@mcp-b/do-runtime 0.1.0

package/dist/chunks/sqlite-DFg92Tgt.js

@@ -0,0 +1,498 @@
+//#region src/util/sqlite.ts
+var SQL_WRONG_BINDINGS_MESSAGE = "Wrong number of parameter bindings for SQL query.";
+/** ← `SQLITE_LIMIT_LENGTH`, raised from 2.2 MB to 4 MiB in workerd 2026-08-20. */
+var SQLITE_LENGTH_LIMIT = 4194304;
+var SQLITE_TOOBIG_MESSAGE = "string or blob too big: SQLITE_TOOBIG";
+var textEncoder = new TextEncoder();
+/** The part of `sqlite3_limit(SQLITE_LIMIT_LENGTH)` visible at the JS binding seam. */
+function requireSqliteLength(value) {
+	if ((typeof value === "string" ? textEncoder.encode(value).byteLength : value instanceof Uint8Array ? value.byteLength : 0) > 4194304) throw new Error(SQLITE_TOOBIG_MESSAGE);
+}
+var SQL_PRELUDE_BINDINGS_MESSAGE = "When executing multiple SQL statements in a single call, only the last statement can have parameters.";
+var SAFE_DATABASE_NAME = /^[A-Za-z0-9_-]+$/;
+var SQLITE_HEADER = "SQLite format 3";
+function requireSafeDatabaseName(name) {
+	if (!SAFE_DATABASE_NAME.test(name)) throw new Error(`Database name is not a safe file name: ${name}`);
+}
+/** Validate the complete snapshot before a backend replaces any files. */
+function requireValidSqlDatabaseSnapshot(snapshot) {
+	const candidate = snapshot;
+	if (candidate === null || typeof candidate !== "object" || !("version" in candidate) || candidate.version !== 1 || !("databases" in candidate) || !Array.isArray(candidate.databases)) throw new Error("Unsupported SQLite snapshot format.");
+	const names = /* @__PURE__ */ new Set();
+	for (const database of candidate.databases) {
+		if (database === null || typeof database !== "object" || !("name" in database) || typeof database.name !== "string" || !("image" in database)) throw new Error("SQLite snapshot contains an invalid database entry.");
+		const { name, image } = database;
+		requireSafeDatabaseName(name);
+		if (names.has(name)) throw new Error(`SQLite snapshot contains duplicate database name: ${name}`);
+		names.add(name);
+		if (!(image instanceof Uint8Array) || image.byteLength < 512 || image.byteLength % 512 !== 0 || [...SQLITE_HEADER].some((character, index) => image[index] !== character.charCodeAt(0))) throw new Error(`Snapshot entry ${name} is not a valid SQLite database image.`);
+	}
+}
+/**
+* ← the state `SqliteDatabase::onCriticalError` reports and
+* `observedCriticalError()` latches.
+*
+* Raised when SQLite has rolled back an open transaction on its own. Upstream
+* hands this to `ActorSqlite`, which treats it as fatal; §1.6 is why — a
+* storage failure this severe destroys the object rather than being survived.
+* Until `io/actor-sqlite.ts` wires it to `onBroken`, latching it and refusing
+* every subsequent statement is what keeps a caller from reading through a
+* cache that is knowingly wrong.
+*/
+var SqliteCriticalError = class extends Error {
+	name = "SqliteCriticalError";
+};
+/** ← `SqliteDatabase::Query::isNull(uint column)`. */
+function isNull(row, column) {
+	return row[column] === null || row[column] === void 0;
+}
+/** ← `SqliteDatabase::Query::getBlob(uint column)`. Fails closed on any other column type. */
+function getBlob(row, column) {
+	const value = row[column];
+	if (value instanceof Uint8Array) return value;
+	throw new Error(`Expected a BLOB in column ${column}, got ${describe(value)}.`);
+}
+/** ← `SqliteDatabase::Query::getText(uint column)`. Fails closed on any other column type. */
+function getText(row, column) {
+	const value = row[column];
+	if (typeof value === "string") return value;
+	throw new Error(`Expected TEXT in column ${column}, got ${describe(value)}.`);
+}
+/**
+* ← `SqliteDatabase::Query::getInt64(uint column)`.
+*
+* Narrowed to a safe integer rather than upstream's `int64_t`: a JS number
+* cannot carry the full range, and a silently-rounded row id or alarm time is
+* exactly the kind of corruption this layer must not produce.
+*/
+function getInt64(row, column) {
+	const value = row[column];
+	if (typeof value === "number" && Number.isSafeInteger(value)) return value;
+	if (typeof value === "bigint") {
+		const narrowed = Number(value);
+		if (Number.isSafeInteger(narrowed) && BigInt(narrowed) === value) return narrowed;
+	}
+	throw new Error(`Expected a safe integer in column ${column}, got ${describe(value)}.`);
+}
+function describe(value) {
+	if (value === null) return "NULL";
+	if (value instanceof Uint8Array) return "a BLOB";
+	return `${typeof value} ${String(value)}`;
+}
+/**
+* ← `SqliteDatabase`, restricted to the members `sqlite-kv` and
+* `sqlite-metadata` actually call.
+*
+* The one piece of real machinery here is the transaction/savepoint stack that
+* `onRollback()` needs. Upstream learns of a `BEGIN` / `SAVEPOINT` / `COMMIT` /
+* `RELEASE` / `ROLLBACK` from the SQLite authorizer while the statement is
+* being compiled (`prepareSql` fills a `ParseContext::stateChange`); we have no
+* authorizer, so the statement text is the only source. `applyChange` below is
+* a line-for-line port of upstream's; only where the `StateChange` comes from
+* differs.
+*/
+var SqliteDatabase = class {
+	#backend;
+	#resetListeners = /* @__PURE__ */ new Set();
+	/** Callbacks registered with onRollback that haven't been committed nor rolled back yet. */
+	#rollbackCallbacks = [];
+	/** Savepoints that haven't been committed nor rolled back yet. */
+	#savepoints = [];
+	/** True if in a BEGIN TRANSACTION transaction. */
+	#inTransaction = false;
+	/** ← `criticalErrorOccurred`, holding the exception rather than a bool. */
+	#criticalError;
+	/** ← `onWriteCallback`. */
+	#onWriteCallback;
+	/** ← `onCriticalErrorCallback`. */
+	#onCriticalErrorCallback;
+	constructor(backend) {
+		this.#backend = backend;
+	}
+	/**
+	* Invokes the given callback whenever a query begins which may write to the
+	* database. The callback is called just before executing the query.
+	*
+	* Durable Objects uses this to automatically begin a transaction and close the
+	* output gate.
+	*
+	* Note that the write callback is NOT called before (or at any point during) a
+	* `reset()`. Use the `ResetListener` mechanism for that case.
+	*/
+	onWrite(callback) {
+		this.#onWriteCallback = callback;
+	}
+	/**
+	* Invokes the given callback when a "critical error" causes an automatic
+	* rollback during a transaction.
+	*
+	* See: https://www.sqlite.org/lang_transaction.html#response_to_errors_within_a_transaction
+	*
+	* Upstream passes `(errorMessage, maybeException)` and lets the caller build
+	* the exception; `#checkForAutoRollback` has already built one by the time it
+	* can tell a rollback happened, so the callback receives that.
+	*/
+	onCriticalError(callback) {
+		this.#onCriticalErrorCallback = callback;
+	}
+	/**
+	* Invoke the onWrite() callback.
+	*
+	* "This is useful when the caller is about to execute a statement which SQLite
+	* considers read-only, but needs to be considered a write for our purposes. In
+	* particular, we use the onWrite callback to start automatic transactions, and
+	* we use the SAVEPOINT statement to implement explicit transactions. For
+	* synchronous transactions, the explicit transaction needs to be nested inside
+	* the automatic transaction, so we need to force an auto-transaction to start
+	* before the SAVEPOINT."
+	*/
+	notifyWrite(allowUnconfirmed = false) {
+		this.#onWriteCallback?.(allowUnconfirmed);
+	}
+	run(first, ...rest) {
+		if (typeof first === "string") return this.#exec(first, rest, false);
+		const [sql, ...bindings] = rest;
+		if (typeof sql !== "string") throw new Error("run(options, sql, ...) takes a SQL string.");
+		return this.#exec(sql, bindings, first.allowUnconfirmed ?? false, first.regulate);
+	}
+	/** ← `SqliteDatabase::ingestSql`: execute complete statements, retain the partial tail. */
+	ingest(sql, regulate) {
+		this.assertUsable();
+		let remainder = sql;
+		let rowsRead = 0;
+		let rowsWritten = 0;
+		let statementCount = 0;
+		while (hasSqlStatement(remainder)) {
+			let statement;
+			try {
+				statement = this.#backend.prepare(remainder);
+			} catch (error) {
+				if (error instanceof Error && /incomplete input/i.test(error.message)) break;
+				throw error;
+			}
+			try {
+				if (!statement.sql.trimEnd().endsWith(";")) break;
+				regulate?.(statement.sql);
+				if (statement.parameterCount !== 0) throw new Error(SQL_WRONG_BINDINGS_MESSAGE);
+				const result = this.#execStatement(statement, [], false);
+				rowsRead += result.rawRows.length;
+				rowsWritten += result.rowsWritten;
+				statementCount += 1;
+				remainder = remainder.slice(statement.sql.length);
+			} finally {
+				statement.close();
+			}
+		}
+		return {
+			remainder,
+			rowsRead,
+			rowsWritten,
+			statementCount
+		};
+	}
+	#exec(sql, bindings, allowUnconfirmed, regulate) {
+		this.assertUsable();
+		let remaining = sql;
+		let result;
+		while (hasSqlStatement(remaining)) {
+			const statement = this.#backend.prepare(remaining);
+			const tail = remaining.slice(statement.sql.length);
+			const isFinal = !hasSqlStatement(tail);
+			try {
+				regulate?.(statement.sql);
+				if (!isFinal && statement.parameterCount !== 0) throw new Error(SQL_PRELUDE_BINDINGS_MESSAGE);
+				if (isFinal && statement.parameterCount !== bindings.length) throw new Error(SQL_WRONG_BINDINGS_MESSAGE);
+				result = this.#execStatement(statement, isFinal ? bindings : [], isFinal ? allowUnconfirmed : false);
+			} finally {
+				statement.close();
+			}
+			remaining = tail;
+		}
+		if (result === void 0) throw new Error("Expected at least one SQL statement.");
+		return result;
+	}
+	/** Execute one statement from `run()`'s batch; bindings and results belong to the last one. */
+	#execStatement(statement, bindings, allowUnconfirmed) {
+		const { sql } = statement;
+		const change = classify(sql);
+		if (isWrite(sql)) this.notifyWrite(allowUnconfirmed);
+		let result;
+		try {
+			result = statement.execute(bindings);
+		} catch (error) {
+			this.#checkForAutoRollback(error);
+			throw error;
+		}
+		this.#applyChange(change);
+		return result;
+	}
+	/**
+	* ← `SqliteDatabase::handleCriticalError`, which reaches the same conclusion
+	* from the error code plus `sqlite3_get_autocommit`. We do not see the error
+	* code — the backend has already turned it into a JS exception — so the
+	* disagreement between our stack and the backend's is the whole signal, and
+	* it is enough: we only ask after a statement has failed, and the only thing
+	* that closes a transaction without going through `run()` is SQLite itself.
+	*
+	* The callbacks are DISCARDED rather than invoked, which looks wrong for two
+	* lines and is not. Invoking them is only correct when a rollback actually
+	* happened, and the branch above is the sole case where that is knowable; in
+	* the ordinary case — a constraint violation, which does not roll anything
+	* back — firing them would restore a cache the database has moved past, which
+	* is corruption in the other direction. Upstream does not fire them here
+	* either. It makes the actor fatal instead, and so does this: the caches are
+	* knowingly stale, so the database is finished rather than repaired.
+	*/
+	#checkForAutoRollback(cause) {
+		if (!this.#inTransaction && this.#savepoints.length === 0) return;
+		if (this.#backend.inTransaction) return;
+		this.#inTransaction = false;
+		this.#savepoints = [];
+		this.#rollbackCallbacks = [];
+		const critical = new SqliteCriticalError("SQLite rolled back the open transaction in response to a critical error, so every in-memory view of this database is now stale and it can no longer be used.", { cause });
+		this.#criticalError = critical;
+		this.#onCriticalErrorCallback?.(critical);
+		throw critical;
+	}
+	/**
+	* ← `SqliteDatabase::observedCriticalError()`. The named state
+	* `io/actor-sqlite.ts` wires to `onBroken`, so it does not have to re-derive
+	* the condition from an exception it caught.
+	*/
+	observedCriticalError() {
+		return this.#criticalError;
+	}
+	/**
+	* The guard for any read this package serves from a cache rather than from a
+	* statement. Those are the only paths a latched critical error would not
+	* already stop, and they are exactly the paths whose answer is wrong once
+	* SQLite has rolled back underneath them.
+	*/
+	assertUsable() {
+		if (this.#criticalError !== void 0) throw this.#criticalError;
+	}
+	get databaseSize() {
+		return this.#backend.databaseSize;
+	}
+	/**
+	* ← `SqliteDatabase::onRollback`.
+	*
+	* "Register a callback which shall be called if the current transaction is
+	* rolled back. If the current transaction commits, then the callback is
+	* discarded without invoking it. [...] When a rollback occurs, callbacks are
+	* invoked in the reverse of the order in which they were registered."
+	*
+	* With nothing open there is nothing that can roll back, so the callback is
+	* dropped — upstream's `if (inTransaction || !savepoints.empty())`.
+	*/
+	onRollback(callback) {
+		if (this.#inTransaction || this.#savepoints.length > 0) this.#rollbackCallbacks.push(callback);
+	}
+	addResetListener(listener) {
+		this.#resetListeners.add(listener);
+	}
+	removeResetListener(listener) {
+		this.#resetListeners.delete(listener);
+	}
+	/** ← `SqliteDatabase::reset()`. */
+	reset() {
+		this.assertUsable();
+		if (this.#inTransaction || this.#savepoints.length > 0) throw new Error("can't reset() a database during a transaction");
+		for (const listener of this.#resetListeners) listener.beforeSqliteReset();
+		this.#backend.reset();
+	}
+	close() {
+		this.#backend.close();
+	}
+	/** ← `SqliteDatabase::applyChange`, ported statement for statement. */
+	#applyChange(change) {
+		switch (change.kind) {
+			case "none": break;
+			case "begin":
+				if (change.savepointName !== null) this.#savepoints.push({
+					name: change.savepointName,
+					rollbackCallbackIndex: this.#rollbackCallbacks.length
+				});
+				else {
+					assert(this.#savepoints.length === 0, "BEGIN TRANSACTION should have failed when savepoints are present?");
+					assert(!this.#inTransaction, "BEGIN TRANSACTION should have failed when already in a transaction?");
+					assert(this.#rollbackCallbacks.length === 0, "we shouldn't have been keeping rollback callbacks with no transaction open!");
+					this.#inTransaction = true;
+				}
+				break;
+			case "commit":
+				if (change.savepointName !== null) for (;;) {
+					const savepoint = this.#savepoints.pop();
+					assert(savepoint !== void 0, "released a savepoint that didn't exist?");
+					if (savepoint.name === change.savepointName) break;
+				}
+				else {
+					assert(this.#inTransaction, "COMMIT TRANSACTION without BEGIN TRANSACTION?");
+					this.#savepoints = [];
+					this.#inTransaction = false;
+				}
+				if (this.#savepoints.length === 0 && !this.#inTransaction) this.#rollbackCallbacks = [];
+				break;
+			case "rollback": if (change.savepointName !== null) for (;;) {
+				const savepoint = this.#savepoints[this.#savepoints.length - 1];
+				assert(savepoint !== void 0, "released a savepoint that didn't exist?");
+				if (savepoint.name === change.savepointName) {
+					this.#runRollbackCallbacksDownTo(savepoint.rollbackCallbackIndex);
+					break;
+				}
+				this.#savepoints.pop();
+			}
+			else {
+				assert(this.#inTransaction, "ROLLBACK TRANSACTION without BEGIN TRANSACTION?");
+				this.#savepoints = [];
+				this.#inTransaction = false;
+				this.#runRollbackCallbacksDownTo(0);
+			}
+		}
+	}
+	#runRollbackCallbacksDownTo(index) {
+		assert(this.#rollbackCallbacks.length >= index, "rollback callback stack shrank?");
+		while (this.#rollbackCallbacks.length > index) {
+			const callback = this.#rollbackCallbacks.pop();
+			assert(callback !== void 0, "rollback callback stack shrank?");
+			callback();
+		}
+	}
+};
+/**
+* Returns whether a runtime-owned table exists, and refuses any present shape
+* other than the one this release writes.
+*/
+function hasCurrentSqliteTable(db, name, createSql) {
+	const query = "SELECT type, sql FROM sqlite_master WHERE name = ? COLLATE NOCASE";
+	const rows = "run" in db ? db.run(query, name).rawRows : db.exec(query, [name]).rawRows;
+	const row = rows[0];
+	if (row === void 0) return false;
+	if (rows.length !== 1 || row[0] !== "table" || typeof row[1] !== "string" || normalizeSchemaSql(row[1]) !== normalizeSchemaSql(createSql)) throw new Error(`Incompatible @mcp-b/do-runtime storage schema for table "${name}". This release accepts only the current schema and does not migrate stored runtime data.`);
+	return true;
+}
+function normalizeSchemaSql(sql) {
+	return sql.replace(/\bIF\s+NOT\s+EXISTS\b/giu, "").replace(/\s+/gu, " ").trim().replace(/;$/u, "").toLowerCase();
+}
+function assert(condition, message) {
+	if (!condition) throw new Error(message);
+}
+var NO_CHANGE = { kind: "none" };
+/** SQLite savepoint names compare case-insensitively, so the stack stores them folded. */
+function savepointName(raw) {
+	return (raw.startsWith("\"") && raw.endsWith("\"") || raw.startsWith("'") && raw.endsWith("'") || raw.startsWith("`") && raw.endsWith("`") ? raw.slice(1, -1) : raw.startsWith("[") && raw.endsWith("]") ? raw.slice(1, -1) : raw).toLowerCase();
+}
+var NAME = String.raw`("[^"]*"|'[^']*'|\`[^\`]*\`|\[[^\]]*\]|[A-Za-z_][A-Za-z0-9_$]*)`;
+var BEGIN = new RegExp(String.raw`^BEGIN(\s+(DEFERRED|IMMEDIATE|EXCLUSIVE))?(\s+TRANSACTION)?$`, "i");
+var SAVEPOINT = new RegExp(String.raw`^SAVEPOINT\s+${NAME}$`, "i");
+var COMMIT = new RegExp(String.raw`^(COMMIT|END)(\s+TRANSACTION)?$`, "i");
+var RELEASE = new RegExp(String.raw`^RELEASE(\s+SAVEPOINT)?\s+${NAME}$`, "i");
+var ROLLBACK = new RegExp(String.raw`^ROLLBACK(\s+TRANSACTION)?$`, "i");
+var ROLLBACK_TO = new RegExp(String.raw`^ROLLBACK(\s+TRANSACTION)?\s+TO(\s+SAVEPOINT)?\s+${NAME}$`, "i");
+var TRANSACTION_KEYWORD = /^(BEGIN|COMMIT|END|ROLLBACK|SAVEPOINT|RELEASE)\b/i;
+/** Every group referenced below is mandatory in its pattern, so an absent one is a broken pattern. */
+function group(match, index) {
+	const value = match[index];
+	if (value === void 0) throw new Error(`SQL pattern group ${index} did not match: ${match[0]}`);
+	return value;
+}
+/**
+* Derives upstream's `StateChange` from the statement text.
+*
+* A statement that opens with a transaction keyword but does not match one of
+* the forms below throws rather than being classified as `NoChange`, since
+* guessing in that direction is what loses a rollback callback. `run()` asks
+* the backend to compile one native statement at a time and applies this state
+* change after each executes, matching workerd's `prepareMulti()` prelude.
+*/
+function classify(sql) {
+	const statement = stripLeadingTrivia(sql).trim().replace(/;$/, "").trimEnd();
+	const rollbackTo = ROLLBACK_TO.exec(statement);
+	if (rollbackTo !== null) return {
+		kind: "rollback",
+		savepointName: savepointName(group(rollbackTo, 3))
+	};
+	if (ROLLBACK.test(statement)) return {
+		kind: "rollback",
+		savepointName: null
+	};
+	const savepoint = SAVEPOINT.exec(statement);
+	if (savepoint !== null) return {
+		kind: "begin",
+		savepointName: savepointName(group(savepoint, 1))
+	};
+	if (BEGIN.test(statement)) return {
+		kind: "begin",
+		savepointName: null
+	};
+	const release = RELEASE.exec(statement);
+	if (release !== null) return {
+		kind: "commit",
+		savepointName: savepointName(group(release, 2))
+	};
+	if (COMMIT.test(statement)) return {
+		kind: "commit",
+		savepointName: null
+	};
+	if (TRANSACTION_KEYWORD.test(statement)) throw new Error(`Unrecognized transaction-control statement: ${statement}`);
+	return NO_CHANGE;
+}
+/**
+* ← `!sqlite3_stmt_readonly(statement)`, the test upstream's `onWrite` gate is
+* written against (`sqlite.c++:1562-1568`).
+*
+* It is NOT the authorizer — the authorizer never sees this question, and the
+* distinction is load bearing: `sqlite3_stmt_readonly()` reports BEGIN, COMMIT,
+* ROLLBACK, SAVEPOINT and RELEASE as read-only, which is why `notifyWrite()`
+* exists at all and why an automatic transaction's own `BEGIN` does not recurse
+* into the callback that issued it.
+*
+* Neither backend exposes the compiled statement, so the text is the only
+* source, and it fails closed the way `classify` does: **a statement is a write
+* unless it provably is not.** The complete read set is `SELECT` and `EXPLAIN`
+* plus the five transaction-control forms. `WITH`, `PRAGMA` and anything
+* unrecognised are writes, which costs a read-only CTE a transaction and an
+* output-gate lock it does not need, and cannot cost atomicity — which is the
+* only error this classification is allowed to make.
+*/
+function isWrite(sql) {
+	return !NON_WRITE_KEYWORDS.has(leadingKeyword(sql));
+}
+var NON_WRITE_KEYWORDS = /* @__PURE__ */ new Set([
+	"SELECT",
+	"EXPLAIN",
+	"BEGIN",
+	"COMMIT",
+	"END",
+	"ROLLBACK",
+	"SAVEPOINT",
+	"RELEASE"
+]);
+/** The first bare word, skipping whitespace and both comment forms. */
+function leadingKeyword(sql) {
+	return (/^[A-Za-z]+/.exec(stripLeadingTrivia(sql))?.[0] ?? "").toUpperCase();
+}
+function hasSqlStatement(sql) {
+	return stripLeadingTrivia(sql).trim().length > 0;
+}
+function stripLeadingTrivia(statement) {
+	let index = 0;
+	for (;;) {
+		while (index < statement.length && /\s/.test(statement.charAt(index))) index += 1;
+		if (statement[index] === "-" && statement[index + 1] === "-") {
+			const newline = statement.indexOf("\n", index);
+			index = newline === -1 ? statement.length : newline + 1;
+			continue;
+		}
+		if (statement[index] === "/" && statement[index + 1] === "*") {
+			const close = statement.indexOf("*/", index + 2);
+			index = close === -1 ? statement.length : close + 2;
+			continue;
+		}
+		return statement.slice(index);
+	}
+}
+//#endregion
+export { getInt64 as a, isNull as c, requireValidSqlDatabaseSnapshot as d, getBlob as i, requireSafeDatabaseName as l, SQL_WRONG_BINDINGS_MESSAGE as n, getText as o, SqliteDatabase as r, hasCurrentSqliteTable as s, SQLITE_LENGTH_LIMIT as t, requireSqliteLength as u };
+
+//# sourceMappingURL=sqlite-DFg92Tgt.js.map

package/dist/chunks/sqlite-DFg92Tgt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqlite-DFg92Tgt.js","names":["#backend","#resetListeners","#onWriteCallback","#onCriticalErrorCallback","#exec","#execStatement","#checkForAutoRollback","#applyChange","#inTransaction","#savepoints","#rollbackCallbacks","#criticalError","#runRollbackCallbacksDownTo"],"sources":["../../src/util/sqlite.ts"],"sourcesContent":["/**\n * ← workerd `src/workerd/util/sqlite.{h,c++}`\n *\n * The SQL backend port. Upstream's seam is the same one: `server.c++` opens\n * `<actor-id>.<facetId>.sqlite` and hands `ActorSqlite` a `SqliteDatabase`.\n *\n * Almost none of upstream's 3,768 lines are ours. `sqlite.{h,c++}` is workerd's\n * binding to the SQLite C API — statement caching, the VFS, regulators, the\n * authorizer, the memory-metering allocator. Underneath us that role is played\n * by `node:sqlite` and sqlite-wasm, which is the storage-backend adaptation the\n * design record sanctions: `io-gate.h` knows nothing about SQLite, `ActorSqlite`\n * calls into it, and that seam is upstream's rather than ours.\n *\n * So this file is two things stacked:\n *\n *  1. `SqlDatabase` / `SqlDatabaseProvider` — the backend seam. `backends/`\n *     implements it, and nothing above `util/` ever sees a driver type.\n *  2. `SqliteDatabase` — the small part of upstream's class that is genuinely\n *     ours, because the layers above call into it and a stateless exec interface\n *     cannot express it: `onRollback`, the transaction/savepoint stack it needs,\n *     `reset()` and its `ResetListener` notification, all three of which\n *     `sqlite-kv.c++` and `sqlite-metadata.c++` reach for; plus `onWrite`,\n *     `notifyWrite` and `onCriticalError`, which only `io/actor-sqlite.ts`\n *     reaches for. That last trio lives here rather than one directory up\n *     because it lives here upstream (`sqlite.h:240`, `:248`, `:267`): a\n *     callback slot is not actor knowledge, and a reader who finds `onWrite` in\n *     `sqlite.h` has to find it in this file too. Every consumer takes a\n *     `SqliteDatabase`, exactly as upstream's take a `SqliteDatabase&`.\n *\n * `transactionSync` is NOT here — it lives in `io/actor-sqlite.ts` as\n * SAVEPOINT/RELEASE with a depth counter, exactly as upstream has it. Today\n * both browser and Node adapters duplicate `BEGIN IMMEDIATE`, which is why a\n * nested call is a live SQLite error (§2.4). Moving it inward fixes that.\n *\n * Not ported, because the substrate has no equivalent: the `Regulator` /\n * authorizer machinery (there is no untrusted-SQL path in `util/`, and\n * `api/sql.ts` owns that question); `SqliteObserver` row-count billing, whose\n * counters are libsql `STMTSTATUS` extensions neither backend exposes;\n * `sqlite-metering.{h,c++}`, which swaps SQLite's process-wide allocator to\n * meter per-database memory — a C-API facility with no JS analogue; and the\n * point-in-time-recovery APIs, a named substrate boundary in the package README.\n *\n * Spec: §1.4, §2.4 in docs/decisions.md.\n */\n\n/** The four values SQLite itself accepts after public JSG-style conversion. */\nexport type SqlValue = string | number | null | Uint8Array;\n\nexport type SqlResult = {\n  readonly columnNames: readonly string[];\n  readonly rawRows: readonly (readonly unknown[])[];\n  /** Rows changed by this statement, including DML with `RETURNING`. */\n  readonly rowsWritten: number;\n};\n\n/** ← `SqliteDatabase::IngestResult`. */\nexport type SqlIngestResult = {\n  readonly remainder: string;\n  readonly rowsRead: number;\n  readonly rowsWritten: number;\n  readonly statementCount: number;\n};\n\n/**\n * One SQLite-compiled statement from the front of a SQL string.\n *\n * `sql` is the exact prefix SQLite consumed, including trigger bodies. Keeping\n * that boundary on the backend is what prevents JavaScript from inventing a\n * second, subtly different SQL grammar.\n */\nexport interface SqlDatabaseStatement {\n  readonly sql: string;\n  readonly parameterCount: number;\n  execute(params: readonly SqlValue[]): SqlResult;\n  close(): void;\n}\n\nexport const SQL_WRONG_BINDINGS_MESSAGE = \"Wrong number of parameter bindings for SQL query.\";\n\n/** ← `SQLITE_LIMIT_LENGTH`, raised from 2.2 MB to 4 MiB in workerd 2026-08-20. */\nexport const SQLITE_LENGTH_LIMIT = 4 * 1024 * 1024;\n\nexport const SQLITE_TOOBIG_MESSAGE = \"string or blob too big: SQLITE_TOOBIG\";\n\nconst textEncoder = new TextEncoder();\n\n/** The part of `sqlite3_limit(SQLITE_LIMIT_LENGTH)` visible at the JS binding seam. */\nexport function requireSqliteLength(value: unknown): void {\n  const length =\n    typeof value === \"string\"\n      ? textEncoder.encode(value).byteLength\n      : value instanceof Uint8Array\n        ? value.byteLength\n        : 0;\n  if (length > SQLITE_LENGTH_LIMIT) throw new Error(SQLITE_TOOBIG_MESSAGE);\n}\n\nexport const SQL_PRELUDE_BINDINGS_MESSAGE =\n  \"When executing multiple SQL statements in a single call, only the last statement can have \" +\n  \"parameters.\";\n\n/**\n * One open database. Synchronous exec, matching every substrate we have: in a\n * SQLite-backed Durable Object reads return a value rather than a promise\n * (§1.4), which is what makes the input gate cheap.\n */\nexport interface SqlDatabase {\n  /** Compile exactly the first statement, using SQLite's own statement boundary. */\n  prepare(sql: string): SqlDatabaseStatement;\n  exec(sql: string, params: readonly SqlValue[]): SqlResult;\n  readonly databaseSize: number;\n  /**\n   * ← `sqlite3_get_autocommit(db) == 0`, which is how upstream's\n   * `handleCriticalError` learns that SQLite rolled a transaction back on its\n   * own (`sqlite.c++:669-691`).\n   *\n   * SQLite auto-rolls-back on `SQLITE_FULL`, `SQLITE_IOERR`, `SQLITE_NOMEM` and\n   * `SQLITE_INTERRUPT`. Nothing announces it, so without this the savepoint\n   * stack above would keep believing a transaction is open and the rollback\n   * callbacks would never fire — a stale cache with nothing thrown, which is\n   * the one failure this layer must never produce.\n   */\n  readonly inTransaction: boolean;\n  /**\n   * ← `SqliteDatabase::reset()` — \"delete the underlying database file and\n   * create a new one in its place\", which is how upstream implements\n   * `deleteAll()`.\n   *\n   * On the backend rather than above it because only the backend knows how to\n   * recreate its own file, and because the alternative — enumerating and\n   * dropping every table — is the fragile dance today's `storage.ts` performs,\n   * complete with an FTS5 shadow-table ordering hazard its comment documents.\n   * The `SqlDatabase` reference stays valid across the call; what changes is\n   * the file behind it.\n   */\n  reset(): void;\n  close(): void;\n}\n\n/**\n * Opens databases within ONE actor's storage scope. The package derives the\n * names (`\"root\"`, `` `facet-${facetId}` ``); the host maps them onto files.\n * OPFS layout knowledge stays with the host — this package never reaches for\n * `navigator.storage`.\n */\nexport interface SqlDatabaseProvider {\n  open(name: string): Promise<SqlDatabase>;\n}\n\n/** A portable, host-owned image of every SQLite database in one actor storage scope. */\nexport type SqlDatabaseSnapshot = {\n  readonly version: 1;\n  readonly databases: readonly {\n    readonly name: string;\n    readonly image: Uint8Array;\n  }[];\n};\n\n/** Local backup/restore. This is deliberately not Cloudflare's time-indexed PITR service. */\nexport interface SqlDatabaseSnapshotProvider extends SqlDatabaseProvider {\n  /** Close every database opened through this provider before snapshot or placement teardown. */\n  close(): void;\n  exportSnapshot(): Promise<SqlDatabaseSnapshot>;\n  importSnapshot(snapshot: SqlDatabaseSnapshot): Promise<void>;\n}\n\nconst SAFE_DATABASE_NAME = /^[A-Za-z0-9_-]+$/;\nconst SQLITE_HEADER = \"SQLite format 3\";\n\nexport function requireSafeDatabaseName(name: string): void {\n  if (!SAFE_DATABASE_NAME.test(name)) {\n    throw new Error(`Database name is not a safe file name: ${name}`);\n  }\n}\n\n/** Validate the complete snapshot before a backend replaces any files. */\nexport function requireValidSqlDatabaseSnapshot(snapshot: SqlDatabaseSnapshot): void {\n  const candidate: unknown = snapshot;\n  if (\n    candidate === null ||\n    typeof candidate !== \"object\" ||\n    !(\"version\" in candidate) ||\n    candidate.version !== 1 ||\n    !(\"databases\" in candidate) ||\n    !Array.isArray(candidate.databases)\n  ) {\n    throw new Error(\"Unsupported SQLite snapshot format.\");\n  }\n  const names = new Set<string>();\n  for (const database of candidate.databases) {\n    if (\n      database === null ||\n      typeof database !== \"object\" ||\n      !(\"name\" in database) ||\n      typeof database.name !== \"string\" ||\n      !(\"image\" in database)\n    ) {\n      throw new Error(\"SQLite snapshot contains an invalid database entry.\");\n    }\n    const { name, image } = database;\n    requireSafeDatabaseName(name);\n    if (names.has(name)) {\n      throw new Error(`SQLite snapshot contains duplicate database name: ${name}`);\n    }\n    names.add(name);\n    if (\n      !(image instanceof Uint8Array) ||\n      image.byteLength < 512 ||\n      image.byteLength % 512 !== 0 ||\n      [...SQLITE_HEADER].some((character, index) => image[index] !== character.charCodeAt(0))\n    ) {\n      throw new Error(`Snapshot entry ${name} is not a valid SQLite database image.`);\n    }\n  }\n}\n\n/**\n * ← `SqliteDatabase::QueryOptions`. The C++ regulator pointer is narrowed to\n * a callback over the exact SQL source SQLite compiled; `api/sql.ts` owns the\n * policy because this backend seam owns no public-API knowledge.\n *\n * `allowUnconfirmed`'s only destination is `onWrite(bool allowUnconfirmed)`,\n * which fires *before* the statement executes so the automatic transaction\n * opens first — see `isWrite` below for how a statement is known to be a write\n * without the compiled plan upstream reads it from.\n */\nexport type QueryOptions = {\n  allowUnconfirmed?: boolean;\n  /** The public SQL regulator, run once against each SQLite-compiled statement. */\n  regulate?: (sql: string) => void;\n};\n\n/**\n * ← the state `SqliteDatabase::onCriticalError` reports and\n * `observedCriticalError()` latches.\n *\n * Raised when SQLite has rolled back an open transaction on its own. Upstream\n * hands this to `ActorSqlite`, which treats it as fatal; §1.6 is why — a\n * storage failure this severe destroys the object rather than being survived.\n * Until `io/actor-sqlite.ts` wires it to `onBroken`, latching it and refusing\n * every subsequent statement is what keeps a caller from reading through a\n * cache that is knowingly wrong.\n */\nexport class SqliteCriticalError extends Error {\n  override readonly name = \"SqliteCriticalError\";\n}\n\n/**\n * ← `SqliteDatabase::ResetListener`.\n *\n * Upstream's is a base class whose constructor registers and whose destructor\n * unregisters. JS has neither, so registration is the explicit\n * `db.addResetListener(this)` call — the same translation Section 1 applied to\n * every kj destructor.\n */\nexport interface ResetListener {\n  /** Called before the database is actually reset. */\n  beforeSqliteReset(): void;\n}\n\n/** ← `SqliteDatabase::Query::isNull(uint column)`. */\nexport function isNull(row: readonly unknown[], column: number): boolean {\n  return row[column] === null || row[column] === undefined;\n}\n\n/** ← `SqliteDatabase::Query::getBlob(uint column)`. Fails closed on any other column type. */\nexport function getBlob(row: readonly unknown[], column: number): Uint8Array {\n  const value = row[column];\n  if (value instanceof Uint8Array) return value;\n  throw new Error(`Expected a BLOB in column ${column}, got ${describe(value)}.`);\n}\n\n/** ← `SqliteDatabase::Query::getText(uint column)`. Fails closed on any other column type. */\nexport function getText(row: readonly unknown[], column: number): string {\n  const value = row[column];\n  if (typeof value === \"string\") return value;\n  throw new Error(`Expected TEXT in column ${column}, got ${describe(value)}.`);\n}\n\n/**\n * ← `SqliteDatabase::Query::getInt64(uint column)`.\n *\n * Narrowed to a safe integer rather than upstream's `int64_t`: a JS number\n * cannot carry the full range, and a silently-rounded row id or alarm time is\n * exactly the kind of corruption this layer must not produce.\n */\nexport function getInt64(row: readonly unknown[], column: number): number {\n  const value = row[column];\n  if (typeof value === \"number\" && Number.isSafeInteger(value)) return value;\n  if (typeof value === \"bigint\") {\n    const narrowed = Number(value);\n    if (Number.isSafeInteger(narrowed) && BigInt(narrowed) === value) return narrowed;\n  }\n  throw new Error(`Expected a safe integer in column ${column}, got ${describe(value)}.`);\n}\n\nfunction describe(value: unknown): string {\n  if (value === null) return \"NULL\";\n  if (value instanceof Uint8Array) return \"a BLOB\";\n  return `${typeof value} ${String(value)}`;\n}\n\ntype Savepoint = {\n  name: string;\n  /** Size of `rollbackCallbacks` when this savepoint was created. */\n  rollbackCallbackIndex: number;\n};\n\n/**\n * ← `SqliteDatabase`, restricted to the members `sqlite-kv` and\n * `sqlite-metadata` actually call.\n *\n * The one piece of real machinery here is the transaction/savepoint stack that\n * `onRollback()` needs. Upstream learns of a `BEGIN` / `SAVEPOINT` / `COMMIT` /\n * `RELEASE` / `ROLLBACK` from the SQLite authorizer while the statement is\n * being compiled (`prepareSql` fills a `ParseContext::stateChange`); we have no\n * authorizer, so the statement text is the only source. `applyChange` below is\n * a line-for-line port of upstream's; only where the `StateChange` comes from\n * differs.\n */\nexport class SqliteDatabase {\n  readonly #backend: SqlDatabase;\n  readonly #resetListeners = new Set<ResetListener>();\n\n  /** Callbacks registered with onRollback that haven't been committed nor rolled back yet. */\n  #rollbackCallbacks: (() => void)[] = [];\n  /** Savepoints that haven't been committed nor rolled back yet. */\n  #savepoints: Savepoint[] = [];\n  /** True if in a BEGIN TRANSACTION transaction. */\n  #inTransaction = false;\n  /** ← `criticalErrorOccurred`, holding the exception rather than a bool. */\n  #criticalError: SqliteCriticalError | undefined;\n  /** ← `onWriteCallback`. */\n  #onWriteCallback: ((allowUnconfirmed: boolean) => void) | undefined;\n  /** ← `onCriticalErrorCallback`. */\n  #onCriticalErrorCallback: ((exception: SqliteCriticalError) => void) | undefined;\n\n  constructor(backend: SqlDatabase) {\n    this.#backend = backend;\n  }\n\n  /**\n   * Invokes the given callback whenever a query begins which may write to the\n   * database. The callback is called just before executing the query.\n   *\n   * Durable Objects uses this to automatically begin a transaction and close the\n   * output gate.\n   *\n   * Note that the write callback is NOT called before (or at any point during) a\n   * `reset()`. Use the `ResetListener` mechanism for that case.\n   */\n  onWrite(callback: (allowUnconfirmed: boolean) => void): void {\n    this.#onWriteCallback = callback;\n  }\n\n  /**\n   * Invokes the given callback when a \"critical error\" causes an automatic\n   * rollback during a transaction.\n   *\n   * See: https://www.sqlite.org/lang_transaction.html#response_to_errors_within_a_transaction\n   *\n   * Upstream passes `(errorMessage, maybeException)` and lets the caller build\n   * the exception; `#checkForAutoRollback` has already built one by the time it\n   * can tell a rollback happened, so the callback receives that.\n   */\n  onCriticalError(callback: (exception: SqliteCriticalError) => void): void {\n    this.#onCriticalErrorCallback = callback;\n  }\n\n  /**\n   * Invoke the onWrite() callback.\n   *\n   * \"This is useful when the caller is about to execute a statement which SQLite\n   * considers read-only, but needs to be considered a write for our purposes. In\n   * particular, we use the onWrite callback to start automatic transactions, and\n   * we use the SAVEPOINT statement to implement explicit transactions. For\n   * synchronous transactions, the explicit transaction needs to be nested inside\n   * the automatic transaction, so we need to force an auto-transaction to start\n   * before the SAVEPOINT.\"\n   */\n  notifyWrite(allowUnconfirmed = false): void {\n    this.#onWriteCallback?.(allowUnconfirmed);\n  }\n\n  /** ← `SqliteDatabase::run`, in both its bare and its `QueryOptions` form. */\n  run(sql: string, ...bindings: SqlValue[]): SqlResult;\n  run(options: QueryOptions, sql: string, ...bindings: SqlValue[]): SqlResult;\n  run(first: string | QueryOptions, ...rest: SqlValue[]): SqlResult {\n    if (typeof first === \"string\") return this.#exec(first, rest, false);\n\n    const [sql, ...bindings] = rest;\n    if (typeof sql !== \"string\") throw new Error(\"run(options, sql, ...) takes a SQL string.\");\n    return this.#exec(sql, bindings, first.allowUnconfirmed ?? false, first.regulate);\n  }\n\n  /** ← `SqliteDatabase::ingestSql`: execute complete statements, retain the partial tail. */\n  ingest(sql: string, regulate?: (sql: string) => void): SqlIngestResult {\n    this.assertUsable();\n    let remainder = sql;\n    let rowsRead = 0;\n    let rowsWritten = 0;\n    let statementCount = 0;\n\n    while (hasSqlStatement(remainder)) {\n      let statement: SqlDatabaseStatement;\n      try {\n        statement = this.#backend.prepare(remainder);\n      } catch (error) {\n        if (error instanceof Error && /incomplete input/i.test(error.message)) break;\n        throw error;\n      }\n      try {\n        // sqlite3_complete_length(), which upstream uses, requires the terminating semicolon.\n        if (!statement.sql.trimEnd().endsWith(\";\")) break;\n        regulate?.(statement.sql);\n        if (statement.parameterCount !== 0) throw new Error(SQL_WRONG_BINDINGS_MESSAGE);\n        const result = this.#execStatement(statement, [], false);\n        rowsRead += result.rawRows.length;\n        rowsWritten += result.rowsWritten;\n        statementCount += 1;\n        remainder = remainder.slice(statement.sql.length);\n      } finally {\n        statement.close();\n      }\n    }\n\n    return { remainder, rowsRead, rowsWritten, statementCount };\n  }\n\n  #exec(\n    sql: string,\n    bindings: readonly SqlValue[],\n    allowUnconfirmed: boolean,\n    regulate?: (sql: string) => void,\n  ): SqlResult {\n    this.assertUsable();\n\n    let remaining = sql;\n    let result: SqlResult | undefined;\n    while (hasSqlStatement(remaining)) {\n      const statement = this.#backend.prepare(remaining);\n      const tail = remaining.slice(statement.sql.length);\n      const isFinal = !hasSqlStatement(tail);\n      try {\n        regulate?.(statement.sql);\n        if (!isFinal && statement.parameterCount !== 0) {\n          throw new Error(SQL_PRELUDE_BINDINGS_MESSAGE);\n        }\n        if (isFinal && statement.parameterCount !== bindings.length) {\n          throw new Error(SQL_WRONG_BINDINGS_MESSAGE);\n        }\n        result = this.#execStatement(\n          statement,\n          isFinal ? bindings : [],\n          isFinal ? allowUnconfirmed : false,\n        );\n      } finally {\n        statement.close();\n      }\n      remaining = tail;\n    }\n    if (result === undefined) throw new Error(\"Expected at least one SQL statement.\");\n    return result;\n  }\n\n  /** Execute one statement from `run()`'s batch; bindings and results belong to the last one. */\n  #execStatement(\n    statement: SqlDatabaseStatement,\n    bindings: readonly SqlValue[],\n    allowUnconfirmed: boolean,\n  ): SqlResult {\n    const { sql } = statement;\n    const change = classify(sql);\n\n    // Before the statement runs, as upstream's `Query::checkRequirements` does: the callback opens\n    // the transaction this statement is about to write into, and it is also allowed to refuse the\n    // statement outright when whatever owns the transaction is already broken.\n    if (isWrite(sql)) this.notifyWrite(allowUnconfirmed);\n\n    let result: SqlResult;\n    try {\n      result = statement.execute(bindings);\n    } catch (error) {\n      this.#checkForAutoRollback(error);\n      throw error;\n    }\n    // Upstream applies the effect on the statement's first step, i.e. after it\n    // has actually run, so a statement that throws changes nothing.\n    this.#applyChange(change);\n    return result;\n  }\n\n  /**\n   * ← `SqliteDatabase::handleCriticalError`, which reaches the same conclusion\n   * from the error code plus `sqlite3_get_autocommit`. We do not see the error\n   * code — the backend has already turned it into a JS exception — so the\n   * disagreement between our stack and the backend's is the whole signal, and\n   * it is enough: we only ask after a statement has failed, and the only thing\n   * that closes a transaction without going through `run()` is SQLite itself.\n   *\n   * The callbacks are DISCARDED rather than invoked, which looks wrong for two\n   * lines and is not. Invoking them is only correct when a rollback actually\n   * happened, and the branch above is the sole case where that is knowable; in\n   * the ordinary case — a constraint violation, which does not roll anything\n   * back — firing them would restore a cache the database has moved past, which\n   * is corruption in the other direction. Upstream does not fire them here\n   * either. It makes the actor fatal instead, and so does this: the caches are\n   * knowingly stale, so the database is finished rather than repaired.\n   */\n  #checkForAutoRollback(cause: unknown): void {\n    if (!this.#inTransaction && this.#savepoints.length === 0) return;\n    if (this.#backend.inTransaction) return;\n\n    this.#inTransaction = false;\n    this.#savepoints = [];\n    this.#rollbackCallbacks = [];\n    const critical = new SqliteCriticalError(\n      \"SQLite rolled back the open transaction in response to a critical error, so every \" +\n        \"in-memory view of this database is now stale and it can no longer be used.\",\n      { cause },\n    );\n    this.#criticalError = critical;\n    this.#onCriticalErrorCallback?.(critical);\n    throw critical;\n  }\n\n  /**\n   * ← `SqliteDatabase::observedCriticalError()`. The named state\n   * `io/actor-sqlite.ts` wires to `onBroken`, so it does not have to re-derive\n   * the condition from an exception it caught.\n   */\n  observedCriticalError(): SqliteCriticalError | undefined {\n    return this.#criticalError;\n  }\n\n  /**\n   * The guard for any read this package serves from a cache rather than from a\n   * statement. Those are the only paths a latched critical error would not\n   * already stop, and they are exactly the paths whose answer is wrong once\n   * SQLite has rolled back underneath them.\n   */\n  assertUsable(): void {\n    if (this.#criticalError !== undefined) throw this.#criticalError;\n  }\n\n  get databaseSize(): number {\n    return this.#backend.databaseSize;\n  }\n\n  /**\n   * ← `SqliteDatabase::onRollback`.\n   *\n   * \"Register a callback which shall be called if the current transaction is\n   * rolled back. If the current transaction commits, then the callback is\n   * discarded without invoking it. [...] When a rollback occurs, callbacks are\n   * invoked in the reverse of the order in which they were registered.\"\n   *\n   * With nothing open there is nothing that can roll back, so the callback is\n   * dropped — upstream's `if (inTransaction || !savepoints.empty())`.\n   */\n  onRollback(callback: () => void): void {\n    if (this.#inTransaction || this.#savepoints.length > 0) {\n      this.#rollbackCallbacks.push(callback);\n    }\n  }\n\n  addResetListener(listener: ResetListener): void {\n    this.#resetListeners.add(listener);\n  }\n\n  removeResetListener(listener: ResetListener): void {\n    this.#resetListeners.delete(listener);\n  }\n\n  /** ← `SqliteDatabase::reset()`. */\n  reset(): void {\n    // Refused for the same reason `run()` is: the listeners below read their own\n    // state on the way out, and after a critical error that state is stale.\n    this.assertUsable();\n    // \"If transactions are open during reset(), whatever had the transaction\n    // open is going to get confused at best, or lose data at worst.\"\n    if (this.#inTransaction || this.#savepoints.length > 0) {\n      throw new Error(\"can't reset() a database during a transaction\");\n    }\n    for (const listener of this.#resetListeners) {\n      listener.beforeSqliteReset();\n    }\n    this.#backend.reset();\n  }\n\n  close(): void {\n    this.#backend.close();\n  }\n\n  /** ← `SqliteDatabase::applyChange`, ported statement for statement. */\n  #applyChange(change: StateChange): void {\n    switch (change.kind) {\n      case \"none\":\n        break;\n\n      case \"begin\":\n        if (change.savepointName !== null) {\n          this.#savepoints.push({\n            name: change.savepointName,\n            rollbackCallbackIndex: this.#rollbackCallbacks.length,\n          });\n        } else {\n          assert(\n            this.#savepoints.length === 0,\n            \"BEGIN TRANSACTION should have failed when savepoints are present?\",\n          );\n          assert(\n            !this.#inTransaction,\n            \"BEGIN TRANSACTION should have failed when already in a transaction?\",\n          );\n          assert(\n            this.#rollbackCallbacks.length === 0,\n            \"we shouldn't have been keeping rollback callbacks with no transaction open!\",\n          );\n          this.#inTransaction = true;\n        }\n        break;\n\n      case \"commit\":\n        if (change.savepointName !== null) {\n          // Per https://www.sqlite.org/lang_savepoint.html, releasing a savepoint also releases\n          // all later savepoints.\n          for (;;) {\n            const savepoint = this.#savepoints.pop();\n            assert(savepoint !== undefined, \"released a savepoint that didn't exist?\");\n            if (savepoint.name === change.savepointName) break;\n          }\n        } else {\n          assert(this.#inTransaction, \"COMMIT TRANSACTION without BEGIN TRANSACTION?\");\n          // Since BEGIN TRANSACTION cannot be nested within a savepoint, this must have released\n          // all savepoints implicitly.\n          this.#savepoints = [];\n          this.#inTransaction = false;\n        }\n        if (this.#savepoints.length === 0 && !this.#inTransaction) {\n          this.#rollbackCallbacks = [];\n        }\n        break;\n\n      case \"rollback\":\n        if (change.savepointName !== null) {\n          for (;;) {\n            const savepoint = this.#savepoints[this.#savepoints.length - 1];\n            assert(savepoint !== undefined, \"released a savepoint that didn't exist?\");\n            if (savepoint.name === change.savepointName) {\n              this.#runRollbackCallbacksDownTo(savepoint.rollbackCallbackIndex);\n              // Rolling back to a savepoint does not release it, so it stays on the stack and\n              // must be released separately.\n              break;\n            }\n            this.#savepoints.pop();\n          }\n        } else {\n          assert(this.#inTransaction, \"ROLLBACK TRANSACTION without BEGIN TRANSACTION?\");\n          this.#savepoints = [];\n          this.#inTransaction = false;\n          this.#runRollbackCallbacksDownTo(0);\n        }\n        break;\n    }\n  }\n\n  #runRollbackCallbacksDownTo(index: number): void {\n    assert(this.#rollbackCallbacks.length >= index, \"rollback callback stack shrank?\");\n    while (this.#rollbackCallbacks.length > index) {\n      // Upstream pops first and then invokes, so a callback that throws does not leave itself on\n      // the stack to be invoked a second time by the next rollback.\n      const callback = this.#rollbackCallbacks.pop();\n      assert(callback !== undefined, \"rollback callback stack shrank?\");\n      callback();\n    }\n  }\n}\n\ntype SqliteSchemaDatabase = Pick<SqlDatabase, \"exec\"> | Pick<SqliteDatabase, \"run\">;\n\n/**\n * Returns whether a runtime-owned table exists, and refuses any present shape\n * other than the one this release writes.\n */\nexport function hasCurrentSqliteTable(\n  db: SqliteSchemaDatabase,\n  name: string,\n  createSql: string,\n): boolean {\n  // SQLite identifiers are ASCII case-insensitive, so schema validation must\n  // find the same object that CREATE TABLE IF NOT EXISTS would collide with.\n  const query = \"SELECT type, sql FROM sqlite_master WHERE name = ? COLLATE NOCASE\";\n  const rows = \"run\" in db ? db.run(query, name).rawRows : db.exec(query, [name]).rawRows;\n  const row = rows[0];\n  if (row === undefined) return false;\n  if (\n    rows.length !== 1 ||\n    row[0] !== \"table\" ||\n    typeof row[1] !== \"string\" ||\n    normalizeSchemaSql(row[1]) !== normalizeSchemaSql(createSql)\n  ) {\n    throw new Error(\n      `Incompatible @mcp-b/do-runtime storage schema for table \"${name}\". ` +\n        \"This release accepts only the current schema and does not migrate stored runtime data.\",\n    );\n  }\n  return true;\n}\n\nfunction normalizeSchemaSql(sql: string): string {\n  return sql\n    .replace(/\\bIF\\s+NOT\\s+EXISTS\\b/giu, \"\")\n    .replace(/\\s+/gu, \" \")\n    .trim()\n    .replace(/;$/u, \"\")\n    .toLowerCase();\n}\n\nfunction assert(condition: boolean, message: string): asserts condition {\n  if (!condition) throw new Error(message);\n}\n\n/** ← `SqliteDatabase::StateChange`. */\ntype StateChange =\n  | { kind: \"none\" }\n  | { kind: \"begin\"; savepointName: string | null }\n  | { kind: \"commit\"; savepointName: string | null }\n  | { kind: \"rollback\"; savepointName: string | null };\n\nconst NO_CHANGE: StateChange = { kind: \"none\" };\n\n/** SQLite savepoint names compare case-insensitively, so the stack stores them folded. */\nfunction savepointName(raw: string): string {\n  const unquoted =\n    (raw.startsWith('\"') && raw.endsWith('\"')) ||\n    (raw.startsWith(\"'\") && raw.endsWith(\"'\")) ||\n    (raw.startsWith(\"`\") && raw.endsWith(\"`\"))\n      ? raw.slice(1, -1)\n      : raw.startsWith(\"[\") && raw.endsWith(\"]\")\n        ? raw.slice(1, -1)\n        : raw;\n  return unquoted.toLowerCase();\n}\n\nconst NAME = String.raw`(\"[^\"]*\"|'[^']*'|\\`[^\\`]*\\`|\\[[^\\]]*\\]|[A-Za-z_][A-Za-z0-9_$]*)`;\nconst BEGIN = new RegExp(\n  String.raw`^BEGIN(\\s+(DEFERRED|IMMEDIATE|EXCLUSIVE))?(\\s+TRANSACTION)?$`,\n  \"i\",\n);\nconst SAVEPOINT = new RegExp(String.raw`^SAVEPOINT\\s+${NAME}$`, \"i\");\nconst COMMIT = new RegExp(String.raw`^(COMMIT|END)(\\s+TRANSACTION)?$`, \"i\");\nconst RELEASE = new RegExp(String.raw`^RELEASE(\\s+SAVEPOINT)?\\s+${NAME}$`, \"i\");\nconst ROLLBACK = new RegExp(String.raw`^ROLLBACK(\\s+TRANSACTION)?$`, \"i\");\nconst ROLLBACK_TO = new RegExp(\n  String.raw`^ROLLBACK(\\s+TRANSACTION)?\\s+TO(\\s+SAVEPOINT)?\\s+${NAME}$`,\n  \"i\",\n);\nconst TRANSACTION_KEYWORD = /^(BEGIN|COMMIT|END|ROLLBACK|SAVEPOINT|RELEASE)\\b/i;\n\n/** Every group referenced below is mandatory in its pattern, so an absent one is a broken pattern. */\nfunction group(match: RegExpExecArray, index: number): string {\n  const value = match[index];\n  if (value === undefined) throw new Error(`SQL pattern group ${index} did not match: ${match[0]}`);\n  return value;\n}\n\n/**\n * Derives upstream's `StateChange` from the statement text.\n *\n * A statement that opens with a transaction keyword but does not match one of\n * the forms below throws rather than being classified as `NoChange`, since\n * guessing in that direction is what loses a rollback callback. `run()` asks\n * the backend to compile one native statement at a time and applies this state\n * change after each executes, matching workerd's `prepareMulti()` prelude.\n */\nfunction classify(sql: string): StateChange {\n  const statement = stripLeadingTrivia(sql).trim().replace(/;$/, \"\").trimEnd();\n\n  const rollbackTo = ROLLBACK_TO.exec(statement);\n  if (rollbackTo !== null) {\n    return { kind: \"rollback\", savepointName: savepointName(group(rollbackTo, 3)) };\n  }\n  if (ROLLBACK.test(statement)) return { kind: \"rollback\", savepointName: null };\n\n  const savepoint = SAVEPOINT.exec(statement);\n  if (savepoint !== null) {\n    return { kind: \"begin\", savepointName: savepointName(group(savepoint, 1)) };\n  }\n  if (BEGIN.test(statement)) return { kind: \"begin\", savepointName: null };\n\n  const release = RELEASE.exec(statement);\n  if (release !== null) {\n    return { kind: \"commit\", savepointName: savepointName(group(release, 2)) };\n  }\n  if (COMMIT.test(statement)) return { kind: \"commit\", savepointName: null };\n\n  if (TRANSACTION_KEYWORD.test(statement)) {\n    throw new Error(`Unrecognized transaction-control statement: ${statement}`);\n  }\n  return NO_CHANGE;\n}\n\n/**\n * ← `!sqlite3_stmt_readonly(statement)`, the test upstream's `onWrite` gate is\n * written against (`sqlite.c++:1562-1568`).\n *\n * It is NOT the authorizer — the authorizer never sees this question, and the\n * distinction is load bearing: `sqlite3_stmt_readonly()` reports BEGIN, COMMIT,\n * ROLLBACK, SAVEPOINT and RELEASE as read-only, which is why `notifyWrite()`\n * exists at all and why an automatic transaction's own `BEGIN` does not recurse\n * into the callback that issued it.\n *\n * Neither backend exposes the compiled statement, so the text is the only\n * source, and it fails closed the way `classify` does: **a statement is a write\n * unless it provably is not.** The complete read set is `SELECT` and `EXPLAIN`\n * plus the five transaction-control forms. `WITH`, `PRAGMA` and anything\n * unrecognised are writes, which costs a read-only CTE a transaction and an\n * output-gate lock it does not need, and cannot cost atomicity — which is the\n * only error this classification is allowed to make.\n */\nfunction isWrite(sql: string): boolean {\n  return !NON_WRITE_KEYWORDS.has(leadingKeyword(sql));\n}\n\nconst NON_WRITE_KEYWORDS = new Set([\n  \"SELECT\",\n  \"EXPLAIN\",\n  \"BEGIN\",\n  \"COMMIT\",\n  \"END\",\n  \"ROLLBACK\",\n  \"SAVEPOINT\",\n  \"RELEASE\",\n]);\n\n/** The first bare word, skipping whitespace and both comment forms. */\nfunction leadingKeyword(sql: string): string {\n  return (/^[A-Za-z]+/.exec(stripLeadingTrivia(sql))?.[0] ?? \"\").toUpperCase();\n}\n\nfunction hasSqlStatement(sql: string): boolean {\n  return stripLeadingTrivia(sql).trim().length > 0;\n}\n\nfunction stripLeadingTrivia(statement: string): string {\n  let index = 0;\n  for (;;) {\n    while (index < statement.length && /\\s/.test(statement.charAt(index))) index += 1;\n    if (statement[index] === \"-\" && statement[index + 1] === \"-\") {\n      const newline = statement.indexOf(\"\\n\", index);\n      index = newline === -1 ? statement.length : newline + 1;\n      continue;\n    }\n    if (statement[index] === \"/\" && statement[index + 1] === \"*\") {\n      const close = statement.indexOf(\"*/\", index + 2);\n      index = close === -1 ? statement.length : close + 2;\n      continue;\n    }\n    return statement.slice(index);\n  }\n}\n"],"mappings":";AA6EA,IAAa,6BAA6B;;AAG1C,IAAa,sBAAsB;AAEnC,IAAa,wBAAwB;AAErC,IAAM,cAAc,IAAI,YAAY;;AAGpC,SAAgB,oBAAoB,OAAsB;CAOxD,KALE,OAAO,UAAU,WACb,YAAY,OAAO,KAAK,CAAC,CAAC,aAC1B,iBAAiB,aACf,MAAM,aACN,KAAA,SAC0B,MAAM,IAAI,MAAM,qBAAqB;AACzE;AAEA,IAAa,+BACX;AAoEF,IAAM,qBAAqB;AAC3B,IAAM,gBAAgB;AAEtB,SAAgB,wBAAwB,MAAoB;CAC1D,IAAI,CAAC,mBAAmB,KAAK,IAAI,GAC/B,MAAM,IAAI,MAAM,0CAA0C,MAAM;AAEpE;;AAGA,SAAgB,gCAAgC,UAAqC;CACnF,MAAM,YAAqB;CAC3B,IACE,cAAc,QACd,OAAO,cAAc,YACrB,EAAE,aAAa,cACf,UAAU,YAAY,KACtB,EAAE,eAAe,cACjB,CAAC,MAAM,QAAQ,UAAU,SAAS,GAElC,MAAM,IAAI,MAAM,qCAAqC;CAEvD,MAAM,wBAAQ,IAAI,IAAY;CAC9B,KAAK,MAAM,YAAY,UAAU,WAAW;EAC1C,IACE,aAAa,QACb,OAAO,aAAa,YACpB,EAAE,UAAU,aACZ,OAAO,SAAS,SAAS,YACzB,EAAE,WAAW,WAEb,MAAM,IAAI,MAAM,qDAAqD;EAEvE,MAAM,EAAE,MAAM,UAAU;EACxB,wBAAwB,IAAI;EAC5B,IAAI,MAAM,IAAI,IAAI,GAChB,MAAM,IAAI,MAAM,qDAAqD,MAAM;EAE7E,MAAM,IAAI,IAAI;EACd,IACE,EAAE,iBAAiB,eACnB,MAAM,aAAa,OACnB,MAAM,aAAa,QAAQ,KAC3B,CAAC,GAAG,aAAa,CAAC,CAAC,MAAM,WAAW,UAAU,MAAM,WAAW,UAAU,WAAW,CAAC,CAAC,GAEtF,MAAM,IAAI,MAAM,kBAAkB,KAAK,uCAAuC;CAElF;AACF;;;;;;;;;;;;AA6BA,IAAa,sBAAb,cAAyC,MAAM;CAC7C,OAAyB;AAC3B;;AAgBA,SAAgB,OAAO,KAAyB,QAAyB;CACvE,OAAO,IAAI,YAAY,QAAQ,IAAI,YAAY,KAAA;AACjD;;AAGA,SAAgB,QAAQ,KAAyB,QAA4B;CAC3E,MAAM,QAAQ,IAAI;CAClB,IAAI,iBAAiB,YAAY,OAAO;CACxC,MAAM,IAAI,MAAM,6BAA6B,OAAO,QAAQ,SAAS,KAAK,EAAE,EAAE;AAChF;;AAGA,SAAgB,QAAQ,KAAyB,QAAwB;CACvE,MAAM,QAAQ,IAAI;CAClB,IAAI,OAAO,UAAU,UAAU,OAAO;CACtC,MAAM,IAAI,MAAM,2BAA2B,OAAO,QAAQ,SAAS,KAAK,EAAE,EAAE;AAC9E;;;;;;;;AASA,SAAgB,SAAS,KAAyB,QAAwB;CACxE,MAAM,QAAQ,IAAI;CAClB,IAAI,OAAO,UAAU,YAAY,OAAO,cAAc,KAAK,GAAG,OAAO;CACrE,IAAI,OAAO,UAAU,UAAU;EAC7B,MAAM,WAAW,OAAO,KAAK;EAC7B,IAAI,OAAO,cAAc,QAAQ,KAAK,OAAO,QAAQ,MAAM,OAAO,OAAO;CAC3E;CACA,MAAM,IAAI,MAAM,qCAAqC,OAAO,QAAQ,SAAS,KAAK,EAAE,EAAE;AACxF;AAEA,SAAS,SAAS,OAAwB;CACxC,IAAI,UAAU,MAAM,OAAO;CAC3B,IAAI,iBAAiB,YAAY,OAAO;CACxC,OAAO,GAAG,OAAO,MAAM,GAAG,OAAO,KAAK;AACxC;;;;;;;;;;;;;AAoBA,IAAa,iBAAb,MAA4B;CAC1B;CACA,kCAA2B,IAAI,IAAmB;;CAGlD,qBAAqC,CAAC;;CAEtC,cAA2B,CAAC;;CAE5B,iBAAiB;;CAEjB;;CAEA;;CAEA;CAEA,YAAY,SAAsB;EAChC,KAAKA,WAAW;CAClB;;;;;;;;;;;CAYA,QAAQ,UAAqD;EAC3D,KAAKE,mBAAmB;CAC1B;;;;;;;;;;;CAYA,gBAAgB,UAA0D;EACxE,KAAKC,2BAA2B;CAClC;;;;;;;;;;;;CAaA,YAAY,mBAAmB,OAAa;EAC1C,KAAKD,mBAAmB,gBAAgB;CAC1C;CAKA,IAAI,OAA8B,GAAG,MAA6B;EAChE,IAAI,OAAO,UAAU,UAAU,OAAO,KAAKE,MAAM,OAAO,MAAM,KAAK;EAEnE,MAAM,CAAC,KAAK,GAAG,YAAY;EAC3B,IAAI,OAAO,QAAQ,UAAU,MAAM,IAAI,MAAM,4CAA4C;EACzF,OAAO,KAAKA,MAAM,KAAK,UAAU,MAAM,oBAAoB,OAAO,MAAM,QAAQ;CAClF;;CAGA,OAAO,KAAa,UAAmD;EACrE,KAAK,aAAa;EAClB,IAAI,YAAY;EAChB,IAAI,WAAW;EACf,IAAI,cAAc;EAClB,IAAI,iBAAiB;EAErB,OAAO,gBAAgB,SAAS,GAAG;GACjC,IAAI;GACJ,IAAI;IACF,YAAY,KAAKJ,SAAS,QAAQ,SAAS;GAC7C,SAAS,OAAO;IACd,IAAI,iBAAiB,SAAS,oBAAoB,KAAK,MAAM,OAAO,GAAG;IACvE,MAAM;GACR;GACA,IAAI;IAEF,IAAI,CAAC,UAAU,IAAI,QAAQ,CAAC,CAAC,SAAS,GAAG,GAAG;IAC5C,WAAW,UAAU,GAAG;IACxB,IAAI,UAAU,mBAAmB,GAAG,MAAM,IAAI,MAAM,0BAA0B;IAC9E,MAAM,SAAS,KAAKK,eAAe,WAAW,CAAC,GAAG,KAAK;IACvD,YAAY,OAAO,QAAQ;IAC3B,eAAe,OAAO;IACtB,kBAAkB;IAClB,YAAY,UAAU,MAAM,UAAU,IAAI,MAAM;GAClD,UAAU;IACR,UAAU,MAAM;GAClB;EACF;EAEA,OAAO;GAAE;GAAW;GAAU;GAAa;EAAe;CAC5D;CAEA,MACE,KACA,UACA,kBACA,UACW;EACX,KAAK,aAAa;EAElB,IAAI,YAAY;EAChB,IAAI;EACJ,OAAO,gBAAgB,SAAS,GAAG;GACjC,MAAM,YAAY,KAAKL,SAAS,QAAQ,SAAS;GACjD,MAAM,OAAO,UAAU,MAAM,UAAU,IAAI,MAAM;GACjD,MAAM,UAAU,CAAC,gBAAgB,IAAI;GACrC,IAAI;IACF,WAAW,UAAU,GAAG;IACxB,IAAI,CAAC,WAAW,UAAU,mBAAmB,GAC3C,MAAM,IAAI,MAAM,4BAA4B;IAE9C,IAAI,WAAW,UAAU,mBAAmB,SAAS,QACnD,MAAM,IAAI,MAAM,0BAA0B;IAE5C,SAAS,KAAKK,eACZ,WACA,UAAU,WAAW,CAAC,GACtB,UAAU,mBAAmB,KAC/B;GACF,UAAU;IACR,UAAU,MAAM;GAClB;GACA,YAAY;EACd;EACA,IAAI,WAAW,KAAA,GAAW,MAAM,IAAI,MAAM,sCAAsC;EAChF,OAAO;CACT;;CAGA,eACE,WACA,UACA,kBACW;EACX,MAAM,EAAE,QAAQ;EAChB,MAAM,SAAS,SAAS,GAAG;EAK3B,IAAI,QAAQ,GAAG,GAAG,KAAK,YAAY,gBAAgB;EAEnD,IAAI;EACJ,IAAI;GACF,SAAS,UAAU,QAAQ,QAAQ;EACrC,SAAS,OAAO;GACd,KAAKC,sBAAsB,KAAK;GAChC,MAAM;EACR;EAGA,KAAKC,aAAa,MAAM;EACxB,OAAO;CACT;;;;;;;;;;;;;;;;;;CAmBA,sBAAsB,OAAsB;EAC1C,IAAI,CAAC,KAAKC,kBAAkB,KAAKC,YAAY,WAAW,GAAG;EAC3D,IAAI,KAAKT,SAAS,eAAe;EAEjC,KAAKQ,iBAAiB;EACtB,KAAKC,cAAc,CAAC;EACpB,KAAKC,qBAAqB,CAAC;EAC3B,MAAM,WAAW,IAAI,oBACnB,gKAEA,EAAE,MAAM,CACV;EACA,KAAKC,iBAAiB;EACtB,KAAKR,2BAA2B,QAAQ;EACxC,MAAM;CACR;;;;;;CAOA,wBAAyD;EACvD,OAAO,KAAKQ;CACd;;;;;;;CAQA,eAAqB;EACnB,IAAI,KAAKA,mBAAmB,KAAA,GAAW,MAAM,KAAKA;CACpD;CAEA,IAAI,eAAuB;EACzB,OAAO,KAAKX,SAAS;CACvB;;;;;;;;;;;;CAaA,WAAW,UAA4B;EACrC,IAAI,KAAKQ,kBAAkB,KAAKC,YAAY,SAAS,GACnD,KAAKC,mBAAmB,KAAK,QAAQ;CAEzC;CAEA,iBAAiB,UAA+B;EAC9C,KAAKT,gBAAgB,IAAI,QAAQ;CACnC;CAEA,oBAAoB,UAA+B;EACjD,KAAKA,gBAAgB,OAAO,QAAQ;CACtC;;CAGA,QAAc;EAGZ,KAAK,aAAa;EAGlB,IAAI,KAAKO,kBAAkB,KAAKC,YAAY,SAAS,GACnD,MAAM,IAAI,MAAM,+CAA+C;EAEjE,KAAK,MAAM,YAAY,KAAKR,iBAC1B,SAAS,kBAAkB;EAE7B,KAAKD,SAAS,MAAM;CACtB;CAEA,QAAc;EACZ,KAAKA,SAAS,MAAM;CACtB;;CAGA,aAAa,QAA2B;EACtC,QAAQ,OAAO,MAAf;GACE,KAAK,QACH;GAEF,KAAK;IACH,IAAI,OAAO,kBAAkB,MAC3B,KAAKS,YAAY,KAAK;KACpB,MAAM,OAAO;KACb,uBAAuB,KAAKC,mBAAmB;IACjD,CAAC;SACI;KACL,OACE,KAAKD,YAAY,WAAW,GAC5B,mEACF;KACA,OACE,CAAC,KAAKD,gBACN,qEACF;KACA,OACE,KAAKE,mBAAmB,WAAW,GACnC,6EACF;KACA,KAAKF,iBAAiB;IACxB;IACA;GAEF,KAAK;IACH,IAAI,OAAO,kBAAkB,MAG3B,SAAS;KACP,MAAM,YAAY,KAAKC,YAAY,IAAI;KACvC,OAAO,cAAc,KAAA,GAAW,yCAAyC;KACzE,IAAI,UAAU,SAAS,OAAO,eAAe;IAC/C;SACK;KACL,OAAO,KAAKD,gBAAgB,+CAA+C;KAG3E,KAAKC,cAAc,CAAC;KACpB,KAAKD,iBAAiB;IACxB;IACA,IAAI,KAAKC,YAAY,WAAW,KAAK,CAAC,KAAKD,gBACzC,KAAKE,qBAAqB,CAAC;IAE7B;GAEF,KAAK,YACH,IAAI,OAAO,kBAAkB,MAC3B,SAAS;IACP,MAAM,YAAY,KAAKD,YAAY,KAAKA,YAAY,SAAS;IAC7D,OAAO,cAAc,KAAA,GAAW,yCAAyC;IACzE,IAAI,UAAU,SAAS,OAAO,eAAe;KAC3C,KAAKG,4BAA4B,UAAU,qBAAqB;KAGhE;IACF;IACA,KAAKH,YAAY,IAAI;GACvB;QACK;IACL,OAAO,KAAKD,gBAAgB,iDAAiD;IAC7E,KAAKC,cAAc,CAAC;IACpB,KAAKD,iBAAiB;IACtB,KAAKI,4BAA4B,CAAC;GACpC;EAEJ;CACF;CAEA,4BAA4B,OAAqB;EAC/C,OAAO,KAAKF,mBAAmB,UAAU,OAAO,iCAAiC;EACjF,OAAO,KAAKA,mBAAmB,SAAS,OAAO;GAG7C,MAAM,WAAW,KAAKA,mBAAmB,IAAI;GAC7C,OAAO,aAAa,KAAA,GAAW,iCAAiC;GAChE,SAAS;EACX;CACF;AACF;;;;;AAQA,SAAgB,sBACd,IACA,MACA,WACS;CAGT,MAAM,QAAQ;CACd,MAAM,OAAO,SAAS,KAAK,GAAG,IAAI,OAAO,IAAI,CAAC,CAAC,UAAU,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;CAChF,MAAM,MAAM,KAAK;CACjB,IAAI,QAAQ,KAAA,GAAW,OAAO;CAC9B,IACE,KAAK,WAAW,KAChB,IAAI,OAAO,WACX,OAAO,IAAI,OAAO,YAClB,mBAAmB,IAAI,EAAE,MAAM,mBAAmB,SAAS,GAE3D,MAAM,IAAI,MACR,4DAA4D,KAAK,0FAEnE;CAEF,OAAO;AACT;AAEA,SAAS,mBAAmB,KAAqB;CAC/C,OAAO,IACJ,QAAQ,4BAA4B,EAAE,CAAC,CACvC,QAAQ,SAAS,GAAG,CAAC,CACrB,KAAK,CAAC,CACN,QAAQ,OAAO,EAAE,CAAC,CAClB,YAAY;AACjB;AAEA,SAAS,OAAO,WAAoB,SAAoC;CACtE,IAAI,CAAC,WAAW,MAAM,IAAI,MAAM,OAAO;AACzC;AASA,IAAM,YAAyB,EAAE,MAAM,OAAO;;AAG9C,SAAS,cAAc,KAAqB;CAS1C,QAPG,IAAI,WAAW,IAAG,KAAK,IAAI,SAAS,IAAG,KACvC,IAAI,WAAW,GAAG,KAAK,IAAI,SAAS,GAAG,KACvC,IAAI,WAAW,GAAG,KAAK,IAAI,SAAS,GAAG,IACpC,IAAI,MAAM,GAAG,EAAE,IACf,IAAI,WAAW,GAAG,KAAK,IAAI,SAAS,GAAG,IACrC,IAAI,MAAM,GAAG,EAAE,IACf,IAAA,CACQ,YAAY;AAC9B;AAEA,IAAM,OAAO,OAAO,GAAG;AACvB,IAAM,QAAQ,IAAI,OAChB,OAAO,GAAG,gEACV,GACF;AACA,IAAM,YAAY,IAAI,OAAO,OAAO,GAAG,gBAAgB,KAAK,IAAI,GAAG;AACnE,IAAM,SAAS,IAAI,OAAO,OAAO,GAAG,mCAAmC,GAAG;AAC1E,IAAM,UAAU,IAAI,OAAO,OAAO,GAAG,6BAA6B,KAAK,IAAI,GAAG;AAC9E,IAAM,WAAW,IAAI,OAAO,OAAO,GAAG,+BAA+B,GAAG;AACxE,IAAM,cAAc,IAAI,OACtB,OAAO,GAAG,oDAAoD,KAAK,IACnE,GACF;AACA,IAAM,sBAAsB;;AAG5B,SAAS,MAAM,OAAwB,OAAuB;CAC5D,MAAM,QAAQ,MAAM;CACpB,IAAI,UAAU,KAAA,GAAW,MAAM,IAAI,MAAM,qBAAqB,MAAM,kBAAkB,MAAM,IAAI;CAChG,OAAO;AACT;;;;;;;;;;AAWA,SAAS,SAAS,KAA0B;CAC1C,MAAM,YAAY,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,MAAM,EAAE,CAAC,CAAC,QAAQ;CAE3E,MAAM,aAAa,YAAY,KAAK,SAAS;CAC7C,IAAI,eAAe,MACjB,OAAO;EAAE,MAAM;EAAY,eAAe,cAAc,MAAM,YAAY,CAAC,CAAC;CAAE;CAEhF,IAAI,SAAS,KAAK,SAAS,GAAG,OAAO;EAAE,MAAM;EAAY,eAAe;CAAK;CAE7E,MAAM,YAAY,UAAU,KAAK,SAAS;CAC1C,IAAI,cAAc,MAChB,OAAO;EAAE,MAAM;EAAS,eAAe,cAAc,MAAM,WAAW,CAAC,CAAC;CAAE;CAE5E,IAAI,MAAM,KAAK,SAAS,GAAG,OAAO;EAAE,MAAM;EAAS,eAAe;CAAK;CAEvE,MAAM,UAAU,QAAQ,KAAK,SAAS;CACtC,IAAI,YAAY,MACd,OAAO;EAAE,MAAM;EAAU,eAAe,cAAc,MAAM,SAAS,CAAC,CAAC;CAAE;CAE3E,IAAI,OAAO,KAAK,SAAS,GAAG,OAAO;EAAE,MAAM;EAAU,eAAe;CAAK;CAEzE,IAAI,oBAAoB,KAAK,SAAS,GACpC,MAAM,IAAI,MAAM,+CAA+C,WAAW;CAE5E,OAAO;AACT;;;;;;;;;;;;;;;;;;;AAoBA,SAAS,QAAQ,KAAsB;CACrC,OAAO,CAAC,mBAAmB,IAAI,eAAe,GAAG,CAAC;AACpD;AAEA,IAAM,qCAAqB,IAAI,IAAI;CACjC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;AAGD,SAAS,eAAe,KAAqB;CAC3C,QAAQ,aAAa,KAAK,mBAAmB,GAAG,CAAC,CAAC,GAAG,MAAM,GAAA,CAAI,YAAY;AAC7E;AAEA,SAAS,gBAAgB,KAAsB;CAC7C,OAAO,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS;AACjD;AAEA,SAAS,mBAAmB,WAA2B;CACrD,IAAI,QAAQ;CACZ,SAAS;EACP,OAAO,QAAQ,UAAU,UAAU,KAAK,KAAK,UAAU,OAAO,KAAK,CAAC,GAAG,SAAS;EAChF,IAAI,UAAU,WAAW,OAAO,UAAU,QAAQ,OAAO,KAAK;GAC5D,MAAM,UAAU,UAAU,QAAQ,MAAM,KAAK;GAC7C,QAAQ,YAAY,KAAK,UAAU,SAAS,UAAU;GACtD;EACF;EACA,IAAI,UAAU,WAAW,OAAO,UAAU,QAAQ,OAAO,KAAK;GAC5D,MAAM,QAAQ,UAAU,QAAQ,MAAM,QAAQ,CAAC;GAC/C,QAAQ,UAAU,KAAK,UAAU,SAAS,QAAQ;GAClD;EACF;EACA,OAAO,UAAU,MAAM,KAAK;CAC9B;AACF"}