casualos 3.3.11-alpha.11060020867 → 3.3.11

package/dist/cli.js

@@ -9817,8 +9817,8 @@ var require_keyword = __commonJS({
       var _a4;
       const { gen, keyword, schema, parentSchema, $data, it: it2 } = cxt;
       checkAsyncKeyword(it2, def);
-      const validate = !$data && def.compile ? def.compile.call(it2.self, schema, parentSchema, it2) : def.validate;
-      const validateRef = useKeyword(gen, keyword, validate);
+      const validate2 = !$data && def.compile ? def.compile.call(it2.self, schema, parentSchema, it2) : def.validate;
+      const validateRef = useKeyword(gen, keyword, validate2);
       const valid = gen.let("valid");
       cxt.block$data(valid, validateKeyword);
       cxt.ok((_a4 = def.valid) !== null && _a4 !== void 0 ? _a4 : valid);
@@ -10900,28 +10900,28 @@ var require_compile = __commonJS({
         if (this.opts.code.process)
           sourceCode = this.opts.code.process(sourceCode, sch);
         const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode);
-        const validate = makeValidate(this, this.scope.get());
-        this.scope.value(validateName, { ref: validate });
-        validate.errors = null;
-        validate.schema = sch.schema;
-        validate.schemaEnv = sch;
+        const validate2 = makeValidate(this, this.scope.get());
+        this.scope.value(validateName, { ref: validate2 });
+        validate2.errors = null;
+        validate2.schema = sch.schema;
+        validate2.schemaEnv = sch;
         if (sch.$async)
-          validate.$async = true;
+          validate2.$async = true;
         if (this.opts.code.source === true) {
-          validate.source = { validateName, validateCode, scopeValues: gen._values };
+          validate2.source = { validateName, validateCode, scopeValues: gen._values };
         }
         if (this.opts.unevaluated) {
           const { props, items } = schemaCxt;
-          validate.evaluated = {
+          validate2.evaluated = {
             props: props instanceof codegen_1.Name ? void 0 : props,
             items: items instanceof codegen_1.Name ? void 0 : items,
             dynamicProps: props instanceof codegen_1.Name,
             dynamicItems: items instanceof codegen_1.Name
           };
-          if (validate.source)
-            validate.source.evaluated = (0, codegen_1.stringify)(validate.evaluated);
+          if (validate2.source)
+            validate2.source.evaluated = (0, codegen_1.stringify)(validate2.evaluated);
         }
-        sch.validate = validate;
+        sch.validate = validate2;
         return sch;
       } catch (e2) {
         delete sch.validate;
@@ -11596,7 +11596,7 @@ var require_uri_all = __commonJS({
       }
       var URI_PARSE = /^(?:([^:\/?#]+):)?(?:\/\/((?:([^\/?#@]*)@)?(\[[^\/?#\]]+\]|[^\/?#:]*)(?:\:(\d*))?))?([^?#]*)(?:\?([^#]*))?(?:#((?:.|\n|\r)*))?/i;
       var NO_MATCH_IS_UNDEFINED = "".match(/(){0}/)[1] === void 0;
-      function parse3(uriString) {
+      function parse4(uriString) {
         var options = arguments.length > 1 && arguments[1] !== void 0 ? arguments[1] : {};
         var components = {};
         var protocol = options.iri !== false ? IRI_PROTOCOL : URI_PROTOCOL;
@@ -11767,8 +11767,8 @@ var require_uri_all = __commonJS({
         var skipNormalization = arguments[3];
         var target = {};
         if (!skipNormalization) {
-          base2 = parse3(serialize(base2, options), options);
-          relative = parse3(serialize(relative, options), options);
+          base2 = parse4(serialize(base2, options), options);
+          relative = parse4(serialize(relative, options), options);
         }
         options = options || {};
         if (!options.tolerant && relative.scheme) {
@@ -11819,24 +11819,24 @@ var require_uri_all = __commonJS({
       }
       function resolve2(baseURI, relativeURI, options) {
         var schemelessOptions = assign2({ scheme: "null" }, options);
-        return serialize(resolveComponents(parse3(baseURI, schemelessOptions), parse3(relativeURI, schemelessOptions), schemelessOptions, true), schemelessOptions);
+        return serialize(resolveComponents(parse4(baseURI, schemelessOptions), parse4(relativeURI, schemelessOptions), schemelessOptions, true), schemelessOptions);
       }
       function normalize(uri, options) {
         if (typeof uri === "string") {
-          uri = serialize(parse3(uri, options), options);
+          uri = serialize(parse4(uri, options), options);
         } else if (typeOf(uri) === "object") {
-          uri = parse3(serialize(uri, options), options);
+          uri = parse4(serialize(uri, options), options);
         }
         return uri;
       }
       function equal(uriA, uriB, options) {
         if (typeof uriA === "string") {
-          uriA = serialize(parse3(uriA, options), options);
+          uriA = serialize(parse4(uriA, options), options);
         } else if (typeOf(uriA) === "object") {
           uriA = serialize(uriA, options);
         }
         if (typeof uriB === "string") {
-          uriB = serialize(parse3(uriB, options), options);
+          uriB = serialize(parse4(uriB, options), options);
         } else if (typeOf(uriB) === "object") {
           uriB = serialize(uriB, options);
         }
@@ -11851,7 +11851,7 @@ var require_uri_all = __commonJS({
       var handler2 = {
         scheme: "http",
         domainHost: true,
-        parse: function parse4(components, options) {
+        parse: function parse5(components, options) {
           if (!components.host) {
             components.error = components.error || "HTTP URIs must have a host.";
           }
@@ -11880,7 +11880,7 @@ var require_uri_all = __commonJS({
       var handler$2 = {
         scheme: "ws",
         domainHost: true,
-        parse: function parse4(components, options) {
+        parse: function parse5(components, options) {
           var wsComponents = components;
           wsComponents.secure = isSecure(wsComponents);
           wsComponents.resourceName = (wsComponents.path || "/") + (wsComponents.query ? "?" + wsComponents.query : "");
@@ -12056,7 +12056,7 @@ var require_uri_all = __commonJS({
       var UUID = /^[0-9A-Fa-f]{8}(?:\-[0-9A-Fa-f]{4}){3}\-[0-9A-Fa-f]{12}$/;
       var handler$6 = {
         scheme: "urn:uuid",
-        parse: function parse4(urnComponents, options) {
+        parse: function parse5(urnComponents, options) {
           var uuidComponents = urnComponents;
           uuidComponents.uuid = uuidComponents.nss;
           uuidComponents.nss = void 0;
@@ -12081,7 +12081,7 @@ var require_uri_all = __commonJS({
       exports2.SCHEMES = SCHEMES;
       exports2.pctEncChar = pctEncChar;
       exports2.pctDecChars = pctDecChars;
-      exports2.parse = parse3;
+      exports2.parse = parse4;
       exports2.removeDotSegments = removeDotSegments;
       exports2.serialize = serialize;
       exports2.resolveComponents = resolveComponents;
@@ -14746,8 +14746,8 @@ var require_formats = __commonJS({
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.formatNames = exports.fastFormats = exports.fullFormats = void 0;
-    function fmtDef(validate, compare) {
-      return { validate, compare };
+    function fmtDef(validate2, compare) {
+      return { validate: validate2, compare };
     }
     exports.fullFormats = {
       // date: http://tools.ietf.org/html/rfc3339#section-5.6
@@ -15428,7 +15428,7 @@ var require_semver = __commonJS({
 var require_parse = __commonJS({
   "../../node_modules/.pnpm/semver@7.5.4/node_modules/semver/functions/parse.js"(exports, module2) {
     var SemVer = require_semver();
-    var parse3 = (version, options, throwErrors = false) => {
+    var parse4 = (version, options, throwErrors = false) => {
       if (version instanceof SemVer) {
         return version;
       }
@@ -15441,16 +15441,16 @@ var require_parse = __commonJS({
         throw er2;
       }
     };
-    module2.exports = parse3;
+    module2.exports = parse4;
   }
 });
 
 // ../../node_modules/.pnpm/semver@7.5.4/node_modules/semver/functions/valid.js
 var require_valid = __commonJS({
   "../../node_modules/.pnpm/semver@7.5.4/node_modules/semver/functions/valid.js"(exports, module2) {
-    var parse3 = require_parse();
+    var parse4 = require_parse();
     var valid = (version, options) => {
-      const v2 = parse3(version, options);
+      const v2 = parse4(version, options);
       return v2 ? v2.version : null;
     };
     module2.exports = valid;
@@ -15460,9 +15460,9 @@ var require_valid = __commonJS({
 // ../../node_modules/.pnpm/semver@7.5.4/node_modules/semver/functions/clean.js
 var require_clean = __commonJS({
   "../../node_modules/.pnpm/semver@7.5.4/node_modules/semver/functions/clean.js"(exports, module2) {
-    var parse3 = require_parse();
+    var parse4 = require_parse();
     var clean = (version, options) => {
-      const s3 = parse3(version.trim().replace(/^[=v]+/, ""), options);
+      const s3 = parse4(version.trim().replace(/^[=v]+/, ""), options);
       return s3 ? s3.version : null;
     };
     module2.exports = clean;
@@ -15495,10 +15495,10 @@ var require_inc = __commonJS({
 // ../../node_modules/.pnpm/semver@7.5.4/node_modules/semver/functions/diff.js
 var require_diff = __commonJS({
   "../../node_modules/.pnpm/semver@7.5.4/node_modules/semver/functions/diff.js"(exports, module2) {
-    var parse3 = require_parse();
+    var parse4 = require_parse();
     var diff = (version1, version2) => {
-      const v1 = parse3(version1, null, true);
-      const v2 = parse3(version2, null, true);
+      const v1 = parse4(version1, null, true);
+      const v2 = parse4(version2, null, true);
       const comparison = v1.compare(v2);
       if (comparison === 0) {
         return null;
@@ -15566,9 +15566,9 @@ var require_patch = __commonJS({
 // ../../node_modules/.pnpm/semver@7.5.4/node_modules/semver/functions/prerelease.js
 var require_prerelease = __commonJS({
   "../../node_modules/.pnpm/semver@7.5.4/node_modules/semver/functions/prerelease.js"(exports, module2) {
-    var parse3 = require_parse();
+    var parse4 = require_parse();
     var prerelease = (version, options) => {
-      const parsed = parse3(version, options);
+      const parsed = parse4(version, options);
       return parsed && parsed.prerelease.length ? parsed.prerelease : null;
     };
     module2.exports = prerelease;
@@ -15740,7 +15740,7 @@ var require_cmp = __commonJS({
 var require_coerce = __commonJS({
   "../../node_modules/.pnpm/semver@7.5.4/node_modules/semver/functions/coerce.js"(exports, module2) {
     var SemVer = require_semver();
-    var parse3 = require_parse();
+    var parse4 = require_parse();
     var { safeRe: re3, t: t2 } = require_re();
     var coerce2 = (version, options) => {
       if (version instanceof SemVer) {
@@ -15769,7 +15769,7 @@ var require_coerce = __commonJS({
       if (match2 === null) {
         return null;
       }
-      return parse3(`${match2[2]}.${match2[3] || "0"}.${match2[4] || "0"}`, options);
+      return parse4(`${match2[2]}.${match2[3] || "0"}.${match2[4] || "0"}`, options);
     };
     module2.exports = coerce2;
   }
@@ -17366,7 +17366,7 @@ var require_semver2 = __commonJS({
     var constants3 = require_constants();
     var SemVer = require_semver();
     var identifiers = require_identifiers();
-    var parse3 = require_parse();
+    var parse4 = require_parse();
     var valid = require_valid();
     var clean = require_clean();
     var inc = require_inc();
@@ -17404,7 +17404,7 @@ var require_semver2 = __commonJS({
     var simplifyRange = require_simplify();
     var subset = require_subset();
     module2.exports = {
-      parse: parse3,
+      parse: parse4,
       valid,
       clean,
       inc,
@@ -20912,7 +20912,7 @@ var require_lodash = __commonJS({
         function uniq2(array) {
           return array && array.length ? baseUniq(array) : [];
         }
-        function uniqBy(array, iteratee2) {
+        function uniqBy2(array, iteratee2) {
           return array && array.length ? baseUniq(array, getIteratee(iteratee2, 2)) : [];
         }
         function uniqWith(array, comparator) {
@@ -22572,7 +22572,7 @@ var require_lodash = __commonJS({
         lodash.unionBy = unionBy2;
         lodash.unionWith = unionWith;
         lodash.uniq = uniq2;
-        lodash.uniqBy = uniqBy;
+        lodash.uniqBy = uniqBy2;
         lodash.uniqWith = uniqWith;
         lodash.unset = unset;
         lodash.unzip = unzip;
@@ -25206,23 +25206,23 @@ var require_nacl_fast = __commonJS({
         randombytes = fn;
       };
       (function() {
-        var crypto7 = typeof self !== "undefined" ? self.crypto || self.msCrypto : null;
-        if (crypto7 && crypto7.getRandomValues) {
+        var crypto8 = typeof self !== "undefined" ? self.crypto || self.msCrypto : null;
+        if (crypto8 && crypto8.getRandomValues) {
           var QUOTA = 65536;
           nacl.setPRNG(function(x2, n3) {
             var i2, v2 = new Uint8Array(n3);
             for (i2 = 0; i2 < n3; i2 += QUOTA) {
-              crypto7.getRandomValues(v2.subarray(i2, i2 + Math.min(n3 - i2, QUOTA)));
+              crypto8.getRandomValues(v2.subarray(i2, i2 + Math.min(n3 - i2, QUOTA)));
             }
             for (i2 = 0; i2 < n3; i2++)
               x2[i2] = v2[i2];
             cleanup(v2);
           });
         } else if (typeof require !== "undefined") {
-          crypto7 = require("crypto");
-          if (crypto7 && crypto7.randomBytes) {
+          crypto8 = require("crypto");
+          if (crypto8 && crypto8.randomBytes) {
             nacl.setPRNG(function(x2, n3) {
-              var i2, v2 = crypto7.randomBytes(n3);
+              var i2, v2 = crypto8.randomBytes(n3);
               for (i2 = 0; i2 < n3; i2++)
                 x2[i2] = v2[i2];
               cleanup(v2);
@@ -44689,7 +44689,7 @@ var require_ms = __commonJS({
       options = options || {};
       var type = typeof val;
       if (type === "string" && val.length > 0) {
-        return parse3(val);
+        return parse4(val);
       } else if (type === "number" && isFinite(val)) {
         return options.long ? fmtLong(val) : fmtShort(val);
       }
@@ -44697,7 +44697,7 @@ var require_ms = __commonJS({
         "val is not a non-empty string or a valid number. val=" + JSON.stringify(val)
       );
     };
-    function parse3(str2) {
+    function parse4(str2) {
       str2 = String(str2);
       if (str2.length > 100) {
         return;
@@ -45448,7 +45448,7 @@ var require_debug2 = __commonJS({
 var require_follow_redirects = __commonJS({
   "../../node_modules/.pnpm/follow-redirects@1.15.3/node_modules/follow-redirects/index.js"(exports, module2) {
     var url2 = require("url");
-    var URL2 = url2.URL;
+    var URL3 = url2.URL;
     var http2 = require("http");
     var https2 = require("https");
     var Writable = require("stream").Writable;
@@ -45791,7 +45791,7 @@ var require_follow_redirects = __commonJS({
           if (isString4(input2)) {
             var parsed;
             try {
-              parsed = urlToOptions(new URL2(input2));
+              parsed = urlToOptions(new URL3(input2));
             } catch (err) {
               parsed = url2.parse(input2);
             }
@@ -45799,7 +45799,7 @@ var require_follow_redirects = __commonJS({
               throw new InvalidUrlError({ input: input2 });
             }
             input2 = parsed;
-          } else if (URL2 && input2 instanceof URL2) {
+          } else if (URL3 && input2 instanceof URL3) {
             input2 = urlToOptions(input2);
           } else {
             callback = options;
@@ -47486,8 +47486,8 @@ var require_URL = __commonJS({
     var utils = require_utils2();
     var Impl = require_URL_impl();
     var impl = utils.implSymbol;
-    function URL2(url2) {
-      if (!this || this[impl] || !(this instanceof URL2)) {
+    function URL3(url2) {
+      if (!this || this[impl] || !(this instanceof URL3)) {
         throw new TypeError("Failed to construct 'URL': Please use the 'new' operator, this DOM object constructor cannot be called as a function.");
       }
       if (arguments.length < 1) {
@@ -47503,7 +47503,7 @@ var require_URL = __commonJS({
       }
       module2.exports.setup(this, args2);
     }
-    URL2.prototype.toJSON = function toJSON2() {
+    URL3.prototype.toJSON = function toJSON2() {
       if (!this || !module2.exports.is(this)) {
         throw new TypeError("Illegal invocation");
       }
@@ -47513,7 +47513,7 @@ var require_URL = __commonJS({
       }
       return this[impl].toJSON.apply(this[impl], args2);
     };
-    Object.defineProperty(URL2.prototype, "href", {
+    Object.defineProperty(URL3.prototype, "href", {
       get() {
         return this[impl].href;
       },
@@ -47524,20 +47524,20 @@ var require_URL = __commonJS({
       enumerable: true,
       configurable: true
     });
-    URL2.prototype.toString = function() {
+    URL3.prototype.toString = function() {
       if (!this || !module2.exports.is(this)) {
         throw new TypeError("Illegal invocation");
       }
       return this.href;
     };
-    Object.defineProperty(URL2.prototype, "origin", {
+    Object.defineProperty(URL3.prototype, "origin", {
       get() {
         return this[impl].origin;
       },
       enumerable: true,
       configurable: true
     });
-    Object.defineProperty(URL2.prototype, "protocol", {
+    Object.defineProperty(URL3.prototype, "protocol", {
       get() {
         return this[impl].protocol;
       },
@@ -47548,7 +47548,7 @@ var require_URL = __commonJS({
       enumerable: true,
       configurable: true
     });
-    Object.defineProperty(URL2.prototype, "username", {
+    Object.defineProperty(URL3.prototype, "username", {
       get() {
         return this[impl].username;
       },
@@ -47559,7 +47559,7 @@ var require_URL = __commonJS({
       enumerable: true,
       configurable: true
     });
-    Object.defineProperty(URL2.prototype, "password", {
+    Object.defineProperty(URL3.prototype, "password", {
       get() {
         return this[impl].password;
       },
@@ -47570,7 +47570,7 @@ var require_URL = __commonJS({
       enumerable: true,
       configurable: true
     });
-    Object.defineProperty(URL2.prototype, "host", {
+    Object.defineProperty(URL3.prototype, "host", {
       get() {
         return this[impl].host;
       },
@@ -47581,7 +47581,7 @@ var require_URL = __commonJS({
       enumerable: true,
       configurable: true
     });
-    Object.defineProperty(URL2.prototype, "hostname", {
+    Object.defineProperty(URL3.prototype, "hostname", {
       get() {
         return this[impl].hostname;
       },
@@ -47592,7 +47592,7 @@ var require_URL = __commonJS({
       enumerable: true,
       configurable: true
     });
-    Object.defineProperty(URL2.prototype, "port", {
+    Object.defineProperty(URL3.prototype, "port", {
       get() {
         return this[impl].port;
       },
@@ -47603,7 +47603,7 @@ var require_URL = __commonJS({
       enumerable: true,
       configurable: true
     });
-    Object.defineProperty(URL2.prototype, "pathname", {
+    Object.defineProperty(URL3.prototype, "pathname", {
       get() {
         return this[impl].pathname;
       },
@@ -47614,7 +47614,7 @@ var require_URL = __commonJS({
       enumerable: true,
       configurable: true
     });
-    Object.defineProperty(URL2.prototype, "search", {
+    Object.defineProperty(URL3.prototype, "search", {
       get() {
         return this[impl].search;
       },
@@ -47625,7 +47625,7 @@ var require_URL = __commonJS({
       enumerable: true,
       configurable: true
     });
-    Object.defineProperty(URL2.prototype, "hash", {
+    Object.defineProperty(URL3.prototype, "hash", {
       get() {
         return this[impl].hash;
       },
@@ -47641,7 +47641,7 @@ var require_URL = __commonJS({
         return !!obj && obj[impl] instanceof Impl.implementation;
       },
       create(constructorArgs, privateData) {
-        let obj = Object.create(URL2.prototype);
+        let obj = Object.create(URL3.prototype);
         this.setup(obj, constructorArgs, privateData);
         return obj;
       },
@@ -47652,10 +47652,10 @@ var require_URL = __commonJS({
         obj[impl] = new Impl.implementation(constructorArgs, privateData);
         obj[impl][utils.wrapperSymbol] = obj;
       },
-      interface: URL2,
+      interface: URL3,
       expose: {
-        Window: { URL: URL2 },
-        Worker: { URL: URL2 }
+        Window: { URL: URL3 },
+        Worker: { URL: URL3 }
       }
     };
   }
@@ -52214,12 +52214,12 @@ var require_lib4 = __commonJS({
       configurable: true
     });
     var INTERNALS$2 = Symbol("Request internals");
-    var URL2 = Url.URL || whatwgUrl.URL;
+    var URL3 = Url.URL || whatwgUrl.URL;
     var parse_url = Url.parse;
     var format_url = Url.format;
     function parseURL(urlStr) {
       if (/^[a-zA-Z][a-zA-Z\d+\-.]*:/.exec(urlStr)) {
-        urlStr = new URL2(urlStr).toString();
+        urlStr = new URL3(urlStr).toString();
       }
       return parse_url(urlStr);
     }
@@ -64928,7 +64928,7 @@ var require_ms2 = __commonJS({
       options = options || {};
       var type = typeof val;
       if (type === "string" && val.length > 0) {
-        return parse3(val);
+        return parse4(val);
       } else if (type === "number" && isFinite(val)) {
         return options.long ? fmtLong(val) : fmtShort(val);
       }
@@ -64936,7 +64936,7 @@ var require_ms2 = __commonJS({
         "val is not a non-empty string or a valid number. val=" + JSON.stringify(val)
       );
     };
-    function parse3(str2) {
+    function parse4(str2) {
       str2 = String(str2);
       if (str2.length > 100) {
         return;
@@ -72908,33 +72908,51 @@ async function askForRecordInputs(inputs, name, repl2) {
   return result;
 }
 async function askForDiscriminatedUnionInputs(inputs, name, repl2) {
-  const kind3 = await (0, import_prompts.default)({
-    type: "select",
-    name: "kind",
-    message: `Select a ${inputs.discriminator} for ${name}.`,
-    choices: inputs.options.map((option) => {
-      const prop = option.schema[inputs.discriminator];
-      if (prop.type === "enum") {
-        return {
-          title: prop.values.join(", "),
-          description: option.description,
-          value: option
-        };
-      } else if (prop.type !== "literal") {
-        return {
-          title: option.type,
-          description: option.description,
-          value: option
-        };
-      }
+  let choices = inputs.options.map((option) => {
+    const prop = option.schema[inputs.discriminator];
+    if (prop.type === "enum") {
       return {
-        title: prop.value,
+        title: prop.values.join(", "),
         description: option.description,
         value: option
       };
-    }),
+    } else if (prop.type !== "literal") {
+      return {
+        title: option.type,
+        description: option.description,
+        value: option
+      };
+    }
+    return {
+      title: prop.value,
+      description: option.description,
+      value: option
+    };
+  });
+  if (inputs.nullable) {
+    choices.unshift({
+      title: "(null)",
+      description: "A null value.",
+      value: null
+    });
+  }
+  if (inputs.optional) {
+    choices.unshift({
+      title: "(undefined)",
+      description: "An undefined value.",
+      value: void 0
+    });
+  }
+  const kind3 = await (0, import_prompts.default)({
+    type: "select",
+    name: "kind",
+    message: `Select a ${inputs.discriminator} for ${name}.`,
+    choices,
     onState
   });
+  if (kind3.kind === null || kind3.kind === void 0) {
+    return kind3.kind;
+  }
   return await askForInputs(kind3.kind, name, repl2);
 }
 async function askForAnyInputs(name, repl2) {
@@ -74322,6 +74340,42 @@ if (!globalThis.Blob) {
 var import_base64_js = __toESM(require_base64_js());
 var import_lodash = __toESM(require_lodash());
 
+// ../../node_modules/.pnpm/uuid@10.0.0/node_modules/uuid/dist/esm-node/regex.js
+var regex_default = /^(?:[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$/i;
+
+// ../../node_modules/.pnpm/uuid@10.0.0/node_modules/uuid/dist/esm-node/validate.js
+function validate(uuid) {
+  return typeof uuid === "string" && regex_default.test(uuid);
+}
+var validate_default = validate;
+
+// ../../node_modules/.pnpm/uuid@10.0.0/node_modules/uuid/dist/esm-node/parse.js
+function parse(uuid) {
+  if (!validate_default(uuid)) {
+    throw TypeError("Invalid UUID");
+  }
+  let v2;
+  const arr = new Uint8Array(16);
+  arr[0] = (v2 = parseInt(uuid.slice(0, 8), 16)) >>> 24;
+  arr[1] = v2 >>> 16 & 255;
+  arr[2] = v2 >>> 8 & 255;
+  arr[3] = v2 & 255;
+  arr[4] = (v2 = parseInt(uuid.slice(9, 13), 16)) >>> 8;
+  arr[5] = v2 & 255;
+  arr[6] = (v2 = parseInt(uuid.slice(14, 18), 16)) >>> 8;
+  arr[7] = v2 & 255;
+  arr[8] = (v2 = parseInt(uuid.slice(19, 23), 16)) >>> 8;
+  arr[9] = v2 & 255;
+  arr[10] = (v2 = parseInt(uuid.slice(24, 36), 16)) / 1099511627776 & 255;
+  arr[11] = v2 / 4294967296 & 255;
+  arr[12] = v2 >>> 24 & 255;
+  arr[13] = v2 >>> 16 & 255;
+  arr[14] = v2 >>> 8 & 255;
+  arr[15] = v2 & 255;
+  return arr;
+}
+var parse_default = parse;
+
 // ../../node_modules/.pnpm/uuid@10.0.0/node_modules/uuid/dist/esm-node/stringify.js
 var byteToHex = [];
 for (let i2 = 0; i2 < 256; ++i2) {
@@ -74343,6 +74397,53 @@ function rng() {
   return rnds8Pool.slice(poolPtr, poolPtr += 16);
 }
 
+// ../../node_modules/.pnpm/uuid@10.0.0/node_modules/uuid/dist/esm-node/v35.js
+function stringToBytes(str2) {
+  str2 = unescape(encodeURIComponent(str2));
+  const bytes = [];
+  for (let i2 = 0; i2 < str2.length; ++i2) {
+    bytes.push(str2.charCodeAt(i2));
+  }
+  return bytes;
+}
+var DNS = "6ba7b810-9dad-11d1-80b4-00c04fd430c8";
+var URL2 = "6ba7b811-9dad-11d1-80b4-00c04fd430c8";
+function v35(name, version, hashfunc) {
+  function generateUUID(value, namespace, buf, offset2) {
+    var _namespace;
+    if (typeof value === "string") {
+      value = stringToBytes(value);
+    }
+    if (typeof namespace === "string") {
+      namespace = parse_default(namespace);
+    }
+    if (((_namespace = namespace) === null || _namespace === void 0 ? void 0 : _namespace.length) !== 16) {
+      throw TypeError("Namespace must be array-like (16 iterable integer values, 0-255)");
+    }
+    let bytes = new Uint8Array(16 + value.length);
+    bytes.set(namespace);
+    bytes.set(value, namespace.length);
+    bytes = hashfunc(bytes);
+    bytes[6] = bytes[6] & 15 | version;
+    bytes[8] = bytes[8] & 63 | 128;
+    if (buf) {
+      offset2 = offset2 || 0;
+      for (let i2 = 0; i2 < 16; ++i2) {
+        buf[offset2 + i2] = bytes[i2];
+      }
+      return buf;
+    }
+    return unsafeStringify(bytes);
+  }
+  try {
+    generateUUID.name = name;
+  } catch (err) {
+  }
+  generateUUID.DNS = DNS;
+  generateUUID.URL = URL2;
+  return generateUUID;
+}
+
 // ../../node_modules/.pnpm/uuid@10.0.0/node_modules/uuid/dist/esm-node/native.js
 var import_node_crypto3 = __toESM(require("node:crypto"));
 var native_default = {
@@ -74369,6 +74470,22 @@ function v4(options, buf, offset2) {
 }
 var v4_default = v4;
 
+// ../../node_modules/.pnpm/uuid@10.0.0/node_modules/uuid/dist/esm-node/sha1.js
+var import_node_crypto4 = __toESM(require("node:crypto"));
+function sha1(bytes) {
+  if (Array.isArray(bytes)) {
+    bytes = Buffer.from(bytes);
+  } else if (typeof bytes === "string") {
+    bytes = Buffer.from(bytes, "utf8");
+  }
+  return import_node_crypto4.default.createHash("sha1").update(bytes).digest();
+}
+var sha1_default = sha1;
+
+// ../../node_modules/.pnpm/uuid@10.0.0/node_modules/uuid/dist/esm-node/v5.js
+var v5 = v35("v5", 80, sha1_default);
+var v5_default = v5;
+
 // ../../node_modules/.pnpm/uuid@10.0.0/node_modules/uuid/dist/esm-node/v7.js
 var _seqLow = null;
 var _seqHigh = null;
@@ -76475,7 +76592,7 @@ function combineExtractors(...extractors) {
     [{}, null, 1]
   ).slice(0, 2);
 }
-function parse(s3, ...patterns) {
+function parse2(s3, ...patterns) {
   if (s3 == null) {
     return [null, null];
   }
@@ -76655,7 +76772,7 @@ var extractISOTimeAndOffset = combineExtractors(
   extractIANAZone
 );
 function parseISODate(s3) {
-  return parse(
+  return parse2(
     s3,
     [isoYmdWithTimeExtensionRegex, extractISOYmdTimeAndOffset],
     [isoWeekWithTimeExtensionRegex, extractISOWeekTimeAndOffset],
@@ -76664,10 +76781,10 @@ function parseISODate(s3) {
   );
 }
 function parseRFC2822Date(s3) {
-  return parse(preprocessRFC2822(s3), [rfc2822, extractRFC2822]);
+  return parse2(preprocessRFC2822(s3), [rfc2822, extractRFC2822]);
 }
 function parseHTTPDate(s3) {
-  return parse(
+  return parse2(
     s3,
     [rfc1123, extractRFC1123Or850],
     [rfc850, extractRFC1123Or850],
@@ -76675,11 +76792,11 @@ function parseHTTPDate(s3) {
   );
 }
 function parseISODuration(s3) {
-  return parse(s3, [isoDuration, extractISODuration]);
+  return parse2(s3, [isoDuration, extractISODuration]);
 }
 var extractISOTimeOnly = combineExtractors(extractISOTime);
 function parseISOTimeOnly(s3) {
-  return parse(s3, [isoTimeOnly, extractISOTimeOnly]);
+  return parse2(s3, [isoTimeOnly, extractISOTimeOnly]);
 }
 var sqlYmdWithTimeExtensionRegex = combineRegexes(sqlYmdRegex, sqlTimeExtensionRegex);
 var sqlTimeCombinedRegex = combineRegexes(sqlTimeRegex);
@@ -76689,7 +76806,7 @@ var extractISOTimeOffsetAndIANAZone = combineExtractors(
   extractIANAZone
 );
 function parseSQL(s3) {
-  return parse(
+  return parse2(
     s3,
     [sqlYmdWithTimeExtensionRegex, extractISOYmdTimeAndOffset],
     [sqlTimeCombinedRegex, extractISOTimeOffsetAndIANAZone]
@@ -85800,6 +85917,7 @@ var LOOM_RESOURCE_KIND = "loom";
 var SLOYD_RESOURCE_KIND = "ai.sloyd";
 var HUME_RESOURCE_KIND = "ai.hume";
 var WEBHOOK_RESOURCE_KIND = "webhook";
+var NOTIFICATION_RESOURCE_KIND = "notification";
 var READ_ACTION = "read";
 var CREATE_ACTION = "create";
 var UPDATE_ACTION = "update";
@@ -85816,6 +85934,10 @@ var REVOKE_ACTION = "revoke";
 var SEND_ACTION_ACTION = "sendAction";
 var UPDATE_DATA_ACTION = "updateData";
 var RUN_ACTION = "run";
+var SEND_ACTION = "send";
+var SUBSCRIBE_ACTION = "subscribe";
+var UNSUBSCRIBE_ACTION = "unsubscribe";
+var LIST_SUBSCRIPTIONS_ACTION = "listSubscriptions";
 var SUBJECT_TYPE_VALIDATION = z.enum(["user", "inst", "role"]);
 var DATA_ACTION_KINDS_VALIDATION = z.enum([
   READ_ACTION,
@@ -85871,6 +85993,17 @@ var WEBHOOK_ACTION_KINDS_VALIDATION = z.enum([
   LIST_ACTION,
   RUN_ACTION
 ]);
+var NOTIFICATION_ACTION_KINDS_VALIDATION = z.enum([
+  CREATE_ACTION,
+  READ_ACTION,
+  UPDATE_ACTION,
+  DELETE_ACTION,
+  LIST_ACTION,
+  SEND_ACTION,
+  SUBSCRIBE_ACTION,
+  UNSUBSCRIBE_ACTION,
+  LIST_SUBSCRIPTIONS_ACTION
+]);
 var RESOURCE_KIND_VALIDATION = z.enum([
   DATA_RESOURCE_KIND,
   FILE_RESOURCE_KIND,
@@ -85881,7 +86014,8 @@ var RESOURCE_KIND_VALIDATION = z.enum([
   LOOM_RESOURCE_KIND,
   SLOYD_RESOURCE_KIND,
   HUME_RESOURCE_KIND,
-  WEBHOOK_RESOURCE_KIND
+  WEBHOOK_RESOURCE_KIND,
+  NOTIFICATION_RESOURCE_KIND
 ]);
 var ACTION_KINDS_VALIDATION = z.enum([
   CREATE_ACTION,
@@ -85899,7 +86033,11 @@ var ACTION_KINDS_VALIDATION = z.enum([
   COUNT_ACTION,
   GRANT_PERMISSION_ACTION,
   REVOKE_PERMISSION_ACTION,
-  RUN_ACTION
+  RUN_ACTION,
+  SEND_ACTION,
+  SUBSCRIBE_ACTION,
+  UNSUBSCRIBE_ACTION,
+  LIST_SUBSCRIPTIONS_ACTION
 ]);
 var PERMISSION_VALIDATION = z.object({
   subjectType: SUBJECT_TYPE_VALIDATION,
@@ -85958,6 +86096,10 @@ var WEBHOOK_PERMISSION_VALIDATION = PERMISSION_VALIDATION.extend({
   resourceKind: z.literal(WEBHOOK_RESOURCE_KIND),
   action: WEBHOOK_ACTION_KINDS_VALIDATION.nullable()
 });
+var NOTIFICATION_PERMISSION_VALIDATION = PERMISSION_VALIDATION.extend({
+  resourceKind: z.literal(NOTIFICATION_RESOURCE_KIND),
+  action: NOTIFICATION_ACTION_KINDS_VALIDATION.nullable()
+});
 var AVAILABLE_PERMISSIONS_VALIDATION = z.discriminatedUnion(
   "resourceKind",
   [
@@ -85970,7 +86112,8 @@ var AVAILABLE_PERMISSIONS_VALIDATION = z.discriminatedUnion(
     LOOM_PERMISSION_VALIDATION,
     SLOYD_PERMISSION_VALIDATION,
     HUME_PERMISSION_VALIDATION,
-    WEBHOOK_PERMISSION_VALIDATION
+    WEBHOOK_PERMISSION_VALIDATION,
+    NOTIFICATION_PERMISSION_VALIDATION
   ]
 );
 var ADMIN_ROLE_NAME = "admin";
@@ -86924,14 +87067,14 @@ var StringDecoder = class {
 };
 
 // ../../node_modules/.pnpm/lib0@0.2.88/node_modules/lib0/webcrypto.node.js
-var import_node_crypto4 = require("node:crypto");
+var import_node_crypto5 = require("node:crypto");
 var subtle = (
   /** @type {any} */
-  import_node_crypto4.webcrypto.subtle
+  import_node_crypto5.webcrypto.subtle
 );
 var getRandomValues = (
   /** @type {any} */
-  import_node_crypto4.webcrypto.getRandomValues.bind(import_node_crypto4.webcrypto)
+  import_node_crypto5.webcrypto.getRandomValues.bind(import_node_crypto5.webcrypto)
 );
 
 // ../../node_modules/.pnpm/lib0@0.2.88/node_modules/lib0/random.js
@@ -96760,7 +96903,7 @@ var trace = TraceAPI.getInstance();
 function hashLowEntropyPasswordWithSalt2(password, salt) {
   const tracer = trace.getTracer(
     "InstrumentedHashHelpers",
-    false ? void 0 : "v3.3.11-alpha.11060020867"
+    false ? void 0 : "v3.3.11"
   );
   return tracer.startActiveSpan(
     "hashLowEntropyPasswordWithSalt",
@@ -96778,7 +96921,7 @@ function hashLowEntropyPasswordWithSalt2(password, salt) {
 function hashHighEntropyPasswordWithSalt2(password, salt) {
   const tracer = trace.getTracer(
     "InstrumentedHashHelpers",
-    false ? void 0 : "v3.3.11-alpha.11060020867"
+    false ? void 0 : "v3.3.11"
   );
   return tracer.startActiveSpan(
     "hashHighEntropyPasswordWithSalt",
@@ -96796,7 +96939,7 @@ function hashHighEntropyPasswordWithSalt2(password, salt) {
 function verifyPasswordAgainstHashes2(password, salt, hashes) {
   const tracer = trace.getTracer(
     "InstrumentedHashHelpers",
-    false ? void 0 : "v3.3.11-alpha.11060020867"
+    false ? void 0 : "v3.3.11"
   );
   return tracer.startActiveSpan(
     "verifyPasswordAgainstHashes",
@@ -103397,7 +103540,7 @@ var import_semantic_conventions = __toESM(require_src3());
 function traced(tracerName, options = {}, metricOptions = {}) {
   const tracer = trace.getTracer(
     tracerName,
-    false ? void 0 : "v3.3.11-alpha.11060020867"
+    false ? void 0 : "v3.3.11"
   );
   return function(target, propertyKey, descriptor) {
     const originalMethod = descriptor.value;
@@ -103475,7 +103618,7 @@ function getHistogram(meter) {
   }
   return metrics.getMeter(
     meter.meter,
-    false ? void 0 : "v3.3.11-alpha.11060020867"
+    false ? void 0 : "v3.3.11"
   ).createHistogram(meter.name, meter.options);
 }
 function getCounter(meter) {
@@ -103484,7 +103627,7 @@ function getCounter(meter) {
   }
   return metrics.getMeter(
     meter.meter,
-    false ? void 0 : "v3.3.11-alpha.11060020867"
+    false ? void 0 : "v3.3.11"
   ).createCounter(meter.name, meter.options);
 }
 function traceHttpResponse(options = {}) {
@@ -103534,6 +103677,7 @@ var AuthController = class {
     this._forceAllowSubscriptionFeatures = forceAllowSubscriptionFeatures;
     this._privoClient = privoClient;
     this._webAuthNRelyingParties = relyingParties;
+    this._privoEnabled = this._privoClient !== null;
   }
   get relyingParties() {
     return this._webAuthNRelyingParties;
@@ -103541,6 +103685,18 @@ var AuthController = class {
   set relyingParties(value) {
     this._webAuthNRelyingParties = value;
   }
+  /**
+   * Gets whether Privo-features are enabled.
+   */
+  get privoEnabled() {
+    return this._privoEnabled;
+  }
+  /**
+   * Sets whether Privo-features are enabled.
+   */
+  set privoEnabled(value) {
+    this._privoEnabled = value;
+  }
   async createAccount(request2) {
     try {
       const createSession = request2.createSession ?? true;
@@ -103579,7 +103735,13 @@ var AuthController = class {
           userId: newUser.id,
           sessionKey: null,
           connectionKey: null,
-          expireTimeMs: null
+          expireTimeMs: null,
+          metadata: {
+            hasUserAuthenticator: false,
+            userAuthenticatorCredentialIds: [],
+            hasPushSubscription: false,
+            pushSubscriptionIds: []
+          }
         };
       }
     } catch (err) {
@@ -104139,6 +104301,13 @@ var AuthController = class {
       );
       const serviceId = result.userInfo.serviceId;
       const email = result.userInfo.email;
+      if (result.userInfo.roleIdentifier !== config2.roleIds.adult && result.userInfo.roleIdentifier !== config2.roleIds.child) {
+        return {
+          success: false,
+          errorCode: "invalid_request",
+          errorMessage: "The login request is invalid. You attempted to sign into an account that is associated with a parent email address. This is not allowed because we don't ask consent for parent accounts, but all accounts must have consent. Please sign up with a new account instead."
+        };
+      }
       let user;
       if (serviceId) {
         user = await this._store.findUserByPrivoServiceId(
@@ -104262,6 +104431,7 @@ var AuthController = class {
       let updatePasswordUrl;
       let serviceId;
       let parentServiceId;
+      let consentUrl;
       if (years < 0) {
         return {
           success: false,
@@ -104298,6 +104468,7 @@ var AuthController = class {
         serviceId = result.childServiceId;
         parentServiceId = result.parentServiceId;
         updatePasswordUrl = result.updatePasswordLink;
+        consentUrl = result.consentUrl;
         privacyFeatures = getPrivacyFeaturesFromPermissions(
           config2.featureIds,
           result.features
@@ -104328,6 +104499,7 @@ var AuthController = class {
         }
         serviceId = result.adultServiceId;
         updatePasswordUrl = result.updatePasswordLink;
+        consentUrl = result.consentUrl;
         privacyFeatures = getPrivacyFeaturesFromPermissions(
           config2.featureIds,
           result.features
@@ -104344,6 +104516,7 @@ var AuthController = class {
         currentLoginRequestId: null,
         privoServiceId: serviceId,
         privoParentServiceId: parentServiceId,
+        privoConsentUrl: consentUrl,
         privacyFeatures
       };
       const saveUserResult = await this._store.saveNewUser(user);
@@ -105589,6 +105762,77 @@ var AuthController = class {
       };
     }
   }
+  async requestPrivacyFeaturesChange(request2) {
+    try {
+      if (!this._privoClient) {
+        return {
+          success: false,
+          errorCode: "not_supported",
+          errorMessage: "Privo features are not supported on this server."
+        };
+      }
+      const config2 = await this._config.getPrivoConfiguration();
+      if (!config2) {
+        return {
+          success: false,
+          errorCode: "not_supported",
+          errorMessage: "Privo features are not supported on this server."
+        };
+      }
+      const keyResult = await this.validateSessionKey(request2.sessionKey);
+      if (keyResult.success === false) {
+        return keyResult;
+      } else if (keyResult.userId !== request2.userId && keyResult.role !== "superUser") {
+        console.log(
+          "[AuthController] [requestPrivacyFeaturesChange] Request User ID doesnt match session key User ID!"
+        );
+        return {
+          success: false,
+          errorCode: "invalid_key",
+          errorMessage: INVALID_KEY_ERROR_MESSAGE
+        };
+      }
+      const user = await this._store.findUser(request2.userId);
+      if (!user) {
+        throw new Error(
+          "Unable to find user even though a valid session key was presented!"
+        );
+      }
+      if (!user.privoServiceId) {
+        return {
+          success: false,
+          errorCode: "not_supported",
+          errorMessage: "Privo features are not supported on this server."
+        };
+      }
+      const result = await this._privoClient.resendConsentRequest(
+        user.privoServiceId,
+        user.privoParentServiceId ?? user.privoServiceId
+      );
+      if (result.success === false) {
+        return result;
+      }
+      console.log(
+        `[AuthController] [requestPrivacyFeaturesChange] [userId: ${request2.userId}] Requested privacy features change.`
+      );
+      return {
+        success: true
+      };
+    } catch (err) {
+      const span = trace.getActiveSpan();
+      span?.recordException(err);
+      span?.setStatus({ code: SpanStatusCode.ERROR });
+      console.error(
+        "[AuthController] Error ocurred while requesting a change in privacy features",
+        err
+      );
+      return {
+        success: false,
+        errorCode: "server_error",
+        errorMessage: "A server error occurred."
+      };
+    }
+  }
   async listEmailRules() {
     try {
       const rules = await this._store.listEmailRules();
@@ -105782,6 +106026,7 @@ var AuthController = class {
     } else {
       await this._store.saveSession(newSession);
     }
+    const metadata = await this._store.findUserLoginMetadata(userId);
     const info = {
       userId,
       sessionKey: formatV1SessionKey(
@@ -105796,7 +106041,13 @@ var AuthController = class {
         newConnectionSecret,
         newSession.expireTimeMs
       ),
-      expireTimeMs: newSession.expireTimeMs
+      expireTimeMs: newSession.expireTimeMs,
+      metadata: {
+        hasUserAuthenticator: metadata?.hasUserAuthenticator ?? false,
+        userAuthenticatorCredentialIds: metadata?.userAuthenticatorCredentialIds ?? [],
+        hasPushSubscription: metadata?.hasPushSubscription ?? false,
+        pushSubscriptionIds: metadata?.pushSubscriptionIds ?? []
+      }
     };
     return {
       newSession,
@@ -105879,6 +106130,9 @@ __decorateClass([
 __decorateClass([
   traced(TRACE_NAME)
 ], AuthController.prototype, "updateUserInfo", 1);
+__decorateClass([
+  traced(TRACE_NAME)
+], AuthController.prototype, "requestPrivacyFeaturesChange", 1);
 __decorateClass([
   traced(TRACE_NAME)
 ], AuthController.prototype, "listEmailRules", 1);
@@ -106127,6 +106381,27 @@ var subscriptionFeaturesSchema = z.object({
     "The configuration for webhook features. Defaults to not allowed."
   ).optional().default({
     allowed: false
+  }),
+  notifications: z.object({
+    allowed: z.boolean().describe(
+      "Whether notifications are allowed for the subscription."
+    ),
+    maxItems: z.number().describe(
+      "The maximum number of notification items that are allowed for the subscription. If not specified, then there is no limit."
+    ).int().positive().optional(),
+    maxSubscribersPerItem: z.number().describe(
+      "The maximum number of subscribers that a notification can have in the subscription. If not specified, then there is no limit."
+    ).int().positive().optional(),
+    maxSentNotificationsPerPeriod: z.number().describe(
+      'The maximum number of notifications that can be sent per subscription period. This tracks the number of times the "sendNotification" operation was called. If not specified, then there is no limit.'
+    ).int().positive().optional(),
+    maxSentPushNotificationsPerPeriod: z.number().describe(
+      "The maximum number of push notifications that can be sent per subscription period. This tracks the actual number of push notifications that were sent to users. If not specified, then there is no limit."
+    ).int().positive().optional()
+  }).describe(
+    "The configuration for notification features. Defaults to not allowed."
+  ).optional().default({
+    allowed: false
   })
 });
 var subscriptionConfigSchema = z.object({
@@ -106256,45 +106531,72 @@ function allowAllFeatures() {
     },
     insts: {
       allowed: true
+    },
+    notifications: {
+      allowed: true
     }
   };
 }
-function getWebhookFeatures(config2, subscriptionStatus, subscriptionId, type) {
+function getNotificationFeatures(config2, subscriptionStatus, subscriptionId, type, periodStartMs, periodEndMs, nowMs = Date.now()) {
   const features = getSubscriptionFeatures(
     config2,
     subscriptionStatus,
     subscriptionId,
-    type
+    type,
+    periodStartMs,
+    periodEndMs,
+    nowMs
+  );
+  return features.notifications ?? { allowed: false };
+}
+function getWebhookFeatures(config2, subscriptionStatus, subscriptionId, type, periodStartMs, periodEndMs, nowMs = Date.now()) {
+  const features = getSubscriptionFeatures(
+    config2,
+    subscriptionStatus,
+    subscriptionId,
+    type,
+    periodStartMs,
+    periodEndMs,
+    nowMs
   );
   return features.webhooks ?? { allowed: false };
 }
-function getComIdFeatures(config2, subscriptionStatus, subscriptionId) {
+function getComIdFeatures(config2, subscriptionStatus, subscriptionId, periodStartMs, periodEndMs, nowMs = Date.now()) {
   const features = getSubscriptionFeatures(
     config2,
     subscriptionStatus,
     subscriptionId,
-    "studio"
+    "studio",
+    periodStartMs,
+    periodEndMs,
+    nowMs
   );
   return features.comId ?? {
     allowed: false
     // allowCustomComId: false,
   };
 }
-function getLoomFeatures(config2, subscriptionStatus, subscriptionId) {
+function getLoomFeatures(config2, subscriptionStatus, subscriptionId, periodStartMs, periodEndMs, nowMs = Date.now()) {
   const features = getSubscriptionFeatures(
     config2,
     subscriptionStatus,
     subscriptionId,
-    "studio"
+    "studio",
+    periodStartMs,
+    periodEndMs,
+    nowMs
   );
   return features.loom ?? { allowed: false };
 }
-function getHumeAiFeatures(config2, subscriptionStatus, subscriptionId, type) {
+function getHumeAiFeatures(config2, subscriptionStatus, subscriptionId, type, periodStartMs, periodEndMs, nowMs = Date.now()) {
   const features = getSubscriptionFeatures(
     config2,
     subscriptionStatus,
     subscriptionId,
-    type
+    type,
+    periodStartMs,
+    periodEndMs,
+    nowMs
   );
   return features.ai.hume ?? { allowed: false };
 }
@@ -107828,6 +108130,13 @@ function getPublicReadPermission(resourceKind, action2) {
         action: action2
       };
     }
+  } else if (resourceKind === "notification") {
+    if (action2 === "read" || action2 === "list" || action2 === "subscribe") {
+      return {
+        resourceKind,
+        action: action2
+      };
+    }
   }
   return null;
 }
@@ -107867,6 +108176,13 @@ function getPublicWritePermission(resourceKind, action2) {
         action: action2
       };
     }
+  } else if (resourceKind === "notification") {
+    if (action2 === "read" || action2 === "list" || action2 === "subscribe") {
+      return {
+        resourceKind,
+        action: action2
+      };
+    }
   }
   return null;
 }
@@ -110645,12 +110961,21 @@ var PolicyController = class {
       recordOwnerPrivacyFeatures = await this._policies.getUserPrivacyFeatures(ownerId);
     }
     if (!recordOwnerPrivacyFeatures) {
-      recordOwnerPrivacyFeatures = {
-        allowAI: true,
-        allowPublicData: true,
-        allowPublicInsts: true,
-        publishData: true
-      };
+      if (this._auth.privoEnabled) {
+        recordOwnerPrivacyFeatures = {
+          allowAI: false,
+          allowPublicData: false,
+          allowPublicInsts: false,
+          publishData: false
+        };
+      } else {
+        recordOwnerPrivacyFeatures = {
+          allowAI: true,
+          allowPublicData: true,
+          allowPublicInsts: true,
+          publishData: true
+        };
+      }
     }
     if (request2.userId) {
       userPrivacyFeatures = await this._policies.getUserPrivacyFeatures(
@@ -110658,12 +110983,21 @@ var PolicyController = class {
       );
     }
     if (!userPrivacyFeatures) {
-      userPrivacyFeatures = {
-        allowAI: true,
-        allowPublicData: true,
-        allowPublicInsts: true,
-        publishData: true
-      };
+      if (this._auth.privoEnabled) {
+        userPrivacyFeatures = {
+          allowAI: false,
+          allowPublicData: false,
+          allowPublicInsts: false,
+          publishData: false
+        };
+      } else {
+        userPrivacyFeatures = {
+          allowAI: true,
+          allowPublicData: true,
+          allowPublicInsts: true,
+          publishData: true
+        };
+      }
     }
     const context = {
       recordName,
@@ -114041,7 +114375,1062 @@ function eraseItemProcedure(auth7, controller, builder) {
 }
 
 // ../aux-records/RecordsServer.ts
+var import_lodash23 = __toESM(require_lodash());
+
+// ../aux-records/crud/CrudRecordsController.ts
+var TRACE_NAME8 = "CrudRecordsController";
+var CrudRecordsController = class {
+  get config() {
+    return this._config;
+  }
+  /**
+   * Gets the name of the controller.
+   */
+  get name() {
+    return this._name;
+  }
+  get policies() {
+    return this._policies;
+  }
+  get store() {
+    return this._store;
+  }
+  /**
+   * Gets the kind of resources that this controller is for.
+   */
+  get resourceKind() {
+    return this._resourceKind;
+  }
+  constructor(config2) {
+    this._name = config2.name;
+    this._store = config2.store;
+    this._policies = config2.policies;
+    this._config = config2.config;
+    this._resourceKind = config2.resourceKind;
+  }
+  async recordItem(request2) {
+    try {
+      const contextResult = await this._policies.constructAuthorizationContext({
+        recordKeyOrRecordName: request2.recordKeyOrRecordName,
+        userId: request2.userId
+      });
+      if (contextResult.success === false) {
+        return contextResult;
+      }
+      const recordName = contextResult.context.recordName;
+      const existingItem = await this._store.getItemByAddress(
+        recordName,
+        request2.item.address
+      );
+      let resourceMarkers;
+      let action2 = existingItem ? "update" : "create";
+      let authorization;
+      if (action2 === "update") {
+        const existingMarkers = existingItem.markers;
+        resourceMarkers = request2.item.markers ?? existingMarkers;
+        action2 = "update";
+        authorization = await this._policies.authorizeUserAndInstancesForResources(
+          contextResult.context,
+          {
+            userId: request2.userId,
+            instances: request2.instances,
+            resources: [
+              {
+                resourceKind: this._resourceKind,
+                resourceId: existingItem.address,
+                action: action2,
+                markers: resourceMarkers
+              },
+              ...getMarkerResourcesForUpdate(
+                existingMarkers,
+                request2.item.markers
+              )
+            ]
+          }
+        );
+        if (authorization.success === false) {
+          return authorization;
+        }
+      } else {
+        resourceMarkers = request2.item.markers;
+        authorization = await this._policies.authorizeUserAndInstancesForResources(
+          contextResult.context,
+          {
+            userId: request2.userId,
+            instances: request2.instances,
+            resources: [
+              {
+                resourceKind: this._resourceKind,
+                resourceId: request2.item.address,
+                action: action2,
+                markers: resourceMarkers
+              },
+              ...getMarkerResourcesForCreation(
+                resourceMarkers
+              )
+            ]
+          }
+        );
+        if (authorization.success === false) {
+          return authorization;
+        }
+      }
+      if (!resourceMarkers) {
+        return {
+          success: false,
+          errorCode: "invalid_request",
+          errorMessage: "The item must have markers."
+        };
+      }
+      const item = this._transformInputItem(request2.item);
+      const subscriptionResult = await this._checkSubscriptionMetrics(
+        action2,
+        contextResult.context,
+        authorization,
+        item
+      );
+      if (subscriptionResult.success === false) {
+        return subscriptionResult;
+      }
+      await this._store.putItem(recordName, item);
+      return {
+        success: true,
+        recordName,
+        address: item.address
+      };
+    } catch (err) {
+      const span = trace.getActiveSpan();
+      span?.recordException(err);
+      span?.setStatus({ code: SpanStatusCode.ERROR });
+      console.error(`[${this._name}] Error recording item:`, err);
+      return {
+        success: false,
+        errorCode: "server_error",
+        errorMessage: "A server error occurred."
+      };
+    }
+  }
+  async getItem(request2) {
+    try {
+      const baseRequest = {
+        recordKeyOrRecordName: request2.recordName,
+        userId: request2.userId,
+        instances: request2.instances
+      };
+      const context = await this._policies.constructAuthorizationContext(
+        baseRequest
+      );
+      if (context.success === false) {
+        return context;
+      }
+      const result = await this._store.getItemByAddress(
+        context.context.recordName,
+        request2.address
+      );
+      if (!result) {
+        return {
+          success: false,
+          errorCode: "data_not_found",
+          errorMessage: "The item was not found."
+        };
+      }
+      const markers = result.markers;
+      const authorization = await this._policies.authorizeUserAndInstances(
+        context.context,
+        {
+          userId: request2.userId,
+          instances: request2.instances,
+          resourceKind: this._resourceKind,
+          resourceId: request2.address,
+          action: "read",
+          markers
+        }
+      );
+      if (authorization.success === false) {
+        return authorization;
+      }
+      return {
+        success: true,
+        item: this._convertItemToResult(result, context.context)
+      };
+    } catch (err) {
+      const span = trace.getActiveSpan();
+      span?.recordException(err);
+      span?.setStatus({ code: SpanStatusCode.ERROR });
+      console.error(`[${this._name}] Error getting item:`, err);
+      return {
+        success: false,
+        errorCode: "server_error",
+        errorMessage: "A server error occurred."
+      };
+    }
+  }
+  async eraseItem(request2) {
+    try {
+      const context = await this._policies.constructAuthorizationContext({
+        recordKeyOrRecordName: request2.recordName,
+        userId: request2.userId
+      });
+      if (context.success === false) {
+        return context;
+      }
+      const result = await this._store.getItemByAddress(
+        context.context.recordName,
+        request2.address
+      );
+      if (!result) {
+        return {
+          success: false,
+          errorCode: "data_not_found",
+          errorMessage: "The item was not found."
+        };
+      }
+      const markers = result.markers;
+      const authorization = await this._policies.authorizeUserAndInstances(
+        context.context,
+        {
+          userId: request2.userId,
+          instances: request2.instances,
+          resourceKind: this._resourceKind,
+          resourceId: request2.address,
+          action: "delete",
+          markers
+        }
+      );
+      if (authorization.success === false) {
+        return authorization;
+      }
+      const recordName = context.context.recordName;
+      const subscriptionResult = await this._checkSubscriptionMetrics(
+        "delete",
+        context.context,
+        authorization
+      );
+      if (subscriptionResult.success === false) {
+        return subscriptionResult;
+      }
+      await this._store.deleteItem(recordName, request2.address);
+      return {
+        success: true
+      };
+    } catch (err) {
+      const span = trace.getActiveSpan();
+      span?.recordException(err);
+      span?.setStatus({ code: SpanStatusCode.ERROR });
+      console.error(`[${this._name}] Error erasing item:`, err);
+      return {
+        success: false,
+        errorCode: "server_error",
+        errorMessage: "A server error occurred."
+      };
+    }
+  }
+  async listItems(request2) {
+    try {
+      const baseRequest = {
+        recordKeyOrRecordName: request2.recordName,
+        userId: request2.userId,
+        instances: request2.instances
+      };
+      const context = await this._policies.constructAuthorizationContext(
+        baseRequest
+      );
+      if (context.success === false) {
+        return context;
+      }
+      const authorization = await this._policies.authorizeUserAndInstances(
+        context.context,
+        {
+          userId: request2.userId,
+          instances: request2.instances,
+          resourceKind: this._resourceKind,
+          action: "list",
+          markers: [ACCOUNT_MARKER]
+        }
+      );
+      if (authorization.success === false) {
+        return authorization;
+      }
+      const result2 = await this._store.listItems(
+        context.context.recordName,
+        request2.startingAddress
+      );
+      return {
+        success: true,
+        recordName: context.context.recordName,
+        items: result2.items.map(
+          (item) => this._convertItemToResult(item, context.context)
+        ),
+        totalCount: result2.totalCount
+      };
+    } catch (err) {
+      const span = trace.getActiveSpan();
+      span?.recordException(err);
+      span?.setStatus({ code: SpanStatusCode.ERROR });
+      console.error(`[${this._name}] Error listing items:`, err);
+      return {
+        success: false,
+        errorCode: "server_error",
+        errorMessage: "A server error occurred."
+      };
+    }
+  }
+  async listItemsByMarker(request2) {
+    try {
+      const baseRequest = {
+        recordKeyOrRecordName: request2.recordName,
+        userId: request2.userId,
+        instances: request2.instances
+      };
+      const context = await this._policies.constructAuthorizationContext(
+        baseRequest
+      );
+      if (context.success === false) {
+        return context;
+      }
+      const authorization = await this._policies.authorizeUserAndInstances(
+        context.context,
+        {
+          userId: request2.userId,
+          instances: request2.instances,
+          resourceKind: this._resourceKind,
+          action: "list",
+          markers: [request2.marker]
+        }
+      );
+      if (authorization.success === false) {
+        return authorization;
+      }
+      const result2 = await this._store.listItemsByMarker({
+        recordName: context.context.recordName,
+        startingAddress: request2.startingAddress,
+        marker: request2.marker,
+        sort: request2.sort
+      });
+      return {
+        success: true,
+        recordName: context.context.recordName,
+        items: result2.items.map(
+          (item) => this._convertItemToResult(item, context.context)
+        ),
+        totalCount: result2.totalCount
+      };
+    } catch (err) {
+      const span = trace.getActiveSpan();
+      span?.recordException(err);
+      span?.setStatus({ code: SpanStatusCode.ERROR });
+      console.error(`[${this._name}] Error listing items:`, err);
+      return {
+        success: false,
+        errorCode: "server_error",
+        errorMessage: "A server error occurred."
+      };
+    }
+  }
+  /**
+   * Converts the given item to a version that is able to be returned to clients.
+   * Can be overriden to ensure that some fields are not returned.
+   * @param item The item that should be converted.
+   * @param context The authorization context.
+   * @returns The converted item.
+   */
+  _convertItemToResult(item, context) {
+    return item;
+  }
+  /**
+   * Transforms the given input item and returns the transformed item.
+   * Useful for transforming items before they are stored.
+   * @param item The item that should be transformed.
+   */
+  _transformInputItem(item) {
+    return item;
+  }
+};
+__decorateClass([
+  traced(TRACE_NAME8)
+], CrudRecordsController.prototype, "recordItem", 1);
+__decorateClass([
+  traced(TRACE_NAME8)
+], CrudRecordsController.prototype, "getItem", 1);
+__decorateClass([
+  traced(TRACE_NAME8)
+], CrudRecordsController.prototype, "eraseItem", 1);
+__decorateClass([
+  traced(TRACE_NAME8)
+], CrudRecordsController.prototype, "listItems", 1);
+__decorateClass([
+  traced(TRACE_NAME8)
+], CrudRecordsController.prototype, "listItemsByMarker", 1);
+
+// ../aux-records/notifications/WebPushInterface.ts
+var SUBSCRIPTION_ID_NAMESPACE = "f12953a9-21e2-47d4-b7b7-f699bd9a5550";
+var PUSH_SUBSCRIPTION_SCHEMA = z.object({
+  endpoint: z.string(),
+  expirationTime: z.number().optional().nullable(),
+  keys: z.record(z.string())
+});
+var PUSH_NOTIFICATION_PAYLOAD_ACTION = z.discriminatedUnion("type", [
+  z.object({
+    type: z.literal("open_url"),
+    url: z.string()
+  }),
+  z.object({
+    type: z.literal("webhook"),
+    method: z.enum(["GET", "POST"]),
+    url: z.string(),
+    headers: z.record(z.string()).optional().nullable()
+  })
+]);
+var PUSH_NOTIFICATION_PAYLOAD = z.object({
+  title: z.string().min(1),
+  body: z.string().min(2),
+  icon: z.string().min(1).optional().nullable(),
+  badge: z.string().min(1).optional().nullable(),
+  silent: z.boolean().optional().nullable(),
+  tag: z.string().min(1).optional().nullable(),
+  timestamp: z.number().optional().nullable(),
+  action: PUSH_NOTIFICATION_PAYLOAD_ACTION.optional().nullable(),
+  actions: z.array(
+    z.object({
+      title: z.string().min(1),
+      icon: z.string().min(1).optional().nullable(),
+      action: PUSH_NOTIFICATION_PAYLOAD_ACTION
+    })
+  ).optional().nullable()
+});
+
+// ../aux-records/notifications/NotificationRecordsController.ts
+var TRACE_NAME9 = "NotificationRecordsController";
+var NotificationRecordsController = class extends CrudRecordsController {
+  constructor(config2) {
+    super({
+      ...config2,
+      name: "NotificationRecordsController",
+      resourceKind: "notification"
+    });
+    this._pushInterface = config2.pushInterface;
+  }
+  async getApplicationServerKey() {
+    try {
+      const key = this._pushInterface.getServerApplicationKey();
+      return {
+        success: true,
+        key
+      };
+    } catch (err) {
+      const span = trace.getActiveSpan();
+      span?.recordException(err);
+      span?.setStatus({ code: SpanStatusCode.ERROR });
+      console.error(
+        "[NotificationRecordsController] Error subscribing to notification:",
+        err
+      );
+      return {
+        success: false,
+        errorCode: "server_error",
+        errorMessage: "A server error occurred."
+      };
+    }
+  }
+  async subscribeToNotification(request2) {
+    try {
+      const context = await this.policies.constructAuthorizationContext({
+        userId: request2.userId,
+        recordKeyOrRecordName: request2.recordName
+      });
+      if (context.success === false) {
+        return context;
+      }
+      const recordName = context.context.recordName;
+      const userId = context.context.userId;
+      const notification = await this.store.getItemByAddress(
+        recordName,
+        request2.address
+      );
+      if (!notification) {
+        return {
+          success: false,
+          errorCode: "data_not_found",
+          errorMessage: "Notification not found."
+        };
+      }
+      const authorization = await this.policies.authorizeUserAndInstances(
+        context.context,
+        {
+          action: "subscribe",
+          resourceKind: "notification",
+          resourceId: notification.address,
+          markers: notification.markers,
+          userId,
+          instances: request2.instances
+        }
+      );
+      if (authorization.success === false) {
+        return authorization;
+      }
+      const metrics3 = await this._checkSubscriptionMetrics(
+        "subscribe",
+        context.context,
+        authorization,
+        notification
+      );
+      if (metrics3.success === false) {
+        return metrics3;
+      }
+      const pushSubscriptionId = this._getPushSubscriptionId(
+        request2.pushSubscription.endpoint
+      );
+      await this.store.savePushSubscription({
+        id: pushSubscriptionId,
+        active: true,
+        endpoint: request2.pushSubscription.endpoint,
+        keys: request2.pushSubscription.keys
+      });
+      await this.store.savePushSubscriptionUser({
+        pushSubscriptionId,
+        userId
+      });
+      let subscriptionId = null;
+      if (userId) {
+        const sub = await this.store.getSubscriptionByRecordAddressAndUserId(
+          recordName,
+          notification.address,
+          userId
+        );
+        if (sub) {
+          subscriptionId = sub.id;
+        }
+      } else {
+        const sub = await this.store.getSubscriptionByRecordAddressAndPushSubscriptionId(
+          recordName,
+          notification.address,
+          pushSubscriptionId
+        );
+        if (sub) {
+          subscriptionId = sub.id;
+        }
+      }
+      if (!subscriptionId) {
+        subscriptionId = v7_default();
+        await this.store.saveSubscription({
+          id: subscriptionId,
+          recordName,
+          notificationAddress: notification.address,
+          userId,
+          pushSubscriptionId: !userId ? pushSubscriptionId : null
+        });
+      }
+      console.log(
+        `[NotificationRecordsController] [userId: ${userId} pushSubscriptionId: ${pushSubscriptionId} subscriptionId: ${subscriptionId}] Subscribed to notification`
+      );
+      return {
+        success: true,
+        subscriptionId
+      };
+    } catch (err) {
+      const span = trace.getActiveSpan();
+      span?.recordException(err);
+      span?.setStatus({ code: SpanStatusCode.ERROR });
+      console.error(
+        "[NotificationRecordsController] Error subscribing to notification:",
+        err
+      );
+      return {
+        success: false,
+        errorCode: "server_error",
+        errorMessage: "A server error occurred."
+      };
+    }
+  }
+  _getPushSubscriptionId(endpoint2) {
+    return v5_default(endpoint2, SUBSCRIPTION_ID_NAMESPACE);
+  }
+  async unsubscribeFromNotification(request2) {
+    try {
+      const subscription = await this.store.getSubscriptionById(
+        request2.subscriptionId
+      );
+      if (!subscription) {
+        return {
+          success: false,
+          errorCode: "data_not_found",
+          errorMessage: "Subscription not found."
+        };
+      }
+      const context = await this.policies.constructAuthorizationContext({
+        userId: request2.userId,
+        recordKeyOrRecordName: subscription.recordName
+      });
+      if (context.success === false) {
+        return context;
+      }
+      let successfulAuthorization = false;
+      if (subscription.userId) {
+        const userContext = await this.policies.constructAuthorizationContext({
+          userId: request2.userId,
+          recordKeyOrRecordName: subscription.userId
+        });
+        if (userContext.success === true) {
+          const userAuthorization = await this.policies.authorizeUserAndInstances(
+            userContext.context,
+            {
+              userId: request2.userId,
+              action: "unsubscribe",
+              resourceKind: "notification",
+              resourceId: subscription.id,
+              instances: request2.instances,
+              markers: [PRIVATE_MARKER]
+            }
+          );
+          if (userAuthorization.success === true) {
+            successfulAuthorization = true;
+          }
+        }
+      }
+      const userId = context.context.userId;
+      const recordName = context.context.recordName;
+      if (!successfulAuthorization) {
+        const notification = await this.store.getItemByAddress(
+          recordName,
+          subscription.notificationAddress
+        );
+        if (!notification) {
+          return {
+            success: false,
+            errorCode: "data_not_found",
+            errorMessage: "Notification not found."
+          };
+        }
+        const authorization = await this.policies.authorizeUserAndInstances(
+          context.context,
+          {
+            userId,
+            action: "unsubscribe",
+            resourceKind: "notification",
+            resourceId: notification.address,
+            instances: request2.instances,
+            markers: notification.markers
+          }
+        );
+        if (authorization.success === false) {
+          return authorization;
+        }
+      }
+      await this.store.deleteSubscription(request2.subscriptionId);
+      console.log(
+        `[NotificationRecordsController] [userId: ${userId} subscriptionId: ${request2.subscriptionId}] Unsubscribed from notification`
+      );
+      return {
+        success: true
+      };
+    } catch (err) {
+      const span = trace.getActiveSpan();
+      span?.recordException(err);
+      span?.setStatus({ code: SpanStatusCode.ERROR });
+      console.error(
+        "[NotificationRecordsController] Error subscribing to notification:",
+        err
+      );
+      return {
+        success: false,
+        errorCode: "server_error",
+        errorMessage: "A server error occurred."
+      };
+    }
+  }
+  async registerPushSubscription(request2) {
+    try {
+      if (!request2.userId) {
+        return {
+          success: false,
+          errorCode: "not_logged_in",
+          errorMessage: "The user must be logged in. Please provide a sessionKey or a recordKey."
+        };
+      }
+      const pushSubscriptionId = this._getPushSubscriptionId(
+        request2.pushSubscription.endpoint
+      );
+      await this.store.savePushSubscription({
+        id: pushSubscriptionId,
+        active: true,
+        endpoint: request2.pushSubscription.endpoint,
+        keys: request2.pushSubscription.keys
+      });
+      await this.store.savePushSubscriptionUser({
+        pushSubscriptionId,
+        userId: request2.userId
+      });
+      console.log(
+        `[NotificationRecordsController] [userId: ${request2.userId} pushSubscriptionId: ${pushSubscriptionId}] Registered push subscription`
+      );
+      return {
+        success: true
+      };
+    } catch (err) {
+      const span = trace.getActiveSpan();
+      span?.recordException(err);
+      span?.setStatus({ code: SpanStatusCode.ERROR });
+      console.error(
+        "[NotificationRecordsController] Error registering push subscription:",
+        err
+      );
+      return {
+        success: false,
+        errorCode: "server_error",
+        errorMessage: "A server error occurred."
+      };
+    }
+  }
+  async sendNotification(request2) {
+    try {
+      const context = await this.policies.constructAuthorizationContext({
+        userId: request2.userId,
+        recordKeyOrRecordName: request2.recordName
+      });
+      if (context.success === false) {
+        return context;
+      }
+      const recordName = context.context.recordName;
+      const userId = context.context.userId;
+      const notification = await this.store.getItemByAddress(
+        recordName,
+        request2.address
+      );
+      if (!notification) {
+        return {
+          success: false,
+          errorCode: "data_not_found",
+          errorMessage: "Notification not found."
+        };
+      }
+      const authorization = await this.policies.authorizeUserAndInstances(
+        context.context,
+        {
+          action: "send",
+          resourceKind: "notification",
+          resourceId: notification.address,
+          markers: notification.markers,
+          userId,
+          instances: request2.instances
+        }
+      );
+      if (authorization.success === false) {
+        return authorization;
+      }
+      const metrics3 = await this._checkSubscriptionMetrics(
+        "send",
+        context.context,
+        authorization,
+        notification
+      );
+      if (metrics3.success === false) {
+        return metrics3;
+      }
+      const pushSubs = await this.store.listActivePushSubscriptionsForNotification(
+        recordName,
+        notification.address
+      );
+      if (typeof metrics3.features.maxSentPushNotificationsPerPeriod === "number") {
+        if (metrics3.metrics.totalSentNotificationsInPeriod + pushSubs.length >= metrics3.features.maxSentPushNotificationsPerPeriod) {
+          return {
+            success: false,
+            errorCode: "subscription_limit_reached",
+            errorMessage: "The maximum number of sent push notifications has been reached for this period."
+          };
+        }
+      }
+      let promises = [];
+      const sentTimeMs = Date.now();
+      for (let push of pushSubs) {
+        promises.push(
+          this._pushInterface.sendNotification(
+            {
+              endpoint: push.endpoint,
+              keys: push.keys
+            },
+            request2.payload,
+            request2.topic
+          ).then((result) => {
+            return [push, result];
+          })
+        );
+      }
+      const results = await Promise.allSettled(promises);
+      const notificationId = v7_default();
+      await this.store.saveSentNotification({
+        id: notificationId,
+        recordName,
+        notificationAddress: notification.address,
+        title: request2.payload.title,
+        body: request2.payload.body,
+        icon: request2.payload.icon,
+        badge: request2.payload.badge,
+        defaultAction: request2.payload.action,
+        actions: request2.payload.actions,
+        silent: request2.payload.silent,
+        tag: request2.payload.tag,
+        timestamp: request2.payload.timestamp,
+        sentTimeMs,
+        topic: request2.topic
+      });
+      let sentPushNotifications = [];
+      let failedPushSubscriptions = [];
+      for (let promiseResult of results) {
+        if (promiseResult.status === "rejected") {
+          console.error(
+            "[NotificationRecordsController] Error sending notification:",
+            promiseResult.reason
+          );
+        } else {
+          const [push, result] = promiseResult.value;
+          sentPushNotifications.push({
+            id: v7_default(),
+            pushSubscriptionId: push.id,
+            sentNotificationId: notificationId,
+            userId: push.userId,
+            subscriptionId: push.subscriptionId,
+            success: result.success,
+            errorCode: result.success === false ? result.errorCode : null
+          });
+          if (result.success === false) {
+            console.error(
+              `[NotificationRecordsController] Error sending notification for ${push.id}:`,
+              result.errorCode
+            );
+            if (result.errorCode === "subscription_gone" || result.errorCode === "subscription_not_found") {
+              failedPushSubscriptions.push(push.id);
+            }
+          }
+        }
+      }
+      if (sentPushNotifications.length > 0) {
+        await this.store.createSentPushNotifications(
+          sentPushNotifications
+        );
+      }
+      if (failedPushSubscriptions.length > 0) {
+        await this.store.markPushSubscriptionsInactiveAndDeleteUserRelations(
+          failedPushSubscriptions
+        );
+      }
+      console.log(
+        `[NotificationRecordsController] [userId: ${userId} notificationId: ${notificationId} sent: ${sentPushNotifications.length} failed: ${failedPushSubscriptions.length}] Sent notification`
+      );
+      return {
+        success: true
+      };
+    } catch (err) {
+      const span = trace.getActiveSpan();
+      span?.recordException(err);
+      span?.setStatus({ code: SpanStatusCode.ERROR });
+      console.error(
+        "[NotificationRecordsController] Error sending notification:",
+        err
+      );
+      return {
+        success: false,
+        errorCode: "server_error",
+        errorMessage: "A server error occurred."
+      };
+    }
+  }
+  async listSubscriptionsForUser(request2) {
+    try {
+      if (!request2.userId) {
+        return {
+          success: false,
+          errorCode: "not_logged_in",
+          errorMessage: "The user must be logged in. Please provide a sessionKey or a recordKey."
+        };
+      }
+      const subscriptions = await this.store.listSubscriptionsForUser(
+        request2.userId
+      );
+      return {
+        success: true,
+        subscriptions: subscriptions.map((sub) => ({
+          id: sub.id,
+          userId: sub.userId,
+          recordName: sub.recordName,
+          notificationAddress: sub.notificationAddress,
+          pushSubscriptionId: sub.pushSubscriptionId
+        }))
+      };
+    } catch (err) {
+      const span = trace.getActiveSpan();
+      span?.recordException(err);
+      span?.setStatus({ code: SpanStatusCode.ERROR });
+      console.error(
+        "[NotificationRecordsController] Error listing subscriptions for user:",
+        err
+      );
+      return {
+        success: false,
+        errorCode: "server_error",
+        errorMessage: "A server error occurred."
+      };
+    }
+  }
+  async listSubscriptions(request2) {
+    try {
+      if (!request2.userId) {
+        return {
+          success: false,
+          errorCode: "not_logged_in",
+          errorMessage: "The user must be logged in. Please provide a sessionKey or a recordKey."
+        };
+      }
+      const context = await this.policies.constructAuthorizationContext({
+        recordKeyOrRecordName: request2.recordName,
+        userId: request2.userId
+      });
+      if (context.success === false) {
+        return context;
+      }
+      const recordName = context.context.recordName;
+      const notification = await this.store.getItemByAddress(
+        recordName,
+        request2.address
+      );
+      if (!notification) {
+        return {
+          success: false,
+          errorCode: "data_not_found",
+          errorMessage: "Notification not found."
+        };
+      }
+      const authorization = await this.policies.authorizeUserAndInstances(
+        context.context,
+        {
+          userId: request2.userId,
+          resourceKind: "notification",
+          markers: notification.markers,
+          resourceId: notification.address,
+          action: "listSubscriptions",
+          instances: request2.instances
+        }
+      );
+      if (authorization.success === false) {
+        return authorization;
+      }
+      const subscriptions = await this.store.listSubscriptionsForNotification(
+        recordName,
+        request2.address
+      );
+      return {
+        success: true,
+        subscriptions: subscriptions.map((sub) => ({
+          id: sub.id,
+          userId: sub.userId,
+          recordName: sub.recordName,
+          notificationAddress: sub.notificationAddress,
+          pushSubscriptionId: sub.pushSubscriptionId
+        }))
+      };
+    } catch (err) {
+      const span = trace.getActiveSpan();
+      span?.recordException(err);
+      span?.setStatus({ code: SpanStatusCode.ERROR });
+      console.error(
+        "[NotificationRecordsController] Error listing subscriptions for notification:",
+        err
+      );
+      return {
+        success: false,
+        errorCode: "server_error",
+        errorMessage: "A server error occurred."
+      };
+    }
+  }
+  async _checkSubscriptionMetrics(action2, context, authorization, item) {
+    const config2 = await this.config.getSubscriptionConfiguration();
+    const metrics3 = await this.store.getSubscriptionMetrics({
+      ownerId: context.recordOwnerId,
+      studioId: context.recordStudioId
+    });
+    const features = getNotificationFeatures(
+      config2,
+      metrics3.subscriptionStatus,
+      metrics3.subscriptionId,
+      metrics3.subscriptionType,
+      metrics3.currentPeriodStartMs,
+      metrics3.currentPeriodEndMs
+    );
+    if (!features.allowed) {
+      return {
+        success: false,
+        errorCode: "not_authorized",
+        errorMessage: "Notifications are not allowed for this subscription."
+      };
+    }
+    if (action2 === "create" && typeof features.maxItems === "number") {
+      if (metrics3.totalItems >= features.maxItems) {
+        return {
+          success: false,
+          errorCode: "subscription_limit_reached",
+          errorMessage: "The maximum number of notification items has been reached for your subscription."
+        };
+      }
+    }
+    if (action2 === "subscribe" && typeof features.maxSubscribersPerItem === "number") {
+      const totalSubscriptions = await this.store.countSubscriptionsForNotification(
+        context.recordName,
+        item.address
+      );
+      if (totalSubscriptions >= features.maxSubscribersPerItem) {
+        return {
+          success: false,
+          errorCode: "subscription_limit_reached",
+          errorMessage: "The maximum number of subscriptions has been reached for this notification."
+        };
+      }
+    }
+    if (action2 === "send") {
+      if (typeof features.maxSentNotificationsPerPeriod === "number" && metrics3.totalSentNotificationsInPeriod >= features.maxSentNotificationsPerPeriod) {
+        return {
+          success: false,
+          errorCode: "subscription_limit_reached",
+          errorMessage: "The maximum number of sent notifications has been reached for this period."
+        };
+      }
+    }
+    return {
+      success: true,
+      config: config2,
+      metrics: metrics3,
+      features
+    };
+  }
+};
+__decorateClass([
+  traced(TRACE_NAME9)
+], NotificationRecordsController.prototype, "getApplicationServerKey", 1);
+__decorateClass([
+  traced(TRACE_NAME9)
+], NotificationRecordsController.prototype, "subscribeToNotification", 1);
+__decorateClass([
+  traced(TRACE_NAME9)
+], NotificationRecordsController.prototype, "unsubscribeFromNotification", 1);
+__decorateClass([
+  traced(TRACE_NAME9)
+], NotificationRecordsController.prototype, "registerPushSubscription", 1);
+__decorateClass([
+  traced(TRACE_NAME9)
+], NotificationRecordsController.prototype, "sendNotification", 1);
+__decorateClass([
+  traced(TRACE_NAME9)
+], NotificationRecordsController.prototype, "listSubscriptionsForUser", 1);
+__decorateClass([
+  traced(TRACE_NAME9)
+], NotificationRecordsController.prototype, "listSubscriptions", 1);
+
+// ../aux-records/crud/MemoryCrudRecordsStore.ts
 var import_lodash21 = __toESM(require_lodash());
+
+// ../aux-records/notifications/MemoryNotificationRecordsStore.ts
+var import_lodash22 = __toESM(require_lodash());
+
+// ../aux-records/RecordsServer.ts
 var NOT_LOGGED_IN_RESULT = {
   success: false,
   errorCode: "not_logged_in",
@@ -114117,7 +115506,8 @@ var RecordsServer = class {
     aiController,
     moderationController,
     loomController,
-    webhooksController
+    webhooksController,
+    notificationsController
   }) {
     /**
      * The map of paths to routes that they match.
@@ -114141,9 +115531,10 @@ var RecordsServer = class {
     this._moderationController = moderationController;
     this._loomController = loomController;
     this._webhooksController = webhooksController;
+    this._notificationsController = notificationsController;
     this._tracer = trace.getTracer(
       "RecordsServer",
-      false ? void 0 : "v3.3.11-alpha.11060020867"
+      false ? void 0 : "v3.3.11"
     );
     this._procedures = this._createProcedures();
     this._setupRoutes();
@@ -114383,6 +115774,21 @@ var RecordsServer = class {
           return result;
         }
       ),
+      requestPrivacyFeaturesChange: procedure().origins("account").http("POST", "/api/v2/privacyFeatures/change").inputs(
+        z.object({
+          userId: z.string()
+        })
+      ).handler(async ({ userId }, context) => {
+        const sessionKey = context.sessionKey;
+        if (!sessionKey) {
+          return NOT_LOGGED_IN_RESULT;
+        }
+        const result = await this._auth.requestPrivacyFeaturesChange({
+          userId,
+          sessionKey
+        });
+        return result;
+      }),
       getWebAuthnRegistrationOptions: procedure().origins(true).http("GET", "/api/v2/webauthn/register/options").handler(async (_3, context) => {
         const validation = await this._validateSessionKey(
           context.sessionKey
@@ -114901,7 +116307,7 @@ var RecordsServer = class {
               ipAddress: context.httpRequest.ipAddress,
               path: "/api/v2/records/webhook/run",
               body: JSON.stringify(data),
-              headers: (0, import_lodash21.omit)(
+              headers: (0, import_lodash23.omit)(
                 context.httpRequest.headers,
                 ...bannedHeaders
               ),
@@ -115010,6 +116416,246 @@ var RecordsServer = class {
         );
         return result;
       }),
+      recordNotification: recordItemProcedure(
+        this._auth,
+        this._notificationsController,
+        z.object({
+          address: ADDRESS_VALIDATION,
+          description: z.string().min(1),
+          markers: MARKERS_VALIDATION.optional().default([
+            PRIVATE_MARKER
+          ])
+        }),
+        procedure().origins("api").http("POST", "/api/v2/records/notification")
+      ),
+      getNotification: getItemProcedure(
+        this._auth,
+        this._notificationsController,
+        procedure().origins("api").http("GET", "/api/v2/records/notification")
+      ),
+      listNotifications: listItemsProcedure(
+        this._auth,
+        this._notificationsController,
+        procedure().origins("api").http("GET", "/api/v2/records/notification/list")
+      ),
+      listNotificationSubscriptions: procedure().origins("api").http("GET", "/api/v2/records/notification/list/subscriptions").inputs(
+        z.object({
+          recordName: RECORD_NAME_VALIDATION,
+          address: ADDRESS_VALIDATION,
+          instances: INSTANCES_ARRAY_VALIDATION.optional()
+        })
+      ).handler(
+        async ({ recordName, address, instances }, context) => {
+          if (!this._notificationsController) {
+            return {
+              success: false,
+              errorCode: "not_supported",
+              errorMessage: "This feature is not supported."
+            };
+          }
+          const validation = await this._validateSessionKey(
+            context.sessionKey
+          );
+          if (validation.success === false) {
+            if (validation.errorCode === "no_session_key") {
+              return NOT_LOGGED_IN_RESULT;
+            }
+            return validation;
+          }
+          const result = await this._notificationsController.listSubscriptions(
+            {
+              recordName,
+              address,
+              userId: validation.userId,
+              instances
+            }
+          );
+          return result;
+        }
+      ),
+      listUserNotificationSubscriptions: procedure().origins("api").http(
+        "GET",
+        "/api/v2/records/notification/list/user/subscriptions"
+      ).inputs(
+        z.object({
+          instances: INSTANCES_ARRAY_VALIDATION.optional()
+        })
+      ).handler(async ({ instances }, context) => {
+        if (!this._notificationsController) {
+          return {
+            success: false,
+            errorCode: "not_supported",
+            errorMessage: "This feature is not supported."
+          };
+        }
+        const validation = await this._validateSessionKey(
+          context.sessionKey
+        );
+        if (validation.success === false) {
+          if (validation.errorCode === "no_session_key") {
+            return NOT_LOGGED_IN_RESULT;
+          }
+          return validation;
+        }
+        const result = await this._notificationsController.listSubscriptionsForUser(
+          {
+            userId: validation.userId,
+            instances
+          }
+        );
+        return result;
+      }),
+      eraseNotification: eraseItemProcedure(
+        this._auth,
+        this._notificationsController,
+        procedure().origins("api").http("DELETE", "/api/v2/records/notification")
+      ),
+      registerPushSubscription: procedure().origins("api").http("POST", "/api/v2/records/notification/register").inputs(
+        z.object({
+          pushSubscription: PUSH_SUBSCRIPTION_SCHEMA,
+          instances: INSTANCES_ARRAY_VALIDATION.optional()
+        })
+      ).handler(async ({ pushSubscription, instances }, context) => {
+        if (!this._notificationsController) {
+          return {
+            success: false,
+            errorCode: "not_supported",
+            errorMessage: "This feature is not supported."
+          };
+        }
+        const validation = await this._validateSessionKey(
+          context.sessionKey
+        );
+        if (validation.success === false && validation.errorCode !== "no_session_key") {
+          return validation;
+        }
+        const result = await this._notificationsController.registerPushSubscription(
+          {
+            userId: validation.userId,
+            pushSubscription,
+            instances
+          }
+        );
+        return result;
+      }),
+      subscribeToNotification: procedure().origins("api").http("POST", "/api/v2/records/notification/subscribe").inputs(
+        z.object({
+          recordName: RECORD_NAME_VALIDATION,
+          address: ADDRESS_VALIDATION,
+          instances: INSTANCES_ARRAY_VALIDATION.optional(),
+          pushSubscription: PUSH_SUBSCRIPTION_SCHEMA
+        })
+      ).handler(
+        async ({ recordName, address, instances, pushSubscription }, context) => {
+          if (!this._notificationsController) {
+            return {
+              success: false,
+              errorCode: "not_supported",
+              errorMessage: "This feature is not supported."
+            };
+          }
+          const validation = await this._validateSessionKey(
+            context.sessionKey
+          );
+          if (validation.success === false && validation.errorCode !== "no_session_key") {
+            return validation;
+          }
+          const result = await this._notificationsController.subscribeToNotification(
+            {
+              recordName,
+              address,
+              userId: validation.userId,
+              pushSubscription,
+              instances
+            }
+          );
+          return result;
+        }
+      ),
+      unsubscribeFromNotification: procedure().origins("api").http("POST", "/api/v2/records/notification/unsubscribe").inputs(
+        z.object({
+          subscriptionId: z.string(),
+          instances: INSTANCES_ARRAY_VALIDATION.optional()
+        })
+      ).handler(async ({ subscriptionId, instances }, context) => {
+        if (!this._notificationsController) {
+          return {
+            success: false,
+            errorCode: "not_supported",
+            errorMessage: "This feature is not supported."
+          };
+        }
+        const validation = await this._validateSessionKey(
+          context.sessionKey
+        );
+        if (validation.success === false) {
+          if (validation.errorCode === "no_session_key") {
+            return NOT_LOGGED_IN_RESULT;
+          }
+          return validation;
+        }
+        const result = await this._notificationsController.unsubscribeFromNotification(
+          {
+            subscriptionId,
+            userId: validation.userId,
+            instances
+          }
+        );
+        return result;
+      }),
+      sendNotification: procedure().origins("api").http("POST", "/api/v2/records/notification/send").inputs(
+        z.object({
+          recordName: RECORD_NAME_VALIDATION,
+          address: ADDRESS_VALIDATION,
+          instances: INSTANCES_ARRAY_VALIDATION.optional(),
+          payload: PUSH_NOTIFICATION_PAYLOAD,
+          topic: z.string().optional()
+        })
+      ).handler(
+        async ({ recordName, address, instances, payload, topic }, context) => {
+          if (!this._notificationsController) {
+            return {
+              success: false,
+              errorCode: "not_supported",
+              errorMessage: "This feature is not supported."
+            };
+          }
+          const validation = await this._validateSessionKey(
+            context.sessionKey
+          );
+          if (validation.success === false) {
+            if (validation.errorCode === "no_session_key") {
+              return NOT_LOGGED_IN_RESULT;
+            }
+            return validation;
+          }
+          const result = await this._notificationsController.sendNotification(
+            {
+              recordName,
+              address,
+              userId: validation.userId,
+              payload,
+              topic,
+              instances
+            }
+          );
+          return result;
+        }
+      ),
+      getNotificationsApplicationServerKey: procedure().origins("api").http(
+        "GET",
+        "/api/v2/records/notification/applicationServerKey"
+      ).handler(async () => {
+        if (!this._notificationsController) {
+          return {
+            success: false,
+            errorCode: "not_supported",
+            errorMessage: "This feature is not supported."
+          };
+        }
+        const result = await this._notificationsController.getApplicationServerKey();
+        return result;
+      }),
       listRecords: procedure().origins("api").http("GET", "/api/v2/records/list").inputs(
         z.object({
           studioId: z.string().nonempty().optional(),
@@ -116222,8 +117868,8 @@ var RecordsServer = class {
         return {
           success: true,
           ...metadata,
-          version: true ? "v3.3.11-alpha.11060020867" : void 0,
-          versionHash: true ? "7781de97502b390b36df63d2cbcc1ab149e0dc90" : void 0
+          version: true ? "v3.3.11" : void 0,
+          versionHash: true ? "8e5ee8f33c196328a1c90dbbd799d2ddf248f31d" : void 0
         };
       })
     };
@@ -116369,7 +118015,7 @@ var RecordsServer = class {
             result,
             context
           );
-          return (0, import_lodash21.merge)(response, procedureResponse);
+          return (0, import_lodash23.merge)(response, procedureResponse);
         }
         return response;
       },
@@ -119592,7 +121238,7 @@ var STRIPE_EVENT_INVOICE_PAID_SCHEMA = z.object({
 });
 
 // ../aux-records/SubscriptionController.ts
-var TRACE_NAME8 = "SubscriptionController";
+var TRACE_NAME10 = "SubscriptionController";
 var SubscriptionController = class {
   constructor(stripe, auth7, authStore, recordsStore, config2) {
     this._stripe = stripe;
@@ -120470,19 +122116,19 @@ var SubscriptionController = class {
   }
 };
 __decorateClass([
-  traced(TRACE_NAME8)
+  traced(TRACE_NAME10)
 ], SubscriptionController.prototype, "getSubscriptionStatus", 1);
 __decorateClass([
-  traced(TRACE_NAME8)
+  traced(TRACE_NAME10)
 ], SubscriptionController.prototype, "updateSubscription", 1);
 __decorateClass([
-  traced(TRACE_NAME8)
+  traced(TRACE_NAME10)
 ], SubscriptionController.prototype, "createManageSubscriptionLink", 1);
 __decorateClass([
-  traced(TRACE_NAME8)
+  traced(TRACE_NAME10)
 ], SubscriptionController.prototype, "_createCheckoutSession", 1);
 __decorateClass([
-  traced(TRACE_NAME8)
+  traced(TRACE_NAME10)
 ], SubscriptionController.prototype, "handleStripeWebhook", 1);
 function returnRoute(basePath, user, studio) {
   if (user) {
@@ -120501,7 +122147,7 @@ function studiosRoute(basePath, studioId, studioName) {
 }
 
 // ../aux-records/RateLimitController.ts
-var TRACE_NAME9 = "RateLimitController";
+var TRACE_NAME11 = "RateLimitController";
 var RateLimitController = class {
   constructor(rateLimiter, config2) {
     this._rateLimiter = rateLimiter;
@@ -120548,7 +122194,7 @@ var RateLimitController = class {
   }
 };
 __decorateClass([
-  traced(TRACE_NAME9)
+  traced(TRACE_NAME11)
 ], RateLimitController.prototype, "checkRateLimit", 1);
 
 // ../../node_modules/.pnpm/openai@4.47.1/node_modules/openai/version.mjs
@@ -125168,7 +126814,7 @@ var { OpenAIError: OpenAIError2, APIError: APIError2, APIConnectionError: APICon
 var openai_default = OpenAI;
 
 // ../aux-records/OpenAIChatInterface.ts
-var TRACE_NAME10 = "OpenAIChatInterface";
+var TRACE_NAME12 = "OpenAIChatInterface";
 var SPAN_OPTIONS = {
   kind: SpanKind.CLIENT,
   attributes: {
@@ -125305,14 +126951,14 @@ var OpenAIChatInterface = class {
   }
 };
 __decorateClass([
-  traced(TRACE_NAME10, SPAN_OPTIONS)
+  traced(TRACE_NAME12, SPAN_OPTIONS)
 ], OpenAIChatInterface.prototype, "chat", 1);
 __decorateClass([
-  traced(TRACE_NAME10, SPAN_OPTIONS)
+  traced(TRACE_NAME12, SPAN_OPTIONS)
 ], OpenAIChatInterface.prototype, "chatStream", 1);
 
 // ../aux-records/BlockadeLabsGenerateSkyboxInterface.ts
-var TRACE_NAME11 = "BlockadeLabsGenerateSkyboxInterface";
+var TRACE_NAME13 = "BlockadeLabsGenerateSkyboxInterface";
 var SPAN_OPTIONS2 = {
   kind: SpanKind.CLIENT,
   attributes: {
@@ -125410,17 +127056,17 @@ var BlockadeLabsGenerateSkyboxInterface = class {
   }
 };
 __decorateClass([
-  traced(TRACE_NAME11, SPAN_OPTIONS2)
+  traced(TRACE_NAME13, SPAN_OPTIONS2)
 ], BlockadeLabsGenerateSkyboxInterface.prototype, "generateSkybox", 1);
 __decorateClass([
-  traced(TRACE_NAME11, SPAN_OPTIONS2)
+  traced(TRACE_NAME13, SPAN_OPTIONS2)
 ], BlockadeLabsGenerateSkyboxInterface.prototype, "getSkybox", 1);
 function isFinished(status) {
   return status.status === "complete" || status.status === "abort" || status.status === "error";
 }
 
 // ../aux-records/OpenAIImageInterface.ts
-var TRACE_NAME12 = "OpenAIImageInterface";
+var TRACE_NAME14 = "OpenAIImageInterface";
 var SPAN_OPTIONS3 = {
   kind: SpanKind.CLIENT,
   attributes: {
@@ -125472,12 +127118,12 @@ var OpenAIImageInterface = class {
   }
 };
 __decorateClass([
-  traced(TRACE_NAME12, SPAN_OPTIONS3)
+  traced(TRACE_NAME14, SPAN_OPTIONS3)
 ], OpenAIImageInterface.prototype, "generateImage", 1);
 
 // ../aux-records/StabilityAIImageInterface.ts
-var import_lodash22 = __toESM(require_lodash());
-var TRACE_NAME13 = "StabilityAIImageInterface";
+var import_lodash24 = __toESM(require_lodash());
+var TRACE_NAME15 = "StabilityAIImageInterface";
 var StabilityAIImageInterface = class {
   constructor(options) {
     this._options = options;
@@ -125533,7 +127179,7 @@ var StabilityAIImageInterface = class {
       console.log(
         `[StabilityAIImageInterface] [${request2.userId}] [generateImage]: Done!`
       );
-      const images = (0, import_lodash22.flatMap)(
+      const images = (0, import_lodash24.flatMap)(
         result.data,
         (a3) => a3.map((d2) => ({
           base64: d2.base64,
@@ -125668,16 +127314,16 @@ var StabilityAIImageInterface = class {
   }
 };
 __decorateClass([
-  traced(TRACE_NAME13)
+  traced(TRACE_NAME15)
 ], StabilityAIImageInterface.prototype, "generateImage", 1);
 __decorateClass([
-  traced(TRACE_NAME13)
+  traced(TRACE_NAME15)
 ], StabilityAIImageInterface.prototype, "_stableImageUltra", 1);
 __decorateClass([
-  traced(TRACE_NAME13)
+  traced(TRACE_NAME15)
 ], StabilityAIImageInterface.prototype, "_stableImageCore", 1);
 __decorateClass([
-  traced(TRACE_NAME13)
+  traced(TRACE_NAME15)
 ], StabilityAIImageInterface.prototype, "_sd3", 1);
 function getStableImageAspectRatio(width, height) {
   if (!width || !height) {
@@ -126517,7 +128163,7 @@ var GoogleGenerativeAI = class {
 };
 
 // ../aux-records/GoogleAIChatInterface.ts
-var TRACE_NAME14 = "GoogleAIChatInterface";
+var TRACE_NAME16 = "GoogleAIChatInterface";
 var SPAN_OPTIONS4 = {
   kind: SpanKind.CLIENT,
   attributes: {
@@ -126697,10 +128343,10 @@ var GoogleAIChatInterface = class {
   }
 };
 __decorateClass([
-  traced(TRACE_NAME14, SPAN_OPTIONS4)
+  traced(TRACE_NAME16, SPAN_OPTIONS4)
 ], GoogleAIChatInterface.prototype, "chat", 1);
 __decorateClass([
-  traced(TRACE_NAME14, SPAN_OPTIONS4)
+  traced(TRACE_NAME16, SPAN_OPTIONS4)
 ], GoogleAIChatInterface.prototype, "chatStream", 1);
 function mapMessage(message2) {
   return {
@@ -128871,7 +130517,7 @@ var { AnthropicError: AnthropicError2, APIError: APIError4, APIConnectionError:
 var sdk_default = Anthropic;
 
 // ../aux-records/AnthropicAIChatInterface.ts
-var TRACE_NAME15 = "AnthropicAIChatInterface";
+var TRACE_NAME17 = "AnthropicAIChatInterface";
 var SPAN_OPTIONS5 = {
   kind: SpanKind.CLIENT,
   attributes: {
@@ -128991,10 +130637,10 @@ var AnthropicAIChatInterface = class {
   }
 };
 __decorateClass([
-  traced(TRACE_NAME15, SPAN_OPTIONS5)
+  traced(TRACE_NAME17, SPAN_OPTIONS5)
 ], AnthropicAIChatInterface.prototype, "chat", 1);
 __decorateClass([
-  traced(TRACE_NAME15, SPAN_OPTIONS5)
+  traced(TRACE_NAME17, SPAN_OPTIONS5)
 ], AnthropicAIChatInterface.prototype, "chatStream", 1);
 function mapMessage2(message2) {
   return {
@@ -129041,13 +130687,13 @@ function mapOutputContent(content) {
 }
 
 // ../aux-records/MemoryStore.ts
-var import_lodash23 = __toESM(require_lodash());
+var import_lodash25 = __toESM(require_lodash());
 
 // ../aux-records/MemoryFileRecordsLookup.ts
-var import_lodash24 = __toESM(require_lodash());
+var import_lodash26 = __toESM(require_lodash());
 
 // ../aux-records/CachingConfigStore.ts
-var TRACE_NAME16 = "CachingConfigStore";
+var TRACE_NAME18 = "CachingConfigStore";
 var CachingConfigStore = class {
   /**
    * Creates a new CachingConfigStore.
@@ -129103,17 +130749,17 @@ var CachingConfigStore = class {
   }
 };
 __decorateClass([
-  traced(TRACE_NAME16)
+  traced(TRACE_NAME18)
 ], CachingConfigStore.prototype, "getSubscriptionConfiguration", 1);
 __decorateClass([
-  traced(TRACE_NAME16)
+  traced(TRACE_NAME18)
 ], CachingConfigStore.prototype, "getPrivoConfiguration", 1);
 __decorateClass([
-  traced(TRACE_NAME16)
+  traced(TRACE_NAME18)
 ], CachingConfigStore.prototype, "getModerationConfig", 1);
 
 // ../aux-records/ModerationController.ts
-var TRACE_NAME17 = "ModerationController";
+var TRACE_NAME19 = "ModerationController";
 var ModerationController = class {
   constructor(store, config2, messenger, jobProvider) {
     this._store = store;
@@ -129347,13 +130993,13 @@ var ModerationController = class {
   }
 };
 __decorateClass([
-  traced(TRACE_NAME17)
+  traced(TRACE_NAME19)
 ], ModerationController.prototype, "reportInst", 1);
 __decorateClass([
-  traced(TRACE_NAME17)
+  traced(TRACE_NAME19)
 ], ModerationController.prototype, "scheduleModerationScans", 1);
 __decorateClass([
-  traced(TRACE_NAME17)
+  traced(TRACE_NAME19)
 ], ModerationController.prototype, "scanFile", 1);
 
 // ../aux-records/ModerationConfiguration.ts
@@ -129440,7 +131086,7 @@ var moderationSchema = z.object({
   }).describe("The moderation jobs that are enabled.").optional()
 });
 
-// ../aux-records/NotificationMessenger.ts
+// ../aux-records/SystemNotificationMessenger.ts
 var slackSchema = z.object({
   webhookUrl: z.string().describe(
     "The Slack webhook URL that should be used to send records notification messages."
@@ -129539,9 +131185,9 @@ var util3 = __toESM(require("node:util"), 1);
 var is_key_object_default = (obj) => util3.types.isKeyObject(obj);
 
 // ../../node_modules/.pnpm/jose@5.4.0/node_modules/jose/dist/node/esm/runtime/webcrypto.js
-var crypto4 = __toESM(require("node:crypto"), 1);
+var crypto5 = __toESM(require("node:crypto"), 1);
 var util4 = __toESM(require("node:util"), 1);
-var webcrypto3 = crypto4.webcrypto;
+var webcrypto3 = crypto5.webcrypto;
 var webcrypto_default = webcrypto3;
 var isCryptoKey = (key) => util4.types.isCryptoKey(key);
 
@@ -129717,11 +131363,11 @@ function isObject4(input2) {
 }
 
 // ../../node_modules/.pnpm/jose@5.4.0/node_modules/jose/dist/node/esm/runtime/ecdhes.js
-var import_node_crypto6 = require("node:crypto");
+var import_node_crypto7 = require("node:crypto");
 var import_node_util3 = require("node:util");
 
 // ../../node_modules/.pnpm/jose@5.4.0/node_modules/jose/dist/node/esm/runtime/get_named_curve.js
-var import_node_crypto5 = require("node:crypto");
+var import_node_crypto6 = require("node:crypto");
 var namedCurveToJOSE = (namedCurve) => {
   switch (namedCurve) {
     case "prime256v1":
@@ -129739,7 +131385,7 @@ var namedCurveToJOSE = (namedCurve) => {
 var getNamedCurve2 = (kee, raw) => {
   let key;
   if (isCryptoKey(kee)) {
-    key = import_node_crypto5.KeyObject.from(kee);
+    key = import_node_crypto6.KeyObject.from(kee);
   } else if (is_key_object_default(kee)) {
     key = kee;
   } else {
@@ -129769,15 +131415,15 @@ var getNamedCurve2 = (kee, raw) => {
 var get_named_curve_default = getNamedCurve2;
 
 // ../../node_modules/.pnpm/jose@5.4.0/node_modules/jose/dist/node/esm/runtime/ecdhes.js
-var generateKeyPair = (0, import_node_util3.promisify)(import_node_crypto6.generateKeyPair);
+var generateKeyPair = (0, import_node_util3.promisify)(import_node_crypto7.generateKeyPair);
 
 // ../../node_modules/.pnpm/jose@5.4.0/node_modules/jose/dist/node/esm/runtime/pbes2kw.js
 var import_node_util4 = require("node:util");
-var import_node_crypto7 = require("node:crypto");
-var pbkdf2 = (0, import_node_util4.promisify)(import_node_crypto7.pbkdf2);
+var import_node_crypto8 = require("node:crypto");
+var pbkdf2 = (0, import_node_util4.promisify)(import_node_crypto8.pbkdf2);
 
 // ../../node_modules/.pnpm/jose@5.4.0/node_modules/jose/dist/node/esm/runtime/rsaes.js
-var import_node_crypto8 = require("node:crypto");
+var import_node_crypto9 = require("node:crypto");
 var import_node_util5 = require("node:util");
 
 // ../../node_modules/.pnpm/jose@5.4.0/node_modules/jose/dist/node/esm/runtime/check_key_length.js
@@ -129789,12 +131435,12 @@ var check_key_length_default = (key, alg) => {
 };
 
 // ../../node_modules/.pnpm/jose@5.4.0/node_modules/jose/dist/node/esm/runtime/rsaes.js
-var RSA1_5 = (0, import_node_util5.deprecate)(() => import_node_crypto8.constants.RSA_PKCS1_PADDING, 'The RSA1_5 "alg" (JWE Algorithm) is deprecated and will be removed in the next major revision.');
+var RSA1_5 = (0, import_node_util5.deprecate)(() => import_node_crypto9.constants.RSA_PKCS1_PADDING, 'The RSA1_5 "alg" (JWE Algorithm) is deprecated and will be removed in the next major revision.');
 
 // ../../node_modules/.pnpm/jose@5.4.0/node_modules/jose/dist/node/esm/runtime/asn1.js
-var import_node_crypto9 = require("node:crypto");
+var import_node_crypto10 = require("node:crypto");
 var import_node_buffer2 = require("node:buffer");
-var fromPKCS8 = (pem) => (0, import_node_crypto9.createPrivateKey)({
+var fromPKCS8 = (pem) => (0, import_node_crypto10.createPrivateKey)({
   key: import_node_buffer2.Buffer.from(pem.replace(/(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g, ""), "base64"),
   type: "pkcs8",
   format: "der"
@@ -129885,7 +131531,7 @@ var validate_crit_default = validateCrit;
 var unprotected = Symbol();
 
 // ../../node_modules/.pnpm/jose@5.4.0/node_modules/jose/dist/node/esm/runtime/verify.js
-var crypto6 = __toESM(require("node:crypto"), 1);
+var crypto7 = __toESM(require("node:crypto"), 1);
 var import_node_util7 = require("node:util");
 
 // ../../node_modules/.pnpm/jose@5.4.0/node_modules/jose/dist/node/esm/runtime/dsa_digest.js
@@ -129912,10 +131558,10 @@ function dsaDigest(alg) {
 }
 
 // ../../node_modules/.pnpm/jose@5.4.0/node_modules/jose/dist/node/esm/runtime/node_key.js
-var import_node_crypto10 = require("node:crypto");
+var import_node_crypto11 = require("node:crypto");
 var PSS = {
-  padding: import_node_crypto10.constants.RSA_PKCS1_PSS_PADDING,
-  saltLength: import_node_crypto10.constants.RSA_PSS_SALTLEN_DIGEST
+  padding: import_node_crypto11.constants.RSA_PKCS1_PSS_PADDING,
+  saltLength: import_node_crypto11.constants.RSA_PSS_SALTLEN_DIGEST
 };
 var ecCurveAlgMap = /* @__PURE__ */ new Map([
   ["ES256", "P-256"],
@@ -129975,7 +131621,7 @@ function keyForCrypto(alg, key) {
 }
 
 // ../../node_modules/.pnpm/jose@5.4.0/node_modules/jose/dist/node/esm/runtime/sign.js
-var crypto5 = __toESM(require("node:crypto"), 1);
+var crypto6 = __toESM(require("node:crypto"), 1);
 var import_node_util6 = require("node:util");
 
 // ../../node_modules/.pnpm/jose@5.4.0/node_modules/jose/dist/node/esm/runtime/hmac_digest.js
@@ -129993,30 +131639,30 @@ function hmacDigest(alg) {
 }
 
 // ../../node_modules/.pnpm/jose@5.4.0/node_modules/jose/dist/node/esm/runtime/get_sign_verify_key.js
-var import_node_crypto11 = require("node:crypto");
+var import_node_crypto12 = require("node:crypto");
 function getSignVerifyKey(alg, key, usage) {
   if (key instanceof Uint8Array) {
     if (!alg.startsWith("HS")) {
       throw new TypeError(invalid_key_input_default(key, ...types3));
     }
-    return (0, import_node_crypto11.createSecretKey)(key);
+    return (0, import_node_crypto12.createSecretKey)(key);
   }
-  if (key instanceof import_node_crypto11.KeyObject) {
+  if (key instanceof import_node_crypto12.KeyObject) {
     return key;
   }
   if (isCryptoKey(key)) {
     checkSigCryptoKey(key, alg, usage);
-    return import_node_crypto11.KeyObject.from(key);
+    return import_node_crypto12.KeyObject.from(key);
   }
   throw new TypeError(invalid_key_input_default(key, ...types3, "Uint8Array"));
 }
 
 // ../../node_modules/.pnpm/jose@5.4.0/node_modules/jose/dist/node/esm/runtime/sign.js
-var oneShotSign = (0, import_node_util6.promisify)(crypto5.sign);
+var oneShotSign = (0, import_node_util6.promisify)(crypto6.sign);
 var sign2 = async (alg, key, data) => {
   const keyObject = getSignVerifyKey(alg, key, "sign");
   if (alg.startsWith("HS")) {
-    const hmac6 = crypto5.createHmac(hmacDigest(alg), keyObject);
+    const hmac6 = crypto6.createHmac(hmacDigest(alg), keyObject);
     hmac6.update(data);
     return hmac6.digest();
   }
@@ -130025,7 +131671,7 @@ var sign2 = async (alg, key, data) => {
 var sign_default = sign2;
 
 // ../../node_modules/.pnpm/jose@5.4.0/node_modules/jose/dist/node/esm/runtime/verify.js
-var oneShotVerify = (0, import_node_util7.promisify)(crypto6.verify);
+var oneShotVerify = (0, import_node_util7.promisify)(crypto7.verify);
 
 // ../../node_modules/.pnpm/jose@5.4.0/node_modules/jose/dist/node/esm/lib/epoch.js
 var epoch_default = (date) => Math.floor(date.getTime() / 1e3);
@@ -130278,12 +131924,12 @@ if (typeof navigator === "undefined" || !navigator.userAgent?.startsWith?.("Mozi
 }
 
 // ../../node_modules/.pnpm/jose@5.4.0/node_modules/jose/dist/node/esm/runtime/generate.js
-var import_node_crypto12 = require("node:crypto");
+var import_node_crypto13 = require("node:crypto");
 var import_node_util8 = require("node:util");
-var generate2 = (0, import_node_util8.promisify)(import_node_crypto12.generateKeyPair);
+var generate2 = (0, import_node_util8.promisify)(import_node_crypto13.generateKeyPair);
 
 // ../aux-records/LoomController.ts
-var TRACE_NAME18 = "LoomController";
+var TRACE_NAME20 = "LoomController";
 var LoomController = class {
   constructor(options) {
     this._policies = options.policies;
@@ -130368,7 +132014,7 @@ var LoomController = class {
   }
 };
 __decorateClass([
-  traced(TRACE_NAME18)
+  traced(TRACE_NAME20)
 ], LoomController.prototype, "getToken", 1);
 
 // ../aux-records/PrivoConfiguration.ts
@@ -130915,10 +132561,6 @@ var serverConfigSchema = z.object({
   telemetry: telemetrySchema.describe(
     "Options for configuring telemetry. If omitted, then telemetry will not be enabled."
   ).optional(),
-  // auth: authSchema
-  //     .describe('Authentication configuration options.')
-  //     .optional()
-  //     .default({}),
   subscriptions: subscriptionConfigSchema.describe(
     "The default subscription configuration. If omitted, then subscription features will be disabled."
   ).optional(),
@@ -130926,7 +132568,7 @@ var serverConfigSchema = z.object({
     "Stripe options. If omitted, then Stripe features will be disabled."
   ).optional(),
   notifications: notificationsSchema.describe(
-    "Notification configuration options. If omitted, then server notifications will be disabled."
+    "System notification configuration options. Used to send messages for various events like user inst reports and com ID requests. If omitted, then server notifications will be disabled."
   ).optional(),
   moderation: moderationSchema.describe(
     "Moderation configuration options. If omitted, then moderation features will be disabled unless overridden in the database."
@@ -130934,6 +132576,19 @@ var serverConfigSchema = z.object({
   webhooks: webhooksSchema.describe(
     "Webhook configuration options. If omitted, then webhook features will be disabled."
   ).optional(),
+  webPush: z.object({
+    vapidSubject: z.string().describe(
+      "The subject that should be used for sending web push notifications. You can generate VAPID keys using https://www.npmjs.com/package/web-push"
+    ).min(1),
+    vapidPublicKey: z.string().describe(
+      "The public key that should be used for sending web push notifications. You can generate VAPID keys using https://www.npmjs.com/package/web-push"
+    ).min(1),
+    vapidPrivateKey: z.string().describe(
+      "The private key that should be used for sending web push notifications. You can generate VAPID keys using https://www.npmjs.com/package/web-push"
+    ).min(1)
+  }).describe(
+    "Web Push configuration options. If omitted, then web push notifications will be disabled."
+  ).optional(),
   meta: z.object({
     apiOrigin: z.string().describe("The HTTP origin that the API is available at."),
     websocketOrigin: z.string().describe(
@@ -130947,391 +132602,6 @@ var serverConfigSchema = z.object({
   ).optional()
 });
 
-// ../aux-records/crud/CrudRecordsController.ts
-var TRACE_NAME19 = "CrudRecordsController";
-var CrudRecordsController = class {
-  get config() {
-    return this._config;
-  }
-  /**
-   * Gets the name of the controller.
-   */
-  get name() {
-    return this._name;
-  }
-  get policies() {
-    return this._policies;
-  }
-  get store() {
-    return this._store;
-  }
-  /**
-   * Gets the kind of resources that this controller is for.
-   */
-  get resourceKind() {
-    return this._resourceKind;
-  }
-  constructor(config2) {
-    this._name = config2.name;
-    this._store = config2.store;
-    this._policies = config2.policies;
-    this._config = config2.config;
-    this._resourceKind = config2.resourceKind;
-  }
-  async recordItem(request2) {
-    try {
-      const contextResult = await this._policies.constructAuthorizationContext({
-        recordKeyOrRecordName: request2.recordKeyOrRecordName,
-        userId: request2.userId
-      });
-      if (contextResult.success === false) {
-        return contextResult;
-      }
-      const recordName = contextResult.context.recordName;
-      const existingItem = await this._store.getItemByAddress(
-        recordName,
-        request2.item.address
-      );
-      let resourceMarkers;
-      let action2 = existingItem ? "update" : "create";
-      let authorization;
-      if (action2 === "update") {
-        const existingMarkers = existingItem.markers;
-        resourceMarkers = request2.item.markers ?? existingMarkers;
-        action2 = "update";
-        authorization = await this._policies.authorizeUserAndInstancesForResources(
-          contextResult.context,
-          {
-            userId: request2.userId,
-            instances: request2.instances,
-            resources: [
-              {
-                resourceKind: this._resourceKind,
-                resourceId: existingItem.address,
-                action: action2,
-                markers: resourceMarkers
-              },
-              ...getMarkerResourcesForUpdate(
-                existingMarkers,
-                request2.item.markers
-              )
-            ]
-          }
-        );
-        if (authorization.success === false) {
-          return authorization;
-        }
-      } else {
-        resourceMarkers = request2.item.markers;
-        authorization = await this._policies.authorizeUserAndInstancesForResources(
-          contextResult.context,
-          {
-            userId: request2.userId,
-            instances: request2.instances,
-            resources: [
-              {
-                resourceKind: this._resourceKind,
-                resourceId: request2.item.address,
-                action: action2,
-                markers: resourceMarkers
-              },
-              ...getMarkerResourcesForCreation(
-                resourceMarkers
-              )
-            ]
-          }
-        );
-        if (authorization.success === false) {
-          return authorization;
-        }
-      }
-      if (!resourceMarkers) {
-        return {
-          success: false,
-          errorCode: "invalid_request",
-          errorMessage: "The item must have markers."
-        };
-      }
-      const item = this._transformInputItem(request2.item);
-      const subscriptionResult = await this._checkSubscriptionMetrics(
-        action2,
-        contextResult.context,
-        authorization,
-        item
-      );
-      if (subscriptionResult.success === false) {
-        return subscriptionResult;
-      }
-      await this._store.putItem(recordName, item);
-      return {
-        success: true,
-        recordName,
-        address: item.address
-      };
-    } catch (err) {
-      const span = trace.getActiveSpan();
-      span?.recordException(err);
-      span?.setStatus({ code: SpanStatusCode.ERROR });
-      console.error(`[${this._name}] Error recording item:`, err);
-      return {
-        success: false,
-        errorCode: "server_error",
-        errorMessage: "A server error occurred."
-      };
-    }
-  }
-  async getItem(request2) {
-    try {
-      const baseRequest = {
-        recordKeyOrRecordName: request2.recordName,
-        userId: request2.userId,
-        instances: request2.instances
-      };
-      const context = await this._policies.constructAuthorizationContext(
-        baseRequest
-      );
-      if (context.success === false) {
-        return context;
-      }
-      const result = await this._store.getItemByAddress(
-        context.context.recordName,
-        request2.address
-      );
-      if (!result) {
-        return {
-          success: false,
-          errorCode: "data_not_found",
-          errorMessage: "The item was not found."
-        };
-      }
-      const markers = result.markers;
-      const authorization = await this._policies.authorizeUserAndInstances(
-        context.context,
-        {
-          userId: request2.userId,
-          instances: request2.instances,
-          resourceKind: this._resourceKind,
-          resourceId: request2.address,
-          action: "read",
-          markers
-        }
-      );
-      if (authorization.success === false) {
-        return authorization;
-      }
-      return {
-        success: true,
-        item: this._convertItemToResult(result, context.context)
-      };
-    } catch (err) {
-      const span = trace.getActiveSpan();
-      span?.recordException(err);
-      span?.setStatus({ code: SpanStatusCode.ERROR });
-      console.error(`[${this._name}] Error getting item:`, err);
-      return {
-        success: false,
-        errorCode: "server_error",
-        errorMessage: "A server error occurred."
-      };
-    }
-  }
-  async eraseItem(request2) {
-    try {
-      const context = await this._policies.constructAuthorizationContext({
-        recordKeyOrRecordName: request2.recordName,
-        userId: request2.userId
-      });
-      if (context.success === false) {
-        return context;
-      }
-      const result = await this._store.getItemByAddress(
-        context.context.recordName,
-        request2.address
-      );
-      if (!result) {
-        return {
-          success: false,
-          errorCode: "data_not_found",
-          errorMessage: "The item was not found."
-        };
-      }
-      const markers = result.markers;
-      const authorization = await this._policies.authorizeUserAndInstances(
-        context.context,
-        {
-          userId: request2.userId,
-          instances: request2.instances,
-          resourceKind: this._resourceKind,
-          resourceId: request2.address,
-          action: "delete",
-          markers
-        }
-      );
-      if (authorization.success === false) {
-        return authorization;
-      }
-      const recordName = context.context.recordName;
-      const subscriptionResult = await this._checkSubscriptionMetrics(
-        "delete",
-        context.context,
-        authorization
-      );
-      if (subscriptionResult.success === false) {
-        return subscriptionResult;
-      }
-      await this._store.deleteItem(recordName, request2.address);
-      return {
-        success: true
-      };
-    } catch (err) {
-      const span = trace.getActiveSpan();
-      span?.recordException(err);
-      span?.setStatus({ code: SpanStatusCode.ERROR });
-      console.error(`[${this._name}] Error erasing item:`, err);
-      return {
-        success: false,
-        errorCode: "server_error",
-        errorMessage: "A server error occurred."
-      };
-    }
-  }
-  async listItems(request2) {
-    try {
-      const baseRequest = {
-        recordKeyOrRecordName: request2.recordName,
-        userId: request2.userId,
-        instances: request2.instances
-      };
-      const context = await this._policies.constructAuthorizationContext(
-        baseRequest
-      );
-      if (context.success === false) {
-        return context;
-      }
-      const authorization = await this._policies.authorizeUserAndInstances(
-        context.context,
-        {
-          userId: request2.userId,
-          instances: request2.instances,
-          resourceKind: this._resourceKind,
-          action: "list",
-          markers: [ACCOUNT_MARKER]
-        }
-      );
-      if (authorization.success === false) {
-        return authorization;
-      }
-      const result2 = await this._store.listItems(
-        context.context.recordName,
-        request2.startingAddress
-      );
-      return {
-        success: true,
-        recordName: context.context.recordName,
-        items: result2.items.map(
-          (item) => this._convertItemToResult(item, context.context)
-        ),
-        totalCount: result2.totalCount
-      };
-    } catch (err) {
-      const span = trace.getActiveSpan();
-      span?.recordException(err);
-      span?.setStatus({ code: SpanStatusCode.ERROR });
-      console.error(`[${this._name}] Error listing items:`, err);
-      return {
-        success: false,
-        errorCode: "server_error",
-        errorMessage: "A server error occurred."
-      };
-    }
-  }
-  async listItemsByMarker(request2) {
-    try {
-      const baseRequest = {
-        recordKeyOrRecordName: request2.recordName,
-        userId: request2.userId,
-        instances: request2.instances
-      };
-      const context = await this._policies.constructAuthorizationContext(
-        baseRequest
-      );
-      if (context.success === false) {
-        return context;
-      }
-      const authorization = await this._policies.authorizeUserAndInstances(
-        context.context,
-        {
-          userId: request2.userId,
-          instances: request2.instances,
-          resourceKind: this._resourceKind,
-          action: "list",
-          markers: [request2.marker]
-        }
-      );
-      if (authorization.success === false) {
-        return authorization;
-      }
-      const result2 = await this._store.listItemsByMarker({
-        recordName: context.context.recordName,
-        startingAddress: request2.startingAddress,
-        marker: request2.marker,
-        sort: request2.sort
-      });
-      return {
-        success: true,
-        recordName: context.context.recordName,
-        items: result2.items.map(
-          (item) => this._convertItemToResult(item, context.context)
-        ),
-        totalCount: result2.totalCount
-      };
-    } catch (err) {
-      const span = trace.getActiveSpan();
-      span?.recordException(err);
-      span?.setStatus({ code: SpanStatusCode.ERROR });
-      console.error(`[${this._name}] Error listing items:`, err);
-      return {
-        success: false,
-        errorCode: "server_error",
-        errorMessage: "A server error occurred."
-      };
-    }
-  }
-  /**
-   * Converts the given item to a version that is able to be returned to clients.
-   * Can be overriden to ensure that some fields are not returned.
-   * @param item The item that should be converted.
-   * @param context The authorization context.
-   * @returns The converted item.
-   */
-  _convertItemToResult(item, context) {
-    return item;
-  }
-  /**
-   * Transforms the given input item and returns the transformed item.
-   * Useful for transforming items before they are stored.
-   * @param item The item that should be transformed.
-   */
-  _transformInputItem(item) {
-    return item;
-  }
-};
-__decorateClass([
-  traced(TRACE_NAME19)
-], CrudRecordsController.prototype, "recordItem", 1);
-__decorateClass([
-  traced(TRACE_NAME19)
-], CrudRecordsController.prototype, "getItem", 1);
-__decorateClass([
-  traced(TRACE_NAME19)
-], CrudRecordsController.prototype, "eraseItem", 1);
-__decorateClass([
-  traced(TRACE_NAME19)
-], CrudRecordsController.prototype, "listItems", 1);
-__decorateClass([
-  traced(TRACE_NAME19)
-], CrudRecordsController.prototype, "listItemsByMarker", 1);
-
 // ../aux-records/webhooks/WebhookEnvironment.ts
 var STORED_AUX_VERSION_1_SCHEMA = z.object({
   version: z.literal(1),
@@ -131395,7 +132665,7 @@ var import_tweetnacl8 = __toESM(require_nacl_fast());
 var import_base64_js14 = __toESM(require_base64_js());
 
 // ../aux-records/webhooks/WebhookRecordsController.ts
-var TRACE_NAME20 = "WebhookRecordsController";
+var TRACE_NAME21 = "WebhookRecordsController";
 var WebhookRecordsController = class extends CrudRecordsController {
   constructor(config2) {
     super({
@@ -131568,6 +132838,7 @@ var WebhookRecordsController = class extends CrudRecordsController {
           errorMessage: "Invalid webhook target. The targeted record does not contain a valid AUX."
         };
       }
+      let sessionUserId;
       let sessionKey;
       let connectionKey;
       if (webhook.userId) {
@@ -131579,6 +132850,7 @@ var WebhookRecordsController = class extends CrudRecordsController {
           lifetimeMs: checkMetrics.features.tokenLifetimeMs ?? 5 * 60 * 1e3
         });
         if (issueSessionResult.success === true) {
+          sessionUserId = issueSessionResult.userId;
           sessionKey = issueSessionResult.sessionKey;
           connectionKey = issueSessionResult.connectionKey;
         } else {
@@ -131599,6 +132871,8 @@ var WebhookRecordsController = class extends CrudRecordsController {
         recordName: stateRecordName,
         inst: stateInstName,
         request: request2.request,
+        requestUserId: request2.userId,
+        sessionUserId,
         sessionKey,
         connectionKey,
         options
@@ -131614,6 +132888,7 @@ var WebhookRecordsController = class extends CrudRecordsController {
           runId,
           version: 1,
           request: request2.request,
+          requestUserId: request2.userId,
           response: result.success === true ? result.response : null,
           logs: result.success === true ? result.logs : [],
           state,
@@ -131890,23 +133165,20 @@ var WebhookRecordsController = class extends CrudRecordsController {
   }
 };
 __decorateClass([
-  traced(TRACE_NAME20)
+  traced(TRACE_NAME21)
 ], WebhookRecordsController.prototype, "handleWebhook", 1);
 __decorateClass([
-  traced(TRACE_NAME20)
+  traced(TRACE_NAME21)
 ], WebhookRecordsController.prototype, "listWebhookRuns", 1);
 __decorateClass([
-  traced(TRACE_NAME20)
+  traced(TRACE_NAME21)
 ], WebhookRecordsController.prototype, "getWebhookRun", 1);
 __decorateClass([
-  traced(TRACE_NAME20)
+  traced(TRACE_NAME21)
 ], WebhookRecordsController.prototype, "_checkSubscriptionMetrics", 1);
 
-// ../aux-records/crud/MemoryCrudRecordsStore.ts
-var import_lodash25 = __toESM(require_lodash());
-
 // ../aux-records/webhooks/MemoryWebhookRecordsStore.ts
-var import_lodash26 = __toESM(require_lodash());
+var import_lodash27 = __toESM(require_lodash());
 
 // cli.ts
 var import_node_stream3 = require("node:stream");
@@ -132169,7 +133441,7 @@ function expand(template, context) {
     return template.replace(/\/$/, "");
   }
 }
-function parse2(options) {
+function parse3(options) {
   let method = options.method.toUpperCase();
   let url2 = (options.url || "/").replace(/:([a-z]\w+)/g, "{$1}");
   let headers = Object.assign({}, options.headers);
@@ -132233,7 +133505,7 @@ function parse2(options) {
   );
 }
 function endpointWithDefaults(defaults2, route, options) {
-  return parse2(merge5(defaults2, route, options));
+  return parse3(merge5(defaults2, route, options));
 }
 function withDefaults(oldDefaults, newDefaults) {
   const DEFAULTS2 = merge5(oldDefaults, newDefaults);
@@ -132242,7 +133514,7 @@ function withDefaults(oldDefaults, newDefaults) {
     DEFAULTS: DEFAULTS2,
     defaults: withDefaults.bind(null, DEFAULTS2),
     merge: merge5.bind(null, DEFAULTS2),
-    parse: parse2
+    parse: parse3
   });
 }
 var endpoint = withDefaults(null, DEFAULTS);
@@ -136211,11 +137483,11 @@ __export(crypto_node_exports, {
   convertPrivateKey: () => convertPrivateKey
 });
 __reExport(crypto_node_exports, require("node:crypto"));
-var import_node_crypto13 = require("node:crypto");
+var import_node_crypto14 = require("node:crypto");
 function convertPrivateKey(privateKey) {
   if (!isPkcs1(privateKey))
     return privateKey;
-  return (0, import_node_crypto13.createPrivateKey)(privateKey).export({
+  return (0, import_node_crypto14.createPrivateKey)(privateKey).export({
     type: "pkcs8",
     format: "pem"
   });
@@ -138417,8 +139689,8 @@ var OAuthApp = class {
 };
 
 // ../../node_modules/.pnpm/@octokit+webhooks-methods@5.1.0/node_modules/@octokit/webhooks-methods/dist-node/index.js
-var import_node_crypto14 = require("node:crypto");
 var import_node_crypto15 = require("node:crypto");
+var import_node_crypto16 = require("node:crypto");
 var import_node_buffer3 = require("node:buffer");
 var VERSION19 = "5.1.0";
 async function sign3(secret, payload) {
@@ -138431,7 +139703,7 @@ async function sign3(secret, payload) {
     throw new TypeError("[@octokit/webhooks-methods] payload must be a string");
   }
   const algorithm = "sha256";
-  return `${algorithm}=${(0, import_node_crypto14.createHmac)(algorithm, secret).update(payload).digest("hex")}`;
+  return `${algorithm}=${(0, import_node_crypto15.createHmac)(algorithm, secret).update(payload).digest("hex")}`;
 }
 sign3.VERSION = VERSION19;
 async function verify3(secret, eventPayload, signature) {
@@ -138450,7 +139722,7 @@ async function verify3(secret, eventPayload, signature) {
   if (signatureBuffer.length !== verificationBuffer.length) {
     return false;
   }
-  return (0, import_node_crypto15.timingSafeEqual)(signatureBuffer, verificationBuffer);
+  return (0, import_node_crypto16.timingSafeEqual)(signatureBuffer, verificationBuffer);
 }
 verify3.VERSION = VERSION19;
 
@@ -139706,7 +140978,7 @@ function parseStringResponse(result, parsers12, texts, trim2 = true) {
         }
         return lines[i2 + offset2];
       };
-      parsers12.some(({ parse: parse3 }) => parse3(line, result));
+      parsers12.some(({ parse: parse4 }) => parse4(line, result));
     }
   });
   return result;
@@ -144036,7 +145308,7 @@ var config = new Conf({
   projectName: "casualos-cli"
 });
 var program2 = new Command();
-program2.name("casualos").description("A CLI for CasualOS").version("v3.3.11-alpha.11060020867").option(
+program2.name("casualos").description("A CLI for CasualOS").version("v3.3.11").option(
   "-e, --endpoint <url>",
   "The endpoint to use for queries. Can be used to override the current endpoint."
 );