@rebasepro/server 0.25.1 → 0.26.0

package/dist/{keys-COzQ2aE8.js → keys-BXcdRNhJ.js}

@@ -2,7 +2,7 @@ import { createRequire as __rebaseCreateRequire } from "module";
 import __rebaseProcess from "process";
 globalThis.process ??= __rebaseProcess;
 __rebaseCreateRequire(import.meta.url);
-import { O as DEFAULT_STORAGE_SOURCE_KEY } from "./src-D5Y3N-S4.js";
+import { k as DEFAULT_STORAGE_SOURCE_KEY } from "./src-Bh9LRPb9.js";
 //#region src/storage/keys.ts
 /**
 * Canonical storage keys and bucket names.
@@ -228,4 +228,4 @@ var InvalidListOptionsError = class extends Error {
 //#endregion
 export { canonicalStorageId as a, listingPrefix as c, canonicalStorageBucket as i, InvalidStorageBucketError as n, canonicalStorageKey as o, InvalidStorageKeyError as r, folderKey as s, InvalidListOptionsError as t };
 
-//# sourceMappingURL=keys-COzQ2aE8.js.map
+//# sourceMappingURL=keys-BXcdRNhJ.js.map

package/dist/{keys-COzQ2aE8.js.map → keys-BXcdRNhJ.js.map}

@@ -1 +1 @@
-{"version":3,"file":"keys-COzQ2aE8.js","names":[],"sources":["../src/storage/keys.ts"],"sourcesContent":["/**\n * Canonical storage keys and bucket names.\n *\n * Storage is not under RLS, so a `storageAuthorize` hook is the whole access\n * control model — and a hook can only be correct if the key it is shown is the\n * key that is written. That is the invariant this module exists to hold: one\n * canonical string, computed once per request, handed to the hook, to the\n * controller, and to the download token alike.\n *\n * ## Why rejecting beats stripping\n *\n * The previous `sanitizeStorageKey` *stripped* `../` in a single pass. Two\n * things were wrong with that, and only one of them was the obvious one.\n *\n * The obvious one: a single pass is not a fixed point. `....//` contains `../`\n * at offset 2, so removing it leaves `../` behind — the sanitizer manufactured\n * the traversal it was there to remove. `users/alice/....//bob/x` came out as\n * `users/alice/../bob/x`, which a prefix hook reads as alice's (it starts with\n * `users/alice/`) and the filesystem reads as bob's. The hook approved one\n * object and the controller wrote another.\n *\n * The subtler one, and the reason this is a rewrite rather than a loop: even a\n * correct strip is a silent rewrite. A caller who asks to store at `a/../b` and\n * gets an object at `a/b` was not protected, they were misled — and every later\n * read, ownership row and audit line now refers to a path nobody chose. So a key\n * that means something other than what it says is refused (400), not repaired.\n *\n * Note what is NOT traversal under this rule: `....` is an ordinary directory\n * name, and `users/alice/....//bob/x` canonicalizes to\n * `users/alice/..../bob/x` — still comfortably inside alice's prefix, which is\n * exactly right. Only a real `..` segment is refused.\n */\n\nimport { DEFAULT_STORAGE_SOURCE_KEY } from \"@rebasepro/types\";\n\n/**\n * `path.posix.normalize`, without `node:path`.\n *\n * A storage key is a POSIX-shaped string that never touches a filesystem, so\n * reaching for `node:path` to fold `.` and `//` out of it was always a little\n * wrong on its own terms — on Windows the platform `path` would have applied\n * different rules to the same key. It also put the module that every storage\n * read, ownership row and audit line goes through on the list of things that\n * only run in a Node process.\n *\n * This is the algorithm Node implements, transcribed: segments are folded left\n * to right, `..` pops unless it would climb past the root of a relative path,\n * and both the leading and the trailing separator survive the round trip. The\n * `..` branch is unreachable from {@link canonicalStorageKey}, which refuses\n * those keys outright before it gets here — it exists so that this function is\n * *the* normalizer rather than a subset of one, and\n * `storage-keys.property.test.ts` holds it to that with a property test against\n * `path.posix.normalize` itself. Exported for exactly that — nothing outside\n * this module should be normalizing a key.\n */\nexport function normalizePosix(input: string): string {\n    if (input.length === 0) return \".\";\n    const isAbsolute = input.startsWith(\"/\");\n    const trailingSeparator = input.endsWith(\"/\");\n\n    const segments: string[] = [];\n    for (const segment of input.split(\"/\")) {\n        if (segment === \"\" || segment === \".\") continue;\n        if (segment === \"..\") {\n            if (segments.length > 0 && segments[segments.length - 1] !== \"..\") segments.pop();\n            else if (!isAbsolute) segments.push(\"..\");\n            continue;\n        }\n        segments.push(segment);\n    }\n\n    const joined = segments.join(\"/\");\n    if (joined === \"\") {\n        if (isAbsolute) return \"/\";\n        return trailingSeparator ? \"./\" : \".\";\n    }\n    const withTrailing = trailingSeparator ? `${joined}/` : joined;\n    return isAbsolute ? `/${withTrailing}` : withTrailing;\n}\n\n/** Longest key accepted, in UTF-16 code units. Matches the previous cap. */\nexport const MAX_STORAGE_KEY_LENGTH = 1024;\n\n/**\n * A key that cannot be canonicalized. Carries no path back to the caller\n * beyond what they sent, so it is safe to surface as a 400 message.\n */\nexport class InvalidStorageKeyError extends Error {\n    constructor(message: string) {\n        super(message);\n        this.name = \"InvalidStorageKeyError\";\n    }\n}\n\n/**\n * Canonicalize a caller-supplied storage key, or throw\n * {@link InvalidStorageKeyError}.\n *\n * Normalizations applied (safe, idempotent, and meaning-preserving):\n * - leading slashes removed — `/a/b` and `a/b` name the same object\n * - `.` segments and repeated slashes collapsed\n *\n * Refusals (the key means something other than what it says):\n * - any `..` segment, on either separator, at any depth\n * - null bytes\n * - keys longer than {@link MAX_STORAGE_KEY_LENGTH}\n *\n * A trailing slash is preserved: it is how the folder route marks a prefix.\n */\nexport function canonicalStorageKey(rawKey: string): string {\n    if (rawKey.includes(\"\\0\")) {\n        throw new InvalidStorageKeyError(\"Storage key contains a null byte.\");\n    }\n    if (rawKey.length > MAX_STORAGE_KEY_LENGTH) {\n        throw new InvalidStorageKeyError(\n            `Storage key exceeds the maximum length of ${MAX_STORAGE_KEY_LENGTH} characters.`\n        );\n    }\n\n    // Split on both separators: `path.join` treats `\\` as a separator on\n    // Windows, so `..\\` is traversal there even though POSIX reads it as a\n    // filename. Checked against the RAW key, before any normalization — the\n    // whole point is that `a/../b` is refused rather than quietly turned into\n    // `b`.\n    if (rawKey.split(/[\\\\/]/).some((segment) => segment === \"..\")) {\n        throw new InvalidStorageKeyError(\n            \"Storage key contains a '..' path segment. Keys must name an object directly.\"\n        );\n    }\n\n    const withoutLeadingSlashes = rawKey.replace(/^\\/+/, \"\");\n    if (withoutLeadingSlashes === \"\") return \"\";\n\n    // Whether the key names a *directory* rather than an object: it ends with a\n    // separator, or its last segment is the `.` that means \"this directory\".\n    //\n    // Recorded before normalizing, because normalization drops the\n    // distinction in one of those two spellings and not the other: `public/.`\n    // becomes `public` while `public/./` stays `public/`. That asymmetry breaks\n    // the rule this module states — a trailing slash is preserved, because it is\n    // how the folder route marks a prefix — and it is not cosmetic on `list`,\n    // where a prefix of `public` also matches `publicity/` and hands back keys\n    // the caller never asked for.\n    const denotesDirectory = /(?:^|\\/)\\.?$/.test(withoutLeadingSlashes);\n\n    // Safe now: with no `..` segment in the input, `normalize` can only collapse\n    // `.` and duplicate slashes — it cannot climb.\n    const normalized = normalizePosix(withoutLeadingSlashes);\n\n    // `normalize(\".\")`, and `normalize(\"./\")` → `./`; neither names an object.\n    if (normalized === \".\" || normalized === \"./\") return \"\";\n\n    // Defensive: nothing reaching here still carries a leading `./`, since the\n    // leading slashes are already gone and `normalize` only emits `./` for a\n    // key that normalizes to nothing — which returned above.\n    const key = normalized.replace(/^\\.\\//, \"\").replace(/^\\/+/, \"\");\n    if (key === \"\") return \"\";\n    return denotesDirectory && !key.endsWith(\"/\") ? `${key}/` : key;\n}\n\n/**\n * Canonicalize, or return `null` when the key is not canonicalizable.\n *\n * For callers that must fail closed without an exception — the download-token\n * middleware compares a request path against a granted path, and a key it\n * cannot canonicalize simply matches nothing.\n */\nexport function tryCanonicalStorageKey(rawKey: string): string | null {\n    try {\n        return canonicalStorageKey(rawKey);\n    } catch {\n        return null;\n    }\n}\n\n/**\n * Canonicalize the storage *source* a request names (`?storageId=`), so that\n * \"the default source\" has exactly one spelling.\n *\n * The default source can be asked for three ways — the parameter omitted, sent\n * empty, or sent as the literal `(default)` — and all three resolve to the same\n * controller. Without a single spelling, the value derived when a download\n * token is minted and the value derived when it is presented can differ for the\n * same object, which is either a spurious 403 or, if the comparison is dropped\n * to stop those, no scoping at all.\n *\n * Deliberately *not* validated against the registry: this is a naming rule, not\n * an existence check, and it must give the same answer in `auth/` (which has no\n * registry) as in the storage routes. An id that names no source still\n * canonicalizes to itself and simply matches only itself.\n */\nexport function canonicalStorageId(rawStorageId: string | undefined | null): string {\n    if (rawStorageId === undefined || rawStorageId === null) return DEFAULT_STORAGE_SOURCE_KEY;\n    const trimmed = rawStorageId.trim();\n    return trimmed === \"\" ? DEFAULT_STORAGE_SOURCE_KEY : trimmed;\n}\n\n/**\n * Longest bucket name accepted. 63 is the S3/GCS limit, and a local bucket is\n * one directory name, so the tighter of the two bounds everything.\n */\nexport const MAX_STORAGE_BUCKET_LENGTH = 63;\n\n/** A bucket name that does not name a bucket. See {@link canonicalStorageBucket}. */\nexport class InvalidStorageBucketError extends Error {\n    constructor(message: string) {\n        super(message);\n        this.name = \"InvalidStorageBucketError\";\n    }\n}\n\n/**\n * One path segment: letters, digits, `.`, `_`, `-`, first character\n * alphanumeric. Deliberately narrow — it is the intersection of what S3, GCS\n * and a filesystem directory all accept, and it makes `..`, `.tus-uploads`,\n * absolute paths and anything containing a separator unrepresentable.\n */\nconst STORAGE_BUCKET_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;\n\n/**\n * Canonicalize a caller-supplied bucket name, or throw\n * {@link InvalidStorageBucketError}.\n *\n * The bucket is the *other* caller-controlled routing value in an upload\n * request, and it was the one nobody validated. `LocalStorageController`\n * builds `join(basePath, bucket)` and then checks containment against that\n * result, so a bucket of `../../etc` moved the boundary rather than crossing\n * it — the guard passed because the guard's reference point was the attacker's.\n * The containment check now resolves against the storage root, and this is the\n * check at the route boundary that stops the value before it gets there.\n *\n * A bucket is configuration, not user data: there is no legitimate caller that\n * needs a separator, a leading dot, or a `..` in one. So this refuses rather\n * than repairs, exactly as {@link canonicalStorageKey} does — a rewritten\n * bucket would silently store the object somewhere the caller did not ask for.\n *\n * Returns `undefined` when the caller named no bucket (absent, or an empty\n * form field), which is how every controller spells \"use my default\". An empty\n * string used to reach `getFullPath` and resolve to the storage *root* rather\n * than the `default` bucket, which is a third place a bare key did not\n * round-trip.\n */\nexport function canonicalStorageBucket(rawBucket: string | undefined | null): string | undefined {\n    if (rawBucket === undefined || rawBucket === null || rawBucket === \"\") return undefined;\n    if (rawBucket.length > MAX_STORAGE_BUCKET_LENGTH) {\n        throw new InvalidStorageBucketError(\n            `Storage bucket exceeds the maximum length of ${MAX_STORAGE_BUCKET_LENGTH} characters.`\n        );\n    }\n    if (!STORAGE_BUCKET_PATTERN.test(rawBucket)) {\n        throw new InvalidStorageBucketError(\n            \"Storage bucket must be a single name of letters, digits, '.', '_' or '-', \" +\n            \"starting with a letter or digit.\"\n        );\n    }\n    return rawBucket;\n}\n\n/**\n * The prefix an object store's listing should be given for a caller's key, and\n * the key a listing should hand back for a folder.\n *\n * The three controllers answer the same question in two different ways, and\n * they used to disagree about the answer. `LocalStorageController` resolves a\n * *directory* on disk, so `listObjects(\"products/images\")` and\n * `listObjects(\"products/images/\")` both list what is inside it. An object\n * store under `Delimiter: \"/\"` does not: `Prefix: \"products/images\"` matches\n * `products/images.txt` and `productsomething/`, and returns none of the files\n * inside `products/images/`. So the same call — the SDK's own documented one —\n * answered one thing against local dev and another against the S3 bucket in\n * production, which is the worst place for a divergence to live.\n *\n * `listingPrefix` is what to *send*: a trailing slash, always, because that is\n * the only spelling that means \"inside this folder\" to a delimiter listing.\n * `folderKey` is what to *return* for a common prefix: no trailing slash, the\n * form the local controller has always used, so a `fullPath` from a listing is\n * a key you can pass straight back to any of them.\n */\nexport function listingPrefix(rawPrefix: string): string | undefined {\n    const key = rawPrefix.replace(/^\\/+/, \"\").replace(/\\/+$/, \"\");\n    return key === \"\" ? undefined : `${key}/`;\n}\n\n/** @see listingPrefix */\nexport function folderKey(rawPrefix: string): string {\n    return rawPrefix.replace(/^\\/+/, \"\").replace(/\\/+$/, \"\");\n}\n\n/**\n * A listing asked for paging a controller cannot honour: a page size below one,\n * or a page token it never issued.\n *\n * Refused rather than coerced. A page size of 0 answered an empty page whose\n * next token was the one it had been handed, so `while (pageToken)` never\n * ended; a token of `-1` read before the first entry and crashed. The route\n * turns this into a 400.\n */\nexport class InvalidListOptionsError extends Error {\n    constructor(message: string) {\n        super(message);\n        this.name = \"InvalidListOptionsError\";\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuDA,SAAgB,eAAe,OAAuB;CAClD,IAAI,MAAM,WAAW,GAAG,OAAO;CAC/B,MAAM,aAAa,MAAM,WAAW,GAAG;CACvC,MAAM,oBAAoB,MAAM,SAAS,GAAG;CAE5C,MAAM,WAAqB,CAAC;CAC5B,KAAK,MAAM,WAAW,MAAM,MAAM,GAAG,GAAG;EACpC,IAAI,YAAY,MAAM,YAAY,KAAK;EACvC,IAAI,YAAY,MAAM;GAClB,IAAI,SAAS,SAAS,KAAK,SAAS,SAAS,SAAS,OAAO,MAAM,SAAS,IAAI;QAC3E,IAAI,CAAC,YAAY,SAAS,KAAK,IAAI;GACxC;EACJ;EACA,SAAS,KAAK,OAAO;CACzB;CAEA,MAAM,SAAS,SAAS,KAAK,GAAG;CAChC,IAAI,WAAW,IAAI;EACf,IAAI,YAAY,OAAO;EACvB,OAAO,oBAAoB,OAAO;CACtC;CACA,MAAM,eAAe,oBAAoB,GAAG,OAAO,KAAK;CACxD,OAAO,aAAa,IAAI,iBAAiB;AAC7C;;AAGA,IAAa,yBAAyB;;;;;AAMtC,IAAa,yBAAb,cAA4C,MAAM;CAC9C,YAAY,SAAiB;EACzB,MAAM,OAAO;EACb,KAAK,OAAO;CAChB;AACJ;;;;;;;;;;;;;;;;AAiBA,SAAgB,oBAAoB,QAAwB;CACxD,IAAI,OAAO,SAAS,IAAI,GACpB,MAAM,IAAI,uBAAuB,mCAAmC;CAExE,IAAI,OAAO,SAAA,MACP,MAAM,IAAI,uBACN,6CAA6C,uBAAuB,aACxE;CAQJ,IAAI,OAAO,MAAM,OAAO,CAAC,CAAC,MAAM,YAAY,YAAY,IAAI,GACxD,MAAM,IAAI,uBACN,8EACJ;CAGJ,MAAM,wBAAwB,OAAO,QAAQ,QAAQ,EAAE;CACvD,IAAI,0BAA0B,IAAI,OAAO;CAYzC,MAAM,mBAAmB,eAAe,KAAK,qBAAqB;CAIlE,MAAM,aAAa,eAAe,qBAAqB;CAGvD,IAAI,eAAe,OAAO,eAAe,MAAM,OAAO;CAKtD,MAAM,MAAM,WAAW,QAAQ,SAAS,EAAE,CAAC,CAAC,QAAQ,QAAQ,EAAE;CAC9D,IAAI,QAAQ,IAAI,OAAO;CACvB,OAAO,oBAAoB,CAAC,IAAI,SAAS,GAAG,IAAI,GAAG,IAAI,KAAK;AAChE;;;;;;;;;;;;;;;;;AAiCA,SAAgB,mBAAmB,cAAiD;CAChF,IAAI,iBAAiB,KAAA,KAAa,iBAAiB,MAAM,OAAO;CAChE,MAAM,UAAU,aAAa,KAAK;CAClC,OAAO,YAAY,KAAK,6BAA6B;AACzD;;AASA,IAAa,4BAAb,cAA+C,MAAM;CACjD,YAAY,SAAiB;EACzB,MAAM,OAAO;EACb,KAAK,OAAO;CAChB;AACJ;;;;;;;AAQA,IAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;AAyB/B,SAAgB,uBAAuB,WAA0D;CAC7F,IAAI,cAAc,KAAA,KAAa,cAAc,QAAQ,cAAc,IAAI,OAAO,KAAA;CAC9E,IAAI,UAAU,SAAA,IACV,MAAM,IAAI,0BACN,6DACJ;CAEJ,IAAI,CAAC,uBAAuB,KAAK,SAAS,GACtC,MAAM,IAAI,0BACN,4GAEJ;CAEJ,OAAO;AACX;;;;;;;;;;;;;;;;;;;;;AAsBA,SAAgB,cAAc,WAAuC;CACjE,MAAM,MAAM,UAAU,QAAQ,QAAQ,EAAE,CAAC,CAAC,QAAQ,QAAQ,EAAE;CAC5D,OAAO,QAAQ,KAAK,KAAA,IAAY,GAAG,IAAI;AAC3C;;AAGA,SAAgB,UAAU,WAA2B;CACjD,OAAO,UAAU,QAAQ,QAAQ,EAAE,CAAC,CAAC,QAAQ,QAAQ,EAAE;AAC3D;;;;;;;;;;AAWA,IAAa,0BAAb,cAA6C,MAAM;CAC/C,YAAY,SAAiB;EACzB,MAAM,OAAO;EACb,KAAK,OAAO;CAChB;AACJ"}
+{"version":3,"file":"keys-BXcdRNhJ.js","names":[],"sources":["../src/storage/keys.ts"],"sourcesContent":["/**\n * Canonical storage keys and bucket names.\n *\n * Storage is not under RLS, so a `storageAuthorize` hook is the whole access\n * control model — and a hook can only be correct if the key it is shown is the\n * key that is written. That is the invariant this module exists to hold: one\n * canonical string, computed once per request, handed to the hook, to the\n * controller, and to the download token alike.\n *\n * ## Why rejecting beats stripping\n *\n * The previous `sanitizeStorageKey` *stripped* `../` in a single pass. Two\n * things were wrong with that, and only one of them was the obvious one.\n *\n * The obvious one: a single pass is not a fixed point. `....//` contains `../`\n * at offset 2, so removing it leaves `../` behind — the sanitizer manufactured\n * the traversal it was there to remove. `users/alice/....//bob/x` came out as\n * `users/alice/../bob/x`, which a prefix hook reads as alice's (it starts with\n * `users/alice/`) and the filesystem reads as bob's. The hook approved one\n * object and the controller wrote another.\n *\n * The subtler one, and the reason this is a rewrite rather than a loop: even a\n * correct strip is a silent rewrite. A caller who asks to store at `a/../b` and\n * gets an object at `a/b` was not protected, they were misled — and every later\n * read, ownership row and audit line now refers to a path nobody chose. So a key\n * that means something other than what it says is refused (400), not repaired.\n *\n * Note what is NOT traversal under this rule: `....` is an ordinary directory\n * name, and `users/alice/....//bob/x` canonicalizes to\n * `users/alice/..../bob/x` — still comfortably inside alice's prefix, which is\n * exactly right. Only a real `..` segment is refused.\n */\n\nimport { DEFAULT_STORAGE_SOURCE_KEY } from \"@rebasepro/types\";\n\n/**\n * `path.posix.normalize`, without `node:path`.\n *\n * A storage key is a POSIX-shaped string that never touches a filesystem, so\n * reaching for `node:path` to fold `.` and `//` out of it was always a little\n * wrong on its own terms — on Windows the platform `path` would have applied\n * different rules to the same key. It also put the module that every storage\n * read, ownership row and audit line goes through on the list of things that\n * only run in a Node process.\n *\n * This is the algorithm Node implements, transcribed: segments are folded left\n * to right, `..` pops unless it would climb past the root of a relative path,\n * and both the leading and the trailing separator survive the round trip. The\n * `..` branch is unreachable from {@link canonicalStorageKey}, which refuses\n * those keys outright before it gets here — it exists so that this function is\n * *the* normalizer rather than a subset of one, and\n * `storage-keys.property.test.ts` holds it to that with a property test against\n * `path.posix.normalize` itself. Exported for exactly that — nothing outside\n * this module should be normalizing a key.\n */\nexport function normalizePosix(input: string): string {\n    if (input.length === 0) return \".\";\n    const isAbsolute = input.startsWith(\"/\");\n    const trailingSeparator = input.endsWith(\"/\");\n\n    const segments: string[] = [];\n    for (const segment of input.split(\"/\")) {\n        if (segment === \"\" || segment === \".\") continue;\n        if (segment === \"..\") {\n            if (segments.length > 0 && segments[segments.length - 1] !== \"..\") segments.pop();\n            else if (!isAbsolute) segments.push(\"..\");\n            continue;\n        }\n        segments.push(segment);\n    }\n\n    const joined = segments.join(\"/\");\n    if (joined === \"\") {\n        if (isAbsolute) return \"/\";\n        return trailingSeparator ? \"./\" : \".\";\n    }\n    const withTrailing = trailingSeparator ? `${joined}/` : joined;\n    return isAbsolute ? `/${withTrailing}` : withTrailing;\n}\n\n/** Longest key accepted, in UTF-16 code units. Matches the previous cap. */\nexport const MAX_STORAGE_KEY_LENGTH = 1024;\n\n/**\n * A key that cannot be canonicalized. Carries no path back to the caller\n * beyond what they sent, so it is safe to surface as a 400 message.\n */\nexport class InvalidStorageKeyError extends Error {\n    constructor(message: string) {\n        super(message);\n        this.name = \"InvalidStorageKeyError\";\n    }\n}\n\n/**\n * Canonicalize a caller-supplied storage key, or throw\n * {@link InvalidStorageKeyError}.\n *\n * Normalizations applied (safe, idempotent, and meaning-preserving):\n * - leading slashes removed — `/a/b` and `a/b` name the same object\n * - `.` segments and repeated slashes collapsed\n *\n * Refusals (the key means something other than what it says):\n * - any `..` segment, on either separator, at any depth\n * - null bytes\n * - keys longer than {@link MAX_STORAGE_KEY_LENGTH}\n *\n * A trailing slash is preserved: it is how the folder route marks a prefix.\n */\nexport function canonicalStorageKey(rawKey: string): string {\n    if (rawKey.includes(\"\\0\")) {\n        throw new InvalidStorageKeyError(\"Storage key contains a null byte.\");\n    }\n    if (rawKey.length > MAX_STORAGE_KEY_LENGTH) {\n        throw new InvalidStorageKeyError(\n            `Storage key exceeds the maximum length of ${MAX_STORAGE_KEY_LENGTH} characters.`\n        );\n    }\n\n    // Split on both separators: `path.join` treats `\\` as a separator on\n    // Windows, so `..\\` is traversal there even though POSIX reads it as a\n    // filename. Checked against the RAW key, before any normalization — the\n    // whole point is that `a/../b` is refused rather than quietly turned into\n    // `b`.\n    if (rawKey.split(/[\\\\/]/).some((segment) => segment === \"..\")) {\n        throw new InvalidStorageKeyError(\n            \"Storage key contains a '..' path segment. Keys must name an object directly.\"\n        );\n    }\n\n    const withoutLeadingSlashes = rawKey.replace(/^\\/+/, \"\");\n    if (withoutLeadingSlashes === \"\") return \"\";\n\n    // Whether the key names a *directory* rather than an object: it ends with a\n    // separator, or its last segment is the `.` that means \"this directory\".\n    //\n    // Recorded before normalizing, because normalization drops the\n    // distinction in one of those two spellings and not the other: `public/.`\n    // becomes `public` while `public/./` stays `public/`. That asymmetry breaks\n    // the rule this module states — a trailing slash is preserved, because it is\n    // how the folder route marks a prefix — and it is not cosmetic on `list`,\n    // where a prefix of `public` also matches `publicity/` and hands back keys\n    // the caller never asked for.\n    const denotesDirectory = /(?:^|\\/)\\.?$/.test(withoutLeadingSlashes);\n\n    // Safe now: with no `..` segment in the input, `normalize` can only collapse\n    // `.` and duplicate slashes — it cannot climb.\n    const normalized = normalizePosix(withoutLeadingSlashes);\n\n    // `normalize(\".\")`, and `normalize(\"./\")` → `./`; neither names an object.\n    if (normalized === \".\" || normalized === \"./\") return \"\";\n\n    // Defensive: nothing reaching here still carries a leading `./`, since the\n    // leading slashes are already gone and `normalize` only emits `./` for a\n    // key that normalizes to nothing — which returned above.\n    const key = normalized.replace(/^\\.\\//, \"\").replace(/^\\/+/, \"\");\n    if (key === \"\") return \"\";\n    return denotesDirectory && !key.endsWith(\"/\") ? `${key}/` : key;\n}\n\n/**\n * Canonicalize, or return `null` when the key is not canonicalizable.\n *\n * For callers that must fail closed without an exception — the download-token\n * middleware compares a request path against a granted path, and a key it\n * cannot canonicalize simply matches nothing.\n */\nexport function tryCanonicalStorageKey(rawKey: string): string | null {\n    try {\n        return canonicalStorageKey(rawKey);\n    } catch {\n        return null;\n    }\n}\n\n/**\n * Canonicalize the storage *source* a request names (`?storageId=`), so that\n * \"the default source\" has exactly one spelling.\n *\n * The default source can be asked for three ways — the parameter omitted, sent\n * empty, or sent as the literal `(default)` — and all three resolve to the same\n * controller. Without a single spelling, the value derived when a download\n * token is minted and the value derived when it is presented can differ for the\n * same object, which is either a spurious 403 or, if the comparison is dropped\n * to stop those, no scoping at all.\n *\n * Deliberately *not* validated against the registry: this is a naming rule, not\n * an existence check, and it must give the same answer in `auth/` (which has no\n * registry) as in the storage routes. An id that names no source still\n * canonicalizes to itself and simply matches only itself.\n */\nexport function canonicalStorageId(rawStorageId: string | undefined | null): string {\n    if (rawStorageId === undefined || rawStorageId === null) return DEFAULT_STORAGE_SOURCE_KEY;\n    const trimmed = rawStorageId.trim();\n    return trimmed === \"\" ? DEFAULT_STORAGE_SOURCE_KEY : trimmed;\n}\n\n/**\n * Longest bucket name accepted. 63 is the S3/GCS limit, and a local bucket is\n * one directory name, so the tighter of the two bounds everything.\n */\nexport const MAX_STORAGE_BUCKET_LENGTH = 63;\n\n/** A bucket name that does not name a bucket. See {@link canonicalStorageBucket}. */\nexport class InvalidStorageBucketError extends Error {\n    constructor(message: string) {\n        super(message);\n        this.name = \"InvalidStorageBucketError\";\n    }\n}\n\n/**\n * One path segment: letters, digits, `.`, `_`, `-`, first character\n * alphanumeric. Deliberately narrow — it is the intersection of what S3, GCS\n * and a filesystem directory all accept, and it makes `..`, `.tus-uploads`,\n * absolute paths and anything containing a separator unrepresentable.\n */\nconst STORAGE_BUCKET_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;\n\n/**\n * Canonicalize a caller-supplied bucket name, or throw\n * {@link InvalidStorageBucketError}.\n *\n * The bucket is the *other* caller-controlled routing value in an upload\n * request, and it was the one nobody validated. `LocalStorageController`\n * builds `join(basePath, bucket)` and then checks containment against that\n * result, so a bucket of `../../etc` moved the boundary rather than crossing\n * it — the guard passed because the guard's reference point was the attacker's.\n * The containment check now resolves against the storage root, and this is the\n * check at the route boundary that stops the value before it gets there.\n *\n * A bucket is configuration, not user data: there is no legitimate caller that\n * needs a separator, a leading dot, or a `..` in one. So this refuses rather\n * than repairs, exactly as {@link canonicalStorageKey} does — a rewritten\n * bucket would silently store the object somewhere the caller did not ask for.\n *\n * Returns `undefined` when the caller named no bucket (absent, or an empty\n * form field), which is how every controller spells \"use my default\". An empty\n * string used to reach `getFullPath` and resolve to the storage *root* rather\n * than the `default` bucket, which is a third place a bare key did not\n * round-trip.\n */\nexport function canonicalStorageBucket(rawBucket: string | undefined | null): string | undefined {\n    if (rawBucket === undefined || rawBucket === null || rawBucket === \"\") return undefined;\n    if (rawBucket.length > MAX_STORAGE_BUCKET_LENGTH) {\n        throw new InvalidStorageBucketError(\n            `Storage bucket exceeds the maximum length of ${MAX_STORAGE_BUCKET_LENGTH} characters.`\n        );\n    }\n    if (!STORAGE_BUCKET_PATTERN.test(rawBucket)) {\n        throw new InvalidStorageBucketError(\n            \"Storage bucket must be a single name of letters, digits, '.', '_' or '-', \" +\n            \"starting with a letter or digit.\"\n        );\n    }\n    return rawBucket;\n}\n\n/**\n * The prefix an object store's listing should be given for a caller's key, and\n * the key a listing should hand back for a folder.\n *\n * The three controllers answer the same question in two different ways, and\n * they used to disagree about the answer. `LocalStorageController` resolves a\n * *directory* on disk, so `listObjects(\"products/images\")` and\n * `listObjects(\"products/images/\")` both list what is inside it. An object\n * store under `Delimiter: \"/\"` does not: `Prefix: \"products/images\"` matches\n * `products/images.txt` and `productsomething/`, and returns none of the files\n * inside `products/images/`. So the same call — the SDK's own documented one —\n * answered one thing against local dev and another against the S3 bucket in\n * production, which is the worst place for a divergence to live.\n *\n * `listingPrefix` is what to *send*: a trailing slash, always, because that is\n * the only spelling that means \"inside this folder\" to a delimiter listing.\n * `folderKey` is what to *return* for a common prefix: no trailing slash, the\n * form the local controller has always used, so a `fullPath` from a listing is\n * a key you can pass straight back to any of them.\n */\nexport function listingPrefix(rawPrefix: string): string | undefined {\n    const key = rawPrefix.replace(/^\\/+/, \"\").replace(/\\/+$/, \"\");\n    return key === \"\" ? undefined : `${key}/`;\n}\n\n/** @see listingPrefix */\nexport function folderKey(rawPrefix: string): string {\n    return rawPrefix.replace(/^\\/+/, \"\").replace(/\\/+$/, \"\");\n}\n\n/**\n * A listing asked for paging a controller cannot honour: a page size below one,\n * or a page token it never issued.\n *\n * Refused rather than coerced. A page size of 0 answered an empty page whose\n * next token was the one it had been handed, so `while (pageToken)` never\n * ended; a token of `-1` read before the first entry and crashed. The route\n * turns this into a 400.\n */\nexport class InvalidListOptionsError extends Error {\n    constructor(message: string) {\n        super(message);\n        this.name = \"InvalidListOptionsError\";\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuDA,SAAgB,eAAe,OAAuB;CAClD,IAAI,MAAM,WAAW,GAAG,OAAO;CAC/B,MAAM,aAAa,MAAM,WAAW,GAAG;CACvC,MAAM,oBAAoB,MAAM,SAAS,GAAG;CAE5C,MAAM,WAAqB,CAAC;CAC5B,KAAK,MAAM,WAAW,MAAM,MAAM,GAAG,GAAG;EACpC,IAAI,YAAY,MAAM,YAAY,KAAK;EACvC,IAAI,YAAY,MAAM;GAClB,IAAI,SAAS,SAAS,KAAK,SAAS,SAAS,SAAS,OAAO,MAAM,SAAS,IAAI;QAC3E,IAAI,CAAC,YAAY,SAAS,KAAK,IAAI;GACxC;EACJ;EACA,SAAS,KAAK,OAAO;CACzB;CAEA,MAAM,SAAS,SAAS,KAAK,GAAG;CAChC,IAAI,WAAW,IAAI;EACf,IAAI,YAAY,OAAO;EACvB,OAAO,oBAAoB,OAAO;CACtC;CACA,MAAM,eAAe,oBAAoB,GAAG,OAAO,KAAK;CACxD,OAAO,aAAa,IAAI,iBAAiB;AAC7C;;AAGA,IAAa,yBAAyB;;;;;AAMtC,IAAa,yBAAb,cAA4C,MAAM;CAC9C,YAAY,SAAiB;EACzB,MAAM,OAAO;EACb,KAAK,OAAO;CAChB;AACJ;;;;;;;;;;;;;;;;AAiBA,SAAgB,oBAAoB,QAAwB;CACxD,IAAI,OAAO,SAAS,IAAI,GACpB,MAAM,IAAI,uBAAuB,mCAAmC;CAExE,IAAI,OAAO,SAAA,MACP,MAAM,IAAI,uBACN,6CAA6C,uBAAuB,aACxE;CAQJ,IAAI,OAAO,MAAM,OAAO,CAAC,CAAC,MAAM,YAAY,YAAY,IAAI,GACxD,MAAM,IAAI,uBACN,8EACJ;CAGJ,MAAM,wBAAwB,OAAO,QAAQ,QAAQ,EAAE;CACvD,IAAI,0BAA0B,IAAI,OAAO;CAYzC,MAAM,mBAAmB,eAAe,KAAK,qBAAqB;CAIlE,MAAM,aAAa,eAAe,qBAAqB;CAGvD,IAAI,eAAe,OAAO,eAAe,MAAM,OAAO;CAKtD,MAAM,MAAM,WAAW,QAAQ,SAAS,EAAE,CAAC,CAAC,QAAQ,QAAQ,EAAE;CAC9D,IAAI,QAAQ,IAAI,OAAO;CACvB,OAAO,oBAAoB,CAAC,IAAI,SAAS,GAAG,IAAI,GAAG,IAAI,KAAK;AAChE;;;;;;;;;;;;;;;;;AAiCA,SAAgB,mBAAmB,cAAiD;CAChF,IAAI,iBAAiB,KAAA,KAAa,iBAAiB,MAAM,OAAO;CAChE,MAAM,UAAU,aAAa,KAAK;CAClC,OAAO,YAAY,KAAK,6BAA6B;AACzD;;AASA,IAAa,4BAAb,cAA+C,MAAM;CACjD,YAAY,SAAiB;EACzB,MAAM,OAAO;EACb,KAAK,OAAO;CAChB;AACJ;;;;;;;AAQA,IAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;AAyB/B,SAAgB,uBAAuB,WAA0D;CAC7F,IAAI,cAAc,KAAA,KAAa,cAAc,QAAQ,cAAc,IAAI,OAAO,KAAA;CAC9E,IAAI,UAAU,SAAA,IACV,MAAM,IAAI,0BACN,6DACJ;CAEJ,IAAI,CAAC,uBAAuB,KAAK,SAAS,GACtC,MAAM,IAAI,0BACN,4GAEJ;CAEJ,OAAO;AACX;;;;;;;;;;;;;;;;;;;;;AAsBA,SAAgB,cAAc,WAAuC;CACjE,MAAM,MAAM,UAAU,QAAQ,QAAQ,EAAE,CAAC,CAAC,QAAQ,QAAQ,EAAE;CAC5D,OAAO,QAAQ,KAAK,KAAA,IAAY,GAAG,IAAI;AAC3C;;AAGA,SAAgB,UAAU,WAA2B;CACjD,OAAO,UAAU,QAAQ,QAAQ,EAAE,CAAC,CAAC,QAAQ,QAAQ,EAAE;AAC3D;;;;;;;;;;AAWA,IAAa,0BAAb,cAA6C,MAAM;CAC/C,YAAY,SAAiB;EACzB,MAAM,OAAO;EACb,KAAK,OAAO;CAChB;AACJ"}

package/dist/mcp/consent-page.d.ts

@@ -28,7 +28,14 @@
  *  5. **Never post the password anywhere but the existing login endpoint.**
  *     The form below sends credentials to `${basePath}/auth/login` and nowhere
  *     else; this file's own endpoint receives only the resulting session token.
- *  6. **Refuse to be framed.** See {@link consentPageHeaders} — a consent screen
+ *  6. **Say where the code goes.** Registration is open by default and the
+ *     client name is the registrant's to choose, so "“Claude” wants access"
+ *     can be anyone. The redirect host cannot, and the page names it.
+ *  7. **Let every account that can sign in consent.** An account with a second
+ *     factor finishes here through the existing MFA routes; an account that
+ *     has only ever used Google, GitHub or an email link is told how to get a
+ *     password, rather than shown an error it cannot act on.
+ *  8. **Refuse to be framed.** See {@link consentPageHeaders} — a consent screen
  *     that can be iframed is a consent screen an attacker can have clicked.
  */
 export interface ConsentPageParams {
@@ -42,6 +49,24 @@ export interface ConsentPageParams {
     requestToken: string;
     /** The existing auth endpoint the sign-in form posts to. */
     loginUrl: string;
+    /**
+     * The existing MFA routes (`POST /auth/mfa/challenge` and
+     * `/auth/mfa/challenge/verify`). An account with a verified factor answers
+     * the login with `MFA_REQUIRED` and a pending token; the page opens a
+     * challenge with it and posts the code, which is where that account's
+     * session is minted. Without this step such an account could never consent.
+     */
+    mfaChallengeUrl: string;
+    mfaVerifyUrl: string;
+    /**
+     * Where the authorization code goes once the person allows.
+     *
+     * The client's name is free text anyone may register, so it proves nothing;
+     * the redirect URI is the one fact on this screen an attacker cannot make
+     * look like someone else's without owning that host. It is shown, as a
+     * host, with a plain statement that this server has not verified it.
+     */
+    redirectUri: string;
     /** Where the decision is posted. */
     decisionUrl: string;
     /** The canonical resource, shown so the user can see which person this is. */
@@ -73,3 +98,15 @@ export interface ConsentPageParams {
  */
 export declare function consentPageHeaders(nonce: string): Record<string, string>;
 export declare function renderConsentPage(params: ConsentPageParams): string;
+/**
+ * What to call the redirect target on the consent screen.
+ *
+ * The host, not the whole URI: a path is the registrant's to dress up
+ * ("/claude/official/callback"), the host is what they must own. A loopback
+ * redirect is a native client on this person's own machine; a private-use
+ * scheme (`com.example.app:/cb`) has no host, so it is shown whole.
+ */
+export declare function describeRedirect(redirectUri: string): {
+    label: string;
+    note: string;
+};

package/dist/mcp/mcp-routes.d.ts

@@ -26,6 +26,7 @@ import type { HonoEnv } from "../api/types.js";
 import { type JwtService } from "../auth/jwt.js";
 import { type DataRateLimitConfig } from "../auth/rate-limiter.js";
 import type { ApiKeyIdentity, ApiKeyRefusal } from "../auth/api-keys/api-key-middleware.js";
+import type { McpGrantIdentity } from "./oauth-routes.js";
 /**
  * The most messages one JSON-RPC batch may carry.
  *
@@ -79,6 +80,14 @@ export interface McpRoutesConfig {
      * rate limiting off. See {@link createMcpRoutes}.
      */
     rateLimit?: DataRateLimitConfig;
+    /**
+     * Who an access token's account is now — the identity the OAuth routes
+     * re-read at consent and refresh. Asked on every request, so a deleted,
+     * disabled or signed-out-everywhere account stops at once and a demotion
+     * takes effect on the next call. Absent when the auth adapter exposes no
+     * user repository, and then a token carries the roles it was minted with.
+     */
+    identity?: McpGrantIdentity;
 }
 /**
  * The `.well-known` documents.

package/dist/mcp/mcp-tools.d.ts

@@ -21,7 +21,7 @@
  * is a second lock, not the main one: a `data:write` token still cannot write
  * a row the user could not write themselves.
  */
-import type { AuthAdapter, CollectionConfig, DataDriver } from "@rebasepro/types";
+import type { AuthAdapter, CallerCredential, CollectionConfig, DataDriver } from "@rebasepro/types";
 import type { McpScope } from "./oauth-metadata.js";
 /** The identity a tool call runs as. Comes from the verified access token. */
 export interface McpCaller {
@@ -30,6 +30,12 @@ export interface McpCaller {
     /** The scopes granted to this connection — `data:read`, `data:write:posts`, … */
     scopes: string[];
     clientId: string;
+    /**
+     * The API key the connection authenticated with, when it was one rather
+     * than an OAuth grant. Handed to collection callbacks as
+     * `context.credential`.
+     */
+    credential?: CallerCredential;
 }
 export interface McpToolContext {
     driver: DataDriver;

package/dist/mcp/oauth-store.d.ts

@@ -146,10 +146,10 @@ export interface OAuthStore {
      * there was nothing to revoke, which lets the route answer 404 rather than
      * reporting success for a client the user never connected.
      *
-     * Access tokens already issued are NOT invalidated — they are self-contained
-     * JWTs with no per-request database lookup, which is what makes `/mcp` cheap.
-     * The window is therefore one access-token lifetime (an hour), and the
-     * route's response says so rather than implying an instant cut-off.
+     * Access tokens already issued are NOT invalidated — `/mcp` re-checks the
+     * account on each request, not the grant. The window is therefore one
+     * access-token lifetime (an hour), and the route's response says so rather
+     * than implying an instant cut-off.
      */
     revokeGrant(uid: string, clientId: string): Promise<boolean>;
 }
@@ -170,4 +170,11 @@ export interface GrantSummary {
  * server that cannot persist a code is not a degraded authorization server, it
  * is one that hands out credentials it cannot check.
  */
-export declare function createOAuthStore(driver: DataDriver): OAuthStore | null;
+export declare function createOAuthStore(driver: DataDriver, options?: {
+    /**
+     * Default `true`. `false` is a backend that changes nothing in its
+     * database: `ensureTables` creates and revokes nothing, and throws
+     * when the tables are not already there.
+     */
+    provision?: boolean;
+}): OAuthStore | null;

package/dist/metrics/history-recorder.d.ts

@@ -15,4 +15,7 @@ export interface MetricsHistory {
  * chart that renders empty is indistinguishable from a quiet period and this is
  * exactly the class of silence the panel it feeds exists to remove.
  */
-export declare function createMetricsHistory(driver: DataDriver): MetricsHistory | undefined;
+export declare function createMetricsHistory(driver: DataDriver, options?: {
+    /** Default `true`. `false` uses the table if it is there and never creates it. */
+    provision?: boolean;
+}): MetricsHistory | undefined;

package/dist/metrics/history-store.d.ts

@@ -59,6 +59,14 @@ export interface MetricSample {
  * nobody is mid-request.
  */
 export declare function ensureMetricsHistory(exec: Exec): Promise<void>;
+/**
+ * {@link ensureMetricsHistory} for a backend that changes nothing in its
+ * database: the table is read, never made, and its absence is an error — which
+ * the caller turns into "no history", the same outcome as a create that failed.
+ * The sweep still runs: it deletes rows, and keeping the table bounded is not a
+ * schema change.
+ */
+export declare function adoptExistingMetricsHistory(exec: Exec): Promise<void>;
 /**
  * What this process is using right now.
  *

package/dist/{offline-BrqCRgih-BtDB1ecy.js → offline-AvuEcg7u-DFHL98OT.js}

@@ -2,11 +2,12 @@ import { createRequire as __rebaseCreateRequire } from "module";
 import __rebaseProcess from "process";
 globalThis.process ??= __rebaseProcess;
 __rebaseCreateRequire(import.meta.url);
-import { c as RebaseClientError, l as isUnsupported, s as RebaseApiError, t as splitSearchTerms } from "./strings.es-BeZWAodn.js";
-import { D as Vector, E as GeoPoint, S as hasFieldOperation, T as EntityRelation, _ as normalizeOrderBy, c as collectAllPages, l as paginateFind, u as resolveFindWindow, w as EntityReference } from "./filter-dialect-O1HK6Nvr.js";
-import { $ as parseRelationAggregateSort, tt as toCanonicalOp } from "./src-D5Y3N-S4.js";
-import { a as byIdRead, f as rebaseReviver, h as unref, i as buildQueryString, n as MemoryOfflineStore, p as etagOf, r as SDKQueryBuilder, s as createMutationId, t as IndexedDBOfflineStore, u as invalidBulkBody } from "./offline-store-BhYXViha-BW5j1We_.js";
-//#region ../client/dist/offline-BrqCRgih.js
+import { a as RebaseClientError, i as RebaseApiError, o as isUnsupported } from "./data_driver-D0mg1Y_x.js";
+import { D as Vector, E as GeoPoint, S as hasFieldOperation, T as EntityRelation, _ as normalizeOrderBy, c as collectAllPages, l as paginateFind, u as resolveFindWindow, w as EntityReference } from "./filter-dialect-TrKFWLqT.js";
+import { et as parseRelationAggregateSort, nt as toCanonicalOp } from "./src-Bh9LRPb9.js";
+import { t as splitSearchTerms } from "./strings.es-B7QLnHh2.js";
+import { a as byIdRead, f as rebaseReviver, h as unref, i as buildQueryString, m as withETag, n as MemoryOfflineStore, p as etagOf, r as SDKQueryBuilder, s as createMutationId, t as IndexedDBOfflineStore, u as invalidBulkBody } from "./offline-store-BhYXViha-YTmjBpo2.js";
+//#region ../client/dist/offline-AvuEcg7u.js
 /**
 * Lossless round-tripping of rows through the offline store.
 *
@@ -901,6 +902,13 @@ function isPlainObject(value) {
 	const proto = Object.getPrototypeOf(value);
 	return proto === null || Object.getPrototypeOf(proto) === null;
 }
+/**
+* The key a folded run is sent under: its first and last member and its
+* length, which fixes its composition.
+*/
+function runKey(run) {
+	return `${run[0].mutationId}..${run[run.length - 1].mutationId}:${run.length}`;
+}
 /** Whether a queued write's payload mentions `id` anywhere — see {@link replaceMintedId}. */
 function mentionsMintedId(op, id) {
 	return [op.data, ...(op.updates ?? []).map((u) => u.data)].some((payload) => replaceMintedId(payload, id, "").changed);
@@ -1324,19 +1332,45 @@ var OfflineManager = class {
 	*/
 	ticket() {
 		if (this.scopeHold) return void 0;
-		return {
-			scope: this.scope,
-			epoch: this.scopeEpoch
-		};
+		return this.currentTicket();
 	}
 	/** The ticket of whoever the held scope turns out to be. */
 	async nextTicket() {
 		await this.scopeKnown();
-		return {
+		return this.currentTicket();
+	}
+	currentTicket() {
+		return this.unverified ? {
+			scope: this.scope,
+			epoch: this.scopeEpoch,
+			unverified: true
+		} : {
 			scope: this.scope,
 			epoch: this.scopeEpoch
 		};
 	}
+	/**
+	* Whether a write may go to the server now. Not while the scope is the last
+	* user's, unconfirmed: it would go out with no credentials, as nobody. It
+	* queues for its author instead, as it does offline.
+	*/
+	sendsWrites() {
+		return this.connectivity.shouldAttempt() && !this.unverified;
+	}
+	reachedUnconfirmedListeners = /* @__PURE__ */ new Set();
+	/**
+	* `listener` runs when a request made while the scope is unconfirmed
+	* reached the server: the connection is back, so the session can be asked
+	* about. The client wires it to the same confirmation the status listener
+	* runs — the status may never have said the connection was gone.
+	*/
+	onReachedUnconfirmed(listener) {
+		this.reachedUnconfirmedListeners.add(listener);
+		return () => this.reachedUnconfirmedListeners.delete(listener);
+	}
+	reachedUnconfirmed() {
+		for (const listener of this.reachedUnconfirmedListeners) callSafely(listener);
+	}
 	/** Whether an operation's user is still the signed-in one. */
 	isCurrent(ticket) {
 		return ticket.epoch === this.scopeEpoch;
@@ -1393,15 +1427,18 @@ var OfflineManager = class {
 				const res = await inner.find(params);
 				this.connectivity.markSuccess();
 				if (!this.isCurrent(ticket)) return res;
-				await this.ingest(slug, res.data ?? [], ticket, isProjection(params));
-				if (!this.isCurrent(ticket)) return res;
-				const snapshot = this.recordSnapshot(slug, params, res, ticket);
-				const answer = this.answer(slug, params, snapshot);
-				this.notifyCollection(slug, false);
-				return {
-					data: answer.data,
-					meta: answer.meta
-				};
+				if (ticket.unverified) this.reachedUnconfirmed();
+				else {
+					await this.ingest(slug, res.data ?? [], ticket, isProjection(params));
+					if (!this.isCurrent(ticket)) return res;
+					const snapshot = this.recordSnapshot(slug, params, res, ticket);
+					const answer = this.answer(slug, params, snapshot);
+					this.notifyCollection(slug, false);
+					return {
+						data: answer.data,
+						meta: answer.meta
+					};
+				}
 			} catch (error) {
 				if (!isNetworkError(error)) {
 					if (isRetryableError(error) && this.hasLocalAnswer(state, slug, params) && !(walk && !this.snapshotFor(slug, params))) {
@@ -1435,10 +1472,16 @@ var OfflineManager = class {
 					const row = await inner.findById(id, options);
 					this.connectivity.markSuccess();
 					if (!this.isCurrent(ticket)) return row;
+					if (ticket.unverified) {
+						this.reachedUnconfirmed();
+						return this.localRow(slug, id);
+					}
 					if (row !== void 0) await this.ingest(slug, [row], ticket);
 					else if (!this.hasPending(slug, id)) this.removeLocalRow(slug, id, ticket, true);
 					this.notifyCollection(slug, false);
-					return this.localRow(slug, id);
+					const local = this.localRow(slug, id);
+					const etag = etagOf(row);
+					return etag && local !== void 0 && !this.hasPending(slug, id) ? withETag({ ...local }, etag) : local;
 				} catch (error) {
 					if (!isNetworkError(error)) throw error;
 					this.connectivity.markFailure();
@@ -1461,7 +1504,7 @@ var OfflineManager = class {
 				await this.ensureCollection(slug);
 				const idempotencyKey = options?.idempotencyKey ?? createMutationId();
 				let sent = false;
-				if (this.connectivity.shouldAttempt()) try {
+				if (this.sendsWrites()) try {
 					const row = await inner.create(data, id, {
 						...options,
 						idempotencyKey
@@ -1503,7 +1546,7 @@ var OfflineManager = class {
 				if (data.length === 0) return [];
 				const idempotencyKey = options?.idempotencyKey ?? createMutationId();
 				let sent = false;
-				if (this.connectivity.shouldAttempt()) try {
+				if (this.sendsWrites()) try {
 					const rows = await inner.createMany(data, {
 						...options,
 						idempotencyKey
@@ -1555,7 +1598,7 @@ var OfflineManager = class {
 			upsert: async (data, options) => {
 				const ticket = this.ticket() ?? await this.nextTicket();
 				await this.ensureCollection(slug);
-				if (this.connectivity.shouldAttempt()) try {
+				if (this.sendsWrites()) try {
 					const row = await inner.upsert(data, options);
 					this.connectivity.markSuccess();
 					await this.ingest(slug, [row], ticket);
@@ -1586,7 +1629,7 @@ var OfflineManager = class {
 				if (!Array.isArray(updates)) throw invalidBulkBody("updateMany expects an array of { id, data } entries.");
 				if (updates.length === 0) return [];
 				const anyPending = updates.some((u) => this.hasPending(slug, u.id));
-				if (this.connectivity.shouldAttempt() && !anyPending) try {
+				if (this.sendsWrites() && !anyPending) try {
 					const rows = await inner.updateMany(updates, options);
 					this.connectivity.markSuccess();
 					await this.ingest(slug, rows, ticket);
@@ -1625,7 +1668,7 @@ var OfflineManager = class {
 				if (!Array.isArray(ids)) throw invalidBulkBody("deleteMany expects an array of ids.");
 				if (ids.length === 0) return;
 				const anyPending = ids.some((id) => this.hasPending(slug, id));
-				if (this.connectivity.shouldAttempt() && !anyPending) try {
+				if (this.sendsWrites() && !anyPending) try {
 					await inner.deleteMany(ids, options);
 					this.connectivity.markSuccess();
 					for (const id of ids) this.removeLocalRow(slug, id, ticket, true);
@@ -1653,7 +1696,7 @@ var OfflineManager = class {
 				const idempotencyKey = options?.idempotencyKey ?? createMutationId();
 				let sent = false;
 				let sendFailure;
-				if (this.connectivity.shouldAttempt() && !this.hasPending(slug, id)) try {
+				if (this.sendsWrites() && !this.hasPending(slug, id)) try {
 					const row = await inner.update(id, data, {
 						...options,
 						idempotencyKey
@@ -1678,7 +1721,7 @@ var OfflineManager = class {
 					throw new RebaseClientError(`Cannot apply a field operation to "${slug}" while offline: it is evaluated against the stored value, which this device does not have a current copy of. Send the value itself, or retry when the connection is back.`, { code: "OFFLINE_FIELD_OP_UNSUPPORTED" });
 				}
 				const base = this.rawLocalRow(slug, id);
-				const ifMatch = this.onConflict ? options?.ifMatch ?? (this.hasPending(slug, id) ? void 0 : this.etagFor(slug, id)) : void 0;
+				const ifMatch = options?.ifMatch ?? (this.onConflict && !this.hasPending(slug, id) ? this.etagFor(slug, id) : void 0);
 				await this.enqueue({
 					collection: slug,
 					type: "update",
@@ -1701,7 +1744,7 @@ var OfflineManager = class {
 				await this.ensureCollection(slug);
 				const idempotencyKey = options?.idempotencyKey ?? createMutationId();
 				let sent = false;
-				if (this.connectivity.shouldAttempt() && !this.hasPending(slug, id)) try {
+				if (this.sendsWrites() && !this.hasPending(slug, id)) try {
 					await inner.delete(id, {
 						...options,
 						idempotencyKey
@@ -1721,6 +1764,7 @@ var OfflineManager = class {
 					type: "delete",
 					id,
 					...sent ? { sent: { idempotencyKey } } : {},
+					...options?.ifMatch ? { ifMatch: options.ifMatch } : {},
 					rollback: { rows: { [String(id)]: this.rawLocalRow(slug, id) ?? null } }
 				}, ticket);
 				this.removeLocalRow(slug, id, ticket);
@@ -1733,6 +1777,12 @@ var OfflineManager = class {
 					const n = await inner.count(params);
 					this.connectivity.markSuccess();
 					if (!this.isCurrent(ticket)) return n;
+					if (ticket.unverified) {
+						this.reachedUnconfirmed();
+						const cached = await this.readCache(this.countKey(slug, params));
+						if (cached !== void 0) return Math.max(0, cached + this.pendingDelta(slug, params));
+						throw offlineError(`No count of "${slug}" for the last user is cached, and their session is not confirmed yet.`);
+					}
 					this.writeCache(this.countKey(slug, params), n);
 					return Math.max(0, n + this.pendingDelta(slug, params));
 				} catch (error) {
@@ -1771,6 +1821,15 @@ var OfflineManager = class {
 				onUpdate(response);
 				return;
 			}
+			if (ticket.unverified) {
+				const answer = this.localFind(slug, params);
+				onUpdate({
+					...response,
+					data: answer.data,
+					meta: answer.meta
+				});
+				return;
+			}
 			this.ingest(slug, response.data ?? [], ticket, isProjection(params)).then(() => {
 				if (!this.isCurrent(ticket)) return;
 				const snapshot = this.recordSnapshot(slug, params, response, ticket);
@@ -1789,6 +1848,10 @@ var OfflineManager = class {
 				onUpdate(row);
 				return;
 			}
+			if (ticket.unverified) {
+				onUpdate(this.localRow(slug, id));
+				return;
+			}
 			if (!row) {
 				if (!this.hasPending(slug, id)) this.removeLocalRow(slug, id, ticket, true);
 				this.notifyCollection(slug, false);
@@ -1820,7 +1883,7 @@ var OfflineManager = class {
 	wrapTrash(slug, inner) {
 		const online = async (what, call) => {
 			const message = `Offline: ${what} on the trash of "${slug}" needs the server; the trash is never cached on this device.`;
-			if (!this.connectivity.shouldAttempt()) throw offlineError(message);
+			if (!this.sendsWrites()) throw offlineError(message);
 			try {
 				const result = await call();
 				this.connectivity.markSuccess();
@@ -1934,7 +1997,7 @@ var OfflineManager = class {
 		})();
 		if (options?.realtime !== false && !isUnsupported(inner.listen)) unlisten = inner.listen(params, (response) => {
 			const ticket = this.ticket();
-			if (!ticket) return;
+			if (!ticket || ticket.unverified) return;
 			this.ingest(slug, response.data ?? [], ticket, isProjection(params)).then(() => {
 				this.recordSnapshot(slug, params, response, ticket);
 				this.notifyCollection(slug, false);
@@ -1989,7 +2052,7 @@ var OfflineManager = class {
 		})();
 		if (options?.realtime !== false && !isUnsupported(inner.listenById)) unlisten = inner.listenById(id, (row) => {
 			const ticket = this.ticket();
-			if (!ticket) return;
+			if (!ticket || ticket.unverified) return;
 			if (!row) {
 				if (!this.hasPending(slug, id)) this.removeLocalRow(slug, id, ticket, true);
 				this.notifyCollection(slug, false);
@@ -2314,6 +2377,7 @@ var OfflineManager = class {
 	*/
 	removeLocalRow(slug, id, ticket, known = false) {
 		if (!this.isCurrent(ticket)) return;
+		if (known && ticket.unverified) return;
 		const state = this.collectionState(slug);
 		const key = String(id);
 		const existed = state.rows.delete(key);
@@ -2346,7 +2410,7 @@ var OfflineManager = class {
 	* dropdown elsewhere asked for titles.
 	*/
 	async ingest(slug, rows, ticket, projection = false) {
-		if (rows.length === 0 || !this.isCurrent(ticket)) return;
+		if (rows.length === 0 || !this.isCurrent(ticket) || ticket.unverified) return;
 		const state = await this.ensureCollection(slug);
 		if (!this.isCurrent(ticket)) return;
 		const cachedAt = Date.now();
@@ -2450,7 +2514,7 @@ var OfflineManager = class {
 			hasMore: meta.hasMore ?? false,
 			...isProjection(params) ? { rows: (result.data ?? []).map((row) => ({ ...row })) } : {}
 		};
-		if (!this.isCurrent(ticket)) return snapshot;
+		if (!this.isCurrent(ticket) || ticket.unverified) return snapshot;
 		const state = this.collectionState(slug);
 		const key = buildQueryString(params);
 		state.snapshots.set(key, snapshot);
@@ -2548,7 +2612,7 @@ var OfflineManager = class {
 			}
 			if (mutation.type === "update") {
 				const tail = this.queue[this.queue.length - 1];
-				if (tail && !this.inFlight.has(tail.mutationId) && tail.sent === void 0 && (tail.schemaVersion ?? 1) <= 1 && tail.collection === mutation.collection && (tail.type === "create" || tail.type === "update") && tail.id === mutation.id) {
+				if (tail && !this.inFlight.has(tail.mutationId) && tail.sent === void 0 && (tail.schemaVersion ?? 1) <= 1 && tail.collection === mutation.collection && (tail.type === "create" || tail.type === "update") && tail.id === mutation.id && (mutation.ifMatch === void 0 || mutation.ifMatch === tail.ifMatch)) {
 					if (tail.type === "update") tail.parts = [...tail.parts ?? [{ ...tail.data }], { ...mutation.data }];
 					tail.data = {
 						...tail.data,
@@ -2729,7 +2793,7 @@ var OfflineManager = class {
 							this.connectivity.markFailure();
 							break;
 						}
-						if (op.type === "update" && op.ifMatch && isPreconditionFailed(error)) {
+						if ((op.type === "update" || op.type === "delete") && op.ifMatch && this.onConflict && isPreconditionFailed(error)) {
 							this.connectivity.markSuccess();
 							await this.resolveConflict(op, error, ticket);
 							continue;
@@ -2800,16 +2864,18 @@ var OfflineManager = class {
 	*/
 	foldableRun(unbatched) {
 		if (this.replayBatchSize < 2) return [];
-		const foldable = (op, collection) => op !== void 0 && op.type === "create" && op.generatedId === true && typeof op.id === "string" && op.sent === void 0 && !op.upsert && (op.schemaVersion ?? 1) <= 1 && !unbatched.has(op.mutationId) && (collection === void 0 || op.collection === collection);
 		const head = this.queue[0];
+		const resent = head?.sent?.run;
+		const foldable = (op, collection) => op !== void 0 && op.type === "create" && op.generatedId === true && typeof op.id === "string" && (resent === void 0 ? op.sent === void 0 : op.sent?.run === resent) && !op.upsert && (op.schemaVersion ?? 1) <= 1 && !unbatched.has(op.mutationId) && (collection === void 0 || op.collection === collection);
 		if (!foldable(head)) return [];
 		const run = [head];
-		for (let i = 1; i < this.queue.length && run.length < this.replayBatchSize; i++) {
+		for (let i = 1; i < this.queue.length && (resent !== void 0 || run.length < this.replayBatchSize); i++) {
 			const next = this.queue[i];
 			if (!foldable(next, head.collection)) break;
 			if (run.some((member) => mentionsMintedId(next, member.id))) break;
 			run.push(next);
 		}
+		if (resent !== void 0 && runKey(run) !== resent) return [];
 		return run;
 	}
 	/**
@@ -2830,9 +2896,10 @@ var OfflineManager = class {
 	*/
 	async replayRun(run, ticket) {
 		const inner = this.innerFor(run[0].collection);
-		const idempotencyKey = `${run[0].mutationId}..${run[run.length - 1].mutationId}:${run.length}`;
+		const idempotencyKey = runKey(run);
 		for (const member of run) this.inFlight.add(member.mutationId);
 		try {
+			for (const member of run) await this.markCreateSent(member, ticket, idempotencyKey);
 			let rows;
 			try {
 				rows = await inner.createMany(run.map((member) => member.data), { idempotencyKey });
@@ -2854,6 +2921,7 @@ var OfflineManager = class {
 	async replay(op, ticket) {
 		const inner = this.innerFor(op.collection);
 		if (op.type === "create") {
+			await this.markCreateSent(op, ticket);
 			let row;
 			try {
 				row = await this.sendQueuedWrite(op, (idempotencyKey) => inner.create(op.data, void 0, { idempotencyKey }), (sent) => inner.create(sent.data, sent.id, { idempotencyKey: sent.idempotencyKey }));
@@ -2906,11 +2974,30 @@ var OfflineManager = class {
 			}
 			for (const id of ids) this.removeLocalRow(op.collection, id, ticket, true);
 		} else if (op.type === "delete") {
-			await inner.delete(op.id, { idempotencyKey: op.sent?.idempotencyKey ?? op.mutationId });
+			await inner.delete(op.id, {
+				idempotencyKey: op.sent?.idempotencyKey ?? op.mutationId,
+				...op.ifMatch ? { ifMatch: op.ifMatch } : {}
+			});
 			this.removeLocalRow(op.collection, op.id, ticket, true);
 		}
 	}
 	/**
+	* Record a queued create as sent, with the request about to go out, and
+	* persist it — before the request, so a lost answer cannot leave it
+	* unmarked. One already marked (sent online before it was queued, or by
+	* an earlier replay) keeps what it holds: that is the request the server
+	* may have stored.
+	*/
+	async markCreateSent(op, ticket, run) {
+		if (op.sent) return;
+		op.sent = {
+			idempotencyKey: op.mutationId,
+			data: { ...op.data },
+			...run ? { run } : {}
+		};
+		await this.persistMutation(`${ticket.scope}|${op.mutationId}`, op).catch(() => void 0);
+	}
+	/**
 	* Send a queued write under its key.
 	*
 	* A write the queue sent once already, before it was queued, carries that
@@ -3302,4 +3389,4 @@ var OfflineManager = class {
 //#endregion
 export { OfflineManager };
 
-//# sourceMappingURL=offline-BrqCRgih-BtDB1ecy.js.map
+//# sourceMappingURL=offline-AvuEcg7u-DFHL98OT.js.map