@rebasepro/server 0.16.0 → 0.16.1-canary.g0d7af95

package/dist/contract-routes-DZ-LBpSL.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"contract-routes-DZ-LBpSL.js","names":[],"sources":["../../types/src/types/project_manifest.ts","../../types/src/types/collection_contract.ts","../../types/src/types/schema_version.ts","../src/api/contract-routes.ts"],"sourcesContent":["/**\n * The project manifest (`rebase.json`) and the build artifacts derived from it.\n *\n * Three separate documents live in this file, and keeping them distinct matters:\n *\n * 1. {@link RebaseProjectManifest} — `rebase.json`. **Authored** by the developer,\n *    committed to the repository. Declares topology only: which runtime major the\n *    project targets, and which apps *this repository* contributes to the project.\n *    Schema, security rules, hooks and functions stay in TypeScript under the\n *    config package — nothing that needs a type system belongs here.\n *\n * 2. {@link RebaseProjectLink} — the per-checkout link (`.rebase/cloud.json`).\n *    **Not committed**, because it is per-developer like a git remote. Says which\n *    deployed project this working copy points at, whether that is a Rebase Cloud\n *    project or the base URL of a self-hosted backend.\n *\n * 3. {@link RebaseBundleManifest} — `manifest.json` inside a built bundle.\n *    **Generated**, never hand-edited. It is the lockfile analogue: the exact\n *    contract a built artifact claims to satisfy, which the runtime validates\n *    before it boots and a control plane validates before it deploys.\n *\n * A repository declares only the apps it contains. The set of apps belonging to a\n * project is held by the project itself, which is what makes multi-repo projects\n * work: two repositories never need to know about each other, only about the\n * project.\n */\n\nimport type { StorageSourceDefinition } from \"./storage_source\";\n\n/**\n * Which kind of thing an app is.\n *\n * - `backend` — the collections/hooks/functions that define the project's API.\n *   Exactly one per *project* (not per repository); the registry enforces it.\n * - `static`  — a pre-built client bundle (SPA, static site), served from the\n *   backend process at its declared `path` or from a CDN. The admin panel is\n *   one of these: it is an app in the user's repository like any other.\n *\n * That is the whole list. Ownership of the server process is a property of the\n * backend app ({@link RebaseBackendAppConfig.runtime}), not an app type.\n */\nexport type RebaseAppType = \"backend\" | \"static\";\n\n/**\n * The backend app: the project's API surface.\n *\n * Paths are relative to the directory holding `rebase.json`. The defaults match\n * the layout `rebase init` scaffolds, so a stock project may declare simply\n * `{ \"type\": \"backend\", \"runtime\": \"managed\" }`.\n */\nexport interface RebaseBackendAppConfig {\n    type: \"backend\";\n    /**\n     * Who owns the process this backend runs in.\n     *\n     * - `managed` — the platform's runtime image boots this project's bundle.\n     *   You supply collections, functions, crons and schema; Rebase supplies the\n     *   server.\n     * - `custom` — this repository builds its own image and entrypoint. The\n     *   escape hatch: full control, no managed-runtime guarantees.\n     *\n     * Independent of *where* it runs. Both run on Rebase Cloud and both\n     * self-host — the destination lives in `.rebase/cloud.json`, not here. See\n     * `docker/docker-compose.selfhost.yml`, which boots a managed bundle on a\n     * developer's own Docker host.\n     *\n     * This is authored rather than inferred on purpose. It is the single most\n     * consequential fact about a deployment, and inferring it is what used to\n     * land projects on the custom runtime without anyone choosing it.\n     */\n    runtime: \"managed\" | \"custom\";\n    /** Directory of the config package (collections + index). Default `config`. */\n    config?: string;\n    /** Directory of server functions. Default `backend/functions`. */\n    functions?: string;\n    /** Directory of cron job definitions. Default `backend/crons` when present. */\n    crons?: string;\n    /**\n     * Path to the generated Drizzle schema module (tables/enums/relations).\n     * Default `backend/src/schema.generated.ts`.\n     */\n    schema?: string;\n    /**\n     * Module path (relative to `config`) exporting the auth users collection as\n     * its default export. Default `collections/users`.\n     */\n    usersCollection?: string;\n\n    /**\n     * `runtime: \"custom\"` only. Dockerfile path relative to the repository root.\n     * Default `Dockerfile`.\n     */\n    dockerfile?: string;\n    /** `runtime: \"custom\"` only. Build context relative to the root. Default `.`. */\n    context?: string;\n    /** `runtime: \"custom\"` only. Port the container listens on. Default 8080. */\n    port?: number;\n}\n\n/**\n * A static client bundle — SPA or static site — built here and served at `path`.\n */\nexport interface RebaseStaticAppConfig {\n    type: \"static\";\n    /** Package directory containing the client sources. */\n    root: string;\n    /** Command that produces `output`. Run from the repository root. */\n    build?: string;\n    /** Directory of built assets, relative to the repository root. */\n    output: string;\n    /**\n     * Public base path this app is served under. Default `/`.\n     *\n     * Several static apps run in one process, each at its own path — the API at\n     * `/api`, a site at `/`, the admin at `/admin` — which is what keeps a\n     * self-hosted deployment a single container.\n     *\n     * **This is a build-time input, not only a serving concern.** An app mounted\n     * at `/admin` must be *built* for `/admin` (Vite's `base`), or `index.html`\n     * loads and every asset 404s: a blank page with no server error. `rebase\n     * build` passes it as `REBASE_APP_BASE` and asserts the emitted HTML honours\n     * it. Changing this value requires rebuilding the app.\n     */\n    path?: string;\n    /**\n     * Serve `index.html` for unmatched paths under `path` (client-side routing).\n     * Default `true` — the overwhelmingly common case for a client app, and a\n     * static *site* generator emits real files for its routes anyway.\n     */\n    spa?: boolean;\n}\n\nexport type RebaseAppConfig = RebaseBackendAppConfig | RebaseStaticAppConfig;\n\n/**\n * One declared storage source, as authored in `rebase.json`.\n *\n * The key comes from the enclosing record, so this is\n * {@link StorageSourceDefinition} minus its `key` — the same document the\n * runtime registry and the frontend router consume, expressed the way a JSON\n * object naturally expresses \"a set of named things\".\n */\nexport interface RebaseStorageSourceConfig {\n    /** Engine backing this source: `local`, `s3`, `gcs`, or a custom id. */\n    engine: string;\n    /**\n     * How the frontend reaches it. Default `server` (proxied through\n     * `/api/storage`). `direct` means a provider SDK talks to the bucket and the\n     * backend is not in the upload path.\n     */\n    transport?: \"server\" | \"direct\";\n    /** Human-readable label for the console and the admin UI. */\n    label?: string;\n}\n\n/**\n * `rebase.json` — the authored project manifest.\n */\nexport interface RebaseProjectManifest {\n    /** JSON Schema URL, for editor completion. Ignored by the tooling. */\n    $schema?: string;\n    /**\n     * The runtime contract **major** this project targets, as a semver range\n     * (e.g. `^1`, `~1.4`, or an exact `1.4.2` to pin).\n     *\n     * The platform upgrades patches and minors underneath a project without\n     * asking; it never crosses a major. See {@link RUNTIME_CONTRACT_VERSION}.\n     *\n     * Named `rebase` rather than `runtime` so that `runtime` means exactly one\n     * thing — {@link RebaseBackendAppConfig.runtime}, who owns the process. It\n     * reads like `engines` in a `package.json`, which is what it is.\n     */\n    rebase: string;\n    /**\n     * Apps this repository contributes, keyed by app name. The key is the app's\n     * identity within the project: it is what `rebase deploy <app>` names, what\n     * client credentials are issued against, and what a second repository must\n     * not collide with.\n     */\n    apps: Record<string, RebaseAppConfig>;\n    /**\n     * Storage sources this project uses, keyed by source key.\n     *\n     * **Topology only — never credentials.** Which buckets exist is a property of\n     * the project and belongs in the repository; how to reach each one is a\n     * property of the deployment and lives in the environment, read per source\n     * from `<BASE>__<KEY>` (`S3_BUCKET__MEDIA` for a source keyed `media`). The\n     * default source takes no suffix, so a single-bucket project configured with\n     * plain `S3_BUCKET` keeps working having declared nothing at all.\n     *\n     * Declared here rather than only in the config package because this file is\n     * the one artifact a host can read *before* running a build. That is what\n     * lets a console show \"this project wants a `media` bucket, and it has none\"\n     * on a project's first deploy, and it is why the managed and custom runtimes\n     * can present the same list — a custom build emits no bundle manifest, so a\n     * declaration that lived only in compiled config would leave every custom\n     * project invisible.\n     *\n     * Omitted entirely means one default source, which is the overwhelmingly\n     * common project and must not be required to say so.\n     */\n    storage?: Record<string, RebaseStorageSourceConfig>;\n    /**\n     * Repository-wide opt-out from anonymous CLI usage sharing.\n     *\n     * **Only `false` does anything.** It suppresses sharing for everyone who\n     * clones this repository, overriding each developer's own opt-in — an\n     * organisation setting policy for work done on its behalf, the same shape\n     * as a committed `.npmrc`.\n     *\n     * `true` is deliberately ignored, and the CLI says so rather than obeying\n     * quietly. This file is committed, so a `true` here would be one developer\n     * answering a privacy question for every colleague who later clones the\n     * repo — consent by proxy, which is the exact thing opt-in exists to\n     * prevent. Individuals opt in with `rebase telemetry enable`.\n     */\n    telemetry?: boolean;\n}\n\n/**\n * The per-checkout project link.\n *\n * Deliberately separate from `rebase.json`: the manifest is committed and shared,\n * while the link is per-developer. Keeping them in one file would mean either\n * committing someone's project id or gitignoring the topology.\n */\nexport interface RebaseProjectLink {\n    /**\n     * A Rebase Cloud project id, or the base URL of any running Rebase backend\n     * (`https://api.example.com`). Both are first-class: every command that\n     * accepts a project reference accepts either, so a self-hosted project has\n     * the same tooling as a cloud one.\n     */\n    project: string;\n    /** Organization slug. Cloud projects only. */\n    org?: string;\n    /** Explicit API base URL, when it differs from the project's default. */\n    apiUrl?: string;\n}\n\n/**\n * Whether a project can run on the managed runtime, and if not, precisely why.\n *\n * The reasons are returned rather than summarised so tooling can print something\n * a developer can act on. \"Not eligible\" is never a dead end — it selects the\n * custom-runtime path, which still deploys.\n */\nexport interface ManagedCompatibility {\n    eligible: boolean;\n    reasons: string[];\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Bundle\n// ─────────────────────────────────────────────────────────────────────────────\n\n/**\n * Version of the bundle *format* itself.\n *\n * Bumped only when the on-disk layout changes in a way an older runtime could\n * not read. A runtime accepts any bundle whose `bundleFormat` is less than or\n * equal to its own — old bundles keep booting on new runtimes, which is the\n * whole point of separating the artifact from the engine.\n *\n * - **1** — `mode: \"cms\" | \"baas\" | \"static\"`, `entry.static` a single directory\n *   string, `entry.admin` for a bundled admin panel.\n * - **2** — `kind: \"backend\" | \"static\"`, `entry.static` a list of\n *   {@link RebaseBundleStatic}, `entry.admin` removed. A format-1 runtime reading\n *   one of these would find no `mode` and an array where it expects a string, so\n *   the bump is what turns that into a refusal to boot instead of a bundle that\n *   starts and serves nothing.\n */\nexport const BUNDLE_FORMAT_VERSION = 2;\n\n/**\n * The runtime contract major.\n *\n * Distinct from the `@rebasepro/server` package version: the package may release\n * any number of minors and patches while this stays put. It changes only when\n * the bundle/runtime contract breaks compatibility, and a project's\n * `manifest.runtime` range is matched against *this*.\n */\nexport const RUNTIME_CONTRACT_VERSION = 1;\n\n/** Where the runtime finds each part of the bundle. Paths are bundle-relative. */\nexport interface RebaseBundleEntrypoints {\n    /** Compiled config package directory (collections live under it). */\n    config?: string;\n    /** Compiled collections directory, when it differs from `<config>/collections`. */\n    collections?: string;\n    /** Compiled functions directory. */\n    functions?: string;\n    /** Compiled crons directory. */\n    crons?: string;\n    /** Compiled Drizzle schema module. */\n    schema?: string;\n    /** Module exporting the auth users collection (default export). */\n    usersCollection?: string;\n    /**\n     * Built static apps to serve from this process, in declaration order.\n     *\n     * A list rather than a single directory because one process serves several\n     * apps at different paths — a site at `/` and the admin at `/admin`. The\n     * runtime mounts them longest-path-first so the `/`-rooted app's catch-all\n     * does not claim its siblings' URLs.\n     */\n    static?: RebaseBundleStatic[];\n}\n\n/** One built static app inside a bundle. */\nexport interface RebaseBundleStatic {\n    /** Public base path, e.g. `/` or `/admin`. */\n    path: string;\n    /** Bundle-relative directory holding the built assets. */\n    dir: string;\n    /** Serve `index.html` for unmatched paths under `path`. */\n    spa: boolean;\n}\n\n/**\n * A native module found in the dependency closure.\n *\n * Recorded rather than merely counted so a rejection can name the offending\n * package instead of saying \"something here is native\".\n */\nexport interface NativeDependency {\n    name: string;\n    /** Why it was flagged — a `.node` binary, a gyp build, or an install script. */\n    reason: string;\n}\n\n/**\n * `manifest.json` — generated, and the document the runtime and control plane\n * both validate against.\n */\nexport interface RebaseBundleManifest {\n    /** @see BUNDLE_FORMAT_VERSION */\n    bundleFormat: number;\n    runtime: {\n        /** The `runtime` range copied from `rebase.json`. */\n        range: string;\n        /** Exact `@rebasepro/server` version this bundle was built against. */\n        builtAgainst: string;\n        /** Runtime contract major this bundle requires. */\n        contract: number;\n    };\n    /**\n     * Hash of the compiled collection definitions.\n     *\n     * This is the contract stamp. A generated SDK records the value it was built\n     * from, a client sends it back, and a mismatch is what lets the platform say\n     * \"this app was built against an older schema\" instead of failing mysteriously\n     * at the first request. It covers collections only — a hook edit does not\n     * change a client's contract, so it must not invalidate every SDK.\n     */\n    schemaVersion: string;\n    /** Which app in `rebase.json` this bundle was built from. */\n    app: string;\n    /**\n     * What the runtime does with this bundle.\n     *\n     * - `backend` — boot the full server: database, auth and the data API, plus\n     *   any static apps in `entry.static`.\n     * - `static` — no backend at all: serve `entry.static` and nothing else. No\n     *   database, no auth, no data sources. This is how a static app runs on the\n     *   same image as the backend.\n     *\n     * Replaces an earlier `mode: \"cms\" | \"baas\" | \"static\"`. The cms/baas\n     * distinction was never a third kind of thing — it is simply whether\n     * `entry.config` is present, so it is derived rather than declared.\n     */\n    kind: \"backend\" | \"static\";\n    entry: RebaseBundleEntrypoints;\n    /** Collection slugs contained in the bundle, for quick inspection. */\n    collections?: string[];\n    hooks: {\n        /**\n         * Whether the dependency closure contains native code.\n         *\n         * The managed runtime refuses these: a prebuilt binary cannot be run on\n         * an image the platform did not build it for, and the honest failure is\n         * at deploy time rather than at 3am in a crash loop.\n         */\n        native: boolean;\n        nativeModules?: NativeDependency[];\n    };\n    /**\n     * What the bundle's config says about storage access control.\n     *\n     * Storage is not under RLS and its keys share one flat namespace, so a\n     * deployment with file storage enabled and no access model serves every\n     * user's files to every signed-in user. The runtime refuses to boot in that\n     * state — which, on a hosted platform that enables storage from the *console*\n     * rather than from the bundle, surfaces as a crash loop the developer cannot\n     * read.\n     *\n     * Recording it here lets a host reject the deploy with the reason instead.\n     * Absent on bundles built before this field existed.\n     */\n    storage?: {\n        /** Whether the config package exports a `storageAuthorize` hook. */\n        authorize: boolean;\n        /**\n         * Every storage source this bundle expects, resolved at build time from\n         * `rebase.json`'s `storage` block merged with any `storageSources` the\n         * config package exports.\n         *\n         * Recorded so the runtime does not have to import user code to learn its\n         * own topology, and so a host can tell — from the artifact alone, before\n         * starting anything — which buckets need configuring. Absent on bundles\n         * built before this field existed, which means one default source.\n         */\n        sources?: StorageSourceDefinition[];\n    };\n    deps: {\n        /** Runtime dependencies of user code, as declared. */\n        declared: Record<string, string>;\n        /**\n         * The dependency tree ships *inside* the bundle, already installed.\n         *\n         * Absent or false means the tree is declared but not present, and\n         * whoever boots the bundle has to install it. On the managed runtime that\n         * install runs in an init container on **every** pod start — the bundle\n         * lives on a volume that is wiped each time — and it is the single\n         * largest cost in a managed pod's life: 35–55 seconds of a 40–60 second\n         * cold start. Since a pod restarts on every eviction, node failure, OOM\n         * and runtime rollout, that number is not a startup detail. It is what an\n         * outage costs.\n         *\n         * Vendoring moves the install to build time, where it happens once. It is\n         * skipped when the closure contains native code, because a prebuilt\n         * binary is only valid for the platform it was built for — see\n         * {@link vendorTarget} for what \"the platform\" means here.\n         */\n        vendored?: boolean;\n        /**\n         * What {@link vendored} was resolved for, recorded so a mismatch can be\n         * refused rather than discovered at import time.\n         *\n         * Cross-platform vendoring is safe for pure JavaScript and unsafe for\n         * anything compiled, and the boundary between them is not always visible\n         * in a dependency list: `esbuild` is pure-JS with a *platform-specific\n         * optional dependency* holding the actual binary, so an install run on a\n         * developer's Mac silently produces a tree that cannot run on the Linux\n         * image. The install therefore resolves optional dependencies for the\n         * target explicitly rather than for the machine it runs on, and records\n         * the answer here.\n         */\n        vendorTarget?: {\n            /** npm `--os`, e.g. `linux`. */\n            os: string;\n            /** npm `--cpu`, e.g. `x64`. */\n            cpu: string;\n            /** Node major the tree was resolved for. */\n            node: string;\n        };\n    };\n    build: {\n        /** `@rebasepro/cli` version that produced this bundle. */\n        cli: string;\n        /** Node major the bundle was compiled on. */\n        node: string;\n        /** ISO-8601. */\n        createdAt: string;\n    };\n}\n\n/** The contract a running backend serves at `GET /api/meta/contract`. */\nexport interface RebaseProjectContract {\n    /** Matches {@link RebaseBundleManifest.schemaVersion}. */\n    schemaVersion: string;\n    runtime: {\n        /** `@rebasepro/server` version currently running. */\n        version: string;\n        contract: number;\n    };\n    /** Full collection definitions, serialized — the input to SDK generation. */\n    collections: unknown[];\n    /** Collection slugs, for cheap inspection without parsing the definitions. */\n    collectionSlugs: string[];\n    generatedAt: string;\n}\n\n/** Header carrying the schema version an SDK was generated from. */\nexport const SCHEMA_VERSION_HEADER = \"x-rebase-schema\";\n","import type { CollectionConfig } from \"./collections\";\n\n/**\n * Serializing collections so they survive a network hop.\n *\n * A collection definition is not plain data. Relations point at their target\n * with a *function* (`target: () => usersCollection`) so two collections can\n * reference each other without an import cycle, and collections also carry\n * callbacks, custom views and component references. `JSON.stringify` silently\n * drops every one of those, which matters because the SDK generator *calls*\n * `relation.target()` to decide whether a foreign key is a string or a number.\n * Serialize naively and remote SDK generation produces subtly wrong types\n * instead of failing — the worst possible outcome.\n *\n * So relation targets are resolved to a slug reference on the way out and\n * rebuilt into functions on the way in. Everything else that cannot cross a wire\n * is dropped deliberately: an SDK is generated from the *shape* of the data, and\n * server-side behaviour is neither useful to a client nor safe to publish.\n */\n\n/** Marker replacing a relation's `target` function in serialized form. */\nexport interface SerializedCollectionRef {\n    __collectionRef: string;\n}\n\nexport function isSerializedCollectionRef(value: unknown): value is SerializedCollectionRef {\n    return typeof value === \"object\"\n        && value !== null\n        && typeof (value as SerializedCollectionRef).__collectionRef === \"string\";\n}\n\n/** Depth limit for the walk — deep enough for real configs, finite for cyclic ones. */\nconst MAX_DEPTH = 64;\n\n/**\n * Resolve whatever a `target` thunk returns down to a collection.\n *\n * A target may be the collection, a module namespace (when the authoring file\n * used `import * as`), or a default-export wrapper. All three appear in real\n * projects, and the SDK generator already unwraps them the same way.\n */\nfunction unwrapTarget(value: unknown): CollectionConfig | undefined {\n    if (!value || typeof value !== \"object\") return undefined;\n    const candidate = value as { default?: unknown; __esModule?: boolean; properties?: unknown };\n    if (candidate.default || candidate.__esModule) {\n        const inner = candidate.default;\n        if (inner && typeof inner === \"object\") return inner as CollectionConfig;\n    }\n    if (candidate.properties) return value as CollectionConfig;\n    return undefined;\n}\n\n/** The identity a serialized reference uses. Slug first — it is the routing key. */\nfunction refFor(collection: CollectionConfig | undefined): string | undefined {\n    if (!collection) return undefined;\n    const withPath = collection as CollectionConfig & { path?: string };\n    return collection.slug || withPath.path || collection.name;\n}\n\n/**\n * Deep-copy a value into something JSON can carry.\n *\n * `target` keys are special-cased into refs. Other functions vanish, cycles are\n * cut, and everything else is copied structurally.\n */\n/** Shared walk state: the memo, plus a count of depth-cap hits. */\ninterface WalkState {\n    memo: WeakMap<object, unknown>;\n    /**\n     * How many times the walk has truncated a subtree — by hitting the depth\n     * cap, or by cutting a cycle.\n     *\n     * Either kind of truncation makes a result valid only at the *position* it\n     * was produced at, so caching it and serving it elsewhere silently drops\n     * content that would have been included. Comparing this counter before and\n     * after a node's children tells us whether its result is position-\n     * independent and therefore safe to memoize.\n     *\n     * The cycle case is the subtle one: with `a.b = b` and `b.a = a`, serializing\n     * `{ first: b, second: a }` visits `a` beneath `b` — where the cycle back to\n     * `b` is cut — and would then reuse that truncated `a` for `second`, where\n     * nothing needed cutting.\n     */\n    truncations: number;\n}\n\nfunction toSerializable(\n    value: unknown,\n    seen: WeakSet<object>,\n    depth: number,\n    state: WalkState,\n    key?: string\n): unknown {\n    if (depth > MAX_DEPTH) {\n        state.truncations++;\n        return undefined;\n    }\n\n    if (typeof value === \"function\") {\n        // Only a relation target carries information a client needs. Calling it\n        // is safe here — this runs on the server, where the target module is\n        // already loaded — and a throwing target simply yields no reference,\n        // which degrades the generated FK type rather than failing the request.\n        if (key === \"target\") {\n            try {\n                const resolved = unwrapTarget((value as () => unknown)());\n                const ref = refFor(resolved);\n                return ref ? { __collectionRef: ref } : undefined;\n            } catch {\n                return undefined;\n            }\n        }\n        return undefined;\n    }\n\n    if (value === null || typeof value !== \"object\") {\n        return value;\n    }\n\n    if (value instanceof Date) return value.toISOString();\n    if (value instanceof RegExp) return value.source;\n\n    if (seen.has(value as object)) {\n        state.truncations++;\n        return undefined;\n    }\n\n    // A shared (non-cyclic) subgraph is reachable by many paths, and `seen` is a\n    // *path* set — released in the `finally` below so a node referenced twice in\n    // different branches is emitted twice rather than dropped as a false cycle.\n    // Without memoization that makes the walk exponential in depth: a diamond\n    // graph 20 levels deep took ~400ms, and each further level doubled it. The\n    // result is a plain data tree, so handing back the same converted object for\n    // a repeat visit is indistinguishable after JSON.stringify.\n    const cached = state.memo.get(value as object);\n    if (cached !== undefined) return cached;\n\n    seen.add(value as object);\n    const truncationsBefore = state.truncations;\n    const memoize = (result: unknown): unknown => {\n        // Only cache a result that nothing was cut from.\n        if (result !== undefined && state.truncations === truncationsBefore) {\n            state.memo.set(value as object, result);\n        }\n        return result;\n    };\n\n    try {\n        if (Array.isArray(value)) {\n            const items = value\n                .map(item => toSerializable(item, seen, depth + 1, state))\n                .filter(item => item !== undefined);\n            // A container that had content, none of which can be represented, is\n            // itself unrepresentable — see the note below.\n            return memoize(value.length > 0 && items.length === 0 ? undefined : items);\n        }\n\n        // A React element or component reference has no meaning to a client and\n        // will not survive JSON anyway.\n        if (\"$$typeof\" in (value as Record<string, unknown>)) return undefined;\n\n        const entries = Object.entries(value as Record<string, unknown>);\n        const out: Record<string, unknown> = {};\n        for (const [k, v] of entries) {\n            const converted = toSerializable(v, seen, depth + 1, state, k);\n            if (converted !== undefined) out[k] = converted;\n        }\n\n        // Drop a container whose entire content was dropped.\n        //\n        // `callbacks: { beforeSave() {…} }` would otherwise serialize to\n        // `callbacks: {}` — an empty husk that carries no information but is not\n        // *nothing*, so it lands in the payload and, worse, in the schema hash.\n        // Editing a hook would then change every client's schema version and\n        // report perfectly current SDKs as stale.\n        //\n        // A container that started empty stays empty: `properties: {}` is a\n        // deliberate statement, not a casualty.\n        if (entries.length > 0 && Object.keys(out).length === 0) return undefined;\n\n        return memoize(out);\n    } finally {\n        // Released so a collection referenced twice in different branches is\n        // emitted twice rather than being dropped as a false cycle.\n        seen.delete(value as object);\n    }\n}\n\n/**\n * Serialize collections for transport over the contract endpoint.\n *\n * Sorted by slug so the output — and therefore the schema hash computed from it\n * — does not depend on filesystem ordering.\n */\nexport function serializeCollections(collections: CollectionConfig[]): unknown[] {\n    return [...collections]\n        .sort((a, b) => String(a.slug ?? \"\").localeCompare(String(b.slug ?? \"\")))\n        .map(collection => toSerializable(withoutAdminBlock(collection), new WeakSet(), 0, {\n            memo: new WeakMap(),\n            truncations: 0\n        }))\n        .filter((c): c is Record<string, unknown> => c !== undefined);\n}\n\n/**\n * Drop the admin block before the walk.\n *\n * Nothing downstream of serialization is an admin panel. The contract endpoint\n * feeds remote SDK generation, and `rebase build` writes the result into a bundle\n * manifest that only the backend runtime reads. The block would survive the walk\n * as a husk anyway — its React elements and component functions are dropped\n * individually — and that husk has two costs worth avoiding: it puts every custom\n * component's *file path* on an endpoint whose job is to describe data shapes, and\n * it grows a payload that is fetched and cached per project.\n *\n * Removing it here rather than at each call site means one chokepoint, so a future\n * consumer of `serializeCollections` cannot forget.\n *\n * Child collections carry their own block, so this recurses — stripping only the\n * top level was the mistake `stripNonClientFields` in the contract routes already\n * had to fix once for security rules.\n */\nfunction withoutAdminBlock(collection: CollectionConfig): CollectionConfig {\n    const { admin: _admin, ...rest } = collection as CollectionConfig & Record<string, unknown>;\n    const nested = rest as Record<string, unknown>;\n    if (Array.isArray(nested.subcollections)) {\n        nested.subcollections = nested.subcollections.map(\n            (child) => withoutAdminBlock(child as CollectionConfig)\n        );\n    }\n    return rest as CollectionConfig;\n}\n\n/**\n * Rebuild collections received from a contract endpoint.\n *\n * Relation refs become real thunks resolving through the returned set, so\n * downstream consumers — the SDK generator above all — see exactly the shape\n * they would have seen had the collections been imported from source.\n *\n * A ref naming a collection that is not in the payload resolves to `undefined`\n * rather than throwing: the generator already tolerates an unresolvable target\n * by falling back to a permissive key type, and a partial contract should still\n * produce a usable SDK.\n */\nexport function deserializeCollections(payload: unknown[]): CollectionConfig[] {\n    const collections = payload\n        .filter((c): c is Record<string, unknown> => typeof c === \"object\" && c !== null)\n        .map(c => ({ ...c })) as unknown as CollectionConfig[];\n\n    const bySlug = new Map<string, CollectionConfig>();\n    for (const collection of collections) {\n        const ref = refFor(collection);\n        if (ref) bySlug.set(ref, collection);\n    }\n\n    const rehydrate = (value: unknown, depth: number): void => {\n        if (depth > MAX_DEPTH || !value || typeof value !== \"object\") return;\n\n        if (Array.isArray(value)) {\n            for (const item of value) rehydrate(item, depth + 1);\n            return;\n        }\n\n        const record = value as Record<string, unknown>;\n        for (const [key, child] of Object.entries(record)) {\n            if (key === \"target\" && isSerializedCollectionRef(child)) {\n                const slug = child.__collectionRef;\n                record.target = () => bySlug.get(slug);\n                continue;\n            }\n            rehydrate(child, depth + 1);\n        }\n    };\n\n    for (const collection of collections) rehydrate(collection, 0);\n    return collections;\n}\n","import type { CollectionConfig } from \"./collections\";\nimport { serializeCollections } from \"./collection_contract\";\n\n/**\n * The schema version stamp.\n *\n * One function, used in three places that must agree or the whole drift-detection\n * story is noise: `rebase build` writes it into a bundle manifest, the runtime\n * serves it from the contract endpoint, and a generated SDK records the value it\n * was built from. If any two of those computed it differently, every client would\n * look permanently out of date.\n *\n * It covers **collections only** — the client's contract is the shape of the\n * data, so editing a hook or a server function must not invalidate every SDK in\n * every repository. That is a deliberate narrowing, not an oversight.\n */\n\n/** Stable stringify: object keys sorted at every level, so key order cannot alter the hash. */\nfunction canonicalize(value: unknown): string {\n    if (value === null || typeof value !== \"object\") {\n        return JSON.stringify(value) ?? \"null\";\n    }\n    if (Array.isArray(value)) {\n        return `[${value.map(canonicalize).join(\",\")}]`;\n    }\n    const entries = Object.entries(value as Record<string, unknown>)\n        .filter(([, v]) => v !== undefined)\n        .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));\n    return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${canonicalize(v)}`).join(\",\")}}`;\n}\n\n/**\n * Reduce a collection to the parts a generated client is actually built from.\n *\n * The version answers one question — \"is this SDK stale?\" — so it must change\n * exactly when the generated types could change, and never otherwise. Hashing a\n * whole collection fails both halves of that:\n *\n * - Security rules, callbacks, icons, groups and UI settings do not appear in a\n *   generated client, so including them reports perfectly current SDKs as stale.\n * - Worse, they are not stable *inputs*. The runtime applies default security\n *   rules when it loads collections, so the same source hashed before and after\n *   loading produced two different answers — a build-time stamp that could never\n *   match the server that served it.\n *\n * Codegen reads the slug (for the `Database` key and type names), the properties,\n * and the relations. That is the projection.\n */\nfunction projectForCodegen(collection: CollectionConfig): Record<string, unknown> {\n    const source = collection as CollectionConfig & {\n        relations?: unknown;\n        subcollections?: CollectionConfig[];\n        path?: string;\n        engine?: unknown;\n        dataSource?: unknown;\n    };\n\n    return {\n        slug: collection.slug ?? source.path,\n        properties: collection.properties,\n        relations: source.relations,\n        // The engine decides whether relations are resolved at all: codegen asks\n        // `getDataSourceCapabilities(collection.engine).supportsRelations`, and an\n        // engine that answers no drops every foreign-key column from the\n        // generated Row/Insert/Update types. Moving a collection to such an\n        // engine is a real change to the generated types, so it has to move the\n        // version. `dataSource` is what resolves to `engine`, so it counts too.\n        engine: source.engine,\n        dataSource: source.dataSource,\n        subcollections: source.subcollections?.map(projectForCodegen)\n    };\n}\n\n/**\n * Compute the canonical string a schema version hashes.\n *\n * Exposed separately so the hashing itself can differ by environment: Node has\n * `crypto`, and callers without it can still compare canonical forms directly.\n */\nexport function canonicalSchemaPayload(collections: CollectionConfig[]): string {\n    const projected = serializeCollections(collections)\n        .map(collection => projectForCodegen(collection as CollectionConfig));\n    return canonicalize(projected);\n}\n\n/**\n * A short, non-cryptographic digest of the canonical payload.\n *\n * FNV-1a style, 64 bits, as two 32-bit halves. This is an identity, not a\n * security boundary: nothing trusts a schema version to prove anything, it only\n * answers \"is this the same schema as before\". A hand-rolled hash keeps this\n * module free of `node:crypto`, so the identical function runs in the browser,\n * in the CLI, and in the runtime — which is the property that actually matters.\n */\nexport function computeSchemaVersion(collections: CollectionConfig[]): string {\n    const payload = canonicalSchemaPayload(collections);\n\n    let h1 = 0x811c9dc5;\n    let h2 = 0x01000193;\n\n    for (let i = 0; i < payload.length; i++) {\n        const code = payload.charCodeAt(i);\n        h1 ^= code;\n        // Multiply by the FNV prime using shifts to stay in 32-bit integer math.\n        h1 = (h1 + ((h1 << 1) + (h1 << 4) + (h1 << 7) + (h1 << 8) + (h1 << 24))) >>> 0;\n        h2 ^= code + i;\n        h2 = (h2 + ((h2 << 1) + (h2 << 5) + (h2 << 9) + (h2 << 15) + (h2 << 24))) >>> 0;\n    }\n\n    const hex = (n: number): string => n.toString(16).padStart(8, \"0\");\n    return `v1:${hex(h1)}${hex(h2)}`;\n}\n","import { Hono } from \"hono\";\nimport {\n    RUNTIME_CONTRACT_VERSION,\n    SCHEMA_VERSION_HEADER,\n    computeSchemaVersion,\n    serializeCollections,\n    type CollectionConfig,\n    type RebaseProjectContract\n} from \"@rebasepro/types\";\nimport type { HonoEnv } from \"./types\";\nimport { logger } from \"../utils/logger\";\n\n/**\n * The project contract endpoint.\n *\n * This is what makes a repository able to build against a project it does not\n * contain. Without it, a typed client can only be generated from local\n * collection *source*, which means every frontend must live in the same\n * repository as the backend. Serving the contract turns that around: an app\n * asks the project what its shape is, so a web app, a second web app and a\n * mobile app can each live wherever they like and none of them needs to know\n * about the others.\n *\n * Admin-gated. Collection definitions describe every table, column and relation\n * in the project, including ones no security rule would ever expose — that is a\n * map of the database, not public API documentation.\n */\n\nexport interface ContractRoutesConfig {\n    collectionRegistry: { getRawCollections(): CollectionConfig[] };\n    /**\n     * The schema version recorded at build time.\n     *\n     * Preferred over recomputing, so that what a client is told matches exactly\n     * what the bundle claims. It is recomputed only when a bundle did not record\n     * one — a `baas`-mode project derives its collections from the live database\n     * at boot, so there was nothing to hash when it was built.\n     */\n    schemaVersion?: string;\n    /** Runtime package version, surfaced so a client can report what it built against. */\n    runtimeVersion?: string;\n}\n\n/**\n * Strip everything a client does not need from a serialized collection.\n *\n * The generator reads the slug, the properties and the relations. It never reads\n * a security rule — but `securityRules` carries the raw SQL of every RLS\n * predicate guarding the project, which is a description of the authorization\n * model rather than of the data shape. Publishing it to anyone who can generate\n * an SDK gives away more than the endpoint is for, so it is removed here rather\n * than trusted not to matter.\n */\nfunction stripNonClientFields(collection: unknown): unknown {\n    if (!collection || typeof collection !== \"object\") return collection;\n    const {\n        securityRules: _securityRules,\n        callbacks: _callbacks,\n        ...rest\n    } = collection as Record<string, unknown>;\n\n    // Subcollections are collections, and carry their own rules. Stripping only\n    // the top level published every nested policy — the leak this exists to\n    // prevent, just one level down.\n    if (Array.isArray(rest.subcollections)) {\n        rest.subcollections = rest.subcollections.map(stripNonClientFields);\n    }\n\n    return rest;\n}\n\nexport function createContractRoutes(config: ContractRoutesConfig): Hono<HonoEnv> {\n    const router = new Hono<HonoEnv>();\n\n    // Computing a version walks and canonicalizes every collection, and\n    // `/schema-version` is deliberately unauthenticated and meant to be polled.\n    // Recomputing per request would make a CI convenience into a CPU\n    // amplification anyone could aim at the server. Collections do not change\n    // after boot, so once is enough.\n    let cachedVersion: string | undefined;\n    const schemaVersionOf = (collections: CollectionConfig[]): string => {\n        if (config.schemaVersion) return config.schemaVersion;\n        if (cachedVersion === undefined) cachedVersion = computeSchemaVersion(collections);\n        return cachedVersion;\n    };\n\n    router.get(\"/contract\", (c) => {\n        const collections = config.collectionRegistry.getRawCollections();\n        const serialized = serializeCollections(collections).map(stripNonClientFields);\n\n        // In `baas` mode the collections are whatever introspection found at\n        // boot, so the version has to be computed from them rather than taken\n        // from a build that never saw them.\n        const schemaVersion = schemaVersionOf(collections);\n\n        const contract: RebaseProjectContract = {\n            schemaVersion,\n            runtime: {\n                version: config.runtimeVersion ?? \"unknown\",\n                contract: RUNTIME_CONTRACT_VERSION\n            },\n            collections: serialized,\n            collectionSlugs: collections\n                .map(collection => collection.slug)\n                .filter((slug): slug is string => Boolean(slug))\n                .sort(),\n            generatedAt: new Date().toISOString()\n        };\n\n        c.header(SCHEMA_VERSION_HEADER, schemaVersion);\n        return c.json(contract);\n    });\n\n    /**\n     * Cheap drift check.\n     *\n     * Deliberately unauthenticated and deliberately tiny: it returns a version\n     * string and nothing else. A CI job that only wants to know whether its\n     * generated SDK is stale should not need admin credentials, and a version\n     * stamp reveals nothing about the schema it stands for.\n     */\n    router.get(\"/schema-version\", (c) => {\n        const schemaVersion = schemaVersionOf(config.collectionRegistry.getRawCollections());\n        c.header(SCHEMA_VERSION_HEADER, schemaVersion);\n        return c.json({ schemaVersion, });\n    });\n\n    logger.debug(\"Contract routes mounted\");\n    return router;\n}\n"],"mappings":";;;;;;;;;AAoeA,IAAa,wBAAwB;;;;ACpcrC,IAAM,YAAY;;;;;;;;AASlB,SAAS,aAAa,OAA8C;CAChE,IAAI,CAAC,SAAS,OAAO,UAAU,UAAU,OAAO,KAAA;CAChD,MAAM,YAAY;CAClB,IAAI,UAAU,WAAW,UAAU,YAAY;EAC3C,MAAM,QAAQ,UAAU;EACxB,IAAI,SAAS,OAAO,UAAU,UAAU,OAAO;CACnD;CACA,IAAI,UAAU,YAAY,OAAO;AAErC;;AAGA,SAAS,OAAO,YAA8D;CAC1E,IAAI,CAAC,YAAY,OAAO,KAAA;CACxB,MAAM,WAAW;CACjB,OAAO,WAAW,QAAQ,SAAS,QAAQ,WAAW;AAC1D;AA6BA,SAAS,eACL,OACA,MACA,OACA,OACA,KACO;CACP,IAAI,QAAQ,WAAW;EACnB,MAAM;EACN;CACJ;CAEA,IAAI,OAAO,UAAU,YAAY;EAK7B,IAAI,QAAQ,UACR,IAAI;GAEA,MAAM,MAAM,OADK,aAAc,MAAwB,CACpC,CAAQ;GAC3B,OAAO,MAAM,EAAE,iBAAiB,IAAI,IAAI,KAAA;EAC5C,QAAQ;GACJ;EACJ;EAEJ;CACJ;CAEA,IAAI,UAAU,QAAQ,OAAO,UAAU,UACnC,OAAO;CAGX,IAAI,iBAAiB,MAAM,OAAO,MAAM,YAAY;CACpD,IAAI,iBAAiB,QAAQ,OAAO,MAAM;CAE1C,IAAI,KAAK,IAAI,KAAe,GAAG;EAC3B,MAAM;EACN;CACJ;CASA,MAAM,SAAS,MAAM,KAAK,IAAI,KAAe;CAC7C,IAAI,WAAW,KAAA,GAAW,OAAO;CAEjC,KAAK,IAAI,KAAe;CACxB,MAAM,oBAAoB,MAAM;CAChC,MAAM,WAAW,WAA6B;EAE1C,IAAI,WAAW,KAAA,KAAa,MAAM,gBAAgB,mBAC9C,MAAM,KAAK,IAAI,OAAiB,MAAM;EAE1C,OAAO;CACX;CAEA,IAAI;EACA,IAAI,MAAM,QAAQ,KAAK,GAAG;GACtB,MAAM,QAAQ,MACT,KAAI,SAAQ,eAAe,MAAM,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CACzD,QAAO,SAAQ,SAAS,KAAA,CAAS;GAGtC,OAAO,QAAQ,MAAM,SAAS,KAAK,MAAM,WAAW,IAAI,KAAA,IAAY,KAAK;EAC7E;EAIA,IAAI,cAAe,OAAmC,OAAO,KAAA;EAE7D,MAAM,UAAU,OAAO,QAAQ,KAAgC;EAC/D,MAAM,MAA+B,CAAC;EACtC,KAAK,MAAM,CAAC,GAAG,MAAM,SAAS;GAC1B,MAAM,YAAY,eAAe,GAAG,MAAM,QAAQ,GAAG,OAAO,CAAC;GAC7D,IAAI,cAAc,KAAA,GAAW,IAAI,KAAK;EAC1C;EAYA,IAAI,QAAQ,SAAS,KAAK,OAAO,KAAK,GAAG,CAAC,CAAC,WAAW,GAAG,OAAO,KAAA;EAEhE,OAAO,QAAQ,GAAG;CACtB,UAAU;EAGN,KAAK,OAAO,KAAe;CAC/B;AACJ;;;;;;;AAQA,SAAgB,qBAAqB,aAA4C;CAC7E,OAAO,CAAC,GAAG,WAAW,CAAC,CAClB,MAAM,GAAG,MAAM,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,cAAc,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CACxE,KAAI,eAAc,eAAe,kBAAkB,UAAU,mBAAG,IAAI,QAAQ,GAAG,GAAG;EAC/E,sBAAM,IAAI,QAAQ;EAClB,aAAa;CACjB,CAAC,CAAC,CAAC,CACF,QAAQ,MAAoC,MAAM,KAAA,CAAS;AACpE;;;;;;;;;;;;;;;;;;;AAoBA,SAAS,kBAAkB,YAAgD;CACvE,MAAM,EAAE,OAAO,QAAQ,GAAG,SAAS;CACnC,MAAM,SAAS;CACf,IAAI,MAAM,QAAQ,OAAO,cAAc,GACnC,OAAO,iBAAiB,OAAO,eAAe,KACzC,UAAU,kBAAkB,KAAyB,CAC1D;CAEJ,OAAO;AACX;;;;;;;;;;;;;;;;;ACrNA,SAAS,aAAa,OAAwB;CAC1C,IAAI,UAAU,QAAQ,OAAO,UAAU,UACnC,OAAO,KAAK,UAAU,KAAK,KAAK;CAEpC,IAAI,MAAM,QAAQ,KAAK,GACnB,OAAO,IAAI,MAAM,IAAI,YAAY,CAAC,CAAC,KAAK,GAAG,EAAE;CAKjD,OAAO,IAHS,OAAO,QAAQ,KAAgC,CAAC,CAC3D,QAAQ,GAAG,OAAO,MAAM,KAAA,CAAS,CAAC,CAClC,MAAM,CAAC,IAAI,CAAC,OAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CACvC,CAAA,CAAQ,KAAK,CAAC,GAAG,OAAO,GAAG,KAAK,UAAU,CAAC,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE;AAC5F;;;;;;;;;;;;;;;;;;AAmBA,SAAS,kBAAkB,YAAuD;CAC9E,MAAM,SAAS;CAQf,OAAO;EACH,MAAM,WAAW,QAAQ,OAAO;EAChC,YAAY,WAAW;EACvB,WAAW,OAAO;EAOlB,QAAQ,OAAO;EACf,YAAY,OAAO;EACnB,gBAAgB,OAAO,gBAAgB,IAAI,iBAAiB;CAChE;AACJ;;;;;;;AAQA,SAAgB,uBAAuB,aAAyC;CAG5E,OAAO,aAFW,qBAAqB,WAAW,CAAC,CAC9C,KAAI,eAAc,kBAAkB,UAA8B,CACnD,CAAS;AACjC;;;;;;;;;;AAWA,SAAgB,qBAAqB,aAAyC;CAC1E,MAAM,UAAU,uBAAuB,WAAW;CAElD,IAAI,KAAK;CACT,IAAI,KAAK;CAET,KAAK,IAAI,IAAI,GAAG,IAAI,QAAQ,QAAQ,KAAK;EACrC,MAAM,OAAO,QAAQ,WAAW,CAAC;EACjC,MAAM;EAEN,KAAM,OAAO,MAAM,MAAM,MAAM,MAAM,MAAM,MAAM,MAAM,MAAM,MAAM,SAAU;EAC7E,MAAM,OAAO;EACb,KAAM,OAAO,MAAM,MAAM,MAAM,MAAM,MAAM,MAAM,MAAM,OAAO,MAAM,SAAU;CAClF;CAEA,MAAM,OAAO,MAAsB,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG;CACjE,OAAO,MAAM,IAAI,EAAE,IAAI,IAAI,EAAE;AACjC;;;;;;;;;;;;;;AC1DA,SAAS,qBAAqB,YAA8B;CACxD,IAAI,CAAC,cAAc,OAAO,eAAe,UAAU,OAAO;CAC1D,MAAM,EACF,eAAe,gBACf,WAAW,YACX,GAAG,SACH;CAKJ,IAAI,MAAM,QAAQ,KAAK,cAAc,GACjC,KAAK,iBAAiB,KAAK,eAAe,IAAI,oBAAoB;CAGtE,OAAO;AACX;AAEA,SAAgB,qBAAqB,QAA6C;CAC9E,MAAM,SAAS,IAAI,KAAc;CAOjC,IAAI;CACJ,MAAM,mBAAmB,gBAA4C;EACjE,IAAI,OAAO,eAAe,OAAO,OAAO;EACxC,IAAI,kBAAkB,KAAA,GAAW,gBAAgB,qBAAqB,WAAW;EACjF,OAAO;CACX;CAEA,OAAO,IAAI,cAAc,MAAM;EAC3B,MAAM,cAAc,OAAO,mBAAmB,kBAAkB;EAChE,MAAM,aAAa,qBAAqB,WAAW,CAAC,CAAC,IAAI,oBAAoB;EAK7E,MAAM,gBAAgB,gBAAgB,WAAW;EAEjD,MAAM,WAAkC;GACpC;GACA,SAAS;IACL,SAAS,OAAO,kBAAkB;IAClC,UAAA;GACJ;GACA,aAAa;GACb,iBAAiB,YACZ,KAAI,eAAc,WAAW,IAAI,CAAC,CAClC,QAAQ,SAAyB,QAAQ,IAAI,CAAC,CAAC,CAC/C,KAAK;GACV,8BAAa,IAAI,KAAK,EAAA,CAAE,YAAY;EACxC;EAEA,EAAE,OAAO,uBAAuB,aAAa;EAC7C,OAAO,EAAE,KAAK,QAAQ;CAC1B,CAAC;;;;;;;;;CAUD,OAAO,IAAI,oBAAoB,MAAM;EACjC,MAAM,gBAAgB,gBAAgB,OAAO,mBAAmB,kBAAkB,CAAC;EACnF,EAAE,OAAO,uBAAuB,aAAa;EAC7C,OAAO,EAAE,KAAK,EAAE,cAAe,CAAC;CACpC,CAAC;CAED,OAAO,MAAM,yBAAyB;CACtC,OAAO;AACX"}

package/dist/cron-routes-maM_RlUu.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"cron-routes-maM_RlUu.js","names":[],"sources":["../src/cron/cron-routes.ts"],"sourcesContent":["import { Hono } from \"hono\";\nimport type { HonoEnv } from \"../api/types\";\nimport type { CronScheduler } from \"./cron-scheduler\";\nimport { ApiError, errorHandler } from \"../api/errors\";\n\n/**\n * Create admin REST routes for managing cron jobs.\n *\n * Routes:\n *   GET    /          → list all cron jobs\n *   GET    /:id       → get a single job's status\n *   POST   /:id/trigger → manually trigger a job\n *   GET    /:id/logs  → get execution logs for a job\n *   PUT    /:id       → update job (enable/disable)\n */\nexport function createCronRoutes(scheduler: CronScheduler, skipped = 0): Hono<HonoEnv> {\n    const router = new Hono<HonoEnv>();\n    // Hono's onError does NOT propagate from parent to child routers, so this\n    // child router registers its own handler to format thrown ApiErrors.\n    router.onError(errorHandler);\n\n    // List all jobs\n    router.get(\"/\", (c) => {\n        const jobs = scheduler.listJobs();\n        // A file that failed to load is not a job, so it appears nowhere in\n        // this list — and \"my job is missing\" and \"my job is not scheduled\"\n        // look identical from here. Say how many were dropped, as the\n        // functions listing does, so the Studio panel and anyone with curl can\n        // see it without boot-log access.\n        return c.json({\n            jobs,\n            ...(skipped > 0 && {\n                skipped,\n                note: `${skipped} cron file(s) failed to load and are NOT scheduled — see the server log for the reason.`\n            })\n        });\n    });\n\n    // Get single job\n    router.get(\"/:id\", (c) => {\n        const id = c.req.param(\"id\");\n        const job = scheduler.getJob(id);\n        if (!job) {\n            throw ApiError.notFound(`Cron job \"${id}\" not found`);\n        }\n        return c.json({ job });\n    });\n\n    // Trigger a job manually\n    router.post(\"/:id/trigger\", async (c) => {\n        const id = c.req.param(\"id\");\n        const job = scheduler.getJob(id);\n        if (!job) {\n            throw ApiError.notFound(`Cron job \"${id}\" not found`);\n        }\n\n        const log = await scheduler.triggerJob(id);\n        return c.json({ log,\njob: scheduler.getJob(id) });\n    });\n\n    // Get job logs\n    router.get(\"/:id/logs\", async (c) => {\n        const id = c.req.param(\"id\");\n        const limitStr = c.req.query(\"limit\");\n        const limit = limitStr ? parseInt(limitStr, 10) : undefined;\n\n        const job = scheduler.getJob(id);\n        if (!job) {\n            throw ApiError.notFound(`Cron job \"${id}\" not found`);\n        }\n\n        const logs = await scheduler.getJobLogsFromDb(id, limit);\n        return c.json({ logs });\n    });\n\n    // Enable/disable a job\n    router.put(\"/:id\", async (c) => {\n        const id = c.req.param(\"id\");\n        const body = await c.req.json().catch(() => ({})) as { enabled: boolean };\n\n        if (typeof body.enabled !== \"boolean\") {\n            throw ApiError.badRequest(\"Missing 'enabled' boolean in body\");\n        }\n\n        const job = scheduler.setJobEnabled(id, body.enabled);\n        if (!job) {\n            throw ApiError.notFound(`Cron job \"${id}\" not found`);\n        }\n\n        return c.json({ job });\n    });\n\n    return router;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAeA,SAAgB,iBAAiB,WAA0B,UAAU,GAAkB;CACnF,MAAM,SAAS,IAAI,KAAc;CAGjC,OAAO,QAAQ,YAAY;CAG3B,OAAO,IAAI,MAAM,MAAM;EACnB,MAAM,OAAO,UAAU,SAAS;EAMhC,OAAO,EAAE,KAAK;GACV;GACA,GAAI,UAAU,KAAK;IACf;IACA,MAAM,GAAG,QAAQ;GACrB;EACJ,CAAC;CACL,CAAC;CAGD,OAAO,IAAI,SAAS,MAAM;EACtB,MAAM,KAAK,EAAE,IAAI,MAAM,IAAI;EAC3B,MAAM,MAAM,UAAU,OAAO,EAAE;EAC/B,IAAI,CAAC,KACD,MAAM,SAAS,SAAS,aAAa,GAAG,YAAY;EAExD,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC;CACzB,CAAC;CAGD,OAAO,KAAK,gBAAgB,OAAO,MAAM;EACrC,MAAM,KAAK,EAAE,IAAI,MAAM,IAAI;EAE3B,IAAI,CADQ,UAAU,OAAO,EACxB,GACD,MAAM,SAAS,SAAS,aAAa,GAAG,YAAY;EAGxD,MAAM,MAAM,MAAM,UAAU,WAAW,EAAE;EACzC,OAAO,EAAE,KAAK;GAAE;GACxB,KAAK,UAAU,OAAO,EAAE;EAAE,CAAC;CACvB,CAAC;CAGD,OAAO,IAAI,aAAa,OAAO,MAAM;EACjC,MAAM,KAAK,EAAE,IAAI,MAAM,IAAI;EAC3B,MAAM,WAAW,EAAE,IAAI,MAAM,OAAO;EACpC,MAAM,QAAQ,WAAW,SAAS,UAAU,EAAE,IAAI,KAAA;EAGlD,IAAI,CADQ,UAAU,OAAO,EACxB,GACD,MAAM,SAAS,SAAS,aAAa,GAAG,YAAY;EAGxD,MAAM,OAAO,MAAM,UAAU,iBAAiB,IAAI,KAAK;EACvD,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC;CAC1B,CAAC;CAGD,OAAO,IAAI,QAAQ,OAAO,MAAM;EAC5B,MAAM,KAAK,EAAE,IAAI,MAAM,IAAI;EAC3B,MAAM,OAAO,MAAM,EAAE,IAAI,KAAK,CAAC,CAAC,aAAa,CAAC,EAAE;EAEhD,IAAI,OAAO,KAAK,YAAY,WACxB,MAAM,SAAS,WAAW,mCAAmC;EAGjE,MAAM,MAAM,UAAU,cAAc,IAAI,KAAK,OAAO;EACpD,IAAI,CAAC,KACD,MAAM,SAAS,SAAS,aAAa,GAAG,YAAY;EAGxD,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC;CACzB,CAAC;CAED,OAAO;AACX"}

package/dist/cron-scheduler-DIpYBmZP.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"cron-scheduler-DIpYBmZP.js","names":[],"sources":["../src/cron/scale-to-zero.ts","../src/cron/cron-scheduler.ts"],"sourcesContent":["/**\n * Scale-to-zero detection for the cron scheduler.\n *\n * The scheduler drives jobs with in-process `setTimeout`. That works on any\n * always-running instance, but on a platform that freezes or evicts the\n * container between requests (Cloud Run with `--min-instances=0`, AWS Lambda,\n * Vercel functions) the timers simply never fire — the process boots, logs the\n * jobs as registered, and silently runs nothing.\n *\n * None of these platforms expose their scaling floor to the container, so this\n * detection is a heuristic: it identifies the *platform*, not the setting. It\n * is a warning only — it must never influence boot.\n *\n * Environment variables used here were verified against vendor documentation:\n *  - `K_SERVICE` / `K_REVISION` / `K_CONFIGURATION` — Cloud Run services\n *    (Cloud Run container contract; no variable exposes min-instances).\n *  - `CLOUD_RUN_JOB` — Cloud Run jobs (same contract).\n *  - `AWS_LAMBDA_FUNCTION_NAME` — reserved AWS Lambda runtime variable.\n *  - `VERCEL=1` — Vercel system environment variable, available at runtime.\n *  - `KUBERNETES_SERVICE_HOST` — injected into every pod by the kubelet. Used\n *    as an *exclusion*: a Deployment pod runs continuously, and Knative on\n *    Kubernetes also sets `K_SERVICE`, so a pod is never warned about.\n */\n\n/** Environment variable that permanently silences the scale-to-zero warning. */\nexport const CRON_ALWAYS_ON_ENV = \"REBASE_CRON_ALWAYS_ON\";\n\n/** The subset of `process.env` this module reads. */\nexport type EnvLike = Record<string, string | undefined>;\n\nexport interface FreezableRuntime {\n    /** Human-readable platform name, used verbatim in the warning. */\n    platform: string;\n    /** Names of the environment variables that identified the platform. */\n    signals: string[];\n}\n\n/** Minimal shape of a registered job needed to build the warning. */\nexport interface WarnableJob {\n    id: string;\n    enabled: boolean;\n}\n\nexport interface ScaleToZeroWarning {\n    message: string;\n    data: Record<string, unknown>;\n}\n\n/** Accepts the usual truthy spellings; anything else (including \"\") is false. */\nfunction isTruthy(value: string | undefined): boolean {\n    if (!value) return false;\n    const normalised = value.trim().toLowerCase();\n    return normalised === \"1\" || normalised === \"true\" || normalised === \"yes\" || normalised === \"on\";\n}\n\n/**\n * Identify a runtime whose instances can be frozen or torn down between\n * requests. Returns `undefined` when the platform is unknown or known to run\n * continuously.\n */\nexport function detectFreezableRuntime(env: EnvLike = process.env): FreezableRuntime | undefined {\n    // A Kubernetes pod (GKE, EKS, self-hosted) runs continuously. Knative and\n    // Cloud Run for Anthos set K_SERVICE *inside* a pod, so this exclusion has\n    // to come first or every Knative pod would be a false positive.\n    if (env.KUBERNETES_SERVICE_HOST) return undefined;\n\n    if (env.K_SERVICE) {\n        const signals = [\"K_SERVICE\"];\n        if (env.K_REVISION) signals.push(\"K_REVISION\");\n        if (env.K_CONFIGURATION) signals.push(\"K_CONFIGURATION\");\n        return { platform: \"Cloud Run\", signals };\n    }\n\n    if (env.CLOUD_RUN_JOB) {\n        return { platform: \"Cloud Run Jobs\", signals: [\"CLOUD_RUN_JOB\"] };\n    }\n\n    if (env.AWS_LAMBDA_FUNCTION_NAME) {\n        return { platform: \"AWS Lambda\", signals: [\"AWS_LAMBDA_FUNCTION_NAME\"] };\n    }\n\n    if (env.VERCEL === \"1\") {\n        return { platform: \"Vercel\", signals: [\"VERCEL\"] };\n    }\n\n    return undefined;\n}\n\n/** How many job ids to name before collapsing the rest into \"+N more\". */\nconst MAX_NAMED_JOBS = 10;\n\n/**\n * Build the boot-time warning, or `undefined` when it does not apply.\n *\n * Fires only when all of the following hold:\n *  1. `NODE_ENV=production` — a laptop or CI run is not at risk.\n *  2. At least one *enabled* job is registered — nothing to lose otherwise.\n *  3. The environment looks like a freezable platform (see above).\n *  4. `REBASE_CRON_ALWAYS_ON` is not set to a truthy value.\n */\nexport function buildScaleToZeroWarning(\n    jobs: WarnableJob[],\n    env: EnvLike = process.env\n): ScaleToZeroWarning | undefined {\n    if (env.NODE_ENV !== \"production\") return undefined;\n    if (isTruthy(env[CRON_ALWAYS_ON_ENV])) return undefined;\n\n    const enabled = jobs.filter((job) => job.enabled).map((job) => job.id);\n    if (enabled.length === 0) return undefined;\n\n    const runtime = detectFreezableRuntime(env);\n    if (!runtime) return undefined;\n\n    const named = enabled.slice(0, MAX_NAMED_JOBS);\n    const list = enabled.length > named.length\n        ? `${named.join(\", \")} (+${enabled.length - named.length} more)`\n        : named.join(\", \");\n\n    const message = `[cron] ${runtime.platform} detected — in-process timers do not fire while an instance is frozen or scaled to zero, so ${enabled.length} enabled job(s) may never run: ${list}; drive them from an external scheduler instead (POST /api/cron/:id/trigger, e.g. Cloud Scheduler). ${runtime.platform} does not expose its scaling floor to the container, so an always-warm deployment cannot be confirmed from inside the process — set ${CRON_ALWAYS_ON_ENV}=1 to silence this if at least one instance is pinned warm.`;\n\n    return {\n        message,\n        data: {\n            platform: runtime.platform,\n            signals: runtime.signals,\n            jobs: enabled\n        }\n    };\n}\n","import type {\n    CronJobDefinition,\n    CronJobStatus,\n    CronJobLogEntry,\n    CronJobRunState,\n    CronJobContext\n} from \"@rebasepro/types\";\nimport type { RebaseServerClient } from \"@rebasepro/types\";\nimport type { LoadedCronJob } from \"./cron-loader\";\nimport type { CronStore } from \"./cron-store\";\nimport { logger, redactSensitiveText } from \"../utils/logger.js\";\nimport { buildScaleToZeroWarning } from \"./scale-to-zero.js\";\n\n// ─── Cron expression parser (minimal, no external dependency) ────────\n// Supports standard 5-field cron (minute hour dom month dow).\n// Returns the next Date after `after` that matches the expression.\n\n/**\n * Expand a single cron field into an ordered array of allowed values.\n * Supports: `*`, `N`, `N-M`, `N/S`, `N-M/S`, `*\\/S`, and comma-separated combinations.\n */\nfunction expandCronField(field: string, min: number, max: number): number[] {\n    const results = new Set<number>();\n    for (const segment of field.split(\",\")) {\n        const trimmed = segment.trim();\n        if (trimmed === \"*\") {\n            for (let i = min; i <= max; i++) results.add(i);\n        } else if (trimmed.includes(\"/\")) {\n            const [rangeStr, stepStr] = trimmed.split(\"/\");\n            const step = parseInt(stepStr, 10);\n            if (isNaN(step) || step <= 0) {\n                throw new Error(`Invalid step value \"${stepStr}\" in cron field \"${field}\"`);\n            }\n            let start = min;\n            let end = max;\n            if (rangeStr !== \"*\") {\n                if (rangeStr.includes(\"-\")) {\n                    const [a, b] = rangeStr.split(\"-\").map(Number);\n                    start = a;\n                    end = b;\n                } else {\n                    start = parseInt(rangeStr, 10);\n                }\n            }\n            for (let i = start; i <= end; i += step) results.add(i);\n        } else if (trimmed.includes(\"-\")) {\n            const [a, b] = trimmed.split(\"-\").map(Number);\n            for (let i = a; i <= b; i++) results.add(i);\n        } else {\n            const val = parseInt(trimmed, 10);\n            if (isNaN(val)) {\n                throw new Error(`Invalid value \"${trimmed}\" in cron field \"${field}\"`);\n            }\n            results.add(val);\n        }\n    }\n    return [...results].sort((a, b) => a - b);\n}\n\n/**\n * Validates a standard 5-field cron expression structurally and semantically.\n * Returns `{ valid: true }` or `{ valid: false, reason: string }`.\n */\nexport function validateCronExpression(schedule: string): { valid: true } | { valid: false; reason: string } {\n    if (!schedule || typeof schedule !== \"string\") {\n        return { valid: false,\nreason: \"Schedule must be a non-empty string\" };\n    }\n    const parts = schedule.trim().split(/\\s+/);\n    if (parts.length !== 5) {\n        return { valid: false,\nreason: `Expected 5 fields, got ${parts.length}` };\n    }\n    const fieldRanges: [string, number, number][] = [\n        [\"minute\", 0, 59],\n        [\"hour\", 0, 23],\n        [\"day of month\", 1, 31],\n        [\"month\", 1, 12],\n        [\"day of week\", 0, 6]\n    ];\n    for (let i = 0; i < 5; i++) {\n        const [name, min, max] = fieldRanges[i];\n        try {\n            const values = expandCronField(parts[i], min, max);\n            if (values.length === 0) {\n                return { valid: false,\nreason: `${name} field \"${parts[i]}\" produces no values` };\n            }\n            for (const v of values) {\n                if (v < min || v > max) {\n                    return { valid: false,\nreason: `${name} field value ${v} out of range [${min}–${max}]` };\n                }\n            }\n        } catch (err) {\n            return { valid: false,\nreason: `${name} field: ${err instanceof Error ? err.message : String(err)}` };\n        }\n    }\n    return { valid: true };\n}\n\n/** The five cron fields, pre-expanded into the values each one allows. */\ninterface CronFields {\n    minutes: number[];\n    hours: number[];\n    doms: number[];\n    months: number[];\n    dows: number[];\n}\n\n/** Expand all five fields of an expression. Throws on invalid expressions. */\nfunction parseCronFields(expression: string): CronFields {\n    const parts = expression.trim().split(/\\s+/);\n    if (parts.length < 5) {\n        throw new Error(`Invalid cron expression: \"${expression}\". Expected 5 fields.`);\n    }\n    const [minField, hourField, domField, monField, dowField] = parts;\n    return {\n        minutes: expandCronField(minField, 0, 59),\n        hours: expandCronField(hourField, 0, 23),\n        doms: expandCronField(domField, 1, 31),\n        months: expandCronField(monField, 1, 12),\n        dows: expandCronField(dowField, 0, 6) // 0=Sunday\n    };\n}\n\n/** Whether a minute-precision instant matches every field of the expression. */\nfunction matchesCronFields(candidate: Date, fields: CronFields): boolean {\n    return fields.months.includes(candidate.getMonth() + 1) // getMonth is 0-11\n        && fields.doms.includes(candidate.getDate())\n        && fields.dows.includes(candidate.getDay())\n        && fields.hours.includes(candidate.getHours())\n        && fields.minutes.includes(candidate.getMinutes());\n}\n\n/** ~1 year in minutes — the walk bound for both search directions. */\n/**\n * How far forward to look for the next matching slot.\n *\n * Four years and a day, not one year. `0 0 29 2 *` — run on 29 February — is a\n * legitimate expression whose slot can be almost four years out, and a one-year\n * search never found it.\n */\nconst MAX_SLOT_SEARCH_MINUTES = 4 * 525960 + 1440;\n\n/**\n * Calculate the next Date after `after` that matches the cron expression.\n * Throws on invalid expressions.\n */\nexport function parseCronExpression(expression: string, after: Date): Date {\n    const fields = parseCronFields(expression);\n\n    // Forward-search from `after + 1 minute`\n    const candidate = new Date(after);\n    candidate.setSeconds(0, 0);\n    candidate.setMinutes(candidate.getMinutes() + 1);\n\n    for (let i = 0; i < MAX_SLOT_SEARCH_MINUTES; i++) {\n        if (matchesCronFields(candidate, fields)) {\n            return candidate;\n        }\n        candidate.setMinutes(candidate.getMinutes() + 1);\n    }\n\n    // No slot inside the window. Refuse rather than invent one.\n    //\n    // This used to return `after + 1 minute`, which is indistinguishable from a\n    // schedule that really does fire every minute — so an expression with no\n    // reachable slot ran sixty times an hour, forever. `0 0 29 2 *` was caught\n    // by it while the search window was a single year: a job meant to run once\n    // every four years became the busiest job on the deployment.\n    //\n    // The caller schedules inside a `try` and reports a job it could not\n    // schedule, which is the correct outcome for an expression that names no\n    // time. Genuinely impossible dates (`0 0 31 2 *`) land here too, and should.\n    throw new Error(\n        `Cron expression \"${expression}\" has no matching time within ` +\n        `${Math.round(MAX_SLOT_SEARCH_MINUTES / 525960)} years of ${after.toISOString()}. ` +\n        \"Check the day-of-month and month fields — a date such as 31 February never occurs.\"\n    );\n}\n\n/**\n * The latest slot matching `expression` within the inclusive window\n * `[from, to]`, or `undefined` when the expression has no slot in it.\n *\n * Walks backwards a minute at a time from `to`, so the first hit is already\n * the answer — in the common case (a job that ran normally moments ago) that\n * is a handful of iterations, not a scan of the whole window.\n *\n * `to`'s own minute is included: an instance booting at 06:00:30 has *not* run\n * the 06:00 slot — `parseCronExpression` already skipped past it to tomorrow —\n * so that slot is genuinely missed and must be a candidate.\n *\n * Seconds and milliseconds are zeroed to match how `parseCronExpression`\n * builds a slot, so the same wall-clock slot serialises to a byte-identical\n * ISO string down either path. The claim key depends on that.\n */\nexport function findMostRecentSlot(expression: string, from: Date, to: Date): Date | undefined {\n    const fields = parseCronFields(expression);\n\n    const candidate = new Date(to);\n    candidate.setSeconds(0, 0);\n\n    for (let i = 0; i < MAX_SLOT_SEARCH_MINUTES && candidate.getTime() >= from.getTime(); i++) {\n        if (matchesCronFields(candidate, fields)) {\n            return candidate;\n        }\n        candidate.setMinutes(candidate.getMinutes() - 1);\n    }\n\n    return undefined;\n}\n\n// ─── In-memory ring buffer for logs ──────────────────────────────────\n\nconst MAX_LOGS_PER_JOB = 50;\n\n/**\n * Minimum milliseconds between scheduled executions of the same job.\n * Prevents tight re-execution loops caused by jitter or clock drift.\n */\nconst MIN_SCHEDULE_INTERVAL_MS = 5_000; // 5 seconds\n\n/**\n * Largest delay setTimeout can hold. Node stores it in a 32-bit signed int;\n * anything larger silently clamps to 1ms and fires immediately, so a slot\n * further out than this must be reached in hops rather than one timer.\n */\nconst MAX_TIMER_DELAY_MS = 2_147_483_647; // 2^31 - 1, ~24.8 days\n\n// ─── CronScheduler ───────────────────────────────────────────────────\n\ninterface RegisteredJob {\n    id: string;\n    definition: CronJobDefinition;\n    enabled: boolean;\n    state: CronJobRunState;\n    lastRunAt?: Date;\n    nextRunAt?: Date;\n    lastDurationMs?: number;\n    lastError?: string;\n    totalRuns: number;\n    totalFailures: number;\n    timerId?: ReturnType<typeof setTimeout>;\n    logs: CronJobLogEntry[];\n    /** True while a handler is actively executing (prevents concurrent runs). */\n    executing: boolean;\n}\n\nexport class CronScheduler {\n    private jobs = new Map<string, RegisteredJob>();\n    private started = false;\n    private store?: CronStore;\n    private client?: RebaseServerClient;\n\n    /**\n     * Set the server singleton to make it available to cron job handlers.\n     *\n     * `RebaseServerClient`, not `RebaseClient`: the object `init.ts` passes is\n     * the same one it registers as the singleton, so this was always the true\n     * type — and the wider annotation is what let `ctx.client.data` look like a\n     * user-scoped plane inside a cron, when it is the RLS-bypassing one.\n     */\n    setClient(client: RebaseServerClient): void {\n        this.client = client;\n    }\n\n    /**\n     * Attach a persistence store for cron logs.\n     * When set, execution logs are written to the database after each run,\n     * and counters are seeded from the database on start.\n     */\n    setStore(store: CronStore): void {\n        this.store = store;\n    }\n\n    /**\n     * Register a batch of loaded cron jobs.\n     *\n     * If the scheduler is already started, newly registered jobs are\n     * automatically scheduled (so late-registered jobs don't sit idle).\n     *\n     * Validates the cron schedule on registration — invalid schedules\n     * are rejected with a warning and the job is NOT registered.\n     */\n    registerJobs(loadedJobs: LoadedCronJob[]): void {\n        for (const loaded of loadedJobs) {\n            // Validate schedule up-front — reject invalid schedules\n            const validation = validateCronExpression(loaded.definition.schedule);\n            if (!validation.valid) {\n                logger.error(`[cron] Rejecting job \"${loaded.id}\": invalid schedule \"${loaded.definition.schedule}\" — ${validation.reason}`);\n                continue;\n            }\n\n            const existing = this.jobs.get(loaded.id);\n            if (existing) {\n                logger.warn(`[cron] Duplicate cron job id: \"${loaded.id}\". Overwriting.`);\n                this.stopJob(loaded.id);\n            }\n\n            const enabled = loaded.definition.enabled !== false;\n\n            this.jobs.set(loaded.id, {\n                id: loaded.id,\n                definition: loaded.definition,\n                enabled,\n                state: enabled ? \"idle\" : \"disabled\",\n                totalRuns: 0,\n                totalFailures: 0,\n                logs: [],\n                executing: false\n            });\n\n            // If the scheduler is already running, auto-schedule new jobs\n            if (this.started && enabled) {\n                this.scheduleNext(loaded.id);\n            }\n        }\n    }\n\n    /**\n     * Start the scheduler — begins ticking all enabled jobs.\n     */\n    start(): void {\n        if (this.started) return;\n        this.started = true;\n\n        // Seed counters from DB (non-blocking — scheduler starts immediately)\n        if (this.store) {\n            this.store.fetchJobStats().then((stats) => {\n                for (const [jobId, data] of stats) {\n                    const job = this.jobs.get(jobId);\n                    if (job) {\n                        job.totalRuns = data.totalRuns;\n                        job.totalFailures = data.totalFailures;\n                        if (data.lastRunAt) {\n                            job.lastRunAt = new Date(data.lastRunAt);\n                        }\n                    }\n                }\n            }).catch((err) => {\n                logger.warn(\"[cron] Failed to seed job stats from database\", { error: err });\n            });\n        }\n\n        for (const [id, job] of this.jobs) {\n            if (job.enabled) {\n                this.scheduleNext(id);\n            }\n        }\n        if (!this.store) {\n            logger.warn(\"[cron] No cron store attached — runs are uncoordinated; with multiple app instances every instance will execute every job\");\n        }\n        this.warnIfScaleToZero();\n\n        // Recover slots that elapsed while nothing was ticking. Deliberately\n        // not awaited: catch-up reaches the database and runs handlers, and\n        // boot must not wait on either. Its own errors are contained inside.\n        void this.catchUpMissedSlots();\n\n        logger.info(`⏰ Cron scheduler started with ${this.jobs.size} job(s)`);\n    }\n\n    /**\n     * Stop the scheduler and clear all timers.\n     *\n     * Currently-executing handlers run to completion (they are async),\n     * but no further scheduling occurs after stop.\n     */\n    stop(): void {\n        this.started = false;\n        for (const [id] of this.jobs) {\n            this.stopJob(id);\n        }\n    }\n\n    /**\n     * List all registered jobs with their current status.\n     */\n    listJobs(): CronJobStatus[] {\n        return [...this.jobs.values()].map((job) => this.toStatus(job));\n    }\n\n    /**\n     * Get a single job status by ID.\n     */\n    getJob(id: string): CronJobStatus | undefined {\n        const job = this.jobs.get(id);\n        return job ? this.toStatus(job) : undefined;\n    }\n\n    /**\n     * Get log entries for a job.\n     */\n    getJobLogs(id: string, limit?: number): CronJobLogEntry[] {\n        const job = this.jobs.get(id);\n        if (!job) return [];\n        const logs = [...job.logs].reverse(); // newest first\n        return limit ? logs.slice(0, limit) : logs;\n    }\n\n    /**\n     * Get log entries for a job from the database (if store is available).\n     * Falls back to in-memory logs if no store is configured.\n     */\n    async getJobLogsFromDb(id: string, limit?: number): Promise<CronJobLogEntry[]> {\n        if (this.store) {\n            const dbLogs = await this.store.fetchLogs(id, limit);\n            if (dbLogs.length > 0) return dbLogs;\n        }\n        // Fallback to in-memory\n        return this.getJobLogs(id, limit);\n    }\n\n    /**\n     * Enable or disable a job at runtime.\n     */\n    setJobEnabled(id: string, enabled: boolean): CronJobStatus | undefined {\n        const job = this.jobs.get(id);\n        if (!job) return undefined;\n\n        job.enabled = enabled;\n\n        if (enabled && this.started) {\n            job.state = \"idle\";\n            this.scheduleNext(id);\n        } else if (!enabled) {\n            this.stopJob(id);\n            job.state = \"disabled\";\n        }\n\n        return this.toStatus(job);\n    }\n\n    /**\n     * Manually trigger a job execution immediately.\n     *\n     * Returns `undefined` if the job doesn't exist.\n     * If the job is currently executing, returns the log entry with\n     * a `skipped: true` result rather than running concurrently.\n     */\n    async triggerJob(id: string): Promise<CronJobLogEntry | undefined> {\n        const job = this.jobs.get(id);\n        if (!job) return undefined;\n\n        // Concurrency guard — don't run two instances simultaneously\n        if (job.executing) {\n            logger.warn(`[cron] Skipping manual trigger of \"${id}\" — already executing`);\n            const logEntry: CronJobLogEntry = {\n                jobId: id,\n                startedAt: new Date().toISOString(),\n                finishedAt: new Date().toISOString(),\n                durationMs: 0,\n                success: true,\n                result: { skipped: true,\nreason: \"already_executing\" },\n                logs: [\"Skipped: job is already running\"],\n                manual: true\n            };\n            job.logs.push(logEntry);\n            if (job.logs.length > MAX_LOGS_PER_JOB) job.logs.shift();\n            return logEntry;\n        }\n\n        return this.executeJob(job, true);\n    }\n\n    // ─── Internal ────────────────────────────────────────────────────\n\n    /**\n     * Warn once at start when the process looks like it is running on a\n     * platform that freezes or evicts instances between requests, where the\n     * in-process timers this scheduler relies on never fire.\n     *\n     * Advisory only: any failure here is swallowed so a detection bug can\n     * never take a production boot down.\n     */\n    private warnIfScaleToZero(): void {\n        try {\n            const warning = buildScaleToZeroWarning(\n                [...this.jobs.values()].map((job) => ({ id: job.id, enabled: job.enabled }))\n            );\n            if (warning) {\n                logger.warn(warning.message, warning.data);\n            }\n        } catch {\n            // Never let the advisory check affect startup.\n        }\n    }\n\n    /**\n     * Schedule the next execution for a job.\n     *\n     * Safety guarantees:\n     * 1. Clears any existing timer first (prevents leaked/duplicate timers)\n     * 2. Enforces a minimum delay to prevent tight loops from jitter\n     * 3. Unref's the timer so it doesn't prevent process exit\n     * 4. Re-checks enabled & started state before executing\n     * 5. Concurrency guard prevents overlapping handler executions\n     */\n    private scheduleNext(id: string): void {\n        const job = this.jobs.get(id);\n        if (!job || !job.enabled || !this.started) return;\n\n        // Clear any previously scheduled timer to prevent double-firing\n        this.stopJob(id);\n\n        try {\n            const now = new Date();\n            const nextRun = parseCronExpression(job.definition.schedule, now);\n            job.nextRunAt = nextRun;\n\n            const rawDelay = nextRun.getTime() - now.getTime();\n            // Enforce a minimum delay to prevent tight re-execution loops\n            // from event loop jitter or near-zero setTimeout drift\n            const delay = Math.max(rawDelay, MIN_SCHEDULE_INTERVAL_MS);\n\n            // A slot past the 32-bit timer ceiling cannot be armed directly:\n            // setTimeout would clamp it to 1ms and fire at once, and since the\n            // slot is already claimed by then, every wake re-schedules the same\n            // overflowing delay — a permanent hot loop, not a late job. Sleep\n            // to the ceiling and re-derive the delay on waking instead; the\n            // cron expression stays the source of truth across the hops.\n            if (delay > MAX_TIMER_DELAY_MS) {\n                const hop = setTimeout(() => {\n                    if (this.started && job.enabled) this.scheduleNext(id);\n                }, MAX_TIMER_DELAY_MS);\n                if (hop && typeof hop === \"object\" && \"unref\" in hop) {\n                    hop.unref();\n                }\n                job.timerId = hop;\n                return;\n            }\n\n            const timer = setTimeout(async () => {\n                // Re-check state: scheduler may have been stopped or job disabled\n                // between when we scheduled and when we fire\n                if (!job.enabled || !this.started) return;\n\n                // Concurrency guard: if somehow we're already executing, skip\n                if (job.executing) {\n                    logger.warn(`[cron] Skipping scheduled run of \"${id}\" — still executing from previous run`);\n                    // Re-schedule to try again later\n                    this.scheduleNext(id);\n                    return;\n                }\n\n                // A timer can wake before its slot: a delay past the 32-bit\n                // ceiling, a clock stepped backwards by NTP, a VM resuming from\n                // suspend. Claiming on an early wake is unrecoverable — claims\n                // are permanent, so the slot would be burned and the real run\n                // silently skipped when it came due. Re-derive from the wall\n                // clock and re-arm instead; only the fire that is genuinely due\n                // may claim.\n                if (Date.now() < nextRun.getTime()) {\n                    this.scheduleNext(id);\n                    return;\n                }\n\n                // Cross-instance guard: claim the scheduled slot in the store.\n                // The slot is the scheduled fire time — deterministic across\n                // instances — so exactly one instance wins each (job, slot) pair.\n                // A store without tryClaimRun (pre-claims custom implementation)\n                // runs uncoordinated; a throwing store fails open — either way\n                // this callback must never reject, or the job would silently\n                // stop rescheduling.\n                if (this.store?.tryClaimRun) {\n                    let claimed = true;\n                    try {\n                        claimed = await this.store.tryClaimRun(id, nextRun.toISOString());\n                    } catch (err) {\n                        logger.warn(`[cron] Claim check threw for \"${id}\" — running uncoordinated`, { error: err });\n                    }\n                    if (!claimed) {\n                        logger.info(`[cron] Slot ${nextRun.toISOString()} for \"${id}\" claimed by another instance — skipping`);\n                        if (this.started && job.enabled) {\n                            this.scheduleNext(id);\n                        }\n                        return;\n                    }\n                }\n\n                await this.executeJob(job, false);\n\n                // Schedule the next tick (only if still started + enabled)\n                if (this.started && job.enabled) {\n                    this.scheduleNext(id);\n                }\n            }, delay);\n\n            // Unref the timer so it doesn't prevent Node.js from exiting\n            // during graceful shutdown\n            if (timer && typeof timer === \"object\" && \"unref\" in timer) {\n                timer.unref();\n            }\n\n            job.timerId = timer;\n        } catch (err: unknown) {\n            logger.error(`[cron] Failed to schedule \"${id}\"`, { error: err });\n            job.state = \"error\";\n            job.lastError = err instanceof Error ? err.message : String(err);\n        }\n    }\n\n    /**\n     * Run any slot that elapsed while no instance was holding a timer for it.\n     *\n     * Only jobs that opted in via `catchUpWindowSeconds` are considered, and\n     * only their single most recent missed slot — see the field's docs for why\n     * both limits are deliberate.\n     *\n     * The claim is what makes this safe. In the ordinary case — an instance\n     * restarting minutes after a slot ran normally — the most recent slot is\n     * already claimed, so this costs one `tryClaimRun` per job per boot and\n     * does nothing. A slot is only executed when no instance, past or present,\n     * ever claimed it.\n     *\n     * Never throws: a failure here must not take down a scheduler that is\n     * otherwise ticking correctly.\n     */\n    private async catchUpMissedSlots(): Promise<void> {\n        const candidates = [...this.jobs.values()].filter(\n            job => job.enabled && (job.definition.catchUpWindowSeconds ?? 0) > 0\n        );\n        if (candidates.length === 0) return;\n\n        // A claims-capable store is the whole safety mechanism. Without one,\n        // every boot would look like \"this slot never ran\" and an instance\n        // recycled twice an hour would re-run the same hourly job twice an\n        // hour. Refusing to catch up is the correct degradation.\n        if (!this.store?.tryClaimRun) {\n            logger.warn(\n                `[cron] Catch-up is configured on ${candidates.length} job(s) but no claims-capable store is attached — skipping. ` +\n                \"Without claims a restart cannot tell an unrun slot from one the previous instance already ran.\"\n            );\n            return;\n        }\n\n        const now = new Date();\n\n        for (const job of candidates) {\n            try {\n                if (!this.started || !job.enabled || job.executing) continue;\n\n                const windowSeconds = job.definition.catchUpWindowSeconds!;\n                const from = new Date(now.getTime() - windowSeconds * 1000);\n                const slot = findMostRecentSlot(job.definition.schedule, from, now);\n                if (!slot) continue;\n\n                const slotIso = slot.toISOString();\n\n                // Same key the scheduled path claims with, so a slot that fired\n                // normally is already taken and this is a no-op.\n                let claimed: boolean;\n                try {\n                    claimed = await this.store.tryClaimRun(job.id, slotIso);\n                } catch (err) {\n                    // Fail closed, unlike the scheduled path. A missed slot is\n                    // a recovery, not an obligation — running it against a\n                    // store that cannot tell us whether it already ran risks a\n                    // duplicate on every boot.\n                    logger.warn(`[cron] Catch-up claim threw for \"${job.id}\" — skipping catch-up`, { error: err });\n                    continue;\n                }\n\n                if (!claimed) continue;\n\n                const lateBy = Math.round((now.getTime() - slot.getTime()) / 1000);\n                logger.info(`[cron] Catching up missed slot ${slotIso} for \"${job.id}\" (${lateBy}s late)`);\n\n                await this.executeJob(job, false, `⏰ Catch-up run for missed slot ${slotIso} (${lateBy}s late)`);\n            } catch (err) {\n                logger.error(`[cron] Catch-up failed for \"${job.id}\"`, { error: err });\n            }\n        }\n    }\n\n    /**\n     * Stop a single job's timer and clear its next run state.\n     */\n    private stopJob(id: string): void {\n        const job = this.jobs.get(id);\n        if (job?.timerId) {\n            clearTimeout(job.timerId);\n            job.timerId = undefined;\n            job.nextRunAt = undefined;\n        }\n    }\n\n    /**\n     * Execute a job's handler with full isolation and safety.\n     *\n     * - Sets a concurrency flag to prevent overlapping runs\n     * - Wraps handler in a timeout race\n     * - Captures all logs, errors, and results\n     * - Persists to store (non-blocking) if available\n     * - Always restores state even on catastrophic errors\n     */\n    private async executeJob(\n        job: RegisteredJob,\n        manual: boolean,\n        seedLog?: string\n    ): Promise<CronJobLogEntry> {\n        const startedAt = new Date();\n        // A caller-supplied first line, stored with the run's own output. A\n        // catch-up uses it to say so in the persisted log, where an operator\n        // reading `cron_logs` will actually see it — `manual` is the only other\n        // provenance the entry carries, and a catch-up is not manual.\n        const capturedLogs: string[] = seedLog ? [seedLog] : [];\n\n        // Set executing flag — prevents concurrent runs\n        job.executing = true;\n\n        const ctx: CronJobContext = {\n            jobId: job.id,\n            scheduledAt: startedAt,\n            log: (...args: unknown[]) => {\n                const line = args.map((a) =>\n                    typeof a === \"string\" ? a : JSON.stringify(a)\n                ).join(\" \");\n                capturedLogs.push(line);\n            },\n            // Both names, one object. `rebase` is canonical — it matches the\n            // singleton import and `defineFunction`'s context — and `client` is\n            // the deprecated alias kept so existing cron files keep running.\n            //\n            // The assertion covers only `client`'s extra `data`: the singleton\n            // carries that alias at runtime (`init.ts` assigns `data` and\n            // `dataAsAdmin` to the same plane) but `RebaseServerClient` omits it\n            // by design, so the deprecated name has to be re-stated here rather\n            // than leaking back into the canonical type.\n            rebase: this.client!,\n            client: this.client! as CronJobContext[\"client\"]\n        };\n\n        job.state = \"running\";\n        job.lastRunAt = startedAt;\n        job.totalRuns++;\n\n        let success = true;\n        let error: string | undefined;\n        let result: unknown;\n\n        try {\n            // Race with timeout\n            const timeout = (job.definition.timeoutSeconds ?? 300) * 1000;\n            const handlerPromise = Promise.resolve(job.definition.handler(ctx));\n            let timeoutHandle: ReturnType<typeof setTimeout>;\n            const timeoutPromise = new Promise<never>((_, reject) => {\n                timeoutHandle = setTimeout(\n                    () => reject(new Error(`Cron job \"${job.id}\" timed out after ${timeout}ms`)),\n                    timeout\n                );\n            });\n\n            try {\n                result = await Promise.race([handlerPromise, timeoutPromise]);\n            } finally {\n                clearTimeout(timeoutHandle!);\n            }\n        } catch (err: unknown) {\n            success = false;\n            // Redacted at the point of capture, not just on the way to the log:\n            // this string is persisted into `cron_logs` and rendered in the\n            // Studio cron panel, and a job that fails on a query would\n            // otherwise store `Failed query: <sql>\\nparams: <values>` — the\n            // statement and every bound value — in a table, indefinitely.\n            error = redactSensitiveText(err instanceof Error ? err.message : String(err));\n            job.totalFailures++;\n        } finally {\n            // Always clear executing flag — even on catastrophic errors\n            job.executing = false;\n        }\n\n        const finishedAt = new Date();\n        const durationMs = finishedAt.getTime() - startedAt.getTime();\n\n        job.state = success ? (job.enabled ? \"idle\" : \"disabled\") : \"error\";\n        job.lastDurationMs = durationMs;\n        job.lastError = error;\n\n        const logEntry: CronJobLogEntry = {\n            jobId: job.id,\n            startedAt: startedAt.toISOString(),\n            finishedAt: finishedAt.toISOString(),\n            durationMs,\n            success,\n            error,\n            result: result !== undefined ? result : undefined,\n            logs: capturedLogs,\n            manual\n        };\n\n        // Push to ring buffer\n        job.logs.push(logEntry);\n        if (job.logs.length > MAX_LOGS_PER_JOB) {\n            job.logs.shift();\n        }\n\n        // Persist to database (non-blocking)\n        if (this.store) {\n            this.store.insertLog(logEntry).catch((persistErr) => {\n                logger.error(`[cron] Failed to persist log for \"${job.id}\"`, { error: persistErr });\n            });\n        }\n\n        if (success) {\n            logger.info(`✅ [cron] \"${job.id}\" completed in ${durationMs}ms`);\n        } else {\n            logger.error(`❌ [cron] \"${job.id}\" failed in ${durationMs}ms: ${error}`);\n        }\n\n        return logEntry;\n    }\n\n    private toStatus(job: RegisteredJob): CronJobStatus {\n        return {\n            id: job.id,\n            name: job.definition.name,\n            description: job.definition.description,\n            schedule: job.definition.schedule,\n            enabled: job.enabled,\n            state: job.state,\n            lastRunAt: job.lastRunAt?.toISOString(),\n            nextRunAt: job.nextRunAt?.toISOString(),\n            lastDurationMs: job.lastDurationMs,\n            lastError: job.lastError,\n            totalRuns: job.totalRuns,\n            totalFailures: job.totalFailures\n        };\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyBA,IAAa,qBAAqB;;AAwBlC,SAAS,SAAS,OAAoC;CAClD,IAAI,CAAC,OAAO,OAAO;CACnB,MAAM,aAAa,MAAM,KAAK,CAAC,CAAC,YAAY;CAC5C,OAAO,eAAe,OAAO,eAAe,UAAU,eAAe,SAAS,eAAe;AACjG;;;;;;AAOA,SAAgB,uBAAuB,MAAe,QAAQ,KAAmC;CAI7F,IAAI,IAAI,yBAAyB,OAAO,KAAA;CAExC,IAAI,IAAI,WAAW;EACf,MAAM,UAAU,CAAC,WAAW;EAC5B,IAAI,IAAI,YAAY,QAAQ,KAAK,YAAY;EAC7C,IAAI,IAAI,iBAAiB,QAAQ,KAAK,iBAAiB;EACvD,OAAO;GAAE,UAAU;GAAa;EAAQ;CAC5C;CAEA,IAAI,IAAI,eACJ,OAAO;EAAE,UAAU;EAAkB,SAAS,CAAC,eAAe;CAAE;CAGpE,IAAI,IAAI,0BACJ,OAAO;EAAE,UAAU;EAAc,SAAS,CAAC,0BAA0B;CAAE;CAG3E,IAAI,IAAI,WAAW,KACf,OAAO;EAAE,UAAU;EAAU,SAAS,CAAC,QAAQ;CAAE;AAIzD;;AAGA,IAAM,iBAAiB;;;;;;;;;;AAWvB,SAAgB,wBACZ,MACA,MAAe,QAAQ,KACO;CAC9B,IAAI,IAAI,aAAa,cAAc,OAAO,KAAA;CAC1C,IAAI,SAAS,IAAA,wBAAuB,GAAG,OAAO,KAAA;CAE9C,MAAM,UAAU,KAAK,QAAQ,QAAQ,IAAI,OAAO,CAAC,CAAC,KAAK,QAAQ,IAAI,EAAE;CACrE,IAAI,QAAQ,WAAW,GAAG,OAAO,KAAA;CAEjC,MAAM,UAAU,uBAAuB,GAAG;CAC1C,IAAI,CAAC,SAAS,OAAO,KAAA;CAErB,MAAM,QAAQ,QAAQ,MAAM,GAAG,cAAc;CAC7C,MAAM,OAAO,QAAQ,SAAS,MAAM,SAC9B,GAAG,MAAM,KAAK,IAAI,EAAE,KAAK,QAAQ,SAAS,MAAM,OAAO,UACvD,MAAM,KAAK,IAAI;CAIrB,OAAO;EACH,SAAA,UAHsB,QAAQ,SAAS,8FAA8F,QAAQ,OAAO,iCAAiC,KAAK,sGAAsG,QAAQ,SAAS,sIAAsI,mBAAmB;EAI1c,MAAM;GACF,UAAU,QAAQ;GAClB,SAAS,QAAQ;GACjB,MAAM;EACV;CACJ;AACJ;;;;;;;;;;;;;AC3GA,SAAS,gBAAgB,OAAe,KAAa,KAAuB;CACxE,MAAM,0BAAU,IAAI,IAAY;CAChC,KAAK,MAAM,WAAW,MAAM,MAAM,GAAG,GAAG;EACpC,MAAM,UAAU,QAAQ,KAAK;EAC7B,IAAI,YAAY,KACZ,KAAK,IAAI,IAAI,KAAK,KAAK,KAAK,KAAK,QAAQ,IAAI,CAAC;OAC3C,IAAI,QAAQ,SAAS,GAAG,GAAG;GAC9B,MAAM,CAAC,UAAU,WAAW,QAAQ,MAAM,GAAG;GAC7C,MAAM,OAAO,SAAS,SAAS,EAAE;GACjC,IAAI,MAAM,IAAI,KAAK,QAAQ,GACvB,MAAM,IAAI,MAAM,uBAAuB,QAAQ,mBAAmB,MAAM,EAAE;GAE9E,IAAI,QAAQ;GACZ,IAAI,MAAM;GACV,IAAI,aAAa,KACb,IAAI,SAAS,SAAS,GAAG,GAAG;IACxB,MAAM,CAAC,GAAG,KAAK,SAAS,MAAM,GAAG,CAAC,CAAC,IAAI,MAAM;IAC7C,QAAQ;IACR,MAAM;GACV,OACI,QAAQ,SAAS,UAAU,EAAE;GAGrC,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,KAAK,MAAM,QAAQ,IAAI,CAAC;EAC1D,OAAO,IAAI,QAAQ,SAAS,GAAG,GAAG;GAC9B,MAAM,CAAC,GAAG,KAAK,QAAQ,MAAM,GAAG,CAAC,CAAC,IAAI,MAAM;GAC5C,KAAK,IAAI,IAAI,GAAG,KAAK,GAAG,KAAK,QAAQ,IAAI,CAAC;EAC9C,OAAO;GACH,MAAM,MAAM,SAAS,SAAS,EAAE;GAChC,IAAI,MAAM,GAAG,GACT,MAAM,IAAI,MAAM,kBAAkB,QAAQ,mBAAmB,MAAM,EAAE;GAEzE,QAAQ,IAAI,GAAG;EACnB;CACJ;CACA,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,MAAM,GAAG,MAAM,IAAI,CAAC;AAC5C;;;;;AAMA,SAAgB,uBAAuB,UAAsE;CACzG,IAAI,CAAC,YAAY,OAAO,aAAa,UACjC,OAAO;EAAE,OAAO;EACxB,QAAQ;CAAsC;CAE1C,MAAM,QAAQ,SAAS,KAAK,CAAC,CAAC,MAAM,KAAK;CACzC,IAAI,MAAM,WAAW,GACjB,OAAO;EAAE,OAAO;EACxB,QAAQ,0BAA0B,MAAM;CAAS;CAE7C,MAAM,cAA0C;EAC5C;GAAC;GAAU;GAAG;EAAE;EAChB;GAAC;GAAQ;GAAG;EAAE;EACd;GAAC;GAAgB;GAAG;EAAE;EACtB;GAAC;GAAS;GAAG;EAAE;EACf;GAAC;GAAe;GAAG;EAAC;CACxB;CACA,KAAK,IAAI,IAAI,GAAG,IAAI,GAAG,KAAK;EACxB,MAAM,CAAC,MAAM,KAAK,OAAO,YAAY;EACrC,IAAI;GACA,MAAM,SAAS,gBAAgB,MAAM,IAAI,KAAK,GAAG;GACjD,IAAI,OAAO,WAAW,GAClB,OAAO;IAAE,OAAO;IAChC,QAAQ,GAAG,KAAK,UAAU,MAAM,GAAG;GAAsB;GAE7C,KAAK,MAAM,KAAK,QACZ,IAAI,IAAI,OAAO,IAAI,KACf,OAAO;IAAE,OAAO;IACpC,QAAQ,GAAG,KAAK,eAAe,EAAE,iBAAiB,IAAI,GAAG,IAAI;GAAG;EAGxD,SAAS,KAAK;GACV,OAAO;IAAE,OAAO;IAC5B,QAAQ,GAAG,KAAK,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;GAAI;EACrE;CACJ;CACA,OAAO,EAAE,OAAO,KAAK;AACzB;;AAYA,SAAS,gBAAgB,YAAgC;CACrD,MAAM,QAAQ,WAAW,KAAK,CAAC,CAAC,MAAM,KAAK;CAC3C,IAAI,MAAM,SAAS,GACf,MAAM,IAAI,MAAM,6BAA6B,WAAW,sBAAsB;CAElF,MAAM,CAAC,UAAU,WAAW,UAAU,UAAU,YAAY;CAC5D,OAAO;EACH,SAAS,gBAAgB,UAAU,GAAG,EAAE;EACxC,OAAO,gBAAgB,WAAW,GAAG,EAAE;EACvC,MAAM,gBAAgB,UAAU,GAAG,EAAE;EACrC,QAAQ,gBAAgB,UAAU,GAAG,EAAE;EACvC,MAAM,gBAAgB,UAAU,GAAG,CAAC;CACxC;AACJ;;AAGA,SAAS,kBAAkB,WAAiB,QAA6B;CACrE,OAAO,OAAO,OAAO,SAAS,UAAU,SAAS,IAAI,CAAC,KAC/C,OAAO,KAAK,SAAS,UAAU,QAAQ,CAAC,KACxC,OAAO,KAAK,SAAS,UAAU,OAAO,CAAC,KACvC,OAAO,MAAM,SAAS,UAAU,SAAS,CAAC,KAC1C,OAAO,QAAQ,SAAS,UAAU,WAAW,CAAC;AACzD;;;;;;;;;AAUA,IAAM,0BAA0B;;;;;AAMhC,SAAgB,oBAAoB,YAAoB,OAAmB;CACvE,MAAM,SAAS,gBAAgB,UAAU;CAGzC,MAAM,YAAY,IAAI,KAAK,KAAK;CAChC,UAAU,WAAW,GAAG,CAAC;CACzB,UAAU,WAAW,UAAU,WAAW,IAAI,CAAC;CAE/C,KAAK,IAAI,IAAI,GAAG,IAAI,yBAAyB,KAAK;EAC9C,IAAI,kBAAkB,WAAW,MAAM,GACnC,OAAO;EAEX,UAAU,WAAW,UAAU,WAAW,IAAI,CAAC;CACnD;CAaA,MAAM,IAAI,MACN,oBAAoB,WAAW,gCAC5B,KAAK,MAAM,0BAA0B,MAAM,EAAE,YAAY,MAAM,YAAY,EAAE,qFAEpF;AACJ;;;;;;;;;;;;;;;;;AAkBA,SAAgB,mBAAmB,YAAoB,MAAY,IAA4B;CAC3F,MAAM,SAAS,gBAAgB,UAAU;CAEzC,MAAM,YAAY,IAAI,KAAK,EAAE;CAC7B,UAAU,WAAW,GAAG,CAAC;CAEzB,KAAK,IAAI,IAAI,GAAG,IAAI,2BAA2B,UAAU,QAAQ,KAAK,KAAK,QAAQ,GAAG,KAAK;EACvF,IAAI,kBAAkB,WAAW,MAAM,GACnC,OAAO;EAEX,UAAU,WAAW,UAAU,WAAW,IAAI,CAAC;CACnD;AAGJ;AAIA,IAAM,mBAAmB;;;;;AAMzB,IAAM,2BAA2B;;;;;;AAOjC,IAAM,qBAAqB;AAqB3B,IAAa,gBAAb,MAA2B;CACvB,uBAAe,IAAI,IAA2B;CAC9C,UAAkB;CAClB;CACA;;;;;;;;;CAUA,UAAU,QAAkC;EACxC,KAAK,SAAS;CAClB;;;;;;CAOA,SAAS,OAAwB;EAC7B,KAAK,QAAQ;CACjB;;;;;;;;;;CAWA,aAAa,YAAmC;EAC5C,KAAK,MAAM,UAAU,YAAY;GAE7B,MAAM,aAAa,uBAAuB,OAAO,WAAW,QAAQ;GACpE,IAAI,CAAC,WAAW,OAAO;IACnB,OAAO,MAAM,yBAAyB,OAAO,GAAG,uBAAuB,OAAO,WAAW,SAAS,MAAM,WAAW,QAAQ;IAC3H;GACJ;GAGA,IADiB,KAAK,KAAK,IAAI,OAAO,EAClC,GAAU;IACV,OAAO,KAAK,kCAAkC,OAAO,GAAG,gBAAgB;IACxE,KAAK,QAAQ,OAAO,EAAE;GAC1B;GAEA,MAAM,UAAU,OAAO,WAAW,YAAY;GAE9C,KAAK,KAAK,IAAI,OAAO,IAAI;IACrB,IAAI,OAAO;IACX,YAAY,OAAO;IACnB;IACA,OAAO,UAAU,SAAS;IAC1B,WAAW;IACX,eAAe;IACf,MAAM,CAAC;IACP,WAAW;GACf,CAAC;GAGD,IAAI,KAAK,WAAW,SAChB,KAAK,aAAa,OAAO,EAAE;EAEnC;CACJ;;;;CAKA,QAAc;EACV,IAAI,KAAK,SAAS;EAClB,KAAK,UAAU;EAGf,IAAI,KAAK,OACL,KAAK,MAAM,cAAc,CAAC,CAAC,MAAM,UAAU;GACvC,KAAK,MAAM,CAAC,OAAO,SAAS,OAAO;IAC/B,MAAM,MAAM,KAAK,KAAK,IAAI,KAAK;IAC/B,IAAI,KAAK;KACL,IAAI,YAAY,KAAK;KACrB,IAAI,gBAAgB,KAAK;KACzB,IAAI,KAAK,WACL,IAAI,YAAY,IAAI,KAAK,KAAK,SAAS;IAE/C;GACJ;EACJ,CAAC,CAAC,CAAC,OAAO,QAAQ;GACd,OAAO,KAAK,iDAAiD,EAAE,OAAO,IAAI,CAAC;EAC/E,CAAC;EAGL,KAAK,MAAM,CAAC,IAAI,QAAQ,KAAK,MACzB,IAAI,IAAI,SACJ,KAAK,aAAa,EAAE;EAG5B,IAAI,CAAC,KAAK,OACN,OAAO,KAAK,2HAA2H;EAE3I,KAAK,kBAAkB;EAKvB,KAAU,mBAAmB;EAE7B,OAAO,KAAK,iCAAiC,KAAK,KAAK,KAAK,QAAQ;CACxE;;;;;;;CAQA,OAAa;EACT,KAAK,UAAU;EACf,KAAK,MAAM,CAAC,OAAO,KAAK,MACpB,KAAK,QAAQ,EAAE;CAEvB;;;;CAKA,WAA4B;EACxB,OAAO,CAAC,GAAG,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,QAAQ,KAAK,SAAS,GAAG,CAAC;CAClE;;;;CAKA,OAAO,IAAuC;EAC1C,MAAM,MAAM,KAAK,KAAK,IAAI,EAAE;EAC5B,OAAO,MAAM,KAAK,SAAS,GAAG,IAAI,KAAA;CACtC;;;;CAKA,WAAW,IAAY,OAAmC;EACtD,MAAM,MAAM,KAAK,KAAK,IAAI,EAAE;EAC5B,IAAI,CAAC,KAAK,OAAO,CAAC;EAClB,MAAM,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,QAAQ;EACnC,OAAO,QAAQ,KAAK,MAAM,GAAG,KAAK,IAAI;CAC1C;;;;;CAMA,MAAM,iBAAiB,IAAY,OAA4C;EAC3E,IAAI,KAAK,OAAO;GACZ,MAAM,SAAS,MAAM,KAAK,MAAM,UAAU,IAAI,KAAK;GACnD,IAAI,OAAO,SAAS,GAAG,OAAO;EAClC;EAEA,OAAO,KAAK,WAAW,IAAI,KAAK;CACpC;;;;CAKA,cAAc,IAAY,SAA6C;EACnE,MAAM,MAAM,KAAK,KAAK,IAAI,EAAE;EAC5B,IAAI,CAAC,KAAK,OAAO,KAAA;EAEjB,IAAI,UAAU;EAEd,IAAI,WAAW,KAAK,SAAS;GACzB,IAAI,QAAQ;GACZ,KAAK,aAAa,EAAE;EACxB,OAAO,IAAI,CAAC,SAAS;GACjB,KAAK,QAAQ,EAAE;GACf,IAAI,QAAQ;EAChB;EAEA,OAAO,KAAK,SAAS,GAAG;CAC5B;;;;;;;;CASA,MAAM,WAAW,IAAkD;EAC/D,MAAM,MAAM,KAAK,KAAK,IAAI,EAAE;EAC5B,IAAI,CAAC,KAAK,OAAO,KAAA;EAGjB,IAAI,IAAI,WAAW;GACf,OAAO,KAAK,sCAAsC,GAAG,sBAAsB;GAC3E,MAAM,WAA4B;IAC9B,OAAO;IACP,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;IAClC,6BAAY,IAAI,KAAK,EAAA,CAAE,YAAY;IACnC,YAAY;IACZ,SAAS;IACT,QAAQ;KAAE,SAAS;KACnC,QAAQ;IAAoB;IACZ,MAAM,CAAC,iCAAiC;IACxC,QAAQ;GACZ;GACA,IAAI,KAAK,KAAK,QAAQ;GACtB,IAAI,IAAI,KAAK,SAAS,kBAAkB,IAAI,KAAK,MAAM;GACvD,OAAO;EACX;EAEA,OAAO,KAAK,WAAW,KAAK,IAAI;CACpC;;;;;;;;;CAYA,oBAAkC;EAC9B,IAAI;GACA,MAAM,UAAU,wBACZ,CAAC,GAAG,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,SAAS;IAAE,IAAI,IAAI;IAAI,SAAS,IAAI;GAAQ,EAAE,CAC/E;GACA,IAAI,SACA,OAAO,KAAK,QAAQ,SAAS,QAAQ,IAAI;EAEjD,QAAQ,CAER;CACJ;;;;;;;;;;;CAYA,aAAqB,IAAkB;EACnC,MAAM,MAAM,KAAK,KAAK,IAAI,EAAE;EAC5B,IAAI,CAAC,OAAO,CAAC,IAAI,WAAW,CAAC,KAAK,SAAS;EAG3C,KAAK,QAAQ,EAAE;EAEf,IAAI;GACA,MAAM,sBAAM,IAAI,KAAK;GACrB,MAAM,UAAU,oBAAoB,IAAI,WAAW,UAAU,GAAG;GAChE,IAAI,YAAY;GAEhB,MAAM,WAAW,QAAQ,QAAQ,IAAI,IAAI,QAAQ;GAGjD,MAAM,QAAQ,KAAK,IAAI,UAAU,wBAAwB;GAQzD,IAAI,QAAQ,oBAAoB;IAC5B,MAAM,MAAM,iBAAiB;KACzB,IAAI,KAAK,WAAW,IAAI,SAAS,KAAK,aAAa,EAAE;IACzD,GAAG,kBAAkB;IACrB,IAAI,OAAO,OAAO,QAAQ,YAAY,WAAW,KAC7C,IAAI,MAAM;IAEd,IAAI,UAAU;IACd;GACJ;GAEA,MAAM,QAAQ,WAAW,YAAY;IAGjC,IAAI,CAAC,IAAI,WAAW,CAAC,KAAK,SAAS;IAGnC,IAAI,IAAI,WAAW;KACf,OAAO,KAAK,qCAAqC,GAAG,sCAAsC;KAE1F,KAAK,aAAa,EAAE;KACpB;IACJ;IASA,IAAI,KAAK,IAAI,IAAI,QAAQ,QAAQ,GAAG;KAChC,KAAK,aAAa,EAAE;KACpB;IACJ;IASA,IAAI,KAAK,OAAO,aAAa;KACzB,IAAI,UAAU;KACd,IAAI;MACA,UAAU,MAAM,KAAK,MAAM,YAAY,IAAI,QAAQ,YAAY,CAAC;KACpE,SAAS,KAAK;MACV,OAAO,KAAK,iCAAiC,GAAG,4BAA4B,EAAE,OAAO,IAAI,CAAC;KAC9F;KACA,IAAI,CAAC,SAAS;MACV,OAAO,KAAK,eAAe,QAAQ,YAAY,EAAE,QAAQ,GAAG,yCAAyC;MACrG,IAAI,KAAK,WAAW,IAAI,SACpB,KAAK,aAAa,EAAE;MAExB;KACJ;IACJ;IAEA,MAAM,KAAK,WAAW,KAAK,KAAK;IAGhC,IAAI,KAAK,WAAW,IAAI,SACpB,KAAK,aAAa,EAAE;GAE5B,GAAG,KAAK;GAIR,IAAI,SAAS,OAAO,UAAU,YAAY,WAAW,OACjD,MAAM,MAAM;GAGhB,IAAI,UAAU;EAClB,SAAS,KAAc;GACnB,OAAO,MAAM,8BAA8B,GAAG,IAAI,EAAE,OAAO,IAAI,CAAC;GAChE,IAAI,QAAQ;GACZ,IAAI,YAAY,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;EACnE;CACJ;;;;;;;;;;;;;;;;;CAkBA,MAAc,qBAAoC;EAC9C,MAAM,aAAa,CAAC,GAAG,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,QACvC,QAAO,IAAI,YAAY,IAAI,WAAW,wBAAwB,KAAK,CACvE;EACA,IAAI,WAAW,WAAW,GAAG;EAM7B,IAAI,CAAC,KAAK,OAAO,aAAa;GAC1B,OAAO,KACH,oCAAoC,WAAW,OAAO,2JAE1D;GACA;EACJ;EAEA,MAAM,sBAAM,IAAI,KAAK;EAErB,KAAK,MAAM,OAAO,YACd,IAAI;GACA,IAAI,CAAC,KAAK,WAAW,CAAC,IAAI,WAAW,IAAI,WAAW;GAEpD,MAAM,gBAAgB,IAAI,WAAW;GACrC,MAAM,uBAAO,IAAI,KAAK,IAAI,QAAQ,IAAI,gBAAgB,GAAI;GAC1D,MAAM,OAAO,mBAAmB,IAAI,WAAW,UAAU,MAAM,GAAG;GAClE,IAAI,CAAC,MAAM;GAEX,MAAM,UAAU,KAAK,YAAY;GAIjC,IAAI;GACJ,IAAI;IACA,UAAU,MAAM,KAAK,MAAM,YAAY,IAAI,IAAI,OAAO;GAC1D,SAAS,KAAK;IAKV,OAAO,KAAK,oCAAoC,IAAI,GAAG,wBAAwB,EAAE,OAAO,IAAI,CAAC;IAC7F;GACJ;GAEA,IAAI,CAAC,SAAS;GAEd,MAAM,SAAS,KAAK,OAAO,IAAI,QAAQ,IAAI,KAAK,QAAQ,KAAK,GAAI;GACjE,OAAO,KAAK,kCAAkC,QAAQ,QAAQ,IAAI,GAAG,KAAK,OAAO,QAAQ;GAEzF,MAAM,KAAK,WAAW,KAAK,OAAO,kCAAkC,QAAQ,IAAI,OAAO,QAAQ;EACnG,SAAS,KAAK;GACV,OAAO,MAAM,+BAA+B,IAAI,GAAG,IAAI,EAAE,OAAO,IAAI,CAAC;EACzE;CAER;;;;CAKA,QAAgB,IAAkB;EAC9B,MAAM,MAAM,KAAK,KAAK,IAAI,EAAE;EAC5B,IAAI,KAAK,SAAS;GACd,aAAa,IAAI,OAAO;GACxB,IAAI,UAAU,KAAA;GACd,IAAI,YAAY,KAAA;EACpB;CACJ;;;;;;;;;;CAWA,MAAc,WACV,KACA,QACA,SACwB;EACxB,MAAM,4BAAY,IAAI,KAAK;EAK3B,MAAM,eAAyB,UAAU,CAAC,OAAO,IAAI,CAAC;EAGtD,IAAI,YAAY;EAEhB,MAAM,MAAsB;GACxB,OAAO,IAAI;GACX,aAAa;GACb,MAAM,GAAG,SAAoB;IACzB,MAAM,OAAO,KAAK,KAAK,MACnB,OAAO,MAAM,WAAW,IAAI,KAAK,UAAU,CAAC,CAChD,CAAC,CAAC,KAAK,GAAG;IACV,aAAa,KAAK,IAAI;GAC1B;GAUA,QAAQ,KAAK;GACb,QAAQ,KAAK;EACjB;EAEA,IAAI,QAAQ;EACZ,IAAI,YAAY;EAChB,IAAI;EAEJ,IAAI,UAAU;EACd,IAAI;EACJ,IAAI;EAEJ,IAAI;GAEA,MAAM,WAAW,IAAI,WAAW,kBAAkB,OAAO;GACzD,MAAM,iBAAiB,QAAQ,QAAQ,IAAI,WAAW,QAAQ,GAAG,CAAC;GAClE,IAAI;GACJ,MAAM,iBAAiB,IAAI,SAAgB,GAAG,WAAW;IACrD,gBAAgB,iBACN,uBAAO,IAAI,MAAM,aAAa,IAAI,GAAG,oBAAoB,QAAQ,GAAG,CAAC,GAC3E,OACJ;GACJ,CAAC;GAED,IAAI;IACA,SAAS,MAAM,QAAQ,KAAK,CAAC,gBAAgB,cAAc,CAAC;GAChE,UAAU;IACN,aAAa,aAAc;GAC/B;EACJ,SAAS,KAAc;GACnB,UAAU;GAMV,QAAQ,oBAAoB,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;GAC5E,IAAI;EACR,UAAU;GAEN,IAAI,YAAY;EACpB;EAEA,MAAM,6BAAa,IAAI,KAAK;EAC5B,MAAM,aAAa,WAAW,QAAQ,IAAI,UAAU,QAAQ;EAE5D,IAAI,QAAQ,UAAW,IAAI,UAAU,SAAS,aAAc;EAC5D,IAAI,iBAAiB;EACrB,IAAI,YAAY;EAEhB,MAAM,WAA4B;GAC9B,OAAO,IAAI;GACX,WAAW,UAAU,YAAY;GACjC,YAAY,WAAW,YAAY;GACnC;GACA;GACA;GACA,QAAQ,WAAW,KAAA,IAAY,SAAS,KAAA;GACxC,MAAM;GACN;EACJ;EAGA,IAAI,KAAK,KAAK,QAAQ;EACtB,IAAI,IAAI,KAAK,SAAS,kBAClB,IAAI,KAAK,MAAM;EAInB,IAAI,KAAK,OACL,KAAK,MAAM,UAAU,QAAQ,CAAC,CAAC,OAAO,eAAe;GACjD,OAAO,MAAM,qCAAqC,IAAI,GAAG,IAAI,EAAE,OAAO,WAAW,CAAC;EACtF,CAAC;EAGL,IAAI,SACA,OAAO,KAAK,aAAa,IAAI,GAAG,iBAAiB,WAAW,GAAG;OAE/D,OAAO,MAAM,aAAa,IAAI,GAAG,cAAc,WAAW,MAAM,OAAO;EAG3E,OAAO;CACX;CAEA,SAAiB,KAAmC;EAChD,OAAO;GACH,IAAI,IAAI;GACR,MAAM,IAAI,WAAW;GACrB,aAAa,IAAI,WAAW;GAC5B,UAAU,IAAI,WAAW;GACzB,SAAS,IAAI;GACb,OAAO,IAAI;GACX,WAAW,IAAI,WAAW,YAAY;GACtC,WAAW,IAAI,WAAW,YAAY;GACtC,gBAAgB,IAAI;GACpB,WAAW,IAAI;GACf,WAAW,IAAI;GACf,eAAe,IAAI;EACvB;CACJ;AACJ"}

package/dist/ddl-bootstrap-Cywoj8Ta.js

@@ -1,221 +0,0 @@
-import { createRequire as __createRequire } from "module";
-import "process";
-__createRequire(import.meta.url);
-import { t as logger } from "./logger-DfvF_8r-.js";
-//#region ../types/src/types/backend.ts
-/**
-* Type guard: does this admin support SQL operations?
-* @group Admin
-*/
-function isSQLAdmin(admin) {
-	return !!admin && typeof admin.executeSql === "function";
-}
-//#endregion
-//#region ../common/src/util/internal-tables.ts
-/**
-* The tables Rebase creates for its own bookkeeping, and the SQL that keeps the
-* end-user role away from them.
-*
-* ## Why this exists
-*
-* Authenticated requests run as {@link REBASE_USER_ROLE}, and the boot-time role
-* provisioning grants that role `SELECT, INSERT, UPDATE, DELETE` on every table
-* in the schemas a project uses — including `rebase`, because a project's own
-* collections are allowed to live there (the scaffold puts `users` there). It
-* also sets `ALTER DEFAULT PRIVILEGES`, so a table created *later* by the
-* migrating role inherits the same grant.
-*
-* Every framework-internal table is created later: auth's tables come up during
-* `initializeAuth`, `api_keys` during route mounting, `cron_logs` when the first
-* job registers, `idempotency_keys` on the first request that carries a key. So
-* they all inherited full DML for the end-user role — and none of them enables
-* row-level security, because none of them is a collection with
-* `securityRules`. Measured on a freshly provisioned database, `SET ROLE
-* rebase_user` could read `rebase.refresh_tokens` (session token hashes),
-* `rebase.mfa_factors` (`secret_encrypted`), `rebase.recovery_codes`, and
-* `rebase.api_keys` (including its `admin` flag), and insert into
-* `rebase.app_config`.
-*
-* Nothing routes a user-context query at those tables today, so this was not
-* reachable over the API. That is the wrong thing to depend on: the documented
-* model is that RLS is the authorization boundary, and these tables sat outside
-* it. The boundary is now a privilege boundary instead — the role simply cannot
-* address them.
-*
-* ## Why REVOKE rather than ENABLE ROW LEVEL SECURITY
-*
-* RLS with no policy denies every row, which is the same outcome, but it is the
-* *weaker* statement: it leaves the grant in place, so a later policy — or a
-* `FORCE` flag cleared by some future migration — reopens the table. There is no
-* row of `refresh_tokens` any end user should ever reach, so the honest encoding
-* is "this role has no privilege here at all". It also keeps the owner
-* connection (which auth actually runs on) completely unaffected.
-*
-* ## Keeping it true
-*
-* `packages/rls-check` scans the `rebase` schema — it used to skip it as a
-* "platform" schema — and its `rls-disabled` check fires on exactly the
-* condition this module removes: RLS off *and* a DML grant to a reachable role.
-* So a table added here without a revoke is caught by `pnpm rls:check`, not by
-* someone re-reading this file.
-*/
-/**
-* The Postgres role authenticated requests run as.
-*
-* Defined here rather than in the Postgres driver because both the driver (which
-* provisions the role) and this module (which revokes on its behalf) need it,
-* and a second spelling of a role name is a silent no-op waiting to happen.
-*/
-var REBASE_USER_ROLE = "rebase_user";
-/** Postgres identifiers this module is willing to interpolate. */
-var SAFE_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_$]*$/;
-/**
-* A single statement that takes every privilege on `schema.table` away from the
-* end-user role.
-*
-* Wrapped in a `DO` block guarded on `pg_roles` for two reasons, both of which
-* happen in practice:
-*
-*  - the role does not exist when the connection is unprivileged (Rebase then
-*    relies on native RLS rather than a role switch), and a bare `REVOKE` on a
-*    missing role is an error, not a no-op;
-*  - the table may not exist yet — `cron_logs` never appears in a project with
-*    no cron jobs — and `to_regclass` returning NULL has to be tolerated too.
-*
-* One command, so it is safe on handles that speak the extended query protocol
-* and reject multi-statement strings.
-*/
-function revokeInternalTableSql(schema, table) {
-	if (!SAFE_IDENTIFIER.test(schema)) throw new Error(`Refusing to build SQL with an unsafe schema name: ${JSON.stringify(schema)}`);
-	if (!SAFE_IDENTIFIER.test(table)) throw new Error(`Refusing to build SQL with an unsafe table name: ${JSON.stringify(table)}`);
-	const qualified = `"${schema}"."${table}"`;
-	return `
-        DO $rebase_revoke$
-        BEGIN
-            IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = '${REBASE_USER_ROLE}')
-               AND to_regclass('${qualified}') IS NOT NULL THEN
-                EXECUTE 'REVOKE ALL ON ${qualified} FROM ${REBASE_USER_ROLE}';
-            END IF;
-        END
-        $rebase_revoke$;
-    `.trim();
-}
-//#endregion
-//#region src/boot/ddl-bootstrap.ts
-/**
-* SQLSTATEs a *simultaneous boot* can raise from statements that are otherwise
-* idempotent. Retrying is always the right answer for these: the second attempt
-* finds the object present and does nothing.
-*/
-var CONCURRENT_DDL_SQLSTATES = /* @__PURE__ */ new Set([
-	"23505",
-	"42P06",
-	"42P07",
-	"42710",
-	"40P01"
-]);
-var DDL_RETRY_BASE_MS = 40;
-/**
-* Walk an error's `cause` chain, stopping at the first link `visit` accepts.
-* Drizzle wraps the driver error, so nothing useful is ever on the top level.
-*/
-function hasInCauseChain(err, visit) {
-	let current = err;
-	for (let depth = 0; depth < 10 && current; depth++) {
-		if (typeof current !== "object") break;
-		const e = current;
-		if (visit(e)) return true;
-		current = e.cause;
-	}
-	return false;
-}
-/**
-* Is this the loser of a race to create something that already exists?
-*
-* Deliberately narrow. A permission failure, an unreachable database or a typo
-* in the DDL must surface on the first attempt rather than being retried four
-* times and then reported as a race that never was.
-*/
-function isConcurrentDdlRace(err) {
-	return hasInCauseChain(err, (e) => typeof e.code === "string" && CONCURRENT_DDL_SQLSTATES.has(e.code) || typeof e.message === "string" && /already exists/i.test(e.message));
-}
-/**
-* SQLSTATEs that mean, unambiguously, *the object is already there*.
-*
-* A subset of {@link CONCURRENT_DDL_SQLSTATES} and a stricter question. The
-* broad set answers "should this be retried"; this one answers "is it safe to
-* carry on as though the statement had succeeded", which is a claim about the
-* end state rather than about the attempt. Deadlock is not in it — a deadlocked
-* statement did nothing and must be retried, not skipped.
-*/
-var DUPLICATE_OBJECT_SQLSTATES = /* @__PURE__ */ new Set([
-	"42P06",
-	"42P07",
-	"42710"
-]);
-/**
-* Did this statement fail *because a peer already created the same object*?
-*
-* The narrow companion to {@link isConcurrentDdlRace}, for the one caller that
-* needs to tell "someone beat me to it" from "this genuinely failed": a loop
-* applying a schema plan, where treating every `23505` as a harmless race would
-* silently swallow the one that matters — a unique constraint that cannot be
-* added because the customer's existing rows violate it.
-*
-* `23505` is therefore only accepted when it names a `pg_catalog` index. That is
-* what a lost `CREATE TYPE`/`CREATE TABLE` race raises (`pg_type_typname_nsp_index`
-* is the one seen in practice); a unique violation on user data names the user's
-* own constraint and is left to the caller.
-*/
-function isDuplicateObjectRace(err) {
-	return hasInCauseChain(err, (e) => {
-		if (typeof e.code !== "string") return false;
-		if (DUPLICATE_OBJECT_SQLSTATES.has(e.code)) return true;
-		if (e.code !== "23505") return false;
-		const constraint = typeof e.constraint === "string" ? e.constraint : "";
-		const detail = typeof e.detail === "string" ? e.detail : "";
-		return constraint.startsWith("pg_") || /\bpg_[a-z_]+_index\b/.test(detail);
-	});
-}
-/**
-* @param exec   the driver's SQL escape hatch
-* @param scope  log prefix identifying the caller, e.g. `"cron-store"`
-*/
-function createDdlBootstrapper(exec, scope) {
-	/** Jittered, so peers that collided once do not collide again in lockstep. */
-	const backoff = (attempt) => new Promise((resolve) => setTimeout(resolve, DDL_RETRY_BASE_MS * attempt * (1 + Math.random())));
-	const step = async (label, run) => {
-		try {
-			await run();
-		} catch (err) {
-			logger.error(`[${scope}] ${label} failed`, { error: err });
-		}
-	};
-	return {
-		step,
-		ensureObject(label, sqlText) {
-			return step(label, async () => {
-				for (let attempt = 1;; attempt++) try {
-					await exec(sqlText);
-					return;
-				} catch (err) {
-					if (!isConcurrentDdlRace(err) || attempt >= 4) throw err;
-					logger.debug(`[${scope}] Lost a create race for ${label} with another instance (attempt ${attempt}/4) — retrying`);
-					await backoff(attempt);
-				}
-			});
-		},
-		async isReadable(table) {
-			try {
-				await exec(`SELECT 1 FROM ${table} WHERE false`);
-				return true;
-			} catch {
-				return false;
-			}
-		}
-	};
-}
-//#endregion
-export { isDuplicateObjectRace as a, isConcurrentDdlRace as i, createDdlBootstrapper as n, revokeInternalTableSql as o, hasInCauseChain as r, isSQLAdmin as s, CONCURRENT_DDL_SQLSTATES as t };
-
-//# sourceMappingURL=ddl-bootstrap-Cywoj8Ta.js.map

package/dist/ddl-bootstrap-Cywoj8Ta.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"ddl-bootstrap-Cywoj8Ta.js","names":[],"sources":["../../types/src/types/backend.ts","../../common/src/util/internal-tables.ts","../src/boot/ddl-bootstrap.ts"],"sourcesContent":["import type { CollectionConfig, FilterValues, WhereFilterOp } from \"./collections\";\nimport type { OrderByTuple } from \"./filter-operators\";\nimport type { LogicalCondition } from \"../controllers/data\";\nimport type { AuthAdapter } from \"./auth_adapter\";\nimport type { HistoryConfig } from \"../controllers/client\";\nimport type { ChannelBusSetting } from \"./channel_bus\";\n\n// =============================================================================\n// DATABASE CONNECTION INTERFACES\n// =============================================================================\n\n/**\n * Abstract database connection interface.\n * Represents a connection to any database system.\n */\nexport interface DatabaseConnection {\n    /**\n     * Type identifier for this database (e.g., 'postgres', 'mongodb', 'mysql')\n     */\n    readonly type: string;\n\n    /**\n     * Whether the connection is currently active\n     */\n    readonly isConnected?: boolean;\n\n    /**\n     * Close the database connection and release resources.\n     */\n    close?(): Promise<void>;\n}\n\n// =============================================================================\n// QUERY BUILDING INTERFACES\n// =============================================================================\n\n/**\n * A single filter condition for database queries\n */\nexport interface QueryFilter {\n    field: string;\n    operator: WhereFilterOp;\n    value: unknown;\n}\n\n/**\n * Options for fetching a collection of entities\n */\nexport interface FetchCollectionOptions<M extends Record<string, unknown> = Record<string, unknown>> {\n    filter?: FilterValues<Extract<keyof M, string>>;\n    /** See `FetchCollectionProps.orderBy`: a field name plus `order`, or a list of tuples. */\n    orderBy?: string | OrderByTuple[];\n    order?: \"desc\" | \"asc\";\n    limit?: number;\n    offset?: number;\n    startAfter?: unknown;\n    searchString?: string;\n    databaseId?: string;\n    collection?: CollectionConfig;\n}\n\n/**\n * Options for searching entities\n */\nexport interface SearchOptions<M extends Record<string, unknown> = Record<string, unknown>> {\n    filter?: FilterValues<Extract<keyof M, string>>;\n    /** See `FetchCollectionProps.orderBy`: a field name plus `order`, or a list of tuples. */\n    orderBy?: string | OrderByTuple[];\n    order?: \"desc\" | \"asc\";\n    limit?: number;\n    databaseId?: string;\n    collection?: CollectionConfig;\n}\n\n/**\n * Options for counting entities\n */\nexport interface CountOptions<M extends Record<string, unknown> = Record<string, unknown>> {\n    filter?: FilterValues<Extract<keyof M, string>>;\n    /**\n     * An `or(...)`/`and(...)` group, alongside `filter`.\n     *\n     * Counted as well as fetched, or `total` describes a different set of rows\n     * from the one that was served — the same reason `filter` is here.\n     */\n    logical?: LogicalCondition;\n    searchString?: string;\n    databaseId?: string;\n}\n\n/**\n * Abstract condition builder interface.\n * Implementations translate Rebase filter conditions to database-specific queries.\n *\n * Note: This interface can be implemented as instance methods or as a class with static methods.\n * For static implementations (like DrizzleConditionBuilder), use the ConditionBuilderStatic type.\n *\n * @template T The type of condition returned by the builder (e.g., SQL for PostgreSQL, Filter<Document> for MongoDB)\n */\nexport interface ConditionBuilder<T = unknown> {\n    /**\n     * Build filter conditions from Rebase FilterValues\n     */\n    buildFilterConditions<M extends Record<string, unknown>>(\n        filter: FilterValues<Extract<keyof M, string>>,\n        collectionPath: string,\n        ...args: unknown[]\n    ): T[];\n\n    /**\n     * Build search conditions for text search\n     */\n    buildSearchConditions(\n        searchString: string,\n        properties: Record<string, unknown>,\n        ...args: unknown[]\n    ): T[];\n\n    /**\n     * Combine multiple conditions with AND operator\n     */\n    combineConditionsWithAnd(conditions: T[]): T | undefined;\n\n    /**\n     * Combine multiple conditions with OR operator\n     */\n    combineConditionsWithOr(conditions: T[]): T | undefined;\n}\n\n/**\n * Static condition builder type for implementations using static methods.\n * Use this type when the class provides static methods rather than instance methods.\n *\n * @example\n * // DrizzleConditionBuilder satisfies this type\n * const builder: ConditionBuilderStatic<SQL> = DrizzleConditionBuilder;\n */\nexport type ConditionBuilderStatic<T = unknown> = {\n    buildFilterConditions<M extends Record<string, unknown>>(\n        filter: FilterValues<Extract<keyof M, string>>,\n        ...args: unknown[]\n    ): T[];\n    buildSearchConditions(\n        searchString: string,\n        properties: Record<string, unknown>,\n        ...args: unknown[]\n    ): T[];\n    combineConditionsWithAnd(conditions: T[]): T | undefined;\n    combineConditionsWithOr(conditions: T[]): T | undefined;\n};\n\n// =============================================================================\n// ENTITY REPOSITORY INTERFACES\n// =============================================================================\n\n/**\n * Abstract entity repository interface.\n * Handles all CRUD operations for entities in the database.\n *\n * Implementations should handle:\n * - Entity serialization/deserialization\n * - Relation resolution\n * - ID generation and conversion\n */\nexport interface DataRepository {\n    /**\n     * Fetch a single entity by ID\n     */\n    fetchOne<M extends Record<string, unknown>>(\n        collectionPath: string,\n        id: string | number,\n        databaseId?: string\n    ): Promise<Record<string, unknown> | undefined>;\n\n    /**\n     * Fetch a collection of entities with optional filtering, ordering, and pagination\n     */\n    fetchCollection<M extends Record<string, unknown>>(\n        collectionPath: string,\n        options?: FetchCollectionOptions<M>\n    ): Promise<Record<string, unknown>[]>;\n\n    /**\n     * Search entities by text\n     */\n    searchRows<M extends Record<string, unknown>>(\n        collectionPath: string,\n        searchString: string,\n        options?: SearchOptions<M>\n    ): Promise<Record<string, unknown>[]>;\n\n    /**\n     * Count entities in a collection\n     */\n    count<M extends Record<string, unknown>>(\n        collectionPath: string,\n        options?: CountOptions<M>\n    ): Promise<number>;\n\n    /**\n     * Save a entity (create or update)\n     */\n    save<M extends Record<string, unknown>>(\n        collectionPath: string,\n        values: Partial<M>,\n        id?: string | number,\n        databaseId?: string\n    ): Promise<Record<string, unknown>>;\n\n    /**\n     * Delete a entity by ID\n     */\n    delete(\n        collectionPath: string,\n        id: string | number,\n        databaseId?: string\n    ): Promise<void>;\n\n    /**\n     * Check if a field value is unique in a collection\n     */\n    checkUniqueField(\n        collectionPath: string,\n        fieldName: string,\n        value: unknown,\n        excludeEntityId?: string,\n        databaseId?: string\n    ): Promise<boolean>;\n\n}\n\n// =============================================================================\n// REALTIME INTERFACES\n// =============================================================================\n\n/**\n * Configuration for subscribing to a collection\n */\nexport interface CollectionSubscriptionConfig {\n    clientId: string;\n    path: string;\n    filter?: unknown;\n    /**\n     * An `or(...)`/`and(...)` group, applied alongside `filter`.\n     *\n     * Declared here because a subscription is a query, and every field a query\n     * has this one needs too. It was missing, so the type-checked boundary\n     * dropped it: the client sent the group, nothing rejected it, and the\n     * subscription re-fetched with the group gone — pushing every row the\n     * caller's policies allowed rather than the ones they asked for. The same\n     * defect `FetchCollectionProps.logical` documents, one layer up.\n     */\n    logical?: LogicalCondition;\n    /**\n     * Where the subscription's page starts. Missing for the same reason, with\n     * a quieter symptom: a subscriber watching page two was pushed page one,\n     * and a `collection_update` frame carries no window for it to notice with.\n     */\n    offset?: number;\n    /** See `FetchCollectionProps.orderBy`: a field name plus `order`, or a list of tuples. */\n    orderBy?: string | OrderByTuple[];\n    order?: \"desc\" | \"asc\";\n    limit?: number;\n    startAfter?: unknown;\n    databaseId?: string;\n    searchString?: string;\n    /** Ask each row which declared search field matched. */\n    searchExplain?: boolean;\n}\n\n/**\n * Configuration for subscribing to a single entity\n */\nexport interface SingleSubscriptionConfig {\n    clientId: string;\n    path: string;\n    id: string | number;\n}\n\n/**\n * Opt-in retention for one set of broadcast channels.\n *\n * Retention is configured on the server and nowhere else. A channel is created\n * by whoever names it, so letting a client ask for its own history depth would\n * let any visitor commit the backend to unbounded storage; and presence-only or\n * notification-only channels — the overwhelming majority — must not pay for a\n * feature they never use. With no rules configured nothing is written, no table\n * is created, and broadcast behaves exactly as it did before history existed.\n */\nexport interface ChannelRetentionRule {\n    /**\n     * Channel name to match. Either exact (`\"doc:42\"`) or a trailing-`*` prefix\n     * (`\"doc:*\"`). Deliberately not a full glob or RegExp: this decides what\n     * gets written to disk, and a rule whose blast radius is not obvious at a\n     * glance is the wrong shape for that.\n     */\n    match: string;\n    /** Keep at most this many of the most recent messages per channel. */\n    limit?: number;\n    /**\n     * Keep messages for at most this long. Accepts a millisecond count or a\n     * short duration string (`\"30s\"`, `\"15m\"`, `\"24h\"`, `\"7d\"`).\n     */\n    ttl?: number | string;\n}\n\n/**\n * Server-side realtime options.\n *\n * The channel bus contract and its config live in `./channel_bus` so that a\n * transport shipped as its own package depends on the contract alone.\n */\nexport interface RealtimeChannelsConfig {\n    /**\n     * Retention rules, most specific first — the first match wins. Omitted or\n     * empty means no channel retains anything.\n     */\n    channels?: ChannelRetentionRule[];\n    /**\n     * How channel broadcast and presence reach other backend instances.\n     * Defaults to `{ type: \"memory\" }` — i.e. they don't.\n     */\n    bus?: ChannelBusSetting;\n}\n\n/**\n * Abstract realtime provider interface.\n * Handles real-time subscriptions and notifications for entity changes.\n */\nexport interface RealtimeProvider {\n    /**\n     * Subscribe to collection changes\n     */\n    subscribeToCollection(\n        subscriptionId: string,\n        config: CollectionSubscriptionConfig,\n        callback?: (rows: Record<string, unknown>[]) => void\n    ): void;\n\n    /**\n     * Subscribe to single entity changes\n     */\n    subscribeToOne(\n        subscriptionId: string,\n        config: SingleSubscriptionConfig,\n        callback?: (row: Record<string, unknown> | null) => void\n    ): void;\n\n    /**\n     * Unsubscribe from a subscription\n     */\n    unsubscribe(subscriptionId: string): void;\n\n    /**\n     * Notify all relevant subscribers of a entity update\n     */\n    notifyUpdate(\n        path: string,\n        id: string,\n        row: Record<string, unknown> | null,\n        databaseId?: string\n    ): Promise<void>;\n\n    /**\n     * Called when the HTTP server is ready and listening.\n     * Useful for providers that need the server address for callbacks.\n     */\n    onServerReady?(serverInfo: { port: number; hostname?: string }): void;\n\n    /**\n     * Gracefully shut down the realtime provider.\n     * Called during server shutdown to clean up resources.\n     */\n    destroy?(): Promise<void>;\n\n    /**\n     * Stop the internal LISTEN client (e.g., PostgreSQL LISTEN/NOTIFY).\n     * Called during graceful shutdown before closing database connections.\n     */\n    stopListening?(): Promise<void>;\n}\n\n// =============================================================================\n// COLLECTION REGISTRY INTERFACES\n// =============================================================================\n\n/**\n * Abstract collection registry interface.\n * Manages registration and lookup of entity collections.\n */\nexport interface CollectionRegistryInterface {\n    /**\n     * Register a collection\n     */\n    register(collection: CollectionConfig): void;\n\n    /**\n     * Get a collection by its path\n     */\n    getCollectionByPath(path: string): CollectionConfig | undefined;\n\n    /**\n     * Get all registered collections\n     */\n    getCollections(): CollectionConfig[];\n\n    /**\n     * Get the currently registered global callbacks, if any.\n     */\n    getGlobalCallbacks(): any | undefined;\n}\n\n// =============================================================================\n// DATA TRANSFORMER INTERFACES\n// =============================================================================\n\n/**\n * Abstract data transformer interface.\n * Handles serialization/deserialization between frontend and database formats.\n */\nexport interface DataTransformer {\n    /**\n     * Transform entity data for storage in the database\n     */\n    serializeToDatabase<M extends Record<string, unknown>>(\n        entity: M,\n        collection: CollectionConfig\n    ): Record<string, unknown>;\n\n    /**\n     * Transform database data back to entity format\n     */\n    deserializeFromDatabase<M extends Record<string, unknown>>(\n        data: Record<string, unknown>,\n        collection: CollectionConfig\n    ): Promise<M>;\n}\n\n// =============================================================================\n// DATABASE ADMIN — CAPABILITY-SPECIFIC INTERFACES (1.3)\n// =============================================================================\n\n/**\n * Administrative operations for SQL-based databases (PostgreSQL, MySQL, etc.).\n * Used by the SQL Editor, RLS Editor, and schema browser.\n *\n * @group Admin\n */\nexport interface SQLAdmin {\n    /**\n     * Execute raw SQL against the database.\n     */\n    executeSql(sql: string, options?: { database?: string; role?: string; params?: unknown[] }): Promise<Record<string, unknown>[]>;\n\n    /**\n     * Fetch the available databases on the server.\n     */\n    fetchAvailableDatabases?(): Promise<string[]>;\n\n    /**\n     * Fetch the available *native PostgreSQL* database roles (from `pg_roles`).\n     *\n     * These are connection-level roles — what the SQL editor can `SET ROLE` to,\n     * and what `SecurityRule.pgRoles` targets. They are NOT application roles;\n     * for those use {@link fetchApplicationRoles}.\n     */\n    fetchAvailableRoles?(): Promise<string[]>;\n\n    /**\n     * Fetch the *application-level* roles in use in this project.\n     *\n     * These are the strings stored on the users table's `roles` column and\n     * exposed to policies as `rebase.roles()` — what `SecurityRule.roles`\n     * matches against. Distinct from {@link fetchAvailableRoles}; the two are\n     * not interchangeable.\n     */\n    fetchApplicationRoles?(): Promise<string[]>;\n\n    /**\n     * Fetch the current database name.\n     */\n    fetchCurrentDatabase?(): Promise<string | undefined>;\n}\n\n/**\n * Administrative operations for document-based databases (MongoDB, Firestore, etc.).\n * Used by future document administration tools.\n *\n * @group Admin\n */\nexport interface DocumentAdmin {\n    /**\n     * Execute an aggregation pipeline or equivalent query.\n     */\n    executeAggregate?(pipeline: Record<string, unknown>[]): Promise<Record<string, unknown>[]>;\n\n    /**\n     * Fetch statistics for a collection (document count, size, etc.).\n     */\n    fetchCollectionStats?(collectionName: string): Promise<{ count: number; sizeBytes?: number }>;\n}\n\n/**\n * Administrative operations for schema management.\n * Shared across SQL and document databases.\n *\n * @group Admin\n */\nexport interface SchemaAdmin {\n    /**\n     * Fetch database tables/collections not yet mapped to a Rebase collection.\n     */\n    fetchUnmappedTables?(mappedPaths?: string[]): Promise<string[]>;\n\n    /**\n     * Fetch column/field metadata for a single table/collection.\n     * The return type is generic — SQL backends return TableMetadata,\n     * document backends may return a different shape.\n     */\n    fetchTableMetadata?(tableName: string): Promise<unknown>;\n}\n\n/**\n * Metadata for a database branch.\n * @group Admin\n */\nexport interface BranchInfo {\n    /** Branch name (without prefix). */\n    name: string;\n    /** The database this branch was created from. */\n    parentDatabase: string;\n    /** When the branch was created. */\n    createdAt: Date;\n    /** Size in bytes, if available from the server. */\n    sizeBytes?: number;\n}\n\n/**\n * Administrative operations for database branching.\n * Allows creating isolated database copies for development/preview workflows.\n *\n * @group Admin\n */\nexport interface BranchAdmin {\n    /** Create a new branch (database copy) from the current or specified source database. */\n    createBranch(name: string, options?: { source?: string }): Promise<BranchInfo>;\n\n    /** Delete a branch database. Cannot delete the main/default database. */\n    deleteBranch(name: string): Promise<void>;\n\n    /** List all branches (databases that were created via branching). */\n    listBranches(): Promise<BranchInfo[]>;\n\n    /** Get info about a specific branch. */\n    getBranchInfo(name: string): Promise<BranchInfo | undefined>;\n}\n\n/**\n * Union type for all admin capabilities.\n * A backend may implement any combination of these interfaces.\n *\n * Use type guards (`isSQLAdmin`, `isDocumentAdmin`, `isSchemaAdmin`, `isBranchAdmin`)\n * to safely narrow the type before calling methods.\n *\n * @group Admin\n */\nexport type DatabaseAdmin = Partial<SQLAdmin> & Partial<DocumentAdmin> & Partial<SchemaAdmin> & Partial<BranchAdmin>;\n\n/**\n * Type guard: does this admin support SQL operations?\n * @group Admin\n */\nexport function isSQLAdmin(admin: DatabaseAdmin | undefined): admin is SQLAdmin {\n    return !!admin && typeof (admin as SQLAdmin).executeSql === \"function\";\n}\n\n/**\n * Type guard: does this admin support document operations?\n * @group Admin\n */\nexport function isDocumentAdmin(admin: DatabaseAdmin | undefined): admin is DocumentAdmin {\n    return !!admin && (\n        typeof (admin as DocumentAdmin).executeAggregate === \"function\" ||\n        typeof (admin as DocumentAdmin).fetchCollectionStats === \"function\"\n    );\n}\n\n/**\n * Type guard: does this admin support schema management?\n * @group Admin\n */\nexport function isSchemaAdmin(admin: DatabaseAdmin | undefined): admin is SchemaAdmin {\n    return !!admin && (\n        typeof (admin as SchemaAdmin).fetchUnmappedTables === \"function\" ||\n        typeof (admin as SchemaAdmin).fetchTableMetadata === \"function\"\n    );\n}\n\n/**\n * Type guard: does this admin support database branching?\n * @group Admin\n */\nexport function isBranchAdmin(admin: DatabaseAdmin | undefined): admin is BranchAdmin {\n    return !!admin && typeof (admin as BranchAdmin).createBranch === \"function\";\n}\n\n// =============================================================================\n// LIFECYCLE INTERFACES (1.4)\n// =============================================================================\n\n/**\n * Health check result returned by `healthCheck()`.\n * @group Lifecycle\n */\nexport interface HealthCheckResult {\n    /** Whether the backend is healthy and able to serve requests. */\n    healthy: boolean;\n    /** Round-trip latency to the database in milliseconds. */\n    latencyMs: number;\n    /** Optional details (e.g., pool stats, replication lag). */\n    details?: Record<string, unknown>;\n}\n\n/**\n * Lifecycle contract for backend components that hold resources\n * (database connections, WebSocket pools, timers, etc.).\n *\n * All methods are optional — simple backends (e.g., in-memory) can skip them.\n * @group Lifecycle\n */\nexport interface BackendLifecycle {\n    /**\n     * Initialize the backend: open connections, run migrations, seed data.\n     * Called once during startup. Idempotent.\n     */\n    initialize?(): Promise<void>;\n\n    /**\n     * Check whether the backend is healthy and reachable.\n     * Should be fast (< 1 s) and safe to call frequently.\n     */\n    healthCheck?(): Promise<HealthCheckResult>;\n\n    /**\n     * Gracefully shut down: close connections, flush buffers, cancel timers.\n     * After calling `destroy()`, no other methods should be called.\n     */\n    destroy?(): Promise<void>;\n}\n\n// =============================================================================\n// BACKEND FACTORY INTERFACES\n// =============================================================================\n\n/**\n * Configuration for creating a database backend\n */\nexport interface BackendConfig {\n    /**\n     * Type of database backend\n     */\n    type: string;\n\n    /**\n     * Database connection (implementation-specific)\n     */\n    connection: unknown;\n\n    /**\n     * Schema definition (implementation-specific, e.g., Drizzle schema for PostgreSQL)\n     */\n    schema?: unknown;\n}\n\n/**\n * A complete backend instance with all required services.\n *\n * Now includes optional lifecycle management and admin capabilities.\n */\nexport interface BackendInstance extends BackendLifecycle {\n    /**\n     * Entity repository for CRUD operations\n     */\n    entityRepository: DataRepository;\n\n    /**\n     * Realtime provider for subscriptions\n     */\n    realtimeProvider: RealtimeProvider;\n\n    /**\n     * Collection registry\n     */\n    collectionRegistry: CollectionRegistryInterface;\n\n    /**\n     * The underlying database connection\n     */\n    connection: DatabaseConnection;\n\n    /**\n     * Administrative operations (SQL, schema, documents).\n     * What's available depends on the backend type — use type guards\n     * (`isSQLAdmin`, `isSchemaAdmin`, etc.) to narrow.\n     */\n    admin?: DatabaseAdmin;\n}\n\n/**\n * Factory function type for creating backend instances\n */\nexport type BackendFactory<TConfig extends BackendConfig = BackendConfig> =\n    (config: TConfig) => BackendInstance;\n\n// =============================================================================\n// BACKEND BOOTSTRAPPER (1.2)\n// =============================================================================\n\n/**\n * A `BackendBootstrapper` encapsulates all driver-specific initialization logic.\n *\n * Instead of hard-coding Postgres setup into `initializeRebaseBackend()`,\n * each database backend provides its own bootstrapper that knows how to:\n * - Create the DataDriver from a config object\n * - Optionally initialize auth tables\n * - Optionally create a realtime service\n * - Mount driver-specific API routes\n *\n * The main `initializeRebaseBackend()` becomes a **coordinator** that iterates\n * registered bootstrappers, calls their hooks, and wires the results together.\n *\n * @group Backend\n *\n * @example\n * ```typescript\n * // Third-party MySQL bootstrapper\n * const mysqlBootstrapper: BackendBootstrapper = {\n *   type: \"mysql\",\n *   initializeDriver: async (config) => new MySQLDataDriver(config.connection),\n *   initializeRealtime: async (config) => new MySQLChangeStreamRealtime(config.connection),\n * };\n *\n * initializeRebaseBackend({\n *   ...config,\n *   bootstrappers: [postgresBootstrapper, mysqlBootstrapper]\n * });\n * ```\n */\nexport interface BackendBootstrapper {\n    /**\n     * Which driver type this bootstrapper handles.\n     * Must match the `type` field on the driver config object\n     * (e.g., `\"postgres\"`, `\"mongodb\"`, `\"mysql\"`).\n     */\n    type: string;\n\n    /**\n     * Unique identifier for this bootstrapper instance.\n     * Used to register the driver in the driver registry.\n     * Defaults to `type` if not set.\n     */\n    id?: string;\n\n    /**\n     * Whether this bootstrapper provides the default driver.\n     * When true, the coordinator uses this driver as the primary one.\n     */\n    isDefault?: boolean;\n\n    /**\n     * Run database migrations for this driver.\n     * Called by the coordinator after all drivers are initialized.\n     */\n    runMigrations?(config: unknown, driverResult: InitializedDriver): Promise<void>;\n\n    /**\n     * Create a DataDriver from the given config.\n     * This is the only **required** method.\n     */\n    initializeDriver(config: unknown): Promise<InitializedDriver>;\n\n    /**\n     * Initialize auth tables / services if this driver supports them.\n     * Return undefined if auth is not supported by this backend.\n     */\n    initializeAuth?(config: unknown, driverResult: InitializedDriver): Promise<BootstrappedAuth | undefined>;\n\n    /**\n     * Initialize history tables / services if this driver supports them.\n     * Return undefined if history is not supported by this backend.\n     */\n    initializeHistory?(config: HistoryConfig, driverResult: InitializedDriver): Promise<{ historyService: unknown } | undefined>;\n\n    /**\n     * Create a realtime provider for this driver.\n     * Return undefined if the driver does not support realtime.\n     */\n    initializeRealtime?(config: unknown, driverResult: InitializedDriver): Promise<RealtimeProvider | undefined>;\n\n    /**\n     * Mount any driver-specific HTTP routes (e.g., custom admin endpoints).\n     * Called after all drivers are initialized.\n     */\n    mountRoutes?(app: unknown, basePath: string, driverResult: InitializedDriver): void;\n\n    /**\n     * Return admin capabilities for this driver.\n     */\n    getAdmin?(driverResult: InitializedDriver): DatabaseAdmin | undefined;\n\n    /**\n     * Bring the database's collection tables up to date, additively.\n     *\n     * Optional because it is only meaningful for schema-ful drivers. A managed\n     * runtime boots a compiled project against a database it has never seen; auth\n     * tables are ensured on boot but collection tables were created by nothing,\n     * so every data request answered 500 on a missing relation. The CLI's `db\n     * push` cannot fill the gap — it needs Atlas, and the runtime image ships no\n     * CLI.\n     *\n     * Implementations MUST be additive-only: create missing tables, columns and\n     * enum types, and never drop, narrow or rewrite anything. This runs\n     * unattended against live customer data with nobody reading a diff, so the\n     * destructive half stays a deliberate migration.\n     *\n     * `driverResult` is optional: this runs before `initializeDriver`, and only\n     * the bundle path has a pre-init stand-in to pass. An adapter built by an\n     * application already holds its own connection and MUST use it when this is\n     * `undefined` — dereferencing it unconditionally works for managed tenants\n     * and breaks every app that builds its own adapter.\n     */\n    ensureCollectionSchema?(\n        collections: unknown[],\n        driverResult?: InitializedDriver,\n        log?: (message: string) => void\n    ): Promise<{ applied: number }>;\n\n    /**\n     * Apply the collections' row-level-security policies, additively and\n     * idempotently — the companion to {@link ensureCollectionSchema}.\n     *\n     * That method creates the tables; a table with RLS disabled and no policies\n     * is not servable, because authenticated requests run as a restricted role:\n     * a read with no `SELECT` policy returns nothing (a public collection\n     * answers 401) and a write with no `INSERT`/`UPDATE` policy is denied. The\n     * `db push` CLI applies these from the same collections, but it cannot reach\n     * a managed tenant's in-cluster database — the runtime, already connected,\n     * is the only thing that can.\n     *\n     * MUST be idempotent (re-run on every boot) and MUST NOT be destructive.\n     * Runs after auth initialization, because the generated policies call the\n     * `auth.*` helper functions and `CREATE POLICY` validates they exist.\n     */\n    ensureCollectionPolicies?(\n        collections: unknown[],\n        driverResult?: InitializedDriver,\n        log?: (message: string) => void\n    ): Promise<{ applied: number }>;\n\n    /**\n     * Read the collections schema version this database was last provisioned\n     * from, or `null` when nothing has ever stamped it.\n     *\n     * The companion to {@link stampCollectionsSchemaVersion}: one process writes\n     * what it applied, every other process compares itself to it. This is what\n     * lets a split deployment — several processes over one database, only one of\n     * which provisions — notice that a unit is serving against a schema it was\n     * not built for. That failure is otherwise silent in both directions: a\n     * column that does not exist is a SQL error on one route, and a policy that\n     * was never applied is a 200 with no rows.\n     *\n     * `null` is not an error and MUST NOT be treated as one — every database\n     * provisioned before the stamp existed reads this way, and so does every\n     * fresh one until its first provisioning boot finishes.\n     */\n    readCollectionsSchemaVersion?(\n        driverResult?: InitializedDriver\n    ): Promise<string | null>;\n\n    /**\n     * Record the collections schema version this process just applied.\n     *\n     * Called only by the process that provisions, and only after both\n     * {@link ensureCollectionSchema} and {@link ensureCollectionPolicies} have\n     * run — a stamp written before the policies would claim a schema that is\n     * only half in place, and the half that is missing is the one that fails\n     * without an error.\n     */\n    stampCollectionsSchemaVersion?(\n        version: string,\n        driverResult?: InitializedDriver\n    ): Promise<void>;\n\n    /**\n     * Initialize WebSocket server for realtime operations.\n     */\n    initializeWebsockets?(server: unknown, realtimeService: RealtimeProvider, driver: import(\"../controllers/data_driver\").DataDriver, config?: unknown, authAdapter?: AuthAdapter): Promise<void> | void;\n}\n\n/**\n * Result of `BackendBootstrapper.initializeDriver()`.\n * @group Backend\n */\nexport interface InitializedDriver {\n    /** The DataDriver instance, ready for use. */\n    driver: import(\"../controllers/data_driver\").DataDriver;\n\n    /** The realtime service, if the driver created one during init. */\n    realtimeProvider?: RealtimeProvider;\n\n    /** A collection registry to register schema / tables into. */\n    collectionRegistry?: CollectionRegistryInterface;\n\n    /**\n     * Collections the driver derived from the live database schema.\n     *\n     * Set by drivers that introspect in `baas` mode; the server serves these\n     * instead of collections loaded from config files.\n     */\n    collections?: import(\"./collections\").CollectionConfig[];\n\n    /** The underlying database connection (for lifecycle management). */\n    connection?: DatabaseConnection;\n\n    /**\n     * Opaque handle that the bootstrapper can use in subsequent hooks\n     * (e.g., `initializeAuth`, `mountRoutes`) to access driver internals.\n     * Not used by the coordinator.\n     */\n    internals?: unknown;\n}\n\n/**\n * Result of `BackendBootstrapper.initializeAuth()`.\n * @group Backend\n */\nexport interface BootstrappedAuth {\n    /** User management service. */\n    userService: unknown;\n    /** Role management service (optional, roles are now simple strings). */\n    roleService?: unknown;\n    /** Email service (optional). */\n    emailService?: unknown;\n    /** Combined Auth Repository for unified token and user management. */\n    authRepository?: unknown;\n    /**\n     * Whether the auth schema in the database is one this runtime can serve.\n     *\n     * Folded into `healthCheck()` so a schema mismatch shows up as a degraded\n     * health response. Without it, a server whose auth is entirely broken still\n     * reports healthy — the database connection it probes is fine, and the\n     * mismatch is only discovered one failed login at a time.\n     */\n    schemaHealthCheck?(): Promise<AuthSchemaHealth>;\n}\n\n/**\n * Result of {@link BootstrappedAuth.schemaHealthCheck}.\n * @group Lifecycle\n */\nexport interface AuthSchemaHealth {\n    /** False when this runtime cannot be trusted to serve auth against this database. */\n    healthy: boolean;\n    /** Human-readable descriptions of each mismatch found. Empty when healthy. */\n    problems: string[];\n    /** Auth schema version recorded in the database, when it records one. */\n    databaseVersion?: number | null;\n    /** Auth schema version this runtime expects. */\n    runtimeVersion?: number;\n}\n","/**\n * The tables Rebase creates for its own bookkeeping, and the SQL that keeps the\n * end-user role away from them.\n *\n * ## Why this exists\n *\n * Authenticated requests run as {@link REBASE_USER_ROLE}, and the boot-time role\n * provisioning grants that role `SELECT, INSERT, UPDATE, DELETE` on every table\n * in the schemas a project uses — including `rebase`, because a project's own\n * collections are allowed to live there (the scaffold puts `users` there). It\n * also sets `ALTER DEFAULT PRIVILEGES`, so a table created *later* by the\n * migrating role inherits the same grant.\n *\n * Every framework-internal table is created later: auth's tables come up during\n * `initializeAuth`, `api_keys` during route mounting, `cron_logs` when the first\n * job registers, `idempotency_keys` on the first request that carries a key. So\n * they all inherited full DML for the end-user role — and none of them enables\n * row-level security, because none of them is a collection with\n * `securityRules`. Measured on a freshly provisioned database, `SET ROLE\n * rebase_user` could read `rebase.refresh_tokens` (session token hashes),\n * `rebase.mfa_factors` (`secret_encrypted`), `rebase.recovery_codes`, and\n * `rebase.api_keys` (including its `admin` flag), and insert into\n * `rebase.app_config`.\n *\n * Nothing routes a user-context query at those tables today, so this was not\n * reachable over the API. That is the wrong thing to depend on: the documented\n * model is that RLS is the authorization boundary, and these tables sat outside\n * it. The boundary is now a privilege boundary instead — the role simply cannot\n * address them.\n *\n * ## Why REVOKE rather than ENABLE ROW LEVEL SECURITY\n *\n * RLS with no policy denies every row, which is the same outcome, but it is the\n * *weaker* statement: it leaves the grant in place, so a later policy — or a\n * `FORCE` flag cleared by some future migration — reopens the table. There is no\n * row of `refresh_tokens` any end user should ever reach, so the honest encoding\n * is \"this role has no privilege here at all\". It also keeps the owner\n * connection (which auth actually runs on) completely unaffected.\n *\n * ## Keeping it true\n *\n * `packages/rls-check` scans the `rebase` schema — it used to skip it as a\n * \"platform\" schema — and its `rls-disabled` check fires on exactly the\n * condition this module removes: RLS off *and* a DML grant to a reachable role.\n * So a table added here without a revoke is caught by `pnpm rls:check`, not by\n * someone re-reading this file.\n */\n\n/**\n * The Postgres role authenticated requests run as.\n *\n * Defined here rather than in the Postgres driver because both the driver (which\n * provisions the role) and this module (which revokes on its behalf) need it,\n * and a second spelling of a role name is a silent no-op waiting to happen.\n */\nexport const REBASE_USER_ROLE = \"rebase_user\";\n\n/**\n * Framework-internal table names, unqualified.\n *\n * Deliberately NOT including `users`: the auth user table is also a collection,\n * with `securityRules`, RLS enabled and policies applied. Users read their own\n * row through it — revoking there would break sign-in.\n *\n * `atlas_schema_revisions` is Atlas's migration ledger, which lands in `rebase`\n * because `db migrate apply` passes `--revisions-schema rebase`.\n */\nexport const REBASE_INTERNAL_TABLES: readonly string[] = [\n    // auth\n    \"user_identities\",\n    \"refresh_tokens\",\n    \"password_reset_tokens\",\n    \"magic_link_tokens\",\n    \"mfa_factors\",\n    \"mfa_challenges\",\n    \"recovery_codes\",\n    \"app_config\",\n    \"schema_meta\",\n    // platform services\n    \"api_keys\",\n    \"cron_logs\",\n    \"cron_claims\",\n    \"rate_limit_hits\",\n    \"idempotency_keys\",\n    \"entity_history\",\n    \"branches\",\n    // realtime channels — authorization for these lives in the channel rules the\n    // server evaluates before it reads or writes, never in a row policy\n    \"channel_messages\",\n    \"channel_cursors\",\n    \"channel_presence\",\n    // migration bookkeeping\n    \"atlas_schema_revisions\"\n];\n\n/** Postgres identifiers this module is willing to interpolate. */\nconst SAFE_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_$]*$/;\n\n/**\n * A single statement that takes every privilege on `schema.table` away from the\n * end-user role.\n *\n * Wrapped in a `DO` block guarded on `pg_roles` for two reasons, both of which\n * happen in practice:\n *\n *  - the role does not exist when the connection is unprivileged (Rebase then\n *    relies on native RLS rather than a role switch), and a bare `REVOKE` on a\n *    missing role is an error, not a no-op;\n *  - the table may not exist yet — `cron_logs` never appears in a project with\n *    no cron jobs — and `to_regclass` returning NULL has to be tolerated too.\n *\n * One command, so it is safe on handles that speak the extended query protocol\n * and reject multi-statement strings.\n */\nexport function revokeInternalTableSql(schema: string, table: string): string {\n    if (!SAFE_IDENTIFIER.test(schema)) {\n        throw new Error(`Refusing to build SQL with an unsafe schema name: ${JSON.stringify(schema)}`);\n    }\n    if (!SAFE_IDENTIFIER.test(table)) {\n        throw new Error(`Refusing to build SQL with an unsafe table name: ${JSON.stringify(table)}`);\n    }\n    const qualified = `\"${schema}\".\"${table}\"`;\n    return `\n        DO $rebase_revoke$\n        BEGIN\n            IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = '${REBASE_USER_ROLE}')\n               AND to_regclass('${qualified}') IS NOT NULL THEN\n                EXECUTE 'REVOKE ALL ON ${qualified} FROM ${REBASE_USER_ROLE}';\n            END IF;\n        END\n        $rebase_revoke$;\n    `.trim();\n}\n\n/**\n * Revoke on every internal table in `schema`, one statement at a time.\n *\n * Best-effort per table: a connection that does not own one of them (a\n * pre-provisioned database, a platform-managed ledger) cannot revoke on it, and\n * that must not take down a boot. The caller decides how loud to be — `onError`\n * exists so the driver can warn without this module importing a logger.\n */\nexport async function revokeInternalTableAccess(\n    execute: (sql: string) => Promise<unknown>,\n    schema: string,\n    options?: { tables?: readonly string[]; onError?: (table: string, error: unknown) => void }\n): Promise<void> {\n    for (const table of options?.tables ?? REBASE_INTERNAL_TABLES) {\n        try {\n            await execute(revokeInternalTableSql(schema, table));\n        } catch (error) {\n            options?.onError?.(table, error);\n        }\n    }\n}\n","import { logger } from \"../utils/logger.js\";\n\n/**\n * Helpers for the \"create my internal table if it isn't there yet\" bootstrap\n * that several stores run at boot.\n *\n * These all look trivially safe — every statement is `IF NOT EXISTS` — and they\n * are not, for two reasons that only show up with more than one app instance:\n *\n *  1. `CREATE … IF NOT EXISTS` reads the catalog and then writes to it, and\n *     those two steps are not one atomic operation. Instances starting together\n *     — a rolling deploy, a replica count going from 1 to N, a crash loop\n *     restarting the fleet — can both see \"absent\" and both try to create. The\n *     loser gets a duplicate key on a *catalog* index instead of the silent\n *     no-op the syntax appears to promise. Measured against Postgres 18: with\n *     five instances booting at once, 8 of 10 `ensureTable` calls hit it.\n *\n *  2. A bootstrap written as one long `try` block therefore abandons everything\n *     after the losing statement — including, in every store that has one, the\n *     `REVOKE` that takes the table back off the end-user role. That revoke is\n *     a security control and must not be collateral damage from a race.\n *\n * So: retry the race, contain each statement separately, and decide what to do\n * next from what actually exists rather than from who won.\n */\n\n/** A driver's `executeSql`, narrowed to what a bootstrap needs. */\nexport type SqlExec = (sqlText: string, options?: { params?: unknown[] }) => Promise<Record<string, unknown>[]>;\n\n/**\n * SQLSTATEs a *simultaneous boot* can raise from statements that are otherwise\n * idempotent. Retrying is always the right answer for these: the second attempt\n * finds the object present and does nothing.\n */\nexport const CONCURRENT_DDL_SQLSTATES = new Set([\n    \"23505\", // unique_violation on pg_type / pg_class / pg_namespace\n    \"42P06\", // duplicate_schema\n    \"42P07\", // duplicate_table\n    \"42710\", // duplicate_object — an index or a constraint\n    \"40P01\" // deadlock_detected — two boots taking catalog locks in step\n]);\n\n/** Attempts per idempotent DDL statement, including the first. */\nexport const DDL_ATTEMPTS = 4;\nconst DDL_RETRY_BASE_MS = 40;\n\n/**\n * Walk an error's `cause` chain, stopping at the first link `visit` accepts.\n * Drizzle wraps the driver error, so nothing useful is ever on the top level.\n */\nexport function hasInCauseChain(err: unknown, visit: (e: Record<string, unknown>) => boolean): boolean {\n    let current: unknown = err;\n    for (let depth = 0; depth < 10 && current; depth++) {\n        if (typeof current !== \"object\") break;\n        const e = current as Record<string, unknown>;\n        if (visit(e)) return true;\n        current = e.cause;\n    }\n    return false;\n}\n\n/**\n * Is this the loser of a race to create something that already exists?\n *\n * Deliberately narrow. A permission failure, an unreachable database or a typo\n * in the DDL must surface on the first attempt rather than being retried four\n * times and then reported as a race that never was.\n */\nexport function isConcurrentDdlRace(err: unknown): boolean {\n    return hasInCauseChain(err, (e) =>\n        (typeof e.code === \"string\" && CONCURRENT_DDL_SQLSTATES.has(e.code)) ||\n        // SQLite and MySQL say it in words rather than in a shared SQLSTATE.\n        (typeof e.message === \"string\" && /already exists/i.test(e.message))\n    );\n}\n\n/**\n * SQLSTATEs that mean, unambiguously, *the object is already there*.\n *\n * A subset of {@link CONCURRENT_DDL_SQLSTATES} and a stricter question. The\n * broad set answers \"should this be retried\"; this one answers \"is it safe to\n * carry on as though the statement had succeeded\", which is a claim about the\n * end state rather than about the attempt. Deadlock is not in it — a deadlocked\n * statement did nothing and must be retried, not skipped.\n */\nconst DUPLICATE_OBJECT_SQLSTATES = new Set([\n    \"42P06\", // duplicate_schema\n    \"42P07\", // duplicate_table\n    \"42710\" // duplicate_object — a type, an index, a constraint\n]);\n\n/**\n * Did this statement fail *because a peer already created the same object*?\n *\n * The narrow companion to {@link isConcurrentDdlRace}, for the one caller that\n * needs to tell \"someone beat me to it\" from \"this genuinely failed\": a loop\n * applying a schema plan, where treating every `23505` as a harmless race would\n * silently swallow the one that matters — a unique constraint that cannot be\n * added because the customer's existing rows violate it.\n *\n * `23505` is therefore only accepted when it names a `pg_catalog` index. That is\n * what a lost `CREATE TYPE`/`CREATE TABLE` race raises (`pg_type_typname_nsp_index`\n * is the one seen in practice); a unique violation on user data names the user's\n * own constraint and is left to the caller.\n */\nexport function isDuplicateObjectRace(err: unknown): boolean {\n    return hasInCauseChain(err, (e) => {\n        if (typeof e.code !== \"string\") return false;\n        if (DUPLICATE_OBJECT_SQLSTATES.has(e.code)) return true;\n        if (e.code !== \"23505\") return false;\n        // node-postgres puts the violated index in `constraint`; some paths only\n        // carry it in the detail text, so check both rather than miss the race.\n        const constraint = typeof e.constraint === \"string\" ? e.constraint : \"\";\n        const detail = typeof e.detail === \"string\" ? e.detail : \"\";\n        return constraint.startsWith(\"pg_\") || /\\bpg_[a-z_]+_index\\b/.test(detail);\n    });\n}\n\nexport interface DdlBootstrapper {\n    /**\n     * Run one idempotent statement — `CREATE … IF NOT EXISTS`, `ALTER TABLE …\n     * ADD COLUMN IF NOT EXISTS` — retrying the catalog race a simultaneous boot\n     * produces. Never throws: a statement that cannot be made to work is logged\n     * and the caller carries on to the next one.\n     */\n    ensureObject(label: string, sqlText: string): Promise<void>;\n\n    /** Contain one step's failure so that the steps after it still run. */\n    step(label: string, run: () => Promise<unknown>): Promise<void>;\n\n    /**\n     * Is this table there and readable? Asked with a query any SQL dialect\n     * answers, rather than `to_regclass`, so a future non-Postgres SQL driver\n     * gets a real answer instead of a syntax error read as \"missing\".\n     */\n    isReadable(table: string): Promise<boolean>;\n}\n\n/**\n * @param exec   the driver's SQL escape hatch\n * @param scope  log prefix identifying the caller, e.g. `\"cron-store\"`\n */\nexport function createDdlBootstrapper(exec: SqlExec, scope: string): DdlBootstrapper {\n    /** Jittered, so peers that collided once do not collide again in lockstep. */\n    const backoff = (attempt: number) =>\n        new Promise(resolve => setTimeout(resolve, DDL_RETRY_BASE_MS * attempt * (1 + Math.random())));\n\n    const step: DdlBootstrapper[\"step\"] = async (label, run) => {\n        try {\n            await run();\n        } catch (err) {\n            logger.error(`[${scope}] ${label} failed`, { error: err });\n        }\n    };\n\n    return {\n        step,\n\n        ensureObject(label, sqlText) {\n            return step(label, async () => {\n                for (let attempt = 1; ; attempt++) {\n                    try {\n                        await exec(sqlText);\n                        return;\n                    } catch (err) {\n                        if (!isConcurrentDdlRace(err) || attempt >= DDL_ATTEMPTS) throw err;\n                        logger.debug(\n                            `[${scope}] Lost a create race for ${label} with another instance ` +\n                            `(attempt ${attempt}/${DDL_ATTEMPTS}) — retrying`\n                        );\n                        await backoff(attempt);\n                    }\n                }\n            });\n        },\n\n        async isReadable(table) {\n            try {\n                await exec(`SELECT 1 FROM ${table} WHERE false`);\n                return true;\n            } catch {\n                return false;\n            }\n        }\n    };\n}\n"],"mappings":";;;;;;;;;AA4jBA,SAAgB,WAAW,OAAqD;CAC5E,OAAO,CAAC,CAAC,SAAS,OAAQ,MAAmB,eAAe;AAChE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACvgBA,IAAa,mBAAmB;;AAyChC,IAAM,kBAAkB;;;;;;;;;;;;;;;;;AAkBxB,SAAgB,uBAAuB,QAAgB,OAAuB;CAC1E,IAAI,CAAC,gBAAgB,KAAK,MAAM,GAC5B,MAAM,IAAI,MAAM,qDAAqD,KAAK,UAAU,MAAM,GAAG;CAEjG,IAAI,CAAC,gBAAgB,KAAK,KAAK,GAC3B,MAAM,IAAI,MAAM,oDAAoD,KAAK,UAAU,KAAK,GAAG;CAE/F,MAAM,YAAY,IAAI,OAAO,KAAK,MAAM;CACxC,OAAO;;;iEAGsD,iBAAiB;kCAChD,UAAU;yCACH,UAAU,QAAQ,iBAAiB;;;;MAItE,KAAK;AACX;;;;;;;;AClGA,IAAa,2CAA2B,IAAI,IAAI;CAC5C;CACA;CACA;CACA;CACA;AACJ,CAAC;AAID,IAAM,oBAAoB;;;;;AAM1B,SAAgB,gBAAgB,KAAc,OAAyD;CACnG,IAAI,UAAmB;CACvB,KAAK,IAAI,QAAQ,GAAG,QAAQ,MAAM,SAAS,SAAS;EAChD,IAAI,OAAO,YAAY,UAAU;EACjC,MAAM,IAAI;EACV,IAAI,MAAM,CAAC,GAAG,OAAO;EACrB,UAAU,EAAE;CAChB;CACA,OAAO;AACX;;;;;;;;AASA,SAAgB,oBAAoB,KAAuB;CACvD,OAAO,gBAAgB,MAAM,MACxB,OAAO,EAAE,SAAS,YAAY,yBAAyB,IAAI,EAAE,IAAI,KAEjE,OAAO,EAAE,YAAY,YAAY,kBAAkB,KAAK,EAAE,OAAO,CACtE;AACJ;;;;;;;;;;AAWA,IAAM,6CAA6B,IAAI,IAAI;CACvC;CACA;CACA;AACJ,CAAC;;;;;;;;;;;;;;;AAgBD,SAAgB,sBAAsB,KAAuB;CACzD,OAAO,gBAAgB,MAAM,MAAM;EAC/B,IAAI,OAAO,EAAE,SAAS,UAAU,OAAO;EACvC,IAAI,2BAA2B,IAAI,EAAE,IAAI,GAAG,OAAO;EACnD,IAAI,EAAE,SAAS,SAAS,OAAO;EAG/B,MAAM,aAAa,OAAO,EAAE,eAAe,WAAW,EAAE,aAAa;EACrE,MAAM,SAAS,OAAO,EAAE,WAAW,WAAW,EAAE,SAAS;EACzD,OAAO,WAAW,WAAW,KAAK,KAAK,uBAAuB,KAAK,MAAM;CAC7E,CAAC;AACL;;;;;AA0BA,SAAgB,sBAAsB,MAAe,OAAgC;;CAEjF,MAAM,WAAW,YACb,IAAI,SAAQ,YAAW,WAAW,SAAS,oBAAoB,WAAW,IAAI,KAAK,OAAO,EAAE,CAAC;CAEjG,MAAM,OAAgC,OAAO,OAAO,QAAQ;EACxD,IAAI;GACA,MAAM,IAAI;EACd,SAAS,KAAK;GACV,OAAO,MAAM,IAAI,MAAM,IAAI,MAAM,UAAU,EAAE,OAAO,IAAI,CAAC;EAC7D;CACJ;CAEA,OAAO;EACH;EAEA,aAAa,OAAO,SAAS;GACzB,OAAO,KAAK,OAAO,YAAY;IAC3B,KAAK,IAAI,UAAU,IAAK,WACpB,IAAI;KACA,MAAM,KAAK,OAAO;KAClB;IACJ,SAAS,KAAK;KACV,IAAI,CAAC,oBAAoB,GAAG,KAAK,WAAA,GAAyB,MAAM;KAChE,OAAO,MACH,IAAI,MAAM,2BAA2B,MAAM,kCAC/B,QAAQ,eACxB;KACA,MAAM,QAAQ,OAAO;IACzB;GAER,CAAC;EACL;EAEA,MAAM,WAAW,OAAO;GACpB,IAAI;IACA,MAAM,KAAK,iBAAiB,MAAM,aAAa;IAC/C,OAAO;GACX,QAAQ;IACJ,OAAO;GACX;EACJ;CACJ;AACJ"}