@velajs/cloudflare 1.24.0 → 1.29.0

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../src/websocket/websocket-routing.ts","../src/cloudflare-application.ts","../src/cloudflare-factory.ts","../src/storage/storage.tokens.ts","../src/storage/storage-key-claim.ts","../src/storage/r2-storage.driver.ts","../src/storage/storage-manager.service.ts","../src/storage/storage.controller.ts","../src/storage/storage.service.ts","../src/storage/storage.module.ts","../src/services/kv-cache.store.ts","../src/services/flagship-flag.driver.ts","../src/services/kv-flag.driver.ts","../src/decorators/env.ts","../src/decorators/scheduled.ts","../src/decorators/queue-consumer.ts","../src/websocket/cloudflare-websocket.module.ts","../src/websocket/broadcast.ts","../src/rate-limit/cloudflare-rate-limit.store.ts","../src/nonce/durable-object-nonce.store.ts"],"sourcesContent":["import type { VelaContext as Context, VelaHono as Hono } from '@velajs/vela';\nimport { getMetadata, getTrustedRequestIdentity } from '@velajs/vela';\nimport {\n  authenticateWebSocketUpgrade,\n  resolveGatewayRoomId,\n  resolveGatewayRoomParam,\n  resolveMaxFrameBytes,\n  WS_GATEWAY_METADATA,\n  type WebSocketGatewayOptions,\n  type WebSocketUpgradeIdentity,\n} from '@velajs/vela/websocket';\nimport { durableObjectRoomName } from './room-id';\n\nexport interface WsGatewayRoute {\n  path: string;\n  binding: string;\n  options: WebSocketGatewayOptions;\n}\n\nconst MAX_IDENTITY_FIELD_BYTES = 2048;\nconst encoder = new TextEncoder();\n\ntype PrincipalType = 'user' | 'service';\n\ninterface ForwardedIdentity extends WebSocketUpgradeIdentity {\n  principal: {\n    issuer: string;\n    subject: string;\n    principalType: PrincipalType;\n  };\n  tenantId: string;\n  expiresAtMs: number;\n}\n\nfunction isIdentityField(value: unknown): value is string {\n  return (\n    typeof value === 'string' &&\n    value.length > 0 &&\n    !value.includes('\\r') &&\n    !value.includes('\\n') &&\n    encoder.encode(value).byteLength <= MAX_IDENTITY_FIELD_BYTES\n  );\n}\n\n/** `null` means an identity was present but violated the transport contract. */\nfunction accessIdentity(c: Context): ForwardedIdentity | null | undefined {\n  const value = getTrustedRequestIdentity(c.req.raw);\n  if (!value) return undefined;\n  const { principal, tenantId, expiresAtMs } = value;\n  if (\n    !isIdentityField(principal.issuer) ||\n    !isIdentityField(principal.subject) ||\n    !isIdentityField(tenantId) ||\n    typeof expiresAtMs !== 'number' ||\n    !Number.isSafeInteger(expiresAtMs) ||\n    expiresAtMs <= 0\n  )\n    return null;\n  return { principal, tenantId, expiresAtMs };\n}\n\n/** `null` means two independently verified identities disagree. */\nfunction combineIdentities(\n  requestIdentity: ForwardedIdentity | undefined,\n  upgradeIdentity: WebSocketUpgradeIdentity | undefined,\n): ForwardedIdentity | null | undefined {\n  if (!requestIdentity && !upgradeIdentity) return undefined;\n  if (!requestIdentity) return upgradeIdentity;\n  if (!upgradeIdentity) return requestIdentity;\n  if (\n    requestIdentity.principal.issuer !== upgradeIdentity.principal.issuer ||\n    requestIdentity.principal.subject !== upgradeIdentity.principal.subject ||\n    requestIdentity.principal.principalType !== upgradeIdentity.principal.principalType ||\n    requestIdentity.tenantId !== upgradeIdentity.tenantId\n  ) {\n    return null;\n  }\n  return {\n    principal: { ...upgradeIdentity.principal },\n    tenantId: upgradeIdentity.tenantId,\n    expiresAtMs: Math.min(requestIdentity.expiresAtMs, upgradeIdentity.expiresAtMs),\n  };\n}\n\n/** Read `@WebSocketGateway({ path, binding })` off a resolved instance (CF-hosted gateways only). */\nexport function collectWsGatewayRoutes(instance: object): WsGatewayRoute[] {\n  // Decorator metadata is the framework's explicit reflection boundary.\n  const options = getMetadata<WebSocketGatewayOptions>(WS_GATEWAY_METADATA, instance.constructor);\n  if (!options?.path || !options?.binding) return [];\n  resolveGatewayRoomParam(options);\n  resolveMaxFrameBytes(options);\n  return [{ path: options.path, binding: options.binding, options: { ...options } }];\n}\n\n/**\n * Registers the upgrade routes on the Worker's Hono app. Each route validates\n * the `Upgrade` header, resolves the room's Durable Object, and forwards the raw\n * request — injecting spoof-safe `x-vela-*` headers the DO reads. The DO returns\n * the `101` with the client socket.\n */\nexport function registerWebSocketRoutes(hono: Hono, routes: WsGatewayRoute[]): void {\n  for (const route of routes) {\n    hono.get(route.path, async (c: Context) => {\n      if (c.req.header('upgrade')?.toLowerCase() !== 'websocket') {\n        return c.text('Expected WebSocket upgrade', 426);\n      }\n\n      // Internal transport headers are never application credentials. Remove\n      // client-supplied values before even the pre-allocation authorization\n      // hook sees the request, then populate trusted values below.\n      const headers = new Headers(c.req.raw.headers);\n      headers.delete('x-vela-room');\n      headers.delete('x-vela-path');\n      headers.delete('x-vela-user');\n      headers.delete('x-vela-expires-at');\n      headers.delete('x-vela-expires-at-ms');\n      headers.delete('x-vela-issuer');\n      headers.delete('x-vela-subject');\n      headers.delete('x-vela-principal-type');\n      headers.delete('x-vela-tenant');\n      const sanitizedRequest = new Request(c.req.raw, { headers });\n\n      let roomId: string;\n      try {\n        roomId = resolveGatewayRoomId(route.options, (name) => c.req.param(name));\n      } catch {\n        return c.text('Invalid WebSocket room', 400);\n      }\n\n      // Origin, application authorization, and ticket/cookie authentication\n      // all complete before the gateway Durable Object id is resolved.\n      const upgrade = await authenticateWebSocketUpgrade(route.options, sanitizedRequest, roomId);\n      if (upgrade === false) return c.text('WebSocket upgrade forbidden', 403);\n\n      const requestIdentity = accessIdentity(c);\n      if (requestIdentity === null) return c.text('Invalid WebSocket identity', 403);\n      const identity = combineIdentities(requestIdentity, upgrade.identity);\n      if (identity === null) return c.text('Conflicting WebSocket identities', 403);\n      if (identity && identity.expiresAtMs <= Date.now()) {\n        return c.text('WebSocket identity expired', 403);\n      }\n\n      // Populate the ticket-free forwarding request with trusted server values.\n      const forwardHeaders = new Headers(upgrade.request.headers);\n      forwardHeaders.set('x-vela-room', roomId);\n      forwardHeaders.set('x-vela-path', route.path);\n      if (identity) {\n        forwardHeaders.set('x-vela-user', identity.principal.subject);\n        forwardHeaders.set('x-vela-issuer', identity.principal.issuer);\n        forwardHeaders.set('x-vela-subject', identity.principal.subject);\n        forwardHeaders.set('x-vela-principal-type', identity.principal.principalType);\n        forwardHeaders.set('x-vela-tenant', identity.tenantId);\n        forwardHeaders.set('x-vela-expires-at-ms', String(identity.expiresAtMs));\n      }\n\n      return forwardToRoom(\n        c.env,\n        route.binding,\n        route.path,\n        roomId,\n        new Request(upgrade.request, { headers: forwardHeaders }),\n      );\n    });\n  }\n}\n\n/**\n * Gateway metadata contains a runtime binding name, so the native type is\n * erased. Validate only the operations consumed here and their observable\n * results; never assert that an arbitrary value implements a native namespace.\n */\nasync function forwardToRoom(\n  env: unknown,\n  binding: string,\n  path: string,\n  room: string,\n  request: Request,\n): Promise<Response> {\n  if (typeof env !== 'object' || env === null) throw new Error('Worker environment is missing');\n  const namespace: unknown = Reflect.get(env, binding);\n  if (typeof namespace !== 'object' || namespace === null) {\n    return new Response(`Durable Object binding '${binding}' is not configured`, { status: 500 });\n  }\n  const idFromName: unknown = Reflect.get(namespace, 'idFromName');\n  const get: unknown = Reflect.get(namespace, 'get');\n  if (typeof idFromName !== 'function' || typeof get !== 'function') {\n    throw new Error('Invalid Durable Object namespace');\n  }\n  const id: unknown = Reflect.apply(idFromName, namespace, [durableObjectRoomName(path, room)]);\n  const stub: unknown = Reflect.apply(get, namespace, [id]);\n  if (typeof stub !== 'object' || stub === null) throw new Error('Invalid Durable Object stub');\n  const fetch: unknown = Reflect.get(stub, 'fetch');\n  if (typeof fetch !== 'function') throw new Error('Durable Object stub has no fetch operation');\n  const response: unknown = await Reflect.apply(fetch, stub, [request]);\n  if (!(response instanceof Response))\n    throw new Error('Durable Object returned an invalid response');\n  return response;\n}\n","import type { ExecutionContext } from 'hono';\nimport {\n  CRON_METADATA,\n  PipelineRunner,\n  buildEntrypointExecutionContext,\n  registerEntrypointKind,\n  getEntrypointModuleId,\n  resolveEntrypoint,\n  resolveScopedComponentsAsync,\n  resolveErrorReporter,\n  runInEntrypointScope,\n  shouldFilterCatch,\n  type VelaApplication,\n} from '@velajs/vela';\nimport type { Entrypoint, ExceptionFilter } from '@velajs/vela';\nimport { readWsEntrypointMeta } from '@velajs/vela/websocket';\nimport { collectWsGatewayRoutes, type WsGatewayRoute } from './websocket/websocket-routing';\nimport { assertCloudflareEnvironment } from './environment';\n\n// vela's own @Cron jobs run via the same Workers cron trigger — declare an\n// entrypoint kind over vela's metadata key (the open-kind system makes\n// cross-package declarations first-class).\nregisterEntrypointKind({ kind: 'cf:vela-cron', metaKey: CRON_METADATA, level: 'method' });\n\n/**\n * Options accepted by {@link CloudflareApplication.mountOpenApi}.\n *\n * Re-exposes vela's `MountOpenApiOptions` type — derived structurally from\n * the underlying `VelaApplication.mountOpenApi` signature so consumers don't\n * have to reach into vela's internal subpaths to type the argument.\n */\nexport type MountOpenApiOptions = Parameters<VelaApplication['mountOpenApi']>[0];\n\nfunction invoke(instance: object, methodName: string | symbol, args: unknown[]): unknown {\n  // Decorator metadata names an instance method; inspect it before invoking.\n  const method: unknown = Reflect.get(instance, methodName);\n  if (typeof method !== 'function') {\n    throw new Error(\n      `Method '${String(methodName)}' is not a function on ${instance.constructor.name}`,\n    );\n  }\n  return Reflect.apply(method, instance, args);\n}\n\nfunction entrypointString(meta: unknown, property: string): string {\n  if (typeof meta !== 'object' || meta === null) throw new Error('Invalid entrypoint metadata.');\n  const value: unknown = Reflect.get(meta, property);\n  if (typeof value !== 'string')\n    throw new Error(`Invalid entrypoint metadata: ${property} must be a string.`);\n  return value;\n}\n\n/** Wait for every matching handler, even when one fails before its siblings. */\nasync function settleEntrypoints(work: readonly Promise<void>[]): Promise<void> {\n  const outcomes = await Promise.allSettled(work);\n  const errors = outcomes.flatMap((outcome) =>\n    outcome.status === 'rejected' ? [outcome.reason] : [],\n  );\n  if (errors.length === 1) throw errors[0];\n  if (errors.length > 1) throw new AggregateError(errors, 'Multiple entrypoint handlers failed.');\n}\n\n/**\n * Wraps VelaApplication with Cloudflare-specific handlers:\n * - `fetch` — HTTP request handler (from Hono)\n * - `scheduled` — Cron trigger handler (matches `@Scheduled()` decorators\n *                 AND vela's own `@Cron()` jobs)\n * - `queue` — Queue consumer handler (matches `@QueueConsumer()` decorators)\n * - `mountOpenApi` — Serve an OpenAPI document (and optional Scalar UI) on\n *                    the underlying Hono app\n *\n * @example\n * ```ts\n * const app = await createCloudflareApp(AppModule, { env, envToken: ENV });\n * export default {\n *   fetch: app.fetch,\n *   scheduled: app.scheduled.bind(app),\n *   queue: app.queue.bind(app),\n * };\n * ```\n *\n * @example\n * ```ts\n * // Serve OpenAPI docs alongside your routes\n * const app = await createCloudflareApp(AppModule, { env, envToken: ENV });\n * const document = createOpenApiDocument(AppModule);\n * app.mountOpenApi({ document, ui: 'scalar' });\n * // GET /openapi.json -> JSON document\n * // GET /scalar       -> Scalar UI (loads from CDN)\n * ```\n */\nexport class CloudflareApplication<T extends object = object> {\n  readonly #wsGatewayRoutes: WsGatewayRoute[] = [];\n  readonly #app: VelaApplication;\n\n  constructor(\n    app: VelaApplication,\n    readonly env: T,\n  ) {\n    this.#app = app;\n    this.get = app.get.bind(app);\n  }\n\n  readonly fetch = async (request: Request, env: T, ctx?: ExecutionContext): Promise<Response> => {\n    assertCloudflareEnvironment(this.env, env);\n    return this.#app.fetch(request, env, ctx);\n  };\n\n  getHonoApp(): ReturnType<VelaApplication['getHonoApp']> {\n    return this.#app.getHonoApp();\n  }\n\n  /**\n   * Resolve a provider from the application's DI container (delegates to\n   * `VelaApplication.get`). Handy for grabbing a service — e.g. an auth service —\n   * to use inside `createCloudflareApp({ middleware: env => [...] })` request middleware,\n   * which runs outside the DI request pipeline.\n   *\n   * @example\n   * ```ts\n   * const app = await createCloudflareApp(AppModule, { env, envToken: ENV });\n   * const auth = app.get(BetterAuthService);\n   * ```\n   */\n  readonly get: VelaApplication['get'];\n\n  get entrypoints(): VelaApplication['entrypoints'] {\n    return this.#app.entrypoints;\n  }\n\n  /**\n   * Serve a pre-built OpenAPI document (and optionally a Scalar UI) on the\n   * underlying Hono app. Delegates verbatim to `VelaApplication.mountOpenApi`,\n   * so the JSON endpoint defaults to `/openapi.json` and the Scalar UI (when\n   * opted in) defaults to `/scalar`. Edge-safe — the UI HTML loads Scalar from\n   * a CDN at runtime, nothing is bundled server-side.\n   *\n   * @example\n   * ```ts\n   * import { createOpenApiDocument } from '@velajs/vela';\n   *\n   * const app = await createCloudflareApp(AppModule, { env, envToken: ENV });\n   * const document = createOpenApiDocument(AppModule, {\n   *   info: { title: 'My API', version: '1.0.0' },\n   * });\n   * app.mountOpenApi({ document, ui: 'scalar' });\n   * // GET /openapi.json -> { openapi: '3.1.0', ... }\n   * // GET /scalar       -> Scalar UI HTML\n   * ```\n   */\n  mountOpenApi(options: MountOpenApiOptions): this {\n    this.#app.mountOpenApi(options);\n    return this;\n  }\n\n  /**\n   * @internal Upgrade routes come from validated gateway entrypoints, including\n   * request-scoped gateways without a bootstrap instance. Retain the instance\n   * scan for legacy applications that only declare forwarding metadata.\n   */\n  scanInstances(instances: unknown[]): void {\n    const routes = new Map<string, WsGatewayRoute>();\n    for (const ep of this.#app.entrypoints.ofKind('websocket')) {\n      if (typeof ep.meta !== 'object' || ep.meta === null || !('dispatcher' in ep.meta)) continue;\n      const meta = readWsEntrypointMeta(ep.meta);\n      if (meta.options.binding) {\n        routes.set(meta.path, {\n          path: meta.path,\n          binding: meta.options.binding,\n          options: { ...meta.options },\n        });\n      }\n    }\n    for (const instance of instances) {\n      if (!instance || typeof instance !== 'object') continue;\n      for (const route of collectWsGatewayRoutes(instance)) {\n        if (!routes.has(route.path)) routes.set(route.path, route);\n      }\n    }\n    this.#wsGatewayRoutes.splice(0, this.#wsGatewayRoutes.length, ...routes.values());\n  }\n\n  /** @internal — upgrade routes discovered from the application's gateways. */\n  getWsGatewayRoutes(): WsGatewayRoute[] {\n    return [...this.#wsGatewayRoutes];\n  }\n\n  /**\n   * Handle Cloudflare scheduled (cron) events.\n   * Matches the event's cron expression to `@Scheduled()` and vela `@Cron()`\n   * handlers read from `app.entrypoints`; each handler runs inside a fresh\n   * request-scoped child (request-scoped providers rebuild per tick).\n   */\n  async scheduled(\n    event: { cron: string; scheduledTime?: number },\n    env: T,\n    ctx: { waitUntil: (promise: Promise<unknown>) => void },\n  ): Promise<void> {\n    assertCloudflareEnvironment(this.env, env);\n    const handlers = [\n      ...this.#app.entrypoints\n        .ofKind('cf:scheduled')\n        .map((ep) => ({ ep, cron: entrypointString(ep.meta, 'cron') })),\n      ...this.#app.entrypoints\n        .ofKind('cf:vela-cron')\n        .map((ep) => ({ ep, cron: entrypointString(ep.meta, 'expression') })),\n    ].filter((h) => h.cron === event.cron);\n\n    await settleEntrypoints(handlers.map(({ ep }) => this.dispatchEntrypoint(ep, event, env, ctx)));\n  }\n\n  /**\n   * Run one entrypoint handler inside a fresh request scope, through the\n   * shared guard → interceptor pipeline (components declared with\n   * `@UseGuards`/`@UseInterceptors`/`@UseFilters` on the consumer class or\n   * method). HTTP-global components deliberately do NOT apply — an HTTP auth\n   * guard has no business rejecting a queue batch. Unclaimed errors rethrow\n   * so the platform's retry semantics stay intact.\n   */\n  private async dispatchEntrypoint(\n    ep: Entrypoint,\n    payload: unknown,\n    env: T,\n    platformContext: { waitUntil: (promise: Promise<unknown>) => void },\n  ): Promise<void> {\n    const targetClass = ep.token;\n    if (typeof targetClass !== 'function') throw new Error('Entrypoint token must be a class.');\n    if (ep.methodName === undefined) throw new Error('Entrypoint must declare a handler method.');\n    const methodName = ep.methodName;\n    const reportContext = {\n      edge: ep.kind === 'cf:queue' ? ('queue' as const) : ('schedule' as const),\n      source: `${targetClass.name}.${String(methodName)}`,\n    };\n    let reported: { error: unknown } | undefined;\n    try {\n      await runInEntrypointScope(this.#app.getContainer(), async (scope, lifetime) => {\n        const moduleId = getEntrypointModuleId(scope, ep);\n        const context = buildEntrypointExecutionContext(\n          ep.kind,\n          targetClass,\n          methodName,\n          payload,\n          moduleId,\n          scope,\n        );\n        const invocationContext = {\n          waitUntil(promise: Promise<unknown>): void {\n            lifetime.waitUntil(promise);\n            platformContext.waitUntil(promise);\n          },\n        };\n        let filters: ExceptionFilter[] = [];\n        try {\n          filters = (\n            await resolveScopedComponentsAsync('filter', targetClass, methodName, scope, moduleId)\n          ).toReversed();\n          const guards = await resolveScopedComponentsAsync(\n            'guard',\n            targetClass,\n            methodName,\n            scope,\n            moduleId,\n          );\n          const interceptors = await resolveScopedComponentsAsync(\n            'interceptor',\n            targetClass,\n            methodName,\n            scope,\n            moduleId,\n          );\n          await PipelineRunner.run({\n            context,\n            guards,\n            interceptors,\n            resolveArgs: async () => [payload, env, invocationContext],\n            invoke: async (args) => {\n              const instance = await resolveEntrypoint(scope, ep);\n              if (typeof instance !== 'object' || instance === null) {\n                throw new Error('Entrypoint must resolve to an object.');\n              }\n              return invoke(instance, methodName, args);\n            },\n          });\n        } catch (error) {\n          resolveErrorReporter(scope).report(error, reportContext);\n          for (const filter of filters) {\n            if (shouldFilterCatch(filter, error)) {\n              // Filters run closest-first; this is the framework catch hook.\n              // eslint-disable-next-line no-await-in-loop, promise/valid-params\n              await filter.catch(error, context);\n              return;\n            }\n          }\n          reported = { error };\n          throw error;\n        }\n      });\n    } catch (error) {\n      // Managed completion happens after the handler's filter boundary. Report\n      // a new completion failure without reporting an already-observed handler\n      // failure twice; preserve both errors in the rejected invocation.\n      if (!reported || reported.error !== error) {\n        const completionError =\n          reported && error instanceof AggregateError && error.errors[0] === reported.error\n            ? error.errors[1]\n            : error;\n        resolveErrorReporter(this.#app.getContainer()).report(completionError, reportContext);\n      }\n      throw error;\n    }\n  }\n\n  /**\n   * Handle Cloudflare Queue consumer events.\n   * Matches the batch queue name to `@QueueConsumer()` handlers read from\n   * `app.entrypoints`; each batch is processed inside a fresh request-scoped\n   * child (request-scoped providers rebuild per batch — no boot-time captives).\n   */\n  async queue(\n    batch: { queue: string; messages: readonly unknown[] },\n    env: T,\n    ctx: { waitUntil: (promise: Promise<unknown>) => void },\n  ): Promise<void> {\n    assertCloudflareEnvironment(this.env, env);\n    const handlers = this.#app.entrypoints\n      .ofKind('cf:queue')\n      .filter((ep) => entrypointString(ep.meta, 'queueName') === batch.queue);\n\n    await settleEntrypoints(handlers.map((ep) => this.dispatchEntrypoint(ep, batch, env, ctx)));\n  }\n\n  async close(signal?: string): Promise<void> {\n    return this.#app.close(signal);\n  }\n}\n","import type { ExecutionContext } from 'hono';\nimport { getConnInfo } from 'hono/cloudflare-workers';\nimport { VelaFactory } from '@velajs/vela';\nimport type {\n  InjectionToken,\n  RuntimeAdapter,\n  VelaMiddlewareHandler,\n  VelaSecurityOptions,\n} from '@velajs/vela';\nimport { CloudflareApplication } from './cloudflare-application';\nimport { assertCloudflareEnvironment, registerCloudflareEnvironment } from './environment';\nimport { registerWebSocketRoutes } from './websocket/websocket-routing';\nimport { resolveCloudflareRoot } from './root-module';\nimport type { CloudflareRoot } from './root-module';\n\nexport interface CloudflareWorkerOptions<T extends object> {\n  /** Global typed DI token for the platform's native environment. */\n  envToken: InjectionToken<T>;\n  globalPrefix?: string;\n  security?: VelaSecurityOptions;\n  /** Build request middleware from the same typed native environment as DI. */\n  middleware?: (env: NoInfer<T>) => VelaMiddlewareHandler[];\n}\n\nexport interface CreateCloudflareAppOptions<T extends object> extends CloudflareWorkerOptions<T> {\n  /** Supply the platform environment inside fetch/queue/scheduled or a DO constructor. */\n  env: NoInfer<T>;\n}\n\n/** Bind an application to one environment before provider factories and lifecycle hooks. */\nexport function cloudflareAdapter<T extends object>(\n  options: CreateCloudflareAppOptions<T>,\n): RuntimeAdapter {\n  return {\n    name: 'cloudflare',\n    requestMiddleware: [\n      async (context, next) => {\n        assertCloudflareEnvironment(options.env, context.env);\n        await next();\n      },\n    ],\n    invocationTransport:\n      ({ app }) =>\n      (request) =>\n        Promise.resolve(app.fetch(request, options.env)),\n    getClientIp: (c) => getConnInfo(c).remote.address ?? null,\n    configureContainer: (container) => {\n      registerCloudflareEnvironment(container, { token: options.envToken, env: options.env });\n    },\n  };\n}\n\n/** Build an application for one native Workers environment. Call inside a platform event. */\nexport async function createCloudflareApp<T extends object>(\n  rootModule: CloudflareRoot<NoInfer<T>>,\n  options: CreateCloudflareAppOptions<T>,\n): Promise<CloudflareApplication<T>> {\n  const velaApp = await VelaFactory.create(resolveCloudflareRoot(rootModule, options.env), {\n    globalPrefix: options.globalPrefix,\n    security: options.security,\n    middleware: options.middleware?.(options.env),\n    adapters: [cloudflareAdapter(options)],\n  });\n  const app = new CloudflareApplication(velaApp, options.env);\n  app.scanInstances(velaApp.getInstances());\n  registerWebSocketRoutes(app.getHonoApp(), app.getWsGatewayRoutes());\n  return app;\n}\n\n/**\n * Worker entrypoint with one bootstrap per environment identity. Weak keys let\n * obsolete environments and secrets be collected. Concurrent cold events share\n * construction; failed construction is evicted so the next event can retry.\n */\nexport function createCloudflareWorker<T extends object>(\n  rootModule: CloudflareRoot<NoInfer<T>>,\n  options: CloudflareWorkerOptions<T>,\n) {\n  const applications = new WeakMap<T, Promise<CloudflareApplication<T>>>();\n  const application = (env: T): Promise<CloudflareApplication<T>> => {\n    const existing = applications.get(env);\n    if (existing) return existing;\n    const pending = createCloudflareApp(rootModule, { ...options, env });\n    applications.set(env, pending);\n    void pending.catch(() => {\n      if (applications.get(env) === pending) applications.delete(env);\n    });\n    return pending;\n  };\n  return {\n    async fetch(request: Request, env: T, ctx: ExecutionContext): Promise<Response> {\n      return (await application(env)).fetch(request, env, ctx);\n    },\n    async scheduled(\n      event: { cron: string; scheduledTime?: number },\n      env: T,\n      ctx: { waitUntil: (promise: Promise<unknown>) => void },\n    ): Promise<void> {\n      return (await application(env)).scheduled(event, env, ctx);\n    },\n    async queue(\n      batch: { queue: string; messages: readonly unknown[] },\n      env: T,\n      ctx: { waitUntil: (promise: Promise<unknown>) => void },\n    ): Promise<void> {\n      return (await application(env)).queue(batch, env, ctx);\n    },\n  };\n}\n","import { InjectionToken } from '@velajs/vela';\nimport type { StorageModuleOptions } from './storage.types';\n\nexport const STORAGE_OPTIONS = new InjectionToken<StorageModuleOptions>('STORAGE_OPTIONS');\n","/** R2-compatible object-key claim bound. Keeps decode work predictably small. */\nexport const MAX_STORAGE_KEY_BYTES = 1024;\n\nconst BASE64URL_RE = /^[A-Za-z0-9_-]+$/;\nconst ROOT_TOKEN_PATTERNS: Record<string, string> = {\n  date: '\\\\d{4}-\\\\d{2}-\\\\d{2}',\n  year: '\\\\d{4}',\n  month: '(?:0[1-9]|1[0-2])',\n  day: '(?:0[1-9]|[12]\\\\d|3[01])',\n  uuid: '[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}',\n};\n\n/** Encode an object key as an opaque, canonical base64url query claim. */\nexport function encodeStorageKeyClaim(key: string): string {\n  const bytes = new TextEncoder().encode(key);\n  if (bytes.byteLength === 0 || bytes.byteLength > MAX_STORAGE_KEY_BYTES) {\n    throw new Error(`Storage key must be 1–${MAX_STORAGE_KEY_BYTES} UTF-8 bytes`);\n  }\n  let binary = '';\n  for (const byte of bytes) binary += String.fromCharCode(byte);\n  return btoa(binary).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '');\n}\n\n/** Decode exactly one canonical base64url layer. Malformed/non-UTF-8 claims return undefined. */\nexport function decodeStorageKeyClaim(claim: string): string | undefined {\n  try {\n    if (\n      claim.length === 0 ||\n      claim.length > Math.ceil((MAX_STORAGE_KEY_BYTES * 4) / 3) ||\n      !BASE64URL_RE.test(claim) ||\n      claim.length % 4 === 1\n    ) {\n      return undefined;\n    }\n    const base64 = claim.replace(/-/g, '+').replace(/_/g, '/');\n    const padded = base64 + '='.repeat((4 - (base64.length % 4)) % 4);\n    const binary = atob(padded);\n    const bytes = new Uint8Array(new ArrayBuffer(binary.length));\n    for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);\n    if (bytes.byteLength === 0 || bytes.byteLength > MAX_STORAGE_KEY_BYTES) return undefined;\n    const decoded = new TextDecoder('utf-8', { fatal: true, ignoreBOM: false }).decode(bytes);\n    return encodeStorageKeyClaim(decoded) === claim ? decoded : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction isDotSegment(segment: string): boolean {\n  let decoded = segment;\n  for (let i = 0; i < 2; i++) {\n    if (decoded === '' || decoded === '.' || decoded === '..') return true;\n    try {\n      const next = decodeURIComponent(decoded);\n      if (next === decoded) break;\n      decoded = next;\n    } catch {\n      break;\n    }\n  }\n  return decoded === '' || decoded === '.' || decoded === '..';\n}\n\nfunction rootSegmentPattern(segment: string): string {\n  let pattern = '';\n  let cursor = 0;\n  for (const match of segment.matchAll(/\\{(date|year|month|day|uuid)\\}/g)) {\n    pattern += segment.slice(cursor, match.index).replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n    pattern += ROOT_TOKEN_PATTERNS[match[1]!]!;\n    cursor = match.index! + match[0].length;\n  }\n  pattern += segment.slice(cursor).replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n  return pattern;\n}\n\n/** Assert a canonical key is beneath a static or templated configured root. */\nexport function isStorageKeyWithinRoot(key: string, root: string | undefined): boolean {\n  const segments = (root ?? '').split(/[/\\\\]+/).filter((segment) => !isDotSegment(segment));\n  if (segments.length === 0) return key.length > 0;\n  const rootPattern = segments.map(rootSegmentPattern).join('/');\n  return new RegExp(`^(?:${rootPattern})(?:/|$)`).test(key);\n}\n","import {\n  signUrl,\n  STORAGE_SIGNED_URL_PURPOSE,\n  type DownloadResult,\n  type PresignedUrlResult,\n  type PresignMethod,\n  type StorageBody,\n  type StorageDriver,\n  type UploadOptions,\n  type UploadResult,\n} from '@velajs/vela/storage';\nimport { encodeStorageKeyClaim } from './storage-key-claim';\n\n/** Base path of the StorageController presign-proxy route. */\nexport const STORAGE_ROUTE_BASE = '/storage';\n\nexport interface R2StorageDriverConfig {\n  disk: string;\n  bucket: R2Bucket;\n  /** HMAC secret for presigned URLs (typically env.APP_SECRET). */\n  secret?: string;\n}\n\n/** {@link StorageDriver} over a Cloudflare R2 bucket. */\nexport class R2StorageDriver implements StorageDriver {\n  constructor(private readonly config: R2StorageDriverConfig) {}\n\n  async upload(body: StorageBody, path: string, options: UploadOptions): Promise<UploadResult> {\n    await this.config.bucket.put(\n      path,\n      body as ReadableStream | ArrayBuffer | ArrayBufferView | string | Blob | null,\n      {\n        httpMetadata: options.mimeType ? { contentType: options.mimeType } : undefined,\n        customMetadata: options.metadata,\n      },\n    );\n    return {\n      path,\n      disk: this.config.disk,\n      size: options.size,\n      mimeType: options.mimeType ?? 'application/octet-stream',\n      uploadedAt: new Date(),\n    };\n  }\n\n  async download(path: string): Promise<DownloadResult> {\n    const obj = await this.config.bucket.get(path);\n    if (!obj) throw new Error(`Storage object not found at \"${path}\".`);\n    return {\n      toStream: () => obj.body as ReadableStream,\n      toArrayBuffer: () => obj.arrayBuffer(),\n      toText: () => obj.text(),\n      contentType: obj.httpMetadata?.contentType ?? 'application/octet-stream',\n      size: obj.size,\n      metadata: obj.customMetadata,\n    };\n  }\n\n  async delete(path: string): Promise<void> {\n    await this.config.bucket.delete(path);\n  }\n\n  async exists(path: string): Promise<boolean> {\n    return (await this.config.bucket.head(path)) !== null;\n  }\n\n  async getPresignedUrl(\n    path: string,\n    method: PresignMethod,\n    expiresIn: number,\n  ): Promise<PresignedUrlResult> {\n    if (!this.config.secret) {\n      throw new Error('A signing secret is required for presigned URLs (set APP_SECRET).');\n    }\n    // Defend the direct-driver path too: a non-finite/non-positive expiry would\n    // make signUrl omit `expires`, yielding a never-expiring URL.\n    if (!Number.isSafeInteger(expiresIn) || expiresIn <= 0) {\n      throw new Error(\n        `Invalid presigned URL expiry: ${expiresIn}s (must be a positive safe integer).`,\n      );\n    }\n    // The object key is an opaque signed query claim, never a URL path. This\n    // prevents WHATWG path normalization / multi-decode behavior from turning\n    // an encoded key into a different storage capability.\n    const claim = encodeStorageKeyClaim(path);\n    const routePath = `${STORAGE_ROUTE_BASE}/${encodeURIComponent(this.config.disk)}`;\n    const query = new URLSearchParams({ key: claim, method });\n    const url = await signUrl(`${routePath}?${query}`, this.config.secret, {\n      expiresIn,\n      method,\n      purpose: STORAGE_SIGNED_URL_PURPOSE,\n    });\n    return { url, method, expiresIn, expiresAt: new Date(Date.now() + expiresIn * 1000) };\n  }\n}\n","import { Inject, Injectable } from '@velajs/vela';\nimport { R2StorageDriver } from './r2-storage.driver';\nimport { STORAGE_OPTIONS } from './storage.tokens';\nimport type { DiskConfig, StorageModuleOptions } from './storage.types';\n\n@Injectable()\nexport class StorageManagerService {\n  constructor(@Inject(STORAGE_OPTIONS) private readonly options: StorageModuleOptions) {}\n\n  hasDisk(disk: string): boolean {\n    return this.options.disks.some((d) => d.disk === disk);\n  }\n\n  getDiskConfig(disk: string): DiskConfig {\n    const config = this.options.disks.find((d) => d.disk === disk);\n    if (!config) throw new Error(`Storage disk \"${disk}\" is not configured.`);\n    return config;\n  }\n\n  getDriver(disk: string): R2StorageDriver {\n    const config = this.getDiskConfig(disk);\n    return new R2StorageDriver({ disk, bucket: config.bucket, secret: this.options.secret });\n  }\n}\n","import { Controller, Get, Inject, Req } from '@velajs/vela';\nimport { joinStoragePath, STORAGE_SIGNED_URL_PURPOSE, verifySignedUrl } from '@velajs/vela/storage';\nimport type { Context } from 'hono';\nimport { STORAGE_OPTIONS } from './storage.tokens';\nimport type { StorageModuleOptions } from './storage.types';\nimport { StorageManagerService } from './storage-manager.service';\nimport { decodeStorageKeyClaim, isStorageKeyWithinRoot } from './storage-key-claim';\n\n/**\n * Presign-proxy: serves objects for HMAC-signed URLs produced by\n * `StorageService.url()`. R2 has no native presign, so a signed URL points here;\n * this route verifies the signature (+expiry) before streaming the object.\n * The FULL object key (root already applied at sign time) is carried as an\n * opaque base64url query claim. The signature is verified before the claim is\n * decoded exactly once and checked against the configured disk root.\n */\n@Controller('storage')\nexport class StorageController {\n  constructor(\n    @Inject(StorageManagerService) private readonly manager: StorageManagerService,\n    @Inject(STORAGE_OPTIONS) private readonly options: StorageModuleOptions,\n  ) {}\n\n  @Get('/:disk')\n  async download(@Req() c: Context): Promise<Response> {\n    const secret = this.options.secret;\n    if (!secret) return new Response('Storage signing is not configured', { status: 500 });\n\n    // Verify the complete path/query capability before inspecting the disk or\n    // decoding attacker-controlled claims.\n    if (\n      !(await verifySignedUrl(c.req.url, secret, {\n        method: c.req.method,\n        purpose: STORAGE_SIGNED_URL_PURPOSE,\n      }))\n    ) {\n      return new Response('Invalid or expired URL', { status: 403 });\n    }\n\n    // Enforce the signed `method` scope: this proxy only serves reads, so a URL\n    // scoped to PUT/DELETE/HEAD must NOT be honored as a GET (it would over-grant\n    // read access relative to the token's intended scope). The param is part of\n    // the signed payload, so it is trustworthy once the signature verifies.\n    const url = new URL(c.req.url);\n    if (url.searchParams.get('method') !== 'GET') {\n      return new Response('URL is not scoped for reads', { status: 403 });\n    }\n\n    const disk = c.req.param('disk');\n    if (!disk || !this.manager.hasDisk(disk)) return new Response('Unknown disk', { status: 404 });\n\n    const claim = url.searchParams.get('key');\n    const decoded = claim ? decodeStorageKeyClaim(claim) : undefined;\n    if (!decoded) return new Response('Malformed storage key claim', { status: 400 });\n\n    // Canonicalize after the one decode. Signed direct-driver callers cannot\n    // smuggle dot segments or non-canonical aliases into the proxy contract.\n    const fullPath = joinStoragePath(undefined, decoded);\n    if (fullPath !== decoded) return new Response('Invalid storage key', { status: 403 });\n\n    if (!isStorageKeyWithinRoot(fullPath, this.manager.getDiskConfig(disk).root)) {\n      return new Response('Storage key is outside the configured root', { status: 403 });\n    }\n\n    try {\n      const result = await this.manager.getDriver(disk).download(fullPath);\n      const filename = fullPath.split('/').at(-1) || 'download';\n      return new Response(result.toStream(), {\n        headers: {\n          'content-type': result.contentType || 'application/octet-stream',\n          // Objects are untrusted user content.  The authenticated API origin\n          // never renders them inline (especially HTML/SVG), even when the\n          // stored Content-Type is attacker controlled.\n          'content-disposition': `attachment; filename*=UTF-8''${encodeURIComponent(filename)}`,\n          'x-content-type-options': 'nosniff',\n        },\n      });\n    } catch {\n      return new Response('Not found', { status: 404 });\n    }\n  }\n}\n","import { Inject, Injectable } from '@velajs/vela';\nimport {\n  joinStoragePath,\n  type DownloadResult,\n  type PresignedUrlResult,\n  type PresignMethod,\n  type StorageBody,\n  type UploadOptions,\n  type UploadResult,\n} from '@velajs/vela/storage';\nimport { StorageManagerService } from './storage-manager.service';\nimport { STORAGE_OPTIONS } from './storage.tokens';\nimport type { StorageModuleOptions } from './storage.types';\n\nconst DEFAULT_PRESIGN = { defaultExpiry: 3600, maxExpiry: 86400 };\n\n/**\n * Multi-disk storage facade. Applies each disk's (templated) root, resolves the\n * driver, and validates presign expiry. Injectable anywhere via `StorageService`.\n */\n@Injectable()\nexport class StorageService {\n  constructor(\n    @Inject(STORAGE_OPTIONS) private readonly options: StorageModuleOptions,\n    @Inject(StorageManagerService) private readonly manager: StorageManagerService,\n  ) {}\n\n  put(\n    relativePath: string,\n    body: StorageBody,\n    options: UploadOptions = {},\n    disk?: string,\n  ): Promise<UploadResult> {\n    const name = this.resolveDisk(disk);\n    return this.manager.getDriver(name).upload(body, this.fullPath(relativePath, name), options);\n  }\n\n  get(relativePath: string, disk?: string): Promise<DownloadResult> {\n    const name = this.resolveDisk(disk);\n    return this.manager.getDriver(name).download(this.fullPath(relativePath, name));\n  }\n\n  delete(relativePath: string, disk?: string): Promise<void> {\n    const name = this.resolveDisk(disk);\n    return this.manager.getDriver(name).delete(this.fullPath(relativePath, name));\n  }\n\n  exists(relativePath: string, disk?: string): Promise<boolean> {\n    const name = this.resolveDisk(disk);\n    return this.manager.getDriver(name).exists(this.fullPath(relativePath, name));\n  }\n\n  url(\n    relativePath: string,\n    method: PresignMethod = 'GET',\n    expiresIn?: number,\n    disk?: string,\n  ): Promise<PresignedUrlResult> {\n    const name = this.resolveDisk(disk);\n    return this.manager\n      .getDriver(name)\n      .getPresignedUrl(this.fullPath(relativePath, name), method, this.validateExpiry(expiresIn));\n  }\n\n  private resolveDisk(disk?: string): string {\n    const name = disk ?? this.options.defaultDisk;\n    if (!this.manager.hasDisk(name)) throw new Error(`Storage disk \"${name}\" is not configured.`);\n    return name;\n  }\n\n  private fullPath(relativePath: string, disk: string): string {\n    return joinStoragePath(this.manager.getDiskConfig(disk).root, relativePath);\n  }\n\n  private validateExpiry(expiresIn?: number): number {\n    const cfg = this.options.presignedUrl ?? DEFAULT_PRESIGN;\n    const value = expiresIn ?? cfg.defaultExpiry;\n    // `Number.isSafeInteger` rejects NaN/fractional/infinite values — otherwise\n    // `NaN < 1 || NaN > max` is false,\n    // NaN slips through, signUrl omits `expires`, and the URL never expires.\n    if (!Number.isSafeInteger(value) || value < 1 || value > cfg.maxExpiry) {\n      throw new Error(`Presigned URL expiry ${value}s is out of range (1–${cfg.maxExpiry}s).`);\n    }\n    return value;\n  }\n}\n","import { ConfigurableModuleBuilder, Module } from '@velajs/vela';\nimport { StorageController } from './storage.controller';\nimport { StorageManagerService } from './storage-manager.service';\nimport { StorageService } from './storage.service';\nimport { STORAGE_OPTIONS } from './storage.tokens';\nimport type { StorageModuleOptions } from './storage.types';\n\nconst { ConfigurableModuleClass } = new ConfigurableModuleBuilder<StorageModuleOptions>({\n  moduleName: 'Storage',\n  optionsInjectionToken: STORAGE_OPTIONS,\n}).build();\n\n@Module({\n  providers: [StorageManagerService, StorageService],\n  controllers: [StorageController],\n  exports: [StorageService, StorageManagerService, STORAGE_OPTIONS],\n})\nexport class StorageModule extends ConfigurableModuleClass {}\n","import {\n  type AsyncCacheStore,\n  type CacheEntryReader,\n  type CacheEntryWriter,\n  type CacheEntry,\n  type CacheInvalidationStore,\n} from '@velajs/vela';\n\n/**\n * Native KV JSON value store. Metadata retains logical expiry even when KV's\n * physical retention rounds up to its 60-second minimum. Legacy values without\n * metadata remain readable, but cannot safely backfill another tier.\n */\nexport class KVCacheStore implements AsyncCacheStore, CacheEntryReader, CacheEntryWriter {\n  constructor(private readonly ns: KVNamespace) {}\n\n  async get(key: string): Promise<unknown> {\n    return (await this.getEntry(key))?.value;\n  }\n\n  async getEntry(key: string): Promise<{ value: unknown; expiresAt?: number } | undefined> {\n    const { value, metadata } = await this.ns.getWithMetadata<unknown, unknown>(key, 'json');\n    if (value === null) return undefined;\n    if (typeof metadata === 'object' && metadata !== null && 'velaCacheExpiresAt' in metadata) {\n      const expiresAt = metadata.velaCacheExpiresAt;\n      if (typeof expiresAt !== 'number' || !Number.isFinite(expiresAt) || expiresAt <= Date.now())\n        return undefined;\n      return { value, expiresAt };\n    }\n    return { value };\n  }\n\n  async set(key: string, value: unknown, ttl?: number): Promise<void> {\n    if (ttl !== undefined && (!Number.isFinite(ttl) || ttl < 0))\n      throw new TypeError('Cache TTL must be finite and nonnegative.');\n    if (ttl !== undefined) return this.setEntry(key, { value, expiresAt: Date.now() + ttl * 1000 });\n    await this.ns.put(key, JSON.stringify(value));\n  }\n\n  async setEntry(key: string, entry: CacheEntry): Promise<void> {\n    if (!Number.isFinite(entry.expiresAt)) throw new TypeError('Cache expiry must be finite.');\n    const remaining = (entry.expiresAt - Date.now()) / 1000;\n    if (remaining <= 0) return this.del(key);\n    await this.ns.put(key, JSON.stringify(entry.value), {\n      expirationTtl: Math.max(60, Math.ceil(remaining)),\n      metadata: { velaCacheExpiresAt: entry.expiresAt },\n    });\n  }\n\n  async del(key: string): Promise<void> {\n    await this.ns.delete(key);\n  }\n\n  /** Namespace-wide, best effort. Use a dedicated value namespace; never use for scoped invalidation. */\n  async clear(): Promise<void> {\n    let cursor: string | undefined;\n    do {\n      const list = await this.ns.list(cursor ? { cursor } : undefined);\n      await Promise.all(list.keys.map((entry) => this.ns.delete(entry.name)));\n      cursor = list.list_complete ? undefined : list.cursor;\n    } while (cursor);\n  }\n}\n\n/**\n * Optional, eventually consistent generation store. Use a dedicated KV namespace\n * without TTL/lifecycle cleanup. Never delete/reset generations while entries can\n * survive. Concurrent writes and cached/negative reads prevent strong invalidation;\n * this is unsuitable for strict read-after-write or authorization revocation.\n */\nexport class KVCacheInvalidationStore implements CacheInvalidationStore {\n  constructor(private readonly ns: KVNamespace) {}\n  async getVersion(key: string): Promise<string> {\n    const value: unknown = await this.ns.get(key, 'json');\n    if (value === null) return 'initial';\n    if (typeof value !== 'string' || value.length === 0 || value.length > 2048)\n      throw new TypeError('Invalid cache generation.');\n    return value;\n  }\n  async invalidate(key: string): Promise<void> {\n    await this.ns.put(key, JSON.stringify(crypto.randomUUID()));\n  }\n}\n","import type { FeatureFlagDriver, FlagContext } from '@velajs/feature-flags';\n\n/**\n * The subset of a Cloudflare **Flagship** binding this driver evaluates against\n * — the four typed value methods. The binding itself returns the supplied\n * `defaultValue` on evaluation errors; transport-level failures reject and are\n * left to propagate (never-throw is the service layer's job, not the driver's).\n *\n * @see https://developers.cloudflare.com/flagship/binding/\n */\nexport interface FlagshipBinding {\n  getBooleanValue(key: string, defaultValue: boolean, context?: FlagContext): Promise<boolean>;\n  getStringValue(key: string, defaultValue: string, context?: FlagContext): Promise<string>;\n  getNumberValue(key: string, defaultValue: number, context?: FlagContext): Promise<number>;\n  getObjectValue(key: string, defaultValue: object, context?: FlagContext): Promise<unknown>;\n}\n\nexport interface FlagshipFlagDriverOptions {\n  /** Driver name used for `use(name)` / default-driver selection. Default `\"flagship\"`. */\n  name?: string;\n}\n\n/**\n * {@link FeatureFlagDriver} backed by a Cloudflare Flagship binding.\n *\n * A thin, honest wrapper: each contract method maps 1:1 onto the binding's\n * corresponding value method, forwarding the caller's `fallback` (the binding's\n * `defaultValue`) and evaluation context. The binding resolves the fallback on\n * evaluation errors; anything the binding *rejects* with (e.g. a `remote: true`\n * dev-proxy tunnel dropping) propagates — `@velajs/feature-flags`'s service owns\n * the never-throw guarantee.\n *\n * Build the driver inside a provider factory with the native environment:\n *\n * ```ts\n * FeatureFlagsModule.forRootAsync({\n *   inject: [ENV],\n *   useFactory: (env: WorkerEnv) => ({ drivers: [flagshipFlagDriver(env.FLAGS)] }),\n * });\n * ```\n *\n * Evaluation ergonomics (the 1:1 binding-method mapping) are ported from the\n * Stratal feature-flags service (MIT, © Temitayo Fadojutimi), reshaped as a\n * bare driver.\n */\nexport class FlagshipFlagDriver implements FeatureFlagDriver {\n  readonly name: string;\n  private readonly resolve: () => FlagshipBinding;\n\n  constructor(\n    binding: FlagshipBinding | (() => FlagshipBinding),\n    options: FlagshipFlagDriverOptions = {},\n  ) {\n    this.resolve = typeof binding === 'function' ? binding : () => binding;\n    this.name = options.name ?? 'flagship';\n  }\n\n  getBoolean(key: string, fallback: boolean, ctx?: FlagContext): Promise<boolean> {\n    return this.resolve().getBooleanValue(key, fallback, ctx);\n  }\n\n  getString(key: string, fallback: string, ctx?: FlagContext): Promise<string> {\n    return this.resolve().getStringValue(key, fallback, ctx);\n  }\n\n  getNumber(key: string, fallback: number, ctx?: FlagContext): Promise<number> {\n    return this.resolve().getNumberValue(key, fallback, ctx);\n  }\n\n  getObject(key: string, fallback: object, ctx?: FlagContext): Promise<unknown> {\n    return this.resolve().getObjectValue(key, fallback, ctx);\n  }\n}\n\n/** Convenience factory for {@link FlagshipFlagDriver}. */\nexport function flagshipFlagDriver(\n  binding: FlagshipBinding | (() => FlagshipBinding),\n  options?: FlagshipFlagDriverOptions,\n): FlagshipFlagDriver {\n  return new FlagshipFlagDriver(binding, options);\n}\n","import type { FeatureFlagDriver, FlagContext } from '@velajs/feature-flags';\n\nexport interface KvFlagDriverOptions {\n  /** Driver name used for `use(name)` / default-driver selection. Default `\"kv\"`. */\n  name?: string;\n  /** Prefix prepended to every flag key before the KV read. Default `\"\"` (none). */\n  prefix?: string;\n}\n\n/**\n * Cloudflare KV-backed {@link FeatureFlagDriver}. Flags are stored as JSON\n * values under an optional key prefix and read with `get(key, 'json')`. Reads\n * are type-checked against the requested type: a missing key or a value of the\n * wrong JSON type returns the caller's `fallback`. KV has no targeting, so the\n * evaluation context is ignored.\n *\n * The driver stays honest — it does **not** swallow errors. A KV failure (or a\n * `SyntaxError` from a malformed stored value) propagates; the never-throw\n * guarantee lives in `@velajs/feature-flags`'s service layer.\n *\n * Placed like {@link KVCacheStore}: construct it in a wiring factory over a\n * resolved {@link KVNamespace}.\n *\n * ```ts\n * FeatureFlagsModule.forRootAsync({\n *   inject: [ENV],\n *   useFactory: (env: WorkerEnv) => ({ drivers: [new KvFlagDriver(env.CACHE, { prefix: 'flag:' })] }),\n * });\n * ```\n */\nexport class KvFlagDriver implements FeatureFlagDriver {\n  readonly name: string;\n  private readonly prefix: string;\n\n  constructor(\n    private readonly ns: KVNamespace,\n    options: KvFlagDriverOptions = {},\n  ) {\n    this.name = options.name ?? 'kv';\n    this.prefix = options.prefix ?? '';\n  }\n\n  getBoolean(key: string, fallback: boolean, _ctx?: FlagContext): Promise<boolean> {\n    return this.read(key, fallback, (v) => typeof v === 'boolean');\n  }\n\n  getString(key: string, fallback: string, _ctx?: FlagContext): Promise<string> {\n    return this.read(key, fallback, (v) => typeof v === 'string');\n  }\n\n  getNumber(key: string, fallback: number, _ctx?: FlagContext): Promise<number> {\n    return this.read(key, fallback, (v) => typeof v === 'number');\n  }\n\n  getObject(key: string, fallback: object, _ctx?: FlagContext): Promise<unknown> {\n    return this.read(key, fallback, (v) => typeof v === 'object' && v !== null);\n  }\n\n  /**\n   * Reads and JSON-parses the (prefixed) key, returning the parsed value only\n   * when `matches` accepts its type; otherwise the caller's fallback. A missing\n   * key reads as `null` → fallback. Read/parse errors are left to propagate.\n   */\n  private async read<T>(\n    key: string,\n    fallback: T,\n    matches: (value: unknown) => value is T,\n  ): Promise<T> {\n    const value = await this.ns.get(this.prefix + key, 'json');\n    if (value === null || value === undefined) return fallback;\n    return matches(value) ? value : fallback;\n  }\n}\n\n/** Convenience factory for {@link KvFlagDriver}. */\nexport function kvFlagDriver(kv: KVNamespace, options?: KvFlagDriverOptions): KvFlagDriver {\n  return new KvFlagDriver(kv, options);\n}\n","import { createParamDecorator } from '@velajs/vela';\n\n/**\n * Parameter decorator to inject Cloudflare environment bindings.\n *\n * Without arguments, returns the entire `env` object.\n * With a binding name, returns that specific binding.\n *\n * @example\n * ```ts\n * @Get()\n * handle(@Env() env: WorkerEnv) { ... }\n *\n * @Get()\n * handle(@Env('MY_KV') kv: KVNamespace) { ... }\n * ```\n */\nexport const Env = createParamDecorator<string | undefined>((bindingName, ctx): unknown => {\n  // Hono Context has .env on Cloudflare Workers\n  const env: unknown = ctx.getContext().env;\n  if (typeof env !== 'object' || env === null) return undefined;\n  return bindingName ? Reflect.get(env, bindingName) : env;\n});\n","import { defineMetadata, getMetadata, parseCron, registerEntrypointKind } from '@velajs/vela';\n\nconst SCHEDULED_METADATA_KEY = 'cloudflare:scheduled';\n\n// Open entrypoint kind: adapters enumerate cron handlers via\n// `app.entrypoints.ofKind('cf:scheduled')` — declared next to the decorator.\nregisterEntrypointKind({ kind: 'cf:scheduled', metaKey: SCHEDULED_METADATA_KEY, level: 'method' });\n\nexport interface ScheduledMetadata {\n  cron: string;\n  methodName: string;\n}\n\n/** Compatible with the existing programmatic scheduled() entrypoint. */\nexport interface ScheduledEvent {\n  readonly cron: string;\n  readonly scheduledTime?: number;\n}\n\n/** Native controller passed unchanged to a Worker handler. Call noRetry on its receiver. */\nexport interface ScheduledController extends ScheduledEvent {\n  readonly scheduledTime: number;\n  noRetry(): void;\n}\n\nexport interface ScheduledContext {\n  waitUntil(promise: Promise<unknown>): void;\n}\n\nexport type ScheduledHandler<Env extends object = object> = (\n  controller: ScheduledController,\n  env: Env,\n  context: ScheduledContext,\n) => void | Promise<void>;\n\nexport function parseScheduledMetadata(value: unknown): ScheduledMetadata {\n  if (\n    typeof value !== 'object' ||\n    value === null ||\n    !('cron' in value) ||\n    typeof value.cron !== 'string' ||\n    !('methodName' in value) ||\n    typeof value.methodName !== 'string' ||\n    !parseCron(value.cron, { dialect: 'cloudflare' })\n  ) {\n    throw new TypeError('Invalid Cloudflare scheduled metadata');\n  }\n  return { cron: value.cron, methodName: value.methodName };\n}\n\n/**\n * Marks a method as a scheduled (cron) handler.\n *\n * @example\n * ```ts\n * @Injectable()\n * class WorkerService {\n *   @Scheduled('0 * * * *')\n *   async hourlyCron() {\n *     console.log('Running hourly');\n *   }\n * }\n * ```\n */\nexport function Scheduled(cron: string): MethodDecorator {\n  if (!parseCron(cron, { dialect: 'cloudflare' })) {\n    throw new TypeError(`Invalid Cloudflare cron expression: ${cron}`);\n  }\n  return (target: object, propertyKey: string | symbol, _descriptor: PropertyDescriptor) => {\n    // Work with a validated copy rather than mutating the registry's handler list.\n    const existing = getScheduledMetadata(target);\n    existing.push({ cron, methodName: String(propertyKey) });\n    defineMetadata(SCHEDULED_METADATA_KEY, existing, target.constructor);\n  };\n}\n\nexport function getScheduledMetadata(target: object): ScheduledMetadata[] {\n  const ctor = typeof target === 'function' ? target : target.constructor;\n  const value: unknown = getMetadata(SCHEDULED_METADATA_KEY, ctor);\n  if (value === undefined) return [];\n  if (!Array.isArray(value)) throw new TypeError('Invalid Cloudflare scheduled metadata list');\n  return value.map(parseScheduledMetadata);\n}\n","import { defineMetadata, getMetadata, registerEntrypointKind } from '@velajs/vela';\n\nconst QUEUE_CONSUMER_METADATA_KEY = 'cloudflare:queue-consumer';\n\n// Open entrypoint kind: any adapter can enumerate queue consumers via\n// `app.entrypoints.ofKind('cf:queue')` — declared here, next to the decorator,\n// with zero vela-core involvement.\nregisterEntrypointKind({ kind: 'cf:queue', metaKey: QUEUE_CONSUMER_METADATA_KEY, level: 'method' });\n\nexport interface QueueConsumerMetadata {\n  queueName: string;\n  methodName: string;\n}\n\n/**\n * Marks a method as a queue consumer handler.\n *\n * @example\n * ```ts\n * @Injectable()\n * class WorkerService {\n *   @QueueConsumer('email-queue')\n *   async processEmails(batch: MessageBatch) {\n *     for (const msg of batch.messages) {\n *       console.log('Processing:', msg.body);\n *       msg.ack();\n *     }\n *   }\n * }\n * ```\n */\nexport function QueueConsumer(queueName: string): MethodDecorator {\n  return (target: object, propertyKey: string | symbol, _descriptor: PropertyDescriptor) => {\n    const existing: QueueConsumerMetadata[] =\n      (getMetadata(QUEUE_CONSUMER_METADATA_KEY, target.constructor) as QueueConsumerMetadata[]) ??\n      [];\n    existing.push({ queueName, methodName: String(propertyKey) });\n    defineMetadata(QUEUE_CONSUMER_METADATA_KEY, existing, target.constructor);\n  };\n}\n\nexport function getQueueConsumerMetadata(target: object): QueueConsumerMetadata[] {\n  const ctor = target.constructor ?? target;\n  return (getMetadata(QUEUE_CONSUMER_METADATA_KEY, ctor) as QueueConsumerMetadata[]) ?? [];\n}\n","import { defineProvider, type DynamicModule } from '@velajs/vela';\nimport { WsDispatcher, WS_SERVER } from '@velajs/vela/websocket';\nimport { WsServerHolder } from './ws-server-holder';\n\n/**\n * Cloudflare counterpart to the core `WebSocketModule.forRoot()`. Import this in\n * your `AppModule` instead: it provides the gateway dispatcher plus a late-bound\n * `WS_SERVER` (`WsServerHolder`) that the WebSocket Durable Object wires to a\n * ctx-backed server per instance. `useClass` ensures a fresh holder per DI\n * container so colocated DO instances never share a server.\n */\nexport class CloudflareWebSocketModule {\n  static forRoot(): DynamicModule {\n    const providers = [defineProvider(WS_SERVER, { useClass: WsServerHolder }), WsDispatcher];\n\n    return {\n      module: CloudflareWebSocketModule,\n      providers,\n      exports: [WS_SERVER, WsDispatcher],\n    };\n  }\n}\n","import {\n  assertBroadcastCommandFits,\n  DEFAULT_WS_MAX_FRAME_BYTES,\n  resolveMaxFrameBytes,\n} from '@velajs/vela/websocket';\nimport type { BroadcastCommand } from '@velajs/vela/websocket';\nimport { roomToDurableId } from './room-id';\n\nexport interface WsBroadcastStub {\n  broadcast(cmd: BroadcastCommand): Promise<void>;\n}\n\nexport interface BroadcastNamespace {\n  idFromName(name: string): DurableObjectId;\n  get(id: DurableObjectId): WsBroadcastStub;\n}\n\n/**\n * Push to a room from a Worker HTTP handler / cron / queue consumer (server-\n * initiated emit). Resolves the room's Durable Object and calls its `broadcast`\n * RPC method — the same canonical room→DO mapping the upgrade route uses, so it\n * always reaches the DO holding those sockets.\n *\n * @example\n * ```ts\n * // In a controller — ns from the typed Worker environment\n * await broadcastToRoom(ns, '/orgs/:orgId/ws', `org:${id}`, 'order.created', order);\n * ```\n */\nexport async function broadcastToRoom(\n  ns: BroadcastNamespace,\n  gatewayPath: string,\n  room: string,\n  event: string,\n  data?: unknown,\n  options?: { exceptIds?: string[]; maxFrameBytes?: number },\n): Promise<void> {\n  const cmd: BroadcastCommand = {\n    rooms: [room],\n    exceptIds: options?.exceptIds,\n    frame: JSON.stringify({ event, data }),\n  };\n  const maxFrameBytes = resolveMaxFrameBytes({\n    maxFrameBytes: options?.maxFrameBytes ?? DEFAULT_WS_MAX_FRAME_BYTES,\n  });\n  assertBroadcastCommandFits(cmd, maxFrameBytes);\n  const stub = ns.get(roomToDurableId(ns, gatewayPath, room));\n  await stub.broadcast(cmd);\n}\n","import type { ThrottlerStorageRecord, ThrottlerStore } from '@velajs/vela';\n\n/** The deliberately small surface exposed by a Workers Rate Limiting binding. */\nexport interface CloudflareRateLimitBinding {\n  limit(input: { key: string }): Promise<{ success: boolean }>;\n}\n\nexport interface CloudflareRateLimitStoreOptions {\n  /** Must match the binding's configured `simple.limit`. */\n  limit: number;\n  /** Must match the binding's configured `simple.period`. */\n  periodSeconds: 10 | 60;\n  /** Bound attacker-influenced tracking keys before calling the platform. */\n  maxKeyBytes?: number;\n}\n\n/**\n * Adapt a Cloudflare Workers Rate Limiting binding to Vela's throttler store.\n *\n * The platform binding makes the allow/deny decision. It does not expose exact\n * counters or reset timestamps, so this adapter intentionally omits `remaining`.\n */\nexport function cloudflareRateLimitStore(\n  binding: CloudflareRateLimitBinding | (() => CloudflareRateLimitBinding),\n  options: CloudflareRateLimitStoreOptions,\n): ThrottlerStore {\n  if (!binding || (typeof binding !== 'function' && typeof binding.limit !== 'function')) {\n    throw new TypeError('A Cloudflare Rate Limiting binding is required');\n  }\n  if (\n    !Number.isSafeInteger(options.limit) ||\n    options.limit <= 0 ||\n    options.limit >= Number.MAX_SAFE_INTEGER\n  ) {\n    throw new RangeError('Rate limit must be a positive safe integer');\n  }\n  if (options.periodSeconds !== 10 && options.periodSeconds !== 60) {\n    throw new RangeError('Cloudflare rate-limit periods must be 10 or 60 seconds');\n  }\n\n  const maxKeyBytes = options.maxKeyBytes ?? 1_024;\n  if (!Number.isSafeInteger(maxKeyBytes) || maxKeyBytes <= 0 || maxKeyBytes > 4_096) {\n    throw new RangeError('maxKeyBytes must be between 1 and 4096');\n  }\n\n  const ttlMs = options.periodSeconds * 1_000;\n  const encoder = new TextEncoder();\n  const resolveBinding =\n    typeof binding === 'function' ? binding : (): CloudflareRateLimitBinding => binding;\n\n  return {\n    async increment(key: string, requestedTtlMs: number): Promise<ThrottlerStorageRecord> {\n      if (requestedTtlMs !== ttlMs) {\n        throw new Error(\n          `Cloudflare binding period mismatch: expected ${ttlMs}ms, received ${requestedTtlMs}ms`,\n        );\n      }\n      if (\n        typeof key !== 'string' ||\n        key.length === 0 ||\n        /[\\u0000-\\u001f\\u007f]/.test(key) ||\n        encoder.encode(key).byteLength > maxKeyBytes\n      ) {\n        throw new Error('Refusing an invalid or oversized rate-limit key');\n      }\n\n      const currentBinding = resolveBinding();\n      if (!currentBinding || typeof currentBinding.limit !== 'function') {\n        throw new Error('Cloudflare Rate Limiting binding is unavailable');\n      }\n      const decision = await currentBinding.limit({ key });\n      if (!decision || typeof decision.success !== 'boolean') {\n        throw new Error('Cloudflare rate-limit binding returned an invalid decision');\n      }\n\n      return {\n        // Vela consumes `allowed` as the authoritative platform decision. These\n        // sentinel counts preserve compatibility without inventing a counter.\n        count: decision.success ? 0 : options.limit + 1,\n        ttlMs,\n        allowed: decision.success,\n        enforcedLimit: options.limit,\n      };\n    },\n\n    reset(): never {\n      throw new Error('Cloudflare Rate Limiting bindings do not support counter reset');\n    },\n  };\n}\n","import type { VelaNonceDurableObject } from './nonce.durable-object';\nimport { MAX_NONCE_BYTES, isCanonicalBoundedText, isValidExpiry } from './nonce-validation';\nimport type { NonceStore } from '@velajs/vela';\n\nconst APP_NAMESPACE_PREFIX = 'vela:nonce:v1:';\nconst MAX_APP_NAMESPACE_BYTES = 128;\n/** The generated Workers binding type for {@link VelaNonceDurableObject}. */\nexport type DurableObjectNonceNamespace = DurableObjectNamespace<VelaNonceDurableObject>;\n\nexport interface DurableObjectNonceStoreOptions {\n  /**\n   * Stable application/environment boundary (for example `billing-api:prod`).\n   * Claims are globally single-use inside this namespace and isolated from all\n   * other application namespaces. It must be non-empty, canonical, and at most\n   * 128 UTF-8 bytes.\n   */\n  appNamespace: string;\n\n  /**\n   * Resolve the Workers Durable Object namespace at claim time. The resolver is\n   * intentionally not cached so request-scoped env/binding references stay safe.\n   */\n  binding: () => DurableObjectNonceNamespace | Promise<DurableObjectNonceNamespace>;\n}\n\n/**\n * Strict, cross-isolate {@link NonceStore} backed by one SQLite Durable Object\n * per explicit application namespace.\n *\n * Invalid input, an unavailable/malformed binding, RPC failure, or a malformed\n * RPC result all deny the claim (`false`). Only the literal boolean `true` from\n * the Durable Object is accepted.\n */\nexport function durableObjectNonceStore(options: DurableObjectNonceStoreOptions): NonceStore {\n  if (!options || typeof options !== 'object') {\n    throw new TypeError('Durable Object nonce-store options are required');\n  }\n  if (!isCanonicalBoundedText(options.appNamespace, MAX_APP_NAMESPACE_BYTES)) {\n    throw new TypeError(\n      `appNamespace must be canonical, non-empty, and at most ${MAX_APP_NAMESPACE_BYTES} UTF-8 bytes`,\n    );\n  }\n  if (typeof options.binding !== 'function') {\n    throw new TypeError('A lazy Durable Object namespace binding resolver is required');\n  }\n\n  const objectName = `${APP_NAMESPACE_PREFIX}${options.appNamespace}`;\n\n  return {\n    async claim(nonce: string, expEpochSeconds: number): Promise<boolean> {\n      const now = Math.floor(Date.now() / 1_000);\n      if (!isCanonicalBoundedText(nonce, MAX_NONCE_BYTES) || !isValidExpiry(expEpochSeconds, now)) {\n        return false;\n      }\n\n      try {\n        const namespace = await options.binding();\n\n        const id = namespace.idFromName(objectName);\n        const stub = namespace.get(id);\n        const result = await stub.claim(nonce, expEpochSeconds);\n        return result === true;\n      } catch {\n        return false;\n      }\n    },\n  };\n}\n"],"mappings":";;;;;;AAmBA,MAAM,2BAA2B;AACjC,MAAM,UAAU,IAAI,YAAY;AAchC,SAAS,gBAAgB,OAAiC;CACxD,OACE,OAAO,UAAU,YACjB,MAAM,SAAS,KACf,CAAC,MAAM,SAAS,IAAI,KACpB,CAAC,MAAM,SAAS,IAAI,KACpB,QAAQ,OAAO,KAAK,CAAC,CAAC,cAAc;AAExC;;AAGA,SAAS,eAAe,GAAkD;CACxE,MAAM,QAAQ,0BAA0B,EAAE,IAAI,GAAG;CACjD,IAAI,CAAC,OAAO,OAAO,KAAA;CACnB,MAAM,EAAE,WAAW,UAAU,gBAAgB;CAC7C,IACE,CAAC,gBAAgB,UAAU,MAAM,KACjC,CAAC,gBAAgB,UAAU,OAAO,KAClC,CAAC,gBAAgB,QAAQ,KACzB,OAAO,gBAAgB,YACvB,CAAC,OAAO,cAAc,WAAW,KACjC,eAAe,GAEf,OAAO;CACT,OAAO;EAAE;EAAW;EAAU;CAAY;AAC5C;;AAGA,SAAS,kBACP,iBACA,iBACsC;CACtC,IAAI,CAAC,mBAAmB,CAAC,iBAAiB,OAAO,KAAA;CACjD,IAAI,CAAC,iBAAiB,OAAO;CAC7B,IAAI,CAAC,iBAAiB,OAAO;CAC7B,IACE,gBAAgB,UAAU,WAAW,gBAAgB,UAAU,UAC/D,gBAAgB,UAAU,YAAY,gBAAgB,UAAU,WAChE,gBAAgB,UAAU,kBAAkB,gBAAgB,UAAU,iBACtE,gBAAgB,aAAa,gBAAgB,UAE7C,OAAO;CAET,OAAO;EACL,WAAW,EAAE,GAAG,gBAAgB,UAAU;EAC1C,UAAU,gBAAgB;EAC1B,aAAa,KAAK,IAAI,gBAAgB,aAAa,gBAAgB,WAAW;CAChF;AACF;;AAGA,SAAgB,uBAAuB,UAAoC;CAEzE,MAAM,UAAU,YAAqC,qBAAqB,SAAS,WAAW;CAC9F,IAAI,CAAC,SAAS,QAAQ,CAAC,SAAS,SAAS,OAAO,CAAC;CACjD,wBAAwB,OAAO;CAC/B,qBAAqB,OAAO;CAC5B,OAAO,CAAC;EAAE,MAAM,QAAQ;EAAM,SAAS,QAAQ;EAAS,SAAS,EAAE,GAAG,QAAQ;CAAE,CAAC;AACnF;;;;;;;AAQA,SAAgB,wBAAwB,MAAY,QAAgC;CAClF,KAAK,MAAM,SAAS,QAClB,KAAK,IAAI,MAAM,MAAM,OAAO,MAAe;EACzC,IAAI,EAAE,IAAI,OAAO,SAAS,CAAC,EAAE,YAAY,MAAM,aAC7C,OAAO,EAAE,KAAK,8BAA8B,GAAG;EAMjD,MAAM,UAAU,IAAI,QAAQ,EAAE,IAAI,IAAI,OAAO;EAC7C,QAAQ,OAAO,aAAa;EAC5B,QAAQ,OAAO,aAAa;EAC5B,QAAQ,OAAO,aAAa;EAC5B,QAAQ,OAAO,mBAAmB;EAClC,QAAQ,OAAO,sBAAsB;EACrC,QAAQ,OAAO,eAAe;EAC9B,QAAQ,OAAO,gBAAgB;EAC/B,QAAQ,OAAO,uBAAuB;EACtC,QAAQ,OAAO,eAAe;EAC9B,MAAM,mBAAmB,IAAI,QAAQ,EAAE,IAAI,KAAK,EAAE,QAAQ,CAAC;EAE3D,IAAI;EACJ,IAAI;GACF,SAAS,qBAAqB,MAAM,UAAU,SAAS,EAAE,IAAI,MAAM,IAAI,CAAC;EAC1E,QAAQ;GACN,OAAO,EAAE,KAAK,0BAA0B,GAAG;EAC7C;EAIA,MAAM,UAAU,MAAM,6BAA6B,MAAM,SAAS,kBAAkB,MAAM;EAC1F,IAAI,YAAY,OAAO,OAAO,EAAE,KAAK,+BAA+B,GAAG;EAEvE,MAAM,kBAAkB,eAAe,CAAC;EACxC,IAAI,oBAAoB,MAAM,OAAO,EAAE,KAAK,8BAA8B,GAAG;EAC7E,MAAM,WAAW,kBAAkB,iBAAiB,QAAQ,QAAQ;EACpE,IAAI,aAAa,MAAM,OAAO,EAAE,KAAK,oCAAoC,GAAG;EAC5E,IAAI,YAAY,SAAS,eAAe,KAAK,IAAI,GAC/C,OAAO,EAAE,KAAK,8BAA8B,GAAG;EAIjD,MAAM,iBAAiB,IAAI,QAAQ,QAAQ,QAAQ,OAAO;EAC1D,eAAe,IAAI,eAAe,MAAM;EACxC,eAAe,IAAI,eAAe,MAAM,IAAI;EAC5C,IAAI,UAAU;GACZ,eAAe,IAAI,eAAe,SAAS,UAAU,OAAO;GAC5D,eAAe,IAAI,iBAAiB,SAAS,UAAU,MAAM;GAC7D,eAAe,IAAI,kBAAkB,SAAS,UAAU,OAAO;GAC/D,eAAe,IAAI,yBAAyB,SAAS,UAAU,aAAa;GAC5E,eAAe,IAAI,iBAAiB,SAAS,QAAQ;GACrD,eAAe,IAAI,wBAAwB,OAAO,SAAS,WAAW,CAAC;EACzE;EAEA,OAAO,cACL,EAAE,KACF,MAAM,SACN,MAAM,MACN,QACA,IAAI,QAAQ,QAAQ,SAAS,EAAE,SAAS,eAAe,CAAC,CAC1D;CACF,CAAC;AAEL;;;;;;AAOA,eAAe,cACb,KACA,SACA,MACA,MACA,SACmB;CACnB,IAAI,OAAO,QAAQ,YAAY,QAAQ,MAAM,MAAM,IAAI,MAAM,+BAA+B;CAC5F,MAAM,YAAqB,QAAQ,IAAI,KAAK,OAAO;CACnD,IAAI,OAAO,cAAc,YAAY,cAAc,MACjD,OAAO,IAAI,SAAS,2BAA2B,QAAQ,sBAAsB,EAAE,QAAQ,IAAI,CAAC;CAE9F,MAAM,aAAsB,QAAQ,IAAI,WAAW,YAAY;CAC/D,MAAM,MAAe,QAAQ,IAAI,WAAW,KAAK;CACjD,IAAI,OAAO,eAAe,cAAc,OAAO,QAAQ,YACrD,MAAM,IAAI,MAAM,kCAAkC;CAEpD,MAAM,KAAc,QAAQ,MAAM,YAAY,WAAW,CAAC,sBAAsB,MAAM,IAAI,CAAC,CAAC;CAC5F,MAAM,OAAgB,QAAQ,MAAM,KAAK,WAAW,CAAC,EAAE,CAAC;CACxD,IAAI,OAAO,SAAS,YAAY,SAAS,MAAM,MAAM,IAAI,MAAM,6BAA6B;CAC5F,MAAM,QAAiB,QAAQ,IAAI,MAAM,OAAO;CAChD,IAAI,OAAO,UAAU,YAAY,MAAM,IAAI,MAAM,4CAA4C;CAC7F,MAAM,WAAoB,MAAM,QAAQ,MAAM,OAAO,MAAM,CAAC,OAAO,CAAC;CACpE,IAAI,EAAE,oBAAoB,WACxB,MAAM,IAAI,MAAM,6CAA6C;CAC/D,OAAO;AACT;;;AC/KA,uBAAuB;CAAE,MAAM;CAAgB,SAAS;CAAe,OAAO;AAAS,CAAC;AAWxF,SAAS,OAAO,UAAkB,YAA6B,MAA0B;CAEvF,MAAM,SAAkB,QAAQ,IAAI,UAAU,UAAU;CACxD,IAAI,OAAO,WAAW,YACpB,MAAM,IAAI,MACR,WAAW,OAAO,UAAU,EAAE,yBAAyB,SAAS,YAAY,MAC9E;CAEF,OAAO,QAAQ,MAAM,QAAQ,UAAU,IAAI;AAC7C;AAEA,SAAS,iBAAiB,MAAe,UAA0B;CACjE,IAAI,OAAO,SAAS,YAAY,SAAS,MAAM,MAAM,IAAI,MAAM,8BAA8B;CAC7F,MAAM,QAAiB,QAAQ,IAAI,MAAM,QAAQ;CACjD,IAAI,OAAO,UAAU,UACnB,MAAM,IAAI,MAAM,gCAAgC,SAAS,mBAAmB;CAC9E,OAAO;AACT;;AAGA,eAAe,kBAAkB,MAA+C;CAE9E,MAAM,UAAS,MADQ,QAAQ,WAAW,IAAI,EAAA,CACtB,SAAS,YAC/B,QAAQ,WAAW,aAAa,CAAC,QAAQ,MAAM,IAAI,CAAC,CACtD;CACA,IAAI,OAAO,WAAW,GAAG,MAAM,OAAO;CACtC,IAAI,OAAO,SAAS,GAAG,MAAM,IAAI,eAAe,QAAQ,sCAAsC;AAChG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BA,IAAa,wBAAb,MAA8D;CAMjD;CALX,mBAA8C,CAAC;CAC/C;CAEA,YACE,KACA,KACA;EADS,KAAA,MAAA;EAET,KAAK,OAAO;EACZ,KAAK,MAAM,IAAI,IAAI,KAAK,GAAG;CAC7B;CAEA,QAAiB,OAAO,SAAkB,KAAQ,QAA8C;EAC9F,4BAA4B,KAAK,KAAK,GAAG;EACzC,OAAO,KAAK,KAAK,MAAM,SAAS,KAAK,GAAG;CAC1C;CAEA,aAAwD;EACtD,OAAO,KAAK,KAAK,WAAW;CAC9B;;;;;;;;;;;;;CAcA;CAEA,IAAI,cAA8C;EAChD,OAAO,KAAK,KAAK;CACnB;;;;;;;;;;;;;;;;;;;;;CAsBA,aAAa,SAAoC;EAC/C,KAAK,KAAK,aAAa,OAAO;EAC9B,OAAO;CACT;;;;;;CAOA,cAAc,WAA4B;EACxC,MAAM,yBAAS,IAAI,IAA4B;EAC/C,KAAK,MAAM,MAAM,KAAK,KAAK,YAAY,OAAO,WAAW,GAAG;GAC1D,IAAI,OAAO,GAAG,SAAS,YAAY,GAAG,SAAS,QAAQ,EAAE,gBAAgB,GAAG,OAAO;GACnF,MAAM,OAAO,qBAAqB,GAAG,IAAI;GACzC,IAAI,KAAK,QAAQ,SACf,OAAO,IAAI,KAAK,MAAM;IACpB,MAAM,KAAK;IACX,SAAS,KAAK,QAAQ;IACtB,SAAS,EAAE,GAAG,KAAK,QAAQ;GAC7B,CAAC;EAEL;EACA,KAAK,MAAM,YAAY,WAAW;GAChC,IAAI,CAAC,YAAY,OAAO,aAAa,UAAU;GAC/C,KAAK,MAAM,SAAS,uBAAuB,QAAQ,GACjD,IAAI,CAAC,OAAO,IAAI,MAAM,IAAI,GAAG,OAAO,IAAI,MAAM,MAAM,KAAK;EAE7D;EACA,KAAK,iBAAiB,OAAO,GAAG,KAAK,iBAAiB,QAAQ,GAAG,OAAO,OAAO,CAAC;CAClF;;CAGA,qBAAuC;EACrC,OAAO,CAAC,GAAG,KAAK,gBAAgB;CAClC;;;;;;;CAQA,MAAM,UACJ,OACA,KACA,KACe;EACf,4BAA4B,KAAK,KAAK,GAAG;EAUzC,MAAM,kBATW,CACf,GAAG,KAAK,KAAK,YACV,OAAO,cAAc,CAAC,CACtB,KAAK,QAAQ;GAAE;GAAI,MAAM,iBAAiB,GAAG,MAAM,MAAM;EAAE,EAAE,GAChE,GAAG,KAAK,KAAK,YACV,OAAO,cAAc,CAAC,CACtB,KAAK,QAAQ;GAAE;GAAI,MAAM,iBAAiB,GAAG,MAAM,YAAY;EAAE,EAAE,CACxE,CAAC,CAAC,QAAQ,MAAM,EAAE,SAAS,MAAM,IAEF,CAAC,CAAC,KAAK,EAAE,SAAS,KAAK,mBAAmB,IAAI,OAAO,KAAK,GAAG,CAAC,CAAC;CAChG;;;;;;;;;CAUA,MAAc,mBACZ,IACA,SACA,KACA,iBACe;EACf,MAAM,cAAc,GAAG;EACvB,IAAI,OAAO,gBAAgB,YAAY,MAAM,IAAI,MAAM,mCAAmC;EAC1F,IAAI,GAAG,eAAe,KAAA,GAAW,MAAM,IAAI,MAAM,2CAA2C;EAC5F,MAAM,aAAa,GAAG;EACtB,MAAM,gBAAgB;GACpB,MAAM,GAAG,SAAS,aAAc,UAAqB;GACrD,QAAQ,GAAG,YAAY,KAAK,GAAG,OAAO,UAAU;EAClD;EACA,IAAI;EACJ,IAAI;GACF,MAAM,qBAAqB,KAAK,KAAK,aAAa,GAAG,OAAO,OAAO,aAAa;IAC9E,MAAM,WAAW,sBAAsB,OAAO,EAAE;IAChD,MAAM,UAAU,gCACd,GAAG,MACH,aACA,YACA,SACA,UACA,KACF;IACA,MAAM,oBAAoB,EACxB,UAAU,SAAiC;KACzC,SAAS,UAAU,OAAO;KAC1B,gBAAgB,UAAU,OAAO;IACnC,EACF;IACA,IAAI,UAA6B,CAAC;IAClC,IAAI;KACF,WACE,MAAM,6BAA6B,UAAU,aAAa,YAAY,OAAO,QAAQ,EAAA,CACrF,WAAW;KACb,MAAM,SAAS,MAAM,6BACnB,SACA,aACA,YACA,OACA,QACF;KACA,MAAM,eAAe,MAAM,6BACzB,eACA,aACA,YACA,OACA,QACF;KACA,MAAM,eAAe,IAAI;MACvB;MACA;MACA;MACA,aAAa,YAAY;OAAC;OAAS;OAAK;MAAiB;MACzD,QAAQ,OAAO,SAAS;OACtB,MAAM,WAAW,MAAM,kBAAkB,OAAO,EAAE;OAClD,IAAI,OAAO,aAAa,YAAY,aAAa,MAC/C,MAAM,IAAI,MAAM,uCAAuC;OAEzD,OAAO,OAAO,UAAU,YAAY,IAAI;MAC1C;KACF,CAAC;IACH,SAAS,OAAO;KACd,qBAAqB,KAAK,CAAC,CAAC,OAAO,OAAO,aAAa;KACvD,KAAK,MAAM,UAAU,SACnB,IAAI,kBAAkB,QAAQ,KAAK,GAAG;MAGpC,MAAM,OAAO,MAAM,OAAO,OAAO;MACjC;KACF;KAEF,WAAW,EAAE,MAAM;KACnB,MAAM;IACR;GACF,CAAC;EACH,SAAS,OAAO;GAId,IAAI,CAAC,YAAY,SAAS,UAAU,OAAO;IACzC,MAAM,kBACJ,YAAY,iBAAiB,kBAAkB,MAAM,OAAO,OAAO,SAAS,QACxE,MAAM,OAAO,KACb;IACN,qBAAqB,KAAK,KAAK,aAAa,CAAC,CAAC,CAAC,OAAO,iBAAiB,aAAa;GACtF;GACA,MAAM;EACR;CACF;;;;;;;CAQA,MAAM,MACJ,OACA,KACA,KACe;EACf,4BAA4B,KAAK,KAAK,GAAG;EAKzC,MAAM,kBAJW,KAAK,KAAK,YACxB,OAAO,UAAU,CAAC,CAClB,QAAQ,OAAO,iBAAiB,GAAG,MAAM,WAAW,MAAM,MAAM,KAEpC,CAAC,CAAC,KAAK,OAAO,KAAK,mBAAmB,IAAI,OAAO,KAAK,GAAG,CAAC,CAAC;CAC5F;CAEA,MAAM,MAAM,QAAgC;EAC1C,OAAO,KAAK,KAAK,MAAM,MAAM;CAC/B;AACF;;;;AChTA,SAAgB,kBACd,SACgB;CAChB,OAAO;EACL,MAAM;EACN,mBAAmB,CACjB,OAAO,SAAS,SAAS;GACvB,4BAA4B,QAAQ,KAAK,QAAQ,GAAG;GACpD,MAAM,KAAK;EACb,CACF;EACA,sBACG,EAAE,WACF,YACC,QAAQ,QAAQ,IAAI,MAAM,SAAS,QAAQ,GAAG,CAAC;EACnD,cAAc,MAAM,YAAY,CAAC,CAAC,CAAC,OAAO,WAAW;EACrD,qBAAqB,cAAc;GACjC,8BAA8B,WAAW;IAAE,OAAO,QAAQ;IAAU,KAAK,QAAQ;GAAI,CAAC;EACxF;CACF;AACF;;AAGA,eAAsB,oBACpB,YACA,SACmC;CACnC,MAAM,UAAU,MAAM,YAAY,OAAO,sBAAsB,YAAY,QAAQ,GAAG,GAAG;EACvF,cAAc,QAAQ;EACtB,UAAU,QAAQ;EAClB,YAAY,QAAQ,aAAa,QAAQ,GAAG;EAC5C,UAAU,CAAC,kBAAkB,OAAO,CAAC;CACvC,CAAC;CACD,MAAM,MAAM,IAAI,sBAAsB,SAAS,QAAQ,GAAG;CAC1D,IAAI,cAAc,QAAQ,aAAa,CAAC;CACxC,wBAAwB,IAAI,WAAW,GAAG,IAAI,mBAAmB,CAAC;CAClE,OAAO;AACT;;;;;;AAOA,SAAgB,uBACd,YACA,SACA;CACA,MAAM,+BAAe,IAAI,QAA8C;CACvE,MAAM,eAAe,QAA8C;EACjE,MAAM,WAAW,aAAa,IAAI,GAAG;EACrC,IAAI,UAAU,OAAO;EACrB,MAAM,UAAU,oBAAoB,YAAY;GAAE,GAAG;GAAS;EAAI,CAAC;EACnE,aAAa,IAAI,KAAK,OAAO;EAC7B,QAAa,YAAY;GACvB,IAAI,aAAa,IAAI,GAAG,MAAM,SAAS,aAAa,OAAO,GAAG;EAChE,CAAC;EACD,OAAO;CACT;CACA,OAAO;EACL,MAAM,MAAM,SAAkB,KAAQ,KAA0C;GAC9E,QAAQ,MAAM,YAAY,GAAG,EAAA,CAAG,MAAM,SAAS,KAAK,GAAG;EACzD;EACA,MAAM,UACJ,OACA,KACA,KACe;GACf,QAAQ,MAAM,YAAY,GAAG,EAAA,CAAG,UAAU,OAAO,KAAK,GAAG;EAC3D;EACA,MAAM,MACJ,OACA,KACA,KACe;GACf,QAAQ,MAAM,YAAY,GAAG,EAAA,CAAG,MAAM,OAAO,KAAK,GAAG;EACvD;CACF;AACF;;;ACzGA,MAAa,kBAAkB,IAAI,eAAqC,iBAAiB;;;;ACFzF,MAAa,wBAAwB;AAErC,MAAM,eAAe;AACrB,MAAM,sBAA8C;CAClD,MAAM;CACN,MAAM;CACN,OAAO;CACP,KAAK;CACL,MAAM;AACR;;AAGA,SAAgB,sBAAsB,KAAqB;CACzD,MAAM,QAAQ,IAAI,YAAY,CAAC,CAAC,OAAO,GAAG;CAC1C,IAAI,MAAM,eAAe,KAAK,MAAM,aAAA,MAClC,MAAM,IAAI,MAAM,yBAAyB,sBAAsB,aAAa;CAE9E,IAAI,SAAS;CACb,KAAK,MAAM,QAAQ,OAAO,UAAU,OAAO,aAAa,IAAI;CAC5D,OAAO,KAAK,MAAM,CAAC,CAAC,QAAQ,OAAO,GAAG,CAAC,CAAC,QAAQ,OAAO,GAAG,CAAC,CAAC,QAAQ,OAAO,EAAE;AAC/E;;AAGA,SAAgB,sBAAsB,OAAmC;CACvE,IAAI;EACF,IACE,MAAM,WAAW,KACjB,MAAM,SAAS,KAAK,KAAA,OAAmC,CAAC,KACxD,CAAC,aAAa,KAAK,KAAK,KACxB,MAAM,SAAS,MAAM,GAErB;EAEF,MAAM,SAAS,MAAM,QAAQ,MAAM,GAAG,CAAC,CAAC,QAAQ,MAAM,GAAG;EACzD,MAAM,SAAS,SAAS,IAAI,QAAQ,IAAK,OAAO,SAAS,KAAM,CAAC;EAChE,MAAM,SAAS,KAAK,MAAM;EAC1B,MAAM,QAAQ,IAAI,WAAW,IAAI,YAAY,OAAO,MAAM,CAAC;EAC3D,KAAK,IAAI,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK,MAAM,KAAK,OAAO,WAAW,CAAC;EACtE,IAAI,MAAM,eAAe,KAAK,MAAM,aAAA,MAAoC,OAAO,KAAA;EAC/E,MAAM,UAAU,IAAI,YAAY,SAAS;GAAE,OAAO;GAAM,WAAW;EAAM,CAAC,CAAC,CAAC,OAAO,KAAK;EACxF,OAAO,sBAAsB,OAAO,MAAM,QAAQ,UAAU,KAAA;CAC9D,QAAQ;EACN;CACF;AACF;AAEA,SAAS,aAAa,SAA0B;CAC9C,IAAI,UAAU;CACd,KAAK,IAAI,IAAI,GAAG,IAAI,GAAG,KAAK;EAC1B,IAAI,YAAY,MAAM,YAAY,OAAO,YAAY,MAAM,OAAO;EAClE,IAAI;GACF,MAAM,OAAO,mBAAmB,OAAO;GACvC,IAAI,SAAS,SAAS;GACtB,UAAU;EACZ,QAAQ;GACN;EACF;CACF;CACA,OAAO,YAAY,MAAM,YAAY,OAAO,YAAY;AAC1D;AAEA,SAAS,mBAAmB,SAAyB;CACnD,IAAI,UAAU;CACd,IAAI,SAAS;CACb,KAAK,MAAM,SAAS,QAAQ,SAAS,iCAAiC,GAAG;EACvE,WAAW,QAAQ,MAAM,QAAQ,MAAM,KAAK,CAAC,CAAC,QAAQ,uBAAuB,MAAM;EACnF,WAAW,oBAAoB,MAAM;EACrC,SAAS,MAAM,QAAS,MAAM,EAAE,CAAC;CACnC;CACA,WAAW,QAAQ,MAAM,MAAM,CAAC,CAAC,QAAQ,uBAAuB,MAAM;CACtE,OAAO;AACT;;AAGA,SAAgB,uBAAuB,KAAa,MAAmC;CACrF,MAAM,YAAY,QAAQ,GAAA,CAAI,MAAM,QAAQ,CAAC,CAAC,QAAQ,YAAY,CAAC,aAAa,OAAO,CAAC;CACxF,IAAI,SAAS,WAAW,GAAG,OAAO,IAAI,SAAS;CAC/C,MAAM,cAAc,SAAS,IAAI,kBAAkB,CAAC,CAAC,KAAK,GAAG;CAC7D,OAAO,IAAI,OAAO,OAAO,YAAY,SAAS,CAAC,CAAC,KAAK,GAAG;AAC1D;;;;AClEA,MAAa,qBAAqB;;AAUlC,IAAa,kBAAb,MAAsD;CACvB;CAA7B,YAAY,QAAgD;EAA/B,KAAA,SAAA;CAAgC;CAE7D,MAAM,OAAO,MAAmB,MAAc,SAA+C;EAC3F,MAAM,KAAK,OAAO,OAAO,IACvB,MACA,MACA;GACE,cAAc,QAAQ,WAAW,EAAE,aAAa,QAAQ,SAAS,IAAI,KAAA;GACrE,gBAAgB,QAAQ;EAC1B,CACF;EACA,OAAO;GACL;GACA,MAAM,KAAK,OAAO;GAClB,MAAM,QAAQ;GACd,UAAU,QAAQ,YAAY;GAC9B,4BAAY,IAAI,KAAK;EACvB;CACF;CAEA,MAAM,SAAS,MAAuC;EACpD,MAAM,MAAM,MAAM,KAAK,OAAO,OAAO,IAAI,IAAI;EAC7C,IAAI,CAAC,KAAK,MAAM,IAAI,MAAM,gCAAgC,KAAK,GAAG;EAClE,OAAO;GACL,gBAAgB,IAAI;GACpB,qBAAqB,IAAI,YAAY;GACrC,cAAc,IAAI,KAAK;GACvB,aAAa,IAAI,cAAc,eAAe;GAC9C,MAAM,IAAI;GACV,UAAU,IAAI;EAChB;CACF;CAEA,MAAM,OAAO,MAA6B;EACxC,MAAM,KAAK,OAAO,OAAO,OAAO,IAAI;CACtC;CAEA,MAAM,OAAO,MAAgC;EAC3C,OAAQ,MAAM,KAAK,OAAO,OAAO,KAAK,IAAI,MAAO;CACnD;CAEA,MAAM,gBACJ,MACA,QACA,WAC6B;EAC7B,IAAI,CAAC,KAAK,OAAO,QACf,MAAM,IAAI,MAAM,mEAAmE;EAIrF,IAAI,CAAC,OAAO,cAAc,SAAS,KAAK,aAAa,GACnD,MAAM,IAAI,MACR,iCAAiC,UAAU,qCAC7C;EAKF,MAAM,QAAQ,sBAAsB,IAAI;EACxC,MAAM,YAAY,GAAG,mBAAmB,GAAG,mBAAmB,KAAK,OAAO,IAAI;EAC9E,MAAM,QAAQ,IAAI,gBAAgB;GAAE,KAAK;GAAO;EAAO,CAAC;EAMxD,OAAO;GAAE,KAAA,MALS,QAAQ,GAAG,UAAU,GAAG,SAAS,KAAK,OAAO,QAAQ;IACrE;IACA;IACA,SAAS;GACX,CAAC;GACa;GAAQ;GAAW,WAAW,IAAI,KAAK,KAAK,IAAI,IAAI,YAAY,GAAI;EAAE;CACtF;AACF;;;;;;;;;;;;;;;ACxFO,IAAM,wBAAN,MAAM,sBAAsB;CACqB;CAAtD,YAAY,SAAyE;EAA/B,KAAA,UAAA;CAAgC;CAEtF,QAAQ,MAAuB;EAC7B,OAAO,KAAK,QAAQ,MAAM,MAAM,MAAM,EAAE,SAAS,IAAI;CACvD;CAEA,cAAc,MAA0B;EACtC,MAAM,SAAS,KAAK,QAAQ,MAAM,MAAM,MAAM,EAAE,SAAS,IAAI;EAC7D,IAAI,CAAC,QAAQ,MAAM,IAAI,MAAM,iBAAiB,KAAK,qBAAqB;EACxE,OAAO;CACT;CAEA,UAAU,MAA+B;EAEvC,OAAO,IAAI,gBAAgB;GAAE;GAAM,QADpB,KAAK,cAAc,IACS,CAAA,CAAO;GAAQ,QAAQ,KAAK,QAAQ;EAAO,CAAC;CACzF;AACF;;CAlBC,WAAW;CAEG,gBAAA,GAAA,OAAO,eAAe,CAAA;;;;;ACU9B,IAAM,oBAAN,MAAM,kBAAkB;CAEqB;CACN;CAF5C,YACE,SACA,SACA;EAFgD,KAAA,UAAA;EACN,KAAA,UAAA;CACzC;CAEH,MACM,SAAS,GAAsC;EACnD,MAAM,SAAS,KAAK,QAAQ;EAC5B,IAAI,CAAC,QAAQ,OAAO,IAAI,SAAS,qCAAqC,EAAE,QAAQ,IAAI,CAAC;EAIrF,IACE,CAAE,MAAM,gBAAgB,EAAE,IAAI,KAAK,QAAQ;GACzC,QAAQ,EAAE,IAAI;GACd,SAAS;EACX,CAAC,GAED,OAAO,IAAI,SAAS,0BAA0B,EAAE,QAAQ,IAAI,CAAC;EAO/D,MAAM,MAAM,IAAI,IAAI,EAAE,IAAI,GAAG;EAC7B,IAAI,IAAI,aAAa,IAAI,QAAQ,MAAM,OACrC,OAAO,IAAI,SAAS,+BAA+B,EAAE,QAAQ,IAAI,CAAC;EAGpE,MAAM,OAAO,EAAE,IAAI,MAAM,MAAM;EAC/B,IAAI,CAAC,QAAQ,CAAC,KAAK,QAAQ,QAAQ,IAAI,GAAG,OAAO,IAAI,SAAS,gBAAgB,EAAE,QAAQ,IAAI,CAAC;EAE7F,MAAM,QAAQ,IAAI,aAAa,IAAI,KAAK;EACxC,MAAM,UAAU,QAAQ,sBAAsB,KAAK,IAAI,KAAA;EACvD,IAAI,CAAC,SAAS,OAAO,IAAI,SAAS,+BAA+B,EAAE,QAAQ,IAAI,CAAC;EAIhF,MAAM,WAAW,gBAAgB,KAAA,GAAW,OAAO;EACnD,IAAI,aAAa,SAAS,OAAO,IAAI,SAAS,uBAAuB,EAAE,QAAQ,IAAI,CAAC;EAEpF,IAAI,CAAC,uBAAuB,UAAU,KAAK,QAAQ,cAAc,IAAI,CAAC,CAAC,IAAI,GACzE,OAAO,IAAI,SAAS,8CAA8C,EAAE,QAAQ,IAAI,CAAC;EAGnF,IAAI;GACF,MAAM,SAAS,MAAM,KAAK,QAAQ,UAAU,IAAI,CAAC,CAAC,SAAS,QAAQ;GACnE,MAAM,WAAW,SAAS,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK;GAC/C,OAAO,IAAI,SAAS,OAAO,SAAS,GAAG,EACrC,SAAS;IACP,gBAAgB,OAAO,eAAe;IAItC,uBAAuB,gCAAgC,mBAAmB,QAAQ;IAClF,0BAA0B;GAC5B,EACF,CAAC;EACH,QAAQ;GACN,OAAO,IAAI,SAAS,aAAa,EAAE,QAAQ,IAAI,CAAC;EAClD;CACF;AACF;;CA1DG,IAAI,QAAQ;CACG,gBAAA,GAAA,IAAI,CAAA;;;;;;CARrB,WAAW,SAAS;CAGhB,gBAAA,GAAA,OAAO,qBAAqB,CAAA;CAC5B,gBAAA,GAAA,OAAO,eAAe,CAAA;;;;;ACN3B,MAAM,kBAAkB;CAAE,eAAe;CAAM,WAAW;AAAM;AAOzD,IAAM,iBAAN,MAAM,eAAe;CAEkB;CACM;CAFlD,YACE,SACA,SACA;EAF0C,KAAA,UAAA;EACM,KAAA,UAAA;CAC/C;CAEH,IACE,cACA,MACA,UAAyB,CAAC,GAC1B,MACuB;EACvB,MAAM,OAAO,KAAK,YAAY,IAAI;EAClC,OAAO,KAAK,QAAQ,UAAU,IAAI,CAAC,CAAC,OAAO,MAAM,KAAK,SAAS,cAAc,IAAI,GAAG,OAAO;CAC7F;CAEA,IAAI,cAAsB,MAAwC;EAChE,MAAM,OAAO,KAAK,YAAY,IAAI;EAClC,OAAO,KAAK,QAAQ,UAAU,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,cAAc,IAAI,CAAC;CAChF;CAEA,OAAO,cAAsB,MAA8B;EACzD,MAAM,OAAO,KAAK,YAAY,IAAI;EAClC,OAAO,KAAK,QAAQ,UAAU,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,cAAc,IAAI,CAAC;CAC9E;CAEA,OAAO,cAAsB,MAAiC;EAC5D,MAAM,OAAO,KAAK,YAAY,IAAI;EAClC,OAAO,KAAK,QAAQ,UAAU,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,cAAc,IAAI,CAAC;CAC9E;CAEA,IACE,cACA,SAAwB,OACxB,WACA,MAC6B;EAC7B,MAAM,OAAO,KAAK,YAAY,IAAI;EAClC,OAAO,KAAK,QACT,UAAU,IAAI,CAAC,CACf,gBAAgB,KAAK,SAAS,cAAc,IAAI,GAAG,QAAQ,KAAK,eAAe,SAAS,CAAC;CAC9F;CAEA,YAAoB,MAAuB;EACzC,MAAM,OAAO,QAAQ,KAAK,QAAQ;EAClC,IAAI,CAAC,KAAK,QAAQ,QAAQ,IAAI,GAAG,MAAM,IAAI,MAAM,iBAAiB,KAAK,qBAAqB;EAC5F,OAAO;CACT;CAEA,SAAiB,cAAsB,MAAsB;EAC3D,OAAO,gBAAgB,KAAK,QAAQ,cAAc,IAAI,CAAC,CAAC,MAAM,YAAY;CAC5E;CAEA,eAAuB,WAA4B;EACjD,MAAM,MAAM,KAAK,QAAQ,gBAAgB;EACzC,MAAM,QAAQ,aAAa,IAAI;EAI/B,IAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,KAAK,QAAQ,IAAI,WAC3D,MAAM,IAAI,MAAM,wBAAwB,MAAM,uBAAuB,IAAI,UAAU,IAAI;EAEzF,OAAO;CACT;AACF;;CAjEC,WAAW;CAGP,gBAAA,GAAA,OAAO,eAAe,CAAA;CACtB,gBAAA,GAAA,OAAO,qBAAqB,CAAA;;;;;ACjBjC,MAAM,EAAE,4BAA4B,IAAI,0BAAgD;CACtF,YAAY;CACZ,uBAAuB;AACzB,CAAC,CAAC,CAAC,MAAM;AAOF,IAAM,gBAAN,MAAM,sBAAsB,wBAAwB,CAAC;AAL3D,gBAAA,WAAA,CAAA,OAAO;CACN,WAAW,CAAC,uBAAuB,cAAc;CACjD,aAAa,CAAC,iBAAiB;CAC/B,SAAS;EAAC;EAAgB;EAAuB;CAAe;AAClE,CAAC,CAAA,GAAA,aAAA;;;;;;;;ACHD,IAAa,eAAb,MAAyF;CAC1D;CAA7B,YAAY,IAAkC;EAAjB,KAAA,KAAA;CAAkB;CAE/C,MAAM,IAAI,KAA+B;EACvC,QAAQ,MAAM,KAAK,SAAS,GAAG,EAAA,EAAI;CACrC;CAEA,MAAM,SAAS,KAA0E;EACvF,MAAM,EAAE,OAAO,aAAa,MAAM,KAAK,GAAG,gBAAkC,KAAK,MAAM;EACvF,IAAI,UAAU,MAAM,OAAO,KAAA;EAC3B,IAAI,OAAO,aAAa,YAAY,aAAa,QAAQ,wBAAwB,UAAU;GACzF,MAAM,YAAY,SAAS;GAC3B,IAAI,OAAO,cAAc,YAAY,CAAC,OAAO,SAAS,SAAS,KAAK,aAAa,KAAK,IAAI,GACxF,OAAO,KAAA;GACT,OAAO;IAAE;IAAO;GAAU;EAC5B;EACA,OAAO,EAAE,MAAM;CACjB;CAEA,MAAM,IAAI,KAAa,OAAgB,KAA6B;EAClE,IAAI,QAAQ,KAAA,MAAc,CAAC,OAAO,SAAS,GAAG,KAAK,MAAM,IACvD,MAAM,IAAI,UAAU,2CAA2C;EACjE,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAK,SAAS,KAAK;GAAE;GAAO,WAAW,KAAK,IAAI,IAAI,MAAM;EAAK,CAAC;EAC9F,MAAM,KAAK,GAAG,IAAI,KAAK,KAAK,UAAU,KAAK,CAAC;CAC9C;CAEA,MAAM,SAAS,KAAa,OAAkC;EAC5D,IAAI,CAAC,OAAO,SAAS,MAAM,SAAS,GAAG,MAAM,IAAI,UAAU,8BAA8B;EACzF,MAAM,aAAa,MAAM,YAAY,KAAK,IAAI,KAAK;EACnD,IAAI,aAAa,GAAG,OAAO,KAAK,IAAI,GAAG;EACvC,MAAM,KAAK,GAAG,IAAI,KAAK,KAAK,UAAU,MAAM,KAAK,GAAG;GAClD,eAAe,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,CAAC;GAChD,UAAU,EAAE,oBAAoB,MAAM,UAAU;EAClD,CAAC;CACH;CAEA,MAAM,IAAI,KAA4B;EACpC,MAAM,KAAK,GAAG,OAAO,GAAG;CAC1B;;CAGA,MAAM,QAAuB;EAC3B,IAAI;EACJ,GAAG;GACD,MAAM,OAAO,MAAM,KAAK,GAAG,KAAK,SAAS,EAAE,OAAO,IAAI,KAAA,CAAS;GAC/D,MAAM,QAAQ,IAAI,KAAK,KAAK,KAAK,UAAU,KAAK,GAAG,OAAO,MAAM,IAAI,CAAC,CAAC;GACtE,SAAS,KAAK,gBAAgB,KAAA,IAAY,KAAK;EACjD,SAAS;CACX;AACF;;;;;;;AAQA,IAAa,2BAAb,MAAwE;CACzC;CAA7B,YAAY,IAAkC;EAAjB,KAAA,KAAA;CAAkB;CAC/C,MAAM,WAAW,KAA8B;EAC7C,MAAM,QAAiB,MAAM,KAAK,GAAG,IAAI,KAAK,MAAM;EACpD,IAAI,UAAU,MAAM,OAAO;EAC3B,IAAI,OAAO,UAAU,YAAY,MAAM,WAAW,KAAK,MAAM,SAAS,MACpE,MAAM,IAAI,UAAU,2BAA2B;EACjD,OAAO;CACT;CACA,MAAM,WAAW,KAA4B;EAC3C,MAAM,KAAK,GAAG,IAAI,KAAK,KAAK,UAAU,OAAO,WAAW,CAAC,CAAC;CAC5D;AACF;;;;;;;;;;;;;;;;;;;;;;;;;;ACrCA,IAAa,qBAAb,MAA6D;CAC3D;CACA;CAEA,YACE,SACA,UAAqC,CAAC,GACtC;EACA,KAAK,UAAU,OAAO,YAAY,aAAa,gBAAgB;EAC/D,KAAK,OAAO,QAAQ,QAAQ;CAC9B;CAEA,WAAW,KAAa,UAAmB,KAAqC;EAC9E,OAAO,KAAK,QAAQ,CAAC,CAAC,gBAAgB,KAAK,UAAU,GAAG;CAC1D;CAEA,UAAU,KAAa,UAAkB,KAAoC;EAC3E,OAAO,KAAK,QAAQ,CAAC,CAAC,eAAe,KAAK,UAAU,GAAG;CACzD;CAEA,UAAU,KAAa,UAAkB,KAAoC;EAC3E,OAAO,KAAK,QAAQ,CAAC,CAAC,eAAe,KAAK,UAAU,GAAG;CACzD;CAEA,UAAU,KAAa,UAAkB,KAAqC;EAC5E,OAAO,KAAK,QAAQ,CAAC,CAAC,eAAe,KAAK,UAAU,GAAG;CACzD;AACF;;AAGA,SAAgB,mBACd,SACA,SACoB;CACpB,OAAO,IAAI,mBAAmB,SAAS,OAAO;AAChD;;;;;;;;;;;;;;;;;;;;;;;;AClDA,IAAa,eAAb,MAAuD;CAKlC;CAJnB;CACA;CAEA,YACE,IACA,UAA+B,CAAC,GAChC;EAFiB,KAAA,KAAA;EAGjB,KAAK,OAAO,QAAQ,QAAQ;EAC5B,KAAK,SAAS,QAAQ,UAAU;CAClC;CAEA,WAAW,KAAa,UAAmB,MAAsC;EAC/E,OAAO,KAAK,KAAK,KAAK,WAAW,MAAM,OAAO,MAAM,SAAS;CAC/D;CAEA,UAAU,KAAa,UAAkB,MAAqC;EAC5E,OAAO,KAAK,KAAK,KAAK,WAAW,MAAM,OAAO,MAAM,QAAQ;CAC9D;CAEA,UAAU,KAAa,UAAkB,MAAqC;EAC5E,OAAO,KAAK,KAAK,KAAK,WAAW,MAAM,OAAO,MAAM,QAAQ;CAC9D;CAEA,UAAU,KAAa,UAAkB,MAAsC;EAC7E,OAAO,KAAK,KAAK,KAAK,WAAW,MAAM,OAAO,MAAM,YAAY,MAAM,IAAI;CAC5E;;;;;;CAOA,MAAc,KACZ,KACA,UACA,SACY;EACZ,MAAM,QAAQ,MAAM,KAAK,GAAG,IAAI,KAAK,SAAS,KAAK,MAAM;EACzD,IAAI,UAAU,QAAQ,UAAU,KAAA,GAAW,OAAO;EAClD,OAAO,QAAQ,KAAK,IAAI,QAAQ;CAClC;AACF;;AAGA,SAAgB,aAAa,IAAiB,SAA6C;CACzF,OAAO,IAAI,aAAa,IAAI,OAAO;AACrC;;;;;;;;;;;;;;;;;;AC5DA,MAAa,MAAM,sBAA0C,aAAa,QAAiB;CAEzF,MAAM,MAAe,IAAI,WAAW,CAAC,CAAC;CACtC,IAAI,OAAO,QAAQ,YAAY,QAAQ,MAAM,OAAO,KAAA;CACpD,OAAO,cAAc,QAAQ,IAAI,KAAK,WAAW,IAAI;AACvD,CAAC;;;ACpBD,MAAM,yBAAyB;AAI/B,uBAAuB;CAAE,MAAM;CAAgB,SAAS;CAAwB,OAAO;AAAS,CAAC;AA6BjG,SAAgB,uBAAuB,OAAmC;CACxE,IACE,OAAO,UAAU,YACjB,UAAU,QACV,EAAE,UAAU,UACZ,OAAO,MAAM,SAAS,YACtB,EAAE,gBAAgB,UAClB,OAAO,MAAM,eAAe,YAC5B,CAAC,UAAU,MAAM,MAAM,EAAE,SAAS,aAAa,CAAC,GAEhD,MAAM,IAAI,UAAU,uCAAuC;CAE7D,OAAO;EAAE,MAAM,MAAM;EAAM,YAAY,MAAM;CAAW;AAC1D;;;;;;;;;;;;;;;AAgBA,SAAgB,UAAU,MAA+B;CACvD,IAAI,CAAC,UAAU,MAAM,EAAE,SAAS,aAAa,CAAC,GAC5C,MAAM,IAAI,UAAU,uCAAuC,MAAM;CAEnE,QAAQ,QAAgB,aAA8B,gBAAoC;EAExF,MAAM,WAAW,qBAAqB,MAAM;EAC5C,SAAS,KAAK;GAAE;GAAM,YAAY,OAAO,WAAW;EAAE,CAAC;EACvD,eAAe,wBAAwB,UAAU,OAAO,WAAW;CACrE;AACF;AAEA,SAAgB,qBAAqB,QAAqC;CACxE,MAAM,OAAO,OAAO,WAAW,aAAa,SAAS,OAAO;CAC5D,MAAM,QAAiB,YAAY,wBAAwB,IAAI;CAC/D,IAAI,UAAU,KAAA,GAAW,OAAO,CAAC;CACjC,IAAI,CAAC,MAAM,QAAQ,KAAK,GAAG,MAAM,IAAI,UAAU,4CAA4C;CAC3F,OAAO,MAAM,IAAI,sBAAsB;AACzC;;;AChFA,MAAM,8BAA8B;AAKpC,uBAAuB;CAAE,MAAM;CAAY,SAAS;CAA6B,OAAO;AAAS,CAAC;;;;;;;;;;;;;;;;;;AAwBlG,SAAgB,cAAc,WAAoC;CAChE,QAAQ,QAAgB,aAA8B,gBAAoC;EACxF,MAAM,WACH,YAAY,6BAA6B,OAAO,WAAW,KAC5D,CAAC;EACH,SAAS,KAAK;GAAE;GAAW,YAAY,OAAO,WAAW;EAAE,CAAC;EAC5D,eAAe,6BAA6B,UAAU,OAAO,WAAW;CAC1E;AACF;;;;;;;;;;AC5BA,IAAa,4BAAb,MAAa,0BAA0B;CACrC,OAAO,UAAyB;EAC9B,MAAM,YAAY,CAAC,eAAe,WAAW,EAAE,UAAU,eAAe,CAAC,GAAG,YAAY;EAExF,OAAO;GACL,QAAQ;GACR;GACA,SAAS,CAAC,WAAW,YAAY;EACnC;CACF;AACF;;;;;;;;;;;;;;;ACQA,eAAsB,gBACpB,IACA,aACA,MACA,OACA,MACA,SACe;CACf,MAAM,MAAwB;EAC5B,OAAO,CAAC,IAAI;EACZ,WAAW,SAAS;EACpB,OAAO,KAAK,UAAU;GAAE;GAAO;EAAK,CAAC;CACvC;CACA,MAAM,gBAAgB,qBAAqB,EACzC,eAAe,SAAS,iBAAiB,2BAC3C,CAAC;CACD,2BAA2B,KAAK,aAAa;CAE7C,MADa,GAAG,IAAI,gBAAgB,IAAI,aAAa,IAAI,CAChD,CAAC,CAAC,UAAU,GAAG;AAC1B;;;;;;;;;AC1BA,SAAgB,yBACd,SACA,SACgB;CAChB,IAAI,CAAC,WAAY,OAAO,YAAY,cAAc,OAAO,QAAQ,UAAU,YACzE,MAAM,IAAI,UAAU,gDAAgD;CAEtE,IACE,CAAC,OAAO,cAAc,QAAQ,KAAK,KACnC,QAAQ,SAAS,KACjB,QAAQ,SAAS,OAAO,kBAExB,MAAM,IAAI,WAAW,4CAA4C;CAEnE,IAAI,QAAQ,kBAAkB,MAAM,QAAQ,kBAAkB,IAC5D,MAAM,IAAI,WAAW,wDAAwD;CAG/E,MAAM,cAAc,QAAQ,eAAe;CAC3C,IAAI,CAAC,OAAO,cAAc,WAAW,KAAK,eAAe,KAAK,cAAc,MAC1E,MAAM,IAAI,WAAW,wCAAwC;CAG/D,MAAM,QAAQ,QAAQ,gBAAgB;CACtC,MAAM,UAAU,IAAI,YAAY;CAChC,MAAM,iBACJ,OAAO,YAAY,aAAa,gBAA4C;CAE9E,OAAO;EACL,MAAM,UAAU,KAAa,gBAAyD;GACpF,IAAI,mBAAmB,OACrB,MAAM,IAAI,MACR,gDAAgD,MAAM,eAAe,eAAe,GACtF;GAEF,IACE,OAAO,QAAQ,YACf,IAAI,WAAW,KACf,wBAAwB,KAAK,GAAG,KAChC,QAAQ,OAAO,GAAG,CAAC,CAAC,aAAa,aAEjC,MAAM,IAAI,MAAM,iDAAiD;GAGnE,MAAM,iBAAiB,eAAe;GACtC,IAAI,CAAC,kBAAkB,OAAO,eAAe,UAAU,YACrD,MAAM,IAAI,MAAM,iDAAiD;GAEnE,MAAM,WAAW,MAAM,eAAe,MAAM,EAAE,IAAI,CAAC;GACnD,IAAI,CAAC,YAAY,OAAO,SAAS,YAAY,WAC3C,MAAM,IAAI,MAAM,4DAA4D;GAG9E,OAAO;IAGL,OAAO,SAAS,UAAU,IAAI,QAAQ,QAAQ;IAC9C;IACA,SAAS,SAAS;IAClB,eAAe,QAAQ;GACzB;EACF;EAEA,QAAe;GACb,MAAM,IAAI,MAAM,gEAAgE;EAClF;CACF;AACF;;;ACrFA,MAAM,uBAAuB;AAC7B,MAAM,0BAA0B;;;;;;;;;AA4BhC,SAAgB,wBAAwB,SAAqD;CAC3F,IAAI,CAAC,WAAW,OAAO,YAAY,UACjC,MAAM,IAAI,UAAU,iDAAiD;CAEvE,IAAI,CAAC,uBAAuB,QAAQ,cAAc,uBAAuB,GACvE,MAAM,IAAI,UACR,0DAA0D,wBAAwB,aACpF;CAEF,IAAI,OAAO,QAAQ,YAAY,YAC7B,MAAM,IAAI,UAAU,8DAA8D;CAGpF,MAAM,aAAa,GAAG,uBAAuB,QAAQ;CAErD,OAAO,EACL,MAAM,MAAM,OAAe,iBAA2C;EACpE,MAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAK;EACzC,IAAI,CAAC,uBAAuB,OAAA,GAAsB,KAAK,CAAC,cAAc,iBAAiB,GAAG,GACxF,OAAO;EAGT,IAAI;GACF,MAAM,YAAY,MAAM,QAAQ,QAAQ;GAExC,MAAM,KAAK,UAAU,WAAW,UAAU;GAG1C,OAAO,MAFM,UAAU,IAAI,EACH,CAAC,CAAC,MAAM,OAAO,eAAe,MACpC;EACpB,QAAQ;GACN,OAAO;EACT;CACF,EACF;AACF"}
+{"version":3,"file":"index.js","names":[],"sources":["../src/websocket/websocket-routing.ts","../src/scheduled-event.ts","../src/cloudflare-application.ts","../src/schedule-diagnostics.ts","../src/cloudflare-factory.ts","../src/storage/storage.tokens.ts","../src/storage/storage-key-claim.ts","../src/storage/r2-storage.driver.ts","../src/storage/storage-manager.service.ts","../src/storage/storage.controller.ts","../src/storage/storage.service.ts","../src/storage/storage.module.ts","../src/services/kv-cache.store.ts","../src/services/flagship-flag.driver.ts","../src/services/kv-flag.driver.ts","../src/decorators/queue-consumer.ts","../src/websocket/cloudflare-websocket.module.ts","../src/websocket/broadcast.ts","../src/rate-limit/cloudflare-rate-limit.store.ts","../src/nonce/durable-object-nonce.store.ts"],"sourcesContent":["import type { Container, Type, VelaContext as Context, VelaHono as Hono } from '@velajs/vela';\nimport { getMetadata, getTrustedRequestIdentity } from '@velajs/vela';\nimport {\n  createWebSocketUpgradeGate,\n  resolveGatewayRoomId,\n  resolveGatewayRoomParam,\n  resolveMaxFrameBytes,\n  WS_GATEWAY_METADATA,\n  type WebSocketGatewayOptions,\n  type WebSocketUpgradeIdentity,\n} from '@velajs/vela/websocket';\nimport { durableObjectRoomName } from './room-id';\n\nexport interface WsGatewayRoute {\n  path: string;\n  binding: string;\n  options: WebSocketGatewayOptions;\n  /** Container module that declares the gateway; its authenticator resolves from here. */\n  moduleId?: string;\n}\n\nconst MAX_IDENTITY_FIELD_BYTES = 2048;\nconst encoder = new TextEncoder();\n\ntype PrincipalType = 'user' | 'service';\n\ninterface ForwardedIdentity extends WebSocketUpgradeIdentity {\n  principal: {\n    issuer: string;\n    subject: string;\n    principalType: PrincipalType;\n  };\n  tenantId: string;\n  expiresAtMs: number;\n}\n\nfunction isIdentityField(value: unknown): value is string {\n  return (\n    typeof value === 'string' &&\n    value.length > 0 &&\n    !value.includes('\\r') &&\n    !value.includes('\\n') &&\n    encoder.encode(value).byteLength <= MAX_IDENTITY_FIELD_BYTES\n  );\n}\n\n/** `null` means an identity was present but violated the transport contract. */\nfunction accessIdentity(c: Context): ForwardedIdentity | null | undefined {\n  const value = getTrustedRequestIdentity(c.req.raw);\n  if (!value) return undefined;\n  const { principal, tenantId, expiresAtMs } = value;\n  if (\n    !isIdentityField(principal.issuer) ||\n    !isIdentityField(principal.subject) ||\n    !isIdentityField(tenantId) ||\n    typeof expiresAtMs !== 'number' ||\n    !Number.isSafeInteger(expiresAtMs) ||\n    expiresAtMs <= 0\n  )\n    return null;\n  return { principal, tenantId, expiresAtMs };\n}\n\n/** `null` means two independently verified identities disagree. */\nfunction combineIdentities(\n  requestIdentity: ForwardedIdentity | undefined,\n  upgradeIdentity: WebSocketUpgradeIdentity | undefined,\n): ForwardedIdentity | null | undefined {\n  if (!requestIdentity && !upgradeIdentity) return undefined;\n  if (!requestIdentity) return upgradeIdentity;\n  if (!upgradeIdentity) return requestIdentity;\n  if (\n    requestIdentity.principal.issuer !== upgradeIdentity.principal.issuer ||\n    requestIdentity.principal.subject !== upgradeIdentity.principal.subject ||\n    requestIdentity.principal.principalType !== upgradeIdentity.principal.principalType ||\n    requestIdentity.tenantId !== upgradeIdentity.tenantId\n  ) {\n    return null;\n  }\n  return {\n    principal: { ...upgradeIdentity.principal },\n    tenantId: upgradeIdentity.tenantId,\n    expiresAtMs: Math.min(requestIdentity.expiresAtMs, upgradeIdentity.expiresAtMs),\n  };\n}\n\n/** An instance's constructor is the class token its module registered. */\nfunction isClass(value: unknown): value is Type {\n  return typeof value === 'function';\n}\n\n/**\n * Read `@WebSocketGateway({ path, binding })` off a resolved instance (CF-hosted\n * gateways only). The application container names the module that declares the\n * gateway when exactly one module registers it.\n */\nexport function collectWsGatewayRoutes(instance: object, container: Container): WsGatewayRoute[] {\n  // Decorator metadata is the framework's explicit reflection boundary.\n  const options = getMetadata<WebSocketGatewayOptions>(WS_GATEWAY_METADATA, instance.constructor);\n  if (!options?.path || !options?.binding) return [];\n  resolveGatewayRoomParam(options);\n  resolveMaxFrameBytes(options);\n  const gateway: unknown = instance.constructor;\n  const owners = isClass(gateway) ? container.getOwnerModuleIds(gateway) : [];\n  return [\n    {\n      path: options.path,\n      binding: options.binding,\n      options: { ...options },\n      ...(owners.length === 1 ? { moduleId: owners[0] } : {}),\n    },\n  ];\n}\n\n/**\n * Registers the upgrade routes on the Worker's Hono app. Each route validates\n * the `Upgrade` header, authenticates through the gateway's authenticator\n * (resolved once from `container`, the application's DI container), resolves\n * the room's Durable Object, and forwards the raw request — injecting\n * spoof-safe `x-vela-*` headers the DO reads. The DO returns the `101` with the\n * client socket.\n */\nexport function registerWebSocketRoutes(\n  hono: Hono,\n  routes: WsGatewayRoute[],\n  container: Container,\n): void {\n  for (const route of routes) {\n    const authenticate = createWebSocketUpgradeGate(container, route);\n    hono.get(route.path, async (c: Context) => {\n      if (c.req.header('upgrade')?.toLowerCase() !== 'websocket') {\n        return c.text('Expected WebSocket upgrade', 426);\n      }\n\n      // Internal transport headers are never application credentials. Remove\n      // client-supplied values before even the pre-allocation authorization\n      // hook sees the request, then populate trusted values below.\n      const headers = new Headers(c.req.raw.headers);\n      headers.delete('x-vela-room');\n      headers.delete('x-vela-path');\n      headers.delete('x-vela-user');\n      headers.delete('x-vela-expires-at');\n      headers.delete('x-vela-expires-at-ms');\n      headers.delete('x-vela-issuer');\n      headers.delete('x-vela-subject');\n      headers.delete('x-vela-principal-type');\n      headers.delete('x-vela-tenant');\n      const sanitizedRequest = new Request(c.req.raw, { headers });\n\n      let roomId: string;\n      try {\n        roomId = resolveGatewayRoomId(route.options, (name) => c.req.param(name));\n      } catch {\n        return c.text('Invalid WebSocket room', 400);\n      }\n\n      // Origin, application authorization, and ticket/cookie authentication\n      // all complete before the gateway Durable Object id is resolved.\n      const upgrade = await authenticate(sanitizedRequest, roomId);\n      if (upgrade === false) return c.text('WebSocket upgrade forbidden', 403);\n\n      const requestIdentity = accessIdentity(c);\n      if (requestIdentity === null) return c.text('Invalid WebSocket identity', 403);\n      const identity = combineIdentities(requestIdentity, upgrade.identity);\n      if (identity === null) return c.text('Conflicting WebSocket identities', 403);\n      if (identity && identity.expiresAtMs <= Date.now()) {\n        return c.text('WebSocket identity expired', 403);\n      }\n\n      // Populate the ticket-free forwarding request with trusted server values.\n      const forwardHeaders = new Headers(upgrade.request.headers);\n      forwardHeaders.set('x-vela-room', roomId);\n      forwardHeaders.set('x-vela-path', route.path);\n      if (identity) {\n        forwardHeaders.set('x-vela-user', identity.principal.subject);\n        forwardHeaders.set('x-vela-issuer', identity.principal.issuer);\n        forwardHeaders.set('x-vela-subject', identity.principal.subject);\n        forwardHeaders.set('x-vela-principal-type', identity.principal.principalType);\n        forwardHeaders.set('x-vela-tenant', identity.tenantId);\n        forwardHeaders.set('x-vela-expires-at-ms', String(identity.expiresAtMs));\n      }\n\n      return forwardToRoom(\n        c.env,\n        route.binding,\n        route.path,\n        roomId,\n        new Request(upgrade.request, { headers: forwardHeaders }),\n      );\n    });\n  }\n}\n\n/**\n * Gateway metadata contains a runtime binding name, so the native type is\n * erased. Validate only the operations consumed here and their observable\n * results; never assert that an arbitrary value implements a native namespace.\n */\nasync function forwardToRoom(\n  env: unknown,\n  binding: string,\n  path: string,\n  room: string,\n  request: Request,\n): Promise<Response> {\n  if (typeof env !== 'object' || env === null) throw new Error('Worker environment is missing');\n  const namespace: unknown = Reflect.get(env, binding);\n  if (typeof namespace !== 'object' || namespace === null) {\n    return new Response(`Durable Object binding '${binding}' is not configured`, { status: 500 });\n  }\n  const idFromName: unknown = Reflect.get(namespace, 'idFromName');\n  const get: unknown = Reflect.get(namespace, 'get');\n  if (typeof idFromName !== 'function' || typeof get !== 'function') {\n    throw new Error('Invalid Durable Object namespace');\n  }\n  const id: unknown = Reflect.apply(idFromName, namespace, [durableObjectRoomName(path, room)]);\n  const stub: unknown = Reflect.apply(get, namespace, [id]);\n  if (typeof stub !== 'object' || stub === null) throw new Error('Invalid Durable Object stub');\n  const fetch: unknown = Reflect.get(stub, 'fetch');\n  if (typeof fetch !== 'function') throw new Error('Durable Object stub has no fetch operation');\n  const response: unknown = await Reflect.apply(fetch, stub, [request]);\n  if (!(response instanceof Response))\n    throw new Error('Durable Object returned an invalid response');\n  return response;\n}\n","import { InjectionToken, SCHEDULE_INVOCATION_SEED, Scope, defineProvider } from '@velajs/vela';\nimport type { ScheduleInvocationSeed } from '@velajs/vela';\nimport type { Container } from '@velajs/vela/internal';\n\n/**\n * The event a Worker's `scheduled()` export receives. The native\n * `ScheduledController` satisfies it; direct calls (tests, scripts) may omit\n * `scheduledTime`, which then defaults to the current time, and `noRetry`.\n */\nexport interface ScheduledEvent {\n  readonly cron: string;\n  readonly scheduledTime?: number;\n  noRetry?(): void;\n}\n\n/** The Cloudflare trigger behind the current scheduled invocation. */\nexport interface CloudflareScheduledEvent {\n  /** The trigger's exact cron string; it equals the invocation's `expression`. */\n  readonly cron: string;\n  /** The platform's scheduled time in Unix milliseconds. */\n  readonly scheduledTime: number;\n  /**\n   * Ask Cloudflare not to retry this trigger if the invocation fails. Already\n   * bound to the native controller, so it can be passed around or destructured.\n   * A no-op for direct calls that supplied no controller.\n   */\n  readonly noRetry: () => void;\n}\n\n/**\n * Request-scoped Cloudflare view of the scheduled trigger, seeded into each\n * `@Cron` job's invocation scope by the Cloudflare adapter. Inject it where a\n * job needs platform controls such as `noRetry()`; the job's argument stays\n * the portable `ScheduleInvocation`. It resolves only inside a scheduled\n * invocation; resolving it anywhere else throws. A cron job fired on demand\n * (Studio's run-now) receives a synthetic event: `cron` is the job's\n * expression and `noRetry()` does nothing.\n *\n * The token provides itself as request-scoped in every container, so a class\n * that injects it is request-scoped wherever the graph boots (a Worker, a\n * Durable Object, the CLI or a testing module) and is built only for an\n * invocation, never at bootstrap.\n *\n * @example\n * ```ts\n * @Injectable({ scope: Scope.REQUEST })\n * class Reports {\n *   constructor(@Inject(CLOUDFLARE_SCHEDULED_EVENT) private readonly trigger: CloudflareScheduledEvent) {}\n *\n *   @Cron('0 3 * * *', { dialect: 'cloudflare' })\n *   async nightly(tick: CronInvocation) {\n *     if (!(await this.upstreamAvailable(tick.signal))) this.trigger.noRetry();\n *   }\n * }\n * ```\n */\nexport const CLOUDFLARE_SCHEDULED_EVENT = new InjectionToken<CloudflareScheduledEvent>(\n  '@velajs/cloudflare:scheduled-event',\n  {\n    scope: Scope.REQUEST,\n    factory: () => {\n      throw new Error(\n        'CLOUDFLARE_SCHEDULED_EVENT can only be resolved inside a scheduled invocation: ' +\n          'the Cloudflare adapter seeds it into each @Cron job scope for a cron trigger.',\n      );\n    },\n  },\n);\n\n/** @internal Freeze the injected view; `noRetry` keeps the native receiver. */\nexport function cloudflareScheduledEvent(\n  event: ScheduledEvent,\n  scheduledTime: number,\n): CloudflareScheduledEvent {\n  return Object.freeze({\n    cron: event.cron,\n    scheduledTime,\n    noRetry: () => {\n      event.noRetry?.();\n    },\n  });\n}\n\n/**\n * Seeds a cron job fired outside a trigger (Studio's run-now) the way a\n * trigger would: a synthetic event whose `cron` is the invocation's\n * expression, with its `scheduledTime` and a `noRetry()` that does nothing.\n * Interval jobs never run from Workers triggers, so they get no event.\n */\nconst seedScheduledEvent: ScheduleInvocationSeed = (scope, invocation) => {\n  if (invocation.kind !== 'cron') return;\n  scope.setRequestInstance(\n    CLOUDFLARE_SCHEDULED_EVENT,\n    cloudflareScheduledEvent({ cron: invocation.expression }, invocation.scheduledTime),\n  );\n};\n\n/**\n * @internal Provide `SCHEDULE_INVOCATION_SEED`, so jobs fired on demand get a\n * synthetic event. Each trigger seeds the real event into its jobs' scopes.\n */\nexport function registerScheduledEventSeed(container: Container): void {\n  container.register(defineProvider(SCHEDULE_INVOCATION_SEED, { useValue: seedScheduledEvent }));\n  container.markGlobalToken(SCHEDULE_INVOCATION_SEED);\n}\n","import type { ExecutionContext } from 'hono';\nimport {\n  PipelineRunner,\n  buildEntrypointExecutionContext,\n  getEntrypointModuleId,\n  invokeScheduledJob,\n  parseCronMetadata,\n  resolveEntrypoint,\n  resolveScopedComponentsAsync,\n  resolveErrorReporter,\n  runInEntrypointScope,\n  shouldFilterCatch,\n  type ScheduleInvocation,\n  type VelaApplication,\n} from '@velajs/vela';\nimport type { Entrypoint, ExceptionFilter, VelaEnv } from '@velajs/vela';\nimport { readWsEntrypointMeta } from '@velajs/vela/websocket';\nimport { collectWsGatewayRoutes, type WsGatewayRoute } from './websocket/websocket-routing';\nimport { assertCloudflareEnvironment } from './environment';\nimport {\n  CLOUDFLARE_SCHEDULED_EVENT,\n  cloudflareScheduledEvent,\n  type ScheduledEvent,\n} from './scheduled-event';\n\n/**\n * Options accepted by {@link CloudflareApplication.mountOpenApi}.\n *\n * Re-exposes vela's `MountOpenApiOptions` type — derived structurally from\n * the underlying `VelaApplication.mountOpenApi` signature so consumers don't\n * have to reach into vela's internal subpaths to type the argument.\n */\nexport type MountOpenApiOptions = Parameters<VelaApplication['mountOpenApi']>[0];\n\nfunction invoke(instance: object, methodName: string | symbol, args: unknown[]): unknown {\n  // Decorator metadata names an instance method; inspect it before invoking.\n  const method: unknown = Reflect.get(instance, methodName);\n  if (typeof method !== 'function') {\n    throw new Error(\n      `Method '${String(methodName)}' is not a function on ${instance.constructor.name}`,\n    );\n  }\n  return Reflect.apply(method, instance, args);\n}\n\nfunction entrypointString(meta: unknown, property: string): string {\n  if (typeof meta !== 'object' || meta === null) throw new Error('Invalid entrypoint metadata.');\n  const value: unknown = Reflect.get(meta, property);\n  if (typeof value !== 'string')\n    throw new Error(`Invalid entrypoint metadata: ${property} must be a string.`);\n  return value;\n}\n\n/**\n * `QueueModule`'s native consumer reports each failure of a batch once itself\n * (processor failures where they ran, transport failures on settlement), so\n * its rejection is not reported again here.\n */\nconst SELF_REPORTING_KINDS = new Set(['cf:queue:module']);\n\nconst warnedRawJobs = new Set<string>();\n\n/** The logical queue of a Vela job envelope, without importing the queue subsystem. */\nfunction envelopeQueue(body: unknown): string | undefined {\n  if (typeof body !== 'object' || body === null) return undefined;\n  const queue: unknown = Reflect.get(body, 'queue');\n  if (\n    typeof queue !== 'string' ||\n    typeof Reflect.get(body, 'id') !== 'string' ||\n    typeof Reflect.get(body, 'name') !== 'string' ||\n    !('data' in body)\n  ) {\n    return undefined;\n  }\n  return queue;\n}\n\n/** Wait for every matching handler, even when one fails before its siblings. */\nasync function settleEntrypoints(work: readonly Promise<void>[]): Promise<void> {\n  const outcomes = await Promise.allSettled(work);\n  const errors = outcomes.flatMap((outcome) =>\n    outcome.status === 'rejected' ? [outcome.reason] : [],\n  );\n  if (errors.length === 1) throw errors[0];\n  if (errors.length > 1) throw new AggregateError(errors, 'Multiple entrypoint handlers failed.');\n}\n\n/**\n * Wraps VelaApplication with Cloudflare-specific handlers:\n * - `fetch` — HTTP request handler (from Hono)\n * - `scheduled` — Cron trigger handler (runs the `@Cron()` jobs whose\n *                 expression is the trigger's exact string)\n * - `queue` — Queue consumer handler (`@QueueConsumer()` by physical queue,\n *             then `QueueModule`'s native consumer)\n * - `mountOpenApi` — Serve an OpenAPI document (and optional Scalar UI) on\n *                    the underlying Hono app\n *\n * @example\n * ```ts\n * const app = await createCloudflareApp(AppModule, { env });\n * export default {\n *   fetch: app.fetch,\n *   scheduled: app.scheduled.bind(app),\n *   queue: app.queue.bind(app),\n * };\n * ```\n *\n * @example\n * ```ts\n * // Serve OpenAPI docs alongside your routes\n * const app = await createCloudflareApp(AppModule, { env });\n * const document = createOpenApiDocument(AppModule);\n * app.mountOpenApi({ document, ui: 'scalar' });\n * // GET /openapi.json -> JSON document\n * // GET /scalar       -> Scalar UI (loads from CDN)\n * ```\n */\nexport class CloudflareApplication {\n  readonly #wsGatewayRoutes: WsGatewayRoute[] = [];\n  readonly #app: VelaApplication;\n  /** Scheduled triggers in flight; close() aborts their signals and awaits them. */\n  readonly #scheduled = new Map<Promise<void>, AbortController>();\n\n  constructor(\n    app: VelaApplication,\n    readonly env: VelaEnv,\n  ) {\n    this.#app = app;\n    this.get = app.get.bind(app);\n  }\n\n  readonly fetch = async (\n    request: Request,\n    env: VelaEnv,\n    ctx?: ExecutionContext,\n  ): Promise<Response> => {\n    assertCloudflareEnvironment(this.env, env);\n    return this.#app.fetch(request, env, ctx);\n  };\n\n  getHonoApp(): ReturnType<VelaApplication['getHonoApp']> {\n    return this.#app.getHonoApp();\n  }\n\n  /**\n   * Resolve a provider from the application's DI container (delegates to\n   * `VelaApplication.get`). Handy for grabbing a service — e.g. an auth service —\n   * to use inside `createCloudflareApp({ middleware: env => [...] })` request middleware,\n   * which runs outside the DI request pipeline.\n   *\n   * @example\n   * ```ts\n   * const app = await createCloudflareApp(AppModule, { env });\n   * const auth = app.get(BetterAuthService);\n   * ```\n   */\n  readonly get: VelaApplication['get'];\n\n  get entrypoints(): VelaApplication['entrypoints'] {\n    return this.#app.entrypoints;\n  }\n\n  /**\n   * Serve a pre-built OpenAPI document (and optionally a Scalar UI) on the\n   * underlying Hono app. Delegates verbatim to `VelaApplication.mountOpenApi`,\n   * so the JSON endpoint defaults to `/openapi.json` and the Scalar UI (when\n   * opted in) defaults to `/scalar`. Edge-safe — the UI HTML loads Scalar from\n   * a CDN at runtime, nothing is bundled server-side.\n   *\n   * @example\n   * ```ts\n   * import { createOpenApiDocument } from '@velajs/vela';\n   *\n   * const app = await createCloudflareApp(AppModule, { env });\n   * const document = createOpenApiDocument(AppModule, {\n   *   info: { title: 'My API', version: '1.0.0' },\n   * });\n   * app.mountOpenApi({ document, ui: 'scalar' });\n   * // GET /openapi.json -> { openapi: '3.1.0', ... }\n   * // GET /scalar       -> Scalar UI HTML\n   * ```\n   */\n  mountOpenApi(options: MountOpenApiOptions): this {\n    this.#app.mountOpenApi(options);\n    return this;\n  }\n\n  /**\n   * @internal Upgrade routes come from validated gateway entrypoints, including\n   * request-scoped gateways without a bootstrap instance. Retain the instance\n   * scan for legacy applications that only declare forwarding metadata.\n   */\n  scanInstances(instances: unknown[]): void {\n    const routes = new Map<string, WsGatewayRoute>();\n    for (const ep of this.#app.entrypoints.ofKind('websocket')) {\n      if (typeof ep.meta !== 'object' || ep.meta === null || !('dispatcher' in ep.meta)) continue;\n      const meta = readWsEntrypointMeta(ep.meta);\n      if (meta.options.binding) {\n        routes.set(meta.path, {\n          path: meta.path,\n          binding: meta.options.binding,\n          options: { ...meta.options },\n          moduleId: meta.moduleId,\n        });\n      }\n    }\n    const container = this.#app.getContainer();\n    for (const instance of instances) {\n      if (!instance || typeof instance !== 'object') continue;\n      for (const route of collectWsGatewayRoutes(instance, container)) {\n        if (!routes.has(route.path)) routes.set(route.path, route);\n      }\n    }\n    this.#wsGatewayRoutes.splice(0, this.#wsGatewayRoutes.length, ...routes.values());\n  }\n\n  /** @internal — upgrade routes discovered from the application's gateways. */\n  getWsGatewayRoutes(): WsGatewayRoute[] {\n    return [...this.#wsGatewayRoutes];\n  }\n\n  /**\n   * Handle a Cloudflare cron trigger. Runs every core `@Cron()` job whose\n   * expression is exactly `event.cron` (the trigger string is compared as\n   * delivered, never re-evaluated) through `invokeScheduledJob`, the dispatch\n   * primitive every runtime shares. Each job receives only its\n   * `ScheduleInvocation`, runs in a fresh invocation scope seeded with\n   * {@link CLOUDFLARE_SCHEDULED_EVENT}, and honors signed `ScheduleModule`\n   * dispatch. The trigger settles after every matching job and its managed\n   * work (`EXECUTION_LIFETIME.waitUntil`/`defer`) settle; failures reject it.\n   */\n  async scheduled(\n    event: ScheduledEvent,\n    env: VelaEnv,\n    _ctx?: { waitUntil: (promise: Promise<unknown>) => void },\n  ): Promise<void> {\n    assertCloudflareEnvironment(this.env, env);\n    const jobs = this.#app.entrypoints\n      .ofKind('schedule:cron', parseCronMetadata)\n      .filter((entry) => entry.meta.expression === event.cron);\n    if (jobs.length === 0) return;\n\n    const controller = new AbortController();\n    const scheduledTime = event.scheduledTime ?? Date.now();\n    // Shared by every matching job, so none of them can alter what another sees.\n    const invocation: ScheduleInvocation = Object.freeze({\n      kind: 'cron' as const,\n      expression: event.cron,\n      scheduledTime,\n      signal: controller.signal,\n    });\n    const trigger = cloudflareScheduledEvent(event, scheduledTime);\n    const container = this.#app.getContainer();\n    const running = settleEntrypoints(\n      jobs.map((entry) =>\n        invokeScheduledJob(container, entry, invocation, {\n          seed: (scope) => scope.setRequestInstance(CLOUDFLARE_SCHEDULED_EVENT, trigger),\n        }),\n      ),\n    );\n    this.#scheduled.set(running, controller);\n    try {\n      await running;\n    } finally {\n      this.#scheduled.delete(running);\n    }\n  }\n\n  /**\n   * Run one queue consumer inside a fresh request scope, through the shared\n   * guard → interceptor pipeline (components declared with\n   * `@UseGuards`/`@UseInterceptors`/`@UseFilters` on the consumer class or\n   * method). HTTP-global components deliberately do NOT apply — an HTTP auth\n   * guard has no business rejecting a queue batch. Unclaimed errors are\n   * reported once (`QueueModule`'s consumer reports its own) and rethrow so\n   * the platform's retry semantics stay intact.\n   */\n  private async dispatchEntrypoint(\n    ep: Entrypoint,\n    payload: unknown,\n    env: VelaEnv,\n    platformContext: { waitUntil: (promise: Promise<unknown>) => void },\n  ): Promise<void> {\n    const targetClass = ep.token;\n    if (typeof targetClass !== 'function') throw new Error('Entrypoint token must be a class.');\n    if (ep.methodName === undefined) throw new Error('Entrypoint must declare a handler method.');\n    const methodName = ep.methodName;\n    const reportContext = {\n      edge: 'queue' as const,\n      source: `${targetClass.name}.${String(methodName)}`,\n    };\n    let reported: { error: unknown } | undefined;\n    // A self-reporting handler's own rejection was already reported.\n    let delegated: { error: unknown } | undefined;\n    try {\n      await runInEntrypointScope(this.#app.getContainer(), async (scope, lifetime) => {\n        const moduleId = getEntrypointModuleId(scope, ep);\n        const context = buildEntrypointExecutionContext(\n          ep.kind,\n          targetClass,\n          methodName,\n          payload,\n          moduleId,\n          scope,\n        );\n        const invocationContext = {\n          waitUntil(promise: Promise<unknown>): void {\n            lifetime.waitUntil(promise);\n            platformContext.waitUntil(promise);\n          },\n        };\n        let filters: ExceptionFilter[] = [];\n        try {\n          filters = (\n            await resolveScopedComponentsAsync('filter', targetClass, methodName, scope, moduleId)\n          ).toReversed();\n          const guards = await resolveScopedComponentsAsync(\n            'guard',\n            targetClass,\n            methodName,\n            scope,\n            moduleId,\n          );\n          const interceptors = await resolveScopedComponentsAsync(\n            'interceptor',\n            targetClass,\n            methodName,\n            scope,\n            moduleId,\n          );\n          await PipelineRunner.run({\n            context,\n            guards,\n            interceptors,\n            resolveArgs: async () => [payload, env, invocationContext],\n            invoke: async (args) => {\n              const instance = await resolveEntrypoint(scope, ep);\n              if (typeof instance !== 'object' || instance === null) {\n                throw new Error('Entrypoint must resolve to an object.');\n              }\n              try {\n                return await invoke(instance, methodName, args);\n              } catch (error) {\n                if (SELF_REPORTING_KINDS.has(ep.kind)) delegated = { error };\n                throw error;\n              }\n            },\n          });\n        } catch (error) {\n          if (delegated?.error !== error) {\n            resolveErrorReporter(scope).report(error, reportContext);\n          }\n          for (const filter of filters) {\n            if (shouldFilterCatch(filter, error)) {\n              // Filters run closest-first; this is the framework catch hook.\n              // eslint-disable-next-line no-await-in-loop, promise/valid-params\n              await filter.catch(error, context);\n              return;\n            }\n          }\n          reported = { error };\n          throw error;\n        }\n      });\n    } catch (error) {\n      // Managed completion happens after the handler's filter boundary. Report\n      // a new completion failure without reporting an already-observed handler\n      // failure twice; preserve both errors in the rejected invocation.\n      if (!reported || reported.error !== error) {\n        const completionError =\n          reported && error instanceof AggregateError && error.errors[0] === reported.error\n            ? error.errors[1]\n            : error;\n        resolveErrorReporter(this.#app.getContainer()).report(completionError, reportContext);\n      }\n      throw error;\n    }\n  }\n\n  /**\n   * Handle Cloudflare Queue consumer events. `@QueueConsumer()` handlers read\n   * from `app.entrypoints` claim a batch by its physical queue name and\n   * receive it whole. A batch no handler claims goes to `QueueModule`'s native\n   * consumer (`cloudflareQueues()` from `@velajs/cloudflare/queues`), which\n   * routes each job by its logical queue. Each dispatch runs inside a fresh\n   * request-scoped child (request-scoped providers rebuild per batch — no\n   * boot-time captives). A batch nothing claims rejects: resolving would let\n   * Cloudflare acknowledge every message implicitly.\n   */\n  async queue(\n    batch: { queue: string; messages: readonly unknown[] },\n    env: VelaEnv,\n    ctx: { waitUntil: (promise: Promise<unknown>) => void },\n  ): Promise<void> {\n    assertCloudflareEnvironment(this.env, env);\n    const raw = this.#app.entrypoints\n      .ofKind('cf:queue')\n      .filter((ep) => entrypointString(ep.meta, 'queueName') === batch.queue);\n    if (raw.length > 0) this.warnRawJobs(batch);\n    const handlers = raw.length > 0 ? raw : this.#app.entrypoints.ofKind('cf:queue:module');\n\n    if (handlers.length === 0) {\n      throw new Error(\n        `No consumer claims queue '${batch.queue}'. Add @QueueConsumer('${batch.queue}') to a ` +\n          `provider, or deliver it through QueueModule.forRoot({ driver: cloudflareQueues() }) ` +\n          `with a QueueModule.registerQueue() for each queue it carries. The batch is rejected ` +\n          `unacknowledged, so Cloudflare retries it and then routes it to the configured ` +\n          `dead-letter queue.`,\n      );\n    }\n\n    await settleEntrypoints(handlers.map((ep) => this.dispatchEntrypoint(ep, batch, env, ctx)));\n  }\n\n  /**\n   * A raw `@QueueConsumer` owns its physical queue's batches and must not carry\n   * jobs of a queue registered with `QueueModule`: those reach their\n   * `@Processor` only if the raw handler dispatches them itself, while\n   * `cloudflareQueues()` delivers registered queues. Warn once per physical and\n   * logical queue (unless diagnostics are silent); the raw consumer still\n   * receives and settles the batch.\n   */\n  private warnRawJobs(batch: { queue: string; messages: readonly unknown[] }): void {\n    if (this.#app.getContainer().getDiagnostics() === 'silent') return;\n    const registered = new Set(\n      this.#app.entrypoints\n        .ofKind('queue:registration')\n        .map((entry) =>\n          typeof entry.meta === 'object' && entry.meta !== null\n            ? Reflect.get(entry.meta, 'name')\n            : undefined,\n        ),\n    );\n    if (registered.size === 0) return;\n    for (const message of batch.messages) {\n      const body =\n        typeof message === 'object' && message !== null ? Reflect.get(message, 'body') : undefined;\n      const queue = envelopeQueue(body);\n      if (queue === undefined || !registered.has(queue)) continue;\n      const warning =\n        `[vela] @QueueConsumer('${batch.queue}') received jobs of registered queue '${queue}'. ` +\n        `The raw consumer owns '${batch.queue}' and must not carry jobs of registered queues: ` +\n        `they reach @Processor('${queue}') only if the raw handler dispatches them itself. ` +\n        `Deliver '${queue}' through cloudflareQueues() instead: send it to a physical queue ` +\n        `that no @QueueConsumer claims.`;\n      if (warnedRawJobs.has(warning)) continue;\n      warnedRawJobs.add(warning);\n      console.warn(warning);\n    }\n  }\n\n  /**\n   * Abort the signals of scheduled jobs still running, wait for them and their\n   * managed work to settle, then close the application.\n   */\n  async close(signal?: string): Promise<void> {\n    for (const controller of this.#scheduled.values()) controller.abort();\n    await Promise.allSettled(this.#scheduled.keys());\n    return this.#app.close(signal);\n  }\n}\n","import {\n  cronDialectAmbiguity,\n  parseCronMetadata,\n  parseIntervalMetadata,\n  scheduledJobComponents,\n} from '@velajs/vela';\nimport type { Entrypoint, VelaApplication } from '@velajs/vela';\nimport type { Container } from '@velajs/vela/internal';\n\nconst reported = new Set<string>();\n\n/** `'throw'` fails the caller, `'log'` warns once per message in this isolate. */\nfunction reportScheduleDiagnostic(container: Container, message: string): void {\n  const mode = container.getDiagnostics();\n  if (mode === 'silent') return;\n  if (mode === 'throw') throw new Error(message);\n  if (reported.has(message)) return;\n  reported.add(message);\n  console.warn(message);\n}\n\nfunction jobName(entry: Entrypoint<{ methodName: string }>): string {\n  const owner = typeof entry.token === 'function' ? entry.token.name : String(entry.token);\n  return `${owner}.${entry.meta.methodName}`;\n}\n\n/**\n * Guards, interceptors and filters declared for a job never run on its\n * trigger, and a direct job that declares guards is refused on every trigger.\n */\nfunction reportComponents(\n  container: Container,\n  label: string,\n  entry: Entrypoint<{ methodName: string }>,\n): void {\n  const decorators = scheduledJobComponents(container, entry);\n  if (decorators.length === 0) return;\n  const named =\n    decorators.length > 1\n      ? `${decorators.slice(0, -1).join(', ')} and ${decorators.at(-1)!}`\n      : decorators.join('');\n  const refused = decorators.includes('@UseGuards')\n    ? ', and one that declares guards refuses to run'\n    : '';\n  reportScheduleDiagnostic(\n    container,\n    `[vela] ${label} declares ${named}, which do not run for scheduled jobs: a direct job ` +\n      `runs no guards, interceptors or filters${refused}. Use signed ScheduleModule dispatch ` +\n      `and declare them on the signed route to run the job through the request pipeline.`,\n  );\n}\n\n/**\n * Report schedule declarations a Workers cron trigger cannot honor as written:\n * a dialect-ambiguous `@Cron`, `dialect: 'unix'`, `timeZone: 'local'`,\n * `@Interval` jobs, and guards, interceptors or filters declared for a job\n * (a direct job that declares guards is refused when it fires).\n * The container's diagnostics policy applies: `'throw'` fails bootstrap and the\n * default `'log'` warns once per declaration, so the first event of a Worker\n * (which bootstraps the application) never fails because of these checks.\n * `vela deploy check` rejects the cron declarations, `@Interval` jobs and\n * guarded direct jobs before deployment (`ambiguous-cron-dialect`,\n * `incompatible-cron-options`, `unsupported-interval`, `scheduled-job-guards`).\n */\nexport function reportCloudflareScheduleDiagnostics(\n  container: Container,\n  entrypoints: VelaApplication['entrypoints'],\n): void {\n  for (const entry of entrypoints.ofKind('schedule:cron', parseCronMetadata)) {\n    const cron = `@Cron('${entry.meta.expression}') on ${jobName(entry)}`;\n    const ambiguity = cronDialectAmbiguity(entry.meta);\n    if (ambiguity) {\n      reportScheduleDiagnostic(\n        container,\n        `[vela] ${cron} declares no dialect, and ${ambiguity}. Workers deliver the trigger ` +\n          `with Cloudflare semantics while Node reads it with Vela's unix dialect; declare ` +\n          `{ dialect: 'cloudflare' } so it fires on the same days on every runtime.`,\n      );\n    }\n    if (entry.meta.dialect === 'unix') {\n      reportScheduleDiagnostic(\n        container,\n        `[vela] ${cron} declares dialect 'unix', but Cloudflare delivers its trigger with ` +\n          `Cloudflare cron semantics (weekdays 1 = Sunday through 7 = Saturday). Declare ` +\n          `{ dialect: 'cloudflare' } and write the expression for Cloudflare.`,\n      );\n    }\n    if (entry.meta.timeZone === 'local') {\n      reportScheduleDiagnostic(\n        container,\n        `[vela] ${cron} declares timeZone 'local', but Cloudflare cron triggers run in UTC. ` +\n          `Remove timeZone or set it to 'UTC'.`,\n      );\n    }\n    reportComponents(container, cron, entry);\n  }\n  for (const entry of entrypoints.ofKind('schedule:interval', parseIntervalMetadata)) {\n    reportScheduleDiagnostic(\n      container,\n      `[vela] @Interval(${entry.meta.ms}) on ${jobName(entry)} never runs on Workers: cron ` +\n        `triggers drive only @Cron jobs. Replace it with a @Cron job and a Wrangler trigger, ` +\n        `or run it under ScheduleNodeModule on Node.`,\n    );\n  }\n}\n","import type { ExecutionContext } from 'hono';\nimport { getConnInfo } from 'hono/cloudflare-workers';\nimport { VelaFactory } from '@velajs/vela';\nimport type {\n  RuntimeAdapter,\n  VelaApplication,\n  VelaEnv,\n  VelaMiddlewareHandler,\n  VelaSecurityOptions,\n} from '@velajs/vela';\nimport { CloudflareApplication } from './cloudflare-application';\nimport { assertCloudflareEnvironment, registerCloudflareEnvironment } from './environment';\nimport { reportCloudflareScheduleDiagnostics } from './schedule-diagnostics';\nimport { registerScheduledEventSeed, type ScheduledEvent } from './scheduled-event';\nimport { warnWorkerLocalLive } from './websocket/do-live';\nimport { registerWebSocketRoutes } from './websocket/websocket-routing';\nimport type { CloudflareRoot } from './root-module';\n\nexport interface CloudflareWorkerOptions {\n  globalPrefix?: string;\n  security?: VelaSecurityOptions;\n  /** Build request middleware from the same native environment DI receives as ENV. */\n  middleware?: (env: VelaEnv) => VelaMiddlewareHandler[];\n  /** Further runtime adapters, composed after the Cloudflare adapter for each application. */\n  adapters?: RuntimeAdapter[];\n}\n\nexport interface CreateCloudflareAppOptions extends CloudflareWorkerOptions {\n  /** Supply the platform environment inside fetch/queue/scheduled or a DO constructor. */\n  env: VelaEnv;\n}\n\nfunction readStrings(meta: unknown, property: string): string[] {\n  const value: unknown =\n    typeof meta === 'object' && meta !== null ? Reflect.get(meta, property) : undefined;\n  if (typeof value === 'string') return [value];\n  if (Array.isArray(value) && value.every((item) => typeof item === 'string')) return value;\n  throw new TypeError(`Invalid queue consumer metadata: ${property}.`);\n}\n\n/**\n * `@QueueConsumer` handlers own their physical queue. A `QueueModule`\n * registration that pins the same physical queue with `consumer` would never\n * see its batches, so bootstrap rejects the overlap.\n */\nfunction assertQueueConsumerOwnership(entrypoints: VelaApplication['entrypoints']): void {\n  const pinned = new Set(\n    entrypoints.ofKind('cf:queue:module').flatMap((entry) => readStrings(entry.meta, 'consumers')),\n  );\n  for (const entry of entrypoints.ofKind('cf:queue')) {\n    const [queue] = readStrings(entry.meta, 'queueName');\n    if (queue !== undefined && pinned.has(queue)) {\n      throw new Error(\n        `Ambiguous consumer ownership for queue '${queue}': @QueueConsumer('${queue}') and a ` +\n          `QueueModule.registerQueue({ consumer: '${queue}' }) both claim it. Keep one owner.`,\n      );\n    }\n  }\n}\n\n/**\n * Bind an application to one environment: seeded as the global ENV before\n * provider factories and lifecycle hooks, and asserted on every request. The\n * adapter also supplies the `InternalDispatcher` transport, so signed queue and\n * schedule dispatch re-enter this application's routes, and reports schedule\n * declarations a cron trigger cannot honor through the diagnostics policy.\n */\nexport function cloudflareAdapter(options: { env: VelaEnv }): RuntimeAdapter {\n  const { env } = options;\n  return {\n    name: 'cloudflare',\n    requestMiddleware: [\n      async (context, next) => {\n        assertCloudflareEnvironment(env, context.env);\n        await next();\n      },\n    ],\n    invocationTransport:\n      ({ app }) =>\n      (request) =>\n        Promise.resolve(app.fetch(request, env)),\n    getClientIp: (c) => getConnInfo(c).remote.address ?? null,\n    configureContainer: (container) => {\n      registerCloudflareEnvironment(container, env);\n      registerScheduledEventSeed(container);\n    },\n    onBootstrap: async ({ app, container }) => {\n      assertQueueConsumerOwnership(app.entrypoints);\n      reportCloudflareScheduleDiagnostics(container, app.entrypoints);\n      await warnWorkerLocalLive(container);\n    },\n  };\n}\n\n/**\n * Build an application for one native Workers environment. Call inside a platform event.\n * The root is static: a module class or a `DynamicModule` declared at module scope.\n * Read bindings in providers (`@InjectEnv()`) and module factories\n * (`forRootAsync({ inject: [ENV], useFactory })`), which run for each application.\n */\nexport async function createCloudflareApp(\n  rootModule: CloudflareRoot,\n  options: CreateCloudflareAppOptions,\n): Promise<CloudflareApplication> {\n  const velaApp = await VelaFactory.create(rootModule, {\n    globalPrefix: options.globalPrefix,\n    security: options.security,\n    middleware: options.middleware?.(options.env),\n    adapters: [cloudflareAdapter(options), ...(options.adapters ?? [])],\n  });\n  const app = new CloudflareApplication(velaApp, options.env);\n  app.scanInstances(velaApp.getInstances());\n  registerWebSocketRoutes(app.getHonoApp(), app.getWsGatewayRoutes(), velaApp.getContainer());\n  return app;\n}\n\n/**\n * Worker entrypoint with one bootstrap per environment identity. Concurrent cold\n * events share construction; failed construction is evicted so the next event\n * can retry. Weak keys stop this cache from retaining a replaced environment.\n */\nexport function createCloudflareWorker(\n  rootModule: CloudflareRoot,\n  options: CloudflareWorkerOptions = {},\n) {\n  const applications = new WeakMap<VelaEnv, Promise<CloudflareApplication>>();\n  const application = (env: VelaEnv): Promise<CloudflareApplication> => {\n    const existing = applications.get(env);\n    if (existing) return existing;\n    const pending = createCloudflareApp(rootModule, { ...options, env });\n    applications.set(env, pending);\n    void pending.catch(() => {\n      if (applications.get(env) === pending) applications.delete(env);\n    });\n    return pending;\n  };\n  return {\n    async fetch(request: Request, env: VelaEnv, ctx: ExecutionContext): Promise<Response> {\n      return (await application(env)).fetch(request, env, ctx);\n    },\n    async scheduled(\n      event: ScheduledEvent,\n      env: VelaEnv,\n      ctx?: { waitUntil: (promise: Promise<unknown>) => void },\n    ): Promise<void> {\n      return (await application(env)).scheduled(event, env, ctx);\n    },\n    async queue(\n      batch: { queue: string; messages: readonly unknown[] },\n      env: VelaEnv,\n      ctx: { waitUntil: (promise: Promise<unknown>) => void },\n    ): Promise<void> {\n      return (await application(env)).queue(batch, env, ctx);\n    },\n  };\n}\n","import { InjectionToken } from '@velajs/vela';\nimport type { StorageModuleOptions } from './storage.types';\n\nexport const STORAGE_OPTIONS = new InjectionToken<StorageModuleOptions>('STORAGE_OPTIONS');\n","/** R2-compatible object-key claim bound. Keeps decode work predictably small. */\nexport const MAX_STORAGE_KEY_BYTES = 1024;\n\nconst BASE64URL_RE = /^[A-Za-z0-9_-]+$/;\nconst ROOT_TOKEN_PATTERNS: Record<string, string> = {\n  date: '\\\\d{4}-\\\\d{2}-\\\\d{2}',\n  year: '\\\\d{4}',\n  month: '(?:0[1-9]|1[0-2])',\n  day: '(?:0[1-9]|[12]\\\\d|3[01])',\n  uuid: '[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}',\n};\n\n/** Encode an object key as an opaque, canonical base64url query claim. */\nexport function encodeStorageKeyClaim(key: string): string {\n  const bytes = new TextEncoder().encode(key);\n  if (bytes.byteLength === 0 || bytes.byteLength > MAX_STORAGE_KEY_BYTES) {\n    throw new Error(`Storage key must be 1–${MAX_STORAGE_KEY_BYTES} UTF-8 bytes`);\n  }\n  let binary = '';\n  for (const byte of bytes) binary += String.fromCharCode(byte);\n  return btoa(binary).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '');\n}\n\n/** Decode exactly one canonical base64url layer. Malformed/non-UTF-8 claims return undefined. */\nexport function decodeStorageKeyClaim(claim: string): string | undefined {\n  try {\n    if (\n      claim.length === 0 ||\n      claim.length > Math.ceil((MAX_STORAGE_KEY_BYTES * 4) / 3) ||\n      !BASE64URL_RE.test(claim) ||\n      claim.length % 4 === 1\n    ) {\n      return undefined;\n    }\n    const base64 = claim.replace(/-/g, '+').replace(/_/g, '/');\n    const padded = base64 + '='.repeat((4 - (base64.length % 4)) % 4);\n    const binary = atob(padded);\n    const bytes = new Uint8Array(new ArrayBuffer(binary.length));\n    for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);\n    if (bytes.byteLength === 0 || bytes.byteLength > MAX_STORAGE_KEY_BYTES) return undefined;\n    const decoded = new TextDecoder('utf-8', { fatal: true, ignoreBOM: false }).decode(bytes);\n    return encodeStorageKeyClaim(decoded) === claim ? decoded : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction isDotSegment(segment: string): boolean {\n  let decoded = segment;\n  for (let i = 0; i < 2; i++) {\n    if (decoded === '' || decoded === '.' || decoded === '..') return true;\n    try {\n      const next = decodeURIComponent(decoded);\n      if (next === decoded) break;\n      decoded = next;\n    } catch {\n      break;\n    }\n  }\n  return decoded === '' || decoded === '.' || decoded === '..';\n}\n\nfunction rootSegmentPattern(segment: string): string {\n  let pattern = '';\n  let cursor = 0;\n  for (const match of segment.matchAll(/\\{(date|year|month|day|uuid)\\}/g)) {\n    pattern += segment.slice(cursor, match.index).replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n    pattern += ROOT_TOKEN_PATTERNS[match[1]!]!;\n    cursor = match.index! + match[0].length;\n  }\n  pattern += segment.slice(cursor).replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n  return pattern;\n}\n\n/** Assert a canonical key is beneath a static or templated configured root. */\nexport function isStorageKeyWithinRoot(key: string, root: string | undefined): boolean {\n  const segments = (root ?? '').split(/[/\\\\]+/).filter((segment) => !isDotSegment(segment));\n  if (segments.length === 0) return key.length > 0;\n  const rootPattern = segments.map(rootSegmentPattern).join('/');\n  return new RegExp(`^(?:${rootPattern})(?:/|$)`).test(key);\n}\n","import {\n  signUrl,\n  STORAGE_SIGNED_URL_PURPOSE,\n  type DownloadResult,\n  type PresignedUrlResult,\n  type PresignMethod,\n  type StorageBody,\n  type StorageDriver,\n  type UploadOptions,\n  type UploadResult,\n} from '@velajs/vela/storage';\nimport { encodeStorageKeyClaim } from './storage-key-claim';\n\n/** Base path of the StorageController presign-proxy route. */\nexport const STORAGE_ROUTE_BASE = '/storage';\n\nexport interface R2StorageDriverConfig {\n  disk: string;\n  bucket: R2Bucket;\n  /** HMAC secret for presigned URLs (typically env.APP_SECRET). */\n  secret?: string;\n}\n\n/** {@link StorageDriver} over a Cloudflare R2 bucket. */\nexport class R2StorageDriver implements StorageDriver {\n  constructor(private readonly config: R2StorageDriverConfig) {}\n\n  async upload(body: StorageBody, path: string, options: UploadOptions): Promise<UploadResult> {\n    await this.config.bucket.put(\n      path,\n      body as ReadableStream | ArrayBuffer | ArrayBufferView | string | Blob | null,\n      {\n        httpMetadata: options.mimeType ? { contentType: options.mimeType } : undefined,\n        customMetadata: options.metadata,\n      },\n    );\n    return {\n      path,\n      disk: this.config.disk,\n      size: options.size,\n      mimeType: options.mimeType ?? 'application/octet-stream',\n      uploadedAt: new Date(),\n    };\n  }\n\n  async download(path: string): Promise<DownloadResult> {\n    const obj = await this.config.bucket.get(path);\n    if (!obj) throw new Error(`Storage object not found at \"${path}\".`);\n    return {\n      toStream: () => obj.body as ReadableStream,\n      toArrayBuffer: () => obj.arrayBuffer(),\n      toText: () => obj.text(),\n      contentType: obj.httpMetadata?.contentType ?? 'application/octet-stream',\n      size: obj.size,\n      metadata: obj.customMetadata,\n    };\n  }\n\n  async delete(path: string): Promise<void> {\n    await this.config.bucket.delete(path);\n  }\n\n  async exists(path: string): Promise<boolean> {\n    return (await this.config.bucket.head(path)) !== null;\n  }\n\n  async getPresignedUrl(\n    path: string,\n    method: PresignMethod,\n    expiresIn: number,\n  ): Promise<PresignedUrlResult> {\n    if (!this.config.secret) {\n      throw new Error('A signing secret is required for presigned URLs (set APP_SECRET).');\n    }\n    // Defend the direct-driver path too: a non-finite/non-positive expiry would\n    // make signUrl omit `expires`, yielding a never-expiring URL.\n    if (!Number.isSafeInteger(expiresIn) || expiresIn <= 0) {\n      throw new Error(\n        `Invalid presigned URL expiry: ${expiresIn}s (must be a positive safe integer).`,\n      );\n    }\n    // The object key is an opaque signed query claim, never a URL path. This\n    // prevents WHATWG path normalization / multi-decode behavior from turning\n    // an encoded key into a different storage capability.\n    const claim = encodeStorageKeyClaim(path);\n    const routePath = `${STORAGE_ROUTE_BASE}/${encodeURIComponent(this.config.disk)}`;\n    const query = new URLSearchParams({ key: claim, method });\n    const url = await signUrl(`${routePath}?${query}`, this.config.secret, {\n      expiresIn,\n      method,\n      purpose: STORAGE_SIGNED_URL_PURPOSE,\n    });\n    return { url, method, expiresIn, expiresAt: new Date(Date.now() + expiresIn * 1000) };\n  }\n}\n","import { Inject, Injectable } from '@velajs/vela';\nimport { R2StorageDriver } from './r2-storage.driver';\nimport { STORAGE_OPTIONS } from './storage.tokens';\nimport type { DiskConfig, StorageModuleOptions } from './storage.types';\n\n@Injectable()\nexport class StorageManagerService {\n  constructor(@Inject(STORAGE_OPTIONS) private readonly options: StorageModuleOptions) {}\n\n  hasDisk(disk: string): boolean {\n    return this.options.disks.some((d) => d.disk === disk);\n  }\n\n  getDiskConfig(disk: string): DiskConfig {\n    const config = this.options.disks.find((d) => d.disk === disk);\n    if (!config) throw new Error(`Storage disk \"${disk}\" is not configured.`);\n    return config;\n  }\n\n  getDriver(disk: string): R2StorageDriver {\n    const config = this.getDiskConfig(disk);\n    return new R2StorageDriver({ disk, bucket: config.bucket, secret: this.options.secret });\n  }\n}\n","import { Controller, Get, Inject, Req } from '@velajs/vela';\nimport { joinStoragePath, STORAGE_SIGNED_URL_PURPOSE, verifySignedUrl } from '@velajs/vela/storage';\nimport type { Context } from 'hono';\nimport { STORAGE_OPTIONS } from './storage.tokens';\nimport type { StorageModuleOptions } from './storage.types';\nimport { StorageManagerService } from './storage-manager.service';\nimport { decodeStorageKeyClaim, isStorageKeyWithinRoot } from './storage-key-claim';\n\n/**\n * Presign-proxy: serves objects for HMAC-signed URLs produced by\n * `StorageService.url()`. R2 has no native presign, so a signed URL points here;\n * this route verifies the signature (+expiry) before streaming the object.\n * The FULL object key (root already applied at sign time) is carried as an\n * opaque base64url query claim. The signature is verified before the claim is\n * decoded exactly once and checked against the configured disk root.\n */\n@Controller('storage')\nexport class StorageController {\n  constructor(\n    @Inject(StorageManagerService) private readonly manager: StorageManagerService,\n    @Inject(STORAGE_OPTIONS) private readonly options: StorageModuleOptions,\n  ) {}\n\n  @Get('/:disk')\n  async download(@Req() c: Context): Promise<Response> {\n    const secret = this.options.secret;\n    if (!secret) return new Response('Storage signing is not configured', { status: 500 });\n\n    // Verify the complete path/query capability before inspecting the disk or\n    // decoding attacker-controlled claims.\n    if (\n      !(await verifySignedUrl(c.req.url, secret, {\n        method: c.req.method,\n        purpose: STORAGE_SIGNED_URL_PURPOSE,\n      }))\n    ) {\n      return new Response('Invalid or expired URL', { status: 403 });\n    }\n\n    // Enforce the signed `method` scope: this proxy only serves reads, so a URL\n    // scoped to PUT/DELETE/HEAD must NOT be honored as a GET (it would over-grant\n    // read access relative to the token's intended scope). The param is part of\n    // the signed payload, so it is trustworthy once the signature verifies.\n    const url = new URL(c.req.url);\n    if (url.searchParams.get('method') !== 'GET') {\n      return new Response('URL is not scoped for reads', { status: 403 });\n    }\n\n    const disk = c.req.param('disk');\n    if (!disk || !this.manager.hasDisk(disk)) return new Response('Unknown disk', { status: 404 });\n\n    const claim = url.searchParams.get('key');\n    const decoded = claim ? decodeStorageKeyClaim(claim) : undefined;\n    if (!decoded) return new Response('Malformed storage key claim', { status: 400 });\n\n    // Canonicalize after the one decode. Signed direct-driver callers cannot\n    // smuggle dot segments or non-canonical aliases into the proxy contract.\n    const fullPath = joinStoragePath(undefined, decoded);\n    if (fullPath !== decoded) return new Response('Invalid storage key', { status: 403 });\n\n    if (!isStorageKeyWithinRoot(fullPath, this.manager.getDiskConfig(disk).root)) {\n      return new Response('Storage key is outside the configured root', { status: 403 });\n    }\n\n    try {\n      const result = await this.manager.getDriver(disk).download(fullPath);\n      const filename = fullPath.split('/').at(-1) || 'download';\n      return new Response(result.toStream(), {\n        headers: {\n          'content-type': result.contentType || 'application/octet-stream',\n          // Objects are untrusted user content.  The authenticated API origin\n          // never renders them inline (especially HTML/SVG), even when the\n          // stored Content-Type is attacker controlled.\n          'content-disposition': `attachment; filename*=UTF-8''${encodeURIComponent(filename)}`,\n          'x-content-type-options': 'nosniff',\n        },\n      });\n    } catch {\n      return new Response('Not found', { status: 404 });\n    }\n  }\n}\n","import { Inject, Injectable } from '@velajs/vela';\nimport {\n  joinStoragePath,\n  type DownloadResult,\n  type PresignedUrlResult,\n  type PresignMethod,\n  type StorageBody,\n  type UploadOptions,\n  type UploadResult,\n} from '@velajs/vela/storage';\nimport { StorageManagerService } from './storage-manager.service';\nimport { STORAGE_OPTIONS } from './storage.tokens';\nimport type { StorageModuleOptions } from './storage.types';\n\nconst DEFAULT_PRESIGN = { defaultExpiry: 3600, maxExpiry: 86400 };\n\n/**\n * Multi-disk storage facade. Applies each disk's (templated) root, resolves the\n * driver, and validates presign expiry. Injectable anywhere via `StorageService`.\n */\n@Injectable()\nexport class StorageService {\n  constructor(\n    @Inject(STORAGE_OPTIONS) private readonly options: StorageModuleOptions,\n    @Inject(StorageManagerService) private readonly manager: StorageManagerService,\n  ) {}\n\n  put(\n    relativePath: string,\n    body: StorageBody,\n    options: UploadOptions = {},\n    disk?: string,\n  ): Promise<UploadResult> {\n    const name = this.resolveDisk(disk);\n    return this.manager.getDriver(name).upload(body, this.fullPath(relativePath, name), options);\n  }\n\n  get(relativePath: string, disk?: string): Promise<DownloadResult> {\n    const name = this.resolveDisk(disk);\n    return this.manager.getDriver(name).download(this.fullPath(relativePath, name));\n  }\n\n  delete(relativePath: string, disk?: string): Promise<void> {\n    const name = this.resolveDisk(disk);\n    return this.manager.getDriver(name).delete(this.fullPath(relativePath, name));\n  }\n\n  exists(relativePath: string, disk?: string): Promise<boolean> {\n    const name = this.resolveDisk(disk);\n    return this.manager.getDriver(name).exists(this.fullPath(relativePath, name));\n  }\n\n  url(\n    relativePath: string,\n    method: PresignMethod = 'GET',\n    expiresIn?: number,\n    disk?: string,\n  ): Promise<PresignedUrlResult> {\n    const name = this.resolveDisk(disk);\n    return this.manager\n      .getDriver(name)\n      .getPresignedUrl(this.fullPath(relativePath, name), method, this.validateExpiry(expiresIn));\n  }\n\n  private resolveDisk(disk?: string): string {\n    const name = disk ?? this.options.defaultDisk;\n    if (!this.manager.hasDisk(name)) throw new Error(`Storage disk \"${name}\" is not configured.`);\n    return name;\n  }\n\n  private fullPath(relativePath: string, disk: string): string {\n    return joinStoragePath(this.manager.getDiskConfig(disk).root, relativePath);\n  }\n\n  private validateExpiry(expiresIn?: number): number {\n    const cfg = this.options.presignedUrl ?? DEFAULT_PRESIGN;\n    const value = expiresIn ?? cfg.defaultExpiry;\n    // `Number.isSafeInteger` rejects NaN/fractional/infinite values — otherwise\n    // `NaN < 1 || NaN > max` is false,\n    // NaN slips through, signUrl omits `expires`, and the URL never expires.\n    if (!Number.isSafeInteger(value) || value < 1 || value > cfg.maxExpiry) {\n      throw new Error(`Presigned URL expiry ${value}s is out of range (1–${cfg.maxExpiry}s).`);\n    }\n    return value;\n  }\n}\n","import { ConfigurableModuleBuilder, Module } from '@velajs/vela';\nimport { StorageController } from './storage.controller';\nimport { StorageManagerService } from './storage-manager.service';\nimport { StorageService } from './storage.service';\nimport { STORAGE_OPTIONS } from './storage.tokens';\nimport type { StorageModuleOptions } from './storage.types';\n\nconst { ConfigurableModuleClass } = new ConfigurableModuleBuilder<StorageModuleOptions>({\n  moduleName: 'Storage',\n  optionsInjectionToken: STORAGE_OPTIONS,\n}).build();\n\n@Module({\n  providers: [StorageManagerService, StorageService],\n  controllers: [StorageController],\n  exports: [StorageService, StorageManagerService, STORAGE_OPTIONS],\n})\nexport class StorageModule extends ConfigurableModuleClass {}\n","import {\n  type AsyncCacheStore,\n  type CacheEntryReader,\n  type CacheEntryWriter,\n  type CacheEntry,\n  type CacheInvalidationStore,\n} from '@velajs/vela';\n\n/**\n * Native KV JSON value store. Metadata retains logical expiry even when KV's\n * physical retention rounds up to its 60-second minimum. Legacy values without\n * metadata remain readable, but cannot safely backfill another tier.\n */\nexport class KVCacheStore implements AsyncCacheStore, CacheEntryReader, CacheEntryWriter {\n  constructor(private readonly ns: KVNamespace) {}\n\n  async get(key: string): Promise<unknown> {\n    return (await this.getEntry(key))?.value;\n  }\n\n  async getEntry(key: string): Promise<{ value: unknown; expiresAt?: number } | undefined> {\n    const { value, metadata } = await this.ns.getWithMetadata<unknown, unknown>(key, 'json');\n    if (value === null) return undefined;\n    if (typeof metadata === 'object' && metadata !== null && 'velaCacheExpiresAt' in metadata) {\n      const expiresAt = metadata.velaCacheExpiresAt;\n      if (typeof expiresAt !== 'number' || !Number.isFinite(expiresAt) || expiresAt <= Date.now())\n        return undefined;\n      return { value, expiresAt };\n    }\n    return { value };\n  }\n\n  async set(key: string, value: unknown, ttl?: number): Promise<void> {\n    if (ttl !== undefined && (!Number.isFinite(ttl) || ttl < 0))\n      throw new TypeError('Cache TTL must be finite and nonnegative.');\n    if (ttl !== undefined) return this.setEntry(key, { value, expiresAt: Date.now() + ttl * 1000 });\n    await this.ns.put(key, JSON.stringify(value));\n  }\n\n  async setEntry(key: string, entry: CacheEntry): Promise<void> {\n    if (!Number.isFinite(entry.expiresAt)) throw new TypeError('Cache expiry must be finite.');\n    const remaining = (entry.expiresAt - Date.now()) / 1000;\n    if (remaining <= 0) return this.del(key);\n    await this.ns.put(key, JSON.stringify(entry.value), {\n      expirationTtl: Math.max(60, Math.ceil(remaining)),\n      metadata: { velaCacheExpiresAt: entry.expiresAt },\n    });\n  }\n\n  async del(key: string): Promise<void> {\n    await this.ns.delete(key);\n  }\n\n  /** Namespace-wide, best effort. Use a dedicated value namespace; never use for scoped invalidation. */\n  async clear(): Promise<void> {\n    let cursor: string | undefined;\n    do {\n      const list = await this.ns.list(cursor ? { cursor } : undefined);\n      await Promise.all(list.keys.map((entry) => this.ns.delete(entry.name)));\n      cursor = list.list_complete ? undefined : list.cursor;\n    } while (cursor);\n  }\n}\n\n/**\n * Optional, eventually consistent generation store. Use a dedicated KV namespace\n * without TTL/lifecycle cleanup. Never delete/reset generations while entries can\n * survive. Concurrent writes and cached/negative reads prevent strong invalidation;\n * this is unsuitable for strict read-after-write or authorization revocation.\n */\nexport class KVCacheInvalidationStore implements CacheInvalidationStore {\n  constructor(private readonly ns: KVNamespace) {}\n  async getVersion(key: string): Promise<string> {\n    const value: unknown = await this.ns.get(key, 'json');\n    if (value === null) return 'initial';\n    if (typeof value !== 'string' || value.length === 0 || value.length > 2048)\n      throw new TypeError('Invalid cache generation.');\n    return value;\n  }\n  async invalidate(key: string): Promise<void> {\n    await this.ns.put(key, JSON.stringify(crypto.randomUUID()));\n  }\n}\n","import type { FeatureFlagDriver, FlagContext } from '@velajs/feature-flags';\n\n/**\n * The subset of a Cloudflare **Flagship** binding this driver evaluates against\n * — the four typed value methods. The binding itself returns the supplied\n * `defaultValue` on evaluation errors; transport-level failures reject and are\n * left to propagate (never-throw is the service layer's job, not the driver's).\n *\n * @see https://developers.cloudflare.com/flagship/binding/\n */\nexport interface FlagshipBinding {\n  getBooleanValue(key: string, defaultValue: boolean, context?: FlagContext): Promise<boolean>;\n  getStringValue(key: string, defaultValue: string, context?: FlagContext): Promise<string>;\n  getNumberValue(key: string, defaultValue: number, context?: FlagContext): Promise<number>;\n  getObjectValue(key: string, defaultValue: object, context?: FlagContext): Promise<unknown>;\n}\n\nexport interface FlagshipFlagDriverOptions {\n  /** Driver name used for `use(name)` / default-driver selection. Default `\"flagship\"`. */\n  name?: string;\n}\n\n/**\n * {@link FeatureFlagDriver} backed by a Cloudflare Flagship binding.\n *\n * A thin, honest wrapper: each contract method maps 1:1 onto the binding's\n * corresponding value method, forwarding the caller's `fallback` (the binding's\n * `defaultValue`) and evaluation context. The binding resolves the fallback on\n * evaluation errors; anything the binding *rejects* with (e.g. a `remote: true`\n * dev-proxy tunnel dropping) propagates — `@velajs/feature-flags`'s service owns\n * the never-throw guarantee.\n *\n * Build the driver inside a provider factory with the native environment:\n *\n * ```ts\n * FeatureFlagsModule.forRootAsync({\n *   inject: [ENV],\n *   useFactory: (env: WorkerEnv) => ({ drivers: [flagshipFlagDriver(env.FLAGS)] }),\n * });\n * ```\n *\n * Evaluation ergonomics (the 1:1 binding-method mapping) are ported from the\n * Stratal feature-flags service (MIT, © Temitayo Fadojutimi), reshaped as a\n * bare driver.\n */\nexport class FlagshipFlagDriver implements FeatureFlagDriver {\n  readonly name: string;\n  private readonly resolve: () => FlagshipBinding;\n\n  constructor(\n    binding: FlagshipBinding | (() => FlagshipBinding),\n    options: FlagshipFlagDriverOptions = {},\n  ) {\n    this.resolve = typeof binding === 'function' ? binding : () => binding;\n    this.name = options.name ?? 'flagship';\n  }\n\n  getBoolean(key: string, fallback: boolean, ctx?: FlagContext): Promise<boolean> {\n    return this.resolve().getBooleanValue(key, fallback, ctx);\n  }\n\n  getString(key: string, fallback: string, ctx?: FlagContext): Promise<string> {\n    return this.resolve().getStringValue(key, fallback, ctx);\n  }\n\n  getNumber(key: string, fallback: number, ctx?: FlagContext): Promise<number> {\n    return this.resolve().getNumberValue(key, fallback, ctx);\n  }\n\n  getObject(key: string, fallback: object, ctx?: FlagContext): Promise<unknown> {\n    return this.resolve().getObjectValue(key, fallback, ctx);\n  }\n}\n\n/** Convenience factory for {@link FlagshipFlagDriver}. */\nexport function flagshipFlagDriver(\n  binding: FlagshipBinding | (() => FlagshipBinding),\n  options?: FlagshipFlagDriverOptions,\n): FlagshipFlagDriver {\n  return new FlagshipFlagDriver(binding, options);\n}\n","import type { FeatureFlagDriver, FlagContext } from '@velajs/feature-flags';\n\nexport interface KvFlagDriverOptions {\n  /** Driver name used for `use(name)` / default-driver selection. Default `\"kv\"`. */\n  name?: string;\n  /** Prefix prepended to every flag key before the KV read. Default `\"\"` (none). */\n  prefix?: string;\n}\n\n/**\n * Cloudflare KV-backed {@link FeatureFlagDriver}. Flags are stored as JSON\n * values under an optional key prefix and read with `get(key, 'json')`. Reads\n * are type-checked against the requested type: a missing key or a value of the\n * wrong JSON type returns the caller's `fallback`. KV has no targeting, so the\n * evaluation context is ignored.\n *\n * The driver stays honest — it does **not** swallow errors. A KV failure (or a\n * `SyntaxError` from a malformed stored value) propagates; the never-throw\n * guarantee lives in `@velajs/feature-flags`'s service layer.\n *\n * Placed like {@link KVCacheStore}: construct it in a wiring factory over a\n * resolved {@link KVNamespace}.\n *\n * ```ts\n * FeatureFlagsModule.forRootAsync({\n *   inject: [ENV],\n *   useFactory: (env: WorkerEnv) => ({ drivers: [new KvFlagDriver(env.CACHE, { prefix: 'flag:' })] }),\n * });\n * ```\n */\nexport class KvFlagDriver implements FeatureFlagDriver {\n  readonly name: string;\n  private readonly prefix: string;\n\n  constructor(\n    private readonly ns: KVNamespace,\n    options: KvFlagDriverOptions = {},\n  ) {\n    this.name = options.name ?? 'kv';\n    this.prefix = options.prefix ?? '';\n  }\n\n  getBoolean(key: string, fallback: boolean, _ctx?: FlagContext): Promise<boolean> {\n    return this.read(key, fallback, (v) => typeof v === 'boolean');\n  }\n\n  getString(key: string, fallback: string, _ctx?: FlagContext): Promise<string> {\n    return this.read(key, fallback, (v) => typeof v === 'string');\n  }\n\n  getNumber(key: string, fallback: number, _ctx?: FlagContext): Promise<number> {\n    return this.read(key, fallback, (v) => typeof v === 'number');\n  }\n\n  getObject(key: string, fallback: object, _ctx?: FlagContext): Promise<unknown> {\n    return this.read(key, fallback, (v) => typeof v === 'object' && v !== null);\n  }\n\n  /**\n   * Reads and JSON-parses the (prefixed) key, returning the parsed value only\n   * when `matches` accepts its type; otherwise the caller's fallback. A missing\n   * key reads as `null` → fallback. Read/parse errors are left to propagate.\n   */\n  private async read<T>(\n    key: string,\n    fallback: T,\n    matches: (value: unknown) => value is T,\n  ): Promise<T> {\n    const value = await this.ns.get(this.prefix + key, 'json');\n    if (value === null || value === undefined) return fallback;\n    return matches(value) ? value : fallback;\n  }\n}\n\n/** Convenience factory for {@link KvFlagDriver}. */\nexport function kvFlagDriver(kv: KVNamespace, options?: KvFlagDriverOptions): KvFlagDriver {\n  return new KvFlagDriver(kv, options);\n}\n","import { defineMetadata, getMetadata, registerEntrypointKind } from '@velajs/vela';\n\nconst QUEUE_CONSUMER_METADATA_KEY = 'cloudflare:queue-consumer';\n\n// Open entrypoint kind: any adapter can enumerate queue consumers via\n// `app.entrypoints.ofKind('cf:queue')` — declared here, next to the decorator,\n// with zero vela-core involvement.\nregisterEntrypointKind({ kind: 'cf:queue', metaKey: QUEUE_CONSUMER_METADATA_KEY, level: 'method' });\n\nexport interface QueueConsumerMetadata {\n  queueName: string;\n  methodName: string;\n}\n\n/**\n * Marks a method as a queue consumer handler.\n *\n * @example\n * ```ts\n * @Injectable()\n * class WorkerService {\n *   @QueueConsumer('email-queue')\n *   async processEmails(batch: MessageBatch) {\n *     for (const msg of batch.messages) {\n *       console.log('Processing:', msg.body);\n *       msg.ack();\n *     }\n *   }\n * }\n * ```\n */\nexport function QueueConsumer(queueName: string): MethodDecorator {\n  return (target: object, propertyKey: string | symbol, _descriptor: PropertyDescriptor) => {\n    const existing: QueueConsumerMetadata[] =\n      (getMetadata(QUEUE_CONSUMER_METADATA_KEY, target.constructor) as QueueConsumerMetadata[]) ??\n      [];\n    existing.push({ queueName, methodName: String(propertyKey) });\n    defineMetadata(QUEUE_CONSUMER_METADATA_KEY, existing, target.constructor);\n  };\n}\n\nexport function getQueueConsumerMetadata(target: object): QueueConsumerMetadata[] {\n  const ctor = target.constructor ?? target;\n  return (getMetadata(QUEUE_CONSUMER_METADATA_KEY, ctor) as QueueConsumerMetadata[]) ?? [];\n}\n","import { defineProvider, type DynamicModule } from '@velajs/vela';\nimport { WsDispatcher, WS_SERVER } from '@velajs/vela/websocket';\nimport { WsServerHolder } from './ws-server-holder';\n\n/**\n * Cloudflare counterpart to the core `WebSocketModule.forRoot()`. Import this in\n * your `AppModule` instead: it provides the gateway dispatcher plus a late-bound\n * `WS_SERVER` (`WsServerHolder`) that the WebSocket Durable Object wires to a\n * ctx-backed server per instance. `useClass` ensures a fresh holder per DI\n * container so colocated DO instances never share a server.\n */\nexport class CloudflareWebSocketModule {\n  static forRoot(): DynamicModule {\n    const providers = [defineProvider(WS_SERVER, { useClass: WsServerHolder }), WsDispatcher];\n\n    return {\n      module: CloudflareWebSocketModule,\n      providers,\n      exports: [WS_SERVER, WsDispatcher],\n    };\n  }\n}\n","import {\n  assertBroadcastCommandFits,\n  DEFAULT_WS_MAX_FRAME_BYTES,\n  resolveMaxFrameBytes,\n} from '@velajs/vela/websocket';\nimport type { BroadcastCommand } from '@velajs/vela/websocket';\nimport { roomToDurableId } from './room-id';\n\nexport interface WsBroadcastStub {\n  broadcast(cmd: BroadcastCommand): Promise<void>;\n}\n\nexport interface BroadcastNamespace {\n  idFromName(name: string): DurableObjectId;\n  get(id: DurableObjectId): WsBroadcastStub;\n}\n\n/**\n * Push to a room from a Worker HTTP handler / cron / queue consumer (server-\n * initiated emit). Resolves the room's Durable Object and calls its `broadcast`\n * RPC method — the same canonical room→DO mapping the upgrade route uses, so it\n * always reaches the DO holding those sockets.\n *\n * @example\n * ```ts\n * // In a controller — ns from the typed Worker environment\n * await broadcastToRoom(ns, '/orgs/:orgId/ws', `org:${id}`, 'order.created', order);\n * ```\n */\nexport async function broadcastToRoom(\n  ns: BroadcastNamespace,\n  gatewayPath: string,\n  room: string,\n  event: string,\n  data?: unknown,\n  options?: { exceptIds?: string[]; maxFrameBytes?: number },\n): Promise<void> {\n  const cmd: BroadcastCommand = {\n    rooms: [room],\n    exceptIds: options?.exceptIds,\n    frame: JSON.stringify({ event, data }),\n  };\n  const maxFrameBytes = resolveMaxFrameBytes({\n    maxFrameBytes: options?.maxFrameBytes ?? DEFAULT_WS_MAX_FRAME_BYTES,\n  });\n  assertBroadcastCommandFits(cmd, maxFrameBytes);\n  const stub = ns.get(roomToDurableId(ns, gatewayPath, room));\n  await stub.broadcast(cmd);\n}\n","import type { ThrottlerStorageRecord, ThrottlerStore } from '@velajs/vela';\n\n/** The deliberately small surface exposed by a Workers Rate Limiting binding. */\nexport interface CloudflareRateLimitBinding {\n  limit(input: { key: string }): Promise<{ success: boolean }>;\n}\n\nexport interface CloudflareRateLimitStoreOptions {\n  /** Must match the binding's configured `simple.limit`. */\n  limit: number;\n  /** Must match the binding's configured `simple.period`. */\n  periodSeconds: 10 | 60;\n  /** Bound attacker-influenced tracking keys before calling the platform. */\n  maxKeyBytes?: number;\n}\n\n/**\n * Adapt a Cloudflare Workers Rate Limiting binding to Vela's throttler store.\n *\n * The platform binding makes the allow/deny decision. It does not expose exact\n * counters or reset timestamps, so this adapter intentionally omits `remaining`.\n */\nexport function cloudflareRateLimitStore(\n  binding: CloudflareRateLimitBinding | (() => CloudflareRateLimitBinding),\n  options: CloudflareRateLimitStoreOptions,\n): ThrottlerStore {\n  if (!binding || (typeof binding !== 'function' && typeof binding.limit !== 'function')) {\n    throw new TypeError('A Cloudflare Rate Limiting binding is required');\n  }\n  if (\n    !Number.isSafeInteger(options.limit) ||\n    options.limit <= 0 ||\n    options.limit >= Number.MAX_SAFE_INTEGER\n  ) {\n    throw new RangeError('Rate limit must be a positive safe integer');\n  }\n  if (options.periodSeconds !== 10 && options.periodSeconds !== 60) {\n    throw new RangeError('Cloudflare rate-limit periods must be 10 or 60 seconds');\n  }\n\n  const maxKeyBytes = options.maxKeyBytes ?? 1_024;\n  if (!Number.isSafeInteger(maxKeyBytes) || maxKeyBytes <= 0 || maxKeyBytes > 4_096) {\n    throw new RangeError('maxKeyBytes must be between 1 and 4096');\n  }\n\n  const ttlMs = options.periodSeconds * 1_000;\n  const encoder = new TextEncoder();\n  const resolveBinding =\n    typeof binding === 'function' ? binding : (): CloudflareRateLimitBinding => binding;\n\n  return {\n    async increment(key: string, requestedTtlMs: number): Promise<ThrottlerStorageRecord> {\n      if (requestedTtlMs !== ttlMs) {\n        throw new Error(\n          `Cloudflare binding period mismatch: expected ${ttlMs}ms, received ${requestedTtlMs}ms`,\n        );\n      }\n      if (\n        typeof key !== 'string' ||\n        key.length === 0 ||\n        /[\\u0000-\\u001f\\u007f]/.test(key) ||\n        encoder.encode(key).byteLength > maxKeyBytes\n      ) {\n        throw new Error('Refusing an invalid or oversized rate-limit key');\n      }\n\n      const currentBinding = resolveBinding();\n      if (!currentBinding || typeof currentBinding.limit !== 'function') {\n        throw new Error('Cloudflare Rate Limiting binding is unavailable');\n      }\n      const decision = await currentBinding.limit({ key });\n      if (!decision || typeof decision.success !== 'boolean') {\n        throw new Error('Cloudflare rate-limit binding returned an invalid decision');\n      }\n\n      return {\n        // Vela consumes `allowed` as the authoritative platform decision. These\n        // sentinel counts preserve compatibility without inventing a counter.\n        count: decision.success ? 0 : options.limit + 1,\n        ttlMs,\n        allowed: decision.success,\n        enforcedLimit: options.limit,\n      };\n    },\n\n    reset(): never {\n      throw new Error('Cloudflare Rate Limiting bindings do not support counter reset');\n    },\n  };\n}\n","import type { VelaNonceDurableObject } from './nonce.durable-object';\nimport { MAX_NONCE_BYTES, isCanonicalBoundedText, isValidExpiry } from './nonce-validation';\nimport type { NonceStore } from '@velajs/vela';\n\nconst APP_NAMESPACE_PREFIX = 'vela:nonce:v1:';\nconst MAX_APP_NAMESPACE_BYTES = 128;\n/** The generated Workers binding type for {@link VelaNonceDurableObject}. */\nexport type DurableObjectNonceNamespace = DurableObjectNamespace<VelaNonceDurableObject>;\n\nexport interface DurableObjectNonceStoreOptions {\n  /**\n   * Stable application/environment boundary (for example `billing-api:prod`).\n   * Claims are globally single-use inside this namespace and isolated from all\n   * other application namespaces. It must be non-empty, canonical, and at most\n   * 128 UTF-8 bytes.\n   */\n  appNamespace: string;\n\n  /**\n   * Resolve the Workers Durable Object namespace at claim time. The resolver is\n   * intentionally not cached so request-scoped env/binding references stay safe.\n   */\n  binding: () => DurableObjectNonceNamespace | Promise<DurableObjectNonceNamespace>;\n}\n\n/**\n * Strict, cross-isolate {@link NonceStore} backed by one SQLite Durable Object\n * per explicit application namespace.\n *\n * Invalid input, an unavailable/malformed binding, RPC failure, or a malformed\n * RPC result all deny the claim (`false`). Only the literal boolean `true` from\n * the Durable Object is accepted.\n */\nexport function durableObjectNonceStore(options: DurableObjectNonceStoreOptions): NonceStore {\n  if (!options || typeof options !== 'object') {\n    throw new TypeError('Durable Object nonce-store options are required');\n  }\n  if (!isCanonicalBoundedText(options.appNamespace, MAX_APP_NAMESPACE_BYTES)) {\n    throw new TypeError(\n      `appNamespace must be canonical, non-empty, and at most ${MAX_APP_NAMESPACE_BYTES} UTF-8 bytes`,\n    );\n  }\n  if (typeof options.binding !== 'function') {\n    throw new TypeError('A lazy Durable Object namespace binding resolver is required');\n  }\n\n  const objectName = `${APP_NAMESPACE_PREFIX}${options.appNamespace}`;\n\n  return {\n    async claim(nonce: string, expEpochSeconds: number): Promise<boolean> {\n      const now = Math.floor(Date.now() / 1_000);\n      if (!isCanonicalBoundedText(nonce, MAX_NONCE_BYTES) || !isValidExpiry(expEpochSeconds, now)) {\n        return false;\n      }\n\n      try {\n        const namespace = await options.binding();\n\n        const id = namespace.idFromName(objectName);\n        const stub = namespace.get(id);\n        const result = await stub.claim(nonce, expEpochSeconds);\n        return result === true;\n      } catch {\n        return false;\n      }\n    },\n  };\n}\n"],"mappings":";;;;;;AAqBA,MAAM,2BAA2B;AACjC,MAAM,UAAU,IAAI,YAAY;AAchC,SAAS,gBAAgB,OAAiC;CACxD,OACE,OAAO,UAAU,YACjB,MAAM,SAAS,KACf,CAAC,MAAM,SAAS,IAAI,KACpB,CAAC,MAAM,SAAS,IAAI,KACpB,QAAQ,OAAO,KAAK,CAAC,CAAC,cAAc;AAExC;;AAGA,SAAS,eAAe,GAAkD;CACxE,MAAM,QAAQ,0BAA0B,EAAE,IAAI,GAAG;CACjD,IAAI,CAAC,OAAO,OAAO,KAAA;CACnB,MAAM,EAAE,WAAW,UAAU,gBAAgB;CAC7C,IACE,CAAC,gBAAgB,UAAU,MAAM,KACjC,CAAC,gBAAgB,UAAU,OAAO,KAClC,CAAC,gBAAgB,QAAQ,KACzB,OAAO,gBAAgB,YACvB,CAAC,OAAO,cAAc,WAAW,KACjC,eAAe,GAEf,OAAO;CACT,OAAO;EAAE;EAAW;EAAU;CAAY;AAC5C;;AAGA,SAAS,kBACP,iBACA,iBACsC;CACtC,IAAI,CAAC,mBAAmB,CAAC,iBAAiB,OAAO,KAAA;CACjD,IAAI,CAAC,iBAAiB,OAAO;CAC7B,IAAI,CAAC,iBAAiB,OAAO;CAC7B,IACE,gBAAgB,UAAU,WAAW,gBAAgB,UAAU,UAC/D,gBAAgB,UAAU,YAAY,gBAAgB,UAAU,WAChE,gBAAgB,UAAU,kBAAkB,gBAAgB,UAAU,iBACtE,gBAAgB,aAAa,gBAAgB,UAE7C,OAAO;CAET,OAAO;EACL,WAAW,EAAE,GAAG,gBAAgB,UAAU;EAC1C,UAAU,gBAAgB;EAC1B,aAAa,KAAK,IAAI,gBAAgB,aAAa,gBAAgB,WAAW;CAChF;AACF;;AAGA,SAAS,QAAQ,OAA+B;CAC9C,OAAO,OAAO,UAAU;AAC1B;;;;;;AAOA,SAAgB,uBAAuB,UAAkB,WAAwC;CAE/F,MAAM,UAAU,YAAqC,qBAAqB,SAAS,WAAW;CAC9F,IAAI,CAAC,SAAS,QAAQ,CAAC,SAAS,SAAS,OAAO,CAAC;CACjD,wBAAwB,OAAO;CAC/B,qBAAqB,OAAO;CAC5B,MAAM,UAAmB,SAAS;CAClC,MAAM,SAAS,QAAQ,OAAO,IAAI,UAAU,kBAAkB,OAAO,IAAI,CAAC;CAC1E,OAAO,CACL;EACE,MAAM,QAAQ;EACd,SAAS,QAAQ;EACjB,SAAS,EAAE,GAAG,QAAQ;EACtB,GAAI,OAAO,WAAW,IAAI,EAAE,UAAU,OAAO,GAAG,IAAI,CAAC;CACvD,CACF;AACF;;;;;;;;;AAUA,SAAgB,wBACd,MACA,QACA,WACM;CACN,KAAK,MAAM,SAAS,QAAQ;EAC1B,MAAM,eAAe,2BAA2B,WAAW,KAAK;EAChE,KAAK,IAAI,MAAM,MAAM,OAAO,MAAe;GACzC,IAAI,EAAE,IAAI,OAAO,SAAS,CAAC,EAAE,YAAY,MAAM,aAC7C,OAAO,EAAE,KAAK,8BAA8B,GAAG;GAMjD,MAAM,UAAU,IAAI,QAAQ,EAAE,IAAI,IAAI,OAAO;GAC7C,QAAQ,OAAO,aAAa;GAC5B,QAAQ,OAAO,aAAa;GAC5B,QAAQ,OAAO,aAAa;GAC5B,QAAQ,OAAO,mBAAmB;GAClC,QAAQ,OAAO,sBAAsB;GACrC,QAAQ,OAAO,eAAe;GAC9B,QAAQ,OAAO,gBAAgB;GAC/B,QAAQ,OAAO,uBAAuB;GACtC,QAAQ,OAAO,eAAe;GAC9B,MAAM,mBAAmB,IAAI,QAAQ,EAAE,IAAI,KAAK,EAAE,QAAQ,CAAC;GAE3D,IAAI;GACJ,IAAI;IACF,SAAS,qBAAqB,MAAM,UAAU,SAAS,EAAE,IAAI,MAAM,IAAI,CAAC;GAC1E,QAAQ;IACN,OAAO,EAAE,KAAK,0BAA0B,GAAG;GAC7C;GAIA,MAAM,UAAU,MAAM,aAAa,kBAAkB,MAAM;GAC3D,IAAI,YAAY,OAAO,OAAO,EAAE,KAAK,+BAA+B,GAAG;GAEvE,MAAM,kBAAkB,eAAe,CAAC;GACxC,IAAI,oBAAoB,MAAM,OAAO,EAAE,KAAK,8BAA8B,GAAG;GAC7E,MAAM,WAAW,kBAAkB,iBAAiB,QAAQ,QAAQ;GACpE,IAAI,aAAa,MAAM,OAAO,EAAE,KAAK,oCAAoC,GAAG;GAC5E,IAAI,YAAY,SAAS,eAAe,KAAK,IAAI,GAC/C,OAAO,EAAE,KAAK,8BAA8B,GAAG;GAIjD,MAAM,iBAAiB,IAAI,QAAQ,QAAQ,QAAQ,OAAO;GAC1D,eAAe,IAAI,eAAe,MAAM;GACxC,eAAe,IAAI,eAAe,MAAM,IAAI;GAC5C,IAAI,UAAU;IACZ,eAAe,IAAI,eAAe,SAAS,UAAU,OAAO;IAC5D,eAAe,IAAI,iBAAiB,SAAS,UAAU,MAAM;IAC7D,eAAe,IAAI,kBAAkB,SAAS,UAAU,OAAO;IAC/D,eAAe,IAAI,yBAAyB,SAAS,UAAU,aAAa;IAC5E,eAAe,IAAI,iBAAiB,SAAS,QAAQ;IACrD,eAAe,IAAI,wBAAwB,OAAO,SAAS,WAAW,CAAC;GACzE;GAEA,OAAO,cACL,EAAE,KACF,MAAM,SACN,MAAM,MACN,QACA,IAAI,QAAQ,QAAQ,SAAS,EAAE,SAAS,eAAe,CAAC,CAC1D;EACF,CAAC;CACH;AACF;;;;;;AAOA,eAAe,cACb,KACA,SACA,MACA,MACA,SACmB;CACnB,IAAI,OAAO,QAAQ,YAAY,QAAQ,MAAM,MAAM,IAAI,MAAM,+BAA+B;CAC5F,MAAM,YAAqB,QAAQ,IAAI,KAAK,OAAO;CACnD,IAAI,OAAO,cAAc,YAAY,cAAc,MACjD,OAAO,IAAI,SAAS,2BAA2B,QAAQ,sBAAsB,EAAE,QAAQ,IAAI,CAAC;CAE9F,MAAM,aAAsB,QAAQ,IAAI,WAAW,YAAY;CAC/D,MAAM,MAAe,QAAQ,IAAI,WAAW,KAAK;CACjD,IAAI,OAAO,eAAe,cAAc,OAAO,QAAQ,YACrD,MAAM,IAAI,MAAM,kCAAkC;CAEpD,MAAM,KAAc,QAAQ,MAAM,YAAY,WAAW,CAAC,sBAAsB,MAAM,IAAI,CAAC,CAAC;CAC5F,MAAM,OAAgB,QAAQ,MAAM,KAAK,WAAW,CAAC,EAAE,CAAC;CACxD,IAAI,OAAO,SAAS,YAAY,SAAS,MAAM,MAAM,IAAI,MAAM,6BAA6B;CAC5F,MAAM,QAAiB,QAAQ,IAAI,MAAM,OAAO;CAChD,IAAI,OAAO,UAAU,YAAY,MAAM,IAAI,MAAM,4CAA4C;CAC7F,MAAM,WAAoB,MAAM,QAAQ,MAAM,OAAO,MAAM,CAAC,OAAO,CAAC;CACpE,IAAI,EAAE,oBAAoB,WACxB,MAAM,IAAI,MAAM,6CAA6C;CAC/D,OAAO;AACT;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACxKA,MAAa,6BAA6B,IAAI,eAC5C,sCACA;CACE,OAAO,MAAM;CACb,eAAe;EACb,MAAM,IAAI,MACR,8JAEF;CACF;AACF,CACF;;AAGA,SAAgB,yBACd,OACA,eAC0B;CAC1B,OAAO,OAAO,OAAO;EACnB,MAAM,MAAM;EACZ;EACA,eAAe;GACb,MAAM,UAAU;EAClB;CACF,CAAC;AACH;;;;;;;AAQA,MAAM,sBAA8C,OAAO,eAAe;CACxE,IAAI,WAAW,SAAS,QAAQ;CAChC,MAAM,mBACJ,4BACA,yBAAyB,EAAE,MAAM,WAAW,WAAW,GAAG,WAAW,aAAa,CACpF;AACF;;;;;AAMA,SAAgB,2BAA2B,WAA4B;CACrE,UAAU,SAAS,eAAe,0BAA0B,EAAE,UAAU,mBAAmB,CAAC,CAAC;CAC7F,UAAU,gBAAgB,wBAAwB;AACpD;;;ACtEA,SAAS,OAAO,UAAkB,YAA6B,MAA0B;CAEvF,MAAM,SAAkB,QAAQ,IAAI,UAAU,UAAU;CACxD,IAAI,OAAO,WAAW,YACpB,MAAM,IAAI,MACR,WAAW,OAAO,UAAU,EAAE,yBAAyB,SAAS,YAAY,MAC9E;CAEF,OAAO,QAAQ,MAAM,QAAQ,UAAU,IAAI;AAC7C;AAEA,SAAS,iBAAiB,MAAe,UAA0B;CACjE,IAAI,OAAO,SAAS,YAAY,SAAS,MAAM,MAAM,IAAI,MAAM,8BAA8B;CAC7F,MAAM,QAAiB,QAAQ,IAAI,MAAM,QAAQ;CACjD,IAAI,OAAO,UAAU,UACnB,MAAM,IAAI,MAAM,gCAAgC,SAAS,mBAAmB;CAC9E,OAAO;AACT;;;;;;AAOA,MAAM,uCAAuB,IAAI,IAAI,CAAC,iBAAiB,CAAC;AAExD,MAAM,gCAAgB,IAAI,IAAY;;AAGtC,SAAS,cAAc,MAAmC;CACxD,IAAI,OAAO,SAAS,YAAY,SAAS,MAAM,OAAO,KAAA;CACtD,MAAM,QAAiB,QAAQ,IAAI,MAAM,OAAO;CAChD,IACE,OAAO,UAAU,YACjB,OAAO,QAAQ,IAAI,MAAM,IAAI,MAAM,YACnC,OAAO,QAAQ,IAAI,MAAM,MAAM,MAAM,YACrC,EAAE,UAAU,OAEZ;CAEF,OAAO;AACT;;AAGA,eAAe,kBAAkB,MAA+C;CAE9E,MAAM,UAAS,MADQ,QAAQ,WAAW,IAAI,EAAA,CACtB,SAAS,YAC/B,QAAQ,WAAW,aAAa,CAAC,QAAQ,MAAM,IAAI,CAAC,CACtD;CACA,IAAI,OAAO,WAAW,GAAG,MAAM,OAAO;CACtC,IAAI,OAAO,SAAS,GAAG,MAAM,IAAI,eAAe,QAAQ,sCAAsC;AAChG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCA,IAAa,wBAAb,MAAmC;CAQtB;CAPX,mBAA8C,CAAC;CAC/C;;CAEA,6BAAsB,IAAI,IAAoC;CAE9D,YACE,KACA,KACA;EADS,KAAA,MAAA;EAET,KAAK,OAAO;EACZ,KAAK,MAAM,IAAI,IAAI,KAAK,GAAG;CAC7B;CAEA,QAAiB,OACf,SACA,KACA,QACsB;EACtB,4BAA4B,KAAK,KAAK,GAAG;EACzC,OAAO,KAAK,KAAK,MAAM,SAAS,KAAK,GAAG;CAC1C;CAEA,aAAwD;EACtD,OAAO,KAAK,KAAK,WAAW;CAC9B;;;;;;;;;;;;;CAcA;CAEA,IAAI,cAA8C;EAChD,OAAO,KAAK,KAAK;CACnB;;;;;;;;;;;;;;;;;;;;;CAsBA,aAAa,SAAoC;EAC/C,KAAK,KAAK,aAAa,OAAO;EAC9B,OAAO;CACT;;;;;;CAOA,cAAc,WAA4B;EACxC,MAAM,yBAAS,IAAI,IAA4B;EAC/C,KAAK,MAAM,MAAM,KAAK,KAAK,YAAY,OAAO,WAAW,GAAG;GAC1D,IAAI,OAAO,GAAG,SAAS,YAAY,GAAG,SAAS,QAAQ,EAAE,gBAAgB,GAAG,OAAO;GACnF,MAAM,OAAO,qBAAqB,GAAG,IAAI;GACzC,IAAI,KAAK,QAAQ,SACf,OAAO,IAAI,KAAK,MAAM;IACpB,MAAM,KAAK;IACX,SAAS,KAAK,QAAQ;IACtB,SAAS,EAAE,GAAG,KAAK,QAAQ;IAC3B,UAAU,KAAK;GACjB,CAAC;EAEL;EACA,MAAM,YAAY,KAAK,KAAK,aAAa;EACzC,KAAK,MAAM,YAAY,WAAW;GAChC,IAAI,CAAC,YAAY,OAAO,aAAa,UAAU;GAC/C,KAAK,MAAM,SAAS,uBAAuB,UAAU,SAAS,GAC5D,IAAI,CAAC,OAAO,IAAI,MAAM,IAAI,GAAG,OAAO,IAAI,MAAM,MAAM,KAAK;EAE7D;EACA,KAAK,iBAAiB,OAAO,GAAG,KAAK,iBAAiB,QAAQ,GAAG,OAAO,OAAO,CAAC;CAClF;;CAGA,qBAAuC;EACrC,OAAO,CAAC,GAAG,KAAK,gBAAgB;CAClC;;;;;;;;;;;CAYA,MAAM,UACJ,OACA,KACA,MACe;EACf,4BAA4B,KAAK,KAAK,GAAG;EACzC,MAAM,OAAO,KAAK,KAAK,YACpB,OAAO,iBAAiB,iBAAiB,CAAC,CAC1C,QAAQ,UAAU,MAAM,KAAK,eAAe,MAAM,IAAI;EACzD,IAAI,KAAK,WAAW,GAAG;EAEvB,MAAM,aAAa,IAAI,gBAAgB;EACvC,MAAM,gBAAgB,MAAM,iBAAiB,KAAK,IAAI;EAEtD,MAAM,aAAiC,OAAO,OAAO;GACnD,MAAM;GACN,YAAY,MAAM;GAClB;GACA,QAAQ,WAAW;EACrB,CAAC;EACD,MAAM,UAAU,yBAAyB,OAAO,aAAa;EAC7D,MAAM,YAAY,KAAK,KAAK,aAAa;EACzC,MAAM,UAAU,kBACd,KAAK,KAAK,UACR,mBAAmB,WAAW,OAAO,YAAY,EAC/C,OAAO,UAAU,MAAM,mBAAmB,4BAA4B,OAAO,EAC/E,CAAC,CACH,CACF;EACA,KAAK,WAAW,IAAI,SAAS,UAAU;EACvC,IAAI;GACF,MAAM;EACR,UAAU;GACR,KAAK,WAAW,OAAO,OAAO;EAChC;CACF;;;;;;;;;;CAWA,MAAc,mBACZ,IACA,SACA,KACA,iBACe;EACf,MAAM,cAAc,GAAG;EACvB,IAAI,OAAO,gBAAgB,YAAY,MAAM,IAAI,MAAM,mCAAmC;EAC1F,IAAI,GAAG,eAAe,KAAA,GAAW,MAAM,IAAI,MAAM,2CAA2C;EAC5F,MAAM,aAAa,GAAG;EACtB,MAAM,gBAAgB;GACpB,MAAM;GACN,QAAQ,GAAG,YAAY,KAAK,GAAG,OAAO,UAAU;EAClD;EACA,IAAI;EAEJ,IAAI;EACJ,IAAI;GACF,MAAM,qBAAqB,KAAK,KAAK,aAAa,GAAG,OAAO,OAAO,aAAa;IAC9E,MAAM,WAAW,sBAAsB,OAAO,EAAE;IAChD,MAAM,UAAU,gCACd,GAAG,MACH,aACA,YACA,SACA,UACA,KACF;IACA,MAAM,oBAAoB,EACxB,UAAU,SAAiC;KACzC,SAAS,UAAU,OAAO;KAC1B,gBAAgB,UAAU,OAAO;IACnC,EACF;IACA,IAAI,UAA6B,CAAC;IAClC,IAAI;KACF,WACE,MAAM,6BAA6B,UAAU,aAAa,YAAY,OAAO,QAAQ,EAAA,CACrF,WAAW;KACb,MAAM,SAAS,MAAM,6BACnB,SACA,aACA,YACA,OACA,QACF;KACA,MAAM,eAAe,MAAM,6BACzB,eACA,aACA,YACA,OACA,QACF;KACA,MAAM,eAAe,IAAI;MACvB;MACA;MACA;MACA,aAAa,YAAY;OAAC;OAAS;OAAK;MAAiB;MACzD,QAAQ,OAAO,SAAS;OACtB,MAAM,WAAW,MAAM,kBAAkB,OAAO,EAAE;OAClD,IAAI,OAAO,aAAa,YAAY,aAAa,MAC/C,MAAM,IAAI,MAAM,uCAAuC;OAEzD,IAAI;QACF,OAAO,MAAM,OAAO,UAAU,YAAY,IAAI;OAChD,SAAS,OAAO;QACd,IAAI,qBAAqB,IAAI,GAAG,IAAI,GAAG,YAAY,EAAE,MAAM;QAC3D,MAAM;OACR;MACF;KACF,CAAC;IACH,SAAS,OAAO;KACd,IAAI,WAAW,UAAU,OACvB,qBAAqB,KAAK,CAAC,CAAC,OAAO,OAAO,aAAa;KAEzD,KAAK,MAAM,UAAU,SACnB,IAAI,kBAAkB,QAAQ,KAAK,GAAG;MAGpC,MAAM,OAAO,MAAM,OAAO,OAAO;MACjC;KACF;KAEF,WAAW,EAAE,MAAM;KACnB,MAAM;IACR;GACF,CAAC;EACH,SAAS,OAAO;GAId,IAAI,CAAC,YAAY,SAAS,UAAU,OAAO;IACzC,MAAM,kBACJ,YAAY,iBAAiB,kBAAkB,MAAM,OAAO,OAAO,SAAS,QACxE,MAAM,OAAO,KACb;IACN,qBAAqB,KAAK,KAAK,aAAa,CAAC,CAAC,CAAC,OAAO,iBAAiB,aAAa;GACtF;GACA,MAAM;EACR;CACF;;;;;;;;;;;CAYA,MAAM,MACJ,OACA,KACA,KACe;EACf,4BAA4B,KAAK,KAAK,GAAG;EACzC,MAAM,MAAM,KAAK,KAAK,YACnB,OAAO,UAAU,CAAC,CAClB,QAAQ,OAAO,iBAAiB,GAAG,MAAM,WAAW,MAAM,MAAM,KAAK;EACxE,IAAI,IAAI,SAAS,GAAG,KAAK,YAAY,KAAK;EAC1C,MAAM,WAAW,IAAI,SAAS,IAAI,MAAM,KAAK,KAAK,YAAY,OAAO,iBAAiB;EAEtF,IAAI,SAAS,WAAW,GACtB,MAAM,IAAI,MACR,6BAA6B,MAAM,MAAM,yBAAyB,MAAM,MAAM,iRAKhF;EAGF,MAAM,kBAAkB,SAAS,KAAK,OAAO,KAAK,mBAAmB,IAAI,OAAO,KAAK,GAAG,CAAC,CAAC;CAC5F;;;;;;;;;CAUA,YAAoB,OAA8D;EAChF,IAAI,KAAK,KAAK,aAAa,CAAC,CAAC,eAAe,MAAM,UAAU;EAC5D,MAAM,aAAa,IAAI,IACrB,KAAK,KAAK,YACP,OAAO,oBAAoB,CAAC,CAC5B,KAAK,UACJ,OAAO,MAAM,SAAS,YAAY,MAAM,SAAS,OAC7C,QAAQ,IAAI,MAAM,MAAM,MAAM,IAC9B,KAAA,CACN,CACJ;EACA,IAAI,WAAW,SAAS,GAAG;EAC3B,KAAK,MAAM,WAAW,MAAM,UAAU;GAGpC,MAAM,QAAQ,cADZ,OAAO,YAAY,YAAY,YAAY,OAAO,QAAQ,IAAI,SAAS,MAAM,IAAI,KAAA,CACnD;GAChC,IAAI,UAAU,KAAA,KAAa,CAAC,WAAW,IAAI,KAAK,GAAG;GACnD,MAAM,UACJ,0BAA0B,MAAM,MAAM,wCAAwC,MAAM,4BAC1D,MAAM,MAAM,yEACZ,MAAM,8DACpB,MAAM;GAEpB,IAAI,cAAc,IAAI,OAAO,GAAG;GAChC,cAAc,IAAI,OAAO;GACzB,QAAQ,KAAK,OAAO;EACtB;CACF;;;;;CAMA,MAAM,MAAM,QAAgC;EAC1C,KAAK,MAAM,cAAc,KAAK,WAAW,OAAO,GAAG,WAAW,MAAM;EACpE,MAAM,QAAQ,WAAW,KAAK,WAAW,KAAK,CAAC;EAC/C,OAAO,KAAK,KAAK,MAAM,MAAM;CAC/B;AACF;;;ACncA,MAAM,2BAAW,IAAI,IAAY;;AAGjC,SAAS,yBAAyB,WAAsB,SAAuB;CAC7E,MAAM,OAAO,UAAU,eAAe;CACtC,IAAI,SAAS,UAAU;CACvB,IAAI,SAAS,SAAS,MAAM,IAAI,MAAM,OAAO;CAC7C,IAAI,SAAS,IAAI,OAAO,GAAG;CAC3B,SAAS,IAAI,OAAO;CACpB,QAAQ,KAAK,OAAO;AACtB;AAEA,SAAS,QAAQ,OAAmD;CAElE,OAAO,GADO,OAAO,MAAM,UAAU,aAAa,MAAM,MAAM,OAAO,OAAO,MAAM,KAAK,EACvE,GAAG,MAAM,KAAK;AAChC;;;;;AAMA,SAAS,iBACP,WACA,OACA,OACM;CACN,MAAM,aAAa,uBAAuB,WAAW,KAAK;CAC1D,IAAI,WAAW,WAAW,GAAG;CAQ7B,yBACE,WACA,UAAU,MAAM,YARhB,WAAW,SAAS,IAChB,GAAG,WAAW,MAAM,GAAG,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,OAAO,WAAW,GAAG,EAAE,MAC7D,WAAW,KAAK,EAAE,EAMY,6FALpB,WAAW,SAAS,YAAY,IAC5C,kDACA,GAIkD,uHAEtD;AACF;;;;;;;;;;;;;AAcA,SAAgB,oCACd,WACA,aACM;CACN,KAAK,MAAM,SAAS,YAAY,OAAO,iBAAiB,iBAAiB,GAAG;EAC1E,MAAM,OAAO,UAAU,MAAM,KAAK,WAAW,QAAQ,QAAQ,KAAK;EAClE,MAAM,YAAY,qBAAqB,MAAM,IAAI;EACjD,IAAI,WACF,yBACE,WACA,UAAU,KAAK,4BAA4B,UAAU,uLAGvD;EAEF,IAAI,MAAM,KAAK,YAAY,QACzB,yBACE,WACA,UAAU,KAAK,oNAGjB;EAEF,IAAI,MAAM,KAAK,aAAa,SAC1B,yBACE,WACA,UAAU,KAAK,yGAEjB;EAEF,iBAAiB,WAAW,MAAM,KAAK;CACzC;CACA,KAAK,MAAM,SAAS,YAAY,OAAO,qBAAqB,qBAAqB,GAC/E,yBACE,WACA,oBAAoB,MAAM,KAAK,GAAG,OAAO,QAAQ,KAAK,EAAE,6JAG1D;AAEJ;;;ACxEA,SAAS,YAAY,MAAe,UAA4B;CAC9D,MAAM,QACJ,OAAO,SAAS,YAAY,SAAS,OAAO,QAAQ,IAAI,MAAM,QAAQ,IAAI,KAAA;CAC5E,IAAI,OAAO,UAAU,UAAU,OAAO,CAAC,KAAK;CAC5C,IAAI,MAAM,QAAQ,KAAK,KAAK,MAAM,OAAO,SAAS,OAAO,SAAS,QAAQ,GAAG,OAAO;CACpF,MAAM,IAAI,UAAU,oCAAoC,SAAS,EAAE;AACrE;;;;;;AAOA,SAAS,6BAA6B,aAAmD;CACvF,MAAM,SAAS,IAAI,IACjB,YAAY,OAAO,iBAAiB,CAAC,CAAC,SAAS,UAAU,YAAY,MAAM,MAAM,WAAW,CAAC,CAC/F;CACA,KAAK,MAAM,SAAS,YAAY,OAAO,UAAU,GAAG;EAClD,MAAM,CAAC,SAAS,YAAY,MAAM,MAAM,WAAW;EACnD,IAAI,UAAU,KAAA,KAAa,OAAO,IAAI,KAAK,GACzC,MAAM,IAAI,MACR,2CAA2C,MAAM,qBAAqB,MAAM,kDAChC,MAAM,oCACpD;CAEJ;AACF;;;;;;;;AASA,SAAgB,kBAAkB,SAA2C;CAC3E,MAAM,EAAE,QAAQ;CAChB,OAAO;EACL,MAAM;EACN,mBAAmB,CACjB,OAAO,SAAS,SAAS;GACvB,4BAA4B,KAAK,QAAQ,GAAG;GAC5C,MAAM,KAAK;EACb,CACF;EACA,sBACG,EAAE,WACF,YACC,QAAQ,QAAQ,IAAI,MAAM,SAAS,GAAG,CAAC;EAC3C,cAAc,MAAM,YAAY,CAAC,CAAC,CAAC,OAAO,WAAW;EACrD,qBAAqB,cAAc;GACjC,8BAA8B,WAAW,GAAG;GAC5C,2BAA2B,SAAS;EACtC;EACA,aAAa,OAAO,EAAE,KAAK,gBAAgB;GACzC,6BAA6B,IAAI,WAAW;GAC5C,oCAAoC,WAAW,IAAI,WAAW;GAC9D,MAAM,oBAAoB,SAAS;EACrC;CACF;AACF;;;;;;;AAQA,eAAsB,oBACpB,YACA,SACgC;CAChC,MAAM,UAAU,MAAM,YAAY,OAAO,YAAY;EACnD,cAAc,QAAQ;EACtB,UAAU,QAAQ;EAClB,YAAY,QAAQ,aAAa,QAAQ,GAAG;EAC5C,UAAU,CAAC,kBAAkB,OAAO,GAAG,GAAI,QAAQ,YAAY,CAAC,CAAE;CACpE,CAAC;CACD,MAAM,MAAM,IAAI,sBAAsB,SAAS,QAAQ,GAAG;CAC1D,IAAI,cAAc,QAAQ,aAAa,CAAC;CACxC,wBAAwB,IAAI,WAAW,GAAG,IAAI,mBAAmB,GAAG,QAAQ,aAAa,CAAC;CAC1F,OAAO;AACT;;;;;;AAOA,SAAgB,uBACd,YACA,UAAmC,CAAC,GACpC;CACA,MAAM,+BAAe,IAAI,QAAiD;CAC1E,MAAM,eAAe,QAAiD;EACpE,MAAM,WAAW,aAAa,IAAI,GAAG;EACrC,IAAI,UAAU,OAAO;EACrB,MAAM,UAAU,oBAAoB,YAAY;GAAE,GAAG;GAAS;EAAI,CAAC;EACnE,aAAa,IAAI,KAAK,OAAO;EAC7B,QAAa,YAAY;GACvB,IAAI,aAAa,IAAI,GAAG,MAAM,SAAS,aAAa,OAAO,GAAG;EAChE,CAAC;EACD,OAAO;CACT;CACA,OAAO;EACL,MAAM,MAAM,SAAkB,KAAc,KAA0C;GACpF,QAAQ,MAAM,YAAY,GAAG,EAAA,CAAG,MAAM,SAAS,KAAK,GAAG;EACzD;EACA,MAAM,UACJ,OACA,KACA,KACe;GACf,QAAQ,MAAM,YAAY,GAAG,EAAA,CAAG,UAAU,OAAO,KAAK,GAAG;EAC3D;EACA,MAAM,MACJ,OACA,KACA,KACe;GACf,QAAQ,MAAM,YAAY,GAAG,EAAA,CAAG,MAAM,OAAO,KAAK,GAAG;EACvD;CACF;AACF;;;ACxJA,MAAa,kBAAkB,IAAI,eAAqC,iBAAiB;;;;ACFzF,MAAa,wBAAwB;AAErC,MAAM,eAAe;AACrB,MAAM,sBAA8C;CAClD,MAAM;CACN,MAAM;CACN,OAAO;CACP,KAAK;CACL,MAAM;AACR;;AAGA,SAAgB,sBAAsB,KAAqB;CACzD,MAAM,QAAQ,IAAI,YAAY,CAAC,CAAC,OAAO,GAAG;CAC1C,IAAI,MAAM,eAAe,KAAK,MAAM,aAAA,MAClC,MAAM,IAAI,MAAM,yBAAyB,sBAAsB,aAAa;CAE9E,IAAI,SAAS;CACb,KAAK,MAAM,QAAQ,OAAO,UAAU,OAAO,aAAa,IAAI;CAC5D,OAAO,KAAK,MAAM,CAAC,CAAC,QAAQ,OAAO,GAAG,CAAC,CAAC,QAAQ,OAAO,GAAG,CAAC,CAAC,QAAQ,OAAO,EAAE;AAC/E;;AAGA,SAAgB,sBAAsB,OAAmC;CACvE,IAAI;EACF,IACE,MAAM,WAAW,KACjB,MAAM,SAAS,KAAK,KAAA,OAAmC,CAAC,KACxD,CAAC,aAAa,KAAK,KAAK,KACxB,MAAM,SAAS,MAAM,GAErB;EAEF,MAAM,SAAS,MAAM,QAAQ,MAAM,GAAG,CAAC,CAAC,QAAQ,MAAM,GAAG;EACzD,MAAM,SAAS,SAAS,IAAI,QAAQ,IAAK,OAAO,SAAS,KAAM,CAAC;EAChE,MAAM,SAAS,KAAK,MAAM;EAC1B,MAAM,QAAQ,IAAI,WAAW,IAAI,YAAY,OAAO,MAAM,CAAC;EAC3D,KAAK,IAAI,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK,MAAM,KAAK,OAAO,WAAW,CAAC;EACtE,IAAI,MAAM,eAAe,KAAK,MAAM,aAAA,MAAoC,OAAO,KAAA;EAC/E,MAAM,UAAU,IAAI,YAAY,SAAS;GAAE,OAAO;GAAM,WAAW;EAAM,CAAC,CAAC,CAAC,OAAO,KAAK;EACxF,OAAO,sBAAsB,OAAO,MAAM,QAAQ,UAAU,KAAA;CAC9D,QAAQ;EACN;CACF;AACF;AAEA,SAAS,aAAa,SAA0B;CAC9C,IAAI,UAAU;CACd,KAAK,IAAI,IAAI,GAAG,IAAI,GAAG,KAAK;EAC1B,IAAI,YAAY,MAAM,YAAY,OAAO,YAAY,MAAM,OAAO;EAClE,IAAI;GACF,MAAM,OAAO,mBAAmB,OAAO;GACvC,IAAI,SAAS,SAAS;GACtB,UAAU;EACZ,QAAQ;GACN;EACF;CACF;CACA,OAAO,YAAY,MAAM,YAAY,OAAO,YAAY;AAC1D;AAEA,SAAS,mBAAmB,SAAyB;CACnD,IAAI,UAAU;CACd,IAAI,SAAS;CACb,KAAK,MAAM,SAAS,QAAQ,SAAS,iCAAiC,GAAG;EACvE,WAAW,QAAQ,MAAM,QAAQ,MAAM,KAAK,CAAC,CAAC,QAAQ,uBAAuB,MAAM;EACnF,WAAW,oBAAoB,MAAM;EACrC,SAAS,MAAM,QAAS,MAAM,EAAE,CAAC;CACnC;CACA,WAAW,QAAQ,MAAM,MAAM,CAAC,CAAC,QAAQ,uBAAuB,MAAM;CACtE,OAAO;AACT;;AAGA,SAAgB,uBAAuB,KAAa,MAAmC;CACrF,MAAM,YAAY,QAAQ,GAAA,CAAI,MAAM,QAAQ,CAAC,CAAC,QAAQ,YAAY,CAAC,aAAa,OAAO,CAAC;CACxF,IAAI,SAAS,WAAW,GAAG,OAAO,IAAI,SAAS;CAC/C,MAAM,cAAc,SAAS,IAAI,kBAAkB,CAAC,CAAC,KAAK,GAAG;CAC7D,OAAO,IAAI,OAAO,OAAO,YAAY,SAAS,CAAC,CAAC,KAAK,GAAG;AAC1D;;;;AClEA,MAAa,qBAAqB;;AAUlC,IAAa,kBAAb,MAAsD;CACvB;CAA7B,YAAY,QAAgD;EAA/B,KAAA,SAAA;CAAgC;CAE7D,MAAM,OAAO,MAAmB,MAAc,SAA+C;EAC3F,MAAM,KAAK,OAAO,OAAO,IACvB,MACA,MACA;GACE,cAAc,QAAQ,WAAW,EAAE,aAAa,QAAQ,SAAS,IAAI,KAAA;GACrE,gBAAgB,QAAQ;EAC1B,CACF;EACA,OAAO;GACL;GACA,MAAM,KAAK,OAAO;GAClB,MAAM,QAAQ;GACd,UAAU,QAAQ,YAAY;GAC9B,4BAAY,IAAI,KAAK;EACvB;CACF;CAEA,MAAM,SAAS,MAAuC;EACpD,MAAM,MAAM,MAAM,KAAK,OAAO,OAAO,IAAI,IAAI;EAC7C,IAAI,CAAC,KAAK,MAAM,IAAI,MAAM,gCAAgC,KAAK,GAAG;EAClE,OAAO;GACL,gBAAgB,IAAI;GACpB,qBAAqB,IAAI,YAAY;GACrC,cAAc,IAAI,KAAK;GACvB,aAAa,IAAI,cAAc,eAAe;GAC9C,MAAM,IAAI;GACV,UAAU,IAAI;EAChB;CACF;CAEA,MAAM,OAAO,MAA6B;EACxC,MAAM,KAAK,OAAO,OAAO,OAAO,IAAI;CACtC;CAEA,MAAM,OAAO,MAAgC;EAC3C,OAAQ,MAAM,KAAK,OAAO,OAAO,KAAK,IAAI,MAAO;CACnD;CAEA,MAAM,gBACJ,MACA,QACA,WAC6B;EAC7B,IAAI,CAAC,KAAK,OAAO,QACf,MAAM,IAAI,MAAM,mEAAmE;EAIrF,IAAI,CAAC,OAAO,cAAc,SAAS,KAAK,aAAa,GACnD,MAAM,IAAI,MACR,iCAAiC,UAAU,qCAC7C;EAKF,MAAM,QAAQ,sBAAsB,IAAI;EACxC,MAAM,YAAY,GAAG,mBAAmB,GAAG,mBAAmB,KAAK,OAAO,IAAI;EAC9E,MAAM,QAAQ,IAAI,gBAAgB;GAAE,KAAK;GAAO;EAAO,CAAC;EAMxD,OAAO;GAAE,KAAA,MALS,QAAQ,GAAG,UAAU,GAAG,SAAS,KAAK,OAAO,QAAQ;IACrE;IACA;IACA,SAAS;GACX,CAAC;GACa;GAAQ;GAAW,WAAW,IAAI,KAAK,KAAK,IAAI,IAAI,YAAY,GAAI;EAAE;CACtF;AACF;;;;;;;;;;;;;;;ACxFO,IAAM,wBAAN,MAAM,sBAAsB;CACqB;CAAtD,YAAY,SAAyE;EAA/B,KAAA,UAAA;CAAgC;CAEtF,QAAQ,MAAuB;EAC7B,OAAO,KAAK,QAAQ,MAAM,MAAM,MAAM,EAAE,SAAS,IAAI;CACvD;CAEA,cAAc,MAA0B;EACtC,MAAM,SAAS,KAAK,QAAQ,MAAM,MAAM,MAAM,EAAE,SAAS,IAAI;EAC7D,IAAI,CAAC,QAAQ,MAAM,IAAI,MAAM,iBAAiB,KAAK,qBAAqB;EACxE,OAAO;CACT;CAEA,UAAU,MAA+B;EAEvC,OAAO,IAAI,gBAAgB;GAAE;GAAM,QADpB,KAAK,cAAc,IACS,CAAA,CAAO;GAAQ,QAAQ,KAAK,QAAQ;EAAO,CAAC;CACzF;AACF;;CAlBC,WAAW;CAEG,gBAAA,GAAA,OAAO,eAAe,CAAA;;;;;ACU9B,IAAM,oBAAN,MAAM,kBAAkB;CAEqB;CACN;CAF5C,YACE,SACA,SACA;EAFgD,KAAA,UAAA;EACN,KAAA,UAAA;CACzC;CAEH,MACM,SAAS,GAAsC;EACnD,MAAM,SAAS,KAAK,QAAQ;EAC5B,IAAI,CAAC,QAAQ,OAAO,IAAI,SAAS,qCAAqC,EAAE,QAAQ,IAAI,CAAC;EAIrF,IACE,CAAE,MAAM,gBAAgB,EAAE,IAAI,KAAK,QAAQ;GACzC,QAAQ,EAAE,IAAI;GACd,SAAS;EACX,CAAC,GAED,OAAO,IAAI,SAAS,0BAA0B,EAAE,QAAQ,IAAI,CAAC;EAO/D,MAAM,MAAM,IAAI,IAAI,EAAE,IAAI,GAAG;EAC7B,IAAI,IAAI,aAAa,IAAI,QAAQ,MAAM,OACrC,OAAO,IAAI,SAAS,+BAA+B,EAAE,QAAQ,IAAI,CAAC;EAGpE,MAAM,OAAO,EAAE,IAAI,MAAM,MAAM;EAC/B,IAAI,CAAC,QAAQ,CAAC,KAAK,QAAQ,QAAQ,IAAI,GAAG,OAAO,IAAI,SAAS,gBAAgB,EAAE,QAAQ,IAAI,CAAC;EAE7F,MAAM,QAAQ,IAAI,aAAa,IAAI,KAAK;EACxC,MAAM,UAAU,QAAQ,sBAAsB,KAAK,IAAI,KAAA;EACvD,IAAI,CAAC,SAAS,OAAO,IAAI,SAAS,+BAA+B,EAAE,QAAQ,IAAI,CAAC;EAIhF,MAAM,WAAW,gBAAgB,KAAA,GAAW,OAAO;EACnD,IAAI,aAAa,SAAS,OAAO,IAAI,SAAS,uBAAuB,EAAE,QAAQ,IAAI,CAAC;EAEpF,IAAI,CAAC,uBAAuB,UAAU,KAAK,QAAQ,cAAc,IAAI,CAAC,CAAC,IAAI,GACzE,OAAO,IAAI,SAAS,8CAA8C,EAAE,QAAQ,IAAI,CAAC;EAGnF,IAAI;GACF,MAAM,SAAS,MAAM,KAAK,QAAQ,UAAU,IAAI,CAAC,CAAC,SAAS,QAAQ;GACnE,MAAM,WAAW,SAAS,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK;GAC/C,OAAO,IAAI,SAAS,OAAO,SAAS,GAAG,EACrC,SAAS;IACP,gBAAgB,OAAO,eAAe;IAItC,uBAAuB,gCAAgC,mBAAmB,QAAQ;IAClF,0BAA0B;GAC5B,EACF,CAAC;EACH,QAAQ;GACN,OAAO,IAAI,SAAS,aAAa,EAAE,QAAQ,IAAI,CAAC;EAClD;CACF;AACF;;CA1DG,IAAI,QAAQ;CACG,gBAAA,GAAA,IAAI,CAAA;;;;;;CARrB,WAAW,SAAS;CAGhB,gBAAA,GAAA,OAAO,qBAAqB,CAAA;CAC5B,gBAAA,GAAA,OAAO,eAAe,CAAA;;;;;ACN3B,MAAM,kBAAkB;CAAE,eAAe;CAAM,WAAW;AAAM;AAOzD,IAAM,iBAAN,MAAM,eAAe;CAEkB;CACM;CAFlD,YACE,SACA,SACA;EAF0C,KAAA,UAAA;EACM,KAAA,UAAA;CAC/C;CAEH,IACE,cACA,MACA,UAAyB,CAAC,GAC1B,MACuB;EACvB,MAAM,OAAO,KAAK,YAAY,IAAI;EAClC,OAAO,KAAK,QAAQ,UAAU,IAAI,CAAC,CAAC,OAAO,MAAM,KAAK,SAAS,cAAc,IAAI,GAAG,OAAO;CAC7F;CAEA,IAAI,cAAsB,MAAwC;EAChE,MAAM,OAAO,KAAK,YAAY,IAAI;EAClC,OAAO,KAAK,QAAQ,UAAU,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,cAAc,IAAI,CAAC;CAChF;CAEA,OAAO,cAAsB,MAA8B;EACzD,MAAM,OAAO,KAAK,YAAY,IAAI;EAClC,OAAO,KAAK,QAAQ,UAAU,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,cAAc,IAAI,CAAC;CAC9E;CAEA,OAAO,cAAsB,MAAiC;EAC5D,MAAM,OAAO,KAAK,YAAY,IAAI;EAClC,OAAO,KAAK,QAAQ,UAAU,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,cAAc,IAAI,CAAC;CAC9E;CAEA,IACE,cACA,SAAwB,OACxB,WACA,MAC6B;EAC7B,MAAM,OAAO,KAAK,YAAY,IAAI;EAClC,OAAO,KAAK,QACT,UAAU,IAAI,CAAC,CACf,gBAAgB,KAAK,SAAS,cAAc,IAAI,GAAG,QAAQ,KAAK,eAAe,SAAS,CAAC;CAC9F;CAEA,YAAoB,MAAuB;EACzC,MAAM,OAAO,QAAQ,KAAK,QAAQ;EAClC,IAAI,CAAC,KAAK,QAAQ,QAAQ,IAAI,GAAG,MAAM,IAAI,MAAM,iBAAiB,KAAK,qBAAqB;EAC5F,OAAO;CACT;CAEA,SAAiB,cAAsB,MAAsB;EAC3D,OAAO,gBAAgB,KAAK,QAAQ,cAAc,IAAI,CAAC,CAAC,MAAM,YAAY;CAC5E;CAEA,eAAuB,WAA4B;EACjD,MAAM,MAAM,KAAK,QAAQ,gBAAgB;EACzC,MAAM,QAAQ,aAAa,IAAI;EAI/B,IAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,KAAK,QAAQ,IAAI,WAC3D,MAAM,IAAI,MAAM,wBAAwB,MAAM,uBAAuB,IAAI,UAAU,IAAI;EAEzF,OAAO;CACT;AACF;;CAjEC,WAAW;CAGP,gBAAA,GAAA,OAAO,eAAe,CAAA;CACtB,gBAAA,GAAA,OAAO,qBAAqB,CAAA;;;;;ACjBjC,MAAM,EAAE,4BAA4B,IAAI,0BAAgD;CACtF,YAAY;CACZ,uBAAuB;AACzB,CAAC,CAAC,CAAC,MAAM;AAOF,IAAM,gBAAN,MAAM,sBAAsB,wBAAwB,CAAC;AAL3D,gBAAA,WAAA,CAAA,OAAO;CACN,WAAW,CAAC,uBAAuB,cAAc;CACjD,aAAa,CAAC,iBAAiB;CAC/B,SAAS;EAAC;EAAgB;EAAuB;CAAe;AAClE,CAAC,CAAA,GAAA,aAAA;;;;;;;;ACHD,IAAa,eAAb,MAAyF;CAC1D;CAA7B,YAAY,IAAkC;EAAjB,KAAA,KAAA;CAAkB;CAE/C,MAAM,IAAI,KAA+B;EACvC,QAAQ,MAAM,KAAK,SAAS,GAAG,EAAA,EAAI;CACrC;CAEA,MAAM,SAAS,KAA0E;EACvF,MAAM,EAAE,OAAO,aAAa,MAAM,KAAK,GAAG,gBAAkC,KAAK,MAAM;EACvF,IAAI,UAAU,MAAM,OAAO,KAAA;EAC3B,IAAI,OAAO,aAAa,YAAY,aAAa,QAAQ,wBAAwB,UAAU;GACzF,MAAM,YAAY,SAAS;GAC3B,IAAI,OAAO,cAAc,YAAY,CAAC,OAAO,SAAS,SAAS,KAAK,aAAa,KAAK,IAAI,GACxF,OAAO,KAAA;GACT,OAAO;IAAE;IAAO;GAAU;EAC5B;EACA,OAAO,EAAE,MAAM;CACjB;CAEA,MAAM,IAAI,KAAa,OAAgB,KAA6B;EAClE,IAAI,QAAQ,KAAA,MAAc,CAAC,OAAO,SAAS,GAAG,KAAK,MAAM,IACvD,MAAM,IAAI,UAAU,2CAA2C;EACjE,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAK,SAAS,KAAK;GAAE;GAAO,WAAW,KAAK,IAAI,IAAI,MAAM;EAAK,CAAC;EAC9F,MAAM,KAAK,GAAG,IAAI,KAAK,KAAK,UAAU,KAAK,CAAC;CAC9C;CAEA,MAAM,SAAS,KAAa,OAAkC;EAC5D,IAAI,CAAC,OAAO,SAAS,MAAM,SAAS,GAAG,MAAM,IAAI,UAAU,8BAA8B;EACzF,MAAM,aAAa,MAAM,YAAY,KAAK,IAAI,KAAK;EACnD,IAAI,aAAa,GAAG,OAAO,KAAK,IAAI,GAAG;EACvC,MAAM,KAAK,GAAG,IAAI,KAAK,KAAK,UAAU,MAAM,KAAK,GAAG;GAClD,eAAe,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,CAAC;GAChD,UAAU,EAAE,oBAAoB,MAAM,UAAU;EAClD,CAAC;CACH;CAEA,MAAM,IAAI,KAA4B;EACpC,MAAM,KAAK,GAAG,OAAO,GAAG;CAC1B;;CAGA,MAAM,QAAuB;EAC3B,IAAI;EACJ,GAAG;GACD,MAAM,OAAO,MAAM,KAAK,GAAG,KAAK,SAAS,EAAE,OAAO,IAAI,KAAA,CAAS;GAC/D,MAAM,QAAQ,IAAI,KAAK,KAAK,KAAK,UAAU,KAAK,GAAG,OAAO,MAAM,IAAI,CAAC,CAAC;GACtE,SAAS,KAAK,gBAAgB,KAAA,IAAY,KAAK;EACjD,SAAS;CACX;AACF;;;;;;;AAQA,IAAa,2BAAb,MAAwE;CACzC;CAA7B,YAAY,IAAkC;EAAjB,KAAA,KAAA;CAAkB;CAC/C,MAAM,WAAW,KAA8B;EAC7C,MAAM,QAAiB,MAAM,KAAK,GAAG,IAAI,KAAK,MAAM;EACpD,IAAI,UAAU,MAAM,OAAO;EAC3B,IAAI,OAAO,UAAU,YAAY,MAAM,WAAW,KAAK,MAAM,SAAS,MACpE,MAAM,IAAI,UAAU,2BAA2B;EACjD,OAAO;CACT;CACA,MAAM,WAAW,KAA4B;EAC3C,MAAM,KAAK,GAAG,IAAI,KAAK,KAAK,UAAU,OAAO,WAAW,CAAC,CAAC;CAC5D;AACF;;;;;;;;;;;;;;;;;;;;;;;;;;ACrCA,IAAa,qBAAb,MAA6D;CAC3D;CACA;CAEA,YACE,SACA,UAAqC,CAAC,GACtC;EACA,KAAK,UAAU,OAAO,YAAY,aAAa,gBAAgB;EAC/D,KAAK,OAAO,QAAQ,QAAQ;CAC9B;CAEA,WAAW,KAAa,UAAmB,KAAqC;EAC9E,OAAO,KAAK,QAAQ,CAAC,CAAC,gBAAgB,KAAK,UAAU,GAAG;CAC1D;CAEA,UAAU,KAAa,UAAkB,KAAoC;EAC3E,OAAO,KAAK,QAAQ,CAAC,CAAC,eAAe,KAAK,UAAU,GAAG;CACzD;CAEA,UAAU,KAAa,UAAkB,KAAoC;EAC3E,OAAO,KAAK,QAAQ,CAAC,CAAC,eAAe,KAAK,UAAU,GAAG;CACzD;CAEA,UAAU,KAAa,UAAkB,KAAqC;EAC5E,OAAO,KAAK,QAAQ,CAAC,CAAC,eAAe,KAAK,UAAU,GAAG;CACzD;AACF;;AAGA,SAAgB,mBACd,SACA,SACoB;CACpB,OAAO,IAAI,mBAAmB,SAAS,OAAO;AAChD;;;;;;;;;;;;;;;;;;;;;;;;AClDA,IAAa,eAAb,MAAuD;CAKlC;CAJnB;CACA;CAEA,YACE,IACA,UAA+B,CAAC,GAChC;EAFiB,KAAA,KAAA;EAGjB,KAAK,OAAO,QAAQ,QAAQ;EAC5B,KAAK,SAAS,QAAQ,UAAU;CAClC;CAEA,WAAW,KAAa,UAAmB,MAAsC;EAC/E,OAAO,KAAK,KAAK,KAAK,WAAW,MAAM,OAAO,MAAM,SAAS;CAC/D;CAEA,UAAU,KAAa,UAAkB,MAAqC;EAC5E,OAAO,KAAK,KAAK,KAAK,WAAW,MAAM,OAAO,MAAM,QAAQ;CAC9D;CAEA,UAAU,KAAa,UAAkB,MAAqC;EAC5E,OAAO,KAAK,KAAK,KAAK,WAAW,MAAM,OAAO,MAAM,QAAQ;CAC9D;CAEA,UAAU,KAAa,UAAkB,MAAsC;EAC7E,OAAO,KAAK,KAAK,KAAK,WAAW,MAAM,OAAO,MAAM,YAAY,MAAM,IAAI;CAC5E;;;;;;CAOA,MAAc,KACZ,KACA,UACA,SACY;EACZ,MAAM,QAAQ,MAAM,KAAK,GAAG,IAAI,KAAK,SAAS,KAAK,MAAM;EACzD,IAAI,UAAU,QAAQ,UAAU,KAAA,GAAW,OAAO;EAClD,OAAO,QAAQ,KAAK,IAAI,QAAQ;CAClC;AACF;;AAGA,SAAgB,aAAa,IAAiB,SAA6C;CACzF,OAAO,IAAI,aAAa,IAAI,OAAO;AACrC;;;AC3EA,MAAM,8BAA8B;AAKpC,uBAAuB;CAAE,MAAM;CAAY,SAAS;CAA6B,OAAO;AAAS,CAAC;;;;;;;;;;;;;;;;;;AAwBlG,SAAgB,cAAc,WAAoC;CAChE,QAAQ,QAAgB,aAA8B,gBAAoC;EACxF,MAAM,WACH,YAAY,6BAA6B,OAAO,WAAW,KAC5D,CAAC;EACH,SAAS,KAAK;GAAE;GAAW,YAAY,OAAO,WAAW;EAAE,CAAC;EAC5D,eAAe,6BAA6B,UAAU,OAAO,WAAW;CAC1E;AACF;;;;;;;;;;AC5BA,IAAa,4BAAb,MAAa,0BAA0B;CACrC,OAAO,UAAyB;EAC9B,MAAM,YAAY,CAAC,eAAe,WAAW,EAAE,UAAU,eAAe,CAAC,GAAG,YAAY;EAExF,OAAO;GACL,QAAQ;GACR;GACA,SAAS,CAAC,WAAW,YAAY;EACnC;CACF;AACF;;;;;;;;;;;;;;;ACQA,eAAsB,gBACpB,IACA,aACA,MACA,OACA,MACA,SACe;CACf,MAAM,MAAwB;EAC5B,OAAO,CAAC,IAAI;EACZ,WAAW,SAAS;EACpB,OAAO,KAAK,UAAU;GAAE;GAAO;EAAK,CAAC;CACvC;CACA,MAAM,gBAAgB,qBAAqB,EACzC,eAAe,SAAS,iBAAiB,2BAC3C,CAAC;CACD,2BAA2B,KAAK,aAAa;CAE7C,MADa,GAAG,IAAI,gBAAgB,IAAI,aAAa,IAAI,CAChD,CAAC,CAAC,UAAU,GAAG;AAC1B;;;;;;;;;AC1BA,SAAgB,yBACd,SACA,SACgB;CAChB,IAAI,CAAC,WAAY,OAAO,YAAY,cAAc,OAAO,QAAQ,UAAU,YACzE,MAAM,IAAI,UAAU,gDAAgD;CAEtE,IACE,CAAC,OAAO,cAAc,QAAQ,KAAK,KACnC,QAAQ,SAAS,KACjB,QAAQ,SAAS,OAAO,kBAExB,MAAM,IAAI,WAAW,4CAA4C;CAEnE,IAAI,QAAQ,kBAAkB,MAAM,QAAQ,kBAAkB,IAC5D,MAAM,IAAI,WAAW,wDAAwD;CAG/E,MAAM,cAAc,QAAQ,eAAe;CAC3C,IAAI,CAAC,OAAO,cAAc,WAAW,KAAK,eAAe,KAAK,cAAc,MAC1E,MAAM,IAAI,WAAW,wCAAwC;CAG/D,MAAM,QAAQ,QAAQ,gBAAgB;CACtC,MAAM,UAAU,IAAI,YAAY;CAChC,MAAM,iBACJ,OAAO,YAAY,aAAa,gBAA4C;CAE9E,OAAO;EACL,MAAM,UAAU,KAAa,gBAAyD;GACpF,IAAI,mBAAmB,OACrB,MAAM,IAAI,MACR,gDAAgD,MAAM,eAAe,eAAe,GACtF;GAEF,IACE,OAAO,QAAQ,YACf,IAAI,WAAW,KACf,wBAAwB,KAAK,GAAG,KAChC,QAAQ,OAAO,GAAG,CAAC,CAAC,aAAa,aAEjC,MAAM,IAAI,MAAM,iDAAiD;GAGnE,MAAM,iBAAiB,eAAe;GACtC,IAAI,CAAC,kBAAkB,OAAO,eAAe,UAAU,YACrD,MAAM,IAAI,MAAM,iDAAiD;GAEnE,MAAM,WAAW,MAAM,eAAe,MAAM,EAAE,IAAI,CAAC;GACnD,IAAI,CAAC,YAAY,OAAO,SAAS,YAAY,WAC3C,MAAM,IAAI,MAAM,4DAA4D;GAG9E,OAAO;IAGL,OAAO,SAAS,UAAU,IAAI,QAAQ,QAAQ;IAC9C;IACA,SAAS,SAAS;IAClB,eAAe,QAAQ;GACzB;EACF;EAEA,QAAe;GACb,MAAM,IAAI,MAAM,gEAAgE;EAClF;CACF;AACF;;;ACrFA,MAAM,uBAAuB;AAC7B,MAAM,0BAA0B;;;;;;;;;AA4BhC,SAAgB,wBAAwB,SAAqD;CAC3F,IAAI,CAAC,WAAW,OAAO,YAAY,UACjC,MAAM,IAAI,UAAU,iDAAiD;CAEvE,IAAI,CAAC,uBAAuB,QAAQ,cAAc,uBAAuB,GACvE,MAAM,IAAI,UACR,0DAA0D,wBAAwB,aACpF;CAEF,IAAI,OAAO,QAAQ,YAAY,YAC7B,MAAM,IAAI,UAAU,8DAA8D;CAGpF,MAAM,aAAa,GAAG,uBAAuB,QAAQ;CAErD,OAAO,EACL,MAAM,MAAM,OAAe,iBAA2C;EACpE,MAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAK;EACzC,IAAI,CAAC,uBAAuB,OAAA,GAAsB,KAAK,CAAC,cAAc,iBAAiB,GAAG,GACxF,OAAO;EAGT,IAAI;GACF,MAAM,YAAY,MAAM,QAAQ,QAAQ;GAExC,MAAM,KAAK,UAAU,WAAW,UAAU;GAG1C,OAAO,MAFM,UAAU,IAAI,EACH,CAAC,CAAC,MAAM,OAAO,eAAe,MACpC;EACpB,QAAQ;GACN,OAAO;EACT;CACF,EACF;AACF"}