@quatronic/sdk 0.7.0-rc.6 → 0.7.0-rc.7

package/dist/next/better-auth/index.js

@@ -1,7 +1,7 @@
 import {
   getLogger,
   setUserContext
-} from "../../chunk-MET4SIMB.js";
+} from "../../chunk-EK6TGWWT.js";
 
 // src/next/better-auth/plugin.ts
 import { createAuthMiddleware, getSessionFromCtx } from "better-auth/api";

package/dist/next/connections/index.js

@@ -3,7 +3,7 @@ import {
   assertConnections,
   assertInboundConnection,
   connection
-} from "../../chunk-HQT57ITV.js";
+} from "../../chunk-ZZTO5Z3N.js";
 import {
   CONNECTION_REJECTED_ATTR,
   CONNECTION_REJECT_REASON_ATTR,
@@ -11,9 +11,9 @@ import {
   ConnectionError,
   DEFAULT_CONNECTION_TIMEOUT_MS,
   requireConnection
-} from "../../chunk-TEBDKNUB.js";
+} from "../../chunk-ROHIN74F.js";
 import "../../chunk-5XMTUPIY.js";
-import "../../chunk-MET4SIMB.js";
+import "../../chunk-EK6TGWWT.js";
 export {
   CONNECTION_REJECTED_ATTR,
   CONNECTION_REJECT_REASON_ATTR,

package/dist/next/security/index.js

@@ -1,12 +1,12 @@
 import {
   parseJsonBounded
 } from "../../chunk-FUPTRHT7.js";
-import {
-  proxyMatcher
-} from "../../chunk-X6D3TBNS.js";
 import {
   STATIC_SECURITY_HEADERS
 } from "../../chunk-2HE2D4SY.js";
+import {
+  proxyMatcher
+} from "../../chunk-X6D3TBNS.js";
 
 // src/next/security/index.ts
 import { NextResponse } from "next/server";

package/dist/next/sentry/client.d.ts

@@ -6,6 +6,7 @@ interface SentryLike {
     setUser(user: {
         id: string;
     } | null): void;
+    captureException(err: unknown, hint?: object): unknown;
 }
 
 type BrowserSentry = SentryLike & {

package/dist/next/sentry/client.js

@@ -3,9 +3,9 @@ import {
 } from "../../chunk-DYOSRJH3.js";
 import {
   initSentry
-} from "../../chunk-G7VPNC6M.js";
-import "../../chunk-MET4SIMB.js";
+} from "../../chunk-5MNPBJYS.js";
 import "../../chunk-7ASQHY7O.js";
+import "../../chunk-EK6TGWWT.js";
 
 // src/next/sentry/client.ts
 import * as Sentry from "@sentry/nextjs";

package/dist/next/sentry/register.js

@@ -1,10 +1,10 @@
 import {
   initSentry
-} from "../../chunk-G7VPNC6M.js";
-import "../../chunk-MET4SIMB.js";
+} from "../../chunk-5MNPBJYS.js";
 import {
   readSentryConfig
 } from "../../chunk-7ASQHY7O.js";
+import "../../chunk-EK6TGWWT.js";
 
 // src/next/sentry/register.ts
 import * as Sentry from "@sentry/nextjs";

package/dist/node/connections/index.js

@@ -3,7 +3,7 @@ import {
   assertConnections,
   assertInboundConnection,
   connection
-} from "../../chunk-HQT57ITV.js";
+} from "../../chunk-ZZTO5Z3N.js";
 import {
   CONNECTION_REJECTED_ATTR,
   CONNECTION_REJECT_REASON_ATTR,
@@ -11,9 +11,9 @@ import {
   ConnectionError,
   DEFAULT_CONNECTION_TIMEOUT_MS,
   requireConnection
-} from "../../chunk-TEBDKNUB.js";
+} from "../../chunk-ROHIN74F.js";
 import "../../chunk-5XMTUPIY.js";
-import "../../chunk-MET4SIMB.js";
+import "../../chunk-EK6TGWWT.js";
 export {
   CONNECTION_REJECTED_ATTR,
   CONNECTION_REJECT_REASON_ATTR,

package/dist/node/identity/index.js

@@ -4,12 +4,12 @@ import {
 import {
   ConnectionError,
   requireConnection
-} from "../../chunk-TEBDKNUB.js";
+} from "../../chunk-ROHIN74F.js";
 import {
   defaultEnv,
   readConn
 } from "../../chunk-5XMTUPIY.js";
-import "../../chunk-MET4SIMB.js";
+import "../../chunk-EK6TGWWT.js";
 
 // src/identity-core/jwksCache.ts
 import { createRemoteJWKSet } from "jose";

package/dist/node/sentry/register.js

@@ -1,10 +1,10 @@
 import {
   initSentry
-} from "../../chunk-G7VPNC6M.js";
-import "../../chunk-MET4SIMB.js";
+} from "../../chunk-5MNPBJYS.js";
 import {
   readSentryConfig
 } from "../../chunk-7ASQHY7O.js";
+import "../../chunk-EK6TGWWT.js";
 
 // src/node/sentry/register.ts
 import * as Sentry from "@sentry/node";

package/dist/observability/index.d.ts

@@ -0,0 +1,10 @@
+type LogAttrs = Record<string, unknown>;
+/**
+ * Hands an error the app caught to the error tracker, with flat context.
+ *
+ * Without a tracker it writes the same JSON line `getLogger().error` would, so
+ * a caught error is never silently dropped in an app that has no Sentry.
+ */
+declare function reportError(err: unknown, ctx?: LogAttrs): void;
+
+export { reportError };

package/dist/observability/index.js

@@ -0,0 +1,7 @@
+import {
+  reportError
+} from "../chunk-EK6TGWWT.js";
+export {
+  reportError
+};
+//# sourceMappingURL=index.js.map

package/dist/observability/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/migrations/no-raw-fetch/codemod.mjs

@@ -0,0 +1,97 @@
+// jscodeshift transform for migration no-raw-fetch. Moves the server-side
+// fetch calls that QDC-NET-001 (safe-fetch) flags onto safeFetch, where the
+// move cannot change behaviour beyond what safeFetch exists to change.
+//
+//   npx jscodeshift@17.3.0 --parser=tsx \
+//     -t node_modules/@quatronic/sdk/migrations/no-raw-fetch/codemod.mjs src
+//
+// It rewrites a call only when it is the global `fetch`, in a server path, with
+// a URL the server did not fix, and an init that SafeFetchInit can hold. Every
+// other call is left exactly as it was; instructions.md covers those.
+
+const SERVER_PATHS = ["src/app/api", "src/lib/server", "src/proxy.ts"]
+const MODULE = "@quatronic/sdk/node/net"
+// SafeFetchInit's keys. `cache`, `next`, `redirect`, `credentials` and the
+// rest have no safeFetch equivalent, so a call carrying one needs a person.
+const INIT_KEYS = new Set(["method", "headers", "body", "signal"])
+
+function isServerFile(path) {
+  const file = path.replace(/\\/g, "/")
+  return SERVER_PATHS.some((p) => file.endsWith(`/${p}`) || file.includes(`/${p}/`) || file.startsWith(`${p}/`) || file === p)
+}
+
+/** Mirrors isFixedTarget in src/eslint/ast.ts: a URL the rule does not flag. */
+function isFixed(node) {
+  if (!node) return false
+  if (node.type === "StringLiteral" || node.type === "Literal") return typeof node.value === "string"
+  if (node.type === "TemplateLiteral") return node.expressions.length === 0
+  if (node.type === "NewExpression") return node.callee.type === "Identifier" && node.callee.name === "URL" && isFixed(node.arguments[0])
+  return false
+}
+
+function keyName(prop) {
+  if (prop.computed) return null
+  if (prop.key.type === "Identifier") return prop.key.name
+  return typeof prop.key.value === "string" ? prop.key.value : null
+}
+
+/** An init safeFetch accepts as is: absent, or a literal of SafeFetchInit keys. */
+function isPortableInit(node) {
+  if (!node) return true
+  if (node.type !== "ObjectExpression") return false
+  return node.properties.every((p) => {
+    if (p.type !== "ObjectProperty" && p.type !== "Property") return false
+    const key = keyName(p)
+    if (!key || !INIT_KEYS.has(key)) return false
+    // `headers: new Headers(...)` or a variable may not be a plain record.
+    return key !== "headers" || p.value.type === "ObjectExpression"
+  })
+}
+
+export default function transformer(file, api) {
+  if (!isServerFile(file.path)) return undefined
+  const j = api.jscodeshift
+  const root = j(file.source)
+
+  // A local or imported `fetch` is not the global one.
+  const shadowed =
+    root.find(j.Identifier, { name: "fetch" }).filter((p) => {
+      const parent = p.parent.node
+      return (
+        (parent.type === "VariableDeclarator" && parent.id === p.node) ||
+        (parent.type.startsWith("Function") && parent.id === p.node) ||
+        parent.type === "ImportSpecifier" ||
+        parent.type === "ImportDefaultSpecifier" ||
+        (parent.type.startsWith("Function") && parent.params.includes(p.node))
+      )
+    }).length > 0
+  if (shadowed) return undefined
+
+  const calls = root
+    .find(j.CallExpression, { callee: { type: "Identifier", name: "fetch" } })
+    .filter((p) => p.node.arguments.length >= 1 && p.node.arguments.length <= 2)
+    .filter((p) => !isFixed(p.node.arguments[0]) && p.node.arguments[0].type !== "SpreadElement")
+    .filter((p) => isPortableInit(p.node.arguments[1]))
+  if (calls.length === 0) return undefined
+
+  calls.forEach((p) => {
+    p.node.callee = j.identifier("safeFetch")
+  })
+
+  const existing = root.find(j.ImportDeclaration, { source: { value: MODULE } })
+  const has = existing.find(j.ImportSpecifier, { imported: { name: "safeFetch" } }).length > 0
+  if (!has) {
+    const spec = j.importSpecifier(j.identifier("safeFetch"))
+    const into = existing.filter((p) => p.node.importKind !== "type")
+    if (into.length > 0) into.get().node.specifiers.push(spec)
+    else {
+      const decl = j.importDeclaration([spec], j.literal(MODULE))
+      const imports = root.find(j.ImportDeclaration)
+      if (imports.length > 0) imports.at(imports.length - 1).insertAfter(decl)
+      else root.get().node.program.body.unshift(decl)
+    }
+  }
+  return root.toSource({ quote: "double" })
+}
+
+export const parser = "tsx"

package/migrations/no-raw-fetch/instructions.md

@@ -0,0 +1,68 @@
+# no-raw-fetch
+
+Server code that fetches a URL it did not fix itself uses `safeFetch` from
+`@quatronic/sdk/node/net`, not the global `fetch`.
+
+**Rule:** `qdc/safe-fetch` (QDC-NET-001), in `configs.recommended`. It covers
+`src/app/api`, `src/lib/server` and `src/proxy.ts`.
+
+## Why
+
+A URL built from input can point at the private network: the metadata service,
+another tenant's internal service, the database. `safeFetch` resolves the host,
+refuses private, loopback and link-local addresses, and re-checks every
+redirect. The global `fetch` does none of that.
+
+## First, pick the right client
+
+| The call goes to | Use |
+|---|---|
+| another module of this app | `connection(alias).fetch` from `@quatronic/sdk/node/connections` |
+| a third-party API the app declares | `integration(alias)` from `@quatronic/sdk/node/integrations` |
+| a URL that comes from input or data | `safeFetch` (this migration) |
+
+The codemod only knows the last case. Move the other two by hand first.
+
+## Run the codemod
+
+```bash
+npx jscodeshift@17.3.0 --parser=tsx \
+  -t node_modules/@quatronic/sdk/migrations/no-raw-fetch/codemod.mjs src
+```
+
+It rewrites `fetch(url)` and `fetch(url, init)` to `safeFetch(...)` and adds the
+import, when all of these hold:
+
+- the file is in one of the paths above;
+- `fetch` is the global one (not imported or declared in the file);
+- the URL is not a fixed string, which the rule does not flag;
+- `init` is absent or an object literal with only `method`, `headers` (an
+  object literal), `body` and `signal`.
+
+```ts
+const res = await fetch(target, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify(payload) })
+// →
+const res = await safeFetch(target, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify(payload) })
+```
+
+The printer may add semicolons to the lines it touched; run your formatter. Then
+run `pnpm lint` to see the calls it left.
+
+## Behaviour that changes
+
+Check each rewritten call against these. The codemod cannot.
+
+- **https only.** An `http:` URL is refused. Pass `{ protocols: ["https:", "http:"] }` as the third argument only if the target cannot do TLS.
+- **No redirects.** Pass `{ maxRedirects: 3 }` if the call relied on following them. Each hop is checked again.
+- **5 s timeout and 5 MiB response cap** for the whole request. Raise them with `timeoutMs` and `maxBytes`.
+- **A refused target throws `SafeFetchError`** (`reason` says why). Catch it where the old code handled a network error, and answer the caller with a 4xx, not a 500.
+
+## By hand
+
+| The call has | Do this |
+|---|---|
+| `headers: new Headers(...)` or a variable | Pass a plain object: `Object.fromEntries(headers)`. |
+| a `ReadableStream` or `FormData` body | Read it into a string or `Uint8Array` first. `safeFetch` replays the body on a redirect, so it cannot stream. |
+| `cache`, `next: { revalidate }` | `safeFetch` does not use Next's data cache. Cache the result yourself, or keep `fetch` for a fixed URL (the rule allows that). |
+| `redirect: "manual"` | That is the default. Drop the key. |
+| `credentials`, `mode`, `keepalive` | Browser options. Server code does not need them. Drop the key. |

package/migrations/no-raw-fetch/meta.json

@@ -0,0 +1,6 @@
+{
+  "id": "no-raw-fetch",
+  "rule": "safe-fetch",
+  "introducedIn": "0.7.0",
+  "testOnly": true
+}

package/migrations/report-error/codemod.mjs

@@ -0,0 +1,94 @@
+// jscodeshift transform for migration report-error. Moves the mechanical
+// Sentry.captureException calls that QDC-OBS-004 flags onto reportError.
+//
+//   npx jscodeshift@17.3.0 --parser=tsx \
+//     -t node_modules/@quatronic/sdk/migrations/report-error/codemod.mjs src
+//
+// Rewritten: `captureException(err)` and `captureException(err, { extra })`,
+// through a namespace or a named import of any @sentry/* package. A call that
+// passes tags, a level, a scope callback or anything else is left for a person;
+// instructions.md says what to do with each.
+
+const SENTRY = /^@sentry\//
+const MODULE = "@quatronic/sdk/observability"
+
+function keyName(prop) {
+  if (prop.computed) return null
+  if (prop.key.type === "Identifier") return prop.key.name
+  return typeof prop.key.value === "string" ? prop.key.value : null
+}
+
+/** The context to hand reportError, or false when the hint does not map. */
+function contextOf(hint) {
+  if (!hint) return null
+  if (hint.type !== "ObjectExpression" || hint.properties.length !== 1) return false
+  const only = hint.properties[0]
+  if ((only.type !== "ObjectProperty" && only.type !== "Property") || keyName(only) !== "extra") return false
+  return only.value
+}
+
+export default function transformer(file, api) {
+  const j = api.jscodeshift
+  const root = j(file.source)
+
+  const namespaces = new Set()
+  const named = new Set()
+  const sentryImports = root.find(j.ImportDeclaration).filter((p) => SENTRY.test(String(p.node.source.value)))
+  sentryImports.forEach((p) => {
+    for (const s of p.node.specifiers ?? []) {
+      if (s.type === "ImportNamespaceSpecifier" || s.type === "ImportDefaultSpecifier") namespaces.add(s.local.name)
+      else if (s.type === "ImportSpecifier" && s.imported.name === "captureException") named.add(s.local.name)
+    }
+  })
+  if (namespaces.size === 0 && named.size === 0) return undefined
+
+  let changed = 0
+  root.find(j.CallExpression).forEach((p) => {
+    const c = p.node.callee
+    const isCapture =
+      (c.type === "Identifier" && named.has(c.name)) ||
+      (c.type === "MemberExpression" &&
+        !c.computed &&
+        c.object.type === "Identifier" &&
+        namespaces.has(c.object.name) &&
+        c.property.type === "Identifier" &&
+        c.property.name === "captureException")
+    if (!isCapture) return
+    const [err, hint, ...rest] = p.node.arguments
+    if (!err || rest.length > 0 || err.type === "SpreadElement") return
+    const ctx = contextOf(hint)
+    if (ctx === false) return
+    p.node.callee = j.identifier("reportError")
+    p.node.arguments = ctx ? [err, ctx] : [err]
+    changed++
+  })
+  if (changed === 0) return undefined
+
+  // Drop a named captureException import nothing uses any more.
+  const stillUsed = (name) =>
+    root
+      .find(j.Identifier, { name })
+      .filter((p) => j(p).closest(j.ImportDeclaration).length === 0).length > 0
+  sentryImports.forEach((p) => {
+    const before = p.node.specifiers.length
+    p.node.specifiers = p.node.specifiers.filter(
+      (s) => s.type !== "ImportSpecifier" || s.imported.name !== "captureException" || stillUsed(s.local.name),
+    )
+    if (before > 0 && p.node.specifiers.length === 0) j(p).remove()
+  })
+
+  const existing = root.find(j.ImportDeclaration, { source: { value: MODULE } })
+  if (existing.find(j.ImportSpecifier, { imported: { name: "reportError" } }).length === 0) {
+    const spec = j.importSpecifier(j.identifier("reportError"))
+    if (existing.length > 0) existing.get().node.specifiers.push(spec)
+    else {
+      const decl = j.importDeclaration([spec], j.literal(MODULE))
+      const imports = root.find(j.ImportDeclaration)
+      if (imports.length > 0) imports.at(imports.length - 1).insertAfter(decl)
+      else root.get().node.program.body.unshift(decl)
+    }
+  }
+  return root.toSource({ quote: "double" })
+}
+
+export const parser = "tsx"

package/migrations/report-error/instructions.md

@@ -0,0 +1,46 @@
+# report-error
+
+Report a caught error with `reportError` from `@quatronic/sdk/observability`,
+not with `Sentry.captureException`.
+
+**Rule:** `qdc/use-report-error` (QDC-OBS-004). This is a test-only migration, so no shipped config switches the rule on; run it explicitly with `eslint --rule "qdc/use-report-error: warn"`.
+
+## Why
+
+The SDK owns the error tracker: it initialises Sentry and wires it into its
+telemetry hooks. An app that calls `reportError` keeps reporting when that
+wiring changes (another tracker, a different scrubbing policy, a test fake).
+An app that calls Sentry directly has to be edited for each of those changes.
+Without a tracker, `reportError` writes an error line to the console instead of
+dropping the error.
+
+Spans, `Sentry.logger` and tags stay `Sentry.*`. Only the capture call moves.
+
+## Run the codemod
+
+```bash
+npx jscodeshift@17.3.0 --parser=tsx \
+  -t node_modules/@quatronic/sdk/migrations/report-error/codemod.mjs src
+```
+
+It rewrites these calls:
+
+```ts
+Sentry.captureException(err)                         // → reportError(err)
+Sentry.captureException(err, { extra: { "qore.invoice.id": id } })
+                                                     // → reportError(err, { "qore.invoice.id": id })
+```
+
+It adds the import and removes a named `captureException` import that nothing
+uses any more. Run your formatter (the printer may add semicolons), then
+`pnpm lint` to see what is left.
+
+## By hand
+
+| You pass | Do this |
+|---|---|
+| `{ tags: {...} }` | Put the tags in the context: `reportError(err, { "qore.area.name": v })`. Keys follow QDC-OBS-002 (`qore.<area>.<name>`) and QDC-OBS-003 (no personal data). |
+| `{ level: "warning" }` or `captureMessage` | It is not an error. Use `Sentry.logger.warn(...)`. |
+| `{ user: ... }` | Leave it out. The SDK sets the user from the session; the context carries ids only. |
+| a scope callback `(scope) => ...` | Move what the callback sets into the context object. |
+| `{ fingerprint: [...] }` | Keep that call as `Sentry.captureException` and suppress the line with a reason: `// eslint-disable-next-line qdc/use-report-error -- custom grouping for <why>`. |

package/migrations/report-error/meta.json

@@ -0,0 +1,6 @@
+{
+  "id": "report-error",
+  "rule": "use-report-error",
+  "introducedIn": "0.7.0",
+  "testOnly": true
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quatronic/sdk",
-  "version": "0.7.0-rc.6",
+  "version": "0.7.0-rc.7",
   "type": "module",
   "private": false,
   "publishConfig": {
@@ -9,6 +9,7 @@
   },
   "files": [
     "dist",
+    "migrations",
     "semgrep",
     "skills",
     "postinstall.mjs"
@@ -50,6 +51,10 @@
       "types": "./dist/node/sentry/register.d.ts",
       "import": "./dist/node/sentry/register.js"
     },
+    "./observability": {
+      "types": "./dist/observability/index.d.ts",
+      "import": "./dist/observability/index.js"
+    },
     "./next/config": {
       "types": "./dist/next/config/index.d.ts",
       "import": "./dist/next/config/index.js"
@@ -127,6 +132,8 @@
     "build": "tsup",
     "surface": "node scripts/api-surface.mjs",
     "surface:check": "node scripts/api-surface.mjs --check",
+    "migration:lint": "node scripts/migration-lint.mjs",
+    "release:manifest": "node scripts/release-manifest.mjs",
     "prepublishOnly": "pnpm build",
     "postinstall": "node postinstall.mjs",
     "test": "vitest run",
@@ -185,12 +192,13 @@
   },
   "devDependencies": {
     "@better-auth/core": "^1.6.24",
-    "@sentry/nextjs": "10.75.2",
-    "@sentry/node": "10.75.2",
     "@eslint/js": "^10.0.1",
     "@opentelemetry/sdk-trace-base": "^2.7.0",
+    "@sentry/nextjs": "10.75.2",
+    "@sentry/node": "10.75.2",
     "@testcontainers/postgresql": "^12.0.0",
     "@testing-library/react": "^16.1.0",
+    "@types/jscodeshift": "17.3.0",
     "@types/node": "^22.10.2",
     "@types/pg": "^8.11.10",
     "@types/react": "^18.3.17",
@@ -200,6 +208,7 @@
     "drizzle-kit": "^0.30.1",
     "drizzle-orm": "^0.38.2",
     "eslint": "^10.5.0",
+    "jscodeshift": "17.3.0",
     "jsdom": "^25.0.1",
     "msw": "^2.7.0",
     "next": "^15.1.0",

package/dist/chunk-MET4SIMB.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/telemetry-hooks/index.ts"],"sourcesContent":["export type LogAttrs = Record<string, unknown>\ntype Flat = Record<string, string | number | boolean>\ntype Level = \"debug\" | \"info\" | \"warn\" | \"error\"\n\nexport interface QoreLogger {\n  debug(attrs: LogAttrs, msg: string): void\n  info(attrs: LogAttrs, msg: string): void\n  warn(attrs: LogAttrs, msg: string): void\n  error(attrs: LogAttrs, msg: string): void\n}\n\nexport interface TelemetryHooks {\n  log?: Record<Level, (msg: string, attrs?: Flat) => void>\n  setUser?: (user: { id: string } | null) => void\n}\n\nconst KEY = Symbol.for(\"@quatronic/sdk.telemetry-hooks\")\ntype Holder = { [KEY]?: TelemetryHooks }\nconst holder = globalThis as Holder\n\nexport function setTelemetryHooks(hooks: TelemetryHooks): void {\n  holder[KEY] = hooks\n}\n\nexport function resetTelemetryHooks(): void {\n  delete holder[KEY]\n}\n\nexport function flattenAttrs(attrs: LogAttrs): Flat {\n  const out: Flat = {}\n  for (const [key, value] of Object.entries(attrs)) {\n    if (value === undefined || value === null) continue\n    if (value instanceof Error) {\n      out[\"error.type\"] = value.name\n      out[\"error.message\"] = value.message\n    } else if (typeof value === \"string\" || typeof value === \"number\" || typeof value === \"boolean\") {\n      out[key] = value\n    } else {\n      out[key] = JSON.stringify(value)\n    }\n  }\n  return out\n}\n\nfunction emit(level: Level, attrs: LogAttrs, msg: string): void {\n  const flat = flattenAttrs(attrs)\n  const sink = holder[KEY]?.log\n  if (sink) return sink[level](msg, flat)\n  const line = JSON.stringify({ level, msg, ...flat })\n  if (level === \"error\") console.error(line)\n  else if (level === \"warn\") console.warn(line)\n  else console.log(line)\n}\n\nconst logger: QoreLogger = {\n  debug: (a, m) => emit(\"debug\", a, m),\n  info: (a, m) => emit(\"info\", a, m),\n  warn: (a, m) => emit(\"warn\", a, m),\n  error: (a, m) => emit(\"error\", a, m),\n}\n\nexport function getLogger(): QoreLogger {\n  return logger\n}\n\nexport function setUserContext(id: string | null): void {\n  holder[KEY]?.setUser?.(id ? { id } : null)\n}\n"],"mappings":";AAgBA,IAAM,MAAM,uBAAO,IAAI,gCAAgC;AAEvD,IAAM,SAAS;AAER,SAAS,kBAAkB,OAA6B;AAC7D,SAAO,GAAG,IAAI;AAChB;AAMO,SAAS,aAAa,OAAuB;AAClD,QAAM,MAAY,CAAC;AACnB,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,GAAG;AAChD,QAAI,UAAU,UAAa,UAAU,KAAM;AAC3C,QAAI,iBAAiB,OAAO;AAC1B,UAAI,YAAY,IAAI,MAAM;AAC1B,UAAI,eAAe,IAAI,MAAM;AAAA,IAC/B,WAAW,OAAO,UAAU,YAAY,OAAO,UAAU,YAAY,OAAO,UAAU,WAAW;AAC/F,UAAI,GAAG,IAAI;AAAA,IACb,OAAO;AACL,UAAI,GAAG,IAAI,KAAK,UAAU,KAAK;AAAA,IACjC;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,KAAK,OAAc,OAAiB,KAAmB;AAC9D,QAAM,OAAO,aAAa,KAAK;AAC/B,QAAM,OAAO,OAAO,GAAG,GAAG;AAC1B,MAAI,KAAM,QAAO,KAAK,KAAK,EAAE,KAAK,IAAI;AACtC,QAAM,OAAO,KAAK,UAAU,EAAE,OAAO,KAAK,GAAG,KAAK,CAAC;AACnD,MAAI,UAAU,QAAS,SAAQ,MAAM,IAAI;AAAA,WAChC,UAAU,OAAQ,SAAQ,KAAK,IAAI;AAAA,MACvC,SAAQ,IAAI,IAAI;AACvB;AAEA,IAAM,SAAqB;AAAA,EACzB,OAAO,CAAC,GAAG,MAAM,KAAK,SAAS,GAAG,CAAC;AAAA,EACnC,MAAM,CAAC,GAAG,MAAM,KAAK,QAAQ,GAAG,CAAC;AAAA,EACjC,MAAM,CAAC,GAAG,MAAM,KAAK,QAAQ,GAAG,CAAC;AAAA,EACjC,OAAO,CAAC,GAAG,MAAM,KAAK,SAAS,GAAG,CAAC;AACrC;AAEO,SAAS,YAAwB;AACtC,SAAO;AACT;AAEO,SAAS,eAAe,IAAyB;AACtD,SAAO,GAAG,GAAG,UAAU,KAAK,EAAE,GAAG,IAAI,IAAI;AAC3C;","names":[]}

package/dist/next/auth/migrations/0001_init.sql

@@ -1,31 +0,0 @@
-CREATE SCHEMA IF NOT EXISTS auth;
-
-CREATE TABLE IF NOT EXISTS auth.sessions (
-    id                 uuid PRIMARY KEY DEFAULT gen_random_uuid(),
-    user_sub           varchar(64)  NOT NULL,
-    user_email         varchar(320),
-    organization_id    varchar(64),
-    organization_alias varchar(255),
-    access_token       text NOT NULL,
-    access_expires_at  timestamptz NOT NULL,
-    refresh_ct         bytea NOT NULL,
-    refresh_iv         bytea NOT NULL,
-    refresh_expires_at timestamptz NOT NULL,
-    created_at         timestamptz NOT NULL DEFAULT now(),
-    updated_at         timestamptz NOT NULL DEFAULT now(),
-    revoked_at         timestamptz
-);
-
-CREATE INDEX IF NOT EXISTS ix_auth_sessions_user_sub
-  ON auth.sessions(user_sub) WHERE revoked_at IS NULL;
-
-CREATE TABLE IF NOT EXISTS auth.login_state (
-    state              varchar(128) PRIMARY KEY,
-    code_verifier      varchar(255) NOT NULL,
-    redirect_path      text NOT NULL DEFAULT '/',
-    created_at         timestamptz NOT NULL DEFAULT now(),
-    expires_at         timestamptz NOT NULL
-);
-
-CREATE INDEX IF NOT EXISTS ix_auth_login_state_expires
-  ON auth.login_state(expires_at);

package/dist/next/auth/migrations/0002_id_token.sql

@@ -1 +0,0 @@
-ALTER TABLE auth.sessions ADD COLUMN IF NOT EXISTS id_token text;