@agent-team-foundation/first-tree-hub 0.8.4 → 0.8.6

package/dist/{core-VW2Qfs73.mjs → core-e1-NPfEC.mjs}

@@ -1,9 +1,9 @@
-import { m as __toESM } from "./esm-CYu4tXXn.mjs";
+import { f as __require, l as __commonJSMin, m as __toESM } from "./esm-CYu4tXXn.mjs";
 import { C as setConfigValue, S as serverConfigSchema, _ as loadAgents, d as DEFAULT_HOME_DIR$1, f as agentConfigSchema, g as initConfig, i as loadCredentials, l as DEFAULT_CONFIG_DIR, m as collectMissingPrompts, n as ensureFreshAccessToken, o as resolveServerUrl, p as clientConfigSchema, s as saveAgentConfig, u as DEFAULT_DATA_DIR$1, x as resolveConfigReadonly } from "./bootstrap-99vUYmLs.mjs";
 import { _ as withSpan, a as endWsConnectionSpan, b as require_pino, c as messageAttrs, d as rootLogger$1, g as startWsConnectionSpan, i as currentTraceId, n as applyLoggerConfig, o as getFastifyOtelPlugin, p as setWsConnectionAttrs, r as createLogger, t as adapterAttrs, u as observabilityPlugin, v as withWsMessageSpan, y as FIRST_TREE_HUB_ATTR } from "./observability-CJzDFY_G-CmvgUuzc.mjs";
-import { $ as updateAgentRuntimeConfigSchema, A as createMemberSchema, B as notificationQuerySchema, C as agentTypeSchema$1, D as createAdapterMappingSchema, E as createAdapterConfigSchema, F as inboxPollQuerySchema, G as sendMessageSchema, H as refreshTokenSchema, I as isRedactedEnvValue, J as sessionEventMessageSchema, K as sendToAgentSchema, L as linkTaskChatSchema, M as createTaskSchema, N as delegateFeishuUserSchema, O as createAgentSchema, P as dryRunAgentRuntimeConfigSchema, Q as updateAdapterConfigSchema, R as loginSchema, S as agentRuntimeConfigPayloadSchema$1, T as connectTokenExchangeSchema, U as runtimeStateMessageSchema, V as paginationQuerySchema, W as selfServiceFeishuBotSchema, X as sessionStateMessageSchema, Y as sessionEventSchema$1, Z as taskListQuerySchema, _ as addParticipantSchema, a as AGENT_SELECTOR_HEADER$1, at as wsAuthFrameSchema, b as agentBindRequestSchema, c as AGENT_TYPES, d as SYSTEM_CONFIG_DEFAULTS, et as updateAgentSchema, f as TASK_CREATOR_TYPES, g as WS_AUTH_FRAME_TIMEOUT_MS, h as TASK_TERMINAL_STATUSES, i as AGENT_BIND_REJECT_REASONS, it as updateTaskStatusSchema, j as createOrganizationSchema, k as createChatSchema, l as AGENT_VISIBILITY, m as TASK_STATUSES, nt as updateOrganizationSchema, o as AGENT_SOURCES, p as TASK_HEALTH_SIGNALS, q as sessionCompletionMessageSchema, rt as updateSystemConfigSchema, s as AGENT_STATUSES, tt as updateMemberSchema, u as DEFAULT_AGENT_RUNTIME_CONFIG_PAYLOAD, v as adminCreateTaskSchema, w as clientRegisterSchema, x as agentPinnedMessageSchema$1, y as adminUpdateTaskSchema, z as messageSourceSchema$1 } from "./feishu-OezhDY7x.mjs";
-import { copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, watch, writeFileSync } from "node:fs";
-import { dirname, isAbsolute, join, resolve } from "node:path";
+import { $ as updateAdapterConfigSchema, A as createMemberSchema, B as notificationQuerySchema, C as agentTypeSchema$1, D as createAdapterMappingSchema, E as createAdapterConfigSchema, F as inboxPollQuerySchema, G as sendMessageSchema, H as refreshTokenSchema, I as isRedactedEnvValue, J as sessionEventMessageSchema, K as sendToAgentSchema, L as linkTaskChatSchema, M as createTaskSchema, N as delegateFeishuUserSchema, O as createAgentSchema, P as dryRunAgentRuntimeConfigSchema, Q as taskListQuerySchema, R as loginSchema, S as agentRuntimeConfigPayloadSchema$1, T as connectTokenExchangeSchema, U as runtimeStateMessageSchema, V as paginationQuerySchema, W as selfServiceFeishuBotSchema, X as sessionReconcileRequestSchema, Y as sessionEventSchema$1, Z as sessionStateMessageSchema, _ as addParticipantSchema, a as AGENT_SELECTOR_HEADER$1, at as updateSystemConfigSchema, b as agentBindRequestSchema, c as AGENT_TYPES, d as SYSTEM_CONFIG_DEFAULTS, et as updateAgentRuntimeConfigSchema, f as TASK_CREATOR_TYPES, g as WS_AUTH_FRAME_TIMEOUT_MS, h as TASK_TERMINAL_STATUSES, i as AGENT_BIND_REJECT_REASONS, it as updateOrganizationSchema, j as createOrganizationSchema, k as createChatSchema, l as AGENT_VISIBILITY, m as TASK_STATUSES, nt as updateChatSchema, o as AGENT_SOURCES, ot as updateTaskStatusSchema, p as TASK_HEALTH_SIGNALS, q as sessionCompletionMessageSchema, rt as updateMemberSchema, s as AGENT_STATUSES, st as wsAuthFrameSchema, tt as updateAgentSchema, u as DEFAULT_AGENT_RUNTIME_CONFIG_PAYLOAD, v as adminCreateTaskSchema, w as clientRegisterSchema, x as agentPinnedMessageSchema$1, y as adminUpdateTaskSchema, z as messageSourceSchema$1 } from "./feishu-n9Y2yGTT.mjs";
+import { copyFileSync, createReadStream, createWriteStream, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, unlinkSync, watch, writeFileSync } from "node:fs";
+import { dirname, extname, isAbsolute, join, resolve } from "node:path";
 import { ZodError, z } from "zod";
 import { Writable } from "node:stream";
 import { stringify } from "yaml";
@@ -230,14 +230,16 @@ const runtimeStateSchema = z.enum([
 	"blocked",
 	"error"
 ]);
-const sessionStateSchema = z.enum([
+z.enum([
 	"active",
 	"suspended",
 	"evicted"
 ]);
+/** Wire-level states a client may report. `evicted` from a stale client is rejected. */
+const clientSessionStateSchema = z.enum(["active", "suspended"]);
 z.object({
 	chatId: z.string().min(1),
-	state: sessionStateSchema
+	state: clientSessionStateSchema
 });
 z.object({ runtimeState: runtimeStateSchema });
 z.object({
@@ -526,6 +528,7 @@ z.object({
 	createdAt: z.string(),
 	updatedAt: z.string()
 }).extend({ participants: z.array(chatParticipantSchema) });
+z.object({ topic: z.string().trim().max(500).nullable() });
 z.object({
 	agentId: z.string().min(1),
 	mode: z.enum(["full", "mention_only"]).default("full")
@@ -641,7 +644,10 @@ z.object({
 	displayName: z.string().min(1).max(200),
 	role: memberRoleSchema.default("member")
 });
-z.object({ role: memberRoleSchema.optional() });
+z.object({
+	role: memberRoleSchema.optional(),
+	displayName: z.string().min(1).max(200).optional()
+});
 memberSchema.extend({
 	username: z.string(),
 	displayName: z.string(),
@@ -807,6 +813,16 @@ z.object({
 	agentId: z.string(),
 	chatId: z.string()
 });
+z.object({
+	type: z.literal("session:reconcile"),
+	agentId: z.string().min(1),
+	chatIds: z.array(z.string().min(1)).max(500)
+});
+z.object({
+	type: z.literal("session:reconcile:result"),
+	agentId: z.string().min(1),
+	staleChatIds: z.array(z.string().min(1))
+});
 const orgStatsSchema = z.object({
 	organizationId: z.string(),
 	agentCount: z.number(),
@@ -1195,6 +1211,15 @@ var ClientConnection = class extends EventEmitter {
 			chatId
 		}));
 	}
+	/** Ask the server which of the supplied chatIds the client should drop. */
+	sendSessionReconcile(agentId, chatIds) {
+		if (!this.ws || this.ws.readyState !== WebSocket.OPEN) return;
+		this.ws.send(JSON.stringify({
+			type: "session:reconcile",
+			agentId,
+			chatIds
+		}));
+	}
 	async disconnect() {
 		this.closing = true;
 		this.clearTimers();
@@ -1372,7 +1397,7 @@ var ClientConnection = class extends EventEmitter {
 			}
 			return;
 		}
-		if (type === "session:suspend" || type === "session:resume" || type === "session:terminate") {
+		if (type === "session:suspend" || type === "session:terminate") {
 			const agentId = msg.agentId;
 			const chatId = msg.chatId;
 			if (agentId && chatId) this.emit("session:command", {
@@ -1382,6 +1407,15 @@ var ClientConnection = class extends EventEmitter {
 			});
 			return;
 		}
+		if (type === "session:reconcile:result") {
+			const agentId = msg.agentId;
+			const staleChatIds = Array.isArray(msg.staleChatIds) ? msg.staleChatIds : null;
+			if (agentId && staleChatIds) this.emit("session:reconcile:result", {
+				agentId,
+				staleChatIds
+			});
+			return;
+		}
 		if (type === "new_message") {
 			const inboxId = msg.inboxId;
 			if (inboxId) this.emit("agent:message", inboxId, msg);
@@ -3134,39 +3168,49 @@ var SessionManager = class {
 		const message = this.extractMessage(entry);
 		await this.routeMessage(chatId, message, entry.id);
 	}
-	/** Handle a session command from the server (suspend/resume/terminate). */
+	/** Handle a server-issued session command. Terminate drops all local state without reporting back. */
 	async handleCommand(chatId, command) {
-		const session = this.sessions.get(chatId);
 		if (command === "session:suspend") {
+			const session = this.sessions.get(chatId);
 			if (session?.status === "active") {
 				this.config.log(`Session ${chatId}: suspend command received`);
 				this.suspendSession(session);
 			}
-		} else if (command === "session:resume") {
-			if (session?.status === "suspended") {
-				this.config.log(`Session ${chatId}: resume command received`);
-				await this.resumeSession(session, null);
-			}
-		} else if (command === "session:terminate") {
-			if (session) {
-				this.config.log(`Session ${chatId}: terminate command received`);
-				if (session.status === "active") {
-					this._activeCount--;
-					await session.handler.shutdown();
-				}
-				this.addEvictedMapping(chatId, {
-					claudeSessionId: session.claudeSessionId,
-					lastActivity: session.lastActivity
-				});
-				this.sessions.delete(chatId);
-				this.sessionRuntimeStates.delete(chatId);
-				this.recomputeRuntimeState();
-				this.notifySessionState(chatId, "evicted");
-				this.persistRegistry();
-				this.drainPendingQueue();
+			return;
+		}
+		if (command === "session:terminate") {
+			const session = this.sessions.get(chatId);
+			const hadMapping = this.evictedMappings.has(chatId);
+			if (!session && !hadMapping) return;
+			this.config.log(`Session ${chatId}: terminate command received`);
+			if (session?.status === "active") {
+				this._activeCount--;
+				await session.handler.shutdown().catch(() => {});
 			}
+			this.sessions.delete(chatId);
+			this.evictedMappings.delete(chatId);
+			this.sessionRuntimeStates.delete(chatId);
+			this.lastReportedStates.delete(chatId);
+			for (let i = this.pendingQueue.length - 1; i >= 0; i--) if (this.pendingQueue[i]?.chatId === chatId) this.pendingQueue.splice(i, 1);
+			this.recomputeRuntimeState();
+			this.persistRegistry();
+			this.drainPendingQueue();
 		}
 	}
+	/** Chat IDs this client still holds locally (sessions + evictedMappings). */
+	getHeldChatIds() {
+		const ids = /* @__PURE__ */ new Set();
+		for (const id of this.sessions.keys()) ids.add(id);
+		for (const id of this.evictedMappings.keys()) ids.add(id);
+		return [...ids];
+	}
+	/**
+	* Apply a server-declared stale list from `session:reconcile:result` — treat
+	* each chatId as if a `session:terminate` command had arrived.
+	*/
+	applyStaleChatIds(staleChatIds) {
+		for (const id of staleChatIds) this.handleCommand(id, "session:terminate");
+	}
 	/** Shut down all sessions gracefully. */
 	async shutdown() {
 		if (this.idleTimer) {
@@ -3367,8 +3411,6 @@ var SessionManager = class {
 				this._activeCount--;
 				candidate.session.handler.shutdown().catch(() => {});
 			}
-			candidate.session.status = "evicted";
-			this.notifySessionState(candidate.key, "evicted");
 			this.sessions.delete(candidate.key);
 			this.sessionRuntimeStates.delete(candidate.key);
 			this.recomputeRuntimeState();
@@ -3505,6 +3547,7 @@ var AgentSlot = class {
 	sdk = null;
 	agentConfigCache = null;
 	pollingTimer = null;
+	reconcileTimer = null;
 	listeners = [];
 	constructor(config) {
 		this.config = config;
@@ -3540,16 +3583,26 @@ var AgentSlot = class {
 			if (agentId === this.config.agentId) this.pullAndDispatch();
 		};
 		const onBound = (boundAgent) => {
-			if (boundAgent.agentId === this.config.agentId) this.fullStateSync();
+			if (boundAgent.agentId === this.config.agentId) {
+				this.fullStateSync();
+				setTimeout(() => this.reconcileNow(), 5e3);
+			}
+		};
+		const onReconcileResult = (result) => {
+			if (result.agentId === this.config.agentId && this.sessionManager) this.sessionManager.applyStaleChatIds(result.staleChatIds);
 		};
 		this.clientConnection.on("agent:message", onMessage);
 		this.clientConnection.on("agent:bound", onBound);
+		this.clientConnection.on("session:reconcile:result", onReconcileResult);
 		this.listeners.push({
 			event: "agent:message",
 			fn: onMessage
 		}, {
 			event: "agent:bound",
 			fn: onBound
+		}, {
+			event: "session:reconcile:result",
+			fn: onReconcileResult
 		});
 		const registryPath = join(DEFAULT_DATA_DIR, "sessions", `${this.config.name}.json`);
 		const gitMirrorManager = createGitMirrorManager({
@@ -3592,6 +3645,7 @@ var AgentSlot = class {
 			fn: onCommand
 		});
 		this.startPolling();
+		this.startReconcileLoop();
 		return agent;
 	}
 	async stop() {
@@ -3599,8 +3653,13 @@ var AgentSlot = class {
 			clearInterval(this.pollingTimer);
 			this.pollingTimer = null;
 		}
+		if (this.reconcileTimer) {
+			clearInterval(this.reconcileTimer);
+			this.reconcileTimer = null;
+		}
 		for (const entry of this.listeners) if (entry.event === "agent:message") this.clientConnection.off(entry.event, entry.fn);
 		else if (entry.event === "agent:bound") this.clientConnection.off(entry.event, entry.fn);
+		else if (entry.event === "session:reconcile:result") this.clientConnection.off(entry.event, entry.fn);
 		else this.clientConnection.off(entry.event, entry.fn);
 		this.listeners = [];
 		await this.clientConnection.unbindAgent(this.config.agentId);
@@ -3631,6 +3690,16 @@ var AgentSlot = class {
 		}, 5e3);
 		this.pullAndDispatch();
 	}
+	startReconcileLoop() {
+		const intervalSec = this.config.session.reconcile_interval_seconds ?? 300;
+		this.reconcileTimer = setInterval(() => this.reconcileNow(), intervalSec * 1e3);
+	}
+	reconcileNow() {
+		if (!this.sessionManager) return;
+		const chatIds = this.sessionManager.getHeldChatIds();
+		if (chatIds.length === 0) return;
+		this.clientConnection.sendSessionReconcile(this.config.agentId, chatIds);
+	}
 	async pullAndDispatch() {
 		if (!this.sdk || !this.sessionManager) return;
 		try {
@@ -3659,7 +3728,8 @@ z.object({
 }).passthrough();
 const sessionConfigSchema = z.object({
 	idle_timeout: z.number().int().positive().default(IDLE_TIMEOUT_MS / 1e3),
-	max_sessions: z.number().int().positive().default(50)
+	max_sessions: z.number().int().positive().default(50),
+	reconcile_interval_seconds: z.number().int().min(30).max(3600).default(300)
 }).passthrough();
 const agentSlotConfigSchema = z.object({
 	agentId: z.string().min(1),
@@ -3808,7 +3878,8 @@ var ClientRuntime = class {
 			handlerFactory,
 			session: {
 				idle_timeout: config.session.idle_timeout,
-				max_sessions: config.session.max_sessions
+				max_sessions: config.session.max_sessions,
+				reconcile_interval_seconds: 300
 			},
 			concurrency: config.concurrency,
 			clientConnection: this.connection
@@ -4602,7 +4673,7 @@ async function onboardCreate(args) {
 	}
 	const runtimeAgent = args.type === "human" ? args.assistant : args.id;
 	if (args.feishuBotAppId && args.feishuBotAppSecret) {
-		const { bindFeishuBot } = await import("./feishu-OezhDY7x.mjs").then((n) => n.r);
+		const { bindFeishuBot } = await import("./feishu-n9Y2yGTT.mjs").then((n) => n.r);
 		const targetAgentUuid = args.type === "human" ? assistantUuid : primary.uuid;
 		if (!targetAgentUuid) process.stderr.write(`Warning: Cannot bind Feishu bot — no runtime agent available for "${args.id}".\n`);
 		else {
@@ -4675,75 +4746,2781 @@ async function promptMissingFields(options) {
 			setNestedByDot(results, dotPath, value);
 		}
 	}
-	return results;
-}
-/**
-* Interactive add agent — simple two-field prompt.
-*/
-async function promptAddAgent() {
-	return {
-		name: await input({
-			message: "Local alias:",
-			validate: (v) => /^[a-z0-9][a-z0-9-]*$/.test(v) ? true : "Lowercase alphanumeric and hyphens only"
-		}),
-		agentId: await input({
-			message: "Agent UUID on the Hub:",
-			validate: (v) => v.length > 0 ? true : "Agent UUID is required"
-		})
-	};
-}
-async function askPrompt(dotPath, prompt) {
-	const type = prompt.type ?? "input";
-	if (type === "select" && prompt.choices) {
-		const value = await select({
-			message: prompt.message,
-			choices: prompt.choices.map((c) => ({
-				name: c.name,
-				value: c.value
-			}))
-		});
-		if (value === "__auto__") return void 0;
-		if (value === "__input__") return input({
-			message: `${dotPath}:`,
-			validate: (v) => v.length > 0 ? true : "Value is required"
+	return results;
+}
+/**
+* Interactive add agent — simple two-field prompt.
+*/
+async function promptAddAgent() {
+	return {
+		name: await input({
+			message: "Local alias:",
+			validate: (v) => /^[a-z0-9][a-z0-9-]*$/.test(v) ? true : "Lowercase alphanumeric and hyphens only"
+		}),
+		agentId: await input({
+			message: "Agent UUID on the Hub:",
+			validate: (v) => v.length > 0 ? true : "Agent UUID is required"
+		})
+	};
+}
+async function askPrompt(dotPath, prompt) {
+	const type = prompt.type ?? "input";
+	if (type === "select" && prompt.choices) {
+		const value = await select({
+			message: prompt.message,
+			choices: prompt.choices.map((c) => ({
+				name: c.name,
+				value: c.value
+			}))
+		});
+		if (value === "__auto__") return void 0;
+		if (value === "__input__") return input({
+			message: `${dotPath}:`,
+			validate: (v) => v.length > 0 ? true : "Value is required"
+		});
+		return value;
+	}
+	if (type === "password") return password({ message: prompt.message });
+	return input({
+		message: prompt.message,
+		default: prompt.default
+	});
+}
+/** Walk schema to find the env var name for a given dot path. */
+function findEnvVar(schema, dotPath) {
+	const parts = dotPath.split(".");
+	let current = schema;
+	for (const part of parts) {
+		if (current === null || current === void 0 || typeof current !== "object") return void 0;
+		const obj = current;
+		if (obj._tag === "optional") current = obj.shape[part];
+		else current = obj[part];
+	}
+	if (typeof current === "object" && current !== null && "_tag" in current) {
+		const field = current;
+		if (field._tag === "field") return field.options?.env;
+	}
+}
+function setNestedByDot(obj, dotPath, value) {
+	const parts = dotPath.split(".");
+	let current = obj;
+	for (let i = 0; i < parts.length - 1; i++) {
+		const key = parts[i];
+		if (key === void 0) continue;
+		if (!(key in current) || typeof current[key] !== "object" || current[key] === null) current[key] = {};
+		current = current[key];
+	}
+	const lastKey = parts.at(-1);
+	if (lastKey !== void 0) current[lastKey] = value;
+}
+//#endregion
+//#region ../../node_modules/.pnpm/@fastify+busboy@3.2.0/node_modules/@fastify/busboy/deps/streamsearch/sbmh.js
+var require_sbmh = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	/**
+	* Copyright Brian White. All rights reserved.
+	*
+	* @see https://github.com/mscdex/streamsearch
+	*
+	* Permission is hereby granted, free of charge, to any person obtaining a copy
+	* of this software and associated documentation files (the "Software"), to
+	* deal in the Software without restriction, including without limitation the
+	* rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
+	* sell copies of the Software, and to permit persons to whom the Software is
+	* furnished to do so, subject to the following conditions:
+	*
+	* The above copyright notice and this permission notice shall be included in
+	* all copies or substantial portions of the Software.
+	*
+	* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+	* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+	* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+	* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+	* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+	* FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
+	* IN THE SOFTWARE.
+	*
+	* Based heavily on the Streaming Boyer-Moore-Horspool C++ implementation
+	* by Hongli Lai at: https://github.com/FooBarWidget/boyer-moore-horspool
+	*/
+	const { EventEmitter: EventEmitter$2 } = __require("node:events");
+	const { inherits: inherits$5 } = __require("node:util");
+	function SBMH(needle) {
+		if (typeof needle === "string") needle = Buffer.from(needle);
+		if (!Buffer.isBuffer(needle)) throw new TypeError("The needle has to be a String or a Buffer.");
+		const needleLength = needle.length;
+		const needleLastCharIndex = needleLength - 1;
+		if (needleLength === 0) throw new Error("The needle cannot be an empty String/Buffer.");
+		if (needleLength > 256) throw new Error("The needle cannot have a length bigger than 256.");
+		this.maxMatches = Infinity;
+		this.matches = 0;
+		this._occ = new Uint8Array(256).fill(needleLength);
+		this._lookbehind_size = 0;
+		this._needle = needle;
+		this._bufpos = 0;
+		this._lookbehind = Buffer.alloc(needleLastCharIndex);
+		for (var i = 0; i < needleLastCharIndex; ++i) this._occ[needle[i]] = needleLastCharIndex - i;
+	}
+	inherits$5(SBMH, EventEmitter$2);
+	SBMH.prototype.reset = function() {
+		this._lookbehind_size = 0;
+		this.matches = 0;
+		this._bufpos = 0;
+	};
+	SBMH.prototype.push = function(chunk, pos) {
+		if (!Buffer.isBuffer(chunk)) chunk = Buffer.from(chunk, "binary");
+		const chlen = chunk.length;
+		this._bufpos = pos || 0;
+		let r;
+		while (r !== chlen && this.matches < this.maxMatches) r = this._sbmh_feed(chunk);
+		return r;
+	};
+	SBMH.prototype._sbmh_feed = function(data) {
+		const len = data.length;
+		const needle = this._needle;
+		const needleLength = needle.length;
+		const needleLastCharIndex = needleLength - 1;
+		const needleLastChar = needle[needleLastCharIndex];
+		let pos = -this._lookbehind_size;
+		let ch;
+		if (pos < 0) {
+			while (pos < 0 && pos <= len - needleLength) {
+				ch = data[pos + needleLastCharIndex];
+				if (ch === needleLastChar && this._sbmh_memcmp(data, pos, needleLastCharIndex)) {
+					this._lookbehind_size = 0;
+					++this.matches;
+					this.emit("info", true);
+					return this._bufpos = pos + needleLength;
+				}
+				pos += this._occ[ch];
+			}
+			while (pos < 0 && !this._sbmh_memcmp(data, pos, len - pos)) ++pos;
+			if (pos >= 0) {
+				this.emit("info", false, this._lookbehind, 0, this._lookbehind_size);
+				this._lookbehind_size = 0;
+			} else {
+				const bytesToCutOff = this._lookbehind_size + pos;
+				if (bytesToCutOff > 0) this.emit("info", false, this._lookbehind, 0, bytesToCutOff);
+				this._lookbehind_size -= bytesToCutOff;
+				this._lookbehind.copy(this._lookbehind, 0, bytesToCutOff, this._lookbehind_size);
+				data.copy(this._lookbehind, this._lookbehind_size);
+				this._lookbehind_size += len;
+				this._bufpos = len;
+				return len;
+			}
+		}
+		pos = data.indexOf(needle, pos + this._bufpos);
+		if (pos !== -1) {
+			++this.matches;
+			if (pos === 0) this.emit("info", true);
+			else this.emit("info", true, data, this._bufpos, pos);
+			return this._bufpos = pos + needleLength;
+		}
+		pos = len - needleLastCharIndex;
+		if (pos < 0) pos = 0;
+		while (pos !== len && (data[pos] !== needle[0] || Buffer.compare(data.subarray(pos + 1, len), needle.subarray(1, len - pos)) !== 0)) ++pos;
+		if (pos !== len) {
+			data.copy(this._lookbehind, 0, pos, len);
+			this._lookbehind_size = len - pos;
+		}
+		if (pos !== 0) this.emit("info", false, data, this._bufpos, pos);
+		this._bufpos = len;
+		return len;
+	};
+	SBMH.prototype._sbmh_lookup_char = function(data, pos) {
+		return pos < 0 ? this._lookbehind[this._lookbehind_size + pos] : data[pos];
+	};
+	SBMH.prototype._sbmh_memcmp = function(data, pos, len) {
+		for (var i = 0; i < len; ++i) if (this._sbmh_lookup_char(data, pos + i) !== this._needle[i]) return false;
+		return true;
+	};
+	module.exports = SBMH;
+}));
+//#endregion
+//#region ../../node_modules/.pnpm/@fastify+busboy@3.2.0/node_modules/@fastify/busboy/deps/dicer/lib/PartStream.js
+var require_PartStream = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	const inherits$4 = __require("node:util").inherits;
+	const ReadableStream = __require("node:stream").Readable;
+	function PartStream(opts) {
+		ReadableStream.call(this, opts);
+	}
+	inherits$4(PartStream, ReadableStream);
+	PartStream.prototype._read = function(n) {};
+	module.exports = PartStream;
+}));
+//#endregion
+//#region ../../node_modules/.pnpm/@fastify+busboy@3.2.0/node_modules/@fastify/busboy/lib/utils/getLimit.js
+var require_getLimit = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	module.exports = function getLimit(limits, name, defaultLimit) {
+		if (!limits || limits[name] === void 0 || limits[name] === null) return defaultLimit;
+		if (typeof limits[name] !== "number" || isNaN(limits[name])) throw new TypeError("Limit " + name + " is not a valid number");
+		return limits[name];
+	};
+}));
+//#endregion
+//#region ../../node_modules/.pnpm/@fastify+busboy@3.2.0/node_modules/@fastify/busboy/deps/dicer/lib/HeaderParser.js
+var require_HeaderParser = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	const EventEmitter$1 = __require("node:events").EventEmitter;
+	const inherits$3 = __require("node:util").inherits;
+	const getLimit = require_getLimit();
+	const StreamSearch = require_sbmh();
+	const B_DCRLF = Buffer.from("\r\n\r\n");
+	const RE_CRLF = /\r\n/g;
+	const RE_HDR = /^([^:]+):[ \t]?([\x00-\xFF]+)?$/;
+	function HeaderParser(cfg) {
+		EventEmitter$1.call(this);
+		cfg = cfg || {};
+		const self = this;
+		this.nread = 0;
+		this.maxed = false;
+		this.npairs = 0;
+		this.maxHeaderPairs = getLimit(cfg, "maxHeaderPairs", 2e3);
+		this.maxHeaderSize = getLimit(cfg, "maxHeaderSize", 80 * 1024);
+		this.buffer = "";
+		this.header = {};
+		this.finished = false;
+		this.ss = new StreamSearch(B_DCRLF);
+		this.ss.on("info", function(isMatch, data, start, end) {
+			if (data && !self.maxed) {
+				if (self.nread + end - start >= self.maxHeaderSize) {
+					end = self.maxHeaderSize - self.nread + start;
+					self.nread = self.maxHeaderSize;
+					self.maxed = true;
+				} else self.nread += end - start;
+				self.buffer += data.toString("binary", start, end);
+			}
+			if (isMatch) self._finish();
+		});
+	}
+	inherits$3(HeaderParser, EventEmitter$1);
+	HeaderParser.prototype.push = function(data) {
+		const r = this.ss.push(data);
+		if (this.finished) return r;
+	};
+	HeaderParser.prototype.reset = function() {
+		this.finished = false;
+		this.buffer = "";
+		this.header = {};
+		this.ss.reset();
+	};
+	HeaderParser.prototype._finish = function() {
+		if (this.buffer) this._parseHeader();
+		this.ss.matches = this.ss.maxMatches;
+		const header = this.header;
+		this.header = {};
+		this.buffer = "";
+		this.finished = true;
+		this.nread = this.npairs = 0;
+		this.maxed = false;
+		this.emit("header", header);
+	};
+	HeaderParser.prototype._parseHeader = function() {
+		if (this.npairs === this.maxHeaderPairs) return;
+		const lines = this.buffer.split(RE_CRLF);
+		const len = lines.length;
+		let m, h;
+		for (var i = 0; i < len; ++i) {
+			if (lines[i].length === 0) continue;
+			if (lines[i][0] === "	" || lines[i][0] === " ") {
+				if (h) {
+					this.header[h][this.header[h].length - 1] += lines[i];
+					continue;
+				}
+			}
+			const posColon = lines[i].indexOf(":");
+			if (posColon === -1 || posColon === 0) return;
+			m = RE_HDR.exec(lines[i]);
+			h = m[1].toLowerCase();
+			this.header[h] = this.header[h] || [];
+			this.header[h].push(m[2] || "");
+			if (++this.npairs === this.maxHeaderPairs) break;
+		}
+	};
+	module.exports = HeaderParser;
+}));
+//#endregion
+//#region ../../node_modules/.pnpm/@fastify+busboy@3.2.0/node_modules/@fastify/busboy/deps/dicer/lib/Dicer.js
+var require_Dicer = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	const WritableStream$1 = __require("node:stream").Writable;
+	const inherits$2 = __require("node:util").inherits;
+	const StreamSearch = require_sbmh();
+	const PartStream = require_PartStream();
+	const HeaderParser = require_HeaderParser();
+	const DASH = 45;
+	const B_ONEDASH = Buffer.from("-");
+	const B_CRLF = Buffer.from("\r\n");
+	const EMPTY_FN = function() {};
+	function Dicer(cfg) {
+		if (!(this instanceof Dicer)) return new Dicer(cfg);
+		WritableStream$1.call(this, cfg);
+		if (!cfg || !cfg.headerFirst && typeof cfg.boundary !== "string") throw new TypeError("Boundary required");
+		if (typeof cfg.boundary === "string") this.setBoundary(cfg.boundary);
+		else this._bparser = void 0;
+		this._headerFirst = cfg.headerFirst;
+		this._dashes = 0;
+		this._parts = 0;
+		this._finished = false;
+		this._realFinish = false;
+		this._isPreamble = true;
+		this._justMatched = false;
+		this._firstWrite = true;
+		this._inHeader = true;
+		this._part = void 0;
+		this._cb = void 0;
+		this._ignoreData = false;
+		this._partOpts = { highWaterMark: cfg.partHwm };
+		this._pause = false;
+		const self = this;
+		this._hparser = new HeaderParser(cfg);
+		this._hparser.on("header", function(header) {
+			self._inHeader = false;
+			self._part.emit("header", header);
+		});
+	}
+	inherits$2(Dicer, WritableStream$1);
+	Dicer.prototype.emit = function(ev) {
+		if (ev === "finish" && !this._realFinish) {
+			if (!this._finished) {
+				const self = this;
+				process.nextTick(function() {
+					self.emit("error", /* @__PURE__ */ new Error("Unexpected end of multipart data"));
+					if (self._part && !self._ignoreData) {
+						const type = self._isPreamble ? "Preamble" : "Part";
+						self._part.emit("error", /* @__PURE__ */ new Error(type + " terminated early due to unexpected end of multipart data"));
+						self._part.push(null);
+						process.nextTick(function() {
+							self._realFinish = true;
+							self.emit("finish");
+							self._realFinish = false;
+						});
+						return;
+					}
+					self._realFinish = true;
+					self.emit("finish");
+					self._realFinish = false;
+				});
+			}
+		} else WritableStream$1.prototype.emit.apply(this, arguments);
+	};
+	Dicer.prototype._write = function(data, encoding, cb) {
+		if (!this._hparser && !this._bparser) return cb();
+		if (this._headerFirst && this._isPreamble) {
+			if (!this._part) {
+				this._part = new PartStream(this._partOpts);
+				if (this.listenerCount("preamble") !== 0) this.emit("preamble", this._part);
+				else this._ignore();
+			}
+			const r = this._hparser.push(data);
+			if (!this._inHeader && r !== void 0 && r < data.length) data = data.slice(r);
+			else return cb();
+		}
+		if (this._firstWrite) {
+			this._bparser.push(B_CRLF);
+			this._firstWrite = false;
+		}
+		this._bparser.push(data);
+		if (this._pause) this._cb = cb;
+		else cb();
+	};
+	Dicer.prototype.reset = function() {
+		this._part = void 0;
+		this._bparser = void 0;
+		this._hparser = void 0;
+	};
+	Dicer.prototype.setBoundary = function(boundary) {
+		const self = this;
+		this._bparser = new StreamSearch("\r\n--" + boundary);
+		this._bparser.on("info", function(isMatch, data, start, end) {
+			self._oninfo(isMatch, data, start, end);
+		});
+	};
+	Dicer.prototype._ignore = function() {
+		if (this._part && !this._ignoreData) {
+			this._ignoreData = true;
+			this._part.on("error", EMPTY_FN);
+			this._part.resume();
+		}
+	};
+	Dicer.prototype._oninfo = function(isMatch, data, start, end) {
+		let buf;
+		const self = this;
+		let i = 0;
+		let r;
+		let shouldWriteMore = true;
+		if (!this._part && this._justMatched && data) {
+			while (this._dashes < 2 && start + i < end) if (data[start + i] === DASH) {
+				++i;
+				++this._dashes;
+			} else {
+				if (this._dashes) buf = B_ONEDASH;
+				this._dashes = 0;
+				break;
+			}
+			if (this._dashes === 2) {
+				if (start + i < end && this.listenerCount("trailer") !== 0) this.emit("trailer", data.slice(start + i, end));
+				this.reset();
+				this._finished = true;
+				if (self._parts === 0) {
+					self._realFinish = true;
+					self.emit("finish");
+					self._realFinish = false;
+				}
+			}
+			if (this._dashes) return;
+		}
+		if (this._justMatched) this._justMatched = false;
+		if (!this._part) {
+			this._part = new PartStream(this._partOpts);
+			this._part._read = function(n) {
+				self._unpause();
+			};
+			if (this._isPreamble && this.listenerCount("preamble") !== 0) this.emit("preamble", this._part);
+			else if (this._isPreamble !== true && this.listenerCount("part") !== 0) this.emit("part", this._part);
+			else this._ignore();
+			if (!this._isPreamble) this._inHeader = true;
+		}
+		if (data && start < end && !this._ignoreData) {
+			if (this._isPreamble || !this._inHeader) {
+				if (buf) shouldWriteMore = this._part.push(buf);
+				shouldWriteMore = this._part.push(data.slice(start, end));
+				if (!shouldWriteMore) this._pause = true;
+			} else if (!this._isPreamble && this._inHeader) {
+				if (buf) this._hparser.push(buf);
+				r = this._hparser.push(data.slice(start, end));
+				if (!this._inHeader && r !== void 0 && r < end) this._oninfo(false, data, start + r, end);
+			}
+		}
+		if (isMatch) {
+			this._hparser.reset();
+			if (this._isPreamble) this._isPreamble = false;
+			else if (start !== end) {
+				++this._parts;
+				this._part.on("end", function() {
+					if (--self._parts === 0) if (self._finished) {
+						self._realFinish = true;
+						self.emit("finish");
+						self._realFinish = false;
+					} else self._unpause();
+				});
+			}
+			this._part.push(null);
+			this._part = void 0;
+			this._ignoreData = false;
+			this._justMatched = true;
+			this._dashes = 0;
+		}
+	};
+	Dicer.prototype._unpause = function() {
+		if (!this._pause) return;
+		this._pause = false;
+		if (this._cb) {
+			const cb = this._cb;
+			this._cb = void 0;
+			cb();
+		}
+	};
+	module.exports = Dicer;
+}));
+//#endregion
+//#region ../../node_modules/.pnpm/@fastify+busboy@3.2.0/node_modules/@fastify/busboy/lib/utils/decodeText.js
+var require_decodeText = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	const utf8Decoder = new TextDecoder("utf-8");
+	const textDecoders = new Map([["utf-8", utf8Decoder], ["utf8", utf8Decoder]]);
+	function getDecoder(charset) {
+		let lc;
+		while (true) switch (charset) {
+			case "utf-8":
+			case "utf8": return decoders.utf8;
+			case "latin1":
+			case "ascii":
+			case "us-ascii":
+			case "iso-8859-1":
+			case "iso8859-1":
+			case "iso88591":
+			case "iso_8859-1":
+			case "windows-1252":
+			case "iso_8859-1:1987":
+			case "cp1252":
+			case "x-cp1252": return decoders.latin1;
+			case "utf16le":
+			case "utf-16le":
+			case "ucs2":
+			case "ucs-2": return decoders.utf16le;
+			case "base64": return decoders.base64;
+			default:
+				if (lc === void 0) {
+					lc = true;
+					charset = charset.toLowerCase();
+					continue;
+				}
+				return decoders.other.bind(charset);
+		}
+	}
+	const decoders = {
+		utf8: (data, sourceEncoding) => {
+			if (data.length === 0) return "";
+			if (typeof data === "string") data = Buffer.from(data, sourceEncoding);
+			return data.utf8Slice(0, data.length);
+		},
+		latin1: (data, sourceEncoding) => {
+			if (data.length === 0) return "";
+			if (typeof data === "string") return data;
+			return data.latin1Slice(0, data.length);
+		},
+		utf16le: (data, sourceEncoding) => {
+			if (data.length === 0) return "";
+			if (typeof data === "string") data = Buffer.from(data, sourceEncoding);
+			return data.ucs2Slice(0, data.length);
+		},
+		base64: (data, sourceEncoding) => {
+			if (data.length === 0) return "";
+			if (typeof data === "string") data = Buffer.from(data, sourceEncoding);
+			return data.base64Slice(0, data.length);
+		},
+		other: (data, sourceEncoding) => {
+			if (data.length === 0) return "";
+			if (typeof data === "string") data = Buffer.from(data, sourceEncoding);
+			if (textDecoders.has(exports.toString())) try {
+				return textDecoders.get(exports).decode(data);
+			} catch {}
+			return typeof data === "string" ? data : data.toString();
+		}
+	};
+	function decodeText(text, sourceEncoding, destEncoding) {
+		if (text) return getDecoder(destEncoding)(text, sourceEncoding);
+		return text;
+	}
+	module.exports = decodeText;
+}));
+//#endregion
+//#region ../../node_modules/.pnpm/@fastify+busboy@3.2.0/node_modules/@fastify/busboy/lib/utils/parseParams.js
+var require_parseParams = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	const decodeText = require_decodeText();
+	const RE_ENCODED = /%[a-fA-F0-9][a-fA-F0-9]/g;
+	const EncodedLookup = {
+		"%00": "\0",
+		"%01": "
",
+		"%02": "",
+		"%03": "",
+		"%04": "",
+		"%05": "",
+		"%06": "",
+		"%07": "\x07",
+		"%08": "\b",
+		"%09": "	",
+		"%0a": "\n",
+		"%0A": "\n",
+		"%0b": "\v",
+		"%0B": "\v",
+		"%0c": "\f",
+		"%0C": "\f",
+		"%0d": "\r",
+		"%0D": "\r",
+		"%0e": "",
+		"%0E": "",
+		"%0f": "",
+		"%0F": "",
+		"%10": "",
+		"%11": "",
+		"%12": "",
+		"%13": "",
+		"%14": "",
+		"%15": "",
+		"%16": "",
+		"%17": "",
+		"%18": "",
+		"%19": "",
+		"%1a": "",
+		"%1A": "",
+		"%1b": "\x1B",
+		"%1B": "\x1B",
+		"%1c": "",
+		"%1C": "",
+		"%1d": "",
+		"%1D": "",
+		"%1e": "",
+		"%1E": "",
+		"%1f": "",
+		"%1F": "",
+		"%20": " ",
+		"%21": "!",
+		"%22": "\"",
+		"%23": "#",
+		"%24": "$",
+		"%25": "%",
+		"%26": "&",
+		"%27": "'",
+		"%28": "(",
+		"%29": ")",
+		"%2a": "*",
+		"%2A": "*",
+		"%2b": "+",
+		"%2B": "+",
+		"%2c": ",",
+		"%2C": ",",
+		"%2d": "-",
+		"%2D": "-",
+		"%2e": ".",
+		"%2E": ".",
+		"%2f": "/",
+		"%2F": "/",
+		"%30": "0",
+		"%31": "1",
+		"%32": "2",
+		"%33": "3",
+		"%34": "4",
+		"%35": "5",
+		"%36": "6",
+		"%37": "7",
+		"%38": "8",
+		"%39": "9",
+		"%3a": ":",
+		"%3A": ":",
+		"%3b": ";",
+		"%3B": ";",
+		"%3c": "<",
+		"%3C": "<",
+		"%3d": "=",
+		"%3D": "=",
+		"%3e": ">",
+		"%3E": ">",
+		"%3f": "?",
+		"%3F": "?",
+		"%40": "@",
+		"%41": "A",
+		"%42": "B",
+		"%43": "C",
+		"%44": "D",
+		"%45": "E",
+		"%46": "F",
+		"%47": "G",
+		"%48": "H",
+		"%49": "I",
+		"%4a": "J",
+		"%4A": "J",
+		"%4b": "K",
+		"%4B": "K",
+		"%4c": "L",
+		"%4C": "L",
+		"%4d": "M",
+		"%4D": "M",
+		"%4e": "N",
+		"%4E": "N",
+		"%4f": "O",
+		"%4F": "O",
+		"%50": "P",
+		"%51": "Q",
+		"%52": "R",
+		"%53": "S",
+		"%54": "T",
+		"%55": "U",
+		"%56": "V",
+		"%57": "W",
+		"%58": "X",
+		"%59": "Y",
+		"%5a": "Z",
+		"%5A": "Z",
+		"%5b": "[",
+		"%5B": "[",
+		"%5c": "\\",
+		"%5C": "\\",
+		"%5d": "]",
+		"%5D": "]",
+		"%5e": "^",
+		"%5E": "^",
+		"%5f": "_",
+		"%5F": "_",
+		"%60": "`",
+		"%61": "a",
+		"%62": "b",
+		"%63": "c",
+		"%64": "d",
+		"%65": "e",
+		"%66": "f",
+		"%67": "g",
+		"%68": "h",
+		"%69": "i",
+		"%6a": "j",
+		"%6A": "j",
+		"%6b": "k",
+		"%6B": "k",
+		"%6c": "l",
+		"%6C": "l",
+		"%6d": "m",
+		"%6D": "m",
+		"%6e": "n",
+		"%6E": "n",
+		"%6f": "o",
+		"%6F": "o",
+		"%70": "p",
+		"%71": "q",
+		"%72": "r",
+		"%73": "s",
+		"%74": "t",
+		"%75": "u",
+		"%76": "v",
+		"%77": "w",
+		"%78": "x",
+		"%79": "y",
+		"%7a": "z",
+		"%7A": "z",
+		"%7b": "{",
+		"%7B": "{",
+		"%7c": "|",
+		"%7C": "|",
+		"%7d": "}",
+		"%7D": "}",
+		"%7e": "~",
+		"%7E": "~",
+		"%7f": "",
+		"%7F": "",
+		"%80": "€",
+		"%81": "",
+		"%82": "‚",
+		"%83": "ƒ",
+		"%84": "„",
+		"%85": "…",
+		"%86": "†",
+		"%87": "‡",
+		"%88": "ˆ",
+		"%89": "‰",
+		"%8a": "Š",
+		"%8A": "Š",
+		"%8b": "‹",
+		"%8B": "‹",
+		"%8c": "Œ",
+		"%8C": "Œ",
+		"%8d": "",
+		"%8D": "",
+		"%8e": "Ž",
+		"%8E": "Ž",
+		"%8f": "",
+		"%8F": "",
+		"%90": "",
+		"%91": "‘",
+		"%92": "’",
+		"%93": "“",
+		"%94": "”",
+		"%95": "•",
+		"%96": "–",
+		"%97": "—",
+		"%98": "˜",
+		"%99": "™",
+		"%9a": "š",
+		"%9A": "š",
+		"%9b": "›",
+		"%9B": "›",
+		"%9c": "œ",
+		"%9C": "œ",
+		"%9d": "",
+		"%9D": "",
+		"%9e": "ž",
+		"%9E": "ž",
+		"%9f": "Ÿ",
+		"%9F": "Ÿ",
+		"%a0": "\xA0",
+		"%A0": "\xA0",
+		"%a1": "¡",
+		"%A1": "¡",
+		"%a2": "¢",
+		"%A2": "¢",
+		"%a3": "£",
+		"%A3": "£",
+		"%a4": "¤",
+		"%A4": "¤",
+		"%a5": "¥",
+		"%A5": "¥",
+		"%a6": "¦",
+		"%A6": "¦",
+		"%a7": "§",
+		"%A7": "§",
+		"%a8": "¨",
+		"%A8": "¨",
+		"%a9": "©",
+		"%A9": "©",
+		"%aa": "ª",
+		"%Aa": "ª",
+		"%aA": "ª",
+		"%AA": "ª",
+		"%ab": "«",
+		"%Ab": "«",
+		"%aB": "«",
+		"%AB": "«",
+		"%ac": "¬",
+		"%Ac": "¬",
+		"%aC": "¬",
+		"%AC": "¬",
+		"%ad": "­",
+		"%Ad": "­",
+		"%aD": "­",
+		"%AD": "­",
+		"%ae": "®",
+		"%Ae": "®",
+		"%aE": "®",
+		"%AE": "®",
+		"%af": "¯",
+		"%Af": "¯",
+		"%aF": "¯",
+		"%AF": "¯",
+		"%b0": "°",
+		"%B0": "°",
+		"%b1": "±",
+		"%B1": "±",
+		"%b2": "²",
+		"%B2": "²",
+		"%b3": "³",
+		"%B3": "³",
+		"%b4": "´",
+		"%B4": "´",
+		"%b5": "µ",
+		"%B5": "µ",
+		"%b6": "¶",
+		"%B6": "¶",
+		"%b7": "·",
+		"%B7": "·",
+		"%b8": "¸",
+		"%B8": "¸",
+		"%b9": "¹",
+		"%B9": "¹",
+		"%ba": "º",
+		"%Ba": "º",
+		"%bA": "º",
+		"%BA": "º",
+		"%bb": "»",
+		"%Bb": "»",
+		"%bB": "»",
+		"%BB": "»",
+		"%bc": "¼",
+		"%Bc": "¼",
+		"%bC": "¼",
+		"%BC": "¼",
+		"%bd": "½",
+		"%Bd": "½",
+		"%bD": "½",
+		"%BD": "½",
+		"%be": "¾",
+		"%Be": "¾",
+		"%bE": "¾",
+		"%BE": "¾",
+		"%bf": "¿",
+		"%Bf": "¿",
+		"%bF": "¿",
+		"%BF": "¿",
+		"%c0": "À",
+		"%C0": "À",
+		"%c1": "Á",
+		"%C1": "Á",
+		"%c2": "Â",
+		"%C2": "Â",
+		"%c3": "Ã",
+		"%C3": "Ã",
+		"%c4": "Ä",
+		"%C4": "Ä",
+		"%c5": "Å",
+		"%C5": "Å",
+		"%c6": "Æ",
+		"%C6": "Æ",
+		"%c7": "Ç",
+		"%C7": "Ç",
+		"%c8": "È",
+		"%C8": "È",
+		"%c9": "É",
+		"%C9": "É",
+		"%ca": "Ê",
+		"%Ca": "Ê",
+		"%cA": "Ê",
+		"%CA": "Ê",
+		"%cb": "Ë",
+		"%Cb": "Ë",
+		"%cB": "Ë",
+		"%CB": "Ë",
+		"%cc": "Ì",
+		"%Cc": "Ì",
+		"%cC": "Ì",
+		"%CC": "Ì",
+		"%cd": "Í",
+		"%Cd": "Í",
+		"%cD": "Í",
+		"%CD": "Í",
+		"%ce": "Î",
+		"%Ce": "Î",
+		"%cE": "Î",
+		"%CE": "Î",
+		"%cf": "Ï",
+		"%Cf": "Ï",
+		"%cF": "Ï",
+		"%CF": "Ï",
+		"%d0": "Ð",
+		"%D0": "Ð",
+		"%d1": "Ñ",
+		"%D1": "Ñ",
+		"%d2": "Ò",
+		"%D2": "Ò",
+		"%d3": "Ó",
+		"%D3": "Ó",
+		"%d4": "Ô",
+		"%D4": "Ô",
+		"%d5": "Õ",
+		"%D5": "Õ",
+		"%d6": "Ö",
+		"%D6": "Ö",
+		"%d7": "×",
+		"%D7": "×",
+		"%d8": "Ø",
+		"%D8": "Ø",
+		"%d9": "Ù",
+		"%D9": "Ù",
+		"%da": "Ú",
+		"%Da": "Ú",
+		"%dA": "Ú",
+		"%DA": "Ú",
+		"%db": "Û",
+		"%Db": "Û",
+		"%dB": "Û",
+		"%DB": "Û",
+		"%dc": "Ü",
+		"%Dc": "Ü",
+		"%dC": "Ü",
+		"%DC": "Ü",
+		"%dd": "Ý",
+		"%Dd": "Ý",
+		"%dD": "Ý",
+		"%DD": "Ý",
+		"%de": "Þ",
+		"%De": "Þ",
+		"%dE": "Þ",
+		"%DE": "Þ",
+		"%df": "ß",
+		"%Df": "ß",
+		"%dF": "ß",
+		"%DF": "ß",
+		"%e0": "à",
+		"%E0": "à",
+		"%e1": "á",
+		"%E1": "á",
+		"%e2": "â",
+		"%E2": "â",
+		"%e3": "ã",
+		"%E3": "ã",
+		"%e4": "ä",
+		"%E4": "ä",
+		"%e5": "å",
+		"%E5": "å",
+		"%e6": "æ",
+		"%E6": "æ",
+		"%e7": "ç",
+		"%E7": "ç",
+		"%e8": "è",
+		"%E8": "è",
+		"%e9": "é",
+		"%E9": "é",
+		"%ea": "ê",
+		"%Ea": "ê",
+		"%eA": "ê",
+		"%EA": "ê",
+		"%eb": "ë",
+		"%Eb": "ë",
+		"%eB": "ë",
+		"%EB": "ë",
+		"%ec": "ì",
+		"%Ec": "ì",
+		"%eC": "ì",
+		"%EC": "ì",
+		"%ed": "í",
+		"%Ed": "í",
+		"%eD": "í",
+		"%ED": "í",
+		"%ee": "î",
+		"%Ee": "î",
+		"%eE": "î",
+		"%EE": "î",
+		"%ef": "ï",
+		"%Ef": "ï",
+		"%eF": "ï",
+		"%EF": "ï",
+		"%f0": "ð",
+		"%F0": "ð",
+		"%f1": "ñ",
+		"%F1": "ñ",
+		"%f2": "ò",
+		"%F2": "ò",
+		"%f3": "ó",
+		"%F3": "ó",
+		"%f4": "ô",
+		"%F4": "ô",
+		"%f5": "õ",
+		"%F5": "õ",
+		"%f6": "ö",
+		"%F6": "ö",
+		"%f7": "÷",
+		"%F7": "÷",
+		"%f8": "ø",
+		"%F8": "ø",
+		"%f9": "ù",
+		"%F9": "ù",
+		"%fa": "ú",
+		"%Fa": "ú",
+		"%fA": "ú",
+		"%FA": "ú",
+		"%fb": "û",
+		"%Fb": "û",
+		"%fB": "û",
+		"%FB": "û",
+		"%fc": "ü",
+		"%Fc": "ü",
+		"%fC": "ü",
+		"%FC": "ü",
+		"%fd": "ý",
+		"%Fd": "ý",
+		"%fD": "ý",
+		"%FD": "ý",
+		"%fe": "þ",
+		"%Fe": "þ",
+		"%fE": "þ",
+		"%FE": "þ",
+		"%ff": "ÿ",
+		"%Ff": "ÿ",
+		"%fF": "ÿ",
+		"%FF": "ÿ"
+	};
+	function encodedReplacer(match) {
+		return EncodedLookup[match];
+	}
+	const STATE_KEY = 0;
+	const STATE_VALUE = 1;
+	const STATE_CHARSET = 2;
+	const STATE_LANG = 3;
+	function parseParams(str) {
+		const res = [];
+		let state = STATE_KEY;
+		let charset = "";
+		let inquote = false;
+		let escaping = false;
+		let p = 0;
+		let tmp = "";
+		const len = str.length;
+		for (var i = 0; i < len; ++i) {
+			const char = str[i];
+			if (char === "\\" && inquote) if (escaping) escaping = false;
+			else {
+				escaping = true;
+				continue;
+			}
+			else if (char === "\"") if (!escaping) {
+				if (inquote) {
+					inquote = false;
+					state = STATE_KEY;
+					while (i + 1 < len && str[i + 1] !== ";") ++i;
+				} else inquote = true;
+				continue;
+			} else escaping = false;
+			else {
+				if (escaping && inquote) tmp += "\\";
+				escaping = false;
+				if ((state === STATE_CHARSET || state === STATE_LANG) && char === "'") {
+					if (state === STATE_CHARSET) {
+						state = STATE_LANG;
+						charset = tmp.substring(1);
+					} else state = STATE_VALUE;
+					tmp = "";
+					continue;
+				} else if (state === STATE_KEY && (char === "*" || char === "=") && res.length) {
+					state = char === "*" ? STATE_CHARSET : STATE_VALUE;
+					res[p] = [tmp, void 0];
+					tmp = "";
+					continue;
+				} else if (!inquote && char === ";") {
+					state = STATE_KEY;
+					if (charset) {
+						if (tmp.length) tmp = decodeText(tmp.replace(RE_ENCODED, encodedReplacer), "binary", charset);
+						charset = "";
+					} else if (tmp.length) tmp = decodeText(tmp, "binary", "utf8");
+					if (res[p] === void 0) res[p] = tmp;
+					else res[p][1] = tmp;
+					tmp = "";
+					++p;
+					continue;
+				} else if (!inquote && (char === " " || char === "	")) continue;
+			}
+			tmp += char;
+		}
+		if (charset && tmp.length) tmp = decodeText(tmp.replace(RE_ENCODED, encodedReplacer), "binary", charset);
+		else if (tmp) tmp = decodeText(tmp, "binary", "utf8");
+		if (res[p] === void 0) {
+			if (tmp) res[p] = tmp;
+		} else res[p][1] = tmp;
+		return res;
+	}
+	module.exports = parseParams;
+}));
+//#endregion
+//#region ../../node_modules/.pnpm/@fastify+busboy@3.2.0/node_modules/@fastify/busboy/lib/utils/basename.js
+var require_basename = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	module.exports = function basename(path) {
+		if (typeof path !== "string") return "";
+		for (var i = path.length - 1; i >= 0; --i) switch (path.charCodeAt(i)) {
+			case 47:
+			case 92:
+				path = path.slice(i + 1);
+				return path === ".." || path === "." ? "" : path;
+		}
+		return path === ".." || path === "." ? "" : path;
+	};
+}));
+//#endregion
+//#region ../../node_modules/.pnpm/@fastify+busboy@3.2.0/node_modules/@fastify/busboy/lib/types/multipart.js
+var require_multipart$1 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	const { Readable: Readable$1 } = __require("node:stream");
+	const { inherits: inherits$1 } = __require("node:util");
+	const Dicer = require_Dicer();
+	const parseParams = require_parseParams();
+	const decodeText = require_decodeText();
+	const basename = require_basename();
+	const getLimit = require_getLimit();
+	const RE_BOUNDARY = /^boundary$/i;
+	const RE_FIELD = /^form-data$/i;
+	const RE_CHARSET = /^charset$/i;
+	const RE_FILENAME = /^filename$/i;
+	const RE_NAME = /^name$/i;
+	Multipart.detect = /^multipart\/form-data/i;
+	function Multipart(boy, cfg) {
+		let i;
+		let len;
+		const self = this;
+		let boundary;
+		const limits = cfg.limits;
+		const isPartAFile = cfg.isPartAFile || ((fieldName, contentType, fileName) => contentType === "application/octet-stream" || fileName !== void 0);
+		const parsedConType = cfg.parsedConType || [];
+		const defCharset = cfg.defCharset || "utf8";
+		const preservePath = cfg.preservePath;
+		const fileOpts = { highWaterMark: cfg.fileHwm };
+		for (i = 0, len = parsedConType.length; i < len; ++i) if (Array.isArray(parsedConType[i]) && RE_BOUNDARY.test(parsedConType[i][0])) {
+			boundary = parsedConType[i][1];
+			break;
+		}
+		function checkFinished() {
+			if (nends === 0 && finished && !boy._done) {
+				finished = false;
+				self.end();
+			}
+		}
+		if (typeof boundary !== "string") throw new Error("Multipart: Boundary not found");
+		const fieldSizeLimit = getLimit(limits, "fieldSize", 1 * 1024 * 1024);
+		const fileSizeLimit = getLimit(limits, "fileSize", Infinity);
+		const filesLimit = getLimit(limits, "files", Infinity);
+		const fieldsLimit = getLimit(limits, "fields", Infinity);
+		const partsLimit = getLimit(limits, "parts", Infinity);
+		const headerPairsLimit = getLimit(limits, "headerPairs", 2e3);
+		const headerSizeLimit = getLimit(limits, "headerSize", 80 * 1024);
+		let nfiles = 0;
+		let nfields = 0;
+		let nends = 0;
+		let curFile;
+		let curField;
+		let finished = false;
+		this._needDrain = false;
+		this._pause = false;
+		this._cb = void 0;
+		this._nparts = 0;
+		this._boy = boy;
+		this.parser = new Dicer({
+			boundary,
+			maxHeaderPairs: headerPairsLimit,
+			maxHeaderSize: headerSizeLimit,
+			partHwm: fileOpts.highWaterMark,
+			highWaterMark: cfg.highWaterMark
+		});
+		this.parser.on("drain", function() {
+			self._needDrain = false;
+			if (self._cb && !self._pause) {
+				const cb = self._cb;
+				self._cb = void 0;
+				cb();
+			}
+		}).on("part", function onPart(part) {
+			if (++self._nparts > partsLimit) {
+				self.parser.removeListener("part", onPart);
+				self.parser.on("part", skipPart);
+				boy.hitPartsLimit = true;
+				boy.emit("partsLimit");
+				return skipPart(part);
+			}
+			if (curField) {
+				const field = curField;
+				field.emit("end");
+				field.removeAllListeners("end");
+			}
+			part.on("header", function(header) {
+				let contype;
+				let fieldname;
+				let parsed;
+				let charset;
+				let encoding;
+				let filename;
+				let nsize = 0;
+				if (header["content-type"]) {
+					parsed = parseParams(header["content-type"][0]);
+					if (parsed[0]) {
+						contype = parsed[0].toLowerCase();
+						for (i = 0, len = parsed.length; i < len; ++i) if (RE_CHARSET.test(parsed[i][0])) {
+							charset = parsed[i][1].toLowerCase();
+							break;
+						}
+					}
+				}
+				if (contype === void 0) contype = "text/plain";
+				if (charset === void 0) charset = defCharset;
+				if (header["content-disposition"]) {
+					parsed = parseParams(header["content-disposition"][0]);
+					if (!RE_FIELD.test(parsed[0])) return skipPart(part);
+					for (i = 0, len = parsed.length; i < len; ++i) if (RE_NAME.test(parsed[i][0])) fieldname = parsed[i][1];
+					else if (RE_FILENAME.test(parsed[i][0])) {
+						filename = parsed[i][1];
+						if (!preservePath) filename = basename(filename);
+					}
+				} else return skipPart(part);
+				if (header["content-transfer-encoding"]) encoding = header["content-transfer-encoding"][0].toLowerCase();
+				else encoding = "7bit";
+				let onData, onEnd;
+				if (isPartAFile(fieldname, contype, filename)) {
+					if (nfiles === filesLimit) {
+						if (!boy.hitFilesLimit) {
+							boy.hitFilesLimit = true;
+							boy.emit("filesLimit");
+						}
+						return skipPart(part);
+					}
+					++nfiles;
+					if (boy.listenerCount("file") === 0) {
+						self.parser._ignore();
+						return;
+					}
+					++nends;
+					const file = new FileStream(fileOpts);
+					curFile = file;
+					file.on("end", function() {
+						--nends;
+						self._pause = false;
+						checkFinished();
+						if (self._cb && !self._needDrain) {
+							const cb = self._cb;
+							self._cb = void 0;
+							cb();
+						}
+					});
+					file._read = function(n) {
+						if (!self._pause) return;
+						self._pause = false;
+						if (self._cb && !self._needDrain) {
+							const cb = self._cb;
+							self._cb = void 0;
+							cb();
+						}
+					};
+					boy.emit("file", fieldname, file, filename, encoding, contype);
+					onData = function(data) {
+						if ((nsize += data.length) > fileSizeLimit) {
+							const extralen = fileSizeLimit - nsize + data.length;
+							if (extralen > 0) file.push(data.slice(0, extralen));
+							file.truncated = true;
+							file.bytesRead = fileSizeLimit;
+							part.removeAllListeners("data");
+							file.emit("limit");
+							return;
+						} else if (!file.push(data)) self._pause = true;
+						file.bytesRead = nsize;
+					};
+					onEnd = function() {
+						curFile = void 0;
+						file.push(null);
+					};
+				} else {
+					if (nfields === fieldsLimit) {
+						if (!boy.hitFieldsLimit) {
+							boy.hitFieldsLimit = true;
+							boy.emit("fieldsLimit");
+						}
+						return skipPart(part);
+					}
+					++nfields;
+					++nends;
+					let buffer = "";
+					let truncated = false;
+					curField = part;
+					onData = function(data) {
+						if ((nsize += data.length) > fieldSizeLimit) {
+							const extralen = fieldSizeLimit - (nsize - data.length);
+							buffer += data.toString("binary", 0, extralen);
+							truncated = true;
+							part.removeAllListeners("data");
+						} else buffer += data.toString("binary");
+					};
+					onEnd = function() {
+						curField = void 0;
+						if (buffer.length) buffer = decodeText(buffer, "binary", charset);
+						boy.emit("field", fieldname, buffer, false, truncated, encoding, contype);
+						--nends;
+						checkFinished();
+					};
+				}
+				part._readableState.sync = false;
+				part.on("data", onData);
+				part.on("end", onEnd);
+			}).on("error", function(err) {
+				if (curFile) curFile.emit("error", err);
+			});
+		}).on("error", function(err) {
+			boy.emit("error", err);
+		}).on("finish", function() {
+			finished = true;
+			checkFinished();
+		});
+	}
+	Multipart.prototype.write = function(chunk, cb) {
+		const r = this.parser.write(chunk);
+		if (r && !this._pause) cb();
+		else {
+			this._needDrain = !r;
+			this._cb = cb;
+		}
+	};
+	Multipart.prototype.end = function() {
+		const self = this;
+		if (self.parser.writable) self.parser.end();
+		else if (!self._boy._done) process.nextTick(function() {
+			self._boy._done = true;
+			self._boy.emit("finish");
+		});
+	};
+	function skipPart(part) {
+		part.resume();
+	}
+	function FileStream(opts) {
+		Readable$1.call(this, opts);
+		this.bytesRead = 0;
+		this.truncated = false;
+	}
+	inherits$1(FileStream, Readable$1);
+	FileStream.prototype._read = function(n) {};
+	module.exports = Multipart;
+}));
+//#endregion
+//#region ../../node_modules/.pnpm/@fastify+busboy@3.2.0/node_modules/@fastify/busboy/lib/utils/Decoder.js
+var require_Decoder = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	const RE_PLUS = /\+/g;
+	const HEX = [
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		1,
+		1,
+		1,
+		1,
+		1,
+		1,
+		1,
+		1,
+		1,
+		1,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		1,
+		1,
+		1,
+		1,
+		1,
+		1,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		1,
+		1,
+		1,
+		1,
+		1,
+		1,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0
+	];
+	function Decoder() {
+		this.buffer = void 0;
+	}
+	Decoder.prototype.write = function(str) {
+		str = str.replace(RE_PLUS, " ");
+		let res = "";
+		let i = 0;
+		let p = 0;
+		const len = str.length;
+		for (; i < len; ++i) if (this.buffer !== void 0) if (!HEX[str.charCodeAt(i)]) {
+			res += "%" + this.buffer;
+			this.buffer = void 0;
+			--i;
+		} else {
+			this.buffer += str[i];
+			++p;
+			if (this.buffer.length === 2) {
+				res += String.fromCharCode(parseInt(this.buffer, 16));
+				this.buffer = void 0;
+			}
+		}
+		else if (str[i] === "%") {
+			if (i > p) {
+				res += str.substring(p, i);
+				p = i;
+			}
+			this.buffer = "";
+			++p;
+		}
+		if (p < len && this.buffer === void 0) res += str.substring(p);
+		return res;
+	};
+	Decoder.prototype.reset = function() {
+		this.buffer = void 0;
+	};
+	module.exports = Decoder;
+}));
+//#endregion
+//#region ../../node_modules/.pnpm/@fastify+busboy@3.2.0/node_modules/@fastify/busboy/lib/types/urlencoded.js
+var require_urlencoded = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	const Decoder = require_Decoder();
+	const decodeText = require_decodeText();
+	const getLimit = require_getLimit();
+	const RE_CHARSET = /^charset$/i;
+	UrlEncoded.detect = /^application\/x-www-form-urlencoded/i;
+	function UrlEncoded(boy, cfg) {
+		const limits = cfg.limits;
+		const parsedConType = cfg.parsedConType;
+		this.boy = boy;
+		this.fieldSizeLimit = getLimit(limits, "fieldSize", 1 * 1024 * 1024);
+		this.fieldNameSizeLimit = getLimit(limits, "fieldNameSize", 100);
+		this.fieldsLimit = getLimit(limits, "fields", Infinity);
+		let charset;
+		for (var i = 0, len = parsedConType.length; i < len; ++i) if (Array.isArray(parsedConType[i]) && RE_CHARSET.test(parsedConType[i][0])) {
+			charset = parsedConType[i][1].toLowerCase();
+			break;
+		}
+		if (charset === void 0) charset = cfg.defCharset || "utf8";
+		this.decoder = new Decoder();
+		this.charset = charset;
+		this._fields = 0;
+		this._state = "key";
+		this._checkingBytes = true;
+		this._bytesKey = 0;
+		this._bytesVal = 0;
+		this._key = "";
+		this._val = "";
+		this._keyTrunc = false;
+		this._valTrunc = false;
+		this._hitLimit = false;
+	}
+	UrlEncoded.prototype.write = function(data, cb) {
+		if (this._fields === this.fieldsLimit) {
+			if (!this.boy.hitFieldsLimit) {
+				this.boy.hitFieldsLimit = true;
+				this.boy.emit("fieldsLimit");
+			}
+			return cb();
+		}
+		let idxeq;
+		let idxamp;
+		let i;
+		let p = 0;
+		const len = data.length;
+		while (p < len) if (this._state === "key") {
+			idxeq = idxamp = void 0;
+			for (i = p; i < len; ++i) {
+				if (!this._checkingBytes) ++p;
+				if (data[i] === 61) {
+					idxeq = i;
+					break;
+				} else if (data[i] === 38) {
+					idxamp = i;
+					break;
+				}
+				if (this._checkingBytes && this._bytesKey === this.fieldNameSizeLimit) {
+					this._hitLimit = true;
+					break;
+				} else if (this._checkingBytes) ++this._bytesKey;
+			}
+			if (idxeq !== void 0) {
+				if (idxeq > p) this._key += this.decoder.write(data.toString("binary", p, idxeq));
+				this._state = "val";
+				this._hitLimit = false;
+				this._checkingBytes = true;
+				this._val = "";
+				this._bytesVal = 0;
+				this._valTrunc = false;
+				this.decoder.reset();
+				p = idxeq + 1;
+			} else if (idxamp !== void 0) {
+				++this._fields;
+				let key;
+				const keyTrunc = this._keyTrunc;
+				if (idxamp > p) key = this._key += this.decoder.write(data.toString("binary", p, idxamp));
+				else key = this._key;
+				this._hitLimit = false;
+				this._checkingBytes = true;
+				this._key = "";
+				this._bytesKey = 0;
+				this._keyTrunc = false;
+				this.decoder.reset();
+				if (key.length) this.boy.emit("field", decodeText(key, "binary", this.charset), "", keyTrunc, false);
+				p = idxamp + 1;
+				if (this._fields === this.fieldsLimit) return cb();
+			} else if (this._hitLimit) {
+				if (i > p) this._key += this.decoder.write(data.toString("binary", p, i));
+				p = i;
+				if ((this._bytesKey = this._key.length) === this.fieldNameSizeLimit) {
+					this._checkingBytes = false;
+					this._keyTrunc = true;
+				}
+			} else {
+				if (p < len) this._key += this.decoder.write(data.toString("binary", p));
+				p = len;
+			}
+		} else {
+			idxamp = void 0;
+			for (i = p; i < len; ++i) {
+				if (!this._checkingBytes) ++p;
+				if (data[i] === 38) {
+					idxamp = i;
+					break;
+				}
+				if (this._checkingBytes && this._bytesVal === this.fieldSizeLimit) {
+					this._hitLimit = true;
+					break;
+				} else if (this._checkingBytes) ++this._bytesVal;
+			}
+			if (idxamp !== void 0) {
+				++this._fields;
+				if (idxamp > p) this._val += this.decoder.write(data.toString("binary", p, idxamp));
+				this.boy.emit("field", decodeText(this._key, "binary", this.charset), decodeText(this._val, "binary", this.charset), this._keyTrunc, this._valTrunc);
+				this._state = "key";
+				this._hitLimit = false;
+				this._checkingBytes = true;
+				this._key = "";
+				this._bytesKey = 0;
+				this._keyTrunc = false;
+				this.decoder.reset();
+				p = idxamp + 1;
+				if (this._fields === this.fieldsLimit) return cb();
+			} else if (this._hitLimit) {
+				if (i > p) this._val += this.decoder.write(data.toString("binary", p, i));
+				p = i;
+				if (this._val === "" && this.fieldSizeLimit === 0 || (this._bytesVal = this._val.length) === this.fieldSizeLimit) {
+					this._checkingBytes = false;
+					this._valTrunc = true;
+				}
+			} else {
+				if (p < len) this._val += this.decoder.write(data.toString("binary", p));
+				p = len;
+			}
+		}
+		cb();
+	};
+	UrlEncoded.prototype.end = function() {
+		if (this.boy._done) return;
+		if (this._state === "key" && this._key.length > 0) this.boy.emit("field", decodeText(this._key, "binary", this.charset), "", this._keyTrunc, false);
+		else if (this._state === "val") this.boy.emit("field", decodeText(this._key, "binary", this.charset), decodeText(this._val, "binary", this.charset), this._keyTrunc, this._valTrunc);
+		this.boy._done = true;
+		this.boy.emit("finish");
+	};
+	module.exports = UrlEncoded;
+}));
+//#endregion
+//#region ../../node_modules/.pnpm/@fastify+busboy@3.2.0/node_modules/@fastify/busboy/lib/main.js
+var require_main = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	const WritableStream = __require("node:stream").Writable;
+	const { inherits } = __require("node:util");
+	const Dicer = require_Dicer();
+	const MultipartParser = require_multipart$1();
+	const UrlencodedParser = require_urlencoded();
+	const parseParams = require_parseParams();
+	function Busboy(opts) {
+		if (!(this instanceof Busboy)) return new Busboy(opts);
+		if (typeof opts !== "object") throw new TypeError("Busboy expected an options-Object.");
+		if (typeof opts.headers !== "object") throw new TypeError("Busboy expected an options-Object with headers-attribute.");
+		if (typeof opts.headers["content-type"] !== "string") throw new TypeError("Missing Content-Type-header.");
+		const { headers, ...streamOptions } = opts;
+		this.opts = {
+			autoDestroy: false,
+			...streamOptions
+		};
+		WritableStream.call(this, this.opts);
+		this._done = false;
+		this._parser = this.getParserByHeaders(headers);
+		this._finished = false;
+	}
+	inherits(Busboy, WritableStream);
+	Busboy.prototype.emit = function(ev) {
+		if (ev === "finish") {
+			if (!this._done) {
+				this._parser?.end();
+				return;
+			} else if (this._finished) return;
+			this._finished = true;
+		}
+		WritableStream.prototype.emit.apply(this, arguments);
+	};
+	Busboy.prototype.getParserByHeaders = function(headers) {
+		const parsed = parseParams(headers["content-type"]);
+		const cfg = {
+			defCharset: this.opts.defCharset,
+			fileHwm: this.opts.fileHwm,
+			headers,
+			highWaterMark: this.opts.highWaterMark,
+			isPartAFile: this.opts.isPartAFile,
+			limits: this.opts.limits,
+			parsedConType: parsed,
+			preservePath: this.opts.preservePath
+		};
+		if (MultipartParser.detect.test(parsed[0])) return new MultipartParser(this, cfg);
+		if (UrlencodedParser.detect.test(parsed[0])) return new UrlencodedParser(this, cfg);
+		throw new Error("Unsupported Content-Type.");
+	};
+	Busboy.prototype._write = function(chunk, encoding, cb) {
+		this._parser.write(chunk, cb);
+	};
+	module.exports = Busboy;
+	module.exports.default = Busboy;
+	module.exports.Busboy = Busboy;
+	module.exports.Dicer = Dicer;
+}));
+//#endregion
+//#region ../../node_modules/.pnpm/fastify-plugin@5.1.0/node_modules/fastify-plugin/lib/getPluginName.js
+var require_getPluginName = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	const fpStackTracePattern = /at\s(?:.*\.)?plugin\s.*\n\s*(.*)/;
+	const fileNamePattern = /(\w*(\.\w*)*)\..*/;
+	module.exports = function getPluginName(fn) {
+		if (fn.name.length > 0) return fn.name;
+		const stackTraceLimit = Error.stackTraceLimit;
+		Error.stackTraceLimit = 10;
+		try {
+			throw new Error("anonymous function");
+		} catch (e) {
+			Error.stackTraceLimit = stackTraceLimit;
+			return extractPluginName(e.stack);
+		}
+	};
+	function extractPluginName(stack) {
+		const m = stack.match(fpStackTracePattern);
+		return m ? m[1].split(/[/\\]/).slice(-1)[0].match(fileNamePattern)[1] : "anonymous";
+	}
+	module.exports.extractPluginName = extractPluginName;
+}));
+//#endregion
+//#region ../../node_modules/.pnpm/fastify-plugin@5.1.0/node_modules/fastify-plugin/lib/toCamelCase.js
+var require_toCamelCase = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	module.exports = function toCamelCase(name) {
+		if (name[0] === "@") name = name.slice(1).replace("/", "-");
+		return name.replace(/-(.)/g, function(match, g1) {
+			return g1.toUpperCase();
+		});
+	};
+}));
+//#endregion
+//#region ../../node_modules/.pnpm/fastify-plugin@5.1.0/node_modules/fastify-plugin/plugin.js
+var require_plugin = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	const getPluginName = require_getPluginName();
+	const toCamelCase = require_toCamelCase();
+	let count = 0;
+	function plugin(fn, options = {}) {
+		let autoName = false;
+		if (fn.default !== void 0) fn = fn.default;
+		if (typeof fn !== "function") throw new TypeError(`fastify-plugin expects a function, instead got a '${typeof fn}'`);
+		if (typeof options === "string") options = { fastify: options };
+		if (typeof options !== "object" || Array.isArray(options) || options === null) throw new TypeError("The options object should be an object");
+		if (options.fastify !== void 0 && typeof options.fastify !== "string") throw new TypeError(`fastify-plugin expects a version string, instead got '${typeof options.fastify}'`);
+		if (!options.name) {
+			autoName = true;
+			options.name = getPluginName(fn) + "-auto-" + count++;
+		}
+		fn[Symbol.for("skip-override")] = options.encapsulate !== true;
+		fn[Symbol.for("fastify.display-name")] = options.name;
+		fn[Symbol.for("plugin-meta")] = options;
+		if (!fn.default) fn.default = fn;
+		const camelCase = toCamelCase(options.name);
+		if (!autoName && !fn[camelCase]) fn[camelCase] = fn;
+		return fn;
+	}
+	module.exports = plugin;
+	module.exports.default = plugin;
+	module.exports.fastifyPlugin = plugin;
+}));
+//#endregion
+//#region ../../node_modules/.pnpm/@fastify+multipart@10.0.0/node_modules/@fastify/multipart/lib/generateId.js
+var require_generateId = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	const HEX = [
+		"00",
+		"01",
+		"02",
+		"03",
+		"04",
+		"05",
+		"06",
+		"07",
+		"08",
+		"09",
+		"0a",
+		"0b",
+		"0c",
+		"0d",
+		"0e",
+		"0f",
+		"10",
+		"11",
+		"12",
+		"13",
+		"14",
+		"15",
+		"16",
+		"17",
+		"18",
+		"19",
+		"1a",
+		"1b",
+		"1c",
+		"1d",
+		"1e",
+		"1f",
+		"20",
+		"21",
+		"22",
+		"23",
+		"24",
+		"25",
+		"26",
+		"27",
+		"28",
+		"29",
+		"2a",
+		"2b",
+		"2c",
+		"2d",
+		"2e",
+		"2f",
+		"30",
+		"31",
+		"32",
+		"33",
+		"34",
+		"35",
+		"36",
+		"37",
+		"38",
+		"39",
+		"3a",
+		"3b",
+		"3c",
+		"3d",
+		"3e",
+		"3f",
+		"40",
+		"41",
+		"42",
+		"43",
+		"44",
+		"45",
+		"46",
+		"47",
+		"48",
+		"49",
+		"4a",
+		"4b",
+		"4c",
+		"4d",
+		"4e",
+		"4f",
+		"50",
+		"51",
+		"52",
+		"53",
+		"54",
+		"55",
+		"56",
+		"57",
+		"58",
+		"59",
+		"5a",
+		"5b",
+		"5c",
+		"5d",
+		"5e",
+		"5f",
+		"60",
+		"61",
+		"62",
+		"63",
+		"64",
+		"65",
+		"66",
+		"67",
+		"68",
+		"69",
+		"6a",
+		"6b",
+		"6c",
+		"6d",
+		"6e",
+		"6f",
+		"70",
+		"71",
+		"72",
+		"73",
+		"74",
+		"75",
+		"76",
+		"77",
+		"78",
+		"79",
+		"7a",
+		"7b",
+		"7c",
+		"7d",
+		"7e",
+		"7f",
+		"80",
+		"81",
+		"82",
+		"83",
+		"84",
+		"85",
+		"86",
+		"87",
+		"88",
+		"89",
+		"8a",
+		"8b",
+		"8c",
+		"8d",
+		"8e",
+		"8f",
+		"90",
+		"91",
+		"92",
+		"93",
+		"94",
+		"95",
+		"96",
+		"97",
+		"98",
+		"99",
+		"9a",
+		"9b",
+		"9c",
+		"9d",
+		"9e",
+		"9f",
+		"a0",
+		"a1",
+		"a2",
+		"a3",
+		"a4",
+		"a5",
+		"a6",
+		"a7",
+		"a8",
+		"a9",
+		"aa",
+		"ab",
+		"ac",
+		"ad",
+		"ae",
+		"af",
+		"b0",
+		"b1",
+		"b2",
+		"b3",
+		"b4",
+		"b5",
+		"b6",
+		"b7",
+		"b8",
+		"b9",
+		"ba",
+		"bb",
+		"bc",
+		"bd",
+		"be",
+		"bf",
+		"c0",
+		"c1",
+		"c2",
+		"c3",
+		"c4",
+		"c5",
+		"c6",
+		"c7",
+		"c8",
+		"c9",
+		"ca",
+		"cb",
+		"cc",
+		"cd",
+		"ce",
+		"cf",
+		"d0",
+		"d1",
+		"d2",
+		"d3",
+		"d4",
+		"d5",
+		"d6",
+		"d7",
+		"d8",
+		"d9",
+		"da",
+		"db",
+		"dc",
+		"dd",
+		"de",
+		"df",
+		"e0",
+		"e1",
+		"e2",
+		"e3",
+		"e4",
+		"e5",
+		"e6",
+		"e7",
+		"e8",
+		"e9",
+		"ea",
+		"eb",
+		"ec",
+		"ed",
+		"ee",
+		"ef",
+		"f0",
+		"f1",
+		"f2",
+		"f3",
+		"f4",
+		"f5",
+		"f6",
+		"f7",
+		"f8",
+		"f9",
+		"fa",
+		"fb",
+		"fc",
+		"fd",
+		"fe",
+		"ff"
+	];
+	const random = Math.random;
+	function seed() {
+		return HEX[255 * random() | 0] + HEX[255 * random() | 0] + HEX[255 * random() | 0] + HEX[255 * random() | 0] + HEX[255 * random() | 0] + HEX[255 * random() | 0] + HEX[255 * random() | 0];
+	}
+	module.exports.generateId = (function generateIdFn() {
+		let num = 0;
+		let str = seed();
+		return function generateId() {
+			return num === 255 ? (str = seed()) + HEX[num = 0] : str + HEX[++num];
+		};
+	})();
+}));
+//#endregion
+//#region ../../node_modules/.pnpm/@fastify+error@4.2.0/node_modules/@fastify/error/index.js
+var require_error = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	const { format } = __require("node:util");
+	function toString() {
+		return `${this.name} [${this.code}]: ${this.message}`;
+	}
+	const FastifyGenericErrorSymbol = Symbol.for("fastify-error-generic");
+	function createError(code, message, statusCode = 500, Base = Error, captureStackTrace = createError.captureStackTrace) {
+		const shouldCreateFastifyGenericError = code === FastifyGenericErrorSymbol;
+		if (shouldCreateFastifyGenericError) code = "FST_ERR";
+		if (!code) throw new Error("Fastify error code must not be empty");
+		if (!message) throw new Error("Fastify error message must not be empty");
+		code = code.toUpperCase();
+		!statusCode && (statusCode = void 0);
+		const FastifySpecificErrorSymbol = Symbol.for(`fastify-error ${code}`);
+		function FastifyError(...args) {
+			if (!new.target) return new FastifyError(...args);
+			this.code = code;
+			this.name = "FastifyError";
+			this.statusCode = statusCode;
+			const lastElement = args.length - 1;
+			if (lastElement !== -1 && args[lastElement] && typeof args[lastElement] === "object" && "cause" in args[lastElement]) this.cause = args.pop().cause;
+			this.message = format(message, ...args);
+			Error.stackTraceLimit && captureStackTrace && Error.captureStackTrace(this, FastifyError);
+		}
+		FastifyError.prototype = Object.create(Base.prototype, {
+			constructor: {
+				value: FastifyError,
+				enumerable: false,
+				writable: true,
+				configurable: true
+			},
+			[FastifyGenericErrorSymbol]: {
+				value: true,
+				enumerable: false,
+				writable: false,
+				configurable: false
+			},
+			[FastifySpecificErrorSymbol]: {
+				value: true,
+				enumerable: false,
+				writable: false,
+				configurable: false
+			}
+		});
+		if (shouldCreateFastifyGenericError) Object.defineProperty(FastifyError, Symbol.hasInstance, {
+			value(instance) {
+				return instance && instance[FastifyGenericErrorSymbol];
+			},
+			configurable: false,
+			writable: false,
+			enumerable: false
+		});
+		else Object.defineProperty(FastifyError, Symbol.hasInstance, {
+			value(instance) {
+				return instance && instance[FastifySpecificErrorSymbol];
+			},
+			configurable: false,
+			writable: false,
+			enumerable: false
+		});
+		FastifyError.prototype[Symbol.toStringTag] = "Error";
+		FastifyError.prototype.toString = toString;
+		return FastifyError;
+	}
+	createError.captureStackTrace = true;
+	const FastifyErrorConstructor = createError(FastifyGenericErrorSymbol, "Fastify Error", 500, Error);
+	module.exports = createError;
+	module.exports.FastifyError = FastifyErrorConstructor;
+	module.exports.default = createError;
+	module.exports.createError = createError;
+}));
+//#endregion
+//#region ../../node_modules/.pnpm/@fastify+multipart@10.0.0/node_modules/@fastify/multipart/lib/stream-consumer.js
+var require_stream_consumer = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	module.exports = function streamToNull(stream) {
+		return new Promise((resolve, reject) => {
+			stream.on("data", () => {});
+			stream.on("close", () => {
+				resolve();
+			});
+			stream.on("end", () => {
+				resolve();
+			});
+			stream.on("error", (error) => {
+				reject(error);
+			});
+		});
+	};
+}));
+//#endregion
+//#region ../../node_modules/.pnpm/@fastify+deepmerge@3.2.1/node_modules/@fastify/deepmerge/index.js
+var require_deepmerge = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	const JSON_PROTO = Object.getPrototypeOf({});
+	function defaultIsMergeableObjectFactory() {
+		return function defaultIsMergeableObject(value) {
+			return typeof value === "object" && value !== null && !(value instanceof RegExp) && !(value instanceof Date);
+		};
+	}
+	function deepmergeConstructor(options) {
+		function isNotPrototypeKey(value) {
+			return value !== "constructor" && value !== "prototype" && value !== "__proto__";
+		}
+		function cloneArray(value) {
+			let i = 0;
+			const il = value.length;
+			const result = new Array(il);
+			for (; i < il; ++i) result[i] = clone(value[i]);
+			return result;
+		}
+		function cloneObject(target) {
+			const result = {};
+			if (cloneProtoObject && Object.getPrototypeOf(target) !== JSON_PROTO) return cloneProtoObject(target);
+			const targetKeys = getKeys(target);
+			let i, il, key;
+			for (i = 0, il = targetKeys.length; i < il; ++i) isNotPrototypeKey(key = targetKeys[i]) && (result[key] = clone(target[key]));
+			return result;
+		}
+		function concatArrays(target, source) {
+			const tl = target.length;
+			const sl = source.length;
+			let i = 0;
+			const result = new Array(tl + sl);
+			for (; i < tl; ++i) result[i] = clone(target[i]);
+			for (i = 0; i < sl; ++i) result[i + tl] = clone(source[i]);
+			return result;
+		}
+		const propertyIsEnumerable = Object.prototype.propertyIsEnumerable;
+		function getSymbolsAndKeys(value) {
+			const result = Object.keys(value);
+			const keys = Object.getOwnPropertySymbols(value);
+			for (let i = 0, il = keys.length; i < il; ++i) propertyIsEnumerable.call(value, keys[i]) && result.push(keys[i]);
+			return result;
+		}
+		const getKeys = options?.symbols ? getSymbolsAndKeys : Object.keys;
+		const cloneProtoObject = typeof options?.cloneProtoObject === "function" ? options.cloneProtoObject : void 0;
+		const isMergeableObject = typeof options?.isMergeableObject === "function" ? options.isMergeableObject : defaultIsMergeableObjectFactory();
+		const onlyDefinedProperties = options?.onlyDefinedProperties === true;
+		function isPrimitive(value) {
+			return typeof value !== "object" || value === null;
+		}
+		const mergeArray = options && typeof options.mergeArray === "function" ? options.mergeArray({
+			clone,
+			deepmerge: _deepmerge,
+			getKeys,
+			isMergeableObject
+		}) : concatArrays;
+		function clone(entry) {
+			return isMergeableObject(entry) ? Array.isArray(entry) ? cloneArray(entry) : cloneObject(entry) : entry;
+		}
+		function mergeObject(target, source) {
+			const result = {};
+			const targetKeys = getKeys(target);
+			const sourceKeys = getKeys(source);
+			let i, il, key;
+			for (i = 0, il = targetKeys.length; i < il; ++i) isNotPrototypeKey(key = targetKeys[i]) && sourceKeys.indexOf(key) === -1 && (result[key] = clone(target[key]));
+			for (i = 0, il = sourceKeys.length; i < il; ++i) {
+				if (!isNotPrototypeKey(key = sourceKeys[i])) continue;
+				if (key in target) {
+					if (targetKeys.indexOf(key) !== -1) if (cloneProtoObject && isMergeableObject(source[key]) && Object.getPrototypeOf(source[key]) !== JSON_PROTO) result[key] = cloneProtoObject(source[key]);
+					else result[key] = _deepmerge(target[key], source[key]);
+				} else {
+					if (onlyDefinedProperties && typeof source[key] === "undefined") continue;
+					result[key] = clone(source[key]);
+				}
+			}
+			return result;
+		}
+		function _deepmerge(target, source) {
+			if (onlyDefinedProperties && typeof source === "undefined") return clone(target);
+			const sourceIsArray = Array.isArray(source);
+			const targetIsArray = Array.isArray(target);
+			if (isPrimitive(source)) return source;
+			else if (!isMergeableObject(target)) return clone(source);
+			else if (sourceIsArray && targetIsArray) return mergeArray(target, source);
+			else if (sourceIsArray !== targetIsArray) return clone(source);
+			else return mergeObject(target, source);
+		}
+		function _deepmergeAll() {
+			switch (arguments.length) {
+				case 0: return {};
+				case 1: return clone(arguments[0]);
+				case 2: return _deepmerge(arguments[0], arguments[1]);
+			}
+			let result;
+			for (let i = 0, il = arguments.length; i < il; ++i) result = _deepmerge(result, arguments[i]);
+			return result;
+		}
+		return options?.all ? _deepmergeAll : _deepmerge;
+	}
+	module.exports = deepmergeConstructor;
+	module.exports.default = deepmergeConstructor;
+	module.exports.deepmerge = deepmergeConstructor;
+	Object.defineProperty(module.exports, "isMergeableObject", { get: defaultIsMergeableObjectFactory });
+}));
+//#endregion
+//#region ../../node_modules/.pnpm/secure-json-parse@4.1.0/node_modules/secure-json-parse/index.js
+var require_secure_json_parse = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	const hasBuffer = typeof Buffer !== "undefined";
+	const suspectProtoRx = /"(?:_|\\u005[Ff])(?:_|\\u005[Ff])(?:p|\\u0070)(?:r|\\u0072)(?:o|\\u006[Ff])(?:t|\\u0074)(?:o|\\u006[Ff])(?:_|\\u005[Ff])(?:_|\\u005[Ff])"\s*:/;
+	const suspectConstructorRx = /"(?:c|\\u0063)(?:o|\\u006[Ff])(?:n|\\u006[Ee])(?:s|\\u0073)(?:t|\\u0074)(?:r|\\u0072)(?:u|\\u0075)(?:c|\\u0063)(?:t|\\u0074)(?:o|\\u006[Ff])(?:r|\\u0072)"\s*:/;
+	/**
+	* @description Internal parse function that parses JSON text with security checks.
+	* @private
+	* @param {string|Buffer} text - The JSON text string or Buffer to parse.
+	* @param {Function} [reviver] - The JSON.parse() optional reviver argument.
+	* @param {import('./types').ParseOptions} [options] - Optional configuration object.
+	* @returns {*} The parsed object.
+	* @throws {SyntaxError} If a forbidden prototype property is found and `options.protoAction` or
+	* `options.constructorAction` is `'error'`.
+	*/
+	function _parse(text, reviver, options) {
+		if (options == null) {
+			if (reviver !== null && typeof reviver === "object") {
+				options = reviver;
+				reviver = void 0;
+			}
+		}
+		if (hasBuffer && Buffer.isBuffer(text)) text = text.toString();
+		if (text && text.charCodeAt(0) === 65279) text = text.slice(1);
+		const obj = JSON.parse(text, reviver);
+		if (obj === null || typeof obj !== "object") return obj;
+		const protoAction = options && options.protoAction || "error";
+		const constructorAction = options && options.constructorAction || "error";
+		if (protoAction === "ignore" && constructorAction === "ignore") return obj;
+		if (protoAction !== "ignore" && constructorAction !== "ignore") {
+			if (suspectProtoRx.test(text) === false && suspectConstructorRx.test(text) === false) return obj;
+		} else if (protoAction !== "ignore" && constructorAction === "ignore") {
+			if (suspectProtoRx.test(text) === false) return obj;
+		} else if (suspectConstructorRx.test(text) === false) return obj;
+		return filter(obj, {
+			protoAction,
+			constructorAction,
+			safe: options && options.safe
+		});
+	}
+	/**
+	* @description Scans and filters an object for forbidden prototype properties.
+	* @param {Object} obj - The object being scanned.
+	* @param {import('./types').ParseOptions} [options] - Optional configuration object.
+	* @returns {Object|null} The filtered object, or `null` if safe mode is enabled and issues are found.
+	* @throws {SyntaxError} If a forbidden prototype property is found and `options.protoAction` or
+	* `options.constructorAction` is `'error'`.
+	*/
+	function filter(obj, { protoAction = "error", constructorAction = "error", safe } = {}) {
+		let next = [obj];
+		while (next.length) {
+			const nodes = next;
+			next = [];
+			for (const node of nodes) {
+				if (protoAction !== "ignore" && Object.prototype.hasOwnProperty.call(node, "__proto__")) {
+					if (safe === true) return null;
+					else if (protoAction === "error") throw new SyntaxError("Object contains forbidden prototype property");
+					delete node.__proto__;
+				}
+				if (constructorAction !== "ignore" && Object.prototype.hasOwnProperty.call(node, "constructor") && node.constructor !== null && typeof node.constructor === "object" && Object.prototype.hasOwnProperty.call(node.constructor, "prototype")) {
+					if (safe === true) return null;
+					else if (constructorAction === "error") throw new SyntaxError("Object contains forbidden prototype property");
+					delete node.constructor;
+				}
+				for (const key in node) {
+					const value = node[key];
+					if (value && typeof value === "object") next.push(value);
+				}
+			}
+		}
+		return obj;
+	}
+	/**
+	* @description Parses a given JSON-formatted text into an object.
+	* @param {string|Buffer} text - The JSON text string or Buffer to parse.
+	* @param {Function} [reviver] - The `JSON.parse()` optional reviver argument, or options object.
+	* @param {import('./types').ParseOptions} [options] - Optional configuration object.
+	* @returns {*} The parsed object.
+	* @throws {SyntaxError} If the JSON text is malformed or contains forbidden prototype properties
+	* when `options.protoAction` or `options.constructorAction` is `'error'`.
+	*/
+	function parse(text, reviver, options) {
+		const { stackTraceLimit } = Error;
+		Error.stackTraceLimit = 0;
+		try {
+			return _parse(text, reviver, options);
+		} finally {
+			Error.stackTraceLimit = stackTraceLimit;
+		}
+	}
+	/**
+	* @description Safely parses a given JSON-formatted text into an object.
+	* @param {string|Buffer} text - The JSON text string or Buffer to parse.
+	* @param {Function} [reviver] - The `JSON.parse()` optional reviver argument.
+	* @returns {*|null|undefined} The parsed object, `null` if security issues found, or `undefined` on parse error.
+	*/
+	function safeParse(text, reviver) {
+		const { stackTraceLimit } = Error;
+		Error.stackTraceLimit = 0;
+		try {
+			return _parse(text, reviver, { safe: true });
+		} catch {
+			return;
+		} finally {
+			Error.stackTraceLimit = stackTraceLimit;
+		}
+	}
+	module.exports = parse;
+	module.exports.default = parse;
+	module.exports.parse = parse;
+	module.exports.safeParse = safeParse;
+	module.exports.scan = filter;
+}));
+//#endregion
+//#region ../server/dist/app-Dlx5GuFi.mjs
+var import_multipart = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin(((exports, module) => {
+	const Busboy = require_main();
+	const os = __require("node:os");
+	const fp = require_plugin();
+	const { createWriteStream: createWriteStream$1 } = __require("node:fs");
+	const { unlink } = __require("node:fs/promises");
+	const path = __require("node:path");
+	const { generateId } = require_generateId();
+	const createError = require_error();
+	const streamToNull = require_stream_consumer();
+	const deepmergeAll = require_deepmerge()({ all: true });
+	const { PassThrough, Readable } = __require("node:stream");
+	const { pipeline: pump } = __require("node:stream/promises");
+	const secureJSON = require_secure_json_parse();
+	const kMultipart = Symbol("multipart");
+	const kMultipartHandler = Symbol("multipartHandler");
+	const kSavedRequestFilesResult = Symbol("savedRequestFilesResult");
+	const PartsLimitError = createError("FST_PARTS_LIMIT", "reach parts limit", 413);
+	const FilesLimitError = createError("FST_FILES_LIMIT", "reach files limit", 413);
+	const FieldsLimitError = createError("FST_FIELDS_LIMIT", "reach fields limit", 413);
+	const RequestFileTooLargeError = createError("FST_REQ_FILE_TOO_LARGE", "request file too large", 413);
+	const PrototypeViolationError = createError("FST_PROTO_VIOLATION", "prototype property is not allowed as field name", 400);
+	const InvalidMultipartContentTypeError = createError("FST_INVALID_MULTIPART_CONTENT_TYPE", "the request is not multipart", 406);
+	const InvalidJSONFieldError = createError("FST_INVALID_JSON_FIELD_ERROR", "a request field is not a valid JSON as declared by its Content-Type", 406);
+	const FileBufferNotFoundError = createError("FST_FILE_BUFFER_NOT_FOUND", "the file buffer was not found", 500);
+	const NoFormData = createError("FST_NO_FORM_DATA", "FormData is not available", 500);
+	function setMultipart(req, _payload, done) {
+		req[kMultipart] = true;
+		done();
+	}
+	function busboy(options) {
+		try {
+			return new Busboy(options);
+		} catch (error) {
+			const errorEmitter = new PassThrough();
+			process.nextTick(function() {
+				errorEmitter.emit("error", error);
+			});
+			return errorEmitter;
+		}
+	}
+	function fastifyMultipart(fastify, options, done) {
+		options.limits = {
+			...options.limits,
+			parts: options.limits?.parts || 1e3,
+			fileSize: options.limits?.fileSize || fastify.initialConfig.bodyLimit
+		};
+		const attachFieldsToBody = options.attachFieldsToBody;
+		if (attachFieldsToBody === true || attachFieldsToBody === "keyValues") {
+			if (typeof options.sharedSchemaId === "string" && attachFieldsToBody === true) fastify.addSchema({
+				$id: options.sharedSchemaId,
+				type: "object",
+				properties: {
+					fieldname: { type: "string" },
+					encoding: { type: "string" },
+					filename: { type: "string" },
+					mimetype: { type: "string" }
+				}
+			});
+			fastify.addHook("preValidation", async function(req) {
+				if (!req.isMultipart()) return;
+				for await (const part of req.parts(req.routeOptions.config.multipartOptions)) {
+					req.body = part.fields;
+					if (part.file) if (options.onFile) await options.onFile.call(req, part);
+					else await part.toBuffer();
+				}
+				if (attachFieldsToBody === "keyValues") {
+					const body = {};
+					if (req.body) {
+						const reqBodyKeys = Object.keys(req.body);
+						for (let i = 0; i < reqBodyKeys.length; ++i) {
+							const key = reqBodyKeys[i];
+							const field = req.body[key];
+							if (field.value !== void 0) body[key] = field.value;
+							else if (field._buf) body[key] = field._buf;
+							else if (Array.isArray(field)) {
+								const items = [];
+								for (let i = 0; i < field.length; ++i) {
+									const item = field[i];
+									if (item.value !== void 0) items.push(item.value);
+									else if (item._buf) items.push(item._buf);
+								}
+								if (items.length) body[key] = items;
+							}
+						}
+					}
+					req.body = body;
+				}
+			});
+			/* istanbul ignore next */
+			if (globalThis.FormData && !fastify.hasRequestDecorator("formData")) fastify.decorateRequest("formData", async function() {
+				const formData = new FormData();
+				for (const key in this.body) {
+					const value = this.body[key];
+					if (Array.isArray(value)) for (const item of value) await append(key, item);
+					else await append(key, value);
+				}
+				async function append(key, entry) {
+					/* c8 ignore next: Buffer.isBuffer is not covered and causing `npm test` to fail */
+					if (entry.type === "file" || attachFieldsToBody === "keyValues" && Buffer.isBuffer(entry)) formData.append(key, new Blob([await entry.toBuffer()], { type: entry.mimetype }), entry.filename);
+					else formData.append(key, entry.value);
+				}
+				return formData;
+			});
+		}
+		/* istanbul ignore next */
+		if (!fastify.hasRequestDecorator("formData")) fastify.decorateRequest("formData", async function() {
+			/* c8 ignore next: Next line is not covered and causing `npm test` to fail */
+			throw new NoFormData();
+		});
+		const defaultThrowFileSizeLimit = typeof options.throwFileSizeLimit === "boolean" ? options.throwFileSizeLimit : true;
+		fastify.decorate("multipartErrors", {
+			PartsLimitError,
+			FilesLimitError,
+			FieldsLimitError,
+			PrototypeViolationError,
+			InvalidMultipartContentTypeError,
+			RequestFileTooLargeError,
+			FileBufferNotFoundError
+		});
+		fastify.addContentTypeParser("multipart/form-data", setMultipart);
+		fastify.decorateRequest(kMultipart, false);
+		fastify.decorateRequest(kMultipartHandler, handleMultipart);
+		fastify.decorateRequest(kSavedRequestFilesResult, null);
+		fastify.decorateRequest("parts", getMultipartIterator);
+		fastify.decorateRequest("isMultipart", isMultipart);
+		fastify.decorateRequest("tmpUploads", null);
+		fastify.decorateRequest("savedRequestFiles", null);
+		fastify.decorateRequest("file", getMultipartFile);
+		fastify.decorateRequest("files", getMultipartFiles);
+		fastify.decorateRequest("saveRequestFiles", saveRequestFiles);
+		fastify.decorateRequest("cleanRequestFiles", cleanRequestFiles);
+		fastify.addHook("onResponse", async (request) => {
+			await request.cleanRequestFiles();
+		});
+		function isMultipart() {
+			return this[kMultipart];
+		}
+		function handleMultipart(opts = {}) {
+			if (!this.isMultipart()) throw new InvalidMultipartContentTypeError();
+			this.log.debug("starting multipart parsing");
+			let values = [];
+			let pendingHandler = null;
+			const ch = (val) => {
+				if (pendingHandler) {
+					pendingHandler(val);
+					pendingHandler = null;
+				} else values.push(val);
+			};
+			const handle = (handler) => {
+				if (values.length > 0) {
+					const value = values[0];
+					values = values.slice(1);
+					handler(value);
+				} else pendingHandler = handler;
+			};
+			const parts = () => {
+				return new Promise((resolve, reject) => {
+					handle((val) => {
+						if (val instanceof Error) if (val.message === "Unexpected end of multipart data") resolve(null);
+						else reject(val);
+						else resolve(val);
+					});
+				});
+			};
+			const body = {};
+			let lastError = null;
+			let currentFile = null;
+			const request = this.raw;
+			const busboyOptions = deepmergeAll({ headers: request.headers }, options, opts);
+			this.log.trace({ busboyOptions }, "Providing options to busboy");
+			const bb = busboy(busboyOptions);
+			request.on("close", cleanup);
+			request.on("error", cleanup);
+			bb.on("field", onField).on("file", onFile).on("end", cleanup).on("finish", cleanup).on("close", cleanup).on("error", cleanup);
+			bb.on("partsLimit", function() {
+				const err = new PartsLimitError();
+				onError(err);
+				process.nextTick(() => cleanup(err));
+			});
+			bb.on("filesLimit", function() {
+				const err = new FilesLimitError();
+				onError(err);
+				process.nextTick(() => cleanup(err));
+			});
+			bb.on("fieldsLimit", function() {
+				const err = new FieldsLimitError();
+				onError(err);
+				process.nextTick(() => cleanup(err));
+			});
+			request.pipe(bb);
+			function onField(name, fieldValue, fieldnameTruncated, valueTruncated, encoding, contentType) {
+				if (name in Object.prototype) {
+					onError(new PrototypeViolationError());
+					return;
+				}
+				if (contentType.startsWith("application/json")) {
+					if (valueTruncated) {
+						onError(new InvalidJSONFieldError());
+						return;
+					}
+					try {
+						fieldValue = secureJSON.parse(fieldValue);
+						contentType = "application/json";
+					} catch {
+						onError(new InvalidJSONFieldError());
+						return;
+					}
+				}
+				const value = {
+					type: "field",
+					fieldname: name,
+					mimetype: contentType,
+					encoding,
+					value: fieldValue,
+					fieldnameTruncated,
+					valueTruncated,
+					fields: body
+				};
+				if (body[name] === void 0) body[name] = value;
+				else if (Array.isArray(body[name])) body[name].push(value);
+				else body[name] = [body[name], value];
+				ch(value);
+			}
+			function onFile(name, file, filename, encoding, mimetype) {
+				if (name in Object.prototype) {
+					streamToNull(file).catch(() => {});
+					onError(new PrototypeViolationError());
+					return;
+				}
+				const throwFileSizeLimit = typeof opts.throwFileSizeLimit === "boolean" ? opts.throwFileSizeLimit : defaultThrowFileSizeLimit;
+				const value = {
+					type: "file",
+					fieldname: name,
+					filename,
+					encoding,
+					mimetype,
+					file,
+					fields: body,
+					_buf: null,
+					async toBuffer() {
+						if (this._buf) return this._buf;
+						const fileChunks = [];
+						let err;
+						for await (const chunk of this.file) {
+							fileChunks.push(chunk);
+							if (throwFileSizeLimit && this.file.truncated) {
+								err = new RequestFileTooLargeError();
+								err.part = this;
+								onError(err);
+								fileChunks.length = 0;
+							}
+						}
+						if (err) throw err;
+						this._buf = Buffer.concat(fileChunks);
+						return this._buf;
+					}
+				};
+				file.on("error", function(err) {
+					if (err.message && err.message.includes("terminated early")) onError(err);
+				});
+				if (throwFileSizeLimit) file.on("limit", function() {
+					const err = new RequestFileTooLargeError();
+					err.part = value;
+					onError(err);
+				});
+				if (body[name] === void 0) body[name] = value;
+				else if (Array.isArray(body[name])) body[name].push(value);
+				else body[name] = [body[name], value];
+				currentFile = file;
+				ch(value);
+			}
+			function onError(err) {
+				lastError = err;
+				currentFile = null;
+			}
+			function cleanup(err) {
+				request.unpipe(bb);
+				if ((err || request.aborted) && currentFile) {
+					currentFile.destroy();
+					currentFile = null;
+				}
+				ch(err || lastError || null);
+			}
+			return parts;
+		}
+		async function saveRequestFiles(options) {
+			if (this[kSavedRequestFilesResult]) return this[kSavedRequestFilesResult];
+			let parts;
+			let values = {};
+			if (attachFieldsToBody === true || attachFieldsToBody === "keyValues") {
+				parts = this.body ? filesFromFields.call(this, this.body) : [];
+				values = this.body || {};
+			} else parts = this.parts(options);
+			this.savedRequestFiles = [];
+			const tmpdir = options?.tmpdir || os.tmpdir();
+			this.tmpUploads = [];
+			let i = 0;
+			for await (const part of parts) {
+				values = part.fields;
+				if (!part.file) continue;
+				const filepath = path.join(tmpdir, generateId() + path.extname(part.filename || "file" + i++));
+				const target = createWriteStream$1(filepath);
+				try {
+					this.tmpUploads.push(filepath);
+					await pump(part.file, target);
+					this.savedRequestFiles.push({
+						...part,
+						filepath
+					});
+				} catch (err) {
+					target.destroy();
+					await this.cleanRequestFiles();
+					this.log.error({ err }, "save request file");
+					throw err;
+				}
+			}
+			this[kSavedRequestFilesResult] = {
+				files: this.savedRequestFiles,
+				values
+			};
+			return this[kSavedRequestFilesResult];
+		}
+		function* filesFromFields(container) {
+			try {
+				const fields = Array.isArray(container) ? container : Object.values(container);
+				for (let i = 0; i < fields.length; ++i) {
+					const field = fields[i];
+					if (Array.isArray(field)) for (const subField of filesFromFields.call(this, field)) yield subField;
+					if (!field.file) continue;
+					if (!field._buf) throw new FileBufferNotFoundError();
+					field.file = Readable.from(field._buf);
+					yield field;
+				}
+			} catch (err) {
+				this.log.error({ err }, "save request file failed");
+				throw err;
+			}
+		}
+		async function cleanRequestFiles() {
+			if (!this.tmpUploads) return;
+			for (let i = 0; i < this.tmpUploads.length; ++i) {
+				const filepath = this.tmpUploads[i];
+				try {
+					await unlink(filepath);
+				} 				/* c8 ignore start */catch (error)  {
+					this.log.error(error, "Could not delete file");
+				}
+			}
+		}
+		async function getMultipartFile(options) {
+			const parts = this[kMultipartHandler](options);
+			let part;
+			while ((part = await parts()) != null) if (part.file) return part;
+		}
+		async function* getMultipartFiles(options) {
+			const parts = this[kMultipartHandler](options);
+			let part;
+			while ((part = await parts()) != null) if (part.file) yield part;
+		}
+		async function* getMultipartIterator(options) {
+			const parts = this[kMultipartHandler](options);
+			let part;
+			while ((part = await parts()) != null) yield part;
+		}
+		done();
+	}
+	/**
+	* Adds a new type `isFile` to help @fastify/swagger generate the correct schema.
+	*/
+	function ajvFilePlugin(ajv) {
+		return ajv.addKeyword({
+			keyword: "isFile",
+			compile: (_schema, parent) => {
+				parent.type = "string";
+				parent.format = "binary";
+				delete parent.isFile;
+				return (field) => !!field.file;
+			},
+			error: { message: "should be a file" }
 		});
-		return value;
-	}
-	if (type === "password") return password({ message: prompt.message });
-	return input({
-		message: prompt.message,
-		default: prompt.default
-	});
-}
-/** Walk schema to find the env var name for a given dot path. */
-function findEnvVar(schema, dotPath) {
-	const parts = dotPath.split(".");
-	let current = schema;
-	for (const part of parts) {
-		if (current === null || current === void 0 || typeof current !== "object") return void 0;
-		const obj = current;
-		if (obj._tag === "optional") current = obj.shape[part];
-		else current = obj[part];
-	}
-	if (typeof current === "object" && current !== null && "_tag" in current) {
-		const field = current;
-		if (field._tag === "field") return field.options?.env;
-	}
-}
-function setNestedByDot(obj, dotPath, value) {
-	const parts = dotPath.split(".");
-	let current = obj;
-	for (let i = 0; i < parts.length - 1; i++) {
-		const key = parts[i];
-		if (key === void 0) continue;
-		if (!(key in current) || typeof current[key] !== "object" || current[key] === null) current[key] = {};
-		current = current[key];
 	}
-	const lastKey = parts.at(-1);
-	if (lastKey !== void 0) current[lastKey] = value;
-}
-//#endregion
-//#region ../server/dist/app-BGneEeZO.mjs
+	/**
+	* These export configurations enable JS and TS developers
+	* to consumer fastify in whatever way best suits their needs.
+	*/
+	module.exports = fp(fastifyMultipart, {
+		fastify: "5.x",
+		name: "@fastify/multipart"
+	});
+	module.exports.default = fastifyMultipart;
+	module.exports.fastifyMultipart = fastifyMultipart;
+	module.exports.ajvFilePlugin = ajvFilePlugin;
+})))(), 1);
 var __defProp = Object.defineProperty;
 var __exportAll = (all, no_symbols) => {
 	let target = {};
@@ -5280,6 +8057,8 @@ function parseId$1(raw) {
 async function adminAdapterMappingRoutes(app) {
 	app.get("/", async (request) => {
 		const scope = memberScope(request);
+		const conditions = [eq(agents.organizationId, scope.organizationId)];
+		if (scope.role !== "admin") conditions.push(eq(agents.managerId, scope.memberId));
 		return (await app.db.select({
 			id: adapterAgentMappings.id,
 			platform: adapterAgentMappings.platform,
@@ -5288,7 +8067,7 @@ async function adminAdapterMappingRoutes(app) {
 			boundVia: adapterAgentMappings.boundVia,
 			displayName: adapterAgentMappings.displayName,
 			createdAt: adapterAgentMappings.createdAt
-		}).from(adapterAgentMappings).innerJoin(agents, eq(agents.uuid, adapterAgentMappings.agentId)).where(eq(agents.organizationId, scope.organizationId)).orderBy(desc(adapterAgentMappings.createdAt))).map((r) => ({
+		}).from(adapterAgentMappings).innerJoin(agents, eq(agents.uuid, adapterAgentMappings.agentId)).where(and(...conditions)).orderBy(desc(adapterAgentMappings.createdAt))).map((r) => ({
 			id: r.id,
 			platform: r.platform,
 			externalUserId: r.externalUserId,
@@ -5336,11 +8115,6 @@ async function adminAdapterMappingRoutes(app) {
 		return reply.status(204).send();
 	});
 }
-async function adminAdapterStatusRoutes(app) {
-	app.get("/", async () => {
-		return app.adapterManager.getBotStatuses();
-	});
-}
 /** Bot credentials for external platform adapters. Credentials are encrypted at application layer (AES-256-GCM). */
 const adapterConfigs = pgTable("adapter_configs", {
 	id: serial("id").primaryKey(),
@@ -5351,6 +8125,17 @@ const adapterConfigs = pgTable("adapter_configs", {
 	createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
 	updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
 }, (t) => [unique("uq_adapter_configs_agent_platform").on(t.agentId, t.platform)]);
+async function adminAdapterStatusRoutes(app) {
+	app.get("/", async (request) => {
+		const scope = memberScope(request);
+		const conditions = [eq(agents.organizationId, scope.organizationId), ne(agents.status, "deleted")];
+		if (scope.role !== "admin") conditions.push(eq(agents.managerId, scope.memberId));
+		const visibleRows = await app.db.select({ id: adapterConfigs.id }).from(adapterConfigs).innerJoin(agents, eq(agents.uuid, adapterConfigs.agentId)).where(and(...conditions));
+		const visibleIds = new Set(visibleRows.map((r) => r.id));
+		if (visibleIds.size === 0) return [];
+		return app.adapterManager.getBotStatuses().filter((s) => visibleIds.has(s.configId));
+	});
+}
 const ALGORITHM = "aes-256-gcm";
 const IV_LENGTH = 12;
 const AUTH_TAG_LENGTH = 16;
@@ -5464,6 +8249,30 @@ function toResponse(row) {
 async function listAdapterConfigs(db) {
 	return (await db.select().from(adapterConfigs).orderBy(desc(adapterConfigs.createdAt))).map(toResponse);
 }
+/**
+* Scoped variant used by the member-facing admin route.
+*
+*   - admin: every adapter config whose agent belongs to the caller's org.
+*   - non-admin: only adapter configs bound to agents the caller manages
+*     (Rule: bindings follow manageability).
+*
+* Kept as a separate function so internal self-service callers
+* (`agent/feishu-bot.ts`) that only need a raw read don't accidentally pay
+* for the join.
+*/
+async function listAdapterConfigsForMember(db, scope) {
+	const conditions = [eq(agents.organizationId, scope.organizationId), ne(agents.status, "deleted")];
+	if (scope.role !== "admin") conditions.push(eq(agents.managerId, scope.memberId));
+	return (await db.select({
+		id: adapterConfigs.id,
+		platform: adapterConfigs.platform,
+		agentId: adapterConfigs.agentId,
+		credentials: adapterConfigs.credentials,
+		status: adapterConfigs.status,
+		createdAt: adapterConfigs.createdAt,
+		updatedAt: adapterConfigs.updatedAt
+	}).from(adapterConfigs).innerJoin(agents, eq(agents.uuid, adapterConfigs.agentId)).where(and(...conditions)).orderBy(desc(adapterConfigs.createdAt))).map(toResponse);
+}
 async function getAdapterConfig(db, id) {
 	const [row] = await db.select().from(adapterConfigs).where(eq(adapterConfigs.id, id)).limit(1);
 	if (!row) throw new NotFoundError(`Adapter config "${id}" not found`);
@@ -5513,8 +8322,9 @@ function parseId(raw) {
 	return id;
 }
 async function adminAdapterRoutes(app) {
-	app.get("/", async () => {
-		return (await listAdapterConfigs(app.db)).map((c) => ({
+	app.get("/", async (request) => {
+		const scope = memberScope(request);
+		return (await listAdapterConfigsForMember(app.db, scope)).map((c) => ({
 			...c,
 			createdAt: c.createdAt.toISOString(),
 			updatedAt: c.updatedAt.toISOString()
@@ -5776,6 +8586,47 @@ async function getAgent(db, uuid) {
 	return agent;
 }
 /**
+* Admin-only variant: return every non-deleted agent in the org, ignoring
+* the visibility filter. Used by the `/admin` "All Agents" view so a team
+* admin can see and act on private agents owned by other members. The
+* route layer is responsible for gating this to admin callers — the
+* service does not enforce role by itself, but it does enforce org scope
+* and the not-deleted predicate.
+*/
+async function listAgentsForAdmin(db, scope, limit, cursor) {
+	const conditions = [eq(agents.organizationId, scope.organizationId), ne(agents.status, AGENT_STATUSES.DELETED)];
+	if (cursor) conditions.push(lt(agents.createdAt, new Date(cursor)));
+	const where = and(...conditions);
+	const rows = await db.select({
+		uuid: agents.uuid,
+		name: agents.name,
+		organizationId: agents.organizationId,
+		type: agents.type,
+		displayName: agents.displayName,
+		delegateMention: agents.delegateMention,
+		inboxId: agents.inboxId,
+		status: agents.status,
+		cloudUserId: agents.cloudUserId,
+		visibility: agents.visibility,
+		metadata: agents.metadata,
+		managerId: agents.managerId,
+		clientId: agents.clientId,
+		createdAt: agents.createdAt,
+		updatedAt: agents.updatedAt,
+		presenceStatus: agentPresence.status,
+		runtimeType: agentPresence.runtimeType,
+		runtimeState: agentPresence.runtimeState,
+		activeSessions: agentPresence.activeSessions
+	}).from(agents).leftJoin(agentPresence, eq(agents.uuid, agentPresence.agentId)).where(where).orderBy(desc(agents.createdAt)).limit(limit + 1);
+	const hasMore = rows.length > limit;
+	const items = hasMore ? rows.slice(0, limit) : rows;
+	const last = items[items.length - 1];
+	return {
+		items,
+		nextCursor: hasMore && last ? last.createdAt.toISOString() : null
+	};
+}
+/**
 * List agents visible to a specific member.
 * Uses agentVisibilityCondition from access-control (same rules for all roles).
 */
@@ -6271,17 +9122,31 @@ async function cleanupStalePresence(db, staleSeconds = 60) {
   `)).length;
 }
 /**
-* Assert the caller's user owns this client. Throws 404 for both "not found"
+* Assert the caller can act on this client. Throws 404 for both "not found"
 * and "not yours" to prevent UUID enumeration across org/user boundaries.
-* Used by management routes (disconnect, retire, single GET) so a cross-org
-* admin cannot operate on another user's client.
+*
+*   - member: owner match (`row.user_id == scope.userId`).
+*   - admin: any client whose owner is a member of the admin's own org.
+*
+* Legacy unclaimed rows (`user_id IS NULL`) have no org association we can
+* verify — we explicitly refuse to grant admin access to them so a
+* cross-tenant admin can't operate on another org's orphan rows. These
+* orphans are surfaced for self-service re-registration only; the owning
+* operator must claim the row via `first-tree-hub connect` before any
+* admin action becomes available.
 */
-async function assertClientOwner(db, clientId, userId) {
+async function assertClientOwner(db, clientId, scope) {
 	const [row] = await db.select({
 		id: clients.id,
 		userId: clients.userId
 	}).from(clients).where(eq(clients.id, clientId)).limit(1);
-	if (!row || row.userId !== userId) throw new NotFoundError(`Client "${clientId}" not found`);
+	if (!row) throw new NotFoundError(`Client "${clientId}" not found`);
+	if (row.userId === scope.userId) return;
+	if (scope.role === "admin" && row.userId !== null) {
+		const [sibling] = await db.select({ id: members.id }).from(members).where(and(eq(members.userId, row.userId), eq(members.organizationId, scope.organizationId))).limit(1);
+		if (sibling) return;
+	}
+	throw new NotFoundError(`Client "${clientId}" not found`);
 }
 /**
 * Upsert the clients row for a given `client_id` under an authenticated user.
@@ -6361,8 +9226,32 @@ async function listActiveAgentsPinnedToClient(db, clientId) {
 		type: agents.type
 	}).from(agents).where(and(eq(agents.clientId, clientId), ne(agents.status, "deleted")));
 }
-async function listClients(db, userId) {
-	const rows = await db.select().from(clients).where(eq(clients.userId, userId));
+/**
+* Scope-aware client listing.
+*
+*   - member: only rows where `user_id = scope.userId`.
+*   - admin: every claimed row whose owner is a member of the caller's
+*     organization.
+*
+* Legacy unclaimed rows (`user_id IS NULL`) are intentionally hidden from
+* both roles — the `clients` table has no org column, so we cannot verify
+* which org an orphan belongs to. Exposing them to admin would leak
+* orphans across tenants. The owning operator reclaims the row via
+* `first-tree-hub connect`, after which it appears in their list.
+*/
+async function listClients(db, scope) {
+	const rows = scope.role === "admin" ? await db.selectDistinct({
+		id: clients.id,
+		userId: clients.userId,
+		status: clients.status,
+		sdkVersion: clients.sdkVersion,
+		hostname: clients.hostname,
+		os: clients.os,
+		instanceId: clients.instanceId,
+		connectedAt: clients.connectedAt,
+		lastSeenAt: clients.lastSeenAt,
+		metadata: clients.metadata
+	}).from(clients).innerJoin(members, eq(members.userId, clients.userId)).where(eq(members.organizationId, scope.organizationId)) : await db.select().from(clients).where(eq(clients.userId, scope.userId));
 	const counts = await db.select({
 		clientId: agents.clientId,
 		count: sql`count(*)::int`
@@ -6827,6 +9716,33 @@ async function adminAgentRoutes(app) {
 			nextCursor: result.nextCursor
 		};
 	});
+	/**
+	* Admin-only: every agent in the caller's org, skipping the visibility
+	* filter applied on the regular `/agents` list. Private agents owned by
+	* other members show up here so an admin can reassign or troubleshoot.
+	* Role gating is enforced here — the parent route group does NOT add
+	* adminOnly because the member-facing `GET /` is shared.
+	*/
+	app.get("/all", async (request) => {
+		const scope = memberScope(request);
+		if (scope.role !== "admin") throw new ForbiddenError("Admin role required");
+		const query = paginationQuerySchema.parse(request.query);
+		const result = await listAgentsForAdmin(app.db, scope, query.limit, query.cursor);
+		return {
+			items: result.items.map((a) => ({
+				...a,
+				managerId: a.managerId ?? null,
+				presenceStatus: a.presenceStatus ?? "offline",
+				createdAt: a.createdAt.toISOString(),
+				updatedAt: a.updatedAt.toISOString(),
+				clientId: a.clientId ?? null,
+				runtimeType: a.runtimeType ?? null,
+				runtimeState: a.runtimeState ?? null,
+				activeSessions: a.activeSessions ?? null
+			})),
+			nextCursor: result.nextCursor
+		};
+	});
 	app.post("/", async (request, reply) => {
 		const scope = memberScope(request);
 		const body = createAgentSchema.parse(request.body);
@@ -7113,6 +10029,24 @@ async function adminChatRoutes(app) {
 			}))
 		};
 	});
+	/** Rename (or clear) a chat's topic. Requires participation or supervision — same gate as reading it. */
+	app.patch("/:chatId", async (request) => {
+		const { chatId } = request.params;
+		const scope = memberScope(request);
+		await assertChatAccess(app.db, scope, chatId);
+		const body = updateChatSchema.parse(request.body);
+		const nextTopic = body.topic && body.topic.length > 0 ? body.topic : null;
+		const [updated] = await app.db.update(chats).set({
+			topic: nextTopic,
+			updatedAt: /* @__PURE__ */ new Date()
+		}).where(eq(chats.id, chatId)).returning();
+		if (!updated) throw new Error("Unexpected: chat missing after update");
+		return {
+			...updated,
+			createdAt: updated.createdAt.toISOString(),
+			updatedAt: updated.updatedAt.toISOString()
+		};
+	});
 	/** List messages in a chat with delivery status (requires participation or supervision) */
 	app.get("/:chatId/messages", async (request) => {
 		const { chatId } = request.params;
@@ -7232,10 +10166,18 @@ const agentChatSessions = pgTable("agent_chat_sessions", {
 	state: text("state").notNull(),
 	updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
 }, (table) => [primaryKey({ columns: [table.agentId, table.chatId] })]);
-/** Upsert a session state, refresh materialized aggregates on agent_presence, and emit org-scoped NOTIFY. */
+/**
+* Upsert session state + refresh presence aggregates + NOTIFY.
+*
+* Revival defense: an admin-terminated (`evicted`) row is immutable; a client
+* report for the same chatId is silently dropped after the FOR UPDATE check.
+*/
 async function upsertSessionState(db, agentId, chatId, state, organizationId, notifier) {
 	const now = /* @__PURE__ */ new Date();
+	let wrote = false;
 	await db.transaction(async (tx) => {
+		const [existing] = await tx.select({ state: agentChatSessions.state }).from(agentChatSessions).where(and(eq(agentChatSessions.agentId, agentId), eq(agentChatSessions.chatId, chatId))).for("update");
+		if (existing?.state === "evicted") return;
 		await tx.insert(agentChatSessions).values({
 			agentId,
 			chatId,
@@ -7259,8 +10201,9 @@ async function upsertSessionState(db, agentId, chatId, state, organizationId, no
 			totalSessions,
 			lastSeenAt: now
 		}).where(eq(agentPresence.agentId, agentId));
+		wrote = true;
 	});
-	if (notifier) notifier.notifySessionStateChange(agentId, chatId, state, organizationId).catch(() => {});
+	if (wrote && notifier) notifier.notifySessionStateChange(agentId, chatId, state, organizationId).catch(() => {});
 }
 async function resetActivity(db, agentId) {
 	const now = /* @__PURE__ */ new Date();
@@ -7313,22 +10256,6 @@ async function listAgentsWithRuntime(db, scope) {
 		type: agents.type
 	}).from(agentPresence).innerJoin(agents, eq(agentPresence.agentId, agents.uuid)).where(and(isNotNull(agentPresence.runtimeState), agentVisibilityCondition(scope)));
 }
-/**
-* Clean up stale session rows from agent_chat_sessions.
-* Removes evicted rows older than staleSeconds and suspended rows older than staleSeconds.
-* Returns the number of rows deleted.
-*/
-async function cleanupStaleSessions(db, staleSeconds = 604800) {
-	return (await db.execute(sql`
-    WITH deleted AS (
-      DELETE FROM agent_chat_sessions
-      WHERE state IN ('evicted', 'suspended')
-      AND updated_at < NOW() - make_interval(secs => ${staleSeconds})
-      RETURNING 1
-    )
-    SELECT count(*)::int AS cnt FROM deleted
-  `))[0]?.cnt ?? 0;
-}
 /** Serialize a Date to ISO string, or null. */
 function serializeDate(d) {
 	return d ? d.toISOString() : null;
@@ -7336,7 +10263,11 @@ function serializeDate(d) {
 async function adminClientRoutes(app) {
 	app.get("/", async (request) => {
 		const scope = memberScope(request);
-		return (await listClients(app.db, scope.userId)).map((c) => ({
+		return (await listClients(app.db, {
+			userId: scope.userId,
+			organizationId: scope.organizationId,
+			role: scope.role
+		})).map((c) => ({
 			id: c.id,
 			userId: c.userId,
 			status: c.status,
@@ -7350,7 +10281,7 @@ async function adminClientRoutes(app) {
 	});
 	app.get("/:clientId", async (request) => {
 		const scope = memberScope(request);
-		await assertClientOwner(app.db, request.params.clientId, scope.userId);
+		await assertClientOwner(app.db, request.params.clientId, scope);
 		const client = await getClient(app.db, request.params.clientId);
 		if (!client) throw new Error("unreachable: client missing after owner check");
 		return {
@@ -7367,7 +10298,7 @@ async function adminClientRoutes(app) {
 	app.post("/:clientId/disconnect", async (request) => {
 		const scope = memberScope(request);
 		const { clientId } = request.params;
-		await assertClientOwner(app.db, clientId, scope.userId);
+		await assertClientOwner(app.db, clientId, scope);
 		const agentIds = forceDisconnectClient(clientId);
 		await disconnectClient(app.db, clientId);
 		return {
@@ -7378,7 +10309,7 @@ async function adminClientRoutes(app) {
 	app.delete("/:clientId", async (request, reply) => {
 		const scope = memberScope(request);
 		const { clientId } = request.params;
-		await assertClientOwner(app.db, clientId, scope.userId);
+		await assertClientOwner(app.db, clientId, scope);
 		await retireClient(app.db, clientId);
 		forceDisconnectClient(clientId);
 		await disconnectClient(app.db, clientId);
@@ -7658,16 +10589,26 @@ async function adminOverviewRoutes(app) {
 		};
 	});
 }
+const SUMMARY_MAX_LENGTH = 50;
+/** Extract a plain-text summary from a message's JSONB content field. */
+function extractSummary(content, maxLen = SUMMARY_MAX_LENGTH) {
+	let text = "";
+	if (typeof content === "object" && content !== null && "text" in content) text = String(content.text ?? "");
+	else if (typeof content === "string") text = content;
+	return text ? text.slice(0, maxLen) : null;
+}
 /** List sessions for a specific agent, with optional state filters. */
 async function listAgentSessions(db, agentId, filters) {
 	const conditions = [eq(agentChatSessions.agentId, agentId)];
 	if (filters?.state) conditions.push(eq(agentChatSessions.state, filters.state));
+	else conditions.push(ne(agentChatSessions.state, "evicted"));
 	const rows = await db.select({
 		agentId: agentChatSessions.agentId,
 		chatId: agentChatSessions.chatId,
 		state: agentChatSessions.state,
 		updatedAt: agentChatSessions.updatedAt,
-		chatCreatedAt: chats.createdAt
+		chatCreatedAt: chats.createdAt,
+		chatTopic: chats.topic
 	}).from(agentChatSessions).innerJoin(chats, eq(agentChatSessions.chatId, chats.id)).where(and(...conditions)).orderBy(desc(agentChatSessions.updatedAt));
 	const [presence] = await db.select({ runtimeState: agentPresence.runtimeState }).from(agentPresence).where(eq(agentPresence.agentId, agentId)).limit(1);
 	const agentRuntimeState = presence?.runtimeState ?? null;
@@ -7678,6 +10619,15 @@ async function listAgentSessions(db, agentId, filters) {
 		count: sql`count(*)::int`
 	}).from(inboxEntries).where(and(eq(inboxEntries.inboxId, sql`(SELECT inbox_id FROM agents WHERE uuid = ${agentId})`), inArray(inboxEntries.chatId, chatIds))).groupBy(inboxEntries.chatId) : [];
 	const countMap = new Map(messageCounts.map((r) => [r.chatId, r.count]));
+	const firstMessages = chatIds.length > 0 ? await db.selectDistinctOn([messages.chatId], {
+		chatId: messages.chatId,
+		content: messages.content
+	}).from(messages).where(inArray(messages.chatId, chatIds)).orderBy(messages.chatId, messages.createdAt) : [];
+	const summaryMap = /* @__PURE__ */ new Map();
+	for (const row of firstMessages) {
+		const summary = extractSummary(row.content);
+		if (summary) summaryMap.set(row.chatId, summary);
+	}
 	return rows.map((r) => ({
 		agentId: r.agentId,
 		chatId: r.chatId,
@@ -7685,7 +10635,9 @@ async function listAgentSessions(db, agentId, filters) {
 		runtimeState: agentRuntimeState,
 		startedAt: r.chatCreatedAt.toISOString(),
 		lastActivityAt: r.updatedAt.toISOString(),
-		messageCount: countMap.get(r.chatId) ?? 0
+		messageCount: countMap.get(r.chatId) ?? 0,
+		summary: summaryMap.get(r.chatId) ?? null,
+		topic: r.chatTopic ?? null
 	}));
 }
 /** Get a single session's detail. */
@@ -7695,11 +10647,14 @@ async function getSession(db, agentId, chatId) {
 		chatId: agentChatSessions.chatId,
 		state: agentChatSessions.state,
 		updatedAt: agentChatSessions.updatedAt,
-		chatCreatedAt: chats.createdAt
+		chatCreatedAt: chats.createdAt,
+		chatTopic: chats.topic
 	}).from(agentChatSessions).innerJoin(chats, eq(agentChatSessions.chatId, chats.id)).where(and(eq(agentChatSessions.agentId, agentId), eq(agentChatSessions.chatId, chatId))).limit(1);
 	if (!row) throw new NotFoundError(`Session (${agentId}, ${chatId}) not found`);
 	const [presence] = await db.select({ runtimeState: agentPresence.runtimeState }).from(agentPresence).where(eq(agentPresence.agentId, agentId)).limit(1);
 	const [countRow] = await db.select({ count: sql`count(*)::int` }).from(inboxEntries).where(and(eq(inboxEntries.inboxId, sql`(SELECT inbox_id FROM agents WHERE uuid = ${agentId})`), eq(inboxEntries.chatId, chatId)));
+	const firstMsg = (await db.execute(sql`SELECT content FROM messages WHERE chat_id = ${chatId} ORDER BY created_at ASC LIMIT 1`))[0];
+	const summary = firstMsg ? extractSummary(firstMsg.content) : null;
 	return {
 		agentId: row.agentId,
 		chatId: row.chatId,
@@ -7707,13 +10662,16 @@ async function getSession(db, agentId, chatId) {
 		runtimeState: presence?.runtimeState ?? null,
 		startedAt: row.chatCreatedAt.toISOString(),
 		lastActivityAt: row.updatedAt.toISOString(),
-		messageCount: countRow?.count ?? 0
+		messageCount: countRow?.count ?? 0,
+		summary,
+		topic: row.chatTopic ?? null
 	};
 }
 /** List all sessions across all agents, with pagination. Scoped to organization. */
 async function listAllSessions(db, limit, cursor, filters) {
 	const conditions = [];
 	if (filters?.state) conditions.push(eq(agentChatSessions.state, filters.state));
+	else conditions.push(ne(agentChatSessions.state, "evicted"));
 	if (filters?.agentId) conditions.push(eq(agentChatSessions.agentId, filters.agentId));
 	if (filters?.organizationId) conditions.push(eq(agents.organizationId, filters.organizationId));
 	if (cursor) conditions.push(sql`${agentChatSessions.updatedAt} < ${new Date(cursor)}`);
@@ -7742,11 +10700,54 @@ async function listAllSessions(db, limit, cursor, filters) {
 			runtimeState: runtimeMap.get(r.agentId) ?? null,
 			startedAt: r.chatCreatedAt.toISOString(),
 			lastActivityAt: r.updatedAt.toISOString(),
-			messageCount: 0
+			messageCount: 0,
+			summary: null,
+			topic: null
 		})),
 		nextCursor
 	};
 }
+/** Commit `active → suspended`. No-op on suspended/evicted. Throws if row is missing. */
+async function suspendSession(db, agentId, chatId, organizationId, notifier) {
+	return transitionSessionState(db, agentId, chatId, "suspended", ["active"], organizationId, notifier);
+}
+/** Commit `suspended → evicted` (terminal — listings hide it, revival defense blocks resurrection). */
+async function archiveSession(db, agentId, chatId, organizationId, notifier) {
+	return transitionSessionState(db, agentId, chatId, "evicted", ["suspended"], organizationId, notifier);
+}
+async function transitionSessionState(db, agentId, chatId, target, from, organizationId, notifier) {
+	const now = /* @__PURE__ */ new Date();
+	let finalState = null;
+	let transitioned = false;
+	await db.transaction(async (tx) => {
+		const [existing] = await tx.select({ state: agentChatSessions.state }).from(agentChatSessions).where(and(eq(agentChatSessions.agentId, agentId), eq(agentChatSessions.chatId, chatId))).for("update");
+		if (!existing) return;
+		const current = existing.state;
+		finalState = current;
+		if (!from.includes(current)) return;
+		await tx.update(agentChatSessions).set({
+			state: target,
+			updatedAt: now
+		}).where(and(eq(agentChatSessions.agentId, agentId), eq(agentChatSessions.chatId, chatId)));
+		const [counts] = await tx.select({
+			active: sql`count(*) FILTER (WHERE ${agentChatSessions.state} = 'active')::int`,
+			total: sql`count(*) FILTER (WHERE ${agentChatSessions.state} != 'evicted')::int`
+		}).from(agentChatSessions).where(eq(agentChatSessions.agentId, agentId));
+		await tx.update(agentPresence).set({
+			activeSessions: counts?.active ?? 0,
+			totalSessions: counts?.total ?? 0,
+			lastSeenAt: now
+		}).where(eq(agentPresence.agentId, agentId));
+		finalState = target;
+		transitioned = true;
+	});
+	if (finalState === null) throw new NotFoundError(`Session (${agentId}, ${chatId}) not found`);
+	if (transitioned && notifier) notifier.notifySessionStateChange(agentId, chatId, target, organizationId).catch(() => {});
+	return {
+		state: finalState,
+		transitioned
+	};
+}
 /**
 * Filter sessions to only those where the given agent is also a participant in the chat.
 * Used when a non-manager views sessions of an org-visible agent — they should only see
@@ -7927,49 +10928,41 @@ async function adminSessionRoutes(app) {
 			direction
 		});
 	});
-	/** POST /admin/sessions/agents/:agentId/:chatId/suspend — suspend a session */
+	/** POST /admin/sessions/agents/:agentId/:chatId/suspend — commit first, WS-send best-effort. */
 	app.post("/agents/:agentId/:chatId/suspend", async (request, reply) => {
 		const { agentId, chatId } = request.params;
 		await assertCanManage(app.db, memberScope(request), agentId);
-		if (!sendToAgent$1(agentId, {
+		const member = requireMember(request);
+		const result = await suspendSession(app.db, agentId, chatId, member.organizationId, app.notifier);
+		if (result.transitioned) sendToAgent$1(agentId, {
 			type: "session:suspend",
 			chatId
-		})) throw new ConflictError("Agent is not connected — session command requires a live connection");
-		return reply.status(202).send({
-			status: "sent",
-			command: "suspend",
-			agentId,
-			chatId
 		});
-	});
-	/** POST /admin/sessions/agents/:agentId/:chatId/resume — resume a session */
-	app.post("/agents/:agentId/:chatId/resume", async (request, reply) => {
-		const { agentId, chatId } = request.params;
-		await assertCanManage(app.db, memberScope(request), agentId);
-		if (!sendToAgent$1(agentId, {
-			type: "session:resume",
-			chatId
-		})) throw new ConflictError("Agent is not connected — session command requires a live connection");
-		return reply.status(202).send({
-			status: "sent",
-			command: "resume",
+		return reply.status(200).send({
 			agentId,
-			chatId
+			chatId,
+			state: result.state,
+			transitioned: result.transitioned
 		});
 	});
-	/** POST /admin/sessions/agents/:agentId/:chatId/terminate — terminate a session */
+	/** POST /admin/sessions/agents/:agentId/:chatId/terminate — archive; clear events + best-effort WS. */
 	app.post("/agents/:agentId/:chatId/terminate", async (request, reply) => {
 		const { agentId, chatId } = request.params;
 		await assertCanManage(app.db, memberScope(request), agentId);
-		if (!sendToAgent$1(agentId, {
-			type: "session:terminate",
-			chatId
-		})) throw new ConflictError("Agent is not connected — session command requires a live connection");
-		return reply.status(202).send({
-			status: "sent",
-			command: "terminate",
+		const member = requireMember(request);
+		const result = await archiveSession(app.db, agentId, chatId, member.organizationId, app.notifier);
+		if (result.transitioned) {
+			clearEvents(app.db, agentId, chatId).catch(() => {});
+			sendToAgent$1(agentId, {
+				type: "session:terminate",
+				chatId
+			});
+		}
+		return reply.status(200).send({
 			agentId,
-			chatId
+			chatId,
+			state: result.state,
+			transitioned: result.transitioned
 		});
 	});
 }
@@ -8532,6 +11525,99 @@ async function adminTaskRoutes(app) {
 		return getTaskHealth(app.db, request.params.taskId);
 	});
 }
+const UPLOADS_DIR = join(DEFAULT_DATA_DIR$1, "uploads");
+const MAX_FILE_SIZE = 10 * 1024 * 1024;
+const ALLOWED_MIME_TYPES = new Set([
+	"image/png",
+	"image/jpeg",
+	"image/gif",
+	"image/webp",
+	"image/svg+xml"
+]);
+function ensureUploadsDir() {
+	if (!existsSync(UPLOADS_DIR)) mkdirSync(UPLOADS_DIR, { recursive: true });
+}
+async function adminUploadRoutes(app) {
+	ensureUploadsDir();
+	/** POST /admin/uploads — upload a file, returns URL */
+	app.post("/", async (request, reply) => {
+		requireMember(request);
+		const data = await request.file();
+		if (!data) return reply.status(400).send({ error: "No file provided" });
+		const mimeType = data.mimetype;
+		if (!ALLOWED_MIME_TYPES.has(mimeType)) return reply.status(400).send({ error: `Unsupported file type: ${mimeType}. Allowed: ${[...ALLOWED_MIME_TYPES].join(", ")}` });
+		const ext = extname(data.filename) || mimeExtension(mimeType);
+		const uniqueName = `${(/* @__PURE__ */ new Date()).toISOString().replace(/[-:T]/g, "").slice(0, 14)}_${randomUUID().slice(0, 8)}${ext}`;
+		const filePath = join(UPLOADS_DIR, uniqueName);
+		let totalSize = 0;
+		const writeStream = createWriteStream(filePath);
+		try {
+			const fileStream = data.file;
+			for await (const chunk of fileStream) {
+				totalSize += chunk.length;
+				if (totalSize > MAX_FILE_SIZE) {
+					writeStream.destroy();
+					try {
+						unlinkSync(filePath);
+					} catch {}
+					return reply.status(400).send({ error: `File too large. Maximum size: ${MAX_FILE_SIZE / 1024 / 1024}MB` });
+				}
+				writeStream.write(chunk);
+			}
+			writeStream.end();
+			await new Promise((resolve, reject) => {
+				writeStream.on("finish", resolve);
+				writeStream.on("error", reject);
+			});
+		} catch (err) {
+			writeStream.destroy();
+			throw err;
+		}
+		const url = `/api/v1/uploads/${uniqueName}`;
+		return reply.status(201).send({
+			url,
+			filename: data.filename,
+			storedName: uniqueName,
+			mimeType,
+			size: totalSize
+		});
+	});
+}
+/** Public routes — GET uploaded files (URL contains random UUID, not guessable) */
+async function publicUploadRoutes(app) {
+	ensureUploadsDir();
+	/** GET /uploads/:filename — serve uploaded file without auth */
+	app.get("/:filename", async (request, reply) => {
+		const { filename } = request.params;
+		if (filename.includes("/") || filename.includes("..")) return reply.status(400).send({ error: "Invalid filename" });
+		const filePath = join(UPLOADS_DIR, filename);
+		if (!existsSync(filePath)) return reply.status(404).send({ error: "File not found" });
+		const contentType = extensionToMime(extname(filename).toLowerCase()) ?? "application/octet-stream";
+		const stream = createReadStream(filePath);
+		return reply.type(contentType).send(stream);
+	});
+}
+function mimeExtension(mime) {
+	switch (mime) {
+		case "image/png": return ".png";
+		case "image/jpeg": return ".jpg";
+		case "image/gif": return ".gif";
+		case "image/webp": return ".webp";
+		case "image/svg+xml": return ".svg";
+		default: return "";
+	}
+}
+function extensionToMime(ext) {
+	switch (ext) {
+		case ".png": return "image/png";
+		case ".jpg":
+		case ".jpeg": return "image/jpeg";
+		case ".gif": return "image/gif";
+		case ".webp": return "image/webp";
+		case ".svg": return "image/svg+xml";
+		default: return null;
+	}
+}
 async function loadVisibleAgentIds(db, organizationId, memberId) {
 	const rows = await db.select({ id: agents.uuid }).from(agents).where(and(eq(agents.organizationId, organizationId), ne(agents.status, AGENT_STATUSES.DELETED), or(eq(agents.visibility, AGENT_VISIBILITY.ORGANIZATION), eq(agents.managerId, memberId))));
 	return new Set(rows.map((r) => r.id));
@@ -9418,9 +12504,47 @@ function clientWsRoutes(notifier, instanceId) {
 								}));
 								return;
 							}
-							const payload = sessionStateMessageSchema.parse(msg);
-							if (payload.state === "evicted") chainSessionOp(agentId, payload.chatId, () => clearEvents(app.db, agentId, payload.chatId).catch(() => {}));
-							await upsertSessionState(app.db, agentId, payload.chatId, payload.state, session.organizationId, notifier);
+							const payloadResult = sessionStateMessageSchema.safeParse(msg);
+							if (!payloadResult.success) {
+								socket.send(JSON.stringify({
+									type: "error",
+									message: "Unsupported session state from client; client upgrade required"
+								}));
+								const rawState = msg.state;
+								app.log.warn({
+									clientId,
+									agentId,
+									rawState
+								}, "session:state rejected — stale client wire");
+								return;
+							}
+							await upsertSessionState(app.db, agentId, payloadResult.data.chatId, payloadResult.data.state, session.organizationId, notifier);
+						} else if (type === "session:reconcile") {
+							const agentId = parsed.data.agentId;
+							if (!agentId || !boundAgents.has(agentId)) {
+								socket.send(JSON.stringify({
+									type: "error",
+									message: "Agent not bound"
+								}));
+								return;
+							}
+							const payloadResult = sessionReconcileRequestSchema.safeParse(msg);
+							if (!payloadResult.success) {
+								socket.send(JSON.stringify({
+									type: "error",
+									message: "Malformed session:reconcile frame"
+								}));
+								return;
+							}
+							const { chatIds } = payloadResult.data;
+							const aliveRows = chatIds.length ? await app.db.select({ chatId: agentChatSessions.chatId }).from(agentChatSessions).where(and(eq(agentChatSessions.agentId, agentId), inArray(agentChatSessions.chatId, chatIds), ne(agentChatSessions.state, "evicted"))) : [];
+							const alive = new Set(aliveRows.map((r) => r.chatId));
+							const staleChatIds = chatIds.filter((id) => !alive.has(id));
+							socket.send(JSON.stringify({
+								type: "session:reconcile:result",
+								agentId,
+								staleChatIds
+							}));
 						} else if (type === "runtime:state") {
 							const agentId = parsed.data.agentId;
 							if (!agentId || !boundAgents.has(agentId)) {
@@ -9839,14 +12963,18 @@ async function getMember(db, id) {
 		createdAt: row.createdAt.toISOString()
 	};
 }
-async function updateMember(db, id, data) {
-	if (!data.role) return getMember(db, id);
-	if (data.role === "member") {
-		const member = await getMember(db, id);
-		if (member.role === "admin") await assertNotLastAdmin(db, member.organizationId, id);
-	}
-	const [row] = await db.update(members).set({ role: data.role }).where(eq(members.id, id)).returning();
-	if (!row) throw new NotFoundError(`Member "${id}" not found`);
+async function updateMember(db, id, data, callerOrgId) {
+	if (data.role === void 0 && data.displayName === void 0) return getMember(db, id);
+	const current = await getMember(db, id);
+	if (callerOrgId && current.organizationId !== callerOrgId) throw new NotFoundError(`Member "${id}" not found`);
+	if (data.role === "member" && current.role === "admin") await assertNotLastAdmin(db, current.organizationId, id);
+	await db.transaction(async (tx) => {
+		if (data.role !== void 0 && data.role !== current.role) await tx.update(members).set({ role: data.role }).where(eq(members.id, id));
+		if (data.displayName !== void 0 && data.displayName !== current.displayName) {
+			await tx.update(users).set({ displayName: data.displayName }).where(eq(users.id, current.userId));
+			await tx.update(agents).set({ displayName: data.displayName }).where(eq(agents.uuid, current.agentId));
+		}
+	});
 	return getMember(db, id);
 }
 async function deleteMember(db, id) {
@@ -9884,7 +13012,8 @@ async function memberRoutes(app) {
 	app.patch("/:id", async (request) => {
 		requireAdmin(request);
 		const body = updateMemberSchema.parse(request.body);
-		return updateMember(app.db, request.params.id, body);
+		const m = requireMember(request);
+		return updateMember(app.db, request.params.id, body, m.organizationId);
 	});
 	app.delete("/:id", async (request, reply) => {
 		requireAdmin(request);
@@ -10965,7 +14094,6 @@ function createBackgroundTasks(app, instanceId, adapterManager, kaelRuntime) {
 	let heartbeatTimer = null;
 	let adapterOutboundTimer = null;
 	let kaelOutboundTimer = null;
-	let sessionCleanupTimer = null;
 	return {
 		start() {
 			inboxTimer = setInterval(async () => {
@@ -11010,14 +14138,6 @@ function createBackgroundTasks(app, instanceId, adapterManager, kaelRuntime) {
 					log.error({ err }, "kael outbound processing failed");
 				}
 			}, 5e3);
-			sessionCleanupTimer = setInterval(async () => {
-				try {
-					const deleted = await cleanupStaleSessions(app.db);
-					if (deleted > 0) log.info({ count: deleted }, "cleaned up stale sessions");
-				} catch (err) {
-					log.error({ err }, "failed to clean up stale sessions");
-				}
-			}, 36e5);
 			heartbeatInstance(app.db, instanceId).catch((err) => {
 				log.error({ err }, "failed initial heartbeat");
 			});
@@ -11039,10 +14159,6 @@ function createBackgroundTasks(app, instanceId, adapterManager, kaelRuntime) {
 				clearInterval(kaelOutboundTimer);
 				kaelOutboundTimer = null;
 			}
-			if (sessionCleanupTimer) {
-				clearInterval(sessionCleanupTimer);
-				sessionCleanupTimer = null;
-			}
 		}
 	};
 }
@@ -11597,6 +14713,7 @@ async function buildApp(config) {
 	const listenClient = postgres(config.database.url, { max: 1 });
 	const notifier = createNotifier(listenClient);
 	await app.register(websocket);
+	await app.register(import_multipart.default, { limits: { fileSize: 10 * 1024 * 1024 } });
 	const corsOrigin = config.cors?.origin;
 	const isDev = process.env.NODE_ENV !== "production";
 	await app.register(cors, {
@@ -11635,6 +14752,7 @@ async function buildApp(config) {
 		await api.register(authRoutes, { prefix: "/auth" });
 		await api.register(contextTreeInfoRoutes, { prefix: "/context-tree" });
 		await api.register(bootstrapConfigRoutes, { prefix: "/bootstrap" });
+		await api.register(publicUploadRoutes, { prefix: "/uploads" });
 		await api.register(async (adminApp) => {
 			adminApp.addHook("onRequest", memberAuth);
 			await adminApp.register(adminAgentRoutes);
@@ -11659,17 +14777,14 @@ async function buildApp(config) {
 		}, { prefix: "/admin/overview" });
 		await api.register(async (adminApp) => {
 			adminApp.addHook("onRequest", memberAuth);
-			adminApp.addHook("onRequest", adminOnly);
 			await adminApp.register(adminAdapterRoutes);
 		}, { prefix: "/admin/adapters" });
 		await api.register(async (adminApp) => {
 			adminApp.addHook("onRequest", memberAuth);
-			adminApp.addHook("onRequest", adminOnly);
 			await adminApp.register(adminAdapterMappingRoutes);
 		}, { prefix: "/admin/adapter-mappings" });
 		await api.register(async (adminApp) => {
 			adminApp.addHook("onRequest", memberAuth);
-			adminApp.addHook("onRequest", adminOnly);
 			await adminApp.register(adminAdapterStatusRoutes);
 		}, { prefix: "/admin/adapters/status" });
 		await api.register(async (memberApp) => {
@@ -11684,6 +14799,10 @@ async function buildApp(config) {
 			adminApp.addHook("onRequest", memberAuth);
 			await adminApp.register(adminChatRoutes);
 		}, { prefix: "/admin/chats" });
+		await api.register(async (adminApp) => {
+			adminApp.addHook("onRequest", memberAuth);
+			await adminApp.register(adminUploadRoutes);
+		}, { prefix: "/admin/uploads" });
 		await api.register(async (adminApp) => {
 			adminApp.addHook("onRequest", memberAuth);
 			await adminApp.register(adminClientRoutes);