@rebasepro/server 0.17.3 → 0.18.0

package/dist/keys-g8lbVC_o.js

@@ -0,0 +1,230 @@
+import { createRequire as __rebaseCreateRequire } from "module";
+import __rebaseProcess from "process";
+globalThis.process ??= __rebaseProcess;
+__rebaseCreateRequire(import.meta.url);
+import { c as DEFAULT_STORAGE_SOURCE_KEY } from "./src-DHK4fHkw.js";
+//#region src/storage/keys.ts
+/**
+* Canonical storage keys and bucket names.
+*
+* Storage is not under RLS, so a `storageAuthorize` hook is the whole access
+* control model — and a hook can only be correct if the key it is shown is the
+* key that is written. That is the invariant this module exists to hold: one
+* canonical string, computed once per request, handed to the hook, to the
+* controller, and to the download token alike.
+*
+* ## Why rejecting beats stripping
+*
+* The previous `sanitizeStorageKey` *stripped* `../` in a single pass. Two
+* things were wrong with that, and only one of them was the obvious one.
+*
+* The obvious one: a single pass is not a fixed point. `....//` contains `../`
+* at offset 2, so removing it leaves `../` behind — the sanitizer manufactured
+* the traversal it was there to remove. `users/alice/....//bob/x` came out as
+* `users/alice/../bob/x`, which a prefix hook reads as alice's (it starts with
+* `users/alice/`) and the filesystem reads as bob's. The hook approved one
+* object and the controller wrote another.
+*
+* The subtler one, and the reason this is a rewrite rather than a loop: even a
+* correct strip is a silent rewrite. A caller who asks to store at `a/../b` and
+* gets an object at `a/b` was not protected, they were misled — and every later
+* read, ownership row and audit line now refers to a path nobody chose. So a key
+* that means something other than what it says is refused (400), not repaired.
+*
+* Note what is NOT traversal under this rule: `....` is an ordinary directory
+* name, and `users/alice/....//bob/x` canonicalizes to
+* `users/alice/..../bob/x` — still comfortably inside alice's prefix, which is
+* exactly right. Only a real `..` segment is refused.
+*/
+/**
+* `path.posix.normalize`, without `node:path`.
+*
+* A storage key is a POSIX-shaped string that never touches a filesystem, so
+* reaching for `node:path` to fold `.` and `//` out of it was always a little
+* wrong on its own terms — on Windows the platform `path` would have applied
+* different rules to the same key. It also put the module that every storage
+* read, ownership row and audit line goes through on the list of things that
+* only run in a Node process.
+*
+* This is the algorithm Node implements, transcribed: segments are folded left
+* to right, `..` pops unless it would climb past the root of a relative path,
+* and both the leading and the trailing separator survive the round trip. The
+* `..` branch is unreachable from {@link canonicalStorageKey}, which refuses
+* those keys outright before it gets here — it exists so that this function is
+* *the* normalizer rather than a subset of one, and
+* `storage-keys.property.test.ts` holds it to that with a property test against
+* `path.posix.normalize` itself. Exported for exactly that — nothing outside
+* this module should be normalizing a key.
+*/
+function normalizePosix(input) {
+	if (input.length === 0) return ".";
+	const isAbsolute = input.startsWith("/");
+	const trailingSeparator = input.endsWith("/");
+	const segments = [];
+	for (const segment of input.split("/")) {
+		if (segment === "" || segment === ".") continue;
+		if (segment === "..") {
+			if (segments.length > 0 && segments[segments.length - 1] !== "..") segments.pop();
+			else if (!isAbsolute) segments.push("..");
+			continue;
+		}
+		segments.push(segment);
+	}
+	const joined = segments.join("/");
+	if (joined === "") {
+		if (isAbsolute) return "/";
+		return trailingSeparator ? "./" : ".";
+	}
+	const withTrailing = trailingSeparator ? `${joined}/` : joined;
+	return isAbsolute ? `/${withTrailing}` : withTrailing;
+}
+/** Longest key accepted, in UTF-16 code units. Matches the previous cap. */
+var MAX_STORAGE_KEY_LENGTH = 1024;
+/**
+* A key that cannot be canonicalized. Carries no path back to the caller
+* beyond what they sent, so it is safe to surface as a 400 message.
+*/
+var InvalidStorageKeyError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "InvalidStorageKeyError";
+	}
+};
+/**
+* Canonicalize a caller-supplied storage key, or throw
+* {@link InvalidStorageKeyError}.
+*
+* Normalizations applied (safe, idempotent, and meaning-preserving):
+* - leading slashes removed — `/a/b` and `a/b` name the same object
+* - `.` segments and repeated slashes collapsed
+*
+* Refusals (the key means something other than what it says):
+* - any `..` segment, on either separator, at any depth
+* - null bytes
+* - keys longer than {@link MAX_STORAGE_KEY_LENGTH}
+*
+* A trailing slash is preserved: it is how the folder route marks a prefix.
+*/
+function canonicalStorageKey(rawKey) {
+	if (rawKey.includes("\0")) throw new InvalidStorageKeyError("Storage key contains a null byte.");
+	if (rawKey.length > 1024) throw new InvalidStorageKeyError(`Storage key exceeds the maximum length of ${MAX_STORAGE_KEY_LENGTH} characters.`);
+	if (rawKey.split(/[\\/]/).some((segment) => segment === "..")) throw new InvalidStorageKeyError("Storage key contains a '..' path segment. Keys must name an object directly.");
+	const withoutLeadingSlashes = rawKey.replace(/^\/+/, "");
+	if (withoutLeadingSlashes === "") return "";
+	const denotesDirectory = /(?:^|\/)\.?$/.test(withoutLeadingSlashes);
+	const normalized = normalizePosix(withoutLeadingSlashes);
+	if (normalized === "." || normalized === "./") return "";
+	const key = normalized.replace(/^\.\//, "").replace(/^\/+/, "");
+	if (key === "") return "";
+	return denotesDirectory && !key.endsWith("/") ? `${key}/` : key;
+}
+/**
+* Canonicalize, or return `null` when the key is not canonicalizable.
+*
+* For callers that must fail closed without an exception — the download-token
+* middleware compares a request path against a granted path, and a key it
+* cannot canonicalize simply matches nothing.
+*/
+function tryCanonicalStorageKey(rawKey) {
+	try {
+		return canonicalStorageKey(rawKey);
+	} catch {
+		return null;
+	}
+}
+/**
+* Canonicalize the storage *source* a request names (`?storageId=`), so that
+* "the default source" has exactly one spelling.
+*
+* The default source can be asked for three ways — the parameter omitted, sent
+* empty, or sent as the literal `(default)` — and all three resolve to the same
+* controller. Without a single spelling, the value derived when a download
+* token is minted and the value derived when it is presented can differ for the
+* same object, which is either a spurious 403 or, if the comparison is dropped
+* to stop those, no scoping at all.
+*
+* Deliberately *not* validated against the registry: this is a naming rule, not
+* an existence check, and it must give the same answer in `auth/` (which has no
+* registry) as in the storage routes. An id that names no source still
+* canonicalizes to itself and simply matches only itself.
+*/
+function canonicalStorageId(rawStorageId) {
+	if (rawStorageId === void 0 || rawStorageId === null) return DEFAULT_STORAGE_SOURCE_KEY;
+	const trimmed = rawStorageId.trim();
+	return trimmed === "" ? DEFAULT_STORAGE_SOURCE_KEY : trimmed;
+}
+/** A bucket name that does not name a bucket. See {@link canonicalStorageBucket}. */
+var InvalidStorageBucketError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "InvalidStorageBucketError";
+	}
+};
+/**
+* One path segment: letters, digits, `.`, `_`, `-`, first character
+* alphanumeric. Deliberately narrow — it is the intersection of what S3, GCS
+* and a filesystem directory all accept, and it makes `..`, `.tus-uploads`,
+* absolute paths and anything containing a separator unrepresentable.
+*/
+var STORAGE_BUCKET_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+/**
+* Canonicalize a caller-supplied bucket name, or throw
+* {@link InvalidStorageBucketError}.
+*
+* The bucket is the *other* caller-controlled routing value in an upload
+* request, and it was the one nobody validated. `LocalStorageController`
+* builds `join(basePath, bucket)` and then checks containment against that
+* result, so a bucket of `../../etc` moved the boundary rather than crossing
+* it — the guard passed because the guard's reference point was the attacker's.
+* The containment check now resolves against the storage root, and this is the
+* check at the route boundary that stops the value before it gets there.
+*
+* A bucket is configuration, not user data: there is no legitimate caller that
+* needs a separator, a leading dot, or a `..` in one. So this refuses rather
+* than repairs, exactly as {@link canonicalStorageKey} does — a rewritten
+* bucket would silently store the object somewhere the caller did not ask for.
+*
+* Returns `undefined` when the caller named no bucket (absent, or an empty
+* form field), which is how every controller spells "use my default". An empty
+* string used to reach `getFullPath` and resolve to the storage *root* rather
+* than the `default` bucket, which is a third place a bare key did not
+* round-trip.
+*/
+function canonicalStorageBucket(rawBucket) {
+	if (rawBucket === void 0 || rawBucket === null || rawBucket === "") return void 0;
+	if (rawBucket.length > 63) throw new InvalidStorageBucketError(`Storage bucket exceeds the maximum length of 63 characters.`);
+	if (!STORAGE_BUCKET_PATTERN.test(rawBucket)) throw new InvalidStorageBucketError("Storage bucket must be a single name of letters, digits, '.', '_' or '-', starting with a letter or digit.");
+	return rawBucket;
+}
+/**
+* The prefix an object store's listing should be given for a caller's key, and
+* the key a listing should hand back for a folder.
+*
+* The three controllers answer the same question in two different ways, and
+* they used to disagree about the answer. `LocalStorageController` resolves a
+* *directory* on disk, so `listObjects("products/images")` and
+* `listObjects("products/images/")` both list what is inside it. An object
+* store under `Delimiter: "/"` does not: `Prefix: "products/images"` matches
+* `products/images.txt` and `productsomething/`, and returns none of the files
+* inside `products/images/`. So the same call — the SDK's own documented one —
+* answered one thing against local dev and another against the S3 bucket in
+* production, which is the worst place for a divergence to live.
+*
+* `listingPrefix` is what to *send*: a trailing slash, always, because that is
+* the only spelling that means "inside this folder" to a delimiter listing.
+* `folderKey` is what to *return* for a common prefix: no trailing slash, the
+* form the local controller has always used, so a `fullPath` from a listing is
+* a key you can pass straight back to any of them.
+*/
+function listingPrefix(rawPrefix) {
+	const key = rawPrefix.replace(/^\/+/, "").replace(/\/+$/, "");
+	return key === "" ? void 0 : `${key}/`;
+}
+/** @see listingPrefix */
+function folderKey(rawPrefix) {
+	return rawPrefix.replace(/^\/+/, "").replace(/\/+$/, "");
+}
+//#endregion
+export { canonicalStorageKey as a, tryCanonicalStorageKey as c, canonicalStorageId as i, InvalidStorageKeyError as n, folderKey as o, canonicalStorageBucket as r, listingPrefix as s, InvalidStorageBucketError as t };
+
+//# sourceMappingURL=keys-g8lbVC_o.js.map

package/dist/keys-g8lbVC_o.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys-g8lbVC_o.js","names":[],"sources":["../src/storage/keys.ts"],"sourcesContent":["/**\n * Canonical storage keys and bucket names.\n *\n * Storage is not under RLS, so a `storageAuthorize` hook is the whole access\n * control model — and a hook can only be correct if the key it is shown is the\n * key that is written. That is the invariant this module exists to hold: one\n * canonical string, computed once per request, handed to the hook, to the\n * controller, and to the download token alike.\n *\n * ## Why rejecting beats stripping\n *\n * The previous `sanitizeStorageKey` *stripped* `../` in a single pass. Two\n * things were wrong with that, and only one of them was the obvious one.\n *\n * The obvious one: a single pass is not a fixed point. `....//` contains `../`\n * at offset 2, so removing it leaves `../` behind — the sanitizer manufactured\n * the traversal it was there to remove. `users/alice/....//bob/x` came out as\n * `users/alice/../bob/x`, which a prefix hook reads as alice's (it starts with\n * `users/alice/`) and the filesystem reads as bob's. The hook approved one\n * object and the controller wrote another.\n *\n * The subtler one, and the reason this is a rewrite rather than a loop: even a\n * correct strip is a silent rewrite. A caller who asks to store at `a/../b` and\n * gets an object at `a/b` was not protected, they were misled — and every later\n * read, ownership row and audit line now refers to a path nobody chose. So a key\n * that means something other than what it says is refused (400), not repaired.\n *\n * Note what is NOT traversal under this rule: `....` is an ordinary directory\n * name, and `users/alice/....//bob/x` canonicalizes to\n * `users/alice/..../bob/x` — still comfortably inside alice's prefix, which is\n * exactly right. Only a real `..` segment is refused.\n */\n\nimport { DEFAULT_STORAGE_SOURCE_KEY } from \"@rebasepro/types\";\n\n/**\n * `path.posix.normalize`, without `node:path`.\n *\n * A storage key is a POSIX-shaped string that never touches a filesystem, so\n * reaching for `node:path` to fold `.` and `//` out of it was always a little\n * wrong on its own terms — on Windows the platform `path` would have applied\n * different rules to the same key. It also put the module that every storage\n * read, ownership row and audit line goes through on the list of things that\n * only run in a Node process.\n *\n * This is the algorithm Node implements, transcribed: segments are folded left\n * to right, `..` pops unless it would climb past the root of a relative path,\n * and both the leading and the trailing separator survive the round trip. The\n * `..` branch is unreachable from {@link canonicalStorageKey}, which refuses\n * those keys outright before it gets here — it exists so that this function is\n * *the* normalizer rather than a subset of one, and\n * `storage-keys.property.test.ts` holds it to that with a property test against\n * `path.posix.normalize` itself. Exported for exactly that — nothing outside\n * this module should be normalizing a key.\n */\nexport function normalizePosix(input: string): string {\n    if (input.length === 0) return \".\";\n    const isAbsolute = input.startsWith(\"/\");\n    const trailingSeparator = input.endsWith(\"/\");\n\n    const segments: string[] = [];\n    for (const segment of input.split(\"/\")) {\n        if (segment === \"\" || segment === \".\") continue;\n        if (segment === \"..\") {\n            if (segments.length > 0 && segments[segments.length - 1] !== \"..\") segments.pop();\n            else if (!isAbsolute) segments.push(\"..\");\n            continue;\n        }\n        segments.push(segment);\n    }\n\n    const joined = segments.join(\"/\");\n    if (joined === \"\") {\n        if (isAbsolute) return \"/\";\n        return trailingSeparator ? \"./\" : \".\";\n    }\n    const withTrailing = trailingSeparator ? `${joined}/` : joined;\n    return isAbsolute ? `/${withTrailing}` : withTrailing;\n}\n\n/** Longest key accepted, in UTF-16 code units. Matches the previous cap. */\nexport const MAX_STORAGE_KEY_LENGTH = 1024;\n\n/**\n * A key that cannot be canonicalized. Carries no path back to the caller\n * beyond what they sent, so it is safe to surface as a 400 message.\n */\nexport class InvalidStorageKeyError extends Error {\n    constructor(message: string) {\n        super(message);\n        this.name = \"InvalidStorageKeyError\";\n    }\n}\n\n/**\n * Canonicalize a caller-supplied storage key, or throw\n * {@link InvalidStorageKeyError}.\n *\n * Normalizations applied (safe, idempotent, and meaning-preserving):\n * - leading slashes removed — `/a/b` and `a/b` name the same object\n * - `.` segments and repeated slashes collapsed\n *\n * Refusals (the key means something other than what it says):\n * - any `..` segment, on either separator, at any depth\n * - null bytes\n * - keys longer than {@link MAX_STORAGE_KEY_LENGTH}\n *\n * A trailing slash is preserved: it is how the folder route marks a prefix.\n */\nexport function canonicalStorageKey(rawKey: string): string {\n    if (rawKey.includes(\"\\0\")) {\n        throw new InvalidStorageKeyError(\"Storage key contains a null byte.\");\n    }\n    if (rawKey.length > MAX_STORAGE_KEY_LENGTH) {\n        throw new InvalidStorageKeyError(\n            `Storage key exceeds the maximum length of ${MAX_STORAGE_KEY_LENGTH} characters.`\n        );\n    }\n\n    // Split on both separators: `path.join` treats `\\` as a separator on\n    // Windows, so `..\\` is traversal there even though POSIX reads it as a\n    // filename. Checked against the RAW key, before any normalization — the\n    // whole point is that `a/../b` is refused rather than quietly turned into\n    // `b`.\n    if (rawKey.split(/[\\\\/]/).some((segment) => segment === \"..\")) {\n        throw new InvalidStorageKeyError(\n            \"Storage key contains a '..' path segment. Keys must name an object directly.\"\n        );\n    }\n\n    const withoutLeadingSlashes = rawKey.replace(/^\\/+/, \"\");\n    if (withoutLeadingSlashes === \"\") return \"\";\n\n    // Whether the key names a *directory* rather than an object: it ends with a\n    // separator, or its last segment is the `.` that means \"this directory\".\n    //\n    // Recorded before normalizing, because normalization drops the\n    // distinction in one of those two spellings and not the other: `public/.`\n    // becomes `public` while `public/./` stays `public/`. That asymmetry breaks\n    // the rule this module states — a trailing slash is preserved, because it is\n    // how the folder route marks a prefix — and it is not cosmetic on `list`,\n    // where a prefix of `public` also matches `publicity/` and hands back keys\n    // the caller never asked for.\n    const denotesDirectory = /(?:^|\\/)\\.?$/.test(withoutLeadingSlashes);\n\n    // Safe now: with no `..` segment in the input, `normalize` can only collapse\n    // `.` and duplicate slashes — it cannot climb.\n    const normalized = normalizePosix(withoutLeadingSlashes);\n\n    // `normalize(\".\")`, and `normalize(\"./\")` → `./`; neither names an object.\n    if (normalized === \".\" || normalized === \"./\") return \"\";\n\n    // Defensive: nothing reaching here still carries a leading `./`, since the\n    // leading slashes are already gone and `normalize` only emits `./` for a\n    // key that normalizes to nothing — which returned above.\n    const key = normalized.replace(/^\\.\\//, \"\").replace(/^\\/+/, \"\");\n    if (key === \"\") return \"\";\n    return denotesDirectory && !key.endsWith(\"/\") ? `${key}/` : key;\n}\n\n/**\n * Canonicalize, or return `null` when the key is not canonicalizable.\n *\n * For callers that must fail closed without an exception — the download-token\n * middleware compares a request path against a granted path, and a key it\n * cannot canonicalize simply matches nothing.\n */\nexport function tryCanonicalStorageKey(rawKey: string): string | null {\n    try {\n        return canonicalStorageKey(rawKey);\n    } catch {\n        return null;\n    }\n}\n\n/**\n * Canonicalize the storage *source* a request names (`?storageId=`), so that\n * \"the default source\" has exactly one spelling.\n *\n * The default source can be asked for three ways — the parameter omitted, sent\n * empty, or sent as the literal `(default)` — and all three resolve to the same\n * controller. Without a single spelling, the value derived when a download\n * token is minted and the value derived when it is presented can differ for the\n * same object, which is either a spurious 403 or, if the comparison is dropped\n * to stop those, no scoping at all.\n *\n * Deliberately *not* validated against the registry: this is a naming rule, not\n * an existence check, and it must give the same answer in `auth/` (which has no\n * registry) as in the storage routes. An id that names no source still\n * canonicalizes to itself and simply matches only itself.\n */\nexport function canonicalStorageId(rawStorageId: string | undefined | null): string {\n    if (rawStorageId === undefined || rawStorageId === null) return DEFAULT_STORAGE_SOURCE_KEY;\n    const trimmed = rawStorageId.trim();\n    return trimmed === \"\" ? DEFAULT_STORAGE_SOURCE_KEY : trimmed;\n}\n\n/**\n * Longest bucket name accepted. 63 is the S3/GCS limit, and a local bucket is\n * one directory name, so the tighter of the two bounds everything.\n */\nexport const MAX_STORAGE_BUCKET_LENGTH = 63;\n\n/** A bucket name that does not name a bucket. See {@link canonicalStorageBucket}. */\nexport class InvalidStorageBucketError extends Error {\n    constructor(message: string) {\n        super(message);\n        this.name = \"InvalidStorageBucketError\";\n    }\n}\n\n/**\n * One path segment: letters, digits, `.`, `_`, `-`, first character\n * alphanumeric. Deliberately narrow — it is the intersection of what S3, GCS\n * and a filesystem directory all accept, and it makes `..`, `.tus-uploads`,\n * absolute paths and anything containing a separator unrepresentable.\n */\nconst STORAGE_BUCKET_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;\n\n/**\n * Canonicalize a caller-supplied bucket name, or throw\n * {@link InvalidStorageBucketError}.\n *\n * The bucket is the *other* caller-controlled routing value in an upload\n * request, and it was the one nobody validated. `LocalStorageController`\n * builds `join(basePath, bucket)` and then checks containment against that\n * result, so a bucket of `../../etc` moved the boundary rather than crossing\n * it — the guard passed because the guard's reference point was the attacker's.\n * The containment check now resolves against the storage root, and this is the\n * check at the route boundary that stops the value before it gets there.\n *\n * A bucket is configuration, not user data: there is no legitimate caller that\n * needs a separator, a leading dot, or a `..` in one. So this refuses rather\n * than repairs, exactly as {@link canonicalStorageKey} does — a rewritten\n * bucket would silently store the object somewhere the caller did not ask for.\n *\n * Returns `undefined` when the caller named no bucket (absent, or an empty\n * form field), which is how every controller spells \"use my default\". An empty\n * string used to reach `getFullPath` and resolve to the storage *root* rather\n * than the `default` bucket, which is a third place a bare key did not\n * round-trip.\n */\nexport function canonicalStorageBucket(rawBucket: string | undefined | null): string | undefined {\n    if (rawBucket === undefined || rawBucket === null || rawBucket === \"\") return undefined;\n    if (rawBucket.length > MAX_STORAGE_BUCKET_LENGTH) {\n        throw new InvalidStorageBucketError(\n            `Storage bucket exceeds the maximum length of ${MAX_STORAGE_BUCKET_LENGTH} characters.`\n        );\n    }\n    if (!STORAGE_BUCKET_PATTERN.test(rawBucket)) {\n        throw new InvalidStorageBucketError(\n            \"Storage bucket must be a single name of letters, digits, '.', '_' or '-', \" +\n            \"starting with a letter or digit.\"\n        );\n    }\n    return rawBucket;\n}\n\n/**\n * The prefix an object store's listing should be given for a caller's key, and\n * the key a listing should hand back for a folder.\n *\n * The three controllers answer the same question in two different ways, and\n * they used to disagree about the answer. `LocalStorageController` resolves a\n * *directory* on disk, so `listObjects(\"products/images\")` and\n * `listObjects(\"products/images/\")` both list what is inside it. An object\n * store under `Delimiter: \"/\"` does not: `Prefix: \"products/images\"` matches\n * `products/images.txt` and `productsomething/`, and returns none of the files\n * inside `products/images/`. So the same call — the SDK's own documented one —\n * answered one thing against local dev and another against the S3 bucket in\n * production, which is the worst place for a divergence to live.\n *\n * `listingPrefix` is what to *send*: a trailing slash, always, because that is\n * the only spelling that means \"inside this folder\" to a delimiter listing.\n * `folderKey` is what to *return* for a common prefix: no trailing slash, the\n * form the local controller has always used, so a `fullPath` from a listing is\n * a key you can pass straight back to any of them.\n */\nexport function listingPrefix(rawPrefix: string): string | undefined {\n    const key = rawPrefix.replace(/^\\/+/, \"\").replace(/\\/+$/, \"\");\n    return key === \"\" ? undefined : `${key}/`;\n}\n\n/** @see listingPrefix */\nexport function folderKey(rawPrefix: string): string {\n    return rawPrefix.replace(/^\\/+/, \"\").replace(/\\/+$/, \"\");\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuDA,SAAgB,eAAe,OAAuB;CAClD,IAAI,MAAM,WAAW,GAAG,OAAO;CAC/B,MAAM,aAAa,MAAM,WAAW,GAAG;CACvC,MAAM,oBAAoB,MAAM,SAAS,GAAG;CAE5C,MAAM,WAAqB,CAAC;CAC5B,KAAK,MAAM,WAAW,MAAM,MAAM,GAAG,GAAG;EACpC,IAAI,YAAY,MAAM,YAAY,KAAK;EACvC,IAAI,YAAY,MAAM;GAClB,IAAI,SAAS,SAAS,KAAK,SAAS,SAAS,SAAS,OAAO,MAAM,SAAS,IAAI;QAC3E,IAAI,CAAC,YAAY,SAAS,KAAK,IAAI;GACxC;EACJ;EACA,SAAS,KAAK,OAAO;CACzB;CAEA,MAAM,SAAS,SAAS,KAAK,GAAG;CAChC,IAAI,WAAW,IAAI;EACf,IAAI,YAAY,OAAO;EACvB,OAAO,oBAAoB,OAAO;CACtC;CACA,MAAM,eAAe,oBAAoB,GAAG,OAAO,KAAK;CACxD,OAAO,aAAa,IAAI,iBAAiB;AAC7C;;AAGA,IAAa,yBAAyB;;;;;AAMtC,IAAa,yBAAb,cAA4C,MAAM;CAC9C,YAAY,SAAiB;EACzB,MAAM,OAAO;EACb,KAAK,OAAO;CAChB;AACJ;;;;;;;;;;;;;;;;AAiBA,SAAgB,oBAAoB,QAAwB;CACxD,IAAI,OAAO,SAAS,IAAI,GACpB,MAAM,IAAI,uBAAuB,mCAAmC;CAExE,IAAI,OAAO,SAAA,MACP,MAAM,IAAI,uBACN,6CAA6C,uBAAuB,aACxE;CAQJ,IAAI,OAAO,MAAM,OAAO,CAAC,CAAC,MAAM,YAAY,YAAY,IAAI,GACxD,MAAM,IAAI,uBACN,8EACJ;CAGJ,MAAM,wBAAwB,OAAO,QAAQ,QAAQ,EAAE;CACvD,IAAI,0BAA0B,IAAI,OAAO;CAYzC,MAAM,mBAAmB,eAAe,KAAK,qBAAqB;CAIlE,MAAM,aAAa,eAAe,qBAAqB;CAGvD,IAAI,eAAe,OAAO,eAAe,MAAM,OAAO;CAKtD,MAAM,MAAM,WAAW,QAAQ,SAAS,EAAE,CAAC,CAAC,QAAQ,QAAQ,EAAE;CAC9D,IAAI,QAAQ,IAAI,OAAO;CACvB,OAAO,oBAAoB,CAAC,IAAI,SAAS,GAAG,IAAI,GAAG,IAAI,KAAK;AAChE;;;;;;;;AASA,SAAgB,uBAAuB,QAA+B;CAClE,IAAI;EACA,OAAO,oBAAoB,MAAM;CACrC,QAAQ;EACJ,OAAO;CACX;AACJ;;;;;;;;;;;;;;;;;AAkBA,SAAgB,mBAAmB,cAAiD;CAChF,IAAI,iBAAiB,KAAA,KAAa,iBAAiB,MAAM,OAAO;CAChE,MAAM,UAAU,aAAa,KAAK;CAClC,OAAO,YAAY,KAAK,6BAA6B;AACzD;;AASA,IAAa,4BAAb,cAA+C,MAAM;CACjD,YAAY,SAAiB;EACzB,MAAM,OAAO;EACb,KAAK,OAAO;CAChB;AACJ;;;;;;;AAQA,IAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;AAyB/B,SAAgB,uBAAuB,WAA0D;CAC7F,IAAI,cAAc,KAAA,KAAa,cAAc,QAAQ,cAAc,IAAI,OAAO,KAAA;CAC9E,IAAI,UAAU,SAAA,IACV,MAAM,IAAI,0BACN,6DACJ;CAEJ,IAAI,CAAC,uBAAuB,KAAK,SAAS,GACtC,MAAM,IAAI,0BACN,4GAEJ;CAEJ,OAAO;AACX;;;;;;;;;;;;;;;;;;;;;AAsBA,SAAgB,cAAc,WAAuC;CACjE,MAAM,MAAM,UAAU,QAAQ,QAAQ,EAAE,CAAC,CAAC,QAAQ,QAAQ,EAAE;CAC5D,OAAO,QAAQ,KAAK,KAAA,IAAY,GAAG,IAAI;AAC3C;;AAGA,SAAgB,UAAU,WAA2B;CACjD,OAAO,UAAU,QAAQ,QAAQ,EAAE,CAAC,CAAC,QAAQ,QAAQ,EAAE;AAC3D"}

package/dist/{logger-DS03e908.js → logger-DO2PZc4i.js}

@@ -112,13 +112,48 @@ var LOG_PRIORITY = {
 function isProduction() {
 	return hostEnv().NODE_ENV === "production";
 }
+/**
+* An explicit level from `config.logging.level`, when a project set one.
+*
+* Outranks `LOG_LEVEL` because it is the more specific statement: an
+* environment variable is the deployment's default, and this is the
+* application saying what it wants regardless of where it runs.
+*
+* There used to be a second, separate mechanism for this — `utils/logging.ts`
+* reassigned `console.debug`/`console.log`/`console.warn` to no-ops — and the
+* two disagreed in a way nobody could have guessed from either: `LOG_LEVEL=warn`
+* silenced this logger's info lines *and* every `console.log` in the process,
+* including a dependency's, including a project's own debugging. It also could
+* not be undone, because the originals were gone.
+*/
+var configuredLevel;
+/**
+* Set the level from configuration. `undefined` returns to `LOG_LEVEL`.
+*
+* Read per line rather than captured at construction, so a logger created
+* before configuration is read still honours it — which the singleton below
+* always is.
+*/
+function setLogLevel(level) {
+	configuredLevel = level;
+}
 function getMinLevel() {
+	if (configuredLevel) return configuredLevel;
 	const env = (hostEnv().LOG_LEVEL || "info").toLowerCase();
 	if (env in LOG_PRIORITY) return env;
 	return "info";
 }
 var FAILED_QUERY_MARKER = "Failed query:";
-var REDACTED_QUERY = "Failed query: [redacted]";
+/**
+* The marker says how to lift it.
+*
+* Every DDL, RLS and CDC failure ends at this string, and the statement is the
+* whole diagnosis — three of them landed in one boot of a two-database project,
+* each a dead end. The switch existed; nothing named it, in the log or in the
+* docs, so `grep -rn REBASE_LOG_RAW_QUERIES` over the documentation, the
+* templates and the agent skills came back empty.
+*/
+var REDACTED_QUERY = "Failed query: [redacted — set REBASE_LOG_RAW_QUERIES=true in development to see it]";
 var REDACTED_VALUE = "[redacted]";
 /**
 * Key fragments whose values are never safe to publish. Compared against the
@@ -145,12 +180,21 @@ function isSensitiveKey(key) {
 	return SENSITIVE_KEY_FRAGMENTS.some((fragment) => normalised.includes(fragment));
 }
 /**
-* Local escape hatch for the `Failed query:` strip only — the statement is the
-* fastest way to diagnose a failing query on a developer machine. Ignored in
+* Whether a SQL statement may be written out at all.
+*
+* The escape hatch for the `Failed query:` strip — the statement is the fastest
+* way to diagnose a failing query on a developer machine. Ignored in
 * production, so a runtime that inherits the variable cannot leak because of
 * it, and it never re-enables the key deny-list.
+*
+* Exported because it is the *only* answer to "may this process print SQL", and
+* a driver that wants to trace what it executes has to ask the same question.
+* The Postgres driver used to decide for itself, with a `console.debug` gated
+* on `NODE_ENV` alone: every statement went to stdout whatever `LOG_LEVEL`
+* said, and it went there without passing through the redaction that lives in
+* this file.
 */
-function rawQueriesAllowed() {
+function rawQueryLoggingEnabled() {
 	return hostEnv().NODE_ENV !== "production" && hostEnv().REBASE_LOG_RAW_QUERIES === "true";
 }
 /**
@@ -167,12 +211,12 @@ function rawQueriesAllowed() {
 * before persisting and then logs the result.
 */
 function redactSensitiveText(text) {
-	if (!text.includes(FAILED_QUERY_MARKER) || rawQueriesAllowed()) return text;
+	if (!text.includes(FAILED_QUERY_MARKER) || rawQueryLoggingEnabled()) return text;
 	let out = text;
 	let idx = out.indexOf(FAILED_QUERY_MARKER);
 	while (idx !== -1) {
 		if (out.startsWith(REDACTED_QUERY, idx)) {
-			idx = out.indexOf(FAILED_QUERY_MARKER, idx + 24);
+			idx = out.indexOf(FAILED_QUERY_MARKER, idx + 83);
 			continue;
 		}
 		const paramsIdx = out.indexOf("\nparams:", idx);
@@ -183,24 +227,76 @@ function redactSensitiveText(text) {
 			end = eol === -1 ? out.length : eol;
 		}
 		out = out.slice(0, idx) + REDACTED_QUERY + out.slice(end);
-		idx = out.indexOf(FAILED_QUERY_MARKER, idx + 24);
+		idx = out.indexOf(FAILED_QUERY_MARKER, idx + 83);
 	}
 	return out;
 }
 /**
-* Serialise an Error into a plain object (stack + message), with the query
-* text redacted out of both. `query`/`params` own-properties — which
-* `DrizzleQueryError` carries beside the message — are deliberately not
-* copied.
+* Diagnostic own-properties worth carrying up out of an error.
+*
+* These are what a socket failure actually says: `ECONNREFUSED` with the
+* `address` and `port` it was refused on, `ENOTFOUND` with the hostname that
+* did not resolve. They live as own-properties on the Node error rather than in
+* its message, so a serialiser that copies only `message` and `stack` prints a
+* boot failure that names no host, no port and no reason.
+*
+* Deliberately a fixed list rather than "every own-property": `DrizzleQueryError`
+* carries `query` and `params` beside its message, and copying those would put
+* the statement and its bound values — an email, a bcrypt hash — straight back
+* on stdout, which is what the redaction above exists to prevent. Postgres's own
+* `detail` and `hint` are left out for the same reason: `23505` reports
+* `Key (email)=(a@b.c) already exists.`, which is a row's contents.
+*/
+var ERROR_DETAIL_KEYS = [
+	"code",
+	"errno",
+	"syscall",
+	"address",
+	"port",
+	"hostname"
+];
+/** How far the cause chain is followed before the serialiser gives up. */
+var MAX_CAUSE_DEPTH = 4;
+/** How many of an `AggregateError`'s children are serialised. */
+var MAX_AGGREGATE_ERRORS = 4;
+/**
+* Serialise an Error into a plain object, with the query text redacted out of
+* its message and stack. `query`/`params` own-properties — which
+* `DrizzleQueryError` carries beside the message — are deliberately not copied.
+*
+* The chain matters more than the top. Everything a driver rethrows is a
+* wrapper: Drizzle's is `Failed query: SELECT 1` with a stack through drizzle
+* internals, and the sentence that says what is wrong — `connect ECONNREFUSED
+* 127.0.0.1:5432`, `password authentication failed for user "app"` — sits in
+* `.cause`, or inside the `AggregateError.errors` that `net` raises when every
+* resolved address is refused. Serialising only the wrapper is why a boot
+* against a stopped database used to log a redacted query and nothing else.
+*
 * Handles non-Error values gracefully.
 */
-function serialiseError(value) {
-	if (value instanceof Error) return {
+function serialiseError(value, depth = 0) {
+	const isError = value instanceof Error;
+	if (!isError && !(!isError && depth > 0 && Boolean(value) && typeof value === "object" && !Array.isArray(value))) return { value: redactSensitiveText(String(value)) };
+	const own = value;
+	const out = isError ? {
 		name: value.name,
 		message: redactSensitiveText(value.message),
 		stack: value.stack ? redactSensitiveText(value.stack) : void 0
+	} : {
+		...typeof own.name === "string" ? { name: own.name } : {},
+		...typeof own.message === "string" ? { message: redactSensitiveText(own.message) } : {}
 	};
-	return { value: redactSensitiveText(String(value)) };
+	for (const key of ERROR_DETAIL_KEYS) {
+		const detail = own[key];
+		if (detail === void 0 || detail === null) continue;
+		if (typeof detail === "object") continue;
+		out[key] = typeof detail === "string" ? redactSensitiveText(detail) : detail;
+	}
+	if (depth >= MAX_CAUSE_DEPTH) return out;
+	if (own.cause !== void 0 && own.cause !== null) out.cause = serialiseError(own.cause, depth + 1);
+	const aggregated = own.errors;
+	if (Array.isArray(aggregated) && aggregated.length > 0) out.errors = aggregated.slice(0, MAX_AGGREGATE_ERRORS).map((item) => serialiseError(item, depth + 1));
+	return out;
 }
 /**
 * Redact one logged value: errors are serialised, strings are stripped of
@@ -230,16 +326,49 @@ function formatData(data) {
 	for (const [key, val] of Object.entries(data)) out[key] = isSensitiveKey(key) ? REDACTED_VALUE : redactValue(val, 0, seen);
 	return out;
 }
+var sinks = /* @__PURE__ */ new Set();
+/**
+* Tee this logger somewhere else. Returns the unsubscribe.
+*
+* The Studio's Logs Explorer is the caller: its ring buffer used to be fed only
+* by a request middleware, so the panel showed a wall of `GET … 200` and not one
+* of the errors, warnings or diagnoses the server was writing to stdout at the
+* same moment. A log viewer that cannot show you an error is a log viewer
+* nobody opens twice.
+*
+* A sink MUST NOT log. It is called from inside `emit`, so anything that comes
+* back through `logger` recurses; the guard below stops the stack blowing, but
+* the line is dropped rather than delivered, which is its own bug.
+*/
+function addLogSink(sink) {
+	sinks.add(sink);
+	return () => {
+		sinks.delete(sink);
+	};
+}
+/** Re-entrancy guard: see `addLogSink`. */
+var inSink = false;
+function fanOut(level, message, data) {
+	if (sinks.size === 0 || inSink) return;
+	inSink = true;
+	try {
+		for (const sink of sinks) try {
+			sink(level, message, data);
+		} catch {}
+	} finally {
+		inSink = false;
+	}
+}
 function createLogger(rawDefaultFields = {}) {
-	const minLevel = getMinLevel();
 	const defaultFields = formatData(rawDefaultFields) ?? {};
 	function emit(level, message, data) {
-		if (LOG_PRIORITY[level] < LOG_PRIORITY[minLevel]) return;
+		if (LOG_PRIORITY[level] < LOG_PRIORITY[getMinLevel()]) return;
 		const safeMessage = redactSensitiveText(message);
 		const merged = {
 			...defaultFields,
 			...formatData(data)
 		};
+		fanOut(level, safeMessage, merged);
 		if (isProduction()) {
 			const entry = {
 				severity: GCP_SEVERITY[level],
@@ -278,7 +407,57 @@ function createLogger(rawDefaultFields = {}) {
 * In development: emits human-readable prefixed lines.
 */
 var logger = createLogger();
+/**
+* The cause chain, one readable line per link.
+*
+* `serialiseError` puts the chain in the structured payload, which is the right
+* place for a log aggregator and the wrong place for a person staring at a
+* container that will not start: the sentence they need is inside a JSON blob
+* behind an escaped stack trace. This renders the same chain as lines to print
+* beside the headline, so the first thing on screen after "Failed to start" is
+* `caused by: connect ECONNREFUSED 127.0.0.1:5432 (ECONNREFUSED)`.
+*
+* Redacted like everything else, and bounded by the same depth: a chain is
+* usually two links and never usefully more than four.
+*/
+function describeCauseChain(error) {
+	const lines = [];
+	const seen = /* @__PURE__ */ new Set();
+	const walk = (value, depth) => {
+		if (depth > MAX_CAUSE_DEPTH || value === void 0 || value === null) return;
+		if (typeof value === "object") {
+			if (seen.has(value)) return;
+			seen.add(value);
+		}
+		if (depth > 0) {
+			const described = describeOneCause(value);
+			if (described) lines.push(`caused by: ${described}`);
+		}
+		if (typeof value !== "object") return;
+		const own = value;
+		walk(own.cause, depth + 1);
+		const aggregated = own.errors;
+		if (Array.isArray(aggregated)) for (const item of aggregated.slice(0, MAX_AGGREGATE_ERRORS)) walk(item, depth + 1);
+	};
+	walk(error, 0);
+	return lines;
+}
+/** One cause rendered as `message (CODE) address:port`, or nothing to say. */
+function describeOneCause(value) {
+	if (value === null || typeof value !== "object") return redactSensitiveText(String(value)) || void 0;
+	const own = value;
+	const message = typeof own.message === "string" && own.message ? redactSensitiveText(own.message) : void 0;
+	const code = typeof own.code === "string" ? own.code : void 0;
+	const endpoint = own.address !== void 0 && own.port !== void 0 ? `${String(own.address)}:${String(own.port)}` : void 0;
+	const where = endpoint && !(message ?? "").includes(endpoint) ? endpoint : void 0;
+	const parts = [
+		message ?? code,
+		code && message ? `(${code})` : void 0,
+		where
+	].filter(Boolean);
+	return parts.length > 0 ? parts.join(" ") : void 0;
+}
 //#endregion
-export { redactSensitiveText as n, hostEnv as r, logger as t };
+export { redactSensitiveText as a, rawQueryLoggingEnabled as i, describeCauseChain as n, setLogLevel as o, logger as r, hostEnv as s, addLogSink as t };
 
-//# sourceMappingURL=logger-DS03e908.js.map
+//# sourceMappingURL=logger-DO2PZc4i.js.map

package/dist/logger-DO2PZc4i.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger-DO2PZc4i.js","names":[],"sources":["../src/utils/host.ts","../src/utils/logger.ts"],"sourcesContent":["/**\n * The host globals this package reads, behind functions that do not assume Node.\n *\n * `process` is not defined on workerd, on Deno Deploy without the compat flag,\n * or in a browser. That matters here for one specific reason: the portable\n * authoring surface (`@rebasepro/server/functions`) reaches the logger and the\n * error handler, and a bare `process.env.NODE_ENV` inside either of them turns\n * the first log line of a request into a `ReferenceError` on a runtime that has\n * no `process` — a failure that reads as \"the framework crashed\" rather than\n * \"this runtime has no process object\".\n *\n * Nothing here throws and nothing here is async. A runtime that cannot answer\n * gets the empty answer, because every caller in this file's blast radius is\n * choosing a log level or a format, and the safe default for both is the\n * development one.\n *\n * @module\n */\n\n/**\n * Where an adapter with no `process` can publish the environment.\n *\n * Cloudflare Workers hand the environment to the *request*, not to the module,\n * so there is no global to read at import time. An edge adapter that has\n * already seen a request can stash the bag here and every contextless reader in\n * the framework — the logger, chiefly — starts answering correctly.\n *\n * `Symbol.for` rather than a module-local for the same reason the singleton\n * uses it: more than one copy of this module can be loaded into one process,\n * and a module-local would leave every copy but the writer's blind. See\n * `../singleton.ts`.\n *\n * Request-scoped code should NOT read this. Use `getEnv(c)` from\n * `@rebasepro/server/functions`, which reads the binding attached to the\n * request it is serving — the only correct source on a runtime where two\n * concurrent requests can carry different bindings.\n */\nconst ENV_SLOT = Symbol.for(\"@rebasepro/server:host-env\");\n\ntype GlobalWithEnv = typeof globalThis & {\n    [ENV_SLOT]?: Record<string, string | undefined>;\n    process?: { env?: Record<string, string | undefined> };\n};\n\n/**\n * The process environment, or the closest thing this runtime has to one.\n *\n * Order: a bag published by {@link setHostEnv} first, because an adapter that\n * set one knows more than the ambient globals do; then `process.env`; then\n * nothing.\n */\nexport function hostEnv(): Record<string, string | undefined> {\n    const global = globalThis as GlobalWithEnv;\n    return global[ENV_SLOT] ?? global.process?.env ?? {};\n}\n\n/**\n * Read one environment variable without touching `process` directly.\n *\n * Trimmed, and blank is treated as absent — a variable declared with no value\n * is the ordinary way to write a compose file or a `.env` line, and every\n * caller in this package means \"unset\" by it. See `resolveFunctionsTimeoutMs`,\n * which learned that the hard way.\n */\nexport function hostEnvVar(name: string): string | undefined {\n    const raw = hostEnv()[name];\n    if (typeof raw !== \"string\") return undefined;\n    const trimmed = raw.trim();\n    return trimmed === \"\" ? undefined : trimmed;\n}\n\n/**\n * Publish an environment bag for contextless readers.\n *\n * Called by an adapter for a runtime whose environment is not ambient. Merges\n * rather than replaces, so two adapters (or an adapter plus a test) do not\n * silently erase each other's variables.\n */\nexport function setHostEnv(env: Record<string, string | undefined>): void {\n    const global = globalThis as GlobalWithEnv;\n    global[ENV_SLOT] = {\n        ...(global[ENV_SLOT] ?? {}),\n        ...env\n    };\n}\n\n/** @internal Test seam — drops anything {@link setHostEnv} published. */\nexport function _clearHostEnv(): void {\n    delete (globalThis as GlobalWithEnv)[ENV_SLOT];\n}\n\ntype GlobalWithStdio = typeof globalThis & {\n    process?: {\n        stdout?: { write?: (chunk: string) => unknown };\n        stderr?: { write?: (chunk: string) => unknown };\n    };\n};\n\n/**\n * Write one already-formatted line to the process's output.\n *\n * `process.stdout.write` is preferred where it exists because it is the only\n * one of the two that does not append its own formatting to a line that is\n * already a complete JSON document — `console.log` on Node is\n * `process.stdout.write` plus `util.format`, and `util.format` will happily\n * reinterpret a `%s` that appeared inside a user's log message.\n *\n * Where it does not exist, `console` is the runtime's log sink and is what its\n * platform collects.\n */\nexport function writeLine(stream: \"out\" | \"err\", line: string): void {\n    const proc = (globalThis as GlobalWithStdio).process;\n    const sink = stream === \"err\" ? proc?.stderr : proc?.stdout;\n    if (typeof sink?.write === \"function\") {\n        sink.write(line + \"\\n\");\n        return;\n    }\n    if (stream === \"err\") console.error(line);\n    else console.log(line);\n}\n","/**\n * Structured Logger for Rebase Backend\n *\n * Outputs JSON lines when `NODE_ENV=production`, human-readable prefixed\n * lines otherwise.  Designed to work with Google Cloud Logging severity levels.\n *\n * Every line — message and data, at any depth — passes through the redaction\n * below, which strips Drizzle's `Failed query: … / params: …` wrapper and the\n * values of secret-looking keys. See the block above `serialiseError`.\n *\n * Usage:\n *   import { logger } from \"./utils/logger\";\n *   logger.info(\"Server started\", { port: 3001 });\n *   logger.error(\"Request failed\", { path: \"/api/test\", error: err });\n *\n * Every host global goes through `./host`, and that is load-bearing rather than\n * tidy: this module is reachable from `@rebasepro/server/functions`, the\n * authoring surface that has to import cleanly on a runtime with no `process`.\n * A bare `process.env.NODE_ENV` here would make the first log line of the first\n * request on workerd a `ReferenceError`.\n */\nimport { hostEnv, writeLine } from \"./host\";\n\nexport type LogLevel = \"debug\" | \"info\" | \"warn\" | \"error\";\n\n/** Google Cloud Logging severity strings. */\nconst GCP_SEVERITY: Record<LogLevel, string> = {\n    debug: \"DEBUG\",\n    info: \"INFO\",\n    warn: \"WARNING\",\n    error: \"ERROR\"\n};\n\nconst LOG_PRIORITY: Record<LogLevel, number> = {\n    debug: 0,\n    info: 1,\n    warn: 2,\n    error: 3\n};\n\nexport interface LogEntry {\n    severity: string;\n    message: string;\n    timestamp: string;\n    [key: string]: unknown;\n}\n\nexport interface Logger {\n    debug(message: string, data?: Record<string, unknown>): void;\n    info(message: string, data?: Record<string, unknown>): void;\n    warn(message: string, data?: Record<string, unknown>): void;\n    error(message: string, data?: Record<string, unknown>): void;\n    child(defaultFields: Record<string, unknown>): Logger;\n}\n\nfunction isProduction(): boolean {\n    return hostEnv().NODE_ENV === \"production\";\n}\n\n/**\n * An explicit level from `config.logging.level`, when a project set one.\n *\n * Outranks `LOG_LEVEL` because it is the more specific statement: an\n * environment variable is the deployment's default, and this is the\n * application saying what it wants regardless of where it runs.\n *\n * There used to be a second, separate mechanism for this — `utils/logging.ts`\n * reassigned `console.debug`/`console.log`/`console.warn` to no-ops — and the\n * two disagreed in a way nobody could have guessed from either: `LOG_LEVEL=warn`\n * silenced this logger's info lines *and* every `console.log` in the process,\n * including a dependency's, including a project's own debugging. It also could\n * not be undone, because the originals were gone.\n */\nlet configuredLevel: LogLevel | undefined;\n\n/**\n * Set the level from configuration. `undefined` returns to `LOG_LEVEL`.\n *\n * Read per line rather than captured at construction, so a logger created\n * before configuration is read still honours it — which the singleton below\n * always is.\n */\nexport function setLogLevel(level?: LogLevel): void {\n    configuredLevel = level;\n}\n\nfunction getMinLevel(): LogLevel {\n    if (configuredLevel) return configuredLevel;\n    const env = (hostEnv().LOG_LEVEL || \"info\").toLowerCase();\n    if (env in LOG_PRIORITY) return env as LogLevel;\n    return \"info\";\n}\n\n// ── Redaction ───────────────────────────────────────────────────────\n//\n// Drizzle builds every query failure as\n// `Failed query: ${query}\\nparams: ${params}` (drizzle-orm/errors.js), so the\n// statement *and* every bound value ride along in `.message` and `.stack` of\n// whatever a driver rethrows — an email and a bcrypt hash reach stdout the\n// moment a registration hits a unique violation. The redaction lives here, in\n// the one function every log line passes through, rather than at the ~124\n// `{ error: … }` call sites: a per-site rule is what produced the leak (one\n// file suppressed the stack, four others did not), and the next caller would\n// reintroduce it. Nothing above this line needs to know about it.\n\nconst FAILED_QUERY_MARKER = \"Failed query:\";\n/**\n * The marker says how to lift it.\n *\n * Every DDL, RLS and CDC failure ends at this string, and the statement is the\n * whole diagnosis — three of them landed in one boot of a two-database project,\n * each a dead end. The switch existed; nothing named it, in the log or in the\n * docs, so `grep -rn REBASE_LOG_RAW_QUERIES` over the documentation, the\n * templates and the agent skills came back empty.\n */\nconst REDACTED_QUERY =\n    \"Failed query: [redacted — set REBASE_LOG_RAW_QUERIES=true in development to see it]\";\nconst REDACTED_VALUE = \"[redacted]\";\n\n/**\n * Key fragments whose values are never safe to publish. Compared against the\n * key with separators and case removed, so `api_key`, `apiKey` and `API-KEY`\n * all match `apikey`.\n */\nconst SENSITIVE_KEY_FRAGMENTS = [\n    \"password\",\n    \"passwd\",\n    \"passphrase\",\n    \"secret\",\n    \"token\",\n    \"apikey\",\n    \"authorization\",\n    \"credential\",\n    \"cookie\",\n    \"privatekey\",\n    \"sessionid\"\n];\n\n/** Longest structure the redactor will walk before giving up. */\nconst MAX_REDACT_DEPTH = 8;\n\nfunction isSensitiveKey(key: string): boolean {\n    const normalised = key.toLowerCase().replace(/[^a-z0-9]/g, \"\");\n    return SENSITIVE_KEY_FRAGMENTS.some(fragment => normalised.includes(fragment));\n}\n\n/**\n * Whether a SQL statement may be written out at all.\n *\n * The escape hatch for the `Failed query:` strip — the statement is the fastest\n * way to diagnose a failing query on a developer machine. Ignored in\n * production, so a runtime that inherits the variable cannot leak because of\n * it, and it never re-enables the key deny-list.\n *\n * Exported because it is the *only* answer to \"may this process print SQL\", and\n * a driver that wants to trace what it executes has to ask the same question.\n * The Postgres driver used to decide for itself, with a `console.debug` gated\n * on `NODE_ENV` alone: every statement went to stdout whatever `LOG_LEVEL`\n * said, and it went there without passing through the redaction that lives in\n * this file.\n */\nexport function rawQueryLoggingEnabled(): boolean {\n    return hostEnv().NODE_ENV !== \"production\"\n        && hostEnv().REBASE_LOG_RAW_QUERIES === \"true\";\n}\n\n/**\n * Strip every `Failed query: … / params: …` span out of a message or stack,\n * keeping the surrounding text (including stack frames, which carry no user\n * data). When no `params:` line follows the marker the rest of the string is\n * dropped: a statement of unknown extent is treated as sensitive rather than\n * guessed at.\n *\n * Idempotent, and it has to be: an already-redacted span still starts with the\n * marker but has no `params:` line, so a second pass over it would fall into\n * the drop-the-rest branch and eat the stack frames behind it. Redaction runs\n * more than once on the same string in practice — the cron scheduler redacts\n * before persisting and then logs the result.\n */\nexport function redactSensitiveText(text: string): string {\n    if (!text.includes(FAILED_QUERY_MARKER) || rawQueryLoggingEnabled()) return text;\n\n    let out = text;\n    let idx = out.indexOf(FAILED_QUERY_MARKER);\n    while (idx !== -1) {\n        if (out.startsWith(REDACTED_QUERY, idx)) {\n            idx = out.indexOf(FAILED_QUERY_MARKER, idx + REDACTED_QUERY.length);\n            continue;\n        }\n        const paramsIdx = out.indexOf(\"\\nparams:\", idx);\n        let end: number;\n        if (paramsIdx === -1) {\n            end = out.length;\n        } else {\n            const eol = out.indexOf(\"\\n\", paramsIdx + 1);\n            end = eol === -1 ? out.length : eol;\n        }\n        out = out.slice(0, idx) + REDACTED_QUERY + out.slice(end);\n        idx = out.indexOf(FAILED_QUERY_MARKER, idx + REDACTED_QUERY.length);\n    }\n    return out;\n}\n\n/**\n * Diagnostic own-properties worth carrying up out of an error.\n *\n * These are what a socket failure actually says: `ECONNREFUSED` with the\n * `address` and `port` it was refused on, `ENOTFOUND` with the hostname that\n * did not resolve. They live as own-properties on the Node error rather than in\n * its message, so a serialiser that copies only `message` and `stack` prints a\n * boot failure that names no host, no port and no reason.\n *\n * Deliberately a fixed list rather than \"every own-property\": `DrizzleQueryError`\n * carries `query` and `params` beside its message, and copying those would put\n * the statement and its bound values — an email, a bcrypt hash — straight back\n * on stdout, which is what the redaction above exists to prevent. Postgres's own\n * `detail` and `hint` are left out for the same reason: `23505` reports\n * `Key (email)=(a@b.c) already exists.`, which is a row's contents.\n */\nconst ERROR_DETAIL_KEYS = [\"code\", \"errno\", \"syscall\", \"address\", \"port\", \"hostname\"] as const;\n\n/** How far the cause chain is followed before the serialiser gives up. */\nconst MAX_CAUSE_DEPTH = 4;\n\n/** How many of an `AggregateError`'s children are serialised. */\nconst MAX_AGGREGATE_ERRORS = 4;\n\n/**\n * Serialise an Error into a plain object, with the query text redacted out of\n * its message and stack. `query`/`params` own-properties — which\n * `DrizzleQueryError` carries beside the message — are deliberately not copied.\n *\n * The chain matters more than the top. Everything a driver rethrows is a\n * wrapper: Drizzle's is `Failed query: SELECT 1` with a stack through drizzle\n * internals, and the sentence that says what is wrong — `connect ECONNREFUSED\n * 127.0.0.1:5432`, `password authentication failed for user \"app\"` — sits in\n * `.cause`, or inside the `AggregateError.errors` that `net` raises when every\n * resolved address is refused. Serialising only the wrapper is why a boot\n * against a stopped database used to log a redacted query and nothing else.\n *\n * Handles non-Error values gracefully.\n */\nfunction serialiseError(value: unknown, depth = 0): Record<string, unknown> {\n    const isError = value instanceof Error;\n    // A cause is not always an Error: drivers throw plain `{ code, address,\n    // port }` bags, and stringifying one yields `[object Object]`, which is\n    // worse than nothing. Only the named fields are copied out of it — the same\n    // fixed list, for the same reason.\n    const isDetailBag = !isError && depth > 0 && Boolean(value) && typeof value === \"object\" && !Array.isArray(value);\n    if (!isError && !isDetailBag) {\n        return { value: redactSensitiveText(String(value)) };\n    }\n\n    const own = value as unknown as Record<string, unknown>;\n    const out: Record<string, unknown> = isError\n        ? {\n            name: (value as Error).name,\n            message: redactSensitiveText((value as Error).message),\n            stack: (value as Error).stack ? redactSensitiveText((value as Error).stack as string) : undefined\n        }\n        : {\n            ...(typeof own.name === \"string\" ? { name: own.name } : {}),\n            ...(typeof own.message === \"string\" ? { message: redactSensitiveText(own.message) } : {})\n        };\n\n    for (const key of ERROR_DETAIL_KEYS) {\n        const detail = own[key];\n        if (detail === undefined || detail === null) continue;\n        if (typeof detail === \"object\") continue;\n        out[key] = typeof detail === \"string\" ? redactSensitiveText(detail) : detail;\n    }\n\n    if (depth >= MAX_CAUSE_DEPTH) return out;\n\n    if (own.cause !== undefined && own.cause !== null) {\n        out.cause = serialiseError(own.cause, depth + 1);\n    }\n    const aggregated = own.errors;\n    if (Array.isArray(aggregated) && aggregated.length > 0) {\n        out.errors = aggregated\n            .slice(0, MAX_AGGREGATE_ERRORS)\n            .map(item => serialiseError(item, depth + 1));\n    }\n    return out;\n}\n\n/**\n * Redact one logged value: errors are serialised, strings are stripped of\n * query text, objects and arrays are walked. Cycles and over-deep structures\n * collapse to a marker rather than throwing — a logger that can fail is worse\n * than one that logs less. (An object referenced twice in one payload is\n * reported as `[circular]` the second time; bounding the walk matters more\n * than rendering a shared reference twice.)\n */\nfunction redactValue(value: unknown, depth: number, seen: WeakSet<object>): unknown {\n    // `serialiseError` returns only already-redacted strings, so it is the\n    // terminal step — walking its output again would redact twice.\n    if (value instanceof Error) return serialiseError(value);\n    if (typeof value === \"string\") return redactSensitiveText(value);\n    if (value === null || typeof value !== \"object\") return value;\n    if (depth >= MAX_REDACT_DEPTH) return \"[truncated]\";\n    if (seen.has(value)) return \"[circular]\";\n    seen.add(value);\n\n    if (Array.isArray(value)) {\n        return value.map(item => redactValue(item, depth + 1, seen));\n    }\n    if (value instanceof Date) return value;\n\n    const out: Record<string, unknown> = {};\n    for (const [key, val] of Object.entries(value as Record<string, unknown>)) {\n        out[key] = isSensitiveKey(key) ? REDACTED_VALUE : redactValue(val, depth + 1, seen);\n    }\n    return out;\n}\n\nfunction formatData(data?: Record<string, unknown>): Record<string, unknown> | undefined {\n    if (!data) return undefined;\n    const seen = new WeakSet<object>();\n    const out: Record<string, unknown> = {};\n    for (const [key, val] of Object.entries(data)) {\n        out[key] = isSensitiveKey(key) ? REDACTED_VALUE : redactValue(val, 0, seen);\n    }\n    return out;\n}\n\n/**\n * Something that wants a copy of every line this logger writes.\n *\n * Receives the message and fields *after* redaction, never before: a sink is\n * another destination for the same line, and the one thing that must not vary\n * by destination is whether the query and its bound values are in it.\n */\nexport type LogSink = (\n    level: LogLevel,\n    message: string,\n    data: Record<string, unknown>\n) => void;\n\nconst sinks = new Set<LogSink>();\n\n/**\n * Tee this logger somewhere else. Returns the unsubscribe.\n *\n * The Studio's Logs Explorer is the caller: its ring buffer used to be fed only\n * by a request middleware, so the panel showed a wall of `GET … 200` and not one\n * of the errors, warnings or diagnoses the server was writing to stdout at the\n * same moment. A log viewer that cannot show you an error is a log viewer\n * nobody opens twice.\n *\n * A sink MUST NOT log. It is called from inside `emit`, so anything that comes\n * back through `logger` recurses; the guard below stops the stack blowing, but\n * the line is dropped rather than delivered, which is its own bug.\n */\nexport function addLogSink(sink: LogSink): () => void {\n    sinks.add(sink);\n    return () => { sinks.delete(sink); };\n}\n\n/** Re-entrancy guard: see `addLogSink`. */\nlet inSink = false;\n\nfunction fanOut(level: LogLevel, message: string, data: Record<string, unknown>): void {\n    if (sinks.size === 0 || inSink) return;\n    inSink = true;\n    try {\n        for (const sink of sinks) {\n            // One broken sink must not take down the line, nor the request that\n            // was writing it.\n            try { sink(level, message, data); } catch { /* a broken tee is not the caller's problem */ }\n        }\n    } finally {\n        inSink = false;\n    }\n}\n\nfunction createLogger(rawDefaultFields: Record<string, unknown> = {}): Logger {\n    // Child fields go through the same pass as per-call data — they are merged\n    // into every line this logger emits, so leaving them raw would be a hole\n    // the moment `child()` gets its first caller.\n    const defaultFields = formatData(rawDefaultFields) ?? {};\n\n    function emit(level: LogLevel, message: string, data?: Record<string, unknown>): void {\n        // Per line, not captured at construction: the singleton is created when\n        // this module is first imported, which is long before a project's\n        // `config.logging.level` has been read.\n        if (LOG_PRIORITY[level] < LOG_PRIORITY[getMinLevel()]) return;\n\n        // The message is redacted too, not just the data: several call sites\n        // interpolate `error.message` straight into the line they log.\n        const safeMessage = redactSensitiveText(message);\n        const merged = { ...defaultFields,\n...formatData(data) };\n\n        // Before the write, so a sink still sees the line if stdout is the\n        // thing that is broken.\n        fanOut(level, safeMessage, merged);\n\n        if (isProduction()) {\n            // Structured JSON for Cloud Logging\n            const entry: LogEntry = {\n                severity: GCP_SEVERITY[level],\n                message: safeMessage,\n                timestamp: new Date().toISOString(),\n                ...merged\n            };\n            const line = JSON.stringify(entry);\n\n            if (level === \"error\") {\n                writeLine(\"err\", line);\n            } else {\n                writeLine(\"out\", line);\n            }\n        } else {\n            // Human-readable for development\n            const prefix = level === \"error\" ? \"❌\"\n                : level === \"warn\" ? \"⚠️\"\n                : level === \"info\" ? \"ℹ️\"\n                : \"🐛\";\n            const extra = Object.keys(merged).length > 0 ? ` ${JSON.stringify(merged)}` : \"\";\n            const out = `${prefix} [${level.toUpperCase()}] ${safeMessage}${extra}`;\n\n            if (level === \"error\") {\n                console.error(out);\n            } else if (level === \"warn\") {\n                console.warn(out);\n            } else {\n                console.log(out);\n            }\n        }\n    }\n\n    return {\n        debug: (msg, data) => emit(\"debug\", msg, data),\n        info: (msg, data) => emit(\"info\", msg, data),\n        warn: (msg, data) => emit(\"warn\", msg, data),\n        error: (msg, data) => emit(\"error\", msg, data),\n        child(fields: Record<string, unknown>): Logger {\n            return createLogger({ ...defaultFields,\n...fields });\n        }\n    };\n}\n\n/**\n * Singleton logger instance.\n * In production: emits JSON lines with `severity`, `message`, `timestamp`.\n * In development: emits human-readable prefixed lines.\n */\nexport const logger: Logger = createLogger();\n\n/**\n * The cause chain, one readable line per link.\n *\n * `serialiseError` puts the chain in the structured payload, which is the right\n * place for a log aggregator and the wrong place for a person staring at a\n * container that will not start: the sentence they need is inside a JSON blob\n * behind an escaped stack trace. This renders the same chain as lines to print\n * beside the headline, so the first thing on screen after \"Failed to start\" is\n * `caused by: connect ECONNREFUSED 127.0.0.1:5432 (ECONNREFUSED)`.\n *\n * Redacted like everything else, and bounded by the same depth: a chain is\n * usually two links and never usefully more than four.\n */\nexport function describeCauseChain(error: unknown): string[] {\n    const lines: string[] = [];\n    const seen = new Set<unknown>();\n\n    const walk = (value: unknown, depth: number): void => {\n        if (depth > MAX_CAUSE_DEPTH || value === undefined || value === null) return;\n        if (typeof value === \"object\") {\n            if (seen.has(value)) return;\n            seen.add(value);\n        }\n        if (depth > 0) {\n            const described = describeOneCause(value);\n            if (described) lines.push(`caused by: ${described}`);\n        }\n        if (typeof value !== \"object\") return;\n        const own = value as Record<string, unknown>;\n        walk(own.cause, depth + 1);\n        const aggregated = own.errors;\n        if (Array.isArray(aggregated)) {\n            for (const item of aggregated.slice(0, MAX_AGGREGATE_ERRORS)) walk(item, depth + 1);\n        }\n    };\n\n    walk(error, 0);\n    return lines;\n}\n\n/** One cause rendered as `message (CODE) address:port`, or nothing to say. */\nfunction describeOneCause(value: unknown): string | undefined {\n    if (value === null || typeof value !== \"object\") {\n        const text = redactSensitiveText(String(value));\n        return text || undefined;\n    }\n    const own = value as Record<string, unknown>;\n    const message = typeof own.message === \"string\" && own.message\n        ? redactSensitiveText(own.message)\n        : undefined;\n    const code = typeof own.code === \"string\" ? own.code : undefined;\n    // Only when the message does not already carry it. Node writes\n    // `connect ECONNREFUSED 127.0.0.1:5432` and also sets `address`/`port`, and\n    // repeating the endpoint reads like two different facts.\n    const endpoint = own.address !== undefined && own.port !== undefined\n        ? `${String(own.address)}:${String(own.port)}`\n        : undefined;\n    const where = endpoint && !(message ?? \"\").includes(endpoint) ? endpoint : undefined;\n    const parts = [message ?? code, code && message ? `(${code})` : undefined, where]\n        .filter(Boolean);\n    return parts.length > 0 ? parts.join(\" \") : undefined;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqCA,IAAM,WAAW,OAAO,IAAI,4BAA4B;;;;;;;;AAcxD,SAAgB,UAA8C;CAC1D,MAAM,SAAS;CACf,OAAO,OAAO,aAAa,OAAO,SAAS,OAAO,CAAC;AACvD;;;;;;;;;;;;;AAwDA,SAAgB,UAAU,QAAuB,MAAoB;CACjE,MAAM,OAAQ,WAA+B;CAC7C,MAAM,OAAO,WAAW,QAAQ,MAAM,SAAS,MAAM;CACrD,IAAI,OAAO,MAAM,UAAU,YAAY;EACnC,KAAK,MAAM,OAAO,IAAI;EACtB;CACJ;CACA,IAAI,WAAW,OAAO,QAAQ,MAAM,IAAI;MACnC,QAAQ,IAAI,IAAI;AACzB;;;;;;;;;;;;;;;;;;;;;;;;;AC7FA,IAAM,eAAyC;CAC3C,OAAO;CACP,MAAM;CACN,MAAM;CACN,OAAO;AACX;AAEA,IAAM,eAAyC;CAC3C,OAAO;CACP,MAAM;CACN,MAAM;CACN,OAAO;AACX;AAiBA,SAAS,eAAwB;CAC7B,OAAO,QAAQ,CAAC,CAAC,aAAa;AAClC;;;;;;;;;;;;;;;AAgBA,IAAI;;;;;;;;AASJ,SAAgB,YAAY,OAAwB;CAChD,kBAAkB;AACtB;AAEA,SAAS,cAAwB;CAC7B,IAAI,iBAAiB,OAAO;CAC5B,MAAM,OAAO,QAAQ,CAAC,CAAC,aAAa,OAAA,CAAQ,YAAY;CACxD,IAAI,OAAO,cAAc,OAAO;CAChC,OAAO;AACX;AAcA,IAAM,sBAAsB;;;;;;;;;;AAU5B,IAAM,iBACF;AACJ,IAAM,iBAAiB;;;;;;AAOvB,IAAM,0BAA0B;CAC5B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACJ;;AAGA,IAAM,mBAAmB;AAEzB,SAAS,eAAe,KAAsB;CAC1C,MAAM,aAAa,IAAI,YAAY,CAAC,CAAC,QAAQ,cAAc,EAAE;CAC7D,OAAO,wBAAwB,MAAK,aAAY,WAAW,SAAS,QAAQ,CAAC;AACjF;;;;;;;;;;;;;;;;AAiBA,SAAgB,yBAAkC;CAC9C,OAAO,QAAQ,CAAC,CAAC,aAAa,gBACvB,QAAQ,CAAC,CAAC,2BAA2B;AAChD;;;;;;;;;;;;;;AAeA,SAAgB,oBAAoB,MAAsB;CACtD,IAAI,CAAC,KAAK,SAAS,mBAAmB,KAAK,uBAAuB,GAAG,OAAO;CAE5E,IAAI,MAAM;CACV,IAAI,MAAM,IAAI,QAAQ,mBAAmB;CACzC,OAAO,QAAQ,IAAI;EACf,IAAI,IAAI,WAAW,gBAAgB,GAAG,GAAG;GACrC,MAAM,IAAI,QAAQ,qBAAqB,MAAM,EAAqB;GAClE;EACJ;EACA,MAAM,YAAY,IAAI,QAAQ,aAAa,GAAG;EAC9C,IAAI;EACJ,IAAI,cAAc,IACd,MAAM,IAAI;OACP;GACH,MAAM,MAAM,IAAI,QAAQ,MAAM,YAAY,CAAC;GAC3C,MAAM,QAAQ,KAAK,IAAI,SAAS;EACpC;EACA,MAAM,IAAI,MAAM,GAAG,GAAG,IAAI,iBAAiB,IAAI,MAAM,GAAG;EACxD,MAAM,IAAI,QAAQ,qBAAqB,MAAM,EAAqB;CACtE;CACA,OAAO;AACX;;;;;;;;;;;;;;;;;AAkBA,IAAM,oBAAoB;CAAC;CAAQ;CAAS;CAAW;CAAW;CAAQ;AAAU;;AAGpF,IAAM,kBAAkB;;AAGxB,IAAM,uBAAuB;;;;;;;;;;;;;;;;AAiB7B,SAAS,eAAe,OAAgB,QAAQ,GAA4B;CACxE,MAAM,UAAU,iBAAiB;CAMjC,IAAI,CAAC,WAAW,EADI,CAAC,WAAW,QAAQ,KAAK,QAAQ,KAAK,KAAK,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAE5G,OAAO,EAAE,OAAO,oBAAoB,OAAO,KAAK,CAAC,EAAE;CAGvD,MAAM,MAAM;CACZ,MAAM,MAA+B,UAC/B;EACE,MAAO,MAAgB;EACvB,SAAS,oBAAqB,MAAgB,OAAO;EACrD,OAAQ,MAAgB,QAAQ,oBAAqB,MAAgB,KAAe,IAAI,KAAA;CAC5F,IACE;EACE,GAAI,OAAO,IAAI,SAAS,WAAW,EAAE,MAAM,IAAI,KAAK,IAAI,CAAC;EACzD,GAAI,OAAO,IAAI,YAAY,WAAW,EAAE,SAAS,oBAAoB,IAAI,OAAO,EAAE,IAAI,CAAC;CAC3F;CAEJ,KAAK,MAAM,OAAO,mBAAmB;EACjC,MAAM,SAAS,IAAI;EACnB,IAAI,WAAW,KAAA,KAAa,WAAW,MAAM;EAC7C,IAAI,OAAO,WAAW,UAAU;EAChC,IAAI,OAAO,OAAO,WAAW,WAAW,oBAAoB,MAAM,IAAI;CAC1E;CAEA,IAAI,SAAS,iBAAiB,OAAO;CAErC,IAAI,IAAI,UAAU,KAAA,KAAa,IAAI,UAAU,MACzC,IAAI,QAAQ,eAAe,IAAI,OAAO,QAAQ,CAAC;CAEnD,MAAM,aAAa,IAAI;CACvB,IAAI,MAAM,QAAQ,UAAU,KAAK,WAAW,SAAS,GACjD,IAAI,SAAS,WACR,MAAM,GAAG,oBAAoB,CAAC,CAC9B,KAAI,SAAQ,eAAe,MAAM,QAAQ,CAAC,CAAC;CAEpD,OAAO;AACX;;;;;;;;;AAUA,SAAS,YAAY,OAAgB,OAAe,MAAgC;CAGhF,IAAI,iBAAiB,OAAO,OAAO,eAAe,KAAK;CACvD,IAAI,OAAO,UAAU,UAAU,OAAO,oBAAoB,KAAK;CAC/D,IAAI,UAAU,QAAQ,OAAO,UAAU,UAAU,OAAO;CACxD,IAAI,SAAS,kBAAkB,OAAO;CACtC,IAAI,KAAK,IAAI,KAAK,GAAG,OAAO;CAC5B,KAAK,IAAI,KAAK;CAEd,IAAI,MAAM,QAAQ,KAAK,GACnB,OAAO,MAAM,KAAI,SAAQ,YAAY,MAAM,QAAQ,GAAG,IAAI,CAAC;CAE/D,IAAI,iBAAiB,MAAM,OAAO;CAElC,MAAM,MAA+B,CAAC;CACtC,KAAK,MAAM,CAAC,KAAK,QAAQ,OAAO,QAAQ,KAAgC,GACpE,IAAI,OAAO,eAAe,GAAG,IAAI,iBAAiB,YAAY,KAAK,QAAQ,GAAG,IAAI;CAEtF,OAAO;AACX;AAEA,SAAS,WAAW,MAAqE;CACrF,IAAI,CAAC,MAAM,OAAO,KAAA;CAClB,MAAM,uBAAO,IAAI,QAAgB;CACjC,MAAM,MAA+B,CAAC;CACtC,KAAK,MAAM,CAAC,KAAK,QAAQ,OAAO,QAAQ,IAAI,GACxC,IAAI,OAAO,eAAe,GAAG,IAAI,iBAAiB,YAAY,KAAK,GAAG,IAAI;CAE9E,OAAO;AACX;AAeA,IAAM,wBAAQ,IAAI,IAAa;;;;;;;;;;;;;;AAe/B,SAAgB,WAAW,MAA2B;CAClD,MAAM,IAAI,IAAI;CACd,aAAa;EAAE,MAAM,OAAO,IAAI;CAAG;AACvC;;AAGA,IAAI,SAAS;AAEb,SAAS,OAAO,OAAiB,SAAiB,MAAqC;CACnF,IAAI,MAAM,SAAS,KAAK,QAAQ;CAChC,SAAS;CACT,IAAI;EACA,KAAK,MAAM,QAAQ,OAGf,IAAI;GAAE,KAAK,OAAO,SAAS,IAAI;EAAG,QAAQ,CAAiD;CAEnG,UAAU;EACN,SAAS;CACb;AACJ;AAEA,SAAS,aAAa,mBAA4C,CAAC,GAAW;CAI1E,MAAM,gBAAgB,WAAW,gBAAgB,KAAK,CAAC;CAEvD,SAAS,KAAK,OAAiB,SAAiB,MAAsC;EAIlF,IAAI,aAAa,SAAS,aAAa,YAAY,IAAI;EAIvD,MAAM,cAAc,oBAAoB,OAAO;EAC/C,MAAM,SAAS;GAAE,GAAG;GAC5B,GAAG,WAAW,IAAI;EAAE;EAIZ,OAAO,OAAO,aAAa,MAAM;EAEjC,IAAI,aAAa,GAAG;GAEhB,MAAM,QAAkB;IACpB,UAAU,aAAa;IACvB,SAAS;IACT,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;IAClC,GAAG;GACP;GACA,MAAM,OAAO,KAAK,UAAU,KAAK;GAEjC,IAAI,UAAU,SACV,UAAU,OAAO,IAAI;QAErB,UAAU,OAAO,IAAI;EAE7B,OAAO;GAEH,MAAM,SAAS,UAAU,UAAU,MAC7B,UAAU,SAAS,OACnB,UAAU,SAAS,OACnB;GACN,MAAM,QAAQ,OAAO,KAAK,MAAM,CAAC,CAAC,SAAS,IAAI,IAAI,KAAK,UAAU,MAAM,MAAM;GAC9E,MAAM,MAAM,GAAG,OAAO,IAAI,MAAM,YAAY,EAAE,IAAI,cAAc;GAEhE,IAAI,UAAU,SACV,QAAQ,MAAM,GAAG;QACd,IAAI,UAAU,QACjB,QAAQ,KAAK,GAAG;QAEhB,QAAQ,IAAI,GAAG;EAEvB;CACJ;CAEA,OAAO;EACH,QAAQ,KAAK,SAAS,KAAK,SAAS,KAAK,IAAI;EAC7C,OAAO,KAAK,SAAS,KAAK,QAAQ,KAAK,IAAI;EAC3C,OAAO,KAAK,SAAS,KAAK,QAAQ,KAAK,IAAI;EAC3C,QAAQ,KAAK,SAAS,KAAK,SAAS,KAAK,IAAI;EAC7C,MAAM,QAAyC;GAC3C,OAAO,aAAa;IAAE,GAAG;IACrC,GAAG;GAAO,CAAC;EACH;CACJ;AACJ;;;;;;AAOA,IAAa,SAAiB,aAAa;;;;;;;;;;;;;;AAe3C,SAAgB,mBAAmB,OAA0B;CACzD,MAAM,QAAkB,CAAC;CACzB,MAAM,uBAAO,IAAI,IAAa;CAE9B,MAAM,QAAQ,OAAgB,UAAwB;EAClD,IAAI,QAAQ,mBAAmB,UAAU,KAAA,KAAa,UAAU,MAAM;EACtE,IAAI,OAAO,UAAU,UAAU;GAC3B,IAAI,KAAK,IAAI,KAAK,GAAG;GACrB,KAAK,IAAI,KAAK;EAClB;EACA,IAAI,QAAQ,GAAG;GACX,MAAM,YAAY,iBAAiB,KAAK;GACxC,IAAI,WAAW,MAAM,KAAK,cAAc,WAAW;EACvD;EACA,IAAI,OAAO,UAAU,UAAU;EAC/B,MAAM,MAAM;EACZ,KAAK,IAAI,OAAO,QAAQ,CAAC;EACzB,MAAM,aAAa,IAAI;EACvB,IAAI,MAAM,QAAQ,UAAU,GACxB,KAAK,MAAM,QAAQ,WAAW,MAAM,GAAG,oBAAoB,GAAG,KAAK,MAAM,QAAQ,CAAC;CAE1F;CAEA,KAAK,OAAO,CAAC;CACb,OAAO;AACX;;AAGA,SAAS,iBAAiB,OAAoC;CAC1D,IAAI,UAAU,QAAQ,OAAO,UAAU,UAEnC,OADa,oBAAoB,OAAO,KAAK,CACtC,KAAQ,KAAA;CAEnB,MAAM,MAAM;CACZ,MAAM,UAAU,OAAO,IAAI,YAAY,YAAY,IAAI,UACjD,oBAAoB,IAAI,OAAO,IAC/B,KAAA;CACN,MAAM,OAAO,OAAO,IAAI,SAAS,WAAW,IAAI,OAAO,KAAA;CAIvD,MAAM,WAAW,IAAI,YAAY,KAAA,KAAa,IAAI,SAAS,KAAA,IACrD,GAAG,OAAO,IAAI,OAAO,EAAE,GAAG,OAAO,IAAI,IAAI,MACzC,KAAA;CACN,MAAM,QAAQ,YAAY,EAAE,WAAW,GAAA,CAAI,SAAS,QAAQ,IAAI,WAAW,KAAA;CAC3E,MAAM,QAAQ;EAAC,WAAW;EAAM,QAAQ,UAAU,IAAI,KAAK,KAAK,KAAA;EAAW;CAAK,CAAC,CAC5E,OAAO,OAAO;CACnB,OAAO,MAAM,SAAS,IAAI,MAAM,KAAK,GAAG,IAAI,KAAA;AAChD"}