@rebasepro/server 0.9.1-canary.fd3754b → 0.10.0

package/dist/index.es.js

@@ -1,10 +1,9 @@
 import { createRequire as __createRequire } from "module";
 import process from "process";
 __createRequire(import.meta.url);
-import { a as __require, i as __exportAll, n as __commonJSMin, s as __toESM } from "./ms-DnYXB-Wd.js";
-import { _ as RebaseClientError, a as getCollectionDataPath, c as CANONICAL_TO_REST, d as toCanonicalOp, f as EntityReference, g as RebaseApiError, h as Vector, i as isSQLAdmin, l as NULL_OPS, m as GeoPoint, o as getDeclaredSubcollections, p as EntityRelation, r as getDataSourceCapabilities, s as isPostgresCollectionConfig, t as DEFAULT_STORAGE_SOURCE_KEY, u as REST_TO_CANONICAL } from "./src-B4OLmNVa.js";
+import { a as getAccessTokenExpiry, d as require_jsonwebtoken, f as __commonJSMin, h as __toESM, i as generateRefreshToken, l as verifyAccessToken, m as __require, n as generateAccessToken, o as getRefreshTokenExpiry, p as __exportAll, r as generateDownloadToken, s as hashRefreshToken, t as configureJwt, u as verifyDownloadToken } from "./jwt-B3zjddCa.js";
+import { _ as RebaseApiError, a as policy, c as isPostgresCollectionConfig, d as REST_TO_CANONICAL, f as toCanonicalOp, g as Vector, h as GeoPoint, i as isSQLAdmin, l as CANONICAL_TO_REST, m as EntityRelation, o as getCollectionDataPath, p as EntityReference, r as getDataSourceCapabilities, s as getDeclaredSubcollections, t as DEFAULT_STORAGE_SOURCE_KEY, u as NULL_OPS, v as RebaseClientError } from "./src-CsHhSKbi.js";
 import { t as logger } from "./logger-BYU66ENZ.js";
-import { a as getAccessTokenExpiry, d as require_jsonwebtoken, i as generateRefreshToken, l as verifyAccessToken, n as generateAccessToken, o as getRefreshTokenExpiry, r as generateDownloadToken, s as hashRefreshToken, t as configureJwt, u as verifyDownloadToken } from "./jwt-BwIn8xmk.js";
 import { t as nativeDynamicImport } from "./dynamic-import-Dvh-K5fl.js";
 import { createHash, randomBytes, randomInt, randomUUID } from "node:crypto";
 import * as fs$2 from "fs";
@@ -18,6 +17,7 @@ import * as crypto from "crypto";
 import { createCipheriv, createDecipheriv, createHash as createHash$1, createHmac, randomBytes as randomBytes$1, randomUUID as randomUUID$1, scrypt, timingSafeEqual } from "crypto";
 import { bodyLimit } from "hono/body-limit";
 import { csrf } from "hono/csrf";
+import { compress } from "hono/compress";
 import fs$1 from "node:fs";
 import fsp from "node:fs/promises";
 import { mkdir, open, unlink, writeFile } from "fs/promises";
@@ -1108,6 +1108,76 @@ function normalizeToEntityRelation(value, propertyType) {
 	if (!(obj.__type === "relation" || obj.__type === "reference" || typeof obj.isEntityRelation === "function" && obj.isEntityRelation() || typeof obj.isEntityReference === "function" && obj.isEntityReference() || propertyType === "relation" && typeof obj.id !== "undefined" && typeof obj.path === "string")) return null;
 	return new EntityRelation(obj.id, obj.path, obj.data);
 }
+/**
+* Derive a row's address from its key columns.
+*
+* Single key → the value as a string. Composite → each part joined by
+* {@link COMPOSITE_ID_SEPARATOR}, in primary-key order, which is what
+* {@link parseIdValues} expects to invert.
+*/
+function buildCompositeId(values, primaryKeys) {
+	if (primaryKeys.length === 0) return "";
+	if (primaryKeys.length === 1) return String(values[primaryKeys[0].fieldName] ?? "");
+	return primaryKeys.map((pk) => String(values[pk.fieldName] ?? "")).join(":::");
+}
+/**
+* The primary keys of a collection, as declared by its properties.
+*
+* This is the only tier both sides can read, because it is the only one written
+* in the config: the postgres driver can also infer keys from the Drizzle
+* schema, which the browser never sees and is never sent — the admin compiles
+* the collection files into its own bundle rather than being served them. A key
+* that lives only in the Drizzle schema is therefore invisible here, and the
+* server says so at boot (`warnOnKeysTheAdminCannotResolve`) naming the `isId`
+* to add.
+*
+* Returns an empty array when a collection declares none, which callers must
+* treat as "not addressable" rather than defaulting to `id`: guessing a key
+* that is not the real one produces confidently wrong addresses.
+*/
+function getDeclaredPrimaryKeys(collection) {
+	const properties = collection.properties;
+	if (!properties) return [];
+	const keys = [];
+	for (const [fieldName, propRaw] of Object.entries(properties)) {
+		const prop = propRaw;
+		if (!prop || typeof prop !== "object") continue;
+		if (!("isId" in prop) || !prop.isId) continue;
+		keys.push({
+			fieldName,
+			type: prop.type === "number" ? "number" : "string",
+			isUUID: prop.isId === "uuid"
+		});
+	}
+	return keys;
+}
+/**
+* The keys to address a collection's rows with, resolved the way the driver
+* resolves them — minus the tier the browser cannot reach.
+*
+* The postgres driver tries, in order: properties marked `isId`; the primary
+* keys of the Drizzle schema; and finally a column literally named `id`. Only
+* the first and last are visible in a `CollectionConfig`, which is what both
+* sides share.
+*
+* So the two agree except on a collection that declares no `isId` and whose key
+* is known only to Drizzle. There, the driver reads the real key, and this
+* either resolves nothing (reported to the console by the caller) or — if the
+* table happens to have an unrelated `id` property — resolves `id`, which is
+* the wrong key and cannot be detected from here: the addresses look right and
+* route wrong. Only the config can settle it, so the server names both cases
+* at boot (`warnOnKeysTheAdminCannotResolve`) with the `isId` to add.
+*/
+function resolvePrimaryKeys(collection) {
+	const declared = getDeclaredPrimaryKeys(collection);
+	if (declared.length > 0) return declared;
+	const idProp = collection.properties?.id;
+	if (idProp && typeof idProp === "object") return [{
+		fieldName: "id",
+		type: idProp.type === "number" ? "number" : "string"
+	}];
+	return [];
+}
 //#endregion
 //#region ../common/src/util/enums.ts
 function enumToObjectEntries(enumValues) {
@@ -1320,6 +1390,8 @@ function getSubcollections(collection) {
 	}
 	return [];
 }
+policy.or(policy.serverContext(), policy.rolesOverlap(["admin"]));
+policy.or(policy.serverContext(), policy.rolesOverlap(["admin"]));
 (/* @__PURE__ */ __commonJSMin(((exports, module) => {
 	(function(root, factory) {
 		if (typeof define === "function" && define.amd) define(factory);
@@ -2752,18 +2824,45 @@ function deserializeLogicalCondition(str) {
 }
 //#endregion
 //#region ../common/src/data/buildRebaseData.ts
+function createPrimaryKeyResolver(options) {
+	const cache = /* @__PURE__ */ new Map();
+	const warned = /* @__PURE__ */ new Set();
+	return function primaryKeysFor(slug) {
+		const cached = cache.get(slug);
+		if (cached) return cached;
+		const collection = options?.resolveCollection?.(slug);
+		if (!collection) return [];
+		const keys = resolvePrimaryKeys(collection);
+		if (keys.length > 0) {
+			cache.set(slug, keys);
+			return keys;
+		}
+		if (!warned.has(slug)) {
+			warned.add(slug);
+			console.warn(`[rebase] Collection '${slug}' declares no primary key, so its rows have no address: detail links, caching and relations will not work for it. Mark the key property with \`isId\` in its collection config — the server logs which column to mark at boot, if its schema knows the key.`);
+		}
+		return keys;
+	};
+}
 /**
-* Convert a flat REST record (e.g. from RestFetchService) to Entity<M> format.
-* Mirrors the client SDK's rowToEntity conversion.
+* Give a flat row the Entity view-model the admin renders.
+*
+* The address is *derived here* — it is not a column, and the row it came from
+* does not contain one. Rows carry exactly what the table has, with the types
+* Postgres returned; the id is this layer's invention, and this is the only
+* place it is minted.
+*
+* `primaryKeys` empty falls back to a literal `id` on the row: drivers other
+* than postgres still serve rows with one, and this keeps them working.
 */
-function rowToEntity(row, slug) {
+function rowToEntity(row, slug, primaryKeys = []) {
 	return {
-		id: row.id,
+		id: primaryKeys.length > 0 ? buildCompositeId(row, primaryKeys) : row.id,
 		path: slug,
 		values: row
 	};
 }
-function createDriverAccessor(driver, slug) {
+function createDriverAccessor(driver, slug, getPks = () => []) {
 	const accessor = {
 		async find(params) {
 			const filter = params?.where ? deserializeFilter(params.where) : void 0;
@@ -2796,7 +2895,7 @@ function createDriverAccessor(driver, slug) {
 				hasMore = offset + rows.length < total;
 			}
 			return {
-				data: rows.map((row) => rowToEntity(row, slug)),
+				data: rows.map((row) => rowToEntity(row, slug, getPks())),
 				meta: {
 					total,
 					limit,
@@ -2810,7 +2909,7 @@ function createDriverAccessor(driver, slug) {
 				path: slug,
 				id
 			});
-			return row ? rowToEntity(row, slug) : void 0;
+			return row ? rowToEntity(row, slug, getPks()) : void 0;
 		},
 		async create(data, id) {
 			return rowToEntity(await driver.save({
@@ -2818,15 +2917,22 @@ function createDriverAccessor(driver, slug) {
 				values: data,
 				id,
 				status: "new"
-			}), slug);
+			}), slug, getPks());
 		},
+		createMany: driver.saveMany ? async (data, options) => {
+			return (await driver.saveMany({
+				path: slug,
+				rows: data,
+				upsert: options?.upsert
+			})).map((row) => rowToEntity(row, slug, getPks()));
+		} : void 0,
 		async update(id, data) {
 			return rowToEntity(await driver.save({
 				path: slug,
 				values: data,
 				id,
 				status: "existing"
-			}), slug);
+			}), slug, getPks());
 		},
 		async delete(id) {
 			return driver.delete({ row: {
@@ -2855,7 +2961,7 @@ function createDriverAccessor(driver, slug) {
 				searchString: params?.searchString,
 				onUpdate: (entities) => {
 					onUpdate({
-						data: entities.map((row) => rowToEntity(row, slug)),
+						data: entities.map((row) => rowToEntity(row, slug, getPks())),
 						meta: {
 							total: entities.length,
 							limit,
@@ -2871,7 +2977,7 @@ function createDriverAccessor(driver, slug) {
 			return driver.listenOne({
 				path: slug,
 				id,
-				onUpdate: (entity) => onUpdate(entity ? rowToEntity(entity, slug) : void 0),
+				onUpdate: (entity) => onUpdate(entity ? rowToEntity(entity, slug, getPks()) : void 0),
 				onError
 			});
 		} : void 0,
@@ -2910,12 +3016,13 @@ function createDriverAccessor(driver, slug) {
 * await data.products.create({ name: "Camera", price: 299 });
 * const { data: items } = await data.products.find({ where: { status: ["==", "published"] } });
 */
-function buildRebaseData(driver) {
+function buildRebaseData(driver, options) {
 	const cache = /* @__PURE__ */ new Map();
+	const primaryKeysFor = createPrimaryKeyResolver(options);
 	function getAccessor(slug) {
 		let accessor = cache.get(slug);
 		if (!accessor) {
-			accessor = createDriverAccessor(driver, slug);
+			accessor = createDriverAccessor(driver, slug, () => primaryKeysFor(slug));
 			cache.set(slug, accessor);
 		}
 		return accessor;
@@ -2928,8 +3035,9 @@ function buildRebaseData(driver) {
 	} });
 }
 /**
-* Unwrap a Entity into a flat row. `rowToEntity` stores the whole flat row
-* (id included) under `.values`, so this is just that payload.
+* Unwrap a Entity back into the flat row it was built from. `rowToEntity` keeps
+* the row untouched under `.values` and derives `.id` alongside it, so dropping
+* the wrapper is the whole operation — the address was never part of the row.
 */
 function entityToRow(entity) {
 	return entity.values;
@@ -3016,6 +3124,12 @@ function toSdkCollectionClient(snap) {
 		async create(data, id) {
 			return entityToRow(await snap.create(data, id));
 		},
+		async createMany(data, options) {
+			if (!Array.isArray(data)) throw new TypeError("createMany expects an array of records.");
+			if (data.length === 0) return [];
+			if (!snap.createMany) throw new Error("Bulk writes are not supported by this collection's data source. Fall back to create() per record.");
+			return (await snap.createMany(data, options)).map(entityToRow);
+		},
 		async update(id, data) {
 			return entityToRow(await snap.update(id, data));
 		},
@@ -3191,7 +3305,7 @@ var BackendCollectionRegistry = class extends CollectionRegistry {
 //#endregion
 //#region src/collections/loader.ts
 function isCollectionFile(file) {
-	return (file.endsWith(".ts") || file.endsWith(".js")) && !file.includes(".test.") && !file.endsWith(".d.ts") && file !== "index.ts" && file !== "index.js";
+	return (file.endsWith(".ts") || file.endsWith(".js")) && !file.startsWith(".") && !file.includes(".test.") && !file.endsWith(".d.ts") && file !== "index.ts" && file !== "index.js";
 }
 async function importModule(filePath) {
 	return await import(pathToFileURL(filePath).href);
@@ -3388,6 +3502,21 @@ function createRoutedRealtimeService(opts) {
 //#region src/api/errors.ts
 /** Tracks whether we've already shown the doctor hint (once per process). */
 var _schemaDriftHinted = false;
+/** 5-character SQLSTATE, e.g. `42501`, `23505`. */
+var SQLSTATE_RE = /^[0-9A-Z]{5}$/;
+/**
+* Walk the cause chain for the underlying database error, identified by a
+* 5-char SQLSTATE `code`. Drizzle wraps the pg error in `.cause`, and route
+* code sometimes wraps drizzle again, so the real error may sit several
+* levels down.
+*/
+function extractDbError(error, depth = 0) {
+	if (!error || typeof error !== "object" || depth > 8) return null;
+	const e = error;
+	if (typeof e.code === "string" && SQLSTATE_RE.test(e.code)) return e;
+	if (e.cause && typeof e.cause === "object") return extractDbError(e.cause, depth + 1);
+	return null;
+}
 /**
 * Extract the missing table or column name from a PG error.
 * PG 42P01 messages look like: 'relation "my_table" does not exist'
@@ -3410,12 +3539,23 @@ var ApiError = class ApiError extends Error {
 	statusCode;
 	code;
 	details;
-	constructor(statusCode, code, message, details) {
+	/**
+	* Whether this outcome is a routine part of normal operation rather than
+	* something an operator should look at. Expected errors log at debug; every
+	* other operational error logs at warn.
+	*
+	* The motivating case is `POST /auth/refresh` with no session: clients
+	* refresh on page load before they know whether one exists, so every
+	* anonymous page view is a 401 — correct, and not worth a warning line.
+	*/
+	expected;
+	constructor(statusCode, code, message, details, expected = false) {
 		super(message);
 		this.name = "ApiError";
 		this.statusCode = statusCode;
 		this.code = code;
 		this.details = details;
+		this.expected = expected;
 	}
 	static badRequest(message, code = "BAD_REQUEST", details) {
 		return new ApiError(400, code, message, details);
@@ -3423,6 +3563,13 @@ var ApiError = class ApiError extends Error {
 	static unauthorized(message, code = "UNAUTHORIZED") {
 		return new ApiError(401, code, message);
 	}
+	/**
+	* A 401 that is a normal outcome, not an incident — logged at debug.
+	* See {@link ApiError.expected}.
+	*/
+	static unauthenticated(message, code = "UNAUTHORIZED") {
+		return new ApiError(401, code, message, void 0, true);
+	}
 	static forbidden(message, code = "FORBIDDEN") {
 		return new ApiError(403, code, message);
 	}
@@ -3455,7 +3602,10 @@ var errorHandler = (err, c) => {
 	const error = err;
 	const reqId = typeof c.get === "function" ? c.get("requestId") : void 0;
 	if (error instanceof ApiError || error.name === "ApiError") {
-		logger.warn(`⚠️ [API] ${c.req.method} ${c.req.path} → ${error.statusCode} ${error.code}: ${error.message}` + (reqId ? ` [${reqId}]` : ""));
+		const expected = error instanceof ApiError && error.expected;
+		const line = `[API] ${c.req.method} ${c.req.path} → ${error.statusCode} ${error.code}: ${error.message}` + (reqId ? ` [${reqId}]` : "");
+		if (expected) logger.debug(line);
+		else logger.warn(`⚠️ ${line}`);
 		return c.json({ error: {
 			message: error.message,
 			code: error.code || "INTERNAL_ERROR",
@@ -3472,26 +3622,31 @@ var errorHandler = (err, c) => {
 		if (cause.code === "ECONNREFUSED" && !cause.address && Array.isArray(cause.errors)) resolvedCause = cause.errors.find((e) => e.address) || cause;
 		else resolvedCause = cause;
 	}
-	if (resolvedCause) {
+	const dbError = extractDbError(error);
+	if (resolvedCause && (resolvedCause.code === "ENETUNREACH" || resolvedCause.code === "ECONNREFUSED")) {
 		const cause = resolvedCause;
 		if (cause.code === "ENETUNREACH") logMessage = `Network unreachable. Cannot connect to database at ${cause.address}:${cause.port}.`;
-		else if (cause.code === "ECONNREFUSED") logMessage = `Connection refused to database at ${cause.address}:${cause.port}. Is PostgreSQL running?`;
-		else if (cause.code === "42703" || cause.code === "42P01") {
-			code = "SCHEMA_DRIFT";
-			logMessage = `Schema drift: ${cause.code === "42703" ? "column" : "table"} "${cause.table || cause.column || extractMissingIdentifier(cause.message) || "unknown"}" does not exist in the database. Run \`pnpm db:push\` to sync your schema, or \`pnpm db:migrate\` to apply pending migrations.`;
-		}
+		else logMessage = `Connection refused to database at ${cause.address}:${cause.port}. Is PostgreSQL running?`;
 	} else if ("code" in error && error.code === "ENETUNREACH") {
 		const netErr = error;
 		logMessage = `Network unreachable. Cannot connect to service at ${netErr.address}:${netErr.port}.`;
-	} else if ("code" in error && (error.code === "42703" || error.code === "42P01")) {
+	} else if (dbError && (dbError.code === "42703" || dbError.code === "42P01")) {
 		code = "SCHEMA_DRIFT";
-		const issue = error.code === "42703" ? "column" : "table";
-		const pgErr = error;
-		logMessage = `Schema drift: ${issue} "${pgErr.table || pgErr.column || extractMissingIdentifier(error.message) || "unknown"}" does not exist in the database. Run \`pnpm db:push\` to sync your schema, or \`pnpm db:migrate\` to apply pending migrations.`;
-	}
-	const causePg = error.cause && typeof error.cause === "object" ? error.cause : void 0;
-	const pgErrorCode = causePg?.code || error.code;
-	const isDbSchemaMismatch = code === "SCHEMA_DRIFT" || pgErrorCode === "42703" || pgErrorCode === "42P01";
+		logMessage = `Schema drift: ${dbError.code === "42703" ? "column" : "table"} "${dbError.table || dbError.column || extractMissingIdentifier(dbError.message) || "unknown"}" does not exist in the database. Run \`pnpm db:push\` to sync your schema, or \`pnpm db:migrate\` to apply pending migrations.`;
+	} else if (dbError) {
+		const parts = [`[PG ${dbError.code}] ${dbError.message}`];
+		if (dbError.detail) parts.push(`Detail: ${dbError.detail}`);
+		if (dbError.hint) parts.push(`Hint: ${dbError.hint}`);
+		if (dbError.table) parts.push(`Table: ${dbError.table}`);
+		if (dbError.column) parts.push(`Column: ${dbError.column}`);
+		if (dbError.constraint) parts.push(`Constraint: ${dbError.constraint}`);
+		if (dbError.code === "42501") {
+			code = "DB_PERMISSION_DENIED";
+			parts.push(`The database rejected the statement for lack of privilege — usually a row-level security policy${dbError.table ? ` on "${dbError.table}"` : ""} denying this role, or a stale FORCE ROW LEVEL SECURITY flag binding the owner connection.`);
+		}
+		logMessage = parts.join(". ");
+	}
+	const isDbSchemaMismatch = code === "SCHEMA_DRIFT";
 	if (isDbSchemaMismatch) {
 		logger.warn(`⚠️ [API] ${c.req.method} ${c.req.path} → ${statusCode} ${code}: ${logMessage}` + (reqId ? ` [${reqId}]` : ""));
 		if (!_schemaDriftHinted && process.env.NODE_ENV !== "production") {
@@ -3510,18 +3665,27 @@ var errorHandler = (err, c) => {
 			].join("\n"));
 		}
 	} else logger.error(`❌ [API] ${c.req.method} ${c.req.path} → ${statusCode} ${code}: ${logMessage}` + (reqId ? ` [${reqId}]` : ""));
-	if (!(isDbSchemaMismatch || statusCode < 500 && code === "BAD_REQUEST")) logger.error(String(error.stack || error));
+	if (!(isDbSchemaMismatch || dbError !== null || statusCode < 500 && code === "BAD_REQUEST")) logger.error(String(error.stack || error));
 	let clientMessage = "An unexpected error occurred";
 	if (statusCode < 500 && error.message) clientMessage = error.message;
 	else if (error instanceof ApiError || error.name === "ApiError") clientMessage = error.message;
 	else if (code === "SCHEMA_DRIFT") {
-		const pgErr = causePg || error;
-		clientMessage = `Schema drift: ${pgErr.code === "42703" || pgErrorCode === "42703" ? "column" : "table"} "${pgErr.table || pgErr.column || extractMissingIdentifier(pgErr.message || error.message) || "unknown"}" does not exist. Run \`pnpm db:push\` to sync your schema.`;
-	} else if (code === "INTERNAL_ERROR") clientMessage = "Internal Server Error";
+		const pgErr = dbError || error;
+		clientMessage = `Schema drift: ${pgErr.code === "42703" ? "column" : "table"} "${pgErr.table || pgErr.column || extractMissingIdentifier(pgErr.message || error.message) || "unknown"}" does not exist. Run \`pnpm db:push\` to sync your schema.`;
+	} else if (code === "DB_PERMISSION_DENIED") clientMessage = `Permission denied by the database${dbError?.table ? ` on "${dbError.table}"` : ""} (row-level security). Check the RLS policies for this table.`;
+	else if (code === "INTERNAL_ERROR") clientMessage = "Internal Server Error";
+	const dbDetails = dbError ? {
+		dbCode: dbError.code,
+		...process.env.NODE_ENV !== "production" && {
+			dbMessage: dbError.message,
+			...dbError.detail && { detail: dbError.detail },
+			...dbError.hint && { hint: dbError.hint }
+		}
+	} : void 0;
 	return c.json({ error: {
 		message: clientMessage,
 		code,
-		...error.details !== void 0 && { details: error.details },
+		...error.details !== void 0 ? { details: error.details } : dbDetails !== void 0 ? { details: dbDetails } : {},
 		...reqId && { requestId: reqId }
 	} }, statusCode);
 };
@@ -3543,6 +3707,7 @@ function codeToStatus(code) {
 		EMAIL_EXISTS: 409,
 		ROLE_EXISTS: 409,
 		SCHEMA_DRIFT: 500,
+		DB_PERMISSION_DENIED: 500,
 		INTERNAL_ERROR: 500,
 		NOT_CONFIGURED: 503,
 		SERVICE_UNAVAILABLE: 503
@@ -3668,6 +3833,41 @@ function parseQueryOptions(query) {
 	return options;
 }
 //#endregion
+//#region src/api/rest/write-validation.ts
+/**
+* Reject a write naming a field the collection does not have.
+*
+* Unknown keys used to travel all the way into the INSERT, where Postgres
+* rejected them — so a typo came back as `column "titel" does not exist`,
+* phrased by the database, from a stack the caller cannot see, and only if the
+* column really was absent. It is a request problem and belongs in a 400.
+*
+* What counts as known:
+* - a declared property (for an introspected BaaS collection these *are* the
+*   columns, so the set is exact);
+* - the foreign-key column behind an owning relation, which callers may write
+*   directly instead of through the relation property;
+* - anything named in `options.extraKnownFields` — for an auth collection the
+*   credential keys the auth adapter consumes before a row is ever built;
+* - nothing else. `id` in particular is not automatically known — see below.
+*/
+function assertKnownWriteFields(values, collection, options) {
+	if (collection.strictWrites === false) return;
+	if (!collection.properties || Object.keys(collection.properties).length === 0) return;
+	const known = new Set(Object.keys(collection.properties));
+	for (const relation of Object.values(resolveCollectionRelations(collection))) if (relation.localKey) known.add(relation.localKey);
+	for (const field of options?.extraKnownFields ?? []) known.add(field);
+	const unknown = Object.keys(values).filter((key) => !known.has(key));
+	if (unknown.length === 0) return;
+	const where = options?.rowIndex !== void 0 ? `Row ${options.rowIndex}: ` : "";
+	if (unknown.includes("id") && !known.has("id")) {
+		const keys = Object.entries(collection.properties ?? {}).filter(([, prop]) => "isId" in prop && Boolean(prop.isId)).map(([name]) => `'${name}'`);
+		const keyDesc = keys.length > 0 ? keys.join(" + ") : "its own key column";
+		throw ApiError.badRequest(`${where}'${collection.slug}' has no 'id' column — it is keyed on ${keyDesc}. The \`id\` argument of \`create(data, id)\` is written as an \`id\` column, so for this collection put the key in \`data\` instead.`, "VALIDATION_UNKNOWN_FIELDS");
+	}
+	throw ApiError.badRequest(`${where}'${collection.slug}' has no field${unknown.length > 1 ? "s" : ""} ${unknown.map((f) => `'${f}'`).join(", ")}. Known fields: ${[...known].sort().map((f) => `'${f}'`).join(", ")}.`, "VALIDATION_UNKNOWN_FIELDS");
+}
+//#endregion
 //#region src/auth/api-keys/api-key-permission-guard.ts
 /**
 * Map an HTTP method string to an `ApiKeyOperation`.
@@ -3703,6 +3903,44 @@ function isOperationAllowed(permissions, collection, operation) {
 	for (const perm of permissions) if ((perm.collection === "*" || perm.collection === collection) && perm.operations.includes(operation)) return true;
 	return false;
 }
+/**
+* Check whether the given permissions array allows a storage operation.
+*
+* Storage, like functions, lives outside the collection namespace: an entry
+* with collection `"storage"` grants storage access for the listed
+* operations (GET routes → `read`, upload/folder/tus → `write`,
+* DELETE routes → `delete`), and the global `"*"` wildcard also matches.
+* A collection-scoped key gets no storage access at all.
+*
+* Matching is exactly {@link isOperationAllowed} with `"storage"` as the
+* resource name — delegated so the semantics can never drift.
+*/
+function isStorageAllowed(permissions, operation) {
+	return isOperationAllowed(permissions, "storage", operation);
+}
+/**
+* Check whether the given permissions array allows invoking a custom function.
+*
+* Functions live outside the collection namespace, so they have their own
+* resource names in the permission list:
+*
+* - `{ collection: "functions", ... }` grants every function
+* - `{ collection: "functions/<name>", ... }` grants a single function
+* - the global `"*"` wildcard (full-access keys) also matches
+*
+* The operation is derived from the HTTP method as usual (GET → read,
+* POST/PUT/PATCH → write, DELETE → delete). The functions index route is
+* checked as `functionName === ""`, which only the `"functions"` and `"*"`
+* entries can grant.
+*
+* A collection-scoped key (e.g. read-only on `events`) therefore can NOT
+* invoke functions — before this guard existed, any valid key could call
+* every function.
+*/
+function isFunctionAllowed(permissions, functionName, operation) {
+	for (const perm of permissions) if ((perm.collection === "*" || perm.collection === "functions" || functionName !== "" && perm.collection === `functions/${functionName}`) && perm.operations.includes(operation)) return true;
+	return false;
+}
 //#endregion
 //#region src/api/rest/api-generator.ts
 /**
@@ -3724,15 +3962,19 @@ async function parseJsonBody(c) {
 * Lightweight REST API generator that leverages existing Rebase DataDriver.
 * Supports `include` query parameter for eager-loading relations via Drizzle.
 */
+/** Rows accepted by a single POST /<collection>/bulk. See `maxBulkRows`. */
+var DEFAULT_MAX_BULK_ROWS = 1e3;
 var RestApiGenerator = class {
 	collections;
 	router;
 	driver;
+	maxBulkRows;
 	authAdapter;
-	constructor(collections, driver, authAdapter) {
+	constructor(collections, driver, authAdapter, maxBulkRows = DEFAULT_MAX_BULK_ROWS) {
 		this.collections = collections;
 		this.driver = driver;
 		this.authAdapter = authAdapter;
+		this.maxBulkRows = maxBulkRows;
 		this.router = new Hono();
 	}
 	/**
@@ -3757,6 +3999,17 @@ var RestApiGenerator = class {
 		if (!isOperationAllowed(apiKey.permissions, collectionSlug, operation)) throw ApiError.forbidden(`API key does not have "${operation}" permission for collection "${collectionSlug}"`, "API_KEY_FORBIDDEN");
 	}
 	/**
+	* API key permission check for nested paths. The operation targets the
+	* LAST collection in the path (e.g. "posts" for /authors/1/posts), so
+	* that is the slug the key must hold permission for — checking the
+	* parent instead would let a key scoped to "authors" write "posts".
+	* `parseSubPath` always yields a collectionPath ending in a collection
+	* slug, never an id.
+	*/
+	enforceSubcollectionApiKeyPermission(c, collectionPath) {
+		this.enforceApiKeyPermission(c, collectionPath.split("/").pop());
+	}
+	/**
 	* Get the request-scoped driver. Throws if none is set — never falls
 	* back to the unscoped `this.driver` to avoid bypassing RLS/auth.
 	*/
@@ -3817,6 +4070,33 @@ var RestApiGenerator = class {
 			if (!entity) throw ApiError.notFound("Entity not found");
 			return c.json(entity);
 		});
+		this.router.post(`${basePath}/bulk`, async (c) => {
+			this.enforceApiKeyPermission(c, collection.slug);
+			const driver = this.getScopedDriver(c);
+			const path = collection.slug;
+			const body = await parseJsonBody(c);
+			if (!Array.isArray(body?.rows)) throw ApiError.badRequest("Expected a JSON body of { rows: [...] }.", "INVALID_BULK_BODY");
+			if (body.rows.length === 0) return c.json({
+				data: [],
+				meta: { written: 0 }
+			});
+			if (body.rows.some((row) => typeof row !== "object" || row === null || Array.isArray(row))) throw ApiError.badRequest("Every entry in `rows` must be an object.", "INVALID_BULK_BODY");
+			if (body.upsert !== void 0 && typeof body.upsert !== "boolean") throw ApiError.badRequest("`upsert` must be a boolean.", "INVALID_BULK_BODY");
+			const maxRows = this.maxBulkRows;
+			if (body.rows.length > maxRows) throw ApiError.badRequest(`Too many rows: ${body.rows.length} exceeds the ${maxRows}-row limit for a single bulk write. Send it in chunks of ${maxRows} or fewer.`, "BULK_TOO_LARGE");
+			if (!driver.saveMany) throw ApiError.badRequest("This collection's data source does not support bulk writes.", "BULK_UNSUPPORTED");
+			body.rows.forEach((row, rowIndex) => assertKnownWriteFields(row, resolvedCollection, { rowIndex }));
+			const rows = await driver.saveMany({
+				path,
+				rows: body.rows,
+				collection: resolvedCollection,
+				upsert: body.upsert === true
+			});
+			return c.json({
+				data: rows.map((row) => this.formatResponse(row)),
+				meta: { written: rows.length }
+			});
+		});
 		this.router.post(basePath, async (c) => {
 			try {
 				this.enforceApiKeyPermission(c, collection.slug);
@@ -3824,8 +4104,14 @@ var RestApiGenerator = class {
 				const path = collection.slug;
 				const body = await parseJsonBody(c);
 				const isAuth = collection.auth;
-				if ((isAuth === true || isAuth && typeof isAuth === "object" && isAuth.enabled === true) && this.authAdapter?.prepareUserCreation) {
-					const collectionAuthConfig = typeof isAuth === "object" ? isAuth : void 0;
+				const isAuthCollection = isAuth === true || isAuth && typeof isAuth === "object" && isAuth.enabled === true;
+				const collectionAuthConfig = typeof isAuth === "object" ? isAuth : void 0;
+				if (!isAuthCollection) assertKnownWriteFields(body, resolvedCollection);
+				else {
+					const contract = this.authAdapter?.describeUserCreationContract?.(collectionAuthConfig);
+					if (contract?.validate) assertKnownWriteFields(body, resolvedCollection, { extraKnownFields: contract.extraFields });
+				}
+				if (isAuthCollection && this.authAdapter?.prepareUserCreation) {
 					const prepared = await this.authAdapter.prepareUserCreation(body, collectionAuthConfig);
 					const entity = await driver.save({
 						path,
@@ -3838,7 +4124,7 @@ var RestApiGenerator = class {
 						invitationSent: prepared.invitationSent
 					} : this.authAdapter.finalizeUserCreation ? await this.authAdapter.finalizeUserCreation({
 						id: entity.id,
-						values: entity.values
+						values: entity
 					}, prepared.clearPassword) : { invitationSent: false };
 					const response = this.formatResponse(entity);
 					return c.json({
@@ -3874,6 +4160,7 @@ var RestApiGenerator = class {
 					collection: resolvedCollection
 				})) throw ApiError.notFound("Entity not found");
 				const body = await parseJsonBody(c);
+				assertKnownWriteFields(body, resolvedCollection);
 				const entity = await driver.save({
 					path: getCollectionDataPath(collection),
 					id: String(id),
@@ -3902,7 +4189,7 @@ var RestApiGenerator = class {
 			if (!existingEntity) throw ApiError.notFound("Entity not found");
 			await driver.delete({
 				row: {
-					id: existingEntity.id,
+					id: String(id),
 					path: getCollectionDataPath(collection),
 					values: existingEntity
 				},
@@ -3950,7 +4237,7 @@ var RestApiGenerator = class {
 			const parsed = parseSubPath(`${c.req.param("parent")}/${c.req.param("parentId")}/${rest}`);
 			if (!parsed) return next();
 			const driver = this.getScopedDriver(c);
-			this.enforceApiKeyPermission(c, c.req.param("parent"));
+			this.enforceSubcollectionApiKeyPermission(c, parsed.collectionPath);
 			if (parsed.id === "count") {
 				const queryDict = c.req.queries();
 				const queryOptions = parseQueryOptions(queryDict);
@@ -4002,7 +4289,7 @@ var RestApiGenerator = class {
 			const parsed = parseSubPath(`${c.req.param("parent")}/${c.req.param("parentId")}/${rest}`);
 			if (!parsed || parsed.id) return next();
 			const driver = this.getScopedDriver(c);
-			this.enforceApiKeyPermission(c, c.req.param("parent"));
+			this.enforceSubcollectionApiKeyPermission(c, parsed.collectionPath);
 			const body = await parseJsonBody(c);
 			const entity = await driver.save({
 				path: parsed.collectionPath,
@@ -4018,7 +4305,7 @@ var RestApiGenerator = class {
 			const parsed = parseSubPath(`${c.req.param("parent")}/${c.req.param("parentId")}/${rest}`);
 			if (!parsed || !parsed.id) return next();
 			const driver = this.getScopedDriver(c);
-			this.enforceApiKeyPermission(c, c.req.param("parent"));
+			this.enforceSubcollectionApiKeyPermission(c, parsed.collectionPath);
 			const body = await parseJsonBody(c);
 			const entity = await driver.save({
 				path: parsed.collectionPath,
@@ -4035,14 +4322,14 @@ var RestApiGenerator = class {
 			const parsed = parseSubPath(`${c.req.param("parent")}/${c.req.param("parentId")}/${rest}`);
 			if (!parsed || !parsed.id) return next();
 			const driver = this.getScopedDriver(c);
-			this.enforceApiKeyPermission(c, c.req.param("parent"));
+			this.enforceSubcollectionApiKeyPermission(c, parsed.collectionPath);
 			const existingEntity = await driver.fetchOne({
 				path: parsed.collectionPath,
 				id: parsed.id
 			});
 			if (!existingEntity) throw ApiError.notFound("Entity not found");
 			await driver.delete({ row: {
-				id: existingEntity.id,
+				id: parsed.id,
 				path: parsed.collectionPath,
 				values: existingEntity
 			} });
@@ -4165,6 +4452,15 @@ function safeCompare(a, b) {
 * 4. Sets `c.set("user", ...)` and `c.set("apiKey", ...)` for downstream use
 * 5. Scopes the DataDriver via `withAuth()` using the API key's service identity
 *
+* Authorization is double-gated for API keys: the key's own permission list
+* (checked by the REST generator) is one ceiling, and Postgres RLS is another,
+* independent one — `withAuth()` runs API-key requests as the restricted
+* `rebase_user` role like any other caller. An `admin` key passes RLS via the
+* injected `default_admin` policies; a non-admin key (roles `["service"]`,
+* uid `api-key:<id>`) only sees rows that a policy explicitly grants to the
+* `service` role or to the public. Owner-style policies
+* (`owner_id = auth.uid()`) never match an API key's synthetic uid.
+*
 * @module
 */
 /**
@@ -4204,10 +4500,10 @@ async function validateApiKey(c, token, options) {
 		message: "API key has expired",
 		code: "UNAUTHORIZED"
 	} }, 401);
-	const userId = `api-key:${apiKey.id}`;
+	const uid = `api-key:${apiKey.id}`;
 	const roles = apiKey.admin ? ["admin", "service"] : ["service"];
 	c.set("user", {
-		userId,
+		uid,
 		roles
 	});
 	const masked = {
@@ -4227,7 +4523,7 @@ async function validateApiKey(c, token, options) {
 	c.set("apiKey", masked);
 	try {
 		const scopedDriver = await scopeDataDriver(driver, {
-			uid: userId,
+			uid,
 			roles
 		});
 		c.set("driver", scopedDriver);
@@ -4238,9 +4534,113 @@ async function validateApiKey(c, token, options) {
 			code: "INTERNAL_ERROR"
 		} }, 500);
 	}
-	store.updateLastUsed(apiKey.id).catch(() => {});
+	const lastTouch = lastUsedTouchedAt.get(apiKey.id);
+	const now = Date.now();
+	if (!lastTouch || now - lastTouch >= LAST_USED_DEBOUNCE_MS) {
+		lastUsedTouchedAt.set(apiKey.id, now);
+		store.updateLastUsed(apiKey.id).catch(() => {});
+	}
 	return true;
 }
+/** Per-process debounce state for last_used_at touches. */
+var lastUsedTouchedAt = /* @__PURE__ */ new Map();
+var LAST_USED_DEBOUNCE_MS = 6e4;
+/**
+* Shared 403 response for API-key permission denials outside the REST
+* generator (storage and functions guards). One envelope, one code — a
+* change to the error contract happens in one place.
+*/
+function forbidApiKey(c, operation, resource, grantHint) {
+	return c.json({ error: {
+		message: `API key does not have "${operation}" permission for ${resource}. Grant it with a permission entry like { "collection": "${grantHint}", "operations": ["${operation}"] }.`,
+		code: "API_KEY_FORBIDDEN"
+	} }, 403);
+}
+/**
+* Permission guard for API-key requests to the storage router.
+*
+* Storage previously did not accept API keys at all (`rk_` tokens were
+* misparsed as JWTs and 401'd). Now that the pre-auth middleware
+* authenticates them, this guard decides what they may do: the key needs a
+* `"storage"` permission entry (or the global `"*"` wildcard) covering the
+* operation derived from the HTTP method. Requests not authenticated via an
+* API key pass through to the storage router's own auth gates.
+*
+* TUS resumable-upload routes (`/tus`, `/tus/:id`) are classified as `write`
+* for EVERY method: the protocol's offset check is a GET and its cancel is a
+* DELETE, but both are steps of an upload — a write-scoped key must be able
+* to complete (and abort) its own resumable upload without also holding
+* `read`/`delete` on stored objects.
+*/
+function createStorageApiKeyGuard() {
+	return async (c, next) => {
+		const apiKey = c.get("apiKey");
+		if (!apiKey) return next();
+		const operation = /\/tus(\/|$)/.test(c.req.path) ? "write" : httpMethodToOperation(c.req.method);
+		if (!isStorageAllowed(apiKey.permissions, operation)) return forbidApiKey(c, operation, "storage", "storage");
+		return next();
+	};
+}
+/**
+* Permission guard for API-key requests to the custom-functions router.
+*
+* The collection permission guard lives in the REST generator and never sees
+* function routes, so before this middleware existed ANY valid API key —
+* however narrowly scoped — could invoke every custom function. This guard
+* closes that: API-key requests must hold a `"functions"`/`"functions/<name>"`
+* permission entry (or the global `"*"` wildcard) for the derived operation.
+*
+* Non-API-key requests (JWT, service key, anonymous) pass through untouched —
+* functions decide their own auth for those, as before.
+*
+* @param mountPrefix - The path the functions router is mounted at
+*                      (e.g. `/api/functions`), used to extract the function
+*                      name from the request path.
+*/
+function createFunctionApiKeyGuard(mountPrefix) {
+	return async (c, next) => {
+		const apiKey = c.get("apiKey");
+		if (!apiKey) return next();
+		const path = c.req.path;
+		const idx = path.indexOf(mountPrefix);
+		const rawName = (idx < 0 ? "" : path.slice(idx + mountPrefix.length)).split("/").filter(Boolean)[0] ?? "";
+		let functionName;
+		try {
+			functionName = decodeURIComponent(rawName);
+		} catch {
+			functionName = rawName;
+		}
+		const operation = httpMethodToOperation(c.req.method);
+		if (!isFunctionAllowed(apiKey.permissions, functionName, operation)) return forbidApiKey(c, operation, functionName ? `function "${functionName}"` : "the functions index", `functions${functionName ? `/${functionName}` : ""}`);
+		return next();
+	};
+}
+/**
+* Standalone pre-auth middleware for `rk_` bearer tokens.
+*
+* Routers whose auth gate is JWT-based (`requireAuth` / `createRequireAuth` —
+* the admin surfaces: admin users/roles, api-keys management, cron, backups,
+* logs, schema editor) don't know about API keys. Mounting this middleware in
+* front of them authenticates `rk_` tokens and populates the request context;
+* the downstream gates then see the already-resolved user and apply their
+* role checks (`requireAdmin`) as usual — so an `admin: true` key passes and
+* a non-admin key is rejected with 403.
+*
+* Requests without an `rk_` bearer token pass through untouched. An invalid,
+* revoked, or expired `rk_` token is rejected here (401) rather than falling
+* through to be misparsed as a JWT.
+*/
+function createApiKeyPreAuth(options) {
+	return async (c, next) => {
+		if (c.get("apiKey")) return next();
+		const authHeader = c.req.header("authorization") || "";
+		const token = authHeader.startsWith("Bearer ") ? authHeader.slice(7) : "";
+		if (!token || !isApiKeyToken(token)) return next();
+		const result = await validateApiKey(c, token, options);
+		if (result !== true) return result;
+		return next();
+	};
+}
 //#endregion
 //#region src/auth/middleware.ts
 /**
@@ -4254,14 +4654,12 @@ async function validateApiKey(c, token, options) {
 * need query-string tokens (e.g. storage file serving for `<img src>`).
 */
 var requireAuth = async (c, next) => {
+	if (c.get("user")) return next();
 	const authHeader = c.req.header("authorization");
-	if (!(authHeader && authHeader.startsWith("Bearer "))) {
-		if (c.get("user")) return next();
-		return c.json({ error: {
-			message: "Authorization header missing or invalid",
-			code: "UNAUTHORIZED"
-		} }, 401);
-	}
+	if (!(authHeader && authHeader.startsWith("Bearer "))) return c.json({ error: {
+		message: "Authorization header missing or invalid",
+		code: "UNAUTHORIZED"
+	} }, 401);
 	const payload = verifyAccessToken(authHeader.substring(7));
 	if (!payload) return c.json({ error: {
 		message: "Invalid or expired token",
@@ -4284,18 +4682,16 @@ function createRequireAuth(options) {
 	if (!options?.serviceKey) return requireAuth;
 	const key = options.serviceKey;
 	return async (c, next) => {
+		if (c.get("user")) return next();
 		const authHeader = c.req.header("authorization");
-		if (!(authHeader && authHeader.startsWith("Bearer "))) {
-			if (c.get("user")) return next();
-			return c.json({ error: {
-				message: "Authorization header missing or invalid",
-				code: "UNAUTHORIZED"
-			} }, 401);
-		}
+		if (!(authHeader && authHeader.startsWith("Bearer "))) return c.json({ error: {
+			message: "Authorization header missing or invalid",
+			code: "UNAUTHORIZED"
+		} }, 401);
 		const token = authHeader.substring(7);
 		if (safeCompare(token, key)) {
 			c.set("user", {
-				userId: "service",
+				uid: "service",
 				roles: ["admin"]
 			});
 			return next();
@@ -4374,11 +4770,11 @@ function createAuthMiddleware(options) {
 		if (validator) try {
 			const authResult = await validator(c);
 			if (authResult && typeof authResult === "object") {
-				const id = ("userId" in authResult ? authResult.userId : void 0) || ("uid" in authResult ? authResult.uid : void 0);
+				const id = ("uid" in authResult ? authResult.uid : void 0) || ("uid" in authResult ? authResult.uid : void 0);
 				if (id) {
 					const roles = authResult.roles || [];
 					c.set("user", {
-						userId: id,
+						uid: id,
 						roles
 					});
 					const user = {
@@ -4393,7 +4789,7 @@ function createAuthMiddleware(options) {
 				}));
 			} else if (authResult === true) {
 				c.set("user", {
-					userId: "default",
+					uid: "default",
 					roles: []
 				});
 				c.set("driver", await scopeDataDriver(driver, {
@@ -4416,7 +4812,7 @@ function createAuthMiddleware(options) {
 				const token = authHeader.substring(7);
 				if (serviceKey && safeCompare(token, serviceKey)) {
 					c.set("user", {
-						userId: "service",
+						uid: "service",
 						roles: ["admin"]
 					});
 					try {
@@ -4443,7 +4839,7 @@ function createAuthMiddleware(options) {
 						c.set("user", payload);
 						try {
 							const user = {
-								uid: payload.userId,
+								uid: payload.uid,
 								roles: payload.roles
 							};
 							c.set("driver", await scopeDataDriver(driver, user));
@@ -4524,7 +4920,7 @@ var publicObjectAuth = async (c, next) => {
 	const idx = fullPath.indexOf(prefix);
 	const rawPath = idx < 0 ? "" : fullPath.substring(idx + prefix.length + 1);
 	if (rawPath && isPublicStoragePath(decodeURIComponent(rawPath))) c.set("user", {
-		userId: "public",
+		uid: "public",
 		roles: ["public"]
 	});
 	return next();
@@ -4532,8 +4928,25 @@ var publicObjectAuth = async (c, next) => {
 /**
 * Helper to match paths for scoped file tokens.
 * Matches exact paths or prefixes (exact folder prefixes or ending with /).
+*
+* The traversal check is defence in depth, not the load-bearing defence.
+*
+* A prefix comparison is a lie for any path containing `..`: `user1/../user2/x`
+* starts with `user1/`, so a token scoped to `user1/` would authorize reading
+* user2's file — and the storage controller would not object, because its own
+* guard stops a path escaping the *bucket*, and that one resolves to `user2/x`,
+* comfortably inside it. The grant is what would be escaped, and this is the
+* only layer that knows what was granted.
+*
+* Nothing arrives here in that shape today: the URL parser resolves `..` (and
+* `%2e%2e`, which the WHATWG spec treats as a dot for normalization) before
+* Hono routes the request, so this comparison already runs on a resolved path.
+* But that is a guarantee of the runtime rather than of this code, and it is
+* one line to not depend on it. The same rule already guards the public-object
+* path — see `isPublicStoragePath`.
 */
 function isPathMatch(requested, allowed) {
+	if (requested.split("/").some((seg) => seg === "..")) return false;
 	if (requested === allowed) return true;
 	if (allowed.endsWith("/")) return requested.startsWith(allowed);
 	return requested.startsWith(allowed + "/");
@@ -4573,7 +4986,7 @@ var fileTokenAuth = async (c, next) => {
 				const { bucket, resolvedPath } = parseBucketPath(decodeURIComponent(rawPath));
 				if (isPathMatch(`${bucket}/${resolvedPath}`, payload.path)) {
 					c.set("user", {
-						userId: "download-token",
+						uid: "download-token",
 						roles: ["reader"]
 					});
 					return next();
@@ -4597,7 +5010,7 @@ var fileTokenAuth = async (c, next) => {
 				const { bucket, resolvedPath } = parseBucketPath(decodeURIComponent(rawPath));
 				if (isPathMatch(`${bucket}/${resolvedPath}`, payload.path)) {
 					c.set("user", {
-						userId: "download-token",
+						uid: "download-token",
 						roles: ["reader"]
 					});
 					return next();
@@ -4646,7 +5059,7 @@ function createAdapterAuthMiddleware(options) {
 		}
 		if (authenticatedUser) {
 			c.set("user", {
-				userId: authenticatedUser.uid,
+				uid: authenticatedUser.uid,
 				email: authenticatedUser.email,
 				roles: authenticatedUser.roles
 			});
@@ -5357,60 +5770,118 @@ function resolveAuthHooks(hooks) {
 	};
 }
 //#endregion
+//#region src/auth/rate-limit-store.ts
+/**
+* The default store: a sliding window in this process's memory.
+*
+* Sliding rather than fixed: a fixed window lets a caller spend its whole
+* allowance in the last second of one window and again in the first second of
+* the next, which is twice the limit over an instant. Timestamps outside the
+* window are dropped on read, and swept periodically so an idle key does not
+* pin its array forever.
+*
+* Per-process, so N replicas enforce N times the limit between them. That is
+* the honest reason {@link RateLimitStore} exists.
+*/
+var MemoryRateLimitStore = class {
+	store = /* @__PURE__ */ new Map();
+	cleanupInterval;
+	constructor(sweepMs = 900 * 1e3) {
+		this.cleanupInterval = setInterval(() => this.sweep(sweepMs), sweepMs);
+		this.cleanupInterval.unref?.();
+	}
+	async hit(key, windowMs, limit) {
+		const now = Date.now();
+		const timestamps = (this.store.get(key) ?? []).filter((t) => now - t < windowMs);
+		if (timestamps.length >= limit) {
+			this.store.set(key, timestamps);
+			return {
+				allowed: false,
+				remaining: 0,
+				retryAfterMs: Math.max(0, timestamps[0] + windowMs - now)
+			};
+		}
+		timestamps.push(now);
+		this.store.set(key, timestamps);
+		return {
+			allowed: true,
+			remaining: limit - timestamps.length,
+			retryAfterMs: 0
+		};
+	}
+	sweep(windowMs) {
+		const now = Date.now();
+		for (const [key, timestamps] of this.store.entries()) {
+			const live = timestamps.filter((t) => now - t < windowMs);
+			if (live.length === 0) this.store.delete(key);
+			else this.store.set(key, live);
+		}
+	}
+	dispose() {
+		if (this.cleanupInterval) clearInterval(this.cleanupInterval);
+		this.cleanupInterval = void 0;
+		this.store.clear();
+	}
+};
+//#endregion
 //#region src/auth/rate-limiter.ts
 /**
+* Resolve the number of trusted proxy hops from an explicit option, the
+* `TRUSTED_PROXY_HOPS` env var, or the default of 1.
+*/
+function resolveTrustedProxyHops(optionValue) {
+	if (typeof optionValue === "number" && Number.isFinite(optionValue) && optionValue >= 0) return Math.floor(optionValue);
+	const fromEnv = Number(process.env.TRUSTED_PROXY_HOPS);
+	if (Number.isFinite(fromEnv) && fromEnv >= 0) return Math.floor(fromEnv);
+	return 1;
+}
+/**
 * Create a rate-limiting middleware.
 *
-* Uses a sliding window algorithm: only timestamps within the last
-* `windowMs` milliseconds are counted. Old entries are garbage-collected
-* every `windowMs` to prevent unbounded memory growth.
+* Uses a sliding window: only hits within the last `windowMs` are counted.
 */
 function createRateLimiter(options = {}) {
-	const { windowMs = 900 * 1e3, limit = 100, keyGenerator = defaultKeyGenerator, message = "Too many requests, please try again later." } = options;
-	const store = /* @__PURE__ */ new Map();
-	const cleanupInterval = setInterval(() => {
-		const now = Date.now();
-		for (const [key, entry] of store.entries()) {
-			entry.timestamps = entry.timestamps.filter((t) => now - t < windowMs);
-			if (entry.timestamps.length === 0) store.delete(key);
-		}
-	}, windowMs);
-	if (cleanupInterval.unref) cleanupInterval.unref();
+	const trustedProxyHops = resolveTrustedProxyHops(options.trustedProxyHops);
+	const { windowMs = 900 * 1e3, limit = 100, keyGenerator = (c) => defaultKeyGenerator(c, trustedProxyHops), message = "Too many requests, please try again later.", store = new MemoryRateLimitStore(windowMs), resolveLimit } = options;
 	return async (c, next) => {
-		const key = keyGenerator(c);
-		const now = Date.now();
-		let entry = store.get(key);
-		if (!entry) {
-			entry = { timestamps: [] };
-			store.set(key, entry);
-		}
-		entry.timestamps = entry.timestamps.filter((t) => now - t < windowMs);
-		if (entry.timestamps.length >= limit) {
-			const retryAfterMs = entry.timestamps[0] + windowMs - now;
-			const retryAfterSec = Math.ceil(retryAfterMs / 1e3);
+		const effectiveLimit = resolveLimit ? resolveLimit(c) : limit;
+		if (effectiveLimit === null) return next();
+		const activeLimit = effectiveLimit ?? limit;
+		const decision = await store.hit(keyGenerator(c), windowMs, activeLimit);
+		c.header("X-RateLimit-Limit", String(activeLimit));
+		c.header("X-RateLimit-Remaining", String(decision.remaining));
+		if (!decision.allowed) {
+			const retryAfterSec = Math.ceil(decision.retryAfterMs / 1e3);
 			c.header("Retry-After", String(retryAfterSec));
-			c.header("X-RateLimit-Limit", String(limit));
-			c.header("X-RateLimit-Remaining", "0");
-			c.header("X-RateLimit-Reset", String(Math.ceil((now + retryAfterMs) / 1e3)));
+			c.header("X-RateLimit-Reset", String(Math.ceil((Date.now() + decision.retryAfterMs) / 1e3)));
 			return c.json({ error: {
 				message,
 				code: "RATE_LIMITED"
 			} }, 429);
 		}
-		entry.timestamps.push(now);
-		c.header("X-RateLimit-Limit", String(limit));
-		c.header("X-RateLimit-Remaining", String(limit - entry.timestamps.length));
 		return next();
 	};
 }
 /**
 * Default key generator: extract client IP from standard headers.
+*
+* `X-Forwarded-For` is a client-writable header; only the entries appended by
+* trusted reverse proxies can be believed. With `trustedProxyHops` proxies in
+* front, each appends the address it saw, so the real client IP is the
+* `trustedProxyHops`-th entry from the right — everything further left is
+* client-supplied and must be ignored. This is what prevents a caller from
+* spoofing `X-Forwarded-For` to spread its requests across many rate-limit keys.
+*
+* With `trustedProxyHops === 0` (server exposed directly, no proxy),
+* `X-Forwarded-For` is not trusted at all and `X-Real-IP` is used instead.
 */
-function defaultKeyGenerator(c) {
-	const forwardedFor = c.req.header("x-forwarded-for");
-	if (forwardedFor) {
-		const ips = forwardedFor.split(",");
-		return ips[ips.length - 1].trim();
+function defaultKeyGenerator(c, trustedProxyHops = resolveTrustedProxyHops()) {
+	if (trustedProxyHops > 0) {
+		const forwardedFor = c.req.header("x-forwarded-for");
+		if (forwardedFor) {
+			const ips = forwardedFor.split(",").map((s) => s.trim()).filter(Boolean);
+			if (ips.length > 0) return ips[Math.max(0, ips.length - trustedProxyHops)];
+		}
 	}
 	return c.req.header("x-real-ip") || "unknown";
 }
@@ -5445,54 +5916,65 @@ function apiKeyKeyGenerator(c) {
 	return defaultKeyGenerator(c);
 }
 /**
+* Rate limiting for the data API.
+*
+* Every request is in exactly one bucket, resolved most-specific first: an API
+* key by its id, a signed-in user by their uid, anyone else by IP. Previously
+* only the first of those was limited at all — the middleware returned early
+* for any request without an API key — so JWT and anonymous traffic to
+* `/api/data/*` was unbounded, which is most of the traffic a BaaS gets.
+*
+* Per bucket, not per route: the point is to bound what one caller costs, and
+* they can spend it wherever they like.
+*
+* The defaults are deliberately loose. This is a floor against a runaway client
+* or a naive scraper, not a quota — a deployment that wants real quotas should
+* set them, and one that already has a proxy doing this should pass
+* `enabled: false` rather than pay for it twice.
+*/
+function createDataRateLimiter(config = {}) {
+	const { windowMs = 900 * 1e3, apiKey: apiKeyLimit = 1e3, user: userLimit = 1e3, anonymous: anonLimit = 300, store = new MemoryRateLimitStore(windowMs) } = config;
+	return createRateLimiter({
+		windowMs,
+		store,
+		message: "Too many requests, please try again later.",
+		keyGenerator: (c) => {
+			const key = c.get("apiKey");
+			if (key) return `api-key:${key.id}`;
+			const user = c.get("user");
+			if (user?.uid && user.uid !== "anon") return `user:${user.uid}`;
+			return `ip:${defaultKeyGenerator(c)}`;
+		},
+		resolveLimit: (c) => {
+			const key = c.get("apiKey");
+			if (key) return key.rate_limit ?? apiKeyLimit;
+			const user = c.get("user");
+			if (user?.uid && user.uid !== "anon") return userLimit;
+			return anonLimit;
+		}
+	});
+}
+/**
 * Create a rate limiter specifically for API key requests.
 *
-* When a request is authenticated via an API key that has a `rate_limit`
-* configured, this limiter enforces per-key limits using the key's ID
-* as the rate limit bucket.
+* @deprecated Use {@link createDataRateLimiter}, which limits signed-in users
+* and anonymous callers too. This one skips every request that is not
+* API-key-authenticated, which was most of them.
 *
 * @param defaultLimit - Fallback limit when the key has no `rate_limit` set.
 * @param windowMs     - Time window in milliseconds (default: 15 minutes).
 */
 function createApiKeyRateLimiter(defaultLimit = 1e3, windowMs = 900 * 1e3) {
-	const store = /* @__PURE__ */ new Map();
-	const cleanupInterval = setInterval(() => {
-		const now = Date.now();
-		for (const [key, entry] of store.entries()) {
-			entry.timestamps = entry.timestamps.filter((t) => now - t < windowMs);
-			if (entry.timestamps.length === 0) store.delete(key);
-		}
-	}, windowMs);
-	if (cleanupInterval.unref) cleanupInterval.unref();
-	return async (c, next) => {
-		const apiKey = c.get("apiKey");
-		if (!apiKey) return next();
-		const limit = apiKey.rate_limit ?? defaultLimit;
-		const key = `api-key:${apiKey.id}`;
-		const now = Date.now();
-		let entry = store.get(key);
-		if (!entry) {
-			entry = { timestamps: [] };
-			store.set(key, entry);
-		}
-		entry.timestamps = entry.timestamps.filter((t) => now - t < windowMs);
-		if (entry.timestamps.length >= limit) {
-			const retryAfterMs = entry.timestamps[0] + windowMs - now;
-			const retryAfterSec = Math.ceil(retryAfterMs / 1e3);
-			c.header("Retry-After", String(retryAfterSec));
-			c.header("X-RateLimit-Limit", String(limit));
-			c.header("X-RateLimit-Remaining", "0");
-			c.header("X-RateLimit-Reset", String(Math.ceil((now + retryAfterMs) / 1e3)));
-			return c.json({ error: {
-				message: "API key rate limit exceeded, please try again later.",
-				code: "RATE_LIMITED"
-			} }, 429);
+	return createRateLimiter({
+		windowMs,
+		message: "API key rate limit exceeded, please try again later.",
+		keyGenerator: apiKeyKeyGenerator,
+		resolveLimit: (c) => {
+			const apiKey = c.get("apiKey");
+			if (!apiKey) return null;
+			return apiKey.rate_limit ?? defaultLimit;
 		}
-		entry.timestamps.push(now);
-		c.header("X-RateLimit-Limit", String(limit));
-		c.header("X-RateLimit-Remaining", String(limit - entry.timestamps.length));
-		return next();
-	};
+	});
 }
 //#endregion
 //#region ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/core/core.js
@@ -9319,7 +9801,7 @@ function mountMfaRoutes(router, config, ops, parseBody, applyTransformHook) {
 		const body = await c.req.json().catch(() => ({}));
 		const friendlyName = typeof body.friendlyName === "string" ? body.friendlyName : void 0;
 		const issuer = typeof body.issuer === "string" ? body.issuer : emailConfig?.appName || "Rebase";
-		const user = await authRepo.getUserById(userCtx.userId);
+		const user = await authRepo.getUserById(userCtx.uid);
 		if (!user) throw ApiError.notFound("User not found");
 		const { secret, uri } = generateTotpSecret(issuer, user.email);
 		const encryptedSecret = encryptTotpSecret(secret);
@@ -9353,7 +9835,7 @@ function mountMfaRoutes(router, config, ops, parseBody, applyTransformHook) {
 			code: string().length(6, "Code must be 6 digits")
 		}), await c.req.json());
 		const factor = await authRepo.getMfaFactorById(factorId);
-		if (!factor || factor.userId !== userCtx.userId) throw ApiError.notFound("MFA factor not found");
+		if (!factor || factor.uid !== userCtx.uid) throw ApiError.notFound("MFA factor not found");
 		if (factor.verified) throw ApiError.badRequest("Factor is already verified", "ALREADY_VERIFIED");
 		if (!verifyTotp(base32Decode(decryptTotpSecret(factor.secretEncrypted)), code)) throw ApiError.unauthorized("Invalid TOTP code", "INVALID_CODE");
 		await authRepo.verifyMfaFactor(factorId);
@@ -9371,7 +9853,7 @@ function mountMfaRoutes(router, config, ops, parseBody, applyTransformHook) {
 		if (!userCtx) throw ApiError.unauthorized("Not authenticated");
 		const { factorId } = parseBody(object({ factorId: string().min(1, "Factor ID is required") }), await c.req.json());
 		const factor = await authRepo.getMfaFactorById(factorId);
-		if (!factor || factor.userId !== userCtx.userId) throw ApiError.notFound("MFA factor not found");
+		if (!factor || factor.uid !== userCtx.uid) throw ApiError.notFound("MFA factor not found");
 		if (!factor.verified) throw ApiError.badRequest("MFA factor is not yet verified", "FACTOR_NOT_VERIFIED");
 		const ipAddress = c.req.header("x-forwarded-for") || "unknown";
 		const challenge = await authRepo.createMfaChallenge(factorId, ipAddress);
@@ -9395,19 +9877,19 @@ function mountMfaRoutes(router, config, ops, parseBody, applyTransformHook) {
 		const challenge = await authRepo.getMfaChallengeById(challengeId);
 		if (!challenge) throw ApiError.badRequest("Invalid or expired challenge", "INVALID_CHALLENGE");
 		const factor = await authRepo.getMfaFactorById(challenge.factorId);
-		if (!factor || factor.userId !== userCtx.userId) throw ApiError.notFound("MFA factor not found");
+		if (!factor || factor.uid !== userCtx.uid) throw ApiError.notFound("MFA factor not found");
 		let isValid = verifyTotp(base32Decode(decryptTotpSecret(factor.secretEncrypted)), code);
 		if (!isValid) {
 			const codeHash = hashRecoveryCode(code);
-			isValid = await authRepo.useRecoveryCode(userCtx.userId, codeHash);
+			isValid = await authRepo.useRecoveryCode(userCtx.uid, codeHash);
 		}
 		if (!isValid) throw ApiError.unauthorized("Invalid verification code", "INVALID_CODE");
 		await authRepo.verifyMfaChallenge(challengeId);
-		const roleIds = (await authRepo.getUserRoles(userCtx.userId)).map((r) => r.id);
-		const accessToken = generateAccessToken(userCtx.userId, roleIds, "aal2");
+		const roleIds = (await authRepo.getUserRoles(userCtx.uid)).map((r) => r.id);
+		const accessToken = generateAccessToken(userCtx.uid, roleIds, "aal2");
 		const refreshToken = generateRefreshToken();
-		await authRepo.createRefreshToken(userCtx.userId, hashRefreshToken(refreshToken), getRefreshTokenExpiry(), c.req.header("user-agent") || "unknown", c.req.header("x-forwarded-for") || "unknown");
-		if (ops.onMfaVerified) ops.onMfaVerified(userCtx.userId, factor.id).catch((err) => {
+		await authRepo.createRefreshToken(userCtx.uid, hashRefreshToken(refreshToken), getRefreshTokenExpiry(), c.req.header("user-agent") || "unknown", c.req.header("x-forwarded-for") || "unknown");
+		if (ops.onMfaVerified) ops.onMfaVerified(userCtx.uid, factor.id).catch((err) => {
 			logger.error("[AuthHooks] onMfaVerified error", { error: err instanceof Error ? err.message : err });
 		});
 		let mfaResponse = { tokens: {
@@ -9415,7 +9897,7 @@ function mountMfaRoutes(router, config, ops, parseBody, applyTransformHook) {
 			refreshToken,
 			accessTokenExpiresAt: getAccessTokenExpiry()
 		} };
-		if (applyTransformHook) mfaResponse = await applyTransformHook(mfaResponse, "mfa", c.req.raw, userCtx.userId);
+		if (applyTransformHook) mfaResponse = await applyTransformHook(mfaResponse, "mfa", c.req.raw, userCtx.uid);
 		return c.json(mfaResponse);
 	});
 	/**
@@ -9425,7 +9907,7 @@ function mountMfaRoutes(router, config, ops, parseBody, applyTransformHook) {
 	router.get("/mfa/factors", requireAuth, async (c) => {
 		const userCtx = c.get("user");
 		if (!userCtx) throw ApiError.unauthorized("Not authenticated");
-		const factors = await authRepo.getMfaFactors(userCtx.userId);
+		const factors = await authRepo.getMfaFactors(userCtx.uid);
 		return c.json({ factors: factors.map((f) => ({
 			id: f.id,
 			factorType: f.factorType,
@@ -9444,9 +9926,9 @@ function mountMfaRoutes(router, config, ops, parseBody, applyTransformHook) {
 		if (userCtx.aal !== "aal2") throw ApiError.forbidden("MFA verification required to unenroll. Please re-authenticate with your second factor.", "AAL2_REQUIRED");
 		const { factorId } = parseBody(object({ factorId: string().min(1, "Factor ID is required") }), await c.req.json());
 		const factor = await authRepo.getMfaFactorById(factorId);
-		if (!factor || factor.userId !== userCtx.userId) throw ApiError.notFound("MFA factor not found");
-		await authRepo.deleteMfaFactor(factorId, userCtx.userId);
-		if (!await authRepo.hasVerifiedMfaFactors(userCtx.userId)) await authRepo.deleteAllRecoveryCodes(userCtx.userId);
+		if (!factor || factor.uid !== userCtx.uid) throw ApiError.notFound("MFA factor not found");
+		await authRepo.deleteMfaFactor(factorId, userCtx.uid);
+		if (!await authRepo.hasVerifiedMfaFactors(userCtx.uid)) await authRepo.deleteAllRecoveryCodes(userCtx.uid);
 		return c.json({
 			success: true,
 			message: "MFA factor removed"
@@ -9548,9 +10030,9 @@ function mountSessionRoutes(opts) {
 		clearRefreshCookie(c, config.cookieAuth);
 		const authHeader = c.req.header("authorization");
 		if (ops.afterLogout && authHeader?.startsWith("Bearer ")) {
-			const { verifyAccessToken } = await import("./jwt-BwIn8xmk.js").then((n) => n.c);
+			const { verifyAccessToken } = await import("./jwt-B3zjddCa.js").then((n) => n.c);
 			const payload = verifyAccessToken(authHeader.substring(7));
-			if (payload) ops.afterLogout(payload.userId).catch((err) => {
+			if (payload) ops.afterLogout(payload.uid).catch((err) => {
 				logger.error("[AuthHooks] afterLogout error", { error: err instanceof Error ? err.message : err });
 			});
 		}
@@ -9565,7 +10047,7 @@ function mountSessionRoutes(opts) {
 		if (!userCtx) throw ApiError.unauthorized("Not authenticated");
 		const currentRefreshToken = c.req.header("x-refresh-token");
 		const currentTokenHash = currentRefreshToken ? hashRefreshToken(currentRefreshToken) : null;
-		const mappedSessions = (await authRepo.listRefreshTokensForUser(userCtx.userId)).map((s) => ({
+		const mappedSessions = (await authRepo.listRefreshTokensForUser(userCtx.uid)).map((s) => ({
 			id: s.id,
 			userAgent: s.userAgent,
 			ipAddress: s.ipAddress,
@@ -9581,7 +10063,7 @@ function mountSessionRoutes(opts) {
 	router.delete("/sessions", requireAuth, async (c) => {
 		const userCtx = c.get("user");
 		if (!userCtx) throw ApiError.unauthorized("Not authenticated");
-		await authRepo.deleteAllRefreshTokensForUser(userCtx.userId);
+		await authRepo.deleteAllRefreshTokensForUser(userCtx.uid);
 		return c.json({
 			success: true,
 			message: "All sessions revoked successfully"
@@ -9596,7 +10078,7 @@ function mountSessionRoutes(opts) {
 		if (!userCtx) throw ApiError.unauthorized("Not authenticated");
 		const id = c.req.param("id");
 		if (!id) throw ApiError.badRequest("Session ID is required", "INVALID_INPUT");
-		await authRepo.deleteRefreshTokenById(id, userCtx.userId);
+		await authRepo.deleteRefreshTokenById(id, userCtx.uid);
 		return c.json({
 			success: true,
 			message: "Session revoked successfully"
@@ -9609,7 +10091,7 @@ function mountSessionRoutes(opts) {
 	router.get("/me", requireAuth, async (c) => {
 		const userCtx = c.get("user");
 		if (!userCtx) throw ApiError.unauthorized("Not authenticated");
-		const result = await authRepo.getUserWithRoles(userCtx.userId);
+		const result = await authRepo.getUserWithRoles(userCtx.uid);
 		if (!result) throw ApiError.notFound("User not found");
 		return c.json({ user: {
 			uid: result.user.id,
@@ -9649,11 +10131,11 @@ function mountSessionRoutes(opts) {
 		const userCtx = c.get("user");
 		if (!userCtx) throw ApiError.unauthorized("Not authenticated");
 		const { displayName, photoURL } = parseBody(updateProfileSchema, await c.req.json());
-		if (!await authRepo.updateUser(userCtx.userId, {
+		if (!await authRepo.updateUser(userCtx.uid, {
 			displayName: displayName !== void 0 ? displayName : void 0,
 			photoUrl: photoURL !== void 0 ? photoURL : void 0
 		})) throw ApiError.notFound("User not found");
-		const result = await authRepo.getUserWithRoles(userCtx.userId);
+		const result = await authRepo.getUserWithRoles(userCtx.uid);
 		if (!result) throw ApiError.notFound("User not found");
 		return c.json({ user: {
 			uid: result.user.id,
@@ -9715,7 +10197,7 @@ function mountSessionRoutes(opts) {
 	router.post("/anonymous/link", requireAuth, async (c) => {
 		const userCtx = c.get("user");
 		if (!userCtx) throw ApiError.unauthorized("Not authenticated");
-		const user = await authRepo.getUserById(userCtx.userId);
+		const user = await authRepo.getUserById(userCtx.uid);
 		if (!user?.isAnonymous) throw ApiError.badRequest("User is not anonymous", "NOT_ANONYMOUS");
 		const { email, password } = parseBody(linkSchema, await c.req.json());
 		const passwordValidation = ops.validatePasswordStrength(password);
@@ -9804,7 +10286,7 @@ function mountMagicLinkRoutes(deps) {
 		const storedToken = await authRepo.findValidMagicLinkToken(tokenHash);
 		if (!storedToken) throw ApiError.badRequest("Invalid or expired magic link", "INVALID_TOKEN");
 		await authRepo.markMagicLinkTokenUsed(tokenHash);
-		const user = await authRepo.getUserById(storedToken.userId);
+		const user = await authRepo.getUserById(storedToken.uid);
 		if (!user) throw ApiError.badRequest("Invalid or expired magic link", "INVALID_TOKEN");
 		if (!user.emailVerified) {
 			await authRepo.setEmailVerified(user.id, true);
@@ -9862,11 +10344,11 @@ function createAuthRoutes(config) {
 	* Errors are caught and logged — the untransformed response is returned
 	* as a graceful fallback so auth never breaks due to a hook failure.
 	*/
-	async function applyTransformHook(response, method, request, userId) {
+	async function applyTransformHook(response, method, request, uid) {
 		if (!ops.transformAuthResponse) return response;
 		try {
 			return await ops.transformAuthResponse(response, {
-				userId,
+				uid,
 				method,
 				request
 			});
@@ -9893,7 +10375,7 @@ function createAuthRoutes(config) {
 		oldPassword: string().min(1, "Old password is required").max(128),
 		newPassword: string().min(1, "New password is required").max(128)
 	});
-	const refreshSchema = object({ refreshToken: config.cookieAuth ? string().optional() : string().min(1, "Refresh token is required") });
+	const refreshSchema = object({ refreshToken: string().min(1).optional() });
 	object({ refreshToken: string().optional() });
 	object({
 		displayName: string().max(255).optional(),
@@ -9944,23 +10426,23 @@ function createAuthRoutes(config) {
 	/**
 	* Helper to generate and store session tokens
 	*/
-	async function createSessionAndTokens(userId, userAgent, ipAddress) {
-		const roleIds = (await authRepo.getUserRoles(userId)).map((r) => r.id);
+	async function createSessionAndTokens(uid, userAgent, ipAddress) {
+		const roleIds = (await authRepo.getUserRoles(uid)).map((r) => r.id);
 		let customClaims;
 		if (ops.customizeAccessToken) {
-			const user = await authRepo.getUserById(userId);
+			const user = await authRepo.getUserById(uid);
 			if (user) {
 				const defaultClaims = {
-					userId,
+					uid,
 					roles: roleIds,
 					aal: "aal1"
 				};
 				customClaims = await ops.customizeAccessToken(defaultClaims, user);
 			}
 		}
-		const accessToken = generateAccessToken(userId, roleIds, "aal1", customClaims);
+		const accessToken = generateAccessToken(uid, roleIds, "aal1", customClaims);
 		const refreshToken = generateRefreshToken();
-		await authRepo.createRefreshToken(userId, hashRefreshToken(refreshToken), getRefreshTokenExpiry(), userAgent, ipAddress);
+		await authRepo.createRefreshToken(uid, hashRefreshToken(refreshToken), getRefreshTokenExpiry(), userAgent, ipAddress);
 		return {
 			roleIds,
 			accessToken,
@@ -10024,7 +10506,7 @@ function createAuthRoutes(config) {
 				logger.warn("[Security Audit] Auth login failure", {
 					eventType: "auth.login.failure",
 					email,
-					userId: user.id
+					uid: user.id
 				});
 				throw ApiError.unauthorized("Invalid email or password", "INVALID_CREDENTIALS");
 			}
@@ -10035,7 +10517,7 @@ function createAuthRoutes(config) {
 		});
 		logger.info("[Security Audit] Auth login success", {
 			eventType: "auth.login.success",
-			userId: user.id,
+			uid: user.id,
 			email
 		});
 		const finalResponse = redactRefreshToken(await applyTransformHook(buildAuthResponse(user, roleIds, accessToken, refreshToken, "password"), "login", c.req.raw, user.id), c, refreshToken, config.cookieAuth);
@@ -10044,54 +10526,101 @@ function createAuthRoutes(config) {
 	/**
 	* Dynamically mount OAuth provider routes
 	*/
-	if (config.oauthProviders && config.oauthProviders.length > 0) for (const provider of config.oauthProviders) router.post(`/${provider.id}`, defaultAuthLimiter, async (c) => {
-		const payload = parseBody(provider.schema, await c.req.json());
-		let externalUser;
-		try {
-			externalUser = await provider.verify(payload);
-		} catch (err) {
-			const msg = err instanceof Error ? err.message : String(err);
-			throw ApiError.unauthorized(`${provider.id} login failed: ${msg}`, "OAUTH_ERROR");
-		}
-		if (!externalUser) throw ApiError.unauthorized(`Invalid ${provider.id} credentials`, "INVALID_TOKEN");
-		let user = await authRepo.getUserByIdentity(provider.id, externalUser.providerId);
-		if (!user) {
-			user = await authRepo.getUserByEmail(externalUser.email);
-			if (user) {
-				if (!externalUser.emailVerified) throw ApiError.forbidden("Cannot auto-link account: email not verified by the OAuth provider. Please log in with your password first and link the provider from your profile.", "EMAIL_NOT_VERIFIED");
-				await authRepo.linkUserIdentity(user.id, provider.id, externalUser.providerId, { email: externalUser.email });
-				await authRepo.updateUser(user.id, {
-					displayName: user.displayName || externalUser.displayName || void 0,
-					photoUrl: user.photoUrl || externalUser.photoUrl || void 0
-				});
-			} else {
-				user = await authRepo.createUser({
-					email: externalUser.email.toLowerCase(),
-					displayName: externalUser.displayName || void 0,
-					photoUrl: externalUser.photoUrl || void 0
-				});
-				await authRepo.linkUserIdentity(user.id, provider.id, externalUser.providerId, { email: externalUser.email });
-				if (ops.afterUserCreate) try {
-					await ops.afterUserCreate(user);
-				} catch (err) {
-					logger.error("[AuthHooks] afterUserCreate error", { error: err instanceof Error ? err.message : err });
+	if (config.oauthProviders && config.oauthProviders.length > 0) for (const provider of config.oauthProviders) {
+		router.post(`/${provider.id}`, defaultAuthLimiter, async (c) => {
+			const payload = parseBody(provider.schema, await c.req.json());
+			let externalUser;
+			try {
+				externalUser = await provider.verify(payload);
+			} catch (err) {
+				const msg = err instanceof Error ? err.message : String(err);
+				throw ApiError.unauthorized(`${provider.id} login failed: ${msg}`, "OAUTH_ERROR");
+			}
+			if (!externalUser) throw ApiError.unauthorized(`Invalid ${provider.id} credentials`, "INVALID_TOKEN");
+			let user = await authRepo.getUserByIdentity(provider.id, externalUser.providerId);
+			if (!user) {
+				user = await authRepo.getUserByEmail(externalUser.email);
+				if (user) {
+					if (!externalUser.emailVerified) throw ApiError.forbidden(`An account with this email already exists with a different sign-in method. ${provider.id} has not verified this email address, so it cannot be linked automatically. Sign in with your existing method, then POST to /auth/link/${provider.id} to link ${provider.id} to your account.`, "EMAIL_NOT_VERIFIED");
+					await authRepo.linkUserIdentity(user.id, provider.id, externalUser.providerId, { email: externalUser.email });
+					await authRepo.updateUser(user.id, {
+						displayName: user.displayName || externalUser.displayName || void 0,
+						photoUrl: user.photoUrl || externalUser.photoUrl || void 0
+					});
+				} else {
+					user = await authRepo.createUser({
+						email: externalUser.email.toLowerCase(),
+						displayName: externalUser.displayName || void 0,
+						photoUrl: externalUser.photoUrl || void 0
+					});
+					await authRepo.linkUserIdentity(user.id, provider.id, externalUser.providerId, { email: externalUser.email });
+					if (ops.afterUserCreate) try {
+						await ops.afterUserCreate(user);
+					} catch (err) {
+						logger.error("[AuthHooks] afterUserCreate error", { error: err instanceof Error ? err.message : err });
+					}
+					const allUsers = await authRepo.listUsers();
+					if (allUsers.length === 1 && allUsers[0].id === user.id) await authRepo.setUserRoles(user.id, ["admin"]);
+					else if (config.defaultRole) await authRepo.assignDefaultRole(user.id, config.defaultRole);
+					sendWelcomeEmail({
+						email: user.email,
+						displayName: user.displayName
+					});
 				}
-				const allUsers = await authRepo.listUsers();
-				if (allUsers.length === 1 && allUsers[0].id === user.id) await authRepo.setUserRoles(user.id, ["admin"]);
-				else if (config.defaultRole) await authRepo.assignDefaultRole(user.id, config.defaultRole);
-				sendWelcomeEmail({
-					email: user.email,
-					displayName: user.displayName
-				});
+			} else await authRepo.updateUser(user.id, {
+				displayName: externalUser.displayName || user.displayName || void 0,
+				photoUrl: externalUser.photoUrl || user.photoUrl || void 0
+			});
+			const { roleIds, accessToken, refreshToken } = await createSessionAndTokens(user.id, c.req.header("user-agent") || "unknown", c.req.header("x-forwarded-for") || "unknown");
+			const finalResponse = redactRefreshToken(await applyTransformHook(buildAuthResponse(user, roleIds, accessToken, refreshToken, provider.id), "oauth", c.req.raw, user.id), c, refreshToken, config.cookieAuth);
+			return c.json(finalResponse);
+		});
+		/**
+		* POST /auth/link/:provider
+		* Attach an OAuth identity to the *already authenticated* account.
+		*
+		* This is the escape hatch from the `EMAIL_NOT_VERIFIED` rejection
+		* on the sign-in route above, and the way to attach a provider
+		* whose email differs from the account's.
+		*
+		* Note the deliberate asymmetry with sign-in: linking here does
+		* NOT require the provider to have verified the email, and does
+		* not require the emails to match at all. On the sign-in route the
+		* provider's email is the *only* evidence tying the incoming
+		* identity to an existing account, so an unverified address would
+		* let an attacker claim someone else's account. Here the caller
+		* has already proven ownership by holding a valid session, and the
+		* OAuth credential proves control of the provider identity — the
+		* email plays no part in the decision, so its verification status
+		* is irrelevant.
+		*/
+		router.post(`/link/${provider.id}`, defaultAuthLimiter, requireAuth, async (c) => {
+			const userCtx = c.get("user");
+			if (!userCtx) throw ApiError.unauthorized("Not authenticated");
+			const payload = parseBody(provider.schema, await c.req.json());
+			let externalUser;
+			try {
+				externalUser = await provider.verify(payload);
+			} catch (err) {
+				const msg = err instanceof Error ? err.message : String(err);
+				throw ApiError.unauthorized(`${provider.id} link failed: ${msg}`, "OAUTH_ERROR");
 			}
-		} else await authRepo.updateUser(user.id, {
-			displayName: externalUser.displayName || user.displayName || void 0,
-			photoUrl: externalUser.photoUrl || user.photoUrl || void 0
+			if (!externalUser) throw ApiError.unauthorized(`Invalid ${provider.id} credentials`, "INVALID_TOKEN");
+			const identityOwner = await authRepo.getUserByIdentity(provider.id, externalUser.providerId);
+			if (identityOwner && identityOwner.id !== userCtx.uid) throw ApiError.conflict(`That ${provider.id} account is already linked to a different user.`, "IDENTITY_ALREADY_LINKED");
+			if (identityOwner) return c.json({
+				success: true,
+				provider: provider.id,
+				alreadyLinked: true
+			});
+			await authRepo.linkUserIdentity(userCtx.uid, provider.id, externalUser.providerId, { email: externalUser.email });
+			return c.json({
+				success: true,
+				provider: provider.id,
+				alreadyLinked: false
+			});
 		});
-		const { roleIds, accessToken, refreshToken } = await createSessionAndTokens(user.id, c.req.header("user-agent") || "unknown", c.req.header("x-forwarded-for") || "unknown");
-		const finalResponse = redactRefreshToken(await applyTransformHook(buildAuthResponse(user, roleIds, accessToken, refreshToken, provider.id), "oauth", c.req.raw, user.id), c, refreshToken, config.cookieAuth);
-		return c.json(finalResponse);
-	});
+	}
 	/**
 	* POST /auth/forgot-password
 	* Request password reset email
@@ -10143,10 +10672,10 @@ function createAuthRoutes(config) {
 		const storedToken = await authRepo.findValidPasswordResetToken(tokenHash);
 		if (!storedToken) throw ApiError.badRequest("Invalid or expired reset token", "INVALID_TOKEN");
 		const passwordHash = await ops.hashPassword(password);
-		await authRepo.updatePassword(storedToken.userId, passwordHash);
+		await authRepo.updatePassword(storedToken.uid, passwordHash);
 		await authRepo.markPasswordResetTokenUsed(tokenHash);
-		await authRepo.deleteAllRefreshTokensForUser(storedToken.userId);
-		if (ops.onPasswordReset) ops.onPasswordReset(storedToken.userId).catch((err) => {
+		await authRepo.deleteAllRefreshTokensForUser(storedToken.uid);
+		if (ops.onPasswordReset) ops.onPasswordReset(storedToken.uid).catch((err) => {
 			logger.error("[AuthHooks] onPasswordReset error", { error: err instanceof Error ? err.message : err });
 		});
 		return c.json({
@@ -10162,7 +10691,7 @@ function createAuthRoutes(config) {
 		const userCtx = c.get("user");
 		if (!userCtx) throw ApiError.unauthorized("Not authenticated");
 		const { oldPassword, newPassword } = parseBody(changePasswordSchema, await c.req.json());
-		const user = await authRepo.getUserById(userCtx.userId);
+		const user = await authRepo.getUserById(userCtx.uid);
 		if (!user || !user.passwordHash) throw ApiError.badRequest("Cannot change password for this account", "INVALID_ACCOUNT");
 		if (!await ops.verifyPassword(oldPassword, user.passwordHash)) throw ApiError.unauthorized("Current password is incorrect", "INVALID_CREDENTIALS");
 		const passwordValidation = ops.validatePasswordStrength(newPassword);
@@ -10183,7 +10712,7 @@ function createAuthRoutes(config) {
 		const userCtx = c.get("user");
 		if (!userCtx) throw ApiError.unauthorized("Not authenticated");
 		if (!isEmailConfigured()) throw ApiError.serviceUnavailable("Email service not configured. Email verification is not available.", "EMAIL_NOT_CONFIGURED");
-		const user = await authRepo.getUserById(userCtx.userId);
+		const user = await authRepo.getUserById(userCtx.uid);
 		if (!user) throw ApiError.notFound("User not found");
 		if (user.emailVerified) throw ApiError.badRequest("Email is already verified", "ALREADY_VERIFIED");
 		const token = generateSecureToken();
@@ -10229,8 +10758,8 @@ function createAuthRoutes(config) {
 	* Refresh access token using refresh token
 	*/
 	router.post("/refresh", async (c) => {
-		const refreshToken = readRefreshToken(c, parseBody(refreshSchema, await c.req.json()), config.cookieAuth);
-		if (!refreshToken) throw ApiError.badRequest("Refresh token is required", "INVALID_INPUT");
+		const refreshToken = readRefreshToken(c, parseBody(refreshSchema, await c.req.json().catch(() => ({}))), config.cookieAuth);
+		if (!refreshToken) throw ApiError.unauthenticated("No refresh token presented", "NO_SESSION");
 		const tokenHash = hashRefreshToken(refreshToken);
 		const storedToken = await authRepo.findRefreshTokenByHash(tokenHash);
 		if (!storedToken) {
@@ -10242,10 +10771,10 @@ function createAuthRoutes(config) {
 			clearRefreshCookie(c, config.cookieAuth);
 			throw ApiError.unauthorized("Refresh token expired", "TOKEN_EXPIRED");
 		}
-		const roleIds = (await authRepo.getUserRoles(storedToken.userId)).map((r) => r.id);
-		const user = await authRepo.getUserById(storedToken.userId).catch((err) => {
+		const roleIds = (await authRepo.getUserRoles(storedToken.uid)).map((r) => r.id);
+		const user = await authRepo.getUserById(storedToken.uid).catch((err) => {
 			logger.warn("[Auth] Could not load user during token refresh; returning tokens only", {
-				userId: storedToken.userId,
+				uid: storedToken.uid,
 				error: err instanceof Error ? err.message : String(err)
 			});
 			return null;
@@ -10253,18 +10782,18 @@ function createAuthRoutes(config) {
 		let customClaims;
 		if (ops.customizeAccessToken && user) {
 			const defaultClaims = {
-				userId: storedToken.userId,
+				uid: storedToken.uid,
 				roles: roleIds,
 				aal: "aal1"
 			};
 			customClaims = await ops.customizeAccessToken(defaultClaims, user);
 		}
-		const newAccessToken = generateAccessToken(storedToken.userId, roleIds, "aal1", customClaims);
+		const newAccessToken = generateAccessToken(storedToken.uid, roleIds, "aal1", customClaims);
 		const newRefreshToken = generateRefreshToken();
 		const userAgent = c.req.header("user-agent") || "unknown";
 		const ipAddress = c.req.header("x-forwarded-for") || "unknown";
 		await authRepo.deleteRefreshToken(tokenHash);
-		await authRepo.createRefreshToken(storedToken.userId, hashRefreshToken(newRefreshToken), getRefreshTokenExpiry(), userAgent, ipAddress);
+		await authRepo.createRefreshToken(storedToken.uid, hashRefreshToken(newRefreshToken), getRefreshTokenExpiry(), userAgent, ipAddress);
 		const tokensOnlyResponse = { tokens: {
 			accessToken: newAccessToken,
 			refreshToken: newRefreshToken,
@@ -10277,7 +10806,7 @@ function createAuthRoutes(config) {
 			logger.warn("[Auth] Could not build enriched refresh response; returning tokens only", { error: err instanceof Error ? err.message : String(err) });
 			refreshResponse = tokensOnlyResponse;
 		}
-		const finalResponse = redactRefreshToken(await applyTransformHook(refreshResponse, "refresh", c.req.raw, storedToken.userId), c, newRefreshToken, config.cookieAuth);
+		const finalResponse = redactRefreshToken(await applyTransformHook(refreshResponse, "refresh", c.req.raw, storedToken.uid), c, newRefreshToken, config.cookieAuth);
 		return c.json(finalResponse);
 	});
 	mountSessionRoutes({
@@ -10314,7 +10843,7 @@ function createAuthRoutes(config) {
 /**
 * Create a standalone admin route for resetting user passwords.
 *
-* Mounts: POST /users/:userId/reset-password
+* Mounts: POST /users/:uid/reset-password
 */
 function createResetPasswordRoute(config) {
 	const router = new Hono();
@@ -10323,9 +10852,9 @@ function createResetPasswordRoute(config) {
 	const ops = resolveAuthHooks(config.authHooks);
 	router.onError(errorHandler);
 	router.use("/*", createRequireAuth({ serviceKey: config.serviceKey }));
-	router.post("/users/:userId/reset-password", requireAdmin, async (c) => {
-		const userId = c.req.param("userId");
-		const existing = await authRepo.getUserById(userId);
+	router.post("/users/:uid/reset-password", requireAdmin, async (c) => {
+		const uid = c.req.param("uid");
+		const existing = await authRepo.getUserById(uid);
 		if (!existing) throw ApiError.notFound("User not found");
 		let invitationSent = false;
 		let temporaryPassword;
@@ -10439,10 +10968,10 @@ function createAdminRolesRoute(config) {
 *
 * Mounts:
 *   GET /users
-*   GET /users/:userId
+*   GET /users/:uid
 *   POST /users
-*   PUT /users/:userId
-*   DELETE /users/:userId
+*   PUT /users/:uid
+*   DELETE /users/:uid
 *   POST /bootstrap
 */
 function createAdminUsersRoute(config) {
@@ -10477,16 +11006,36 @@ function createAdminUsersRoute(config) {
 			break;
 		}
 		if (hasAdmin) throw ApiError.forbidden("Admin users already exist. Bootstrap not allowed.", "BOOTSTRAP_COMPLETED");
-		const userId = "userId" in user ? user.userId : "uid" in user ? user.uid : void 0;
-		if (!userId) throw ApiError.unauthorized("User ID not found in auth context");
-		if (!await authRepo.getUserById(userId)) throw ApiError.notFound("Authenticated user does not exist in the database.", "USER_NOT_FOUND");
-		await authRepo.setUserRoles(userId, ["admin"]);
+		const uid = "uid" in user ? user.uid : "uid" in user ? user.uid : void 0;
+		if (!uid) throw ApiError.unauthorized("User ID not found in auth context");
+		if (!await authRepo.getUserById(uid)) throw ApiError.notFound("Authenticated user does not exist in the database.", "USER_NOT_FOUND");
+		if (users.length > 0) {
+			const earliest = users.reduce((a, b) => {
+				const at = new Date(a.createdAt).getTime();
+				const bt = new Date(b.createdAt).getTime();
+				if (at !== bt) return at < bt ? a : b;
+				return a.id < b.id ? a : b;
+			});
+			if (earliest.id !== uid) {
+				logger.warn("[Security Audit] Bootstrap denied: caller is not the earliest-registered user", {
+					eventType: "auth.bootstrap.denied",
+					callerId: uid,
+					earliestUserId: earliest.id
+				});
+				throw ApiError.forbidden("Only the first registered user may claim the initial admin role. Ask that user to bootstrap, or assign the admin role using the service key.", "BOOTSTRAP_NOT_FIRST_USER");
+			}
+		}
+		await authRepo.setUserRoles(uid, ["admin"]);
+		logger.info("[Security Audit] Initial admin bootstrapped", {
+			eventType: "auth.bootstrap.success",
+			uid
+		});
 		if (config.setBootstrapCompleted) await config.setBootstrapCompleted();
 		return c.json({
 			success: true,
 			message: "You are now an admin",
 			user: {
-				uid: userId,
+				uid,
 				roles: ["admin"]
 			}
 		});
@@ -10517,9 +11066,9 @@ function createAdminUsersRoute(config) {
 			offset: result.offset
 		});
 	});
-	router.get("/users/:userId", requireAdmin, async (c) => {
-		const userId = c.req.param("userId");
-		const result = await authRepo.getUserWithRoles(userId);
+	router.get("/users/:uid", requireAdmin, async (c) => {
+		const uid = c.req.param("uid");
+		const result = await authRepo.getUserWithRoles(uid);
 		if (!result) throw ApiError.notFound("User not found");
 		const adminUser = toAdminUser(result.user, result.roles.map((r) => r.id));
 		return c.json({ user: adminUser });
@@ -10562,10 +11111,10 @@ function createAdminUsersRoute(config) {
 			...finalizeResult.emailDeliveryFailed ? { emailDeliveryFailed: true } : {}
 		}, 201);
 	});
-	router.put("/users/:userId", requireAdmin, async (c) => {
-		const userId = c.req.param("userId");
+	router.put("/users/:uid", requireAdmin, async (c) => {
+		const uid = c.req.param("uid");
 		const { password, email, displayName, roles } = await c.req.json();
-		if (!await authRepo.getUserById(userId)) throw ApiError.notFound("User not found");
+		if (!await authRepo.getUserById(uid)) throw ApiError.notFound("User not found");
 		const updates = {};
 		if (email !== void 0) updates.email = email.toLowerCase();
 		if (displayName !== void 0) updates.displayName = displayName;
@@ -10574,9 +11123,9 @@ function createAdminUsersRoute(config) {
 			if (!validation.valid) throw ApiError.badRequest(`Password too weak: ${validation.errors.join(". ")}`);
 			updates.passwordHash = await ops.hashPassword(password);
 		}
-		if (Object.keys(updates).length > 0) await authRepo.updateUser(userId, updates);
+		if (Object.keys(updates).length > 0) await authRepo.updateUser(uid, updates);
 		if (roles !== void 0 && Array.isArray(roles)) {
-			const wasAdmin = (await authRepo.getUserRoleIds(userId)).includes("admin");
+			const wasAdmin = (await authRepo.getUserRoleIds(uid)).includes("admin");
 			const willBeAdmin = roles.includes("admin");
 			if (wasAdmin && !willBeAdmin) {
 				if ((await authRepo.listUsersPaginated({
@@ -10584,24 +11133,23 @@ function createAdminUsersRoute(config) {
 					limit: 1
 				})).total <= 1) throw ApiError.forbidden("Cannot demote the last administrator", "LAST_ADMIN");
 			}
-			await authRepo.setUserRoles(userId, roles);
+			await authRepo.setUserRoles(uid, roles);
 		}
-		const result = await authRepo.getUserWithRoles(userId);
+		const result = await authRepo.getUserWithRoles(uid);
 		const adminUser = toAdminUser(result.user, result.roles.map((r) => r.id));
 		return c.json({ user: adminUser });
 	});
-	router.delete("/users/:userId", requireAdmin, async (c) => {
-		const userId = c.req.param("userId");
-		const authUser = c.get("user");
-		if ((authUser?.uid || authUser?.userId) === userId) throw ApiError.badRequest("Cannot delete your own account", "SELF_DELETE");
-		if (!await authRepo.getUserById(userId)) throw ApiError.notFound("User not found");
-		if ((await authRepo.getUserRoleIds(userId)).includes("admin")) {
+	router.delete("/users/:uid", requireAdmin, async (c) => {
+		const uid = c.req.param("uid");
+		if (c.get("user")?.uid === uid) throw ApiError.badRequest("Cannot delete your own account", "SELF_DELETE");
+		if (!await authRepo.getUserById(uid)) throw ApiError.notFound("User not found");
+		if ((await authRepo.getUserRoleIds(uid)).includes("admin")) {
 			if ((await authRepo.listUsersPaginated({
 				roleId: "admin",
 				limit: 1
 			})).total <= 1) throw ApiError.forbidden("Cannot delete the last administrator", "LAST_ADMIN");
 		}
-		await authRepo.deleteUser(userId);
+		await authRepo.deleteUser(uid);
 		return c.json({ success: true });
 	});
 	return router;
@@ -10623,10 +11171,8 @@ function createBuiltinAuthAdapter(config) {
 		serviceKey,
 		async verifyRequest(request) {
 			const authHeader = request.headers.get("authorization");
-			const queryToken = new URL(request.url, "http://localhost").searchParams.get("token");
-			const hasBearer = authHeader?.startsWith("Bearer ");
-			if (!hasBearer && !queryToken) return null;
-			const token = hasBearer ? authHeader.substring(7) : queryToken;
+			if (!authHeader?.startsWith("Bearer ")) return null;
+			const token = authHeader.substring(7);
 			if (serviceKey && safeCompare(token, serviceKey)) return {
 				uid: "service",
 				email: "service@rebase.internal",
@@ -10638,16 +11184,16 @@ function createBuiltinAuthAdapter(config) {
 			if (!payload) return null;
 			let roles = payload.roles || [];
 			try {
-				roles = await authRepository.getUserRoleIds(payload.userId);
+				roles = await authRepository.getUserRoleIds(payload.uid);
 			} catch (err) {
 				logger.warn("Role lookup from repository failed, using token roles as fallback", {
-					userId: payload.userId,
+					uid: payload.uid,
 					error: err
 				});
 			}
 			const isAdmin = roles.some((r) => r === "admin" || r === "schema-admin");
 			return {
-				uid: payload.userId,
+				uid: payload.uid,
 				email: payload.email ?? "",
 				displayName: payload.displayName ?? null,
 				roles,
@@ -10667,16 +11213,16 @@ function createBuiltinAuthAdapter(config) {
 			if (!payload) return null;
 			let roles = payload.roles || [];
 			try {
-				roles = await authRepository.getUserRoleIds(payload.userId);
+				roles = await authRepository.getUserRoleIds(payload.uid);
 			} catch (err) {
 				logger.warn("Role lookup from repository failed, using token roles as fallback", {
-					userId: payload.userId,
+					uid: payload.uid,
 					error: err
 				});
 			}
 			const isAdmin = roles.some((r) => r === "admin" || r === "schema-admin");
 			return {
-				uid: payload.userId,
+				uid: payload.uid,
 				email: payload.email ?? "",
 				displayName: payload.displayName ?? null,
 				roles,
@@ -10735,6 +11281,16 @@ function createBuiltinAuthAdapter(config) {
 				collectionAuthConfig: collectionAuth ?? collectionAuthConfig
 			});
 		},
+		describeUserCreationContract(collectionAuth) {
+			if ((collectionAuth ?? collectionAuthConfig)?.onCreateUser || resolvedOps.onAdminCreateUser) return {
+				validate: false,
+				extraFields: []
+			};
+			return {
+				validate: true,
+				extraFields: ["password"]
+			};
+		},
 		async finalizeUserCreation(entity, clearPassword) {
 			return finalizeAdminUserCreation(entity, clearPassword, {
 				authRepo: authRepository,
@@ -10824,11 +11380,11 @@ function createUserManagementFromRepo(repo, resolvedOps) {
 				logger.error("[AuthHooks] afterUserDelete error", { error: err instanceof Error ? err.message : err });
 			});
 		},
-		async getUserRoles(userId) {
-			return repo.getUserRoleIds(userId);
+		async getUserRoles(uid) {
+			return repo.getUserRoleIds(uid);
 		},
-		async setUserRoles(userId, roleIds) {
-			await repo.setUserRoles(userId, roleIds);
+		async setUserRoles(uid, roleIds) {
+			await repo.setUserRoles(uid, roleIds);
 		}
 	};
 }
@@ -10863,6 +11419,33 @@ function configureLogLevel(logLevel) {
 	if (currentLevel < 0) console.error = () => {};
 }
 //#endregion
+//#region src/utils/compression.ts
+/**
+* Response compression (gzip/deflate), negotiated from `Accept-Encoding`.
+*
+* Wraps Hono's `compress` with two corrections it does not make itself:
+*
+* - **`Vary: Accept-Encoding`** on every response it guards. Without it a shared
+*   cache may hand a gzipped body to a client that asked for identity.
+* - **Range responses are left alone.** `Content-Range` describes offsets into
+*   the identity body, so compressing a 206 desyncs the framing from the bytes
+*   actually sent.
+*
+* No brotli: `CompressionStream` has no "br", so a br-only client would fall
+* back to identity — every real client sends gzip too.
+*/
+function responseCompression() {
+	const gzip = compress();
+	return async (c, next) => {
+		await next();
+		const vary = c.res.headers.get("Vary");
+		if (!vary) c.res.headers.set("Vary", "Accept-Encoding");
+		else if (!/\baccept-encoding\b/i.test(vary)) c.res.headers.append("Vary", "Accept-Encoding");
+		if (c.res.status === 206 || c.res.headers.has("Content-Range")) return;
+		await gzip(c, async () => {});
+	};
+}
+//#endregion
 //#region src/utils/request-id.ts
 /**
 * X-Request-ID Middleware for Hono.
@@ -10917,36 +11500,133 @@ function requestLogger(options) {
 		const reqId = c.get("requestId");
 		if (reqId) data.requestId = reqId;
 		if (contentLength) data.contentLength = parseInt(contentLength, 10);
-		const userId = c.get("userId");
-		if (userId) data.userId = userId;
+		const uid = c.get("user")?.uid;
+		if (uid) data.uid = uid;
 		if (status >= 500) logger.error("request", data);
 		else if (status >= 400) logger.warn("request", data);
 		else logger.info("request", data);
 	};
 }
 //#endregion
-//#region src/init/middlewares.ts
-function configureMiddlewares(app, basePath, isProduction, config) {
-	app.use(`${basePath}/*`, requestId());
-	const maxBodySize = config.maxBodySize ?? 10 * 1024 * 1024;
-	if (maxBodySize > 0) {
-		app.use(`${basePath}/*`, bodyLimit({
-			maxSize: maxBodySize,
-			onError: (c) => {
-				return c.json({ error: {
-					message: `Request body too large. Maximum size is ${Math.round(maxBodySize / 1024 / 1024)}MB.`,
-					code: "PAYLOAD_TOO_LARGE"
-				} }, 413);
-			}
-		}));
-		logger.info("Request body limit configured", { maxSizeMB: Math.round(maxBodySize / 1024 / 1024) });
-	}
-	if (config.csrf?.origin) {
-		app.use(`${basePath}/*`, csrf({ origin: config.csrf.origin }));
-		logger.info("CSRF protection enabled");
+//#region src/api/logs-routes.ts
+var logs_routes_exports = /* @__PURE__ */ __exportAll({
+	addLog: () => addLog,
+	default: () => app,
+	logBuffer: () => logBuffer,
+	logMiddleware: () => logMiddleware
+});
+var LogRingBuffer = class {
+	buffer = [];
+	maxSize;
+	idCounter = 0;
+	constructor(maxSize = 1e4) {
+		this.maxSize = maxSize;
+	}
+	push(entry) {
+		const id = `log_${++this.idCounter}`;
+		this.buffer.push({
+			...entry,
+			id
+		});
+		if (this.buffer.length > this.maxSize) this.buffer.shift();
+	}
+	query(options) {
+		let filtered = this.buffer;
+		if (options.level) filtered = filtered.filter((e) => e.level === options.level);
+		if (options.source) filtered = filtered.filter((e) => e.source === options.source);
+		if (options.search) {
+			const searchLower = options.search.toLowerCase();
+			filtered = filtered.filter((e) => e.message.toLowerCase().includes(searchLower));
+		}
+		if (options.since) {
+			const sinceValue = options.since;
+			filtered = filtered.filter((e) => e.timestamp >= sinceValue);
+		}
+		const sorted = [...filtered].reverse();
+		const total = sorted.length;
+		const limit = options.limit || 100;
+		const offset = options.offset || 0;
+		return {
+			entries: sorted.slice(offset, offset + limit),
+			total
+		};
+	}
+	getLatest(count = 50) {
+		return this.buffer.slice(-count).reverse();
 	}
-	if (!isProduction && !process.env.CORS_ORIGINS && !process.env.FRONTEND_URL) logger.warn("No CORS configuration detected (CORS_ORIGINS / FRONTEND_URL not set). The API will accept requests from any origin. Set CORS_ORIGINS in your .env file to restrict access.");
+};
+var logBuffer = new LogRingBuffer();
+/** Add a log entry */
+function addLog(level, source, message, metadata) {
+	logBuffer.push({
+		timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+		level,
+		source,
+		message,
+		metadata
+	});
+}
+/** Hono middleware to log API requests */
+function logMiddleware() {
+	return async (c, next) => {
+		const start = Date.now();
+		await next();
+		const duration = Date.now() - start;
+		const reqId = c.get("requestId");
+		addLog("info", "api", `${c.req.method} ${c.req.path} ${c.res.status} ${duration}ms`, {
+			method: c.req.method,
+			path: c.req.path,
+			status: c.res.status,
+			duration,
+			...reqId && { requestId: reqId }
+		});
+	};
+}
+var app = new Hono();
+app.get("/", (c) => {
+	const query = c.req.query();
+	const result = logBuffer.query({
+		level: query.level,
+		source: query.source,
+		search: query.search,
+		limit: query.limit ? parseInt(query.limit) : void 0,
+		offset: query.offset ? parseInt(query.offset) : void 0,
+		since: query.since
+	});
+	return c.json(result);
+});
+app.get("/latest", (c) => {
+	const count = parseInt(c.req.query("count") || "50");
+	return c.json({ entries: logBuffer.getLatest(count) });
+});
+//#endregion
+//#region src/init/middlewares.ts
+function configureMiddlewares(app, basePath, isProduction, config) {
+	app.use(`${basePath}/*`, requestId());
+	if (config.compression !== false) {
+		app.use(`${basePath}/*`, responseCompression());
+		logger.info("Response compression enabled");
+	}
+	const maxBodySize = config.maxBodySize ?? 10 * 1024 * 1024;
+	if (maxBodySize > 0) {
+		app.use(`${basePath}/*`, bodyLimit({
+			maxSize: maxBodySize,
+			onError: (c) => {
+				return c.json({ error: {
+					message: `Request body too large. Maximum size is ${Math.round(maxBodySize / 1024 / 1024)}MB.`,
+					code: "PAYLOAD_TOO_LARGE"
+				} }, 413);
+			}
+		}));
+		logger.info("Request body limit configured", { maxSizeMB: Math.round(maxBodySize / 1024 / 1024) });
+	}
+	if (config.csrf?.origin) {
+		app.use(`${basePath}/*`, csrf({ origin: config.csrf.origin }));
+		logger.info("CSRF protection enabled");
+	}
+	if (!process.env.CORS_ORIGINS && !process.env.FRONTEND_URL) logger.warn((isProduction ? "[PRODUCTION] " : "") + "No CORS configuration detected (CORS_ORIGINS / FRONTEND_URL not set). If your app does not install its own CORS middleware, the API may accept requests from any origin. Set CORS_ORIGINS to restrict access.");
 	app.use(`${basePath}/*`, requestLogger());
+	app.use(`${basePath}/*`, logMiddleware());
 }
 //#endregion
 //#region src/storage/types.ts
@@ -11027,11 +11707,21 @@ var LocalStorageController = class {
 		}
 	}
 	/**
-	* Get the full filesystem path for a storage path.
-	* Includes a path traversal guard to prevent escaping the base directory.
+	* Get the full filesystem path for a storage path, with a traversal guard
+	* that keeps the result inside the bucket directory.
+	*
+	* Defaults the bucket the way `putObject` does.
+	*
+	* `putObject` has always written into `default` when given no bucket, while
+	* the read side resolved a bare key against the storage root — where
+	* nothing is. The two disagreed silently: `getObject` returned null (reads
+	* as "file missing"), `deleteObject` deleted nothing (404s are swallowed by
+	* design), and `listObjects` returned an empty page. So the obvious
+	* `putObject({ key })` → `getObject(key)` did not round-trip and nothing
+	* said why. One default, applied everywhere, removes the whole class.
 	*/
 	getFullPath(storagePath, bucket) {
-		const bucketPath = bucket ? path$1.join(this.basePath, bucket) : this.basePath;
+		const bucketPath = path$1.join(this.basePath, bucket ?? "default");
 		const resolved = path$1.resolve(path$1.join(bucketPath, storagePath));
 		if (!resolved.startsWith(bucketPath + path$1.sep) && resolved !== bucketPath) throw new Error("Path traversal detected: resolved storage path is outside the bucket directory.");
 		return resolved;
@@ -11192,8 +11882,10 @@ var LocalStorageController = class {
 			let count = 0;
 			const maxResults = options?.maxResults ?? 1e3;
 			const startIndex = options?.pageToken ? parseInt(options.pageToken, 10) : 0;
+			let scanned = startIndex;
 			for (let i = startIndex; i < entries.length && count < maxResults; i++) {
 				const entry = entries[i];
+				scanned = i + 1;
 				if (entry.name.endsWith(".metadata.json")) continue;
 				const entryPath = prefix ? `${prefix}/${entry.name}` : entry.name;
 				const bucket = options?.bucket ?? "default";
@@ -11212,7 +11904,7 @@ var LocalStorageController = class {
 			return {
 				items,
 				prefixes,
-				nextPageToken: startIndex + count < entries.length ? String(startIndex + count) : void 0
+				nextPageToken: scanned < entries.length ? String(scanned) : void 0
 			};
 		} catch (error) {
 			const code = error?.code;
@@ -11486,7 +12178,7 @@ var gcsModule = null;
 async function loadGCS() {
 	if (gcsModule) return gcsModule;
 	try {
-		gcsModule = await import("./src-B9tjYmqP.js");
+		gcsModule = await import("@google-cloud/storage");
 		return gcsModule;
 	} catch {
 		throw new Error("Google Cloud Storage is required for the GCS storage controller. Install it with: pnpm add @google-cloud/storage");
@@ -11692,6 +12384,47 @@ async function loadGoogleAuth() {
 	return _googleAuth;
 }
 /**
+* Verify a Google **access token** and resolve it to a profile.
+*
+* SECURITY: an access token must be checked against Google's `tokeninfo`
+* endpoint so we can confirm its `aud` (the OAuth client the token was issued
+* to) matches *our* `clientId`. The `userinfo` endpoint does **not** verify
+* audience — it returns a profile for any valid Google access token — so
+* trusting it alone lets an attacker present a token they obtained for a
+* *different* client (e.g. their own app, via a phished consent) and log in as
+* whatever account that token belongs to. The `aud` check is what binds the
+* token to this application.
+*
+* Identity (`sub` / `email` / `email_verified`) is taken from the
+* audience-checked `tokeninfo` response. `userinfo` is used only, best-effort,
+* to enrich display fields (name, picture).
+*/
+async function verifyGoogleAccessToken(accessToken, expectedClientId) {
+	const tokenInfoRes = await fetch(`https://oauth2.googleapis.com/tokeninfo?access_token=${encodeURIComponent(accessToken)}`);
+	if (!tokenInfoRes.ok) throw new Error(`Google tokeninfo request failed with status ${tokenInfoRes.status}`);
+	const tokenInfo = await tokenInfoRes.json();
+	if (tokenInfo.aud !== expectedClientId) throw new Error("Google access token audience mismatch: the token was not issued for this application");
+	if (!tokenInfo.sub || !tokenInfo.email) throw new Error("Google access token missing sub or email (the email scope is required)");
+	const emailVerified = tokenInfo.email_verified === true || tokenInfo.email_verified === "true";
+	let displayName = null;
+	let photoUrl = null;
+	try {
+		const res = await fetch("https://www.googleapis.com/oauth2/v3/userinfo", { headers: { Authorization: `Bearer ${accessToken}` } });
+		if (res.ok) {
+			const info = await res.json();
+			displayName = info.name || null;
+			photoUrl = info.picture || null;
+		}
+	} catch {}
+	return {
+		providerId: tokenInfo.sub,
+		email: tokenInfo.email,
+		displayName,
+		photoUrl,
+		emailVerified
+	};
+}
+/**
 * Creates a Google OAuth Provider integration.
 *
 * Supports three verification paths:
@@ -11741,22 +12474,10 @@ function createGoogleProvider(config) {
 						email: content.email || "",
 						displayName: content.name || null,
 						photoUrl: content.picture || null,
-						emailVerified: true
-					};
-				}
-				if (payload.accessToken) {
-					const res = await fetch("https://www.googleapis.com/oauth2/v3/userinfo", { headers: { Authorization: `Bearer ${payload.accessToken}` } });
-					if (!res.ok) throw new Error(`Google userinfo request failed with status ${res.status}`);
-					const info = await res.json();
-					if (!info.sub || !info.email) throw new Error("Google userinfo response missing sub or email");
-					return {
-						providerId: info.sub,
-						email: info.email,
-						displayName: info.name || null,
-						photoUrl: info.picture || null,
-						emailVerified: true
+						emailVerified: content.email_verified === true
 					};
 				}
+				if (payload.accessToken) return await verifyGoogleAccessToken(payload.accessToken, clientId);
 				if (payload.code && payload.redirectUri) {
 					if (!clientSecret) throw new Error("Google authorization code flow requires clientSecret. Configure GOOGLE_CLIENT_SECRET in your environment.");
 					const tokenResponse = await fetch("https://oauth2.googleapis.com/token", {
@@ -11787,22 +12508,10 @@ function createGoogleProvider(config) {
 							email: content.email || "",
 							displayName: content.name || null,
 							photoUrl: content.picture || null,
-							emailVerified: true
-						};
-					}
-					if (tokenData.access_token) {
-						const userInfoRes = await fetch("https://www.googleapis.com/oauth2/v3/userinfo", { headers: { Authorization: `Bearer ${tokenData.access_token}` } });
-						if (!userInfoRes.ok) throw new Error(`Google userinfo request failed after code exchange (${userInfoRes.status})`);
-						const info = await userInfoRes.json();
-						if (!info.sub || !info.email) return null;
-						return {
-							providerId: info.sub,
-							email: info.email,
-							displayName: info.name || null,
-							photoUrl: info.picture || null,
-							emailVerified: true
+							emailVerified: content.email_verified === true
 						};
 					}
+					if (tokenData.access_token) return await verifyGoogleAccessToken(tokenData.access_token, clientId);
 					throw new Error("Google token exchange returned neither id_token nor access_token");
 				}
 				throw new Error("No valid Google credential provided (expected idToken, accessToken, or code+redirectUri)");
@@ -11992,12 +12701,13 @@ function createMicrosoftProvider(config) {
 					logger.error("Microsoft user has no email");
 					return null;
 				}
+				const emailVerified = Boolean(profileData.mail);
 				return {
 					providerId: profileData.id,
 					email,
 					displayName: profileData.displayName || null,
 					photoUrl: null,
-					emailVerified: true
+					emailVerified
 				};
 			} catch (error) {
 				logger.error("Microsoft OAuth error", { error });
@@ -12794,7 +13504,7 @@ function createApiKeyRoutes(options) {
 			if (parsed <= /* @__PURE__ */ new Date()) throw ApiError.badRequest("expires_at must be in the future", "INVALID_INPUT");
 		}
 		const user = c.get("user");
-		const createdBy = user && typeof user === "object" && "userId" in user ? user.userId : "unknown";
+		const createdBy = user && typeof user === "object" && "uid" in user ? user.uid : "unknown";
 		const request = {
 			name: name.trim(),
 			permissions,
@@ -12890,6 +13600,7 @@ function createCustomAuthAdapter(options) {
 //#endregion
 //#region src/auth/index.ts
 var auth_exports = /* @__PURE__ */ __exportAll({
+	MemoryRateLimitStore: () => MemoryRateLimitStore,
 	apiKeyKeyGenerator: () => apiKeyKeyGenerator,
 	configureJwt: () => configureJwt,
 	createAdapterAuthMiddleware: () => createAdapterAuthMiddleware,
@@ -12902,6 +13613,7 @@ var auth_exports = /* @__PURE__ */ __exportAll({
 	createBitbucketProvider: () => createBitbucketProvider,
 	createBuiltinAuthAdapter: () => createBuiltinAuthAdapter,
 	createCustomAuthAdapter: () => createCustomAuthAdapter,
+	createDataRateLimiter: () => createDataRateLimiter,
 	createDiscordProvider: () => createDiscordProvider,
 	createFacebookProvider: () => createFacebookProvider,
 	createGitHubProvider: () => createGitHubProvider,
@@ -13143,12 +13855,14 @@ var UPLOAD_EXPIRY_MS = 1440 * 60 * 1e3;
 var TusHandler = class {
 	storageController;
 	storageRegistry;
+	authorizeUpload;
 	uploads = /* @__PURE__ */ new Map();
 	tusDir;
 	cleanupTimer;
-	constructor(storageBaseDir, storageController, storageRegistry) {
+	constructor(storageBaseDir, storageController, storageRegistry, authorizeUpload) {
 		this.storageController = storageController;
 		this.storageRegistry = storageRegistry;
+		this.authorizeUpload = authorizeUpload;
 		this.tusDir = join(storageBaseDir, ".tus-uploads");
 	}
 	/** Ensure the temp directory exists. */
@@ -13212,6 +13926,10 @@ var TusHandler = class {
 		if (Number.isNaN(uploadLength) || uploadLength <= 0) throw ApiError.badRequest("Invalid Upload-Length");
 		if (uploadLength > MAX_UPLOAD_SIZE) throw new ApiError(413, "PAYLOAD_TOO_LARGE", `Upload-Length exceeds maximum of ${MAX_UPLOAD_SIZE} bytes`);
 		const metadata = this.parseMetadata(c.req.header("Upload-Metadata") || "");
+		if (this.authorizeUpload) {
+			const key = metadata.key || metadata.filename || "";
+			await this.authorizeUpload(c, key, metadata.bucket || "default");
+		}
 		const id = randomUUID$1();
 		const filePath = join(this.tusDir, id);
 		await writeFile(filePath, Buffer.alloc(0));
@@ -13397,7 +14115,7 @@ function buildAdapterAuthMiddleware(adapter, requireAuth, publicRead) {
 				} }, 401);
 			}
 			if (authenticatedUser) c.set("user", {
-				userId: authenticatedUser.uid,
+				uid: authenticatedUser.uid,
 				email: authenticatedUser.email,
 				roles: authenticatedUser.roles
 			});
@@ -13419,7 +14137,34 @@ function buildAdapterAuthMiddleware(adapter, requireAuth, publicRead) {
 function createStorageRoutes(config) {
 	const router = new Hono();
 	router.onError(errorHandler);
-	const { controller, registry, sources: declaredSources, requireAuth: requireAuth$1 = true, publicRead = false, authAdapter } = config;
+	const { controller, registry, sources: declaredSources, requireAuth: requireAuth$1 = true, publicRead = false, authAdapter, authorize } = config;
+	/**
+	* Run the per-object authorization hook, if one is configured.
+	*
+	* Denials are 403 rather than 404: the route already established that the
+	* caller is authenticated, so hiding existence buys nothing, and a
+	* distinguishable status is what makes a misconfigured policy debuggable.
+	* A hook that throws denies too — an ownership lookup that fails must not
+	* fall open.
+	*/
+	const checkAuthorized = async (c, operation, key, bucket, storageId) => {
+		if (!authorize) return;
+		const user = c.get("user") ?? null;
+		if (user?.uid === "download-token" || user?.uid === "public") return;
+		let allowed;
+		try {
+			allowed = await authorize({
+				key,
+				bucket,
+				operation,
+				user,
+				storageId: storageId ?? void 0
+			});
+		} catch {
+			allowed = false;
+		}
+		if (!allowed) throw ApiError.forbidden("Not authorized for this object");
+	};
 	/**
 	* Resolve the storage controller for a request.
 	* Looks up by `storageId` in the registry, falls back to the single
@@ -13469,6 +14214,7 @@ function createStorageRoutes(config) {
 		const finalKey = sanitizeStorageKey(key || uploadedFile.name || "unnamed");
 		const metadata = {};
 		for (const [k, value] of Object.entries(body)) if (k.startsWith("metadata_")) metadata[k.replace("metadata_", "")] = value;
+		await checkAuthorized(c, "write", finalKey, bucket ?? "default", storageId);
 		const result = await resolveController(storageId).putObject({
 			file: uploadedFile,
 			key: finalKey,
@@ -13489,7 +14235,12 @@ function createStorageRoutes(config) {
 		const rawPath = extractWildcardPath(c);
 		if (!rawPath) throw ApiError.notFound("File not found");
 		const filePath = decodeURIComponent(rawPath);
-		const resolved = resolveController(c.req.query("storageId"));
+		const storageId = c.req.query("storageId");
+		const resolved = resolveController(storageId);
+		{
+			const { bucket, resolvedPath } = parseBucketAndPath(filePath);
+			await checkAuthorized(c, "read", resolvedPath, bucket, storageId);
+		}
 		const transformOpts = parseTransformOptions(c.req.query());
 		if (resolved.getType() === "local") {
 			const localController = resolved;
@@ -13552,8 +14303,10 @@ function createStorageRoutes(config) {
 			fileNotFound: true
 		}, 404);
 		const filePath = decodeURIComponent(rawPath);
-		const resolved = resolveController(c.req.query("storageId"));
+		const storageId = c.req.query("storageId");
+		const resolved = resolveController(storageId);
 		const { bucket, resolvedPath } = parseBucketAndPath(filePath);
+		await checkAuthorized(c, "read", resolvedPath, bucket, storageId);
 		const downloadConfig = await resolved.getSignedUrl(resolvedPath, bucket);
 		if (downloadConfig.fileNotFound) throw ApiError.notFound("File not found");
 		if (downloadConfig.metadata) {
@@ -13579,8 +14332,10 @@ function createStorageRoutes(config) {
 			message: "No file to delete"
 		});
 		const filePath = decodeURIComponent(rawPath);
-		const resolved = resolveController(c.req.query("storageId"));
+		const storageId = c.req.query("storageId");
+		const resolved = resolveController(storageId);
 		const { bucket, resolvedPath } = parseBucketAndPath(filePath);
+		await checkAuthorized(c, "delete", resolvedPath, bucket, storageId);
 		await resolved.deleteObject(resolvedPath, bucket);
 		return c.json({
 			success: true,
@@ -13595,7 +14350,9 @@ function createStorageRoutes(config) {
 		const bucket = c.req.query("bucket");
 		const maxResults = c.req.query("maxResults");
 		const pageToken = c.req.query("pageToken");
-		const resolved = resolveController(c.req.query("storageId"));
+		const storageId = c.req.query("storageId");
+		const resolved = resolveController(storageId);
+		await checkAuthorized(c, "list", storagePrefix, bucket ?? "default", storageId);
 		const result = await resolved.listObjects(storagePrefix, {
 			bucket: bucket ?? (resolved.getType() === "local" ? "default" : void 0),
 			maxResults: maxResults ? parseInt(maxResults, 10) : void 0,
@@ -13618,6 +14375,7 @@ function createStorageRoutes(config) {
 		const resolved = resolveController(storageId);
 		const { bucket, resolvedPath } = parseBucketAndPath(folderPath);
 		if (!resolvedPath || resolvedPath.trim() === "") throw ApiError.badRequest("Invalid folder path");
+		await checkAuthorized(c, "write", resolvedPath, bucket, storageId);
 		if (resolved.getType() === "local") {
 			const absolutePath = resolved.getAbsolutePath(resolvedPath, bucket);
 			fs$1.mkdirSync(absolutePath, { recursive: true });
@@ -13635,7 +14393,9 @@ function createStorageRoutes(config) {
 		}, 201);
 	});
 	const defaultCtrl = getDefaultController();
-	const tusHandler = new TusHandler(defaultCtrl.getType() === "local" ? defaultCtrl.getBasePath() : process.env.STORAGE_PATH || "./uploads", defaultCtrl, registry);
+	const tusHandler = new TusHandler(defaultCtrl.getType() === "local" ? defaultCtrl.getBasePath() : process.env.STORAGE_PATH || "./uploads", defaultCtrl, registry, authorize ? async (c, key, bucket) => {
+		await checkAuthorized(c, "write", sanitizeStorageKey(key), bucket, c.req.query("storageId"));
+	} : void 0);
 	tusHandler.startCleanup();
 	router.options("/tus", (_c) => tusHandler.options());
 	router.post("/tus", writeAuthMiddleware, async (c) => tusHandler.create(c));
@@ -13776,7 +14536,7 @@ async function initializeStorage(storageConfig, isProduction) {
 	const toController = async (entry, label) => {
 		if (typeof entry.putObject === "function") return entry;
 		const conf = entry;
-		if (isProduction && conf.type === "local") logger.warn(`Storage backend "${label}" uses local filesystem in production. Files will be lost on container restart. Configure S3-compatible storage or a custom StorageController.`);
+		if (isProduction && conf.type === "local" && !process.env.FORCE_LOCAL_STORAGE) throw new Error(`Storage backend "${label}" is set to "local" in production. Local storage is the container filesystem, so uploaded files are destroyed on the next restart or redeploy. Configure S3-compatible storage (STORAGE_TYPE=s3) or GCS (STORAGE_TYPE=gcs), or pass a custom StorageController. If this deployment really does have a durable volume mounted at the storage path, set FORCE_LOCAL_STORAGE=true to proceed.`);
 		return await createStorageController(conf);
 	};
 	if (typeof storageConfig === "object" && ("type" in storageConfig || typeof storageConfig.putObject === "function")) controllers[DEFAULT_STORAGE_ID] = await toController(storageConfig, DEFAULT_STORAGE_ID);
@@ -13796,7 +14556,7 @@ async function initializeStorage(storageConfig, isProduction) {
 //#region src/init/docs.ts
 async function mountOpenApiDocs(app, basePath, enableSwagger, activeCollections, requireAuth) {
 	if (enableSwagger === false || activeCollections.length === 0) return;
-	const { generateOpenApiSpec } = await import("./openapi-generator-Z9oYWLf_.js");
+	const { generateOpenApiSpec } = await import("./openapi-generator-DqSIwNLV.js");
 	app.get(`${basePath}/docs`, (c) => {
 		const spec = generateOpenApiSpec(activeCollections, {
 			basePath,
@@ -13950,6 +14710,38 @@ function createShutdown(config) {
 	};
 }
 //#endregion
+//#region src/auth/collection-callback-warning.ts
+/** The data callbacks the auth write path does not run. */
+var DATA_CALLBACKS = [
+	"beforeSave",
+	"afterSave",
+	"beforeDelete",
+	"afterDelete"
+];
+/**
+* Warn when the auth collection hangs data callbacks that auth will not fire.
+*
+* Creating a user through the auth subsystem — registration, OAuth, the admin
+* user routes — writes to the user store directly, because that path owns
+* password hashing, identity rows and its own transaction. It deliberately does
+* not go through the collection save pipeline: a `beforeSave` able to rewrite
+* `password_hash` on its way to the database is a footgun, not a feature, and
+* the auth hooks (`afterUserCreate`, `beforeUserCreate`, …) exist to hang
+* behaviour off those events with the right contract.
+*
+* The cost is a reasonable expectation quietly not being met: someone puts
+* "send the welcome email" in `afterSave` on their users collection, tests it
+* by creating a user in the admin, and it works — because *that* is a
+* collection write. Then a real signup does nothing at all. Which is why this
+* is said at boot, naming the callbacks that will not run.
+*/
+function warnOnAuthCollectionDataCallbacks(collection) {
+	if (!collection?.callbacks) return;
+	const declared = DATA_CALLBACKS.filter((name) => typeof collection.callbacks?.[name] === "function");
+	if (declared.length === 0) return;
+	logger.warn(`[Auth] The auth collection "${collection.slug}" defines ${declared.join("/")} callback(s), but these do NOT fire when users are created or updated through the auth system (registration, admin, OAuth) — that path bypasses the collection save pipeline. Use auth hooks (afterUserCreate, beforeUserCreate, afterUserDelete, …) for those side effects.`);
+}
+//#endregion
 //#region ../client/dist/index.es.js
 function rebaseReviver(_key, value) {
 	if (value && typeof value === "object" && "__type" in value) {
@@ -14001,6 +14793,28 @@ function buildQueryString(params) {
 	}
 	return parts.length > 0 ? "?" + parts.join("&") : "";
 }
+/**
+* The base every request and every caller-built URL resolves against.
+*
+* `baseUrl` is optional because the common production shape is a Rebase
+* backend serving its own SPA, where the API is simply the page's origin.
+* Leaving it unset is therefore the *correct* configuration there — and the
+* one that keeps working when a second hostname (a custom domain) points at
+* the same app.
+*
+* When unset in a browser this resolves to the page origin rather than "".
+* Requests behave identically either way, but the empty string is a trap for
+* anything that builds a URL from `client.baseUrl`: `new URL("" + path)`
+* throws, so apps "fixed" it by baking an absolute host into their bundle —
+* which is exactly what breaks the day a custom domain is added, and which no
+* amount of CORS configuration repairs, because a SameSite=Lax auth cookie is
+* not sent cross-site either.
+*/
+function resolveBaseUrl(configured) {
+	if (configured) return configured.replace(/\/$/, "");
+	if (typeof window !== "undefined" && window.location?.origin) return window.location.origin;
+	return "";
+}
 function createTransport(config) {
 	const fetchFn = config.fetch || globalThis.fetch;
 	const apiPath = config.apiPath || "/api";
@@ -14015,7 +14829,7 @@ function createTransport(config) {
 		};
 	}
 	async function request(path, init) {
-		const url = (config.baseUrl ? config.baseUrl.replace(/\/$/, "") : "") + apiPath + path;
+		const url = resolveBaseUrl(config.baseUrl) + apiPath + path;
 		let activeToken = token;
 		if (tokenGetter) try {
 			const fetched = await tokenGetter();
@@ -14090,7 +14904,7 @@ function createTransport(config) {
 			onUnauthorizedHandler = handler;
 		},
 		get baseUrl() {
-			return config.baseUrl ? config.baseUrl.replace(/\/$/, "") : "";
+			return resolveBaseUrl(config.baseUrl);
 		},
 		get apiPath() {
 			return apiPath;
@@ -14550,6 +15364,30 @@ function createAuth(transport, options) {
 			})
 		});
 	}
+	/**
+	* Link an OAuth provider to the **currently signed-in** account.
+	*
+	* Use this when `signIn*` failed with `EMAIL_NOT_VERIFIED` — an account
+	* with that email already exists under a different sign-in method — or to
+	* attach a provider whose email differs from the account's.
+	*
+	* The payload is the same one the provider's sign-in method takes, e.g.
+	* `linkProvider("google", { idToken })`.
+	*
+	* Unlike sign-in, this does not require the provider to have verified the
+	* email, and the emails need not match: the active session already proves
+	* account ownership.
+	*
+	* Throws `IDENTITY_ALREADY_LINKED` (409) if that provider identity is
+	* attached to a different user. Succeeds idempotently (`alreadyLinked:
+	* true`) if it is already attached to the current one.
+	*/
+	async function linkProvider(providerId, payload) {
+		return transport.request(authPath + "/link/" + providerId, {
+			method: "POST",
+			body: JSON.stringify(payload)
+		});
+	}
 	async function sendVerificationEmail() {
 		return transport.request(authPath + "/send-verification", { method: "POST" });
 	}
@@ -14671,6 +15509,7 @@ function createAuth(transport, options) {
 		resetPasswordForEmail,
 		resetPassword,
 		changePassword,
+		linkProvider,
 		sendVerificationEmail,
 		verifyEmail,
 		sendMagicLink,
@@ -14933,7 +15772,7 @@ var SDKQueryBuilder = class {
 	* Listen to realtime updates matching this query.
 	*/
 	listen(onUpdate, onError) {
-		if (!this.collection.listen) throw new Error("Listen is only available when RebaseClient is configured with a websocketUrl.");
+		if (!this.collection.listen) throw new Error("Listen is only available when RebaseClient is configured with a websocketUrl, and not when it was created with realtime: false.");
 		return this.collection.listen(this.params, onUpdate, onError);
 	}
 };
@@ -14966,6 +15805,17 @@ function createCollectionClient(transport, slug, ws) {
 				body: JSON.stringify(body)
 			});
 		},
+		async createMany(data, options) {
+			if (!Array.isArray(data)) throw new TypeError("createMany expects an array of records.");
+			if (data.length === 0) return [];
+			return (await transport.request(`${basePath}/bulk`, {
+				method: "POST",
+				body: JSON.stringify({
+					rows: data,
+					...options?.upsert ? { upsert: true } : {}
+				})
+			})).data || [];
+		},
 		async update(id, data) {
 			return await transport.request(`${basePath}/${encodeURIComponent(String(id))}`, {
 				method: "PUT",
@@ -15274,12 +16124,29 @@ var ClientStorageSourceRegistry = class ClientStorageSourceRegistry {
 function extractMessageError(message) {
 	const payload = message.payload;
 	const errPayload = payload?.error;
+	const errorMessage = typeof errPayload === "object" ? errPayload.message : payload?.message || (typeof errPayload === "string" ? errPayload : void 0) || message.error || "Unknown error";
+	const errorCode = typeof errPayload === "object" ? errPayload.code : payload?.code;
 	return {
-		errorMessage: typeof errPayload === "object" ? errPayload.message : payload?.message || (typeof errPayload === "string" ? errPayload : void 0) || message.error || "Unknown error",
-		errorCode: typeof errPayload === "object" ? errPayload.code : payload?.code
+		errorMessage: typeof errorMessage === "string" ? errorMessage : errorMessage == null ? "Unknown error" : JSON.stringify(errorMessage),
+		errorCode
 	};
 }
 /**
+* Broadcast and presence frames.
+*
+* Fire-and-forget (the server sends no response envelope), and exempt from the
+* client-side auth gate — a public channel is usable without an account.
+*/
+var CHANNEL_MESSAGE_TYPES = new Set([
+	"join_channel",
+	"leave_channel",
+	"broadcast",
+	"presence_track",
+	"presence_untrack",
+	"presence_state",
+	"channel_history"
+]);
+/**
 * Low-level realtime WebSocket client.
 *
 * @internal Not a stable app-facing API. `createRebaseClient()` constructs and
@@ -15294,6 +16161,36 @@ var RebaseWebSocketClient = class {
 	getAuthToken;
 	subscriptions = /* @__PURE__ */ new Map();
 	listeners = /* @__PURE__ */ new Map();
+	/** Channel-name → handlers, for broadcast and presence frames. */
+	channelHandlers = /* @__PURE__ */ new Map();
+	/** Set by `close()`. Blocks any later operation from silently redialling. */
+	closedByCaller = false;
+	/**
+	* Whether a socket exists at all (open or still opening).
+	*
+	* Lets callers distinguish "authenticate the live socket" from "there is
+	* nothing to authenticate yet", without that question forcing a dial.
+	*/
+	get hasSocket() {
+		return this.ws !== null;
+	}
+	/** So the "no WebSocket in this environment" warning is said once, not per call. */
+	warnedNoWebSocket = false;
+	/** Subscribe to broadcast/presence frames for one channel. */
+	onChannelMessage(channel, handler) {
+		if (!this.channelHandlers.has(channel)) this.channelHandlers.set(channel, /* @__PURE__ */ new Set());
+		this.channelHandlers.get(channel).add(handler);
+		return () => {
+			const handlers = this.channelHandlers.get(channel);
+			if (!handlers) return;
+			handlers.delete(handler);
+			if (handlers.size === 0) this.channelHandlers.delete(channel);
+		};
+	}
+	/** Notified after the socket comes back, so channels can re-join. */
+	onReconnect(handler) {
+		return this.on("reconnect", handler);
+	}
 	on(event, cb) {
 		if (!this.listeners.has(event)) this.listeners.set(event, /* @__PURE__ */ new Set());
 		this.listeners.get(event).add(cb);
@@ -15312,6 +16209,7 @@ var RebaseWebSocketClient = class {
 	isConnected = false;
 	messageQueue = [];
 	requestTimeoutMs = 3e4;
+	subscriptionTimeoutMs = 3e4;
 	reconnectTimeout = null;
 	isAuthenticated = false;
 	authPromise = null;
@@ -15323,8 +16221,25 @@ var RebaseWebSocketClient = class {
 		this.getAuthToken = config.getAuthToken;
 		this.onUnauthorized = config.onUnauthorized;
 		this.WebSocketConstructor = config.WebSocket || (typeof WebSocket !== "undefined" ? WebSocket : void 0);
-		if (!this.WebSocketConstructor) console.warn("WebSocket is not defined in this environment. Realtime subscriptions will not work unless you provide a WebSocket implementation in the config.");
-		else this.initWebSocket();
+	}
+	/**
+	* Open the socket if it is not open (or opening) already.
+	*
+	* Idempotent, synchronous, and safe to call on every operation that needs a
+	* live socket — `initWebSocket` already no-ops on an open socket and is
+	* re-entrant, since the reconnect path has always called it.
+	*/
+	ensureConnected() {
+		if (this.closedByCaller) return;
+		if (!this.WebSocketConstructor) {
+			if (!this.warnedNoWebSocket) {
+				this.warnedNoWebSocket = true;
+				console.warn("WebSocket is not defined in this environment. Realtime subscriptions will not work unless you provide a WebSocket implementation in the config.");
+			}
+			return;
+		}
+		if (this.ws || this.reconnectTimeout) return;
+		this.initWebSocket();
 	}
 	/**
 	* Authenticate the WebSocket connection
@@ -15374,7 +16289,16 @@ var RebaseWebSocketClient = class {
 			});
 		}
 	}
-	disconnect() {
+	/**
+	* Drop the socket.
+	*
+	* `permanent` distinguishes the two callers. Signing out drops the socket
+	* but the client stays usable — a later subscribe should reconnect
+	* anonymously. `client.close()` is the caller saying they are done, and
+	* must not be undone by a stray queued frame.
+	*/
+	disconnect(permanent = false) {
+		if (permanent) this.closedByCaller = true;
 		this.isAuthenticated = false;
 		this.authPromise = null;
 		if (this.reconnectTimeout) {
@@ -15417,6 +16341,7 @@ var RebaseWebSocketClient = class {
 				this.emit(wasReconnect ? "reconnect" : "connect");
 				this.processMessageQueue();
 				if (wasReconnect) this.resubscribeAll();
+				this.armPendingSubscribeWatchdogs();
 			};
 			this.ws.onmessage = (event) => {
 				try {
@@ -15431,6 +16356,7 @@ var RebaseWebSocketClient = class {
 				this.isConnected = false;
 				this.isAuthenticated = false;
 				this.authPromise = null;
+				this.suspendSubscribeWatchdogs();
 				this.emit("disconnect");
 				for (const [reqId, request] of this.pendingRequests.entries()) {
 					if (reqId.startsWith("auth_")) request.reject(/* @__PURE__ */ new Error("Connection closed during authentication"));
@@ -15462,6 +16388,7 @@ var RebaseWebSocketClient = class {
 	attemptReconnect() {
 		if (this.reconnectAttempts >= this.maxReconnectAttempts) {
 			console.error("Max reconnection attempts reached");
+			this.failAllPendingSubscriptions(new RebaseApiError("Connection lost", { code: "CONNECTION_LOST" }));
 			return;
 		}
 		this.reconnectAttempts++;
@@ -15516,29 +16443,18 @@ var RebaseWebSocketClient = class {
 				subscription.backendSubscriptionId = newBackendId;
 				backendKeyMap.delete(oldBackendId);
 				backendKeyMap.set(newBackendId, subscriptionKey);
-				this.sendMessage({
-					type: messageType,
-					payload: {
-						...subscription.props,
-						subscriptionId: newBackendId
-					}
-				}).catch((error) => {
-					console.error(`[WS] Failed to re-subscribe ${idPrefix} after auth refresh:`, subscriptionKey, error);
-					subscription.callbacks.forEach((callback) => {
-						if (callback.onError) callback.onError(error);
-					});
-				});
-			} else {
-				const { errorMessage, errorCode } = extractMessageError(message);
-				const error = new RebaseApiError(errorMessage, { code: errorCode });
-				subscription.callbacks.forEach((callback) => {
-					if (callback.onError) callback.onError(error);
-				});
+				if (messageType === "subscribe_collection") this.sendCollectionSubscribe(subscriptionKey);
+				else this.sendEntitySubscribe(subscriptionKey);
+				return;
 			}
+			const { errorMessage, errorCode } = extractMessageError(message);
+			const error = new RebaseApiError(errorMessage, { code: errorCode });
+			if (messageType === "subscribe_collection") this.failCollectionSubscription(subscriptionKey, error);
+			else this.failEntitySubscription(subscriptionKey, error);
 		}).catch((err) => {
-			subscription.callbacks.forEach((callback) => {
-				if (callback.onError) callback.onError(err);
-			});
+			const error = err instanceof Error ? err : new Error(String(err));
+			if (messageType === "subscribe_collection") this.failCollectionSubscription(subscriptionKey, error);
+			else this.failEntitySubscription(subscriptionKey, error);
 		});
 	}
 	handleWebSocketMessage(message) {
@@ -15567,16 +16483,30 @@ var RebaseWebSocketClient = class {
 			}
 			return;
 		}
+		if (typeof message.channel === "string" && (type === "broadcast" || type === "presence_state" || type === "presence_diff" || type === "channel_history")) {
+			const handlers = this.channelHandlers.get(message.channel);
+			if (handlers) for (const handler of [...handlers]) try {
+				handler(message);
+			} catch (error) {
+				console.error("Error in channel handler:", error);
+			}
+			return;
+		}
 		if (subscriptionId && type === "collection_update") {
 			const subscriptionKey = this.backendToCollectionKey.get(subscriptionId);
 			if (subscriptionKey) {
 				const collectionSub = this.collectionSubscriptions.get(subscriptionKey);
 				if (collectionSub) {
 					const incomingRows = message.rows || [];
-					const rows = this.mergeRows(collectionSub.latestData, incomingRows);
+					const updatePks = message.pks;
+					if (updatePks) collectionSub.pks = updatePks;
+					const rows = this.mergeRows(collectionSub.latestData, incomingRows, collectionSub.pks);
 					collectionSub.latestData = rows;
 					collectionSub.lastUpdated = Date.now();
 					collectionSub.isInitialDataReceived = true;
+					if (collectionSub.subscribeTimeout) clearTimeout(collectionSub.subscribeTimeout);
+					collectionSub.subscribeTimeout = void 0;
+					collectionSub.subscribeInFlight = false;
 					collectionSub.callbacks.forEach((callback) => {
 						try {
 							callback.onUpdate(rows);
@@ -15595,12 +16525,14 @@ var RebaseWebSocketClient = class {
 				const collectionSub = this.collectionSubscriptions.get(subscriptionKey);
 				if (collectionSub && collectionSub.isInitialDataReceived && collectionSub.latestData) {
 					const patchWireEntity = message.row ?? null;
-					const patchEntityId = message.id;
+					const patchMessage = message;
+					const patchEntityId = patchMessage.id;
+					if (patchMessage.pks) collectionSub.pks = patchMessage.pks;
 					const patchRow = patchWireEntity ? patchWireEntity : null;
 					let updated;
-					if (patchRow === null) updated = collectionSub.latestData.filter((e) => String(e.id) !== String(patchEntityId));
+					if (patchRow === null) updated = collectionSub.latestData.filter((e) => this.rowAddress(e, collectionSub.pks) !== String(patchEntityId));
 					else {
-						const idx = collectionSub.latestData.findIndex((e) => String(e.id) === String(patchRow.id));
+						const idx = collectionSub.latestData.findIndex((e) => this.rowAddress(e, collectionSub.pks) === String(patchEntityId));
 						if (idx >= 0) {
 							updated = [...collectionSub.latestData];
 							updated[idx] = patchRow;
@@ -15630,6 +16562,9 @@ var RebaseWebSocketClient = class {
 					entitySub.latestData = row;
 					entitySub.lastUpdated = Date.now();
 					entitySub.isInitialDataReceived = true;
+					if (entitySub.subscribeTimeout) clearTimeout(entitySub.subscribeTimeout);
+					entitySub.subscribeTimeout = void 0;
+					entitySub.subscribeInFlight = false;
 					entitySub.callbacks.forEach((callback) => {
 						try {
 							callback.onUpdate(row);
@@ -15651,6 +16586,9 @@ var RebaseWebSocketClient = class {
 						this.resubscribeAfterAuthRefresh(message, collectionSub, collectionKey, "collection", this.backendToCollectionKey, "subscribe_collection");
 						return;
 					}
+					if (collectionSub.subscribeTimeout) clearTimeout(collectionSub.subscribeTimeout);
+					collectionSub.subscribeTimeout = void 0;
+					collectionSub.subscribeInFlight = false;
 					const { errorMessage, errorCode } = extractMessageError(message);
 					const error = new RebaseApiError(errorMessage, { code: errorCode });
 					collectionSub.callbacks.forEach((callback) => {
@@ -15667,6 +16605,9 @@ var RebaseWebSocketClient = class {
 						this.resubscribeAfterAuthRefresh(message, entitySub, entityKey, "row", this.backendToEntityKey, "subscribe_one");
 						return;
 					}
+					if (entitySub.subscribeTimeout) clearTimeout(entitySub.subscribeTimeout);
+					entitySub.subscribeTimeout = void 0;
+					entitySub.subscribeInFlight = false;
 					const { errorMessage, errorCode } = extractMessageError(message);
 					const error = new RebaseApiError(errorMessage, { code: errorCode });
 					entitySub.callbacks.forEach((callback) => {
@@ -15739,21 +16680,28 @@ var RebaseWebSocketClient = class {
 			throw error;
 		}
 	}
+	/**
+	* Public because `RebaseRealtimeChannel` sends channel frames through it.
+	* Not part of the stable surface — prefer `client.realtime.channel(name)`.
+	*/
 	sendMessage(message) {
 		const queuedMsg = message;
 		if (queuedMsg._queuedResolve && queuedMsg._queuedReject) return this.doSendMessage(message, queuedMsg._queuedResolve, queuedMsg._queuedReject);
-		if (!this.isConnected || !this.ws) return new Promise((resolve, reject) => {
-			const queueable = message;
-			queueable._queuedResolve = resolve;
-			queueable._queuedReject = reject;
-			this.messageQueue.push(message);
-		});
+		if (!this.isConnected || !this.ws) {
+			this.ensureConnected();
+			return new Promise((resolve, reject) => {
+				const queueable = message;
+				queueable._queuedResolve = resolve;
+				queueable._queuedReject = reject;
+				this.messageQueue.push(message);
+			});
+		}
 		return new Promise((resolve, reject) => {
 			this.doSendMessage(message, resolve, reject);
 		});
 	}
 	async doSendMessage(message, resolve, reject) {
-		if (message.type !== "AUTHENTICATE" && this.getAuthToken && !this.isAuthenticated) try {
+		if (message.type !== "AUTHENTICATE" && !CHANNEL_MESSAGE_TYPES.has(message.type) && this.getAuthToken && !this.isAuthenticated) try {
 			await this.ensureAuthenticated();
 		} catch (error) {
 			reject(new RebaseApiError(error instanceof Error ? error.message : "Authentication required"));
@@ -15761,17 +16709,7 @@ var RebaseWebSocketClient = class {
 		}
 		const requestId = message.requestId || `req_${Date.now()}_${Math.random().toString(36).substring(2, 9)}`;
 		message.requestId = requestId;
-		const expectsResponse = ![
-			"subscribe_collection",
-			"subscribe_one",
-			"unsubscribe",
-			"join_channel",
-			"leave_channel",
-			"broadcast",
-			"presence_track",
-			"presence_untrack",
-			"presence_state"
-		].includes(message.type);
+		const expectsResponse = !(message.type === "subscribe_collection" || message.type === "subscribe_one" || message.type === "unsubscribe" || CHANNEL_MESSAGE_TYPES.has(message.type));
 		if (expectsResponse && !this.pendingRequests.has(requestId)) {
 			const timeoutHandle = setTimeout(() => {
 				if (this.pendingRequests.has(requestId)) {
@@ -15841,6 +16779,9 @@ var RebaseWebSocketClient = class {
 	async fetchAvailableRoles() {
 		return (await this.sendMessage({ type: "FETCH_ROLES" })).roles || [];
 	}
+	async fetchApplicationRoles() {
+		return (await this.sendMessage({ type: "FETCH_APPLICATION_ROLES" })).roles || [];
+	}
 	async fetchCurrentDatabase() {
 		return (await this.sendMessage({ type: "FETCH_CURRENT_DATABASE" })).database;
 	}
@@ -15950,17 +16891,39 @@ var RebaseWebSocketClient = class {
 		return val;
 	}
 	/**
+	* The address of a row, for matching it against another copy of itself.
+	*
+	* A row is exactly its columns and carries no address, so it is derived
+	* from the key columns the server named — including the ordinary case where
+	* that key is `id`, which the server reports like any other.
+	*
+	* Undefined when there are no keys, which means the server could not
+	* resolve any: such rows genuinely cannot be recognised, and guessing at a
+	* column called `id` would be inventing an identity for a table that has
+	* none.
+	*/
+	rowAddress(row, pks) {
+		if (!pks || pks.length === 0) return void 0;
+		const address = buildCompositeId(row, pks);
+		if (!address || address.split(":::").every((part) => part === "")) return void 0;
+		return address;
+	}
+	/**
 	* Merge incoming rows with cached data, preserving cached references
 	* for rows whose values haven't changed. This avoids unnecessary
 	* React re-renders when the server refetches all rows but most
 	* haven't actually changed.
 	*/
-	mergeRows(cached, incoming) {
+	mergeRows(cached, incoming, pks) {
 		if (!cached || cached.length === 0) return incoming;
 		const cachedById = /* @__PURE__ */ new Map();
-		for (const row of cached) cachedById.set(row.id, row);
+		for (const row of cached) {
+			const address = this.rowAddress(row, pks);
+			if (address !== void 0) cachedById.set(address, row);
+		}
 		return incoming.map((incomingRow) => {
-			const cachedRow = cachedById.get(incomingRow.id);
+			const address = this.rowAddress(incomingRow, pks);
+			const cachedRow = address === void 0 ? void 0 : cachedById.get(address);
 			if (!cachedRow) return incomingRow;
 			const normCached = this.normalizeForComparison(cachedRow);
 			const normIncoming = this.normalizeForComparison(incomingRow);
@@ -15972,12 +16935,13 @@ var RebaseWebSocketClient = class {
 					cached: normCached[key],
 					incoming: normIncoming[key]
 				};
-				console.debug(`[RebaseWS] Row ${incomingRow.id} refetch mismatch:\n`, JSON.stringify(mismatches, null, 2));
+				console.debug(`[RebaseWS] Row ${address} refetch mismatch:\n`, JSON.stringify(mismatches, null, 2));
 			}
 			return incomingRow;
 		});
 	}
 	listenCollection(props, onUpdate, onError) {
+		this.ensureConnected();
 		const subscriptionKey = this.createCollectionSubscriptionKey(props);
 		const callbackId = `callback_${Date.now()}_${Math.random().toString(36).substring(2, 9)}`;
 		const existingSubscription = this.collectionSubscriptions.get(subscriptionKey);
@@ -15993,9 +16957,12 @@ var RebaseWebSocketClient = class {
 				console.error("Error in collection subscription callback:", error);
 				if (onError) onError(error instanceof Error ? error : new Error(String(error)));
 			}
+			else if (!existingSubscription.subscribeInFlight) this.sendCollectionSubscribe(subscriptionKey);
 			return () => {
 				callbackMap.delete(callbackId);
 				if (callbackMap.size === 0) {
+					if (this.collectionSubscriptions.get(subscriptionKey) !== existingSubscription) return;
+					if (existingSubscription.subscribeTimeout) clearTimeout(existingSubscription.subscribeTimeout);
 					this.collectionSubscriptions.delete(subscriptionKey);
 					this.backendToCollectionKey.delete(existingSubscription.backendSubscriptionId);
 					if (this.isConnected && this.ws) this.sendMessage({
@@ -16017,21 +16984,14 @@ var RebaseWebSocketClient = class {
 			props
 		});
 		this.backendToCollectionKey.set(backendSubscriptionId, subscriptionKey);
-		this.sendMessage({
-			type: "subscribe_collection",
-			payload: {
-				...props,
-				subscriptionId: backendSubscriptionId
-			}
-		}).catch((error) => {
-			if (onError) onError(error);
-		});
+		this.sendCollectionSubscribe(subscriptionKey);
 		return () => {
 			const subscription = this.collectionSubscriptions.get(subscriptionKey);
 			if (subscription) {
 				const callbacks = subscription.callbacks;
 				callbacks.delete(callbackId);
 				if (callbacks.size === 0) {
+					if (subscription.subscribeTimeout) clearTimeout(subscription.subscribeTimeout);
 					this.collectionSubscriptions.delete(subscriptionKey);
 					this.backendToCollectionKey.delete(subscription.backendSubscriptionId);
 					if (this.isConnected && this.ws) this.sendMessage({
@@ -16043,6 +17003,7 @@ var RebaseWebSocketClient = class {
 		};
 	}
 	listenOne(props, onUpdate, onError) {
+		this.ensureConnected();
 		const subscriptionKey = this.createSingleSubscriptionKey(props);
 		const callbackId = `callback_${Date.now()}_${Math.random().toString(36).substring(2, 9)}`;
 		const existingSubscription = this.singleSubscriptions.get(subscriptionKey);
@@ -16058,9 +17019,12 @@ var RebaseWebSocketClient = class {
 				console.error("Error in row subscription callback:", error);
 				if (onError) onError(error instanceof Error ? error : new Error(String(error)));
 			}
+			else if (!existingSubscription.subscribeInFlight) this.sendEntitySubscribe(subscriptionKey);
 			return () => {
 				callbackMap.delete(callbackId);
 				if (callbackMap.size === 0) {
+					if (this.singleSubscriptions.get(subscriptionKey) !== existingSubscription) return;
+					if (existingSubscription.subscribeTimeout) clearTimeout(existingSubscription.subscribeTimeout);
 					this.singleSubscriptions.delete(subscriptionKey);
 					this.backendToEntityKey.delete(existingSubscription.backendSubscriptionId);
 					if (this.isConnected && this.ws) this.sendMessage({
@@ -16082,15 +17046,7 @@ var RebaseWebSocketClient = class {
 			props
 		});
 		this.backendToEntityKey.set(backendSubscriptionId, subscriptionKey);
-		this.sendMessage({
-			type: "subscribe_one",
-			payload: {
-				...props,
-				subscriptionId: backendSubscriptionId
-			}
-		}).catch((error) => {
-			if (onError) onError(error);
-		});
+		this.sendEntitySubscribe(subscriptionKey);
 		return () => {
 			const subscription = this.singleSubscriptions.get(subscriptionKey);
 			if (subscription) {
@@ -16108,6 +17064,157 @@ var RebaseWebSocketClient = class {
 		};
 	}
 	/**
+	* Send a `subscribe_collection` for an already-registered subscription and
+	* arm its watchdog.
+	*
+	* Every path that registers a collection subscription goes through here, so
+	* that a subscribe which never lands — a rejected send, or a server that
+	* never answers — always ends up in `failCollectionSubscription` rather than
+	* leaving the entry parked with `isInitialDataReceived === false` forever.
+	*/
+	sendCollectionSubscribe(subscriptionKey) {
+		const subscription = this.collectionSubscriptions.get(subscriptionKey);
+		if (!subscription) return;
+		const backendSubscriptionId = subscription.backendSubscriptionId;
+		subscription.subscribeInFlight = true;
+		if (subscription.subscribeTimeout) clearTimeout(subscription.subscribeTimeout);
+		subscription.subscribeTimeout = void 0;
+		if (this.isConnected) this.sendCollectionSubscribeWatchdog(subscriptionKey);
+		this.sendMessage({
+			type: "subscribe_collection",
+			payload: {
+				...subscription.props,
+				subscriptionId: backendSubscriptionId
+			}
+		}).catch((error) => {
+			const current = this.collectionSubscriptions.get(subscriptionKey);
+			if (!current || current.backendSubscriptionId !== backendSubscriptionId) return;
+			this.failCollectionSubscription(subscriptionKey, error instanceof Error ? error : new Error(String(error)));
+		});
+	}
+	/** The `listenOne` counterpart of {@link sendCollectionSubscribe}. */
+	sendEntitySubscribe(subscriptionKey) {
+		const subscription = this.singleSubscriptions.get(subscriptionKey);
+		if (!subscription) return;
+		const backendSubscriptionId = subscription.backendSubscriptionId;
+		subscription.subscribeInFlight = true;
+		if (subscription.subscribeTimeout) clearTimeout(subscription.subscribeTimeout);
+		subscription.subscribeTimeout = void 0;
+		if (this.isConnected) this.sendEntitySubscribeWatchdog(subscriptionKey);
+		this.sendMessage({
+			type: "subscribe_one",
+			payload: {
+				...subscription.props,
+				subscriptionId: backendSubscriptionId
+			}
+		}).catch((error) => {
+			const current = this.singleSubscriptions.get(subscriptionKey);
+			if (!current || current.backendSubscriptionId !== backendSubscriptionId) return;
+			this.failEntitySubscription(subscriptionKey, error instanceof Error ? error : new Error(String(error)));
+		});
+	}
+	/**
+	* Report a subscribe failure to every listener and drop the registration.
+	*
+	* Dropping it is the point: the callbacks stay live (their components are
+	* still mounted and have been told), but the next `listenCollection` for
+	* these params finds no entry and issues a fresh subscribe instead of
+	* silently attaching to a dead one.
+	*/
+	failCollectionSubscription(subscriptionKey, error) {
+		const subscription = this.collectionSubscriptions.get(subscriptionKey);
+		if (!subscription) return;
+		if (subscription.subscribeTimeout) clearTimeout(subscription.subscribeTimeout);
+		subscription.subscribeInFlight = false;
+		this.collectionSubscriptions.delete(subscriptionKey);
+		this.backendToCollectionKey.delete(subscription.backendSubscriptionId);
+		subscription.callbacks.forEach((callback) => {
+			if (callback.onError) try {
+				callback.onError(error);
+			} catch (callbackError) {
+				console.error("Error in collection subscription error callback:", callbackError);
+			}
+		});
+	}
+	/** The `listenOne` counterpart of {@link failCollectionSubscription}. */
+	failEntitySubscription(subscriptionKey, error) {
+		const subscription = this.singleSubscriptions.get(subscriptionKey);
+		if (!subscription) return;
+		if (subscription.subscribeTimeout) clearTimeout(subscription.subscribeTimeout);
+		subscription.subscribeInFlight = false;
+		this.singleSubscriptions.delete(subscriptionKey);
+		this.backendToEntityKey.delete(subscription.backendSubscriptionId);
+		subscription.callbacks.forEach((callback) => {
+			if (callback.onError) try {
+				callback.onError(error);
+			} catch (callbackError) {
+				console.error("Error in row subscription error callback:", callbackError);
+			}
+		});
+	}
+	/**
+	* Stop the watchdogs without failing anything — used when the socket drops,
+	* since the reconnect path re-subscribes everything anyway and a watchdog
+	* firing mid-reconnect would tear down healthy subscriptions.
+	*/
+	suspendSubscribeWatchdogs() {
+		for (const sub of this.collectionSubscriptions.values()) {
+			if (sub.subscribeTimeout) clearTimeout(sub.subscribeTimeout);
+			sub.subscribeTimeout = void 0;
+			sub.subscribeInFlight = false;
+		}
+		for (const sub of this.singleSubscriptions.values()) {
+			if (sub.subscribeTimeout) clearTimeout(sub.subscribeTimeout);
+			sub.subscribeTimeout = void 0;
+			sub.subscribeInFlight = false;
+		}
+	}
+	/**
+	* Arm watchdogs for subscribes that were requested while offline and have
+	* just been flushed to the socket. Their timers were deliberately not set at
+	* request time, so without this they would have no timeout at all.
+	*/
+	armPendingSubscribeWatchdogs() {
+		for (const [key, sub] of this.collectionSubscriptions.entries()) if (sub.subscribeInFlight && !sub.subscribeTimeout) this.sendCollectionSubscribeWatchdog(key);
+		for (const [key, sub] of this.singleSubscriptions.entries()) if (sub.subscribeInFlight && !sub.subscribeTimeout) this.sendEntitySubscribeWatchdog(key);
+	}
+	sendCollectionSubscribeWatchdog(subscriptionKey) {
+		const subscription = this.collectionSubscriptions.get(subscriptionKey);
+		if (!subscription) return;
+		const backendSubscriptionId = subscription.backendSubscriptionId;
+		subscription.subscribeTimeout = setTimeout(() => {
+			const current = this.collectionSubscriptions.get(subscriptionKey);
+			if (!current || current.backendSubscriptionId !== backendSubscriptionId) return;
+			if (!current.subscribeInFlight) return;
+			this.failCollectionSubscription(subscriptionKey, new RebaseApiError("Subscription timed out", { code: "SUBSCRIPTION_TIMEOUT" }));
+		}, this.subscriptionTimeoutMs);
+	}
+	sendEntitySubscribeWatchdog(subscriptionKey) {
+		const subscription = this.singleSubscriptions.get(subscriptionKey);
+		if (!subscription) return;
+		const backendSubscriptionId = subscription.backendSubscriptionId;
+		subscription.subscribeTimeout = setTimeout(() => {
+			const current = this.singleSubscriptions.get(subscriptionKey);
+			if (!current || current.backendSubscriptionId !== backendSubscriptionId) return;
+			if (!current.subscribeInFlight) return;
+			this.failEntitySubscription(subscriptionKey, new RebaseApiError("Subscription timed out", { code: "SUBSCRIPTION_TIMEOUT" }));
+		}, this.subscriptionTimeoutMs);
+	}
+	/**
+	* Fail every subscription that never received data. Called when reconnection
+	* is given up on, so views surface an error instead of spinning forever.
+	*/
+	failAllPendingSubscriptions(error) {
+		for (const key of [...this.collectionSubscriptions.keys()]) {
+			const sub = this.collectionSubscriptions.get(key);
+			if (sub && !sub.isInitialDataReceived) this.failCollectionSubscription(key, error);
+		}
+		for (const key of [...this.singleSubscriptions.keys()]) {
+			const sub = this.singleSubscriptions.get(key);
+			if (sub && !sub.isInitialDataReceived) this.failEntitySubscription(key, error);
+		}
+	}
+	/**
 	* Re-send all active subscriptions to the backend after a reconnect.
 	* The server wipes subscription state when a client disconnects, so
 	* we need to re-register everything to resume receiving updates.
@@ -16120,15 +17227,7 @@ var RebaseWebSocketClient = class {
 			sub.backendSubscriptionId = newBackendId;
 			this.backendToCollectionKey.delete(oldBackendId);
 			this.backendToCollectionKey.set(newBackendId, key);
-			this.sendMessage({
-				type: "subscribe_collection",
-				payload: {
-					...sub.props,
-					subscriptionId: newBackendId
-				}
-			}).catch((error) => {
-				console.error("[WS] Failed to re-subscribe collection:", key, error);
-			});
+			this.sendCollectionSubscribe(key);
 		}
 		for (const [key, sub] of this.singleSubscriptions.entries()) {
 			const oldBackendId = sub.backendSubscriptionId;
@@ -16136,15 +17235,7 @@ var RebaseWebSocketClient = class {
 			sub.backendSubscriptionId = newBackendId;
 			this.backendToEntityKey.delete(oldBackendId);
 			this.backendToEntityKey.set(newBackendId, key);
-			this.sendMessage({
-				type: "subscribe_one",
-				payload: {
-					...sub.props,
-					subscriptionId: newBackendId
-				}
-			}).catch((error) => {
-				console.error("[WS] Failed to re-subscribe row:", key, error);
-			});
+			this.sendEntitySubscribe(key);
 		}
 	}
 	createCollectionSubscriptionKey(props) {
@@ -16171,6 +17262,377 @@ var RebaseWebSocketClient = class {
 	}
 };
 /**
+* Re-send presence comfortably inside the server's 30s expiry.
+*
+* Two-thirds of the window: one lost heartbeat still leaves time for the next
+* before the entry is reaped, so a single dropped frame is not a disappearance.
+*/
+var PRESENCE_HEARTBEAT_MS = 2e4;
+/**
+* How long live messages are held back waiting for a catch-up response.
+*
+* Short, because the cost of waiting is visible — on a collaborative document
+* this is a stall in everyone else's edits appearing. Long enough that a slow
+* replay of a busy channel is not abandoned needlessly.
+*/
+var CATCH_UP_TIMEOUT_MS = 1e4;
+var RebaseRealtimeChannel = class {
+	name;
+	transport;
+	presenceHandlers = /* @__PURE__ */ new Set();
+	broadcastHandlers = /* @__PURE__ */ new Set();
+	unsubscribers = [];
+	/** Last known roster, kept so handlers always get a full picture. */
+	presences = {};
+	/** What this client last tracked, replayed on reconnect and heartbeat. */
+	trackedState = null;
+	heartbeat = null;
+	joined = false;
+	/** Whether this handle asks the server to replay missed messages. */
+	wantsHistory;
+	/**
+	* Highest sequence number delivered to handlers so far.
+	*
+	* This is the resume point sent as `sinceSeq`, and the watermark that makes
+	* replay idempotent: catch-up ranges overlap with what arrived live, and
+	* anything at or below this has already been seen.
+	*/
+	lastSeq = 0;
+	/**
+	* Live messages that arrived while a catch-up was in flight.
+	*
+	* Without this they would be delivered ahead of the older messages being
+	* fetched, and — worse — would advance {@link lastSeq} past them, so the
+	* catch-up response would then be discarded as already-seen and those
+	* messages would be lost for good. Held here and flushed, in order, once
+	* the replay lands.
+	*/
+	pendingLive = [];
+	catchUpInFlight = false;
+	/**
+	* Deadline for a catch-up response.
+	*
+	* Buffering live messages is only safe because the wait is bounded. A
+	* catch-up frame that never arrives — a server that dropped it, a socket
+	* that died between request and reply — would otherwise leave the channel
+	* silently holding every subsequent edit forever, which is a worse failure
+	* than the one replay was added to fix.
+	*/
+	catchUpTimeout = null;
+	/**
+	* Callers of {@link history} awaiting the next `channel_history` frame.
+	*
+	* These frames are addressed by channel rather than by request id, so they
+	* are matched in arrival order. Requests on one channel are serialized by
+	* the socket, so FIFO is the right correlation here.
+	*/
+	historyWaiters = [];
+	constructor(name, transport, options = {}) {
+		this.name = name;
+		this.transport = transport;
+		this.wantsHistory = options.history ?? false;
+	}
+	/**
+	* Turn on catch-up for a handle that was created without it.
+	*
+	* The client hands back the same channel object for a given name, so a
+	* later `channel(name, { history: true })` has no new object to configure —
+	* it upgrades this one instead. Idempotent, and never downgrades: one
+	* caller asking for history must not be switched off by another that did
+	* not ask.
+	*/
+	enableHistory() {
+		if (this.wantsHistory) return;
+		this.wantsHistory = true;
+		if (this.joined) this.requestHistory();
+	}
+	/**
+	* Join the channel and ask for the current roster.
+	*
+	* Called automatically by `track`, `broadcast`, `onPresence` and
+	* `onBroadcast`; calling it directly is only needed to start receiving
+	* before there is anything to send.
+	*/
+	/**
+	* Send a channel message.
+	*
+	* Every channel message is read by the server out of a `payload` envelope
+	* (`payload?.channel`, `payload?.state`, `payload?.event`). Sending those
+	* fields flat does not error: `payload?.channel` simply reads as
+	* `undefined`, so the client is registered into channel `undefined` with
+	* empty state, and the echo comes back with no `channel` for
+	* `onChannelMessage` to match — presence and broadcast both go quiet with
+	* nothing logged. Funnelled through one place so a new message type cannot
+	* reintroduce that.
+	*/
+	send(type, fields = {}) {
+		return this.transport.sendMessage({
+			type,
+			payload: {
+				channel: this.name,
+				...fields
+			}
+		});
+	}
+	async join() {
+		if (this.joined) return;
+		this.joined = true;
+		this.unsubscribers.push(this.transport.onChannelMessage(this.name, (message) => this.handle(message)));
+		this.unsubscribers.push(this.transport.onReconnect(() => {
+			this.rejoin();
+		}));
+		await this.send("join_channel");
+		await this.send("presence_state");
+		if (this.wantsHistory) await this.requestHistory();
+	}
+	async rejoin() {
+		try {
+			await this.send("join_channel");
+			await this.send("presence_state");
+			if (this.trackedState) await this.send("presence_track", { state: this.trackedState });
+			if (this.wantsHistory) await this.requestHistory();
+		} catch {}
+	}
+	/**
+	* Ask the server for everything after {@link lastSeq}.
+	*
+	* Live messages are buffered from here until the answer arrives — see
+	* {@link pendingLive}.
+	*/
+	async requestHistory(limit) {
+		this.catchUpInFlight = true;
+		if (this.catchUpTimeout) clearTimeout(this.catchUpTimeout);
+		this.catchUpTimeout = setTimeout(() => this.abandonCatchUp(), CATCH_UP_TIMEOUT_MS);
+		this.catchUpTimeout.unref?.();
+		try {
+			await this.send("channel_history", {
+				sinceSeq: this.lastSeq,
+				...limit !== void 0 ? { limit } : {}
+			});
+		} catch {
+			this.abandonCatchUp();
+		}
+	}
+	/**
+	* Give up waiting for a catch-up and release what was held back.
+	*
+	* The buffered messages are still the freshest thing this client has, so
+	* they are delivered rather than dropped. Callers of {@link history} are
+	* answered with `retained: false` — accurate in the sense that matters:
+	* this client has no history to work from and has to resync.
+	*/
+	abandonCatchUp() {
+		if (this.catchUpTimeout) {
+			clearTimeout(this.catchUpTimeout);
+			this.catchUpTimeout = null;
+		}
+		if (!this.catchUpInFlight) return;
+		this.catchUpInFlight = false;
+		for (const resolve of this.historyWaiters.splice(0)) resolve({
+			messages: [],
+			retained: false
+		});
+		this.flushPendingLive();
+	}
+	/**
+	* Publish this client's presence state, and keep publishing it.
+	*
+	* Calling `track` again replaces the state (and restarts the heartbeat),
+	* which is how you update e.g. a cursor position.
+	*/
+	async track(state) {
+		await this.join();
+		this.trackedState = state;
+		await this.send("presence_track", { state });
+		if (!this.heartbeat) {
+			this.heartbeat = setInterval(() => {
+				if (!this.trackedState) return;
+				this.send("presence_track", { state: this.trackedState }).catch(() => {});
+			}, PRESENCE_HEARTBEAT_MS);
+			this.heartbeat.unref?.();
+		}
+	}
+	/** Stop publishing presence, without leaving the channel. */
+	async untrack() {
+		this.stopHeartbeat();
+		this.trackedState = null;
+		if (this.joined) await this.send("presence_untrack");
+	}
+	/**
+	* Observe the roster. The handler fires immediately with what is already
+	* known, then on every change.
+	*/
+	onPresence(handler) {
+		this.presenceHandlers.add(handler);
+		this.join();
+		if (Object.keys(this.presences).length > 0) handler({ ...this.presences });
+		return () => this.presenceHandlers.delete(handler);
+	}
+	/** Send a broadcast. The sender does not receive its own message. */
+	async broadcast(event, payload) {
+		await this.join();
+		await this.send("broadcast", {
+			event,
+			payload
+		});
+	}
+	onBroadcast(eventOrHandler, maybeHandler) {
+		const wrapped = typeof eventOrHandler === "string" ? (e) => {
+			if (e.event === eventOrHandler) maybeHandler(e.payload);
+		} : eventOrHandler;
+		this.broadcastHandlers.add(wrapped);
+		this.join();
+		return () => this.broadcastHandlers.delete(wrapped);
+	}
+	/**
+	* The last sequence number this channel has delivered.
+	*
+	* Zero on a channel that retains nothing. Persist it if you want catch-up
+	* to survive a page reload as well as a reconnect, and pass it back via
+	* {@link history}.
+	*/
+	get sequence() {
+		return this.lastSeq;
+	}
+	/**
+	* Fetch retained messages explicitly, instead of waiting for join or
+	* reconnect to do it.
+	*
+	* Defaults to resuming from {@link sequence}. Messages are delivered to
+	* `onBroadcast` handlers as usual — the returned value is for callers that
+	* want to inspect the batch, or to learn from `retained` that the channel
+	* keeps no history at all.
+	*/
+	async history(options = {}) {
+		await this.join();
+		if (options.sinceSeq !== void 0) this.lastSeq = options.sinceSeq;
+		const result = new Promise((resolve) => {
+			this.historyWaiters.push(resolve);
+		});
+		await this.requestHistory(options.limit);
+		return result;
+	}
+	/** Leave the channel and release every listener and timer. */
+	async leave() {
+		this.stopHeartbeat();
+		this.trackedState = null;
+		this.presences = {};
+		this.presenceHandlers.clear();
+		this.broadcastHandlers.clear();
+		this.lastSeq = 0;
+		this.pendingLive = [];
+		this.catchUpInFlight = false;
+		if (this.catchUpTimeout) {
+			clearTimeout(this.catchUpTimeout);
+			this.catchUpTimeout = null;
+		}
+		for (const resolve of this.historyWaiters.splice(0)) resolve({
+			messages: [],
+			retained: false
+		});
+		for (const off of this.unsubscribers) off();
+		this.unsubscribers = [];
+		if (this.joined) {
+			this.joined = false;
+			await this.send("leave_channel");
+		}
+	}
+	stopHeartbeat() {
+		if (this.heartbeat) {
+			clearInterval(this.heartbeat);
+			this.heartbeat = null;
+		}
+	}
+	/** Fold an incoming frame into the roster and fan it out. */
+	handle(message) {
+		switch (message.type) {
+			case "presence_state":
+				this.presences = message.presences ?? {};
+				this.emitPresence();
+				break;
+			case "presence_diff": {
+				const joins = message.joins ?? {};
+				const leaves = message.leaves ?? {};
+				for (const [id, state] of Object.entries(joins)) this.presences[id] = state;
+				for (const id of Object.keys(leaves)) delete this.presences[id];
+				this.emitPresence({
+					joins,
+					leaves
+				});
+				break;
+			}
+			case "broadcast": {
+				const seq = typeof message.seq === "number" ? message.seq : void 0;
+				const event = {
+					event: message.event,
+					payload: message.payload,
+					...seq !== void 0 ? { seq } : {}
+				};
+				if (seq === void 0) {
+					this.deliver(event);
+					break;
+				}
+				if (this.catchUpInFlight) {
+					this.pendingLive.push(event);
+					break;
+				}
+				if (seq <= this.lastSeq) break;
+				this.lastSeq = seq;
+				this.deliver(event);
+				break;
+			}
+			case "channel_history": {
+				this.catchUpInFlight = false;
+				if (this.catchUpTimeout) {
+					clearTimeout(this.catchUpTimeout);
+					this.catchUpTimeout = null;
+				}
+				const entries = message.messages ?? [];
+				const retained = message.retained === true;
+				const latestSeq = typeof message.latestSeq === "number" ? message.latestSeq : void 0;
+				for (const resolve of this.historyWaiters.splice(0)) resolve({
+					messages: entries,
+					retained,
+					latestSeq
+				});
+				for (const entry of entries) {
+					if (entry.seq <= this.lastSeq) continue;
+					this.lastSeq = entry.seq;
+					this.deliver({
+						event: entry.event,
+						payload: entry.payload,
+						seq: entry.seq,
+						replayed: true
+					});
+				}
+				this.flushPendingLive();
+				break;
+			}
+		}
+	}
+	/** Deliver everything held back during a catch-up, in sequence order. */
+	flushPendingLive() {
+		if (this.pendingLive.length === 0) return;
+		const buffered = this.pendingLive.sort((a, b) => (a.seq ?? 0) - (b.seq ?? 0));
+		this.pendingLive = [];
+		for (const event of buffered) {
+			const seq = event.seq;
+			if (seq !== void 0) {
+				if (seq <= this.lastSeq) continue;
+				this.lastSeq = seq;
+			}
+			this.deliver(event);
+		}
+	}
+	deliver(event) {
+		for (const handler of [...this.broadcastHandlers]) handler(event);
+	}
+	emitPresence(diff) {
+		const snapshot = { ...this.presences };
+		for (const handler of this.presenceHandlers) handler(snapshot, diff);
+	}
+};
+/**
 * Derive a WebSocket URL from an HTTP base URL.
 * `http://` → `ws://`, `https://` → `wss://`.
 */
@@ -16217,8 +17679,10 @@ function createRebaseClient(options) {
 		});
 		return storageSourcesPromise;
 	};
-	const resolvedWsUrl = options.websocketUrl ?? deriveWebSocketUrl(options.baseUrl);
+	const resolvedWsUrl = options.realtime !== false ? options.websocketUrl ?? deriveWebSocketUrl(options.baseUrl) : void 0;
 	let ws;
+	/** One channel object per name — see `realtime.channel`. */
+	const realtimeChannels = /* @__PURE__ */ new Map();
 	if (resolvedWsUrl) {
 		ws = new RebaseWebSocketClient({
 			websocketUrl: resolvedWsUrl,
@@ -16242,7 +17706,7 @@ function createRebaseClient(options) {
 			if (!ws) return;
 			if (event === "SIGNED_OUT") ws.disconnect();
 			else if (event === "SIGNED_IN" || event === "TOKEN_REFRESHED") {
-				if (session?.accessToken) ws.authenticate(session.accessToken).catch(console.warn);
+				if (session?.accessToken && ws.hasSocket) ws.authenticate(session.accessToken).catch(console.warn);
 			}
 		});
 	}
@@ -16329,6 +17793,36 @@ function createRebaseClient(options) {
 		createStorageSource,
 		fetchStorageSources,
 		ws,
+		realtime: { 
+		/**
+		* Join a broadcast/presence channel.
+		*
+		* Repeated calls with the same name return the same channel, so
+		* separate components can attach handlers without each opening its
+		* own membership — and `leave()` from one would otherwise silently
+		* cut off the others.
+		*/
+channel: (name, options) => {
+			if (!ws) throw new RebaseClientError("Realtime is disabled on this client (realtime: false), so channels are unavailable.");
+			let existing = realtimeChannels.get(name);
+			if (!existing) {
+				existing = new RebaseRealtimeChannel(name, ws, options);
+				realtimeChannels.set(name, existing);
+			} else if (options?.history) existing.enableHistory();
+			return existing;
+		} },
+		/**
+		* Release the realtime socket and its reconnect timer.
+		*
+		* Until this returns, the open socket keeps the Node event loop alive
+		* and the process will not exit on its own. Safe to call when realtime
+		* was never started, and safe to call twice.
+		*/
+		close: () => {
+			for (const channel of realtimeChannels.values()) channel.leave();
+			realtimeChannels.clear();
+			ws?.disconnect(true);
+		},
 		setToken: transport.setToken,
 		setAuthTokenGetter: transport.setAuthTokenGetter,
 		setOnUnauthorized: transport.setOnUnauthorized,
@@ -16763,16 +18257,7 @@ async function _initializeRebaseBackend(config) {
 			const authDs = resolveDataSource(safeAuthConfig.collection, dataSourceRegistry);
 			if (authDs.key !== "(default)") logger.warn(`[Auth] The auth collection "${safeAuthConfig.collection.slug}" is on data source "${authDs.key}", but the built-in auth system always uses the default data source. Move the auth collection to the default data source, or replace auth with an AuthAdapter that manages users in "${authDs.key}".`);
 		}
-		if (safeAuthConfig.collection?.callbacks) {
-			const cb = safeAuthConfig.collection.callbacks;
-			const dataCallbacks = [
-				"beforeSave",
-				"afterSave",
-				"beforeDelete",
-				"afterDelete"
-			].filter((k) => typeof cb[k] === "function");
-			if (dataCallbacks.length > 0) logger.warn(`[Auth] The auth collection "${safeAuthConfig.collection.slug}" defines ${dataCallbacks.join("/")} callback(s), but these do NOT fire when users are created or updated through the auth system (registration, admin, OAuth) — that path bypasses the collection save pipeline. Use auth hooks (afterUserCreate, beforeUserCreate, afterUserDelete, …) for those side effects.`);
-		}
+		warnOnAuthCollectionDataCallbacks(safeAuthConfig.collection);
 		safeAuthConfig.collection && safeAuthConfig.collection.auth;
 		if (safeAuthConfig.jwtSecret) configureJwt({
 			secret: safeAuthConfig.jwtSecret,
@@ -16800,6 +18285,33 @@ async function _initializeRebaseBackend(config) {
 		}
 		logger.info("Entity history initialized");
 	} else logger.warn("History requested but default bootstrapper does not support initializeHistory");
+	const internalServiceKey = serviceKey || randomBytes(48).toString("base64");
+	if (!serviceKey) logger.info("No REBASE_SERVICE_KEY configured. Generated internal per-boot key for singleton control-plane APIs.");
+	if (authAdapter && !authAdapter.serviceKey) authAdapter.serviceKey = internalServiceKey;
+	let apiKeyStore;
+	const apiKeyStoreResult = createApiKeyStore(defaultDriver);
+	if (apiKeyStoreResult) {
+		apiKeyStore = apiKeyStoreResult;
+		await apiKeyStore.ensureTable();
+		logger.info("Service API Keys initialized");
+	}
+	const apiKeyPreAuth = apiKeyStore ? createApiKeyPreAuth({
+		store: apiKeyStore,
+		driver: defaultDriver
+	}) : void 0;
+	if (apiKeyPreAuth) config.app.use(`${basePath}/admin/*`, apiKeyPreAuth);
+	if (apiKeyStore) {
+		const apiKeyRoutes = createApiKeyRoutes({
+			store: apiKeyStore,
+			serviceKey: internalServiceKey
+		});
+		config.app.route(`${basePath}/admin/api-keys`, apiKeyRoutes);
+		logger.info("API key admin routes mounted", { path: `${basePath}/admin/api-keys` });
+	}
+	const rateLimitConfig = config.rateLimit?.enabled !== false ? {
+		...config.rateLimit,
+		store: config.rateLimit?.store ?? new MemoryRateLimitStore(config.rateLimit?.windowMs ?? 900 * 1e3)
+	} : void 0;
 	const { storageRegistry, storageController } = await initializeStorage(config.storage, isProduction);
 	if (config.auth) {
 		config.app.get(`${basePath}/auth/config`, async (c) => {
@@ -16892,7 +18404,7 @@ async function _initializeRebaseBackend(config) {
 				allowUserLookup: safeAuthConfig.allowUserLookup ?? false,
 				defaultRole: safeAuthConfig.defaultRole,
 				oauthProviders,
-				serviceKey,
+				serviceKey: serviceKey || internalServiceKey,
 				authHooks: safeAuthConfig.hooks,
 				collectionAuthConfig,
 				enableMagicLink: safeAuthConfig.magicLink ?? false,
@@ -16917,33 +18429,31 @@ async function _initializeRebaseBackend(config) {
 			}
 		}
 	}
-	const internalServiceKey = serviceKey || randomBytes(48).toString("base64");
-	if (!serviceKey) logger.info("No REBASE_SERVICE_KEY configured. Generated internal per-boot key for singleton control-plane APIs.");
-	if (authAdapter && !authAdapter.serviceKey) authAdapter.serviceKey = internalServiceKey;
-	let apiKeyStore;
-	const apiKeyStoreResult = createApiKeyStore(defaultDriver);
-	if (apiKeyStoreResult) {
-		apiKeyStore = apiKeyStoreResult;
-		await apiKeyStore.ensureTable();
-		logger.info("Service API Keys initialized");
-		const apiKeyRoutes = createApiKeyRoutes({
-			store: apiKeyStore,
-			serviceKey: internalServiceKey
-		});
-		config.app.route(`${basePath}/admin/api-keys`, apiKeyRoutes);
-		logger.info("API key admin routes mounted", { path: `${basePath}/admin/api-keys` });
-	}
+	const adminSurfacesGated = !!authAdapter && (isAuthAdapter(config.auth) || config.auth.requireAuth !== false && !!config.auth.jwtSecret);
+	const applyAdminGate = (router, surface) => {
+		if (!adminSurfacesGated) {
+			logger.warn(`${surface} routes are mounted WITHOUT an auth gate (no auth configured, requireAuth: false, or no jwtSecret) — anyone who can reach the server can call them.`);
+			return;
+		}
+		if (apiKeyPreAuth) router.use("/*", apiKeyPreAuth);
+		router.use("/*", createRequireAuth({ serviceKey: internalServiceKey }), requireAdmin);
+	};
 	const schemaEditorEnabled = config.schemaEditor ?? (!!config.collectionsDir && process.env.NODE_ENV !== "production" && mode === "cms");
 	if (schemaEditorEnabled && !config.collectionsDir) logger.warn("schemaEditor is enabled but no collectionsDir is set — the schema editor has nowhere to write. Skipping.");
 	if (schemaEditorEnabled && config.collectionsDir) {
-		const { createSchemaEditorRoutes } = await import("./schema-editor-routes-D3ef8zu1.js");
-		const schemaEditorRoutes = createSchemaEditorRoutes(config.collectionsDir);
-		if (authAdapter && !isAuthAdapter(config.auth)) {
-			const safeAuth = config.auth;
-			if (safeAuth.requireAuth !== false && !!safeAuth.jwtSecret) schemaEditorRoutes.use("/*", requireAuth, requireAdmin);
-		} else if (authAdapter) schemaEditorRoutes.use("/*", requireAuth, requireAdmin);
-		config.app.route(`${basePath}/schema-editor`, schemaEditorRoutes);
-		logger.info("Schema Editor mounted", { path: `${basePath}/schema-editor` });
+		let editorModule;
+		try {
+			editorModule = await import("./schema-editor-routes-D3ef8zu1.js");
+		} catch (err) {
+			if (err?.code === "ERR_MODULE_NOT_FOUND") logger.warn("Schema Editor disabled: its dependency ts-morph is not installed. Run `npm install ts-morph@28.0.0` to enable it.");
+			else throw err;
+		}
+		if (editorModule) {
+			const schemaEditorRoutes = editorModule.createSchemaEditorRoutes(config.collectionsDir);
+			applyAdminGate(schemaEditorRoutes, "Schema editor");
+			config.app.route(`${basePath}/schema-editor`, schemaEditorRoutes);
+			logger.info("Schema Editor mounted", { path: `${basePath}/schema-editor` });
+		}
 	}
 	if (storageController) {
 		const storageMaxSize = (config.storage && typeof config.storage === "object" && "type" in config.storage ? config.storage.maxFileSize : void 0) ?? 50 * 1024 * 1024;
@@ -16952,9 +18462,12 @@ async function _initializeRebaseBackend(config) {
 			registry: storageRegistry,
 			sources: config.storageSources,
 			requireAuth: resolveRequireAuth(config.auth),
-			authAdapter
+			authAdapter,
+			authorize: config.storageAuthorize
 		});
-		storageRoutes.use("/upload", bodyLimit({
+		const storageRouter = new Hono();
+		if (apiKeyPreAuth) storageRouter.use("/*", apiKeyPreAuth, createStorageApiKeyGuard());
+		storageRouter.use("/upload", bodyLimit({
 			maxSize: storageMaxSize,
 			onError: (c) => {
 				return c.json({ error: {
@@ -16963,7 +18476,8 @@ async function _initializeRebaseBackend(config) {
 				} }, 413);
 			}
 		}));
-		config.app.route(`${basePath}/storage`, storageRoutes);
+		storageRouter.route("/", storageRoutes);
+		config.app.route(`${basePath}/storage`, storageRouter);
 	}
 	if (activeCollections.length > 0) {
 		const dataRouter = new Hono();
@@ -16992,7 +18506,7 @@ async function _initializeRebaseBackend(config) {
 			serviceKey: internalServiceKey,
 			apiKeyStore
 		}));
-		if (apiKeyStore) dataRouter.use("/*", createApiKeyRateLimiter());
+		if (rateLimitConfig) dataRouter.use("/*", createDataRateLimiter(rateLimitConfig));
 		if (historyConfigResult && historyConfigResult.historyService) {
 			const historyRoutes = createHistoryRoutes({
 				historyService: historyConfigResult.historyService,
@@ -17037,6 +18551,10 @@ async function _initializeRebaseBackend(config) {
 		dataAsAdmin: serverData
 	});
 	logger.info("Native data plane attached to singleton (bypasses HTTP loop)");
+	if (storageController) {
+		Object.assign(serverClient, { storage: storageController });
+		logger.info("Native storage attached to singleton (bypasses HTTP loop)");
+	}
 	let emailService;
 	if (authConfigResult?.emailService) emailService = authConfigResult.emailService;
 	else if (config.auth && !isAuthAdapter(config.auth) && config.auth.email) emailService = createEmailService(config.auth.email);
@@ -17081,6 +18599,11 @@ async function _initializeRebaseBackend(config) {
 				serviceKey: internalServiceKey,
 				apiKeyStore
 			}));
+			functionsRouter.use("/*", createFunctionApiKeyGuard(`${basePath}/functions`));
+			if (rateLimitConfig) functionsRouter.use("/*", createDataRateLimiter({
+				...rateLimitConfig,
+				anonymous: null
+			}));
 			const fnRoutes = createFunctionRoutes(loadedFunctions);
 			functionsRouter.route("/", fnRoutes);
 			config.app.route(`${basePath}/functions`, functionsRouter);
@@ -17107,10 +18630,7 @@ async function _initializeRebaseBackend(config) {
 				cronScheduler.setStore(store);
 			}
 			const cronRouter = new Hono();
-			if (authAdapter && !isAuthAdapter(config.auth)) {
-				const safeAuth = config.auth;
-				if (safeAuth.requireAuth !== false && !!safeAuth.jwtSecret) cronRouter.use("/*", requireAuth, requireAdmin);
-			} else if (authAdapter) cronRouter.use("/*", requireAuth, requireAdmin);
+			applyAdminGate(cronRouter, "Cron");
 			cronRouter.route("/", createCronRoutes(cronScheduler));
 			config.app.route(`${basePath}/cron`, cronRouter);
 			cronScheduler.start();
@@ -17123,10 +18643,7 @@ async function _initializeRebaseBackend(config) {
 	{
 		const { createBackupRoutes, parseBackupDestination } = await Promise.resolve().then(() => backup_exports);
 		const backupRouter = new Hono();
-		if (authAdapter && !isAuthAdapter(config.auth)) {
-			const safeAuth = config.auth;
-			if (safeAuth.requireAuth !== false && !!safeAuth.jwtSecret) backupRouter.use("/*", requireAuth, requireAdmin);
-		} else if (authAdapter) backupRouter.use("/*", requireAuth, requireAdmin);
+		applyAdminGate(backupRouter, "Backup");
 		backupRouter.route("/", createBackupRoutes({
 			getDestination: () => {
 				const out = process.env.BACKUP_DESTINATION?.trim();
@@ -17137,6 +18654,14 @@ async function _initializeRebaseBackend(config) {
 		config.app.route(`${basePath}/admin/backups`, backupRouter);
 		logger.info("Backup admin routes mounted", { path: `${basePath}/admin/backups` });
 	}
+	{
+		const { default: logsRoutes } = await Promise.resolve().then(() => logs_routes_exports);
+		const logsRouter = new Hono();
+		applyAdminGate(logsRouter, "Logs");
+		logsRouter.route("/", logsRoutes);
+		config.app.route(`${basePath}/logs`, logsRouter);
+		logger.info("Logs routes mounted", { path: `${basePath}/logs` });
+	}
 	const effectiveRealtimeService = Object.keys(realtimeServices).length > 1 ? createRoutedRealtimeService({
 		providers: realtimeServices,
 		defaultKey: defaultDriverId,
@@ -17150,9 +18675,34 @@ async function _initializeRebaseBackend(config) {
 		cronScheduler,
 		realtimeServices
 	});
+	/**
+	* Every registry a driver might resolve callbacks from, plus the backend's
+	* own. Each holds its own normalized copy of a collection, so callbacks have
+	* to be written to all of them.
+	*/
+	const callbackTargets = () => {
+		const targets = [collectionRegistry];
+		for (const key of [DEFAULT_DRIVER_ID, ...driverRegistry.list()]) {
+			const d = driverRegistry.get(key);
+			if (d?.registry && typeof d.registry.get === "function" && !targets.includes(d.registry)) targets.push(d.registry);
+		}
+		return targets;
+	};
+	const setCollectionCallbacks = (slug, callbacks) => {
+		let attached = 0;
+		for (const registry of callbackTargets()) {
+			const collection = registry.get(slug);
+			if (collection) {
+				collection.callbacks = callbacks;
+				attached++;
+			}
+		}
+		if (attached === 0) logger.warn(`[callbacks] Collection "${slug}" not found in any registry — callbacks not attached.`);
+	};
 	return {
 		driverRegistry,
 		driver: defaultDriver,
+		setCollectionCallbacks,
 		realtimeServices,
 		realtimeService: effectiveRealtimeService,
 		auth: authConfigResult,
@@ -17182,7 +18732,7 @@ async function loadFunctionsFromDirectory(directory, importModule = nativeDynami
 	const problems = [];
 	if (!fs$2.existsSync(directory)) return functions;
 	const files = fs$2.readdirSync(directory);
-	for (const file of files) if ((file.endsWith(".ts") || file.endsWith(".js")) && !file.includes(".test.") && !file.endsWith(".d.ts") && file !== "index.ts" && file !== "index.js") {
+	for (const file of files) if ((file.endsWith(".ts") || file.endsWith(".js")) && !file.startsWith(".") && !file.includes(".test.") && !file.endsWith(".d.ts") && file !== "index.ts" && file !== "index.js") {
 		const filePath = path$1.join(directory, file);
 		try {
 			const fileUrl = pathToFileURL(filePath).href;
@@ -17311,7 +18861,7 @@ async function loadCronJobsFromDirectory(directory, importModule = nativeDynamic
 	const jobs = [];
 	if (!fs$2.existsSync(directory)) return jobs;
 	const files = fs$2.readdirSync(directory);
-	for (const file of files) if ((file.endsWith(".ts") || file.endsWith(".js")) && !file.includes(".test.") && !file.endsWith(".d.ts") && file !== "index.ts" && file !== "index.js") {
+	for (const file of files) if ((file.endsWith(".ts") || file.endsWith(".js")) && !file.startsWith(".") && !file.includes(".test.") && !file.endsWith(".d.ts") && file !== "index.ts" && file !== "index.js") {
 		const filePath = path$1.join(directory, file);
 		try {
 			const fileUrl = pathToFileURL(filePath).href;
@@ -17585,6 +19135,7 @@ var CronScheduler = class {
 			logger.warn("[cron] Failed to seed job stats from database", { error: err });
 		});
 		for (const [id, job] of this.jobs) if (job.enabled) this.scheduleNext(id);
+		if (!this.store) logger.warn("[cron] No cron store attached — runs are uncoordinated; with multiple app instances every instance will execute every job");
 		logger.info(`⏰ Cron scheduler started with ${this.jobs.size} job(s)`);
 	}
 	/**
@@ -17703,6 +19254,19 @@ var CronScheduler = class {
 					this.scheduleNext(id);
 					return;
 				}
+				if (this.store?.tryClaimRun) {
+					let claimed = true;
+					try {
+						claimed = await this.store.tryClaimRun(id, nextRun.toISOString());
+					} catch (err) {
+						logger.warn(`[cron] Claim check threw for "${id}" — running uncoordinated`, { error: err });
+					}
+					if (!claimed) {
+						logger.info(`[cron] Slot ${nextRun.toISOString()} for "${id}" claimed by another instance — skipping`);
+						if (this.started && job.enabled) this.scheduleNext(id);
+						return;
+					}
+				}
 				await this.executeJob(job, false);
 				if (this.started && job.enabled) this.scheduleNext(id);
 			}, Math.max(rawDelay, MIN_SCHEDULE_INTERVAL_MS));
@@ -17871,6 +19435,25 @@ function createCronRoutes(scheduler) {
 //#region src/cron/cron-store.ts
 var cron_store_exports = /* @__PURE__ */ __exportAll({ createCronStore: () => createCronStore });
 var TABLE = "rebase.cron_logs";
+var CLAIMS_TABLE = "rebase.cron_claims";
+/** Claims older than this are garbage-collected on startup. */
+var CLAIM_RETENTION_DAYS = 7;
+/**
+* Detect a unique-constraint violation anywhere in an error's cause chain.
+* Drizzle wraps the PG error — match the SQLSTATE code, never message text.
+* Also covers SQLite ("UNIQUE constraint failed") and MySQL (ER_DUP_ENTRY 1062)
+* for future SQL drivers.
+*/
+function isUniqueViolation(err) {
+	let current = err;
+	for (let depth = 0; depth < 10 && current; depth++) if (typeof current === "object") {
+		const e = current;
+		if (e.code === "23505" || e.errno === 1062) return true;
+		if (typeof e.message === "string" && e.message.includes("UNIQUE constraint failed")) return true;
+		current = e.cause;
+	} else break;
+	return false;
+}
 function createCronStore(driver) {
 	const admin = driver.admin;
 	if (!isSQLAdmin(admin)) {
@@ -17900,6 +19483,15 @@ function createCronStore(driver) {
                     CREATE INDEX IF NOT EXISTS idx_cron_logs_job
                     ON ${TABLE}(job_id, started_at DESC)
                 `);
+				await exec(`
+                    CREATE TABLE IF NOT EXISTS ${CLAIMS_TABLE} (
+                        job_id TEXT NOT NULL,
+                        slot TIMESTAMPTZ NOT NULL,
+                        claimed_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+                        PRIMARY KEY (job_id, slot)
+                    )
+                `);
+				await exec(`DELETE FROM ${CLAIMS_TABLE} WHERE claimed_at < now() - make_interval(days => $1)`, { params: [CLAIM_RETENTION_DAYS] });
 				logger.info("✅ Cron logs table ready");
 			} catch (err) {
 				logger.error("❌ Failed to create cron logs table", { error: err });
@@ -17959,6 +19551,18 @@ function createCronStore(driver) {
 				logger.error("[cron-store] Failed to fetch job stats", { error: err });
 			}
 			return stats;
+		},
+		async tryClaimRun(jobId, slot) {
+			try {
+				return (await exec(`INSERT INTO ${CLAIMS_TABLE} (job_id, slot)
+                     VALUES ($1, $2)
+                     ON CONFLICT (job_id, slot) DO NOTHING
+                     RETURNING job_id`, { params: [jobId, slot] })).length > 0;
+			} catch (err) {
+				if (isUniqueViolation(err)) return false;
+				logger.warn(`[cron-store] Claim check failed for "${jobId}" — running uncoordinated`, { error: err });
+				return true;
+			}
 		}
 	};
 }
@@ -18138,10 +19742,10 @@ var backup_exports = /* @__PURE__ */ __exportAll({
 /**
 * Returns a SQL chunk calling `auth.uid()` — the current user's ID.
 * This is a PostgreSQL RLS helper function created in the `auth` schema
-* that reads `app.user_id` set per-transaction by `withAuth()`.
+* that reads `app.uid` set per-transaction by `withAuth()`.
 *
 * @example
-* sql`${table.user_id} = ${authUid()}`
+* sql`${table.uid} = ${authUid()}`
 */
 var authUid = () => {
 	return sql`auth.uid()`;
@@ -18247,14 +19851,21 @@ var rebaseEnvSchema = object({
 	DATABASE_DIRECT_URL: string().url().optional(),
 	DATABASE_READ_URL: string().url().optional(),
 	FORCE_LOCAL_STORAGE: optionalBoolString,
-	STORAGE_TYPE: _enum(["local", "s3"]).default("local"),
+	STORAGE_TYPE: _enum([
+		"local",
+		"s3",
+		"gcs"
+	]).default("local"),
 	STORAGE_PATH: string().optional(),
 	S3_BUCKET: string().optional(),
 	S3_REGION: string().optional(),
 	S3_ACCESS_KEY_ID: string().optional(),
 	S3_SECRET_ACCESS_KEY: string().optional(),
 	S3_ENDPOINT: string().url().optional(),
-	S3_FORCE_PATH_STYLE: optionalBoolString
+	S3_FORCE_PATH_STYLE: optionalBoolString,
+	GCS_BUCKET: string().optional(),
+	GCS_PROJECT_ID: string().optional(),
+	GCS_KEY_FILENAME: string().optional()
 });
 function loadEnv(options) {
 	const isProduction = process.env.NODE_ENV === "production";
@@ -18415,7 +20026,11 @@ function writeStateFile(projectRoot, port, serviceKey) {
 			startedAt: (/* @__PURE__ */ new Date()).toISOString()
 		};
 		if (serviceKey) state.serviceKey = serviceKey;
-		fs.writeFileSync(stateFile, JSON.stringify(state, null, 2), "utf-8");
+		fs.writeFileSync(stateFile, JSON.stringify(state, null, 2), {
+			encoding: "utf-8",
+			mode: 384
+		});
+		fs.chmodSync(stateFile, 384);
 	} catch {}
 }
 //#endregion
@@ -18436,7 +20051,11 @@ function serveSPA(app, config) {
 		logger.warn("   SPA serving is disabled. Build your frontend first.");
 		return;
 	}
-	app.use("/*", serveStatic({ root: path$1.relative(process.cwd(), frontendPath) }));
+	app.use("/*", responseCompression());
+	app.use("/*", serveStatic({
+		root: path$1.relative(process.cwd(), frontendPath),
+		precompressed: true
+	}));
 	const allExcludePaths = [apiBasePath, ...excludePaths];
 	let cachedHtml = null;
 	app.get("*", async (c, next) => {