@north-light/crouter 0.3.318 → 0.3.319

package/dist/core/pagination.js

@@ -1,88 +1 @@
-// Pagination helper for agent-facing paginated list leaves.
-//
-// Precondition: `allItemsSortedAscByKey` MUST be sorted ascending by the value
-// `keyOf` returns. Sort order is part of each leaf's contract — this module
-// trusts the caller. Violating the precondition produces silently wrong pages.
-//
-// Cursor design: encodes the stable sort key of the last-emitted item as
-// base64url JSON `{k: <sortKey>}`. Resumption seeks the first item whose key
-// is strictly greater than the cursor key — stable under inserts and deletes
-// between pages (a deleted cursor key simply doesn't stall the scan; the next
-// item after it is returned correctly).
-import { CrtrError } from './errors.js';
-import { ExitCode } from '../types.js';
-// Cursor encoding / decoding
-/** Encodes a stable sort key into an opaque base64url cursor token. */
-export function encodeCursor(key) {
-    const json = JSON.stringify({ k: key });
-    return Buffer.from(json, 'utf8').toString('base64url');
-}
-/** Decodes an opaque cursor token back to the sort key it encodes.
- *  Throws `CrtrError` with code `'invalid_cursor'` on malformed input. */
-export function decodeCursor(token) {
-    let json;
-    try {
-        json = Buffer.from(token, 'base64url').toString('utf8');
-    }
-    catch {
-        throw new CrtrError('invalid_cursor', 'cursor could not be decoded.', ExitCode.USAGE, {
-            received: token,
-            next: 'Omit cursor to restart from the beginning.',
-        });
-    }
-    let parsed;
-    try {
-        parsed = JSON.parse(json);
-    }
-    catch {
-        throw new CrtrError('invalid_cursor', 'cursor payload is not valid JSON.', ExitCode.USAGE, {
-            received: token,
-            next: 'Omit cursor to restart from the beginning.',
-        });
-    }
-    if (typeof parsed !== 'object' ||
-        parsed === null ||
-        !('k' in parsed) ||
-        typeof parsed.k !== 'string') {
-        throw new CrtrError('invalid_cursor', 'cursor payload is missing required key field.', ExitCode.USAGE, {
-            received: token,
-            next: 'Omit cursor to restart from the beginning.',
-        });
-    }
-    return parsed.k;
-}
-/**
- * Returns one page of items from a pre-sorted list, with a stable opaque
- * cursor for resumption.
- *
- * @param allItemsSortedAscByKey - Full dataset, sorted ascending by `keyOf`.
- * @param params - Agent-supplied `{ limit?, cursor? }` from stdin.
- * @param opts - Caller-supplied configuration (limits, key extractor, total).
- */
-export function paginate(allItemsSortedAscByKey, params, opts) {
-    // Resolve effective limit: clamp to [1, maxLimit], default when absent.
-    const rawLimit = params.limit !== undefined ? params.limit : opts.defaultLimit;
-    const effectiveLimit = Math.min(Math.max(1, rawLimit), opts.maxLimit);
-    // Resolve start position from cursor.
-    let startIndex = 0;
-    if (params.cursor !== undefined) {
-        const cursorKey = decodeCursor(params.cursor); // throws CrtrError on bad cursor
-        const compareKeys = opts.compareKeys ?? ((left, right) => left < right ? -1 : left > right ? 1 : 0);
-        // Find the first item whose key is strictly greater than cursorKey.
-        // Linear scan; callers with large datasets should pre-filter upstream.
-        startIndex = allItemsSortedAscByKey.findIndex((item) => compareKeys(opts.keyOf(item), cursorKey) > 0);
-        if (startIndex === -1) {
-            // All items are at or before the cursor key — list is exhausted.
-            startIndex = allItemsSortedAscByKey.length;
-        }
-    }
-    const page = allItemsSortedAscByKey.slice(startIndex, startIndex + effectiveLimit);
-    // next_cursor: null is the ONLY end-of-list signal.
-    let next_cursor = null;
-    if (page.length === effectiveLimit && startIndex + effectiveLimit < allItemsSortedAscByKey.length) {
-        const lastKey = opts.keyOf(page[page.length - 1]);
-        next_cursor = encodeCursor(lastKey);
-    }
-    const total = opts.total === 'count' ? allItemsSortedAscByKey.length : null;
-    return { items: page, next_cursor, total };
-}
+var x=Object.defineProperty;var c=(r,e)=>x(r,"name",{value:e,configurable:!0});import{CrtrError as s}from"./errors.js";import{ExitCode as d}from"../types.js";function v(r){const e=JSON.stringify({k:r});return Buffer.from(e,"utf8").toString("base64url")}c(v,"encodeCursor");function O(r){let e;try{e=Buffer.from(r,"base64url").toString("utf8")}catch{throw new s("invalid_cursor","cursor could not be decoded.",d.USAGE,{received:r,next:"Omit cursor to restart from the beginning."})}let t;try{t=JSON.parse(e)}catch{throw new s("invalid_cursor","cursor payload is not valid JSON.",d.USAGE,{received:r,next:"Omit cursor to restart from the beginning."})}if(typeof t!="object"||t===null||!("k"in t)||typeof t.k!="string")throw new s("invalid_cursor","cursor payload is missing required key field.",d.USAGE,{received:r,next:"Omit cursor to restart from the beginning."});return t.k}c(O,"decodeCursor");function y(r,e,t){const m=e.limit!==void 0?e.limit:t.defaultLimit,u=Math.min(Math.max(1,m),t.maxLimit);let n=0;if(e.cursor!==void 0){const f=O(e.cursor),h=t.compareKeys??((o,a)=>o<a?-1:o>a?1:0);n=r.findIndex(o=>h(t.keyOf(o),f)>0),n===-1&&(n=r.length)}const i=r.slice(n,n+u);let l=null;if(i.length===u&&n+u<r.length){const f=t.keyOf(i[i.length-1]);l=v(f)}const g=t.total==="count"?r.length:null;return{items:i,next_cursor:l,total:g}}c(y,"paginate");export{O as decodeCursor,v as encodeCursor,y as paginate};

package/dist/core/plugin-swap-lock.js

@@ -1,31 +1 @@
-// The one name for the lock a bundle-plugin package swap is held under, and the
-// two questions a reader asks about it.
-//
-// Two modules need it and neither may own it: the swapper lives in
-// `commands/pkg/plugin-manage.ts` (the whole command graph), the reader in
-// `core/installed-plugins.ts` (deliberately leaf-safe: types, fs-utils,
-// manifest). This module keeps both dependency-light — `node:path` plus the
-// generic lock primitive, which itself imports only `node:fs` and
-// `node:crypto`.
-import { join } from 'node:path';
-import { awaitExclusiveLockRelease, exclusiveLockOwnerPid } from './exclusive-lock.js';
-/** How long a reader waits for another process's swap to finish before it
- *  reports what it can see. A swap is one rename of an already-staged, already-
- *  validated tree, so a wait this long means the holder is wedged, not slow. */
-const READER_WAIT_MS = 2_000;
-/** Under the scope root's `tmp/`, alongside the staging and `.prev` dirs the
- *  swap itself uses, so one directory holds the whole transition. */
-export function bundleSwapLockPath(scopeRootPath, name) {
-    return join(scopeRootPath, 'tmp', `${name}.swap.lock`);
-}
-/** Whether ANOTHER live process currently holds this plugin's swap lock. Our
- *  own lock does not count: the swapper reads the plugin list from inside its
- *  own critical section. */
-export function bundleSwapInFlightElsewhere(scopeRootPath, name) {
-    const pid = exclusiveLockOwnerPid(bundleSwapLockPath(scopeRootPath, name));
-    return pid !== null && pid !== process.pid;
-}
-/** Wait out another process's swap of this plugin, bounded. */
-export function awaitBundleSwap(scopeRootPath, name) {
-    awaitExclusiveLockRelease(bundleSwapLockPath(scopeRootPath, name), READER_WAIT_MS);
-}
+var r=Object.defineProperty;var n=(e,o)=>r(e,"name",{value:o,configurable:!0});import{join as p}from"node:path";import{awaitExclusiveLockRelease as c,exclusiveLockOwnerPid as l}from"./exclusive-lock.js";const u=2e3;function i(e,o){return p(e,"tmp",`${o}.swap.lock`)}n(i,"bundleSwapLockPath");function d(e,o){const t=l(i(e,o));return t!==null&&t!==process.pid}n(d,"bundleSwapInFlightElsewhere");function f(e,o){c(i(e,o),u)}n(f,"awaitBundleSwap");export{f as awaitBundleSwap,d as bundleSwapInFlightElsewhere,i as bundleSwapLockPath};

package/dist/core/pool-credential-store.js

@@ -1,116 +1 @@
-// pool-credential-store.ts — the CredentialStore pi reads managed providers through.
-//
-// Managed-provider OAuth credentials live in the subscription pool, which can hold multiple
-// accounts per provider. This store elects one pool account for pi; non-managed providers pass
-// through to auth.json.
-import { CrouterCredentialStore, defaultAuthPath } from './auth-file.js';
-import { ANTHROPIC_PROVIDER_ID, OPENAI_CODEX_PROVIDER_ID, getProviderLabel, isManagedProvider, modifyElectedSubscription, readSubscriptionPool, removeManagedAccount, } from './subscription-state.js';
-const MANAGED_PROVIDER_IDS = [ANTHROPIC_PROVIDER_ID, OPENAI_CODEX_PROVIDER_ID];
-/**
- * Which pool account pi is handed for a managed provider. Deliberately dumb: pi calls `read()`
- * mid-turn, so this must be cheap, must not touch the network, and must not make a policy
- * decision that surprises a turn already in flight. First entry that is healthy and not cooling
- * wins; ties break on pool order, which is stable and user-controlled (`/provider-sub select`
- * promotes).
- *
- * When every account is cooling or auth-failed we still return the first one rather than
- * nothing: deciding a turn is unservable belongs to the rotation loop, and an `undefined` here
- * would make pi's eager launch gate FATAL a node that rotation could still have serviced.
- */
-export function electPoolCredential(providerId, now = Date.now()) {
-    return electFrom(readSubscriptionPool(providerId), now);
-}
-function electFrom(pool, now = Date.now()) {
-    return pool.find((entry) => !entry.authFailure && (!entry.rateLimitedUntil || entry.rateLimitedUntil <= now)) ?? pool[0];
-}
-function toCredential(entry) {
-    return {
-        type: 'oauth',
-        refresh: entry.refresh,
-        access: entry.access,
-        expires: entry.expires,
-        ...(entry.accountId ? { accountId: entry.accountId } : {}),
-    };
-}
-export class PoolCredentialStore {
-    authPath;
-    auth;
-    constructor(authPath = defaultAuthPath()) {
-        this.authPath = authPath;
-        this.auth = new CrouterCredentialStore(authPath);
-    }
-    async read(providerId) {
-        if (!isManagedProvider(providerId))
-            return this.auth.read(providerId);
-        const elected = electPoolCredential(providerId);
-        // No pool account at all: fall through to auth.json, which is where a hand-written api_key
-        // for a managed provider still legitimately lives. An OAUTH record there is not served: the
-        // pool owns managed oauth, and nothing outside it can refresh such a record, so serving it
-        // would hand pi a credential that works until its access token expires and then fails every
-        // turn non-retryably. It reads as absent, so the provider reads logged out and `/login` fixes it.
-        if (elected !== undefined)
-            return toCredential(elected);
-        const stored = await this.auth.read(providerId);
-        return stored?.type === 'oauth' ? undefined : stored;
-    }
-    async list() {
-        // Managed providers are reported from the pool alone, on the same rule `read` serves them by:
-        // a managed oauth record in auth.json is not a credential this store can honour, and letting
-        // it report configured is how a provider comes to look healthy while every turn fails.
-        const infos = (await this.auth.list()).filter((info) => !(isManagedProvider(info.providerId) && info.type === 'oauth'));
-        for (const providerId of MANAGED_PROVIDER_IDS) {
-            if (infos.some((info) => info.providerId === providerId))
-                continue;
-            // Every pool row carries an OAuth token pair (rows without one are not stored), so pool
-            // occupancy IS a stored credential for pi's purposes.
-            if (readSubscriptionPool(providerId).length > 0)
-                infos.push({ providerId, type: 'oauth' });
-        }
-        return infos;
-    }
-    /**
-     * pi's locked read-modify-write, chiefly its OAuth refresh. The whole transaction — electing
-     * the account, running pi's `fn`, committing the result — happens under the pool file's
-     * cross-process lock, because a refresh token is single-use: two brokers electing the same
-     * expired account outside a lock would both spend it and the loser would get a genuine
-     * `invalid_grant`. Electing under the lock is also what guarantees the refreshed token lands
-     * back on exactly the account whose token was spent.
-     *
-     * A managed provider with no pool account is NOT created here — pi must not be able to mint a
-     * managed account behind crouter's login surfaces, which own the account-identity gate.
-     */
-    async modify(providerId, fn) {
-        if (!isManagedProvider(providerId))
-            return this.auth.modify(providerId, fn);
-        if (electPoolCredential(providerId) === undefined) {
-            // A hand-written api_key for a managed provider legitimately lives in auth.json (see
-            // `read`), so keep modifying it there. `read` already refuses an oauth record for a managed
-            // provider, so what it returns here is never one.
-            const existing = await this.read(providerId);
-            if (existing !== undefined)
-                return this.auth.modify(providerId, fn);
-            throw new Error(`${getProviderLabel(providerId)} has no account to update — add one with \`crtr sys settings\` or \`/provider-sub ${providerId} add\`.`);
-        }
-        const committed = await modifyElectedSubscription(providerId, (pool) => electFrom(pool), async (entry) => {
-            const next = await fn(toCredential(entry));
-            // Per the CredentialStore contract, `undefined` leaves the entry unchanged. A non-oauth
-            // result cannot be stored in the pool, which holds oauth accounts only.
-            return next === undefined || next.type !== 'oauth' ? undefined : { refresh: next.refresh, access: next.access, expires: next.expires };
-        });
-        return committed === undefined ? undefined : toCredential(committed);
-    }
-    async delete(providerId) {
-        if (!isManagedProvider(providerId))
-            return this.auth.delete(providerId);
-        // pi exposes logout only at provider scope, so managed logout removes the account currently
-        // elected for that provider. `/provider-sub remove` manages a specific named account.
-        const elected = electPoolCredential(providerId);
-        if (elected !== undefined)
-            await removeManagedAccount(providerId, elected.label);
-        // A managed provider can also be backed by a hand-written auth.json api_key, which `read`
-        // serves when no pool account exists. Leaving it behind would make a successful logout
-        // hand the very same credential back on the next read.
-        if ((await this.auth.read(providerId)) !== undefined)
-            await this.auth.delete(providerId);
-    }
-}
+var d=Object.defineProperty;var s=(a,t)=>d(a,"name",{value:t,configurable:!0});import{CrouterCredentialStore as l,defaultAuthPath as m}from"./auth-file.js";import{ANTHROPIC_PROVIDER_ID as w,OPENAI_CODEX_PROVIDER_ID as P,getProviderLabel as D,isManagedProvider as o,modifyElectedSubscription as x,readSubscriptionPool as h,removeManagedAccount as y}from"./subscription-state.js";const E=[w,P];function r(a,t=Date.now()){return f(h(a),t)}s(r,"electPoolCredential");function f(a,t=Date.now()){return a.find(e=>!e.authFailure&&(!e.rateLimitedUntil||e.rateLimitedUntil<=t))??a[0]}s(f,"electFrom");function c(a){return{type:"oauth",refresh:a.refresh,access:a.access,expires:a.expires,...a.accountId?{accountId:a.accountId}:{}}}s(c,"toCredential");class _{static{s(this,"PoolCredentialStore")}authPath;auth;constructor(t=m()){this.authPath=t,this.auth=new l(t)}async read(t){if(!o(t))return this.auth.read(t);const e=r(t);if(e!==void 0)return c(e);const n=await this.auth.read(t);return n?.type==="oauth"?void 0:n}async list(){const t=(await this.auth.list()).filter(e=>!(o(e.providerId)&&e.type==="oauth"));for(const e of E)t.some(n=>n.providerId===e)||h(e).length>0&&t.push({providerId:e,type:"oauth"});return t}async modify(t,e){if(!o(t))return this.auth.modify(t,e);if(r(t)===void 0){if(await this.read(t)!==void 0)return this.auth.modify(t,e);throw new Error(`${D(t)} has no account to update \u2014 add one with \`crtr sys settings\` or \`/provider-sub ${t} add\`.`)}const n=await x(t,u=>f(u),async u=>{const i=await e(c(u));return i===void 0||i.type!=="oauth"?void 0:{refresh:i.refresh,access:i.access,expires:i.expires}});return n===void 0?void 0:c(n)}async delete(t){if(!o(t))return this.auth.delete(t);const e=r(t);e!==void 0&&await y(t,e.label),await this.auth.read(t)!==void 0&&await this.auth.delete(t)}}export{_ as PoolCredentialStore,r as electPoolCredential};

package/dist/core/predicate.js

@@ -1,191 +1 @@
-/**
- * Predicate matcher engine — vendored verbatim from pi's frontmatter-rules
- * extension.
- *
- * Source: src/builtin-pi-packages/pi-crtr-extensions/extensions/frontmatter-rules/index.ts
- *         (the "Condition language" block, functions `asArray` … `evalCondition`).
- *
- * The unified document substrate uses this to evaluate a document's `gate`
- * predicate against a node-config subject (e.g. `orchestration.depth: { gte: 2 }`).
- *
- * This is intentionally a COPY, not an import: the bundled pi package is
- * excluded from crouter's tsc compile unit (tsconfig `exclude`) — it is loaded
- * by pi's own TS loader at runtime — so compiled core cannot import from it;
- * cross-boundary imports go extension→core only. The functions are pure
- * TS over `unknown` / `Record<string, unknown>` with zero external imports, so
- * vendoring them keeps this module standalone and dependency-free. Keep it in
- * sync with the source by hand if the matcher language ever changes.
- *
- * Condition language (evaluated against the subject object):
- *   A condition is a map of <field> -> <matcher>, AND-ed across fields.
- *   `field` may be dotted to reach nested values (e.g. `orchestration.depth`).
- *
- *   Matcher forms:
- *     scalar (string/number/bool/null)
- *         field === value, OR (if the field is an array) the array includes value
- *     array  [a, b, c]
- *         membership/intersection: field is one of these, OR the field array
- *         shares any element with these
- *     object { <op>: <arg>, ... }   (multiple ops AND together)
- *         eq          equals (scalar or array-includes)
- *         ne          not eq
- *         in          [..] — field (or any of its array elements) is in the list
- *         nin         not in
- *         exists      true|false — field is present / absent
- *         contains    field array includes this value
- *         containsAll [..] — field array includes all of these
- *         containsAny [..] — field array includes any of these
- *         matches     regex string, case-sensitive (tests String(field); arrays: any)
- *         imatches    regex string, case-insensitive
- *         gt gte lt lte   numeric comparison
- *
- *   Combinators (reserved keys at any condition level):
- *     all: [ {..}, {..} ]   every sub-condition true (AND)
- *     any: [ {..}, {..} ]   at least one true (OR)
- *     not: { .. }           sub-condition false
- *   Sibling field matchers next to combinators are AND-ed in.
- *
- *   Two load-bearing edge cases preserved from the source:
- *     - An empty condition (`{}`) is INERT: it returns false, NOT match-all.
- *     - An unknown op never matches.
- */
-export function asArray(v) {
-    if (Array.isArray(v))
-        return v;
-    if (v === undefined)
-        return [];
-    return [v];
-}
-// Scalar equality with light, predictable coercion: exact match, or
-// string/number cross-compare so `version: 2` matches a subject "2".
-export function scalarEq(a, b) {
-    if (a === b)
-        return true;
-    if ((typeof a === 'number' || typeof a === 'string') &&
-        (typeof b === 'number' || typeof b === 'string')) {
-        return String(a) === String(b);
-    }
-    return false;
-}
-// Resolve a (possibly dotted) field path against the subject object.
-export function getField(subject, key) {
-    if (subject && typeof subject === 'object' && key in subject) {
-        return subject[key];
-    }
-    if (!key.includes('.'))
-        return undefined;
-    let cur = subject;
-    for (const part of key.split('.')) {
-        if (cur == null || typeof cur !== 'object')
-            return undefined;
-        cur = cur[part];
-    }
-    return cur;
-}
-export function toRegExp(arg, flags) {
-    if (typeof arg !== 'string')
-        return null;
-    try {
-        return new RegExp(arg, flags);
-    }
-    catch {
-        return null;
-    }
-}
-export function applyOp(op, value, arg) {
-    const vals = asArray(value);
-    switch (op) {
-        case 'eq':
-            return Array.isArray(value) ? value.some((v) => scalarEq(v, arg)) : scalarEq(value, arg);
-        case 'ne':
-            return !applyOp('eq', value, arg);
-        case 'in':
-            return asArray(arg).some((a) => vals.some((v) => scalarEq(v, a)));
-        case 'nin':
-            return !applyOp('in', value, arg);
-        case 'exists':
-            return (value !== undefined) === (arg !== false);
-        case 'contains':
-            return vals.some((v) => scalarEq(v, arg));
-        case 'containsAll':
-            return asArray(arg).every((a) => vals.some((v) => scalarEq(v, a)));
-        case 'containsAny':
-            return asArray(arg).some((a) => vals.some((v) => scalarEq(v, a)));
-        case 'matches':
-        case 'imatches': {
-            const re = toRegExp(arg, op === 'imatches' ? 'i' : '');
-            if (!re)
-                return false;
-            return vals.some((v) => (typeof v === 'string' || typeof v === 'number' ? re.test(String(v)) : false));
-        }
-        case 'gt':
-        case 'gte':
-        case 'lt':
-        case 'lte': {
-            const n = Number(value);
-            const t = Number(arg);
-            if (Number.isNaN(n) || Number.isNaN(t))
-                return false;
-            if (op === 'gt')
-                return n > t;
-            if (op === 'gte')
-                return n >= t;
-            if (op === 'lt')
-                return n < t;
-            return n <= t;
-        }
-        default:
-            return false; // unknown op never matches
-    }
-}
-export function matchField(value, matcher) {
-    if (matcher === null || ['string', 'number', 'boolean'].includes(typeof matcher)) {
-        if (Array.isArray(value))
-            return value.some((v) => scalarEq(v, matcher));
-        return scalarEq(value, matcher);
-    }
-    if (Array.isArray(matcher)) {
-        const vals = asArray(value);
-        return matcher.some((m) => vals.some((v) => scalarEq(v, m)));
-    }
-    if (matcher && typeof matcher === 'object') {
-        return Object.entries(matcher).every(([op, arg]) => applyOp(op, value, arg));
-    }
-    return false;
-}
-/**
- * Evaluate a `gate` predicate against a subject object.
- *
- * This is the one function consumers call. Returns true iff `condition`
- * matches `subject`. A null/non-object condition and an empty object both
- * return false (inert), never match-all.
- */
-export function evalCondition(condition, subject) {
-    if (condition == null)
-        return false;
-    if (Array.isArray(condition))
-        return condition.every((sub) => evalCondition(sub, subject));
-    if (typeof condition !== 'object')
-        return false;
-    const c = condition;
-    const hasCombinator = 'all' in c || 'any' in c || 'not' in c;
-    if (hasCombinator) {
-        let ok = true;
-        if ('all' in c)
-            ok = ok && asArray(c.all).every((s) => evalCondition(s, subject));
-        if ('any' in c)
-            ok = ok && asArray(c.any).some((s) => evalCondition(s, subject));
-        if ('not' in c)
-            ok = ok && !evalCondition(c.not, subject);
-        for (const k of Object.keys(c)) {
-            if (k === 'all' || k === 'any' || k === 'not')
-                continue;
-            ok = ok && matchField(getField(subject, k), c[k]);
-        }
-        return ok;
-    }
-    const keys = Object.keys(c);
-    if (keys.length === 0)
-        return false; // empty condition is inert, not match-all
-    return keys.every((k) => matchField(getField(subject, k), c[k]));
-}
+var m=Object.defineProperty;var u=(r,e)=>m(r,"name",{value:e,configurable:!0});function l(r){return Array.isArray(r)?r:r===void 0?[]:[r]}u(l,"asArray");function o(r,e){return r===e?!0:(typeof r=="number"||typeof r=="string")&&(typeof e=="number"||typeof e=="string")?String(r)===String(e):!1}u(o,"scalarEq");function c(r,e){if(r&&typeof r=="object"&&e in r)return r[e];if(!e.includes("."))return;let n=r;for(const s of e.split(".")){if(n==null||typeof n!="object")return;n=n[s]}return n}u(c,"getField");function A(r,e){if(typeof r!="string")return null;try{return new RegExp(r,e)}catch{return null}}u(A,"toRegExp");function a(r,e,n){const s=l(e);switch(r){case"eq":return Array.isArray(e)?e.some(i=>o(i,n)):o(e,n);case"ne":return!a("eq",e,n);case"in":return l(n).some(i=>s.some(t=>o(t,i)));case"nin":return!a("in",e,n);case"exists":return e!==void 0==(n!==!1);case"contains":return s.some(i=>o(i,n));case"containsAll":return l(n).every(i=>s.some(t=>o(t,i)));case"containsAny":return l(n).some(i=>s.some(t=>o(t,i)));case"matches":case"imatches":{const i=A(n,r==="imatches"?"i":"");return i?s.some(t=>typeof t=="string"||typeof t=="number"?i.test(String(t)):!1):!1}case"gt":case"gte":case"lt":case"lte":{const i=Number(e),t=Number(n);return Number.isNaN(i)||Number.isNaN(t)?!1:r==="gt"?i>t:r==="gte"?i>=t:r==="lt"?i<t:i<=t}default:return!1}}u(a,"applyOp");function p(r,e){if(e===null||["string","number","boolean"].includes(typeof e))return Array.isArray(r)?r.some(n=>o(n,e)):o(r,e);if(Array.isArray(e)){const n=l(r);return e.some(s=>n.some(i=>o(i,s)))}return e&&typeof e=="object"?Object.entries(e).every(([n,s])=>a(n,r,s)):!1}u(p,"matchField");function y(r,e){if(r==null)return!1;if(Array.isArray(r))return r.every(t=>y(t,e));if(typeof r!="object")return!1;const n=r;if("all"in n||"any"in n||"not"in n){let t=!0;"all"in n&&(t=t&&l(n.all).every(f=>y(f,e))),"any"in n&&(t=t&&l(n.any).some(f=>y(f,e))),"not"in n&&(t=t&&!y(n.not,e));for(const f of Object.keys(n))f==="all"||f==="any"||f==="not"||(t=t&&p(c(e,f),n[f]));return t}const i=Object.keys(n);return i.length===0?!1:i.every(t=>p(c(e,t),n[t]))}u(y,"evalCondition");export{a as applyOp,l as asArray,y as evalCondition,c as getField,p as matchField,o as scalarEq,A as toRegExp};