@rebasepro/server 0.16.0 → 0.16.1-canary.g0d7af95

package/dist/query-parser--nstjRCh.js

@@ -0,0 +1,355 @@
+import { createRequire as __rebaseCreateRequire } from "module";
+import __rebaseProcess from "process";
+globalThis.process ??= __rebaseProcess;
+__rebaseCreateRequire(import.meta.url);
+import { C as ListLimitError, T as resolveClientListLimit, a as deserializeLogicalCondition, i as deserializeFilter, r as UnknownFilterOperatorError } from "./src-B-CmIFMr.js";
+import "./src-Cdsw7DqV.js";
+import { t as ApiError } from "./errors-DBwpj9N8.js";
+//#region src/api/rest/query-parser.ts
+/**
+* A malformed query parameter, refused with a 400.
+*
+* Every rejection in this file is one of these, and every one of them is
+* `expected` — the flag `errorHandler` reads to log a routine outcome at debug
+* instead of warn. A client that mistypes an operator, a sort direction or a
+* limit is not an incident: nothing on the server is wrong, the request never
+* reached the database, and the caller has already been told what to fix in the
+* response body. Left at warn, a single frontend holding a stale field name
+* writes a `⚠️` line per request forever, and the warn level stops meaning
+* anything — which is why "routine 4xx logs at WARN" is a standing finding
+* against this API.
+*
+* Not a factory on `ApiError`: the class's members are part of the tracked
+* runtime surface (`api-surface/server.api.txt`), and this needs no addition to
+* it. `ApiError.unauthenticated` is the same idea one status code up.
+*/
+function invalidParam(message, code, details) {
+	return new ApiError(400, code, message, details, true);
+}
+/**
+* Decode a filter, turning the shared codec's operator rejection into a 400.
+*
+* `deserializeFilter` lives in `@rebasepro/common`, which cannot throw an
+* `ApiError` — it does not depend on this package, and the browser SDK decodes
+* through the same function and has nothing to render one with. So it throws
+* `UnknownFilterOperatorError`, and the HTTP boundary is where that becomes a
+* status code. Same seam `parseLogicalGroup` uses for the nesting bound.
+*
+* Without this the operator string became a *value*: `?where={"title":
+* ["!!","Hello"]}` compiled to `title IN ('!!','Hello')` and answered 200 with
+* the row the caller was filtering out, and `{"id":[">>",0]}` reached Postgres
+* and came back a 500 quoting `invalid input syntax for type integer`. Both are
+* malformed requests and now say so.
+*/
+function decodeFilter(query) {
+	try {
+		return deserializeFilter(query);
+	} catch (e) {
+		if (e instanceof UnknownFilterOperatorError) throw invalidParam(e.message, e.code, e.details);
+		throw e;
+	}
+}
+function getLastValue(val) {
+	if (Array.isArray(val)) return val[val.length - 1];
+	return val;
+}
+/**
+* Parse an `or(...)` / `and(...)` logical group from its wire form.
+*
+* The wire carries the inner conditions wrapped in parens (e.g.
+* `(status.eq.active,age.gte.18)`); we re-attach the `or`/`and` prefix and
+* delegate to the canonical filter dialect (`@rebasepro/common`). Values are
+* preserved as strings — type coercion is the schema-aware driver's job, so
+* this path stays byte-for-byte consistent with the SDK/admin path (which
+* also parses via the shared dialect).
+*/
+function parseLogicalGroup(type, raw) {
+	let inner = String(raw).trim();
+	if (inner.startsWith("(") && inner.endsWith(")")) inner = inner.slice(1, -1);
+	inner = inner.trim();
+	if (!inner) return void 0;
+	let parsed;
+	try {
+		parsed = deserializeLogicalCondition(`${type}(${inner})`);
+	} catch (e) {
+		throw invalidParam(`Invalid \`${type}\` parameter: ${e instanceof Error ? e.message : String(e)}`, "INVALID_LOGICAL_GROUP");
+	}
+	return "type" in parsed ? parsed : void 0;
+}
+/**
+* Parse the `?where=` JSON filter object.
+*
+* This is the dialect the OpenAPI document publishes on every
+* `GET /api/data/{slug}` — `{"status":["==","active"]}`: field → canonical
+* `[WhereFilterOp, value]` tuple. It is normalized through the same
+* `deserializeFilter` as the `?field=op.value` params below, so a value that
+* arrives as a PostgREST dot-string (`{"status":"eq.active"}`) or as a bare
+* scalar (`{"status":"active"}`) compiles to the same condition. Unlike the
+* querystring dialect, JSON carries types — a number stays a number.
+*
+* A malformed value is a 400 rather than a silent drop: dropping the filter
+* would run the read unfiltered and return everything RLS happens to allow.
+*/
+function parseWhereParam(raw) {
+	const str = String(raw).trim();
+	if (!str) return void 0;
+	let parsed;
+	try {
+		parsed = JSON.parse(str);
+	} catch {
+		throw invalidParam("Invalid `where` parameter: expected a JSON object, e.g. {\"status\":[\"==\",\"active\"]}", "INVALID_WHERE");
+	}
+	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw invalidParam("Invalid `where` parameter: expected a JSON object mapping fields to conditions, e.g. {\"status\":[\"==\",\"active\"]}", "INVALID_WHERE");
+	const filter = decodeFilter(parsed);
+	return Object.keys(filter).length > 0 ? filter : void 0;
+}
+/**
+* The parsed entries as the driver contract spells them: `[field, direction]`
+* tuples in order of significance.
+*
+* The REST layer used to hand the driver `orderBy[0].field` and drop the rest,
+* so `?orderBy=[{"field":"roles"},{"field":"created_at","direction":"desc"}]`
+* — a shape this parser has always accepted and validated in full — sorted by
+* `roles` alone and returned the ties in whatever order Postgres pleased.
+*/
+function orderByEntriesToTuples(entries) {
+	if (!entries || entries.length === 0) return void 0;
+	return entries.map(({ field, direction }) => [field, direction]);
+}
+function invalidOrderBy(detail) {
+	throw invalidParam(`Invalid \`orderBy\` parameter: ${detail}. Expected \`field\`, \`field:desc\`, or a JSON array like [{"field":"created_at","direction":"desc"}]`, "INVALID_ORDER_BY");
+}
+/** The aggregate functions `?select=` accepts. */
+var AGGREGATE_FUNCTIONS = /* @__PURE__ */ new Set([
+	"count",
+	"sum",
+	"avg",
+	"min",
+	"max"
+]);
+/**
+* Parse `?select=count(),sum(total),avg(total)`.
+*
+* The spelling is SQL's, because whoever writes it is thinking in SQL and
+* because any other spelling has to be learned first. `count()` with no field
+* counts rows; every other function names a column.
+*
+* Aliases are derived rather than accepted: `sum(total)` returns as
+* `sum_total`, `count()` as `count`. Letting a caller choose would mean
+* checking their alias is not also a `groupBy` field — a rule nobody would
+* guess, and a silently overwritten value if it went unchecked.
+*/
+function parseAggregateSelect(raw) {
+	const value = getLastValue(raw);
+	if (!value) return void 0;
+	const entries = String(value).split(",").map((s) => s.trim()).filter(Boolean);
+	if (entries.length === 0) return void 0;
+	return entries.map((entry) => {
+		const match = /^([a-z]+)\(\s*([A-Za-z0-9_]*)\s*\)$/i.exec(entry);
+		if (!match) throw invalidParam(`Invalid \`select\` entry "${entry}". Expected \`fn(field)\`, e.g. \`sum(total)\` or \`count()\`.`, "INVALID_AGGREGATE_SELECT");
+		const fn = match[1].toLowerCase();
+		const field = match[2] || void 0;
+		if (!AGGREGATE_FUNCTIONS.has(fn)) throw invalidParam(`Unknown aggregate function "${fn}". Expected: ${[...AGGREGATE_FUNCTIONS].join(", ")}.`, "INVALID_AGGREGATE_FUNCTION");
+		if (fn !== "count" && !field) throw invalidParam(`\`${fn}()\` needs a field, e.g. \`${fn}(total)\`. Only \`count()\` may be empty.`, "INVALID_AGGREGATE_SELECT");
+		return {
+			fn,
+			field,
+			alias: field ? `${fn}_${field}` : fn
+		};
+	});
+}
+/** Parse `?groupBy=status,country`. */
+function parseGroupBy(raw) {
+	const value = getLastValue(raw);
+	if (!value) return void 0;
+	const fields = String(value).split(",").map((s) => s.trim()).filter(Boolean);
+	return fields.length > 0 ? fields : void 0;
+}
+/** `asc`/`desc`, in any case. Anything else is a request to sort in a way that does not exist. */
+function toDirection(raw, context) {
+	if (raw === void 0 || raw === null) return "asc";
+	if (typeof raw !== "string") invalidOrderBy(`${context} has a non-string \`direction\``);
+	const lowered = raw.toLowerCase();
+	if (lowered !== "asc" && lowered !== "desc") invalidOrderBy(`${context} has direction '${raw}'`);
+	return lowered;
+}
+/** One entry: the canonical `{field, direction}`, or the `field:direction` shorthand as a string. */
+function toOrderByEntry(raw, index) {
+	const context = `entry ${index}`;
+	if (typeof raw === "string") {
+		const idx = raw.indexOf(":");
+		const field = (idx === -1 ? raw : raw.slice(0, idx)).trim();
+		if (!field) invalidOrderBy(`${context} is an empty field name`);
+		return {
+			field,
+			direction: idx === -1 ? "asc" : toDirection(raw.slice(idx + 1), context)
+		};
+	}
+	if (typeof raw !== "object" || raw === null || Array.isArray(raw)) invalidOrderBy(`${context} is not a field name or a {field, direction} object`);
+	const entry = raw;
+	if (typeof entry.field !== "string" || entry.field.trim() === "") invalidOrderBy(`${context} has no \`field\``);
+	return {
+		field: entry.field,
+		direction: toDirection(entry.direction, context)
+	};
+}
+/**
+* Parse the `orderBy` query parameter.
+*
+* The field *name* has been validated against the schema for a while — an
+* `?orderBy=titel` is a 400 rather than 200 with unsorted rows, on the grounds
+* that silently dropping the sort leaves the caller believing in an order that
+* is not there. The parameter's *shape* was never checked the same way, and it
+* failed in exactly the same silent manner one layer earlier: whatever
+* `JSON.parse` returned was assigned to an option declared as an array of
+* `{field, direction}`, and the REST layer reads only `orderBy[0].field`. So
+* `?orderBy={"field":"name"}` — an object rather than an array, and the most
+* natural thing for a client to try — read `undefined`, dropped the ORDER BY,
+* and answered 200. So did a number, a boolean, `null`, and `["name"]`.
+*
+* This refuses those, the way `parseWhereParam` above already refuses a
+* malformed filter and for the same reason. What it keeps working is every
+* shape that worked before: the `field` and `field:desc` shorthands, and the
+* canonical JSON array.
+*/
+function parseOrderByParam(raw) {
+	if (Array.isArray(raw)) return raw.length === 0 ? void 0 : raw.map(toOrderByEntry);
+	const str = String(raw).trim();
+	if (!str) return void 0;
+	let parsed;
+	try {
+		parsed = JSON.parse(str);
+	} catch {
+		return [toOrderByEntry(str, 0)];
+	}
+	if (Array.isArray(parsed)) {
+		if (parsed.length === 0) return void 0;
+		return parsed.map(toOrderByEntry);
+	}
+	if (typeof parsed === "string") return [toOrderByEntry(parsed, 0)];
+	if (typeof parsed === "object" && parsed !== null) invalidOrderBy("a single object was given where a JSON array was expected");
+	invalidOrderBy(`${typeof parsed} is not a field name or a list of them`);
+}
+/**
+* {@link resolveClientListLimit} for an HTTP route: the same bounds, answered
+* with a 400 rather than a 500.
+*
+* The shared resolver throws a `ListLimitError`, which carries `status` — but
+* the Hono error handler discriminates on `statusCode`, so an unconverted one
+* reaches the client as `INTERNAL_ERROR` with its message stripped, telling the
+* caller nothing about the parameter it got wrong. Every REST list ingress
+* routes its `limit` through here so all of them name the ceiling the same way.
+*/
+function resolveListLimitParam(rawLimit, opts = {}) {
+	try {
+		return resolveClientListLimit(rawLimit, opts);
+	} catch (e) {
+		if (e instanceof ListLimitError) throw invalidParam(e.message, "INVALID_LIMIT");
+		throw e;
+	}
+}
+/**
+* Parse query parameters into QueryOptions
+*/
+function parseQueryOptions(query, limits = {}) {
+	const options = {};
+	const rawLimit = getLastValue(query.limit);
+	const offsetVal = getLastValue(query.offset);
+	if (offsetVal) options.offset = parseInt(String(offsetVal));
+	const pageVal = getLastValue(query.page);
+	if (pageVal) {
+		const page = parseInt(String(pageVal));
+		const limit = resolveListLimitParam(rawLimit, {
+			defaultLimit: limits.defaultLimit,
+			maxLimit: limits.maxLimit
+		});
+		options.offset = (page - 1) * limit;
+	}
+	const orVal = getLastValue(query.or);
+	const andVal = getLastValue(query.and);
+	if (orVal) {
+		const logical = parseLogicalGroup("or", orVal);
+		if (logical) options.logical = logical;
+	} else if (andVal) {
+		const logical = parseLogicalGroup("and", andVal);
+		if (logical) options.logical = logical;
+	}
+	const reservedQueryKeys = [
+		"limit",
+		"offset",
+		"page",
+		"orderBy",
+		"include",
+		"fields",
+		"searchString",
+		"searchExplain",
+		"vector_search",
+		"vector",
+		"vector_distance",
+		"vector_threshold",
+		"or",
+		"and",
+		"where",
+		"select",
+		"groupBy"
+	];
+	const filterDict = {};
+	for (const [key, rawValue] of Object.entries(query)) {
+		if (reservedQueryKeys.includes(key)) continue;
+		filterDict[key] = rawValue;
+	}
+	const whereVal = getLastValue(query.where);
+	const where = {
+		...whereVal !== void 0 && whereVal !== null ? parseWhereParam(whereVal) : void 0,
+		...decodeFilter(filterDict)
+	};
+	if (Object.keys(where).length > 0) options.where = where;
+	const orderByVal = getLastValue(query.orderBy);
+	if (orderByVal) options.orderBy = parseOrderByParam(orderByVal);
+	const includeVal = getLastValue(query.include);
+	if (includeVal) {
+		const includeStr = String(includeVal).trim();
+		if (includeStr === "*") options.include = ["*"];
+		else options.include = includeStr.split(",").map((s) => s.trim()).filter(Boolean);
+	}
+	const fieldsVal = getLastValue(query.fields);
+	if (fieldsVal) options.fields = String(fieldsVal).trim().split(",").map((s) => s.trim()).filter(Boolean);
+	const vectorSearchVal = getLastValue(query.vector_search);
+	const vectorVal = getLastValue(query.vector);
+	if (vectorSearchVal && vectorVal) {
+		const vectorStr = String(vectorVal);
+		let decoded;
+		try {
+			decoded = JSON.parse(vectorStr);
+		} catch {
+			decoded = void 0;
+		}
+		if (!Array.isArray(decoded) || !decoded.every((v) => typeof v === "number")) throw invalidParam("Invalid `vector` format. Expected a JSON array of numbers, e.g. [0.1,0.2,0.3]", "INVALID_VECTOR");
+		const queryVector = decoded;
+		const distanceParamVal = getLastValue(query.vector_distance);
+		const distanceParam = distanceParamVal ? String(distanceParamVal) : "cosine";
+		if (distanceParam !== "cosine" && distanceParam !== "l2" && distanceParam !== "inner_product") throw invalidParam(`Invalid \`vector_distance\`: ${distanceParam}. Expected: cosine, l2, or inner_product`, "INVALID_VECTOR_DISTANCE");
+		const vectorSearch = {
+			property: String(vectorSearchVal),
+			vector: queryVector,
+			distance: distanceParam
+		};
+		const thresholdVal = getLastValue(query.vector_threshold);
+		if (thresholdVal) {
+			const threshold = parseFloat(String(thresholdVal));
+			if (isNaN(threshold)) throw invalidParam("Invalid `vector_threshold`. Expected a number.", "INVALID_VECTOR_THRESHOLD");
+			vectorSearch.threshold = threshold;
+		}
+		options.vectorSearch = vectorSearch;
+	}
+	options.limit = resolveListLimitParam(rawLimit, {
+		vectorSearch: !!options.vectorSearch,
+		defaultLimit: limits.defaultLimit,
+		maxLimit: limits.maxLimit
+	});
+	return options;
+}
+//#endregion
+export { resolveListLimitParam as a, parseQueryOptions as i, parseAggregateSelect as n, parseGroupBy as r, orderByEntriesToTuples as t };
+
+//# sourceMappingURL=query-parser--nstjRCh.js.map

package/dist/query-parser--nstjRCh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"query-parser--nstjRCh.js","names":[],"sources":["../src/api/rest/query-parser.ts"],"sourcesContent":["import type { FilterValues, ListLimitBounds, LogicalCondition, OrderByTuple, VectorSearchParams } from \"@rebasepro/types\";\nimport { toCanonicalOp, resolveClientListLimit, ListLimitError, DEFAULT_LIST_LIMIT, MAX_LIST_LIMIT } from \"@rebasepro/types\";\nimport { deserializeFilter, deserializeLogicalCondition, UnknownFilterOperatorError } from \"@rebasepro/common\";\nimport { QueryOptions } from \"../types\";\nimport { ApiError } from \"../errors\";\n\nexport const mapOperator = (op: string) => toCanonicalOp(op) ?? null;\n\n/**\n * A malformed query parameter, refused with a 400.\n *\n * Every rejection in this file is one of these, and every one of them is\n * `expected` — the flag `errorHandler` reads to log a routine outcome at debug\n * instead of warn. A client that mistypes an operator, a sort direction or a\n * limit is not an incident: nothing on the server is wrong, the request never\n * reached the database, and the caller has already been told what to fix in the\n * response body. Left at warn, a single frontend holding a stale field name\n * writes a `⚠️` line per request forever, and the warn level stops meaning\n * anything — which is why \"routine 4xx logs at WARN\" is a standing finding\n * against this API.\n *\n * Not a factory on `ApiError`: the class's members are part of the tracked\n * runtime surface (`api-surface/server.api.txt`), and this needs no addition to\n * it. `ApiError.unauthenticated` is the same idea one status code up.\n */\nfunction invalidParam(message: string, code: string, details?: unknown): ApiError {\n    return new ApiError(400, code, message, details, true);\n}\n\n/**\n * Decode a filter, turning the shared codec's operator rejection into a 400.\n *\n * `deserializeFilter` lives in `@rebasepro/common`, which cannot throw an\n * `ApiError` — it does not depend on this package, and the browser SDK decodes\n * through the same function and has nothing to render one with. So it throws\n * `UnknownFilterOperatorError`, and the HTTP boundary is where that becomes a\n * status code. Same seam `parseLogicalGroup` uses for the nesting bound.\n *\n * Without this the operator string became a *value*: `?where={\"title\":\n * [\"!!\",\"Hello\"]}` compiled to `title IN ('!!','Hello')` and answered 200 with\n * the row the caller was filtering out, and `{\"id\":[\">>\",0]}` reached Postgres\n * and came back a 500 quoting `invalid input syntax for type integer`. Both are\n * malformed requests and now say so.\n */\nfunction decodeFilter(query: Record<string, unknown>): FilterValues<string> {\n    try {\n        return deserializeFilter(query);\n    } catch (e) {\n        if (e instanceof UnknownFilterOperatorError) {\n            throw invalidParam(e.message, e.code, e.details);\n        }\n        throw e;\n    }\n}\n\nfunction getLastValue(val: unknown): unknown {\n    if (Array.isArray(val)) {\n        return val[val.length - 1];\n    }\n    return val;\n}\n\n/**\n * Parse an `or(...)` / `and(...)` logical group from its wire form.\n *\n * The wire carries the inner conditions wrapped in parens (e.g.\n * `(status.eq.active,age.gte.18)`); we re-attach the `or`/`and` prefix and\n * delegate to the canonical filter dialect (`@rebasepro/common`). Values are\n * preserved as strings — type coercion is the schema-aware driver's job, so\n * this path stays byte-for-byte consistent with the SDK/admin path (which\n * also parses via the shared dialect).\n */\nfunction parseLogicalGroup(type: \"or\" | \"and\", raw: unknown): LogicalCondition | undefined {\n    let inner = String(raw).trim();\n    if (inner.startsWith(\"(\") && inner.endsWith(\")\")) {\n        inner = inner.slice(1, -1);\n    }\n    inner = inner.trim();\n    if (!inner) return undefined;\n    let parsed;\n    try {\n        parsed = deserializeLogicalCondition(`${type}(${inner})`);\n    } catch (e) {\n        // The parser refuses a nesting depth no real filter reaches. That is a\n        // request problem, and without this it surfaced as a 500 — the\n        // unbounded version reached `RangeError: Maximum call stack size\n        // exceeded`, which tells the caller nothing about their filter.\n        throw invalidParam(\n            `Invalid \\`${type}\\` parameter: ${e instanceof Error ? e.message : String(e)}`,\n            \"INVALID_LOGICAL_GROUP\"\n        );\n    }\n    return \"type\" in parsed ? parsed : undefined;\n}\n\n/**\n * Parse the `?where=` JSON filter object.\n *\n * This is the dialect the OpenAPI document publishes on every\n * `GET /api/data/{slug}` — `{\"status\":[\"==\",\"active\"]}`: field → canonical\n * `[WhereFilterOp, value]` tuple. It is normalized through the same\n * `deserializeFilter` as the `?field=op.value` params below, so a value that\n * arrives as a PostgREST dot-string (`{\"status\":\"eq.active\"}`) or as a bare\n * scalar (`{\"status\":\"active\"}`) compiles to the same condition. Unlike the\n * querystring dialect, JSON carries types — a number stays a number.\n *\n * A malformed value is a 400 rather than a silent drop: dropping the filter\n * would run the read unfiltered and return everything RLS happens to allow.\n */\nfunction parseWhereParam(raw: unknown): FilterValues<string> | undefined {\n    const str = String(raw).trim();\n    if (!str) return undefined;\n\n    let parsed: unknown;\n    try {\n        parsed = JSON.parse(str);\n    } catch {\n        throw invalidParam(\n            \"Invalid `where` parameter: expected a JSON object, e.g. {\\\"status\\\":[\\\"==\\\",\\\"active\\\"]}\",\n            \"INVALID_WHERE\"\n        );\n    }\n    if (typeof parsed !== \"object\" || parsed === null || Array.isArray(parsed)) {\n        throw invalidParam(\n            \"Invalid `where` parameter: expected a JSON object mapping fields to conditions, \"\n            + \"e.g. {\\\"status\\\":[\\\"==\\\",\\\"active\\\"]}\",\n            \"INVALID_WHERE\"\n        );\n    }\n\n    const filter = decodeFilter(parsed as Record<string, unknown>);\n    return Object.keys(filter).length > 0 ? filter : undefined;\n}\n\ntype OrderByEntry = { field: string; direction: \"asc\" | \"desc\" };\n\n/**\n * The parsed entries as the driver contract spells them: `[field, direction]`\n * tuples in order of significance.\n *\n * The REST layer used to hand the driver `orderBy[0].field` and drop the rest,\n * so `?orderBy=[{\"field\":\"roles\"},{\"field\":\"created_at\",\"direction\":\"desc\"}]`\n * — a shape this parser has always accepted and validated in full — sorted by\n * `roles` alone and returned the ties in whatever order Postgres pleased.\n */\nexport function orderByEntriesToTuples(entries?: OrderByEntry[]): OrderByTuple[] | undefined {\n    if (!entries || entries.length === 0) return undefined;\n    return entries.map(({ field, direction }) => [field, direction] as OrderByTuple);\n}\n\nfunction invalidOrderBy(detail: string): never {\n    throw invalidParam(\n        `Invalid \\`orderBy\\` parameter: ${detail}. Expected \\`field\\`, \\`field:desc\\`, `\n        + \"or a JSON array like [{\\\"field\\\":\\\"created_at\\\",\\\"direction\\\":\\\"desc\\\"}]\",\n        \"INVALID_ORDER_BY\"\n    );\n}\n\n/** The aggregate functions `?select=` accepts. */\nconst AGGREGATE_FUNCTIONS = new Set([\"count\", \"sum\", \"avg\", \"min\", \"max\"]);\n\nexport interface ParsedAggregate {\n    fn: \"count\" | \"sum\" | \"avg\" | \"min\" | \"max\";\n    /** Absent only for `count()`, which counts rows rather than values. */\n    field?: string;\n    /** The key this appears under in the response. */\n    alias: string;\n}\n\n/**\n * Parse `?select=count(),sum(total),avg(total)`.\n *\n * The spelling is SQL's, because whoever writes it is thinking in SQL and\n * because any other spelling has to be learned first. `count()` with no field\n * counts rows; every other function names a column.\n *\n * Aliases are derived rather than accepted: `sum(total)` returns as\n * `sum_total`, `count()` as `count`. Letting a caller choose would mean\n * checking their alias is not also a `groupBy` field — a rule nobody would\n * guess, and a silently overwritten value if it went unchecked.\n */\nexport function parseAggregateSelect(raw: unknown): ParsedAggregate[] | undefined {\n    const value = getLastValue(raw);\n    if (!value) return undefined;\n\n    const entries = String(value).split(\",\").map(s => s.trim()).filter(Boolean);\n    if (entries.length === 0) return undefined;\n\n    return entries.map((entry) => {\n        const match = /^([a-z]+)\\(\\s*([A-Za-z0-9_]*)\\s*\\)$/i.exec(entry);\n        if (!match) {\n            throw invalidParam(\n                `Invalid \\`select\\` entry \"${entry}\". Expected \\`fn(field)\\`, e.g. \\`sum(total)\\` or \\`count()\\`.`,\n                \"INVALID_AGGREGATE_SELECT\"\n            );\n        }\n\n        const fn = match[1].toLowerCase();\n        const field = match[2] || undefined;\n\n        if (!AGGREGATE_FUNCTIONS.has(fn)) {\n            throw invalidParam(\n                `Unknown aggregate function \"${fn}\". Expected: ${[...AGGREGATE_FUNCTIONS].join(\", \")}.`,\n                \"INVALID_AGGREGATE_FUNCTION\"\n            );\n        }\n        if (fn !== \"count\" && !field) {\n            // `sum()` has no sensible reading, and guessing one would be\n            // inventing a column on the caller's behalf.\n            throw invalidParam(\n                `\\`${fn}()\\` needs a field, e.g. \\`${fn}(total)\\`. Only \\`count()\\` may be empty.`,\n                \"INVALID_AGGREGATE_SELECT\"\n            );\n        }\n\n        return {\n            fn: fn as ParsedAggregate[\"fn\"],\n            field,\n            alias: field ? `${fn}_${field}` : fn\n        };\n    });\n}\n\n/** Parse `?groupBy=status,country`. */\nexport function parseGroupBy(raw: unknown): string[] | undefined {\n    const value = getLastValue(raw);\n    if (!value) return undefined;\n    const fields = String(value).split(\",\").map(s => s.trim()).filter(Boolean);\n    return fields.length > 0 ? fields : undefined;\n}\n\n/** `asc`/`desc`, in any case. Anything else is a request to sort in a way that does not exist. */\nfunction toDirection(raw: unknown, context: string): \"asc\" | \"desc\" {\n    if (raw === undefined || raw === null) return \"asc\";\n    if (typeof raw !== \"string\") invalidOrderBy(`${context} has a non-string \\`direction\\``);\n    const lowered = raw.toLowerCase();\n    if (lowered !== \"asc\" && lowered !== \"desc\") {\n        invalidOrderBy(`${context} has direction '${raw}'`);\n    }\n    return lowered;\n}\n\n/** One entry: the canonical `{field, direction}`, or the `field:direction` shorthand as a string. */\nfunction toOrderByEntry(raw: unknown, index: number): OrderByEntry {\n    const context = `entry ${index}`;\n    if (typeof raw === \"string\") {\n        // Split here rather than through `deserializeOrderBy`, which is the\n        // *client* end of the codec and normalises anything that is not\n        // literally \"desc\" to \"asc\". Routed through it, `?orderBy=x:DESC`\n        // reached `toDirection` already collapsed to \"asc\" and answered 200\n        // with the rows in the opposite order — a newest-first list showing\n        // the oldest rows — and `x:sideways` did the same. The direction token\n        // has to arrive here raw for `toDirection` to have anything to refuse.\n        const idx = raw.indexOf(\":\");\n        const field = (idx === -1 ? raw : raw.slice(0, idx)).trim();\n        if (!field) invalidOrderBy(`${context} is an empty field name`);\n        return { field, direction: idx === -1 ? \"asc\" : toDirection(raw.slice(idx + 1), context) };\n    }\n    if (typeof raw !== \"object\" || raw === null || Array.isArray(raw)) {\n        invalidOrderBy(`${context} is not a field name or a {field, direction} object`);\n    }\n    const entry = raw as Record<string, unknown>;\n    if (typeof entry.field !== \"string\" || entry.field.trim() === \"\") {\n        invalidOrderBy(`${context} has no \\`field\\``);\n    }\n    return { field: entry.field, direction: toDirection(entry.direction, context) };\n}\n\n/**\n * Parse the `orderBy` query parameter.\n *\n * The field *name* has been validated against the schema for a while — an\n * `?orderBy=titel` is a 400 rather than 200 with unsorted rows, on the grounds\n * that silently dropping the sort leaves the caller believing in an order that\n * is not there. The parameter's *shape* was never checked the same way, and it\n * failed in exactly the same silent manner one layer earlier: whatever\n * `JSON.parse` returned was assigned to an option declared as an array of\n * `{field, direction}`, and the REST layer reads only `orderBy[0].field`. So\n * `?orderBy={\"field\":\"name\"}` — an object rather than an array, and the most\n * natural thing for a client to try — read `undefined`, dropped the ORDER BY,\n * and answered 200. So did a number, a boolean, `null`, and `[\"name\"]`.\n *\n * This refuses those, the way `parseWhereParam` above already refuses a\n * malformed filter and for the same reason. What it keeps working is every\n * shape that worked before: the `field` and `field:desc` shorthands, and the\n * canonical JSON array.\n */\nfunction parseOrderByParam(raw: unknown): OrderByEntry[] | undefined {\n    if (Array.isArray(raw)) {\n        // A repeated query parameter arrives pre-split; treat it as the list.\n        return raw.length === 0 ? undefined : raw.map(toOrderByEntry);\n    }\n\n    const str = String(raw).trim();\n    if (!str) return undefined;\n\n    let parsed: unknown;\n    try {\n        parsed = JSON.parse(str);\n    } catch {\n        // Not JSON at all, so it is the `field:direction` shorthand.\n        return [toOrderByEntry(str, 0)];\n    }\n\n    // `JSON.parse` succeeding says nothing about the shape being usable.\n    if (Array.isArray(parsed)) {\n        if (parsed.length === 0) return undefined;\n        return parsed.map(toOrderByEntry);\n    }\n    if (typeof parsed === \"string\") return [toOrderByEntry(parsed, 0)];\n    if (typeof parsed === \"object\" && parsed !== null) {\n        // A bare `{field, direction}` is a near miss rather than nonsense, but\n        // accepting it would leave two spellings of one parameter. Name it.\n        invalidOrderBy(\"a single object was given where a JSON array was expected\");\n    }\n    invalidOrderBy(`${typeof parsed} is not a field name or a list of them`);\n}\n\n// Re-exported for callers/tests that reference the REST list bounds. The\n// numbers and the rule live in `@rebasepro/types` so the REST parser and the\n// WebSocket ingress enforce ONE shared guarantee. See `resolveClientListLimit`.\nexport { DEFAULT_LIST_LIMIT, DEFAULT_VECTOR_LIST_LIMIT, MAX_LIST_LIMIT } from \"@rebasepro/types\";\n\n/**\n * Overridable list-pagination bounds for {@link parseQueryOptions}. Without\n * these, `GET /<collection>` with no `?limit` would buffer the ENTIRE table\n * into a JS array + JSON response (a trivial OOM/DoS), and `?limit=100000000`\n * would be honoured verbatim.\n */\nexport interface ListLimitOptions {\n    /**\n     * Page size used when the client sends no `?limit`. Applied to plain and\n     * text-search reads — a vector search falls back to its own default (10).\n     */\n    defaultLimit?: number;\n    /** Largest `?limit` a client may ask for. A larger one is a 400, not a clamp. */\n    maxLimit?: number;\n}\n\n/**\n * {@link resolveClientListLimit} for an HTTP route: the same bounds, answered\n * with a 400 rather than a 500.\n *\n * The shared resolver throws a `ListLimitError`, which carries `status` — but\n * the Hono error handler discriminates on `statusCode`, so an unconverted one\n * reaches the client as `INTERNAL_ERROR` with its message stripped, telling the\n * caller nothing about the parameter it got wrong. Every REST list ingress\n * routes its `limit` through here so all of them name the ceiling the same way.\n */\nexport function resolveListLimitParam(\n    rawLimit: number | string | null | undefined,\n    opts: ListLimitBounds & { vectorSearch?: boolean } = {}\n): number {\n    try {\n        return resolveClientListLimit(rawLimit, opts);\n    } catch (e) {\n        if (e instanceof ListLimitError) {\n            throw invalidParam(e.message, \"INVALID_LIMIT\");\n        }\n        throw e;\n    }\n}\n\n/**\n * Parse query parameters into QueryOptions\n */\nexport function parseQueryOptions(\n    query: Record<string, unknown>,\n    limits: ListLimitOptions = {}\n): QueryOptions {\n    const options: QueryOptions = {};\n    const rawLimit = getLastValue(query.limit) as number | string | null | undefined;\n\n    const offsetVal = getLastValue(query.offset);\n    if (offsetVal) options.offset = parseInt(String(offsetVal));\n\n    const pageVal = getLastValue(query.page);\n    if (pageVal) {\n        const page = parseInt(String(pageVal));\n        // Page stride uses the same bounded page size the read will use, so\n        // pages neither overlap nor gap. (Vector search never paginates by\n        // page, so the plain/text default is correct here.)\n        const limit = resolveListLimitParam(rawLimit, {\n            defaultLimit: limits.defaultLimit,\n            maxLimit: limits.maxLimit\n        });\n        options.offset = (page - 1) * limit;\n    }\n\n    // ── Logical conditions (or / and) ──────────────────────────────────\n    const orVal = getLastValue(query.or);\n    const andVal = getLastValue(query.and);\n    if (orVal) {\n        const logical = parseLogicalGroup(\"or\", orVal);\n        if (logical) options.logical = logical;\n    } else if (andVal) {\n        const logical = parseLogicalGroup(\"and\", andVal);\n        if (logical) options.logical = logical;\n    }\n\n    // ── PostgREST-style field filters: ?field=op.value ─────────────────\n    // Delegate to the canonical filter dialect (the single source of truth\n    // for the wire grammar: operator codes, list/escape handling, implicit\n    // eq). Values stay strings; the schema-aware driver coerces them to\n    // column types. This keeps the REST path byte-for-byte consistent with\n    // the SDK/admin path, which parses through the same `deserializeFilter`.\n    //\n    // `where` is reserved: it is the JSON filter dialect (see\n    // `parseWhereParam`), not a column named \"where\". Leaving it out of this\n    // list made the documented `?where={...}` compile as a filter on a\n    // nonexistent field — which used to be dropped, widening the read to the\n    // whole table, and is now a 400 `UNKNOWN_FILTER_FIELD`.\n    //\n    // `select` and `groupBy` are reserved for the same reason: on\n    // `/aggregate` they are the request, and left out of this list\n    // `?select=sum(total)` compiles into the filter as a comparison on a\n    // column named \"select\" — a 400 on the one endpoint that requires it.\n    const reservedQueryKeys = [\"limit\", \"offset\", \"page\", \"orderBy\", \"include\", \"fields\", \"searchString\", \"searchExplain\", \"vector_search\", \"vector\", \"vector_distance\", \"vector_threshold\", \"or\", \"and\", \"where\", \"select\", \"groupBy\"];\n    const filterDict: Record<string, unknown> = {};\n    for (const [key, rawValue] of Object.entries(query)) {\n        if (reservedQueryKeys.includes(key)) continue;\n        filterDict[key] = rawValue;\n    }\n    // Both dialects may be sent together; an explicit `?field=op.value` wins\n    // over the same field inside `where`, being the more specific request.\n    const whereVal = getLastValue(query.where);\n    const where = {\n        ...(whereVal !== undefined && whereVal !== null ? parseWhereParam(whereVal) : undefined),\n        ...decodeFilter(filterDict)\n    };\n    if (Object.keys(where).length > 0) {\n        options.where = where;\n    }\n\n    // Sorting\n    const orderByVal = getLastValue(query.orderBy);\n    if (orderByVal) {\n        options.orderBy = parseOrderByParam(orderByVal);\n    }\n\n    // Relation includes\n    const includeVal = getLastValue(query.include);\n    if (includeVal) {\n        const includeStr = String(includeVal).trim();\n        if (includeStr === \"*\") {\n            options.include = [\"*\"];\n        } else {\n            options.include = includeStr.split(\",\").map(s => s.trim()).filter(Boolean);\n        }\n    }\n\n    // Field selection\n    const fieldsVal = getLastValue(query.fields);\n    if (fieldsVal) {\n        const fieldsStr = String(fieldsVal).trim();\n        options.fields = fieldsStr.split(\",\").map(s => s.trim()).filter(Boolean);\n    }\n\n    // ── Vector similarity search ───────────────────────────────────────\n    // Every rejection here is a malformed *request*, so it must carry a 400.\n    // A bare `Error` reaches the handler with no `statusCode` and no known\n    // `code`, which makes it a 500 — logged with a full stack as an incident,\n    // and answered with \"An unexpected error occurred\", because the handler\n    // only forwards a message to the client below 500. The caller was told\n    // nothing about what it got wrong.\n    const vectorSearchVal = getLastValue(query.vector_search);\n    const vectorVal = getLastValue(query.vector);\n    if (vectorSearchVal && vectorVal) {\n        const vectorStr = String(vectorVal);\n        let decoded: unknown;\n        try {\n            decoded = JSON.parse(vectorStr);\n        } catch {\n            decoded = undefined;\n        }\n        // Validated outside the `try` on purpose: inside it, the thrown\n        // ApiError would be caught by its own `catch` and re-thrown as\n        // something else.\n        if (!Array.isArray(decoded) || !decoded.every(v => typeof v === \"number\")) {\n            throw invalidParam(\n                \"Invalid `vector` format. Expected a JSON array of numbers, e.g. [0.1,0.2,0.3]\",\n                \"INVALID_VECTOR\"\n            );\n        }\n        const queryVector = decoded as number[];\n\n        const distanceParamVal = getLastValue(query.vector_distance);\n        const distanceParam = distanceParamVal ? String(distanceParamVal) : \"cosine\";\n        if (distanceParam !== \"cosine\" && distanceParam !== \"l2\" && distanceParam !== \"inner_product\") {\n            throw invalidParam(\n                `Invalid \\`vector_distance\\`: ${distanceParam}. Expected: cosine, l2, or inner_product`,\n                \"INVALID_VECTOR_DISTANCE\"\n            );\n        }\n\n        const vectorSearch: VectorSearchParams = {\n            property: String(vectorSearchVal),\n            vector: queryVector,\n            distance: distanceParam\n        };\n\n        const thresholdVal = getLastValue(query.vector_threshold);\n        if (thresholdVal) {\n            const threshold = parseFloat(String(thresholdVal));\n            if (isNaN(threshold)) {\n                throw invalidParam(\n                    \"Invalid `vector_threshold`. Expected a number.\",\n                    \"INVALID_VECTOR_THRESHOLD\"\n                );\n            }\n            vectorSearch.threshold = threshold;\n        }\n\n        options.vectorSearch = vectorSearch;\n    }\n\n    // Resolve the limit LAST — once we know whether this is a vector search —\n    // so a client-supplied limit above the ceiling is refused with a 400 and an\n    // absent one falls back to the correct mode default (plain/text =\n    // defaultLimit, vector = 10). Without this a bare `GET /<collection>` would\n    // return the whole table. Shared with the WebSocket ingress via\n    // `resolveClientListLimit`.\n    options.limit = resolveListLimitParam(rawLimit, {\n        vectorSearch: !!options.vectorSearch,\n        defaultLimit: limits.defaultLimit,\n        maxLimit: limits.maxLimit\n    });\n\n    return options;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAyBA,SAAS,aAAa,SAAiB,MAAc,SAA6B;CAC9E,OAAO,IAAI,SAAS,KAAK,MAAM,SAAS,SAAS,IAAI;AACzD;;;;;;;;;;;;;;;;AAiBA,SAAS,aAAa,OAAsD;CACxE,IAAI;EACA,OAAO,kBAAkB,KAAK;CAClC,SAAS,GAAG;EACR,IAAI,aAAa,4BACb,MAAM,aAAa,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO;EAEnD,MAAM;CACV;AACJ;AAEA,SAAS,aAAa,KAAuB;CACzC,IAAI,MAAM,QAAQ,GAAG,GACjB,OAAO,IAAI,IAAI,SAAS;CAE5B,OAAO;AACX;;;;;;;;;;;AAYA,SAAS,kBAAkB,MAAoB,KAA4C;CACvF,IAAI,QAAQ,OAAO,GAAG,CAAC,CAAC,KAAK;CAC7B,IAAI,MAAM,WAAW,GAAG,KAAK,MAAM,SAAS,GAAG,GAC3C,QAAQ,MAAM,MAAM,GAAG,EAAE;CAE7B,QAAQ,MAAM,KAAK;CACnB,IAAI,CAAC,OAAO,OAAO,KAAA;CACnB,IAAI;CACJ,IAAI;EACA,SAAS,4BAA4B,GAAG,KAAK,GAAG,MAAM,EAAE;CAC5D,SAAS,GAAG;EAKR,MAAM,aACF,aAAa,KAAK,gBAAgB,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC,KAC3E,uBACJ;CACJ;CACA,OAAO,UAAU,SAAS,SAAS,KAAA;AACvC;;;;;;;;;;;;;;;AAgBA,SAAS,gBAAgB,KAAgD;CACrE,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK;CAC7B,IAAI,CAAC,KAAK,OAAO,KAAA;CAEjB,IAAI;CACJ,IAAI;EACA,SAAS,KAAK,MAAM,GAAG;CAC3B,QAAQ;EACJ,MAAM,aACF,4FACA,eACJ;CACJ;CACA,IAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,MAAM,QAAQ,MAAM,GACrE,MAAM,aACF,yHAEA,eACJ;CAGJ,MAAM,SAAS,aAAa,MAAiC;CAC7D,OAAO,OAAO,KAAK,MAAM,CAAC,CAAC,SAAS,IAAI,SAAS,KAAA;AACrD;;;;;;;;;;AAaA,SAAgB,uBAAuB,SAAsD;CACzF,IAAI,CAAC,WAAW,QAAQ,WAAW,GAAG,OAAO,KAAA;CAC7C,OAAO,QAAQ,KAAK,EAAE,OAAO,gBAAgB,CAAC,OAAO,SAAS,CAAiB;AACnF;AAEA,SAAS,eAAe,QAAuB;CAC3C,MAAM,aACF,kCAAkC,OAAO,yGAEzC,kBACJ;AACJ;;AAGA,IAAM,sCAAsB,IAAI,IAAI;CAAC;CAAS;CAAO;CAAO;CAAO;AAAK,CAAC;;;;;;;;;;;;;AAsBzE,SAAgB,qBAAqB,KAA6C;CAC9E,MAAM,QAAQ,aAAa,GAAG;CAC9B,IAAI,CAAC,OAAO,OAAO,KAAA;CAEnB,MAAM,UAAU,OAAO,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,KAAI,MAAK,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,OAAO;CAC1E,IAAI,QAAQ,WAAW,GAAG,OAAO,KAAA;CAEjC,OAAO,QAAQ,KAAK,UAAU;EAC1B,MAAM,QAAQ,uCAAuC,KAAK,KAAK;EAC/D,IAAI,CAAC,OACD,MAAM,aACF,6BAA6B,MAAM,iEACnC,0BACJ;EAGJ,MAAM,KAAK,MAAM,EAAE,CAAC,YAAY;EAChC,MAAM,QAAQ,MAAM,MAAM,KAAA;EAE1B,IAAI,CAAC,oBAAoB,IAAI,EAAE,GAC3B,MAAM,aACF,+BAA+B,GAAG,eAAe,CAAC,GAAG,mBAAmB,CAAC,CAAC,KAAK,IAAI,EAAE,IACrF,4BACJ;EAEJ,IAAI,OAAO,WAAW,CAAC,OAGnB,MAAM,aACF,KAAK,GAAG,6BAA6B,GAAG,4CACxC,0BACJ;EAGJ,OAAO;GACC;GACJ;GACA,OAAO,QAAQ,GAAG,GAAG,GAAG,UAAU;EACtC;CACJ,CAAC;AACL;;AAGA,SAAgB,aAAa,KAAoC;CAC7D,MAAM,QAAQ,aAAa,GAAG;CAC9B,IAAI,CAAC,OAAO,OAAO,KAAA;CACnB,MAAM,SAAS,OAAO,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,KAAI,MAAK,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,OAAO;CACzE,OAAO,OAAO,SAAS,IAAI,SAAS,KAAA;AACxC;;AAGA,SAAS,YAAY,KAAc,SAAiC;CAChE,IAAI,QAAQ,KAAA,KAAa,QAAQ,MAAM,OAAO;CAC9C,IAAI,OAAO,QAAQ,UAAU,eAAe,GAAG,QAAQ,gCAAgC;CACvF,MAAM,UAAU,IAAI,YAAY;CAChC,IAAI,YAAY,SAAS,YAAY,QACjC,eAAe,GAAG,QAAQ,kBAAkB,IAAI,EAAE;CAEtD,OAAO;AACX;;AAGA,SAAS,eAAe,KAAc,OAA6B;CAC/D,MAAM,UAAU,SAAS;CACzB,IAAI,OAAO,QAAQ,UAAU;EAQzB,MAAM,MAAM,IAAI,QAAQ,GAAG;EAC3B,MAAM,SAAS,QAAQ,KAAK,MAAM,IAAI,MAAM,GAAG,GAAG,EAAA,CAAG,KAAK;EAC1D,IAAI,CAAC,OAAO,eAAe,GAAG,QAAQ,wBAAwB;EAC9D,OAAO;GAAE;GAAO,WAAW,QAAQ,KAAK,QAAQ,YAAY,IAAI,MAAM,MAAM,CAAC,GAAG,OAAO;EAAE;CAC7F;CACA,IAAI,OAAO,QAAQ,YAAY,QAAQ,QAAQ,MAAM,QAAQ,GAAG,GAC5D,eAAe,GAAG,QAAQ,oDAAoD;CAElF,MAAM,QAAQ;CACd,IAAI,OAAO,MAAM,UAAU,YAAY,MAAM,MAAM,KAAK,MAAM,IAC1D,eAAe,GAAG,QAAQ,kBAAkB;CAEhD,OAAO;EAAE,OAAO,MAAM;EAAO,WAAW,YAAY,MAAM,WAAW,OAAO;CAAE;AAClF;;;;;;;;;;;;;;;;;;;;AAqBA,SAAS,kBAAkB,KAA0C;CACjE,IAAI,MAAM,QAAQ,GAAG,GAEjB,OAAO,IAAI,WAAW,IAAI,KAAA,IAAY,IAAI,IAAI,cAAc;CAGhE,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK;CAC7B,IAAI,CAAC,KAAK,OAAO,KAAA;CAEjB,IAAI;CACJ,IAAI;EACA,SAAS,KAAK,MAAM,GAAG;CAC3B,QAAQ;EAEJ,OAAO,CAAC,eAAe,KAAK,CAAC,CAAC;CAClC;CAGA,IAAI,MAAM,QAAQ,MAAM,GAAG;EACvB,IAAI,OAAO,WAAW,GAAG,OAAO,KAAA;EAChC,OAAO,OAAO,IAAI,cAAc;CACpC;CACA,IAAI,OAAO,WAAW,UAAU,OAAO,CAAC,eAAe,QAAQ,CAAC,CAAC;CACjE,IAAI,OAAO,WAAW,YAAY,WAAW,MAGzC,eAAe,2DAA2D;CAE9E,eAAe,GAAG,OAAO,OAAO,uCAAuC;AAC3E;;;;;;;;;;;AAiCA,SAAgB,sBACZ,UACA,OAAqD,CAAC,GAChD;CACN,IAAI;EACA,OAAO,uBAAuB,UAAU,IAAI;CAChD,SAAS,GAAG;EACR,IAAI,aAAa,gBACb,MAAM,aAAa,EAAE,SAAS,eAAe;EAEjD,MAAM;CACV;AACJ;;;;AAKA,SAAgB,kBACZ,OACA,SAA2B,CAAC,GAChB;CACZ,MAAM,UAAwB,CAAC;CAC/B,MAAM,WAAW,aAAa,MAAM,KAAK;CAEzC,MAAM,YAAY,aAAa,MAAM,MAAM;CAC3C,IAAI,WAAW,QAAQ,SAAS,SAAS,OAAO,SAAS,CAAC;CAE1D,MAAM,UAAU,aAAa,MAAM,IAAI;CACvC,IAAI,SAAS;EACT,MAAM,OAAO,SAAS,OAAO,OAAO,CAAC;EAIrC,MAAM,QAAQ,sBAAsB,UAAU;GAC1C,cAAc,OAAO;GACrB,UAAU,OAAO;EACrB,CAAC;EACD,QAAQ,UAAU,OAAO,KAAK;CAClC;CAGA,MAAM,QAAQ,aAAa,MAAM,EAAE;CACnC,MAAM,SAAS,aAAa,MAAM,GAAG;CACrC,IAAI,OAAO;EACP,MAAM,UAAU,kBAAkB,MAAM,KAAK;EAC7C,IAAI,SAAS,QAAQ,UAAU;CACnC,OAAO,IAAI,QAAQ;EACf,MAAM,UAAU,kBAAkB,OAAO,MAAM;EAC/C,IAAI,SAAS,QAAQ,UAAU;CACnC;CAmBA,MAAM,oBAAoB;EAAC;EAAS;EAAU;EAAQ;EAAW;EAAW;EAAU;EAAgB;EAAiB;EAAiB;EAAU;EAAmB;EAAoB;EAAM;EAAO;EAAS;EAAU;CAAS;CAClO,MAAM,aAAsC,CAAC;CAC7C,KAAK,MAAM,CAAC,KAAK,aAAa,OAAO,QAAQ,KAAK,GAAG;EACjD,IAAI,kBAAkB,SAAS,GAAG,GAAG;EACrC,WAAW,OAAO;CACtB;CAGA,MAAM,WAAW,aAAa,MAAM,KAAK;CACzC,MAAM,QAAQ;EACV,GAAI,aAAa,KAAA,KAAa,aAAa,OAAO,gBAAgB,QAAQ,IAAI,KAAA;EAC9E,GAAG,aAAa,UAAU;CAC9B;CACA,IAAI,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,GAC5B,QAAQ,QAAQ;CAIpB,MAAM,aAAa,aAAa,MAAM,OAAO;CAC7C,IAAI,YACA,QAAQ,UAAU,kBAAkB,UAAU;CAIlD,MAAM,aAAa,aAAa,MAAM,OAAO;CAC7C,IAAI,YAAY;EACZ,MAAM,aAAa,OAAO,UAAU,CAAC,CAAC,KAAK;EAC3C,IAAI,eAAe,KACf,QAAQ,UAAU,CAAC,GAAG;OAEtB,QAAQ,UAAU,WAAW,MAAM,GAAG,CAAC,CAAC,KAAI,MAAK,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,OAAO;CAEjF;CAGA,MAAM,YAAY,aAAa,MAAM,MAAM;CAC3C,IAAI,WAEA,QAAQ,SADU,OAAO,SAAS,CAAC,CAAC,KACnB,CAAA,CAAU,MAAM,GAAG,CAAC,CAAC,KAAI,MAAK,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,OAAO;CAU3E,MAAM,kBAAkB,aAAa,MAAM,aAAa;CACxD,MAAM,YAAY,aAAa,MAAM,MAAM;CAC3C,IAAI,mBAAmB,WAAW;EAC9B,MAAM,YAAY,OAAO,SAAS;EAClC,IAAI;EACJ,IAAI;GACA,UAAU,KAAK,MAAM,SAAS;EAClC,QAAQ;GACJ,UAAU,KAAA;EACd;EAIA,IAAI,CAAC,MAAM,QAAQ,OAAO,KAAK,CAAC,QAAQ,OAAM,MAAK,OAAO,MAAM,QAAQ,GACpE,MAAM,aACF,iFACA,gBACJ;EAEJ,MAAM,cAAc;EAEpB,MAAM,mBAAmB,aAAa,MAAM,eAAe;EAC3D,MAAM,gBAAgB,mBAAmB,OAAO,gBAAgB,IAAI;EACpE,IAAI,kBAAkB,YAAY,kBAAkB,QAAQ,kBAAkB,iBAC1E,MAAM,aACF,gCAAgC,cAAc,2CAC9C,yBACJ;EAGJ,MAAM,eAAmC;GACrC,UAAU,OAAO,eAAe;GAChC,QAAQ;GACR,UAAU;EACd;EAEA,MAAM,eAAe,aAAa,MAAM,gBAAgB;EACxD,IAAI,cAAc;GACd,MAAM,YAAY,WAAW,OAAO,YAAY,CAAC;GACjD,IAAI,MAAM,SAAS,GACf,MAAM,aACF,kDACA,0BACJ;GAEJ,aAAa,YAAY;EAC7B;EAEA,QAAQ,eAAe;CAC3B;CAQA,QAAQ,QAAQ,sBAAsB,UAAU;EAC5C,cAAc,CAAC,CAAC,QAAQ;EACxB,cAAc,OAAO;EACrB,UAAU,OAAO;CACrB,CAAC;CAED,OAAO;AACX"}

package/dist/{request-timeout-BuFoEKwT.js → request-timeout-C8gkc-j7.js}

@@ -1,8 +1,15 @@
-import { createRequire as __createRequire } from "module";
-import process from "process";
-__createRequire(import.meta.url);
-import { t as logger } from "./logger-DfvF_8r-.js";
+import { createRequire as __rebaseCreateRequire } from "module";
+import __rebaseProcess from "process";
+globalThis.process ??= __rebaseProcess;
+__rebaseCreateRequire(import.meta.url);
+import { n as __exportAll } from "./rolldown-runtime-dW7B1o5h.js";
+import { t as logger } from "./logger-DS03e908.js";
 //#region src/functions/request-timeout.ts
+var request_timeout_exports = /* @__PURE__ */ __exportAll({
+	DEFAULT_FUNCTIONS_TIMEOUT_MS: () => DEFAULT_FUNCTIONS_TIMEOUT_MS,
+	createFunctionsRequestTimeout: () => createFunctionsRequestTimeout,
+	resolveFunctionsTimeoutMs: () => resolveFunctionsTimeoutMs
+});
 /** Default ceiling for a custom function request, in milliseconds. */
 var DEFAULT_FUNCTIONS_TIMEOUT_MS = 3e4;
 /**
@@ -39,6 +46,14 @@ function resolveFunctionsTimeoutMs(configured) {
 * eventual result is dropped. It is a ceiling, not a kill switch, and the exact
 * number matters far less than its existence.
 *
+* "The handler keeps running" is a **Node** guarantee, not a property of the
+* contract. It follows from the process outliving the request, which is not
+* true on an isolate-based host: there, work still in flight when the response
+* resolves is terminated rather than orphaned. So a handler must not depend on
+* finishing after its 504 — anything that has to complete belongs in
+* `waitUntil()`, which is the one construct both hosts honour. See
+* `./wait-until.ts`.
+*
 * Mounted in front of the auth middleware rather than behind it, so a wedged
 * driver — the failure that also hangs `withAuth()` — is covered too.
 */
@@ -63,6 +78,6 @@ function createFunctionsRequestTimeout(ms) {
 	};
 }
 //#endregion
-export { createFunctionsRequestTimeout, resolveFunctionsTimeoutMs };
+export { request_timeout_exports as t };
 
-//# sourceMappingURL=request-timeout-BuFoEKwT.js.map
+//# sourceMappingURL=request-timeout-C8gkc-j7.js.map

package/dist/request-timeout-C8gkc-j7.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-timeout-C8gkc-j7.js","names":[],"sources":["../src/functions/request-timeout.ts"],"sourcesContent":["import type { MiddlewareHandler } from \"hono\";\nimport type { HonoEnv } from \"../api/types\";\nimport { logger } from \"../utils/logger\";\n\n/** Default ceiling for a custom function request, in milliseconds. */\nexport const DEFAULT_FUNCTIONS_TIMEOUT_MS = 30_000;\n\n/**\n * Resolve the functions request timeout from config, then env, then the default.\n *\n * `0` (or any non-positive number) disables the ceiling — for a deployment\n * whose proxy already imposes one, or a function that legitimately streams for\n * minutes.\n */\nexport function resolveFunctionsTimeoutMs(configured?: number): number {\n    if (typeof configured === \"number\" && Number.isFinite(configured)) {\n        return Math.max(0, Math.floor(configured));\n    }\n    // Blank means unset, not zero. `Number(\"\")` and `Number(\" \")` are both 0,\n    // and 0 here means \"no ceiling\" — so a compose file with\n    // `REBASE_FUNCTIONS_TIMEOUT_MS=${SOMETHING}` and `SOMETHING` undefined, or\n    // a `.env` line with the name and no value, silently switched off the one\n    // bound on how long code the framework did not write may hold a socket.\n    // Declaring a variable without setting it is the ordinary way to write\n    // both of those files, and the failure is invisible: nothing logs, and the\n    // deployment behaves exactly as it did before the ceiling existed.\n    const raw = process.env.REBASE_FUNCTIONS_TIMEOUT_MS?.trim();\n    if (raw) {\n        const fromEnv = Number(raw);\n        if (Number.isFinite(fromEnv) && fromEnv >= 0) {\n            return Math.floor(fromEnv);\n        }\n    }\n    return DEFAULT_FUNCTIONS_TIMEOUT_MS;\n}\n\n/**\n * A per-request ceiling for the custom functions router.\n *\n * Custom functions are the one router that runs code the framework did not\n * write, and nothing else in the stack bounds how long that code takes: the\n * Node server is constructed without `requestTimeout`/`headersTimeout`, so a\n * handler awaiting a promise that never settles — a `fetch` to an unreachable\n * third party with no `AbortSignal`, a query on a wedged connection — holds its\n * socket and its request object until the client gives up. On the managed\n * runtime the process is shared between tenants, so that is not only the slow\n * caller's problem.\n *\n * The handler is **not** cancelled — it cannot be, there is no cancellation\n * token to hand user code. What is bounded is the client-visible request: after\n * `ms` the caller gets a 504 and the socket is released, and the handler's\n * eventual result is dropped. It is a ceiling, not a kill switch, and the exact\n * number matters far less than its existence.\n *\n * \"The handler keeps running\" is a **Node** guarantee, not a property of the\n * contract. It follows from the process outliving the request, which is not\n * true on an isolate-based host: there, work still in flight when the response\n * resolves is terminated rather than orphaned. So a handler must not depend on\n * finishing after its 504 — anything that has to complete belongs in\n * `waitUntil()`, which is the one construct both hosts honour. See\n * `./wait-until.ts`.\n *\n * Mounted in front of the auth middleware rather than behind it, so a wedged\n * driver — the failure that also hangs `withAuth()` — is covered too.\n */\nexport function createFunctionsRequestTimeout(ms: number): MiddlewareHandler<HonoEnv> {\n    return async (c, next) => {\n        if (ms <= 0) return next();\n\n        let timer: ReturnType<typeof setTimeout> | undefined;\n        const timedOut = new Promise<\"timeout\">((resolve) => {\n            timer = setTimeout(() => resolve(\"timeout\"), ms);\n        });\n\n        try {\n            const outcome = await Promise.race([next().then(() => \"done\" as const), timedOut]);\n            if (outcome === \"timeout\") {\n                logger.warn(\n                    `[functions] ${c.req.method} ${c.req.path} exceeded the ${ms}ms request timeout — ` +\n                    \"answering 504. The handler is still running; it cannot be cancelled from here. \" +\n                    \"Give outbound calls an AbortSignal, or raise `functionsTimeoutMs` / REBASE_FUNCTIONS_TIMEOUT_MS.\"\n                );\n                return c.json({\n                    error: {\n                        message: \"Function timed out\",\n                        code: \"FUNCTION_TIMEOUT\"\n                    }\n                }, 504);\n            }\n        } finally {\n            if (timer) clearTimeout(timer);\n        }\n        return undefined;\n    };\n}\n"],"mappings":";;;;;;;;;;;;;AAKA,IAAa,+BAA+B;;;;;;;;AAS5C,SAAgB,0BAA0B,YAA6B;CACnE,IAAI,OAAO,eAAe,YAAY,OAAO,SAAS,UAAU,GAC5D,OAAO,KAAK,IAAI,GAAG,KAAK,MAAM,UAAU,CAAC;CAU7C,MAAM,MAAM,QAAQ,IAAI,6BAA6B,KAAK;CAC1D,IAAI,KAAK;EACL,MAAM,UAAU,OAAO,GAAG;EAC1B,IAAI,OAAO,SAAS,OAAO,KAAK,WAAW,GACvC,OAAO,KAAK,MAAM,OAAO;CAEjC;CACA,OAAO;AACX;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BA,SAAgB,8BAA8B,IAAwC;CAClF,OAAO,OAAO,GAAG,SAAS;EACtB,IAAI,MAAM,GAAG,OAAO,KAAK;EAEzB,IAAI;EACJ,MAAM,WAAW,IAAI,SAAoB,YAAY;GACjD,QAAQ,iBAAiB,QAAQ,SAAS,GAAG,EAAE;EACnD,CAAC;EAED,IAAI;GAEA,IAAI,MADkB,QAAQ,KAAK,CAAC,KAAK,CAAC,CAAC,WAAW,MAAe,GAAG,QAAQ,CAAC,MACjE,WAAW;IACvB,OAAO,KACH,eAAe,EAAE,IAAI,OAAO,GAAG,EAAE,IAAI,KAAK,gBAAgB,GAAG,uMAGjE;IACA,OAAO,EAAE,KAAK,EACV,OAAO;KACH,SAAS;KACT,MAAM;IACV,EACJ,GAAG,GAAG;GACV;EACJ,UAAU;GACN,IAAI,OAAO,aAAa,KAAK;EACjC;CAEJ;AACJ"}

package/dist/rls-audit/index.d.ts

@@ -0,0 +1,111 @@
+/**
+ * The shape `@rebasepro/rls-check` returns. Declared structurally rather than
+ * imported as a type, so this module carries no dependency on it at all — see
+ * the module comment.
+ */
+export interface RlsScanFinding {
+    id: string;
+    severity: "info" | "low" | "medium" | "high" | "critical";
+    title: string;
+    target: {
+        schema: string;
+        table?: string;
+        policy?: string;
+    };
+}
+export interface RlsScanResult {
+    scannedAt: string;
+    /** Host and database name only — the checker never returns credentials. */
+    database: {
+        host: string;
+        name: string;
+    };
+    stats: {
+        schemas: number;
+        tables: number;
+        policies: number;
+        tablesWithoutRls: number;
+        checksRun: number;
+    };
+    findings: RlsScanFinding[];
+}
+declare const SEVERITY_ORDER: readonly ["info", "low", "medium", "high", "critical"];
+export type RlsSeverity = (typeof SEVERITY_ORDER)[number];
+export interface RlsAuditConfig {
+    /** Off unless set. See the module comment for why. */
+    enabled?: boolean;
+    /**
+     * How often to run, in milliseconds. Default 24 hours.
+     *
+     * The thing being watched is a schema, which changes on deploys, not on
+     * traffic — so this is a daily safety net, not a monitor.
+     */
+    intervalMs?: number;
+    /** Run once at startup as well as on the interval. Default true. */
+    runOnBoot?: boolean;
+    /** Restrict the scan to these schemas. Default: every user schema. */
+    schemas?: string[];
+    /**
+     * Where to connect. Defaults to `DATABASE_URL`.
+     *
+     * Taken as a string rather than borrowed from the driver because the checker
+     * connects on its own terms — its own session, its own statement timeout —
+     * and threading it through a driver would make the audit's behaviour depend
+     * on the pool it borrowed from.
+     */
+    connectionString?: string;
+    /**
+     * Severity at or above which a completed run logs a warning rather than an
+     * info line. Default `high`.
+     */
+    warnAtSeverity?: RlsSeverity;
+    /** Statement timeout for the scan's own queries. Default 30s. */
+    statementTimeoutMs?: number;
+    /**
+     * The scanner. Pass `scan` from `@rebasepro/rls-check`:
+     *
+     * ```ts
+     * import { scan } from "@rebasepro/rls-check";
+     * rlsAudit: { enabled: true, scan }
+     * ```
+     *
+     * Required when `enabled`. See the module comment for why it is not
+     * imported here.
+     */
+    scan?: RlsScanner;
+}
+/** The one function this module needs from `@rebasepro/rls-check`. */
+export type RlsScanner = (options: {
+    connectionString: string;
+    schemas?: string[];
+    statementTimeoutMs?: number;
+}) => Promise<RlsScanResult>;
+export interface RlsAuditStatus {
+    enabled: boolean;
+    /** Why it is not running, when it is not. */
+    reason?: string;
+    lastRunAt?: string;
+    lastError?: string;
+    result?: RlsScanResult;
+}
+export interface RlsAudit {
+    start(): void;
+    stop(): void;
+    /** Run now, outside the schedule. Resolves when the run finishes. */
+    runNow(): Promise<void>;
+    status(): RlsAuditStatus;
+}
+/** One line naming what the run found, at the right level to be noticed. */
+export declare function summarize(result: RlsScanResult, warnAt: RlsSeverity): {
+    level: "warn" | "info";
+    message: string;
+};
+/**
+ * Create the audit. Nothing runs until {@link RlsAudit.start}.
+ *
+ * Because the scanner is supplied by the caller, the schedule, the summary and
+ * the failure handling are all testable without a database and without
+ * `@rebasepro/rls-check` present.
+ */
+export declare function createRlsAudit(config: RlsAuditConfig): RlsAudit;
+export {};

package/dist/{rolldown-runtime-DSJWtz9O.js → rolldown-runtime-dW7B1o5h.js}

@@ -1,6 +1,7 @@
-import { createRequire as __createRequire } from "module";
-import "process";
-const require = __createRequire(import.meta.url);
+import { createRequire as __rebaseCreateRequire } from "module";
+import __rebaseProcess from "process";
+globalThis.process ??= __rebaseProcess;
+const require = __rebaseCreateRequire(import.meta.url);
 //#region \0rolldown/runtime.js
 var __create = Object.create;
 var __defProp = Object.defineProperty;