@rebasepro/server 0.9.1-canary.f2f61da → 0.9.1-canary.ff338b5

package/dist/index.es.js

@@ -3305,7 +3305,7 @@ var BackendCollectionRegistry = class extends CollectionRegistry {
 //#endregion
 //#region src/collections/loader.ts
 function isCollectionFile(file) {
-	return (file.endsWith(".ts") || file.endsWith(".js")) && !file.includes(".test.") && !file.endsWith(".d.ts") && file !== "index.ts" && file !== "index.js";
+	return (file.endsWith(".ts") || file.endsWith(".js")) && !file.startsWith(".") && !file.includes(".test.") && !file.endsWith(".d.ts") && file !== "index.ts" && file !== "index.js";
 }
 async function importModule(filePath) {
 	return await import(pathToFileURL(filePath).href);
@@ -11623,11 +11623,21 @@ var LocalStorageController = class {
 		}
 	}
 	/**
-	* Get the full filesystem path for a storage path.
-	* Includes a path traversal guard to prevent escaping the base directory.
+	* Get the full filesystem path for a storage path, with a traversal guard
+	* that keeps the result inside the bucket directory.
+	*
+	* Defaults the bucket the way `putObject` does.
+	*
+	* `putObject` has always written into `default` when given no bucket, while
+	* the read side resolved a bare key against the storage root — where
+	* nothing is. The two disagreed silently: `getObject` returned null (reads
+	* as "file missing"), `deleteObject` deleted nothing (404s are swallowed by
+	* design), and `listObjects` returned an empty page. So the obvious
+	* `putObject({ key })` → `getObject(key)` did not round-trip and nothing
+	* said why. One default, applied everywhere, removes the whole class.
 	*/
 	getFullPath(storagePath, bucket) {
-		const bucketPath = bucket ? path$1.join(this.basePath, bucket) : this.basePath;
+		const bucketPath = path$1.join(this.basePath, bucket ?? "default");
 		const resolved = path$1.resolve(path$1.join(bucketPath, storagePath));
 		if (!resolved.startsWith(bucketPath + path$1.sep) && resolved !== bucketPath) throw new Error("Path traversal detected: resolved storage path is outside the bucket directory.");
 		return resolved;
@@ -11788,8 +11798,10 @@ var LocalStorageController = class {
 			let count = 0;
 			const maxResults = options?.maxResults ?? 1e3;
 			const startIndex = options?.pageToken ? parseInt(options.pageToken, 10) : 0;
+			let scanned = startIndex;
 			for (let i = startIndex; i < entries.length && count < maxResults; i++) {
 				const entry = entries[i];
+				scanned = i + 1;
 				if (entry.name.endsWith(".metadata.json")) continue;
 				const entryPath = prefix ? `${prefix}/${entry.name}` : entry.name;
 				const bucket = options?.bucket ?? "default";
@@ -11808,7 +11820,7 @@ var LocalStorageController = class {
 			return {
 				items,
 				prefixes,
-				nextPageToken: startIndex + count < entries.length ? String(startIndex + count) : void 0
+				nextPageToken: scanned < entries.length ? String(scanned) : void 0
 			};
 		} catch (error) {
 			const code = error?.code;
@@ -13759,12 +13771,14 @@ var UPLOAD_EXPIRY_MS = 1440 * 60 * 1e3;
 var TusHandler = class {
 	storageController;
 	storageRegistry;
+	authorizeUpload;
 	uploads = /* @__PURE__ */ new Map();
 	tusDir;
 	cleanupTimer;
-	constructor(storageBaseDir, storageController, storageRegistry) {
+	constructor(storageBaseDir, storageController, storageRegistry, authorizeUpload) {
 		this.storageController = storageController;
 		this.storageRegistry = storageRegistry;
+		this.authorizeUpload = authorizeUpload;
 		this.tusDir = join(storageBaseDir, ".tus-uploads");
 	}
 	/** Ensure the temp directory exists. */
@@ -13828,6 +13842,10 @@ var TusHandler = class {
 		if (Number.isNaN(uploadLength) || uploadLength <= 0) throw ApiError.badRequest("Invalid Upload-Length");
 		if (uploadLength > MAX_UPLOAD_SIZE) throw new ApiError(413, "PAYLOAD_TOO_LARGE", `Upload-Length exceeds maximum of ${MAX_UPLOAD_SIZE} bytes`);
 		const metadata = this.parseMetadata(c.req.header("Upload-Metadata") || "");
+		if (this.authorizeUpload) {
+			const key = metadata.key || metadata.filename || "";
+			await this.authorizeUpload(c, key, metadata.bucket || "default");
+		}
 		const id = randomUUID$1();
 		const filePath = join(this.tusDir, id);
 		await writeFile(filePath, Buffer.alloc(0));
@@ -14035,7 +14053,34 @@ function buildAdapterAuthMiddleware(adapter, requireAuth, publicRead) {
 function createStorageRoutes(config) {
 	const router = new Hono();
 	router.onError(errorHandler);
-	const { controller, registry, sources: declaredSources, requireAuth: requireAuth$1 = true, publicRead = false, authAdapter } = config;
+	const { controller, registry, sources: declaredSources, requireAuth: requireAuth$1 = true, publicRead = false, authAdapter, authorize } = config;
+	/**
+	* Run the per-object authorization hook, if one is configured.
+	*
+	* Denials are 403 rather than 404: the route already established that the
+	* caller is authenticated, so hiding existence buys nothing, and a
+	* distinguishable status is what makes a misconfigured policy debuggable.
+	* A hook that throws denies too — an ownership lookup that fails must not
+	* fall open.
+	*/
+	const checkAuthorized = async (c, operation, key, bucket, storageId) => {
+		if (!authorize) return;
+		const user = c.get("user") ?? null;
+		if (user?.userId === "download-token" || user?.userId === "public") return;
+		let allowed;
+		try {
+			allowed = await authorize({
+				key,
+				bucket,
+				operation,
+				user,
+				storageId: storageId ?? void 0
+			});
+		} catch {
+			allowed = false;
+		}
+		if (!allowed) throw ApiError.forbidden("Not authorized for this object");
+	};
 	/**
 	* Resolve the storage controller for a request.
 	* Looks up by `storageId` in the registry, falls back to the single
@@ -14085,6 +14130,7 @@ function createStorageRoutes(config) {
 		const finalKey = sanitizeStorageKey(key || uploadedFile.name || "unnamed");
 		const metadata = {};
 		for (const [k, value] of Object.entries(body)) if (k.startsWith("metadata_")) metadata[k.replace("metadata_", "")] = value;
+		await checkAuthorized(c, "write", finalKey, bucket ?? "default", storageId);
 		const result = await resolveController(storageId).putObject({
 			file: uploadedFile,
 			key: finalKey,
@@ -14105,7 +14151,12 @@ function createStorageRoutes(config) {
 		const rawPath = extractWildcardPath(c);
 		if (!rawPath) throw ApiError.notFound("File not found");
 		const filePath = decodeURIComponent(rawPath);
-		const resolved = resolveController(c.req.query("storageId"));
+		const storageId = c.req.query("storageId");
+		const resolved = resolveController(storageId);
+		{
+			const { bucket, resolvedPath } = parseBucketAndPath(filePath);
+			await checkAuthorized(c, "read", resolvedPath, bucket, storageId);
+		}
 		const transformOpts = parseTransformOptions(c.req.query());
 		if (resolved.getType() === "local") {
 			const localController = resolved;
@@ -14168,8 +14219,10 @@ function createStorageRoutes(config) {
 			fileNotFound: true
 		}, 404);
 		const filePath = decodeURIComponent(rawPath);
-		const resolved = resolveController(c.req.query("storageId"));
+		const storageId = c.req.query("storageId");
+		const resolved = resolveController(storageId);
 		const { bucket, resolvedPath } = parseBucketAndPath(filePath);
+		await checkAuthorized(c, "read", resolvedPath, bucket, storageId);
 		const downloadConfig = await resolved.getSignedUrl(resolvedPath, bucket);
 		if (downloadConfig.fileNotFound) throw ApiError.notFound("File not found");
 		if (downloadConfig.metadata) {
@@ -14195,8 +14248,10 @@ function createStorageRoutes(config) {
 			message: "No file to delete"
 		});
 		const filePath = decodeURIComponent(rawPath);
-		const resolved = resolveController(c.req.query("storageId"));
+		const storageId = c.req.query("storageId");
+		const resolved = resolveController(storageId);
 		const { bucket, resolvedPath } = parseBucketAndPath(filePath);
+		await checkAuthorized(c, "delete", resolvedPath, bucket, storageId);
 		await resolved.deleteObject(resolvedPath, bucket);
 		return c.json({
 			success: true,
@@ -14211,7 +14266,9 @@ function createStorageRoutes(config) {
 		const bucket = c.req.query("bucket");
 		const maxResults = c.req.query("maxResults");
 		const pageToken = c.req.query("pageToken");
-		const resolved = resolveController(c.req.query("storageId"));
+		const storageId = c.req.query("storageId");
+		const resolved = resolveController(storageId);
+		await checkAuthorized(c, "list", storagePrefix, bucket ?? "default", storageId);
 		const result = await resolved.listObjects(storagePrefix, {
 			bucket: bucket ?? (resolved.getType() === "local" ? "default" : void 0),
 			maxResults: maxResults ? parseInt(maxResults, 10) : void 0,
@@ -14234,6 +14291,7 @@ function createStorageRoutes(config) {
 		const resolved = resolveController(storageId);
 		const { bucket, resolvedPath } = parseBucketAndPath(folderPath);
 		if (!resolvedPath || resolvedPath.trim() === "") throw ApiError.badRequest("Invalid folder path");
+		await checkAuthorized(c, "write", resolvedPath, bucket, storageId);
 		if (resolved.getType() === "local") {
 			const absolutePath = resolved.getAbsolutePath(resolvedPath, bucket);
 			fs$1.mkdirSync(absolutePath, { recursive: true });
@@ -14251,7 +14309,9 @@ function createStorageRoutes(config) {
 		}, 201);
 	});
 	const defaultCtrl = getDefaultController();
-	const tusHandler = new TusHandler(defaultCtrl.getType() === "local" ? defaultCtrl.getBasePath() : process.env.STORAGE_PATH || "./uploads", defaultCtrl, registry);
+	const tusHandler = new TusHandler(defaultCtrl.getType() === "local" ? defaultCtrl.getBasePath() : process.env.STORAGE_PATH || "./uploads", defaultCtrl, registry, authorize ? async (c, key, bucket) => {
+		await checkAuthorized(c, "write", sanitizeStorageKey(key), bucket, c.req.query("storageId"));
+	} : void 0);
 	tusHandler.startCleanup();
 	router.options("/tus", (_c) => tusHandler.options());
 	router.post("/tus", writeAuthMiddleware, async (c) => tusHandler.create(c));
@@ -14392,7 +14452,7 @@ async function initializeStorage(storageConfig, isProduction) {
 	const toController = async (entry, label) => {
 		if (typeof entry.putObject === "function") return entry;
 		const conf = entry;
-		if (isProduction && conf.type === "local") logger.warn(`Storage backend "${label}" uses local filesystem in production. Files will be lost on container restart. Configure S3-compatible storage or a custom StorageController.`);
+		if (isProduction && conf.type === "local" && !process.env.FORCE_LOCAL_STORAGE) throw new Error(`Storage backend "${label}" is set to "local" in production. Local storage is the container filesystem, so uploaded files are destroyed on the next restart or redeploy. Configure S3-compatible storage (STORAGE_TYPE=s3) or GCS (STORAGE_TYPE=gcs), or pass a custom StorageController. If this deployment really does have a durable volume mounted at the storage path, set FORCE_LOCAL_STORAGE=true to proceed.`);
 		return await createStorageController(conf);
 	};
 	if (typeof storageConfig === "object" && ("type" in storageConfig || typeof storageConfig.putObject === "function")) controllers[DEFAULT_STORAGE_ID] = await toController(storageConfig, DEFAULT_STORAGE_ID);
@@ -15933,12 +15993,28 @@ var ClientStorageSourceRegistry = class ClientStorageSourceRegistry {
 function extractMessageError(message) {
 	const payload = message.payload;
 	const errPayload = payload?.error;
+	const errorMessage = typeof errPayload === "object" ? errPayload.message : payload?.message || (typeof errPayload === "string" ? errPayload : void 0) || message.error || "Unknown error";
+	const errorCode = typeof errPayload === "object" ? errPayload.code : payload?.code;
 	return {
-		errorMessage: typeof errPayload === "object" ? errPayload.message : payload?.message || (typeof errPayload === "string" ? errPayload : void 0) || message.error || "Unknown error",
-		errorCode: typeof errPayload === "object" ? errPayload.code : payload?.code
+		errorMessage: typeof errorMessage === "string" ? errorMessage : errorMessage == null ? "Unknown error" : JSON.stringify(errorMessage),
+		errorCode
 	};
 }
 /**
+* Broadcast and presence frames.
+*
+* Fire-and-forget (the server sends no response envelope), and exempt from the
+* client-side auth gate — a public channel is usable without an account.
+*/
+var CHANNEL_MESSAGE_TYPES = new Set([
+	"join_channel",
+	"leave_channel",
+	"broadcast",
+	"presence_track",
+	"presence_untrack",
+	"presence_state"
+]);
+/**
 * Low-level realtime WebSocket client.
 *
 * @internal Not a stable app-facing API. `createRebaseClient()` constructs and
@@ -15953,6 +16029,36 @@ var RebaseWebSocketClient = class {
 	getAuthToken;
 	subscriptions = /* @__PURE__ */ new Map();
 	listeners = /* @__PURE__ */ new Map();
+	/** Channel-name → handlers, for broadcast and presence frames. */
+	channelHandlers = /* @__PURE__ */ new Map();
+	/** Set by `close()`. Blocks any later operation from silently redialling. */
+	closedByCaller = false;
+	/**
+	* Whether a socket exists at all (open or still opening).
+	*
+	* Lets callers distinguish "authenticate the live socket" from "there is
+	* nothing to authenticate yet", without that question forcing a dial.
+	*/
+	get hasSocket() {
+		return this.ws !== null;
+	}
+	/** So the "no WebSocket in this environment" warning is said once, not per call. */
+	warnedNoWebSocket = false;
+	/** Subscribe to broadcast/presence frames for one channel. */
+	onChannelMessage(channel, handler) {
+		if (!this.channelHandlers.has(channel)) this.channelHandlers.set(channel, /* @__PURE__ */ new Set());
+		this.channelHandlers.get(channel).add(handler);
+		return () => {
+			const handlers = this.channelHandlers.get(channel);
+			if (!handlers) return;
+			handlers.delete(handler);
+			if (handlers.size === 0) this.channelHandlers.delete(channel);
+		};
+	}
+	/** Notified after the socket comes back, so channels can re-join. */
+	onReconnect(handler) {
+		return this.on("reconnect", handler);
+	}
 	on(event, cb) {
 		if (!this.listeners.has(event)) this.listeners.set(event, /* @__PURE__ */ new Set());
 		this.listeners.get(event).add(cb);
@@ -15971,6 +16077,7 @@ var RebaseWebSocketClient = class {
 	isConnected = false;
 	messageQueue = [];
 	requestTimeoutMs = 3e4;
+	subscriptionTimeoutMs = 3e4;
 	reconnectTimeout = null;
 	isAuthenticated = false;
 	authPromise = null;
@@ -15982,8 +16089,25 @@ var RebaseWebSocketClient = class {
 		this.getAuthToken = config.getAuthToken;
 		this.onUnauthorized = config.onUnauthorized;
 		this.WebSocketConstructor = config.WebSocket || (typeof WebSocket !== "undefined" ? WebSocket : void 0);
-		if (!this.WebSocketConstructor) console.warn("WebSocket is not defined in this environment. Realtime subscriptions will not work unless you provide a WebSocket implementation in the config.");
-		else this.initWebSocket();
+	}
+	/**
+	* Open the socket if it is not open (or opening) already.
+	*
+	* Idempotent, synchronous, and safe to call on every operation that needs a
+	* live socket — `initWebSocket` already no-ops on an open socket and is
+	* re-entrant, since the reconnect path has always called it.
+	*/
+	ensureConnected() {
+		if (this.closedByCaller) return;
+		if (!this.WebSocketConstructor) {
+			if (!this.warnedNoWebSocket) {
+				this.warnedNoWebSocket = true;
+				console.warn("WebSocket is not defined in this environment. Realtime subscriptions will not work unless you provide a WebSocket implementation in the config.");
+			}
+			return;
+		}
+		if (this.ws || this.reconnectTimeout) return;
+		this.initWebSocket();
 	}
 	/**
 	* Authenticate the WebSocket connection
@@ -16033,7 +16157,16 @@ var RebaseWebSocketClient = class {
 			});
 		}
 	}
-	disconnect() {
+	/**
+	* Drop the socket.
+	*
+	* `permanent` distinguishes the two callers. Signing out drops the socket
+	* but the client stays usable — a later subscribe should reconnect
+	* anonymously. `client.close()` is the caller saying they are done, and
+	* must not be undone by a stray queued frame.
+	*/
+	disconnect(permanent = false) {
+		if (permanent) this.closedByCaller = true;
 		this.isAuthenticated = false;
 		this.authPromise = null;
 		if (this.reconnectTimeout) {
@@ -16076,6 +16209,7 @@ var RebaseWebSocketClient = class {
 				this.emit(wasReconnect ? "reconnect" : "connect");
 				this.processMessageQueue();
 				if (wasReconnect) this.resubscribeAll();
+				this.armPendingSubscribeWatchdogs();
 			};
 			this.ws.onmessage = (event) => {
 				try {
@@ -16090,6 +16224,7 @@ var RebaseWebSocketClient = class {
 				this.isConnected = false;
 				this.isAuthenticated = false;
 				this.authPromise = null;
+				this.suspendSubscribeWatchdogs();
 				this.emit("disconnect");
 				for (const [reqId, request] of this.pendingRequests.entries()) {
 					if (reqId.startsWith("auth_")) request.reject(/* @__PURE__ */ new Error("Connection closed during authentication"));
@@ -16121,6 +16256,7 @@ var RebaseWebSocketClient = class {
 	attemptReconnect() {
 		if (this.reconnectAttempts >= this.maxReconnectAttempts) {
 			console.error("Max reconnection attempts reached");
+			this.failAllPendingSubscriptions(new RebaseApiError("Connection lost", { code: "CONNECTION_LOST" }));
 			return;
 		}
 		this.reconnectAttempts++;
@@ -16175,29 +16311,18 @@ var RebaseWebSocketClient = class {
 				subscription.backendSubscriptionId = newBackendId;
 				backendKeyMap.delete(oldBackendId);
 				backendKeyMap.set(newBackendId, subscriptionKey);
-				this.sendMessage({
-					type: messageType,
-					payload: {
-						...subscription.props,
-						subscriptionId: newBackendId
-					}
-				}).catch((error) => {
-					console.error(`[WS] Failed to re-subscribe ${idPrefix} after auth refresh:`, subscriptionKey, error);
-					subscription.callbacks.forEach((callback) => {
-						if (callback.onError) callback.onError(error);
-					});
-				});
-			} else {
-				const { errorMessage, errorCode } = extractMessageError(message);
-				const error = new RebaseApiError(errorMessage, { code: errorCode });
-				subscription.callbacks.forEach((callback) => {
-					if (callback.onError) callback.onError(error);
-				});
+				if (messageType === "subscribe_collection") this.sendCollectionSubscribe(subscriptionKey);
+				else this.sendEntitySubscribe(subscriptionKey);
+				return;
 			}
+			const { errorMessage, errorCode } = extractMessageError(message);
+			const error = new RebaseApiError(errorMessage, { code: errorCode });
+			if (messageType === "subscribe_collection") this.failCollectionSubscription(subscriptionKey, error);
+			else this.failEntitySubscription(subscriptionKey, error);
 		}).catch((err) => {
-			subscription.callbacks.forEach((callback) => {
-				if (callback.onError) callback.onError(err);
-			});
+			const error = err instanceof Error ? err : new Error(String(err));
+			if (messageType === "subscribe_collection") this.failCollectionSubscription(subscriptionKey, error);
+			else this.failEntitySubscription(subscriptionKey, error);
 		});
 	}
 	handleWebSocketMessage(message) {
@@ -16226,6 +16351,15 @@ var RebaseWebSocketClient = class {
 			}
 			return;
 		}
+		if (typeof message.channel === "string" && (type === "broadcast" || type === "presence_state" || type === "presence_diff")) {
+			const handlers = this.channelHandlers.get(message.channel);
+			if (handlers) for (const handler of [...handlers]) try {
+				handler(message);
+			} catch (error) {
+				console.error("Error in channel handler:", error);
+			}
+			return;
+		}
 		if (subscriptionId && type === "collection_update") {
 			const subscriptionKey = this.backendToCollectionKey.get(subscriptionId);
 			if (subscriptionKey) {
@@ -16238,6 +16372,9 @@ var RebaseWebSocketClient = class {
 					collectionSub.latestData = rows;
 					collectionSub.lastUpdated = Date.now();
 					collectionSub.isInitialDataReceived = true;
+					if (collectionSub.subscribeTimeout) clearTimeout(collectionSub.subscribeTimeout);
+					collectionSub.subscribeTimeout = void 0;
+					collectionSub.subscribeInFlight = false;
 					collectionSub.callbacks.forEach((callback) => {
 						try {
 							callback.onUpdate(rows);
@@ -16293,6 +16430,9 @@ var RebaseWebSocketClient = class {
 					entitySub.latestData = row;
 					entitySub.lastUpdated = Date.now();
 					entitySub.isInitialDataReceived = true;
+					if (entitySub.subscribeTimeout) clearTimeout(entitySub.subscribeTimeout);
+					entitySub.subscribeTimeout = void 0;
+					entitySub.subscribeInFlight = false;
 					entitySub.callbacks.forEach((callback) => {
 						try {
 							callback.onUpdate(row);
@@ -16314,6 +16454,9 @@ var RebaseWebSocketClient = class {
 						this.resubscribeAfterAuthRefresh(message, collectionSub, collectionKey, "collection", this.backendToCollectionKey, "subscribe_collection");
 						return;
 					}
+					if (collectionSub.subscribeTimeout) clearTimeout(collectionSub.subscribeTimeout);
+					collectionSub.subscribeTimeout = void 0;
+					collectionSub.subscribeInFlight = false;
 					const { errorMessage, errorCode } = extractMessageError(message);
 					const error = new RebaseApiError(errorMessage, { code: errorCode });
 					collectionSub.callbacks.forEach((callback) => {
@@ -16330,6 +16473,9 @@ var RebaseWebSocketClient = class {
 						this.resubscribeAfterAuthRefresh(message, entitySub, entityKey, "row", this.backendToEntityKey, "subscribe_one");
 						return;
 					}
+					if (entitySub.subscribeTimeout) clearTimeout(entitySub.subscribeTimeout);
+					entitySub.subscribeTimeout = void 0;
+					entitySub.subscribeInFlight = false;
 					const { errorMessage, errorCode } = extractMessageError(message);
 					const error = new RebaseApiError(errorMessage, { code: errorCode });
 					entitySub.callbacks.forEach((callback) => {
@@ -16402,21 +16548,28 @@ var RebaseWebSocketClient = class {
 			throw error;
 		}
 	}
+	/**
+	* Public because `RebaseRealtimeChannel` sends channel frames through it.
+	* Not part of the stable surface — prefer `client.realtime.channel(name)`.
+	*/
 	sendMessage(message) {
 		const queuedMsg = message;
 		if (queuedMsg._queuedResolve && queuedMsg._queuedReject) return this.doSendMessage(message, queuedMsg._queuedResolve, queuedMsg._queuedReject);
-		if (!this.isConnected || !this.ws) return new Promise((resolve, reject) => {
-			const queueable = message;
-			queueable._queuedResolve = resolve;
-			queueable._queuedReject = reject;
-			this.messageQueue.push(message);
-		});
+		if (!this.isConnected || !this.ws) {
+			this.ensureConnected();
+			return new Promise((resolve, reject) => {
+				const queueable = message;
+				queueable._queuedResolve = resolve;
+				queueable._queuedReject = reject;
+				this.messageQueue.push(message);
+			});
+		}
 		return new Promise((resolve, reject) => {
 			this.doSendMessage(message, resolve, reject);
 		});
 	}
 	async doSendMessage(message, resolve, reject) {
-		if (message.type !== "AUTHENTICATE" && this.getAuthToken && !this.isAuthenticated) try {
+		if (message.type !== "AUTHENTICATE" && !CHANNEL_MESSAGE_TYPES.has(message.type) && this.getAuthToken && !this.isAuthenticated) try {
 			await this.ensureAuthenticated();
 		} catch (error) {
 			reject(new RebaseApiError(error instanceof Error ? error.message : "Authentication required"));
@@ -16424,17 +16577,7 @@ var RebaseWebSocketClient = class {
 		}
 		const requestId = message.requestId || `req_${Date.now()}_${Math.random().toString(36).substring(2, 9)}`;
 		message.requestId = requestId;
-		const expectsResponse = ![
-			"subscribe_collection",
-			"subscribe_one",
-			"unsubscribe",
-			"join_channel",
-			"leave_channel",
-			"broadcast",
-			"presence_track",
-			"presence_untrack",
-			"presence_state"
-		].includes(message.type);
+		const expectsResponse = !(message.type === "subscribe_collection" || message.type === "subscribe_one" || message.type === "unsubscribe" || CHANNEL_MESSAGE_TYPES.has(message.type));
 		if (expectsResponse && !this.pendingRequests.has(requestId)) {
 			const timeoutHandle = setTimeout(() => {
 				if (this.pendingRequests.has(requestId)) {
@@ -16663,6 +16806,7 @@ var RebaseWebSocketClient = class {
 		});
 	}
 	listenCollection(props, onUpdate, onError) {
+		this.ensureConnected();
 		const subscriptionKey = this.createCollectionSubscriptionKey(props);
 		const callbackId = `callback_${Date.now()}_${Math.random().toString(36).substring(2, 9)}`;
 		const existingSubscription = this.collectionSubscriptions.get(subscriptionKey);
@@ -16678,9 +16822,12 @@ var RebaseWebSocketClient = class {
 				console.error("Error in collection subscription callback:", error);
 				if (onError) onError(error instanceof Error ? error : new Error(String(error)));
 			}
+			else if (!existingSubscription.subscribeInFlight) this.sendCollectionSubscribe(subscriptionKey);
 			return () => {
 				callbackMap.delete(callbackId);
 				if (callbackMap.size === 0) {
+					if (this.collectionSubscriptions.get(subscriptionKey) !== existingSubscription) return;
+					if (existingSubscription.subscribeTimeout) clearTimeout(existingSubscription.subscribeTimeout);
 					this.collectionSubscriptions.delete(subscriptionKey);
 					this.backendToCollectionKey.delete(existingSubscription.backendSubscriptionId);
 					if (this.isConnected && this.ws) this.sendMessage({
@@ -16702,21 +16849,14 @@ var RebaseWebSocketClient = class {
 			props
 		});
 		this.backendToCollectionKey.set(backendSubscriptionId, subscriptionKey);
-		this.sendMessage({
-			type: "subscribe_collection",
-			payload: {
-				...props,
-				subscriptionId: backendSubscriptionId
-			}
-		}).catch((error) => {
-			if (onError) onError(error);
-		});
+		this.sendCollectionSubscribe(subscriptionKey);
 		return () => {
 			const subscription = this.collectionSubscriptions.get(subscriptionKey);
 			if (subscription) {
 				const callbacks = subscription.callbacks;
 				callbacks.delete(callbackId);
 				if (callbacks.size === 0) {
+					if (subscription.subscribeTimeout) clearTimeout(subscription.subscribeTimeout);
 					this.collectionSubscriptions.delete(subscriptionKey);
 					this.backendToCollectionKey.delete(subscription.backendSubscriptionId);
 					if (this.isConnected && this.ws) this.sendMessage({
@@ -16728,6 +16868,7 @@ var RebaseWebSocketClient = class {
 		};
 	}
 	listenOne(props, onUpdate, onError) {
+		this.ensureConnected();
 		const subscriptionKey = this.createSingleSubscriptionKey(props);
 		const callbackId = `callback_${Date.now()}_${Math.random().toString(36).substring(2, 9)}`;
 		const existingSubscription = this.singleSubscriptions.get(subscriptionKey);
@@ -16743,9 +16884,12 @@ var RebaseWebSocketClient = class {
 				console.error("Error in row subscription callback:", error);
 				if (onError) onError(error instanceof Error ? error : new Error(String(error)));
 			}
+			else if (!existingSubscription.subscribeInFlight) this.sendEntitySubscribe(subscriptionKey);
 			return () => {
 				callbackMap.delete(callbackId);
 				if (callbackMap.size === 0) {
+					if (this.singleSubscriptions.get(subscriptionKey) !== existingSubscription) return;
+					if (existingSubscription.subscribeTimeout) clearTimeout(existingSubscription.subscribeTimeout);
 					this.singleSubscriptions.delete(subscriptionKey);
 					this.backendToEntityKey.delete(existingSubscription.backendSubscriptionId);
 					if (this.isConnected && this.ws) this.sendMessage({
@@ -16767,15 +16911,7 @@ var RebaseWebSocketClient = class {
 			props
 		});
 		this.backendToEntityKey.set(backendSubscriptionId, subscriptionKey);
-		this.sendMessage({
-			type: "subscribe_one",
-			payload: {
-				...props,
-				subscriptionId: backendSubscriptionId
-			}
-		}).catch((error) => {
-			if (onError) onError(error);
-		});
+		this.sendEntitySubscribe(subscriptionKey);
 		return () => {
 			const subscription = this.singleSubscriptions.get(subscriptionKey);
 			if (subscription) {
@@ -16793,6 +16929,157 @@ var RebaseWebSocketClient = class {
 		};
 	}
 	/**
+	* Send a `subscribe_collection` for an already-registered subscription and
+	* arm its watchdog.
+	*
+	* Every path that registers a collection subscription goes through here, so
+	* that a subscribe which never lands — a rejected send, or a server that
+	* never answers — always ends up in `failCollectionSubscription` rather than
+	* leaving the entry parked with `isInitialDataReceived === false` forever.
+	*/
+	sendCollectionSubscribe(subscriptionKey) {
+		const subscription = this.collectionSubscriptions.get(subscriptionKey);
+		if (!subscription) return;
+		const backendSubscriptionId = subscription.backendSubscriptionId;
+		subscription.subscribeInFlight = true;
+		if (subscription.subscribeTimeout) clearTimeout(subscription.subscribeTimeout);
+		subscription.subscribeTimeout = void 0;
+		if (this.isConnected) this.sendCollectionSubscribeWatchdog(subscriptionKey);
+		this.sendMessage({
+			type: "subscribe_collection",
+			payload: {
+				...subscription.props,
+				subscriptionId: backendSubscriptionId
+			}
+		}).catch((error) => {
+			const current = this.collectionSubscriptions.get(subscriptionKey);
+			if (!current || current.backendSubscriptionId !== backendSubscriptionId) return;
+			this.failCollectionSubscription(subscriptionKey, error instanceof Error ? error : new Error(String(error)));
+		});
+	}
+	/** The `listenOne` counterpart of {@link sendCollectionSubscribe}. */
+	sendEntitySubscribe(subscriptionKey) {
+		const subscription = this.singleSubscriptions.get(subscriptionKey);
+		if (!subscription) return;
+		const backendSubscriptionId = subscription.backendSubscriptionId;
+		subscription.subscribeInFlight = true;
+		if (subscription.subscribeTimeout) clearTimeout(subscription.subscribeTimeout);
+		subscription.subscribeTimeout = void 0;
+		if (this.isConnected) this.sendEntitySubscribeWatchdog(subscriptionKey);
+		this.sendMessage({
+			type: "subscribe_one",
+			payload: {
+				...subscription.props,
+				subscriptionId: backendSubscriptionId
+			}
+		}).catch((error) => {
+			const current = this.singleSubscriptions.get(subscriptionKey);
+			if (!current || current.backendSubscriptionId !== backendSubscriptionId) return;
+			this.failEntitySubscription(subscriptionKey, error instanceof Error ? error : new Error(String(error)));
+		});
+	}
+	/**
+	* Report a subscribe failure to every listener and drop the registration.
+	*
+	* Dropping it is the point: the callbacks stay live (their components are
+	* still mounted and have been told), but the next `listenCollection` for
+	* these params finds no entry and issues a fresh subscribe instead of
+	* silently attaching to a dead one.
+	*/
+	failCollectionSubscription(subscriptionKey, error) {
+		const subscription = this.collectionSubscriptions.get(subscriptionKey);
+		if (!subscription) return;
+		if (subscription.subscribeTimeout) clearTimeout(subscription.subscribeTimeout);
+		subscription.subscribeInFlight = false;
+		this.collectionSubscriptions.delete(subscriptionKey);
+		this.backendToCollectionKey.delete(subscription.backendSubscriptionId);
+		subscription.callbacks.forEach((callback) => {
+			if (callback.onError) try {
+				callback.onError(error);
+			} catch (callbackError) {
+				console.error("Error in collection subscription error callback:", callbackError);
+			}
+		});
+	}
+	/** The `listenOne` counterpart of {@link failCollectionSubscription}. */
+	failEntitySubscription(subscriptionKey, error) {
+		const subscription = this.singleSubscriptions.get(subscriptionKey);
+		if (!subscription) return;
+		if (subscription.subscribeTimeout) clearTimeout(subscription.subscribeTimeout);
+		subscription.subscribeInFlight = false;
+		this.singleSubscriptions.delete(subscriptionKey);
+		this.backendToEntityKey.delete(subscription.backendSubscriptionId);
+		subscription.callbacks.forEach((callback) => {
+			if (callback.onError) try {
+				callback.onError(error);
+			} catch (callbackError) {
+				console.error("Error in row subscription error callback:", callbackError);
+			}
+		});
+	}
+	/**
+	* Stop the watchdogs without failing anything — used when the socket drops,
+	* since the reconnect path re-subscribes everything anyway and a watchdog
+	* firing mid-reconnect would tear down healthy subscriptions.
+	*/
+	suspendSubscribeWatchdogs() {
+		for (const sub of this.collectionSubscriptions.values()) {
+			if (sub.subscribeTimeout) clearTimeout(sub.subscribeTimeout);
+			sub.subscribeTimeout = void 0;
+			sub.subscribeInFlight = false;
+		}
+		for (const sub of this.singleSubscriptions.values()) {
+			if (sub.subscribeTimeout) clearTimeout(sub.subscribeTimeout);
+			sub.subscribeTimeout = void 0;
+			sub.subscribeInFlight = false;
+		}
+	}
+	/**
+	* Arm watchdogs for subscribes that were requested while offline and have
+	* just been flushed to the socket. Their timers were deliberately not set at
+	* request time, so without this they would have no timeout at all.
+	*/
+	armPendingSubscribeWatchdogs() {
+		for (const [key, sub] of this.collectionSubscriptions.entries()) if (sub.subscribeInFlight && !sub.subscribeTimeout) this.sendCollectionSubscribeWatchdog(key);
+		for (const [key, sub] of this.singleSubscriptions.entries()) if (sub.subscribeInFlight && !sub.subscribeTimeout) this.sendEntitySubscribeWatchdog(key);
+	}
+	sendCollectionSubscribeWatchdog(subscriptionKey) {
+		const subscription = this.collectionSubscriptions.get(subscriptionKey);
+		if (!subscription) return;
+		const backendSubscriptionId = subscription.backendSubscriptionId;
+		subscription.subscribeTimeout = setTimeout(() => {
+			const current = this.collectionSubscriptions.get(subscriptionKey);
+			if (!current || current.backendSubscriptionId !== backendSubscriptionId) return;
+			if (!current.subscribeInFlight) return;
+			this.failCollectionSubscription(subscriptionKey, new RebaseApiError("Subscription timed out", { code: "SUBSCRIPTION_TIMEOUT" }));
+		}, this.subscriptionTimeoutMs);
+	}
+	sendEntitySubscribeWatchdog(subscriptionKey) {
+		const subscription = this.singleSubscriptions.get(subscriptionKey);
+		if (!subscription) return;
+		const backendSubscriptionId = subscription.backendSubscriptionId;
+		subscription.subscribeTimeout = setTimeout(() => {
+			const current = this.singleSubscriptions.get(subscriptionKey);
+			if (!current || current.backendSubscriptionId !== backendSubscriptionId) return;
+			if (!current.subscribeInFlight) return;
+			this.failEntitySubscription(subscriptionKey, new RebaseApiError("Subscription timed out", { code: "SUBSCRIPTION_TIMEOUT" }));
+		}, this.subscriptionTimeoutMs);
+	}
+	/**
+	* Fail every subscription that never received data. Called when reconnection
+	* is given up on, so views surface an error instead of spinning forever.
+	*/
+	failAllPendingSubscriptions(error) {
+		for (const key of [...this.collectionSubscriptions.keys()]) {
+			const sub = this.collectionSubscriptions.get(key);
+			if (sub && !sub.isInitialDataReceived) this.failCollectionSubscription(key, error);
+		}
+		for (const key of [...this.singleSubscriptions.keys()]) {
+			const sub = this.singleSubscriptions.get(key);
+			if (sub && !sub.isInitialDataReceived) this.failEntitySubscription(key, error);
+		}
+	}
+	/**
 	* Re-send all active subscriptions to the backend after a reconnect.
 	* The server wipes subscription state when a client disconnects, so
 	* we need to re-register everything to resume receiving updates.
@@ -16805,15 +17092,7 @@ var RebaseWebSocketClient = class {
 			sub.backendSubscriptionId = newBackendId;
 			this.backendToCollectionKey.delete(oldBackendId);
 			this.backendToCollectionKey.set(newBackendId, key);
-			this.sendMessage({
-				type: "subscribe_collection",
-				payload: {
-					...sub.props,
-					subscriptionId: newBackendId
-				}
-			}).catch((error) => {
-				console.error("[WS] Failed to re-subscribe collection:", key, error);
-			});
+			this.sendCollectionSubscribe(key);
 		}
 		for (const [key, sub] of this.singleSubscriptions.entries()) {
 			const oldBackendId = sub.backendSubscriptionId;
@@ -16821,15 +17100,7 @@ var RebaseWebSocketClient = class {
 			sub.backendSubscriptionId = newBackendId;
 			this.backendToEntityKey.delete(oldBackendId);
 			this.backendToEntityKey.set(newBackendId, key);
-			this.sendMessage({
-				type: "subscribe_one",
-				payload: {
-					...sub.props,
-					subscriptionId: newBackendId
-				}
-			}).catch((error) => {
-				console.error("[WS] Failed to re-subscribe row:", key, error);
-			});
+			this.sendEntitySubscribe(key);
 		}
 	}
 	createCollectionSubscriptionKey(props) {
@@ -16856,6 +17127,177 @@ var RebaseWebSocketClient = class {
 	}
 };
 /**
+* Re-send presence comfortably inside the server's 30s expiry.
+*
+* Two-thirds of the window: one lost heartbeat still leaves time for the next
+* before the entry is reaped, so a single dropped frame is not a disappearance.
+*/
+var PRESENCE_HEARTBEAT_MS = 2e4;
+var RebaseRealtimeChannel = class {
+	name;
+	transport;
+	presenceHandlers = /* @__PURE__ */ new Set();
+	broadcastHandlers = /* @__PURE__ */ new Set();
+	unsubscribers = [];
+	/** Last known roster, kept so handlers always get a full picture. */
+	presences = {};
+	/** What this client last tracked, replayed on reconnect and heartbeat. */
+	trackedState = null;
+	heartbeat = null;
+	joined = false;
+	constructor(name, transport) {
+		this.name = name;
+		this.transport = transport;
+	}
+	/**
+	* Join the channel and ask for the current roster.
+	*
+	* Called automatically by `track`, `broadcast`, `onPresence` and
+	* `onBroadcast`; calling it directly is only needed to start receiving
+	* before there is anything to send.
+	*/
+	/**
+	* Send a channel message.
+	*
+	* Every channel message is read by the server out of a `payload` envelope
+	* (`payload?.channel`, `payload?.state`, `payload?.event`). Sending those
+	* fields flat does not error: `payload?.channel` simply reads as
+	* `undefined`, so the client is registered into channel `undefined` with
+	* empty state, and the echo comes back with no `channel` for
+	* `onChannelMessage` to match — presence and broadcast both go quiet with
+	* nothing logged. Funnelled through one place so a new message type cannot
+	* reintroduce that.
+	*/
+	send(type, fields = {}) {
+		return this.transport.sendMessage({
+			type,
+			payload: {
+				channel: this.name,
+				...fields
+			}
+		});
+	}
+	async join() {
+		if (this.joined) return;
+		this.joined = true;
+		this.unsubscribers.push(this.transport.onChannelMessage(this.name, (message) => this.handle(message)));
+		this.unsubscribers.push(this.transport.onReconnect(() => {
+			this.rejoin();
+		}));
+		await this.send("join_channel");
+		await this.send("presence_state");
+	}
+	async rejoin() {
+		try {
+			await this.send("join_channel");
+			await this.send("presence_state");
+			if (this.trackedState) await this.send("presence_track", { state: this.trackedState });
+		} catch {}
+	}
+	/**
+	* Publish this client's presence state, and keep publishing it.
+	*
+	* Calling `track` again replaces the state (and restarts the heartbeat),
+	* which is how you update e.g. a cursor position.
+	*/
+	async track(state) {
+		await this.join();
+		this.trackedState = state;
+		await this.send("presence_track", { state });
+		if (!this.heartbeat) {
+			this.heartbeat = setInterval(() => {
+				if (!this.trackedState) return;
+				this.send("presence_track", { state: this.trackedState }).catch(() => {});
+			}, PRESENCE_HEARTBEAT_MS);
+			this.heartbeat.unref?.();
+		}
+	}
+	/** Stop publishing presence, without leaving the channel. */
+	async untrack() {
+		this.stopHeartbeat();
+		this.trackedState = null;
+		if (this.joined) await this.send("presence_untrack");
+	}
+	/**
+	* Observe the roster. The handler fires immediately with what is already
+	* known, then on every change.
+	*/
+	onPresence(handler) {
+		this.presenceHandlers.add(handler);
+		this.join();
+		if (Object.keys(this.presences).length > 0) handler({ ...this.presences });
+		return () => this.presenceHandlers.delete(handler);
+	}
+	/** Send a broadcast. The sender does not receive its own message. */
+	async broadcast(event, payload) {
+		await this.join();
+		await this.send("broadcast", {
+			event,
+			payload
+		});
+	}
+	onBroadcast(eventOrHandler, maybeHandler) {
+		const wrapped = typeof eventOrHandler === "string" ? (e) => {
+			if (e.event === eventOrHandler) maybeHandler(e.payload);
+		} : eventOrHandler;
+		this.broadcastHandlers.add(wrapped);
+		this.join();
+		return () => this.broadcastHandlers.delete(wrapped);
+	}
+	/** Leave the channel and release every listener and timer. */
+	async leave() {
+		this.stopHeartbeat();
+		this.trackedState = null;
+		this.presences = {};
+		this.presenceHandlers.clear();
+		this.broadcastHandlers.clear();
+		for (const off of this.unsubscribers) off();
+		this.unsubscribers = [];
+		if (this.joined) {
+			this.joined = false;
+			await this.send("leave_channel");
+		}
+	}
+	stopHeartbeat() {
+		if (this.heartbeat) {
+			clearInterval(this.heartbeat);
+			this.heartbeat = null;
+		}
+	}
+	/** Fold an incoming frame into the roster and fan it out. */
+	handle(message) {
+		switch (message.type) {
+			case "presence_state":
+				this.presences = message.presences ?? {};
+				this.emitPresence();
+				break;
+			case "presence_diff": {
+				const joins = message.joins ?? {};
+				const leaves = message.leaves ?? {};
+				for (const [id, state] of Object.entries(joins)) this.presences[id] = state;
+				for (const id of Object.keys(leaves)) delete this.presences[id];
+				this.emitPresence({
+					joins,
+					leaves
+				});
+				break;
+			}
+			case "broadcast": {
+				const event = {
+					event: message.event,
+					payload: message.payload
+				};
+				for (const handler of this.broadcastHandlers) handler(event);
+				break;
+			}
+		}
+	}
+	emitPresence(diff) {
+		const snapshot = { ...this.presences };
+		for (const handler of this.presenceHandlers) handler(snapshot, diff);
+	}
+};
+/**
 * Derive a WebSocket URL from an HTTP base URL.
 * `http://` → `ws://`, `https://` → `wss://`.
 */
@@ -16904,6 +17346,8 @@ function createRebaseClient(options) {
 	};
 	const resolvedWsUrl = options.realtime !== false ? options.websocketUrl ?? deriveWebSocketUrl(options.baseUrl) : void 0;
 	let ws;
+	/** One channel object per name — see `realtime.channel`. */
+	const realtimeChannels = /* @__PURE__ */ new Map();
 	if (resolvedWsUrl) {
 		ws = new RebaseWebSocketClient({
 			websocketUrl: resolvedWsUrl,
@@ -16927,7 +17371,7 @@ function createRebaseClient(options) {
 			if (!ws) return;
 			if (event === "SIGNED_OUT") ws.disconnect();
 			else if (event === "SIGNED_IN" || event === "TOKEN_REFRESHED") {
-				if (session?.accessToken) ws.authenticate(session.accessToken).catch(console.warn);
+				if (session?.accessToken && ws.hasSocket) ws.authenticate(session.accessToken).catch(console.warn);
 			}
 		});
 	}
@@ -17014,6 +17458,24 @@ function createRebaseClient(options) {
 		createStorageSource,
 		fetchStorageSources,
 		ws,
+		realtime: { 
+		/**
+		* Join a broadcast/presence channel.
+		*
+		* Repeated calls with the same name return the same channel, so
+		* separate components can attach handlers without each opening its
+		* own membership — and `leave()` from one would otherwise silently
+		* cut off the others.
+		*/
+channel: (name) => {
+			if (!ws) throw new RebaseClientError("Realtime is disabled on this client (realtime: false), so channels are unavailable.");
+			let existing = realtimeChannels.get(name);
+			if (!existing) {
+				existing = new RebaseRealtimeChannel(name, ws);
+				realtimeChannels.set(name, existing);
+			}
+			return existing;
+		} },
 		/**
 		* Release the realtime socket and its reconnect timer.
 		*
@@ -17022,7 +17484,9 @@ function createRebaseClient(options) {
 		* was never started, and safe to call twice.
 		*/
 		close: () => {
-			ws?.disconnect();
+			for (const channel of realtimeChannels.values()) channel.leave();
+			realtimeChannels.clear();
+			ws?.disconnect(true);
 		},
 		setToken: transport.setToken,
 		setAuthTokenGetter: transport.setAuthTokenGetter,
@@ -17663,7 +18127,8 @@ async function _initializeRebaseBackend(config) {
 			registry: storageRegistry,
 			sources: config.storageSources,
 			requireAuth: resolveRequireAuth(config.auth),
-			authAdapter
+			authAdapter,
+			authorize: config.storageAuthorize
 		});
 		const storageRouter = new Hono();
 		if (apiKeyPreAuth) storageRouter.use("/*", apiKeyPreAuth, createStorageApiKeyGuard());
@@ -17932,7 +18397,7 @@ async function loadFunctionsFromDirectory(directory, importModule = nativeDynami
 	const problems = [];
 	if (!fs$2.existsSync(directory)) return functions;
 	const files = fs$2.readdirSync(directory);
-	for (const file of files) if ((file.endsWith(".ts") || file.endsWith(".js")) && !file.includes(".test.") && !file.endsWith(".d.ts") && file !== "index.ts" && file !== "index.js") {
+	for (const file of files) if ((file.endsWith(".ts") || file.endsWith(".js")) && !file.startsWith(".") && !file.includes(".test.") && !file.endsWith(".d.ts") && file !== "index.ts" && file !== "index.js") {
 		const filePath = path$1.join(directory, file);
 		try {
 			const fileUrl = pathToFileURL(filePath).href;
@@ -18061,7 +18526,7 @@ async function loadCronJobsFromDirectory(directory, importModule = nativeDynamic
 	const jobs = [];
 	if (!fs$2.existsSync(directory)) return jobs;
 	const files = fs$2.readdirSync(directory);
-	for (const file of files) if ((file.endsWith(".ts") || file.endsWith(".js")) && !file.includes(".test.") && !file.endsWith(".d.ts") && file !== "index.ts" && file !== "index.js") {
+	for (const file of files) if ((file.endsWith(".ts") || file.endsWith(".js")) && !file.startsWith(".") && !file.includes(".test.") && !file.endsWith(".d.ts") && file !== "index.ts" && file !== "index.js") {
 		const filePath = path$1.join(directory, file);
 		try {
 			const fileUrl = pathToFileURL(filePath).href;
@@ -18335,6 +18800,7 @@ var CronScheduler = class {
 			logger.warn("[cron] Failed to seed job stats from database", { error: err });
 		});
 		for (const [id, job] of this.jobs) if (job.enabled) this.scheduleNext(id);
+		if (!this.store) logger.warn("[cron] No cron store attached — runs are uncoordinated; with multiple app instances every instance will execute every job");
 		logger.info(`⏰ Cron scheduler started with ${this.jobs.size} job(s)`);
 	}
 	/**
@@ -18453,6 +18919,19 @@ var CronScheduler = class {
 					this.scheduleNext(id);
 					return;
 				}
+				if (this.store?.tryClaimRun) {
+					let claimed = true;
+					try {
+						claimed = await this.store.tryClaimRun(id, nextRun.toISOString());
+					} catch (err) {
+						logger.warn(`[cron] Claim check threw for "${id}" — running uncoordinated`, { error: err });
+					}
+					if (!claimed) {
+						logger.info(`[cron] Slot ${nextRun.toISOString()} for "${id}" claimed by another instance — skipping`);
+						if (this.started && job.enabled) this.scheduleNext(id);
+						return;
+					}
+				}
 				await this.executeJob(job, false);
 				if (this.started && job.enabled) this.scheduleNext(id);
 			}, Math.max(rawDelay, MIN_SCHEDULE_INTERVAL_MS));
@@ -18621,6 +19100,25 @@ function createCronRoutes(scheduler) {
 //#region src/cron/cron-store.ts
 var cron_store_exports = /* @__PURE__ */ __exportAll({ createCronStore: () => createCronStore });
 var TABLE = "rebase.cron_logs";
+var CLAIMS_TABLE = "rebase.cron_claims";
+/** Claims older than this are garbage-collected on startup. */
+var CLAIM_RETENTION_DAYS = 7;
+/**
+* Detect a unique-constraint violation anywhere in an error's cause chain.
+* Drizzle wraps the PG error — match the SQLSTATE code, never message text.
+* Also covers SQLite ("UNIQUE constraint failed") and MySQL (ER_DUP_ENTRY 1062)
+* for future SQL drivers.
+*/
+function isUniqueViolation(err) {
+	let current = err;
+	for (let depth = 0; depth < 10 && current; depth++) if (typeof current === "object") {
+		const e = current;
+		if (e.code === "23505" || e.errno === 1062) return true;
+		if (typeof e.message === "string" && e.message.includes("UNIQUE constraint failed")) return true;
+		current = e.cause;
+	} else break;
+	return false;
+}
 function createCronStore(driver) {
 	const admin = driver.admin;
 	if (!isSQLAdmin(admin)) {
@@ -18650,6 +19148,15 @@ function createCronStore(driver) {
                     CREATE INDEX IF NOT EXISTS idx_cron_logs_job
                     ON ${TABLE}(job_id, started_at DESC)
                 `);
+				await exec(`
+                    CREATE TABLE IF NOT EXISTS ${CLAIMS_TABLE} (
+                        job_id TEXT NOT NULL,
+                        slot TIMESTAMPTZ NOT NULL,
+                        claimed_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+                        PRIMARY KEY (job_id, slot)
+                    )
+                `);
+				await exec(`DELETE FROM ${CLAIMS_TABLE} WHERE claimed_at < now() - make_interval(days => $1)`, { params: [CLAIM_RETENTION_DAYS] });
 				logger.info("✅ Cron logs table ready");
 			} catch (err) {
 				logger.error("❌ Failed to create cron logs table", { error: err });
@@ -18709,6 +19216,18 @@ function createCronStore(driver) {
 				logger.error("[cron-store] Failed to fetch job stats", { error: err });
 			}
 			return stats;
+		},
+		async tryClaimRun(jobId, slot) {
+			try {
+				return (await exec(`INSERT INTO ${CLAIMS_TABLE} (job_id, slot)
+                     VALUES ($1, $2)
+                     ON CONFLICT (job_id, slot) DO NOTHING
+                     RETURNING job_id`, { params: [jobId, slot] })).length > 0;
+			} catch (err) {
+				if (isUniqueViolation(err)) return false;
+				logger.warn(`[cron-store] Claim check failed for "${jobId}" — running uncoordinated`, { error: err });
+				return true;
+			}
 		}
 	};
 }
@@ -19008,7 +19527,10 @@ var rebaseEnvSchema = object({
 	S3_ACCESS_KEY_ID: string().optional(),
 	S3_SECRET_ACCESS_KEY: string().optional(),
 	S3_ENDPOINT: string().url().optional(),
-	S3_FORCE_PATH_STYLE: optionalBoolString
+	S3_FORCE_PATH_STYLE: optionalBoolString,
+	GCS_BUCKET: string().optional(),
+	GCS_PROJECT_ID: string().optional(),
+	GCS_KEY_FILENAME: string().optional()
 });
 function loadEnv(options) {
 	const isProduction = process.env.NODE_ENV === "production";