@rebasepro/server-mongo 0.12.1-canary.gf5f1d39 → 0.13.0

package/dist/{websocket-CoKu1mvm.js → websocket-74DDOdK0.js}

@@ -1,14 +1,13 @@
 import { isDocumentAdmin, isSchemaAdmin } from "@rebasepro/types";
-import { extractUserFromToken, logger } from "@rebasepro/server";
+import { extractUserFromToken, logger, resolveRequireAuth } from "@rebasepro/server";
 import { WebSocketServer } from "ws";
 //#region src/websocket.ts
 function isDriverWithAuth(driver) {
 	return "withAuth" in driver && typeof driver.withAuth === "function";
 }
-var clientSessions = /* @__PURE__ */ new Map();
 var WS_RATE_LIMIT = 2e3;
 var WS_RATE_WINDOW_MS = 6e4;
-var ADMIN_ONLY_TYPES = new Set([
+var ADMIN_ONLY_TYPES = /* @__PURE__ */ new Set([
 	"EXECUTE_SQL",
 	"FETCH_DATABASES",
 	"FETCH_ROLES",
@@ -24,6 +23,7 @@ function isAdminSession(session) {
 	return session.user.roles.includes("admin");
 }
 function createMongoWebSocket(server, realtimeService, driver, authConfig, admin) {
+	const clientSessions = /* @__PURE__ */ new Map();
 	const isProduction = process.env.NODE_ENV === "production";
 	const wsDebug = (...args) => {
 		if (!isProduction) console.debug(...args);
@@ -33,7 +33,8 @@ function createMongoWebSocket(server, realtimeService, driver, authConfig, admin
 		if (err.code === "EADDRINUSE") return;
 		logger.error("❌ [WebSocket Server] Error", { error: err });
 	});
-	const requireAuth = authConfig?.requireAuth !== false && authConfig?.jwtSecret;
+	const requireAuth = resolveRequireAuth(authConfig);
+	if (requireAuth && !authConfig?.jwtSecret) logger.warn("🔐 [WebSocket Server] Authentication is required but no jwtSecret is configured — no client can complete AUTH, so every realtime message will be refused.");
 	wss.on("connection", (ws) => {
 		const clientId = `client_${Date.now()}_${Math.random().toString(36).substring(2, 9)}`;
 		wsDebug(`WebSocket client connected: ${clientId}`);
@@ -278,4 +279,4 @@ function createMongoWebSocket(server, realtimeService, driver, authConfig, admin
 //#endregion
 export { createMongoWebSocket };
 
-//# sourceMappingURL=websocket-CoKu1mvm.js.map
+//# sourceMappingURL=websocket-74DDOdK0.js.map

package/dist/websocket-74DDOdK0.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"websocket-74DDOdK0.js","names":[],"sources":["../src/websocket.ts"],"sourcesContent":["import { RealtimeProvider, DataDriver, FetchCollectionProps, FetchOneProps, SaveProps, DeleteProps, TableMetadata, DatabaseAdmin, isSchemaAdmin, isDocumentAdmin, User } from \"@rebasepro/types\";\nimport { WebSocketServer, WebSocket } from \"ws\";\nimport { Server } from \"http\";\nimport { inspect } from \"util\";\nimport type { AccessTokenPayload } from \"@rebasepro/server\";\nimport { extractUserFromToken, resolveRequireAuth } from \"@rebasepro/server\";\nimport type { RebaseAuthConfig } from \"@rebasepro/server\";\nimport { MongoRealtimeService } from \"./services/MongoRealtimeService\";\nimport { MongoDriver } from \"./services/MongoDriver\";\nimport { logger } from \"@rebasepro/server\";\n\ninterface DriverWithAuth extends DataDriver {\n    withAuth(user: Record<string, unknown>): Promise<DataDriver>;\n}\n\nfunction isDriverWithAuth(driver: DataDriver): driver is DriverWithAuth {\n    return \"withAuth\" in driver && typeof (driver as Record<string, unknown>).withAuth === \"function\";\n}\n\ninterface ClientSession {\n    ws: WebSocket;\n    user?: AccessTokenPayload;\n    authenticated: boolean;\n    messageCount: number;\n    messageWindowStart: number;\n}\n\nconst WS_RATE_LIMIT = 2000;\nconst WS_RATE_WINDOW_MS = 60_000;\n\nconst ADMIN_ONLY_TYPES = new Set([\n    \"EXECUTE_SQL\",\n    \"FETCH_DATABASES\",\n    \"FETCH_ROLES\",\n    \"FETCH_UNMAPPED_TABLES\",\n    \"FETCH_TABLE_METADATA\",\n    \"FETCH_CURRENT_DATABASE\",\n    \"CREATE_BRANCH\",\n    \"DELETE_BRANCH\",\n    \"LIST_BRANCHES\"\n]);\n\nfunction isAdminSession(session: ClientSession | undefined): boolean {\n    if (!session?.user?.roles) return false;\n    return session.user.roles.includes(\"admin\");\n}\n\nexport function createMongoWebSocket(\n    server: Server,\n    realtimeService: MongoRealtimeService,\n    driver: MongoDriver,\n    authConfig?: RebaseAuthConfig,\n    admin?: DatabaseAdmin\n) {\n    // Scoped to this factory invocation rather than the module, so sessions do\n    // not leak across hot reloads or a second server on the same process — the\n    // Postgres socket keeps it here for the same reason.\n    const clientSessions = new Map<string, ClientSession>();\n\n    const isProduction = process.env.NODE_ENV === \"production\";\n    const wsDebug = (...args: unknown[]) => { if (!isProduction) console.debug(...args); };\n    const wss = new WebSocketServer({ server });\n\n    wss.on(\"error\", (err: NodeJS.ErrnoException) => {\n        if (err.code === \"EADDRINUSE\") return;\n        logger.error(\"❌ [WebSocket Server] Error\", { error: err });\n    });\n\n    // The same predicate the HTTP data routes use, from the same function. See\n    // `resolveRequireAuth` for what this socket's local copy got wrong — most\n    // importantly that a `false` here does not skip a check, it marks every\n    // session `authenticated` at connect time.\n    const requireAuth = resolveRequireAuth(authConfig);\n\n    if (requireAuth && !authConfig?.jwtSecret) {\n        logger.warn(\n            \"🔐 [WebSocket Server] Authentication is required but no jwtSecret is configured — \" +\n            \"no client can complete AUTH, so every realtime message will be refused.\"\n        );\n    }\n\n    wss.on(\"connection\", (ws) => {\n        const clientId = `client_${Date.now()}_${Math.random().toString(36).substring(2, 9)}`;\n        wsDebug(`WebSocket client connected: ${clientId}`);\n\n        clientSessions.set(clientId, { ws,\nauthenticated: !requireAuth,\nmessageCount: 0,\nmessageWindowStart: Date.now() });\n        realtimeService.addClient(clientId, ws);\n\n        ws.on(\"close\", () => {\n            wsDebug(`WebSocket client disconnected: ${clientId}`);\n            clientSessions.delete(clientId);\n        });\n\n        ws.on(\"message\", async (message) => {\n            let requestId: string | undefined;\n            try {\n                const { type, payload, requestId: reqId } = JSON.parse(message.toString());\n                requestId = reqId;\n\n                wsDebug(`[WS] ${clientId} → ${type}`, requestId ? `(${requestId})` : \"\");\n\n                const sendError = (errType: \"ERROR\" | \"AUTH_ERROR\", code: string, msg: string) => {\n                    ws.send(JSON.stringify({ type: errType,\nrequestId,\npayload: { error: { message: msg,\ncode } } }));\n                };\n\n                if (type === \"AUTHENTICATE\") {\n                    const { token } = payload || {};\n                    if (!token) {\n                        sendError(\"AUTH_ERROR\", \"INVALID_INPUT\", \"Token is required\");\n                        return;\n                    }\n\n                    const user = extractUserFromToken(token);\n                    if (user) {\n                        const session = clientSessions.get(clientId);\n                        if (session) {\n                            session.user = user;\n                            session.authenticated = true;\n                        }\n                        ws.send(JSON.stringify({ type: \"AUTH_SUCCESS\",\nrequestId,\npayload: { uid: user.uid,\nroles: user.roles } }));\n                    } else {\n                        sendError(\"AUTH_ERROR\", \"INVALID_TOKEN\", \"Invalid or expired token\");\n                    }\n                    return;\n                }\n\n                if (requireAuth) {\n                    const session = clientSessions.get(clientId);\n                    if (!session?.authenticated) {\n                        sendError(\"ERROR\", \"UNAUTHORIZED\", \"Authentication required\");\n                        return;\n                    }\n                }\n\n                {\n                    const session = clientSessions.get(clientId);\n                    if (session) {\n                        const now = Date.now();\n                        if (now - session.messageWindowStart > WS_RATE_WINDOW_MS) {\n                            session.messageCount = 0;\n                            session.messageWindowStart = now;\n                        }\n                        session.messageCount++;\n                        if (session.messageCount > WS_RATE_LIMIT) {\n                            sendError(\"ERROR\", \"RATE_LIMITED\", \"Too many requests. Please slow down.\");\n                            return;\n                        }\n                    }\n                }\n\n                if (ADMIN_ONLY_TYPES.has(type)) {\n                    const session = clientSessions.get(clientId);\n                    if (!isAdminSession(session)) {\n                        sendError(\"ERROR\", \"FORBIDDEN\", \"Admin access required for this operation\");\n                        return;\n                    }\n                }\n\n                const getScopedDelegate = async (): Promise<DataDriver> => {\n                    const session = clientSessions.get(clientId);\n                    if (session?.user && isDriverWithAuth(driver)) {\n                        try {\n                            const userForAuth: User = {\n                                uid: session.user.uid,\n                                email: session.user.email ?? \"\",\n                                displayName: session.user.displayName ?? \"\",\n                                photoURL: session.user.photoURL ?? \"\",\n                                providerId: \"jwt\",\n                                isAnonymous: false,\n                                roles: session.user.roles ?? []\n                            };\n                            return await driver.withAuth(userForAuth);\n                        } catch (e) {\n                            logger.error(\"Failed to create authenticated delegate for WS request\", { error: e });\n                            return driver;\n                        }\n                    }\n                    return driver;\n                };\n\n                switch (type) {\n                    case \"FETCH_COLLECTION\": {\n                        const request: FetchCollectionProps = payload;\n                        const delegate = await getScopedDelegate();\n                        const rows = await delegate.fetchCollection(request);\n                        ws.send(JSON.stringify({ type: \"FETCH_COLLECTION_SUCCESS\",\npayload: { rows },\nrequestId }));\n                        break;\n                    }\n                    case \"FETCH_ONE\": {\n                        const request: FetchOneProps = payload;\n                        const delegate = await getScopedDelegate();\n                        const row = await delegate.fetchOne(request);\n                        ws.send(JSON.stringify({ type: \"FETCH_ONE_SUCCESS\",\npayload: { row },\nrequestId }));\n                        break;\n                    }\n                    case \"SAVE\": {\n                        const request: SaveProps = payload;\n                        const delegate = await getScopedDelegate();\n                        const row = await delegate.save(request);\n                        ws.send(JSON.stringify({ type: \"SAVE_SUCCESS\",\npayload: { row },\nrequestId }));\n                        break;\n                    }\n                    case \"DELETE\": {\n                        const request: DeleteProps = payload;\n                        const delegate = await getScopedDelegate();\n                        await delegate.delete(request);\n                        ws.send(JSON.stringify({ type: \"DELETE_SUCCESS\",\npayload: { success: true },\nrequestId }));\n                        break;\n                    }\n                    case \"CHECK_UNIQUE_FIELD\": {\n                        const { path, name, value, id, collection } = payload;\n                        const delegate = await getScopedDelegate();\n                        const isUnique = await delegate.checkUniqueField(path, name, value, id, collection);\n                        ws.send(JSON.stringify({ type: \"CHECK_UNIQUE_FIELD_SUCCESS\",\npayload: { isUnique },\nrequestId }));\n                        break;\n                    }\n                    case \"COUNT\": {\n                        const request: FetchCollectionProps = payload;\n                        const delegate = await getScopedDelegate();\n                        const count = await delegate.count!(request);\n                        ws.send(JSON.stringify({ type: \"COUNT_SUCCESS\",\npayload: { count },\nrequestId }));\n                        break;\n                    }\n                    case \"EXECUTE_SQL\": {\n                        const { sql, options } = payload;\n                        if (admin && isDocumentAdmin(admin) && admin.executeAggregate) {\n                            const result = await admin.executeAggregate(sql as Record<string, unknown>[]);\n                            ws.send(JSON.stringify({ type: \"EXECUTE_SQL_SUCCESS\",\npayload: { result },\nrequestId }));\n                        } else {\n                            ws.send(JSON.stringify({ type: \"ERROR\",\nrequestId,\npayload: { error: { message: \"SQL execution not supported for this driver\",\ncode: \"NOT_SUPPORTED\" } } }));\n                        }\n                        break;\n                    }\n                    case \"FETCH_UNMAPPED_TABLES\": {\n                        if (admin && isSchemaAdmin(admin)) {\n                            const tables = await admin.fetchUnmappedTables?.(payload?.mappedPaths) || [];\n                            ws.send(JSON.stringify({ type: \"FETCH_UNMAPPED_TABLES_SUCCESS\",\npayload: { tables },\nrequestId }));\n                        } else {\n                            ws.send(JSON.stringify({ type: \"FETCH_UNMAPPED_TABLES_SUCCESS\",\npayload: { tables: [] },\nrequestId }));\n                        }\n                        break;\n                    }\n                    case \"FETCH_TABLE_METADATA\": {\n                        const { tableName } = payload;\n                        if (admin && isSchemaAdmin(admin)) {\n                            const metadata = await admin.fetchTableMetadata?.(tableName);\n                            ws.send(JSON.stringify({ type: \"FETCH_TABLE_METADATA_SUCCESS\",\npayload: { metadata },\nrequestId }));\n                        } else {\n                            ws.send(JSON.stringify({ type: \"FETCH_TABLE_METADATA_SUCCESS\",\npayload: { metadata: null },\nrequestId }));\n                        }\n                        break;\n                    }\n                    case \"subscribe_collection\":\n                    case \"subscribe_one\":\n                    case \"unsubscribe\": {\n                        const session = clientSessions.get(clientId);\n                        const authContext = session?.user ? { uid: session.user.uid,\nroles: session.user.roles ?? [] } : undefined;\n                        await realtimeService.handleClientMessage(clientId, {\n                            type,\n                            payload,\n                            subscriptionId: payload?.subscriptionId\n                        }, authContext);\n                        break;\n                    }\n                    default:\n                        logger.error(\"❌ [WebSocket Server] Unknown message type\", { detail: type });\n                }\n            } catch (error: unknown) {\n                const errorMessage = process.env.NODE_ENV === \"production\" ? \"An unexpected error occurred\" : (error instanceof Error ? error.message : \"An unexpected error occurred\");\n                ws.send(JSON.stringify({ type: \"ERROR\",\nrequestId,\npayload: { error: { message: errorMessage,\ncode: \"INTERNAL_ERROR\" } } }));\n            }\n        });\n    });\n}\n"],"mappings":";;;;AAeA,SAAS,iBAAiB,QAA8C;CACpE,OAAO,cAAc,UAAU,OAAQ,OAAmC,aAAa;AAC3F;AAUA,IAAM,gBAAgB;AACtB,IAAM,oBAAoB;AAE1B,IAAM,mCAAmB,IAAI,IAAI;CAC7B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACJ,CAAC;AAED,SAAS,eAAe,SAA6C;CACjE,IAAI,CAAC,SAAS,MAAM,OAAO,OAAO;CAClC,OAAO,QAAQ,KAAK,MAAM,SAAS,OAAO;AAC9C;AAEA,SAAgB,qBACZ,QACA,iBACA,QACA,YACA,OACF;CAIE,MAAM,iCAAiB,IAAI,IAA2B;CAEtD,MAAM,eAAA,QAAA,IAAA,aAAwC;CAC9C,MAAM,WAAW,GAAG,SAAoB;EAAE,IAAI,CAAC,cAAc,QAAQ,MAAM,GAAG,IAAI;CAAG;CACrF,MAAM,MAAM,IAAI,gBAAgB,EAAE,OAAO,CAAC;CAE1C,IAAI,GAAG,UAAU,QAA+B;EAC5C,IAAI,IAAI,SAAS,cAAc;EAC/B,OAAO,MAAM,8BAA8B,EAAE,OAAO,IAAI,CAAC;CAC7D,CAAC;CAMD,MAAM,cAAc,mBAAmB,UAAU;CAEjD,IAAI,eAAe,CAAC,YAAY,WAC5B,OAAO,KACH,2JAEJ;CAGJ,IAAI,GAAG,eAAe,OAAO;EACzB,MAAM,WAAW,UAAU,KAAK,IAAI,EAAE,GAAG,KAAK,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,UAAU,GAAG,CAAC;EAClF,QAAQ,+BAA+B,UAAU;EAEjD,eAAe,IAAI,UAAU;GAAE;GACvC,eAAe,CAAC;GAChB,cAAc;GACd,oBAAoB,KAAK,IAAI;EAAE,CAAC;EACxB,gBAAgB,UAAU,UAAU,EAAE;EAEtC,GAAG,GAAG,eAAe;GACjB,QAAQ,kCAAkC,UAAU;GACpD,eAAe,OAAO,QAAQ;EAClC,CAAC;EAED,GAAG,GAAG,WAAW,OAAO,YAAY;GAChC,IAAI;GACJ,IAAI;IACA,MAAM,EAAE,MAAM,SAAS,WAAW,UAAU,KAAK,MAAM,QAAQ,SAAS,CAAC;IACzE,YAAY;IAEZ,QAAQ,QAAQ,SAAS,KAAK,QAAQ,YAAY,IAAI,UAAU,KAAK,EAAE;IAEvE,MAAM,aAAa,SAAiC,MAAc,QAAgB;KAC9E,GAAG,KAAK,KAAK,UAAU;MAAE,MAAM;MACnD;MACA,SAAS,EAAE,OAAO;OAAE,SAAS;OAC7B;MAAK,EAAE;KAAE,CAAC,CAAC;IACK;IAEA,IAAI,SAAS,gBAAgB;KACzB,MAAM,EAAE,UAAU,WAAW,CAAC;KAC9B,IAAI,CAAC,OAAO;MACR,UAAU,cAAc,iBAAiB,mBAAmB;MAC5D;KACJ;KAEA,MAAM,OAAO,qBAAqB,KAAK;KACvC,IAAI,MAAM;MACN,MAAM,UAAU,eAAe,IAAI,QAAQ;MAC3C,IAAI,SAAS;OACT,QAAQ,OAAO;OACf,QAAQ,gBAAgB;MAC5B;MACA,GAAG,KAAK,KAAK,UAAU;OAAE,MAAM;OACvD;OACA,SAAS;QAAE,KAAK,KAAK;QACrB,OAAO,KAAK;OAAM;MAAE,CAAC,CAAC;KACF,OACI,UAAU,cAAc,iBAAiB,0BAA0B;KAEvE;IACJ;IAEA,IAAI;SAEI,CADY,eAAe,IAAI,QAC9B,CAAA,EAAS,eAAe;MACzB,UAAU,SAAS,gBAAgB,yBAAyB;MAC5D;KACJ;;IAGJ;KACI,MAAM,UAAU,eAAe,IAAI,QAAQ;KAC3C,IAAI,SAAS;MACT,MAAM,MAAM,KAAK,IAAI;MACrB,IAAI,MAAM,QAAQ,qBAAqB,mBAAmB;OACtD,QAAQ,eAAe;OACvB,QAAQ,qBAAqB;MACjC;MACA,QAAQ;MACR,IAAI,QAAQ,eAAe,eAAe;OACtC,UAAU,SAAS,gBAAgB,sCAAsC;OACzE;MACJ;KACJ;IACJ;IAEA,IAAI,iBAAiB,IAAI,IAAI;SAErB,CAAC,eADW,eAAe,IAAI,QACf,CAAO,GAAG;MAC1B,UAAU,SAAS,aAAa,0CAA0C;MAC1E;KACJ;;IAGJ,MAAM,oBAAoB,YAAiC;KACvD,MAAM,UAAU,eAAe,IAAI,QAAQ;KAC3C,IAAI,SAAS,QAAQ,iBAAiB,MAAM,GACxC,IAAI;MACA,MAAM,cAAoB;OACtB,KAAK,QAAQ,KAAK;OAClB,OAAO,QAAQ,KAAK,SAAS;OAC7B,aAAa,QAAQ,KAAK,eAAe;OACzC,UAAU,QAAQ,KAAK,YAAY;OACnC,YAAY;OACZ,aAAa;OACb,OAAO,QAAQ,KAAK,SAAS,CAAC;MAClC;MACA,OAAO,MAAM,OAAO,SAAS,WAAW;KAC5C,SAAS,GAAG;MACR,OAAO,MAAM,0DAA0D,EAAE,OAAO,EAAE,CAAC;MACnF,OAAO;KACX;KAEJ,OAAO;IACX;IAEA,QAAQ,MAAR;KACI,KAAK,oBAAoB;MACrB,MAAM,UAAgC;MAEtC,MAAM,OAAO,OAAM,MADI,kBAAkB,EAAA,CACb,gBAAgB,OAAO;MACnD,GAAG,KAAK,KAAK,UAAU;OAAE,MAAM;OACvD,SAAS,EAAE,KAAK;OAChB;MAAU,CAAC,CAAC;MACY;KACJ;KACA,KAAK,aAAa;MACd,MAAM,UAAyB;MAE/B,MAAM,MAAM,OAAM,MADK,kBAAkB,EAAA,CACd,SAAS,OAAO;MAC3C,GAAG,KAAK,KAAK,UAAU;OAAE,MAAM;OACvD,SAAS,EAAE,IAAI;OACf;MAAU,CAAC,CAAC;MACY;KACJ;KACA,KAAK,QAAQ;MACT,MAAM,UAAqB;MAE3B,MAAM,MAAM,OAAM,MADK,kBAAkB,EAAA,CACd,KAAK,OAAO;MACvC,GAAG,KAAK,KAAK,UAAU;OAAE,MAAM;OACvD,SAAS,EAAE,IAAI;OACf;MAAU,CAAC,CAAC;MACY;KACJ;KACA,KAAK,UAAU;MACX,MAAM,UAAuB;MAE7B,OAAM,MADiB,kBAAkB,EAAA,CAC1B,OAAO,OAAO;MAC7B,GAAG,KAAK,KAAK,UAAU;OAAE,MAAM;OACvD,SAAS,EAAE,SAAS,KAAK;OACzB;MAAU,CAAC,CAAC;MACY;KACJ;KACA,KAAK,sBAAsB;MACvB,MAAM,EAAE,MAAM,MAAM,OAAO,IAAI,eAAe;MAE9C,MAAM,WAAW,OAAM,MADA,kBAAkB,EAAA,CACT,iBAAiB,MAAM,MAAM,OAAO,IAAI,UAAU;MAClF,GAAG,KAAK,KAAK,UAAU;OAAE,MAAM;OACvD,SAAS,EAAE,SAAS;OACpB;MAAU,CAAC,CAAC;MACY;KACJ;KACA,KAAK,SAAS;MACV,MAAM,UAAgC;MAEtC,MAAM,QAAQ,OAAM,MADG,kBAAkB,EAAA,CACZ,MAAO,OAAO;MAC3C,GAAG,KAAK,KAAK,UAAU;OAAE,MAAM;OACvD,SAAS,EAAE,MAAM;OACjB;MAAU,CAAC,CAAC;MACY;KACJ;KACA,KAAK,eAAe;MAChB,MAAM,EAAE,KAAK,YAAY;MACzB,IAAI,SAAS,gBAAgB,KAAK,KAAK,MAAM,kBAAkB;OAC3D,MAAM,SAAS,MAAM,MAAM,iBAAiB,GAAgC;OAC5E,GAAG,KAAK,KAAK,UAAU;QAAE,MAAM;QAC3D,SAAS,EAAE,OAAO;QAClB;OAAU,CAAC,CAAC;MACY,OACI,GAAG,KAAK,KAAK,UAAU;OAAE,MAAM;OAC3D;OACA,SAAS,EAAE,OAAO;QAAE,SAAS;QAC7B,MAAM;OAAgB,EAAE;MAAE,CAAC,CAAC;MAEJ;KACJ;KACA,KAAK;MACD,IAAI,SAAS,cAAc,KAAK,GAAG;OAC/B,MAAM,SAAS,MAAM,MAAM,sBAAsB,SAAS,WAAW,KAAK,CAAC;OAC3E,GAAG,KAAK,KAAK,UAAU;QAAE,MAAM;QAC3D,SAAS,EAAE,OAAO;QAClB;OAAU,CAAC,CAAC;MACY,OACI,GAAG,KAAK,KAAK,UAAU;OAAE,MAAM;OAC3D,SAAS,EAAE,QAAQ,CAAC,EAAE;OACtB;MAAU,CAAC,CAAC;MAEY;KAEJ,KAAK,wBAAwB;MACzB,MAAM,EAAE,cAAc;MACtB,IAAI,SAAS,cAAc,KAAK,GAAG;OAC/B,MAAM,WAAW,MAAM,MAAM,qBAAqB,SAAS;OAC3D,GAAG,KAAK,KAAK,UAAU;QAAE,MAAM;QAC3D,SAAS,EAAE,SAAS;QACpB;OAAU,CAAC,CAAC;MACY,OACI,GAAG,KAAK,KAAK,UAAU;OAAE,MAAM;OAC3D,SAAS,EAAE,UAAU,KAAK;OAC1B;MAAU,CAAC,CAAC;MAEY;KACJ;KACA,KAAK;KACL,KAAK;KACL,KAAK,eAAe;MAChB,MAAM,UAAU,eAAe,IAAI,QAAQ;MAC3C,MAAM,cAAc,SAAS,OAAO;OAAE,KAAK,QAAQ,KAAK;OAChF,OAAO,QAAQ,KAAK,SAAS,CAAC;MAAE,IAAI,KAAA;MACZ,MAAM,gBAAgB,oBAAoB,UAAU;OAChD;OACA;OACA,gBAAgB,SAAS;MAC7B,GAAG,WAAW;MACd;KACJ;KACA,SACI,OAAO,MAAM,6CAA6C,EAAE,QAAQ,KAAK,CAAC;IAClF;GACJ,SAAS,OAAgB;IACrB,MAAM,eAAA,QAAA,IAAA,aAAwC,eAAe,iCAAkC,iBAAiB,QAAQ,MAAM,UAAU;IACxI,GAAG,KAAK,KAAK,UAAU;KAAE,MAAM;KAC/C;KACA,SAAS,EAAE,OAAO;MAAE,SAAS;MAC7B,MAAM;KAAiB,EAAE;IAAE,CAAC,CAAC;GACjB;EACJ,CAAC;CACL,CAAC;AACL"}

package/dist/websocket.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"websocket.d.ts","sourceRoot":"","sources":["../src/websocket.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4G,aAAa,EAAwC,MAAM,kBAAkB,CAAC;AAEjM,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAI9B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAwCrD,wBAAgB,oBAAoB,CAChC,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,oBAAoB,EACrC,MAAM,EAAE,WAAW,EACnB,UAAU,CAAC,EAAE,gBAAgB,EAC7B,KAAK,CAAC,EAAE,aAAa,QAmPxB"}
+{"version":3,"file":"websocket.d.ts","sourceRoot":"","sources":["../src/websocket.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4G,aAAa,EAAwC,MAAM,kBAAkB,CAAC;AAEjM,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAI9B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAuCrD,wBAAgB,oBAAoB,CAChC,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,oBAAoB,EACrC,MAAM,EAAE,WAAW,EACnB,UAAU,CAAC,EAAE,gBAAgB,EAC7B,KAAK,CAAC,EAAE,aAAa,QAmQxB"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@rebasepro/server-mongo",
   "type": "module",
-  "version": "0.12.1-canary.gf5f1d39",
+  "version": "0.13.0",
   "description": "MongoDB backend for Rebase",
   "funding": {
     "url": "https://github.com/sponsors/rebaseco"
@@ -38,24 +38,24 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "mongodb": "^7.3.0",
-    "ws": "^8.21.0",
-    "@rebasepro/common": "0.12.1-canary.gf5f1d39",
-    "@rebasepro/utils": "0.12.1-canary.gf5f1d39",
-    "@rebasepro/types": "0.12.1-canary.gf5f1d39"
+    "mongodb": "^7.5.0",
+    "ws": "^8.21.1",
+    "@rebasepro/common": "0.13.0",
+    "@rebasepro/types": "0.13.0",
+    "@rebasepro/utils": "0.13.0"
   },
   "devDependencies": {
     "@types/jest": "^30.0.0",
-    "@types/node": "^25.9.3",
+    "@types/node": "^26.1.2",
     "@types/ws": "^8.18.1",
     "jest": "^30.4.2",
     "mongodb-memory-server": "^11.2.0",
-    "ts-jest": "29.4.11",
+    "ts-jest": "29.4.12",
     "typescript": "^6.0.3",
-    "vite": "^8.0.16"
+    "vite": "^8.1.5"
   },
   "peerDependencies": {
-    "@rebasepro/server": "0.12.1-canary.gf5f1d39"
+    "@rebasepro/server": "0.13.0"
   },
   "peerDependenciesMeta": {
     "@rebasepro/server": {

package/src/auth/services.ts

@@ -1,4 +1,5 @@
 import { Db, ObjectId } from "mongodb";
+import { normalizeEmail } from "@rebasepro/common";
 
 /** Loose document type that allows string _id values (Rebase convention). */
 export interface MongoDoc { _id?: string; [key: string]: any; }
@@ -68,7 +69,7 @@ export class MongoUserService implements UserRepository {
         const doc = {
             _id: id,
             id,
-            email: data.email.toLowerCase(),
+            email: normalizeEmail(data.email),
             passwordHash: data.passwordHash ?? null,
             displayName: data.displayName ?? null,
             photoUrl: data.photoUrl ?? null,
@@ -86,7 +87,7 @@ export class MongoUserService implements UserRepository {
     }
 
     async getUserByEmail(email: string): Promise<UserData | null> {
-        const doc = await this.collection.findOne({ email: email.toLowerCase() });
+        const doc = await this.collection.findOne({ email: normalizeEmail(email) });
         return doc ? toUser(doc) : null;
     }
 
@@ -136,7 +137,7 @@ providerId },
     async updateUser(id: string, data: Partial<Omit<CreateUserData, "id">>): Promise<UserData | null> {
         const updateData: Record<string, unknown> = { ...data,
 updatedAt: new Date() };
-        if (typeof updateData.email === "string") updateData.email = updateData.email.toLowerCase();
+        if (typeof updateData.email === "string") updateData.email = normalizeEmail(updateData.email);
 
         await this.collection.updateOne({ id }, { $set: updateData });
         return this.getUserById(id);

package/src/db/MongoConditionBuilder.ts

@@ -4,7 +4,7 @@
  * Translates Rebase filter conditions to MongoDB query operators.
  */
 
-import { FilterValues, WhereFilterOp } from "@rebasepro/types";
+import { CollectionConfig, FilterValues, WhereFilterOp } from "@rebasepro/types";
 import { Filter, Document } from "mongodb";
 import { logger } from "@rebasepro/server";
 
@@ -115,12 +115,16 @@ export class MongoConditionBuilder {
      * Build search conditions for text search
      *
      * @param searchString - Text to search for
-     * @param properties - Properties to search in
+     * @param properties - The collection's properties, searched for string fields
      * @returns Array of MongoDB filter objects for text search
      */
     static buildSearchConditions(
         searchString: string,
-        properties: Record<string, any>
+        // Typed as the real property map, not `Record<string, any>`. The loose
+        // type is what let the `dataType` bug below survive: a caller — and,
+        // more to the point, a test fixture — could invent any key it liked and
+        // nothing checked it against a property a user can actually declare.
+        properties: CollectionConfig["properties"]
     ): Filter<Document>[] {
         if (!searchString) return [];
 
@@ -130,8 +134,17 @@ export class MongoConditionBuilder {
         const searchRegex = new RegExp(escapedSearch, "i");
 
         for (const [key, prop] of Object.entries(properties)) {
-            // Only search in string-type properties
-            if (prop?.dataType === "string" || typeof prop === "string") {
+            // `type`, not `dataType`. No property in `@rebasepro/types` has ever
+            // had a `dataType` field — a real collection carries `type:
+            // "string"` — so this matched nothing for every collection a user
+            // could actually declare. With no field matching, the fallback
+            // below took over and every search became a `$text` query, which
+            // needs a text index and throws `IndexNotFound` without one.
+            //
+            // The suite passed because its fixtures were written with the same
+            // wrong key, so the test data agreed with the bug and the two
+            // never met a real collection between them.
+            if (prop?.type === "string" || typeof prop === "string") {
                 orConditions.push({
                     [key]: { $regex: searchRegex }
                 });
@@ -179,7 +192,7 @@ export class MongoConditionBuilder {
     static buildQuery<M extends Record<string, any>>(options: {
         filter?: FilterValues<Extract<keyof M, string>>;
         searchString?: string;
-        properties?: Record<string, any>;
+        properties?: CollectionConfig["properties"];
     }): Filter<Document> {
         const conditions: Filter<Document>[] = [];
 

package/src/websocket.ts

@@ -3,7 +3,7 @@ import { WebSocketServer, WebSocket } from "ws";
 import { Server } from "http";
 import { inspect } from "util";
 import type { AccessTokenPayload } from "@rebasepro/server";
-import { extractUserFromToken } from "@rebasepro/server";
+import { extractUserFromToken, resolveRequireAuth } from "@rebasepro/server";
 import type { RebaseAuthConfig } from "@rebasepro/server";
 import { MongoRealtimeService } from "./services/MongoRealtimeService";
 import { MongoDriver } from "./services/MongoDriver";
@@ -25,7 +25,6 @@ interface ClientSession {
     messageWindowStart: number;
 }
 
-const clientSessions = new Map<string, ClientSession>();
 const WS_RATE_LIMIT = 2000;
 const WS_RATE_WINDOW_MS = 60_000;
 
@@ -53,6 +52,11 @@ export function createMongoWebSocket(
     authConfig?: RebaseAuthConfig,
     admin?: DatabaseAdmin
 ) {
+    // Scoped to this factory invocation rather than the module, so sessions do
+    // not leak across hot reloads or a second server on the same process — the
+    // Postgres socket keeps it here for the same reason.
+    const clientSessions = new Map<string, ClientSession>();
+
     const isProduction = process.env.NODE_ENV === "production";
     const wsDebug = (...args: unknown[]) => { if (!isProduction) console.debug(...args); };
     const wss = new WebSocketServer({ server });
@@ -62,7 +66,18 @@ export function createMongoWebSocket(
         logger.error("❌ [WebSocket Server] Error", { error: err });
     });
 
-    const requireAuth = authConfig?.requireAuth !== false && authConfig?.jwtSecret;
+    // The same predicate the HTTP data routes use, from the same function. See
+    // `resolveRequireAuth` for what this socket's local copy got wrong — most
+    // importantly that a `false` here does not skip a check, it marks every
+    // session `authenticated` at connect time.
+    const requireAuth = resolveRequireAuth(authConfig);
+
+    if (requireAuth && !authConfig?.jwtSecret) {
+        logger.warn(
+            "🔐 [WebSocket Server] Authentication is required but no jwtSecret is configured — " +
+            "no client can complete AUTH, so every realtime message will be refused."
+        );
+    }
 
     wss.on("connection", (ws) => {
         const clientId = `client_${Date.now()}_${Math.random().toString(36).substring(2, 9)}`;

package/dist/websocket-CoKu1mvm.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"websocket-CoKu1mvm.js","names":[],"sources":["../src/websocket.ts"],"sourcesContent":["import { RealtimeProvider, DataDriver, FetchCollectionProps, FetchOneProps, SaveProps, DeleteProps, TableMetadata, DatabaseAdmin, isSchemaAdmin, isDocumentAdmin, User } from \"@rebasepro/types\";\nimport { WebSocketServer, WebSocket } from \"ws\";\nimport { Server } from \"http\";\nimport { inspect } from \"util\";\nimport type { AccessTokenPayload } from \"@rebasepro/server\";\nimport { extractUserFromToken } from \"@rebasepro/server\";\nimport type { RebaseAuthConfig } from \"@rebasepro/server\";\nimport { MongoRealtimeService } from \"./services/MongoRealtimeService\";\nimport { MongoDriver } from \"./services/MongoDriver\";\nimport { logger } from \"@rebasepro/server\";\n\ninterface DriverWithAuth extends DataDriver {\n    withAuth(user: Record<string, unknown>): Promise<DataDriver>;\n}\n\nfunction isDriverWithAuth(driver: DataDriver): driver is DriverWithAuth {\n    return \"withAuth\" in driver && typeof (driver as Record<string, unknown>).withAuth === \"function\";\n}\n\ninterface ClientSession {\n    ws: WebSocket;\n    user?: AccessTokenPayload;\n    authenticated: boolean;\n    messageCount: number;\n    messageWindowStart: number;\n}\n\nconst clientSessions = new Map<string, ClientSession>();\nconst WS_RATE_LIMIT = 2000;\nconst WS_RATE_WINDOW_MS = 60_000;\n\nconst ADMIN_ONLY_TYPES = new Set([\n    \"EXECUTE_SQL\",\n    \"FETCH_DATABASES\",\n    \"FETCH_ROLES\",\n    \"FETCH_UNMAPPED_TABLES\",\n    \"FETCH_TABLE_METADATA\",\n    \"FETCH_CURRENT_DATABASE\",\n    \"CREATE_BRANCH\",\n    \"DELETE_BRANCH\",\n    \"LIST_BRANCHES\"\n]);\n\nfunction isAdminSession(session: ClientSession | undefined): boolean {\n    if (!session?.user?.roles) return false;\n    return session.user.roles.includes(\"admin\");\n}\n\nexport function createMongoWebSocket(\n    server: Server,\n    realtimeService: MongoRealtimeService,\n    driver: MongoDriver,\n    authConfig?: RebaseAuthConfig,\n    admin?: DatabaseAdmin\n) {\n    const isProduction = process.env.NODE_ENV === \"production\";\n    const wsDebug = (...args: unknown[]) => { if (!isProduction) console.debug(...args); };\n    const wss = new WebSocketServer({ server });\n\n    wss.on(\"error\", (err: NodeJS.ErrnoException) => {\n        if (err.code === \"EADDRINUSE\") return;\n        logger.error(\"❌ [WebSocket Server] Error\", { error: err });\n    });\n\n    const requireAuth = authConfig?.requireAuth !== false && authConfig?.jwtSecret;\n\n    wss.on(\"connection\", (ws) => {\n        const clientId = `client_${Date.now()}_${Math.random().toString(36).substring(2, 9)}`;\n        wsDebug(`WebSocket client connected: ${clientId}`);\n\n        clientSessions.set(clientId, { ws,\nauthenticated: !requireAuth,\nmessageCount: 0,\nmessageWindowStart: Date.now() });\n        realtimeService.addClient(clientId, ws);\n\n        ws.on(\"close\", () => {\n            wsDebug(`WebSocket client disconnected: ${clientId}`);\n            clientSessions.delete(clientId);\n        });\n\n        ws.on(\"message\", async (message) => {\n            let requestId: string | undefined;\n            try {\n                const { type, payload, requestId: reqId } = JSON.parse(message.toString());\n                requestId = reqId;\n\n                wsDebug(`[WS] ${clientId} → ${type}`, requestId ? `(${requestId})` : \"\");\n\n                const sendError = (errType: \"ERROR\" | \"AUTH_ERROR\", code: string, msg: string) => {\n                    ws.send(JSON.stringify({ type: errType,\nrequestId,\npayload: { error: { message: msg,\ncode } } }));\n                };\n\n                if (type === \"AUTHENTICATE\") {\n                    const { token } = payload || {};\n                    if (!token) {\n                        sendError(\"AUTH_ERROR\", \"INVALID_INPUT\", \"Token is required\");\n                        return;\n                    }\n\n                    const user = extractUserFromToken(token);\n                    if (user) {\n                        const session = clientSessions.get(clientId);\n                        if (session) {\n                            session.user = user;\n                            session.authenticated = true;\n                        }\n                        ws.send(JSON.stringify({ type: \"AUTH_SUCCESS\",\nrequestId,\npayload: { uid: user.uid,\nroles: user.roles } }));\n                    } else {\n                        sendError(\"AUTH_ERROR\", \"INVALID_TOKEN\", \"Invalid or expired token\");\n                    }\n                    return;\n                }\n\n                if (requireAuth) {\n                    const session = clientSessions.get(clientId);\n                    if (!session?.authenticated) {\n                        sendError(\"ERROR\", \"UNAUTHORIZED\", \"Authentication required\");\n                        return;\n                    }\n                }\n\n                {\n                    const session = clientSessions.get(clientId);\n                    if (session) {\n                        const now = Date.now();\n                        if (now - session.messageWindowStart > WS_RATE_WINDOW_MS) {\n                            session.messageCount = 0;\n                            session.messageWindowStart = now;\n                        }\n                        session.messageCount++;\n                        if (session.messageCount > WS_RATE_LIMIT) {\n                            sendError(\"ERROR\", \"RATE_LIMITED\", \"Too many requests. Please slow down.\");\n                            return;\n                        }\n                    }\n                }\n\n                if (ADMIN_ONLY_TYPES.has(type)) {\n                    const session = clientSessions.get(clientId);\n                    if (!isAdminSession(session)) {\n                        sendError(\"ERROR\", \"FORBIDDEN\", \"Admin access required for this operation\");\n                        return;\n                    }\n                }\n\n                const getScopedDelegate = async (): Promise<DataDriver> => {\n                    const session = clientSessions.get(clientId);\n                    if (session?.user && isDriverWithAuth(driver)) {\n                        try {\n                            const userForAuth: User = {\n                                uid: session.user.uid,\n                                email: session.user.email ?? \"\",\n                                displayName: session.user.displayName ?? \"\",\n                                photoURL: session.user.photoURL ?? \"\",\n                                providerId: \"jwt\",\n                                isAnonymous: false,\n                                roles: session.user.roles ?? []\n                            };\n                            return await driver.withAuth(userForAuth);\n                        } catch (e) {\n                            logger.error(\"Failed to create authenticated delegate for WS request\", { error: e });\n                            return driver;\n                        }\n                    }\n                    return driver;\n                };\n\n                switch (type) {\n                    case \"FETCH_COLLECTION\": {\n                        const request: FetchCollectionProps = payload;\n                        const delegate = await getScopedDelegate();\n                        const rows = await delegate.fetchCollection(request);\n                        ws.send(JSON.stringify({ type: \"FETCH_COLLECTION_SUCCESS\",\npayload: { rows },\nrequestId }));\n                        break;\n                    }\n                    case \"FETCH_ONE\": {\n                        const request: FetchOneProps = payload;\n                        const delegate = await getScopedDelegate();\n                        const row = await delegate.fetchOne(request);\n                        ws.send(JSON.stringify({ type: \"FETCH_ONE_SUCCESS\",\npayload: { row },\nrequestId }));\n                        break;\n                    }\n                    case \"SAVE\": {\n                        const request: SaveProps = payload;\n                        const delegate = await getScopedDelegate();\n                        const row = await delegate.save(request);\n                        ws.send(JSON.stringify({ type: \"SAVE_SUCCESS\",\npayload: { row },\nrequestId }));\n                        break;\n                    }\n                    case \"DELETE\": {\n                        const request: DeleteProps = payload;\n                        const delegate = await getScopedDelegate();\n                        await delegate.delete(request);\n                        ws.send(JSON.stringify({ type: \"DELETE_SUCCESS\",\npayload: { success: true },\nrequestId }));\n                        break;\n                    }\n                    case \"CHECK_UNIQUE_FIELD\": {\n                        const { path, name, value, id, collection } = payload;\n                        const delegate = await getScopedDelegate();\n                        const isUnique = await delegate.checkUniqueField(path, name, value, id, collection);\n                        ws.send(JSON.stringify({ type: \"CHECK_UNIQUE_FIELD_SUCCESS\",\npayload: { isUnique },\nrequestId }));\n                        break;\n                    }\n                    case \"COUNT\": {\n                        const request: FetchCollectionProps = payload;\n                        const delegate = await getScopedDelegate();\n                        const count = await delegate.count!(request);\n                        ws.send(JSON.stringify({ type: \"COUNT_SUCCESS\",\npayload: { count },\nrequestId }));\n                        break;\n                    }\n                    case \"EXECUTE_SQL\": {\n                        const { sql, options } = payload;\n                        if (admin && isDocumentAdmin(admin) && admin.executeAggregate) {\n                            const result = await admin.executeAggregate(sql as Record<string, unknown>[]);\n                            ws.send(JSON.stringify({ type: \"EXECUTE_SQL_SUCCESS\",\npayload: { result },\nrequestId }));\n                        } else {\n                            ws.send(JSON.stringify({ type: \"ERROR\",\nrequestId,\npayload: { error: { message: \"SQL execution not supported for this driver\",\ncode: \"NOT_SUPPORTED\" } } }));\n                        }\n                        break;\n                    }\n                    case \"FETCH_UNMAPPED_TABLES\": {\n                        if (admin && isSchemaAdmin(admin)) {\n                            const tables = await admin.fetchUnmappedTables?.(payload?.mappedPaths) || [];\n                            ws.send(JSON.stringify({ type: \"FETCH_UNMAPPED_TABLES_SUCCESS\",\npayload: { tables },\nrequestId }));\n                        } else {\n                            ws.send(JSON.stringify({ type: \"FETCH_UNMAPPED_TABLES_SUCCESS\",\npayload: { tables: [] },\nrequestId }));\n                        }\n                        break;\n                    }\n                    case \"FETCH_TABLE_METADATA\": {\n                        const { tableName } = payload;\n                        if (admin && isSchemaAdmin(admin)) {\n                            const metadata = await admin.fetchTableMetadata?.(tableName);\n                            ws.send(JSON.stringify({ type: \"FETCH_TABLE_METADATA_SUCCESS\",\npayload: { metadata },\nrequestId }));\n                        } else {\n                            ws.send(JSON.stringify({ type: \"FETCH_TABLE_METADATA_SUCCESS\",\npayload: { metadata: null },\nrequestId }));\n                        }\n                        break;\n                    }\n                    case \"subscribe_collection\":\n                    case \"subscribe_one\":\n                    case \"unsubscribe\": {\n                        const session = clientSessions.get(clientId);\n                        const authContext = session?.user ? { uid: session.user.uid,\nroles: session.user.roles ?? [] } : undefined;\n                        await realtimeService.handleClientMessage(clientId, {\n                            type,\n                            payload,\n                            subscriptionId: payload?.subscriptionId\n                        }, authContext);\n                        break;\n                    }\n                    default:\n                        logger.error(\"❌ [WebSocket Server] Unknown message type\", { detail: type });\n                }\n            } catch (error: unknown) {\n                const errorMessage = process.env.NODE_ENV === \"production\" ? \"An unexpected error occurred\" : (error instanceof Error ? error.message : \"An unexpected error occurred\");\n                ws.send(JSON.stringify({ type: \"ERROR\",\nrequestId,\npayload: { error: { message: errorMessage,\ncode: \"INTERNAL_ERROR\" } } }));\n            }\n        });\n    });\n}\n"],"mappings":";;;;AAeA,SAAS,iBAAiB,QAA8C;CACpE,OAAO,cAAc,UAAU,OAAQ,OAAmC,aAAa;AAC3F;AAUA,IAAM,iCAAiB,IAAI,IAA2B;AACtD,IAAM,gBAAgB;AACtB,IAAM,oBAAoB;AAE1B,IAAM,mBAAmB,IAAI,IAAI;CAC7B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACJ,CAAC;AAED,SAAS,eAAe,SAA6C;CACjE,IAAI,CAAC,SAAS,MAAM,OAAO,OAAO;CAClC,OAAO,QAAQ,KAAK,MAAM,SAAS,OAAO;AAC9C;AAEA,SAAgB,qBACZ,QACA,iBACA,QACA,YACA,OACF;CACE,MAAM,eAAA,QAAA,IAAA,aAAwC;CAC9C,MAAM,WAAW,GAAG,SAAoB;EAAE,IAAI,CAAC,cAAc,QAAQ,MAAM,GAAG,IAAI;CAAG;CACrF,MAAM,MAAM,IAAI,gBAAgB,EAAE,OAAO,CAAC;CAE1C,IAAI,GAAG,UAAU,QAA+B;EAC5C,IAAI,IAAI,SAAS,cAAc;EAC/B,OAAO,MAAM,8BAA8B,EAAE,OAAO,IAAI,CAAC;CAC7D,CAAC;CAED,MAAM,cAAc,YAAY,gBAAgB,SAAS,YAAY;CAErE,IAAI,GAAG,eAAe,OAAO;EACzB,MAAM,WAAW,UAAU,KAAK,IAAI,EAAE,GAAG,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,UAAU,GAAG,CAAC;EAClF,QAAQ,+BAA+B,UAAU;EAEjD,eAAe,IAAI,UAAU;GAAE;GACvC,eAAe,CAAC;GAChB,cAAc;GACd,oBAAoB,KAAK,IAAI;EAAE,CAAC;EACxB,gBAAgB,UAAU,UAAU,EAAE;EAEtC,GAAG,GAAG,eAAe;GACjB,QAAQ,kCAAkC,UAAU;GACpD,eAAe,OAAO,QAAQ;EAClC,CAAC;EAED,GAAG,GAAG,WAAW,OAAO,YAAY;GAChC,IAAI;GACJ,IAAI;IACA,MAAM,EAAE,MAAM,SAAS,WAAW,UAAU,KAAK,MAAM,QAAQ,SAAS,CAAC;IACzE,YAAY;IAEZ,QAAQ,QAAQ,SAAS,KAAK,QAAQ,YAAY,IAAI,UAAU,KAAK,EAAE;IAEvE,MAAM,aAAa,SAAiC,MAAc,QAAgB;KAC9E,GAAG,KAAK,KAAK,UAAU;MAAE,MAAM;MACnD;MACA,SAAS,EAAE,OAAO;OAAE,SAAS;OAC7B;MAAK,EAAE;KAAE,CAAC,CAAC;IACK;IAEA,IAAI,SAAS,gBAAgB;KACzB,MAAM,EAAE,UAAU,WAAW,CAAC;KAC9B,IAAI,CAAC,OAAO;MACR,UAAU,cAAc,iBAAiB,mBAAmB;MAC5D;KACJ;KAEA,MAAM,OAAO,qBAAqB,KAAK;KACvC,IAAI,MAAM;MACN,MAAM,UAAU,eAAe,IAAI,QAAQ;MAC3C,IAAI,SAAS;OACT,QAAQ,OAAO;OACf,QAAQ,gBAAgB;MAC5B;MACA,GAAG,KAAK,KAAK,UAAU;OAAE,MAAM;OACvD;OACA,SAAS;QAAE,KAAK,KAAK;QACrB,OAAO,KAAK;OAAM;MAAE,CAAC,CAAC;KACF,OACI,UAAU,cAAc,iBAAiB,0BAA0B;KAEvE;IACJ;IAEA,IAAI;SAEI,CADY,eAAe,IAAI,QAC9B,GAAS,eAAe;MACzB,UAAU,SAAS,gBAAgB,yBAAyB;MAC5D;KACJ;;IAGJ;KACI,MAAM,UAAU,eAAe,IAAI,QAAQ;KAC3C,IAAI,SAAS;MACT,MAAM,MAAM,KAAK,IAAI;MACrB,IAAI,MAAM,QAAQ,qBAAqB,mBAAmB;OACtD,QAAQ,eAAe;OACvB,QAAQ,qBAAqB;MACjC;MACA,QAAQ;MACR,IAAI,QAAQ,eAAe,eAAe;OACtC,UAAU,SAAS,gBAAgB,sCAAsC;OACzE;MACJ;KACJ;IACJ;IAEA,IAAI,iBAAiB,IAAI,IAAI;SAErB,CAAC,eADW,eAAe,IAAI,QACf,CAAO,GAAG;MAC1B,UAAU,SAAS,aAAa,0CAA0C;MAC1E;KACJ;;IAGJ,MAAM,oBAAoB,YAAiC;KACvD,MAAM,UAAU,eAAe,IAAI,QAAQ;KAC3C,IAAI,SAAS,QAAQ,iBAAiB,MAAM,GACxC,IAAI;MACA,MAAM,cAAoB;OACtB,KAAK,QAAQ,KAAK;OAClB,OAAO,QAAQ,KAAK,SAAS;OAC7B,aAAa,QAAQ,KAAK,eAAe;OACzC,UAAU,QAAQ,KAAK,YAAY;OACnC,YAAY;OACZ,aAAa;OACb,OAAO,QAAQ,KAAK,SAAS,CAAC;MAClC;MACA,OAAO,MAAM,OAAO,SAAS,WAAW;KAC5C,SAAS,GAAG;MACR,OAAO,MAAM,0DAA0D,EAAE,OAAO,EAAE,CAAC;MACnF,OAAO;KACX;KAEJ,OAAO;IACX;IAEA,QAAQ,MAAR;KACI,KAAK,oBAAoB;MACrB,MAAM,UAAgC;MAEtC,MAAM,OAAO,OAAM,MADI,kBAAkB,GACb,gBAAgB,OAAO;MACnD,GAAG,KAAK,KAAK,UAAU;OAAE,MAAM;OACvD,SAAS,EAAE,KAAK;OAChB;MAAU,CAAC,CAAC;MACY;KACJ;KACA,KAAK,aAAa;MACd,MAAM,UAAyB;MAE/B,MAAM,MAAM,OAAM,MADK,kBAAkB,GACd,SAAS,OAAO;MAC3C,GAAG,KAAK,KAAK,UAAU;OAAE,MAAM;OACvD,SAAS,EAAE,IAAI;OACf;MAAU,CAAC,CAAC;MACY;KACJ;KACA,KAAK,QAAQ;MACT,MAAM,UAAqB;MAE3B,MAAM,MAAM,OAAM,MADK,kBAAkB,GACd,KAAK,OAAO;MACvC,GAAG,KAAK,KAAK,UAAU;OAAE,MAAM;OACvD,SAAS,EAAE,IAAI;OACf;MAAU,CAAC,CAAC;MACY;KACJ;KACA,KAAK,UAAU;MACX,MAAM,UAAuB;MAE7B,OAAM,MADiB,kBAAkB,GAC1B,OAAO,OAAO;MAC7B,GAAG,KAAK,KAAK,UAAU;OAAE,MAAM;OACvD,SAAS,EAAE,SAAS,KAAK;OACzB;MAAU,CAAC,CAAC;MACY;KACJ;KACA,KAAK,sBAAsB;MACvB,MAAM,EAAE,MAAM,MAAM,OAAO,IAAI,eAAe;MAE9C,MAAM,WAAW,OAAM,MADA,kBAAkB,GACT,iBAAiB,MAAM,MAAM,OAAO,IAAI,UAAU;MAClF,GAAG,KAAK,KAAK,UAAU;OAAE,MAAM;OACvD,SAAS,EAAE,SAAS;OACpB;MAAU,CAAC,CAAC;MACY;KACJ;KACA,KAAK,SAAS;MACV,MAAM,UAAgC;MAEtC,MAAM,QAAQ,OAAM,MADG,kBAAkB,GACZ,MAAO,OAAO;MAC3C,GAAG,KAAK,KAAK,UAAU;OAAE,MAAM;OACvD,SAAS,EAAE,MAAM;OACjB;MAAU,CAAC,CAAC;MACY;KACJ;KACA,KAAK,eAAe;MAChB,MAAM,EAAE,KAAK,YAAY;MACzB,IAAI,SAAS,gBAAgB,KAAK,KAAK,MAAM,kBAAkB;OAC3D,MAAM,SAAS,MAAM,MAAM,iBAAiB,GAAgC;OAC5E,GAAG,KAAK,KAAK,UAAU;QAAE,MAAM;QAC3D,SAAS,EAAE,OAAO;QAClB;OAAU,CAAC,CAAC;MACY,OACI,GAAG,KAAK,KAAK,UAAU;OAAE,MAAM;OAC3D;OACA,SAAS,EAAE,OAAO;QAAE,SAAS;QAC7B,MAAM;OAAgB,EAAE;MAAE,CAAC,CAAC;MAEJ;KACJ;KACA,KAAK;MACD,IAAI,SAAS,cAAc,KAAK,GAAG;OAC/B,MAAM,SAAS,MAAM,MAAM,sBAAsB,SAAS,WAAW,KAAK,CAAC;OAC3E,GAAG,KAAK,KAAK,UAAU;QAAE,MAAM;QAC3D,SAAS,EAAE,OAAO;QAClB;OAAU,CAAC,CAAC;MACY,OACI,GAAG,KAAK,KAAK,UAAU;OAAE,MAAM;OAC3D,SAAS,EAAE,QAAQ,CAAC,EAAE;OACtB;MAAU,CAAC,CAAC;MAEY;KAEJ,KAAK,wBAAwB;MACzB,MAAM,EAAE,cAAc;MACtB,IAAI,SAAS,cAAc,KAAK,GAAG;OAC/B,MAAM,WAAW,MAAM,MAAM,qBAAqB,SAAS;OAC3D,GAAG,KAAK,KAAK,UAAU;QAAE,MAAM;QAC3D,SAAS,EAAE,SAAS;QACpB;OAAU,CAAC,CAAC;MACY,OACI,GAAG,KAAK,KAAK,UAAU;OAAE,MAAM;OAC3D,SAAS,EAAE,UAAU,KAAK;OAC1B;MAAU,CAAC,CAAC;MAEY;KACJ;KACA,KAAK;KACL,KAAK;KACL,KAAK,eAAe;MAChB,MAAM,UAAU,eAAe,IAAI,QAAQ;MAC3C,MAAM,cAAc,SAAS,OAAO;OAAE,KAAK,QAAQ,KAAK;OAChF,OAAO,QAAQ,KAAK,SAAS,CAAC;MAAE,IAAI,KAAA;MACZ,MAAM,gBAAgB,oBAAoB,UAAU;OAChD;OACA;OACA,gBAAgB,SAAS;MAC7B,GAAG,WAAW;MACd;KACJ;KACA,SACI,OAAO,MAAM,6CAA6C,EAAE,QAAQ,KAAK,CAAC;IAClF;GACJ,SAAS,OAAgB;IACrB,MAAM,eAAA,QAAA,IAAA,aAAwC,eAAe,iCAAkC,iBAAiB,QAAQ,MAAM,UAAU;IACxI,GAAG,KAAK,KAAK,UAAU;KAAE,MAAM;KAC/C;KACA,SAAS,EAAE,OAAO;MAAE,SAAS;MAC7B,MAAM;KAAiB,EAAE;IAAE,CAAC,CAAC;GACjB;EACJ,CAAC;CACL,CAAC;AACL"}