Account
Security
Scoped tokens, path normalization, rate limits, audit logs.
Server functions that read a project go through authMiddleware and assertProjectAccess. A client-sent owner id is ignored.
Studio tokens are hashed and scoped. Sync paths are normalized and must start at a known service.
Build and iterate are rate limited per user. Security-sensitive actions write to logs.
OmniRoute keys, provider keys, and the database service role never ship to the browser.