@rebasepro/server 0.17.2-canary.g439a156 → 0.17.2

package/dist/{contract-routes-D8TvxPLo.js → contract-routes-CHPVKTZW.js}

@@ -3,7 +3,7 @@ import __rebaseProcess from "process";
 globalThis.process ??= __rebaseProcess;
 __rebaseCreateRequire(import.meta.url);
 import { n as __exportAll } from "./rolldown-runtime-dW7B1o5h.js";
-import "./src-Cdsw7DqV.js";
+import "./src-CcOl05Oq.js";
 import { t as logger } from "./logger-DS03e908.js";
 import { Hono } from "hono";
 //#region ../types/src/types/project_manifest.ts
@@ -262,4 +262,4 @@ function createContractRoutes(config) {
 //#endregion
 export { createContractRoutes as n, computeSchemaVersion as r, contract_routes_exports as t };
 
-//# sourceMappingURL=contract-routes-D8TvxPLo.js.map
+//# sourceMappingURL=contract-routes-CHPVKTZW.js.map

package/dist/{contract-routes-D8TvxPLo.js.map → contract-routes-CHPVKTZW.js.map}

@@ -1 +1 @@
-{"version":3,"file":"contract-routes-D8TvxPLo.js","names":[],"sources":["../../types/src/types/project_manifest.ts","../../types/src/types/collection_contract.ts","../../types/src/types/schema_version.ts","../src/api/contract-routes.ts"],"sourcesContent":["/**\n * The project manifest (`rebase.json`) and the build artifacts derived from it.\n *\n * Three separate documents live in this file, and keeping them distinct matters:\n *\n * 1. {@link RebaseProjectManifest} — `rebase.json`. **Authored** by the developer,\n *    committed to the repository. Declares topology only: which runtime major the\n *    project targets, and which apps *this repository* contributes to the project.\n *    Schema, security rules, hooks and functions stay in TypeScript under the\n *    config package — nothing that needs a type system belongs here.\n *\n * 2. {@link RebaseProjectLink} — the per-checkout link (`.rebase/cloud.json`).\n *    **Not committed**, because it is per-developer like a git remote. Says which\n *    deployed project this working copy points at, whether that is a Rebase Cloud\n *    project or the base URL of a self-hosted backend.\n *\n * 3. {@link RebaseBundleManifest} — `manifest.json` inside a built bundle.\n *    **Generated**, never hand-edited. It is the lockfile analogue: the exact\n *    contract a built artifact claims to satisfy, which the runtime validates\n *    before it boots and a control plane validates before it deploys.\n *\n * A repository declares only the apps it contains. The set of apps belonging to a\n * project is held by the project itself, which is what makes multi-repo projects\n * work: two repositories never need to know about each other, only about the\n * project.\n */\n\nimport type { StorageSourceDefinition } from \"./storage_source\";\nimport type { ResourceGraph } from \"./resources\";\n\n/**\n * Which kind of thing an app is.\n *\n * - `backend` — the collections/hooks/functions that define the project's API.\n *   Exactly one per *project* (not per repository); the registry enforces it.\n * - `static`  — a pre-built client bundle (SPA, static site), served from the\n *   backend process at its declared `path` or from a CDN. The admin panel is\n *   one of these: it is an app in the user's repository like any other.\n *\n * That is the whole list. Ownership of the server process is a property of the\n * backend app ({@link RebaseBackendAppConfig.runtime}), not an app type.\n */\nexport type RebaseAppType = \"backend\" | \"static\";\n\n/**\n * The backend app: the project's API surface.\n *\n * Paths are relative to the directory holding `rebase.json`. The defaults match\n * the layout `rebase init` scaffolds, so a stock project may declare simply\n * `{ \"type\": \"backend\", \"runtime\": \"managed\" }`.\n */\nexport interface RebaseBackendAppConfig {\n    type: \"backend\";\n    /**\n     * Who owns the process this backend runs in.\n     *\n     * - `managed` — the platform's runtime image boots this project's bundle.\n     *   You supply collections, functions, crons and schema; Rebase supplies the\n     *   server.\n     * - `custom` — this repository builds its own image and entrypoint. The\n     *   escape hatch: full control, no managed-runtime guarantees.\n     *\n     * Independent of *where* it runs. Both run on Rebase Cloud and both\n     * self-host — the destination lives in `.rebase/cloud.json`, not here. See\n     * `infra/docker/docker-compose.selfhost.yml`, which boots a managed bundle on a\n     * developer's own Docker host.\n     *\n     * This is authored rather than inferred on purpose. It is the single most\n     * consequential fact about a deployment, and inferring it is what used to\n     * land projects on the custom runtime without anyone choosing it.\n     */\n    runtime: \"managed\" | \"custom\";\n    /** Directory of the config package (collections + index). Default `config`. */\n    config?: string;\n    /** Directory of server functions. Default `backend/functions`. */\n    functions?: string;\n    /** Directory of cron job definitions. Default `backend/crons` when present. */\n    crons?: string;\n    /**\n     * Path to the generated Drizzle schema module (tables/enums/relations).\n     * Default `backend/src/schema.generated.ts`.\n     */\n    schema?: string;\n    /**\n     * Module path (relative to `config`) exporting the auth users collection as\n     * its default export. Default `collections/users`.\n     */\n    usersCollection?: string;\n\n    /**\n     * `runtime: \"custom\"` only. Dockerfile path relative to the repository root.\n     * Default `Dockerfile`.\n     */\n    dockerfile?: string;\n    /** `runtime: \"custom\"` only. Build context relative to the root. Default `.`. */\n    context?: string;\n    /** `runtime: \"custom\"` only. Port the container listens on. Default 8080. */\n    port?: number;\n}\n\n/**\n * A static client bundle — SPA or static site — built here and served at `path`.\n */\nexport interface RebaseStaticAppConfig {\n    type: \"static\";\n    /** Package directory containing the client sources. */\n    root: string;\n    /** Command that produces `output`. Run from the repository root. */\n    build?: string;\n    /** Directory of built assets, relative to the repository root. */\n    output: string;\n    /**\n     * Public base path this app is served under. Default `/`.\n     *\n     * Several static apps run in one process, each at its own path — the API at\n     * `/api`, a site at `/`, the admin at `/admin` — which is what keeps a\n     * self-hosted deployment a single container.\n     *\n     * **This is a build-time input, not only a serving concern.** An app mounted\n     * at `/admin` must be *built* for `/admin` (Vite's `base`), or `index.html`\n     * loads and every asset 404s: a blank page with no server error. `rebase\n     * build` passes it as `REBASE_APP_BASE` and asserts the emitted HTML honours\n     * it. Changing this value requires rebuilding the app.\n     */\n    path?: string;\n    /**\n     * Serve `index.html` for unmatched paths under `path` (client-side routing).\n     * Default `true` — the overwhelmingly common case for a client app, and a\n     * static *site* generator emits real files for its routes anyway.\n     */\n    spa?: boolean;\n}\n\nexport type RebaseAppConfig = RebaseBackendAppConfig | RebaseStaticAppConfig;\n\n/**\n * Path prefixes the backend owns, which no static app may claim.\n *\n * One process — and, on the platform, one hostname — serves both the API and\n * however many static apps a project has. Mounting is longest-path-first, so an\n * app declaring `/api` would win against the API itself and every request to it\n * would be answered with that app's `index.html`: a 200 carrying HTML where the\n * caller expected JSON, from a project that looks deployed and healthy.\n *\n * Declared here rather than in either enforcer because both must agree. The CLI\n * checks it so a developer finds out while editing `rebase.json`; the control\n * plane checks it again at deploy intake, because the front door's correctness\n * cannot rest on a check that ran in somebody else's CLI — and a repository can\n * be deployed by a CLI older than this rule.\n */\nexport const RESERVED_BACKEND_PREFIXES = [\"/api\", \"/health\", \"/healthz\", \"/livez\", \"/readyz\", \"/metrics\"] as const;\n\n/**\n * Whether `path` collides with a prefix the backend owns.\n *\n * Compares at segment boundaries, so `/api` and `/api/v2` collide while\n * `/apidocs` does not — the same rule the router matches with, because a check\n * that is stricter than the router rejects paths that would have worked, and one\n * that is looser admits paths that will not.\n */\nexport function reservedPrefixFor(path: string): string | undefined {\n    const normalized = path.endsWith(\"/\") && path !== \"/\" ? path.slice(0, -1) : path;\n    return RESERVED_BACKEND_PREFIXES.find(\n        reserved => normalized === reserved || normalized.startsWith(`${reserved}/`)\n    );\n}\n\n/**\n * One declared storage source, as authored in `rebase.json`.\n *\n * The key comes from the enclosing record, so this is\n * {@link StorageSourceDefinition} minus its `key` — the same document the\n * runtime registry and the frontend router consume, expressed the way a JSON\n * object naturally expresses \"a set of named things\".\n */\nexport interface RebaseStorageSourceConfig {\n    /** Engine backing this source: `local`, `s3`, `gcs`, or a custom id. */\n    engine: string;\n    /**\n     * How the frontend reaches it. Default `server` (proxied through\n     * `/api/storage`). `direct` means a provider SDK talks to the bucket and the\n     * backend is not in the upload path.\n     */\n    transport?: \"server\" | \"direct\";\n    /** Human-readable label for the console and the admin UI. */\n    label?: string;\n}\n\n/**\n * `rebase.json` — the authored project manifest.\n */\nexport interface RebaseProjectManifest {\n    /** JSON Schema URL, for editor completion. Ignored by the tooling. */\n    $schema?: string;\n    /**\n     * The runtime contract **major** this project targets, as a semver range\n     * (e.g. `^1`, `~1.4`, or an exact `1.4.2` to pin).\n     *\n     * The platform upgrades patches and minors underneath a project without\n     * asking; it never crosses a major. See {@link RUNTIME_CONTRACT_VERSION}.\n     *\n     * Named `rebase` rather than `runtime` so that `runtime` means exactly one\n     * thing — {@link RebaseBackendAppConfig.runtime}, who owns the process. It\n     * reads like `engines` in a `package.json`, which is what it is.\n     */\n    rebase: string;\n    /**\n     * Apps this repository contributes, keyed by app name. The key is the app's\n     * identity within the project: it is what `rebase deploy <app>` names, what\n     * client credentials are issued against, and what a second repository must\n     * not collide with.\n     */\n    apps: Record<string, RebaseAppConfig>;\n    /**\n     * Buckets are NOT declared here any more.\n     *\n     * They were, and the runtime merged this block with the declarations in\n     * config code — a bucket named in both had one engine kept and the other\n     * silently discarded. Two homes for one concept, with a merge to decide\n     * between them, is the shape this whole model replaced.\n     *\n     * `bucket(\"media\", { engine: \"s3\" })` in the project's config declares one\n     * now, and `rebase resources --write` generates `rebase.resources.json`,\n     * which is what a host reads before a build. A `storage` block left in this\n     * file is refused by the validator, by name, with the replacement in the\n     * message — not ignored, because a key that still parses and does nothing\n     * is the failure this removed.\n     */\n    /**\n     * Repository-wide opt-out from anonymous CLI usage sharing.\n     *\n     * **Only `false` does anything.** It suppresses sharing for everyone who\n     * clones this repository, overriding each developer's own opt-in — an\n     * organisation setting policy for work done on its behalf, the same shape\n     * as a committed `.npmrc`.\n     *\n     * `true` is deliberately ignored, and the CLI says so rather than obeying\n     * quietly. This file is committed, so a `true` here would be one developer\n     * answering a privacy question for every colleague who later clones the\n     * repo — consent by proxy, which is the exact thing opt-in exists to\n     * prevent. Individuals opt in with `rebase telemetry enable`.\n     */\n    telemetry?: boolean;\n}\n\n/**\n * The per-checkout project link.\n *\n * Deliberately separate from `rebase.json`: the manifest is committed and shared,\n * while the link is per-developer. Keeping them in one file would mean either\n * committing someone's project id or gitignoring the topology.\n */\nexport interface RebaseProjectLink {\n    /**\n     * A Rebase Cloud project id, or the base URL of any running Rebase backend\n     * (`https://api.example.com`). Both are first-class: every command that\n     * accepts a project reference accepts either, so a self-hosted project has\n     * the same tooling as a cloud one.\n     */\n    project: string;\n    /** Organization slug. Cloud projects only. */\n    org?: string;\n    /** Explicit API base URL, when it differs from the project's default. */\n    apiUrl?: string;\n}\n\n/**\n * Whether a project can run on the managed runtime, and if not, precisely why.\n *\n * The reasons are returned rather than summarised so tooling can print something\n * a developer can act on. \"Not eligible\" is never a dead end — it selects the\n * custom-runtime path, which still deploys.\n */\nexport interface ManagedCompatibility {\n    eligible: boolean;\n    reasons: string[];\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Bundle\n// ─────────────────────────────────────────────────────────────────────────────\n\n/**\n * Version of the bundle *format* itself.\n *\n * Bumped only when the on-disk layout changes in a way an older runtime could\n * not read. A runtime accepts any bundle whose `bundleFormat` is less than or\n * equal to its own — old bundles keep booting on new runtimes, which is the\n * whole point of separating the artifact from the engine.\n *\n * - **1** — `mode: \"cms\" | \"baas\" | \"static\"`, `entry.static` a single directory\n *   string, `entry.admin` for a bundled admin panel.\n * - **2** — `kind: \"backend\" | \"static\"`, `entry.static` a list of\n *   {@link RebaseBundleStatic}, `entry.admin` removed. A format-1 runtime reading\n *   one of these would find no `mode` and an array where it expects a string, so\n *   the bump is what turns that into a refusal to boot instead of a bundle that\n *   starts and serves nothing.\n */\nexport const BUNDLE_FORMAT_VERSION = 2;\n\n/**\n * The runtime contract major.\n *\n * Distinct from the `@rebasepro/server` package version: the package may release\n * any number of minors and patches while this stays put. It changes only when\n * the bundle/runtime contract breaks compatibility, and a project's\n * `manifest.runtime` range is matched against *this*.\n *\n * ## v2 — resources are declared, not configured\n *\n * `RebaseBackendConfig.dataSources` and `.storageSources` are gone. A project\n * declares its databases and buckets with `database()` / `bucket()` in its\n * config, and the runtime reads those declarations.\n *\n * This had to be a major, and the reason is the managed tier: it moves projects\n * onto new images WITHOUT rebuilding them. A bundle built against v1 exports\n * those keys, and a v2 runtime refuses them at boot — so without this bump, one\n * image rollout would crash-loop every tenant that had ever declared a second\n * database or bucket, in a wave, with the cause in a container log nobody is\n * watching.\n *\n * With the bump, a v1 bundle on a v2 runtime is refused by\n * `assertBundleCompatibility` with the remedy in the message, and the platform\n * keeps it on a v1 image until it is rebuilt. That is the whole purpose of this\n * number.\n *\n * **Release order matters and is not optional.** The control plane is the side\n * that rejects, so it ships FIRST: raise `SUPPORTED_RUNTIME_CONTRACT` in the\n * saas repo (it rejects only `contract >` its own, so it then accepts both),\n * deploy that, and only then release a runtime implementing v2. Shipping the\n * runtime first turns every deploy into a rejected intake blaming the tenant's\n * bundle.\n */\nexport const RUNTIME_CONTRACT_VERSION = 1;\n\n/** Where the runtime finds each part of the bundle. Paths are bundle-relative. */\nexport interface RebaseBundleEntrypoints {\n    /** Compiled config package directory (collections live under it). */\n    config?: string;\n    /** Compiled collections directory, when it differs from `<config>/collections`. */\n    collections?: string;\n    /** Compiled functions directory. */\n    functions?: string;\n    /** Compiled crons directory. */\n    crons?: string;\n    /** Compiled Drizzle schema module. */\n    schema?: string;\n    /** Module exporting the auth users collection (default export). */\n    usersCollection?: string;\n    /**\n     * Built static apps to serve from this process, in declaration order.\n     *\n     * A list rather than a single directory because one process serves several\n     * apps at different paths — a site at `/` and the admin at `/admin`. The\n     * runtime mounts them longest-path-first so the `/`-rooted app's catch-all\n     * does not claim its siblings' URLs.\n     */\n    static?: RebaseBundleStatic[];\n}\n\n/** One built static app inside a bundle. */\nexport interface RebaseBundleStatic {\n    /** Public base path, e.g. `/` or `/admin`. */\n    path: string;\n    /** Bundle-relative directory holding the built assets. */\n    dir: string;\n    /** Serve `index.html` for unmatched paths under `path`. */\n    spa: boolean;\n}\n\n/**\n * A native module found in the dependency closure.\n *\n * Recorded rather than merely counted so a rejection can name the offending\n * package instead of saying \"something here is native\".\n */\nexport interface NativeDependency {\n    name: string;\n    /** Why it was flagged — a `.node` binary, a gyp build, or an install script. */\n    reason: string;\n}\n\n/**\n * `manifest.json` — generated, and the document the runtime and control plane\n * both validate against.\n */\n/**\n * One custom function, as recorded in a built bundle.\n *\n * @see RebaseBundleManifest.functions\n */\nexport interface RebaseBundleFunction {\n    /**\n     * The filename without its extension — which is also the URL segment it\n     * mounts at (`/api/functions/<name>`), the API-key permission that grants\n     * it, and the name `REBASE_FUNCTIONS_ONLY` selects by. One identity, used\n     * everywhere.\n     */\n    name: string;\n    /** Path inside the bundle, so a host can point at the file. */\n    file: string;\n    /**\n     * `false` when the function's own source imports a Node built-in or a\n     * package that needs one.\n     *\n     * Descriptive, never a gate: nothing refuses to build or deploy on this. It\n     * says where this function *could* run, not where it should.\n     */\n    portable: boolean;\n    /**\n     * Why it is not portable — one short phrase per reason, deduplicated.\n     * Absent when it is.\n     */\n    requires?: string[];\n}\n\nexport interface RebaseBundleManifest {\n    /** @see BUNDLE_FORMAT_VERSION */\n    bundleFormat: number;\n    runtime: {\n        /** The `runtime` range copied from `rebase.json`. */\n        range: string;\n        /** Exact `@rebasepro/server` version this bundle was built against. */\n        builtAgainst: string;\n        /** Runtime contract major this bundle requires. */\n        contract: number;\n    };\n    /**\n     * Hash of the compiled collection definitions.\n     *\n     * This is the contract stamp. A generated SDK records the value it was built\n     * from, a client sends it back, and a mismatch is what lets the platform say\n     * \"this app was built against an older schema\" instead of failing mysteriously\n     * at the first request. It covers collections only — a hook edit does not\n     * change a client's contract, so it must not invalidate every SDK.\n     */\n    schemaVersion: string;\n    /** Which app in `rebase.json` this bundle was built from. */\n    app: string;\n    /**\n     * What the runtime does with this bundle.\n     *\n     * - `backend` — boot the full server: database, auth and the data API, plus\n     *   any static apps in `entry.static`.\n     * - `static` — no backend at all: serve `entry.static` and nothing else. No\n     *   database, no auth, no data sources. This is how a static app runs on the\n     *   same image as the backend.\n     *\n     * Replaces an earlier `mode: \"cms\" | \"baas\" | \"static\"`. The cms/baas\n     * distinction was never a third kind of thing — it is simply whether\n     * `entry.config` is present, so it is derived rather than declared.\n     */\n    kind: \"backend\" | \"static\";\n    entry: RebaseBundleEntrypoints;\n    /** Collection slugs contained in the bundle, for quick inspection. */\n    collections?: string[];\n    /**\n     * Every custom function in the bundle, named and classified.\n     *\n     * Two things are recorded per function, and both are answers a host would\n     * otherwise have to get by importing user code:\n     *\n     * - **What it is called.** That name is the function's identity everywhere —\n     *   the URL segment it mounts at, the `functions/<name>` API-key\n     *   permission, the value `REBASE_FUNCTIONS_ONLY` selects by. A host that\n     *   wants to give one slow function its own replica count currently has to\n     *   boot the bundle to discover what is in it.\n     * - **Whether it needs Node.** Purely descriptive: a function that opens a\n     *   file or runs raw SQL is a fine function, and every deployment today is\n     *   a Node process. It is recorded because the question \"which of these\n     *   could run somewhere else\" has to be answerable from the artifact, and\n     *   because answering it per-file after the fact — across a codebase\n     *   already written — is the expensive version of the same question.\n     *\n     * Absent on a bundle built before this field existed, which is why every\n     * consumer must treat it as optional rather than as an empty list.\n     */\n    functions?: RebaseBundleFunction[];\n    hooks: {\n        /**\n         * Whether the dependency closure contains native code.\n         *\n         * The managed runtime refuses these: a prebuilt binary cannot be run on\n         * an image the platform did not build it for, and the honest failure is\n         * at deploy time rather than at 3am in a crash loop.\n         */\n        native: boolean;\n        nativeModules?: NativeDependency[];\n    };\n    /**\n     * What the bundle's config says about storage access control.\n     *\n     * Storage is not under RLS and its keys share one flat namespace, so a\n     * deployment with file storage enabled and no access model serves every\n     * user's files to every signed-in user. The runtime refuses to boot in that\n     * state — which, on a hosted platform that enables storage from the *console*\n     * rather than from the bundle, surfaces as a crash loop the developer cannot\n     * read.\n     *\n     * Recording it here lets a host reject the deploy with the reason instead.\n     * Absent on bundles built before this field existed.\n     */\n    storage?: {\n        /** Whether the config package exports a `storageAuthorize` hook. */\n        authorize: boolean;\n        /**\n         * Buckets, on bundles built before {@link RebaseBundleManifest.resources}.\n         *\n         * No longer written. A host reads `resources`, which carries every kind\n         * in one list; this stays declared so a control plane can keep reading\n         * the bundles a project shipped before it was rebuilt.\n         */\n        sources?: StorageSourceDefinition[];\n    };\n    /**\n     * Everything the project declares it needs — databases, buckets, topics,\n     * and whatever kind is registered next.\n     *\n     * Recorded so a host can tell, from the artifact alone and before starting\n     * anything, what a deploy will need provisioned. That question used to be\n     * answerable for buckets and for nothing else, because buckets were the\n     * only kind written into an artifact — which is how a project's databases\n     * became invisible to the platform that runs them.\n     *\n     * Absent on bundles built before this field existed.\n     */\n    resources?: ResourceGraph;\n    deps: {\n        /** Runtime dependencies of user code, as declared. */\n        declared: Record<string, string>;\n        /**\n         * The dependency tree ships *inside* the bundle, already installed.\n         *\n         * Absent or false means the tree is declared but not present, and\n         * whoever boots the bundle has to install it. On the managed runtime that\n         * install runs in an init container on **every** pod start — the bundle\n         * lives on a volume that is wiped each time — and it is the single\n         * largest cost in a managed pod's life: 35–55 seconds of a 40–60 second\n         * cold start. Since a pod restarts on every eviction, node failure, OOM\n         * and runtime rollout, that number is not a startup detail. It is what an\n         * outage costs.\n         *\n         * Vendoring moves the install to build time, where it happens once. It is\n         * skipped when the closure contains native code, because a prebuilt\n         * binary is only valid for the platform it was built for — see\n         * {@link vendorTarget} for what \"the platform\" means here.\n         */\n        vendored?: boolean;\n        /**\n         * What {@link vendored} was resolved for, recorded so a mismatch can be\n         * refused rather than discovered at import time.\n         *\n         * Cross-platform vendoring is safe for pure JavaScript and unsafe for\n         * anything compiled, and the boundary between them is not always visible\n         * in a dependency list: `esbuild` is pure-JS with a *platform-specific\n         * optional dependency* holding the actual binary, so an install run on a\n         * developer's Mac silently produces a tree that cannot run on the Linux\n         * image. The install therefore resolves optional dependencies for the\n         * target explicitly rather than for the machine it runs on, and records\n         * the answer here.\n         */\n        vendorTarget?: {\n            /** npm `--os`, e.g. `linux`. */\n            os: string;\n            /** npm `--cpu`, e.g. `x64`. */\n            cpu: string;\n            /** Node major the tree was resolved for. */\n            node: string;\n        };\n    };\n    build: {\n        /** `@rebasepro/cli` version that produced this bundle. */\n        cli: string;\n        /** Node major the bundle was compiled on. */\n        node: string;\n        /** ISO-8601. */\n        createdAt: string;\n    };\n}\n\n/** The contract a running backend serves at `GET /api/meta/contract`. */\nexport interface RebaseProjectContract {\n    /** Matches {@link RebaseBundleManifest.schemaVersion}. */\n    schemaVersion: string;\n    runtime: {\n        /** `@rebasepro/server` version currently running. */\n        version: string;\n        contract: number;\n    };\n    /** Full collection definitions, serialized — the input to SDK generation. */\n    collections: unknown[];\n    /** Collection slugs, for cheap inspection without parsing the definitions. */\n    collectionSlugs: string[];\n    generatedAt: string;\n}\n\n/** Header carrying the schema version an SDK was generated from. */\nexport const SCHEMA_VERSION_HEADER = \"x-rebase-schema\";\n","import type { CollectionConfig } from \"./collections\";\n\n/**\n * Serializing collections so they survive a network hop.\n *\n * A collection definition is not plain data. Relations point at their target\n * with a *function* (`target: () => usersCollection`) so two collections can\n * reference each other without an import cycle, and collections also carry\n * callbacks, custom views and component references. `JSON.stringify` silently\n * drops every one of those, which matters because the SDK generator *calls*\n * `relation.target()` to decide whether a foreign key is a string or a number.\n * Serialize naively and remote SDK generation produces subtly wrong types\n * instead of failing — the worst possible outcome.\n *\n * So relation targets are resolved to a slug reference on the way out and\n * rebuilt into functions on the way in. Everything else that cannot cross a wire\n * is dropped deliberately: an SDK is generated from the *shape* of the data, and\n * server-side behaviour is neither useful to a client nor safe to publish.\n */\n\n/** Marker replacing a relation's `target` function in serialized form. */\nexport interface SerializedCollectionRef {\n    __collectionRef: string;\n}\n\nexport function isSerializedCollectionRef(value: unknown): value is SerializedCollectionRef {\n    return typeof value === \"object\"\n        && value !== null\n        && typeof (value as SerializedCollectionRef).__collectionRef === \"string\";\n}\n\n/** Depth limit for the walk — deep enough for real configs, finite for cyclic ones. */\nconst MAX_DEPTH = 64;\n\n/**\n * Resolve whatever a `target` thunk returns down to a collection.\n *\n * A target may be the collection, a module namespace (when the authoring file\n * used `import * as`), or a default-export wrapper. All three appear in real\n * projects, and the SDK generator already unwraps them the same way.\n */\nfunction unwrapTarget(value: unknown): CollectionConfig | undefined {\n    if (!value || typeof value !== \"object\") return undefined;\n    const candidate = value as { default?: unknown; __esModule?: boolean; properties?: unknown };\n    if (candidate.default || candidate.__esModule) {\n        const inner = candidate.default;\n        if (inner && typeof inner === \"object\") return inner as CollectionConfig;\n    }\n    if (candidate.properties) return value as CollectionConfig;\n    return undefined;\n}\n\n/** The identity a serialized reference uses. Slug first — it is the routing key. */\nfunction refFor(collection: CollectionConfig | undefined): string | undefined {\n    if (!collection) return undefined;\n    const withPath = collection as CollectionConfig & { path?: string };\n    return collection.slug || withPath.path || collection.name;\n}\n\n/**\n * Deep-copy a value into something JSON can carry.\n *\n * `target` keys are special-cased into refs. Other functions vanish, cycles are\n * cut, and everything else is copied structurally.\n */\n/** Shared walk state: the memo, plus a count of depth-cap hits. */\ninterface WalkState {\n    memo: WeakMap<object, unknown>;\n    /**\n     * How many times the walk has truncated a subtree — by hitting the depth\n     * cap, or by cutting a cycle.\n     *\n     * Either kind of truncation makes a result valid only at the *position* it\n     * was produced at, so caching it and serving it elsewhere silently drops\n     * content that would have been included. Comparing this counter before and\n     * after a node's children tells us whether its result is position-\n     * independent and therefore safe to memoize.\n     *\n     * The cycle case is the subtle one: with `a.b = b` and `b.a = a`, serializing\n     * `{ first: b, second: a }` visits `a` beneath `b` — where the cycle back to\n     * `b` is cut — and would then reuse that truncated `a` for `second`, where\n     * nothing needed cutting.\n     */\n    truncations: number;\n}\n\nfunction toSerializable(\n    value: unknown,\n    seen: WeakSet<object>,\n    depth: number,\n    state: WalkState,\n    key?: string\n): unknown {\n    if (depth > MAX_DEPTH) {\n        state.truncations++;\n        return undefined;\n    }\n\n    if (typeof value === \"function\") {\n        // Only a relation target carries information a client needs. Calling it\n        // is safe here — this runs on the server, where the target module is\n        // already loaded — and a throwing target simply yields no reference,\n        // which degrades the generated FK type rather than failing the request.\n        if (key === \"target\") {\n            try {\n                const resolved = unwrapTarget((value as () => unknown)());\n                const ref = refFor(resolved);\n                return ref ? { __collectionRef: ref } : undefined;\n            } catch {\n                return undefined;\n            }\n        }\n        return undefined;\n    }\n\n    if (value === null || typeof value !== \"object\") {\n        return value;\n    }\n\n    if (value instanceof Date) return value.toISOString();\n    if (value instanceof RegExp) return value.source;\n\n    if (seen.has(value as object)) {\n        state.truncations++;\n        return undefined;\n    }\n\n    // A shared (non-cyclic) subgraph is reachable by many paths, and `seen` is a\n    // *path* set — released in the `finally` below so a node referenced twice in\n    // different branches is emitted twice rather than dropped as a false cycle.\n    // Without memoization that makes the walk exponential in depth: a diamond\n    // graph 20 levels deep took ~400ms, and each further level doubled it. The\n    // result is a plain data tree, so handing back the same converted object for\n    // a repeat visit is indistinguishable after JSON.stringify.\n    const cached = state.memo.get(value as object);\n    if (cached !== undefined) return cached;\n\n    seen.add(value as object);\n    const truncationsBefore = state.truncations;\n    const memoize = (result: unknown): unknown => {\n        // Only cache a result that nothing was cut from.\n        if (result !== undefined && state.truncations === truncationsBefore) {\n            state.memo.set(value as object, result);\n        }\n        return result;\n    };\n\n    try {\n        if (Array.isArray(value)) {\n            const items = value\n                .map(item => toSerializable(item, seen, depth + 1, state))\n                .filter(item => item !== undefined);\n            // A container that had content, none of which can be represented, is\n            // itself unrepresentable — see the note below.\n            return memoize(value.length > 0 && items.length === 0 ? undefined : items);\n        }\n\n        // A React element or component reference has no meaning to a client and\n        // will not survive JSON anyway.\n        if (\"$$typeof\" in (value as Record<string, unknown>)) return undefined;\n\n        const entries = Object.entries(value as Record<string, unknown>);\n        const out: Record<string, unknown> = {};\n        for (const [k, v] of entries) {\n            const converted = toSerializable(v, seen, depth + 1, state, k);\n            if (converted !== undefined) out[k] = converted;\n        }\n\n        // Drop a container whose entire content was dropped.\n        //\n        // `callbacks: { beforeSave() {…} }` would otherwise serialize to\n        // `callbacks: {}` — an empty husk that carries no information but is not\n        // *nothing*, so it lands in the payload and, worse, in the schema hash.\n        // Editing a hook would then change every client's schema version and\n        // report perfectly current SDKs as stale.\n        //\n        // A container that started empty stays empty: `properties: {}` is a\n        // deliberate statement, not a casualty.\n        if (entries.length > 0 && Object.keys(out).length === 0) return undefined;\n\n        return memoize(out);\n    } finally {\n        // Released so a collection referenced twice in different branches is\n        // emitted twice rather than being dropped as a false cycle.\n        seen.delete(value as object);\n    }\n}\n\n/**\n * Serialize collections for transport over the contract endpoint.\n *\n * Sorted by slug so the output — and therefore the schema hash computed from it\n * — does not depend on filesystem ordering.\n */\nexport function serializeCollections(collections: CollectionConfig[]): unknown[] {\n    return [...collections]\n        .sort((a, b) => String(a.slug ?? \"\").localeCompare(String(b.slug ?? \"\")))\n        .map(collection => toSerializable(withoutAdminBlock(collection), new WeakSet(), 0, {\n            memo: new WeakMap(),\n            truncations: 0\n        }))\n        .filter((c): c is Record<string, unknown> => c !== undefined);\n}\n\n/**\n * Drop the admin block before the walk.\n *\n * Nothing downstream of serialization is an admin panel. The contract endpoint\n * feeds remote SDK generation, and `rebase build` writes the result into a bundle\n * manifest that only the backend runtime reads. The block would survive the walk\n * as a husk anyway — its React elements and component functions are dropped\n * individually — and that husk has two costs worth avoiding: it puts every custom\n * component's *file path* on an endpoint whose job is to describe data shapes, and\n * it grows a payload that is fetched and cached per project.\n *\n * Removing it here rather than at each call site means one chokepoint, so a future\n * consumer of `serializeCollections` cannot forget.\n *\n * Child collections carry their own block, so this recurses — stripping only the\n * top level was the mistake `stripNonClientFields` in the contract routes already\n * had to fix once for security rules.\n */\nfunction withoutAdminBlock(collection: CollectionConfig): CollectionConfig {\n    const { admin: _admin, ...rest } = collection as CollectionConfig & Record<string, unknown>;\n    const nested = rest as Record<string, unknown>;\n    if (Array.isArray(nested.subcollections)) {\n        nested.subcollections = nested.subcollections.map(\n            (child) => withoutAdminBlock(child as CollectionConfig)\n        );\n    }\n    return rest as CollectionConfig;\n}\n\n/**\n * Rebuild collections received from a contract endpoint.\n *\n * Relation refs become real thunks resolving through the returned set, so\n * downstream consumers — the SDK generator above all — see exactly the shape\n * they would have seen had the collections been imported from source.\n *\n * A ref naming a collection that is not in the payload resolves to `undefined`\n * rather than throwing: the generator already tolerates an unresolvable target\n * by falling back to a permissive key type, and a partial contract should still\n * produce a usable SDK.\n */\nexport function deserializeCollections(payload: unknown[]): CollectionConfig[] {\n    const collections = payload\n        .filter((c): c is Record<string, unknown> => typeof c === \"object\" && c !== null)\n        .map(c => ({ ...c })) as unknown as CollectionConfig[];\n\n    const bySlug = new Map<string, CollectionConfig>();\n    for (const collection of collections) {\n        const ref = refFor(collection);\n        if (ref) bySlug.set(ref, collection);\n    }\n\n    const rehydrate = (value: unknown, depth: number): void => {\n        if (depth > MAX_DEPTH || !value || typeof value !== \"object\") return;\n\n        if (Array.isArray(value)) {\n            for (const item of value) rehydrate(item, depth + 1);\n            return;\n        }\n\n        const record = value as Record<string, unknown>;\n        for (const [key, child] of Object.entries(record)) {\n            if (key === \"target\" && isSerializedCollectionRef(child)) {\n                const slug = child.__collectionRef;\n                record.target = () => bySlug.get(slug);\n                continue;\n            }\n            rehydrate(child, depth + 1);\n        }\n    };\n\n    for (const collection of collections) rehydrate(collection, 0);\n    return collections;\n}\n","import type { CollectionConfig } from \"./collections\";\nimport { serializeCollections } from \"./collection_contract\";\n\n/**\n * The schema version stamp.\n *\n * One function, used in three places that must agree or the whole drift-detection\n * story is noise: `rebase build` writes it into a bundle manifest, the runtime\n * serves it from the contract endpoint, and a generated SDK records the value it\n * was built from. If any two of those computed it differently, every client would\n * look permanently out of date.\n *\n * It covers **collections only** — the client's contract is the shape of the\n * data, so editing a hook or a server function must not invalidate every SDK in\n * every repository. That is a deliberate narrowing, not an oversight.\n */\n\n/** Stable stringify: object keys sorted at every level, so key order cannot alter the hash. */\nfunction canonicalize(value: unknown): string {\n    if (value === null || typeof value !== \"object\") {\n        return JSON.stringify(value) ?? \"null\";\n    }\n    if (Array.isArray(value)) {\n        return `[${value.map(canonicalize).join(\",\")}]`;\n    }\n    const entries = Object.entries(value as Record<string, unknown>)\n        .filter(([, v]) => v !== undefined)\n        .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));\n    return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${canonicalize(v)}`).join(\",\")}}`;\n}\n\n/**\n * Reduce a collection to the parts a generated client is actually built from.\n *\n * The version answers one question — \"is this SDK stale?\" — so it must change\n * exactly when the generated types could change, and never otherwise. Hashing a\n * whole collection fails both halves of that:\n *\n * - Security rules, callbacks, icons, groups and UI settings do not appear in a\n *   generated client, so including them reports perfectly current SDKs as stale.\n * - Worse, they are not stable *inputs*. The runtime applies default security\n *   rules when it loads collections, so the same source hashed before and after\n *   loading produced two different answers — a build-time stamp that could never\n *   match the server that served it.\n *\n * Codegen reads the slug (for the `Database` key and type names), the properties,\n * and the relations. That is the projection.\n */\nfunction projectForCodegen(collection: CollectionConfig): Record<string, unknown> {\n    const source = collection as CollectionConfig & {\n        relations?: unknown;\n        subcollections?: CollectionConfig[];\n        path?: string;\n        engine?: unknown;\n        dataSource?: unknown;\n    };\n\n    return {\n        slug: collection.slug ?? source.path,\n        properties: collection.properties,\n        relations: source.relations,\n        // The engine decides whether relations are resolved at all: codegen asks\n        // `getDataSourceCapabilities(collection.engine).supportsRelations`, and an\n        // engine that answers no drops every foreign-key column from the\n        // generated Row/Insert/Update types. Moving a collection to such an\n        // engine is a real change to the generated types, so it has to move the\n        // version. `dataSource` is what resolves to `engine`, so it counts too.\n        engine: source.engine,\n        dataSource: source.dataSource,\n        subcollections: source.subcollections?.map(projectForCodegen)\n    };\n}\n\n/**\n * Compute the canonical string a schema version hashes.\n *\n * Exposed separately so the hashing itself can differ by environment: Node has\n * `crypto`, and callers without it can still compare canonical forms directly.\n */\nexport function canonicalSchemaPayload(collections: CollectionConfig[]): string {\n    const projected = serializeCollections(collections)\n        .map(collection => projectForCodegen(collection as CollectionConfig));\n    return canonicalize(projected);\n}\n\n/**\n * A short, non-cryptographic digest of the canonical payload.\n *\n * FNV-1a style, 64 bits, as two 32-bit halves. This is an identity, not a\n * security boundary: nothing trusts a schema version to prove anything, it only\n * answers \"is this the same schema as before\". A hand-rolled hash keeps this\n * module free of `node:crypto`, so the identical function runs in the browser,\n * in the CLI, and in the runtime — which is the property that actually matters.\n */\nexport function computeSchemaVersion(collections: CollectionConfig[]): string {\n    const payload = canonicalSchemaPayload(collections);\n\n    let h1 = 0x811c9dc5;\n    let h2 = 0x01000193;\n\n    for (let i = 0; i < payload.length; i++) {\n        const code = payload.charCodeAt(i);\n        h1 ^= code;\n        // Multiply by the FNV prime using shifts to stay in 32-bit integer math.\n        h1 = (h1 + ((h1 << 1) + (h1 << 4) + (h1 << 7) + (h1 << 8) + (h1 << 24))) >>> 0;\n        h2 ^= code + i;\n        h2 = (h2 + ((h2 << 1) + (h2 << 5) + (h2 << 9) + (h2 << 15) + (h2 << 24))) >>> 0;\n    }\n\n    const hex = (n: number): string => n.toString(16).padStart(8, \"0\");\n    return `v1:${hex(h1)}${hex(h2)}`;\n}\n","import { Hono } from \"hono\";\nimport {\n    RUNTIME_CONTRACT_VERSION,\n    SCHEMA_VERSION_HEADER,\n    computeSchemaVersion,\n    serializeCollections,\n    type CollectionConfig,\n    type RebaseProjectContract\n} from \"@rebasepro/types\";\nimport type { HonoEnv } from \"./types\";\nimport { logger } from \"../utils/logger\";\n\n/**\n * The project contract endpoint.\n *\n * This is what makes a repository able to build against a project it does not\n * contain. Without it, a typed client can only be generated from local\n * collection *source*, which means every frontend must live in the same\n * repository as the backend. Serving the contract turns that around: an app\n * asks the project what its shape is, so a web app, a second web app and a\n * mobile app can each live wherever they like and none of them needs to know\n * about the others.\n *\n * Admin-gated. Collection definitions describe every table, column and relation\n * in the project, including ones no security rule would ever expose — that is a\n * map of the database, not public API documentation.\n */\n\nexport interface ContractRoutesConfig {\n    collectionRegistry: { getRawCollections(): CollectionConfig[] };\n    /**\n     * The schema version recorded at build time.\n     *\n     * Preferred over recomputing, so that what a client is told matches exactly\n     * what the bundle claims. It is recomputed only when a bundle did not record\n     * one — a `baas`-mode project derives its collections from the live database\n     * at boot, so there was nothing to hash when it was built.\n     */\n    schemaVersion?: string;\n    /** Runtime package version, surfaced so a client can report what it built against. */\n    runtimeVersion?: string;\n}\n\n/**\n * Strip everything a client does not need from a serialized collection.\n *\n * The generator reads the slug, the properties and the relations. It never reads\n * a security rule — but `securityRules` carries the raw SQL of every RLS\n * predicate guarding the project, which is a description of the authorization\n * model rather than of the data shape. Publishing it to anyone who can generate\n * an SDK gives away more than the endpoint is for, so it is removed here rather\n * than trusted not to matter.\n */\nfunction stripNonClientFields(collection: unknown): unknown {\n    if (!collection || typeof collection !== \"object\") return collection;\n    const {\n        securityRules: _securityRules,\n        callbacks: _callbacks,\n        ...rest\n    } = collection as Record<string, unknown>;\n\n    // Subcollections are collections, and carry their own rules. Stripping only\n    // the top level published every nested policy — the leak this exists to\n    // prevent, just one level down.\n    if (Array.isArray(rest.subcollections)) {\n        rest.subcollections = rest.subcollections.map(stripNonClientFields);\n    }\n\n    return rest;\n}\n\nexport function createContractRoutes(config: ContractRoutesConfig): Hono<HonoEnv> {\n    const router = new Hono<HonoEnv>();\n\n    // Computing a version walks and canonicalizes every collection, and\n    // `/schema-version` is deliberately unauthenticated and meant to be polled.\n    // Recomputing per request would make a CI convenience into a CPU\n    // amplification anyone could aim at the server. Collections do not change\n    // after boot, so once is enough.\n    let cachedVersion: string | undefined;\n    const schemaVersionOf = (collections: CollectionConfig[]): string => {\n        if (config.schemaVersion) return config.schemaVersion;\n        if (cachedVersion === undefined) cachedVersion = computeSchemaVersion(collections);\n        return cachedVersion;\n    };\n\n    router.get(\"/contract\", (c) => {\n        const collections = config.collectionRegistry.getRawCollections();\n        const serialized = serializeCollections(collections).map(stripNonClientFields);\n\n        // In `baas` mode the collections are whatever introspection found at\n        // boot, so the version has to be computed from them rather than taken\n        // from a build that never saw them.\n        const schemaVersion = schemaVersionOf(collections);\n\n        const contract: RebaseProjectContract = {\n            schemaVersion,\n            runtime: {\n                version: config.runtimeVersion ?? \"unknown\",\n                contract: RUNTIME_CONTRACT_VERSION\n            },\n            collections: serialized,\n            collectionSlugs: collections\n                .map(collection => collection.slug)\n                .filter((slug): slug is string => Boolean(slug))\n                .sort(),\n            generatedAt: new Date().toISOString()\n        };\n\n        c.header(SCHEMA_VERSION_HEADER, schemaVersion);\n        return c.json(contract);\n    });\n\n    /**\n     * Cheap drift check.\n     *\n     * Deliberately unauthenticated and deliberately tiny: it returns a version\n     * string and nothing else. A CI job that only wants to know whether its\n     * generated SDK is stale should not need admin credentials, and a version\n     * stamp reveals nothing about the schema it stands for.\n     */\n    router.get(\"/schema-version\", (c) => {\n        const schemaVersion = schemaVersionOf(config.collectionRegistry.getRawCollections());\n        c.header(SCHEMA_VERSION_HEADER, schemaVersion);\n        return c.json({ schemaVersion, });\n    });\n\n    logger.debug(\"Contract routes mounted\");\n    return router;\n}\n"],"mappings":";;;;;;;;;;AAqlBA,IAAa,wBAAwB;;;;ACrjBrC,IAAM,YAAY;;;;;;;;AASlB,SAAS,aAAa,OAA8C;CAChE,IAAI,CAAC,SAAS,OAAO,UAAU,UAAU,OAAO,KAAA;CAChD,MAAM,YAAY;CAClB,IAAI,UAAU,WAAW,UAAU,YAAY;EAC3C,MAAM,QAAQ,UAAU;EACxB,IAAI,SAAS,OAAO,UAAU,UAAU,OAAO;CACnD;CACA,IAAI,UAAU,YAAY,OAAO;AAErC;;AAGA,SAAS,OAAO,YAA8D;CAC1E,IAAI,CAAC,YAAY,OAAO,KAAA;CACxB,MAAM,WAAW;CACjB,OAAO,WAAW,QAAQ,SAAS,QAAQ,WAAW;AAC1D;AA6BA,SAAS,eACL,OACA,MACA,OACA,OACA,KACO;CACP,IAAI,QAAQ,WAAW;EACnB,MAAM;EACN;CACJ;CAEA,IAAI,OAAO,UAAU,YAAY;EAK7B,IAAI,QAAQ,UACR,IAAI;GAEA,MAAM,MAAM,OADK,aAAc,MAAwB,CACpC,CAAQ;GAC3B,OAAO,MAAM,EAAE,iBAAiB,IAAI,IAAI,KAAA;EAC5C,QAAQ;GACJ;EACJ;EAEJ;CACJ;CAEA,IAAI,UAAU,QAAQ,OAAO,UAAU,UACnC,OAAO;CAGX,IAAI,iBAAiB,MAAM,OAAO,MAAM,YAAY;CACpD,IAAI,iBAAiB,QAAQ,OAAO,MAAM;CAE1C,IAAI,KAAK,IAAI,KAAe,GAAG;EAC3B,MAAM;EACN;CACJ;CASA,MAAM,SAAS,MAAM,KAAK,IAAI,KAAe;CAC7C,IAAI,WAAW,KAAA,GAAW,OAAO;CAEjC,KAAK,IAAI,KAAe;CACxB,MAAM,oBAAoB,MAAM;CAChC,MAAM,WAAW,WAA6B;EAE1C,IAAI,WAAW,KAAA,KAAa,MAAM,gBAAgB,mBAC9C,MAAM,KAAK,IAAI,OAAiB,MAAM;EAE1C,OAAO;CACX;CAEA,IAAI;EACA,IAAI,MAAM,QAAQ,KAAK,GAAG;GACtB,MAAM,QAAQ,MACT,KAAI,SAAQ,eAAe,MAAM,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CACzD,QAAO,SAAQ,SAAS,KAAA,CAAS;GAGtC,OAAO,QAAQ,MAAM,SAAS,KAAK,MAAM,WAAW,IAAI,KAAA,IAAY,KAAK;EAC7E;EAIA,IAAI,cAAe,OAAmC,OAAO,KAAA;EAE7D,MAAM,UAAU,OAAO,QAAQ,KAAgC;EAC/D,MAAM,MAA+B,CAAC;EACtC,KAAK,MAAM,CAAC,GAAG,MAAM,SAAS;GAC1B,MAAM,YAAY,eAAe,GAAG,MAAM,QAAQ,GAAG,OAAO,CAAC;GAC7D,IAAI,cAAc,KAAA,GAAW,IAAI,KAAK;EAC1C;EAYA,IAAI,QAAQ,SAAS,KAAK,OAAO,KAAK,GAAG,CAAC,CAAC,WAAW,GAAG,OAAO,KAAA;EAEhE,OAAO,QAAQ,GAAG;CACtB,UAAU;EAGN,KAAK,OAAO,KAAe;CAC/B;AACJ;;;;;;;AAQA,SAAgB,qBAAqB,aAA4C;CAC7E,OAAO,CAAC,GAAG,WAAW,CAAC,CAClB,MAAM,GAAG,MAAM,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,cAAc,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CACxE,KAAI,eAAc,eAAe,kBAAkB,UAAU,mBAAG,IAAI,QAAQ,GAAG,GAAG;EAC/E,sBAAM,IAAI,QAAQ;EAClB,aAAa;CACjB,CAAC,CAAC,CAAC,CACF,QAAQ,MAAoC,MAAM,KAAA,CAAS;AACpE;;;;;;;;;;;;;;;;;;;AAoBA,SAAS,kBAAkB,YAAgD;CACvE,MAAM,EAAE,OAAO,QAAQ,GAAG,SAAS;CACnC,MAAM,SAAS;CACf,IAAI,MAAM,QAAQ,OAAO,cAAc,GACnC,OAAO,iBAAiB,OAAO,eAAe,KACzC,UAAU,kBAAkB,KAAyB,CAC1D;CAEJ,OAAO;AACX;;;;;;;;;;;;;;;;;ACrNA,SAAS,aAAa,OAAwB;CAC1C,IAAI,UAAU,QAAQ,OAAO,UAAU,UACnC,OAAO,KAAK,UAAU,KAAK,KAAK;CAEpC,IAAI,MAAM,QAAQ,KAAK,GACnB,OAAO,IAAI,MAAM,IAAI,YAAY,CAAC,CAAC,KAAK,GAAG,EAAE;CAKjD,OAAO,IAHS,OAAO,QAAQ,KAAgC,CAAC,CAC3D,QAAQ,GAAG,OAAO,MAAM,KAAA,CAAS,CAAC,CAClC,MAAM,CAAC,IAAI,CAAC,OAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CACvC,CAAA,CAAQ,KAAK,CAAC,GAAG,OAAO,GAAG,KAAK,UAAU,CAAC,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE;AAC5F;;;;;;;;;;;;;;;;;;AAmBA,SAAS,kBAAkB,YAAuD;CAC9E,MAAM,SAAS;CAQf,OAAO;EACH,MAAM,WAAW,QAAQ,OAAO;EAChC,YAAY,WAAW;EACvB,WAAW,OAAO;EAOlB,QAAQ,OAAO;EACf,YAAY,OAAO;EACnB,gBAAgB,OAAO,gBAAgB,IAAI,iBAAiB;CAChE;AACJ;;;;;;;AAQA,SAAgB,uBAAuB,aAAyC;CAG5E,OAAO,aAFW,qBAAqB,WAAW,CAAC,CAC9C,KAAI,eAAc,kBAAkB,UAA8B,CACnD,CAAS;AACjC;;;;;;;;;;AAWA,SAAgB,qBAAqB,aAAyC;CAC1E,MAAM,UAAU,uBAAuB,WAAW;CAElD,IAAI,KAAK;CACT,IAAI,KAAK;CAET,KAAK,IAAI,IAAI,GAAG,IAAI,QAAQ,QAAQ,KAAK;EACrC,MAAM,OAAO,QAAQ,WAAW,CAAC;EACjC,MAAM;EAEN,KAAM,OAAO,MAAM,MAAM,MAAM,MAAM,MAAM,MAAM,MAAM,MAAM,MAAM,SAAU;EAC7E,MAAM,OAAO;EACb,KAAM,OAAO,MAAM,MAAM,MAAM,MAAM,MAAM,MAAM,MAAM,OAAO,MAAM,SAAU;CAClF;CAEA,MAAM,OAAO,MAAsB,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG;CACjE,OAAO,MAAM,IAAI,EAAE,IAAI,IAAI,EAAE;AACjC;;;;;;;;;;;;;;AC1DA,SAAS,qBAAqB,YAA8B;CACxD,IAAI,CAAC,cAAc,OAAO,eAAe,UAAU,OAAO;CAC1D,MAAM,EACF,eAAe,gBACf,WAAW,YACX,GAAG,SACH;CAKJ,IAAI,MAAM,QAAQ,KAAK,cAAc,GACjC,KAAK,iBAAiB,KAAK,eAAe,IAAI,oBAAoB;CAGtE,OAAO;AACX;AAEA,SAAgB,qBAAqB,QAA6C;CAC9E,MAAM,SAAS,IAAI,KAAc;CAOjC,IAAI;CACJ,MAAM,mBAAmB,gBAA4C;EACjE,IAAI,OAAO,eAAe,OAAO,OAAO;EACxC,IAAI,kBAAkB,KAAA,GAAW,gBAAgB,qBAAqB,WAAW;EACjF,OAAO;CACX;CAEA,OAAO,IAAI,cAAc,MAAM;EAC3B,MAAM,cAAc,OAAO,mBAAmB,kBAAkB;EAChE,MAAM,aAAa,qBAAqB,WAAW,CAAC,CAAC,IAAI,oBAAoB;EAK7E,MAAM,gBAAgB,gBAAgB,WAAW;EAEjD,MAAM,WAAkC;GACpC;GACA,SAAS;IACL,SAAS,OAAO,kBAAkB;IAClC,UAAA;GACJ;GACA,aAAa;GACb,iBAAiB,YACZ,KAAI,eAAc,WAAW,IAAI,CAAC,CAClC,QAAQ,SAAyB,QAAQ,IAAI,CAAC,CAAC,CAC/C,KAAK;GACV,8BAAa,IAAI,KAAK,EAAA,CAAE,YAAY;EACxC;EAEA,EAAE,OAAO,uBAAuB,aAAa;EAC7C,OAAO,EAAE,KAAK,QAAQ;CAC1B,CAAC;;;;;;;;;CAUD,OAAO,IAAI,oBAAoB,MAAM;EACjC,MAAM,gBAAgB,gBAAgB,OAAO,mBAAmB,kBAAkB,CAAC;EACnF,EAAE,OAAO,uBAAuB,aAAa;EAC7C,OAAO,EAAE,KAAK,EAAE,cAAe,CAAC;CACpC,CAAC;CAED,OAAO,MAAM,yBAAyB;CACtC,OAAO;AACX"}
+{"version":3,"file":"contract-routes-CHPVKTZW.js","names":[],"sources":["../../types/src/types/project_manifest.ts","../../types/src/types/collection_contract.ts","../../types/src/types/schema_version.ts","../src/api/contract-routes.ts"],"sourcesContent":["/**\n * The project manifest (`rebase.json`) and the build artifacts derived from it.\n *\n * Three separate documents live in this file, and keeping them distinct matters:\n *\n * 1. {@link RebaseProjectManifest} — `rebase.json`. **Authored** by the developer,\n *    committed to the repository. Declares topology only: which runtime major the\n *    project targets, and which apps *this repository* contributes to the project.\n *    Schema, security rules, hooks and functions stay in TypeScript under the\n *    config package — nothing that needs a type system belongs here.\n *\n * 2. {@link RebaseProjectLink} — the per-checkout link (`.rebase/cloud.json`).\n *    **Not committed**, because it is per-developer like a git remote. Says which\n *    deployed project this working copy points at, whether that is a Rebase Cloud\n *    project or the base URL of a self-hosted backend.\n *\n * 3. {@link RebaseBundleManifest} — `manifest.json` inside a built bundle.\n *    **Generated**, never hand-edited. It is the lockfile analogue: the exact\n *    contract a built artifact claims to satisfy, which the runtime validates\n *    before it boots and a control plane validates before it deploys.\n *\n * A repository declares only the apps it contains. The set of apps belonging to a\n * project is held by the project itself, which is what makes multi-repo projects\n * work: two repositories never need to know about each other, only about the\n * project.\n */\n\nimport type { StorageSourceDefinition } from \"./storage_source\";\nimport type { ResourceGraph } from \"./resources\";\n\n/**\n * Which kind of thing an app is.\n *\n * - `backend` — the collections/hooks/functions that define the project's API.\n *   Exactly one per *project* (not per repository); the registry enforces it.\n * - `static`  — a pre-built client bundle (SPA, static site), served from the\n *   backend process at its declared `path` or from a CDN. The admin panel is\n *   one of these: it is an app in the user's repository like any other.\n *\n * That is the whole list. Ownership of the server process is a property of the\n * backend app ({@link RebaseBackendAppConfig.runtime}), not an app type.\n */\nexport type RebaseAppType = \"backend\" | \"static\";\n\n/**\n * The backend app: the project's API surface.\n *\n * Paths are relative to the directory holding `rebase.json`. The defaults match\n * the layout `rebase init` scaffolds, so a stock project may declare simply\n * `{ \"type\": \"backend\", \"runtime\": \"managed\" }`.\n */\nexport interface RebaseBackendAppConfig {\n    type: \"backend\";\n    /**\n     * Who owns the process this backend runs in.\n     *\n     * - `managed` — the platform's runtime image boots this project's bundle.\n     *   You supply collections, functions, crons and schema; Rebase supplies the\n     *   server.\n     * - `custom` — this repository builds its own image and entrypoint. The\n     *   escape hatch: full control, no managed-runtime guarantees.\n     *\n     * Independent of *where* it runs. Both run on Rebase Cloud and both\n     * self-host — the destination lives in `.rebase/cloud.json`, not here. See\n     * `infra/docker/docker-compose.selfhost.yml`, which boots a managed bundle on a\n     * developer's own Docker host.\n     *\n     * This is authored rather than inferred on purpose. It is the single most\n     * consequential fact about a deployment, and inferring it is what used to\n     * land projects on the custom runtime without anyone choosing it.\n     */\n    runtime: \"managed\" | \"custom\";\n    /** Directory of the config package (collections + index). Default `config`. */\n    config?: string;\n    /** Directory of server functions. Default `backend/functions`. */\n    functions?: string;\n    /** Directory of cron job definitions. Default `backend/crons` when present. */\n    crons?: string;\n    /**\n     * Path to the generated Drizzle schema module (tables/enums/relations).\n     * Default `backend/src/schema.generated.ts`.\n     */\n    schema?: string;\n    /**\n     * Module path (relative to `config`) exporting the auth users collection as\n     * its default export. Default `collections/users`.\n     */\n    usersCollection?: string;\n\n    /**\n     * `runtime: \"custom\"` only. Dockerfile path relative to the repository root.\n     * Default `Dockerfile`.\n     */\n    dockerfile?: string;\n    /** `runtime: \"custom\"` only. Build context relative to the root. Default `.`. */\n    context?: string;\n    /** `runtime: \"custom\"` only. Port the container listens on. Default 8080. */\n    port?: number;\n}\n\n/**\n * A static client bundle — SPA or static site — built here and served at `path`.\n */\nexport interface RebaseStaticAppConfig {\n    type: \"static\";\n    /** Package directory containing the client sources. */\n    root: string;\n    /** Command that produces `output`. Run from the repository root. */\n    build?: string;\n    /** Directory of built assets, relative to the repository root. */\n    output: string;\n    /**\n     * Public base path this app is served under. Default `/`.\n     *\n     * Several static apps run in one process, each at its own path — the API at\n     * `/api`, a site at `/`, the admin at `/admin` — which is what keeps a\n     * self-hosted deployment a single container.\n     *\n     * **This is a build-time input, not only a serving concern.** An app mounted\n     * at `/admin` must be *built* for `/admin` (Vite's `base`), or `index.html`\n     * loads and every asset 404s: a blank page with no server error. `rebase\n     * build` passes it as `REBASE_APP_BASE` and asserts the emitted HTML honours\n     * it. Changing this value requires rebuilding the app.\n     */\n    path?: string;\n    /**\n     * Serve `index.html` for unmatched paths under `path` (client-side routing).\n     * Default `true` — the overwhelmingly common case for a client app, and a\n     * static *site* generator emits real files for its routes anyway.\n     */\n    spa?: boolean;\n}\n\nexport type RebaseAppConfig = RebaseBackendAppConfig | RebaseStaticAppConfig;\n\n/**\n * Path prefixes the backend owns, which no static app may claim.\n *\n * One process — and, on the platform, one hostname — serves both the API and\n * however many static apps a project has. Mounting is longest-path-first, so an\n * app declaring `/api` would win against the API itself and every request to it\n * would be answered with that app's `index.html`: a 200 carrying HTML where the\n * caller expected JSON, from a project that looks deployed and healthy.\n *\n * Declared here rather than in either enforcer because both must agree. The CLI\n * checks it so a developer finds out while editing `rebase.json`; the control\n * plane checks it again at deploy intake, because the front door's correctness\n * cannot rest on a check that ran in somebody else's CLI — and a repository can\n * be deployed by a CLI older than this rule.\n */\nexport const RESERVED_BACKEND_PREFIXES = [\"/api\", \"/health\", \"/healthz\", \"/livez\", \"/readyz\", \"/metrics\"] as const;\n\n/**\n * Whether `path` collides with a prefix the backend owns.\n *\n * Compares at segment boundaries, so `/api` and `/api/v2` collide while\n * `/apidocs` does not — the same rule the router matches with, because a check\n * that is stricter than the router rejects paths that would have worked, and one\n * that is looser admits paths that will not.\n */\nexport function reservedPrefixFor(path: string): string | undefined {\n    const normalized = path.endsWith(\"/\") && path !== \"/\" ? path.slice(0, -1) : path;\n    return RESERVED_BACKEND_PREFIXES.find(\n        reserved => normalized === reserved || normalized.startsWith(`${reserved}/`)\n    );\n}\n\n/**\n * One declared storage source, as authored in `rebase.json`.\n *\n * The key comes from the enclosing record, so this is\n * {@link StorageSourceDefinition} minus its `key` — the same document the\n * runtime registry and the frontend router consume, expressed the way a JSON\n * object naturally expresses \"a set of named things\".\n */\nexport interface RebaseStorageSourceConfig {\n    /** Engine backing this source: `local`, `s3`, `gcs`, or a custom id. */\n    engine: string;\n    /**\n     * How the frontend reaches it. Default `server` (proxied through\n     * `/api/storage`). `direct` means a provider SDK talks to the bucket and the\n     * backend is not in the upload path.\n     */\n    transport?: \"server\" | \"direct\";\n    /** Human-readable label for the console and the admin UI. */\n    label?: string;\n}\n\n/**\n * `rebase.json` — the authored project manifest.\n */\nexport interface RebaseProjectManifest {\n    /** JSON Schema URL, for editor completion. Ignored by the tooling. */\n    $schema?: string;\n    /**\n     * The runtime contract **major** this project targets, as a semver range\n     * (e.g. `^1`, `~1.4`, or an exact `1.4.2` to pin).\n     *\n     * The platform upgrades patches and minors underneath a project without\n     * asking; it never crosses a major. See {@link RUNTIME_CONTRACT_VERSION}.\n     *\n     * Named `rebase` rather than `runtime` so that `runtime` means exactly one\n     * thing — {@link RebaseBackendAppConfig.runtime}, who owns the process. It\n     * reads like `engines` in a `package.json`, which is what it is.\n     */\n    rebase: string;\n    /**\n     * Apps this repository contributes, keyed by app name. The key is the app's\n     * identity within the project: it is what `rebase deploy <app>` names, what\n     * client credentials are issued against, and what a second repository must\n     * not collide with.\n     */\n    apps: Record<string, RebaseAppConfig>;\n    /**\n     * Buckets are NOT declared here any more.\n     *\n     * They were, and the runtime merged this block with the declarations in\n     * config code — a bucket named in both had one engine kept and the other\n     * silently discarded. Two homes for one concept, with a merge to decide\n     * between them, is the shape this whole model replaced.\n     *\n     * `bucket(\"media\", { engine: \"s3\" })` in the project's config declares one\n     * now, and `rebase resources --write` generates `rebase.resources.json`,\n     * which is what a host reads before a build. A `storage` block left in this\n     * file is refused by the validator, by name, with the replacement in the\n     * message — not ignored, because a key that still parses and does nothing\n     * is the failure this removed.\n     */\n    /**\n     * Repository-wide opt-out from anonymous CLI usage sharing.\n     *\n     * **Only `false` does anything.** It suppresses sharing for everyone who\n     * clones this repository, overriding each developer's own opt-in — an\n     * organisation setting policy for work done on its behalf, the same shape\n     * as a committed `.npmrc`.\n     *\n     * `true` is deliberately ignored, and the CLI says so rather than obeying\n     * quietly. This file is committed, so a `true` here would be one developer\n     * answering a privacy question for every colleague who later clones the\n     * repo — consent by proxy, which is the exact thing opt-in exists to\n     * prevent. Individuals opt in with `rebase telemetry enable`.\n     */\n    telemetry?: boolean;\n}\n\n/**\n * The per-checkout project link.\n *\n * Deliberately separate from `rebase.json`: the manifest is committed and shared,\n * while the link is per-developer. Keeping them in one file would mean either\n * committing someone's project id or gitignoring the topology.\n */\nexport interface RebaseProjectLink {\n    /**\n     * A Rebase Cloud project id, or the base URL of any running Rebase backend\n     * (`https://api.example.com`). Both are first-class: every command that\n     * accepts a project reference accepts either, so a self-hosted project has\n     * the same tooling as a cloud one.\n     */\n    project: string;\n    /** Organization slug. Cloud projects only. */\n    org?: string;\n    /** Explicit API base URL, when it differs from the project's default. */\n    apiUrl?: string;\n}\n\n/**\n * Whether a project can run on the managed runtime, and if not, precisely why.\n *\n * The reasons are returned rather than summarised so tooling can print something\n * a developer can act on. \"Not eligible\" is never a dead end — it selects the\n * custom-runtime path, which still deploys.\n */\nexport interface ManagedCompatibility {\n    eligible: boolean;\n    reasons: string[];\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Bundle\n// ─────────────────────────────────────────────────────────────────────────────\n\n/**\n * Version of the bundle *format* itself.\n *\n * Bumped only when the on-disk layout changes in a way an older runtime could\n * not read. A runtime accepts any bundle whose `bundleFormat` is less than or\n * equal to its own — old bundles keep booting on new runtimes, which is the\n * whole point of separating the artifact from the engine.\n *\n * - **1** — `mode: \"cms\" | \"baas\" | \"static\"`, `entry.static` a single directory\n *   string, `entry.admin` for a bundled admin panel.\n * - **2** — `kind: \"backend\" | \"static\"`, `entry.static` a list of\n *   {@link RebaseBundleStatic}, `entry.admin` removed. A format-1 runtime reading\n *   one of these would find no `mode` and an array where it expects a string, so\n *   the bump is what turns that into a refusal to boot instead of a bundle that\n *   starts and serves nothing.\n */\nexport const BUNDLE_FORMAT_VERSION = 2;\n\n/**\n * The runtime contract major.\n *\n * Distinct from the `@rebasepro/server` package version: the package may release\n * any number of minors and patches while this stays put. It changes only when\n * the bundle/runtime contract breaks compatibility, and a project's\n * `manifest.runtime` range is matched against *this*.\n *\n * ## v2 — resources are declared, not configured\n *\n * `RebaseBackendConfig.dataSources` and `.storageSources` are gone. A project\n * declares its databases and buckets with `database()` / `bucket()` in its\n * config, and the runtime reads those declarations.\n *\n * This had to be a major, and the reason is the managed tier: it moves projects\n * onto new images WITHOUT rebuilding them. A bundle built against v1 exports\n * those keys, and a v2 runtime refuses them at boot — so without this bump, one\n * image rollout would crash-loop every tenant that had ever declared a second\n * database or bucket, in a wave, with the cause in a container log nobody is\n * watching.\n *\n * With the bump, a v1 bundle on a v2 runtime is refused by\n * `assertBundleCompatibility` with the remedy in the message, and the platform\n * keeps it on a v1 image until it is rebuilt. That is the whole purpose of this\n * number.\n *\n * **Release order matters and is not optional.** The control plane is the side\n * that rejects, so it ships FIRST: raise `SUPPORTED_RUNTIME_CONTRACT` in the\n * saas repo (it rejects only `contract >` its own, so it then accepts both),\n * deploy that, and only then release a runtime implementing v2. Shipping the\n * runtime first turns every deploy into a rejected intake blaming the tenant's\n * bundle.\n */\nexport const RUNTIME_CONTRACT_VERSION = 1;\n\n/** Where the runtime finds each part of the bundle. Paths are bundle-relative. */\nexport interface RebaseBundleEntrypoints {\n    /** Compiled config package directory (collections live under it). */\n    config?: string;\n    /** Compiled collections directory, when it differs from `<config>/collections`. */\n    collections?: string;\n    /** Compiled functions directory. */\n    functions?: string;\n    /** Compiled crons directory. */\n    crons?: string;\n    /** Compiled Drizzle schema module. */\n    schema?: string;\n    /** Module exporting the auth users collection (default export). */\n    usersCollection?: string;\n    /**\n     * Built static apps to serve from this process, in declaration order.\n     *\n     * A list rather than a single directory because one process serves several\n     * apps at different paths — a site at `/` and the admin at `/admin`. The\n     * runtime mounts them longest-path-first so the `/`-rooted app's catch-all\n     * does not claim its siblings' URLs.\n     */\n    static?: RebaseBundleStatic[];\n}\n\n/** One built static app inside a bundle. */\nexport interface RebaseBundleStatic {\n    /** Public base path, e.g. `/` or `/admin`. */\n    path: string;\n    /** Bundle-relative directory holding the built assets. */\n    dir: string;\n    /** Serve `index.html` for unmatched paths under `path`. */\n    spa: boolean;\n}\n\n/**\n * A native module found in the dependency closure.\n *\n * Recorded rather than merely counted so a rejection can name the offending\n * package instead of saying \"something here is native\".\n */\nexport interface NativeDependency {\n    name: string;\n    /** Why it was flagged — a `.node` binary, a gyp build, or an install script. */\n    reason: string;\n}\n\n/**\n * `manifest.json` — generated, and the document the runtime and control plane\n * both validate against.\n */\n/**\n * One custom function, as recorded in a built bundle.\n *\n * @see RebaseBundleManifest.functions\n */\nexport interface RebaseBundleFunction {\n    /**\n     * The filename without its extension — which is also the URL segment it\n     * mounts at (`/api/functions/<name>`), the API-key permission that grants\n     * it, and the name `REBASE_FUNCTIONS_ONLY` selects by. One identity, used\n     * everywhere.\n     */\n    name: string;\n    /** Path inside the bundle, so a host can point at the file. */\n    file: string;\n    /**\n     * `false` when the function's own source imports a Node built-in or a\n     * package that needs one.\n     *\n     * Descriptive, never a gate: nothing refuses to build or deploy on this. It\n     * says where this function *could* run, not where it should.\n     */\n    portable: boolean;\n    /**\n     * Why it is not portable — one short phrase per reason, deduplicated.\n     * Absent when it is.\n     */\n    requires?: string[];\n}\n\nexport interface RebaseBundleManifest {\n    /** @see BUNDLE_FORMAT_VERSION */\n    bundleFormat: number;\n    runtime: {\n        /** The `runtime` range copied from `rebase.json`. */\n        range: string;\n        /** Exact `@rebasepro/server` version this bundle was built against. */\n        builtAgainst: string;\n        /** Runtime contract major this bundle requires. */\n        contract: number;\n    };\n    /**\n     * Hash of the compiled collection definitions.\n     *\n     * This is the contract stamp. A generated SDK records the value it was built\n     * from, a client sends it back, and a mismatch is what lets the platform say\n     * \"this app was built against an older schema\" instead of failing mysteriously\n     * at the first request. It covers collections only — a hook edit does not\n     * change a client's contract, so it must not invalidate every SDK.\n     */\n    schemaVersion: string;\n    /** Which app in `rebase.json` this bundle was built from. */\n    app: string;\n    /**\n     * What the runtime does with this bundle.\n     *\n     * - `backend` — boot the full server: database, auth and the data API, plus\n     *   any static apps in `entry.static`.\n     * - `static` — no backend at all: serve `entry.static` and nothing else. No\n     *   database, no auth, no data sources. This is how a static app runs on the\n     *   same image as the backend.\n     *\n     * Replaces an earlier `mode: \"cms\" | \"baas\" | \"static\"`. The cms/baas\n     * distinction was never a third kind of thing — it is simply whether\n     * `entry.config` is present, so it is derived rather than declared.\n     */\n    kind: \"backend\" | \"static\";\n    entry: RebaseBundleEntrypoints;\n    /** Collection slugs contained in the bundle, for quick inspection. */\n    collections?: string[];\n    /**\n     * Every custom function in the bundle, named and classified.\n     *\n     * Two things are recorded per function, and both are answers a host would\n     * otherwise have to get by importing user code:\n     *\n     * - **What it is called.** That name is the function's identity everywhere —\n     *   the URL segment it mounts at, the `functions/<name>` API-key\n     *   permission, the value `REBASE_FUNCTIONS_ONLY` selects by. A host that\n     *   wants to give one slow function its own replica count currently has to\n     *   boot the bundle to discover what is in it.\n     * - **Whether it needs Node.** Purely descriptive: a function that opens a\n     *   file or runs raw SQL is a fine function, and every deployment today is\n     *   a Node process. It is recorded because the question \"which of these\n     *   could run somewhere else\" has to be answerable from the artifact, and\n     *   because answering it per-file after the fact — across a codebase\n     *   already written — is the expensive version of the same question.\n     *\n     * Absent on a bundle built before this field existed, which is why every\n     * consumer must treat it as optional rather than as an empty list.\n     */\n    functions?: RebaseBundleFunction[];\n    hooks: {\n        /**\n         * Whether the dependency closure contains native code.\n         *\n         * The managed runtime refuses these: a prebuilt binary cannot be run on\n         * an image the platform did not build it for, and the honest failure is\n         * at deploy time rather than at 3am in a crash loop.\n         */\n        native: boolean;\n        nativeModules?: NativeDependency[];\n    };\n    /**\n     * What the bundle's config says about storage access control.\n     *\n     * Storage is not under RLS and its keys share one flat namespace, so a\n     * deployment with file storage enabled and no access model serves every\n     * user's files to every signed-in user. The runtime refuses to boot in that\n     * state — which, on a hosted platform that enables storage from the *console*\n     * rather than from the bundle, surfaces as a crash loop the developer cannot\n     * read.\n     *\n     * Recording it here lets a host reject the deploy with the reason instead.\n     * Absent on bundles built before this field existed.\n     */\n    storage?: {\n        /** Whether the config package exports a `storageAuthorize` hook. */\n        authorize: boolean;\n        /**\n         * Buckets, on bundles built before {@link RebaseBundleManifest.resources}.\n         *\n         * No longer written. A host reads `resources`, which carries every kind\n         * in one list; this stays declared so a control plane can keep reading\n         * the bundles a project shipped before it was rebuilt.\n         */\n        sources?: StorageSourceDefinition[];\n    };\n    /**\n     * Everything the project declares it needs — databases, buckets, topics,\n     * and whatever kind is registered next.\n     *\n     * Recorded so a host can tell, from the artifact alone and before starting\n     * anything, what a deploy will need provisioned. That question used to be\n     * answerable for buckets and for nothing else, because buckets were the\n     * only kind written into an artifact — which is how a project's databases\n     * became invisible to the platform that runs them.\n     *\n     * Absent on bundles built before this field existed.\n     */\n    resources?: ResourceGraph;\n    deps: {\n        /** Runtime dependencies of user code, as declared. */\n        declared: Record<string, string>;\n        /**\n         * The dependency tree ships *inside* the bundle, already installed.\n         *\n         * Absent or false means the tree is declared but not present, and\n         * whoever boots the bundle has to install it. On the managed runtime that\n         * install runs in an init container on **every** pod start — the bundle\n         * lives on a volume that is wiped each time — and it is the single\n         * largest cost in a managed pod's life: 35–55 seconds of a 40–60 second\n         * cold start. Since a pod restarts on every eviction, node failure, OOM\n         * and runtime rollout, that number is not a startup detail. It is what an\n         * outage costs.\n         *\n         * Vendoring moves the install to build time, where it happens once. It is\n         * skipped when the closure contains native code, because a prebuilt\n         * binary is only valid for the platform it was built for — see\n         * {@link vendorTarget} for what \"the platform\" means here.\n         */\n        vendored?: boolean;\n        /**\n         * What {@link vendored} was resolved for, recorded so a mismatch can be\n         * refused rather than discovered at import time.\n         *\n         * Cross-platform vendoring is safe for pure JavaScript and unsafe for\n         * anything compiled, and the boundary between them is not always visible\n         * in a dependency list: `esbuild` is pure-JS with a *platform-specific\n         * optional dependency* holding the actual binary, so an install run on a\n         * developer's Mac silently produces a tree that cannot run on the Linux\n         * image. The install therefore resolves optional dependencies for the\n         * target explicitly rather than for the machine it runs on, and records\n         * the answer here.\n         */\n        vendorTarget?: {\n            /** npm `--os`, e.g. `linux`. */\n            os: string;\n            /** npm `--cpu`, e.g. `x64`. */\n            cpu: string;\n            /** Node major the tree was resolved for. */\n            node: string;\n        };\n    };\n    build: {\n        /** `@rebasepro/cli` version that produced this bundle. */\n        cli: string;\n        /** Node major the bundle was compiled on. */\n        node: string;\n        /** ISO-8601. */\n        createdAt: string;\n    };\n}\n\n/** The contract a running backend serves at `GET /api/meta/contract`. */\nexport interface RebaseProjectContract {\n    /** Matches {@link RebaseBundleManifest.schemaVersion}. */\n    schemaVersion: string;\n    runtime: {\n        /** `@rebasepro/server` version currently running. */\n        version: string;\n        contract: number;\n    };\n    /** Full collection definitions, serialized — the input to SDK generation. */\n    collections: unknown[];\n    /** Collection slugs, for cheap inspection without parsing the definitions. */\n    collectionSlugs: string[];\n    generatedAt: string;\n}\n\n/** Header carrying the schema version an SDK was generated from. */\nexport const SCHEMA_VERSION_HEADER = \"x-rebase-schema\";\n","import type { CollectionConfig } from \"./collections\";\n\n/**\n * Serializing collections so they survive a network hop.\n *\n * A collection definition is not plain data. Relations point at their target\n * with a *function* (`target: () => usersCollection`) so two collections can\n * reference each other without an import cycle, and collections also carry\n * callbacks, custom views and component references. `JSON.stringify` silently\n * drops every one of those, which matters because the SDK generator *calls*\n * `relation.target()` to decide whether a foreign key is a string or a number.\n * Serialize naively and remote SDK generation produces subtly wrong types\n * instead of failing — the worst possible outcome.\n *\n * So relation targets are resolved to a slug reference on the way out and\n * rebuilt into functions on the way in. Everything else that cannot cross a wire\n * is dropped deliberately: an SDK is generated from the *shape* of the data, and\n * server-side behaviour is neither useful to a client nor safe to publish.\n */\n\n/** Marker replacing a relation's `target` function in serialized form. */\nexport interface SerializedCollectionRef {\n    __collectionRef: string;\n}\n\nexport function isSerializedCollectionRef(value: unknown): value is SerializedCollectionRef {\n    return typeof value === \"object\"\n        && value !== null\n        && typeof (value as SerializedCollectionRef).__collectionRef === \"string\";\n}\n\n/** Depth limit for the walk — deep enough for real configs, finite for cyclic ones. */\nconst MAX_DEPTH = 64;\n\n/**\n * Resolve whatever a `target` thunk returns down to a collection.\n *\n * A target may be the collection, a module namespace (when the authoring file\n * used `import * as`), or a default-export wrapper. All three appear in real\n * projects, and the SDK generator already unwraps them the same way.\n */\nfunction unwrapTarget(value: unknown): CollectionConfig | undefined {\n    if (!value || typeof value !== \"object\") return undefined;\n    const candidate = value as { default?: unknown; __esModule?: boolean; properties?: unknown };\n    if (candidate.default || candidate.__esModule) {\n        const inner = candidate.default;\n        if (inner && typeof inner === \"object\") return inner as CollectionConfig;\n    }\n    if (candidate.properties) return value as CollectionConfig;\n    return undefined;\n}\n\n/** The identity a serialized reference uses. Slug first — it is the routing key. */\nfunction refFor(collection: CollectionConfig | undefined): string | undefined {\n    if (!collection) return undefined;\n    const withPath = collection as CollectionConfig & { path?: string };\n    return collection.slug || withPath.path || collection.name;\n}\n\n/**\n * Deep-copy a value into something JSON can carry.\n *\n * `target` keys are special-cased into refs. Other functions vanish, cycles are\n * cut, and everything else is copied structurally.\n */\n/** Shared walk state: the memo, plus a count of depth-cap hits. */\ninterface WalkState {\n    memo: WeakMap<object, unknown>;\n    /**\n     * How many times the walk has truncated a subtree — by hitting the depth\n     * cap, or by cutting a cycle.\n     *\n     * Either kind of truncation makes a result valid only at the *position* it\n     * was produced at, so caching it and serving it elsewhere silently drops\n     * content that would have been included. Comparing this counter before and\n     * after a node's children tells us whether its result is position-\n     * independent and therefore safe to memoize.\n     *\n     * The cycle case is the subtle one: with `a.b = b` and `b.a = a`, serializing\n     * `{ first: b, second: a }` visits `a` beneath `b` — where the cycle back to\n     * `b` is cut — and would then reuse that truncated `a` for `second`, where\n     * nothing needed cutting.\n     */\n    truncations: number;\n}\n\nfunction toSerializable(\n    value: unknown,\n    seen: WeakSet<object>,\n    depth: number,\n    state: WalkState,\n    key?: string\n): unknown {\n    if (depth > MAX_DEPTH) {\n        state.truncations++;\n        return undefined;\n    }\n\n    if (typeof value === \"function\") {\n        // Only a relation target carries information a client needs. Calling it\n        // is safe here — this runs on the server, where the target module is\n        // already loaded — and a throwing target simply yields no reference,\n        // which degrades the generated FK type rather than failing the request.\n        if (key === \"target\") {\n            try {\n                const resolved = unwrapTarget((value as () => unknown)());\n                const ref = refFor(resolved);\n                return ref ? { __collectionRef: ref } : undefined;\n            } catch {\n                return undefined;\n            }\n        }\n        return undefined;\n    }\n\n    if (value === null || typeof value !== \"object\") {\n        return value;\n    }\n\n    if (value instanceof Date) return value.toISOString();\n    if (value instanceof RegExp) return value.source;\n\n    if (seen.has(value as object)) {\n        state.truncations++;\n        return undefined;\n    }\n\n    // A shared (non-cyclic) subgraph is reachable by many paths, and `seen` is a\n    // *path* set — released in the `finally` below so a node referenced twice in\n    // different branches is emitted twice rather than dropped as a false cycle.\n    // Without memoization that makes the walk exponential in depth: a diamond\n    // graph 20 levels deep took ~400ms, and each further level doubled it. The\n    // result is a plain data tree, so handing back the same converted object for\n    // a repeat visit is indistinguishable after JSON.stringify.\n    const cached = state.memo.get(value as object);\n    if (cached !== undefined) return cached;\n\n    seen.add(value as object);\n    const truncationsBefore = state.truncations;\n    const memoize = (result: unknown): unknown => {\n        // Only cache a result that nothing was cut from.\n        if (result !== undefined && state.truncations === truncationsBefore) {\n            state.memo.set(value as object, result);\n        }\n        return result;\n    };\n\n    try {\n        if (Array.isArray(value)) {\n            const items = value\n                .map(item => toSerializable(item, seen, depth + 1, state))\n                .filter(item => item !== undefined);\n            // A container that had content, none of which can be represented, is\n            // itself unrepresentable — see the note below.\n            return memoize(value.length > 0 && items.length === 0 ? undefined : items);\n        }\n\n        // A React element or component reference has no meaning to a client and\n        // will not survive JSON anyway.\n        if (\"$$typeof\" in (value as Record<string, unknown>)) return undefined;\n\n        const entries = Object.entries(value as Record<string, unknown>);\n        const out: Record<string, unknown> = {};\n        for (const [k, v] of entries) {\n            const converted = toSerializable(v, seen, depth + 1, state, k);\n            if (converted !== undefined) out[k] = converted;\n        }\n\n        // Drop a container whose entire content was dropped.\n        //\n        // `callbacks: { beforeSave() {…} }` would otherwise serialize to\n        // `callbacks: {}` — an empty husk that carries no information but is not\n        // *nothing*, so it lands in the payload and, worse, in the schema hash.\n        // Editing a hook would then change every client's schema version and\n        // report perfectly current SDKs as stale.\n        //\n        // A container that started empty stays empty: `properties: {}` is a\n        // deliberate statement, not a casualty.\n        if (entries.length > 0 && Object.keys(out).length === 0) return undefined;\n\n        return memoize(out);\n    } finally {\n        // Released so a collection referenced twice in different branches is\n        // emitted twice rather than being dropped as a false cycle.\n        seen.delete(value as object);\n    }\n}\n\n/**\n * Serialize collections for transport over the contract endpoint.\n *\n * Sorted by slug so the output — and therefore the schema hash computed from it\n * — does not depend on filesystem ordering.\n */\nexport function serializeCollections(collections: CollectionConfig[]): unknown[] {\n    return [...collections]\n        .sort((a, b) => String(a.slug ?? \"\").localeCompare(String(b.slug ?? \"\")))\n        .map(collection => toSerializable(withoutAdminBlock(collection), new WeakSet(), 0, {\n            memo: new WeakMap(),\n            truncations: 0\n        }))\n        .filter((c): c is Record<string, unknown> => c !== undefined);\n}\n\n/**\n * Drop the admin block before the walk.\n *\n * Nothing downstream of serialization is an admin panel. The contract endpoint\n * feeds remote SDK generation, and `rebase build` writes the result into a bundle\n * manifest that only the backend runtime reads. The block would survive the walk\n * as a husk anyway — its React elements and component functions are dropped\n * individually — and that husk has two costs worth avoiding: it puts every custom\n * component's *file path* on an endpoint whose job is to describe data shapes, and\n * it grows a payload that is fetched and cached per project.\n *\n * Removing it here rather than at each call site means one chokepoint, so a future\n * consumer of `serializeCollections` cannot forget.\n *\n * Child collections carry their own block, so this recurses — stripping only the\n * top level was the mistake `stripNonClientFields` in the contract routes already\n * had to fix once for security rules.\n */\nfunction withoutAdminBlock(collection: CollectionConfig): CollectionConfig {\n    const { admin: _admin, ...rest } = collection as CollectionConfig & Record<string, unknown>;\n    const nested = rest as Record<string, unknown>;\n    if (Array.isArray(nested.subcollections)) {\n        nested.subcollections = nested.subcollections.map(\n            (child) => withoutAdminBlock(child as CollectionConfig)\n        );\n    }\n    return rest as CollectionConfig;\n}\n\n/**\n * Rebuild collections received from a contract endpoint.\n *\n * Relation refs become real thunks resolving through the returned set, so\n * downstream consumers — the SDK generator above all — see exactly the shape\n * they would have seen had the collections been imported from source.\n *\n * A ref naming a collection that is not in the payload resolves to `undefined`\n * rather than throwing: the generator already tolerates an unresolvable target\n * by falling back to a permissive key type, and a partial contract should still\n * produce a usable SDK.\n */\nexport function deserializeCollections(payload: unknown[]): CollectionConfig[] {\n    const collections = payload\n        .filter((c): c is Record<string, unknown> => typeof c === \"object\" && c !== null)\n        .map(c => ({ ...c })) as unknown as CollectionConfig[];\n\n    const bySlug = new Map<string, CollectionConfig>();\n    for (const collection of collections) {\n        const ref = refFor(collection);\n        if (ref) bySlug.set(ref, collection);\n    }\n\n    const rehydrate = (value: unknown, depth: number): void => {\n        if (depth > MAX_DEPTH || !value || typeof value !== \"object\") return;\n\n        if (Array.isArray(value)) {\n            for (const item of value) rehydrate(item, depth + 1);\n            return;\n        }\n\n        const record = value as Record<string, unknown>;\n        for (const [key, child] of Object.entries(record)) {\n            if (key === \"target\" && isSerializedCollectionRef(child)) {\n                const slug = child.__collectionRef;\n                record.target = () => bySlug.get(slug);\n                continue;\n            }\n            rehydrate(child, depth + 1);\n        }\n    };\n\n    for (const collection of collections) rehydrate(collection, 0);\n    return collections;\n}\n","import type { CollectionConfig } from \"./collections\";\nimport { serializeCollections } from \"./collection_contract\";\n\n/**\n * The schema version stamp.\n *\n * One function, used in three places that must agree or the whole drift-detection\n * story is noise: `rebase build` writes it into a bundle manifest, the runtime\n * serves it from the contract endpoint, and a generated SDK records the value it\n * was built from. If any two of those computed it differently, every client would\n * look permanently out of date.\n *\n * It covers **collections only** — the client's contract is the shape of the\n * data, so editing a hook or a server function must not invalidate every SDK in\n * every repository. That is a deliberate narrowing, not an oversight.\n */\n\n/** Stable stringify: object keys sorted at every level, so key order cannot alter the hash. */\nfunction canonicalize(value: unknown): string {\n    if (value === null || typeof value !== \"object\") {\n        return JSON.stringify(value) ?? \"null\";\n    }\n    if (Array.isArray(value)) {\n        return `[${value.map(canonicalize).join(\",\")}]`;\n    }\n    const entries = Object.entries(value as Record<string, unknown>)\n        .filter(([, v]) => v !== undefined)\n        .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));\n    return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${canonicalize(v)}`).join(\",\")}}`;\n}\n\n/**\n * Reduce a collection to the parts a generated client is actually built from.\n *\n * The version answers one question — \"is this SDK stale?\" — so it must change\n * exactly when the generated types could change, and never otherwise. Hashing a\n * whole collection fails both halves of that:\n *\n * - Security rules, callbacks, icons, groups and UI settings do not appear in a\n *   generated client, so including them reports perfectly current SDKs as stale.\n * - Worse, they are not stable *inputs*. The runtime applies default security\n *   rules when it loads collections, so the same source hashed before and after\n *   loading produced two different answers — a build-time stamp that could never\n *   match the server that served it.\n *\n * Codegen reads the slug (for the `Database` key and type names), the properties,\n * and the relations. That is the projection.\n */\nfunction projectForCodegen(collection: CollectionConfig): Record<string, unknown> {\n    const source = collection as CollectionConfig & {\n        relations?: unknown;\n        subcollections?: CollectionConfig[];\n        path?: string;\n        engine?: unknown;\n        dataSource?: unknown;\n    };\n\n    return {\n        slug: collection.slug ?? source.path,\n        properties: collection.properties,\n        relations: source.relations,\n        // The engine decides whether relations are resolved at all: codegen asks\n        // `getDataSourceCapabilities(collection.engine).supportsRelations`, and an\n        // engine that answers no drops every foreign-key column from the\n        // generated Row/Insert/Update types. Moving a collection to such an\n        // engine is a real change to the generated types, so it has to move the\n        // version. `dataSource` is what resolves to `engine`, so it counts too.\n        engine: source.engine,\n        dataSource: source.dataSource,\n        subcollections: source.subcollections?.map(projectForCodegen)\n    };\n}\n\n/**\n * Compute the canonical string a schema version hashes.\n *\n * Exposed separately so the hashing itself can differ by environment: Node has\n * `crypto`, and callers without it can still compare canonical forms directly.\n */\nexport function canonicalSchemaPayload(collections: CollectionConfig[]): string {\n    const projected = serializeCollections(collections)\n        .map(collection => projectForCodegen(collection as CollectionConfig));\n    return canonicalize(projected);\n}\n\n/**\n * A short, non-cryptographic digest of the canonical payload.\n *\n * FNV-1a style, 64 bits, as two 32-bit halves. This is an identity, not a\n * security boundary: nothing trusts a schema version to prove anything, it only\n * answers \"is this the same schema as before\". A hand-rolled hash keeps this\n * module free of `node:crypto`, so the identical function runs in the browser,\n * in the CLI, and in the runtime — which is the property that actually matters.\n */\nexport function computeSchemaVersion(collections: CollectionConfig[]): string {\n    const payload = canonicalSchemaPayload(collections);\n\n    let h1 = 0x811c9dc5;\n    let h2 = 0x01000193;\n\n    for (let i = 0; i < payload.length; i++) {\n        const code = payload.charCodeAt(i);\n        h1 ^= code;\n        // Multiply by the FNV prime using shifts to stay in 32-bit integer math.\n        h1 = (h1 + ((h1 << 1) + (h1 << 4) + (h1 << 7) + (h1 << 8) + (h1 << 24))) >>> 0;\n        h2 ^= code + i;\n        h2 = (h2 + ((h2 << 1) + (h2 << 5) + (h2 << 9) + (h2 << 15) + (h2 << 24))) >>> 0;\n    }\n\n    const hex = (n: number): string => n.toString(16).padStart(8, \"0\");\n    return `v1:${hex(h1)}${hex(h2)}`;\n}\n","import { Hono } from \"hono\";\nimport {\n    RUNTIME_CONTRACT_VERSION,\n    SCHEMA_VERSION_HEADER,\n    computeSchemaVersion,\n    serializeCollections,\n    type CollectionConfig,\n    type RebaseProjectContract\n} from \"@rebasepro/types\";\nimport type { HonoEnv } from \"./types\";\nimport { logger } from \"../utils/logger\";\n\n/**\n * The project contract endpoint.\n *\n * This is what makes a repository able to build against a project it does not\n * contain. Without it, a typed client can only be generated from local\n * collection *source*, which means every frontend must live in the same\n * repository as the backend. Serving the contract turns that around: an app\n * asks the project what its shape is, so a web app, a second web app and a\n * mobile app can each live wherever they like and none of them needs to know\n * about the others.\n *\n * Admin-gated. Collection definitions describe every table, column and relation\n * in the project, including ones no security rule would ever expose — that is a\n * map of the database, not public API documentation.\n */\n\nexport interface ContractRoutesConfig {\n    collectionRegistry: { getRawCollections(): CollectionConfig[] };\n    /**\n     * The schema version recorded at build time.\n     *\n     * Preferred over recomputing, so that what a client is told matches exactly\n     * what the bundle claims. It is recomputed only when a bundle did not record\n     * one — a `baas`-mode project derives its collections from the live database\n     * at boot, so there was nothing to hash when it was built.\n     */\n    schemaVersion?: string;\n    /** Runtime package version, surfaced so a client can report what it built against. */\n    runtimeVersion?: string;\n}\n\n/**\n * Strip everything a client does not need from a serialized collection.\n *\n * The generator reads the slug, the properties and the relations. It never reads\n * a security rule — but `securityRules` carries the raw SQL of every RLS\n * predicate guarding the project, which is a description of the authorization\n * model rather than of the data shape. Publishing it to anyone who can generate\n * an SDK gives away more than the endpoint is for, so it is removed here rather\n * than trusted not to matter.\n */\nfunction stripNonClientFields(collection: unknown): unknown {\n    if (!collection || typeof collection !== \"object\") return collection;\n    const {\n        securityRules: _securityRules,\n        callbacks: _callbacks,\n        ...rest\n    } = collection as Record<string, unknown>;\n\n    // Subcollections are collections, and carry their own rules. Stripping only\n    // the top level published every nested policy — the leak this exists to\n    // prevent, just one level down.\n    if (Array.isArray(rest.subcollections)) {\n        rest.subcollections = rest.subcollections.map(stripNonClientFields);\n    }\n\n    return rest;\n}\n\nexport function createContractRoutes(config: ContractRoutesConfig): Hono<HonoEnv> {\n    const router = new Hono<HonoEnv>();\n\n    // Computing a version walks and canonicalizes every collection, and\n    // `/schema-version` is deliberately unauthenticated and meant to be polled.\n    // Recomputing per request would make a CI convenience into a CPU\n    // amplification anyone could aim at the server. Collections do not change\n    // after boot, so once is enough.\n    let cachedVersion: string | undefined;\n    const schemaVersionOf = (collections: CollectionConfig[]): string => {\n        if (config.schemaVersion) return config.schemaVersion;\n        if (cachedVersion === undefined) cachedVersion = computeSchemaVersion(collections);\n        return cachedVersion;\n    };\n\n    router.get(\"/contract\", (c) => {\n        const collections = config.collectionRegistry.getRawCollections();\n        const serialized = serializeCollections(collections).map(stripNonClientFields);\n\n        // In `baas` mode the collections are whatever introspection found at\n        // boot, so the version has to be computed from them rather than taken\n        // from a build that never saw them.\n        const schemaVersion = schemaVersionOf(collections);\n\n        const contract: RebaseProjectContract = {\n            schemaVersion,\n            runtime: {\n                version: config.runtimeVersion ?? \"unknown\",\n                contract: RUNTIME_CONTRACT_VERSION\n            },\n            collections: serialized,\n            collectionSlugs: collections\n                .map(collection => collection.slug)\n                .filter((slug): slug is string => Boolean(slug))\n                .sort(),\n            generatedAt: new Date().toISOString()\n        };\n\n        c.header(SCHEMA_VERSION_HEADER, schemaVersion);\n        return c.json(contract);\n    });\n\n    /**\n     * Cheap drift check.\n     *\n     * Deliberately unauthenticated and deliberately tiny: it returns a version\n     * string and nothing else. A CI job that only wants to know whether its\n     * generated SDK is stale should not need admin credentials, and a version\n     * stamp reveals nothing about the schema it stands for.\n     */\n    router.get(\"/schema-version\", (c) => {\n        const schemaVersion = schemaVersionOf(config.collectionRegistry.getRawCollections());\n        c.header(SCHEMA_VERSION_HEADER, schemaVersion);\n        return c.json({ schemaVersion, });\n    });\n\n    logger.debug(\"Contract routes mounted\");\n    return router;\n}\n"],"mappings":";;;;;;;;;;AAqlBA,IAAa,wBAAwB;;;;ACrjBrC,IAAM,YAAY;;;;;;;;AASlB,SAAS,aAAa,OAA8C;CAChE,IAAI,CAAC,SAAS,OAAO,UAAU,UAAU,OAAO,KAAA;CAChD,MAAM,YAAY;CAClB,IAAI,UAAU,WAAW,UAAU,YAAY;EAC3C,MAAM,QAAQ,UAAU;EACxB,IAAI,SAAS,OAAO,UAAU,UAAU,OAAO;CACnD;CACA,IAAI,UAAU,YAAY,OAAO;AAErC;;AAGA,SAAS,OAAO,YAA8D;CAC1E,IAAI,CAAC,YAAY,OAAO,KAAA;CACxB,MAAM,WAAW;CACjB,OAAO,WAAW,QAAQ,SAAS,QAAQ,WAAW;AAC1D;AA6BA,SAAS,eACL,OACA,MACA,OACA,OACA,KACO;CACP,IAAI,QAAQ,WAAW;EACnB,MAAM;EACN;CACJ;CAEA,IAAI,OAAO,UAAU,YAAY;EAK7B,IAAI,QAAQ,UACR,IAAI;GAEA,MAAM,MAAM,OADK,aAAc,MAAwB,CACpC,CAAQ;GAC3B,OAAO,MAAM,EAAE,iBAAiB,IAAI,IAAI,KAAA;EAC5C,QAAQ;GACJ;EACJ;EAEJ;CACJ;CAEA,IAAI,UAAU,QAAQ,OAAO,UAAU,UACnC,OAAO;CAGX,IAAI,iBAAiB,MAAM,OAAO,MAAM,YAAY;CACpD,IAAI,iBAAiB,QAAQ,OAAO,MAAM;CAE1C,IAAI,KAAK,IAAI,KAAe,GAAG;EAC3B,MAAM;EACN;CACJ;CASA,MAAM,SAAS,MAAM,KAAK,IAAI,KAAe;CAC7C,IAAI,WAAW,KAAA,GAAW,OAAO;CAEjC,KAAK,IAAI,KAAe;CACxB,MAAM,oBAAoB,MAAM;CAChC,MAAM,WAAW,WAA6B;EAE1C,IAAI,WAAW,KAAA,KAAa,MAAM,gBAAgB,mBAC9C,MAAM,KAAK,IAAI,OAAiB,MAAM;EAE1C,OAAO;CACX;CAEA,IAAI;EACA,IAAI,MAAM,QAAQ,KAAK,GAAG;GACtB,MAAM,QAAQ,MACT,KAAI,SAAQ,eAAe,MAAM,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CACzD,QAAO,SAAQ,SAAS,KAAA,CAAS;GAGtC,OAAO,QAAQ,MAAM,SAAS,KAAK,MAAM,WAAW,IAAI,KAAA,IAAY,KAAK;EAC7E;EAIA,IAAI,cAAe,OAAmC,OAAO,KAAA;EAE7D,MAAM,UAAU,OAAO,QAAQ,KAAgC;EAC/D,MAAM,MAA+B,CAAC;EACtC,KAAK,MAAM,CAAC,GAAG,MAAM,SAAS;GAC1B,MAAM,YAAY,eAAe,GAAG,MAAM,QAAQ,GAAG,OAAO,CAAC;GAC7D,IAAI,cAAc,KAAA,GAAW,IAAI,KAAK;EAC1C;EAYA,IAAI,QAAQ,SAAS,KAAK,OAAO,KAAK,GAAG,CAAC,CAAC,WAAW,GAAG,OAAO,KAAA;EAEhE,OAAO,QAAQ,GAAG;CACtB,UAAU;EAGN,KAAK,OAAO,KAAe;CAC/B;AACJ;;;;;;;AAQA,SAAgB,qBAAqB,aAA4C;CAC7E,OAAO,CAAC,GAAG,WAAW,CAAC,CAClB,MAAM,GAAG,MAAM,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,cAAc,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CACxE,KAAI,eAAc,eAAe,kBAAkB,UAAU,mBAAG,IAAI,QAAQ,GAAG,GAAG;EAC/E,sBAAM,IAAI,QAAQ;EAClB,aAAa;CACjB,CAAC,CAAC,CAAC,CACF,QAAQ,MAAoC,MAAM,KAAA,CAAS;AACpE;;;;;;;;;;;;;;;;;;;AAoBA,SAAS,kBAAkB,YAAgD;CACvE,MAAM,EAAE,OAAO,QAAQ,GAAG,SAAS;CACnC,MAAM,SAAS;CACf,IAAI,MAAM,QAAQ,OAAO,cAAc,GACnC,OAAO,iBAAiB,OAAO,eAAe,KACzC,UAAU,kBAAkB,KAAyB,CAC1D;CAEJ,OAAO;AACX;;;;;;;;;;;;;;;;;ACrNA,SAAS,aAAa,OAAwB;CAC1C,IAAI,UAAU,QAAQ,OAAO,UAAU,UACnC,OAAO,KAAK,UAAU,KAAK,KAAK;CAEpC,IAAI,MAAM,QAAQ,KAAK,GACnB,OAAO,IAAI,MAAM,IAAI,YAAY,CAAC,CAAC,KAAK,GAAG,EAAE;CAKjD,OAAO,IAHS,OAAO,QAAQ,KAAgC,CAAC,CAC3D,QAAQ,GAAG,OAAO,MAAM,KAAA,CAAS,CAAC,CAClC,MAAM,CAAC,IAAI,CAAC,OAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CACvC,CAAA,CAAQ,KAAK,CAAC,GAAG,OAAO,GAAG,KAAK,UAAU,CAAC,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE;AAC5F;;;;;;;;;;;;;;;;;;AAmBA,SAAS,kBAAkB,YAAuD;CAC9E,MAAM,SAAS;CAQf,OAAO;EACH,MAAM,WAAW,QAAQ,OAAO;EAChC,YAAY,WAAW;EACvB,WAAW,OAAO;EAOlB,QAAQ,OAAO;EACf,YAAY,OAAO;EACnB,gBAAgB,OAAO,gBAAgB,IAAI,iBAAiB;CAChE;AACJ;;;;;;;AAQA,SAAgB,uBAAuB,aAAyC;CAG5E,OAAO,aAFW,qBAAqB,WAAW,CAAC,CAC9C,KAAI,eAAc,kBAAkB,UAA8B,CACnD,CAAS;AACjC;;;;;;;;;;AAWA,SAAgB,qBAAqB,aAAyC;CAC1E,MAAM,UAAU,uBAAuB,WAAW;CAElD,IAAI,KAAK;CACT,IAAI,KAAK;CAET,KAAK,IAAI,IAAI,GAAG,IAAI,QAAQ,QAAQ,KAAK;EACrC,MAAM,OAAO,QAAQ,WAAW,CAAC;EACjC,MAAM;EAEN,KAAM,OAAO,MAAM,MAAM,MAAM,MAAM,MAAM,MAAM,MAAM,MAAM,MAAM,SAAU;EAC7E,MAAM,OAAO;EACb,KAAM,OAAO,MAAM,MAAM,MAAM,MAAM,MAAM,MAAM,MAAM,OAAO,MAAM,SAAU;CAClF;CAEA,MAAM,OAAO,MAAsB,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG;CACjE,OAAO,MAAM,IAAI,EAAE,IAAI,IAAI,EAAE;AACjC;;;;;;;;;;;;;;AC1DA,SAAS,qBAAqB,YAA8B;CACxD,IAAI,CAAC,cAAc,OAAO,eAAe,UAAU,OAAO;CAC1D,MAAM,EACF,eAAe,gBACf,WAAW,YACX,GAAG,SACH;CAKJ,IAAI,MAAM,QAAQ,KAAK,cAAc,GACjC,KAAK,iBAAiB,KAAK,eAAe,IAAI,oBAAoB;CAGtE,OAAO;AACX;AAEA,SAAgB,qBAAqB,QAA6C;CAC9E,MAAM,SAAS,IAAI,KAAc;CAOjC,IAAI;CACJ,MAAM,mBAAmB,gBAA4C;EACjE,IAAI,OAAO,eAAe,OAAO,OAAO;EACxC,IAAI,kBAAkB,KAAA,GAAW,gBAAgB,qBAAqB,WAAW;EACjF,OAAO;CACX;CAEA,OAAO,IAAI,cAAc,MAAM;EAC3B,MAAM,cAAc,OAAO,mBAAmB,kBAAkB;EAChE,MAAM,aAAa,qBAAqB,WAAW,CAAC,CAAC,IAAI,oBAAoB;EAK7E,MAAM,gBAAgB,gBAAgB,WAAW;EAEjD,MAAM,WAAkC;GACpC;GACA,SAAS;IACL,SAAS,OAAO,kBAAkB;IAClC,UAAA;GACJ;GACA,aAAa;GACb,iBAAiB,YACZ,KAAI,eAAc,WAAW,IAAI,CAAC,CAClC,QAAQ,SAAyB,QAAQ,IAAI,CAAC,CAAC,CAC/C,KAAK;GACV,8BAAa,IAAI,KAAK,EAAA,CAAE,YAAY;EACxC;EAEA,EAAE,OAAO,uBAAuB,aAAa;EAC7C,OAAO,EAAE,KAAK,QAAQ;CAC1B,CAAC;;;;;;;;;CAUD,OAAO,IAAI,oBAAoB,MAAM;EACjC,MAAM,gBAAgB,gBAAgB,OAAO,mBAAmB,kBAAkB,CAAC;EACnF,EAAE,OAAO,uBAAuB,aAAa;EAC7C,OAAO,EAAE,KAAK,EAAE,cAAe,CAAC;CACpC,CAAC;CAED,OAAO,MAAM,yBAAyB;CACtC,OAAO;AACX"}

package/dist/{cron-routes-BsukhMGm.js → cron-routes-DSC-kZXI.js}

@@ -4,7 +4,7 @@ globalThis.process ??= __rebaseProcess;
 __rebaseCreateRequire(import.meta.url);
 import { n as __exportAll } from "./rolldown-runtime-dW7B1o5h.js";
 import { n as errorHandler, t as ApiError } from "./errors-DBwpj9N8.js";
-import { a as resolveListLimitParam } from "./query-parser--nstjRCh.js";
+import { a as resolveListLimitParam } from "./query-parser-DqXNaBIH.js";
 import { Hono } from "hono";
 //#region src/cron/cron-routes.ts
 var cron_routes_exports = /* @__PURE__ */ __exportAll({ createCronRoutes: () => createCronRoutes });
@@ -66,4 +66,4 @@ function createCronRoutes(scheduler, skipped = 0) {
 //#endregion
 export { cron_routes_exports as n, createCronRoutes as t };
 
-//# sourceMappingURL=cron-routes-BsukhMGm.js.map
+//# sourceMappingURL=cron-routes-DSC-kZXI.js.map

package/dist/{cron-routes-BsukhMGm.js.map → cron-routes-DSC-kZXI.js.map}

@@ -1 +1 @@
-{"version":3,"file":"cron-routes-BsukhMGm.js","names":[],"sources":["../src/cron/cron-routes.ts"],"sourcesContent":["import { Hono } from \"hono\";\nimport type { HonoEnv } from \"../api/types\";\nimport type { CronScheduler } from \"./cron-scheduler\";\nimport { ApiError, errorHandler } from \"../api/errors\";\nimport { resolveListLimitParam } from \"../api/rest/query-parser\";\n\n/**\n * Create admin REST routes for managing cron jobs.\n *\n * Routes:\n *   GET    /          → list all cron jobs\n *   GET    /:id       → get a single job's status\n *   POST   /:id/trigger → manually trigger a job\n *   GET    /:id/logs  → get execution logs for a job\n *   PUT    /:id       → update job (enable/disable)\n */\nexport function createCronRoutes(scheduler: CronScheduler, skipped = 0): Hono<HonoEnv> {\n    const router = new Hono<HonoEnv>();\n    // Hono's onError does NOT propagate from parent to child routers, so this\n    // child router registers its own handler to format thrown ApiErrors.\n    router.onError(errorHandler);\n\n    // List all jobs\n    router.get(\"/\", (c) => {\n        const jobs = scheduler.listJobs();\n        // A file that failed to load is not a job, so it appears nowhere in\n        // this list — and \"my job is missing\" and \"my job is not scheduled\"\n        // look identical from here. Say how many were dropped, as the\n        // functions listing does, so the Studio panel and anyone with curl can\n        // see it without boot-log access.\n        return c.json({\n            jobs,\n            ...(skipped > 0 && {\n                skipped,\n                note: `${skipped} cron file(s) failed to load and are NOT scheduled — see the server log for the reason.`\n            })\n        });\n    });\n\n    // Get single job\n    router.get(\"/:id\", (c) => {\n        const id = c.req.param(\"id\");\n        const job = scheduler.getJob(id);\n        if (!job) {\n            throw ApiError.notFound(`Cron job \"${id}\" not found`);\n        }\n        return c.json({ job });\n    });\n\n    // Trigger a job manually\n    router.post(\"/:id/trigger\", async (c) => {\n        const id = c.req.param(\"id\");\n        const job = scheduler.getJob(id);\n        if (!job) {\n            throw ApiError.notFound(`Cron job \"${id}\" not found`);\n        }\n\n        const log = await scheduler.triggerJob(id);\n        return c.json({ log,\njob: scheduler.getJob(id) });\n    });\n\n    // Get job logs\n    router.get(\"/:id/logs\", async (c) => {\n        const id = c.req.param(\"id\");\n        // Validated, not `parseInt`-ed. `?limit=abc` used to reach the store as\n        // `NaN`, where Postgres refused `LIMIT NaN`, the store swallowed the\n        // error and returned `[]` — a 200 with an empty list, which reads as\n        // \"this job has never run\". The data plane answers 400 for the same\n        // input; so does this now.\n        const limit = resolveListLimitParam(c.req.query(\"limit\") ?? null, { defaultLimit: 50 });\n\n        const job = scheduler.getJob(id);\n        if (!job) {\n            throw ApiError.notFound(`Cron job \"${id}\" not found`);\n        }\n\n        const logs = await scheduler.getJobLogsFromDb(id, limit);\n        return c.json({ logs });\n    });\n\n    // Enable/disable a job\n    router.put(\"/:id\", async (c) => {\n        const id = c.req.param(\"id\");\n        const body = await c.req.json().catch(() => ({})) as { enabled: boolean };\n\n        if (typeof body.enabled !== \"boolean\") {\n            throw ApiError.badRequest(\"Missing 'enabled' boolean in body\");\n        }\n\n        const job = scheduler.setJobEnabled(id, body.enabled);\n        if (!job) {\n            throw ApiError.notFound(`Cron job \"${id}\" not found`);\n        }\n\n        return c.json({ job });\n    });\n\n    return router;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAgBA,SAAgB,iBAAiB,WAA0B,UAAU,GAAkB;CACnF,MAAM,SAAS,IAAI,KAAc;CAGjC,OAAO,QAAQ,YAAY;CAG3B,OAAO,IAAI,MAAM,MAAM;EACnB,MAAM,OAAO,UAAU,SAAS;EAMhC,OAAO,EAAE,KAAK;GACV;GACA,GAAI,UAAU,KAAK;IACf;IACA,MAAM,GAAG,QAAQ;GACrB;EACJ,CAAC;CACL,CAAC;CAGD,OAAO,IAAI,SAAS,MAAM;EACtB,MAAM,KAAK,EAAE,IAAI,MAAM,IAAI;EAC3B,MAAM,MAAM,UAAU,OAAO,EAAE;EAC/B,IAAI,CAAC,KACD,MAAM,SAAS,SAAS,aAAa,GAAG,YAAY;EAExD,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC;CACzB,CAAC;CAGD,OAAO,KAAK,gBAAgB,OAAO,MAAM;EACrC,MAAM,KAAK,EAAE,IAAI,MAAM,IAAI;EAE3B,IAAI,CADQ,UAAU,OAAO,EACxB,GACD,MAAM,SAAS,SAAS,aAAa,GAAG,YAAY;EAGxD,MAAM,MAAM,MAAM,UAAU,WAAW,EAAE;EACzC,OAAO,EAAE,KAAK;GAAE;GACxB,KAAK,UAAU,OAAO,EAAE;EAAE,CAAC;CACvB,CAAC;CAGD,OAAO,IAAI,aAAa,OAAO,MAAM;EACjC,MAAM,KAAK,EAAE,IAAI,MAAM,IAAI;EAM3B,MAAM,QAAQ,sBAAsB,EAAE,IAAI,MAAM,OAAO,KAAK,MAAM,EAAE,cAAc,GAAG,CAAC;EAGtF,IAAI,CADQ,UAAU,OAAO,EACxB,GACD,MAAM,SAAS,SAAS,aAAa,GAAG,YAAY;EAGxD,MAAM,OAAO,MAAM,UAAU,iBAAiB,IAAI,KAAK;EACvD,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC;CAC1B,CAAC;CAGD,OAAO,IAAI,QAAQ,OAAO,MAAM;EAC5B,MAAM,KAAK,EAAE,IAAI,MAAM,IAAI;EAC3B,MAAM,OAAO,MAAM,EAAE,IAAI,KAAK,CAAC,CAAC,aAAa,CAAC,EAAE;EAEhD,IAAI,OAAO,KAAK,YAAY,WACxB,MAAM,SAAS,WAAW,mCAAmC;EAGjE,MAAM,MAAM,UAAU,cAAc,IAAI,KAAK,OAAO;EACpD,IAAI,CAAC,KACD,MAAM,SAAS,SAAS,aAAa,GAAG,YAAY;EAGxD,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC;CACzB,CAAC;CAED,OAAO;AACX"}
+{"version":3,"file":"cron-routes-DSC-kZXI.js","names":[],"sources":["../src/cron/cron-routes.ts"],"sourcesContent":["import { Hono } from \"hono\";\nimport type { HonoEnv } from \"../api/types\";\nimport type { CronScheduler } from \"./cron-scheduler\";\nimport { ApiError, errorHandler } from \"../api/errors\";\nimport { resolveListLimitParam } from \"../api/rest/query-parser\";\n\n/**\n * Create admin REST routes for managing cron jobs.\n *\n * Routes:\n *   GET    /          → list all cron jobs\n *   GET    /:id       → get a single job's status\n *   POST   /:id/trigger → manually trigger a job\n *   GET    /:id/logs  → get execution logs for a job\n *   PUT    /:id       → update job (enable/disable)\n */\nexport function createCronRoutes(scheduler: CronScheduler, skipped = 0): Hono<HonoEnv> {\n    const router = new Hono<HonoEnv>();\n    // Hono's onError does NOT propagate from parent to child routers, so this\n    // child router registers its own handler to format thrown ApiErrors.\n    router.onError(errorHandler);\n\n    // List all jobs\n    router.get(\"/\", (c) => {\n        const jobs = scheduler.listJobs();\n        // A file that failed to load is not a job, so it appears nowhere in\n        // this list — and \"my job is missing\" and \"my job is not scheduled\"\n        // look identical from here. Say how many were dropped, as the\n        // functions listing does, so the Studio panel and anyone with curl can\n        // see it without boot-log access.\n        return c.json({\n            jobs,\n            ...(skipped > 0 && {\n                skipped,\n                note: `${skipped} cron file(s) failed to load and are NOT scheduled — see the server log for the reason.`\n            })\n        });\n    });\n\n    // Get single job\n    router.get(\"/:id\", (c) => {\n        const id = c.req.param(\"id\");\n        const job = scheduler.getJob(id);\n        if (!job) {\n            throw ApiError.notFound(`Cron job \"${id}\" not found`);\n        }\n        return c.json({ job });\n    });\n\n    // Trigger a job manually\n    router.post(\"/:id/trigger\", async (c) => {\n        const id = c.req.param(\"id\");\n        const job = scheduler.getJob(id);\n        if (!job) {\n            throw ApiError.notFound(`Cron job \"${id}\" not found`);\n        }\n\n        const log = await scheduler.triggerJob(id);\n        return c.json({ log,\njob: scheduler.getJob(id) });\n    });\n\n    // Get job logs\n    router.get(\"/:id/logs\", async (c) => {\n        const id = c.req.param(\"id\");\n        // Validated, not `parseInt`-ed. `?limit=abc` used to reach the store as\n        // `NaN`, where Postgres refused `LIMIT NaN`, the store swallowed the\n        // error and returned `[]` — a 200 with an empty list, which reads as\n        // \"this job has never run\". The data plane answers 400 for the same\n        // input; so does this now.\n        const limit = resolveListLimitParam(c.req.query(\"limit\") ?? null, { defaultLimit: 50 });\n\n        const job = scheduler.getJob(id);\n        if (!job) {\n            throw ApiError.notFound(`Cron job \"${id}\" not found`);\n        }\n\n        const logs = await scheduler.getJobLogsFromDb(id, limit);\n        return c.json({ logs });\n    });\n\n    // Enable/disable a job\n    router.put(\"/:id\", async (c) => {\n        const id = c.req.param(\"id\");\n        const body = await c.req.json().catch(() => ({})) as { enabled: boolean };\n\n        if (typeof body.enabled !== \"boolean\") {\n            throw ApiError.badRequest(\"Missing 'enabled' boolean in body\");\n        }\n\n        const job = scheduler.setJobEnabled(id, body.enabled);\n        if (!job) {\n            throw ApiError.notFound(`Cron job \"${id}\" not found`);\n        }\n\n        return c.json({ job });\n    });\n\n    return router;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAgBA,SAAgB,iBAAiB,WAA0B,UAAU,GAAkB;CACnF,MAAM,SAAS,IAAI,KAAc;CAGjC,OAAO,QAAQ,YAAY;CAG3B,OAAO,IAAI,MAAM,MAAM;EACnB,MAAM,OAAO,UAAU,SAAS;EAMhC,OAAO,EAAE,KAAK;GACV;GACA,GAAI,UAAU,KAAK;IACf;IACA,MAAM,GAAG,QAAQ;GACrB;EACJ,CAAC;CACL,CAAC;CAGD,OAAO,IAAI,SAAS,MAAM;EACtB,MAAM,KAAK,EAAE,IAAI,MAAM,IAAI;EAC3B,MAAM,MAAM,UAAU,OAAO,EAAE;EAC/B,IAAI,CAAC,KACD,MAAM,SAAS,SAAS,aAAa,GAAG,YAAY;EAExD,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC;CACzB,CAAC;CAGD,OAAO,KAAK,gBAAgB,OAAO,MAAM;EACrC,MAAM,KAAK,EAAE,IAAI,MAAM,IAAI;EAE3B,IAAI,CADQ,UAAU,OAAO,EACxB,GACD,MAAM,SAAS,SAAS,aAAa,GAAG,YAAY;EAGxD,MAAM,MAAM,MAAM,UAAU,WAAW,EAAE;EACzC,OAAO,EAAE,KAAK;GAAE;GACxB,KAAK,UAAU,OAAO,EAAE;EAAE,CAAC;CACvB,CAAC;CAGD,OAAO,IAAI,aAAa,OAAO,MAAM;EACjC,MAAM,KAAK,EAAE,IAAI,MAAM,IAAI;EAM3B,MAAM,QAAQ,sBAAsB,EAAE,IAAI,MAAM,OAAO,KAAK,MAAM,EAAE,cAAc,GAAG,CAAC;EAGtF,IAAI,CADQ,UAAU,OAAO,EACxB,GACD,MAAM,SAAS,SAAS,aAAa,GAAG,YAAY;EAGxD,MAAM,OAAO,MAAM,UAAU,iBAAiB,IAAI,KAAK;EACvD,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC;CAC1B,CAAC;CAGD,OAAO,IAAI,QAAQ,OAAO,MAAM;EAC5B,MAAM,KAAK,EAAE,IAAI,MAAM,IAAI;EAC3B,MAAM,OAAO,MAAM,EAAE,IAAI,KAAK,CAAC,CAAC,aAAa,CAAC,EAAE;EAEhD,IAAI,OAAO,KAAK,YAAY,WACxB,MAAM,SAAS,WAAW,mCAAmC;EAGjE,MAAM,MAAM,UAAU,cAAc,IAAI,KAAK,OAAO;EACpD,IAAI,CAAC,KACD,MAAM,SAAS,SAAS,aAAa,GAAG,YAAY;EAGxD,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC;CACzB,CAAC;CAED,OAAO;AACX"}

package/dist/{cron-store-dof07MjG.js → cron-store-KeN8rN63.js}

@@ -3,8 +3,8 @@ import __rebaseProcess from "process";
 globalThis.process ??= __rebaseProcess;
 __rebaseCreateRequire(import.meta.url);
 import { n as __exportAll } from "./rolldown-runtime-dW7B1o5h.js";
-import "./src-B-CmIFMr.js";
-import "./src-Cdsw7DqV.js";
+import "./src-C9gKj23J.js";
+import "./src-CcOl05Oq.js";
 import { n as createDdlBootstrapper, o as isSQLAdmin, r as hasInCauseChain } from "./ddl-bootstrap-5YZCZ8qk.js";
 import { t as revokeInternalTableSql } from "./internal-tables-DYVcFFSv.js";
 import { t as logger } from "./logger-DS03e908.js";
@@ -182,4 +182,4 @@ function rowToLogEntry(row) {
 //#endregion
 export { cron_store_exports as n, createCronStore as t };
 
-//# sourceMappingURL=cron-store-dof07MjG.js.map
+//# sourceMappingURL=cron-store-KeN8rN63.js.map

package/dist/{cron-store-dof07MjG.js.map → cron-store-KeN8rN63.js.map}

@@ -1 +1 @@
-{"version":3,"file":"cron-store-dof07MjG.js","names":[],"sources":["../src/cron/cron-store.ts"],"sourcesContent":["import type { CronJobLogEntry } from \"@rebasepro/types\";\nimport type { DataDriver } from \"@rebasepro/types\";\nimport { isSQLAdmin } from \"@rebasepro/types\";\nimport { revokeInternalTableSql } from \"@rebasepro/common\";\nimport { logger } from \"../utils/logger.js\";\nimport { createDdlBootstrapper, hasInCauseChain } from \"../boot/ddl-bootstrap.js\";\n\n/**\n * Persistence layer for cron job execution logs.\n *\n * Uses the DataDriver's `admin.executeSql` capability to store logs in a\n * `rebase.cron_logs` table. Falls back gracefully if the driver doesn't\n * support SQL (e.g. MongoDB) — in that case, no persistence occurs.\n */\nexport interface CronStore {\n    /** Ensure the backing table exists. Called once on startup. */\n    ensureTable(): Promise<void>;\n\n    /** Persist a single log entry after execution. */\n    insertLog(entry: CronJobLogEntry): Promise<void>;\n\n    /**\n     * Fetch the most recent logs for a job.\n     * @param jobId  The job identifier\n     * @param limit  Max entries to return (default 50)\n     * @returns Logs sorted newest-first\n     */\n    fetchLogs(jobId: string, limit?: number): Promise<CronJobLogEntry[]>;\n\n    /**\n     * Fetch aggregate stats for all jobs (totalRuns, totalFailures, lastRunAt).\n     * Used to seed in-memory counters on startup.\n     */\n    fetchJobStats(): Promise<Map<string, { totalRuns: number; totalFailures: number; lastRunAt?: string }>>;\n\n    /**\n     * Atomically claim a scheduled run slot for a job.\n     *\n     * `slot` is the *scheduled* fire time (ISO string) derived from the cron\n     * expression — deterministic across instances regardless of timer drift,\n     * so all instances contend on the same (jobId, slot) key. Exactly one\n     * caller wins the insert against the unique constraint and executes;\n     * the rest skip.\n     *\n     * Fails open (returns true) on unexpected store errors, so a broken\n     * claims table degrades to uncoordinated execution rather than silently\n     * never running jobs.\n     *\n     * Optional so custom stores written against the pre-claims interface\n     * keep working — the scheduler treats a missing implementation as\n     * uncoordinated (always run).\n     */\n    tryClaimRun?(jobId: string, slot: string): Promise<boolean>;\n}\n\n// ─── SQL-based implementation ────────────────────────────────────────\n\nconst TABLE = \"rebase.cron_logs\";\nconst CLAIMS_TABLE = \"rebase.cron_claims\";\n\n/** Claims older than this are garbage-collected on startup. */\nconst CLAIM_RETENTION_DAYS = 7;\n\n/**\n * How far ahead a claim may legitimately sit. Slots are claimed as they fire,\n * so anything beyond this is a clock-skewed peer at best and a stranded claim\n * at worst; see the sweep in `ensureTable`.\n */\nconst FUTURE_CLAIM_SKEW_MINUTES = 2;\n\n/**\n * Detect a unique-constraint violation anywhere in an error's cause chain.\n * Match the SQLSTATE code, never message text. Also covers SQLite\n * (\"UNIQUE constraint failed\") and MySQL (ER_DUP_ENTRY 1062) for future SQL\n * drivers.\n *\n * Distinct from `isConcurrentDdlRace` in `boot/ddl-bootstrap.ts`, which shares\n * the 23505 code but asks a different question — that one is about a losing\n * `CREATE`, this one is about a losing claim, and only the latter means\n * \"another instance already has this slot\".\n */\nfunction isUniqueViolation(err: unknown): boolean {\n    return hasInCauseChain(err, (e) =>\n        e.code === \"23505\" ||\n        e.errno === 1062 ||\n        (typeof e.message === \"string\" && e.message.includes(\"UNIQUE constraint failed\"))\n    );\n}\n\nexport function createCronStore(driver: DataDriver): CronStore | undefined {\n    const admin = driver.admin;\n    if (!isSQLAdmin(admin)) {\n        logger.warn(\"⚠️ [cron-store] DataDriver does not support SQL admin — cron logs will not be persisted.\");\n        return undefined;\n    }\n\n    const exec = (sqlText: string, options?: { params?: unknown[] }) =>\n        admin.executeSql(sqlText, options?.params ? { params: options.params } : undefined);\n\n    const ddl = createDdlBootstrapper(exec, \"cron-store\");\n\n    return {\n        async ensureTable(): Promise<void> {\n            // Creation. Every statement here is idempotent, so losing the race\n            // to a peer that booted at the same moment is survivable — but only\n            // if the loser retries rather than abandoning everything below it.\n            // One step each, so a hard failure on any one of them does not take\n            // the others with it. The claims table in particular must not be\n            // lost because an index on the *logs* table could not be built.\n            await ddl.ensureObject(\"Creating schema rebase\", \"CREATE SCHEMA IF NOT EXISTS rebase\");\n\n            await ddl.ensureObject(`Creating ${TABLE}`, `\n                CREATE TABLE IF NOT EXISTS ${TABLE} (\n                    id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,\n                    job_id TEXT NOT NULL,\n                    started_at TIMESTAMPTZ NOT NULL,\n                    finished_at TIMESTAMPTZ NOT NULL,\n                    duration_ms INTEGER NOT NULL,\n                    success BOOLEAN NOT NULL DEFAULT true,\n                    error TEXT,\n                    result JSONB,\n                    logs JSONB,\n                    manual BOOLEAN NOT NULL DEFAULT false\n                )\n            `);\n\n            await ddl.ensureObject(\"Creating idx_cron_logs_job\", `\n                CREATE INDEX IF NOT EXISTS idx_cron_logs_job\n                ON ${TABLE}(job_id, started_at DESC)\n            `);\n\n            await ddl.ensureObject(`Creating ${CLAIMS_TABLE}`, `\n                CREATE TABLE IF NOT EXISTS ${CLAIMS_TABLE} (\n                    job_id TEXT NOT NULL,\n                    slot TIMESTAMPTZ NOT NULL,\n                    claimed_at TIMESTAMPTZ NOT NULL DEFAULT now(),\n                    PRIMARY KEY (job_id, slot)\n                )\n            `);\n\n            // Everything from here is keyed on what actually exists, not on\n            // whether *this* instance is the one that created it. A single\n            // failure above used to abandon the rest of this method, which meant\n            // the loser of a boot race skipped the sweeps and — far worse — the\n            // privilege revocation, leaving the claims table writable by end\n            // users on an instance that reported nothing but a warning about\n            // log persistence.\n            const [logsReady, claimsReady] = await Promise.all([\n                ddl.isReadable(TABLE),\n                ddl.isReadable(CLAIMS_TABLE)\n            ]);\n\n            if (claimsReady) {\n                // Garbage-collect old claims — they are only needed while\n                // instances could still contend on the same slot.\n                await ddl.step(\"Claim retention sweep\", async () => {\n                    await exec(\n                        `DELETE FROM ${CLAIMS_TABLE} WHERE claimed_at < now() - make_interval(days => $1)`,\n                        { params: [CLAIM_RETENTION_DAYS] }\n                    );\n                });\n\n                // Drop claims for slots that have not happened yet. A slot is\n                // claimed at the moment it fires, so a future one can only come\n                // from a timer that woke early — and because claims are\n                // permanent, that claim would silently skip the real run when it\n                // finally came due. The margin keeps a legitimate claim made\n                // moments early by a clock-skewed peer.\n                await ddl.step(\"Future-slot claim sweep\", async () => {\n                    const stranded = await exec(\n                        `DELETE FROM ${CLAIMS_TABLE}\n                         WHERE slot > now() + make_interval(mins => $1)\n                         RETURNING job_id, slot`,\n                        { params: [FUTURE_CLAIM_SKEW_MINUTES] }\n                    );\n                    // A driver that does not honour RETURNING gives back\n                    // nothing; the rows are only used to report, so treat that\n                    // as \"none\".\n                    for (const row of (stranded ?? []) as { job_id: string; slot: string }[]) {\n                        logger.warn(\n                            `[cron-store] Released a claim on the future slot ${new Date(row.slot).toISOString()} ` +\n                            `for \"${row.job_id}\" — it was claimed by a timer that fired early, and would ` +\n                            \"otherwise have skipped that run\"\n                        );\n                    }\n                });\n            }\n\n            // Neither table is a collection, so neither carries RLS, while the\n            // Postgres driver's schema-wide grant reaches both. Cron logs hold\n            // job output — arbitrary application data — and a writable\n            // `cron_claims` lets any signed-in user suppress a scheduled run by\n            // claiming its slot. This is a security control, so it is re-applied\n            // by every instance on every boot, whatever else went wrong.\n            if (logsReady) {\n                await ddl.step(\"Revoking end-user access to cron_logs\", () =>\n                    exec(revokeInternalTableSql(\"rebase\", \"cron_logs\")));\n            }\n            if (claimsReady) {\n                await ddl.step(\"Revoking end-user access to cron_claims\", () =>\n                    exec(revokeInternalTableSql(\"rebase\", \"cron_claims\")));\n            }\n\n            if (logsReady && claimsReady) {\n                logger.info(\"✅ Cron logs table ready\");\n                return;\n            }\n            // Say which capability is gone, and what it costs. \"Continuing\n            // without cron log persistence\" undersold this: the claims table is\n            // the only thing stopping every instance from running every job.\n            if (!claimsReady) {\n                logger.error(\n                    `❌ [cron-store] ${CLAIMS_TABLE} is unavailable — scheduled runs cannot be coordinated. ` +\n                    \"With more than one app instance, every instance will now run every job on every tick.\"\n                );\n            }\n            if (!logsReady) {\n                logger.warn(`⚠️ [cron-store] ${TABLE} is unavailable — cron run history will not be persisted.`);\n            }\n        },\n\n        async insertLog(entry: CronJobLogEntry): Promise<void> {\n            try {\n                const resultJson = entry.result !== undefined ? JSON.stringify(entry.result) : null;\n                const logsJson = entry.logs.length > 0 ? JSON.stringify(entry.logs) : null;\n\n                await exec(\n                    `INSERT INTO ${TABLE} (job_id, started_at, finished_at, duration_ms, success, error, result, logs, manual)\n                     VALUES ($1, $2, $3, $4, $5, $6, $7::jsonb, $8::jsonb, $9)`,\n                    { params: [\n                        entry.jobId,\n                        entry.startedAt,\n                        entry.finishedAt,\n                        entry.durationMs,\n                        entry.success,\n                        entry.error || null,\n                        resultJson,\n                        logsJson,\n                        entry.manual\n                    ]}\n                );\n            } catch (err) {\n                // Non-blocking — log persistence should never crash the scheduler\n                logger.error(`[cron-store] Failed to persist log for \"${entry.jobId}\"`, { error: err });\n            }\n        },\n\n        async fetchLogs(jobId: string, limit = 50): Promise<CronJobLogEntry[]> {\n            try {\n                const rows = await exec(\n                    `SELECT job_id, started_at, finished_at, duration_ms, success, error, result, logs, manual\n                     FROM ${TABLE}\n                     WHERE job_id = $1\n                     ORDER BY started_at DESC\n                     LIMIT $2`,\n                    { params: [jobId, limit] }\n                );\n\n                return rows.map(rowToLogEntry);\n            } catch (err) {\n                logger.error(`[cron-store] Failed to fetch logs for \"${jobId}\"`, { error: err });\n                return [];\n            }\n        },\n\n        async fetchJobStats(): Promise<Map<string, { totalRuns: number; totalFailures: number; lastRunAt?: string }>> {\n            const stats = new Map<string, { totalRuns: number; totalFailures: number; lastRunAt?: string }>();\n            try {\n                const rows = await exec(`\n                    SELECT\n                        job_id,\n                        COUNT(*)::int AS total_runs,\n                        COUNT(*) FILTER (WHERE NOT success)::int AS total_failures,\n                        MAX(started_at) AS last_run_at\n                    FROM ${TABLE}\n                    GROUP BY job_id\n                `);\n\n                for (const row of rows) {\n                    stats.set(row.job_id as string, {\n                        totalRuns: row.total_runs as number,\n                        totalFailures: row.total_failures as number,\n                        lastRunAt: row.last_run_at ? new Date(row.last_run_at as string).toISOString() : undefined\n                    });\n                }\n            } catch (err) {\n                logger.error(\"[cron-store] Failed to fetch job stats\", { error: err });\n            }\n            return stats;\n        },\n\n        async tryClaimRun(jobId: string, slot: string): Promise<boolean> {\n            try {\n                const rows = await exec(\n                    `INSERT INTO ${CLAIMS_TABLE} (job_id, slot)\n                     VALUES ($1, $2)\n                     ON CONFLICT (job_id, slot) DO NOTHING\n                     RETURNING job_id`,\n                    { params: [jobId, slot] }\n                );\n                return rows.length > 0;\n            } catch (err) {\n                if (isUniqueViolation(err)) {\n                    // Another instance won the race for this slot\n                    return false;\n                }\n                // Fail open: better to risk a duplicate run than to have a\n                // broken claims table silently stop all cron execution.\n                logger.warn(`[cron-store] Claim check failed for \"${jobId}\" — running uncoordinated`, { error: err });\n                return true;\n            }\n        }\n    };\n}\n\n// ─── Helpers ─────────────────────────────────────────────────────────\n\nfunction rowToLogEntry(row: Record<string, unknown>): CronJobLogEntry {\n    return {\n        jobId: row.job_id as string,\n        startedAt: new Date(row.started_at as string).toISOString(),\n        finishedAt: new Date(row.finished_at as string).toISOString(),\n        durationMs: row.duration_ms as number,\n        success: row.success as boolean,\n        error: (row.error as string) ?? undefined,\n        result: row.result ?? undefined,\n        logs: Array.isArray(row.logs) ? row.logs : (row.logs ? (() => { try { return JSON.parse(row.logs as string); } catch { return []; } })() : []),\n        manual: row.manual as boolean\n    };\n}\n"],"mappings":";;;;;;;;;;;;AAyDA,IAAM,QAAQ;AACd,IAAM,eAAe;;AAGrB,IAAM,uBAAuB;;;;;;AAO7B,IAAM,4BAA4B;;;;;;;;;;;;AAalC,SAAS,kBAAkB,KAAuB;CAC9C,OAAO,gBAAgB,MAAM,MACzB,EAAE,SAAS,WACX,EAAE,UAAU,QACX,OAAO,EAAE,YAAY,YAAY,EAAE,QAAQ,SAAS,0BAA0B,CACnF;AACJ;AAEA,SAAgB,gBAAgB,QAA2C;CACvE,MAAM,QAAQ,OAAO;CACrB,IAAI,CAAC,WAAW,KAAK,GAAG;EACpB,OAAO,KAAK,0FAA0F;EACtG;CACJ;CAEA,MAAM,QAAQ,SAAiB,YAC3B,MAAM,WAAW,SAAS,SAAS,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,KAAA,CAAS;CAEtF,MAAM,MAAM,sBAAsB,MAAM,YAAY;CAEpD,OAAO;EACH,MAAM,cAA6B;GAO/B,MAAM,IAAI,aAAa,0BAA0B,oCAAoC;GAErF,MAAM,IAAI,aAAa,YAAY,SAAS;6CACX,MAAM;;;;;;;;;;;;aAYtC;GAED,MAAM,IAAI,aAAa,8BAA8B;;qBAE5C,MAAM;aACd;GAED,MAAM,IAAI,aAAa,YAAY,gBAAgB;6CAClB,aAAa;;;;;;aAM7C;GASD,MAAM,CAAC,WAAW,eAAe,MAAM,QAAQ,IAAI,CAC/C,IAAI,WAAW,KAAK,GACpB,IAAI,WAAW,YAAY,CAC/B,CAAC;GAED,IAAI,aAAa;IAGb,MAAM,IAAI,KAAK,yBAAyB,YAAY;KAChD,MAAM,KACF,eAAe,aAAa,wDAC5B,EAAE,QAAQ,CAAC,oBAAoB,EAAE,CACrC;IACJ,CAAC;IAQD,MAAM,IAAI,KAAK,2BAA2B,YAAY;KAClD,MAAM,WAAW,MAAM,KACnB,eAAe,aAAa;;kDAG5B,EAAE,QAAQ,CAAC,yBAAyB,EAAE,CAC1C;KAIA,KAAK,MAAM,OAAQ,YAAY,CAAC,GAC5B,OAAO,KACH,oDAAoD,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,YAAY,EAAE,QAC7E,IAAI,OAAO,0FAEvB;IAER,CAAC;GACL;GAQA,IAAI,WACA,MAAM,IAAI,KAAK,+CACX,KAAK,uBAAuB,UAAU,WAAW,CAAC,CAAC;GAE3D,IAAI,aACA,MAAM,IAAI,KAAK,iDACX,KAAK,uBAAuB,UAAU,aAAa,CAAC,CAAC;GAG7D,IAAI,aAAa,aAAa;IAC1B,OAAO,KAAK,yBAAyB;IACrC;GACJ;GAIA,IAAI,CAAC,aACD,OAAO,MACH,kBAAkB,aAAa,8IAEnC;GAEJ,IAAI,CAAC,WACD,OAAO,KAAK,mBAAmB,MAAM,0DAA0D;EAEvG;EAEA,MAAM,UAAU,OAAuC;GACnD,IAAI;IACA,MAAM,aAAa,MAAM,WAAW,KAAA,IAAY,KAAK,UAAU,MAAM,MAAM,IAAI;IAC/E,MAAM,WAAW,MAAM,KAAK,SAAS,IAAI,KAAK,UAAU,MAAM,IAAI,IAAI;IAEtE,MAAM,KACF,eAAe,MAAM;iFAErB,EAAE,QAAQ;KACN,MAAM;KACN,MAAM;KACN,MAAM;KACN,MAAM;KACN,MAAM;KACN,MAAM,SAAS;KACf;KACA;KACA,MAAM;IACV,EAAC,CACL;GACJ,SAAS,KAAK;IAEV,OAAO,MAAM,2CAA2C,MAAM,MAAM,IAAI,EAAE,OAAO,IAAI,CAAC;GAC1F;EACJ;EAEA,MAAM,UAAU,OAAe,QAAQ,IAAgC;GACnE,IAAI;IAUA,QAAO,MATY,KACf;4BACQ,MAAM;;;gCAId,EAAE,QAAQ,CAAC,OAAO,KAAK,EAAE,CAC7B,EAAA,CAEY,IAAI,aAAa;GACjC,SAAS,KAAK;IACV,OAAO,MAAM,0CAA0C,MAAM,IAAI,EAAE,OAAO,IAAI,CAAC;IAC/E,OAAO,CAAC;GACZ;EACJ;EAEA,MAAM,gBAAwG;GAC1G,MAAM,wBAAQ,IAAI,IAA8E;GAChG,IAAI;IACA,MAAM,OAAO,MAAM,KAAK;;;;;;2BAMb,MAAM;;iBAEhB;IAED,KAAK,MAAM,OAAO,MACd,MAAM,IAAI,IAAI,QAAkB;KAC5B,WAAW,IAAI;KACf,eAAe,IAAI;KACnB,WAAW,IAAI,cAAc,IAAI,KAAK,IAAI,WAAqB,CAAC,CAAC,YAAY,IAAI,KAAA;IACrF,CAAC;GAET,SAAS,KAAK;IACV,OAAO,MAAM,0CAA0C,EAAE,OAAO,IAAI,CAAC;GACzE;GACA,OAAO;EACX;EAEA,MAAM,YAAY,OAAe,MAAgC;GAC7D,IAAI;IAQA,QAAO,MAPY,KACf,eAAe,aAAa;;;wCAI5B,EAAE,QAAQ,CAAC,OAAO,IAAI,EAAE,CAC5B,EAAA,CACY,SAAS;GACzB,SAAS,KAAK;IACV,IAAI,kBAAkB,GAAG,GAErB,OAAO;IAIX,OAAO,KAAK,wCAAwC,MAAM,4BAA4B,EAAE,OAAO,IAAI,CAAC;IACpG,OAAO;GACX;EACJ;CACJ;AACJ;AAIA,SAAS,cAAc,KAA+C;CAClE,OAAO;EACH,OAAO,IAAI;EACX,WAAW,IAAI,KAAK,IAAI,UAAoB,CAAC,CAAC,YAAY;EAC1D,YAAY,IAAI,KAAK,IAAI,WAAqB,CAAC,CAAC,YAAY;EAC5D,YAAY,IAAI;EAChB,SAAS,IAAI;EACb,OAAQ,IAAI,SAAoB,KAAA;EAChC,QAAQ,IAAI,UAAU,KAAA;EACtB,MAAM,MAAM,QAAQ,IAAI,IAAI,IAAI,IAAI,OAAQ,IAAI,cAAc;GAAE,IAAI;IAAE,OAAO,KAAK,MAAM,IAAI,IAAc;GAAG,QAAQ;IAAE,OAAO,CAAC;GAAG;EAAE,EAAA,CAAG,IAAI,CAAC;EAC5I,QAAQ,IAAI;CAChB;AACJ"}
+{"version":3,"file":"cron-store-KeN8rN63.js","names":[],"sources":["../src/cron/cron-store.ts"],"sourcesContent":["import type { CronJobLogEntry } from \"@rebasepro/types\";\nimport type { DataDriver } from \"@rebasepro/types\";\nimport { isSQLAdmin } from \"@rebasepro/types\";\nimport { revokeInternalTableSql } from \"@rebasepro/common\";\nimport { logger } from \"../utils/logger.js\";\nimport { createDdlBootstrapper, hasInCauseChain } from \"../boot/ddl-bootstrap.js\";\n\n/**\n * Persistence layer for cron job execution logs.\n *\n * Uses the DataDriver's `admin.executeSql` capability to store logs in a\n * `rebase.cron_logs` table. Falls back gracefully if the driver doesn't\n * support SQL (e.g. MongoDB) — in that case, no persistence occurs.\n */\nexport interface CronStore {\n    /** Ensure the backing table exists. Called once on startup. */\n    ensureTable(): Promise<void>;\n\n    /** Persist a single log entry after execution. */\n    insertLog(entry: CronJobLogEntry): Promise<void>;\n\n    /**\n     * Fetch the most recent logs for a job.\n     * @param jobId  The job identifier\n     * @param limit  Max entries to return (default 50)\n     * @returns Logs sorted newest-first\n     */\n    fetchLogs(jobId: string, limit?: number): Promise<CronJobLogEntry[]>;\n\n    /**\n     * Fetch aggregate stats for all jobs (totalRuns, totalFailures, lastRunAt).\n     * Used to seed in-memory counters on startup.\n     */\n    fetchJobStats(): Promise<Map<string, { totalRuns: number; totalFailures: number; lastRunAt?: string }>>;\n\n    /**\n     * Atomically claim a scheduled run slot for a job.\n     *\n     * `slot` is the *scheduled* fire time (ISO string) derived from the cron\n     * expression — deterministic across instances regardless of timer drift,\n     * so all instances contend on the same (jobId, slot) key. Exactly one\n     * caller wins the insert against the unique constraint and executes;\n     * the rest skip.\n     *\n     * Fails open (returns true) on unexpected store errors, so a broken\n     * claims table degrades to uncoordinated execution rather than silently\n     * never running jobs.\n     *\n     * Optional so custom stores written against the pre-claims interface\n     * keep working — the scheduler treats a missing implementation as\n     * uncoordinated (always run).\n     */\n    tryClaimRun?(jobId: string, slot: string): Promise<boolean>;\n}\n\n// ─── SQL-based implementation ────────────────────────────────────────\n\nconst TABLE = \"rebase.cron_logs\";\nconst CLAIMS_TABLE = \"rebase.cron_claims\";\n\n/** Claims older than this are garbage-collected on startup. */\nconst CLAIM_RETENTION_DAYS = 7;\n\n/**\n * How far ahead a claim may legitimately sit. Slots are claimed as they fire,\n * so anything beyond this is a clock-skewed peer at best and a stranded claim\n * at worst; see the sweep in `ensureTable`.\n */\nconst FUTURE_CLAIM_SKEW_MINUTES = 2;\n\n/**\n * Detect a unique-constraint violation anywhere in an error's cause chain.\n * Match the SQLSTATE code, never message text. Also covers SQLite\n * (\"UNIQUE constraint failed\") and MySQL (ER_DUP_ENTRY 1062) for future SQL\n * drivers.\n *\n * Distinct from `isConcurrentDdlRace` in `boot/ddl-bootstrap.ts`, which shares\n * the 23505 code but asks a different question — that one is about a losing\n * `CREATE`, this one is about a losing claim, and only the latter means\n * \"another instance already has this slot\".\n */\nfunction isUniqueViolation(err: unknown): boolean {\n    return hasInCauseChain(err, (e) =>\n        e.code === \"23505\" ||\n        e.errno === 1062 ||\n        (typeof e.message === \"string\" && e.message.includes(\"UNIQUE constraint failed\"))\n    );\n}\n\nexport function createCronStore(driver: DataDriver): CronStore | undefined {\n    const admin = driver.admin;\n    if (!isSQLAdmin(admin)) {\n        logger.warn(\"⚠️ [cron-store] DataDriver does not support SQL admin — cron logs will not be persisted.\");\n        return undefined;\n    }\n\n    const exec = (sqlText: string, options?: { params?: unknown[] }) =>\n        admin.executeSql(sqlText, options?.params ? { params: options.params } : undefined);\n\n    const ddl = createDdlBootstrapper(exec, \"cron-store\");\n\n    return {\n        async ensureTable(): Promise<void> {\n            // Creation. Every statement here is idempotent, so losing the race\n            // to a peer that booted at the same moment is survivable — but only\n            // if the loser retries rather than abandoning everything below it.\n            // One step each, so a hard failure on any one of them does not take\n            // the others with it. The claims table in particular must not be\n            // lost because an index on the *logs* table could not be built.\n            await ddl.ensureObject(\"Creating schema rebase\", \"CREATE SCHEMA IF NOT EXISTS rebase\");\n\n            await ddl.ensureObject(`Creating ${TABLE}`, `\n                CREATE TABLE IF NOT EXISTS ${TABLE} (\n                    id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,\n                    job_id TEXT NOT NULL,\n                    started_at TIMESTAMPTZ NOT NULL,\n                    finished_at TIMESTAMPTZ NOT NULL,\n                    duration_ms INTEGER NOT NULL,\n                    success BOOLEAN NOT NULL DEFAULT true,\n                    error TEXT,\n                    result JSONB,\n                    logs JSONB,\n                    manual BOOLEAN NOT NULL DEFAULT false\n                )\n            `);\n\n            await ddl.ensureObject(\"Creating idx_cron_logs_job\", `\n                CREATE INDEX IF NOT EXISTS idx_cron_logs_job\n                ON ${TABLE}(job_id, started_at DESC)\n            `);\n\n            await ddl.ensureObject(`Creating ${CLAIMS_TABLE}`, `\n                CREATE TABLE IF NOT EXISTS ${CLAIMS_TABLE} (\n                    job_id TEXT NOT NULL,\n                    slot TIMESTAMPTZ NOT NULL,\n                    claimed_at TIMESTAMPTZ NOT NULL DEFAULT now(),\n                    PRIMARY KEY (job_id, slot)\n                )\n            `);\n\n            // Everything from here is keyed on what actually exists, not on\n            // whether *this* instance is the one that created it. A single\n            // failure above used to abandon the rest of this method, which meant\n            // the loser of a boot race skipped the sweeps and — far worse — the\n            // privilege revocation, leaving the claims table writable by end\n            // users on an instance that reported nothing but a warning about\n            // log persistence.\n            const [logsReady, claimsReady] = await Promise.all([\n                ddl.isReadable(TABLE),\n                ddl.isReadable(CLAIMS_TABLE)\n            ]);\n\n            if (claimsReady) {\n                // Garbage-collect old claims — they are only needed while\n                // instances could still contend on the same slot.\n                await ddl.step(\"Claim retention sweep\", async () => {\n                    await exec(\n                        `DELETE FROM ${CLAIMS_TABLE} WHERE claimed_at < now() - make_interval(days => $1)`,\n                        { params: [CLAIM_RETENTION_DAYS] }\n                    );\n                });\n\n                // Drop claims for slots that have not happened yet. A slot is\n                // claimed at the moment it fires, so a future one can only come\n                // from a timer that woke early — and because claims are\n                // permanent, that claim would silently skip the real run when it\n                // finally came due. The margin keeps a legitimate claim made\n                // moments early by a clock-skewed peer.\n                await ddl.step(\"Future-slot claim sweep\", async () => {\n                    const stranded = await exec(\n                        `DELETE FROM ${CLAIMS_TABLE}\n                         WHERE slot > now() + make_interval(mins => $1)\n                         RETURNING job_id, slot`,\n                        { params: [FUTURE_CLAIM_SKEW_MINUTES] }\n                    );\n                    // A driver that does not honour RETURNING gives back\n                    // nothing; the rows are only used to report, so treat that\n                    // as \"none\".\n                    for (const row of (stranded ?? []) as { job_id: string; slot: string }[]) {\n                        logger.warn(\n                            `[cron-store] Released a claim on the future slot ${new Date(row.slot).toISOString()} ` +\n                            `for \"${row.job_id}\" — it was claimed by a timer that fired early, and would ` +\n                            \"otherwise have skipped that run\"\n                        );\n                    }\n                });\n            }\n\n            // Neither table is a collection, so neither carries RLS, while the\n            // Postgres driver's schema-wide grant reaches both. Cron logs hold\n            // job output — arbitrary application data — and a writable\n            // `cron_claims` lets any signed-in user suppress a scheduled run by\n            // claiming its slot. This is a security control, so it is re-applied\n            // by every instance on every boot, whatever else went wrong.\n            if (logsReady) {\n                await ddl.step(\"Revoking end-user access to cron_logs\", () =>\n                    exec(revokeInternalTableSql(\"rebase\", \"cron_logs\")));\n            }\n            if (claimsReady) {\n                await ddl.step(\"Revoking end-user access to cron_claims\", () =>\n                    exec(revokeInternalTableSql(\"rebase\", \"cron_claims\")));\n            }\n\n            if (logsReady && claimsReady) {\n                logger.info(\"✅ Cron logs table ready\");\n                return;\n            }\n            // Say which capability is gone, and what it costs. \"Continuing\n            // without cron log persistence\" undersold this: the claims table is\n            // the only thing stopping every instance from running every job.\n            if (!claimsReady) {\n                logger.error(\n                    `❌ [cron-store] ${CLAIMS_TABLE} is unavailable — scheduled runs cannot be coordinated. ` +\n                    \"With more than one app instance, every instance will now run every job on every tick.\"\n                );\n            }\n            if (!logsReady) {\n                logger.warn(`⚠️ [cron-store] ${TABLE} is unavailable — cron run history will not be persisted.`);\n            }\n        },\n\n        async insertLog(entry: CronJobLogEntry): Promise<void> {\n            try {\n                const resultJson = entry.result !== undefined ? JSON.stringify(entry.result) : null;\n                const logsJson = entry.logs.length > 0 ? JSON.stringify(entry.logs) : null;\n\n                await exec(\n                    `INSERT INTO ${TABLE} (job_id, started_at, finished_at, duration_ms, success, error, result, logs, manual)\n                     VALUES ($1, $2, $3, $4, $5, $6, $7::jsonb, $8::jsonb, $9)`,\n                    { params: [\n                        entry.jobId,\n                        entry.startedAt,\n                        entry.finishedAt,\n                        entry.durationMs,\n                        entry.success,\n                        entry.error || null,\n                        resultJson,\n                        logsJson,\n                        entry.manual\n                    ]}\n                );\n            } catch (err) {\n                // Non-blocking — log persistence should never crash the scheduler\n                logger.error(`[cron-store] Failed to persist log for \"${entry.jobId}\"`, { error: err });\n            }\n        },\n\n        async fetchLogs(jobId: string, limit = 50): Promise<CronJobLogEntry[]> {\n            try {\n                const rows = await exec(\n                    `SELECT job_id, started_at, finished_at, duration_ms, success, error, result, logs, manual\n                     FROM ${TABLE}\n                     WHERE job_id = $1\n                     ORDER BY started_at DESC\n                     LIMIT $2`,\n                    { params: [jobId, limit] }\n                );\n\n                return rows.map(rowToLogEntry);\n            } catch (err) {\n                logger.error(`[cron-store] Failed to fetch logs for \"${jobId}\"`, { error: err });\n                return [];\n            }\n        },\n\n        async fetchJobStats(): Promise<Map<string, { totalRuns: number; totalFailures: number; lastRunAt?: string }>> {\n            const stats = new Map<string, { totalRuns: number; totalFailures: number; lastRunAt?: string }>();\n            try {\n                const rows = await exec(`\n                    SELECT\n                        job_id,\n                        COUNT(*)::int AS total_runs,\n                        COUNT(*) FILTER (WHERE NOT success)::int AS total_failures,\n                        MAX(started_at) AS last_run_at\n                    FROM ${TABLE}\n                    GROUP BY job_id\n                `);\n\n                for (const row of rows) {\n                    stats.set(row.job_id as string, {\n                        totalRuns: row.total_runs as number,\n                        totalFailures: row.total_failures as number,\n                        lastRunAt: row.last_run_at ? new Date(row.last_run_at as string).toISOString() : undefined\n                    });\n                }\n            } catch (err) {\n                logger.error(\"[cron-store] Failed to fetch job stats\", { error: err });\n            }\n            return stats;\n        },\n\n        async tryClaimRun(jobId: string, slot: string): Promise<boolean> {\n            try {\n                const rows = await exec(\n                    `INSERT INTO ${CLAIMS_TABLE} (job_id, slot)\n                     VALUES ($1, $2)\n                     ON CONFLICT (job_id, slot) DO NOTHING\n                     RETURNING job_id`,\n                    { params: [jobId, slot] }\n                );\n                return rows.length > 0;\n            } catch (err) {\n                if (isUniqueViolation(err)) {\n                    // Another instance won the race for this slot\n                    return false;\n                }\n                // Fail open: better to risk a duplicate run than to have a\n                // broken claims table silently stop all cron execution.\n                logger.warn(`[cron-store] Claim check failed for \"${jobId}\" — running uncoordinated`, { error: err });\n                return true;\n            }\n        }\n    };\n}\n\n// ─── Helpers ─────────────────────────────────────────────────────────\n\nfunction rowToLogEntry(row: Record<string, unknown>): CronJobLogEntry {\n    return {\n        jobId: row.job_id as string,\n        startedAt: new Date(row.started_at as string).toISOString(),\n        finishedAt: new Date(row.finished_at as string).toISOString(),\n        durationMs: row.duration_ms as number,\n        success: row.success as boolean,\n        error: (row.error as string) ?? undefined,\n        result: row.result ?? undefined,\n        logs: Array.isArray(row.logs) ? row.logs : (row.logs ? (() => { try { return JSON.parse(row.logs as string); } catch { return []; } })() : []),\n        manual: row.manual as boolean\n    };\n}\n"],"mappings":";;;;;;;;;;;;AAyDA,IAAM,QAAQ;AACd,IAAM,eAAe;;AAGrB,IAAM,uBAAuB;;;;;;AAO7B,IAAM,4BAA4B;;;;;;;;;;;;AAalC,SAAS,kBAAkB,KAAuB;CAC9C,OAAO,gBAAgB,MAAM,MACzB,EAAE,SAAS,WACX,EAAE,UAAU,QACX,OAAO,EAAE,YAAY,YAAY,EAAE,QAAQ,SAAS,0BAA0B,CACnF;AACJ;AAEA,SAAgB,gBAAgB,QAA2C;CACvE,MAAM,QAAQ,OAAO;CACrB,IAAI,CAAC,WAAW,KAAK,GAAG;EACpB,OAAO,KAAK,0FAA0F;EACtG;CACJ;CAEA,MAAM,QAAQ,SAAiB,YAC3B,MAAM,WAAW,SAAS,SAAS,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,KAAA,CAAS;CAEtF,MAAM,MAAM,sBAAsB,MAAM,YAAY;CAEpD,OAAO;EACH,MAAM,cAA6B;GAO/B,MAAM,IAAI,aAAa,0BAA0B,oCAAoC;GAErF,MAAM,IAAI,aAAa,YAAY,SAAS;6CACX,MAAM;;;;;;;;;;;;aAYtC;GAED,MAAM,IAAI,aAAa,8BAA8B;;qBAE5C,MAAM;aACd;GAED,MAAM,IAAI,aAAa,YAAY,gBAAgB;6CAClB,aAAa;;;;;;aAM7C;GASD,MAAM,CAAC,WAAW,eAAe,MAAM,QAAQ,IAAI,CAC/C,IAAI,WAAW,KAAK,GACpB,IAAI,WAAW,YAAY,CAC/B,CAAC;GAED,IAAI,aAAa;IAGb,MAAM,IAAI,KAAK,yBAAyB,YAAY;KAChD,MAAM,KACF,eAAe,aAAa,wDAC5B,EAAE,QAAQ,CAAC,oBAAoB,EAAE,CACrC;IACJ,CAAC;IAQD,MAAM,IAAI,KAAK,2BAA2B,YAAY;KAClD,MAAM,WAAW,MAAM,KACnB,eAAe,aAAa;;kDAG5B,EAAE,QAAQ,CAAC,yBAAyB,EAAE,CAC1C;KAIA,KAAK,MAAM,OAAQ,YAAY,CAAC,GAC5B,OAAO,KACH,oDAAoD,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,YAAY,EAAE,QAC7E,IAAI,OAAO,0FAEvB;IAER,CAAC;GACL;GAQA,IAAI,WACA,MAAM,IAAI,KAAK,+CACX,KAAK,uBAAuB,UAAU,WAAW,CAAC,CAAC;GAE3D,IAAI,aACA,MAAM,IAAI,KAAK,iDACX,KAAK,uBAAuB,UAAU,aAAa,CAAC,CAAC;GAG7D,IAAI,aAAa,aAAa;IAC1B,OAAO,KAAK,yBAAyB;IACrC;GACJ;GAIA,IAAI,CAAC,aACD,OAAO,MACH,kBAAkB,aAAa,8IAEnC;GAEJ,IAAI,CAAC,WACD,OAAO,KAAK,mBAAmB,MAAM,0DAA0D;EAEvG;EAEA,MAAM,UAAU,OAAuC;GACnD,IAAI;IACA,MAAM,aAAa,MAAM,WAAW,KAAA,IAAY,KAAK,UAAU,MAAM,MAAM,IAAI;IAC/E,MAAM,WAAW,MAAM,KAAK,SAAS,IAAI,KAAK,UAAU,MAAM,IAAI,IAAI;IAEtE,MAAM,KACF,eAAe,MAAM;iFAErB,EAAE,QAAQ;KACN,MAAM;KACN,MAAM;KACN,MAAM;KACN,MAAM;KACN,MAAM;KACN,MAAM,SAAS;KACf;KACA;KACA,MAAM;IACV,EAAC,CACL;GACJ,SAAS,KAAK;IAEV,OAAO,MAAM,2CAA2C,MAAM,MAAM,IAAI,EAAE,OAAO,IAAI,CAAC;GAC1F;EACJ;EAEA,MAAM,UAAU,OAAe,QAAQ,IAAgC;GACnE,IAAI;IAUA,QAAO,MATY,KACf;4BACQ,MAAM;;;gCAId,EAAE,QAAQ,CAAC,OAAO,KAAK,EAAE,CAC7B,EAAA,CAEY,IAAI,aAAa;GACjC,SAAS,KAAK;IACV,OAAO,MAAM,0CAA0C,MAAM,IAAI,EAAE,OAAO,IAAI,CAAC;IAC/E,OAAO,CAAC;GACZ;EACJ;EAEA,MAAM,gBAAwG;GAC1G,MAAM,wBAAQ,IAAI,IAA8E;GAChG,IAAI;IACA,MAAM,OAAO,MAAM,KAAK;;;;;;2BAMb,MAAM;;iBAEhB;IAED,KAAK,MAAM,OAAO,MACd,MAAM,IAAI,IAAI,QAAkB;KAC5B,WAAW,IAAI;KACf,eAAe,IAAI;KACnB,WAAW,IAAI,cAAc,IAAI,KAAK,IAAI,WAAqB,CAAC,CAAC,YAAY,IAAI,KAAA;IACrF,CAAC;GAET,SAAS,KAAK;IACV,OAAO,MAAM,0CAA0C,EAAE,OAAO,IAAI,CAAC;GACzE;GACA,OAAO;EACX;EAEA,MAAM,YAAY,OAAe,MAAgC;GAC7D,IAAI;IAQA,QAAO,MAPY,KACf,eAAe,aAAa;;;wCAI5B,EAAE,QAAQ,CAAC,OAAO,IAAI,EAAE,CAC5B,EAAA,CACY,SAAS;GACzB,SAAS,KAAK;IACV,IAAI,kBAAkB,GAAG,GAErB,OAAO;IAIX,OAAO,KAAK,wCAAwC,MAAM,4BAA4B,EAAE,OAAO,IAAI,CAAC;IACpG,OAAO;GACX;EACJ;CACJ;AACJ;AAIA,SAAS,cAAc,KAA+C;CAClE,OAAO;EACH,OAAO,IAAI;EACX,WAAW,IAAI,KAAK,IAAI,UAAoB,CAAC,CAAC,YAAY;EAC1D,YAAY,IAAI,KAAK,IAAI,WAAqB,CAAC,CAAC,YAAY;EAC5D,YAAY,IAAI;EAChB,SAAS,IAAI;EACb,OAAQ,IAAI,SAAoB,KAAA;EAChC,QAAQ,IAAI,UAAU,KAAA;EACtB,MAAM,MAAM,QAAQ,IAAI,IAAI,IAAI,IAAI,OAAQ,IAAI,cAAc;GAAE,IAAI;IAAE,OAAO,KAAK,MAAM,IAAI,IAAc;GAAG,QAAQ;IAAE,OAAO,CAAC;GAAG;EAAE,EAAA,CAAG,IAAI,CAAC;EAC5I,QAAQ,IAAI;CAChB;AACJ"}

package/dist/{history-recorder-BMSFyySP.js → history-recorder-B2pL3X8b.js}

@@ -3,7 +3,7 @@ import __rebaseProcess from "process";
 globalThis.process ??= __rebaseProcess;
 __rebaseCreateRequire(import.meta.url);
 import { t as logger } from "./logger-DS03e908.js";
-import { a as recordSamples, i as readSeries, n as SAMPLE_INTERVAL_MS, o as sampleSelf, r as ensureMetricsHistory } from "./history-store-Dtsip8nH.js";
+import { a as recordSamples, i as readSeries, n as SAMPLE_INTERVAL_MS, o as sampleSelf, r as ensureMetricsHistory } from "./history-store-BUJ-37Sm.js";
 import { monitorEventLoopDelay } from "node:perf_hooks";
 //#region src/metrics/history-recorder.ts
 /**
@@ -73,4 +73,4 @@ function createMetricsHistory(driver) {
 //#endregion
 export { createMetricsHistory };
 
-//# sourceMappingURL=history-recorder-BMSFyySP.js.map
+//# sourceMappingURL=history-recorder-B2pL3X8b.js.map

package/dist/{history-recorder-BMSFyySP.js.map → history-recorder-B2pL3X8b.js.map}

@@ -1 +1 @@
-{"version":3,"file":"history-recorder-BMSFyySP.js","names":[],"sources":["../src/metrics/history-recorder.ts"],"sourcesContent":["/**\n * Wiring the history store to a driver and a timer.\n *\n * Split from `history-store.ts` so the store stays pure — every rule in it is\n * testable with a fake executor, and nothing there knows what a DataDriver is.\n * This half is the part that cannot be unit-tested meaningfully: it opens a\n * connection and starts an interval.\n */\nimport { monitorEventLoopDelay } from \"node:perf_hooks\";\nimport { logger } from \"../utils/logger.js\";\nimport type { DataDriver } from \"@rebasepro/types\";\nimport {\n    ensureMetricsHistory,\n    recordSamples,\n    readSeries,\n    sampleSelf,\n    SAMPLE_INTERVAL_MS,\n    type Exec,\n    type MetricSeries,\n    type SeriesPoint\n} from \"./history-store.js\";\n\nexport interface MetricsHistory {\n    /** Create the table and sweep what has aged out. */\n    ensure(): Promise<void>;\n    /** Begin sampling this process. Returns a stop. */\n    start(): () => void;\n    /** Read one series, for the route and for anything else that asks. */\n    read(series: MetricSeries, sinceMinutes: number): Promise<SeriesPoint[]>;\n}\n\n/** Narrow structural check, matching how the job store decides the same thing. */\nfunction sqlExecutorOf(driver: DataDriver): Exec | undefined {\n    const admin = (driver as { admin?: { executeSql?: unknown } }).admin;\n    if (!admin || typeof admin.executeSql !== \"function\") return undefined;\n    const executeSql = admin.executeSql as (sql: string, opts?: { params?: unknown[] }) => Promise<unknown>;\n    return (sql, params) => executeSql(sql, params ? { params } : undefined);\n}\n\n/**\n * History for this deployment, or `undefined` when it cannot have any.\n *\n * Undefined rather than a no-op: the route turns it into a named 501, because a\n * chart that renders empty is indistinguishable from a quiet period and this is\n * exactly the class of silence the panel it feeds exists to remove.\n */\nexport function createMetricsHistory(driver: DataDriver): MetricsHistory | undefined {\n    const exec = sqlExecutorOf(driver);\n    if (!exec) {\n        logger.debug(\"[metrics] driver has no SQL admin — no metrics history will be kept.\");\n        return undefined;\n    }\n\n    return {\n        ensure: () => ensureMetricsHistory(exec),\n        read: (series, sinceMinutes) => readSeries(exec, series, sinceMinutes),\n        start(): () => void {\n            // Which process this is. A tenant's replicas share one database and\n            // each records its own numbers, so a row needs to say whose they\n            // are — without it they overwrite each other and a scaled-out app\n            // charts one arbitrary pod.\n            //\n            // HOSTNAME is the pod name on Kubernetes and the container id under\n            // Docker; the pid fallback keeps two local processes distinct.\n            const instance = process.env.HOSTNAME?.trim() || `pid-${process.pid}`;\n            let cursor: { cpu: NodeJS.CpuUsage; at: number } | null = null;\n            let stopped = false;\n\n            // Event-loop delay: how long a callback waited past its schedule.\n            // The one number here that says whether this process is *healthy*\n            // rather than how much it is consuming — a pod can sit at 20% CPU\n            // and still be unable to answer, and nothing else recorded would\n            // show it.\n            //\n            // `monitorEventLoopDelay` samples in libuv at a fixed resolution and\n            // costs effectively nothing; `.enable()` is required, and the\n            // histogram is reset each tick so every sample describes its own\n            // minute rather than the process's whole life.\n            interface LoopHistogram { mean: number; enable(): void; reset(): void }\n            let loop: LoopHistogram | null = null;\n            try {\n                loop = monitorEventLoopDelay({ resolution: 20 }) as unknown as LoopHistogram;\n                loop.enable();\n            } catch {\n                // A runtime without it still records the other two.\n                loop = null;\n            }\n\n            const tick = async () => {\n                if (stopped) return;\n                // Nanoseconds from the histogram, milliseconds on the wire.\n                const delayMs = loop ? loop.mean / 1e6 : undefined;\n                loop?.reset();\n                const { samples, cursor: next } = sampleSelf(cursor, Date.now(), delayMs);\n                cursor = next;\n                try {\n                    await recordSamples(exec, samples, instance);\n                } catch (err) {\n                    // Never fatal, and never noisy: a sampler that crash-loops a\n                    // pod over a chart would be a far worse trade than a gap in\n                    // one. The gap is visible in the data; a restart loop is not.\n                    logger.debug(\"[metrics] could not record a sample\", { err });\n                }\n            };\n\n            // The first tick establishes the CPU cursor and publishes memory;\n            // the rate needs a second reading, which is why nothing claims a CPU\n            // figure until one interval has passed.\n            void tick();\n            const timer = setInterval(() => void tick(), SAMPLE_INTERVAL_MS);\n            // Not the reason this process should stay alive.\n            timer.unref?.();\n\n            return () => { stopped = true; clearInterval(timer); };\n        }\n    };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAgCA,SAAS,cAAc,QAAsC;CACzD,MAAM,QAAS,OAAgD;CAC/D,IAAI,CAAC,SAAS,OAAO,MAAM,eAAe,YAAY,OAAO,KAAA;CAC7D,MAAM,aAAa,MAAM;CACzB,QAAQ,KAAK,WAAW,WAAW,KAAK,SAAS,EAAE,OAAO,IAAI,KAAA,CAAS;AAC3E;;;;;;;;AASA,SAAgB,qBAAqB,QAAgD;CACjF,MAAM,OAAO,cAAc,MAAM;CACjC,IAAI,CAAC,MAAM;EACP,OAAO,MAAM,sEAAsE;EACnF;CACJ;CAEA,OAAO;EACH,cAAc,qBAAqB,IAAI;EACvC,OAAO,QAAQ,iBAAiB,WAAW,MAAM,QAAQ,YAAY;EACrE,QAAoB;GAQhB,MAAM,WAAW,QAAQ,IAAI,UAAU,KAAK,KAAK,OAAO,QAAQ;GAChE,IAAI,SAAsD;GAC1D,IAAI,UAAU;GAad,IAAI,OAA6B;GACjC,IAAI;IACA,OAAO,sBAAsB,EAAE,YAAY,GAAG,CAAC;IAC/C,KAAK,OAAO;GAChB,QAAQ;IAEJ,OAAO;GACX;GAEA,MAAM,OAAO,YAAY;IACrB,IAAI,SAAS;IAEb,MAAM,UAAU,OAAO,KAAK,OAAO,MAAM,KAAA;IACzC,MAAM,MAAM;IACZ,MAAM,EAAE,SAAS,QAAQ,SAAS,WAAW,QAAQ,KAAK,IAAI,GAAG,OAAO;IACxE,SAAS;IACT,IAAI;KACA,MAAM,cAAc,MAAM,SAAS,QAAQ;IAC/C,SAAS,KAAK;KAIV,OAAO,MAAM,uCAAuC,EAAE,IAAI,CAAC;IAC/D;GACJ;GAKA,KAAU;GACV,MAAM,QAAQ,kBAAkB,KAAK,KAAK,GAAG,kBAAkB;GAE/D,MAAM,QAAQ;GAEd,aAAa;IAAE,UAAU;IAAM,cAAc,KAAK;GAAG;EACzD;CACJ;AACJ"}
+{"version":3,"file":"history-recorder-B2pL3X8b.js","names":[],"sources":["../src/metrics/history-recorder.ts"],"sourcesContent":["/**\n * Wiring the history store to a driver and a timer.\n *\n * Split from `history-store.ts` so the store stays pure — every rule in it is\n * testable with a fake executor, and nothing there knows what a DataDriver is.\n * This half is the part that cannot be unit-tested meaningfully: it opens a\n * connection and starts an interval.\n */\nimport { monitorEventLoopDelay } from \"node:perf_hooks\";\nimport { logger } from \"../utils/logger.js\";\nimport type { DataDriver } from \"@rebasepro/types\";\nimport {\n    ensureMetricsHistory,\n    recordSamples,\n    readSeries,\n    sampleSelf,\n    SAMPLE_INTERVAL_MS,\n    type Exec,\n    type MetricSeries,\n    type SeriesPoint\n} from \"./history-store.js\";\n\nexport interface MetricsHistory {\n    /** Create the table and sweep what has aged out. */\n    ensure(): Promise<void>;\n    /** Begin sampling this process. Returns a stop. */\n    start(): () => void;\n    /** Read one series, for the route and for anything else that asks. */\n    read(series: MetricSeries, sinceMinutes: number): Promise<SeriesPoint[]>;\n}\n\n/** Narrow structural check, matching how the job store decides the same thing. */\nfunction sqlExecutorOf(driver: DataDriver): Exec | undefined {\n    const admin = (driver as { admin?: { executeSql?: unknown } }).admin;\n    if (!admin || typeof admin.executeSql !== \"function\") return undefined;\n    const executeSql = admin.executeSql as (sql: string, opts?: { params?: unknown[] }) => Promise<unknown>;\n    return (sql, params) => executeSql(sql, params ? { params } : undefined);\n}\n\n/**\n * History for this deployment, or `undefined` when it cannot have any.\n *\n * Undefined rather than a no-op: the route turns it into a named 501, because a\n * chart that renders empty is indistinguishable from a quiet period and this is\n * exactly the class of silence the panel it feeds exists to remove.\n */\nexport function createMetricsHistory(driver: DataDriver): MetricsHistory | undefined {\n    const exec = sqlExecutorOf(driver);\n    if (!exec) {\n        logger.debug(\"[metrics] driver has no SQL admin — no metrics history will be kept.\");\n        return undefined;\n    }\n\n    return {\n        ensure: () => ensureMetricsHistory(exec),\n        read: (series, sinceMinutes) => readSeries(exec, series, sinceMinutes),\n        start(): () => void {\n            // Which process this is. A tenant's replicas share one database and\n            // each records its own numbers, so a row needs to say whose they\n            // are — without it they overwrite each other and a scaled-out app\n            // charts one arbitrary pod.\n            //\n            // HOSTNAME is the pod name on Kubernetes and the container id under\n            // Docker; the pid fallback keeps two local processes distinct.\n            const instance = process.env.HOSTNAME?.trim() || `pid-${process.pid}`;\n            let cursor: { cpu: NodeJS.CpuUsage; at: number } | null = null;\n            let stopped = false;\n\n            // Event-loop delay: how long a callback waited past its schedule.\n            // The one number here that says whether this process is *healthy*\n            // rather than how much it is consuming — a pod can sit at 20% CPU\n            // and still be unable to answer, and nothing else recorded would\n            // show it.\n            //\n            // `monitorEventLoopDelay` samples in libuv at a fixed resolution and\n            // costs effectively nothing; `.enable()` is required, and the\n            // histogram is reset each tick so every sample describes its own\n            // minute rather than the process's whole life.\n            interface LoopHistogram { mean: number; enable(): void; reset(): void }\n            let loop: LoopHistogram | null = null;\n            try {\n                loop = monitorEventLoopDelay({ resolution: 20 }) as unknown as LoopHistogram;\n                loop.enable();\n            } catch {\n                // A runtime without it still records the other two.\n                loop = null;\n            }\n\n            const tick = async () => {\n                if (stopped) return;\n                // Nanoseconds from the histogram, milliseconds on the wire.\n                const delayMs = loop ? loop.mean / 1e6 : undefined;\n                loop?.reset();\n                const { samples, cursor: next } = sampleSelf(cursor, Date.now(), delayMs);\n                cursor = next;\n                try {\n                    await recordSamples(exec, samples, instance);\n                } catch (err) {\n                    // Never fatal, and never noisy: a sampler that crash-loops a\n                    // pod over a chart would be a far worse trade than a gap in\n                    // one. The gap is visible in the data; a restart loop is not.\n                    logger.debug(\"[metrics] could not record a sample\", { err });\n                }\n            };\n\n            // The first tick establishes the CPU cursor and publishes memory;\n            // the rate needs a second reading, which is why nothing claims a CPU\n            // figure until one interval has passed.\n            void tick();\n            const timer = setInterval(() => void tick(), SAMPLE_INTERVAL_MS);\n            // Not the reason this process should stay alive.\n            timer.unref?.();\n\n            return () => { stopped = true; clearInterval(timer); };\n        }\n    };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAgCA,SAAS,cAAc,QAAsC;CACzD,MAAM,QAAS,OAAgD;CAC/D,IAAI,CAAC,SAAS,OAAO,MAAM,eAAe,YAAY,OAAO,KAAA;CAC7D,MAAM,aAAa,MAAM;CACzB,QAAQ,KAAK,WAAW,WAAW,KAAK,SAAS,EAAE,OAAO,IAAI,KAAA,CAAS;AAC3E;;;;;;;;AASA,SAAgB,qBAAqB,QAAgD;CACjF,MAAM,OAAO,cAAc,MAAM;CACjC,IAAI,CAAC,MAAM;EACP,OAAO,MAAM,sEAAsE;EACnF;CACJ;CAEA,OAAO;EACH,cAAc,qBAAqB,IAAI;EACvC,OAAO,QAAQ,iBAAiB,WAAW,MAAM,QAAQ,YAAY;EACrE,QAAoB;GAQhB,MAAM,WAAW,QAAQ,IAAI,UAAU,KAAK,KAAK,OAAO,QAAQ;GAChE,IAAI,SAAsD;GAC1D,IAAI,UAAU;GAad,IAAI,OAA6B;GACjC,IAAI;IACA,OAAO,sBAAsB,EAAE,YAAY,GAAG,CAAC;IAC/C,KAAK,OAAO;GAChB,QAAQ;IAEJ,OAAO;GACX;GAEA,MAAM,OAAO,YAAY;IACrB,IAAI,SAAS;IAEb,MAAM,UAAU,OAAO,KAAK,OAAO,MAAM,KAAA;IACzC,MAAM,MAAM;IACZ,MAAM,EAAE,SAAS,QAAQ,SAAS,WAAW,QAAQ,KAAK,IAAI,GAAG,OAAO;IACxE,SAAS;IACT,IAAI;KACA,MAAM,cAAc,MAAM,SAAS,QAAQ;IAC/C,SAAS,KAAK;KAIV,OAAO,MAAM,uCAAuC,EAAE,IAAI,CAAC;IAC/D;GACJ;GAKA,KAAU;GACV,MAAM,QAAQ,kBAAkB,KAAK,KAAK,GAAG,kBAAkB;GAE/D,MAAM,QAAQ;GAEd,aAAa;IAAE,UAAU;IAAM,cAAc,KAAK;GAAG;EACzD;CACJ;AACJ"}

package/dist/{history-store-Dtsip8nH.js → history-store-BUJ-37Sm.js}

@@ -2,7 +2,7 @@ import { createRequire as __rebaseCreateRequire } from "module";
 import __rebaseProcess from "process";
 globalThis.process ??= __rebaseProcess;
 __rebaseCreateRequire(import.meta.url);
-import "./src-B-CmIFMr.js";
+import "./src-C9gKj23J.js";
 import { t as revokeInternalTableSql } from "./internal-tables-DYVcFFSv.js";
 //#region src/metrics/history-store.ts
 /**
@@ -207,4 +207,4 @@ async function readSeries(exec, series, sinceMinutes) {
 //#endregion
 export { recordSamples as a, readSeries as i, SAMPLE_INTERVAL_MS as n, sampleSelf as o, ensureMetricsHistory as r, METRIC_SERIES as t };
 
-//# sourceMappingURL=history-store-Dtsip8nH.js.map
+//# sourceMappingURL=history-store-BUJ-37Sm.js.map

package/dist/{history-store-Dtsip8nH.js.map → history-store-BUJ-37Sm.js.map}

@@ -1 +1 @@
-{"version":3,"file":"history-store-Dtsip8nH.js","names":[],"sources":["../src/metrics/history-store.ts"],"sourcesContent":["/**\n * A little history for the metrics this process already keeps.\n *\n * ## Why this is in the framework and not in the cloud console\n *\n * The console wants to draw \"CPU over the last hour\". The obvious way to get it\n * on GKE is Cloud Monitoring, which already collects exactly this — and which\n * would make the panel unportable the day the platform moves, for a feature\n * every self-hoster also wants. So the history lives where the runtime lives:\n * the process samples ITSELF, into its OWN database, and anything that can read\n * the database can draw the chart. No cluster, no metrics-server, no vendor.\n *\n * That is the same rule the binder follows — the cloud is a better\n * implementation behind the same interface, never a different one.\n *\n * ## Why it stays cheap\n *\n * One row per series per instance per minute. Three series across two replicas\n * is 8,640 rows a day, and the sweep below bounds the window, so the table settles\n * at a size measured in megabytes. It is deliberately NOT a general time-series\n * store: no labels, no cardinality to explode, no per-request rows.\n *\n * A minute is the resolution because that is what the question needs — \"was it\n * slow at 15:40\", \"did my deploy cause that\" — and because a finer grain buys\n * nothing a reader can see on a chart of an hour.\n */\n/**\n * The positional-parameter shape every store in this package settles on.\n *\n * The bootstrapper's own `SqlExec` takes an options object; each store wraps it\n * once and reads better for it. Same two shapes, same reason, as `job-store`.\n */\nimport { revokeInternalTableSql } from \"@rebasepro/common\";\n\nexport type Exec = (sql: string, params?: unknown[]) => Promise<unknown>;\n\n/** Where the samples live. Framework-owned, like `rebase.jobs`. */\nexport const METRICS_HISTORY_TABLE = \"rebase.metric_samples\";\n\n/**\n * How long a sample is kept.\n *\n * Two weeks answers \"is this worse than last week\" and stops well short of\n * being an archive. Anything that needs to outlive it — billing, capacity\n * planning — is a rollup somebody else owns, not a longer retention here.\n *\n * Read it as \"14 days, or since this process started, whichever is longer\": the\n * sweep runs at boot and nowhere else, so a pod up for 90 days holds 90 days.\n * That is a deliberate trade rather than an oversight — a cron for it would be\n * machinery for a table that stays trivial either way, and reads are bounded by\n * the index regardless — but the table does not \"reach a steady size and stay\n * there\" on a long-lived pod, which an earlier version of this comment claimed.\n */\nexport const RETENTION_DAYS = 14;\n\n/** How often the process samples itself. Matched to the resolution it stores. */\nexport const SAMPLE_INTERVAL_MS = 60_000;\n\n/**\n * The series this records. A closed set on purpose — see the cardinality note.\n *\n * A list rather than only a union, because the route validates against it: an\n * unknown `?series=` must be a named 400 rather than an empty chart, which\n * reads exactly like a quiet period.\n *\n * **It lists what `sampleSelf` actually writes, and nothing else.** It used to\n * also name `requests_total`, `errors_total` and `event_loop_delay_ms`, none of\n * which anything ever recorded — so those three were *valid* parameters that\n * returned `points: []`, which is precisely the empty chart the 400 two\n * paragraphs up exists to prevent. A declared-but-unwritten series is worse\n * than an absent one: the 400 tells you the name is wrong, and the empty array\n * tells you the app was quiet.\n *\n * `event_loop_delay_ms` kept its place by gaining a sampler, because it is the\n * one signal here that says whether the process is *healthy* rather than how\n * much it is using, and it has no counter semantics to get wrong.\n *\n * `requests_total` and `errors_total` were dropped rather than wired up. The\n * registry does hold them, but they reset on restart, and a resetting counter\n * summed across replicas is not monotonic — a rolling deploy would draw a\n * cliff that looks like traffic collapsing. That needs a deliberate decision\n * about deltas and resets, not a line added at 2am. Adding either back means\n * adding its sampler in the same commit.\n */\nexport const METRIC_SERIES = [\n    \"cpu_millicores\",\n    \"memory_bytes\",\n    \"event_loop_delay_ms\"\n] as const;\n\nexport type MetricSeries = (typeof METRIC_SERIES)[number];\n\nexport interface MetricSample {\n    at: Date;\n    series: MetricSeries;\n    value: number;\n}\n\n/**\n * Create the table and sweep what has aged out.\n *\n * Called at boot, beside the job and cron stores, and for the same reason they\n * do it there: the only moment the schema is guaranteed to be reachable and\n * nobody is mid-request.\n */\nexport async function ensureMetricsHistory(exec: Exec): Promise<void> {\n    await exec(`\n        CREATE TABLE IF NOT EXISTS ${METRICS_HISTORY_TABLE} (\n            at        timestamptz      NOT NULL,\n            series    text             NOT NULL,\n            instance  text             NOT NULL,\n            value     double precision NOT NULL,\n            PRIMARY KEY (series, instance, at)\n        )\n    `, []);\n\n    // (series, at DESC) rather than the primary key's order: every read is\n    // \"this series across all instances, bounded by time\", and the PK leads with\n    // instance, which is the wrong first column for that scan.\n    await exec(`\n        CREATE INDEX IF NOT EXISTS metric_samples_series_recent\n            ON ${METRICS_HISTORY_TABLE} (series, at DESC)\n    `, []);\n\n    // Framework-internal, so the end-user role must not be able to address it.\n    //\n    // The driver grants `rebase_user` full DML across the schemas a project\n    // uses, plus `ALTER DEFAULT PRIVILEGES` so tables created later inherit it —\n    // and this one is created later, at boot. Without the revoke, an\n    // authenticated request could read and write another deployment's process\n    // metrics, and `pnpm rls:check` correctly called that `[critical]\n    // rls-disabled` the first time CI saw the table.\n    //\n    // REVOKE rather than `ENABLE ROW LEVEL SECURITY`, matching every other table\n    // in `REBASE_INTERNAL_TABLES`: RLS with no policy denies the same rows but\n    // is the weaker statement, because the grant survives and a later policy\n    // reopens it. There is no row here any end user should reach, so \"this role\n    // has no privilege at all\" is the honest encoding. The owner connection the\n    // recorder runs on is unaffected.\n    await exec(revokeInternalTableSql(\"rebase\", \"metric_samples\"), []);\n\n    // Swept here rather than by a cron, so a deployment that runs no scheduler\n    // still stays bounded. A DELETE is the right tool at this size — a few\n    // thousand rows a day — and partitioning would be machinery for a table\n    // that never gets big.\n    await exec(\n        `DELETE FROM ${METRICS_HISTORY_TABLE} WHERE at < now() - make_interval(days => $1)`,\n        [RETENTION_DAYS]\n    );\n}\n\n/**\n * What this process is using right now.\n *\n * `process.cpuUsage()` is cumulative, so a rate needs two readings and the gap\n * between them — which is why the previous one is threaded through rather than\n * held in a module global: a module global is shared by every test in a file\n * and makes the first assertion depend on whatever ran before it.\n */\nexport function sampleSelf(\n    previous: { cpu: NodeJS.CpuUsage; at: number } | null,\n    now = Date.now(),\n    /**\n     * Mean event-loop delay over the last window, in milliseconds, or undefined\n     * where it cannot be measured. Passed in rather than read here so this\n     * function stays pure: the histogram is a stateful handle the recorder owns.\n     */\n    eventLoopDelayMs?: number\n): { samples: Omit<MetricSample, \"at\">[]; cursor: { cpu: NodeJS.CpuUsage; at: number } } {\n    const cpu = process.cpuUsage();\n    const memory = process.memoryUsage();\n    const samples: Omit<MetricSample, \"at\">[] = [\n        { series: \"memory_bytes\", value: memory.rss }\n    ];\n\n    // Only when it was actually measured. Zero is a real and common reading for\n    // an idle process, so a `?? 0` here would be indistinguishable from a\n    // healthy one — the same substitution this module rejects everywhere else.\n    if (typeof eventLoopDelayMs === \"number\" && Number.isFinite(eventLoopDelayMs)) {\n        samples.push({ series: \"event_loop_delay_ms\", value: eventLoopDelayMs });\n    }\n\n    if (previous) {\n        const elapsedMs = now - previous.at;\n        if (elapsedMs > 0) {\n            // Microseconds of CPU over milliseconds of wall clock, as\n            // millicores: 1000m is one core saturated for the whole window.\n            const usedMicros = (cpu.user - previous.cpu.user) + (cpu.system - previous.cpu.system);\n            samples.push({ series: \"cpu_millicores\", value: (usedMicros / 1000 / elapsedMs) * 1000 });\n        }\n    }\n\n    return { samples, cursor: { cpu, at: now } };\n}\n\n/**\n * Write one tick's samples, for one instance.\n *\n * ## Why `instance` is part of the key\n *\n * A tenant's replicas share one database, and each records its OWN process. Key\n * a row by `(series, minute)` alone and the pods overwrite each other every\n * tick: one pod at 5m and another at 500m leave whichever wrote last, so a\n * scaled-out tenant charts one arbitrary replica and calls it the app. Adding\n * the instance makes each pod its own row, and lets the read decide whether the\n * question is \"the whole deployment\" or \"which pod is hot\".\n *\n * Cardinality stays bounded: rows are series × replicas × minutes, and replicas\n * are capped by the autoscaling ceiling. Six pods is ~43k rows a day and a\n * fortnight of them is well under a million.\n */\nexport async function recordSamples(\n    exec: Exec,\n    samples: Omit<MetricSample, \"at\">[],\n    instance: string,\n    at: Date = new Date()\n): Promise<void> {\n    if (samples.length === 0) return;\n    // Truncated to the minute, so a pod restarting mid-minute overwrites its own\n    // earlier row rather than adding a second one for the same instant.\n    const bucket = new Date(Math.floor(at.getTime() / 60_000) * 60_000);\n    for (const s of samples) {\n        if (!Number.isFinite(s.value)) continue;\n        await exec(\n            `INSERT INTO ${METRICS_HISTORY_TABLE} (at, series, instance, value)\n             VALUES ($1, $2, $3, $4)\n             ON CONFLICT (series, instance, at) DO UPDATE SET value = EXCLUDED.value`,\n            [bucket, s.series, instance, s.value]\n        );\n    }\n}\n\n/**\n * How a series combines across the replicas that reported it.\n *\n * Not one answer for everything, because the right one differs by what the\n * number means. CPU and memory are consumption: the deployment's figure is the\n * sum, and a mean would make scaling out look like it reduced usage. A queue\n * depth or an event-loop delay is a condition each process is independently in,\n * and summing those produces a number no single pod ever experienced.\n */\nconst COMBINE: Record<MetricSeries, \"sum\" | \"avg\"> = {\n    cpu_millicores: \"sum\",\n    memory_bytes: \"sum\",\n    event_loop_delay_ms: \"avg\"\n};\n\nexport interface SeriesPoint {\n    at: string;\n    /** The deployment's figure, combined per `COMBINE`. */\n    value: number;\n    /** How many instances reported in this bucket. */\n    instances: number;\n}\n\n/**\n * Read one series over a window, oldest first — the order a chart draws in.\n *\n * Combined across instances rather than returned per-pod. A chart of \"this\n * app's CPU\" is the question people ask; \"which pod is hot\" is answered by the\n * live panel, which already lists instances individually and does not need\n * history to do it.\n *\n * `instances` rides along because a sum whose contributor count changed is not\n * comparable with itself: CPU doubling because the app got busy and CPU\n * doubling because it scaled from one replica to two are different events, and\n * a line chart alone cannot tell them apart.\n */\nexport async function readSeries(\n    exec: Exec,\n    series: MetricSeries,\n    sinceMinutes: number\n): Promise<SeriesPoint[]> {\n    const combine = COMBINE[series] === \"avg\" ? \"avg\" : \"sum\";\n    // The current minute is EXCLUDED, and that is not tidiness.\n    //\n    // Each replica samples on its own phase — `setInterval` from whenever that\n    // pod booted — so at 10:45:20 the bucket for 10:45 holds rows from whichever\n    // pods have ticked so far, typically one of three. The chart takes the last\n    // point as its headline figure, so a three-replica app displayed one\n    // replica's CPU as the deployment's, the line ended in a cliff, and the\n    // instance step dropped underneath it — which the chart's own caption\n    // explains to the reader as a scale-down that never happened.\n    //\n    // Every live pod has written bucket M-1 before the clock enters M, so the\n    // newest bucket returned is complete and its `instances` is the true\n    // contributor count. `date_trunc` rather than arithmetic because it matches\n    // the recorder's `floor(t / 60_000) * 60_000` exactly, and is\n    // timezone-independent on a timestamptz.\n    const rows = await exec(\n        `SELECT at, ${combine}(value) AS value, count(*) AS instances\n           FROM ${METRICS_HISTORY_TABLE}\n          WHERE series = $1\n            AND at >= now() - make_interval(mins => $2)\n            AND at < date_trunc('minute', now())\n          GROUP BY at\n          ORDER BY at ASC`,\n        [series, sinceMinutes]\n    ) as unknown as { rows?: RawPoint[] } | RawPoint[];\n\n    const list = Array.isArray(rows) ? rows : (rows?.rows ?? []);\n    return list.map(r => ({\n        at: r.at instanceof Date ? r.at.toISOString() : String(r.at),\n        value: Number(r.value),\n        instances: Number(r.instances ?? 1)\n    }));\n}\n\ninterface RawPoint { at: Date | string; value: number; instances?: number | string }\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqCA,IAAa,wBAAwB;;AAmBrC,IAAa,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BlC,IAAa,gBAAgB;CACzB;CACA;CACA;AACJ;;;;;;;;AAiBA,eAAsB,qBAAqB,MAA2B;CAClE,MAAM,KAAK;qCACsB,sBAAsB;;;;;;;OAOpD,CAAC,CAAC;CAKL,MAAM,KAAK;;iBAEE,sBAAsB;OAChC,CAAC,CAAC;CAiBL,MAAM,KAAK,uBAAuB,UAAU,gBAAgB,GAAG,CAAC,CAAC;CAMjE,MAAM,KACF,eAAe,sBAAsB,gDACrC,CAAA,EAAe,CACnB;AACJ;;;;;;;;;AAUA,SAAgB,WACZ,UACA,MAAM,KAAK,IAAI,GAMf,kBACqF;CACrF,MAAM,MAAM,QAAQ,SAAS;CAE7B,MAAM,UAAsC,CACxC;EAAE,QAAQ;EAAgB,OAFf,QAAQ,YAEc,CAAA,CAAO;CAAI,CAChD;CAKA,IAAI,OAAO,qBAAqB,YAAY,OAAO,SAAS,gBAAgB,GACxE,QAAQ,KAAK;EAAE,QAAQ;EAAuB,OAAO;CAAiB,CAAC;CAG3E,IAAI,UAAU;EACV,MAAM,YAAY,MAAM,SAAS;EACjC,IAAI,YAAY,GAAG;GAGf,MAAM,aAAc,IAAI,OAAO,SAAS,IAAI,QAAS,IAAI,SAAS,SAAS,IAAI;GAC/E,QAAQ,KAAK;IAAE,QAAQ;IAAkB,OAAQ,aAAa,MAAO,YAAa;GAAK,CAAC;EAC5F;CACJ;CAEA,OAAO;EAAE;EAAS,QAAQ;GAAE;GAAK,IAAI;EAAI;CAAE;AAC/C;;;;;;;;;;;;;;;;;AAkBA,eAAsB,cAClB,MACA,SACA,UACA,qBAAW,IAAI,KAAK,GACP;CACb,IAAI,QAAQ,WAAW,GAAG;CAG1B,MAAM,yBAAS,IAAI,KAAK,KAAK,MAAM,GAAG,QAAQ,IAAI,GAAM,IAAI,GAAM;CAClE,KAAK,MAAM,KAAK,SAAS;EACrB,IAAI,CAAC,OAAO,SAAS,EAAE,KAAK,GAAG;EAC/B,MAAM,KACF,eAAe,sBAAsB;;uFAGrC;GAAC;GAAQ,EAAE;GAAQ;GAAU,EAAE;EAAK,CACxC;CACJ;AACJ;;;;;;;;;;AAWA,IAAM,UAA+C;CACjD,gBAAgB;CAChB,cAAc;CACd,qBAAqB;AACzB;;;;;;;;;;;;;;AAuBA,eAAsB,WAClB,MACA,QACA,cACsB;CAiBtB,MAAM,OAAO,MAAM,KACf,cAjBY,QAAQ,YAAY,QAAQ,QAAQ,MAiB1B;kBACZ,sBAAsB;;;;;4BAMhC,CAAC,QAAQ,YAAY,CACzB;CAGA,QADa,MAAM,QAAQ,IAAI,IAAI,OAAQ,MAAM,QAAQ,CAAC,EAAA,CAC9C,KAAI,OAAM;EAClB,IAAI,EAAE,cAAc,OAAO,EAAE,GAAG,YAAY,IAAI,OAAO,EAAE,EAAE;EAC3D,OAAO,OAAO,EAAE,KAAK;EACrB,WAAW,OAAO,EAAE,aAAa,CAAC;CACtC,EAAE;AACN"}
+{"version":3,"file":"history-store-BUJ-37Sm.js","names":[],"sources":["../src/metrics/history-store.ts"],"sourcesContent":["/**\n * A little history for the metrics this process already keeps.\n *\n * ## Why this is in the framework and not in the cloud console\n *\n * The console wants to draw \"CPU over the last hour\". The obvious way to get it\n * on GKE is Cloud Monitoring, which already collects exactly this — and which\n * would make the panel unportable the day the platform moves, for a feature\n * every self-hoster also wants. So the history lives where the runtime lives:\n * the process samples ITSELF, into its OWN database, and anything that can read\n * the database can draw the chart. No cluster, no metrics-server, no vendor.\n *\n * That is the same rule the binder follows — the cloud is a better\n * implementation behind the same interface, never a different one.\n *\n * ## Why it stays cheap\n *\n * One row per series per instance per minute. Three series across two replicas\n * is 8,640 rows a day, and the sweep below bounds the window, so the table settles\n * at a size measured in megabytes. It is deliberately NOT a general time-series\n * store: no labels, no cardinality to explode, no per-request rows.\n *\n * A minute is the resolution because that is what the question needs — \"was it\n * slow at 15:40\", \"did my deploy cause that\" — and because a finer grain buys\n * nothing a reader can see on a chart of an hour.\n */\n/**\n * The positional-parameter shape every store in this package settles on.\n *\n * The bootstrapper's own `SqlExec` takes an options object; each store wraps it\n * once and reads better for it. Same two shapes, same reason, as `job-store`.\n */\nimport { revokeInternalTableSql } from \"@rebasepro/common\";\n\nexport type Exec = (sql: string, params?: unknown[]) => Promise<unknown>;\n\n/** Where the samples live. Framework-owned, like `rebase.jobs`. */\nexport const METRICS_HISTORY_TABLE = \"rebase.metric_samples\";\n\n/**\n * How long a sample is kept.\n *\n * Two weeks answers \"is this worse than last week\" and stops well short of\n * being an archive. Anything that needs to outlive it — billing, capacity\n * planning — is a rollup somebody else owns, not a longer retention here.\n *\n * Read it as \"14 days, or since this process started, whichever is longer\": the\n * sweep runs at boot and nowhere else, so a pod up for 90 days holds 90 days.\n * That is a deliberate trade rather than an oversight — a cron for it would be\n * machinery for a table that stays trivial either way, and reads are bounded by\n * the index regardless — but the table does not \"reach a steady size and stay\n * there\" on a long-lived pod, which an earlier version of this comment claimed.\n */\nexport const RETENTION_DAYS = 14;\n\n/** How often the process samples itself. Matched to the resolution it stores. */\nexport const SAMPLE_INTERVAL_MS = 60_000;\n\n/**\n * The series this records. A closed set on purpose — see the cardinality note.\n *\n * A list rather than only a union, because the route validates against it: an\n * unknown `?series=` must be a named 400 rather than an empty chart, which\n * reads exactly like a quiet period.\n *\n * **It lists what `sampleSelf` actually writes, and nothing else.** It used to\n * also name `requests_total`, `errors_total` and `event_loop_delay_ms`, none of\n * which anything ever recorded — so those three were *valid* parameters that\n * returned `points: []`, which is precisely the empty chart the 400 two\n * paragraphs up exists to prevent. A declared-but-unwritten series is worse\n * than an absent one: the 400 tells you the name is wrong, and the empty array\n * tells you the app was quiet.\n *\n * `event_loop_delay_ms` kept its place by gaining a sampler, because it is the\n * one signal here that says whether the process is *healthy* rather than how\n * much it is using, and it has no counter semantics to get wrong.\n *\n * `requests_total` and `errors_total` were dropped rather than wired up. The\n * registry does hold them, but they reset on restart, and a resetting counter\n * summed across replicas is not monotonic — a rolling deploy would draw a\n * cliff that looks like traffic collapsing. That needs a deliberate decision\n * about deltas and resets, not a line added at 2am. Adding either back means\n * adding its sampler in the same commit.\n */\nexport const METRIC_SERIES = [\n    \"cpu_millicores\",\n    \"memory_bytes\",\n    \"event_loop_delay_ms\"\n] as const;\n\nexport type MetricSeries = (typeof METRIC_SERIES)[number];\n\nexport interface MetricSample {\n    at: Date;\n    series: MetricSeries;\n    value: number;\n}\n\n/**\n * Create the table and sweep what has aged out.\n *\n * Called at boot, beside the job and cron stores, and for the same reason they\n * do it there: the only moment the schema is guaranteed to be reachable and\n * nobody is mid-request.\n */\nexport async function ensureMetricsHistory(exec: Exec): Promise<void> {\n    await exec(`\n        CREATE TABLE IF NOT EXISTS ${METRICS_HISTORY_TABLE} (\n            at        timestamptz      NOT NULL,\n            series    text             NOT NULL,\n            instance  text             NOT NULL,\n            value     double precision NOT NULL,\n            PRIMARY KEY (series, instance, at)\n        )\n    `, []);\n\n    // (series, at DESC) rather than the primary key's order: every read is\n    // \"this series across all instances, bounded by time\", and the PK leads with\n    // instance, which is the wrong first column for that scan.\n    await exec(`\n        CREATE INDEX IF NOT EXISTS metric_samples_series_recent\n            ON ${METRICS_HISTORY_TABLE} (series, at DESC)\n    `, []);\n\n    // Framework-internal, so the end-user role must not be able to address it.\n    //\n    // The driver grants `rebase_user` full DML across the schemas a project\n    // uses, plus `ALTER DEFAULT PRIVILEGES` so tables created later inherit it —\n    // and this one is created later, at boot. Without the revoke, an\n    // authenticated request could read and write another deployment's process\n    // metrics, and `pnpm rls:check` correctly called that `[critical]\n    // rls-disabled` the first time CI saw the table.\n    //\n    // REVOKE rather than `ENABLE ROW LEVEL SECURITY`, matching every other table\n    // in `REBASE_INTERNAL_TABLES`: RLS with no policy denies the same rows but\n    // is the weaker statement, because the grant survives and a later policy\n    // reopens it. There is no row here any end user should reach, so \"this role\n    // has no privilege at all\" is the honest encoding. The owner connection the\n    // recorder runs on is unaffected.\n    await exec(revokeInternalTableSql(\"rebase\", \"metric_samples\"), []);\n\n    // Swept here rather than by a cron, so a deployment that runs no scheduler\n    // still stays bounded. A DELETE is the right tool at this size — a few\n    // thousand rows a day — and partitioning would be machinery for a table\n    // that never gets big.\n    await exec(\n        `DELETE FROM ${METRICS_HISTORY_TABLE} WHERE at < now() - make_interval(days => $1)`,\n        [RETENTION_DAYS]\n    );\n}\n\n/**\n * What this process is using right now.\n *\n * `process.cpuUsage()` is cumulative, so a rate needs two readings and the gap\n * between them — which is why the previous one is threaded through rather than\n * held in a module global: a module global is shared by every test in a file\n * and makes the first assertion depend on whatever ran before it.\n */\nexport function sampleSelf(\n    previous: { cpu: NodeJS.CpuUsage; at: number } | null,\n    now = Date.now(),\n    /**\n     * Mean event-loop delay over the last window, in milliseconds, or undefined\n     * where it cannot be measured. Passed in rather than read here so this\n     * function stays pure: the histogram is a stateful handle the recorder owns.\n     */\n    eventLoopDelayMs?: number\n): { samples: Omit<MetricSample, \"at\">[]; cursor: { cpu: NodeJS.CpuUsage; at: number } } {\n    const cpu = process.cpuUsage();\n    const memory = process.memoryUsage();\n    const samples: Omit<MetricSample, \"at\">[] = [\n        { series: \"memory_bytes\", value: memory.rss }\n    ];\n\n    // Only when it was actually measured. Zero is a real and common reading for\n    // an idle process, so a `?? 0` here would be indistinguishable from a\n    // healthy one — the same substitution this module rejects everywhere else.\n    if (typeof eventLoopDelayMs === \"number\" && Number.isFinite(eventLoopDelayMs)) {\n        samples.push({ series: \"event_loop_delay_ms\", value: eventLoopDelayMs });\n    }\n\n    if (previous) {\n        const elapsedMs = now - previous.at;\n        if (elapsedMs > 0) {\n            // Microseconds of CPU over milliseconds of wall clock, as\n            // millicores: 1000m is one core saturated for the whole window.\n            const usedMicros = (cpu.user - previous.cpu.user) + (cpu.system - previous.cpu.system);\n            samples.push({ series: \"cpu_millicores\", value: (usedMicros / 1000 / elapsedMs) * 1000 });\n        }\n    }\n\n    return { samples, cursor: { cpu, at: now } };\n}\n\n/**\n * Write one tick's samples, for one instance.\n *\n * ## Why `instance` is part of the key\n *\n * A tenant's replicas share one database, and each records its OWN process. Key\n * a row by `(series, minute)` alone and the pods overwrite each other every\n * tick: one pod at 5m and another at 500m leave whichever wrote last, so a\n * scaled-out tenant charts one arbitrary replica and calls it the app. Adding\n * the instance makes each pod its own row, and lets the read decide whether the\n * question is \"the whole deployment\" or \"which pod is hot\".\n *\n * Cardinality stays bounded: rows are series × replicas × minutes, and replicas\n * are capped by the autoscaling ceiling. Six pods is ~43k rows a day and a\n * fortnight of them is well under a million.\n */\nexport async function recordSamples(\n    exec: Exec,\n    samples: Omit<MetricSample, \"at\">[],\n    instance: string,\n    at: Date = new Date()\n): Promise<void> {\n    if (samples.length === 0) return;\n    // Truncated to the minute, so a pod restarting mid-minute overwrites its own\n    // earlier row rather than adding a second one for the same instant.\n    const bucket = new Date(Math.floor(at.getTime() / 60_000) * 60_000);\n    for (const s of samples) {\n        if (!Number.isFinite(s.value)) continue;\n        await exec(\n            `INSERT INTO ${METRICS_HISTORY_TABLE} (at, series, instance, value)\n             VALUES ($1, $2, $3, $4)\n             ON CONFLICT (series, instance, at) DO UPDATE SET value = EXCLUDED.value`,\n            [bucket, s.series, instance, s.value]\n        );\n    }\n}\n\n/**\n * How a series combines across the replicas that reported it.\n *\n * Not one answer for everything, because the right one differs by what the\n * number means. CPU and memory are consumption: the deployment's figure is the\n * sum, and a mean would make scaling out look like it reduced usage. A queue\n * depth or an event-loop delay is a condition each process is independently in,\n * and summing those produces a number no single pod ever experienced.\n */\nconst COMBINE: Record<MetricSeries, \"sum\" | \"avg\"> = {\n    cpu_millicores: \"sum\",\n    memory_bytes: \"sum\",\n    event_loop_delay_ms: \"avg\"\n};\n\nexport interface SeriesPoint {\n    at: string;\n    /** The deployment's figure, combined per `COMBINE`. */\n    value: number;\n    /** How many instances reported in this bucket. */\n    instances: number;\n}\n\n/**\n * Read one series over a window, oldest first — the order a chart draws in.\n *\n * Combined across instances rather than returned per-pod. A chart of \"this\n * app's CPU\" is the question people ask; \"which pod is hot\" is answered by the\n * live panel, which already lists instances individually and does not need\n * history to do it.\n *\n * `instances` rides along because a sum whose contributor count changed is not\n * comparable with itself: CPU doubling because the app got busy and CPU\n * doubling because it scaled from one replica to two are different events, and\n * a line chart alone cannot tell them apart.\n */\nexport async function readSeries(\n    exec: Exec,\n    series: MetricSeries,\n    sinceMinutes: number\n): Promise<SeriesPoint[]> {\n    const combine = COMBINE[series] === \"avg\" ? \"avg\" : \"sum\";\n    // The current minute is EXCLUDED, and that is not tidiness.\n    //\n    // Each replica samples on its own phase — `setInterval` from whenever that\n    // pod booted — so at 10:45:20 the bucket for 10:45 holds rows from whichever\n    // pods have ticked so far, typically one of three. The chart takes the last\n    // point as its headline figure, so a three-replica app displayed one\n    // replica's CPU as the deployment's, the line ended in a cliff, and the\n    // instance step dropped underneath it — which the chart's own caption\n    // explains to the reader as a scale-down that never happened.\n    //\n    // Every live pod has written bucket M-1 before the clock enters M, so the\n    // newest bucket returned is complete and its `instances` is the true\n    // contributor count. `date_trunc` rather than arithmetic because it matches\n    // the recorder's `floor(t / 60_000) * 60_000` exactly, and is\n    // timezone-independent on a timestamptz.\n    const rows = await exec(\n        `SELECT at, ${combine}(value) AS value, count(*) AS instances\n           FROM ${METRICS_HISTORY_TABLE}\n          WHERE series = $1\n            AND at >= now() - make_interval(mins => $2)\n            AND at < date_trunc('minute', now())\n          GROUP BY at\n          ORDER BY at ASC`,\n        [series, sinceMinutes]\n    ) as unknown as { rows?: RawPoint[] } | RawPoint[];\n\n    const list = Array.isArray(rows) ? rows : (rows?.rows ?? []);\n    return list.map(r => ({\n        at: r.at instanceof Date ? r.at.toISOString() : String(r.at),\n        value: Number(r.value),\n        instances: Number(r.instances ?? 1)\n    }));\n}\n\ninterface RawPoint { at: Date | string; value: number; instances?: number | string }\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqCA,IAAa,wBAAwB;;AAmBrC,IAAa,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BlC,IAAa,gBAAgB;CACzB;CACA;CACA;AACJ;;;;;;;;AAiBA,eAAsB,qBAAqB,MAA2B;CAClE,MAAM,KAAK;qCACsB,sBAAsB;;;;;;;OAOpD,CAAC,CAAC;CAKL,MAAM,KAAK;;iBAEE,sBAAsB;OAChC,CAAC,CAAC;CAiBL,MAAM,KAAK,uBAAuB,UAAU,gBAAgB,GAAG,CAAC,CAAC;CAMjE,MAAM,KACF,eAAe,sBAAsB,gDACrC,CAAA,EAAe,CACnB;AACJ;;;;;;;;;AAUA,SAAgB,WACZ,UACA,MAAM,KAAK,IAAI,GAMf,kBACqF;CACrF,MAAM,MAAM,QAAQ,SAAS;CAE7B,MAAM,UAAsC,CACxC;EAAE,QAAQ;EAAgB,OAFf,QAAQ,YAEc,CAAA,CAAO;CAAI,CAChD;CAKA,IAAI,OAAO,qBAAqB,YAAY,OAAO,SAAS,gBAAgB,GACxE,QAAQ,KAAK;EAAE,QAAQ;EAAuB,OAAO;CAAiB,CAAC;CAG3E,IAAI,UAAU;EACV,MAAM,YAAY,MAAM,SAAS;EACjC,IAAI,YAAY,GAAG;GAGf,MAAM,aAAc,IAAI,OAAO,SAAS,IAAI,QAAS,IAAI,SAAS,SAAS,IAAI;GAC/E,QAAQ,KAAK;IAAE,QAAQ;IAAkB,OAAQ,aAAa,MAAO,YAAa;GAAK,CAAC;EAC5F;CACJ;CAEA,OAAO;EAAE;EAAS,QAAQ;GAAE;GAAK,IAAI;EAAI;CAAE;AAC/C;;;;;;;;;;;;;;;;;AAkBA,eAAsB,cAClB,MACA,SACA,UACA,qBAAW,IAAI,KAAK,GACP;CACb,IAAI,QAAQ,WAAW,GAAG;CAG1B,MAAM,yBAAS,IAAI,KAAK,KAAK,MAAM,GAAG,QAAQ,IAAI,GAAM,IAAI,GAAM;CAClE,KAAK,MAAM,KAAK,SAAS;EACrB,IAAI,CAAC,OAAO,SAAS,EAAE,KAAK,GAAG;EAC/B,MAAM,KACF,eAAe,sBAAsB;;uFAGrC;GAAC;GAAQ,EAAE;GAAQ;GAAU,EAAE;EAAK,CACxC;CACJ;AACJ;;;;;;;;;;AAWA,IAAM,UAA+C;CACjD,gBAAgB;CAChB,cAAc;CACd,qBAAqB;AACzB;;;;;;;;;;;;;;AAuBA,eAAsB,WAClB,MACA,QACA,cACsB;CAiBtB,MAAM,OAAO,MAAM,KACf,cAjBY,QAAQ,YAAY,QAAQ,QAAQ,MAiB1B;kBACZ,sBAAsB;;;;;4BAMhC,CAAC,QAAQ,YAAY,CACzB;CAGA,QADa,MAAM,QAAQ,IAAI,IAAI,OAAQ,MAAM,QAAQ,CAAC,EAAA,CAC9C,KAAI,OAAM;EAClB,IAAI,EAAE,cAAc,OAAO,EAAE,GAAG,YAAY,IAAI,OAAO,EAAE,EAAE;EAC3D,OAAO,OAAO,EAAE,KAAK;EACrB,WAAW,OAAO,EAAE,aAAa,CAAC;CACtC,EAAE;AACN"}