@rebasepro/server 0.16.0 → 0.16.1-canary.g701140a

package/dist/contract-routes-DZ-LBpSL.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"contract-routes-DZ-LBpSL.js","names":[],"sources":["../../types/src/types/project_manifest.ts","../../types/src/types/collection_contract.ts","../../types/src/types/schema_version.ts","../src/api/contract-routes.ts"],"sourcesContent":["/**\n * The project manifest (`rebase.json`) and the build artifacts derived from it.\n *\n * Three separate documents live in this file, and keeping them distinct matters:\n *\n * 1. {@link RebaseProjectManifest} — `rebase.json`. **Authored** by the developer,\n *    committed to the repository. Declares topology only: which runtime major the\n *    project targets, and which apps *this repository* contributes to the project.\n *    Schema, security rules, hooks and functions stay in TypeScript under the\n *    config package — nothing that needs a type system belongs here.\n *\n * 2. {@link RebaseProjectLink} — the per-checkout link (`.rebase/cloud.json`).\n *    **Not committed**, because it is per-developer like a git remote. Says which\n *    deployed project this working copy points at, whether that is a Rebase Cloud\n *    project or the base URL of a self-hosted backend.\n *\n * 3. {@link RebaseBundleManifest} — `manifest.json` inside a built bundle.\n *    **Generated**, never hand-edited. It is the lockfile analogue: the exact\n *    contract a built artifact claims to satisfy, which the runtime validates\n *    before it boots and a control plane validates before it deploys.\n *\n * A repository declares only the apps it contains. The set of apps belonging to a\n * project is held by the project itself, which is what makes multi-repo projects\n * work: two repositories never need to know about each other, only about the\n * project.\n */\n\nimport type { StorageSourceDefinition } from \"./storage_source\";\n\n/**\n * Which kind of thing an app is.\n *\n * - `backend` — the collections/hooks/functions that define the project's API.\n *   Exactly one per *project* (not per repository); the registry enforces it.\n * - `static`  — a pre-built client bundle (SPA, static site), served from the\n *   backend process at its declared `path` or from a CDN. The admin panel is\n *   one of these: it is an app in the user's repository like any other.\n *\n * That is the whole list. Ownership of the server process is a property of the\n * backend app ({@link RebaseBackendAppConfig.runtime}), not an app type.\n */\nexport type RebaseAppType = \"backend\" | \"static\";\n\n/**\n * The backend app: the project's API surface.\n *\n * Paths are relative to the directory holding `rebase.json`. The defaults match\n * the layout `rebase init` scaffolds, so a stock project may declare simply\n * `{ \"type\": \"backend\", \"runtime\": \"managed\" }`.\n */\nexport interface RebaseBackendAppConfig {\n    type: \"backend\";\n    /**\n     * Who owns the process this backend runs in.\n     *\n     * - `managed` — the platform's runtime image boots this project's bundle.\n     *   You supply collections, functions, crons and schema; Rebase supplies the\n     *   server.\n     * - `custom` — this repository builds its own image and entrypoint. The\n     *   escape hatch: full control, no managed-runtime guarantees.\n     *\n     * Independent of *where* it runs. Both run on Rebase Cloud and both\n     * self-host — the destination lives in `.rebase/cloud.json`, not here. See\n     * `docker/docker-compose.selfhost.yml`, which boots a managed bundle on a\n     * developer's own Docker host.\n     *\n     * This is authored rather than inferred on purpose. It is the single most\n     * consequential fact about a deployment, and inferring it is what used to\n     * land projects on the custom runtime without anyone choosing it.\n     */\n    runtime: \"managed\" | \"custom\";\n    /** Directory of the config package (collections + index). Default `config`. */\n    config?: string;\n    /** Directory of server functions. Default `backend/functions`. */\n    functions?: string;\n    /** Directory of cron job definitions. Default `backend/crons` when present. */\n    crons?: string;\n    /**\n     * Path to the generated Drizzle schema module (tables/enums/relations).\n     * Default `backend/src/schema.generated.ts`.\n     */\n    schema?: string;\n    /**\n     * Module path (relative to `config`) exporting the auth users collection as\n     * its default export. Default `collections/users`.\n     */\n    usersCollection?: string;\n\n    /**\n     * `runtime: \"custom\"` only. Dockerfile path relative to the repository root.\n     * Default `Dockerfile`.\n     */\n    dockerfile?: string;\n    /** `runtime: \"custom\"` only. Build context relative to the root. Default `.`. */\n    context?: string;\n    /** `runtime: \"custom\"` only. Port the container listens on. Default 8080. */\n    port?: number;\n}\n\n/**\n * A static client bundle — SPA or static site — built here and served at `path`.\n */\nexport interface RebaseStaticAppConfig {\n    type: \"static\";\n    /** Package directory containing the client sources. */\n    root: string;\n    /** Command that produces `output`. Run from the repository root. */\n    build?: string;\n    /** Directory of built assets, relative to the repository root. */\n    output: string;\n    /**\n     * Public base path this app is served under. Default `/`.\n     *\n     * Several static apps run in one process, each at its own path — the API at\n     * `/api`, a site at `/`, the admin at `/admin` — which is what keeps a\n     * self-hosted deployment a single container.\n     *\n     * **This is a build-time input, not only a serving concern.** An app mounted\n     * at `/admin` must be *built* for `/admin` (Vite's `base`), or `index.html`\n     * loads and every asset 404s: a blank page with no server error. `rebase\n     * build` passes it as `REBASE_APP_BASE` and asserts the emitted HTML honours\n     * it. Changing this value requires rebuilding the app.\n     */\n    path?: string;\n    /**\n     * Serve `index.html` for unmatched paths under `path` (client-side routing).\n     * Default `true` — the overwhelmingly common case for a client app, and a\n     * static *site* generator emits real files for its routes anyway.\n     */\n    spa?: boolean;\n}\n\nexport type RebaseAppConfig = RebaseBackendAppConfig | RebaseStaticAppConfig;\n\n/**\n * One declared storage source, as authored in `rebase.json`.\n *\n * The key comes from the enclosing record, so this is\n * {@link StorageSourceDefinition} minus its `key` — the same document the\n * runtime registry and the frontend router consume, expressed the way a JSON\n * object naturally expresses \"a set of named things\".\n */\nexport interface RebaseStorageSourceConfig {\n    /** Engine backing this source: `local`, `s3`, `gcs`, or a custom id. */\n    engine: string;\n    /**\n     * How the frontend reaches it. Default `server` (proxied through\n     * `/api/storage`). `direct` means a provider SDK talks to the bucket and the\n     * backend is not in the upload path.\n     */\n    transport?: \"server\" | \"direct\";\n    /** Human-readable label for the console and the admin UI. */\n    label?: string;\n}\n\n/**\n * `rebase.json` — the authored project manifest.\n */\nexport interface RebaseProjectManifest {\n    /** JSON Schema URL, for editor completion. Ignored by the tooling. */\n    $schema?: string;\n    /**\n     * The runtime contract **major** this project targets, as a semver range\n     * (e.g. `^1`, `~1.4`, or an exact `1.4.2` to pin).\n     *\n     * The platform upgrades patches and minors underneath a project without\n     * asking; it never crosses a major. See {@link RUNTIME_CONTRACT_VERSION}.\n     *\n     * Named `rebase` rather than `runtime` so that `runtime` means exactly one\n     * thing — {@link RebaseBackendAppConfig.runtime}, who owns the process. It\n     * reads like `engines` in a `package.json`, which is what it is.\n     */\n    rebase: string;\n    /**\n     * Apps this repository contributes, keyed by app name. The key is the app's\n     * identity within the project: it is what `rebase deploy <app>` names, what\n     * client credentials are issued against, and what a second repository must\n     * not collide with.\n     */\n    apps: Record<string, RebaseAppConfig>;\n    /**\n     * Storage sources this project uses, keyed by source key.\n     *\n     * **Topology only — never credentials.** Which buckets exist is a property of\n     * the project and belongs in the repository; how to reach each one is a\n     * property of the deployment and lives in the environment, read per source\n     * from `<BASE>__<KEY>` (`S3_BUCKET__MEDIA` for a source keyed `media`). The\n     * default source takes no suffix, so a single-bucket project configured with\n     * plain `S3_BUCKET` keeps working having declared nothing at all.\n     *\n     * Declared here rather than only in the config package because this file is\n     * the one artifact a host can read *before* running a build. That is what\n     * lets a console show \"this project wants a `media` bucket, and it has none\"\n     * on a project's first deploy, and it is why the managed and custom runtimes\n     * can present the same list — a custom build emits no bundle manifest, so a\n     * declaration that lived only in compiled config would leave every custom\n     * project invisible.\n     *\n     * Omitted entirely means one default source, which is the overwhelmingly\n     * common project and must not be required to say so.\n     */\n    storage?: Record<string, RebaseStorageSourceConfig>;\n    /**\n     * Repository-wide opt-out from anonymous CLI usage sharing.\n     *\n     * **Only `false` does anything.** It suppresses sharing for everyone who\n     * clones this repository, overriding each developer's own opt-in — an\n     * organisation setting policy for work done on its behalf, the same shape\n     * as a committed `.npmrc`.\n     *\n     * `true` is deliberately ignored, and the CLI says so rather than obeying\n     * quietly. This file is committed, so a `true` here would be one developer\n     * answering a privacy question for every colleague who later clones the\n     * repo — consent by proxy, which is the exact thing opt-in exists to\n     * prevent. Individuals opt in with `rebase telemetry enable`.\n     */\n    telemetry?: boolean;\n}\n\n/**\n * The per-checkout project link.\n *\n * Deliberately separate from `rebase.json`: the manifest is committed and shared,\n * while the link is per-developer. Keeping them in one file would mean either\n * committing someone's project id or gitignoring the topology.\n */\nexport interface RebaseProjectLink {\n    /**\n     * A Rebase Cloud project id, or the base URL of any running Rebase backend\n     * (`https://api.example.com`). Both are first-class: every command that\n     * accepts a project reference accepts either, so a self-hosted project has\n     * the same tooling as a cloud one.\n     */\n    project: string;\n    /** Organization slug. Cloud projects only. */\n    org?: string;\n    /** Explicit API base URL, when it differs from the project's default. */\n    apiUrl?: string;\n}\n\n/**\n * Whether a project can run on the managed runtime, and if not, precisely why.\n *\n * The reasons are returned rather than summarised so tooling can print something\n * a developer can act on. \"Not eligible\" is never a dead end — it selects the\n * custom-runtime path, which still deploys.\n */\nexport interface ManagedCompatibility {\n    eligible: boolean;\n    reasons: string[];\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Bundle\n// ─────────────────────────────────────────────────────────────────────────────\n\n/**\n * Version of the bundle *format* itself.\n *\n * Bumped only when the on-disk layout changes in a way an older runtime could\n * not read. A runtime accepts any bundle whose `bundleFormat` is less than or\n * equal to its own — old bundles keep booting on new runtimes, which is the\n * whole point of separating the artifact from the engine.\n *\n * - **1** — `mode: \"cms\" | \"baas\" | \"static\"`, `entry.static` a single directory\n *   string, `entry.admin` for a bundled admin panel.\n * - **2** — `kind: \"backend\" | \"static\"`, `entry.static` a list of\n *   {@link RebaseBundleStatic}, `entry.admin` removed. A format-1 runtime reading\n *   one of these would find no `mode` and an array where it expects a string, so\n *   the bump is what turns that into a refusal to boot instead of a bundle that\n *   starts and serves nothing.\n */\nexport const BUNDLE_FORMAT_VERSION = 2;\n\n/**\n * The runtime contract major.\n *\n * Distinct from the `@rebasepro/server` package version: the package may release\n * any number of minors and patches while this stays put. It changes only when\n * the bundle/runtime contract breaks compatibility, and a project's\n * `manifest.runtime` range is matched against *this*.\n */\nexport const RUNTIME_CONTRACT_VERSION = 1;\n\n/** Where the runtime finds each part of the bundle. Paths are bundle-relative. */\nexport interface RebaseBundleEntrypoints {\n    /** Compiled config package directory (collections live under it). */\n    config?: string;\n    /** Compiled collections directory, when it differs from `<config>/collections`. */\n    collections?: string;\n    /** Compiled functions directory. */\n    functions?: string;\n    /** Compiled crons directory. */\n    crons?: string;\n    /** Compiled Drizzle schema module. */\n    schema?: string;\n    /** Module exporting the auth users collection (default export). */\n    usersCollection?: string;\n    /**\n     * Built static apps to serve from this process, in declaration order.\n     *\n     * A list rather than a single directory because one process serves several\n     * apps at different paths — a site at `/` and the admin at `/admin`. The\n     * runtime mounts them longest-path-first so the `/`-rooted app's catch-all\n     * does not claim its siblings' URLs.\n     */\n    static?: RebaseBundleStatic[];\n}\n\n/** One built static app inside a bundle. */\nexport interface RebaseBundleStatic {\n    /** Public base path, e.g. `/` or `/admin`. */\n    path: string;\n    /** Bundle-relative directory holding the built assets. */\n    dir: string;\n    /** Serve `index.html` for unmatched paths under `path`. */\n    spa: boolean;\n}\n\n/**\n * A native module found in the dependency closure.\n *\n * Recorded rather than merely counted so a rejection can name the offending\n * package instead of saying \"something here is native\".\n */\nexport interface NativeDependency {\n    name: string;\n    /** Why it was flagged — a `.node` binary, a gyp build, or an install script. */\n    reason: string;\n}\n\n/**\n * `manifest.json` — generated, and the document the runtime and control plane\n * both validate against.\n */\nexport interface RebaseBundleManifest {\n    /** @see BUNDLE_FORMAT_VERSION */\n    bundleFormat: number;\n    runtime: {\n        /** The `runtime` range copied from `rebase.json`. */\n        range: string;\n        /** Exact `@rebasepro/server` version this bundle was built against. */\n        builtAgainst: string;\n        /** Runtime contract major this bundle requires. */\n        contract: number;\n    };\n    /**\n     * Hash of the compiled collection definitions.\n     *\n     * This is the contract stamp. A generated SDK records the value it was built\n     * from, a client sends it back, and a mismatch is what lets the platform say\n     * \"this app was built against an older schema\" instead of failing mysteriously\n     * at the first request. It covers collections only — a hook edit does not\n     * change a client's contract, so it must not invalidate every SDK.\n     */\n    schemaVersion: string;\n    /** Which app in `rebase.json` this bundle was built from. */\n    app: string;\n    /**\n     * What the runtime does with this bundle.\n     *\n     * - `backend` — boot the full server: database, auth and the data API, plus\n     *   any static apps in `entry.static`.\n     * - `static` — no backend at all: serve `entry.static` and nothing else. No\n     *   database, no auth, no data sources. This is how a static app runs on the\n     *   same image as the backend.\n     *\n     * Replaces an earlier `mode: \"cms\" | \"baas\" | \"static\"`. The cms/baas\n     * distinction was never a third kind of thing — it is simply whether\n     * `entry.config` is present, so it is derived rather than declared.\n     */\n    kind: \"backend\" | \"static\";\n    entry: RebaseBundleEntrypoints;\n    /** Collection slugs contained in the bundle, for quick inspection. */\n    collections?: string[];\n    hooks: {\n        /**\n         * Whether the dependency closure contains native code.\n         *\n         * The managed runtime refuses these: a prebuilt binary cannot be run on\n         * an image the platform did not build it for, and the honest failure is\n         * at deploy time rather than at 3am in a crash loop.\n         */\n        native: boolean;\n        nativeModules?: NativeDependency[];\n    };\n    /**\n     * What the bundle's config says about storage access control.\n     *\n     * Storage is not under RLS and its keys share one flat namespace, so a\n     * deployment with file storage enabled and no access model serves every\n     * user's files to every signed-in user. The runtime refuses to boot in that\n     * state — which, on a hosted platform that enables storage from the *console*\n     * rather than from the bundle, surfaces as a crash loop the developer cannot\n     * read.\n     *\n     * Recording it here lets a host reject the deploy with the reason instead.\n     * Absent on bundles built before this field existed.\n     */\n    storage?: {\n        /** Whether the config package exports a `storageAuthorize` hook. */\n        authorize: boolean;\n        /**\n         * Every storage source this bundle expects, resolved at build time from\n         * `rebase.json`'s `storage` block merged with any `storageSources` the\n         * config package exports.\n         *\n         * Recorded so the runtime does not have to import user code to learn its\n         * own topology, and so a host can tell — from the artifact alone, before\n         * starting anything — which buckets need configuring. Absent on bundles\n         * built before this field existed, which means one default source.\n         */\n        sources?: StorageSourceDefinition[];\n    };\n    deps: {\n        /** Runtime dependencies of user code, as declared. */\n        declared: Record<string, string>;\n        /**\n         * The dependency tree ships *inside* the bundle, already installed.\n         *\n         * Absent or false means the tree is declared but not present, and\n         * whoever boots the bundle has to install it. On the managed runtime that\n         * install runs in an init container on **every** pod start — the bundle\n         * lives on a volume that is wiped each time — and it is the single\n         * largest cost in a managed pod's life: 35–55 seconds of a 40–60 second\n         * cold start. Since a pod restarts on every eviction, node failure, OOM\n         * and runtime rollout, that number is not a startup detail. It is what an\n         * outage costs.\n         *\n         * Vendoring moves the install to build time, where it happens once. It is\n         * skipped when the closure contains native code, because a prebuilt\n         * binary is only valid for the platform it was built for — see\n         * {@link vendorTarget} for what \"the platform\" means here.\n         */\n        vendored?: boolean;\n        /**\n         * What {@link vendored} was resolved for, recorded so a mismatch can be\n         * refused rather than discovered at import time.\n         *\n         * Cross-platform vendoring is safe for pure JavaScript and unsafe for\n         * anything compiled, and the boundary between them is not always visible\n         * in a dependency list: `esbuild` is pure-JS with a *platform-specific\n         * optional dependency* holding the actual binary, so an install run on a\n         * developer's Mac silently produces a tree that cannot run on the Linux\n         * image. The install therefore resolves optional dependencies for the\n         * target explicitly rather than for the machine it runs on, and records\n         * the answer here.\n         */\n        vendorTarget?: {\n            /** npm `--os`, e.g. `linux`. */\n            os: string;\n            /** npm `--cpu`, e.g. `x64`. */\n            cpu: string;\n            /** Node major the tree was resolved for. */\n            node: string;\n        };\n    };\n    build: {\n        /** `@rebasepro/cli` version that produced this bundle. */\n        cli: string;\n        /** Node major the bundle was compiled on. */\n        node: string;\n        /** ISO-8601. */\n        createdAt: string;\n    };\n}\n\n/** The contract a running backend serves at `GET /api/meta/contract`. */\nexport interface RebaseProjectContract {\n    /** Matches {@link RebaseBundleManifest.schemaVersion}. */\n    schemaVersion: string;\n    runtime: {\n        /** `@rebasepro/server` version currently running. */\n        version: string;\n        contract: number;\n    };\n    /** Full collection definitions, serialized — the input to SDK generation. */\n    collections: unknown[];\n    /** Collection slugs, for cheap inspection without parsing the definitions. */\n    collectionSlugs: string[];\n    generatedAt: string;\n}\n\n/** Header carrying the schema version an SDK was generated from. */\nexport const SCHEMA_VERSION_HEADER = \"x-rebase-schema\";\n","import type { CollectionConfig } from \"./collections\";\n\n/**\n * Serializing collections so they survive a network hop.\n *\n * A collection definition is not plain data. Relations point at their target\n * with a *function* (`target: () => usersCollection`) so two collections can\n * reference each other without an import cycle, and collections also carry\n * callbacks, custom views and component references. `JSON.stringify` silently\n * drops every one of those, which matters because the SDK generator *calls*\n * `relation.target()` to decide whether a foreign key is a string or a number.\n * Serialize naively and remote SDK generation produces subtly wrong types\n * instead of failing — the worst possible outcome.\n *\n * So relation targets are resolved to a slug reference on the way out and\n * rebuilt into functions on the way in. Everything else that cannot cross a wire\n * is dropped deliberately: an SDK is generated from the *shape* of the data, and\n * server-side behaviour is neither useful to a client nor safe to publish.\n */\n\n/** Marker replacing a relation's `target` function in serialized form. */\nexport interface SerializedCollectionRef {\n    __collectionRef: string;\n}\n\nexport function isSerializedCollectionRef(value: unknown): value is SerializedCollectionRef {\n    return typeof value === \"object\"\n        && value !== null\n        && typeof (value as SerializedCollectionRef).__collectionRef === \"string\";\n}\n\n/** Depth limit for the walk — deep enough for real configs, finite for cyclic ones. */\nconst MAX_DEPTH = 64;\n\n/**\n * Resolve whatever a `target` thunk returns down to a collection.\n *\n * A target may be the collection, a module namespace (when the authoring file\n * used `import * as`), or a default-export wrapper. All three appear in real\n * projects, and the SDK generator already unwraps them the same way.\n */\nfunction unwrapTarget(value: unknown): CollectionConfig | undefined {\n    if (!value || typeof value !== \"object\") return undefined;\n    const candidate = value as { default?: unknown; __esModule?: boolean; properties?: unknown };\n    if (candidate.default || candidate.__esModule) {\n        const inner = candidate.default;\n        if (inner && typeof inner === \"object\") return inner as CollectionConfig;\n    }\n    if (candidate.properties) return value as CollectionConfig;\n    return undefined;\n}\n\n/** The identity a serialized reference uses. Slug first — it is the routing key. */\nfunction refFor(collection: CollectionConfig | undefined): string | undefined {\n    if (!collection) return undefined;\n    const withPath = collection as CollectionConfig & { path?: string };\n    return collection.slug || withPath.path || collection.name;\n}\n\n/**\n * Deep-copy a value into something JSON can carry.\n *\n * `target` keys are special-cased into refs. Other functions vanish, cycles are\n * cut, and everything else is copied structurally.\n */\n/** Shared walk state: the memo, plus a count of depth-cap hits. */\ninterface WalkState {\n    memo: WeakMap<object, unknown>;\n    /**\n     * How many times the walk has truncated a subtree — by hitting the depth\n     * cap, or by cutting a cycle.\n     *\n     * Either kind of truncation makes a result valid only at the *position* it\n     * was produced at, so caching it and serving it elsewhere silently drops\n     * content that would have been included. Comparing this counter before and\n     * after a node's children tells us whether its result is position-\n     * independent and therefore safe to memoize.\n     *\n     * The cycle case is the subtle one: with `a.b = b` and `b.a = a`, serializing\n     * `{ first: b, second: a }` visits `a` beneath `b` — where the cycle back to\n     * `b` is cut — and would then reuse that truncated `a` for `second`, where\n     * nothing needed cutting.\n     */\n    truncations: number;\n}\n\nfunction toSerializable(\n    value: unknown,\n    seen: WeakSet<object>,\n    depth: number,\n    state: WalkState,\n    key?: string\n): unknown {\n    if (depth > MAX_DEPTH) {\n        state.truncations++;\n        return undefined;\n    }\n\n    if (typeof value === \"function\") {\n        // Only a relation target carries information a client needs. Calling it\n        // is safe here — this runs on the server, where the target module is\n        // already loaded — and a throwing target simply yields no reference,\n        // which degrades the generated FK type rather than failing the request.\n        if (key === \"target\") {\n            try {\n                const resolved = unwrapTarget((value as () => unknown)());\n                const ref = refFor(resolved);\n                return ref ? { __collectionRef: ref } : undefined;\n            } catch {\n                return undefined;\n            }\n        }\n        return undefined;\n    }\n\n    if (value === null || typeof value !== \"object\") {\n        return value;\n    }\n\n    if (value instanceof Date) return value.toISOString();\n    if (value instanceof RegExp) return value.source;\n\n    if (seen.has(value as object)) {\n        state.truncations++;\n        return undefined;\n    }\n\n    // A shared (non-cyclic) subgraph is reachable by many paths, and `seen` is a\n    // *path* set — released in the `finally` below so a node referenced twice in\n    // different branches is emitted twice rather than dropped as a false cycle.\n    // Without memoization that makes the walk exponential in depth: a diamond\n    // graph 20 levels deep took ~400ms, and each further level doubled it. The\n    // result is a plain data tree, so handing back the same converted object for\n    // a repeat visit is indistinguishable after JSON.stringify.\n    const cached = state.memo.get(value as object);\n    if (cached !== undefined) return cached;\n\n    seen.add(value as object);\n    const truncationsBefore = state.truncations;\n    const memoize = (result: unknown): unknown => {\n        // Only cache a result that nothing was cut from.\n        if (result !== undefined && state.truncations === truncationsBefore) {\n            state.memo.set(value as object, result);\n        }\n        return result;\n    };\n\n    try {\n        if (Array.isArray(value)) {\n            const items = value\n                .map(item => toSerializable(item, seen, depth + 1, state))\n                .filter(item => item !== undefined);\n            // A container that had content, none of which can be represented, is\n            // itself unrepresentable — see the note below.\n            return memoize(value.length > 0 && items.length === 0 ? undefined : items);\n        }\n\n        // A React element or component reference has no meaning to a client and\n        // will not survive JSON anyway.\n        if (\"$$typeof\" in (value as Record<string, unknown>)) return undefined;\n\n        const entries = Object.entries(value as Record<string, unknown>);\n        const out: Record<string, unknown> = {};\n        for (const [k, v] of entries) {\n            const converted = toSerializable(v, seen, depth + 1, state, k);\n            if (converted !== undefined) out[k] = converted;\n        }\n\n        // Drop a container whose entire content was dropped.\n        //\n        // `callbacks: { beforeSave() {…} }` would otherwise serialize to\n        // `callbacks: {}` — an empty husk that carries no information but is not\n        // *nothing*, so it lands in the payload and, worse, in the schema hash.\n        // Editing a hook would then change every client's schema version and\n        // report perfectly current SDKs as stale.\n        //\n        // A container that started empty stays empty: `properties: {}` is a\n        // deliberate statement, not a casualty.\n        if (entries.length > 0 && Object.keys(out).length === 0) return undefined;\n\n        return memoize(out);\n    } finally {\n        // Released so a collection referenced twice in different branches is\n        // emitted twice rather than being dropped as a false cycle.\n        seen.delete(value as object);\n    }\n}\n\n/**\n * Serialize collections for transport over the contract endpoint.\n *\n * Sorted by slug so the output — and therefore the schema hash computed from it\n * — does not depend on filesystem ordering.\n */\nexport function serializeCollections(collections: CollectionConfig[]): unknown[] {\n    return [...collections]\n        .sort((a, b) => String(a.slug ?? \"\").localeCompare(String(b.slug ?? \"\")))\n        .map(collection => toSerializable(withoutAdminBlock(collection), new WeakSet(), 0, {\n            memo: new WeakMap(),\n            truncations: 0\n        }))\n        .filter((c): c is Record<string, unknown> => c !== undefined);\n}\n\n/**\n * Drop the admin block before the walk.\n *\n * Nothing downstream of serialization is an admin panel. The contract endpoint\n * feeds remote SDK generation, and `rebase build` writes the result into a bundle\n * manifest that only the backend runtime reads. The block would survive the walk\n * as a husk anyway — its React elements and component functions are dropped\n * individually — and that husk has two costs worth avoiding: it puts every custom\n * component's *file path* on an endpoint whose job is to describe data shapes, and\n * it grows a payload that is fetched and cached per project.\n *\n * Removing it here rather than at each call site means one chokepoint, so a future\n * consumer of `serializeCollections` cannot forget.\n *\n * Child collections carry their own block, so this recurses — stripping only the\n * top level was the mistake `stripNonClientFields` in the contract routes already\n * had to fix once for security rules.\n */\nfunction withoutAdminBlock(collection: CollectionConfig): CollectionConfig {\n    const { admin: _admin, ...rest } = collection as CollectionConfig & Record<string, unknown>;\n    const nested = rest as Record<string, unknown>;\n    if (Array.isArray(nested.subcollections)) {\n        nested.subcollections = nested.subcollections.map(\n            (child) => withoutAdminBlock(child as CollectionConfig)\n        );\n    }\n    return rest as CollectionConfig;\n}\n\n/**\n * Rebuild collections received from a contract endpoint.\n *\n * Relation refs become real thunks resolving through the returned set, so\n * downstream consumers — the SDK generator above all — see exactly the shape\n * they would have seen had the collections been imported from source.\n *\n * A ref naming a collection that is not in the payload resolves to `undefined`\n * rather than throwing: the generator already tolerates an unresolvable target\n * by falling back to a permissive key type, and a partial contract should still\n * produce a usable SDK.\n */\nexport function deserializeCollections(payload: unknown[]): CollectionConfig[] {\n    const collections = payload\n        .filter((c): c is Record<string, unknown> => typeof c === \"object\" && c !== null)\n        .map(c => ({ ...c })) as unknown as CollectionConfig[];\n\n    const bySlug = new Map<string, CollectionConfig>();\n    for (const collection of collections) {\n        const ref = refFor(collection);\n        if (ref) bySlug.set(ref, collection);\n    }\n\n    const rehydrate = (value: unknown, depth: number): void => {\n        if (depth > MAX_DEPTH || !value || typeof value !== \"object\") return;\n\n        if (Array.isArray(value)) {\n            for (const item of value) rehydrate(item, depth + 1);\n            return;\n        }\n\n        const record = value as Record<string, unknown>;\n        for (const [key, child] of Object.entries(record)) {\n            if (key === \"target\" && isSerializedCollectionRef(child)) {\n                const slug = child.__collectionRef;\n                record.target = () => bySlug.get(slug);\n                continue;\n            }\n            rehydrate(child, depth + 1);\n        }\n    };\n\n    for (const collection of collections) rehydrate(collection, 0);\n    return collections;\n}\n","import type { CollectionConfig } from \"./collections\";\nimport { serializeCollections } from \"./collection_contract\";\n\n/**\n * The schema version stamp.\n *\n * One function, used in three places that must agree or the whole drift-detection\n * story is noise: `rebase build` writes it into a bundle manifest, the runtime\n * serves it from the contract endpoint, and a generated SDK records the value it\n * was built from. If any two of those computed it differently, every client would\n * look permanently out of date.\n *\n * It covers **collections only** — the client's contract is the shape of the\n * data, so editing a hook or a server function must not invalidate every SDK in\n * every repository. That is a deliberate narrowing, not an oversight.\n */\n\n/** Stable stringify: object keys sorted at every level, so key order cannot alter the hash. */\nfunction canonicalize(value: unknown): string {\n    if (value === null || typeof value !== \"object\") {\n        return JSON.stringify(value) ?? \"null\";\n    }\n    if (Array.isArray(value)) {\n        return `[${value.map(canonicalize).join(\",\")}]`;\n    }\n    const entries = Object.entries(value as Record<string, unknown>)\n        .filter(([, v]) => v !== undefined)\n        .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));\n    return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${canonicalize(v)}`).join(\",\")}}`;\n}\n\n/**\n * Reduce a collection to the parts a generated client is actually built from.\n *\n * The version answers one question — \"is this SDK stale?\" — so it must change\n * exactly when the generated types could change, and never otherwise. Hashing a\n * whole collection fails both halves of that:\n *\n * - Security rules, callbacks, icons, groups and UI settings do not appear in a\n *   generated client, so including them reports perfectly current SDKs as stale.\n * - Worse, they are not stable *inputs*. The runtime applies default security\n *   rules when it loads collections, so the same source hashed before and after\n *   loading produced two different answers — a build-time stamp that could never\n *   match the server that served it.\n *\n * Codegen reads the slug (for the `Database` key and type names), the properties,\n * and the relations. That is the projection.\n */\nfunction projectForCodegen(collection: CollectionConfig): Record<string, unknown> {\n    const source = collection as CollectionConfig & {\n        relations?: unknown;\n        subcollections?: CollectionConfig[];\n        path?: string;\n        engine?: unknown;\n        dataSource?: unknown;\n    };\n\n    return {\n        slug: collection.slug ?? source.path,\n        properties: collection.properties,\n        relations: source.relations,\n        // The engine decides whether relations are resolved at all: codegen asks\n        // `getDataSourceCapabilities(collection.engine).supportsRelations`, and an\n        // engine that answers no drops every foreign-key column from the\n        // generated Row/Insert/Update types. Moving a collection to such an\n        // engine is a real change to the generated types, so it has to move the\n        // version. `dataSource` is what resolves to `engine`, so it counts too.\n        engine: source.engine,\n        dataSource: source.dataSource,\n        subcollections: source.subcollections?.map(projectForCodegen)\n    };\n}\n\n/**\n * Compute the canonical string a schema version hashes.\n *\n * Exposed separately so the hashing itself can differ by environment: Node has\n * `crypto`, and callers without it can still compare canonical forms directly.\n */\nexport function canonicalSchemaPayload(collections: CollectionConfig[]): string {\n    const projected = serializeCollections(collections)\n        .map(collection => projectForCodegen(collection as CollectionConfig));\n    return canonicalize(projected);\n}\n\n/**\n * A short, non-cryptographic digest of the canonical payload.\n *\n * FNV-1a style, 64 bits, as two 32-bit halves. This is an identity, not a\n * security boundary: nothing trusts a schema version to prove anything, it only\n * answers \"is this the same schema as before\". A hand-rolled hash keeps this\n * module free of `node:crypto`, so the identical function runs in the browser,\n * in the CLI, and in the runtime — which is the property that actually matters.\n */\nexport function computeSchemaVersion(collections: CollectionConfig[]): string {\n    const payload = canonicalSchemaPayload(collections);\n\n    let h1 = 0x811c9dc5;\n    let h2 = 0x01000193;\n\n    for (let i = 0; i < payload.length; i++) {\n        const code = payload.charCodeAt(i);\n        h1 ^= code;\n        // Multiply by the FNV prime using shifts to stay in 32-bit integer math.\n        h1 = (h1 + ((h1 << 1) + (h1 << 4) + (h1 << 7) + (h1 << 8) + (h1 << 24))) >>> 0;\n        h2 ^= code + i;\n        h2 = (h2 + ((h2 << 1) + (h2 << 5) + (h2 << 9) + (h2 << 15) + (h2 << 24))) >>> 0;\n    }\n\n    const hex = (n: number): string => n.toString(16).padStart(8, \"0\");\n    return `v1:${hex(h1)}${hex(h2)}`;\n}\n","import { Hono } from \"hono\";\nimport {\n    RUNTIME_CONTRACT_VERSION,\n    SCHEMA_VERSION_HEADER,\n    computeSchemaVersion,\n    serializeCollections,\n    type CollectionConfig,\n    type RebaseProjectContract\n} from \"@rebasepro/types\";\nimport type { HonoEnv } from \"./types\";\nimport { logger } from \"../utils/logger\";\n\n/**\n * The project contract endpoint.\n *\n * This is what makes a repository able to build against a project it does not\n * contain. Without it, a typed client can only be generated from local\n * collection *source*, which means every frontend must live in the same\n * repository as the backend. Serving the contract turns that around: an app\n * asks the project what its shape is, so a web app, a second web app and a\n * mobile app can each live wherever they like and none of them needs to know\n * about the others.\n *\n * Admin-gated. Collection definitions describe every table, column and relation\n * in the project, including ones no security rule would ever expose — that is a\n * map of the database, not public API documentation.\n */\n\nexport interface ContractRoutesConfig {\n    collectionRegistry: { getRawCollections(): CollectionConfig[] };\n    /**\n     * The schema version recorded at build time.\n     *\n     * Preferred over recomputing, so that what a client is told matches exactly\n     * what the bundle claims. It is recomputed only when a bundle did not record\n     * one — a `baas`-mode project derives its collections from the live database\n     * at boot, so there was nothing to hash when it was built.\n     */\n    schemaVersion?: string;\n    /** Runtime package version, surfaced so a client can report what it built against. */\n    runtimeVersion?: string;\n}\n\n/**\n * Strip everything a client does not need from a serialized collection.\n *\n * The generator reads the slug, the properties and the relations. It never reads\n * a security rule — but `securityRules` carries the raw SQL of every RLS\n * predicate guarding the project, which is a description of the authorization\n * model rather than of the data shape. Publishing it to anyone who can generate\n * an SDK gives away more than the endpoint is for, so it is removed here rather\n * than trusted not to matter.\n */\nfunction stripNonClientFields(collection: unknown): unknown {\n    if (!collection || typeof collection !== \"object\") return collection;\n    const {\n        securityRules: _securityRules,\n        callbacks: _callbacks,\n        ...rest\n    } = collection as Record<string, unknown>;\n\n    // Subcollections are collections, and carry their own rules. Stripping only\n    // the top level published every nested policy — the leak this exists to\n    // prevent, just one level down.\n    if (Array.isArray(rest.subcollections)) {\n        rest.subcollections = rest.subcollections.map(stripNonClientFields);\n    }\n\n    return rest;\n}\n\nexport function createContractRoutes(config: ContractRoutesConfig): Hono<HonoEnv> {\n    const router = new Hono<HonoEnv>();\n\n    // Computing a version walks and canonicalizes every collection, and\n    // `/schema-version` is deliberately unauthenticated and meant to be polled.\n    // Recomputing per request would make a CI convenience into a CPU\n    // amplification anyone could aim at the server. Collections do not change\n    // after boot, so once is enough.\n    let cachedVersion: string | undefined;\n    const schemaVersionOf = (collections: CollectionConfig[]): string => {\n        if (config.schemaVersion) return config.schemaVersion;\n        if (cachedVersion === undefined) cachedVersion = computeSchemaVersion(collections);\n        return cachedVersion;\n    };\n\n    router.get(\"/contract\", (c) => {\n        const collections = config.collectionRegistry.getRawCollections();\n        const serialized = serializeCollections(collections).map(stripNonClientFields);\n\n        // In `baas` mode the collections are whatever introspection found at\n        // boot, so the version has to be computed from them rather than taken\n        // from a build that never saw them.\n        const schemaVersion = schemaVersionOf(collections);\n\n        const contract: RebaseProjectContract = {\n            schemaVersion,\n            runtime: {\n                version: config.runtimeVersion ?? \"unknown\",\n                contract: RUNTIME_CONTRACT_VERSION\n            },\n            collections: serialized,\n            collectionSlugs: collections\n                .map(collection => collection.slug)\n                .filter((slug): slug is string => Boolean(slug))\n                .sort(),\n            generatedAt: new Date().toISOString()\n        };\n\n        c.header(SCHEMA_VERSION_HEADER, schemaVersion);\n        return c.json(contract);\n    });\n\n    /**\n     * Cheap drift check.\n     *\n     * Deliberately unauthenticated and deliberately tiny: it returns a version\n     * string and nothing else. A CI job that only wants to know whether its\n     * generated SDK is stale should not need admin credentials, and a version\n     * stamp reveals nothing about the schema it stands for.\n     */\n    router.get(\"/schema-version\", (c) => {\n        const schemaVersion = schemaVersionOf(config.collectionRegistry.getRawCollections());\n        c.header(SCHEMA_VERSION_HEADER, schemaVersion);\n        return c.json({ schemaVersion, });\n    });\n\n    logger.debug(\"Contract routes mounted\");\n    return router;\n}\n"],"mappings":";;;;;;;;;AAoeA,IAAa,wBAAwB;;;;ACpcrC,IAAM,YAAY;;;;;;;;AASlB,SAAS,aAAa,OAA8C;CAChE,IAAI,CAAC,SAAS,OAAO,UAAU,UAAU,OAAO,KAAA;CAChD,MAAM,YAAY;CAClB,IAAI,UAAU,WAAW,UAAU,YAAY;EAC3C,MAAM,QAAQ,UAAU;EACxB,IAAI,SAAS,OAAO,UAAU,UAAU,OAAO;CACnD;CACA,IAAI,UAAU,YAAY,OAAO;AAErC;;AAGA,SAAS,OAAO,YAA8D;CAC1E,IAAI,CAAC,YAAY,OAAO,KAAA;CACxB,MAAM,WAAW;CACjB,OAAO,WAAW,QAAQ,SAAS,QAAQ,WAAW;AAC1D;AA6BA,SAAS,eACL,OACA,MACA,OACA,OACA,KACO;CACP,IAAI,QAAQ,WAAW;EACnB,MAAM;EACN;CACJ;CAEA,IAAI,OAAO,UAAU,YAAY;EAK7B,IAAI,QAAQ,UACR,IAAI;GAEA,MAAM,MAAM,OADK,aAAc,MAAwB,CACpC,CAAQ;GAC3B,OAAO,MAAM,EAAE,iBAAiB,IAAI,IAAI,KAAA;EAC5C,QAAQ;GACJ;EACJ;EAEJ;CACJ;CAEA,IAAI,UAAU,QAAQ,OAAO,UAAU,UACnC,OAAO;CAGX,IAAI,iBAAiB,MAAM,OAAO,MAAM,YAAY;CACpD,IAAI,iBAAiB,QAAQ,OAAO,MAAM;CAE1C,IAAI,KAAK,IAAI,KAAe,GAAG;EAC3B,MAAM;EACN;CACJ;CASA,MAAM,SAAS,MAAM,KAAK,IAAI,KAAe;CAC7C,IAAI,WAAW,KAAA,GAAW,OAAO;CAEjC,KAAK,IAAI,KAAe;CACxB,MAAM,oBAAoB,MAAM;CAChC,MAAM,WAAW,WAA6B;EAE1C,IAAI,WAAW,KAAA,KAAa,MAAM,gBAAgB,mBAC9C,MAAM,KAAK,IAAI,OAAiB,MAAM;EAE1C,OAAO;CACX;CAEA,IAAI;EACA,IAAI,MAAM,QAAQ,KAAK,GAAG;GACtB,MAAM,QAAQ,MACT,KAAI,SAAQ,eAAe,MAAM,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CACzD,QAAO,SAAQ,SAAS,KAAA,CAAS;GAGtC,OAAO,QAAQ,MAAM,SAAS,KAAK,MAAM,WAAW,IAAI,KAAA,IAAY,KAAK;EAC7E;EAIA,IAAI,cAAe,OAAmC,OAAO,KAAA;EAE7D,MAAM,UAAU,OAAO,QAAQ,KAAgC;EAC/D,MAAM,MAA+B,CAAC;EACtC,KAAK,MAAM,CAAC,GAAG,MAAM,SAAS;GAC1B,MAAM,YAAY,eAAe,GAAG,MAAM,QAAQ,GAAG,OAAO,CAAC;GAC7D,IAAI,cAAc,KAAA,GAAW,IAAI,KAAK;EAC1C;EAYA,IAAI,QAAQ,SAAS,KAAK,OAAO,KAAK,GAAG,CAAC,CAAC,WAAW,GAAG,OAAO,KAAA;EAEhE,OAAO,QAAQ,GAAG;CACtB,UAAU;EAGN,KAAK,OAAO,KAAe;CAC/B;AACJ;;;;;;;AAQA,SAAgB,qBAAqB,aAA4C;CAC7E,OAAO,CAAC,GAAG,WAAW,CAAC,CAClB,MAAM,GAAG,MAAM,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,cAAc,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CACxE,KAAI,eAAc,eAAe,kBAAkB,UAAU,mBAAG,IAAI,QAAQ,GAAG,GAAG;EAC/E,sBAAM,IAAI,QAAQ;EAClB,aAAa;CACjB,CAAC,CAAC,CAAC,CACF,QAAQ,MAAoC,MAAM,KAAA,CAAS;AACpE;;;;;;;;;;;;;;;;;;;AAoBA,SAAS,kBAAkB,YAAgD;CACvE,MAAM,EAAE,OAAO,QAAQ,GAAG,SAAS;CACnC,MAAM,SAAS;CACf,IAAI,MAAM,QAAQ,OAAO,cAAc,GACnC,OAAO,iBAAiB,OAAO,eAAe,KACzC,UAAU,kBAAkB,KAAyB,CAC1D;CAEJ,OAAO;AACX;;;;;;;;;;;;;;;;;ACrNA,SAAS,aAAa,OAAwB;CAC1C,IAAI,UAAU,QAAQ,OAAO,UAAU,UACnC,OAAO,KAAK,UAAU,KAAK,KAAK;CAEpC,IAAI,MAAM,QAAQ,KAAK,GACnB,OAAO,IAAI,MAAM,IAAI,YAAY,CAAC,CAAC,KAAK,GAAG,EAAE;CAKjD,OAAO,IAHS,OAAO,QAAQ,KAAgC,CAAC,CAC3D,QAAQ,GAAG,OAAO,MAAM,KAAA,CAAS,CAAC,CAClC,MAAM,CAAC,IAAI,CAAC,OAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CACvC,CAAA,CAAQ,KAAK,CAAC,GAAG,OAAO,GAAG,KAAK,UAAU,CAAC,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE;AAC5F;;;;;;;;;;;;;;;;;;AAmBA,SAAS,kBAAkB,YAAuD;CAC9E,MAAM,SAAS;CAQf,OAAO;EACH,MAAM,WAAW,QAAQ,OAAO;EAChC,YAAY,WAAW;EACvB,WAAW,OAAO;EAOlB,QAAQ,OAAO;EACf,YAAY,OAAO;EACnB,gBAAgB,OAAO,gBAAgB,IAAI,iBAAiB;CAChE;AACJ;;;;;;;AAQA,SAAgB,uBAAuB,aAAyC;CAG5E,OAAO,aAFW,qBAAqB,WAAW,CAAC,CAC9C,KAAI,eAAc,kBAAkB,UAA8B,CACnD,CAAS;AACjC;;;;;;;;;;AAWA,SAAgB,qBAAqB,aAAyC;CAC1E,MAAM,UAAU,uBAAuB,WAAW;CAElD,IAAI,KAAK;CACT,IAAI,KAAK;CAET,KAAK,IAAI,IAAI,GAAG,IAAI,QAAQ,QAAQ,KAAK;EACrC,MAAM,OAAO,QAAQ,WAAW,CAAC;EACjC,MAAM;EAEN,KAAM,OAAO,MAAM,MAAM,MAAM,MAAM,MAAM,MAAM,MAAM,MAAM,MAAM,SAAU;EAC7E,MAAM,OAAO;EACb,KAAM,OAAO,MAAM,MAAM,MAAM,MAAM,MAAM,MAAM,MAAM,OAAO,MAAM,SAAU;CAClF;CAEA,MAAM,OAAO,MAAsB,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG;CACjE,OAAO,MAAM,IAAI,EAAE,IAAI,IAAI,EAAE;AACjC;;;;;;;;;;;;;;AC1DA,SAAS,qBAAqB,YAA8B;CACxD,IAAI,CAAC,cAAc,OAAO,eAAe,UAAU,OAAO;CAC1D,MAAM,EACF,eAAe,gBACf,WAAW,YACX,GAAG,SACH;CAKJ,IAAI,MAAM,QAAQ,KAAK,cAAc,GACjC,KAAK,iBAAiB,KAAK,eAAe,IAAI,oBAAoB;CAGtE,OAAO;AACX;AAEA,SAAgB,qBAAqB,QAA6C;CAC9E,MAAM,SAAS,IAAI,KAAc;CAOjC,IAAI;CACJ,MAAM,mBAAmB,gBAA4C;EACjE,IAAI,OAAO,eAAe,OAAO,OAAO;EACxC,IAAI,kBAAkB,KAAA,GAAW,gBAAgB,qBAAqB,WAAW;EACjF,OAAO;CACX;CAEA,OAAO,IAAI,cAAc,MAAM;EAC3B,MAAM,cAAc,OAAO,mBAAmB,kBAAkB;EAChE,MAAM,aAAa,qBAAqB,WAAW,CAAC,CAAC,IAAI,oBAAoB;EAK7E,MAAM,gBAAgB,gBAAgB,WAAW;EAEjD,MAAM,WAAkC;GACpC;GACA,SAAS;IACL,SAAS,OAAO,kBAAkB;IAClC,UAAA;GACJ;GACA,aAAa;GACb,iBAAiB,YACZ,KAAI,eAAc,WAAW,IAAI,CAAC,CAClC,QAAQ,SAAyB,QAAQ,IAAI,CAAC,CAAC,CAC/C,KAAK;GACV,8BAAa,IAAI,KAAK,EAAA,CAAE,YAAY;EACxC;EAEA,EAAE,OAAO,uBAAuB,aAAa;EAC7C,OAAO,EAAE,KAAK,QAAQ;CAC1B,CAAC;;;;;;;;;CAUD,OAAO,IAAI,oBAAoB,MAAM;EACjC,MAAM,gBAAgB,gBAAgB,OAAO,mBAAmB,kBAAkB,CAAC;EACnF,EAAE,OAAO,uBAAuB,aAAa;EAC7C,OAAO,EAAE,KAAK,EAAE,cAAe,CAAC;CACpC,CAAC;CAED,OAAO,MAAM,yBAAyB;CACtC,OAAO;AACX"}

package/dist/errors-EBYiaJ2E.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"errors-EBYiaJ2E.js","names":[],"sources":["../src/api/errors.ts"],"sourcesContent":["import type { ErrorHandler } from \"hono\";\nimport type { ContentfulStatusCode } from \"hono/utils/http-status\";\nimport type { HonoEnv } from \"./types\";\nimport { logger } from \"../utils/logger\";\n\n/** Tracks whether we've already shown the doctor hint (once per process). */\nlet _schemaDriftHinted = false;\n\n/** Shape of Postgres / network errors with diagnostic codes */\ninterface PgLikeError {\n    code?: string;\n    address?: string;\n    port?: number;\n    message?: string;\n    table?: string;\n    column?: string;\n    schema?: string;\n    detail?: string;\n    hint?: string;\n    constraint?: string;\n}\n\n/** 5-character SQLSTATE, e.g. `42501`, `23505`. */\nconst SQLSTATE_RE = /^[0-9A-Z]{5}$/;\n\n/**\n * Walk the cause chain for the underlying database error, identified by a\n * 5-char SQLSTATE `code`. Drizzle wraps the pg error in `.cause`, and route\n * code sometimes wraps drizzle again, so the real error may sit several\n * levels down.\n */\nfunction extractDbError(error: unknown, depth = 0): PgLikeError | null {\n    if (!error || typeof error !== \"object\" || depth > 8) return null;\n    const e = error as PgLikeError & { cause?: unknown };\n    if (typeof e.code === \"string\" && SQLSTATE_RE.test(e.code)) return e;\n    if (e.cause && typeof e.cause === \"object\") return extractDbError(e.cause, depth + 1);\n    return null;\n}\n\n/**\n * Extract the missing table or column name from a PG error.\n * PG 42P01 messages look like: 'relation \"my_table\" does not exist'\n * PG 42703 messages look like: 'column \"my_col\" does not exist' or 'column my_table.my_col does not exist'\n */\nfunction extractMissingIdentifier(pgMessage?: string): string | null {\n    if (!pgMessage) return null;\n    // Match quoted identifier: relation \"xxx\" / column \"xxx\"\n    const quoted = pgMessage.match(/(?:relation|column|table)\\s+\"([^\"]+)\"/i);\n    if (quoted) return quoted[1];\n    // Match unquoted: column table.col does not exist\n    const unquoted = pgMessage.match(/(?:relation|column|table)\\s+([\\w.]+)\\s+does not exist/i);\n    if (unquoted) return unquoted[1];\n    return null;\n}\n\n/**\n * Standardized API error class.\n * Throw this from any route handler — the errorHandler middleware\n * will format it into `{ error: { message, code, details? } }`.\n */\nexport class ApiError extends Error {\n    public readonly statusCode: number;\n    public readonly code: string;\n    public readonly details?: unknown;\n    /**\n     * Whether this outcome is a routine part of normal operation rather than\n     * something an operator should look at. Expected errors log at debug; every\n     * other operational error logs at warn.\n     *\n     * The motivating case is `POST /auth/refresh` with no session: clients\n     * refresh on page load before they know whether one exists, so every\n     * anonymous page view is a 401 — correct, and not worth a warning line.\n     *\n     * The other class is a caller-caused 4xx that never reached the database: a\n     * mistyped filter operator, sort direction or limit, a request for a\n     * collection that does not exist. Nothing on this server is wrong, and the\n     * response body has already told the caller what to fix — while one client\n     * holding a stale name would otherwise write a warning per request, forever,\n     * until the level means nothing. See `api/rest/query-parser.ts`.\n     *\n     * What stays at warn is anything that says something about the *server*:\n     * a schema that has drifted from the code, a permission the database\n     * refused, a dependency that failed. Those are 4xx too, and they are still\n     * incidents.\n     */\n    public readonly expected: boolean;\n\n    constructor(statusCode: number, code: string, message: string, details?: unknown, expected = false) {\n        super(message);\n        this.name = \"ApiError\";\n        this.statusCode = statusCode;\n        this.code = code;\n        this.details = details;\n        this.expected = expected;\n    }\n\n    // ── Factory methods ──────────────────────────────────────────────\n\n    static badRequest(message: string, code = \"BAD_REQUEST\", details?: unknown): ApiError {\n        return new ApiError(400, code, message, details);\n    }\n\n    static unauthorized(message: string, code = \"UNAUTHORIZED\"): ApiError {\n        return new ApiError(401, code, message);\n    }\n\n    /**\n     * A 401 that is a normal outcome, not an incident — logged at debug.\n     * See {@link ApiError.expected}.\n     */\n    static unauthenticated(message: string, code = \"UNAUTHORIZED\"): ApiError {\n        return new ApiError(401, code, message, undefined, true);\n    }\n\n    static forbidden(message: string, code = \"FORBIDDEN\"): ApiError {\n        return new ApiError(403, code, message);\n    }\n\n    static notFound(message: string, code = \"NOT_FOUND\"): ApiError {\n        return new ApiError(404, code, message);\n    }\n\n    static conflict(message: string, code = \"CONFLICT\"): ApiError {\n        return new ApiError(409, code, message);\n    }\n\n    static internal(message: string, code = \"INTERNAL_ERROR\"): ApiError {\n        return new ApiError(500, code, message);\n    }\n\n    static serviceUnavailable(message: string, code = \"SERVICE_UNAVAILABLE\"): ApiError {\n        return new ApiError(503, code, message);\n    }\n}\n\n/**\n * Canonical error response shape:\n * `{ error: { message: string, code: string, details?: unknown } }`\n */\nexport interface ErrorResponse {\n    error: {\n        message: string;\n        code: string;\n        details?: unknown;\n        /** Request correlation ID for tracing (echoes X-Request-ID). */\n        requestId?: string;\n    };\n}\n\n/**\n * General shape of errors that flow through the API error handler.\n * Extends Error with optional HTTP status, error code, and details.\n */\nexport interface RebaseApiError extends Error {\n    statusCode?: number;\n    code?: string;\n    details?: unknown;\n}\n\n// `isRebaseApiError` was here. It read `return error instanceof Error`, so it\n// answered yes to every error while being named and used as though it\n// discriminated — the create and update handlers guarded a \"classify this as\n// BAD_REQUEST\" branch on it, and an unreachable database was therefore reported\n// to callers as a bad request. Deleted rather than repaired: the shape it\n// claimed to test is not decidable from an `Error`, and the layer that does\n// know — the driver, which holds the SQLSTATE — raises a real `ApiError`.\n\n/**\n * Hono error-handling middleware (`app.onError`).\n * Converts any error into the canonical `{ error: { message, code } }` shape.\n */\nexport const errorHandler: ErrorHandler<HonoEnv> = (err, c) => {\n    // Typecast custom error properties\n    const error: RebaseApiError = err;\n    const reqId = typeof c.get === \"function\" ? c.get(\"requestId\") : undefined;\n\n    if (error instanceof ApiError || error.name === \"ApiError\") {\n        // Operational errors — log at warn, unless the error declares itself a\n        // routine outcome (see ApiError.expected), which would otherwise put a\n        // warning in the log for every anonymous page view.\n        const expected = error instanceof ApiError && error.expected;\n        const line = `[API] ${c.req.method} ${c.req.path} → ${error.statusCode} ${error.code}: ${error.message}` +\n            (reqId ? ` [${reqId}]` : \"\");\n        if (expected) {\n            logger.debug(line);\n        } else {\n            logger.warn(`⚠️ ${line}`);\n        }\n        return c.json({\n            error: {\n                message: error.message,\n                code: error.code || \"INTERNAL_ERROR\",\n                ...(error.details !== undefined && { details: error.details }),\n                ...(reqId && { requestId: reqId })\n            }\n        } satisfies ErrorResponse, (error.statusCode || 500) as ContentfulStatusCode);\n    }\n\n    const statusCode = error.statusCode || codeToStatus(error.code) || 500;\n    let code = error.code || \"INTERNAL_ERROR\";\n\n    // Handle DB connection and specific system errors for better logging\n    let logMessage = error.message;\n\n    // Resolve the actual cause — Node's net module wraps dual-stack failures\n    // in an AggregateError whose inner errors carry the real address/port.\n    let resolvedCause: PgLikeError | undefined;\n    if (error.cause && typeof error.cause === \"object\" && error.cause !== null && \"code\" in error.cause) {\n        const cause = error.cause as PgLikeError & { errors?: PgLikeError[] };\n        if (cause.code === \"ECONNREFUSED\" && !cause.address && Array.isArray(cause.errors)) {\n            // AggregateError — pick the first inner error that has address info\n            resolvedCause = cause.errors.find(e => e.address) || cause;\n        } else {\n            resolvedCause = cause;\n        }\n    }\n\n    // The real database error may sit several levels down the cause chain.\n    // Losing it turns a precise failure (e.g. an RLS denial) into an opaque\n    // \"Failed query: …\" 500 that is undiagnosable without direct DB access.\n    const dbError = extractDbError(error);\n\n    if (resolvedCause && (resolvedCause.code === \"ENETUNREACH\" || resolvedCause.code === \"ECONNREFUSED\")) {\n        const cause = resolvedCause;\n        if (cause.code === \"ENETUNREACH\") {\n            logMessage = `Network unreachable. Cannot connect to database at ${cause.address}:${cause.port}.`;\n        } else {\n            logMessage = `Connection refused to database at ${cause.address}:${cause.port}. Is PostgreSQL running?`;\n        }\n    } else if (\"code\" in error && error.code === \"ENETUNREACH\") {\n         const netErr = error as PgLikeError;\n         logMessage = `Network unreachable. Cannot connect to service at ${netErr.address}:${netErr.port}.`;\n    } else if (dbError && (dbError.code === \"42703\" || dbError.code === \"42P01\")) {\n        code = \"SCHEMA_DRIFT\";\n        const issue = dbError.code === \"42703\" ? \"column\" : \"table\";\n        const identifier = dbError.table || dbError.column || extractMissingIdentifier(dbError.message) || \"unknown\";\n        logMessage = `Schema drift: ${issue} \"${identifier}\" does not exist in the database. Run \\`pnpm db:push\\` to sync your schema, or \\`pnpm db:migrate\\` to apply pending migrations.`;\n    } else if (dbError) {\n        const parts = [`[PG ${dbError.code}] ${dbError.message}`];\n        if (dbError.detail) parts.push(`Detail: ${dbError.detail}`);\n        if (dbError.hint) parts.push(`Hint: ${dbError.hint}`);\n        if (dbError.table) parts.push(`Table: ${dbError.table}`);\n        if (dbError.column) parts.push(`Column: ${dbError.column}`);\n        if (dbError.constraint) parts.push(`Constraint: ${dbError.constraint}`);\n        if (dbError.code === \"42501\") {\n            code = \"DB_PERMISSION_DENIED\";\n            parts.push(\n                \"The database rejected the statement for lack of privilege — usually a row-level \" +\n                `security policy${dbError.table ? ` on \"${dbError.table}\"` : \"\"} denying this role, ` +\n                \"or a stale FORCE ROW LEVEL SECURITY flag binding the owner connection.\"\n            );\n        }\n        logMessage = parts.join(\". \");\n    }\n\n    const isDbSchemaMismatch = code === \"SCHEMA_DRIFT\";\n\n    if (isDbSchemaMismatch) {\n        // Database schema mismatch is logged as a warning instead of a fatal error\n        logger.warn(\n            `⚠️ [API] ${c.req.method} ${c.req.path} → ${statusCode} ${code}: ${logMessage}` +\n            (reqId ? ` [${reqId}]` : \"\")\n        );\n        // In dev mode, show a one-time hint to run `rebase doctor`\n        if (!_schemaDriftHinted && process.env.NODE_ENV !== \"production\") {\n            _schemaDriftHinted = true;\n            logger.warn([\n                \"\",\n                \"┌──────────────────────────────────────────────────────────────┐\",\n                \"│  💡 TIP: Run `rebase doctor` for full schema diagnostics    │\",\n                \"│                                                             │\",\n                \"│  Quick fixes (local dev, against DATABASE_URL):             │\",\n                \"│    pnpm db:push      sync schema to database (dev)          │\",\n                \"│    pnpm db:migrate   generate + apply migration (prod)      │\",\n                \"│    rebase doctor     full 3-way drift report                │\",\n                \"│                                                             │\",\n                \"│  Managed cloud: the runtime applies schema + RLS at boot    │\",\n                \"│  (REBASE_MIGRATE_ON_BOOT); redeploy rather than db:push,    │\",\n                \"│  which cannot reach the tenant database.                    │\",\n                \"└──────────────────────────────────────────────────────────────┘\",\n                \"\"\n            ].join(\"\\n\"));\n        }\n    } else {\n        // Unexpected errors — log at error level\n        logger.error(\n            `❌ [API] ${c.req.method} ${c.req.path} → ${statusCode} ${code}: ${logMessage}` +\n            (reqId ? ` [${reqId}]` : \"\")\n        );\n    }\n\n    // Suppress the huge stack trace for known DB errors: it is noisy, and the\n    // extracted [PG …] line above carries the signal. The SQL and the bound\n    // params it used to leak are no longer this branch's problem — `logger`\n    // strips Drizzle's `Failed query: … / params: …` wrapper out of every\n    // message and stack it emits, so the fallbacks below (a connection dropped\n    // mid-statement carries no SQLSTATE, so `dbError` is null and the stack is\n    // logged) are covered too.\n    const suppressStack = isDbSchemaMismatch || dbError !== null || (statusCode < 500 && code === \"BAD_REQUEST\");\n    if (!suppressStack) {\n        logger.error(String(error.stack || error));\n    }\n\n    // Sanitize the message for the client to prevent leaking sensitive details\n    // like SQL queries or internal IP addresses.\n    let clientMessage = \"An unexpected error occurred\";\n    if (statusCode < 500 && error.message) {\n        // If it's a 4xx error (e.g. from validation), it's generally safe to send the message\n        clientMessage = error.message;\n    } else if (error instanceof ApiError || error.name === \"ApiError\") {\n        // We already handled ApiError above, but just in case\n        clientMessage = error.message;\n    } else if (code === \"SCHEMA_DRIFT\") {\n        const pgErr = dbError || (error as PgLikeError);\n        const issue = pgErr.code === \"42703\" ? \"column\" : \"table\";\n        const identifier = pgErr.table || pgErr.column || extractMissingIdentifier(pgErr.message || error.message) || \"unknown\";\n        clientMessage = `Schema drift: ${issue} \"${identifier}\" does not exist. Run \\`pnpm db:push\\` to sync your schema.`;\n    } else if (code === \"DB_PERMISSION_DENIED\") {\n        clientMessage = `Permission denied by the database${dbError?.table ? ` on \"${dbError.table}\"` : \"\"} (row-level security). Check the RLS policies for this table.`;\n    } else if (code === \"INTERNAL_ERROR\") {\n        clientMessage = \"Internal Server Error\";\n    }\n\n    // Database diagnostics for the envelope: the SQLSTATE is always safe to\n    // return; message/detail/hint can reference schema internals, so only\n    // outside production.\n    const dbDetails = dbError ? {\n        dbCode: dbError.code,\n        ...(process.env.NODE_ENV !== \"production\" && {\n            dbMessage: dbError.message,\n            ...(dbError.detail && { detail: dbError.detail }),\n            ...(dbError.hint && { hint: dbError.hint })\n        })\n    } : undefined;\n\n    return c.json({\n        error: {\n            message: clientMessage,\n            code,\n            ...(error.details !== undefined\n                ? { details: error.details }\n                : dbDetails !== undefined ? { details: dbDetails } : {}),\n            ...(reqId && { requestId: reqId })\n        }\n    } satisfies ErrorResponse, statusCode as ContentfulStatusCode);\n};\n\n/**\n * Map known error codes to HTTP status codes.\n */\nfunction codeToStatus(code?: string): number | undefined {\n    if (!code) return undefined;\n    const map: Record<string, number> = {\n        BAD_REQUEST: 400,\n        INVALID_INPUT: 400,\n        WEAK_PASSWORD: 400,\n        UNAUTHORIZED: 401,\n        INVALID_CREDENTIALS: 401,\n        INVALID_TOKEN: 401,\n        FORBIDDEN: 403,\n        NOT_FOUND: 404,\n        CONFLICT: 409,\n        EMAIL_EXISTS: 409,\n        ROLE_EXISTS: 409,\n        SCHEMA_DRIFT: 500,\n        DB_PERMISSION_DENIED: 500,\n        INTERNAL_ERROR: 500,\n        NOT_CONFIGURED: 503,\n        SERVICE_UNAVAILABLE: 503\n    };\n    return map[code];\n}\n\n\n"],"mappings":";;;;;;AAMA,IAAI,qBAAqB;;AAiBzB,IAAM,cAAc;;;;;;;AAQpB,SAAS,eAAe,OAAgB,QAAQ,GAAuB;CACnE,IAAI,CAAC,SAAS,OAAO,UAAU,YAAY,QAAQ,GAAG,OAAO;CAC7D,MAAM,IAAI;CACV,IAAI,OAAO,EAAE,SAAS,YAAY,YAAY,KAAK,EAAE,IAAI,GAAG,OAAO;CACnE,IAAI,EAAE,SAAS,OAAO,EAAE,UAAU,UAAU,OAAO,eAAe,EAAE,OAAO,QAAQ,CAAC;CACpF,OAAO;AACX;;;;;;AAOA,SAAS,yBAAyB,WAAmC;CACjE,IAAI,CAAC,WAAW,OAAO;CAEvB,MAAM,SAAS,UAAU,MAAM,wCAAwC;CACvE,IAAI,QAAQ,OAAO,OAAO;CAE1B,MAAM,WAAW,UAAU,MAAM,wDAAwD;CACzF,IAAI,UAAU,OAAO,SAAS;CAC9B,OAAO;AACX;;;;;;AAOA,IAAa,WAAb,MAAa,iBAAiB,MAAM;CAChC;CACA;CACA;;;;;;;;;;;;;;;;;;;;;;CAsBA;CAEA,YAAY,YAAoB,MAAc,SAAiB,SAAmB,WAAW,OAAO;EAChG,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,KAAK,aAAa;EAClB,KAAK,OAAO;EACZ,KAAK,UAAU;EACf,KAAK,WAAW;CACpB;CAIA,OAAO,WAAW,SAAiB,OAAO,eAAe,SAA6B;EAClF,OAAO,IAAI,SAAS,KAAK,MAAM,SAAS,OAAO;CACnD;CAEA,OAAO,aAAa,SAAiB,OAAO,gBAA0B;EAClE,OAAO,IAAI,SAAS,KAAK,MAAM,OAAO;CAC1C;;;;;CAMA,OAAO,gBAAgB,SAAiB,OAAO,gBAA0B;EACrE,OAAO,IAAI,SAAS,KAAK,MAAM,SAAS,KAAA,GAAW,IAAI;CAC3D;CAEA,OAAO,UAAU,SAAiB,OAAO,aAAuB;EAC5D,OAAO,IAAI,SAAS,KAAK,MAAM,OAAO;CAC1C;CAEA,OAAO,SAAS,SAAiB,OAAO,aAAuB;EAC3D,OAAO,IAAI,SAAS,KAAK,MAAM,OAAO;CAC1C;CAEA,OAAO,SAAS,SAAiB,OAAO,YAAsB;EAC1D,OAAO,IAAI,SAAS,KAAK,MAAM,OAAO;CAC1C;CAEA,OAAO,SAAS,SAAiB,OAAO,kBAA4B;EAChE,OAAO,IAAI,SAAS,KAAK,MAAM,OAAO;CAC1C;CAEA,OAAO,mBAAmB,SAAiB,OAAO,uBAAiC;EAC/E,OAAO,IAAI,SAAS,KAAK,MAAM,OAAO;CAC1C;AACJ;;;;;AAsCA,IAAa,gBAAuC,KAAK,MAAM;CAE3D,MAAM,QAAwB;CAC9B,MAAM,QAAQ,OAAO,EAAE,QAAQ,aAAa,EAAE,IAAI,WAAW,IAAI,KAAA;CAEjE,IAAI,iBAAiB,YAAY,MAAM,SAAS,YAAY;EAIxD,MAAM,WAAW,iBAAiB,YAAY,MAAM;EACpD,MAAM,OAAO,SAAS,EAAE,IAAI,OAAO,GAAG,EAAE,IAAI,KAAK,KAAK,MAAM,WAAW,GAAG,MAAM,KAAK,IAAI,MAAM,aAC1F,QAAQ,KAAK,MAAM,KAAK;EAC7B,IAAI,UACA,OAAO,MAAM,IAAI;OAEjB,OAAO,KAAK,MAAM,MAAM;EAE5B,OAAO,EAAE,KAAK,EACV,OAAO;GACH,SAAS,MAAM;GACf,MAAM,MAAM,QAAQ;GACpB,GAAI,MAAM,YAAY,KAAA,KAAa,EAAE,SAAS,MAAM,QAAQ;GAC5D,GAAI,SAAS,EAAE,WAAW,MAAM;EACpC,EACJ,GAA4B,MAAM,cAAc,GAA4B;CAChF;CAEA,MAAM,aAAa,MAAM,cAAc,aAAa,MAAM,IAAI,KAAK;CACnE,IAAI,OAAO,MAAM,QAAQ;CAGzB,IAAI,aAAa,MAAM;CAIvB,IAAI;CACJ,IAAI,MAAM,SAAS,OAAO,MAAM,UAAU,YAAY,MAAM,UAAU,QAAQ,UAAU,MAAM,OAAO;EACjG,MAAM,QAAQ,MAAM;EACpB,IAAI,MAAM,SAAS,kBAAkB,CAAC,MAAM,WAAW,MAAM,QAAQ,MAAM,MAAM,GAE7E,gBAAgB,MAAM,OAAO,MAAK,MAAK,EAAE,OAAO,KAAK;OAErD,gBAAgB;CAExB;CAKA,MAAM,UAAU,eAAe,KAAK;CAEpC,IAAI,kBAAkB,cAAc,SAAS,iBAAiB,cAAc,SAAS,iBAAiB;EAClG,MAAM,QAAQ;EACd,IAAI,MAAM,SAAS,eACf,aAAa,sDAAsD,MAAM,QAAQ,GAAG,MAAM,KAAK;OAE/F,aAAa,qCAAqC,MAAM,QAAQ,GAAG,MAAM,KAAK;CAEtF,OAAO,IAAI,UAAU,SAAS,MAAM,SAAS,eAAe;EACvD,MAAM,SAAS;EACf,aAAa,qDAAqD,OAAO,QAAQ,GAAG,OAAO,KAAK;CACrG,OAAO,IAAI,YAAY,QAAQ,SAAS,WAAW,QAAQ,SAAS,UAAU;EAC1E,OAAO;EAGP,aAAa,iBAFC,QAAQ,SAAS,UAAU,WAAW,QAEhB,IADjB,QAAQ,SAAS,QAAQ,UAAU,yBAAyB,QAAQ,OAAO,KAAK,UAChD;CACvD,OAAO,IAAI,SAAS;EAChB,MAAM,QAAQ,CAAC,OAAO,QAAQ,KAAK,IAAI,QAAQ,SAAS;EACxD,IAAI,QAAQ,QAAQ,MAAM,KAAK,WAAW,QAAQ,QAAQ;EAC1D,IAAI,QAAQ,MAAM,MAAM,KAAK,SAAS,QAAQ,MAAM;EACpD,IAAI,QAAQ,OAAO,MAAM,KAAK,UAAU,QAAQ,OAAO;EACvD,IAAI,QAAQ,QAAQ,MAAM,KAAK,WAAW,QAAQ,QAAQ;EAC1D,IAAI,QAAQ,YAAY,MAAM,KAAK,eAAe,QAAQ,YAAY;EACtE,IAAI,QAAQ,SAAS,SAAS;GAC1B,OAAO;GACP,MAAM,KACF,kGACkB,QAAQ,QAAQ,QAAQ,QAAQ,MAAM,KAAK,GAAG,2FAEpE;EACJ;EACA,aAAa,MAAM,KAAK,IAAI;CAChC;CAEA,MAAM,qBAAqB,SAAS;CAEpC,IAAI,oBAAoB;EAEpB,OAAO,KACH,YAAY,EAAE,IAAI,OAAO,GAAG,EAAE,IAAI,KAAK,KAAK,WAAW,GAAG,KAAK,IAAI,gBAClE,QAAQ,KAAK,MAAM,KAAK,GAC7B;EAEA,IAAI,CAAC,sBAAA,QAAA,IAAA,aAA+C,cAAc;GAC9D,qBAAqB;GACrB,OAAO,KAAK;IACR;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;GACJ,CAAC,CAAC,KAAK,IAAI,CAAC;EAChB;CACJ,OAEI,OAAO,MACH,WAAW,EAAE,IAAI,OAAO,GAAG,EAAE,IAAI,KAAK,KAAK,WAAW,GAAG,KAAK,IAAI,gBACjE,QAAQ,KAAK,MAAM,KAAK,GAC7B;CAWJ,IAAI,EADkB,sBAAsB,YAAY,QAAS,aAAa,OAAO,SAAS,gBAE1F,OAAO,MAAM,OAAO,MAAM,SAAS,KAAK,CAAC;CAK7C,IAAI,gBAAgB;CACpB,IAAI,aAAa,OAAO,MAAM,SAE1B,gBAAgB,MAAM;MACnB,IAAI,iBAAiB,YAAY,MAAM,SAAS,YAEnD,gBAAgB,MAAM;MACnB,IAAI,SAAS,gBAAgB;EAChC,MAAM,QAAQ,WAAY;EAG1B,gBAAgB,iBAFF,MAAM,SAAS,UAAU,WAAW,QAEX,IADpB,MAAM,SAAS,MAAM,UAAU,yBAAyB,MAAM,WAAW,MAAM,OAAO,KAAK,UACxD;CAC1D,OAAO,IAAI,SAAS,wBAChB,gBAAgB,oCAAoC,SAAS,QAAQ,QAAQ,QAAQ,MAAM,KAAK,GAAG;MAChG,IAAI,SAAS,kBAChB,gBAAgB;CAMpB,MAAM,YAAY,UAAU;EACxB,QAAQ,QAAQ;EAChB,GAAA,QAAA,IAAA,aAA6B,gBAAgB;GACzC,WAAW,QAAQ;GACnB,GAAI,QAAQ,UAAU,EAAE,QAAQ,QAAQ,OAAO;GAC/C,GAAI,QAAQ,QAAQ,EAAE,MAAM,QAAQ,KAAK;EAC7C;CACJ,IAAI,KAAA;CAEJ,OAAO,EAAE,KAAK,EACV,OAAO;EACH,SAAS;EACT;EACA,GAAI,MAAM,YAAY,KAAA,IAChB,EAAE,SAAS,MAAM,QAAQ,IACzB,cAAc,KAAA,IAAY,EAAE,SAAS,UAAU,IAAI,CAAC;EAC1D,GAAI,SAAS,EAAE,WAAW,MAAM;CACpC,EACJ,GAA2B,UAAkC;AACjE;;;;AAKA,SAAS,aAAa,MAAmC;CACrD,IAAI,CAAC,MAAM,OAAO,KAAA;CAmBlB,OAAO;EAjBH,aAAa;EACb,eAAe;EACf,eAAe;EACf,cAAc;EACd,qBAAqB;EACrB,eAAe;EACf,WAAW;EACX,WAAW;EACX,UAAU;EACV,cAAc;EACd,aAAa;EACb,cAAc;EACd,sBAAsB;EACtB,gBAAgB;EAChB,gBAAgB;EAChB,qBAAqB;CAElB,EAAI;AACf"}

package/dist/logger-DfvF_8r-.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"logger-DfvF_8r-.js","names":[],"sources":["../src/utils/logger.ts"],"sourcesContent":["/**\n * Structured Logger for Rebase Backend\n *\n * Outputs JSON lines when `NODE_ENV=production`, human-readable prefixed\n * lines otherwise.  Designed to work with Google Cloud Logging severity levels.\n *\n * Every line — message and data, at any depth — passes through the redaction\n * below, which strips Drizzle's `Failed query: … / params: …` wrapper and the\n * values of secret-looking keys. See the block above `serialiseError`.\n *\n * Usage:\n *   import { logger } from \"./utils/logger\";\n *   logger.info(\"Server started\", { port: 3001 });\n *   logger.error(\"Request failed\", { path: \"/api/test\", error: err });\n */\n\nexport type LogLevel = \"debug\" | \"info\" | \"warn\" | \"error\";\n\n/** Google Cloud Logging severity strings. */\nconst GCP_SEVERITY: Record<LogLevel, string> = {\n    debug: \"DEBUG\",\n    info: \"INFO\",\n    warn: \"WARNING\",\n    error: \"ERROR\"\n};\n\nconst LOG_PRIORITY: Record<LogLevel, number> = {\n    debug: 0,\n    info: 1,\n    warn: 2,\n    error: 3\n};\n\nexport interface LogEntry {\n    severity: string;\n    message: string;\n    timestamp: string;\n    [key: string]: unknown;\n}\n\nexport interface Logger {\n    debug(message: string, data?: Record<string, unknown>): void;\n    info(message: string, data?: Record<string, unknown>): void;\n    warn(message: string, data?: Record<string, unknown>): void;\n    error(message: string, data?: Record<string, unknown>): void;\n    child(defaultFields: Record<string, unknown>): Logger;\n}\n\nfunction isProduction(): boolean {\n    return process.env.NODE_ENV === \"production\";\n}\n\nfunction getMinLevel(): LogLevel {\n    const env = (process.env.LOG_LEVEL || \"info\").toLowerCase();\n    if (env in LOG_PRIORITY) return env as LogLevel;\n    return \"info\";\n}\n\n// ── Redaction ───────────────────────────────────────────────────────\n//\n// Drizzle builds every query failure as\n// `Failed query: ${query}\\nparams: ${params}` (drizzle-orm/errors.js), so the\n// statement *and* every bound value ride along in `.message` and `.stack` of\n// whatever a driver rethrows — an email and a bcrypt hash reach stdout the\n// moment a registration hits a unique violation. The redaction lives here, in\n// the one function every log line passes through, rather than at the ~124\n// `{ error: … }` call sites: a per-site rule is what produced the leak (one\n// file suppressed the stack, four others did not), and the next caller would\n// reintroduce it. Nothing above this line needs to know about it.\n\nconst FAILED_QUERY_MARKER = \"Failed query:\";\nconst REDACTED_QUERY = \"Failed query: [redacted]\";\nconst REDACTED_VALUE = \"[redacted]\";\n\n/**\n * Key fragments whose values are never safe to publish. Compared against the\n * key with separators and case removed, so `api_key`, `apiKey` and `API-KEY`\n * all match `apikey`.\n */\nconst SENSITIVE_KEY_FRAGMENTS = [\n    \"password\",\n    \"passwd\",\n    \"passphrase\",\n    \"secret\",\n    \"token\",\n    \"apikey\",\n    \"authorization\",\n    \"credential\",\n    \"cookie\",\n    \"privatekey\",\n    \"sessionid\"\n];\n\n/** Longest structure the redactor will walk before giving up. */\nconst MAX_REDACT_DEPTH = 8;\n\nfunction isSensitiveKey(key: string): boolean {\n    const normalised = key.toLowerCase().replace(/[^a-z0-9]/g, \"\");\n    return SENSITIVE_KEY_FRAGMENTS.some(fragment => normalised.includes(fragment));\n}\n\n/**\n * Local escape hatch for the `Failed query:` strip only — the statement is the\n * fastest way to diagnose a failing query on a developer machine. Ignored in\n * production, so a runtime that inherits the variable cannot leak because of\n * it, and it never re-enables the key deny-list.\n */\nfunction rawQueriesAllowed(): boolean {\n    return process.env.NODE_ENV !== \"production\"\n        && process.env.REBASE_LOG_RAW_QUERIES === \"true\";\n}\n\n/**\n * Strip every `Failed query: … / params: …` span out of a message or stack,\n * keeping the surrounding text (including stack frames, which carry no user\n * data). When no `params:` line follows the marker the rest of the string is\n * dropped: a statement of unknown extent is treated as sensitive rather than\n * guessed at.\n *\n * Idempotent, and it has to be: an already-redacted span still starts with the\n * marker but has no `params:` line, so a second pass over it would fall into\n * the drop-the-rest branch and eat the stack frames behind it. Redaction runs\n * more than once on the same string in practice — the cron scheduler redacts\n * before persisting and then logs the result.\n */\nexport function redactSensitiveText(text: string): string {\n    if (!text.includes(FAILED_QUERY_MARKER) || rawQueriesAllowed()) return text;\n\n    let out = text;\n    let idx = out.indexOf(FAILED_QUERY_MARKER);\n    while (idx !== -1) {\n        if (out.startsWith(REDACTED_QUERY, idx)) {\n            idx = out.indexOf(FAILED_QUERY_MARKER, idx + REDACTED_QUERY.length);\n            continue;\n        }\n        const paramsIdx = out.indexOf(\"\\nparams:\", idx);\n        let end: number;\n        if (paramsIdx === -1) {\n            end = out.length;\n        } else {\n            const eol = out.indexOf(\"\\n\", paramsIdx + 1);\n            end = eol === -1 ? out.length : eol;\n        }\n        out = out.slice(0, idx) + REDACTED_QUERY + out.slice(end);\n        idx = out.indexOf(FAILED_QUERY_MARKER, idx + REDACTED_QUERY.length);\n    }\n    return out;\n}\n\n/**\n * Serialise an Error into a plain object (stack + message), with the query\n * text redacted out of both. `query`/`params` own-properties — which\n * `DrizzleQueryError` carries beside the message — are deliberately not\n * copied.\n * Handles non-Error values gracefully.\n */\nfunction serialiseError(value: unknown): Record<string, unknown> {\n    if (value instanceof Error) {\n        return {\n            name: value.name,\n            message: redactSensitiveText(value.message),\n            stack: value.stack ? redactSensitiveText(value.stack) : undefined\n        };\n    }\n    return { value: redactSensitiveText(String(value)) };\n}\n\n/**\n * Redact one logged value: errors are serialised, strings are stripped of\n * query text, objects and arrays are walked. Cycles and over-deep structures\n * collapse to a marker rather than throwing — a logger that can fail is worse\n * than one that logs less. (An object referenced twice in one payload is\n * reported as `[circular]` the second time; bounding the walk matters more\n * than rendering a shared reference twice.)\n */\nfunction redactValue(value: unknown, depth: number, seen: WeakSet<object>): unknown {\n    // `serialiseError` returns only already-redacted strings, so it is the\n    // terminal step — walking its output again would redact twice.\n    if (value instanceof Error) return serialiseError(value);\n    if (typeof value === \"string\") return redactSensitiveText(value);\n    if (value === null || typeof value !== \"object\") return value;\n    if (depth >= MAX_REDACT_DEPTH) return \"[truncated]\";\n    if (seen.has(value)) return \"[circular]\";\n    seen.add(value);\n\n    if (Array.isArray(value)) {\n        return value.map(item => redactValue(item, depth + 1, seen));\n    }\n    if (value instanceof Date) return value;\n\n    const out: Record<string, unknown> = {};\n    for (const [key, val] of Object.entries(value as Record<string, unknown>)) {\n        out[key] = isSensitiveKey(key) ? REDACTED_VALUE : redactValue(val, depth + 1, seen);\n    }\n    return out;\n}\n\nfunction formatData(data?: Record<string, unknown>): Record<string, unknown> | undefined {\n    if (!data) return undefined;\n    const seen = new WeakSet<object>();\n    const out: Record<string, unknown> = {};\n    for (const [key, val] of Object.entries(data)) {\n        out[key] = isSensitiveKey(key) ? REDACTED_VALUE : redactValue(val, 0, seen);\n    }\n    return out;\n}\n\nfunction createLogger(rawDefaultFields: Record<string, unknown> = {}): Logger {\n    const minLevel = getMinLevel();\n    // Child fields go through the same pass as per-call data — they are merged\n    // into every line this logger emits, so leaving them raw would be a hole\n    // the moment `child()` gets its first caller.\n    const defaultFields = formatData(rawDefaultFields) ?? {};\n\n    function emit(level: LogLevel, message: string, data?: Record<string, unknown>): void {\n        if (LOG_PRIORITY[level] < LOG_PRIORITY[minLevel]) return;\n\n        // The message is redacted too, not just the data: several call sites\n        // interpolate `error.message` straight into the line they log.\n        const safeMessage = redactSensitiveText(message);\n        const merged = { ...defaultFields,\n...formatData(data) };\n\n        if (isProduction()) {\n            // Structured JSON for Cloud Logging\n            const entry: LogEntry = {\n                severity: GCP_SEVERITY[level],\n                message: safeMessage,\n                timestamp: new Date().toISOString(),\n                ...merged\n            };\n            const line = JSON.stringify(entry);\n\n            if (level === \"error\") {\n                process.stderr.write(line + \"\\n\");\n            } else {\n                process.stdout.write(line + \"\\n\");\n            }\n        } else {\n            // Human-readable for development\n            const prefix = level === \"error\" ? \"❌\"\n                : level === \"warn\" ? \"⚠️\"\n                : level === \"info\" ? \"ℹ️\"\n                : \"🐛\";\n            const extra = Object.keys(merged).length > 0 ? ` ${JSON.stringify(merged)}` : \"\";\n            const out = `${prefix} [${level.toUpperCase()}] ${safeMessage}${extra}`;\n\n            if (level === \"error\") {\n                console.error(out);\n            } else if (level === \"warn\") {\n                console.warn(out);\n            } else {\n                console.log(out);\n            }\n        }\n    }\n\n    return {\n        debug: (msg, data) => emit(\"debug\", msg, data),\n        info: (msg, data) => emit(\"info\", msg, data),\n        warn: (msg, data) => emit(\"warn\", msg, data),\n        error: (msg, data) => emit(\"error\", msg, data),\n        child(fields: Record<string, unknown>): Logger {\n            return createLogger({ ...defaultFields,\n...fields });\n        }\n    };\n}\n\n/**\n * Singleton logger instance.\n * In production: emits JSON lines with `severity`, `message`, `timestamp`.\n * In development: emits human-readable prefixed lines.\n */\nexport const logger: Logger = createLogger();\n"],"mappings":";;;;;AAmBA,IAAM,eAAyC;CAC3C,OAAO;CACP,MAAM;CACN,MAAM;CACN,OAAO;AACX;AAEA,IAAM,eAAyC;CAC3C,OAAO;CACP,MAAM;CACN,MAAM;CACN,OAAO;AACX;AAiBA,SAAS,eAAwB;CAC7B,OAAA,QAAA,IAAA,aAAgC;AACpC;AAEA,SAAS,cAAwB;CAC7B,MAAM,OAAO,QAAQ,IAAI,aAAa,OAAA,CAAQ,YAAY;CAC1D,IAAI,OAAO,cAAc,OAAO;CAChC,OAAO;AACX;AAcA,IAAM,sBAAsB;AAC5B,IAAM,iBAAiB;AACvB,IAAM,iBAAiB;;;;;;AAOvB,IAAM,0BAA0B;CAC5B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACJ;;AAGA,IAAM,mBAAmB;AAEzB,SAAS,eAAe,KAAsB;CAC1C,MAAM,aAAa,IAAI,YAAY,CAAC,CAAC,QAAQ,cAAc,EAAE;CAC7D,OAAO,wBAAwB,MAAK,aAAY,WAAW,SAAS,QAAQ,CAAC;AACjF;;;;;;;AAQA,SAAS,oBAA6B;CAClC,OAAA,QAAA,IAAA,aAAgC,gBACzB,QAAQ,IAAI,2BAA2B;AAClD;;;;;;;;;;;;;;AAeA,SAAgB,oBAAoB,MAAsB;CACtD,IAAI,CAAC,KAAK,SAAS,mBAAmB,KAAK,kBAAkB,GAAG,OAAO;CAEvE,IAAI,MAAM;CACV,IAAI,MAAM,IAAI,QAAQ,mBAAmB;CACzC,OAAO,QAAQ,IAAI;EACf,IAAI,IAAI,WAAW,gBAAgB,GAAG,GAAG;GACrC,MAAM,IAAI,QAAQ,qBAAqB,MAAM,EAAqB;GAClE;EACJ;EACA,MAAM,YAAY,IAAI,QAAQ,aAAa,GAAG;EAC9C,IAAI;EACJ,IAAI,cAAc,IACd,MAAM,IAAI;OACP;GACH,MAAM,MAAM,IAAI,QAAQ,MAAM,YAAY,CAAC;GAC3C,MAAM,QAAQ,KAAK,IAAI,SAAS;EACpC;EACA,MAAM,IAAI,MAAM,GAAG,GAAG,IAAI,iBAAiB,IAAI,MAAM,GAAG;EACxD,MAAM,IAAI,QAAQ,qBAAqB,MAAM,EAAqB;CACtE;CACA,OAAO;AACX;;;;;;;;AASA,SAAS,eAAe,OAAyC;CAC7D,IAAI,iBAAiB,OACjB,OAAO;EACH,MAAM,MAAM;EACZ,SAAS,oBAAoB,MAAM,OAAO;EAC1C,OAAO,MAAM,QAAQ,oBAAoB,MAAM,KAAK,IAAI,KAAA;CAC5D;CAEJ,OAAO,EAAE,OAAO,oBAAoB,OAAO,KAAK,CAAC,EAAE;AACvD;;;;;;;;;AAUA,SAAS,YAAY,OAAgB,OAAe,MAAgC;CAGhF,IAAI,iBAAiB,OAAO,OAAO,eAAe,KAAK;CACvD,IAAI,OAAO,UAAU,UAAU,OAAO,oBAAoB,KAAK;CAC/D,IAAI,UAAU,QAAQ,OAAO,UAAU,UAAU,OAAO;CACxD,IAAI,SAAS,kBAAkB,OAAO;CACtC,IAAI,KAAK,IAAI,KAAK,GAAG,OAAO;CAC5B,KAAK,IAAI,KAAK;CAEd,IAAI,MAAM,QAAQ,KAAK,GACnB,OAAO,MAAM,KAAI,SAAQ,YAAY,MAAM,QAAQ,GAAG,IAAI,CAAC;CAE/D,IAAI,iBAAiB,MAAM,OAAO;CAElC,MAAM,MAA+B,CAAC;CACtC,KAAK,MAAM,CAAC,KAAK,QAAQ,OAAO,QAAQ,KAAgC,GACpE,IAAI,OAAO,eAAe,GAAG,IAAI,iBAAiB,YAAY,KAAK,QAAQ,GAAG,IAAI;CAEtF,OAAO;AACX;AAEA,SAAS,WAAW,MAAqE;CACrF,IAAI,CAAC,MAAM,OAAO,KAAA;CAClB,MAAM,uBAAO,IAAI,QAAgB;CACjC,MAAM,MAA+B,CAAC;CACtC,KAAK,MAAM,CAAC,KAAK,QAAQ,OAAO,QAAQ,IAAI,GACxC,IAAI,OAAO,eAAe,GAAG,IAAI,iBAAiB,YAAY,KAAK,GAAG,IAAI;CAE9E,OAAO;AACX;AAEA,SAAS,aAAa,mBAA4C,CAAC,GAAW;CAC1E,MAAM,WAAW,YAAY;CAI7B,MAAM,gBAAgB,WAAW,gBAAgB,KAAK,CAAC;CAEvD,SAAS,KAAK,OAAiB,SAAiB,MAAsC;EAClF,IAAI,aAAa,SAAS,aAAa,WAAW;EAIlD,MAAM,cAAc,oBAAoB,OAAO;EAC/C,MAAM,SAAS;GAAE,GAAG;GAC5B,GAAG,WAAW,IAAI;EAAE;EAEZ,IAAI,aAAa,GAAG;GAEhB,MAAM,QAAkB;IACpB,UAAU,aAAa;IACvB,SAAS;IACT,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;IAClC,GAAG;GACP;GACA,MAAM,OAAO,KAAK,UAAU,KAAK;GAEjC,IAAI,UAAU,SACV,QAAQ,OAAO,MAAM,OAAO,IAAI;QAEhC,QAAQ,OAAO,MAAM,OAAO,IAAI;EAExC,OAAO;GAEH,MAAM,SAAS,UAAU,UAAU,MAC7B,UAAU,SAAS,OACnB,UAAU,SAAS,OACnB;GACN,MAAM,QAAQ,OAAO,KAAK,MAAM,CAAC,CAAC,SAAS,IAAI,IAAI,KAAK,UAAU,MAAM,MAAM;GAC9E,MAAM,MAAM,GAAG,OAAO,IAAI,MAAM,YAAY,EAAE,IAAI,cAAc;GAEhE,IAAI,UAAU,SACV,QAAQ,MAAM,GAAG;QACd,IAAI,UAAU,QACjB,QAAQ,KAAK,GAAG;QAEhB,QAAQ,IAAI,GAAG;EAEvB;CACJ;CAEA,OAAO;EACH,QAAQ,KAAK,SAAS,KAAK,SAAS,KAAK,IAAI;EAC7C,OAAO,KAAK,SAAS,KAAK,QAAQ,KAAK,IAAI;EAC3C,OAAO,KAAK,SAAS,KAAK,QAAQ,KAAK,IAAI;EAC3C,QAAQ,KAAK,SAAS,KAAK,SAAS,KAAK,IAAI;EAC7C,MAAM,QAAyC;GAC3C,OAAO,aAAa;IAAE,GAAG;IACrC,GAAG;GAAO,CAAC;EACH;CACJ;AACJ;;;;;;AAOA,IAAa,SAAiB,aAAa"}

package/dist/request-timeout-BuFoEKwT.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"request-timeout-BuFoEKwT.js","names":[],"sources":["../src/functions/request-timeout.ts"],"sourcesContent":["import type { MiddlewareHandler } from \"hono\";\nimport type { HonoEnv } from \"../api/types\";\nimport { logger } from \"../utils/logger\";\n\n/** Default ceiling for a custom function request, in milliseconds. */\nexport const DEFAULT_FUNCTIONS_TIMEOUT_MS = 30_000;\n\n/**\n * Resolve the functions request timeout from config, then env, then the default.\n *\n * `0` (or any non-positive number) disables the ceiling — for a deployment\n * whose proxy already imposes one, or a function that legitimately streams for\n * minutes.\n */\nexport function resolveFunctionsTimeoutMs(configured?: number): number {\n    if (typeof configured === \"number\" && Number.isFinite(configured)) {\n        return Math.max(0, Math.floor(configured));\n    }\n    // Blank means unset, not zero. `Number(\"\")` and `Number(\" \")` are both 0,\n    // and 0 here means \"no ceiling\" — so a compose file with\n    // `REBASE_FUNCTIONS_TIMEOUT_MS=${SOMETHING}` and `SOMETHING` undefined, or\n    // a `.env` line with the name and no value, silently switched off the one\n    // bound on how long code the framework did not write may hold a socket.\n    // Declaring a variable without setting it is the ordinary way to write\n    // both of those files, and the failure is invisible: nothing logs, and the\n    // deployment behaves exactly as it did before the ceiling existed.\n    const raw = process.env.REBASE_FUNCTIONS_TIMEOUT_MS?.trim();\n    if (raw) {\n        const fromEnv = Number(raw);\n        if (Number.isFinite(fromEnv) && fromEnv >= 0) {\n            return Math.floor(fromEnv);\n        }\n    }\n    return DEFAULT_FUNCTIONS_TIMEOUT_MS;\n}\n\n/**\n * A per-request ceiling for the custom functions router.\n *\n * Custom functions are the one router that runs code the framework did not\n * write, and nothing else in the stack bounds how long that code takes: the\n * Node server is constructed without `requestTimeout`/`headersTimeout`, so a\n * handler awaiting a promise that never settles — a `fetch` to an unreachable\n * third party with no `AbortSignal`, a query on a wedged connection — holds its\n * socket and its request object until the client gives up. On the managed\n * runtime the process is shared between tenants, so that is not only the slow\n * caller's problem.\n *\n * The handler is **not** cancelled — it cannot be, there is no cancellation\n * token to hand user code. What is bounded is the client-visible request: after\n * `ms` the caller gets a 504 and the socket is released, and the handler's\n * eventual result is dropped. It is a ceiling, not a kill switch, and the exact\n * number matters far less than its existence.\n *\n * Mounted in front of the auth middleware rather than behind it, so a wedged\n * driver — the failure that also hangs `withAuth()` — is covered too.\n */\nexport function createFunctionsRequestTimeout(ms: number): MiddlewareHandler<HonoEnv> {\n    return async (c, next) => {\n        if (ms <= 0) return next();\n\n        let timer: ReturnType<typeof setTimeout> | undefined;\n        const timedOut = new Promise<\"timeout\">((resolve) => {\n            timer = setTimeout(() => resolve(\"timeout\"), ms);\n        });\n\n        try {\n            const outcome = await Promise.race([next().then(() => \"done\" as const), timedOut]);\n            if (outcome === \"timeout\") {\n                logger.warn(\n                    `[functions] ${c.req.method} ${c.req.path} exceeded the ${ms}ms request timeout — ` +\n                    \"answering 504. The handler is still running; it cannot be cancelled from here. \" +\n                    \"Give outbound calls an AbortSignal, or raise `functionsTimeoutMs` / REBASE_FUNCTIONS_TIMEOUT_MS.\"\n                );\n                return c.json({\n                    error: {\n                        message: \"Function timed out\",\n                        code: \"FUNCTION_TIMEOUT\"\n                    }\n                }, 504);\n            }\n        } finally {\n            if (timer) clearTimeout(timer);\n        }\n        return undefined;\n    };\n}\n"],"mappings":";;;;;;AAKA,IAAa,+BAA+B;;;;;;;;AAS5C,SAAgB,0BAA0B,YAA6B;CACnE,IAAI,OAAO,eAAe,YAAY,OAAO,SAAS,UAAU,GAC5D,OAAO,KAAK,IAAI,GAAG,KAAK,MAAM,UAAU,CAAC;CAU7C,MAAM,MAAM,QAAQ,IAAI,6BAA6B,KAAK;CAC1D,IAAI,KAAK;EACL,MAAM,UAAU,OAAO,GAAG;EAC1B,IAAI,OAAO,SAAS,OAAO,KAAK,WAAW,GACvC,OAAO,KAAK,MAAM,OAAO;CAEjC;CACA,OAAO;AACX;;;;;;;;;;;;;;;;;;;;;;AAuBA,SAAgB,8BAA8B,IAAwC;CAClF,OAAO,OAAO,GAAG,SAAS;EACtB,IAAI,MAAM,GAAG,OAAO,KAAK;EAEzB,IAAI;EACJ,MAAM,WAAW,IAAI,SAAoB,YAAY;GACjD,QAAQ,iBAAiB,QAAQ,SAAS,GAAG,EAAE;EACnD,CAAC;EAED,IAAI;GAEA,IAAI,MADkB,QAAQ,KAAK,CAAC,KAAK,CAAC,CAAC,WAAW,MAAe,GAAG,QAAQ,CAAC,MACjE,WAAW;IACvB,OAAO,KACH,eAAe,EAAE,IAAI,OAAO,GAAG,EAAE,IAAI,KAAK,gBAAgB,GAAG,uMAGjE;IACA,OAAO,EAAE,KAAK,EACV,OAAO;KACH,SAAS;KACT,MAAM;IACV,EACJ,GAAG,GAAG;GACV;EACJ,UAAU;GACN,IAAI,OAAO,aAAa,KAAK;EACjC;CAEJ;AACJ"}