@rebasepro/server 0.9.1-canary.7ba0e49 → 0.9.1-canary.7dddf96

package/dist/index.es.js

@@ -1,7 +1,7 @@
 import { createRequire as __createRequire } from "module";
 import process from "process";
 __createRequire(import.meta.url);
-import { a as getAccessTokenExpiry, d as require_jsonwebtoken, f as __commonJSMin, h as __toESM, i as generateRefreshToken, l as verifyAccessToken, m as __require, n as generateAccessToken, o as getRefreshTokenExpiry, p as __exportAll, r as generateDownloadToken, s as hashRefreshToken, t as configureJwt, u as verifyDownloadToken } from "./jwt-BJzQOa8a.js";
+import { a as getAccessTokenExpiry, d as require_jsonwebtoken, f as __commonJSMin, h as __toESM, i as generateRefreshToken, l as verifyAccessToken, m as __require, n as generateAccessToken, o as getRefreshTokenExpiry, p as __exportAll, r as generateDownloadToken, s as hashRefreshToken, t as configureJwt, u as verifyDownloadToken } from "./jwt-C6pbGtvf.js";
 import { _ as RebaseApiError, a as policy, c as isPostgresCollectionConfig, d as REST_TO_CANONICAL, f as toCanonicalOp, g as Vector, h as GeoPoint, i as isSQLAdmin, l as CANONICAL_TO_REST, m as EntityRelation, o as getCollectionDataPath, p as EntityReference, r as getDataSourceCapabilities, s as getDeclaredSubcollections, t as DEFAULT_STORAGE_SOURCE_KEY, u as NULL_OPS, v as RebaseClientError } from "./src-CsHhSKbi.js";
 import { t as logger } from "./logger-BYU66ENZ.js";
 import { t as nativeDynamicImport } from "./dynamic-import-Dvh-K5fl.js";
@@ -3502,21 +3502,6 @@ function createRoutedRealtimeService(opts) {
 //#region src/api/errors.ts
 /** Tracks whether we've already shown the doctor hint (once per process). */
 var _schemaDriftHinted = false;
-/** 5-character SQLSTATE, e.g. `42501`, `23505`. */
-var SQLSTATE_RE = /^[0-9A-Z]{5}$/;
-/**
-* Walk the cause chain for the underlying database error, identified by a
-* 5-char SQLSTATE `code`. Drizzle wraps the pg error in `.cause`, and route
-* code sometimes wraps drizzle again, so the real error may sit several
-* levels down.
-*/
-function extractDbError(error, depth = 0) {
-	if (!error || typeof error !== "object" || depth > 8) return null;
-	const e = error;
-	if (typeof e.code === "string" && SQLSTATE_RE.test(e.code)) return e;
-	if (e.cause && typeof e.cause === "object") return extractDbError(e.cause, depth + 1);
-	return null;
-}
 /**
 * Extract the missing table or column name from a PG error.
 * PG 42P01 messages look like: 'relation "my_table" does not exist'
@@ -3601,31 +3586,26 @@ var errorHandler = (err, c) => {
 		if (cause.code === "ECONNREFUSED" && !cause.address && Array.isArray(cause.errors)) resolvedCause = cause.errors.find((e) => e.address) || cause;
 		else resolvedCause = cause;
 	}
-	const dbError = extractDbError(error);
-	if (resolvedCause && (resolvedCause.code === "ENETUNREACH" || resolvedCause.code === "ECONNREFUSED")) {
+	if (resolvedCause) {
 		const cause = resolvedCause;
 		if (cause.code === "ENETUNREACH") logMessage = `Network unreachable. Cannot connect to database at ${cause.address}:${cause.port}.`;
-		else logMessage = `Connection refused to database at ${cause.address}:${cause.port}. Is PostgreSQL running?`;
+		else if (cause.code === "ECONNREFUSED") logMessage = `Connection refused to database at ${cause.address}:${cause.port}. Is PostgreSQL running?`;
+		else if (cause.code === "42703" || cause.code === "42P01") {
+			code = "SCHEMA_DRIFT";
+			logMessage = `Schema drift: ${cause.code === "42703" ? "column" : "table"} "${cause.table || cause.column || extractMissingIdentifier(cause.message) || "unknown"}" does not exist in the database. Run \`pnpm db:push\` to sync your schema, or \`pnpm db:migrate\` to apply pending migrations.`;
+		}
 	} else if ("code" in error && error.code === "ENETUNREACH") {
 		const netErr = error;
 		logMessage = `Network unreachable. Cannot connect to service at ${netErr.address}:${netErr.port}.`;
-	} else if (dbError && (dbError.code === "42703" || dbError.code === "42P01")) {
+	} else if ("code" in error && (error.code === "42703" || error.code === "42P01")) {
 		code = "SCHEMA_DRIFT";
-		logMessage = `Schema drift: ${dbError.code === "42703" ? "column" : "table"} "${dbError.table || dbError.column || extractMissingIdentifier(dbError.message) || "unknown"}" does not exist in the database. Run \`pnpm db:push\` to sync your schema, or \`pnpm db:migrate\` to apply pending migrations.`;
-	} else if (dbError) {
-		const parts = [`[PG ${dbError.code}] ${dbError.message}`];
-		if (dbError.detail) parts.push(`Detail: ${dbError.detail}`);
-		if (dbError.hint) parts.push(`Hint: ${dbError.hint}`);
-		if (dbError.table) parts.push(`Table: ${dbError.table}`);
-		if (dbError.column) parts.push(`Column: ${dbError.column}`);
-		if (dbError.constraint) parts.push(`Constraint: ${dbError.constraint}`);
-		if (dbError.code === "42501") {
-			code = "DB_PERMISSION_DENIED";
-			parts.push(`The database rejected the statement for lack of privilege — usually a row-level security policy${dbError.table ? ` on "${dbError.table}"` : ""} denying this role, or a stale FORCE ROW LEVEL SECURITY flag binding the owner connection.`);
-		}
-		logMessage = parts.join(". ");
-	}
-	const isDbSchemaMismatch = code === "SCHEMA_DRIFT";
+		const issue = error.code === "42703" ? "column" : "table";
+		const pgErr = error;
+		logMessage = `Schema drift: ${issue} "${pgErr.table || pgErr.column || extractMissingIdentifier(error.message) || "unknown"}" does not exist in the database. Run \`pnpm db:push\` to sync your schema, or \`pnpm db:migrate\` to apply pending migrations.`;
+	}
+	const causePg = error.cause && typeof error.cause === "object" ? error.cause : void 0;
+	const pgErrorCode = causePg?.code || error.code;
+	const isDbSchemaMismatch = code === "SCHEMA_DRIFT" || pgErrorCode === "42703" || pgErrorCode === "42P01";
 	if (isDbSchemaMismatch) {
 		logger.warn(`⚠️ [API] ${c.req.method} ${c.req.path} → ${statusCode} ${code}: ${logMessage}` + (reqId ? ` [${reqId}]` : ""));
 		if (!_schemaDriftHinted && process.env.NODE_ENV !== "production") {
@@ -3644,27 +3624,18 @@ var errorHandler = (err, c) => {
 			].join("\n"));
 		}
 	} else logger.error(`❌ [API] ${c.req.method} ${c.req.path} → ${statusCode} ${code}: ${logMessage}` + (reqId ? ` [${reqId}]` : ""));
-	if (!(isDbSchemaMismatch || dbError !== null || statusCode < 500 && code === "BAD_REQUEST")) logger.error(String(error.stack || error));
+	if (!(isDbSchemaMismatch || statusCode < 500 && code === "BAD_REQUEST")) logger.error(String(error.stack || error));
 	let clientMessage = "An unexpected error occurred";
 	if (statusCode < 500 && error.message) clientMessage = error.message;
 	else if (error instanceof ApiError || error.name === "ApiError") clientMessage = error.message;
 	else if (code === "SCHEMA_DRIFT") {
-		const pgErr = dbError || error;
-		clientMessage = `Schema drift: ${pgErr.code === "42703" ? "column" : "table"} "${pgErr.table || pgErr.column || extractMissingIdentifier(pgErr.message || error.message) || "unknown"}" does not exist. Run \`pnpm db:push\` to sync your schema.`;
-	} else if (code === "DB_PERMISSION_DENIED") clientMessage = `Permission denied by the database${dbError?.table ? ` on "${dbError.table}"` : ""} (row-level security). Check the RLS policies for this table.`;
-	else if (code === "INTERNAL_ERROR") clientMessage = "Internal Server Error";
-	const dbDetails = dbError ? {
-		dbCode: dbError.code,
-		...process.env.NODE_ENV !== "production" && {
-			dbMessage: dbError.message,
-			...dbError.detail && { detail: dbError.detail },
-			...dbError.hint && { hint: dbError.hint }
-		}
-	} : void 0;
+		const pgErr = causePg || error;
+		clientMessage = `Schema drift: ${pgErr.code === "42703" || pgErrorCode === "42703" ? "column" : "table"} "${pgErr.table || pgErr.column || extractMissingIdentifier(pgErr.message || error.message) || "unknown"}" does not exist. Run \`pnpm db:push\` to sync your schema.`;
+	} else if (code === "INTERNAL_ERROR") clientMessage = "Internal Server Error";
 	return c.json({ error: {
 		message: clientMessage,
 		code,
-		...error.details !== void 0 ? { details: error.details } : dbDetails !== void 0 ? { details: dbDetails } : {},
+		...error.details !== void 0 && { details: error.details },
 		...reqId && { requestId: reqId }
 	} }, statusCode);
 };
@@ -3686,7 +3657,6 @@ function codeToStatus(code) {
 		EMAIL_EXISTS: 409,
 		ROLE_EXISTS: 409,
 		SCHEMA_DRIFT: 500,
-		DB_PERMISSION_DENIED: 500,
 		INTERNAL_ERROR: 500,
 		NOT_CONFIGURED: 503,
 		SERVICE_UNAVAILABLE: 503
@@ -3812,38 +3782,6 @@ function parseQueryOptions(query) {
 	return options;
 }
 //#endregion
-//#region src/api/rest/write-validation.ts
-/**
-* Reject a write naming a field the collection does not have.
-*
-* Unknown keys used to travel all the way into the INSERT, where Postgres
-* rejected them — so a typo came back as `column "titel" does not exist`,
-* phrased by the database, from a stack the caller cannot see, and only if the
-* column really was absent. It is a request problem and belongs in a 400.
-*
-* What counts as known:
-* - a declared property (for an introspected BaaS collection these *are* the
-*   columns, so the set is exact);
-* - the foreign-key column behind an owning relation, which callers may write
-*   directly instead of through the relation property;
-* - nothing else. `id` in particular is not automatically known — see below.
-*/
-function assertKnownWriteFields(values, collection, options) {
-	if (collection.strictWrites === false) return;
-	if (!collection.properties || Object.keys(collection.properties).length === 0) return;
-	const known = new Set(Object.keys(collection.properties));
-	for (const relation of Object.values(resolveCollectionRelations(collection))) if (relation.localKey) known.add(relation.localKey);
-	const unknown = Object.keys(values).filter((key) => !known.has(key));
-	if (unknown.length === 0) return;
-	const where = options?.rowIndex !== void 0 ? `Row ${options.rowIndex}: ` : "";
-	if (unknown.includes("id") && !known.has("id")) {
-		const keys = Object.entries(collection.properties ?? {}).filter(([, prop]) => "isId" in prop && Boolean(prop.isId)).map(([name]) => `'${name}'`);
-		const keyDesc = keys.length > 0 ? keys.join(" + ") : "its own key column";
-		throw ApiError.badRequest(`${where}'${collection.slug}' has no 'id' column — it is keyed on ${keyDesc}. The \`id\` argument of \`create(data, id)\` is written as an \`id\` column, so for this collection put the key in \`data\` instead.`, "VALIDATION_UNKNOWN_FIELDS");
-	}
-	throw ApiError.badRequest(`${where}'${collection.slug}' has no field${unknown.length > 1 ? "s" : ""} ${unknown.map((f) => `'${f}'`).join(", ")}. Known fields: ${[...known].sort().map((f) => `'${f}'`).join(", ")}.`, "VALIDATION_UNKNOWN_FIELDS");
-}
-//#endregion
 //#region src/auth/api-keys/api-key-permission-guard.ts
 /**
 * Map an HTTP method string to an `ApiKeyOperation`.
@@ -3879,44 +3817,6 @@ function isOperationAllowed(permissions, collection, operation) {
 	for (const perm of permissions) if ((perm.collection === "*" || perm.collection === collection) && perm.operations.includes(operation)) return true;
 	return false;
 }
-/**
-* Check whether the given permissions array allows a storage operation.
-*
-* Storage, like functions, lives outside the collection namespace: an entry
-* with collection `"storage"` grants storage access for the listed
-* operations (GET routes → `read`, upload/folder/tus → `write`,
-* DELETE routes → `delete`), and the global `"*"` wildcard also matches.
-* A collection-scoped key gets no storage access at all.
-*
-* Matching is exactly {@link isOperationAllowed} with `"storage"` as the
-* resource name — delegated so the semantics can never drift.
-*/
-function isStorageAllowed(permissions, operation) {
-	return isOperationAllowed(permissions, "storage", operation);
-}
-/**
-* Check whether the given permissions array allows invoking a custom function.
-*
-* Functions live outside the collection namespace, so they have their own
-* resource names in the permission list:
-*
-* - `{ collection: "functions", ... }` grants every function
-* - `{ collection: "functions/<name>", ... }` grants a single function
-* - the global `"*"` wildcard (full-access keys) also matches
-*
-* The operation is derived from the HTTP method as usual (GET → read,
-* POST/PUT/PATCH → write, DELETE → delete). The functions index route is
-* checked as `functionName === ""`, which only the `"functions"` and `"*"`
-* entries can grant.
-*
-* A collection-scoped key (e.g. read-only on `events`) therefore can NOT
-* invoke functions — before this guard existed, any valid key could call
-* every function.
-*/
-function isFunctionAllowed(permissions, functionName, operation) {
-	for (const perm of permissions) if ((perm.collection === "*" || perm.collection === "functions" || functionName !== "" && perm.collection === `functions/${functionName}`) && perm.operations.includes(operation)) return true;
-	return false;
-}
 //#endregion
 //#region src/api/rest/api-generator.ts
 /**
@@ -3975,17 +3875,6 @@ var RestApiGenerator = class {
 		if (!isOperationAllowed(apiKey.permissions, collectionSlug, operation)) throw ApiError.forbidden(`API key does not have "${operation}" permission for collection "${collectionSlug}"`, "API_KEY_FORBIDDEN");
 	}
 	/**
-	* API key permission check for nested paths. The operation targets the
-	* LAST collection in the path (e.g. "posts" for /authors/1/posts), so
-	* that is the slug the key must hold permission for — checking the
-	* parent instead would let a key scoped to "authors" write "posts".
-	* `parseSubPath` always yields a collectionPath ending in a collection
-	* slug, never an id.
-	*/
-	enforceSubcollectionApiKeyPermission(c, collectionPath) {
-		this.enforceApiKeyPermission(c, collectionPath.split("/").pop());
-	}
-	/**
 	* Get the request-scoped driver. Throws if none is set — never falls
 	* back to the unscoped `this.driver` to avoid bypassing RLS/auth.
 	*/
@@ -4061,7 +3950,6 @@ var RestApiGenerator = class {
 			const maxRows = this.maxBulkRows;
 			if (body.rows.length > maxRows) throw ApiError.badRequest(`Too many rows: ${body.rows.length} exceeds the ${maxRows}-row limit for a single bulk write. Send it in chunks of ${maxRows} or fewer.`, "BULK_TOO_LARGE");
 			if (!driver.saveMany) throw ApiError.badRequest("This collection's data source does not support bulk writes.", "BULK_UNSUPPORTED");
-			body.rows.forEach((row, rowIndex) => assertKnownWriteFields(row, resolvedCollection, { rowIndex }));
 			const rows = await driver.saveMany({
 				path,
 				rows: body.rows,
@@ -4080,9 +3968,7 @@ var RestApiGenerator = class {
 				const path = collection.slug;
 				const body = await parseJsonBody(c);
 				const isAuth = collection.auth;
-				const isAuthCollection = isAuth === true || isAuth && typeof isAuth === "object" && isAuth.enabled === true;
-				if (!isAuthCollection) assertKnownWriteFields(body, resolvedCollection);
-				if (isAuthCollection && this.authAdapter?.prepareUserCreation) {
+				if ((isAuth === true || isAuth && typeof isAuth === "object" && isAuth.enabled === true) && this.authAdapter?.prepareUserCreation) {
 					const collectionAuthConfig = typeof isAuth === "object" ? isAuth : void 0;
 					const prepared = await this.authAdapter.prepareUserCreation(body, collectionAuthConfig);
 					const entity = await driver.save({
@@ -4096,7 +3982,7 @@ var RestApiGenerator = class {
 						invitationSent: prepared.invitationSent
 					} : this.authAdapter.finalizeUserCreation ? await this.authAdapter.finalizeUserCreation({
 						id: entity.id,
-						values: entity
+						values: entity.values
 					}, prepared.clearPassword) : { invitationSent: false };
 					const response = this.formatResponse(entity);
 					return c.json({
@@ -4132,7 +4018,6 @@ var RestApiGenerator = class {
 					collection: resolvedCollection
 				})) throw ApiError.notFound("Entity not found");
 				const body = await parseJsonBody(c);
-				assertKnownWriteFields(body, resolvedCollection);
 				const entity = await driver.save({
 					path: getCollectionDataPath(collection),
 					id: String(id),
@@ -4161,7 +4046,7 @@ var RestApiGenerator = class {
 			if (!existingEntity) throw ApiError.notFound("Entity not found");
 			await driver.delete({
 				row: {
-					id: String(id),
+					id: existingEntity.id,
 					path: getCollectionDataPath(collection),
 					values: existingEntity
 				},
@@ -4209,7 +4094,7 @@ var RestApiGenerator = class {
 			const parsed = parseSubPath(`${c.req.param("parent")}/${c.req.param("parentId")}/${rest}`);
 			if (!parsed) return next();
 			const driver = this.getScopedDriver(c);
-			this.enforceSubcollectionApiKeyPermission(c, parsed.collectionPath);
+			this.enforceApiKeyPermission(c, c.req.param("parent"));
 			if (parsed.id === "count") {
 				const queryDict = c.req.queries();
 				const queryOptions = parseQueryOptions(queryDict);
@@ -4261,7 +4146,7 @@ var RestApiGenerator = class {
 			const parsed = parseSubPath(`${c.req.param("parent")}/${c.req.param("parentId")}/${rest}`);
 			if (!parsed || parsed.id) return next();
 			const driver = this.getScopedDriver(c);
-			this.enforceSubcollectionApiKeyPermission(c, parsed.collectionPath);
+			this.enforceApiKeyPermission(c, c.req.param("parent"));
 			const body = await parseJsonBody(c);
 			const entity = await driver.save({
 				path: parsed.collectionPath,
@@ -4277,7 +4162,7 @@ var RestApiGenerator = class {
 			const parsed = parseSubPath(`${c.req.param("parent")}/${c.req.param("parentId")}/${rest}`);
 			if (!parsed || !parsed.id) return next();
 			const driver = this.getScopedDriver(c);
-			this.enforceSubcollectionApiKeyPermission(c, parsed.collectionPath);
+			this.enforceApiKeyPermission(c, c.req.param("parent"));
 			const body = await parseJsonBody(c);
 			const entity = await driver.save({
 				path: parsed.collectionPath,
@@ -4294,14 +4179,14 @@ var RestApiGenerator = class {
 			const parsed = parseSubPath(`${c.req.param("parent")}/${c.req.param("parentId")}/${rest}`);
 			if (!parsed || !parsed.id) return next();
 			const driver = this.getScopedDriver(c);
-			this.enforceSubcollectionApiKeyPermission(c, parsed.collectionPath);
+			this.enforceApiKeyPermission(c, c.req.param("parent"));
 			const existingEntity = await driver.fetchOne({
 				path: parsed.collectionPath,
 				id: parsed.id
 			});
 			if (!existingEntity) throw ApiError.notFound("Entity not found");
 			await driver.delete({ row: {
-				id: parsed.id,
+				id: existingEntity.id,
 				path: parsed.collectionPath,
 				values: existingEntity
 			} });
@@ -4424,15 +4309,6 @@ function safeCompare(a, b) {
 * 4. Sets `c.set("user", ...)` and `c.set("apiKey", ...)` for downstream use
 * 5. Scopes the DataDriver via `withAuth()` using the API key's service identity
 *
-* Authorization is double-gated for API keys: the key's own permission list
-* (checked by the REST generator) is one ceiling, and Postgres RLS is another,
-* independent one — `withAuth()` runs API-key requests as the restricted
-* `rebase_user` role like any other caller. An `admin` key passes RLS via the
-* injected `default_admin` policies; a non-admin key (roles `["service"]`,
-* uid `api-key:<id>`) only sees rows that a policy explicitly grants to the
-* `service` role or to the public. Owner-style policies
-* (`owner_id = auth.uid()`) never match an API key's synthetic uid.
-*
 * @module
 */
 /**
@@ -4506,113 +4382,9 @@ async function validateApiKey(c, token, options) {
 			code: "INTERNAL_ERROR"
 		} }, 500);
 	}
-	const lastTouch = lastUsedTouchedAt.get(apiKey.id);
-	const now = Date.now();
-	if (!lastTouch || now - lastTouch >= LAST_USED_DEBOUNCE_MS) {
-		lastUsedTouchedAt.set(apiKey.id, now);
-		store.updateLastUsed(apiKey.id).catch(() => {});
-	}
+	store.updateLastUsed(apiKey.id).catch(() => {});
 	return true;
 }
-/** Per-process debounce state for last_used_at touches. */
-var lastUsedTouchedAt = /* @__PURE__ */ new Map();
-var LAST_USED_DEBOUNCE_MS = 6e4;
-/**
-* Shared 403 response for API-key permission denials outside the REST
-* generator (storage and functions guards). One envelope, one code — a
-* change to the error contract happens in one place.
-*/
-function forbidApiKey(c, operation, resource, grantHint) {
-	return c.json({ error: {
-		message: `API key does not have "${operation}" permission for ${resource}. Grant it with a permission entry like { "collection": "${grantHint}", "operations": ["${operation}"] }.`,
-		code: "API_KEY_FORBIDDEN"
-	} }, 403);
-}
-/**
-* Permission guard for API-key requests to the storage router.
-*
-* Storage previously did not accept API keys at all (`rk_` tokens were
-* misparsed as JWTs and 401'd). Now that the pre-auth middleware
-* authenticates them, this guard decides what they may do: the key needs a
-* `"storage"` permission entry (or the global `"*"` wildcard) covering the
-* operation derived from the HTTP method. Requests not authenticated via an
-* API key pass through to the storage router's own auth gates.
-*
-* TUS resumable-upload routes (`/tus`, `/tus/:id`) are classified as `write`
-* for EVERY method: the protocol's offset check is a GET and its cancel is a
-* DELETE, but both are steps of an upload — a write-scoped key must be able
-* to complete (and abort) its own resumable upload without also holding
-* `read`/`delete` on stored objects.
-*/
-function createStorageApiKeyGuard() {
-	return async (c, next) => {
-		const apiKey = c.get("apiKey");
-		if (!apiKey) return next();
-		const operation = /\/tus(\/|$)/.test(c.req.path) ? "write" : httpMethodToOperation(c.req.method);
-		if (!isStorageAllowed(apiKey.permissions, operation)) return forbidApiKey(c, operation, "storage", "storage");
-		return next();
-	};
-}
-/**
-* Permission guard for API-key requests to the custom-functions router.
-*
-* The collection permission guard lives in the REST generator and never sees
-* function routes, so before this middleware existed ANY valid API key —
-* however narrowly scoped — could invoke every custom function. This guard
-* closes that: API-key requests must hold a `"functions"`/`"functions/<name>"`
-* permission entry (or the global `"*"` wildcard) for the derived operation.
-*
-* Non-API-key requests (JWT, service key, anonymous) pass through untouched —
-* functions decide their own auth for those, as before.
-*
-* @param mountPrefix - The path the functions router is mounted at
-*                      (e.g. `/api/functions`), used to extract the function
-*                      name from the request path.
-*/
-function createFunctionApiKeyGuard(mountPrefix) {
-	return async (c, next) => {
-		const apiKey = c.get("apiKey");
-		if (!apiKey) return next();
-		const path = c.req.path;
-		const idx = path.indexOf(mountPrefix);
-		const rawName = (idx < 0 ? "" : path.slice(idx + mountPrefix.length)).split("/").filter(Boolean)[0] ?? "";
-		let functionName;
-		try {
-			functionName = decodeURIComponent(rawName);
-		} catch {
-			functionName = rawName;
-		}
-		const operation = httpMethodToOperation(c.req.method);
-		if (!isFunctionAllowed(apiKey.permissions, functionName, operation)) return forbidApiKey(c, operation, functionName ? `function "${functionName}"` : "the functions index", `functions${functionName ? `/${functionName}` : ""}`);
-		return next();
-	};
-}
-/**
-* Standalone pre-auth middleware for `rk_` bearer tokens.
-*
-* Routers whose auth gate is JWT-based (`requireAuth` / `createRequireAuth` —
-* the admin surfaces: admin users/roles, api-keys management, cron, backups,
-* logs, schema editor) don't know about API keys. Mounting this middleware in
-* front of them authenticates `rk_` tokens and populates the request context;
-* the downstream gates then see the already-resolved user and apply their
-* role checks (`requireAdmin`) as usual — so an `admin: true` key passes and
-* a non-admin key is rejected with 403.
-*
-* Requests without an `rk_` bearer token pass through untouched. An invalid,
-* revoked, or expired `rk_` token is rejected here (401) rather than falling
-* through to be misparsed as a JWT.
-*/
-function createApiKeyPreAuth(options) {
-	return async (c, next) => {
-		if (c.get("apiKey")) return next();
-		const authHeader = c.req.header("authorization") || "";
-		const token = authHeader.startsWith("Bearer ") ? authHeader.slice(7) : "";
-		if (!token || !isApiKeyToken(token)) return next();
-		const result = await validateApiKey(c, token, options);
-		if (result !== true) return result;
-		return next();
-	};
-}
 //#endregion
 //#region src/auth/middleware.ts
 /**
@@ -4626,12 +4398,14 @@ function createApiKeyPreAuth(options) {
 * need query-string tokens (e.g. storage file serving for `<img src>`).
 */
 var requireAuth = async (c, next) => {
-	if (c.get("user")) return next();
 	const authHeader = c.req.header("authorization");
-	if (!(authHeader && authHeader.startsWith("Bearer "))) return c.json({ error: {
-		message: "Authorization header missing or invalid",
-		code: "UNAUTHORIZED"
-	} }, 401);
+	if (!(authHeader && authHeader.startsWith("Bearer "))) {
+		if (c.get("user")) return next();
+		return c.json({ error: {
+			message: "Authorization header missing or invalid",
+			code: "UNAUTHORIZED"
+		} }, 401);
+	}
 	const payload = verifyAccessToken(authHeader.substring(7));
 	if (!payload) return c.json({ error: {
 		message: "Invalid or expired token",
@@ -4654,12 +4428,14 @@ function createRequireAuth(options) {
 	if (!options?.serviceKey) return requireAuth;
 	const key = options.serviceKey;
 	return async (c, next) => {
-		if (c.get("user")) return next();
 		const authHeader = c.req.header("authorization");
-		if (!(authHeader && authHeader.startsWith("Bearer "))) return c.json({ error: {
-			message: "Authorization header missing or invalid",
-			code: "UNAUTHORIZED"
-		} }, 401);
+		if (!(authHeader && authHeader.startsWith("Bearer "))) {
+			if (c.get("user")) return next();
+			return c.json({ error: {
+				message: "Authorization header missing or invalid",
+				code: "UNAUTHORIZED"
+			} }, 401);
+		}
 		const token = authHeader.substring(7);
 		if (safeCompare(token, key)) {
 			c.set("user", {
@@ -4900,25 +4676,8 @@ var publicObjectAuth = async (c, next) => {
 /**
 * Helper to match paths for scoped file tokens.
 * Matches exact paths or prefixes (exact folder prefixes or ending with /).
-*
-* The traversal check is defence in depth, not the load-bearing defence.
-*
-* A prefix comparison is a lie for any path containing `..`: `user1/../user2/x`
-* starts with `user1/`, so a token scoped to `user1/` would authorize reading
-* user2's file — and the storage controller would not object, because its own
-* guard stops a path escaping the *bucket*, and that one resolves to `user2/x`,
-* comfortably inside it. The grant is what would be escaped, and this is the
-* only layer that knows what was granted.
-*
-* Nothing arrives here in that shape today: the URL parser resolves `..` (and
-* `%2e%2e`, which the WHATWG spec treats as a dot for normalization) before
-* Hono routes the request, so this comparison already runs on a resolved path.
-* But that is a guarantee of the runtime rather than of this code, and it is
-* one line to not depend on it. The same rule already guards the public-object
-* path — see `isPublicStoragePath`.
 */
 function isPathMatch(requested, allowed) {
-	if (requested.split("/").some((seg) => seg === "..")) return false;
 	if (requested === allowed) return true;
 	if (allowed.endsWith("/")) return requested.startsWith(allowed);
 	return requested.startsWith(allowed + "/");
@@ -5742,118 +5501,60 @@ function resolveAuthHooks(hooks) {
 	};
 }
 //#endregion
-//#region src/auth/rate-limit-store.ts
-/**
-* The default store: a sliding window in this process's memory.
-*
-* Sliding rather than fixed: a fixed window lets a caller spend its whole
-* allowance in the last second of one window and again in the first second of
-* the next, which is twice the limit over an instant. Timestamps outside the
-* window are dropped on read, and swept periodically so an idle key does not
-* pin its array forever.
-*
-* Per-process, so N replicas enforce N times the limit between them. That is
-* the honest reason {@link RateLimitStore} exists.
-*/
-var MemoryRateLimitStore = class {
-	store = /* @__PURE__ */ new Map();
-	cleanupInterval;
-	constructor(sweepMs = 900 * 1e3) {
-		this.cleanupInterval = setInterval(() => this.sweep(sweepMs), sweepMs);
-		this.cleanupInterval.unref?.();
-	}
-	async hit(key, windowMs, limit) {
-		const now = Date.now();
-		const timestamps = (this.store.get(key) ?? []).filter((t) => now - t < windowMs);
-		if (timestamps.length >= limit) {
-			this.store.set(key, timestamps);
-			return {
-				allowed: false,
-				remaining: 0,
-				retryAfterMs: Math.max(0, timestamps[0] + windowMs - now)
-			};
-		}
-		timestamps.push(now);
-		this.store.set(key, timestamps);
-		return {
-			allowed: true,
-			remaining: limit - timestamps.length,
-			retryAfterMs: 0
-		};
-	}
-	sweep(windowMs) {
-		const now = Date.now();
-		for (const [key, timestamps] of this.store.entries()) {
-			const live = timestamps.filter((t) => now - t < windowMs);
-			if (live.length === 0) this.store.delete(key);
-			else this.store.set(key, live);
-		}
-	}
-	dispose() {
-		if (this.cleanupInterval) clearInterval(this.cleanupInterval);
-		this.cleanupInterval = void 0;
-		this.store.clear();
-	}
-};
-//#endregion
 //#region src/auth/rate-limiter.ts
 /**
-* Resolve the number of trusted proxy hops from an explicit option, the
-* `TRUSTED_PROXY_HOPS` env var, or the default of 1.
-*/
-function resolveTrustedProxyHops(optionValue) {
-	if (typeof optionValue === "number" && Number.isFinite(optionValue) && optionValue >= 0) return Math.floor(optionValue);
-	const fromEnv = Number(process.env.TRUSTED_PROXY_HOPS);
-	if (Number.isFinite(fromEnv) && fromEnv >= 0) return Math.floor(fromEnv);
-	return 1;
-}
-/**
 * Create a rate-limiting middleware.
 *
-* Uses a sliding window: only hits within the last `windowMs` are counted.
+* Uses a sliding window algorithm: only timestamps within the last
+* `windowMs` milliseconds are counted. Old entries are garbage-collected
+* every `windowMs` to prevent unbounded memory growth.
 */
 function createRateLimiter(options = {}) {
-	const trustedProxyHops = resolveTrustedProxyHops(options.trustedProxyHops);
-	const { windowMs = 900 * 1e3, limit = 100, keyGenerator = (c) => defaultKeyGenerator(c, trustedProxyHops), message = "Too many requests, please try again later.", store = new MemoryRateLimitStore(windowMs), resolveLimit } = options;
+	const { windowMs = 900 * 1e3, limit = 100, keyGenerator = defaultKeyGenerator, message = "Too many requests, please try again later." } = options;
+	const store = /* @__PURE__ */ new Map();
+	const cleanupInterval = setInterval(() => {
+		const now = Date.now();
+		for (const [key, entry] of store.entries()) {
+			entry.timestamps = entry.timestamps.filter((t) => now - t < windowMs);
+			if (entry.timestamps.length === 0) store.delete(key);
+		}
+	}, windowMs);
+	if (cleanupInterval.unref) cleanupInterval.unref();
 	return async (c, next) => {
-		const effectiveLimit = resolveLimit ? resolveLimit(c) : limit;
-		if (effectiveLimit === null) return next();
-		const activeLimit = effectiveLimit ?? limit;
-		const decision = await store.hit(keyGenerator(c), windowMs, activeLimit);
-		c.header("X-RateLimit-Limit", String(activeLimit));
-		c.header("X-RateLimit-Remaining", String(decision.remaining));
-		if (!decision.allowed) {
-			const retryAfterSec = Math.ceil(decision.retryAfterMs / 1e3);
+		const key = keyGenerator(c);
+		const now = Date.now();
+		let entry = store.get(key);
+		if (!entry) {
+			entry = { timestamps: [] };
+			store.set(key, entry);
+		}
+		entry.timestamps = entry.timestamps.filter((t) => now - t < windowMs);
+		if (entry.timestamps.length >= limit) {
+			const retryAfterMs = entry.timestamps[0] + windowMs - now;
+			const retryAfterSec = Math.ceil(retryAfterMs / 1e3);
 			c.header("Retry-After", String(retryAfterSec));
-			c.header("X-RateLimit-Reset", String(Math.ceil((Date.now() + decision.retryAfterMs) / 1e3)));
+			c.header("X-RateLimit-Limit", String(limit));
+			c.header("X-RateLimit-Remaining", "0");
+			c.header("X-RateLimit-Reset", String(Math.ceil((now + retryAfterMs) / 1e3)));
 			return c.json({ error: {
 				message,
 				code: "RATE_LIMITED"
 			} }, 429);
 		}
+		entry.timestamps.push(now);
+		c.header("X-RateLimit-Limit", String(limit));
+		c.header("X-RateLimit-Remaining", String(limit - entry.timestamps.length));
 		return next();
 	};
 }
 /**
 * Default key generator: extract client IP from standard headers.
-*
-* `X-Forwarded-For` is a client-writable header; only the entries appended by
-* trusted reverse proxies can be believed. With `trustedProxyHops` proxies in
-* front, each appends the address it saw, so the real client IP is the
-* `trustedProxyHops`-th entry from the right — everything further left is
-* client-supplied and must be ignored. This is what prevents a caller from
-* spoofing `X-Forwarded-For` to spread its requests across many rate-limit keys.
-*
-* With `trustedProxyHops === 0` (server exposed directly, no proxy),
-* `X-Forwarded-For` is not trusted at all and `X-Real-IP` is used instead.
 */
-function defaultKeyGenerator(c, trustedProxyHops = resolveTrustedProxyHops()) {
-	if (trustedProxyHops > 0) {
-		const forwardedFor = c.req.header("x-forwarded-for");
-		if (forwardedFor) {
-			const ips = forwardedFor.split(",").map((s) => s.trim()).filter(Boolean);
-			if (ips.length > 0) return ips[Math.max(0, ips.length - trustedProxyHops)];
-		}
+function defaultKeyGenerator(c) {
+	const forwardedFor = c.req.header("x-forwarded-for");
+	if (forwardedFor) {
+		const ips = forwardedFor.split(",");
+		return ips[ips.length - 1].trim();
 	}
 	return c.req.header("x-real-ip") || "unknown";
 }
@@ -5888,65 +5589,54 @@ function apiKeyKeyGenerator(c) {
 	return defaultKeyGenerator(c);
 }
 /**
-* Rate limiting for the data API.
-*
-* Every request is in exactly one bucket, resolved most-specific first: an API
-* key by its id, a signed-in user by their uid, anyone else by IP. Previously
-* only the first of those was limited at all — the middleware returned early
-* for any request without an API key — so JWT and anonymous traffic to
-* `/api/data/*` was unbounded, which is most of the traffic a BaaS gets.
-*
-* Per bucket, not per route: the point is to bound what one caller costs, and
-* they can spend it wherever they like.
-*
-* The defaults are deliberately loose. This is a floor against a runaway client
-* or a naive scraper, not a quota — a deployment that wants real quotas should
-* set them, and one that already has a proxy doing this should pass
-* `enabled: false` rather than pay for it twice.
-*/
-function createDataRateLimiter(config = {}) {
-	const { windowMs = 900 * 1e3, apiKey: apiKeyLimit = 1e3, user: userLimit = 1e3, anonymous: anonLimit = 300, store = new MemoryRateLimitStore(windowMs) } = config;
-	return createRateLimiter({
-		windowMs,
-		store,
-		message: "Too many requests, please try again later.",
-		keyGenerator: (c) => {
-			const key = c.get("apiKey");
-			if (key) return `api-key:${key.id}`;
-			const user = c.get("user");
-			if (user?.userId && user.userId !== "anon") return `user:${user.userId}`;
-			return `ip:${defaultKeyGenerator(c)}`;
-		},
-		resolveLimit: (c) => {
-			const key = c.get("apiKey");
-			if (key) return key.rate_limit ?? apiKeyLimit;
-			const user = c.get("user");
-			if (user?.userId && user.userId !== "anon") return userLimit;
-			return anonLimit;
-		}
-	});
-}
-/**
 * Create a rate limiter specifically for API key requests.
 *
-* @deprecated Use {@link createDataRateLimiter}, which limits signed-in users
-* and anonymous callers too. This one skips every request that is not
-* API-key-authenticated, which was most of them.
+* When a request is authenticated via an API key that has a `rate_limit`
+* configured, this limiter enforces per-key limits using the key's ID
+* as the rate limit bucket.
 *
 * @param defaultLimit - Fallback limit when the key has no `rate_limit` set.
 * @param windowMs     - Time window in milliseconds (default: 15 minutes).
 */
 function createApiKeyRateLimiter(defaultLimit = 1e3, windowMs = 900 * 1e3) {
-	return createRateLimiter({
-		windowMs,
-		message: "API key rate limit exceeded, please try again later.",
-		keyGenerator: apiKeyKeyGenerator,
-		resolveLimit: (c) => {
-			const apiKey = c.get("apiKey");
-			if (!apiKey) return null;
-			return apiKey.rate_limit ?? defaultLimit;
+	const store = /* @__PURE__ */ new Map();
+	const cleanupInterval = setInterval(() => {
+		const now = Date.now();
+		for (const [key, entry] of store.entries()) {
+			entry.timestamps = entry.timestamps.filter((t) => now - t < windowMs);
+			if (entry.timestamps.length === 0) store.delete(key);
 		}
-	});
+	}, windowMs);
+	if (cleanupInterval.unref) cleanupInterval.unref();
+	return async (c, next) => {
+		const apiKey = c.get("apiKey");
+		if (!apiKey) return next();
+		const limit = apiKey.rate_limit ?? defaultLimit;
+		const key = `api-key:${apiKey.id}`;
+		const now = Date.now();
+		let entry = store.get(key);
+		if (!entry) {
+			entry = { timestamps: [] };
+			store.set(key, entry);
+		}
+		entry.timestamps = entry.timestamps.filter((t) => now - t < windowMs);
+		if (entry.timestamps.length >= limit) {
+			const retryAfterMs = entry.timestamps[0] + windowMs - now;
+			const retryAfterSec = Math.ceil(retryAfterMs / 1e3);
+			c.header("Retry-After", String(retryAfterSec));
+			c.header("X-RateLimit-Limit", String(limit));
+			c.header("X-RateLimit-Remaining", "0");
+			c.header("X-RateLimit-Reset", String(Math.ceil((now + retryAfterMs) / 1e3)));
+			return c.json({ error: {
+				message: "API key rate limit exceeded, please try again later.",
+				code: "RATE_LIMITED"
+			} }, 429);
+		}
+		entry.timestamps.push(now);
+		c.header("X-RateLimit-Limit", String(limit));
+		c.header("X-RateLimit-Remaining", String(limit - entry.timestamps.length));
+		return next();
+	};
 }
 //#endregion
 //#region ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/core/core.js
@@ -10002,7 +9692,7 @@ function mountSessionRoutes(opts) {
 		clearRefreshCookie(c, config.cookieAuth);
 		const authHeader = c.req.header("authorization");
 		if (ops.afterLogout && authHeader?.startsWith("Bearer ")) {
-			const { verifyAccessToken } = await import("./jwt-BJzQOa8a.js").then((n) => n.c);
+			const { verifyAccessToken } = await import("./jwt-C6pbGtvf.js").then((n) => n.c);
 			const payload = verifyAccessToken(authHeader.substring(7));
 			if (payload) ops.afterLogout(payload.userId).catch((err) => {
 				logger.error("[AuthHooks] afterLogout error", { error: err instanceof Error ? err.message : err });
@@ -10934,27 +10624,7 @@ function createAdminUsersRoute(config) {
 		const userId = "userId" in user ? user.userId : "uid" in user ? user.uid : void 0;
 		if (!userId) throw ApiError.unauthorized("User ID not found in auth context");
 		if (!await authRepo.getUserById(userId)) throw ApiError.notFound("Authenticated user does not exist in the database.", "USER_NOT_FOUND");
-		if (users.length > 0) {
-			const earliest = users.reduce((a, b) => {
-				const at = new Date(a.createdAt).getTime();
-				const bt = new Date(b.createdAt).getTime();
-				if (at !== bt) return at < bt ? a : b;
-				return a.id < b.id ? a : b;
-			});
-			if (earliest.id !== userId) {
-				logger.warn("[Security Audit] Bootstrap denied: caller is not the earliest-registered user", {
-					eventType: "auth.bootstrap.denied",
-					callerId: userId,
-					earliestUserId: earliest.id
-				});
-				throw ApiError.forbidden("Only the first registered user may claim the initial admin role. Ask that user to bootstrap, or assign the admin role using the service key.", "BOOTSTRAP_NOT_FIRST_USER");
-			}
-		}
 		await authRepo.setUserRoles(userId, ["admin"]);
-		logger.info("[Security Audit] Initial admin bootstrapped", {
-			eventType: "auth.bootstrap.success",
-			userId
-		});
 		if (config.setBootstrapCompleted) await config.setBootstrapCompleted();
 		return c.json({
 			success: true,
@@ -11097,8 +10767,10 @@ function createBuiltinAuthAdapter(config) {
 		serviceKey,
 		async verifyRequest(request) {
 			const authHeader = request.headers.get("authorization");
-			if (!authHeader?.startsWith("Bearer ")) return null;
-			const token = authHeader.substring(7);
+			const queryToken = new URL(request.url, "http://localhost").searchParams.get("token");
+			const hasBearer = authHeader?.startsWith("Bearer ");
+			if (!hasBearer && !queryToken) return null;
+			const token = hasBearer ? authHeader.substring(7) : queryToken;
 			if (serviceKey && safeCompare(token, serviceKey)) return {
 				uid: "service",
 				email: "service@rebase.internal",
@@ -11540,7 +11212,7 @@ function configureMiddlewares(app, basePath, isProduction, config) {
 		app.use(`${basePath}/*`, csrf({ origin: config.csrf.origin }));
 		logger.info("CSRF protection enabled");
 	}
-	if (!process.env.CORS_ORIGINS && !process.env.FRONTEND_URL) logger.warn((isProduction ? "[PRODUCTION] " : "") + "No CORS configuration detected (CORS_ORIGINS / FRONTEND_URL not set). If your app does not install its own CORS middleware, the API may accept requests from any origin. Set CORS_ORIGINS to restrict access.");
+	if (!isProduction && !process.env.CORS_ORIGINS && !process.env.FRONTEND_URL) logger.warn("No CORS configuration detected (CORS_ORIGINS / FRONTEND_URL not set). The API will accept requests from any origin. Set CORS_ORIGINS in your .env file to restrict access.");
 	app.use(`${basePath}/*`, requestLogger());
 	app.use(`${basePath}/*`, logMiddleware());
 }
@@ -12288,47 +11960,6 @@ async function loadGoogleAuth() {
 	return _googleAuth;
 }
 /**
-* Verify a Google **access token** and resolve it to a profile.
-*
-* SECURITY: an access token must be checked against Google's `tokeninfo`
-* endpoint so we can confirm its `aud` (the OAuth client the token was issued
-* to) matches *our* `clientId`. The `userinfo` endpoint does **not** verify
-* audience — it returns a profile for any valid Google access token — so
-* trusting it alone lets an attacker present a token they obtained for a
-* *different* client (e.g. their own app, via a phished consent) and log in as
-* whatever account that token belongs to. The `aud` check is what binds the
-* token to this application.
-*
-* Identity (`sub` / `email` / `email_verified`) is taken from the
-* audience-checked `tokeninfo` response. `userinfo` is used only, best-effort,
-* to enrich display fields (name, picture).
-*/
-async function verifyGoogleAccessToken(accessToken, expectedClientId) {
-	const tokenInfoRes = await fetch(`https://oauth2.googleapis.com/tokeninfo?access_token=${encodeURIComponent(accessToken)}`);
-	if (!tokenInfoRes.ok) throw new Error(`Google tokeninfo request failed with status ${tokenInfoRes.status}`);
-	const tokenInfo = await tokenInfoRes.json();
-	if (tokenInfo.aud !== expectedClientId) throw new Error("Google access token audience mismatch: the token was not issued for this application");
-	if (!tokenInfo.sub || !tokenInfo.email) throw new Error("Google access token missing sub or email (the email scope is required)");
-	const emailVerified = tokenInfo.email_verified === true || tokenInfo.email_verified === "true";
-	let displayName = null;
-	let photoUrl = null;
-	try {
-		const res = await fetch("https://www.googleapis.com/oauth2/v3/userinfo", { headers: { Authorization: `Bearer ${accessToken}` } });
-		if (res.ok) {
-			const info = await res.json();
-			displayName = info.name || null;
-			photoUrl = info.picture || null;
-		}
-	} catch {}
-	return {
-		providerId: tokenInfo.sub,
-		email: tokenInfo.email,
-		displayName,
-		photoUrl,
-		emailVerified
-	};
-}
-/**
 * Creates a Google OAuth Provider integration.
 *
 * Supports three verification paths:
@@ -12378,10 +12009,22 @@ function createGoogleProvider(config) {
 						email: content.email || "",
 						displayName: content.name || null,
 						photoUrl: content.picture || null,
-						emailVerified: content.email_verified === true
+						emailVerified: true
+					};
+				}
+				if (payload.accessToken) {
+					const res = await fetch("https://www.googleapis.com/oauth2/v3/userinfo", { headers: { Authorization: `Bearer ${payload.accessToken}` } });
+					if (!res.ok) throw new Error(`Google userinfo request failed with status ${res.status}`);
+					const info = await res.json();
+					if (!info.sub || !info.email) throw new Error("Google userinfo response missing sub or email");
+					return {
+						providerId: info.sub,
+						email: info.email,
+						displayName: info.name || null,
+						photoUrl: info.picture || null,
+						emailVerified: true
 					};
 				}
-				if (payload.accessToken) return await verifyGoogleAccessToken(payload.accessToken, clientId);
 				if (payload.code && payload.redirectUri) {
 					if (!clientSecret) throw new Error("Google authorization code flow requires clientSecret. Configure GOOGLE_CLIENT_SECRET in your environment.");
 					const tokenResponse = await fetch("https://oauth2.googleapis.com/token", {
@@ -12412,10 +12055,22 @@ function createGoogleProvider(config) {
 							email: content.email || "",
 							displayName: content.name || null,
 							photoUrl: content.picture || null,
-							emailVerified: content.email_verified === true
+							emailVerified: true
+						};
+					}
+					if (tokenData.access_token) {
+						const userInfoRes = await fetch("https://www.googleapis.com/oauth2/v3/userinfo", { headers: { Authorization: `Bearer ${tokenData.access_token}` } });
+						if (!userInfoRes.ok) throw new Error(`Google userinfo request failed after code exchange (${userInfoRes.status})`);
+						const info = await userInfoRes.json();
+						if (!info.sub || !info.email) return null;
+						return {
+							providerId: info.sub,
+							email: info.email,
+							displayName: info.name || null,
+							photoUrl: info.picture || null,
+							emailVerified: true
 						};
 					}
-					if (tokenData.access_token) return await verifyGoogleAccessToken(tokenData.access_token, clientId);
 					throw new Error("Google token exchange returned neither id_token nor access_token");
 				}
 				throw new Error("No valid Google credential provided (expected idToken, accessToken, or code+redirectUri)");
@@ -12605,13 +12260,12 @@ function createMicrosoftProvider(config) {
 					logger.error("Microsoft user has no email");
 					return null;
 				}
-				const emailVerified = Boolean(profileData.mail);
 				return {
 					providerId: profileData.id,
 					email,
 					displayName: profileData.displayName || null,
 					photoUrl: null,
-					emailVerified
+					emailVerified: true
 				};
 			} catch (error) {
 				logger.error("Microsoft OAuth error", { error });
@@ -13504,7 +13158,6 @@ function createCustomAuthAdapter(options) {
 //#endregion
 //#region src/auth/index.ts
 var auth_exports = /* @__PURE__ */ __exportAll({
-	MemoryRateLimitStore: () => MemoryRateLimitStore,
 	apiKeyKeyGenerator: () => apiKeyKeyGenerator,
 	configureJwt: () => configureJwt,
 	createAdapterAuthMiddleware: () => createAdapterAuthMiddleware,
@@ -13517,7 +13170,6 @@ var auth_exports = /* @__PURE__ */ __exportAll({
 	createBitbucketProvider: () => createBitbucketProvider,
 	createBuiltinAuthAdapter: () => createBuiltinAuthAdapter,
 	createCustomAuthAdapter: () => createCustomAuthAdapter,
-	createDataRateLimiter: () => createDataRateLimiter,
 	createDiscordProvider: () => createDiscordProvider,
 	createFacebookProvider: () => createFacebookProvider,
 	createGitHubProvider: () => createGitHubProvider,
@@ -14412,7 +14064,7 @@ async function initializeStorage(storageConfig, isProduction) {
 //#region src/init/docs.ts
 async function mountOpenApiDocs(app, basePath, enableSwagger, activeCollections, requireAuth) {
 	if (enableSwagger === false || activeCollections.length === 0) return;
-	const { generateOpenApiSpec } = await import("./openapi-generator-DqSIwNLV.js");
+	const { generateOpenApiSpec } = await import("./openapi-generator-Z9oYWLf_.js");
 	app.get(`${basePath}/docs`, (c) => {
 		const spec = generateOpenApiSpec(activeCollections, {
 			basePath,
@@ -14566,38 +14218,6 @@ function createShutdown(config) {
 	};
 }
 //#endregion
-//#region src/auth/collection-callback-warning.ts
-/** The data callbacks the auth write path does not run. */
-var DATA_CALLBACKS = [
-	"beforeSave",
-	"afterSave",
-	"beforeDelete",
-	"afterDelete"
-];
-/**
-* Warn when the auth collection hangs data callbacks that auth will not fire.
-*
-* Creating a user through the auth subsystem — registration, OAuth, the admin
-* user routes — writes to the user store directly, because that path owns
-* password hashing, identity rows and its own transaction. It deliberately does
-* not go through the collection save pipeline: a `beforeSave` able to rewrite
-* `password_hash` on its way to the database is a footgun, not a feature, and
-* the auth hooks (`afterUserCreate`, `beforeUserCreate`, …) exist to hang
-* behaviour off those events with the right contract.
-*
-* The cost is a reasonable expectation quietly not being met: someone puts
-* "send the welcome email" in `afterSave` on their users collection, tests it
-* by creating a user in the admin, and it works — because *that* is a
-* collection write. Then a real signup does nothing at all. Which is why this
-* is said at boot, naming the callbacks that will not run.
-*/
-function warnOnAuthCollectionDataCallbacks(collection) {
-	if (!collection?.callbacks) return;
-	const declared = DATA_CALLBACKS.filter((name) => typeof collection.callbacks?.[name] === "function");
-	if (declared.length === 0) return;
-	logger.warn(`[Auth] The auth collection "${collection.slug}" defines ${declared.join("/")} callback(s), but these do NOT fire when users are created or updated through the auth system (registration, admin, OAuth) — that path bypasses the collection save pipeline. Use auth hooks (afterUserCreate, beforeUserCreate, afterUserDelete, …) for those side effects.`);
-}
-//#endregion
 //#region ../client/dist/index.es.js
 function rebaseReviver(_key, value) {
 	if (value && typeof value === "object" && "__type" in value) {
@@ -17458,7 +17078,16 @@ async function _initializeRebaseBackend(config) {
 			const authDs = resolveDataSource(safeAuthConfig.collection, dataSourceRegistry);
 			if (authDs.key !== "(default)") logger.warn(`[Auth] The auth collection "${safeAuthConfig.collection.slug}" is on data source "${authDs.key}", but the built-in auth system always uses the default data source. Move the auth collection to the default data source, or replace auth with an AuthAdapter that manages users in "${authDs.key}".`);
 		}
-		warnOnAuthCollectionDataCallbacks(safeAuthConfig.collection);
+		if (safeAuthConfig.collection?.callbacks) {
+			const cb = safeAuthConfig.collection.callbacks;
+			const dataCallbacks = [
+				"beforeSave",
+				"afterSave",
+				"beforeDelete",
+				"afterDelete"
+			].filter((k) => typeof cb[k] === "function");
+			if (dataCallbacks.length > 0) logger.warn(`[Auth] The auth collection "${safeAuthConfig.collection.slug}" defines ${dataCallbacks.join("/")} callback(s), but these do NOT fire when users are created or updated through the auth system (registration, admin, OAuth) — that path bypasses the collection save pipeline. Use auth hooks (afterUserCreate, beforeUserCreate, afterUserDelete, …) for those side effects.`);
+		}
 		safeAuthConfig.collection && safeAuthConfig.collection.auth;
 		if (safeAuthConfig.jwtSecret) configureJwt({
 			secret: safeAuthConfig.jwtSecret,
@@ -17486,33 +17115,6 @@ async function _initializeRebaseBackend(config) {
 		}
 		logger.info("Entity history initialized");
 	} else logger.warn("History requested but default bootstrapper does not support initializeHistory");
-	const internalServiceKey = serviceKey || randomBytes(48).toString("base64");
-	if (!serviceKey) logger.info("No REBASE_SERVICE_KEY configured. Generated internal per-boot key for singleton control-plane APIs.");
-	if (authAdapter && !authAdapter.serviceKey) authAdapter.serviceKey = internalServiceKey;
-	let apiKeyStore;
-	const apiKeyStoreResult = createApiKeyStore(defaultDriver);
-	if (apiKeyStoreResult) {
-		apiKeyStore = apiKeyStoreResult;
-		await apiKeyStore.ensureTable();
-		logger.info("Service API Keys initialized");
-	}
-	const apiKeyPreAuth = apiKeyStore ? createApiKeyPreAuth({
-		store: apiKeyStore,
-		driver: defaultDriver
-	}) : void 0;
-	if (apiKeyPreAuth) config.app.use(`${basePath}/admin/*`, apiKeyPreAuth);
-	if (apiKeyStore) {
-		const apiKeyRoutes = createApiKeyRoutes({
-			store: apiKeyStore,
-			serviceKey: internalServiceKey
-		});
-		config.app.route(`${basePath}/admin/api-keys`, apiKeyRoutes);
-		logger.info("API key admin routes mounted", { path: `${basePath}/admin/api-keys` });
-	}
-	const rateLimitConfig = config.rateLimit?.enabled !== false ? {
-		...config.rateLimit,
-		store: config.rateLimit?.store ?? new MemoryRateLimitStore(config.rateLimit?.windowMs ?? 900 * 1e3)
-	} : void 0;
 	const { storageRegistry, storageController } = await initializeStorage(config.storage, isProduction);
 	if (config.auth) {
 		config.app.get(`${basePath}/auth/config`, async (c) => {
@@ -17605,7 +17207,7 @@ async function _initializeRebaseBackend(config) {
 				allowUserLookup: safeAuthConfig.allowUserLookup ?? false,
 				defaultRole: safeAuthConfig.defaultRole,
 				oauthProviders,
-				serviceKey: serviceKey || internalServiceKey,
+				serviceKey,
 				authHooks: safeAuthConfig.hooks,
 				collectionAuthConfig,
 				enableMagicLink: safeAuthConfig.magicLink ?? false,
@@ -17630,31 +17232,33 @@ async function _initializeRebaseBackend(config) {
 			}
 		}
 	}
-	const adminSurfacesGated = !!authAdapter && (isAuthAdapter(config.auth) || config.auth.requireAuth !== false && !!config.auth.jwtSecret);
-	const applyAdminGate = (router, surface) => {
-		if (!adminSurfacesGated) {
-			logger.warn(`${surface} routes are mounted WITHOUT an auth gate (no auth configured, requireAuth: false, or no jwtSecret) — anyone who can reach the server can call them.`);
-			return;
-		}
-		if (apiKeyPreAuth) router.use("/*", apiKeyPreAuth);
-		router.use("/*", createRequireAuth({ serviceKey: internalServiceKey }), requireAdmin);
-	};
+	const internalServiceKey = serviceKey || randomBytes(48).toString("base64");
+	if (!serviceKey) logger.info("No REBASE_SERVICE_KEY configured. Generated internal per-boot key for singleton control-plane APIs.");
+	if (authAdapter && !authAdapter.serviceKey) authAdapter.serviceKey = internalServiceKey;
+	let apiKeyStore;
+	const apiKeyStoreResult = createApiKeyStore(defaultDriver);
+	if (apiKeyStoreResult) {
+		apiKeyStore = apiKeyStoreResult;
+		await apiKeyStore.ensureTable();
+		logger.info("Service API Keys initialized");
+		const apiKeyRoutes = createApiKeyRoutes({
+			store: apiKeyStore,
+			serviceKey: internalServiceKey
+		});
+		config.app.route(`${basePath}/admin/api-keys`, apiKeyRoutes);
+		logger.info("API key admin routes mounted", { path: `${basePath}/admin/api-keys` });
+	}
 	const schemaEditorEnabled = config.schemaEditor ?? (!!config.collectionsDir && process.env.NODE_ENV !== "production" && mode === "cms");
 	if (schemaEditorEnabled && !config.collectionsDir) logger.warn("schemaEditor is enabled but no collectionsDir is set — the schema editor has nowhere to write. Skipping.");
 	if (schemaEditorEnabled && config.collectionsDir) {
-		let editorModule;
-		try {
-			editorModule = await import("./schema-editor-routes-D3ef8zu1.js");
-		} catch (err) {
-			if (err?.code === "ERR_MODULE_NOT_FOUND") logger.warn("Schema Editor disabled: its dependency ts-morph is not installed. Run `npm install ts-morph@28.0.0` to enable it.");
-			else throw err;
-		}
-		if (editorModule) {
-			const schemaEditorRoutes = editorModule.createSchemaEditorRoutes(config.collectionsDir);
-			applyAdminGate(schemaEditorRoutes, "Schema editor");
-			config.app.route(`${basePath}/schema-editor`, schemaEditorRoutes);
-			logger.info("Schema Editor mounted", { path: `${basePath}/schema-editor` });
-		}
+		const { createSchemaEditorRoutes } = await import("./schema-editor-routes-D3ef8zu1.js");
+		const schemaEditorRoutes = createSchemaEditorRoutes(config.collectionsDir);
+		if (authAdapter && !isAuthAdapter(config.auth)) {
+			const safeAuth = config.auth;
+			if (safeAuth.requireAuth !== false && !!safeAuth.jwtSecret) schemaEditorRoutes.use("/*", requireAuth, requireAdmin);
+		} else if (authAdapter) schemaEditorRoutes.use("/*", requireAuth, requireAdmin);
+		config.app.route(`${basePath}/schema-editor`, schemaEditorRoutes);
+		logger.info("Schema Editor mounted", { path: `${basePath}/schema-editor` });
 	}
 	if (storageController) {
 		const storageMaxSize = (config.storage && typeof config.storage === "object" && "type" in config.storage ? config.storage.maxFileSize : void 0) ?? 50 * 1024 * 1024;
@@ -17665,9 +17269,7 @@ async function _initializeRebaseBackend(config) {
 			requireAuth: resolveRequireAuth(config.auth),
 			authAdapter
 		});
-		const storageRouter = new Hono();
-		if (apiKeyPreAuth) storageRouter.use("/*", apiKeyPreAuth, createStorageApiKeyGuard());
-		storageRouter.use("/upload", bodyLimit({
+		storageRoutes.use("/upload", bodyLimit({
 			maxSize: storageMaxSize,
 			onError: (c) => {
 				return c.json({ error: {
@@ -17676,8 +17278,7 @@ async function _initializeRebaseBackend(config) {
 				} }, 413);
 			}
 		}));
-		storageRouter.route("/", storageRoutes);
-		config.app.route(`${basePath}/storage`, storageRouter);
+		config.app.route(`${basePath}/storage`, storageRoutes);
 	}
 	if (activeCollections.length > 0) {
 		const dataRouter = new Hono();
@@ -17706,7 +17307,7 @@ async function _initializeRebaseBackend(config) {
 			serviceKey: internalServiceKey,
 			apiKeyStore
 		}));
-		if (rateLimitConfig) dataRouter.use("/*", createDataRateLimiter(rateLimitConfig));
+		if (apiKeyStore) dataRouter.use("/*", createApiKeyRateLimiter());
 		if (historyConfigResult && historyConfigResult.historyService) {
 			const historyRoutes = createHistoryRoutes({
 				historyService: historyConfigResult.historyService,
@@ -17799,11 +17400,6 @@ async function _initializeRebaseBackend(config) {
 				serviceKey: internalServiceKey,
 				apiKeyStore
 			}));
-			functionsRouter.use("/*", createFunctionApiKeyGuard(`${basePath}/functions`));
-			if (rateLimitConfig) functionsRouter.use("/*", createDataRateLimiter({
-				...rateLimitConfig,
-				anonymous: null
-			}));
 			const fnRoutes = createFunctionRoutes(loadedFunctions);
 			functionsRouter.route("/", fnRoutes);
 			config.app.route(`${basePath}/functions`, functionsRouter);
@@ -17830,7 +17426,10 @@ async function _initializeRebaseBackend(config) {
 				cronScheduler.setStore(store);
 			}
 			const cronRouter = new Hono();
-			applyAdminGate(cronRouter, "Cron");
+			if (authAdapter && !isAuthAdapter(config.auth)) {
+				const safeAuth = config.auth;
+				if (safeAuth.requireAuth !== false && !!safeAuth.jwtSecret) cronRouter.use("/*", requireAuth, requireAdmin);
+			} else if (authAdapter) cronRouter.use("/*", requireAuth, requireAdmin);
 			cronRouter.route("/", createCronRoutes(cronScheduler));
 			config.app.route(`${basePath}/cron`, cronRouter);
 			cronScheduler.start();
@@ -17843,7 +17442,10 @@ async function _initializeRebaseBackend(config) {
 	{
 		const { createBackupRoutes, parseBackupDestination } = await Promise.resolve().then(() => backup_exports);
 		const backupRouter = new Hono();
-		applyAdminGate(backupRouter, "Backup");
+		if (authAdapter && !isAuthAdapter(config.auth)) {
+			const safeAuth = config.auth;
+			if (safeAuth.requireAuth !== false && !!safeAuth.jwtSecret) backupRouter.use("/*", requireAuth, requireAdmin);
+		} else if (authAdapter) backupRouter.use("/*", requireAuth, requireAdmin);
 		backupRouter.route("/", createBackupRoutes({
 			getDestination: () => {
 				const out = process.env.BACKUP_DESTINATION?.trim();
@@ -17857,7 +17459,10 @@ async function _initializeRebaseBackend(config) {
 	{
 		const { default: logsRoutes } = await Promise.resolve().then(() => logs_routes_exports);
 		const logsRouter = new Hono();
-		applyAdminGate(logsRouter, "Logs");
+		if (authAdapter && !isAuthAdapter(config.auth)) {
+			const safeAuth = config.auth;
+			if (safeAuth.requireAuth !== false && !!safeAuth.jwtSecret) logsRouter.use("/*", requireAuth, requireAdmin);
+		} else if (authAdapter) logsRouter.use("/*", requireAuth, requireAdmin);
 		logsRouter.route("/", logsRoutes);
 		config.app.route(`${basePath}/logs`, logsRouter);
 		logger.info("Logs routes mounted", { path: `${basePath}/logs` });
@@ -19169,11 +18774,7 @@ function writeStateFile(projectRoot, port, serviceKey) {
 			startedAt: (/* @__PURE__ */ new Date()).toISOString()
 		};
 		if (serviceKey) state.serviceKey = serviceKey;
-		fs.writeFileSync(stateFile, JSON.stringify(state, null, 2), {
-			encoding: "utf-8",
-			mode: 384
-		});
-		fs.chmodSync(stateFile, 384);
+		fs.writeFileSync(stateFile, JSON.stringify(state, null, 2), "utf-8");
 	} catch {}
 }
 //#endregion