@rebasepro/server 0.16.0 → 0.16.1-canary.g2d1aec8

package/dist/functions/index.js

@@ -0,0 +1,919 @@
+import { Hono } from "hono";
+import { env as env$1, getRuntimeKey } from "hono/adapter";
+//#region src/utils/host.ts
+/**
+* The host globals this package reads, behind functions that do not assume Node.
+*
+* `process` is not defined on workerd, on Deno Deploy without the compat flag,
+* or in a browser. That matters here for one specific reason: the portable
+* authoring surface (`@rebasepro/server/functions`) reaches the logger and the
+* error handler, and a bare `process.env.NODE_ENV` inside either of them turns
+* the first log line of a request into a `ReferenceError` on a runtime that has
+* no `process` — a failure that reads as "the framework crashed" rather than
+* "this runtime has no process object".
+*
+* Nothing here throws and nothing here is async. A runtime that cannot answer
+* gets the empty answer, because every caller in this file's blast radius is
+* choosing a log level or a format, and the safe default for both is the
+* development one.
+*
+* @module
+*/
+/**
+* Where an adapter with no `process` can publish the environment.
+*
+* Cloudflare Workers hand the environment to the *request*, not to the module,
+* so there is no global to read at import time. An edge adapter that has
+* already seen a request can stash the bag here and every contextless reader in
+* the framework — the logger, chiefly — starts answering correctly.
+*
+* `Symbol.for` rather than a module-local for the same reason the singleton
+* uses it: more than one copy of this module can be loaded into one process,
+* and a module-local would leave every copy but the writer's blind. See
+* `../singleton.ts`.
+*
+* Request-scoped code should NOT read this. Use `getEnv(c)` from
+* `@rebasepro/server/functions`, which reads the binding attached to the
+* request it is serving — the only correct source on a runtime where two
+* concurrent requests can carry different bindings.
+*/
+var ENV_SLOT = Symbol.for("@rebasepro/server:host-env");
+/**
+* The process environment, or the closest thing this runtime has to one.
+*
+* Order: a bag published by {@link setHostEnv} first, because an adapter that
+* set one knows more than the ambient globals do; then `process.env`; then
+* nothing.
+*/
+function hostEnv() {
+	const global = globalThis;
+	return global[ENV_SLOT] ?? global.process?.env ?? {};
+}
+/**
+* Write one already-formatted line to the process's output.
+*
+* `process.stdout.write` is preferred where it exists because it is the only
+* one of the two that does not append its own formatting to a line that is
+* already a complete JSON document — `console.log` on Node is
+* `process.stdout.write` plus `util.format`, and `util.format` will happily
+* reinterpret a `%s` that appeared inside a user's log message.
+*
+* Where it does not exist, `console` is the runtime's log sink and is what its
+* platform collects.
+*/
+function writeLine(stream, line) {
+	const proc = globalThis.process;
+	const sink = stream === "err" ? proc?.stderr : proc?.stdout;
+	if (typeof sink?.write === "function") {
+		sink.write(line + "\n");
+		return;
+	}
+	if (stream === "err") console.error(line);
+	else console.log(line);
+}
+//#endregion
+//#region src/singleton.ts
+/**
+* The backing instance lives on a process-global slot, NOT in a module-local
+* variable — because more than one copy of this module can be loaded into one
+* process, and a module-local would leave every copy but the booting one dead.
+*
+* That is the normal layout under the managed runtime, not an edge case: the
+* image ships the framework at `/app/node_modules`, while a project's bundle
+* installs its own dependencies into `/bundle/node_modules` — and every custom
+* function imports `defineFunction` from `@rebasepro/server`, which resolves to
+* the bundle's transitively-installed copy. `initializeRebaseBackend()` then ran
+* against `/app`'s copy while every function held `/bundle`'s, so `rebase.data`,
+* `rebase.storage` and `rebase.dataAsAdmin` threw "server not initialized yet"
+* on EVERY request, forever, in an otherwise healthy process.
+*
+* `Symbol.for` is the fix because its registry is per-process rather than
+* per-module: whichever copy boots publishes here, and every other copy — same
+* version or not — reads the same live client.
+*/
+var INSTANCE_SLOT = Symbol.for("@rebasepro/server:singleton-instance");
+/**
+* A *function* that answers "which client is this call for", for hosts where
+* one answer per process is the wrong shape.
+*
+* A Node server boots once and serves every request from the same client, so
+* {@link INSTANCE_SLOT} is the whole story. An isolate-based host is different
+* in a way that matters: the environment arrives attached to the **request**,
+* not to the module, so there is nothing to publish at import time, and an
+* isolate can be reused across requests that must not share state. Such a host
+* registers a resolver — typically reading an `AsyncLocalStorage` populated per
+* request — and it is consulted first.
+*
+* This exists now, before there is a host that needs it, because of what it
+* protects: `rebase` is a lazy Proxy, so every property access already goes
+* through `getInstance()`. Backing that lookup with a resolver is therefore the
+* entire porting story for the singleton — **no function anyone has already
+* written changes**. Take the resolver away and the only alternative is asking
+* users to thread a client through their handlers, which is a rewrite of every
+* function file in existence.
+*/
+var RESOLVER_SLOT = Symbol.for("@rebasepro/server:singleton-resolver");
+function getInstance() {
+	const global = globalThis;
+	const resolver = global[RESOLVER_SLOT];
+	if (resolver) {
+		const resolved = resolver();
+		if (resolved) return resolved;
+	}
+	return global[INSTANCE_SLOT] ?? null;
+}
+/**
+* The server-side Rebase singleton.
+*
+* Initialized automatically during server startup. Provides access to all
+* app-scoped services: **data**, **auth**, **storage**, and **email**.
+*
+* **Admin data plane** (`rebase.dataAsAdmin`):
+* Backed by the native DataDriver — calls go directly to the database without
+* JSON serialization, HTTP dispatch, or middleware overhead. The driver is
+* scoped once as `{ uid: "service", roles: ["admin"] }` (`SERVICE_IDENTITY`),
+* which makes it **admin-scoped, not RLS-bypassing**: every read and write runs
+* in a transaction that has done `SET LOCAL ROLE rebase_user` with
+* `app.uid = 'service'`, and policies are evaluated against that. No
+* `REBASE_SERVICE_KEY` is required.
+*
+* It clears the default policies through their `rolesOverlap(['admin'])` arm —
+* which is why the difference rarely shows. It shows when you write your own:
+*
+* - `policy.serverContext()` compiles to `rebase.uid() IS NULL` and is therefore
+*   **false** for this accessor. A collection with `disableDefaultPolicies:
+*   true` whose rule is `serverContext()` denies these writes (`42501`) and
+*   returns zero rows — HTTP 200, empty — for these reads.
+* - Its reach equals an `admin`-roled application user's reach. It is not a
+*   private door.
+*
+* `rebase.sql()` *is* an unconditional bypass — it runs on the owner connection
+* and never goes through `withAuth`. Of the two accessors on this object, the
+* quieter one is the more privileged.
+*
+* ⚠️ `rebase.dataAsAdmin` is for trusted background work (cron jobs,
+* migrations, service tasks) — **not** for serving user-facing data. Inside a
+* request handler, run user-scoped queries through the request-scoped driver
+* (`c.var.driver`), which carries the caller's identity.
+*
+* `rebase.data` is **gone from the type**: `RebaseServerClient` omits it, so the
+* admin-scoped accessor has exactly one name and the privilege is visible at the
+* call site. The property still exists at runtime, aliasing `dataAsAdmin`, so an
+* untyped JavaScript caller keeps working rather than failing on `undefined`.
+*
+* **Control plane** (`rebase.auth`, `rebase.admin`, `rebase.storage`, etc.):
+* Routes through the Hono app's internal request handler. An internal per-boot
+* credential is generated automatically when `REBASE_SERVICE_KEY` is not set,
+* so control-plane calls always authenticate.
+*
+* @example
+* ```typescript
+* import { rebase } from "@rebasepro/server";
+*
+* // In a cron job, hook, or trusted service file (admin scope, RLS evaluated
+* // as `{ uid: "service", roles: ["admin"] }`):
+* await rebase.email.send({ to: "admin@co.com", subject: "Alert", html: "<p>Hi</p>" });
+* const jobs = await rebase.dataAsAdmin.jobs.find({ limit: 10 });
+* ```
+*/
+var rebase = new Proxy({}, {
+	get(_, prop) {
+		const instance = getInstance();
+		if (!instance) throw new Error(`rebase.${String(prop)}: server not initialized yet. The singleton is available after Rebase starts — don't call it at import time.`);
+		return instance[prop];
+	},
+	set(_, prop) {
+		throw new Error(`Cannot set rebase.${String(prop)} directly. The singleton is read-only. Use _initRebase() during server startup.`);
+	}
+});
+//#endregion
+//#region src/functions/define-function.ts
+/**
+* Typed authoring contract for a custom backend function.
+*
+* A custom function is a file in the `functionsDir` that default-exports a
+* Hono app; the loader mounts it at `/<filename>`. `defineFunction` is the
+* typed opt-in for that contract: it hands you a pre-typed `Hono<HonoEnv>`
+* app (so `c.var.user` / `c.var.driver` are typed) plus a
+* {@link RebaseFunctionContext}, and returns exactly the Hono app the loader
+* already accepts — so it is fully interchangeable with a plain
+* `export default new Hono()`.
+*
+* @example
+* ```ts
+* import { defineFunction, requireAuth } from "@rebasepro/server";
+*
+* export default defineFunction((app, { rebase }) => {
+*     app.use("/*", requireAuth);
+*     app.get("/home", async (c) => {
+*         // `rebase.sql` runs on the owner connection: no RLS, no policies,
+*         // every row. It is the most privileged thing in this context —
+*         // more so than `dataAsAdmin`, which is merely admin-scoped.
+*         const [stats] = await rebase.sql(`SELECT count(*) AS n FROM orders`);
+*         return c.json({ orders: Number(stats.n) });
+*     });
+* });
+* ```
+*
+* @param definition Receives the function's Hono app and the typed context.
+*   Register routes on the provided `app` and return nothing, or return your
+*   own `Hono<HonoEnv>` app to use instead.
+* @returns The Hono app to default-export from the function file.
+*/
+function defineFunction(definition) {
+	const app = new Hono();
+	const returned = definition(app, { rebase });
+	return returned instanceof Hono ? returned : app;
+}
+//#endregion
+//#region src/auth/admin-roles.ts
+/**
+* Which role names carry administrative privilege.
+*
+* One definition, because there used to be several and they disagreed.
+* `requireAdmin` accepted `admin` **or** `schema-admin`; the guard that refuses
+* a dangerous `defaultRole` compared against `admin` alone. So
+* `AUTH_DEFAULT_ROLE=schema-admin` passed the guard and made every public
+* registrant an administrator — and, since a `schema-admin` may edit users, one
+* of them could then grant themselves real `admin` and keep it.
+*
+* The guard and the check have to read the same list or the gap comes back, so
+* neither of them owns it.
+*
+* `schema-admin` is here deliberately: it can reach the schema editor and the
+* SQL surfaces, which is administrative by any definition that matters. If a
+* genuinely lesser role is added later, it does not belong in this list — it
+* belongs in a capability check of its own.
+*/
+var ADMINISTRATIVE_ROLES = ["admin", "schema-admin"];
+/** Does this single role name carry administrative privilege? */
+function isAdministrativeRole(role) {
+	return ADMINISTRATIVE_ROLES.includes(role);
+}
+/** Does any role in this list carry administrative privilege? */
+function hasAdministrativeRole(roles) {
+	return !!roles?.some(isAdministrativeRole);
+}
+//#endregion
+//#region src/functions/context.ts
+function read(c, key) {
+	return c.get(key);
+}
+/**
+* The authenticated caller, or `undefined` for an anonymous request.
+*
+* **`undefined` is not a permission decision.** The functions router mounts its
+* auth middleware with `requireAuth: false` on purpose — a webhook receiver has
+* no token to send — so an anonymous caller reaches the handler and reads
+* `undefined` here while the handler runs on regardless. Use {@link requireAuth}
+* (or a `!user` branch that returns 401) to make it a decision.
+*
+* A caller who presented a *bad* token never gets this far: both auth
+* middlewares reject an unverifiable token with 401 before the router is
+* reached, precisely so an expired session cannot be silently downgraded to an
+* anonymous one.
+*/
+function getUser(c) {
+	const raw = read(c, "user");
+	if (!raw || typeof raw !== "object") return void 0;
+	const record = raw;
+	const uid = typeof record.uid === "string" ? record.uid : typeof record.userId === "string" ? record.userId : void 0;
+	if (uid === void 0) return void 0;
+	const roles = Array.isArray(record.roles) ? record.roles.filter((role) => typeof role === "string") : [];
+	return {
+		...record,
+		uid,
+		roles
+	};
+}
+/** The caller's id, or `undefined` when nobody is signed in. */
+function getUserId(c) {
+	return getUser(c)?.uid;
+}
+/** The caller's roles. Empty for an anonymous request — never `undefined`. */
+function getRoles(c) {
+	return getUser(c)?.roles ?? [];
+}
+/**
+* Whether the caller holds **any** of the named roles.
+*
+* Any rather than all, because that is what a route guard means by a list of
+* roles; require several by calling this more than once.
+*/
+function hasRole(c, ...roles) {
+	if (roles.length === 0) return false;
+	const held = new Set(getRoles(c));
+	return roles.some((role) => held.has(role));
+}
+/**
+* Whether the caller holds an administrative role.
+*
+* Delegates to the single definition in `auth/admin-roles.ts` — which is
+* `admin` **or** `schema-admin` — rather than comparing against `"admin"`.
+* Those two lists disagreed once, and the gap made every public registrant an
+* administrator; see that file.
+*/
+function isAdmin(c) {
+	return hasAdministrativeRole(getRoles(c));
+}
+/** Whether the request carries an identity at all. */
+function isAuthenticated(c) {
+	return getUser(c) !== void 0;
+}
+/**
+* The request-scoped data driver: reads and writes run as **the caller**, with
+* your row-level security policies evaluated against their identity.
+*
+* This is the accessor to reach for when a function serves user-facing data.
+* `rebase.dataAsAdmin` is the other one, and it is not the same thing — it runs
+* as `{ uid: "service", roles: ["admin"] }` for every caller alike, which is
+* correct for trusted background work and wrong for a request.
+*
+* `undefined` only when no Rebase auth middleware ran (see
+* {@link identityResolved}); inside a function mounted by the framework it is
+* always present, anonymous requests included — they get an anon-scoped driver
+* so policies still have an identity to evaluate.
+*/
+function getDriver(c) {
+	return read(c, "driver");
+}
+/**
+* {@link getDriver}, but throws instead of handing back `undefined`.
+*
+* For the common case where a handler cannot proceed without it and would
+* otherwise write `c.get("driver")!` — an assertion that turns a wiring problem
+* into `Cannot read properties of undefined (reading 'fetchCollection')` twenty
+* lines away from the cause.
+*/
+function requireDriver(c) {
+	const driver = getDriver(c);
+	if (!driver) throw new Error("No request-scoped driver on this context. A Rebase auth middleware populates it before any custom function runs, so this means the handler was mounted outside the functions router — e.g. added to your own Hono app directly. Mount it from the functions directory, or use `rebase.dataAsAdmin` if the work is genuinely service-scoped.");
+	return driver;
+}
+/**
+* The API key this request authenticated with, masked, or `undefined` when it
+* did not use one.
+*
+* Useful for attribution and for per-key behaviour. The permission check itself
+* has already happened — reaching a handler means the key was allowed to.
+*/
+function getApiKey(c) {
+	return read(c, "apiKey");
+}
+/**
+* The correlation id for this request — generated, or taken from an inbound
+* `X-Request-ID`.
+*
+* Log it. It is the only thing that ties a line written inside a function to
+* the framework's own lines for the same request.
+*/
+function getRequestId(c) {
+	return read(c, "requestId");
+}
+/**
+* Whether a Rebase auth middleware has run on this request.
+*
+* Both middlewares populate `driver` for *every* outcome, anonymous included,
+* and populate `user` whenever there is one. So "neither is set" does not mean
+* "anonymous" — it means nothing resolved the identity, and treating that as
+* anonymous is the dangerous reading. The guards use this to tell a genuinely
+* anonymous caller (401) from a misconfigured mount (500), because answering
+* 401 to the second sends whoever is debugging it to look at the token.
+*/
+function identityResolved(c) {
+	return read(c, "user") !== void 0 || read(c, "driver") !== void 0;
+}
+//#endregion
+//#region src/functions/guards.ts
+/**
+* The answer to "a guard ran, but no middleware had resolved anything".
+*
+* Deliberately a 500 and not a 401. A 401 tells the caller their credential is
+* the problem, and here the caller's credential was never looked at — sending
+* them to check their token is sending them to the one place the answer is not.
+*/
+function unresolvedIdentity() {
+	return { error: {
+		message: "This route's identity was never resolved: no Rebase auth middleware ran before the guard. A function loaded from the functions directory always has one. This usually means the Hono app was mounted onto your own server directly, bypassing the functions router.",
+		code: "AUTH_MIDDLEWARE_MISSING"
+	} };
+}
+/**
+* Reject anonymous callers with 401.
+*
+* Put it in the route's own middleware slot rather than `app.use("/*", …)`:
+* `use()` covers only the routes declared *below* it, so a route appended later
+* — by you, months from now, at the bottom of the file — is silently
+* unprotected. The per-route form cannot drift that way.
+*
+* @example
+* ```ts
+* app.post("/", requireAuth, async (c) => {
+*     const user = getUser(c)!;  // guaranteed by the guard
+*     return c.json({ uid: user.uid });
+* });
+* ```
+*/
+var requireAuth = async (c, next) => {
+	if (getUser(c)) return next();
+	if (!identityResolved(c)) return c.json(unresolvedIdentity(), 500);
+	return c.json({ error: {
+		message: "Authentication required",
+		code: "UNAUTHORIZED"
+	} }, 401);
+};
+/**
+* Reject callers without an administrative role with 403.
+*
+* Must come **after** {@link requireAuth}: on its own it answers 401 for an
+* anonymous caller, which is right, but pairing them keeps the two failures
+* distinguishable — 401 "who are you", 403 "not you".
+*
+* Administrative means `admin` or `schema-admin`, from the single list in
+* `auth/admin-roles.ts`. Do not compare against `"admin"` by hand; that is the
+* divergence that list exists to prevent.
+*/
+var requireAdmin = async (c, next) => {
+	if (!getUser(c)) {
+		if (!identityResolved(c)) return c.json(unresolvedIdentity(), 500);
+		return c.json({ error: {
+			message: "Authentication required",
+			code: "UNAUTHORIZED"
+		} }, 401);
+	}
+	if (!isAdmin(c)) return c.json({ error: {
+		message: "Admin privileges required for this operation",
+		code: "FORBIDDEN"
+	} }, 403);
+	return next();
+};
+/**
+* Reject callers holding none of the named roles with 403.
+*
+* Any of them, not all — require several by chaining the guard twice. Naming no
+* role at all is a programming error and throws at module load rather than at
+* request time, because `requireRole()` with an empty list would otherwise read
+* as a guard while admitting everyone.
+*
+* @example
+* ```ts
+* app.post("/publish", requireAuth, requireRole("editor", "admin"), handler);
+* ```
+*/
+function requireRole(...roles) {
+	if (roles.length === 0) throw new Error("requireRole() needs at least one role. An empty list would admit every signed-in caller while reading as a restriction.");
+	const allowed = new Set(roles);
+	return async (c, next) => {
+		if (!getUser(c)) {
+			if (!identityResolved(c)) return c.json(unresolvedIdentity(), 500);
+			return c.json({ error: {
+				message: "Authentication required",
+				code: "UNAUTHORIZED"
+			} }, 401);
+		}
+		if (!getRoles(c).some((role) => allowed.has(role))) return c.json({ error: {
+			message: `This operation requires one of these roles: ${roles.join(", ")}`,
+			code: "FORBIDDEN"
+		} }, 403);
+		return next();
+	};
+}
+//#endregion
+//#region src/functions/runtime-env.ts
+/**
+* Every environment variable visible to this request.
+*
+* `c.env` on workerd, `Deno.env` on Deno, `process.env` on Node, Bun and
+* Vercel's edge runtime. Reading it through here rather than through `process`
+* is the whole of what makes a function's configuration portable.
+*/
+function getEnv(c) {
+	return env$1(c);
+}
+/**
+* One environment variable, or `undefined`.
+*
+* Trimmed, and a blank value counts as absent — declaring a variable and
+* leaving it empty is the ordinary way to write a compose file or a `.env`
+* line, and nobody has ever meant `""` by it.
+*/
+function env(c, name) {
+	const raw = getEnv(c)[name];
+	if (typeof raw !== "string") return void 0;
+	const trimmed = raw.trim();
+	return trimmed === "" ? void 0 : trimmed;
+}
+/**
+* One environment variable, or a thrown error naming it.
+*
+* For configuration a handler cannot run without. Throwing here — inside the
+* request — is deliberately better than the module-scope `process.env.KEY!`
+* it replaces: that one takes the whole *file* down at load time, and the
+* loader reports it as "this function could not be imported", which names the
+* file but not the variable. This fails one request, with the name in the
+* message, while every other route in the file keeps serving.
+*/
+function requireEnv(c, name) {
+	const value = env(c, name);
+	if (value === void 0) throw new Error(`Missing required environment variable ${name}. Set it on the process (or as a binding, on a host that has them) — and read it inside the handler, not at module scope, so the same file works on both.`);
+	return value;
+}
+/**
+* Which host this is: `"node"`, `"workerd"`, `"deno"`, `"bun"`, `"edge-light"`,
+* `"fastly"` or `"other"`.
+*
+* Use it to *degrade*, not to branch a whole implementation — a function that
+* needs two implementations is two functions. It is honest about one thing in
+* particular: a Node-only capability, such as `rebase.sql()`, can check this
+* and say so, instead of failing at the call.
+*/
+function runtimeKey() {
+	return getRuntimeKey();
+}
+/** Whether this is a Node-like host — Node itself, or Bun's Node compatibility. */
+function isNodeRuntime() {
+	const key = getRuntimeKey();
+	return key === "node" || key === "bun";
+}
+/**
+* Build something expensive once per environment, on first use, from inside a
+* request.
+*
+* This is the sanctioned replacement for the module-scope client:
+*
+* ```ts
+* // Don't: runs at import time, before bindings exist on some hosts.
+* const stripe = new Stripe(process.env.STRIPE_SECRET_KEY!);
+*
+* // Do: runs on first request, reads that request's configuration.
+* const stripe = lazyResource(env => new Stripe(env.STRIPE_SECRET_KEY!));
+* app.post("/", async (c) => { await stripe(c).charges.list(); });
+* ```
+*
+* The factory runs once per distinct environment object and the result is
+* cached against it. On Node that is once per process, because `process.env` is
+* one object for the life of the process — identical to the module-scope
+* version in cost, and unlike it, deferred until configuration exists. On a
+* host that hands each request a fresh binding object it is once per object,
+* which is the only correct answer there: caching across bindings would serve
+* one tenant's client to another.
+*
+* A {@link WeakMap} holds the cache, so an environment object the host has
+* finished with takes the resource with it.
+*/
+function lazyResource(factory) {
+	const cache = /* @__PURE__ */ new WeakMap();
+	return (c) => {
+		const bindings = getEnv(c);
+		if (!bindings || typeof bindings !== "object") return factory(bindings ?? {});
+		const existing = cache.get(bindings);
+		if (existing !== void 0) return existing;
+		const created = factory(bindings);
+		cache.set(bindings, created);
+		return created;
+	};
+}
+//#endregion
+//#region src/utils/logger.ts
+/**
+* Structured Logger for Rebase Backend
+*
+* Outputs JSON lines when `NODE_ENV=production`, human-readable prefixed
+* lines otherwise.  Designed to work with Google Cloud Logging severity levels.
+*
+* Every line — message and data, at any depth — passes through the redaction
+* below, which strips Drizzle's `Failed query: … / params: …` wrapper and the
+* values of secret-looking keys. See the block above `serialiseError`.
+*
+* Usage:
+*   import { logger } from "./utils/logger";
+*   logger.info("Server started", { port: 3001 });
+*   logger.error("Request failed", { path: "/api/test", error: err });
+*
+* Every host global goes through `./host`, and that is load-bearing rather than
+* tidy: this module is reachable from `@rebasepro/server/functions`, the
+* authoring surface that has to import cleanly on a runtime with no `process`.
+* A bare `process.env.NODE_ENV` here would make the first log line of the first
+* request on workerd a `ReferenceError`.
+*/
+/** Google Cloud Logging severity strings. */
+var GCP_SEVERITY = {
+	debug: "DEBUG",
+	info: "INFO",
+	warn: "WARNING",
+	error: "ERROR"
+};
+var LOG_PRIORITY = {
+	debug: 0,
+	info: 1,
+	warn: 2,
+	error: 3
+};
+function isProduction() {
+	return hostEnv().NODE_ENV === "production";
+}
+function getMinLevel() {
+	const env = (hostEnv().LOG_LEVEL || "info").toLowerCase();
+	if (env in LOG_PRIORITY) return env;
+	return "info";
+}
+var FAILED_QUERY_MARKER = "Failed query:";
+var REDACTED_QUERY = "Failed query: [redacted]";
+var REDACTED_VALUE = "[redacted]";
+/**
+* Key fragments whose values are never safe to publish. Compared against the
+* key with separators and case removed, so `api_key`, `apiKey` and `API-KEY`
+* all match `apikey`.
+*/
+var SENSITIVE_KEY_FRAGMENTS = [
+	"password",
+	"passwd",
+	"passphrase",
+	"secret",
+	"token",
+	"apikey",
+	"authorization",
+	"credential",
+	"cookie",
+	"privatekey",
+	"sessionid"
+];
+/** Longest structure the redactor will walk before giving up. */
+var MAX_REDACT_DEPTH = 8;
+function isSensitiveKey(key) {
+	const normalised = key.toLowerCase().replace(/[^a-z0-9]/g, "");
+	return SENSITIVE_KEY_FRAGMENTS.some((fragment) => normalised.includes(fragment));
+}
+/**
+* Local escape hatch for the `Failed query:` strip only — the statement is the
+* fastest way to diagnose a failing query on a developer machine. Ignored in
+* production, so a runtime that inherits the variable cannot leak because of
+* it, and it never re-enables the key deny-list.
+*/
+function rawQueriesAllowed() {
+	return hostEnv().NODE_ENV !== "production" && hostEnv().REBASE_LOG_RAW_QUERIES === "true";
+}
+/**
+* Strip every `Failed query: … / params: …` span out of a message or stack,
+* keeping the surrounding text (including stack frames, which carry no user
+* data). When no `params:` line follows the marker the rest of the string is
+* dropped: a statement of unknown extent is treated as sensitive rather than
+* guessed at.
+*
+* Idempotent, and it has to be: an already-redacted span still starts with the
+* marker but has no `params:` line, so a second pass over it would fall into
+* the drop-the-rest branch and eat the stack frames behind it. Redaction runs
+* more than once on the same string in practice — the cron scheduler redacts
+* before persisting and then logs the result.
+*/
+function redactSensitiveText(text) {
+	if (!text.includes(FAILED_QUERY_MARKER) || rawQueriesAllowed()) return text;
+	let out = text;
+	let idx = out.indexOf(FAILED_QUERY_MARKER);
+	while (idx !== -1) {
+		if (out.startsWith(REDACTED_QUERY, idx)) {
+			idx = out.indexOf(FAILED_QUERY_MARKER, idx + 24);
+			continue;
+		}
+		const paramsIdx = out.indexOf("\nparams:", idx);
+		let end;
+		if (paramsIdx === -1) end = out.length;
+		else {
+			const eol = out.indexOf("\n", paramsIdx + 1);
+			end = eol === -1 ? out.length : eol;
+		}
+		out = out.slice(0, idx) + REDACTED_QUERY + out.slice(end);
+		idx = out.indexOf(FAILED_QUERY_MARKER, idx + 24);
+	}
+	return out;
+}
+/**
+* Serialise an Error into a plain object (stack + message), with the query
+* text redacted out of both. `query`/`params` own-properties — which
+* `DrizzleQueryError` carries beside the message — are deliberately not
+* copied.
+* Handles non-Error values gracefully.
+*/
+function serialiseError(value) {
+	if (value instanceof Error) return {
+		name: value.name,
+		message: redactSensitiveText(value.message),
+		stack: value.stack ? redactSensitiveText(value.stack) : void 0
+	};
+	return { value: redactSensitiveText(String(value)) };
+}
+/**
+* Redact one logged value: errors are serialised, strings are stripped of
+* query text, objects and arrays are walked. Cycles and over-deep structures
+* collapse to a marker rather than throwing — a logger that can fail is worse
+* than one that logs less. (An object referenced twice in one payload is
+* reported as `[circular]` the second time; bounding the walk matters more
+* than rendering a shared reference twice.)
+*/
+function redactValue(value, depth, seen) {
+	if (value instanceof Error) return serialiseError(value);
+	if (typeof value === "string") return redactSensitiveText(value);
+	if (value === null || typeof value !== "object") return value;
+	if (depth >= MAX_REDACT_DEPTH) return "[truncated]";
+	if (seen.has(value)) return "[circular]";
+	seen.add(value);
+	if (Array.isArray(value)) return value.map((item) => redactValue(item, depth + 1, seen));
+	if (value instanceof Date) return value;
+	const out = {};
+	for (const [key, val] of Object.entries(value)) out[key] = isSensitiveKey(key) ? REDACTED_VALUE : redactValue(val, depth + 1, seen);
+	return out;
+}
+function formatData(data) {
+	if (!data) return void 0;
+	const seen = /* @__PURE__ */ new WeakSet();
+	const out = {};
+	for (const [key, val] of Object.entries(data)) out[key] = isSensitiveKey(key) ? REDACTED_VALUE : redactValue(val, 0, seen);
+	return out;
+}
+function createLogger(rawDefaultFields = {}) {
+	const minLevel = getMinLevel();
+	const defaultFields = formatData(rawDefaultFields) ?? {};
+	function emit(level, message, data) {
+		if (LOG_PRIORITY[level] < LOG_PRIORITY[minLevel]) return;
+		const safeMessage = redactSensitiveText(message);
+		const merged = {
+			...defaultFields,
+			...formatData(data)
+		};
+		if (isProduction()) {
+			const entry = {
+				severity: GCP_SEVERITY[level],
+				message: safeMessage,
+				timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+				...merged
+			};
+			const line = JSON.stringify(entry);
+			if (level === "error") writeLine("err", line);
+			else writeLine("out", line);
+		} else {
+			const prefix = level === "error" ? "❌" : level === "warn" ? "⚠️" : level === "info" ? "ℹ️" : "🐛";
+			const extra = Object.keys(merged).length > 0 ? ` ${JSON.stringify(merged)}` : "";
+			const out = `${prefix} [${level.toUpperCase()}] ${safeMessage}${extra}`;
+			if (level === "error") console.error(out);
+			else if (level === "warn") console.warn(out);
+			else console.log(out);
+		}
+	}
+	return {
+		debug: (msg, data) => emit("debug", msg, data),
+		info: (msg, data) => emit("info", msg, data),
+		warn: (msg, data) => emit("warn", msg, data),
+		error: (msg, data) => emit("error", msg, data),
+		child(fields) {
+			return createLogger({
+				...defaultFields,
+				...fields
+			});
+		}
+	};
+}
+/**
+* Singleton logger instance.
+* In production: emits JSON lines with `severity`, `message`, `timestamp`.
+* In development: emits human-readable prefixed lines.
+*/
+var logger = createLogger();
+//#endregion
+//#region src/functions/wait-until.ts
+/**
+* Pending background work, on a process-global slot for the reason given in
+* `../singleton.ts`: two copies of this module in one process must not each
+* hold half the work, or shutdown drains one half and drops the other.
+*/
+var PENDING_SLOT = Symbol.for("@rebasepro/server:pending-background-work");
+function pending() {
+	const global = globalThis;
+	if (!global[PENDING_SLOT]) global[PENDING_SLOT] = /* @__PURE__ */ new Set();
+	return global[PENDING_SLOT];
+}
+/**
+* Keep `work` alive past the response, on any runtime.
+*
+* Hand it a promise or a function returning one. Nothing is awaited: the
+* response goes out immediately, exactly as an un-awaited call would.
+*
+* What it buys, per host:
+*
+* - **Isolate hosts** (Workers, Deno Deploy, Vercel Edge): the host is told to
+*   keep the isolate alive until the promise settles. Without this the work is
+*   dropped when the response resolves.
+* - **Node**: the promise is tracked so {@link drainBackgroundWork} can wait for
+*   it during graceful shutdown instead of the process exiting out from under
+*   it.
+*
+* On every host a rejection is logged rather than left to the unhandled-rejection
+* handler, so the failure names the function it came from.
+*
+* @example
+* ```ts
+* app.post("/orders", requireAuth, async (c) => {
+*     const order = await createOrder(c);
+*     waitUntil(c, notifyWarehouse(order));   // caller does not wait for this
+*     return c.json({ id: order.id });
+* });
+* ```
+*/
+function waitUntil(c, work) {
+	let promise;
+	try {
+		promise = typeof work === "function" ? Promise.resolve(work()) : work;
+	} catch (error) {
+		logBackgroundFailure(c, error);
+		return;
+	}
+	const tracked = promise.catch((error) => {
+		logBackgroundFailure(c, error);
+	});
+	const set = pending();
+	set.add(tracked);
+	tracked.finally(() => set.delete(tracked));
+	try {
+		c.executionCtx?.waitUntil?.(tracked);
+	} catch {}
+}
+function logBackgroundFailure(c, error) {
+	logger.error("[functions] Background work failed after the response was sent", {
+		method: c.req?.method,
+		path: c.req?.path,
+		error: error instanceof Error ? error : new Error(String(error))
+	});
+}
+//#endregion
+//#region src/api/errors.ts
+/**
+* Standardized API error class.
+* Throw this from any route handler — the errorHandler middleware
+* will format it into `{ error: { message, code, details? } }`.
+*/
+var ApiError = class ApiError extends Error {
+	statusCode;
+	code;
+	details;
+	/**
+	* Whether this outcome is a routine part of normal operation rather than
+	* something an operator should look at. Expected errors log at debug; every
+	* other operational error logs at warn.
+	*
+	* The motivating case is `POST /auth/refresh` with no session: clients
+	* refresh on page load before they know whether one exists, so every
+	* anonymous page view is a 401 — correct, and not worth a warning line.
+	*
+	* The other class is a caller-caused 4xx that never reached the database: a
+	* mistyped filter operator, sort direction or limit, a request for a
+	* collection that does not exist. Nothing on this server is wrong, and the
+	* response body has already told the caller what to fix — while one client
+	* holding a stale name would otherwise write a warning per request, forever,
+	* until the level means nothing. See `api/rest/query-parser.ts`.
+	*
+	* What stays at warn is anything that says something about the *server*:
+	* a schema that has drifted from the code, a permission the database
+	* refused, a dependency that failed. Those are 4xx too, and they are still
+	* incidents.
+	*/
+	expected;
+	constructor(statusCode, code, message, details, expected = false) {
+		super(message);
+		this.name = "ApiError";
+		this.statusCode = statusCode;
+		this.code = code;
+		this.details = details;
+		this.expected = expected;
+	}
+	static badRequest(message, code = "BAD_REQUEST", details) {
+		return new ApiError(400, code, message, details);
+	}
+	static unauthorized(message, code = "UNAUTHORIZED") {
+		return new ApiError(401, code, message);
+	}
+	/**
+	* A 401 that is a normal outcome, not an incident — logged at debug.
+	* See {@link ApiError.expected}.
+	*/
+	static unauthenticated(message, code = "UNAUTHORIZED") {
+		return new ApiError(401, code, message, void 0, true);
+	}
+	static forbidden(message, code = "FORBIDDEN") {
+		return new ApiError(403, code, message);
+	}
+	static notFound(message, code = "NOT_FOUND") {
+		return new ApiError(404, code, message);
+	}
+	static conflict(message, code = "CONFLICT") {
+		return new ApiError(409, code, message);
+	}
+	static internal(message, code = "INTERNAL_ERROR") {
+		return new ApiError(500, code, message);
+	}
+	static serviceUnavailable(message, code = "SERVICE_UNAVAILABLE") {
+		return new ApiError(503, code, message);
+	}
+};
+//#endregion
+export { ApiError, defineFunction, env, getApiKey, getDriver, getEnv, getRequestId, getRoles, getUser, getUserId, hasRole, identityResolved, isAdmin, isAuthenticated, isNodeRuntime, lazyResource, rebase, requireAdmin, requireAuth, requireDriver, requireEnv, requireRole, runtimeKey, waitUntil };
+
+//# sourceMappingURL=index.js.map