@rebasepro/server 0.16.0 → 0.16.1-canary.g0d7af95

package/dist/{logger-DfvF_8r-.js → logger-DS03e908.js}

@@ -1,7 +1,101 @@
-import { createRequire as __createRequire } from "module";
-import process from "process";
-__createRequire(import.meta.url);
+import { createRequire as __rebaseCreateRequire } from "module";
+import __rebaseProcess from "process";
+globalThis.process ??= __rebaseProcess;
+__rebaseCreateRequire(import.meta.url);
+//#region src/utils/host.ts
+/**
+* The host globals this package reads, behind functions that do not assume Node.
+*
+* `process` is not defined on workerd, on Deno Deploy without the compat flag,
+* or in a browser. That matters here for one specific reason: the portable
+* authoring surface (`@rebasepro/server/functions`) reaches the logger and the
+* error handler, and a bare `process.env.NODE_ENV` inside either of them turns
+* the first log line of a request into a `ReferenceError` on a runtime that has
+* no `process` — a failure that reads as "the framework crashed" rather than
+* "this runtime has no process object".
+*
+* Nothing here throws and nothing here is async. A runtime that cannot answer
+* gets the empty answer, because every caller in this file's blast radius is
+* choosing a log level or a format, and the safe default for both is the
+* development one.
+*
+* @module
+*/
+/**
+* Where an adapter with no `process` can publish the environment.
+*
+* Cloudflare Workers hand the environment to the *request*, not to the module,
+* so there is no global to read at import time. An edge adapter that has
+* already seen a request can stash the bag here and every contextless reader in
+* the framework — the logger, chiefly — starts answering correctly.
+*
+* `Symbol.for` rather than a module-local for the same reason the singleton
+* uses it: more than one copy of this module can be loaded into one process,
+* and a module-local would leave every copy but the writer's blind. See
+* `../singleton.ts`.
+*
+* Request-scoped code should NOT read this. Use `getEnv(c)` from
+* `@rebasepro/server/functions`, which reads the binding attached to the
+* request it is serving — the only correct source on a runtime where two
+* concurrent requests can carry different bindings.
+*/
+var ENV_SLOT = Symbol.for("@rebasepro/server:host-env");
+/**
+* The process environment, or the closest thing this runtime has to one.
+*
+* Order: a bag published by {@link setHostEnv} first, because an adapter that
+* set one knows more than the ambient globals do; then `process.env`; then
+* nothing.
+*/
+function hostEnv() {
+	const global = globalThis;
+	return global[ENV_SLOT] ?? global.process?.env ?? {};
+}
+/**
+* Write one already-formatted line to the process's output.
+*
+* `process.stdout.write` is preferred where it exists because it is the only
+* one of the two that does not append its own formatting to a line that is
+* already a complete JSON document — `console.log` on Node is
+* `process.stdout.write` plus `util.format`, and `util.format` will happily
+* reinterpret a `%s` that appeared inside a user's log message.
+*
+* Where it does not exist, `console` is the runtime's log sink and is what its
+* platform collects.
+*/
+function writeLine(stream, line) {
+	const proc = globalThis.process;
+	const sink = stream === "err" ? proc?.stderr : proc?.stdout;
+	if (typeof sink?.write === "function") {
+		sink.write(line + "\n");
+		return;
+	}
+	if (stream === "err") console.error(line);
+	else console.log(line);
+}
+//#endregion
 //#region src/utils/logger.ts
+/**
+* Structured Logger for Rebase Backend
+*
+* Outputs JSON lines when `NODE_ENV=production`, human-readable prefixed
+* lines otherwise.  Designed to work with Google Cloud Logging severity levels.
+*
+* Every line — message and data, at any depth — passes through the redaction
+* below, which strips Drizzle's `Failed query: … / params: …` wrapper and the
+* values of secret-looking keys. See the block above `serialiseError`.
+*
+* Usage:
+*   import { logger } from "./utils/logger";
+*   logger.info("Server started", { port: 3001 });
+*   logger.error("Request failed", { path: "/api/test", error: err });
+*
+* Every host global goes through `./host`, and that is load-bearing rather than
+* tidy: this module is reachable from `@rebasepro/server/functions`, the
+* authoring surface that has to import cleanly on a runtime with no `process`.
+* A bare `process.env.NODE_ENV` here would make the first log line of the first
+* request on workerd a `ReferenceError`.
+*/
 /** Google Cloud Logging severity strings. */
 var GCP_SEVERITY = {
 	debug: "DEBUG",
@@ -16,10 +110,10 @@ var LOG_PRIORITY = {
 	error: 3
 };
 function isProduction() {
-	return process.env.NODE_ENV === "production";
+	return hostEnv().NODE_ENV === "production";
 }
 function getMinLevel() {
-	const env = (process.env.LOG_LEVEL || "info").toLowerCase();
+	const env = (hostEnv().LOG_LEVEL || "info").toLowerCase();
 	if (env in LOG_PRIORITY) return env;
 	return "info";
 }
@@ -57,7 +151,7 @@ function isSensitiveKey(key) {
 * it, and it never re-enables the key deny-list.
 */
 function rawQueriesAllowed() {
-	return process.env.NODE_ENV !== "production" && process.env.REBASE_LOG_RAW_QUERIES === "true";
+	return hostEnv().NODE_ENV !== "production" && hostEnv().REBASE_LOG_RAW_QUERIES === "true";
 }
 /**
 * Strip every `Failed query: … / params: …` span out of a message or stack,
@@ -154,8 +248,8 @@ function createLogger(rawDefaultFields = {}) {
 				...merged
 			};
 			const line = JSON.stringify(entry);
-			if (level === "error") process.stderr.write(line + "\n");
-			else process.stdout.write(line + "\n");
+			if (level === "error") writeLine("err", line);
+			else writeLine("out", line);
 		} else {
 			const prefix = level === "error" ? "❌" : level === "warn" ? "⚠️" : level === "info" ? "ℹ️" : "🐛";
 			const extra = Object.keys(merged).length > 0 ? ` ${JSON.stringify(merged)}` : "";
@@ -185,6 +279,6 @@ function createLogger(rawDefaultFields = {}) {
 */
 var logger = createLogger();
 //#endregion
-export { redactSensitiveText as n, logger as t };
+export { redactSensitiveText as n, hostEnv as r, logger as t };
 
-//# sourceMappingURL=logger-DfvF_8r-.js.map
+//# sourceMappingURL=logger-DS03e908.js.map

package/dist/logger-DS03e908.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger-DS03e908.js","names":[],"sources":["../src/utils/host.ts","../src/utils/logger.ts"],"sourcesContent":["/**\n * The host globals this package reads, behind functions that do not assume Node.\n *\n * `process` is not defined on workerd, on Deno Deploy without the compat flag,\n * or in a browser. That matters here for one specific reason: the portable\n * authoring surface (`@rebasepro/server/functions`) reaches the logger and the\n * error handler, and a bare `process.env.NODE_ENV` inside either of them turns\n * the first log line of a request into a `ReferenceError` on a runtime that has\n * no `process` — a failure that reads as \"the framework crashed\" rather than\n * \"this runtime has no process object\".\n *\n * Nothing here throws and nothing here is async. A runtime that cannot answer\n * gets the empty answer, because every caller in this file's blast radius is\n * choosing a log level or a format, and the safe default for both is the\n * development one.\n *\n * @module\n */\n\n/**\n * Where an adapter with no `process` can publish the environment.\n *\n * Cloudflare Workers hand the environment to the *request*, not to the module,\n * so there is no global to read at import time. An edge adapter that has\n * already seen a request can stash the bag here and every contextless reader in\n * the framework — the logger, chiefly — starts answering correctly.\n *\n * `Symbol.for` rather than a module-local for the same reason the singleton\n * uses it: more than one copy of this module can be loaded into one process,\n * and a module-local would leave every copy but the writer's blind. See\n * `../singleton.ts`.\n *\n * Request-scoped code should NOT read this. Use `getEnv(c)` from\n * `@rebasepro/server/functions`, which reads the binding attached to the\n * request it is serving — the only correct source on a runtime where two\n * concurrent requests can carry different bindings.\n */\nconst ENV_SLOT = Symbol.for(\"@rebasepro/server:host-env\");\n\ntype GlobalWithEnv = typeof globalThis & {\n    [ENV_SLOT]?: Record<string, string | undefined>;\n    process?: { env?: Record<string, string | undefined> };\n};\n\n/**\n * The process environment, or the closest thing this runtime has to one.\n *\n * Order: a bag published by {@link setHostEnv} first, because an adapter that\n * set one knows more than the ambient globals do; then `process.env`; then\n * nothing.\n */\nexport function hostEnv(): Record<string, string | undefined> {\n    const global = globalThis as GlobalWithEnv;\n    return global[ENV_SLOT] ?? global.process?.env ?? {};\n}\n\n/**\n * Read one environment variable without touching `process` directly.\n *\n * Trimmed, and blank is treated as absent — a variable declared with no value\n * is the ordinary way to write a compose file or a `.env` line, and every\n * caller in this package means \"unset\" by it. See `resolveFunctionsTimeoutMs`,\n * which learned that the hard way.\n */\nexport function hostEnvVar(name: string): string | undefined {\n    const raw = hostEnv()[name];\n    if (typeof raw !== \"string\") return undefined;\n    const trimmed = raw.trim();\n    return trimmed === \"\" ? undefined : trimmed;\n}\n\n/**\n * Publish an environment bag for contextless readers.\n *\n * Called by an adapter for a runtime whose environment is not ambient. Merges\n * rather than replaces, so two adapters (or an adapter plus a test) do not\n * silently erase each other's variables.\n */\nexport function setHostEnv(env: Record<string, string | undefined>): void {\n    const global = globalThis as GlobalWithEnv;\n    global[ENV_SLOT] = {\n        ...(global[ENV_SLOT] ?? {}),\n        ...env\n    };\n}\n\n/** @internal Test seam — drops anything {@link setHostEnv} published. */\nexport function _clearHostEnv(): void {\n    delete (globalThis as GlobalWithEnv)[ENV_SLOT];\n}\n\ntype GlobalWithStdio = typeof globalThis & {\n    process?: {\n        stdout?: { write?: (chunk: string) => unknown };\n        stderr?: { write?: (chunk: string) => unknown };\n    };\n};\n\n/**\n * Write one already-formatted line to the process's output.\n *\n * `process.stdout.write` is preferred where it exists because it is the only\n * one of the two that does not append its own formatting to a line that is\n * already a complete JSON document — `console.log` on Node is\n * `process.stdout.write` plus `util.format`, and `util.format` will happily\n * reinterpret a `%s` that appeared inside a user's log message.\n *\n * Where it does not exist, `console` is the runtime's log sink and is what its\n * platform collects.\n */\nexport function writeLine(stream: \"out\" | \"err\", line: string): void {\n    const proc = (globalThis as GlobalWithStdio).process;\n    const sink = stream === \"err\" ? proc?.stderr : proc?.stdout;\n    if (typeof sink?.write === \"function\") {\n        sink.write(line + \"\\n\");\n        return;\n    }\n    if (stream === \"err\") console.error(line);\n    else console.log(line);\n}\n","/**\n * Structured Logger for Rebase Backend\n *\n * Outputs JSON lines when `NODE_ENV=production`, human-readable prefixed\n * lines otherwise.  Designed to work with Google Cloud Logging severity levels.\n *\n * Every line — message and data, at any depth — passes through the redaction\n * below, which strips Drizzle's `Failed query: … / params: …` wrapper and the\n * values of secret-looking keys. See the block above `serialiseError`.\n *\n * Usage:\n *   import { logger } from \"./utils/logger\";\n *   logger.info(\"Server started\", { port: 3001 });\n *   logger.error(\"Request failed\", { path: \"/api/test\", error: err });\n *\n * Every host global goes through `./host`, and that is load-bearing rather than\n * tidy: this module is reachable from `@rebasepro/server/functions`, the\n * authoring surface that has to import cleanly on a runtime with no `process`.\n * A bare `process.env.NODE_ENV` here would make the first log line of the first\n * request on workerd a `ReferenceError`.\n */\nimport { hostEnv, writeLine } from \"./host\";\n\nexport type LogLevel = \"debug\" | \"info\" | \"warn\" | \"error\";\n\n/** Google Cloud Logging severity strings. */\nconst GCP_SEVERITY: Record<LogLevel, string> = {\n    debug: \"DEBUG\",\n    info: \"INFO\",\n    warn: \"WARNING\",\n    error: \"ERROR\"\n};\n\nconst LOG_PRIORITY: Record<LogLevel, number> = {\n    debug: 0,\n    info: 1,\n    warn: 2,\n    error: 3\n};\n\nexport interface LogEntry {\n    severity: string;\n    message: string;\n    timestamp: string;\n    [key: string]: unknown;\n}\n\nexport interface Logger {\n    debug(message: string, data?: Record<string, unknown>): void;\n    info(message: string, data?: Record<string, unknown>): void;\n    warn(message: string, data?: Record<string, unknown>): void;\n    error(message: string, data?: Record<string, unknown>): void;\n    child(defaultFields: Record<string, unknown>): Logger;\n}\n\nfunction isProduction(): boolean {\n    return hostEnv().NODE_ENV === \"production\";\n}\n\nfunction getMinLevel(): LogLevel {\n    const env = (hostEnv().LOG_LEVEL || \"info\").toLowerCase();\n    if (env in LOG_PRIORITY) return env as LogLevel;\n    return \"info\";\n}\n\n// ── Redaction ───────────────────────────────────────────────────────\n//\n// Drizzle builds every query failure as\n// `Failed query: ${query}\\nparams: ${params}` (drizzle-orm/errors.js), so the\n// statement *and* every bound value ride along in `.message` and `.stack` of\n// whatever a driver rethrows — an email and a bcrypt hash reach stdout the\n// moment a registration hits a unique violation. The redaction lives here, in\n// the one function every log line passes through, rather than at the ~124\n// `{ error: … }` call sites: a per-site rule is what produced the leak (one\n// file suppressed the stack, four others did not), and the next caller would\n// reintroduce it. Nothing above this line needs to know about it.\n\nconst FAILED_QUERY_MARKER = \"Failed query:\";\nconst REDACTED_QUERY = \"Failed query: [redacted]\";\nconst REDACTED_VALUE = \"[redacted]\";\n\n/**\n * Key fragments whose values are never safe to publish. Compared against the\n * key with separators and case removed, so `api_key`, `apiKey` and `API-KEY`\n * all match `apikey`.\n */\nconst SENSITIVE_KEY_FRAGMENTS = [\n    \"password\",\n    \"passwd\",\n    \"passphrase\",\n    \"secret\",\n    \"token\",\n    \"apikey\",\n    \"authorization\",\n    \"credential\",\n    \"cookie\",\n    \"privatekey\",\n    \"sessionid\"\n];\n\n/** Longest structure the redactor will walk before giving up. */\nconst MAX_REDACT_DEPTH = 8;\n\nfunction isSensitiveKey(key: string): boolean {\n    const normalised = key.toLowerCase().replace(/[^a-z0-9]/g, \"\");\n    return SENSITIVE_KEY_FRAGMENTS.some(fragment => normalised.includes(fragment));\n}\n\n/**\n * Local escape hatch for the `Failed query:` strip only — the statement is the\n * fastest way to diagnose a failing query on a developer machine. Ignored in\n * production, so a runtime that inherits the variable cannot leak because of\n * it, and it never re-enables the key deny-list.\n */\nfunction rawQueriesAllowed(): boolean {\n    return hostEnv().NODE_ENV !== \"production\"\n        && hostEnv().REBASE_LOG_RAW_QUERIES === \"true\";\n}\n\n/**\n * Strip every `Failed query: … / params: …` span out of a message or stack,\n * keeping the surrounding text (including stack frames, which carry no user\n * data). When no `params:` line follows the marker the rest of the string is\n * dropped: a statement of unknown extent is treated as sensitive rather than\n * guessed at.\n *\n * Idempotent, and it has to be: an already-redacted span still starts with the\n * marker but has no `params:` line, so a second pass over it would fall into\n * the drop-the-rest branch and eat the stack frames behind it. Redaction runs\n * more than once on the same string in practice — the cron scheduler redacts\n * before persisting and then logs the result.\n */\nexport function redactSensitiveText(text: string): string {\n    if (!text.includes(FAILED_QUERY_MARKER) || rawQueriesAllowed()) return text;\n\n    let out = text;\n    let idx = out.indexOf(FAILED_QUERY_MARKER);\n    while (idx !== -1) {\n        if (out.startsWith(REDACTED_QUERY, idx)) {\n            idx = out.indexOf(FAILED_QUERY_MARKER, idx + REDACTED_QUERY.length);\n            continue;\n        }\n        const paramsIdx = out.indexOf(\"\\nparams:\", idx);\n        let end: number;\n        if (paramsIdx === -1) {\n            end = out.length;\n        } else {\n            const eol = out.indexOf(\"\\n\", paramsIdx + 1);\n            end = eol === -1 ? out.length : eol;\n        }\n        out = out.slice(0, idx) + REDACTED_QUERY + out.slice(end);\n        idx = out.indexOf(FAILED_QUERY_MARKER, idx + REDACTED_QUERY.length);\n    }\n    return out;\n}\n\n/**\n * Serialise an Error into a plain object (stack + message), with the query\n * text redacted out of both. `query`/`params` own-properties — which\n * `DrizzleQueryError` carries beside the message — are deliberately not\n * copied.\n * Handles non-Error values gracefully.\n */\nfunction serialiseError(value: unknown): Record<string, unknown> {\n    if (value instanceof Error) {\n        return {\n            name: value.name,\n            message: redactSensitiveText(value.message),\n            stack: value.stack ? redactSensitiveText(value.stack) : undefined\n        };\n    }\n    return { value: redactSensitiveText(String(value)) };\n}\n\n/**\n * Redact one logged value: errors are serialised, strings are stripped of\n * query text, objects and arrays are walked. Cycles and over-deep structures\n * collapse to a marker rather than throwing — a logger that can fail is worse\n * than one that logs less. (An object referenced twice in one payload is\n * reported as `[circular]` the second time; bounding the walk matters more\n * than rendering a shared reference twice.)\n */\nfunction redactValue(value: unknown, depth: number, seen: WeakSet<object>): unknown {\n    // `serialiseError` returns only already-redacted strings, so it is the\n    // terminal step — walking its output again would redact twice.\n    if (value instanceof Error) return serialiseError(value);\n    if (typeof value === \"string\") return redactSensitiveText(value);\n    if (value === null || typeof value !== \"object\") return value;\n    if (depth >= MAX_REDACT_DEPTH) return \"[truncated]\";\n    if (seen.has(value)) return \"[circular]\";\n    seen.add(value);\n\n    if (Array.isArray(value)) {\n        return value.map(item => redactValue(item, depth + 1, seen));\n    }\n    if (value instanceof Date) return value;\n\n    const out: Record<string, unknown> = {};\n    for (const [key, val] of Object.entries(value as Record<string, unknown>)) {\n        out[key] = isSensitiveKey(key) ? REDACTED_VALUE : redactValue(val, depth + 1, seen);\n    }\n    return out;\n}\n\nfunction formatData(data?: Record<string, unknown>): Record<string, unknown> | undefined {\n    if (!data) return undefined;\n    const seen = new WeakSet<object>();\n    const out: Record<string, unknown> = {};\n    for (const [key, val] of Object.entries(data)) {\n        out[key] = isSensitiveKey(key) ? REDACTED_VALUE : redactValue(val, 0, seen);\n    }\n    return out;\n}\n\nfunction createLogger(rawDefaultFields: Record<string, unknown> = {}): Logger {\n    const minLevel = getMinLevel();\n    // Child fields go through the same pass as per-call data — they are merged\n    // into every line this logger emits, so leaving them raw would be a hole\n    // the moment `child()` gets its first caller.\n    const defaultFields = formatData(rawDefaultFields) ?? {};\n\n    function emit(level: LogLevel, message: string, data?: Record<string, unknown>): void {\n        if (LOG_PRIORITY[level] < LOG_PRIORITY[minLevel]) return;\n\n        // The message is redacted too, not just the data: several call sites\n        // interpolate `error.message` straight into the line they log.\n        const safeMessage = redactSensitiveText(message);\n        const merged = { ...defaultFields,\n...formatData(data) };\n\n        if (isProduction()) {\n            // Structured JSON for Cloud Logging\n            const entry: LogEntry = {\n                severity: GCP_SEVERITY[level],\n                message: safeMessage,\n                timestamp: new Date().toISOString(),\n                ...merged\n            };\n            const line = JSON.stringify(entry);\n\n            if (level === \"error\") {\n                writeLine(\"err\", line);\n            } else {\n                writeLine(\"out\", line);\n            }\n        } else {\n            // Human-readable for development\n            const prefix = level === \"error\" ? \"❌\"\n                : level === \"warn\" ? \"⚠️\"\n                : level === \"info\" ? \"ℹ️\"\n                : \"🐛\";\n            const extra = Object.keys(merged).length > 0 ? ` ${JSON.stringify(merged)}` : \"\";\n            const out = `${prefix} [${level.toUpperCase()}] ${safeMessage}${extra}`;\n\n            if (level === \"error\") {\n                console.error(out);\n            } else if (level === \"warn\") {\n                console.warn(out);\n            } else {\n                console.log(out);\n            }\n        }\n    }\n\n    return {\n        debug: (msg, data) => emit(\"debug\", msg, data),\n        info: (msg, data) => emit(\"info\", msg, data),\n        warn: (msg, data) => emit(\"warn\", msg, data),\n        error: (msg, data) => emit(\"error\", msg, data),\n        child(fields: Record<string, unknown>): Logger {\n            return createLogger({ ...defaultFields,\n...fields });\n        }\n    };\n}\n\n/**\n * Singleton logger instance.\n * In production: emits JSON lines with `severity`, `message`, `timestamp`.\n * In development: emits human-readable prefixed lines.\n */\nexport const logger: Logger = createLogger();\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqCA,IAAM,WAAW,OAAO,IAAI,4BAA4B;;;;;;;;AAcxD,SAAgB,UAA8C;CAC1D,MAAM,SAAS;CACf,OAAO,OAAO,aAAa,OAAO,SAAS,OAAO,CAAC;AACvD;;;;;;;;;;;;;AAwDA,SAAgB,UAAU,QAAuB,MAAoB;CACjE,MAAM,OAAQ,WAA+B;CAC7C,MAAM,OAAO,WAAW,QAAQ,MAAM,SAAS,MAAM;CACrD,IAAI,OAAO,MAAM,UAAU,YAAY;EACnC,KAAK,MAAM,OAAO,IAAI;EACtB;CACJ;CACA,IAAI,WAAW,OAAO,QAAQ,MAAM,IAAI;MACnC,QAAQ,IAAI,IAAI;AACzB;;;;;;;;;;;;;;;;;;;;;;;;;AC7FA,IAAM,eAAyC;CAC3C,OAAO;CACP,MAAM;CACN,MAAM;CACN,OAAO;AACX;AAEA,IAAM,eAAyC;CAC3C,OAAO;CACP,MAAM;CACN,MAAM;CACN,OAAO;AACX;AAiBA,SAAS,eAAwB;CAC7B,OAAO,QAAQ,CAAC,CAAC,aAAa;AAClC;AAEA,SAAS,cAAwB;CAC7B,MAAM,OAAO,QAAQ,CAAC,CAAC,aAAa,OAAA,CAAQ,YAAY;CACxD,IAAI,OAAO,cAAc,OAAO;CAChC,OAAO;AACX;AAcA,IAAM,sBAAsB;AAC5B,IAAM,iBAAiB;AACvB,IAAM,iBAAiB;;;;;;AAOvB,IAAM,0BAA0B;CAC5B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACJ;;AAGA,IAAM,mBAAmB;AAEzB,SAAS,eAAe,KAAsB;CAC1C,MAAM,aAAa,IAAI,YAAY,CAAC,CAAC,QAAQ,cAAc,EAAE;CAC7D,OAAO,wBAAwB,MAAK,aAAY,WAAW,SAAS,QAAQ,CAAC;AACjF;;;;;;;AAQA,SAAS,oBAA6B;CAClC,OAAO,QAAQ,CAAC,CAAC,aAAa,gBACvB,QAAQ,CAAC,CAAC,2BAA2B;AAChD;;;;;;;;;;;;;;AAeA,SAAgB,oBAAoB,MAAsB;CACtD,IAAI,CAAC,KAAK,SAAS,mBAAmB,KAAK,kBAAkB,GAAG,OAAO;CAEvE,IAAI,MAAM;CACV,IAAI,MAAM,IAAI,QAAQ,mBAAmB;CACzC,OAAO,QAAQ,IAAI;EACf,IAAI,IAAI,WAAW,gBAAgB,GAAG,GAAG;GACrC,MAAM,IAAI,QAAQ,qBAAqB,MAAM,EAAqB;GAClE;EACJ;EACA,MAAM,YAAY,IAAI,QAAQ,aAAa,GAAG;EAC9C,IAAI;EACJ,IAAI,cAAc,IACd,MAAM,IAAI;OACP;GACH,MAAM,MAAM,IAAI,QAAQ,MAAM,YAAY,CAAC;GAC3C,MAAM,QAAQ,KAAK,IAAI,SAAS;EACpC;EACA,MAAM,IAAI,MAAM,GAAG,GAAG,IAAI,iBAAiB,IAAI,MAAM,GAAG;EACxD,MAAM,IAAI,QAAQ,qBAAqB,MAAM,EAAqB;CACtE;CACA,OAAO;AACX;;;;;;;;AASA,SAAS,eAAe,OAAyC;CAC7D,IAAI,iBAAiB,OACjB,OAAO;EACH,MAAM,MAAM;EACZ,SAAS,oBAAoB,MAAM,OAAO;EAC1C,OAAO,MAAM,QAAQ,oBAAoB,MAAM,KAAK,IAAI,KAAA;CAC5D;CAEJ,OAAO,EAAE,OAAO,oBAAoB,OAAO,KAAK,CAAC,EAAE;AACvD;;;;;;;;;AAUA,SAAS,YAAY,OAAgB,OAAe,MAAgC;CAGhF,IAAI,iBAAiB,OAAO,OAAO,eAAe,KAAK;CACvD,IAAI,OAAO,UAAU,UAAU,OAAO,oBAAoB,KAAK;CAC/D,IAAI,UAAU,QAAQ,OAAO,UAAU,UAAU,OAAO;CACxD,IAAI,SAAS,kBAAkB,OAAO;CACtC,IAAI,KAAK,IAAI,KAAK,GAAG,OAAO;CAC5B,KAAK,IAAI,KAAK;CAEd,IAAI,MAAM,QAAQ,KAAK,GACnB,OAAO,MAAM,KAAI,SAAQ,YAAY,MAAM,QAAQ,GAAG,IAAI,CAAC;CAE/D,IAAI,iBAAiB,MAAM,OAAO;CAElC,MAAM,MAA+B,CAAC;CACtC,KAAK,MAAM,CAAC,KAAK,QAAQ,OAAO,QAAQ,KAAgC,GACpE,IAAI,OAAO,eAAe,GAAG,IAAI,iBAAiB,YAAY,KAAK,QAAQ,GAAG,IAAI;CAEtF,OAAO;AACX;AAEA,SAAS,WAAW,MAAqE;CACrF,IAAI,CAAC,MAAM,OAAO,KAAA;CAClB,MAAM,uBAAO,IAAI,QAAgB;CACjC,MAAM,MAA+B,CAAC;CACtC,KAAK,MAAM,CAAC,KAAK,QAAQ,OAAO,QAAQ,IAAI,GACxC,IAAI,OAAO,eAAe,GAAG,IAAI,iBAAiB,YAAY,KAAK,GAAG,IAAI;CAE9E,OAAO;AACX;AAEA,SAAS,aAAa,mBAA4C,CAAC,GAAW;CAC1E,MAAM,WAAW,YAAY;CAI7B,MAAM,gBAAgB,WAAW,gBAAgB,KAAK,CAAC;CAEvD,SAAS,KAAK,OAAiB,SAAiB,MAAsC;EAClF,IAAI,aAAa,SAAS,aAAa,WAAW;EAIlD,MAAM,cAAc,oBAAoB,OAAO;EAC/C,MAAM,SAAS;GAAE,GAAG;GAC5B,GAAG,WAAW,IAAI;EAAE;EAEZ,IAAI,aAAa,GAAG;GAEhB,MAAM,QAAkB;IACpB,UAAU,aAAa;IACvB,SAAS;IACT,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;IAClC,GAAG;GACP;GACA,MAAM,OAAO,KAAK,UAAU,KAAK;GAEjC,IAAI,UAAU,SACV,UAAU,OAAO,IAAI;QAErB,UAAU,OAAO,IAAI;EAE7B,OAAO;GAEH,MAAM,SAAS,UAAU,UAAU,MAC7B,UAAU,SAAS,OACnB,UAAU,SAAS,OACnB;GACN,MAAM,QAAQ,OAAO,KAAK,MAAM,CAAC,CAAC,SAAS,IAAI,IAAI,KAAK,UAAU,MAAM,MAAM;GAC9E,MAAM,MAAM,GAAG,OAAO,IAAI,MAAM,YAAY,EAAE,IAAI,cAAc;GAEhE,IAAI,UAAU,SACV,QAAQ,MAAM,GAAG;QACd,IAAI,UAAU,QACjB,QAAQ,KAAK,GAAG;QAEhB,QAAQ,IAAI,GAAG;EAEvB;CACJ;CAEA,OAAO;EACH,QAAQ,KAAK,SAAS,KAAK,SAAS,KAAK,IAAI;EAC7C,OAAO,KAAK,SAAS,KAAK,QAAQ,KAAK,IAAI;EAC3C,OAAO,KAAK,SAAS,KAAK,QAAQ,KAAK,IAAI;EAC3C,QAAQ,KAAK,SAAS,KAAK,SAAS,KAAK,IAAI;EAC7C,MAAM,QAAyC;GAC3C,OAAO,aAAa;IAAE,GAAG;IACrC,GAAG;GAAO,CAAC;EACH;CACJ;AACJ;;;;;;AAOA,IAAa,SAAiB,aAAa"}

package/dist/{logs-routes-CWBLQj2l.js → logs-routes-DB72iQSr.js}

@@ -1,7 +1,9 @@
-import { createRequire as __createRequire } from "module";
-import "process";
-__createRequire(import.meta.url);
-import { n as __exportAll } from "./rolldown-runtime-DSJWtz9O.js";
+import { createRequire as __rebaseCreateRequire } from "module";
+import __rebaseProcess from "process";
+globalThis.process ??= __rebaseProcess;
+__rebaseCreateRequire(import.meta.url);
+import { n as __exportAll } from "./rolldown-runtime-dW7B1o5h.js";
+import { n as errorHandler, t as ApiError } from "./errors-DBwpj9N8.js";
 import { Hono } from "hono";
 import { streamSSE } from "hono/streaming";
 //#region src/api/logs-routes.ts
@@ -147,25 +149,50 @@ var STREAM_HEARTBEAT_MS = 25e3;
 * entries, a few MB, per stuck connection.
 */
 var STREAM_MAX_PENDING = 2e3;
+/**
+* The largest window any of these routes will hand back.
+*
+* The ring buffer holds 10,000 entries, so asking for more than all of it is a
+* mistake worth naming rather than silently clamping — and a clamped answer is
+* indistinguishable from "that is all there is".
+*/
+var LOG_WINDOW_MAX = 1e4;
 function createLogsRoutes(timing = {}) {
 	const flushMs = timing.flushMs ?? STREAM_FLUSH_MS;
 	const heartbeatMs = timing.heartbeatMs ?? STREAM_HEARTBEAT_MS;
 	const maxPending = timing.maxPending ?? STREAM_MAX_PENDING;
 	const app = new Hono();
+	app.onError(errorHandler);
+	/**
+	* A window into the ring buffer, or a 400 saying why not.
+	*
+	* `parseInt` was the whole of it before, and every malformed value failed
+	* differently and silently: `?limit=abc` fell through to the default,
+	* `?limit=-5` sliced an empty window and answered 200 with no entries, and
+	* `?count=abc` made `slice(-NaN)` return the *entire* buffer. Three ways to
+	* be wrong, none of them visible to the caller. The data plane refuses the
+	* same input with a 400 — see `resolveListLimitParam`.
+	*/
+	const window = (raw, what, max) => {
+		if (raw === void 0 || raw.trim() === "") return void 0;
+		const parsed = Number(raw.trim());
+		if (!Number.isInteger(parsed) || parsed < 1 || parsed > max) throw new ApiError(400, "INVALID_PARAM", `Invalid \`${what}\`: ${raw}. Expected a whole number between 1 and ${max}.`, void 0, true);
+		return parsed;
+	};
 	app.get("/", (c) => {
 		const query = c.req.query();
 		const result = logBuffer.query({
 			level: query.level,
 			source: query.source,
 			search: query.search,
-			limit: query.limit ? parseInt(query.limit) : void 0,
-			offset: query.offset ? parseInt(query.offset) : void 0,
+			limit: window(query.limit, "limit", LOG_WINDOW_MAX),
+			offset: window(query.offset, "offset", Number.MAX_SAFE_INTEGER),
 			since: query.since
 		});
 		return c.json(result);
 	});
 	app.get("/latest", (c) => {
-		const count = parseInt(c.req.query("count") || "50");
+		const count = window(c.req.query("count"), "count", LOG_WINDOW_MAX) ?? 50;
 		return c.json({ entries: logBuffer.getLatest(count) });
 	});
 	app.get("/stream", (c) => {
@@ -175,7 +202,7 @@ function createLogsRoutes(timing = {}) {
 			source: query.source,
 			search: query.search
 		});
-		const limit = query.limit ? parseInt(query.limit) : 200;
+		const limit = window(query.limit, "limit", LOG_WINDOW_MAX) ?? 200;
 		c.header("X-Accel-Buffering", "no");
 		return streamSSE(c, async (stream) => {
 			let pending = [];
@@ -242,4 +269,4 @@ var logs_routes_default = createLogsRoutes();
 //#endregion
 export { logs_routes_exports as n, logMiddleware as t };
 
-//# sourceMappingURL=logs-routes-CWBLQj2l.js.map
+//# sourceMappingURL=logs-routes-DB72iQSr.js.map

package/dist/logs-routes-DB72iQSr.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logs-routes-DB72iQSr.js","names":[],"sources":["../src/api/logs-routes.ts"],"sourcesContent":["import { Hono } from \"hono\";\nimport type { MiddlewareHandler } from \"hono\";\nimport { streamSSE } from \"hono/streaming\";\nimport type { HonoEnv } from \"./types\";\nimport { ApiError, errorHandler } from \"./errors\";\n\nexport interface LogEntry {\n    id: string;\n    timestamp: string;\n    level: \"debug\" | \"info\" | \"warn\" | \"error\";\n    source: \"api\" | \"auth\" | \"storage\" | \"realtime\" | \"system\";\n    message: string;\n    metadata?: Record<string, unknown>;\n}\n\n/** What a caller can narrow the log by, in either direction (query or stream). */\nexport interface LogFilterOptions {\n    level?: string;\n    source?: string;\n    search?: string;\n    since?: string;\n}\n\n/**\n * A filter with the search term already lowercased.\n *\n * The distinction matters on the stream path: `query()` lowercases once and then\n * scans, but a subscriber tests one entry at a time and would otherwise redo the\n * same `toLowerCase()` on every request the server handles.\n */\ntype NormalizedFilter = LogFilterOptions;\n\nfunction normalizeFilter(options: LogFilterOptions): NormalizedFilter {\n    return { ...options,\n        search: options.search?.toLowerCase() };\n}\n\n/**\n * Whether one entry belongs in a filtered view.\n *\n * Shared by the query and the stream on purpose: two copies of this would drift,\n * and the failure that produces is invisible — a tail that quietly shows a\n * different set of lines than the snapshot it started from.\n */\nfunction matchesFilter(entry: LogEntry, filter: NormalizedFilter): boolean {\n    if (filter.level && entry.level !== filter.level) return false;\n    if (filter.source && entry.source !== filter.source) return false;\n    if (filter.search && !entry.message.toLowerCase().includes(filter.search)) return false;\n    if (filter.since && entry.timestamp < filter.since) return false;\n    return true;\n}\n\n/** Notified for every entry pushed, in push order. */\nexport type LogListener = (entry: LogEntry) => void;\n\nclass LogRingBuffer {\n    private buffer: LogEntry[] = [];\n    private maxSize: number;\n    private idCounter = 0;\n    private listeners = new Set<LogListener>();\n\n    constructor(maxSize = 10000) {\n        this.maxSize = maxSize;\n    }\n\n    push(entry: Omit<LogEntry, \"id\">): void {\n        const id = `log_${++this.idCounter}`;\n        const stored: LogEntry = { ...entry,\n            id };\n        this.buffer.push(stored);\n        if (this.buffer.length > this.maxSize) {\n            this.buffer.shift();\n        }\n        // This runs on the request hot path, so a listener must never be able to\n        // take the request down with it: a tail that throws loses its own tail,\n        // not the response the log line was describing.\n        for (const listener of this.listeners) {\n            try {\n                listener(stored);\n            } catch {\n                /* a broken tail is not the request's problem */\n            }\n        }\n    }\n\n    /**\n     * Follow the buffer. Returns the unsubscribe — call it, always: a listener\n     * left behind holds its whole closure, and on this class that closure is a\n     * pending-entry array.\n     *\n     * A listener must not log. It is called from inside `push`, so anything that\n     * reaches `addLog` from here recurses until the stack gives out.\n     */\n    subscribe(listener: LogListener): () => void {\n        this.listeners.add(listener);\n        return () => {\n            this.listeners.delete(listener);\n        };\n    }\n\n    query(options: LogFilterOptions & {\n        limit?: number;\n        offset?: number;\n    }): { entries: LogEntry[]; total: number } {\n        const filter = normalizeFilter(options);\n        const filtered = this.buffer.filter(e => matchesFilter(e, filter));\n\n        // Newest first\n        const sorted = [...filtered].reverse();\n        const total = sorted.length;\n        const limit = options.limit || 100;\n        const offset = options.offset || 0;\n\n        return {\n            entries: sorted.slice(offset, offset + limit),\n            total\n        };\n    }\n\n    getLatest(count = 50): LogEntry[] {\n        return this.buffer.slice(-count).reverse();\n    }\n}\n\n// Global singleton\nexport const logBuffer = new LogRingBuffer();\n\n/** Add a log entry */\nexport function addLog(\n    level: LogEntry[\"level\"],\n    source: LogEntry[\"source\"],\n    message: string,\n    metadata?: Record<string, unknown>\n): void {\n    logBuffer.push({\n        timestamp: new Date().toISOString(),\n        level,\n        source,\n        message,\n        metadata\n    });\n}\n\nexport interface LogMiddlewareOptions {\n    /**\n     * Paths this sink ignores, matched exactly against `c.req.path`.\n     *\n     * For requests whose only reason to exist is to read the log. Recording\n     * those makes the reader the loudest thing in its own output, and on a quiet\n     * server it is also the thing evicting real entries out of the ring.\n     */\n    ignorePaths?: string[];\n}\n\n/** Hono middleware to log API requests */\nexport function logMiddleware(options: LogMiddlewareOptions = {}): MiddlewareHandler<HonoEnv> {\n    const ignored = new Set(options.ignorePaths ?? []);\n    return async (c, next) => {\n        const start = Date.now();\n        await next();\n        if (ignored.has(c.req.path)) return;\n        const duration = Date.now() - start;\n        const reqId = c.get(\"requestId\");\n        addLog(\"info\", \"api\", `${c.req.method} ${c.req.path} ${c.res.status} ${duration}ms`, {\n            method: c.req.method,\n            path: c.req.path,\n            status: c.res.status,\n            duration,\n            ...(reqId && { requestId: reqId })\n        });\n    };\n}\n\n/**\n * How long entries accumulate before a batch goes out.\n *\n * Not zero, and that is the point. A busy server logs faster than a browser can\n * render, and one SSE frame per line would hand the client a re-render per\n * request served — worse than the 3s poll this replaces, precisely when the logs\n * are worth watching. Coalescing keeps the frame rate bounded by the window\n * rather than by traffic, and 250ms still reads as \"live\" to a person.\n */\nconst STREAM_FLUSH_MS = 250;\n\n/**\n * Idle gap after which the stream sends a comment line.\n *\n * A silent SSE connection is indistinguishable from a dead one to everything in\n * between — proxies, load balancers and laptop NICs all reap idle sockets, and a\n * server with nothing to say is the normal state here.\n */\nconst STREAM_HEARTBEAT_MS = 25_000;\n\n/**\n * Entries a single connection will hold between flushes.\n *\n * This is a *rate* ceiling, not just a memory bound, and that is easy to get\n * wrong: nothing drains `pending` between flushes, so the most a connection can\n * carry losslessly is `maxPending` per `flushMs` — here 2000 per 250ms, or 8000\n * entries a second. Above that the oldest pending entries go and the client is\n * told how many, whatever speed it is reading at.\n *\n * It was 500, which put that ceiling at 2000/s. A healthy reader on a loopback\n * socket lost 85% of a 20k burst to it — the cap fired on the server's own\n * coalescing window rather than on any slowness at the client, which is a drop\n * notice that says nothing true about why. 8000/s is past what one Node process\n * serves, so reaching it now means genuinely more log than a person can be shown.\n *\n * The memory this bounds is the copy a *stalled* reader causes: roughly 2000\n * entries, a few MB, per stuck connection.\n */\nconst STREAM_MAX_PENDING = 2000;\n\n/**\n * The largest window any of these routes will hand back.\n *\n * The ring buffer holds 10,000 entries, so asking for more than all of it is a\n * mistake worth naming rather than silently clamping — and a clamped answer is\n * indistinguishable from \"that is all there is\".\n */\nconst LOG_WINDOW_MAX = 10_000;\n\n/**\n * The stream's timings, injectable only so they can be tested.\n *\n * The defaults above are the contract and nothing in production passes this. A\n * heartbeat is a 25-second wait to observe, and a suite that cannot observe it is\n * a suite where the keepalive can rot — which surfaces as \"the tail dies after a\n * few minutes behind the load balancer\", months later, on someone else's cluster.\n */\nexport interface LogStreamTiming {\n    flushMs?: number;\n    heartbeatMs?: number;\n    maxPending?: number;\n}\n\nexport function createLogsRoutes(timing: LogStreamTiming = {}): Hono<HonoEnv> {\n    const flushMs = timing.flushMs ?? STREAM_FLUSH_MS;\n    const heartbeatMs = timing.heartbeatMs ?? STREAM_HEARTBEAT_MS;\n    const maxPending = timing.maxPending ?? STREAM_MAX_PENDING;\n\n    const app = new Hono<HonoEnv>();\n    // Its own, like every other router here: nothing registers one on the host\n    // app — not `boot.ts`, not the scaffolded backend, not the eject template —\n    // so a router that throws without this answers Hono's default 500 in plain\n    // text, outside the `{ error: { code, message } }` envelope the rest of the\n    // API keeps to.\n    app.onError(errorHandler);\n\n    /**\n     * A window into the ring buffer, or a 400 saying why not.\n     *\n     * `parseInt` was the whole of it before, and every malformed value failed\n     * differently and silently: `?limit=abc` fell through to the default,\n     * `?limit=-5` sliced an empty window and answered 200 with no entries, and\n     * `?count=abc` made `slice(-NaN)` return the *entire* buffer. Three ways to\n     * be wrong, none of them visible to the caller. The data plane refuses the\n     * same input with a 400 — see `resolveListLimitParam`.\n     */\n    const window = (raw: string | undefined, what: string, max: number): number | undefined => {\n        if (raw === undefined || raw.trim() === \"\") return undefined;\n        const parsed = Number(raw.trim());\n        if (!Number.isInteger(parsed) || parsed < 1 || parsed > max) {\n            throw new ApiError(\n                400,\n                \"INVALID_PARAM\",\n                `Invalid \\`${what}\\`: ${raw}. Expected a whole number between 1 and ${max}.`,\n                undefined,\n                true\n            );\n        }\n        return parsed;\n    };\n\n    // GET /api/logs — Query logs\n    app.get(\"/\", (c) => {\n        const query = c.req.query();\n        const result = logBuffer.query({\n            level: query.level,\n            source: query.source,\n            search: query.search,\n            limit: window(query.limit, \"limit\", LOG_WINDOW_MAX),\n            offset: window(query.offset, \"offset\", Number.MAX_SAFE_INTEGER),\n            since: query.since\n        });\n        return c.json(result);\n    });\n\n    // GET /api/logs/latest — Get latest logs (for real-time)\n    app.get(\"/latest\", (c) => {\n        const count = window(c.req.query(\"count\"), \"count\", LOG_WINDOW_MAX) ?? 50;\n        return c.json({ entries: logBuffer.getLatest(count) });\n    });\n\n    // GET /api/logs/stream — tail the buffer over SSE.\n    //\n    // The Logs Explorer used to poll this router every 3 seconds, which cost a\n    // request per client per 3s to say \"nothing happened\" and still showed each\n    // line up to 3s late. Here the buffer pushes instead, so an idle server is an\n    // idle socket.\n    //\n    // Events:\n    //   snapshot  {entries, total}   the filtered window, oldest-first, at open\n    //   append    {entries, dropped} entries since the last frame, oldest-first\n    //   `: ping`                     comment, keepalive only\n    //\n    // Snapshot and appends come down the same connection deliberately. A client\n    // that fetched its backlog separately would race the subscription — entries\n    // logged between the two calls belong to neither — and closing that race from\n    // the outside needs an id cursor and dedupe on every frame.\n    app.get(\"/stream\", (c) => {\n        const query = c.req.query();\n        const filter = normalizeFilter({\n            level: query.level,\n            source: query.source,\n            search: query.search\n        });\n        const limit = window(query.limit, \"limit\", LOG_WINDOW_MAX) ?? 200;\n\n        // Reverse proxies buffer text responses by default, which turns a live\n        // tail into nothing at all until the buffer fills. nginx (and the ingress\n        // in front of the managed runtime) reads this header; everything else\n        // ignores it. The rest of the SSE headers are set by `streamSSE`.\n        c.header(\"X-Accel-Buffering\", \"no\");\n\n        return streamSSE(c, async (stream) => {\n            let pending: LogEntry[] = [];\n            let dropped = 0;\n\n            // Subscribe *before* reading the backlog, with nothing awaited\n            // between the two. Both are synchronous, so the two halves meet\n            // exactly: an entry logged after the query but before the\n            // subscription would otherwise be in neither, and that gap is the one\n            // thing this route exists to close.\n            const unsubscribe = logBuffer.subscribe(entry => {\n                if (!matchesFilter(entry, filter)) return;\n                if (pending.length >= maxPending) {\n                    pending.shift();\n                    dropped++;\n                }\n                pending.push(entry);\n            });\n            const snapshot = logBuffer.query({ ...filter,\n                limit });\n\n            // A client that goes away has to end this handler, or the\n            // subscription outlives the socket. `streamSSE` only wires the\n            // request signal through on old Bun, so do it here and let\n            // `stream.aborted` be the one condition the loop tests.\n            //\n            // The `aborted` check is not belt-and-braces. A listener added to an\n            // already-aborted signal is never called, so a client that leaves\n            // during the snapshot write — a fast navigation, or a reconnect storm\n            // against a restarting server — would leave this handler with no way\n            // to learn it had gone: a subscriber and a flush loop, per attempt,\n            // for the life of the process.\n            const abortOnDisconnect = () => {\n                if (!stream.closed) stream.abort();\n            };\n            c.req.raw.signal.addEventListener(\"abort\", abortOnDisconnect, { once: true });\n            if (c.req.raw.signal.aborted) abortOnDisconnect();\n\n            try {\n                await stream.writeSSE({\n                    event: \"snapshot\",\n                    // The view tails like a terminal; both frames are oldest-first\n                    // so the client only ever appends.\n                    data: JSON.stringify({\n                        entries: snapshot.entries.slice().reverse(),\n                        total: snapshot.total\n                    })\n                });\n\n                let idleMs = 0;\n                while (!stream.aborted && !stream.closed) {\n                    await stream.sleep(flushMs);\n                    if (stream.aborted || stream.closed) break;\n\n                    if (pending.length === 0) {\n                        idleMs += flushMs;\n                        if (idleMs >= heartbeatMs) {\n                            await stream.write(\": ping\\n\\n\");\n                            idleMs = 0;\n                        }\n                        continue;\n                    }\n\n                    const entries = pending;\n                    const lost = dropped;\n                    pending = [];\n                    dropped = 0;\n                    idleMs = 0;\n                    await stream.writeSSE({\n                        event: \"append\",\n                        data: JSON.stringify(lost > 0 ? { entries,\n                            dropped: lost } : { entries })\n                    });\n                }\n            } finally {\n                unsubscribe();\n                c.req.raw.signal.removeEventListener(\"abort\", abortOnDisconnect);\n            }\n        });\n    });\n\n    return app;\n}\n\nexport default createLogsRoutes();\n"],"mappings":";;;;;;;;;;;;;;;;AAgCA,SAAS,gBAAgB,SAA6C;CAClE,OAAO;EAAE,GAAG;EACR,QAAQ,QAAQ,QAAQ,YAAY;CAAE;AAC9C;;;;;;;;AASA,SAAS,cAAc,OAAiB,QAAmC;CACvE,IAAI,OAAO,SAAS,MAAM,UAAU,OAAO,OAAO,OAAO;CACzD,IAAI,OAAO,UAAU,MAAM,WAAW,OAAO,QAAQ,OAAO;CAC5D,IAAI,OAAO,UAAU,CAAC,MAAM,QAAQ,YAAY,CAAC,CAAC,SAAS,OAAO,MAAM,GAAG,OAAO;CAClF,IAAI,OAAO,SAAS,MAAM,YAAY,OAAO,OAAO,OAAO;CAC3D,OAAO;AACX;AAKA,IAAM,gBAAN,MAAoB;CAChB,SAA6B,CAAC;CAC9B;CACA,YAAoB;CACpB,4BAAoB,IAAI,IAAiB;CAEzC,YAAY,UAAU,KAAO;EACzB,KAAK,UAAU;CACnB;CAEA,KAAK,OAAmC;EACpC,MAAM,KAAK,OAAO,EAAE,KAAK;EACzB,MAAM,SAAmB;GAAE,GAAG;GAC1B;EAAG;EACP,KAAK,OAAO,KAAK,MAAM;EACvB,IAAI,KAAK,OAAO,SAAS,KAAK,SAC1B,KAAK,OAAO,MAAM;EAKtB,KAAK,MAAM,YAAY,KAAK,WACxB,IAAI;GACA,SAAS,MAAM;EACnB,QAAQ,CAER;CAER;;;;;;;;;CAUA,UAAU,UAAmC;EACzC,KAAK,UAAU,IAAI,QAAQ;EAC3B,aAAa;GACT,KAAK,UAAU,OAAO,QAAQ;EAClC;CACJ;CAEA,MAAM,SAGqC;EACvC,MAAM,SAAS,gBAAgB,OAAO;EAItC,MAAM,SAAS,CAAC,GAHC,KAAK,OAAO,QAAO,MAAK,cAAc,GAAG,MAAM,CAG7C,CAAQ,CAAC,CAAC,QAAQ;EACrC,MAAM,QAAQ,OAAO;EACrB,MAAM,QAAQ,QAAQ,SAAS;EAC/B,MAAM,SAAS,QAAQ,UAAU;EAEjC,OAAO;GACH,SAAS,OAAO,MAAM,QAAQ,SAAS,KAAK;GAC5C;EACJ;CACJ;CAEA,UAAU,QAAQ,IAAgB;EAC9B,OAAO,KAAK,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ;CAC7C;AACJ;AAGA,IAAa,YAAY,IAAI,cAAc;;AAG3C,SAAgB,OACZ,OACA,QACA,SACA,UACI;CACJ,UAAU,KAAK;EACX,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;EAClC;EACA;EACA;EACA;CACJ,CAAC;AACL;;AAcA,SAAgB,cAAc,UAAgC,CAAC,GAA+B;CAC1F,MAAM,UAAU,IAAI,IAAI,QAAQ,eAAe,CAAC,CAAC;CACjD,OAAO,OAAO,GAAG,SAAS;EACtB,MAAM,QAAQ,KAAK,IAAI;EACvB,MAAM,KAAK;EACX,IAAI,QAAQ,IAAI,EAAE,IAAI,IAAI,GAAG;EAC7B,MAAM,WAAW,KAAK,IAAI,IAAI;EAC9B,MAAM,QAAQ,EAAE,IAAI,WAAW;EAC/B,OAAO,QAAQ,OAAO,GAAG,EAAE,IAAI,OAAO,GAAG,EAAE,IAAI,KAAK,GAAG,EAAE,IAAI,OAAO,GAAG,SAAS,KAAK;GACjF,QAAQ,EAAE,IAAI;GACd,MAAM,EAAE,IAAI;GACZ,QAAQ,EAAE,IAAI;GACd;GACA,GAAI,SAAS,EAAE,WAAW,MAAM;EACpC,CAAC;CACL;AACJ;;;;;;;;;;AAWA,IAAM,kBAAkB;;;;;;;;AASxB,IAAM,sBAAsB;;;;;;;;;;;;;;;;;;;AAoB5B,IAAM,qBAAqB;;;;;;;;AAS3B,IAAM,iBAAiB;AAgBvB,SAAgB,iBAAiB,SAA0B,CAAC,GAAkB;CAC1E,MAAM,UAAU,OAAO,WAAW;CAClC,MAAM,cAAc,OAAO,eAAe;CAC1C,MAAM,aAAa,OAAO,cAAc;CAExC,MAAM,MAAM,IAAI,KAAc;CAM9B,IAAI,QAAQ,YAAY;;;;;;;;;;;CAYxB,MAAM,UAAU,KAAyB,MAAc,QAAoC;EACvF,IAAI,QAAQ,KAAA,KAAa,IAAI,KAAK,MAAM,IAAI,OAAO,KAAA;EACnD,MAAM,SAAS,OAAO,IAAI,KAAK,CAAC;EAChC,IAAI,CAAC,OAAO,UAAU,MAAM,KAAK,SAAS,KAAK,SAAS,KACpD,MAAM,IAAI,SACN,KACA,iBACA,aAAa,KAAK,MAAM,IAAI,0CAA0C,IAAI,IAC1E,KAAA,GACA,IACJ;EAEJ,OAAO;CACX;CAGA,IAAI,IAAI,MAAM,MAAM;EAChB,MAAM,QAAQ,EAAE,IAAI,MAAM;EAC1B,MAAM,SAAS,UAAU,MAAM;GAC3B,OAAO,MAAM;GACb,QAAQ,MAAM;GACd,QAAQ,MAAM;GACd,OAAO,OAAO,MAAM,OAAO,SAAS,cAAc;GAClD,QAAQ,OAAO,MAAM,QAAQ,UAAU,OAAO,gBAAgB;GAC9D,OAAO,MAAM;EACjB,CAAC;EACD,OAAO,EAAE,KAAK,MAAM;CACxB,CAAC;CAGD,IAAI,IAAI,YAAY,MAAM;EACtB,MAAM,QAAQ,OAAO,EAAE,IAAI,MAAM,OAAO,GAAG,SAAS,cAAc,KAAK;EACvE,OAAO,EAAE,KAAK,EAAE,SAAS,UAAU,UAAU,KAAK,EAAE,CAAC;CACzD,CAAC;CAkBD,IAAI,IAAI,YAAY,MAAM;EACtB,MAAM,QAAQ,EAAE,IAAI,MAAM;EAC1B,MAAM,SAAS,gBAAgB;GAC3B,OAAO,MAAM;GACb,QAAQ,MAAM;GACd,QAAQ,MAAM;EAClB,CAAC;EACD,MAAM,QAAQ,OAAO,MAAM,OAAO,SAAS,cAAc,KAAK;EAM9D,EAAE,OAAO,qBAAqB,IAAI;EAElC,OAAO,UAAU,GAAG,OAAO,WAAW;GAClC,IAAI,UAAsB,CAAC;GAC3B,IAAI,UAAU;GAOd,MAAM,cAAc,UAAU,WAAU,UAAS;IAC7C,IAAI,CAAC,cAAc,OAAO,MAAM,GAAG;IACnC,IAAI,QAAQ,UAAU,YAAY;KAC9B,QAAQ,MAAM;KACd;IACJ;IACA,QAAQ,KAAK,KAAK;GACtB,CAAC;GACD,MAAM,WAAW,UAAU,MAAM;IAAE,GAAG;IAClC;GAAM,CAAC;GAaX,MAAM,0BAA0B;IAC5B,IAAI,CAAC,OAAO,QAAQ,OAAO,MAAM;GACrC;GACA,EAAE,IAAI,IAAI,OAAO,iBAAiB,SAAS,mBAAmB,EAAE,MAAM,KAAK,CAAC;GAC5E,IAAI,EAAE,IAAI,IAAI,OAAO,SAAS,kBAAkB;GAEhD,IAAI;IACA,MAAM,OAAO,SAAS;KAClB,OAAO;KAGP,MAAM,KAAK,UAAU;MACjB,SAAS,SAAS,QAAQ,MAAM,CAAC,CAAC,QAAQ;MAC1C,OAAO,SAAS;KACpB,CAAC;IACL,CAAC;IAED,IAAI,SAAS;IACb,OAAO,CAAC,OAAO,WAAW,CAAC,OAAO,QAAQ;KACtC,MAAM,OAAO,MAAM,OAAO;KAC1B,IAAI,OAAO,WAAW,OAAO,QAAQ;KAErC,IAAI,QAAQ,WAAW,GAAG;MACtB,UAAU;MACV,IAAI,UAAU,aAAa;OACvB,MAAM,OAAO,MAAM,YAAY;OAC/B,SAAS;MACb;MACA;KACJ;KAEA,MAAM,UAAU;KAChB,MAAM,OAAO;KACb,UAAU,CAAC;KACX,UAAU;KACV,SAAS;KACT,MAAM,OAAO,SAAS;MAClB,OAAO;MACP,MAAM,KAAK,UAAU,OAAO,IAAI;OAAE;OAC9B,SAAS;MAAK,IAAI,EAAE,QAAQ,CAAC;KACrC,CAAC;IACL;GACJ,UAAU;IACN,YAAY;IACZ,EAAE,IAAI,IAAI,OAAO,oBAAoB,SAAS,iBAAiB;GACnE;EACJ,CAAC;CACL,CAAC;CAED,OAAO;AACX;AAEA,IAAA,sBAAe,iBAAiB"}

package/dist/metrics/history-recorder.d.ts

@@ -0,0 +1,18 @@
+import type { DataDriver } from "@rebasepro/types";
+import { type MetricSeries, type SeriesPoint } from "./history-store.js";
+export interface MetricsHistory {
+    /** Create the table and sweep what has aged out. */
+    ensure(): Promise<void>;
+    /** Begin sampling this process. Returns a stop. */
+    start(): () => void;
+    /** Read one series, for the route and for anything else that asks. */
+    read(series: MetricSeries, sinceMinutes: number): Promise<SeriesPoint[]>;
+}
+/**
+ * History for this deployment, or `undefined` when it cannot have any.
+ *
+ * Undefined rather than a no-op: the route turns it into a named 501, because a
+ * chart that renders empty is indistinguishable from a quiet period and this is
+ * exactly the class of silence the panel it feeds exists to remove.
+ */
+export declare function createMetricsHistory(driver: DataDriver): MetricsHistory | undefined;

package/dist/metrics/history-store.d.ts

@@ -0,0 +1,123 @@
+export type Exec = (sql: string, params?: unknown[]) => Promise<unknown>;
+/** Where the samples live. Framework-owned, like `rebase.jobs`. */
+export declare const METRICS_HISTORY_TABLE = "rebase.metric_samples";
+/**
+ * How long a sample is kept.
+ *
+ * Two weeks answers "is this worse than last week" and stops well short of
+ * being an archive. Anything that needs to outlive it — billing, capacity
+ * planning — is a rollup somebody else owns, not a longer retention here.
+ *
+ * Read it as "14 days, or since this process started, whichever is longer": the
+ * sweep runs at boot and nowhere else, so a pod up for 90 days holds 90 days.
+ * That is a deliberate trade rather than an oversight — a cron for it would be
+ * machinery for a table that stays trivial either way, and reads are bounded by
+ * the index regardless — but the table does not "reach a steady size and stay
+ * there" on a long-lived pod, which an earlier version of this comment claimed.
+ */
+export declare const RETENTION_DAYS = 14;
+/** How often the process samples itself. Matched to the resolution it stores. */
+export declare const SAMPLE_INTERVAL_MS = 60000;
+/**
+ * The series this records. A closed set on purpose — see the cardinality note.
+ *
+ * A list rather than only a union, because the route validates against it: an
+ * unknown `?series=` must be a named 400 rather than an empty chart, which
+ * reads exactly like a quiet period.
+ *
+ * **It lists what `sampleSelf` actually writes, and nothing else.** It used to
+ * also name `requests_total`, `errors_total` and `event_loop_delay_ms`, none of
+ * which anything ever recorded — so those three were *valid* parameters that
+ * returned `points: []`, which is precisely the empty chart the 400 two
+ * paragraphs up exists to prevent. A declared-but-unwritten series is worse
+ * than an absent one: the 400 tells you the name is wrong, and the empty array
+ * tells you the app was quiet.
+ *
+ * `event_loop_delay_ms` kept its place by gaining a sampler, because it is the
+ * one signal here that says whether the process is *healthy* rather than how
+ * much it is using, and it has no counter semantics to get wrong.
+ *
+ * `requests_total` and `errors_total` were dropped rather than wired up. The
+ * registry does hold them, but they reset on restart, and a resetting counter
+ * summed across replicas is not monotonic — a rolling deploy would draw a
+ * cliff that looks like traffic collapsing. That needs a deliberate decision
+ * about deltas and resets, not a line added at 2am. Adding either back means
+ * adding its sampler in the same commit.
+ */
+export declare const METRIC_SERIES: readonly ["cpu_millicores", "memory_bytes", "event_loop_delay_ms"];
+export type MetricSeries = (typeof METRIC_SERIES)[number];
+export interface MetricSample {
+    at: Date;
+    series: MetricSeries;
+    value: number;
+}
+/**
+ * Create the table and sweep what has aged out.
+ *
+ * Called at boot, beside the job and cron stores, and for the same reason they
+ * do it there: the only moment the schema is guaranteed to be reachable and
+ * nobody is mid-request.
+ */
+export declare function ensureMetricsHistory(exec: Exec): Promise<void>;
+/**
+ * What this process is using right now.
+ *
+ * `process.cpuUsage()` is cumulative, so a rate needs two readings and the gap
+ * between them — which is why the previous one is threaded through rather than
+ * held in a module global: a module global is shared by every test in a file
+ * and makes the first assertion depend on whatever ran before it.
+ */
+export declare function sampleSelf(previous: {
+    cpu: NodeJS.CpuUsage;
+    at: number;
+} | null, now?: number, 
+/**
+ * Mean event-loop delay over the last window, in milliseconds, or undefined
+ * where it cannot be measured. Passed in rather than read here so this
+ * function stays pure: the histogram is a stateful handle the recorder owns.
+ */
+eventLoopDelayMs?: number): {
+    samples: Omit<MetricSample, "at">[];
+    cursor: {
+        cpu: NodeJS.CpuUsage;
+        at: number;
+    };
+};
+/**
+ * Write one tick's samples, for one instance.
+ *
+ * ## Why `instance` is part of the key
+ *
+ * A tenant's replicas share one database, and each records its OWN process. Key
+ * a row by `(series, minute)` alone and the pods overwrite each other every
+ * tick: one pod at 5m and another at 500m leave whichever wrote last, so a
+ * scaled-out tenant charts one arbitrary replica and calls it the app. Adding
+ * the instance makes each pod its own row, and lets the read decide whether the
+ * question is "the whole deployment" or "which pod is hot".
+ *
+ * Cardinality stays bounded: rows are series × replicas × minutes, and replicas
+ * are capped by the autoscaling ceiling. Six pods is ~43k rows a day and a
+ * fortnight of them is well under a million.
+ */
+export declare function recordSamples(exec: Exec, samples: Omit<MetricSample, "at">[], instance: string, at?: Date): Promise<void>;
+export interface SeriesPoint {
+    at: string;
+    /** The deployment's figure, combined per `COMBINE`. */
+    value: number;
+    /** How many instances reported in this bucket. */
+    instances: number;
+}
+/**
+ * Read one series over a window, oldest first — the order a chart draws in.
+ *
+ * Combined across instances rather than returned per-pod. A chart of "this
+ * app's CPU" is the question people ask; "which pod is hot" is answered by the
+ * live panel, which already lists instances individually and does not need
+ * history to do it.
+ *
+ * `instances` rides along because a sum whose contributor count changed is not
+ * comparable with itself: CPU doubling because the app got busy and CPU
+ * doubling because it scaled from one replica to two are different events, and
+ * a line chart alone cannot tell them apart.
+ */
+export declare function readSeries(exec: Exec, series: MetricSeries, sinceMinutes: number): Promise<SeriesPoint[]>;

package/dist/metrics/index.d.ts

@@ -1,6 +1,7 @@
 import { Hono } from "hono";
 import type { MiddlewareHandler } from "hono";
-import type { HonoEnv } from "../api/types";
+import { type MetricSeries, type SeriesPoint } from "./history-store.js";
+import type { HonoEnv } from "../api/types.js";
 /**
  * Runtime metrics, in Prometheus text format.
  *
@@ -80,4 +81,11 @@ export declare function createMetricsMiddleware(basePath?: string): MetricsHandl
  * When a token is configured it is required, and compared in constant time — a
  * timing oracle on a metrics token is a small thing, but it is free to avoid.
  */
-export declare function createMetricsRoutes(registry: MetricsRegistry, token?: string): Hono<HonoEnv>;
+export declare function createMetricsRoutes(registry: MetricsRegistry, token?: string, 
+/**
+ * Reads a stored series. Absent when the deployment keeps no history — a
+ * driver with no SQL admin, or a role that does not provision — and the
+ * route then answers 501 rather than pretending an empty chart is a quiet
+ * period.
+ */
+history?: (series: MetricSeries, sinceMinutes: number) => Promise<SeriesPoint[]>): Hono<HonoEnv>;

package/dist/{openapi-generator-BCKJRUS4.js → openapi-generator-FFGT0H6O.js}

@@ -1,8 +1,9 @@
-import { createRequire as __createRequire } from "module";
-import "process";
-__createRequire(import.meta.url);
-import { y as resolveCollectionRelations } from "./src-BPfYOeN4.js";
-import "./src-CrCxd8km.js";
+import { createRequire as __rebaseCreateRequire } from "module";
+import __rebaseProcess from "process";
+globalThis.process ??= __rebaseProcess;
+__rebaseCreateRequire(import.meta.url);
+import { y as resolveCollectionRelations } from "./src-B-CmIFMr.js";
+import "./src-Cdsw7DqV.js";
 //#region ../types/src/types/relations.ts
 /** @group Models */
 function isToMany(relation) {
@@ -503,11 +504,6 @@ function generateOpenApiSpec(collections, options = {}) {
 				}
 			},
 			patch: updateOperation(collection, schemaName, requireAuth),
-			put: {
-				...updateOperation(collection, schemaName, requireAuth),
-				operationId: `update${schemaName}ViaPut`,
-				deprecated: true
-			},
 			delete: {
 				tags: [collection.name],
 				summary: `Delete ${collection.singularName || collection.name}`,
@@ -927,4 +923,4 @@ function toPascalCase(str) {
 //#endregion
 export { generateOpenApiSpec };
 
-//# sourceMappingURL=openapi-generator-BCKJRUS4.js.map
+//# sourceMappingURL=openapi-generator-FFGT0H6O.js.map