@rebasepro/server 0.21.2-canary.g1ea48be → 0.23.0

package/dist/{keys-Qfc4XieN.js → keys-CogCQpxG.js}

@@ -2,7 +2,7 @@ import { createRequire as __rebaseCreateRequire } from "module";
 import __rebaseProcess from "process";
 globalThis.process ??= __rebaseProcess;
 __rebaseCreateRequire(import.meta.url);
-import { c as DEFAULT_STORAGE_SOURCE_KEY } from "./src-Br6ARbs6.js";
+import { c as DEFAULT_STORAGE_SOURCE_KEY } from "./src-vkcwKXbT.js";
 //#region src/storage/keys.ts
 /**
 * Canonical storage keys and bucket names.
@@ -224,7 +224,22 @@ function listingPrefix(rawPrefix) {
 function folderKey(rawPrefix) {
 	return rawPrefix.replace(/^\/+/, "").replace(/\/+$/, "");
 }
+/**
+* A listing asked for paging a controller cannot honour: a page size below one,
+* or a page token it never issued.
+*
+* Refused rather than coerced. A page size of 0 answered an empty page whose
+* next token was the one it had been handed, so `while (pageToken)` never
+* ended; a token of `-1` read before the first entry and crashed. The route
+* turns this into a 400.
+*/
+var InvalidListOptionsError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "InvalidListOptionsError";
+	}
+};
 //#endregion
-export { canonicalStorageKey as a, tryCanonicalStorageKey as c, canonicalStorageId as i, InvalidStorageKeyError as n, folderKey as o, canonicalStorageBucket as r, listingPrefix as s, InvalidStorageBucketError as t };
+export { canonicalStorageId as a, listingPrefix as c, canonicalStorageBucket as i, tryCanonicalStorageKey as l, InvalidStorageBucketError as n, canonicalStorageKey as o, InvalidStorageKeyError as r, folderKey as s, InvalidListOptionsError as t };
 
-//# sourceMappingURL=keys-Qfc4XieN.js.map
+//# sourceMappingURL=keys-CogCQpxG.js.map

package/dist/{keys-Qfc4XieN.js.map → keys-CogCQpxG.js.map}

@@ -1 +1 @@
-{"version":3,"file":"keys-Qfc4XieN.js","names":[],"sources":["../src/storage/keys.ts"],"sourcesContent":["/**\n * Canonical storage keys and bucket names.\n *\n * Storage is not under RLS, so a `storageAuthorize` hook is the whole access\n * control model — and a hook can only be correct if the key it is shown is the\n * key that is written. That is the invariant this module exists to hold: one\n * canonical string, computed once per request, handed to the hook, to the\n * controller, and to the download token alike.\n *\n * ## Why rejecting beats stripping\n *\n * The previous `sanitizeStorageKey` *stripped* `../` in a single pass. Two\n * things were wrong with that, and only one of them was the obvious one.\n *\n * The obvious one: a single pass is not a fixed point. `....//` contains `../`\n * at offset 2, so removing it leaves `../` behind — the sanitizer manufactured\n * the traversal it was there to remove. `users/alice/....//bob/x` came out as\n * `users/alice/../bob/x`, which a prefix hook reads as alice's (it starts with\n * `users/alice/`) and the filesystem reads as bob's. The hook approved one\n * object and the controller wrote another.\n *\n * The subtler one, and the reason this is a rewrite rather than a loop: even a\n * correct strip is a silent rewrite. A caller who asks to store at `a/../b` and\n * gets an object at `a/b` was not protected, they were misled — and every later\n * read, ownership row and audit line now refers to a path nobody chose. So a key\n * that means something other than what it says is refused (400), not repaired.\n *\n * Note what is NOT traversal under this rule: `....` is an ordinary directory\n * name, and `users/alice/....//bob/x` canonicalizes to\n * `users/alice/..../bob/x` — still comfortably inside alice's prefix, which is\n * exactly right. Only a real `..` segment is refused.\n */\n\nimport { DEFAULT_STORAGE_SOURCE_KEY } from \"@rebasepro/types\";\n\n/**\n * `path.posix.normalize`, without `node:path`.\n *\n * A storage key is a POSIX-shaped string that never touches a filesystem, so\n * reaching for `node:path` to fold `.` and `//` out of it was always a little\n * wrong on its own terms — on Windows the platform `path` would have applied\n * different rules to the same key. It also put the module that every storage\n * read, ownership row and audit line goes through on the list of things that\n * only run in a Node process.\n *\n * This is the algorithm Node implements, transcribed: segments are folded left\n * to right, `..` pops unless it would climb past the root of a relative path,\n * and both the leading and the trailing separator survive the round trip. The\n * `..` branch is unreachable from {@link canonicalStorageKey}, which refuses\n * those keys outright before it gets here — it exists so that this function is\n * *the* normalizer rather than a subset of one, and\n * `storage-keys.property.test.ts` holds it to that with a property test against\n * `path.posix.normalize` itself. Exported for exactly that — nothing outside\n * this module should be normalizing a key.\n */\nexport function normalizePosix(input: string): string {\n    if (input.length === 0) return \".\";\n    const isAbsolute = input.startsWith(\"/\");\n    const trailingSeparator = input.endsWith(\"/\");\n\n    const segments: string[] = [];\n    for (const segment of input.split(\"/\")) {\n        if (segment === \"\" || segment === \".\") continue;\n        if (segment === \"..\") {\n            if (segments.length > 0 && segments[segments.length - 1] !== \"..\") segments.pop();\n            else if (!isAbsolute) segments.push(\"..\");\n            continue;\n        }\n        segments.push(segment);\n    }\n\n    const joined = segments.join(\"/\");\n    if (joined === \"\") {\n        if (isAbsolute) return \"/\";\n        return trailingSeparator ? \"./\" : \".\";\n    }\n    const withTrailing = trailingSeparator ? `${joined}/` : joined;\n    return isAbsolute ? `/${withTrailing}` : withTrailing;\n}\n\n/** Longest key accepted, in UTF-16 code units. Matches the previous cap. */\nexport const MAX_STORAGE_KEY_LENGTH = 1024;\n\n/**\n * A key that cannot be canonicalized. Carries no path back to the caller\n * beyond what they sent, so it is safe to surface as a 400 message.\n */\nexport class InvalidStorageKeyError extends Error {\n    constructor(message: string) {\n        super(message);\n        this.name = \"InvalidStorageKeyError\";\n    }\n}\n\n/**\n * Canonicalize a caller-supplied storage key, or throw\n * {@link InvalidStorageKeyError}.\n *\n * Normalizations applied (safe, idempotent, and meaning-preserving):\n * - leading slashes removed — `/a/b` and `a/b` name the same object\n * - `.` segments and repeated slashes collapsed\n *\n * Refusals (the key means something other than what it says):\n * - any `..` segment, on either separator, at any depth\n * - null bytes\n * - keys longer than {@link MAX_STORAGE_KEY_LENGTH}\n *\n * A trailing slash is preserved: it is how the folder route marks a prefix.\n */\nexport function canonicalStorageKey(rawKey: string): string {\n    if (rawKey.includes(\"\\0\")) {\n        throw new InvalidStorageKeyError(\"Storage key contains a null byte.\");\n    }\n    if (rawKey.length > MAX_STORAGE_KEY_LENGTH) {\n        throw new InvalidStorageKeyError(\n            `Storage key exceeds the maximum length of ${MAX_STORAGE_KEY_LENGTH} characters.`\n        );\n    }\n\n    // Split on both separators: `path.join` treats `\\` as a separator on\n    // Windows, so `..\\` is traversal there even though POSIX reads it as a\n    // filename. Checked against the RAW key, before any normalization — the\n    // whole point is that `a/../b` is refused rather than quietly turned into\n    // `b`.\n    if (rawKey.split(/[\\\\/]/).some((segment) => segment === \"..\")) {\n        throw new InvalidStorageKeyError(\n            \"Storage key contains a '..' path segment. Keys must name an object directly.\"\n        );\n    }\n\n    const withoutLeadingSlashes = rawKey.replace(/^\\/+/, \"\");\n    if (withoutLeadingSlashes === \"\") return \"\";\n\n    // Whether the key names a *directory* rather than an object: it ends with a\n    // separator, or its last segment is the `.` that means \"this directory\".\n    //\n    // Recorded before normalizing, because normalization drops the\n    // distinction in one of those two spellings and not the other: `public/.`\n    // becomes `public` while `public/./` stays `public/`. That asymmetry breaks\n    // the rule this module states — a trailing slash is preserved, because it is\n    // how the folder route marks a prefix — and it is not cosmetic on `list`,\n    // where a prefix of `public` also matches `publicity/` and hands back keys\n    // the caller never asked for.\n    const denotesDirectory = /(?:^|\\/)\\.?$/.test(withoutLeadingSlashes);\n\n    // Safe now: with no `..` segment in the input, `normalize` can only collapse\n    // `.` and duplicate slashes — it cannot climb.\n    const normalized = normalizePosix(withoutLeadingSlashes);\n\n    // `normalize(\".\")`, and `normalize(\"./\")` → `./`; neither names an object.\n    if (normalized === \".\" || normalized === \"./\") return \"\";\n\n    // Defensive: nothing reaching here still carries a leading `./`, since the\n    // leading slashes are already gone and `normalize` only emits `./` for a\n    // key that normalizes to nothing — which returned above.\n    const key = normalized.replace(/^\\.\\//, \"\").replace(/^\\/+/, \"\");\n    if (key === \"\") return \"\";\n    return denotesDirectory && !key.endsWith(\"/\") ? `${key}/` : key;\n}\n\n/**\n * Canonicalize, or return `null` when the key is not canonicalizable.\n *\n * For callers that must fail closed without an exception — the download-token\n * middleware compares a request path against a granted path, and a key it\n * cannot canonicalize simply matches nothing.\n */\nexport function tryCanonicalStorageKey(rawKey: string): string | null {\n    try {\n        return canonicalStorageKey(rawKey);\n    } catch {\n        return null;\n    }\n}\n\n/**\n * Canonicalize the storage *source* a request names (`?storageId=`), so that\n * \"the default source\" has exactly one spelling.\n *\n * The default source can be asked for three ways — the parameter omitted, sent\n * empty, or sent as the literal `(default)` — and all three resolve to the same\n * controller. Without a single spelling, the value derived when a download\n * token is minted and the value derived when it is presented can differ for the\n * same object, which is either a spurious 403 or, if the comparison is dropped\n * to stop those, no scoping at all.\n *\n * Deliberately *not* validated against the registry: this is a naming rule, not\n * an existence check, and it must give the same answer in `auth/` (which has no\n * registry) as in the storage routes. An id that names no source still\n * canonicalizes to itself and simply matches only itself.\n */\nexport function canonicalStorageId(rawStorageId: string | undefined | null): string {\n    if (rawStorageId === undefined || rawStorageId === null) return DEFAULT_STORAGE_SOURCE_KEY;\n    const trimmed = rawStorageId.trim();\n    return trimmed === \"\" ? DEFAULT_STORAGE_SOURCE_KEY : trimmed;\n}\n\n/**\n * Longest bucket name accepted. 63 is the S3/GCS limit, and a local bucket is\n * one directory name, so the tighter of the two bounds everything.\n */\nexport const MAX_STORAGE_BUCKET_LENGTH = 63;\n\n/** A bucket name that does not name a bucket. See {@link canonicalStorageBucket}. */\nexport class InvalidStorageBucketError extends Error {\n    constructor(message: string) {\n        super(message);\n        this.name = \"InvalidStorageBucketError\";\n    }\n}\n\n/**\n * One path segment: letters, digits, `.`, `_`, `-`, first character\n * alphanumeric. Deliberately narrow — it is the intersection of what S3, GCS\n * and a filesystem directory all accept, and it makes `..`, `.tus-uploads`,\n * absolute paths and anything containing a separator unrepresentable.\n */\nconst STORAGE_BUCKET_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;\n\n/**\n * Canonicalize a caller-supplied bucket name, or throw\n * {@link InvalidStorageBucketError}.\n *\n * The bucket is the *other* caller-controlled routing value in an upload\n * request, and it was the one nobody validated. `LocalStorageController`\n * builds `join(basePath, bucket)` and then checks containment against that\n * result, so a bucket of `../../etc` moved the boundary rather than crossing\n * it — the guard passed because the guard's reference point was the attacker's.\n * The containment check now resolves against the storage root, and this is the\n * check at the route boundary that stops the value before it gets there.\n *\n * A bucket is configuration, not user data: there is no legitimate caller that\n * needs a separator, a leading dot, or a `..` in one. So this refuses rather\n * than repairs, exactly as {@link canonicalStorageKey} does — a rewritten\n * bucket would silently store the object somewhere the caller did not ask for.\n *\n * Returns `undefined` when the caller named no bucket (absent, or an empty\n * form field), which is how every controller spells \"use my default\". An empty\n * string used to reach `getFullPath` and resolve to the storage *root* rather\n * than the `default` bucket, which is a third place a bare key did not\n * round-trip.\n */\nexport function canonicalStorageBucket(rawBucket: string | undefined | null): string | undefined {\n    if (rawBucket === undefined || rawBucket === null || rawBucket === \"\") return undefined;\n    if (rawBucket.length > MAX_STORAGE_BUCKET_LENGTH) {\n        throw new InvalidStorageBucketError(\n            `Storage bucket exceeds the maximum length of ${MAX_STORAGE_BUCKET_LENGTH} characters.`\n        );\n    }\n    if (!STORAGE_BUCKET_PATTERN.test(rawBucket)) {\n        throw new InvalidStorageBucketError(\n            \"Storage bucket must be a single name of letters, digits, '.', '_' or '-', \" +\n            \"starting with a letter or digit.\"\n        );\n    }\n    return rawBucket;\n}\n\n/**\n * The prefix an object store's listing should be given for a caller's key, and\n * the key a listing should hand back for a folder.\n *\n * The three controllers answer the same question in two different ways, and\n * they used to disagree about the answer. `LocalStorageController` resolves a\n * *directory* on disk, so `listObjects(\"products/images\")` and\n * `listObjects(\"products/images/\")` both list what is inside it. An object\n * store under `Delimiter: \"/\"` does not: `Prefix: \"products/images\"` matches\n * `products/images.txt` and `productsomething/`, and returns none of the files\n * inside `products/images/`. So the same call — the SDK's own documented one —\n * answered one thing against local dev and another against the S3 bucket in\n * production, which is the worst place for a divergence to live.\n *\n * `listingPrefix` is what to *send*: a trailing slash, always, because that is\n * the only spelling that means \"inside this folder\" to a delimiter listing.\n * `folderKey` is what to *return* for a common prefix: no trailing slash, the\n * form the local controller has always used, so a `fullPath` from a listing is\n * a key you can pass straight back to any of them.\n */\nexport function listingPrefix(rawPrefix: string): string | undefined {\n    const key = rawPrefix.replace(/^\\/+/, \"\").replace(/\\/+$/, \"\");\n    return key === \"\" ? undefined : `${key}/`;\n}\n\n/** @see listingPrefix */\nexport function folderKey(rawPrefix: string): string {\n    return rawPrefix.replace(/^\\/+/, \"\").replace(/\\/+$/, \"\");\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuDA,SAAgB,eAAe,OAAuB;CAClD,IAAI,MAAM,WAAW,GAAG,OAAO;CAC/B,MAAM,aAAa,MAAM,WAAW,GAAG;CACvC,MAAM,oBAAoB,MAAM,SAAS,GAAG;CAE5C,MAAM,WAAqB,CAAC;CAC5B,KAAK,MAAM,WAAW,MAAM,MAAM,GAAG,GAAG;EACpC,IAAI,YAAY,MAAM,YAAY,KAAK;EACvC,IAAI,YAAY,MAAM;GAClB,IAAI,SAAS,SAAS,KAAK,SAAS,SAAS,SAAS,OAAO,MAAM,SAAS,IAAI;QAC3E,IAAI,CAAC,YAAY,SAAS,KAAK,IAAI;GACxC;EACJ;EACA,SAAS,KAAK,OAAO;CACzB;CAEA,MAAM,SAAS,SAAS,KAAK,GAAG;CAChC,IAAI,WAAW,IAAI;EACf,IAAI,YAAY,OAAO;EACvB,OAAO,oBAAoB,OAAO;CACtC;CACA,MAAM,eAAe,oBAAoB,GAAG,OAAO,KAAK;CACxD,OAAO,aAAa,IAAI,iBAAiB;AAC7C;;AAGA,IAAa,yBAAyB;;;;;AAMtC,IAAa,yBAAb,cAA4C,MAAM;CAC9C,YAAY,SAAiB;EACzB,MAAM,OAAO;EACb,KAAK,OAAO;CAChB;AACJ;;;;;;;;;;;;;;;;AAiBA,SAAgB,oBAAoB,QAAwB;CACxD,IAAI,OAAO,SAAS,IAAI,GACpB,MAAM,IAAI,uBAAuB,mCAAmC;CAExE,IAAI,OAAO,SAAA,MACP,MAAM,IAAI,uBACN,6CAA6C,uBAAuB,aACxE;CAQJ,IAAI,OAAO,MAAM,OAAO,CAAC,CAAC,MAAM,YAAY,YAAY,IAAI,GACxD,MAAM,IAAI,uBACN,8EACJ;CAGJ,MAAM,wBAAwB,OAAO,QAAQ,QAAQ,EAAE;CACvD,IAAI,0BAA0B,IAAI,OAAO;CAYzC,MAAM,mBAAmB,eAAe,KAAK,qBAAqB;CAIlE,MAAM,aAAa,eAAe,qBAAqB;CAGvD,IAAI,eAAe,OAAO,eAAe,MAAM,OAAO;CAKtD,MAAM,MAAM,WAAW,QAAQ,SAAS,EAAE,CAAC,CAAC,QAAQ,QAAQ,EAAE;CAC9D,IAAI,QAAQ,IAAI,OAAO;CACvB,OAAO,oBAAoB,CAAC,IAAI,SAAS,GAAG,IAAI,GAAG,IAAI,KAAK;AAChE;;;;;;;;AASA,SAAgB,uBAAuB,QAA+B;CAClE,IAAI;EACA,OAAO,oBAAoB,MAAM;CACrC,QAAQ;EACJ,OAAO;CACX;AACJ;;;;;;;;;;;;;;;;;AAkBA,SAAgB,mBAAmB,cAAiD;CAChF,IAAI,iBAAiB,KAAA,KAAa,iBAAiB,MAAM,OAAO;CAChE,MAAM,UAAU,aAAa,KAAK;CAClC,OAAO,YAAY,KAAK,6BAA6B;AACzD;;AASA,IAAa,4BAAb,cAA+C,MAAM;CACjD,YAAY,SAAiB;EACzB,MAAM,OAAO;EACb,KAAK,OAAO;CAChB;AACJ;;;;;;;AAQA,IAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;AAyB/B,SAAgB,uBAAuB,WAA0D;CAC7F,IAAI,cAAc,KAAA,KAAa,cAAc,QAAQ,cAAc,IAAI,OAAO,KAAA;CAC9E,IAAI,UAAU,SAAA,IACV,MAAM,IAAI,0BACN,6DACJ;CAEJ,IAAI,CAAC,uBAAuB,KAAK,SAAS,GACtC,MAAM,IAAI,0BACN,4GAEJ;CAEJ,OAAO;AACX;;;;;;;;;;;;;;;;;;;;;AAsBA,SAAgB,cAAc,WAAuC;CACjE,MAAM,MAAM,UAAU,QAAQ,QAAQ,EAAE,CAAC,CAAC,QAAQ,QAAQ,EAAE;CAC5D,OAAO,QAAQ,KAAK,KAAA,IAAY,GAAG,IAAI;AAC3C;;AAGA,SAAgB,UAAU,WAA2B;CACjD,OAAO,UAAU,QAAQ,QAAQ,EAAE,CAAC,CAAC,QAAQ,QAAQ,EAAE;AAC3D"}
+{"version":3,"file":"keys-CogCQpxG.js","names":[],"sources":["../src/storage/keys.ts"],"sourcesContent":["/**\n * Canonical storage keys and bucket names.\n *\n * Storage is not under RLS, so a `storageAuthorize` hook is the whole access\n * control model — and a hook can only be correct if the key it is shown is the\n * key that is written. That is the invariant this module exists to hold: one\n * canonical string, computed once per request, handed to the hook, to the\n * controller, and to the download token alike.\n *\n * ## Why rejecting beats stripping\n *\n * The previous `sanitizeStorageKey` *stripped* `../` in a single pass. Two\n * things were wrong with that, and only one of them was the obvious one.\n *\n * The obvious one: a single pass is not a fixed point. `....//` contains `../`\n * at offset 2, so removing it leaves `../` behind — the sanitizer manufactured\n * the traversal it was there to remove. `users/alice/....//bob/x` came out as\n * `users/alice/../bob/x`, which a prefix hook reads as alice's (it starts with\n * `users/alice/`) and the filesystem reads as bob's. The hook approved one\n * object and the controller wrote another.\n *\n * The subtler one, and the reason this is a rewrite rather than a loop: even a\n * correct strip is a silent rewrite. A caller who asks to store at `a/../b` and\n * gets an object at `a/b` was not protected, they were misled — and every later\n * read, ownership row and audit line now refers to a path nobody chose. So a key\n * that means something other than what it says is refused (400), not repaired.\n *\n * Note what is NOT traversal under this rule: `....` is an ordinary directory\n * name, and `users/alice/....//bob/x` canonicalizes to\n * `users/alice/..../bob/x` — still comfortably inside alice's prefix, which is\n * exactly right. Only a real `..` segment is refused.\n */\n\nimport { DEFAULT_STORAGE_SOURCE_KEY } from \"@rebasepro/types\";\n\n/**\n * `path.posix.normalize`, without `node:path`.\n *\n * A storage key is a POSIX-shaped string that never touches a filesystem, so\n * reaching for `node:path` to fold `.` and `//` out of it was always a little\n * wrong on its own terms — on Windows the platform `path` would have applied\n * different rules to the same key. It also put the module that every storage\n * read, ownership row and audit line goes through on the list of things that\n * only run in a Node process.\n *\n * This is the algorithm Node implements, transcribed: segments are folded left\n * to right, `..` pops unless it would climb past the root of a relative path,\n * and both the leading and the trailing separator survive the round trip. The\n * `..` branch is unreachable from {@link canonicalStorageKey}, which refuses\n * those keys outright before it gets here — it exists so that this function is\n * *the* normalizer rather than a subset of one, and\n * `storage-keys.property.test.ts` holds it to that with a property test against\n * `path.posix.normalize` itself. Exported for exactly that — nothing outside\n * this module should be normalizing a key.\n */\nexport function normalizePosix(input: string): string {\n    if (input.length === 0) return \".\";\n    const isAbsolute = input.startsWith(\"/\");\n    const trailingSeparator = input.endsWith(\"/\");\n\n    const segments: string[] = [];\n    for (const segment of input.split(\"/\")) {\n        if (segment === \"\" || segment === \".\") continue;\n        if (segment === \"..\") {\n            if (segments.length > 0 && segments[segments.length - 1] !== \"..\") segments.pop();\n            else if (!isAbsolute) segments.push(\"..\");\n            continue;\n        }\n        segments.push(segment);\n    }\n\n    const joined = segments.join(\"/\");\n    if (joined === \"\") {\n        if (isAbsolute) return \"/\";\n        return trailingSeparator ? \"./\" : \".\";\n    }\n    const withTrailing = trailingSeparator ? `${joined}/` : joined;\n    return isAbsolute ? `/${withTrailing}` : withTrailing;\n}\n\n/** Longest key accepted, in UTF-16 code units. Matches the previous cap. */\nexport const MAX_STORAGE_KEY_LENGTH = 1024;\n\n/**\n * A key that cannot be canonicalized. Carries no path back to the caller\n * beyond what they sent, so it is safe to surface as a 400 message.\n */\nexport class InvalidStorageKeyError extends Error {\n    constructor(message: string) {\n        super(message);\n        this.name = \"InvalidStorageKeyError\";\n    }\n}\n\n/**\n * Canonicalize a caller-supplied storage key, or throw\n * {@link InvalidStorageKeyError}.\n *\n * Normalizations applied (safe, idempotent, and meaning-preserving):\n * - leading slashes removed — `/a/b` and `a/b` name the same object\n * - `.` segments and repeated slashes collapsed\n *\n * Refusals (the key means something other than what it says):\n * - any `..` segment, on either separator, at any depth\n * - null bytes\n * - keys longer than {@link MAX_STORAGE_KEY_LENGTH}\n *\n * A trailing slash is preserved: it is how the folder route marks a prefix.\n */\nexport function canonicalStorageKey(rawKey: string): string {\n    if (rawKey.includes(\"\\0\")) {\n        throw new InvalidStorageKeyError(\"Storage key contains a null byte.\");\n    }\n    if (rawKey.length > MAX_STORAGE_KEY_LENGTH) {\n        throw new InvalidStorageKeyError(\n            `Storage key exceeds the maximum length of ${MAX_STORAGE_KEY_LENGTH} characters.`\n        );\n    }\n\n    // Split on both separators: `path.join` treats `\\` as a separator on\n    // Windows, so `..\\` is traversal there even though POSIX reads it as a\n    // filename. Checked against the RAW key, before any normalization — the\n    // whole point is that `a/../b` is refused rather than quietly turned into\n    // `b`.\n    if (rawKey.split(/[\\\\/]/).some((segment) => segment === \"..\")) {\n        throw new InvalidStorageKeyError(\n            \"Storage key contains a '..' path segment. Keys must name an object directly.\"\n        );\n    }\n\n    const withoutLeadingSlashes = rawKey.replace(/^\\/+/, \"\");\n    if (withoutLeadingSlashes === \"\") return \"\";\n\n    // Whether the key names a *directory* rather than an object: it ends with a\n    // separator, or its last segment is the `.` that means \"this directory\".\n    //\n    // Recorded before normalizing, because normalization drops the\n    // distinction in one of those two spellings and not the other: `public/.`\n    // becomes `public` while `public/./` stays `public/`. That asymmetry breaks\n    // the rule this module states — a trailing slash is preserved, because it is\n    // how the folder route marks a prefix — and it is not cosmetic on `list`,\n    // where a prefix of `public` also matches `publicity/` and hands back keys\n    // the caller never asked for.\n    const denotesDirectory = /(?:^|\\/)\\.?$/.test(withoutLeadingSlashes);\n\n    // Safe now: with no `..` segment in the input, `normalize` can only collapse\n    // `.` and duplicate slashes — it cannot climb.\n    const normalized = normalizePosix(withoutLeadingSlashes);\n\n    // `normalize(\".\")`, and `normalize(\"./\")` → `./`; neither names an object.\n    if (normalized === \".\" || normalized === \"./\") return \"\";\n\n    // Defensive: nothing reaching here still carries a leading `./`, since the\n    // leading slashes are already gone and `normalize` only emits `./` for a\n    // key that normalizes to nothing — which returned above.\n    const key = normalized.replace(/^\\.\\//, \"\").replace(/^\\/+/, \"\");\n    if (key === \"\") return \"\";\n    return denotesDirectory && !key.endsWith(\"/\") ? `${key}/` : key;\n}\n\n/**\n * Canonicalize, or return `null` when the key is not canonicalizable.\n *\n * For callers that must fail closed without an exception — the download-token\n * middleware compares a request path against a granted path, and a key it\n * cannot canonicalize simply matches nothing.\n */\nexport function tryCanonicalStorageKey(rawKey: string): string | null {\n    try {\n        return canonicalStorageKey(rawKey);\n    } catch {\n        return null;\n    }\n}\n\n/**\n * Canonicalize the storage *source* a request names (`?storageId=`), so that\n * \"the default source\" has exactly one spelling.\n *\n * The default source can be asked for three ways — the parameter omitted, sent\n * empty, or sent as the literal `(default)` — and all three resolve to the same\n * controller. Without a single spelling, the value derived when a download\n * token is minted and the value derived when it is presented can differ for the\n * same object, which is either a spurious 403 or, if the comparison is dropped\n * to stop those, no scoping at all.\n *\n * Deliberately *not* validated against the registry: this is a naming rule, not\n * an existence check, and it must give the same answer in `auth/` (which has no\n * registry) as in the storage routes. An id that names no source still\n * canonicalizes to itself and simply matches only itself.\n */\nexport function canonicalStorageId(rawStorageId: string | undefined | null): string {\n    if (rawStorageId === undefined || rawStorageId === null) return DEFAULT_STORAGE_SOURCE_KEY;\n    const trimmed = rawStorageId.trim();\n    return trimmed === \"\" ? DEFAULT_STORAGE_SOURCE_KEY : trimmed;\n}\n\n/**\n * Longest bucket name accepted. 63 is the S3/GCS limit, and a local bucket is\n * one directory name, so the tighter of the two bounds everything.\n */\nexport const MAX_STORAGE_BUCKET_LENGTH = 63;\n\n/** A bucket name that does not name a bucket. See {@link canonicalStorageBucket}. */\nexport class InvalidStorageBucketError extends Error {\n    constructor(message: string) {\n        super(message);\n        this.name = \"InvalidStorageBucketError\";\n    }\n}\n\n/**\n * One path segment: letters, digits, `.`, `_`, `-`, first character\n * alphanumeric. Deliberately narrow — it is the intersection of what S3, GCS\n * and a filesystem directory all accept, and it makes `..`, `.tus-uploads`,\n * absolute paths and anything containing a separator unrepresentable.\n */\nconst STORAGE_BUCKET_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;\n\n/**\n * Canonicalize a caller-supplied bucket name, or throw\n * {@link InvalidStorageBucketError}.\n *\n * The bucket is the *other* caller-controlled routing value in an upload\n * request, and it was the one nobody validated. `LocalStorageController`\n * builds `join(basePath, bucket)` and then checks containment against that\n * result, so a bucket of `../../etc` moved the boundary rather than crossing\n * it — the guard passed because the guard's reference point was the attacker's.\n * The containment check now resolves against the storage root, and this is the\n * check at the route boundary that stops the value before it gets there.\n *\n * A bucket is configuration, not user data: there is no legitimate caller that\n * needs a separator, a leading dot, or a `..` in one. So this refuses rather\n * than repairs, exactly as {@link canonicalStorageKey} does — a rewritten\n * bucket would silently store the object somewhere the caller did not ask for.\n *\n * Returns `undefined` when the caller named no bucket (absent, or an empty\n * form field), which is how every controller spells \"use my default\". An empty\n * string used to reach `getFullPath` and resolve to the storage *root* rather\n * than the `default` bucket, which is a third place a bare key did not\n * round-trip.\n */\nexport function canonicalStorageBucket(rawBucket: string | undefined | null): string | undefined {\n    if (rawBucket === undefined || rawBucket === null || rawBucket === \"\") return undefined;\n    if (rawBucket.length > MAX_STORAGE_BUCKET_LENGTH) {\n        throw new InvalidStorageBucketError(\n            `Storage bucket exceeds the maximum length of ${MAX_STORAGE_BUCKET_LENGTH} characters.`\n        );\n    }\n    if (!STORAGE_BUCKET_PATTERN.test(rawBucket)) {\n        throw new InvalidStorageBucketError(\n            \"Storage bucket must be a single name of letters, digits, '.', '_' or '-', \" +\n            \"starting with a letter or digit.\"\n        );\n    }\n    return rawBucket;\n}\n\n/**\n * The prefix an object store's listing should be given for a caller's key, and\n * the key a listing should hand back for a folder.\n *\n * The three controllers answer the same question in two different ways, and\n * they used to disagree about the answer. `LocalStorageController` resolves a\n * *directory* on disk, so `listObjects(\"products/images\")` and\n * `listObjects(\"products/images/\")` both list what is inside it. An object\n * store under `Delimiter: \"/\"` does not: `Prefix: \"products/images\"` matches\n * `products/images.txt` and `productsomething/`, and returns none of the files\n * inside `products/images/`. So the same call — the SDK's own documented one —\n * answered one thing against local dev and another against the S3 bucket in\n * production, which is the worst place for a divergence to live.\n *\n * `listingPrefix` is what to *send*: a trailing slash, always, because that is\n * the only spelling that means \"inside this folder\" to a delimiter listing.\n * `folderKey` is what to *return* for a common prefix: no trailing slash, the\n * form the local controller has always used, so a `fullPath` from a listing is\n * a key you can pass straight back to any of them.\n */\nexport function listingPrefix(rawPrefix: string): string | undefined {\n    const key = rawPrefix.replace(/^\\/+/, \"\").replace(/\\/+$/, \"\");\n    return key === \"\" ? undefined : `${key}/`;\n}\n\n/** @see listingPrefix */\nexport function folderKey(rawPrefix: string): string {\n    return rawPrefix.replace(/^\\/+/, \"\").replace(/\\/+$/, \"\");\n}\n\n/**\n * A listing asked for paging a controller cannot honour: a page size below one,\n * or a page token it never issued.\n *\n * Refused rather than coerced. A page size of 0 answered an empty page whose\n * next token was the one it had been handed, so `while (pageToken)` never\n * ended; a token of `-1` read before the first entry and crashed. The route\n * turns this into a 400.\n */\nexport class InvalidListOptionsError extends Error {\n    constructor(message: string) {\n        super(message);\n        this.name = \"InvalidListOptionsError\";\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuDA,SAAgB,eAAe,OAAuB;CAClD,IAAI,MAAM,WAAW,GAAG,OAAO;CAC/B,MAAM,aAAa,MAAM,WAAW,GAAG;CACvC,MAAM,oBAAoB,MAAM,SAAS,GAAG;CAE5C,MAAM,WAAqB,CAAC;CAC5B,KAAK,MAAM,WAAW,MAAM,MAAM,GAAG,GAAG;EACpC,IAAI,YAAY,MAAM,YAAY,KAAK;EACvC,IAAI,YAAY,MAAM;GAClB,IAAI,SAAS,SAAS,KAAK,SAAS,SAAS,SAAS,OAAO,MAAM,SAAS,IAAI;QAC3E,IAAI,CAAC,YAAY,SAAS,KAAK,IAAI;GACxC;EACJ;EACA,SAAS,KAAK,OAAO;CACzB;CAEA,MAAM,SAAS,SAAS,KAAK,GAAG;CAChC,IAAI,WAAW,IAAI;EACf,IAAI,YAAY,OAAO;EACvB,OAAO,oBAAoB,OAAO;CACtC;CACA,MAAM,eAAe,oBAAoB,GAAG,OAAO,KAAK;CACxD,OAAO,aAAa,IAAI,iBAAiB;AAC7C;;AAGA,IAAa,yBAAyB;;;;;AAMtC,IAAa,yBAAb,cAA4C,MAAM;CAC9C,YAAY,SAAiB;EACzB,MAAM,OAAO;EACb,KAAK,OAAO;CAChB;AACJ;;;;;;;;;;;;;;;;AAiBA,SAAgB,oBAAoB,QAAwB;CACxD,IAAI,OAAO,SAAS,IAAI,GACpB,MAAM,IAAI,uBAAuB,mCAAmC;CAExE,IAAI,OAAO,SAAA,MACP,MAAM,IAAI,uBACN,6CAA6C,uBAAuB,aACxE;CAQJ,IAAI,OAAO,MAAM,OAAO,CAAC,CAAC,MAAM,YAAY,YAAY,IAAI,GACxD,MAAM,IAAI,uBACN,8EACJ;CAGJ,MAAM,wBAAwB,OAAO,QAAQ,QAAQ,EAAE;CACvD,IAAI,0BAA0B,IAAI,OAAO;CAYzC,MAAM,mBAAmB,eAAe,KAAK,qBAAqB;CAIlE,MAAM,aAAa,eAAe,qBAAqB;CAGvD,IAAI,eAAe,OAAO,eAAe,MAAM,OAAO;CAKtD,MAAM,MAAM,WAAW,QAAQ,SAAS,EAAE,CAAC,CAAC,QAAQ,QAAQ,EAAE;CAC9D,IAAI,QAAQ,IAAI,OAAO;CACvB,OAAO,oBAAoB,CAAC,IAAI,SAAS,GAAG,IAAI,GAAG,IAAI,KAAK;AAChE;;;;;;;;AASA,SAAgB,uBAAuB,QAA+B;CAClE,IAAI;EACA,OAAO,oBAAoB,MAAM;CACrC,QAAQ;EACJ,OAAO;CACX;AACJ;;;;;;;;;;;;;;;;;AAkBA,SAAgB,mBAAmB,cAAiD;CAChF,IAAI,iBAAiB,KAAA,KAAa,iBAAiB,MAAM,OAAO;CAChE,MAAM,UAAU,aAAa,KAAK;CAClC,OAAO,YAAY,KAAK,6BAA6B;AACzD;;AASA,IAAa,4BAAb,cAA+C,MAAM;CACjD,YAAY,SAAiB;EACzB,MAAM,OAAO;EACb,KAAK,OAAO;CAChB;AACJ;;;;;;;AAQA,IAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;AAyB/B,SAAgB,uBAAuB,WAA0D;CAC7F,IAAI,cAAc,KAAA,KAAa,cAAc,QAAQ,cAAc,IAAI,OAAO,KAAA;CAC9E,IAAI,UAAU,SAAA,IACV,MAAM,IAAI,0BACN,6DACJ;CAEJ,IAAI,CAAC,uBAAuB,KAAK,SAAS,GACtC,MAAM,IAAI,0BACN,4GAEJ;CAEJ,OAAO;AACX;;;;;;;;;;;;;;;;;;;;;AAsBA,SAAgB,cAAc,WAAuC;CACjE,MAAM,MAAM,UAAU,QAAQ,QAAQ,EAAE,CAAC,CAAC,QAAQ,QAAQ,EAAE;CAC5D,OAAO,QAAQ,KAAK,KAAA,IAAY,GAAG,IAAI;AAC3C;;AAGA,SAAgB,UAAU,WAA2B;CACjD,OAAO,UAAU,QAAQ,QAAQ,EAAE,CAAC,CAAC,QAAQ,QAAQ,EAAE;AAC3D;;;;;;;;;;AAWA,IAAa,0BAAb,cAA6C,MAAM;CAC/C,YAAY,SAAiB;EACzB,MAAM,OAAO;EACb,KAAK,OAAO;CAChB;AACJ"}

package/dist/{logs-routes-3EEzPjhl.js → logs-routes-Bj4TYYUl.js}

@@ -240,11 +240,14 @@ function createLogsRoutes(timing = {}) {
 	* `?count=abc` made `slice(-NaN)` return the *entire* buffer. Three ways to
 	* be wrong, none of them visible to the caller. The data plane refuses the
 	* same input with a 400 — see `resolveListLimitParam`.
+	*
+	* `min` is 1 for a size and 0 for an offset: `?offset=0` is the first page,
+	* which is where every pager starts, and it was a 400.
 	*/
-	const window = (raw, what, max) => {
+	const window = (raw, what, max, min = 1) => {
 		if (raw === void 0 || raw.trim() === "") return void 0;
 		const parsed = Number(raw.trim());
-		if (!Number.isInteger(parsed) || parsed < 1 || parsed > max) throw new ApiError(400, "INVALID_PARAM", `Invalid \`${what}\`: ${raw}. Expected a whole number between 1 and ${max}.`, void 0, true);
+		if (!Number.isInteger(parsed) || parsed < min || parsed > max) throw new ApiError(400, "INVALID_PARAM", `Invalid \`${what}\`: ${raw}. Expected a whole number between ${min} and ${max}.`, void 0, true);
 		return parsed;
 	};
 	app.get("/", (c) => {
@@ -254,7 +257,7 @@ function createLogsRoutes(timing = {}) {
 			source: query.source,
 			search: query.search,
 			limit: window(query.limit, "limit", LOG_WINDOW_MAX),
-			offset: window(query.offset, "offset", Number.MAX_SAFE_INTEGER),
+			offset: window(query.offset, "offset", Number.MAX_SAFE_INTEGER, 0),
 			since: query.since
 		});
 		return c.json(result);
@@ -337,4 +340,4 @@ var logs_routes_default = createLogsRoutes();
 //#endregion
 export { logs_routes_exports as n, logMiddleware as t };
 
-//# sourceMappingURL=logs-routes-3EEzPjhl.js.map
+//# sourceMappingURL=logs-routes-Bj4TYYUl.js.map

package/dist/{logs-routes-3EEzPjhl.js.map → logs-routes-Bj4TYYUl.js.map}

@@ -1 +1 @@
-{"version":3,"file":"logs-routes-3EEzPjhl.js","names":[],"sources":["../src/api/logs-routes.ts"],"sourcesContent":["import { Hono } from \"hono\";\nimport type { MiddlewareHandler } from \"hono\";\nimport { streamSSE } from \"hono/streaming\";\nimport type { HonoEnv } from \"./types\";\nimport { ApiError, errorHandler } from \"./errors\";\nimport { addLogSink } from \"../utils/logger\";\n\nexport interface LogEntry {\n    id: string;\n    timestamp: string;\n    level: \"debug\" | \"info\" | \"warn\" | \"error\";\n    source: \"api\" | \"auth\" | \"storage\" | \"realtime\" | \"system\";\n    message: string;\n    metadata?: Record<string, unknown>;\n}\n\n/** What a caller can narrow the log by, in either direction (query or stream). */\nexport interface LogFilterOptions {\n    level?: string;\n    source?: string;\n    search?: string;\n    since?: string;\n}\n\n/**\n * A filter with the search term already lowercased.\n *\n * The distinction matters on the stream path: `query()` lowercases once and then\n * scans, but a subscriber tests one entry at a time and would otherwise redo the\n * same `toLowerCase()` on every request the server handles.\n */\ntype NormalizedFilter = LogFilterOptions;\n\nfunction normalizeFilter(options: LogFilterOptions): NormalizedFilter {\n    return { ...options,\n        search: options.search?.toLowerCase() };\n}\n\n/**\n * Whether one entry belongs in a filtered view.\n *\n * Shared by the query and the stream on purpose: two copies of this would drift,\n * and the failure that produces is invisible — a tail that quietly shows a\n * different set of lines than the snapshot it started from.\n */\nfunction matchesFilter(entry: LogEntry, filter: NormalizedFilter): boolean {\n    if (filter.level && entry.level !== filter.level) return false;\n    if (filter.source && entry.source !== filter.source) return false;\n    if (filter.search && !entry.message.toLowerCase().includes(filter.search)) return false;\n    if (filter.since && entry.timestamp < filter.since) return false;\n    return true;\n}\n\n/** Notified for every entry pushed, in push order. */\nexport type LogListener = (entry: LogEntry) => void;\n\nclass LogRingBuffer {\n    private buffer: LogEntry[] = [];\n    private maxSize: number;\n    private idCounter = 0;\n    private listeners = new Set<LogListener>();\n\n    constructor(maxSize = 10000) {\n        this.maxSize = maxSize;\n    }\n\n    push(entry: Omit<LogEntry, \"id\">): void {\n        const id = `log_${++this.idCounter}`;\n        const stored: LogEntry = { ...entry,\n            id };\n        this.buffer.push(stored);\n        if (this.buffer.length > this.maxSize) {\n            this.buffer.shift();\n        }\n        // This runs on the request hot path, so a listener must never be able to\n        // take the request down with it: a tail that throws loses its own tail,\n        // not the response the log line was describing.\n        for (const listener of this.listeners) {\n            try {\n                listener(stored);\n            } catch {\n                /* a broken tail is not the request's problem */\n            }\n        }\n    }\n\n    /**\n     * Follow the buffer. Returns the unsubscribe — call it, always: a listener\n     * left behind holds its whole closure, and on this class that closure is a\n     * pending-entry array.\n     *\n     * A listener must not log. It is called from inside `push`, so anything that\n     * reaches `addLog` from here recurses until the stack gives out.\n     */\n    subscribe(listener: LogListener): () => void {\n        this.listeners.add(listener);\n        return () => {\n            this.listeners.delete(listener);\n        };\n    }\n\n    query(options: LogFilterOptions & {\n        limit?: number;\n        offset?: number;\n    }): { entries: LogEntry[]; total: number } {\n        const filter = normalizeFilter(options);\n        const filtered = this.buffer.filter(e => matchesFilter(e, filter));\n\n        // Newest first\n        const sorted = [...filtered].reverse();\n        const total = sorted.length;\n        const limit = options.limit || 100;\n        const offset = options.offset || 0;\n\n        return {\n            entries: sorted.slice(offset, offset + limit),\n            total\n        };\n    }\n\n    getLatest(count = 50): LogEntry[] {\n        return this.buffer.slice(-count).reverse();\n    }\n}\n\n// Global singleton\nexport const logBuffer = new LogRingBuffer();\n\n/** Add a log entry */\nexport function addLog(\n    level: LogEntry[\"level\"],\n    source: LogEntry[\"source\"],\n    message: string,\n    metadata?: Record<string, unknown>\n): void {\n    logBuffer.push({\n        timestamp: new Date().toISOString(),\n        level,\n        source,\n        message,\n        metadata\n    });\n}\n\nexport interface LogMiddlewareOptions {\n    /**\n     * Paths this sink ignores, matched exactly against `c.req.path`.\n     *\n     * For requests whose only reason to exist is to read the log. Recording\n     * those makes the reader the loudest thing in its own output, and on a quiet\n     * server it is also the thing evicting real entries out of the ring.\n     */\n    ignorePaths?: string[];\n}\n\n/** Hono middleware to log API requests */\nexport function logMiddleware(options: LogMiddlewareOptions = {}): MiddlewareHandler<HonoEnv> {\n    const ignored = new Set(options.ignorePaths ?? []);\n    return async (c, next) => {\n        const start = Date.now();\n        await next();\n        if (ignored.has(c.req.path)) return;\n        const duration = Date.now() - start;\n        const reqId = c.get(\"requestId\");\n        // Every request used to be recorded at `info`, whatever it answered, so\n        // the Logs Explorer's level filter could not find a single failure: a\n        // 500 sat at the same level as the 200 above it, in a wall of them.\n        const status = c.res.status;\n        const level: LogEntry[\"level\"] = status >= 500 ? \"error\" : status >= 400 ? \"warn\" : \"info\";\n        // What the error handler answered, so the failure is on the entry\n        // rather than in a stdout line the panel cannot see. See\n        // `HonoEnv.Variables.errorSummary`.\n        const failure = c.get(\"errorSummary\");\n        addLog(\n            level,\n            \"api\",\n            `${c.req.method} ${c.req.path} ${status} ${duration}ms`\n                + (failure ? ` — ${failure.code}: ${failure.message}` : \"\"),\n            {\n                method: c.req.method,\n                path: c.req.path,\n                status,\n                duration,\n                ...(reqId && { requestId: reqId }),\n                ...(c.get(\"collection\") && { collection: c.get(\"collection\") }),\n                ...(failure && { errorCode: failure.code, errorMessage: failure.message })\n            }\n        );\n    };\n}\n\n/**\n * Prefixes the server writes at the head of a log message, and the `source`\n * each one belongs to.\n *\n * The ring's `source` is a closed set the Studio filters on, and the messages\n * carry their origin as a bracketed prefix — `[API]`, `[Auth]`, `[functions]`,\n * `[schema]`. Matching them is what makes a teed line filterable beside the\n * request entries rather than a heap under \"system\".\n */\nconst SOURCE_BY_PREFIX: Array<[RegExp, LogEntry[\"source\"]]> = [\n    [/^\\[?(api|rest)\\b/i, \"api\"],\n    [/^\\[?auth\\b/i, \"auth\"],\n    [/^\\[?(storage|s3|gcs)\\b/i, \"storage\"],\n    [/^\\[?(realtime|ws|websocket|cdc)\\b/i, \"realtime\"]\n];\n\n/**\n * The `source` for a teed line, from whatever prefix it carries.\n *\n * Exported for its test: the mapping is a string match on wording somebody else\n * writes, which is the shape of check that stops working without failing.\n */\nexport function sourceForMessage(message: string): LogEntry[\"source\"] {\n    // The level emoji comes first on several call sites (`⚠️ [API] …`), so the\n    // prefix is whatever is inside the first bracket, wherever that is.\n    const bracketed = message.match(/\\[([^\\]]{1,32})\\]/);\n    const candidate = bracketed?.[1] ?? message;\n    for (const [pattern, source] of SOURCE_BY_PREFIX) {\n        if (pattern.test(candidate)) return source;\n    }\n    return \"system\";\n}\n\n/**\n * Feed the Logs Explorer everything the server says at warn and above.\n *\n * The ring used to be filled by `logMiddleware` alone, so the panel showed a\n * wall of `GET /api/data/posts 200 4ms` and not one of the errors, warnings or\n * boot diagnoses being written to stdout at the same moment. A function that\n * threw was the sharpest case: the request entry said `500` and the reason\n * existed only in a terminal the person looking at the panel does not have.\n *\n * Warn and above, deliberately. `info` is where the steady-state chatter lives,\n * and a 10,000-entry ring filled with it evicts the lines somebody opened the\n * panel to find.\n *\n * Idempotent: called from `createLogsRoutes`, which a split deployment may\n * reach more than once.\n */\nlet detachLoggerTee: (() => void) | undefined;\nexport function teeLoggerIntoLogBuffer(): () => void {\n    if (detachLoggerTee) return detachLoggerTee;\n    const detach = addLogSink((level, message, data) => {\n        if (level !== \"warn\" && level !== \"error\") return;\n        // `requestLogger` writes this one to stdout for every request, and\n        // `logMiddleware` has already recorded the same request here with the\n        // fields this panel renders. Teeing it too would double every failure.\n        if (message === \"request\") return;\n        addLog(level, sourceForMessage(message), message, Object.keys(data).length > 0 ? data : undefined);\n    });\n    detachLoggerTee = () => {\n        detach();\n        detachLoggerTee = undefined;\n    };\n    return detachLoggerTee;\n}\n\n/**\n * How long entries accumulate before a batch goes out.\n *\n * Not zero, and that is the point. A busy server logs faster than a browser can\n * render, and one SSE frame per line would hand the client a re-render per\n * request served — worse than the 3s poll this replaces, precisely when the logs\n * are worth watching. Coalescing keeps the frame rate bounded by the window\n * rather than by traffic, and 250ms still reads as \"live\" to a person.\n */\nconst STREAM_FLUSH_MS = 250;\n\n/**\n * Idle gap after which the stream sends a comment line.\n *\n * A silent SSE connection is indistinguishable from a dead one to everything in\n * between — proxies, load balancers and laptop NICs all reap idle sockets, and a\n * server with nothing to say is the normal state here.\n */\nconst STREAM_HEARTBEAT_MS = 25_000;\n\n/**\n * Entries a single connection will hold between flushes.\n *\n * This is a *rate* ceiling, not just a memory bound, and that is easy to get\n * wrong: nothing drains `pending` between flushes, so the most a connection can\n * carry losslessly is `maxPending` per `flushMs` — here 2000 per 250ms, or 8000\n * entries a second. Above that the oldest pending entries go and the client is\n * told how many, whatever speed it is reading at.\n *\n * It was 500, which put that ceiling at 2000/s. A healthy reader on a loopback\n * socket lost 85% of a 20k burst to it — the cap fired on the server's own\n * coalescing window rather than on any slowness at the client, which is a drop\n * notice that says nothing true about why. 8000/s is past what one Node process\n * serves, so reaching it now means genuinely more log than a person can be shown.\n *\n * The memory this bounds is the copy a *stalled* reader causes: roughly 2000\n * entries, a few MB, per stuck connection.\n */\nconst STREAM_MAX_PENDING = 2000;\n\n/**\n * The largest window any of these routes will hand back.\n *\n * The ring buffer holds 10,000 entries, so asking for more than all of it is a\n * mistake worth naming rather than silently clamping — and a clamped answer is\n * indistinguishable from \"that is all there is\".\n */\nconst LOG_WINDOW_MAX = 10_000;\n\n/**\n * The stream's timings, injectable only so they can be tested.\n *\n * The defaults above are the contract and nothing in production passes this. A\n * heartbeat is a 25-second wait to observe, and a suite that cannot observe it is\n * a suite where the keepalive can rot — which surfaces as \"the tail dies after a\n * few minutes behind the load balancer\", months later, on someone else's cluster.\n */\nexport interface LogStreamTiming {\n    flushMs?: number;\n    heartbeatMs?: number;\n    maxPending?: number;\n}\n\nexport function createLogsRoutes(timing: LogStreamTiming = {}): Hono<HonoEnv> {\n    // Here rather than at module load: the ring exists whether or not anything\n    // reads it, but there is no reason to fill it on a process that serves no\n    // logs surface. Idempotent, so the repeated calls a split deployment makes\n    // do not stack up sinks.\n    teeLoggerIntoLogBuffer();\n\n    const flushMs = timing.flushMs ?? STREAM_FLUSH_MS;\n    const heartbeatMs = timing.heartbeatMs ?? STREAM_HEARTBEAT_MS;\n    const maxPending = timing.maxPending ?? STREAM_MAX_PENDING;\n\n    const app = new Hono<HonoEnv>();\n    // Its own, like every other router here: nothing registers one on the host\n    // app — not `boot.ts`, not the scaffolded backend, not the eject template —\n    // so a router that throws without this answers Hono's default 500 in plain\n    // text, outside the `{ error: { code, message } }` envelope the rest of the\n    // API keeps to.\n    app.onError(errorHandler);\n\n    /**\n     * A window into the ring buffer, or a 400 saying why not.\n     *\n     * `parseInt` was the whole of it before, and every malformed value failed\n     * differently and silently: `?limit=abc` fell through to the default,\n     * `?limit=-5` sliced an empty window and answered 200 with no entries, and\n     * `?count=abc` made `slice(-NaN)` return the *entire* buffer. Three ways to\n     * be wrong, none of them visible to the caller. The data plane refuses the\n     * same input with a 400 — see `resolveListLimitParam`.\n     */\n    const window = (raw: string | undefined, what: string, max: number): number | undefined => {\n        if (raw === undefined || raw.trim() === \"\") return undefined;\n        const parsed = Number(raw.trim());\n        if (!Number.isInteger(parsed) || parsed < 1 || parsed > max) {\n            throw new ApiError(\n                400,\n                \"INVALID_PARAM\",\n                `Invalid \\`${what}\\`: ${raw}. Expected a whole number between 1 and ${max}.`,\n                undefined,\n                true\n            );\n        }\n        return parsed;\n    };\n\n    // GET /api/logs — Query logs\n    app.get(\"/\", (c) => {\n        const query = c.req.query();\n        const result = logBuffer.query({\n            level: query.level,\n            source: query.source,\n            search: query.search,\n            limit: window(query.limit, \"limit\", LOG_WINDOW_MAX),\n            offset: window(query.offset, \"offset\", Number.MAX_SAFE_INTEGER),\n            since: query.since\n        });\n        return c.json(result);\n    });\n\n    // GET /api/logs/latest — Get latest logs (for real-time)\n    app.get(\"/latest\", (c) => {\n        const count = window(c.req.query(\"count\"), \"count\", LOG_WINDOW_MAX) ?? 50;\n        return c.json({ entries: logBuffer.getLatest(count) });\n    });\n\n    // GET /api/logs/stream — tail the buffer over SSE.\n    //\n    // The Logs Explorer used to poll this router every 3 seconds, which cost a\n    // request per client per 3s to say \"nothing happened\" and still showed each\n    // line up to 3s late. Here the buffer pushes instead, so an idle server is an\n    // idle socket.\n    //\n    // Events:\n    //   snapshot  {entries, total}   the filtered window, oldest-first, at open\n    //   append    {entries, dropped} entries since the last frame, oldest-first\n    //   `: ping`                     comment, keepalive only\n    //\n    // Snapshot and appends come down the same connection deliberately. A client\n    // that fetched its backlog separately would race the subscription — entries\n    // logged between the two calls belong to neither — and closing that race from\n    // the outside needs an id cursor and dedupe on every frame.\n    app.get(\"/stream\", (c) => {\n        const query = c.req.query();\n        const filter = normalizeFilter({\n            level: query.level,\n            source: query.source,\n            search: query.search\n        });\n        const limit = window(query.limit, \"limit\", LOG_WINDOW_MAX) ?? 200;\n\n        // Reverse proxies buffer text responses by default, which turns a live\n        // tail into nothing at all until the buffer fills. nginx (and the ingress\n        // in front of the managed runtime) reads this header; everything else\n        // ignores it. The rest of the SSE headers are set by `streamSSE`.\n        c.header(\"X-Accel-Buffering\", \"no\");\n\n        return streamSSE(c, async (stream) => {\n            let pending: LogEntry[] = [];\n            let dropped = 0;\n\n            // Subscribe *before* reading the backlog, with nothing awaited\n            // between the two. Both are synchronous, so the two halves meet\n            // exactly: an entry logged after the query but before the\n            // subscription would otherwise be in neither, and that gap is the one\n            // thing this route exists to close.\n            const unsubscribe = logBuffer.subscribe(entry => {\n                if (!matchesFilter(entry, filter)) return;\n                if (pending.length >= maxPending) {\n                    pending.shift();\n                    dropped++;\n                }\n                pending.push(entry);\n            });\n            const snapshot = logBuffer.query({ ...filter,\n                limit });\n\n            // A client that goes away has to end this handler, or the\n            // subscription outlives the socket. `streamSSE` only wires the\n            // request signal through on old Bun, so do it here and let\n            // `stream.aborted` be the one condition the loop tests.\n            //\n            // The `aborted` check is not belt-and-braces. A listener added to an\n            // already-aborted signal is never called, so a client that leaves\n            // during the snapshot write — a fast navigation, or a reconnect storm\n            // against a restarting server — would leave this handler with no way\n            // to learn it had gone: a subscriber and a flush loop, per attempt,\n            // for the life of the process.\n            const abortOnDisconnect = () => {\n                if (!stream.closed) stream.abort();\n            };\n            c.req.raw.signal.addEventListener(\"abort\", abortOnDisconnect, { once: true });\n            if (c.req.raw.signal.aborted) abortOnDisconnect();\n\n            try {\n                await stream.writeSSE({\n                    event: \"snapshot\",\n                    // The view tails like a terminal; both frames are oldest-first\n                    // so the client only ever appends.\n                    data: JSON.stringify({\n                        entries: snapshot.entries.slice().reverse(),\n                        total: snapshot.total\n                    })\n                });\n\n                let idleMs = 0;\n                while (!stream.aborted && !stream.closed) {\n                    await stream.sleep(flushMs);\n                    if (stream.aborted || stream.closed) break;\n\n                    if (pending.length === 0) {\n                        idleMs += flushMs;\n                        if (idleMs >= heartbeatMs) {\n                            await stream.write(\": ping\\n\\n\");\n                            idleMs = 0;\n                        }\n                        continue;\n                    }\n\n                    const entries = pending;\n                    const lost = dropped;\n                    pending = [];\n                    dropped = 0;\n                    idleMs = 0;\n                    await stream.writeSSE({\n                        event: \"append\",\n                        data: JSON.stringify(lost > 0 ? { entries,\n                            dropped: lost } : { entries })\n                    });\n                }\n            } finally {\n                unsubscribe();\n                c.req.raw.signal.removeEventListener(\"abort\", abortOnDisconnect);\n            }\n        });\n    });\n\n    return app;\n}\n\nexport default createLogsRoutes();\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAiCA,SAAS,gBAAgB,SAA6C;CAClE,OAAO;EAAE,GAAG;EACR,QAAQ,QAAQ,QAAQ,YAAY;CAAE;AAC9C;;;;;;;;AASA,SAAS,cAAc,OAAiB,QAAmC;CACvE,IAAI,OAAO,SAAS,MAAM,UAAU,OAAO,OAAO,OAAO;CACzD,IAAI,OAAO,UAAU,MAAM,WAAW,OAAO,QAAQ,OAAO;CAC5D,IAAI,OAAO,UAAU,CAAC,MAAM,QAAQ,YAAY,CAAC,CAAC,SAAS,OAAO,MAAM,GAAG,OAAO;CAClF,IAAI,OAAO,SAAS,MAAM,YAAY,OAAO,OAAO,OAAO;CAC3D,OAAO;AACX;AAKA,IAAM,gBAAN,MAAoB;CAChB,SAA6B,CAAC;CAC9B;CACA,YAAoB;CACpB,4BAAoB,IAAI,IAAiB;CAEzC,YAAY,UAAU,KAAO;EACzB,KAAK,UAAU;CACnB;CAEA,KAAK,OAAmC;EACpC,MAAM,KAAK,OAAO,EAAE,KAAK;EACzB,MAAM,SAAmB;GAAE,GAAG;GAC1B;EAAG;EACP,KAAK,OAAO,KAAK,MAAM;EACvB,IAAI,KAAK,OAAO,SAAS,KAAK,SAC1B,KAAK,OAAO,MAAM;EAKtB,KAAK,MAAM,YAAY,KAAK,WACxB,IAAI;GACA,SAAS,MAAM;EACnB,QAAQ,CAER;CAER;;;;;;;;;CAUA,UAAU,UAAmC;EACzC,KAAK,UAAU,IAAI,QAAQ;EAC3B,aAAa;GACT,KAAK,UAAU,OAAO,QAAQ;EAClC;CACJ;CAEA,MAAM,SAGqC;EACvC,MAAM,SAAS,gBAAgB,OAAO;EAItC,MAAM,SAAS,CAAC,GAHC,KAAK,OAAO,QAAO,MAAK,cAAc,GAAG,MAAM,CAG7C,CAAQ,CAAC,CAAC,QAAQ;EACrC,MAAM,QAAQ,OAAO;EACrB,MAAM,QAAQ,QAAQ,SAAS;EAC/B,MAAM,SAAS,QAAQ,UAAU;EAEjC,OAAO;GACH,SAAS,OAAO,MAAM,QAAQ,SAAS,KAAK;GAC5C;EACJ;CACJ;CAEA,UAAU,QAAQ,IAAgB;EAC9B,OAAO,KAAK,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ;CAC7C;AACJ;AAGA,IAAa,YAAY,IAAI,cAAc;;AAG3C,SAAgB,OACZ,OACA,QACA,SACA,UACI;CACJ,UAAU,KAAK;EACX,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;EAClC;EACA;EACA;EACA;CACJ,CAAC;AACL;;AAcA,SAAgB,cAAc,UAAgC,CAAC,GAA+B;CAC1F,MAAM,UAAU,IAAI,IAAI,QAAQ,eAAe,CAAC,CAAC;CACjD,OAAO,OAAO,GAAG,SAAS;EACtB,MAAM,QAAQ,KAAK,IAAI;EACvB,MAAM,KAAK;EACX,IAAI,QAAQ,IAAI,EAAE,IAAI,IAAI,GAAG;EAC7B,MAAM,WAAW,KAAK,IAAI,IAAI;EAC9B,MAAM,QAAQ,EAAE,IAAI,WAAW;EAI/B,MAAM,SAAS,EAAE,IAAI;EACrB,MAAM,QAA2B,UAAU,MAAM,UAAU,UAAU,MAAM,SAAS;EAIpF,MAAM,UAAU,EAAE,IAAI,cAAc;EACpC,OACI,OACA,OACA,GAAG,EAAE,IAAI,OAAO,GAAG,EAAE,IAAI,KAAK,GAAG,OAAO,GAAG,SAAS,OAC7C,UAAU,MAAM,QAAQ,KAAK,IAAI,QAAQ,YAAY,KAC5D;GACI,QAAQ,EAAE,IAAI;GACd,MAAM,EAAE,IAAI;GACZ;GACA;GACA,GAAI,SAAS,EAAE,WAAW,MAAM;GAChC,GAAI,EAAE,IAAI,YAAY,KAAK,EAAE,YAAY,EAAE,IAAI,YAAY,EAAE;GAC7D,GAAI,WAAW;IAAE,WAAW,QAAQ;IAAM,cAAc,QAAQ;GAAQ;EAC5E,CACJ;CACJ;AACJ;;;;;;;;;;AAWA,IAAM,mBAAwD;CAC1D,CAAC,qBAAqB,KAAK;CAC3B,CAAC,eAAe,MAAM;CACtB,CAAC,2BAA2B,SAAS;CACrC,CAAC,sCAAsC,UAAU;AACrD;;;;;;;AAQA,SAAgB,iBAAiB,SAAqC;CAIlE,MAAM,YADY,QAAQ,MAAM,mBACd,CAAA,GAAY,MAAM;CACpC,KAAK,MAAM,CAAC,SAAS,WAAW,kBAC5B,IAAI,QAAQ,KAAK,SAAS,GAAG,OAAO;CAExC,OAAO;AACX;;;;;;;;;;;;;;;;;AAkBA,IAAI;AACJ,SAAgB,yBAAqC;CACjD,IAAI,iBAAiB,OAAO;CAC5B,MAAM,SAAS,YAAY,OAAO,SAAS,SAAS;EAChD,IAAI,UAAU,UAAU,UAAU,SAAS;EAI3C,IAAI,YAAY,WAAW;EAC3B,OAAO,OAAO,iBAAiB,OAAO,GAAG,SAAS,OAAO,KAAK,IAAI,CAAC,CAAC,SAAS,IAAI,OAAO,KAAA,CAAS;CACrG,CAAC;CACD,wBAAwB;EACpB,OAAO;EACP,kBAAkB,KAAA;CACtB;CACA,OAAO;AACX;;;;;;;;;;AAWA,IAAM,kBAAkB;;;;;;;;AASxB,IAAM,sBAAsB;;;;;;;;;;;;;;;;;;;AAoB5B,IAAM,qBAAqB;;;;;;;;AAS3B,IAAM,iBAAiB;AAgBvB,SAAgB,iBAAiB,SAA0B,CAAC,GAAkB;CAK1E,uBAAuB;CAEvB,MAAM,UAAU,OAAO,WAAW;CAClC,MAAM,cAAc,OAAO,eAAe;CAC1C,MAAM,aAAa,OAAO,cAAc;CAExC,MAAM,MAAM,IAAI,KAAc;CAM9B,IAAI,QAAQ,YAAY;;;;;;;;;;;CAYxB,MAAM,UAAU,KAAyB,MAAc,QAAoC;EACvF,IAAI,QAAQ,KAAA,KAAa,IAAI,KAAK,MAAM,IAAI,OAAO,KAAA;EACnD,MAAM,SAAS,OAAO,IAAI,KAAK,CAAC;EAChC,IAAI,CAAC,OAAO,UAAU,MAAM,KAAK,SAAS,KAAK,SAAS,KACpD,MAAM,IAAI,SACN,KACA,iBACA,aAAa,KAAK,MAAM,IAAI,0CAA0C,IAAI,IAC1E,KAAA,GACA,IACJ;EAEJ,OAAO;CACX;CAGA,IAAI,IAAI,MAAM,MAAM;EAChB,MAAM,QAAQ,EAAE,IAAI,MAAM;EAC1B,MAAM,SAAS,UAAU,MAAM;GAC3B,OAAO,MAAM;GACb,QAAQ,MAAM;GACd,QAAQ,MAAM;GACd,OAAO,OAAO,MAAM,OAAO,SAAS,cAAc;GAClD,QAAQ,OAAO,MAAM,QAAQ,UAAU,OAAO,gBAAgB;GAC9D,OAAO,MAAM;EACjB,CAAC;EACD,OAAO,EAAE,KAAK,MAAM;CACxB,CAAC;CAGD,IAAI,IAAI,YAAY,MAAM;EACtB,MAAM,QAAQ,OAAO,EAAE,IAAI,MAAM,OAAO,GAAG,SAAS,cAAc,KAAK;EACvE,OAAO,EAAE,KAAK,EAAE,SAAS,UAAU,UAAU,KAAK,EAAE,CAAC;CACzD,CAAC;CAkBD,IAAI,IAAI,YAAY,MAAM;EACtB,MAAM,QAAQ,EAAE,IAAI,MAAM;EAC1B,MAAM,SAAS,gBAAgB;GAC3B,OAAO,MAAM;GACb,QAAQ,MAAM;GACd,QAAQ,MAAM;EAClB,CAAC;EACD,MAAM,QAAQ,OAAO,MAAM,OAAO,SAAS,cAAc,KAAK;EAM9D,EAAE,OAAO,qBAAqB,IAAI;EAElC,OAAO,UAAU,GAAG,OAAO,WAAW;GAClC,IAAI,UAAsB,CAAC;GAC3B,IAAI,UAAU;GAOd,MAAM,cAAc,UAAU,WAAU,UAAS;IAC7C,IAAI,CAAC,cAAc,OAAO,MAAM,GAAG;IACnC,IAAI,QAAQ,UAAU,YAAY;KAC9B,QAAQ,MAAM;KACd;IACJ;IACA,QAAQ,KAAK,KAAK;GACtB,CAAC;GACD,MAAM,WAAW,UAAU,MAAM;IAAE,GAAG;IAClC;GAAM,CAAC;GAaX,MAAM,0BAA0B;IAC5B,IAAI,CAAC,OAAO,QAAQ,OAAO,MAAM;GACrC;GACA,EAAE,IAAI,IAAI,OAAO,iBAAiB,SAAS,mBAAmB,EAAE,MAAM,KAAK,CAAC;GAC5E,IAAI,EAAE,IAAI,IAAI,OAAO,SAAS,kBAAkB;GAEhD,IAAI;IACA,MAAM,OAAO,SAAS;KAClB,OAAO;KAGP,MAAM,KAAK,UAAU;MACjB,SAAS,SAAS,QAAQ,MAAM,CAAC,CAAC,QAAQ;MAC1C,OAAO,SAAS;KACpB,CAAC;IACL,CAAC;IAED,IAAI,SAAS;IACb,OAAO,CAAC,OAAO,WAAW,CAAC,OAAO,QAAQ;KACtC,MAAM,OAAO,MAAM,OAAO;KAC1B,IAAI,OAAO,WAAW,OAAO,QAAQ;KAErC,IAAI,QAAQ,WAAW,GAAG;MACtB,UAAU;MACV,IAAI,UAAU,aAAa;OACvB,MAAM,OAAO,MAAM,YAAY;OAC/B,SAAS;MACb;MACA;KACJ;KAEA,MAAM,UAAU;KAChB,MAAM,OAAO;KACb,UAAU,CAAC;KACX,UAAU;KACV,SAAS;KACT,MAAM,OAAO,SAAS;MAClB,OAAO;MACP,MAAM,KAAK,UAAU,OAAO,IAAI;OAAE;OAC9B,SAAS;MAAK,IAAI,EAAE,QAAQ,CAAC;KACrC,CAAC;IACL;GACJ,UAAU;IACN,YAAY;IACZ,EAAE,IAAI,IAAI,OAAO,oBAAoB,SAAS,iBAAiB;GACnE;EACJ,CAAC;CACL,CAAC;CAED,OAAO;AACX;AAEA,IAAA,sBAAe,iBAAiB"}
+{"version":3,"file":"logs-routes-Bj4TYYUl.js","names":[],"sources":["../src/api/logs-routes.ts"],"sourcesContent":["import { Hono } from \"hono\";\nimport type { MiddlewareHandler } from \"hono\";\nimport { streamSSE } from \"hono/streaming\";\nimport type { HonoEnv } from \"./types\";\nimport { ApiError, errorHandler } from \"./errors\";\nimport { addLogSink } from \"../utils/logger\";\n\nexport interface LogEntry {\n    id: string;\n    timestamp: string;\n    level: \"debug\" | \"info\" | \"warn\" | \"error\";\n    source: \"api\" | \"auth\" | \"storage\" | \"realtime\" | \"system\";\n    message: string;\n    metadata?: Record<string, unknown>;\n}\n\n/** What a caller can narrow the log by, in either direction (query or stream). */\nexport interface LogFilterOptions {\n    level?: string;\n    source?: string;\n    search?: string;\n    since?: string;\n}\n\n/**\n * A filter with the search term already lowercased.\n *\n * The distinction matters on the stream path: `query()` lowercases once and then\n * scans, but a subscriber tests one entry at a time and would otherwise redo the\n * same `toLowerCase()` on every request the server handles.\n */\ntype NormalizedFilter = LogFilterOptions;\n\nfunction normalizeFilter(options: LogFilterOptions): NormalizedFilter {\n    return { ...options,\n        search: options.search?.toLowerCase() };\n}\n\n/**\n * Whether one entry belongs in a filtered view.\n *\n * Shared by the query and the stream on purpose: two copies of this would drift,\n * and the failure that produces is invisible — a tail that quietly shows a\n * different set of lines than the snapshot it started from.\n */\nfunction matchesFilter(entry: LogEntry, filter: NormalizedFilter): boolean {\n    if (filter.level && entry.level !== filter.level) return false;\n    if (filter.source && entry.source !== filter.source) return false;\n    if (filter.search && !entry.message.toLowerCase().includes(filter.search)) return false;\n    if (filter.since && entry.timestamp < filter.since) return false;\n    return true;\n}\n\n/** Notified for every entry pushed, in push order. */\nexport type LogListener = (entry: LogEntry) => void;\n\nclass LogRingBuffer {\n    private buffer: LogEntry[] = [];\n    private maxSize: number;\n    private idCounter = 0;\n    private listeners = new Set<LogListener>();\n\n    constructor(maxSize = 10000) {\n        this.maxSize = maxSize;\n    }\n\n    push(entry: Omit<LogEntry, \"id\">): void {\n        const id = `log_${++this.idCounter}`;\n        const stored: LogEntry = { ...entry,\n            id };\n        this.buffer.push(stored);\n        if (this.buffer.length > this.maxSize) {\n            this.buffer.shift();\n        }\n        // This runs on the request hot path, so a listener must never be able to\n        // take the request down with it: a tail that throws loses its own tail,\n        // not the response the log line was describing.\n        for (const listener of this.listeners) {\n            try {\n                listener(stored);\n            } catch {\n                /* a broken tail is not the request's problem */\n            }\n        }\n    }\n\n    /**\n     * Follow the buffer. Returns the unsubscribe — call it, always: a listener\n     * left behind holds its whole closure, and on this class that closure is a\n     * pending-entry array.\n     *\n     * A listener must not log. It is called from inside `push`, so anything that\n     * reaches `addLog` from here recurses until the stack gives out.\n     */\n    subscribe(listener: LogListener): () => void {\n        this.listeners.add(listener);\n        return () => {\n            this.listeners.delete(listener);\n        };\n    }\n\n    query(options: LogFilterOptions & {\n        limit?: number;\n        offset?: number;\n    }): { entries: LogEntry[]; total: number } {\n        const filter = normalizeFilter(options);\n        const filtered = this.buffer.filter(e => matchesFilter(e, filter));\n\n        // Newest first\n        const sorted = [...filtered].reverse();\n        const total = sorted.length;\n        const limit = options.limit || 100;\n        const offset = options.offset || 0;\n\n        return {\n            entries: sorted.slice(offset, offset + limit),\n            total\n        };\n    }\n\n    getLatest(count = 50): LogEntry[] {\n        return this.buffer.slice(-count).reverse();\n    }\n}\n\n// Global singleton\nexport const logBuffer = new LogRingBuffer();\n\n/** Add a log entry */\nexport function addLog(\n    level: LogEntry[\"level\"],\n    source: LogEntry[\"source\"],\n    message: string,\n    metadata?: Record<string, unknown>\n): void {\n    logBuffer.push({\n        timestamp: new Date().toISOString(),\n        level,\n        source,\n        message,\n        metadata\n    });\n}\n\nexport interface LogMiddlewareOptions {\n    /**\n     * Paths this sink ignores, matched exactly against `c.req.path`.\n     *\n     * For requests whose only reason to exist is to read the log. Recording\n     * those makes the reader the loudest thing in its own output, and on a quiet\n     * server it is also the thing evicting real entries out of the ring.\n     */\n    ignorePaths?: string[];\n}\n\n/** Hono middleware to log API requests */\nexport function logMiddleware(options: LogMiddlewareOptions = {}): MiddlewareHandler<HonoEnv> {\n    const ignored = new Set(options.ignorePaths ?? []);\n    return async (c, next) => {\n        const start = Date.now();\n        await next();\n        if (ignored.has(c.req.path)) return;\n        const duration = Date.now() - start;\n        const reqId = c.get(\"requestId\");\n        // Every request used to be recorded at `info`, whatever it answered, so\n        // the Logs Explorer's level filter could not find a single failure: a\n        // 500 sat at the same level as the 200 above it, in a wall of them.\n        const status = c.res.status;\n        const level: LogEntry[\"level\"] = status >= 500 ? \"error\" : status >= 400 ? \"warn\" : \"info\";\n        // What the error handler answered, so the failure is on the entry\n        // rather than in a stdout line the panel cannot see. See\n        // `HonoEnv.Variables.errorSummary`.\n        const failure = c.get(\"errorSummary\");\n        addLog(\n            level,\n            \"api\",\n            `${c.req.method} ${c.req.path} ${status} ${duration}ms`\n                + (failure ? ` — ${failure.code}: ${failure.message}` : \"\"),\n            {\n                method: c.req.method,\n                path: c.req.path,\n                status,\n                duration,\n                ...(reqId && { requestId: reqId }),\n                ...(c.get(\"collection\") && { collection: c.get(\"collection\") }),\n                ...(failure && { errorCode: failure.code, errorMessage: failure.message })\n            }\n        );\n    };\n}\n\n/**\n * Prefixes the server writes at the head of a log message, and the `source`\n * each one belongs to.\n *\n * The ring's `source` is a closed set the Studio filters on, and the messages\n * carry their origin as a bracketed prefix — `[API]`, `[Auth]`, `[functions]`,\n * `[schema]`. Matching them is what makes a teed line filterable beside the\n * request entries rather than a heap under \"system\".\n */\nconst SOURCE_BY_PREFIX: Array<[RegExp, LogEntry[\"source\"]]> = [\n    [/^\\[?(api|rest)\\b/i, \"api\"],\n    [/^\\[?auth\\b/i, \"auth\"],\n    [/^\\[?(storage|s3|gcs)\\b/i, \"storage\"],\n    [/^\\[?(realtime|ws|websocket|cdc)\\b/i, \"realtime\"]\n];\n\n/**\n * The `source` for a teed line, from whatever prefix it carries.\n *\n * Exported for its test: the mapping is a string match on wording somebody else\n * writes, which is the shape of check that stops working without failing.\n */\nexport function sourceForMessage(message: string): LogEntry[\"source\"] {\n    // The level emoji comes first on several call sites (`⚠️ [API] …`), so the\n    // prefix is whatever is inside the first bracket, wherever that is.\n    const bracketed = message.match(/\\[([^\\]]{1,32})\\]/);\n    const candidate = bracketed?.[1] ?? message;\n    for (const [pattern, source] of SOURCE_BY_PREFIX) {\n        if (pattern.test(candidate)) return source;\n    }\n    return \"system\";\n}\n\n/**\n * Feed the Logs Explorer everything the server says at warn and above.\n *\n * The ring used to be filled by `logMiddleware` alone, so the panel showed a\n * wall of `GET /api/data/posts 200 4ms` and not one of the errors, warnings or\n * boot diagnoses being written to stdout at the same moment. A function that\n * threw was the sharpest case: the request entry said `500` and the reason\n * existed only in a terminal the person looking at the panel does not have.\n *\n * Warn and above, deliberately. `info` is where the steady-state chatter lives,\n * and a 10,000-entry ring filled with it evicts the lines somebody opened the\n * panel to find.\n *\n * Idempotent: called from `createLogsRoutes`, which a split deployment may\n * reach more than once.\n */\nlet detachLoggerTee: (() => void) | undefined;\nexport function teeLoggerIntoLogBuffer(): () => void {\n    if (detachLoggerTee) return detachLoggerTee;\n    const detach = addLogSink((level, message, data) => {\n        if (level !== \"warn\" && level !== \"error\") return;\n        // `requestLogger` writes this one to stdout for every request, and\n        // `logMiddleware` has already recorded the same request here with the\n        // fields this panel renders. Teeing it too would double every failure.\n        if (message === \"request\") return;\n        addLog(level, sourceForMessage(message), message, Object.keys(data).length > 0 ? data : undefined);\n    });\n    detachLoggerTee = () => {\n        detach();\n        detachLoggerTee = undefined;\n    };\n    return detachLoggerTee;\n}\n\n/**\n * How long entries accumulate before a batch goes out.\n *\n * Not zero, and that is the point. A busy server logs faster than a browser can\n * render, and one SSE frame per line would hand the client a re-render per\n * request served — worse than the 3s poll this replaces, precisely when the logs\n * are worth watching. Coalescing keeps the frame rate bounded by the window\n * rather than by traffic, and 250ms still reads as \"live\" to a person.\n */\nconst STREAM_FLUSH_MS = 250;\n\n/**\n * Idle gap after which the stream sends a comment line.\n *\n * A silent SSE connection is indistinguishable from a dead one to everything in\n * between — proxies, load balancers and laptop NICs all reap idle sockets, and a\n * server with nothing to say is the normal state here.\n */\nconst STREAM_HEARTBEAT_MS = 25_000;\n\n/**\n * Entries a single connection will hold between flushes.\n *\n * This is a *rate* ceiling, not just a memory bound, and that is easy to get\n * wrong: nothing drains `pending` between flushes, so the most a connection can\n * carry losslessly is `maxPending` per `flushMs` — here 2000 per 250ms, or 8000\n * entries a second. Above that the oldest pending entries go and the client is\n * told how many, whatever speed it is reading at.\n *\n * It was 500, which put that ceiling at 2000/s. A healthy reader on a loopback\n * socket lost 85% of a 20k burst to it — the cap fired on the server's own\n * coalescing window rather than on any slowness at the client, which is a drop\n * notice that says nothing true about why. 8000/s is past what one Node process\n * serves, so reaching it now means genuinely more log than a person can be shown.\n *\n * The memory this bounds is the copy a *stalled* reader causes: roughly 2000\n * entries, a few MB, per stuck connection.\n */\nconst STREAM_MAX_PENDING = 2000;\n\n/**\n * The largest window any of these routes will hand back.\n *\n * The ring buffer holds 10,000 entries, so asking for more than all of it is a\n * mistake worth naming rather than silently clamping — and a clamped answer is\n * indistinguishable from \"that is all there is\".\n */\nconst LOG_WINDOW_MAX = 10_000;\n\n/**\n * The stream's timings, injectable only so they can be tested.\n *\n * The defaults above are the contract and nothing in production passes this. A\n * heartbeat is a 25-second wait to observe, and a suite that cannot observe it is\n * a suite where the keepalive can rot — which surfaces as \"the tail dies after a\n * few minutes behind the load balancer\", months later, on someone else's cluster.\n */\nexport interface LogStreamTiming {\n    flushMs?: number;\n    heartbeatMs?: number;\n    maxPending?: number;\n}\n\nexport function createLogsRoutes(timing: LogStreamTiming = {}): Hono<HonoEnv> {\n    // Here rather than at module load: the ring exists whether or not anything\n    // reads it, but there is no reason to fill it on a process that serves no\n    // logs surface. Idempotent, so the repeated calls a split deployment makes\n    // do not stack up sinks.\n    teeLoggerIntoLogBuffer();\n\n    const flushMs = timing.flushMs ?? STREAM_FLUSH_MS;\n    const heartbeatMs = timing.heartbeatMs ?? STREAM_HEARTBEAT_MS;\n    const maxPending = timing.maxPending ?? STREAM_MAX_PENDING;\n\n    const app = new Hono<HonoEnv>();\n    // Its own, like every other router here: nothing registers one on the host\n    // app — not `boot.ts`, not the scaffolded backend, not the eject template —\n    // so a router that throws without this answers Hono's default 500 in plain\n    // text, outside the `{ error: { code, message } }` envelope the rest of the\n    // API keeps to.\n    app.onError(errorHandler);\n\n    /**\n     * A window into the ring buffer, or a 400 saying why not.\n     *\n     * `parseInt` was the whole of it before, and every malformed value failed\n     * differently and silently: `?limit=abc` fell through to the default,\n     * `?limit=-5` sliced an empty window and answered 200 with no entries, and\n     * `?count=abc` made `slice(-NaN)` return the *entire* buffer. Three ways to\n     * be wrong, none of them visible to the caller. The data plane refuses the\n     * same input with a 400 — see `resolveListLimitParam`.\n     *\n     * `min` is 1 for a size and 0 for an offset: `?offset=0` is the first page,\n     * which is where every pager starts, and it was a 400.\n     */\n    const window = (raw: string | undefined, what: string, max: number, min = 1): number | undefined => {\n        if (raw === undefined || raw.trim() === \"\") return undefined;\n        const parsed = Number(raw.trim());\n        if (!Number.isInteger(parsed) || parsed < min || parsed > max) {\n            throw new ApiError(\n                400,\n                \"INVALID_PARAM\",\n                `Invalid \\`${what}\\`: ${raw}. Expected a whole number between ${min} and ${max}.`,\n                undefined,\n                true\n            );\n        }\n        return parsed;\n    };\n\n    // GET /api/logs — Query logs\n    app.get(\"/\", (c) => {\n        const query = c.req.query();\n        const result = logBuffer.query({\n            level: query.level,\n            source: query.source,\n            search: query.search,\n            limit: window(query.limit, \"limit\", LOG_WINDOW_MAX),\n            offset: window(query.offset, \"offset\", Number.MAX_SAFE_INTEGER, 0),\n            since: query.since\n        });\n        return c.json(result);\n    });\n\n    // GET /api/logs/latest — Get latest logs (for real-time)\n    app.get(\"/latest\", (c) => {\n        const count = window(c.req.query(\"count\"), \"count\", LOG_WINDOW_MAX) ?? 50;\n        return c.json({ entries: logBuffer.getLatest(count) });\n    });\n\n    // GET /api/logs/stream — tail the buffer over SSE.\n    //\n    // The Logs Explorer used to poll this router every 3 seconds, which cost a\n    // request per client per 3s to say \"nothing happened\" and still showed each\n    // line up to 3s late. Here the buffer pushes instead, so an idle server is an\n    // idle socket.\n    //\n    // Events:\n    //   snapshot  {entries, total}   the filtered window, oldest-first, at open\n    //   append    {entries, dropped} entries since the last frame, oldest-first\n    //   `: ping`                     comment, keepalive only\n    //\n    // Snapshot and appends come down the same connection deliberately. A client\n    // that fetched its backlog separately would race the subscription — entries\n    // logged between the two calls belong to neither — and closing that race from\n    // the outside needs an id cursor and dedupe on every frame.\n    app.get(\"/stream\", (c) => {\n        const query = c.req.query();\n        const filter = normalizeFilter({\n            level: query.level,\n            source: query.source,\n            search: query.search\n        });\n        const limit = window(query.limit, \"limit\", LOG_WINDOW_MAX) ?? 200;\n\n        // Reverse proxies buffer text responses by default, which turns a live\n        // tail into nothing at all until the buffer fills. nginx (and the ingress\n        // in front of the managed runtime) reads this header; everything else\n        // ignores it. The rest of the SSE headers are set by `streamSSE`.\n        c.header(\"X-Accel-Buffering\", \"no\");\n\n        return streamSSE(c, async (stream) => {\n            let pending: LogEntry[] = [];\n            let dropped = 0;\n\n            // Subscribe *before* reading the backlog, with nothing awaited\n            // between the two. Both are synchronous, so the two halves meet\n            // exactly: an entry logged after the query but before the\n            // subscription would otherwise be in neither, and that gap is the one\n            // thing this route exists to close.\n            const unsubscribe = logBuffer.subscribe(entry => {\n                if (!matchesFilter(entry, filter)) return;\n                if (pending.length >= maxPending) {\n                    pending.shift();\n                    dropped++;\n                }\n                pending.push(entry);\n            });\n            const snapshot = logBuffer.query({ ...filter,\n                limit });\n\n            // A client that goes away has to end this handler, or the\n            // subscription outlives the socket. `streamSSE` only wires the\n            // request signal through on old Bun, so do it here and let\n            // `stream.aborted` be the one condition the loop tests.\n            //\n            // The `aborted` check is not belt-and-braces. A listener added to an\n            // already-aborted signal is never called, so a client that leaves\n            // during the snapshot write — a fast navigation, or a reconnect storm\n            // against a restarting server — would leave this handler with no way\n            // to learn it had gone: a subscriber and a flush loop, per attempt,\n            // for the life of the process.\n            const abortOnDisconnect = () => {\n                if (!stream.closed) stream.abort();\n            };\n            c.req.raw.signal.addEventListener(\"abort\", abortOnDisconnect, { once: true });\n            if (c.req.raw.signal.aborted) abortOnDisconnect();\n\n            try {\n                await stream.writeSSE({\n                    event: \"snapshot\",\n                    // The view tails like a terminal; both frames are oldest-first\n                    // so the client only ever appends.\n                    data: JSON.stringify({\n                        entries: snapshot.entries.slice().reverse(),\n                        total: snapshot.total\n                    })\n                });\n\n                let idleMs = 0;\n                while (!stream.aborted && !stream.closed) {\n                    await stream.sleep(flushMs);\n                    if (stream.aborted || stream.closed) break;\n\n                    if (pending.length === 0) {\n                        idleMs += flushMs;\n                        if (idleMs >= heartbeatMs) {\n                            await stream.write(\": ping\\n\\n\");\n                            idleMs = 0;\n                        }\n                        continue;\n                    }\n\n                    const entries = pending;\n                    const lost = dropped;\n                    pending = [];\n                    dropped = 0;\n                    idleMs = 0;\n                    await stream.writeSSE({\n                        event: \"append\",\n                        data: JSON.stringify(lost > 0 ? { entries,\n                            dropped: lost } : { entries })\n                    });\n                }\n            } finally {\n                unsubscribe();\n                c.req.raw.signal.removeEventListener(\"abort\", abortOnDisconnect);\n            }\n        });\n    });\n\n    return app;\n}\n\nexport default createLogsRoutes();\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAiCA,SAAS,gBAAgB,SAA6C;CAClE,OAAO;EAAE,GAAG;EACR,QAAQ,QAAQ,QAAQ,YAAY;CAAE;AAC9C;;;;;;;;AASA,SAAS,cAAc,OAAiB,QAAmC;CACvE,IAAI,OAAO,SAAS,MAAM,UAAU,OAAO,OAAO,OAAO;CACzD,IAAI,OAAO,UAAU,MAAM,WAAW,OAAO,QAAQ,OAAO;CAC5D,IAAI,OAAO,UAAU,CAAC,MAAM,QAAQ,YAAY,CAAC,CAAC,SAAS,OAAO,MAAM,GAAG,OAAO;CAClF,IAAI,OAAO,SAAS,MAAM,YAAY,OAAO,OAAO,OAAO;CAC3D,OAAO;AACX;AAKA,IAAM,gBAAN,MAAoB;CAChB,SAA6B,CAAC;CAC9B;CACA,YAAoB;CACpB,4BAAoB,IAAI,IAAiB;CAEzC,YAAY,UAAU,KAAO;EACzB,KAAK,UAAU;CACnB;CAEA,KAAK,OAAmC;EACpC,MAAM,KAAK,OAAO,EAAE,KAAK;EACzB,MAAM,SAAmB;GAAE,GAAG;GAC1B;EAAG;EACP,KAAK,OAAO,KAAK,MAAM;EACvB,IAAI,KAAK,OAAO,SAAS,KAAK,SAC1B,KAAK,OAAO,MAAM;EAKtB,KAAK,MAAM,YAAY,KAAK,WACxB,IAAI;GACA,SAAS,MAAM;EACnB,QAAQ,CAER;CAER;;;;;;;;;CAUA,UAAU,UAAmC;EACzC,KAAK,UAAU,IAAI,QAAQ;EAC3B,aAAa;GACT,KAAK,UAAU,OAAO,QAAQ;EAClC;CACJ;CAEA,MAAM,SAGqC;EACvC,MAAM,SAAS,gBAAgB,OAAO;EAItC,MAAM,SAAS,CAAC,GAHC,KAAK,OAAO,QAAO,MAAK,cAAc,GAAG,MAAM,CAG7C,CAAQ,CAAC,CAAC,QAAQ;EACrC,MAAM,QAAQ,OAAO;EACrB,MAAM,QAAQ,QAAQ,SAAS;EAC/B,MAAM,SAAS,QAAQ,UAAU;EAEjC,OAAO;GACH,SAAS,OAAO,MAAM,QAAQ,SAAS,KAAK;GAC5C;EACJ;CACJ;CAEA,UAAU,QAAQ,IAAgB;EAC9B,OAAO,KAAK,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ;CAC7C;AACJ;AAGA,IAAa,YAAY,IAAI,cAAc;;AAG3C,SAAgB,OACZ,OACA,QACA,SACA,UACI;CACJ,UAAU,KAAK;EACX,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;EAClC;EACA;EACA;EACA;CACJ,CAAC;AACL;;AAcA,SAAgB,cAAc,UAAgC,CAAC,GAA+B;CAC1F,MAAM,UAAU,IAAI,IAAI,QAAQ,eAAe,CAAC,CAAC;CACjD,OAAO,OAAO,GAAG,SAAS;EACtB,MAAM,QAAQ,KAAK,IAAI;EACvB,MAAM,KAAK;EACX,IAAI,QAAQ,IAAI,EAAE,IAAI,IAAI,GAAG;EAC7B,MAAM,WAAW,KAAK,IAAI,IAAI;EAC9B,MAAM,QAAQ,EAAE,IAAI,WAAW;EAI/B,MAAM,SAAS,EAAE,IAAI;EACrB,MAAM,QAA2B,UAAU,MAAM,UAAU,UAAU,MAAM,SAAS;EAIpF,MAAM,UAAU,EAAE,IAAI,cAAc;EACpC,OACI,OACA,OACA,GAAG,EAAE,IAAI,OAAO,GAAG,EAAE,IAAI,KAAK,GAAG,OAAO,GAAG,SAAS,OAC7C,UAAU,MAAM,QAAQ,KAAK,IAAI,QAAQ,YAAY,KAC5D;GACI,QAAQ,EAAE,IAAI;GACd,MAAM,EAAE,IAAI;GACZ;GACA;GACA,GAAI,SAAS,EAAE,WAAW,MAAM;GAChC,GAAI,EAAE,IAAI,YAAY,KAAK,EAAE,YAAY,EAAE,IAAI,YAAY,EAAE;GAC7D,GAAI,WAAW;IAAE,WAAW,QAAQ;IAAM,cAAc,QAAQ;GAAQ;EAC5E,CACJ;CACJ;AACJ;;;;;;;;;;AAWA,IAAM,mBAAwD;CAC1D,CAAC,qBAAqB,KAAK;CAC3B,CAAC,eAAe,MAAM;CACtB,CAAC,2BAA2B,SAAS;CACrC,CAAC,sCAAsC,UAAU;AACrD;;;;;;;AAQA,SAAgB,iBAAiB,SAAqC;CAIlE,MAAM,YADY,QAAQ,MAAM,mBACd,CAAA,GAAY,MAAM;CACpC,KAAK,MAAM,CAAC,SAAS,WAAW,kBAC5B,IAAI,QAAQ,KAAK,SAAS,GAAG,OAAO;CAExC,OAAO;AACX;;;;;;;;;;;;;;;;;AAkBA,IAAI;AACJ,SAAgB,yBAAqC;CACjD,IAAI,iBAAiB,OAAO;CAC5B,MAAM,SAAS,YAAY,OAAO,SAAS,SAAS;EAChD,IAAI,UAAU,UAAU,UAAU,SAAS;EAI3C,IAAI,YAAY,WAAW;EAC3B,OAAO,OAAO,iBAAiB,OAAO,GAAG,SAAS,OAAO,KAAK,IAAI,CAAC,CAAC,SAAS,IAAI,OAAO,KAAA,CAAS;CACrG,CAAC;CACD,wBAAwB;EACpB,OAAO;EACP,kBAAkB,KAAA;CACtB;CACA,OAAO;AACX;;;;;;;;;;AAWA,IAAM,kBAAkB;;;;;;;;AASxB,IAAM,sBAAsB;;;;;;;;;;;;;;;;;;;AAoB5B,IAAM,qBAAqB;;;;;;;;AAS3B,IAAM,iBAAiB;AAgBvB,SAAgB,iBAAiB,SAA0B,CAAC,GAAkB;CAK1E,uBAAuB;CAEvB,MAAM,UAAU,OAAO,WAAW;CAClC,MAAM,cAAc,OAAO,eAAe;CAC1C,MAAM,aAAa,OAAO,cAAc;CAExC,MAAM,MAAM,IAAI,KAAc;CAM9B,IAAI,QAAQ,YAAY;;;;;;;;;;;;;;CAexB,MAAM,UAAU,KAAyB,MAAc,KAAa,MAAM,MAA0B;EAChG,IAAI,QAAQ,KAAA,KAAa,IAAI,KAAK,MAAM,IAAI,OAAO,KAAA;EACnD,MAAM,SAAS,OAAO,IAAI,KAAK,CAAC;EAChC,IAAI,CAAC,OAAO,UAAU,MAAM,KAAK,SAAS,OAAO,SAAS,KACtD,MAAM,IAAI,SACN,KACA,iBACA,aAAa,KAAK,MAAM,IAAI,oCAAoC,IAAI,OAAO,IAAI,IAC/E,KAAA,GACA,IACJ;EAEJ,OAAO;CACX;CAGA,IAAI,IAAI,MAAM,MAAM;EAChB,MAAM,QAAQ,EAAE,IAAI,MAAM;EAC1B,MAAM,SAAS,UAAU,MAAM;GAC3B,OAAO,MAAM;GACb,QAAQ,MAAM;GACd,QAAQ,MAAM;GACd,OAAO,OAAO,MAAM,OAAO,SAAS,cAAc;GAClD,QAAQ,OAAO,MAAM,QAAQ,UAAU,OAAO,kBAAkB,CAAC;GACjE,OAAO,MAAM;EACjB,CAAC;EACD,OAAO,EAAE,KAAK,MAAM;CACxB,CAAC;CAGD,IAAI,IAAI,YAAY,MAAM;EACtB,MAAM,QAAQ,OAAO,EAAE,IAAI,MAAM,OAAO,GAAG,SAAS,cAAc,KAAK;EACvE,OAAO,EAAE,KAAK,EAAE,SAAS,UAAU,UAAU,KAAK,EAAE,CAAC;CACzD,CAAC;CAkBD,IAAI,IAAI,YAAY,MAAM;EACtB,MAAM,QAAQ,EAAE,IAAI,MAAM;EAC1B,MAAM,SAAS,gBAAgB;GAC3B,OAAO,MAAM;GACb,QAAQ,MAAM;GACd,QAAQ,MAAM;EAClB,CAAC;EACD,MAAM,QAAQ,OAAO,MAAM,OAAO,SAAS,cAAc,KAAK;EAM9D,EAAE,OAAO,qBAAqB,IAAI;EAElC,OAAO,UAAU,GAAG,OAAO,WAAW;GAClC,IAAI,UAAsB,CAAC;GAC3B,IAAI,UAAU;GAOd,MAAM,cAAc,UAAU,WAAU,UAAS;IAC7C,IAAI,CAAC,cAAc,OAAO,MAAM,GAAG;IACnC,IAAI,QAAQ,UAAU,YAAY;KAC9B,QAAQ,MAAM;KACd;IACJ;IACA,QAAQ,KAAK,KAAK;GACtB,CAAC;GACD,MAAM,WAAW,UAAU,MAAM;IAAE,GAAG;IAClC;GAAM,CAAC;GAaX,MAAM,0BAA0B;IAC5B,IAAI,CAAC,OAAO,QAAQ,OAAO,MAAM;GACrC;GACA,EAAE,IAAI,IAAI,OAAO,iBAAiB,SAAS,mBAAmB,EAAE,MAAM,KAAK,CAAC;GAC5E,IAAI,EAAE,IAAI,IAAI,OAAO,SAAS,kBAAkB;GAEhD,IAAI;IACA,MAAM,OAAO,SAAS;KAClB,OAAO;KAGP,MAAM,KAAK,UAAU;MACjB,SAAS,SAAS,QAAQ,MAAM,CAAC,CAAC,QAAQ;MAC1C,OAAO,SAAS;KACpB,CAAC;IACL,CAAC;IAED,IAAI,SAAS;IACb,OAAO,CAAC,OAAO,WAAW,CAAC,OAAO,QAAQ;KACtC,MAAM,OAAO,MAAM,OAAO;KAC1B,IAAI,OAAO,WAAW,OAAO,QAAQ;KAErC,IAAI,QAAQ,WAAW,GAAG;MACtB,UAAU;MACV,IAAI,UAAU,aAAa;OACvB,MAAM,OAAO,MAAM,YAAY;OAC/B,SAAS;MACb;MACA;KACJ;KAEA,MAAM,UAAU;KAChB,MAAM,OAAO;KACb,UAAU,CAAC;KACX,UAAU;KACV,SAAS;KACT,MAAM,OAAO,SAAS;MAClB,OAAO;MACP,MAAM,KAAK,UAAU,OAAO,IAAI;OAAE;OAC9B,SAAS;MAAK,IAAI,EAAE,QAAQ,CAAC;KACrC,CAAC;IACL;GACJ,UAAU;IACN,YAAY;IACZ,EAAE,IAAI,IAAI,OAAO,oBAAoB,SAAS,iBAAiB;GACnE;EACJ,CAAC;CACL,CAAC;CAED,OAAO;AACX;AAEA,IAAA,sBAAe,iBAAiB"}

package/dist/mcp/mcp-routes.d.ts

@@ -21,8 +21,20 @@
  * 401, and a token too narrow for the tool it names is 403 `insufficient_scope`.
  */
 import { Hono } from "hono";
-import type { CollectionConfig, DataDriver } from "@rebasepro/types";
+import type { AuthAdapter, CollectionConfig, DataDriver } from "@rebasepro/types";
 import type { HonoEnv } from "../api/types.js";
+import { type DataRateLimitConfig } from "../auth/rate-limiter.js";
+/**
+ * The most messages one JSON-RPC batch may carry.
+ *
+ * A batch is many tool calls behind one request: one body, one tick of the
+ * rate limiter, run one after another. Uncapped, a single POST was a thousand
+ * queries for the price of one. Twenty is far above what a client batches —
+ * the 2025-06-18 revision dropped batching altogether — and a batch over it is
+ * refused whole rather than truncated, so nothing runs that the client will
+ * not hear about.
+ */
+export declare const MAX_BATCH_MESSAGES = 20;
 export interface McpRoutesConfig {
     /** The externally reachable origin. */
     publicUrl: string;
@@ -33,11 +45,27 @@ export interface McpRoutesConfig {
     /** Resolved per request, because a driver may be swapped at runtime. */
     getDriver(): DataDriver | undefined;
     getCollections(): CollectionConfig[];
+    /**
+     * The deployment's auth adapter. A write to the auth collection is user
+     * administration, and the adapter holds it to the rules `/admin/users`
+     * does. Without one, those rows are written as any table's.
+     */
+    getAuthAdapter?(): AuthAdapter | undefined;
     /** The server's own name and version, for `initialize`. */
     serverInfo: {
         name: string;
         version: string;
     };
+    /**
+     * The largest request body accepted, in bytes; `0` or less for none.
+     * Defaults to the server-wide limit. See {@link createMcpRoutes}.
+     */
+    maxBodySize?: number;
+    /**
+     * The data API's per-caller limits, or undefined when the deployment has
+     * rate limiting off. See {@link createMcpRoutes}.
+     */
+    rateLimit?: DataRateLimitConfig;
 }
 /**
  * The `.well-known` documents.
@@ -48,5 +76,13 @@ export interface McpRoutesConfig {
  * uncredentialed by design.
  */
 export declare function createMcpWellKnownRoutes(config: McpRoutesConfig): Hono<HonoEnv>;
-/** The MCP endpoint itself. */
+/**
+ * The MCP endpoint itself.
+ *
+ * It carries its own body limit and rate limit because it is mounted at the
+ * origin, outside `basePath`, and the server-wide ones are registered on
+ * `${basePath}/*` — so neither ever saw it. The limit is the data API's, bucketed
+ * by the person the token acts for and shared with their other requests: one
+ * caller's budget, spent wherever they like.
+ */
 export declare function createMcpRoutes(config: McpRoutesConfig): Hono<HonoEnv>;

package/dist/mcp/mcp-tools.d.ts

@@ -20,7 +20,7 @@
  * second lock, not the main one — a `mcp:write` token still cannot write a row
  * the user could not write themselves.
  */
-import type { CollectionConfig, DataDriver } from "@rebasepro/types";
+import type { AuthAdapter, CollectionConfig, DataDriver } from "@rebasepro/types";
 /** The identity a tool call runs as. Comes from the verified access token. */
 export interface McpCaller {
     uid: string;
@@ -32,6 +32,12 @@ export interface McpToolContext {
     driver: DataDriver;
     collections: CollectionConfig[];
     caller: McpCaller;
+    /**
+     * The deployment's auth adapter. The auth collection's rows are the users,
+     * so the write tools hand a write to one to it, as REST and `/admin/users`
+     * do. See `api/rest/auth-collection-writes.ts`.
+     */
+    authAdapter?: AuthAdapter;
 }
 export interface McpToolDefinition {
     name: string;

package/dist/mcp/oauth-routes.d.ts

@@ -25,6 +25,7 @@
  */
 import { Hono } from "hono";
 import type { HonoEnv } from "../api/types.js";
+import type { AuthRepository } from "../auth/interfaces.js";
 import type { OAuthStore } from "./oauth-store.js";
 export interface OAuthRoutesConfig {
     store: OAuthStore;
@@ -36,7 +37,33 @@ export interface OAuthRoutesConfig {
     authBasePath: string;
     /** Whether open registration is permitted. */
     allowDynamicRegistration: boolean;
+    /**
+     * Who a grant's user is now. Absent when the auth adapter exposes no user
+     * repository, and then a grant carries the roles it was consented with.
+     */
+    identity?: McpGrantIdentity;
 }
+/**
+ * The account a grant acts for, read where a grant is issued or renewed.
+ *
+ * A refresh has no session to re-read anything from, so without this a grant
+ * is a snapshot of the moment of consent: the roles it was given, for an
+ * account that may since have been demoted, signed out everywhere, or deleted.
+ */
+export interface McpGrantIdentity {
+    /** The account's roles as they are now, or null when it no longer exists. */
+    currentRoles(uid: string): Promise<string[] | null>;
+    /** Where "sign out everywhere" and every password change leave their mark. */
+    revocation?: Pick<AuthRepository, "getTokensValidAfter">;
+}
+/**
+ * The grant identity the auth repository can answer, or undefined when the
+ * adapter exposes no repository that can say whether an account exists.
+ *
+ * The same repository the admin gate re-reads roles and the revocation
+ * watermark from, so a grant is held to what a session is held to.
+ */
+export declare function grantIdentityFromRepository(repo: Partial<Pick<AuthRepository, "getUserById" | "getUserRoleIds" | "getTokensValidAfter">> | undefined): McpGrantIdentity | undefined;
 export declare function createOAuthRoutes(config: OAuthRoutesConfig): Hono<HonoEnv>;
 /**
  * Why a redirect URI cannot be registered, or null if it can.

package/dist/mcp/oauth-store.d.ts

@@ -53,26 +53,29 @@ export interface RefreshTokenRecord {
     clientId: string;
     uid: string;
     /**
-     * The roles the grant was made with.
+     * The roles the token was minted with.
      *
-     * Carried here because a refresh has no session to re-read them from, and
-     * an access token minted with an empty `roles` is not a smaller grant — it
-     * is a DIFFERENT identity to the database. Any policy written as "a row this
-     * user's role may see" evaluates against an empty list and returns nothing,
-     * so dropping them turns the first token refresh into an integration that
-     * silently stops seeing data.
-     *
-     * The consequence of storing them is that a role change does not reach an
-     * existing grant until the refresh token expires or the user revokes the
-     * client. That is stated in the docs, and it is the trade this design makes
-     * knowingly: the alternative is a user lookup on every refresh, which puts
-     * the auth adapter on a path that currently has no dependency on it.
+     * A refresh re-reads the account's roles when the routes are given an
+     * identity to ask (`McpGrantIdentity`), so these are what a grant falls
+     * back on when there is none — an auth adapter that exposes no user
+     * repository. The fallback is these rather than an empty list because an
+     * access token minted with no `roles` is not a smaller grant — it is a
+     * DIFFERENT identity to the database: any policy written as "a row this
+     * user's role may see" evaluates against an empty list and returns nothing.
      */
     roles: string[];
     scope: string;
     resource: string;
     family: string;
 }
+/** A refresh token that could be spent right now, and when it was minted. */
+export interface LiveRefreshToken extends RefreshTokenRecord {
+    /**
+     * When this token — not its family — was issued. Compared with the user's
+     * revocation watermark: a token minted before "sign out everywhere" is void.
+     */
+    issuedAt: Date;
+}
 export interface OAuthStore {
     ensureTables(): Promise<void>;
     registerClient(client: OAuthClient): Promise<void>;
@@ -91,6 +94,19 @@ export interface OAuthStore {
      * the same family before returning null.
      */
     consumeRefreshToken(token: string): Promise<RefreshTokenRecord | null>;
+    /**
+     * A live refresh token's grant, WITHOUT spending it.
+     *
+     * What the token endpoint checks before it rotates: whose client it is,
+     * the scope asked for, and whether the account behind it still stands.
+     * Spending first and checking after means a refusal — or a database blip
+     * in the account lookup — leaves the holder with a spent token, and their
+     * retry reads as a replay that kills the family.
+     *
+     * Returns null for anything {@link consumeRefreshToken} would refuse, and
+     * writes nothing: a replayed token is detected when it is spent.
+     */
+    peekRefreshToken(token: string): Promise<LiveRefreshToken | null>;
     revokeFamily(family: string): Promise<void>;
     /**
      * Revoke the family a token belongs to, for RFC 7009 — without spending it.

package/dist/metrics/history-recorder.d.ts

@@ -1,4 +1,4 @@
-import type { DataDriver } from "@rebasepro/types";
+import { type DataDriver } from "@rebasepro/types";
 import { type MetricSeries, type SeriesPoint } from "./history-store.js";
 export interface MetricsHistory {
     /** Create the table and sweep what has aged out. */

package/dist/{openapi-generator-D8ZIN_ss.js → openapi-generator-O_O24MAT.js}

@@ -2,8 +2,8 @@ import { createRequire as __rebaseCreateRequire } from "module";
 import __rebaseProcess from "process";
 globalThis.process ??= __rebaseProcess;
 __rebaseCreateRequire(import.meta.url);
-import { B as findRelation, E as effectiveAccess, H as isRelationRequired, L as getTenantConfig, U as resolveCollectionRelations, ct as isToMany, z as fieldKeyForColumn } from "./src-BYax9_rm.js";
-import "./src-Br6ARbs6.js";
+import { B as fieldKeyForColumn, E as effectiveAccess, G as resolveCollectionRelations, R as getTenantConfig, U as isRelationRequired, V as findRelation, pt as isToMany } from "./src-pmvW7BFx.js";
+import "./src-vkcwKXbT.js";
 //#region src/api/openapi-generator.ts
 function generateOpenApiSpec(collections, options = {}) {
 	const basePath = options.basePath ?? "/api";
@@ -108,7 +108,7 @@ function generateOpenApiSpec(collections, options = {}) {
 			name: "distinct",
 			in: "query",
 			schema: { type: "boolean" },
-			description: "`SELECT DISTINCT` over the returned columns. Only meaningful alongside `fields`: the primary key is always in the projection, so without narrowing it every row is already distinct. `meta.total` counts distinct rows too. Refused (400) alongside `searchString` or a vector search, which attach a per-row score that makes every row distinct by construction, and (400 DISTINCT_ORDER_BY_NOT_SELECTED) when `orderBy` names a column `fields` does not return.",
+			description: "`SELECT DISTINCT` over the returned columns. Only meaningful alongside `fields`: the primary key is always in the projection, so without narrowing it every row is already distinct. The response has no `meta.total` — the rows before deduplication are a different set, so their count would not describe the page — and `meta.hasMore` is true when the page came back full. Refused (400) alongside `searchString` or a vector search, which attach a per-row score that makes every row distinct by construction, and (400 DISTINCT_ORDER_BY_NOT_SELECTED) when `orderBy` names a column `fields` does not return.",
 			example: "true"
 		},
 		{
@@ -183,7 +183,7 @@ function generateOpenApiSpec(collections, options = {}) {
 					properties: {
 						total: {
 							type: "integer",
-							description: "Total number of matching records"
+							description: "Total number of matching records. Absent on a `distinct` read, which has no count of the rows it returns."
 						},
 						limit: {
 							type: "integer",
@@ -430,7 +430,15 @@ function generateOpenApiSpec(collections, options = {}) {
 					schema: { type: "string" },
 					example: "status"
 				},
-				...listQueryParameters().filter((p) => p.name === "searchString" || p.name === "limit"),
+				...listQueryParameters().filter((p) => p.name === "searchString" || p.name === "limit" || p.name === "offset" || p.name === "page"),
+				{
+					name: "orderBy",
+					in: "query",
+					required: false,
+					description: "Sort for the groups, by a `groupBy` field or an aggregate's result key (`count`, `sum_total`): `key:asc`, `key:desc` or `key:desc:last`. Groups it leaves tied are ordered by the `groupBy` fields, so every page boundary falls in the same place. `offset`, `page` and `orderBy` need `groupBy` — without it the result is one row — and are otherwise a 400 INVALID_AGGREGATE_WINDOW.",
+					schema: { type: "string" },
+					example: "count:desc"
+				},
 				...buildFilterParameters(collection, reservedParameterNames)
 			],
 			responses: {
@@ -439,13 +447,27 @@ function generateOpenApiSpec(collections, options = {}) {
 					content: { "application/json": { schema: {
 						type: "object",
 						required: ["data"],
-						properties: { data: {
-							type: "array",
-							items: {
+						properties: {
+							data: {
+								type: "array",
+								items: {
+									type: "object",
+									additionalProperties: true
+								}
+							},
+							meta: {
 								type: "object",
-								additionalProperties: true
+								description: "The page of groups. Present when `groupBy` is.",
+								properties: {
+									limit: { type: "integer" },
+									offset: { type: "integer" },
+									hasMore: {
+										type: "boolean",
+										description: "Whether a group follows this page."
+									}
+								}
 							}
-						} }
+						}
 					} } }
 				},
 				501: { description: "This backend's data driver does not implement aggregates" },
@@ -1055,7 +1077,7 @@ function updateOperation(collection, schemaName, requireAuth, shared) {
 	return {
 		tags: [collection.name],
 		summary: `Update ${collection.singularName || collection.name}`,
-		description: "Partial update: only the properties present in the body are written; the rest are left unchanged.\n\nA property's value may instead be a field operation — `{ \"views\": { \"$inc\": 1 } }`, `{ \"tags\": { \"$push\": \"new\" } }`, `{ \"tags\": { \"$pull\": \"old\" } }`, `{ \"meta\": { \"$merge\": { \"seen\": true } } }` — which is applied inside the statement holding the row lock. That is the difference between a counter that is correct under concurrency and one that silently loses increments, because expressing the same change as a value means reading it first. `$inc` needs a `number` property, `$push`/`$pull` an `array`, `$merge` a `map`; anything else is a 400. See the `FieldOperation` schema.",
+		description: "Partial update: only the properties present in the body are written; the rest are left unchanged.\n\nA property's value may instead be a field operation — `{ \"views\": { \"$inc\": 1 } }`, `{ \"tags\": { \"$push\": \"new\" } }`, `{ \"tags\": { \"$pull\": \"old\" } }`, `{ \"meta\": { \"$merge\": { \"seen\": true } } }` — which is applied inside the statement holding the row lock. That is the difference between a counter that is correct under concurrency and one that silently loses increments, because expressing the same change as a value means reading it first. `$inc` needs a `number` property, `$push`/`$pull` an `array`, `$merge` a `map`; anything else is a 400. Pushed elements and merged keys answer to the property's own rules, as a value would. See the `FieldOperation` schema.",
 		operationId: `update${schemaName}`,
 		parameters: [
 			{
@@ -1426,4 +1448,4 @@ function toPascalCase(str) {
 //#endregion
 export { generateOpenApiSpec };
 
-//# sourceMappingURL=openapi-generator-D8ZIN_ss.js.map
+//# sourceMappingURL=openapi-generator-O_O24MAT.js.map