@rebasepro/server-mongo 0.21.0 → 0.21.1

package/dist/services/MongoDriver.d.ts

@@ -7,7 +7,7 @@
 import { Db } from "mongodb";
 import { DataDriver, DeleteProps, CollectionConfig, FetchCollectionProps, FetchOneProps, ListenCollectionProps, ListenOneProps, SaveProps, CollectionRegistryInterface, User, RebaseServerClient, RebaseSdkData } from "@rebasepro/types";
 import { MongoDataService } from "../db/MongoDataService.js";
-import { MongoRealtimeService } from "./MongoRealtimeService.js";
+import { MongoRealtimeService, type SubscriptionAuthContext } from "./MongoRealtimeService.js";
 import { MongoHistoryService } from "./MongoHistoryService.js";
 /**
  * MongoDB DataDriver Delegate
@@ -60,10 +60,7 @@ export declare class MongoDriver implements DataDriver {
      * what every re-fetch reads — the wrapper used to stamp the field on the
      * `Subscription` object instead, and nothing has ever read that one.
      */
-    listenCollection<M extends Record<string, any>>({ onUpdate, onError, collection, vectorSearch, ...query }: ListenCollectionProps<M>, authContext?: {
-        uid: string;
-        roles: string[];
-    }): () => void;
+    listenCollection<M extends Record<string, any>>({ onUpdate, onError, collection, vectorSearch, ...query }: ListenCollectionProps<M>, authContext?: SubscriptionAuthContext): () => void;
     /**
      * Fetch a single row
      */
@@ -71,10 +68,7 @@ export declare class MongoDriver implements DataDriver {
     /**
      * Listen to row changes
      */
-    listenOne<M extends Record<string, any>>({ path, id, collection, onUpdate, onError }: ListenOneProps<M>, authContext?: {
-        uid: string;
-        roles: string[];
-    }): () => void;
+    listenOne<M extends Record<string, any>>({ path, id, collection, onUpdate, onError }: ListenOneProps<M>, authContext?: SubscriptionAuthContext): () => void;
     /**
      * Save an row (create or update)
      */
@@ -126,7 +120,14 @@ export declare class AuthenticatedMongoDriver implements DataDriver {
     currentTime(): Date;
     fetchCollection<M extends Record<string, any>>(props: FetchCollectionProps<M>): Promise<Record<string, unknown>[]>;
     listenCollection<M extends Record<string, any>>(props: ListenCollectionProps<M>): () => void;
-    /** The acting user, in the shape the realtime subscriptions carry. */
+    /**
+     * The acting user, in the shape the realtime subscriptions carry.
+     *
+     * `isAnonymous` included: a guest has a real uid, and without the flag
+     * every fetch a listener's subscription makes reads as an account, so
+     * `policy.registered()` handed a guest's listener what it withholds from a
+     * guest's `fetchCollection` on this same driver.
+     */
     private authContext;
     /**
      * Evaluate the collection's rules for one row, fail-closed.

package/dist/services/MongoRealtimeService.d.ts

@@ -12,6 +12,13 @@ import type { MongoDriver } from "./MongoDriver.js";
 export interface SubscriptionAuthContext {
     uid: string;
     roles: string[];
+    /**
+     * Whether the subscriber is a guest — anonymous sign-in rather than an
+     * account. A guest has a real uid, so without this every fetch the
+     * subscription makes reads as an account, and `policy.registered()` lets
+     * it through. Absent reads as "not a guest".
+     */
+    isAnonymous?: boolean;
 }
 interface Subscription {
     type: "collection" | "single";
@@ -26,6 +33,13 @@ interface Subscription {
     };
     changeStream?: ChangeStream;
     callback?: (data: any) => void;
+    /**
+     * Told when a fetch for this subscription fails — the initial one or any
+     * re-fetch. Without it the failure was logged and nothing else happened:
+     * the subscriber had been sent neither rows nor an error, so its view
+     * stayed loading and its `onError` never fired.
+     */
+    onError?: (error: unknown) => void;
     /**
      * How many deliveries have been started for this subscription, and the
      * highest that has already reached the callback.
@@ -78,14 +92,31 @@ export declare class MongoRealtimeService implements RealtimeProvider {
      * fetch behind it is the newest thing known about the row, so it must also
      * be the thing that closes the door on an older fetch still in flight —
      * otherwise the deleted row reappears a moment after it vanished.
+     *
+     * `mayReportFailure()` is the same check for reporting this delivery's
+     * failure, except that it also answers yes to the delivery that already
+     * claimed the slot. That is the send itself failing (the socket closure's
+     * `JSON.stringify` on a row that will not serialise) after the check passed
+     * and before anything reached the subscriber. Same rule as the Postgres
+     * service's `beginDelivery`.
      */
     private beginDelivery;
+    /**
+     * Tell the subscriber a fetch failed, through the slot the rows would have
+     * used.
+     *
+     * The slot matters as much for an error as for rows. Without it, a fetch
+     * that a newer delivery has overtaken would mark a view showing current
+     * data as failed, and one whose subscription was cancelled or replaced
+     * under the same id would fail a different subscription's view.
+     */
+    private reportFetchFailure;
     /**
      * Subscribe to collection changes
      */
     subscribeToCollection(subscriptionId: string, config: CollectionSubscriptionConfig & {
         authContext?: SubscriptionAuthContext;
-    }, callback?: (rows: Record<string, unknown>[]) => void): void;
+    }, callback?: (rows: Record<string, unknown>[]) => void, onError?: (error: unknown) => void): void;
     /**
      * Fetch collection and notify callback
      */
@@ -102,7 +133,7 @@ export declare class MongoRealtimeService implements RealtimeProvider {
      */
     subscribeToOne(subscriptionId: string, config: SingleSubscriptionConfig & {
         authContext?: SubscriptionAuthContext;
-    }, callback?: (row: Record<string, unknown> | null) => void): void;
+    }, callback?: (row: Record<string, unknown> | null) => void, onError?: (error: unknown) => void): void;
     /**
      * Fetch row and notify callback
      */
@@ -142,6 +173,7 @@ export declare class MongoRealtimeService implements RealtimeProvider {
     }, _authContext?: {
         uid: string;
         roles: unknown[];
+        isAnonymous?: boolean;
     }): Promise<void>;
 }
 export {};

package/dist/{websocket-B3LiQfFN.js → websocket-C3iT6srl.js}

@@ -1,10 +1,7 @@
-import { isDocumentAdmin, isSchemaAdmin } from "@rebasepro/types";
-import { ApiError, assertWriteRequestValid, extractUserFromToken, logger, resolveRequireAuth } from "@rebasepro/server";
+import { ANONYMOUS_USER_ID, isDocumentAdmin, isSchemaAdmin } from "@rebasepro/types";
+import { ApiError, assertWriteRequestValid, declaredErrorAnswer, extractUserFromToken, logger, resolveRequireAuth } from "@rebasepro/server";
 import { WebSocketServer } from "ws";
 //#region src/websocket.ts
-function isDriverWithAuth(driver) {
-	return "withAuth" in driver && typeof driver.withAuth === "function";
-}
 var WS_RATE_LIMIT = 2e3;
 var WS_RATE_WINDOW_MS = 6e4;
 var ADMIN_ONLY_TYPES = /* @__PURE__ */ new Set([
@@ -18,6 +15,35 @@ var ADMIN_ONLY_TYPES = /* @__PURE__ */ new Set([
 	"DELETE_BRANCH",
 	"LIST_BRANCHES"
 ]);
+/**
+* Who a socket reads and writes as, for its request frames and its
+* subscriptions alike — one answer, so the two cannot disagree.
+*
+* A socket with no session (only possible with `requireAuth: false`) is the
+* anonymous user, exactly as REST scopes the same caller. It used to get the
+* base driver instead, which on this engine applies no security rules at all:
+* such a socket read every row and wrote wherever it liked.
+*/
+function sessionUser(session) {
+	if (!session?.user) return {
+		uid: ANONYMOUS_USER_ID,
+		displayName: null,
+		email: null,
+		photoURL: null,
+		providerId: "websocket",
+		isAnonymous: false,
+		roles: ["anon"]
+	};
+	return {
+		uid: session.user.uid,
+		email: session.user.email ?? "",
+		displayName: session.user.displayName ?? "",
+		photoURL: session.user.photoURL ?? "",
+		providerId: "jwt",
+		isAnonymous: session.user.isAnonymous,
+		roles: session.user.roles ?? []
+	};
+}
 function isAdminSession(session) {
 	if (!session?.user) return false;
 	if (session.user.isAdmin) return true;
@@ -79,7 +105,8 @@ function createMongoWebSocket(server, realtimeService, driver, authConfig, admin
 							uid: adapterUser.uid,
 							email: adapterUser.email,
 							roles: adapterUser.roles ?? [],
-							isAdmin: !!adapterUser.isAdmin
+							isAdmin: !!adapterUser.isAdmin,
+							isAnonymous: adapterUser.isAnonymous === true
 						};
 					} catch {}
 					else {
@@ -90,7 +117,8 @@ function createMongoWebSocket(server, realtimeService, driver, authConfig, admin
 							displayName: jwtPayload.displayName,
 							photoURL: jwtPayload.photoURL,
 							roles: jwtPayload.roles ?? [],
-							isAdmin: (jwtPayload.roles ?? []).some((r) => r === "admin")
+							isAdmin: (jwtPayload.roles ?? []).some((r) => r === "admin"),
+							isAnonymous: jwtPayload.isAnonymous === true
 						};
 					}
 					if (verifiedUser) {
@@ -137,6 +165,33 @@ function createMongoWebSocket(server, realtimeService, driver, authConfig, admin
 						return;
 					}
 				}
+				/**
+				* Refuse a frame whose path names no registered data collection.
+				*
+				* MongoDB has no row-level security, so on this engine the
+				* registry *is* the access model: `securityRules` are enforced
+				* only for a collection the registry resolves, and
+				* `MongoDataService.getCollection` maps any path to a physical
+				* collection by replacing `/` with `_`. A path the registry does
+				* not know therefore reaches the database with no rule to apply —
+				* `AuthenticatedMongoDriver.authorize(undefined)` answers
+				* "allowed" and the RLS filter for an undefined collection is
+				* "match all" — which put the auth store (`rebase_users` and its
+				* password hashes, `rebase_user_roles`, `rebase_refresh_tokens`)
+				* one frame away from any caller: authenticated, or anonymous
+				* when `requireAuth` is false.
+				*
+				* The socket is the one client-facing door onto this driver. REST
+				* mounts routes per registered slug and 404s everything else, and
+				* in-process writes are trusted server code — so the registry
+				* check lives here, at the boundary this door owns, exactly as the
+				* write validation beside it does. A `notFound` matches what REST
+				* answers for an unknown collection, and does not distinguish a
+				* collection that exists in Mongo from one that does not.
+				*/
+				const assertRegisteredPath = (path) => {
+					if (!path || !driver.registry?.getCollectionByPath(path)) throw ApiError.notFound(`Unknown collection at path "${path ?? ""}": it is not a registered data collection.`);
+				};
 				/** @see the Postgres socket — same rule, same reason. */
 				const assertWriteRequest = (path, values) => {
 					if (!path || !values || typeof values !== "object") return;
@@ -144,28 +199,11 @@ function createMongoWebSocket(server, realtimeService, driver, authConfig, admin
 					if (!collection) return;
 					assertWriteRequestValid(values, collection);
 				};
-				const getScopedDelegate = async () => {
-					const session = clientSessions.get(clientId);
-					if (session?.user && isDriverWithAuth(driver)) try {
-						const userForAuth = {
-							uid: session.user.uid,
-							email: session.user.email ?? "",
-							displayName: session.user.displayName ?? "",
-							photoURL: session.user.photoURL ?? "",
-							providerId: "jwt",
-							isAnonymous: false,
-							roles: session.user.roles ?? []
-						};
-						return await driver.withAuth(userForAuth);
-					} catch (e) {
-						logger.error("Failed to create authenticated delegate for WS request", { error: e });
-						return driver;
-					}
-					return driver;
-				};
+				const getScopedDelegate = () => driver.withAuth(sessionUser(clientSessions.get(clientId)));
 				switch (type) {
 					case "FETCH_COLLECTION": {
 						const request = payload;
+						assertRegisteredPath(request.path);
 						const rows = await (await getScopedDelegate()).fetchCollection(request);
 						ws.send(JSON.stringify({
 							type: "FETCH_COLLECTION_SUCCESS",
@@ -176,6 +214,7 @@ function createMongoWebSocket(server, realtimeService, driver, authConfig, admin
 					}
 					case "FETCH_ONE": {
 						const request = payload;
+						assertRegisteredPath(request.path);
 						const row = await (await getScopedDelegate()).fetchOne(request);
 						ws.send(JSON.stringify({
 							type: "FETCH_ONE_SUCCESS",
@@ -186,6 +225,7 @@ function createMongoWebSocket(server, realtimeService, driver, authConfig, admin
 					}
 					case "SAVE": {
 						const request = payload;
+						assertRegisteredPath(request.path);
 						assertWriteRequest(request.path, request.values);
 						const row = await (await getScopedDelegate()).save(request);
 						ws.send(JSON.stringify({
@@ -197,7 +237,14 @@ function createMongoWebSocket(server, realtimeService, driver, authConfig, admin
 					}
 					case "DELETE": {
 						const request = payload;
-						await (await getScopedDelegate()).delete(request);
+						assertRegisteredPath(request.row?.path);
+						await (await getScopedDelegate()).delete({
+							row: {
+								id: request.row.id,
+								path: request.row.path
+							},
+							hard: request.hard
+						});
 						ws.send(JSON.stringify({
 							type: "DELETE_SUCCESS",
 							payload: { success: true },
@@ -207,6 +254,7 @@ function createMongoWebSocket(server, realtimeService, driver, authConfig, admin
 					}
 					case "CHECK_UNIQUE_FIELD": {
 						const { path, name, value, id, collection } = payload;
+						assertRegisteredPath(path);
 						const isUnique = await (await getScopedDelegate()).checkUniqueField(path, name, value, id, collection);
 						ws.send(JSON.stringify({
 							type: "CHECK_UNIQUE_FIELD_SUCCESS",
@@ -217,6 +265,7 @@ function createMongoWebSocket(server, realtimeService, driver, authConfig, admin
 					}
 					case "COUNT": {
 						const request = payload;
+						assertRegisteredPath(request.path);
 						const count = await (await getScopedDelegate()).count(request);
 						ws.send(JSON.stringify({
 							type: "COUNT_SUCCESS",
@@ -277,29 +326,42 @@ function createMongoWebSocket(server, realtimeService, driver, authConfig, admin
 					case "subscribe_collection":
 					case "subscribe_one":
 					case "unsubscribe": {
-						const session = clientSessions.get(clientId);
-						const authContext = session?.user ? {
-							uid: session.user.uid,
-							roles: session.user.roles ?? []
-						} : void 0;
+						if (type !== "unsubscribe" && !driver.registry?.getCollectionByPath(payload?.path)) {
+							ws.send(JSON.stringify({
+								type: "ERROR",
+								requestId,
+								subscriptionId: payload?.subscriptionId,
+								payload: { error: {
+									message: `Unknown collection at path "${payload?.path ?? ""}": it is not a registered data collection.`,
+									code: "NOT_FOUND"
+								} }
+							}));
+							return;
+						}
+						const subscriber = sessionUser(clientSessions.get(clientId));
 						await realtimeService.handleClientMessage(clientId, {
 							type,
 							payload,
 							subscriptionId: payload?.subscriptionId
-						}, authContext);
+						}, {
+							uid: subscriber.uid,
+							roles: subscriber.roles ?? [],
+							isAnonymous: subscriber.isAnonymous
+						});
 						break;
 					}
 					default: logger.error("❌ [WebSocket Server] Unknown message type", { detail: type });
 				}
 			} catch (error) {
-				if (error instanceof ApiError || error?.name === "ApiError") {
-					const apiError = error;
+				const answer = declaredErrorAnswer(error);
+				if (answer) {
 					ws.send(JSON.stringify({
 						type: "ERROR",
 						requestId,
 						payload: { error: {
-							message: apiError.message,
-							code: apiError.code
+							message: answer.message,
+							code: answer.code,
+							...answer.details !== void 0 && { details: answer.details }
 						} }
 					}));
 					return;
@@ -320,4 +382,4 @@ function createMongoWebSocket(server, realtimeService, driver, authConfig, admin
 //#endregion
 export { createMongoWebSocket };
 
-//# sourceMappingURL=websocket-B3LiQfFN.js.map
+//# sourceMappingURL=websocket-C3iT6srl.js.map

package/dist/websocket-C3iT6srl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"websocket-C3iT6srl.js","names":[],"sources":["../src/websocket.ts"],"sourcesContent":["import { ANONYMOUS_USER_ID, RealtimeProvider, DataDriver, FetchCollectionProps, FetchOneProps, SaveProps, DeleteProps, TableMetadata, DatabaseAdmin, isSchemaAdmin, isDocumentAdmin, User, AuthAdapter } from \"@rebasepro/types\";\nimport { WebSocketServer, WebSocket } from \"ws\";\nimport { Server } from \"http\";\nimport { inspect } from \"util\";\nimport { extractUserFromToken, resolveRequireAuth, assertWriteRequestValid, ApiError, declaredErrorAnswer } from \"@rebasepro/server\";\nimport type { RebaseAuthConfig } from \"@rebasepro/server\";\nimport { MongoRealtimeService } from \"./services/MongoRealtimeService\";\nimport { MongoDriver } from \"./services/MongoDriver\";\nimport { logger } from \"@rebasepro/server\";\n\n/**\n * Normalized user identity for WebSocket sessions — the same shape the Postgres\n * socket keeps, because an `AuthAdapter` user is not an access-token payload.\n */\ninterface WsUserIdentity {\n    uid: string;\n    email?: string;\n    displayName?: string;\n    photoURL?: string;\n    roles: string[];\n    isAdmin: boolean;\n    /**\n     * Whether this session is a guest — anonymous sign-in rather than an\n     * account. Required, so every way of signing in has to say: a guest has a\n     * real uid, and `policy.registered()` has nothing else to tell it from an\n     * account by. Neither sign-in path read it, and every frame was then\n     * scoped as an account.\n     */\n    isAnonymous: boolean;\n}\n\ninterface ClientSession {\n    ws: WebSocket;\n    user?: WsUserIdentity;\n    authenticated: boolean;\n    messageCount: number;\n    messageWindowStart: number;\n}\n\nconst WS_RATE_LIMIT = 2000;\nconst WS_RATE_WINDOW_MS = 60_000;\n\nconst ADMIN_ONLY_TYPES = new Set([\n    \"EXECUTE_SQL\",\n    \"FETCH_DATABASES\",\n    \"FETCH_ROLES\",\n    \"FETCH_UNMAPPED_TABLES\",\n    \"FETCH_TABLE_METADATA\",\n    \"FETCH_CURRENT_DATABASE\",\n    \"CREATE_BRANCH\",\n    \"DELETE_BRANCH\",\n    \"LIST_BRANCHES\"\n]);\n\n/**\n * Who a socket reads and writes as, for its request frames and its\n * subscriptions alike — one answer, so the two cannot disagree.\n *\n * A socket with no session (only possible with `requireAuth: false`) is the\n * anonymous user, exactly as REST scopes the same caller. It used to get the\n * base driver instead, which on this engine applies no security rules at all:\n * such a socket read every row and wrote wherever it liked.\n */\nfunction sessionUser(session: ClientSession | undefined): User {\n    if (!session?.user) {\n        return {\n            uid: ANONYMOUS_USER_ID,\n            displayName: null,\n            email: null,\n            photoURL: null,\n            providerId: \"websocket\",\n            isAnonymous: false,\n            roles: [\"anon\"]\n        };\n    }\n    return {\n        uid: session.user.uid,\n        email: session.user.email ?? \"\",\n        displayName: session.user.displayName ?? \"\",\n        photoURL: session.user.photoURL ?? \"\",\n        providerId: \"jwt\",\n        isAnonymous: session.user.isAnonymous,\n        roles: session.user.roles ?? []\n    };\n}\n\nfunction isAdminSession(session: ClientSession | undefined): boolean {\n    if (!session?.user) return false;\n    // The adapter's own answer first; a role *named* `admin` is only the\n    // fallback for the built-in JWT path.\n    if (session.user.isAdmin) return true;\n    return (session.user.roles ?? []).some((r) => r === \"admin\");\n}\n\nexport function createMongoWebSocket(\n    server: Server,\n    realtimeService: MongoRealtimeService,\n    driver: MongoDriver,\n    authConfig?: RebaseAuthConfig,\n    admin?: DatabaseAdmin,\n    authAdapter?: AuthAdapter\n) {\n    // Scoped to this factory invocation rather than the module, so sessions do\n    // not leak across hot reloads or a second server on the same process — the\n    // Postgres socket keeps it here for the same reason.\n    const clientSessions = new Map<string, ClientSession>();\n\n    const isProduction = process.env.NODE_ENV === \"production\";\n    const wsDebug = (...args: unknown[]) => { if (!isProduction) console.debug(...args); };\n    const wss = new WebSocketServer({ server });\n\n    wss.on(\"error\", (err: NodeJS.ErrnoException) => {\n        if (err.code === \"EADDRINUSE\") return;\n        logger.error(\"❌ [WebSocket Server] Error\", { error: err });\n    });\n\n    // The same predicate the HTTP data routes use, from the same function. See\n    // `resolveRequireAuth` for what this socket's local copy got wrong — most\n    // importantly that a `false` here does not skip a check, it marks every\n    // session `authenticated` at connect time.\n    const requireAuth = !!authAdapter || resolveRequireAuth(authConfig);\n\n    if (requireAuth && !authAdapter && !authConfig?.jwtSecret) {\n        logger.warn(\n            \"🔐 [WebSocket Server] Authentication is required but no adapter or jwtSecret is \" +\n            \"configured — no client can complete AUTH, so every realtime message will be refused.\"\n        );\n    }\n\n    wss.on(\"connection\", (ws) => {\n        const clientId = `client_${Date.now()}_${Math.random().toString(36).substring(2, 9)}`;\n        wsDebug(`WebSocket client connected: ${clientId}`);\n\n        clientSessions.set(clientId, { ws,\nauthenticated: !requireAuth,\nmessageCount: 0,\nmessageWindowStart: Date.now() });\n        realtimeService.addClient(clientId, ws);\n\n        ws.on(\"close\", () => {\n            wsDebug(`WebSocket client disconnected: ${clientId}`);\n            clientSessions.delete(clientId);\n        });\n\n        ws.on(\"message\", async (message) => {\n            let requestId: string | undefined;\n            try {\n                const { type, payload, requestId: reqId } = JSON.parse(message.toString());\n                requestId = reqId;\n\n                wsDebug(`[WS] ${clientId} → ${type}`, requestId ? `(${requestId})` : \"\");\n\n                const sendError = (errType: \"ERROR\" | \"AUTH_ERROR\", code: string, msg: string) => {\n                    ws.send(JSON.stringify({ type: errType,\nrequestId,\npayload: { error: { message: msg,\ncode } } }));\n                };\n\n                if (type === \"AUTHENTICATE\") {\n                    const { token } = payload || {};\n                    if (!token) {\n                        sendError(\"AUTH_ERROR\", \"INVALID_INPUT\", \"Token is required\");\n                        return;\n                    }\n\n                    // The adapter verifies when one is configured, exactly as the\n                    // HTTP routes do; the built-in JWT path is the fallback.\n                    let verifiedUser: WsUserIdentity | null = null;\n\n                    if (authAdapter) {\n                        try {\n                            const adapterUser = authAdapter.verifyToken\n                                ? await authAdapter.verifyToken(token)\n                                : await authAdapter.verifyRequest(new Request(\"http://localhost/_ws_auth\", {\n                                    headers: { Authorization: `Bearer ${token}` }\n                                }));\n                            if (adapterUser) {\n                                verifiedUser = {\n                                    uid: adapterUser.uid,\n                                    email: adapterUser.email,\n                                    roles: adapterUser.roles ?? [],\n                                    isAdmin: !!adapterUser.isAdmin,\n                                    // Absent from an adapter with no such\n                                    // concept, and absent reads as \"not a guest\".\n                                    isAnonymous: adapterUser.isAnonymous === true\n                                };\n                            }\n                        } catch {\n                            // Adapter threw — treat as invalid token\n                        }\n                    } else {\n                        const jwtPayload = await extractUserFromToken(token);\n                        if (jwtPayload) {\n                            verifiedUser = {\n                                uid: jwtPayload.uid,\n                                email: jwtPayload.email,\n                                displayName: jwtPayload.displayName,\n                                photoURL: jwtPayload.photoURL,\n                                roles: jwtPayload.roles ?? [],\n                                isAdmin: (jwtPayload.roles ?? []).some((r: string) => r === \"admin\"),\n                                isAnonymous: jwtPayload.isAnonymous === true\n                            };\n                        }\n                    }\n\n                    if (verifiedUser) {\n                        const session = clientSessions.get(clientId);\n                        if (session) {\n                            session.user = verifiedUser;\n                            session.authenticated = true;\n                        }\n                        ws.send(JSON.stringify({ type: \"AUTH_SUCCESS\",\nrequestId,\npayload: { uid: verifiedUser.uid,\nroles: verifiedUser.roles } }));\n                    } else {\n                        sendError(\"AUTH_ERROR\", \"INVALID_TOKEN\", \"Invalid or expired token\");\n                    }\n                    return;\n                }\n\n                if (requireAuth) {\n                    const session = clientSessions.get(clientId);\n                    if (!session?.authenticated) {\n                        sendError(\"ERROR\", \"UNAUTHORIZED\", \"Authentication required\");\n                        return;\n                    }\n                }\n\n                {\n                    const session = clientSessions.get(clientId);\n                    if (session) {\n                        const now = Date.now();\n                        if (now - session.messageWindowStart > WS_RATE_WINDOW_MS) {\n                            session.messageCount = 0;\n                            session.messageWindowStart = now;\n                        }\n                        session.messageCount++;\n                        if (session.messageCount > WS_RATE_LIMIT) {\n                            sendError(\"ERROR\", \"RATE_LIMITED\", \"Too many requests. Please slow down.\");\n                            return;\n                        }\n                    }\n                }\n\n                if (ADMIN_ONLY_TYPES.has(type)) {\n                    const session = clientSessions.get(clientId);\n                    if (!isAdminSession(session)) {\n                        sendError(\"ERROR\", \"FORBIDDEN\", \"Admin access required for this operation\");\n                        return;\n                    }\n                }\n\n                /**\n                 * Refuse a frame whose path names no registered data collection.\n                 *\n                 * MongoDB has no row-level security, so on this engine the\n                 * registry *is* the access model: `securityRules` are enforced\n                 * only for a collection the registry resolves, and\n                 * `MongoDataService.getCollection` maps any path to a physical\n                 * collection by replacing `/` with `_`. A path the registry does\n                 * not know therefore reaches the database with no rule to apply —\n                 * `AuthenticatedMongoDriver.authorize(undefined)` answers\n                 * \"allowed\" and the RLS filter for an undefined collection is\n                 * \"match all\" — which put the auth store (`rebase_users` and its\n                 * password hashes, `rebase_user_roles`, `rebase_refresh_tokens`)\n                 * one frame away from any caller: authenticated, or anonymous\n                 * when `requireAuth` is false.\n                 *\n                 * The socket is the one client-facing door onto this driver. REST\n                 * mounts routes per registered slug and 404s everything else, and\n                 * in-process writes are trusted server code — so the registry\n                 * check lives here, at the boundary this door owns, exactly as the\n                 * write validation beside it does. A `notFound` matches what REST\n                 * answers for an unknown collection, and does not distinguish a\n                 * collection that exists in Mongo from one that does not.\n                 */\n                const assertRegisteredPath = (path: string | undefined): void => {\n                    if (!path || !driver.registry?.getCollectionByPath(path)) {\n                        throw ApiError.notFound(\n                            `Unknown collection at path \"${path ?? \"\"}\": it is not a registered data collection.`\n                        );\n                    }\n                };\n\n                /** @see the Postgres socket — same rule, same reason. */\n                const assertWriteRequest = (path: string | undefined, values: unknown): void => {\n                    if (!path || !values || typeof values !== \"object\") return;\n                    const collection = driver.registry?.getCollectionByPath(path);\n                    if (!collection) return;\n                    assertWriteRequestValid(values as Record<string, unknown>, collection);\n                };\n\n                // Always scoped. A failure to scope propagates to the frame's\n                // `catch` rather than falling back to the base driver, which\n                // is what it did: the fallback is the unscoped read.\n                const getScopedDelegate = (): Promise<DataDriver> =>\n                    driver.withAuth(sessionUser(clientSessions.get(clientId)));\n\n                switch (type) {\n                    case \"FETCH_COLLECTION\": {\n                        const request: FetchCollectionProps = payload;\n                        assertRegisteredPath(request.path);\n                        const delegate = await getScopedDelegate();\n                        const rows = await delegate.fetchCollection(request);\n                        ws.send(JSON.stringify({ type: \"FETCH_COLLECTION_SUCCESS\",\npayload: { rows },\nrequestId }));\n                        break;\n                    }\n                    case \"FETCH_ONE\": {\n                        const request: FetchOneProps = payload;\n                        assertRegisteredPath(request.path);\n                        const delegate = await getScopedDelegate();\n                        const row = await delegate.fetchOne(request);\n                        ws.send(JSON.stringify({ type: \"FETCH_ONE_SUCCESS\",\npayload: { row },\nrequestId }));\n                        break;\n                    }\n                    case \"SAVE\": {\n                        const request: SaveProps = payload;\n                        // The REST layer's write checks, at this boundary too —\n                        // the socket is a second way in, and it used to be the\n                        // unchecked one. Collection from the registry by path,\n                        // never from the client's `request.collection`.\n                        assertRegisteredPath(request.path);\n                        assertWriteRequest(request.path, request.values as Record<string, unknown>);\n                        const delegate = await getScopedDelegate();\n                        const row = await delegate.save(request);\n                        ws.send(JSON.stringify({ type: \"SAVE_SUCCESS\",\npayload: { row },\nrequestId }));\n                        break;\n                    }\n                    case \"DELETE\": {\n                        const request: DeleteProps = payload;\n                        assertRegisteredPath(request.row?.path);\n                        const delegate = await getScopedDelegate();\n                        // The address, and nothing else the frame says: the\n                        // driver reads the row and resolves the collection by\n                        // path — see the Postgres socket's DELETE.\n                        await delegate.delete({\n                            row: { id: request.row.id, path: request.row.path },\n                            hard: request.hard\n                        });\n                        ws.send(JSON.stringify({ type: \"DELETE_SUCCESS\",\npayload: { success: true },\nrequestId }));\n                        break;\n                    }\n                    case \"CHECK_UNIQUE_FIELD\": {\n                        const { path, name, value, id, collection } = payload;\n                        assertRegisteredPath(path);\n                        const delegate = await getScopedDelegate();\n                        const isUnique = await delegate.checkUniqueField(path, name, value, id, collection);\n                        ws.send(JSON.stringify({ type: \"CHECK_UNIQUE_FIELD_SUCCESS\",\npayload: { isUnique },\nrequestId }));\n                        break;\n                    }\n                    case \"COUNT\": {\n                        const request: FetchCollectionProps = payload;\n                        assertRegisteredPath(request.path);\n                        const delegate = await getScopedDelegate();\n                        const count = await delegate.count!(request);\n                        ws.send(JSON.stringify({ type: \"COUNT_SUCCESS\",\npayload: { count },\nrequestId }));\n                        break;\n                    }\n                    case \"EXECUTE_SQL\": {\n                        const { sql, options } = payload;\n                        if (admin && isDocumentAdmin(admin) && admin.executeAggregate) {\n                            const result = await admin.executeAggregate(sql as Record<string, unknown>[]);\n                            ws.send(JSON.stringify({ type: \"EXECUTE_SQL_SUCCESS\",\npayload: { result },\nrequestId }));\n                        } else {\n                            ws.send(JSON.stringify({ type: \"ERROR\",\nrequestId,\npayload: { error: { message: \"SQL execution not supported for this driver\",\ncode: \"NOT_SUPPORTED\" } } }));\n                        }\n                        break;\n                    }\n                    case \"FETCH_UNMAPPED_TABLES\": {\n                        if (admin && isSchemaAdmin(admin)) {\n                            const tables = await admin.fetchUnmappedTables?.(payload?.mappedPaths) || [];\n                            ws.send(JSON.stringify({ type: \"FETCH_UNMAPPED_TABLES_SUCCESS\",\npayload: { tables },\nrequestId }));\n                        } else {\n                            ws.send(JSON.stringify({ type: \"FETCH_UNMAPPED_TABLES_SUCCESS\",\npayload: { tables: [] },\nrequestId }));\n                        }\n                        break;\n                    }\n                    case \"FETCH_TABLE_METADATA\": {\n                        const { tableName } = payload;\n                        if (admin && isSchemaAdmin(admin)) {\n                            const metadata = await admin.fetchTableMetadata?.(tableName);\n                            ws.send(JSON.stringify({ type: \"FETCH_TABLE_METADATA_SUCCESS\",\npayload: { metadata },\nrequestId }));\n                        } else {\n                            ws.send(JSON.stringify({ type: \"FETCH_TABLE_METADATA_SUCCESS\",\npayload: { metadata: null },\nrequestId }));\n                        }\n                        break;\n                    }\n                    case \"subscribe_collection\":\n                    case \"subscribe_one\":\n                    case \"unsubscribe\": {\n                        // A subscription is a read that re-runs on every matching\n                        // write, so an unregistered path leaks exactly as\n                        // FETCH_COLLECTION does — and re-leaks. Refused here, with\n                        // the subscription id the client keys its errors on, since\n                        // `handleClientMessage`'s frames carry no `requestId`.\n                        if (type !== \"unsubscribe\" && !driver.registry?.getCollectionByPath(payload?.path)) {\n                            ws.send(JSON.stringify({\n                                type: \"ERROR\",\n                                requestId,\n                                subscriptionId: payload?.subscriptionId,\n                                payload: { error: {\n                                    message: `Unknown collection at path \"${payload?.path ?? \"\"}\": it is not a registered data collection.`,\n                                    code: \"NOT_FOUND\"\n                                } }\n                            }));\n                            return;\n                        }\n                        // The same principal the request frames use, guest flag\n                        // included: every re-fetch reads as it.\n                        const subscriber = sessionUser(clientSessions.get(clientId));\n                        await realtimeService.handleClientMessage(clientId, {\n                            type,\n                            payload,\n                            subscriptionId: payload?.subscriptionId\n                        }, {\n                            uid: subscriber.uid,\n                            roles: subscriber.roles ?? [],\n                            isAnonymous: subscriber.isAnonymous\n                        });\n                        break;\n                    }\n                    default:\n                        logger.error(\"❌ [WebSocket Server] Unknown message type\", { detail: type });\n                }\n            } catch (error: unknown) {\n                // A refused write keeps its message: it is the only thing that\n                // tells the caller what to send instead, and the generic branch\n                // below drops it in production. \"Refused\" is whatever REST\n                // answers with the error's own status — `ApiError`, and the\n                // `RebaseApiError` every collection-callback veto is — by the\n                // same predicate, so the two cannot list different classes.\n                const answer = declaredErrorAnswer(error);\n                if (answer) {\n                    ws.send(JSON.stringify({ type: \"ERROR\",\nrequestId,\npayload: { error: {\n    message: answer.message,\n    code: answer.code,\n    ...(answer.details !== undefined && { details: answer.details })\n} } }));\n                    return;\n                }\n                const errorMessage = process.env.NODE_ENV === \"production\" ? \"An unexpected error occurred\" : (error instanceof Error ? error.message : \"An unexpected error occurred\");\n                ws.send(JSON.stringify({ type: \"ERROR\",\nrequestId,\npayload: { error: { message: errorMessage,\ncode: \"INTERNAL_ERROR\" } } }));\n            }\n        });\n    });\n}\n"],"mappings":";;;;AAuCA,IAAM,gBAAgB;AACtB,IAAM,oBAAoB;AAE1B,IAAM,mCAAmB,IAAI,IAAI;CAC7B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACJ,CAAC;;;;;;;;;;AAWD,SAAS,YAAY,SAA0C;CAC3D,IAAI,CAAC,SAAS,MACV,OAAO;EACH,KAAK;EACL,aAAa;EACb,OAAO;EACP,UAAU;EACV,YAAY;EACZ,aAAa;EACb,OAAO,CAAC,MAAM;CAClB;CAEJ,OAAO;EACH,KAAK,QAAQ,KAAK;EAClB,OAAO,QAAQ,KAAK,SAAS;EAC7B,aAAa,QAAQ,KAAK,eAAe;EACzC,UAAU,QAAQ,KAAK,YAAY;EACnC,YAAY;EACZ,aAAa,QAAQ,KAAK;EAC1B,OAAO,QAAQ,KAAK,SAAS,CAAC;CAClC;AACJ;AAEA,SAAS,eAAe,SAA6C;CACjE,IAAI,CAAC,SAAS,MAAM,OAAO;CAG3B,IAAI,QAAQ,KAAK,SAAS,OAAO;CACjC,QAAQ,QAAQ,KAAK,SAAS,CAAC,EAAA,CAAG,MAAM,MAAM,MAAM,OAAO;AAC/D;AAEA,SAAgB,qBACZ,QACA,iBACA,QACA,YACA,OACA,aACF;CAIE,MAAM,iCAAiB,IAAI,IAA2B;CAEtD,MAAM,eAAA,QAAA,IAAA,aAAwC;CAC9C,MAAM,WAAW,GAAG,SAAoB;EAAE,IAAI,CAAC,cAAc,QAAQ,MAAM,GAAG,IAAI;CAAG;CACrF,MAAM,MAAM,IAAI,gBAAgB,EAAE,OAAO,CAAC;CAE1C,IAAI,GAAG,UAAU,QAA+B;EAC5C,IAAI,IAAI,SAAS,cAAc;EAC/B,OAAO,MAAM,8BAA8B,EAAE,OAAO,IAAI,CAAC;CAC7D,CAAC;CAMD,MAAM,cAAc,CAAC,CAAC,eAAe,mBAAmB,UAAU;CAElE,IAAI,eAAe,CAAC,eAAe,CAAC,YAAY,WAC5C,OAAO,KACH,sKAEJ;CAGJ,IAAI,GAAG,eAAe,OAAO;EACzB,MAAM,WAAW,UAAU,KAAK,IAAI,EAAE,GAAG,KAAK,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,UAAU,GAAG,CAAC;EAClF,QAAQ,+BAA+B,UAAU;EAEjD,eAAe,IAAI,UAAU;GAAE;GACvC,eAAe,CAAC;GAChB,cAAc;GACd,oBAAoB,KAAK,IAAI;EAAE,CAAC;EACxB,gBAAgB,UAAU,UAAU,EAAE;EAEtC,GAAG,GAAG,eAAe;GACjB,QAAQ,kCAAkC,UAAU;GACpD,eAAe,OAAO,QAAQ;EAClC,CAAC;EAED,GAAG,GAAG,WAAW,OAAO,YAAY;GAChC,IAAI;GACJ,IAAI;IACA,MAAM,EAAE,MAAM,SAAS,WAAW,UAAU,KAAK,MAAM,QAAQ,SAAS,CAAC;IACzE,YAAY;IAEZ,QAAQ,QAAQ,SAAS,KAAK,QAAQ,YAAY,IAAI,UAAU,KAAK,EAAE;IAEvE,MAAM,aAAa,SAAiC,MAAc,QAAgB;KAC9E,GAAG,KAAK,KAAK,UAAU;MAAE,MAAM;MACnD;MACA,SAAS,EAAE,OAAO;OAAE,SAAS;OAC7B;MAAK,EAAE;KAAE,CAAC,CAAC;IACK;IAEA,IAAI,SAAS,gBAAgB;KACzB,MAAM,EAAE,UAAU,WAAW,CAAC;KAC9B,IAAI,CAAC,OAAO;MACR,UAAU,cAAc,iBAAiB,mBAAmB;MAC5D;KACJ;KAIA,IAAI,eAAsC;KAE1C,IAAI,aACA,IAAI;MACA,MAAM,cAAc,YAAY,cAC1B,MAAM,YAAY,YAAY,KAAK,IACnC,MAAM,YAAY,cAAc,IAAI,QAAQ,6BAA6B,EACvE,SAAS,EAAE,eAAe,UAAU,QAAQ,EAChD,CAAC,CAAC;MACN,IAAI,aACA,eAAe;OACX,KAAK,YAAY;OACjB,OAAO,YAAY;OACnB,OAAO,YAAY,SAAS,CAAC;OAC7B,SAAS,CAAC,CAAC,YAAY;OAGvB,aAAa,YAAY,gBAAgB;MAC7C;KAER,QAAQ,CAER;UACG;MACH,MAAM,aAAa,MAAM,qBAAqB,KAAK;MACnD,IAAI,YACA,eAAe;OACX,KAAK,WAAW;OAChB,OAAO,WAAW;OAClB,aAAa,WAAW;OACxB,UAAU,WAAW;OACrB,OAAO,WAAW,SAAS,CAAC;OAC5B,UAAU,WAAW,SAAS,CAAC,EAAA,CAAG,MAAM,MAAc,MAAM,OAAO;OACnE,aAAa,WAAW,gBAAgB;MAC5C;KAER;KAEA,IAAI,cAAc;MACd,MAAM,UAAU,eAAe,IAAI,QAAQ;MAC3C,IAAI,SAAS;OACT,QAAQ,OAAO;OACf,QAAQ,gBAAgB;MAC5B;MACA,GAAG,KAAK,KAAK,UAAU;OAAE,MAAM;OACvD;OACA,SAAS;QAAE,KAAK,aAAa;QAC7B,OAAO,aAAa;OAAM;MAAE,CAAC,CAAC;KACV,OACI,UAAU,cAAc,iBAAiB,0BAA0B;KAEvE;IACJ;IAEA,IAAI;SAEI,CADY,eAAe,IAAI,QAC9B,CAAA,EAAS,eAAe;MACzB,UAAU,SAAS,gBAAgB,yBAAyB;MAC5D;KACJ;;IAGJ;KACI,MAAM,UAAU,eAAe,IAAI,QAAQ;KAC3C,IAAI,SAAS;MACT,MAAM,MAAM,KAAK,IAAI;MACrB,IAAI,MAAM,QAAQ,qBAAqB,mBAAmB;OACtD,QAAQ,eAAe;OACvB,QAAQ,qBAAqB;MACjC;MACA,QAAQ;MACR,IAAI,QAAQ,eAAe,eAAe;OACtC,UAAU,SAAS,gBAAgB,sCAAsC;OACzE;MACJ;KACJ;IACJ;IAEA,IAAI,iBAAiB,IAAI,IAAI;SAErB,CAAC,eADW,eAAe,IAAI,QACf,CAAO,GAAG;MAC1B,UAAU,SAAS,aAAa,0CAA0C;MAC1E;KACJ;;;;;;;;;;;;;;;;;;;;;;;;;;IA2BJ,MAAM,wBAAwB,SAAmC;KAC7D,IAAI,CAAC,QAAQ,CAAC,OAAO,UAAU,oBAAoB,IAAI,GACnD,MAAM,SAAS,SACX,+BAA+B,QAAQ,GAAG,2CAC9C;IAER;;IAGA,MAAM,sBAAsB,MAA0B,WAA0B;KAC5E,IAAI,CAAC,QAAQ,CAAC,UAAU,OAAO,WAAW,UAAU;KACpD,MAAM,aAAa,OAAO,UAAU,oBAAoB,IAAI;KAC5D,IAAI,CAAC,YAAY;KACjB,wBAAwB,QAAmC,UAAU;IACzE;IAKA,MAAM,0BACF,OAAO,SAAS,YAAY,eAAe,IAAI,QAAQ,CAAC,CAAC;IAE7D,QAAQ,MAAR;KACI,KAAK,oBAAoB;MACrB,MAAM,UAAgC;MACtC,qBAAqB,QAAQ,IAAI;MAEjC,MAAM,OAAO,OAAM,MADI,kBAAkB,EAAA,CACb,gBAAgB,OAAO;MACnD,GAAG,KAAK,KAAK,UAAU;OAAE,MAAM;OACvD,SAAS,EAAE,KAAK;OAChB;MAAU,CAAC,CAAC;MACY;KACJ;KACA,KAAK,aAAa;MACd,MAAM,UAAyB;MAC/B,qBAAqB,QAAQ,IAAI;MAEjC,MAAM,MAAM,OAAM,MADK,kBAAkB,EAAA,CACd,SAAS,OAAO;MAC3C,GAAG,KAAK,KAAK,UAAU;OAAE,MAAM;OACvD,SAAS,EAAE,IAAI;OACf;MAAU,CAAC,CAAC;MACY;KACJ;KACA,KAAK,QAAQ;MACT,MAAM,UAAqB;MAK3B,qBAAqB,QAAQ,IAAI;MACjC,mBAAmB,QAAQ,MAAM,QAAQ,MAAiC;MAE1E,MAAM,MAAM,OAAM,MADK,kBAAkB,EAAA,CACd,KAAK,OAAO;MACvC,GAAG,KAAK,KAAK,UAAU;OAAE,MAAM;OACvD,SAAS,EAAE,IAAI;OACf;MAAU,CAAC,CAAC;MACY;KACJ;KACA,KAAK,UAAU;MACX,MAAM,UAAuB;MAC7B,qBAAqB,QAAQ,KAAK,IAAI;MAKtC,OAAM,MAJiB,kBAAkB,EAAA,CAI1B,OAAO;OAClB,KAAK;QAAE,IAAI,QAAQ,IAAI;QAAI,MAAM,QAAQ,IAAI;OAAK;OAClD,MAAM,QAAQ;MAClB,CAAC;MACD,GAAG,KAAK,KAAK,UAAU;OAAE,MAAM;OACvD,SAAS,EAAE,SAAS,KAAK;OACzB;MAAU,CAAC,CAAC;MACY;KACJ;KACA,KAAK,sBAAsB;MACvB,MAAM,EAAE,MAAM,MAAM,OAAO,IAAI,eAAe;MAC9C,qBAAqB,IAAI;MAEzB,MAAM,WAAW,OAAM,MADA,kBAAkB,EAAA,CACT,iBAAiB,MAAM,MAAM,OAAO,IAAI,UAAU;MAClF,GAAG,KAAK,KAAK,UAAU;OAAE,MAAM;OACvD,SAAS,EAAE,SAAS;OACpB;MAAU,CAAC,CAAC;MACY;KACJ;KACA,KAAK,SAAS;MACV,MAAM,UAAgC;MACtC,qBAAqB,QAAQ,IAAI;MAEjC,MAAM,QAAQ,OAAM,MADG,kBAAkB,EAAA,CACZ,MAAO,OAAO;MAC3C,GAAG,KAAK,KAAK,UAAU;OAAE,MAAM;OACvD,SAAS,EAAE,MAAM;OACjB;MAAU,CAAC,CAAC;MACY;KACJ;KACA,KAAK,eAAe;MAChB,MAAM,EAAE,KAAK,YAAY;MACzB,IAAI,SAAS,gBAAgB,KAAK,KAAK,MAAM,kBAAkB;OAC3D,MAAM,SAAS,MAAM,MAAM,iBAAiB,GAAgC;OAC5E,GAAG,KAAK,KAAK,UAAU;QAAE,MAAM;QAC3D,SAAS,EAAE,OAAO;QAClB;OAAU,CAAC,CAAC;MACY,OACI,GAAG,KAAK,KAAK,UAAU;OAAE,MAAM;OAC3D;OACA,SAAS,EAAE,OAAO;QAAE,SAAS;QAC7B,MAAM;OAAgB,EAAE;MAAE,CAAC,CAAC;MAEJ;KACJ;KACA,KAAK;MACD,IAAI,SAAS,cAAc,KAAK,GAAG;OAC/B,MAAM,SAAS,MAAM,MAAM,sBAAsB,SAAS,WAAW,KAAK,CAAC;OAC3E,GAAG,KAAK,KAAK,UAAU;QAAE,MAAM;QAC3D,SAAS,EAAE,OAAO;QAClB;OAAU,CAAC,CAAC;MACY,OACI,GAAG,KAAK,KAAK,UAAU;OAAE,MAAM;OAC3D,SAAS,EAAE,QAAQ,CAAC,EAAE;OACtB;MAAU,CAAC,CAAC;MAEY;KAEJ,KAAK,wBAAwB;MACzB,MAAM,EAAE,cAAc;MACtB,IAAI,SAAS,cAAc,KAAK,GAAG;OAC/B,MAAM,WAAW,MAAM,MAAM,qBAAqB,SAAS;OAC3D,GAAG,KAAK,KAAK,UAAU;QAAE,MAAM;QAC3D,SAAS,EAAE,SAAS;QACpB;OAAU,CAAC,CAAC;MACY,OACI,GAAG,KAAK,KAAK,UAAU;OAAE,MAAM;OAC3D,SAAS,EAAE,UAAU,KAAK;OAC1B;MAAU,CAAC,CAAC;MAEY;KACJ;KACA,KAAK;KACL,KAAK;KACL,KAAK,eAAe;MAMhB,IAAI,SAAS,iBAAiB,CAAC,OAAO,UAAU,oBAAoB,SAAS,IAAI,GAAG;OAChF,GAAG,KAAK,KAAK,UAAU;QACnB,MAAM;QACN;QACA,gBAAgB,SAAS;QACzB,SAAS,EAAE,OAAO;SACd,SAAS,+BAA+B,SAAS,QAAQ,GAAG;SAC5D,MAAM;QACV,EAAE;OACN,CAAC,CAAC;OACF;MACJ;MAGA,MAAM,aAAa,YAAY,eAAe,IAAI,QAAQ,CAAC;MAC3D,MAAM,gBAAgB,oBAAoB,UAAU;OAChD;OACA;OACA,gBAAgB,SAAS;MAC7B,GAAG;OACC,KAAK,WAAW;OAChB,OAAO,WAAW,SAAS,CAAC;OAC5B,aAAa,WAAW;MAC5B,CAAC;MACD;KACJ;KACA,SACI,OAAO,MAAM,6CAA6C,EAAE,QAAQ,KAAK,CAAC;IAClF;GACJ,SAAS,OAAgB;IAOrB,MAAM,SAAS,oBAAoB,KAAK;IACxC,IAAI,QAAQ;KACR,GAAG,KAAK,KAAK,UAAU;MAAE,MAAM;MACnD;MACA,SAAS,EAAE,OAAO;OACd,SAAS,OAAO;OAChB,MAAM,OAAO;OACb,GAAI,OAAO,YAAY,KAAA,KAAa,EAAE,SAAS,OAAO,QAAQ;MAClE,EAAE;KAAE,CAAC,CAAC;KACc;IACJ;IACA,MAAM,eAAA,QAAA,IAAA,aAAwC,eAAe,iCAAkC,iBAAiB,QAAQ,MAAM,UAAU;IACxI,GAAG,KAAK,KAAK,UAAU;KAAE,MAAM;KAC/C;KACA,SAAS,EAAE,OAAO;MAAE,SAAS;MAC7B,MAAM;KAAiB,EAAE;IAAE,CAAC,CAAC;GACjB;EACJ,CAAC;CACL,CAAC;AACL"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rebasepro/server-mongo",
-  "version": "0.21.0",
+  "version": "0.21.1",
   "description": "MongoDB backend for Rebase",
   "keywords": [
     "rebase",
@@ -44,9 +44,9 @@
   "dependencies": {
     "mongodb": "^7.5.0",
     "ws": "^8.21.1",
-    "@rebasepro/types": "0.21.0",
-    "@rebasepro/utils": "0.21.0",
-    "@rebasepro/common": "0.21.0"
+    "@rebasepro/common": "0.21.1",
+    "@rebasepro/types": "0.21.1",
+    "@rebasepro/utils": "0.21.1"
   },
   "devDependencies": {
     "@types/jest": "^30.0.0",
@@ -59,7 +59,7 @@
     "vite": "^8.1.5"
   },
   "peerDependencies": {
-    "@rebasepro/server": "0.21.0"
+    "@rebasepro/server": "0.21.1"
   },
   "peerDependenciesMeta": {
     "@rebasepro/server": {

package/dist/websocket-B3LiQfFN.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"websocket-B3LiQfFN.js","names":[],"sources":["../src/websocket.ts"],"sourcesContent":["import { RealtimeProvider, DataDriver, FetchCollectionProps, FetchOneProps, SaveProps, DeleteProps, TableMetadata, DatabaseAdmin, isSchemaAdmin, isDocumentAdmin, User, AuthAdapter } from \"@rebasepro/types\";\nimport { WebSocketServer, WebSocket } from \"ws\";\nimport { Server } from \"http\";\nimport { inspect } from \"util\";\nimport { extractUserFromToken, resolveRequireAuth, assertWriteRequestValid, ApiError } from \"@rebasepro/server\";\nimport type { RebaseAuthConfig } from \"@rebasepro/server\";\nimport { MongoRealtimeService } from \"./services/MongoRealtimeService\";\nimport { MongoDriver } from \"./services/MongoDriver\";\nimport { logger } from \"@rebasepro/server\";\n\ninterface DriverWithAuth extends DataDriver {\n    withAuth(user: Record<string, unknown>): Promise<DataDriver>;\n}\n\nfunction isDriverWithAuth(driver: DataDriver): driver is DriverWithAuth {\n    return \"withAuth\" in driver && typeof (driver as Record<string, unknown>).withAuth === \"function\";\n}\n\n/**\n * Normalized user identity for WebSocket sessions — the same shape the Postgres\n * socket keeps, because an `AuthAdapter` user is not an access-token payload.\n */\ninterface WsUserIdentity {\n    uid: string;\n    email?: string;\n    displayName?: string;\n    photoURL?: string;\n    roles: string[];\n    isAdmin: boolean;\n}\n\ninterface ClientSession {\n    ws: WebSocket;\n    user?: WsUserIdentity;\n    authenticated: boolean;\n    messageCount: number;\n    messageWindowStart: number;\n}\n\nconst WS_RATE_LIMIT = 2000;\nconst WS_RATE_WINDOW_MS = 60_000;\n\nconst ADMIN_ONLY_TYPES = new Set([\n    \"EXECUTE_SQL\",\n    \"FETCH_DATABASES\",\n    \"FETCH_ROLES\",\n    \"FETCH_UNMAPPED_TABLES\",\n    \"FETCH_TABLE_METADATA\",\n    \"FETCH_CURRENT_DATABASE\",\n    \"CREATE_BRANCH\",\n    \"DELETE_BRANCH\",\n    \"LIST_BRANCHES\"\n]);\n\nfunction isAdminSession(session: ClientSession | undefined): boolean {\n    if (!session?.user) return false;\n    // The adapter's own answer first; a role *named* `admin` is only the\n    // fallback for the built-in JWT path.\n    if (session.user.isAdmin) return true;\n    return (session.user.roles ?? []).some((r) => r === \"admin\");\n}\n\nexport function createMongoWebSocket(\n    server: Server,\n    realtimeService: MongoRealtimeService,\n    driver: MongoDriver,\n    authConfig?: RebaseAuthConfig,\n    admin?: DatabaseAdmin,\n    authAdapter?: AuthAdapter\n) {\n    // Scoped to this factory invocation rather than the module, so sessions do\n    // not leak across hot reloads or a second server on the same process — the\n    // Postgres socket keeps it here for the same reason.\n    const clientSessions = new Map<string, ClientSession>();\n\n    const isProduction = process.env.NODE_ENV === \"production\";\n    const wsDebug = (...args: unknown[]) => { if (!isProduction) console.debug(...args); };\n    const wss = new WebSocketServer({ server });\n\n    wss.on(\"error\", (err: NodeJS.ErrnoException) => {\n        if (err.code === \"EADDRINUSE\") return;\n        logger.error(\"❌ [WebSocket Server] Error\", { error: err });\n    });\n\n    // The same predicate the HTTP data routes use, from the same function. See\n    // `resolveRequireAuth` for what this socket's local copy got wrong — most\n    // importantly that a `false` here does not skip a check, it marks every\n    // session `authenticated` at connect time.\n    const requireAuth = !!authAdapter || resolveRequireAuth(authConfig);\n\n    if (requireAuth && !authAdapter && !authConfig?.jwtSecret) {\n        logger.warn(\n            \"🔐 [WebSocket Server] Authentication is required but no adapter or jwtSecret is \" +\n            \"configured — no client can complete AUTH, so every realtime message will be refused.\"\n        );\n    }\n\n    wss.on(\"connection\", (ws) => {\n        const clientId = `client_${Date.now()}_${Math.random().toString(36).substring(2, 9)}`;\n        wsDebug(`WebSocket client connected: ${clientId}`);\n\n        clientSessions.set(clientId, { ws,\nauthenticated: !requireAuth,\nmessageCount: 0,\nmessageWindowStart: Date.now() });\n        realtimeService.addClient(clientId, ws);\n\n        ws.on(\"close\", () => {\n            wsDebug(`WebSocket client disconnected: ${clientId}`);\n            clientSessions.delete(clientId);\n        });\n\n        ws.on(\"message\", async (message) => {\n            let requestId: string | undefined;\n            try {\n                const { type, payload, requestId: reqId } = JSON.parse(message.toString());\n                requestId = reqId;\n\n                wsDebug(`[WS] ${clientId} → ${type}`, requestId ? `(${requestId})` : \"\");\n\n                const sendError = (errType: \"ERROR\" | \"AUTH_ERROR\", code: string, msg: string) => {\n                    ws.send(JSON.stringify({ type: errType,\nrequestId,\npayload: { error: { message: msg,\ncode } } }));\n                };\n\n                if (type === \"AUTHENTICATE\") {\n                    const { token } = payload || {};\n                    if (!token) {\n                        sendError(\"AUTH_ERROR\", \"INVALID_INPUT\", \"Token is required\");\n                        return;\n                    }\n\n                    // The adapter verifies when one is configured, exactly as the\n                    // HTTP routes do; the built-in JWT path is the fallback.\n                    let verifiedUser: WsUserIdentity | null = null;\n\n                    if (authAdapter) {\n                        try {\n                            const adapterUser = authAdapter.verifyToken\n                                ? await authAdapter.verifyToken(token)\n                                : await authAdapter.verifyRequest(new Request(\"http://localhost/_ws_auth\", {\n                                    headers: { Authorization: `Bearer ${token}` }\n                                }));\n                            if (adapterUser) {\n                                verifiedUser = {\n                                    uid: adapterUser.uid,\n                                    email: adapterUser.email,\n                                    roles: adapterUser.roles ?? [],\n                                    isAdmin: !!adapterUser.isAdmin\n                                };\n                            }\n                        } catch {\n                            // Adapter threw — treat as invalid token\n                        }\n                    } else {\n                        const jwtPayload = await extractUserFromToken(token);\n                        if (jwtPayload) {\n                            verifiedUser = {\n                                uid: jwtPayload.uid,\n                                email: jwtPayload.email,\n                                displayName: jwtPayload.displayName,\n                                photoURL: jwtPayload.photoURL,\n                                roles: jwtPayload.roles ?? [],\n                                isAdmin: (jwtPayload.roles ?? []).some((r: string) => r === \"admin\")\n                            };\n                        }\n                    }\n\n                    if (verifiedUser) {\n                        const session = clientSessions.get(clientId);\n                        if (session) {\n                            session.user = verifiedUser;\n                            session.authenticated = true;\n                        }\n                        ws.send(JSON.stringify({ type: \"AUTH_SUCCESS\",\nrequestId,\npayload: { uid: verifiedUser.uid,\nroles: verifiedUser.roles } }));\n                    } else {\n                        sendError(\"AUTH_ERROR\", \"INVALID_TOKEN\", \"Invalid or expired token\");\n                    }\n                    return;\n                }\n\n                if (requireAuth) {\n                    const session = clientSessions.get(clientId);\n                    if (!session?.authenticated) {\n                        sendError(\"ERROR\", \"UNAUTHORIZED\", \"Authentication required\");\n                        return;\n                    }\n                }\n\n                {\n                    const session = clientSessions.get(clientId);\n                    if (session) {\n                        const now = Date.now();\n                        if (now - session.messageWindowStart > WS_RATE_WINDOW_MS) {\n                            session.messageCount = 0;\n                            session.messageWindowStart = now;\n                        }\n                        session.messageCount++;\n                        if (session.messageCount > WS_RATE_LIMIT) {\n                            sendError(\"ERROR\", \"RATE_LIMITED\", \"Too many requests. Please slow down.\");\n                            return;\n                        }\n                    }\n                }\n\n                if (ADMIN_ONLY_TYPES.has(type)) {\n                    const session = clientSessions.get(clientId);\n                    if (!isAdminSession(session)) {\n                        sendError(\"ERROR\", \"FORBIDDEN\", \"Admin access required for this operation\");\n                        return;\n                    }\n                }\n\n                /** @see the Postgres socket — same rule, same reason. */\n                const assertWriteRequest = (path: string | undefined, values: unknown): void => {\n                    if (!path || !values || typeof values !== \"object\") return;\n                    const collection = driver.registry?.getCollectionByPath(path);\n                    if (!collection) return;\n                    assertWriteRequestValid(values as Record<string, unknown>, collection);\n                };\n\n                const getScopedDelegate = async (): Promise<DataDriver> => {\n                    const session = clientSessions.get(clientId);\n                    if (session?.user && isDriverWithAuth(driver)) {\n                        try {\n                            const userForAuth: User = {\n                                uid: session.user.uid,\n                                email: session.user.email ?? \"\",\n                                displayName: session.user.displayName ?? \"\",\n                                photoURL: session.user.photoURL ?? \"\",\n                                providerId: \"jwt\",\n                                isAnonymous: false,\n                                roles: session.user.roles ?? []\n                            };\n                            return await driver.withAuth(userForAuth);\n                        } catch (e) {\n                            logger.error(\"Failed to create authenticated delegate for WS request\", { error: e });\n                            return driver;\n                        }\n                    }\n                    return driver;\n                };\n\n                switch (type) {\n                    case \"FETCH_COLLECTION\": {\n                        const request: FetchCollectionProps = payload;\n                        const delegate = await getScopedDelegate();\n                        const rows = await delegate.fetchCollection(request);\n                        ws.send(JSON.stringify({ type: \"FETCH_COLLECTION_SUCCESS\",\npayload: { rows },\nrequestId }));\n                        break;\n                    }\n                    case \"FETCH_ONE\": {\n                        const request: FetchOneProps = payload;\n                        const delegate = await getScopedDelegate();\n                        const row = await delegate.fetchOne(request);\n                        ws.send(JSON.stringify({ type: \"FETCH_ONE_SUCCESS\",\npayload: { row },\nrequestId }));\n                        break;\n                    }\n                    case \"SAVE\": {\n                        const request: SaveProps = payload;\n                        // The REST layer's write checks, at this boundary too —\n                        // the socket is a second way in, and it used to be the\n                        // unchecked one. Collection from the registry by path,\n                        // never from the client's `request.collection`.\n                        assertWriteRequest(request.path, request.values as Record<string, unknown>);\n                        const delegate = await getScopedDelegate();\n                        const row = await delegate.save(request);\n                        ws.send(JSON.stringify({ type: \"SAVE_SUCCESS\",\npayload: { row },\nrequestId }));\n                        break;\n                    }\n                    case \"DELETE\": {\n                        const request: DeleteProps = payload;\n                        const delegate = await getScopedDelegate();\n                        await delegate.delete(request);\n                        ws.send(JSON.stringify({ type: \"DELETE_SUCCESS\",\npayload: { success: true },\nrequestId }));\n                        break;\n                    }\n                    case \"CHECK_UNIQUE_FIELD\": {\n                        const { path, name, value, id, collection } = payload;\n                        const delegate = await getScopedDelegate();\n                        const isUnique = await delegate.checkUniqueField(path, name, value, id, collection);\n                        ws.send(JSON.stringify({ type: \"CHECK_UNIQUE_FIELD_SUCCESS\",\npayload: { isUnique },\nrequestId }));\n                        break;\n                    }\n                    case \"COUNT\": {\n                        const request: FetchCollectionProps = payload;\n                        const delegate = await getScopedDelegate();\n                        const count = await delegate.count!(request);\n                        ws.send(JSON.stringify({ type: \"COUNT_SUCCESS\",\npayload: { count },\nrequestId }));\n                        break;\n                    }\n                    case \"EXECUTE_SQL\": {\n                        const { sql, options } = payload;\n                        if (admin && isDocumentAdmin(admin) && admin.executeAggregate) {\n                            const result = await admin.executeAggregate(sql as Record<string, unknown>[]);\n                            ws.send(JSON.stringify({ type: \"EXECUTE_SQL_SUCCESS\",\npayload: { result },\nrequestId }));\n                        } else {\n                            ws.send(JSON.stringify({ type: \"ERROR\",\nrequestId,\npayload: { error: { message: \"SQL execution not supported for this driver\",\ncode: \"NOT_SUPPORTED\" } } }));\n                        }\n                        break;\n                    }\n                    case \"FETCH_UNMAPPED_TABLES\": {\n                        if (admin && isSchemaAdmin(admin)) {\n                            const tables = await admin.fetchUnmappedTables?.(payload?.mappedPaths) || [];\n                            ws.send(JSON.stringify({ type: \"FETCH_UNMAPPED_TABLES_SUCCESS\",\npayload: { tables },\nrequestId }));\n                        } else {\n                            ws.send(JSON.stringify({ type: \"FETCH_UNMAPPED_TABLES_SUCCESS\",\npayload: { tables: [] },\nrequestId }));\n                        }\n                        break;\n                    }\n                    case \"FETCH_TABLE_METADATA\": {\n                        const { tableName } = payload;\n                        if (admin && isSchemaAdmin(admin)) {\n                            const metadata = await admin.fetchTableMetadata?.(tableName);\n                            ws.send(JSON.stringify({ type: \"FETCH_TABLE_METADATA_SUCCESS\",\npayload: { metadata },\nrequestId }));\n                        } else {\n                            ws.send(JSON.stringify({ type: \"FETCH_TABLE_METADATA_SUCCESS\",\npayload: { metadata: null },\nrequestId }));\n                        }\n                        break;\n                    }\n                    case \"subscribe_collection\":\n                    case \"subscribe_one\":\n                    case \"unsubscribe\": {\n                        const session = clientSessions.get(clientId);\n                        const authContext = session?.user ? { uid: session.user.uid,\nroles: session.user.roles ?? [] } : undefined;\n                        await realtimeService.handleClientMessage(clientId, {\n                            type,\n                            payload,\n                            subscriptionId: payload?.subscriptionId\n                        }, authContext);\n                        break;\n                    }\n                    default:\n                        logger.error(\"❌ [WebSocket Server] Unknown message type\", { detail: type });\n                }\n            } catch (error: unknown) {\n                // A refused write keeps its message: it is the only thing that\n                // tells the caller what to send instead, and the generic branch\n                // below drops it in production.\n                if (error instanceof ApiError || (error as Error)?.name === \"ApiError\") {\n                    const apiError = error as ApiError;\n                    ws.send(JSON.stringify({ type: \"ERROR\",\nrequestId,\npayload: { error: { message: apiError.message,\ncode: apiError.code } } }));\n                    return;\n                }\n                const errorMessage = process.env.NODE_ENV === \"production\" ? \"An unexpected error occurred\" : (error instanceof Error ? error.message : \"An unexpected error occurred\");\n                ws.send(JSON.stringify({ type: \"ERROR\",\nrequestId,\npayload: { error: { message: errorMessage,\ncode: \"INTERNAL_ERROR\" } } }));\n            }\n        });\n    });\n}\n"],"mappings":";;;;AAcA,SAAS,iBAAiB,QAA8C;CACpE,OAAO,cAAc,UAAU,OAAQ,OAAmC,aAAa;AAC3F;AAuBA,IAAM,gBAAgB;AACtB,IAAM,oBAAoB;AAE1B,IAAM,mCAAmB,IAAI,IAAI;CAC7B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACJ,CAAC;AAED,SAAS,eAAe,SAA6C;CACjE,IAAI,CAAC,SAAS,MAAM,OAAO;CAG3B,IAAI,QAAQ,KAAK,SAAS,OAAO;CACjC,QAAQ,QAAQ,KAAK,SAAS,CAAC,EAAA,CAAG,MAAM,MAAM,MAAM,OAAO;AAC/D;AAEA,SAAgB,qBACZ,QACA,iBACA,QACA,YACA,OACA,aACF;CAIE,MAAM,iCAAiB,IAAI,IAA2B;CAEtD,MAAM,eAAA,QAAA,IAAA,aAAwC;CAC9C,MAAM,WAAW,GAAG,SAAoB;EAAE,IAAI,CAAC,cAAc,QAAQ,MAAM,GAAG,IAAI;CAAG;CACrF,MAAM,MAAM,IAAI,gBAAgB,EAAE,OAAO,CAAC;CAE1C,IAAI,GAAG,UAAU,QAA+B;EAC5C,IAAI,IAAI,SAAS,cAAc;EAC/B,OAAO,MAAM,8BAA8B,EAAE,OAAO,IAAI,CAAC;CAC7D,CAAC;CAMD,MAAM,cAAc,CAAC,CAAC,eAAe,mBAAmB,UAAU;CAElE,IAAI,eAAe,CAAC,eAAe,CAAC,YAAY,WAC5C,OAAO,KACH,sKAEJ;CAGJ,IAAI,GAAG,eAAe,OAAO;EACzB,MAAM,WAAW,UAAU,KAAK,IAAI,EAAE,GAAG,KAAK,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,UAAU,GAAG,CAAC;EAClF,QAAQ,+BAA+B,UAAU;EAEjD,eAAe,IAAI,UAAU;GAAE;GACvC,eAAe,CAAC;GAChB,cAAc;GACd,oBAAoB,KAAK,IAAI;EAAE,CAAC;EACxB,gBAAgB,UAAU,UAAU,EAAE;EAEtC,GAAG,GAAG,eAAe;GACjB,QAAQ,kCAAkC,UAAU;GACpD,eAAe,OAAO,QAAQ;EAClC,CAAC;EAED,GAAG,GAAG,WAAW,OAAO,YAAY;GAChC,IAAI;GACJ,IAAI;IACA,MAAM,EAAE,MAAM,SAAS,WAAW,UAAU,KAAK,MAAM,QAAQ,SAAS,CAAC;IACzE,YAAY;IAEZ,QAAQ,QAAQ,SAAS,KAAK,QAAQ,YAAY,IAAI,UAAU,KAAK,EAAE;IAEvE,MAAM,aAAa,SAAiC,MAAc,QAAgB;KAC9E,GAAG,KAAK,KAAK,UAAU;MAAE,MAAM;MACnD;MACA,SAAS,EAAE,OAAO;OAAE,SAAS;OAC7B;MAAK,EAAE;KAAE,CAAC,CAAC;IACK;IAEA,IAAI,SAAS,gBAAgB;KACzB,MAAM,EAAE,UAAU,WAAW,CAAC;KAC9B,IAAI,CAAC,OAAO;MACR,UAAU,cAAc,iBAAiB,mBAAmB;MAC5D;KACJ;KAIA,IAAI,eAAsC;KAE1C,IAAI,aACA,IAAI;MACA,MAAM,cAAc,YAAY,cAC1B,MAAM,YAAY,YAAY,KAAK,IACnC,MAAM,YAAY,cAAc,IAAI,QAAQ,6BAA6B,EACvE,SAAS,EAAE,eAAe,UAAU,QAAQ,EAChD,CAAC,CAAC;MACN,IAAI,aACA,eAAe;OACX,KAAK,YAAY;OACjB,OAAO,YAAY;OACnB,OAAO,YAAY,SAAS,CAAC;OAC7B,SAAS,CAAC,CAAC,YAAY;MAC3B;KAER,QAAQ,CAER;UACG;MACH,MAAM,aAAa,MAAM,qBAAqB,KAAK;MACnD,IAAI,YACA,eAAe;OACX,KAAK,WAAW;OAChB,OAAO,WAAW;OAClB,aAAa,WAAW;OACxB,UAAU,WAAW;OACrB,OAAO,WAAW,SAAS,CAAC;OAC5B,UAAU,WAAW,SAAS,CAAC,EAAA,CAAG,MAAM,MAAc,MAAM,OAAO;MACvE;KAER;KAEA,IAAI,cAAc;MACd,MAAM,UAAU,eAAe,IAAI,QAAQ;MAC3C,IAAI,SAAS;OACT,QAAQ,OAAO;OACf,QAAQ,gBAAgB;MAC5B;MACA,GAAG,KAAK,KAAK,UAAU;OAAE,MAAM;OACvD;OACA,SAAS;QAAE,KAAK,aAAa;QAC7B,OAAO,aAAa;OAAM;MAAE,CAAC,CAAC;KACV,OACI,UAAU,cAAc,iBAAiB,0BAA0B;KAEvE;IACJ;IAEA,IAAI;SAEI,CADY,eAAe,IAAI,QAC9B,CAAA,EAAS,eAAe;MACzB,UAAU,SAAS,gBAAgB,yBAAyB;MAC5D;KACJ;;IAGJ;KACI,MAAM,UAAU,eAAe,IAAI,QAAQ;KAC3C,IAAI,SAAS;MACT,MAAM,MAAM,KAAK,IAAI;MACrB,IAAI,MAAM,QAAQ,qBAAqB,mBAAmB;OACtD,QAAQ,eAAe;OACvB,QAAQ,qBAAqB;MACjC;MACA,QAAQ;MACR,IAAI,QAAQ,eAAe,eAAe;OACtC,UAAU,SAAS,gBAAgB,sCAAsC;OACzE;MACJ;KACJ;IACJ;IAEA,IAAI,iBAAiB,IAAI,IAAI;SAErB,CAAC,eADW,eAAe,IAAI,QACf,CAAO,GAAG;MAC1B,UAAU,SAAS,aAAa,0CAA0C;MAC1E;KACJ;;;IAIJ,MAAM,sBAAsB,MAA0B,WAA0B;KAC5E,IAAI,CAAC,QAAQ,CAAC,UAAU,OAAO,WAAW,UAAU;KACpD,MAAM,aAAa,OAAO,UAAU,oBAAoB,IAAI;KAC5D,IAAI,CAAC,YAAY;KACjB,wBAAwB,QAAmC,UAAU;IACzE;IAEA,MAAM,oBAAoB,YAAiC;KACvD,MAAM,UAAU,eAAe,IAAI,QAAQ;KAC3C,IAAI,SAAS,QAAQ,iBAAiB,MAAM,GACxC,IAAI;MACA,MAAM,cAAoB;OACtB,KAAK,QAAQ,KAAK;OAClB,OAAO,QAAQ,KAAK,SAAS;OAC7B,aAAa,QAAQ,KAAK,eAAe;OACzC,UAAU,QAAQ,KAAK,YAAY;OACnC,YAAY;OACZ,aAAa;OACb,OAAO,QAAQ,KAAK,SAAS,CAAC;MAClC;MACA,OAAO,MAAM,OAAO,SAAS,WAAW;KAC5C,SAAS,GAAG;MACR,OAAO,MAAM,0DAA0D,EAAE,OAAO,EAAE,CAAC;MACnF,OAAO;KACX;KAEJ,OAAO;IACX;IAEA,QAAQ,MAAR;KACI,KAAK,oBAAoB;MACrB,MAAM,UAAgC;MAEtC,MAAM,OAAO,OAAM,MADI,kBAAkB,EAAA,CACb,gBAAgB,OAAO;MACnD,GAAG,KAAK,KAAK,UAAU;OAAE,MAAM;OACvD,SAAS,EAAE,KAAK;OAChB;MAAU,CAAC,CAAC;MACY;KACJ;KACA,KAAK,aAAa;MACd,MAAM,UAAyB;MAE/B,MAAM,MAAM,OAAM,MADK,kBAAkB,EAAA,CACd,SAAS,OAAO;MAC3C,GAAG,KAAK,KAAK,UAAU;OAAE,MAAM;OACvD,SAAS,EAAE,IAAI;OACf;MAAU,CAAC,CAAC;MACY;KACJ;KACA,KAAK,QAAQ;MACT,MAAM,UAAqB;MAK3B,mBAAmB,QAAQ,MAAM,QAAQ,MAAiC;MAE1E,MAAM,MAAM,OAAM,MADK,kBAAkB,EAAA,CACd,KAAK,OAAO;MACvC,GAAG,KAAK,KAAK,UAAU;OAAE,MAAM;OACvD,SAAS,EAAE,IAAI;OACf;MAAU,CAAC,CAAC;MACY;KACJ;KACA,KAAK,UAAU;MACX,MAAM,UAAuB;MAE7B,OAAM,MADiB,kBAAkB,EAAA,CAC1B,OAAO,OAAO;MAC7B,GAAG,KAAK,KAAK,UAAU;OAAE,MAAM;OACvD,SAAS,EAAE,SAAS,KAAK;OACzB;MAAU,CAAC,CAAC;MACY;KACJ;KACA,KAAK,sBAAsB;MACvB,MAAM,EAAE,MAAM,MAAM,OAAO,IAAI,eAAe;MAE9C,MAAM,WAAW,OAAM,MADA,kBAAkB,EAAA,CACT,iBAAiB,MAAM,MAAM,OAAO,IAAI,UAAU;MAClF,GAAG,KAAK,KAAK,UAAU;OAAE,MAAM;OACvD,SAAS,EAAE,SAAS;OACpB;MAAU,CAAC,CAAC;MACY;KACJ;KACA,KAAK,SAAS;MACV,MAAM,UAAgC;MAEtC,MAAM,QAAQ,OAAM,MADG,kBAAkB,EAAA,CACZ,MAAO,OAAO;MAC3C,GAAG,KAAK,KAAK,UAAU;OAAE,MAAM;OACvD,SAAS,EAAE,MAAM;OACjB;MAAU,CAAC,CAAC;MACY;KACJ;KACA,KAAK,eAAe;MAChB,MAAM,EAAE,KAAK,YAAY;MACzB,IAAI,SAAS,gBAAgB,KAAK,KAAK,MAAM,kBAAkB;OAC3D,MAAM,SAAS,MAAM,MAAM,iBAAiB,GAAgC;OAC5E,GAAG,KAAK,KAAK,UAAU;QAAE,MAAM;QAC3D,SAAS,EAAE,OAAO;QAClB;OAAU,CAAC,CAAC;MACY,OACI,GAAG,KAAK,KAAK,UAAU;OAAE,MAAM;OAC3D;OACA,SAAS,EAAE,OAAO;QAAE,SAAS;QAC7B,MAAM;OAAgB,EAAE;MAAE,CAAC,CAAC;MAEJ;KACJ;KACA,KAAK;MACD,IAAI,SAAS,cAAc,KAAK,GAAG;OAC/B,MAAM,SAAS,MAAM,MAAM,sBAAsB,SAAS,WAAW,KAAK,CAAC;OAC3E,GAAG,KAAK,KAAK,UAAU;QAAE,MAAM;QAC3D,SAAS,EAAE,OAAO;QAClB;OAAU,CAAC,CAAC;MACY,OACI,GAAG,KAAK,KAAK,UAAU;OAAE,MAAM;OAC3D,SAAS,EAAE,QAAQ,CAAC,EAAE;OACtB;MAAU,CAAC,CAAC;MAEY;KAEJ,KAAK,wBAAwB;MACzB,MAAM,EAAE,cAAc;MACtB,IAAI,SAAS,cAAc,KAAK,GAAG;OAC/B,MAAM,WAAW,MAAM,MAAM,qBAAqB,SAAS;OAC3D,GAAG,KAAK,KAAK,UAAU;QAAE,MAAM;QAC3D,SAAS,EAAE,SAAS;QACpB;OAAU,CAAC,CAAC;MACY,OACI,GAAG,KAAK,KAAK,UAAU;OAAE,MAAM;OAC3D,SAAS,EAAE,UAAU,KAAK;OAC1B;MAAU,CAAC,CAAC;MAEY;KACJ;KACA,KAAK;KACL,KAAK;KACL,KAAK,eAAe;MAChB,MAAM,UAAU,eAAe,IAAI,QAAQ;MAC3C,MAAM,cAAc,SAAS,OAAO;OAAE,KAAK,QAAQ,KAAK;OAChF,OAAO,QAAQ,KAAK,SAAS,CAAC;MAAE,IAAI,KAAA;MACZ,MAAM,gBAAgB,oBAAoB,UAAU;OAChD;OACA;OACA,gBAAgB,SAAS;MAC7B,GAAG,WAAW;MACd;KACJ;KACA,SACI,OAAO,MAAM,6CAA6C,EAAE,QAAQ,KAAK,CAAC;IAClF;GACJ,SAAS,OAAgB;IAIrB,IAAI,iBAAiB,YAAa,OAAiB,SAAS,YAAY;KACpE,MAAM,WAAW;KACjB,GAAG,KAAK,KAAK,UAAU;MAAE,MAAM;MACnD;MACA,SAAS,EAAE,OAAO;OAAE,SAAS,SAAS;OACtC,MAAM,SAAS;MAAK,EAAE;KAAE,CAAC,CAAC;KACN;IACJ;IACA,MAAM,eAAA,QAAA,IAAA,aAAwC,eAAe,iCAAkC,iBAAiB,QAAQ,MAAM,UAAU;IACxI,GAAG,KAAK,KAAK,UAAU;KAAE,MAAM;KAC/C;KACA,SAAS,EAAE,OAAO;MAAE,SAAS;MAC7B,MAAM;KAAiB,EAAE;IAAE,CAAC,CAAC;GACjB;EACJ,CAAC;CACL,CAAC;AACL"}