@dsh-remote/relay 3.1.4 → 3.1.5

package/README.md

@@ -8,7 +8,7 @@ DSH Remote Control 的**零知识 WebSocket 中继**：在宿主插件与已配
 
 ## 自托管
 
-完整配方（环境变量表、systemd / docker / nginx、排错、升级与回滚）见
+完整配方（环境变量表、systemd / docker / nginx、排错、升级）见
 [`docs/SELF-HOSTING.md`](docs/SELF-HOSTING.md)。最速验证：
 
 ```sh

package/deploy/docker/Dockerfile

@@ -41,67 +41,41 @@
 #      （deploy/docker/README.md 有完整的离线步骤；生产那次就是这么发的）。
 #
 # Node 22 与 CI、与 HANDOFF 的工具链口径一致（pnpm 11 要求 >= 22.13）。
+#
+# ## 2026-10-13（3.1.5 起）：这份 Dockerfile 回到**单仓形态**
+#
+# 3.1.3/3.1.4 那两次部署用的是**伞仓上下文**（COPY 带 `packages/` 前缀、compose 的
+# `context: ../..` 指到 monorepo 根）——因为那时服务器上摆的是整棵伞仓树。
+# 2026-10-13 用户裁决：服务器改成**单仓部署**（部署源 = 本仓，不再摆伞仓）。
+# 本仓与伞仓共用这份文件路径（`deploy/docker/Dockerfile`），但**两边各有一份内容**：
+# 伞仓那份（`/deploy/docker/`）保持 monorepo 形态给伞仓构建用；本仓这份从现在是
+# 独立仓形态——`COPY package.json pnpm-lock.yaml ./` 拷的是**本包**清单，
+# `@dsh-remote/protocol` 从 **npm** 装（devDependency，发版顺序 protocol 先行），
+# `pnpm-lock.yaml` 由 `scripts/split-repos.mjs` 在暂存时生成并随仓跟踪（CI 的
+# `--frozen-lockfile` 依赖它）。两份 Dockerfile 的差异只有 build 阶段的 COPY 路径，
+# runtime 阶段逐字相同。
 FROM node:22-alpine AS build
 WORKDIR /src
 
-# 先只拷锁文件再装：pnpm 的安装缓存按 lockfile 命中，改 src 不必重装依赖树。
+# 先只拷清单与锁再装：安装缓存按 lockfile 命中，改 src 不必重装依赖树。
 # --frozen-lockfile 是刻意的——镜像里装的必须与提交的 lockfile 逐位一致，
 # "构建时顺手升了某个传递依赖"这类漂移正是要消掉的。
-#
-# ## v3 单仓：这里的 COPY 必须带 packages/ 前缀（2026-10-08 修）
-#
-# v2 时这个仓是**独立仓**，build 上下文（compose 的 `context: ../..`）就是本仓根，
-# 所以 `COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./` 拷的是"本包 + 本包锁"。
-# v3 变成 monorepo 后，同一行拷的是 **monorepo 根**的三个文件——而根 package.json 里
-# 没有 relay 的依赖，于是 pnpm 报的错是「lockfile 里有 ^22.9.0、manifest 要 ^26.6.3」
-# 这类**看起来毫不相关**的 mismatch（真实原因：那份 package.json 不是这个包的）。
-#
-# 症状与判据：`docker compose build` 失败，而 `pnpm install` 在本机完全正常。
-# 所以下面显式列出三个路径，让"上下文是单仓根"这件事变成 Dockerfile 自己保证的。
-# ⚠️ 下面几行的行尾**不许带注释** —— Dockerfile 会把 `#` 之后的内容也当成拷贝路径
-# （报错形态：`"/需要它要解": not found`，看起来像文件不存在，其��是把注释当路径了）。
+# ⚠️ 下面几行的行尾**不许带注释** —— Dockerfile 会把 `#` 之后的内容也当成拷贝路径。
 # 要说明就写在上一行。
-COPY pnpm-workspace.yaml ./
-COPY pnpm-lock.yaml ./
-# monorepo 根清单：pnpm 需要它来解 workspace（里面没有 relay 的依赖，只负责解析结构）
 COPY package.json ./
+COPY pnpm-lock.yaml ./
 #
-# ⚠️ **pnpm-workspace.yaml 声明的每一个包都要有 package.json 在场**，少一个都不行。
-# 缺的那几个不会报"文件不存在"，而是报 `specifiers in the lockfile don't match`，
-# 并把**缺的包的依赖名**列出来（第一次栽在这里：漏了 plugin/client/e2e，于是报错说
-# 「lockfile 有 ^22.9.0、manifest 要 ^26.6.3」——那是 plugin 的 @types/node，
-# 与 relay 一点关系都没有 ⇒ 看起来像 lockfile 坏了，其��是清单没拷全）。
-# 镜像只需要 relay + protocol 的源码，但**清单必须全在场**，否则 pnpm 在 install 阶段就退出了。
-COPY packages/relay/package.json ./packages/relay/
-COPY packages/protocol/package.json ./packages/protocol/
-#
-# ⚠️ **不需要**把 workspace 里其他包（plugin / client / e2e）的 package.json 也拷进来。
-# 我一度以为"声明的包必须清单齐备"，为此加了三条 COPY —— 那三条**无效**：
-# 删掉之后 `pnpm install --frozen-lockfile` 照样通过（2026-10-08 在服务器上实测过：
-# 只放 protocol + relay 两份清单，frozen 检查顺利过，只在下一步因缺 protocol 的
-# tsconfig 而失败）。pnpm 只校验**它要解析的那些 importer**。
-#
-# 那次「lockfile 有 ^22.9.0、manifest 要 ^26.6.3」的 mismatch 真相不是"清单没拷全"，
-# 而是**根 package.json 被污染**：上传源码时用 `tar xzf`，relay 的 package.json
-# 覆盖到了仓库根，于是 pnpm 拿 relay 的依赖去比根的 lock ⇒ 报出 relay 的依赖名。
-# ⇒ **报错指错地方时，先怀疑"文件被覆盖"，别急着加 COPY。**
-#
-# protocol 的 src + tsconfig 必须在 install **之前**进来：
-# 它的 `prepare: tsc -p tsconfig.json` 是 install 生命周期的一环，
-# 顺序写反的报错是 `TS5058: path does not exist`，出现在 install 阶段。
-COPY packages/protocol/tsconfig.json ./packages/protocol/
-COPY packages/protocol/src ./packages/protocol/src
+# `@dsh-remote/protocol` 是 devDependency、从 **npm** 装（不再是 workspace 软链）：
+# 单仓里没有它的源码，也不需要——它对 runtime 是零依赖（bundle 全内联）。
+# 发版顺序因此必须是 **protocol 先发**，本仓构建才能锁到同版本。
+# 锁文件由 `scripts/split-repos.mjs` 暂存时 `pnpm install` 生成并随仓跟踪；
+# 在伞仓里它不存在（伞仓由根锁文件管），这是"两边各有一份内容"的一部分。
 RUN corepack enable && pnpm install --frozen-lockfile
 
-COPY packages/relay/tsconfig.json ./packages/relay/
-COPY packages/relay/src ./packages/relay/src
-COPY packages/relay/scripts ./packages/relay/scripts
-# protocol 必须**先构建**：它是 workspace 依赖，`pnpm install` 只软链它的 package.json，
-# 而 bundle 脚本按 node_modules 解析 ⇒ 拿到的必须是 `dist/src/**`（main 字段指向那里）。
-# 少这一步的报错形态是 esbuild 找不到 `@dsh-remote/protocol/dist/src/index.js`。
-RUN pnpm --filter @dsh-remote/protocol build
-# 在 relay 包目录里构建：它的 tsconfig 与 bundle 脚本都以包根为基准
-WORKDIR /src/packages/relay
+COPY tsconfig.json ./
+COPY src ./src
+COPY scripts ./scripts
+# tsconfig/bundle 脚本都以仓根为基准（单仓形态：仓根就是包根）
 RUN pnpm build
 
 # 产物级断言。两条取自 tests/bundle.test.mjs 的同款断言，写在这里是因为
@@ -119,7 +93,7 @@ ARG VCS_REF=unknown
 LABEL org.opencontainers.image.title="dsh-remote-relay" org.opencontainers.image.description="Zero-knowledge WebSocket relay for DSH Remote Control" org.opencontainers.image.source="https://github.com/providcc/dsh-remote-server" org.opencontainers.image.licenses="MIT" org.opencontainers.image.version="${DRC_VERSION}" org.opencontainers.image.revision="${VCS_REF}"
 
 WORKDIR /app
-COPY --from=build /src/packages/relay/dist/bundle/main.js /app/relay.mjs
+COPY --from=build /src/dist/bundle/main.js /app/relay.mjs
 
 # 只有这两个。**故意不设 DRC_STATE_FILE**：镜像里的默认值要与裸机（systemd 单元）一致——
 # 不配就是纯内存、配了才落盘。落盘路径属于"部署形态"而不是"程序形态"，它与卷是一对，

package/dist/bundle/main.js

@@ -3726,7 +3726,7 @@ var require_websocket_server = __commonJS({
 // src/main.ts
 import { readFileSync as readFileSync2 } from "node:fs";
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/classic/external.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/classic/external.js
 var external_exports = {};
 __export(external_exports, {
   $brand: () => $brand,
@@ -3989,7 +3989,7 @@ __export(external_exports, {
   xor: () => xor
 });
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/index.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/core/index.js
 var core_exports2 = {};
 __export(core_exports2, {
   $ZodAny: () => $ZodAny,
@@ -4306,7 +4306,7 @@ __export(core_exports2, {
   withParser: () => withParser
 });
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/util.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/core/util.js
 var util_exports = {};
 __export(util_exports, {
   BIGINT_FORMAT_RANGES: () => BIGINT_FORMAT_RANGES,
@@ -4377,6 +4377,7 @@ __export(util_exports, {
   required: () => required,
   safeExtend: () => safeExtend,
   shallowClone: () => shallowClone,
+  sizeCaps: () => sizeCaps,
   slugify: () => slugify,
   stringifyPrimitive: () => stringifyPrimitive,
   toZod: () => toZod,
@@ -4896,6 +4897,18 @@ function prefixIssues(path, issues) {
 function unwrapMessage(message) {
   return typeof message === "string" ? message : message?.message;
 }
+function sizeCaps(defChecks) {
+  const caps = [];
+  for (const ch of defChecks ?? []) {
+    const d = ch._zod.def;
+    if (!/_(length|size)$|_equals$/.test(d.check))
+      break;
+    const max = d.maximum ?? d.length ?? d.size;
+    if (max >= 0)
+      caps.push([max, ch]);
+  }
+  return caps;
+}
 function attachSchema(issues, start, inst) {
   var _a3;
   for (let i = start; i < issues.length; i++) {
@@ -5149,7 +5162,7 @@ function constantCatch(value) {
   return fn;
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/core.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/core/core.js
 var _a;
 var NEVER = /* @__PURE__ */ Object.freeze({
   status: "aborted"
@@ -5271,7 +5284,7 @@ function config(newConfig) {
   return globalConfig;
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/errors.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/core/errors.js
 function _getMessage() {
   const internals = this._zod;
   internals.message ?? (internals.message = JSON.stringify(internals.def, jsonStringifyReplacer, 2));
@@ -5463,7 +5476,7 @@ function prettifyError(error62) {
   return lines.join("\n");
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/parse.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/core/parse.js
 function finalizeParams(callee, params) {
   return { callee: params?.callee ?? callee, Err: params?.Err };
 }
@@ -5623,7 +5636,7 @@ var _safeDecodeAsync = (_Err) => async (schema, value, _ctx) => {
 };
 var safeDecodeAsync = /* @__PURE__ */ _safeDecodeAsync($ZodRealError);
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/regexes.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/core/regexes.js
 var regexes_exports = {};
 __export(regexes_exports, {
   anyString: () => anyString,
@@ -5795,7 +5808,7 @@ var sha512_hex = /^[0-9a-fA-F]{128}$/;
 var sha512_base64 = /* @__PURE__ */ fixedBase64(86, "==");
 var sha512_base64url = /* @__PURE__ */ fixedBase64url(86);
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/checks.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/core/checks.js
 var $ZodCheck = /* @__PURE__ */ $constructor("$ZodCheck", (inst, def) => {
   var _a3;
   inst._zod ?? (inst._zod = {});
@@ -6271,7 +6284,7 @@ var $ZodCheckOverwrite = /* @__PURE__ */ $constructor("$ZodCheckOverwrite", (ins
   };
 });
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/doc.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/core/doc.js
 var Doc = class {
   constructor(args = [], closed = {}) {
     this.content = [];
@@ -6312,14 +6325,14 @@ ${content.join("\n")}
   }
 };
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/versions.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/core/versions.js
 var version = {
   major: 4,
   minor: 6,
-  patch: 5
+  patch: 6
 };
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/schemas.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/core/schemas.js
 var $ZodType = /* @__PURE__ */ $constructor("$ZodType", (inst, def) => {
   var _a3;
   inst ?? (inst = {});
@@ -7072,6 +7085,31 @@ var $ZodDate = /* @__PURE__ */ $constructor("$ZodDate", (inst, def) => {
     return payload;
   };
 });
+function capSize(inst, size) {
+  const caps = sizeCaps(inst._zod.def.checks);
+  if (!caps.length)
+    return;
+  const cap = Math.min(...caps.map((c) => c[0]));
+  const parse3 = inst._zod.parse;
+  inst._zod.parse = (payload, ctx) => {
+    const n = size(payload.value);
+    if (n > cap && !ctx?.skipChecks && ctx?.direction !== "backward") {
+      for (const [max, ch] of sizeCaps(inst._zod.def.checks)) {
+        if (n > max && ch._zod.def.when(payload)) {
+          const start = payload.issues.length;
+          ch._zod.check(payload);
+          payload.issues[start].continue = false;
+          attachSchema(payload.issues, start, inst);
+          return payload;
+        }
+      }
+    }
+    return parse3(payload, ctx);
+  };
+}
+var arraySize = (input2) => Array.isArray(input2) ? input2.length : -1;
+var mapSize = (input2) => input2 instanceof Map ? input2.size : -1;
+var setSize = (input2) => input2 instanceof Set ? input2.size : -1;
 function handleArrayResult(result, final, index) {
   if (result.issues.length) {
     final.issues.push(...prefixIssues(index, result.issues));
@@ -7115,6 +7153,7 @@ var $ZodArray = /* @__PURE__ */ $constructor("$ZodArray", (inst, def) => {
     }
     return payload;
   };
+  capSize(inst, arraySize);
 });
 function handlePropertyResult(result, final, key, input2, optin, optout) {
   const isPresent = key in input2;
@@ -8071,6 +8110,7 @@ var $ZodMap = /* @__PURE__ */ $constructor("$ZodMap", (inst, def) => {
       return Promise.all(proms).then(() => payload);
     return payload;
   };
+  capSize(inst, mapSize);
 });
 function handleMapResult(keyResult, valueResult, final, key, input2, inst, ctx) {
   if (keyResult.issues.length) {
@@ -8137,6 +8177,7 @@ var $ZodSet = /* @__PURE__ */ $constructor("$ZodSet", (inst, def) => {
       return Promise.all(proms).then(() => payload);
     return payload;
   };
+  capSize(inst, setSize);
 });
 function handleSetResult(result, final) {
   if (result.issues.length) {
@@ -8733,7 +8774,7 @@ function handleRefineResult(result, payload, input2, inst) {
   }
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/memoizer.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/core/memoizer.js
 var $ZodCyclicError = class extends Error {
   constructor() {
     super(`Cannot parse a reference cycle that closes through a transform`);
@@ -9010,7 +9051,7 @@ function isBackEdge(ctx, value) {
   return backEdges !== void 0 && isRef(value) && backEdges.has(value);
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/index.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/index.js
 var locales_exports = {};
 __export(locales_exports, {
   ar: () => ar_default,
@@ -9078,7 +9119,7 @@ __export(locales_exports, {
   zhTW: () => zh_TW_default
 });
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/ar.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/ar.js
 var error = () => {
   const Sizable = {
     string: { unit: "\u062D\u0631\u0641", verb: "\u0623\u0646 \u064A\u062D\u0648\u064A" },
@@ -9190,7 +9231,7 @@ function ar_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/az.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/az.js
 var error2 = () => {
   const Sizable = {
     string: { unit: "simvol", verb: "olmal\u0131d\u0131r" },
@@ -9301,7 +9342,7 @@ function az_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/be.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/be.js
 function getBelarusianPlural(count, one, few, many) {
   const absCount = Math.abs(count);
   const lastDigit = absCount % 10;
@@ -9470,7 +9511,7 @@ function be_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/bg.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/bg.js
 var error4 = () => {
   const Sizable = {
     string: { unit: "\u0441\u0438\u043C\u0432\u043E\u043B\u0430", verb: "\u0434\u0430 \u0441\u044A\u0434\u044A\u0440\u0436\u0430" },
@@ -9596,7 +9637,7 @@ function bg_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/bn.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/bn.js
 var error5 = () => {
   const Sizable = {
     string: { unit: "\u0985\u0995\u09CD\u09B7\u09B0", verb: "\u09A5\u09BE\u0995\u09A4\u09C7 \u09B9\u09AC\u09C7" },
@@ -9710,7 +9751,7 @@ function bn_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/ca.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/ca.js
 var error6 = () => {
   const Sizable = {
     string: { unit: "car\xE0cters", verb: "contenir" },
@@ -9824,7 +9865,7 @@ function ca_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/ckb.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/ckb.js
 var error7 = () => {
   const Sizable = {
     string: { unit: "\u067E\u06CC\u062A", verb: "\u0628\u06CE\u062A" },
@@ -9957,7 +9998,7 @@ function ckb_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/cs.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/cs.js
 var error8 = () => {
   const Sizable = {
     string: { unit: "znak\u016F", verb: "m\xEDt" },
@@ -10074,7 +10115,7 @@ function cs_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/da.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/da.js
 var error9 = () => {
   const Sizable = {
     string: { unit: "tegn", verb: "havde" },
@@ -10195,7 +10236,7 @@ function da_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/de.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/de.js
 var error10 = () => {
   const Sizable = {
     string: { unit: "Zeichen", verb: "zu haben" },
@@ -10309,7 +10350,7 @@ function de_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/el.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/el.js
 var error11 = () => {
   const Sizable = {
     string: { unit: "\u03C7\u03B1\u03C1\u03B1\u03BA\u03C4\u03AE\u03C1\u03B5\u03C2", verb: "\u03BD\u03B1 \u03AD\u03C7\u03B5\u03B9" },
@@ -10422,7 +10463,7 @@ function el_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/en.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/en.js
 var error12 = () => {
   const Sizable = {
     string: { unit: "characters", verb: "to have" },
@@ -10547,7 +10588,7 @@ function en_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/eo.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/eo.js
 var error13 = () => {
   const Sizable = {
     string: { unit: "karaktrojn", verb: "havi" },
@@ -10662,7 +10703,7 @@ function eo_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/es.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/es.js
 var error14 = () => {
   const Sizable = {
     string: { unit: "caracteres", verb: "tener" },
@@ -10799,7 +10840,7 @@ function es_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/fa.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/fa.js
 var error15 = () => {
   const Sizable = {
     string: { unit: "\u06A9\u0627\u0631\u0627\u06A9\u062A\u0631", verb: "\u062F\u0627\u0634\u062A\u0647 \u0628\u0627\u0634\u062F" },
@@ -10919,7 +10960,7 @@ function fa_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/fi.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/fi.js
 var error16 = () => {
   const Sizable = {
     string: { unit: "merkki\xE4", subject: "merkkijonon" },
@@ -11037,7 +11078,7 @@ function fi_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/fr.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/fr.js
 var error17 = () => {
   const Sizable = {
     string: { unit: "caract\xE8res", verb: "avoir" },
@@ -11167,7 +11208,7 @@ function fr_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/fr-CA.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/fr-CA.js
 var error18 = () => {
   const Sizable = {
     string: { unit: "caract\xE8res", verb: "avoir" },
@@ -11280,7 +11321,7 @@ function fr_CA_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/gu.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/gu.js
 var error19 = () => {
   const Sizable = {
     string: { unit: "\u0A85\u0A95\u0ACD\u0AB7\u0AB0", verb: "\u0AB9\u0ACB\u0AB5\u0ABE \u0A9C\u0ACB\u0A88\u0A8F" },
@@ -11394,7 +11435,7 @@ function gu_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/he.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/he.js
 var error20 = () => {
   const TypeNames = {
     string: { label: "\u05DE\u05D7\u05E8\u05D5\u05D6\u05EA", gender: "f" },
@@ -11596,7 +11637,7 @@ function he_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/hi.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/hi.js
 var error21 = () => {
   const Sizable = {
     string: { unit: "\u0905\u0915\u094D\u0937\u0930", verb: "\u0930\u0916\u0928\u0947 \u0915\u0947 \u0932\u093F\u090F" },
@@ -11708,7 +11749,7 @@ function hi_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/hr.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/hr.js
 var error22 = () => {
   const Sizable = {
     string: { unit: "znakova", verb: "imati" },
@@ -11835,7 +11876,7 @@ function hr_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/hu.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/hu.js
 var error23 = () => {
   const Sizable = {
     string: { unit: "karakter", verb: "legyen" },
@@ -11949,7 +11990,7 @@ function hu_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/hy.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/hy.js
 function getArmenianPlural(count, one, many) {
   return Math.abs(count) === 1 ? one : many;
 }
@@ -12108,7 +12149,7 @@ function hy_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/id.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/id.js
 var error25 = () => {
   const Sizable = {
     string: { unit: "karakter", verb: "memiliki" },
@@ -12220,7 +12261,7 @@ function id_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/is.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/is.js
 var error26 = () => {
   const Sizable = {
     string: { unit: "stafi", verb: "a\xF0 hafa" },
@@ -12335,7 +12376,7 @@ function is_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/it.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/it.js
 var error27 = () => {
   const Sizable = {
     string: { unit: "caratteri", verb: "avere" },
@@ -12449,7 +12490,7 @@ function it_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/ja.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/ja.js
 var error28 = () => {
   const Sizable = {
     string: { unit: "\u6587\u5B57", verb: "\u3067\u3042\u308B" },
@@ -12562,7 +12603,7 @@ function ja_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/ka.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/ka.js
 var error29 = () => {
   const Sizable = {
     string: { unit: "\u10E1\u10D8\u10DB\u10D1\u10DD\u10DA\u10DD", verb: "\u10E3\u10DC\u10D3\u10D0 \u10E8\u10D4\u10D8\u10EA\u10D0\u10D5\u10D3\u10D4\u10E1" },
@@ -12680,7 +12721,7 @@ function ka_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/km.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/km.js
 var error30 = () => {
   const Sizable = {
     string: { unit: "\u178F\u17BD\u17A2\u1780\u17D2\u179F\u179A", verb: "\u1782\u17BD\u179A\u1798\u17B6\u1793" },
@@ -12796,12 +12837,12 @@ function km_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/kh.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/kh.js
 function kh_default() {
   return km_default();
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/kn.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/kn.js
 var error31 = () => {
   const Sizable = {
     string: { unit: "\u0C85\u0C95\u0CCD\u0CB7\u0CB0\u0C97\u0CB3\u0CC1", verb: "\u0CB9\u0CCA\u0C82\u0CA6\u0CB2\u0CC1" },
@@ -12917,7 +12958,7 @@ function kn_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/ko.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/ko.js
 var error32 = () => {
   const Sizable = {
     string: { unit: "\uBB38\uC790", verb: "to have" },
@@ -13034,7 +13075,7 @@ function ko_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/lt.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/lt.js
 var capitalizeFirstCharacter = (text) => {
   return text.charAt(0).toUpperCase() + text.slice(1);
 };
@@ -13242,7 +13283,7 @@ function lt_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/mk.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/mk.js
 var error34 = () => {
   const Sizable = {
     string: { unit: "\u0437\u043D\u0430\u0446\u0438", verb: "\u0434\u0430 \u0438\u043C\u0430\u0430\u0442" },
@@ -13357,7 +13398,7 @@ function mk_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/ms.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/ms.js
 var error35 = () => {
   const Sizable = {
     string: { unit: "aksara", verb: "mempunyai" },
@@ -13470,7 +13511,7 @@ function ms_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/ne.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/ne.js
 var error36 = () => {
   const Sizable = {
     string: { unit: "\u0905\u0915\u094D\u0937\u0930", verb: "\u0939\u0941\u0928\u0941\u092A\u0930\u094D\u091B" },
@@ -13582,7 +13623,7 @@ function ne_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/nl.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/nl.js
 var error37 = () => {
   const Sizable = {
     string: { unit: "tekens", verb: "heeft" },
@@ -13698,7 +13739,7 @@ function nl_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/nn.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/nn.js
 var error38 = () => {
   const Sizable = {
     string: { unit: "teikn", verb: "\xE5 ha" },
@@ -13812,7 +13853,7 @@ function nn_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/no.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/no.js
 var error39 = () => {
   const Sizable = {
     string: { unit: "tegn", verb: "\xE5 ha" },
@@ -13926,7 +13967,7 @@ function no_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/ota.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/ota.js
 var error40 = () => {
   const Sizable = {
     string: { unit: "harf", verb: "olmal\u0131d\u0131r" },
@@ -14041,7 +14082,7 @@ function ota_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/ps.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/ps.js
 var error41 = () => {
   const Sizable = {
     string: { unit: "\u062A\u0648\u06A9\u064A", verb: "\u0648\u0644\u0631\u064A" },
@@ -14161,7 +14202,7 @@ function ps_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/pl.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/pl.js
 var error42 = () => {
   const Sizable = {
     string: { unit: "znak\xF3w", verb: "mie\u0107" },
@@ -14276,7 +14317,7 @@ function pl_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/pt.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/pt.js
 var error43 = () => {
   const Sizable = {
     string: { unit: "caracteres" },
@@ -14420,7 +14461,7 @@ function pt_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/pt-BR.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/pt-BR.js
 var error44 = () => {
   const Sizable = {
     string: { unit: "caracteres" },
@@ -14565,7 +14606,7 @@ function pt_BR_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/ro.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/ro.js
 var error45 = () => {
   const Sizable = {
     string: { unit: "caractere", verb: "s\u0103 aib\u0103" },
@@ -14688,7 +14729,7 @@ function ro_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/ru.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/ru.js
 function getRussianPlural(count, one, few, many) {
   const absCount = Math.abs(count);
   const lastDigit = absCount % 10;
@@ -14857,7 +14898,7 @@ function ru_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/sk.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/sk.js
 var error47 = () => {
   const Sizable = {
     string: { unit: "znakov", verb: "ma\u0165" },
@@ -14974,7 +15015,7 @@ function sk_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/sl.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/sl.js
 var error48 = () => {
   const Sizable = {
     string: { unit: "znakov", verb: "imeti" },
@@ -15089,7 +15130,7 @@ function sl_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/sv.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/sv.js
 var error49 = () => {
   const Sizable = {
     string: { unit: "tecken", verb: "att ha" },
@@ -15205,7 +15246,7 @@ function sv_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/ta.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/ta.js
 var error50 = () => {
   const Sizable = {
     string: { unit: "\u0B8E\u0BB4\u0BC1\u0BA4\u0BCD\u0BA4\u0BC1\u0B95\u0BCD\u0B95\u0BB3\u0BCD", verb: "\u0B95\u0BCA\u0BA3\u0BCD\u0B9F\u0BBF\u0BB0\u0BC1\u0B95\u0BCD\u0B95 \u0BB5\u0BC7\u0BA3\u0BCD\u0B9F\u0BC1\u0BAE\u0BCD" },
@@ -15321,7 +15362,7 @@ function ta_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/tg.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/tg.js
 var error51 = () => {
   const Sizable = {
     string: { unit: "\u0430\u043B\u043E\u043C\u0430\u0442", verb: "\u0434\u043E\u0448\u0442\u0430 \u0431\u043E\u0448\u0430\u0434" },
@@ -15438,7 +15479,7 @@ function tg_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/th.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/th.js
 var error52 = () => {
   const Sizable = {
     string: { unit: "\u0E15\u0E31\u0E27\u0E2D\u0E31\u0E01\u0E29\u0E23", verb: "\u0E04\u0E27\u0E23\u0E21\u0E35" },
@@ -15554,7 +15595,7 @@ function th_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/tk.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/tk.js
 var error53 = () => {
   const Sizable = {
     string: { unit: "simwol", verb: "bolmaly" },
@@ -15662,7 +15703,7 @@ function tk_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/tr.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/tr.js
 var error54 = () => {
   const Sizable = {
     string: { unit: "karakter", verb: "olmal\u0131" },
@@ -15773,7 +15814,7 @@ function tr_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/uk.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/uk.js
 var error55 = () => {
   const Sizable = {
     string: { unit: "\u0441\u0438\u043C\u0432\u043E\u043B\u0456\u0432", verb: "\u043C\u0430\u0442\u0438\u043C\u0435" },
@@ -15887,12 +15928,12 @@ function uk_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/ua.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/ua.js
 function ua_default() {
   return uk_default();
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/ur.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/ur.js
 var error56 = () => {
   const Sizable = {
     string: { unit: "\u062D\u0631\u0648\u0641", verb: "\u06C1\u0648\u0646\u0627" },
@@ -16008,7 +16049,7 @@ function ur_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/uz.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/uz.js
 var error57 = () => {
   const Sizable = {
     string: { unit: "belgi", verb: "bo\u2018lishi kerak" },
@@ -16122,7 +16163,7 @@ function uz_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/vi.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/vi.js
 var error58 = () => {
   const Sizable = {
     string: { unit: "k\xFD t\u1EF1", verb: "c\xF3" },
@@ -16236,7 +16277,7 @@ function vi_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/zh-CN.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/zh-CN.js
 var error59 = () => {
   const Sizable = {
     string: { unit: "\u5B57\u7B26", verb: "\u5305\u542B" },
@@ -16351,7 +16392,7 @@ function zh_CN_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/zh-TW.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/zh-TW.js
 var error60 = () => {
   const Sizable = {
     string: { unit: "\u5B57\u5143", verb: "\u64C1\u6709" },
@@ -16464,7 +16505,7 @@ function zh_TW_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/yo.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/yo.js
 var error61 = () => {
   const Sizable = {
     string: { unit: "\xE0mi", verb: "n\xED" },
@@ -16577,7 +16618,7 @@ function yo_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/registries.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/core/registries.js
 var _a2;
 var $output = /* @__PURE__ */ Symbol("ZodOutput");
 var $input = /* @__PURE__ */ Symbol("ZodInput");
@@ -16627,7 +16668,7 @@ function registry() {
 (_a2 = globalThis).__zod_globalRegistry ?? (_a2.__zod_globalRegistry = registry());
 var globalRegistry = globalThis.__zod_globalRegistry;
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/compile.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/core/compile.js
 var INVALID = /* @__PURE__ */ Symbol.for("zod.compile.invalid");
 var FALLBACK_FLAG = /* @__PURE__ */ Symbol.for("zod.compile.fallback");
 var ZodCompileAsyncError = class extends Error {
@@ -17667,9 +17708,15 @@ function generateNullableCheck(doc, ctx, schema, accessor, buildsValue = true) {
   doc.write(`}`);
   return outputVar;
 }
+function generateSizeGate(doc, schema, size) {
+  for (const [max, check2] of sizeCaps(schema._zod.def.checks)) {
+    doc.write(`if (${size} > ${numericOperand(max, check2._zod.def.check)}) return INVALID;`);
+  }
+}
 function generateArrayCheck(doc, ctx, schema, accessor, buildsValue = true) {
   const def = schema._zod.def;
   doc.write(`if (!Array.isArray(${accessor})) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.length`);
   const outputVar = buildsValue ? newVar(ctx) : null;
   const iVar = newVar(ctx);
   const elemVar = newVar(ctx);
@@ -18069,6 +18116,7 @@ function literalPropertyKey(ctx, key) {
 function generateMapCheck(doc, ctx, schema, accessor) {
   const def = schema._zod.def;
   doc.write(`if (!(${accessor} instanceof Map)) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.size`);
   const outputVar = newVar(ctx);
   const kVar = newVar(ctx);
   const valVar = newVar(ctx);
@@ -18085,6 +18133,7 @@ function generateMapCheck(doc, ctx, schema, accessor) {
 function generateSetCheck(doc, ctx, schema, accessor) {
   const def = schema._zod.def;
   doc.write(`if (!(${accessor} instanceof Set)) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.size`);
   const outputVar = newVar(ctx);
   const valVar = newVar(ctx);
   doc.write(`const ${outputVar} = new Set();`);
@@ -18229,7 +18278,7 @@ function generateTransformCheck(doc, ctx, schema, accessor) {
   return accessor;
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/api.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/core/api.js
 function snapshotChecks(def) {
   if (def.checks)
     def.checks = [...def.checks];
@@ -19288,7 +19337,7 @@ function _stringFormat(Class2, format, fnOrRegex, _params = {}) {
   return inst;
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/to-json-schema.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/core/to-json-schema.js
 function assignProps(target, ...sources) {
   for (const source of sources) {
     for (const key of Reflect.ownKeys(source)) {
@@ -19818,7 +19867,7 @@ var createStandardJSONSchemaMethod = (schema, io, processors = {}) => (params) =
   return finalize(ctx, schema);
 };
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/json-schema-processors.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/core/json-schema-processors.js
 var narrowMin = (agg, key, value) => {
   if (agg[key] === void 0 || value > agg[key])
     agg[key] = value;
@@ -20566,7 +20615,7 @@ function toJSONSchema(input2, params) {
   return finalize(ctx, input2);
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/json-schema-generator.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/core/json-schema-generator.js
 var JSONSchemaGenerator = class {
   /** @deprecated Access via ctx instead */
   get metadataRegistry() {
@@ -20644,10 +20693,10 @@ var JSONSchemaGenerator = class {
   }
 };
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/json-schema.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/core/json-schema.js
 var json_schema_exports = {};
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/classic/schemas.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/classic/schemas.js
 var schemas_exports2 = {};
 __export(schemas_exports2, {
   ZodAny: () => ZodAny,
@@ -20828,7 +20877,7 @@ __export(schemas_exports2, {
   xor: () => xor
 });
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/classic/checks.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/classic/checks.js
 var checks_exports2 = {};
 __export(checks_exports2, {
   endsWith: () => _endsWith,
@@ -20863,7 +20912,7 @@ __export(checks_exports2, {
   uppercase: () => _uppercase
 });
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/classic/errors.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/classic/errors.js
 var _installedErrorProtos = /* @__PURE__ */ new WeakSet([Object.prototype, Error.prototype]);
 function _lazyMethod(proto, key, make) {
   Object.defineProperty(proto, key, {
@@ -20909,7 +20958,7 @@ var ZodRealError = /* @__PURE__ */ $constructor("ZodError", initializer2, void 0
   Parent: Error
 });
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/classic/parse.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/classic/parse.js
 var parse2 = /* @__PURE__ */ _parse(ZodRealError);
 var parseAsync2 = /* @__PURE__ */ _parseAsync(ZodRealError);
 var safeParse2 = /* @__PURE__ */ _safeParse(ZodRealError);
@@ -20923,7 +20972,7 @@ var safeDecode2 = /* @__PURE__ */ _safeDecode(ZodRealError);
 var safeEncodeAsync2 = /* @__PURE__ */ _safeEncodeAsync(ZodRealError);
 var safeDecodeAsync2 = /* @__PURE__ */ _safeDecodeAsync(ZodRealError);
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/classic/schemas.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/classic/schemas.js
 function _ensureDefaultLocale() {
   if (!globalConfig.localeError)
     config(en_default());
@@ -22388,7 +22437,7 @@ function preprocess(fn, schema) {
   });
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/classic/compat.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/classic/compat.js
 var ZodIssueCode = {
   invalid_type: "invalid_type",
   too_big: "too_big",
@@ -22414,7 +22463,7 @@ var ZodFirstPartyTypeKind;
 /* @__PURE__ */ (function(ZodFirstPartyTypeKind2) {
 })(ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {}));
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/classic/iso.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/classic/iso.js
 var iso_exports = {};
 __export(iso_exports, {
   ZodISODate: () => ZodISODate,
@@ -22439,7 +22488,7 @@ function duration2(params) {
   return _isoDuration(ZodISODuration, params);
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/classic/from-json-schema.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/classic/from-json-schema.js
 var z = {
   ...schemas_exports2,
   ...checks_exports2,
@@ -23172,7 +23221,7 @@ function fromJSONSchema(schema, params) {
   return convertSchema(normalized, ctx);
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/visit.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/core/visit.js
 var RESOLVING = /* @__PURE__ */ Symbol("z.visit/resolving");
 function visit(schema, fnOrHandlers) {
   const fn = typeof fnOrHandlers === "function" ? fnOrHandlers : (node2, rewritten) => {
@@ -23327,7 +23376,7 @@ function visit(schema, fnOrHandlers) {
   return run(schema);
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/classic/deep-partial.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/classic/deep-partial.js
 function deepPartial(schema) {
   return visit(schema, {
     object: (s) => s.partial(),
@@ -23339,7 +23388,7 @@ function deepPartial(schema) {
   });
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/classic/in-out.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/classic/in-out.js
 function withChecks(side, checks) {
   if (!checks?.length)
     return side;
@@ -23369,7 +23418,7 @@ function output(schema) {
   });
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/classic/coerce.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/classic/coerce.js
 var coerce_exports = {};
 __export(coerce_exports, {
   bigint: () => bigint3,
@@ -23653,11 +23702,14 @@ var Budget = class {
   windowMs;
   windowAt = 0;
   left = 0;
+  /** 有没有真的开过窗口（见 `take` 的第 ② 条）。 */
+  armed = false;
   /** 取一个配额；成功 true，用尽 false。 */
   take(now) {
-    if (now - this.windowAt >= this.windowMs || now < this.windowAt) {
+    if (!this.armed || now - this.windowAt >= this.windowMs || now < this.windowAt) {
       this.windowAt = now;
       this.left = this.perWindow;
+      this.armed = true;
     }
     if (this.left <= 0) return false;
     this.left -= 1;
@@ -23811,6 +23863,9 @@ function loadConfig(env, version2) {
     pairStatusBudgetPerSec: integer2(env.DRC_PAIR_STATUS_PER_SEC, 5, "DRC_PAIR_STATUS_PER_SEC", problems),
     maxPendingPairs: integer2(env.DRC_MAX_PENDING_PAIRS, 1e3, "DRC_MAX_PENDING_PAIRS", problems),
     maxHostTokens: integer2(env.DRC_MAX_HOST_TOKENS, 500, "DRC_MAX_HOST_TOKENS", problems),
+    // D6：会话表是唯一曾经没有上界的一张表，而每次认领都要同步写它（成本 ∝ 表大小）。
+    // 默认与依据见 `RelayConfig.maxConversations` 的注释。
+    maxConversations: integer2(env.DRC_MAX_CONVERSATIONS, 5e3, "DRC_MAX_CONVERSATIONS", problems),
     claimMinIntervalMs: claimMinIntervalMs(env, problems),
     conversationIdleTtlMs: integer2(env.DRC_CONV_IDLE_TTL_MS, 7 * 24 * 3600 * 1e3, "DRC_CONV_IDLE_TTL_MS", problems),
     // P2-⑤（2026-10-04 用户拍板 30 分钟）：远小于 7 天的空闲 TTL。
@@ -24673,10 +24728,6 @@ function readStateFile(path, log) {
     return void 0;
   }
   const file2 = parsed;
-  if (file2.version !== STATE_FILE_VERSION) {
-    log.warn("state file version mismatch, starting empty", { path, found: String(file2.version) });
-    return void 0;
-  }
   const { conversations, dropped } = sanitize(file2.conversations);
   if (dropped > 0) log.warn("state file entries dropped", { path, dropped, kept: conversations.length });
   if (!Array.isArray(file2.hostTokens)) {
@@ -24813,9 +24864,15 @@ var RelayState = class {
   /** 测试可注入固定时钟；默认用真实时间。 */
   clock;
   maxPendingPairsValue;
+  /**
+   * 会话表上界（D6）。见 `RelayConfig.maxConversations` 的注释：这是"每次认领同步整表写"
+   * 那条成本链的**唯一**封口。
+   */
+  maxConversationsValue;
   constructor(options = {}) {
     this.clock = options.now ?? (() => Date.now());
     this.maxPendingPairsValue = options.maxPendingPairs ?? 1e3;
+    this.maxConversationsValue = options.maxConversations ?? 5e3;
   }
   now() {
     return this.clock();
@@ -24880,6 +24937,27 @@ var RelayState = class {
     });
     return { ok: true, replaced: existing !== void 0, full: false };
   }
+  /**
+   * 回收**已空**的会话，从最旧的一条开始，直到表回到上界以下（D6）。
+   *
+   * "最旧"按 `emptySince ?? lastActivityAt` 算——即"它被放弃得有多久"，
+   * 而不是"会话建立得有多早"：一条建立了很久但直到刚才才被放弃的会话，
+   * 比一条刚建立就被放弃的更该回收。
+   *
+   * 返回回收了几条（调用方拿它写日志／计数——回收这件事必须留痕，
+   * 否则"表为什么突然小了一截"只能靠猜）。
+   */
+  evictAbandonedConversations() {
+    if (this.conversations.size < this.maxConversationsValue) return 0;
+    const abandoned = [...this.conversations.entries()].filter(([, conv]) => conv.clients.size === 0).sort((a, b) => (a[1].emptySince ?? a[1].lastActivityAt) - (b[1].emptySince ?? b[1].lastActivityAt));
+    let dropped = 0;
+    for (const [conversationId] of abandoned) {
+      if (this.conversations.size < this.maxConversationsValue) break;
+      this.conversations.delete(conversationId);
+      dropped += 1;
+    }
+    return dropped;
+  }
   /** 还能被认领的码数（`/api/pair-status` 与主机侧「还有没有码可发」问的都是它）。 */
   countClaimablePairs() {
     let n = 0;
@@ -24894,6 +24972,12 @@ var RelayState = class {
     if (pending.used) return { ok: false, reason: "already_used" };
     const host = this.hosts.get(pending.hostId);
     if (!host || host.ws.readyState !== WS_OPEN) return { ok: false, reason: "host_offline" };
+    if (this.conversations.size >= this.maxConversationsValue) {
+      this.evictAbandonedConversations();
+      if (this.conversations.size >= this.maxConversationsValue) {
+        return { ok: false, reason: "table_full" };
+      }
+    }
     pending.used = true;
     const detached = this.leaveAll(clientId);
     const conversationId = newConversationId();
@@ -25247,11 +25331,16 @@ function tokenMatches(expected, got) {
   return timingSafeEqual(a, b);
 }
 var CLAIM_TRACK_MAX = 1e4;
+var PERSIST_COALESCE_MS = 200;
 var MAX_HOST_ID_LEN2 = 200;
 var HOST_ID_RE = /^[A-Za-z0-9._:-]+$/;
 function createRelay(config2) {
   const log = new Log(config2.logLevel);
-  const state = new RelayState({ maxPendingPairs: config2.maxPendingPairs });
+  const state = new RelayState({
+    maxPendingPairs: config2.maxPendingPairs,
+    // D6：会话表上界（缺了它，每次认领的同步整表写就成了无界的成本放大）。
+    maxConversations: config2.maxConversations
+  });
   const startedAt = Date.now();
   const pairBudget = new Budget(config2.pairGlobalBudgetPerSec);
   const pairStatusBudget = new Budget(config2.pairStatusBudgetPerSec);
@@ -25260,6 +25349,8 @@ function createRelay(config2) {
   const lastClaimAt = /* @__PURE__ */ new Map();
   let sweepTimer;
   let pingTimer;
+  let persistPending = false;
+  let persistTimer;
   let lastPingAt = 0;
   let lastCountersAt = 0;
   function newHostToken() {
@@ -25295,6 +25386,11 @@ function createRelay(config2) {
     }
   }
   function persistNow() {
+    persistPending = false;
+    if (persistTimer !== void 0) {
+      clearTimeout(persistTimer);
+      persistTimer = void 0;
+    }
     if (!persistence.enabled) return false;
     const ok = writeStateFile(config2.stateFile, snapshotState(state, Date.now()), log);
     if (ok) {
@@ -25306,6 +25402,17 @@ function createRelay(config2) {
     return ok;
   }
   function markStateChanged() {
+    if (!persistence.enabled) return;
+    persistPending = true;
+    if (persistTimer !== void 0) return;
+    persistTimer = setTimeout(() => {
+      persistTimer = void 0;
+      flushPendingPersist();
+    }, PERSIST_COALESCE_MS);
+    persistTimer.unref?.();
+  }
+  function flushPendingPersist() {
+    if (!persistPending) return;
     persistNow();
   }
   const MAX_PING_BUCKETS = 1024;
@@ -25475,9 +25582,24 @@ function createRelay(config2) {
     }
     const claimed = state.claim(frame.pairingToken, peer.clientId);
     if (!claimed.ok) {
+      const wireReason = claimed.reason === "table_full" ? "invalid_or_expired" : claimed.reason;
+      if (claimed.reason === "table_full") {
+        counters.rejectedPairs += 1;
+        const now = Date.now();
+        if (now - peer.tableFullWarnedAt >= 1e3) {
+          peer.tableFullWarnedAt = now;
+          log.warn("conversation table full, refusing new pairings (D6)", {
+            clientId: peer.clientId,
+            conversations: state.conversations.size,
+            max: config2.maxConversations
+          });
+        }
+        sendToPeer(peer, pairFail(wireReason, frame.pairingToken));
+        return;
+      }
       peer.pairAttempts += 1;
       counters.rejectedPairs += 1;
-      sendToPeer(peer, pairFail(claimed.reason, frame.pairingToken));
+      sendToPeer(peer, pairFail(wireReason, frame.pairingToken));
       log.info("pair failed", {
         clientId: peer.clientId,
         reason: claimed.reason,
@@ -25675,6 +25797,7 @@ function createRelay(config2) {
       notedNonMember: false,
       notedPairTableFull: false,
       pairBudgetWarnedAt: 0,
+      tableFullWarnedAt: 0,
       backpressure: new BackpressureGate(),
       alive: true,
       // 轮转序号取模分配：**均匀是刻意的**。哪怕重启风暴里 10k 条连接在几十秒内
@@ -26141,7 +26264,7 @@ function registerSignalHandlers(shutdown) {
 
 // src/main.ts
 function readVersion() {
-  if ("3.1.4") return "3.1.4";
+  if ("3.1.5") return "3.1.5";
   try {
     const pkg = JSON.parse(readFileSync2(new URL("../../package.json", import.meta.url), "utf8"));
     if (typeof pkg.version === "string") return pkg.version;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dsh-remote/relay",
-  "version": "3.1.4",
+  "version": "3.1.5",
   "description": "DSH Remote Control 的零知识 WebSocket 中继：只做路由，不碰载荷明文。可自托管的单文件产物。",
   "type": "module",
   "license": "MIT",