@pithy-sh/core 0.11.0 → 0.13.0

package/dist/crypto/envelope.js

@@ -0,0 +1,129 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+import { InternalError } from "../error/pithyError.js";
+import { z } from "zod";
+//#region src/crypto/envelope.ts
+/**
+* **The AES-256-GCM envelope: one primitive, two callers** (#390).
+*
+* It was `@pithy-sh/secrets`' own, ported from the CMS `secretsCrypto`, and it sealed that capability's rows and
+* nothing else. Field encryption needs the same primitive inside an adopter's own Workers, and a capability may not
+* depend on another's internals (principle 4), so it lives in core now and both callers import it from here. The
+* format did not change: a row secrets sealed before the move opens after it, byte for byte.
+*
+* ## Two version axes
+*
+* `currentVersion` says which key seals new writes, and the `keyVersion` persisted on every envelope says which key
+* opens it. A rotation adds a version, moves the pointer and keeps the old key until nothing is sealed under it, so
+* a row opens under whichever version sealed it, for as long as that version is in the set. This is the
+* *encryption-key* version. A secret's *value* version is a separate concern (`secrets/src/crypto/versionedValue.ts`).
+*
+* The config is the uniform `{ currentVersion, versions }` shape every versioned value uses, plus `lastRotatedAt`
+* beside it as rotation metadata. Version keys are stringified integers, so reading the keys is a full-set read:
+* every still-valid version, never the current one alone.
+*
+* ## The bound context is the caller's, and it is authenticated
+*
+* Every seal binds a **context** string as AES-GCM additional authenticated data. It is not encrypted; it is bound.
+* Without it a ciphertext is valid under the key alone, so one lifted from one row and written into another opens
+* cleanly, and every decision about which value a caller gets lives in the query above. With it, a moved ciphertext
+* fails inside the primitive, however that query is later rewritten.
+*
+* The primitive takes the context whole, because what to bind is the caller's fact, not this module's:
+*
+* - `@pithy-sh/secrets` binds `pithy.secrets.v1:<stored name>` — exactly what it always bound.
+* - A field marked `encrypted()` binds `pithy/enc/1:<declared name>:<field path>:<primary key>` (`../privacy/sealed`).
+*
+* Each prefix is versioned, so a later change to what is bound is a deliberate, visible break, and the two prefixes
+* are distinct, so a secret's ciphertext never opens as a field and a field's never opens as a secret. **What is bound
+* must be stable for the life of the ciphertext**: each caller states why its own context is.
+*
+* An empty context is refused on both halves. It binds nothing, and it would fail open rather than loudly.
+*/
+/** The key set a seal draws from: which version is current, every still-valid key, and when it last rotated. */
+const EncryptionConfig = z.object({
+	currentVersion: z.string().meta({ multiline: false }).describe("The version key (a stringified integer) whose key seals new writes — the active key."),
+	versions: z.record(z.string(), z.string().meta({ multiline: false })).describe("Every still-valid key: version key (stringified integer) → base64-encoded AES-256 key. Holds the current key plus any prior versions still needed to open values not yet re-sealed."),
+	lastRotatedAt: z.iso.datetime().meta({ multiline: false }).describe("ISO-8601 timestamp of the last rotation; the rotation cron compares against it to decide when to rotate.")
+}).describe("A versioned AES-256 key set: the uniform versioned-value shape (currentVersion + versions) plus rotation metadata. Secrets' master key (`SECRETS_ENCRYPTION_KEYS`) and the field key (`PITHY_FIELD_KEYS`) both take it.");
+/**
+* One AES-256-GCM envelope: base64 ciphertext, base64 IV, and the key version that sealed it.
+*
+* The bound context is deliberately not in here. It is supplied by the caller on the way back in, from the row's own
+* identity, so a row that has been moved cannot carry its old context with it.
+*/
+const EncryptedEnvelope = z.object({
+	encryptedValue: z.string().min(1).describe("The AES-256-GCM ciphertext and tag, base64."),
+	iv: z.string().min(1).describe("The 12-byte initialization vector, base64. Fresh for every seal."),
+	keyVersion: z.number().int().describe("The version of the key that sealed this value: the key set entry that opens it.")
+}).describe("An AES-256-GCM envelope: the ciphertext, its IV, and the key version that sealed it.");
+/** Base64-encode raw bytes without spreading into `fromCharCode` (stack-safe, lint-clean). */
+function toBase64(bytes) {
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary);
+}
+/** Decode base64 to raw bytes. */
+function fromBase64(b64) {
+	return Uint8Array.from(atob(b64), (char) => char.charCodeAt(0));
+}
+/** The authenticated data for one seal. An empty context is refused: it would bind nothing. */
+function additionalData(context) {
+	if (context.length === 0) throw new InternalError({ detail: "the envelope needs a context to bind; an empty context binds nothing" });
+	return Uint8Array.from(new TextEncoder().encode(context));
+}
+/** The raw key bytes for `version`, or a refusal naming the key set. Never the key itself. */
+function keyBytes(config, version, options = {}) {
+	const b64 = config.versions[String(version)];
+	if (!b64) throw new InternalError({ detail: `encryption key version ${version} not present in ${options.keys ?? "the key set"}` });
+	return fromBase64(b64);
+}
+/** Import the AES-GCM key for `version` from the config, or throw if that version is absent. */
+async function importKey(config, version, usage, options) {
+	return crypto.subtle.importKey("raw", keyBytes(config, version, options), "AES-GCM", false, usage);
+}
+/**
+* Seal `plaintext` under the config's current key version, binding `context`. The IV is 12 fresh random bytes, so
+* two seals of one value never share a ciphertext.
+*/
+async function encryptValue(config, context, plaintext, options = {}) {
+	const aad = additionalData(context);
+	const keyVersion = Number(config.currentVersion);
+	const key = await importKey(config, keyVersion, ["encrypt"], options);
+	const iv = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(12));
+	const ciphertext = await crypto.subtle.encrypt({
+		name: "AES-GCM",
+		iv,
+		additionalData: aad
+	}, key, new TextEncoder().encode(plaintext));
+	return {
+		encryptedValue: toBase64(new Uint8Array(ciphertext)),
+		iv: toBase64(iv),
+		keyVersion
+	};
+}
+/**
+* Open an envelope sealed under `context`. The key version may differ from `currentVersion` during a rotation window;
+* the matching key must still be in the config.
+*
+* A missing key version, a tampered ciphertext, the wrong key, or a ciphertext sealed under another context all throw
+* — never the plaintext or key material. GCM cannot tell those apart, and separating them for the caller would be an
+* oracle: the `detail` names the context the open was *attempted under*, which is what an operator needs. Each caller
+* binds a context composed from validated identifiers, so it is safe in a log; neither binds a value.
+*/
+async function decryptValue(config, context, envelope, options = {}) {
+	const aad = additionalData(context);
+	const key = await importKey(config, envelope.keyVersion, ["decrypt"], options);
+	try {
+		const plaintext = await crypto.subtle.decrypt({
+			name: "AES-GCM",
+			iv: fromBase64(envelope.iv),
+			additionalData: aad
+		}, key, fromBase64(envelope.encryptedValue));
+		return new TextDecoder().decode(plaintext);
+	} catch (cause) {
+		throw new InternalError({ detail: `AES-GCM decrypt failed for '${context}' under key version ${envelope.keyVersion}: wrong key, tampered ciphertext, or a ciphertext sealed under a different context` }, { cause });
+	}
+}
+//#endregion
+export { EncryptedEnvelope, EncryptionConfig, decryptValue, encryptValue, fromBase64, keyBytes, toBase64 };

package/dist/crypto/fieldKeys.d.ts

@@ -0,0 +1,41 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+import { EncryptionConfig } from "./envelope";
+/**
+ * **The field key: what an app Worker seals its encrypted fields with** (#390).
+ *
+ * `PITHY_FIELD_KEYS` is an {@link EncryptionConfig}, the same versioned shape as secrets' master key, and it is a
+ * **different key on purpose**. Field encryption seals and opens inside the adopter's own Workers, so every Worker that
+ * holds an encrypted field must hold the key it uses. Were that the master key `SECRETS_ENCRYPTION_KEYS`, every such
+ * Worker would hold the key to the whole secrets vault, and one compromised would open it. A key of its own limits
+ * that to the fields: a Worker that holds an encrypted field and composes no `secrets` is bound this key and never
+ * the master key.
+ *
+ * It is not a second mechanism: `pithy secrets provision` mints it beside the master key, in the same format, binds
+ * it to every Worker that holds an encrypted field, and the manager's at-rest cron rotates it every
+ * {@link FIELD_KEY_ROTATION_DAYS} days.
+ */
+/** The binding an app Worker reads its field key through. Fixed across environments; only the store entry is scoped. */
+export declare const FIELD_KEYS_BINDING = "PITHY_FIELD_KEYS";
+/** How often the manager rotates the field key, in days. */
+export declare const FIELD_KEY_ROTATION_DAYS = 30;
+/** A Secrets Store binding: `.get()` resolves the plaintext inside the Worker. */
+export interface FieldKeyBinding {
+    get(): Promise<string>;
+}
+/**
+ * Where a field key comes from: the Worker's `env.PITHY_FIELD_KEYS` binding (a Secrets Store binding deployed, a JSON
+ * string from `.dev.vars` locally), or a config a caller already resolved.
+ */
+export type FieldKeys = FieldKeyBinding | string | EncryptionConfig;
+/**
+ * Resolve a field key to its config. A missing binding, text that is not JSON, and JSON that is not a key set are each
+ * refused, and **nothing read is ever echoed**: what failed to parse is the key set.
+ */
+export declare function resolveFieldKeys(keys: FieldKeys | undefined): Promise<EncryptionConfig>;
+/**
+ * Every live version in a key set, newest first, as numbers. A version key that is not an integer is refused rather
+ * than sorted as text, where `"10"` sorts before `"9"`.
+ */
+export declare function liveVersions(config: EncryptionConfig): number[];
+//# sourceMappingURL=fieldKeys.d.ts.map

package/dist/crypto/fieldKeys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fieldKeys.d.ts","sourceRoot":"","sources":["../../src/crypto/fieldKeys.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9C;;;;;;;;;;;;;GAaG;AAEH,wHAAwH;AACxH,eAAO,MAAM,kBAAkB,qBAAqB,CAAC;AAErD,4DAA4D;AAC5D,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAE1C,kFAAkF;AAClF,MAAM,WAAW,eAAe;IAC9B,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,MAAM,SAAS,GAAG,eAAe,GAAG,MAAM,GAAG,gBAAgB,CAAC;AAEpE;;;GAGG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,SAAS,GAAG,SAAS,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAoB7F;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,EAAE,CAM/D"}

package/dist/crypto/fieldKeys.js

@@ -0,0 +1,56 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+import { InternalError } from "../error/pithyError.js";
+import { remedy } from "../cli/command.js";
+import { EncryptionConfig } from "./envelope.js";
+//#region src/crypto/fieldKeys.ts
+/**
+* **The field key: what an app Worker seals its encrypted fields with** (#390).
+*
+* `PITHY_FIELD_KEYS` is an {@link EncryptionConfig}, the same versioned shape as secrets' master key, and it is a
+* **different key on purpose**. Field encryption seals and opens inside the adopter's own Workers, so every Worker that
+* holds an encrypted field must hold the key it uses. Were that the master key `SECRETS_ENCRYPTION_KEYS`, every such
+* Worker would hold the key to the whole secrets vault, and one compromised would open it. A key of its own limits
+* that to the fields: a Worker that holds an encrypted field and composes no `secrets` is bound this key and never
+* the master key.
+*
+* It is not a second mechanism: `pithy secrets provision` mints it beside the master key, in the same format, binds
+* it to every Worker that holds an encrypted field, and the manager's at-rest cron rotates it every
+* {@link FIELD_KEY_ROTATION_DAYS} days.
+*/
+/** The binding an app Worker reads its field key through. Fixed across environments; only the store entry is scoped. */
+const FIELD_KEYS_BINDING = "PITHY_FIELD_KEYS";
+/** How often the manager rotates the field key, in days. */
+const FIELD_KEY_ROTATION_DAYS = 30;
+/**
+* Resolve a field key to its config. A missing binding, text that is not JSON, and JSON that is not a key set are each
+* refused, and **nothing read is ever echoed**: what failed to parse is the key set.
+*/
+async function resolveFieldKeys(keys) {
+	let raw = keys;
+	if (keys === void 0 || keys === null) throw new InternalError({
+		message: "This Worker holds an encrypted field and no field key.",
+		action: `Bind ${FIELD_KEYS_BINDING}. ${remedy("secrets provision").say((command) => `${command} binds it to every Worker with an encrypted field.`)}`,
+		detail: `${FIELD_KEYS_BINDING} binding is not configured`
+	});
+	if (typeof keys === "object" && "get" in keys && typeof keys.get === "function") raw = await keys.get();
+	if (typeof raw === "string") try {
+		raw = JSON.parse(raw);
+	} catch {
+		throw new InternalError({ detail: `${FIELD_KEYS_BINDING} is not valid JSON` });
+	}
+	const parsed = EncryptionConfig.safeParse(raw);
+	if (!parsed.success) throw new InternalError({ detail: `${FIELD_KEYS_BINDING} is not a valid EncryptionConfig` });
+	return parsed.data;
+}
+/**
+* Every live version in a key set, newest first, as numbers. A version key that is not an integer is refused rather
+* than sorted as text, where `"10"` sorts before `"9"`.
+*/
+function liveVersions(config) {
+	const versions = Object.keys(config.versions).map(Number);
+	if (!versions.every((version) => Number.isInteger(version))) throw new InternalError({ detail: `${FIELD_KEYS_BINDING}: a version key is not a stringified integer` });
+	return versions.sort((left, right) => right - left);
+}
+//#endregion
+export { FIELD_KEYS_BINDING, FIELD_KEY_ROTATION_DAYS, liveVersions, resolveFieldKeys };

package/dist/data/codecs.d.ts

@@ -8,17 +8,29 @@ export declare const SQLiteDate: z.ZodCodec<z.ZodUnion<readonly [z.ZodNumber, z.
 /** JsonDate: Date ↔ ISO string, for dates nested inside `sqliteJson` payloads. */
 export declare const JsonDate: z.ZodCodec<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodDate]>, z.ZodDate>;
 /**
- * sqliteJson: T ↔ JSON string, validated by `schema` on both sides. Decode
- * accepts a JSON string or an already-parsed value; the result is validated
- * against `schema` before it reaches the app.
- *
- * **Both `JSON` functions throw**, and both were reachable. `JSON.parse` throws a
- * `SyntaxError` on any string that is not a JSON document — which a column holding
- * text an older writer put there, or a payload a customer's Worker returned, can be.
- * `JSON.stringify` throws a `TypeError` on a `BigInt` and on a cycle, either of
- * which a `schema` can legitimately admit. Both become an issue (#358).
+ * sqliteJson: T ↔ JSON string, validated by `schema` on both sides. Decode accepts a JSON string or an
+ * already-parsed value; the result is validated against `schema` before it reaches the app.
  */
-export declare function sqliteJson<T extends z.ZodType>(schema: T): z.ZodCodec<z.ZodUnion<readonly [z.ZodString, T]>, T>;
+export declare function sqliteJson<T extends z.ZodType>(schema: T): SqliteJson<T>;
+/**
+ * Names the type `sqliteJson` returns, and nothing else. A type only: no value carries it. `Redacted<T>` reads a JSON
+ * column's fields through it, as `redact` reads them through {@link isSqliteJson}, so an adopter's codec of the same
+ * shape is opaque to both.
+ */
+declare const kitJsonColumn: unique symbol;
+/** What `sqliteJson(schema)` returns: the kit's JSON column over `schema`. Clones keep it, as they return `this`. */
+export type SqliteJson<T extends z.ZodType> = z.ZodCodec<z.ZodUnion<[z.ZodString, T]>, T> & {
+    readonly [kitJsonColumn]: T;
+};
+/** The schema a kit JSON column decodes to, or `never` for any other node. */
+export type SqliteJsonSchema<S> = S extends {
+    readonly [kitJsonColumn]: infer T;
+} ? T : never;
+/**
+ * Whether a schema is a JSON column `sqliteJson` built, or a clone of one (`.describe()`, `.meta()`), read by its
+ * decode. `redact` walks such a column's fields one by one, and treats every other codec as opaque.
+ */
+export declare function isSqliteJson(schema: z.ZodType): boolean;
 export declare const MAX_TIMEZONE_LENGTH = 64;
 /**
  * Trim, validate, and canonicalize an IANA timezone; anything invalid becomes
@@ -33,4 +45,5 @@ export declare function isValidIanaTimezone(value: string): boolean;
  * to `undefined` on both decode and encode rather than throwing.
  */
 export declare const IanaTimezone: z.ZodCodec<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodOptional<z.ZodString>>;
+export {};
 //# sourceMappingURL=codecs.d.ts.map

package/dist/data/codecs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codecs.d.ts","sourceRoot":"","sources":["../../src/data/codecs.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA+CxB,+EAA+E;AAC/E,eAAO,MAAM,aAAa,8GAGxB,CAAC;AAoBH,6EAA6E;AAC7E,eAAO,MAAM,UAAU,mFAGrB,CAAC;AAEH,kFAAkF;AAClF,eAAO,MAAM,QAAQ,mFAGnB,CAAC;AAEH;;;;;;;;;;GAUG;AACH,wBAAgB,UAAU,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,wDA8BxD;AAED,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAEtC;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CASxE;AAED,sFAAsF;AACtF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED;;;GAGG;AACH,eAAO,MAAM,YAAY,mFAGvB,CAAC"}
+{"version":3,"file":"codecs.d.ts","sourceRoot":"","sources":["../../src/data/codecs.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA+CxB,+EAA+E;AAC/E,eAAO,MAAM,aAAa,8GAGxB,CAAC;AAoBH,6EAA6E;AAC7E,eAAO,MAAM,UAAU,mFAGrB,CAAC;AAEH,kFAAkF;AAClF,eAAO,MAAM,QAAQ,mFAGnB,CAAC;AA0CH;;;GAGG;AACH,wBAAgB,UAAU,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAKxE;AAED;;;;GAIG;AACH,OAAO,CAAC,MAAM,aAAa,EAAE,OAAO,MAAM,CAAC;AAE3C,qHAAqH;AACrH,MAAM,MAAM,UAAU,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG;IAC1F,QAAQ,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;CAC7B,CAAC;AAEF,8EAA8E;AAC9E,MAAM,MAAM,gBAAgB,CAAC,CAAC,IAAI,CAAC,SAAS;IAAE,QAAQ,CAAC,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC,CAAA;CAAE,GAAG,CAAC,GAAG,KAAK,CAAC;AAE9F;;;GAGG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,GAAG,OAAO,CAGvD;AAED,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAEtC;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CASxE;AAED,sFAAsF;AACtF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED;;;GAGG;AACH,eAAO,MAAM,YAAY,mFAGvB,CAAC"}

package/dist/data/codecs.js

@@ -64,47 +64,61 @@ const JsonDate = z.codec(z.union([
 	encode: (value) => value.toISOString()
 });
 /**
-* sqliteJson: T ↔ JSON string, validated by `schema` on both sides. Decode
-* accepts a JSON string or an already-parsed value; the result is validated
-* against `schema` before it reaches the app.
+* sqliteJson's decode: a JSON string is parsed, an already-parsed value passes through. One function for every
+* column, so `isSqliteJson` can tell the kit's codec from any other by its decode.
 *
-* **Both `JSON` functions throw**, and both were reachable. `JSON.parse` throws a
-* `SyntaxError` on any string that is not a JSON document — which a column holding
-* text an older writer put there, or a payload a customer's Worker returned, can be.
-* `JSON.stringify` throws a `TypeError` on a `BigInt` and on a cycle, either of
-* which a `schema` can legitimately admit. Both become an issue (#358).
+* **`JSON.parse` throws**, and it was reachable: a column holding text an older writer put there, or a payload a
+* customer's Worker returned, need not be a JSON document. That becomes an issue (#358).
+*/
+function decodeJson(value, payload) {
+	if (typeof value !== "string") return value;
+	try {
+		return JSON.parse(value);
+	} catch {
+		payload.issues.push({
+			code: "invalid_format",
+			format: "json",
+			input: value,
+			message: "Not valid JSON."
+		});
+		return z.NEVER;
+	}
+}
+/**
+* sqliteJson's encode. **`JSON.stringify` throws** on a `BigInt` and on a cycle, either of which a schema can
+* legitimately admit, so that becomes an issue too (#358).
+*/
+function encodeJson(value, payload) {
+	try {
+		const json = JSON.stringify(value);
+		if (typeof json === "string") return json;
+	} catch {}
+	payload.issues.push({
+		code: "invalid_format",
+		format: "json",
+		input: void 0,
+		message: "Not serializable as JSON."
+	});
+	return z.NEVER;
+}
+/**
+* sqliteJson: T ↔ JSON string, validated by `schema` on both sides. Decode accepts a JSON string or an
+* already-parsed value; the result is validated against `schema` before it reaches the app.
 */
 function sqliteJson(schema) {
 	return z.codec(z.union([z.string(), schema]), schema, {
-		decode: (value, payload) => {
-			if (typeof value !== "string") return value;
-			try {
-				return JSON.parse(value);
-			} catch {
-				payload.issues.push({
-					code: "invalid_format",
-					format: "json",
-					input: value,
-					message: "Not valid JSON."
-				});
-				return z.NEVER;
-			}
-		},
-		encode: (value, payload) => {
-			try {
-				const json = JSON.stringify(value);
-				if (typeof json === "string") return json;
-			} catch {}
-			payload.issues.push({
-				code: "invalid_format",
-				format: "json",
-				input: void 0,
-				message: "Not serializable as JSON."
-			});
-			return z.NEVER;
-		}
+		decode: decodeJson,
+		encode: encodeJson
 	});
 }
+/**
+* Whether a schema is a JSON column `sqliteJson` built, or a clone of one (`.describe()`, `.meta()`), read by its
+* decode. `redact` walks such a column's fields one by one, and treats every other codec as opaque.
+*/
+function isSqliteJson(schema) {
+	const def = schema._zod.def;
+	return def.type === "pipe" && def.transform === decodeJson;
+}
 const MAX_TIMEZONE_LENGTH = 64;
 /**
 * Trim, validate, and canonicalize an IANA timezone; anything invalid becomes
@@ -134,4 +148,4 @@ const IanaTimezone = z.codec(z.string().nullish(), z.string().optional(), {
 	encode: (value) => normalizeIanaTimezone(value)
 });
 //#endregion
-export { IanaTimezone, JsonDate, MAX_TIMEZONE_LENGTH, SQLiteBoolean, SQLiteDate, isValidIanaTimezone, normalizeIanaTimezone, sqliteJson };
+export { IanaTimezone, JsonDate, MAX_TIMEZONE_LENGTH, SQLiteBoolean, SQLiteDate, isSqliteJson, isValidIanaTimezone, normalizeIanaTimezone, sqliteJson };

package/dist/error/extend.d.ts

@@ -1,6 +1,7 @@
 // SPDX-FileCopyrightText: 2026 Pithy
 // SPDX-License-Identifier: MIT
 import type { MessageParams } from "../i18n/catalog";
+import type { UnmarkedString } from "../privacy/types";
 import type { ErrorPayload, KitErrorDomain } from "./payload";
 import { ExtendedErrorPayload } from "./payload";
 /**
@@ -84,11 +85,11 @@ export declare function defineErrorPayload<const Code extends `${string}/${strin
     /** The HTTP status this code maps to. A 4xx or a 5xx — an error is not a success. */
     status: number;
     /** Public, safe-to-expose summary. Sent to clients and shown in the terminal. */
-    message: string;
-    /** Operator remediation hint. Becomes the CLI action line. Never sent to a client. */
-    action?: string;
-    /** Internal context for logs + audit. NEVER serialized to clients — the HTTP codec strips it. */
-    detail?: string;
+    message: UnmarkedString;
+    /** Operator remediation hint. Becomes the CLI action line. Never sent to a client. Never a marked value (#132). */
+    action?: UnmarkedString;
+    /** Internal context for logs + audit. NEVER serialized to clients — the HTTP codec strips it. Never a marked value (#132). */
+    detail?: UnmarkedString;
     /**
      * Values a translating client interpolates into its own wording for this code. Client-facing:
      * these cross the boundary with `message`, unlike `action` and `detail`.

package/dist/error/extend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"extend.d.ts","sourceRoot":"","sources":["../../src/error/extend.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAMjD;;;;GAIG;AACH,KAAK,cAAc,CAAC,IAAI,SAAS,MAAM,IAAI,IAAI,SAAS,GAAG,cAAc,IAAI,MAAM,EAAE,GACjF;IAAE,IAAI,EAAE,2EAA2E,CAAA;CAAE,GACrF,OAAO,CAAC;AAEZ;;;;;GAKG;AACH,MAAM,MAAM,cAAc,CAAC,IAAI,SAAS,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE;IAAE,IAAI,EAAE,IAAI,CAAA;CAAE,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GACrG,oBAAoB,GAAG;IAAE,IAAI,EAAE,IAAI,CAAA;CAAE,GACrC,OAAO,CAAC,YAAY,EAAE;IAAE,IAAI,EAAE,IAAI,CAAA;CAAE,CAAC,CAAC;AAE1C;;;;;;;;;;;;;GAaG;AACH,wBAAgB,WAAW,CAAC,KAAK,CAAC,IAAI,SAAS,GAAG,MAAM,IAAI,MAAM,EAAE,EAClE,OAAO,EAAE,YAAY,EACrB,IAAI,EAAE,IAAI,GACT,OAAO,IAAI,cAAc,CAAC,IAAI,CAAC,CAEjC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,CAAC,IAAI,SAAS,GAAG,MAAM,IAAI,MAAM,EAAE,EACzE,OAAO,EAAE;IACP,uGAAuG;IACvG,IAAI,EAAE,IAAI,CAAC;IACX,qFAAqF;IACrF,MAAM,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,OAAO,EAAE,MAAM,CAAC;IAChB,sFAAsF;IACtF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iGAAiG;IACjG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB,GAAG,cAAc,CAAC,IAAI,CAAC,GACvB,cAAc,CAAC,IAAI,CAAC,CAiBtB"}
+{"version":3,"file":"extend.d.ts","sourceRoot":"","sources":["../../src/error/extend.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAMjD;;;;GAIG;AACH,KAAK,cAAc,CAAC,IAAI,SAAS,MAAM,IAAI,IAAI,SAAS,GAAG,cAAc,IAAI,MAAM,EAAE,GACjF;IAAE,IAAI,EAAE,2EAA2E,CAAA;CAAE,GACrF,OAAO,CAAC;AAEZ;;;;;GAKG;AACH,MAAM,MAAM,cAAc,CAAC,IAAI,SAAS,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE;IAAE,IAAI,EAAE,IAAI,CAAA;CAAE,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GACrG,oBAAoB,GAAG;IAAE,IAAI,EAAE,IAAI,CAAA;CAAE,GACrC,OAAO,CAAC,YAAY,EAAE;IAAE,IAAI,EAAE,IAAI,CAAA;CAAE,CAAC,CAAC;AAE1C;;;;;;;;;;;;;GAaG;AACH,wBAAgB,WAAW,CAAC,KAAK,CAAC,IAAI,SAAS,GAAG,MAAM,IAAI,MAAM,EAAE,EAClE,OAAO,EAAE,YAAY,EACrB,IAAI,EAAE,IAAI,GACT,OAAO,IAAI,cAAc,CAAC,IAAI,CAAC,CAEjC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,CAAC,IAAI,SAAS,GAAG,MAAM,IAAI,MAAM,EAAE,EACzE,OAAO,EAAE;IACP,uGAAuG;IACvG,IAAI,EAAE,IAAI,CAAC;IACX,qFAAqF;IACrF,MAAM,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,OAAO,EAAE,cAAc,CAAC;IACxB,mHAAmH;IACnH,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,8HAA8H;IAC9H,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB,GAAG,cAAc,CAAC,IAAI,CAAC,GACvB,cAAc,CAAC,IAAI,CAAC,CAiBtB"}

package/dist/error/http.d.ts

@@ -68,6 +68,16 @@ export declare const HttpError: z.ZodCodec<z.ZodUnion<readonly [z.ZodDiscriminat
     params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
     code: z.ZodLiteral<"auth/session_not_fresh">;
     status: z.ZodLiteral<403>;
+}, z.core.$strip>, z.ZodObject<{
+    message: z.ZodString;
+    params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
+    code: z.ZodLiteral<"auth/account_suspended">;
+    status: z.ZodLiteral<403>;
+}, z.core.$strip>, z.ZodObject<{
+    message: z.ZodString;
+    params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
+    code: z.ZodLiteral<"auth/account_deleted">;
+    status: z.ZodLiteral<403>;
 }, z.core.$strip>, z.ZodObject<{
     message: z.ZodString;
     params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
@@ -648,6 +658,26 @@ export declare const HttpError: z.ZodCodec<z.ZodUnion<readonly [z.ZodDiscriminat
     params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
     code: z.ZodLiteral<"organization/nomination_invalid">;
     status: z.ZodLiteral<400>;
+}, z.core.$strip>, z.ZodObject<{
+    message: z.ZodString;
+    params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
+    code: z.ZodLiteral<"organization/last_owner">;
+    status: z.ZodLiteral<409>;
+}, z.core.$strip>, z.ZodObject<{
+    message: z.ZodString;
+    params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
+    code: z.ZodLiteral<"organization/already_member">;
+    status: z.ZodLiteral<409>;
+}, z.core.$strip>, z.ZodObject<{
+    message: z.ZodString;
+    params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
+    code: z.ZodLiteral<"organization/seat_limit_reached">;
+    status: z.ZodLiteral<409>;
+}, z.core.$strip>, z.ZodObject<{
+    message: z.ZodString;
+    params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
+    code: z.ZodLiteral<"organization/organization_suspended">;
+    status: z.ZodLiteral<403>;
 }, z.core.$strip>, z.ZodObject<{
     message: z.ZodString;
     params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
@@ -821,6 +851,20 @@ export declare const HttpError: z.ZodCodec<z.ZodUnion<readonly [z.ZodDiscriminat
     detail: z.ZodOptional<z.ZodString>;
     code: z.ZodLiteral<"auth/session_not_fresh">;
     status: z.ZodLiteral<403>;
+}, z.core.$strip>, z.ZodObject<{
+    message: z.ZodString;
+    params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
+    action: z.ZodOptional<z.ZodString>;
+    detail: z.ZodOptional<z.ZodString>;
+    code: z.ZodLiteral<"auth/account_suspended">;
+    status: z.ZodLiteral<403>;
+}, z.core.$strip>, z.ZodObject<{
+    message: z.ZodString;
+    params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
+    action: z.ZodOptional<z.ZodString>;
+    detail: z.ZodOptional<z.ZodString>;
+    code: z.ZodLiteral<"auth/account_deleted">;
+    status: z.ZodLiteral<403>;
 }, z.core.$strip>, z.ZodObject<{
     message: z.ZodString;
     params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
@@ -1633,6 +1677,34 @@ export declare const HttpError: z.ZodCodec<z.ZodUnion<readonly [z.ZodDiscriminat
     detail: z.ZodOptional<z.ZodString>;
     code: z.ZodLiteral<"organization/nomination_invalid">;
     status: z.ZodLiteral<400>;
+}, z.core.$strip>, z.ZodObject<{
+    message: z.ZodString;
+    params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
+    action: z.ZodOptional<z.ZodString>;
+    detail: z.ZodOptional<z.ZodString>;
+    code: z.ZodLiteral<"organization/last_owner">;
+    status: z.ZodLiteral<409>;
+}, z.core.$strip>, z.ZodObject<{
+    message: z.ZodString;
+    params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
+    action: z.ZodOptional<z.ZodString>;
+    detail: z.ZodOptional<z.ZodString>;
+    code: z.ZodLiteral<"organization/already_member">;
+    status: z.ZodLiteral<409>;
+}, z.core.$strip>, z.ZodObject<{
+    message: z.ZodString;
+    params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
+    action: z.ZodOptional<z.ZodString>;
+    detail: z.ZodOptional<z.ZodString>;
+    code: z.ZodLiteral<"organization/seat_limit_reached">;
+    status: z.ZodLiteral<409>;
+}, z.core.$strip>, z.ZodObject<{
+    message: z.ZodString;
+    params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
+    action: z.ZodOptional<z.ZodString>;
+    detail: z.ZodOptional<z.ZodString>;
+    code: z.ZodLiteral<"organization/organization_suspended">;
+    status: z.ZodLiteral<403>;
 }, z.core.$strip>, z.ZodObject<{
     message: z.ZodString;
     params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;

package/dist/error/http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/error/http.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAGpC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAA4B,UAAU,EAAmB,MAAM,cAAc,CAAC;AAErF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oBA8BpB,CAAC;AAeH;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,KAAK,GAAG,UAAU,CAInD;AAED,gGAAgG;AAChG,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,OAAO,GAAG,QAAQ,CAKxE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,GAAG,QAAQ,CAElE"}
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/error/http.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAGpC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAA4B,UAAU,EAAmB,MAAM,cAAc,CAAC;AAErF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oBA8BpB,CAAC;AAeH;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,KAAK,GAAG,UAAU,CAInD;AAED,gGAAgG;AAChG,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,OAAO,GAAG,QAAQ,CAKxE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,GAAG,QAAQ,CAElE"}