@farm.js/core 0.1.51-beta.0 → 0.1.51-beta.2

package/dist/chunk-7FVVQEVL.cjs

@@ -0,0 +1,541 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
+
+var _chunkJMYXO572cjs = require('./chunk-JMYXO572.cjs');
+
+
+var _chunkSHIWRBFIcjs = require('./chunk-SHIWRBFI.cjs');
+
+// src/mobile/session.ts
+var FARM_MOBILE_SESSION_PLUGIN = "farm:mobile-session";
+var FARM_MOBILE_SESSION_PATH = "/__farm/mobile/session";
+var FARM_MOBILE_APP_HEADER = "x-farm-mobile";
+var FARM_MOBILE_NONCE_HEADER = "x-farm-mobile-nonce";
+var FARM_MOBILE_DEVICE_COOKIE = "farm_mobile";
+var ACCESS_PREFIX = "fma1";
+var REFRESH_PREFIX = "fmr1";
+var STORAGE_NAMESPACE = "farm-mobile";
+var STATE_KEY = "farm:mobile-session";
+var USED_REFRESH_LIMIT = 8;
+var BROWSER_HEADERS = [
+  "origin",
+  "sec-fetch-site",
+  "sec-fetch-mode",
+  "sec-fetch-dest",
+  "sec-fetch-user"
+];
+var APP_ID = /^[A-Za-z][A-Za-z0-9_]*(?:\.[A-Za-z][A-Za-z0-9_]*)+$/;
+var BASE64URL = /^[A-Za-z0-9_-]+$/;
+var encoder = new TextEncoder();
+var decoder = new TextDecoder();
+function toBase64Url(bytes) {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function fromBase64Url(value) {
+  const base64 = value.replace(/-/g, "+").replace(/_/g, "/");
+  const binary = atob(base64 + "=".repeat((4 - base64.length % 4) % 4));
+  const bytes = new Uint8Array(binary.length);
+  for (let index = 0; index < binary.length; index++) bytes[index] = binary.charCodeAt(index);
+  return bytes;
+}
+function randomToken(bytes) {
+  return toBase64Url(globalThis.crypto.getRandomValues(new Uint8Array(bytes)));
+}
+async function sha256(value) {
+  const digest = await globalThis.crypto.subtle.digest("SHA-256", encoder.encode(value));
+  return toBase64Url(new Uint8Array(digest));
+}
+async function aesKey(key) {
+  return globalThis.crypto.subtle.importKey("raw", fromBase64Url(key), "AES-GCM", false, [
+    "encrypt",
+    "decrypt"
+  ]);
+}
+async function sealJar(jar, key, deviceId) {
+  const iv = globalThis.crypto.getRandomValues(new Uint8Array(12));
+  const data = await globalThis.crypto.subtle.encrypt(
+    { name: "AES-GCM", iv, additionalData: encoder.encode(deviceId) },
+    await aesKey(key),
+    encoder.encode(JSON.stringify(jar))
+  );
+  return { iv: toBase64Url(iv), data: toBase64Url(new Uint8Array(data)) };
+}
+async function openJar(sealed, key, deviceId) {
+  try {
+    const data = await globalThis.crypto.subtle.decrypt(
+      { name: "AES-GCM", iv: fromBase64Url(sealed.iv), additionalData: encoder.encode(deviceId) },
+      await aesKey(key),
+      fromBase64Url(sealed.data)
+    );
+    const jar = JSON.parse(decoder.decode(data));
+    if (!jar || typeof jar !== "object" || Array.isArray(jar)) return null;
+    return Object.fromEntries(
+      Object.entries(jar).filter(
+        (entry) => typeof entry[1] === "string"
+      )
+    );
+  } catch (e) {
+    return null;
+  }
+}
+function formatToken(prefix, token) {
+  return `${prefix}.${token.deviceId}.${token.secret}.${token.key}`;
+}
+function parseFarmMobileToken(value, kind) {
+  if (typeof value !== "string" || value.length > 256) return null;
+  const parts = value.split(".");
+  if (parts.length !== 4 || parts[0] !== (kind === "access" ? ACCESS_PREFIX : REFRESH_PREFIX)) {
+    return null;
+  }
+  const [, deviceId, secret, key] = parts;
+  if (deviceId.length !== 22 || secret.length !== 43 || key.length !== 43) return null;
+  if (!BASE64URL.test(deviceId) || !BASE64URL.test(secret) || !BASE64URL.test(key)) return null;
+  return { deviceId, secret, key };
+}
+function readCookies(header) {
+  const cookies = {};
+  for (const part of (_nullishCoalesce(header, () => ( ""))).split(";")) {
+    const separator = part.indexOf("=");
+    if (separator <= 0) continue;
+    const name = part.slice(0, separator).trim();
+    if (!name || name === "__proto__" || name in cookies) continue;
+    cookies[name] = part.slice(separator + 1).trim();
+  }
+  return cookies;
+}
+function cookieHeader(jar) {
+  return Object.entries(jar).map(([name, value]) => `${name}=${value}`).join("; ");
+}
+function readSetCookies(headers, now) {
+  const changes = [];
+  for (const line of headers.getSetCookie()) {
+    const [pair = "", ...attributes] = line.split(";");
+    const separator = pair.indexOf("=");
+    if (separator <= 0) continue;
+    const name = pair.slice(0, separator).trim();
+    if (!name || name === "__proto__") continue;
+    let expired = false;
+    for (const attribute of attributes) {
+      const [rawKey = "", ...rest] = attribute.split("=");
+      const key = rawKey.trim().toLowerCase();
+      const value = rest.join("=").trim();
+      if (key === "max-age" && /^-?\d+$/.test(value)) expired = Number(value) <= 0;
+      if (key === "expires" && !attributes.some((item) => /^\s*max-age=/i.test(item))) {
+        const time = Date.parse(value);
+        if (!Number.isNaN(time) && time <= now) expired = true;
+      }
+    }
+    changes.push([name, expired ? null : pair.slice(separator + 1).trim()]);
+  }
+  return changes;
+}
+function applySetCookies(jar, changes) {
+  const next = { ...jar };
+  for (const [name, value] of changes) {
+    if (name === FARM_MOBILE_DEVICE_COOKIE) continue;
+    if (value === null) delete next[name];
+    else next[name] = value;
+  }
+  return next;
+}
+function json(body, status = 200, headers) {
+  const response = Response.json(body, { status, headers });
+  response.headers.set("cache-control", "no-store");
+  return response;
+}
+function failure(status, error, message) {
+  const response = json({ error, message }, status);
+  if (status === 401) {
+    response.headers.set("www-authenticate", `Bearer error="invalid_token"`);
+  }
+  return response;
+}
+function isFarmMobileNativeRequest(request) {
+  return !BROWSER_HEADERS.some((name) => request.headers.has(name));
+}
+function readAppId(request) {
+  const value = _optionalChain([request, 'access', _ => _.headers, 'access', _2 => _2.get, 'call', _3 => _3(FARM_MOBILE_APP_HEADER), 'optionalAccess', _4 => _4.trim, 'call', _5 => _5()]);
+  return value && value.length <= 255 && APP_ID.test(value) ? value : null;
+}
+function bearer(request) {
+  const header = request.headers.get("authorization");
+  if (!header) return null;
+  const match = /^bearer\s+(\S+)$/i.exec(header.trim());
+  return match ? match[1] : null;
+}
+var SessionReadError = class extends Error {
+  constructor(message, reason) {
+    super(message);
+    this.reason = reason;
+  }
+};
+function createFarmMobileSessionPlugin(options) {
+  const basePath = options.basePath && options.basePath !== "/" ? options.basePath : "";
+  const accessTtl = (_nullishCoalesce(options.accessTokenTtl, () => ( 15 * 60))) * 1e3;
+  const refreshTtl = (_nullishCoalesce(options.refreshTokenTtl, () => ( 30 * 24 * 60 * 60))) * 1e3;
+  const nonceTtl = (_nullishCoalesce(options.nonceTtl, () => ( 60))) * 1e3;
+  const now = _nullishCoalesce(options.now, () => ( Date.now));
+  const store = () => _nullishCoalesce(_optionalChain([options, 'access', _6 => _6.storage, 'optionalCall', _7 => _7()]), () => ( _chunkJMYXO572cjs.getStorage.call(void 0, STORAGE_NAMESPACE)));
+  let warnedNoReader = false;
+  function sessionReader() {
+    for (const integration of Object.values(_nullishCoalesce(options.integrations(), () => ( {})))) {
+      const session = _optionalChain([integration, 'optionalAccess', _8 => _8.session]);
+      if (typeof session === "function") {
+        return (request) => session.call(integration, request);
+      }
+    }
+    return null;
+  }
+  async function readSession(reader, url, cookies) {
+    const header = cookieHeader(cookies);
+    if (!header) return null;
+    let session;
+    try {
+      session = await reader(new Request(url, { headers: { cookie: header } }));
+    } catch (error) {
+      throw new SessionReadError("The auth integration's session() failed", error);
+    }
+    const id = _optionalChain([session, 'optionalAccess', _9 => _9.id]);
+    return typeof id === "string" && id ? session : null;
+  }
+  function noReader() {
+    if (!warnedNoReader) {
+      warnedNoReader = true;
+      console.warn(
+        "[Farm] Mobile session tokens need an auth integration that reads sessions (`session()`): @farm.js/auth (`auth: true`) or @farm.js/better-auth. No configured integration has one, so native screens stay signed out."
+      );
+    }
+    return failure(
+      501,
+      "mobile_session_unavailable",
+      "No auth integration in this app reads sessions for mobile tokens."
+    );
+  }
+  function markerCookie(request, value, maxAge) {
+    const secure = new URL(request.url).protocol === "https:" ? "; Secure" : "";
+    return `${FARM_MOBILE_DEVICE_COOKIE}=${value}; Path=${basePath || "/"}; Max-Age=${maxAge}; HttpOnly; SameSite=Lax${secure}`;
+  }
+  async function loadDevice(deviceId) {
+    const record = await store().getItem(`device:${deviceId}`);
+    return record && record.v === 1 ? record : null;
+  }
+  async function saveDevice(deviceId, record) {
+    await store().setItem(`device:${deviceId}`, record);
+  }
+  async function revokeDevice(deviceId) {
+    await store().removeItem(`device:${deviceId}`);
+  }
+  async function challengeKey(sessionId, appId) {
+    return `challenge:${await sha256(`${sessionId}
+${appId}`)}`;
+  }
+  async function issueTokens(deviceId, key, base, jar) {
+    const access = { deviceId, secret: randomToken(32), key };
+    const refresh2 = { deviceId, secret: randomToken(32), key };
+    const issuedAt = now();
+    const record = {
+      ...base,
+      accessHash: await sha256(access.secret),
+      accessExpiresAt: issuedAt + accessTtl,
+      refreshHash: await sha256(refresh2.secret),
+      refreshExpiresAt: issuedAt + refreshTtl,
+      jar: await sealJar(jar, key, deviceId)
+    };
+    await saveDevice(deviceId, record);
+    return {
+      record,
+      body: {
+        tokenType: "Bearer",
+        accessToken: formatToken(ACCESS_PREFIX, access),
+        refreshToken: formatToken(REFRESH_PREFIX, refresh2),
+        expiresIn: Math.floor(accessTtl / 1e3),
+        refreshExpiresIn: Math.floor(refreshTtl / 1e3)
+      }
+    };
+  }
+  function guardEndpoint(request) {
+    if (request.method !== "POST") {
+      return new Response("Method Not Allowed", {
+        status: 405,
+        headers: { allow: "POST", "cache-control": "no-store" }
+      });
+    }
+    if (!isFarmMobileNativeRequest(request)) {
+      return failure(403, "not_native", "Mobile session endpoints answer the app's shell only.");
+    }
+    const appId = readAppId(request);
+    if (!appId) {
+      return failure(400, "invalid_app", `Send the app's mobile.id in ${FARM_MOBILE_APP_HEADER}.`);
+    }
+    return { appId };
+  }
+  async function challenge(request) {
+    const guard = guardEndpoint(request);
+    if (guard instanceof Response) return guard;
+    const reader = sessionReader();
+    if (!reader) return noReader();
+    const cookies = readCookies(request.headers.get("cookie"));
+    delete cookies[FARM_MOBILE_DEVICE_COOKIE];
+    const session = await readSession(reader, request.url, cookies);
+    if (!session) return failure(401, "signed_out", "Sign in on a web screen first.");
+    const nonce = randomToken(32);
+    await store().setItem(await challengeKey(session.id, guard.appId), {
+      hash: await sha256(nonce),
+      expiresAt: now() + nonceTtl
+    });
+    return json({ nonce, expiresIn: Math.floor(nonceTtl / 1e3) });
+  }
+  async function issue(request) {
+    const guard = guardEndpoint(request);
+    if (guard instanceof Response) return guard;
+    const reader = sessionReader();
+    if (!reader) return noReader();
+    const nonce = _nullishCoalesce(_optionalChain([request, 'access', _10 => _10.headers, 'access', _11 => _11.get, 'call', _12 => _12(FARM_MOBILE_NONCE_HEADER), 'optionalAccess', _13 => _13.trim, 'call', _14 => _14()]), () => ( ""));
+    const cookies = readCookies(request.headers.get("cookie"));
+    delete cookies[FARM_MOBILE_DEVICE_COOKIE];
+    const session = await readSession(reader, request.url, cookies);
+    if (!session) return failure(401, "signed_out", "Sign in on a web screen first.");
+    const key = await challengeKey(session.id, guard.appId);
+    const pending = await store().getItem(key);
+    if (pending) await store().removeItem(key);
+    if (!pending || pending.expiresAt <= now() || !nonce || !_chunkSHIWRBFIcjs.farmSecretsMatch.call(void 0, await sha256(nonce), pending.hash)) {
+      return failure(401, "invalid_nonce", "Request a new challenge and try again.");
+    }
+    const deviceId = randomToken(16);
+    const { body: tokens } = await issueTokens(
+      deviceId,
+      randomToken(32),
+      {
+        v: 1,
+        appId: guard.appId,
+        sessionHash: await sha256(session.id),
+        createdAt: now(),
+        usedRefreshHashes: []
+      },
+      cookies
+    );
+    const response = json(tokens);
+    response.headers.append(
+      "set-cookie",
+      markerCookie(request, deviceId, Math.floor(refreshTtl / 1e3))
+    );
+    return response;
+  }
+  async function refresh(request) {
+    const guard = guardEndpoint(request);
+    if (guard instanceof Response) return guard;
+    const reader = sessionReader();
+    if (!reader) return noReader();
+    const token = parseFarmMobileToken(bearer(request), "refresh");
+    if (!token) return failure(401, "invalid_token", "Unknown refresh token.");
+    const record = await loadDevice(token.deviceId);
+    if (!record) return failure(401, "invalid_token", "Unknown refresh token.");
+    if (record.appId !== guard.appId) {
+      return failure(401, "invalid_token", "The token belongs to another app.");
+    }
+    const hash = await sha256(token.secret);
+    if (!_chunkSHIWRBFIcjs.farmSecretsMatch.call(void 0, hash, record.refreshHash)) {
+      if (record.usedRefreshHashes.some((used) => _chunkSHIWRBFIcjs.farmSecretsMatch.call(void 0, hash, used))) {
+        await revokeDevice(token.deviceId);
+        return failure(401, "refresh_reused", "The refresh token was already used.");
+      }
+      return failure(401, "invalid_token", "Unknown refresh token.");
+    }
+    if (record.refreshExpiresAt <= now()) {
+      await revokeDevice(token.deviceId);
+      return failure(401, "invalid_token", "The refresh token expired.");
+    }
+    const jar = await openJar(record.jar, token.key, token.deviceId);
+    if (!jar) return failure(401, "invalid_token", "Unknown refresh token.");
+    let session;
+    try {
+      session = await readSession(reader, request.url, jar);
+    } catch (error) {
+      console.error("[Farm] Mobile session refresh could not read the session:", error);
+      return failure(503, "session_unavailable", "Try again later.");
+    }
+    if (!session || await sha256(session.id) !== record.sessionHash) {
+      await revokeDevice(token.deviceId);
+      return failure(401, "signed_out", "The web session behind this device ended.");
+    }
+    const { body: tokens } = await issueTokens(
+      token.deviceId,
+      randomToken(32),
+      {
+        v: 1,
+        appId: record.appId,
+        sessionHash: record.sessionHash,
+        createdAt: record.createdAt,
+        usedRefreshHashes: [record.refreshHash, ...record.usedRefreshHashes].slice(
+          0,
+          USED_REFRESH_LIMIT
+        )
+      },
+      jar
+    );
+    const response = json(tokens);
+    response.headers.append(
+      "set-cookie",
+      markerCookie(request, token.deviceId, Math.floor(refreshTtl / 1e3))
+    );
+    return response;
+  }
+  async function revoke(request) {
+    const guard = guardEndpoint(request);
+    if (guard instanceof Response) return guard;
+    const access = parseFarmMobileToken(bearer(request), "access");
+    const token = _nullishCoalesce(access, () => ( parseFarmMobileToken(bearer(request), "refresh")));
+    if (token) {
+      const record = await loadDevice(token.deviceId);
+      const hash = await sha256(token.secret);
+      if (record && record.appId === guard.appId && _chunkSHIWRBFIcjs.farmSecretsMatch.call(void 0, hash, access ? record.accessHash : record.refreshHash)) {
+        await revokeDevice(token.deviceId);
+      }
+    }
+    const response = new Response(null, { status: 204, headers: { "cache-control": "no-store" } });
+    response.headers.append("set-cookie", markerCookie(request, "", 0));
+    return response;
+  }
+  async function before(event) {
+    const { request } = event;
+    const value = bearer(request);
+    if (!_optionalChain([value, 'optionalAccess', _15 => _15.startsWith, 'call', _16 => _16(`${ACCESS_PREFIX}.`)])) return void 0;
+    if (!isFarmMobileNativeRequest(request)) return void 0;
+    const token = parseFarmMobileToken(value, "access");
+    if (!token) return failure(401, "invalid_token", "Unknown access token.");
+    const appId = readAppId(request);
+    const record = await loadDevice(token.deviceId);
+    const hash = await sha256(token.secret);
+    if (!record || !_chunkSHIWRBFIcjs.farmSecretsMatch.call(void 0, hash, record.accessHash)) {
+      return failure(401, "invalid_token", "Unknown access token.");
+    }
+    if (!appId || appId !== record.appId) {
+      return failure(401, "invalid_token", "The token belongs to another app.");
+    }
+    if (record.accessExpiresAt <= now()) {
+      return failure(401, "invalid_token", "The access token expired.");
+    }
+    const jar = await openJar(record.jar, token.key, token.deviceId);
+    if (!jar) return failure(401, "invalid_token", "Unknown access token.");
+    const headers = new Headers(request.headers);
+    headers.delete("authorization");
+    headers.delete("cookie");
+    const cookies = cookieHeader(jar);
+    if (cookies) headers.set("cookie", cookies);
+    headers.set("origin", new URL(request.url).origin);
+    event.req.set(STATE_KEY, {
+      deviceId: token.deviceId,
+      key: token.key,
+      accessHash: record.accessHash
+    });
+    return new Request(request, { headers });
+  }
+  async function after(event) {
+    const state = event.req.get(STATE_KEY);
+    if (state) return afterBearer(event.request, event.response, state);
+    const cookie = event.request.headers.get("cookie");
+    if (!_optionalChain([cookie, 'optionalAccess', _17 => _17.includes, 'call', _18 => _18(`${FARM_MOBILE_DEVICE_COOKIE}=`)])) return void 0;
+    return afterWebScreen(event.request, event.response);
+  }
+  async function afterBearer(request, response, state) {
+    const changes = readSetCookies(response.headers, now());
+    const headers = new Headers(response.headers);
+    headers.delete("set-cookie");
+    headers.set("cache-control", "private, no-store");
+    if (changes.length > 0) {
+      const record = await loadDevice(state.deviceId);
+      if (record && _chunkSHIWRBFIcjs.farmSecretsMatch.call(void 0, state.accessHash, record.accessHash)) {
+        const jar = await openJar(record.jar, state.key, state.deviceId);
+        if (jar) {
+          const next = applySetCookies(jar, changes);
+          const reader = sessionReader();
+          let signedOut = false;
+          if (reader && changes.some(([, value]) => value === null)) {
+            signedOut = await readSession(reader, request.url, next).then(
+              async (session) => !session || await sha256(session.id) !== record.sessionHash,
+              () => false
+            );
+          }
+          if (signedOut) await revokeDevice(state.deviceId);
+          else
+            await saveDevice(state.deviceId, {
+              ...record,
+              jar: await sealJar(next, state.key, state.deviceId)
+            });
+        }
+      }
+    }
+    return new Response(response.body, {
+      status: response.status,
+      statusText: response.statusText,
+      headers
+    });
+  }
+  async function afterWebScreen(request, response) {
+    const changes = readSetCookies(response.headers, now());
+    if (!changes.some(([, value]) => value === null)) return void 0;
+    const cookies = readCookies(request.headers.get("cookie"));
+    const deviceId = cookies[FARM_MOBILE_DEVICE_COOKIE];
+    if (!deviceId || deviceId.length !== 22 || !BASE64URL.test(deviceId)) return void 0;
+    const reader = sessionReader();
+    if (!reader) return void 0;
+    delete cookies[FARM_MOBILE_DEVICE_COOKIE];
+    const signedOut = await readSession(
+      reader,
+      request.url,
+      applySetCookies(cookies, changes)
+    ).then(
+      (session) => !session,
+      () => false
+    );
+    if (!signedOut) return void 0;
+    await revokeDevice(deviceId);
+    const headers = new Headers(response.headers);
+    headers.append("set-cookie", markerCookie(request, "", 0));
+    return new Response(response.body, {
+      status: response.status,
+      statusText: response.statusText,
+      headers
+    });
+  }
+  const endpoint = (path, handler) => ({
+    path,
+    handler: (event) => handler(event.request).catch((error) => {
+      if (error instanceof SessionReadError) {
+        console.error("[Farm] Mobile session endpoint could not read the session:", error.reason);
+        return failure(503, "session_unavailable", "Try again later.");
+      }
+      throw error;
+    })
+  });
+  return {
+    name: FARM_MOBILE_SESSION_PLUGIN,
+    // Before app plugins, so their hooks see the signed-in request.
+    enforce: "pre",
+    runtime: {
+      // `before` changes only requests with a mobile bearer, and `after` marks those private.
+      // Every other response stays as cacheable as it was.
+      cache: "public",
+      endpoints: [
+        endpoint(`${FARM_MOBILE_SESSION_PATH}/challenge`, challenge),
+        endpoint(FARM_MOBILE_SESSION_PATH, issue),
+        endpoint(`${FARM_MOBILE_SESSION_PATH}/refresh`, refresh),
+        endpoint(`${FARM_MOBILE_SESSION_PATH}/revoke`, revoke)
+      ],
+      before,
+      after
+    }
+  };
+}
+
+
+
+
+
+
+
+
+
+
+exports.FARM_MOBILE_SESSION_PLUGIN = FARM_MOBILE_SESSION_PLUGIN; exports.FARM_MOBILE_SESSION_PATH = FARM_MOBILE_SESSION_PATH; exports.FARM_MOBILE_APP_HEADER = FARM_MOBILE_APP_HEADER; exports.FARM_MOBILE_NONCE_HEADER = FARM_MOBILE_NONCE_HEADER; exports.FARM_MOBILE_DEVICE_COOKIE = FARM_MOBILE_DEVICE_COOKIE; exports.parseFarmMobileToken = parseFarmMobileToken; exports.isFarmMobileNativeRequest = isFarmMobileNativeRequest; exports.createFarmMobileSessionPlugin = createFarmMobileSessionPlugin;

package/dist/{chunk-OD6WM3I7.mjs → chunk-AV26KHTG.mjs}

@@ -29,7 +29,7 @@ import {
 } from "./chunk-F3N52U7S.mjs";
 import {
   getIntegrationSchemas
-} from "./chunk-HHFMECFO.mjs";
+} from "./chunk-Y2G5SJFB.mjs";
 
 // src/schema-dependencies.ts
 function collectSchemaDependencies(owners) {