.cronPersistence !== false ? createCronStore(defaultDriver, { provision: provision.database }) : void 0;
 			if (store) {
-				if (provision.database) await store.ensureTable();
+				await store.ensureTable();
 				cronScheduler.setStore(store);
 			}
 		}
@@ -27343,24 +28719,28 @@ async function buildRebaseBackend(options, announcements) {
 	}
 	let metricsHistory;
 	try {
-		const { createMetricsHistory } = await import("./history-recorder-B2rkuhuy.js");
-		metricsHistory = createMetricsHistory(defaultDriver);
-		if (metricsHistory && provision.database) await metricsHistory.ensure();
+		const { createMetricsHistory } = await import("./history-recorder-Bsau7h4X.js");
+		metricsHistory = createMetricsHistory(defaultDriver, { provision: provision.database });
+		if (metricsHistory) await metricsHistory.ensure();
 	} catch (err) {
 		logger.warn("[metrics] history is unavailable; the runtime is otherwise unaffected.", { err });
 		metricsHistory = void 0;
 	}
 	let jobQueue;
 	if (jobsOptions?.enabled) {
-		const { createJobStore, createJobQueue } = await import("./jobs-h1WRq3cp.js").then((n) => n.t);
-		const store = createJobStore(defaultDriver);
+		const { createJobStore, createJobQueue } = await import("./jobs-Co6Ni5HP.js").then((n) => n.t);
+		const store = createJobStore(defaultDriver, { provision: provision.database });
 		if (store) {
-			if (provision.database) await store.ensureTable();
+			await store.ensureTable();
 			const tasks = Object.fromEntries(Object.entries(jobsOptions.tasks ?? {}).map(([task, handler]) => [task, (ctx) => runInBackendScope(ownScope, () => handler(ctx))]));
 			jobQueue = createJobQueue(store, {
 				...jobsOptions,
 				tasks
 			});
+			if (orphanScans) {
+				const scans = orphanScans;
+				jobQueue.register(STORAGE_ORPHANS_TASK, (ctx) => runInBackendScope(ownScope, () => scans.runTask(ctx.payload, ctx.signal)));
+			}
 			if (declaredTopics.length > 0) {
 				ownScope.topics = createTopicRuntime({
 					queue: jobQueue,
@@ -27388,11 +28768,12 @@ Use a driver that supports the job queue, or remove the declarations. Refusing t
 	let backupSurface;
 	let rlsAuditSurface;
 	let sqlExportSurface;
+	let branchSurface;
 	let devMailSurface;
 	let logsSurface;
 	let metaSurface;
 	if (surfaces.admin) {
-		const { createBackupRoutes, backupDestinationFromEnv, readBackupSchedule } = await import("./backup-B9m3cb3X.js").then((n) => n.t);
+		const { createBackupRoutes, backupDestinationFromEnv, readBackupSchedule } = await import("./backup-BVbHoKo8.js").then((n) => n.t);
 		const backupRouter = new Hono();
 		applyAdminGate(backupRouter, "Backup", "backups:read");
 		const scheduler = cronScheduler;
@@ -27412,13 +28793,36 @@ Use a driver that supports the job queue, or remove the declarations. Refusing t
 		}));
 		rlsAuditSurface = rlsAuditRouter;
 	}
+	let rlsSimulatorSurface;
+	if (surfaces.admin) {
+		const { createRlsSimulatorRoutes } = await import("./rls-simulator-routes-bEY7-5-u.js");
+		const rlsSimulatorRouter = new Hono();
+		applyAdminGate(rlsSimulatorRouter, "RLS simulator", "schema:read");
+		rlsSimulatorRouter.route("/", createRlsSimulatorRoutes({
+			collections: () => collectionRegistry.getRawCollections(),
+			driverFor: (slug) => {
+				const key = keyForCollectionPath(slug);
+				return !key || key === "(default)" ? defaultDriver : driverRegistry.get(key) ?? defaultDriver;
+			},
+			resolveUser: authAdapter?.resolveUser ? authAdapter.resolveUser.bind(authAdapter) : void 0,
+			apiKeyStore
+		}));
+		rlsSimulatorSurface = rlsSimulatorRouter;
+	}
 	if (surfaces.admin) {
-		const { createSqlExportRoutes } = await import("./sql-export-routes-DmB_uZ4l.js");
+		const { createSqlExportRoutes } = await import("./sql-export-routes-QycX8W8S.js");
 		const sqlExportRouter = new Hono();
 		applyAdminGate(sqlExportRouter, "SQL export", "database:write");
 		sqlExportRouter.route("/", createSqlExportRoutes({ getAdmin: () => defaultDriver.admin }));
 		sqlExportSurface = sqlExportRouter;
 	}
+	if (surfaces.admin) {
+		const { createBranchRoutes } = await import("./branch-routes-B2vvEx53.js");
+		const branchRouter = new Hono();
+		applyAdminGate(branchRouter, "Branch review", "database:write");
+		branchRouter.route("/", createBranchRoutes({ getAdmin: () => defaultDriver.admin }));
+		branchSurface = branchRouter;
+	}
 	if (surfaces.admin) {
 		const devMailRouter = new Hono();
 		applyAdminGate(devMailRouter, "Development mailbox", "users:write");
@@ -27426,8 +28830,10 @@ Use a driver that supports the job queue, or remove the declarations. Refusing t
 			code: "DEV_MAILBOX_UNAVAILABLE",
 			message: "No development mailbox is active. Mail is captured only when SMTP_HOST is unset and NODE_ENV is not production; with a mail server configured, messages are delivered rather than held here."
 		} };
+		const ownEmail = config.auth && !isAuthAdapter(config.auth) ? config.auth.email : void 0;
+		const devMailbox = () => ownEmail ? devEmailSinkFor(ownEmail.sendEmail) : activeDevEmailSink();
 		devMailRouter.get("/", (c) => {
-			const sink = activeDevEmailSink();
+			const sink = devMailbox();
 			if (!sink) return c.json(unavailable, 501);
 			return c.json({
 				enabled: true,
@@ -27435,7 +28841,7 @@ Use a driver that supports the job queue, or remove the declarations. Refusing t
 			});
 		});
 		devMailRouter.delete("/", (c) => {
-			const sink = activeDevEmailSink();
+			const sink = devMailbox();
 			if (!sink) return c.json(unavailable, 501);
 			sink.clear();
 			return c.json({ cleared: true });
@@ -27450,7 +28856,7 @@ Use a driver that supports the job queue, or remove the declarations. Refusing t
 		logsSurface = logsRouter;
 	}
 	if (surfaces.meta) {
-		const { createContractRoutes } = await import("./contract-routes-CsFXW7j4.js").then((n) => n.t);
+		const { createContractRoutes } = await import("./contract-routes-CU2A3JnF.js").then((n) => n.t);
 		const contractRouter = new Hono();
 		if (adminSurfacesGated) contractRouter.use("/contract", ...adminGate("schema:read"));
 		else {
@@ -27509,10 +28915,20 @@ Use a driver that supports the job queue, or remove the declarations. Refusing t
 	/**
 	* A group: this backend's services on every request first, then a fresh
 	* router over `router`'s handlers.
-	*/
-	const group = (router) => {
+	*
+	* Each group also answers the impersonation and simulation headers itself,
+	* so one mounted on its own (`backend.routes.storage()` at `/v2/storage`)
+	* keeps the rule `mount()` installs on its base path. A group that does
+	* not run requests as someone else refuses them; the data and functions
+	* groups (`"honoured"`), whose auth middleware applies them, report what a
+	* simulated request ran as. Without this a custom server's storage or
+	* admin group answered `x-rebase-impersonate: <B>` as the administrator
+	* who sent it, under B's label.
+	*/
+	const group = (router, identitySwap = "refused") => {
 		const composed = new Hono();
 		composed.use("/*", provideServices);
+		composed.use("/*", identitySwap === "honoured" ? reportSimulatedContext() : refuseUnhonouredImpersonation([]));
 		return router ? composed.route("/", router) : composed;
 	};
 	const requireSurface = (surface) => {
@@ -27532,7 +28948,7 @@ Use a driver that supports the job queue, or remove the declarations. Refusing t
 		},
 		data: () => {
 			requireSurface("data");
-			return group(dataSurface);
+			return group(dataSurface, "honoured");
 		},
 		storage: () => {
 			requireSurface("storage");
@@ -27540,7 +28956,7 @@ Use a driver that supports the job queue, or remove the declarations. Refusing t
 		},
 		functions: () => {
 			if (!functionsSurface) throw new Error("routes.functions(): this backend serves no functions. Pass `functions` (or `functionsDir`) with the functions surface on, or `functionsUpstream` with it off to forward them.");
-			return group(functionsSurface);
+			return group(functionsSurface, "honoured");
 		},
 		admin: () => {
 			requireSurface("admin");
@@ -27555,7 +28971,9 @@ Use a driver that supports the job queue, or remove the declarations. Refusing t
 			if (storageMaintenanceSurface) adminGroup.route("/storage", storageMaintenanceSurface);
 			if (backupSurface) adminGroup.route("/backups", backupSurface);
 			if (rlsAuditSurface) adminGroup.route("/rls-audit", rlsAuditSurface);
+			if (rlsSimulatorSurface) adminGroup.route("/rls-simulator", rlsSimulatorSurface);
 			if (sqlExportSurface) adminGroup.route("/sql", sqlExportSurface);
+			if (branchSurface) adminGroup.route("/branches", branchSurface);
 			if (devMailSurface) adminGroup.route("/dev/emails", devMailSurface);
 			if (logsSurface) adminGroup.route("/logs", logsSurface);
 			return adminGroup;
@@ -27617,6 +29035,7 @@ Use a driver that supports the job queue, or remove the declarations. Refusing t
 		});
 		app.use(`${basePath}/*`, refuseUnhonouredImpersonation([`${basePath}/data`, `${basePath}/functions`]));
 		if (surfaces.admin) app.route(`${basePath}/admin`, groups.admin());
+		else if (!announce) mountInProcessAdmin(app, basePath);
 		if (surfaces.auth) app.route(`${basePath}/auth`, groups.auth());
 		if (jwt.isConfigured() && surfaces.auth) {
 			app.route("/.well-known", createJwksRoutes(jwt));
@@ -27642,7 +29061,7 @@ Use a driver that supports the job queue, or remove the declarations. Refusing t
 				unprotectedTables
 			});
 		}
-		if (functionsSurface) {
+		if (functionsSurface && (!announce || !forwardsFunctionsOnlyInProcess)) {
 			app.route(`${basePath}/functions`, groups.functions());
 			if (announce) logger.debug("Function routes mounted", { path: `${basePath}/functions` });
 		}
@@ -27654,27 +29073,64 @@ Use a driver that supports the job queue, or remove the declarations. Refusing t
 		if (surfaces.meta && metaSurface) app.route(`${basePath}/meta`, groups.meta());
 		if (announce) logger.debug("Rebase backend mounted", { basePath });
 	};
+	const mountInProcessAdmin = (app, basePath) => {
+		if (adapterAdminRouter) {
+			const adminGroup = group();
+			adminGroup.route("/", adapterAdminRouter);
+			app.route(`${basePath}/admin`, adminGroup);
+		}
+		if (cronSurface && !surfaces.cron) app.route(`${basePath}/admin/cron`, group(cronSurface));
+	};
 	let inProcess;
 	const inProcessApp = () => {
 		if (!inProcess) {
 			inProcess = new Hono();
 			mountInto(inProcess, IN_PROCESS_BASE_PATH, false);
+			refuseSurfacesOffByName(inProcess);
 		}
 		return inProcess;
 	};
+	const refuseSurfacesOffByName = (app) => {
+		const elsewhere = "Call it over HTTP on a process that serves it, or run this code on one.";
+		const off = [];
+		if (!functionsSurface) off.push({
+			path: "functions",
+			surface: "functions",
+			roles: "REBASE_ROLE=worker and REBASE_ROLE=api",
+			consequence: "rebase.functions has nothing to call in this process",
+			remedy: "Set REBASE_FUNCTIONS_UPSTREAM to the functions process's URL on this process to forward these calls there, or call the function over HTTP on a process that serves it."
+		});
+		if (!surfaces.auth) off.push({
+			path: "auth",
+			surface: "auth",
+			roles: "REBASE_ROLE=worker and REBASE_ROLE=functions",
+			consequence: "rebase.auth has nothing to call in this process",
+			remedy: `For account administration from server code use rebase.admin, which works here. ${elsewhere}`
+		});
+		if (!surfaces.admin) off.push({
+			path: "admin",
+			surface: "admin",
+			roles: "REBASE_ROLE=worker and REBASE_ROLE=functions",
+			consequence: adapterAdminRouter || cronSurface ? "this process carries only the user and role administration (rebase.admin) and the cron controls (rebase.cron) in-process, and this is neither" : "rebase.admin and rebase.cron have nothing to call in this process",
+			remedy: elsewhere
+		});
+		for (const { path, surface, consequence, roles, remedy } of off) app.all(`${IN_PROCESS_BASE_PATH}/${path}/*`, (c) => errorHandler(new ApiError(404, "NOT_FOUND", `No route for ${c.req.method} ${c.req.path} on this backend: its ${surface} surface is off (${roles} turn it off), so ${consequence}. ${remedy}`, void 0, true), c));
+	};
 	let realtimeAttached = false;
 	const attachRealtime = async (server, attachOptions = {}) => {
 		announcements.serve();
 		if (!surfaces.realtime || !defaultBootstrapper.initializeWebsockets || !effectiveRealtimeService) return;
 		if (realtimeAttached) throw new Error("attachRealtime(): this backend's websocket is already attached to a server.");
 		realtimeAttached = true;
-		await defaultBootstrapper.initializeWebsockets(server, effectiveRealtimeService, defaultDriver, config.auth, authAdapter, {
+		const socketAuthConfig = config.auth && isAuthAdapter(config.auth) ? authAdapter : config.auth;
+		await defaultBootstrapper.initializeWebsockets(server, effectiveRealtimeService, defaultDriver, socketAuthConfig, authAdapter, {
 			maxPayload: config.maxBodySize,
 			dataRateLimit: rateLimitConfig ? createDataRateLimitCheck(rateLimitConfig) : void 0,
 			resolveApiKey: apiKeyStore ? (token) => resolveApiKey(apiKeyStore, token, access) : void 0,
 			verifyAccessToken: (token) => jwt.isConfigured() ? jwt.verifyAccessToken(token) : Promise.resolve(null),
 			accessModel: access.model,
-			path: attachOptions.path ?? realtimeSocketPath(mountedBasePath)
+			path: attachOptions.path ?? realtimeSocketPath(mountedBasePath),
+			runInScope: runInOwnScope
 		});
 	};
 	let started = false;
@@ -27715,13 +29171,15 @@ Use a driver that supports the job queue, or remove the declarations. Refusing t
 			authRepo: adminIdentityRepo,
 			driver: defaultDriver,
 			ownsTimers: ownership.cronScheduler,
-			persistClaims: config.cronPersistence !== false
+			persistClaims: config.cronPersistence !== false,
+			provision: provision.database
 		});
 		historyRetentionSweep = startHistoryRetentionSweep({
 			historyService: historyConfigResult?.historyService,
 			driver: defaultDriver,
 			ownsTimers: ownership.cronScheduler,
-			persistClaims: config.cronPersistence !== false
+			persistClaims: config.cronPersistence !== false,
+			provision: provision.database
 		});
 	};
 	const shutdown = (timeoutMs, shutdownOptions = {}) => announcements.run(() => createShutdown({
@@ -27732,6 +29190,7 @@ Use a driver that supports the job queue, or remove the declarations. Refusing t
 		authTokenSweep,
 		historyRetentionSweep,
 		stopMetricsSampler,
+		ownedRateLimitStore: config.rateLimit?.store ? void 0 : sharedRateLimitStore,
 		realtimeServices,
 		closeLongLivedResponses: () => longLivedResponses.abort(),
 		emailService
@@ -27823,7 +29282,12 @@ function setDefaultBackend(backend) {
 *
 * ```ts
 * installUnhandledRejectionHandler();
-* const backend = await createRebaseBackend({ ...options, provision: true });
+* const backend = await createRebaseBackend({
+*     ...options,
+*     provision: !resolveProvisionEnv(process.env)
+*         ? false
+*         : provisionSchema === false ? { collections: false, realtime: false } : true
+* });
 * setDefaultBackend(backend);
 * backend.mount(app, { basePath });
 * await backend.attachRealtime(server);
@@ -27844,7 +29308,7 @@ async function initializeRebaseBackend(config) {
 	installUnhandledRejectionHandler();
 	const backend = await createRebaseBackend({
 		...options,
-		provision: provisionSchema === false ? {
+		provision: !resolveProvisionEnv(process.env) ? false : provisionSchema === false ? {
 			collections: false,
 			realtime: false
 		} : true
@@ -27914,7 +29378,7 @@ function typedSingleton() {
 function defineFunction(definition) {
 	const app = new Hono();
 	const returned = definition(app, { rebase: typedSingleton() });
-	return returned instanceof Hono ? returned : app;
+	return isHonoLike(returned) ? returned : app;
 }
 //#endregion
 //#region src/functions/runtime-env.ts
@@ -29681,12 +31145,55 @@ function strictTransportSecurity(includeSubDomains) {
 * that broke any of them would be one every project had to turn off.
 */
 var STATIC_APP_CSP = "frame-ancestors 'self'; object-src 'none'; base-uri 'self'";
+/**
+* The `Referrer-Policy` this runtime sends: `strict-origin-when-cross-origin`,
+* the browsers' own default. A cross-origin request carries the page's origin
+* and never its path or query.
+*
+* Not `no-referrer`, the `secureHeaders()` default it used to send: an origin
+* check then sees no origin at all. Google's "Sign in with Google" button is the
+* one that bit — it compares the page's origin with the OAuth client's
+* authorized JavaScript origins, and under `no-referrer` it refused every
+* Rebase-hosted app with "The given origin is not allowed for the given client
+* ID", whatever the client allowed.
+*/
+var DEFAULT_REFERRER_POLICY = "strict-origin-when-cross-origin";
+/**
+* The headers a route may set for itself, and what every other response gets.
+*
+* `secureHeaders()` overwrites whatever the route set, and some routes set a
+* stricter value on purpose — the MCP consent page sends `no-referrer`, so the
+* `client_id` and `state` in its URL go nowhere, and `X-Frame-Options: DENY`,
+* because a consent screen that can be framed is one an attacker can have
+* clicked. So these two are sent here instead, and only when the route did not.
+*/
+var OVERRIDABLE_DEFAULTS = [["Referrer-Policy", DEFAULT_REFERRER_POLICY], ["X-Frame-Options", "SAMEORIGIN"]];
+/**
+* Sends `Referrer-Policy: strict-origin-when-cross-origin` and
+* `X-Frame-Options: SAMEORIGIN` on every response that does not set its own.
+*
+* Use it beside `secureHeaders({ referrerPolicy: false, xFrameOptions: false })`;
+* left on, those two options overwrite the route's value. A static app that
+* wants a stricter referrer policy says so with `<meta name="referrer">`.
+*/
+function overridableSecurityHeaders() {
+	return async (c, next) => {
+		await next();
+		for (const [name, value] of OVERRIDABLE_DEFAULTS) if (!c.res.headers.has(name)) c.header(name, value);
+	};
+}
 /** The security headers both boot paths — backend and static-only — install. */
 function runtimeSecureHeaders(options) {
-	return secureHeaders({
+	const headers = secureHeaders({
 		crossOriginResourcePolicy: "cross-origin",
 		crossOriginOpenerPolicy: "same-origin-allow-popups",
-		strictTransportSecurity: strictTransportSecurity(options.hstsIncludeSubDomains)
+		strictTransportSecurity: strictTransportSecurity(options.hstsIncludeSubDomains),
+		referrerPolicy: false,
+		xFrameOptions: false
+	});
+	const overridable = overridableSecurityHeaders();
+	return (c, next) => headers(c, async () => {
+		await overridable(c, next);
 	});
 }
 //#endregion
@@ -30324,6 +31831,29 @@ var bootEnvExtension = z$1.object({
 		""
 	]).optional(),
 	/**
+	* `false`: this deployment changes nothing in its database. No table,
+	* column, index, function, trigger, policy, role or grant — the framework's
+	* own included, which `REBASE_MIGRATE_ON_BOOT=none` leaves on — is created
+	* or altered, at boot or by a request; what is missing is reported by name
+	* instead. For a database whose schema only changes through a change
+	* process: run a provisioning step (`REBASE_PROVISION_ONLY=true`, with
+	* `REBASE_PROVISION_SQL_OUT` to keep the SQL it ran) under that process.
+	*
+	* See `resolveProvisionEnv` in `boot/provision.ts`.
+	*/
+	REBASE_PROVISION: z$1.enum([
+		"true",
+		"false",
+		""
+	]).default("true").transform((v) => v !== "false"),
+	/**
+	* A file a provisioning run (`REBASE_PROVISION_ONLY=true`) writes every
+	* schema change it executed to, in order, as a SQL script — the reviewable
+	* record a change process applies with psql. Refused on a process that
+	* serves, which would write it while it kept running.
+	*/
+	REBASE_PROVISION_SQL_OUT: z$1.string().optional(),
+	/**
 	* Add `includeSubDomains` to the `Strict-Transport-Security` header.
 	*
 	* Off by default: it tells browsers to refuse plain HTTP on every subdomain
@@ -30663,9 +32193,12 @@ var bootEnvExtension = z$1.object({
 	/**
 	* Base URL of the process serving `/api/functions/*`.
 	*
-	* `api` role only. Set it and this process forwards those requests there
-	* instead of mounting them, so a split deployment presents the identical URL
-	* surface and nobody has to run a reverse proxy to try one.
+	* `api` and `worker` roles only. Set on the api, this process forwards
+	* those requests there instead of mounting them, so a split deployment
+	* presents the identical URL surface and nobody has to run a reverse proxy
+	* to try one. Set on a worker, only the worker's own in-process
+	* `rebase.functions` calls are forwarded; its port serves none. An http(s)
+	* URL, or the boot stops.
 	*/
 	REBASE_FUNCTIONS_UPSTREAM: z$1.string().optional(),
 	/**
@@ -30844,7 +32377,8 @@ var CORS_EXPOSED_HEADERS = [
 	"Preference-Applied",
 	"Location",
 	"Upload-Offset",
-	"Rebase-Upload-Result"
+	"Rebase-Upload-Result",
+	"X-Rebase-Simulated-Context"
 ];
 /** The runtime's whole CORS config, so a test can drive the same one boot does. */
 function resolveCorsOptions(env) {
@@ -30981,8 +32515,10 @@ function resolveRole(env) {
 	const base = ROLES[role];
 	if (!base) throw new RoleConfigurationError(`REBASE_ROLE="${role}" is not a role.`, `Use one of: ${Object.keys(ROLES).join(", ")}.`);
 	const migrate = env.REBASE_MIGRATE_ON_BOOT || "ensure";
-	if (!base.provisionSchema && migrate !== "none") throw new RoleConfigurationError(`REBASE_ROLE="${role}" cannot also provision the database schema (REBASE_MIGRATE_ON_BOOT="${migrate}").`, "Set REBASE_MIGRATE_ON_BOOT=none on this process. Exactly one process in a split deployment provisions the schema, and that is the one running REBASE_ROLE=api (or all).");
-	if (env.REBASE_FUNCTIONS_UPSTREAM && role !== "api") throw new RoleConfigurationError(`REBASE_FUNCTIONS_UPSTREAM is only read by REBASE_ROLE=api, and this process is "${role}".`, role === "functions" ? "A functions process serves those routes; it does not forward them. Set the upstream on the api process instead." : "Remove it, or set REBASE_ROLE=api on this process.");
+	if (!base.provisionSchema && migrate !== "none" && env.REBASE_PROVISION !== false) throw new RoleConfigurationError(`REBASE_ROLE="${role}" cannot also provision the database schema (REBASE_MIGRATE_ON_BOOT="${migrate}").`, "Set REBASE_MIGRATE_ON_BOOT=none on this process. Exactly one process in a split deployment provisions the schema, and that is the one running REBASE_ROLE=api (or all).");
+	const functionsUpstream = env.REBASE_FUNCTIONS_UPSTREAM?.trim() || void 0;
+	if (functionsUpstream && role !== "api" && role !== "worker") throw new RoleConfigurationError(`REBASE_FUNCTIONS_UPSTREAM is only read by REBASE_ROLE=api and REBASE_ROLE=worker, and this process is "${role}".`, role === "functions" ? "A functions process serves those routes; it does not forward them. Set the upstream on the api (or worker) process instead." : "This process serves the functions itself. Remove it, or set REBASE_ROLE=api on this process.");
+	if (functionsUpstream) assertUpstreamUrl(functionsUpstream);
 	if (Boolean(env.REBASE_FUNCTIONS_ONLY || env.REBASE_FUNCTIONS_EXCLUDE) && role !== "functions") throw new RoleConfigurationError(`REBASE_FUNCTIONS_ONLY / REBASE_FUNCTIONS_EXCLUDE are only read by REBASE_ROLE=functions, and this process is "${role}".`, "Set them on the functions process, or set REBASE_ROLE=functions here.");
 	const ownership = { ...base.ownership };
 	if (env.REBASE_CRON_SCHEDULER !== void 0) ownership.cronScheduler = env.REBASE_CRON_SCHEDULER;
@@ -30999,9 +32535,19 @@ function resolveRole(env) {
 			only: parseNameList(env.REBASE_FUNCTIONS_ONLY),
 			exclude: parseNameList(env.REBASE_FUNCTIONS_EXCLUDE)
 		},
-		functionsUpstream: env.REBASE_FUNCTIONS_UPSTREAM?.trim() || void 0
+		functionsUpstream
 	};
 }
+/** Refuse a `REBASE_FUNCTIONS_UPSTREAM` that is not an absolute http(s) URL. */
+function assertUpstreamUrl(value) {
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		url = void 0;
+	}
+	if (!url || url.protocol !== "http:" && url.protocol !== "https:") throw new RoleConfigurationError(`REBASE_FUNCTIONS_UPSTREAM="${value}" is not an http(s) URL.`, "Set it to the functions process's base URL, e.g. http://functions:8080.");
+}
 /**
 * ## Why there is no channel-bus refusal here
 *
@@ -31026,6 +32572,32 @@ function resolveRole(env) {
 * beside the replica count, not here.
 */
 //#endregion
+//#region src/boot/provision-only.ts
+/**
+* `REBASE_PROVISION_ONLY`, read the one way every caller reads it.
+*
+* Its own module, with nothing imported, so `tooling/scripts/chart-unit-roles.mts`
+* can ask the same question of a rendered chart unit without loading the boot.
+*/
+/**
+* Whether this process should provision the schema and stop, rather than serve.
+*
+* The shape a migration Job wants: same image, same bundle, same boot — and no
+* socket. Nothing else changes, which is the point. A separate migration image
+* would be a second artifact to build, publish and keep in step with the
+* runtime, and the failure mode of it drifting is a schema applied by a version
+* that is not the one about to run against it.
+*
+* A blank value is *unset*: `REBASE_PROVISION_ONLY=${SOMETHING}` with SOMETHING
+* undefined is the ordinary way to write a compose file or a Helm template, and
+* reading it as true would turn an ordinary deployment into one that migrates
+* and then refuses to serve.
+*/
+function resolveProvisionOnly(env) {
+	const raw = (env.REBASE_PROVISION_ONLY ?? "").trim().toLowerCase();
+	return raw === "1" || raw === "true";
+}
+//#endregion
 //#region src/boot/static-routing.ts
 /**
 * A request's hostname in the form an app's `host` is written in: lowercase,
@@ -32287,6 +33859,10 @@ function imageModulesDir() {
 * and ran zero crons. The image installs zod (see
 * infra/docker/server.Dockerfile); naming it here is what makes the bundle's
 * copy collapse onto it.
+*
+* `hono` and `@hono/node-server` likewise: the bundler strips them, so a
+* function importing `hono` directly found no copy under the bundle and failed
+* to load. See `infra/docker/entrypoint.mjs`.
 */
 var RUNTIME_PROVIDED_PACKAGES = [
 	"@rebasepro/server",
@@ -32294,7 +33870,9 @@ var RUNTIME_PROVIDED_PACKAGES = [
 	"@rebasepro/client",
 	"@rebasepro/common",
 	"@rebasepro/utils",
-	"zod"
+	"zod",
+	"hono",
+	"@hono/node-server"
 ];
 /**
 * Collapse a duplicate framework copy in the bundle onto the image's.
@@ -32506,6 +34084,323 @@ function bundleRootIn(directory) {
 	return null;
 }
 //#endregion
+//#region src/boot/schema-change-recorder.ts
+/**
+* The schema changes a provisioning run made, written down as the SQL script a
+* change process reviews and applies.
+*
+* ## Why a recording, not a plan
+*
+* The obvious tool is a dry run: compute the DDL boot would execute against a
+* database, print it, execute nothing. Rebase's bootstraps cannot be planned
+* that way. Each one reads what it just created — the auth bootstrap
+* introspects the users table it made a statement earlier to choose the type of
+* every foreign key after it; the stores probe their own tables before they
+* revoke on them — so a run that executes nothing takes different branches from
+* one that executes everything, and a plan computed from it would be a guess
+* dressed as an answer.
+*
+* So the run is real, and it is recorded. Against an empty scratch database the
+* script is the whole schema this release needs; against a restored copy of
+* production it is exactly the upgrade, because every branch saw the state it
+* will see there. Either way it is a list of statements that ran and succeeded,
+* in order — which is a claim a reviewer can check, where a plan is a claim
+* about code.
+*
+* ## What is recorded
+*
+* Statements that change the database's structure or privileges
+* ({@link isSchemaChange}): that is what a change process controls. Rows the
+* run writes — the first admin account, version stamps, a backfill — are not
+* schema, and the first of those carries a password hash that has no business
+* in a file that is attached to a ticket.
+*
+* Captured at the pool, below every driver abstraction: each connection checked
+* out of a recorded pool reports the statements it completed. That is the one
+* place every path converges — Drizzle, the SQL admin, a dedicated index-build
+* session — so nothing needs to remember to report itself.
+*/
+function isQueryable(value) {
+	return typeof value === "object" && value !== null && "query" in value && typeof value.query === "function";
+}
+/** The SQL text of a `query` call: a string, or a `{ text }` config object. */
+function statementText(first) {
+	if (typeof first === "string") return first;
+	if (typeof first === "object" && first !== null && "text" in first && typeof first.text === "string") return first.text;
+}
+function isQueryCallback(value) {
+	return typeof value === "function";
+}
+/** Whether a promise-like came back, the shape `query` has without a callback. */
+function isThenable(value) {
+	return typeof value === "object" && value !== null && "then" in value && typeof value.then === "function";
+}
+/**
+* Split a query string into its statements, at every `;` that is not inside a
+* string, a quoted identifier, a dollar-quoted body or a comment.
+*
+* Boot sends several statements as one string — `SET LOCAL lock_timeout`, then
+* a table and its indexes, committed together — so a recording that looked
+* only at the first word of each query would miss every table it made that
+* way. Dollar quotes are the case that matters: a `DO` block or a function
+* body is full of semicolons that end nothing.
+*/
+function splitStatements(sqlText) {
+	const statements = [];
+	let start = 0;
+	let i = 0;
+	const push = (end) => {
+		const statement = withoutLeadingComments(sqlText.slice(start, end)).trim();
+		if (statement !== "") statements.push(statement);
+	};
+	while (i < sqlText.length) {
+		const char = sqlText[i];
+		const next = sqlText[i + 1];
+		if (char === "-" && next === "-") {
+			const end = sqlText.indexOf("\n", i);
+			i = end === -1 ? sqlText.length : end + 1;
+		} else if (char === "/" && next === "*") {
+			const end = sqlText.indexOf("*/", i + 2);
+			i = end === -1 ? sqlText.length : end + 2;
+		} else if (char === "'" || char === "\"") {
+			let j = i + 1;
+			while (j < sqlText.length) {
+				if (sqlText[j] === char) {
+					if (sqlText[j + 1] === char) {
+						j += 2;
+						continue;
+					}
+					break;
+				}
+				j++;
+			}
+			i = j + 1;
+		} else if (char === "$") {
+			const tag = i > 0 && /[A-Za-z0-9_]/.test(sqlText[i - 1]) ? void 0 : sqlText.slice(i).match(/^\$(?:[A-Za-z_][A-Za-z0-9_]*)?\$/)?.[0];
+			if (tag) {
+				const end = sqlText.indexOf(tag, i + tag.length);
+				i = end === -1 ? sqlText.length : end + tag.length;
+			} else i++;
+		} else if (char === ";") {
+			push(i);
+			start = i + 1;
+			i++;
+		} else i++;
+	}
+	push(sqlText.length);
+	return statements;
+}
+function transactionStep(statement) {
+	const words = withoutLeadingComments(statement).split(/\s+/).map((word) => word.replace(/;$/, ""));
+	const [first, second, third] = words.map((word) => word.toUpperCase());
+	const name = (word) => (word ?? "").replace(/^"|"$/g, "").toLowerCase();
+	if (first === "BEGIN" || first === "START" && second === "TRANSACTION") return { kind: "begin" };
+	if (first === "COMMIT" || first === "END") return second === "PREPARED" ? void 0 : { kind: "commit" };
+	if (first === "ROLLBACK" || first === "ABORT") {
+		if (second === "TO") return {
+			kind: "rollback-to",
+			name: name(third === "SAVEPOINT" ? words[3] : words[2])
+		};
+		return second === "PREPARED" ? void 0 : { kind: "rollback" };
+	}
+	if (first === "SAVEPOINT") return {
+		kind: "savepoint",
+		name: name(words[1])
+	};
+	if (first === "RELEASE") return {
+		kind: "release",
+		name: name(second === "SAVEPOINT" ? words[2] : words[1])
+	};
+}
+/**
+* One connection's view of what it has done: schema changes it made inside a
+* transaction are held until that transaction commits, and dropped if it rolls
+* back — a probe that tries a change and rolls it away must not reach the
+* script.
+*/
+var ConnectionLedger = class {
+	commit;
+	open;
+	savepoints = [];
+	constructor(commit) {
+		this.commit = commit;
+	}
+	/** Account for one query that succeeded. */
+	completed(sqlText) {
+		for (const statement of splitStatements(sqlText)) {
+			const step = transactionStep(statement);
+			if (step) this.apply(step);
+			else if (isSchemaChange(statement)) if (this.open) this.open.push(statement);
+			else this.commit([statement]);
+		}
+	}
+	apply(step) {
+		switch (step.kind) {
+			case "begin":
+				this.open ??= [];
+				return;
+			case "commit":
+				if (this.open) this.commit(this.open);
+				this.open = void 0;
+				this.savepoints = [];
+				return;
+			case "rollback":
+				this.open = void 0;
+				this.savepoints = [];
+				return;
+			case "savepoint":
+				if (this.open) this.savepoints.push({
+					name: step.name,
+					at: this.open.length
+				});
+				return;
+			case "release": {
+				const index = this.savepoints.map((s) => s.name).lastIndexOf(step.name);
+				if (index !== -1) this.savepoints.splice(index);
+				return;
+			}
+			case "rollback-to": {
+				const savepoint = [...this.savepoints].reverse().find((s) => s.name === step.name);
+				if (this.open && savepoint) this.open.splice(savepoint.at);
+				return;
+			}
+		}
+	}
+};
+/**
+* Record every schema change completed on connections checked out of `pools`.
+*
+* Wraps `connect` on each pool object, and `query` on each connection it hands
+* out — never a prototype, so nothing outside these pools is touched. Must be
+* installed before the first statement: a `pg.Pool` connects lazily, so a pool
+* that has just been created has nothing open yet, and `pool.query` checks out
+* through `connect` like everything else.
+*/
+function recordSchemaChanges(pools) {
+	const recorded = [];
+	let active = true;
+	const wrapped = /* @__PURE__ */ new WeakSet();
+	const observe = (client) => {
+		if (!isQueryable(client) || wrapped.has(client)) return;
+		wrapped.add(client);
+		const ledger = new ConnectionLedger((statements) => {
+			if (active) recorded.push(...statements);
+		});
+		const note = (text) => {
+			if (text !== void 0) ledger.completed(text);
+		};
+		const original = client.query;
+		client.query = function recordedQuery(...args) {
+			const text = statementText(args[0]);
+			const last = args[args.length - 1];
+			if (isQueryCallback(last)) {
+				args[args.length - 1] = (err, result) => {
+					if (!err) note(text);
+					return last(err, result);
+				};
+				return original.apply(this, args);
+			}
+			const out = original.apply(this, args);
+			if (isThenable(out)) return out.then((result) => {
+				note(text);
+				return result;
+			});
+			return out;
+		};
+	};
+	for (const pool of pools) {
+		const connect = pool.connect;
+		if (typeof connect !== "function") continue;
+		pool.connect = function recordedConnect(callback) {
+			if (typeof callback === "function") return connect.call(this, (err, client, done) => {
+				if (!err) observe(client);
+				callback(err, client, done);
+			});
+			const checkout = connect.call(this);
+			return checkout === void 0 ? checkout : checkout.then((client) => {
+				observe(client);
+				return client;
+			});
+		};
+	}
+	return {
+		statements: () => [...recorded],
+		stop: () => {
+			active = false;
+		}
+	};
+}
+/**
+* Strip the indentation a statement carries from the template literal it was
+* written in, so the script reads as SQL rather than as source code.
+*/
+function dedent(statement) {
+	const lines = statement.replace(/^\s*\n/, "").replace(/\s+$/, "").split("\n");
+	const indents = lines.slice(1).filter((line) => line.trim() !== "").map((line) => line.match(/^[ \t]*/)?.[0].length ?? 0);
+	const strip = indents.length > 0 ? Math.min(...indents) : 0;
+	return lines.map((line, index) => index === 0 ? line.trim() : line.slice(Math.min(strip, line.match(/^[ \t]*/)?.[0].length ?? 0))).join("\n");
+}
+/** One statement, terminated exactly once. */
+function terminated(statement) {
+	const text = dedent(statement);
+	return text.endsWith(";") ? text : `${text};`;
+}
+/** Where the run happened, for the script's header — never the credentials. */
+function describeDatabase(connectionString) {
+	if (!connectionString) return void 0;
+	try {
+		const url = new URL(connectionString);
+		const database = url.pathname.replace(/^\//, "");
+		return `${url.hostname}${url.port ? `:${url.port}` : ""}${database ? `/${database}` : ""}`;
+	} catch {
+		return;
+	}
+}
+/**
+* The script a change process applies: a header saying what it is and how to
+* run it, then every recorded statement in order.
+*
+* Deliberately free of anything that changes between two runs of the same
+* release against the same state — no timestamp — so that two scripts can be
+* diffed, and a reviewer comparing this release's script with the last one
+* sees only what the release changed.
+*/
+function renderSchemaChangeScript(statements, context) {
+	const header = [
+		"-- Schema changes made by a Rebase provisioning run (REBASE_PROVISION_ONLY=true).",
+		"--",
+		...context.runtimeVersion ? [`-- Runtime: @rebasepro/server ${context.runtimeVersion}`] : [],
+		...context.database ? [`-- Recorded against: ${context.database}`] : [],
+		`-- Statements: ${statements.length}`,
+		"--",
+		"-- Every statement below ran, in this order, and succeeded. Recorded against an",
+		"-- empty database, this is the whole schema the release needs; against a copy of",
+		"-- production, it is the upgrade. Apply it as a role that may create in the database:",
+		"--",
+		"--   psql \"$DATABASE_URL\" -v ON_ERROR_STOP=1 -f <this file>",
+		...statements.some((statement) => /\bCONCURRENTLY\b/i.test(statement)) ? [
+			"--",
+			"-- Not inside one transaction (no `psql -1`, no BEGIN around it): it builds an",
+			"-- index CONCURRENTLY, which PostgreSQL refuses to run in a transaction block."
+		] : [],
+		"--",
+		"-- Rows the run wrote (the first admin account, version stamps, backfills) are not",
+		"-- schema and are not included."
+	];
+	if (statements.length === 0) return [
+		...header,
+		"",
+		"-- Nothing to change: the database already had everything this release needs.",
+		""
+	].join("\n");
+	return [
+		...header,
+		"",
+		statements.map(terminated).join("\n\n"),
+		""
+	].join("\n");
+}
+//#endregion
 //#region src/boot/boot.ts
 /**
 * Boot a Rebase runtime from a built bundle.
@@ -32552,6 +34447,18 @@ async function bootFromBundle(options = {}) {
 	const env = loadBootEnv();
 	const isProduction = env.NODE_ENV === "production";
 	const runtimeRole = resolveRole(env);
+	const provisionOnlyRun = resolveProvisionOnly(process.env);
+	if (!env.REBASE_PROVISION && provisionOnlyRun) throw new RoleConfigurationError("REBASE_PROVISION=false and REBASE_PROVISION_ONLY=true ask for a provisioning run that may not provision.", "Unset REBASE_PROVISION on the run that provisions — the migration step your change process runs — and keep REBASE_PROVISION=false on the processes that serve.");
+	const sqlOut = env.REBASE_PROVISION_SQL_OUT?.trim() || void 0;
+	if (sqlOut) {
+		if (!provisionOnlyRun) throw new RoleConfigurationError("REBASE_PROVISION_SQL_OUT is written by a provisioning run, and this process serves.", "Set REBASE_PROVISION_ONLY=true beside it: the run provisions, writes the SQL it executed, and exits.");
+		if (!env.REBASE_PROVISION) throw new RoleConfigurationError("REBASE_PROVISION_SQL_OUT records the schema changes a run makes, and REBASE_PROVISION=false makes none.", "Unset REBASE_PROVISION on the run that records.");
+		try {
+			fs.writeFileSync(sqlOut, "");
+		} catch (err) {
+			throw new RoleConfigurationError(`REBASE_PROVISION_SQL_OUT="${sqlOut}" cannot be written: ${err instanceof Error ? err.message : String(err)}`, "Point it at a file in a directory that exists and that this process can write.");
+		}
+	}
 	const liveSchema = resolveLiveSchemaOptions(env);
 	if (runtimeRole.role !== "all") logger.info(`Runtime role: ${runtimeRole.role}`, {
 		provisionsSchema: runtimeRole.provisionSchema,
@@ -32571,6 +34478,12 @@ async function bootFromBundle(options = {}) {
 	const rlsAudit = await resolveRlsAuditOptions(env, driverRoots);
 	const dataSources = await initializeDataSources(resolvedSources, schema, driverRoots);
 	warnOnDriverSkew(dataSources, readRuntimeVersion(driverRoots));
+	let schemaChangeRecorder;
+	if (sqlOut) {
+		const unrecordable = dataSources.filter((source) => typeof source.connection.pool?.connect !== "function");
+		if (unrecordable.length > 0) throw new RoleConfigurationError(`REBASE_PROVISION_SQL_OUT cannot record data source ${unrecordable.map((source) => `"${source.key}"`).join(", ")}: its driver hands back no connection pool to observe.`, "Recording is for SQL drivers that pool their connections, as the Postgres driver does.");
+		schemaChangeRecorder = recordSchemaChanges(dataSources.map((source) => source.connection.pool ?? {}));
+	}
 	const app = new Hono();
 	installRootErrorHandler(app);
 	app.use("/*", runtimeCors(resolveCorsOptions(env)));
@@ -32585,8 +34498,9 @@ async function bootFromBundle(options = {}) {
 	const storage = resolveBootStorage(bundle, process.env, storageSourceDefs, isProduction);
 	warnOnUnusableBundleShape(bundle);
 	installUnhandledRejectionHandler();
+	const ownsSchema = options.provisionSchema ?? runtimeRole.provisionSchema;
 	const createdBackend = await createRebaseBackend({
-		provision: options.provisionSchema ?? runtimeRole.provisionSchema ? true : {
+		provision: !env.REBASE_PROVISION ? false : ownsSchema ? true : {
 			collections: false,
 			realtime: false
 		},
@@ -32622,7 +34536,7 @@ async function bootFromBundle(options = {}) {
 	setDefaultBackend(createdBackend);
 	createdBackend.mount(app, { basePath: env.REBASE_BASE_PATH });
 	await createdBackend.attachRealtime(server);
-	createdBackend.start();
+	if (!provisionOnlyRun) createdBackend.start();
 	const backend = {
 		...createdBackend,
 		shutdown: (timeoutMs, shutdownOptions) => createdBackend.shutdown(timeoutMs, {
@@ -32683,8 +34597,18 @@ async function bootFromBundle(options = {}) {
 			});
 		}
 	}
+	if (provisionOnlyRun && env.REBASE_PROVISION) await provisionFirstUseTables(createdBackend.driver, process.env);
+	if (schemaChangeRecorder && sqlOut) {
+		schemaChangeRecorder.stop();
+		const statements = schemaChangeRecorder.statements();
+		fs.writeFileSync(sqlOut, renderSchemaChangeScript(statements, {
+			runtimeVersion: readRuntimeVersion(driverRoots),
+			database: describeDatabase(dataSources[0]?.connection.connectionString)
+		}));
+		logger.info(`Wrote the ${statements.length} schema change(s) this run made to ${sqlOut}.`);
+	}
 	let port = env.PORT;
-	if (!(options.listen === false || resolveProvisionOnly(process.env))) if (isProduction) {
+	if (options.listen !== false && !provisionOnlyRun) if (isProduction) {
 		await new Promise((resolve, reject) => {
 			server.once("error", reject);
 			server.listen(env.PORT, () => {
@@ -32861,24 +34785,6 @@ async function bootStaticApp(bundle, devRoot, options) {
 * answer is "set DATABASE_URL". Anything else keeps its stack, because it is a
 * bug and the trace is the point.
 */
-/**
-* Whether this process should provision the schema and stop, rather than serve.
-*
-* The shape a migration Job wants: same image, same bundle, same boot — and no
-* socket. Nothing else changes, which is the point. A separate migration image
-* would be a second artifact to build, publish and keep in step with the
-* runtime, and the failure mode of it drifting is a schema applied by a version
-* that is not the one about to run against it.
-*
-* A blank value is *unset*: `REBASE_PROVISION_ONLY=${SOMETHING}` with SOMETHING
-* undefined is the ordinary way to write a compose file or a Helm template, and
-* reading it as true would turn an ordinary deployment into one that migrates
-* and then refuses to serve.
-*/
-function resolveProvisionOnly(env = process.env) {
-	const raw = (env.REBASE_PROVISION_ONLY ?? "").trim().toLowerCase();
-	return raw === "1" || raw === "true";
-}
 async function runFromBundle(options = {}) {
 	try {
 		const booted = await bootFromBundle(options);
@@ -33046,6 +34952,6 @@ function warnOnUnusableBundleShape(bundle) {
 	logger.warn(`This bundle declares collections at "${bundle.manifest.entry.collections}", but that directory did not resolve, so no collections were loaded and no tables will be created. Rebuild with \`rebase build\`.`);
 }
 //#endregion
-export { ACCOUNT_SCOPED_STORAGE_BASES, ApiError, BATCH_REF_KEY, BlockedUrlError, BundleError, CONCURRENT_DDL_SQLSTATES, CORS_EXPOSED_HEADERS, CollectionConfigError, CronScheduler, DATABASE_UNAVAILABLE_MESSAGE, DEFAULT_DRIVER_ID, DEFAULT_MAX_FILE_SIZE, DEFAULT_STORAGE_ID, DOCUMENT_MIME_TYPES, DefaultDriverRegistry, DefaultStorageRegistry, ETAG_HEADER, FIELD_OPERATORS, GCSStorageController, IF_MATCH_HEADER, IMAGE_MIME_TYPES, LocalStorageController, MetricsRegistry, RUNTIME_BUNDLE_MOUNT, RUNTIME_DEFAULT_MAX_BODY_SIZE, RUNTIME_HEALTH_PATH, RUNTIME_LIVENESS_PATH, RUNTIME_MIN_TERMINATION_GRACE_SECONDS, RUNTIME_PRESTOP_DRAIN_SECONDS, RUNTIME_PROBE_PATHS, RUNTIME_STARTUP_BUDGET_SECONDS, RawHtml, S3StorageController, SMTPEmailService, StoragePolicyError, TOPOLOGY_ENV_VARS, TransformCache, TusHandler, UPLOAD_COLLECTION_FIELD, UPLOAD_PROPERTY_FIELD, UnknownStorageSourceError, WEBHOOK_DELIVERY_TASK, WebhookDispatcher, _resetRebaseMock, _setRebaseMock, accessModelFromCollections, activeDevEmailSink, applyCollectionDefaults, assertAllowedOutboundUrl, assertCollectionConfigs, assertDistinctSuffixes, assertEmailLinkBases, assertEveryKindBindable, assertFieldOpsValid, assertIfMatch, assertNestedWriteAllowed, assertNoFieldOpsOnCreate, assertNoUserUpsert, assertQueryFieldsReadable, assertUploadWithinPathLimits, assertUploadWithinPropertyLimits, assertUserCreationBodyValid, assertWriteRequestValid, authJwt, authRoles, authUid, backupStorageFromEnv, blockedAddressReason, bootFromBundle, callerScopes, classifySurface, cleanupDevPortFile, clearActiveDevEmailSink, compileStoragePolicies, composeCallbacks, configureAccess, configureJwt, createAppleProvider, createBackupLinkRoutes, createBackupRoutes, createBitbucketProvider, createBuiltinAuthAdapter, createCallContext, createContractRoutes, createCronRoutes, createCronStore, createCustomAuthAdapter, createDdlBootstrapper, createDevEmailSink, createDiscordProvider, createEmailService, createFacebookProvider, createFunctionRoutes, createGitHubProvider, createGitLabProvider, createGoogleProvider, createHistoryRoutes, createJobQueue, createJobStore, createJwksRoutes, createJwtService, createLinkedinProvider, createMetricsMiddleware, createMetricsRoutes, createMicrosoftProvider, createRebaseBackend, createRlsAudit, createSlackProvider, createSourceBundle, createSpotifyProvider, createStorageController, createStorageRoutes, createTwitterProvider, createUnconfiguredEmailService, createUploadConstraintResolver, createUploadPathResolver, createUserThroughAuthCollection, decideImpersonation, declareCrons, declaredErrorAnswer, declaredUniqueTargets, defaultBackoff, defineCron, defineFunction, drainBackgroundWork, envSuffixForKey, errorHandler, escapeHtml, extractLinks, extractUserFromToken, fileTokenAuth, findCollectionConfigProblems, generateSecurePassword, getAccessModel, getApiKey, getDriver, getEmailChangeNoticeTemplate, getEmailChangeTemplate, getEmailOtpTemplate, getEmailVerificationTemplate, getEnv, getJwks, getMagicLinkTemplate, getPasswordResetTemplate, getRequestId, getRoles, getUser, getUserId, getUserInvitationTemplate, getWelcomeEmailTemplate, hasAsymmetricSigningKey, hasFieldOps, hasRole, hasScope, hashPassword, html, httpMethodToOperation, identityResolved, implicitDeclaration, initializeDataSource, initializeDataSources, initializeRebaseBackend, installShutdownHandlers, installUnhandledRejectionHandler, isAcceptedFile, isAdmin, isApiKeyToken, isAuthAdapter, isAuthenticated, isConcurrentDdlRace, isDataException, isDatabaseAdapter, isDatabaseUnreachable, isDuplicateObjectRace, isLocalhostOrigin, isNodeRuntime, isTopologyEnvVar, isTransformableImage, isUncountedPath, lazyResource, listBackupObjects, listenWithPortRetry, loadBootEnv, loadBundle, loadBundleConfigExports, loadBundleSchema, loadCollectionsFromDirectory, loadCronJobsFromDirectory, loadCronJobsWithDiagnostics, loadCrons, loadEnv, loadFunctions, loadFunctionsFromDirectory, loadFunctionsWithDiagnostics, loadUsersCollection, logger, looksLikeFieldOp, oauthCodeFlowSchema, optionalAuth, parseBackupDestination, parseBackupTimestamp, parseFieldOp, parseTransformOptions, pendingBackgroundWork, pkceTokenParams, providerVerifiedEmail, queryTokenAuth, raw, rawQueryLoggingEnabled, readBackupBytes, readBundleManifest, readUploadPropertyContext, realtimeSocketPath, rebase, registerDevEmailSink, registerResourceResolver, requireAdmin, requireAuth, requireDriver, requireEnv, requireRole, requireScope, resolveApiKey, resolveAuthHooks, resolveAuthOptions, resolveBatchRefs, resolveConflictTarget, resolveCorsOrigin, resolveDataSources, resolveEmailBranding, resolveEmailLinkBase, resolveEmailOptions, resolveRequireAuth, resolveStorageAccessControl, resolveStorageBackend, resolveStorageSources, resourceResolver, resourceResolvers, rowETag, runFromBundle, runtimeKey, safeCompare, schemaDriftRemedy, serveSPA, setDefaultBackend, setLogOutput, splitFieldOps, summarize as summarizeRlsScan, transformImage, tryVerifyOidcIdToken, unbindableKinds, unknownKeyPolicyFromEnv, validateApiKey, validateCronExpression, validatePasswordStrength, verifyCredential, verifyOidcIdToken, verifyPassword, versionProperty, waitUntil, z };
+export { ACCOUNT_SCOPED_STORAGE_BASES, ApiError, BATCH_REF_KEY, BlockedUrlError, BundleError, CONCURRENT_DDL_SQLSTATES, CORS_EXPOSED_HEADERS, CollectionConfigError, CronScheduler, DATABASE_UNAVAILABLE_MESSAGE, DEFAULT_DRIVER_ID, DEFAULT_MAX_FILE_SIZE, DEFAULT_REFERRER_POLICY, DEFAULT_STORAGE_ID, DOCUMENT_MIME_TYPES, DefaultDriverRegistry, DefaultStorageRegistry, ETAG_HEADER, FIELD_OPERATORS, GCSStorageController, IF_MATCH_HEADER, IMAGE_MIME_TYPES, LocalStorageController, MetricsRegistry, RUNTIME_BUNDLE_MOUNT, RUNTIME_DEFAULT_MAX_BODY_SIZE, RUNTIME_HEALTH_PATH, RUNTIME_LIVENESS_PATH, RUNTIME_MIN_TERMINATION_GRACE_SECONDS, RUNTIME_PRESTOP_DRAIN_SECONDS, RUNTIME_PROBE_PATHS, RUNTIME_STARTUP_BUDGET_SECONDS, RawHtml, S3StorageController, SMTPEmailService, StoragePolicyError, TOPOLOGY_ENV_VARS, TransformCache, TusHandler, UPLOAD_COLLECTION_FIELD, UPLOAD_PROPERTY_FIELD, UnknownStorageSourceError, WEBHOOK_DELIVERY_TASK, WebhookDispatcher, _resetRebaseMock, _setRebaseMock, accessModelFromCollections, activeDevEmailSink, applyCollectionDefaults, assertAllowedOutboundUrl, assertCollectionConfigs, assertDistinctSuffixes, assertEmailLinkBases, assertEveryKindBindable, assertFieldOpsValid, assertIfMatch, assertNestedWriteAllowed, assertNoFieldOpsOnCreate, assertNoUserUpsert, assertQueryFieldsReadable, assertUploadWithinPathLimits, assertUploadWithinPropertyLimits, assertUserCreationBodyValid, assertWriteRequestValid, authJwt, authRoles, authUid, backupStorageFromEnv, blockedAddressReason, bootFromBundle, callerScopes, classifySurface, cleanupDevPortFile, clearActiveDevEmailSink, compileStoragePolicies, composeCallbacks, configureAccess, configureJwt, createAppleProvider, createBackupLinkRoutes, createBackupRoutes, createBitbucketProvider, createBuiltinAuthAdapter, createCallContext, createContractRoutes, createCronRoutes, createCronStore, createCustomAuthAdapter, createDdlBootstrapper, createDevEmailSink, createDiscordProvider, createEmailService, createFacebookProvider, createFunctionRoutes, createGitHubProvider, createGitLabProvider, createGoogleProvider, createHistoryRoutes, createJobQueue, createJobStore, createJwksRoutes, createJwtService, createLinkedinProvider, createMetricsMiddleware, createMetricsRoutes, createMicrosoftProvider, createRebaseBackend, createRlsAudit, createSlackProvider, createSourceBundle, createSpotifyProvider, createStorageController, createStorageRoutes, createTwitterProvider, createUnconfiguredEmailService, createUploadConstraintResolver, createUploadPathResolver, createUserThroughAuthCollection, decideImpersonation, declareCrons, declaredErrorAnswer, declaredUniqueTargets, defaultBackoff, defineCron, defineFunction, devEmailSinkFor, drainBackgroundWork, envSuffixForKey, errorHandler, escapeHtml, extractLinks, extractUserFromToken, fileTokenAuth, findCollectionConfigProblems, generateSecurePassword, getAccessModel, getApiKey, getDriver, getEmailChangeNoticeTemplate, getEmailChangeTemplate, getEmailOtpTemplate, getEmailVerificationTemplate, getEnv, getJwks, getMagicLinkTemplate, getPasswordResetTemplate, getRequestId, getRoles, getUser, getUserId, getUserInvitationTemplate, getWelcomeEmailTemplate, hasAsymmetricSigningKey, hasFieldOps, hasRole, hasScope, hashPassword, html, httpMethodToOperation, identityResolved, implicitDeclaration, initializeDataSource, initializeDataSources, initializeRebaseBackend, installShutdownHandlers, installUnhandledRejectionHandler, isAcceptedFile, isAdmin, isApiKeyToken, isAuthAdapter, isAuthenticated, isConcurrentDdlRace, isDataException, isDatabaseAdapter, isDatabaseUnreachable, isDuplicateObjectRace, isLocalhostOrigin, isNodeRuntime, isTopologyEnvVar, isTransformableImage, isUncountedPath, lazyResource, listBackupObjects, listenWithPortRetry, loadBootEnv, loadBundle, loadBundleConfigExports, loadBundleSchema, loadCollectionsFromDirectory, loadCronJobsFromDirectory, loadCronJobsWithDiagnostics, loadCrons, loadEnv, loadFunctions, loadFunctionsFromDirectory, loadFunctionsWithDiagnostics, loadUsersCollection, logger, looksLikeFieldOp, oauthCodeFlowSchema, optionalAuth, overridableSecurityHeaders, parseBackupDestination, parseBackupTimestamp, parseFieldOp, parseTransformOptions, pendingBackgroundWork, pkceTokenParams, providerVerifiedEmail, queryTokenAuth, raw, rawQueryLoggingEnabled, readBackupBytes, readBundleManifest, readUploadPropertyContext, realtimeSocketPath, rebase, refuseUnhonouredImpersonation, registerDevEmailSink, registerResourceResolver, reportSimulatedContext, requireAdmin, requireAuth, requireDriver, requireEnv, requireRole, requireScope, resolveApiKey, resolveAuthHooks, resolveAuthOptions, resolveBatchRefs, resolveConflictTarget, resolveCorsOrigin, resolveDataSources, resolveEmailBranding, resolveEmailLinkBase, resolveEmailOptions, resolveRequireAuth, resolveStorageAccessControl, resolveStorageBackend, resolveStorageSources, resourceResolver, resourceResolvers, rowETag, runFromBundle, runtimeKey, safeCompare, schemaDriftRemedy, serveSPA, setDefaultBackend, setLogOutput, splitFieldOps, summarize as summarizeRlsScan, transformImage, tryVerifyOidcIdToken, unbindableKinds, unknownKeyPolicyFromEnv, validateApiKey, validateCronExpression, validatePasswordStrength, verifyCredential, verifyOidcIdToken, verifyPassword, versionProperty, waitUntil, z };
 
 //# sourceMappingURL=index.es.js.map