@rebasepro/server 0.17.3 → 0.18.0

package/dist/function-routes-gQ0EShVG.js

@@ -0,0 +1,267 @@
+import { createRequire as __rebaseCreateRequire } from "module";
+import __rebaseProcess from "process";
+globalThis.process ??= __rebaseProcess;
+__rebaseCreateRequire(import.meta.url);
+import { n as __exportAll } from "./rolldown-runtime-dW7B1o5h.js";
+import { t as ApiError } from "./errors-HjfaPlvY.js";
+import { n as hasAdministrativeRole } from "./admin-roles-vYdp_Pil.js";
+import { Hono } from "hono";
+//#region src/functions/context.ts
+function read(c, key) {
+	return c.get(key);
+}
+/**
+* The authenticated caller, or `undefined` for an anonymous request.
+*
+* **`undefined` is not a permission decision.** The functions router mounts its
+* auth middleware with `requireAuth: false` on purpose — a webhook receiver has
+* no token to send — so an anonymous caller reaches the handler and reads
+* `undefined` here while the handler runs on regardless. Use {@link requireAuth}
+* (or a `!user` branch that returns 401) to make it a decision.
+*
+* A caller who presented a *bad* token never gets this far: both auth
+* middlewares reject an unverifiable token with 401 before the router is
+* reached, precisely so an expired session cannot be silently downgraded to an
+* anonymous one.
+*/
+function getUser(c) {
+	const raw = read(c, "user");
+	if (!raw || typeof raw !== "object") return void 0;
+	const record = raw;
+	const uid = typeof record.uid === "string" ? record.uid : void 0;
+	if (uid === void 0) return void 0;
+	const roles = Array.isArray(record.roles) ? record.roles.filter((role) => typeof role === "string") : [];
+	return {
+		...record,
+		uid,
+		roles
+	};
+}
+/** The caller's id, or `undefined` when nobody is signed in. */
+function getUserId(c) {
+	return getUser(c)?.uid;
+}
+/** The caller's roles. Empty for an anonymous request — never `undefined`. */
+function getRoles(c) {
+	return getUser(c)?.roles ?? [];
+}
+/**
+* Whether the caller holds **any** of the named roles.
+*
+* Any rather than all, because that is what a route guard means by a list of
+* roles; require several by calling this more than once.
+*/
+function hasRole(c, ...roles) {
+	if (roles.length === 0) return false;
+	const held = new Set(getRoles(c));
+	return roles.some((role) => held.has(role));
+}
+/**
+* Whether the caller holds an administrative role.
+*
+* Delegates to the single definition in `auth/admin-roles.ts` — which is
+* `admin` **or** `schema-admin` — rather than comparing against `"admin"`.
+* Those two lists disagreed once, and the gap made every public registrant an
+* administrator; see that file.
+*/
+function isAdmin(c) {
+	return hasAdministrativeRole(getRoles(c));
+}
+/** Whether the request carries an identity at all. */
+function isAuthenticated(c) {
+	return getUser(c) !== void 0;
+}
+/**
+* The request-scoped data driver: reads and writes run as **the caller**, with
+* your row-level security policies evaluated against their identity.
+*
+* This is the accessor to reach for when a function serves user-facing data.
+* `rebase.dataAsAdmin` is the other one, and it is not the same thing — it runs
+* as `{ uid: "service", roles: ["admin"] }` for every caller alike, which is
+* correct for trusted background work and wrong for a request.
+*
+* `undefined` only when no Rebase auth middleware ran (see
+* {@link identityResolved}); inside a function mounted by the framework it is
+* always present, anonymous requests included — they get an anon-scoped driver
+* so policies still have an identity to evaluate.
+*/
+function getDriver(c) {
+	return read(c, "driver");
+}
+/**
+* {@link getDriver}, but throws instead of handing back `undefined`.
+*
+* For the common case where a handler cannot proceed without it and would
+* otherwise write `c.get("driver")!` — an assertion that turns a wiring problem
+* into `Cannot read properties of undefined (reading 'fetchCollection')` twenty
+* lines away from the cause.
+*/
+function requireDriver(c) {
+	const driver = getDriver(c);
+	if (!driver) throw new Error("No request-scoped driver on this context. A Rebase auth middleware populates it before any custom function runs, so this means the handler was mounted outside the functions router — e.g. added to your own Hono app directly. Mount it from the functions directory, or use `rebase.dataAsAdmin` if the work is genuinely service-scoped.");
+	return driver;
+}
+/**
+* The API key this request authenticated with, masked, or `undefined` when it
+* did not use one.
+*
+* Useful for attribution and for per-key behaviour. The permission check itself
+* has already happened — reaching a handler means the key was allowed to.
+*/
+function getApiKey(c) {
+	return read(c, "apiKey");
+}
+/**
+* The correlation id for this request — generated, or taken from an inbound
+* `X-Request-ID`.
+*
+* Log it. It is the only thing that ties a line written inside a function to
+* the framework's own lines for the same request.
+*/
+function getRequestId(c) {
+	return read(c, "requestId");
+}
+/**
+* Whether a Rebase auth middleware has run on this request.
+*
+* Both middlewares populate `driver` for *every* outcome, anonymous included,
+* and populate `user` whenever there is one. So "neither is set" does not mean
+* "anonymous" — it means nothing resolved the identity, and treating that as
+* anonymous is the dangerous reading. The guards use this to tell a genuinely
+* anonymous caller (401) from a misconfigured mount (500), because answering
+* 401 to the second sends whoever is debugging it to look at the token.
+*/
+function identityResolved(c) {
+	return read(c, "user") !== void 0 || read(c, "driver") !== void 0;
+}
+//#endregion
+//#region src/functions/guards.ts
+/**
+* The answer to "a guard ran, but no middleware had resolved anything".
+*
+* Deliberately a 500 and not a 401. A 401 tells the caller their credential is
+* the problem, and here the caller's credential was never looked at — sending
+* them to check their token is sending them to the one place the answer is not.
+*/
+function unresolvedIdentity() {
+	return { error: {
+		message: "This route's identity was never resolved: no Rebase auth middleware ran before the guard. A function loaded from the functions directory always has one. This usually means the Hono app was mounted onto your own server directly, bypassing the functions router.",
+		code: "AUTH_MIDDLEWARE_MISSING"
+	} };
+}
+/**
+* Reject anonymous callers with 401.
+*
+* Put it in the route's own middleware slot rather than `app.use("/*", …)`:
+* `use()` covers only the routes declared *below* it, so a route appended later
+* — by you, months from now, at the bottom of the file — is silently
+* unprotected. The per-route form cannot drift that way.
+*
+* @example
+* ```ts
+* app.post("/", requireAuth, async (c) => {
+*     const user = getUser(c)!;  // guaranteed by the guard
+*     return c.json({ uid: user.uid });
+* });
+* ```
+*/
+var requireAuth = async (c, next) => {
+	if (getUser(c)) return next();
+	if (!identityResolved(c)) return c.json(unresolvedIdentity(), 500);
+	return c.json({ error: {
+		message: "Authentication required",
+		code: "UNAUTHORIZED"
+	} }, 401);
+};
+/**
+* Reject callers holding none of the named roles with 403.
+*
+* Any of them, not all — require several by chaining the guard twice. Naming no
+* role at all is a programming error and throws at module load rather than at
+* request time, because `requireRole()` with an empty list would otherwise read
+* as a guard while admitting everyone.
+*
+* @example
+* ```ts
+* app.post("/publish", requireAuth, requireRole("editor", "admin"), handler);
+* ```
+*/
+function requireRole(...roles) {
+	if (roles.length === 0) throw new Error("requireRole() needs at least one role. An empty list would admit every signed-in caller while reading as a restriction.");
+	const allowed = new Set(roles);
+	return async (c, next) => {
+		if (!getUser(c)) {
+			if (!identityResolved(c)) return c.json(unresolvedIdentity(), 500);
+			return c.json({ error: {
+				message: "Authentication required",
+				code: "UNAUTHORIZED"
+			} }, 401);
+		}
+		if (!getRoles(c).some((role) => allowed.has(role))) return c.json({ error: {
+			message: `This operation requires one of these roles: ${roles.join(", ")}`,
+			code: "FORBIDDEN"
+		} }, 403);
+		return next();
+	};
+}
+//#endregion
+//#region src/functions/function-routes.ts
+var function_routes_exports = /* @__PURE__ */ __exportAll({ createFunctionRoutes: () => createFunctionRoutes });
+/** The file a loader problem names, without its extension: `broken.ts (threw: …)` → `broken`. */
+function problemName(problem) {
+	return problem.split(" ")[0].replace(/\/$/, "").replace(/\.[cm]?[jt]s$/, "");
+}
+/**
+* Mount all loaded function routes under a single Hono router.
+*
+* Each function is mounted at `/<function-name>`, preserving
+* whatever HTTP methods and middleware the Hono sub-app defines.
+*
+* @param functions What loaded. May be empty — the router still mounts, so
+*   "no functions are served" answers 200 with an empty list instead of 404.
+* @param problems The files the loader saw and could not serve, as
+*   `"<file> (<reason>)"`. The listing reports a count and a pointer to the log,
+*   not the reasons: those carry import errors, and the listing is one guard
+*   away from anyone. The unmatched-route handler uses the *names* to answer the
+*   one question a 404 on a function nobody can find should answer — "there is a
+*   file for this and it did not load" — which is the difference between a typo
+*   and a broken deploy, and the loader was the only thing that knew.
+*/
+function createFunctionRoutes(functions, problems = [], mountPath = "/functions") {
+	const router = new Hono();
+	const skipped = problems.length;
+	router.get("/", requireAuth, (c) => {
+		return c.json({
+			functions: functions.map((fn) => ({
+				name: fn.name,
+				endpoint: `${mountPath}/${fn.name}`
+			})),
+			...skipped > 0 && {
+				skipped,
+				note: `${skipped} function file(s) failed to load and are NOT served — see the server log for the reason.`
+			}
+		});
+	});
+	for (const fn of functions) router.route(`/${fn.name}`, fn.app);
+	const mounted = new Set(functions.map((fn) => fn.name));
+	const failedToLoad = new Map(problems.map((p) => [problemName(p), p.split(" ")[0]]));
+	router.all("/:name{.*}", (c) => {
+		const requested = (c.req.param("name") ?? "").split("/").filter(Boolean);
+		const name = requested[0] ?? "";
+		const rest = requested.slice(1).join("/");
+		const identified = Boolean(c.get("user"));
+		const refuse = (message) => {
+			throw new ApiError(404, "FUNCTION_NOT_FOUND", message, { function: name }, true);
+		};
+		if (!name) refuse(`No function in the request path. Expected ${mountPath}/<function>.`);
+		if (mounted.has(name)) refuse(`The function '${name}' is served, and has no ${c.req.method} route at '/${rest}'. The path after the function name is routed by the function's own Hono app.`);
+		const file = failedToLoad.get(name);
+		if (file) refuse(`The function '${name}' is not served: '${file}' failed to load. The server log records why, at boot.`);
+		return refuse(`No function named '${name}' on this backend.` + (identified ? mounted.size > 0 ? ` This backend serves: ${[...mounted].sort().join(", ")}.` : " This backend serves no functions." : "") + (skipped > 0 && identified ? ` ${skipped} function file(s) failed to load and are not served — see the server log.` : ""));
+	});
+	return router;
+}
+//#endregion
+export { getDriver as a, getUser as c, identityResolved as d, isAdmin as f, getApiKey as i, getUserId as l, requireDriver as m, function_routes_exports as n, getRequestId as o, isAuthenticated as p, requireRole as r, getRoles as s, createFunctionRoutes as t, hasRole as u };
+
+//# sourceMappingURL=function-routes-gQ0EShVG.js.map

package/dist/function-routes-gQ0EShVG.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"function-routes-gQ0EShVG.js","names":[],"sources":["../src/functions/context.ts","../src/functions/guards.ts","../src/functions/function-routes.ts"],"sourcesContent":["/**\n * Reading the request context from inside a custom function.\n *\n * The functions router resolves the caller's identity before any handler runs\n * and leaves the result on the Hono context. Getting it back out used to be the\n * user's problem, and the shape made that worse than it sounds: `HonoEnv`\n * types `user` as `AuthResult`, a union that includes `boolean`, `null` and an\n * index signature, because the same slot is filled by four different middlewares\n * — JWT, service key, API key, and a user-supplied validator that may return\n * `true`. Every example in the documentation therefore opened with\n *\n *     const user = c.get(\"user\") as { uid: string; roles?: string[] } | undefined;\n *\n * and an assertion in a security-relevant position is exactly the kind of line\n * that gets copied once and then never re-examined. It is also wrong in one\n * case that occurs in practice: a custom validator returning `true` stores\n * `{ uid: \"default\", roles: [] }`, which the assertion above types as having a\n * `uid` — true here, but nothing checks it.\n *\n * These accessors do the narrowing once, in the framework, where it can be\n * tested. They are also **runtime-neutral by construction** — no crypto, no\n * token parsing, no I/O, nothing but property reads on an object another\n * middleware already populated. That is what lets them live in\n * `@rebasepro/server/functions` and run unchanged on a host that has no Node\n * built-ins.\n *\n * @module\n */\nimport type { Context } from \"hono\";\nimport type { DataDriver } from \"@rebasepro/types\";\nimport type { HonoEnv } from \"../api/types\";\nimport type { ApiKeyMasked } from \"../auth/api-keys/api-key-types\";\nimport { hasAdministrativeRole } from \"../auth/admin-roles\";\n\n/**\n * The caller, as a custom function sees them.\n *\n * A narrowed view of whatever the auth middleware resolved: `uid` and `roles`\n * are guaranteed, and the index signature keeps any extra claims the token or\n * the adapter carried (`email`, `org_id`, anything a custom validator added)\n * reachable without a cast.\n */\nexport interface FunctionUser {\n    /** Stable id of the caller. `\"service\"` for service-key and API-key callers. */\n    uid: string;\n    /** Roles as resolved for this request. Never `undefined` — an empty array instead. */\n    roles: string[];\n    /** Present when the identity carried one. Not every auth method does. */\n    email?: string;\n    /** Any further claim the token, adapter or validator supplied. */\n    [claim: string]: unknown;\n}\n\n/** Anything with a Hono-style `.get`, so these work on any `Context` shape. */\ntype CtxLike = Context<HonoEnv> | Context;\n\nfunction read<K extends keyof HonoEnv[\"Variables\"]>(\n    c: CtxLike,\n    key: K\n): HonoEnv[\"Variables\"][K] | undefined {\n    // `c.get` is typed against the app's own Env, which a handler mounted\n    // through `app.route()` may have declared more loosely. The cast is\n    // confined to this one function rather than repeated at every call site.\n    return (c as Context<HonoEnv>).get(key);\n}\n\n/**\n * The authenticated caller, or `undefined` for an anonymous request.\n *\n * **`undefined` is not a permission decision.** The functions router mounts its\n * auth middleware with `requireAuth: false` on purpose — a webhook receiver has\n * no token to send — so an anonymous caller reaches the handler and reads\n * `undefined` here while the handler runs on regardless. Use {@link requireAuth}\n * (or a `!user` branch that returns 401) to make it a decision.\n *\n * A caller who presented a *bad* token never gets this far: both auth\n * middlewares reject an unverifiable token with 401 before the router is\n * reached, precisely so an expired session cannot be silently downgraded to an\n * anonymous one.\n */\nexport function getUser(c: CtxLike): FunctionUser | undefined {\n    const raw = read(c, \"user\");\n    if (!raw || typeof raw !== \"object\") return undefined;\n\n    const record = raw as Record<string, unknown>;\n    const uid = typeof record.uid === \"string\" ? record.uid : undefined;\n    if (uid === undefined) return undefined;\n\n    const roles = Array.isArray(record.roles)\n        ? record.roles.filter((role): role is string => typeof role === \"string\")\n        : [];\n\n    return { ...record,\n        uid,\n        roles } as FunctionUser;\n}\n\n/** The caller's id, or `undefined` when nobody is signed in. */\nexport function getUserId(c: CtxLike): string | undefined {\n    return getUser(c)?.uid;\n}\n\n/** The caller's roles. Empty for an anonymous request — never `undefined`. */\nexport function getRoles(c: CtxLike): string[] {\n    return getUser(c)?.roles ?? [];\n}\n\n/**\n * Whether the caller holds **any** of the named roles.\n *\n * Any rather than all, because that is what a route guard means by a list of\n * roles; require several by calling this more than once.\n */\nexport function hasRole(c: CtxLike, ...roles: string[]): boolean {\n    if (roles.length === 0) return false;\n    const held = new Set(getRoles(c));\n    return roles.some(role => held.has(role));\n}\n\n/**\n * Whether the caller holds an administrative role.\n *\n * Delegates to the single definition in `auth/admin-roles.ts` — which is\n * `admin` **or** `schema-admin` — rather than comparing against `\"admin\"`.\n * Those two lists disagreed once, and the gap made every public registrant an\n * administrator; see that file.\n */\nexport function isAdmin(c: CtxLike): boolean {\n    return hasAdministrativeRole(getRoles(c));\n}\n\n/** Whether the request carries an identity at all. */\nexport function isAuthenticated(c: CtxLike): boolean {\n    return getUser(c) !== undefined;\n}\n\n/**\n * The request-scoped data driver: reads and writes run as **the caller**, with\n * your row-level security policies evaluated against their identity.\n *\n * This is the accessor to reach for when a function serves user-facing data.\n * `rebase.dataAsAdmin` is the other one, and it is not the same thing — it runs\n * as `{ uid: \"service\", roles: [\"admin\"] }` for every caller alike, which is\n * correct for trusted background work and wrong for a request.\n *\n * `undefined` only when no Rebase auth middleware ran (see\n * {@link identityResolved}); inside a function mounted by the framework it is\n * always present, anonymous requests included — they get an anon-scoped driver\n * so policies still have an identity to evaluate.\n */\nexport function getDriver(c: CtxLike): DataDriver | undefined {\n    return read(c, \"driver\");\n}\n\n/**\n * {@link getDriver}, but throws instead of handing back `undefined`.\n *\n * For the common case where a handler cannot proceed without it and would\n * otherwise write `c.get(\"driver\")!` — an assertion that turns a wiring problem\n * into `Cannot read properties of undefined (reading 'fetchCollection')` twenty\n * lines away from the cause.\n */\nexport function requireDriver(c: CtxLike): DataDriver {\n    const driver = getDriver(c);\n    if (!driver) {\n        throw new Error(\n            \"No request-scoped driver on this context. A Rebase auth middleware \" +\n            \"populates it before any custom function runs, so this means the handler \" +\n            \"was mounted outside the functions router — e.g. added to your own Hono \" +\n            \"app directly. Mount it from the functions directory, or use \" +\n            \"`rebase.dataAsAdmin` if the work is genuinely service-scoped.\"\n        );\n    }\n    return driver;\n}\n\n/**\n * The API key this request authenticated with, masked, or `undefined` when it\n * did not use one.\n *\n * Useful for attribution and for per-key behaviour. The permission check itself\n * has already happened — reaching a handler means the key was allowed to.\n */\nexport function getApiKey(c: CtxLike): ApiKeyMasked | undefined {\n    return read(c, \"apiKey\");\n}\n\n/**\n * The correlation id for this request — generated, or taken from an inbound\n * `X-Request-ID`.\n *\n * Log it. It is the only thing that ties a line written inside a function to\n * the framework's own lines for the same request.\n */\nexport function getRequestId(c: CtxLike): string | undefined {\n    return read(c, \"requestId\");\n}\n\n/**\n * Whether a Rebase auth middleware has run on this request.\n *\n * Both middlewares populate `driver` for *every* outcome, anonymous included,\n * and populate `user` whenever there is one. So \"neither is set\" does not mean\n * \"anonymous\" — it means nothing resolved the identity, and treating that as\n * anonymous is the dangerous reading. The guards use this to tell a genuinely\n * anonymous caller (401) from a misconfigured mount (500), because answering\n * 401 to the second sends whoever is debugging it to look at the token.\n */\nexport function identityResolved(c: CtxLike): boolean {\n    return read(c, \"user\") !== undefined || read(c, \"driver\") !== undefined;\n}\n","/**\n * Route guards for custom functions.\n *\n * These decide access from the identity the platform already resolved. They do\n * **not** verify tokens, and that division is the point rather than a\n * limitation:\n *\n * - Verifying a token needs a signing key, constant-time comparison and a\n *   revocation lookup. That is host work, it belongs to the process that holds\n *   the secret, and it is the part of the stack that cannot be made\n *   runtime-neutral without rewriting it against WebCrypto.\n * - Deciding whether *this* caller may call *this* route is application work.\n *   It needs nothing but the resolved identity, so it costs nothing to make it\n *   portable — and it is the half that lives in user code.\n *\n * Splitting there is what lets a function file compile and run unchanged on a\n * host with no Node built-ins, and it is why these live in\n * `@rebasepro/server/functions` while `verifyAccessToken` does not.\n *\n * **Inside the functions router these are equivalent to the guards exported\n * from the package root.** Both auth middlewares resolve the identity before\n * any handler runs: a valid credential populates `user`, an invalid one is\n * rejected with 401 by the middleware itself, and a missing one leaves `user`\n * unset. So the root `requireAuth`'s token-parsing branch is unreachable from a\n * function, and removing it changes no outcome. The one difference is a handler\n * mounted **outside** the framework's router, where no middleware ran: the root\n * guard would parse the `Authorization` header itself, and these refuse the\n * request with a 500 that names the wiring problem. Fail-closed, and legible.\n *\n * @module\n */\nimport type { MiddlewareHandler } from \"hono\";\nimport type { HonoEnv } from \"../api/types\";\nimport { getUser, isAdmin, getRoles, identityResolved } from \"./context\";\n\n/**\n * The answer to \"a guard ran, but no middleware had resolved anything\".\n *\n * Deliberately a 500 and not a 401. A 401 tells the caller their credential is\n * the problem, and here the caller's credential was never looked at — sending\n * them to check their token is sending them to the one place the answer is not.\n */\nfunction unresolvedIdentity(): { error: { message: string; code: string } } {\n    return {\n        error: {\n            message:\n                \"This route's identity was never resolved: no Rebase auth middleware ran \" +\n                \"before the guard. A function loaded from the functions directory always \" +\n                \"has one. This usually means the Hono app was mounted onto your own \" +\n                \"server directly, bypassing the functions router.\",\n            code: \"AUTH_MIDDLEWARE_MISSING\"\n        }\n    };\n}\n\n/**\n * Reject anonymous callers with 401.\n *\n * Put it in the route's own middleware slot rather than `app.use(\"/*\", …)`:\n * `use()` covers only the routes declared *below* it, so a route appended later\n * — by you, months from now, at the bottom of the file — is silently\n * unprotected. The per-route form cannot drift that way.\n *\n * @example\n * ```ts\n * app.post(\"/\", requireAuth, async (c) => {\n *     const user = getUser(c)!;  // guaranteed by the guard\n *     return c.json({ uid: user.uid });\n * });\n * ```\n */\nexport const requireAuth: MiddlewareHandler<HonoEnv> = async (c, next) => {\n    if (getUser(c)) return next();\n    if (!identityResolved(c)) return c.json(unresolvedIdentity(), 500);\n\n    return c.json({\n        error: {\n            message: \"Authentication required\",\n            code: \"UNAUTHORIZED\"\n        }\n    }, 401);\n};\n\n/**\n * Reject callers without an administrative role with 403.\n *\n * Must come **after** {@link requireAuth}: on its own it answers 401 for an\n * anonymous caller, which is right, but pairing them keeps the two failures\n * distinguishable — 401 \"who are you\", 403 \"not you\".\n *\n * Administrative means `admin` or `schema-admin`, from the single list in\n * `auth/admin-roles.ts`. Do not compare against `\"admin\"` by hand; that is the\n * divergence that list exists to prevent.\n */\nexport const requireAdmin: MiddlewareHandler<HonoEnv> = async (c, next) => {\n    const user = getUser(c);\n    if (!user) {\n        if (!identityResolved(c)) return c.json(unresolvedIdentity(), 500);\n        return c.json({\n            error: {\n                message: \"Authentication required\",\n                code: \"UNAUTHORIZED\"\n            }\n        }, 401);\n    }\n\n    if (!isAdmin(c)) {\n        return c.json({\n            error: {\n                message: \"Admin privileges required for this operation\",\n                code: \"FORBIDDEN\"\n            }\n        }, 403);\n    }\n\n    return next();\n};\n\n/**\n * Reject callers holding none of the named roles with 403.\n *\n * Any of them, not all — require several by chaining the guard twice. Naming no\n * role at all is a programming error and throws at module load rather than at\n * request time, because `requireRole()` with an empty list would otherwise read\n * as a guard while admitting everyone.\n *\n * @example\n * ```ts\n * app.post(\"/publish\", requireAuth, requireRole(\"editor\", \"admin\"), handler);\n * ```\n */\nexport function requireRole(...roles: string[]): MiddlewareHandler<HonoEnv> {\n    if (roles.length === 0) {\n        throw new Error(\n            \"requireRole() needs at least one role. An empty list would admit every \" +\n            \"signed-in caller while reading as a restriction.\"\n        );\n    }\n\n    const allowed = new Set(roles);\n    return async (c, next) => {\n        const user = getUser(c);\n        if (!user) {\n            if (!identityResolved(c)) return c.json(unresolvedIdentity(), 500);\n            return c.json({\n                error: {\n                    message: \"Authentication required\",\n                    code: \"UNAUTHORIZED\"\n                }\n            }, 401);\n        }\n\n        if (!getRoles(c).some(role => allowed.has(role))) {\n            return c.json({\n                error: {\n                    message: `This operation requires one of these roles: ${roles.join(\", \")}`,\n                    code: \"FORBIDDEN\"\n                }\n            }, 403);\n        }\n\n        return next();\n    };\n}\n","import { Hono } from \"hono\";\nimport { HonoEnv } from \"../api/types\";\nimport { ApiError } from \"../api/errors\";\nimport { LoadedFunction } from \"./function-loader\";\nimport { requireAuth } from \"./guards\";\n\n/** The file a loader problem names, without its extension: `broken.ts (threw: …)` → `broken`. */\nfunction problemName(problem: string): string {\n    return problem.split(\" \")[0].replace(/\\/$/, \"\").replace(/\\.[cm]?[jt]s$/, \"\");\n}\n\n/**\n * Mount all loaded function routes under a single Hono router.\n *\n * Each function is mounted at `/<function-name>`, preserving\n * whatever HTTP methods and middleware the Hono sub-app defines.\n *\n * @param functions What loaded. May be empty — the router still mounts, so\n *   \"no functions are served\" answers 200 with an empty list instead of 404.\n * @param problems The files the loader saw and could not serve, as\n *   `\"<file> (<reason>)\"`. The listing reports a count and a pointer to the log,\n *   not the reasons: those carry import errors, and the listing is one guard\n *   away from anyone. The unmatched-route handler uses the *names* to answer the\n *   one question a 404 on a function nobody can find should answer — \"there is a\n *   file for this and it did not load\" — which is the difference between a typo\n *   and a broken deploy, and the loader was the only thing that knew.\n */\nexport function createFunctionRoutes(\n    functions: LoadedFunction[],\n    problems: string[] = [],\n    /**\n     * Where this router is mounted, so the listing can report a path a caller\n     * can actually request. It used to hardcode `/functions/<name>`, which is\n     * wrong under every `basePath` including the default `/api`.\n     */\n    mountPath = \"/functions\"\n): Hono<HonoEnv> {\n    const router = new Hono<HonoEnv>();\n    const skipped = problems.length;\n\n    // Listing endpoint: GET / → list available functions.\n    //\n    // Functions themselves stay anonymous-callable by default — a webhook\n    // receiver has to be — but the index of them does not: it is an inventory\n    // of every custom endpoint, for whoever asks. `requireAuth` admits any\n    // resolved identity (a signed-in user, an API key, the service key), so\n    // `rebase doctor` and `rebase cloud debug` keep their answer; the latter\n    // already reads a 401 here as \"mounted\".\n    router.get(\"/\", requireAuth, (c) => {\n        return c.json({\n            functions: functions.map((fn) => ({\n                name: fn.name,\n                endpoint: `${mountPath}/${fn.name}`\n            })),\n            ...(skipped > 0 && {\n                skipped,\n                note: `${skipped} function file(s) failed to load and are NOT served — see the server log for the reason.`\n            })\n        });\n    });\n\n    for (const fn of functions) {\n        router.route(`/${fn.name}`, fn.app);\n    }\n\n    // A name that matches nothing, answered in the envelope.\n    //\n    // Registered last so every real route wins it. Without it, a typo'd\n    // function name — the single most likely 404 a developer meets on this\n    // surface — fell through to Hono's default `404 Not Found` as `text/plain`,\n    // and through the SDK arrived as `RebaseApiError { code: undefined }`, so\n    // the documented `e.code === \"FUNCTION_NOT_FOUND\"` branch never ran.\n    //\n    // What the message may say depends on who is asking. The mounted names are\n    // an inventory of every custom endpoint, which is exactly what the listing\n    // above requires an identity to see — so an anonymous caller is told their\n    // name is unknown and nothing more, and a resolved caller gets the list\n    // that turns the 404 into a fix.\n    const mounted = new Set(functions.map(fn => fn.name));\n    const failedToLoad = new Map(problems.map(p => [problemName(p), p.split(\" \")[0]]));\n\n    router.all(\"/:name{.*}\", (c): never => {\n        const requested = (c.req.param(\"name\") ?? \"\").split(\"/\").filter(Boolean);\n        const name = requested[0] ?? \"\";\n        const rest = requested.slice(1).join(\"/\");\n        const identified = Boolean(c.get(\"user\"));\n\n        const refuse = (message: string): never => {\n            throw new ApiError(404, \"FUNCTION_NOT_FOUND\", message, { function: name }, true);\n        };\n\n        if (!name) {\n            refuse(`No function in the request path. Expected ${mountPath}/<function>.`);\n        }\n        if (mounted.has(name)) {\n            refuse(\n                `The function '${name}' is served, and has no ${c.req.method} route at '/${rest}'. ` +\n                \"The path after the function name is routed by the function's own Hono app.\"\n            );\n        }\n        const file = failedToLoad.get(name);\n        if (file) {\n            refuse(\n                `The function '${name}' is not served: '${file}' failed to load. ` +\n                \"The server log records why, at boot.\"\n            );\n        }\n        return refuse(\n            `No function named '${name}' on this backend.` +\n            (identified\n                ? (mounted.size > 0\n                    ? ` This backend serves: ${[...mounted].sort().join(\", \")}.`\n                    : \" This backend serves no functions.\")\n                : \"\") +\n            (skipped > 0 && identified\n                ? ` ${skipped} function file(s) failed to load and are not served — see the server log.`\n                : \"\")\n        );\n    });\n\n    return router;\n}\n"],"mappings":";;;;;;;;;AAwDA,SAAS,KACL,GACA,KACmC;CAInC,OAAQ,EAAuB,IAAI,GAAG;AAC1C;;;;;;;;;;;;;;;AAgBA,SAAgB,QAAQ,GAAsC;CAC1D,MAAM,MAAM,KAAK,GAAG,MAAM;CAC1B,IAAI,CAAC,OAAO,OAAO,QAAQ,UAAU,OAAO,KAAA;CAE5C,MAAM,SAAS;CACf,MAAM,MAAM,OAAO,OAAO,QAAQ,WAAW,OAAO,MAAM,KAAA;CAC1D,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;CAE9B,MAAM,QAAQ,MAAM,QAAQ,OAAO,KAAK,IAClC,OAAO,MAAM,QAAQ,SAAyB,OAAO,SAAS,QAAQ,IACtE,CAAC;CAEP,OAAO;EAAE,GAAG;EACR;EACA;CAAM;AACd;;AAGA,SAAgB,UAAU,GAAgC;CACtD,OAAO,QAAQ,CAAC,CAAC,EAAE;AACvB;;AAGA,SAAgB,SAAS,GAAsB;CAC3C,OAAO,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC;AACjC;;;;;;;AAQA,SAAgB,QAAQ,GAAY,GAAG,OAA0B;CAC7D,IAAI,MAAM,WAAW,GAAG,OAAO;CAC/B,MAAM,OAAO,IAAI,IAAI,SAAS,CAAC,CAAC;CAChC,OAAO,MAAM,MAAK,SAAQ,KAAK,IAAI,IAAI,CAAC;AAC5C;;;;;;;;;AAUA,SAAgB,QAAQ,GAAqB;CACzC,OAAO,sBAAsB,SAAS,CAAC,CAAC;AAC5C;;AAGA,SAAgB,gBAAgB,GAAqB;CACjD,OAAO,QAAQ,CAAC,MAAM,KAAA;AAC1B;;;;;;;;;;;;;;;AAgBA,SAAgB,UAAU,GAAoC;CAC1D,OAAO,KAAK,GAAG,QAAQ;AAC3B;;;;;;;;;AAUA,SAAgB,cAAc,GAAwB;CAClD,MAAM,SAAS,UAAU,CAAC;CAC1B,IAAI,CAAC,QACD,MAAM,IAAI,MACN,6UAKJ;CAEJ,OAAO;AACX;;;;;;;;AASA,SAAgB,UAAU,GAAsC;CAC5D,OAAO,KAAK,GAAG,QAAQ;AAC3B;;;;;;;;AASA,SAAgB,aAAa,GAAgC;CACzD,OAAO,KAAK,GAAG,WAAW;AAC9B;;;;;;;;;;;AAYA,SAAgB,iBAAiB,GAAqB;CAClD,OAAO,KAAK,GAAG,MAAM,MAAM,KAAA,KAAa,KAAK,GAAG,QAAQ,MAAM,KAAA;AAClE;;;;;;;;;;ACxKA,SAAS,qBAAmE;CACxE,OAAO,EACH,OAAO;EACH,SACI;EAIJ,MAAM;CACV,EACJ;AACJ;;;;;;;;;;;;;;;;;AAkBA,IAAa,cAA0C,OAAO,GAAG,SAAS;CACtE,IAAI,QAAQ,CAAC,GAAG,OAAO,KAAK;CAC5B,IAAI,CAAC,iBAAiB,CAAC,GAAG,OAAO,EAAE,KAAK,mBAAmB,GAAG,GAAG;CAEjE,OAAO,EAAE,KAAK,EACV,OAAO;EACH,SAAS;EACT,MAAM;CACV,EACJ,GAAG,GAAG;AACV;;;;;;;;;;;;;;AAkDA,SAAgB,YAAY,GAAG,OAA6C;CACxE,IAAI,MAAM,WAAW,GACjB,MAAM,IAAI,MACN,yHAEJ;CAGJ,MAAM,UAAU,IAAI,IAAI,KAAK;CAC7B,OAAO,OAAO,GAAG,SAAS;EAEtB,IAAI,CADS,QAAQ,CAChB,GAAM;GACP,IAAI,CAAC,iBAAiB,CAAC,GAAG,OAAO,EAAE,KAAK,mBAAmB,GAAG,GAAG;GACjE,OAAO,EAAE,KAAK,EACV,OAAO;IACH,SAAS;IACT,MAAM;GACV,EACJ,GAAG,GAAG;EACV;EAEA,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAK,SAAQ,QAAQ,IAAI,IAAI,CAAC,GAC3C,OAAO,EAAE,KAAK,EACV,OAAO;GACH,SAAS,+CAA+C,MAAM,KAAK,IAAI;GACvE,MAAM;EACV,EACJ,GAAG,GAAG;EAGV,OAAO,KAAK;CAChB;AACJ;;;;;AC5JA,SAAS,YAAY,SAAyB;CAC1C,OAAO,QAAQ,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,QAAQ,OAAO,EAAE,CAAC,CAAC,QAAQ,iBAAiB,EAAE;AAC/E;;;;;;;;;;;;;;;;;AAkBA,SAAgB,qBACZ,WACA,WAAqB,CAAC,GAMtB,YAAY,cACC;CACb,MAAM,SAAS,IAAI,KAAc;CACjC,MAAM,UAAU,SAAS;CAUzB,OAAO,IAAI,KAAK,cAAc,MAAM;EAChC,OAAO,EAAE,KAAK;GACV,WAAW,UAAU,KAAK,QAAQ;IAC9B,MAAM,GAAG;IACT,UAAU,GAAG,UAAU,GAAG,GAAG;GACjC,EAAE;GACF,GAAI,UAAU,KAAK;IACf;IACA,MAAM,GAAG,QAAQ;GACrB;EACJ,CAAC;CACL,CAAC;CAED,KAAK,MAAM,MAAM,WACb,OAAO,MAAM,IAAI,GAAG,QAAQ,GAAG,GAAG;CAgBtC,MAAM,UAAU,IAAI,IAAI,UAAU,KAAI,OAAM,GAAG,IAAI,CAAC;CACpD,MAAM,eAAe,IAAI,IAAI,SAAS,KAAI,MAAK,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;CAEjF,OAAO,IAAI,eAAe,MAAa;EACnC,MAAM,aAAa,EAAE,IAAI,MAAM,MAAM,KAAK,GAAA,CAAI,MAAM,GAAG,CAAC,CAAC,OAAO,OAAO;EACvE,MAAM,OAAO,UAAU,MAAM;EAC7B,MAAM,OAAO,UAAU,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG;EACxC,MAAM,aAAa,QAAQ,EAAE,IAAI,MAAM,CAAC;EAExC,MAAM,UAAU,YAA2B;GACvC,MAAM,IAAI,SAAS,KAAK,sBAAsB,SAAS,EAAE,UAAU,KAAK,GAAG,IAAI;EACnF;EAEA,IAAI,CAAC,MACD,OAAO,6CAA6C,UAAU,aAAa;EAE/E,IAAI,QAAQ,IAAI,IAAI,GAChB,OACI,iBAAiB,KAAK,0BAA0B,EAAE,IAAI,OAAO,cAAc,KAAK,8EAEpF;EAEJ,MAAM,OAAO,aAAa,IAAI,IAAI;EAClC,IAAI,MACA,OACI,iBAAiB,KAAK,oBAAoB,KAAK,uDAEnD;EAEJ,OAAO,OACH,sBAAsB,KAAK,uBAC1B,aACM,QAAQ,OAAO,IACZ,yBAAyB,CAAC,GAAG,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,EAAE,KACxD,uCACJ,OACL,UAAU,KAAK,aACV,IAAI,QAAQ,6EACZ,GACV;CACJ,CAAC;CAED,OAAO;AACX"}

package/dist/functions/define-function.d.ts

@@ -52,11 +52,14 @@ export interface RebaseFunctionContext {
  *
  * @example
  * ```ts
- * import { defineFunction, requireAuth } from "@rebasepro/server";
+ * // The portable entry point, and a per-route guard — both for the reasons
+ * // their own docs give: this subpath pulls in nothing Node-only, and
+ * // `app.use("/*", requireAuth)` covers only the routes declared *below* it,
+ * // so a route appended later at the bottom of the file is unprotected.
+ * import { defineFunction, requireAuth } from "@rebasepro/server/functions";
  *
  * export default defineFunction((app, { rebase }) => {
- *     app.use("/*", requireAuth);
- *     app.get("/home", async (c) => {
+ *     app.get("/home", requireAuth, async (c) => {
  *         // `rebase.sql` runs on the owner connection: no RLS, no policies,
  *         // every row. It is the most privileged thing in this context —
  *         // more so than `dataAsAdmin`, which is merely admin-scoped.

package/dist/functions/function-routes.d.ts

@@ -9,11 +9,15 @@ import { LoadedFunction } from "./function-loader.js";
  *
  * @param functions What loaded. May be empty — the router still mounts, so
  *   "no functions are served" answers 200 with an empty list instead of 404.
- * @param skipped How many files the loader saw and could not serve. Reported
- *   as a count and a pointer to the log, not as filenames: the listing is
- *   reachable anonymously, and the per-file reasons carry import errors.
+ * @param problems The files the loader saw and could not serve, as
+ *   `"<file> (<reason>)"`. The listing reports a count and a pointer to the log,
+ *   not the reasons: those carry import errors, and the listing is one guard
+ *   away from anyone. The unmatched-route handler uses the *names* to answer the
+ *   one question a 404 on a function nobody can find should answer — "there is a
+ *   file for this and it did not load" — which is the difference between a typo
+ *   and a broken deploy, and the loader was the only thing that knew.
  */
-export declare function createFunctionRoutes(functions: LoadedFunction[], skipped?: number, 
+export declare function createFunctionRoutes(functions: LoadedFunction[], problems?: string[], 
 /**
  * Where this router is mounted, so the listing can report a path a caller
  * can actually request. It used to hardcode `/functions/<name>`, which is

package/dist/functions/index.js

@@ -156,10 +156,12 @@ function getInstance() {
 * request handler, run user-scoped queries through the request-scoped driver
 * (`c.var.driver`), which carries the caller's identity.
 *
-* `rebase.data` is **gone from the type**: `RebaseServerClient` omits it, so the
-* admin-scoped accessor has exactly one name and the privilege is visible at the
-* call site. The property still exists at runtime, aliasing `dataAsAdmin`, so an
-* untyped JavaScript caller keeps working rather than failing on `undefined`.
+* `rebase.data` is **gone**: `RebaseServerClient` omits it, and the property is
+* removed from the object at boot, so the admin-scoped accessor has exactly one
+* name and the privilege is visible at the call site. It was left as a runtime
+* alias for a while — which defeated the point, since untyped code could still
+* reach the privileged plane by the name that means *user-scoped* everywhere
+* else. Use `rebase.dataAsAdmin`.
 *
 * **Control plane** (`rebase.auth`, `rebase.admin`, `rebase.storage`, etc.):
 * Routes through the Hono app's internal request handler. An internal per-boot
@@ -201,11 +203,14 @@ var rebase = new Proxy({}, {
 *
 * @example
 * ```ts
-* import { defineFunction, requireAuth } from "@rebasepro/server";
+* // The portable entry point, and a per-route guard — both for the reasons
+* // their own docs give: this subpath pulls in nothing Node-only, and
+* // `app.use("/*", requireAuth)` covers only the routes declared *below* it,
+* // so a route appended later at the bottom of the file is unprotected.
+* import { defineFunction, requireAuth } from "@rebasepro/server/functions";
 *
 * export default defineFunction((app, { rebase }) => {
-*     app.use("/*", requireAuth);
-*     app.get("/home", async (c) => {
+*     app.get("/home", requireAuth, async (c) => {
 *         // `rebase.sql` runs on the owner connection: no RLS, no policies,
 *         // every row. It is the most privileged thing in this context —
 *         // more so than `dataAsAdmin`, which is merely admin-scoped.
@@ -612,13 +617,38 @@ var LOG_PRIORITY = {
 function isProduction() {
 	return hostEnv().NODE_ENV === "production";
 }
+/**
+* An explicit level from `config.logging.level`, when a project set one.
+*
+* Outranks `LOG_LEVEL` because it is the more specific statement: an
+* environment variable is the deployment's default, and this is the
+* application saying what it wants regardless of where it runs.
+*
+* There used to be a second, separate mechanism for this — `utils/logging.ts`
+* reassigned `console.debug`/`console.log`/`console.warn` to no-ops — and the
+* two disagreed in a way nobody could have guessed from either: `LOG_LEVEL=warn`
+* silenced this logger's info lines *and* every `console.log` in the process,
+* including a dependency's, including a project's own debugging. It also could
+* not be undone, because the originals were gone.
+*/
+var configuredLevel;
 function getMinLevel() {
+	if (configuredLevel) return configuredLevel;
 	const env = (hostEnv().LOG_LEVEL || "info").toLowerCase();
 	if (env in LOG_PRIORITY) return env;
 	return "info";
 }
 var FAILED_QUERY_MARKER = "Failed query:";
-var REDACTED_QUERY = "Failed query: [redacted]";
+/**
+* The marker says how to lift it.
+*
+* Every DDL, RLS and CDC failure ends at this string, and the statement is the
+* whole diagnosis — three of them landed in one boot of a two-database project,
+* each a dead end. The switch existed; nothing named it, in the log or in the
+* docs, so `grep -rn REBASE_LOG_RAW_QUERIES` over the documentation, the
+* templates and the agent skills came back empty.
+*/
+var REDACTED_QUERY = "Failed query: [redacted — set REBASE_LOG_RAW_QUERIES=true in development to see it]";
 var REDACTED_VALUE = "[redacted]";
 /**
 * Key fragments whose values are never safe to publish. Compared against the
@@ -645,12 +675,21 @@ function isSensitiveKey(key) {
 	return SENSITIVE_KEY_FRAGMENTS.some((fragment) => normalised.includes(fragment));
 }
 /**
-* Local escape hatch for the `Failed query:` strip only — the statement is the
-* fastest way to diagnose a failing query on a developer machine. Ignored in
+* Whether a SQL statement may be written out at all.
+*
+* The escape hatch for the `Failed query:` strip — the statement is the fastest
+* way to diagnose a failing query on a developer machine. Ignored in
 * production, so a runtime that inherits the variable cannot leak because of
 * it, and it never re-enables the key deny-list.
+*
+* Exported because it is the *only* answer to "may this process print SQL", and
+* a driver that wants to trace what it executes has to ask the same question.
+* The Postgres driver used to decide for itself, with a `console.debug` gated
+* on `NODE_ENV` alone: every statement went to stdout whatever `LOG_LEVEL`
+* said, and it went there without passing through the redaction that lives in
+* this file.
 */
-function rawQueriesAllowed() {
+function rawQueryLoggingEnabled() {
 	return hostEnv().NODE_ENV !== "production" && hostEnv().REBASE_LOG_RAW_QUERIES === "true";
 }
 /**
@@ -667,12 +706,12 @@ function rawQueriesAllowed() {
 * before persisting and then logs the result.
 */
 function redactSensitiveText(text) {
-	if (!text.includes(FAILED_QUERY_MARKER) || rawQueriesAllowed()) return text;
+	if (!text.includes(FAILED_QUERY_MARKER) || rawQueryLoggingEnabled()) return text;
 	let out = text;
 	let idx = out.indexOf(FAILED_QUERY_MARKER);
 	while (idx !== -1) {
 		if (out.startsWith(REDACTED_QUERY, idx)) {
-			idx = out.indexOf(FAILED_QUERY_MARKER, idx + 24);
+			idx = out.indexOf(FAILED_QUERY_MARKER, idx + 83);
 			continue;
 		}
 		const paramsIdx = out.indexOf("\nparams:", idx);
@@ -683,24 +722,76 @@ function redactSensitiveText(text) {
 			end = eol === -1 ? out.length : eol;
 		}
 		out = out.slice(0, idx) + REDACTED_QUERY + out.slice(end);
-		idx = out.indexOf(FAILED_QUERY_MARKER, idx + 24);
+		idx = out.indexOf(FAILED_QUERY_MARKER, idx + 83);
 	}
 	return out;
 }
 /**
-* Serialise an Error into a plain object (stack + message), with the query
-* text redacted out of both. `query`/`params` own-properties — which
-* `DrizzleQueryError` carries beside the message — are deliberately not
-* copied.
+* Diagnostic own-properties worth carrying up out of an error.
+*
+* These are what a socket failure actually says: `ECONNREFUSED` with the
+* `address` and `port` it was refused on, `ENOTFOUND` with the hostname that
+* did not resolve. They live as own-properties on the Node error rather than in
+* its message, so a serialiser that copies only `message` and `stack` prints a
+* boot failure that names no host, no port and no reason.
+*
+* Deliberately a fixed list rather than "every own-property": `DrizzleQueryError`
+* carries `query` and `params` beside its message, and copying those would put
+* the statement and its bound values — an email, a bcrypt hash — straight back
+* on stdout, which is what the redaction above exists to prevent. Postgres's own
+* `detail` and `hint` are left out for the same reason: `23505` reports
+* `Key (email)=(a@b.c) already exists.`, which is a row's contents.
+*/
+var ERROR_DETAIL_KEYS = [
+	"code",
+	"errno",
+	"syscall",
+	"address",
+	"port",
+	"hostname"
+];
+/** How far the cause chain is followed before the serialiser gives up. */
+var MAX_CAUSE_DEPTH = 4;
+/** How many of an `AggregateError`'s children are serialised. */
+var MAX_AGGREGATE_ERRORS = 4;
+/**
+* Serialise an Error into a plain object, with the query text redacted out of
+* its message and stack. `query`/`params` own-properties — which
+* `DrizzleQueryError` carries beside the message — are deliberately not copied.
+*
+* The chain matters more than the top. Everything a driver rethrows is a
+* wrapper: Drizzle's is `Failed query: SELECT 1` with a stack through drizzle
+* internals, and the sentence that says what is wrong — `connect ECONNREFUSED
+* 127.0.0.1:5432`, `password authentication failed for user "app"` — sits in
+* `.cause`, or inside the `AggregateError.errors` that `net` raises when every
+* resolved address is refused. Serialising only the wrapper is why a boot
+* against a stopped database used to log a redacted query and nothing else.
+*
 * Handles non-Error values gracefully.
 */
-function serialiseError(value) {
-	if (value instanceof Error) return {
+function serialiseError(value, depth = 0) {
+	const isError = value instanceof Error;
+	if (!isError && !(!isError && depth > 0 && Boolean(value) && typeof value === "object" && !Array.isArray(value))) return { value: redactSensitiveText(String(value)) };
+	const own = value;
+	const out = isError ? {
 		name: value.name,
 		message: redactSensitiveText(value.message),
 		stack: value.stack ? redactSensitiveText(value.stack) : void 0
+	} : {
+		...typeof own.name === "string" ? { name: own.name } : {},
+		...typeof own.message === "string" ? { message: redactSensitiveText(own.message) } : {}
 	};
-	return { value: redactSensitiveText(String(value)) };
+	for (const key of ERROR_DETAIL_KEYS) {
+		const detail = own[key];
+		if (detail === void 0 || detail === null) continue;
+		if (typeof detail === "object") continue;
+		out[key] = typeof detail === "string" ? redactSensitiveText(detail) : detail;
+	}
+	if (depth >= MAX_CAUSE_DEPTH) return out;
+	if (own.cause !== void 0 && own.cause !== null) out.cause = serialiseError(own.cause, depth + 1);
+	const aggregated = own.errors;
+	if (Array.isArray(aggregated) && aggregated.length > 0) out.errors = aggregated.slice(0, MAX_AGGREGATE_ERRORS).map((item) => serialiseError(item, depth + 1));
+	return out;
 }
 /**
 * Redact one logged value: errors are serialised, strings are stripped of
@@ -730,16 +821,30 @@ function formatData(data) {
 	for (const [key, val] of Object.entries(data)) out[key] = isSensitiveKey(key) ? REDACTED_VALUE : redactValue(val, 0, seen);
 	return out;
 }
+var sinks = /* @__PURE__ */ new Set();
+/** Re-entrancy guard: see `addLogSink`. */
+var inSink = false;
+function fanOut(level, message, data) {
+	if (sinks.size === 0 || inSink) return;
+	inSink = true;
+	try {
+		for (const sink of sinks) try {
+			sink(level, message, data);
+		} catch {}
+	} finally {
+		inSink = false;
+	}
+}
 function createLogger(rawDefaultFields = {}) {
-	const minLevel = getMinLevel();
 	const defaultFields = formatData(rawDefaultFields) ?? {};
 	function emit(level, message, data) {
-		if (LOG_PRIORITY[level] < LOG_PRIORITY[minLevel]) return;
+		if (LOG_PRIORITY[level] < LOG_PRIORITY[getMinLevel()]) return;
 		const safeMessage = redactSensitiveText(message);
 		const merged = {
 			...defaultFields,
 			...formatData(data)
 		};
+		fanOut(level, safeMessage, merged);
 		if (isProduction()) {
 			const entry = {
 				severity: GCP_SEVERITY[level],