@caplets/core 0.25.0 → 0.26.0

package/dist/{service-DjwB8aiW.js → service-rvZ7z6FI.js}

@@ -1,7 +1,7 @@
-import { A as safeParseAsync$1, C as toJSONSchema, D as parse$3, E as $ZodType, F as NEVER, M as defineLazy, N as normalizeParams, O as parseAsync, P as $constructor, S as datetime, T as $ZodObject, _ as record, a as any, b as unknown, c as custom, d as literal, f as looseObject, g as preprocess, h as optional, i as _null, j as clone, k as safeParse$1, l as discriminatedUnion, m as object$1, o as array, p as number$1, r as _enum, s as boolean, t as ZodNumber$1, u as intersection, v as string, w as _coercedNumber, x as url, y as union } from "./schemas-C0PNPwjS.js";
-import { a as isAllowedHttpBaseUrl, c as validateHttpActionHeaders, d as errorResult, f as redactSecrets, i as SERVER_ID_PATTERN, n as HEADER_NAME_PATTERN, o as isAllowedRemoteUrl, p as toSafeError, r as HTTP_BASE_URL_PATTERN, s as isUrl, t as FORBIDDEN_HEADERS, u as CapletsError } from "./validation-DgxCzt-A.js";
+import { A as safeParseAsync$1, C as toJSONSchema, D as parse$3, E as $ZodType, F as NEVER, M as defineLazy, N as normalizeParams, O as parseAsync, P as $constructor, S as datetime, T as $ZodObject, _ as record, a as any, b as unknown, c as custom, d as literal, f as looseObject, g as preprocess, h as optional, i as _null, j as clone, k as safeParse$1, l as discriminatedUnion, m as object$1, o as array, p as number$1, r as _enum, s as boolean, t as ZodNumber$1, u as intersection, v as string, w as _coercedNumber, x as url, y as union } from "./schemas-BoqMu4MG.js";
+import { a as isAllowedHttpBaseUrl, c as validateHttpActionHeaders, d as errorResult, f as redactSecrets, i as SERVER_ID_PATTERN, n as HEADER_NAME_PATTERN, o as isAllowedRemoteUrl, p as toSafeError, r as HTTP_BASE_URL_PATTERN, s as isUrl, t as FORBIDDEN_HEADERS, u as CapletsError } from "./validation-C4tYXw6G.js";
 import { generatedToolInputJsonSchema, generatedToolInputJsonSchemaForCaplet, generatedToolInputSchemaForCaplet, mcpOperations, operations } from "./generated-tool-input-schema.js";
-import { f as observedOutputShapeKey, i as observeOutputShape, r as normalizedObservableValue, t as usefulOutputSchema, u as FileObservedOutputShapeStore } from "./observed-output-shapes-D2k2-q8K.js";
+import { f as observedOutputShapeKey, i as observeOutputShape, r as normalizedObservableValue, t as usefulOutputSchema, u as FileObservedOutputShapeStore } from "./observed-output-shapes-DuP7mJQf.js";
 import { createRequire } from "node:module";
 import { accessSync, chmodSync, constants, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statSync, watch, writeFileSync } from "node:fs";
 import { basename, delimiter, dirname, extname, isAbsolute, join, parse, posix, relative, resolve, sep, win32 } from "node:path";
@@ -9,8 +9,9 @@ import { spawn } from "node:child_process";
 import process$1 from "node:process";
 import { PassThrough } from "node:stream";
 import { createServer } from "node:http";
-import { createHash, createHmac, randomBytes, randomUUID } from "node:crypto";
+import { createCipheriv, createDecipheriv, createHash, createHmac, randomBytes, randomUUID } from "node:crypto";
 import { homedir } from "node:os";
+import { Buffer as Buffer$1 } from "node:buffer";
 import { readFile } from "node:fs/promises";
 import ts from "typescript";
 import { getQuickJS, shouldInterruptAfterDeadline } from "quickjs-emscripten";
@@ -45,7 +46,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 	value: mod,
 	enumerable: true
 }) : target, mod));
-var __require = /* @__PURE__ */ createRequire(import.meta.url);
+var __require = /* #__PURE__ */ (() => createRequire(import.meta.url))();
 //#endregion
 //#region ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v3/helpers/util.js
 var util$1;
@@ -8910,7 +8911,7 @@ var require_boolSchema = /* @__PURE__ */ __commonJSMin(((exports) => {
 var require_rules = /* @__PURE__ */ __commonJSMin(((exports) => {
 	Object.defineProperty(exports, "__esModule", { value: true });
 	exports.getRules = exports.isJSONType = void 0;
-	const jsonTypes = new Set([
+	const jsonTypes = /* @__PURE__ */ new Set([
 		"string",
 		"number",
 		"integer",
@@ -9029,7 +9030,7 @@ var require_dataType = /* @__PURE__ */ __commonJSMin(((exports) => {
 		return checkTypes;
 	}
 	exports.coerceAndCheckDataType = coerceAndCheckDataType;
-	const COERCIBLE = new Set([
+	const COERCIBLE = /* @__PURE__ */ new Set([
 		"string",
 		"number",
 		"integer",
@@ -9583,7 +9584,7 @@ var require_resolve = /* @__PURE__ */ __commonJSMin(((exports) => {
 	const util_1 = require_util$1();
 	const equal = require_fast_deep_equal();
 	const traverse = require_json_schema_traverse();
-	const SIMPLE_INLINED = new Set([
+	const SIMPLE_INLINED = /* @__PURE__ */ new Set([
 		"type",
 		"format",
 		"pattern",
@@ -9608,7 +9609,7 @@ var require_resolve = /* @__PURE__ */ __commonJSMin(((exports) => {
 		return countKeys(schema) <= limit;
 	}
 	exports.inlineRef = inlineRef;
-	const REF_KEYWORDS = new Set([
+	const REF_KEYWORDS = /* @__PURE__ */ new Set([
 		"$ref",
 		"$recursiveRef",
 		"$recursiveAnchor",
@@ -10329,7 +10330,7 @@ var require_compile = /* @__PURE__ */ __commonJSMin(((exports) => {
 		return getJsonPointer.call(this, p, schOrRef);
 	}
 	exports.resolveSchema = resolveSchema;
-	const PREVENT_SCOPE_CHANGE = new Set([
+	const PREVENT_SCOPE_CHANGE = /* @__PURE__ */ new Set([
 		"properties",
 		"patternProperties",
 		"enum",
@@ -11281,7 +11282,7 @@ var require_core$4 = /* @__PURE__ */ __commonJSMin(((exports) => {
 		"useDefaults",
 		"coerceTypes"
 	];
-	const EXT_SCOPE_NAMES = new Set([
+	const EXT_SCOPE_NAMES = /* @__PURE__ */ new Set([
 		"validate",
 		"serialize",
 		"parse",
@@ -18095,7 +18096,7 @@ function searchToolList(tools, query, limit, compact) {
 		return utility === 0 ? left.tool.name.localeCompare(right.tool.name) : utility;
 	}).slice(0, limit).map((candidate) => compact(candidate.tool));
 }
-const MUTATING_QUERY_TOKENS = new Set([
+const MUTATING_QUERY_TOKENS = /* @__PURE__ */ new Set([
 	"add",
 	"create",
 	"delete",
@@ -20097,7 +20098,7 @@ var require_Collection = /* @__PURE__ */ __commonJSMin(((exports) => {
 				const a = [];
 				a[k] = v;
 				v = a;
-			} else v = new Map([[k, v]]);
+			} else v = /* @__PURE__ */ new Map([[k, v]]);
 		}
 		return createNode.createNode(v, void 0, {
 			aliasDuplicateObjects: false,
@@ -20656,7 +20657,7 @@ var require_stringify = /* @__PURE__ */ __commonJSMin(((exports) => {
 			if (ctx.resolvedAliases?.has(item)) throw new TypeError(`Cannot stringify circular structure without alias nodes`);
 			else {
 				if (ctx.resolvedAliases) ctx.resolvedAliases.add(item);
-				else ctx.resolvedAliases = new Set([item]);
+				else ctx.resolvedAliases = /* @__PURE__ */ new Set([item]);
 				item = item.resolve(ctx.doc);
 			}
 		}
@@ -22050,7 +22051,7 @@ var require_tags = /* @__PURE__ */ __commonJSMin(((exports) => {
 	var schema$2 = require_schema$7();
 	var set = require_set$1();
 	var timestamp = require_timestamp$1();
-	const schemas = new Map([
+	const schemas = /* @__PURE__ */ new Map([
 		["core", schema.schema],
 		["failsafe", [
 			map.map,
@@ -26078,7 +26079,7 @@ const capletMcpServerSchema = object$1({
 		path: ["url"],
 		message: "remote servers require url"
 	});
-	if (server.url && !hasEnvReference$2(server.url) && !isAllowedRemoteUrl(server.url)) ctx.addIssue({
+	if (server.url && !hasInterpolationReference$2(server.url) && !isAllowedRemoteUrl(server.url)) ctx.addIssue({
 		code: "custom",
 		path: ["url"],
 		message: "remote url must use https except loopback development urls"
@@ -26091,7 +26092,7 @@ const capletMcpServerSchema = object$1({
 		"redirectUri"
 	]) {
 		const value = server.auth[field];
-		if (value && !hasEnvReference$2(value) && !isUrl(value)) ctx.addIssue({
+		if (value && !hasInterpolationReference$2(value) && !isUrl(value)) ctx.addIssue({
 			code: "custom",
 			path: ["auth", field],
 			message: `${field} must be a URL or environment reference`
@@ -26125,12 +26126,12 @@ const capletOpenApiEndpointSchema = object$1({
 		code: "custom",
 		message: "openapiEndpoint must define exactly one spec source: specPath or specUrl"
 	});
-	if (endpoint.specUrl && !hasEnvReference$2(endpoint.specUrl) && !isAllowedRemoteUrl(endpoint.specUrl)) ctx.addIssue({
+	if (endpoint.specUrl && !hasInterpolationReference$2(endpoint.specUrl) && !isAllowedRemoteUrl(endpoint.specUrl)) ctx.addIssue({
 		code: "custom",
 		path: ["specUrl"],
 		message: "OpenAPI specUrl must use https except loopback development urls"
 	});
-	if (endpoint.baseUrl && !hasEnvReference$2(endpoint.baseUrl) && !isAllowedRemoteUrl(endpoint.baseUrl)) ctx.addIssue({
+	if (endpoint.baseUrl && !hasInterpolationReference$2(endpoint.baseUrl) && !isAllowedRemoteUrl(endpoint.baseUrl)) ctx.addIssue({
 		code: "custom",
 		path: ["baseUrl"],
 		message: "OpenAPI baseUrl must use https except loopback development urls"
@@ -26155,12 +26156,12 @@ const capletGoogleDiscoveryApiSchema = object$1({
 		code: "custom",
 		message: "googleDiscoveryApi must define exactly one discovery source: discoveryPath or discoveryUrl"
 	});
-	if (api.discoveryUrl && !hasEnvReference$2(api.discoveryUrl) && !isAllowedRemoteUrl(api.discoveryUrl)) ctx.addIssue({
+	if (api.discoveryUrl && !hasInterpolationReference$2(api.discoveryUrl) && !isAllowedRemoteUrl(api.discoveryUrl)) ctx.addIssue({
 		code: "custom",
 		path: ["discoveryUrl"],
 		message: "Google Discovery discoveryUrl must use https except loopback development urls"
 	});
-	if (api.baseUrl && !hasEnvReference$2(api.baseUrl) && !isAllowedHttpBaseUrl(api.baseUrl)) ctx.addIssue({
+	if (api.baseUrl && !hasInterpolationReference$2(api.baseUrl) && !isAllowedHttpBaseUrl(api.baseUrl)) ctx.addIssue({
 		code: "custom",
 		path: ["baseUrl"],
 		message: "Google Discovery baseUrl must use https except loopback development urls and must not include credentials, query, or fragment"
@@ -26197,12 +26198,12 @@ const capletGraphQlEndpointSchema = object$1({
 		code: "custom",
 		message: "graphqlEndpoint must define exactly one schema source: schemaPath, schemaUrl, or introspection"
 	});
-	if (endpoint.endpointUrl && !hasEnvReference$2(endpoint.endpointUrl) && !isAllowedRemoteUrl(endpoint.endpointUrl)) ctx.addIssue({
+	if (endpoint.endpointUrl && !hasInterpolationReference$2(endpoint.endpointUrl) && !isAllowedRemoteUrl(endpoint.endpointUrl)) ctx.addIssue({
 		code: "custom",
 		path: ["endpointUrl"],
 		message: "GraphQL endpointUrl must use https except loopback development urls"
 	});
-	if (endpoint.schemaUrl && !hasEnvReference$2(endpoint.schemaUrl) && !isAllowedRemoteUrl(endpoint.schemaUrl)) ctx.addIssue({
+	if (endpoint.schemaUrl && !hasInterpolationReference$2(endpoint.schemaUrl) && !isAllowedRemoteUrl(endpoint.schemaUrl)) ctx.addIssue({
 		code: "custom",
 		path: ["schemaUrl"],
 		message: "GraphQL schemaUrl must use https except loopback development urls"
@@ -26246,7 +26247,7 @@ const capletHttpApiSchema = object$1({
 	projectBinding: capletProjectBindingSchema.optional(),
 	runtime: capletRuntimeRequirementsSchema.optional()
 }).strict().superRefine((api, ctx) => {
-	if (api.baseUrl && !hasEnvReference$2(api.baseUrl) && !isAllowedHttpBaseUrl(api.baseUrl)) ctx.addIssue({
+	if (api.baseUrl && !hasInterpolationReference$2(api.baseUrl) && !isAllowedHttpBaseUrl(api.baseUrl)) ctx.addIssue({
 		code: "custom",
 		path: ["baseUrl"],
 		message: "HTTP API baseUrl must use https except loopback development urls and must not include credentials, query, or fragment"
@@ -26445,7 +26446,7 @@ function discoverCapletFileMapCandidates(paths) {
 		});
 	}
 	return candidates.map(({ id, path }) => {
-		validateCapletId(id, path);
+		validateCapletId$1(id, path);
 		return {
 			id,
 			path
@@ -26551,7 +26552,7 @@ function normalizeGraphQlOperations(operations, baseDir, normalizePath) {
 	}]));
 }
 function normalizeBundleLocalPath(value, baseDir) {
-	if (!value || isMapAbsolutePath(value) || hasEnvReference$2(value)) return value;
+	if (!value || isMapAbsolutePath(value) || hasInterpolationReference$2(value)) return value;
 	const parts = [...baseDir ? baseDir.split("/") : [], ...value.split("/")];
 	const normalized = [];
 	for (const part of parts) {
@@ -26625,21 +26626,18 @@ function parseFrontmatter(text, path) {
 function isPlainObject$6(value) {
 	return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
-function validateCapletId(id, path) {
+function validateCapletId$1(id, path) {
 	if (!SERVER_ID_PATTERN.test(id)) throw new CapletsError("CONFIG_INVALID", `Caplet file at ${path} derives invalid ID ${id}; ID must match ^[a-zA-Z0-9_-]{1,64}$`);
 }
 function errorMessage$4(error) {
 	return error instanceof Error ? error.message : String(error);
 }
-function hasEnvReference$2(value) {
-	return /\$\{[A-Za-z_][A-Za-z0-9_]*\}|\$env:[A-Za-z_][A-Za-z0-9_]*/.test(value);
+function hasInterpolationReference$2(value) {
+	return /\$\{[A-Za-z_][A-Za-z0-9_]*\}|\$env:[A-Za-z_][A-Za-z0-9_]*|\$\{vault:[^}]+\}|\$vault:[A-Za-z0-9_-]+/.test(value);
 }
 //#endregion
 //#region src/caplet-files.ts
 const MAX_CAPLET_FILE_BYTES = 128 * 1024;
-function loadCapletFiles(root) {
-	return loadCapletFilesWithPaths(root)?.config;
-}
 function loadCapletFilesWithPaths(root) {
 	if (!existsSync(root)) return;
 	return buildCapletFileLoadResultFromEntries(root, discoverCapletFiles(root), (path) => readCapletFile(path));
@@ -26653,7 +26651,7 @@ function discoverCapletFiles(root) {
 	const entries = readdirSync(root, { withFileTypes: true }).sort((left, right) => left.name.localeCompare(right.name));
 	const candidates = [];
 	function addCandidate(id, path) {
-		validateCapletId(id, path);
+		validateCapletId$1(id, path);
 		candidates.push({
 			id,
 			path
@@ -26679,7 +26677,7 @@ function discoverCapletFilesBestEffort(root, warnings) {
 	const duplicateIds = /* @__PURE__ */ new Set();
 	function addCandidate(id, path, isDirectoryCaplet) {
 		try {
-			validateCapletId(id, path);
+			validateCapletId$1(id, path);
 		} catch (error) {
 			warnings.push({
 				path,
@@ -26754,20 +26752,430 @@ function validateCapletFile(path) {
 	readCapletFile(path);
 }
 function normalizeLocalPath$1(value, baseDir) {
-	if (!value || isAbsolute(value) || hasEnvReference$1(value)) return value;
+	if (!value || isAbsolute(value) || hasInterpolationReference$1(value)) return value;
 	return join(baseDir, value);
 }
-function hasEnvReference$1(value) {
-	return /\$\{[A-Za-z_][A-Za-z0-9_]*\}|\$env:[A-Za-z_][A-Za-z0-9_]*/.test(value);
+function hasInterpolationReference$1(value) {
+	return /\$\{[A-Za-z_][A-Za-z0-9_]*\}|\$env:[A-Za-z_][A-Za-z0-9_]*|\$\{vault:[^}]+\}|\$vault:[A-Za-z0-9_-]+/.test(value);
+}
+//#endregion
+//#region src/vault/crypto.ts
+const NONCE_BYTES = 12;
+function encryptVaultValue(input) {
+	const nonce = randomBytes(NONCE_BYTES);
+	const cipher = createCipheriv("aes-256-gcm", input.key, nonce);
+	const ciphertext = Buffer$1.concat([cipher.update(input.plaintext, "utf8"), cipher.final()]);
+	const authTag = cipher.getAuthTag();
+	const timestamp = input.now.toISOString();
+	return {
+		version: 1,
+		algorithm: "aes-256-gcm",
+		nonce: nonce.toString("base64url"),
+		ciphertext: ciphertext.toString("base64url"),
+		authTag: authTag.toString("base64url"),
+		valueBytes: Buffer$1.byteLength(input.plaintext, "utf8"),
+		createdAt: input.existing?.createdAt ?? timestamp,
+		updatedAt: timestamp
+	};
+}
+function decryptVaultValue(record, key) {
+	const parsed = parseEncryptedRecord(record);
+	try {
+		const decipher = createDecipheriv("aes-256-gcm", key, Buffer$1.from(parsed.nonce, "base64url"));
+		decipher.setAuthTag(Buffer$1.from(parsed.authTag, "base64url"));
+		return Buffer$1.concat([decipher.update(Buffer$1.from(parsed.ciphertext, "base64url")), decipher.final()]).toString("utf8");
+	} catch {
+		throw new CapletsError("CONFIG_INVALID", "Vault encrypted record could not be decrypted.");
+	}
+}
+function parseEncryptedRecord(record) {
+	if (!record || typeof record !== "object" || Array.isArray(record)) throw new CapletsError("CONFIG_INVALID", "Vault encrypted record must be an object.");
+	const value = record;
+	if (value.version !== 1 || value.algorithm !== "aes-256-gcm") throw new CapletsError("CONFIG_INVALID", "Vault encrypted record version is unsupported.");
+	if (typeof value.nonce !== "string" || typeof value.ciphertext !== "string" || typeof value.authTag !== "string" || typeof value.valueBytes !== "number" || typeof value.createdAt !== "string" || typeof value.updatedAt !== "string") throw new CapletsError("CONFIG_INVALID", "Vault encrypted record is malformed.");
+	return value;
+}
+//#endregion
+//#region src/vault/store.ts
+function ensurePrivateDir(path) {
+	mkdirSync(path, {
+		recursive: true,
+		mode: 448
+	});
+	try {
+		chmodSync(path, 448);
+	} catch {}
+}
+function writePrivateFileAtomic(path, contents) {
+	ensurePrivateDir(dirname(path));
+	const tempPath = `${path}.${process.pid}.${Date.now()}.tmp`;
+	writeFileSync(tempPath, contents, { mode: 384 });
+	try {
+		chmodSync(tempPath, 384);
+	} catch {}
+	renameSync(tempPath, path);
+}
+function readJsonFile(path, fallback) {
+	if (!existsSync(path)) return fallback;
+	return JSON.parse(readFileSync(path, "utf8"));
+}
+function deleteFile(path) {
+	if (!existsSync(path)) return false;
+	rmSync(path, { force: true });
+	return true;
+}
+//#endregion
+//#region src/vault/keys.ts
+const VAULT_KEY_PATTERN = /^[A-Z_][A-Z0-9_]{0,127}$/;
+const KEY_FILE_PREFIX = "caplets-vault-key-v1.";
+const KEY_BYTES = 32;
+function validateVaultKeyName(name) {
+	if (!VAULT_KEY_PATTERN.test(name)) throw new CapletsError("REQUEST_INVALID", "Vault key names must match ^[A-Z_][A-Z0-9_]{0,127}$");
+	return name;
+}
+function loadVaultKey(input) {
+	const envKey = input.env?.CAPLETS_ENCRYPTION_KEY;
+	if (envKey !== void 0) return decodeExactKey(envKey, "CAPLETS_ENCRYPTION_KEY");
+	const status = vaultKeySourceStatus(input);
+	if (!status.available) throw new CapletsError("CONFIG_INVALID", `Vault key source is unavailable: ${"reason" in status ? status.reason : "invalid"}`);
+	return parseKeyFile(readFileSync(input.keyFile, "utf8"));
+}
+function ensureVaultKey(input) {
+	const envKey = input.env?.CAPLETS_ENCRYPTION_KEY;
+	if (envKey !== void 0) return decodeExactKey(envKey, "CAPLETS_ENCRYPTION_KEY");
+	if (!existsSync(input.keyFile)) {
+		ensurePrivateDir(dirname(input.keyFile));
+		const encoded = randomBytes(KEY_BYTES).toString("base64url");
+		writePrivateFileAtomic(input.keyFile, `${KEY_FILE_PREFIX}${encoded}\n`);
+		try {
+			chmodSync(input.keyFile, 384);
+		} catch {}
+	}
+	return loadVaultKey(input);
+}
+function vaultKeySourceStatus(input) {
+	const envKey = input.env?.CAPLETS_ENCRYPTION_KEY;
+	if (envKey !== void 0) try {
+		decodeExactKey(envKey, "CAPLETS_ENCRYPTION_KEY");
+		return {
+			available: true,
+			source: "env"
+		};
+	} catch {
+		return {
+			available: false,
+			source: "env",
+			reason: "invalid"
+		};
+	}
+	if (!existsSync(input.keyFile)) return {
+		available: false,
+		source: "file",
+		reason: "missing",
+		keyFile: input.keyFile
+	};
+	let mode;
+	try {
+		mode = statSync(input.keyFile).mode;
+	} catch (error) {
+		return unavailableKeyFileStatus(input.keyFile, error);
+	}
+	if (process.platform !== "win32" && (mode & 63) !== 0) return {
+		available: false,
+		source: "file",
+		reason: "wrong-permissions",
+		keyFile: input.keyFile
+	};
+	let contents;
+	try {
+		contents = readFileSync(input.keyFile, "utf8");
+	} catch (error) {
+		return unavailableKeyFileStatus(input.keyFile, error);
+	}
+	try {
+		parseKeyFile(contents);
+		return {
+			available: true,
+			source: "file",
+			keyFile: input.keyFile
+		};
+	} catch (error) {
+		return {
+			available: false,
+			source: "file",
+			reason: error instanceof CapletsError && error.message.includes("unsupported") ? "unsupported-version" : "invalid",
+			keyFile: input.keyFile
+		};
+	}
+}
+function unavailableKeyFileStatus(keyFile, error) {
+	return {
+		available: false,
+		source: "file",
+		reason: (error && typeof error === "object" && "code" in error ? String(error.code) : "") === "ENOENT" ? "missing" : "unreadable",
+		keyFile
+	};
+}
+function parseKeyFile(contents) {
+	const trimmed = contents.trim();
+	if (!trimmed.startsWith(KEY_FILE_PREFIX)) throw new CapletsError("CONFIG_INVALID", "Vault key file has an unsupported format version.");
+	return decodeExactKey(trimmed.slice(21), "Vault key file");
+}
+function decodeExactKey(encoded, label) {
+	let decoded;
+	try {
+		decoded = Buffer$1.from(encoded, "base64url");
+	} catch {
+		throw new CapletsError("REQUEST_INVALID", `${label} must be a base64url-encoded 32-byte key.`);
+	}
+	if (decoded.length !== KEY_BYTES || decoded.toString("base64url") !== encoded.replace(/=+$/u, "")) throw new CapletsError("REQUEST_INVALID", `${label} must be a base64url-encoded 32-byte key.`);
+	return decoded;
+}
+//#endregion
+//#region src/vault/access.ts
+function normalizeVaultGrant(input) {
+	const now = (input.now ?? /* @__PURE__ */ new Date()).toISOString();
+	return {
+		storedKey: validateVaultKeyName(input.storedKey),
+		referenceName: validateVaultKeyName(input.referenceName),
+		capletId: validateCapletId(input.capletId),
+		origin: normalizeOrigin(input.origin),
+		createdAt: now,
+		updatedAt: now
+	};
+}
+function upsertVaultGrant(grants, input) {
+	const next = normalizeVaultGrant(input);
+	return [...grants.filter((grant) => !sameGrantIdentity(grant, next)), {
+		...next,
+		createdAt: grants.find((grant) => sameGrantIdentity(grant, next))?.createdAt ?? next.createdAt
+	}].sort(compareGrants);
+}
+function filterVaultGrants(grants, filter = {}) {
+	return grants.filter((grant) => {
+		if (filter.storedKey !== void 0 && grant.storedKey !== filter.storedKey) return false;
+		if (filter.referenceName !== void 0 && grant.referenceName !== filter.referenceName) return false;
+		if (filter.capletId !== void 0 && grant.capletId !== filter.capletId) return false;
+		if (filter.origin !== void 0 && !sameOrigin(grant.origin, filter.origin)) return false;
+		return true;
+	});
+}
+function sameOrigin(left, right) {
+	return left.kind === right.kind && left.path === right.path;
+}
+function sameGrantIdentity(left, right) {
+	return left.referenceName === right.referenceName && left.capletId === right.capletId && sameOrigin(left.origin, right.origin);
+}
+function normalizeOrigin(origin) {
+	if (!origin.path) throw new CapletsError("REQUEST_INVALID", "Vault access grants require a config origin path.");
+	return {
+		kind: origin.kind,
+		path: origin.path
+	};
+}
+function validateCapletId(capletId) {
+	if (!/^[a-zA-Z0-9_-]{1,64}$/u.test(capletId)) throw new CapletsError("REQUEST_INVALID", "Vault access grants require a valid Caplet ID.");
+	return capletId;
+}
+function compareGrants(left, right) {
+	return left.capletId.localeCompare(right.capletId) || left.referenceName.localeCompare(right.referenceName) || left.storedKey.localeCompare(right.storedKey) || left.origin.kind.localeCompare(right.origin.kind) || left.origin.path.localeCompare(right.origin.path);
+}
+//#endregion
+//#region src/vault/types.ts
+const VAULT_MAX_VALUE_BYTES = 64 * 1024;
+//#endregion
+//#region src/vault/index.ts
+var FileVaultStore = class {
+	root;
+	env;
+	paths;
+	constructor(options = {}) {
+		this.root = options.root ?? join(defaultStateBaseDir(options.env), "caplets", "vault");
+		this.env = options.env ?? process.env;
+		this.paths = {
+			keyFile: join(this.root, "vault-key"),
+			valuesDir: join(this.root, "values"),
+			grantsFile: join(this.root, "access-grants.json")
+		};
+	}
+	valuePath(key) {
+		return join(this.paths.valuesDir, `${encodeURIComponent(validateVaultKeyName(key))}.json`);
+	}
+	set(key, value, options = {}) {
+		const normalizedKey = validateVaultKeyName(key);
+		if (Buffer$1.byteLength(value, "utf8") > 65536) throw new CapletsError("REQUEST_INVALID", `Vault values must be ${VAULT_MAX_VALUE_BYTES} bytes or smaller.`);
+		const path = this.valuePath(normalizedKey);
+		const existing = this.loadValueRecord(normalizedKey);
+		if (existing && !options.force) throw new CapletsError("CONFIG_EXISTS", `Vault key ${normalizedKey} already exists.`);
+		ensurePrivateDir(this.root);
+		ensurePrivateDir(this.paths.valuesDir);
+		const encrypted = encryptVaultValue({
+			plaintext: value,
+			key: ensureVaultKey({
+				keyFile: this.paths.keyFile,
+				env: this.env
+			}),
+			now: options.now ?? /* @__PURE__ */ new Date(),
+			...existing ? { existing } : {}
+		});
+		writePrivateFileAtomic(path, `${JSON.stringify(encrypted, null, 2)}\n`);
+		return this.statusForRecord(normalizedKey, encrypted);
+	}
+	getStatus(key) {
+		const normalizedKey = validateVaultKeyName(key);
+		const record = this.loadValueRecord(normalizedKey);
+		return record ? this.statusForRecord(normalizedKey, record) : {
+			key: normalizedKey,
+			present: false
+		};
+	}
+	listValues() {
+		if (!existsSync(this.paths.valuesDir)) return [];
+		return readdirSync(this.paths.valuesDir).filter((entry) => entry.endsWith(".json")).map((entry) => decodeURIComponent(basename(entry, ".json"))).map((key) => this.getStatus(key)).filter((status) => status.present).sort((left, right) => left.key.localeCompare(right.key));
+	}
+	resolveValue(key) {
+		const normalizedKey = validateVaultKeyName(key);
+		const record = this.loadValueRecord(normalizedKey);
+		if (!record) throw new CapletsError("CONFIG_INVALID", `Vault key ${normalizedKey} is missing.`);
+		return decryptVaultValue(record, loadVaultKey({
+			keyFile: this.paths.keyFile,
+			env: this.env
+		}));
+	}
+	delete(key) {
+		const normalizedKey = validateVaultKeyName(key);
+		return {
+			key: normalizedKey,
+			deleted: deleteFile(this.valuePath(normalizedKey)),
+			grantsRetained: this.listAccess({ storedKey: normalizedKey }).length
+		};
+	}
+	keySourceStatus() {
+		return vaultKeySourceStatus({
+			keyFile: this.paths.keyFile,
+			env: this.env
+		});
+	}
+	grantAccess(input) {
+		const next = normalizeVaultGrant(input);
+		const grants = upsertVaultGrant(this.loadAccessGrants(), input);
+		this.saveAccessGrants(grants);
+		return grants.find((grant) => grant.storedKey === next.storedKey && grant.referenceName === next.referenceName && grant.capletId === next.capletId && sameOrigin(grant.origin, next.origin));
+	}
+	listAccess(filter = {}) {
+		return filterVaultGrants(this.loadAccessGrants(), filter);
+	}
+	revokeAccess(filter) {
+		const removed = this.listAccess(filter);
+		if (removed.length === 0) return [];
+		const removedKeys = new Set(removed.map(accessGrantIdentity));
+		const remaining = this.loadAccessGrants().filter((grant) => !removedKeys.has(accessGrantIdentity(grant)));
+		this.saveAccessGrants(remaining);
+		return removed;
+	}
+	resolveGrantedValue(input) {
+		const referenceName = validateVaultKeyName(input.referenceName);
+		const grant = this.listAccess({
+			referenceName,
+			capletId: input.capletId,
+			origin: input.origin
+		})[0];
+		if (!grant) return {
+			reason: "ungranted",
+			referenceName,
+			capletId: input.capletId,
+			origin: input.origin
+		};
+		if (!existsSync(this.valuePath(grant.storedKey))) return {
+			reason: "missing",
+			storedKey: grant.storedKey,
+			referenceName,
+			capletId: input.capletId,
+			origin: input.origin
+		};
+		return {
+			storedKey: grant.storedKey,
+			value: this.resolveValue(grant.storedKey)
+		};
+	}
+	loadValueRecord(key) {
+		const path = this.valuePath(key);
+		if (!existsSync(path)) return void 0;
+		let raw;
+		try {
+			raw = readJsonFile(path, {});
+		} catch {
+			throw new CapletsError("CONFIG_INVALID", `Vault value record for ${key} is not valid JSON.`);
+		}
+		return parseEncryptedRecord(raw);
+	}
+	statusForRecord(key, record) {
+		return {
+			key,
+			present: true,
+			valueBytes: record.valueBytes,
+			createdAt: record.createdAt,
+			updatedAt: record.updatedAt
+		};
+	}
+	loadAccessGrants() {
+		let raw;
+		try {
+			raw = readJsonFile(this.paths.grantsFile, []);
+		} catch {
+			throw new CapletsError("CONFIG_INVALID", "Vault access grants file is not valid JSON.");
+		}
+		if (!Array.isArray(raw)) throw new CapletsError("CONFIG_INVALID", "Vault access grants file must contain an array.");
+		return raw.map(parseStoredGrant);
+	}
+	saveAccessGrants(grants) {
+		ensurePrivateDir(this.root);
+		writePrivateFileAtomic(this.paths.grantsFile, `${JSON.stringify(grants, null, 2)}\n`);
+	}
+};
+function accessGrantIdentity(grant) {
+	return [
+		grant.storedKey,
+		grant.referenceName,
+		grant.capletId,
+		grant.origin.kind,
+		grant.origin.path
+	].join("\0");
+}
+function parseStoredGrant(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) throw new CapletsError("CONFIG_INVALID", "Vault access grant must be an object.");
+	const record = value;
+	if (typeof record.storedKey !== "string" || typeof record.referenceName !== "string" || typeof record.capletId !== "string" || typeof record.createdAt !== "string" || typeof record.updatedAt !== "string" || !record.origin || typeof record.origin !== "object" || Array.isArray(record.origin)) throw new CapletsError("CONFIG_INVALID", "Vault access grant is malformed.");
+	const originRecord = record.origin;
+	if (typeof originRecord.kind !== "string" || typeof originRecord.path !== "string" || ![
+		"global-config",
+		"global-file",
+		"project-config",
+		"project-file"
+	].includes(originRecord.kind)) throw new CapletsError("CONFIG_INVALID", "Vault access grant origin is malformed.");
+	return {
+		...normalizeVaultGrant({
+			storedKey: record.storedKey,
+			referenceName: record.referenceName,
+			capletId: record.capletId,
+			origin: {
+				kind: originRecord.kind,
+				path: originRecord.path
+			}
+		}),
+		createdAt: record.createdAt,
+		updatedAt: record.updatedAt
+	};
 }
 //#endregion
 //#region src/config.ts
-const NON_INTERPOLATED_SERVER_FIELDS = new Set([
+const NON_INTERPOLATED_SERVER_FIELDS = /* @__PURE__ */ new Set([
 	"name",
 	"description",
 	"tags",
 	"body"
 ]);
+const VAULT_BARE_REFERENCE = "[A-Za-z0-9_-]+";
 const remoteAuthSchema = discriminatedUnion("type", [
 	object$1({ type: literal("none") }).strict(),
 	object$1({
@@ -27430,10 +27838,10 @@ function configSchemaFor(serverValueSchema, openApiEndpointValueSchema, googleDi
 }
 const configFileSchema = configSchemaFor(publicServerSchema, publicOpenApiEndpointSchema, publicGoogleDiscoveryApiSchema, publicGraphQlEndpointSchema, publicHttpApiSchema, publicCliToolsSchema, publicCapletSetSchema);
 const normalizedConfigFileSchema = configSchemaFor(normalizedServerSchema, normalizedOpenApiEndpointSchema, normalizedGoogleDiscoveryApiSchema, normalizedGraphQlEndpointSchema, normalizedHttpApiSchema, normalizedCliToolsSchema, normalizedCapletSetSchema);
-function loadConfig(path = resolveConfigPath(), projectPath = resolveProjectConfigPath()) {
-	return loadConfigWithSources(path, projectPath).config;
+function loadConfig(path = resolveConfigPath(), projectPath = resolveProjectConfigPath(), options = {}) {
+	return loadConfigWithSources(path, projectPath, options).config;
 }
-function loadConfigWithSources(path = resolveConfigPath(), projectPath = resolveProjectConfigPath()) {
+function loadConfigWithSources(path = resolveConfigPath(), projectPath = resolveProjectConfigPath(), options = {}) {
 	const hasUserConfig = existsSync(path);
 	const hasProjectConfig = existsSync(projectPath);
 	const userConfig = hasUserConfig ? readPublicConfigInput(path) : void 0;
@@ -27470,9 +27878,9 @@ function loadConfigWithSources(path = resolveConfigPath(), projectPath = resolve
 				path: projectCaplets.paths
 			}
 		} : void 0
-	], `Caplets config not found at ${path} or ${projectPath}`, "Caplets config must define at least one MCP server, OpenAPI endpoint, Google Discovery API, GraphQL endpoint, HTTP API, CLI tools backend, or Caplet set");
+	], `Caplets config not found at ${path} or ${projectPath}`, "Caplets config must define at least one MCP server, OpenAPI endpoint, Google Discovery API, GraphQL endpoint, HTTP API, CLI tools backend, or Caplet set", options);
 }
-function loadGlobalConfig(path = resolveConfigPath()) {
+function loadGlobalConfig(path = resolveConfigPath(), options = {}) {
 	const userConfig = existsSync(path) ? readPublicConfigInput(path) : void 0;
 	const userCaplets = loadCapletFilesWithPaths(resolveCapletsRoot(path));
 	return buildConfigWithSources([{
@@ -27487,9 +27895,9 @@ function loadGlobalConfig(path = resolveConfigPath()) {
 			kind: "global-file",
 			path: userCaplets.paths
 		}
-	} : void 0], `Caplets user config not found at ${path}`, void 0).config;
+	} : void 0], `Caplets user config not found at ${path}`, void 0, options).config;
 }
-function loadProjectConfig(projectPath = resolveProjectConfigPath()) {
+function loadProjectConfig(projectPath = resolveProjectConfigPath(), options = {}) {
 	const projectConfig = existsSync(projectPath) ? rejectProjectConfigExecutableBackendMaps(readPublicConfigInput(projectPath), projectPath) : void 0;
 	const projectCapletsRoot = resolveProjectCapletsRootForConfigPath(projectPath);
 	const projectCaplets = projectCapletsRoot ? loadCapletFilesWithPaths(projectCapletsRoot) : void 0;
@@ -27505,13 +27913,16 @@ function loadProjectConfig(projectPath = resolveProjectConfigPath()) {
 			kind: "project-file",
 			path: projectCaplets.paths
 		}
-	} : void 0], `Caplets project config not found at ${projectPath}`, void 0).config;
+	} : void 0], `Caplets project config not found at ${projectPath}`, void 0, options).config;
 }
-function buildConfigWithSources(inputs, notFoundMessage, emptyMessage) {
+function buildConfigWithSources(inputs, notFoundMessage, emptyMessage, options = {}) {
 	if (!inputs.some((entry) => entry?.input !== void 0)) throw new CapletsError("CONFIG_NOT_FOUND", notFoundMessage);
 	try {
 		const { input, sources, shadows } = mergeConfigInputsWithSources(...inputs);
-		const config = parseConfig(input);
+		const config = parseConfig(input, {
+			sources,
+			vaultResolver: options.vaultResolver ?? defaultVaultResolver()
+		});
 		if (emptyMessage && Object.keys(config.mcpServers).length === 0 && Object.keys(config.openapiEndpoints).length === 0 && Object.keys(config.googleDiscoveryApis).length === 0 && Object.keys(config.graphqlEndpoints).length === 0 && Object.keys(config.httpApis).length === 0 && Object.keys(config.cliTools).length === 0 && Object.keys(config.capletSets).length === 0) throw new CapletsError("CONFIG_INVALID", emptyMessage);
 		return {
 			config,
@@ -27523,13 +27934,18 @@ function buildConfigWithSources(inputs, notFoundMessage, emptyMessage) {
 		throw new CapletsError("CONFIG_INVALID", "Caplets config is not valid JSON", redactSecrets(error));
 	}
 }
-function loadLocalOverlayConfigWithSources(path = resolveConfigPath(), projectPath = resolveProjectConfigPath()) {
+function loadLocalOverlayConfigWithSources(path = resolveConfigPath(), projectPath = resolveProjectConfigPath(), options = {}) {
+	const parseOptions = {
+		vaultResolver: options.vaultResolver ?? defaultVaultResolver(),
+		vaultRecoveryTarget: options.vaultRecoveryTarget
+	};
 	const warnings = [];
-	const userConfig = existsSync(path) ? readBestEffortConfigInput(path, "global-config", warnings) : void 0;
-	const userCaplets = loadBestEffortCapletFiles(resolveCapletsRoot(path), "global-file", warnings);
-	const projectConfig = existsSync(projectPath) ? readBestEffortConfigInput(projectPath, "project-config", warnings, (input) => rejectProjectConfigExecutableBackendMaps(input, projectPath)) : void 0;
+	const userConfig = existsSync(path) ? readBestEffortConfigInput(path, "global-config", warnings, void 0, parseOptions) : void 0;
+	const userCaplets = loadBestEffortCapletFiles(resolveCapletsRoot(path), "global-file", warnings, parseOptions);
+	const projectConfig = existsSync(projectPath) ? readBestEffortConfigInput(projectPath, "project-config", warnings, (input) => rejectProjectConfigExecutableBackendMaps(input, projectPath), parseOptions) : void 0;
 	const projectCapletsRoot = resolveProjectCapletsRootForConfigPath(projectPath);
-	const projectCaplets = projectCapletsRoot ? loadBestEffortCapletFiles(projectCapletsRoot, "project-file", warnings) : void 0;
+	const projectCaplets = projectCapletsRoot ? loadBestEffortCapletFiles(projectCapletsRoot, "project-file", warnings, parseOptions) : void 0;
+	const sourceFound = Boolean(userConfig || userCaplets || projectConfig || projectCaplets);
 	const { input, sources, shadows } = mergeConfigInputsWithSources({
 		input: userConfig,
 		source: {
@@ -27556,17 +27972,40 @@ function loadLocalOverlayConfigWithSources(path = resolveConfigPath(), projectPa
 		}
 	} : void 0);
 	return {
-		config: parseConfig(input),
+		config: parseConfig(input, {
+			sources,
+			vaultResolver: parseOptions.vaultResolver
+		}),
 		sources,
 		shadows,
-		warnings
+		warnings,
+		sourceFound
 	};
 }
-function readBestEffortConfigInput(path, kind, warnings, transform) {
+function loadLocalRuntimeConfig(path = resolveConfigPath(), projectPath = resolveProjectConfigPath(), options = {}) {
+	const overlay = loadLocalOverlayConfigWithSources(path, projectPath, {
+		vaultResolver: options.vaultResolver,
+		vaultRecoveryTarget: options.vaultRecoveryTarget
+	});
+	for (const warning of overlay.warnings) options.writeWarning?.(warning);
+	const blockingWarning = overlay.warnings.find((warning) => !warning.recoverable && (warning.kind === "global-config" || warning.kind === "project-config"));
+	if (blockingWarning) throw new CapletsError("CONFIG_INVALID", blockingWarning.message);
+	if (!overlay.sourceFound) throw new CapletsError("CONFIG_NOT_FOUND", `Caplets config not found at ${path} or ${projectPath}`);
+	if (!configHasAnyCaplets(overlay.config) && !overlay.warnings.some((warning) => warning.recoverable)) throw new CapletsError("CONFIG_INVALID", "Caplets config must define at least one MCP server, OpenAPI endpoint, Google Discovery API, GraphQL endpoint, HTTP API, CLI tools backend, or Caplet set");
+	return overlay.config;
+}
+function readBestEffortConfigInput(path, kind, warnings, transform, options = {}) {
 	try {
 		const normalized = normalizeLocalPaths(readBestEffortJsonConfigInput(path), dirname(path));
-		const filtered = quarantineMissingEnvCaplets(transform ? transform(normalized) : normalized, kind, path, warnings);
-		const parsed = configFileSchema.safeParse(interpolateConfig(filtered));
+		const filtered = quarantineUnresolvedReferenceCaplets(transform ? transform(normalized) : normalized, kind, path, warnings, options);
+		const validationOptions = {
+			...options,
+			sources: Object.fromEntries(capletIds(filtered).map((id) => [id, {
+				kind,
+				path
+			}]))
+		};
+		const parsed = configFileSchema.safeParse(interpolateConfig(filtered, [], validationOptions));
 		if (!parsed.success) throw new CapletsError("CONFIG_INVALID", `Caplets config at ${path} is invalid`, parsed.error.issues);
 		return filtered;
 	} catch (error) {
@@ -27585,21 +28024,35 @@ function readBestEffortJsonConfigInput(path) {
 		throw new CapletsError("CONFIG_INVALID", `Caplets config at ${path} is not valid JSON`, redactSecrets(error));
 	}
 }
-function quarantineMissingEnvCaplets(input, kind, sourcePath, warnings) {
+function quarantineUnresolvedReferenceCaplets(input, kind, sourcePath, warnings, options = {}) {
 	let filtered = input;
 	for (const backend of CAPLET_BACKEND_KEYS) {
 		const caplets = filtered[backend];
 		if (!isPlainObject$5(caplets)) continue;
 		for (const [id, caplet] of Object.entries(caplets)) {
-			const missing = missingEnvReferences(caplet, [backend, id]);
-			if (missing.length === 0) continue;
+			const envMissing = missingEnvReferences(caplet, [backend, id]);
+			const capletSourcePath = typeof sourcePath === "function" ? sourcePath(id) : sourcePath;
+			const vaultIssues = unresolvedVaultReferences(caplet, [backend, id], {
+				capletId: id,
+				origin: {
+					kind,
+					path: capletSourcePath
+				}
+			}, options);
+			if (envMissing.length === 0 && vaultIssues.length === 0) continue;
 			filtered = removeCapletBackendId(filtered, backend, id);
-			warnings.push({
+			for (const missing of groupMissingEnvReferences(envMissing)) warnings.push({
 				kind,
-				path: typeof sourcePath === "function" ? sourcePath(id) : sourcePath,
+				path: capletSourcePath,
 				message: formatMissingEnvWarning(id, missing),
 				recoverable: true
 			});
+			for (const issue of vaultIssues) warnings.push({
+				kind,
+				path: capletSourcePath,
+				message: formatVaultReferenceWarning(id, issue, options.vaultRecoveryTarget),
+				recoverable: true
+			});
 		}
 	}
 	return filtered;
@@ -27627,7 +28080,90 @@ function formatMissingEnvWarning(id, missing) {
 	const paths = [...new Set(missing.map((reference) => reference.path))];
 	return `Caplet ${id} references missing ${names.length === 1 ? "environment variable" : "environment variables"} ${names.join(", ")} at ${paths.join(", ")}; skipping Caplet ${id}.`;
 }
-function loadBestEffortCapletFiles(root, kind, warnings) {
+function groupMissingEnvReferences(missing) {
+	return missing.length === 0 ? [] : [missing];
+}
+function configHasAnyCaplets(config) {
+	return Object.keys(config.mcpServers).length > 0 || Object.keys(config.openapiEndpoints).length > 0 || Object.keys(config.googleDiscoveryApis).length > 0 || Object.keys(config.graphqlEndpoints).length > 0 || Object.keys(config.httpApis).length > 0 || Object.keys(config.cliTools).length > 0 || Object.keys(config.capletSets).length > 0;
+}
+function unresolvedVaultReferences(value, path, context, options) {
+	if (isPublicMetadataPath(path)) return [];
+	if (typeof value === "string") return unresolvedVaultReferencesInString(value, path.join("."), context, options);
+	if (Array.isArray(value)) return value.flatMap((item, index) => unresolvedVaultReferences(item, [...path, String(index)], context, options));
+	if (isPlainObject$5(value)) return Object.entries(value).flatMap(([key, nested]) => unresolvedVaultReferences(nested, [...path, key], context, options));
+	return [];
+}
+function unresolvedVaultReferencesInString(value, path, context, options) {
+	const issues = [];
+	for (const match of value.matchAll(VAULT_REFERENCE_PATTERN)) {
+		const name = match[1] ?? match[2];
+		if (!name) continue;
+		try {
+			validateVaultKeyName(name);
+		} catch {
+			issues.push({
+				name,
+				path,
+				reason: "invalid-key-source"
+			});
+			continue;
+		}
+		const resolution = options.vaultResolver?.({
+			referenceName: name,
+			capletId: context.capletId,
+			origin: context.origin,
+			path
+		});
+		if (!resolution || !("value" in resolution)) {
+			const reason = resolution && "reason" in resolution ? resolution.reason : "unavailable";
+			issues.push({
+				name,
+				path,
+				reason,
+				...resolution && "storedKey" in resolution && resolution.storedKey ? { storedKey: resolution.storedKey } : {}
+			});
+		}
+	}
+	return issues;
+}
+function formatVaultReferenceWarning(id, issue, target) {
+	const key = issue.storedKey ?? issue.name;
+	const targetFlag = target === "remote" ? " --remote" : "";
+	if (issue.reason === "invalid-key-source") return `Caplet ${id} references invalid-key-source Vault key ${key} at ${issue.path}; run \`caplets doctor\` for key-source details, then reload Caplets; skipping Caplet ${id}.`;
+	if (issue.reason === "missing") return `Caplet ${id} references missing Vault key ${key} at ${issue.path}; run \`caplets vault set ${key}${targetFlag}\`, then reload Caplets; skipping Caplet ${id}.`;
+	const grantCommand = `caplets vault access grant ${key} ${id}${targetFlag}${key !== issue.name ? ` --as ${issue.name}` : ""}`;
+	return `Caplet ${id} references ${issue.reason} Vault key ${key} at ${issue.path}; run \`${grantCommand}\` after setting the value, then reload Caplets; skipping Caplet ${id}.`;
+}
+function defaultVaultResolver(store = new FileVaultStore()) {
+	return (reference) => {
+		try {
+			return store.resolveGrantedValue(reference);
+		} catch (error) {
+			return {
+				reason: error instanceof CapletsError ? "invalid-key-source" : "unavailable",
+				referenceName: reference.referenceName,
+				capletId: reference.capletId,
+				origin: reference.origin
+			};
+		}
+	};
+}
+function vaultStoreForAuthDir(authDir) {
+	return new FileVaultStore(authDir ? { root: join(authDir, "vault") } : {});
+}
+function vaultResolverForAuthDir(authDir) {
+	return defaultVaultResolver(vaultStoreForAuthDir(authDir));
+}
+const vaultBootstrapResolver = (reference) => ({
+	storedKey: reference.referenceName,
+	value: vaultBootstrapPlaceholderValue(reference.path)
+});
+function vaultBootstrapPlaceholderValue(path) {
+	const leaf = path.split(".").at(-1)?.toLowerCase() ?? "";
+	if (leaf.endsWith("url") || leaf.endsWith("uri") || leaf === "issuer") return "https://caplets.local/vault-placeholder";
+	return "caplets-vault-placeholder";
+}
+function loadBestEffortCapletFiles(root, kind, warnings, options = {}) {
 	const result = loadCapletFilesWithPathsBestEffort(root);
 	if (!result) return;
 	for (const warning of result.warnings) warnings.push({
@@ -27635,7 +28171,7 @@ function loadBestEffortCapletFiles(root, kind, warnings) {
 		path: warning.path ?? root,
 		message: warning.message
 	});
-	const config = quarantineMissingEnvCaplets(result.config, kind, (id) => result.paths[id] ?? root, warnings);
+	const config = quarantineUnresolvedReferenceCaplets(result.config, kind, (id) => result.paths[id] ?? root, warnings, options);
 	const retainedIds = new Set(capletIds(config));
 	return {
 		config,
@@ -27647,14 +28183,44 @@ function errorMessage$3(error) {
 }
 function loadIsolatedConfig(options) {
 	if (!options.configPath && !options.capletsRoot) throw new CapletsError("CONFIG_INVALID", "Nested Caplet set must define at least one source: configPath or capletsRoot");
-	const configInput = options.configPath ? readPublicConfigInput(options.configPath) : void 0;
-	const capletInput = options.capletsRoot ? loadCapletFiles(options.capletsRoot) : void 0;
-	if (!configInput && !capletInput) throw new CapletsError("CONFIG_NOT_FOUND", `Nested Caplet set sources not found: ${[options.configPath, options.capletsRoot].filter(Boolean).join(", ")}`);
-	const config = parseConfig(mergeConfigInputs(configInput, capletInput, {
-		version: 1,
-		defaultSearchLimit: options.defaultSearchLimit,
-		maxSearchLimit: options.maxSearchLimit
-	}));
+	const warnings = [];
+	const parseOptions = {
+		vaultResolver: options.vaultResolver ?? defaultVaultResolver(),
+		vaultRecoveryTarget: options.vaultRecoveryTarget
+	};
+	const configExists = Boolean(options.configPath && existsSync(options.configPath));
+	const configInput = configExists ? readBestEffortConfigInput(options.configPath, "global-config", warnings, void 0, parseOptions) : void 0;
+	const capletInput = options.capletsRoot ? loadBestEffortCapletFiles(options.capletsRoot, "global-file", warnings, parseOptions) : void 0;
+	if (!configExists && !capletInput) throw new CapletsError("CONFIG_NOT_FOUND", `Nested Caplet set sources not found: ${[options.configPath, options.capletsRoot].filter(Boolean).join(", ")}`);
+	const blockingWarning = warnings.find((warning) => !warning.recoverable);
+	if (blockingWarning) throw new CapletsError("CONFIG_INVALID", blockingWarning.message);
+	const { input, sources } = mergeConfigInputsWithSources({
+		input: configInput,
+		source: {
+			kind: "global-config",
+			path: options.configPath ?? ""
+		}
+	}, capletInput ? {
+		input: capletInput.config,
+		source: {
+			kind: "global-file",
+			path: capletInput.paths
+		}
+	} : void 0, {
+		input: {
+			version: 1,
+			defaultSearchLimit: options.defaultSearchLimit,
+			maxSearchLimit: options.maxSearchLimit
+		},
+		source: {
+			kind: "global-config",
+			path: options.configPath ?? ""
+		}
+	});
+	const config = parseConfig(input, {
+		sources,
+		vaultResolver: parseOptions.vaultResolver
+	});
 	if (Object.keys(config.mcpServers).length === 0 && Object.keys(config.openapiEndpoints).length === 0 && Object.keys(config.googleDiscoveryApis).length === 0 && Object.keys(config.graphqlEndpoints).length === 0 && Object.keys(config.httpApis).length === 0 && Object.keys(config.cliTools).length === 0 && Object.keys(config.capletSets).length === 0) throw new CapletsError("CONFIG_INVALID", "Nested Caplet set must define at least one Caplet");
 	return config;
 }
@@ -27665,7 +28231,14 @@ function resolveProjectCapletsRootForConfigPath(projectPath) {
 function readPublicConfigInput(path) {
 	try {
 		const normalized = normalizeLocalPaths(JSON.parse(readFileSync(path, "utf8")), dirname(path));
-		const parsed = configFileSchema.safeParse(interpolateConfig(normalized));
+		const validationOptions = {
+			sources: Object.fromEntries(capletIds(normalized).map((id) => [id, {
+				kind: "global-config",
+				path
+			}])),
+			vaultResolver: vaultBootstrapResolver
+		};
+		const parsed = configFileSchema.safeParse(interpolateConfig(normalized, [], validationOptions));
 		if (!parsed.success) throw new CapletsError("CONFIG_INVALID", `Caplets config at ${path} is invalid`, parsed.error.issues);
 		return normalized;
 	} catch (error) {
@@ -27729,7 +28302,7 @@ function normalizeCapletSetPaths(endpoint, baseDir) {
 	};
 }
 function normalizeLocalPath(value, baseDir) {
-	if (typeof value !== "string" || !value || isAbsolute(value) || hasEnvReference(value)) return value;
+	if (typeof value !== "string" || !value || isAbsolute(value) || hasInterpolationReference(value)) return value;
 	return join(baseDir, value);
 }
 function rejectProjectConfigExecutableBackendMaps(input, path) {
@@ -27845,8 +28418,8 @@ function sourceForId(source, id) {
 		path: typeof source.path === "string" ? source.path : source.path[id] ?? ""
 	};
 }
-function parseConfig(input) {
-	const parsed = normalizedConfigFileSchema.safeParse(interpolateConfig(input));
+function parseConfig(input, options = {}) {
+	const parsed = normalizedConfigFileSchema.safeParse(interpolateConfig(input, [], options));
 	if (!parsed.success) throw new CapletsError("CONFIG_INVALID", "Caplets config is invalid", parsed.error.issues);
 	const servers = {};
 	for (const [server, raw] of Object.entries(parsed.data.mcpServers)) {
@@ -27931,11 +28504,11 @@ function validateEndpointAuthHeaders(auth, ctx, path) {
 function stripUndefined(value) {
 	return Object.fromEntries(Object.entries(value).filter(([, nested]) => nested !== void 0));
 }
-function interpolateConfig(value, path = []) {
+function interpolateConfig(value, path = [], options = {}) {
 	if (isPublicMetadataPath(path)) return value;
-	if (typeof value === "string") return interpolateEnv(value);
-	if (Array.isArray(value)) return value.map((item, index) => interpolateConfig(item, [...path, String(index)]));
-	if (value && typeof value === "object") return Object.fromEntries(Object.entries(value).map(([nestedKey, nested]) => [nestedKey, interpolateConfig(nested, [...path, nestedKey])]));
+	if (typeof value === "string") return interpolateVault(interpolateEnv(value), path, options);
+	if (Array.isArray(value)) return value.map((item, index) => interpolateConfig(item, [...path, String(index)], options));
+	if (value && typeof value === "object") return Object.fromEntries(Object.entries(value).map(([nestedKey, nested]) => [nestedKey, interpolateConfig(nested, [...path, nestedKey], options)]));
 	return value;
 }
 function isPublicMetadataPath(path) {
@@ -27945,8 +28518,28 @@ function isPublicMetadataPath(path) {
 function isPlainObject$5(value) {
 	return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
-function hasEnvReference(value) {
-	return /\$\{[A-Za-z_][A-Za-z0-9_]*\}|\$env:[A-Za-z_][A-Za-z0-9_]*/.test(value);
+function hasInterpolationReference(value) {
+	return new RegExp(`\\$\\{[A-Za-z_][A-Za-z0-9_]*\\}|\\$env:[A-Za-z_][A-Za-z0-9_]*|\\$\\{vault:[^}]+\\}|\\$vault:${VAULT_BARE_REFERENCE}`).test(value);
+}
+const VAULT_REFERENCE_PATTERN = new RegExp(`\\$\\{vault:([^}]+)\\}|\\$vault:(${VAULT_BARE_REFERENCE})`, "g");
+function interpolateVault(value, path, options) {
+	if (!options.vaultResolver) return value;
+	const backend = path[0];
+	const capletId = path[1];
+	if (!backend || !capletId || !CAPLET_BACKEND_KEY_SET.has(backend)) return value;
+	const origin = options.sources?.[capletId];
+	if (!origin) return value;
+	return value.replace(VAULT_REFERENCE_PATTERN, (_match, braced, bare) => {
+		const referenceName = validateVaultKeyName(braced ?? bare);
+		const resolution = options.vaultResolver?.({
+			referenceName,
+			capletId,
+			origin,
+			path: path.join(".")
+		});
+		if (!resolution || !("value" in resolution)) throw new CapletsError("CONFIG_INVALID", `Vault key ${referenceName} is unresolved for Caplet ${capletId}`);
+		return resolution.value;
+	});
 }
 function interpolateEnv(value) {
 	return value.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g, (_match, name) => process.env[name] ?? "").replace(/\$env:([A-Za-z_][A-Za-z0-9_]*)/g, (_match, name) => process.env[name] ?? "");
@@ -27961,7 +28554,7 @@ function googleDiscoverySchemaToJsonSchema(value, schemas = {}, seen = /* @__PUR
 			type: "object",
 			additionalProperties: true
 		};
-		return googleDiscoverySchemaToJsonSchema(target, schemas, new Set([...seen, value.$ref]));
+		return googleDiscoverySchemaToJsonSchema(target, schemas, /* @__PURE__ */ new Set([...seen, value.$ref]));
 	}
 	const type = discoveryTypeToJsonSchemaType(value.type);
 	const converted = {};
@@ -41372,7 +41965,7 @@ var require_OverlappingFieldsCanBeMergedRule = /* @__PURE__ */ __commonJSMin(((e
 		}
 		add(a, b, weaklyPresent) {
 			const map = this._data.get(a);
-			if (map === void 0) this._data.set(a, new Map([[b, weaklyPresent]]));
+			if (map === void 0) this._data.set(a, /* @__PURE__ */ new Map([[b, weaklyPresent]]));
 			else map.set(b, weaklyPresent);
 		}
 	};
@@ -61332,7 +61925,7 @@ const HTTP_METHODS = [
 ];
 const DEFAULT_OPENAPI_RESPONSE_MAX_BYTES = 100 * 1024 * 1024;
 const JSON_CONTENT_TYPES = ["application/json"];
-const FORBIDDEN_ARGUMENT_HEADERS = new Set([
+const FORBIDDEN_ARGUMENT_HEADERS = /* @__PURE__ */ new Set([
 	"accept",
 	"authorization",
 	"connection",
@@ -62987,14 +63580,15 @@ var CapletSetManager = class CapletSetManager {
 				...config.configPath ? { configPath: config.configPath } : {},
 				...config.capletsRoot ? { capletsRoot: config.capletsRoot } : {},
 				defaultSearchLimit: config.defaultSearchLimit,
-				maxSearchLimit: config.maxSearchLimit
+				maxSearchLimit: config.maxSearchLimit,
+				vaultResolver: vaultResolverForAuthDir(this.options.authDir)
 			}));
 			const sharedOptions = {
 				...this.options.authDir ? { authDir: this.options.authDir } : {},
 				...this.options.artifactDir ? { artifactDir: this.options.artifactDir } : {},
 				...this.options.exposeLocalArtifactPaths === false ? { exposeLocalArtifactPaths: false } : {}
 			};
-			const childAncestry = new Set([...ancestry, cacheKey]);
+			const childAncestry = /* @__PURE__ */ new Set([...ancestry, cacheKey]);
 			child = {
 				registry,
 				downstream: new DownstreamManager(registry, sharedOptions),
@@ -63329,8 +63923,9 @@ var CapletsEngine = class {
 			configPath: resolveConfigPath(options.configPath),
 			projectConfigPath: options.projectConfigPath ?? resolveProjectConfigPath()
 		};
-		this.configLoader = options.configLoader ?? loadConfig;
-		const config = this.configLoader(this.paths.configPath, this.paths.projectConfigPath);
+		this.writeErr = options.writeErr ?? ((value) => process.stderr.write(value));
+		this.configLoader = options.configLoader ?? runtimeConfigLoader(options.authDir, options.vaultRecoveryTarget);
+		const config = this.loadConfigWithWarnings();
 		this.registry = new ServerRegistry(config);
 		this.downstream = new DownstreamManager(this.registry, selectAuthOptions(options.authDir));
 		this.openapi = new OpenApiManager(this.registry, selectHttpLikeOptions(options));
@@ -63341,7 +63936,6 @@ var CapletsEngine = class {
 		this.capletSets = new CapletSetManager(this.registry, selectHttpLikeOptions(options));
 		this.watchDebounceMs = options.watchDebounceMs ?? 250;
 		this.watchEnabled = options.watch ?? true;
-		this.writeErr = options.writeErr ?? ((value) => process.stderr.write(value));
 		this.observedOutputShapeStore = options.observedOutputShapeStore ?? new FileObservedOutputShapeStore(options.observedOutputShapeCacheDir ?? DEFAULT_OBSERVED_OUTPUT_SHAPE_CACHE_DIR);
 		this.observedOutputShapeScope = options.observedOutputShapeScope ?? "local";
 		this.projectFingerprint = options.projectFingerprint ?? safeProjectFingerprint();
@@ -63434,7 +64028,7 @@ var CapletsEngine = class {
 		}
 	}
 	async completeCliWords(words) {
-		const { completeCliWords } = await import("./completion-DrPr2vYw.js").then((n) => n.r);
+		const { completeCliWords } = await import("./completion-DaYL-XQN.js").then((n) => n.r);
 		return await completeCliWords(words, {
 			config: this.registry.config,
 			managers: {
@@ -63508,7 +64102,7 @@ var CapletsEngine = class {
 		if (this.closed) return false;
 		let nextConfig;
 		try {
-			nextConfig = this.configLoader(this.paths.configPath, this.paths.projectConfigPath);
+			nextConfig = this.loadConfigWithWarnings();
 		} catch (error) {
 			this.writeErr(`Caplets config reload failed; keeping last known-good config.\n`);
 			this.writeErr(`${JSON.stringify(toSafeError(error, "CONFIG_INVALID"), null, 2)}\n`);
@@ -63542,6 +64136,11 @@ var CapletsEngine = class {
 		});
 		return invalidated;
 	}
+	loadConfigWithWarnings() {
+		return this.configLoader(this.paths.configPath, this.paths.projectConfigPath, { writeWarning: (warning) => {
+			this.writeErr(`Warning: ${warning.kind} at ${warning.path}: ${warning.message}\n`);
+		} });
+	}
 	async reloadUntilSettled() {
 		let succeeded = true;
 		do {
@@ -63567,7 +64166,7 @@ var CapletsEngine = class {
 	async invalidateChangedBackends(previous, next) {
 		const previousCaplets = new Map(allCaplets(previous).map((server) => [server.server, server]));
 		const nextCaplets = new Map(allCaplets(next).map((server) => [server.server, server]));
-		const changedIds = new Set([...previousCaplets.keys(), ...nextCaplets.keys()]);
+		const changedIds = /* @__PURE__ */ new Set([...previousCaplets.keys(), ...nextCaplets.keys()]);
 		for (const serverId of changedIds) {
 			const before = previousCaplets.get(serverId);
 			const after = nextCaplets.get(serverId);
@@ -63631,6 +64230,14 @@ var CapletsEngine = class {
 		}, this.watchDebounceMs);
 	}
 };
+function runtimeConfigLoader(authDir, vaultRecoveryTarget) {
+	const vaultResolver = vaultResolverForAuthDir(authDir);
+	return (configPath, projectConfigPath, options) => loadLocalRuntimeConfig(configPath, projectConfigPath, {
+		...options,
+		vaultResolver,
+		vaultRecoveryTarget
+	});
+}
 function selectAuthOptions(authDir) {
 	return authDir ? { authDir } : {};
 }
@@ -63970,7 +64577,7 @@ var CodeModeJournalStore = class {
 			version: JOURNAL_VERSION,
 			journalKey,
 			sessionIdHash: this.sessionIdHash(input.sessionId),
-			recoveryRefHashes: [...new Set([...existing?.recoveryRefHashes ?? [], recoveryRefHash])],
+			recoveryRefHashes: [.../* @__PURE__ */ new Set([...existing?.recoveryRefHashes ?? [], recoveryRefHash])],
 			createdAt: existing?.createdAt ?? now.toISOString(),
 			updatedAt: now.toISOString(),
 			expiresAt,
@@ -65029,7 +65636,7 @@ var import_lib = (/* @__PURE__ */ __commonJSMin(((exports) => {
 		ParseExpressionEmptyInput: "Unexpected parseExpression() input: The input is empty or contains only comments.",
 		ParseExpressionExpectsEOF: ({ unexpected }) => `Unexpected parseExpression() input: The input should contain exactly one expression, but the first expression is followed by the unexpected character \`${String.fromCodePoint(unexpected)}\`.`
 	};
-	const UnparenthesizedPipeBodyDescriptions = new Set([
+	const UnparenthesizedPipeBodyDescriptions = /* @__PURE__ */ new Set([
 		"ArrowFunctionExpression",
 		"AssignmentExpression",
 		"ConditionalExpression",
@@ -66930,7 +67537,7 @@ var import_lib = (/* @__PURE__ */ __commonJSMin(((exports) => {
 	function isIteratorStart(current, next, next2) {
 		return current === 64 && next === 64 && isIdentifierStart(next2);
 	}
-	const reservedWordLikeSet = new Set([
+	const reservedWordLikeSet = /* @__PURE__ */ new Set([
 		"break",
 		"case",
 		"catch",
@@ -67136,7 +67743,7 @@ var import_lib = (/* @__PURE__ */ __commonJSMin(((exports) => {
 			if (!this.scopeStack[0].declareFunctions.has(id.name)) super.checkLocalExport(id);
 		}
 	};
-	const reservedTypes = new Set([
+	const reservedTypes = /* @__PURE__ */ new Set([
 		"_",
 		"any",
 		"bool",
@@ -70115,7 +70722,7 @@ var import_lib = (/* @__PURE__ */ __commonJSMin(((exports) => {
 		return code >= 48 && code <= 57;
 	};
 	const forbiddenNumericSeparatorSiblings = {
-		decBinOct: new Set([
+		decBinOct: /* @__PURE__ */ new Set([
 			46,
 			66,
 			69,
@@ -70125,7 +70732,7 @@ var import_lib = (/* @__PURE__ */ __commonJSMin(((exports) => {
 			101,
 			111
 		]),
-		hex: new Set([
+		hex: /* @__PURE__ */ new Set([
 			46,
 			88,
 			95,
@@ -70333,7 +70940,7 @@ var import_lib = (/* @__PURE__ */ __commonJSMin(((exports) => {
 	function buildPosition(pos, lineStart, curLine) {
 		return new Position(curLine, pos - lineStart, pos);
 	}
-	const VALID_REGEX_FLAGS = new Set([
+	const VALID_REGEX_FLAGS = /* @__PURE__ */ new Set([
 		103,
 		109,
 		115,
@@ -77791,10 +78398,10 @@ function resolveTimer(context, deferred, fired) {
 }
 //#endregion
 //#region src/code-mode/platform-runtime.generated.ts
-const CODE_MODE_PLATFORM_RUNTIME_SOURCE = "(function() {\n	//#region node_modules/.pnpm/@ungap+structured-clone@1.3.1/node_modules/@ungap/structured-clone/esm/deserialize.js\n	const env = typeof self === \"object\" ? self : globalThis;\n	const guard = (name, init) => {\n		switch (name) {\n			case \"Function\":\n			case \"SharedWorker\":\n			case \"Worker\":\n			case \"eval\":\n			case \"setInterval\":\n			case \"setTimeout\": throw new TypeError(\"unable to deserialize \" + name);\n		}\n		return new env[name](init);\n	};\n	const deserializer = ($, _) => {\n		const as = (out, index) => {\n			$.set(index, out);\n			return out;\n		};\n		const unpair = (index) => {\n			if ($.has(index)) return $.get(index);\n			const [type, value] = _[index];\n			switch (type) {\n				case 0:\n				case -1: return as(value, index);\n				case 1: {\n					const arr = as([], index);\n					for (const index of value) arr.push(unpair(index));\n					return arr;\n				}\n				case 2: {\n					const object = as({}, index);\n					for (const [key, index] of value) object[unpair(key)] = unpair(index);\n					return object;\n				}\n				case 3: return as(new Date(value), index);\n				case 4: {\n					const { source, flags } = value;\n					return as(new RegExp(source, flags), index);\n				}\n				case 5: {\n					const map = as(/* @__PURE__ */ new Map(), index);\n					for (const [key, index] of value) map.set(unpair(key), unpair(index));\n					return map;\n				}\n				case 6: {\n					const set = as(/* @__PURE__ */ new Set(), index);\n					for (const index of value) set.add(unpair(index));\n					return set;\n				}\n				case 7: {\n					const { name, message } = value;\n					return as(guard(name, message), index);\n				}\n				case 8: return as(BigInt(value), index);\n				case \"BigInt\": return as(Object(BigInt(value)), index);\n				case \"ArrayBuffer\": return as(new Uint8Array(value).buffer, value);\n				case \"DataView\": {\n					const { buffer } = new Uint8Array(value);\n					return as(new DataView(buffer), value);\n				}\n			}\n			return as(guard(type, value), index);\n		};\n		return unpair;\n	};\n	/**\n	* @typedef {Array<string,any>} Record a type representation\n	*/\n	/**\n	* Returns a deserialized value from a serialized array of Records.\n	* @param {Record[]} serialized a previously serialized value.\n	* @returns {any}\n	*/\n	const deserialize = (serialized) => deserializer(/* @__PURE__ */ new Map(), serialized)(0);\n	//#endregion\n	//#region node_modules/.pnpm/@ungap+structured-clone@1.3.1/node_modules/@ungap/structured-clone/esm/serialize.js\n	const EMPTY = \"\";\n	const { toString } = {};\n	const { keys } = Object;\n	const typeOf = (value) => {\n		const type = typeof value;\n		if (type !== \"object\" || !value) return [0, type];\n		const asString = toString.call(value).slice(8, -1);\n		switch (asString) {\n			case \"Array\": return [1, EMPTY];\n			case \"Object\": return [2, EMPTY];\n			case \"Date\": return [3, EMPTY];\n			case \"RegExp\": return [4, EMPTY];\n			case \"Map\": return [5, EMPTY];\n			case \"Set\": return [6, EMPTY];\n			case \"DataView\": return [1, asString];\n		}\n		if (asString.includes(\"Array\")) return [1, asString];\n		if (asString.includes(\"Error\")) return [7, asString];\n		return [2, asString];\n	};\n	const shouldSkip = ([TYPE, type]) => TYPE === 0 && (type === \"function\" || type === \"symbol\");\n	const serializer = (strict, json, $, _) => {\n		const as = (out, value) => {\n			const index = _.push(out) - 1;\n			$.set(value, index);\n			return index;\n		};\n		const pair = (value) => {\n			if ($.has(value)) return $.get(value);\n			let [TYPE, type] = typeOf(value);\n			switch (TYPE) {\n				case 0: {\n					let entry = value;\n					switch (type) {\n						case \"bigint\":\n							TYPE = 8;\n							entry = value.toString();\n							break;\n						case \"function\":\n						case \"symbol\":\n							if (strict) throw new TypeError(\"unable to serialize \" + type);\n							entry = null;\n							break;\n						case \"undefined\": return as([-1], value);\n					}\n					return as([TYPE, entry], value);\n				}\n				case 1: {\n					if (type) {\n						let spread = value;\n						if (type === \"DataView\") spread = new Uint8Array(value.buffer);\n						else if (type === \"ArrayBuffer\") spread = new Uint8Array(value);\n						return as([type, [...spread]], value);\n					}\n					const arr = [];\n					const index = as([TYPE, arr], value);\n					for (const entry of value) arr.push(pair(entry));\n					return index;\n				}\n				case 2: {\n					if (type) switch (type) {\n						case \"BigInt\": return as([type, value.toString()], value);\n						case \"Boolean\":\n						case \"Number\":\n						case \"String\": return as([type, value.valueOf()], value);\n					}\n					if (json && \"toJSON\" in value) return pair(value.toJSON());\n					const entries = [];\n					const index = as([TYPE, entries], value);\n					for (const key of keys(value)) if (strict || !shouldSkip(typeOf(value[key]))) entries.push([pair(key), pair(value[key])]);\n					return index;\n				}\n				case 3: return as([TYPE, value.toISOString()], value);\n				case 4: {\n					const { source, flags } = value;\n					return as([TYPE, {\n						source,\n						flags\n					}], value);\n				}\n				case 5: {\n					const entries = [];\n					const index = as([TYPE, entries], value);\n					for (const [key, entry] of value) if (strict || !(shouldSkip(typeOf(key)) || shouldSkip(typeOf(entry)))) entries.push([pair(key), pair(entry)]);\n					return index;\n				}\n				case 6: {\n					const entries = [];\n					const index = as([TYPE, entries], value);\n					for (const entry of value) if (strict || !shouldSkip(typeOf(entry))) entries.push(pair(entry));\n					return index;\n				}\n			}\n			const { message } = value;\n			return as([TYPE, {\n				name: type,\n				message\n			}], value);\n		};\n		return pair;\n	};\n	/**\n	* @typedef {Array<string,any>} Record a type representation\n	*/\n	/**\n	* Returns an array of serialized Records.\n	* @param {any} value a serializable value.\n	* @param {{json?: boolean, lossy?: boolean}?} options an object with a `lossy` or `json` property that,\n	*  if `true`, will not throw errors on incompatible types, and behave more\n	*  like JSON stringify would behave. Symbol and Function will be discarded.\n	* @returns {Record[]}\n	*/\n	const serialize = (value, { json, lossy } = {}) => {\n		const _ = [];\n		return serializer(!(json || lossy), !!json, /* @__PURE__ */ new Map(), _)(value), _;\n	};\n	//#endregion\n	//#region node_modules/.pnpm/@ungap+structured-clone@1.3.1/node_modules/@ungap/structured-clone/esm/index.js\n	/**\n	* @typedef {Array<string,any>} Record a type representation\n	*/\n	/**\n	* Returns an array of serialized Records.\n	* @param {any} any a serializable value.\n	* @param {{transfer?: any[], json?: boolean, lossy?: boolean}?} options an object with\n	* a transfer option (ignored when polyfilled) and/or non standard fields that\n	* fallback to the polyfill if present.\n	* @returns {Record[]}\n	*/\n	var esm_default = typeof structuredClone === \"function\" ? (any, options) => options && (\"json\" in options || \"lossy\" in options) ? deserialize(serialize(any, options)) : structuredClone(any) : (any, options) => deserialize(serialize(any, options));\n	//#endregion\n	//#region node_modules/.pnpm/formdata-node@6.0.3/node_modules/formdata-node/lib/form-data.js\n	var __accessCheck = (obj, member, msg) => {\n		if (!member.has(obj)) throw TypeError(\"Cannot \" + msg);\n	};\n	var __privateGet = (obj, member, getter) => {\n		__accessCheck(obj, member, \"read from private field\");\n		return getter ? getter.call(obj) : member.get(obj);\n	};\n	var __privateAdd = (obj, member, value) => {\n		if (member.has(obj)) throw TypeError(\"Cannot add the same private member more than once\");\n		member instanceof WeakSet ? member.add(obj) : member.set(obj, value);\n	};\n	var __privateSet = (obj, member, value, setter) => {\n		__accessCheck(obj, member, \"write to private field\");\n		setter ? setter.call(obj, value) : member.set(obj, value);\n		return value;\n	};\n	var __privateMethod = (obj, member, method) => {\n		__accessCheck(obj, member, \"access private method\");\n		return method;\n	};\n	var isFunction = (value) => typeof value === \"function\";\n	var isObject = (value) => typeof value === \"object\" && value != null && !Array.isArray(value);\n	var isAsyncIterable = (value) => isObject(value) && isFunction(value[Symbol.asyncIterator]);\n	var MAX_CHUNK_SIZE = 65536;\n	async function* clonePart(value) {\n		if (value.byteLength <= MAX_CHUNK_SIZE) {\n			yield value;\n			return;\n		}\n		let offset = 0;\n		while (offset < value.byteLength) {\n			const size = Math.min(value.byteLength - offset, MAX_CHUNK_SIZE);\n			const buffer = value.buffer.slice(offset, offset + size);\n			offset += buffer.byteLength;\n			yield new Uint8Array(buffer);\n		}\n	}\n	async function* readStream(readable) {\n		const reader = readable.getReader();\n		while (true) {\n			const { done, value } = await reader.read();\n			if (done) break;\n			yield value;\n		}\n	}\n	async function* chunkStream(stream) {\n		for await (const value of stream) yield* clonePart(value);\n	}\n	var getStreamIterator = (source) => {\n		if (isAsyncIterable(source)) return chunkStream(source);\n		if (isFunction(source.getReader)) return chunkStream(readStream(source));\n		throw new TypeError(\"Unsupported data source: Expected either ReadableStream or async iterable.\");\n	};\n	async function* consumeNodeBlob(blob) {\n		let position = 0;\n		while (position !== blob.size) {\n			const buffer = await blob.slice(position, Math.min(blob.size, position + MAX_CHUNK_SIZE)).arrayBuffer();\n			position += buffer.byteLength;\n			yield new Uint8Array(buffer);\n		}\n	}\n	async function* consumeBlobParts(parts, clone = false) {\n		for (const part of parts) if (ArrayBuffer.isView(part)) if (clone) yield* clonePart(part);\n		else yield part;\n		else if (isFunction(part.stream)) yield* getStreamIterator(part.stream());\n		else yield* consumeNodeBlob(part);\n	}\n	function* sliceBlob(blobParts, blobSize, start = 0, end) {\n		end ??= blobSize;\n		let relativeStart = start < 0 ? Math.max(blobSize + start, 0) : Math.min(start, blobSize);\n		let relativeEnd = end < 0 ? Math.max(blobSize + end, 0) : Math.min(end, blobSize);\n		const span = Math.max(relativeEnd - relativeStart, 0);\n		let added = 0;\n		for (const part of blobParts) {\n			if (added >= span) break;\n			const partSize = ArrayBuffer.isView(part) ? part.byteLength : part.size;\n			if (relativeStart && partSize <= relativeStart) {\n				relativeStart -= partSize;\n				relativeEnd -= partSize;\n			} else {\n				let chunk;\n				if (ArrayBuffer.isView(part)) {\n					chunk = part.subarray(relativeStart, Math.min(partSize, relativeEnd));\n					added += chunk.byteLength;\n				} else {\n					chunk = part.slice(relativeStart, Math.min(partSize, relativeEnd));\n					added += chunk.size;\n				}\n				relativeEnd -= partSize;\n				relativeStart = 0;\n				yield chunk;\n			}\n		}\n	}\n	var _parts, _type, _size;\n	var _Blob = class _Blob {\n		/**\n		* Returns a new [`Blob`](https://developer.mozilla.org/en-US/docs/Web/API/Blob) object.\n		* The content of the blob consists of the concatenation of the values given in the parameter array.\n		*\n		* @param blobParts An `Array` strings, or [`ArrayBuffer`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/ArrayBuffer), [`ArrayBufferView`](https://developer.mozilla.org/en-US/docs/Web/API/ArrayBufferView), [`Blob`](https://developer.mozilla.org/en-US/docs/Web/API/Blob) objects, or a mix of any of such objects, that will be put inside the [`Blob`](https://developer.mozilla.org/en-US/docs/Web/API/Blob).\n		* @param options An optional object of type `BlobPropertyBag`.\n		*/\n		constructor(blobParts = [], options = {}) {\n			/**\n			* An `Array` of [`ArrayBufferView`](https://developer.mozilla.org/en-US/docs/Web/API/ArrayBufferView) or [`Blob`](https://developer.mozilla.org/en-US/docs/Web/API/Blob) objects, or a mix of any of such objects, that will be put inside the [`Blob`](https://developer.mozilla.org/en-US/docs/Web/API/Blob).\n			*/\n			__privateAdd(this, _parts, []);\n			/**\n			* Returns the [`MIME type`](https://developer.mozilla.org/en-US/docs/Glossary/MIME_type) of the [`Blob`](https://developer.mozilla.org/en-US/docs/Web/API/Blob) or [`File`](https://developer.mozilla.org/en-US/docs/Web/API/File).\n			*/\n			__privateAdd(this, _type, \"\");\n			/**\n			* Returns the size of the [`Blob`](https://developer.mozilla.org/en-US/docs/Web/API/Blob) or [`File`](https://developer.mozilla.org/en-US/docs/Web/API/File) in bytes.\n			*/\n			__privateAdd(this, _size, 0);\n			options ??= {};\n			if (typeof blobParts !== \"object\" || blobParts === null) throw new TypeError(\"Failed to construct 'Blob': The provided value cannot be converted to a sequence.\");\n			if (!isFunction(blobParts[Symbol.iterator])) throw new TypeError(\"Failed to construct 'Blob': The object must have a callable @@iterator property.\");\n			if (typeof options !== \"object\" && !isFunction(options)) throw new TypeError(\"Failed to construct 'Blob': parameter 2 cannot convert to dictionary.\");\n			const encoder = new TextEncoder();\n			for (const raw of blobParts) {\n				let part;\n				if (ArrayBuffer.isView(raw)) part = new Uint8Array(raw.buffer.slice(raw.byteOffset, raw.byteOffset + raw.byteLength));\n				else if (raw instanceof ArrayBuffer) part = new Uint8Array(raw.slice(0));\n				else if (raw instanceof _Blob) part = raw;\n				else part = encoder.encode(String(raw));\n				__privateSet(this, _size, __privateGet(this, _size) + (ArrayBuffer.isView(part) ? part.byteLength : part.size));\n				__privateGet(this, _parts).push(part);\n			}\n			const type = options.type === void 0 ? \"\" : String(options.type);\n			__privateSet(this, _type, /^[\\x20-\\x7E]*$/.test(type) ? type : \"\");\n		}\n		static [Symbol.hasInstance](value) {\n			return Boolean(value && typeof value === \"object\" && isFunction(value.constructor) && (isFunction(value.stream) || isFunction(value.arrayBuffer)) && /^(Blob|File)$/.test(value[Symbol.toStringTag]));\n		}\n		/**\n		* Returns the [`MIME type`](https://developer.mozilla.org/en-US/docs/Glossary/MIME_type) of the [`Blob`](https://developer.mozilla.org/en-US/docs/Web/API/Blob) or [`File`](https://developer.mozilla.org/en-US/docs/Web/API/File).\n		*/\n		get type() {\n			return __privateGet(this, _type);\n		}\n		/**\n		* Returns the size of the [`Blob`](https://developer.mozilla.org/en-US/docs/Web/API/Blob) or [`File`](https://developer.mozilla.org/en-US/docs/Web/API/File) in bytes.\n		*/\n		get size() {\n			return __privateGet(this, _size);\n		}\n		/**\n		* Creates and returns a new [`Blob`](https://developer.mozilla.org/en-US/docs/Web/API/Blob) object which contains data from a subset of the blob on which it's called.\n		*\n		* @param start An index into the Blob indicating the first byte to include in the new Blob. If you specify a negative value, it's treated as an offset from the end of the Blob toward the beginning. For example, -10 would be the 10th from last byte in the Blob. The default value is 0. If you specify a value for start that is larger than the size of the source Blob, the returned Blob has size 0 and contains no data.\n		* @param end An index into the Blob indicating the first byte that will *not* be included in the new Blob (i.e. the byte exactly at this index is not included). If you specify a negative value, it's treated as an offset from the end of the Blob toward the beginning. For example, -10 would be the 10th from last byte in the Blob. The default value is size.\n		* @param contentType The content type to assign to the new Blob; this will be the value of its type property. The default value is an empty string.\n		*/\n		slice(start, end, contentType) {\n			return new _Blob(sliceBlob(__privateGet(this, _parts), this.size, start, end), { type: contentType });\n		}\n		/**\n		* Returns a [`Promise`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Promise) that resolves with a string containing the contents of the blob, interpreted as UTF-8.\n		*/\n		async text() {\n			const decoder = new TextDecoder();\n			let result = \"\";\n			for await (const chunk of consumeBlobParts(__privateGet(this, _parts))) result += decoder.decode(chunk, { stream: true });\n			result += decoder.decode();\n			return result;\n		}\n		/**\n		* Returns a [`Promise`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Promise) that resolves with the contents of the blob as binary data contained in an [`ArrayBuffer`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/ArrayBuffer).\n		*/\n		async arrayBuffer() {\n			const view = new Uint8Array(this.size);\n			let offset = 0;\n			for await (const chunk of consumeBlobParts(__privateGet(this, _parts))) {\n				view.set(chunk, offset);\n				offset += chunk.length;\n			}\n			return view.buffer;\n		}\n		/**\n		* Returns a [`ReadableStream`](https://developer.mozilla.org/en-US/docs/Web/API/ReadableStream) which upon reading returns the data contained within the [`Blob`](https://developer.mozilla.org/en-US/docs/Web/API/Blob).\n		*/\n		stream() {\n			const iterator = consumeBlobParts(__privateGet(this, _parts), true);\n			return new ReadableStream({\n				async pull(controller) {\n					const { value, done } = await iterator.next();\n					if (done) return queueMicrotask(() => controller.close());\n					controller.enqueue(value);\n				},\n				async cancel() {\n					await iterator.return();\n				}\n			});\n		}\n		get [Symbol.toStringTag]() {\n			return \"Blob\";\n		}\n	};\n	_parts = /* @__PURE__ */ new WeakMap();\n	_type = /* @__PURE__ */ new WeakMap();\n	_size = /* @__PURE__ */ new WeakMap();\n	var Blob = _Blob;\n	Object.defineProperties(Blob.prototype, {\n		type: { enumerable: true },\n		size: { enumerable: true },\n		slice: { enumerable: true },\n		stream: { enumerable: true },\n		text: { enumerable: true },\n		arrayBuffer: { enumerable: true }\n	});\n	var isBlob = (value) => value instanceof Blob;\n	var _name, _lastModified;\n	var File = class extends Blob {\n		/**\n		* Creates a new File instance.\n		*\n		* @param fileBits An `Array` strings, or [`ArrayBuffer`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/ArrayBuffer), [`ArrayBufferView`](https://developer.mozilla.org/en-US/docs/Web/API/ArrayBufferView), [`Blob`](https://developer.mozilla.org/en-US/docs/Web/API/Blob) objects, or a mix of any of such objects, that will be put inside the [`File`](https://developer.mozilla.org/en-US/docs/Web/API/File).\n		* @param name The name of the file.\n		* @param options An options object containing optional attributes for the file.\n		*/\n		constructor(fileBits, name, options = {}) {\n			super(fileBits, options);\n			/**\n			* Returns the name of the file referenced by the File object.\n			*/\n			__privateAdd(this, _name, void 0);\n			/**\n			* The last modified date of the file as the number of milliseconds since the Unix epoch (January 1, 1970 at midnight). Files without a known last modified date return the current date.\n			*/\n			__privateAdd(this, _lastModified, 0);\n			if (arguments.length < 2) throw new TypeError(`Failed to construct 'File': 2 arguments required, but only ${arguments.length} present.`);\n			__privateSet(this, _name, String(name));\n			const lastModified = options.lastModified === void 0 ? Date.now() : Number(options.lastModified);\n			if (!Number.isNaN(lastModified)) __privateSet(this, _lastModified, lastModified);\n		}\n		static [Symbol.hasInstance](value) {\n			return value instanceof Blob && value[Symbol.toStringTag] === \"File\" && typeof value.name === \"string\";\n		}\n		/**\n		* Name of the file referenced by the File object.\n		*/\n		get name() {\n			return __privateGet(this, _name);\n		}\n		/* c8 ignore next 3 */\n		get webkitRelativePath() {\n			return \"\";\n		}\n		/**\n		* The last modified date of the file as the number of milliseconds since the Unix epoch (January 1, 1970 at midnight). Files without a known last modified date return the current date.\n		*/\n		get lastModified() {\n			return __privateGet(this, _lastModified);\n		}\n		get [Symbol.toStringTag]() {\n			return \"File\";\n		}\n	};\n	_name = /* @__PURE__ */ new WeakMap();\n	_lastModified = /* @__PURE__ */ new WeakMap();\n	var isFile = (value) => value instanceof File;\n	var _entries, _setEntry, setEntry_fn;\n	var FormData = class {\n		constructor() {\n			__privateAdd(this, _setEntry);\n			/**\n			* Stores internal data for every entry\n			*/\n			__privateAdd(this, _entries, /* @__PURE__ */ new Map());\n		}\n		static [Symbol.hasInstance](value) {\n			if (!value) return false;\n			const val = value;\n			return Boolean(isFunction(val.constructor) && val[Symbol.toStringTag] === \"FormData\" && isFunction(val.append) && isFunction(val.set) && isFunction(val.get) && isFunction(val.getAll) && isFunction(val.has) && isFunction(val.delete) && isFunction(val.entries) && isFunction(val.values) && isFunction(val.keys) && isFunction(val[Symbol.iterator]) && isFunction(val.forEach));\n		}\n		/**\n		* Appends a new value onto an existing key inside a FormData object,\n		* or adds the key if it does not already exist.\n		*\n		* The difference between `set()` and `append()` is that if the specified key already exists, `set()` will overwrite all existing values with the new one, whereas `append()` will append the new value onto the end of the existing set of values.\n		*\n		* @param name The name of the field whose data is contained in `value`.\n		* @param value The field's value. This can be [`Blob`](https://developer.mozilla.org/en-US/docs/Web/API/Blob)\n		or [`File`](https://developer.mozilla.org/en-US/docs/Web/API/File). If none of these are specified the value is converted to a string.\n		* @param fileName The filename reported to the server, when a Blob or File is passed as the second parameter. The default filename for Blob objects is \"blob\". The default filename for File objects is the file's filename.\n		*/\n		append(name, value, fileName) {\n			__privateMethod(this, _setEntry, setEntry_fn).call(this, {\n				name,\n				fileName,\n				append: true,\n				rawValue: value,\n				argsLength: arguments.length\n			});\n		}\n		/**\n		* Set a new value for an existing key inside FormData,\n		* or add the new field if it does not already exist.\n		*\n		* @param name The name of the field whose data is contained in `value`.\n		* @param value The field's value. This can be [`Blob`](https://developer.mozilla.org/en-US/docs/Web/API/Blob)\n		or [`File`](https://developer.mozilla.org/en-US/docs/Web/API/File). If none of these are specified the value is converted to a string.\n		* @param fileName The filename reported to the server, when a Blob or File is passed as the second parameter. The default filename for Blob objects is \"blob\". The default filename for File objects is the file's filename.\n		*\n		*/\n		set(name, value, fileName) {\n			__privateMethod(this, _setEntry, setEntry_fn).call(this, {\n				name,\n				fileName,\n				append: false,\n				rawValue: value,\n				argsLength: arguments.length\n			});\n		}\n		/**\n		* Returns the first value associated with a given key from within a `FormData` object.\n		* If you expect multiple values and want all of them, use the `getAll()` method instead.\n		*\n		* @param {string} name A name of the value you want to retrieve.\n		*\n		* @returns A `FormDataEntryValue` containing the value. If the key doesn't exist, the method returns null.\n		*/\n		get(name) {\n			const field = __privateGet(this, _entries).get(String(name));\n			if (!field) return null;\n			return field[0];\n		}\n		/**\n		* Returns all the values associated with a given key from within a `FormData` object.\n		*\n		* @param {string} name A name of the value you want to retrieve.\n		*\n		* @returns An array of `FormDataEntryValue` whose key matches the value passed in the `name` parameter. If the key doesn't exist, the method returns an empty list.\n		*/\n		getAll(name) {\n			const field = __privateGet(this, _entries).get(String(name));\n			if (!field) return [];\n			return field.slice();\n		}\n		/**\n		* Returns a boolean stating whether a `FormData` object contains a certain key.\n		*\n		* @param name A string representing the name of the key you want to test for.\n		*\n		* @return A boolean value.\n		*/\n		has(name) {\n			return __privateGet(this, _entries).has(String(name));\n		}\n		/**\n		* Deletes a key and its value(s) from a `FormData` object.\n		*\n		* @param name The name of the key you want to delete.\n		*/\n		delete(name) {\n			__privateGet(this, _entries).delete(String(name));\n		}\n		/**\n		* Returns an [`iterator`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Iteration_protocols) allowing to go through all keys contained in this `FormData` object.\n		* Each key is a `string`.\n		*/\n		*keys() {\n			for (const key of __privateGet(this, _entries).keys()) yield key;\n		}\n		/**\n		* Returns an [`iterator`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Iteration_protocols) allowing to go through the `FormData` key/value pairs.\n		* The key of each pair is a string; the value is a [`FormDataValue`](https://developer.mozilla.org/en-US/docs/Web/API/FormDataEntryValue).\n		*/\n		*entries() {\n			for (const name of this.keys()) {\n				const values = this.getAll(name);\n				for (const value of values) yield [name, value];\n			}\n		}\n		/**\n		* Returns an [`iterator`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Iteration_protocols) allowing to go through all values contained in this object `FormData` object.\n		* Each value is a [`FormDataValue`](https://developer.mozilla.org/en-US/docs/Web/API/FormDataEntryValue).\n		*/\n		*values() {\n			for (const [, value] of this) yield value;\n		}\n		/**\n		* An alias for FormData#entries()\n		*/\n		[Symbol.iterator]() {\n			return this.entries();\n		}\n		/**\n		* Executes given callback function for each field of the FormData instance\n		*/\n		forEach(callback, thisArg) {\n			for (const [name, value] of this) callback.call(thisArg, value, name, this);\n		}\n		get [Symbol.toStringTag]() {\n			return \"FormData\";\n		}\n	};\n	_entries = /* @__PURE__ */ new WeakMap();\n	_setEntry = /* @__PURE__ */ new WeakSet();\n	setEntry_fn = function({ name, rawValue, append, fileName, argsLength }) {\n		const methodName = append ? \"append\" : \"set\";\n		if (argsLength < 2) throw new TypeError(`Failed to execute '${methodName}' on 'FormData': 2 arguments required, but only ${argsLength} present.`);\n		name = String(name);\n		let value;\n		if (isFile(rawValue)) value = fileName === void 0 ? rawValue : new File([rawValue], fileName, {\n			type: rawValue.type,\n			lastModified: rawValue.lastModified\n		});\n		else if (isBlob(rawValue)) value = new File([rawValue], fileName === void 0 ? \"blob\" : fileName, { type: rawValue.type });\n		else if (fileName) throw new TypeError(`Failed to execute '${methodName}' on 'FormData': parameter 2 is not of type 'Blob'.`);\n		else value = String(rawValue);\n		const values = __privateGet(this, _entries).get(name);\n		if (!values) {\n			__privateGet(this, _entries).set(name, [value]);\n			return;\n		}\n		if (!append) {\n			__privateGet(this, _entries).set(name, [value]);\n			return;\n		}\n		values.push(value);\n	};\n	/*! Based on fetch-blob. MIT License. Jimmy Wärting <https://jimmy.warting.se/opensource> & David Frank */\n	//#endregion\n	//#region node_modules/.pnpm/set-cookie-parser@3.1.0/node_modules/set-cookie-parser/lib/set-cookie.js\n	var defaultParseOptions = {\n		decodeValues: true,\n		map: false,\n		silent: false,\n		split: \"auto\"\n	};\n	function isForbiddenKey(key) {\n		return typeof key !== \"string\" || key in {};\n	}\n	function createNullObj() {\n		return Object.create(null);\n	}\n	function isNonEmptyString(str) {\n		return typeof str === \"string\" && !!str.trim();\n	}\n	function parseString(setCookieValue, options) {\n		var parts = setCookieValue.split(\";\").filter(isNonEmptyString);\n		var parsed = parseNameValuePair(parts.shift());\n		var name = parsed.name;\n		var value = parsed.value;\n		options = options ? Object.assign({}, defaultParseOptions, options) : defaultParseOptions;\n		if (isForbiddenKey(name)) return null;\n		try {\n			value = options.decodeValues ? decodeURIComponent(value) : value;\n		} catch (e) {\n			console.error(\"set-cookie-parser: failed to decode cookie value. Set options.decodeValues=false to disable decoding.\", e);\n		}\n		var cookie = createNullObj();\n		cookie.name = name;\n		cookie.value = value;\n		parts.forEach(function(part) {\n			var sides = part.split(\"=\");\n			var key = sides.shift().trimLeft().toLowerCase();\n			if (isForbiddenKey(key)) return;\n			var value = sides.join(\"=\");\n			if (key === \"expires\") cookie.expires = new Date(value);\n			else if (key === \"max-age\") {\n				var n = parseInt(value, 10);\n				if (!Number.isNaN(n)) cookie.maxAge = n;\n			} else if (key === \"secure\") cookie.secure = true;\n			else if (key === \"httponly\") cookie.httpOnly = true;\n			else if (key === \"samesite\") cookie.sameSite = value;\n			else if (key === \"partitioned\") cookie.partitioned = true;\n			else if (key) cookie[key] = value;\n		});\n		return cookie;\n	}\n	function parseNameValuePair(nameValuePairStr) {\n		var name = \"\";\n		var value = \"\";\n		var nameValueArr = nameValuePairStr.split(\"=\");\n		if (nameValueArr.length > 1) {\n			name = nameValueArr.shift();\n			value = nameValueArr.join(\"=\");\n		} else value = nameValuePairStr;\n		return {\n			name,\n			value\n		};\n	}\n	function parseSetCookie(input, options) {\n		options = options ? Object.assign({}, defaultParseOptions, options) : defaultParseOptions;\n		if (!input) if (!options.map) return [];\n		else return createNullObj();\n		if (input.headers) if (typeof input.headers.getSetCookie === \"function\") input = input.headers.getSetCookie();\n		else if (input.headers[\"set-cookie\"]) input = input.headers[\"set-cookie\"];\n		else {\n			var sch = input.headers[Object.keys(input.headers).find(function(key) {\n				return key.toLowerCase() === \"set-cookie\";\n			})];\n			if (!sch && input.headers.cookie && !options.silent) console.warn(\"Warning: set-cookie-parser appears to have been called on a request object. It is designed to parse Set-Cookie headers from responses, not Cookie headers from requests. Set the option {silent: true} to suppress this warning.\");\n			input = sch;\n		}\n		var split = options.split;\n		var isArray = Array.isArray(input);\n		if (split === \"auto\") split = !isArray;\n		if (!isArray) input = [input];\n		input = input.filter(isNonEmptyString);\n		if (split) input = input.map(splitCookiesString).flat();\n		if (!options.map) return input.map(function(str) {\n			return parseString(str, options);\n		}).filter(Boolean);\n		else {\n			var cookies = createNullObj();\n			return input.reduce(function(cookies, str) {\n				var cookie = parseString(str, options);\n				if (cookie && !isForbiddenKey(cookie.name)) cookies[cookie.name] = cookie;\n				return cookies;\n			}, cookies);\n		}\n	}\n	function splitCookiesString(cookiesString) {\n		if (Array.isArray(cookiesString)) return cookiesString;\n		if (typeof cookiesString !== \"string\") return [];\n		var cookiesStrings = [];\n		var pos = 0;\n		var start;\n		var ch;\n		var lastComma;\n		var nextStart;\n		var cookiesSeparatorFound;\n		function skipWhitespace() {\n			while (pos < cookiesString.length && /\\s/.test(cookiesString.charAt(pos))) pos += 1;\n			return pos < cookiesString.length;\n		}\n		function notSpecialChar() {\n			ch = cookiesString.charAt(pos);\n			return ch !== \"=\" && ch !== \";\" && ch !== \",\";\n		}\n		while (pos < cookiesString.length) {\n			start = pos;\n			cookiesSeparatorFound = false;\n			while (skipWhitespace()) {\n				ch = cookiesString.charAt(pos);\n				if (ch === \",\") {\n					lastComma = pos;\n					pos += 1;\n					skipWhitespace();\n					nextStart = pos;\n					while (pos < cookiesString.length && notSpecialChar()) pos += 1;\n					if (pos < cookiesString.length && cookiesString.charAt(pos) === \"=\") {\n						cookiesSeparatorFound = true;\n						pos = nextStart;\n						cookiesStrings.push(cookiesString.substring(start, lastComma));\n						start = pos;\n					} else pos = lastComma + 1;\n				} else pos += 1;\n			}\n			if (!cookiesSeparatorFound || pos >= cookiesString.length) cookiesStrings.push(cookiesString.substring(start, cookiesString.length));\n		}\n		return cookiesStrings;\n	}\n	parseSetCookie.parseSetCookie = parseSetCookie;\n	parseSetCookie.parse = parseSetCookie;\n	parseSetCookie.parseString = parseString;\n	parseSetCookie.splitCookiesString = splitCookiesString;\n	//#endregion\n	//#region node_modules/.pnpm/headers-polyfill@5.0.1/node_modules/headers-polyfill/lib/index.mjs\n	const HEADERS_INVALID_CHARACTERS = /[^a-z0-9\\-#$%&'*+.^_`|~]/i;\n	function normalizeHeaderName(name) {\n		if (HEADERS_INVALID_CHARACTERS.test(name) || name.trim() === \"\") throw new TypeError(\"Invalid character in header field name\");\n		return name.trim().toLowerCase();\n	}\n	const charCodesToRemove = [\n		String.fromCharCode(10),\n		String.fromCharCode(13),\n		String.fromCharCode(9),\n		String.fromCharCode(32)\n	];\n	const HEADER_VALUE_REMOVE_REGEXP = new RegExp(`(^[${charCodesToRemove.join(\"\")}]|$[${charCodesToRemove.join(\"\")}])`, \"g\");\n	/**\n	* Normalize the given header value.\n	* @see https://fetch.spec.whatwg.org/#concept-header-value-normalize\n	*/\n	function normalizeHeaderValue(value) {\n		return value.replace(HEADER_VALUE_REMOVE_REGEXP, \"\");\n	}\n	/**\n	* Validate the given header name.\n	* @see https://fetch.spec.whatwg.org/#header-name\n	*/\n	function isValidHeaderName(value) {\n		if (typeof value !== \"string\") return false;\n		if (value.length === 0) return false;\n		for (let i = 0; i < value.length; i++) {\n			const character = value.charCodeAt(i);\n			if (character > 127 || !isToken(character)) return false;\n		}\n		return true;\n	}\n	function isToken(value) {\n		return ![\n			127,\n			32,\n			\"(\",\n			\")\",\n			\"<\",\n			\">\",\n			\"@\",\n			\",\",\n			\";\",\n			\":\",\n			\"\\\\\",\n			\"\\\"\",\n			\"/\",\n			\"[\",\n			\"]\",\n			\"?\",\n			\"=\",\n			\"{\",\n			\"}\"\n		].includes(value);\n	}\n	/**\n	* Validate the given header value.\n	* @see https://fetch.spec.whatwg.org/#header-value\n	*/\n	function isValidHeaderValue(value) {\n		if (typeof value !== \"string\") return false;\n		if (value.trim() !== value) return false;\n		for (let i = 0; i < value.length; i++) {\n			const character = value.charCodeAt(i);\n			if (character === 0 || character === 10 || character === 13) return false;\n		}\n		return true;\n	}\n	let _Symbol$toStringTag;\n	const NORMALIZED_HEADERS = Symbol(\"normalizedHeaders\");\n	const RAW_HEADER_NAMES = Symbol(\"rawHeaderNames\");\n	const HEADER_VALUE_DELIMITER = \", \";\n	var Headers = class Headers {\n		constructor(init) {\n			this[NORMALIZED_HEADERS] = {};\n			this[RAW_HEADER_NAMES] = /* @__PURE__ */ new Map();\n			this[_Symbol$toStringTag] = \"Headers\";\n			/**\n			* @note Cannot necessarily check if the `init` is an instance of the\n			* `Headers` because that class may not be defined in Node or jsdom.\n			*/\n			if ([\"Headers\", \"HeadersPolyfill\"].includes(init?.constructor?.name) || init instanceof Headers || typeof globalThis.Headers !== \"undefined\" && init instanceof globalThis.Headers) init.forEach((value, name) => {\n				this.append(name, value);\n			}, this);\n			else if (Array.isArray(init)) init.forEach(([name, value]) => {\n				this.append(name, Array.isArray(value) ? value.join(HEADER_VALUE_DELIMITER) : value);\n			});\n			else if (init) Object.getOwnPropertyNames(init).forEach((name) => {\n				const value = init[name];\n				this.append(name, Array.isArray(value) ? value.join(HEADER_VALUE_DELIMITER) : value);\n			});\n		}\n		[(_Symbol$toStringTag = Symbol.toStringTag, Symbol.iterator)]() {\n			return this.entries();\n		}\n		*keys() {\n			for (const [name] of this.entries()) yield name;\n		}\n		*values() {\n			for (const [, value] of this.entries()) yield value;\n		}\n		*entries() {\n			let sortedKeys = Object.keys(this[NORMALIZED_HEADERS]).sort((a, b) => a.localeCompare(b));\n			for (const name of sortedKeys) if (name === \"set-cookie\") for (const value of this.getSetCookie()) yield [name, value];\n			else yield [name, this.get(name)];\n		}\n		/**\n		* Returns a boolean stating whether a `Headers` object contains a certain header.\n		*/\n		has(name) {\n			if (!isValidHeaderName(name)) throw new TypeError(`Invalid header name \"${name}\"`);\n			return this[NORMALIZED_HEADERS].hasOwnProperty(normalizeHeaderName(name));\n		}\n		/**\n		* Returns a `ByteString` sequence of all the values of a header with a given name.\n		*/\n		get(name) {\n			if (!isValidHeaderName(name)) throw TypeError(`Invalid header name \"${name}\"`);\n			return this[NORMALIZED_HEADERS][normalizeHeaderName(name)] ?? null;\n		}\n		/**\n		* Sets a new value for an existing header inside a `Headers` object, or adds the header if it does not already exist.\n		*/\n		set(name, value) {\n			if (!isValidHeaderName(name) || !isValidHeaderValue(value)) return;\n			const normalizedName = normalizeHeaderName(name);\n			const normalizedValue = normalizeHeaderValue(value);\n			this[NORMALIZED_HEADERS][normalizedName] = normalizeHeaderValue(normalizedValue);\n			this[RAW_HEADER_NAMES].set(normalizedName, name);\n		}\n		/**\n		* Appends a new value onto an existing header inside a `Headers` object, or adds the header if it does not already exist.\n		*/\n		append(name, value) {\n			if (!isValidHeaderName(name) || !isValidHeaderValue(value)) return;\n			const normalizedName = normalizeHeaderName(name);\n			const normalizedValue = normalizeHeaderValue(value);\n			let resolvedValue = this.has(normalizedName) ? `${this.get(normalizedName)}, ${normalizedValue}` : normalizedValue;\n			this.set(name, resolvedValue);\n		}\n		/**\n		* Deletes a header from the `Headers` object.\n		*/\n		delete(name) {\n			if (!isValidHeaderName(name)) return;\n			if (!this.has(name)) return;\n			const normalizedName = normalizeHeaderName(name);\n			delete this[NORMALIZED_HEADERS][normalizedName];\n			this[RAW_HEADER_NAMES].delete(normalizedName);\n		}\n		/**\n		* Traverses the `Headers` object,\n		* calling the given callback for each header.\n		*/\n		forEach(callback, thisArg) {\n			for (const [name, value] of this.entries()) callback.call(thisArg, value, name, this);\n		}\n		/**\n		* Returns an array containing the values\n		* of all Set-Cookie headers associated\n		* with a response\n		*/\n		getSetCookie() {\n			const setCookieHeader = this.get(\"set-cookie\");\n			if (setCookieHeader === null) return [];\n			if (setCookieHeader === \"\") return [\"\"];\n			return splitCookiesString(setCookieHeader);\n		}\n	};\n	//#endregion\n	//#region packages/core/src/code-mode/platform-entry.ts\n	const platformBridgeGlobalThis = globalThis;\n	const capletsPlatformHost = {\n		randomUUID: platformBridgeGlobalThis.__caplets_platform_random_uuid,\n		randomValues: platformBridgeGlobalThis.__caplets_platform_random_values,\n		sleep: platformBridgeGlobalThis.__caplets_platform_sleep,\n		clearTimer: platformBridgeGlobalThis.__caplets_platform_clear_timer\n	};\n	delete platformBridgeGlobalThis.__caplets_platform_random_uuid;\n	delete platformBridgeGlobalThis.__caplets_platform_random_values;\n	delete platformBridgeGlobalThis.__caplets_platform_sleep;\n	delete platformBridgeGlobalThis.__caplets_platform_clear_timer;\n	const DISABLED_FETCH_MESSAGE = \"Direct fetch is not available in Code Mode; use a Caplet instead.\";\n	const BASE64_ALPHABET = \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\";\n	const base64Lookup = new Map(BASE64_ALPHABET.split(\"\").map((char, index) => [char, index]));\n	function utf8Encode(input) {\n		const encoded = encodeURIComponent(input);\n		const bytes = [];\n		for (let index = 0; index < encoded.length; index += 1) {\n			if (encoded[index] === \"%\") {\n				bytes.push(Number.parseInt(encoded.slice(index + 1, index + 3), 16));\n				index += 2;\n				continue;\n			}\n			bytes.push(encoded.charCodeAt(index));\n		}\n		return Uint8Array.from(bytes);\n	}\n	function utf8Decode(input) {\n		let output = \"\";\n		for (let index = 0; index < input.length; index += 1) {\n			const first = input[index] ?? 0;\n			if (first < 128) {\n				output += String.fromCharCode(first);\n				continue;\n			}\n			if (first >= 194 && first <= 223) {\n				const second = input[index + 1];\n				if (isUtf8Continuation(second)) {\n					output += String.fromCodePoint((first & 31) << 6 | second & 63);\n					index += 1;\n					continue;\n				}\n				output += \"�\";\n				continue;\n			}\n			if (first >= 224 && first <= 239) {\n				const second = input[index + 1];\n				const third = input[index + 2];\n				if (isValidUtf8SecondForThreeByte(first, second) && isUtf8Continuation(third)) {\n					output += String.fromCodePoint((first & 15) << 12 | (second & 63) << 6 | third & 63);\n					index += 2;\n					continue;\n				}\n				output += \"�\";\n				if (isValidUtf8SecondForThreeByte(first, second)) index += 1;\n				continue;\n			}\n			if (first >= 240 && first <= 244) {\n				const second = input[index + 1];\n				const third = input[index + 2];\n				const fourth = input[index + 3];\n				if (isValidUtf8SecondForFourByte(first, second) && isUtf8Continuation(third) && isUtf8Continuation(fourth)) {\n					output += String.fromCodePoint((first & 7) << 18 | (second & 63) << 12 | (third & 63) << 6 | fourth & 63);\n					index += 3;\n					continue;\n				}\n				output += \"�\";\n				if (isValidUtf8SecondForFourByte(first, second)) index += isUtf8Continuation(third) ? 2 : 1;\n				continue;\n			}\n			output += \"�\";\n		}\n		return output;\n	}\n	function isUtf8Continuation(value) {\n		return value !== void 0 && value >= 128 && value <= 191;\n	}\n	function isValidUtf8SecondForThreeByte(first, second) {\n		if (second === void 0) return false;\n		if (first === 224) return second >= 160 && second <= 191;\n		if (first === 237) return second >= 128 && second <= 159;\n		return second >= 128 && second <= 191;\n	}\n	function isValidUtf8SecondForFourByte(first, second) {\n		if (second === void 0) return false;\n		if (first === 240) return second >= 144 && second <= 191;\n		if (first === 244) return second >= 128 && second <= 143;\n		return second >= 128 && second <= 191;\n	}\n	var TextEncoderShim = class {\n		encoding = \"utf-8\";\n		encode(input = \"\") {\n			return utf8Encode(String(input));\n		}\n	};\n	var TextDecoderShim = class {\n		encoding;\n		constructor(label = \"utf-8\") {\n			const normalized = label.toLowerCase();\n			if (![\n				\"utf-8\",\n				\"utf8\",\n				\"unicode-1-1-utf-8\"\n			].includes(normalized)) throw new TypeError(`Unsupported encoding: ${label}`);\n			this.encoding = \"utf-8\";\n		}\n		decode(input) {\n			if (input === void 0) return \"\";\n			return utf8Decode(copyBytes(input));\n		}\n	};\n	const textEncoder = new TextEncoderShim();\n	const textDecoder = new TextDecoderShim();\n	var URLSearchParamsShim = class URLSearchParamsShim {\n		#entries = [];\n		#onChange;\n		constructor(init = \"\", onChange) {\n			this.#onChange = onChange;\n			if (typeof init === \"string\") {\n				const source = init.startsWith(\"?\") ? init.slice(1) : init;\n				if (!source) return;\n				for (const pair of source.split(\"&\")) {\n					if (!pair) continue;\n					const separatorIndex = pair.indexOf(\"=\");\n					const key = separatorIndex >= 0 ? pair.slice(0, separatorIndex) : pair;\n					const value = separatorIndex >= 0 ? pair.slice(separatorIndex + 1) : \"\";\n					this.#entries.push([decodeUrlParam(key), decodeUrlParam(value)]);\n				}\n				return;\n			}\n			if (init instanceof URLSearchParamsShim) {\n				this.#entries = [...init.#entries];\n				return;\n			}\n			if (Array.isArray(init)) {\n				this.#entries = init.map(([key, value]) => [String(key), String(value)]);\n				return;\n			}\n			this.#entries = Object.entries(init).map(([key, value]) => [key, String(value)]);\n		}\n		append(name, value) {\n			this.#entries.push([String(name), String(value)]);\n			this.#onChange?.();\n		}\n		delete(name) {\n			const normalized = String(name);\n			this.#entries = this.#entries.filter(([key]) => key !== normalized);\n			this.#onChange?.();\n		}\n		entries() {\n			return this.#entries[Symbol.iterator]();\n		}\n		forEach(callback) {\n			for (const [key, value] of this.#entries) callback(value, key, this);\n		}\n		get(name) {\n			return this.#entries.find(([key]) => key === String(name))?.[1] ?? null;\n		}\n		getAll(name) {\n			return this.#entries.filter(([key]) => key === String(name)).map(([, value]) => value);\n		}\n		has(name) {\n			return this.#entries.some(([key]) => key === String(name));\n		}\n		keys() {\n			return this.#entries.map(([key]) => key)[Symbol.iterator]();\n		}\n		set(name, value) {\n			const normalizedName = String(name);\n			const normalizedValue = String(value);\n			const next = [];\n			let replaced = false;\n			for (const entry of this.#entries) {\n				if (entry[0] !== normalizedName) {\n					next.push(entry);\n					continue;\n				}\n				if (!replaced) {\n					next.push([normalizedName, normalizedValue]);\n					replaced = true;\n				}\n			}\n			if (!replaced) next.push([normalizedName, normalizedValue]);\n			this.#entries = next;\n			this.#onChange?.();\n		}\n		toString() {\n			return this.#entries.map(([key, value]) => `${encodeURIComponent(key)}=${encodeURIComponent(value)}`).join(\"&\");\n		}\n		values() {\n			return this.#entries.map(([, value]) => value)[Symbol.iterator]();\n		}\n		[Symbol.iterator]() {\n			return this.entries();\n		}\n	};\n	function decodeUrlParam(value) {\n		return decodeURIComponent(value.replace(/\\+/gu, \" \"));\n	}\n	function parseAbsoluteUrl(input) {\n		const match = /^(?<protocol>[a-zA-Z][a-zA-Z\\d+.-]*:)\\/\\/(?<host>[^/?#]*)(?<pathname>[^?#]*)?(?<search>\\?[^#]*)?(?<hash>#.*)?$/u.exec(input);\n		if (!match?.groups?.protocol || !match.groups.host) return;\n		return {\n			protocol: match.groups.protocol,\n			host: match.groups.host,\n			pathname: match.groups.pathname || \"/\",\n			search: match.groups.search || \"\",\n			hash: match.groups.hash || \"\"\n		};\n	}\n	function normalizePathname(pathname) {\n		const segments = [];\n		for (const part of pathname.split(\"/\")) {\n			if (!part || part === \".\") continue;\n			if (part === \"..\") {\n				segments.pop();\n				continue;\n			}\n			segments.push(part);\n		}\n		return `/${segments.join(\"/\")}`;\n	}\n	function resolveUrl(input, base) {\n		const absolute = parseAbsoluteUrl(input);\n		if (absolute) return absolute;\n		if (base === void 0) throw new TypeError(`Invalid URL: ${input}`);\n		const baseUrl = base instanceof URLShim ? base : new URLShim(String(base));\n		const basePath = baseUrl.pathname.endsWith(\"/\") ? baseUrl.pathname : baseUrl.pathname.slice(0, baseUrl.pathname.lastIndexOf(\"/\") + 1);\n		const [beforeHash, rawHash = \"\"] = input.split(\"#\");\n		const hasExplicitSearch = beforeHash?.includes(\"?\") ?? false;\n		const [rawPath, rawSearch = \"\"] = (beforeHash ?? \"\").split(\"?\");\n		const pathname = rawPath === \"\" && (input === \"\" || input.startsWith(\"?\") || input.startsWith(\"#\")) ? baseUrl.pathname : rawPath?.startsWith(\"/\") ? rawPath : `${basePath}${rawPath || \"\"}`;\n		return {\n			protocol: baseUrl.protocol,\n			host: baseUrl.host,\n			pathname: normalizePathname(pathname),\n			search: hasExplicitSearch ? `?${rawSearch}` : rawPath === \"\" && (input === \"\" || input.startsWith(\"#\")) ? baseUrl.search : \"\",\n			hash: rawHash ? `#${rawHash}` : \"\"\n		};\n	}\n	var URLShim = class {\n		host;\n		hostname;\n		origin;\n		password = \"\";\n		port;\n		protocol;\n		searchParams;\n		username = \"\";\n		hash;\n		pathname;\n		#search;\n		constructor(input, base) {\n			const parsed = resolveUrl(String(input), base);\n			this.protocol = parsed.protocol;\n			this.host = parsed.host;\n			const portIndex = this.host.lastIndexOf(\":\");\n			this.hostname = portIndex >= 0 ? this.host.slice(0, portIndex) : this.host;\n			this.port = portIndex >= 0 ? this.host.slice(portIndex + 1) : \"\";\n			this.pathname = parsed.pathname;\n			this.#search = parsed.search;\n			this.hash = parsed.hash;\n			this.origin = `${this.protocol}//${this.host}`;\n			this.searchParams = new URLSearchParamsShim(this.#search, () => {\n				const next = this.searchParams.toString();\n				this.#search = next ? `?${next}` : \"\";\n			});\n		}\n		get href() {\n			return `${this.origin}${this.pathname}${this.#search}${this.hash}`;\n		}\n		get search() {\n			return this.#search;\n		}\n		toString() {\n			return this.href;\n		}\n		toJSON() {\n			return this.href;\n		}\n	};\n	var ReadableStreamShim = class {\n		#queue = [];\n		#closed = false;\n		#pulling = false;\n		#source;\n		#controller;\n		#pending;\n		constructor(source = {}) {\n			this.#source = source;\n			this.#controller = {\n				enqueue: (value) => {\n					if (this.#pending) {\n						this.#pending.resolve({\n							done: false,\n							value\n						});\n						this.#pending = void 0;\n						return;\n					}\n					this.#queue.push(value);\n				},\n				close: () => {\n					this.#closed = true;\n					if (this.#pending) {\n						this.#pending.resolve({ done: true });\n						this.#pending = void 0;\n					}\n				}\n			};\n			source.start?.(this.#controller);\n		}\n		async #pull() {\n			if (this.#pulling || this.#closed || !this.#source.pull) return;\n			this.#pulling = true;\n			try {\n				await this.#source.pull(this.#controller);\n			} finally {\n				this.#pulling = false;\n			}\n		}\n		getReader() {\n			return { read: async () => {\n				if (this.#queue.length > 0) return {\n					done: false,\n					value: this.#queue.shift()\n				};\n				await this.#pull();\n				if (this.#queue.length > 0) return {\n					done: false,\n					value: this.#queue.shift()\n				};\n				if (this.#closed) return {\n					done: true,\n					value: void 0\n				};\n				return await new Promise((resolve) => {\n					this.#pending = { resolve };\n					this.#pull();\n				});\n			} };\n		}\n	};\n	var WritableStreamShim = class {\n		#sink;\n		constructor(sink = {}) {\n			this.#sink = sink;\n		}\n		getWriter() {\n			return {\n				write: async (chunk) => {\n					await this.#sink.write?.(chunk);\n				},\n				close: async () => {\n					await this.#sink.close?.();\n				}\n			};\n		}\n	};\n	var TransformStreamShim = class {\n		readable;\n		writable;\n		constructor(transformer = {}) {\n			const queue = [];\n			let closed = false;\n			let pending;\n			const controller = {\n				enqueue: (value) => {\n					if (pending) {\n						pending.resolve({\n							done: false,\n							value\n						});\n						pending = void 0;\n						return;\n					}\n					queue.push(value);\n				},\n				close: () => {\n					closed = true;\n					if (pending) {\n						pending.resolve({ done: true });\n						pending = void 0;\n					}\n				}\n			};\n			this.readable = { getReader() {\n				return { read: async () => {\n					if (queue.length > 0) return {\n						done: false,\n						value: queue.shift()\n					};\n					if (closed) return {\n						done: true,\n						value: void 0\n					};\n					return await new Promise((resolve) => {\n						pending = { resolve };\n					});\n				} };\n			} };\n			this.writable = new WritableStreamShim({\n				write: async (chunk) => {\n					transformer.transform?.(chunk, controller);\n				},\n				close: async () => {\n					transformer.flush?.(controller);\n					controller.close();\n				}\n			});\n		}\n	};\n	function definePlatformGlobal(name, value, options = {}) {\n		if (!options.overwrite && name in globalThis) return;\n		Object.defineProperty(globalThis, name, {\n			value,\n			writable: true,\n			configurable: true\n		});\n	}\n	function formatLogArg(value) {\n		if (typeof value === \"string\") return value;\n		try {\n			return JSON.stringify(value);\n		} catch {\n			return String(value);\n		}\n	}\n	function formatLogLine(args) {\n		return args.map(formatLogArg).join(\" \");\n	}\n	const platformConsole = {\n		log: (...args) => __caplets_log(\"log\", formatLogLine(args)),\n		info: (...args) => __caplets_log(\"info\", formatLogLine(args)),\n		warn: (...args) => __caplets_log(\"warn\", formatLogLine(args)),\n		error: (...args) => __caplets_log(\"error\", formatLogLine(args)),\n		debug: (...args) => __caplets_log(\"debug\", formatLogLine(args))\n	};\n	function normalizeEncoding(encoding) {\n		const normalized = (encoding ?? \"utf8\").toLowerCase();\n		switch (normalized) {\n			case \"utf8\":\n			case \"utf-8\":\n			case \"base64\":\n			case \"base64url\":\n			case \"hex\": return normalized;\n			default: throw new TypeError(`Unsupported Buffer encoding: ${encoding}`);\n		}\n	}\n	function hexToBytes(value) {\n		if (value.length % 2 !== 0) throw new TypeError(\"Invalid hex string length\");\n		const bytes = new Uint8Array(value.length / 2);\n		for (let index = 0; index < value.length; index += 2) {\n			const parsed = Number.parseInt(value.slice(index, index + 2), 16);\n			if (Number.isNaN(parsed)) throw new TypeError(\"Invalid hex string\");\n			bytes[index / 2] = parsed;\n		}\n		return bytes;\n	}\n	function bytesToHex(bytes) {\n		return Array.from(bytes, (value) => value.toString(16).padStart(2, \"0\")).join(\"\");\n	}\n	function base64ToBytes(value, encoding) {\n		let normalized = value.replace(/\\s+/gu, \"\");\n		if (encoding === \"base64url\") normalized = normalized.replace(/-/gu, \"+\").replace(/_/gu, \"/\");\n		const padding = normalized.length % 4;\n		if (padding === 1) throw new TypeError(\"Invalid base64 string\");\n		if (padding > 0) normalized = normalized.padEnd(normalized.length + (4 - padding), \"=\");\n		const output = [];\n		for (let index = 0; index < normalized.length; index += 4) {\n			const values = normalized.slice(index, index + 4).split(\"\").map((char) => char === \"=\" ? 64 : base64Lookup.get(char) ?? NaN);\n			if (values.some((entry) => Number.isNaN(entry))) throw new TypeError(\"Invalid base64 string\");\n			const [a = 0, b = 0, c = 64, d = 64] = values;\n			const triple = a << 18 | b << 12 | (c & 63) << 6 | d & 63;\n			output.push(triple >> 16 & 255);\n			if (c !== 64) output.push(triple >> 8 & 255);\n			if (d !== 64) output.push(triple & 255);\n		}\n		return Uint8Array.from(output);\n	}\n	function bytesToBase64(bytes, encoding) {\n		let output = \"\";\n		for (let index = 0; index < bytes.length; index += 3) {\n			const a = bytes[index] ?? 0;\n			const b = bytes[index + 1] ?? 0;\n			const c = bytes[index + 2] ?? 0;\n			const triple = a << 16 | b << 8 | c;\n			output += BASE64_ALPHABET[triple >> 18 & 63];\n			output += BASE64_ALPHABET[triple >> 12 & 63];\n			output += index + 1 < bytes.length ? BASE64_ALPHABET[triple >> 6 & 63] : \"=\";\n			output += index + 2 < bytes.length ? BASE64_ALPHABET[triple & 63] : \"=\";\n		}\n		if (encoding === \"base64url\") return output.replace(/\\+/gu, \"-\").replace(/\\//gu, \"_\").replace(/=+$/gu, \"\");\n		return output;\n	}\n	function copyBytes(input) {\n		if (input instanceof ArrayBuffer) return new Uint8Array(input.slice(0));\n		return new Uint8Array(input.buffer.slice(input.byteOffset, input.byteOffset + input.byteLength));\n	}\n	function toBytes(input, encoding) {\n		if (input instanceof BufferShim) return input.toUint8Array();\n		if (typeof input === \"string\") switch (normalizeEncoding(encoding)) {\n			case \"utf8\":\n			case \"utf-8\": return textEncoder.encode(input);\n			case \"base64\":\n			case \"base64url\": return base64ToBytes(input, normalizeEncoding(encoding));\n			case \"hex\": return hexToBytes(input);\n		}\n		if (input instanceof ArrayBuffer || ArrayBuffer.isView(input)) return copyBytes(input);\n		if (Array.isArray(input)) return Uint8Array.from(input);\n		throw new TypeError(\"Buffer.from only supports strings, arrays, ArrayBuffers, and typed arrays\");\n	}\n	var BufferShim = class BufferShim {\n		#bytes;\n		byteLength;\n		length;\n		constructor(bytes) {\n			this.#bytes = bytes;\n			this.byteLength = bytes.byteLength;\n			this.length = bytes.length;\n		}\n		static from(input, encoding) {\n			return new BufferShim(toBytes(input, encoding));\n		}\n		static isBuffer(value) {\n			return value instanceof BufferShim;\n		}\n		static byteLength(input, encoding) {\n			return toBytes(input, encoding).byteLength;\n		}\n		toUint8Array() {\n			return new Uint8Array(this.#bytes);\n		}\n		toString(encoding) {\n			switch (normalizeEncoding(encoding)) {\n				case \"utf8\":\n				case \"utf-8\": return textDecoder.decode(this.#bytes);\n				case \"base64\":\n				case \"base64url\": return bytesToBase64(this.#bytes, normalizeEncoding(encoding));\n				case \"hex\": return bytesToHex(this.#bytes);\n			}\n		}\n	};\n	function atobShim(input) {\n		return Array.from(base64ToBytes(String(input), \"base64\"), (value) => String.fromCharCode(value)).join(\"\");\n	}\n	function btoaShim(input) {\n		const bytes = new Uint8Array(input.length);\n		for (let index = 0; index < input.length; index += 1) {\n			const codePoint = input.charCodeAt(index);\n			if (codePoint > 255) throw new TypeError(\"The string to be encoded contains characters outside of Latin1\");\n			bytes[index] = codePoint;\n		}\n		return bytesToBase64(bytes, \"base64\");\n	}\n	function queueMicrotaskShim(callback) {\n		Promise.resolve().then(callback);\n	}\n	var AbortSignalShim = class AbortSignalShim {\n		aborted = false;\n		reason;\n		onabort = null;\n		#listeners = /* @__PURE__ */ new Set();\n		addEventListener(type, listener) {\n			if (type === \"abort\" && listener) this.#listeners.add(listener);\n		}\n		removeEventListener(type, listener) {\n			if (type === \"abort\" && listener) this.#listeners.delete(listener);\n		}\n		dispatchEvent(event) {\n			if (event.type !== \"abort\") return true;\n			this.onabort?.(event);\n			for (const listener of this.#listeners) listener(event);\n			return true;\n		}\n		throwIfAborted() {\n			if (this.aborted) throw this.reason ?? /* @__PURE__ */ new Error(\"Operation was aborted\");\n		}\n		static abort(reason) {\n			const signal = new AbortSignalShim();\n			signal.abort(reason);\n			return signal;\n		}\n		abort(reason) {\n			if (this.aborted) return;\n			this.aborted = true;\n			this.reason = reason;\n			this.dispatchEvent({\n				type: \"abort\",\n				target: this\n			});\n		}\n	};\n	var AbortControllerShim = class {\n		signal = new AbortSignalShim();\n		abort(reason) {\n			this.signal.abort(reason);\n		}\n	};\n	function cloneFormData(input) {\n		const clone = new FormData();\n		for (const [name, value] of input.entries()) {\n			if (value instanceof File) {\n				clone.append(name, new File([value], value.name, { type: value.type }), value.name);\n				continue;\n			}\n			clone.append(name, value);\n		}\n		return clone;\n	}\n	function cloneBodyValue(input) {\n		if (input === null || input === void 0 || typeof input === \"string\") return input;\n		if (input instanceof FormData) return cloneFormData(input);\n		if (input instanceof Blob) return input.slice(0, input.size, input.type);\n		if (input instanceof ArrayBuffer || ArrayBuffer.isView(input)) return copyBytes(input);\n		return input;\n	}\n	function blobFromBody(input) {\n		if (input instanceof Blob) return input;\n		if (typeof input === \"string\") return new Blob([input], { type: \"text/plain;charset=utf-8\" });\n		if (input instanceof FormData) throw new TypeError(\"FormData body reading is not supported in Code Mode\");\n		if (input instanceof ArrayBuffer || ArrayBuffer.isView(input)) return new Blob([copyBytes(input)]);\n		return new Blob([]);\n	}\n	var BodyMixin = class {\n		_bodyInit;\n		bodyUsed = false;\n		body = null;\n		constructor(body) {\n			this._bodyInit = cloneBodyValue(body);\n		}\n		async arrayBuffer() {\n			this.bodyUsed = true;\n			return await blobFromBody(this._bodyInit).arrayBuffer();\n		}\n		async blob() {\n			this.bodyUsed = true;\n			return blobFromBody(this._bodyInit);\n		}\n		async formData() {\n			this.bodyUsed = true;\n			if (this._bodyInit instanceof FormData) return cloneFormData(this._bodyInit);\n			throw new TypeError(\"Body does not contain FormData\");\n		}\n		async json() {\n			return JSON.parse(await this.text());\n		}\n		async text() {\n			this.bodyUsed = true;\n			return await blobFromBody(this._bodyInit).text();\n		}\n	};\n	function toHeaders(init) {\n		return init instanceof Headers ? new Headers(init) : new Headers(init ?? {});\n	}\n	function normalizeMethod(method) {\n		return String(method ?? \"GET\").toUpperCase();\n	}\n	var RequestShim = class RequestShim extends BodyMixin {\n		headers;\n		method;\n		signal;\n		url;\n		constructor(input, init = {}) {\n			const sourceBody = input instanceof RequestShim ? input._bodyInit : void 0;\n			super(init.body ?? sourceBody);\n			if (input instanceof RequestShim) this.url = input.url;\n			else this.url = input instanceof URLShim ? input.href : new URLShim(String(input)).href;\n			this.method = normalizeMethod(init.method ?? (input instanceof RequestShim ? input.method : \"GET\"));\n			this.headers = toHeaders(init.headers ?? (input instanceof RequestShim ? input.headers : void 0));\n			this.signal = init.signal ?? (input instanceof RequestShim ? input.signal : new AbortControllerShim().signal);\n		}\n		clone() {\n			return new RequestShim(this, {\n				method: this.method,\n				headers: this.headers,\n				body: this._bodyInit,\n				signal: this.signal\n			});\n		}\n	};\n	var ResponseShim = class ResponseShim extends BodyMixin {\n		headers;\n		ok;\n		redirected = false;\n		status;\n		statusText;\n		type = \"default\";\n		url = \"\";\n		constructor(body, init = {}) {\n			super(body);\n			this.status = init.status ?? 200;\n			this.statusText = init.statusText ?? \"\";\n			this.headers = toHeaders(init.headers);\n			this.ok = this.status >= 200 && this.status <= 299;\n		}\n		clone() {\n			return new ResponseShim(this._bodyInit, {\n				headers: this.headers,\n				status: this.status,\n				statusText: this.statusText\n			});\n		}\n		static json(data, init) {\n			const headers = toHeaders(init?.headers);\n			if (!headers.has(\"content-type\")) headers.set(\"content-type\", \"application/json\");\n			const responseInit = { headers };\n			if (init?.status !== void 0) responseInit.status = init.status;\n			if (init?.statusText !== void 0) responseInit.statusText = init.statusText;\n			return new ResponseShim(JSON.stringify(data), responseInit);\n		}\n	};\n	function disabledFetch() {\n		throw new Error(DISABLED_FETCH_MESSAGE);\n	}\n	const integerTypedArrayConstructors = new Set([\n		Int8Array,\n		Uint8Array,\n		Uint8ClampedArray,\n		Int16Array,\n		Uint16Array,\n		Int32Array,\n		Uint32Array,\n		typeof BigInt64Array === \"undefined\" ? void 0 : BigInt64Array,\n		typeof BigUint64Array === \"undefined\" ? void 0 : BigUint64Array\n	]);\n	var QuotaExceededErrorShim = class extends Error {\n		constructor(message) {\n			super(message);\n			this.name = \"QuotaExceededError\";\n		}\n	};\n	const platformCrypto = {\n		randomUUID() {\n			const randomUUID = capletsPlatformHost.randomUUID;\n			if (!randomUUID) throw new Error(\"Code Mode platform random UUID bridge is not installed\");\n			return randomUUID();\n		},\n		getRandomValues(typedArray) {\n			if (!ArrayBuffer.isView(typedArray) || typedArray instanceof DataView) throw new TypeError(\"crypto.getRandomValues requires an integer typed array\");\n			if (!integerTypedArrayConstructors.has(typedArray.constructor)) throw new TypeError(\"crypto.getRandomValues requires an integer typed array\");\n			if (typedArray.byteLength > 65536) throw new QuotaExceededErrorShim(\"crypto.getRandomValues cannot generate more than 65,536 bytes\");\n			const randomValues = capletsPlatformHost.randomValues;\n			if (!randomValues) throw new Error(\"Code Mode platform random values bridge is not installed\");\n			const bytes = randomValues(typedArray.byteLength);\n			new Uint8Array(typedArray.buffer, typedArray.byteOffset, typedArray.byteLength).set(bytes);\n			return typedArray;\n		}\n	};\n	let nextTimerId = 1;\n	const activeTimers = /* @__PURE__ */ new Set();\n	function normalizeTimerDelay(delay) {\n		const value = Number(delay ?? 0);\n		if (!Number.isFinite(value) || value <= 0) return 0;\n		return Math.trunc(value);\n	}\n	function setTimeoutShim(callback, delay, ...args) {\n		if (typeof callback !== \"function\") throw new TypeError(\"setTimeout callback must be a function\");\n		const timerId = nextTimerId++;\n		activeTimers.add(timerId);\n		const sleep = capletsPlatformHost.sleep;\n		if (!sleep) throw new Error(\"Code Mode platform sleep bridge is not installed\");\n		sleep(timerId, normalizeTimerDelay(delay)).then((fired) => {\n			activeTimers.delete(timerId);\n			if (fired) callback(...args);\n		});\n		return timerId;\n	}\n	function clearTimeoutShim(timerId) {\n		const id = Number(timerId);\n		activeTimers.delete(id);\n		capletsPlatformHost.clearTimer?.(id);\n	}\n	function setIntervalShim(callback, delay, ...args) {\n		if (typeof callback !== \"function\") throw new TypeError(\"setInterval callback must be a function\");\n		const timerId = nextTimerId++;\n		const intervalDelay = normalizeTimerDelay(delay);\n		activeTimers.add(timerId);\n		const tick = () => {\n			const sleep = capletsPlatformHost.sleep;\n			if (!sleep) throw new Error(\"Code Mode platform sleep bridge is not installed\");\n			sleep(timerId, intervalDelay).then((fired) => {\n				if (!fired || !activeTimers.has(timerId)) {\n					activeTimers.delete(timerId);\n					return;\n				}\n				callback(...args);\n				if (activeTimers.has(timerId)) tick();\n			});\n		};\n		tick();\n		return timerId;\n	}\n	function clearIntervalShim(timerId) {\n		clearTimeoutShim(timerId);\n	}\n	definePlatformGlobal(\"atob\", atobShim);\n	definePlatformGlobal(\"btoa\", btoaShim);\n	definePlatformGlobal(\"Buffer\", BufferShim);\n	definePlatformGlobal(\"TextEncoder\", TextEncoderShim);\n	definePlatformGlobal(\"TextDecoder\", TextDecoderShim);\n	definePlatformGlobal(\"URL\", URLShim);\n	definePlatformGlobal(\"URLSearchParams\", URLSearchParamsShim);\n	definePlatformGlobal(\"structuredClone\", esm_default);\n	definePlatformGlobal(\"Headers\", Headers);\n	definePlatformGlobal(\"Blob\", Blob);\n	definePlatformGlobal(\"File\", File);\n	definePlatformGlobal(\"FormData\", FormData);\n	definePlatformGlobal(\"ReadableStream\", ReadableStreamShim);\n	definePlatformGlobal(\"WritableStream\", WritableStreamShim);\n	definePlatformGlobal(\"TransformStream\", TransformStreamShim);\n	definePlatformGlobal(\"AbortController\", AbortControllerShim);\n	definePlatformGlobal(\"AbortSignal\", AbortSignalShim);\n	definePlatformGlobal(\"Request\", RequestShim);\n	definePlatformGlobal(\"Response\", ResponseShim);\n	definePlatformGlobal(\"crypto\", platformCrypto);\n	definePlatformGlobal(\"setTimeout\", setTimeoutShim);\n	definePlatformGlobal(\"clearTimeout\", clearTimeoutShim);\n	definePlatformGlobal(\"setInterval\", setIntervalShim);\n	definePlatformGlobal(\"clearInterval\", clearIntervalShim);\n	definePlatformGlobal(\"queueMicrotask\", queueMicrotaskShim);\n	definePlatformGlobal(\"console\", platformConsole);\n	definePlatformGlobal(\"fetch\", disabledFetch, { overwrite: true });\n	//#endregion\n})();";
+const CODE_MODE_PLATFORM_RUNTIME_SOURCE = "(function() {\n	//#region node_modules/.pnpm/@ungap+structured-clone@1.3.1/node_modules/@ungap/structured-clone/esm/deserialize.js\n	const env = typeof self === \"object\" ? self : globalThis;\n	const guard = (name, init) => {\n		switch (name) {\n			case \"Function\":\n			case \"SharedWorker\":\n			case \"Worker\":\n			case \"eval\":\n			case \"setInterval\":\n			case \"setTimeout\": throw new TypeError(\"unable to deserialize \" + name);\n		}\n		return new env[name](init);\n	};\n	const deserializer = ($, _) => {\n		const as = (out, index) => {\n			$.set(index, out);\n			return out;\n		};\n		const unpair = (index) => {\n			if ($.has(index)) return $.get(index);\n			const [type, value] = _[index];\n			switch (type) {\n				case 0:\n				case -1: return as(value, index);\n				case 1: {\n					const arr = as([], index);\n					for (const index of value) arr.push(unpair(index));\n					return arr;\n				}\n				case 2: {\n					const object = as({}, index);\n					for (const [key, index] of value) object[unpair(key)] = unpair(index);\n					return object;\n				}\n				case 3: return as(new Date(value), index);\n				case 4: {\n					const { source, flags } = value;\n					return as(new RegExp(source, flags), index);\n				}\n				case 5: {\n					const map = as(/* @__PURE__ */ new Map(), index);\n					for (const [key, index] of value) map.set(unpair(key), unpair(index));\n					return map;\n				}\n				case 6: {\n					const set = as(/* @__PURE__ */ new Set(), index);\n					for (const index of value) set.add(unpair(index));\n					return set;\n				}\n				case 7: {\n					const { name, message } = value;\n					return as(guard(name, message), index);\n				}\n				case 8: return as(BigInt(value), index);\n				case \"BigInt\": return as(Object(BigInt(value)), index);\n				case \"ArrayBuffer\": return as(new Uint8Array(value).buffer, value);\n				case \"DataView\": {\n					const { buffer } = new Uint8Array(value);\n					return as(new DataView(buffer), value);\n				}\n			}\n			return as(guard(type, value), index);\n		};\n		return unpair;\n	};\n	/**\n	* @typedef {Array<string,any>} Record a type representation\n	*/\n	/**\n	* Returns a deserialized value from a serialized array of Records.\n	* @param {Record[]} serialized a previously serialized value.\n	* @returns {any}\n	*/\n	const deserialize = (serialized) => deserializer(/* @__PURE__ */ new Map(), serialized)(0);\n	//#endregion\n	//#region node_modules/.pnpm/@ungap+structured-clone@1.3.1/node_modules/@ungap/structured-clone/esm/serialize.js\n	const EMPTY = \"\";\n	const { toString } = {};\n	const { keys } = Object;\n	const typeOf = (value) => {\n		const type = typeof value;\n		if (type !== \"object\" || !value) return [0, type];\n		const asString = toString.call(value).slice(8, -1);\n		switch (asString) {\n			case \"Array\": return [1, EMPTY];\n			case \"Object\": return [2, EMPTY];\n			case \"Date\": return [3, EMPTY];\n			case \"RegExp\": return [4, EMPTY];\n			case \"Map\": return [5, EMPTY];\n			case \"Set\": return [6, EMPTY];\n			case \"DataView\": return [1, asString];\n		}\n		if (asString.includes(\"Array\")) return [1, asString];\n		if (asString.includes(\"Error\")) return [7, asString];\n		return [2, asString];\n	};\n	const shouldSkip = ([TYPE, type]) => TYPE === 0 && (type === \"function\" || type === \"symbol\");\n	const serializer = (strict, json, $, _) => {\n		const as = (out, value) => {\n			const index = _.push(out) - 1;\n			$.set(value, index);\n			return index;\n		};\n		const pair = (value) => {\n			if ($.has(value)) return $.get(value);\n			let [TYPE, type] = typeOf(value);\n			switch (TYPE) {\n				case 0: {\n					let entry = value;\n					switch (type) {\n						case \"bigint\":\n							TYPE = 8;\n							entry = value.toString();\n							break;\n						case \"function\":\n						case \"symbol\":\n							if (strict) throw new TypeError(\"unable to serialize \" + type);\n							entry = null;\n							break;\n						case \"undefined\": return as([-1], value);\n					}\n					return as([TYPE, entry], value);\n				}\n				case 1: {\n					if (type) {\n						let spread = value;\n						if (type === \"DataView\") spread = new Uint8Array(value.buffer);\n						else if (type === \"ArrayBuffer\") spread = new Uint8Array(value);\n						return as([type, [...spread]], value);\n					}\n					const arr = [];\n					const index = as([TYPE, arr], value);\n					for (const entry of value) arr.push(pair(entry));\n					return index;\n				}\n				case 2: {\n					if (type) switch (type) {\n						case \"BigInt\": return as([type, value.toString()], value);\n						case \"Boolean\":\n						case \"Number\":\n						case \"String\": return as([type, value.valueOf()], value);\n					}\n					if (json && \"toJSON\" in value) return pair(value.toJSON());\n					const entries = [];\n					const index = as([TYPE, entries], value);\n					for (const key of keys(value)) if (strict || !shouldSkip(typeOf(value[key]))) entries.push([pair(key), pair(value[key])]);\n					return index;\n				}\n				case 3: return as([TYPE, value.toISOString()], value);\n				case 4: {\n					const { source, flags } = value;\n					return as([TYPE, {\n						source,\n						flags\n					}], value);\n				}\n				case 5: {\n					const entries = [];\n					const index = as([TYPE, entries], value);\n					for (const [key, entry] of value) if (strict || !(shouldSkip(typeOf(key)) || shouldSkip(typeOf(entry)))) entries.push([pair(key), pair(entry)]);\n					return index;\n				}\n				case 6: {\n					const entries = [];\n					const index = as([TYPE, entries], value);\n					for (const entry of value) if (strict || !shouldSkip(typeOf(entry))) entries.push(pair(entry));\n					return index;\n				}\n			}\n			const { message } = value;\n			return as([TYPE, {\n				name: type,\n				message\n			}], value);\n		};\n		return pair;\n	};\n	/**\n	* @typedef {Array<string,any>} Record a type representation\n	*/\n	/**\n	* Returns an array of serialized Records.\n	* @param {any} value a serializable value.\n	* @param {{json?: boolean, lossy?: boolean}?} options an object with a `lossy` or `json` property that,\n	*  if `true`, will not throw errors on incompatible types, and behave more\n	*  like JSON stringify would behave. Symbol and Function will be discarded.\n	* @returns {Record[]}\n	*/\n	const serialize = (value, { json, lossy } = {}) => {\n		const _ = [];\n		return serializer(!(json || lossy), !!json, /* @__PURE__ */ new Map(), _)(value), _;\n	};\n	//#endregion\n	//#region node_modules/.pnpm/@ungap+structured-clone@1.3.1/node_modules/@ungap/structured-clone/esm/index.js\n	/**\n	* @typedef {Array<string,any>} Record a type representation\n	*/\n	/**\n	* Returns an array of serialized Records.\n	* @param {any} any a serializable value.\n	* @param {{transfer?: any[], json?: boolean, lossy?: boolean}?} options an object with\n	* a transfer option (ignored when polyfilled) and/or non standard fields that\n	* fallback to the polyfill if present.\n	* @returns {Record[]}\n	*/\n	var esm_default = typeof structuredClone === \"function\" ? (any, options) => options && (\"json\" in options || \"lossy\" in options) ? deserialize(serialize(any, options)) : structuredClone(any) : (any, options) => deserialize(serialize(any, options));\n	//#endregion\n	//#region node_modules/.pnpm/formdata-node@6.0.3/node_modules/formdata-node/lib/form-data.js\n	var __accessCheck = (obj, member, msg) => {\n		if (!member.has(obj)) throw TypeError(\"Cannot \" + msg);\n	};\n	var __privateGet = (obj, member, getter) => {\n		__accessCheck(obj, member, \"read from private field\");\n		return getter ? getter.call(obj) : member.get(obj);\n	};\n	var __privateAdd = (obj, member, value) => {\n		if (member.has(obj)) throw TypeError(\"Cannot add the same private member more than once\");\n		member instanceof WeakSet ? member.add(obj) : member.set(obj, value);\n	};\n	var __privateSet = (obj, member, value, setter) => {\n		__accessCheck(obj, member, \"write to private field\");\n		setter ? setter.call(obj, value) : member.set(obj, value);\n		return value;\n	};\n	var __privateMethod = (obj, member, method) => {\n		__accessCheck(obj, member, \"access private method\");\n		return method;\n	};\n	var isFunction = (value) => typeof value === \"function\";\n	var isObject = (value) => typeof value === \"object\" && value != null && !Array.isArray(value);\n	var isAsyncIterable = (value) => isObject(value) && isFunction(value[Symbol.asyncIterator]);\n	var MAX_CHUNK_SIZE = 65536;\n	async function* clonePart(value) {\n		if (value.byteLength <= MAX_CHUNK_SIZE) {\n			yield value;\n			return;\n		}\n		let offset = 0;\n		while (offset < value.byteLength) {\n			const size = Math.min(value.byteLength - offset, MAX_CHUNK_SIZE);\n			const buffer = value.buffer.slice(offset, offset + size);\n			offset += buffer.byteLength;\n			yield new Uint8Array(buffer);\n		}\n	}\n	async function* readStream(readable) {\n		const reader = readable.getReader();\n		while (true) {\n			const { done, value } = await reader.read();\n			if (done) break;\n			yield value;\n		}\n	}\n	async function* chunkStream(stream) {\n		for await (const value of stream) yield* clonePart(value);\n	}\n	var getStreamIterator = (source) => {\n		if (isAsyncIterable(source)) return chunkStream(source);\n		if (isFunction(source.getReader)) return chunkStream(readStream(source));\n		throw new TypeError(\"Unsupported data source: Expected either ReadableStream or async iterable.\");\n	};\n	async function* consumeNodeBlob(blob) {\n		let position = 0;\n		while (position !== blob.size) {\n			const buffer = await blob.slice(position, Math.min(blob.size, position + MAX_CHUNK_SIZE)).arrayBuffer();\n			position += buffer.byteLength;\n			yield new Uint8Array(buffer);\n		}\n	}\n	async function* consumeBlobParts(parts, clone = false) {\n		for (const part of parts) if (ArrayBuffer.isView(part)) if (clone) yield* clonePart(part);\n		else yield part;\n		else if (isFunction(part.stream)) yield* getStreamIterator(part.stream());\n		else yield* consumeNodeBlob(part);\n	}\n	function* sliceBlob(blobParts, blobSize, start = 0, end) {\n		end ??= blobSize;\n		let relativeStart = start < 0 ? Math.max(blobSize + start, 0) : Math.min(start, blobSize);\n		let relativeEnd = end < 0 ? Math.max(blobSize + end, 0) : Math.min(end, blobSize);\n		const span = Math.max(relativeEnd - relativeStart, 0);\n		let added = 0;\n		for (const part of blobParts) {\n			if (added >= span) break;\n			const partSize = ArrayBuffer.isView(part) ? part.byteLength : part.size;\n			if (relativeStart && partSize <= relativeStart) {\n				relativeStart -= partSize;\n				relativeEnd -= partSize;\n			} else {\n				let chunk;\n				if (ArrayBuffer.isView(part)) {\n					chunk = part.subarray(relativeStart, Math.min(partSize, relativeEnd));\n					added += chunk.byteLength;\n				} else {\n					chunk = part.slice(relativeStart, Math.min(partSize, relativeEnd));\n					added += chunk.size;\n				}\n				relativeEnd -= partSize;\n				relativeStart = 0;\n				yield chunk;\n			}\n		}\n	}\n	var _parts, _type, _size;\n	var _Blob = class _Blob {\n		/**\n		* Returns a new [`Blob`](https://developer.mozilla.org/en-US/docs/Web/API/Blob) object.\n		* The content of the blob consists of the concatenation of the values given in the parameter array.\n		*\n		* @param blobParts An `Array` strings, or [`ArrayBuffer`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/ArrayBuffer), [`ArrayBufferView`](https://developer.mozilla.org/en-US/docs/Web/API/ArrayBufferView), [`Blob`](https://developer.mozilla.org/en-US/docs/Web/API/Blob) objects, or a mix of any of such objects, that will be put inside the [`Blob`](https://developer.mozilla.org/en-US/docs/Web/API/Blob).\n		* @param options An optional object of type `BlobPropertyBag`.\n		*/\n		constructor(blobParts = [], options = {}) {\n			/**\n			* An `Array` of [`ArrayBufferView`](https://developer.mozilla.org/en-US/docs/Web/API/ArrayBufferView) or [`Blob`](https://developer.mozilla.org/en-US/docs/Web/API/Blob) objects, or a mix of any of such objects, that will be put inside the [`Blob`](https://developer.mozilla.org/en-US/docs/Web/API/Blob).\n			*/\n			__privateAdd(this, _parts, []);\n			/**\n			* Returns the [`MIME type`](https://developer.mozilla.org/en-US/docs/Glossary/MIME_type) of the [`Blob`](https://developer.mozilla.org/en-US/docs/Web/API/Blob) or [`File`](https://developer.mozilla.org/en-US/docs/Web/API/File).\n			*/\n			__privateAdd(this, _type, \"\");\n			/**\n			* Returns the size of the [`Blob`](https://developer.mozilla.org/en-US/docs/Web/API/Blob) or [`File`](https://developer.mozilla.org/en-US/docs/Web/API/File) in bytes.\n			*/\n			__privateAdd(this, _size, 0);\n			options ??= {};\n			if (typeof blobParts !== \"object\" || blobParts === null) throw new TypeError(\"Failed to construct 'Blob': The provided value cannot be converted to a sequence.\");\n			if (!isFunction(blobParts[Symbol.iterator])) throw new TypeError(\"Failed to construct 'Blob': The object must have a callable @@iterator property.\");\n			if (typeof options !== \"object\" && !isFunction(options)) throw new TypeError(\"Failed to construct 'Blob': parameter 2 cannot convert to dictionary.\");\n			const encoder = new TextEncoder();\n			for (const raw of blobParts) {\n				let part;\n				if (ArrayBuffer.isView(raw)) part = new Uint8Array(raw.buffer.slice(raw.byteOffset, raw.byteOffset + raw.byteLength));\n				else if (raw instanceof ArrayBuffer) part = new Uint8Array(raw.slice(0));\n				else if (raw instanceof _Blob) part = raw;\n				else part = encoder.encode(String(raw));\n				__privateSet(this, _size, __privateGet(this, _size) + (ArrayBuffer.isView(part) ? part.byteLength : part.size));\n				__privateGet(this, _parts).push(part);\n			}\n			const type = options.type === void 0 ? \"\" : String(options.type);\n			__privateSet(this, _type, /^[\\x20-\\x7E]*$/.test(type) ? type : \"\");\n		}\n		static [Symbol.hasInstance](value) {\n			return Boolean(value && typeof value === \"object\" && isFunction(value.constructor) && (isFunction(value.stream) || isFunction(value.arrayBuffer)) && /^(Blob|File)$/.test(value[Symbol.toStringTag]));\n		}\n		/**\n		* Returns the [`MIME type`](https://developer.mozilla.org/en-US/docs/Glossary/MIME_type) of the [`Blob`](https://developer.mozilla.org/en-US/docs/Web/API/Blob) or [`File`](https://developer.mozilla.org/en-US/docs/Web/API/File).\n		*/\n		get type() {\n			return __privateGet(this, _type);\n		}\n		/**\n		* Returns the size of the [`Blob`](https://developer.mozilla.org/en-US/docs/Web/API/Blob) or [`File`](https://developer.mozilla.org/en-US/docs/Web/API/File) in bytes.\n		*/\n		get size() {\n			return __privateGet(this, _size);\n		}\n		/**\n		* Creates and returns a new [`Blob`](https://developer.mozilla.org/en-US/docs/Web/API/Blob) object which contains data from a subset of the blob on which it's called.\n		*\n		* @param start An index into the Blob indicating the first byte to include in the new Blob. If you specify a negative value, it's treated as an offset from the end of the Blob toward the beginning. For example, -10 would be the 10th from last byte in the Blob. The default value is 0. If you specify a value for start that is larger than the size of the source Blob, the returned Blob has size 0 and contains no data.\n		* @param end An index into the Blob indicating the first byte that will *not* be included in the new Blob (i.e. the byte exactly at this index is not included). If you specify a negative value, it's treated as an offset from the end of the Blob toward the beginning. For example, -10 would be the 10th from last byte in the Blob. The default value is size.\n		* @param contentType The content type to assign to the new Blob; this will be the value of its type property. The default value is an empty string.\n		*/\n		slice(start, end, contentType) {\n			return new _Blob(sliceBlob(__privateGet(this, _parts), this.size, start, end), { type: contentType });\n		}\n		/**\n		* Returns a [`Promise`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Promise) that resolves with a string containing the contents of the blob, interpreted as UTF-8.\n		*/\n		async text() {\n			const decoder = new TextDecoder();\n			let result = \"\";\n			for await (const chunk of consumeBlobParts(__privateGet(this, _parts))) result += decoder.decode(chunk, { stream: true });\n			result += decoder.decode();\n			return result;\n		}\n		/**\n		* Returns a [`Promise`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Promise) that resolves with the contents of the blob as binary data contained in an [`ArrayBuffer`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/ArrayBuffer).\n		*/\n		async arrayBuffer() {\n			const view = new Uint8Array(this.size);\n			let offset = 0;\n			for await (const chunk of consumeBlobParts(__privateGet(this, _parts))) {\n				view.set(chunk, offset);\n				offset += chunk.length;\n			}\n			return view.buffer;\n		}\n		/**\n		* Returns a [`ReadableStream`](https://developer.mozilla.org/en-US/docs/Web/API/ReadableStream) which upon reading returns the data contained within the [`Blob`](https://developer.mozilla.org/en-US/docs/Web/API/Blob).\n		*/\n		stream() {\n			const iterator = consumeBlobParts(__privateGet(this, _parts), true);\n			return new ReadableStream({\n				async pull(controller) {\n					const { value, done } = await iterator.next();\n					if (done) return queueMicrotask(() => controller.close());\n					controller.enqueue(value);\n				},\n				async cancel() {\n					await iterator.return();\n				}\n			});\n		}\n		get [Symbol.toStringTag]() {\n			return \"Blob\";\n		}\n	};\n	_parts = /* @__PURE__ */ new WeakMap();\n	_type = /* @__PURE__ */ new WeakMap();\n	_size = /* @__PURE__ */ new WeakMap();\n	var Blob = _Blob;\n	Object.defineProperties(Blob.prototype, {\n		type: { enumerable: true },\n		size: { enumerable: true },\n		slice: { enumerable: true },\n		stream: { enumerable: true },\n		text: { enumerable: true },\n		arrayBuffer: { enumerable: true }\n	});\n	var isBlob = (value) => value instanceof Blob;\n	var _name, _lastModified;\n	var File = class extends Blob {\n		/**\n		* Creates a new File instance.\n		*\n		* @param fileBits An `Array` strings, or [`ArrayBuffer`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/ArrayBuffer), [`ArrayBufferView`](https://developer.mozilla.org/en-US/docs/Web/API/ArrayBufferView), [`Blob`](https://developer.mozilla.org/en-US/docs/Web/API/Blob) objects, or a mix of any of such objects, that will be put inside the [`File`](https://developer.mozilla.org/en-US/docs/Web/API/File).\n		* @param name The name of the file.\n		* @param options An options object containing optional attributes for the file.\n		*/\n		constructor(fileBits, name, options = {}) {\n			super(fileBits, options);\n			/**\n			* Returns the name of the file referenced by the File object.\n			*/\n			__privateAdd(this, _name, void 0);\n			/**\n			* The last modified date of the file as the number of milliseconds since the Unix epoch (January 1, 1970 at midnight). Files without a known last modified date return the current date.\n			*/\n			__privateAdd(this, _lastModified, 0);\n			if (arguments.length < 2) throw new TypeError(`Failed to construct 'File': 2 arguments required, but only ${arguments.length} present.`);\n			__privateSet(this, _name, String(name));\n			const lastModified = options.lastModified === void 0 ? Date.now() : Number(options.lastModified);\n			if (!Number.isNaN(lastModified)) __privateSet(this, _lastModified, lastModified);\n		}\n		static [Symbol.hasInstance](value) {\n			return value instanceof Blob && value[Symbol.toStringTag] === \"File\" && typeof value.name === \"string\";\n		}\n		/**\n		* Name of the file referenced by the File object.\n		*/\n		get name() {\n			return __privateGet(this, _name);\n		}\n		/* c8 ignore next 3 */\n		get webkitRelativePath() {\n			return \"\";\n		}\n		/**\n		* The last modified date of the file as the number of milliseconds since the Unix epoch (January 1, 1970 at midnight). Files without a known last modified date return the current date.\n		*/\n		get lastModified() {\n			return __privateGet(this, _lastModified);\n		}\n		get [Symbol.toStringTag]() {\n			return \"File\";\n		}\n	};\n	_name = /* @__PURE__ */ new WeakMap();\n	_lastModified = /* @__PURE__ */ new WeakMap();\n	var isFile = (value) => value instanceof File;\n	var _entries, _setEntry, setEntry_fn;\n	var FormData = class {\n		constructor() {\n			__privateAdd(this, _setEntry);\n			/**\n			* Stores internal data for every entry\n			*/\n			__privateAdd(this, _entries, /* @__PURE__ */ new Map());\n		}\n		static [Symbol.hasInstance](value) {\n			if (!value) return false;\n			const val = value;\n			return Boolean(isFunction(val.constructor) && val[Symbol.toStringTag] === \"FormData\" && isFunction(val.append) && isFunction(val.set) && isFunction(val.get) && isFunction(val.getAll) && isFunction(val.has) && isFunction(val.delete) && isFunction(val.entries) && isFunction(val.values) && isFunction(val.keys) && isFunction(val[Symbol.iterator]) && isFunction(val.forEach));\n		}\n		/**\n		* Appends a new value onto an existing key inside a FormData object,\n		* or adds the key if it does not already exist.\n		*\n		* The difference between `set()` and `append()` is that if the specified key already exists, `set()` will overwrite all existing values with the new one, whereas `append()` will append the new value onto the end of the existing set of values.\n		*\n		* @param name The name of the field whose data is contained in `value`.\n		* @param value The field's value. This can be [`Blob`](https://developer.mozilla.org/en-US/docs/Web/API/Blob)\n		or [`File`](https://developer.mozilla.org/en-US/docs/Web/API/File). If none of these are specified the value is converted to a string.\n		* @param fileName The filename reported to the server, when a Blob or File is passed as the second parameter. The default filename for Blob objects is \"blob\". The default filename for File objects is the file's filename.\n		*/\n		append(name, value, fileName) {\n			__privateMethod(this, _setEntry, setEntry_fn).call(this, {\n				name,\n				fileName,\n				append: true,\n				rawValue: value,\n				argsLength: arguments.length\n			});\n		}\n		/**\n		* Set a new value for an existing key inside FormData,\n		* or add the new field if it does not already exist.\n		*\n		* @param name The name of the field whose data is contained in `value`.\n		* @param value The field's value. This can be [`Blob`](https://developer.mozilla.org/en-US/docs/Web/API/Blob)\n		or [`File`](https://developer.mozilla.org/en-US/docs/Web/API/File). If none of these are specified the value is converted to a string.\n		* @param fileName The filename reported to the server, when a Blob or File is passed as the second parameter. The default filename for Blob objects is \"blob\". The default filename for File objects is the file's filename.\n		*\n		*/\n		set(name, value, fileName) {\n			__privateMethod(this, _setEntry, setEntry_fn).call(this, {\n				name,\n				fileName,\n				append: false,\n				rawValue: value,\n				argsLength: arguments.length\n			});\n		}\n		/**\n		* Returns the first value associated with a given key from within a `FormData` object.\n		* If you expect multiple values and want all of them, use the `getAll()` method instead.\n		*\n		* @param {string} name A name of the value you want to retrieve.\n		*\n		* @returns A `FormDataEntryValue` containing the value. If the key doesn't exist, the method returns null.\n		*/\n		get(name) {\n			const field = __privateGet(this, _entries).get(String(name));\n			if (!field) return null;\n			return field[0];\n		}\n		/**\n		* Returns all the values associated with a given key from within a `FormData` object.\n		*\n		* @param {string} name A name of the value you want to retrieve.\n		*\n		* @returns An array of `FormDataEntryValue` whose key matches the value passed in the `name` parameter. If the key doesn't exist, the method returns an empty list.\n		*/\n		getAll(name) {\n			const field = __privateGet(this, _entries).get(String(name));\n			if (!field) return [];\n			return field.slice();\n		}\n		/**\n		* Returns a boolean stating whether a `FormData` object contains a certain key.\n		*\n		* @param name A string representing the name of the key you want to test for.\n		*\n		* @return A boolean value.\n		*/\n		has(name) {\n			return __privateGet(this, _entries).has(String(name));\n		}\n		/**\n		* Deletes a key and its value(s) from a `FormData` object.\n		*\n		* @param name The name of the key you want to delete.\n		*/\n		delete(name) {\n			__privateGet(this, _entries).delete(String(name));\n		}\n		/**\n		* Returns an [`iterator`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Iteration_protocols) allowing to go through all keys contained in this `FormData` object.\n		* Each key is a `string`.\n		*/\n		*keys() {\n			for (const key of __privateGet(this, _entries).keys()) yield key;\n		}\n		/**\n		* Returns an [`iterator`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Iteration_protocols) allowing to go through the `FormData` key/value pairs.\n		* The key of each pair is a string; the value is a [`FormDataValue`](https://developer.mozilla.org/en-US/docs/Web/API/FormDataEntryValue).\n		*/\n		*entries() {\n			for (const name of this.keys()) {\n				const values = this.getAll(name);\n				for (const value of values) yield [name, value];\n			}\n		}\n		/**\n		* Returns an [`iterator`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Iteration_protocols) allowing to go through all values contained in this object `FormData` object.\n		* Each value is a [`FormDataValue`](https://developer.mozilla.org/en-US/docs/Web/API/FormDataEntryValue).\n		*/\n		*values() {\n			for (const [, value] of this) yield value;\n		}\n		/**\n		* An alias for FormData#entries()\n		*/\n		[Symbol.iterator]() {\n			return this.entries();\n		}\n		/**\n		* Executes given callback function for each field of the FormData instance\n		*/\n		forEach(callback, thisArg) {\n			for (const [name, value] of this) callback.call(thisArg, value, name, this);\n		}\n		get [Symbol.toStringTag]() {\n			return \"FormData\";\n		}\n	};\n	_entries = /* @__PURE__ */ new WeakMap();\n	_setEntry = /* @__PURE__ */ new WeakSet();\n	setEntry_fn = function({ name, rawValue, append, fileName, argsLength }) {\n		const methodName = append ? \"append\" : \"set\";\n		if (argsLength < 2) throw new TypeError(`Failed to execute '${methodName}' on 'FormData': 2 arguments required, but only ${argsLength} present.`);\n		name = String(name);\n		let value;\n		if (isFile(rawValue)) value = fileName === void 0 ? rawValue : new File([rawValue], fileName, {\n			type: rawValue.type,\n			lastModified: rawValue.lastModified\n		});\n		else if (isBlob(rawValue)) value = new File([rawValue], fileName === void 0 ? \"blob\" : fileName, { type: rawValue.type });\n		else if (fileName) throw new TypeError(`Failed to execute '${methodName}' on 'FormData': parameter 2 is not of type 'Blob'.`);\n		else value = String(rawValue);\n		const values = __privateGet(this, _entries).get(name);\n		if (!values) {\n			__privateGet(this, _entries).set(name, [value]);\n			return;\n		}\n		if (!append) {\n			__privateGet(this, _entries).set(name, [value]);\n			return;\n		}\n		values.push(value);\n	};\n	/*! Based on fetch-blob. MIT License. Jimmy Wärting <https://jimmy.warting.se/opensource> & David Frank */\n	//#endregion\n	//#region node_modules/.pnpm/set-cookie-parser@3.1.0/node_modules/set-cookie-parser/lib/set-cookie.js\n	var defaultParseOptions = {\n		decodeValues: true,\n		map: false,\n		silent: false,\n		split: \"auto\"\n	};\n	function isForbiddenKey(key) {\n		return typeof key !== \"string\" || key in {};\n	}\n	function createNullObj() {\n		return Object.create(null);\n	}\n	function isNonEmptyString(str) {\n		return typeof str === \"string\" && !!str.trim();\n	}\n	function parseString(setCookieValue, options) {\n		var parts = setCookieValue.split(\";\").filter(isNonEmptyString);\n		var parsed = parseNameValuePair(parts.shift());\n		var name = parsed.name;\n		var value = parsed.value;\n		options = options ? Object.assign({}, defaultParseOptions, options) : defaultParseOptions;\n		if (isForbiddenKey(name)) return null;\n		try {\n			value = options.decodeValues ? decodeURIComponent(value) : value;\n		} catch (e) {\n			console.error(\"set-cookie-parser: failed to decode cookie value. Set options.decodeValues=false to disable decoding.\", e);\n		}\n		var cookie = createNullObj();\n		cookie.name = name;\n		cookie.value = value;\n		parts.forEach(function(part) {\n			var sides = part.split(\"=\");\n			var key = sides.shift().trimLeft().toLowerCase();\n			if (isForbiddenKey(key)) return;\n			var value = sides.join(\"=\");\n			if (key === \"expires\") cookie.expires = new Date(value);\n			else if (key === \"max-age\") {\n				var n = parseInt(value, 10);\n				if (!Number.isNaN(n)) cookie.maxAge = n;\n			} else if (key === \"secure\") cookie.secure = true;\n			else if (key === \"httponly\") cookie.httpOnly = true;\n			else if (key === \"samesite\") cookie.sameSite = value;\n			else if (key === \"partitioned\") cookie.partitioned = true;\n			else if (key) cookie[key] = value;\n		});\n		return cookie;\n	}\n	function parseNameValuePair(nameValuePairStr) {\n		var name = \"\";\n		var value = \"\";\n		var nameValueArr = nameValuePairStr.split(\"=\");\n		if (nameValueArr.length > 1) {\n			name = nameValueArr.shift();\n			value = nameValueArr.join(\"=\");\n		} else value = nameValuePairStr;\n		return {\n			name,\n			value\n		};\n	}\n	function parseSetCookie(input, options) {\n		options = options ? Object.assign({}, defaultParseOptions, options) : defaultParseOptions;\n		if (!input) if (!options.map) return [];\n		else return createNullObj();\n		if (input.headers) if (typeof input.headers.getSetCookie === \"function\") input = input.headers.getSetCookie();\n		else if (input.headers[\"set-cookie\"]) input = input.headers[\"set-cookie\"];\n		else {\n			var sch = input.headers[Object.keys(input.headers).find(function(key) {\n				return key.toLowerCase() === \"set-cookie\";\n			})];\n			if (!sch && input.headers.cookie && !options.silent) console.warn(\"Warning: set-cookie-parser appears to have been called on a request object. It is designed to parse Set-Cookie headers from responses, not Cookie headers from requests. Set the option {silent: true} to suppress this warning.\");\n			input = sch;\n		}\n		var split = options.split;\n		var isArray = Array.isArray(input);\n		if (split === \"auto\") split = !isArray;\n		if (!isArray) input = [input];\n		input = input.filter(isNonEmptyString);\n		if (split) input = input.map(splitCookiesString).flat();\n		if (!options.map) return input.map(function(str) {\n			return parseString(str, options);\n		}).filter(Boolean);\n		else {\n			var cookies = createNullObj();\n			return input.reduce(function(cookies, str) {\n				var cookie = parseString(str, options);\n				if (cookie && !isForbiddenKey(cookie.name)) cookies[cookie.name] = cookie;\n				return cookies;\n			}, cookies);\n		}\n	}\n	function splitCookiesString(cookiesString) {\n		if (Array.isArray(cookiesString)) return cookiesString;\n		if (typeof cookiesString !== \"string\") return [];\n		var cookiesStrings = [];\n		var pos = 0;\n		var start;\n		var ch;\n		var lastComma;\n		var nextStart;\n		var cookiesSeparatorFound;\n		function skipWhitespace() {\n			while (pos < cookiesString.length && /\\s/.test(cookiesString.charAt(pos))) pos += 1;\n			return pos < cookiesString.length;\n		}\n		function notSpecialChar() {\n			ch = cookiesString.charAt(pos);\n			return ch !== \"=\" && ch !== \";\" && ch !== \",\";\n		}\n		while (pos < cookiesString.length) {\n			start = pos;\n			cookiesSeparatorFound = false;\n			while (skipWhitespace()) {\n				ch = cookiesString.charAt(pos);\n				if (ch === \",\") {\n					lastComma = pos;\n					pos += 1;\n					skipWhitespace();\n					nextStart = pos;\n					while (pos < cookiesString.length && notSpecialChar()) pos += 1;\n					if (pos < cookiesString.length && cookiesString.charAt(pos) === \"=\") {\n						cookiesSeparatorFound = true;\n						pos = nextStart;\n						cookiesStrings.push(cookiesString.substring(start, lastComma));\n						start = pos;\n					} else pos = lastComma + 1;\n				} else pos += 1;\n			}\n			if (!cookiesSeparatorFound || pos >= cookiesString.length) cookiesStrings.push(cookiesString.substring(start, cookiesString.length));\n		}\n		return cookiesStrings;\n	}\n	parseSetCookie.parseSetCookie = parseSetCookie;\n	parseSetCookie.parse = parseSetCookie;\n	parseSetCookie.parseString = parseString;\n	parseSetCookie.splitCookiesString = splitCookiesString;\n	//#endregion\n	//#region node_modules/.pnpm/headers-polyfill@5.0.1/node_modules/headers-polyfill/lib/index.mjs\n	const HEADERS_INVALID_CHARACTERS = /[^a-z0-9\\-#$%&'*+.^_`|~]/i;\n	function normalizeHeaderName(name) {\n		if (HEADERS_INVALID_CHARACTERS.test(name) || name.trim() === \"\") throw new TypeError(\"Invalid character in header field name\");\n		return name.trim().toLowerCase();\n	}\n	const charCodesToRemove = [\n		String.fromCharCode(10),\n		String.fromCharCode(13),\n		String.fromCharCode(9),\n		String.fromCharCode(32)\n	];\n	const HEADER_VALUE_REMOVE_REGEXP = new RegExp(`(^[${charCodesToRemove.join(\"\")}]|$[${charCodesToRemove.join(\"\")}])`, \"g\");\n	/**\n	* Normalize the given header value.\n	* @see https://fetch.spec.whatwg.org/#concept-header-value-normalize\n	*/\n	function normalizeHeaderValue(value) {\n		return value.replace(HEADER_VALUE_REMOVE_REGEXP, \"\");\n	}\n	/**\n	* Validate the given header name.\n	* @see https://fetch.spec.whatwg.org/#header-name\n	*/\n	function isValidHeaderName(value) {\n		if (typeof value !== \"string\") return false;\n		if (value.length === 0) return false;\n		for (let i = 0; i < value.length; i++) {\n			const character = value.charCodeAt(i);\n			if (character > 127 || !isToken(character)) return false;\n		}\n		return true;\n	}\n	function isToken(value) {\n		return ![\n			127,\n			32,\n			\"(\",\n			\")\",\n			\"<\",\n			\">\",\n			\"@\",\n			\",\",\n			\";\",\n			\":\",\n			\"\\\\\",\n			\"\\\"\",\n			\"/\",\n			\"[\",\n			\"]\",\n			\"?\",\n			\"=\",\n			\"{\",\n			\"}\"\n		].includes(value);\n	}\n	/**\n	* Validate the given header value.\n	* @see https://fetch.spec.whatwg.org/#header-value\n	*/\n	function isValidHeaderValue(value) {\n		if (typeof value !== \"string\") return false;\n		if (value.trim() !== value) return false;\n		for (let i = 0; i < value.length; i++) {\n			const character = value.charCodeAt(i);\n			if (character === 0 || character === 10 || character === 13) return false;\n		}\n		return true;\n	}\n	let _Symbol$toStringTag;\n	const NORMALIZED_HEADERS = Symbol(\"normalizedHeaders\");\n	const RAW_HEADER_NAMES = Symbol(\"rawHeaderNames\");\n	const HEADER_VALUE_DELIMITER = \", \";\n	var Headers = class Headers {\n		constructor(init) {\n			this[NORMALIZED_HEADERS] = {};\n			this[RAW_HEADER_NAMES] = /* @__PURE__ */ new Map();\n			this[_Symbol$toStringTag] = \"Headers\";\n			/**\n			* @note Cannot necessarily check if the `init` is an instance of the\n			* `Headers` because that class may not be defined in Node or jsdom.\n			*/\n			if ([\"Headers\", \"HeadersPolyfill\"].includes(init?.constructor?.name) || init instanceof Headers || typeof globalThis.Headers !== \"undefined\" && init instanceof globalThis.Headers) init.forEach((value, name) => {\n				this.append(name, value);\n			}, this);\n			else if (Array.isArray(init)) init.forEach(([name, value]) => {\n				this.append(name, Array.isArray(value) ? value.join(HEADER_VALUE_DELIMITER) : value);\n			});\n			else if (init) Object.getOwnPropertyNames(init).forEach((name) => {\n				const value = init[name];\n				this.append(name, Array.isArray(value) ? value.join(HEADER_VALUE_DELIMITER) : value);\n			});\n		}\n		[(_Symbol$toStringTag = Symbol.toStringTag, Symbol.iterator)]() {\n			return this.entries();\n		}\n		*keys() {\n			for (const [name] of this.entries()) yield name;\n		}\n		*values() {\n			for (const [, value] of this.entries()) yield value;\n		}\n		*entries() {\n			let sortedKeys = Object.keys(this[NORMALIZED_HEADERS]).sort((a, b) => a.localeCompare(b));\n			for (const name of sortedKeys) if (name === \"set-cookie\") for (const value of this.getSetCookie()) yield [name, value];\n			else yield [name, this.get(name)];\n		}\n		/**\n		* Returns a boolean stating whether a `Headers` object contains a certain header.\n		*/\n		has(name) {\n			if (!isValidHeaderName(name)) throw new TypeError(`Invalid header name \"${name}\"`);\n			return this[NORMALIZED_HEADERS].hasOwnProperty(normalizeHeaderName(name));\n		}\n		/**\n		* Returns a `ByteString` sequence of all the values of a header with a given name.\n		*/\n		get(name) {\n			if (!isValidHeaderName(name)) throw TypeError(`Invalid header name \"${name}\"`);\n			return this[NORMALIZED_HEADERS][normalizeHeaderName(name)] ?? null;\n		}\n		/**\n		* Sets a new value for an existing header inside a `Headers` object, or adds the header if it does not already exist.\n		*/\n		set(name, value) {\n			if (!isValidHeaderName(name) || !isValidHeaderValue(value)) return;\n			const normalizedName = normalizeHeaderName(name);\n			const normalizedValue = normalizeHeaderValue(value);\n			this[NORMALIZED_HEADERS][normalizedName] = normalizeHeaderValue(normalizedValue);\n			this[RAW_HEADER_NAMES].set(normalizedName, name);\n		}\n		/**\n		* Appends a new value onto an existing header inside a `Headers` object, or adds the header if it does not already exist.\n		*/\n		append(name, value) {\n			if (!isValidHeaderName(name) || !isValidHeaderValue(value)) return;\n			const normalizedName = normalizeHeaderName(name);\n			const normalizedValue = normalizeHeaderValue(value);\n			let resolvedValue = this.has(normalizedName) ? `${this.get(normalizedName)}, ${normalizedValue}` : normalizedValue;\n			this.set(name, resolvedValue);\n		}\n		/**\n		* Deletes a header from the `Headers` object.\n		*/\n		delete(name) {\n			if (!isValidHeaderName(name)) return;\n			if (!this.has(name)) return;\n			const normalizedName = normalizeHeaderName(name);\n			delete this[NORMALIZED_HEADERS][normalizedName];\n			this[RAW_HEADER_NAMES].delete(normalizedName);\n		}\n		/**\n		* Traverses the `Headers` object,\n		* calling the given callback for each header.\n		*/\n		forEach(callback, thisArg) {\n			for (const [name, value] of this.entries()) callback.call(thisArg, value, name, this);\n		}\n		/**\n		* Returns an array containing the values\n		* of all Set-Cookie headers associated\n		* with a response\n		*/\n		getSetCookie() {\n			const setCookieHeader = this.get(\"set-cookie\");\n			if (setCookieHeader === null) return [];\n			if (setCookieHeader === \"\") return [\"\"];\n			return splitCookiesString(setCookieHeader);\n		}\n	};\n	//#endregion\n	//#region packages/core/src/code-mode/platform-entry.ts\n	const platformBridgeGlobalThis = globalThis;\n	const capletsPlatformHost = {\n		randomUUID: platformBridgeGlobalThis.__caplets_platform_random_uuid,\n		randomValues: platformBridgeGlobalThis.__caplets_platform_random_values,\n		sleep: platformBridgeGlobalThis.__caplets_platform_sleep,\n		clearTimer: platformBridgeGlobalThis.__caplets_platform_clear_timer\n	};\n	delete platformBridgeGlobalThis.__caplets_platform_random_uuid;\n	delete platformBridgeGlobalThis.__caplets_platform_random_values;\n	delete platformBridgeGlobalThis.__caplets_platform_sleep;\n	delete platformBridgeGlobalThis.__caplets_platform_clear_timer;\n	const DISABLED_FETCH_MESSAGE = \"Direct fetch is not available in Code Mode; use a Caplet instead.\";\n	const BASE64_ALPHABET = \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\";\n	const base64Lookup = new Map(BASE64_ALPHABET.split(\"\").map((char, index) => [char, index]));\n	function utf8Encode(input) {\n		const encoded = encodeURIComponent(input);\n		const bytes = [];\n		for (let index = 0; index < encoded.length; index += 1) {\n			if (encoded[index] === \"%\") {\n				bytes.push(Number.parseInt(encoded.slice(index + 1, index + 3), 16));\n				index += 2;\n				continue;\n			}\n			bytes.push(encoded.charCodeAt(index));\n		}\n		return Uint8Array.from(bytes);\n	}\n	function utf8Decode(input) {\n		let output = \"\";\n		for (let index = 0; index < input.length; index += 1) {\n			const first = input[index] ?? 0;\n			if (first < 128) {\n				output += String.fromCharCode(first);\n				continue;\n			}\n			if (first >= 194 && first <= 223) {\n				const second = input[index + 1];\n				if (isUtf8Continuation(second)) {\n					output += String.fromCodePoint((first & 31) << 6 | second & 63);\n					index += 1;\n					continue;\n				}\n				output += \"�\";\n				continue;\n			}\n			if (first >= 224 && first <= 239) {\n				const second = input[index + 1];\n				const third = input[index + 2];\n				if (isValidUtf8SecondForThreeByte(first, second) && isUtf8Continuation(third)) {\n					output += String.fromCodePoint((first & 15) << 12 | (second & 63) << 6 | third & 63);\n					index += 2;\n					continue;\n				}\n				output += \"�\";\n				if (isValidUtf8SecondForThreeByte(first, second)) index += 1;\n				continue;\n			}\n			if (first >= 240 && first <= 244) {\n				const second = input[index + 1];\n				const third = input[index + 2];\n				const fourth = input[index + 3];\n				if (isValidUtf8SecondForFourByte(first, second) && isUtf8Continuation(third) && isUtf8Continuation(fourth)) {\n					output += String.fromCodePoint((first & 7) << 18 | (second & 63) << 12 | (third & 63) << 6 | fourth & 63);\n					index += 3;\n					continue;\n				}\n				output += \"�\";\n				if (isValidUtf8SecondForFourByte(first, second)) index += isUtf8Continuation(third) ? 2 : 1;\n				continue;\n			}\n			output += \"�\";\n		}\n		return output;\n	}\n	function isUtf8Continuation(value) {\n		return value !== void 0 && value >= 128 && value <= 191;\n	}\n	function isValidUtf8SecondForThreeByte(first, second) {\n		if (second === void 0) return false;\n		if (first === 224) return second >= 160 && second <= 191;\n		if (first === 237) return second >= 128 && second <= 159;\n		return second >= 128 && second <= 191;\n	}\n	function isValidUtf8SecondForFourByte(first, second) {\n		if (second === void 0) return false;\n		if (first === 240) return second >= 144 && second <= 191;\n		if (first === 244) return second >= 128 && second <= 143;\n		return second >= 128 && second <= 191;\n	}\n	var TextEncoderShim = class {\n		encoding = \"utf-8\";\n		encode(input = \"\") {\n			return utf8Encode(String(input));\n		}\n	};\n	var TextDecoderShim = class {\n		encoding;\n		constructor(label = \"utf-8\") {\n			const normalized = label.toLowerCase();\n			if (![\n				\"utf-8\",\n				\"utf8\",\n				\"unicode-1-1-utf-8\"\n			].includes(normalized)) throw new TypeError(`Unsupported encoding: ${label}`);\n			this.encoding = \"utf-8\";\n		}\n		decode(input) {\n			if (input === void 0) return \"\";\n			return utf8Decode(copyBytes(input));\n		}\n	};\n	const textEncoder = new TextEncoderShim();\n	const textDecoder = new TextDecoderShim();\n	var URLSearchParamsShim = class URLSearchParamsShim {\n		#entries = [];\n		#onChange;\n		constructor(init = \"\", onChange) {\n			this.#onChange = onChange;\n			if (typeof init === \"string\") {\n				const source = init.startsWith(\"?\") ? init.slice(1) : init;\n				if (!source) return;\n				for (const pair of source.split(\"&\")) {\n					if (!pair) continue;\n					const separatorIndex = pair.indexOf(\"=\");\n					const key = separatorIndex >= 0 ? pair.slice(0, separatorIndex) : pair;\n					const value = separatorIndex >= 0 ? pair.slice(separatorIndex + 1) : \"\";\n					this.#entries.push([decodeUrlParam(key), decodeUrlParam(value)]);\n				}\n				return;\n			}\n			if (init instanceof URLSearchParamsShim) {\n				this.#entries = [...init.#entries];\n				return;\n			}\n			if (Array.isArray(init)) {\n				this.#entries = init.map(([key, value]) => [String(key), String(value)]);\n				return;\n			}\n			this.#entries = Object.entries(init).map(([key, value]) => [key, String(value)]);\n		}\n		append(name, value) {\n			this.#entries.push([String(name), String(value)]);\n			this.#onChange?.();\n		}\n		delete(name) {\n			const normalized = String(name);\n			this.#entries = this.#entries.filter(([key]) => key !== normalized);\n			this.#onChange?.();\n		}\n		entries() {\n			return this.#entries[Symbol.iterator]();\n		}\n		forEach(callback) {\n			for (const [key, value] of this.#entries) callback(value, key, this);\n		}\n		get(name) {\n			return this.#entries.find(([key]) => key === String(name))?.[1] ?? null;\n		}\n		getAll(name) {\n			return this.#entries.filter(([key]) => key === String(name)).map(([, value]) => value);\n		}\n		has(name) {\n			return this.#entries.some(([key]) => key === String(name));\n		}\n		keys() {\n			return this.#entries.map(([key]) => key)[Symbol.iterator]();\n		}\n		set(name, value) {\n			const normalizedName = String(name);\n			const normalizedValue = String(value);\n			const next = [];\n			let replaced = false;\n			for (const entry of this.#entries) {\n				if (entry[0] !== normalizedName) {\n					next.push(entry);\n					continue;\n				}\n				if (!replaced) {\n					next.push([normalizedName, normalizedValue]);\n					replaced = true;\n				}\n			}\n			if (!replaced) next.push([normalizedName, normalizedValue]);\n			this.#entries = next;\n			this.#onChange?.();\n		}\n		toString() {\n			return this.#entries.map(([key, value]) => `${encodeURIComponent(key)}=${encodeURIComponent(value)}`).join(\"&\");\n		}\n		values() {\n			return this.#entries.map(([, value]) => value)[Symbol.iterator]();\n		}\n		[Symbol.iterator]() {\n			return this.entries();\n		}\n	};\n	function decodeUrlParam(value) {\n		return decodeURIComponent(value.replace(/\\+/gu, \" \"));\n	}\n	function parseAbsoluteUrl(input) {\n		const match = /^(?<protocol>[a-zA-Z][a-zA-Z\\d+.-]*:)\\/\\/(?<host>[^/?#]*)(?<pathname>[^?#]*)?(?<search>\\?[^#]*)?(?<hash>#.*)?$/u.exec(input);\n		if (!match?.groups?.protocol || !match.groups.host) return;\n		return {\n			protocol: match.groups.protocol,\n			host: match.groups.host,\n			pathname: match.groups.pathname || \"/\",\n			search: match.groups.search || \"\",\n			hash: match.groups.hash || \"\"\n		};\n	}\n	function normalizePathname(pathname) {\n		const segments = [];\n		for (const part of pathname.split(\"/\")) {\n			if (!part || part === \".\") continue;\n			if (part === \"..\") {\n				segments.pop();\n				continue;\n			}\n			segments.push(part);\n		}\n		return `/${segments.join(\"/\")}`;\n	}\n	function resolveUrl(input, base) {\n		const absolute = parseAbsoluteUrl(input);\n		if (absolute) return absolute;\n		if (base === void 0) throw new TypeError(`Invalid URL: ${input}`);\n		const baseUrl = base instanceof URLShim ? base : new URLShim(String(base));\n		const basePath = baseUrl.pathname.endsWith(\"/\") ? baseUrl.pathname : baseUrl.pathname.slice(0, baseUrl.pathname.lastIndexOf(\"/\") + 1);\n		const [beforeHash, rawHash = \"\"] = input.split(\"#\");\n		const hasExplicitSearch = beforeHash?.includes(\"?\") ?? false;\n		const [rawPath, rawSearch = \"\"] = (beforeHash ?? \"\").split(\"?\");\n		const pathname = rawPath === \"\" && (input === \"\" || input.startsWith(\"?\") || input.startsWith(\"#\")) ? baseUrl.pathname : rawPath?.startsWith(\"/\") ? rawPath : `${basePath}${rawPath || \"\"}`;\n		return {\n			protocol: baseUrl.protocol,\n			host: baseUrl.host,\n			pathname: normalizePathname(pathname),\n			search: hasExplicitSearch ? `?${rawSearch}` : rawPath === \"\" && (input === \"\" || input.startsWith(\"#\")) ? baseUrl.search : \"\",\n			hash: rawHash ? `#${rawHash}` : \"\"\n		};\n	}\n	var URLShim = class {\n		host;\n		hostname;\n		origin;\n		password = \"\";\n		port;\n		protocol;\n		searchParams;\n		username = \"\";\n		hash;\n		pathname;\n		#search;\n		constructor(input, base) {\n			const parsed = resolveUrl(String(input), base);\n			this.protocol = parsed.protocol;\n			this.host = parsed.host;\n			const portIndex = this.host.lastIndexOf(\":\");\n			this.hostname = portIndex >= 0 ? this.host.slice(0, portIndex) : this.host;\n			this.port = portIndex >= 0 ? this.host.slice(portIndex + 1) : \"\";\n			this.pathname = parsed.pathname;\n			this.#search = parsed.search;\n			this.hash = parsed.hash;\n			this.origin = `${this.protocol}//${this.host}`;\n			this.searchParams = new URLSearchParamsShim(this.#search, () => {\n				const next = this.searchParams.toString();\n				this.#search = next ? `?${next}` : \"\";\n			});\n		}\n		get href() {\n			return `${this.origin}${this.pathname}${this.#search}${this.hash}`;\n		}\n		get search() {\n			return this.#search;\n		}\n		toString() {\n			return this.href;\n		}\n		toJSON() {\n			return this.href;\n		}\n	};\n	var ReadableStreamShim = class {\n		#queue = [];\n		#closed = false;\n		#pulling = false;\n		#source;\n		#controller;\n		#pending;\n		constructor(source = {}) {\n			this.#source = source;\n			this.#controller = {\n				enqueue: (value) => {\n					if (this.#pending) {\n						this.#pending.resolve({\n							done: false,\n							value\n						});\n						this.#pending = void 0;\n						return;\n					}\n					this.#queue.push(value);\n				},\n				close: () => {\n					this.#closed = true;\n					if (this.#pending) {\n						this.#pending.resolve({ done: true });\n						this.#pending = void 0;\n					}\n				}\n			};\n			source.start?.(this.#controller);\n		}\n		async #pull() {\n			if (this.#pulling || this.#closed || !this.#source.pull) return;\n			this.#pulling = true;\n			try {\n				await this.#source.pull(this.#controller);\n			} finally {\n				this.#pulling = false;\n			}\n		}\n		getReader() {\n			return { read: async () => {\n				if (this.#queue.length > 0) return {\n					done: false,\n					value: this.#queue.shift()\n				};\n				await this.#pull();\n				if (this.#queue.length > 0) return {\n					done: false,\n					value: this.#queue.shift()\n				};\n				if (this.#closed) return {\n					done: true,\n					value: void 0\n				};\n				return await new Promise((resolve) => {\n					this.#pending = { resolve };\n					this.#pull();\n				});\n			} };\n		}\n	};\n	var WritableStreamShim = class {\n		#sink;\n		constructor(sink = {}) {\n			this.#sink = sink;\n		}\n		getWriter() {\n			return {\n				write: async (chunk) => {\n					await this.#sink.write?.(chunk);\n				},\n				close: async () => {\n					await this.#sink.close?.();\n				}\n			};\n		}\n	};\n	var TransformStreamShim = class {\n		readable;\n		writable;\n		constructor(transformer = {}) {\n			const queue = [];\n			let closed = false;\n			let pending;\n			const controller = {\n				enqueue: (value) => {\n					if (pending) {\n						pending.resolve({\n							done: false,\n							value\n						});\n						pending = void 0;\n						return;\n					}\n					queue.push(value);\n				},\n				close: () => {\n					closed = true;\n					if (pending) {\n						pending.resolve({ done: true });\n						pending = void 0;\n					}\n				}\n			};\n			this.readable = { getReader() {\n				return { read: async () => {\n					if (queue.length > 0) return {\n						done: false,\n						value: queue.shift()\n					};\n					if (closed) return {\n						done: true,\n						value: void 0\n					};\n					return await new Promise((resolve) => {\n						pending = { resolve };\n					});\n				} };\n			} };\n			this.writable = new WritableStreamShim({\n				write: async (chunk) => {\n					transformer.transform?.(chunk, controller);\n				},\n				close: async () => {\n					transformer.flush?.(controller);\n					controller.close();\n				}\n			});\n		}\n	};\n	function definePlatformGlobal(name, value, options = {}) {\n		if (!options.overwrite && name in globalThis) return;\n		Object.defineProperty(globalThis, name, {\n			value,\n			writable: true,\n			configurable: true\n		});\n	}\n	function formatLogArg(value) {\n		if (typeof value === \"string\") return value;\n		try {\n			return JSON.stringify(value);\n		} catch {\n			return String(value);\n		}\n	}\n	function formatLogLine(args) {\n		return args.map(formatLogArg).join(\" \");\n	}\n	const platformConsole = {\n		log: (...args) => __caplets_log(\"log\", formatLogLine(args)),\n		info: (...args) => __caplets_log(\"info\", formatLogLine(args)),\n		warn: (...args) => __caplets_log(\"warn\", formatLogLine(args)),\n		error: (...args) => __caplets_log(\"error\", formatLogLine(args)),\n		debug: (...args) => __caplets_log(\"debug\", formatLogLine(args))\n	};\n	function normalizeEncoding(encoding) {\n		const normalized = (encoding ?? \"utf8\").toLowerCase();\n		switch (normalized) {\n			case \"utf8\":\n			case \"utf-8\":\n			case \"base64\":\n			case \"base64url\":\n			case \"hex\": return normalized;\n			default: throw new TypeError(`Unsupported Buffer encoding: ${encoding}`);\n		}\n	}\n	function hexToBytes(value) {\n		if (value.length % 2 !== 0) throw new TypeError(\"Invalid hex string length\");\n		const bytes = new Uint8Array(value.length / 2);\n		for (let index = 0; index < value.length; index += 2) {\n			const parsed = Number.parseInt(value.slice(index, index + 2), 16);\n			if (Number.isNaN(parsed)) throw new TypeError(\"Invalid hex string\");\n			bytes[index / 2] = parsed;\n		}\n		return bytes;\n	}\n	function bytesToHex(bytes) {\n		return Array.from(bytes, (value) => value.toString(16).padStart(2, \"0\")).join(\"\");\n	}\n	function base64ToBytes(value, encoding) {\n		let normalized = value.replace(/\\s+/gu, \"\");\n		if (encoding === \"base64url\") normalized = normalized.replace(/-/gu, \"+\").replace(/_/gu, \"/\");\n		const padding = normalized.length % 4;\n		if (padding === 1) throw new TypeError(\"Invalid base64 string\");\n		if (padding > 0) normalized = normalized.padEnd(normalized.length + (4 - padding), \"=\");\n		const output = [];\n		for (let index = 0; index < normalized.length; index += 4) {\n			const values = normalized.slice(index, index + 4).split(\"\").map((char) => char === \"=\" ? 64 : base64Lookup.get(char) ?? NaN);\n			if (values.some((entry) => Number.isNaN(entry))) throw new TypeError(\"Invalid base64 string\");\n			const [a = 0, b = 0, c = 64, d = 64] = values;\n			const triple = a << 18 | b << 12 | (c & 63) << 6 | d & 63;\n			output.push(triple >> 16 & 255);\n			if (c !== 64) output.push(triple >> 8 & 255);\n			if (d !== 64) output.push(triple & 255);\n		}\n		return Uint8Array.from(output);\n	}\n	function bytesToBase64(bytes, encoding) {\n		let output = \"\";\n		for (let index = 0; index < bytes.length; index += 3) {\n			const a = bytes[index] ?? 0;\n			const b = bytes[index + 1] ?? 0;\n			const c = bytes[index + 2] ?? 0;\n			const triple = a << 16 | b << 8 | c;\n			output += BASE64_ALPHABET[triple >> 18 & 63];\n			output += BASE64_ALPHABET[triple >> 12 & 63];\n			output += index + 1 < bytes.length ? BASE64_ALPHABET[triple >> 6 & 63] : \"=\";\n			output += index + 2 < bytes.length ? BASE64_ALPHABET[triple & 63] : \"=\";\n		}\n		if (encoding === \"base64url\") return output.replace(/\\+/gu, \"-\").replace(/\\//gu, \"_\").replace(/=+$/gu, \"\");\n		return output;\n	}\n	function copyBytes(input) {\n		if (input instanceof ArrayBuffer) return new Uint8Array(input.slice(0));\n		return new Uint8Array(input.buffer.slice(input.byteOffset, input.byteOffset + input.byteLength));\n	}\n	function toBytes(input, encoding) {\n		if (input instanceof BufferShim) return input.toUint8Array();\n		if (typeof input === \"string\") switch (normalizeEncoding(encoding)) {\n			case \"utf8\":\n			case \"utf-8\": return textEncoder.encode(input);\n			case \"base64\":\n			case \"base64url\": return base64ToBytes(input, normalizeEncoding(encoding));\n			case \"hex\": return hexToBytes(input);\n		}\n		if (input instanceof ArrayBuffer || ArrayBuffer.isView(input)) return copyBytes(input);\n		if (Array.isArray(input)) return Uint8Array.from(input);\n		throw new TypeError(\"Buffer.from only supports strings, arrays, ArrayBuffers, and typed arrays\");\n	}\n	var BufferShim = class BufferShim {\n		#bytes;\n		byteLength;\n		length;\n		constructor(bytes) {\n			this.#bytes = bytes;\n			this.byteLength = bytes.byteLength;\n			this.length = bytes.length;\n		}\n		static from(input, encoding) {\n			return new BufferShim(toBytes(input, encoding));\n		}\n		static isBuffer(value) {\n			return value instanceof BufferShim;\n		}\n		static byteLength(input, encoding) {\n			return toBytes(input, encoding).byteLength;\n		}\n		toUint8Array() {\n			return new Uint8Array(this.#bytes);\n		}\n		toString(encoding) {\n			switch (normalizeEncoding(encoding)) {\n				case \"utf8\":\n				case \"utf-8\": return textDecoder.decode(this.#bytes);\n				case \"base64\":\n				case \"base64url\": return bytesToBase64(this.#bytes, normalizeEncoding(encoding));\n				case \"hex\": return bytesToHex(this.#bytes);\n			}\n		}\n	};\n	function atobShim(input) {\n		return Array.from(base64ToBytes(String(input), \"base64\"), (value) => String.fromCharCode(value)).join(\"\");\n	}\n	function btoaShim(input) {\n		const bytes = new Uint8Array(input.length);\n		for (let index = 0; index < input.length; index += 1) {\n			const codePoint = input.charCodeAt(index);\n			if (codePoint > 255) throw new TypeError(\"The string to be encoded contains characters outside of Latin1\");\n			bytes[index] = codePoint;\n		}\n		return bytesToBase64(bytes, \"base64\");\n	}\n	function queueMicrotaskShim(callback) {\n		Promise.resolve().then(callback);\n	}\n	var AbortSignalShim = class AbortSignalShim {\n		aborted = false;\n		reason;\n		onabort = null;\n		#listeners = /* @__PURE__ */ new Set();\n		addEventListener(type, listener) {\n			if (type === \"abort\" && listener) this.#listeners.add(listener);\n		}\n		removeEventListener(type, listener) {\n			if (type === \"abort\" && listener) this.#listeners.delete(listener);\n		}\n		dispatchEvent(event) {\n			if (event.type !== \"abort\") return true;\n			this.onabort?.(event);\n			for (const listener of this.#listeners) listener(event);\n			return true;\n		}\n		throwIfAborted() {\n			if (this.aborted) throw this.reason ?? /* @__PURE__ */ new Error(\"Operation was aborted\");\n		}\n		static abort(reason) {\n			const signal = new AbortSignalShim();\n			signal.abort(reason);\n			return signal;\n		}\n		abort(reason) {\n			if (this.aborted) return;\n			this.aborted = true;\n			this.reason = reason;\n			this.dispatchEvent({\n				type: \"abort\",\n				target: this\n			});\n		}\n	};\n	var AbortControllerShim = class {\n		signal = new AbortSignalShim();\n		abort(reason) {\n			this.signal.abort(reason);\n		}\n	};\n	function cloneFormData(input) {\n		const clone = new FormData();\n		for (const [name, value] of input.entries()) {\n			if (value instanceof File) {\n				clone.append(name, new File([value], value.name, { type: value.type }), value.name);\n				continue;\n			}\n			clone.append(name, value);\n		}\n		return clone;\n	}\n	function cloneBodyValue(input) {\n		if (input === null || input === void 0 || typeof input === \"string\") return input;\n		if (input instanceof FormData) return cloneFormData(input);\n		if (input instanceof Blob) return input.slice(0, input.size, input.type);\n		if (input instanceof ArrayBuffer || ArrayBuffer.isView(input)) return copyBytes(input);\n		return input;\n	}\n	function blobFromBody(input) {\n		if (input instanceof Blob) return input;\n		if (typeof input === \"string\") return new Blob([input], { type: \"text/plain;charset=utf-8\" });\n		if (input instanceof FormData) throw new TypeError(\"FormData body reading is not supported in Code Mode\");\n		if (input instanceof ArrayBuffer || ArrayBuffer.isView(input)) return new Blob([copyBytes(input)]);\n		return new Blob([]);\n	}\n	var BodyMixin = class {\n		_bodyInit;\n		bodyUsed = false;\n		body = null;\n		constructor(body) {\n			this._bodyInit = cloneBodyValue(body);\n		}\n		async arrayBuffer() {\n			this.bodyUsed = true;\n			return await blobFromBody(this._bodyInit).arrayBuffer();\n		}\n		async blob() {\n			this.bodyUsed = true;\n			return blobFromBody(this._bodyInit);\n		}\n		async formData() {\n			this.bodyUsed = true;\n			if (this._bodyInit instanceof FormData) return cloneFormData(this._bodyInit);\n			throw new TypeError(\"Body does not contain FormData\");\n		}\n		async json() {\n			return JSON.parse(await this.text());\n		}\n		async text() {\n			this.bodyUsed = true;\n			return await blobFromBody(this._bodyInit).text();\n		}\n	};\n	function toHeaders(init) {\n		return init instanceof Headers ? new Headers(init) : new Headers(init ?? {});\n	}\n	function normalizeMethod(method) {\n		return String(method ?? \"GET\").toUpperCase();\n	}\n	var RequestShim = class RequestShim extends BodyMixin {\n		headers;\n		method;\n		signal;\n		url;\n		constructor(input, init = {}) {\n			const sourceBody = input instanceof RequestShim ? input._bodyInit : void 0;\n			super(init.body ?? sourceBody);\n			if (input instanceof RequestShim) this.url = input.url;\n			else this.url = input instanceof URLShim ? input.href : new URLShim(String(input)).href;\n			this.method = normalizeMethod(init.method ?? (input instanceof RequestShim ? input.method : \"GET\"));\n			this.headers = toHeaders(init.headers ?? (input instanceof RequestShim ? input.headers : void 0));\n			this.signal = init.signal ?? (input instanceof RequestShim ? input.signal : new AbortControllerShim().signal);\n		}\n		clone() {\n			return new RequestShim(this, {\n				method: this.method,\n				headers: this.headers,\n				body: this._bodyInit,\n				signal: this.signal\n			});\n		}\n	};\n	var ResponseShim = class ResponseShim extends BodyMixin {\n		headers;\n		ok;\n		redirected = false;\n		status;\n		statusText;\n		type = \"default\";\n		url = \"\";\n		constructor(body, init = {}) {\n			super(body);\n			this.status = init.status ?? 200;\n			this.statusText = init.statusText ?? \"\";\n			this.headers = toHeaders(init.headers);\n			this.ok = this.status >= 200 && this.status <= 299;\n		}\n		clone() {\n			return new ResponseShim(this._bodyInit, {\n				headers: this.headers,\n				status: this.status,\n				statusText: this.statusText\n			});\n		}\n		static json(data, init) {\n			const headers = toHeaders(init?.headers);\n			if (!headers.has(\"content-type\")) headers.set(\"content-type\", \"application/json\");\n			const responseInit = { headers };\n			if (init?.status !== void 0) responseInit.status = init.status;\n			if (init?.statusText !== void 0) responseInit.statusText = init.statusText;\n			return new ResponseShim(JSON.stringify(data), responseInit);\n		}\n	};\n	function disabledFetch() {\n		throw new Error(DISABLED_FETCH_MESSAGE);\n	}\n	const integerTypedArrayConstructors = /* @__PURE__ */ new Set([\n		Int8Array,\n		Uint8Array,\n		Uint8ClampedArray,\n		Int16Array,\n		Uint16Array,\n		Int32Array,\n		Uint32Array,\n		typeof BigInt64Array === \"undefined\" ? void 0 : BigInt64Array,\n		typeof BigUint64Array === \"undefined\" ? void 0 : BigUint64Array\n	]);\n	var QuotaExceededErrorShim = class extends Error {\n		constructor(message) {\n			super(message);\n			this.name = \"QuotaExceededError\";\n		}\n	};\n	const platformCrypto = {\n		randomUUID() {\n			const randomUUID = capletsPlatformHost.randomUUID;\n			if (!randomUUID) throw new Error(\"Code Mode platform random UUID bridge is not installed\");\n			return randomUUID();\n		},\n		getRandomValues(typedArray) {\n			if (!ArrayBuffer.isView(typedArray) || typedArray instanceof DataView) throw new TypeError(\"crypto.getRandomValues requires an integer typed array\");\n			if (!integerTypedArrayConstructors.has(typedArray.constructor)) throw new TypeError(\"crypto.getRandomValues requires an integer typed array\");\n			if (typedArray.byteLength > 65536) throw new QuotaExceededErrorShim(\"crypto.getRandomValues cannot generate more than 65,536 bytes\");\n			const randomValues = capletsPlatformHost.randomValues;\n			if (!randomValues) throw new Error(\"Code Mode platform random values bridge is not installed\");\n			const bytes = randomValues(typedArray.byteLength);\n			new Uint8Array(typedArray.buffer, typedArray.byteOffset, typedArray.byteLength).set(bytes);\n			return typedArray;\n		}\n	};\n	let nextTimerId = 1;\n	const activeTimers = /* @__PURE__ */ new Set();\n	function normalizeTimerDelay(delay) {\n		const value = Number(delay ?? 0);\n		if (!Number.isFinite(value) || value <= 0) return 0;\n		return Math.trunc(value);\n	}\n	function setTimeoutShim(callback, delay, ...args) {\n		if (typeof callback !== \"function\") throw new TypeError(\"setTimeout callback must be a function\");\n		const timerId = nextTimerId++;\n		activeTimers.add(timerId);\n		const sleep = capletsPlatformHost.sleep;\n		if (!sleep) throw new Error(\"Code Mode platform sleep bridge is not installed\");\n		sleep(timerId, normalizeTimerDelay(delay)).then((fired) => {\n			activeTimers.delete(timerId);\n			if (fired) callback(...args);\n		});\n		return timerId;\n	}\n	function clearTimeoutShim(timerId) {\n		const id = Number(timerId);\n		activeTimers.delete(id);\n		capletsPlatformHost.clearTimer?.(id);\n	}\n	function setIntervalShim(callback, delay, ...args) {\n		if (typeof callback !== \"function\") throw new TypeError(\"setInterval callback must be a function\");\n		const timerId = nextTimerId++;\n		const intervalDelay = normalizeTimerDelay(delay);\n		activeTimers.add(timerId);\n		const tick = () => {\n			const sleep = capletsPlatformHost.sleep;\n			if (!sleep) throw new Error(\"Code Mode platform sleep bridge is not installed\");\n			sleep(timerId, intervalDelay).then((fired) => {\n				if (!fired || !activeTimers.has(timerId)) {\n					activeTimers.delete(timerId);\n					return;\n				}\n				callback(...args);\n				if (activeTimers.has(timerId)) tick();\n			});\n		};\n		tick();\n		return timerId;\n	}\n	function clearIntervalShim(timerId) {\n		clearTimeoutShim(timerId);\n	}\n	definePlatformGlobal(\"atob\", atobShim);\n	definePlatformGlobal(\"btoa\", btoaShim);\n	definePlatformGlobal(\"Buffer\", BufferShim);\n	definePlatformGlobal(\"TextEncoder\", TextEncoderShim);\n	definePlatformGlobal(\"TextDecoder\", TextDecoderShim);\n	definePlatformGlobal(\"URL\", URLShim);\n	definePlatformGlobal(\"URLSearchParams\", URLSearchParamsShim);\n	definePlatformGlobal(\"structuredClone\", esm_default);\n	definePlatformGlobal(\"Headers\", Headers);\n	definePlatformGlobal(\"Blob\", Blob);\n	definePlatformGlobal(\"File\", File);\n	definePlatformGlobal(\"FormData\", FormData);\n	definePlatformGlobal(\"ReadableStream\", ReadableStreamShim);\n	definePlatformGlobal(\"WritableStream\", WritableStreamShim);\n	definePlatformGlobal(\"TransformStream\", TransformStreamShim);\n	definePlatformGlobal(\"AbortController\", AbortControllerShim);\n	definePlatformGlobal(\"AbortSignal\", AbortSignalShim);\n	definePlatformGlobal(\"Request\", RequestShim);\n	definePlatformGlobal(\"Response\", ResponseShim);\n	definePlatformGlobal(\"crypto\", platformCrypto);\n	definePlatformGlobal(\"setTimeout\", setTimeoutShim);\n	definePlatformGlobal(\"clearTimeout\", clearTimeoutShim);\n	definePlatformGlobal(\"setInterval\", setIntervalShim);\n	definePlatformGlobal(\"clearInterval\", clearIntervalShim);\n	definePlatformGlobal(\"queueMicrotask\", queueMicrotaskShim);\n	definePlatformGlobal(\"console\", platformConsole);\n	definePlatformGlobal(\"fetch\", disabledFetch, { overwrite: true });\n	//#endregion\n})();";
 //#endregion
 //#region src/code-mode/sandbox.ts
-const CODE_MODE_SANDBOX_METHODS = new Set([
+const CODE_MODE_SANDBOX_METHODS = /* @__PURE__ */ new Set([
 	"inspect",
 	"check",
 	"tools",
@@ -77812,7 +78419,7 @@ const CODE_MODE_SANDBOX_METHODS = new Set([
 	"readLogs",
 	"readRecovery"
 ]);
-const CODE_MODE_DEBUG_METHODS = new Set(["readLogs", "readRecovery"]);
+const CODE_MODE_DEBUG_METHODS = /* @__PURE__ */ new Set(["readLogs", "readRecovery"]);
 var QuickJsCodeModeSandbox = class {
 	async run(input) {
 		return await evaluateInQuickJs(input);
@@ -78822,7 +79429,7 @@ function splitPersistentPrelude(javascript, existingNames = [], checkpointToken
 	const ranges = [];
 	const names = collectPersistentBindingNames(source);
 	const lexicalNames = collectTopLevelLexicalBindingNames(source);
-	const allNames = [...new Set([...existingNames, ...names])];
+	const allNames = [.../* @__PURE__ */ new Set([...existingNames, ...names])];
 	const snapshotNames = allNames.filter((name) => !lexicalNames.has(name));
 	const returnTempName = uniqueInternalName("__caplets_return", allNames);
 	const postlude = snapshotNames.map((name) => persistentBindingPostlude(name, checkpointToken)).join("\n");
@@ -78855,7 +79462,7 @@ function collectPersistentReturnRanges(node, source, snapshotNames, ranges, retu
 	if (snapshotNames.length === 0) return;
 	if (ts.isFunctionLike(node) || ts.isClassLike(node)) return;
 	const declared = lexicalNamesDeclaredByNode(node);
-	const activeShadowedNames = declared.size === 0 ? shadowedNames : new Set([...shadowedNames, ...declared]);
+	const activeShadowedNames = declared.size === 0 ? shadowedNames : /* @__PURE__ */ new Set([...shadowedNames, ...declared]);
 	if (ts.isReturnStatement(node)) {
 		const expression = node.expression?.getText(source);
 		const postludeExpression = snapshotNames.filter((name) => !activeShadowedNames.has(name)).map((name) => persistentBindingExpression(name, checkpointToken)).join(", ");
@@ -78920,10 +79527,10 @@ function collectPersistentFinallyRanges(node, snapshotNames, ranges, checkpointT
 	if (snapshotNames.length === 0) return;
 	if (ts.isFunctionLike(node) || ts.isClassLike(node)) return;
 	const declared = lexicalNamesDeclaredByNode(node);
-	const activeShadowedNames = declared.size === 0 ? shadowedNames : new Set([...shadowedNames, ...declared]);
+	const activeShadowedNames = declared.size === 0 ? shadowedNames : /* @__PURE__ */ new Set([...shadowedNames, ...declared]);
 	if (ts.isTryStatement(node) && node.finallyBlock) {
 		const finallyDeclared = lexicalNamesDeclaredByNode(node.finallyBlock);
-		const finallyShadowedNames = finallyDeclared.size === 0 ? activeShadowedNames : new Set([...activeShadowedNames, ...finallyDeclared]);
+		const finallyShadowedNames = finallyDeclared.size === 0 ? activeShadowedNames : /* @__PURE__ */ new Set([...activeShadowedNames, ...finallyDeclared]);
 		const postlude = snapshotNames.filter((name) => !finallyShadowedNames.has(name)).map((name) => persistentBindingPostlude(name, checkpointToken)).join("\n");
 		if (postlude) ranges.push({
 			start: node.finallyBlock.end - 1,
@@ -80061,6 +80668,79 @@ var CapletsCloudClient = class {
 		});
 		if (!response.ok) throw new Error(`Caplets Cloud Project Binding update failed: HTTP ${response.status}`);
 	}
+	async setVaultValue(input) {
+		const response = await this.fetchImpl(this.endpoint(`api/workspaces/${encodeURIComponent(input.workspace)}/vault/values/${encodeURIComponent(input.name)}`), {
+			method: "PUT",
+			headers: this.headers({ json: true }),
+			body: JSON.stringify({
+				value: input.value,
+				force: Boolean(input.force),
+				...input.grant ? { grant: input.grant } : {},
+				...input.referenceName ? { referenceName: input.referenceName } : {}
+			})
+		});
+		if (!response.ok) throw new Error(`Caplets Cloud Vault set failed: HTTP ${response.status}`);
+		return await response.json();
+	}
+	async getVaultValue(input) {
+		const url = this.endpoint(`api/workspaces/${encodeURIComponent(input.workspace)}/vault/values/${encodeURIComponent(input.name)}`);
+		if (input.reveal) {
+			url.searchParams.set("reveal", "true");
+			url.searchParams.set("revealContext", input.revealContext ?? "human-cli");
+		}
+		const response = await this.fetchImpl(url, {
+			method: "GET",
+			headers: this.headers()
+		});
+		if (!response.ok) throw new Error(`Caplets Cloud Vault get failed: HTTP ${response.status}`);
+		return await response.json();
+	}
+	async listVaultValues(input) {
+		const response = await this.fetchImpl(this.endpoint(`api/workspaces/${encodeURIComponent(input.workspace)}/vault/values`), {
+			method: "GET",
+			headers: this.headers()
+		});
+		if (!response.ok) throw new Error(`Caplets Cloud Vault list failed: HTTP ${response.status}`);
+		return await response.json();
+	}
+	async deleteVaultValue(input) {
+		const response = await this.fetchImpl(this.endpoint(`api/workspaces/${encodeURIComponent(input.workspace)}/vault/values/${encodeURIComponent(input.name)}`), {
+			method: "DELETE",
+			headers: this.headers()
+		});
+		if (!response.ok) throw new Error(`Caplets Cloud Vault delete failed: HTTP ${response.status}`);
+		return await response.json();
+	}
+	async grantVaultAccess(input) {
+		const response = await this.fetchImpl(this.endpoint(`api/workspaces/${encodeURIComponent(input.workspace)}/vault/access/${encodeURIComponent(input.name)}/${encodeURIComponent(input.capletId)}`), {
+			method: "PUT",
+			headers: this.headers({ json: true }),
+			body: JSON.stringify({ referenceName: input.referenceName ?? input.name })
+		});
+		if (!response.ok) throw new Error(`Caplets Cloud Vault access grant failed: HTTP ${response.status}`);
+		return await response.json();
+	}
+	async listVaultAccess(input) {
+		const url = this.endpoint(`api/workspaces/${encodeURIComponent(input.workspace)}/vault/access`);
+		if (input.name) url.searchParams.set("name", input.name);
+		if (input.capletId) url.searchParams.set("capletId", input.capletId);
+		const response = await this.fetchImpl(url, {
+			method: "GET",
+			headers: this.headers()
+		});
+		if (!response.ok) throw new Error(`Caplets Cloud Vault access list failed: HTTP ${response.status}`);
+		return await response.json();
+	}
+	async revokeVaultAccess(input) {
+		const url = this.endpoint(`api/workspaces/${encodeURIComponent(input.workspace)}/vault/access/${encodeURIComponent(input.name)}/${encodeURIComponent(input.capletId)}`);
+		if (input.referenceName) url.searchParams.set("referenceName", input.referenceName);
+		const response = await this.fetchImpl(url, {
+			method: "DELETE",
+			headers: this.headers()
+		});
+		if (!response.ok) throw new Error(`Caplets Cloud Vault access revoke failed: HTTP ${response.status}`);
+		return await response.json();
+	}
 	headers(options = {}) {
 		const headers = new Headers();
 		headers.set("authorization", `Bearer ${this.options.accessToken}`);
@@ -82771,7 +83451,7 @@ var CompositeNativeCapletsService = class {
 		return localExecutionKeys(this.local.listTools(), capletId).some((key) => !remoteIds.has(key));
 	}
 	warnShadowedLocalCaplets(localTools, remoteIds) {
-		const localIds = new Set([...localTools.filter((tool) => tool.codeModeRun !== true).map((tool) => tool.sourceCaplet ?? tool.caplet), ...codeModeCallableNativeTools(localTools, { fallbackToVisible: false }).map((tool) => tool.caplet)]);
+		const localIds = /* @__PURE__ */ new Set([...localTools.filter((tool) => tool.codeModeRun !== true).map((tool) => tool.sourceCaplet ?? tool.caplet), ...codeModeCallableNativeTools(localTools, { fallbackToVisible: false }).map((tool) => tool.caplet)]);
 		for (const capletId of localIds) {
 			if (!remoteIds.has(capletId)) continue;
 			if (this.warnedShadowedLocalCaplets.has(capletId)) continue;
@@ -82867,4 +83547,4 @@ function errorMessage(error) {
 	return error instanceof Error ? error.message : String(error);
 }
 //#endregion
-export { decodeDirectResourceUri as $, ElicitResultSchema as $t, nativeCapletToolDescription as A, objectFromShape as An, defaultCacheBaseDir as At, QuickJsCodeModeSandbox as B, assertClientRequestTaskCapability as Bt, resolveRemoteMode as C, getLiteralValue as Cn, startOAuthFlow as Ct, parseServerBaseUrl as D, isSchemaOptional as Dn, DEFAULT_AUTH_DIR as Dt, isLoopbackHost as E, getSchemaDescription as En, readTokenBundle as Et, codeModeRunInputSchema as F, resolveConfigPath as Ft, CodeModeLogStore as G, toJsonSchemaCompat as Gt, createCodeModeCapletsApi as H, AjvJsonSchemaValidator as Ht, codeModeRunParamsSchema as I, resolveProjectCapletsRoot as It, generateCodeModeDeclarations as J, CompleteRequestSchema as Jt, redactCodeModeLogText as K, CallToolRequestSchema as Kt, emptyCodeModeRunMeta as L, resolveProjectConfigPath as Lt, nativeCapletsSystemGuidance as M, safeParseAsync as Mn, defaultConfigPath as Mt, nativeCodeModeToolId as N, __exportAll as Nn, defaultStateBaseDir as Nt, resolveCapletsServer as O, isZ4Schema as On, DEFAULT_COMPLETION_CACHE_DIR as Ot, nativeCodeModeToolName as P, resolveCapletsRoot as Pt, resolveExposure as Q, DEFAULT_NEGOTIATED_PROTOCOL_VERSION as Qt, runCodeMode as R, ReadBuffer as Rt, resolveHostedCloudRemote as S, isJSONRPCResultResponse as Sn, startGenericOAuthFlow as St, controlUrlForBase as T, getParseErrorMessage as Tn, isTokenBundleExpired as Tt, listCodeModeCallableCaplets as U, Protocol as Ut, diagnoseCodeModeTypeScript as V, assertToolsCallTaskCapability as Vt, CodeModeJournalStore as W, mergeCapabilities as Wt, minifyCodeModeDeclarationText as X, CreateMessageResultWithToolsSchema as Xt, generateCodeModeRunToolDescription as Y, CreateMessageResultSchema as Yt, CapletsEngine as Z, CreateTaskResultSchema as Zt, resolveNativeCapletsServiceOptions as _, assertCompleteRequestPrompt as _n, markdownCallToolResultContent as _t, CloudAuthStore as a, JSONRPCMessageSchema as an, capabilityDescription as at, normalizeRemoteProfileHostUrl as b, isJSONRPCErrorResponse as bn, runGenericOAuthFlow as bt, redactedCloudAuthStatus as c, ListResourceTemplatesRequestSchema as cn, loadConfigWithSources as ct, projectBindingError as d, ListToolsRequestSchema as dn, loadProjectConfig as dt, EmptyResultSchema as en, directResourceUriMatchesTemplate as et, projectBindingRecovery as f, LoggingLevelSchema as fn, parseConfig as ft, buildProjectSyncManifest as g, SetLevelRequestSchema as gn, hasRenderableStructuredContent as gt, createSdkRemoteCapletsClient as h, SUPPORTED_PROTOCOL_VERSIONS as hn, loadCapletFilesFromMap as ht, createRemoteProfileStore as i, InitializedNotificationSchema as in, ServerRegistry as it, nativeCapletToolName as j, safeParse as jn, defaultConfigBaseDir as jt, nativeCapletPromptGuidance as k, normalizeObjectSchema as kn, DEFAULT_OBSERVED_OUTPUT_SHAPE_CACHE_DIR as kt, PROJECT_BINDING_ERROR_CODES as l, ListResourcesRequestSchema as ln, loadGlobalConfig as lt, RemoteNativeCapletsService as m, ReadResourceRequestSchema as mn, validateCapletFile as mt, resolveRemoteSelection as n, GetPromptRequestSchema as nn, fingerprintProjectRoot as nt, cloudAuthPath as o, LATEST_PROTOCOL_VERSION as on, GoogleDiscoveryManager as ot, CloudAuthClient as p, McpError as pn, discoverCapletFiles as pt, codeModeDeclarationHash as q, CallToolResultSchema as qt, cloudCredentialsFromRemoteProfile as r, InitializeRequestSchema as rn, handleServerTool as rt, migrateCredentials as s, ListPromptsRequestSchema as sn, loadConfig as st, createNativeCapletsService as t, ErrorCode as tn, findProjectRoot as tt, ProjectBindingError as u, ListRootsResultSchema as un, loadLocalOverlayConfigWithSources as ut, hostedCloudWorkspaceFromRemoteUrl as v, assertCompleteRequestResourceTemplate as vn, markdownStructuredContent as vt, appendBasePath as w, getObjectShape as wn, deleteTokenBundle as wt, resolveCapletsRemote as x, isJSONRPCRequest as xn, runOAuthFlow as xt, isCapletsCloudUrl as y, isInitializeRequest as yn, refreshOAuthTokenBundle as yt, CodeModeSessionManager as z, serializeMessage as zt };
+export { resolveExposure as $, CallToolRequestSchema as $t, nativeCapletPromptGuidance as A, getLiteralValue as An, startOAuthFlow as At, CodeModeSessionManager as B, __exportAll as Bn, defaultStateBaseDir as Bt, resolveHostedCloudRemote as C, SetLevelRequestSchema as Cn, hasRenderableStructuredContent as Ct, isLoopbackHost as D, isJSONRPCErrorResponse as Dn, runGenericOAuthFlow as Dt, controlUrlForBase as E, isInitializeRequest as En, refreshOAuthTokenBundle as Et, nativeCodeModeToolName as F, isZ4Schema as Fn, DEFAULT_COMPLETION_CACHE_DIR as Ft, CodeModeJournalStore as G, ReadBuffer as Gt, diagnoseCodeModeTypeScript as H, resolveConfigPath as Ht, codeModeRunInputSchema as I, normalizeObjectSchema as In, DEFAULT_OBSERVED_OUTPUT_SHAPE_CACHE_DIR as It, codeModeDeclarationHash as J, assertToolsCallTaskCapability as Jt, CodeModeLogStore as K, serializeMessage as Kt, codeModeRunParamsSchema as L, objectFromShape as Ln, defaultCacheBaseDir as Lt, nativeCapletToolName as M, getParseErrorMessage as Mn, isTokenBundleExpired as Mt, nativeCapletsSystemGuidance as N, getSchemaDescription as Nn, readTokenBundle as Nt, parseServerBaseUrl as O, isJSONRPCRequest as On, runOAuthFlow as Ot, nativeCodeModeToolId as P, isSchemaOptional as Pn, DEFAULT_AUTH_DIR as Pt, CapletsEngine as Q, toJsonSchemaCompat as Qt, emptyCodeModeRunMeta as R, safeParse as Rn, defaultConfigBaseDir as Rt, resolveCapletsRemote as S, SUPPORTED_PROTOCOL_VERSIONS as Sn, loadCapletFilesFromMap as St, appendBasePath as T, assertCompleteRequestResourceTemplate as Tn, markdownStructuredContent as Tt, createCodeModeCapletsApi as U, resolveProjectCapletsRoot as Ut, QuickJsCodeModeSandbox as V, resolveCapletsRoot as Vt, listCodeModeCallableCaplets as W, resolveProjectConfigPath as Wt, generateCodeModeRunToolDescription as X, Protocol as Xt, generateCodeModeDeclarations as Y, AjvJsonSchemaValidator as Yt, minifyCodeModeDeclarationText as Z, mergeCapabilities as Zt, CapletsCloudClient as _, ListRootsResultSchema as _n, FileVaultStore as _t, CloudAuthStore as a, DEFAULT_NEGOTIATED_PROTOCOL_VERSION as an, ServerRegistry as at, isCapletsCloudUrl as b, McpError as bn, discoverCapletFiles as bt, redactedCloudAuthStatus as c, ErrorCode as cn, loadConfig as ct, projectBindingError as d, InitializedNotificationSchema as dn, loadLocalOverlayConfigWithSources as dt, CallToolResultSchema as en, decodeDirectResourceUri as et, projectBindingRecovery as f, JSONRPCMessageSchema as fn, loadProjectConfig as ft, buildProjectSyncManifest as g, ListResourcesRequestSchema as gn, vaultStoreForAuthDir as gt, createSdkRemoteCapletsClient as h, ListResourceTemplatesRequestSchema as hn, vaultResolverForAuthDir as ht, createRemoteProfileStore as i, CreateTaskResultSchema as in, handleServerTool as it, nativeCapletToolDescription as j, getObjectShape as jn, deleteTokenBundle as jt, resolveCapletsServer as k, isJSONRPCResultResponse as kn, startGenericOAuthFlow as kt, PROJECT_BINDING_ERROR_CODES as l, GetPromptRequestSchema as ln, loadConfigWithSources as lt, RemoteNativeCapletsService as m, ListPromptsRequestSchema as mn, vaultBootstrapResolver as mt, resolveRemoteSelection as n, CreateMessageResultSchema as nn, findProjectRoot as nt, cloudAuthPath as o, ElicitResultSchema as on, capabilityDescription as ot, CloudAuthClient as p, LATEST_PROTOCOL_VERSION as pn, parseConfig as pt, redactCodeModeLogText as q, assertClientRequestTaskCapability as qt, cloudCredentialsFromRemoteProfile as r, CreateMessageResultWithToolsSchema as rn, fingerprintProjectRoot as rt, migrateCredentials as s, EmptyResultSchema as sn, GoogleDiscoveryManager as st, createNativeCapletsService as t, CompleteRequestSchema as tn, directResourceUriMatchesTemplate as tt, ProjectBindingError as u, InitializeRequestSchema as un, loadGlobalConfig as ut, resolveNativeCapletsServiceOptions as v, ListToolsRequestSchema as vn, VAULT_MAX_VALUE_BYTES as vt, resolveRemoteMode as w, assertCompleteRequestPrompt as wn, markdownCallToolResultContent as wt, normalizeRemoteProfileHostUrl as x, ReadResourceRequestSchema as xn, validateCapletFile as xt, hostedCloudWorkspaceFromRemoteUrl as y, LoggingLevelSchema as yn, validateVaultKeyName as yt, runCodeMode as z, safeParseAsync as zn, defaultConfigPath as zt };