@concavejs/docstore-bun-sqlite 0.0.1-alpha.11 → 0.0.1-alpha.13

package/dist/index.js

@@ -14,7 +14,6 @@ var __export = (target, all) => {
     });
 };
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
-var __require = import.meta.require;
 
 // ../../node_modules/convex/dist/esm/values/base64.js
 function getLens(b64) {
@@ -802,6 +801,237 @@ var init_values = __esm(() => {
   init_errors();
 });
 
+// ../core/dist/id-codec/base32.js
+function base32Encode(data) {
+  if (data.length === 0)
+    return "";
+  let result = "";
+  let buffer = 0;
+  let bitsLeft = 0;
+  for (const byte of data) {
+    buffer = buffer << 8 | byte;
+    bitsLeft += 8;
+    while (bitsLeft >= 5) {
+      bitsLeft -= 5;
+      const index = buffer >> bitsLeft & 31;
+      result += ALPHABET[index];
+    }
+  }
+  if (bitsLeft > 0) {
+    const index = buffer << 5 - bitsLeft & 31;
+    result += ALPHABET[index];
+  }
+  return result;
+}
+function base32Decode(str) {
+  if (str.length === 0)
+    return new Uint8Array(0);
+  const outputLength = Math.floor(str.length * 5 / 8);
+  const result = new Uint8Array(outputLength);
+  let buffer = 0;
+  let bitsLeft = 0;
+  let outputIndex = 0;
+  for (const char of str) {
+    const value = ALPHABET_MAP.get(char);
+    if (value === undefined) {
+      throw new Error(`Invalid base32 character: ${char}`);
+    }
+    buffer = buffer << 5 | value;
+    bitsLeft += 5;
+    if (bitsLeft >= 8) {
+      bitsLeft -= 8;
+      result[outputIndex++] = buffer >> bitsLeft & 255;
+    }
+  }
+  return result;
+}
+function isValidBase32(str) {
+  for (const char of str) {
+    if (!ALPHABET_MAP.has(char)) {
+      return false;
+    }
+  }
+  return true;
+}
+var ALPHABET = "0123456789abcdefghjkmnpqrstvwxyz", ALPHABET_MAP;
+var init_base32 = __esm(() => {
+  ALPHABET_MAP = new Map;
+  for (let i2 = 0;i2 < ALPHABET.length; i2++) {
+    ALPHABET_MAP.set(ALPHABET[i2], i2);
+    ALPHABET_MAP.set(ALPHABET[i2].toUpperCase(), i2);
+  }
+  ALPHABET_MAP.set("i", 1);
+  ALPHABET_MAP.set("I", 1);
+  ALPHABET_MAP.set("l", 1);
+  ALPHABET_MAP.set("L", 1);
+  ALPHABET_MAP.set("o", 0);
+  ALPHABET_MAP.set("O", 0);
+});
+
+// ../core/dist/id-codec/vint.js
+function vintEncode(value) {
+  if (value < 0) {
+    throw new Error("VInt cannot encode negative numbers");
+  }
+  if (value > 4294967295) {
+    throw new Error("VInt cannot encode values larger than 2^32-1");
+  }
+  value = value >>> 0;
+  if (value < 128) {
+    return new Uint8Array([value]);
+  }
+  if (value < 16512) {
+    const adjusted2 = value - 128;
+    return new Uint8Array([128 | adjusted2 >> 8 & 63, adjusted2 & 255]);
+  }
+  if (value < 2113664) {
+    const adjusted2 = value - 16512;
+    return new Uint8Array([192 | adjusted2 >> 16 & 31, adjusted2 >> 8 & 255, adjusted2 & 255]);
+  }
+  if (value < 270549120) {
+    const adjusted2 = value - 2113664;
+    return new Uint8Array([
+      224 | adjusted2 >> 24 & 15,
+      adjusted2 >> 16 & 255,
+      adjusted2 >> 8 & 255,
+      adjusted2 & 255
+    ]);
+  }
+  const adjusted = value - 270549120;
+  return new Uint8Array([
+    240 | adjusted >> 32 & 7,
+    adjusted >> 24 & 255,
+    adjusted >> 16 & 255,
+    adjusted >> 8 & 255,
+    adjusted & 255
+  ]);
+}
+function vintDecode(data, offset = 0) {
+  if (offset >= data.length) {
+    throw new Error("VInt decode: unexpected end of data");
+  }
+  const first = data[offset];
+  if ((first & 128) === 0) {
+    return { value: first, bytesRead: 1 };
+  }
+  if ((first & 192) === 128) {
+    if (offset + 1 >= data.length) {
+      throw new Error("VInt decode: truncated 2-byte encoding");
+    }
+    const value = 128 + ((first & 63) << 8 | data[offset + 1]);
+    return { value, bytesRead: 2 };
+  }
+  if ((first & 224) === 192) {
+    if (offset + 2 >= data.length) {
+      throw new Error("VInt decode: truncated 3-byte encoding");
+    }
+    const value = 16512 + ((first & 31) << 16 | data[offset + 1] << 8 | data[offset + 2]);
+    return { value, bytesRead: 3 };
+  }
+  if ((first & 240) === 224) {
+    if (offset + 3 >= data.length) {
+      throw new Error("VInt decode: truncated 4-byte encoding");
+    }
+    const value = 2113664 + ((first & 15) << 24 | data[offset + 1] << 16 | data[offset + 2] << 8 | data[offset + 3]);
+    return { value: value >>> 0, bytesRead: 4 };
+  }
+  if ((first & 248) === 240) {
+    if (offset + 4 >= data.length) {
+      throw new Error("VInt decode: truncated 5-byte encoding");
+    }
+    const high = first & 7;
+    const low = (data[offset + 1] << 24 | data[offset + 2] << 16 | data[offset + 3] << 8 | data[offset + 4]) >>> 0;
+    const value = 270549120 + high * 4294967296 + low;
+    return { value: value >>> 0, bytesRead: 5 };
+  }
+  throw new Error("VInt decode: invalid prefix");
+}
+
+// ../core/dist/id-codec/fletcher16.js
+function fletcher16(data) {
+  let sum1 = 0;
+  let sum2 = 0;
+  for (const byte of data) {
+    sum1 = (sum1 + byte) % 255;
+    sum2 = (sum2 + sum1) % 255;
+  }
+  return new Uint8Array([sum1, sum2]);
+}
+function verifyFletcher16(data, checksum) {
+  if (checksum.length !== 2)
+    return false;
+  const computed = fletcher16(data);
+  return computed[0] === checksum[0] && computed[1] === checksum[1];
+}
+
+// ../core/dist/utils/crypto.js
+var weakRandomState;
+var init_crypto = __esm(() => {
+  weakRandomState = (Date.now() ^ 2654435769) >>> 0;
+});
+
+// ../core/dist/id-codec/document-id.js
+function encodeDocumentId(tableNumber, internalId) {
+  if (internalId.length !== INTERNAL_ID_LENGTH) {
+    throw new Error(`Internal ID must be exactly ${INTERNAL_ID_LENGTH} bytes, got ${internalId.length}`);
+  }
+  if (tableNumber < 1 || tableNumber > 4294967295) {
+    throw new Error(`Table number must be between 1 and 2^32-1, got ${tableNumber}`);
+  }
+  const tableBytes = vintEncode(tableNumber);
+  const payload = new Uint8Array(tableBytes.length + INTERNAL_ID_LENGTH);
+  payload.set(tableBytes, 0);
+  payload.set(internalId, tableBytes.length);
+  const checksum = fletcher16(payload);
+  const final = new Uint8Array(payload.length + 2);
+  final.set(payload, 0);
+  final.set(checksum, payload.length);
+  return base32Encode(final);
+}
+function decodeDocumentId(encoded) {
+  if (encoded.length < MIN_ENCODED_LENGTH || encoded.length > MAX_ENCODED_LENGTH) {
+    throw new Error(`Invalid document ID length: ${encoded.length} (expected ${MIN_ENCODED_LENGTH}-${MAX_ENCODED_LENGTH})`);
+  }
+  if (!isValidBase32(encoded)) {
+    throw new Error("Invalid document ID: contains invalid base32 characters");
+  }
+  const bytes = base32Decode(encoded);
+  if (bytes.length < 19) {
+    throw new Error(`Invalid document ID: decoded to ${bytes.length} bytes (minimum 19)`);
+  }
+  const checksum = bytes.slice(bytes.length - 2);
+  const payload = bytes.slice(0, bytes.length - 2);
+  if (!verifyFletcher16(payload, checksum)) {
+    throw new Error("Invalid document ID: checksum verification failed");
+  }
+  const { value: tableNumber, bytesRead } = vintDecode(payload, 0);
+  const internalId = payload.slice(bytesRead, bytesRead + INTERNAL_ID_LENGTH);
+  if (internalId.length !== INTERNAL_ID_LENGTH) {
+    throw new Error(`Invalid document ID: internal ID is ${internalId.length} bytes (expected ${INTERNAL_ID_LENGTH})`);
+  }
+  return { tableNumber, internalId };
+}
+function isValidDocumentId(encoded) {
+  try {
+    decodeDocumentId(encoded);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function internalIdToHex(internalId) {
+  let hex = "";
+  for (let i2 = 0;i2 < internalId.length; i2++) {
+    hex += internalId[i2].toString(16).padStart(2, "0");
+  }
+  return hex;
+}
+var INTERNAL_ID_LENGTH = 16, MIN_ENCODED_LENGTH = 31, MAX_ENCODED_LENGTH = 37;
+var init_document_id = __esm(() => {
+  init_base32();
+  init_crypto();
+});
+
 // ../core/dist/utils/utils.js
 function hexToArrayBuffer(hex) {
   if (hex === "") {
@@ -840,9 +1070,15 @@ function deserializeDeveloperId(developerId) {
   return null;
 }
 var DOC_ID_SEPARATOR = ":", LEGACY_DOC_ID_SEPARATOR = ";";
+var init_utils = __esm(() => {
+  init_document_id();
+});
 
 // ../core/dist/tables/interface.js
 function getFullTableName(tableName, componentPath) {
+  if (isSystemTable(tableName)) {
+    return tableName;
+  }
   if (!componentPath || componentPath === "") {
     return tableName;
   }
@@ -859,23 +1095,28 @@ function parseFullTableName(fullName) {
   };
 }
 function isSystemTable(tableName) {
-  return tableName.startsWith("_");
+  return Object.hasOwn(SYSTEM_TABLE_NUMBERS, tableName);
 }
-var SYSTEM_TABLE_NUMBERS, FIRST_USER_TABLE_NUMBER = 100;
+var SYSTEM_TABLE_NUMBERS, FIRST_USER_TABLE_NUMBER = 10001;
 var init_interface = __esm(() => {
   SYSTEM_TABLE_NUMBERS = {
     _tables: 1,
     _scheduled_functions: 2,
     _storage: 3,
-    _crons: 4
+    _crons: 4,
+    _indexes: 5,
+    _schemas: 6,
+    _components: 7,
+    _component_definitions: 8,
+    _schema_validation_progress: 9
   };
 });
 
 // ../core/dist/kernel/context-storage.js
-function resolveFromRequire(req) {
+function resolveFromModuleResolver(resolveModule) {
   for (const specifier of ["node:async_hooks", "async_hooks"]) {
     try {
-      const mod = req(specifier);
+      const mod = resolveModule(specifier);
       if (mod?.AsyncLocalStorage) {
         return mod.AsyncLocalStorage;
       }
@@ -918,16 +1159,16 @@ var resolveAsyncLocalStorage = () => {
   if (globalCtor) {
     return globalCtor;
   }
-  const runtimeRequire = __require;
-  if (runtimeRequire) {
-    const ctor = resolveFromRequire(runtimeRequire);
+  const getBuiltinModule = globalThis?.process?.getBuiltinModule;
+  if (typeof getBuiltinModule === "function") {
+    const ctor = resolveFromModuleResolver((specifier) => getBuiltinModule(specifier));
     if (ctor) {
       return ctor;
     }
   }
   const globalRequire = globalThis?.require;
   if (typeof globalRequire === "function") {
-    return resolveFromRequire(globalRequire);
+    return resolveFromModuleResolver(globalRequire);
   }
   return;
 }, AsyncLocalStorageCtor;
@@ -2212,7 +2453,7 @@ async function listSystemFunctions(options = {}) {
     }
     for (const route of httpRoutes) {
       const method = route.route.method;
-      const routePath = route.route.path;
+      const routePath = mountHttpRoutePath(route.route.path, owningComponent);
       results.push({
         name: `${method} ${routePath}`,
         module: listing.path,
@@ -2274,6 +2515,16 @@ async function loadAndAnalyzeModule(listing, componentPath) {
 function makeCacheKey(componentPath, modulePath) {
   return `${componentPath ?? ""}::${modulePath}`;
 }
+function mountHttpRoutePath(routePath, componentPath) {
+  if (!componentPath) {
+    return routePath;
+  }
+  const prefix = `/${componentPath}`;
+  if (routePath === "/") {
+    return prefix;
+  }
+  return `${prefix}${routePath}`;
+}
 function buildFallbackSourcePath(modulePath) {
   const trimmed = modulePath.replace(/\\/g, "/").replace(/^\//, "");
   const withConvex = trimmed.startsWith("convex/") ? trimmed : `convex/${trimmed}`;
@@ -2435,132 +2686,15 @@ var init_base64url = __esm(() => {
   init_buffer_utils();
 });
 
-// ../../node_modules/jose/dist/webapi/util/errors.js
-var exports_errors = {};
-__export(exports_errors, {
-  JWTInvalid: () => JWTInvalid,
-  JWTExpired: () => JWTExpired,
-  JWTClaimValidationFailed: () => JWTClaimValidationFailed,
-  JWSSignatureVerificationFailed: () => JWSSignatureVerificationFailed,
-  JWSInvalid: () => JWSInvalid,
-  JWKSTimeout: () => JWKSTimeout,
-  JWKSNoMatchingKey: () => JWKSNoMatchingKey,
-  JWKSMultipleMatchingKeys: () => JWKSMultipleMatchingKeys,
-  JWKSInvalid: () => JWKSInvalid,
-  JWKInvalid: () => JWKInvalid,
-  JWEInvalid: () => JWEInvalid,
-  JWEDecryptionFailed: () => JWEDecryptionFailed,
-  JOSENotSupported: () => JOSENotSupported,
-  JOSEError: () => JOSEError,
-  JOSEAlgNotAllowed: () => JOSEAlgNotAllowed
-});
-var JOSEError, JWTClaimValidationFailed, JWTExpired, JOSEAlgNotAllowed, JOSENotSupported, JWEDecryptionFailed, JWEInvalid, JWSInvalid, JWTInvalid, JWKInvalid, JWKSInvalid, JWKSNoMatchingKey, JWKSMultipleMatchingKeys, JWKSTimeout, JWSSignatureVerificationFailed;
-var init_errors2 = __esm(() => {
-  JOSEError = class JOSEError extends Error {
-    static code = "ERR_JOSE_GENERIC";
-    code = "ERR_JOSE_GENERIC";
-    constructor(message, options) {
-      super(message, options);
-      this.name = this.constructor.name;
-      Error.captureStackTrace?.(this, this.constructor);
-    }
-  };
-  JWTClaimValidationFailed = class JWTClaimValidationFailed extends JOSEError {
-    static code = "ERR_JWT_CLAIM_VALIDATION_FAILED";
-    code = "ERR_JWT_CLAIM_VALIDATION_FAILED";
-    claim;
-    reason;
-    payload;
-    constructor(message, payload, claim = "unspecified", reason = "unspecified") {
-      super(message, { cause: { claim, reason, payload } });
-      this.claim = claim;
-      this.reason = reason;
-      this.payload = payload;
-    }
-  };
-  JWTExpired = class JWTExpired extends JOSEError {
-    static code = "ERR_JWT_EXPIRED";
-    code = "ERR_JWT_EXPIRED";
-    claim;
-    reason;
-    payload;
-    constructor(message, payload, claim = "unspecified", reason = "unspecified") {
-      super(message, { cause: { claim, reason, payload } });
-      this.claim = claim;
-      this.reason = reason;
-      this.payload = payload;
-    }
-  };
-  JOSEAlgNotAllowed = class JOSEAlgNotAllowed extends JOSEError {
-    static code = "ERR_JOSE_ALG_NOT_ALLOWED";
-    code = "ERR_JOSE_ALG_NOT_ALLOWED";
-  };
-  JOSENotSupported = class JOSENotSupported extends JOSEError {
-    static code = "ERR_JOSE_NOT_SUPPORTED";
-    code = "ERR_JOSE_NOT_SUPPORTED";
-  };
-  JWEDecryptionFailed = class JWEDecryptionFailed extends JOSEError {
-    static code = "ERR_JWE_DECRYPTION_FAILED";
-    code = "ERR_JWE_DECRYPTION_FAILED";
-    constructor(message = "decryption operation failed", options) {
-      super(message, options);
-    }
-  };
-  JWEInvalid = class JWEInvalid extends JOSEError {
-    static code = "ERR_JWE_INVALID";
-    code = "ERR_JWE_INVALID";
-  };
-  JWSInvalid = class JWSInvalid extends JOSEError {
-    static code = "ERR_JWS_INVALID";
-    code = "ERR_JWS_INVALID";
-  };
-  JWTInvalid = class JWTInvalid extends JOSEError {
-    static code = "ERR_JWT_INVALID";
-    code = "ERR_JWT_INVALID";
-  };
-  JWKInvalid = class JWKInvalid extends JOSEError {
-    static code = "ERR_JWK_INVALID";
-    code = "ERR_JWK_INVALID";
-  };
-  JWKSInvalid = class JWKSInvalid extends JOSEError {
-    static code = "ERR_JWKS_INVALID";
-    code = "ERR_JWKS_INVALID";
-  };
-  JWKSNoMatchingKey = class JWKSNoMatchingKey extends JOSEError {
-    static code = "ERR_JWKS_NO_MATCHING_KEY";
-    code = "ERR_JWKS_NO_MATCHING_KEY";
-    constructor(message = "no applicable key found in the JSON Web Key Set", options) {
-      super(message, options);
-    }
-  };
-  JWKSMultipleMatchingKeys = class JWKSMultipleMatchingKeys extends JOSEError {
-    [Symbol.asyncIterator];
-    static code = "ERR_JWKS_MULTIPLE_MATCHING_KEYS";
-    code = "ERR_JWKS_MULTIPLE_MATCHING_KEYS";
-    constructor(message = "multiple matching keys found in the JSON Web Key Set", options) {
-      super(message, options);
-    }
-  };
-  JWKSTimeout = class JWKSTimeout extends JOSEError {
-    static code = "ERR_JWKS_TIMEOUT";
-    code = "ERR_JWKS_TIMEOUT";
-    constructor(message = "request timed out", options) {
-      super(message, options);
-    }
-  };
-  JWSSignatureVerificationFailed = class JWSSignatureVerificationFailed extends JOSEError {
-    static code = "ERR_JWS_SIGNATURE_VERIFICATION_FAILED";
-    code = "ERR_JWS_SIGNATURE_VERIFICATION_FAILED";
-    constructor(message = "signature verification failed", options) {
-      super(message, options);
-    }
-  };
-});
-
 // ../../node_modules/jose/dist/webapi/lib/crypto_key.js
 function getHashLength(hash) {
   return parseInt(hash.name.slice(4), 10);
 }
+function checkHashLength(algorithm, expected) {
+  const actual = getHashLength(algorithm.hash);
+  if (actual !== expected)
+    throw unusable(`SHA-${expected}`, "algorithm.hash");
+}
 function getNamedCurve(alg) {
   switch (alg) {
     case "ES256":
@@ -2585,10 +2719,7 @@ function checkSigCryptoKey(key, alg, usage) {
     case "HS512": {
       if (!isAlgorithm(key.algorithm, "HMAC"))
         throw unusable("HMAC");
-      const expected = parseInt(alg.slice(2), 10);
-      const actual = getHashLength(key.algorithm.hash);
-      if (actual !== expected)
-        throw unusable(`SHA-${expected}`, "algorithm.hash");
+      checkHashLength(key.algorithm, parseInt(alg.slice(2), 10));
       break;
     }
     case "RS256":
@@ -2596,10 +2727,7 @@ function checkSigCryptoKey(key, alg, usage) {
     case "RS512": {
       if (!isAlgorithm(key.algorithm, "RSASSA-PKCS1-v1_5"))
         throw unusable("RSASSA-PKCS1-v1_5");
-      const expected = parseInt(alg.slice(2), 10);
-      const actual = getHashLength(key.algorithm.hash);
-      if (actual !== expected)
-        throw unusable(`SHA-${expected}`, "algorithm.hash");
+      checkHashLength(key.algorithm, parseInt(alg.slice(2), 10));
       break;
     }
     case "PS256":
@@ -2607,10 +2735,7 @@ function checkSigCryptoKey(key, alg, usage) {
     case "PS512": {
       if (!isAlgorithm(key.algorithm, "RSA-PSS"))
         throw unusable("RSA-PSS");
-      const expected = parseInt(alg.slice(2), 10);
-      const actual = getHashLength(key.algorithm.hash);
-      if (actual !== expected)
-        throw unusable(`SHA-${expected}`, "algorithm.hash");
+      checkHashLength(key.algorithm, parseInt(alg.slice(2), 10));
       break;
     }
     case "Ed25519":
@@ -2668,6 +2793,128 @@ function message(msg, actual, ...types) {
 }
 var invalidKeyInput = (actual, ...types) => message("Key must be ", actual, ...types), withAlg = (alg, actual, ...types) => message(`Key for the ${alg} algorithm must be `, actual, ...types);
 
+// ../../node_modules/jose/dist/webapi/util/errors.js
+var exports_errors = {};
+__export(exports_errors, {
+  JWTInvalid: () => JWTInvalid,
+  JWTExpired: () => JWTExpired,
+  JWTClaimValidationFailed: () => JWTClaimValidationFailed,
+  JWSSignatureVerificationFailed: () => JWSSignatureVerificationFailed,
+  JWSInvalid: () => JWSInvalid,
+  JWKSTimeout: () => JWKSTimeout,
+  JWKSNoMatchingKey: () => JWKSNoMatchingKey,
+  JWKSMultipleMatchingKeys: () => JWKSMultipleMatchingKeys,
+  JWKSInvalid: () => JWKSInvalid,
+  JWKInvalid: () => JWKInvalid,
+  JWEInvalid: () => JWEInvalid,
+  JWEDecryptionFailed: () => JWEDecryptionFailed,
+  JOSENotSupported: () => JOSENotSupported,
+  JOSEError: () => JOSEError,
+  JOSEAlgNotAllowed: () => JOSEAlgNotAllowed
+});
+var JOSEError, JWTClaimValidationFailed, JWTExpired, JOSEAlgNotAllowed, JOSENotSupported, JWEDecryptionFailed, JWEInvalid, JWSInvalid, JWTInvalid, JWKInvalid, JWKSInvalid, JWKSNoMatchingKey, JWKSMultipleMatchingKeys, JWKSTimeout, JWSSignatureVerificationFailed;
+var init_errors2 = __esm(() => {
+  JOSEError = class JOSEError extends Error {
+    static code = "ERR_JOSE_GENERIC";
+    code = "ERR_JOSE_GENERIC";
+    constructor(message2, options) {
+      super(message2, options);
+      this.name = this.constructor.name;
+      Error.captureStackTrace?.(this, this.constructor);
+    }
+  };
+  JWTClaimValidationFailed = class JWTClaimValidationFailed extends JOSEError {
+    static code = "ERR_JWT_CLAIM_VALIDATION_FAILED";
+    code = "ERR_JWT_CLAIM_VALIDATION_FAILED";
+    claim;
+    reason;
+    payload;
+    constructor(message2, payload, claim = "unspecified", reason = "unspecified") {
+      super(message2, { cause: { claim, reason, payload } });
+      this.claim = claim;
+      this.reason = reason;
+      this.payload = payload;
+    }
+  };
+  JWTExpired = class JWTExpired extends JOSEError {
+    static code = "ERR_JWT_EXPIRED";
+    code = "ERR_JWT_EXPIRED";
+    claim;
+    reason;
+    payload;
+    constructor(message2, payload, claim = "unspecified", reason = "unspecified") {
+      super(message2, { cause: { claim, reason, payload } });
+      this.claim = claim;
+      this.reason = reason;
+      this.payload = payload;
+    }
+  };
+  JOSEAlgNotAllowed = class JOSEAlgNotAllowed extends JOSEError {
+    static code = "ERR_JOSE_ALG_NOT_ALLOWED";
+    code = "ERR_JOSE_ALG_NOT_ALLOWED";
+  };
+  JOSENotSupported = class JOSENotSupported extends JOSEError {
+    static code = "ERR_JOSE_NOT_SUPPORTED";
+    code = "ERR_JOSE_NOT_SUPPORTED";
+  };
+  JWEDecryptionFailed = class JWEDecryptionFailed extends JOSEError {
+    static code = "ERR_JWE_DECRYPTION_FAILED";
+    code = "ERR_JWE_DECRYPTION_FAILED";
+    constructor(message2 = "decryption operation failed", options) {
+      super(message2, options);
+    }
+  };
+  JWEInvalid = class JWEInvalid extends JOSEError {
+    static code = "ERR_JWE_INVALID";
+    code = "ERR_JWE_INVALID";
+  };
+  JWSInvalid = class JWSInvalid extends JOSEError {
+    static code = "ERR_JWS_INVALID";
+    code = "ERR_JWS_INVALID";
+  };
+  JWTInvalid = class JWTInvalid extends JOSEError {
+    static code = "ERR_JWT_INVALID";
+    code = "ERR_JWT_INVALID";
+  };
+  JWKInvalid = class JWKInvalid extends JOSEError {
+    static code = "ERR_JWK_INVALID";
+    code = "ERR_JWK_INVALID";
+  };
+  JWKSInvalid = class JWKSInvalid extends JOSEError {
+    static code = "ERR_JWKS_INVALID";
+    code = "ERR_JWKS_INVALID";
+  };
+  JWKSNoMatchingKey = class JWKSNoMatchingKey extends JOSEError {
+    static code = "ERR_JWKS_NO_MATCHING_KEY";
+    code = "ERR_JWKS_NO_MATCHING_KEY";
+    constructor(message2 = "no applicable key found in the JSON Web Key Set", options) {
+      super(message2, options);
+    }
+  };
+  JWKSMultipleMatchingKeys = class JWKSMultipleMatchingKeys extends JOSEError {
+    [Symbol.asyncIterator];
+    static code = "ERR_JWKS_MULTIPLE_MATCHING_KEYS";
+    code = "ERR_JWKS_MULTIPLE_MATCHING_KEYS";
+    constructor(message2 = "multiple matching keys found in the JSON Web Key Set", options) {
+      super(message2, options);
+    }
+  };
+  JWKSTimeout = class JWKSTimeout extends JOSEError {
+    static code = "ERR_JWKS_TIMEOUT";
+    code = "ERR_JWKS_TIMEOUT";
+    constructor(message2 = "request timed out", options) {
+      super(message2, options);
+    }
+  };
+  JWSSignatureVerificationFailed = class JWSSignatureVerificationFailed extends JOSEError {
+    static code = "ERR_JWS_SIGNATURE_VERIFICATION_FAILED";
+    code = "ERR_JWS_SIGNATURE_VERIFICATION_FAILED";
+    constructor(message2 = "signature verification failed", options) {
+      super(message2, options);
+    }
+  };
+});
+
 // ../../node_modules/jose/dist/webapi/lib/is_key_like.js
 var isCryptoKey = (key) => {
   if (key?.[Symbol.toStringTag] === "CryptoKey")
@@ -2679,7 +2926,34 @@ var isCryptoKey = (key) => {
   }
 }, isKeyObject = (key) => key?.[Symbol.toStringTag] === "KeyObject", isKeyLike = (key) => isCryptoKey(key) || isKeyObject(key);
 
-// ../../node_modules/jose/dist/webapi/lib/is_disjoint.js
+// ../../node_modules/jose/dist/webapi/lib/helpers.js
+function decodeBase64url(value, label, ErrorClass) {
+  try {
+    return decode(value);
+  } catch {
+    throw new ErrorClass(`Failed to base64url decode the ${label}`);
+  }
+}
+var unprotected;
+var init_helpers = __esm(() => {
+  init_base64url();
+  unprotected = Symbol();
+});
+
+// ../../node_modules/jose/dist/webapi/lib/type_checks.js
+function isObject(input) {
+  if (!isObjectLike(input) || Object.prototype.toString.call(input) !== "[object Object]") {
+    return false;
+  }
+  if (Object.getPrototypeOf(input) === null) {
+    return true;
+  }
+  let proto = input;
+  while (Object.getPrototypeOf(proto) !== null) {
+    proto = Object.getPrototypeOf(proto);
+  }
+  return Object.getPrototypeOf(input) === proto;
+}
 function isDisjoint(...headers) {
   const sources = headers.filter(Boolean);
   if (sources.length === 0 || sources.length === 1) {
@@ -2701,24 +2975,9 @@ function isDisjoint(...headers) {
   }
   return true;
 }
+var isObjectLike = (value) => typeof value === "object" && value !== null, isJWK = (key) => isObject(key) && typeof key.kty === "string", isPrivateJWK = (key) => key.kty !== "oct" && (key.kty === "AKP" && typeof key.priv === "string" || typeof key.d === "string"), isPublicJWK = (key) => key.kty !== "oct" && key.d === undefined && key.priv === undefined, isSecretJWK = (key) => key.kty === "oct" && typeof key.k === "string";
 
-// ../../node_modules/jose/dist/webapi/lib/is_object.js
-function isObject(input) {
-  if (!isObjectLike(input) || Object.prototype.toString.call(input) !== "[object Object]") {
-    return false;
-  }
-  if (Object.getPrototypeOf(input) === null) {
-    return true;
-  }
-  let proto = input;
-  while (Object.getPrototypeOf(proto) !== null) {
-    proto = Object.getPrototypeOf(proto);
-  }
-  return Object.getPrototypeOf(input) === proto;
-}
-var isObjectLike = (value) => typeof value === "object" && value !== null;
-
-// ../../node_modules/jose/dist/webapi/lib/check_key_length.js
+// ../../node_modules/jose/dist/webapi/lib/signing.js
 function checkKeyLength(alg, key) {
   if (alg.startsWith("RS") || alg.startsWith("PS")) {
     const { modulusLength } = key.algorithm;
@@ -2727,31 +2986,84 @@ function checkKeyLength(alg, key) {
     }
   }
 }
-
-// ../../node_modules/jose/dist/webapi/lib/jwk_to_key.js
-function subtleMapping(jwk) {
-  let algorithm;
-  let keyUsages;
-  switch (jwk.kty) {
-    case "AKP": {
-      switch (jwk.alg) {
-        case "ML-DSA-44":
-        case "ML-DSA-65":
-        case "ML-DSA-87":
-          algorithm = { name: jwk.alg };
-          keyUsages = jwk.priv ? ["sign"] : ["verify"];
-          break;
-        default:
-          throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
-      }
-      break;
-    }
-    case "RSA": {
-      switch (jwk.alg) {
-        case "PS256":
-        case "PS384":
-        case "PS512":
-          algorithm = { name: "RSA-PSS", hash: `SHA-${jwk.alg.slice(-3)}` };
+function subtleAlgorithm(alg, algorithm) {
+  const hash = `SHA-${alg.slice(-3)}`;
+  switch (alg) {
+    case "HS256":
+    case "HS384":
+    case "HS512":
+      return { hash, name: "HMAC" };
+    case "PS256":
+    case "PS384":
+    case "PS512":
+      return { hash, name: "RSA-PSS", saltLength: parseInt(alg.slice(-3), 10) >> 3 };
+    case "RS256":
+    case "RS384":
+    case "RS512":
+      return { hash, name: "RSASSA-PKCS1-v1_5" };
+    case "ES256":
+    case "ES384":
+    case "ES512":
+      return { hash, name: "ECDSA", namedCurve: algorithm.namedCurve };
+    case "Ed25519":
+    case "EdDSA":
+      return { name: "Ed25519" };
+    case "ML-DSA-44":
+    case "ML-DSA-65":
+    case "ML-DSA-87":
+      return { name: alg };
+    default:
+      throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
+  }
+}
+async function getSigKey(alg, key, usage) {
+  if (key instanceof Uint8Array) {
+    if (!alg.startsWith("HS")) {
+      throw new TypeError(invalidKeyInput(key, "CryptoKey", "KeyObject", "JSON Web Key"));
+    }
+    return crypto.subtle.importKey("raw", key, { hash: `SHA-${alg.slice(-3)}`, name: "HMAC" }, false, [usage]);
+  }
+  checkSigCryptoKey(key, alg, usage);
+  return key;
+}
+async function verify(alg, key, signature, data) {
+  const cryptoKey = await getSigKey(alg, key, "verify");
+  checkKeyLength(alg, cryptoKey);
+  const algorithm = subtleAlgorithm(alg, cryptoKey.algorithm);
+  try {
+    return await crypto.subtle.verify(algorithm, cryptoKey, signature, data);
+  } catch {
+    return false;
+  }
+}
+var init_signing = __esm(() => {
+  init_errors2();
+});
+
+// ../../node_modules/jose/dist/webapi/lib/jwk_to_key.js
+function subtleMapping(jwk) {
+  let algorithm;
+  let keyUsages;
+  switch (jwk.kty) {
+    case "AKP": {
+      switch (jwk.alg) {
+        case "ML-DSA-44":
+        case "ML-DSA-65":
+        case "ML-DSA-87":
+          algorithm = { name: jwk.alg };
+          keyUsages = jwk.priv ? ["sign"] : ["verify"];
+          break;
+        default:
+          throw new JOSENotSupported(unsupportedAlg);
+      }
+      break;
+    }
+    case "RSA": {
+      switch (jwk.alg) {
+        case "PS256":
+        case "PS384":
+        case "PS512":
+          algorithm = { name: "RSA-PSS", hash: `SHA-${jwk.alg.slice(-3)}` };
           keyUsages = jwk.d ? ["sign"] : ["verify"];
           break;
         case "RS256":
@@ -2771,22 +3083,19 @@ function subtleMapping(jwk) {
           keyUsages = jwk.d ? ["decrypt", "unwrapKey"] : ["encrypt", "wrapKey"];
           break;
         default:
-          throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
+          throw new JOSENotSupported(unsupportedAlg);
       }
       break;
     }
     case "EC": {
       switch (jwk.alg) {
         case "ES256":
-          algorithm = { name: "ECDSA", namedCurve: "P-256" };
-          keyUsages = jwk.d ? ["sign"] : ["verify"];
-          break;
         case "ES384":
-          algorithm = { name: "ECDSA", namedCurve: "P-384" };
-          keyUsages = jwk.d ? ["sign"] : ["verify"];
-          break;
         case "ES512":
-          algorithm = { name: "ECDSA", namedCurve: "P-521" };
+          algorithm = {
+            name: "ECDSA",
+            namedCurve: { ES256: "P-256", ES384: "P-384", ES512: "P-521" }[jwk.alg]
+          };
           keyUsages = jwk.d ? ["sign"] : ["verify"];
           break;
         case "ECDH-ES":
@@ -2797,7 +3106,7 @@ function subtleMapping(jwk) {
           keyUsages = jwk.d ? ["deriveBits"] : [];
           break;
         default:
-          throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
+          throw new JOSENotSupported(unsupportedAlg);
       }
       break;
     }
@@ -2816,7 +3125,7 @@ function subtleMapping(jwk) {
           keyUsages = jwk.d ? ["deriveBits"] : [];
           break;
         default:
-          throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
+          throw new JOSENotSupported(unsupportedAlg);
       }
       break;
     }
@@ -2837,100 +3146,11 @@ async function jwkToKey(jwk) {
   delete keyData.use;
   return crypto.subtle.importKey("jwk", keyData, algorithm, jwk.ext ?? (jwk.d || jwk.priv ? false : true), jwk.key_ops ?? keyUsages);
 }
+var unsupportedAlg = 'Invalid or unsupported JWK "alg" (Algorithm) Parameter value';
 var init_jwk_to_key = __esm(() => {
   init_errors2();
 });
 
-// ../../node_modules/jose/dist/webapi/key/import.js
-async function importJWK(jwk, alg, options) {
-  if (!isObject(jwk)) {
-    throw new TypeError("JWK must be an object");
-  }
-  let ext;
-  alg ??= jwk.alg;
-  ext ??= options?.extractable ?? jwk.ext;
-  switch (jwk.kty) {
-    case "oct":
-      if (typeof jwk.k !== "string" || !jwk.k) {
-        throw new TypeError('missing "k" (Key Value) Parameter value');
-      }
-      return decode(jwk.k);
-    case "RSA":
-      if ("oth" in jwk && jwk.oth !== undefined) {
-        throw new JOSENotSupported('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');
-      }
-      return jwkToKey({ ...jwk, alg, ext });
-    case "AKP": {
-      if (typeof jwk.alg !== "string" || !jwk.alg) {
-        throw new TypeError('missing "alg" (Algorithm) Parameter value');
-      }
-      if (alg !== undefined && alg !== jwk.alg) {
-        throw new TypeError("JWK alg and alg option value mismatch");
-      }
-      return jwkToKey({ ...jwk, ext });
-    }
-    case "EC":
-    case "OKP":
-      return jwkToKey({ ...jwk, alg, ext });
-    default:
-      throw new JOSENotSupported('Unsupported "kty" (Key Type) Parameter value');
-  }
-}
-var init_import = __esm(() => {
-  init_base64url();
-  init_jwk_to_key();
-  init_errors2();
-});
-
-// ../../node_modules/jose/dist/webapi/lib/validate_crit.js
-function validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader, joseHeader) {
-  if (joseHeader.crit !== undefined && protectedHeader?.crit === undefined) {
-    throw new Err('"crit" (Critical) Header Parameter MUST be integrity protected');
-  }
-  if (!protectedHeader || protectedHeader.crit === undefined) {
-    return new Set;
-  }
-  if (!Array.isArray(protectedHeader.crit) || protectedHeader.crit.length === 0 || protectedHeader.crit.some((input) => typeof input !== "string" || input.length === 0)) {
-    throw new Err('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');
-  }
-  let recognized;
-  if (recognizedOption !== undefined) {
-    recognized = new Map([...Object.entries(recognizedOption), ...recognizedDefault.entries()]);
-  } else {
-    recognized = recognizedDefault;
-  }
-  for (const parameter of protectedHeader.crit) {
-    if (!recognized.has(parameter)) {
-      throw new JOSENotSupported(`Extension Header Parameter "${parameter}" is not recognized`);
-    }
-    if (joseHeader[parameter] === undefined) {
-      throw new Err(`Extension Header Parameter "${parameter}" is missing`);
-    }
-    if (recognized.get(parameter) && protectedHeader[parameter] === undefined) {
-      throw new Err(`Extension Header Parameter "${parameter}" MUST be integrity protected`);
-    }
-  }
-  return new Set(protectedHeader.crit);
-}
-var init_validate_crit = __esm(() => {
-  init_errors2();
-});
-
-// ../../node_modules/jose/dist/webapi/lib/validate_algorithms.js
-function validateAlgorithms(option, algorithms) {
-  if (algorithms !== undefined && (!Array.isArray(algorithms) || algorithms.some((s) => typeof s !== "string"))) {
-    throw new TypeError(`"${option}" option must be an array of strings`);
-  }
-  if (!algorithms) {
-    return;
-  }
-  return new Set(algorithms);
-}
-
-// ../../node_modules/jose/dist/webapi/lib/is_jwk.js
-var isJWK = (key) => isObject(key) && typeof key.kty === "string", isPrivateJWK = (key) => key.kty !== "oct" && (key.kty === "AKP" && typeof key.priv === "string" || typeof key.d === "string"), isPublicJWK = (key) => key.kty !== "oct" && key.d === undefined && key.priv === undefined, isSecretJWK = (key) => key.kty === "oct" && typeof key.k === "string";
-var init_is_jwk = () => {};
-
 // ../../node_modules/jose/dist/webapi/lib/normalize_key.js
 async function normalizeKey(key, alg) {
   if (key instanceof Uint8Array) {
@@ -2963,7 +3183,7 @@ async function normalizeKey(key, alg) {
   }
   throw new Error("unreachable");
 }
-var cache, handleJWK = async (key, jwk, alg, freeze = false) => {
+var unusableForAlg = "given KeyObject instance cannot be used for this algorithm", cache, handleJWK = async (key, jwk, alg, freeze = false) => {
   cache ||= new WeakMap;
   let cached = cache.get(key);
   if (cached?.[alg]) {
@@ -2995,13 +3215,13 @@ var cache, handleJWK = async (key, jwk, alg, freeze = false) => {
       case "ECDH-ES+A256KW":
         break;
       default:
-        throw new TypeError("given KeyObject instance cannot be used for this algorithm");
+        throw new TypeError(unusableForAlg);
     }
     cryptoKey = keyObject.toCryptoKey(keyObject.asymmetricKeyType, extractable, isPublic ? [] : ["deriveBits"]);
   }
   if (keyObject.asymmetricKeyType === "ed25519") {
     if (alg !== "EdDSA" && alg !== "Ed25519") {
-      throw new TypeError("given KeyObject instance cannot be used for this algorithm");
+      throw new TypeError(unusableForAlg);
     }
     cryptoKey = keyObject.toCryptoKey(keyObject.asymmetricKeyType, extractable, [
       isPublic ? "verify" : "sign"
@@ -3012,7 +3232,7 @@ var cache, handleJWK = async (key, jwk, alg, freeze = false) => {
     case "ml-dsa-65":
     case "ml-dsa-87": {
       if (alg !== keyObject.asymmetricKeyType.toUpperCase()) {
-        throw new TypeError("given KeyObject instance cannot be used for this algorithm");
+        throw new TypeError(unusableForAlg);
       }
       cryptoKey = keyObject.toCryptoKey(keyObject.asymmetricKeyType, extractable, [
         isPublic ? "verify" : "sign"
@@ -3041,7 +3261,7 @@ var cache, handleJWK = async (key, jwk, alg, freeze = false) => {
         hash = "SHA-512";
         break;
       default:
-        throw new TypeError("given KeyObject instance cannot be used for this algorithm");
+        throw new TypeError(unusableForAlg);
     }
     if (alg.startsWith("RSA-OAEP")) {
       return keyObject.toCryptoKey({
@@ -3062,21 +3282,10 @@ var cache, handleJWK = async (key, jwk, alg, freeze = false) => {
     ]);
     const namedCurve = nist.get(keyObject.asymmetricKeyDetails?.namedCurve);
     if (!namedCurve) {
-      throw new TypeError("given KeyObject instance cannot be used for this algorithm");
-    }
-    if (alg === "ES256" && namedCurve === "P-256") {
-      cryptoKey = keyObject.toCryptoKey({
-        name: "ECDSA",
-        namedCurve
-      }, extractable, [isPublic ? "verify" : "sign"]);
-    }
-    if (alg === "ES384" && namedCurve === "P-384") {
-      cryptoKey = keyObject.toCryptoKey({
-        name: "ECDSA",
-        namedCurve
-      }, extractable, [isPublic ? "verify" : "sign"]);
+      throw new TypeError(unusableForAlg);
     }
-    if (alg === "ES512" && namedCurve === "P-521") {
+    const expectedCurve = { ES256: "P-256", ES384: "P-384", ES512: "P-521" };
+    if (expectedCurve[alg] && namedCurve === expectedCurve[alg]) {
       cryptoKey = keyObject.toCryptoKey({
         name: "ECDSA",
         namedCurve
@@ -3090,7 +3299,7 @@ var cache, handleJWK = async (key, jwk, alg, freeze = false) => {
     }
   }
   if (!cryptoKey) {
-    throw new TypeError("given KeyObject instance cannot be used for this algorithm");
+    throw new TypeError(unusableForAlg);
   }
   if (!cached) {
     cache.set(keyObject, { [alg]: cryptoKey });
@@ -3100,49 +3309,134 @@ var cache, handleJWK = async (key, jwk, alg, freeze = false) => {
   return cryptoKey;
 };
 var init_normalize_key = __esm(() => {
-  init_is_jwk();
   init_base64url();
   init_jwk_to_key();
 });
 
-// ../../node_modules/jose/dist/webapi/lib/check_key_type.js
-function checkKeyType(alg, key, usage) {
-  switch (alg.substring(0, 2)) {
-    case "A1":
-    case "A2":
-    case "di":
-    case "HS":
-    case "PB":
-      symmetricTypeCheck(alg, key, usage);
-      break;
+// ../../node_modules/jose/dist/webapi/key/import.js
+async function importJWK(jwk, alg, options) {
+  if (!isObject(jwk)) {
+    throw new TypeError("JWK must be an object");
+  }
+  let ext;
+  alg ??= jwk.alg;
+  ext ??= options?.extractable ?? jwk.ext;
+  switch (jwk.kty) {
+    case "oct":
+      if (typeof jwk.k !== "string" || !jwk.k) {
+        throw new TypeError('missing "k" (Key Value) Parameter value');
+      }
+      return decode(jwk.k);
+    case "RSA":
+      if ("oth" in jwk && jwk.oth !== undefined) {
+        throw new JOSENotSupported('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');
+      }
+      return jwkToKey({ ...jwk, alg, ext });
+    case "AKP": {
+      if (typeof jwk.alg !== "string" || !jwk.alg) {
+        throw new TypeError('missing "alg" (Algorithm) Parameter value');
+      }
+      if (alg !== undefined && alg !== jwk.alg) {
+        throw new TypeError("JWK alg and alg option value mismatch");
+      }
+      return jwkToKey({ ...jwk, ext });
+    }
+    case "EC":
+    case "OKP":
+      return jwkToKey({ ...jwk, alg, ext });
     default:
-      asymmetricTypeCheck(alg, key, usage);
+      throw new JOSENotSupported('Unsupported "kty" (Key Type) Parameter value');
   }
 }
-var tag = (key) => key?.[Symbol.toStringTag], jwkMatchesOp = (alg, key, usage) => {
-  if (key.use !== undefined) {
-    let expected;
-    switch (usage) {
-      case "sign":
-      case "verify":
-        expected = "sig";
-        break;
-      case "encrypt":
-      case "decrypt":
-        expected = "enc";
-        break;
-    }
-    if (key.use !== expected) {
-      throw new TypeError(`Invalid key for this operation, its "use" must be "${expected}" when present`);
-    }
+var init_import = __esm(() => {
+  init_base64url();
+  init_jwk_to_key();
+  init_errors2();
+});
+
+// ../../node_modules/jose/dist/webapi/lib/validate_crit.js
+function validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader, joseHeader) {
+  if (joseHeader.crit !== undefined && protectedHeader?.crit === undefined) {
+    throw new Err('"crit" (Critical) Header Parameter MUST be integrity protected');
   }
-  if (key.alg !== undefined && key.alg !== alg) {
-    throw new TypeError(`Invalid key for this operation, its "alg" must be "${alg}" when present`);
+  if (!protectedHeader || protectedHeader.crit === undefined) {
+    return new Set;
   }
-  if (Array.isArray(key.key_ops)) {
-    let expectedKeyOp;
-    switch (true) {
-      case (usage === "sign" || usage === "verify"):
+  if (!Array.isArray(protectedHeader.crit) || protectedHeader.crit.length === 0 || protectedHeader.crit.some((input) => typeof input !== "string" || input.length === 0)) {
+    throw new Err('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');
+  }
+  let recognized;
+  if (recognizedOption !== undefined) {
+    recognized = new Map([...Object.entries(recognizedOption), ...recognizedDefault.entries()]);
+  } else {
+    recognized = recognizedDefault;
+  }
+  for (const parameter of protectedHeader.crit) {
+    if (!recognized.has(parameter)) {
+      throw new JOSENotSupported(`Extension Header Parameter "${parameter}" is not recognized`);
+    }
+    if (joseHeader[parameter] === undefined) {
+      throw new Err(`Extension Header Parameter "${parameter}" is missing`);
+    }
+    if (recognized.get(parameter) && protectedHeader[parameter] === undefined) {
+      throw new Err(`Extension Header Parameter "${parameter}" MUST be integrity protected`);
+    }
+  }
+  return new Set(protectedHeader.crit);
+}
+var init_validate_crit = __esm(() => {
+  init_errors2();
+});
+
+// ../../node_modules/jose/dist/webapi/lib/validate_algorithms.js
+function validateAlgorithms(option, algorithms) {
+  if (algorithms !== undefined && (!Array.isArray(algorithms) || algorithms.some((s) => typeof s !== "string"))) {
+    throw new TypeError(`"${option}" option must be an array of strings`);
+  }
+  if (!algorithms) {
+    return;
+  }
+  return new Set(algorithms);
+}
+
+// ../../node_modules/jose/dist/webapi/lib/check_key_type.js
+function checkKeyType(alg, key, usage) {
+  switch (alg.substring(0, 2)) {
+    case "A1":
+    case "A2":
+    case "di":
+    case "HS":
+    case "PB":
+      symmetricTypeCheck(alg, key, usage);
+      break;
+    default:
+      asymmetricTypeCheck(alg, key, usage);
+  }
+}
+var tag = (key) => key?.[Symbol.toStringTag], jwkMatchesOp = (alg, key, usage) => {
+  if (key.use !== undefined) {
+    let expected;
+    switch (usage) {
+      case "sign":
+      case "verify":
+        expected = "sig";
+        break;
+      case "encrypt":
+      case "decrypt":
+        expected = "enc";
+        break;
+    }
+    if (key.use !== expected) {
+      throw new TypeError(`Invalid key for this operation, its "use" must be "${expected}" when present`);
+    }
+  }
+  if (key.alg !== undefined && key.alg !== alg) {
+    throw new TypeError(`Invalid key for this operation, its "alg" must be "${alg}" when present`);
+  }
+  if (Array.isArray(key.key_ops)) {
+    let expectedKeyOp;
+    switch (true) {
+      case (usage === "sign" || usage === "verify"):
       case alg === "dir":
       case alg.includes("CBC-HS"):
         expectedKeyOp = usage;
@@ -3221,73 +3515,7 @@ var tag = (key) => key?.[Symbol.toStringTag], jwkMatchesOp = (alg, key, usage) =
     }
   }
 };
-var init_check_key_type = __esm(() => {
-  init_is_jwk();
-});
-
-// ../../node_modules/jose/dist/webapi/lib/subtle_dsa.js
-function subtleAlgorithm(alg, algorithm) {
-  const hash = `SHA-${alg.slice(-3)}`;
-  switch (alg) {
-    case "HS256":
-    case "HS384":
-    case "HS512":
-      return { hash, name: "HMAC" };
-    case "PS256":
-    case "PS384":
-    case "PS512":
-      return { hash, name: "RSA-PSS", saltLength: parseInt(alg.slice(-3), 10) >> 3 };
-    case "RS256":
-    case "RS384":
-    case "RS512":
-      return { hash, name: "RSASSA-PKCS1-v1_5" };
-    case "ES256":
-    case "ES384":
-    case "ES512":
-      return { hash, name: "ECDSA", namedCurve: algorithm.namedCurve };
-    case "Ed25519":
-    case "EdDSA":
-      return { name: "Ed25519" };
-    case "ML-DSA-44":
-    case "ML-DSA-65":
-    case "ML-DSA-87":
-      return { name: alg };
-    default:
-      throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
-  }
-}
-var init_subtle_dsa = __esm(() => {
-  init_errors2();
-});
-
-// ../../node_modules/jose/dist/webapi/lib/get_sign_verify_key.js
-async function getSigKey(alg, key, usage) {
-  if (key instanceof Uint8Array) {
-    if (!alg.startsWith("HS")) {
-      throw new TypeError(invalidKeyInput(key, "CryptoKey", "KeyObject", "JSON Web Key"));
-    }
-    return crypto.subtle.importKey("raw", key, { hash: `SHA-${alg.slice(-3)}`, name: "HMAC" }, false, [usage]);
-  }
-  checkSigCryptoKey(key, alg, usage);
-  return key;
-}
-var init_get_sign_verify_key = () => {};
-
-// ../../node_modules/jose/dist/webapi/lib/verify.js
-async function verify(alg, key, signature, data) {
-  const cryptoKey = await getSigKey(alg, key, "verify");
-  checkKeyLength(alg, cryptoKey);
-  const algorithm = subtleAlgorithm(alg, cryptoKey.algorithm);
-  try {
-    return await crypto.subtle.verify(algorithm, cryptoKey, signature, data);
-  } catch {
-    return false;
-  }
-}
-var init_verify = __esm(() => {
-  init_subtle_dsa();
-  init_get_sign_verify_key();
-});
+var init_check_key_type = () => {};
 
 // ../../node_modules/jose/dist/webapi/jws/flattened/verify.js
 async function flattenedVerify(jws, key, options) {
@@ -3355,12 +3583,7 @@ async function flattenedVerify(jws, key, options) {
   }
   checkKeyType(alg, key, "verify");
   const data = concat(jws.protected !== undefined ? encode(jws.protected) : new Uint8Array, encode("."), typeof jws.payload === "string" ? b64 ? encode(jws.payload) : encoder.encode(jws.payload) : jws.payload);
-  let signature;
-  try {
-    signature = decode(jws.signature);
-  } catch {
-    throw new JWSInvalid("Failed to base64url decode the signature");
-  }
+  const signature = decodeBase64url(jws.signature, "signature", JWSInvalid);
   const k = await normalizeKey(key, alg);
   const verified = await verify(alg, k, signature, data);
   if (!verified) {
@@ -3368,11 +3591,7 @@ async function flattenedVerify(jws, key, options) {
   }
   let payload;
   if (b64) {
-    try {
-      payload = decode(jws.payload);
-    } catch {
-      throw new JWSInvalid("Failed to base64url decode the payload");
-    }
+    payload = decodeBase64url(jws.payload, "payload", JWSInvalid);
   } else if (typeof jws.payload === "string") {
     payload = encoder.encode(jws.payload);
   } else {
@@ -3390,11 +3609,12 @@ async function flattenedVerify(jws, key, options) {
   }
   return result;
 }
-var init_verify2 = __esm(() => {
+var init_verify = __esm(() => {
   init_base64url();
-  init_verify();
+  init_signing();
   init_errors2();
   init_buffer_utils();
+  init_helpers();
   init_check_key_type();
   init_validate_crit();
   init_normalize_key();
@@ -3419,8 +3639,8 @@ async function compactVerify(jws, key, options) {
   }
   return result;
 }
-var init_verify3 = __esm(() => {
-  init_verify2();
+var init_verify2 = __esm(() => {
+  init_verify();
   init_errors2();
   init_buffer_utils();
 });
@@ -3664,8 +3884,8 @@ async function jwtVerify(jwt, key, options) {
   }
   return result;
 }
-var init_verify4 = __esm(() => {
-  init_verify3();
+var init_verify3 = __esm(() => {
+  init_verify2();
   init_jwt_claims_set();
   init_errors2();
 });
@@ -3950,7 +4170,7 @@ var init_remote = __esm(() => {
   init_local();
   if (typeof navigator === "undefined" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) {
     const NAME = "jose";
-    const VERSION = "v6.1.3";
+    const VERSION = "v6.2.1";
     USER_AGENT = `${NAME}/${VERSION}`;
   }
   customFetch = Symbol();
@@ -3959,7 +4179,8 @@ var init_remote = __esm(() => {
 
 // ../../node_modules/jose/dist/webapi/index.js
 var init_webapi = __esm(() => {
-  init_verify4();
+  init_verify3();
+  init_local();
   init_remote();
   init_errors2();
 });
@@ -4164,7 +4385,7 @@ function getRemoteJwks(jwksUrl, config) {
   if (cached) {
     JWKS_CACHE.delete(jwksUrl);
   }
-  const jwks = createRemoteJWKSet(new URL(jwksUrl));
+  const jwks = jwksUrl.startsWith("data:") ? createLocalJWKSet(parseDataUriJson(jwksUrl)) : createRemoteJWKSet(new URL(jwksUrl));
   const configuredTtl = config?.jwksCacheTtlMs;
   const ttlMs = resolveJwksCacheTtlMs(configuredTtl);
   JWKS_CACHE.set(jwksUrl, {
@@ -4173,6 +4394,24 @@ function getRemoteJwks(jwksUrl, config) {
   });
   return jwks;
 }
+function parseDataUriJson(dataUri) {
+  const match = /^data:([^;,]+)?(?:;charset=[^;,]+)?(;base64)?,(.*)$/i.exec(dataUri);
+  if (!match) {
+    throw new JWTValidationError("INVALID_TOKEN", "Invalid JWKS data URI");
+  }
+  const [, , isBase64, payload] = match;
+  const jsonText = isBase64 ? decodeBase642(payload) : decodeURIComponent(payload);
+  return JSON.parse(jsonText);
+}
+function decodeBase642(value) {
+  if (typeof Buffer !== "undefined") {
+    return Buffer.from(value, "base64").toString("utf8");
+  }
+  if (typeof atob === "function") {
+    return new TextDecoder().decode(Uint8Array.from(atob(value), (char) => char.charCodeAt(0)));
+  }
+  throw new JWTValidationError("INVALID_TOKEN", "Base64 decoding is unavailable");
+}
 function resolveJwksCacheTtlMs(configuredTtl) {
   if (configuredTtl === undefined) {
     return DEFAULT_JWKS_CACHE_TTL_MS;
@@ -4207,6 +4446,7 @@ async function verifyJwt(token, config) {
     const options = {
       issuer: effectiveConfig.issuer,
       audience: effectiveConfig.audience,
+      algorithms: effectiveConfig.algorithms,
       clockTolerance: effectiveConfig.clockTolerance ?? DEFAULT_CLOCK_TOLERANCE_SECONDS
     };
     let payload;
@@ -4764,6 +5004,207 @@ var init_auth = __esm(() => {
   init_auth_config_service();
 });
 
+// ../core/dist/components/manifest.js
+var COMPONENT_MANIFEST_SYMBOL;
+var init_manifest = __esm(() => {
+  COMPONENT_MANIFEST_SYMBOL = Symbol.for("concave.componentManifest");
+});
+
+// ../core/dist/id-codec/index.js
+var init_id_codec = __esm(() => {
+  init_base32();
+  init_document_id();
+});
+
+// ../core/dist/system/system-tables.js
+function getSystemTableDefinition(name) {
+  return SYSTEM_TABLE_DEFINITIONS.find((definition) => definition.name === name) ?? null;
+}
+function isPublicSystemTable(name) {
+  return getSystemTableDefinition(name)?.visibility === "public";
+}
+function createTableInfo(name, tableNumber, componentPath = "", options = {}) {
+  const fullName = getFullTableName(name, componentPath);
+  return {
+    tableNumber,
+    name,
+    componentPath: isSystemTableName(name) ? "" : componentPath,
+    fullName,
+    isSystem: options.isSystem ?? isSystemTableName(name),
+    visibility: options.visibility ?? (isPublicSystemTable(name) ? "public" : "private"),
+    state: "active",
+    createdAt: options.createdAt ?? Date.now()
+  };
+}
+function getReservedSystemTables() {
+  return SYSTEM_TABLE_DEFINITIONS.map((definition) => createTableInfo(definition.name, SYSTEM_TABLE_NUMBERS[definition.name], "", {
+    isSystem: true,
+    visibility: definition.visibility
+  }));
+}
+function tableInfoFromStoredDocument(value) {
+  if (!value) {
+    return null;
+  }
+  const name = typeof value.name === "string" ? value.name : null;
+  const tableNumber = typeof value.tableNumber === "number" ? value.tableNumber : null;
+  if (!name || !tableNumber) {
+    return null;
+  }
+  const componentPath = typeof value.componentPath === "string" ? value.componentPath : "";
+  const fullName = typeof value.fullName === "string" ? value.fullName : getFullTableName(name, componentPath);
+  return {
+    tableNumber,
+    name,
+    componentPath,
+    fullName,
+    isSystem: value.isSystem === true,
+    visibility: value.visibility === "private" ? "private" : "public",
+    state: "active",
+    createdAt: typeof value.createdAt === "number" ? value.createdAt : Date.now()
+  };
+}
+function nextUserTableNumber(tables) {
+  let next = FIRST_USER_TABLE_NUMBER;
+  for (const table of tables) {
+    if (table.tableNumber >= next) {
+      next = table.tableNumber + 1;
+    }
+  }
+  return next;
+}
+function createSystemMetadata(partial) {
+  const now = partial?.updatedAt ?? Date.now();
+  return {
+    version: 1,
+    bootstrapped: true,
+    tableIdStrategy: "registry_u32",
+    developerIdCodec: "convex_base32",
+    nextUserTableNumber: partial?.nextUserTableNumber ?? FIRST_USER_TABLE_NUMBER,
+    registryVersion: partial?.registryVersion ?? now,
+    runtimeMetadataVersion: partial?.runtimeMetadataVersion,
+    bootstrappedAt: partial?.bootstrappedAt ?? now,
+    updatedAt: now
+  };
+}
+async function readSystemMetadata(docstore) {
+  const metadata = await docstore.getGlobal(SYSTEM_METADATA_GLOBAL_KEY);
+  if (!metadata || metadata.bootstrapped !== true || metadata.version !== 1) {
+    return null;
+  }
+  return createSystemMetadata({
+    nextUserTableNumber: metadata.nextUserTableNumber,
+    registryVersion: metadata.registryVersion ?? metadata.updatedAt,
+    runtimeMetadataVersion: metadata.runtimeMetadataVersion,
+    bootstrappedAt: metadata.bootstrappedAt,
+    updatedAt: metadata.updatedAt
+  });
+}
+function createTableNumberReservationKey(tableNumber) {
+  return `${TABLE_NUMBER_RESERVATION_GLOBAL_PREFIX}${tableNumber}`;
+}
+async function ensureSystemTablesBootstrapped(docstore) {
+  const existingMetadata = await readSystemMetadata(docstore);
+  if (existingMetadata?.version === 1 && existingMetadata.bootstrapped) {
+    return;
+  }
+  const now = Date.now();
+  const tableInfos = getReservedSystemTables();
+  const existingEntries = await docstore.scan(stringToHex("_tables"));
+  const existingByName = new Map;
+  for (const entry of existingEntries) {
+    const info = tableInfoFromStoredDocument(entry.value.value);
+    if (info) {
+      existingByName.set(info.fullName, info);
+    }
+  }
+  const docs = [];
+  const oracle = docstore.timestampOracle;
+  const allocateTimestamp = oracle?.allocateTimestamp?.bind(oracle) ?? (() => BigInt(Date.now()));
+  for (const table of tableInfos) {
+    const existing = existingByName.get(table.fullName);
+    const createdAt = existing?.createdAt ?? now;
+    docs.push(createTableMetadataEntry(table, allocateTimestamp(), createdAt));
+  }
+  if (docs.length > 0) {
+    await docstore.write(docs, new Set, "Overwrite");
+  }
+  const metadata = createSystemMetadata({
+    nextUserTableNumber: nextUserTableNumber([...tableInfos, ...existingByName.values()]),
+    registryVersion: now,
+    bootstrappedAt: existingMetadata?.bootstrappedAt ?? now,
+    updatedAt: now
+  });
+  await docstore.writeGlobal(SYSTEM_METADATA_GLOBAL_KEY, metadata);
+}
+function createTableMetadataEntryForUserTable(table, timestamp2) {
+  return createTableMetadataEntry(table, timestamp2, table.createdAt);
+}
+function createTableMetadataEntry(table, timestamp2, createdAt) {
+  const docId = createTableMetadataDocumentId(table.fullName);
+  const developerId = encodeDocumentId(SYSTEM_TABLE_NUMBERS._tables, stableMetadataInternalIdBytes(table.fullName));
+  const storedTable = {
+    _id: developerId,
+    _creationTime: Number(timestamp2),
+    name: table.name,
+    componentPath: table.componentPath,
+    fullName: table.fullName,
+    tableNumber: table.tableNumber,
+    isSystem: table.isSystem,
+    visibility: table.visibility,
+    state: table.state,
+    createdAt
+  };
+  return {
+    ts: timestamp2,
+    id: docId,
+    value: {
+      id: docId,
+      value: storedTable
+    },
+    prev_ts: null
+  };
+}
+function createTableMetadataDocumentId(fullTableName) {
+  const internalIdBytes = stableMetadataInternalIdBytes(fullTableName);
+  return {
+    table: stringToHex("_tables"),
+    internalId: internalIdToHex(internalIdBytes),
+    tableNumber: SYSTEM_TABLE_NUMBERS._tables
+  };
+}
+function stableMetadataInternalIdBytes(fullTableName) {
+  const bytes = new Uint8Array(16);
+  const input = new TextEncoder().encode(`table:${fullTableName}`);
+  for (let i2 = 0;i2 < input.length; i2 += 1) {
+    const target = i2 % 16;
+    bytes[target] = bytes[target] * 33 + input[i2] & 255;
+  }
+  return bytes;
+}
+function isSystemTableName(name) {
+  return Object.hasOwn(SYSTEM_TABLE_NUMBERS, name);
+}
+var SYSTEM_METADATA_GLOBAL_KEY = "concave:system_metadata:v1", TABLE_NUMBER_RESERVATION_GLOBAL_PREFIX = "concave:table_number:", SYSTEM_TABLE_DEFINITIONS;
+var init_system_tables = __esm(() => {
+  init_manifest();
+  init_id_codec();
+  init_interface();
+  init_utils();
+  init_module_loader();
+  SYSTEM_TABLE_DEFINITIONS = [
+    { name: "_tables", visibility: "public" },
+    { name: "_scheduled_functions", visibility: "public" },
+    { name: "_storage", visibility: "public" },
+    { name: "_crons", visibility: "public" },
+    { name: "_indexes", visibility: "private" },
+    { name: "_schemas", visibility: "private" },
+    { name: "_components", visibility: "private" },
+    { name: "_component_definitions", visibility: "private" },
+    { name: "_schema_validation_progress", visibility: "private" }
+  ];
+});
+
 // ../core/dist/system/internal.js
 function requireSystemCapability(capability) {
   const principal2 = getPrincipal();
@@ -4777,34 +5218,17 @@ function createSystemFunctions(deps) {
   return {
     systemListComponents: query({
       args: {},
-      handler: async (_ctx) => {
+      handler: async (ctx) => {
         requireSystemCapability("components:read");
-        const modules = await listRegisteredModules();
-        const componentPaths = new Set;
-        componentPaths.add("");
-        for (const module of modules) {
-          if (module.componentPath) {
-            componentPaths.add(module.componentPath);
-          }
-        }
-        const components = [];
-        for (const path of componentPaths) {
-          const componentModules = modules.filter((m) => path === "" ? !m.componentPath || m.componentPath === "" : m.componentPath === path);
-          const functions = await listSystemFunctions({ componentPath: path || undefined });
-          components.push({
-            path: path || "(root)",
-            isRoot: path === "",
-            moduleCount: componentModules.length,
+        const components = await loadComponentRows(ctx);
+        const withFunctionCounts = await Promise.all(components.map(async (component) => {
+          const functions = await listSystemFunctions({ componentPath: component.componentPath || undefined });
+          return {
+            ...component,
             functionCount: functions.length
-          });
-        }
-        return components.sort((a, b) => {
-          if (a.isRoot)
-            return -1;
-          if (b.isRoot)
-            return 1;
-          return a.path.localeCompare(b.path);
-        });
+          };
+        }));
+        return sortComponentRows(withFunctionCounts);
       }
     }),
     systemListTables: query({
@@ -4813,25 +5237,40 @@ function createSystemFunctions(deps) {
         requireSystemCapability("tables:read");
         const targetComponent = componentPath ?? "";
         const schema2 = await loadSchemaDefinition(targetComponent);
-        let tableEntries = [];
+        const schemaTables = new Map;
         if (schema2?.tables) {
-          tableEntries = extractTablesFromSchema(schema2);
-        } else {
-          try {
-            const systemTables = await ctx.db.system.query("_tables").collect();
-            tableEntries = systemTables.map((table) => ({
-              name: table.name,
-              exported: {
-                indexes: table.indexes || [],
-                searchIndexes: table.searchIndexes || [],
-                vectorIndexes: table.vectorIndexes || [],
-                documentType: null
-              }
-            }));
-          } catch {
-            tableEntries = [];
+          for (const table of extractTablesFromSchema(schema2)) {
+            schemaTables.set(table.name, table);
           }
         }
+        const discoveredTables = new Map;
+        for (const name of schemaTables.keys()) {
+          discoveredTables.set(name, {
+            name,
+            isSystem: isSystemTable(name),
+            visibility: getDefaultSystemTableVisibility(name)
+          });
+        }
+        try {
+          const systemTables = await ctx.db.system.query("_tables").collect();
+          discoveredTables.clear();
+          for (const table of systemTables.filter((entry) => (entry.componentPath ?? "") === targetComponent)) {
+            discoveredTables.set(table.name, {
+              name: table.name,
+              isSystem: table.isSystem === true || isSystemTable(table.name),
+              visibility: table.visibility === "private" ? "private" : "public"
+            });
+          }
+        } catch {}
+        const tableEntries = Array.from(discoveredTables.values()).map((metadata) => ({
+          ...metadata,
+          exported: schemaTables.get(metadata.name)?.exported ?? {
+            indexes: [],
+            searchIndexes: [],
+            vectorIndexes: [],
+            documentType: null
+          }
+        }));
         const tableInfo = await Promise.all(tableEntries.map(async (table) => {
           const fullName = getFullTableName(table.name, targetComponent);
           const documentCount = await countDocuments(ctx, fullName);
@@ -4842,6 +5281,8 @@ function createSystemFunctions(deps) {
             name: table.name,
             fullName,
             componentPath: targetComponent || undefined,
+            isSystem: table.isSystem,
+            visibility: table.visibility,
             documentCount,
             indexes: buildIndexList(exported?.indexes),
             searchIndexes: searchIndexes.map((idx) => typeof idx === "string" ? idx : idx.indexDescriptor),
@@ -4875,7 +5316,7 @@ function createSystemFunctions(deps) {
         }
         try {
           const fullName = getFullTableName(tableName, targetComponent);
-          const sampleDoc = await ctx.db.query(fullName).first();
+          const sampleDoc = await getTableQuery(ctx, fullName).first();
           const fields = sampleDoc ? Object.keys(sampleDoc).map((key) => ({
             name: key,
             type: typeof sampleDoc[key],
@@ -4910,7 +5351,7 @@ function createSystemFunctions(deps) {
       handler: async (ctx, args) => {
         requireSystemCapability("documents:read");
         const fullName = getFullTableName(args.tableName, args.componentPath ?? "");
-        let query2 = ctx.db.query(fullName);
+        let query2 = getTableQuery(ctx, fullName);
         if (args.orderBy && args.orderBy !== "_creationTime") {
           const allDocs2 = await query2.collect();
           const sorted = allDocs2.sort((a, b) => {
@@ -4961,7 +5402,7 @@ function createSystemFunctions(deps) {
       handler: async (ctx, args) => {
         requireSystemCapability("documents:write");
         const fullName = getFullTableName(args.tableName, args.componentPath ?? "");
-        const docs = await ctx.db.query(fullName).collect();
+        const docs = await getTableQuery(ctx, fullName).collect();
         for (const doc of docs) {
           await ctx.db.delete(doc._id);
         }
@@ -5257,6 +5698,83 @@ function resolveFunctionReference(functionPath, componentPath) {
   }
   return functionPath;
 }
+async function loadComponentRows(ctx) {
+  try {
+    const rows = await ctx.db.system.query("_components").collect();
+    if (rows.length > 0) {
+      return rows.map((row) => normalizeStoredComponentRow(row));
+    }
+  } catch {}
+  const modules = await listRegisteredModules();
+  const moduleCountByComponent = new Map;
+  const hasHttpByComponent = new Map;
+  const componentPaths = new Set([""]);
+  for (const module of modules) {
+    const componentPath = module.componentPath ?? "";
+    componentPaths.add(componentPath);
+    moduleCountByComponent.set(componentPath, (moduleCountByComponent.get(componentPath) ?? 0) + 1);
+    if (module.path === "http") {
+      hasHttpByComponent.set(componentPath, true);
+    }
+  }
+  return Array.from(componentPaths).map((componentPath) => ({
+    componentPath,
+    path: componentPath || "(root)",
+    isRoot: componentPath === "",
+    parentPath: componentPath === "" ? null : componentPath.includes("/") ? componentPath.split("/").slice(0, -1).join("/") : "",
+    depth: componentPath === "" ? 0 : componentPath.split("/").length,
+    moduleCount: moduleCountByComponent.get(componentPath) ?? 0,
+    childCount: 0,
+    functionCount: 0,
+    sourceType: "local",
+    hasHttp: hasHttpByComponent.get(componentPath) === true
+  }));
+}
+function normalizeStoredComponentRow(row) {
+  const componentPath = typeof row.componentPath === "string" ? row.componentPath : "";
+  return {
+    componentPath,
+    path: typeof row.displayPath === "string" ? row.displayPath : typeof row.path === "string" && row.path.length > 0 ? row.path : componentPath || "(root)",
+    isRoot: row.isRoot === true || componentPath === "",
+    parentPath: row.parentPath === null ? null : typeof row.parentPath === "string" ? row.parentPath : componentPath === "" ? null : "",
+    depth: typeof row.depth === "number" ? row.depth : componentPath === "" ? 0 : componentPath.split("/").length,
+    moduleCount: typeof row.moduleCount === "number" ? row.moduleCount : 0,
+    childCount: typeof row.childCount === "number" ? row.childCount : 0,
+    functionCount: 0,
+    sourceType: row.sourceType === "npm" ? "npm" : row.sourceType === "local" ? "local" : undefined,
+    sourcePath: typeof row.sourcePath === "string" ? row.sourcePath : undefined,
+    packageName: typeof row.packageName === "string" ? row.packageName : undefined,
+    packageVersion: typeof row.packageVersion === "string" ? row.packageVersion : undefined,
+    hasHttp: row.hasHttp === true
+  };
+}
+function sortComponentRows(rows) {
+  const childrenByParent = new Map;
+  for (const row of rows) {
+    const parentKey = row.parentPath ?? null;
+    const siblings = childrenByParent.get(parentKey) ?? [];
+    siblings.push(row);
+    childrenByParent.set(parentKey, siblings);
+  }
+  for (const siblings of childrenByParent.values()) {
+    siblings.sort((a, b) => {
+      if (a.isRoot)
+        return -1;
+      if (b.isRoot)
+        return 1;
+      return a.componentPath.localeCompare(b.componentPath);
+    });
+  }
+  const ordered = [];
+  const visit = (parentPath) => {
+    for (const row of childrenByParent.get(parentPath) ?? []) {
+      ordered.push(row);
+      visit(row.componentPath);
+    }
+  };
+  visit(null);
+  return ordered;
+}
 async function loadSchemaDefinition(componentPath) {
   try {
     const module = await loadConvexModule("schema", {
@@ -5290,15 +5808,28 @@ function extractTableMetadata(schema2, tableName) {
 }
 async function countDocuments(ctx, tableName) {
   try {
-    const documents = await ctx.db.query(tableName).collect();
+    const documents = await getTableQuery(ctx, tableName).collect();
     return documents.length;
   } catch (error) {
     console.warn(`Failed to count documents for table ${tableName}:`, error);
     return 0;
   }
 }
-function buildIndexList(indexes) {
-  const base = ["by_id", "by_creation_time"];
+function getTableQuery(ctx, fullTableName) {
+  const { tableName } = parseFullTableName(fullTableName);
+  if (isSystemTable(tableName)) {
+    return ctx.db.system.query(tableName);
+  }
+  return ctx.db.query(fullTableName);
+}
+function getDefaultSystemTableVisibility(tableName) {
+  if (!isSystemTable(tableName)) {
+    return "public";
+  }
+  return isPublicSystemTable(tableName) ? "public" : "private";
+}
+function buildIndexList(indexes) {
+  const base = ["by_id", "by_creation_time"];
   if (!indexes || indexes.length === 0) {
     return base;
   }
@@ -5398,6 +5929,7 @@ var init_internal = __esm(() => {
   init_interface();
   init_execution_log();
   init_auth();
+  init_system_tables();
 });
 
 // ../core/dist/system/system-functions-module.js
@@ -5555,8 +6087,9 @@ class ModuleRegistry {
             const normalized = normalizeModuleListing(listing);
             if (!normalized)
               continue;
-            if (!results.has(normalized.path)) {
-              results.set(normalized.path, {
+            const resultKey = `${normalized.componentPath ?? scope ?? ""}:${normalized.path}`;
+            if (!results.has(resultKey)) {
+              results.set(resultKey, {
                 ...normalized,
                 scope: scope || undefined,
                 componentPath: normalized.componentPath ?? (scope || undefined)
@@ -5875,8 +6408,10 @@ var init_module_loader = __esm(() => {
 class SchemaValidator {
   schemaCache = new Map;
   componentPath;
-  constructor(componentPath) {
+  tableRegistry;
+  constructor(componentPath, tableRegistry) {
     this.componentPath = componentPath;
+    this.tableRegistry = tableRegistry;
   }
   async loadTableSchema(tableName) {
     if (this.schemaCache.has(tableName)) {
@@ -5919,8 +6454,11 @@ class SchemaValidator {
       return;
     }
     try {
+      const tableNumberToName = this.tableRegistry ? new Map((await this.tableRegistry.listTables()).map((table) => [table.tableNumber, table.fullName])) : undefined;
       validateValidator(tableSchema, omit(document, ["_id", "_creationTime"]), "", {
-        componentPath: this.componentPath ?? ""
+        componentPath: this.componentPath ?? "",
+        tableRegistry: this.tableRegistry,
+        tableNumberToName
       });
     } catch (error) {
       throw new ValidatorError(`Failed to insert or update a document in table "${tableName}" because it does not match the schema: ${error.message}`);
@@ -6018,6 +6556,16 @@ Path: ${formatPath(path)}
 Value: ${formatValue(value)}
 Validator: v.id("${validator2.tableName}")`);
       }
+      if (isValidDocumentId(value)) {
+        const tableName2 = tableNameFromConvexId(value, options);
+        if (!tableName2 || !isMatchingValidatorTable(tableName2, validator2.tableName, options.componentPath)) {
+          throw new Error(`Value does not match validator.
+Path: ${formatPath(path)}
+Value: ${formatValue(value)}
+Validator: v.id("${validator2.tableName}")`);
+        }
+        return;
+      }
       const tableName = tableNameFromId(value);
       if (!tableName || !isMatchingValidatorTable(tableName, validator2.tableName, options.componentPath)) {
         throw new Error(`Value does not match validator.
@@ -6079,289 +6627,72 @@ Validator: v.object({...})`);
           }
         } else {
           const fieldPath = path ? `${path}.${k}` : `.${k}`;
-          validateValidator(fieldType, value[k], fieldPath, options);
-        }
-      }
-      for (const k of Object.keys(value)) {
-        if (validator2.value[k] === undefined) {
-          throw new Error(`Object contains extra field \`${k}\` that is not in the validator.
-
-Object: ${JSON.stringify(value)}
-Validator: v.object({...})`);
-        }
-      }
-      return;
-    }
-  }
-}
-function tableNameFromId(id) {
-  const parts = deserializeDeveloperId(id);
-  if (!parts) {
-    return null;
-  }
-  return hexToString(parts.table);
-}
-function isMatchingValidatorTable(idTableName, validatorTableName, componentPath) {
-  if (idTableName === validatorTableName) {
-    return true;
-  }
-  const { tableName: validatorBareName } = parseFullTableName(validatorTableName);
-  const { tableName: idBareName } = parseFullTableName(idTableName);
-  if (componentPath !== undefined) {
-    const expectedFullName = getFullTableName(validatorBareName, componentPath);
-    return idTableName === expectedFullName;
-  }
-  return idBareName === validatorBareName;
-}
-function isSimpleObject2(value) {
-  const isObject2 = typeof value === "object";
-  const prototype = Object.getPrototypeOf(value);
-  const isSimple = prototype === null || prototype === Object.prototype || prototype?.constructor?.name === "Object";
-  return isObject2 && isSimple;
-}
-var ValidatorError;
-var init_validator2 = __esm(() => {
-  init_interface();
-  init_module_loader();
-  ValidatorError = class ValidatorError extends Error {
-    path;
-    constructor(message2, path = "") {
-      super(message2);
-      this.path = path;
-      this.name = "ValidatorError";
-    }
-  };
-});
-
-// ../core/dist/id-codec/base32.js
-function base32Encode(data) {
-  if (data.length === 0)
-    return "";
-  let result = "";
-  let buffer = 0;
-  let bitsLeft = 0;
-  for (const byte of data) {
-    buffer = buffer << 8 | byte;
-    bitsLeft += 8;
-    while (bitsLeft >= 5) {
-      bitsLeft -= 5;
-      const index = buffer >> bitsLeft & 31;
-      result += ALPHABET[index];
-    }
-  }
-  if (bitsLeft > 0) {
-    const index = buffer << 5 - bitsLeft & 31;
-    result += ALPHABET[index];
-  }
-  return result;
-}
-function base32Decode(str) {
-  if (str.length === 0)
-    return new Uint8Array(0);
-  const outputLength = Math.floor(str.length * 5 / 8);
-  const result = new Uint8Array(outputLength);
-  let buffer = 0;
-  let bitsLeft = 0;
-  let outputIndex = 0;
-  for (const char of str) {
-    const value = ALPHABET_MAP.get(char);
-    if (value === undefined) {
-      throw new Error(`Invalid base32 character: ${char}`);
-    }
-    buffer = buffer << 5 | value;
-    bitsLeft += 5;
-    if (bitsLeft >= 8) {
-      bitsLeft -= 8;
-      result[outputIndex++] = buffer >> bitsLeft & 255;
-    }
-  }
-  return result;
-}
-function isValidBase32(str) {
-  for (const char of str) {
-    if (!ALPHABET_MAP.has(char)) {
-      return false;
-    }
-  }
-  return true;
-}
-var ALPHABET = "0123456789abcdefghjkmnpqrstvwxyz", ALPHABET_MAP;
-var init_base32 = __esm(() => {
-  ALPHABET_MAP = new Map;
-  for (let i2 = 0;i2 < ALPHABET.length; i2++) {
-    ALPHABET_MAP.set(ALPHABET[i2], i2);
-    ALPHABET_MAP.set(ALPHABET[i2].toUpperCase(), i2);
-  }
-  ALPHABET_MAP.set("i", 1);
-  ALPHABET_MAP.set("I", 1);
-  ALPHABET_MAP.set("l", 1);
-  ALPHABET_MAP.set("L", 1);
-  ALPHABET_MAP.set("o", 0);
-  ALPHABET_MAP.set("O", 0);
-});
-
-// ../core/dist/id-codec/vint.js
-function vintEncode(value) {
-  if (value < 0) {
-    throw new Error("VInt cannot encode negative numbers");
-  }
-  if (value > 4294967295) {
-    throw new Error("VInt cannot encode values larger than 2^32-1");
-  }
-  value = value >>> 0;
-  if (value < 128) {
-    return new Uint8Array([value]);
-  }
-  if (value < 16512) {
-    const adjusted2 = value - 128;
-    return new Uint8Array([128 | adjusted2 >> 8 & 63, adjusted2 & 255]);
-  }
-  if (value < 2113664) {
-    const adjusted2 = value - 16512;
-    return new Uint8Array([192 | adjusted2 >> 16 & 31, adjusted2 >> 8 & 255, adjusted2 & 255]);
-  }
-  if (value < 270549120) {
-    const adjusted2 = value - 2113664;
-    return new Uint8Array([
-      224 | adjusted2 >> 24 & 15,
-      adjusted2 >> 16 & 255,
-      adjusted2 >> 8 & 255,
-      adjusted2 & 255
-    ]);
-  }
-  const adjusted = value - 270549120;
-  return new Uint8Array([
-    240 | adjusted >> 32 & 7,
-    adjusted >> 24 & 255,
-    adjusted >> 16 & 255,
-    adjusted >> 8 & 255,
-    adjusted & 255
-  ]);
-}
-function vintDecode(data, offset = 0) {
-  if (offset >= data.length) {
-    throw new Error("VInt decode: unexpected end of data");
-  }
-  const first = data[offset];
-  if ((first & 128) === 0) {
-    return { value: first, bytesRead: 1 };
-  }
-  if ((first & 192) === 128) {
-    if (offset + 1 >= data.length) {
-      throw new Error("VInt decode: truncated 2-byte encoding");
-    }
-    const value = 128 + ((first & 63) << 8 | data[offset + 1]);
-    return { value, bytesRead: 2 };
-  }
-  if ((first & 224) === 192) {
-    if (offset + 2 >= data.length) {
-      throw new Error("VInt decode: truncated 3-byte encoding");
-    }
-    const value = 16512 + ((first & 31) << 16 | data[offset + 1] << 8 | data[offset + 2]);
-    return { value, bytesRead: 3 };
-  }
-  if ((first & 240) === 224) {
-    if (offset + 3 >= data.length) {
-      throw new Error("VInt decode: truncated 4-byte encoding");
-    }
-    const value = 2113664 + ((first & 15) << 24 | data[offset + 1] << 16 | data[offset + 2] << 8 | data[offset + 3]);
-    return { value: value >>> 0, bytesRead: 4 };
-  }
-  if ((first & 248) === 240) {
-    if (offset + 4 >= data.length) {
-      throw new Error("VInt decode: truncated 5-byte encoding");
-    }
-    const high = first & 7;
-    const low = (data[offset + 1] << 24 | data[offset + 2] << 16 | data[offset + 3] << 8 | data[offset + 4]) >>> 0;
-    const value = 270549120 + high * 4294967296 + low;
-    return { value: value >>> 0, bytesRead: 5 };
-  }
-  throw new Error("VInt decode: invalid prefix");
-}
-
-// ../core/dist/id-codec/fletcher16.js
-function fletcher16(data) {
-  let sum1 = 0;
-  let sum2 = 0;
-  for (const byte of data) {
-    sum1 = (sum1 + byte) % 255;
-    sum2 = (sum2 + sum1) % 255;
-  }
-  return new Uint8Array([sum1, sum2]);
-}
-function verifyFletcher16(data, checksum) {
-  if (checksum.length !== 2)
-    return false;
-  const computed = fletcher16(data);
-  return computed[0] === checksum[0] && computed[1] === checksum[1];
-}
-
-// ../core/dist/utils/crypto.js
-var weakRandomState;
-var init_crypto = __esm(() => {
-  weakRandomState = (Date.now() ^ 2654435769) >>> 0;
-});
-
-// ../core/dist/id-codec/document-id.js
-function encodeDocumentId(tableNumber, internalId) {
-  if (internalId.length !== INTERNAL_ID_LENGTH) {
-    throw new Error(`Internal ID must be exactly ${INTERNAL_ID_LENGTH} bytes, got ${internalId.length}`);
-  }
-  if (tableNumber < 1 || tableNumber > 4294967295) {
-    throw new Error(`Table number must be between 1 and 2^32-1, got ${tableNumber}`);
-  }
-  const tableBytes = vintEncode(tableNumber);
-  const payload = new Uint8Array(tableBytes.length + INTERNAL_ID_LENGTH);
-  payload.set(tableBytes, 0);
-  payload.set(internalId, tableBytes.length);
-  const checksum = fletcher16(payload);
-  const final = new Uint8Array(payload.length + 2);
-  final.set(payload, 0);
-  final.set(checksum, payload.length);
-  return base32Encode(final);
-}
-function decodeDocumentId(encoded) {
-  if (encoded.length < MIN_ENCODED_LENGTH || encoded.length > MAX_ENCODED_LENGTH) {
-    throw new Error(`Invalid document ID length: ${encoded.length} (expected ${MIN_ENCODED_LENGTH}-${MAX_ENCODED_LENGTH})`);
-  }
-  if (!isValidBase32(encoded)) {
-    throw new Error("Invalid document ID: contains invalid base32 characters");
-  }
-  const bytes = base32Decode(encoded);
-  if (bytes.length < 19) {
-    throw new Error(`Invalid document ID: decoded to ${bytes.length} bytes (minimum 19)`);
-  }
-  const checksum = bytes.slice(bytes.length - 2);
-  const payload = bytes.slice(0, bytes.length - 2);
-  if (!verifyFletcher16(payload, checksum)) {
-    throw new Error("Invalid document ID: checksum verification failed");
+          validateValidator(fieldType, value[k], fieldPath, options);
+        }
+      }
+      for (const k of Object.keys(value)) {
+        if (validator2.value[k] === undefined) {
+          throw new Error(`Object contains extra field \`${k}\` that is not in the validator.
+
+Object: ${JSON.stringify(value)}
+Validator: v.object({...})`);
+        }
+      }
+      return;
+    }
   }
-  const { value: tableNumber, bytesRead } = vintDecode(payload, 0);
-  const internalId = payload.slice(bytesRead, bytesRead + INTERNAL_ID_LENGTH);
-  if (internalId.length !== INTERNAL_ID_LENGTH) {
-    throw new Error(`Invalid document ID: internal ID is ${internalId.length} bytes (expected ${INTERNAL_ID_LENGTH})`);
+}
+function tableNameFromId(id) {
+  const parts = deserializeDeveloperId(id);
+  if (!parts) {
+    return null;
   }
-  return { tableNumber, internalId };
+  return hexToString(parts.table);
 }
-function isValidDocumentId(encoded) {
+function tableNameFromConvexId(id, options) {
   try {
-    decodeDocumentId(encoded);
-    return true;
+    const decoded = decodeDocumentId(id);
+    const fromMap = options.tableNumberToName?.get(decoded.tableNumber);
+    if (fromMap) {
+      return fromMap;
+    }
+    return null;
   } catch {
-    return false;
+    return null;
   }
 }
-function internalIdToHex(internalId) {
-  let hex = "";
-  for (let i2 = 0;i2 < internalId.length; i2++) {
-    hex += internalId[i2].toString(16).padStart(2, "0");
+function isMatchingValidatorTable(idTableName, validatorTableName, componentPath) {
+  if (idTableName === validatorTableName) {
+    return true;
   }
-  return hex;
+  const { tableName: validatorBareName } = parseFullTableName(validatorTableName);
+  const { tableName: idBareName } = parseFullTableName(idTableName);
+  if (componentPath !== undefined) {
+    const expectedFullName = getFullTableName(validatorBareName, componentPath);
+    return idTableName === expectedFullName;
+  }
+  return idBareName === validatorBareName;
 }
-var INTERNAL_ID_LENGTH = 16, MIN_ENCODED_LENGTH = 31, MAX_ENCODED_LENGTH = 37;
-var init_document_id = __esm(() => {
-  init_base32();
-  init_crypto();
+function isSimpleObject2(value) {
+  const isObject2 = typeof value === "object";
+  const prototype = Object.getPrototypeOf(value);
+  const isSimple = prototype === null || prototype === Object.prototype || prototype?.constructor?.name === "Object";
+  return isObject2 && isSimple;
+}
+var ValidatorError;
+var init_validator2 = __esm(() => {
+  init_utils();
+  init_interface();
+  init_module_loader();
+  init_id_codec();
+  ValidatorError = class ValidatorError extends Error {
+    path;
+    constructor(message2, path = "") {
+      super(message2);
+      this.path = path;
+      this.name = "ValidatorError";
+    }
+  };
 });
 
 // src/sqlite-docstore.ts
@@ -6372,7 +6703,10 @@ init_values();
 
 // ../core/dist/docstore/interface.js
 function documentIdKey(id) {
-  const tableKey = id.table && id.table.length > 0 ? id.table : id.tableNumber !== undefined && Number.isInteger(id.tableNumber) && id.tableNumber > 0 ? `#${id.tableNumber}` : id.table;
+  const tableKey = id.table && id.table.length > 0 ? id.table : id.tableNumber !== undefined && Number.isInteger(id.tableNumber) && id.tableNumber > 0 ? `#${id.tableNumber}` : null;
+  if (!tableKey) {
+    throw new Error("Invalid document ID: missing table and tableNumber");
+  }
   return `${tableKey}:${id.internalId}`;
 }
 var Order;
@@ -6579,6 +6913,7 @@ class TimestampOracle {
   }
 }
 // ../core/dist/utils/keyspace.js
+init_utils();
 var TABLE_PREFIX = "table";
 var INDEX_PREFIX = "index";
 function encodeComponent(component) {
@@ -6619,6 +6954,13 @@ function decodeIndexId(indexId) {
     index: decoded.slice(separatorIndex + 1)
   };
 }
+
+// ../core/dist/utils/index.js
+init_utils();
+
+// ../core/dist/queryengine/indexing/index-manager.js
+init_utils();
+
 // ../core/dist/queryengine/indexing/index-key-codec.js
 var TypeTag;
 (function(TypeTag2) {
@@ -6668,8 +7010,9 @@ function encodeBigInt(n) {
   return bytes;
 }
 function encodeString(s) {
-  const encoder = new TextEncoder;
-  const raw = encoder.encode(s);
+  return encodeEscapedBytes(new TextEncoder().encode(s));
+}
+function encodeEscapedBytes(raw) {
   let nullCount = 0;
   for (const byte of raw) {
     if (byte === 0)
@@ -6733,11 +7076,10 @@ function encodeValue(value) {
   }
   if (value instanceof ArrayBuffer || value instanceof Uint8Array) {
     const bytes = value instanceof Uint8Array ? value : new Uint8Array(value);
-    const result = new Uint8Array(1 + bytes.length + 2);
+    const encoded = encodeEscapedBytes(bytes);
+    const result = new Uint8Array(1 + encoded.length);
     result[0] = TypeTag.Bytes;
-    result.set(bytes, 1);
-    result[result.length - 2] = 0;
-    result[result.length - 1] = 0;
+    result.set(encoded, 1);
     return result;
   }
   throw new Error(`Cannot encode value of type ${typeof value} in index key`);
@@ -6854,9 +7196,11 @@ class SchemaService {
   tableCache = new Map;
   schemaValidator;
   componentPath;
-  constructor(componentPath) {
+  tableRegistry;
+  constructor(componentPath, tableRegistry) {
     this.componentPath = componentPath;
-    this.schemaValidator = new SchemaValidator(componentPath);
+    this.tableRegistry = tableRegistry;
+    this.schemaValidator = new SchemaValidator(componentPath, tableRegistry);
   }
   async validate(tableName, document) {
     try {
@@ -6981,6 +7325,10 @@ class SchemaService {
     return this.cachedSchemaDefinition;
   }
 }
+
+// ../core/dist/queryengine/index-query.js
+init_utils();
+
 // ../core/dist/observability/udf-trace.js
 init_context_storage();
 var TRACE_CONTEXT = new ContextStorage;
@@ -7224,11 +7572,10 @@ function evaluateFieldPath(fieldPath, document) {
   }
   return current;
 }
-// ../core/dist/id-codec/index.js
-init_base32();
-init_document_id();
 
 // ../core/dist/queryengine/developer-id.js
+init_utils();
+init_id_codec();
 function parseDeveloperId(developerId) {
   if (isValidDocumentId(developerId)) {
     try {
@@ -7246,6 +7593,25 @@ function parseDeveloperId(developerId) {
   }
   return { table: parts.table, internalId: parts.internalId };
 }
+async function parseDeveloperIdWithTableRegistry(developerId, tableRegistry) {
+  if (isValidDocumentId(developerId)) {
+    try {
+      const decoded = decodeDocumentId(developerId);
+      const tableInfo = await tableRegistry.getTableInfo(decoded.tableNumber);
+      if (!tableInfo) {
+        return null;
+      }
+      return {
+        table: stringToHex(tableInfo.fullName),
+        internalId: internalIdToHex(decoded.internalId),
+        tableNumber: decoded.tableNumber
+      };
+    } catch {
+      return null;
+    }
+  }
+  return parseDeveloperId(developerId);
+}
 function parseStorageId(storageId) {
   const parsed = parseDeveloperId(storageId);
   if (parsed) {
@@ -7262,12 +7628,21 @@ function parseStorageId(storageId) {
 function isTablePlaceholder(table) {
   return table.startsWith("#");
 }
+
+// ../core/dist/query/query-runtime.js
+init_utils();
+
 // ../core/dist/query/planner.js
 init_interface();
+init_utils();
+
 // ../core/dist/query/actions.js
+init_utils();
 init_interface();
 
 // ../core/dist/queryengine/indexing/read-write-set.js
+init_utils();
+
 class RangeSet {
   ranges = new Map;
   addDocument(docId) {
@@ -7378,6 +7753,8 @@ function deserializeKeyRange(serialized) {
 }
 
 // ../core/dist/kernel/access-log.js
+init_utils();
+
 class AccessLog {
   ranges = new RangeSet;
   addDocument(docId) {
@@ -7402,104 +7779,9 @@ class AccessLog {
   }
 }
 
-// ../core/dist/tables/memory-table-registry.js
+// ../core/dist/kernel/kernel-context.js
 init_interface();
 
-class MemoryTableRegistry {
-  tablesByName = new Map;
-  tablesByNumber = new Map;
-  nextTableNumber = FIRST_USER_TABLE_NUMBER;
-  constructor() {
-    this.registerSystemTables();
-  }
-  registerSystemTables() {
-    for (const [name, number] of Object.entries(SYSTEM_TABLE_NUMBERS)) {
-      const info = {
-        tableNumber: number,
-        name,
-        componentPath: "",
-        fullName: name,
-        isSystem: true,
-        createdAt: Date.now()
-      };
-      this.tablesByName.set(name, info);
-      this.tablesByNumber.set(number, info);
-    }
-  }
-  async getOrAllocateTableNumber(tableName, componentPath = "") {
-    const fullName = getFullTableName(tableName, componentPath);
-    const existing = this.tablesByName.get(fullName);
-    if (existing) {
-      return existing.tableNumber;
-    }
-    if (isSystemTable(tableName) && componentPath === "") {
-      const systemNumber = SYSTEM_TABLE_NUMBERS[tableName];
-      if (systemNumber !== undefined) {
-        return systemNumber;
-      }
-    }
-    const tableNumber = this.nextTableNumber++;
-    const info = {
-      tableNumber,
-      name: tableName,
-      componentPath,
-      fullName,
-      isSystem: false,
-      createdAt: Date.now()
-    };
-    this.tablesByName.set(fullName, info);
-    this.tablesByNumber.set(tableNumber, info);
-    return tableNumber;
-  }
-  async getTableInfo(tableNumber) {
-    return this.tablesByNumber.get(tableNumber) ?? null;
-  }
-  async getTableInfoByName(tableName, componentPath = "") {
-    const fullName = getFullTableName(tableName, componentPath);
-    return this.tablesByName.get(fullName) ?? null;
-  }
-  async listTables(componentPath) {
-    const tables = Array.from(this.tablesByNumber.values());
-    if (componentPath === undefined) {
-      return tables;
-    }
-    return tables.filter((t) => t.componentPath === componentPath);
-  }
-  async hasAccess(tableNumber, componentPath) {
-    const info = await this.getTableInfo(tableNumber);
-    if (!info) {
-      return false;
-    }
-    if (info.isSystem) {
-      return true;
-    }
-    return info.componentPath === componentPath;
-  }
-  getSystemTableNumber(systemTableName) {
-    return SYSTEM_TABLE_NUMBERS[systemTableName];
-  }
-  reset() {
-    this.tablesByName.clear();
-    this.tablesByNumber.clear();
-    this.nextTableNumber = FIRST_USER_TABLE_NUMBER;
-    this.registerSystemTables();
-  }
-  getState() {
-    return {
-      tableCount: this.tablesByNumber.size,
-      nextNumber: this.nextTableNumber
-    };
-  }
-}
-var globalRegistry = null;
-function getGlobalTableRegistry() {
-  if (!globalRegistry) {
-    globalRegistry = new MemoryTableRegistry;
-  }
-  return globalRegistry;
-}
-
-// ../core/dist/kernel/kernel-context.js
 class KernelContext {
   authContext;
   componentPath;
@@ -7516,11 +7798,14 @@ class KernelContext {
     this.authContext = options.authContext;
     this.componentPath = options.componentPath ?? "";
     this.mutationTransaction = options.mutationTransaction;
-    this.tableRegistry = options.tableRegistry ?? getGlobalTableRegistry();
-    this.useConvexIdFormat = options.useConvexIdFormat ?? false;
+    if (!options.tableRegistry) {
+      throw new Error("KernelContext requires an explicit tableRegistry");
+    }
+    this.tableRegistry = options.tableRegistry;
+    this.useConvexIdFormat = options.useConvexIdFormat ?? true;
   }
   async getTableNumber(tableName) {
-    return this.tableRegistry.getOrAllocateTableNumber(tableName, this.componentPath);
+    return this.tableRegistry.getOrAllocateTableNumber(tableName, isSystemTable(tableName) ? "" : this.componentPath);
   }
   nextSubrequestId(prefix, udfPath) {
     return `${prefix}:${udfPath}:${Date.now()}:${Math.random()}:${this.subrequestCounter++}`;
@@ -7565,7 +7850,7 @@ class KernelContext {
     this.writeLog.addDocument(docId);
   }
   recordLocalWrite(developerId, tableName, value, docId) {
-    this.localWrites.set(developerId, { table: tableName, value });
+    this.localWrites.set(developerId, { table: tableName, value, docId });
     if (docId) {
       this.recordDocumentWrite(docId);
       return;
@@ -7607,7 +7892,13 @@ class KernelContext {
   }
 }
 
+// ../core/dist/kernel/udf-kernel.js
+init_id_codec();
+
 // ../core/dist/kernel/blob-store-gateway.js
+init_id_codec();
+init_utils();
+
 class BlobStoreGateway {
   context;
   docStore;
@@ -7656,7 +7947,7 @@ class BlobStoreGateway {
     if (!this.storage) {
       return null;
     }
-    const docId = parseStorageId(storageId);
+    const docId = await parseDeveloperIdWithTableRegistry(storageId, this.context.tableRegistry) ?? parseStorageId(storageId);
     if (!docId) {
       console.debug(`[BlobStoreGateway] Failed to parse storage ID: ${storageId}`);
       return null;
@@ -7677,7 +7968,7 @@ class BlobStoreGateway {
     if (!this.storage) {
       return null;
     }
-    const docId = parseStorageId(storageId);
+    const docId = await parseDeveloperIdWithTableRegistry(storageId, this.context.tableRegistry) ?? parseStorageId(storageId);
     if (!docId) {
       return null;
     }
@@ -7690,7 +7981,7 @@ class BlobStoreGateway {
   }
   async delete(storageId) {
     const storage2 = this.requireStorage();
-    const docId = parseStorageId(storageId);
+    const docId = await parseDeveloperIdWithTableRegistry(storageId, this.context.tableRegistry) ?? parseStorageId(storageId);
     if (!docId) {
       return;
     }
@@ -7715,13 +8006,17 @@ class BlobStoreGateway {
 
 // ../core/dist/kernel/scheduler-gateway.js
 init_values();
+init_id_codec();
+init_utils();
+
 // ../core/dist/kernel/syscalls/utils.js
 init_values();
+init_utils();
 async function resolveTableName(docId, tableRegistry) {
   if (docId.tableNumber !== undefined) {
     const info = await tableRegistry.getTableInfo(docId.tableNumber);
     if (info) {
-      return info.name;
+      return info.fullName;
     }
     if (!isTablePlaceholder(docId.table)) {
       return hexToString(docId.table);
@@ -7902,7 +8197,7 @@ class SchedulerGateway {
     return developerId;
   }
   async cancel(id, state) {
-    const docId = parseDeveloperId(id);
+    const docId = await parseDeveloperIdWithTableRegistry(id, this.context.tableRegistry);
     if (!docId) {
       throw new Error(`Scheduled job with id ${id} not found.`);
     }
@@ -8027,6 +8322,8 @@ class ActionSyscalls {
 
 // ../core/dist/kernel/syscalls/database-syscalls.js
 init_values();
+init_id_codec();
+init_utils();
 init_interface();
 
 class DatabaseSyscalls {
@@ -8063,7 +8360,8 @@ class DatabaseSyscalls {
     if (docId.tableNumber !== undefined) {
       return { id: idString };
     }
-    if (docId.table === stringToHex(tableName)) {
+    const expectedFullTableName = getFullTableName(tableName, isSystemTable(tableName) ? "" : this.context.componentPath);
+    if (docId.table === stringToHex(expectedFullTableName)) {
       return { id: idString };
     }
     return { id: null };
@@ -8122,29 +8420,28 @@ class DatabaseSyscalls {
     return { _id: developerId };
   }
   async handleGet(args) {
-    const { id } = args;
+    const { id, table } = args;
     if (typeof id !== "string") {
       throw new Error("`id` argument for `get` must be a string.");
     }
-    const internalId = parseDeveloperId(id);
-    if (!internalId) {
+    const resolved = await this.resolveDocumentTarget(id, table, "get");
+    if (!resolved) {
       return null;
     }
-    this.context.recordDocumentRead(internalId);
-    const doc = await this.queryRuntime.getVisibleDocumentById(id, internalId);
+    this.context.recordDocumentRead(resolved.docId);
+    const doc = await this.queryRuntime.getVisibleDocumentById(id, resolved.docId);
     return doc ?? null;
   }
   async handleRemove(args) {
-    const { id } = args;
+    const { id, table } = args;
     if (typeof id !== "string") {
       throw new Error("`id` argument for `remove` must be a string.");
     }
-    const docId = parseDeveloperId(id);
-    if (!docId) {
+    const resolved = await this.resolveDocumentTarget(id, table, "remove", true);
+    if (!resolved) {
       throw new Error(`Document with id ${id} not found.`);
     }
-    const fullTableName = await resolveTableName(docId, this.context.tableRegistry);
-    const { tableName: bareTableName } = parseFullTableName(fullTableName);
+    const { docId, fullTableName, bareTableName } = resolved;
     const latest = await this.docStore.fetchLatestDocument(docId, this.context.snapshotTimestamp);
     if (!latest) {
       throw new Error(`Document with id ${id} not found.`);
@@ -8160,16 +8457,15 @@ class DatabaseSyscalls {
     return {};
   }
   async handleShallowMerge(args) {
-    const { id, value } = args;
+    const { id, table, value } = args;
     if (typeof id !== "string") {
       throw new Error("`id` argument for `shallowMerge` must be a string.");
     }
-    const docId = parseDeveloperId(id);
-    if (!docId) {
+    const resolved = await this.resolveDocumentTarget(id, table, "patch", true);
+    if (!resolved) {
       throw new Error(`Document with id ${id} not found.`);
     }
-    const fullTableName = await resolveTableName(docId, this.context.tableRegistry);
-    const { tableName: bareTableName } = parseFullTableName(fullTableName);
+    const { docId, fullTableName, bareTableName } = resolved;
     if (value && typeof value === "object") {
       if ("_id" in value) {
         throw new Error("System field `_id` cannot be modified in a patch operation.");
@@ -8220,16 +8516,15 @@ class DatabaseSyscalls {
     return {};
   }
   async handleReplace(args) {
-    const { id, value } = args;
+    const { id, table, value } = args;
     if (typeof id !== "string") {
       throw new Error("`id` argument for `replace` must be a string.");
     }
-    const docId = parseDeveloperId(id);
-    if (!docId) {
+    const resolved = await this.resolveDocumentTarget(id, table, "replace", true);
+    if (!resolved) {
       throw new Error(`Document with id ${id} not found.`);
     }
-    const fullTableName = await resolveTableName(docId, this.context.tableRegistry);
-    const { tableName: bareTableName } = parseFullTableName(fullTableName);
+    const { docId, fullTableName, bareTableName } = resolved;
     const replaceValue = jsonToConvex(value);
     if (typeof replaceValue !== "object" || replaceValue === null || Array.isArray(replaceValue)) {
       throw new Error("The replacement value for `replace` must be an object.");
@@ -8252,6 +8547,27 @@ class DatabaseSyscalls {
     this.context.recordLocalWrite(id, fullTableName, newValue, canonicalDocId);
     return {};
   }
+  async resolveDocumentTarget(id, table, operation, throwOnMismatch = false) {
+    if (table !== undefined && typeof table !== "string") {
+      throw new Error(`\`table\` argument for \`${operation}\` must be a string.`);
+    }
+    const docId = await parseDeveloperIdWithTableRegistry(id, this.context.tableRegistry);
+    if (!docId) {
+      return null;
+    }
+    const fullTableName = await resolveTableName(docId, this.context.tableRegistry);
+    if (typeof table === "string") {
+      const expectedFullTableName = getFullTableName(table, isSystemTable(table) ? "" : this.context.componentPath);
+      if (fullTableName !== expectedFullTableName) {
+        if (throwOnMismatch) {
+          throw new Error(`Document with id ${id} does not belong to table ${table}.`);
+        }
+        return null;
+      }
+    }
+    const { tableName: bareTableName } = parseFullTableName(fullTableName);
+    return { docId, fullTableName, bareTableName };
+  }
 }
 
 // ../core/dist/kernel/syscalls/identity-syscalls.js
@@ -8567,11 +8883,203 @@ class KernelSyscalls {
     return this.jsRouter.dispatch(op, args);
   }
 }
+
+// ../core/dist/tables/docstore-table-registry.js
+init_system_tables();
+init_utils();
+init_interface();
+
+class DocStoreTableRegistry {
+  docstore;
+  tablesByNumber = new Map;
+  tablesByName = new Map;
+  loadPromise = null;
+  cachedRegistryVersion = 0;
+  constructor(docstore) {
+    this.docstore = docstore;
+  }
+  async getOrAllocateTableNumber(tableName, componentPath = "") {
+    await this.ensureLoaded();
+    await this.ensureFresh();
+    const normalizedComponent = isSystemTable(tableName) ? "" : componentPath;
+    const fullName = getFullTableName(tableName, normalizedComponent);
+    let existing = this.tablesByName.get(fullName);
+    if (existing) {
+      return existing.tableNumber;
+    }
+    await this.reloadTables();
+    existing = this.tablesByName.get(fullName);
+    if (existing) {
+      return existing.tableNumber;
+    }
+    const oracle = this.docstore.timestampOracle;
+    for (;; ) {
+      const metadata = await readSystemMetadata(this.docstore) ?? createSystemMetadata({
+        nextUserTableNumber: Math.max(FIRST_USER_TABLE_NUMBER, nextUserTableNumber(this.tablesByNumber.values()))
+      });
+      const candidate = Math.max(metadata.nextUserTableNumber, nextUserTableNumber(this.tablesByNumber.values()));
+      const reserved = await this.docstore.writeGlobalIfAbsent(createTableNumberReservationKey(candidate), {
+        fullName,
+        reservedAt: Date.now()
+      });
+      if (!reserved) {
+        await this.reloadTables();
+        const raced = this.tablesByName.get(fullName);
+        if (raced) {
+          return raced.tableNumber;
+        }
+        continue;
+      }
+      const createdAt = Date.now();
+      const info = createTableInfo(tableName, candidate, normalizedComponent, { createdAt, visibility: "public" });
+      const timestamp2 = oracle?.allocateTimestamp?.() ?? BigInt(createdAt);
+      const entry = createTableMetadataEntryForUserTable(info, timestamp2);
+      try {
+        await this.docstore.write([entry], new Set, "Error");
+      } catch {
+        await this.reloadTables();
+        const raced = this.tablesByName.get(fullName);
+        if (raced) {
+          return raced.tableNumber;
+        }
+        throw new Error(`Failed to allocate table number for ${fullName}`);
+      }
+      const registryVersion = Number(timestamp2 > BigInt(Number.MAX_SAFE_INTEGER) ? BigInt(Date.now()) : timestamp2);
+      await this.docstore.writeGlobal(SYSTEM_METADATA_GLOBAL_KEY, createSystemMetadata({
+        nextUserTableNumber: candidate + 1,
+        registryVersion,
+        bootstrappedAt: metadata.bootstrappedAt,
+        updatedAt: registryVersion
+      }));
+      this.cachedRegistryVersion = registryVersion;
+      this.tablesByName.set(fullName, info);
+      this.tablesByNumber.set(candidate, info);
+      return candidate;
+    }
+  }
+  async getTableInfo(tableNumber) {
+    await this.ensureLoaded();
+    await this.ensureFresh();
+    const existing = this.tablesByNumber.get(tableNumber);
+    if (existing) {
+      return existing;
+    }
+    await this.reloadTables();
+    return this.tablesByNumber.get(tableNumber) ?? null;
+  }
+  async getTableInfoByName(tableName, componentPath = "") {
+    await this.ensureLoaded();
+    await this.ensureFresh();
+    const fullName = getFullTableName(tableName, isSystemTable(tableName) ? "" : componentPath);
+    const existing = this.tablesByName.get(fullName);
+    if (existing) {
+      return existing;
+    }
+    await this.reloadTables();
+    return this.tablesByName.get(fullName) ?? null;
+  }
+  async listTables(componentPath) {
+    await this.ensureLoaded();
+    await this.ensureFresh();
+    const values = Array.from(this.tablesByNumber.values());
+    if (componentPath === undefined) {
+      return values.sort((a, b) => a.tableNumber - b.tableNumber);
+    }
+    return values.filter((table) => table.componentPath === componentPath).sort((a, b) => a.tableNumber - b.tableNumber);
+  }
+  async hasAccess(tableNumber, componentPath) {
+    const info = await this.getTableInfo(tableNumber);
+    if (!info) {
+      return false;
+    }
+    if (info.isSystem) {
+      return true;
+    }
+    return info.componentPath === componentPath;
+  }
+  getSystemTableNumber(systemTableName) {
+    return SYSTEM_TABLE_NUMBERS[systemTableName];
+  }
+  async ensureLoaded() {
+    if (!this.loadPromise) {
+      this.loadPromise = this.loadTables();
+    }
+    await this.loadPromise;
+  }
+  async ensureFresh() {
+    const metadata = await readSystemMetadata(this.docstore);
+    if (!metadata) {
+      if (this.cachedRegistryVersion !== 0 || this.tablesByName.size > 0 || this.tablesByNumber.size > 0) {
+        await this.reloadTables();
+      }
+      return;
+    }
+    if (metadata.registryVersion > this.cachedRegistryVersion) {
+      await this.reloadTables();
+    }
+  }
+  async reloadTables() {
+    this.loadPromise = this.loadTables();
+    await this.loadPromise;
+  }
+  async loadTables() {
+    await ensureSystemTablesBootstrapped(this.docstore);
+    const docs = await this.docstore.scan(stringToHex("_tables"));
+    this.tablesByName.clear();
+    this.tablesByNumber.clear();
+    for (const doc of docs) {
+      const info = tableInfoFromStoredDocument(doc.value.value);
+      if (!info) {
+        continue;
+      }
+      this.tablesByName.set(info.fullName, info);
+      this.tablesByNumber.set(info.tableNumber, info);
+    }
+    if (this.tablesByNumber.size === 0) {
+      for (const [name, tableNumber] of Object.entries(SYSTEM_TABLE_NUMBERS)) {
+        const info = createTableInfo(name, tableNumber, "", { isSystem: true });
+        this.tablesByName.set(info.fullName, info);
+        this.tablesByNumber.set(info.tableNumber, info);
+      }
+    }
+    const metadata = await readSystemMetadata(this.docstore);
+    if (!metadata) {
+      const now = Date.now();
+      this.cachedRegistryVersion = now;
+      await this.docstore.writeGlobal(SYSTEM_METADATA_GLOBAL_KEY, createSystemMetadata({
+        nextUserTableNumber: Math.max(FIRST_USER_TABLE_NUMBER, nextUserTableNumber(this.tablesByNumber.values())),
+        registryVersion: now,
+        bootstrappedAt: now,
+        updatedAt: now
+      }));
+    } else {
+      this.cachedRegistryVersion = metadata.registryVersion;
+    }
+  }
+}
+
+// ../core/dist/tables/transactional-table-registry.js
+init_system_tables();
+init_utils();
+init_interface();
 // ../core/dist/kernel/contexts.js
 init_context_storage();
-var snapshotContext = new ContextStorage;
-var transactionContext = new ContextStorage;
-var idGeneratorContext = new ContextStorage;
+var SNAPSHOT_CONTEXT_SYMBOL = Symbol.for("@concavejs/core/snapshot-context");
+var TRANSACTION_CONTEXT_SYMBOL = Symbol.for("@concavejs/core/transaction-context");
+var ID_GENERATOR_CONTEXT_SYMBOL = Symbol.for("@concavejs/core/id-generator-context");
+var globalContexts = globalThis;
+var snapshotContext = globalContexts[SNAPSHOT_CONTEXT_SYMBOL] ?? new ContextStorage;
+var transactionContext = globalContexts[TRANSACTION_CONTEXT_SYMBOL] ?? new ContextStorage;
+var idGeneratorContext = globalContexts[ID_GENERATOR_CONTEXT_SYMBOL] ?? new ContextStorage;
+if (!globalContexts[SNAPSHOT_CONTEXT_SYMBOL]) {
+  globalContexts[SNAPSHOT_CONTEXT_SYMBOL] = snapshotContext;
+}
+if (!globalContexts[TRANSACTION_CONTEXT_SYMBOL]) {
+  globalContexts[TRANSACTION_CONTEXT_SYMBOL] = transactionContext;
+}
+if (!globalContexts[ID_GENERATOR_CONTEXT_SYMBOL]) {
+  globalContexts[ID_GENERATOR_CONTEXT_SYMBOL] = idGeneratorContext;
+}
 // ../core/dist/queryengine/convex-ops.js
 var debug = () => {};
 class CfConvex {
@@ -8624,6 +9132,8 @@ class BaseSqliteDocStore {
   vectorIndexesByTable = new Map;
   fts5Available = true;
   statementCache = new Map;
+  configuredSearchIndexes = [];
+  configuredVectorIndexes = [];
   constructor(adapter) {
     this.adapter = adapter;
     this.timestampOracle = new TimestampOracle;
@@ -8638,6 +9148,8 @@ class BaseSqliteDocStore {
     return statement;
   }
   async setupSchema(options) {
+    this.configuredSearchIndexes = [...options?.searchIndexes ?? []];
+    this.configuredVectorIndexes = [...options?.vectorIndexes ?? []];
     await this.adapter.exec(DOCUMENTS_TABLE_SCHEMA);
     await this.adapter.exec(DOCUMENTS_BY_TABLE_INDEX);
     await this.adapter.exec(INDEXES_TABLE_SCHEMA);
@@ -8645,6 +9157,24 @@ class BaseSqliteDocStore {
     await this.setupSearchIndexes(options?.searchIndexes ?? []);
     await this.setupVectorIndexes(options?.vectorIndexes ?? []);
   }
+  async resetForTesting() {
+    const rows = await this.adapter.prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name NOT LIKE 'sqlite_%' AND sql IS NOT NULL").all();
+    for (const row of rows) {
+      const tableName = row?.name;
+      if (typeof tableName !== "string" || tableName.length === 0) {
+        continue;
+      }
+      await this.adapter.exec(`DROP TABLE IF EXISTS ${quoteSqlIdentifier(tableName)}`);
+    }
+    this.statementCache.clear();
+    this.searchIndexesByTable.clear();
+    this.vectorIndexesByTable.clear();
+    this.fts5Available = true;
+    await this.setupSchema({
+      searchIndexes: this.configuredSearchIndexes,
+      vectorIndexes: this.configuredVectorIndexes
+    });
+  }
   async setupSearchIndexes(searchIndexes) {
     try {
       await this.adapter.exec(SEARCH_INDEXES_FTS_SCHEMA);
@@ -8860,6 +9390,15 @@ class BaseSqliteDocStore {
     const stmt = this.getPreparedStatement("INSERT OR REPLACE INTO persistence_globals (key, json_value) VALUES (?, ?)");
     await stmt.run(key, JSON.stringify(value));
   }
+  async writeGlobalIfAbsent(key, value) {
+    const insertStmt = this.getPreparedStatement("INSERT OR IGNORE INTO persistence_globals (key, json_value) VALUES (?, ?)");
+    const changesStmt = this.getPreparedStatement("SELECT changes() as changes");
+    return this.adapter.transaction(async () => {
+      await insertStmt.run(key, JSON.stringify(value));
+      const row = await changesStmt.get();
+      return Number(row?.changes ?? 0) > 0;
+    });
+  }
   async previous_revisions(queries) {
     const results = new Map;
     const stmt = this.getPreparedStatement(`
@@ -9155,6 +9694,9 @@ class BaseSqliteDocStore {
     return scored.slice(0, limit);
   }
 }
+function quoteSqlIdentifier(value) {
+  return `"${value.replace(/"/g, '""')}"`;
+}
 // ../docstore-sqlite-base/dist/transaction-runner.js
 function createSerializedTransactionRunner(hooks) {
   let queue = Promise.resolve();