@velajs/cloudflare 1.28.0 → 1.30.0

package/dist/durable-objects.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"durable-objects.js","names":[],"sources":["../src/websocket/cf-room-registry.ts","../src/websocket/do-websocket-host.ts","../src/websocket/do-bootstrap.ts","../src/websocket/websocket.durable-object.ts","../src/nonce/nonce.durable-object.ts"],"sourcesContent":["import { WebSocketSendGate, type WebSocketSendPolicy } from '@velajs/vela/websocket';\nimport { socketAttachment, rejectedAttachment } from './ws-attachment';\nimport type { BroadcastCommand, RoomRegistry, WsClient } from '@velajs/vela/websocket';\nimport type { DoStateLike, WsAttachment, WsLike } from './do-state';\nimport { CfWsClient } from './cf-ws-client';\n\n/**\n * Core `RoomRegistry` backed by a Durable Object's hibernatable sockets. Room\n * membership lives in tags (hub room, set at accept) + the attachment (dynamic\n * `join()`), never in DO instance fields — so it survives hibernation with zero\n * rehydration.\n */\nexport class CfRoomRegistry implements RoomRegistry {\n  readonly #sendGates = new WeakMap<WsLike, WebSocketSendGate>();\n  #sendPolicyForPath?: (path: string) => WebSocketSendPolicy | undefined;\n\n  setSendPolicyResolver(resolve: (path: string) => WebSocketSendPolicy | undefined): void {\n    this.#sendPolicyForPath = resolve;\n  }\n\n  private deliveryAuthorizer?: (client: WsClient) => boolean | Promise<boolean>;\n  private frameLimitForPath?: (path: string) => number | undefined;\n\n  constructor(private readonly ctx: DoStateLike) {}\n\n  setDeliveryAuthorizer(authorizer: (client: WsClient) => boolean | Promise<boolean>): void {\n    this.deliveryAuthorizer = authorizer;\n  }\n\n  /** Reconcile pre-migration/woken attachments with authoritative gateway metadata. */\n  setFrameLimitResolver(resolver: (path: string) => number | undefined): void {\n    this.frameLimitForPath = resolver;\n  }\n\n  // CF sockets are registered with the DO by `acceptWebSocket`; nothing to track.\n  register(_client: WsClient): void {}\n  leaveAll(_client: WsClient): void {}\n\n  join(client: WsClient, room: string): void | Promise<void> {\n    return client.join(room);\n  }\n\n  leave(client: WsClient, room: string): void | Promise<void> {\n    return client.leave(room);\n  }\n\n  localIdsInRoom(room: string): string[] {\n    return this.socketsForRoom(room).map((ws) => this.attachmentOf(ws).connId);\n  }\n\n  deliverLocal(cmd: BroadcastCommand): void | Promise<void> {\n    const excludeIds = new Set(cmd.exceptIds ?? []);\n    const excludeRooms = cmd.exceptRooms ?? [];\n\n    // Empty `rooms` => GLOBAL (every socket in this DO). Otherwise the union of\n    // targeted rooms, deduped per connection.\n    const targets =\n      cmd.rooms.length === 0 ? this.ctx.getWebSockets() : this.collectRooms(cmd.rooms);\n\n    const seen = new Set<string>();\n    const selected: Array<{ ws: WsLike; client: WsClient }> = [];\n    for (const ws of targets) {\n      const att = this.reconcileFrameLimit(ws, this.attachmentOf(ws));\n      if (\n        att.state !== 'active' ||\n        (att.expiresAtMs !== undefined &&\n          (!Number.isSafeInteger(att.expiresAtMs) || att.expiresAtMs <= Date.now()))\n      ) {\n        try {\n          att.state = 'rejected';\n          ws.serializeAttachment(att);\n          ws.close(1008, 'identity expired or connection rejected');\n        } catch {\n          // already closed or malformed attachment\n        }\n        continue;\n      }\n      if (seen.has(att.connId)) continue;\n      seen.add(att.connId);\n      if (excludeIds.has(att.connId)) continue;\n      if (excludeRooms.some((r) => att.rooms.includes(r))) continue;\n      selected.push({ ws, client: this.clientFor(ws) });\n    }\n\n    if (!this.deliveryAuthorizer) {\n      for (const { client } of selected) client.sendRaw(cmd.frame);\n      return;\n    }\n    return Promise.all(\n      selected.map(async ({ ws, client }) => {\n        let allowed = false;\n        try {\n          allowed = (await this.deliveryAuthorizer!(client)) === true;\n        } catch {\n          allowed = false;\n        }\n        if (allowed) client.sendRaw(cmd.frame);\n        else this.reject(ws, 'delivery authorization revoked');\n      }),\n    ).then(() => undefined);\n  }\n\n  private collectRooms(rooms: string[]): WsLike[] {\n    const set = new Set<WsLike>();\n    for (const room of rooms) for (const ws of this.socketsForRoom(room)) set.add(ws);\n    return [...set];\n  }\n\n  private socketsForRoom(room: string): WsLike[] {\n    // Membership is the attachment's `rooms`, NOT the hibernation tag: tags are\n    // immutable after acceptWebSocket, so a socket that left its hub room still\n    // carries the tag. Since one DO ≈ one room, scanning all sockets in the DO\n    // and filtering by attachment is both correct and cheap.\n    return this.ctx.getWebSockets().filter((ws) => this.attachmentOf(ws).rooms.includes(room));\n  }\n\n  private attachmentOf(ws: WsLike): WsAttachment {\n    return socketAttachment(ws) ?? rejectedAttachment();\n  }\n\n  /** Reconstruct a `WsClient` for a raw socket (e.g. inside gateway lifecycle scans). */\n  clientFor(ws: WsLike): CfWsClient {\n    this.reconcileFrameLimit(ws, this.attachmentOf(ws));\n    let gate = this.#sendGates.get(ws);\n    if (!gate) {\n      gate = new WebSocketSendGate(this.#sendPolicyForPath?.(this.attachmentOf(ws).path));\n      this.#sendGates.set(ws, gate);\n    }\n    return new CfWsClient(this.ctx, ws, gate);\n  }\n\n  private reconcileFrameLimit(ws: WsLike, attachment: WsAttachment): WsAttachment {\n    const expected = this.frameLimitForPath?.(attachment.path);\n    if (expected !== undefined && attachment.maxFrameBytes !== expected) {\n      attachment.maxFrameBytes = expected;\n      ws.serializeAttachment(attachment);\n    }\n    return attachment;\n  }\n\n  private reject(ws: WsLike, reason: string): void {\n    try {\n      const attachment = this.attachmentOf(ws);\n      attachment.state = 'rejected';\n      ws.serializeAttachment(attachment);\n      ws.close(1008, reason);\n    } catch {\n      // already closed or malformed attachment\n    }\n  }\n}\n","import { socketAttachment } from './ws-attachment';\nimport { WsMessageQueue, assertBroadcastCommandFits } from '@velajs/vela/websocket';\nimport type { BroadcastCommand, WsDispatcher } from '@velajs/vela/websocket';\nimport type { CfRoomRegistry } from './cf-room-registry';\nimport {\n  MAX_WS_ATTACHMENT_BYTES,\n  type DoStateLike,\n  type WsAttachment,\n  type WsLike,\n} from './do-state';\nimport { connTag, roomTag } from './room-id';\n\nexport interface WsConnectionPrincipal {\n  issuer: string;\n  subject: string;\n  principalType: 'user' | 'service';\n  tenantId: string;\n}\n\n/**\n * The socket lifecycle inside a WebSocket Durable Object, decoupled from the\n * `cloudflare:workers` base class so it is unit-testable with fakes. The thin\n * `VelaWebSocketDurableObject` shell forwards its hibernation callbacks here.\n */\nexport class DoWebSocketHost {\n  readonly #messages = new WeakMap<WsLike, WsMessageQueue>();\n  constructor(\n    private readonly ctx: DoStateLike,\n    private readonly dispatcher: WsDispatcher,\n    private readonly registry: CfRoomRegistry,\n    private readonly gatewayPaths: readonly string[] = [],\n  ) {}\n\n  /** The single registered gateway's path — a fallback when the Worker didn't forward `x-vela-path`. */\n  defaultPath(): string | undefined {\n    return this.gatewayPaths[0];\n  }\n\n  /**\n   * Accept a hibernatable socket: tag it with its hub room + connection id,\n   * persist the attachment, then await `OnGatewayConnection` before the caller\n   * returns 101. A rejected lifecycle hook closes and fails the upgrade.\n   */\n  async accept(\n    ws: WsLike,\n    path: string,\n    roomId: string,\n    userId?: string,\n    expiresAtMs?: number,\n    principal?: WsConnectionPrincipal,\n  ): Promise<boolean> {\n    const maxFrameBytes = this.dispatcher.getGatewayMaxFrameBytes(path);\n    if (maxFrameBytes === undefined) return false;\n    if (\n      expiresAtMs !== undefined &&\n      (!Number.isSafeInteger(expiresAtMs) || expiresAtMs <= Date.now())\n    ) {\n      return false;\n    }\n    if (\n      (principal !== undefined &&\n        (expiresAtMs === undefined ||\n          userId !== principal.subject ||\n          !principal.issuer ||\n          !principal.tenantId)) ||\n      (expiresAtMs !== undefined && principal === undefined)\n    ) {\n      return false;\n    }\n\n    const connId = crypto.randomUUID();\n    const attachment: WsAttachment = {\n      version: 1,\n      connId,\n      state: 'pending',\n      userId,\n      principal:\n        principal === undefined\n          ? undefined\n          : {\n              issuer: principal.issuer,\n              subject: principal.subject,\n              principalType: principal.principalType,\n            },\n      tenantId: principal?.tenantId,\n      expiresAtMs,\n      path,\n      maxFrameBytes,\n      rooms: [roomId],\n      data: {\n        ...(userId ? { userId } : {}),\n        ...(principal\n          ? {\n              principal: {\n                issuer: principal.issuer,\n                subject: principal.subject,\n                principalType: principal.principalType,\n              },\n              tenantId: principal.tenantId,\n            }\n          : {}),\n        ...(expiresAtMs !== undefined ? { expiresAtMs } : {}),\n      },\n    };\n    if (new TextEncoder().encode(JSON.stringify(attachment)).byteLength > MAX_WS_ATTACHMENT_BYTES) {\n      return false;\n    }\n    try {\n      this.ctx.acceptWebSocket(ws, [roomTag(roomId), connTag(connId)]);\n      ws.serializeAttachment(attachment);\n    } catch {\n      try {\n        ws.close(1008, 'Connection rejected');\n      } catch {\n        // already closed\n      }\n      return false;\n    }\n\n    const client = this.registry.clientFor(ws);\n    try {\n      await this.dispatcher.handleOpen(path, client);\n      // Another callback may have rejected the socket while the asynchronous\n      // connection hook was still pending. Never resurrect that terminal state\n      // after the hook resolves.\n      if (!this.transition(ws, 'active', 'pending')) {\n        throw new Error('Unable to persist authorized WebSocket state');\n      }\n      return true;\n    } catch (err) {\n      await this.dispatcher.handleError(path, client, err).catch(() => {});\n      this.transition(ws, 'rejected');\n      try {\n        ws.close(1008, 'Connection rejected');\n      } catch {\n        // already closed\n      }\n      return false;\n    }\n  }\n\n  async onMessage(ws: WsLike, message: string | ArrayBuffer): Promise<void> {\n    if (!this.isActive(ws)) {\n      this.reject(ws, 'Connection is not authorized');\n      return;\n    }\n    let queue = this.#messages.get(ws);\n    if (!queue) {\n      const path = socketAttachment(ws)?.path;\n      const options = this.dispatcher.collectEntrypoints().find((entry) => entry.meta.path === path)\n        ?.meta.options;\n      queue = new WsMessageQueue(\n        () => this.reject(ws, 'WebSocket message budget exceeded', 1013),\n        options?.maxPendingMessages,\n        options?.maxPendingBytes,\n      );\n      this.#messages.set(ws, queue);\n    }\n    await queue.run(message, async () => {\n      if (!this.isActive(ws)) return;\n      const client = this.registry.clientFor(ws);\n      await this.dispatcher.dispatchMessage(client.path, client, message);\n    });\n  }\n\n  async onClose(ws: WsLike, code: number, reason: string): Promise<void> {\n    this.#messages.get(ws)?.stop();\n    if (!this.isActive(ws, false)) {\n      this.transition(ws, 'rejected');\n      try {\n        ws.close();\n      } catch {\n        // already closed\n      }\n      return;\n    }\n    const client = this.registry.clientFor(ws);\n    await this.dispatcher.handleClose(client.path, client, code, reason);\n    // Complete the closing handshake. Only 1000 and 3000-4999 are valid for\n    // close(); reserved/abnormal codes (1005/1006/1015, etc.) throw a RangeError,\n    // so fall back to a codeless close on those.\n    try {\n      if (code === 1000 || (code >= 3000 && code <= 4999)) ws.close(code, reason);\n      else ws.close();\n    } catch {\n      // socket already closed\n    }\n  }\n\n  async onError(ws: WsLike, err: unknown): Promise<void> {\n    if (!this.isActive(ws, false)) {\n      this.reject(ws, 'Connection failed before authorization');\n      return;\n    }\n    const client = this.registry.clientFor(ws);\n    await this.dispatcher.handleError(client.path, client, err);\n  }\n\n  /** Deliver a broadcast command to this DO's local sockets (RPC entry point). */\n  broadcast(cmd: BroadcastCommand): void | Promise<void> {\n    assertBroadcastCommandFits(cmd, this.dispatcher.getMaximumGatewayFrameBytes());\n    return this.registry.deliverLocal(cmd);\n  }\n\n  private transition(\n    ws: WsLike,\n    state: WsAttachment['state'],\n    expectedState?: WsAttachment['state'],\n  ): boolean {\n    try {\n      const attachment = socketAttachment(ws);\n      if (!attachment) return false;\n      if (expectedState !== undefined && attachment.state !== expectedState) return false;\n      attachment.state = state;\n      ws.serializeAttachment(attachment);\n      return true;\n    } catch {\n      return false;\n    }\n  }\n\n  private isActive(ws: WsLike, checkExpiry = true): boolean {\n    try {\n      const attachment = socketAttachment(ws);\n      if (!attachment || attachment.state !== 'active') return false;\n      return (\n        !checkExpiry ||\n        attachment.expiresAtMs === undefined ||\n        (Number.isSafeInteger(attachment.expiresAtMs) && attachment.expiresAtMs > Date.now())\n      );\n    } catch {\n      return false;\n    }\n  }\n\n  private reject(ws: WsLike, reason: string, code = 1008): void {\n    this.#messages.get(ws)?.stop();\n    this.transition(ws, 'rejected');\n    try {\n      ws.close(code, reason);\n    } catch {\n      // already closed\n    }\n  }\n}\n","import { bootstrap, VelaApplication } from '@velajs/vela';\nimport type { InjectionToken, Type } from '@velajs/vela';\nimport {\n  local,\n  readWsEntrypointMeta,\n  WsDispatcher,\n  WsServerImpl,\n  WS_SERVER,\n} from '@velajs/vela/websocket';\nimport type { WsServer } from '@velajs/vela/websocket';\nimport type { LiveEngine } from '@velajs/vela/live';\nimport { registerCloudflareEnvironment } from '../environment';\nimport { CfWsClient } from './cf-ws-client';\nimport { CfRoomRegistry } from './cf-room-registry';\nimport { initDoLive, initializeDoLiveResources } from './do-live';\nimport type { DoStateLike } from './do-state';\nimport { WsServerHolder } from './ws-server-holder';\n\nexport interface DoRuntime {\n  dispatcher: WsDispatcher;\n  registry: CfRoomRegistry;\n  server: WsServer;\n  /** Gateway paths from `app.entrypoints.ofKind('websocket')` (discovery order). */\n  gatewayPaths: string[];\n  /** The live-query engine (undefined when the app doesn't import LiveModule). */\n  live?: LiveEngine;\n  close(signal?: string): Promise<void>;\n}\n\n/**\n * Slim DI bootstrap for the Durable Object isolate: wires the container and runs\n * `OnModuleInit`/`OnApplicationBootstrap` (so `WsDispatcher` discovers gateways)\n * WITHOUT building the Hono app/routes the DO never serves. Cloudflare binding\n * refs are initialized straight from the DO's `env`, and the ctx-backed server\n * is bound before bootstrap lifecycle so gateway `afterInit`/handlers see it.\n */\nexport async function buildDoRuntime<T extends object>(\n  rootModule: Type,\n  ctx: DoStateLike,\n  options: { env: T; envToken: InjectionToken<T> },\n): Promise<DoRuntime> {\n  const { container, routeManager, loader } = await bootstrap(rootModule, {\n    configureContainer: (container) => {\n      registerCloudflareEnvironment(container, { token: options.envToken, env: options.env });\n    },\n  });\n\n  const registry = new CfRoomRegistry(ctx);\n  const driver = local();\n  driver.bind(registry);\n  const server = new WsServerImpl(driver);\n\n  if (container.has(WS_SERVER)) {\n    const holder = await container.resolveAsync(WS_SERVER);\n    if (holder instanceof WsServerHolder) holder.setTarget(server);\n  }\n\n  const app = new VelaApplication(container, routeManager);\n  app.setInstances(await loader.resolveAllInstances());\n  initializeDoLiveResources(container, ctx);\n  await app.callOnModuleInit();\n  await app.callOnApplicationBootstrap();\n\n  // The entrypoint registry is the transport contract: one 'websocket' entry\n  // per discovered gateway ({ meta: { path, dispatcher } }). Built by\n  // callOnApplicationBootstrap(), so this slim no-routes path has it too.\n  const wsEntrypoints = app.entrypoints.ofKind('websocket', readWsEntrypointMeta);\n  const dispatcher = wsEntrypoints[0]?.meta.dispatcher ?? app.get(WsDispatcher);\n  registry.setSendPolicyResolver(\n    (path) => wsEntrypoints.find((entry) => entry.meta.path === path)?.meta.options.sendPolicy,\n  );\n  registry.setFrameLimitResolver((path) => dispatcher.getGatewayMaxFrameBytes(path));\n  registry.setDeliveryAuthorizer((client) => {\n    const path = client instanceof CfWsClient ? client.path : '';\n    return dispatcher.authorizeDelivery(path, client);\n  });\n\n  // Live queries: wire the SQLite cursor log + local driver mode and replay\n  // hibernation-persisted subscriptions into the fresh engine.\n  const live = initDoLive(app, ctx, registry);\n\n  return {\n    // Zero gateways still yields a live dispatcher (module imported, nothing\n    // decorated) — fall back to resolving it directly.\n    dispatcher,\n    registry,\n    server,\n    gatewayPaths: wsEntrypoints.map((ep) => ep.meta.path),\n    live,\n    close: (signal?: string) => app.close(signal),\n  };\n}\n","import { DurableObject } from 'cloudflare:workers';\nimport type { InjectionToken } from '@velajs/vela';\nimport type { BroadcastCommand } from '@velajs/vela/websocket';\nimport type {\n  CommitStamp,\n  InvalidationCommand,\n  LiveEngine,\n  LiveInspection,\n} from '@velajs/vela/live';\nimport { buildDoRuntime } from './do-bootstrap';\nimport { DoWebSocketHost, type WsConnectionPrincipal } from './do-websocket-host';\nimport { armDoPitr, readDoPitrBookmark } from './do-pitr';\nimport { resolveCloudflareRoot } from '../root-module';\nimport type { CloudflareRoot } from '../root-module';\nimport type {\n  DoPitrArmOptions,\n  DoPitrArmResult,\n  DoPitrBookmarkRead,\n  VelaDoPitrRpc,\n} from './do-pitr';\n\nconst PING = '{\"event\":\"$ping\"}';\nconst PONG = '{\"event\":\"$pong\"}';\nconst MAX_IDENTITY_FIELD_BYTES = 2048;\nconst encoder = new TextEncoder();\n\nfunction isIdentityField(value: string | null): value is string {\n  return (\n    value !== null &&\n    value.length > 0 &&\n    encoder.encode(value).byteLength <= MAX_IDENTITY_FIELD_BYTES\n  );\n}\n\n/**\n * Base class for the WebSocket Durable Object. The user exports a named subclass\n * (matching their `wrangler.toml` `class_name`) built from their `AppModule`:\n *\n * ```ts\n * export class ChatRoom extends VelaWebSocketDurableObject(AppModule, { envToken: ENV }) {}\n * ```\n *\n * It owns the raw hibernation socket lifecycle (Hono's `upgradeWebSocket` cannot\n * bridge DO hibernation) and forwards every event into the runtime-agnostic\n * `WsDispatcher` via {@link DoWebSocketHost}.\n */\nexport function VelaWebSocketDurableObject<T extends object>(\n  rootModule: CloudflareRoot<NoInfer<T>>,\n  options: { envToken: InjectionToken<T> },\n): new (\n  ctx: DurableObjectState,\n  env: T,\n) => DurableObject<T> &\n  VelaDoPitrRpc & {\n    broadcast(cmd: BroadcastCommand): Promise<void>;\n    invalidate(cmd: InvalidationCommand): Promise<CommitStamp | undefined>;\n    inspectLive(): Promise<LiveInspection>;\n  } {\n  return class VelaWsDurableObject extends DurableObject<T> {\n    private host!: DoWebSocketHost;\n    private liveEngine?: LiveEngine;\n    private readonly ready: Promise<void>;\n\n    constructor(ctx: DurableObjectState, env: T) {\n      super(ctx, env);\n      // Application-level ping/pong answered WITHOUT waking a hibernated DO.\n      try {\n        ctx.setWebSocketAutoResponse(new WebSocketRequestResponsePair(PING, PONG));\n      } catch {\n        // Older runtimes without auto-response — fine, protocol pings still work.\n      }\n      this.ready = ctx.blockConcurrencyWhile(async () => {\n        const runtime = await buildDoRuntime(await resolveCloudflareRoot(rootModule, env), ctx, {\n          ...options,\n          env,\n        });\n        this.host = new DoWebSocketHost(\n          ctx,\n          runtime.dispatcher,\n          runtime.registry,\n          runtime.gatewayPaths,\n        );\n        this.liveEngine = runtime.live;\n      });\n    }\n\n    /** Intra-worker RPC only; HTTP fetch never exposes this admin snapshot. */\n    async inspectLive(): Promise<LiveInspection> {\n      await this.ready;\n      return this.liveEngine?.inspect() ?? { subscriptions: [], rooms: [] };\n    }\n\n    override async fetch(request: Request): Promise<Response> {\n      await this.ready;\n      if (request.headers.get('upgrade')?.toLowerCase() !== 'websocket') {\n        return new Response('Expected WebSocket upgrade', { status: 426 });\n      }\n\n      const url = new URL(request.url);\n      // Headers are primary (carry auth + multi-gateway routing); fall back to the\n      // DO's own name (set via idFromName(room)) and the single gateway path so a\n      // plain `stub.fetch(request)` forward still works.\n      const roomId = request.headers.get('x-vela-room') ?? this.ctx.id.name ?? url.pathname;\n      const path = request.headers.get('x-vela-path') ?? this.host.defaultPath() ?? url.pathname;\n      const userId = request.headers.get('x-vela-user') || undefined;\n      const rawExpiresAtMs = request.headers.get('x-vela-expires-at-ms');\n      const parsedExpiresAtMs = rawExpiresAtMs === null ? undefined : Number(rawExpiresAtMs);\n      if (\n        parsedExpiresAtMs !== undefined &&\n        (!Number.isSafeInteger(parsedExpiresAtMs) || parsedExpiresAtMs <= 0)\n      ) {\n        return new Response('Invalid WebSocket identity expiry', { status: 403 });\n      }\n\n      const issuer = request.headers.get('x-vela-issuer');\n      const subject = request.headers.get('x-vela-subject');\n      const principalType = request.headers.get('x-vela-principal-type');\n      const tenantId = request.headers.get('x-vela-tenant');\n      const hasPrincipalHeader =\n        issuer !== null || subject !== null || principalType !== null || tenantId !== null;\n      let principal: WsConnectionPrincipal | undefined;\n      if (hasPrincipalHeader) {\n        if (\n          !isIdentityField(issuer) ||\n          !isIdentityField(subject) ||\n          (principalType !== 'user' && principalType !== 'service') ||\n          !isIdentityField(tenantId) ||\n          parsedExpiresAtMs === undefined ||\n          (userId !== undefined && userId !== subject)\n        ) {\n          return new Response('Invalid WebSocket principal', { status: 403 });\n        }\n        principal = { issuer, subject, principalType, tenantId };\n      } else if (parsedExpiresAtMs !== undefined) {\n        return new Response('WebSocket identity tuple is missing', { status: 403 });\n      }\n\n      if (parsedExpiresAtMs !== undefined && parsedExpiresAtMs <= Date.now()) {\n        return new Response('WebSocket identity expired', { status: 403 });\n      }\n\n      const { 0: client, 1: server } = new WebSocketPair();\n      const accepted = await this.host.accept(\n        server,\n        path,\n        roomId,\n        userId,\n        parsedExpiresAtMs,\n        principal,\n      );\n      if (!accepted) return new Response('WebSocket connection rejected', { status: 403 });\n      return new Response(null, { status: 101, webSocket: client });\n    }\n\n    override async webSocketMessage(ws: WebSocket, message: string | ArrayBuffer): Promise<void> {\n      await this.ready;\n      await this.host.onMessage(ws, message);\n    }\n\n    override async webSocketClose(ws: WebSocket, code: number, reason: string): Promise<void> {\n      await this.ready;\n      await this.host.onClose(ws, code, reason);\n    }\n\n    override async webSocketError(ws: WebSocket, error: unknown): Promise<void> {\n      await this.ready;\n      await this.host.onError(ws, error);\n    }\n\n    /** DO RPC — server-initiated broadcast forwarded from a Worker (see `broadcastToRoom`). */\n    async broadcast(cmd: BroadcastCommand): Promise<void> {\n      await this.ready;\n      await this.host.broadcast(cmd);\n    }\n\n    /**\n     * DO RPC — live tag invalidation forwarded from a Worker (durableObjectLive /\n     * liveInvalidateToRoom). Appends to THIS log scope's cursor log and returns\n     * the commit stamp (what `Vela-Commit-Cursor` carries); the subscription\n     * refreshes fan out asynchronously.\n     */\n    async invalidate(cmd: InvalidationCommand): Promise<CommitStamp | undefined> {\n      await this.ready;\n      return this.liveEngine?.applyInvalidation(cmd);\n    }\n\n    // -- Durable Object PITR (point-in-time recovery) RPC ---------------------\n    //\n    // GUARD / reachability: these are admin-privileged operations (a restore can\n    // roll the DO's SQLite state back up to 30 days and, with `restart`, abort\n    // the DO to apply it now). They are safe to expose here because a Durable\n    // Object's RPC methods are NOT network-reachable: a `DurableObjectStub` is\n    // obtainable ONLY from a Worker that binds this DO namespace, and RPC calls\n    // travel Cloudflare's internal capability channel — never the public\n    // internet. A WebSocket/HTTP client reaches only `fetch()` above, never these\n    // methods. The security boundary is therefore the WORKER-SIDE studio admin\n    // gate that fronts the `CloudflareDoTimeTravelPort` (master admin token + the\n    // 428 confirm challenge) — the identical trust model as `broadcast()` /\n    // `invalidate()` on this same DO. See `do-pitr.ts` for the storage wrappers.\n\n    /** DO RPC — the current PITR bookmark (typed-unavailable on a non-SQLite DO). */\n    async pitrCurrentBookmark(): Promise<DoPitrBookmarkRead> {\n      await this.ready;\n      return readDoPitrBookmark(this.ctx.storage);\n    }\n\n    /** DO RPC — the PITR bookmark closest to `time` (+ the current bookmark). */\n    async pitrBookmarkForTime(time: number | string): Promise<DoPitrBookmarkRead> {\n      await this.ready;\n      return readDoPitrBookmark(this.ctx.storage, time);\n    }\n\n    /**\n     * DO RPC — arm a PITR restore and return the undo bookmark. When `restart` is\n     * requested, `ctx.abort()` is called AFTER the undo bookmark is computed so\n     * the recovery applies on the immediately-following session; otherwise the\n     * restore applies on the next natural restart (`restarted: false`).\n     */\n    async pitrArmRestore(opts: DoPitrArmOptions): Promise<DoPitrArmResult> {\n      await this.ready;\n      const result = await armDoPitr(this.ctx.storage, opts);\n      if (opts.restart === true) this.ctx.abort('vela PITR restore');\n      return result;\n    }\n  };\n}\n","import { DurableObject } from 'cloudflare:workers';\nimport { MAX_NONCE_BYTES, isCanonicalBoundedText, isValidExpiry } from './nonce-validation';\nconst EXPIRED_DELETE_BATCH = 1_024;\n\nconst CREATE_TABLE =\n  'CREATE TABLE IF NOT EXISTS __vela_nonce_claims (' +\n  'nonce TEXT PRIMARY KEY NOT NULL, ' +\n  'expires_at INTEGER NOT NULL CHECK (expires_at > 0)' +\n  ') WITHOUT ROWID';\nconst CREATE_EXPIRY_INDEX =\n  'CREATE INDEX IF NOT EXISTS __vela_nonce_claims_expiry ON __vela_nonce_claims (expires_at)';\nconst DELETE_EXPIRED =\n  'DELETE FROM __vela_nonce_claims WHERE nonce IN (' +\n  'SELECT nonce FROM __vela_nonce_claims ' +\n  'WHERE expires_at < ? ORDER BY expires_at LIMIT ?' +\n  ')';\nconst INSERT_CLAIM =\n  'INSERT INTO __vela_nonce_claims (nonce, expires_at) VALUES (?, ?) ' +\n  'ON CONFLICT(nonce) DO NOTHING RETURNING nonce, expires_at';\n\ninterface NonceSqlCursor {\n  toArray(): Record<string, unknown>[];\n}\n\ninterface NonceSqlStorage {\n  exec(query: string, ...bindings: unknown[]): NonceSqlCursor;\n}\n\n/**\n * SQLite Durable Object that atomically consumes nonces.\n *\n * Export this class from the Worker entry and register it through a Wrangler\n * `new_sqlite_classes` migration. `INSERT ... ON CONFLICT DO NOTHING RETURNING`\n * is the single-use decision; all SQL runs synchronously before the RPC method\n * yields, and the nonce primary key is the final concurrency boundary.\n */\nexport class VelaNonceDurableObject extends DurableObject<Record<string, unknown>> {\n  private sql?: NonceSqlStorage;\n\n  constructor(ctx: DurableObjectState, env: Record<string, unknown>) {\n    super(ctx, env);\n    try {\n      const sql = ctx.storage?.sql;\n      if (!sql || typeof sql.exec !== 'function') return;\n      sql.exec(CREATE_TABLE);\n      sql.exec(CREATE_EXPIRY_INDEX);\n      this.sql = sql;\n    } catch {\n      // A non-SQLite/misconfigured class stays fail-closed: every claim denies.\n      this.sql = undefined;\n    }\n  }\n\n  async claim(nonce: string, expEpochSeconds: number): Promise<boolean> {\n    const sql = this.sql;\n    if (!sql) return false;\n\n    const now = Math.floor(Date.now() / 1_000);\n    if (!isCanonicalBoundedText(nonce, MAX_NONCE_BYTES) || !isValidExpiry(expEpochSeconds, now)) {\n      return false;\n    }\n\n    try {\n      // Keep cleanup bounded so one claim cannot monopolize the DO. Entries at\n      // exactly `now` remain: Vela's invocation verifier accepts `now === exp`.\n      sql.exec(DELETE_EXPIRED, now, EXPIRED_DELETE_BATCH);\n\n      const cursor = sql.exec(INSERT_CLAIM, nonce, expEpochSeconds);\n      if (!cursor || typeof cursor.toArray !== 'function') return false;\n      const rows: unknown = cursor.toArray();\n      if (!Array.isArray(rows) || rows.length !== 1) return false;\n\n      const row: unknown = rows[0];\n      if (typeof row !== 'object' || row === null) return false;\n      if (\n        !Object.hasOwn(row, 'nonce') ||\n        !Object.hasOwn(row, 'expires_at') ||\n        !('nonce' in row) ||\n        !('expires_at' in row)\n      ) {\n        return false;\n      }\n      return row.nonce === nonce && row.expires_at === expEpochSeconds;\n    } catch {\n      return false;\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;AAYA,IAAa,iBAAb,MAAoD;CAWrB;CAV7B,6BAAsB,IAAI,QAAmC;CAC7D;CAEA,sBAAsB,SAAkE;EACtF,KAAK,qBAAqB;CAC5B;CAEA;CACA;CAEA,YAAY,KAAmC;EAAlB,KAAA,MAAA;CAAmB;CAEhD,sBAAsB,YAAoE;EACxF,KAAK,qBAAqB;CAC5B;;CAGA,sBAAsB,UAAsD;EAC1E,KAAK,oBAAoB;CAC3B;CAGA,SAAS,SAAyB,CAAC;CACnC,SAAS,SAAyB,CAAC;CAEnC,KAAK,QAAkB,MAAoC;EACzD,OAAO,OAAO,KAAK,IAAI;CACzB;CAEA,MAAM,QAAkB,MAAoC;EAC1D,OAAO,OAAO,MAAM,IAAI;CAC1B;CAEA,eAAe,MAAwB;EACrC,OAAO,KAAK,eAAe,IAAI,CAAC,CAAC,KAAK,OAAO,KAAK,aAAa,EAAE,CAAC,CAAC,MAAM;CAC3E;CAEA,aAAa,KAA6C;EACxD,MAAM,aAAa,IAAI,IAAI,IAAI,aAAa,CAAC,CAAC;EAC9C,MAAM,eAAe,IAAI,eAAe,CAAC;EAIzC,MAAM,UACJ,IAAI,MAAM,WAAW,IAAI,KAAK,IAAI,cAAc,IAAI,KAAK,aAAa,IAAI,KAAK;EAEjF,MAAM,uBAAO,IAAI,IAAY;EAC7B,MAAM,WAAoD,CAAC;EAC3D,KAAK,MAAM,MAAM,SAAS;GACxB,MAAM,MAAM,KAAK,oBAAoB,IAAI,KAAK,aAAa,EAAE,CAAC;GAC9D,IACE,IAAI,UAAU,YACb,IAAI,gBAAgB,KAAA,MAClB,CAAC,OAAO,cAAc,IAAI,WAAW,KAAK,IAAI,eAAe,KAAK,IAAI,IACzE;IACA,IAAI;KACF,IAAI,QAAQ;KACZ,GAAG,oBAAoB,GAAG;KAC1B,GAAG,MAAM,MAAM,yCAAyC;IAC1D,QAAQ,CAER;IACA;GACF;GACA,IAAI,KAAK,IAAI,IAAI,MAAM,GAAG;GAC1B,KAAK,IAAI,IAAI,MAAM;GACnB,IAAI,WAAW,IAAI,IAAI,MAAM,GAAG;GAChC,IAAI,aAAa,MAAM,MAAM,IAAI,MAAM,SAAS,CAAC,CAAC,GAAG;GACrD,SAAS,KAAK;IAAE;IAAI,QAAQ,KAAK,UAAU,EAAE;GAAE,CAAC;EAClD;EAEA,IAAI,CAAC,KAAK,oBAAoB;GAC5B,KAAK,MAAM,EAAE,YAAY,UAAU,OAAO,QAAQ,IAAI,KAAK;GAC3D;EACF;EACA,OAAO,QAAQ,IACb,SAAS,IAAI,OAAO,EAAE,IAAI,aAAa;GACrC,IAAI,UAAU;GACd,IAAI;IACF,UAAW,MAAM,KAAK,mBAAoB,MAAM,MAAO;GACzD,QAAQ;IACN,UAAU;GACZ;GACA,IAAI,SAAS,OAAO,QAAQ,IAAI,KAAK;QAChC,KAAK,OAAO,IAAI,gCAAgC;EACvD,CAAC,CACH,CAAC,CAAC,WAAW,KAAA,CAAS;CACxB;CAEA,aAAqB,OAA2B;EAC9C,MAAM,sBAAM,IAAI,IAAY;EAC5B,KAAK,MAAM,QAAQ,OAAO,KAAK,MAAM,MAAM,KAAK,eAAe,IAAI,GAAG,IAAI,IAAI,EAAE;EAChF,OAAO,CAAC,GAAG,GAAG;CAChB;CAEA,eAAuB,MAAwB;EAK7C,OAAO,KAAK,IAAI,cAAc,CAAC,CAAC,QAAQ,OAAO,KAAK,aAAa,EAAE,CAAC,CAAC,MAAM,SAAS,IAAI,CAAC;CAC3F;CAEA,aAAqB,IAA0B;EAC7C,OAAO,iBAAiB,EAAE,KAAK,mBAAmB;CACpD;;CAGA,UAAU,IAAwB;EAChC,KAAK,oBAAoB,IAAI,KAAK,aAAa,EAAE,CAAC;EAClD,IAAI,OAAO,KAAK,WAAW,IAAI,EAAE;EACjC,IAAI,CAAC,MAAM;GACT,OAAO,IAAI,kBAAkB,KAAK,qBAAqB,KAAK,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC;GAClF,KAAK,WAAW,IAAI,IAAI,IAAI;EAC9B;EACA,OAAO,IAAI,WAAW,KAAK,KAAK,IAAI,IAAI;CAC1C;CAEA,oBAA4B,IAAY,YAAwC;EAC9E,MAAM,WAAW,KAAK,oBAAoB,WAAW,IAAI;EACzD,IAAI,aAAa,KAAA,KAAa,WAAW,kBAAkB,UAAU;GACnE,WAAW,gBAAgB;GAC3B,GAAG,oBAAoB,UAAU;EACnC;EACA,OAAO;CACT;CAEA,OAAe,IAAY,QAAsB;EAC/C,IAAI;GACF,MAAM,aAAa,KAAK,aAAa,EAAE;GACvC,WAAW,QAAQ;GACnB,GAAG,oBAAoB,UAAU;GACjC,GAAG,MAAM,MAAM,MAAM;EACvB,QAAQ,CAER;CACF;AACF;;;;;;;;AC9HA,IAAa,kBAAb,MAA6B;CAGR;CACA;CACA;CACA;CALnB,4BAAqB,IAAI,QAAgC;CACzD,YACE,KACA,YACA,UACA,eAAmD,CAAC,GACpD;EAJiB,KAAA,MAAA;EACA,KAAA,aAAA;EACA,KAAA,WAAA;EACA,KAAA,eAAA;CAChB;;CAGH,cAAkC;EAChC,OAAO,KAAK,aAAa;CAC3B;;;;;;CAOA,MAAM,OACJ,IACA,MACA,QACA,QACA,aACA,WACkB;EAClB,MAAM,gBAAgB,KAAK,WAAW,wBAAwB,IAAI;EAClE,IAAI,kBAAkB,KAAA,GAAW,OAAO;EACxC,IACE,gBAAgB,KAAA,MACf,CAAC,OAAO,cAAc,WAAW,KAAK,eAAe,KAAK,IAAI,IAE/D,OAAO;EAET,IACG,cAAc,KAAA,MACZ,gBAAgB,KAAA,KACf,WAAW,UAAU,WACrB,CAAC,UAAU,UACX,CAAC,UAAU,aACd,gBAAgB,KAAA,KAAa,cAAc,KAAA,GAE5C,OAAO;EAGT,MAAM,SAAS,OAAO,WAAW;EACjC,MAAM,aAA2B;GAC/B,SAAS;GACT;GACA,OAAO;GACP;GACA,WACE,cAAc,KAAA,IACV,KAAA,IACA;IACE,QAAQ,UAAU;IAClB,SAAS,UAAU;IACnB,eAAe,UAAU;GAC3B;GACN,UAAU,WAAW;GACrB;GACA;GACA;GACA,OAAO,CAAC,MAAM;GACd,MAAM;IACJ,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;IAC3B,GAAI,YACA;KACE,WAAW;MACT,QAAQ,UAAU;MAClB,SAAS,UAAU;MACnB,eAAe,UAAU;KAC3B;KACA,UAAU,UAAU;IACtB,IACA,CAAC;IACL,GAAI,gBAAgB,KAAA,IAAY,EAAE,YAAY,IAAI,CAAC;GACrD;EACF;EACA,IAAI,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK,UAAU,UAAU,CAAC,CAAC,CAAC,aAAA,OACvD,OAAO;EAET,IAAI;GACF,KAAK,IAAI,gBAAgB,IAAI,CAAC,QAAQ,MAAM,GAAG,QAAQ,MAAM,CAAC,CAAC;GAC/D,GAAG,oBAAoB,UAAU;EACnC,QAAQ;GACN,IAAI;IACF,GAAG,MAAM,MAAM,qBAAqB;GACtC,QAAQ,CAER;GACA,OAAO;EACT;EAEA,MAAM,SAAS,KAAK,SAAS,UAAU,EAAE;EACzC,IAAI;GACF,MAAM,KAAK,WAAW,WAAW,MAAM,MAAM;GAI7C,IAAI,CAAC,KAAK,WAAW,IAAI,UAAU,SAAS,GAC1C,MAAM,IAAI,MAAM,8CAA8C;GAEhE,OAAO;EACT,SAAS,KAAK;GACZ,MAAM,KAAK,WAAW,YAAY,MAAM,QAAQ,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC;GACnE,KAAK,WAAW,IAAI,UAAU;GAC9B,IAAI;IACF,GAAG,MAAM,MAAM,qBAAqB;GACtC,QAAQ,CAER;GACA,OAAO;EACT;CACF;CAEA,MAAM,UAAU,IAAY,SAA8C;EACxE,IAAI,CAAC,KAAK,SAAS,EAAE,GAAG;GACtB,KAAK,OAAO,IAAI,8BAA8B;GAC9C;EACF;EACA,IAAI,QAAQ,KAAK,UAAU,IAAI,EAAE;EACjC,IAAI,CAAC,OAAO;GACV,MAAM,OAAO,iBAAiB,EAAE,CAAC,EAAE;GACnC,MAAM,UAAU,KAAK,WAAW,mBAAmB,CAAC,CAAC,MAAM,UAAU,MAAM,KAAK,SAAS,IAAI,CAAC,EAC1F,KAAK;GACT,QAAQ,IAAI,qBACJ,KAAK,OAAO,IAAI,qCAAqC,IAAI,GAC/D,SAAS,oBACT,SAAS,eACX;GACA,KAAK,UAAU,IAAI,IAAI,KAAK;EAC9B;EACA,MAAM,MAAM,IAAI,SAAS,YAAY;GACnC,IAAI,CAAC,KAAK,SAAS,EAAE,GAAG;GACxB,MAAM,SAAS,KAAK,SAAS,UAAU,EAAE;GACzC,MAAM,KAAK,WAAW,gBAAgB,OAAO,MAAM,QAAQ,OAAO;EACpE,CAAC;CACH;CAEA,MAAM,QAAQ,IAAY,MAAc,QAA+B;EACrE,KAAK,UAAU,IAAI,EAAE,CAAC,EAAE,KAAK;EAC7B,IAAI,CAAC,KAAK,SAAS,IAAI,KAAK,GAAG;GAC7B,KAAK,WAAW,IAAI,UAAU;GAC9B,IAAI;IACF,GAAG,MAAM;GACX,QAAQ,CAER;GACA;EACF;EACA,MAAM,SAAS,KAAK,SAAS,UAAU,EAAE;EACzC,MAAM,KAAK,WAAW,YAAY,OAAO,MAAM,QAAQ,MAAM,MAAM;EAInE,IAAI;GACF,IAAI,SAAS,OAAS,QAAQ,OAAQ,QAAQ,MAAO,GAAG,MAAM,MAAM,MAAM;QACrE,GAAG,MAAM;EAChB,QAAQ,CAER;CACF;CAEA,MAAM,QAAQ,IAAY,KAA6B;EACrD,IAAI,CAAC,KAAK,SAAS,IAAI,KAAK,GAAG;GAC7B,KAAK,OAAO,IAAI,wCAAwC;GACxD;EACF;EACA,MAAM,SAAS,KAAK,SAAS,UAAU,EAAE;EACzC,MAAM,KAAK,WAAW,YAAY,OAAO,MAAM,QAAQ,GAAG;CAC5D;;CAGA,UAAU,KAA6C;EACrD,2BAA2B,KAAK,KAAK,WAAW,4BAA4B,CAAC;EAC7E,OAAO,KAAK,SAAS,aAAa,GAAG;CACvC;CAEA,WACE,IACA,OACA,eACS;EACT,IAAI;GACF,MAAM,aAAa,iBAAiB,EAAE;GACtC,IAAI,CAAC,YAAY,OAAO;GACxB,IAAI,kBAAkB,KAAA,KAAa,WAAW,UAAU,eAAe,OAAO;GAC9E,WAAW,QAAQ;GACnB,GAAG,oBAAoB,UAAU;GACjC,OAAO;EACT,QAAQ;GACN,OAAO;EACT;CACF;CAEA,SAAiB,IAAY,cAAc,MAAe;EACxD,IAAI;GACF,MAAM,aAAa,iBAAiB,EAAE;GACtC,IAAI,CAAC,cAAc,WAAW,UAAU,UAAU,OAAO;GACzD,OACE,CAAC,eACD,WAAW,gBAAgB,KAAA,KAC1B,OAAO,cAAc,WAAW,WAAW,KAAK,WAAW,cAAc,KAAK,IAAI;EAEvF,QAAQ;GACN,OAAO;EACT;CACF;CAEA,OAAe,IAAY,QAAgB,OAAO,MAAY;EAC5D,KAAK,UAAU,IAAI,EAAE,CAAC,EAAE,KAAK;EAC7B,KAAK,WAAW,IAAI,UAAU;EAC9B,IAAI;GACF,GAAG,MAAM,MAAM,MAAM;EACvB,QAAQ,CAER;CACF;AACF;;;;;;;;;;AChNA,eAAsB,eACpB,YACA,KACA,SACoB;CACpB,MAAM,EAAE,WAAW,cAAc,WAAW,MAAM,UAAU,YAAY,EACtE,qBAAqB,cAAc;EACjC,8BAA8B,WAAW;GAAE,OAAO,QAAQ;GAAU,KAAK,QAAQ;EAAI,CAAC;CACxF,EACF,CAAC;CAED,MAAM,WAAW,IAAI,eAAe,GAAG;CACvC,MAAM,SAAS,MAAM;CACrB,OAAO,KAAK,QAAQ;CACpB,MAAM,SAAS,IAAI,aAAa,MAAM;CAEtC,IAAI,UAAU,IAAI,SAAS,GAAG;EAC5B,MAAM,SAAS,MAAM,UAAU,aAAa,SAAS;EACrD,IAAI,kBAAkB,gBAAgB,OAAO,UAAU,MAAM;CAC/D;CAEA,MAAM,MAAM,IAAI,gBAAgB,WAAW,YAAY;CACvD,IAAI,aAAa,MAAM,OAAO,oBAAoB,CAAC;CACnD,0BAA0B,WAAW,GAAG;CACxC,MAAM,IAAI,iBAAiB;CAC3B,MAAM,IAAI,2BAA2B;CAKrC,MAAM,gBAAgB,IAAI,YAAY,OAAO,aAAa,oBAAoB;CAC9E,MAAM,aAAa,cAAc,EAAE,EAAE,KAAK,cAAc,IAAI,IAAI,YAAY;CAC5E,SAAS,uBACN,SAAS,cAAc,MAAM,UAAU,MAAM,KAAK,SAAS,IAAI,CAAC,EAAE,KAAK,QAAQ,UAClF;CACA,SAAS,uBAAuB,SAAS,WAAW,wBAAwB,IAAI,CAAC;CACjF,SAAS,uBAAuB,WAAW;EACzC,MAAM,OAAO,kBAAkB,aAAa,OAAO,OAAO;EAC1D,OAAO,WAAW,kBAAkB,MAAM,MAAM;CAClD,CAAC;CAID,MAAM,OAAO,WAAW,KAAK,KAAK,QAAQ;CAE1C,OAAO;EAGL;EACA;EACA;EACA,cAAc,cAAc,KAAK,OAAO,GAAG,KAAK,IAAI;EACpD;EACA,QAAQ,WAAoB,IAAI,MAAM,MAAM;CAC9C;AACF;;;ACtEA,MAAM,OAAO;AACb,MAAM,OAAO;AACb,MAAM,2BAA2B;AACjC,MAAM,UAAU,IAAI,YAAY;AAEhC,SAAS,gBAAgB,OAAuC;CAC9D,OACE,UAAU,QACV,MAAM,SAAS,KACf,QAAQ,OAAO,KAAK,CAAC,CAAC,cAAc;AAExC;;;;;;;;;;;;;AAcA,SAAgB,2BACd,YACA,SASE;CACF,OAAO,MAAM,4BAA4B,cAAiB;EACxD;EACA;EACA;EAEA,YAAY,KAAyB,KAAQ;GAC3C,MAAM,KAAK,GAAG;GAEd,IAAI;IACF,IAAI,yBAAyB,IAAI,6BAA6B,MAAM,IAAI,CAAC;GAC3E,QAAQ,CAER;GACA,KAAK,QAAQ,IAAI,sBAAsB,YAAY;IACjD,MAAM,UAAU,MAAM,eAAe,MAAM,sBAAsB,YAAY,GAAG,GAAG,KAAK;KACtF,GAAG;KACH;IACF,CAAC;IACD,KAAK,OAAO,IAAI,gBACd,KACA,QAAQ,YACR,QAAQ,UACR,QAAQ,YACV;IACA,KAAK,aAAa,QAAQ;GAC5B,CAAC;EACH;;EAGA,MAAM,cAAuC;GAC3C,MAAM,KAAK;GACX,OAAO,KAAK,YAAY,QAAQ,KAAK;IAAE,eAAe,CAAC;IAAG,OAAO,CAAC;GAAE;EACtE;EAEA,MAAe,MAAM,SAAqC;GACxD,MAAM,KAAK;GACX,IAAI,QAAQ,QAAQ,IAAI,SAAS,CAAC,EAAE,YAAY,MAAM,aACpD,OAAO,IAAI,SAAS,8BAA8B,EAAE,QAAQ,IAAI,CAAC;GAGnE,MAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;GAI/B,MAAM,SAAS,QAAQ,QAAQ,IAAI,aAAa,KAAK,KAAK,IAAI,GAAG,QAAQ,IAAI;GAC7E,MAAM,OAAO,QAAQ,QAAQ,IAAI,aAAa,KAAK,KAAK,KAAK,YAAY,KAAK,IAAI;GAClF,MAAM,SAAS,QAAQ,QAAQ,IAAI,aAAa,KAAK,KAAA;GACrD,MAAM,iBAAiB,QAAQ,QAAQ,IAAI,sBAAsB;GACjE,MAAM,oBAAoB,mBAAmB,OAAO,KAAA,IAAY,OAAO,cAAc;GACrF,IACE,sBAAsB,KAAA,MACrB,CAAC,OAAO,cAAc,iBAAiB,KAAK,qBAAqB,IAElE,OAAO,IAAI,SAAS,qCAAqC,EAAE,QAAQ,IAAI,CAAC;GAG1E,MAAM,SAAS,QAAQ,QAAQ,IAAI,eAAe;GAClD,MAAM,UAAU,QAAQ,QAAQ,IAAI,gBAAgB;GACpD,MAAM,gBAAgB,QAAQ,QAAQ,IAAI,uBAAuB;GACjE,MAAM,WAAW,QAAQ,QAAQ,IAAI,eAAe;GACpD,MAAM,qBACJ,WAAW,QAAQ,YAAY,QAAQ,kBAAkB,QAAQ,aAAa;GAChF,IAAI;GACJ,IAAI,oBAAoB;IACtB,IACE,CAAC,gBAAgB,MAAM,KACvB,CAAC,gBAAgB,OAAO,KACvB,kBAAkB,UAAU,kBAAkB,aAC/C,CAAC,gBAAgB,QAAQ,KACzB,sBAAsB,KAAA,KACrB,WAAW,KAAA,KAAa,WAAW,SAEpC,OAAO,IAAI,SAAS,+BAA+B,EAAE,QAAQ,IAAI,CAAC;IAEpE,YAAY;KAAE;KAAQ;KAAS;KAAe;IAAS;GACzD,OAAO,IAAI,sBAAsB,KAAA,GAC/B,OAAO,IAAI,SAAS,uCAAuC,EAAE,QAAQ,IAAI,CAAC;GAG5E,IAAI,sBAAsB,KAAA,KAAa,qBAAqB,KAAK,IAAI,GACnE,OAAO,IAAI,SAAS,8BAA8B,EAAE,QAAQ,IAAI,CAAC;GAGnE,MAAM,EAAE,GAAG,QAAQ,GAAG,WAAW,IAAI,cAAc;GASnD,IAAI,CAAC,MARkB,KAAK,KAAK,OAC/B,QACA,MACA,QACA,QACA,mBACA,SACF,GACe,OAAO,IAAI,SAAS,iCAAiC,EAAE,QAAQ,IAAI,CAAC;GACnF,OAAO,IAAI,SAAS,MAAM;IAAE,QAAQ;IAAK,WAAW;GAAO,CAAC;EAC9D;EAEA,MAAe,iBAAiB,IAAe,SAA8C;GAC3F,MAAM,KAAK;GACX,MAAM,KAAK,KAAK,UAAU,IAAI,OAAO;EACvC;EAEA,MAAe,eAAe,IAAe,MAAc,QAA+B;GACxF,MAAM,KAAK;GACX,MAAM,KAAK,KAAK,QAAQ,IAAI,MAAM,MAAM;EAC1C;EAEA,MAAe,eAAe,IAAe,OAA+B;GAC1E,MAAM,KAAK;GACX,MAAM,KAAK,KAAK,QAAQ,IAAI,KAAK;EACnC;;EAGA,MAAM,UAAU,KAAsC;GACpD,MAAM,KAAK;GACX,MAAM,KAAK,KAAK,UAAU,GAAG;EAC/B;;;;;;;EAQA,MAAM,WAAW,KAA4D;GAC3E,MAAM,KAAK;GACX,OAAO,KAAK,YAAY,kBAAkB,GAAG;EAC/C;;EAiBA,MAAM,sBAAmD;GACvD,MAAM,KAAK;GACX,OAAO,mBAAmB,KAAK,IAAI,OAAO;EAC5C;;EAGA,MAAM,oBAAoB,MAAoD;GAC5E,MAAM,KAAK;GACX,OAAO,mBAAmB,KAAK,IAAI,SAAS,IAAI;EAClD;;;;;;;EAQA,MAAM,eAAe,MAAkD;GACrE,MAAM,KAAK;GACX,MAAM,SAAS,MAAM,UAAU,KAAK,IAAI,SAAS,IAAI;GACrD,IAAI,KAAK,YAAY,MAAM,KAAK,IAAI,MAAM,mBAAmB;GAC7D,OAAO;EACT;CACF;AACF;;;AC/NA,MAAM,uBAAuB;AAE7B,MAAM,eACJ;AAIF,MAAM,sBACJ;AACF,MAAM,iBACJ;AAIF,MAAM,eACJ;;;;;;;;;AAmBF,IAAa,yBAAb,cAA4C,cAAuC;CACjF;CAEA,YAAY,KAAyB,KAA8B;EACjE,MAAM,KAAK,GAAG;EACd,IAAI;GACF,MAAM,MAAM,IAAI,SAAS;GACzB,IAAI,CAAC,OAAO,OAAO,IAAI,SAAS,YAAY;GAC5C,IAAI,KAAK,YAAY;GACrB,IAAI,KAAK,mBAAmB;GAC5B,KAAK,MAAM;EACb,QAAQ;GAEN,KAAK,MAAM,KAAA;EACb;CACF;CAEA,MAAM,MAAM,OAAe,iBAA2C;EACpE,MAAM,MAAM,KAAK;EACjB,IAAI,CAAC,KAAK,OAAO;EAEjB,MAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAK;EACzC,IAAI,CAAC,uBAAuB,OAAA,GAAsB,KAAK,CAAC,cAAc,iBAAiB,GAAG,GACxF,OAAO;EAGT,IAAI;GAGF,IAAI,KAAK,gBAAgB,KAAK,oBAAoB;GAElD,MAAM,SAAS,IAAI,KAAK,cAAc,OAAO,eAAe;GAC5D,IAAI,CAAC,UAAU,OAAO,OAAO,YAAY,YAAY,OAAO;GAC5D,MAAM,OAAgB,OAAO,QAAQ;GACrC,IAAI,CAAC,MAAM,QAAQ,IAAI,KAAK,KAAK,WAAW,GAAG,OAAO;GAEtD,MAAM,MAAe,KAAK;GAC1B,IAAI,OAAO,QAAQ,YAAY,QAAQ,MAAM,OAAO;GACpD,IACE,CAAC,OAAO,OAAO,KAAK,OAAO,KAC3B,CAAC,OAAO,OAAO,KAAK,YAAY,KAChC,EAAE,WAAW,QACb,EAAE,gBAAgB,MAElB,OAAO;GAET,OAAO,IAAI,UAAU,SAAS,IAAI,eAAe;EACnD,QAAQ;GACN,OAAO;EACT;CACF;AACF"}

package/dist/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","names":[],"sources":["../src/websocket/websocket-routing.ts","../src/cloudflare-application.ts","../src/cloudflare-factory.ts","../src/storage/storage.tokens.ts","../src/storage/storage-key-claim.ts","../src/storage/r2-storage.driver.ts","../src/storage/storage-manager.service.ts","../src/storage/storage.controller.ts","../src/storage/storage.service.ts","../src/storage/storage.module.ts","../src/services/kv-cache.store.ts","../src/services/flagship-flag.driver.ts","../src/services/kv-flag.driver.ts","../src/decorators/env.ts","../src/decorators/scheduled.ts","../src/decorators/queue-consumer.ts","../src/websocket/cloudflare-websocket.module.ts","../src/websocket/broadcast.ts","../src/rate-limit/cloudflare-rate-limit.store.ts","../src/nonce/durable-object-nonce.store.ts"],"sourcesContent":["import type { VelaContext as Context, VelaHono as Hono } from '@velajs/vela';\nimport { getMetadata, getTrustedRequestIdentity } from '@velajs/vela';\nimport {\n  authenticateWebSocketUpgrade,\n  resolveGatewayRoomId,\n  resolveGatewayRoomParam,\n  resolveMaxFrameBytes,\n  WS_GATEWAY_METADATA,\n  type WebSocketGatewayOptions,\n  type WebSocketUpgradeIdentity,\n} from '@velajs/vela/websocket';\nimport { durableObjectRoomName } from './room-id';\n\nexport interface WsGatewayRoute {\n  path: string;\n  binding: string;\n  options: WebSocketGatewayOptions;\n}\n\nconst MAX_IDENTITY_FIELD_BYTES = 2048;\nconst encoder = new TextEncoder();\n\ntype PrincipalType = 'user' | 'service';\n\ninterface ForwardedIdentity extends WebSocketUpgradeIdentity {\n  principal: {\n    issuer: string;\n    subject: string;\n    principalType: PrincipalType;\n  };\n  tenantId: string;\n  expiresAtMs: number;\n}\n\nfunction isIdentityField(value: unknown): value is string {\n  return (\n    typeof value === 'string' &&\n    value.length > 0 &&\n    !value.includes('\\r') &&\n    !value.includes('\\n') &&\n    encoder.encode(value).byteLength <= MAX_IDENTITY_FIELD_BYTES\n  );\n}\n\n/** `null` means an identity was present but violated the transport contract. */\nfunction accessIdentity(c: Context): ForwardedIdentity | null | undefined {\n  const value = getTrustedRequestIdentity(c.req.raw);\n  if (!value) return undefined;\n  const { principal, tenantId, expiresAtMs } = value;\n  if (\n    !isIdentityField(principal.issuer) ||\n    !isIdentityField(principal.subject) ||\n    !isIdentityField(tenantId) ||\n    typeof expiresAtMs !== 'number' ||\n    !Number.isSafeInteger(expiresAtMs) ||\n    expiresAtMs <= 0\n  )\n    return null;\n  return { principal, tenantId, expiresAtMs };\n}\n\n/** `null` means two independently verified identities disagree. */\nfunction combineIdentities(\n  requestIdentity: ForwardedIdentity | undefined,\n  upgradeIdentity: WebSocketUpgradeIdentity | undefined,\n): ForwardedIdentity | null | undefined {\n  if (!requestIdentity && !upgradeIdentity) return undefined;\n  if (!requestIdentity) return upgradeIdentity;\n  if (!upgradeIdentity) return requestIdentity;\n  if (\n    requestIdentity.principal.issuer !== upgradeIdentity.principal.issuer ||\n    requestIdentity.principal.subject !== upgradeIdentity.principal.subject ||\n    requestIdentity.principal.principalType !== upgradeIdentity.principal.principalType ||\n    requestIdentity.tenantId !== upgradeIdentity.tenantId\n  ) {\n    return null;\n  }\n  return {\n    principal: { ...upgradeIdentity.principal },\n    tenantId: upgradeIdentity.tenantId,\n    expiresAtMs: Math.min(requestIdentity.expiresAtMs, upgradeIdentity.expiresAtMs),\n  };\n}\n\n/** Read `@WebSocketGateway({ path, binding })` off a resolved instance (CF-hosted gateways only). */\nexport function collectWsGatewayRoutes(instance: object): WsGatewayRoute[] {\n  // Decorator metadata is the framework's explicit reflection boundary.\n  const options = getMetadata<WebSocketGatewayOptions>(WS_GATEWAY_METADATA, instance.constructor);\n  if (!options?.path || !options?.binding) return [];\n  resolveGatewayRoomParam(options);\n  resolveMaxFrameBytes(options);\n  return [{ path: options.path, binding: options.binding, options: { ...options } }];\n}\n\n/**\n * Registers the upgrade routes on the Worker's Hono app. Each route validates\n * the `Upgrade` header, resolves the room's Durable Object, and forwards the raw\n * request — injecting spoof-safe `x-vela-*` headers the DO reads. The DO returns\n * the `101` with the client socket.\n */\nexport function registerWebSocketRoutes(hono: Hono, routes: WsGatewayRoute[]): void {\n  for (const route of routes) {\n    hono.get(route.path, async (c: Context) => {\n      if (c.req.header('upgrade')?.toLowerCase() !== 'websocket') {\n        return c.text('Expected WebSocket upgrade', 426);\n      }\n\n      // Internal transport headers are never application credentials. Remove\n      // client-supplied values before even the pre-allocation authorization\n      // hook sees the request, then populate trusted values below.\n      const headers = new Headers(c.req.raw.headers);\n      headers.delete('x-vela-room');\n      headers.delete('x-vela-path');\n      headers.delete('x-vela-user');\n      headers.delete('x-vela-expires-at');\n      headers.delete('x-vela-expires-at-ms');\n      headers.delete('x-vela-issuer');\n      headers.delete('x-vela-subject');\n      headers.delete('x-vela-principal-type');\n      headers.delete('x-vela-tenant');\n      const sanitizedRequest = new Request(c.req.raw, { headers });\n\n      let roomId: string;\n      try {\n        roomId = resolveGatewayRoomId(route.options, (name) => c.req.param(name));\n      } catch {\n        return c.text('Invalid WebSocket room', 400);\n      }\n\n      // Origin, application authorization, and ticket/cookie authentication\n      // all complete before the gateway Durable Object id is resolved.\n      const upgrade = await authenticateWebSocketUpgrade(route.options, sanitizedRequest, roomId);\n      if (upgrade === false) return c.text('WebSocket upgrade forbidden', 403);\n\n      const requestIdentity = accessIdentity(c);\n      if (requestIdentity === null) return c.text('Invalid WebSocket identity', 403);\n      const identity = combineIdentities(requestIdentity, upgrade.identity);\n      if (identity === null) return c.text('Conflicting WebSocket identities', 403);\n      if (identity && identity.expiresAtMs <= Date.now()) {\n        return c.text('WebSocket identity expired', 403);\n      }\n\n      // Populate the ticket-free forwarding request with trusted server values.\n      const forwardHeaders = new Headers(upgrade.request.headers);\n      forwardHeaders.set('x-vela-room', roomId);\n      forwardHeaders.set('x-vela-path', route.path);\n      if (identity) {\n        forwardHeaders.set('x-vela-user', identity.principal.subject);\n        forwardHeaders.set('x-vela-issuer', identity.principal.issuer);\n        forwardHeaders.set('x-vela-subject', identity.principal.subject);\n        forwardHeaders.set('x-vela-principal-type', identity.principal.principalType);\n        forwardHeaders.set('x-vela-tenant', identity.tenantId);\n        forwardHeaders.set('x-vela-expires-at-ms', String(identity.expiresAtMs));\n      }\n\n      return forwardToRoom(\n        c.env,\n        route.binding,\n        route.path,\n        roomId,\n        new Request(upgrade.request, { headers: forwardHeaders }),\n      );\n    });\n  }\n}\n\n/**\n * Gateway metadata contains a runtime binding name, so the native type is\n * erased. Validate only the operations consumed here and their observable\n * results; never assert that an arbitrary value implements a native namespace.\n */\nasync function forwardToRoom(\n  env: unknown,\n  binding: string,\n  path: string,\n  room: string,\n  request: Request,\n): Promise<Response> {\n  if (typeof env !== 'object' || env === null) throw new Error('Worker environment is missing');\n  const namespace: unknown = Reflect.get(env, binding);\n  if (typeof namespace !== 'object' || namespace === null) {\n    return new Response(`Durable Object binding '${binding}' is not configured`, { status: 500 });\n  }\n  const idFromName: unknown = Reflect.get(namespace, 'idFromName');\n  const get: unknown = Reflect.get(namespace, 'get');\n  if (typeof idFromName !== 'function' || typeof get !== 'function') {\n    throw new Error('Invalid Durable Object namespace');\n  }\n  const id: unknown = Reflect.apply(idFromName, namespace, [durableObjectRoomName(path, room)]);\n  const stub: unknown = Reflect.apply(get, namespace, [id]);\n  if (typeof stub !== 'object' || stub === null) throw new Error('Invalid Durable Object stub');\n  const fetch: unknown = Reflect.get(stub, 'fetch');\n  if (typeof fetch !== 'function') throw new Error('Durable Object stub has no fetch operation');\n  const response: unknown = await Reflect.apply(fetch, stub, [request]);\n  if (!(response instanceof Response))\n    throw new Error('Durable Object returned an invalid response');\n  return response;\n}\n","import type { ExecutionContext } from 'hono';\nimport {\n  CRON_METADATA,\n  PipelineRunner,\n  buildEntrypointExecutionContext,\n  registerEntrypointKind,\n  getEntrypointModuleId,\n  resolveEntrypoint,\n  resolveScopedComponentsAsync,\n  resolveErrorReporter,\n  runInEntrypointScope,\n  shouldFilterCatch,\n  type VelaApplication,\n} from '@velajs/vela';\nimport type { Entrypoint, ExceptionFilter } from '@velajs/vela';\nimport { readWsEntrypointMeta } from '@velajs/vela/websocket';\nimport { collectWsGatewayRoutes, type WsGatewayRoute } from './websocket/websocket-routing';\nimport { assertCloudflareEnvironment } from './environment';\n\n// vela's own @Cron jobs run via the same Workers cron trigger — declare an\n// entrypoint kind over vela's metadata key (the open-kind system makes\n// cross-package declarations first-class).\nregisterEntrypointKind({ kind: 'cf:vela-cron', metaKey: CRON_METADATA, level: 'method' });\n\n/**\n * Options accepted by {@link CloudflareApplication.mountOpenApi}.\n *\n * Re-exposes vela's `MountOpenApiOptions` type — derived structurally from\n * the underlying `VelaApplication.mountOpenApi` signature so consumers don't\n * have to reach into vela's internal subpaths to type the argument.\n */\nexport type MountOpenApiOptions = Parameters<VelaApplication['mountOpenApi']>[0];\n\nfunction invoke(instance: object, methodName: string | symbol, args: unknown[]): unknown {\n  // Decorator metadata names an instance method; inspect it before invoking.\n  const method: unknown = Reflect.get(instance, methodName);\n  if (typeof method !== 'function') {\n    throw new Error(\n      `Method '${String(methodName)}' is not a function on ${instance.constructor.name}`,\n    );\n  }\n  return Reflect.apply(method, instance, args);\n}\n\nfunction entrypointString(meta: unknown, property: string): string {\n  if (typeof meta !== 'object' || meta === null) throw new Error('Invalid entrypoint metadata.');\n  const value: unknown = Reflect.get(meta, property);\n  if (typeof value !== 'string')\n    throw new Error(`Invalid entrypoint metadata: ${property} must be a string.`);\n  return value;\n}\n\n/** Wait for every matching handler, even when one fails before its siblings. */\nasync function settleEntrypoints(work: readonly Promise<void>[]): Promise<void> {\n  const outcomes = await Promise.allSettled(work);\n  const errors = outcomes.flatMap((outcome) =>\n    outcome.status === 'rejected' ? [outcome.reason] : [],\n  );\n  if (errors.length === 1) throw errors[0];\n  if (errors.length > 1) throw new AggregateError(errors, 'Multiple entrypoint handlers failed.');\n}\n\n/**\n * Wraps VelaApplication with Cloudflare-specific handlers:\n * - `fetch` — HTTP request handler (from Hono)\n * - `scheduled` — Cron trigger handler (matches `@Scheduled()` decorators\n *                 AND vela's own `@Cron()` jobs)\n * - `queue` — Queue consumer handler (matches `@QueueConsumer()` decorators)\n * - `mountOpenApi` — Serve an OpenAPI document (and optional Scalar UI) on\n *                    the underlying Hono app\n *\n * @example\n * ```ts\n * const app = await createCloudflareApp(AppModule, { env, envToken: ENV });\n * export default {\n *   fetch: app.fetch,\n *   scheduled: app.scheduled.bind(app),\n *   queue: app.queue.bind(app),\n * };\n * ```\n *\n * @example\n * ```ts\n * // Serve OpenAPI docs alongside your routes\n * const app = await createCloudflareApp(AppModule, { env, envToken: ENV });\n * const document = createOpenApiDocument(AppModule);\n * app.mountOpenApi({ document, ui: 'scalar' });\n * // GET /openapi.json -> JSON document\n * // GET /scalar       -> Scalar UI (loads from CDN)\n * ```\n */\nexport class CloudflareApplication<T extends object = object> {\n  readonly #wsGatewayRoutes: WsGatewayRoute[] = [];\n  readonly #app: VelaApplication;\n\n  constructor(\n    app: VelaApplication,\n    readonly env: T,\n  ) {\n    this.#app = app;\n    this.get = app.get.bind(app);\n  }\n\n  readonly fetch = async (request: Request, env: T, ctx?: ExecutionContext): Promise<Response> => {\n    assertCloudflareEnvironment(this.env, env);\n    return this.#app.fetch(request, env, ctx);\n  };\n\n  getHonoApp(): ReturnType<VelaApplication['getHonoApp']> {\n    return this.#app.getHonoApp();\n  }\n\n  /**\n   * Resolve a provider from the application's DI container (delegates to\n   * `VelaApplication.get`). Handy for grabbing a service — e.g. an auth service —\n   * to use inside `createCloudflareApp({ middleware: env => [...] })` request middleware,\n   * which runs outside the DI request pipeline.\n   *\n   * @example\n   * ```ts\n   * const app = await createCloudflareApp(AppModule, { env, envToken: ENV });\n   * const auth = app.get(BetterAuthService);\n   * ```\n   */\n  readonly get: VelaApplication['get'];\n\n  get entrypoints(): VelaApplication['entrypoints'] {\n    return this.#app.entrypoints;\n  }\n\n  /**\n   * Serve a pre-built OpenAPI document (and optionally a Scalar UI) on the\n   * underlying Hono app. Delegates verbatim to `VelaApplication.mountOpenApi`,\n   * so the JSON endpoint defaults to `/openapi.json` and the Scalar UI (when\n   * opted in) defaults to `/scalar`. Edge-safe — the UI HTML loads Scalar from\n   * a CDN at runtime, nothing is bundled server-side.\n   *\n   * @example\n   * ```ts\n   * import { createOpenApiDocument } from '@velajs/vela';\n   *\n   * const app = await createCloudflareApp(AppModule, { env, envToken: ENV });\n   * const document = createOpenApiDocument(AppModule, {\n   *   info: { title: 'My API', version: '1.0.0' },\n   * });\n   * app.mountOpenApi({ document, ui: 'scalar' });\n   * // GET /openapi.json -> { openapi: '3.1.0', ... }\n   * // GET /scalar       -> Scalar UI HTML\n   * ```\n   */\n  mountOpenApi(options: MountOpenApiOptions): this {\n    this.#app.mountOpenApi(options);\n    return this;\n  }\n\n  /**\n   * @internal Upgrade routes come from validated gateway entrypoints, including\n   * request-scoped gateways without a bootstrap instance. Retain the instance\n   * scan for legacy applications that only declare forwarding metadata.\n   */\n  scanInstances(instances: unknown[]): void {\n    const routes = new Map<string, WsGatewayRoute>();\n    for (const ep of this.#app.entrypoints.ofKind('websocket')) {\n      if (typeof ep.meta !== 'object' || ep.meta === null || !('dispatcher' in ep.meta)) continue;\n      const meta = readWsEntrypointMeta(ep.meta);\n      if (meta.options.binding) {\n        routes.set(meta.path, {\n          path: meta.path,\n          binding: meta.options.binding,\n          options: { ...meta.options },\n        });\n      }\n    }\n    for (const instance of instances) {\n      if (!instance || typeof instance !== 'object') continue;\n      for (const route of collectWsGatewayRoutes(instance)) {\n        if (!routes.has(route.path)) routes.set(route.path, route);\n      }\n    }\n    this.#wsGatewayRoutes.splice(0, this.#wsGatewayRoutes.length, ...routes.values());\n  }\n\n  /** @internal — upgrade routes discovered from the application's gateways. */\n  getWsGatewayRoutes(): WsGatewayRoute[] {\n    return [...this.#wsGatewayRoutes];\n  }\n\n  /**\n   * Handle Cloudflare scheduled (cron) events.\n   * Matches the event's cron expression to `@Scheduled()` and vela `@Cron()`\n   * handlers read from `app.entrypoints`; each handler runs inside a fresh\n   * request-scoped child (request-scoped providers rebuild per tick).\n   */\n  async scheduled(\n    event: { cron: string; scheduledTime?: number },\n    env: T,\n    ctx: { waitUntil: (promise: Promise<unknown>) => void },\n  ): Promise<void> {\n    assertCloudflareEnvironment(this.env, env);\n    const handlers = [\n      ...this.#app.entrypoints\n        .ofKind('cf:scheduled')\n        .map((ep) => ({ ep, cron: entrypointString(ep.meta, 'cron') })),\n      ...this.#app.entrypoints\n        .ofKind('cf:vela-cron')\n        .map((ep) => ({ ep, cron: entrypointString(ep.meta, 'expression') })),\n    ].filter((h) => h.cron === event.cron);\n\n    await settleEntrypoints(handlers.map(({ ep }) => this.dispatchEntrypoint(ep, event, env, ctx)));\n  }\n\n  /**\n   * Run one entrypoint handler inside a fresh request scope, through the\n   * shared guard → interceptor pipeline (components declared with\n   * `@UseGuards`/`@UseInterceptors`/`@UseFilters` on the consumer class or\n   * method). HTTP-global components deliberately do NOT apply — an HTTP auth\n   * guard has no business rejecting a queue batch. Unclaimed errors rethrow\n   * so the platform's retry semantics stay intact.\n   */\n  private async dispatchEntrypoint(\n    ep: Entrypoint,\n    payload: unknown,\n    env: T,\n    platformContext: { waitUntil: (promise: Promise<unknown>) => void },\n  ): Promise<void> {\n    const targetClass = ep.token;\n    if (typeof targetClass !== 'function') throw new Error('Entrypoint token must be a class.');\n    if (ep.methodName === undefined) throw new Error('Entrypoint must declare a handler method.');\n    const methodName = ep.methodName;\n    const reportContext = {\n      edge: ep.kind.startsWith('cf:queue') ? ('queue' as const) : ('schedule' as const),\n      source: `${targetClass.name}.${String(methodName)}`,\n    };\n    let reported: { error: unknown } | undefined;\n    try {\n      await runInEntrypointScope(this.#app.getContainer(), async (scope, lifetime) => {\n        const moduleId = getEntrypointModuleId(scope, ep);\n        const context = buildEntrypointExecutionContext(\n          ep.kind,\n          targetClass,\n          methodName,\n          payload,\n          moduleId,\n          scope,\n        );\n        const invocationContext = {\n          waitUntil(promise: Promise<unknown>): void {\n            lifetime.waitUntil(promise);\n            platformContext.waitUntil(promise);\n          },\n        };\n        let filters: ExceptionFilter[] = [];\n        try {\n          filters = (\n            await resolveScopedComponentsAsync('filter', targetClass, methodName, scope, moduleId)\n          ).toReversed();\n          const guards = await resolveScopedComponentsAsync(\n            'guard',\n            targetClass,\n            methodName,\n            scope,\n            moduleId,\n          );\n          const interceptors = await resolveScopedComponentsAsync(\n            'interceptor',\n            targetClass,\n            methodName,\n            scope,\n            moduleId,\n          );\n          await PipelineRunner.run({\n            context,\n            guards,\n            interceptors,\n            resolveArgs: async () => [payload, env, invocationContext],\n            invoke: async (args) => {\n              const instance = await resolveEntrypoint(scope, ep);\n              if (typeof instance !== 'object' || instance === null) {\n                throw new Error('Entrypoint must resolve to an object.');\n              }\n              return invoke(instance, methodName, args);\n            },\n          });\n        } catch (error) {\n          resolveErrorReporter(scope).report(error, reportContext);\n          for (const filter of filters) {\n            if (shouldFilterCatch(filter, error)) {\n              // Filters run closest-first; this is the framework catch hook.\n              // eslint-disable-next-line no-await-in-loop, promise/valid-params\n              await filter.catch(error, context);\n              return;\n            }\n          }\n          reported = { error };\n          throw error;\n        }\n      });\n    } catch (error) {\n      // Managed completion happens after the handler's filter boundary. Report\n      // a new completion failure without reporting an already-observed handler\n      // failure twice; preserve both errors in the rejected invocation.\n      if (!reported || reported.error !== error) {\n        const completionError =\n          reported && error instanceof AggregateError && error.errors[0] === reported.error\n            ? error.errors[1]\n            : error;\n        resolveErrorReporter(this.#app.getContainer()).report(completionError, reportContext);\n      }\n      throw error;\n    }\n  }\n\n  /**\n   * Handle Cloudflare Queue consumer events.\n   * Matches the batch queue name to `@QueueConsumer()` handlers read from\n   * `app.entrypoints`; each batch is processed inside a fresh request-scoped\n   * child (request-scoped providers rebuild per batch — no boot-time captives).\n   */\n  async queue(\n    batch: { queue: string; messages: readonly unknown[] },\n    env: T,\n    ctx: { waitUntil: (promise: Promise<unknown>) => void },\n  ): Promise<void> {\n    assertCloudflareEnvironment(this.env, env);\n    const handlers = [\n      ...this.#app.entrypoints.ofKind('cf:queue'),\n      ...this.#app.entrypoints.ofKind('cf:queue:module'),\n    ].filter((ep) => entrypointString(ep.meta, 'queueName') === batch.queue);\n\n    if (handlers.length === 0) throw new Error(`No consumer for queue '${batch.queue}'.`);\n\n    await settleEntrypoints(handlers.map((ep) => this.dispatchEntrypoint(ep, batch, env, ctx)));\n  }\n\n  async close(signal?: string): Promise<void> {\n    return this.#app.close(signal);\n  }\n}\n","import type { ExecutionContext } from 'hono';\nimport { getConnInfo } from 'hono/cloudflare-workers';\nimport { VelaFactory } from '@velajs/vela';\nimport type {\n  InjectionToken,\n  RuntimeAdapter,\n  VelaMiddlewareHandler,\n  VelaSecurityOptions,\n} from '@velajs/vela';\nimport { CloudflareApplication } from './cloudflare-application';\nimport { assertCloudflareEnvironment, registerCloudflareEnvironment } from './environment';\nimport { registerWebSocketRoutes } from './websocket/websocket-routing';\nimport { resolveCloudflareRoot } from './root-module';\nimport type { CloudflareRoot } from './root-module';\n\nexport interface CloudflareWorkerOptions<T extends object> {\n  /** Global typed DI token for the platform's native environment. */\n  envToken: InjectionToken<T>;\n  globalPrefix?: string;\n  security?: VelaSecurityOptions;\n  /** Build request middleware from the same typed native environment as DI. */\n  middleware?: (env: NoInfer<T>) => VelaMiddlewareHandler[];\n}\n\nexport interface CreateCloudflareAppOptions<T extends object> extends CloudflareWorkerOptions<T> {\n  /** Supply the platform environment inside fetch/queue/scheduled or a DO constructor. */\n  env: NoInfer<T>;\n}\n\n/** Bind an application to one environment before provider factories and lifecycle hooks. */\nexport function cloudflareAdapter<T extends object>(\n  options: CreateCloudflareAppOptions<T>,\n): RuntimeAdapter {\n  return {\n    name: 'cloudflare',\n    requestMiddleware: [\n      async (context, next) => {\n        assertCloudflareEnvironment(options.env, context.env);\n        await next();\n      },\n    ],\n    invocationTransport:\n      ({ app }) =>\n      (request) =>\n        Promise.resolve(app.fetch(request, options.env)),\n    getClientIp: (c) => getConnInfo(c).remote.address ?? null,\n    configureContainer: (container) => {\n      registerCloudflareEnvironment(container, { token: options.envToken, env: options.env });\n    },\n  };\n}\n\n/** Build an application for one native Workers environment. Call inside a platform event. */\nexport async function createCloudflareApp<T extends object>(\n  rootModule: CloudflareRoot<NoInfer<T>>,\n  options: CreateCloudflareAppOptions<T>,\n): Promise<CloudflareApplication<T>> {\n  const velaApp = await VelaFactory.create(await resolveCloudflareRoot(rootModule, options.env), {\n    globalPrefix: options.globalPrefix,\n    security: options.security,\n    middleware: options.middleware?.(options.env),\n    adapters: [cloudflareAdapter(options)],\n  });\n  const app = new CloudflareApplication(velaApp, options.env);\n  const consumers = new Map<string, string>();\n  for (const entry of [\n    ...app.entrypoints.ofKind('cf:queue'),\n    ...app.entrypoints.ofKind('cf:queue:module'),\n  ]) {\n    const meta = entry.meta;\n    if (\n      typeof meta !== 'object' ||\n      meta === null ||\n      !('queueName' in meta) ||\n      typeof meta.queueName !== 'string'\n    ) {\n      await app.close();\n      throw new TypeError('Invalid queue consumer metadata.');\n    }\n    const previous = consumers.get(meta.queueName);\n    // Existing native fan-out remains available; module routing owns a queue exclusively.\n    if (previous && (previous === 'cf:queue:module' || entry.kind === 'cf:queue:module')) {\n      await app.close();\n      throw new Error(`Ambiguous consumer ownership for queue '${meta.queueName}'.`);\n    }\n    consumers.set(meta.queueName, entry.kind);\n  }\n  app.scanInstances(velaApp.getInstances());\n  registerWebSocketRoutes(app.getHonoApp(), app.getWsGatewayRoutes());\n  return app;\n}\n\n/**\n * Worker entrypoint with one bootstrap per environment identity. Weak keys let\n * obsolete environments and secrets be collected. Concurrent cold events share\n * construction; failed construction is evicted so the next event can retry.\n */\nexport function createCloudflareWorker<T extends object>(\n  rootModule: CloudflareRoot<NoInfer<T>>,\n  options: CloudflareWorkerOptions<T>,\n) {\n  const applications = new WeakMap<T, Promise<CloudflareApplication<T>>>();\n  const application = (env: T): Promise<CloudflareApplication<T>> => {\n    const existing = applications.get(env);\n    if (existing) return existing;\n    const pending = createCloudflareApp(rootModule, { ...options, env });\n    applications.set(env, pending);\n    void pending.catch(() => {\n      if (applications.get(env) === pending) applications.delete(env);\n    });\n    return pending;\n  };\n  return {\n    async fetch(request: Request, env: T, ctx: ExecutionContext): Promise<Response> {\n      return (await application(env)).fetch(request, env, ctx);\n    },\n    async scheduled(\n      event: { cron: string; scheduledTime?: number },\n      env: T,\n      ctx: { waitUntil: (promise: Promise<unknown>) => void },\n    ): Promise<void> {\n      return (await application(env)).scheduled(event, env, ctx);\n    },\n    async queue(\n      batch: { queue: string; messages: readonly unknown[] },\n      env: T,\n      ctx: { waitUntil: (promise: Promise<unknown>) => void },\n    ): Promise<void> {\n      return (await application(env)).queue(batch, env, ctx);\n    },\n  };\n}\n","import { InjectionToken } from '@velajs/vela';\nimport type { StorageModuleOptions } from './storage.types';\n\nexport const STORAGE_OPTIONS = new InjectionToken<StorageModuleOptions>('STORAGE_OPTIONS');\n","/** R2-compatible object-key claim bound. Keeps decode work predictably small. */\nexport const MAX_STORAGE_KEY_BYTES = 1024;\n\nconst BASE64URL_RE = /^[A-Za-z0-9_-]+$/;\nconst ROOT_TOKEN_PATTERNS: Record<string, string> = {\n  date: '\\\\d{4}-\\\\d{2}-\\\\d{2}',\n  year: '\\\\d{4}',\n  month: '(?:0[1-9]|1[0-2])',\n  day: '(?:0[1-9]|[12]\\\\d|3[01])',\n  uuid: '[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}',\n};\n\n/** Encode an object key as an opaque, canonical base64url query claim. */\nexport function encodeStorageKeyClaim(key: string): string {\n  const bytes = new TextEncoder().encode(key);\n  if (bytes.byteLength === 0 || bytes.byteLength > MAX_STORAGE_KEY_BYTES) {\n    throw new Error(`Storage key must be 1–${MAX_STORAGE_KEY_BYTES} UTF-8 bytes`);\n  }\n  let binary = '';\n  for (const byte of bytes) binary += String.fromCharCode(byte);\n  return btoa(binary).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '');\n}\n\n/** Decode exactly one canonical base64url layer. Malformed/non-UTF-8 claims return undefined. */\nexport function decodeStorageKeyClaim(claim: string): string | undefined {\n  try {\n    if (\n      claim.length === 0 ||\n      claim.length > Math.ceil((MAX_STORAGE_KEY_BYTES * 4) / 3) ||\n      !BASE64URL_RE.test(claim) ||\n      claim.length % 4 === 1\n    ) {\n      return undefined;\n    }\n    const base64 = claim.replace(/-/g, '+').replace(/_/g, '/');\n    const padded = base64 + '='.repeat((4 - (base64.length % 4)) % 4);\n    const binary = atob(padded);\n    const bytes = new Uint8Array(new ArrayBuffer(binary.length));\n    for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);\n    if (bytes.byteLength === 0 || bytes.byteLength > MAX_STORAGE_KEY_BYTES) return undefined;\n    const decoded = new TextDecoder('utf-8', { fatal: true, ignoreBOM: false }).decode(bytes);\n    return encodeStorageKeyClaim(decoded) === claim ? decoded : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction isDotSegment(segment: string): boolean {\n  let decoded = segment;\n  for (let i = 0; i < 2; i++) {\n    if (decoded === '' || decoded === '.' || decoded === '..') return true;\n    try {\n      const next = decodeURIComponent(decoded);\n      if (next === decoded) break;\n      decoded = next;\n    } catch {\n      break;\n    }\n  }\n  return decoded === '' || decoded === '.' || decoded === '..';\n}\n\nfunction rootSegmentPattern(segment: string): string {\n  let pattern = '';\n  let cursor = 0;\n  for (const match of segment.matchAll(/\\{(date|year|month|day|uuid)\\}/g)) {\n    pattern += segment.slice(cursor, match.index).replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n    pattern += ROOT_TOKEN_PATTERNS[match[1]!]!;\n    cursor = match.index! + match[0].length;\n  }\n  pattern += segment.slice(cursor).replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n  return pattern;\n}\n\n/** Assert a canonical key is beneath a static or templated configured root. */\nexport function isStorageKeyWithinRoot(key: string, root: string | undefined): boolean {\n  const segments = (root ?? '').split(/[/\\\\]+/).filter((segment) => !isDotSegment(segment));\n  if (segments.length === 0) return key.length > 0;\n  const rootPattern = segments.map(rootSegmentPattern).join('/');\n  return new RegExp(`^(?:${rootPattern})(?:/|$)`).test(key);\n}\n","import {\n  signUrl,\n  STORAGE_SIGNED_URL_PURPOSE,\n  type DownloadResult,\n  type PresignedUrlResult,\n  type PresignMethod,\n  type StorageBody,\n  type StorageDriver,\n  type UploadOptions,\n  type UploadResult,\n} from '@velajs/vela/storage';\nimport { encodeStorageKeyClaim } from './storage-key-claim';\n\n/** Base path of the StorageController presign-proxy route. */\nexport const STORAGE_ROUTE_BASE = '/storage';\n\nexport interface R2StorageDriverConfig {\n  disk: string;\n  bucket: R2Bucket;\n  /** HMAC secret for presigned URLs (typically env.APP_SECRET). */\n  secret?: string;\n}\n\n/** {@link StorageDriver} over a Cloudflare R2 bucket. */\nexport class R2StorageDriver implements StorageDriver {\n  constructor(private readonly config: R2StorageDriverConfig) {}\n\n  async upload(body: StorageBody, path: string, options: UploadOptions): Promise<UploadResult> {\n    await this.config.bucket.put(\n      path,\n      body as ReadableStream | ArrayBuffer | ArrayBufferView | string | Blob | null,\n      {\n        httpMetadata: options.mimeType ? { contentType: options.mimeType } : undefined,\n        customMetadata: options.metadata,\n      },\n    );\n    return {\n      path,\n      disk: this.config.disk,\n      size: options.size,\n      mimeType: options.mimeType ?? 'application/octet-stream',\n      uploadedAt: new Date(),\n    };\n  }\n\n  async download(path: string): Promise<DownloadResult> {\n    const obj = await this.config.bucket.get(path);\n    if (!obj) throw new Error(`Storage object not found at \"${path}\".`);\n    return {\n      toStream: () => obj.body as ReadableStream,\n      toArrayBuffer: () => obj.arrayBuffer(),\n      toText: () => obj.text(),\n      contentType: obj.httpMetadata?.contentType ?? 'application/octet-stream',\n      size: obj.size,\n      metadata: obj.customMetadata,\n    };\n  }\n\n  async delete(path: string): Promise<void> {\n    await this.config.bucket.delete(path);\n  }\n\n  async exists(path: string): Promise<boolean> {\n    return (await this.config.bucket.head(path)) !== null;\n  }\n\n  async getPresignedUrl(\n    path: string,\n    method: PresignMethod,\n    expiresIn: number,\n  ): Promise<PresignedUrlResult> {\n    if (!this.config.secret) {\n      throw new Error('A signing secret is required for presigned URLs (set APP_SECRET).');\n    }\n    // Defend the direct-driver path too: a non-finite/non-positive expiry would\n    // make signUrl omit `expires`, yielding a never-expiring URL.\n    if (!Number.isSafeInteger(expiresIn) || expiresIn <= 0) {\n      throw new Error(\n        `Invalid presigned URL expiry: ${expiresIn}s (must be a positive safe integer).`,\n      );\n    }\n    // The object key is an opaque signed query claim, never a URL path. This\n    // prevents WHATWG path normalization / multi-decode behavior from turning\n    // an encoded key into a different storage capability.\n    const claim = encodeStorageKeyClaim(path);\n    const routePath = `${STORAGE_ROUTE_BASE}/${encodeURIComponent(this.config.disk)}`;\n    const query = new URLSearchParams({ key: claim, method });\n    const url = await signUrl(`${routePath}?${query}`, this.config.secret, {\n      expiresIn,\n      method,\n      purpose: STORAGE_SIGNED_URL_PURPOSE,\n    });\n    return { url, method, expiresIn, expiresAt: new Date(Date.now() + expiresIn * 1000) };\n  }\n}\n","import { Inject, Injectable } from '@velajs/vela';\nimport { R2StorageDriver } from './r2-storage.driver';\nimport { STORAGE_OPTIONS } from './storage.tokens';\nimport type { DiskConfig, StorageModuleOptions } from './storage.types';\n\n@Injectable()\nexport class StorageManagerService {\n  constructor(@Inject(STORAGE_OPTIONS) private readonly options: StorageModuleOptions) {}\n\n  hasDisk(disk: string): boolean {\n    return this.options.disks.some((d) => d.disk === disk);\n  }\n\n  getDiskConfig(disk: string): DiskConfig {\n    const config = this.options.disks.find((d) => d.disk === disk);\n    if (!config) throw new Error(`Storage disk \"${disk}\" is not configured.`);\n    return config;\n  }\n\n  getDriver(disk: string): R2StorageDriver {\n    const config = this.getDiskConfig(disk);\n    return new R2StorageDriver({ disk, bucket: config.bucket, secret: this.options.secret });\n  }\n}\n","import { Controller, Get, Inject, Req } from '@velajs/vela';\nimport { joinStoragePath, STORAGE_SIGNED_URL_PURPOSE, verifySignedUrl } from '@velajs/vela/storage';\nimport type { Context } from 'hono';\nimport { STORAGE_OPTIONS } from './storage.tokens';\nimport type { StorageModuleOptions } from './storage.types';\nimport { StorageManagerService } from './storage-manager.service';\nimport { decodeStorageKeyClaim, isStorageKeyWithinRoot } from './storage-key-claim';\n\n/**\n * Presign-proxy: serves objects for HMAC-signed URLs produced by\n * `StorageService.url()`. R2 has no native presign, so a signed URL points here;\n * this route verifies the signature (+expiry) before streaming the object.\n * The FULL object key (root already applied at sign time) is carried as an\n * opaque base64url query claim. The signature is verified before the claim is\n * decoded exactly once and checked against the configured disk root.\n */\n@Controller('storage')\nexport class StorageController {\n  constructor(\n    @Inject(StorageManagerService) private readonly manager: StorageManagerService,\n    @Inject(STORAGE_OPTIONS) private readonly options: StorageModuleOptions,\n  ) {}\n\n  @Get('/:disk')\n  async download(@Req() c: Context): Promise<Response> {\n    const secret = this.options.secret;\n    if (!secret) return new Response('Storage signing is not configured', { status: 500 });\n\n    // Verify the complete path/query capability before inspecting the disk or\n    // decoding attacker-controlled claims.\n    if (\n      !(await verifySignedUrl(c.req.url, secret, {\n        method: c.req.method,\n        purpose: STORAGE_SIGNED_URL_PURPOSE,\n      }))\n    ) {\n      return new Response('Invalid or expired URL', { status: 403 });\n    }\n\n    // Enforce the signed `method` scope: this proxy only serves reads, so a URL\n    // scoped to PUT/DELETE/HEAD must NOT be honored as a GET (it would over-grant\n    // read access relative to the token's intended scope). The param is part of\n    // the signed payload, so it is trustworthy once the signature verifies.\n    const url = new URL(c.req.url);\n    if (url.searchParams.get('method') !== 'GET') {\n      return new Response('URL is not scoped for reads', { status: 403 });\n    }\n\n    const disk = c.req.param('disk');\n    if (!disk || !this.manager.hasDisk(disk)) return new Response('Unknown disk', { status: 404 });\n\n    const claim = url.searchParams.get('key');\n    const decoded = claim ? decodeStorageKeyClaim(claim) : undefined;\n    if (!decoded) return new Response('Malformed storage key claim', { status: 400 });\n\n    // Canonicalize after the one decode. Signed direct-driver callers cannot\n    // smuggle dot segments or non-canonical aliases into the proxy contract.\n    const fullPath = joinStoragePath(undefined, decoded);\n    if (fullPath !== decoded) return new Response('Invalid storage key', { status: 403 });\n\n    if (!isStorageKeyWithinRoot(fullPath, this.manager.getDiskConfig(disk).root)) {\n      return new Response('Storage key is outside the configured root', { status: 403 });\n    }\n\n    try {\n      const result = await this.manager.getDriver(disk).download(fullPath);\n      const filename = fullPath.split('/').at(-1) || 'download';\n      return new Response(result.toStream(), {\n        headers: {\n          'content-type': result.contentType || 'application/octet-stream',\n          // Objects are untrusted user content.  The authenticated API origin\n          // never renders them inline (especially HTML/SVG), even when the\n          // stored Content-Type is attacker controlled.\n          'content-disposition': `attachment; filename*=UTF-8''${encodeURIComponent(filename)}`,\n          'x-content-type-options': 'nosniff',\n        },\n      });\n    } catch {\n      return new Response('Not found', { status: 404 });\n    }\n  }\n}\n","import { Inject, Injectable } from '@velajs/vela';\nimport {\n  joinStoragePath,\n  type DownloadResult,\n  type PresignedUrlResult,\n  type PresignMethod,\n  type StorageBody,\n  type UploadOptions,\n  type UploadResult,\n} from '@velajs/vela/storage';\nimport { StorageManagerService } from './storage-manager.service';\nimport { STORAGE_OPTIONS } from './storage.tokens';\nimport type { StorageModuleOptions } from './storage.types';\n\nconst DEFAULT_PRESIGN = { defaultExpiry: 3600, maxExpiry: 86400 };\n\n/**\n * Multi-disk storage facade. Applies each disk's (templated) root, resolves the\n * driver, and validates presign expiry. Injectable anywhere via `StorageService`.\n */\n@Injectable()\nexport class StorageService {\n  constructor(\n    @Inject(STORAGE_OPTIONS) private readonly options: StorageModuleOptions,\n    @Inject(StorageManagerService) private readonly manager: StorageManagerService,\n  ) {}\n\n  put(\n    relativePath: string,\n    body: StorageBody,\n    options: UploadOptions = {},\n    disk?: string,\n  ): Promise<UploadResult> {\n    const name = this.resolveDisk(disk);\n    return this.manager.getDriver(name).upload(body, this.fullPath(relativePath, name), options);\n  }\n\n  get(relativePath: string, disk?: string): Promise<DownloadResult> {\n    const name = this.resolveDisk(disk);\n    return this.manager.getDriver(name).download(this.fullPath(relativePath, name));\n  }\n\n  delete(relativePath: string, disk?: string): Promise<void> {\n    const name = this.resolveDisk(disk);\n    return this.manager.getDriver(name).delete(this.fullPath(relativePath, name));\n  }\n\n  exists(relativePath: string, disk?: string): Promise<boolean> {\n    const name = this.resolveDisk(disk);\n    return this.manager.getDriver(name).exists(this.fullPath(relativePath, name));\n  }\n\n  url(\n    relativePath: string,\n    method: PresignMethod = 'GET',\n    expiresIn?: number,\n    disk?: string,\n  ): Promise<PresignedUrlResult> {\n    const name = this.resolveDisk(disk);\n    return this.manager\n      .getDriver(name)\n      .getPresignedUrl(this.fullPath(relativePath, name), method, this.validateExpiry(expiresIn));\n  }\n\n  private resolveDisk(disk?: string): string {\n    const name = disk ?? this.options.defaultDisk;\n    if (!this.manager.hasDisk(name)) throw new Error(`Storage disk \"${name}\" is not configured.`);\n    return name;\n  }\n\n  private fullPath(relativePath: string, disk: string): string {\n    return joinStoragePath(this.manager.getDiskConfig(disk).root, relativePath);\n  }\n\n  private validateExpiry(expiresIn?: number): number {\n    const cfg = this.options.presignedUrl ?? DEFAULT_PRESIGN;\n    const value = expiresIn ?? cfg.defaultExpiry;\n    // `Number.isSafeInteger` rejects NaN/fractional/infinite values — otherwise\n    // `NaN < 1 || NaN > max` is false,\n    // NaN slips through, signUrl omits `expires`, and the URL never expires.\n    if (!Number.isSafeInteger(value) || value < 1 || value > cfg.maxExpiry) {\n      throw new Error(`Presigned URL expiry ${value}s is out of range (1–${cfg.maxExpiry}s).`);\n    }\n    return value;\n  }\n}\n","import { ConfigurableModuleBuilder, Module } from '@velajs/vela';\nimport { StorageController } from './storage.controller';\nimport { StorageManagerService } from './storage-manager.service';\nimport { StorageService } from './storage.service';\nimport { STORAGE_OPTIONS } from './storage.tokens';\nimport type { StorageModuleOptions } from './storage.types';\n\nconst { ConfigurableModuleClass } = new ConfigurableModuleBuilder<StorageModuleOptions>({\n  moduleName: 'Storage',\n  optionsInjectionToken: STORAGE_OPTIONS,\n}).build();\n\n@Module({\n  providers: [StorageManagerService, StorageService],\n  controllers: [StorageController],\n  exports: [StorageService, StorageManagerService, STORAGE_OPTIONS],\n})\nexport class StorageModule extends ConfigurableModuleClass {}\n","import {\n  type AsyncCacheStore,\n  type CacheEntryReader,\n  type CacheEntryWriter,\n  type CacheEntry,\n  type CacheInvalidationStore,\n} from '@velajs/vela';\n\n/**\n * Native KV JSON value store. Metadata retains logical expiry even when KV's\n * physical retention rounds up to its 60-second minimum. Legacy values without\n * metadata remain readable, but cannot safely backfill another tier.\n */\nexport class KVCacheStore implements AsyncCacheStore, CacheEntryReader, CacheEntryWriter {\n  constructor(private readonly ns: KVNamespace) {}\n\n  async get(key: string): Promise<unknown> {\n    return (await this.getEntry(key))?.value;\n  }\n\n  async getEntry(key: string): Promise<{ value: unknown; expiresAt?: number } | undefined> {\n    const { value, metadata } = await this.ns.getWithMetadata<unknown, unknown>(key, 'json');\n    if (value === null) return undefined;\n    if (typeof metadata === 'object' && metadata !== null && 'velaCacheExpiresAt' in metadata) {\n      const expiresAt = metadata.velaCacheExpiresAt;\n      if (typeof expiresAt !== 'number' || !Number.isFinite(expiresAt) || expiresAt <= Date.now())\n        return undefined;\n      return { value, expiresAt };\n    }\n    return { value };\n  }\n\n  async set(key: string, value: unknown, ttl?: number): Promise<void> {\n    if (ttl !== undefined && (!Number.isFinite(ttl) || ttl < 0))\n      throw new TypeError('Cache TTL must be finite and nonnegative.');\n    if (ttl !== undefined) return this.setEntry(key, { value, expiresAt: Date.now() + ttl * 1000 });\n    await this.ns.put(key, JSON.stringify(value));\n  }\n\n  async setEntry(key: string, entry: CacheEntry): Promise<void> {\n    if (!Number.isFinite(entry.expiresAt)) throw new TypeError('Cache expiry must be finite.');\n    const remaining = (entry.expiresAt - Date.now()) / 1000;\n    if (remaining <= 0) return this.del(key);\n    await this.ns.put(key, JSON.stringify(entry.value), {\n      expirationTtl: Math.max(60, Math.ceil(remaining)),\n      metadata: { velaCacheExpiresAt: entry.expiresAt },\n    });\n  }\n\n  async del(key: string): Promise<void> {\n    await this.ns.delete(key);\n  }\n\n  /** Namespace-wide, best effort. Use a dedicated value namespace; never use for scoped invalidation. */\n  async clear(): Promise<void> {\n    let cursor: string | undefined;\n    do {\n      const list = await this.ns.list(cursor ? { cursor } : undefined);\n      await Promise.all(list.keys.map((entry) => this.ns.delete(entry.name)));\n      cursor = list.list_complete ? undefined : list.cursor;\n    } while (cursor);\n  }\n}\n\n/**\n * Optional, eventually consistent generation store. Use a dedicated KV namespace\n * without TTL/lifecycle cleanup. Never delete/reset generations while entries can\n * survive. Concurrent writes and cached/negative reads prevent strong invalidation;\n * this is unsuitable for strict read-after-write or authorization revocation.\n */\nexport class KVCacheInvalidationStore implements CacheInvalidationStore {\n  constructor(private readonly ns: KVNamespace) {}\n  async getVersion(key: string): Promise<string> {\n    const value: unknown = await this.ns.get(key, 'json');\n    if (value === null) return 'initial';\n    if (typeof value !== 'string' || value.length === 0 || value.length > 2048)\n      throw new TypeError('Invalid cache generation.');\n    return value;\n  }\n  async invalidate(key: string): Promise<void> {\n    await this.ns.put(key, JSON.stringify(crypto.randomUUID()));\n  }\n}\n","import type { FeatureFlagDriver, FlagContext } from '@velajs/feature-flags';\n\n/**\n * The subset of a Cloudflare **Flagship** binding this driver evaluates against\n * — the four typed value methods. The binding itself returns the supplied\n * `defaultValue` on evaluation errors; transport-level failures reject and are\n * left to propagate (never-throw is the service layer's job, not the driver's).\n *\n * @see https://developers.cloudflare.com/flagship/binding/\n */\nexport interface FlagshipBinding {\n  getBooleanValue(key: string, defaultValue: boolean, context?: FlagContext): Promise<boolean>;\n  getStringValue(key: string, defaultValue: string, context?: FlagContext): Promise<string>;\n  getNumberValue(key: string, defaultValue: number, context?: FlagContext): Promise<number>;\n  getObjectValue(key: string, defaultValue: object, context?: FlagContext): Promise<unknown>;\n}\n\nexport interface FlagshipFlagDriverOptions {\n  /** Driver name used for `use(name)` / default-driver selection. Default `\"flagship\"`. */\n  name?: string;\n}\n\n/**\n * {@link FeatureFlagDriver} backed by a Cloudflare Flagship binding.\n *\n * A thin, honest wrapper: each contract method maps 1:1 onto the binding's\n * corresponding value method, forwarding the caller's `fallback` (the binding's\n * `defaultValue`) and evaluation context. The binding resolves the fallback on\n * evaluation errors; anything the binding *rejects* with (e.g. a `remote: true`\n * dev-proxy tunnel dropping) propagates — `@velajs/feature-flags`'s service owns\n * the never-throw guarantee.\n *\n * Build the driver inside a provider factory with the native environment:\n *\n * ```ts\n * FeatureFlagsModule.forRootAsync({\n *   inject: [ENV],\n *   useFactory: (env: WorkerEnv) => ({ drivers: [flagshipFlagDriver(env.FLAGS)] }),\n * });\n * ```\n *\n * Evaluation ergonomics (the 1:1 binding-method mapping) are ported from the\n * Stratal feature-flags service (MIT, © Temitayo Fadojutimi), reshaped as a\n * bare driver.\n */\nexport class FlagshipFlagDriver implements FeatureFlagDriver {\n  readonly name: string;\n  private readonly resolve: () => FlagshipBinding;\n\n  constructor(\n    binding: FlagshipBinding | (() => FlagshipBinding),\n    options: FlagshipFlagDriverOptions = {},\n  ) {\n    this.resolve = typeof binding === 'function' ? binding : () => binding;\n    this.name = options.name ?? 'flagship';\n  }\n\n  getBoolean(key: string, fallback: boolean, ctx?: FlagContext): Promise<boolean> {\n    return this.resolve().getBooleanValue(key, fallback, ctx);\n  }\n\n  getString(key: string, fallback: string, ctx?: FlagContext): Promise<string> {\n    return this.resolve().getStringValue(key, fallback, ctx);\n  }\n\n  getNumber(key: string, fallback: number, ctx?: FlagContext): Promise<number> {\n    return this.resolve().getNumberValue(key, fallback, ctx);\n  }\n\n  getObject(key: string, fallback: object, ctx?: FlagContext): Promise<unknown> {\n    return this.resolve().getObjectValue(key, fallback, ctx);\n  }\n}\n\n/** Convenience factory for {@link FlagshipFlagDriver}. */\nexport function flagshipFlagDriver(\n  binding: FlagshipBinding | (() => FlagshipBinding),\n  options?: FlagshipFlagDriverOptions,\n): FlagshipFlagDriver {\n  return new FlagshipFlagDriver(binding, options);\n}\n","import type { FeatureFlagDriver, FlagContext } from '@velajs/feature-flags';\n\nexport interface KvFlagDriverOptions {\n  /** Driver name used for `use(name)` / default-driver selection. Default `\"kv\"`. */\n  name?: string;\n  /** Prefix prepended to every flag key before the KV read. Default `\"\"` (none). */\n  prefix?: string;\n}\n\n/**\n * Cloudflare KV-backed {@link FeatureFlagDriver}. Flags are stored as JSON\n * values under an optional key prefix and read with `get(key, 'json')`. Reads\n * are type-checked against the requested type: a missing key or a value of the\n * wrong JSON type returns the caller's `fallback`. KV has no targeting, so the\n * evaluation context is ignored.\n *\n * The driver stays honest — it does **not** swallow errors. A KV failure (or a\n * `SyntaxError` from a malformed stored value) propagates; the never-throw\n * guarantee lives in `@velajs/feature-flags`'s service layer.\n *\n * Placed like {@link KVCacheStore}: construct it in a wiring factory over a\n * resolved {@link KVNamespace}.\n *\n * ```ts\n * FeatureFlagsModule.forRootAsync({\n *   inject: [ENV],\n *   useFactory: (env: WorkerEnv) => ({ drivers: [new KvFlagDriver(env.CACHE, { prefix: 'flag:' })] }),\n * });\n * ```\n */\nexport class KvFlagDriver implements FeatureFlagDriver {\n  readonly name: string;\n  private readonly prefix: string;\n\n  constructor(\n    private readonly ns: KVNamespace,\n    options: KvFlagDriverOptions = {},\n  ) {\n    this.name = options.name ?? 'kv';\n    this.prefix = options.prefix ?? '';\n  }\n\n  getBoolean(key: string, fallback: boolean, _ctx?: FlagContext): Promise<boolean> {\n    return this.read(key, fallback, (v) => typeof v === 'boolean');\n  }\n\n  getString(key: string, fallback: string, _ctx?: FlagContext): Promise<string> {\n    return this.read(key, fallback, (v) => typeof v === 'string');\n  }\n\n  getNumber(key: string, fallback: number, _ctx?: FlagContext): Promise<number> {\n    return this.read(key, fallback, (v) => typeof v === 'number');\n  }\n\n  getObject(key: string, fallback: object, _ctx?: FlagContext): Promise<unknown> {\n    return this.read(key, fallback, (v) => typeof v === 'object' && v !== null);\n  }\n\n  /**\n   * Reads and JSON-parses the (prefixed) key, returning the parsed value only\n   * when `matches` accepts its type; otherwise the caller's fallback. A missing\n   * key reads as `null` → fallback. Read/parse errors are left to propagate.\n   */\n  private async read<T>(\n    key: string,\n    fallback: T,\n    matches: (value: unknown) => value is T,\n  ): Promise<T> {\n    const value = await this.ns.get(this.prefix + key, 'json');\n    if (value === null || value === undefined) return fallback;\n    return matches(value) ? value : fallback;\n  }\n}\n\n/** Convenience factory for {@link KvFlagDriver}. */\nexport function kvFlagDriver(kv: KVNamespace, options?: KvFlagDriverOptions): KvFlagDriver {\n  return new KvFlagDriver(kv, options);\n}\n","import { createParamDecorator } from '@velajs/vela';\n\n/**\n * Parameter decorator to inject Cloudflare environment bindings.\n *\n * Without arguments, returns the entire `env` object.\n * With a binding name, returns that specific binding.\n *\n * @example\n * ```ts\n * @Get()\n * handle(@Env() env: WorkerEnv) { ... }\n *\n * @Get()\n * handle(@Env('MY_KV') kv: KVNamespace) { ... }\n * ```\n */\nexport const Env = createParamDecorator<string | undefined>((bindingName, ctx): unknown => {\n  // Hono Context has .env on Cloudflare Workers\n  const env: unknown = ctx.getContext().env;\n  if (typeof env !== 'object' || env === null) return undefined;\n  return bindingName ? Reflect.get(env, bindingName) : env;\n});\n","import { defineMetadata, getMetadata, parseCron, registerEntrypointKind } from '@velajs/vela';\n\nconst SCHEDULED_METADATA_KEY = 'cloudflare:scheduled';\n\n// Open entrypoint kind: adapters enumerate cron handlers via\n// `app.entrypoints.ofKind('cf:scheduled')` — declared next to the decorator.\nregisterEntrypointKind({ kind: 'cf:scheduled', metaKey: SCHEDULED_METADATA_KEY, level: 'method' });\n\nexport interface ScheduledMetadata {\n  cron: string;\n  methodName: string;\n}\n\n/** Compatible with the existing programmatic scheduled() entrypoint. */\nexport interface ScheduledEvent {\n  readonly cron: string;\n  readonly scheduledTime?: number;\n}\n\n/** Native controller passed unchanged to a Worker handler. Call noRetry on its receiver. */\nexport interface ScheduledController extends ScheduledEvent {\n  readonly scheduledTime: number;\n  noRetry(): void;\n}\n\nexport interface ScheduledContext {\n  waitUntil(promise: Promise<unknown>): void;\n}\n\nexport type ScheduledHandler<Env extends object = object> = (\n  controller: ScheduledController,\n  env: Env,\n  context: ScheduledContext,\n) => void | Promise<void>;\n\nexport function parseScheduledMetadata(value: unknown): ScheduledMetadata {\n  if (\n    typeof value !== 'object' ||\n    value === null ||\n    !('cron' in value) ||\n    typeof value.cron !== 'string' ||\n    !('methodName' in value) ||\n    typeof value.methodName !== 'string' ||\n    !parseCron(value.cron, { dialect: 'cloudflare' })\n  ) {\n    throw new TypeError('Invalid Cloudflare scheduled metadata');\n  }\n  return { cron: value.cron, methodName: value.methodName };\n}\n\n/**\n * Marks a method as a scheduled (cron) handler.\n *\n * @example\n * ```ts\n * @Injectable()\n * class WorkerService {\n *   @Scheduled('0 * * * *')\n *   async hourlyCron() {\n *     console.log('Running hourly');\n *   }\n * }\n * ```\n */\nexport function Scheduled(cron: string): MethodDecorator {\n  if (!parseCron(cron, { dialect: 'cloudflare' })) {\n    throw new TypeError(`Invalid Cloudflare cron expression: ${cron}`);\n  }\n  return (target: object, propertyKey: string | symbol, _descriptor: PropertyDescriptor) => {\n    // Work with a validated copy rather than mutating the registry's handler list.\n    const existing = getScheduledMetadata(target);\n    existing.push({ cron, methodName: String(propertyKey) });\n    defineMetadata(SCHEDULED_METADATA_KEY, existing, target.constructor);\n  };\n}\n\nexport function getScheduledMetadata(target: object): ScheduledMetadata[] {\n  const ctor = typeof target === 'function' ? target : target.constructor;\n  const value: unknown = getMetadata(SCHEDULED_METADATA_KEY, ctor);\n  if (value === undefined) return [];\n  if (!Array.isArray(value)) throw new TypeError('Invalid Cloudflare scheduled metadata list');\n  return value.map(parseScheduledMetadata);\n}\n","import { defineMetadata, getMetadata, registerEntrypointKind } from '@velajs/vela';\n\nconst QUEUE_CONSUMER_METADATA_KEY = 'cloudflare:queue-consumer';\n\n// Open entrypoint kind: any adapter can enumerate queue consumers via\n// `app.entrypoints.ofKind('cf:queue')` — declared here, next to the decorator,\n// with zero vela-core involvement.\nregisterEntrypointKind({ kind: 'cf:queue', metaKey: QUEUE_CONSUMER_METADATA_KEY, level: 'method' });\n\nexport interface QueueConsumerMetadata {\n  queueName: string;\n  methodName: string;\n}\n\n/**\n * Marks a method as a queue consumer handler.\n *\n * @example\n * ```ts\n * @Injectable()\n * class WorkerService {\n *   @QueueConsumer('email-queue')\n *   async processEmails(batch: MessageBatch) {\n *     for (const msg of batch.messages) {\n *       console.log('Processing:', msg.body);\n *       msg.ack();\n *     }\n *   }\n * }\n * ```\n */\nexport function QueueConsumer(queueName: string): MethodDecorator {\n  return (target: object, propertyKey: string | symbol, _descriptor: PropertyDescriptor) => {\n    const existing: QueueConsumerMetadata[] =\n      (getMetadata(QUEUE_CONSUMER_METADATA_KEY, target.constructor) as QueueConsumerMetadata[]) ??\n      [];\n    existing.push({ queueName, methodName: String(propertyKey) });\n    defineMetadata(QUEUE_CONSUMER_METADATA_KEY, existing, target.constructor);\n  };\n}\n\nexport function getQueueConsumerMetadata(target: object): QueueConsumerMetadata[] {\n  const ctor = target.constructor ?? target;\n  return (getMetadata(QUEUE_CONSUMER_METADATA_KEY, ctor) as QueueConsumerMetadata[]) ?? [];\n}\n","import { defineProvider, type DynamicModule } from '@velajs/vela';\nimport { WsDispatcher, WS_SERVER } from '@velajs/vela/websocket';\nimport { WsServerHolder } from './ws-server-holder';\n\n/**\n * Cloudflare counterpart to the core `WebSocketModule.forRoot()`. Import this in\n * your `AppModule` instead: it provides the gateway dispatcher plus a late-bound\n * `WS_SERVER` (`WsServerHolder`) that the WebSocket Durable Object wires to a\n * ctx-backed server per instance. `useClass` ensures a fresh holder per DI\n * container so colocated DO instances never share a server.\n */\nexport class CloudflareWebSocketModule {\n  static forRoot(): DynamicModule {\n    const providers = [defineProvider(WS_SERVER, { useClass: WsServerHolder }), WsDispatcher];\n\n    return {\n      module: CloudflareWebSocketModule,\n      providers,\n      exports: [WS_SERVER, WsDispatcher],\n    };\n  }\n}\n","import {\n  assertBroadcastCommandFits,\n  DEFAULT_WS_MAX_FRAME_BYTES,\n  resolveMaxFrameBytes,\n} from '@velajs/vela/websocket';\nimport type { BroadcastCommand } from '@velajs/vela/websocket';\nimport { roomToDurableId } from './room-id';\n\nexport interface WsBroadcastStub {\n  broadcast(cmd: BroadcastCommand): Promise<void>;\n}\n\nexport interface BroadcastNamespace {\n  idFromName(name: string): DurableObjectId;\n  get(id: DurableObjectId): WsBroadcastStub;\n}\n\n/**\n * Push to a room from a Worker HTTP handler / cron / queue consumer (server-\n * initiated emit). Resolves the room's Durable Object and calls its `broadcast`\n * RPC method — the same canonical room→DO mapping the upgrade route uses, so it\n * always reaches the DO holding those sockets.\n *\n * @example\n * ```ts\n * // In a controller — ns from the typed Worker environment\n * await broadcastToRoom(ns, '/orgs/:orgId/ws', `org:${id}`, 'order.created', order);\n * ```\n */\nexport async function broadcastToRoom(\n  ns: BroadcastNamespace,\n  gatewayPath: string,\n  room: string,\n  event: string,\n  data?: unknown,\n  options?: { exceptIds?: string[]; maxFrameBytes?: number },\n): Promise<void> {\n  const cmd: BroadcastCommand = {\n    rooms: [room],\n    exceptIds: options?.exceptIds,\n    frame: JSON.stringify({ event, data }),\n  };\n  const maxFrameBytes = resolveMaxFrameBytes({\n    maxFrameBytes: options?.maxFrameBytes ?? DEFAULT_WS_MAX_FRAME_BYTES,\n  });\n  assertBroadcastCommandFits(cmd, maxFrameBytes);\n  const stub = ns.get(roomToDurableId(ns, gatewayPath, room));\n  await stub.broadcast(cmd);\n}\n","import type { ThrottlerStorageRecord, ThrottlerStore } from '@velajs/vela';\n\n/** The deliberately small surface exposed by a Workers Rate Limiting binding. */\nexport interface CloudflareRateLimitBinding {\n  limit(input: { key: string }): Promise<{ success: boolean }>;\n}\n\nexport interface CloudflareRateLimitStoreOptions {\n  /** Must match the binding's configured `simple.limit`. */\n  limit: number;\n  /** Must match the binding's configured `simple.period`. */\n  periodSeconds: 10 | 60;\n  /** Bound attacker-influenced tracking keys before calling the platform. */\n  maxKeyBytes?: number;\n}\n\n/**\n * Adapt a Cloudflare Workers Rate Limiting binding to Vela's throttler store.\n *\n * The platform binding makes the allow/deny decision. It does not expose exact\n * counters or reset timestamps, so this adapter intentionally omits `remaining`.\n */\nexport function cloudflareRateLimitStore(\n  binding: CloudflareRateLimitBinding | (() => CloudflareRateLimitBinding),\n  options: CloudflareRateLimitStoreOptions,\n): ThrottlerStore {\n  if (!binding || (typeof binding !== 'function' && typeof binding.limit !== 'function')) {\n    throw new TypeError('A Cloudflare Rate Limiting binding is required');\n  }\n  if (\n    !Number.isSafeInteger(options.limit) ||\n    options.limit <= 0 ||\n    options.limit >= Number.MAX_SAFE_INTEGER\n  ) {\n    throw new RangeError('Rate limit must be a positive safe integer');\n  }\n  if (options.periodSeconds !== 10 && options.periodSeconds !== 60) {\n    throw new RangeError('Cloudflare rate-limit periods must be 10 or 60 seconds');\n  }\n\n  const maxKeyBytes = options.maxKeyBytes ?? 1_024;\n  if (!Number.isSafeInteger(maxKeyBytes) || maxKeyBytes <= 0 || maxKeyBytes > 4_096) {\n    throw new RangeError('maxKeyBytes must be between 1 and 4096');\n  }\n\n  const ttlMs = options.periodSeconds * 1_000;\n  const encoder = new TextEncoder();\n  const resolveBinding =\n    typeof binding === 'function' ? binding : (): CloudflareRateLimitBinding => binding;\n\n  return {\n    async increment(key: string, requestedTtlMs: number): Promise<ThrottlerStorageRecord> {\n      if (requestedTtlMs !== ttlMs) {\n        throw new Error(\n          `Cloudflare binding period mismatch: expected ${ttlMs}ms, received ${requestedTtlMs}ms`,\n        );\n      }\n      if (\n        typeof key !== 'string' ||\n        key.length === 0 ||\n        /[\\u0000-\\u001f\\u007f]/.test(key) ||\n        encoder.encode(key).byteLength > maxKeyBytes\n      ) {\n        throw new Error('Refusing an invalid or oversized rate-limit key');\n      }\n\n      const currentBinding = resolveBinding();\n      if (!currentBinding || typeof currentBinding.limit !== 'function') {\n        throw new Error('Cloudflare Rate Limiting binding is unavailable');\n      }\n      const decision = await currentBinding.limit({ key });\n      if (!decision || typeof decision.success !== 'boolean') {\n        throw new Error('Cloudflare rate-limit binding returned an invalid decision');\n      }\n\n      return {\n        // Vela consumes `allowed` as the authoritative platform decision. These\n        // sentinel counts preserve compatibility without inventing a counter.\n        count: decision.success ? 0 : options.limit + 1,\n        ttlMs,\n        allowed: decision.success,\n        enforcedLimit: options.limit,\n      };\n    },\n\n    reset(): never {\n      throw new Error('Cloudflare Rate Limiting bindings do not support counter reset');\n    },\n  };\n}\n","import type { VelaNonceDurableObject } from './nonce.durable-object';\nimport { MAX_NONCE_BYTES, isCanonicalBoundedText, isValidExpiry } from './nonce-validation';\nimport type { NonceStore } from '@velajs/vela';\n\nconst APP_NAMESPACE_PREFIX = 'vela:nonce:v1:';\nconst MAX_APP_NAMESPACE_BYTES = 128;\n/** The generated Workers binding type for {@link VelaNonceDurableObject}. */\nexport type DurableObjectNonceNamespace = DurableObjectNamespace<VelaNonceDurableObject>;\n\nexport interface DurableObjectNonceStoreOptions {\n  /**\n   * Stable application/environment boundary (for example `billing-api:prod`).\n   * Claims are globally single-use inside this namespace and isolated from all\n   * other application namespaces. It must be non-empty, canonical, and at most\n   * 128 UTF-8 bytes.\n   */\n  appNamespace: string;\n\n  /**\n   * Resolve the Workers Durable Object namespace at claim time. The resolver is\n   * intentionally not cached so request-scoped env/binding references stay safe.\n   */\n  binding: () => DurableObjectNonceNamespace | Promise<DurableObjectNonceNamespace>;\n}\n\n/**\n * Strict, cross-isolate {@link NonceStore} backed by one SQLite Durable Object\n * per explicit application namespace.\n *\n * Invalid input, an unavailable/malformed binding, RPC failure, or a malformed\n * RPC result all deny the claim (`false`). Only the literal boolean `true` from\n * the Durable Object is accepted.\n */\nexport function durableObjectNonceStore(options: DurableObjectNonceStoreOptions): NonceStore {\n  if (!options || typeof options !== 'object') {\n    throw new TypeError('Durable Object nonce-store options are required');\n  }\n  if (!isCanonicalBoundedText(options.appNamespace, MAX_APP_NAMESPACE_BYTES)) {\n    throw new TypeError(\n      `appNamespace must be canonical, non-empty, and at most ${MAX_APP_NAMESPACE_BYTES} UTF-8 bytes`,\n    );\n  }\n  if (typeof options.binding !== 'function') {\n    throw new TypeError('A lazy Durable Object namespace binding resolver is required');\n  }\n\n  const objectName = `${APP_NAMESPACE_PREFIX}${options.appNamespace}`;\n\n  return {\n    async claim(nonce: string, expEpochSeconds: number): Promise<boolean> {\n      const now = Math.floor(Date.now() / 1_000);\n      if (!isCanonicalBoundedText(nonce, MAX_NONCE_BYTES) || !isValidExpiry(expEpochSeconds, now)) {\n        return false;\n      }\n\n      try {\n        const namespace = await options.binding();\n\n        const id = namespace.idFromName(objectName);\n        const stub = namespace.get(id);\n        const result = await stub.claim(nonce, expEpochSeconds);\n        return result === true;\n      } catch {\n        return false;\n      }\n    },\n  };\n}\n"],"mappings":";;;;;;AAmBA,MAAM,2BAA2B;AACjC,MAAM,UAAU,IAAI,YAAY;AAchC,SAAS,gBAAgB,OAAiC;CACxD,OACE,OAAO,UAAU,YACjB,MAAM,SAAS,KACf,CAAC,MAAM,SAAS,IAAI,KACpB,CAAC,MAAM,SAAS,IAAI,KACpB,QAAQ,OAAO,KAAK,CAAC,CAAC,cAAc;AAExC;;AAGA,SAAS,eAAe,GAAkD;CACxE,MAAM,QAAQ,0BAA0B,EAAE,IAAI,GAAG;CACjD,IAAI,CAAC,OAAO,OAAO,KAAA;CACnB,MAAM,EAAE,WAAW,UAAU,gBAAgB;CAC7C,IACE,CAAC,gBAAgB,UAAU,MAAM,KACjC,CAAC,gBAAgB,UAAU,OAAO,KAClC,CAAC,gBAAgB,QAAQ,KACzB,OAAO,gBAAgB,YACvB,CAAC,OAAO,cAAc,WAAW,KACjC,eAAe,GAEf,OAAO;CACT,OAAO;EAAE;EAAW;EAAU;CAAY;AAC5C;;AAGA,SAAS,kBACP,iBACA,iBACsC;CACtC,IAAI,CAAC,mBAAmB,CAAC,iBAAiB,OAAO,KAAA;CACjD,IAAI,CAAC,iBAAiB,OAAO;CAC7B,IAAI,CAAC,iBAAiB,OAAO;CAC7B,IACE,gBAAgB,UAAU,WAAW,gBAAgB,UAAU,UAC/D,gBAAgB,UAAU,YAAY,gBAAgB,UAAU,WAChE,gBAAgB,UAAU,kBAAkB,gBAAgB,UAAU,iBACtE,gBAAgB,aAAa,gBAAgB,UAE7C,OAAO;CAET,OAAO;EACL,WAAW,EAAE,GAAG,gBAAgB,UAAU;EAC1C,UAAU,gBAAgB;EAC1B,aAAa,KAAK,IAAI,gBAAgB,aAAa,gBAAgB,WAAW;CAChF;AACF;;AAGA,SAAgB,uBAAuB,UAAoC;CAEzE,MAAM,UAAU,YAAqC,qBAAqB,SAAS,WAAW;CAC9F,IAAI,CAAC,SAAS,QAAQ,CAAC,SAAS,SAAS,OAAO,CAAC;CACjD,wBAAwB,OAAO;CAC/B,qBAAqB,OAAO;CAC5B,OAAO,CAAC;EAAE,MAAM,QAAQ;EAAM,SAAS,QAAQ;EAAS,SAAS,EAAE,GAAG,QAAQ;CAAE,CAAC;AACnF;;;;;;;AAQA,SAAgB,wBAAwB,MAAY,QAAgC;CAClF,KAAK,MAAM,SAAS,QAClB,KAAK,IAAI,MAAM,MAAM,OAAO,MAAe;EACzC,IAAI,EAAE,IAAI,OAAO,SAAS,CAAC,EAAE,YAAY,MAAM,aAC7C,OAAO,EAAE,KAAK,8BAA8B,GAAG;EAMjD,MAAM,UAAU,IAAI,QAAQ,EAAE,IAAI,IAAI,OAAO;EAC7C,QAAQ,OAAO,aAAa;EAC5B,QAAQ,OAAO,aAAa;EAC5B,QAAQ,OAAO,aAAa;EAC5B,QAAQ,OAAO,mBAAmB;EAClC,QAAQ,OAAO,sBAAsB;EACrC,QAAQ,OAAO,eAAe;EAC9B,QAAQ,OAAO,gBAAgB;EAC/B,QAAQ,OAAO,uBAAuB;EACtC,QAAQ,OAAO,eAAe;EAC9B,MAAM,mBAAmB,IAAI,QAAQ,EAAE,IAAI,KAAK,EAAE,QAAQ,CAAC;EAE3D,IAAI;EACJ,IAAI;GACF,SAAS,qBAAqB,MAAM,UAAU,SAAS,EAAE,IAAI,MAAM,IAAI,CAAC;EAC1E,QAAQ;GACN,OAAO,EAAE,KAAK,0BAA0B,GAAG;EAC7C;EAIA,MAAM,UAAU,MAAM,6BAA6B,MAAM,SAAS,kBAAkB,MAAM;EAC1F,IAAI,YAAY,OAAO,OAAO,EAAE,KAAK,+BAA+B,GAAG;EAEvE,MAAM,kBAAkB,eAAe,CAAC;EACxC,IAAI,oBAAoB,MAAM,OAAO,EAAE,KAAK,8BAA8B,GAAG;EAC7E,MAAM,WAAW,kBAAkB,iBAAiB,QAAQ,QAAQ;EACpE,IAAI,aAAa,MAAM,OAAO,EAAE,KAAK,oCAAoC,GAAG;EAC5E,IAAI,YAAY,SAAS,eAAe,KAAK,IAAI,GAC/C,OAAO,EAAE,KAAK,8BAA8B,GAAG;EAIjD,MAAM,iBAAiB,IAAI,QAAQ,QAAQ,QAAQ,OAAO;EAC1D,eAAe,IAAI,eAAe,MAAM;EACxC,eAAe,IAAI,eAAe,MAAM,IAAI;EAC5C,IAAI,UAAU;GACZ,eAAe,IAAI,eAAe,SAAS,UAAU,OAAO;GAC5D,eAAe,IAAI,iBAAiB,SAAS,UAAU,MAAM;GAC7D,eAAe,IAAI,kBAAkB,SAAS,UAAU,OAAO;GAC/D,eAAe,IAAI,yBAAyB,SAAS,UAAU,aAAa;GAC5E,eAAe,IAAI,iBAAiB,SAAS,QAAQ;GACrD,eAAe,IAAI,wBAAwB,OAAO,SAAS,WAAW,CAAC;EACzE;EAEA,OAAO,cACL,EAAE,KACF,MAAM,SACN,MAAM,MACN,QACA,IAAI,QAAQ,QAAQ,SAAS,EAAE,SAAS,eAAe,CAAC,CAC1D;CACF,CAAC;AAEL;;;;;;AAOA,eAAe,cACb,KACA,SACA,MACA,MACA,SACmB;CACnB,IAAI,OAAO,QAAQ,YAAY,QAAQ,MAAM,MAAM,IAAI,MAAM,+BAA+B;CAC5F,MAAM,YAAqB,QAAQ,IAAI,KAAK,OAAO;CACnD,IAAI,OAAO,cAAc,YAAY,cAAc,MACjD,OAAO,IAAI,SAAS,2BAA2B,QAAQ,sBAAsB,EAAE,QAAQ,IAAI,CAAC;CAE9F,MAAM,aAAsB,QAAQ,IAAI,WAAW,YAAY;CAC/D,MAAM,MAAe,QAAQ,IAAI,WAAW,KAAK;CACjD,IAAI,OAAO,eAAe,cAAc,OAAO,QAAQ,YACrD,MAAM,IAAI,MAAM,kCAAkC;CAEpD,MAAM,KAAc,QAAQ,MAAM,YAAY,WAAW,CAAC,sBAAsB,MAAM,IAAI,CAAC,CAAC;CAC5F,MAAM,OAAgB,QAAQ,MAAM,KAAK,WAAW,CAAC,EAAE,CAAC;CACxD,IAAI,OAAO,SAAS,YAAY,SAAS,MAAM,MAAM,IAAI,MAAM,6BAA6B;CAC5F,MAAM,QAAiB,QAAQ,IAAI,MAAM,OAAO;CAChD,IAAI,OAAO,UAAU,YAAY,MAAM,IAAI,MAAM,4CAA4C;CAC7F,MAAM,WAAoB,MAAM,QAAQ,MAAM,OAAO,MAAM,CAAC,OAAO,CAAC;CACpE,IAAI,EAAE,oBAAoB,WACxB,MAAM,IAAI,MAAM,6CAA6C;CAC/D,OAAO;AACT;;;AC/KA,uBAAuB;CAAE,MAAM;CAAgB,SAAS;CAAe,OAAO;AAAS,CAAC;AAWxF,SAAS,OAAO,UAAkB,YAA6B,MAA0B;CAEvF,MAAM,SAAkB,QAAQ,IAAI,UAAU,UAAU;CACxD,IAAI,OAAO,WAAW,YACpB,MAAM,IAAI,MACR,WAAW,OAAO,UAAU,EAAE,yBAAyB,SAAS,YAAY,MAC9E;CAEF,OAAO,QAAQ,MAAM,QAAQ,UAAU,IAAI;AAC7C;AAEA,SAAS,iBAAiB,MAAe,UAA0B;CACjE,IAAI,OAAO,SAAS,YAAY,SAAS,MAAM,MAAM,IAAI,MAAM,8BAA8B;CAC7F,MAAM,QAAiB,QAAQ,IAAI,MAAM,QAAQ;CACjD,IAAI,OAAO,UAAU,UACnB,MAAM,IAAI,MAAM,gCAAgC,SAAS,mBAAmB;CAC9E,OAAO;AACT;;AAGA,eAAe,kBAAkB,MAA+C;CAE9E,MAAM,UAAS,MADQ,QAAQ,WAAW,IAAI,EAAA,CACtB,SAAS,YAC/B,QAAQ,WAAW,aAAa,CAAC,QAAQ,MAAM,IAAI,CAAC,CACtD;CACA,IAAI,OAAO,WAAW,GAAG,MAAM,OAAO;CACtC,IAAI,OAAO,SAAS,GAAG,MAAM,IAAI,eAAe,QAAQ,sCAAsC;AAChG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BA,IAAa,wBAAb,MAA8D;CAMjD;CALX,mBAA8C,CAAC;CAC/C;CAEA,YACE,KACA,KACA;EADS,KAAA,MAAA;EAET,KAAK,OAAO;EACZ,KAAK,MAAM,IAAI,IAAI,KAAK,GAAG;CAC7B;CAEA,QAAiB,OAAO,SAAkB,KAAQ,QAA8C;EAC9F,4BAA4B,KAAK,KAAK,GAAG;EACzC,OAAO,KAAK,KAAK,MAAM,SAAS,KAAK,GAAG;CAC1C;CAEA,aAAwD;EACtD,OAAO,KAAK,KAAK,WAAW;CAC9B;;;;;;;;;;;;;CAcA;CAEA,IAAI,cAA8C;EAChD,OAAO,KAAK,KAAK;CACnB;;;;;;;;;;;;;;;;;;;;;CAsBA,aAAa,SAAoC;EAC/C,KAAK,KAAK,aAAa,OAAO;EAC9B,OAAO;CACT;;;;;;CAOA,cAAc,WAA4B;EACxC,MAAM,yBAAS,IAAI,IAA4B;EAC/C,KAAK,MAAM,MAAM,KAAK,KAAK,YAAY,OAAO,WAAW,GAAG;GAC1D,IAAI,OAAO,GAAG,SAAS,YAAY,GAAG,SAAS,QAAQ,EAAE,gBAAgB,GAAG,OAAO;GACnF,MAAM,OAAO,qBAAqB,GAAG,IAAI;GACzC,IAAI,KAAK,QAAQ,SACf,OAAO,IAAI,KAAK,MAAM;IACpB,MAAM,KAAK;IACX,SAAS,KAAK,QAAQ;IACtB,SAAS,EAAE,GAAG,KAAK,QAAQ;GAC7B,CAAC;EAEL;EACA,KAAK,MAAM,YAAY,WAAW;GAChC,IAAI,CAAC,YAAY,OAAO,aAAa,UAAU;GAC/C,KAAK,MAAM,SAAS,uBAAuB,QAAQ,GACjD,IAAI,CAAC,OAAO,IAAI,MAAM,IAAI,GAAG,OAAO,IAAI,MAAM,MAAM,KAAK;EAE7D;EACA,KAAK,iBAAiB,OAAO,GAAG,KAAK,iBAAiB,QAAQ,GAAG,OAAO,OAAO,CAAC;CAClF;;CAGA,qBAAuC;EACrC,OAAO,CAAC,GAAG,KAAK,gBAAgB;CAClC;;;;;;;CAQA,MAAM,UACJ,OACA,KACA,KACe;EACf,4BAA4B,KAAK,KAAK,GAAG;EAUzC,MAAM,kBATW,CACf,GAAG,KAAK,KAAK,YACV,OAAO,cAAc,CAAC,CACtB,KAAK,QAAQ;GAAE;GAAI,MAAM,iBAAiB,GAAG,MAAM,MAAM;EAAE,EAAE,GAChE,GAAG,KAAK,KAAK,YACV,OAAO,cAAc,CAAC,CACtB,KAAK,QAAQ;GAAE;GAAI,MAAM,iBAAiB,GAAG,MAAM,YAAY;EAAE,EAAE,CACxE,CAAC,CAAC,QAAQ,MAAM,EAAE,SAAS,MAAM,IAEF,CAAC,CAAC,KAAK,EAAE,SAAS,KAAK,mBAAmB,IAAI,OAAO,KAAK,GAAG,CAAC,CAAC;CAChG;;;;;;;;;CAUA,MAAc,mBACZ,IACA,SACA,KACA,iBACe;EACf,MAAM,cAAc,GAAG;EACvB,IAAI,OAAO,gBAAgB,YAAY,MAAM,IAAI,MAAM,mCAAmC;EAC1F,IAAI,GAAG,eAAe,KAAA,GAAW,MAAM,IAAI,MAAM,2CAA2C;EAC5F,MAAM,aAAa,GAAG;EACtB,MAAM,gBAAgB;GACpB,MAAM,GAAG,KAAK,WAAW,UAAU,IAAK,UAAqB;GAC7D,QAAQ,GAAG,YAAY,KAAK,GAAG,OAAO,UAAU;EAClD;EACA,IAAI;EACJ,IAAI;GACF,MAAM,qBAAqB,KAAK,KAAK,aAAa,GAAG,OAAO,OAAO,aAAa;IAC9E,MAAM,WAAW,sBAAsB,OAAO,EAAE;IAChD,MAAM,UAAU,gCACd,GAAG,MACH,aACA,YACA,SACA,UACA,KACF;IACA,MAAM,oBAAoB,EACxB,UAAU,SAAiC;KACzC,SAAS,UAAU,OAAO;KAC1B,gBAAgB,UAAU,OAAO;IACnC,EACF;IACA,IAAI,UAA6B,CAAC;IAClC,IAAI;KACF,WACE,MAAM,6BAA6B,UAAU,aAAa,YAAY,OAAO,QAAQ,EAAA,CACrF,WAAW;KACb,MAAM,SAAS,MAAM,6BACnB,SACA,aACA,YACA,OACA,QACF;KACA,MAAM,eAAe,MAAM,6BACzB,eACA,aACA,YACA,OACA,QACF;KACA,MAAM,eAAe,IAAI;MACvB;MACA;MACA;MACA,aAAa,YAAY;OAAC;OAAS;OAAK;MAAiB;MACzD,QAAQ,OAAO,SAAS;OACtB,MAAM,WAAW,MAAM,kBAAkB,OAAO,EAAE;OAClD,IAAI,OAAO,aAAa,YAAY,aAAa,MAC/C,MAAM,IAAI,MAAM,uCAAuC;OAEzD,OAAO,OAAO,UAAU,YAAY,IAAI;MAC1C;KACF,CAAC;IACH,SAAS,OAAO;KACd,qBAAqB,KAAK,CAAC,CAAC,OAAO,OAAO,aAAa;KACvD,KAAK,MAAM,UAAU,SACnB,IAAI,kBAAkB,QAAQ,KAAK,GAAG;MAGpC,MAAM,OAAO,MAAM,OAAO,OAAO;MACjC;KACF;KAEF,WAAW,EAAE,MAAM;KACnB,MAAM;IACR;GACF,CAAC;EACH,SAAS,OAAO;GAId,IAAI,CAAC,YAAY,SAAS,UAAU,OAAO;IACzC,MAAM,kBACJ,YAAY,iBAAiB,kBAAkB,MAAM,OAAO,OAAO,SAAS,QACxE,MAAM,OAAO,KACb;IACN,qBAAqB,KAAK,KAAK,aAAa,CAAC,CAAC,CAAC,OAAO,iBAAiB,aAAa;GACtF;GACA,MAAM;EACR;CACF;;;;;;;CAQA,MAAM,MACJ,OACA,KACA,KACe;EACf,4BAA4B,KAAK,KAAK,GAAG;EACzC,MAAM,WAAW,CACf,GAAG,KAAK,KAAK,YAAY,OAAO,UAAU,GAC1C,GAAG,KAAK,KAAK,YAAY,OAAO,iBAAiB,CACnD,CAAC,CAAC,QAAQ,OAAO,iBAAiB,GAAG,MAAM,WAAW,MAAM,MAAM,KAAK;EAEvE,IAAI,SAAS,WAAW,GAAG,MAAM,IAAI,MAAM,0BAA0B,MAAM,MAAM,GAAG;EAEpF,MAAM,kBAAkB,SAAS,KAAK,OAAO,KAAK,mBAAmB,IAAI,OAAO,KAAK,GAAG,CAAC,CAAC;CAC5F;CAEA,MAAM,MAAM,QAAgC;EAC1C,OAAO,KAAK,KAAK,MAAM,MAAM;CAC/B;AACF;;;;ACnTA,SAAgB,kBACd,SACgB;CAChB,OAAO;EACL,MAAM;EACN,mBAAmB,CACjB,OAAO,SAAS,SAAS;GACvB,4BAA4B,QAAQ,KAAK,QAAQ,GAAG;GACpD,MAAM,KAAK;EACb,CACF;EACA,sBACG,EAAE,WACF,YACC,QAAQ,QAAQ,IAAI,MAAM,SAAS,QAAQ,GAAG,CAAC;EACnD,cAAc,MAAM,YAAY,CAAC,CAAC,CAAC,OAAO,WAAW;EACrD,qBAAqB,cAAc;GACjC,8BAA8B,WAAW;IAAE,OAAO,QAAQ;IAAU,KAAK,QAAQ;GAAI,CAAC;EACxF;CACF;AACF;;AAGA,eAAsB,oBACpB,YACA,SACmC;CACnC,MAAM,UAAU,MAAM,YAAY,OAAO,MAAM,sBAAsB,YAAY,QAAQ,GAAG,GAAG;EAC7F,cAAc,QAAQ;EACtB,UAAU,QAAQ;EAClB,YAAY,QAAQ,aAAa,QAAQ,GAAG;EAC5C,UAAU,CAAC,kBAAkB,OAAO,CAAC;CACvC,CAAC;CACD,MAAM,MAAM,IAAI,sBAAsB,SAAS,QAAQ,GAAG;CAC1D,MAAM,4BAAY,IAAI,IAAoB;CAC1C,KAAK,MAAM,SAAS,CAClB,GAAG,IAAI,YAAY,OAAO,UAAU,GACpC,GAAG,IAAI,YAAY,OAAO,iBAAiB,CAC7C,GAAG;EACD,MAAM,OAAO,MAAM;EACnB,IACE,OAAO,SAAS,YAChB,SAAS,QACT,EAAE,eAAe,SACjB,OAAO,KAAK,cAAc,UAC1B;GACA,MAAM,IAAI,MAAM;GAChB,MAAM,IAAI,UAAU,kCAAkC;EACxD;EACA,MAAM,WAAW,UAAU,IAAI,KAAK,SAAS;EAE7C,IAAI,aAAa,aAAa,qBAAqB,MAAM,SAAS,oBAAoB;GACpF,MAAM,IAAI,MAAM;GAChB,MAAM,IAAI,MAAM,2CAA2C,KAAK,UAAU,GAAG;EAC/E;EACA,UAAU,IAAI,KAAK,WAAW,MAAM,IAAI;CAC1C;CACA,IAAI,cAAc,QAAQ,aAAa,CAAC;CACxC,wBAAwB,IAAI,WAAW,GAAG,IAAI,mBAAmB,CAAC;CAClE,OAAO;AACT;;;;;;AAOA,SAAgB,uBACd,YACA,SACA;CACA,MAAM,+BAAe,IAAI,QAA8C;CACvE,MAAM,eAAe,QAA8C;EACjE,MAAM,WAAW,aAAa,IAAI,GAAG;EACrC,IAAI,UAAU,OAAO;EACrB,MAAM,UAAU,oBAAoB,YAAY;GAAE,GAAG;GAAS;EAAI,CAAC;EACnE,aAAa,IAAI,KAAK,OAAO;EAC7B,QAAa,YAAY;GACvB,IAAI,aAAa,IAAI,GAAG,MAAM,SAAS,aAAa,OAAO,GAAG;EAChE,CAAC;EACD,OAAO;CACT;CACA,OAAO;EACL,MAAM,MAAM,SAAkB,KAAQ,KAA0C;GAC9E,QAAQ,MAAM,YAAY,GAAG,EAAA,CAAG,MAAM,SAAS,KAAK,GAAG;EACzD;EACA,MAAM,UACJ,OACA,KACA,KACe;GACf,QAAQ,MAAM,YAAY,GAAG,EAAA,CAAG,UAAU,OAAO,KAAK,GAAG;EAC3D;EACA,MAAM,MACJ,OACA,KACA,KACe;GACf,QAAQ,MAAM,YAAY,GAAG,EAAA,CAAG,MAAM,OAAO,KAAK,GAAG;EACvD;CACF;AACF;;;AChIA,MAAa,kBAAkB,IAAI,eAAqC,iBAAiB;;;;ACFzF,MAAa,wBAAwB;AAErC,MAAM,eAAe;AACrB,MAAM,sBAA8C;CAClD,MAAM;CACN,MAAM;CACN,OAAO;CACP,KAAK;CACL,MAAM;AACR;;AAGA,SAAgB,sBAAsB,KAAqB;CACzD,MAAM,QAAQ,IAAI,YAAY,CAAC,CAAC,OAAO,GAAG;CAC1C,IAAI,MAAM,eAAe,KAAK,MAAM,aAAA,MAClC,MAAM,IAAI,MAAM,yBAAyB,sBAAsB,aAAa;CAE9E,IAAI,SAAS;CACb,KAAK,MAAM,QAAQ,OAAO,UAAU,OAAO,aAAa,IAAI;CAC5D,OAAO,KAAK,MAAM,CAAC,CAAC,QAAQ,OAAO,GAAG,CAAC,CAAC,QAAQ,OAAO,GAAG,CAAC,CAAC,QAAQ,OAAO,EAAE;AAC/E;;AAGA,SAAgB,sBAAsB,OAAmC;CACvE,IAAI;EACF,IACE,MAAM,WAAW,KACjB,MAAM,SAAS,KAAK,KAAA,OAAmC,CAAC,KACxD,CAAC,aAAa,KAAK,KAAK,KACxB,MAAM,SAAS,MAAM,GAErB;EAEF,MAAM,SAAS,MAAM,QAAQ,MAAM,GAAG,CAAC,CAAC,QAAQ,MAAM,GAAG;EACzD,MAAM,SAAS,SAAS,IAAI,QAAQ,IAAK,OAAO,SAAS,KAAM,CAAC;EAChE,MAAM,SAAS,KAAK,MAAM;EAC1B,MAAM,QAAQ,IAAI,WAAW,IAAI,YAAY,OAAO,MAAM,CAAC;EAC3D,KAAK,IAAI,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK,MAAM,KAAK,OAAO,WAAW,CAAC;EACtE,IAAI,MAAM,eAAe,KAAK,MAAM,aAAA,MAAoC,OAAO,KAAA;EAC/E,MAAM,UAAU,IAAI,YAAY,SAAS;GAAE,OAAO;GAAM,WAAW;EAAM,CAAC,CAAC,CAAC,OAAO,KAAK;EACxF,OAAO,sBAAsB,OAAO,MAAM,QAAQ,UAAU,KAAA;CAC9D,QAAQ;EACN;CACF;AACF;AAEA,SAAS,aAAa,SAA0B;CAC9C,IAAI,UAAU;CACd,KAAK,IAAI,IAAI,GAAG,IAAI,GAAG,KAAK;EAC1B,IAAI,YAAY,MAAM,YAAY,OAAO,YAAY,MAAM,OAAO;EAClE,IAAI;GACF,MAAM,OAAO,mBAAmB,OAAO;GACvC,IAAI,SAAS,SAAS;GACtB,UAAU;EACZ,QAAQ;GACN;EACF;CACF;CACA,OAAO,YAAY,MAAM,YAAY,OAAO,YAAY;AAC1D;AAEA,SAAS,mBAAmB,SAAyB;CACnD,IAAI,UAAU;CACd,IAAI,SAAS;CACb,KAAK,MAAM,SAAS,QAAQ,SAAS,iCAAiC,GAAG;EACvE,WAAW,QAAQ,MAAM,QAAQ,MAAM,KAAK,CAAC,CAAC,QAAQ,uBAAuB,MAAM;EACnF,WAAW,oBAAoB,MAAM;EACrC,SAAS,MAAM,QAAS,MAAM,EAAE,CAAC;CACnC;CACA,WAAW,QAAQ,MAAM,MAAM,CAAC,CAAC,QAAQ,uBAAuB,MAAM;CACtE,OAAO;AACT;;AAGA,SAAgB,uBAAuB,KAAa,MAAmC;CACrF,MAAM,YAAY,QAAQ,GAAA,CAAI,MAAM,QAAQ,CAAC,CAAC,QAAQ,YAAY,CAAC,aAAa,OAAO,CAAC;CACxF,IAAI,SAAS,WAAW,GAAG,OAAO,IAAI,SAAS;CAC/C,MAAM,cAAc,SAAS,IAAI,kBAAkB,CAAC,CAAC,KAAK,GAAG;CAC7D,OAAO,IAAI,OAAO,OAAO,YAAY,SAAS,CAAC,CAAC,KAAK,GAAG;AAC1D;;;;AClEA,MAAa,qBAAqB;;AAUlC,IAAa,kBAAb,MAAsD;CACvB;CAA7B,YAAY,QAAgD;EAA/B,KAAA,SAAA;CAAgC;CAE7D,MAAM,OAAO,MAAmB,MAAc,SAA+C;EAC3F,MAAM,KAAK,OAAO,OAAO,IACvB,MACA,MACA;GACE,cAAc,QAAQ,WAAW,EAAE,aAAa,QAAQ,SAAS,IAAI,KAAA;GACrE,gBAAgB,QAAQ;EAC1B,CACF;EACA,OAAO;GACL;GACA,MAAM,KAAK,OAAO;GAClB,MAAM,QAAQ;GACd,UAAU,QAAQ,YAAY;GAC9B,4BAAY,IAAI,KAAK;EACvB;CACF;CAEA,MAAM,SAAS,MAAuC;EACpD,MAAM,MAAM,MAAM,KAAK,OAAO,OAAO,IAAI,IAAI;EAC7C,IAAI,CAAC,KAAK,MAAM,IAAI,MAAM,gCAAgC,KAAK,GAAG;EAClE,OAAO;GACL,gBAAgB,IAAI;GACpB,qBAAqB,IAAI,YAAY;GACrC,cAAc,IAAI,KAAK;GACvB,aAAa,IAAI,cAAc,eAAe;GAC9C,MAAM,IAAI;GACV,UAAU,IAAI;EAChB;CACF;CAEA,MAAM,OAAO,MAA6B;EACxC,MAAM,KAAK,OAAO,OAAO,OAAO,IAAI;CACtC;CAEA,MAAM,OAAO,MAAgC;EAC3C,OAAQ,MAAM,KAAK,OAAO,OAAO,KAAK,IAAI,MAAO;CACnD;CAEA,MAAM,gBACJ,MACA,QACA,WAC6B;EAC7B,IAAI,CAAC,KAAK,OAAO,QACf,MAAM,IAAI,MAAM,mEAAmE;EAIrF,IAAI,CAAC,OAAO,cAAc,SAAS,KAAK,aAAa,GACnD,MAAM,IAAI,MACR,iCAAiC,UAAU,qCAC7C;EAKF,MAAM,QAAQ,sBAAsB,IAAI;EACxC,MAAM,YAAY,GAAG,mBAAmB,GAAG,mBAAmB,KAAK,OAAO,IAAI;EAC9E,MAAM,QAAQ,IAAI,gBAAgB;GAAE,KAAK;GAAO;EAAO,CAAC;EAMxD,OAAO;GAAE,KAAA,MALS,QAAQ,GAAG,UAAU,GAAG,SAAS,KAAK,OAAO,QAAQ;IACrE;IACA;IACA,SAAS;GACX,CAAC;GACa;GAAQ;GAAW,WAAW,IAAI,KAAK,KAAK,IAAI,IAAI,YAAY,GAAI;EAAE;CACtF;AACF;;;;;;;;;;;;;;;ACxFO,IAAM,wBAAN,MAAM,sBAAsB;CACqB;CAAtD,YAAY,SAAyE;EAA/B,KAAA,UAAA;CAAgC;CAEtF,QAAQ,MAAuB;EAC7B,OAAO,KAAK,QAAQ,MAAM,MAAM,MAAM,EAAE,SAAS,IAAI;CACvD;CAEA,cAAc,MAA0B;EACtC,MAAM,SAAS,KAAK,QAAQ,MAAM,MAAM,MAAM,EAAE,SAAS,IAAI;EAC7D,IAAI,CAAC,QAAQ,MAAM,IAAI,MAAM,iBAAiB,KAAK,qBAAqB;EACxE,OAAO;CACT;CAEA,UAAU,MAA+B;EAEvC,OAAO,IAAI,gBAAgB;GAAE;GAAM,QADpB,KAAK,cAAc,IACS,CAAA,CAAO;GAAQ,QAAQ,KAAK,QAAQ;EAAO,CAAC;CACzF;AACF;;CAlBC,WAAW;CAEG,gBAAA,GAAA,OAAO,eAAe,CAAA;;;;;ACU9B,IAAM,oBAAN,MAAM,kBAAkB;CAEqB;CACN;CAF5C,YACE,SACA,SACA;EAFgD,KAAA,UAAA;EACN,KAAA,UAAA;CACzC;CAEH,MACM,SAAS,GAAsC;EACnD,MAAM,SAAS,KAAK,QAAQ;EAC5B,IAAI,CAAC,QAAQ,OAAO,IAAI,SAAS,qCAAqC,EAAE,QAAQ,IAAI,CAAC;EAIrF,IACE,CAAE,MAAM,gBAAgB,EAAE,IAAI,KAAK,QAAQ;GACzC,QAAQ,EAAE,IAAI;GACd,SAAS;EACX,CAAC,GAED,OAAO,IAAI,SAAS,0BAA0B,EAAE,QAAQ,IAAI,CAAC;EAO/D,MAAM,MAAM,IAAI,IAAI,EAAE,IAAI,GAAG;EAC7B,IAAI,IAAI,aAAa,IAAI,QAAQ,MAAM,OACrC,OAAO,IAAI,SAAS,+BAA+B,EAAE,QAAQ,IAAI,CAAC;EAGpE,MAAM,OAAO,EAAE,IAAI,MAAM,MAAM;EAC/B,IAAI,CAAC,QAAQ,CAAC,KAAK,QAAQ,QAAQ,IAAI,GAAG,OAAO,IAAI,SAAS,gBAAgB,EAAE,QAAQ,IAAI,CAAC;EAE7F,MAAM,QAAQ,IAAI,aAAa,IAAI,KAAK;EACxC,MAAM,UAAU,QAAQ,sBAAsB,KAAK,IAAI,KAAA;EACvD,IAAI,CAAC,SAAS,OAAO,IAAI,SAAS,+BAA+B,EAAE,QAAQ,IAAI,CAAC;EAIhF,MAAM,WAAW,gBAAgB,KAAA,GAAW,OAAO;EACnD,IAAI,aAAa,SAAS,OAAO,IAAI,SAAS,uBAAuB,EAAE,QAAQ,IAAI,CAAC;EAEpF,IAAI,CAAC,uBAAuB,UAAU,KAAK,QAAQ,cAAc,IAAI,CAAC,CAAC,IAAI,GACzE,OAAO,IAAI,SAAS,8CAA8C,EAAE,QAAQ,IAAI,CAAC;EAGnF,IAAI;GACF,MAAM,SAAS,MAAM,KAAK,QAAQ,UAAU,IAAI,CAAC,CAAC,SAAS,QAAQ;GACnE,MAAM,WAAW,SAAS,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK;GAC/C,OAAO,IAAI,SAAS,OAAO,SAAS,GAAG,EACrC,SAAS;IACP,gBAAgB,OAAO,eAAe;IAItC,uBAAuB,gCAAgC,mBAAmB,QAAQ;IAClF,0BAA0B;GAC5B,EACF,CAAC;EACH,QAAQ;GACN,OAAO,IAAI,SAAS,aAAa,EAAE,QAAQ,IAAI,CAAC;EAClD;CACF;AACF;;CA1DG,IAAI,QAAQ;CACG,gBAAA,GAAA,IAAI,CAAA;;;;;;CARrB,WAAW,SAAS;CAGhB,gBAAA,GAAA,OAAO,qBAAqB,CAAA;CAC5B,gBAAA,GAAA,OAAO,eAAe,CAAA;;;;;ACN3B,MAAM,kBAAkB;CAAE,eAAe;CAAM,WAAW;AAAM;AAOzD,IAAM,iBAAN,MAAM,eAAe;CAEkB;CACM;CAFlD,YACE,SACA,SACA;EAF0C,KAAA,UAAA;EACM,KAAA,UAAA;CAC/C;CAEH,IACE,cACA,MACA,UAAyB,CAAC,GAC1B,MACuB;EACvB,MAAM,OAAO,KAAK,YAAY,IAAI;EAClC,OAAO,KAAK,QAAQ,UAAU,IAAI,CAAC,CAAC,OAAO,MAAM,KAAK,SAAS,cAAc,IAAI,GAAG,OAAO;CAC7F;CAEA,IAAI,cAAsB,MAAwC;EAChE,MAAM,OAAO,KAAK,YAAY,IAAI;EAClC,OAAO,KAAK,QAAQ,UAAU,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,cAAc,IAAI,CAAC;CAChF;CAEA,OAAO,cAAsB,MAA8B;EACzD,MAAM,OAAO,KAAK,YAAY,IAAI;EAClC,OAAO,KAAK,QAAQ,UAAU,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,cAAc,IAAI,CAAC;CAC9E;CAEA,OAAO,cAAsB,MAAiC;EAC5D,MAAM,OAAO,KAAK,YAAY,IAAI;EAClC,OAAO,KAAK,QAAQ,UAAU,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,cAAc,IAAI,CAAC;CAC9E;CAEA,IACE,cACA,SAAwB,OACxB,WACA,MAC6B;EAC7B,MAAM,OAAO,KAAK,YAAY,IAAI;EAClC,OAAO,KAAK,QACT,UAAU,IAAI,CAAC,CACf,gBAAgB,KAAK,SAAS,cAAc,IAAI,GAAG,QAAQ,KAAK,eAAe,SAAS,CAAC;CAC9F;CAEA,YAAoB,MAAuB;EACzC,MAAM,OAAO,QAAQ,KAAK,QAAQ;EAClC,IAAI,CAAC,KAAK,QAAQ,QAAQ,IAAI,GAAG,MAAM,IAAI,MAAM,iBAAiB,KAAK,qBAAqB;EAC5F,OAAO;CACT;CAEA,SAAiB,cAAsB,MAAsB;EAC3D,OAAO,gBAAgB,KAAK,QAAQ,cAAc,IAAI,CAAC,CAAC,MAAM,YAAY;CAC5E;CAEA,eAAuB,WAA4B;EACjD,MAAM,MAAM,KAAK,QAAQ,gBAAgB;EACzC,MAAM,QAAQ,aAAa,IAAI;EAI/B,IAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,KAAK,QAAQ,IAAI,WAC3D,MAAM,IAAI,MAAM,wBAAwB,MAAM,uBAAuB,IAAI,UAAU,IAAI;EAEzF,OAAO;CACT;AACF;;CAjEC,WAAW;CAGP,gBAAA,GAAA,OAAO,eAAe,CAAA;CACtB,gBAAA,GAAA,OAAO,qBAAqB,CAAA;;;;;ACjBjC,MAAM,EAAE,4BAA4B,IAAI,0BAAgD;CACtF,YAAY;CACZ,uBAAuB;AACzB,CAAC,CAAC,CAAC,MAAM;AAOF,IAAM,gBAAN,MAAM,sBAAsB,wBAAwB,CAAC;AAL3D,gBAAA,WAAA,CAAA,OAAO;CACN,WAAW,CAAC,uBAAuB,cAAc;CACjD,aAAa,CAAC,iBAAiB;CAC/B,SAAS;EAAC;EAAgB;EAAuB;CAAe;AAClE,CAAC,CAAA,GAAA,aAAA;;;;;;;;ACHD,IAAa,eAAb,MAAyF;CAC1D;CAA7B,YAAY,IAAkC;EAAjB,KAAA,KAAA;CAAkB;CAE/C,MAAM,IAAI,KAA+B;EACvC,QAAQ,MAAM,KAAK,SAAS,GAAG,EAAA,EAAI;CACrC;CAEA,MAAM,SAAS,KAA0E;EACvF,MAAM,EAAE,OAAO,aAAa,MAAM,KAAK,GAAG,gBAAkC,KAAK,MAAM;EACvF,IAAI,UAAU,MAAM,OAAO,KAAA;EAC3B,IAAI,OAAO,aAAa,YAAY,aAAa,QAAQ,wBAAwB,UAAU;GACzF,MAAM,YAAY,SAAS;GAC3B,IAAI,OAAO,cAAc,YAAY,CAAC,OAAO,SAAS,SAAS,KAAK,aAAa,KAAK,IAAI,GACxF,OAAO,KAAA;GACT,OAAO;IAAE;IAAO;GAAU;EAC5B;EACA,OAAO,EAAE,MAAM;CACjB;CAEA,MAAM,IAAI,KAAa,OAAgB,KAA6B;EAClE,IAAI,QAAQ,KAAA,MAAc,CAAC,OAAO,SAAS,GAAG,KAAK,MAAM,IACvD,MAAM,IAAI,UAAU,2CAA2C;EACjE,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAK,SAAS,KAAK;GAAE;GAAO,WAAW,KAAK,IAAI,IAAI,MAAM;EAAK,CAAC;EAC9F,MAAM,KAAK,GAAG,IAAI,KAAK,KAAK,UAAU,KAAK,CAAC;CAC9C;CAEA,MAAM,SAAS,KAAa,OAAkC;EAC5D,IAAI,CAAC,OAAO,SAAS,MAAM,SAAS,GAAG,MAAM,IAAI,UAAU,8BAA8B;EACzF,MAAM,aAAa,MAAM,YAAY,KAAK,IAAI,KAAK;EACnD,IAAI,aAAa,GAAG,OAAO,KAAK,IAAI,GAAG;EACvC,MAAM,KAAK,GAAG,IAAI,KAAK,KAAK,UAAU,MAAM,KAAK,GAAG;GAClD,eAAe,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,CAAC;GAChD,UAAU,EAAE,oBAAoB,MAAM,UAAU;EAClD,CAAC;CACH;CAEA,MAAM,IAAI,KAA4B;EACpC,MAAM,KAAK,GAAG,OAAO,GAAG;CAC1B;;CAGA,MAAM,QAAuB;EAC3B,IAAI;EACJ,GAAG;GACD,MAAM,OAAO,MAAM,KAAK,GAAG,KAAK,SAAS,EAAE,OAAO,IAAI,KAAA,CAAS;GAC/D,MAAM,QAAQ,IAAI,KAAK,KAAK,KAAK,UAAU,KAAK,GAAG,OAAO,MAAM,IAAI,CAAC,CAAC;GACtE,SAAS,KAAK,gBAAgB,KAAA,IAAY,KAAK;EACjD,SAAS;CACX;AACF;;;;;;;AAQA,IAAa,2BAAb,MAAwE;CACzC;CAA7B,YAAY,IAAkC;EAAjB,KAAA,KAAA;CAAkB;CAC/C,MAAM,WAAW,KAA8B;EAC7C,MAAM,QAAiB,MAAM,KAAK,GAAG,IAAI,KAAK,MAAM;EACpD,IAAI,UAAU,MAAM,OAAO;EAC3B,IAAI,OAAO,UAAU,YAAY,MAAM,WAAW,KAAK,MAAM,SAAS,MACpE,MAAM,IAAI,UAAU,2BAA2B;EACjD,OAAO;CACT;CACA,MAAM,WAAW,KAA4B;EAC3C,MAAM,KAAK,GAAG,IAAI,KAAK,KAAK,UAAU,OAAO,WAAW,CAAC,CAAC;CAC5D;AACF;;;;;;;;;;;;;;;;;;;;;;;;;;ACrCA,IAAa,qBAAb,MAA6D;CAC3D;CACA;CAEA,YACE,SACA,UAAqC,CAAC,GACtC;EACA,KAAK,UAAU,OAAO,YAAY,aAAa,gBAAgB;EAC/D,KAAK,OAAO,QAAQ,QAAQ;CAC9B;CAEA,WAAW,KAAa,UAAmB,KAAqC;EAC9E,OAAO,KAAK,QAAQ,CAAC,CAAC,gBAAgB,KAAK,UAAU,GAAG;CAC1D;CAEA,UAAU,KAAa,UAAkB,KAAoC;EAC3E,OAAO,KAAK,QAAQ,CAAC,CAAC,eAAe,KAAK,UAAU,GAAG;CACzD;CAEA,UAAU,KAAa,UAAkB,KAAoC;EAC3E,OAAO,KAAK,QAAQ,CAAC,CAAC,eAAe,KAAK,UAAU,GAAG;CACzD;CAEA,UAAU,KAAa,UAAkB,KAAqC;EAC5E,OAAO,KAAK,QAAQ,CAAC,CAAC,eAAe,KAAK,UAAU,GAAG;CACzD;AACF;;AAGA,SAAgB,mBACd,SACA,SACoB;CACpB,OAAO,IAAI,mBAAmB,SAAS,OAAO;AAChD;;;;;;;;;;;;;;;;;;;;;;;;AClDA,IAAa,eAAb,MAAuD;CAKlC;CAJnB;CACA;CAEA,YACE,IACA,UAA+B,CAAC,GAChC;EAFiB,KAAA,KAAA;EAGjB,KAAK,OAAO,QAAQ,QAAQ;EAC5B,KAAK,SAAS,QAAQ,UAAU;CAClC;CAEA,WAAW,KAAa,UAAmB,MAAsC;EAC/E,OAAO,KAAK,KAAK,KAAK,WAAW,MAAM,OAAO,MAAM,SAAS;CAC/D;CAEA,UAAU,KAAa,UAAkB,MAAqC;EAC5E,OAAO,KAAK,KAAK,KAAK,WAAW,MAAM,OAAO,MAAM,QAAQ;CAC9D;CAEA,UAAU,KAAa,UAAkB,MAAqC;EAC5E,OAAO,KAAK,KAAK,KAAK,WAAW,MAAM,OAAO,MAAM,QAAQ;CAC9D;CAEA,UAAU,KAAa,UAAkB,MAAsC;EAC7E,OAAO,KAAK,KAAK,KAAK,WAAW,MAAM,OAAO,MAAM,YAAY,MAAM,IAAI;CAC5E;;;;;;CAOA,MAAc,KACZ,KACA,UACA,SACY;EACZ,MAAM,QAAQ,MAAM,KAAK,GAAG,IAAI,KAAK,SAAS,KAAK,MAAM;EACzD,IAAI,UAAU,QAAQ,UAAU,KAAA,GAAW,OAAO;EAClD,OAAO,QAAQ,KAAK,IAAI,QAAQ;CAClC;AACF;;AAGA,SAAgB,aAAa,IAAiB,SAA6C;CACzF,OAAO,IAAI,aAAa,IAAI,OAAO;AACrC;;;;;;;;;;;;;;;;;;AC5DA,MAAa,MAAM,sBAA0C,aAAa,QAAiB;CAEzF,MAAM,MAAe,IAAI,WAAW,CAAC,CAAC;CACtC,IAAI,OAAO,QAAQ,YAAY,QAAQ,MAAM,OAAO,KAAA;CACpD,OAAO,cAAc,QAAQ,IAAI,KAAK,WAAW,IAAI;AACvD,CAAC;;;ACpBD,MAAM,yBAAyB;AAI/B,uBAAuB;CAAE,MAAM;CAAgB,SAAS;CAAwB,OAAO;AAAS,CAAC;AA6BjG,SAAgB,uBAAuB,OAAmC;CACxE,IACE,OAAO,UAAU,YACjB,UAAU,QACV,EAAE,UAAU,UACZ,OAAO,MAAM,SAAS,YACtB,EAAE,gBAAgB,UAClB,OAAO,MAAM,eAAe,YAC5B,CAAC,UAAU,MAAM,MAAM,EAAE,SAAS,aAAa,CAAC,GAEhD,MAAM,IAAI,UAAU,uCAAuC;CAE7D,OAAO;EAAE,MAAM,MAAM;EAAM,YAAY,MAAM;CAAW;AAC1D;;;;;;;;;;;;;;;AAgBA,SAAgB,UAAU,MAA+B;CACvD,IAAI,CAAC,UAAU,MAAM,EAAE,SAAS,aAAa,CAAC,GAC5C,MAAM,IAAI,UAAU,uCAAuC,MAAM;CAEnE,QAAQ,QAAgB,aAA8B,gBAAoC;EAExF,MAAM,WAAW,qBAAqB,MAAM;EAC5C,SAAS,KAAK;GAAE;GAAM,YAAY,OAAO,WAAW;EAAE,CAAC;EACvD,eAAe,wBAAwB,UAAU,OAAO,WAAW;CACrE;AACF;AAEA,SAAgB,qBAAqB,QAAqC;CACxE,MAAM,OAAO,OAAO,WAAW,aAAa,SAAS,OAAO;CAC5D,MAAM,QAAiB,YAAY,wBAAwB,IAAI;CAC/D,IAAI,UAAU,KAAA,GAAW,OAAO,CAAC;CACjC,IAAI,CAAC,MAAM,QAAQ,KAAK,GAAG,MAAM,IAAI,UAAU,4CAA4C;CAC3F,OAAO,MAAM,IAAI,sBAAsB;AACzC;;;AChFA,MAAM,8BAA8B;AAKpC,uBAAuB;CAAE,MAAM;CAAY,SAAS;CAA6B,OAAO;AAAS,CAAC;;;;;;;;;;;;;;;;;;AAwBlG,SAAgB,cAAc,WAAoC;CAChE,QAAQ,QAAgB,aAA8B,gBAAoC;EACxF,MAAM,WACH,YAAY,6BAA6B,OAAO,WAAW,KAC5D,CAAC;EACH,SAAS,KAAK;GAAE;GAAW,YAAY,OAAO,WAAW;EAAE,CAAC;EAC5D,eAAe,6BAA6B,UAAU,OAAO,WAAW;CAC1E;AACF;;;;;;;;;;AC5BA,IAAa,4BAAb,MAAa,0BAA0B;CACrC,OAAO,UAAyB;EAC9B,MAAM,YAAY,CAAC,eAAe,WAAW,EAAE,UAAU,eAAe,CAAC,GAAG,YAAY;EAExF,OAAO;GACL,QAAQ;GACR;GACA,SAAS,CAAC,WAAW,YAAY;EACnC;CACF;AACF;;;;;;;;;;;;;;;ACQA,eAAsB,gBACpB,IACA,aACA,MACA,OACA,MACA,SACe;CACf,MAAM,MAAwB;EAC5B,OAAO,CAAC,IAAI;EACZ,WAAW,SAAS;EACpB,OAAO,KAAK,UAAU;GAAE;GAAO;EAAK,CAAC;CACvC;CACA,MAAM,gBAAgB,qBAAqB,EACzC,eAAe,SAAS,iBAAiB,2BAC3C,CAAC;CACD,2BAA2B,KAAK,aAAa;CAE7C,MADa,GAAG,IAAI,gBAAgB,IAAI,aAAa,IAAI,CAChD,CAAC,CAAC,UAAU,GAAG;AAC1B;;;;;;;;;AC1BA,SAAgB,yBACd,SACA,SACgB;CAChB,IAAI,CAAC,WAAY,OAAO,YAAY,cAAc,OAAO,QAAQ,UAAU,YACzE,MAAM,IAAI,UAAU,gDAAgD;CAEtE,IACE,CAAC,OAAO,cAAc,QAAQ,KAAK,KACnC,QAAQ,SAAS,KACjB,QAAQ,SAAS,OAAO,kBAExB,MAAM,IAAI,WAAW,4CAA4C;CAEnE,IAAI,QAAQ,kBAAkB,MAAM,QAAQ,kBAAkB,IAC5D,MAAM,IAAI,WAAW,wDAAwD;CAG/E,MAAM,cAAc,QAAQ,eAAe;CAC3C,IAAI,CAAC,OAAO,cAAc,WAAW,KAAK,eAAe,KAAK,cAAc,MAC1E,MAAM,IAAI,WAAW,wCAAwC;CAG/D,MAAM,QAAQ,QAAQ,gBAAgB;CACtC,MAAM,UAAU,IAAI,YAAY;CAChC,MAAM,iBACJ,OAAO,YAAY,aAAa,gBAA4C;CAE9E,OAAO;EACL,MAAM,UAAU,KAAa,gBAAyD;GACpF,IAAI,mBAAmB,OACrB,MAAM,IAAI,MACR,gDAAgD,MAAM,eAAe,eAAe,GACtF;GAEF,IACE,OAAO,QAAQ,YACf,IAAI,WAAW,KACf,wBAAwB,KAAK,GAAG,KAChC,QAAQ,OAAO,GAAG,CAAC,CAAC,aAAa,aAEjC,MAAM,IAAI,MAAM,iDAAiD;GAGnE,MAAM,iBAAiB,eAAe;GACtC,IAAI,CAAC,kBAAkB,OAAO,eAAe,UAAU,YACrD,MAAM,IAAI,MAAM,iDAAiD;GAEnE,MAAM,WAAW,MAAM,eAAe,MAAM,EAAE,IAAI,CAAC;GACnD,IAAI,CAAC,YAAY,OAAO,SAAS,YAAY,WAC3C,MAAM,IAAI,MAAM,4DAA4D;GAG9E,OAAO;IAGL,OAAO,SAAS,UAAU,IAAI,QAAQ,QAAQ;IAC9C;IACA,SAAS,SAAS;IAClB,eAAe,QAAQ;GACzB;EACF;EAEA,QAAe;GACb,MAAM,IAAI,MAAM,gEAAgE;EAClF;CACF;AACF;;;ACrFA,MAAM,uBAAuB;AAC7B,MAAM,0BAA0B;;;;;;;;;AA4BhC,SAAgB,wBAAwB,SAAqD;CAC3F,IAAI,CAAC,WAAW,OAAO,YAAY,UACjC,MAAM,IAAI,UAAU,iDAAiD;CAEvE,IAAI,CAAC,uBAAuB,QAAQ,cAAc,uBAAuB,GACvE,MAAM,IAAI,UACR,0DAA0D,wBAAwB,aACpF;CAEF,IAAI,OAAO,QAAQ,YAAY,YAC7B,MAAM,IAAI,UAAU,8DAA8D;CAGpF,MAAM,aAAa,GAAG,uBAAuB,QAAQ;CAErD,OAAO,EACL,MAAM,MAAM,OAAe,iBAA2C;EACpE,MAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAK;EACzC,IAAI,CAAC,uBAAuB,OAAA,GAAsB,KAAK,CAAC,cAAc,iBAAiB,GAAG,GACxF,OAAO;EAGT,IAAI;GACF,MAAM,YAAY,MAAM,QAAQ,QAAQ;GAExC,MAAM,KAAK,UAAU,WAAW,UAAU;GAG1C,OAAO,MAFM,UAAU,IAAI,EACH,CAAC,CAAC,MAAM,OAAO,eAAe,MACpC;EACpB,QAAQ;GACN,OAAO;EACT;CACF,EACF;AACF"}