@rebasepro/server 0.24.0 → 0.24.1-canary.g19596ef

package/dist/logger-D-S-hO5e.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"logger-D-S-hO5e.js","names":[],"sources":["../src/utils/host.ts","../src/utils/logger.ts"],"sourcesContent":["/**\n * The host globals this package reads, behind functions that do not assume Node.\n *\n * `process` is not defined on workerd, on Deno Deploy without the compat flag,\n * or in a browser. That matters here for one specific reason: the portable\n * authoring surface (`@rebasepro/server/functions`) reaches the logger and the\n * error handler, and a bare `process.env.NODE_ENV` inside either of them turns\n * the first log line of a request into a `ReferenceError` on a runtime that has\n * no `process` — a failure that reads as \"the framework crashed\" rather than\n * \"this runtime has no process object\".\n *\n * Nothing here throws and nothing here is async. A runtime that cannot answer\n * gets the empty answer, because every caller in this file's blast radius is\n * choosing a log level or a format, and the safe default for both is the\n * development one.\n *\n * @module\n */\n\n/**\n * Where an adapter with no `process` can publish the environment.\n *\n * Cloudflare Workers hand the environment to the *request*, not to the module,\n * so there is no global to read at import time. An edge adapter that has\n * already seen a request can stash the bag here and every contextless reader in\n * the framework — the logger, chiefly — starts answering correctly.\n *\n * `Symbol.for` rather than a module-local for the same reason the singleton\n * uses it: more than one copy of this module can be loaded into one process,\n * and a module-local would leave every copy but the writer's blind. See\n * `../singleton.ts`.\n *\n * Request-scoped code should NOT read this. Use `getEnv(c)` from\n * `@rebasepro/server/functions`, which reads the binding attached to the\n * request it is serving — the only correct source on a runtime where two\n * concurrent requests can carry different bindings.\n */\nconst ENV_SLOT = Symbol.for(\"@rebasepro/server:host-env\");\n\ntype GlobalWithEnv = typeof globalThis & {\n    [ENV_SLOT]?: Record<string, string | undefined>;\n    process?: { env?: Record<string, string | undefined> };\n};\n\n/**\n * The process environment, or the closest thing this runtime has to one.\n *\n * Order: a bag published by {@link setHostEnv} first, because an adapter that\n * set one knows more than the ambient globals do; then `process.env`; then\n * nothing.\n */\nexport function hostEnv(): Record<string, string | undefined> {\n    const global = globalThis as GlobalWithEnv;\n    return global[ENV_SLOT] ?? global.process?.env ?? {};\n}\n\n/**\n * Read one environment variable without touching `process` directly.\n *\n * Trimmed, and blank is treated as absent — a variable declared with no value\n * is the ordinary way to write a compose file or a `.env` line, and every\n * caller in this package means \"unset\" by it. See `resolveFunctionsTimeoutMs`,\n * which learned that the hard way.\n */\nexport function hostEnvVar(name: string): string | undefined {\n    const raw = hostEnv()[name];\n    if (typeof raw !== \"string\") return undefined;\n    const trimmed = raw.trim();\n    return trimmed === \"\" ? undefined : trimmed;\n}\n\n/**\n * Publish an environment bag for contextless readers.\n *\n * Called by an adapter for a runtime whose environment is not ambient. Merges\n * rather than replaces, so two adapters (or an adapter plus a test) do not\n * silently erase each other's variables.\n */\nexport function setHostEnv(env: Record<string, string | undefined>): void {\n    const global = globalThis as GlobalWithEnv;\n    global[ENV_SLOT] = {\n        ...(global[ENV_SLOT] ?? {}),\n        ...env\n    };\n}\n\n/** @internal Test seam — drops anything {@link setHostEnv} published. */\nexport function _clearHostEnv(): void {\n    delete (globalThis as GlobalWithEnv)[ENV_SLOT];\n}\n\ntype GlobalWithStdio = typeof globalThis & {\n    process?: {\n        stdout?: { write?: (chunk: string) => unknown };\n        stderr?: { write?: (chunk: string) => unknown };\n    };\n};\n\n/**\n * Write one already-formatted line to the process's output.\n *\n * `process.stdout.write` is preferred where it exists because it is the only\n * one of the two that does not append its own formatting to a line that is\n * already a complete JSON document — `console.log` on Node is\n * `process.stdout.write` plus `util.format`, and `util.format` will happily\n * reinterpret a `%s` that appeared inside a user's log message.\n *\n * Where it does not exist, `console` is the runtime's log sink and is what its\n * platform collects.\n */\nexport function writeLine(stream: \"out\" | \"err\", line: string): void {\n    const proc = (globalThis as GlobalWithStdio).process;\n    const sink = stream === \"err\" ? proc?.stderr : proc?.stdout;\n    if (typeof sink?.write === \"function\") {\n        sink.write(line + \"\\n\");\n        return;\n    }\n    if (stream === \"err\") console.error(line);\n    else console.log(line);\n}\n","/**\n * Structured Logger for Rebase Backend\n *\n * Outputs JSON lines when `NODE_ENV=production`, human-readable prefixed\n * lines otherwise.  Designed to work with Google Cloud Logging severity levels.\n *\n * Every line — message and data, at any depth — passes through the redaction\n * below, which strips Drizzle's `Failed query: … / params: …` wrapper and the\n * values of secret-looking keys. See the block above `serialiseError`.\n *\n * Usage:\n *   import { logger } from \"./utils/logger\";\n *   logger.info(\"Server started\", { port: 3001 });\n *   logger.error(\"Request failed\", { path: \"/api/test\", error: err });\n *\n * Every host global goes through `./host`, and that is load-bearing rather than\n * tidy: this module is reachable from `@rebasepro/server/functions`, the\n * authoring surface that has to import cleanly on a runtime with no `process`.\n * A bare `process.env.NODE_ENV` here would make the first log line of the first\n * request on workerd a `ReferenceError`.\n */\nimport { hostEnv, writeLine } from \"./host\";\n\nexport type LogLevel = \"debug\" | \"info\" | \"warn\" | \"error\";\n\n/** Google Cloud Logging severity strings. */\nconst GCP_SEVERITY: Record<LogLevel, string> = {\n    debug: \"DEBUG\",\n    info: \"INFO\",\n    warn: \"WARNING\",\n    error: \"ERROR\"\n};\n\nconst LOG_PRIORITY: Record<LogLevel, number> = {\n    debug: 0,\n    info: 1,\n    warn: 2,\n    error: 3\n};\n\nexport interface LogEntry {\n    severity: string;\n    message: string;\n    timestamp: string;\n    [key: string]: unknown;\n}\n\nexport interface Logger {\n    debug(message: string, data?: Record<string, unknown>): void;\n    info(message: string, data?: Record<string, unknown>): void;\n    warn(message: string, data?: Record<string, unknown>): void;\n    error(message: string, data?: Record<string, unknown>): void;\n    child(defaultFields: Record<string, unknown>): Logger;\n}\n\nfunction isProduction(): boolean {\n    return hostEnv().NODE_ENV === \"production\";\n}\n\n/**\n * An explicit level from `config.logging.level`, when a project set one.\n *\n * Outranks `LOG_LEVEL` because it is the more specific statement: an\n * environment variable is the deployment's default, and this is the\n * application saying what it wants regardless of where it runs.\n *\n * There used to be a second, separate mechanism for this — `utils/logging.ts`\n * reassigned `console.debug`/`console.log`/`console.warn` to no-ops — and the\n * two disagreed in a way nobody could have guessed from either: `LOG_LEVEL=warn`\n * silenced this logger's info lines *and* every `console.log` in the process,\n * including a dependency's, including a project's own debugging. It also could\n * not be undone, because the originals were gone.\n */\nlet configuredLevel: LogLevel | undefined;\n\n/**\n * Set the level from configuration. `undefined` returns to `LOG_LEVEL`.\n *\n * Read per line rather than captured at construction, so a logger created\n * before configuration is read still honours it — which the singleton below\n * always is.\n */\nexport function setLogLevel(level?: LogLevel): void {\n    configuredLevel = level;\n}\n\nfunction getMinLevel(): LogLevel {\n    if (configuredLevel) return configuredLevel;\n    const env = (hostEnv().LOG_LEVEL || \"info\").trim().toLowerCase();\n    if (env in LOG_PRIORITY) return env as LogLevel;\n    return \"info\";\n}\n\n// ── Redaction ───────────────────────────────────────────────────────\n//\n// Drizzle builds every query failure as\n// `Failed query: ${query}\\nparams: ${params}` (drizzle-orm/errors.js), so the\n// statement *and* every bound value ride along in `.message` and `.stack` of\n// whatever a driver rethrows — an email and a bcrypt hash reach stdout the\n// moment a registration hits a unique violation. The redaction lives here, in\n// the one function every log line passes through, rather than at the ~124\n// `{ error: … }` call sites: a per-site rule is what produced the leak (one\n// file suppressed the stack, four others did not), and the next caller would\n// reintroduce it. Nothing above this line needs to know about it.\n\nconst FAILED_QUERY_MARKER = \"Failed query:\";\n/**\n * The marker says how to lift it.\n *\n * Every DDL, RLS and CDC failure ends at this string, and the statement is the\n * whole diagnosis — three of them landed in one boot of a two-database project,\n * each a dead end. The switch existed; nothing named it, in the log or in the\n * docs, so `grep -rn REBASE_LOG_RAW_QUERIES` over the documentation, the\n * templates and the agent skills came back empty.\n */\nconst REDACTED_QUERY =\n    \"Failed query: [redacted — set REBASE_LOG_RAW_QUERIES=true in development to see it]\";\nconst REDACTED_VALUE = \"[redacted]\";\n\n/**\n * Key fragments whose values are never safe to publish. Compared against the\n * key with separators and case removed, so `api_key`, `apiKey` and `API-KEY`\n * all match `apikey`.\n */\nconst SENSITIVE_KEY_FRAGMENTS = [\n    \"password\",\n    \"passwd\",\n    \"passphrase\",\n    \"secret\",\n    \"token\",\n    \"apikey\",\n    \"authorization\",\n    \"credential\",\n    \"cookie\",\n    \"privatekey\",\n    \"sessionid\"\n];\n\n/** Longest structure the redactor will walk before giving up. */\nconst MAX_REDACT_DEPTH = 8;\n\nfunction isSensitiveKey(key: string): boolean {\n    const normalised = key.toLowerCase().replace(/[^a-z0-9]/g, \"\");\n    return SENSITIVE_KEY_FRAGMENTS.some(fragment => normalised.includes(fragment));\n}\n\n/**\n * Whether a SQL statement may be written out at all.\n *\n * The escape hatch for the `Failed query:` strip — the statement is the fastest\n * way to diagnose a failing query on a developer machine. Ignored in\n * production, so a runtime that inherits the variable cannot leak because of\n * it, and it never re-enables the key deny-list.\n *\n * Exported because it is the *only* answer to \"may this process print SQL\", and\n * a driver that wants to trace what it executes has to ask the same question.\n * The Postgres driver used to decide for itself, with a `console.debug` gated\n * on `NODE_ENV` alone: every statement went to stdout whatever `LOG_LEVEL`\n * said, and it went there without passing through the redaction that lives in\n * this file.\n */\nexport function rawQueryLoggingEnabled(): boolean {\n    return hostEnv().NODE_ENV !== \"production\"\n        && hostEnv().REBASE_LOG_RAW_QUERIES === \"true\";\n}\n\n/**\n * Strip every `Failed query: … / params: …` span out of a message or stack,\n * keeping the surrounding text (including stack frames, which carry no user\n * data). When no `params:` line follows the marker the rest of the string is\n * dropped: a statement of unknown extent is treated as sensitive rather than\n * guessed at.\n *\n * Idempotent, and it has to be: an already-redacted span still starts with the\n * marker but has no `params:` line, so a second pass over it would fall into\n * the drop-the-rest branch and eat the stack frames behind it. Redaction runs\n * more than once on the same string in practice — the cron scheduler redacts\n * before persisting and then logs the result.\n */\nexport function redactSensitiveText(text: string): string {\n    if (!text.includes(FAILED_QUERY_MARKER) || rawQueryLoggingEnabled()) return text;\n\n    let out = text;\n    let idx = out.indexOf(FAILED_QUERY_MARKER);\n    while (idx !== -1) {\n        if (out.startsWith(REDACTED_QUERY, idx)) {\n            idx = out.indexOf(FAILED_QUERY_MARKER, idx + REDACTED_QUERY.length);\n            continue;\n        }\n        const paramsIdx = out.indexOf(\"\\nparams:\", idx);\n        let end: number;\n        if (paramsIdx === -1) {\n            end = out.length;\n        } else {\n            const eol = out.indexOf(\"\\n\", paramsIdx + 1);\n            end = eol === -1 ? out.length : eol;\n        }\n        out = out.slice(0, idx) + REDACTED_QUERY + out.slice(end);\n        idx = out.indexOf(FAILED_QUERY_MARKER, idx + REDACTED_QUERY.length);\n    }\n    return out;\n}\n\n/**\n * Diagnostic own-properties worth carrying up out of an error.\n *\n * These are what a socket failure actually says: `ECONNREFUSED` with the\n * `address` and `port` it was refused on, `ENOTFOUND` with the hostname that\n * did not resolve. They live as own-properties on the Node error rather than in\n * its message, so a serialiser that copies only `message` and `stack` prints a\n * boot failure that names no host, no port and no reason.\n *\n * Deliberately a fixed list rather than \"every own-property\": `DrizzleQueryError`\n * carries `query` and `params` beside its message, and copying those would put\n * the statement and its bound values — an email, a bcrypt hash — straight back\n * on stdout, which is what the redaction above exists to prevent. Postgres's own\n * `detail` and `hint` are left out for the same reason: `23505` reports\n * `Key (email)=(a@b.c) already exists.`, which is a row's contents.\n */\nconst ERROR_DETAIL_KEYS = [\"code\", \"errno\", \"syscall\", \"address\", \"port\", \"hostname\"] as const;\n\n/** How far the cause chain is followed before the serialiser gives up. */\nconst MAX_CAUSE_DEPTH = 4;\n\n/** How many of an `AggregateError`'s children are serialised. */\nconst MAX_AGGREGATE_ERRORS = 4;\n\n/**\n * Serialise an Error into a plain object, with the query text redacted out of\n * its message and stack. `query`/`params` own-properties — which\n * `DrizzleQueryError` carries beside the message — are deliberately not copied.\n *\n * The chain matters more than the top. Everything a driver rethrows is a\n * wrapper: Drizzle's is `Failed query: SELECT 1` with a stack through drizzle\n * internals, and the sentence that says what is wrong — `connect ECONNREFUSED\n * 127.0.0.1:5432`, `password authentication failed for user \"app\"` — sits in\n * `.cause`, or inside the `AggregateError.errors` that `net` raises when every\n * resolved address is refused. Serialising only the wrapper is why a boot\n * against a stopped database used to log a redacted query and nothing else.\n *\n * Handles non-Error values gracefully.\n */\nfunction serialiseError(value: unknown, depth = 0): Record<string, unknown> {\n    const isError = value instanceof Error;\n    // A cause is not always an Error: drivers throw plain `{ code, address,\n    // port }` bags, and stringifying one yields `[object Object]`, which is\n    // worse than nothing. Only the named fields are copied out of it — the same\n    // fixed list, for the same reason.\n    const isDetailBag = !isError && depth > 0 && Boolean(value) && typeof value === \"object\" && !Array.isArray(value);\n    if (!isError && !isDetailBag) {\n        return { value: redactSensitiveText(String(value)) };\n    }\n\n    const own = value as Record<string, unknown>;\n    const out: Record<string, unknown> = isError\n        ? {\n            name: (value as Error).name,\n            message: redactSensitiveText((value as Error).message),\n            stack: (value as Error).stack ? redactSensitiveText((value as Error).stack as string) : undefined\n        }\n        : {\n            ...(typeof own.name === \"string\" ? { name: own.name } : {}),\n            ...(typeof own.message === \"string\" ? { message: redactSensitiveText(own.message) } : {})\n        };\n\n    for (const key of ERROR_DETAIL_KEYS) {\n        const detail = own[key];\n        if (detail === undefined || detail === null) continue;\n        if (typeof detail === \"object\") continue;\n        out[key] = typeof detail === \"string\" ? redactSensitiveText(detail) : detail;\n    }\n\n    if (depth >= MAX_CAUSE_DEPTH) return out;\n\n    if (own.cause !== undefined && own.cause !== null) {\n        out.cause = serialiseError(own.cause, depth + 1);\n    }\n    const aggregated = own.errors;\n    if (Array.isArray(aggregated) && aggregated.length > 0) {\n        out.errors = aggregated\n            .slice(0, MAX_AGGREGATE_ERRORS)\n            .map(item => serialiseError(item, depth + 1));\n    }\n    return out;\n}\n\n/**\n * Redact one logged value: errors are serialised, strings are stripped of\n * query text, objects and arrays are walked. Cycles and over-deep structures\n * collapse to a marker rather than throwing — a logger that can fail is worse\n * than one that logs less. (An object referenced twice in one payload is\n * reported as `[circular]` the second time; bounding the walk matters more\n * than rendering a shared reference twice.)\n */\nfunction redactValue(value: unknown, depth: number, seen: WeakSet<object>): unknown {\n    // `serialiseError` returns only already-redacted strings, so it is the\n    // terminal step — walking its output again would redact twice.\n    if (value instanceof Error) return serialiseError(value);\n    if (typeof value === \"string\") return redactSensitiveText(value);\n    if (value === null || typeof value !== \"object\") return value;\n    if (depth >= MAX_REDACT_DEPTH) return \"[truncated]\";\n    if (seen.has(value)) return \"[circular]\";\n    seen.add(value);\n\n    if (Array.isArray(value)) {\n        return value.map(item => redactValue(item, depth + 1, seen));\n    }\n    if (value instanceof Date) return value;\n\n    const out: Record<string, unknown> = {};\n    for (const [key, val] of Object.entries(value as Record<string, unknown>)) {\n        out[key] = isSensitiveKey(key) ? REDACTED_VALUE : redactValue(val, depth + 1, seen);\n    }\n    return out;\n}\n\nfunction formatData(data?: Record<string, unknown>): Record<string, unknown> | undefined {\n    if (!data) return undefined;\n    const seen = new WeakSet<object>();\n    const out: Record<string, unknown> = {};\n    for (const [key, val] of Object.entries(data)) {\n        out[key] = isSensitiveKey(key) ? REDACTED_VALUE : redactValue(val, 0, seen);\n    }\n    return out;\n}\n\n/**\n * `JSON.stringify`, with the redaction a structured field gets.\n *\n * For a value that has to go *into the message*. Once an object is a string,\n * `emit` can only strip `Failed query:` spans out of it: a sensitive key would\n * pass, and so would the `query` and `params` own-properties `DrizzleQueryError`\n * carries beside its message, which `JSON.stringify` copies and the message\n * redaction never sees. Unlike the structured walk this honours `toJSON`, since\n * the result is read as text. Never throws: a value that cannot be stringified\n * is a marker, not a failed log line.\n */\nexport function stringifyForLog(value: unknown): string | undefined {\n    try {\n        return JSON.stringify(value, (key, val: unknown) => {\n            if (isSensitiveKey(key)) return REDACTED_VALUE;\n            if (val instanceof Error) return serialiseError(val);\n            if (typeof val === \"string\") return redactSensitiveText(val);\n            return val;\n        });\n    } catch {\n        return \"[unserialisable]\";\n    }\n}\n\n/**\n * Something that wants a copy of every line this logger writes.\n *\n * Receives the message and fields *after* redaction, never before: a sink is\n * another destination for the same line, and the one thing that must not vary\n * by destination is whether the query and its bound values are in it.\n */\nexport type LogSink = (\n    level: LogLevel,\n    message: string,\n    data: Record<string, unknown>\n) => void;\n\nconst sinks = new Set<LogSink>();\n\n/**\n * Tee this logger somewhere else. Returns the unsubscribe.\n *\n * The Studio's Logs Explorer is the caller: its ring buffer used to be fed only\n * by a request middleware, so the panel showed a wall of `GET … 200` and not one\n * of the errors, warnings or diagnoses the server was writing to stdout at the\n * same moment. A log viewer that cannot show you an error is a log viewer\n * nobody opens twice.\n *\n * A sink MUST NOT log. It is called from inside `emit`, so anything that comes\n * back through `logger` recurses; the guard below stops the stack blowing, but\n * the line is dropped rather than delivered, which is its own bug.\n */\nexport function addLogSink(sink: LogSink): () => void {\n    sinks.add(sink);\n    return () => { sinks.delete(sink); };\n}\n\n/** Re-entrancy guard: see `addLogSink`. */\nlet inSink = false;\n\nfunction fanOut(level: LogLevel, message: string, data: Record<string, unknown>): void {\n    if (sinks.size === 0 || inSink) return;\n    inSink = true;\n    try {\n        for (const sink of sinks) {\n            // One broken sink must not take down the line, nor the request that\n            // was writing it.\n            try { sink(level, message, data); } catch { /* a broken tee is not the caller's problem */ }\n        }\n    } finally {\n        inSink = false;\n    }\n}\n\nfunction createLogger(rawDefaultFields: Record<string, unknown> = {}): Logger {\n    // Child fields go through the same pass as per-call data — they are merged\n    // into every line this logger emits, so leaving them raw would be a hole\n    // the moment `child()` gets its first caller.\n    const defaultFields = formatData(rawDefaultFields) ?? {};\n\n    function emit(level: LogLevel, message: string, data?: Record<string, unknown>): void {\n        // Per line, not captured at construction: the singleton is created when\n        // this module is first imported, which is long before a project's\n        // `config.logging.level` has been read.\n        if (LOG_PRIORITY[level] < LOG_PRIORITY[getMinLevel()]) return;\n\n        // The message is redacted too, not just the data: several call sites\n        // interpolate `error.message` straight into the line they log.\n        const safeMessage = redactSensitiveText(message);\n        const merged = { ...defaultFields,\n...formatData(data) };\n\n        // Before the write, so a sink still sees the line if stdout is the\n        // thing that is broken.\n        fanOut(level, safeMessage, merged);\n\n        if (isProduction()) {\n            // Structured JSON for Cloud Logging\n            const entry: LogEntry = {\n                severity: GCP_SEVERITY[level],\n                message: safeMessage,\n                timestamp: new Date().toISOString(),\n                ...merged\n            };\n            const line = JSON.stringify(entry);\n\n            if (level === \"error\") {\n                writeLine(\"err\", line);\n            } else {\n                writeLine(\"out\", line);\n            }\n        } else {\n            // Human-readable for development\n            const prefix = level === \"error\" ? \"❌\"\n                : level === \"warn\" ? \"⚠️\"\n                : level === \"info\" ? \"ℹ️\"\n                : \"🐛\";\n            const extra = Object.keys(merged).length > 0 ? ` ${JSON.stringify(merged)}` : \"\";\n            const out = `${prefix} [${level.toUpperCase()}] ${safeMessage}${extra}`;\n\n            if (level === \"error\") {\n                console.error(out);\n            } else if (level === \"warn\") {\n                console.warn(out);\n            } else {\n                console.log(out);\n            }\n        }\n    }\n\n    return {\n        debug: (msg, data) => emit(\"debug\", msg, data),\n        info: (msg, data) => emit(\"info\", msg, data),\n        warn: (msg, data) => emit(\"warn\", msg, data),\n        error: (msg, data) => emit(\"error\", msg, data),\n        child(fields: Record<string, unknown>): Logger {\n            return createLogger({ ...defaultFields,\n...fields });\n        }\n    };\n}\n\n/**\n * Singleton logger instance.\n * In production: emits JSON lines with `severity`, `message`, `timestamp`.\n * In development: emits human-readable prefixed lines.\n */\nexport const logger: Logger = createLogger();\n\n/**\n * The cause chain, one readable line per link.\n *\n * `serialiseError` puts the chain in the structured payload, which is the right\n * place for a log aggregator and the wrong place for a person staring at a\n * container that will not start: the sentence they need is inside a JSON blob\n * behind an escaped stack trace. This renders the same chain as lines to print\n * beside the headline, so the first thing on screen after \"Failed to start\" is\n * `caused by: connect ECONNREFUSED 127.0.0.1:5432 (ECONNREFUSED)`.\n *\n * Redacted like everything else, and bounded by the same depth: a chain is\n * usually two links and never usefully more than four.\n */\nexport function describeCauseChain(error: unknown): string[] {\n    const lines: string[] = [];\n    const seen = new Set<unknown>();\n\n    const walk = (value: unknown, depth: number): void => {\n        if (depth > MAX_CAUSE_DEPTH || value === undefined || value === null) return;\n        if (typeof value === \"object\") {\n            if (seen.has(value)) return;\n            seen.add(value);\n        }\n        if (depth > 0) {\n            const described = describeOneCause(value);\n            if (described) lines.push(`caused by: ${described}`);\n        }\n        if (typeof value !== \"object\") return;\n        const own = value as Record<string, unknown>;\n        walk(own.cause, depth + 1);\n        const aggregated = own.errors;\n        if (Array.isArray(aggregated)) {\n            for (const item of aggregated.slice(0, MAX_AGGREGATE_ERRORS)) walk(item, depth + 1);\n        }\n    };\n\n    walk(error, 0);\n    return lines;\n}\n\n/** One cause rendered as `message (CODE) address:port`, or nothing to say. */\nfunction describeOneCause(value: unknown): string | undefined {\n    if (value === null || typeof value !== \"object\") {\n        const text = redactSensitiveText(String(value));\n        return text || undefined;\n    }\n    const own = value as Record<string, unknown>;\n    const message = typeof own.message === \"string\" && own.message\n        ? redactSensitiveText(own.message)\n        : undefined;\n    const code = typeof own.code === \"string\" ? own.code : undefined;\n    // Only when the message does not already carry it. Node writes\n    // `connect ECONNREFUSED 127.0.0.1:5432` and also sets `address`/`port`, and\n    // repeating the endpoint reads like two different facts.\n    const endpoint = own.address !== undefined && own.port !== undefined\n        ? `${String(own.address)}:${String(own.port)}`\n        : undefined;\n    const where = endpoint && !(message ?? \"\").includes(endpoint) ? endpoint : undefined;\n    const parts = [message ?? code, code && message ? `(${code})` : undefined, where]\n        .filter(Boolean);\n    return parts.length > 0 ? parts.join(\" \") : undefined;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqCA,IAAM,WAAW,OAAO,IAAI,4BAA4B;;;;;;;;AAcxD,SAAgB,UAA8C;CAC1D,MAAM,SAAS;CACf,OAAO,OAAO,aAAa,OAAO,SAAS,OAAO,CAAC;AACvD;;;;;;;;;;;;;AAwDA,SAAgB,UAAU,QAAuB,MAAoB;CACjE,MAAM,OAAQ,WAA+B;CAC7C,MAAM,OAAO,WAAW,QAAQ,MAAM,SAAS,MAAM;CACrD,IAAI,OAAO,MAAM,UAAU,YAAY;EACnC,KAAK,MAAM,OAAO,IAAI;EACtB;CACJ;CACA,IAAI,WAAW,OAAO,QAAQ,MAAM,IAAI;MACnC,QAAQ,IAAI,IAAI;AACzB;;;;;;;;;;;;;;;;;;;;;;;;;AC7FA,IAAM,eAAyC;CAC3C,OAAO;CACP,MAAM;CACN,MAAM;CACN,OAAO;AACX;AAEA,IAAM,eAAyC;CAC3C,OAAO;CACP,MAAM;CACN,MAAM;CACN,OAAO;AACX;AAiBA,SAAS,eAAwB;CAC7B,OAAO,QAAQ,CAAC,CAAC,aAAa;AAClC;;;;;;;;;;;;;;;AAgBA,IAAI;;;;;;;;AASJ,SAAgB,YAAY,OAAwB;CAChD,kBAAkB;AACtB;AAEA,SAAS,cAAwB;CAC7B,IAAI,iBAAiB,OAAO;CAC5B,MAAM,OAAO,QAAQ,CAAC,CAAC,aAAa,OAAA,CAAQ,KAAK,CAAC,CAAC,YAAY;CAC/D,IAAI,OAAO,cAAc,OAAO;CAChC,OAAO;AACX;AAcA,IAAM,sBAAsB;;;;;;;;;;AAU5B,IAAM,iBACF;AACJ,IAAM,iBAAiB;;;;;;AAOvB,IAAM,0BAA0B;CAC5B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACJ;;AAGA,IAAM,mBAAmB;AAEzB,SAAS,eAAe,KAAsB;CAC1C,MAAM,aAAa,IAAI,YAAY,CAAC,CAAC,QAAQ,cAAc,EAAE;CAC7D,OAAO,wBAAwB,MAAK,aAAY,WAAW,SAAS,QAAQ,CAAC;AACjF;;;;;;;;;;;;;;;;AAiBA,SAAgB,yBAAkC;CAC9C,OAAO,QAAQ,CAAC,CAAC,aAAa,gBACvB,QAAQ,CAAC,CAAC,2BAA2B;AAChD;;;;;;;;;;;;;;AAeA,SAAgB,oBAAoB,MAAsB;CACtD,IAAI,CAAC,KAAK,SAAS,mBAAmB,KAAK,uBAAuB,GAAG,OAAO;CAE5E,IAAI,MAAM;CACV,IAAI,MAAM,IAAI,QAAQ,mBAAmB;CACzC,OAAO,QAAQ,IAAI;EACf,IAAI,IAAI,WAAW,gBAAgB,GAAG,GAAG;GACrC,MAAM,IAAI,QAAQ,qBAAqB,MAAM,EAAqB;GAClE;EACJ;EACA,MAAM,YAAY,IAAI,QAAQ,aAAa,GAAG;EAC9C,IAAI;EACJ,IAAI,cAAc,IACd,MAAM,IAAI;OACP;GACH,MAAM,MAAM,IAAI,QAAQ,MAAM,YAAY,CAAC;GAC3C,MAAM,QAAQ,KAAK,IAAI,SAAS;EACpC;EACA,MAAM,IAAI,MAAM,GAAG,GAAG,IAAI,iBAAiB,IAAI,MAAM,GAAG;EACxD,MAAM,IAAI,QAAQ,qBAAqB,MAAM,EAAqB;CACtE;CACA,OAAO;AACX;;;;;;;;;;;;;;;;;AAkBA,IAAM,oBAAoB;CAAC;CAAQ;CAAS;CAAW;CAAW;CAAQ;AAAU;;AAGpF,IAAM,kBAAkB;;AAGxB,IAAM,uBAAuB;;;;;;;;;;;;;;;;AAiB7B,SAAS,eAAe,OAAgB,QAAQ,GAA4B;CACxE,MAAM,UAAU,iBAAiB;CAMjC,IAAI,CAAC,WAAW,EADI,CAAC,WAAW,QAAQ,KAAK,QAAQ,KAAK,KAAK,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAE5G,OAAO,EAAE,OAAO,oBAAoB,OAAO,KAAK,CAAC,EAAE;CAGvD,MAAM,MAAM;CACZ,MAAM,MAA+B,UAC/B;EACE,MAAO,MAAgB;EACvB,SAAS,oBAAqB,MAAgB,OAAO;EACrD,OAAQ,MAAgB,QAAQ,oBAAqB,MAAgB,KAAe,IAAI,KAAA;CAC5F,IACE;EACE,GAAI,OAAO,IAAI,SAAS,WAAW,EAAE,MAAM,IAAI,KAAK,IAAI,CAAC;EACzD,GAAI,OAAO,IAAI,YAAY,WAAW,EAAE,SAAS,oBAAoB,IAAI,OAAO,EAAE,IAAI,CAAC;CAC3F;CAEJ,KAAK,MAAM,OAAO,mBAAmB;EACjC,MAAM,SAAS,IAAI;EACnB,IAAI,WAAW,KAAA,KAAa,WAAW,MAAM;EAC7C,IAAI,OAAO,WAAW,UAAU;EAChC,IAAI,OAAO,OAAO,WAAW,WAAW,oBAAoB,MAAM,IAAI;CAC1E;CAEA,IAAI,SAAS,iBAAiB,OAAO;CAErC,IAAI,IAAI,UAAU,KAAA,KAAa,IAAI,UAAU,MACzC,IAAI,QAAQ,eAAe,IAAI,OAAO,QAAQ,CAAC;CAEnD,MAAM,aAAa,IAAI;CACvB,IAAI,MAAM,QAAQ,UAAU,KAAK,WAAW,SAAS,GACjD,IAAI,SAAS,WACR,MAAM,GAAG,oBAAoB,CAAC,CAC9B,KAAI,SAAQ,eAAe,MAAM,QAAQ,CAAC,CAAC;CAEpD,OAAO;AACX;;;;;;;;;AAUA,SAAS,YAAY,OAAgB,OAAe,MAAgC;CAGhF,IAAI,iBAAiB,OAAO,OAAO,eAAe,KAAK;CACvD,IAAI,OAAO,UAAU,UAAU,OAAO,oBAAoB,KAAK;CAC/D,IAAI,UAAU,QAAQ,OAAO,UAAU,UAAU,OAAO;CACxD,IAAI,SAAS,kBAAkB,OAAO;CACtC,IAAI,KAAK,IAAI,KAAK,GAAG,OAAO;CAC5B,KAAK,IAAI,KAAK;CAEd,IAAI,MAAM,QAAQ,KAAK,GACnB,OAAO,MAAM,KAAI,SAAQ,YAAY,MAAM,QAAQ,GAAG,IAAI,CAAC;CAE/D,IAAI,iBAAiB,MAAM,OAAO;CAElC,MAAM,MAA+B,CAAC;CACtC,KAAK,MAAM,CAAC,KAAK,QAAQ,OAAO,QAAQ,KAAgC,GACpE,IAAI,OAAO,eAAe,GAAG,IAAI,iBAAiB,YAAY,KAAK,QAAQ,GAAG,IAAI;CAEtF,OAAO;AACX;AAEA,SAAS,WAAW,MAAqE;CACrF,IAAI,CAAC,MAAM,OAAO,KAAA;CAClB,MAAM,uBAAO,IAAI,QAAgB;CACjC,MAAM,MAA+B,CAAC;CACtC,KAAK,MAAM,CAAC,KAAK,QAAQ,OAAO,QAAQ,IAAI,GACxC,IAAI,OAAO,eAAe,GAAG,IAAI,iBAAiB,YAAY,KAAK,GAAG,IAAI;CAE9E,OAAO;AACX;;;;;;;;;;;;AAaA,SAAgB,gBAAgB,OAAoC;CAChE,IAAI;EACA,OAAO,KAAK,UAAU,QAAQ,KAAK,QAAiB;GAChD,IAAI,eAAe,GAAG,GAAG,OAAO;GAChC,IAAI,eAAe,OAAO,OAAO,eAAe,GAAG;GACnD,IAAI,OAAO,QAAQ,UAAU,OAAO,oBAAoB,GAAG;GAC3D,OAAO;EACX,CAAC;CACL,QAAQ;EACJ,OAAO;CACX;AACJ;AAeA,IAAM,wBAAQ,IAAI,IAAa;;;;;;;;;;;;;;AAe/B,SAAgB,WAAW,MAA2B;CAClD,MAAM,IAAI,IAAI;CACd,aAAa;EAAE,MAAM,OAAO,IAAI;CAAG;AACvC;;AAGA,IAAI,SAAS;AAEb,SAAS,OAAO,OAAiB,SAAiB,MAAqC;CACnF,IAAI,MAAM,SAAS,KAAK,QAAQ;CAChC,SAAS;CACT,IAAI;EACA,KAAK,MAAM,QAAQ,OAGf,IAAI;GAAE,KAAK,OAAO,SAAS,IAAI;EAAG,QAAQ,CAAiD;CAEnG,UAAU;EACN,SAAS;CACb;AACJ;AAEA,SAAS,aAAa,mBAA4C,CAAC,GAAW;CAI1E,MAAM,gBAAgB,WAAW,gBAAgB,KAAK,CAAC;CAEvD,SAAS,KAAK,OAAiB,SAAiB,MAAsC;EAIlF,IAAI,aAAa,SAAS,aAAa,YAAY,IAAI;EAIvD,MAAM,cAAc,oBAAoB,OAAO;EAC/C,MAAM,SAAS;GAAE,GAAG;GAC5B,GAAG,WAAW,IAAI;EAAE;EAIZ,OAAO,OAAO,aAAa,MAAM;EAEjC,IAAI,aAAa,GAAG;GAEhB,MAAM,QAAkB;IACpB,UAAU,aAAa;IACvB,SAAS;IACT,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;IAClC,GAAG;GACP;GACA,MAAM,OAAO,KAAK,UAAU,KAAK;GAEjC,IAAI,UAAU,SACV,UAAU,OAAO,IAAI;QAErB,UAAU,OAAO,IAAI;EAE7B,OAAO;GAEH,MAAM,SAAS,UAAU,UAAU,MAC7B,UAAU,SAAS,OACnB,UAAU,SAAS,OACnB;GACN,MAAM,QAAQ,OAAO,KAAK,MAAM,CAAC,CAAC,SAAS,IAAI,IAAI,KAAK,UAAU,MAAM,MAAM;GAC9E,MAAM,MAAM,GAAG,OAAO,IAAI,MAAM,YAAY,EAAE,IAAI,cAAc;GAEhE,IAAI,UAAU,SACV,QAAQ,MAAM,GAAG;QACd,IAAI,UAAU,QACjB,QAAQ,KAAK,GAAG;QAEhB,QAAQ,IAAI,GAAG;EAEvB;CACJ;CAEA,OAAO;EACH,QAAQ,KAAK,SAAS,KAAK,SAAS,KAAK,IAAI;EAC7C,OAAO,KAAK,SAAS,KAAK,QAAQ,KAAK,IAAI;EAC3C,OAAO,KAAK,SAAS,KAAK,QAAQ,KAAK,IAAI;EAC3C,QAAQ,KAAK,SAAS,KAAK,SAAS,KAAK,IAAI;EAC7C,MAAM,QAAyC;GAC3C,OAAO,aAAa;IAAE,GAAG;IACrC,GAAG;GAAO,CAAC;EACH;CACJ;AACJ;;;;;;AAOA,IAAa,SAAiB,aAAa;;;;;;;;;;;;;;AAe3C,SAAgB,mBAAmB,OAA0B;CACzD,MAAM,QAAkB,CAAC;CACzB,MAAM,uBAAO,IAAI,IAAa;CAE9B,MAAM,QAAQ,OAAgB,UAAwB;EAClD,IAAI,QAAQ,mBAAmB,UAAU,KAAA,KAAa,UAAU,MAAM;EACtE,IAAI,OAAO,UAAU,UAAU;GAC3B,IAAI,KAAK,IAAI,KAAK,GAAG;GACrB,KAAK,IAAI,KAAK;EAClB;EACA,IAAI,QAAQ,GAAG;GACX,MAAM,YAAY,iBAAiB,KAAK;GACxC,IAAI,WAAW,MAAM,KAAK,cAAc,WAAW;EACvD;EACA,IAAI,OAAO,UAAU,UAAU;EAC/B,MAAM,MAAM;EACZ,KAAK,IAAI,OAAO,QAAQ,CAAC;EACzB,MAAM,aAAa,IAAI;EACvB,IAAI,MAAM,QAAQ,UAAU,GACxB,KAAK,MAAM,QAAQ,WAAW,MAAM,GAAG,oBAAoB,GAAG,KAAK,MAAM,QAAQ,CAAC;CAE1F;CAEA,KAAK,OAAO,CAAC;CACb,OAAO;AACX;;AAGA,SAAS,iBAAiB,OAAoC;CAC1D,IAAI,UAAU,QAAQ,OAAO,UAAU,UAEnC,OADa,oBAAoB,OAAO,KAAK,CACtC,KAAQ,KAAA;CAEnB,MAAM,MAAM;CACZ,MAAM,UAAU,OAAO,IAAI,YAAY,YAAY,IAAI,UACjD,oBAAoB,IAAI,OAAO,IAC/B,KAAA;CACN,MAAM,OAAO,OAAO,IAAI,SAAS,WAAW,IAAI,OAAO,KAAA;CAIvD,MAAM,WAAW,IAAI,YAAY,KAAA,KAAa,IAAI,SAAS,KAAA,IACrD,GAAG,OAAO,IAAI,OAAO,EAAE,GAAG,OAAO,IAAI,IAAI,MACzC,KAAA;CACN,MAAM,QAAQ,YAAY,EAAE,WAAW,GAAA,CAAI,SAAS,QAAQ,IAAI,WAAW,KAAA;CAC3E,MAAM,QAAQ;EAAC,WAAW;EAAM,QAAQ,UAAU,IAAI,KAAK,KAAK,KAAA;EAAW;CAAK,CAAC,CAC5E,OAAO,OAAO;CACnB,OAAO,MAAM,SAAS,IAAI,MAAM,KAAK,GAAG,IAAI,KAAA;AAChD"}

package/dist/openapi-generator-DAq_XVDu.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"openapi-generator-DAq_XVDu.js","names":[],"sources":["../../common/src/collections/soft-delete.ts","../src/api/openapi-generator.ts"],"sourcesContent":["import type { CollectionConfig } from \"@rebasepro/types\";\n\n/** The field `softDelete: true` means, when the object form names none. */\nexport const DEFAULT_SOFT_DELETE_FIELD = \"deletedAt\";\n\n/**\n * The property a `softDelete` collection records a deletion in — its wire\n * name, what a delete stamps and what a restore (an update to `null`) clears —\n * or `undefined` for a collection without soft delete.\n *\n * One reading of the declaration for every layer that needs it: the driver\n * that stamps and filters on it, and the REST route that has to recognise a\n * restore before it looks the row up.\n */\nexport function softDeleteFieldOf(collection: CollectionConfig | undefined): string | undefined {\n    // Declared on the Postgres collection shape only; narrowed, not cast.\n    const declared = collection && \"softDelete\" in collection ? collection.softDelete : undefined;\n    if (!declared) return undefined;\n    return (typeof declared === \"object\" && declared.field) || DEFAULT_SOFT_DELETE_FIELD;\n}\n\n/**\n * Whether an update's values restore a soft-deleted row: they set the\n * soft-delete field back to `null`, the documented restore.\n *\n * A restore is an ordinary update of a row every default read hides, so a door\n * that looks the row up before updating it has to include the trashed rows for\n * this update — and only for this one: any other edit of a trashed row is a\n * 404.\n */\nexport function restoresSoftDeletedRow(\n    collection: CollectionConfig | undefined,\n    values: Record<string, unknown> | undefined\n): boolean {\n    const field = softDeleteFieldOf(collection);\n    return field !== undefined && values?.[field] === null;\n}\n","import { CollectionConfig, Property, StringProperty, NumberProperty, ArrayProperty, MapProperty, isToMany, ResolvedRelation, VectorProperty, DEFAULT_LIST_LIMIT, MAX_LIST_LIMIT } from \"@rebasepro/types\";\nimport { effectiveAccess, fieldKeyForColumn, findRelation, getTenantConfig, isRelationRequired, resolveCollectionRelations, softDeleteFieldOf } from \"@rebasepro/common\";\nimport { DELETED_QUERY_PARAM, HARD_DELETE_QUERY_PARAM } from \"./rest/soft-delete-params\";\n\n/**\n * OpenAPI 3.0.3 specification generator.\n *\n * Produces a spec that exactly mirrors the REST API consumed by the\n * Rebase SDK client (`@rebasepro/client`).\n *\n * Routes are mounted at `{basePath}/data/{slug}` by `initializeRebaseBackend`.\n */\n\nexport interface OpenApiGeneratorOptions {\n    /** Base path for the API (e.g. \"/api\"). Defaults to \"/api\". */\n    basePath?: string;\n    /** Whether auth is enabled on data routes. Defaults to true. */\n    requireAuth?: boolean;\n    /**\n     * The list-pagination bounds the REST layer applies, so the spec states the\n     * ones a request will actually meet.\n     *\n     * These were hardcoded as `default: 20, maximum: 100` — neither of which\n     * the server has ever used. The spec drives the API Explorer and is what a\n     * generated client is built from, so an understated ceiling is a request\n     * the client refuses to make, and an overstated one is a 400 nobody\n     * predicted.\n     */\n    listLimits?: { defaultLimit?: number; maxLimit?: number };\n}\n\nexport function generateOpenApiSpec(\n    collections: CollectionConfig[],\n    options: OpenApiGeneratorOptions = {}\n): Record<string, unknown> {\n    const basePath = options.basePath ?? \"/api\";\n    const requireAuth = options.requireAuth ?? true;\n    const defaultLimit = options.listLimits?.defaultLimit ?? DEFAULT_LIST_LIMIT;\n    const maxLimit = options.listLimits?.maxLimit ?? MAX_LIST_LIMIT;\n\n    /**\n     * The query parameters every list endpoint honours.\n     *\n     * Written once because it was written twice: the root listing named eight\n     * and the subcollection listing named four, though both go through the same\n     * `parseQueryOptions` and the same fetch. Four capabilities were therefore\n     * unreachable from a generated client on nested routes, and `or`/`and` were\n     * undocumented on both.\n     */\n    const listQueryParameters = () => [\n        { name: \"limit\", in: \"query\", schema: { type: \"integer\", default: defaultLimit, minimum: 1, maximum: maxLimit },\n            description: `Maximum number of records to return. Must be a whole number between 1 and ${maxLimit}; a larger one is rejected with 400 INVALID_LIMIT rather than trimmed, so a short page always means a short collection. Page past the ceiling with \\`offset\\`.` },\n        { name: \"offset\", in: \"query\", schema: { type: \"integer\", default: 0 },\n            description: \"Number of records to skip\" },\n        { name: \"page\", in: \"query\", schema: { type: \"integer\", minimum: 1 },\n            description: \"Page number (alternative to offset). Calculates offset as (page-1)*limit\" },\n        {\n            name: \"after\",\n            in: \"query\",\n            schema: { type: \"string\" },\n            description:\n                \"Keyset cursor: continue after the row the previous page ended on. Pass back \"\n                + \"`meta.nextCursor` from that response, unchanged — it is opaque, and encodes both the \"\n                + \"sort keys and the last row's values for them. Unlike `offset`, a row inserted or \"\n                + \"deleted before the cursor cannot shift the window, so a walk neither repeats nor \"\n                + \"skips rows. Cannot be combined with `offset`/`page` (400 CURSOR_WITH_OFFSET), and an \"\n                + \"`orderBy` different from the one the cursor was issued under is refused \"\n                + \"(400 CURSOR_ORDER_MISMATCH) rather than seeked in an order nobody asked for.\"\n        },\n        {\n            name: \"orderBy\",\n            in: \"query\",\n            schema: { type: \"string\" },\n            description:\n                \"Sort field and direction. Accepts `field:asc`, `field:desc`, or `field:desc:last` — \"\n                + \"the third segment places NULLs (`first`/`last`), defaulting to Postgres's own \"\n                + \"convention (last ascending, first descending). Also accepts a JSON array \"\n                + \"`[{\\\"field\\\":\\\"name\\\",\\\"direction\\\":\\\"asc\\\",\\\"nulls\\\":\\\"last\\\"}]` — several entries sort by \"\n                + \"each in turn, the second breaking ties on the first.\",\n            example: \"created_at:desc:last\"\n        },\n        {\n            name: \"where\",\n            in: \"query\",\n            schema: { type: \"string\" },\n            description: \"JSON object filter, mapping each field to a `[operator, value]` tuple. \"\n                + \"Combines with the per-field `?field=op.value` parameters below; on the same field, the per-field parameter wins.\",\n            example: \"{\\\"status\\\":[\\\"==\\\",\\\"active\\\"]}\"\n        },\n        {\n            name: \"or\",\n            in: \"query\",\n            schema: { type: \"string\" },\n            description: \"Disjunction of conditions, AND-ed with `where` and `searchString`.\",\n            example: \"(status.eq.draft,status.eq.review)\"\n        },\n        {\n            name: \"and\",\n            in: \"query\",\n            schema: { type: \"string\" },\n            description: \"Conjunction of conditions, AND-ed with `where` and `searchString`. Ignored when `or` is also present.\",\n            example: \"(views.gte.10,status.eq.draft)\"\n        },\n        {\n            name: \"not\",\n            in: \"query\",\n            schema: { type: \"string\" },\n            description:\n                \"Negation, AND-ed with `where` and `searchString`. Negates the **conjunction** of its \"\n                + \"conditions: `not(a)` is `NOT a`, `not(a,b)` is `NOT (a AND b)`. Groups nest, so \"\n                + \"`not(or(a,b))` is the De Morgan case. Compiles to a real SQL `NOT (...)`, which — \"\n                + \"three-valued logic — also excludes rows whose column is NULL. Ignored when `or` or \"\n                + \"`and` is also present.\",\n            example: \"(status.eq.draft,views.gte.10)\"\n        },\n        {\n            name: \"include\",\n            in: \"query\",\n            schema: { type: \"string\" },\n            description:\n                \"Relations to load, in either of two spellings. **Comma-separated names or dotted \"\n                + \"paths** — `author,comments.author`, up to 3 hops deep; `*` loads every relation one \"\n                + \"hop deep. **JSON**, when a relation needs narrowing — \"\n                + \"`{\\\"comments\\\":{\\\"limit\\\":5,\\\"where\\\":{\\\"published\\\":[\\\"==\\\",true]},\"\n                + \"\\\"orderBy\\\":\\\"created_at:desc\\\",\\\"fields\\\":\\\"id,body\\\",\\\"include\\\":{\\\"author\\\":true}}}`. \"\n                + \"A value starting with `{` is read as the JSON form. A name that is not a relation of \"\n                + \"the collection is a 400 UNKNOWN_RELATION, not a silently missing field.\",\n            example: \"author,comments.author\"\n        },\n        {\n            name: \"fields\",\n            in: \"query\",\n            schema: { type: \"string\" },\n            description:\n                \"Comma-separated columns to return. A projection pushed into the SELECT, so a query \"\n                + \"that needs two fields of a wide row reads two columns. The primary key is always \"\n                + \"returned (a row that cannot be addressed cannot be updated, deleted, or paged past), \"\n                + \"and `excludeFromApi` columns stay hidden whether or not they are named here. An \"\n                + \"unknown column is a 400 UNKNOWN_FIELD.\",\n            example: \"id,name,created_at\"\n        },\n        {\n            name: \"distinct\",\n            in: \"query\",\n            schema: { type: \"boolean\" },\n            description:\n                \"`SELECT DISTINCT` over the returned columns. Only meaningful alongside `fields`: the \"\n                + \"primary key is always in the projection, so without narrowing it every row is \"\n                + \"already distinct. The response has no `meta.total` — the rows before deduplication \"\n                + \"are a different set, so their count would not describe the page — and `meta.hasMore` \"\n                + \"is true when the page came back full. Refused (400) alongside \"\n                + \"`searchString` or a vector search, which attach a per-row score that makes every row \"\n                + \"distinct by construction, and (400 DISTINCT_ORDER_BY_NOT_SELECTED) when `orderBy` \"\n                + \"names a column `fields` does not return.\",\n            example: \"true\"\n        },\n        {\n            name: \"searchString\",\n            in: \"query\",\n            schema: { type: \"string\" },\n            description:\n                \"Text search. By default a case-insensitive substring match OR-ed across the \" +\n                \"collection's top-level string properties. A collection declaring a `search` block \" +\n                \"gets ranked full-text matching over the fields it names, and rows carry a `_score`.\"\n        },\n        // Vector search has been served here since vectors landed and was\n        // documented nowhere, so the only way to find it was to read the query\n        // parser. All four are needed together; `vector_search` and `vector`\n        // are ignored unless both are present.\n        {\n            name: \"vector_search\",\n            in: \"query\",\n            schema: { type: \"string\" },\n            description: \"Name of the `vector` property to run a nearest-neighbour search against. Requires `vector`.\",\n            example: \"embedding\"\n        },\n        {\n            name: \"vector\",\n            in: \"query\",\n            schema: { type: \"string\" },\n            description: \"The query embedding, as a JSON array of numbers. Its length must match the property's declared `dimensions`.\",\n            example: \"[0.12,-0.04,0.98]\"\n        },\n        {\n            name: \"vector_distance\",\n            in: \"query\",\n            schema: { type: \"string\", enum: [\"cosine\", \"l2\", \"inner_product\"], default: \"cosine\" },\n            description: \"Distance function used for ordering.\"\n        },\n        {\n            name: \"vector_threshold\",\n            in: \"query\",\n            schema: { type: \"number\" },\n            description: \"Drop rows farther than this distance. Rows are returned closest-first with a `_distance` field.\"\n        }\n    ];\n\n    const spec: Record<string, unknown> = {\n        openapi: \"3.0.3\",\n        info: {\n            title: \"Rebase API\",\n            version: \"1.0.0\",\n            description:\n                \"Auto-generated REST API from Rebase collection definitions. \" +\n                \"This is the same API consumed by the `@rebasepro/client` SDK.\"\n        },\n        servers: [\n            {\n                url: basePath,\n                description: \"API Server\"\n            }\n        ],\n        paths: {} as Record<string, unknown>,\n        components: {\n            schemas: {\n                ErrorResponse: {\n                    type: \"object\",\n                    properties: {\n                        error: {\n                            type: \"object\",\n                            required: [\"message\", \"code\"],\n                            properties: {\n                                message: { type: \"string\" },\n                                code: { type: \"string\" },\n                                details: {}\n                            }\n                        }\n                    }\n                },\n                PaginationMeta: {\n                    type: \"object\",\n                    properties: {\n                        total: { type: \"integer\",\ndescription: \"Total number of matching records. Absent on a `distinct` read, which has no count of the rows it returns.\" },\n                        limit: { type: \"integer\",\ndescription: \"Page size used for this query\" },\n                        offset: { type: \"integer\",\ndescription: \"Number of records skipped\" },\n                        hasMore: { type: \"boolean\",\ndescription: \"Whether more records exist beyond this page\" },\n                        nextCursor: {\n                            type: \"string\",\n                            description:\n                                \"Opaque keyset cursor continuing this listing — pass it back as `?after=`. \"\n                                + \"Present when `hasMore` is true and the page returned at least one row; \"\n                                + \"absent on the last page and on an ordering no cursor can describe \"\n                                + \"(relevance, whose scores are computed per query and not stored). Do not \"\n                                + \"parse it: the encoding exists to be changed.\"\n                        }\n                    }\n                }\n            } as Record<string, unknown>,\n            securitySchemes: {} as Record<string, unknown>\n        },\n        tags: [] as Array<{ name: string; description?: string }>\n    };\n\n    // ── Security Schemes ─────────────────────────────────────────────────\n    if (requireAuth) {\n        (spec.components as Record<string, unknown>).securitySchemes = {\n            bearerAuth: {\n                type: \"http\",\n                scheme: \"bearer\",\n                bearerFormat: \"JWT\",\n                description:\n                    \"JWT access token obtained from `POST /auth/login` or `POST /auth/register`. \" +\n                    \"Can also be a static service key for server-to-server authentication.\"\n            }\n            // No `?token=` scheme. It was declared here — globally, so on every\n            // operation — and no data route has ever accepted one: both\n            // `createAuthMiddleware` and `createAdapterAuthMiddleware` read the\n            // `Authorization` header and nothing else, deliberately, because\n            // URLs leak into access logs, proxies, Referer headers and browser\n            // history (`auth/middleware.ts`). Following it cost a caller twice:\n            // unauthenticated, *and* a 400, since `token` is not in the query\n            // parser's `reservedQueryKeys` and so compiles as a filter on a\n            // column named `token`. `queryTokenAuth` is real but is mounted\n            // only on storage file serving, for `<img src>`; if those routes\n            // are ever documented, the scheme belongs on them, per-operation.\n        };\n        (spec as Record<string, unknown>).security = [\n            { bearerAuth: [] }\n        ];\n    }\n\n    const paths = spec.paths as Record<string, unknown>;\n    const schemas = (spec.components as Record<string, unknown>).schemas as Record<string, unknown>;\n    const tags = spec.tags as Array<{ name: string; description?: string }>;\n\n    // The names a listing has already spent. A collection is free to have a\n    // `limit` or a `fields` column, and the query parser reads those names as\n    // pagination and field selection before any filter is compiled — so the\n    // per-field filter could never fire, and documenting it a second time put\n    // two parameters with the same (`name`, `in`) pair on one operation, which\n    // is invalid OpenAPI: Swagger UI renders a duplicate and several generators\n    // abort. Taken from the parameter list itself so the two cannot drift.\n    //\n    // `deleted` too: the parser reads it as the soft-delete parameter on every\n    // collection (a value other than `include`/`only` is a 400), so a filter\n    // on a column of that name never runs either.\n    const reservedParameterNames = new Set([...listQueryParameters().map(p => p.name), DELETED_QUERY_PARAM]);\n\n    /**\n     * `?deleted=` on the reads of a `softDelete` collection. A delete there\n     * moves the row to the trash, and every read hides trashed rows unless it\n     * asks for them; the list, the single row, the count and the aggregate all\n     * honour this. Empty for any other collection.\n     */\n    const deletedParameters = (collection: CollectionConfig) => {\n        const field = softDeleteFieldOf(collection);\n        if (!field) return [];\n        return [{\n            name: DELETED_QUERY_PARAM,\n            in: \"query\",\n            required: false,\n            schema: { type: \"string\", enum: [\"include\", \"only\"] },\n            description:\n                `Rows a delete moved to the trash (\\`${field}\\` set) are left out unless this asks for them: ` +\n                \"`include` reads them with the live rows, `only` reads them alone. Any other value is a \" +\n                \"400 INVALID_DELETED_PARAM.\"\n        }];\n    };\n\n    /**\n     * `?hard=` on the deletes of a `softDelete` collection: delete for good\n     * rather than move to the trash. Empty for any other collection.\n     */\n    const hardDeleteParameters = (collection: CollectionConfig) => {\n        if (!softDeleteFieldOf(collection)) return [];\n        return [{\n            name: HARD_DELETE_QUERY_PARAM,\n            in: \"query\",\n            required: false,\n            schema: { type: \"boolean\", default: false },\n            description:\n                \"`true` deletes for good instead of moving to the trash — a row already in the trash \" +\n                \"included, which is how the trash is emptied. Only `true`/`1` and `false`/`0` are \" +\n                \"accepted; anything else is a 400 INVALID_HARD_PARAM.\"\n        }];\n    };\n\n    /** What a delete does to a `softDelete` collection's row, for the delete operations' descriptions. */\n    const softDeleteBehaviour = (collection: CollectionConfig): string | undefined => {\n        const field = softDeleteFieldOf(collection);\n        if (!field) return undefined;\n        return `This collection soft-deletes: a delete moves the row to the trash by stamping \\`${field}\\`, ` +\n            \"and every read leaves it out unless it passes `?deleted=include` or `?deleted=only`. A PATCH \" +\n            `setting \\`${field}\\` back to \\`null\\` restores it. Pass \\`?hard=true\\` to delete for good.`;\n    };\n\n    // Every component name this document will carry, known before the first\n    // schema is built: a relation may point at a collection that appears later\n    // in the list, or at one that is not documented here at all, and a `$ref`\n    // at a component that does not exist is a document Swagger UI renders empty\n    // and a strict generator refuses.\n    const registeredSchemas = new Set((collections || []).map(schemaNameFor));\n\n    /**\n     * `Prefer: return=minimal`, on every route that would otherwise send a row\n     * back. Documented rather than left implicit because a client generated\n     * from this spec cannot send a header the spec does not mention.\n     */\n    const preferHeader = {\n        name: \"Prefer\",\n        in: \"header\",\n        required: false,\n        schema: { type: \"string\", enum: [\"return=minimal\"] },\n        description:\n            \"`return=minimal` asks the server not to send the written row back. Single writes then \" +\n            \"answer `204 No Content`; bulk and batch writes answer `200` carrying the ids only. \" +\n            \"The response repeats it in `Preference-Applied` when it was honoured.\"\n    };\n\n    const ifMatchHeader = {\n        name: \"If-Match\",\n        in: \"header\",\n        required: false,\n        schema: { type: \"string\" },\n        description:\n            \"The `ETag` this edit was made against, from the `GET` that read the row. The write is \" +\n            \"refused with `412` if the row has changed since — which is the difference between \" +\n            \"\\\"update the row I read\\\" and \\\"overwrite whatever is there now\\\". `*` means only that \" +\n            \"the row must exist.\"\n    };\n\n    const preconditionFailed = {\n        412: {\n            description:\n                \"The row changed since the ETag in `If-Match` was issued. Nothing was written: \" +\n                \"re-read the row, re-apply the change, and send the new ETag\",\n            content: { \"application/json\": { schema: { $ref: \"#/components/schemas/ErrorResponse\" } } }\n        }\n    };\n\n    const minimalResponse = {\n        204: {\n            description: \"Written. `Prefer: return=minimal` was honoured, so there is no body\",\n            headers: {\n                \"Preference-Applied\": { schema: { type: \"string\" }, description: \"`return=minimal`\" }\n            }\n        }\n    };\n\n    // ── POST /data/_batch — writes across collections, one transaction ────\n    //\n    // Registered before the per-collection paths for the same reason the route\n    // is: `_batch` is not a collection, and reading it as one would document a\n    // table that does not exist.\n    if ((collections || []).length > 0) {\n        paths[\"/data/_batch\"] = {\n            post: {\n                tags: [\"Data\"],\n                summary: \"Write across collections in one transaction\",\n                description:\n                    \"All-or-nothing across collections — an order and its line items, a user and \" +\n                    \"their membership row. `/bulk` is one collection at a time, and sending the two \" +\n                    \"halves as separate requests is exactly the sequence that can half-succeed.\\n\\n\" +\n                    \"Operations run in order, each through the same pipeline its single-row route \" +\n                    \"uses: the same validation, callbacks and row-level security, as the same role. \" +\n                    \"An operation may name itself with `ref`, and a later one may stand \" +\n                    \"`{ \\\"$ref\\\": \\\"order.id\\\" }` wherever a value goes — in `values`, at any depth, \" +\n                    \"or as an `id`. Only backward references resolve.\\n\\n\" +\n                    \"Capped at the same number of entries as a bulk write, because one batch is one \" +\n                    \"transaction and holds its locks for the whole of it.\",\n                operationId: \"batchWrite\",\n                parameters: [\n                    {\n                        name: \"Idempotency-Key\",\n                        in: \"header\",\n                        required: false,\n                        schema: { type: \"string\" },\n                        description:\n                            \"Names this batch so a retry is recognised instead of repeated. Without it a \" +\n                            \"client that lost the response cannot tell a replay from a second batch, and \" +\n                            \"the whole batch is written twice.\"\n                    },\n                    preferHeader\n                ],\n                requestBody: {\n                    required: true,\n                    content: {\n                        \"application/json\": {\n                            schema: {\n                                type: \"object\",\n                                required: [\"operations\"],\n                                properties: {\n                                    operations: {\n                                        type: \"array\",\n                                        items: { $ref: \"#/components/schemas/BatchOperation\" }\n                                    }\n                                }\n                            }\n                        }\n                    }\n                },\n                responses: {\n                    200: {\n                        description:\n                            \"One entry per operation, in order: the written row for a create, update or \" +\n                            \"upsert, and `null` for a delete\",\n                        content: {\n                            \"application/json\": {\n                                schema: {\n                                    type: \"object\",\n                                    properties: {\n                                        data: { type: \"array\", items: { type: \"object\", nullable: true } },\n                                        meta: { type: \"object\", properties: { operations: { type: \"integer\" } } }\n                                    }\n                                }\n                            }\n                        }\n                    },\n                    400: {\n                        description:\n                            \"Malformed body, an unknown collection or field, an illegal field operation \" +\n                            \"or conflict target, a forward `$ref`, or more operations than the limit. \" +\n                            \"Nothing was written\",\n                        content: { \"application/json\": { schema: { $ref: \"#/components/schemas/ErrorResponse\" } } }\n                    },\n                    404: {\n                        description: \"An `update` or `delete` names a row that does not exist; nothing was written\",\n                        content: { \"application/json\": { schema: { $ref: \"#/components/schemas/ErrorResponse\" } } }\n                    },\n                    409: {\n                        description: \"A request with the same Idempotency-Key is still in flight\",\n                        content: { \"application/json\": { schema: { $ref: \"#/components/schemas/ErrorResponse\" } } }\n                    },\n                    422: {\n                        description: \"The Idempotency-Key was already used for a different request\",\n                        content: { \"application/json\": { schema: { $ref: \"#/components/schemas/ErrorResponse\" } } }\n                    },\n                    ...errorResponses(requireAuth)\n                }\n            }\n        };\n\n        schemas.FieldOperation = {\n            type: \"object\",\n            description:\n                \"A change to the column's current value rather than the value to store. Exactly one \" +\n                \"operator per field. Only on an update: an operation over a value that does not exist \" +\n                \"yet is refused with a 400.\",\n            properties: {\n                $inc: { type: \"number\", description: \"Add to a `number` column; negative to subtract.\" },\n                $push: { description: \"Append a value, or each of an array of values, to an `array` column.\" },\n                $pull: { description: \"Remove every occurrence of a value from an `array` column.\" },\n                $merge: { type: \"object\", description: \"Shallow-merge an object into a `map` column.\" }\n            }\n        };\n\n        schemas.BatchOperation = {\n            type: \"object\",\n            required: [\"op\", \"collection\"],\n            properties: {\n                op: { type: \"string\", enum: [\"create\", \"update\", \"upsert\", \"delete\"] },\n                collection: { type: \"string\", description: \"The collection slug this operation writes to.\" },\n                id: {\n                    description:\n                        \"Required for `update` and `delete`. May instead be a reference marker — an \" +\n                        \"object whose single key is `$ref` and whose value is `<ref name>.<field>`, \" +\n                        \"e.g. `{ \\\"$ref\\\": \\\"order.id\\\" }` — naming a column of the row an earlier \" +\n                        \"operation wrote. (Described rather than declared as a schema: `$ref` is a \" +\n                        \"reserved word to every OpenAPI reader, and a property named `$ref` is read \" +\n                        \"as a reference and mangled.)\",\n                    oneOf: [{ type: \"string\" }, { type: \"integer\" }, { type: \"object\" }]\n                },\n                values: {\n                    type: \"object\",\n                    description:\n                        \"The row's fields. Values may be `$ref` markers; an `update` may also carry \" +\n                        \"field operations.\",\n                    additionalProperties: true\n                },\n                onConflict: {\n                    type: \"array\",\n                    items: { type: \"string\" },\n                    description:\n                        \"`upsert` only: the columns the conflict is matched on. Must carry a declared \" +\n                        \"uniqueness guarantee. Defaults to the primary key.\"\n                },\n                ref: {\n                    type: \"string\",\n                    description: \"Names this operation's result, so a later one can `$ref` its columns.\"\n                }\n            }\n        };\n    }\n\n    // ── Collection routes ────────────────────────────────────────────────\n    for (const collection of (collections || [])) {\n        const schemaName = schemaNameFor(collection);\n        const slug = collection.slug;\n\n        tags.push({\n            name: collection.name,\n            description: collection.description || `CRUD operations for ${collection.name}`\n        });\n\n        // Build component schema for this collection\n        schemas[schemaName] = buildCollectionSchema(collection, registeredSchemas);\n\n        // Build an \"input\" schema (no read-only/auto fields like autoValue dates)\n        schemas[`${schemaName}Input`] = buildCollectionInputSchema(collection);\n\n        // The update body — same columns, no `required`. PATCH and PUT both\n        // merge, so a field left out means \"unchanged\", not \"omitted by mistake\".\n        schemas[`${schemaName}Update`] = buildCollectionUpdateSchema(collection);\n\n        const dataPath = `/data/${slug}`;\n        const softDeleteNote = softDeleteBehaviour(collection);\n\n        // ── GET /data/{slug}/count — How many rows match ──────────────\n        //\n        // Served for every collection since the route existed and described\n        // here for the first time. A spec is what a generated client can see,\n        // so an endpoint missing from it is an endpoint that client does not\n        // have — and this is the one a paginating UI needs to know how many\n        // pages there are.\n        //\n        // Registered before the list path so its literal segment cannot be read\n        // as an `{id}`, which is the same ordering the router uses.\n        paths[`${dataPath}/count`] = {\n            get: {\n                tags: [collection.name],\n                summary: `Count ${collection.name}`,\n                description:\n                    \"The number of rows the same filters would return, without returning them. \" +\n                    \"Takes the filter and search parameters of the list endpoint; `limit`, `offset` \" +\n                    \"and `orderBy` are not part of the question and are ignored.\",\n                operationId: `count${schemaName}`,\n                parameters: [\n                    ...listQueryParameters().filter(p => p.name === \"searchString\"),\n                    ...deletedParameters(collection),\n                    ...buildFilterParameters(collection, reservedParameterNames)\n                ],\n                responses: {\n                    200: {\n                        description: \"The number of matching rows\",\n                        content: {\n                            \"application/json\": {\n                                schema: {\n                                    type: \"object\",\n                                    required: [\"count\"],\n                                    properties: {\n                                        count: { type: \"integer\", description: \"Rows matching the filters\" }\n                                    }\n                                }\n                            }\n                        }\n                    },\n                    ...errorResponses(requireAuth)\n                }\n            }\n        };\n\n        // ── GET /data/{slug}/aggregate — count/sum/avg/min/max ────────\n        //\n        // Before the list path for the same reason `/count` is: a literal\n        // segment that a generated client would otherwise be told is an `{id}`.\n        paths[`${dataPath}/aggregate`] = {\n            get: {\n                tags: [collection.name],\n                summary: `Aggregate ${collection.name}`,\n                description:\n                    \"Aggregate values over the rows the same filters would return. Takes the filter and \" +\n                    \"search parameters of the list endpoint. Row-level security applies to the rows \" +\n                    \"being aggregated, so a caller who can read nothing counts nothing.\",\n                operationId: `aggregate${schemaName}`,\n                parameters: [\n                    {\n                        name: \"select\",\n                        in: \"query\",\n                        required: true,\n                        description:\n                            \"Comma-separated aggregates, e.g. `count()`, `sum(total)`, `avg(total),max(total)`. \" +\n                            \"Results are keyed `count`, `sum_total`, `avg_total` and so on.\",\n                        schema: { type: \"string\" },\n                        example: \"count(),sum(total)\"\n                    },\n                    {\n                        name: \"groupBy\",\n                        in: \"query\",\n                        required: false,\n                        description: \"Comma-separated fields to group by. Each grouped field is returned alongside the aggregates.\",\n                        schema: { type: \"string\" },\n                        example: \"status\"\n                    },\n                    // `limit`, `offset` and `page` bound and page the groups,\n                    // exactly as they do a listing's rows.\n                    ...listQueryParameters().filter(p =>\n                        p.name === \"searchString\" || p.name === \"limit\" || p.name === \"offset\" || p.name === \"page\"),\n                    {\n                        name: \"orderBy\",\n                        in: \"query\",\n                        required: false,\n                        description:\n                            \"Sort for the groups, by a `groupBy` field or an aggregate's result key (`count`, \" +\n                            \"`sum_total`): `key:asc`, `key:desc` or `key:desc:last`. Groups it leaves tied are \" +\n                            \"ordered by the `groupBy` fields, so every page boundary falls in the same place. \" +\n                            \"`offset`, `page` and `orderBy` need `groupBy` — without it the result is one row — \" +\n                            \"and are otherwise a 400 INVALID_AGGREGATE_WINDOW.\",\n                        schema: { type: \"string\" },\n                        example: \"count:desc\"\n                    },\n                    ...deletedParameters(collection),\n                    ...buildFilterParameters(collection, reservedParameterNames)\n                ],\n                responses: {\n                    200: {\n                        description: \"One row per group, or a single row when `groupBy` is absent\",\n                        content: {\n                            \"application/json\": {\n                                schema: {\n                                    type: \"object\",\n                                    required: [\"data\"],\n                                    properties: {\n                                        data: {\n                                            type: \"array\",\n                                            items: { type: \"object\", additionalProperties: true }\n                                        },\n                                        meta: {\n                                            type: \"object\",\n                                            description: \"The page of groups. Present when `groupBy` is.\",\n                                            properties: {\n                                                limit: { type: \"integer\" },\n                                                offset: { type: \"integer\" },\n                                                hasMore: { type: \"boolean\", description: \"Whether a group follows this page.\" }\n                                            }\n                                        }\n                                    }\n                                }\n                            }\n                        }\n                    },\n                    501: { description: \"This backend's data driver does not implement aggregates\" },\n                    ...errorResponses(requireAuth)\n                }\n            }\n        };\n\n        // ── GET /data/{slug} — List entities ──────────────────────────\n        paths[dataPath] = {\n            get: {\n                tags: [collection.name],\n                summary: `List ${collection.name}`,\n                operationId: `list${schemaName}`,\n                parameters: [\n                    ...listQueryParameters(),\n                    ...deletedParameters(collection),\n                    ...buildFilterParameters(collection, reservedParameterNames)\n                ],\n                responses: {\n                    200: {\n                        description: \"Paginated list of entities\",\n                        content: {\n                            \"application/json\": {\n                                schema: {\n                                    type: \"object\",\n                                    properties: {\n                                        data: {\n                                            type: \"array\",\n                                            items: { $ref: `#/components/schemas/${schemaName}` }\n                                        },\n                                        meta: { $ref: \"#/components/schemas/PaginationMeta\" }\n                                    }\n                                }\n                            }\n                        }\n                    },\n                    ...errorResponses(requireAuth)\n                }\n            },\n            post: {\n                tags: [collection.name],\n                summary: `Create ${collection.singularName || collection.name}`,\n                operationId: `create${schemaName}`,\n                parameters: [\n                    {\n                        name: \"on_conflict\",\n                        in: \"query\",\n                        required: false,\n                        schema: { type: \"string\" },\n                        description:\n                            \"Comma-separated columns to upsert on, turning the create into \" +\n                            \"INSERT ... ON CONFLICT DO UPDATE. They must carry a declared uniqueness \" +\n                            \"guarantee — `validation.unique`, a `unique` index, or the primary key — \" +\n                            \"or the request is refused with a 400 naming the targets that do exist. \" +\n                            \"Left off, this is a plain insert and a duplicate key still raises.\",\n                        example: \"email\"\n                    },\n                    preferHeader\n                ],\n                requestBody: {\n                    required: true,\n                    content: {\n                        \"application/json\": {\n                            schema: { $ref: `#/components/schemas/${schemaName}Input` }\n                        }\n                    }\n                },\n                responses: {\n                    201: {\n                        description: \"Created entity\",\n                        content: {\n                            \"application/json\": {\n                                schema: { $ref: `#/components/schemas/${schemaName}` }\n                            }\n                        }\n                    },\n                    ...minimalResponse,\n                    ...errorResponses(requireAuth)\n                }\n            }\n        };\n\n        // ── Bulk: one transaction, all-or-nothing ─────────────────────\n        //\n        // These went undocumented while they existed, which is the same defect\n        // the update verb had: an endpoint the server serves and the spec does\n        // not mention cannot be reached by a generated client at all.\n        const idempotencyHeader = {\n            name: \"Idempotency-Key\",\n            in: \"header\",\n            required: false,\n            schema: { type: \"string\" },\n            description:\n                \"Names this write so a retry is recognised instead of repeated. Without it a \" +\n                \"client that lost the response cannot distinguish a replay from a second \" +\n                \"genuine batch, and the whole batch is written twice. A key names one request: \" +\n                \"re-send the identical request to replay its answer, and use a new key for a \" +\n                \"different one.\"\n        };\n\n        const bulkErrors = {\n            400: {\n                description: \"Malformed body, an unknown field, or more rows than the per-batch limit\",\n                content: { \"application/json\": { schema: { $ref: \"#/components/schemas/ErrorResponse\" } } }\n            },\n            409: {\n                description:\n                    \"A request with the same Idempotency-Key is still in flight. Retry it: the \" +\n                    \"first attempt's result is replayed once it lands\",\n                content: { \"application/json\": { schema: { $ref: \"#/components/schemas/ErrorResponse\" } } }\n            },\n            422: {\n                description: \"The Idempotency-Key was already used for a different request\",\n                content: { \"application/json\": { schema: { $ref: \"#/components/schemas/ErrorResponse\" } } }\n            },\n            ...errorResponses(requireAuth)\n        };\n\n        paths[`/data/${slug}/bulk`] = {\n            post: {\n                tags: [collection.name],\n                summary: `Create many ${collection.name} in one transaction`,\n                description:\n                    \"All-or-nothing: if any row is rejected none of them land, and the error names \" +\n                    \"the offending index. Every row still runs callbacks, relations and row-level \" +\n                    \"security. Capped server-side because one batch holds its locks for its whole \" +\n                    \"duration.\",\n                operationId: `createMany${schemaName}`,\n                parameters: [idempotencyHeader, preferHeader],\n                requestBody: {\n                    required: true,\n                    content: {\n                        \"application/json\": {\n                            schema: {\n                                type: \"object\",\n                                required: [\"rows\"],\n                                properties: {\n                                    rows: { type: \"array\", items: { $ref: `#/components/schemas/${schemaName}Input` } },\n                                    upsert: {\n                                        type: \"boolean\",\n                                        description: \"Write each row as INSERT ... ON CONFLICT DO UPDATE.\"\n                                    },\n                                    onConflict: {\n                                        type: \"array\",\n                                        items: { type: \"string\" },\n                                        description:\n                                            \"The columns the conflict is matched on, instead of the primary key. \" +\n                                            \"They must carry a declared uniqueness guarantee. Naming them without \" +\n                                            \"`upsert: true` is a 400 rather than a silently ignored field.\"\n                                    }\n                                }\n                            }\n                        }\n                    }\n                },\n                responses: {\n                    200: {\n                        description: \"The written rows, in the order given\",\n                        content: {\n                            \"application/json\": {\n                                schema: {\n                                    type: \"object\",\n                                    properties: {\n                                        data: { type: \"array\", items: { $ref: `#/components/schemas/${schemaName}` } },\n                                        meta: { type: \"object\", properties: { written: { type: \"integer\" } } }\n                                    }\n                                }\n                            }\n                        }\n                    },\n                    ...bulkErrors\n                }\n            },\n            patch: {\n                tags: [collection.name],\n                summary: `Update many ${collection.name} in one transaction`,\n                description:\n                    \"Each entry names its row and the fields to change. `{ id, data }` rather than \" +\n                    \"flat rows carrying their own key, because on a table keyed on something other \" +\n                    \"than `id` a flat row cannot say whether a column is the address or a value to \" +\n                    \"write. An id matching no row fails the batch.\",\n                operationId: `updateMany${schemaName}`,\n                parameters: [idempotencyHeader, preferHeader],\n                requestBody: {\n                    required: true,\n                    content: {\n                        \"application/json\": {\n                            schema: {\n                                type: \"object\",\n                                required: [\"updates\"],\n                                properties: {\n                                    updates: {\n                                        type: \"array\",\n                                        items: {\n                                            type: \"object\",\n                                            required: [\"id\", \"data\"],\n                                            properties: {\n                                                id: { type: \"string\", description: \"The row to update\" },\n                                                data: { $ref: `#/components/schemas/${schemaName}Update` }\n                                            }\n                                        }\n                                    }\n                                }\n                            }\n                        }\n                    }\n                },\n                responses: {\n                    200: {\n                        description: \"The updated rows, in the order given\",\n                        content: {\n                            \"application/json\": {\n                                schema: {\n                                    type: \"object\",\n                                    properties: {\n                                        data: { type: \"array\", items: { $ref: `#/components/schemas/${schemaName}` } },\n                                        meta: { type: \"object\", properties: { written: { type: \"integer\" } } }\n                                    }\n                                }\n                            }\n                        }\n                    },\n                    404: {\n                        description: \"One of the ids matches no row; nothing was written\",\n                        content: { \"application/json\": { schema: { $ref: \"#/components/schemas/ErrorResponse\" } } }\n                    },\n                    ...bulkErrors\n                }\n            }\n        };\n\n        paths[`/data/${slug}/bulk/delete`] = {\n            post: {\n                tags: [collection.name],\n                summary: `Delete many ${collection.name} in one transaction`,\n                description:\n                    \"A POST, not `DELETE /bulk` with a body. Bodies on DELETE are permitted but \" +\n                    \"widely dropped by proxies and CDNs, and several generators ignore \" +\n                    \"`requestBody` on a DELETE operation — a generated client would send the \" +\n                    \"request with no ids at all. Takes ids rather than a filter: a mistyped \" +\n                    \"condition that empties a table cannot be reviewed at the call site the way \" +\n                    \"an explicit list can. `beforeDelete`/`afterDelete` fire per row.\" +\n                    (softDeleteNote ? `\\n\\n${softDeleteNote}` : \"\"),\n                operationId: `deleteMany${schemaName}`,\n                parameters: [idempotencyHeader, ...hardDeleteParameters(collection)],\n                requestBody: {\n                    required: true,\n                    content: {\n                        \"application/json\": {\n                            schema: {\n                                type: \"object\",\n                                required: [\"ids\"],\n                                properties: {\n                                    ids: {\n                                        type: \"array\",\n                                        items: { oneOf: [{ type: \"string\" }, { type: \"integer\" }] }\n                                    }\n                                }\n                            }\n                        }\n                    }\n                },\n                responses: {\n                    200: {\n                        description: softDeleteNote\n                            ? \"How many rows were moved to the trash, or deleted for good with `?hard=true`\"\n                            : \"How many rows were deleted\",\n                        content: {\n                            \"application/json\": {\n                                schema: {\n                                    type: \"object\",\n                                    properties: {\n                                        meta: { type: \"object\", properties: { deleted: { type: \"integer\" } } }\n                                    }\n                                }\n                            }\n                        }\n                    },\n                    404: {\n                        description: \"One of the ids matches no row; nothing was deleted\",\n                        content: { \"application/json\": { schema: { $ref: \"#/components/schemas/ErrorResponse\" } } }\n                    },\n                    ...bulkErrors\n                }\n            }\n        };\n\n        // ── GET/PUT/DELETE /data/{slug}/{id} ──────────────────────────\n        const entityPath = `/data/${slug}/{id}`;\n        paths[entityPath] = {\n            get: {\n                tags: [collection.name],\n                summary: `Get ${collection.singularName || collection.name} by ID`,\n                operationId: `get${schemaName}ById`,\n                parameters: [\n                    { name: \"id\",\nin: \"path\",\nrequired: true,\nschema: { type: \"string\" },\ndescription: \"Entity ID\" },\n                    // The same two parameters the list route documents, and the\n                    // same code serves them — one row and a page of them go\n                    // through one pipeline, so anything true of `include` or\n                    // `fields` there is true here.\n                    {\n                        name: \"include\",\n                        in: \"query\",\n                        schema: { type: \"string\" },\n                        description:\n                            \"Relations to load: comma-separated names or dotted paths \"\n                            + \"(`author,comments.author`, up to 3 hops), `*` for all one hop deep, or the \"\n                            + \"JSON form for per-relation `limit`/`where`/`orderBy`/`fields`. An unknown \"\n                            + \"name is a 400 UNKNOWN_RELATION.\",\n                        example: \"author,comments.author\"\n                    },\n                    {\n                        name: \"fields\",\n                        in: \"query\",\n                        schema: { type: \"string\" },\n                        description:\n                            \"Comma-separated columns to return, as a SELECT projection. The primary key \"\n                            + \"always survives and `excludeFromApi` columns stay hidden.\",\n                        example: \"id,title\"\n                    },\n                    ...deletedParameters(collection)\n                ],\n                responses: {\n                    200: {\n                        description: \"Entity found\",\n                        headers: {\n                            ETag: {\n                                schema: { type: \"string\" },\n                                description:\n                                    \"This row's version. Send it back as `If-Match` on a later PATCH or \" +\n                                    \"DELETE to have the write refused if the row has changed in between.\"\n                            }\n                        },\n                        content: {\n                            \"application/json\": {\n                                schema: { $ref: `#/components/schemas/${schemaName}` }\n                            }\n                        }\n                    },\n                    404: { description: \"Entity not found\",\ncontent: { \"application/json\": { schema: { $ref: \"#/components/schemas/ErrorResponse\" } } } },\n                    ...errorResponses(requireAuth)\n                }\n            },\n            patch: updateOperation(collection, schemaName, requireAuth, {\n                ifMatchHeader,\n                preferHeader,\n                preconditionFailed,\n                minimalResponse\n            }),\n            delete: {\n                tags: [collection.name],\n                summary: `Delete ${collection.singularName || collection.name}`,\n                ...(softDeleteNote ? { description: softDeleteNote } : {}),\n                operationId: `delete${schemaName}`,\n                parameters: [\n                    { name: \"id\",\nin: \"path\",\nrequired: true,\nschema: { type: \"string\" },\ndescription: \"Entity ID\" },\n                    ifMatchHeader,\n                    {\n                        name: \"Idempotency-Key\",\n                        in: \"header\",\n                        required: false,\n                        schema: { type: \"string\" },\n                        description:\n                            \"Names this delete so a retry replays its answer. A delete replayed after \" +\n                            \"the first attempt committed would otherwise answer 404 — which an offline \" +\n                            \"queue reads as a permanent failure for a delete that in fact succeeded.\"\n                    },\n                    ...hardDeleteParameters(collection)\n                ],\n                responses: {\n                    204: {\n                        description: softDeleteNote\n                            ? \"Moved to the trash: the row still exists and can be restored. With `?hard=true`, deleted for good\"\n                            : \"Deleted successfully\"\n                    },\n                    404: { description: \"Entity not found\",\ncontent: { \"application/json\": { schema: { $ref: \"#/components/schemas/ErrorResponse\" } } } },\n                    409: {\n                        description: \"A request with the same Idempotency-Key is still in flight\",\n                        content: { \"application/json\": { schema: { $ref: \"#/components/schemas/ErrorResponse\" } } }\n                    },\n                    422: {\n                        description: \"The Idempotency-Key was already used for a different request\",\n                        content: { \"application/json\": { schema: { $ref: \"#/components/schemas/ErrorResponse\" } } }\n                    },\n                    ...preconditionFailed,\n                    ...errorResponses(requireAuth)\n                }\n            }\n        };\n\n    }\n\n    // ── Subcollection routes ─────────────────────────────────────────────\n    //\n    // A second pass, after every collection's component schema exists. These\n    // routes `$ref` the *target's* schema, and the first pass builds schemas in\n    // array order — so doing this inline meant a subcollection whose target\n    // appeared later in the list silently degraded to an untyped `object`.\n    //\n    // The names come from the *resolved* relations, not from the authored\n    // `relations` array. `relationName` is optional at the authoring surface —\n    // it defaults to the property key, or to the target's slug — so reading the\n    // raw field skipped every relation that relied on the default, and missed\n    // relations declared inline on a property entirely, since those are not in\n    // the array. These are the same resolved names the nested-path router\n    // matches, so the spec and the routes cannot drift apart.\n    //\n    // A to-one relation is left out. `posts/1/author` resolves, but it\n    // addresses a single row, and documenting it as a paginated list would\n    // describe a response shape the client never gets.\n    for (const collection of (collections || [])) {\n        const slug = collection.slug;\n        const schemaName = schemaNameFor(collection);\n        const relations = Object.values(resolveCollectionRelations(collection))\n            .filter(isToMany);\n        for (const relation of relations) {\n            const relationName = relation.relationName;\n            const targetCollection = relation.target();\n            const targetSchema = schemaNameFor(targetCollection);\n\n            const subPath = `/data/${slug}/{parentId}/${relationName}`;\n\n            // Only add if the schema exists (target collection is also registered)\n            paths[subPath] = {\n                get: {\n                    tags: [collection.name],\n                    summary: `List ${relationName} for ${withIndefiniteArticle(collection.singularName || collection.name)}`,\n                    operationId: `list${schemaName}${toPascalCase(relationName)}`,\n                    parameters: [\n                        { name: \"parentId\",\nin: \"path\",\nrequired: true,\nschema: { type: \"string\" },\ndescription: `${collection.singularName || collection.name} ID` },\n                        // The nested list handler goes through the same\n                        // `parseQueryOptions` and the same fetch as the root\n                        // one, so it honours the same parameters. It documented\n                        // four of them.\n                        ...listQueryParameters()\n                    ],\n                    responses: {\n                        200: {\n                            description: `List of related ${relationName}`,\n                            content: {\n                                \"application/json\": {\n                                    schema: {\n                                        type: \"object\",\n                                        properties: {\n                                            data: {\n                                                type: \"array\",\n                                                items: schemas[targetSchema]\n                                                    ? { $ref: `#/components/schemas/${targetSchema}` }\n                                                    : { type: \"object\" }\n                                            },\n                                            meta: { $ref: \"#/components/schemas/PaginationMeta\" }\n                                        }\n                                    }\n                                }\n                            }\n                        },\n                        ...errorResponses(requireAuth)\n                    }\n                }\n            };\n        }\n    }\n\n    return spec;\n}\n\n// ── Helpers ──────────────────────────────────────────────────────────────\n\n/**\n * Is this property part of the shape the document may describe?\n *\n * One exclusion, and it is the document telling the truth about what the server\n * does: `excludeFromApi` is a server-side guarantee that the column \"is\n * stripped from every row the API serves, for every caller, including admins\n * and service keys\" — `stripExcluded` in the row pipeline enforces it. A schema\n * that lists such a column describes a field that is never present, and it\n * describes it to everyone: `/docs` is mounted on the app, not on the data\n * router, so it carries none of the auth middleware `{basePath}/data` does.\n * Every project scaffolded by `rebase init` published its `users` collection's\n * `passwordHash` and `emailVerificationToken` this way.\n *\n * A `relation` property used to be excluded here too, on the reasoning that the\n * property is virtual. It is — but the row is not empty where it stands: the\n * owning side carries a foreign key under a *wire* name (`authorId`), and a\n * read that includes the relation carries the target's row under the relation's\n * own name. Excluding both left `/api/docs` describing a strictly smaller\n * collection than `generated/sdk/database.types.ts` did for the same config.\n * Relations are now emitted by {@link emitRelationProperties}, under the same\n * keys and in the same order as the SDK's `Row`; the direct-property loops skip\n * them so the two passes cannot emit one key twice.\n *\n * Written as one predicate rather than a `continue` per loop because it kept\n * being fixed in one loop at a time: this is the same rule the SDK generator\n * applies to its `Row` type (`packages/codegen/src/generate-types.ts`).\n */\nfunction isDocumentedProperty(property: Property, direction: \"read\" | \"write\" = \"read\"): boolean {\n    const access = effectiveAccess(property);\n    return access?.[direction]?.length !== 0;\n}\n\n/**\n * The `x-rebase-access` annotation, or nothing for a field with no rule.\n *\n * A vendor extension rather than a schema keyword because OpenAPI has no way to\n * say \"this property is present for some callers\" — `readOnly` is about the\n * direction of a field, not about who. Generators ignore what they do not know,\n * so a client built from this spec still compiles; a *human* reading `/docs`, or\n * a gateway that wants to enforce the same rule at the edge, gets the role lists\n * verbatim. Emitted for the role case only: a field closed to everybody is\n * absent from the document entirely, which is a stronger statement.\n */\nfunction accessAnnotation(property: Property): Record<string, unknown> | undefined {\n    const access = effectiveAccess(property);\n    if (!access) return undefined;\n    const annotation: Record<string, unknown> = {};\n    if (access.read !== undefined) annotation.read = [...access.read];\n    if (access.write !== undefined) annotation.write = [...access.write];\n    return Object.keys(annotation).length > 0 ? annotation : undefined;\n}\n\n/** The sentence `x-rebase-access` deserves in prose, for a reader of `/docs`. */\nfunction accessDescription(property: Property): string | undefined {\n    const access = effectiveAccess(property);\n    if (!access) return undefined;\n    const parts: string[] = [];\n    const phrase = (roles: readonly string[]) =>\n        roles.length === 0 ? \"nobody through the API\" : roles.map(r => `\\`${r}\\``).join(\", \") + \" (and `admin`)\";\n    if (access.read !== undefined) parts.push(`readable by ${phrase(access.read)}`);\n    if (access.write !== undefined) parts.push(`writable by ${phrase(access.write)}`);\n    if (parts.length === 0) return undefined;\n    return `Field access: ${parts.join(\"; \")}. A caller without the role does not receive the field at all — it is absent, not null.`;\n}\n\n/**\n * The keys `stripExcluded` deletes: the property name *and* its column name.\n *\n * Seeding the emitted set with both is what stops a foreign key derived from a\n * relation putting an `excludeFromApi` column back on the surface under its\n * other name. Same pair, same reason, as `excludedApiKeys` in the SDK\n * generator.\n */\nfunction excludedApiKeys(collection: CollectionConfig, direction: \"read\" | \"write\" = \"read\"): Set<string> {\n    const excluded = new Set<string>();\n    for (const [key, property] of Object.entries(collection.properties ?? {})) {\n        if (isDocumentedProperty(property as Property, direction)) continue;\n        excluded.add(key);\n        const columnName = (property as { columnName?: unknown }).columnName;\n        if (typeof columnName === \"string\") excluded.add(columnName);\n    }\n    return excluded;\n}\n\n/**\n * The collection's primary key, as the key it is addressed by on the wire and\n * the property that declares it.\n *\n * `id` was a literal in three places — seeded before the read loop, assigned\n * after the input loop, inherited by the update schema from the input one — and\n * the two spellings disagreed: a declared `id: { type: \"number\" }` overwrote\n * the read seed and was overwritten by the input assignment, so the same field\n * was `integer` in `Post` and `string` in `PostInput`. One helper now answers\n * the question for all three.\n */\nfunction idPropertyEntry(collection: CollectionConfig | undefined): [string, Property] | undefined {\n    for (const [key, property] of Object.entries(collection?.properties ?? {})) {\n        if ((property as Record<string, unknown>)?.isId) return [key, property as Property];\n    }\n    return undefined;\n}\n\n/**\n * The schema of a primary key or of a foreign key pointing at one: the declared\n * property's own type, stripped of the field-level facts (description,\n * validation bounds) that belong to the column and not to a reference to it.\n *\n * Falls back to `string` for a collection that declares no primary key, which\n * is what every schema here assumed unconditionally before.\n */\nfunction idSchemaFor(collection: CollectionConfig | undefined): Record<string, unknown> {\n    const declared = idPropertyEntry(collection);\n    if (!declared) return { type: \"string\" };\n    const converted = convertPropertyToSchema(declared[1]);\n    const schema: Record<string, unknown> = { type: converted.type ?? \"string\" };\n    if (converted.format) schema.format = converted.format;\n    return schema;\n}\n\n/**\n * Relations resolve or they do not; a document is still owed for a collection\n * whose target thunk throws (a circular import, usually). The SDK generator\n * warns and carries on with no relation fields, and so does this — the\n * alternative is `/api/docs` 500ing for the whole project.\n */\nfunction resolveRelationsForDocument(collection: CollectionConfig): Record<string, ResolvedRelation> {\n    try {\n        return resolveCollectionRelations(collection);\n    } catch {\n        return {};\n    }\n}\n\n/** Unwrap a target handed back as a module namespace — `() => import(\"./authors\")`. */\nfunction relationTarget(relation: ResolvedRelation): CollectionConfig | undefined {\n    try {\n        let target = relation.target() as CollectionConfig & { default?: CollectionConfig; __esModule?: boolean };\n        if (target && (target.default || target.__esModule)) {\n            target = (target.default ?? target) as typeof target;\n        }\n        return target;\n    } catch {\n        return undefined;\n    }\n}\n\n/**\n * The schema an *included* relation arrives as: the target's own row.\n *\n * `$ref` when the target is one of the collections this document describes, and\n * an open object when it is not — a dangling pointer makes Swagger UI render an\n * empty model and makes a strict generator abort, which is worse than a vague\n * one.\n */\nfunction includedRelationSchema(\n    relation: ResolvedRelation,\n    registeredSchemas: ReadonlySet<string>\n): Record<string, unknown> {\n    const target = relationTarget(relation);\n    const targetSchema = target ? schemaNameFor(target) : undefined;\n    const item: Record<string, unknown> = targetSchema && registeredSchemas.has(targetSchema)\n        ? { $ref: `#/components/schemas/${targetSchema}` }\n        : { type: \"object\" };\n    return relation.cardinality === \"many\" ? { type: \"array\", items: item } : item;\n}\n\n/**\n * Emit a collection's relations onto a read schema: the foreign keys first,\n * then the relations themselves.\n *\n * The order and the keys are the SDK `Row`'s, deliberately — the parity test\n * next door compares the two key sets, and the only way that stays true is for\n * both to be derived the same way rather than kept in step by hand.\n *\n * A `belongsTo` reaches the wire under the *field* name of its local column\n * (`author_id` → `authorId`), which is what `fieldKeyForColumn` answers; a\n * relation addressed by the same name as its own foreign key is served as\n * either the scalar or the nested row depending on `include`, so it is\n * documented as both.\n */\nfunction emitRelationProperties(\n    collection: CollectionConfig,\n    properties: Record<string, unknown>,\n    required: string[],\n    emitted: Set<string>,\n    registeredSchemas: ReadonlySet<string>\n): void {\n    const resolved = resolveRelationsForDocument(collection);\n\n    for (const [relationKey, relation] of Object.entries(resolved)) {\n        if (relation.kind !== \"belongsTo\" || !relation.localKey) continue;\n        const fieldKey = fieldKeyForColumn(collection, relation.localKey);\n        if (emitted.has(fieldKey)) continue;\n\n        const foreignKey = idSchemaFor(relationTarget(relation));\n        const shadowedByInclude = relationKey === fieldKey;\n        properties[fieldKey] = shadowedByInclude\n            ? { oneOf: [foreignKey, includedRelationSchema(relation, registeredSchemas)] }\n            : { ...foreignKey, description: `Foreign key into \\`${relation.targetSlug}\\`` };\n        emitted.add(fieldKey);\n\n        if (isRelationRequired(collection, relation) && !shadowedByInclude) required.push(fieldKey);\n    }\n\n    for (const [key, relation] of Object.entries(resolved)) {\n        if (emitted.has(key)) continue;\n        properties[key] = includedRelationSchema(relation, registeredSchemas);\n        emitted.add(key);\n    }\n\n    // A `relation` property whose relation did not resolve. Still a field of the\n    // row, just not a precisely describable one.\n    for (const [key, property] of Object.entries(collection.properties ?? {})) {\n        if ((property as Property)?.type !== \"relation\") continue;\n        if (emitted.has(key)) continue;\n        properties[key] = { type: \"object\" };\n        emitted.add(key);\n    }\n}\n\n/**\n * Build the component schema for a collection (output / read shape).\n *\n * Every declared property except the ones {@link isDocumentedProperty} rules\n * out, plus the foreign keys and relations {@link emitRelationProperties} adds.\n */\nexport function buildCollectionSchema(\n    collection: CollectionConfig,\n    registeredSchemas: ReadonlySet<string>\n): Record<string, unknown> {\n    const idKey = idPropertyEntry(collection)?.[0] ?? \"id\";\n    const properties: Record<string, unknown> = {\n        [idKey]: { ...idSchemaFor(collection), description: \"Unique identifier\" }\n    };\n    const required: string[] = [idKey];\n    const excluded = excludedApiKeys(collection);\n    const emitted = new Set<string>(excluded);\n    emitted.add(idKey);\n\n    for (const [key, property] of Object.entries(collection.properties)) {\n        if (property.type === \"relation\") continue;\n        if (!isDocumentedProperty(property)) continue;\n\n        properties[key] = convertPropertyToSchema(property);\n        emitted.add(key);\n\n        if (property.validation?.required && key !== idKey) {\n            required.push(key);\n        }\n    }\n\n    emitRelationProperties(collection, properties, required, emitted, registeredSchemas);\n    annotateTenantField(collection, properties, \"read\");\n\n    return {\n        type: \"object\",\n        required: required.length > 0 ? required : undefined,\n        properties\n    };\n}\n\n/**\n * Mark the tenant field, on whichever schema is being built.\n *\n * A vendor extension for the same reason `x-rebase-access` is one: OpenAPI has\n * no keyword for \"the server fills this in from who you are, and refuses a\n * value that is not yours\". `readOnly` is the closest and it is wrong — the\n * field *is* writable, by a caller sending their own tenant, and a bypass role\n * may send any. Generators ignore what they do not know, so a client built from\n * this document still compiles; a human reading `/docs`, or a gateway wanting\n * to enforce the same boundary at the edge, learns the field is special and\n * why.\n *\n * Applied after the property loops rather than inside `convertPropertyToSchema`\n * because tenancy is a fact about the *collection*, and that function is handed\n * a property with no idea which collection it came from.\n */\nfunction annotateTenantField(\n    collection: CollectionConfig,\n    properties: Record<string, unknown>,\n    direction: \"read\" | \"write\"\n): void {\n    const tenant = getTenantConfig(collection);\n    if (!tenant) return;\n    const schema = properties[tenant.field];\n    if (!schema || typeof schema !== \"object\") return;\n\n    const existing = (schema as { description?: unknown }).description;\n    const sentence = direction === \"write\"\n        ? \"The tenant this row belongs to. Omit it and the server stamps the tenant you are calling as; \" +\n          \"send another tenant's and the write is refused with `TENANT_MISMATCH`. It cannot be changed \" +\n          \"on an update (`TENANT_IMMUTABLE`).\"\n        : \"The tenant this row belongs to. Rows of other tenants are not returned at all.\";\n\n    properties[tenant.field] = {\n        ...(schema as Record<string, unknown>),\n        description: typeof existing === \"string\" && existing ? `${existing} — ${sentence}` : sentence,\n        \"x-rebase-tenant\": true\n    };\n}\n\n/**\n * The PATCH/PUT operation for `/data/{slug}/{id}`.\n *\n * Split out because both verbs serve it and they must not drift: the update\n * body is a **partial**, and describing it with the create schema was the bug\n * this replaces. `<Name>Input` marks every `validation.required` property as\n * required — correct for POST, wrong for an update, where omitting a field\n * means \"leave it alone\" rather than \"I forgot it\". A client generated from\n * that spec demanded fields the server does not, and a spec-validating gateway\n * would have rejected partial updates the server accepts.\n */\nfunction updateOperation(\n    collection: CollectionConfig,\n    schemaName: string,\n    requireAuth: boolean,\n    shared: {\n        ifMatchHeader: Record<string, unknown>;\n        preferHeader: Record<string, unknown>;\n        preconditionFailed: Record<string, unknown>;\n        minimalResponse: Record<string, unknown>;\n    }\n): Record<string, unknown> {\n    return {\n        tags: [collection.name],\n        summary: `Update ${collection.singularName || collection.name}`,\n        description:\n            \"Partial update: only the properties present in the body are written; the rest are left \" +\n            \"unchanged.\\n\\n\" +\n            \"A property's value may instead be a field operation — `{ \\\"views\\\": { \\\"$inc\\\": 1 } }`, \" +\n            \"`{ \\\"tags\\\": { \\\"$push\\\": \\\"new\\\" } }`, `{ \\\"tags\\\": { \\\"$pull\\\": \\\"old\\\" } }`, \" +\n            \"`{ \\\"meta\\\": { \\\"$merge\\\": { \\\"seen\\\": true } } }` — which is applied inside the \" +\n            \"statement holding the row lock. That is the difference between a counter that is correct \" +\n            \"under concurrency and one that silently loses increments, because expressing the same \" +\n            \"change as a value means reading it first. `$inc` needs a `number` property, `$push`/`$pull` \" +\n            \"an `array`, `$merge` a `map`; anything else is a 400. Pushed elements and merged keys answer \" +\n            \"to the property's own rules, as a value would. See the `FieldOperation` schema.\",\n        operationId: `update${schemaName}`,\n        parameters: [\n            { name: \"id\", in: \"path\", required: true, schema: { type: \"string\" }, description: \"Entity ID\" },\n            shared.ifMatchHeader,\n            shared.preferHeader,\n            {\n                name: \"Idempotency-Key\",\n                in: \"header\",\n                required: false,\n                schema: { type: \"string\" },\n                description:\n                    \"Names this update so a retry replays its answer instead of applying the edit \" +\n                    \"again. A PATCH is not naturally idempotent — a field operation emphatically is \" +\n                    \"not — so a retry after a lost response applies it twice.\"\n            }\n        ],\n        requestBody: {\n            required: true,\n            content: {\n                \"application/json\": {\n                    schema: { $ref: `#/components/schemas/${schemaName}Update` }\n                }\n            }\n        },\n        responses: {\n            200: {\n                description: \"Updated entity\",\n                content: {\n                    \"application/json\": {\n                        schema: { $ref: `#/components/schemas/${schemaName}` }\n                    }\n                }\n            },\n            404: {\n                description: \"Entity not found\",\n                content: { \"application/json\": { schema: { $ref: \"#/components/schemas/ErrorResponse\" } } }\n            },\n            409: {\n                description: \"A request with the same Idempotency-Key is still in flight\",\n                content: { \"application/json\": { schema: { $ref: \"#/components/schemas/ErrorResponse\" } } }\n            },\n            422: {\n                description: \"The Idempotency-Key was already used for a different request\",\n                content: { \"application/json\": { schema: { $ref: \"#/components/schemas/ErrorResponse\" } } }\n            },\n            ...shared.preconditionFailed,\n            ...shared.minimalResponse,\n            ...errorResponses(requireAuth)\n        }\n    };\n}\n\n/**\n * The update body: the create schema with `required` dropped.\n *\n * Derived rather than rebuilt so the two cannot describe different columns —\n * the only difference between creating and updating is which fields you must\n * supply, and that is exactly the one thing removed here.\n */\nfunction buildCollectionUpdateSchema(collection: CollectionConfig): Record<string, unknown> {\n    const { required: _required, ...rest } = buildCollectionInputSchema(collection);\n    return rest;\n}\n\n/**\n * Build an input schema (for POST/PUT) — excludes auto-generated fields.\n *\n * `excludeFromApi` columns are left out too, and the server now agrees: a write\n * naming one is refused (`write-validation.ts`), which is what the flag's name\n * and the generated SDK's own documentation always said. This comment used to\n * record that such a write was \"still accepted\" — the document was right and\n * the server was the thing that had not caught up.\n */\nexport function buildCollectionInputSchema(collection: CollectionConfig): Record<string, unknown> {\n    const properties: Record<string, unknown> = {};\n    const required: string[] = [];\n    // The write half, not the read half: a field readable by nobody but\n    // writable by an `admin` belongs in the input body and not in the row, and\n    // the two schemas used to share one exclusion set and so got both wrong.\n    const excluded = excludedApiKeys(collection, \"write\");\n    const emitted = new Set<string>(excluded);\n    const idKey = idPropertyEntry(collection)?.[0] ?? \"id\";\n\n    for (const [key, property] of Object.entries(collection.properties)) {\n        if (property.type === \"relation\") continue;\n        if (!isDocumentedProperty(property, \"write\")) continue;\n\n        // Skip auto-value date fields from the input schema\n        if (property.type === \"date\" && property.autoValue) continue;\n\n        // Skip auto-generated ID fields\n        if (\"isId\" in property && property.isId && property.isId !== \"manual\" && property.isId !== true) continue;\n\n        properties[key] = convertPropertyToSchema(property);\n        emitted.add(key);\n\n        if (property.validation?.required) {\n            required.push(key);\n        }\n    }\n\n    // Allow explicit ID for create (optional). Typed from the declared primary\n    // key rather than as a `string` literal: a serial `id` was `integer` on the\n    // read schema and `string` here, for the same column, in every document the\n    // generator has ever produced.\n    if (!emitted.has(idKey)) {\n        properties[idKey] = {\n            ...idSchemaFor(collection),\n            description: \"Optional: client-assigned ID. If omitted, the server generates one.\"\n        };\n        emitted.add(idKey);\n    }\n\n    // The two ways a write may name a `belongsTo` target, both of which the\n    // server accepts and the generated SDK's `Insert` already offered: the\n    // foreign key under its own wire name (`authorId`), and the relation\n    // property (`author`), which the write transformer maps onto that column.\n    // Neither reached the document, so the spec described a create that could\n    // not set a relation at all.\n    emitWritableRelations(collection, properties, emitted);\n    annotateTenantField(collection, properties, \"write\");\n\n    // The tenant field is never required on input, whatever the property\n    // declares: the column is NOT NULL, and the server is what fills it.\n    // Listing it would tell every generated client to demand a value its caller\n    // is not supposed to compute.\n    const tenantField = getTenantConfig(collection)?.field;\n    const requiredOnInput = tenantField ? required.filter(key => key !== tenantField) : required;\n\n    return {\n        type: \"object\",\n        required: requiredOnInput.length > 0 ? requiredOnInput : undefined,\n        properties\n    };\n}\n\n/**\n * The writable half of a collection's relations: `belongsTo` only.\n *\n * A to-many is not writable through the body — the server links rows through\n * the nested routes — so offering `tags: [...]` on a create would describe a\n * write that does nothing. Same rule, same reason, as `emitWritableRelations`\n * in the SDK generator, whose `Insert` type this mirrors key for key.\n *\n * Neither spelling is listed in `required`, even for a relation the collection\n * declares `validation: { required: true }` on: the two keys are alternatives,\n * and a schema naming both would tell a spec-validating gateway to reject a\n * create that the server accepts. (The SDK's `Insert` marks both non-optional\n * for the same relation, which is the same fact stated less carefully; a\n * document is the half that a gateway enforces.)\n */\nfunction emitWritableRelations(\n    collection: CollectionConfig,\n    properties: Record<string, unknown>,\n    emitted: Set<string>\n): void {\n    const resolved = resolveRelationsForDocument(collection);\n\n    const emit = (key: string, relation: ResolvedRelation): void => {\n        if (emitted.has(key)) return;\n        properties[key] = {\n            ...idSchemaFor(relationTarget(relation)),\n            description: `The \\`${relation.targetSlug}\\` row this belongs to.`\n        };\n        emitted.add(key);\n    };\n\n    for (const relation of Object.values(resolved)) {\n        if (relation.kind === \"belongsTo\" && relation.localKey) {\n            emit(fieldKeyForColumn(collection, relation.localKey), relation);\n        }\n    }\n\n    for (const [key, property] of Object.entries(collection.properties ?? {})) {\n        if ((property as Property)?.type !== \"relation\") continue;\n        const relation = findRelation(resolved, key);\n        if (relation?.kind === \"belongsTo\" && relation.localKey) emit(key, relation);\n    }\n}\n\n/**\n * Convert a Rebase Property to an OpenAPI 3.0 schema object.\n */\nfunction convertPropertyToSchema(property: Property): Record<string, unknown> {\n    const schema = convertPropertyTypeToSchema(property);\n    const annotation = accessAnnotation(property);\n    if (!annotation) return schema;\n\n    const sentence = accessDescription(property);\n    return {\n        ...schema,\n        ...(sentence\n            ? { description: schema.description ? `${schema.description} — ${sentence}` : sentence }\n            : {}),\n        \"x-rebase-access\": annotation\n    };\n}\n\n/** The JSON Schema a property's *type* compiles to, before any access annotation. */\nfunction convertPropertyTypeToSchema(property: Property): Record<string, unknown> {\n    const base: Record<string, unknown> = {};\n\n    if (property.name) {\n        base.description = property.name;\n    }\n\n    switch (property.type) {\n        case \"string\": {\n            const sp = property as StringProperty;\n            base.type = \"string\";\n\n            if (sp.enum) {\n                const enumValues = resolveEnumValues(sp.enum);\n                if (enumValues.length > 0) {\n                    base.enum = enumValues;\n                }\n            }\n\n            if (sp.validation) {\n                if (sp.validation.min !== undefined) base.minLength = sp.validation.min;\n                if (sp.validation.max !== undefined) base.maxLength = sp.validation.max;\n                if (sp.validation.length !== undefined) {\n                    base.minLength = sp.validation.length;\n                    base.maxLength = sp.validation.length;\n                }\n                if (sp.validation.matches !== undefined) {\n                    base.pattern = String(sp.validation.matches);\n                }\n            }\n\n            if (sp.email) base.format = \"email\";\n            if (sp.url) base.format = \"uri\";\n            if (sp.storage) base.format = \"uri\";\n\n            return base;\n        }\n\n        case \"number\": {\n            const np = property as NumberProperty;\n            // `isId` is on this list because the DDL generator puts it there:\n            // a numeric primary key is `INTEGER GENERATED BY DEFAULT AS\n            // IDENTITY` for `\"increment\"` and `INTEGER` for every other form\n            // (`generate-postgres-ddl-logic.ts`), so the column the scaffold's\n            // `posts.id` creates is an integer and the document called it a\n            // `number` — which lets a generated client send `1.5` for a row id.\n            const isInteger = np.validation?.integer\n                || Boolean(np.isId)\n                || np.columnType === \"integer\" || np.columnType === \"serial\"\n                || np.columnType === \"bigserial\" || np.columnType === \"bigint\";\n            base.type = isInteger ? \"integer\" : \"number\";\n\n            if (np.enum) {\n                const enumValues = resolveEnumValues(np.enum);\n                if (enumValues.length > 0) {\n                    base.enum = enumValues;\n                }\n            }\n\n            if (np.validation) {\n                if (np.validation.min !== undefined) base.minimum = np.validation.min;\n                if (np.validation.max !== undefined) base.maximum = np.validation.max;\n                if (np.validation.moreThan !== undefined) {\n                    base.minimum = np.validation.moreThan;\n                    base.exclusiveMinimum = true;\n                }\n                if (np.validation.lessThan !== undefined) {\n                    base.maximum = np.validation.lessThan;\n                    base.exclusiveMaximum = true;\n                }\n            }\n\n            return base;\n        }\n\n        case \"boolean\":\n            base.type = \"boolean\";\n            return base;\n\n        case \"date\": {\n            base.type = \"string\";\n            if (property.mode === \"date\") {\n                base.format = \"date\";\n            } else {\n                base.format = \"date-time\";\n            }\n            if (property.autoValue) {\n                base.readOnly = true;\n                base.description = (base.description || \"\") +\n                    (property.autoValue === \"on_create\" ? \" (Auto-set on creation)\" : \" (Auto-updated)\");\n            }\n            return base;\n        }\n\n        case \"geopoint\":\n            base.type = \"object\";\n            base.properties = {\n                latitude: { type: \"number\" },\n                longitude: { type: \"number\" }\n            };\n            base.required = [\"latitude\", \"longitude\"];\n            return base;\n\n        case \"reference\":\n            base.type = \"string\";\n            base.description = (base.description || \"\") + \" (Reference ID)\";\n            return base;\n\n        case \"array\": {\n            const ap = property as ArrayProperty;\n            base.type = \"array\";\n\n            if (ap.oneOf) {\n                // Discriminated union (e.g., content blocks)\n                const typeField = ap.oneOf.typeField || \"type\";\n                const valueField = ap.oneOf.valueField || \"value\";\n                const variants: Record<string, unknown>[] = [];\n\n                for (const [variantKey, variantProp] of Object.entries(ap.oneOf.properties)) {\n                    variants.push({\n                        type: \"object\",\n                        properties: {\n                            [typeField]: { type: \"string\",\nenum: [variantKey] },\n                            [valueField]: convertPropertyToSchema(variantProp)\n                        },\n                        required: [typeField, valueField]\n                    });\n                }\n\n                base.items = { oneOf: variants };\n            } else if (ap.of) {\n                if (Array.isArray(ap.of)) {\n                    base.items = { oneOf: ap.of.map(p => convertPropertyToSchema(p)) };\n                } else {\n                    base.items = convertPropertyToSchema(ap.of);\n                }\n            } else {\n                base.items = {};\n            }\n\n            if (ap.validation) {\n                if (ap.validation.min !== undefined) base.minItems = ap.validation.min;\n                if (ap.validation.max !== undefined) base.maxItems = ap.validation.max;\n            }\n\n            return base;\n        }\n\n        case \"map\": {\n            const mp = property as MapProperty;\n            base.type = \"object\";\n\n            if (mp.properties) {\n                const props: Record<string, unknown> = {};\n                const req: string[] = [];\n\n                for (const [key, subProp] of Object.entries(mp.properties)) {\n                    props[key] = convertPropertyToSchema(subProp);\n                    if (subProp.validation?.required) {\n                        req.push(key);\n                    }\n                }\n\n                base.properties = props;\n                if (req.length > 0) base.required = req;\n            } else if (mp.keyValue) {\n                base.additionalProperties = true;\n            }\n\n            return base;\n        }\n\n        case \"vector\": {\n            const vp = property as VectorProperty;\n            base.type = \"array\";\n            base.items = { type: \"number\" };\n            base.description = (base.description || \"\") + ` (Vector(${vp.dimensions}))`;\n            return base;\n        }\n        case \"binary\": {\n            base.type = \"string\";\n            base.description = (base.description || \"\") + \" (Binary/Base64)\";\n            return base;\n        }\n        default:\n            base.type = \"string\";\n            return base;\n    }\n}\n\n/**\n * Resolve EnumValues (array or record) into a flat array of enum values.\n */\nfunction resolveEnumValues(enumDef: Record<string | number, unknown> | Array<{ id: string | number }>): Array<string | number> {\n    if (Array.isArray(enumDef)) {\n        return enumDef.map(e => (typeof e === \"object\" && e !== null && \"id\" in e) ? e.id : e as string | number);\n    }\n    return Object.keys(enumDef).map(k => {\n        // Preserve numeric keys as numbers\n        const num = Number(k);\n        return isNaN(num) ? k : num;\n    });\n}\n\n/**\n * Build PostgREST-style filter parameters for a collection.\n * These are additional query parameters like `?status=eq.active&price=gte.100`.\n *\n * `excludeFromApi` columns are not offered: the server does filter on them, and\n * that is exactly the problem — a filter on a column no response can contain\n * answers questions about the value one row at a time, which is a worse\n * disclosure than the column name alone.\n */\nfunction buildFilterParameters(\n    collection: CollectionConfig,\n    reservedNames: ReadonlySet<string> = new Set()\n): Array<Record<string, unknown>> {\n    const params: Array<Record<string, unknown>> = [];\n\n    for (const [key, property] of Object.entries(collection.properties)) {\n        if (!isDocumentedProperty(property)) continue;\n        // A `relation` property is not a column, so there is nothing to compare\n        // against. The foreign key beside it is filterable and is still not\n        // offered here — a separate gap from the schema one, and one the query\n        // layer has to answer first.\n        if (property.type === \"relation\") continue;\n        if (property.type === \"map\" || property.type === \"array\" || property.type === \"geopoint\") {\n            continue;\n        }\n        // A column whose name a list parameter already owns is unfilterable\n        // over the wire — see `reservedParameterNames`.\n        if (reservedNames.has(key)) continue;\n\n        params.push({\n            name: key,\n            in: \"query\",\n            required: false,\n            schema: { type: \"string\" },\n            description:\n                `Filter by \\`${key}\\`. Supports PostgREST operators: ` +\n                \"`eq.value`, `neq.value`, `gt.value`, `gte.value`, `lt.value`, `lte.value`, \" +\n                \"`in.(a,b,c)`, `nin.(a,b,c)`, `cs.value` (array-contains), `csa.(a,b)` (array-contains-any). \" +\n                \"Plain values imply equality.\",\n            example: property.type === \"string\" ? \"eq.active\" : property.type === \"number\" ? \"gte.100\" : undefined\n        });\n    }\n\n    return params;\n}\n\n/**\n * Standard error responses included on every endpoint.\n */\nfunction errorResponses(requireAuth: boolean): Record<string, unknown> {\n    const responses: Record<string, unknown> = {\n        400: {\n            description: \"Bad request\",\n            content: { \"application/json\": { schema: { $ref: \"#/components/schemas/ErrorResponse\" } } }\n        },\n        500: {\n            description: \"Internal server error\",\n            content: { \"application/json\": { schema: { $ref: \"#/components/schemas/ErrorResponse\" } } }\n        }\n    };\n\n    if (requireAuth) {\n        responses[401] = {\n            description: \"Authentication required or invalid token\",\n            content: { \"application/json\": { schema: { $ref: \"#/components/schemas/ErrorResponse\" } } }\n        };\n        responses[403] = {\n            description: \"Insufficient permissions\",\n            content: { \"application/json\": { schema: { $ref: \"#/components/schemas/ErrorResponse\" } } }\n        };\n    }\n\n    return responses;\n}\n\n/**\n * Prefix a noun with \"a\" or \"an\" based on its leading sound.\n */\nfunction withIndefiniteArticle(noun: string): string {\n    return `${/^[aeiou]/i.test(noun) ? \"an\" : \"a\"} ${noun}`;\n}\n\n/**\n * The component-schema name for a collection — and the stem of every\n * `operationId` and `$ref` that mentions it.\n *\n * `toPascalCase` keeps ASCII letters and digits and nothing else, so a name\n * written in a script that has none of them — a Cyrillic or Japanese\n * `singularName`, which the docs' six locales make ordinary rather than exotic\n * — reduced to the empty string. The schema was then stored under `\"\"` and\n * every reference to it read `#/components/schemas/`, an unresolvable pointer:\n * Swagger UI renders the model empty and a strict generator fails outright. So\n * fall through the names until one survives, and keep a constant as the floor.\n *\n * Two collections whose names PascalCase identically still share one component;\n * that needs a disambiguation rule, not a fallback.\n */\nfunction schemaNameFor(collection: CollectionConfig): string {\n    return toPascalCase(collection.singularName || \"\")\n        || toPascalCase(collection.name || \"\")\n        || toPascalCase(collection.slug || \"\")\n        || \"Collection\";\n}\n\n/**\n * Convert a string to PascalCase for schema names.\n */\nfunction toPascalCase(str: string): string {\n    return str\n        .replace(/[^a-zA-Z0-9]+/g, \" \")\n        .split(\" \")\n        .filter(Boolean)\n        .map(word => word.charAt(0).toUpperCase() + word.slice(1).toLowerCase())\n        .join(\"\");\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAcA,SAAgB,kBAAkB,YAA8D;CAE5F,MAAM,WAAW,cAAc,gBAAgB,aAAa,WAAW,aAAa,KAAA;CACpF,IAAI,CAAC,UAAU,OAAO,KAAA;CACtB,OAAQ,OAAO,aAAa,YAAY,SAAS,SAAA;AACrD;;;;;;;;;;AAWA,SAAgB,uBACZ,YACA,QACO;CACP,MAAM,QAAQ,kBAAkB,UAAU;CAC1C,OAAO,UAAU,KAAA,KAAa,SAAS,WAAW;AACtD;;;;;;;;ACLA,SAAgB,oBACZ,aACA,UAAmC,CAAC,GACb;CACvB,MAAM,WAAW,QAAQ,YAAY;CACrC,MAAM,cAAc,QAAQ,eAAe;CAC3C,MAAM,eAAe,QAAQ,YAAY,gBAAA;CACzC,MAAM,WAAW,QAAQ,YAAY,YAAA;;;;;;;;;;CAWrC,MAAM,4BAA4B;EAC9B;GAAE,MAAM;GAAS,IAAI;GAAS,QAAQ;IAAE,MAAM;IAAW,SAAS;IAAc,SAAS;IAAG,SAAS;GAAS;GAC1G,aAAa,6EAA6E,SAAS;EAAgK;EACvQ;GAAE,MAAM;GAAU,IAAI;GAAS,QAAQ;IAAE,MAAM;IAAW,SAAS;GAAE;GACjE,aAAa;EAA4B;EAC7C;GAAE,MAAM;GAAQ,IAAI;GAAS,QAAQ;IAAE,MAAM;IAAW,SAAS;GAAE;GAC/D,aAAa;EAA2E;EAC5F;GACI,MAAM;GACN,IAAI;GACJ,QAAQ,EAAE,MAAM,SAAS;GACzB,aACI;EAOR;EACA;GACI,MAAM;GACN,IAAI;GACJ,QAAQ,EAAE,MAAM,SAAS;GACzB,aACI;GAKJ,SAAS;EACb;EACA;GACI,MAAM;GACN,IAAI;GACJ,QAAQ,EAAE,MAAM,SAAS;GACzB,aAAa;GAEb,SAAS;EACb;EACA;GACI,MAAM;GACN,IAAI;GACJ,QAAQ,EAAE,MAAM,SAAS;GACzB,aAAa;GACb,SAAS;EACb;EACA;GACI,MAAM;GACN,IAAI;GACJ,QAAQ,EAAE,MAAM,SAAS;GACzB,aAAa;GACb,SAAS;EACb;EACA;GACI,MAAM;GACN,IAAI;GACJ,QAAQ,EAAE,MAAM,SAAS;GACzB,aACI;GAKJ,SAAS;EACb;EACA;GACI,MAAM;GACN,IAAI;GACJ,QAAQ,EAAE,MAAM,SAAS;GACzB,aACI;GAOJ,SAAS;EACb;EACA;GACI,MAAM;GACN,IAAI;GACJ,QAAQ,EAAE,MAAM,SAAS;GACzB,aACI;GAKJ,SAAS;EACb;EACA;GACI,MAAM;GACN,IAAI;GACJ,QAAQ,EAAE,MAAM,UAAU;GAC1B,aACI;GAQJ,SAAS;EACb;EACA;GACI,MAAM;GACN,IAAI;GACJ,QAAQ,EAAE,MAAM,SAAS;GACzB,aACI;EAGR;EAKA;GACI,MAAM;GACN,IAAI;GACJ,QAAQ,EAAE,MAAM,SAAS;GACzB,aAAa;GACb,SAAS;EACb;EACA;GACI,MAAM;GACN,IAAI;GACJ,QAAQ,EAAE,MAAM,SAAS;GACzB,aAAa;GACb,SAAS;EACb;EACA;GACI,MAAM;GACN,IAAI;GACJ,QAAQ;IAAE,MAAM;IAAU,MAAM;KAAC;KAAU;KAAM;IAAe;IAAG,SAAS;GAAS;GACrF,aAAa;EACjB;EACA;GACI,MAAM;GACN,IAAI;GACJ,QAAQ,EAAE,MAAM,SAAS;GACzB,aAAa;EACjB;CACJ;CAEA,MAAM,OAAgC;EAClC,SAAS;EACT,MAAM;GACF,OAAO;GACP,SAAS;GACT,aACI;EAER;EACA,SAAS,CACL;GACI,KAAK;GACL,aAAa;EACjB,CACJ;EACA,OAAO,CAAC;EACR,YAAY;GACR,SAAS;IACL,eAAe;KACX,MAAM;KACN,YAAY,EACR,OAAO;MACH,MAAM;MACN,UAAU,CAAC,WAAW,MAAM;MAC5B,YAAY;OACR,SAAS,EAAE,MAAM,SAAS;OAC1B,MAAM,EAAE,MAAM,SAAS;OACvB,SAAS,CAAC;MACd;KACJ,EACJ;IACJ;IACA,gBAAgB;KACZ,MAAM;KACN,YAAY;MACR,OAAO;OAAE,MAAM;OACvC,aAAa;MAA4G;MACjG,OAAO;OAAE,MAAM;OACvC,aAAa;MAAgC;MACrB,QAAQ;OAAE,MAAM;OACxC,aAAa;MAA4B;MACjB,SAAS;OAAE,MAAM;OACzC,aAAa;MAA8C;MACnC,YAAY;OACR,MAAM;OACN,aACI;MAKR;KACJ;IACJ;GACJ;GACA,iBAAiB,CAAC;EACtB;EACA,MAAM,CAAC;CACX;CAGA,IAAI,aAAa;EACb,KAAM,WAAuC,kBAAkB,EAC3D,YAAY;GACR,MAAM;GACN,QAAQ;GACR,cAAc;GACd,aACI;EAER,EAYJ;EACA,KAAkC,WAAW,CACzC,EAAE,YAAY,CAAC,EAAE,CACrB;CACJ;CAEA,MAAM,QAAQ,KAAK;CACnB,MAAM,UAAW,KAAK,WAAuC;CAC7D,MAAM,OAAO,KAAK;CAalB,MAAM,yCAAyB,IAAI,IAAI,CAAC,GAAG,oBAAoB,CAAC,CAAC,KAAI,MAAK,EAAE,IAAI,GAAG,mBAAmB,CAAC;;;;;;;CAQvG,MAAM,qBAAqB,eAAiC;EACxD,MAAM,QAAQ,kBAAkB,UAAU;EAC1C,IAAI,CAAC,OAAO,OAAO,CAAC;EACpB,OAAO,CAAC;GACJ,MAAM;GACN,IAAI;GACJ,UAAU;GACV,QAAQ;IAAE,MAAM;IAAU,MAAM,CAAC,WAAW,MAAM;GAAE;GACpD,aACI,uCAAuC,MAAM;EAGrD,CAAC;CACL;;;;;CAMA,MAAM,wBAAwB,eAAiC;EAC3D,IAAI,CAAC,kBAAkB,UAAU,GAAG,OAAO,CAAC;EAC5C,OAAO,CAAC;GACJ,MAAM;GACN,IAAI;GACJ,UAAU;GACV,QAAQ;IAAE,MAAM;IAAW,SAAS;GAAM;GAC1C,aACI;EAGR,CAAC;CACL;;CAGA,MAAM,uBAAuB,eAAqD;EAC9E,MAAM,QAAQ,kBAAkB,UAAU;EAC1C,IAAI,CAAC,OAAO,OAAO,KAAA;EACnB,OAAO,mFAAmF,MAAM,iHAE/E,MAAM;CAC3B;CAOA,MAAM,oBAAoB,IAAI,KAAK,eAAe,CAAC,EAAA,CAAG,IAAI,aAAa,CAAC;;;;;;CAOxE,MAAM,eAAe;EACjB,MAAM;EACN,IAAI;EACJ,UAAU;EACV,QAAQ;GAAE,MAAM;GAAU,MAAM,CAAC,gBAAgB;EAAE;EACnD,aACI;CAGR;CAEA,MAAM,gBAAgB;EAClB,MAAM;EACN,IAAI;EACJ,UAAU;EACV,QAAQ,EAAE,MAAM,SAAS;EACzB,aACI;CAIR;CAEA,MAAM,qBAAqB,EACvB,KAAK;EACD,aACI;EAEJ,SAAS,EAAE,oBAAoB,EAAE,QAAQ,EAAE,MAAM,qCAAqC,EAAE,EAAE;CAC9F,EACJ;CAEA,MAAM,kBAAkB,EACpB,KAAK;EACD,aAAa;EACb,SAAS,EACL,sBAAsB;GAAE,QAAQ,EAAE,MAAM,SAAS;GAAG,aAAa;EAAmB,EACxF;CACJ,EACJ;CAOA,KAAK,eAAe,CAAC,EAAA,CAAG,SAAS,GAAG;EAChC,MAAM,kBAAkB,EACpB,MAAM;GACF,MAAM,CAAC,MAAM;GACb,SAAS;GACT,aACI;GAUJ,aAAa;GACb,YAAY,CACR;IACI,MAAM;IACN,IAAI;IACJ,UAAU;IACV,QAAQ,EAAE,MAAM,SAAS;IACzB,aACI;GAGR,GACA,YACJ;GACA,aAAa;IACT,UAAU;IACV,SAAS,EACL,oBAAoB,EAChB,QAAQ;KACJ,MAAM;KACN,UAAU,CAAC,YAAY;KACvB,YAAY,EACR,YAAY;MACR,MAAM;MACN,OAAO,EAAE,MAAM,sCAAsC;KACzD,EACJ;IACJ,EACJ,EACJ;GACJ;GACA,WAAW;IACP,KAAK;KACD,aACI;KAEJ,SAAS,EACL,oBAAoB,EAChB,QAAQ;MACJ,MAAM;MACN,YAAY;OACR,MAAM;QAAE,MAAM;QAAS,OAAO;SAAE,MAAM;SAAU,UAAU;QAAK;OAAE;OACjE,MAAM;QAAE,MAAM;QAAU,YAAY,EAAE,YAAY,EAAE,MAAM,UAAU,EAAE;OAAE;MAC5E;KACJ,EACJ,EACJ;IACJ;IACA,KAAK;KACD,aACI;KAGJ,SAAS,EAAE,oBAAoB,EAAE,QAAQ,EAAE,MAAM,qCAAqC,EAAE,EAAE;IAC9F;IACA,KAAK;KACD,aAAa;KACb,SAAS,EAAE,oBAAoB,EAAE,QAAQ,EAAE,MAAM,qCAAqC,EAAE,EAAE;IAC9F;IACA,KAAK;KACD,aAAa;KACb,SAAS,EAAE,oBAAoB,EAAE,QAAQ,EAAE,MAAM,qCAAqC,EAAE,EAAE;IAC9F;IACA,KAAK;KACD,aAAa;KACb,SAAS,EAAE,oBAAoB,EAAE,QAAQ,EAAE,MAAM,qCAAqC,EAAE,EAAE;IAC9F;IACA,GAAG,eAAe,WAAW;GACjC;EACJ,EACJ;EAEA,QAAQ,iBAAiB;GACrB,MAAM;GACN,aACI;GAGJ,YAAY;IACR,MAAM;KAAE,MAAM;KAAU,aAAa;IAAkD;IACvF,OAAO,EAAE,aAAa,uEAAuE;IAC7F,OAAO,EAAE,aAAa,6DAA6D;IACnF,QAAQ;KAAE,MAAM;KAAU,aAAa;IAA+C;GAC1F;EACJ;EAEA,QAAQ,iBAAiB;GACrB,MAAM;GACN,UAAU,CAAC,MAAM,YAAY;GAC7B,YAAY;IACR,IAAI;KAAE,MAAM;KAAU,MAAM;MAAC;MAAU;MAAU;MAAU;KAAQ;IAAE;IACrE,YAAY;KAAE,MAAM;KAAU,aAAa;IAAgD;IAC3F,IAAI;KACA,aACI;KAMJ,OAAO;MAAC,EAAE,MAAM,SAAS;MAAG,EAAE,MAAM,UAAU;MAAG,EAAE,MAAM,SAAS;KAAC;IACvE;IACA,QAAQ;KACJ,MAAM;KACN,aACI;KAEJ,sBAAsB;IAC1B;IACA,YAAY;KACR,MAAM;KACN,OAAO,EAAE,MAAM,SAAS;KACxB,aACI;IAER;IACA,KAAK;KACD,MAAM;KACN,aAAa;IACjB;GACJ;EACJ;CACJ;CAGA,KAAK,MAAM,cAAe,eAAe,CAAC,GAAI;EAC1C,MAAM,aAAa,cAAc,UAAU;EAC3C,MAAM,OAAO,WAAW;EAExB,KAAK,KAAK;GACN,MAAM,WAAW;GACjB,aAAa,WAAW,eAAe,uBAAuB,WAAW;EAC7E,CAAC;EAGD,QAAQ,cAAc,sBAAsB,YAAY,iBAAiB;EAGzE,QAAQ,GAAG,WAAW,UAAU,2BAA2B,UAAU;EAIrE,QAAQ,GAAG,WAAW,WAAW,4BAA4B,UAAU;EAEvE,MAAM,WAAW,SAAS;EAC1B,MAAM,iBAAiB,oBAAoB,UAAU;EAYrD,MAAM,GAAG,SAAS,WAAW,EACzB,KAAK;GACD,MAAM,CAAC,WAAW,IAAI;GACtB,SAAS,SAAS,WAAW;GAC7B,aACI;GAGJ,aAAa,QAAQ;GACrB,YAAY;IACR,GAAG,oBAAoB,CAAC,CAAC,QAAO,MAAK,EAAE,SAAS,cAAc;IAC9D,GAAG,kBAAkB,UAAU;IAC/B,GAAG,sBAAsB,YAAY,sBAAsB;GAC/D;GACA,WAAW;IACP,KAAK;KACD,aAAa;KACb,SAAS,EACL,oBAAoB,EAChB,QAAQ;MACJ,MAAM;MACN,UAAU,CAAC,OAAO;MAClB,YAAY,EACR,OAAO;OAAE,MAAM;OAAW,aAAa;MAA4B,EACvE;KACJ,EACJ,EACJ;IACJ;IACA,GAAG,eAAe,WAAW;GACjC;EACJ,EACJ;EAMA,MAAM,GAAG,SAAS,eAAe,EAC7B,KAAK;GACD,MAAM,CAAC,WAAW,IAAI;GACtB,SAAS,aAAa,WAAW;GACjC,aACI;GAGJ,aAAa,YAAY;GACzB,YAAY;IACR;KACI,MAAM;KACN,IAAI;KACJ,UAAU;KACV,aACI;KAEJ,QAAQ,EAAE,MAAM,SAAS;KACzB,SAAS;IACb;IACA;KACI,MAAM;KACN,IAAI;KACJ,UAAU;KACV,aAAa;KACb,QAAQ,EAAE,MAAM,SAAS;KACzB,SAAS;IACb;IAGA,GAAG,oBAAoB,CAAC,CAAC,QAAO,MAC5B,EAAE,SAAS,kBAAkB,EAAE,SAAS,WAAW,EAAE,SAAS,YAAY,EAAE,SAAS,MAAM;IAC/F;KACI,MAAM;KACN,IAAI;KACJ,UAAU;KACV,aACI;KAKJ,QAAQ,EAAE,MAAM,SAAS;KACzB,SAAS;IACb;IACA,GAAG,kBAAkB,UAAU;IAC/B,GAAG,sBAAsB,YAAY,sBAAsB;GAC/D;GACA,WAAW;IACP,KAAK;KACD,aAAa;KACb,SAAS,EACL,oBAAoB,EAChB,QAAQ;MACJ,MAAM;MACN,UAAU,CAAC,MAAM;MACjB,YAAY;OACR,MAAM;QACF,MAAM;QACN,OAAO;SAAE,MAAM;SAAU,sBAAsB;QAAK;OACxD;OACA,MAAM;QACF,MAAM;QACN,aAAa;QACb,YAAY;SACR,OAAO,EAAE,MAAM,UAAU;SACzB,QAAQ,EAAE,MAAM,UAAU;SAC1B,SAAS;UAAE,MAAM;UAAW,aAAa;SAAqC;QAClF;OACJ;MACJ;KACJ,EACJ,EACJ;IACJ;IACA,KAAK,EAAE,aAAa,2DAA2D;IAC/E,GAAG,eAAe,WAAW;GACjC;EACJ,EACJ;EAGA,MAAM,YAAY;GACd,KAAK;IACD,MAAM,CAAC,WAAW,IAAI;IACtB,SAAS,QAAQ,WAAW;IAC5B,aAAa,OAAO;IACpB,YAAY;KACR,GAAG,oBAAoB;KACvB,GAAG,kBAAkB,UAAU;KAC/B,GAAG,sBAAsB,YAAY,sBAAsB;IAC/D;IACA,WAAW;KACP,KAAK;MACD,aAAa;MACb,SAAS,EACL,oBAAoB,EAChB,QAAQ;OACJ,MAAM;OACN,YAAY;QACR,MAAM;SACF,MAAM;SACN,OAAO,EAAE,MAAM,wBAAwB,aAAa;QACxD;QACA,MAAM,EAAE,MAAM,sCAAsC;OACxD;MACJ,EACJ,EACJ;KACJ;KACA,GAAG,eAAe,WAAW;IACjC;GACJ;GACA,MAAM;IACF,MAAM,CAAC,WAAW,IAAI;IACtB,SAAS,UAAU,WAAW,gBAAgB,WAAW;IACzD,aAAa,SAAS;IACtB,YAAY,CACR;KACI,MAAM;KACN,IAAI;KACJ,UAAU;KACV,QAAQ,EAAE,MAAM,SAAS;KACzB,aACI;KAKJ,SAAS;IACb,GACA,YACJ;IACA,aAAa;KACT,UAAU;KACV,SAAS,EACL,oBAAoB,EAChB,QAAQ,EAAE,MAAM,wBAAwB,WAAW,OAAO,EAC9D,EACJ;IACJ;IACA,WAAW;KACP,KAAK;MACD,aAAa;MACb,SAAS,EACL,oBAAoB,EAChB,QAAQ,EAAE,MAAM,wBAAwB,aAAa,EACzD,EACJ;KACJ;KACA,GAAG;KACH,GAAG,eAAe,WAAW;IACjC;GACJ;EACJ;EAOA,MAAM,oBAAoB;GACtB,MAAM;GACN,IAAI;GACJ,UAAU;GACV,QAAQ,EAAE,MAAM,SAAS;GACzB,aACI;EAKR;EAEA,MAAM,aAAa;GACf,KAAK;IACD,aAAa;IACb,SAAS,EAAE,oBAAoB,EAAE,QAAQ,EAAE,MAAM,qCAAqC,EAAE,EAAE;GAC9F;GACA,KAAK;IACD,aACI;IAEJ,SAAS,EAAE,oBAAoB,EAAE,QAAQ,EAAE,MAAM,qCAAqC,EAAE,EAAE;GAC9F;GACA,KAAK;IACD,aAAa;IACb,SAAS,EAAE,oBAAoB,EAAE,QAAQ,EAAE,MAAM,qCAAqC,EAAE,EAAE;GAC9F;GACA,GAAG,eAAe,WAAW;EACjC;EAEA,MAAM,SAAS,KAAK,UAAU;GAC1B,MAAM;IACF,MAAM,CAAC,WAAW,IAAI;IACtB,SAAS,eAAe,WAAW,KAAK;IACxC,aACI;IAIJ,aAAa,aAAa;IAC1B,YAAY,CAAC,mBAAmB,YAAY;IAC5C,aAAa;KACT,UAAU;KACV,SAAS,EACL,oBAAoB,EAChB,QAAQ;MACJ,MAAM;MACN,UAAU,CAAC,MAAM;MACjB,YAAY;OACR,MAAM;QAAE,MAAM;QAAS,OAAO,EAAE,MAAM,wBAAwB,WAAW,OAAO;OAAE;OAClF,QAAQ;QACJ,MAAM;QACN,aAAa;OACjB;OACA,YAAY;QACR,MAAM;QACN,OAAO,EAAE,MAAM,SAAS;QACxB,aACI;OAGR;MACJ;KACJ,EACJ,EACJ;IACJ;IACA,WAAW;KACP,KAAK;MACD,aAAa;MACb,SAAS,EACL,oBAAoB,EAChB,QAAQ;OACJ,MAAM;OACN,YAAY;QACR,MAAM;SAAE,MAAM;SAAS,OAAO,EAAE,MAAM,wBAAwB,aAAa;QAAE;QAC7E,MAAM;SAAE,MAAM;SAAU,YAAY,EAAE,SAAS,EAAE,MAAM,UAAU,EAAE;QAAE;OACzE;MACJ,EACJ,EACJ;KACJ;KACA,GAAG;IACP;GACJ;GACA,OAAO;IACH,MAAM,CAAC,WAAW,IAAI;IACtB,SAAS,eAAe,WAAW,KAAK;IACxC,aACI;IAIJ,aAAa,aAAa;IAC1B,YAAY,CAAC,mBAAmB,YAAY;IAC5C,aAAa;KACT,UAAU;KACV,SAAS,EACL,oBAAoB,EAChB,QAAQ;MACJ,MAAM;MACN,UAAU,CAAC,SAAS;MACpB,YAAY,EACR,SAAS;OACL,MAAM;OACN,OAAO;QACH,MAAM;QACN,UAAU,CAAC,MAAM,MAAM;QACvB,YAAY;SACR,IAAI;UAAE,MAAM;UAAU,aAAa;SAAoB;SACvD,MAAM,EAAE,MAAM,wBAAwB,WAAW,QAAQ;QAC7D;OACJ;MACJ,EACJ;KACJ,EACJ,EACJ;IACJ;IACA,WAAW;KACP,KAAK;MACD,aAAa;MACb,SAAS,EACL,oBAAoB,EAChB,QAAQ;OACJ,MAAM;OACN,YAAY;QACR,MAAM;SAAE,MAAM;SAAS,OAAO,EAAE,MAAM,wBAAwB,aAAa;QAAE;QAC7E,MAAM;SAAE,MAAM;SAAU,YAAY,EAAE,SAAS,EAAE,MAAM,UAAU,EAAE;QAAE;OACzE;MACJ,EACJ,EACJ;KACJ;KACA,KAAK;MACD,aAAa;MACb,SAAS,EAAE,oBAAoB,EAAE,QAAQ,EAAE,MAAM,qCAAqC,EAAE,EAAE;KAC9F;KACA,GAAG;IACP;GACJ;EACJ;EAEA,MAAM,SAAS,KAAK,iBAAiB,EACjC,MAAM;GACF,MAAM,CAAC,WAAW,IAAI;GACtB,SAAS,eAAe,WAAW,KAAK;GACxC,aACI,6aAMC,iBAAiB,OAAO,mBAAmB;GAChD,aAAa,aAAa;GAC1B,YAAY,CAAC,mBAAmB,GAAG,qBAAqB,UAAU,CAAC;GACnE,aAAa;IACT,UAAU;IACV,SAAS,EACL,oBAAoB,EAChB,QAAQ;KACJ,MAAM;KACN,UAAU,CAAC,KAAK;KAChB,YAAY,EACR,KAAK;MACD,MAAM;MACN,OAAO,EAAE,OAAO,CAAC,EAAE,MAAM,SAAS,GAAG,EAAE,MAAM,UAAU,CAAC,EAAE;KAC9D,EACJ;IACJ,EACJ,EACJ;GACJ;GACA,WAAW;IACP,KAAK;KACD,aAAa,iBACP,iFACA;KACN,SAAS,EACL,oBAAoB,EAChB,QAAQ;MACJ,MAAM;MACN,YAAY,EACR,MAAM;OAAE,MAAM;OAAU,YAAY,EAAE,SAAS,EAAE,MAAM,UAAU,EAAE;MAAE,EACzE;KACJ,EACJ,EACJ;IACJ;IACA,KAAK;KACD,aAAa;KACb,SAAS,EAAE,oBAAoB,EAAE,QAAQ,EAAE,MAAM,qCAAqC,EAAE,EAAE;IAC9F;IACA,GAAG;GACP;EACJ,EACJ;EAGA,MAAM,aAAa,SAAS,KAAK;EACjC,MAAM,cAAc;GAChB,KAAK;IACD,MAAM,CAAC,WAAW,IAAI;IACtB,SAAS,OAAO,WAAW,gBAAgB,WAAW,KAAK;IAC3D,aAAa,MAAM,WAAW;IAC9B,YAAY;KACR;MAAE,MAAM;MAC5B,IAAI;MACJ,UAAU;MACV,QAAQ,EAAE,MAAM,SAAS;MACzB,aAAa;KAAY;KAKL;MACI,MAAM;MACN,IAAI;MACJ,QAAQ,EAAE,MAAM,SAAS;MACzB,aACI;MAIJ,SAAS;KACb;KACA;MACI,MAAM;MACN,IAAI;MACJ,QAAQ,EAAE,MAAM,SAAS;MACzB,aACI;MAEJ,SAAS;KACb;KACA,GAAG,kBAAkB,UAAU;IACnC;IACA,WAAW;KACP,KAAK;MACD,aAAa;MACb,SAAS,EACL,MAAM;OACF,QAAQ,EAAE,MAAM,SAAS;OACzB,aACI;MAER,EACJ;MACA,SAAS,EACL,oBAAoB,EAChB,QAAQ,EAAE,MAAM,wBAAwB,aAAa,EACzD,EACJ;KACJ;KACA,KAAK;MAAE,aAAa;MACxC,SAAS,EAAE,oBAAoB,EAAE,QAAQ,EAAE,MAAM,qCAAqC,EAAE,EAAE;KAAE;KACxE,GAAG,eAAe,WAAW;IACjC;GACJ;GACA,OAAO,gBAAgB,YAAY,YAAY,aAAa;IACxD;IACA;IACA;IACA;GACJ,CAAC;GACD,QAAQ;IACJ,MAAM,CAAC,WAAW,IAAI;IACtB,SAAS,UAAU,WAAW,gBAAgB,WAAW;IACzD,GAAI,iBAAiB,EAAE,aAAa,eAAe,IAAI,CAAC;IACxD,aAAa,SAAS;IACtB,YAAY;KACR;MAAE,MAAM;MAC5B,IAAI;MACJ,UAAU;MACV,QAAQ,EAAE,MAAM,SAAS;MACzB,aAAa;KAAY;KACL;KACA;MACI,MAAM;MACN,IAAI;MACJ,UAAU;MACV,QAAQ,EAAE,MAAM,SAAS;MACzB,aACI;KAGR;KACA,GAAG,qBAAqB,UAAU;IACtC;IACA,WAAW;KACP,KAAK,EACD,aAAa,iBACP,sGACA,uBACV;KACA,KAAK;MAAE,aAAa;MACxC,SAAS,EAAE,oBAAoB,EAAE,QAAQ,EAAE,MAAM,qCAAqC,EAAE,EAAE;KAAE;KACxE,KAAK;MACD,aAAa;MACb,SAAS,EAAE,oBAAoB,EAAE,QAAQ,EAAE,MAAM,qCAAqC,EAAE,EAAE;KAC9F;KACA,KAAK;MACD,aAAa;MACb,SAAS,EAAE,oBAAoB,EAAE,QAAQ,EAAE,MAAM,qCAAqC,EAAE,EAAE;KAC9F;KACA,GAAG;KACH,GAAG,eAAe,WAAW;IACjC;GACJ;EACJ;CAEJ;CAoBA,KAAK,MAAM,cAAe,eAAe,CAAC,GAAI;EAC1C,MAAM,OAAO,WAAW;EACxB,MAAM,aAAa,cAAc,UAAU;EAC3C,MAAM,YAAY,OAAO,OAAO,2BAA2B,UAAU,CAAC,CAAC,CAClE,OAAO,QAAQ;EACpB,KAAK,MAAM,YAAY,WAAW;GAC9B,MAAM,eAAe,SAAS;GAE9B,MAAM,eAAe,cADI,SAAS,OACC,CAAgB;GAEnD,MAAM,UAAU,SAAS,KAAK,cAAc;GAG5C,MAAM,WAAW,EACb,KAAK;IACD,MAAM,CAAC,WAAW,IAAI;IACtB,SAAS,QAAQ,aAAa,OAAO,sBAAsB,WAAW,gBAAgB,WAAW,IAAI;IACrG,aAAa,OAAO,aAAa,aAAa,YAAY;IAC1D,YAAY,CACR;KAAE,MAAM;KAChC,IAAI;KACJ,UAAU;KACV,QAAQ,EAAE,MAAM,SAAS;KACzB,aAAa,GAAG,WAAW,gBAAgB,WAAW,KAAK;IAAK,GAKxC,GAAG,oBAAoB,CAC3B;IACA,WAAW;KACP,KAAK;MACD,aAAa,mBAAmB;MAChC,SAAS,EACL,oBAAoB,EAChB,QAAQ;OACJ,MAAM;OACN,YAAY;QACR,MAAM;SACF,MAAM;SACN,OAAO,QAAQ,gBACT,EAAE,MAAM,wBAAwB,eAAe,IAC/C,EAAE,MAAM,SAAS;QAC3B;QACA,MAAM,EAAE,MAAM,sCAAsC;OACxD;MACJ,EACJ,EACJ;KACJ;KACA,GAAG,eAAe,WAAW;IACjC;GACJ,EACJ;EACJ;CACJ;CAEA,OAAO;AACX;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BA,SAAS,qBAAqB,UAAoB,YAA8B,QAAiB;CAE7F,OADe,gBAAgB,QACxB,CAAA,GAAS,UAAU,EAAE,WAAW;AAC3C;;;;;;;;;;;;AAaA,SAAS,iBAAiB,UAAyD;CAC/E,MAAM,SAAS,gBAAgB,QAAQ;CACvC,IAAI,CAAC,QAAQ,OAAO,KAAA;CACpB,MAAM,aAAsC,CAAC;CAC7C,IAAI,OAAO,SAAS,KAAA,GAAW,WAAW,OAAO,CAAC,GAAG,OAAO,IAAI;CAChE,IAAI,OAAO,UAAU,KAAA,GAAW,WAAW,QAAQ,CAAC,GAAG,OAAO,KAAK;CACnE,OAAO,OAAO,KAAK,UAAU,CAAC,CAAC,SAAS,IAAI,aAAa,KAAA;AAC7D;;AAGA,SAAS,kBAAkB,UAAwC;CAC/D,MAAM,SAAS,gBAAgB,QAAQ;CACvC,IAAI,CAAC,QAAQ,OAAO,KAAA;CACpB,MAAM,QAAkB,CAAC;CACzB,MAAM,UAAU,UACZ,MAAM,WAAW,IAAI,2BAA2B,MAAM,KAAI,MAAK,KAAK,EAAE,GAAG,CAAC,CAAC,KAAK,IAAI,IAAI;CAC5F,IAAI,OAAO,SAAS,KAAA,GAAW,MAAM,KAAK,eAAe,OAAO,OAAO,IAAI,GAAG;CAC9E,IAAI,OAAO,UAAU,KAAA,GAAW,MAAM,KAAK,eAAe,OAAO,OAAO,KAAK,GAAG;CAChF,IAAI,MAAM,WAAW,GAAG,OAAO,KAAA;CAC/B,OAAO,iBAAiB,MAAM,KAAK,IAAI,EAAE;AAC7C;;;;;;;;;AAUA,SAAS,gBAAgB,YAA8B,YAA8B,QAAqB;CACtG,MAAM,2BAAW,IAAI,IAAY;CACjC,KAAK,MAAM,CAAC,KAAK,aAAa,OAAO,QAAQ,WAAW,cAAc,CAAC,CAAC,GAAG;EACvE,IAAI,qBAAqB,UAAsB,SAAS,GAAG;EAC3D,SAAS,IAAI,GAAG;EAChB,MAAM,aAAc,SAAsC;EAC1D,IAAI,OAAO,eAAe,UAAU,SAAS,IAAI,UAAU;CAC/D;CACA,OAAO;AACX;;;;;;;;;;;;AAaA,SAAS,gBAAgB,YAA0E;CAC/F,KAAK,MAAM,CAAC,KAAK,aAAa,OAAO,QAAQ,YAAY,cAAc,CAAC,CAAC,GACrE,IAAK,UAAsC,MAAM,OAAO,CAAC,KAAK,QAAoB;AAG1F;;;;;;;;;AAUA,SAAS,YAAY,YAAmE;CACpF,MAAM,WAAW,gBAAgB,UAAU;CAC3C,IAAI,CAAC,UAAU,OAAO,EAAE,MAAM,SAAS;CACvC,MAAM,YAAY,wBAAwB,SAAS,EAAE;CACrD,MAAM,SAAkC,EAAE,MAAM,UAAU,QAAQ,SAAS;CAC3E,IAAI,UAAU,QAAQ,OAAO,SAAS,UAAU;CAChD,OAAO;AACX;;;;;;;AAQA,SAAS,4BAA4B,YAAgE;CACjG,IAAI;EACA,OAAO,2BAA2B,UAAU;CAChD,QAAQ;EACJ,OAAO,CAAC;CACZ;AACJ;;AAGA,SAAS,eAAe,UAA0D;CAC9E,IAAI;EACA,IAAI,SAAS,SAAS,OAAO;EAC7B,IAAI,WAAW,OAAO,WAAW,OAAO,aACpC,SAAU,OAAO,WAAW;EAEhC,OAAO;CACX,QAAQ;EACJ;CACJ;AACJ;;;;;;;;;AAUA,SAAS,uBACL,UACA,mBACuB;CACvB,MAAM,SAAS,eAAe,QAAQ;CACtC,MAAM,eAAe,SAAS,cAAc,MAAM,IAAI,KAAA;CACtD,MAAM,OAAgC,gBAAgB,kBAAkB,IAAI,YAAY,IAClF,EAAE,MAAM,wBAAwB,eAAe,IAC/C,EAAE,MAAM,SAAS;CACvB,OAAO,SAAS,gBAAgB,SAAS;EAAE,MAAM;EAAS,OAAO;CAAK,IAAI;AAC9E;;;;;;;;;;;;;;;AAgBA,SAAS,uBACL,YACA,YACA,UACA,SACA,mBACI;CACJ,MAAM,WAAW,4BAA4B,UAAU;CAEvD,KAAK,MAAM,CAAC,aAAa,aAAa,OAAO,QAAQ,QAAQ,GAAG;EAC5D,IAAI,SAAS,SAAS,eAAe,CAAC,SAAS,UAAU;EACzD,MAAM,WAAW,kBAAkB,YAAY,SAAS,QAAQ;EAChE,IAAI,QAAQ,IAAI,QAAQ,GAAG;EAE3B,MAAM,aAAa,YAAY,eAAe,QAAQ,CAAC;EACvD,MAAM,oBAAoB,gBAAgB;EAC1C,WAAW,YAAY,oBACjB,EAAE,OAAO,CAAC,YAAY,uBAAuB,UAAU,iBAAiB,CAAC,EAAE,IAC3E;GAAE,GAAG;GAAY,aAAa,sBAAsB,SAAS,WAAW;EAAI;EAClF,QAAQ,IAAI,QAAQ;EAEpB,IAAI,mBAAmB,YAAY,QAAQ,KAAK,CAAC,mBAAmB,SAAS,KAAK,QAAQ;CAC9F;CAEA,KAAK,MAAM,CAAC,KAAK,aAAa,OAAO,QAAQ,QAAQ,GAAG;EACpD,IAAI,QAAQ,IAAI,GAAG,GAAG;EACtB,WAAW,OAAO,uBAAuB,UAAU,iBAAiB;EACpE,QAAQ,IAAI,GAAG;CACnB;CAIA,KAAK,MAAM,CAAC,KAAK,aAAa,OAAO,QAAQ,WAAW,cAAc,CAAC,CAAC,GAAG;EACvE,IAAK,UAAuB,SAAS,YAAY;EACjD,IAAI,QAAQ,IAAI,GAAG,GAAG;EACtB,WAAW,OAAO,EAAE,MAAM,SAAS;EACnC,QAAQ,IAAI,GAAG;CACnB;AACJ;;;;;;;AAQA,SAAgB,sBACZ,YACA,mBACuB;CACvB,MAAM,QAAQ,gBAAgB,UAAU,CAAC,GAAG,MAAM;CAClD,MAAM,aAAsC,GACvC,QAAQ;EAAE,GAAG,YAAY,UAAU;EAAG,aAAa;CAAoB,EAC5E;CACA,MAAM,WAAqB,CAAC,KAAK;CACjC,MAAM,WAAW,gBAAgB,UAAU;CAC3C,MAAM,UAAU,IAAI,IAAY,QAAQ;CACxC,QAAQ,IAAI,KAAK;CAEjB,KAAK,MAAM,CAAC,KAAK,aAAa,OAAO,QAAQ,WAAW,UAAU,GAAG;EACjE,IAAI,SAAS,SAAS,YAAY;EAClC,IAAI,CAAC,qBAAqB,QAAQ,GAAG;EAErC,WAAW,OAAO,wBAAwB,QAAQ;EAClD,QAAQ,IAAI,GAAG;EAEf,IAAI,SAAS,YAAY,YAAY,QAAQ,OACzC,SAAS,KAAK,GAAG;CAEzB;CAEA,uBAAuB,YAAY,YAAY,UAAU,SAAS,iBAAiB;CACnF,oBAAoB,YAAY,YAAY,MAAM;CAElD,OAAO;EACH,MAAM;EACN,UAAU,SAAS,SAAS,IAAI,WAAW,KAAA;EAC3C;CACJ;AACJ;;;;;;;;;;;;;;;;;AAkBA,SAAS,oBACL,YACA,YACA,WACI;CACJ,MAAM,SAAS,gBAAgB,UAAU;CACzC,IAAI,CAAC,QAAQ;CACb,MAAM,SAAS,WAAW,OAAO;CACjC,IAAI,CAAC,UAAU,OAAO,WAAW,UAAU;CAE3C,MAAM,WAAY,OAAqC;CACvD,MAAM,WAAW,cAAc,UACzB,gOAGA;CAEN,WAAW,OAAO,SAAS;EACvB,GAAI;EACJ,aAAa,OAAO,aAAa,YAAY,WAAW,GAAG,SAAS,KAAK,aAAa;EACtF,mBAAmB;CACvB;AACJ;;;;;;;;;;;;AAaA,SAAS,gBACL,YACA,YACA,aACA,QAMuB;CACvB,OAAO;EACH,MAAM,CAAC,WAAW,IAAI;EACtB,SAAS,UAAU,WAAW,gBAAgB,WAAW;EACzD,aACI;EAUJ,aAAa,SAAS;EACtB,YAAY;GACR;IAAE,MAAM;IAAM,IAAI;IAAQ,UAAU;IAAM,QAAQ,EAAE,MAAM,SAAS;IAAG,aAAa;GAAY;GAC/F,OAAO;GACP,OAAO;GACP;IACI,MAAM;IACN,IAAI;IACJ,UAAU;IACV,QAAQ,EAAE,MAAM,SAAS;IACzB,aACI;GAGR;EACJ;EACA,aAAa;GACT,UAAU;GACV,SAAS,EACL,oBAAoB,EAChB,QAAQ,EAAE,MAAM,wBAAwB,WAAW,QAAQ,EAC/D,EACJ;EACJ;EACA,WAAW;GACP,KAAK;IACD,aAAa;IACb,SAAS,EACL,oBAAoB,EAChB,QAAQ,EAAE,MAAM,wBAAwB,aAAa,EACzD,EACJ;GACJ;GACA,KAAK;IACD,aAAa;IACb,SAAS,EAAE,oBAAoB,EAAE,QAAQ,EAAE,MAAM,qCAAqC,EAAE,EAAE;GAC9F;GACA,KAAK;IACD,aAAa;IACb,SAAS,EAAE,oBAAoB,EAAE,QAAQ,EAAE,MAAM,qCAAqC,EAAE,EAAE;GAC9F;GACA,KAAK;IACD,aAAa;IACb,SAAS,EAAE,oBAAoB,EAAE,QAAQ,EAAE,MAAM,qCAAqC,EAAE,EAAE;GAC9F;GACA,GAAG,OAAO;GACV,GAAG,OAAO;GACV,GAAG,eAAe,WAAW;EACjC;CACJ;AACJ;;;;;;;;AASA,SAAS,4BAA4B,YAAuD;CACxF,MAAM,EAAE,UAAU,WAAW,GAAG,SAAS,2BAA2B,UAAU;CAC9E,OAAO;AACX;;;;;;;;;;AAWA,SAAgB,2BAA2B,YAAuD;CAC9F,MAAM,aAAsC,CAAC;CAC7C,MAAM,WAAqB,CAAC;CAI5B,MAAM,WAAW,gBAAgB,YAAY,OAAO;CACpD,MAAM,UAAU,IAAI,IAAY,QAAQ;CACxC,MAAM,QAAQ,gBAAgB,UAAU,CAAC,GAAG,MAAM;CAElD,KAAK,MAAM,CAAC,KAAK,aAAa,OAAO,QAAQ,WAAW,UAAU,GAAG;EACjE,IAAI,SAAS,SAAS,YAAY;EAClC,IAAI,CAAC,qBAAqB,UAAU,OAAO,GAAG;EAG9C,IAAI,SAAS,SAAS,UAAU,SAAS,WAAW;EAGpD,IAAI,UAAU,YAAY,SAAS,QAAQ,SAAS,SAAS,YAAY,SAAS,SAAS,MAAM;EAEjG,WAAW,OAAO,wBAAwB,QAAQ;EAClD,QAAQ,IAAI,GAAG;EAEf,IAAI,SAAS,YAAY,UACrB,SAAS,KAAK,GAAG;CAEzB;CAMA,IAAI,CAAC,QAAQ,IAAI,KAAK,GAAG;EACrB,WAAW,SAAS;GAChB,GAAG,YAAY,UAAU;GACzB,aAAa;EACjB;EACA,QAAQ,IAAI,KAAK;CACrB;CAQA,sBAAsB,YAAY,YAAY,OAAO;CACrD,oBAAoB,YAAY,YAAY,OAAO;CAMnD,MAAM,cAAc,gBAAgB,UAAU,CAAC,EAAE;CACjD,MAAM,kBAAkB,cAAc,SAAS,QAAO,QAAO,QAAQ,WAAW,IAAI;CAEpF,OAAO;EACH,MAAM;EACN,UAAU,gBAAgB,SAAS,IAAI,kBAAkB,KAAA;EACzD;CACJ;AACJ;;;;;;;;;;;;;;;;AAiBA,SAAS,sBACL,YACA,YACA,SACI;CACJ,MAAM,WAAW,4BAA4B,UAAU;CAEvD,MAAM,QAAQ,KAAa,aAAqC;EAC5D,IAAI,QAAQ,IAAI,GAAG,GAAG;EACtB,WAAW,OAAO;GACd,GAAG,YAAY,eAAe,QAAQ,CAAC;GACvC,aAAa,SAAS,SAAS,WAAW;EAC9C;EACA,QAAQ,IAAI,GAAG;CACnB;CAEA,KAAK,MAAM,YAAY,OAAO,OAAO,QAAQ,GACzC,IAAI,SAAS,SAAS,eAAe,SAAS,UAC1C,KAAK,kBAAkB,YAAY,SAAS,QAAQ,GAAG,QAAQ;CAIvE,KAAK,MAAM,CAAC,KAAK,aAAa,OAAO,QAAQ,WAAW,cAAc,CAAC,CAAC,GAAG;EACvE,IAAK,UAAuB,SAAS,YAAY;EACjD,MAAM,WAAW,aAAa,UAAU,GAAG;EAC3C,IAAI,UAAU,SAAS,eAAe,SAAS,UAAU,KAAK,KAAK,QAAQ;CAC/E;AACJ;;;;AAKA,SAAS,wBAAwB,UAA6C;CAC1E,MAAM,SAAS,4BAA4B,QAAQ;CACnD,MAAM,aAAa,iBAAiB,QAAQ;CAC5C,IAAI,CAAC,YAAY,OAAO;CAExB,MAAM,WAAW,kBAAkB,QAAQ;CAC3C,OAAO;EACH,GAAG;EACH,GAAI,WACE,EAAE,aAAa,OAAO,cAAc,GAAG,OAAO,YAAY,KAAK,aAAa,SAAS,IACrF,CAAC;EACP,mBAAmB;CACvB;AACJ;;AAGA,SAAS,4BAA4B,UAA6C;CAC9E,MAAM,OAAgC,CAAC;CAEvC,IAAI,SAAS,MACT,KAAK,cAAc,SAAS;CAGhC,QAAQ,SAAS,MAAjB;EACI,KAAK,UAAU;GACX,MAAM,KAAK;GACX,KAAK,OAAO;GAEZ,IAAI,GAAG,MAAM;IACT,MAAM,aAAa,kBAAkB,GAAG,IAAI;IAC5C,IAAI,WAAW,SAAS,GACpB,KAAK,OAAO;GAEpB;GAEA,IAAI,GAAG,YAAY;IACf,IAAI,GAAG,WAAW,QAAQ,KAAA,GAAW,KAAK,YAAY,GAAG,WAAW;IACpE,IAAI,GAAG,WAAW,QAAQ,KAAA,GAAW,KAAK,YAAY,GAAG,WAAW;IACpE,IAAI,GAAG,WAAW,WAAW,KAAA,GAAW;KACpC,KAAK,YAAY,GAAG,WAAW;KAC/B,KAAK,YAAY,GAAG,WAAW;IACnC;IACA,IAAI,GAAG,WAAW,YAAY,KAAA,GAC1B,KAAK,UAAU,OAAO,GAAG,WAAW,OAAO;GAEnD;GAEA,IAAI,GAAG,OAAO,KAAK,SAAS;GAC5B,IAAI,GAAG,KAAK,KAAK,SAAS;GAC1B,IAAI,GAAG,SAAS,KAAK,SAAS;GAE9B,OAAO;EACX;EAEA,KAAK,UAAU;GACX,MAAM,KAAK;GAWX,KAAK,OAJa,GAAG,YAAY,WAC1B,QAAQ,GAAG,IAAI,KACf,GAAG,eAAe,aAAa,GAAG,eAAe,YACjD,GAAG,eAAe,eAAe,GAAG,eAAe,WAClC,YAAY;GAEpC,IAAI,GAAG,MAAM;IACT,MAAM,aAAa,kBAAkB,GAAG,IAAI;IAC5C,IAAI,WAAW,SAAS,GACpB,KAAK,OAAO;GAEpB;GAEA,IAAI,GAAG,YAAY;IACf,IAAI,GAAG,WAAW,QAAQ,KAAA,GAAW,KAAK,UAAU,GAAG,WAAW;IAClE,IAAI,GAAG,WAAW,QAAQ,KAAA,GAAW,KAAK,UAAU,GAAG,WAAW;IAClE,IAAI,GAAG,WAAW,aAAa,KAAA,GAAW;KACtC,KAAK,UAAU,GAAG,WAAW;KAC7B,KAAK,mBAAmB;IAC5B;IACA,IAAI,GAAG,WAAW,aAAa,KAAA,GAAW;KACtC,KAAK,UAAU,GAAG,WAAW;KAC7B,KAAK,mBAAmB;IAC5B;GACJ;GAEA,OAAO;EACX;EAEA,KAAK;GACD,KAAK,OAAO;GACZ,OAAO;EAEX,KAAK;GACD,KAAK,OAAO;GACZ,IAAI,SAAS,SAAS,QAClB,KAAK,SAAS;QAEd,KAAK,SAAS;GAElB,IAAI,SAAS,WAAW;IACpB,KAAK,WAAW;IAChB,KAAK,eAAe,KAAK,eAAe,OACnC,SAAS,cAAc,cAAc,4BAA4B;GAC1E;GACA,OAAO;EAGX,KAAK;GACD,KAAK,OAAO;GACZ,KAAK,aAAa;IACd,UAAU,EAAE,MAAM,SAAS;IAC3B,WAAW,EAAE,MAAM,SAAS;GAChC;GACA,KAAK,WAAW,CAAC,YAAY,WAAW;GACxC,OAAO;EAEX,KAAK;GACD,KAAK,OAAO;GACZ,KAAK,eAAe,KAAK,eAAe,MAAM;GAC9C,OAAO;EAEX,KAAK,SAAS;GACV,MAAM,KAAK;GACX,KAAK,OAAO;GAEZ,IAAI,GAAG,OAAO;IAEV,MAAM,YAAY,GAAG,MAAM,aAAa;IACxC,MAAM,aAAa,GAAG,MAAM,cAAc;IAC1C,MAAM,WAAsC,CAAC;IAE7C,KAAK,MAAM,CAAC,YAAY,gBAAgB,OAAO,QAAQ,GAAG,MAAM,UAAU,GACtE,SAAS,KAAK;KACV,MAAM;KACN,YAAY;OACP,YAAY;OAAE,MAAM;OACjD,MAAM,CAAC,UAAU;MAAE;OACU,aAAa,wBAAwB,WAAW;KACrD;KACA,UAAU,CAAC,WAAW,UAAU;IACpC,CAAC;IAGL,KAAK,QAAQ,EAAE,OAAO,SAAS;GACnC,OAAO,IAAI,GAAG,IACV,IAAI,MAAM,QAAQ,GAAG,EAAE,GACnB,KAAK,QAAQ,EAAE,OAAO,GAAG,GAAG,KAAI,MAAK,wBAAwB,CAAC,CAAC,EAAE;QAEjE,KAAK,QAAQ,wBAAwB,GAAG,EAAE;QAG9C,KAAK,QAAQ,CAAC;GAGlB,IAAI,GAAG,YAAY;IACf,IAAI,GAAG,WAAW,QAAQ,KAAA,GAAW,KAAK,WAAW,GAAG,WAAW;IACnE,IAAI,GAAG,WAAW,QAAQ,KAAA,GAAW,KAAK,WAAW,GAAG,WAAW;GACvE;GAEA,OAAO;EACX;EAEA,KAAK,OAAO;GACR,MAAM,KAAK;GACX,KAAK,OAAO;GAEZ,IAAI,GAAG,YAAY;IACf,MAAM,QAAiC,CAAC;IACxC,MAAM,MAAgB,CAAC;IAEvB,KAAK,MAAM,CAAC,KAAK,YAAY,OAAO,QAAQ,GAAG,UAAU,GAAG;KACxD,MAAM,OAAO,wBAAwB,OAAO;KAC5C,IAAI,QAAQ,YAAY,UACpB,IAAI,KAAK,GAAG;IAEpB;IAEA,KAAK,aAAa;IAClB,IAAI,IAAI,SAAS,GAAG,KAAK,WAAW;GACxC,OAAO,IAAI,GAAG,UACV,KAAK,uBAAuB;GAGhC,OAAO;EACX;EAEA,KAAK,UAAU;GACX,MAAM,KAAK;GACX,KAAK,OAAO;GACZ,KAAK,QAAQ,EAAE,MAAM,SAAS;GAC9B,KAAK,eAAe,KAAK,eAAe,MAAM,YAAY,GAAG,WAAW;GACxE,OAAO;EACX;EACA,KAAK;GACD,KAAK,OAAO;GACZ,KAAK,eAAe,KAAK,eAAe,MAAM;GAC9C,OAAO;EAEX;GACI,KAAK,OAAO;GACZ,OAAO;CACf;AACJ;;;;AAKA,SAAS,kBAAkB,SAAoG;CAC3H,IAAI,MAAM,QAAQ,OAAO,GACrB,OAAO,QAAQ,KAAI,MAAM,OAAO,MAAM,YAAY,MAAM,QAAQ,QAAQ,IAAK,EAAE,KAAK,CAAoB;CAE5G,OAAO,OAAO,KAAK,OAAO,CAAC,CAAC,KAAI,MAAK;EAEjC,MAAM,MAAM,OAAO,CAAC;EACpB,OAAO,MAAM,GAAG,IAAI,IAAI;CAC5B,CAAC;AACL;;;;;;;;;;AAWA,SAAS,sBACL,YACA,gCAAqC,IAAI,IAAI,GACf;CAC9B,MAAM,SAAyC,CAAC;CAEhD,KAAK,MAAM,CAAC,KAAK,aAAa,OAAO,QAAQ,WAAW,UAAU,GAAG;EACjE,IAAI,CAAC,qBAAqB,QAAQ,GAAG;EAKrC,IAAI,SAAS,SAAS,YAAY;EAClC,IAAI,SAAS,SAAS,SAAS,SAAS,SAAS,WAAW,SAAS,SAAS,YAC1E;EAIJ,IAAI,cAAc,IAAI,GAAG,GAAG;EAE5B,OAAO,KAAK;GACR,MAAM;GACN,IAAI;GACJ,UAAU;GACV,QAAQ,EAAE,MAAM,SAAS;GACzB,aACI,eAAe,IAAI;GAIvB,SAAS,SAAS,SAAS,WAAW,cAAc,SAAS,SAAS,WAAW,YAAY,KAAA;EACjG,CAAC;CACL;CAEA,OAAO;AACX;;;;AAKA,SAAS,eAAe,aAA+C;CACnE,MAAM,YAAqC;EACvC,KAAK;GACD,aAAa;GACb,SAAS,EAAE,oBAAoB,EAAE,QAAQ,EAAE,MAAM,qCAAqC,EAAE,EAAE;EAC9F;EACA,KAAK;GACD,aAAa;GACb,SAAS,EAAE,oBAAoB,EAAE,QAAQ,EAAE,MAAM,qCAAqC,EAAE,EAAE;EAC9F;CACJ;CAEA,IAAI,aAAa;EACb,UAAU,OAAO;GACb,aAAa;GACb,SAAS,EAAE,oBAAoB,EAAE,QAAQ,EAAE,MAAM,qCAAqC,EAAE,EAAE;EAC9F;EACA,UAAU,OAAO;GACb,aAAa;GACb,SAAS,EAAE,oBAAoB,EAAE,QAAQ,EAAE,MAAM,qCAAqC,EAAE,EAAE;EAC9F;CACJ;CAEA,OAAO;AACX;;;;AAKA,SAAS,sBAAsB,MAAsB;CACjD,OAAO,GAAG,YAAY,KAAK,IAAI,IAAI,OAAO,IAAI,GAAG;AACrD;;;;;;;;;;;;;;;;AAiBA,SAAS,cAAc,YAAsC;CACzD,OAAO,aAAa,WAAW,gBAAgB,EAAE,KAC1C,aAAa,WAAW,QAAQ,EAAE,KAClC,aAAa,WAAW,QAAQ,EAAE,KAClC;AACX;;;;AAKA,SAAS,aAAa,KAAqB;CACvC,OAAO,IACF,QAAQ,kBAAkB,GAAG,CAAC,CAC9B,MAAM,GAAG,CAAC,CACV,OAAO,OAAO,CAAC,CACf,KAAI,SAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,YAAY,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CACvE,KAAK,EAAE;AAChB"}

package/dist/proxy-qRlqeUmO.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"proxy-qRlqeUmO.js","names":[],"sources":["../src/functions/proxy.ts"],"sourcesContent":["/**\n * Forwarding `/api/functions/*` to the process that serves it.\n *\n * A split deployment normally puts a reverse proxy in front and routes the path\n * there. This exists so it does not have to: set `REBASE_FUNCTIONS_UPSTREAM` on\n * the API process and the two-container topology presents the identical URL\n * surface as the one-container one, with nothing new to install and nothing for\n * a client or an SDK to know about.\n *\n * It is a transport hop, not a trust boundary. Nothing is authenticated or\n * authorised here: the upstream runs the same auth middleware against the same\n * `JWT_SECRET` and must see the original `Authorization` header, so re-deciding\n * anything on the way through would put two answers where the system has one.\n */\nimport { Hono, type Context } from \"hono\";\nimport { getConnInfo } from \"@hono/node-server/conninfo\";\nimport type { HonoEnv } from \"../api/types\";\nimport { logger } from \"../utils/logger\";\n\n/**\n * Headers that describe *this* connection rather than the request, and so must\n * not be copied onto a new one.\n *\n * `host` is the important one: forwarded unchanged it names the API process, and\n * an upstream doing any virtual-host routing would answer for the wrong service.\n * `content-length` and `transfer-encoding` are recomputed by `fetch` from the\n * body it is actually given, and a stale value is a hang or a truncation.\n */\nconst HOP_BY_HOP = new Set([\n    \"connection\",\n    \"keep-alive\",\n    \"proxy-authenticate\",\n    \"proxy-authorization\",\n    \"te\",\n    \"trailer\",\n    \"transfer-encoding\",\n    \"upgrade\",\n    \"host\",\n    \"content-length\"\n]);\n\n/**\n * Additionally dropped from the *response*, because `fetch` has already acted on\n * them by the time we see the body.\n *\n * `Content-Encoding` is the one that matters and the one that is easy to miss:\n * undici decompresses a `gzip` response transparently, but leaves the header on\n * the `Response` object. Copy it onto the body we hand back and the client is\n * told to gunzip bytes that are already plain — which does not fail cleanly. It\n * hangs, or it surfaces as a decode error several layers away from the proxy\n * that caused it. (This is not hypothetical: the runtime compresses its own\n * responses, so *every* forwarded response carries the header.)\n */\nconst RESPONSE_ONLY_DROP = new Set([\"content-encoding\", \"content-length\"]);\n\nexport interface FunctionsProxyOptions {\n    /** Base URL of the process serving the functions, e.g. `http://functions:8080`. */\n    upstream: string;\n    /** The mount path being forwarded, e.g. `/api/functions`. */\n    basePath: string;\n}\n\n/**\n * A router that forwards everything under its mount point to `upstream`.\n *\n * Method, path, query string, body and headers travel verbatim, with two\n * deliberate exceptions:\n *\n * 1. Hop-by-hop headers are dropped ({@link HOP_BY_HOP}).\n * 2. `X-Forwarded-For` gains the address this process saw the request come from.\n *    This is not decoration — the upstream's rate limiters and the auth routes'\n *    IP logging read that chain, and without the append every forwarded request\n *    arrives from one address: the API pod's. Every caller would share a single\n *    rate-limit bucket and every login would be logged from the same IP.\n *\n *    **The upstream must therefore count one more proxy hop than the API process\n *    does.** `TRUSTED_PROXY_HOPS` on the functions process is the API's value\n *    plus one. Left unset it defaults to 0, and the upstream falls back to the\n *    socket address — again, the API pod's — which is safe but useless.\n */\nexport function createFunctionsProxy(options: FunctionsProxyOptions): Hono<HonoEnv> {\n    const router = new Hono<HonoEnv>();\n    // Trailing slash trimmed once, here: joining it per request is how a proxy\n    // ends up asking for `//functions/x`, which some servers route and some 404.\n    const upstream = options.upstream.replace(/\\/+$/, \"\");\n\n    router.all(\"/*\", async (c) => {\n        const incoming = new URL(c.req.url);\n        // The path *below* the mount point. Hono gives the full request path, so\n        // taking the suffix is what keeps the upstream's own mount identical:\n        // `/api/functions/send-invoice` here becomes `/api/functions/send-invoice`\n        // there, not `/api/functions/api/functions/send-invoice`.\n        const suffix = incoming.pathname.startsWith(options.basePath)\n            ? incoming.pathname.slice(options.basePath.length)\n            : incoming.pathname;\n        const target = `${upstream}${options.basePath}${suffix}${incoming.search}`;\n\n        const headers = new Headers();\n        for (const [name, value] of c.req.raw.headers) {\n            if (!HOP_BY_HOP.has(name.toLowerCase())) headers.set(name, value);\n        }\n\n        const seenFrom = socketAddress(c);\n        if (seenFrom) {\n            const chain = c.req.header(\"x-forwarded-for\");\n            headers.set(\"x-forwarded-for\", chain ? `${chain}, ${seenFrom}` : seenFrom);\n        }\n\n        try {\n            const response = await fetch(target, {\n                method: c.req.method,\n                headers,\n                // GET and HEAD may not carry one; everything else streams\n                // through rather than being buffered, so a large upload does not\n                // have to fit in this process's memory on its way past.\n                body: c.req.method === \"GET\" || c.req.method === \"HEAD\" ? undefined : c.req.raw.body,\n                // Required by undici whenever the body is a stream. Without it\n                // the fetch rejects with a message about duplex that says\n                // nothing about what to do.\n                duplex: \"half\",\n                redirect: \"manual\"\n            } as RequestInit);\n\n            return new Response(response.body, {\n                status: response.status,\n                statusText: response.statusText,\n                headers: responseHeaders(response.headers)\n            });\n        } catch (err) {\n            // The upstream being down is an infrastructure fact, not a bug in\n            // the caller's request, and 502 is the one status that says so.\n            // Named explicitly in the body because the alternative — a generic\n            // 500 from the API process — sends people reading the wrong logs.\n            logger.error(\"Functions upstream unreachable\", {\n                upstream,\n                path: incoming.pathname,\n                error: err instanceof Error ? err : new Error(String(err))\n            });\n            return c.json({\n                error: {\n                    code: \"FUNCTIONS_UPSTREAM_UNREACHABLE\",\n                    message: \"The process serving custom functions could not be reached from this one.\"\n                }\n            }, 502);\n        }\n    });\n\n    return router;\n}\n\n/**\n * Response headers, minus the ones that describe the upstream's connection and\n * the ones `fetch` has already consumed on our behalf.\n */\nfunction responseHeaders(headers: Headers): Headers {\n    const out = new Headers();\n    for (const [name, value] of headers) {\n        const lower = name.toLowerCase();\n        if (HOP_BY_HOP.has(lower) || RESPONSE_ONLY_DROP.has(lower)) continue;\n        out.set(name, value);\n    }\n    return out;\n}\n\n/** The address this process saw, or undefined on a runtime that cannot say. */\nfunction socketAddress(c: Context<HonoEnv>): string | undefined {\n    try {\n        return getConnInfo(c).remote.address;\n    } catch {\n        return undefined;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,IAAM,6BAAa,IAAI,IAAI;CACvB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACJ,CAAC;;;;;;;;;;;;;AAcD,IAAM,qCAAqB,IAAI,IAAI,CAAC,oBAAoB,gBAAgB,CAAC;;;;;;;;;;;;;;;;;;;AA2BzE,SAAgB,qBAAqB,SAA+C;CAChF,MAAM,SAAS,IAAI,KAAc;CAGjC,MAAM,WAAW,QAAQ,SAAS,QAAQ,QAAQ,EAAE;CAEpD,OAAO,IAAI,MAAM,OAAO,MAAM;EAC1B,MAAM,WAAW,IAAI,IAAI,EAAE,IAAI,GAAG;EAKlC,MAAM,SAAS,SAAS,SAAS,WAAW,QAAQ,QAAQ,IACtD,SAAS,SAAS,MAAM,QAAQ,SAAS,MAAM,IAC/C,SAAS;EACf,MAAM,SAAS,GAAG,WAAW,QAAQ,WAAW,SAAS,SAAS;EAElE,MAAM,UAAU,IAAI,QAAQ;EAC5B,KAAK,MAAM,CAAC,MAAM,UAAU,EAAE,IAAI,IAAI,SAClC,IAAI,CAAC,WAAW,IAAI,KAAK,YAAY,CAAC,GAAG,QAAQ,IAAI,MAAM,KAAK;EAGpE,MAAM,WAAW,cAAc,CAAC;EAChC,IAAI,UAAU;GACV,MAAM,QAAQ,EAAE,IAAI,OAAO,iBAAiB;GAC5C,QAAQ,IAAI,mBAAmB,QAAQ,GAAG,MAAM,IAAI,aAAa,QAAQ;EAC7E;EAEA,IAAI;GACA,MAAM,WAAW,MAAM,MAAM,QAAQ;IACjC,QAAQ,EAAE,IAAI;IACd;IAIA,MAAM,EAAE,IAAI,WAAW,SAAS,EAAE,IAAI,WAAW,SAAS,KAAA,IAAY,EAAE,IAAI,IAAI;IAIhF,QAAQ;IACR,UAAU;GACd,CAAgB;GAEhB,OAAO,IAAI,SAAS,SAAS,MAAM;IAC/B,QAAQ,SAAS;IACjB,YAAY,SAAS;IACrB,SAAS,gBAAgB,SAAS,OAAO;GAC7C,CAAC;EACL,SAAS,KAAK;GAKV,OAAO,MAAM,kCAAkC;IAC3C;IACA,MAAM,SAAS;IACf,OAAO,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,GAAG,CAAC;GAC7D,CAAC;GACD,OAAO,EAAE,KAAK,EACV,OAAO;IACH,MAAM;IACN,SAAS;GACb,EACJ,GAAG,GAAG;EACV;CACJ,CAAC;CAED,OAAO;AACX;;;;;AAMA,SAAS,gBAAgB,SAA2B;CAChD,MAAM,MAAM,IAAI,QAAQ;CACxB,KAAK,MAAM,CAAC,MAAM,UAAU,SAAS;EACjC,MAAM,QAAQ,KAAK,YAAY;EAC/B,IAAI,WAAW,IAAI,KAAK,KAAK,mBAAmB,IAAI,KAAK,GAAG;EAC5D,IAAI,IAAI,MAAM,KAAK;CACvB;CACA,OAAO;AACX;;AAGA,SAAS,cAAc,GAAyC;CAC5D,IAAI;EACA,OAAO,YAAY,CAAC,CAAC,CAAC,OAAO;CACjC,QAAQ;EACJ;CACJ;AACJ"}

package/dist/query-parser-BgiKJKvc.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"query-parser-BgiKJKvc.js","names":[],"sources":["../src/api/rest/field-access-query.ts","../src/api/rest/query-parser.ts"],"sourcesContent":["import type { CollectionConfig, IncludeSpec } from \"@rebasepro/types\";\nimport type { FilterCondition, LogicalCondition } from \"@rebasepro/types\";\nimport { type FieldViewer, type IncludeNode, normalizeInclude, resolveCollectionRelations, restrictedFieldNames } from \"@rebasepro/common\";\nimport { ApiError } from \"../errors\";\n\n/**\n * A read may not name a field the caller cannot read.\n *\n * The strip in the row pipeline is what keeps the *value* off the wire. This is\n * the other half, and without it the value is still readable one bit at a time:\n * `?salary=gt.100000` returns the rows whose withheld salary is above 100k, and\n * `?orderBy=salary` returns them in order of it. A column no response can carry\n * has to be a column no query can interrogate, or the read rule is decoration.\n *\n * The refusal names the field. That is deliberate and it is not a leak: the\n * published OpenAPI lists every property of every collection, including the ones\n * a given caller cannot read, because the document is one document and is served\n * off the app rather than off the authenticated data router. Hiding the name\n * here would protect nothing and would answer a caller's genuine typo with\n * \"unknown field\", sending them to look for a spelling mistake that is not\n * there. Field *names* are public; field *values* are not.\n *\n * @module\n */\n\n/**\n * The roles behind a request, as a viewer a field rule can judge.\n *\n * Never `undefined`, and that is the point. `undefined` means the trusted server\n * plane in {@link FieldViewer}, which satisfies every non-empty role list — so\n * returning it for a request that merely has no `user` on the context would\n * hand an unauthenticated caller every field in the database. The auth\n * middleware scopes such a request's driver as `roles: [\"anon\"]` but sets no\n * `user`, so the fallback here has to be the same list the driver was scoped\n * with, not nothing.\n *\n * @param c anything carrying the Hono context's `get` — the batch route passes a\n *          shim rather than the context itself, exactly as the API-key\n *          permission check does.\n */\nexport function requestViewer(c: { get: (key: never) => unknown }): FieldViewer {\n    const user = c.get(\"user\" as never) as { roles?: readonly string[] } | undefined;\n    return { roles: user?.roles ?? ANON_ROLES };\n}\n\n/** What the auth middleware scopes an unauthenticated request's driver with. */\nconst ANON_ROLES: readonly string[] = Object.freeze([\"anon\"]);\n\n/** Which query parameter a refused field arrived in, for the message. */\ntype Where = \"filter\" | \"orderBy\" | \"fields\" | \"select\" | \"groupBy\" | \"vector_search\";\n\nconst WHERE_LABEL: Record<Where, string> = {\n    filter: \"a filter\",\n    orderBy: \"`orderBy`\",\n    fields: \"`fields`\",\n    select: \"`select`\",\n    groupBy: \"`groupBy`\",\n    vector_search: \"`vector_search`\"\n};\n\n/** Every column a logical group compares, however deeply nested. */\nfunction logicalColumns(logical: LogicalCondition | undefined, into: string[]): void {\n    if (!logical?.conditions) return;\n    for (const condition of logical.conditions) {\n        if (\"conditions\" in condition) logicalColumns(condition as LogicalCondition, into);\n        else if ((condition as FilterCondition).column) into.push((condition as FilterCondition).column);\n    }\n}\n\n/**\n * The bare column an `orderBy` key names, or `undefined` for one that is not a\n * column at all.\n *\n * A sort key may be a relation aggregate (`comments.count()`) or one of the\n * computed keys a search adds (`_score`, `_distance`). Neither is a property of\n * this collection, so neither is a field this rule has anything to say about;\n * the field it *would* have named is checked by the same walk one level down\n * when the driver resolves the relation.\n */\nfunction orderByColumn(field: string): string | undefined {\n    if (field.startsWith(\"_\")) return undefined;\n    if (field.includes(\"(\") || field.includes(\".\")) return undefined;\n    return field;\n}\n\n/**\n * Refuse the request when any of `names` is a field this caller cannot read.\n *\n * Exported so the aggregate route — whose `select` and `groupBy` are parsed\n * outside `parseQueryOptions` — applies the identical rule. `count(*)` over a\n * withheld column is the same disclosure as reading it, one predicate at a time.\n */\nexport function assertReadableFields(\n    names: readonly (string | undefined)[],\n    collection: CollectionConfig,\n    viewer: FieldViewer | undefined,\n    where: Where\n): void {\n    if (names.length === 0) return;\n    const { refused } = restrictedFieldNames(collection, viewer, \"read\");\n    if (refused.size === 0) return;\n\n    const named = [...new Set(names.filter((n): n is string => n !== undefined && refused.has(n)))];\n    if (named.length === 0) return;\n\n    throw ApiError.badRequest(\n        `${named.map(f => `'${f}'`).join(\", \")} ${named.length > 1 ? \"are\" : \"is\"} not readable ` +\n        `on '${collection.slug}' with your roles, so ${named.length > 1 ? \"they\" : \"it\"} cannot be used in ` +\n        `${WHERE_LABEL[where]}.`,\n        \"FIELD_NOT_READABLE\",\n        {\n            collection: collection.slug,\n            fields: named,\n            violations: named.map(field => ({\n                field,\n                code: \"access\",\n                message: `'${field}' is not readable with your roles.`\n            }))\n        }\n    );\n}\n\n/**\n * The whole of a parsed read request, checked in one pass.\n *\n * One call rather than five, because five call sites is five chances to add a\n * sixth query parameter and forget it — which is exactly how `?or=` came to be\n * parsed and then dropped by the list route.\n */\nexport function assertQueryFieldsReadable(\n    options: {\n        where?: Record<string, unknown>;\n        logical?: LogicalCondition;\n        orderBy?: { field: string }[];\n        fields?: string[];\n        include?: IncludeSpec;\n        vectorSearch?: { property: string };\n    },\n    collection: CollectionConfig,\n    viewer: FieldViewer | undefined\n): void {\n    const filtered: string[] = [];\n    if (options.where) filtered.push(...Object.keys(options.where));\n    logicalColumns(options.logical, filtered);\n    assertReadableFields(filtered, collection, viewer, \"filter\");\n\n    assertReadableFields(\n        (options.orderBy ?? []).map(entry => orderByColumn(entry.field)),\n        collection, viewer, \"orderBy\"\n    );\n\n    assertReadableFields(options.fields ?? [], collection, viewer, \"fields\");\n\n    // A similarity search reads the vector it ranks by: `_distance` from a\n    // point the caller chose is a measurement of it, enough of them locate it,\n    // and `vector_threshold` alone answers \"is it within r of here\".\n    assertReadableFields(\n        options.vectorSearch ? [options.vectorSearch.property] : [],\n        collection, viewer, \"vector_search\"\n    );\n\n    const include = options.include !== undefined ? normalizeInclude(options.include) : undefined;\n    if (include) assertIncludeFieldsReadable(include.tree, collection, viewer);\n}\n\n/**\n * Every relation an `include` loads, judged like the read it is part of.\n *\n * An include's own `where`, `logical`, `orderBy` and `fields` read the columns\n * of the relation's *target*: `?include={\"staff\":{\"where\":{\"salary\":[\">\",100000]}}}`\n * answers which departments employ someone paid over 100k, and `orderBy` with a\n * `limit` of one names who — while `?salary=gt.100000` on `staff` itself is\n * refused. So each node is checked against its target's rules, level by level.\n *\n * A name that is not a relation of the collection is skipped rather than\n * refused here: the driver refuses it with a 400 naming the relations there\n * are, and loads nothing for it. Looked up by exact key, as the driver does, so\n * both judge the same relation.\n */\nfunction assertIncludeFieldsReadable(\n    tree: Record<string, IncludeNode>,\n    collection: CollectionConfig,\n    viewer: FieldViewer | undefined\n): void {\n    const relations = resolveCollectionRelations(collection);\n    for (const [key, node] of Object.entries(tree)) {\n        const relation = relations[key];\n        if (!relation) continue;\n        const target = relation.target();\n        assertQueryFieldsReadable({\n            where: node.where,\n            logical: node.logical,\n            orderBy: node.orderBy?.map(([field]) => ({ field })),\n            fields: node.fields\n        }, target, viewer);\n        assertIncludeFieldsReadable(node.children, target, viewer);\n    }\n}\n","import type { CollectionConfig, FilterValues, ListLimitBounds, LogicalCondition, NullsPlacement, OrderByTuple, VectorSearchParams } from \"@rebasepro/types\";\nimport { toCanonicalOp, resolveClientListLimit, ListLimitError, DEFAULT_LIST_LIMIT, MAX_LIST_LIMIT } from \"@rebasepro/types\";\nimport type { DecodedCursor } from \"@rebasepro/common\";\nimport {\n    CursorError,\n    CursorMismatchError,\n    type FieldViewer,\n    IncludeSpecError,\n    OrderBySpecError,\n    decodeCursor,\n    deserializeFilter,\n    deserializeInclude,\n    deserializeLogicalCondition,\n    normalizeInclude,\n    reconcileCursorOrder,\n    RESERVED_QUERY_KEYS,\n    UnknownFilterOperatorError\n} from \"@rebasepro/common\";\nimport { QueryOptions } from \"../types\";\nimport { ApiError } from \"../errors\";\nimport { DELETED_QUERY_PARAM, parseWithDeleted } from \"./soft-delete-params\";\nimport { assertQueryFieldsReadable } from \"./field-access-query\";\n\nexport const mapOperator = (op: string) => toCanonicalOp(op) ?? null;\n\n/**\n * A malformed query parameter, refused with a 400.\n *\n * Every rejection in this file is one of these, and every one of them is\n * `expected` — the flag `errorHandler` reads to log a routine outcome at debug\n * instead of warn. A client that mistypes an operator, a sort direction or a\n * limit is not an incident: nothing on the server is wrong, the request never\n * reached the database, and the caller has already been told what to fix in the\n * response body. Left at warn, a single frontend holding a stale field name\n * writes a `⚠️` line per request forever, and the warn level stops meaning\n * anything — which is why \"routine 4xx logs at WARN\" is a standing finding\n * against this API.\n *\n * Not a factory on `ApiError`: the class's members are part of the tracked\n * runtime surface (`api-surface/server.api.txt`), and this needs no addition to\n * it. `ApiError.unauthenticated` is the same idea one status code up.\n */\nfunction invalidParam(message: string, code: string, details?: unknown): ApiError {\n    return new ApiError(400, code, message, details, true);\n}\n\n/**\n * Decode a filter, turning the shared codec's operator rejection into a 400.\n *\n * `deserializeFilter` lives in `@rebasepro/common`, which cannot throw an\n * `ApiError` — it does not depend on this package, and the browser SDK decodes\n * through the same function and has nothing to render one with. So it throws\n * `UnknownFilterOperatorError`, and the HTTP boundary is where that becomes a\n * status code. Same seam `parseLogicalGroup` uses for the nesting bound.\n *\n * Without this the operator string became a *value*: `?where={\"title\":\n * [\"!!\",\"Hello\"]}` compiled to `title IN ('!!','Hello')` and answered 200 with\n * the row the caller was filtering out, and `{\"id\":[\">>\",0]}` reached Postgres\n * and came back a 500 quoting `invalid input syntax for type integer`. Both are\n * malformed requests and now say so.\n */\nfunction decodeFilter(query: Record<string, unknown>): FilterValues<string> {\n    try {\n        return deserializeFilter(query);\n    } catch (e) {\n        if (e instanceof UnknownFilterOperatorError) {\n            throw invalidParam(e.message, e.code, e.details);\n        }\n        throw e;\n    }\n}\n\nfunction getLastValue(val: unknown): unknown {\n    if (Array.isArray(val)) {\n        return val[val.length - 1];\n    }\n    return val;\n}\n\n/**\n * Parse an `or(...)` / `and(...)` logical group from its wire form.\n *\n * The wire carries the inner conditions wrapped in parens (e.g.\n * `(status.eq.active,age.gte.18)`); we re-attach the `or`/`and` prefix and\n * delegate to the canonical filter dialect (`@rebasepro/common`). Values are\n * preserved as strings — type coercion is the schema-aware driver's job, so\n * this path stays byte-for-byte consistent with the SDK/admin path (which\n * also parses via the shared dialect).\n */\nfunction parseLogicalGroup(type: \"or\" | \"and\" | \"not\", raw: unknown): LogicalCondition | undefined {\n    let inner = String(raw).trim();\n    if (inner.startsWith(\"(\") && inner.endsWith(\")\")) {\n        inner = inner.slice(1, -1);\n    }\n    inner = inner.trim();\n    if (!inner) return undefined;\n    let parsed;\n    try {\n        parsed = deserializeLogicalCondition(`${type}(${inner})`);\n    } catch (e) {\n        // The parser refuses a nesting depth no real filter reaches. That is a\n        // request problem, and without this it surfaced as a 500 — the\n        // unbounded version reached `RangeError: Maximum call stack size\n        // exceeded`, which tells the caller nothing about their filter.\n        throw invalidParam(\n            `Invalid \\`${type}\\` parameter: ${e instanceof Error ? e.message : String(e)}`,\n            \"INVALID_LOGICAL_GROUP\"\n        );\n    }\n    return \"type\" in parsed ? parsed : undefined;\n}\n\n/**\n * Parse the `?where=` JSON filter object.\n *\n * This is the dialect the OpenAPI document publishes on every\n * `GET /api/data/{slug}` — `{\"status\":[\"==\",\"active\"]}`: field → canonical\n * `[WhereFilterOp, value]` tuple. It is normalized through the same\n * `deserializeFilter` as the `?field=op.value` params below, so a value that\n * arrives as a PostgREST dot-string (`{\"status\":\"eq.active\"}`) or as a bare\n * scalar (`{\"status\":\"active\"}`) compiles to the same condition. Unlike the\n * querystring dialect, JSON carries types — a number stays a number.\n *\n * A malformed value is a 400 rather than a silent drop: dropping the filter\n * would run the read unfiltered and return everything RLS happens to allow.\n */\nfunction parseWhereParam(raw: unknown): FilterValues<string> | undefined {\n    const str = String(raw).trim();\n    if (!str) return undefined;\n\n    let parsed: unknown;\n    try {\n        parsed = JSON.parse(str);\n    } catch {\n        throw invalidParam(\n            \"Invalid `where` parameter: expected a JSON object, e.g. {\\\"status\\\":[\\\"==\\\",\\\"active\\\"]}\",\n            \"INVALID_WHERE\"\n        );\n    }\n    if (typeof parsed !== \"object\" || parsed === null || Array.isArray(parsed)) {\n        throw invalidParam(\n            \"Invalid `where` parameter: expected a JSON object mapping fields to conditions, \"\n            + \"e.g. {\\\"status\\\":[\\\"==\\\",\\\"active\\\"]}\",\n            \"INVALID_WHERE\"\n        );\n    }\n\n    const filter = decodeFilter(parsed as Record<string, unknown>);\n    return Object.keys(filter).length > 0 ? filter : undefined;\n}\n\ntype OrderByEntry = { field: string; direction: \"asc\" | \"desc\"; nulls?: NullsPlacement };\n\n/**\n * The parsed entries as the driver contract spells them: `[field, direction]`\n * tuples in order of significance.\n *\n * The REST layer used to hand the driver `orderBy[0].field` and drop the rest,\n * so `?orderBy=[{\"field\":\"roles\"},{\"field\":\"created_at\",\"direction\":\"desc\"}]`\n * — a shape this parser has always accepted and validated in full — sorted by\n * `roles` alone and returned the ties in whatever order Postgres pleased.\n */\nexport function orderByEntriesToTuples(entries?: OrderByEntry[]): OrderByTuple[] | undefined {\n    if (!entries || entries.length === 0) return undefined;\n    return entries.map(({ field, direction, nulls }) => (nulls\n        ? [field, direction, nulls]\n        : [field, direction]) as OrderByTuple);\n}\n\nfunction invalidOrderBy(detail: string): never {\n    throw invalidParam(\n        `Invalid \\`orderBy\\` parameter: ${detail}. Expected \\`field\\`, \\`field:desc\\`, `\n        + \"`field:desc:last`, or a JSON array like \"\n        + \"[{\\\"field\\\":\\\"created_at\\\",\\\"direction\\\":\\\"desc\\\",\\\"nulls\\\":\\\"last\\\"}]\",\n        \"INVALID_ORDER_BY\"\n    );\n}\n\n/**\n * The `nulls` slot: `first`/`last`, or a refusal naming the entry.\n *\n * Refused rather than defaulted, for the reason every other parameter here is:\n * a sort quietly ordered by a convention the caller did not ask for reads as\n * though it obeyed them. See {@link NullsPlacement} for what the default is\n * when the slot is simply absent.\n */\nfunction toNulls(raw: unknown, context: string): NullsPlacement | undefined {\n    if (raw === undefined || raw === null || raw === \"\") return undefined;\n    if (raw !== \"first\" && raw !== \"last\") {\n        invalidOrderBy(`${context} has nulls '${String(raw)}'`);\n    }\n    return raw;\n}\n\n/** The aggregate functions `?select=` accepts. */\nconst AGGREGATE_FUNCTIONS = new Set([\"count\", \"sum\", \"avg\", \"min\", \"max\"]);\n\nexport interface ParsedAggregate {\n    fn: \"count\" | \"sum\" | \"avg\" | \"min\" | \"max\";\n    /** Absent only for `count()`, which counts rows rather than values. */\n    field?: string;\n    /** The key this appears under in the response. */\n    alias: string;\n}\n\n/**\n * Parse `?select=count(),sum(total),avg(total)`.\n *\n * The spelling is SQL's, because whoever writes it is thinking in SQL and\n * because any other spelling has to be learned first. `count()` with no field\n * counts rows; every other function names a column.\n *\n * Aliases are derived rather than accepted: `sum(total)` returns as\n * `sum_total`, `count()` as `count`. Letting a caller choose would mean\n * checking their alias is not also a `groupBy` field — a rule nobody would\n * guess, and a silently overwritten value if it went unchecked.\n */\nexport function parseAggregateSelect(raw: unknown): ParsedAggregate[] | undefined {\n    const value = getLastValue(raw);\n    if (!value) return undefined;\n\n    const entries = String(value).split(\",\").map(s => s.trim()).filter(Boolean);\n    if (entries.length === 0) return undefined;\n\n    return entries.map((entry) => {\n        const match = /^([a-z]+)\\(\\s*([A-Za-z0-9_]*)\\s*\\)$/i.exec(entry);\n        if (!match) {\n            throw invalidParam(\n                `Invalid \\`select\\` entry \"${entry}\". Expected \\`fn(field)\\`, e.g. \\`sum(total)\\` or \\`count()\\`.`,\n                \"INVALID_AGGREGATE_SELECT\"\n            );\n        }\n\n        const fn = match[1].toLowerCase();\n        const field = match[2] || undefined;\n\n        if (!AGGREGATE_FUNCTIONS.has(fn)) {\n            throw invalidParam(\n                `Unknown aggregate function \"${fn}\". Expected: ${[...AGGREGATE_FUNCTIONS].join(\", \")}.`,\n                \"INVALID_AGGREGATE_FUNCTION\"\n            );\n        }\n        if (fn !== \"count\" && !field) {\n            // `sum()` has no sensible reading, and guessing one would be\n            // inventing a column on the caller's behalf.\n            throw invalidParam(\n                `\\`${fn}()\\` needs a field, e.g. \\`${fn}(total)\\`. Only \\`count()\\` may be empty.`,\n                \"INVALID_AGGREGATE_SELECT\"\n            );\n        }\n\n        return {\n            fn: fn as ParsedAggregate[\"fn\"],\n            field,\n            alias: field ? `${fn}_${field}` : fn\n        };\n    });\n}\n\n/** Parse `?groupBy=status,country`. */\nexport function parseGroupBy(raw: unknown): string[] | undefined {\n    const value = getLastValue(raw);\n    if (!value) return undefined;\n    const fields = String(value).split(\",\").map(s => s.trim()).filter(Boolean);\n    return fields.length > 0 ? fields : undefined;\n}\n\n/** `asc`/`desc`, in any case. Anything else is a request to sort in a way that does not exist. */\nfunction toDirection(raw: unknown, context: string): \"asc\" | \"desc\" {\n    if (raw === undefined || raw === null) return \"asc\";\n    if (typeof raw !== \"string\") invalidOrderBy(`${context} has a non-string \\`direction\\``);\n    const lowered = raw.toLowerCase();\n    if (lowered !== \"asc\" && lowered !== \"desc\") {\n        invalidOrderBy(`${context} has direction '${raw}'`);\n    }\n    return lowered;\n}\n\n/** One entry: the canonical `{field, direction}`, or the `field:direction` shorthand as a string. */\nfunction toOrderByEntry(raw: unknown, index: number): OrderByEntry {\n    const context = `entry ${index}`;\n    if (typeof raw === \"string\") {\n        // Split here rather than through `deserializeOrderBy`, which is the\n        // *client* end of the codec and normalises anything that is not\n        // literally \"desc\" to \"asc\". Routed through it, `?orderBy=x:DESC`\n        // reached `toDirection` already collapsed to \"asc\" and answered 200\n        // with the rows in the opposite order — a newest-first list showing\n        // the oldest rows — and `x:sideways` did the same. The direction token\n        // has to arrive here raw for `toDirection` to have anything to refuse.\n        const idx = raw.indexOf(\":\");\n        const field = (idx === -1 ? raw : raw.slice(0, idx)).trim();\n        if (!field) invalidOrderBy(`${context} is an empty field name`);\n        if (idx === -1) return { field, direction: \"asc\" };\n        // `field:direction:nulls`. The third segment is optional, so every\n        // `field:desc` written before it existed parses exactly as it did.\n        const rest = raw.slice(idx + 1);\n        const nullsIdx = rest.indexOf(\":\");\n        const direction = toDirection(nullsIdx === -1 ? rest : rest.slice(0, nullsIdx), context);\n        const nulls = nullsIdx === -1 ? undefined : toNulls(rest.slice(nullsIdx + 1), context);\n        return nulls ? { field, direction, nulls } : { field, direction };\n    }\n    if (typeof raw !== \"object\" || raw === null || Array.isArray(raw)) {\n        invalidOrderBy(`${context} is not a field name or a {field, direction} object`);\n    }\n    const entry = raw as Record<string, unknown>;\n    if (typeof entry.field !== \"string\" || entry.field.trim() === \"\") {\n        invalidOrderBy(`${context} has no \\`field\\``);\n    }\n    const nulls = toNulls(entry.nulls, context);\n    const direction = toDirection(entry.direction, context);\n    return nulls ? { field: entry.field, direction, nulls } : { field: entry.field, direction };\n}\n\n/**\n * Parse the `orderBy` query parameter.\n *\n * The field *name* has been validated against the schema for a while — an\n * `?orderBy=titel` is a 400 rather than 200 with unsorted rows, on the grounds\n * that silently dropping the sort leaves the caller believing in an order that\n * is not there. The parameter's *shape* was never checked the same way, and it\n * failed in exactly the same silent manner one layer earlier: whatever\n * `JSON.parse` returned was assigned to an option declared as an array of\n * `{field, direction}`, and the REST layer reads only `orderBy[0].field`. So\n * `?orderBy={\"field\":\"name\"}` — an object rather than an array, and the most\n * natural thing for a client to try — read `undefined`, dropped the ORDER BY,\n * and answered 200. So did a number, a boolean, `null`, and `[\"name\"]`.\n *\n * This refuses those, the way `parseWhereParam` above already refuses a\n * malformed filter and for the same reason. What it keeps working is every\n * shape that worked before: the `field` and `field:desc` shorthands, and the\n * canonical JSON array.\n */\nfunction parseOrderByParam(raw: unknown): OrderByEntry[] | undefined {\n    if (Array.isArray(raw)) {\n        // A repeated query parameter arrives pre-split; treat it as the list.\n        return raw.length === 0 ? undefined : raw.map(toOrderByEntry);\n    }\n\n    const str = String(raw).trim();\n    if (!str) return undefined;\n\n    let parsed: unknown;\n    try {\n        parsed = JSON.parse(str);\n    } catch {\n        // Not JSON at all, so it is the `field:direction` shorthand.\n        return [toOrderByEntry(str, 0)];\n    }\n\n    // `JSON.parse` succeeding says nothing about the shape being usable.\n    if (Array.isArray(parsed)) {\n        if (parsed.length === 0) return undefined;\n        return parsed.map(toOrderByEntry);\n    }\n    if (typeof parsed === \"string\") return [toOrderByEntry(parsed, 0)];\n    if (typeof parsed === \"object\" && parsed !== null) {\n        // A bare `{field, direction}` is a near miss rather than nonsense, but\n        // accepting it would leave two spellings of one parameter. Name it.\n        invalidOrderBy(\"a single object was given where a JSON array was expected\");\n    }\n    invalidOrderBy(`${typeof parsed} is not a field name or a list of them`);\n}\n\n// Re-exported for callers/tests that reference the REST list bounds. The\n// numbers and the rule live in `@rebasepro/types` so the REST parser and the\n// WebSocket ingress enforce ONE shared guarantee. See `resolveClientListLimit`.\nexport { DEFAULT_LIST_LIMIT, DEFAULT_VECTOR_LIST_LIMIT, MAX_LIST_LIMIT } from \"@rebasepro/types\";\n\n/**\n * Overridable list-pagination bounds for {@link parseQueryOptions}. Without\n * these, `GET /<collection>` with no `?limit` would buffer the ENTIRE table\n * into a JS array + JSON response (a trivial OOM/DoS), and `?limit=100000000`\n * would be honoured verbatim.\n */\nexport interface ListLimitOptions {\n    /**\n     * Page size used when the client sends no `?limit`. Applied to plain and\n     * text-search reads — a vector search falls back to its own default (10).\n     */\n    defaultLimit?: number;\n    /** Largest `?limit` a client may ask for. A larger one is a 400, not a clamp. */\n    maxLimit?: number;\n}\n\n/**\n * {@link resolveClientListLimit} for an HTTP route: the same bounds, answered\n * with a 400 rather than a 500.\n *\n * The shared resolver throws a `ListLimitError`, which carries `status` — but\n * the Hono error handler discriminates on `statusCode`, so an unconverted one\n * reaches the client as `INTERNAL_ERROR` with its message stripped, telling the\n * caller nothing about the parameter it got wrong. Every REST list ingress\n * routes its `limit` through here so all of them name the ceiling the same way.\n */\nexport function resolveListLimitParam(\n    rawLimit: number | string | null | undefined,\n    opts: ListLimitBounds & { vectorSearch?: boolean } = {}\n): number {\n    try {\n        return resolveClientListLimit(rawLimit, opts);\n    } catch (e) {\n        if (e instanceof ListLimitError) {\n            throw invalidParam(e.message, \"INVALID_LIMIT\");\n        }\n        throw e;\n    }\n}\n\n/**\n * A whole number at or above `minimum`, or a 400 naming the parameter.\n *\n * `parseInt` was the whole of the validation, and it answers `NaN` for\n * `?offset=abc` and a negative for `?offset=-5`. Neither was checked:\n *\n * - `NaN` reached the driver, where `OFFSET NaN` is a 500 about a syntax error\n *   in a query the caller never wrote;\n * - `?page=0` computed `offset = -limit`, a negative offset, which Postgres\n *   also refuses — and `?page=-3` refused deeper;\n * - `?offset=1.5` truncated silently to `1`, so the caller paged a window they\n *   had not asked for.\n *\n * Every one of those is the caller's parameter, so every one is a 400 named\n * after the parameter — the shape `INVALID_LIMIT` already had, and the reason a\n * limit is *rejected* rather than clamped: a window quietly different from the\n * one asked for cannot be told apart from having reached the end.\n *\n * `expected: true` on the error (via {@link invalidParam}): a mistyped query\n * parameter never reached the database and the response body already says what\n * to fix, so it logs at debug rather than putting a warning in production logs\n * on every request from a client holding a stale link.\n */\nfunction parseWindowParam(raw: unknown, name: string, minimum: number, code: string): number {\n    const text = String(raw).trim();\n    const value = Number(text);\n    if (text === \"\" || !Number.isFinite(value) || !Number.isInteger(value) || value < minimum) {\n        throw invalidParam(\n            `Invalid \\`${name}\\` parameter: expected a whole number ${minimum === 0 ? \"of 0 or more\" : `of ${minimum} or more`}, got ${JSON.stringify(text)}.`,\n            code\n        );\n    }\n    return value;\n}\n\n/**\n * Parse query parameters into QueryOptions\n */\nexport function parseQueryOptions(\n    query: Record<string, unknown>,\n    limits: ListLimitOptions = {},\n    /**\n     * The collection being read and who is reading it. Optional so the parser\n     * stays a pure parser for the callers that have neither (tests, the WS\n     * ingress, anything parsing a query it is not about to run); when present,\n     * a `where`, `orderBy` or `fields` naming a field the caller cannot read is\n     * a 400 rather than a query the driver would happily answer. See\n     * {@link assertQueryFieldsReadable}.\n     */\n    access?: { collection: CollectionConfig; viewer?: FieldViewer }\n): QueryOptions {\n    const options: QueryOptions = {};\n    const rawLimit = getLastValue(query.limit) as number | string | null | undefined;\n\n    // `?deleted=include|only` — soft delete. See `soft-delete-params.ts`.\n    const withDeleted = parseWithDeleted(getLastValue(query[DELETED_QUERY_PARAM]));\n    if (withDeleted !== undefined) options.withDeleted = withDeleted;\n\n    const offsetVal = getLastValue(query.offset);\n    if (offsetVal) options.offset = parseWindowParam(offsetVal, \"offset\", 0, \"INVALID_OFFSET\");\n\n    const pageVal = getLastValue(query.page);\n    if (pageVal) {\n        const page = parseWindowParam(pageVal, \"page\", 1, \"INVALID_PAGE\");\n        // Page stride uses the same bounded page size the read will use, so\n        // pages neither overlap nor gap. (Vector search never paginates by\n        // page, so the plain/text default is correct here.)\n        const limit = resolveListLimitParam(rawLimit, {\n            defaultLimit: limits.defaultLimit,\n            maxLimit: limits.maxLimit\n        });\n        options.offset = (page - 1) * limit;\n    }\n\n    // ── Logical conditions (or / and / not) ────────────────────────────\n    //\n    // `?not=(status.eq.draft,views.gte.10)` negates the **conjunction** of its\n    // conditions: `not(a)` is `NOT a`, `not(a,b)` is `NOT (a AND b)`. The rule\n    // lives on `LogicalCondition` and is applied identically by this parser,\n    // the shared wire codec and every driver compiler — one negation, one\n    // meaning. A group nests, so `?not=(or(a,b))` is the De Morgan case.\n    //\n    // Three parameters and one slot, so exactly one applies. `or` wins over\n    // `and`, and both over `not` — the precedence `or`/`and` already had, with\n    // the third added at the end rather than in the middle, where it would have\n    // silently changed which of two existing parameters was honoured.\n    const orVal = getLastValue(query.or);\n    const andVal = getLastValue(query.and);\n    const notVal = getLastValue(query.not);\n    if (orVal) {\n        const logical = parseLogicalGroup(\"or\", orVal);\n        if (logical) options.logical = logical;\n    } else if (andVal) {\n        const logical = parseLogicalGroup(\"and\", andVal);\n        if (logical) options.logical = logical;\n    } else if (notVal) {\n        const logical = parseLogicalGroup(\"not\", notVal);\n        if (logical) options.logical = logical;\n    }\n\n    // ── PostgREST-style field filters: ?field=op.value ─────────────────\n    // Delegate to the canonical filter dialect (the single source of truth\n    // for the wire grammar: operator codes, list/escape handling, implicit\n    // eq). Values stay strings; the schema-aware driver coerces them to\n    // column types. This keeps the REST path byte-for-byte consistent with\n    // the SDK/admin path, which parses through the same `deserializeFilter`.\n    //\n    // `where` is reserved: it is the JSON filter dialect (see\n    // `parseWhereParam`), not a column named \"where\". Leaving it out of this\n    // list made the documented `?where={...}` compile as a filter on a\n    // nonexistent field — which used to be dropped, widening the read to the\n    // whole table, and is now a 400 `UNKNOWN_FILTER_FIELD`.\n    //\n    // `select` and `groupBy` are reserved for the same reason: on\n    // `/aggregate` they are the request, and left out of this list\n    // `?select=sum(total)` compiles into the filter as a comparison on a\n    // column named \"select\" — a 400 on the one endpoint that requires it.\n    // `not`, `after` and `distinct` join the list for the reason the comment\n    // above gives: a reserved key left out of it compiles as a filter on a\n    // column of that name, which is a 400 `UNKNOWN_FILTER_FIELD` on the one\n    // request that needs the parameter. So do `?deleted=` and `?hard=`, which\n    // ask about the soft-delete stamp rather than name a column.\n    //\n    // The list is shared with the SDK, which sends a filter on a column with\n    // one of these names inside `?where=` rather than as its own parameter.\n    const filterDict: Record<string, unknown> = {};\n    for (const [key, rawValue] of Object.entries(query)) {\n        if (RESERVED_QUERY_KEYS.has(key)) continue;\n        filterDict[key] = rawValue;\n    }\n    // Both dialects may be sent together; an explicit `?field=op.value` wins\n    // over the same field inside `where`, being the more specific request.\n    const whereVal = getLastValue(query.where);\n    const where = {\n        ...(whereVal !== undefined && whereVal !== null ? parseWhereParam(whereVal) : undefined),\n        ...decodeFilter(filterDict)\n    };\n    if (Object.keys(where).length > 0) {\n        options.where = where;\n    }\n\n    // Sorting\n    const orderByVal = getLastValue(query.orderBy);\n    if (orderByVal) {\n        options.orderBy = parseOrderByParam(orderByVal);\n    }\n\n    // ── Relation includes ──────────────────────────────────────────────\n    //\n    // Two spellings on one parameter, told apart by a leading `{`:\n    //\n    //   ?include=author,comments.author        — names and dotted paths\n    //   ?include={\"comments\":{\"limit\":5,\"include\":{\"author\":true}}}\n    //\n    // The flat form is what a human types and what every existing client\n    // sends; the JSON form exists because the flat one has nowhere to put a\n    // per-relation `limit`/`where`/`orderBy`/`fields`, and inventing a\n    // punctuation for those (`comments(limit:5)`) would be a third grammar to\n    // learn beside the two this API already has. Both compile to the same\n    // request — `deserializeInclude` in `@rebasepro/common` is the codec, and\n    // the SDK serialises through its inverse.\n    const includeVal = getLastValue(query.include);\n    if (includeVal !== undefined && includeVal !== null) {\n        try {\n            const include = deserializeInclude(String(includeVal));\n            // Normalized for its *checks* — the depth bound and the shape of a\n            // per-relation options object — and then discarded: what travels on\n            // is the caller's own spelling, which the driver normalizes again\n            // (idempotently) when it reads it. Validating here is what makes a\n            // malformed include a 400 at the boundary rather than an\n            // `IncludeSpecError` escaping from the driver as a 500, which is\n            // what `?include=a.b.c.d` used to answer.\n            normalizeInclude(include);\n            options.include = include;\n        } catch (e) {\n            if (e instanceof IncludeSpecError) throw invalidParam(e.message, e.code);\n            if (e instanceof OrderBySpecError) {\n                throw invalidParam(`Invalid \\`include\\`: ${e.message}`, \"INVALID_INCLUDE\");\n            }\n            throw e;\n        }\n    }\n\n    // Field selection. A projection at the driver, not a trim of the response:\n    // the columns named here are the columns read.\n    const fieldsVal = getLastValue(query.fields);\n    if (fieldsVal) {\n        const fieldsStr = String(fieldsVal).trim();\n        options.fields = fieldsStr.split(\",\").map(s => s.trim()).filter(Boolean);\n    }\n\n    // `?distinct=true` — `SELECT DISTINCT` over the projection. Only `true`\n    // and `1` mean yes; anything else is refused rather than read as \"no\",\n    // because a `?distinct=1&` typo'd into `?distinct=ture` would otherwise\n    // return duplicate rows while looking exactly like it had worked.\n    const distinctVal = getLastValue(query.distinct);\n    if (distinctVal !== undefined && distinctVal !== null && String(distinctVal) !== \"\") {\n        const text = String(distinctVal).trim().toLowerCase();\n        if (text !== \"true\" && text !== \"1\" && text !== \"false\" && text !== \"0\") {\n            throw invalidParam(\n                `Invalid \\`distinct\\` parameter: expected \\`true\\` or \\`false\\`, got ${JSON.stringify(String(distinctVal))}.`,\n                \"INVALID_DISTINCT\"\n            );\n        }\n        options.distinct = text === \"true\" || text === \"1\";\n    }\n\n    // ── Keyset cursor ──────────────────────────────────────────────────\n    //\n    // `?after=<meta.nextCursor>`. Decoded here so a malformed cursor is one\n    // 400 in one place, and so the sort a cursor implies is settled before any\n    // route reads `orderBy`: a request that names no sort adopts the cursor's,\n    // and one that names a different sort is refused rather than seeked in an\n    // order nobody asked for.\n    const afterVal = getLastValue(query.after);\n    if (afterVal !== undefined && afterVal !== null && String(afterVal).trim() !== \"\") {\n        let cursor: DecodedCursor;\n        try {\n            cursor = decodeCursor(String(afterVal));\n        } catch (e) {\n            if (e instanceof CursorError) throw invalidParam(e.message, e.code);\n            throw e;\n        }\n        try {\n            const reconciled = reconcileCursorOrder(cursor, orderByEntriesToTuples(options.orderBy));\n            options.orderBy = reconciled.map(([field, direction, nulls]) =>\n                (nulls ? { field, direction, nulls } : { field, direction }));\n        } catch (e) {\n            if (e instanceof CursorMismatchError) throw invalidParam(e.message, e.code);\n            throw e;\n        }\n        options.cursor = cursor;\n        // A cursor and an offset describe the same window two incompatible\n        // ways, and honouring both would start the page `offset` rows past\n        // where the cursor pointed — a gap the caller cannot see.\n        if (options.offset !== undefined) {\n            throw invalidParam(\n                \"`after` and `offset`/`page` cannot be combined: a cursor already says where the page \"\n                + \"starts, and an offset on top of it skips rows. Use one or the other.\",\n                \"CURSOR_WITH_OFFSET\"\n            );\n        }\n    }\n\n    // ── Vector similarity search ───────────────────────────────────────\n    // Every rejection here is a malformed *request*, so it must carry a 400.\n    // A bare `Error` reaches the handler with no `statusCode` and no known\n    // `code`, which makes it a 500 — logged with a full stack as an incident,\n    // and answered with \"An unexpected error occurred\", because the handler\n    // only forwards a message to the client below 500. The caller was told\n    // nothing about what it got wrong.\n    const vectorSearchVal = getLastValue(query.vector_search);\n    const vectorVal = getLastValue(query.vector);\n    if (vectorSearchVal && vectorVal) {\n        const vectorStr = String(vectorVal);\n        let decoded: unknown;\n        try {\n            decoded = JSON.parse(vectorStr);\n        } catch {\n            decoded = undefined;\n        }\n        // Validated outside the `try` on purpose: inside it, the thrown\n        // ApiError would be caught by its own `catch` and re-thrown as\n        // something else.\n        if (!Array.isArray(decoded) || !decoded.every(v => typeof v === \"number\")) {\n            throw invalidParam(\n                \"Invalid `vector` format. Expected a JSON array of numbers, e.g. [0.1,0.2,0.3]\",\n                \"INVALID_VECTOR\"\n            );\n        }\n        const queryVector = decoded as number[];\n\n        const distanceParamVal = getLastValue(query.vector_distance);\n        const distanceParam = distanceParamVal ? String(distanceParamVal) : \"cosine\";\n        if (distanceParam !== \"cosine\" && distanceParam !== \"l2\" && distanceParam !== \"inner_product\") {\n            throw invalidParam(\n                `Invalid \\`vector_distance\\`: ${distanceParam}. Expected: cosine, l2, or inner_product`,\n                \"INVALID_VECTOR_DISTANCE\"\n            );\n        }\n\n        const vectorSearch: VectorSearchParams = {\n            property: String(vectorSearchVal),\n            vector: queryVector,\n            distance: distanceParam\n        };\n\n        const thresholdVal = getLastValue(query.vector_threshold);\n        if (thresholdVal) {\n            const threshold = parseFloat(String(thresholdVal));\n            if (isNaN(threshold)) {\n                throw invalidParam(\n                    \"Invalid `vector_threshold`. Expected a number.\",\n                    \"INVALID_VECTOR_THRESHOLD\"\n                );\n            }\n            vectorSearch.threshold = threshold;\n        }\n\n        options.vectorSearch = vectorSearch;\n    }\n\n    // Resolve the limit LAST — once we know whether this is a vector search —\n    // so a client-supplied limit above the ceiling is refused with a 400 and an\n    // absent one falls back to the correct mode default (plain/text =\n    // defaultLimit, vector = 10). Without this a bare `GET /<collection>` would\n    // return the whole table. Shared with the WebSocket ingress via\n    // `resolveClientListLimit`.\n    options.limit = resolveListLimitParam(rawLimit, {\n        vectorSearch: !!options.vectorSearch,\n        defaultLimit: limits.defaultLimit,\n        maxLimit: limits.maxLimit\n    });\n\n    // Every field the request named, against what this caller may read. Last,\n    // so a malformed parameter is still answered as malformed rather than as a\n    // permission problem.\n    if (access) assertQueryFieldsReadable(options, access.collection, access.viewer);\n\n    return options;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwCA,SAAgB,cAAc,GAAkD;CAE5E,OAAO,EAAE,OADI,EAAE,IAAI,MACH,CAAA,EAAM,SAAS,WAAW;AAC9C;;AAGA,IAAM,aAAgC,OAAO,OAAO,CAAC,MAAM,CAAC;AAK5D,IAAM,cAAqC;CACvC,QAAQ;CACR,SAAS;CACT,QAAQ;CACR,QAAQ;CACR,SAAS;CACT,eAAe;AACnB;;AAGA,SAAS,eAAe,SAAuC,MAAsB;CACjF,IAAI,CAAC,SAAS,YAAY;CAC1B,KAAK,MAAM,aAAa,QAAQ,YAC5B,IAAI,gBAAgB,WAAW,eAAe,WAA+B,IAAI;MAC5E,IAAK,UAA8B,QAAQ,KAAK,KAAM,UAA8B,MAAM;AAEvG;;;;;;;;;;;AAYA,SAAS,cAAc,OAAmC;CACtD,IAAI,MAAM,WAAW,GAAG,GAAG,OAAO,KAAA;CAClC,IAAI,MAAM,SAAS,GAAG,KAAK,MAAM,SAAS,GAAG,GAAG,OAAO,KAAA;CACvD,OAAO;AACX;;;;;;;;AASA,SAAgB,qBACZ,OACA,YACA,QACA,OACI;CACJ,IAAI,MAAM,WAAW,GAAG;CACxB,MAAM,EAAE,YAAY,qBAAqB,YAAY,QAAQ,MAAM;CACnE,IAAI,QAAQ,SAAS,GAAG;CAExB,MAAM,QAAQ,CAAC,GAAG,IAAI,IAAI,MAAM,QAAQ,MAAmB,MAAM,KAAA,KAAa,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC;CAC9F,IAAI,MAAM,WAAW,GAAG;CAExB,MAAM,SAAS,WACX,GAAG,MAAM,KAAI,MAAK,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,GAAG,MAAM,SAAS,IAAI,QAAQ,KAAK,oBACnE,WAAW,KAAK,wBAAwB,MAAM,SAAS,IAAI,SAAS,KAAK,qBAC7E,YAAY,OAAO,IACtB,sBACA;EACI,YAAY,WAAW;EACvB,QAAQ;EACR,YAAY,MAAM,KAAI,WAAU;GAC5B;GACA,MAAM;GACN,SAAS,IAAI,MAAM;EACvB,EAAE;CACN,CACJ;AACJ;;;;;;;;AASA,SAAgB,0BACZ,SAQA,YACA,QACI;CACJ,MAAM,WAAqB,CAAC;CAC5B,IAAI,QAAQ,OAAO,SAAS,KAAK,GAAG,OAAO,KAAK,QAAQ,KAAK,CAAC;CAC9D,eAAe,QAAQ,SAAS,QAAQ;CACxC,qBAAqB,UAAU,YAAY,QAAQ,QAAQ;CAE3D,sBACK,QAAQ,WAAW,CAAC,EAAA,CAAG,KAAI,UAAS,cAAc,MAAM,KAAK,CAAC,GAC/D,YAAY,QAAQ,SACxB;CAEA,qBAAqB,QAAQ,UAAU,CAAC,GAAG,YAAY,QAAQ,QAAQ;CAKvE,qBACI,QAAQ,eAAe,CAAC,QAAQ,aAAa,QAAQ,IAAI,CAAC,GAC1D,YAAY,QAAQ,eACxB;CAEA,MAAM,UAAU,QAAQ,YAAY,KAAA,IAAY,iBAAiB,QAAQ,OAAO,IAAI,KAAA;CACpF,IAAI,SAAS,4BAA4B,QAAQ,MAAM,YAAY,MAAM;AAC7E;;;;;;;;;;;;;;;AAgBA,SAAS,4BACL,MACA,YACA,QACI;CACJ,MAAM,YAAY,2BAA2B,UAAU;CACvD,KAAK,MAAM,CAAC,KAAK,SAAS,OAAO,QAAQ,IAAI,GAAG;EAC5C,MAAM,WAAW,UAAU;EAC3B,IAAI,CAAC,UAAU;EACf,MAAM,SAAS,SAAS,OAAO;EAC/B,0BAA0B;GACtB,OAAO,KAAK;GACZ,SAAS,KAAK;GACd,SAAS,KAAK,SAAS,KAAK,CAAC,YAAY,EAAE,MAAM,EAAE;GACnD,QAAQ,KAAK;EACjB,GAAG,QAAQ,MAAM;EACjB,4BAA4B,KAAK,UAAU,QAAQ,MAAM;CAC7D;AACJ;;;;;;;;;;;;;;;;;;;;AC3JA,SAAS,aAAa,SAAiB,MAAc,SAA6B;CAC9E,OAAO,IAAI,SAAS,KAAK,MAAM,SAAS,SAAS,IAAI;AACzD;;;;;;;;;;;;;;;;AAiBA,SAAS,aAAa,OAAsD;CACxE,IAAI;EACA,OAAO,kBAAkB,KAAK;CAClC,SAAS,GAAG;EACR,IAAI,aAAa,4BACb,MAAM,aAAa,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO;EAEnD,MAAM;CACV;AACJ;AAEA,SAAS,aAAa,KAAuB;CACzC,IAAI,MAAM,QAAQ,GAAG,GACjB,OAAO,IAAI,IAAI,SAAS;CAE5B,OAAO;AACX;;;;;;;;;;;AAYA,SAAS,kBAAkB,MAA4B,KAA4C;CAC/F,IAAI,QAAQ,OAAO,GAAG,CAAC,CAAC,KAAK;CAC7B,IAAI,MAAM,WAAW,GAAG,KAAK,MAAM,SAAS,GAAG,GAC3C,QAAQ,MAAM,MAAM,GAAG,EAAE;CAE7B,QAAQ,MAAM,KAAK;CACnB,IAAI,CAAC,OAAO,OAAO,KAAA;CACnB,IAAI;CACJ,IAAI;EACA,SAAS,4BAA4B,GAAG,KAAK,GAAG,MAAM,EAAE;CAC5D,SAAS,GAAG;EAKR,MAAM,aACF,aAAa,KAAK,gBAAgB,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC,KAC3E,uBACJ;CACJ;CACA,OAAO,UAAU,SAAS,SAAS,KAAA;AACvC;;;;;;;;;;;;;;;AAgBA,SAAS,gBAAgB,KAAgD;CACrE,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK;CAC7B,IAAI,CAAC,KAAK,OAAO,KAAA;CAEjB,IAAI;CACJ,IAAI;EACA,SAAS,KAAK,MAAM,GAAG;CAC3B,QAAQ;EACJ,MAAM,aACF,4FACA,eACJ;CACJ;CACA,IAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,MAAM,QAAQ,MAAM,GACrE,MAAM,aACF,yHAEA,eACJ;CAGJ,MAAM,SAAS,aAAa,MAAiC;CAC7D,OAAO,OAAO,KAAK,MAAM,CAAC,CAAC,SAAS,IAAI,SAAS,KAAA;AACrD;;;;;;;;;;AAaA,SAAgB,uBAAuB,SAAsD;CACzF,IAAI,CAAC,WAAW,QAAQ,WAAW,GAAG,OAAO,KAAA;CAC7C,OAAO,QAAQ,KAAK,EAAE,OAAO,WAAW,YAAa,QAC/C;EAAC;EAAO;EAAW;CAAK,IACxB,CAAC,OAAO,SAAS,CAAkB;AAC7C;AAEA,SAAS,eAAe,QAAuB;CAC3C,MAAM,aACF,kCAAkC,OAAO,6IAGzC,kBACJ;AACJ;;;;;;;;;AAUA,SAAS,QAAQ,KAAc,SAA6C;CACxE,IAAI,QAAQ,KAAA,KAAa,QAAQ,QAAQ,QAAQ,IAAI,OAAO,KAAA;CAC5D,IAAI,QAAQ,WAAW,QAAQ,QAC3B,eAAe,GAAG,QAAQ,cAAc,OAAO,GAAG,EAAE,EAAE;CAE1D,OAAO;AACX;;AAGA,IAAM,sCAAsB,IAAI,IAAI;CAAC;CAAS;CAAO;CAAO;CAAO;AAAK,CAAC;;;;;;;;;;;;;AAsBzE,SAAgB,qBAAqB,KAA6C;CAC9E,MAAM,QAAQ,aAAa,GAAG;CAC9B,IAAI,CAAC,OAAO,OAAO,KAAA;CAEnB,MAAM,UAAU,OAAO,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,KAAI,MAAK,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,OAAO;CAC1E,IAAI,QAAQ,WAAW,GAAG,OAAO,KAAA;CAEjC,OAAO,QAAQ,KAAK,UAAU;EAC1B,MAAM,QAAQ,uCAAuC,KAAK,KAAK;EAC/D,IAAI,CAAC,OACD,MAAM,aACF,6BAA6B,MAAM,iEACnC,0BACJ;EAGJ,MAAM,KAAK,MAAM,EAAE,CAAC,YAAY;EAChC,MAAM,QAAQ,MAAM,MAAM,KAAA;EAE1B,IAAI,CAAC,oBAAoB,IAAI,EAAE,GAC3B,MAAM,aACF,+BAA+B,GAAG,eAAe,CAAC,GAAG,mBAAmB,CAAC,CAAC,KAAK,IAAI,EAAE,IACrF,4BACJ;EAEJ,IAAI,OAAO,WAAW,CAAC,OAGnB,MAAM,aACF,KAAK,GAAG,6BAA6B,GAAG,4CACxC,0BACJ;EAGJ,OAAO;GACC;GACJ;GACA,OAAO,QAAQ,GAAG,GAAG,GAAG,UAAU;EACtC;CACJ,CAAC;AACL;;AAGA,SAAgB,aAAa,KAAoC;CAC7D,MAAM,QAAQ,aAAa,GAAG;CAC9B,IAAI,CAAC,OAAO,OAAO,KAAA;CACnB,MAAM,SAAS,OAAO,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,KAAI,MAAK,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,OAAO;CACzE,OAAO,OAAO,SAAS,IAAI,SAAS,KAAA;AACxC;;AAGA,SAAS,YAAY,KAAc,SAAiC;CAChE,IAAI,QAAQ,KAAA,KAAa,QAAQ,MAAM,OAAO;CAC9C,IAAI,OAAO,QAAQ,UAAU,eAAe,GAAG,QAAQ,gCAAgC;CACvF,MAAM,UAAU,IAAI,YAAY;CAChC,IAAI,YAAY,SAAS,YAAY,QACjC,eAAe,GAAG,QAAQ,kBAAkB,IAAI,EAAE;CAEtD,OAAO;AACX;;AAGA,SAAS,eAAe,KAAc,OAA6B;CAC/D,MAAM,UAAU,SAAS;CACzB,IAAI,OAAO,QAAQ,UAAU;EAQzB,MAAM,MAAM,IAAI,QAAQ,GAAG;EAC3B,MAAM,SAAS,QAAQ,KAAK,MAAM,IAAI,MAAM,GAAG,GAAG,EAAA,CAAG,KAAK;EAC1D,IAAI,CAAC,OAAO,eAAe,GAAG,QAAQ,wBAAwB;EAC9D,IAAI,QAAQ,IAAI,OAAO;GAAE;GAAO,WAAW;EAAM;EAGjD,MAAM,OAAO,IAAI,MAAM,MAAM,CAAC;EAC9B,MAAM,WAAW,KAAK,QAAQ,GAAG;EACjC,MAAM,YAAY,YAAY,aAAa,KAAK,OAAO,KAAK,MAAM,GAAG,QAAQ,GAAG,OAAO;EACvF,MAAM,QAAQ,aAAa,KAAK,KAAA,IAAY,QAAQ,KAAK,MAAM,WAAW,CAAC,GAAG,OAAO;EACrF,OAAO,QAAQ;GAAE;GAAO;GAAW;EAAM,IAAI;GAAE;GAAO;EAAU;CACpE;CACA,IAAI,OAAO,QAAQ,YAAY,QAAQ,QAAQ,MAAM,QAAQ,GAAG,GAC5D,eAAe,GAAG,QAAQ,oDAAoD;CAElF,MAAM,QAAQ;CACd,IAAI,OAAO,MAAM,UAAU,YAAY,MAAM,MAAM,KAAK,MAAM,IAC1D,eAAe,GAAG,QAAQ,kBAAkB;CAEhD,MAAM,QAAQ,QAAQ,MAAM,OAAO,OAAO;CAC1C,MAAM,YAAY,YAAY,MAAM,WAAW,OAAO;CACtD,OAAO,QAAQ;EAAE,OAAO,MAAM;EAAO;EAAW;CAAM,IAAI;EAAE,OAAO,MAAM;EAAO;CAAU;AAC9F;;;;;;;;;;;;;;;;;;;;AAqBA,SAAS,kBAAkB,KAA0C;CACjE,IAAI,MAAM,QAAQ,GAAG,GAEjB,OAAO,IAAI,WAAW,IAAI,KAAA,IAAY,IAAI,IAAI,cAAc;CAGhE,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK;CAC7B,IAAI,CAAC,KAAK,OAAO,KAAA;CAEjB,IAAI;CACJ,IAAI;EACA,SAAS,KAAK,MAAM,GAAG;CAC3B,QAAQ;EAEJ,OAAO,CAAC,eAAe,KAAK,CAAC,CAAC;CAClC;CAGA,IAAI,MAAM,QAAQ,MAAM,GAAG;EACvB,IAAI,OAAO,WAAW,GAAG,OAAO,KAAA;EAChC,OAAO,OAAO,IAAI,cAAc;CACpC;CACA,IAAI,OAAO,WAAW,UAAU,OAAO,CAAC,eAAe,QAAQ,CAAC,CAAC;CACjE,IAAI,OAAO,WAAW,YAAY,WAAW,MAGzC,eAAe,2DAA2D;CAE9E,eAAe,GAAG,OAAO,OAAO,uCAAuC;AAC3E;;;;;;;;;;;AAiCA,SAAgB,sBACZ,UACA,OAAqD,CAAC,GAChD;CACN,IAAI;EACA,OAAO,uBAAuB,UAAU,IAAI;CAChD,SAAS,GAAG;EACR,IAAI,aAAa,gBACb,MAAM,aAAa,EAAE,SAAS,eAAe;EAEjD,MAAM;CACV;AACJ;;;;;;;;;;;;;;;;;;;;;;;;AAyBA,SAAS,iBAAiB,KAAc,MAAc,SAAiB,MAAsB;CACzF,MAAM,OAAO,OAAO,GAAG,CAAC,CAAC,KAAK;CAC9B,MAAM,QAAQ,OAAO,IAAI;CACzB,IAAI,SAAS,MAAM,CAAC,OAAO,SAAS,KAAK,KAAK,CAAC,OAAO,UAAU,KAAK,KAAK,QAAQ,SAC9E,MAAM,aACF,aAAa,KAAK,wCAAwC,YAAY,IAAI,iBAAiB,MAAM,QAAQ,UAAU,QAAQ,KAAK,UAAU,IAAI,EAAE,IAChJ,IACJ;CAEJ,OAAO;AACX;;;;AAKA,SAAgB,kBACZ,OACA,SAA2B,CAAC,GAS5B,QACY;CACZ,MAAM,UAAwB,CAAC;CAC/B,MAAM,WAAW,aAAa,MAAM,KAAK;CAGzC,MAAM,cAAc,iBAAiB,aAAa,MAAM,oBAAoB,CAAC;CAC7E,IAAI,gBAAgB,KAAA,GAAW,QAAQ,cAAc;CAErD,MAAM,YAAY,aAAa,MAAM,MAAM;CAC3C,IAAI,WAAW,QAAQ,SAAS,iBAAiB,WAAW,UAAU,GAAG,gBAAgB;CAEzF,MAAM,UAAU,aAAa,MAAM,IAAI;CACvC,IAAI,SAAS;EACT,MAAM,OAAO,iBAAiB,SAAS,QAAQ,GAAG,cAAc;EAIhE,MAAM,QAAQ,sBAAsB,UAAU;GAC1C,cAAc,OAAO;GACrB,UAAU,OAAO;EACrB,CAAC;EACD,QAAQ,UAAU,OAAO,KAAK;CAClC;CAcA,MAAM,QAAQ,aAAa,MAAM,EAAE;CACnC,MAAM,SAAS,aAAa,MAAM,GAAG;CACrC,MAAM,SAAS,aAAa,MAAM,GAAG;CACrC,IAAI,OAAO;EACP,MAAM,UAAU,kBAAkB,MAAM,KAAK;EAC7C,IAAI,SAAS,QAAQ,UAAU;CACnC,OAAO,IAAI,QAAQ;EACf,MAAM,UAAU,kBAAkB,OAAO,MAAM;EAC/C,IAAI,SAAS,QAAQ,UAAU;CACnC,OAAO,IAAI,QAAQ;EACf,MAAM,UAAU,kBAAkB,OAAO,MAAM;EAC/C,IAAI,SAAS,QAAQ,UAAU;CACnC;CA2BA,MAAM,aAAsC,CAAC;CAC7C,KAAK,MAAM,CAAC,KAAK,aAAa,OAAO,QAAQ,KAAK,GAAG;EACjD,IAAI,oBAAoB,IAAI,GAAG,GAAG;EAClC,WAAW,OAAO;CACtB;CAGA,MAAM,WAAW,aAAa,MAAM,KAAK;CACzC,MAAM,QAAQ;EACV,GAAI,aAAa,KAAA,KAAa,aAAa,OAAO,gBAAgB,QAAQ,IAAI,KAAA;EAC9E,GAAG,aAAa,UAAU;CAC9B;CACA,IAAI,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,GAC5B,QAAQ,QAAQ;CAIpB,MAAM,aAAa,aAAa,MAAM,OAAO;CAC7C,IAAI,YACA,QAAQ,UAAU,kBAAkB,UAAU;CAiBlD,MAAM,aAAa,aAAa,MAAM,OAAO;CAC7C,IAAI,eAAe,KAAA,KAAa,eAAe,MAC3C,IAAI;EACA,MAAM,UAAU,mBAAmB,OAAO,UAAU,CAAC;EAQrD,iBAAiB,OAAO;EACxB,QAAQ,UAAU;CACtB,SAAS,GAAG;EACR,IAAI,aAAa,kBAAkB,MAAM,aAAa,EAAE,SAAS,EAAE,IAAI;EACvE,IAAI,aAAa,kBACb,MAAM,aAAa,wBAAwB,EAAE,WAAW,iBAAiB;EAE7E,MAAM;CACV;CAKJ,MAAM,YAAY,aAAa,MAAM,MAAM;CAC3C,IAAI,WAEA,QAAQ,SADU,OAAO,SAAS,CAAC,CAAC,KACnB,CAAA,CAAU,MAAM,GAAG,CAAC,CAAC,KAAI,MAAK,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,OAAO;CAO3E,MAAM,cAAc,aAAa,MAAM,QAAQ;CAC/C,IAAI,gBAAgB,KAAA,KAAa,gBAAgB,QAAQ,OAAO,WAAW,MAAM,IAAI;EACjF,MAAM,OAAO,OAAO,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,YAAY;EACpD,IAAI,SAAS,UAAU,SAAS,OAAO,SAAS,WAAW,SAAS,KAChE,MAAM,aACF,uEAAuE,KAAK,UAAU,OAAO,WAAW,CAAC,EAAE,IAC3G,kBACJ;EAEJ,QAAQ,WAAW,SAAS,UAAU,SAAS;CACnD;CASA,MAAM,WAAW,aAAa,MAAM,KAAK;CACzC,IAAI,aAAa,KAAA,KAAa,aAAa,QAAQ,OAAO,QAAQ,CAAC,CAAC,KAAK,MAAM,IAAI;EAC/E,IAAI;EACJ,IAAI;GACA,SAAS,aAAa,OAAO,QAAQ,CAAC;EAC1C,SAAS,GAAG;GACR,IAAI,aAAa,aAAa,MAAM,aAAa,EAAE,SAAS,EAAE,IAAI;GAClE,MAAM;EACV;EACA,IAAI;GAEA,QAAQ,UADW,qBAAqB,QAAQ,uBAAuB,QAAQ,OAAO,CACpE,CAAA,CAAW,KAAK,CAAC,OAAO,WAAW,WAChD,QAAQ;IAAE;IAAO;IAAW;GAAM,IAAI;IAAE;IAAO;GAAU,CAAE;EACpE,SAAS,GAAG;GACR,IAAI,aAAa,qBAAqB,MAAM,aAAa,EAAE,SAAS,EAAE,IAAI;GAC1E,MAAM;EACV;EACA,QAAQ,SAAS;EAIjB,IAAI,QAAQ,WAAW,KAAA,GACnB,MAAM,aACF,6JAEA,oBACJ;CAER;CASA,MAAM,kBAAkB,aAAa,MAAM,aAAa;CACxD,MAAM,YAAY,aAAa,MAAM,MAAM;CAC3C,IAAI,mBAAmB,WAAW;EAC9B,MAAM,YAAY,OAAO,SAAS;EAClC,IAAI;EACJ,IAAI;GACA,UAAU,KAAK,MAAM,SAAS;EAClC,QAAQ;GACJ,UAAU,KAAA;EACd;EAIA,IAAI,CAAC,MAAM,QAAQ,OAAO,KAAK,CAAC,QAAQ,OAAM,MAAK,OAAO,MAAM,QAAQ,GACpE,MAAM,aACF,iFACA,gBACJ;EAEJ,MAAM,cAAc;EAEpB,MAAM,mBAAmB,aAAa,MAAM,eAAe;EAC3D,MAAM,gBAAgB,mBAAmB,OAAO,gBAAgB,IAAI;EACpE,IAAI,kBAAkB,YAAY,kBAAkB,QAAQ,kBAAkB,iBAC1E,MAAM,aACF,gCAAgC,cAAc,2CAC9C,yBACJ;EAGJ,MAAM,eAAmC;GACrC,UAAU,OAAO,eAAe;GAChC,QAAQ;GACR,UAAU;EACd;EAEA,MAAM,eAAe,aAAa,MAAM,gBAAgB;EACxD,IAAI,cAAc;GACd,MAAM,YAAY,WAAW,OAAO,YAAY,CAAC;GACjD,IAAI,MAAM,SAAS,GACf,MAAM,aACF,kDACA,0BACJ;GAEJ,aAAa,YAAY;EAC7B;EAEA,QAAQ,eAAe;CAC3B;CAQA,QAAQ,QAAQ,sBAAsB,UAAU;EAC5C,cAAc,CAAC,CAAC,QAAQ;EACxB,cAAc,OAAO;EACrB,UAAU,OAAO;CACrB,CAAC;CAKD,IAAI,QAAQ,0BAA0B,SAAS,OAAO,YAAY,OAAO,MAAM;CAE/E,OAAO;AACX"}

package/dist/request-timeout-DgH7j8qO.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"request-timeout-DgH7j8qO.js","names":[],"sources":["../src/functions/request-timeout.ts"],"sourcesContent":["import type { MiddlewareHandler } from \"hono\";\nimport type { HonoEnv } from \"../api/types\";\nimport { logger } from \"../utils/logger\";\nimport { ApiError, errorHandler } from \"../api/errors\";\n\n/** Default ceiling for a custom function request, in milliseconds. */\nexport const DEFAULT_FUNCTIONS_TIMEOUT_MS = 30_000;\n\n/**\n * Resolve the functions request timeout from config, then env, then the default.\n *\n * `0` (or any non-positive number) disables the ceiling — for a deployment\n * whose proxy already imposes one, or a function that legitimately streams for\n * minutes.\n */\nexport function resolveFunctionsTimeoutMs(configured?: number): number {\n    if (typeof configured === \"number\" && Number.isFinite(configured)) {\n        return Math.max(0, Math.floor(configured));\n    }\n    // Blank means unset, not zero. `Number(\"\")` and `Number(\" \")` are both 0,\n    // and 0 here means \"no ceiling\" — so a compose file with\n    // `REBASE_FUNCTIONS_TIMEOUT_MS=${SOMETHING}` and `SOMETHING` undefined, or\n    // a `.env` line with the name and no value, silently switched off the one\n    // bound on how long code the framework did not write may hold a socket.\n    // Declaring a variable without setting it is the ordinary way to write\n    // both of those files, and the failure is invisible: nothing logs, and the\n    // deployment behaves exactly as it did before the ceiling existed.\n    const raw = process.env.REBASE_FUNCTIONS_TIMEOUT_MS?.trim();\n    if (raw) {\n        const fromEnv = Number(raw);\n        if (Number.isFinite(fromEnv) && fromEnv >= 0) {\n            return Math.floor(fromEnv);\n        }\n    }\n    return DEFAULT_FUNCTIONS_TIMEOUT_MS;\n}\n\n/**\n * A per-request ceiling for the custom functions router.\n *\n * Custom functions are the one router that runs code the framework did not\n * write, and nothing else in the stack bounds how long that code takes: the\n * Node server is constructed without `requestTimeout`/`headersTimeout`, so a\n * handler awaiting a promise that never settles — a `fetch` to an unreachable\n * third party with no `AbortSignal`, a query on a wedged connection — holds its\n * socket and its request object until the client gives up. On the managed\n * runtime the process is shared between tenants, so that is not only the slow\n * caller's problem.\n *\n * The handler is **not** cancelled — it cannot be, there is no cancellation\n * token to hand user code. What is bounded is the client-visible request: after\n * `ms` the caller gets a 504 and the socket is released, and the handler's\n * eventual result is dropped. It is a ceiling, not a kill switch, and the exact\n * number matters far less than its existence.\n *\n * \"The handler keeps running\" is a **Node** guarantee, not a property of the\n * contract. It follows from the process outliving the request, which is not\n * true on an isolate-based host: there, work still in flight when the response\n * resolves is terminated rather than orphaned. So a handler must not depend on\n * finishing after its 504 — anything that has to complete belongs in\n * `waitUntil()`, which is the one construct both hosts honour. See\n * `./wait-until.ts`.\n *\n * Mounted in front of the auth middleware rather than behind it, so a wedged\n * driver — the failure that also hangs `withAuth()` — is covered too.\n */\nexport function createFunctionsRequestTimeout(ms: number): MiddlewareHandler<HonoEnv> {\n    return async (c, next) => {\n        if (ms <= 0) return next();\n\n        let timer: ReturnType<typeof setTimeout> | undefined;\n        const timedOut = new Promise<\"timeout\">((resolve) => {\n            timer = setTimeout(() => resolve(\"timeout\"), ms);\n        });\n\n        try {\n            const outcome = await Promise.race([next().then(() => \"done\" as const), timedOut]);\n            if (outcome === \"timeout\") {\n                logger.warn(\n                    `[functions] ${c.req.method} ${c.req.path} exceeded the ${ms}ms request timeout — ` +\n                    \"answering 504. The handler is still running; it cannot be cancelled from here. \" +\n                    \"Give outbound calls an AbortSignal, or raise `functionsTimeoutMs` / REBASE_FUNCTIONS_TIMEOUT_MS.\"\n                );\n                // Through `errorHandler`, not `c.json`: that is what puts the\n                // `requestId` in the body and hands the outcome to the request\n                // log, so the Studio Logs entry for a timeout carries\n                // `errorCode` like every other failure. Hand-built, it was the\n                // one 504 nobody could join to a log line.\n                return errorHandler(\n                    new ApiError(504, \"FUNCTION_TIMEOUT\", \"Function timed out\"),\n                    c\n                ) as Response;\n            }\n        } finally {\n            if (timer) clearTimeout(timer);\n        }\n        return undefined;\n    };\n}\n"],"mappings":";;;;;;;;;;;;;;AAMA,IAAa,+BAA+B;;;;;;;;AAS5C,SAAgB,0BAA0B,YAA6B;CACnE,IAAI,OAAO,eAAe,YAAY,OAAO,SAAS,UAAU,GAC5D,OAAO,KAAK,IAAI,GAAG,KAAK,MAAM,UAAU,CAAC;CAU7C,MAAM,MAAM,QAAQ,IAAI,6BAA6B,KAAK;CAC1D,IAAI,KAAK;EACL,MAAM,UAAU,OAAO,GAAG;EAC1B,IAAI,OAAO,SAAS,OAAO,KAAK,WAAW,GACvC,OAAO,KAAK,MAAM,OAAO;CAEjC;CACA,OAAO;AACX;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BA,SAAgB,8BAA8B,IAAwC;CAClF,OAAO,OAAO,GAAG,SAAS;EACtB,IAAI,MAAM,GAAG,OAAO,KAAK;EAEzB,IAAI;EACJ,MAAM,WAAW,IAAI,SAAoB,YAAY;GACjD,QAAQ,iBAAiB,QAAQ,SAAS,GAAG,EAAE;EACnD,CAAC;EAED,IAAI;GAEA,IAAI,MADkB,QAAQ,KAAK,CAAC,KAAK,CAAC,CAAC,WAAW,MAAe,GAAG,QAAQ,CAAC,MACjE,WAAW;IACvB,OAAO,KACH,eAAe,EAAE,IAAI,OAAO,GAAG,EAAE,IAAI,KAAK,gBAAgB,GAAG,uMAGjE;IAMA,OAAO,aACH,IAAI,SAAS,KAAK,oBAAoB,oBAAoB,GAC1D,CACJ;GACJ;EACJ,UAAU;GACN,IAAI,OAAO,aAAa,KAAK;EACjC;CAEJ;AACJ"}